@patronage/software-factory 1.0.0-alpha.35 → 1.0.0-alpha.36

package/dist/index.js

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./chunk-pbuEa-1d.js";
+import { t as __exportAll } from "./chunk-DrSxFLj_.js";
+import { createRequire } from "node:module";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -18,9 +19,10 @@ import { Worker } from "node:worker_threads";
 import { parse } from "yaml";
 import http from "node:http";
 import { pathToFileURL } from "node:url";
+import { choice, noul, score } from "@typesafe-ai/sdk";
 //#region package.json
 var name = "@patronage/software-factory";
-var version = "1.0.0-alpha.35";
+var version = "1.0.0-alpha.36";
 //#endregion
 //#region src/cli-entry.ts
 /**
@@ -1517,6 +1519,15 @@ function normalizeRepositoryIdentity(repository) {
 		owner: repository.owner.toLowerCase()
 	};
 }
+function normalizeRepositorySlug(slug) {
+	const segments = slug.split("/");
+	const [owner, name] = segments;
+	if (!(owner && name) || segments.length !== 2) return;
+	return repositorySlug(normalizeRepositoryIdentity({
+		name,
+		owner
+	}));
+}
 const GITHUB_HOSTNAME = "github.com";
 const SCP_GITHUB_REMOTE_PATTERN = /^(?:[^@\s]+@)?github\.com:(?<path>[^\s]+)$/iu;
 function githubRepositoryPath(remoteUrl) {
@@ -2344,7 +2355,7 @@ const concurrentWriteMessage = (output, cause) => {
 const LOCK_REMOVAL_INSTRUCTION = "if that writer is gone, remove the file and retry";
 const DEFAULT_LOCK_WAIT_MS = 5e3;
 const LOCK_POLL_MS = 20;
-const errorCode = (error) => error?.code;
+const errorCode$1 = (error) => error?.code;
 const sleepSync = (ms) => {
 	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 };
@@ -2383,7 +2394,7 @@ const describeHeldProofLock = (output, fs = nodeProofWriteFileSystem, now = Date
 	try {
 		({mtimeMs} = fs.statSync(lockPath));
 	} catch (error) {
-		if (errorCode(error) === "ENOENT") return;
+		if (errorCode$1(error) === "ENOENT") return;
 		throw error;
 	}
 	let contents = "";
@@ -2414,7 +2425,7 @@ const acquireProofLock = (output, fs, { lockWaitMs = DEFAULT_LOCK_WAIT_MS, repor
 			fs.closeSync(fs.openSync(lockPath, "wx"));
 			return true;
 		} catch (error) {
-			if (errorCode(error) !== "EEXIST") throw error;
+			if (errorCode$1(error) !== "EEXIST") throw error;
 			return false;
 		}
 	};
@@ -2432,7 +2443,7 @@ const acquireProofLock = (output, fs, { lockWaitMs = DEFAULT_LOCK_WAIT_MS, repor
 			try {
 				current = fs.readFileSync(lockPath, "utf-8");
 			} catch (error) {
-				report(errorCode(error) === "ENOENT" ? `pr-proof: lock ${lockPath} was removed by someone else before this writer released it; nothing to release.` : `pr-proof: lock ${lockPath} could not be read on release (${String(error)}); left in place.`);
+				report(errorCode$1(error) === "ENOENT" ? `pr-proof: lock ${lockPath} was removed by someone else before this writer released it; nothing to release.` : `pr-proof: lock ${lockPath} could not be read on release (${String(error)}); left in place.`);
 				return;
 			}
 			if (current !== mine) {
@@ -4005,6 +4016,112 @@ function tryUserConfig(input = {}) {
 function formatUserConfigError(configPath, error) {
 	return `User config is invalid: ${configPath}: ${formatZodIssues(error)}`;
 }
+//#endregion
+//#region src/hq-origin-policy.ts
+/**
+* Where the HQ Access service token may be sent, decided once.
+*
+* A request that carries the token goes only to an HTTPS origin with no
+* embedded credentials that the operator listed, exactly, in
+* `hqAllowedOrigins` in the operator user config. Committed repository data
+* and the environment can name an origin; only the operator can authorize one
+* (ADR 0015). HQ ingest and the Jev client both call this module, so the two
+* cannot drift apart: one protocol rule, one reader, one parser.
+*
+* The reader is bounded. A config path that is a FIFO, a huge file, or a disk
+* that hangs answers "no origin is authorized" within the caller's deadline
+* instead of holding a gate or a lint run open.
+*/
+/** Largest operator config or profile file the HQ readers will open. */
+const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
+const remainingMs = (deadline) => Math.max(0, deadline - performance.now());
+const settleWithin = async (operation, budgetMs) => {
+	const settleOperation = async () => {
+		try {
+			return {
+				status: "fulfilled",
+				value: await operation
+			};
+		} catch (error) {
+			return {
+				error,
+				status: "rejected"
+			};
+		}
+	};
+	const timeoutAbort = new AbortController();
+	const settleTimeout = async () => {
+		try {
+			await setTimeout$1(Math.max(0, budgetMs), void 0, { signal: timeoutAbort.signal });
+		} catch {}
+		return { status: "timed-out" };
+	};
+	const result = await Promise.race([settleOperation(), settleTimeout()]);
+	timeoutAbort.abort();
+	return result;
+};
+const readBoundedTextFile = async (filePath, deadline, maxBytes = MAX_HQ_CONFIG_BYTES) => {
+	const metadata = await settleWithin(stat(filePath), remainingMs(deadline));
+	if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.size > maxBytes) return;
+	const budget = remainingMs(deadline);
+	if (budget <= 0) return;
+	const abort = new AbortController();
+	const abortTimer = setTimeout(() => abort.abort(), budget);
+	const contents = await settleWithin(readFile(filePath, {
+		encoding: "utf-8",
+		signal: abort.signal
+	}), budget);
+	clearTimeout(abortTimer);
+	if (contents.status !== "fulfilled" || Buffer.byteLength(contents.value, "utf-8") > maxBytes) return;
+	return contents.value;
+};
+/**
+* The protocol rule: an `https:` URL with no username and no password. There
+* is no `http:` exception, loopback included. The caller composes its own path
+* onto the returned URL's `origin`.
+*/
+const validatedHqOrigin = (value) => {
+	try {
+		const endpoint = new URL(value);
+		if (endpoint.protocol !== "https:" || endpoint.username !== "" || endpoint.password !== "") return;
+		return endpoint;
+	} catch {
+		return;
+	}
+};
+/**
+* The operator's `hqAllowedOrigins`, from the text of the operator user
+* config. A file that is not JSON or not a valid user config authorizes
+* nothing: the list is empty, never partly read.
+*/
+const hqAllowedOriginsFromConfigText = (text) => {
+	try {
+		const parsed = factoryUserConfigSchema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data.hqAllowedOrigins ?? [] : [];
+	} catch {
+		return [];
+	}
+};
+/**
+* The operator's `hqAllowedOrigins`, read from the operator user config within
+* `deadline` (a `performance.now()` time). A missing, unreadable, oversized or
+* invalid file, or one that does not answer in time, authorizes nothing.
+*/
+const loadHqAllowedOrigins = async (env, deadline) => {
+	let configPath;
+	try {
+		configPath = defaultUserConfigPath(env);
+	} catch {
+		return [];
+	}
+	const contents = await readBoundedTextFile(configPath, deadline);
+	return contents === void 0 ? [] : hqAllowedOriginsFromConfigText(contents);
+};
+/**
+* The matching rule: the URL's origin must equal one listed origin exactly.
+* No prefix, wildcard, or host-only match.
+*/
+const isHqOriginAuthorized = (allowedOrigins, endpoint) => allowedOrigins.includes(endpoint.origin);
 const DEFAULT_HQ_TRANSPORT_TIMEOUT_MS = 2500;
 const HQ_RETRY_SPOOL_DIRNAME = "hq-retry-spool";
 /**
@@ -4048,7 +4165,6 @@ const SPOOL_REPOSITORY_MARKER = ".repository-identity";
 */
 const HQ_SPOOL_SWEEP_MAX_DEPTH = 4;
 const HQ_SPOOL_STATE_SEGMENTS = ["patronage-factory", "hq-spool"];
-const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
 const MAX_HQ_INGEST_PAYLOAD_BYTES = 256 * 1024;
 const MAX_HQ_REPLAY_ENTRIES = 32;
 const STALE_SPOOL_ARTIFACT_MS = 6e4;
@@ -4442,47 +4558,6 @@ const transportTimeoutFor = (dependencies) => {
 		return DEFAULT_HQ_TRANSPORT_TIMEOUT_MS;
 	}
 };
-const remainingMs = (deadline) => Math.max(0, deadline - performance.now());
-const settleWithin = async (operation, budgetMs) => {
-	const settleOperation = async () => {
-		try {
-			return {
-				status: "fulfilled",
-				value: await operation
-			};
-		} catch (error) {
-			return {
-				error,
-				status: "rejected"
-			};
-		}
-	};
-	const timeoutAbort = new AbortController();
-	const settleTimeout = async () => {
-		try {
-			await setTimeout$1(Math.max(0, budgetMs), void 0, { signal: timeoutAbort.signal });
-		} catch {}
-		return { status: "timed-out" };
-	};
-	const result = await Promise.race([settleOperation(), settleTimeout()]);
-	timeoutAbort.abort();
-	return result;
-};
-const readBoundedTextFile = async (filePath, deadline, maxBytes = MAX_HQ_CONFIG_BYTES) => {
-	const metadata = await settleWithin(stat(filePath), remainingMs(deadline));
-	if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.size > maxBytes) return;
-	const budget = remainingMs(deadline);
-	if (budget <= 0) return;
-	const abort = new AbortController();
-	const abortTimer = setTimeout(() => abort.abort(), budget);
-	const contents = await settleWithin(readFile(filePath, {
-		encoding: "utf-8",
-		signal: abort.signal
-	}), budget);
-	clearTimeout(abortTimer);
-	if (contents.status !== "fulfilled" || Buffer.byteLength(contents.value, "utf-8") > maxBytes) return;
-	return contents.value;
-};
 const readBoundedTextFileNoFollow = async (filePath, deadline, maxBytes) => {
 	const opened = await openWithin(filePath, constants.O_RDONLY + constants.O_NOFOLLOW, remainingMs(deadline));
 	if (opened.status !== "fulfilled") return;
@@ -4503,22 +4578,6 @@ const readBoundedTextFileNoFollow = async (filePath, deadline, maxBytes) => {
 		}
 	};
 };
-const loadAllowedOrigins = async (env, deadline) => {
-	let configPath;
-	try {
-		configPath = defaultUserConfigPath(env);
-	} catch {
-		return [];
-	}
-	const contents = await readBoundedTextFile(configPath, deadline);
-	if (contents === void 0) return [];
-	try {
-		const parsed = factoryUserConfigSchema.safeParse(JSON.parse(contents));
-		return parsed.success ? parsed.data.hqAllowedOrigins ?? [] : [];
-	} catch {
-		return [];
-	}
-};
 const reportDiagnostic = async (dependencies, deadline, message, prefix = "HQ ingest deferred") => {
 	const line = `${prefix}: ${message.replaceAll(/[\r\n]+/gu, " ").trim()}`;
 	let diagnostic;
@@ -4608,15 +4667,6 @@ const loadBoundedPayload = async (input, deadline) => {
 		status: "dropped"
 	} : parseBoundedPayloadText(source);
 };
-const validatedEndpoint = (value) => {
-	try {
-		const endpoint = new URL(value);
-		if (endpoint.protocol !== "https:" || endpoint.username !== "" || endpoint.password !== "") return;
-		return endpoint;
-	} catch {
-		return;
-	}
-};
 /** HQ's ingest boundary, composed onto a profile origin (#318). */
 const HQ_INGEST_PATH = "/api/ingest";
 /**
@@ -4626,7 +4676,7 @@ const HQ_INGEST_PATH = "/api/ingest";
 * the composed href, so replay and origin authorization are unchanged.
 */
 const validatedIngestEndpoint = (value) => {
-	const origin = validatedEndpoint(value);
+	const origin = validatedHqOrigin(value);
 	return origin === void 0 ? void 0 : new URL(HQ_INGEST_PATH, origin.origin);
 };
 const retainRetryEntry = async (layout, entry, dependencies, deadline) => {
@@ -4838,7 +4888,7 @@ const replayCloseoutSpool = async (layout, endpoint, clientId, clientSecret, req
 			if (!await mutateBoundDirectory(spool, spoolIdentity, setupDeadline, async () => unlink(claimPath))) return;
 			continue;
 		}
-		const entryEndpoint = validatedEndpoint(entry.endpoint);
+		const entryEndpoint = validatedHqOrigin(entry.endpoint);
 		if (!entryEndpoint || entryEndpoint.origin !== endpoint.origin) {
 			if (!await mutateBoundDirectory(spool, spoolIdentity, performance.now() + flushBudgetMs, async () => rename(claimPath, `${eventPath}${UNDELIVERABLE_SUFFIX}`))) return;
 			report?.({
@@ -4910,7 +4960,7 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 		await reportDiagnostic(dependencies, setupDeadline, "operator configuration is unavailable", "HQ ingest skipped");
 		return "skipped";
 	}
-	if (!(await loadAllowedOrigins(env, setupDeadline)).includes(endpoint.origin)) {
+	if (!isHqOriginAuthorized(await loadHqAllowedOrigins(env, setupDeadline), endpoint)) {
 		await reportDiagnostic(dependencies, setupDeadline, `endpoint origin ${endpoint.origin} is not authorized by hqAllowedOrigins in the operator user config`, "HQ ingest skipped");
 		return "skipped";
 	}
@@ -5725,14 +5775,7 @@ const deferProjectHqIngestIsolated = async (input, env) => {
 	if (!isIsolatedReadResult(sourcesRead)) return "held";
 	const configSource = sourcesRead.results.config;
 	if (configSource?.status !== "ok" || configSource.source === void 0) return "skipped";
-	let allowedOrigins = [];
-	try {
-		const parsed = factoryUserConfigSchema.safeParse(JSON.parse(configSource.source));
-		allowedOrigins = parsed.success ? parsed.data.hqAllowedOrigins ?? [] : [];
-	} catch {
-		allowedOrigins = [];
-	}
-	if (!allowedOrigins.includes(endpoint.origin)) return "skipped";
+	if (!isHqOriginAuthorized(hqAllowedOriginsFromConfigText(configSource.source), endpoint)) return "skipped";
 	const payloadSource = input.payloadJson ?? (sourcesRead.results.payload?.status === "ok" ? sourcesRead.results.payload.source : void 0);
 	if (payloadSource === void 0) return "held";
 	const projectedPayload = parseBoundedPayloadText(payloadSource);
@@ -5987,7 +6030,7 @@ const canonical = (value) => {
 	if (isRecord$1(value)) return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, canonical(value[key])]));
 	return value;
 };
-const stableStringify$1 = (value) => JSON.stringify(canonical(value));
+const stableStringify$2 = (value) => JSON.stringify(canonical(value));
 const parseLockfile = (content) => {
 	try {
 		const parsed = parse(content);
@@ -6000,7 +6043,7 @@ const parseLockfile = (content) => {
 };
 const nonGraphSections = ({ importers: _importers, packages: _packages, snapshots: _snapshots, ...rest }) => rest;
 const changedSectionKeys = (before, after) => {
-	return [...new Set([...Object.keys(before ?? {}), ...Object.keys(after ?? {})])].filter((key) => stableStringify$1(before?.[key]) !== stableStringify$1(after?.[key]));
+	return [...new Set([...Object.keys(before ?? {}), ...Object.keys(after ?? {})])].filter((key) => stableStringify$2(before?.[key]) !== stableStringify$2(after?.[key]));
 };
 const linkTarget = (importerPath, version) => {
 	if (!version.startsWith("link:")) return;
@@ -6259,7 +6302,7 @@ const computeImpactStampOrThrow = ({ changedFiles, profile, profilePath = "softw
 		unsubscribedPaths: source.unsubscribedPaths
 	};
 	const [baseLock, headLock] = sides.parsed;
-	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeImpactStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"], source.unsubscribedPaths, source.inertPaths);
+	if (stableStringify$2(nonGraphSections(baseLock)) !== stableStringify$2(nonGraphSections(headLock))) return conservativeImpactStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"], source.unsubscribedPaths, source.inertPaths);
 	const delta = {
 		changedImporters: changedSectionKeys(baseLock.importers, headLock.importers),
 		changedPackages: changedSectionKeys(baseLock.packages, headLock.packages),
@@ -15261,9 +15304,9 @@ const buildEpicStructurePayload = (dag) => {
 	};
 };
 /** Stable, key-sorted JSON for content hashing (values already ordered). */
-const stableStringify = (value) => {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+const stableStringify$1 = (value) => {
+	if (Array.isArray(value)) return `[${value.map(stableStringify$1).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify$1(value[key])}`).join(",")}}`;
 	return JSON.stringify(value ?? null);
 };
 /**
@@ -15273,7 +15316,7 @@ const stableStringify = (value) => {
 * supersedes the prior structure wholesale (HQ keeps the latest). This mirrors
 * seed-dev's fixed-eventId idempotency, content-addressed instead of literal.
 */
-const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify(payload)).digest("hex").slice(0, 16)}`;
+const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify$1(payload)).digest("hex").slice(0, 16)}`;
 /**
 * Validates and builds the full `epic-structure` v1 ingest event, ready to POST
 * to `/api/ingest`. Throws {@link EpicStructureValidationError} fail-closed.
@@ -15580,7 +15623,7 @@ async function runHqFlush(args, dependencies = {}) {
 		status: "flushed"
 	};
 }
-const outcomeLine = (outcome) => `[${outcome.status}${outcome.permanent === true ? ", permanent" : ""}] ${outcome.kind} ${outcome.eventId}${outcome.detail === void 0 ? "" : ` — ${outcome.detail}`}`;
+const outcomeLine$1 = (outcome) => `[${outcome.status}${outcome.permanent === true ? ", permanent" : ""}] ${outcome.kind} ${outcome.eventId}${outcome.detail === void 0 ? "" : ` — ${outcome.detail}`}`;
 const orphanLine = (orphan) => `ORPHAN SPOOL: ${orphan.directory} — ${orphan.unlistable > 0 && orphan.pending === 0 ? "could not be inspected" : `${orphan.pending} event(s)`}${orphan.oldestQueuedAt === void 0 ? "" : `, oldest ${orphan.oldestQueuedAt}`}`;
 /**
 * Orphan lines, plus the recovery instruction. This run did not drain these
@@ -15593,7 +15636,7 @@ function renderHqFlush(result) {
 	return `${[
 		`hq:flush ${result.endpoint}`,
 		...result.spools.length === 0 ? ["no spool directory found"] : result.spools.map((spool) => `spool: ${spool}`),
-		...result.outcomes.map(outcomeLine),
+		...result.outcomes.map(outcomeLine$1),
 		`delivered ${result.delivered}, duplicate ${result.duplicate}, rejected ${result.rejected}, undeliverable ${result.undeliverable}, unreachable ${result.unreachable}`,
 		...result.undeliverable > 0 ? [`${result.undeliverable} event(s) can never be delivered and were dispositioned in place, renamed with \`.undeliverable\` and left readable; they no longer count as work waiting.`] : [],
 		...result.outcomes.some((outcome) => outcome.permanent === true && outcome.status === "rejected") ? ["Permanent rejection(s) above will fail identically on every retry; evict them with `psf hq:flush --evict-permanent`, or wait for an HQ ingest schema fix."] : [],
@@ -15636,6 +15679,1642 @@ function createHqFlushCommand(output, action = runHqFlush) {
 	}));
 }
 //#endregion
+//#region src/jev-calibrate/report.ts
+/**
+* The calibration report for a terminal. It prints counts and the cases behind
+* them, never a rate, a grade or a recommendation, and never one number that
+* mixes tuning with holdout.
+*/
+const usageLine = (usage) => `requests ${usage.live} live, ${usage.cached} cached, ${usage.failed} failed · tokens ${usage.inputTokens} in / ${usage.outputTokens} out · ${(usage.elapsedMs / 1e3).toFixed(1)} s · model HQ reported: ${usage.models.length === 0 ? "none" : usage.models.join(", ")}`;
+const where = (outcome) => `${outcome.path}${outcome.target === "file" ? "" : `:${outcome.target.line}${outcome.target.column === void 0 ? "" : `:${outcome.target.column}`}`} @ ${outcome.sha.slice(0, 12)}`;
+const scoreText = (outcome, cutoff) => outcome.score === void 0 ? "" : ` — answered ${String(outcome.score)} against ${String(cutoff)}`;
+const outcomeLine = (outcome, cutoff) => `    ${outcome.id} expected ${outcome.expected}: ${outcome.status}${scoreText(outcome, cutoff)}${outcome.knownMiss ? " [known miss]" : ""}${outcome.reason === void 0 ? "" : ` — ${outcome.reason}`} (${where(outcome)})`;
+const poolSection = (pool, cutoff) => {
+	const listed = pool.outcomes.filter((outcome) => outcome.knownMiss || !(outcome.status === "caught" || outcome.status === "quiet"));
+	return [
+		`  ${pool.pool}: ${pool.outcomes.length} case(s), ${pool.compared} answer(s) compared`,
+		`    caught ${pool.caught} · quiet ${pool.quiet} · selector misses ${pool.selectorMisses} · model misses ${pool.modelMisses} · unanswered ${pool.unanswered} · unavailable ${pool.unavailable}`,
+		...listed.map((outcome) => outcomeLine(outcome, cutoff))
+	];
+};
+const questionSection = (question) => [
+	`## ${question.id} [${question.textHash}] — target ${question.target}, cutoff ${String(question.cutoff)}`,
+	`  ${usageLine(question.usage)}`,
+	`  matches sent: ${question.sentMatches}`,
+	...question.pools.flatMap((pool) => poolSection(pool, question.cutoff))
+].join("\n");
+const renderJevCalibrationText = (report) => [
+	"# jev:calibrate",
+	"",
+	"A session diagnostic: counts against each question's own cutoff. No bar, no verdict, no recommendation.",
+	"",
+	`generated: ${report.generatedAt}`,
+	`mode: ${report.mode}${report.mode === "solo" ? " (each labeled match in its own request)" : " (the plugin's requests, one per file)"}`,
+	`config: ${report.configPath}`,
+	...report.manifests.map((manifest) => `${manifest.pool}: ${manifest.path} sha256 ${manifest.sha256}`),
+	"cache: fresh for this run, discarded after it",
+	`total: ${usageLine(report.usage)}`,
+	`answers compared: ${report.compared}`,
+	"",
+	...report.questions.map((question) => `${questionSection(question)}\n`),
+	...report.failures.length === 0 ? ["The run completed."] : [`The run did not complete (${report.failures.length}):`, ...report.failures.map((failure) => `  - ${failure}`)],
+	""
+].join("\n");
+//#endregion
+//#region src/jev/schema.ts
+const noulAnswerSchema = z.object({
+	noul: z.number().min(0).max(1),
+	type: z.literal("noul")
+});
+const choiceAnswerSchema = z.object({
+	choice: z.string(),
+	confidence: z.number(),
+	probabilities: z.record(z.string(), z.number()),
+	type: z.literal("choice")
+});
+const scoreAnswerSchema = z.object({
+	confidence: z.number(),
+	probabilities: z.record(z.string(), z.number()),
+	score: z.number(),
+	type: z.literal("score")
+});
+/**
+* One answer, discriminated exactly as Jev discriminates it.
+*
+* Every member is a *stripping* object: an unknown key inside one answer is
+* dropped, not an error. Erroring would let a single surprising field sink a
+* whole response, and keeping it would put an upstream-named field into a
+* record. Dropping is the only behavior that is both safe and non-destructive.
+*/
+const jevAnswerSchema = z.discriminatedUnion("type", [
+	noulAnswerSchema,
+	choiceAnswerSchema,
+	scoreAnswerSchema
+]);
+/** Token counters, copied field by field. Never a passthrough object. */
+const usageSchema = z.object({
+	input_tokens: z.number().optional(),
+	output_tokens: z.number().optional()
+});
+/**
+* Jev's response body. Unknown keys are stripped at every level: nothing
+* upstream names may end up on a record simply because it was present.
+*/
+const jevResponseSchema = z.object({
+	answers: z.record(z.string(), jevAnswerSchema),
+	model: z.string().min(1),
+	usage: usageSchema.optional()
+});
+/** A model id is a short token. Anything longer or stranger is prose. */
+const MODEL_ID_SHAPE = /^[A-Za-z0-9][\w.-]{0,63}$/u;
+/** What a report says when HQ names its model in something other than an id. */
+const UNKNOWN_MODEL = "unknown";
+/**
+* The one way an upstream body becomes a value this package will carry.
+*
+* It returns `undefined` rather than throwing, because a thrown validation
+* error carries the rejected data in its own message — the exact thing that
+* must not travel. Every field is copied explicitly: a passthrough object, a
+* spread, or a `z.infer` handed straight to a record would all reintroduce
+* "whatever HQ sent" as "whatever we publish".
+*/
+const parseJevResponse = (payload) => {
+	const parsed = jevResponseSchema.safeParse(payload);
+	if (!parsed.success) return;
+	const { answers, model, usage } = parsed.data;
+	const counters = {};
+	if (typeof usage?.input_tokens === "number") counters.input_tokens = usage.input_tokens;
+	if (typeof usage?.output_tokens === "number") counters.output_tokens = usage.output_tokens;
+	return {
+		answers,
+		model: MODEL_ID_SHAPE.test(model) ? model : UNKNOWN_MODEL,
+		...usage === void 0 ? {} : { usage: counters }
+	};
+};
+/**
+* Projects one answer onto the question that asked for it.
+*
+* Two jobs, and the second is why this lives here rather than in a caller.
+* Type agreement keeps a well-formed answer of the wrong kind from throwing
+* later, deeper, and taking a whole report with it. And the only free text an
+* answer can carry — a `choice` label — is accepted solely when it is a label
+* this package itself wrote into the question. Probability keys are rebuilt
+* from the question's own labels or rubric levels for the same reason, so an
+* upstream-invented key cannot ride along.
+*/
+const projectAnswer = (question, answer) => {
+	if (answer.type !== question.type) return { reason: `asked ${question.type}, answered ${answer.type}` };
+	if (answer.type === "noul") return { answer: {
+		noul: answer.noul,
+		type: "noul"
+	} };
+	const keep = (keys) => Object.fromEntries(keys.map((key) => [key, answer.probabilities[key]]).filter(([, value]) => typeof value === "number"));
+	if (answer.type === "choice") {
+		const labels = Object.keys(question.criteria);
+		if (!labels.includes(answer.choice)) return { reason: "answered with a label the question did not offer" };
+		return { answer: {
+			choice: answer.choice,
+			confidence: answer.confidence,
+			probabilities: keep(labels),
+			type: "choice"
+		} };
+	}
+	const levels = question.criteria.map((_, index) => String(index));
+	return { answer: {
+		confidence: answer.confidence,
+		probabilities: keep(levels),
+		score: answer.score,
+		type: "score"
+	} };
+};
+//#endregion
+//#region src/jev/cache.ts
+/**
+* The request-hash cache: the same request bytes against the same endpoint
+* answer from disk instead of from HQ.
+*
+* The key is the endpoint plus the exact serialized request, and nothing else.
+* That is the whole design: a changed snippet, a reworded question, a
+* different reference file and a different HQ all move the bytes, so they all
+* move the key. There is no key schema to keep in step with the request
+* builder, and no way to grow one that forgets a field.
+*
+* It lives under `node_modules/.cache`, which is disposable by convention and
+* already ignored everywhere — a Jev answer is a session diagnostic (ADR
+* 0034), not a build input and not evidence.
+*
+* An entry that exists but cannot be used — unreadable, not JSON, not Jev's
+* response shape — is an error, not a miss, and so is a write that fails. Only
+* `ENOENT` means "nothing is stored". Repairing any of the others silently and
+* calling HQ anyway would be a second behavior for one failure, and a paid
+* one; the run names the entry and its cause, and the operator removes it.
+*/
+/** A cache entry that could not be used, or could not be written. */
+var JevCacheError = class extends Error {
+	path;
+	constructor(entryPath, detail) {
+		super(`the Jev cache entry ${entryPath} could not be used: ${detail}. Remove it and run again.`);
+		this.name = "JevCacheError";
+		this.path = entryPath;
+	}
+};
+/**
+* The filesystem's own error code, which is a short constant it names
+* (`EISDIR`, `EACCES`), not a message that could quote anything.
+*/
+const errnoOf = (error) => error?.code ?? "an unknown error";
+/** Where a repository's Jev answers are kept. */
+const defaultJevCacheDirectory = (cwd) => path.join(cwd, "node_modules", ".cache", "patronage-jev");
+/**
+* Opens the cache, creating its directory now so a directory that cannot be
+* written fails here — at the one place that names it — rather than midway
+* through a run as an unexplained request failure.
+*/
+const openJevCache = ({ directory = defaultJevCacheDirectory(process.cwd()), endpoint }) => {
+	mkdirSync(directory, { recursive: true });
+	const keyFor = (serialized) => createHash("sha256").update(`${endpoint}\0${serialized}`).digest("hex");
+	const entryPathFor = (serialized) => path.join(directory, `${keyFor(serialized)}.json`);
+	return {
+		keyFor,
+		read: (serialized) => {
+			const entryPath = entryPathFor(serialized);
+			let text;
+			try {
+				text = readFileSync(entryPath, "utf-8");
+			} catch (error) {
+				if (errnoOf(error) === "ENOENT") return;
+				throw new JevCacheError(entryPath, `reading it failed with ${errnoOf(error)}`);
+			}
+			let payload;
+			try {
+				payload = JSON.parse(text);
+			} catch {
+				throw new JevCacheError(entryPath, "it is not JSON");
+			}
+			const parsed = parseJevResponse(payload);
+			if (parsed === void 0) throw new JevCacheError(entryPath, "it is not Jev's response shape");
+			return parsed;
+		},
+		write: (serialized, response) => {
+			const entryPath = entryPathFor(serialized);
+			try {
+				writeFileSync(entryPath, JSON.stringify(response), "utf-8");
+			} catch (error) {
+				throw new JevCacheError(entryPath, `writing it failed with ${errnoOf(error)}`);
+			}
+		}
+	};
+};
+//#endregion
+//#region src/jev/client.ts
+/**
+* The one Jev gateway: HQ (ADR 0033).
+*
+* There is no fallback provider and no direct mode "for local dev". This
+* module knows Jev's request schema and how to reach HQ; it does not know
+* Cloudflare, TypeSafe, accounts, or model versions. HQ names the model and
+* returns the one that actually ran.
+*
+* `HQ_INGEST_URL` names the origin (#259). The origin is authorized before
+* anything else happens, by the same code HQ ingest uses
+* (`hq-origin-policy.ts`, ADR 0015): it must be an `https:` origin with no
+* embedded credentials, listed exactly in the operator's `hqAllowedOrigins`.
+* Only then are credentials read: `resolveHqCredentials` reads the hyphenated
+* `CF-Access-Client-Id` / `CF-Access-Client-Secret` pair, and
+* `buildCloudflareAccessRequestInit` attaches them to a request that refuses
+* redirects so the credentials cannot leave the authorized origin.
+*
+* Credentials are read from the environment only. A diagnostic must not reach
+* into the operator's secret manager: `hq:flush` is the deliberate command
+* allowed to do that, and a session that has already loaded the pair for a
+* factory command has it here too. So `resolveHqCredentials` is called with no
+* references, and the remedy this module prints is the one that actually
+* applies — load the variables — never "record references in the user config",
+* which would do nothing for this command.
+*/
+/** The environment variable that carries HQ's origin, same as ingest. */
+const HQ_ORIGIN_ENV = "HQ_INGEST_URL";
+/** HQ's Jev boundary, composed onto the origin. */
+const JEV_ROUTE_PATH = "/api/jev";
+/** Per-attempt ceiling. A 32k-token packet is a slow request, not a hung one. */
+const JEV_REQUEST_TIMEOUT_MS = 6e4;
+/**
+* Ceiling for reading the operator user config. A config path that hangs
+* authorizes nothing rather than holding the run open.
+*/
+const ORIGIN_POLICY_READ_MS = 5e3;
+/**
+* An upstream refusal, carried with the code HQ passed through rather than
+* flattened into prose. `max_tokens_exceeded` is the one a caller acts on: it
+* means the packet was too large despite the local budget.
+*/
+var JevRequestError = class extends Error {
+	code;
+	httpStatus;
+	constructor(httpStatus, code, message) {
+		super(message);
+		this.name = "JevRequestError";
+		this.code = code;
+		this.httpStatus = httpStatus;
+	}
+};
+/**
+* A code is a short machine token. Anything else in that field is prose the
+* upstream chose, and prose is exactly what must not travel into a report.
+*/
+const CODE_SHAPE = /^[a-z0-9_.-]{1,64}$/iu;
+/** Reads the upstream error code out of whatever shape the body arrived in. */
+const rawErrorCode = (body) => {
+	if (body === null || typeof body !== "object") return;
+	const record = body;
+	if (typeof record.code === "string") return record.code;
+	if (typeof record.error === "string") return record.error;
+	if (record.error !== null && typeof record.error === "object") {
+		const nested = record.error.code;
+		return typeof nested === "string" ? nested : void 0;
+	}
+};
+/**
+* The only thing kept from a refusal body.
+*
+* An upstream 400 routinely quotes the state it rejected, and this state is
+* repository source. That message used to be copied into the request record and
+* into every affected case's reasons, so an ordinary run without
+* `--include-evidence` could print source back out. Status and a code-shaped
+* token are enough to act on — `max_tokens_exceeded` is the one a caller does
+* anything about — and a field that is not code-shaped is dropped rather than
+* trimmed, because a truncated leak is still a leak.
+*/
+const errorCode = (body) => {
+	const raw = rawErrorCode(body);
+	return raw !== void 0 && CODE_SHAPE.test(raw) ? raw : void 0;
+};
+/**
+* How to name a rejected origin without repeating it.
+*
+* Every `unavailable` reason reaches `statusReason`, each case's `reasons`, and
+* both the JSON and Markdown renderings — none of which is redacted anywhere.
+* An `HQ_INGEST_URL` carrying userinfo is exactly the value that must not be
+* echoed, and it is exactly the value being rejected, so the diagnostic is
+* limited to scheme and host. A value that does not parse is not quoted at all:
+* there is no structure to trim it down to.
+*/
+const describeOrigin = (origin) => {
+	const parsed = URL.parse(origin);
+	return parsed === null ? "(not a URL; the value is withheld because it could not be parsed to strip credentials)" : `${parsed.protocol}//${parsed.host}`;
+};
+/**
+* HQ's Jev endpoint for a configured origin, or `undefined` when the value
+* breaks HQ ingest's protocol rule (`validatedHqOrigin`: `https:` only, no
+* embedded credentials, no `http:` exception).
+*
+* The path is composed onto the URL's *origin*, which is what both existing HQ
+* readers do and what makes the documented misconfiguration harmless: the
+* operator who sets `HQ_INGEST_URL` to the profile's `/api/ingest` endpoint
+* instead of the origin (#259) still reaches `/api/jev`, not
+* `/api/ingest/api/jev`.
+*/
+const jevEndpointFor = (origin) => {
+	const parsed = validatedHqOrigin(origin);
+	return parsed === void 0 ? void 0 : new URL(JEV_ROUTE_PATH, parsed.origin).href;
+};
+/**
+* Whether an upstream token is this request's own credential handed back.
+*
+* Narrow on purpose. A model id and an error code are opaque tokens HQ names,
+* so they cannot be pattern-matched for secrets in general, and general secret
+* scanning is not wanted here: HQ already holds both the credential and the
+* source, so a hostile HQ is outside the threat model. What *is* cheap and
+* exact is the comparison this function makes — the credential values are in
+* scope at the one place a response is read, so a field that echoes one back
+* can be recognized by equality rather than by guesswork.
+*/
+const reflectsCredential = (value, token) => value.includes(token.clientId) || value.includes(token.clientSecret);
+/**
+* The whole exchange, and the only place an upstream body is touched.
+*
+* Fetching, reading the body, parsing it, and validating it all happen inside
+* one boundary with one outer catch, because the leak this shape prevents kept
+* coming back by a different route each time: first the refusal body, then the
+* transport message, then the body stream, then a schema issue. Each of those
+* is a distinct throw site, and patching them one at a time is a losing game.
+*
+* The rule is therefore structural, not per-site: **everything that leaves here
+* is a `JevRequestError` whose message is a fixed string, plus an HTTP status,
+* plus a code-shaped token.** Nothing derived from an upstream value —
+* `error.message`, `error.cause`, response text, or a validation issue — is
+* ever read into a message. A throw this function does not recognize becomes
+* one fixed sentence rather than being inspected.
+*/
+const exchange = async (input) => {
+	const init = buildCloudflareAccessRequestInit(input.token, {
+		body: input.serializedBody,
+		headers: { "content-type": "application/json" },
+		method: "POST",
+		signal: AbortSignal.timeout(JEV_REQUEST_TIMEOUT_MS)
+	});
+	try {
+		let response;
+		try {
+			response = await input.fetchImpl(input.endpoint, init);
+		} catch (error) {
+			const timedOut = error instanceof Error && error.name === "TimeoutError";
+			throw new JevRequestError(0, timedOut ? "timeout" : "unreachable", timedOut ? `HQ Jev at ${input.endpoint} did not answer within ${JEV_REQUEST_TIMEOUT_MS}ms.` : `HQ Jev at ${input.endpoint} could not be reached. Redirects are refused to protect Cloudflare Access credentials.`);
+		}
+		const text = await response.text();
+		let payload;
+		try {
+			payload = JSON.parse(text);
+		} catch {
+			payload = void 0;
+		}
+		if (!response.ok) {
+			const reported = errorCode(payload);
+			const code = reported !== void 0 && reflectsCredential(reported, input.token) ? void 0 : reported;
+			throw new JevRequestError(response.status, code, `HQ Jev refused the request with HTTP ${response.status}${code === void 0 ? "" : ` (${code})`}. The response body is not reported: an upstream validation error can quote the state it rejected, which is repository source.`);
+		}
+		const parsed = parseJevResponse(payload);
+		const body = parsed !== void 0 && reflectsCredential(parsed.model, input.token) ? {
+			...parsed,
+			model: UNKNOWN_MODEL
+		} : parsed;
+		if (body === void 0) throw new JevRequestError(response.status, "malformed_response", "HQ Jev returned a body that is not Jev's response shape. The body is not reported.");
+		return body;
+	} catch (error) {
+		if (error instanceof JevRequestError) throw error;
+		throw new JevRequestError(0, "exchange_failed", "The HQ Jev exchange failed before a response could be read. No upstream text is reported: it can quote the request.");
+	}
+};
+/**
+* The whole remedy, in one sentence. The variable names are literally
+* hyphenated, so a plain `export` does not set them.
+*/
+const MISSING_CREDENTIALS_REASON = `no HQ credentials: ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} are not both in the environment. The names are literally hyphenated, so a plain \`export\` does not set them — prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <the command> …\`.`;
+/** Where the operator config was looked for, for a message that names it. */
+const operatorConfigLocation = (env) => {
+	try {
+		return ` (${defaultUserConfigPath(env)})`;
+	} catch {
+		return "";
+	}
+};
+/**
+* Why an origin is not authorized. An empty list and an unlisted origin are
+* different remedies, so they are different sentences. A config that is
+* missing, unreadable or invalid reads as an empty list, exactly as it does
+* for HQ ingest.
+*/
+const unauthorizedOriginReason = (allowedOrigins, origin, env) => allowedOrigins.length === 0 ? `no HQ origin is authorized: the operator user config${operatorConfigLocation(env)} has no hqAllowedOrigins, or it is missing or cannot be read. List ${origin} there, as HQ ingest requires, before Jev sends credentials or source to it.` : `HQ origin ${origin} is not authorized by hqAllowedOrigins in the operator user config${operatorConfigLocation(env)}. List the exact origin there, as HQ ingest requires, before Jev sends credentials or source to it.`;
+/**
+* Resolves the gateway, or says why there isn't one. Every `unavailable`
+* reason is an operator-facing sentence naming a remedy that applies to this
+* command, and none of them can carry a credential: nothing here reads a
+* resolved value into a message.
+*
+* The order is the policy. The origin is checked against HQ ingest's protocol
+* rule and the operator's `hqAllowedOrigins` first, and only an authorized
+* origin gets as far as reading credentials. An unauthorized origin never sees
+* a request.
+*/
+const resolveJevGateway = async ({ env, fetchImpl = fetch }) => {
+	const origin = env[HQ_ORIGIN_ENV]?.trim();
+	if (!origin) return {
+		reason: `no HQ origin: ${HQ_ORIGIN_ENV} is unset. It wants the origin, for example https://hq.patronage.com.`,
+		status: "unavailable"
+	};
+	const endpoint = jevEndpointFor(origin);
+	if (endpoint === void 0) return {
+		reason: `${HQ_ORIGIN_ENV} must be an https origin without embedded credentials, as HQ ingest requires: ${describeOrigin(origin)}`,
+		status: "unavailable"
+	};
+	const endpointUrl = new URL(endpoint);
+	const allowedOrigins = await loadHqAllowedOrigins(env, performance.now() + ORIGIN_POLICY_READ_MS);
+	if (!isHqOriginAuthorized(allowedOrigins, endpointUrl)) return {
+		reason: unauthorizedOriginReason(allowedOrigins, endpointUrl.origin, env),
+		status: "unavailable"
+	};
+	const resolution = resolveHqCredentials({ env });
+	if (resolution.status !== "resolved") return {
+		reason: MISSING_CREDENTIALS_REASON,
+		status: "unavailable"
+	};
+	return {
+		endpoint,
+		evaluate: (serializedBody) => exchange({
+			endpoint,
+			fetchImpl,
+			serializedBody,
+			token: resolution.credentials
+		}),
+		status: "ready"
+	};
+};
+//#endregion
+//#region src/jev/request.ts
+/**
+* The per-request ceiling, in tokens. Jev's context is the constraint this
+* bounds; 32k is the size the epic designed to, and the headroom below covers
+* the estimator's error rather than pretending it has none.
+*/
+const JEV_REQUEST_TOKEN_BUDGET = 32e3;
+/** Fraction of the budget a request may fill. The rest absorbs estimator error. */
+const BUDGET_HEADROOM = .9;
+/** JSON punctuation the per-part sizes do not account for. */
+const ENVELOPE_OVERHEAD_BYTES = 128;
+const BYTES_PER_TOKEN = 4;
+/**
+* Tokens from bytes, at the conventional four-bytes-per-token ratio.
+*
+* A real tokenizer would be a heavy dependency and a second thing to keep in
+* step with whatever model HQ routes to — and the factory holds no model
+* vocabulary by design (ADR 0033). An over-estimate costs an extra split; the
+* headroom above covers an under-estimate. It is a budget, not a measurement.
+*/
+const tokensFor = (bytes) => Math.ceil(bytes / BYTES_PER_TOKEN);
+/**
+* JSON with object keys in sorted order, so the same logical request always
+* serializes to the same bytes — and therefore the same hash, and therefore
+* the same cache entry. Two runs that assembled their state in a different
+* order must not look like two different requests.
+*/
+const stableStringify = (value) => JSON.stringify(value, (_key, nested) => {
+	if (nested === null || typeof nested !== "object" || Array.isArray(nested)) return nested;
+	const source = nested;
+	return Object.fromEntries(Object.keys(source).toSorted().map((key) => [key, source[key]]));
+});
+const byteSize = (value) => Buffer.byteLength(stableStringify(value), "utf-8");
+/** What one match adds to a request: its state entry plus its questions. */
+const matchCost = (match) => byteSize({ [match.key]: match.state }) + byteSize(match.questions);
+/** What a request costs before any match is in it. */
+const baseCost = (file) => ENVELOPE_OVERHEAD_BYTES + byteSize({ path: file.path }) + byteSize({ file: file.shared });
+const buildBody = (file, matches) => {
+	const matchStates = Object.fromEntries(matches.map((match) => [match.key, match.state]));
+	return {
+		questions: Object.fromEntries(matches.flatMap((match) => Object.entries(match.questions))),
+		state: {
+			file: file.shared,
+			matches: matchStates,
+			path: file.path
+		}
+	};
+};
+const toRequest = (file, matches) => {
+	const body = buildBody(file, matches);
+	const serialized = stableStringify(body);
+	return {
+		body,
+		estimatedTokens: tokensFor(Buffer.byteLength(serialized, "utf-8")),
+		hash: createHash("sha256").update(serialized).digest("hex"),
+		matchKeys: matches.map((match) => match.key),
+		path: file.path,
+		serialized
+	};
+};
+/**
+* Turns files into the requests that will be sent, plus the matches that
+* cannot be sent and why. Pure: it performs no I/O and decides nothing about
+* transport.
+*/
+const buildJevRequests = ({ budgetTokens = JEV_REQUEST_TOKEN_BUDGET, files }) => {
+	const ceiling = Math.floor(budgetTokens * BUDGET_HEADROOM);
+	const ceilingBytes = ceiling * BYTES_PER_TOKEN;
+	const requests = [];
+	const unavailable = [];
+	for (const file of files) {
+		const base = baseCost(file);
+		let open = [];
+		let openBytes = base;
+		const flush = () => {
+			if (open.length > 0) {
+				requests.push(toRequest(file, open));
+				open = [];
+				openBytes = base;
+			}
+		};
+		for (const match of file.matches) {
+			const cost = matchCost(match);
+			if (openBytes + cost <= ceilingBytes) {
+				open.push(match);
+				openBytes += cost;
+				continue;
+			}
+			flush();
+			if (openBytes + cost <= ceilingBytes) {
+				open.push(match);
+				openBytes += cost;
+				continue;
+			}
+			unavailable.push({
+				key: match.key,
+				reason: `this match does not fit one Jev request: ${file.path} plus this match is estimated at ${tokensFor(base + cost)} tokens against a ${ceiling}-token ceiling`
+			});
+		}
+		flush();
+	}
+	return {
+		requests,
+		unavailable
+	};
+};
+//#endregion
+//#region src/jev/run.ts
+const describe = (error) => error instanceof Error ? error.message : String(error);
+/**
+* Matches one match's answers to the questions it asked.
+*
+* `projectAnswer` does the work: it rebuilds each answer from the question
+* that asked for it, so an answer of the wrong kind, a `choice` label nobody
+* offered, and an upstream-invented probability key are each refused or
+* dropped rather than carried. A refusal costs one match — it becomes
+* unavailable with a reason — instead of throwing later, deeper, and taking a
+* whole report's correctly answered siblings with it.
+*/
+const routeAnswers = (questions, answers) => {
+	const routed = /* @__PURE__ */ new Map();
+	const missing = [];
+	const mismatched = [];
+	for (const [name, question] of Object.entries(questions)) {
+		const answer = answers[name];
+		if (answer === void 0) {
+			missing.push(name);
+			continue;
+		}
+		const projected = projectAnswer(question, answer);
+		if (projected.reason === void 0) routed.set(name, projected.answer);
+		else mismatched.push(`${name} (${projected.reason})`);
+	}
+	if (missing.length > 0) return { reason: `Jev answered the request but omitted ${missing.join(", ")}` };
+	if (mismatched.length > 0) return { reason: `answer type mismatch: ${mismatched.join(", ")}` };
+	return { answers: Object.fromEntries(routed) };
+};
+const completionOf = (answered, unanswered) => {
+	if (unanswered === 0) return "complete";
+	return answered === 0 ? "unavailable" : "partial";
+};
+/** Counters copied one by one, never the parsed object: this record is printed. */
+const copyUsage = (usage) => {
+	const copied = {};
+	if (typeof usage.input_tokens === "number") copied.input_tokens = usage.input_tokens;
+	if (typeof usage.output_tokens === "number") copied.output_tokens = usage.output_tokens;
+	return copied;
+};
+/**
+* One request's answer, from the cache when the exact bytes are already
+* answered and from HQ otherwise. A live answer is stored on the way back, so
+* the next identical request costs nothing.
+*/
+const answerFor = async (gateway, cache, serialized) => {
+	const stored = cache?.read(serialized);
+	if (stored !== void 0) return {
+		cached: true,
+		response: stored
+	};
+	const response = await gateway.evaluate(serialized);
+	cache?.write(serialized, response);
+	return {
+		cached: false,
+		response
+	};
+};
+/** Writes what HQ reported about the call itself onto the request's record. */
+const recordResponse = (record, response, models) => {
+	record.model = response.model;
+	if (response.usage !== void 0) record.usage = copyUsage(response.usage);
+	if (!models.includes(response.model)) models.push(response.model);
+};
+/**
+* Builds the requests, sends the ones the cache does not already answer, and
+* routes answers back to the matches that asked for them.
+*
+* Requests go one at a time. Bounded load is the point: a repository-wide run
+* would otherwise open dozens of concurrent 32k-token requests against one HQ
+* route for a diagnostic nothing is waiting on.
+*/
+const runJevFiles = async ({ budgetTokens, cache, files, gateway }) => {
+	const plan = buildJevRequests({
+		...budgetTokens === void 0 ? {} : { budgetTokens },
+		files
+	});
+	const questionsByMatch = /* @__PURE__ */ new Map();
+	for (const file of files) for (const match of file.matches) questionsByMatch.set(match.key, match.questions);
+	const answers = /* @__PURE__ */ new Map();
+	const unavailable = /* @__PURE__ */ new Map();
+	const requests = [];
+	const models = [];
+	for (const { key, reason } of plan.unavailable) unavailable.set(key, reason);
+	if (gateway.status !== "ready") {
+		for (const request of plan.requests) for (const key of request.matchKeys) unavailable.set(key, gateway.reason);
+		return {
+			answersByMatchKey: {},
+			completion: completionOf(0, unavailable.size),
+			elapsedMs: 0,
+			models,
+			requests,
+			unavailableByMatchKey: Object.fromEntries(unavailable)
+		};
+	}
+	const runStarted = Date.now();
+	for (const request of plan.requests) {
+		const record = {
+			cached: false,
+			elapsedMs: 0,
+			estimatedTokens: request.estimatedTokens,
+			matchKeys: request.matchKeys,
+			path: request.path,
+			requestHash: request.hash
+		};
+		const started = Date.now();
+		try {
+			const { cached, response } = await answerFor(gateway, cache, request.serialized);
+			record.cached = cached;
+			recordResponse(record, response, models);
+			for (const matchKey of request.matchKeys) {
+				const routed = routeAnswers(questionsByMatch.get(matchKey) ?? {}, response.answers);
+				if (routed.reason === void 0) answers.set(matchKey, routed.answers);
+				else unavailable.set(matchKey, routed.reason);
+			}
+		} catch (error) {
+			record.error = describe(error);
+			if (error instanceof JevRequestError && error.code !== void 0) record.errorCode = error.code;
+			for (const matchKey of request.matchKeys) unavailable.set(matchKey, record.error);
+		}
+		record.elapsedMs = Date.now() - started;
+		requests.push(record);
+	}
+	return {
+		answersByMatchKey: Object.fromEntries(answers),
+		completion: completionOf(answers.size, unavailable.size),
+		elapsedMs: Date.now() - runStarted,
+		models,
+		requests,
+		unavailableByMatchKey: Object.fromEntries(unavailable)
+	};
+};
+//#endregion
+//#region src/oxlint-jev/pass.ts
+/** The environment variable that turns spending on. */
+const JEV_MODE_ENV = "PATRONAGE_JEV_MODE";
+/**
+* The mode this run is in.
+*
+* Deliberately an environment variable rather than a rule option. The Oxlint
+* config that carries the questions is a checked-in file: a `mode: "live"` in
+* it would be one merge away from every runner with HQ credentials spending on
+* every invocation, including whichever tool picks the config up next. An
+* environment variable is set per invocation by whoever is paying, and it is
+* bounded by the same credentials — `live` without `HQ_INGEST_URL` and the
+* Cloudflare Access pair buys nothing, it reports that it could not ask. A
+* value that is neither mode is refused rather than rounded to the safe one,
+* because "I set it and nothing happened" is how an operator ends up believing
+* a run asked something it did not.
+*/
+const resolveJevMode = (env) => {
+	const raw = env[JEV_MODE_ENV]?.trim();
+	if (raw === void 0 || raw === "") return "record";
+	if (raw === "live" || raw === "record") return raw;
+	throw new Error(`jev: ${JEV_MODE_ENV} must be "record" or "live"; got "${raw}"`);
+};
+/** Where recorded request bodies are written. */
+const recordDirectoryFor = (cacheDirectory) => path.join(cacheDirectory, "record");
+const fail = (detail) => {
+	throw new Error(`jev/ask: ${detail}`);
+};
+/** The short hash of a question's text that every finding carries. */
+const questionTextHash = (question) => createHash("sha256").update(question).digest("hex").slice(0, 8);
+/**
+* A reference must name a file inside the repository. An absolute path or one
+* that climbs out of the checkout would make the request depend on the machine
+* that ran the lint, and the request is the cache key — two machines would
+* disagree about what the same configuration asked.
+*/
+const checkReference = (id, reference) => {
+	if (path.isAbsolute(reference)) fail(`question "${id}" references an absolute path (${reference}); references are repository-relative`);
+	const normalized = path.normalize(reference);
+	if (normalized === ".." || normalized.startsWith(`..${path.sep}`)) fail(`question "${id}" references a path outside the repository (${reference})`);
+};
+/**
+* Turns the rule's options into the questions this file's pass will ask.
+*
+* Called once per file, so it stays cheap: the only work is compiling
+* `contains` and hashing the question text.
+*/
+const resolveJevQuestions = (raw) => {
+	if (raw === null || typeof raw !== "object") fail("the rule takes one options object with a `questions` array; configure it as `\"jev/ask\": [\"warn\", { \"questions\": [ … ] }]`");
+	const { questions } = raw;
+	if (!Array.isArray(questions) || questions.length === 0) fail("`questions` must list at least one question");
+	const seen = /* @__PURE__ */ new Set();
+	return questions.map((question) => {
+		if (seen.has(question.id)) fail(`question id "${question.id}" is used more than once`);
+		seen.add(question.id);
+		for (const reference of question.references ?? []) checkReference(question.id, reference);
+		let pattern;
+		if (question.contains !== void 0) try {
+			pattern = new RegExp(question.contains, "u");
+		} catch {
+			fail(`question "${question.id}" has a \`contains\` that is not a valid regular expression: ${question.contains}`);
+		}
+		return {
+			...question,
+			pattern,
+			textHash: questionTextHash(question.question)
+		};
+	});
+};
+//#endregion
+//#region src/jev-calibrate/installed.ts
+/**
+* Finding what a project installed, and nothing else.
+*
+* `require.resolve` would also search `NODE_PATH` and Node's global folders.
+* Those belong to whatever launched the command, not to the project: pnpm, for
+* one, sets `NODE_PATH` to its own hoisted store for every child it runs, so a
+* project with no Oxlint at all "resolves" one from there. Calibration must
+* run the Oxlint and the plugin the project's Jev config runs with, so the
+* search here is only the `node_modules` directories from the starting
+* directory up to the filesystem root.
+*/
+/** The installed root of `packageName` for `fromDirectory`, or `undefined`. */
+const installedPackageRoot = (fromDirectory, packageName) => {
+	for (let directory = path.resolve(fromDirectory);; directory = path.dirname(directory)) {
+		const candidate = path.join(directory, "node_modules", packageName);
+		if (existsSync(path.join(candidate, "package.json"))) return realpathSync(candidate);
+		if (path.dirname(directory) === directory) return;
+	}
+};
+/**
+* The package `fromDirectory` itself belongs to, when that package is
+* `packageName`: Node's self-reference, which Oxlint's resolver honors too, so
+* a config inside the plugin's own package can name it by package name.
+*/
+const selfPackageRoot = (fromDirectory, packageName) => {
+	for (let directory = path.resolve(fromDirectory);; directory = path.dirname(directory)) {
+		const manifest = path.join(directory, "package.json");
+		if (existsSync(manifest)) {
+			const { name } = JSON.parse(readFileSync(manifest, "utf-8"));
+			return name === packageName ? realpathSync(directory) : void 0;
+		}
+		if (path.dirname(directory) === directory) return;
+	}
+};
+/** The package name a bare specifier names: `@scope/name` or `name`. */
+const packageNameOf = (specifier) => {
+	const segments = specifier.split("/");
+	return (specifier.startsWith("@") ? segments.slice(0, 2) : segments.slice(0, 1)).join("/");
+};
+/**
+* A module specifier resolved from `fromDirectory`: a relative or absolute
+* path as a file, a bare specifier through the package that encloses
+* `fromDirectory` (when it is that package) or the one the project installed,
+* and that package's own `exports`. The result is a file inside that package,
+* or this throws.
+*/
+const resolveInstalledModule = (fromDirectory, specifier) => {
+	if (specifier.startsWith(".") || path.isAbsolute(specifier)) {
+		const resolved = path.resolve(fromDirectory, specifier);
+		if (!existsSync(resolved)) throw new Error(`${resolved} does not exist`);
+		return resolved;
+	}
+	const packageName = packageNameOf(specifier);
+	const root = selfPackageRoot(fromDirectory, packageName) ?? installedPackageRoot(fromDirectory, packageName);
+	if (root === void 0) throw new Error(`${packageName} is not installed in any node_modules above ${fromDirectory}`);
+	const resolved = createRequire(path.join(root, "package.json")).resolve(specifier);
+	if (!resolved.startsWith(`${root}${path.sep}`)) throw new Error(`${specifier} resolved outside the installed ${packageName} at ${root}`);
+	return resolved;
+};
+//#endregion
+//#region src/jev-calibrate/config.ts
+/**
+* The project's dedicated Jev Oxlint config, read once for two things: the
+* questions (so each case is scored against its own question's cutoff) and the
+* plugin the config loads (so the selection that runs is the project's own).
+*
+* The questions go through `resolveJevQuestions`, the same function the plugin
+* runs on its options, so an id, a text hash and a `contains` pattern mean the
+* same thing here as in a lint run. Nothing about a question is decided here:
+* the cutoff, the wording and the selector are the project's.
+*/
+/** The file the calibration config is written to inside each rebuilt tree. */
+const CALIBRATION_CONFIG_NAME = "jev-calibration.oxlintrc.json";
+/**
+* Keys that change which files or nodes a lint run selects and that a
+* calibration config cannot carry faithfully: their globs and paths are
+* relative to the project's config file, and the calibration config lives
+* somewhere else. Refusing them keeps "the selection is the plugin's" true
+* instead of approximately true.
+*/
+const UNREPRODUCIBLE_KEYS = [
+	"extends",
+	"ignorePatterns",
+	"overrides"
+];
+const specifierOf = (entry) => typeof entry === "string" ? entry : entry.specifier;
+/**
+* A plugin specifier resolved the way Oxlint resolves it: relative to the
+* config file, through the project's own `node_modules`. The result is an
+* absolute path, so the calibration config can load the very same file from a
+* different directory.
+*/
+const resolvePlugin = (configPath, entry) => {
+	const specifier = specifierOf(entry);
+	let resolved;
+	try {
+		resolved = resolveInstalledModule(path.dirname(configPath), specifier);
+	} catch (error) {
+		throw new Error(`the Jev config ${configPath} loads the plugin "${specifier}", which the project has not installed: ${error instanceof Error ? error.message : String(error)}.`, { cause: error });
+	}
+	return typeof entry === "string" ? resolved : {
+		...entry,
+		specifier: resolved
+	};
+};
+/**
+* Reads the project's Jev config. Every problem throws: a config calibration
+* cannot read faithfully is a run that must not start.
+*/
+const loadJevCalibrationConfig = (configPath) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+	} catch (error) {
+		throw new Error(`the Jev config ${configPath} could not be read as JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	for (const key of UNREPRODUCIBLE_KEYS) if (key in parsed) throw new Error(`the Jev config ${configPath} uses "${key}", which changes what the plugin selects and cannot be carried into a calibration run. Keep the Jev config flat: jsPlugins and top-level rules.`);
+	const ask = (parsed.rules ?? {})["jev/ask"];
+	if (!Array.isArray(ask) || ask.length !== 2) throw new Error(`the Jev config ${configPath} has no top-level "jev/ask": [severity, { questions }] rule to calibrate.`);
+	const plugins = parsed.jsPlugins;
+	if (!Array.isArray(plugins) || plugins.length === 0) throw new Error(`the Jev config ${configPath} loads no jsPlugins, so it cannot run the Jev plugin.`);
+	return {
+		askOptions: ask[1],
+		jsPlugins: plugins.map((entry) => resolvePlugin(configPath, entry)),
+		path: configPath,
+		questions: resolveJevQuestions(ask[1])
+	};
+};
+/**
+* The Oxlint config written beside each rebuilt tree.
+*
+* It asks the project's questions verbatim, through the project's plugin, and
+* nothing else runs: built-in plugins and the default `correctness` category
+* are off, so the only diagnostics are the plugin's own. `jev/ask` is a
+* warning whatever the project set — a recorded match is not a failure — and
+* `jev/unavailable` is an error, so an incomplete selection exits non-zero.
+*/
+const calibrationOxlintConfig = (config) => ({
+	categories: { correctness: "off" },
+	jsPlugins: config.jsPlugins,
+	plugins: [],
+	rules: {
+		"jev/ask": ["warn", config.askOptions],
+		"jev/unavailable": "error"
+	}
+});
+//#endregion
+//#region src/jev-calibrate/manifest.ts
+/**
+* The labeled cases, as manifests rather than fixtures.
+*
+* A case is a label about code at a commit: "the node this question selects on
+* line 38 of this file, at this sha, should be answered yes". The manifest
+* stores only enough to find that code again — repository, sha, path, where
+* the node starts, the question id, and the expected answer. The file is
+* rebuilt from git at run time. No source is copied here: a copy would keep
+* answering yesterday's question about yesterday's snippet after the question
+* or the selector changed, which is exactly what calibration exists to catch.
+*
+* Two pools, and they are never merged:
+*
+* - `tuning` is the only pool a question's wording, `contains` or cutoff may
+*   be tuned against.
+* - `holdout` is the pool the author does not tune against. Every report
+*   prints each manifest's SHA-256, so an edit to the holdout is visible
+*   beside the numbers it produced.
+*/
+const CALIBRATION_POOL_NAMES = ["tuning", "holdout"];
+/**
+* Where the node a case labels starts, as an editor shows it: 1-based line and
+* column. `file` for a question whose target is the whole file. A column is
+* needed only when two selected nodes of one question start on the same line.
+*/
+const caseTargetSchema = z.union([z.literal("file"), z.object({
+	column: z.number().int().min(1).optional(),
+	line: z.number().int().min(1)
+}).strict()]);
+const calibrationCaseSchema = z.object({
+	/** Who or what produced `expected`: a model id, or a named person. */
+	adjudicator: z.string().min(1),
+	expected: z.enum(["yes", "no"]),
+	id: z.string().min(1),
+	/**
+	* A case the question is already known to get wrong. It is asked and
+	* scored like every other case and stays listed in every report: a known
+	* miss is evidence, and dropping it would make the numbers look better
+	* than the question is.
+	*/
+	knownMiss: z.boolean().optional(),
+	/** The adjudicator's own words. */
+	note: z.string().min(1).optional(),
+	/** Repository-relative, exactly as git names it at `sha`. */
+	path: z.string().min(1),
+	/** The id of a question in the Jev config this run is given. */
+	question: z.string().min(1),
+	/** `owner/name`. It must be the repository the command runs in. */
+	repository: z.string().regex(/^[^/\s]+\/[^/\s]+$/u),
+	sha: z.string().regex(/^[0-9a-f]{40}$/u),
+	target: caseTargetSchema
+}).strict();
+const calibrationPoolSchema = z.object({
+	cases: z.array(calibrationCaseSchema),
+	pool: z.enum(CALIBRATION_POOL_NAMES),
+	schemaVersion: z.literal(1),
+	/** Where these labels came from, in prose. */
+	source: z.string().min(1)
+}).strict();
+const poolPath = (directory, name) => path.join(directory, `${name}.json`);
+const loadPool = (directory, name) => {
+	const manifestPath = poolPath(directory, name);
+	const text = readFileSync(manifestPath, "utf-8");
+	const parsed = calibrationPoolSchema.safeParse(JSON.parse(text));
+	if (!parsed.success) throw new Error(`${manifestPath} is not a calibration manifest: ${z.prettifyError(parsed.error)}`);
+	if (parsed.data.pool !== name) throw new Error(`${manifestPath} declares pool ${parsed.data.pool}, not ${name}.`);
+	for (const entry of parsed.data.cases) assertRepositoryRelativePath(entry.path, `case ${entry.id}`);
+	return {
+		cases: parsed.data.cases,
+		name,
+		path: manifestPath,
+		sha256: createHash("sha256").update(text).digest("hex"),
+		source: parsed.data.source
+	};
+};
+/**
+* Reads both pools from `directory` (`tuning.json` and `holdout.json`) and
+* checks every case against the questions it names.
+*
+* Every problem here throws, before git, Oxlint or HQ is touched. A case that
+* names a question the config does not have cannot be scored against any
+* cutoff; a case whose target shape disagrees with its question's target
+* cannot be attributed; and two cases writing the identical target would
+* have one answer counted twice. Targets that differ in spelling but name one
+* node are caught after selection, in `run.ts`, on the node itself.
+*/
+const loadCalibrationPools = (directory, questions) => {
+	const pools = CALIBRATION_POOL_NAMES.map((name) => loadPool(directory, name));
+	const targetById = new Map(questions.map((question) => [question.id, question.target]));
+	const cases = [];
+	const ids = /* @__PURE__ */ new Set();
+	const nodes = /* @__PURE__ */ new Set();
+	for (const pool of pools) for (const entry of pool.cases) {
+		if (ids.has(entry.id)) throw new Error(`case id ${entry.id} is used more than once.`);
+		ids.add(entry.id);
+		const target = targetById.get(entry.question);
+		if (target === void 0) throw new Error(`case ${entry.id} names question ${entry.question}, which the Jev config does not ask.`);
+		if (target === "file" !== (entry.target === "file")) throw new Error(`case ${entry.id}: question ${entry.question} targets ${target}, so the case target must be ${target === "file" ? "\"file\"" : "{ line, column? }"}.`);
+		const node = JSON.stringify([
+			entry.question,
+			entry.sha,
+			entry.path,
+			entry.target
+		]);
+		if (nodes.has(node)) throw new Error(`case ${entry.id} labels the same node as an earlier case; one node takes one label.`);
+		nodes.add(node);
+		cases.push({
+			...entry,
+			pool: pool.name
+		});
+	}
+	return {
+		cases,
+		pools
+	};
+};
+//#endregion
+//#region src/jev-calibrate/score.ts
+/**
+* The one comparison. At or above the cutoff is reported, exactly as the
+* plugin reports a finding (`noul >= cutoff`), so a case scored here lands on
+* the same side it would land on in a lint run.
+*/
+const statusFor = (expected, observation, cutoff) => {
+	if (observation.kind === "unanswered" || observation.kind === "unavailable") return observation.kind;
+	if (observation.kind === "not-selected") return expected === "yes" ? "selector-miss" : "quiet";
+	const reported = observation.score >= cutoff;
+	if (expected === "yes") return reported ? "caught" : "model-miss";
+	return reported ? "model-miss" : "quiet";
+};
+/**
+* Totals over a set of request records. A request answered from the cache
+* adds no tokens; a failed one adds none either, and is counted as failed.
+*/
+const usageOf = (requests) => {
+	const usage = {
+		cached: 0,
+		elapsedMs: 0,
+		failed: 0,
+		inputTokens: 0,
+		live: 0,
+		models: [],
+		outputTokens: 0
+	};
+	for (const request of requests) {
+		usage.elapsedMs += request.elapsedMs;
+		if (request.error !== void 0) {
+			usage.failed += 1;
+			continue;
+		}
+		if (request.cached) usage.cached += 1;
+		else {
+			usage.live += 1;
+			usage.inputTokens += request.usage?.input_tokens ?? 0;
+			usage.outputTokens += request.usage?.output_tokens ?? 0;
+		}
+		if (request.model !== void 0 && !usage.models.includes(request.model)) usage.models.push(request.model);
+	}
+	return usage;
+};
+const countOf = (outcomes, status) => outcomes.filter((outcome) => outcome.status === status).length;
+/** One question's cases, one pool at a time, in manifest order. */
+const scorePools = (cases, observations, cutoff) => CALIBRATION_POOL_NAMES.map((pool) => {
+	const outcomes = cases.filter((entry) => entry.pool === pool).map((entry) => {
+		const observation = observations.get(entry.id) ?? {
+			kind: "unavailable",
+			reason: "the run recorded nothing for this case"
+		};
+		return {
+			expected: entry.expected,
+			id: entry.id,
+			knownMiss: entry.knownMiss ?? false,
+			path: entry.path,
+			...observation.kind === "unanswered" || observation.kind === "unavailable" ? { reason: observation.reason } : {},
+			...observation.kind === "answered" ? { score: observation.score } : {},
+			sha: entry.sha,
+			status: statusFor(entry.expected, observation, cutoff),
+			target: entry.target
+		};
+	});
+	return {
+		caught: countOf(outcomes, "caught"),
+		compared: outcomes.filter((outcome) => outcome.score !== void 0).length,
+		modelMisses: countOf(outcomes, "model-miss"),
+		outcomes,
+		pool,
+		quiet: countOf(outcomes, "quiet"),
+		selectorMisses: countOf(outcomes, "selector-miss"),
+		unanswered: countOf(outcomes, "unanswered"),
+		unavailable: countOf(outcomes, "unavailable")
+	};
+});
+//#endregion
+//#region src/jev-calibrate/select.ts
+/**
+* Selection: the project's Oxlint, running the project's plugin in `record`
+* mode over a rebuilt tree, and nothing else.
+*
+* There is no second selector here. Which nodes are asked about is whatever
+* the plugin recorded; this module only reads the records back and says where
+* each recorded node starts, so a labeled case can be joined to it.
+*
+* ## Two Linux hazards, both invisible on macOS
+*
+* Oxlint is launched as `process.execPath` running the Oxlint package's own
+* `bin/oxlint`, with `shell: false`. The `node_modules/.bin/oxlint` shim is a
+* `#!/bin/sh` script, and on Debian and Ubuntu `/bin/sh` is dash, which drops
+* every environment variable whose name is not a shell identifier — the HQ
+* credential names are hyphenated.
+*
+* It always runs with `--threads 1`. Oxlint maps a 6 GiB arena per lint
+* thread when JS plugins load, and on a small Linux runner the plugin's
+* subprocess then fails to fork with `ENOMEM` (`src/oxlint-jev/bridge.ts`
+* carries the measurements).
+*/
+/**
+* The project's Oxlint entry: the package's own `bin/oxlint`, resolved from the
+* directory the command runs in. That is the Oxlint the project's Jev config
+* runs with; there is no copy to fall back to.
+*/
+const resolveProjectOxlint = (cwd) => {
+	const root = installedPackageRoot(cwd, "oxlint");
+	if (root === void 0) throw new Error(`Oxlint is not installed where jev:calibrate runs: no node_modules/oxlint in ${cwd} or above it. Run the command from the package whose Jev config runs Oxlint.`);
+	const manifest = JSON.parse(readFileSync(path.join(root, "package.json"), "utf-8"));
+	const bin = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.oxlint;
+	if (bin === void 0) throw new Error(`the Oxlint package at ${root} declares no oxlint bin entry.`);
+	return path.join(root, bin);
+};
+/** The one way the command launches Oxlint. */
+const oxlintInvocation = (oxlintBin, files) => ({
+	args: [
+		oxlintBin,
+		"-c",
+		CALIBRATION_CONFIG_NAME,
+		"-f",
+		"json",
+		"--threads",
+		"1",
+		...files
+	],
+	command: process.execPath,
+	shell: false
+});
+/** Room for Oxlint's JSON report over a whole tree of recorded matches. */
+const MAX_OXLINT_OUTPUT_BYTES = 64 * 1024 * 1024;
+const describeDiagnostic = (entry) => `${entry.filename ?? "?"}:${entry.labels?.[0]?.span?.line ?? "?"} ${entry.code ?? "?"} ${entry.message ?? ""}`;
+/**
+* Runs the selection over `files` in `root`. The plugin writes one record per
+* request it would send; nothing is sent.
+*
+* The environment is the caller's, with the mode forced to `record` and the
+* HQ credentials removed: the selection run cannot spend, by construction.
+* Any non-zero exit — a plugin that did not load, a file that did not parse, a
+* `jev/unavailable` for a reference or an item too large for one request — is
+* a failed run, and every diagnostic that explains it is quoted.
+*/
+const runSelection = (oxlintBin, root, files) => {
+	const invocation = oxlintInvocation(oxlintBin, files);
+	const withheld = new Set([CF_ACCESS_CLIENT_ID_ENV, CF_ACCESS_CLIENT_SECRET_ENV]);
+	const env = {
+		...Object.fromEntries(Object.entries(process.env).filter(([name]) => !withheld.has(name))),
+		[JEV_MODE_ENV]: "record"
+	};
+	const child = spawnSync(invocation.command, invocation.args, {
+		cwd: root,
+		encoding: "utf-8",
+		env,
+		maxBuffer: MAX_OXLINT_OUTPUT_BYTES,
+		shell: invocation.shell
+	});
+	if (child.error !== void 0) throw new Error(`Oxlint could not run: ${child.error.code ?? child.error.message}`);
+	let diagnostics;
+	try {
+		({diagnostics} = JSON.parse(child.stdout));
+	} catch {
+		diagnostics = void 0;
+	}
+	if (child.status !== 0 || diagnostics === void 0) {
+		const explained = (diagnostics ?? []).filter((entry) => entry.code !== "jev(ask)").map(describeDiagnostic);
+		throw new Error([
+			`the selection run exited with status ${String(child.status)} in a tree rebuilt at one sha.`,
+			...explained,
+			child.stderr.trim()
+		].filter((line) => line !== "").join("\n"));
+	}
+};
+/** One file's recorded request, as the plugin wrote it. */
+const recordSchema = z.object({
+	body: z.object({
+		questions: z.record(z.string(), z.unknown()),
+		state: z.object({
+			file: z.object({ source: z.string() }).loose(),
+			matches: z.record(z.string(), z.unknown()),
+			path: z.string()
+		})
+	}),
+	matchKeys: z.array(z.string()).min(1),
+	path: z.string(),
+	requestHash: z.string()
+});
+/**
+* A match key is `<question id>@<start>-<end>`: the plugin's own key, whose
+* range is the selected node's offsets in the file text. The question id is
+* everything before the last `@`, since an id may itself contain one.
+*/
+const parseMatchKey = (key) => {
+	const at = key.lastIndexOf("@");
+	const range = /^(?<start>\d+)-\d+$/u.exec(key.slice(at + 1));
+	if (at <= 0 || range?.groups?.start === void 0) throw new Error(`the plugin recorded a match key calibration cannot read: ${key}`);
+	return {
+		question: key.slice(0, at),
+		start: Number(range.groups.start)
+	};
+};
+/** 1-based line and column of a string offset, as an editor counts them. */
+const positionOf = (source, offset) => {
+	const before = source.slice(0, offset);
+	return {
+		column: offset - before.lastIndexOf("\n"),
+		line: before.split("\n").length
+	};
+};
+/**
+* One recorded request rebuilt as the `JevFile` it came from.
+*
+* The rebuilt file is fed back through `buildJevRequests`, and the bytes must
+* hash to the plugin's own `requestHash`. That makes "grouped mode sends
+* exactly what the plugin would send" a checked fact rather than a claim: a
+* mismatch is a bug and ends the run.
+*/
+const rebuildUnit = (recordPath) => {
+	const record = recordSchema.parse(JSON.parse(readFileSync(recordPath, "utf-8")));
+	const { questions, state } = record.body;
+	const unit = {
+		matches: record.matchKeys.map((key) => ({
+			key,
+			questions: { [key]: questions[key] },
+			state: state.matches[key]
+		})),
+		path: state.path,
+		shared: state.file
+	};
+	const rebuilt = buildJevRequests({ files: [unit] });
+	if (rebuilt.requests.length !== 1 || rebuilt.unavailable.length > 0 || rebuilt.requests[0]?.hash !== record.requestHash) throw new Error(`the request rebuilt from ${recordPath} does not match the bytes the plugin recorded; calibration would measure a request the plugin never sends.`);
+	return unit;
+};
+/**
+* Runs the selection over the rebuilt tree at `root` and returns every node
+* the plugin selected. `files` are the repository-relative case files that
+* exist there.
+*/
+const selectMatches = (input) => {
+	runSelection(input.oxlintBin, input.root, input.files);
+	const directory = recordDirectoryFor(defaultJevCacheDirectory(input.root));
+	if (!existsSync(directory)) return [];
+	const selected = [];
+	for (const name of readdirSync(directory).toSorted()) {
+		const unit = rebuildUnit(path.join(directory, name));
+		const { source } = unit.shared;
+		for (const match of unit.matches) {
+			const { question, start } = parseMatchKey(match.key);
+			selected.push({
+				...positionOf(source, start),
+				key: match.key,
+				path: unit.path,
+				question,
+				unit
+			});
+		}
+	}
+	return selected;
+};
+//#endregion
+//#region src/jev-calibrate/run.ts
+/**
+* `psf jev:calibrate`: run the project's labeled cases through the project's
+* own Jev selection, ask HQ, and report each question against its own cutoff.
+*
+* The shape of a run:
+*
+* 1. Every case's file is rebuilt from git at its sha into a fresh tree, one
+*    tree per sha, at its repository-relative path — so the request the plugin
+*    builds names the same path a lint run from the repository root would.
+* 2. The project's Oxlint runs the project's plugin over each tree in `record`
+*    mode. That is the one selection path: a node is asked about if and only
+*    if the plugin recorded it.
+* 3. The command sends. Grouped (the default) sends each recorded request
+*    exactly as recorded — one request per file, every match in it — and
+*    `--solo` sends each labeled match in its own request with the same shared
+*    state. The plugin cannot send solo, and must not learn to: `--solo` is a
+*    measurement of this command, not a product mode. Both go through the
+*    shared Jev client with a cache that is fresh for this run.
+* 4. Each case is scored against its question's own cutoff.
+*
+* A Jev report is a session diagnostic (ADR 0034). This command gates
+* nothing, is never a verification command, and emits no evidence. It exits
+* non-zero only when the run itself did not complete: a case that could not be
+* rebuilt, a request that failed, or a run that compared no answers at all.
+*/
+const REPORT_SCHEMA_VERSION = 1;
+/** A file's bytes at a sha, or why there are none. Never a silent absence. */
+const blobAt = (root, sha, filePath) => {
+	try {
+		return { content: runCapture("git", [
+			"cat-file",
+			"blob",
+			`${sha}:${filePath}`
+		], root).stdout };
+	} catch {
+		return { reason: `${filePath} does not exist at ${sha}` };
+	}
+};
+const commitReachable = (root, sha) => {
+	try {
+		runCapture("git", [
+			"cat-file",
+			"-e",
+			`${sha}^{commit}`
+		], root);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const writeInto = (tree, filePath, content) => {
+	const target = path.join(tree, filePath);
+	mkdirSync(path.dirname(target), { recursive: true });
+	writeFileSync(target, content, "utf-8");
+};
+/**
+* Rebuilds one sha's tree and runs the selection over it. Returns the selected
+* nodes, and every case at this sha that could not be rebuilt, with why.
+*
+* References are rebuilt at the same sha as the code: a lint run at that
+* commit would have read them there. One that is absent is left absent, and
+* the plugin reports it as `jev/unavailable` if a question that needs it
+* matched — which fails the run by name.
+*/
+const selectAtSha = (input) => {
+	const unavailable = /* @__PURE__ */ new Map();
+	const { cases, repositoryRootPath: root, sha, tree } = input;
+	if (!commitReachable(root, sha)) {
+		for (const entry of cases) unavailable.set(entry.id, `${sha} is not a commit in this checkout: fetch it, or it has been garbage collected`);
+		return {
+			selected: [],
+			unavailable
+		};
+	}
+	const files = [];
+	for (const filePath of new Set(cases.map((entry) => entry.path))) {
+		const blob = blobAt(root, sha, filePath);
+		if ("reason" in blob) {
+			for (const entry of cases) if (entry.path === filePath) unavailable.set(entry.id, blob.reason);
+			continue;
+		}
+		writeInto(tree, filePath, blob.content);
+		files.push(filePath);
+	}
+	if (files.length === 0) return {
+		selected: [],
+		unavailable
+	};
+	const references = new Set(input.config.questions.flatMap((question) => question.references ?? []));
+	for (const reference of references) {
+		if (files.includes(reference)) continue;
+		const blob = blobAt(root, sha, reference);
+		if ("content" in blob) writeInto(tree, reference, blob.content);
+	}
+	writeFileSync(path.join(tree, CALIBRATION_CONFIG_NAME), `${JSON.stringify(calibrationOxlintConfig(input.config), null, 2)}\n`, "utf-8");
+	return {
+		selected: selectMatches({
+			files,
+			oxlintBin: input.oxlintBin,
+			root: tree
+		}),
+		unavailable
+	};
+};
+/**
+* The selected node a case labels, or why it cannot be named. A case that
+* names two nodes is refused rather than resolved: attributing one node's
+* answer to another's label is worse than not scoring the case.
+*/
+const locate = (entry, selected) => {
+	const { target } = entry;
+	const candidates = selected.filter((match) => match.path === entry.path && match.question === entry.question && (target === "file" || match.line === target.line && (target.column === void 0 || match.column === target.column)));
+	if (candidates.length > 1) return { reason: `${candidates.length} selected nodes of ${entry.question} start on line ${target === "file" ? "?" : target.line} of ${entry.path}; name a column` };
+	return { match: candidates[0] };
+};
+const questionOfKey = (key) => key.slice(0, key.lastIndexOf("@"));
+/**
+* The files to send. Grouped: each recorded request that carries at least one
+* labeled match, whole and unchanged — its other matches ride along exactly as
+* they would in a lint run. Solo: one request per labeled match, with the same
+* shared state and nothing else.
+*
+* A case's answer is read back from the unit it was sent in, never looked up
+* by match key across units: a key is unique within its file only.
+*/
+const unitsToSend = (mode, labeled) => {
+	if (mode === "solo") return [...labeled].map(([caseId, match]) => ({
+		cases: new Map([[caseId, match.key]]),
+		file: {
+			...match.unit,
+			matches: match.unit.matches.filter((candidate) => candidate.key === match.key)
+		}
+	}));
+	const byFile = /* @__PURE__ */ new Map();
+	for (const [caseId, match] of labeled) {
+		const unit = byFile.get(match.unit) ?? {
+			cases: /* @__PURE__ */ new Map(),
+			file: match.unit
+		};
+		unit.cases.set(caseId, match.key);
+		byFile.set(match.unit, unit);
+	}
+	return [...byFile.values()];
+};
+/**
+* Rebuilds every sha's tree, runs the selection over it, and joins each case
+* to the node it labels. Cases that cannot be rebuilt or attributed are
+* observed as unavailable; cases the plugin did not select, as not selected.
+* Two cases that resolve to one node end the run before anything is sent:
+* one answer would otherwise count twice, possibly in both pools and under
+* two labels.
+*/
+const observeSelection = (input) => {
+	const observations = /* @__PURE__ */ new Map();
+	const labeled = /* @__PURE__ */ new Map();
+	const bySha = /* @__PURE__ */ new Map();
+	for (const entry of input.cases) if (normalizeRepositorySlug(entry.repository) === input.repository) bySha.set(entry.sha, [...bySha.get(entry.sha) ?? [], entry]);
+	else observations.set(entry.id, {
+		kind: "unavailable",
+		reason: `the case names ${entry.repository}; this checkout is ${input.repository}`
+	});
+	for (const [sha, shaCases] of bySha) {
+		const tree = path.join(input.scratch, "trees", sha);
+		mkdirSync(tree, { recursive: true });
+		const { selected, unavailable } = selectAtSha({
+			cases: shaCases,
+			config: input.config,
+			oxlintBin: input.oxlintBin,
+			repositoryRootPath: input.root,
+			sha,
+			tree
+		});
+		const caseByNode = /* @__PURE__ */ new Map();
+		for (const entry of shaCases) {
+			const reason = unavailable.get(entry.id);
+			const located = reason === void 0 ? locate(entry, selected) : { reason };
+			if ("reason" in located) observations.set(entry.id, {
+				kind: "unavailable",
+				reason: located.reason
+			});
+			else if (located.match === void 0) observations.set(entry.id, { kind: "not-selected" });
+			else {
+				const node = `${located.match.path}\0${located.match.key}`;
+				const earlier = caseByNode.get(node);
+				if (earlier !== void 0) throw new Error(`cases ${earlier.id} (${earlier.pool}) and ${entry.id} (${entry.pool}) both resolve to the same selected node of ${entry.question} in ${entry.path} at ${sha}; one node takes one case.`);
+				caseByNode.set(node, entry);
+				labeled.set(entry.id, located.match);
+			}
+		}
+	}
+	return {
+		labeled,
+		observations
+	};
+};
+/**
+* Sends every unit, one at a time, through the shared Jev client and a cache
+* that is fresh for this run: an answer bought by an earlier run is never
+* counted as this run's measurement.
+*
+* Each unit gets its own `runJevFiles` call. A match key is unique within its
+* file only, so two files are never routed through one answer map.
+*/
+const sendUnits = async (units, gateway, cacheDirectory) => {
+	const cache = openJevCache({
+		directory: cacheDirectory,
+		endpoint: gateway.endpoint
+	});
+	const sent = [];
+	for (const unit of units) {
+		const result = await runJevFiles({
+			cache,
+			files: [unit.file],
+			gateway
+		});
+		sent.push({
+			...unit,
+			result
+		});
+	}
+	return sent;
+};
+/** Each sent case's answer, read back from the unit it was sent in. */
+const observeAnswers = (units, observations) => {
+	for (const unit of units) for (const [caseId, key] of unit.cases) {
+		const answer = unit.result.answersByMatchKey[key]?.[key];
+		observations.set(caseId, answer?.type === "noul" ? {
+			kind: "answered",
+			score: answer.noul
+		} : {
+			kind: "unanswered",
+			reason: unit.result.unavailableByMatchKey[key] ?? "the send returned no answer and no reason"
+		});
+	}
+};
+const questionReport = (question, cases, observations, units) => {
+	const carries = (key) => questionOfKey(key) === question.id;
+	const requests = units.filter((unit) => unit.file.matches.some((match) => carries(match.key))).flatMap((unit) => unit.result.requests);
+	return {
+		cutoff: question.cutoff,
+		id: question.id,
+		pools: scorePools(cases.filter((entry) => entry.question === question.id), observations, question.cutoff),
+		sentMatches: requests.flatMap((request) => request.matchKeys).filter(carries).length,
+		target: question.target,
+		textHash: question.textHash,
+		usage: usageOf(requests)
+	};
+};
+/** Every reason the run did not complete, each named. */
+const failuresOf = (questions, units, compared) => {
+	const failures = units.flatMap((unit) => unit.result.requests).filter((request) => request.error !== void 0).map((request) => `request for ${request.path} (${request.matchKeys.length} match(es)) failed: ${request.error ?? ""}`);
+	for (const question of questions) for (const pool of question.pools) for (const outcome of pool.outcomes) if (outcome.status === "unanswered" || outcome.status === "unavailable") failures.push(`case ${outcome.id} (${question.id}, ${pool.pool}) is ${outcome.status}: ${outcome.reason ?? ""}`);
+	if (compared === 0) failures.push("the run compared zero answers: no labeled case was both selected and answered, so nothing was measured");
+	return failures;
+};
+const runJevCalibration = async ({ casesDirectory, configPath, cwd, env = process.env, generatedAt, mode }) => {
+	if (resolveJevMode(env) !== "live") throw new Error(`jev:calibrate asks HQ and runs only with ${JEV_MODE_ENV}=live. To see what a question selects without spending, run the Jev config itself in record mode.`);
+	const gateway = await resolveJevGateway({ env });
+	if (gateway.status !== "ready") throw new Error(`jev:calibrate cannot ask HQ: ${gateway.reason}`);
+	const config = loadJevCalibrationConfig(configPath);
+	const { cases, pools } = loadCalibrationPools(casesDirectory, config.questions);
+	const oxlintBin = resolveProjectOxlint(cwd);
+	const root = repositoryRoot(cwd);
+	const repository = repositorySlug(checkoutRepository(root));
+	const scratch = mkdtempSync(path.join(tmpdir(), "jev-calibrate-"));
+	let observations;
+	let units;
+	try {
+		const selection = observeSelection({
+			cases,
+			config,
+			oxlintBin,
+			repository,
+			root,
+			scratch
+		});
+		({observations} = selection);
+		units = await sendUnits(unitsToSend(mode, selection.labeled), gateway, path.join(scratch, "cache"));
+	} finally {
+		rmSync(scratch, {
+			force: true,
+			recursive: true
+		});
+	}
+	observeAnswers(units, observations);
+	const questions = config.questions.map((question) => questionReport(question, cases, observations, units));
+	const compared = questions.flatMap((question) => question.pools).reduce((total, pool) => total + pool.compared, 0);
+	return {
+		casesDirectory,
+		compared,
+		configPath,
+		failures: failuresOf(questions, units, compared),
+		generatedAt: generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		manifests: pools.map((pool) => ({
+			path: pool.path,
+			pool: pool.name,
+			sha256: pool.sha256
+		})),
+		mode,
+		questions,
+		schemaVersion: REPORT_SCHEMA_VERSION,
+		usage: usageOf(units.flatMap((unit) => unit.result.requests))
+	};
+};
+//#endregion
+//#region src/commands/jev-calibrate.ts
+/**
+* `psf jev:calibrate` — ask HQ about a project's labeled Jev cases through the
+* project's own Oxlint and plugin, and report each question against its own
+* cutoff: caught, quiet, selector misses, model misses, usage and timing, for
+* the tuning pool and the holdout apart.
+*
+* **Exit codes.** Zero when the run completed, whatever Jev answered (ADR
+* 0034). Non-zero when it did not: a case that could not be rebuilt, a request
+* that failed, a run that compared zero answers, or a selection run that did
+* not finish. The report is printed first, so the reason is on screen.
+*/
+function createJevCalibrateCommand(output, action = runJevCalibration) {
+	return markCwdOptionDefault(new Command("jev:calibrate").description("Run labeled Jev cases through the project's own Oxlint and Jev plugin, ask HQ, and report each question's caught, quiet, selector misses and model misses against its own cutoff, for the tuning pool and the holdout apart. Spends only with PATRONAGE_JEV_MODE=live. A session diagnostic: never a gate").option("--cwd <path>", "directory the project's Oxlint and Jev plugin resolve from", collectCwdOption).requiredOption("--config <path>", "the project's dedicated Jev Oxlint config").requiredOption("--cases <dir>", "directory holding the tuning.json and holdout.json case manifests").option("--solo", "send each labeled match in its own request instead of the plugin's one request per file").option("--json", "print the JSON report instead of text").action(async (options) => {
+		const cwd = resolveCwdOption(options.cwd);
+		const report = await action({
+			casesDirectory: path.resolve(cwd, options.cases),
+			configPath: path.resolve(cwd, options.config),
+			cwd,
+			mode: options.solo === true ? "solo" : "grouped"
+		});
+		output.stdout.write(options.json ? `${JSON.stringify(report, null, 2)}\n` : renderJevCalibrationText(report));
+		if (report.failures.length > 0) throw new Error(`jev:calibrate did not complete: ${report.failures.length} failure(s), listed in the report.`);
+	}));
+}
+//#endregion
 //#region src/follow-up.ts
 const FACTORY_CLI_EXECUTABLE = "patronage-factory";
 const FactoryCliInvocationSchema = z.object({
@@ -22618,6 +24297,7 @@ function createProgram(options = {}) {
 	program.addCommand(createEvidenceEmitCommand(output));
 	program.addCommand(createCiAnalyzeCommand(output));
 	program.addCommand(createHqFlushCommand(output));
+	program.addCommand(createJevCalibrateCommand(output));
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));
 	program.addCommand(createPrVerifyCommand(output));
 	program.addCommand(createProductionImpactCommand(output));
@@ -22647,4 +24327,4 @@ async function run(argv = process.argv, cliEntry = factoryCliEntry()) {
 	}
 }
 //#endregion
-export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, DemandWaiveRefusalError, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, REVIEW_FOCUS_SECTION, WorkerCheckoutGuardError, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, comment_provenance_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evidenceEnvelopeFilename, followUpFromArgv, impactStampScopeDecision, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveTraceWriteSinks, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };
+export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, DemandWaiveRefusalError, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, FactoryCliInvocationSchema, FollowUpActionSchema, JevCacheError, JevRequestError, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, REVIEW_FOCUS_SECTION, UNKNOWN_MODEL, WorkerCheckoutGuardError, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildJevRequests, buildReviewGateNotRequiredTraceEvent, choice, comment_provenance_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, defaultJevCacheDirectory, doctorProjectProfile, epicStructureEventId, evidenceEnvelopeFilename, followUpFromArgv, impactStampScopeDecision, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, noul, openJevCache, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveJevGateway, resolveTraceWriteSinks, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runJevFiles, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, score, selectWaiversForCandidate, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };