@primitive.ai/prim 0.1.0-alpha.93 → 0.1.0-alpha.96

package/dist/hook-runtime/hooks/pre-tool-use.js

@@ -51,623 +51,597 @@ var require_ucs2length = __commonJS({
   }
 });
 
-// src/lib/activation.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+// src/client.ts
+import { createHash as createHash2 } from "crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
+import { dirname as dirname3 } from "path";
 
-// src/lib/git.ts
-import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-import { lstatSync, realpathSync } from "fs";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
-var GIT_TIMEOUT_MS = 1e3;
-var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
-var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
-function gitToplevel(cwd) {
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+var DEFAULT_FILE_MODE = 438;
+function syncDirectory(path) {
+  const fd = openSync(path, constants.O_RDONLY);
   try {
-    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS
-    }).trim();
-  } catch {
-    return null;
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
   }
 }
-function gitValue(cwd, args) {
-  try {
-    const value = execFileSync("git", args, {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS
-    }).trim();
-    return value || void 0;
-  } catch {
-    return void 0;
+function syncCreatedParentChain(firstCreatedParent, parent) {
+  const createdDirectories = [];
+  let current = parent;
+  while (current !== firstCreatedParent) {
+    createdDirectories.push(current);
+    const next = dirname(current);
+    if (next === current) {
+      throw new Error("recursive mkdir returned a path outside the target parent chain");
+    }
+    current = next;
+  }
+  createdDirectories.push(firstCreatedParent);
+  syncDirectory(dirname(firstCreatedParent));
+  for (const directory of createdDirectories.reverse().slice(0, -1)) {
+    syncDirectory(directory);
   }
 }
-function currentBranch(cwd) {
-  return gitValue(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
-}
-function githubRepositoryFullName(cwd) {
-  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
-  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
-  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
-    remote
-  );
-  const path = match?.[1] ?? match?.[2];
-  if (!path) return null;
-  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
-  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
-    return null;
+function ensureDurableDirectory(path, mode) {
+  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
+  if (firstCreatedParent) {
+    syncCreatedParentChain(firstCreatedParent, path);
   }
-  return `${parts[0]}/${parts[1]}`;
 }
-function canonicalGitRoot(cwd) {
+function atomicWriteFile(target, content, options = {}) {
+  const parent = dirname(target);
+  if (options.ensureParent) {
+    ensureDurableDirectory(parent);
+  }
+  const temporaryPath = `${target}.${randomUUID()}.tmp`;
+  let temporaryCreated = false;
   try {
-    const top = gitToplevel(cwd);
-    return top ? realpathSync.native(top) : null;
-  } catch {
-    return null;
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
+    temporaryCreated = true;
+    try {
+      if (options.mode !== void 0) fchmodSync(fd, options.mode);
+      writeFileSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    options.validate?.(temporaryPath);
+    renameSync(temporaryPath, target);
+    syncDirectory(parent);
+  } catch (error) {
+    if (temporaryCreated) {
+      try {
+        rmSync(temporaryPath, { force: true });
+      } catch {
+      }
+    }
+    throw error;
   }
 }
-function normalizeOriginRemote(remote) {
-  const value = remote.trim();
-  if (!value) return void 0;
-  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
-  if (scp?.host && scp.path) {
-    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
-    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
   }
-  try {
-    const url = new URL(value);
-    url.username = "";
-    url.password = "";
-    url.search = "";
-    url.hash = "";
-    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
-    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
-    return void 0;
-  } catch {
-    return void 0;
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
   }
+  return { path: join(home, ".config", "prim"), source: "default" };
 }
-function opaqueRepoKey(source, value) {
-  return `repo_v1_${createHash("sha256").update(`${source}\0${value}`).digest("hex")}`;
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
 }
-function resolveRepositoryContext(cwd = process.cwd()) {
-  const top = gitToplevel(cwd);
-  if (!top) return null;
-  let repoRoot;
-  try {
-    repoRoot = realpathSync.native(top);
-  } catch {
-    repoRoot = resolve(top);
+
+// src/lib/workos-connect.ts
+var TOKEN_PATH = "/oauth2/token";
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
   }
-  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
-  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
-  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
-  if (normalizedOrigin) {
-    return {
-      repoRoot,
-      repoKey: opaqueRepoKey("origin", normalizedOrigin),
-      identitySource: "origin",
-      repoFullName
-    };
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
   }
-  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
-  if (roots && roots.length > 0) {
-    return {
-      repoRoot,
-      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
-      identitySource: "root_commit",
-      repoFullName
-    };
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
   }
-  return { repoRoot, repoFullName };
+  return value;
 }
-function nearestExistingAncestor(path) {
-  const suffix = [];
-  let cursor = path;
-  while (true) {
-    try {
-      lstatSync(cursor);
-      break;
-    } catch (error) {
-      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
-      const parent = dirname(cursor);
-      if (parent === cursor) return null;
-      suffix.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
-      cursor = parent;
-    }
+function safeInteger(value, field, minimum, maximum) {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
   }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
   try {
-    return { real: realpathSync.native(cursor), suffix };
+    parsed = new URL(issuer);
   } catch {
-    return null;
-  }
-}
-function canonicalRepositoryPathScoped(filePath, context, baseDir) {
-  if (!filePath || filePath !== filePath.trim() || filePath.includes("\0")) {
-    return { ok: false, reason: "invalid_path" };
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
   }
-  const absolute = resolve(baseDir, filePath);
-  const resolved = nearestExistingAncestor(absolute);
-  if (!resolved) return { ok: false, reason: "invalid_path" };
-  const target = resolve(resolved.real, ...resolved.suffix);
-  const rel = relative(context.repoRoot, target);
-  if (!rel || rel === ".") return { ok: false, reason: "invalid_path" };
-  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
-    return { ok: false, reason: "outside_repository" };
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
   }
-  return { ok: true, file: sep === "/" ? rel : rel.split(sep).join("/") };
+  return issuer;
 }
-function canonicalRepositoryPathLegacy(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
-  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
-    return null;
-  const absolute = resolve(cwd, filePath);
-  let target;
-  try {
-    const stat = lstatSync(absolute);
-    if (!stat.isFile() || stat.isSymbolicLink()) return null;
-    target = realpathSync.native(absolute);
-  } catch (error) {
-    if (!(error instanceof Error) || error.code !== "ENOENT") {
-      return null;
-    }
-    try {
-      const parent = realpathSync.native(dirname(absolute));
-      if (!lstatSync(parent).isDirectory()) return null;
-      target = resolve(parent, basename(absolute));
-    } catch {
-      return null;
-    }
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
   }
-  const rel = relative(repositoryRoot, target);
-  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
-    return null;
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
   }
-  return sep === "/" ? rel : rel.split(sep).join("/");
-}
-function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
-  if (typeof contextOrCwd === "string") {
-    return canonicalRepositoryPathLegacy(filePath, contextOrCwd, baseDirOrRoot);
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
   }
-  return canonicalRepositoryPathScoped(
-    filePath,
-    contextOrCwd,
-    baseDirOrRoot ?? contextOrCwd.repoRoot
-  );
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
 }
-
-// src/lib/activation.ts
-var PRIM_ACTIVE_KEY = "prim.active";
-var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
-var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
-var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
-var GIT_TIMEOUT_MS2 = 1e3;
-var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json", ".cursor/hooks.json"];
-var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
-function repoActiveFlag(cwd) {
+async function readBoundedJson(response, maxBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    if (!/^\d+$/u.test(contentLength) || Number(contentLength) > maxBytes) {
+      throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+    }
+  }
+  if (!response.body) {
+    throw new WorkosConnectProtocolError("invalid_response", "response body is missing");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
   try {
-    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS2
-    }).trim();
-    if (value === "true") return "true";
-    if (value === "false") return "false";
-    return void 0;
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      total += result.value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return JSON.parse(text);
   } catch {
-    return void 0;
+    throw new WorkosConnectProtocolError("invalid_response", "response body is not valid JSON");
   }
 }
-function isRepoActive(cwd) {
-  return repoActiveFlag(cwd) === "true";
+function workosConnectTokenEndpoint(issuer) {
+  return `${issuer}${TOKEN_PATH}`;
 }
-function isValidRepoSyncId(value) {
-  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+function parseWorkosConnectTokens(value, options = {}) {
+  const record = recordFrom(value, "token response");
+  const accessToken = exactString(
+    record.access_token,
+    "access_token",
+    WORKOS_CONNECT_RESPONSE_MAX_BYTES
+  );
+  const refreshToken2 = record.refresh_token === void 0 && options.fallbackRefreshToken !== void 0 ? options.fallbackRefreshToken : exactString(record.refresh_token, "refresh_token", WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+  return {
+    accessToken,
+    refreshToken: refreshToken2,
+    expiresIn: record.expires_in === void 0 ? void 0 : safeInteger(record.expires_in, "expires_in", 1, MAX_TOKEN_LIFETIME_SECONDS)
+  };
 }
-function localGitConfigValue(cwd, key) {
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
   try {
-    const value = execFileSync2("git", ["config", "--local", "--get", key], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS2
-    }).trim();
+    const value = readFileSync(path, "utf8").trim();
     return value || void 0;
   } catch {
     return void 0;
   }
 }
-function repoSyncId(cwd) {
-  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
-  if (!isValidRepoSyncId(value)) return void 0;
-  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
-  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
-}
-function repositoryBindingState(cwd) {
-  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
-  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
-  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
-  if (marker === "unbound" || marker === "invalid") return marker;
-  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
-  if (marker !== void 0) return "invalid";
-  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
-}
-function hasProjectPrimInstall(cwd) {
-  const root = gitToplevel(cwd);
-  if (root === null || root === homedir()) return false;
-  for (const rel of PROJECT_INSTALL_FILES) {
-    const path = join(root, rel);
-    if (existsSync(path)) {
-      try {
-        const content = readFileSync(path, "utf-8");
-        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
-      } catch {
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken3 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken3 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken3)) {
+        return void 0;
       }
     }
+    return { token: stored, source: "token_file" };
   }
-  return false;
-}
-function isRepoActiveForCapture(cwd) {
-  const flag = repoActiveFlag(cwd);
-  if (flag === "true") return true;
-  if (flag === "false") return false;
-  return hasProjectPrimInstall(cwd);
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
 }
-function decisionIngestionStatus(cwd) {
-  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
 }
-
-// src/lib/bin-path.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2 } from "path";
-import { fileURLToPath } from "url";
-var PKG_NAME = "@primitive.ai/prim";
-var ROOT_WALK_LIMIT = 6;
-var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
-var resolvedRoot;
-function locateRoot() {
-  if (resolvedRoot !== void 0) {
-    return resolvedRoot;
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
   }
-  let dir = dirname2(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
-    const manifestPath = join2(dir, "package.json");
-    if (existsSync2(manifestPath)) {
-      try {
-        const manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
-        if (manifest.name === PKG_NAME && manifest.bin) {
-          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
-          return resolvedRoot;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
   }
-  resolvedRoot = null;
-  return resolvedRoot;
-}
-function packageVersion() {
-  return locateRoot()?.version ?? null;
-}
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
 }
-var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
-var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
-function stableHookCommand(bin, args = "") {
-  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
-    throw new Error("invalid stable hook command");
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
   }
-  const resolver = [
-    // #242 and earlier identify managed commands by this package marker. Keep
-    // it as inert data during the rolling window so an older uninstall or
-    // reinstall can remove the stable entry without invoking npm or PATH.
-    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
-    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
-    'exec "$prim_launcher" "$@"'
-  ].join("");
-  const suffix = args ? ` ${args}` : "";
-  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
-}
-function detachedHookShimCommand(bin, args = "") {
-  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
-}
-
-// src/client.ts
-import { createHash as createHash3 } from "crypto";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync3 } from "fs";
-import { dirname as dirname5 } from "path";
-
-// src/lib/atomic-file.ts
-import { randomUUID } from "crypto";
-import {
-  constants,
-  closeSync,
-  fchmodSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  renameSync,
-  rmSync,
-  writeFileSync
-} from "fs";
-import { dirname as dirname3 } from "path";
-var DEFAULT_FILE_MODE = 438;
-function syncDirectory(path) {
-  const fd = openSync(path, constants.O_RDONLY);
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
   try {
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
 }
-function syncCreatedParentChain(firstCreatedParent, parent) {
-  const createdDirectories = [];
-  let current = parent;
-  while (current !== firstCreatedParent) {
-    createdDirectories.push(current);
-    const next = dirname3(current);
-    if (next === current) {
-      throw new Error("recursive mkdir returned a path outside the target parent chain");
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
     }
-    current = next;
-  }
-  createdDirectories.push(firstCreatedParent);
-  syncDirectory(dirname3(firstCreatedParent));
-  for (const directory of createdDirectories.reverse().slice(0, -1)) {
-    syncDirectory(directory);
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
   }
 }
-function ensureDurableDirectory(path, mode) {
-  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
-  if (firstCreatedParent) {
-    syncCreatedParentChain(firstCreatedParent, path);
-  }
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
 }
-function atomicWriteFile(target, content, options = {}) {
-  const parent = dirname3(target);
-  if (options.ensureParent) {
-    ensureDurableDirectory(parent);
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
   }
-  const temporaryPath = `${target}.${randomUUID()}.tmp`;
-  let temporaryCreated = false;
+  if (parsed === null) return { state: "invalid" };
   try {
-    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
-    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
-    temporaryCreated = true;
-    try {
-      if (options.mode !== void 0) fchmodSync(fd, options.mode);
-      writeFileSync(fd, content);
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    options.validate?.(temporaryPath);
-    renameSync(temporaryPath, target);
-    syncDirectory(parent);
-  } catch (error) {
-    if (temporaryCreated) {
-      try {
-        rmSync(temporaryPath, { force: true });
-      } catch {
-      }
-    }
-    throw error;
-  }
-}
-
-// src/lib/credentials.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
-
-// src/lib/paths.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute3, join as join3, normalize } from "path";
-var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
-function absolutePath(value, variable) {
-  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
-    throw new Error(`${variable} contains unsafe characters`);
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
   }
-  if (!value || value.trim() !== value || !isAbsolute3(value)) return;
-  const normalized = normalize(value);
-  return normalized === value ? value : void 0;
 }
-function resolvePrimConfigDirectory(options = {}) {
-  const env = options.env ?? process.env;
-  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
-  if (explicit) return { path: explicit, source: "explicit" };
-  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
-  if (xdgConfigHome) return { path: join3(xdgConfigHome, "prim"), source: "xdg" };
-  const home = absolutePath(options.homeDir ?? homedir2(), "HOME");
-  if (!home) {
-    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
   }
-  return { path: join3(home, ".config", "prim"), source: "default" };
 }
-function primConfigDirectory(options = {}) {
-  return resolvePrimConfigDirectory(options).path;
+function jwtExpiresAt(token) {
+  const exp = decodeJwtPayload(token)?.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
 }
 
-// src/lib/workos-connect.ts
-var TOKEN_PATH = "/oauth2/token";
-var DISCOVERY_MAX_BYTES = 16 * 1024;
-var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
-var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
-var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
-var MAX_URL_LENGTH = 2048;
-var MAX_CLIENT_ID_LENGTH = 256;
-var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
-var WorkosConnectProtocolError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "WorkosConnectProtocolError";
-    this.code = code;
-  }
-};
-function recordFrom(value, label) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+
+// src/lib/process-liveness.ts
+function processIsAlive(pid, probe = process.kill) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    probe(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
   }
-  return value;
 }
-function exactString(value, field, maxLength) {
-  const containsControl = typeof value === "string" && [...value].some((character) => {
-    const code = character.charCodeAt(0);
-    return code <= 31 || code === 127;
-  });
-  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
-    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
-  }
-  return value;
+
+// src/lib/file-lock.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_POLL_MS = 50;
+var DEFAULT_INIT_GRACE_MS = 2e3;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+function ownerPath(lockDir) {
+  return join3(lockDir, "owner.json");
 }
-function safeInteger(value, field, minimum, maximum) {
-  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
-    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+function readOwner(lockDir) {
+  try {
+    const owner = JSON.parse(readFileSync2(ownerPath(lockDir), "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
+      return null;
+    }
+    return owner;
+  } catch {
+    return null;
   }
-  return value;
 }
-function canonicalIssuer(value) {
-  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
-  let parsed;
+function sameOwner(a, b) {
+  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+}
+function tryTakeLock(lockDir, now) {
   try {
-    parsed = new URL(issuer);
-  } catch {
-    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+    mkdirSync2(lockDir, { mode: DIRECTORY_MODE });
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
   }
-  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
-    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  const owner = {
+    pid: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    createdAt: now
+  };
+  try {
+    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE,
+      flag: "wx"
+    });
+    return owner;
+  } catch (error) {
+    rmSync2(lockDir, { recursive: true, force: true });
+    throw error;
   }
-  return issuer;
 }
-function parseWorkosConnectCredentialMetadata(value) {
-  const record = recordFrom(value, "credential metadata");
-  if (record.version !== 1 || record.family !== "workos_connect") {
-    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
-  }
-  const issuer = canonicalIssuer(record.issuer);
-  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
-  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
-  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
-  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
-    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+function recoverStaleLock(lockDir, now, alive, initGraceMs) {
+  const owner = readOwner(lockDir);
+  if (owner) {
+    if (alive(owner.pid)) return false;
+    if (!sameOwner(readOwner(lockDir), owner)) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
   }
-  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
-    throw new WorkosConnectProtocolError(
-      "invalid_metadata",
-      "credential accessTokenHash is invalid"
-    );
+  try {
+    const before = statSync(lockDir).mtimeMs;
+    if (now - before < initGraceMs) return false;
+    if (readOwner(lockDir)) return false;
+    if (statSync(lockDir).mtimeMs !== before) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return true;
   }
-  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
-    throw new WorkosConnectProtocolError(
-      "invalid_metadata",
-      "credential refreshTokenHash is invalid"
-    );
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError(signal);
+}
+async function defaultSleep(ms, signal) {
+  if (!signal) {
+    await new Promise((resolve5) => setTimeout(resolve5, ms));
+    return;
   }
-  return {
-    version: 1,
-    family: "workos_connect",
-    issuer,
-    clientId,
-    accessTokenHash,
-    refreshTokenHash
-  };
+  throwIfAborted(signal);
+  await new Promise((resolve5, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve5();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
 }
-async function readBoundedJson(response, maxBytes) {
-  const contentLength = response.headers.get("content-length");
-  if (contentLength !== null) {
-    if (!/^\d+$/u.test(contentLength) || Number(contentLength) > maxBytes) {
-      throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+async function withFileLock(lockDir, operation, options = {}) {
+  mkdirSync2(dirname2(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    throwIfAborted(options.signal);
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    if (options.sleep) {
+      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
+      throwIfAborted(options.signal);
+    } else {
+      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
     }
   }
-  if (!response.body) {
-    throw new WorkosConnectProtocolError("invalid_response", "response body is missing");
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
   try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) break;
-      total += result.value.byteLength;
-      if (total > maxBytes) {
-        await reader.cancel();
-        throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
-      }
-      chunks.push(result.value);
-    }
+    throwIfAborted(options.signal);
+    return await operation();
   } finally {
-    reader.releaseLock();
-  }
-  const bytes = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync2(lockDir, { recursive: true, force: true });
+    }
   }
-  let text;
-  try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    return JSON.parse(text);
-  } catch {
-    throw new WorkosConnectProtocolError("invalid_response", "response body is not valid JSON");
+}
+
+// src/lib/terminal-safe.ts
+function replaceIsolatedSurrogates(value) {
+  let out = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += value[index] + value[index + 1];
+        index += 1;
+      } else {
+        out += "\uFFFD";
+      }
+    } else if (unit >= 56320 && unit <= 57343) {
+      out += "\uFFFD";
+    } else {
+      out += value[index];
+    }
   }
+  return out;
 }
-function workosConnectTokenEndpoint(issuer) {
-  return `${issuer}${TOKEN_PATH}`;
+function isUnsafeTerminalCodePoint(point) {
+  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
+  const bidiOrZeroWidth = point === 173 || // soft hyphen
+  point === 1564 || // Arabic letter mark
+  point === 6158 || // Mongolian vowel separator
+  point >= 8203 && point <= 8207 || // zero-width + directional marks
+  point >= 8234 && point <= 8238 || // bidi embeddings/overrides
+  point >= 8288 && point <= 8303 || // word joiner + bidi isolates/controls
+  point >= 65529 && point <= 65531 || // interlinear annotation controls
+  point === 65279 || // zero-width no-break space / BOM
+  point >= 917504 && point <= 917631;
+  return c0OrC1 || bidiOrZeroWidth;
 }
-function parseWorkosConnectTokens(value, options = {}) {
-  const record = recordFrom(value, "token response");
-  const accessToken = exactString(
-    record.access_token,
-    "access_token",
-    WORKOS_CONNECT_RESPONSE_MAX_BYTES
-  );
-  const refreshToken2 = record.refresh_token === void 0 && options.fallbackRefreshToken !== void 0 ? options.fallbackRefreshToken : exactString(record.refresh_token, "refresh_token", WORKOS_CONNECT_RESPONSE_MAX_BYTES);
-  return {
-    accessToken,
-    refreshToken: refreshToken2,
-    expiresIn: record.expires_in === void 0 ? void 0 : safeInteger(record.expires_in, "expires_in", 1, MAX_TOKEN_LIFETIME_SECONDS)
-  };
+function terminalSafeText(value) {
+  return Array.from(replaceIsolatedSurrogates(value)).filter((character) => !isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0)).join("");
+}
+function terminalSafeLine(value) {
+  return terminalSafeText(value.replace(/\s+/gu, " ")).replace(/\s+/gu, " ").trim();
 }
+var stripControlChars = terminalSafeText;
 
-// src/lib/credentials.ts
-var CONFIG_DIRECTORY = primConfigDirectory();
-var TOKEN_FILE_PATH = join4(CONFIG_DIRECTORY, "token");
-var REFRESH_TOKEN_PATH = join4(CONFIG_DIRECTORY, "refresh_token");
-var TOKEN_EXPIRES_PATH = join4(CONFIG_DIRECTORY, "token_expires_at");
-var TERMINAL_REFRESH_PATH = join4(CONFIG_DIRECTORY, "refresh_terminal");
-var CREDENTIAL_METADATA_PATH = join4(CONFIG_DIRECTORY, "credential_metadata.json");
-var CREDENTIAL_FAMILY_PATH = join4(CONFIG_DIRECTORY, "credential_family.json");
-var CREDENTIAL_MIGRATION_PATH = join4(CONFIG_DIRECTORY, "credential_migration.json");
-var CREDENTIAL_LOCK_PATH = join4(CONFIG_DIRECTORY, "credentials.lock");
-var MAX_CREDENTIAL_METADATA_BYTES = 4096;
-var CREDENTIAL_MIGRATION_VERSION = 1;
-var CREDENTIAL_MIGRATION_STATE = "family_bound";
-function readTrimmed(path) {
+// src/client.ts
+var CONFIG_DIR_MODE = 448;
+var CREDENTIAL_FILE_MODE = 384;
+var REFRESH_THRESHOLD_MS = 6e4;
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
+var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
+function readTrimmed2(path) {
   try {
     const value = readFileSync3(path, "utf8").trim();
     return value || void 0;
@@ -675,757 +649,786 @@ function readTrimmed(path) {
     return void 0;
   }
 }
-function resolveAuthCredential(options = {}) {
-  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
-  if (envToken) return { token: envToken, source: "environment" };
-  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
-  if (!stored) return void 0;
-  const metadata = readStoredCredentialMetadata(
-    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
-    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
-    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
-  );
-  if (metadata.state === "legacy_broker") {
-    if (metadata.metadata) {
-      const refreshToken3 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
-      if (!refreshToken3 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken3)) {
-        return void 0;
-      }
-    }
-    return { token: stored, source: "token_file" };
-  }
-  if (metadata.state === "invalid") return void 0;
-  const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
-  if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
-    return void 0;
-  }
-  return { token: stored, source: "token_file" };
+function getSiteUrl() {
+  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
 }
-function credentialFingerprint(value) {
-  return createHash2("sha256").update(value).digest("hex");
+function getSiteUrlForEnvironment(primApiUrl) {
+  return primApiUrl?.trim() || DEFAULT_API_URL;
 }
-function parseLegacyBrokerCredentialMetadata(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("credential family is invalid");
-  }
-  const record = value;
-  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
-    throw new Error("credential family is invalid");
-  }
+function expiresAtFor(token, expiresIn) {
+  return expiresIn === void 0 ? jwtExpiresAt(token) : Date.now() + expiresIn * 1e3;
+}
+function ensureConfigDirectory() {
+  const directory = dirname3(TOKEN_FILE_PATH);
+  mkdirSync3(directory, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodSync(directory, CONFIG_DIR_MODE);
+}
+function atomicWrite(path, content) {
+  ensureConfigDirectory();
+  atomicWriteFile(path, content, { mode: CREDENTIAL_FILE_MODE });
+}
+function removeCredentialFile(path) {
+  if (!existsSync2(path)) return false;
+  rmSync3(path, { force: true });
+  return true;
+}
+function getTokenExpiresAt() {
+  const stored = readTrimmed2(TOKEN_EXPIRES_PATH);
+  if (stored === void 0) return void 0;
+  const value = Number(stored);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function isTokenExpiringSoon(credential) {
+  if (credential.source !== "token_file") return false;
+  const expiresAt = getTokenExpiresAt();
+  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
+}
+function refreshFingerprint(refreshToken2) {
+  return createHash2("sha256").update(refreshToken2).digest("hex");
+}
+function legacyBrokerCredentialMetadata(accessToken, refreshToken2) {
   return {
     version: 1,
     family: "legacy_broker",
-    accessTokenHash: record.accessTokenHash,
-    refreshTokenHash: record.refreshTokenHash
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
   };
 }
-function readBoundedCredentialJson(path) {
-  let raw;
-  try {
-    raw = readFileSync3(path, "utf8");
-  } catch (error) {
-    return error.code === "ENOENT" ? void 0 : null;
-  }
-  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function readCredentialFamily(path) {
-  const parsed = readBoundedCredentialJson(path);
-  if (parsed === void 0) return void 0;
-  if (parsed === null) return { state: "invalid" };
-  try {
-    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
-      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
-    }
-    return {
-      state: "workos_connect",
-      metadata: parseWorkosConnectCredentialMetadata(parsed)
-    };
-  } catch {
-    return { state: "invalid" };
-  }
-}
-function isCredentialMigrationSentinel(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  const record = value;
-  const keys = Object.keys(record).sort();
-  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+function credentialFamilyMetadata(accessToken, refreshToken2, metadata) {
+  const hashes = {
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
+  };
+  return metadata === void 0 ? legacyBrokerCredentialMetadata(accessToken, refreshToken2) : { ...metadata, ...hashes };
 }
-function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
-  const parsed = readBoundedCredentialJson(path);
-  if (parsed === void 0) return "absent";
-  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+function writeCredentialMigrationSentinel() {
+  atomicWrite(
+    CREDENTIAL_MIGRATION_PATH,
+    `${JSON.stringify({
+      version: CREDENTIAL_MIGRATION_VERSION,
+      state: CREDENTIAL_MIGRATION_STATE
+    })}
+`
+  );
 }
-function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
-  const family = readCredentialFamily(familyPath);
-  if (family) return family;
-  const parsed = readBoundedCredentialJson(metadataPath);
-  if (parsed === void 0) {
-    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+function bindLegacyBrokerGeneration(accessToken, refreshToken2, metadata) {
+  if (metadata.state !== "legacy_broker" || !accessToken || !refreshToken2) {
+    return { state: "invalid" };
   }
-  if (parsed === null) return { state: "invalid" };
-  try {
-    return {
-      state: "workos_connect",
-      metadata: parseWorkosConnectCredentialMetadata(parsed)
-    };
-  } catch {
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  if (metadata.metadata !== void 0 && (metadata.metadata.accessTokenHash !== familyMetadata.accessTokenHash || metadata.metadata.refreshTokenHash !== familyMetadata.refreshTokenHash)) {
     return { state: "invalid" };
   }
-}
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return void 0;
-  try {
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
-    return payload;
-  } catch {
-    return void 0;
+  if (metadata.metadata === void 0) {
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
   }
+  const migrationState = readCredentialMigrationState();
+  if (migrationState === "invalid") return { state: "invalid" };
+  if (migrationState === "absent") writeCredentialMigrationSentinel();
+  return { state: "legacy_broker", metadata: familyMetadata };
 }
-function jwtExpiresAt(token) {
-  const exp = decodeJwtPayload(token)?.exp;
-  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
+function preserveMarkerlessLegacyGeneration() {
+  const metadata = readStoredCredentialMetadata();
+  if (metadata.state !== "legacy_broker" || metadata.metadata !== void 0) return;
+  const accessToken = readTrimmed2(TOKEN_FILE_PATH);
+  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!(accessToken && refreshToken2)) return;
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
 }
-
-// src/lib/file-lock.ts
-import { randomBytes } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/lib/process-liveness.ts
-function processIsAlive(pid, probe = process.kill) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
-  try {
-    probe(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
+function terminalFingerprint() {
+  return readTrimmed2(TERMINAL_REFRESH_PATH);
 }
-
-// src/lib/file-lock.ts
-var DEFAULT_TIMEOUT_MS = 3e4;
-var DEFAULT_POLL_MS = 50;
-var DEFAULT_INIT_GRACE_MS = 2e3;
-var DIRECTORY_MODE = 448;
-var FILE_MODE = 384;
-function ownerPath(lockDir) {
-  return join5(lockDir, "owner.json");
+function writeTerminalFingerprint(refreshToken2) {
+  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
+`);
 }
-function readOwner(lockDir) {
-  try {
-    const owner = JSON.parse(readFileSync4(ownerPath(lockDir), "utf8"));
-    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
-      return null;
-    }
-    return owner;
-  } catch {
-    return null;
-  }
+function clearTerminalFingerprint() {
+  removeCredentialFile(TERMINAL_REFRESH_PATH);
 }
-function sameOwner(a, b) {
-  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+function isSessionEnded() {
+  if (resolveAuthCredential()?.source !== "token_file") return false;
+  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
+  const ended = terminalFingerprint();
+  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
 }
-function tryTakeLock(lockDir, now) {
-  try {
-    mkdirSync2(lockDir, { mode: DIRECTORY_MODE });
-  } catch (error) {
-    if (error.code === "EEXIST") return null;
-    throw error;
+function withCredentialLock(operation, options = {}) {
+  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
+}
+function commitCredentialsUnlocked(credentials) {
+  const accessToken = credentials.accessToken.trim();
+  const refreshToken2 = credentials.refreshToken.trim();
+  if (!accessToken || !refreshToken2) {
+    throw new Error("OAuth credentials require both access and refresh tokens");
   }
-  const owner = {
-    pid: process.pid,
-    nonce: randomBytes(16).toString("hex"),
-    createdAt: now
-  };
-  try {
-    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
-`, {
-      encoding: "utf8",
-      mode: FILE_MODE,
-      flag: "wx"
-    });
-    return owner;
-  } catch (error) {
-    rmSync2(lockDir, { recursive: true, force: true });
-    throw error;
+  const familyMetadata = credentialFamilyMetadata(accessToken, refreshToken2, credentials.metadata);
+  if (credentials.metadata !== void 0) {
+    preserveMarkerlessLegacyGeneration();
+    writeCredentialMigrationSentinel();
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(CREDENTIAL_METADATA_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+  } else {
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    removeCredentialFile(CREDENTIAL_METADATA_PATH);
   }
+  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
+  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
+  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
+`);
+  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
+`);
+  clearTerminalFingerprint();
+  _cachedCredential = { token: accessToken, source: "token_file" };
 }
-function recoverStaleLock(lockDir, now, alive, initGraceMs) {
-  const owner = readOwner(lockDir);
-  if (owner) {
-    if (alive(owner.pid)) return false;
-    if (!sameOwner(readOwner(lockDir), owner)) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
-  }
+function isTerminalRefreshResponse(response, detail) {
+  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
   try {
-    const before = statSync(lockDir).mtimeMs;
-    if (now - before < initGraceMs) return false;
-    if (readOwner(lockDir)) return false;
-    if (statSync(lockDir).mtimeMs !== before) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
+    const error = JSON.parse(detail).error;
+    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
   } catch {
-    return true;
+    return response.status === 401 && detail.includes("Invalid or expired refresh token");
   }
 }
-function abortError(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
+function workosConnectRefreshErrorCode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
+  return value.error === "invalid_grant" ? "invalid_grant" : "";
 }
-function throwIfAborted(signal) {
-  if (signal?.aborted) throw abortError(signal);
+function refreshDiagnostic(response, detail, quiet, provider) {
+  if (quiet) return;
+  const statusText = terminalSafeLine(response.statusText).slice(0, 120);
+  const safeDetail = terminalSafeLine(detail).slice(0, 200);
+  process.stderr.write(
+    `[prim] token refresh rejected by ${provider}: ${response.status}${statusText ? ` ${statusText}` : ""}${safeDetail ? ` \u2014 ${safeDetail}` : ""}
+`
+  );
 }
-async function defaultSleep(ms, signal) {
-  if (!signal) {
-    await new Promise((resolve5) => setTimeout(resolve5, ms));
-    return;
+function metadataMatchesCredentialGeneration(expected, accessToken, refreshToken2) {
+  const current = readStoredCredentialMetadata();
+  if (expected.state === "legacy_broker") {
+    if (current.state !== "legacy_broker") return false;
+    if (!expected.metadata) return current.metadata === void 0;
+    return current.metadata !== void 0 && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
   }
-  throwIfAborted(signal);
-  await new Promise((resolve5, reject) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve5();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(abortError(signal));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
+  if (expected.state !== "workos_connect" || current.state !== "workos_connect") return false;
+  return current.metadata.issuer === expected.metadata.issuer && current.metadata.clientId === expected.metadata.clientId && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
 }
-var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
-async function withFileLock(lockDir, operation, options = {}) {
-  mkdirSync2(dirname4(lockDir), { recursive: true, mode: DIRECTORY_MODE });
-  const nowMs = options.nowMs ?? Date.now;
-  const alive = options.processAlive ?? processIsAlive;
-  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  let owner = null;
-  while (!owner) {
-    throwIfAborted(options.signal);
-    const now = nowMs();
-    owner = tryTakeLock(lockDir, now);
-    if (owner) break;
-    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
-    if (now >= deadline) {
-      throw new Error(`timed out waiting for file lock ${lockDir}`);
-    }
-    if (options.sleep) {
-      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
-      throwIfAborted(options.signal);
-    } else {
-      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
-    }
-  }
-  try {
-    throwIfAborted(options.signal);
-    return await operation();
-  } finally {
-    if (sameOwner(readOwner(lockDir), owner)) {
-      rmSync2(lockDir, { recursive: true, force: true });
-    }
+function uncoordinatedLegacyWinnerAccessToken(expected, currentGeneration) {
+  if (!expected || readCredentialMigrationState() !== "valid") return void 0;
+  const stored = readStoredCredentialMetadata();
+  if (stored.state !== "legacy_broker" || stored.metadata === void 0 || stored.metadata.accessTokenHash !== expected.accessTokenHash || stored.metadata.refreshTokenHash !== expected.refreshTokenHash) {
+    return void 0;
   }
+  const replacementRefreshToken = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!replacementRefreshToken || replacementRefreshToken === currentGeneration) return void 0;
+  return readTrimmed2(TOKEN_FILE_PATH);
 }
-
-// src/lib/terminal-safe.ts
-function replaceIsolatedSurrogates(value) {
-  let out = "";
-  for (let index = 0; index < value.length; index += 1) {
-    const unit = value.charCodeAt(index);
-    if (unit >= 55296 && unit <= 56319) {
-      const next = value.charCodeAt(index + 1);
-      if (next >= 56320 && next <= 57343) {
-        out += value[index] + value[index + 1];
-        index += 1;
+function winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration) {
+  if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) return void 0;
+  const winner = resolveAuthCredential();
+  return (winner?.source === "token_file" ? winner.token : void 0) ?? uncoordinatedLegacyWinnerAccessToken(expectedLegacyGeneration, currentGeneration);
+}
+async function performTokenRefresh(options = {}) {
+  const selected = resolveAuthCredential();
+  if (selected?.source !== "token_file") return void 0;
+  const startingGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!startingGeneration || isSessionEnded()) return void 0;
+  const startingAccessToken = selected.token;
+  return withCredentialLock(
+    async () => {
+      const currentCredential = resolveAuthCredential();
+      if (currentCredential?.source !== "token_file") return void 0;
+      const currentGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
+      if (!currentGeneration) return void 0;
+      if (currentGeneration !== startingGeneration) {
+        return currentCredential.token;
+      }
+      if (currentCredential.token !== startingAccessToken) {
+        return currentCredential.token;
+      }
+      if (isSessionEnded()) return void 0;
+      let metadata = readStoredCredentialMetadata();
+      const markerlessLegacyAtStart = metadata.state === "legacy_broker" && metadata.metadata === void 0;
+      if (metadata.state === "invalid" || metadata.state === "workos_connect" && (metadata.metadata.accessTokenHash !== refreshFingerprint(currentCredential.token) || metadata.metadata.refreshTokenHash !== refreshFingerprint(currentGeneration))) {
+        return void 0;
+      }
+      if (metadata.state === "legacy_broker") {
+        try {
+          metadata = bindLegacyBrokerGeneration(
+            currentCredential.token,
+            currentGeneration,
+            metadata
+          );
+        } catch {
+          return void 0;
+        }
+        if (metadata.state !== "legacy_broker") return void 0;
+      }
+      const expectedLegacyGeneration = markerlessLegacyAtStart && metadata.state === "legacy_broker" ? metadata.metadata : void 0;
+      const connectContext = metadata.state === "workos_connect" ? {
+        version: 1,
+        family: "workos_connect",
+        issuer: metadata.metadata.issuer,
+        clientId: metadata.metadata.clientId
+      } : void 0;
+      const response = await fetch(
+        connectContext ? workosConnectTokenEndpoint(connectContext.issuer) : `${getSiteUrl()}/mcp/broker/refresh`,
+        connectContext ? {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: currentGeneration,
+            client_id: connectContext.clientId
+          }),
+          signal: options.signal
+        } : {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ refresh_token: currentGeneration }),
+          signal: options.signal
+        }
+      );
+      let directResponse;
+      if (connectContext) {
+        try {
+          directResponse = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+        } catch {
+          if (response.ok && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      }
+      if (!response.ok) {
+        let detail = "";
+        if (connectContext) {
+          detail = workosConnectRefreshErrorCode(directResponse);
+        } else {
+          detail = (await response.text().catch(() => "")).slice(0, 200);
+        }
+        if (isTerminalRefreshResponse(response, detail) && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        refreshDiagnostic(
+          response,
+          detail,
+          options.quiet,
+          connectContext ? "WorkOS Connect" : "broker"
+        );
+        return winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      let accessToken;
+      let replacementRefreshToken;
+      let expiresIn;
+      if (connectContext) {
+        try {
+          const tokens = parseWorkosConnectTokens(directResponse, {
+            fallbackRefreshToken: currentGeneration
+          });
+          accessToken = tokens.accessToken;
+          replacementRefreshToken = tokens.refreshToken;
+          expiresIn = tokens.expiresIn;
+        } catch {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
       } else {
-        out += "\uFFFD";
+        let data;
+        try {
+          data = await response.json();
+        } catch {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+        const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
+        accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
+        replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
+        expiresIn = typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0;
+        if (!(accessToken && replacementRefreshToken)) {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
       }
-    } else if (unit >= 56320 && unit <= 57343) {
-      out += "\uFFFD";
-    } else {
-      out += value[index];
-    }
+      const latestCredential = resolveAuthCredential();
+      if (readTrimmed2(REFRESH_TOKEN_PATH) !== currentGeneration || latestCredential?.source !== "token_file" || latestCredential.token !== currentCredential.token || !metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+        return latestCredential?.source === "token_file" ? latestCredential.token : winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      commitCredentialsUnlocked({
+        accessToken,
+        refreshToken: replacementRefreshToken,
+        expiresIn,
+        metadata: connectContext
+      });
+      return accessToken;
+    },
+    { signal: options.signal }
+  );
+}
+var _refreshInFlight;
+function refreshToken(options = {}) {
+  if (_refreshInFlight) return _refreshInFlight;
+  const attempt = performTokenRefresh(options).then((token) => {
+    if (token) _cachedCredential = { token, source: "token_file" };
+    return token;
+  }).finally(() => {
+    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
+  });
+  _refreshInFlight = attempt;
+  return attempt;
+}
+var HttpError = class extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.body = body;
   }
-  return out;
+};
+var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+var _cachedCredential;
+function selectedCredential() {
+  const resolved = resolveAuthCredential();
+  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
+    _cachedCredential = resolved;
+  }
+  return _cachedCredential;
 }
-function isUnsafeTerminalCodePoint(point) {
-  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
-  const bidiOrZeroWidth = point === 173 || // soft hyphen
-  point === 1564 || // Arabic letter mark
-  point === 6158 || // Mongolian vowel separator
-  point >= 8203 && point <= 8207 || // zero-width + directional marks
-  point >= 8234 && point <= 8238 || // bidi embeddings/overrides
-  point >= 8288 && point <= 8303 || // word joiner + bidi isolates/controls
-  point >= 65529 && point <= 65531 || // interlinear annotation controls
-  point === 65279 || // zero-width no-break space / BOM
-  point >= 917504 && point <= 917631;
-  return c0OrC1 || bidiOrZeroWidth;
+function fetchWithToken(method, path, body, options, token, siteUrl) {
+  return fetch(`${siteUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    signal: options?.signal
+  });
 }
-function terminalSafeText(value) {
-  return Array.from(replaceIsolatedSurrogates(value)).filter((character) => !isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0)).join("");
+async function responseValue(response) {
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+    }
+    const errorBody = await response.json().catch(() => null);
+    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
+    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
+    throw new HttpError(response.status, message, errorBody);
+  }
+  return response.json();
 }
-function terminalSafeLine(value) {
-  return terminalSafeText(value.replace(/\s+/gu, " ")).replace(/\s+/gu, " ").trim();
+async function request(method, path, body, options) {
+  const siteUrl = getSiteUrl();
+  let credential = selectedCredential();
+  let refreshAttempted = false;
+  if (credential && isTokenExpiringSoon(credential)) {
+    refreshAttempted = true;
+    const token = await refreshToken({
+      signal: options?.signal,
+      quiet: options?.quietRefresh
+    });
+    if (token) credential = { token, source: "token_file" };
+  }
+  if (!credential) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  if (isTokenExpiringSoon(credential) && isSessionEnded()) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  const tokenUsed = credential.token;
+  let response = await fetchWithToken(method, path, body, options, tokenUsed, siteUrl);
+  if (response.status === 401) {
+    const latest = resolveAuthCredential();
+    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
+    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
+      refreshAttempted = true;
+      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
+    }
+    if (retryToken) {
+      _cachedCredential = {
+        token: retryToken,
+        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
+      };
+      response = await fetchWithToken(method, path, body, options, retryToken, siteUrl);
+    }
+  }
+  return responseValue(response);
+}
+function getClient() {
+  return {
+    get: (path, options) => request("GET", path, void 0, options),
+    post: (path, body, options) => request("POST", path, body, options)
+  };
 }
-var stripControlChars = terminalSafeText;
 
-// src/client.ts
-var CONFIG_DIR_MODE = 448;
-var CREDENTIAL_FILE_MODE = 384;
-var REFRESH_THRESHOLD_MS = 6e4;
-var DEFAULT_API_URL = "https://api.getprimitive.ai";
-var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
-function readTrimmed2(path) {
+// src/lib/activation.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
   try {
-    const value = readFileSync5(path, "utf8").trim();
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
     return value || void 0;
   } catch {
     return void 0;
   }
 }
-function getSiteUrl() {
-  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
-}
-function getSiteUrlForEnvironment(primApiUrl) {
-  return primApiUrl?.trim() || DEFAULT_API_URL;
-}
-function expiresAtFor(token, expiresIn) {
-  return expiresIn === void 0 ? jwtExpiresAt(token) : Date.now() + expiresIn * 1e3;
-}
-function ensureConfigDirectory() {
-  const directory = dirname5(TOKEN_FILE_PATH);
-  mkdirSync3(directory, { recursive: true, mode: CONFIG_DIR_MODE });
-  chmodSync(directory, CONFIG_DIR_MODE);
-}
-function atomicWrite(path, content) {
-  ensureConfigDirectory();
-  atomicWriteFile(path, content, { mode: CREDENTIAL_FILE_MODE });
-}
-function removeCredentialFile(path) {
-  if (!existsSync4(path)) return false;
-  rmSync3(path, { force: true });
-  return true;
-}
-function getTokenExpiresAt() {
-  const stored = readTrimmed2(TOKEN_EXPIRES_PATH);
-  if (stored === void 0) return void 0;
-  const value = Number(stored);
-  return Number.isNaN(value) ? void 0 : value;
-}
-function isTokenExpiringSoon(credential) {
-  if (credential.source !== "token_file") return false;
-  const expiresAt = getTokenExpiresAt();
-  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
-}
-function refreshFingerprint(refreshToken2) {
-  return createHash3("sha256").update(refreshToken2).digest("hex");
-}
-function legacyBrokerCredentialMetadata(accessToken, refreshToken2) {
-  return {
-    version: 1,
-    family: "legacy_broker",
-    accessTokenHash: refreshFingerprint(accessToken),
-    refreshTokenHash: refreshFingerprint(refreshToken2)
-  };
-}
-function credentialFamilyMetadata(accessToken, refreshToken2, metadata) {
-  const hashes = {
-    accessTokenHash: refreshFingerprint(accessToken),
-    refreshTokenHash: refreshFingerprint(refreshToken2)
-  };
-  return metadata === void 0 ? legacyBrokerCredentialMetadata(accessToken, refreshToken2) : { ...metadata, ...hashes };
+function currentBranch(cwd) {
+  return gitValue(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
 }
-function writeCredentialMigrationSentinel() {
-  atomicWrite(
-    CREDENTIAL_MIGRATION_PATH,
-    `${JSON.stringify({
-      version: CREDENTIAL_MIGRATION_VERSION,
-      state: CREDENTIAL_MIGRATION_STATE
-    })}
-`
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
   );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
 }
-function bindLegacyBrokerGeneration(accessToken, refreshToken2, metadata) {
-  if (metadata.state !== "legacy_broker" || !accessToken || !refreshToken2) {
-    return { state: "invalid" };
+function canonicalGitRoot(cwd) {
+  try {
+    const top = gitToplevel(cwd);
+    return top ? realpathSync.native(top) : null;
+  } catch {
+    return null;
   }
-  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
-  if (metadata.metadata !== void 0 && (metadata.metadata.accessTokenHash !== familyMetadata.accessTokenHash || metadata.metadata.refreshTokenHash !== familyMetadata.refreshTokenHash)) {
-    return { state: "invalid" };
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
   }
-  if (metadata.metadata === void 0) {
-    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
-`);
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
   }
-  const migrationState = readCredentialMigrationState();
-  if (migrationState === "invalid") return { state: "invalid" };
-  if (migrationState === "absent") writeCredentialMigrationSentinel();
-  return { state: "legacy_broker", metadata: familyMetadata };
-}
-function preserveMarkerlessLegacyGeneration() {
-  const metadata = readStoredCredentialMetadata();
-  if (metadata.state !== "legacy_broker" || metadata.metadata !== void 0) return;
-  const accessToken = readTrimmed2(TOKEN_FILE_PATH);
-  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
-  if (!(accessToken && refreshToken2)) return;
-  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
-  atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
-`);
-}
-function terminalFingerprint() {
-  return readTrimmed2(TERMINAL_REFRESH_PATH);
-}
-function writeTerminalFingerprint(refreshToken2) {
-  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
-`);
-}
-function clearTerminalFingerprint() {
-  removeCredentialFile(TERMINAL_REFRESH_PATH);
-}
-function isSessionEnded() {
-  if (resolveAuthCredential()?.source !== "token_file") return false;
-  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
-  const ended = terminalFingerprint();
-  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
 }
-function withCredentialLock(operation, options = {}) {
-  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash3("sha256").update(`${source}\0${value}`).digest("hex")}`;
 }
-function commitCredentialsUnlocked(credentials) {
-  const accessToken = credentials.accessToken.trim();
-  const refreshToken2 = credentials.refreshToken.trim();
-  if (!accessToken || !refreshToken2) {
-    throw new Error("OAuth credentials require both access and refresh tokens");
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync.native(top);
+  } catch {
+    repoRoot = resolve2(top);
   }
-  const familyMetadata = credentialFamilyMetadata(accessToken, refreshToken2, credentials.metadata);
-  if (credentials.metadata !== void 0) {
-    preserveMarkerlessLegacyGeneration();
-    writeCredentialMigrationSentinel();
-    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
-`);
-    atomicWrite(CREDENTIAL_METADATA_PATH, `${JSON.stringify(familyMetadata)}
-`);
-    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
-`);
-  } else {
-    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
-`);
-    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
-`);
-    removeCredentialFile(CREDENTIAL_METADATA_PATH);
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
   }
-  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
-  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
-  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
-`);
-  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
-`);
-  clearTerminalFingerprint();
-  _cachedCredential = { token: accessToken, source: "token_file" };
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
 }
-function isTerminalRefreshResponse(response, detail) {
-  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
+function nearestExistingAncestor(path) {
+  const suffix = [];
+  let cursor = path;
+  while (true) {
+    try {
+      lstatSync(cursor);
+      break;
+    } catch (error) {
+      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname4(cursor);
+      if (parent === cursor) return null;
+      suffix.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
+      cursor = parent;
+    }
+  }
   try {
-    const error = JSON.parse(detail).error;
-    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
+    return { real: realpathSync.native(cursor), suffix };
   } catch {
-    return response.status === 401 && detail.includes("Invalid or expired refresh token");
+    return null;
   }
 }
-function workosConnectRefreshErrorCode(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
-  return value.error === "invalid_grant" ? "invalid_grant" : "";
-}
-function refreshDiagnostic(response, detail, quiet, provider) {
-  if (quiet) return;
-  const statusText = terminalSafeLine(response.statusText).slice(0, 120);
-  const safeDetail = terminalSafeLine(detail).slice(0, 200);
-  process.stderr.write(
-    `[prim] token refresh rejected by ${provider}: ${response.status}${statusText ? ` ${statusText}` : ""}${safeDetail ? ` \u2014 ${safeDetail}` : ""}
-`
-  );
-}
-function metadataMatchesCredentialGeneration(expected, accessToken, refreshToken2) {
-  const current = readStoredCredentialMetadata();
-  if (expected.state === "legacy_broker") {
-    if (current.state !== "legacy_broker") return false;
-    if (!expected.metadata) return current.metadata === void 0;
-    return current.metadata !== void 0 && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
+function canonicalRepositoryPathScoped(filePath, context, baseDir) {
+  if (!filePath || filePath !== filePath.trim() || filePath.includes("\0")) {
+    return { ok: false, reason: "invalid_path" };
   }
-  if (expected.state !== "workos_connect" || current.state !== "workos_connect") return false;
-  return current.metadata.issuer === expected.metadata.issuer && current.metadata.clientId === expected.metadata.clientId && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
-}
-function uncoordinatedLegacyWinnerAccessToken(expected, currentGeneration) {
-  if (!expected || readCredentialMigrationState() !== "valid") return void 0;
-  const stored = readStoredCredentialMetadata();
-  if (stored.state !== "legacy_broker" || stored.metadata === void 0 || stored.metadata.accessTokenHash !== expected.accessTokenHash || stored.metadata.refreshTokenHash !== expected.refreshTokenHash) {
-    return void 0;
+  const absolute = resolve2(baseDir, filePath);
+  const resolved = nearestExistingAncestor(absolute);
+  if (!resolved) return { ok: false, reason: "invalid_path" };
+  const target = resolve2(resolved.real, ...resolved.suffix);
+  const rel = relative(context.repoRoot, target);
+  if (!rel || rel === ".") return { ok: false, reason: "invalid_path" };
+  if (isAbsolute2(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return { ok: false, reason: "outside_repository" };
   }
-  const replacementRefreshToken = readTrimmed2(REFRESH_TOKEN_PATH);
-  if (!replacementRefreshToken || replacementRefreshToken === currentGeneration) return void 0;
-  return readTrimmed2(TOKEN_FILE_PATH);
+  return { ok: true, file: sep === "/" ? rel : rel.split(sep).join("/") };
 }
-function winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration) {
-  if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) return void 0;
-  const winner = resolveAuthCredential();
-  return (winner?.source === "token_file" ? winner.token : void 0) ?? uncoordinatedLegacyWinnerAccessToken(expectedLegacyGeneration, currentGeneration);
+function canonicalRepositoryPathLegacy(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
+  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
+    return null;
+  const absolute = resolve2(cwd, filePath);
+  let target;
+  try {
+    const stat = lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    target = realpathSync.native(absolute);
+  } catch (error) {
+    if (!(error instanceof Error) || error.code !== "ENOENT") {
+      return null;
+    }
+    try {
+      const parent = realpathSync.native(dirname4(absolute));
+      if (!lstatSync(parent).isDirectory()) return null;
+      target = resolve2(parent, basename(absolute));
+    } catch {
+      return null;
+    }
+  }
+  const rel = relative(repositoryRoot, target);
+  if (!rel || isAbsolute2(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return sep === "/" ? rel : rel.split(sep).join("/");
 }
-async function performTokenRefresh(options = {}) {
-  const selected = resolveAuthCredential();
-  if (selected?.source !== "token_file") return void 0;
-  const startingGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
-  if (!startingGeneration || isSessionEnded()) return void 0;
-  const startingAccessToken = selected.token;
-  return withCredentialLock(
-    async () => {
-      const currentCredential = resolveAuthCredential();
-      if (currentCredential?.source !== "token_file") return void 0;
-      const currentGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
-      if (!currentGeneration) return void 0;
-      if (currentGeneration !== startingGeneration) {
-        return currentCredential.token;
-      }
-      if (currentCredential.token !== startingAccessToken) {
-        return currentCredential.token;
-      }
-      if (isSessionEnded()) return void 0;
-      let metadata = readStoredCredentialMetadata();
-      const markerlessLegacyAtStart = metadata.state === "legacy_broker" && metadata.metadata === void 0;
-      if (metadata.state === "invalid" || metadata.state === "workos_connect" && (metadata.metadata.accessTokenHash !== refreshFingerprint(currentCredential.token) || metadata.metadata.refreshTokenHash !== refreshFingerprint(currentGeneration))) {
-        return void 0;
-      }
-      if (metadata.state === "legacy_broker") {
-        try {
-          metadata = bindLegacyBrokerGeneration(
-            currentCredential.token,
-            currentGeneration,
-            metadata
-          );
-        } catch {
-          return void 0;
-        }
-        if (metadata.state !== "legacy_broker") return void 0;
-      }
-      const expectedLegacyGeneration = markerlessLegacyAtStart && metadata.state === "legacy_broker" ? metadata.metadata : void 0;
-      const connectContext = metadata.state === "workos_connect" ? {
-        version: 1,
-        family: "workos_connect",
-        issuer: metadata.metadata.issuer,
-        clientId: metadata.metadata.clientId
-      } : void 0;
-      const response = await fetch(
-        connectContext ? workosConnectTokenEndpoint(connectContext.issuer) : `${getSiteUrl()}/mcp/broker/refresh`,
-        connectContext ? {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({
-            grant_type: "refresh_token",
-            refresh_token: currentGeneration,
-            client_id: connectContext.clientId
-          }),
-          signal: options.signal
-        } : {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ refresh_token: currentGeneration }),
-          signal: options.signal
-        }
-      );
-      let directResponse;
-      if (connectContext) {
-        try {
-          directResponse = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
-        } catch {
-          if (response.ok && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
-            metadata,
-            currentCredential.token,
-            currentGeneration
-          )) {
-            writeTerminalFingerprint(currentGeneration);
-          }
-          return void 0;
-        }
-      }
-      if (!response.ok) {
-        let detail = "";
-        if (connectContext) {
-          detail = workosConnectRefreshErrorCode(directResponse);
-        } else {
-          detail = (await response.text().catch(() => "")).slice(0, 200);
-        }
-        if (isTerminalRefreshResponse(response, detail) && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
-          writeTerminalFingerprint(currentGeneration);
-        }
-        refreshDiagnostic(
-          response,
-          detail,
-          options.quiet,
-          connectContext ? "WorkOS Connect" : "broker"
-        );
-        return winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
-      }
-      let accessToken;
-      let replacementRefreshToken;
-      let expiresIn;
-      if (connectContext) {
-        try {
-          const tokens = parseWorkosConnectTokens(directResponse, {
-            fallbackRefreshToken: currentGeneration
-          });
-          accessToken = tokens.accessToken;
-          replacementRefreshToken = tokens.refreshToken;
-          expiresIn = tokens.expiresIn;
-        } catch {
-          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
-            metadata,
-            currentCredential.token,
-            currentGeneration
-          )) {
-            writeTerminalFingerprint(currentGeneration);
-          }
-          return void 0;
-        }
-      } else {
-        let data;
-        try {
-          data = await response.json();
-        } catch {
-          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
-            writeTerminalFingerprint(currentGeneration);
-          }
-          return void 0;
-        }
-        const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
-        accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
-        replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
-        expiresIn = typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0;
-        if (!(accessToken && replacementRefreshToken)) {
-          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
-            writeTerminalFingerprint(currentGeneration);
-          }
-          return void 0;
-        }
-      }
-      const latestCredential = resolveAuthCredential();
-      if (readTrimmed2(REFRESH_TOKEN_PATH) !== currentGeneration || latestCredential?.source !== "token_file" || latestCredential.token !== currentCredential.token || !metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
-        return latestCredential?.source === "token_file" ? latestCredential.token : winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
-      }
-      commitCredentialsUnlocked({
-        accessToken,
-        refreshToken: replacementRefreshToken,
-        expiresIn,
-        metadata: connectContext
-      });
-      return accessToken;
-    },
-    { signal: options.signal }
+function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
+  if (typeof contextOrCwd === "string") {
+    return canonicalRepositoryPathLegacy(filePath, contextOrCwd, baseDirOrRoot);
+  }
+  return canonicalRepositoryPathScoped(
+    filePath,
+    contextOrCwd,
+    baseDirOrRoot ?? contextOrCwd.repoRoot
   );
 }
-var _refreshInFlight;
-function refreshToken(options = {}) {
-  if (_refreshInFlight) return _refreshInFlight;
-  const attempt = performTokenRefresh(options).then((token) => {
-    if (token) _cachedCredential = { token, source: "token_file" };
-    return token;
-  }).finally(() => {
-    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
-  });
-  _refreshInFlight = attempt;
-  return attempt;
-}
-var HttpError = class extends Error {
-  status;
-  body;
-  constructor(status, message, body) {
-    super(message);
-    this.name = "HttpError";
-    this.status = status;
-    this.body = body;
+
+// src/lib/activation.ts
+var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
+var GIT_TIMEOUT_MS2 = 1e3;
+var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json", ".cursor/hooks.json"];
+var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function repoActiveFlag(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    if (value === "true") return "true";
+    if (value === "false") return "false";
+    return void 0;
+  } catch {
+    return void 0;
   }
-};
-var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
-var _cachedCredential;
-function selectedCredential() {
-  const resolved = resolveAuthCredential();
-  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
-    _cachedCredential = resolved;
+}
+function isRepoActive(cwd) {
+  return repoActiveFlag(cwd) === "true";
+}
+function isValidRepoSyncId(value) {
+  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+}
+function localGitConfigValue(cwd, key) {
+  try {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
   }
-  return _cachedCredential;
 }
-function fetchWithToken(method, path, body, options, token, siteUrl) {
-  return fetch(`${siteUrl}${path}`, {
-    method,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json"
-    },
-    body: body === void 0 ? void 0 : JSON.stringify(body),
-    signal: options?.signal
-  });
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
 }
-async function responseValue(response) {
-  if (!response.ok) {
-    if (response.status === 401) {
-      throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+function repositoryBindingState(cwd) {
+  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
+  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
+  if (marker === "unbound" || marker === "invalid") return marker;
+  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
+  if (marker !== void 0) return "invalid";
+  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
+}
+function hasProjectPrimInstall(cwd) {
+  const root = gitToplevel(cwd);
+  if (root === null || root === homedir2()) return false;
+  for (const rel of PROJECT_INSTALL_FILES) {
+    const path = join5(root, rel);
+    if (existsSync3(path)) {
+      try {
+        const content = readFileSync4(path, "utf-8");
+        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
+      } catch {
+      }
     }
-    const errorBody = await response.json().catch(() => null);
-    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
-    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
-    throw new HttpError(response.status, message, errorBody);
   }
-  return response.json();
+  return false;
 }
-async function request(method, path, body, options) {
-  const siteUrl = getSiteUrl();
-  let credential = selectedCredential();
-  let refreshAttempted = false;
-  if (credential && isTokenExpiringSoon(credential)) {
-    refreshAttempted = true;
-    const token = await refreshToken({
-      signal: options?.signal,
-      quiet: options?.quietRefresh
-    });
-    if (token) credential = { token, source: "token_file" };
-  }
-  if (!credential) {
-    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
-  }
-  if (isTokenExpiringSoon(credential) && isSessionEnded()) {
-    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+function isRepoActiveForCapture(cwd) {
+  const flag = repoActiveFlag(cwd);
+  if (flag === "true") return true;
+  if (flag === "false") return false;
+  return hasProjectPrimInstall(cwd);
+}
+function decisionIngestionStatus(cwd) {
+  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
+}
+
+// src/lib/bin-path.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join6 } from "path";
+import { fileURLToPath } from "url";
+var PKG_NAME = "@primitive.ai/prim";
+var ROOT_WALK_LIMIT = 6;
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
+var resolvedRoot;
+function locateRoot() {
+  if (resolvedRoot !== void 0) {
+    return resolvedRoot;
   }
-  const tokenUsed = credential.token;
-  let response = await fetchWithToken(method, path, body, options, tokenUsed, siteUrl);
-  if (response.status === 401) {
-    const latest = resolveAuthCredential();
-    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
-    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
-      refreshAttempted = true;
-      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
+  let dir = dirname5(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
+    const manifestPath = join6(dir, "package.json");
+    if (existsSync4(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
+        if (manifest.name === PKG_NAME && manifest.bin) {
+          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
+          return resolvedRoot;
+        }
+      } catch {
+      }
     }
-    if (retryToken) {
-      _cachedCredential = {
-        token: retryToken,
-        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
-      };
-      response = await fetchWithToken(method, path, body, options, retryToken, siteUrl);
+    const parent = dirname5(dir);
+    if (parent === dir) {
+      break;
     }
+    dir = parent;
   }
-  return responseValue(response);
+  resolvedRoot = null;
+  return resolvedRoot;
 }
-function getClient() {
-  return {
-    get: (path, options) => request("GET", path, void 0, options),
-    post: (path, body, options) => request("POST", path, body, options)
-  };
+function packageVersion() {
+  return locateRoot()?.version ?? null;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    PRIM_CONFIG_SHELL_RESOLVER,
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
 }
 
 // src/generated/cli-http-v1.validators.js
@@ -12507,7 +12510,6 @@ function validate45(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate45.evaluated = { "dynamicProps": true, "dynamicItems": false };
-var schema83 = { "anyOf": [{ "type": "object", "properties": { "error": { "type": "string", "const": "Unauthorized" } }, "required": ["error"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "const": "interactive_workos_authority_required" } }, "required": ["error"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "const": "feature_disabled" }, "feature": { "type": "string", "const": "github-connect" } }, "required": ["error", "feature"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "enum": ["github_connect_unavailable", "feature_check_unavailable"] }, "feature": { "type": "string", "const": "github-connect" } }, "required": ["error", "feature"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "const": "WorkOS identity authority is temporarily unavailable" } }, "required": ["error"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "const": "github_install_intent_conflict" } }, "required": ["error"], "additionalProperties": false }, { "type": "object", "properties": { "error": { "type": "string", "const": "github_install_intent_rate_limited" }, "retryAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": ["error", "retryAt"], "additionalProperties": false }] };
 function validate46(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -12657,7 +12659,7 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
   if (errors === _errs12) {
     if (data && typeof data == "object" && !Array.isArray(data)) {
       let missing2;
-      if (data.error === void 0 && (missing2 = "error") || data.feature === void 0 && (missing2 = "feature")) {
+      if (data.error === void 0 && (missing2 = "error")) {
         const err10 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/required", keyword: "required", params: { missingProperty: missing2 }, message: "must have required property '" + missing2 + "'" };
         if (vErrors === null) {
           vErrors = [err10];
@@ -12668,7 +12670,7 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
       } else {
         const _errs14 = errors;
         for (const key2 in data) {
-          if (!(key2 === "error" || key2 === "feature")) {
+          if (!(key2 === "error")) {
             const err11 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key2 }, message: "must NOT have additional properties" };
             if (vErrors === null) {
               vErrors = [err11];
@@ -12680,219 +12682,90 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
           }
         }
         if (_errs14 === errors) {
-          if (data.error !== void 0) {
-            let data2 = data.error;
-            const _errs15 = errors;
-            if (typeof data2 !== "string") {
-              const err12 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
-              if (vErrors === null) {
-                vErrors = [err12];
-              } else {
-                vErrors.push(err12);
-              }
-              errors++;
-            }
-            if ("feature_disabled" !== data2) {
-              const err13 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/error/const", keyword: "const", params: { allowedValue: "feature_disabled" }, message: "must be equal to constant" };
-              if (vErrors === null) {
-                vErrors = [err13];
-              } else {
-                vErrors.push(err13);
-              }
-              errors++;
-            }
-            var valid4 = _errs15 === errors;
-          } else {
-            var valid4 = true;
-          }
-          if (valid4) {
-            if (data.feature !== void 0) {
-              let data3 = data.feature;
-              const _errs17 = errors;
-              if (typeof data3 !== "string") {
-                const err14 = { instancePath: instancePath + "/feature", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/feature/type", keyword: "type", params: { type: "string" }, message: "must be string" };
-                if (vErrors === null) {
-                  vErrors = [err14];
-                } else {
-                  vErrors.push(err14);
-                }
-                errors++;
-              }
-              if ("github-connect" !== data3) {
-                const err15 = { instancePath: instancePath + "/feature", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/feature/const", keyword: "const", params: { allowedValue: "github-connect" }, message: "must be equal to constant" };
-                if (vErrors === null) {
-                  vErrors = [err15];
-                } else {
-                  vErrors.push(err15);
-                }
-                errors++;
-              }
-              var valid4 = _errs17 === errors;
-            } else {
-              var valid4 = true;
-            }
-          }
-        }
-      }
-    } else {
-      const err16 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/type", keyword: "type", params: { type: "object" }, message: "must be object" };
-      if (vErrors === null) {
-        vErrors = [err16];
-      } else {
-        vErrors.push(err16);
-      }
-      errors++;
-    }
-  }
-  var _valid0 = _errs12 === errors;
-  valid1 = valid1 || _valid0;
-  if (_valid0) {
-    if (props0 !== true) {
-      props0 = true;
-    }
-  }
-  const _errs19 = errors;
-  if (errors === _errs19) {
-    if (data && typeof data == "object" && !Array.isArray(data)) {
-      let missing3;
-      if (data.error === void 0 && (missing3 = "error") || data.feature === void 0 && (missing3 = "feature")) {
-        const err17 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/required", keyword: "required", params: { missingProperty: missing3 }, message: "must have required property '" + missing3 + "'" };
-        if (vErrors === null) {
-          vErrors = [err17];
-        } else {
-          vErrors.push(err17);
-        }
-        errors++;
-      } else {
-        const _errs21 = errors;
-        for (const key3 in data) {
-          if (!(key3 === "error" || key3 === "feature")) {
-            const err18 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key3 }, message: "must NOT have additional properties" };
-            if (vErrors === null) {
-              vErrors = [err18];
-            } else {
-              vErrors.push(err18);
-            }
-            errors++;
-            break;
-          }
-        }
-        if (_errs21 === errors) {
-          if (data.error !== void 0) {
-            let data4 = data.error;
-            const _errs22 = errors;
-            if (typeof data4 !== "string") {
-              const err19 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+          if (data.error !== void 0) {
+            let data2 = data.error;
+            if (typeof data2 !== "string") {
+              const err12 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
               if (vErrors === null) {
-                vErrors = [err19];
+                vErrors = [err12];
               } else {
-                vErrors.push(err19);
+                vErrors.push(err12);
               }
               errors++;
             }
-            if (!(data4 === "github_connect_unavailable" || data4 === "feature_check_unavailable")) {
-              const err20 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/error/enum", keyword: "enum", params: { allowedValues: schema83.anyOf[3].properties.error.enum }, message: "must be equal to one of the allowed values" };
+            if ("github_connect_unavailable" !== data2) {
+              const err13 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/properties/error/const", keyword: "const", params: { allowedValue: "github_connect_unavailable" }, message: "must be equal to constant" };
               if (vErrors === null) {
-                vErrors = [err20];
+                vErrors = [err13];
               } else {
-                vErrors.push(err20);
+                vErrors.push(err13);
               }
               errors++;
             }
-            var valid5 = _errs22 === errors;
-          } else {
-            var valid5 = true;
-          }
-          if (valid5) {
-            if (data.feature !== void 0) {
-              let data5 = data.feature;
-              const _errs24 = errors;
-              if (typeof data5 !== "string") {
-                const err21 = { instancePath: instancePath + "/feature", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/feature/type", keyword: "type", params: { type: "string" }, message: "must be string" };
-                if (vErrors === null) {
-                  vErrors = [err21];
-                } else {
-                  vErrors.push(err21);
-                }
-                errors++;
-              }
-              if ("github-connect" !== data5) {
-                const err22 = { instancePath: instancePath + "/feature", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/feature/const", keyword: "const", params: { allowedValue: "github-connect" }, message: "must be equal to constant" };
-                if (vErrors === null) {
-                  vErrors = [err22];
-                } else {
-                  vErrors.push(err22);
-                }
-                errors++;
-              }
-              var valid5 = _errs24 === errors;
-            } else {
-              var valid5 = true;
-            }
           }
         }
       }
     } else {
-      const err23 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+      const err14 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/2/type", keyword: "type", params: { type: "object" }, message: "must be object" };
       if (vErrors === null) {
-        vErrors = [err23];
+        vErrors = [err14];
       } else {
-        vErrors.push(err23);
+        vErrors.push(err14);
       }
       errors++;
     }
   }
-  var _valid0 = _errs19 === errors;
+  var _valid0 = _errs12 === errors;
   valid1 = valid1 || _valid0;
   if (_valid0) {
     if (props0 !== true) {
       props0 = true;
     }
   }
-  const _errs26 = errors;
-  if (errors === _errs26) {
+  const _errs17 = errors;
+  if (errors === _errs17) {
     if (data && typeof data == "object" && !Array.isArray(data)) {
-      let missing4;
-      if (data.error === void 0 && (missing4 = "error")) {
-        const err24 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/required", keyword: "required", params: { missingProperty: missing4 }, message: "must have required property '" + missing4 + "'" };
+      let missing3;
+      if (data.error === void 0 && (missing3 = "error")) {
+        const err15 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/required", keyword: "required", params: { missingProperty: missing3 }, message: "must have required property '" + missing3 + "'" };
         if (vErrors === null) {
-          vErrors = [err24];
+          vErrors = [err15];
         } else {
-          vErrors.push(err24);
+          vErrors.push(err15);
         }
         errors++;
       } else {
-        const _errs28 = errors;
-        for (const key4 in data) {
-          if (!(key4 === "error")) {
-            const err25 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key4 }, message: "must NOT have additional properties" };
+        const _errs19 = errors;
+        for (const key3 in data) {
+          if (!(key3 === "error")) {
+            const err16 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key3 }, message: "must NOT have additional properties" };
             if (vErrors === null) {
-              vErrors = [err25];
+              vErrors = [err16];
             } else {
-              vErrors.push(err25);
+              vErrors.push(err16);
             }
             errors++;
             break;
           }
         }
-        if (_errs28 === errors) {
+        if (_errs19 === errors) {
           if (data.error !== void 0) {
-            let data6 = data.error;
-            if (typeof data6 !== "string") {
-              const err26 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+            let data3 = data.error;
+            if (typeof data3 !== "string") {
+              const err17 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
               if (vErrors === null) {
-                vErrors = [err26];
+                vErrors = [err17];
               } else {
-                vErrors.push(err26);
+                vErrors.push(err17);
               }
               errors++;
             }
-            if ("WorkOS identity authority is temporarily unavailable" !== data6) {
-              const err27 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/properties/error/const", keyword: "const", params: { allowedValue: "WorkOS identity authority is temporarily unavailable" }, message: "must be equal to constant" };
+            if ("WorkOS identity authority is temporarily unavailable" !== data3) {
+              const err18 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/properties/error/const", keyword: "const", params: { allowedValue: "WorkOS identity authority is temporarily unavailable" }, message: "must be equal to constant" };
               if (vErrors === null) {
-                vErrors = [err27];
+                vErrors = [err18];
               } else {
-                vErrors.push(err27);
+                vErrors.push(err18);
               }
               errors++;
             }
@@ -12900,66 +12773,66 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
         }
       }
     } else {
-      const err28 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+      const err19 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/3/type", keyword: "type", params: { type: "object" }, message: "must be object" };
       if (vErrors === null) {
-        vErrors = [err28];
+        vErrors = [err19];
       } else {
-        vErrors.push(err28);
+        vErrors.push(err19);
       }
       errors++;
     }
   }
-  var _valid0 = _errs26 === errors;
+  var _valid0 = _errs17 === errors;
   valid1 = valid1 || _valid0;
   if (_valid0) {
     if (props0 !== true) {
       props0 = true;
     }
   }
-  const _errs31 = errors;
-  if (errors === _errs31) {
+  const _errs22 = errors;
+  if (errors === _errs22) {
     if (data && typeof data == "object" && !Array.isArray(data)) {
-      let missing5;
-      if (data.error === void 0 && (missing5 = "error")) {
-        const err29 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/required", keyword: "required", params: { missingProperty: missing5 }, message: "must have required property '" + missing5 + "'" };
+      let missing4;
+      if (data.error === void 0 && (missing4 = "error")) {
+        const err20 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/required", keyword: "required", params: { missingProperty: missing4 }, message: "must have required property '" + missing4 + "'" };
         if (vErrors === null) {
-          vErrors = [err29];
+          vErrors = [err20];
         } else {
-          vErrors.push(err29);
+          vErrors.push(err20);
         }
         errors++;
       } else {
-        const _errs33 = errors;
-        for (const key5 in data) {
-          if (!(key5 === "error")) {
-            const err30 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key5 }, message: "must NOT have additional properties" };
+        const _errs24 = errors;
+        for (const key4 in data) {
+          if (!(key4 === "error")) {
+            const err21 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key4 }, message: "must NOT have additional properties" };
             if (vErrors === null) {
-              vErrors = [err30];
+              vErrors = [err21];
             } else {
-              vErrors.push(err30);
+              vErrors.push(err21);
             }
             errors++;
             break;
           }
         }
-        if (_errs33 === errors) {
+        if (_errs24 === errors) {
           if (data.error !== void 0) {
-            let data7 = data.error;
-            if (typeof data7 !== "string") {
-              const err31 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+            let data4 = data.error;
+            if (typeof data4 !== "string") {
+              const err22 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
               if (vErrors === null) {
-                vErrors = [err31];
+                vErrors = [err22];
               } else {
-                vErrors.push(err31);
+                vErrors.push(err22);
               }
               errors++;
             }
-            if ("github_install_intent_conflict" !== data7) {
-              const err32 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/error/const", keyword: "const", params: { allowedValue: "github_install_intent_conflict" }, message: "must be equal to constant" };
+            if ("github_install_intent_conflict" !== data4) {
+              const err23 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/properties/error/const", keyword: "const", params: { allowedValue: "github_install_intent_conflict" }, message: "must be equal to constant" };
               if (vErrors === null) {
-                vErrors = [err32];
+                vErrors = [err23];
               } else {
-                vErrors.push(err32);
+                vErrors.push(err23);
               }
               errors++;
             }
@@ -12967,128 +12840,128 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
         }
       }
     } else {
-      const err33 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+      const err24 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/4/type", keyword: "type", params: { type: "object" }, message: "must be object" };
       if (vErrors === null) {
-        vErrors = [err33];
+        vErrors = [err24];
       } else {
-        vErrors.push(err33);
+        vErrors.push(err24);
       }
       errors++;
     }
   }
-  var _valid0 = _errs31 === errors;
+  var _valid0 = _errs22 === errors;
   valid1 = valid1 || _valid0;
   if (_valid0) {
     if (props0 !== true) {
       props0 = true;
     }
   }
-  const _errs36 = errors;
-  if (errors === _errs36) {
+  const _errs27 = errors;
+  if (errors === _errs27) {
     if (data && typeof data == "object" && !Array.isArray(data)) {
-      let missing6;
-      if (data.error === void 0 && (missing6 = "error") || data.retryAt === void 0 && (missing6 = "retryAt")) {
-        const err34 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/required", keyword: "required", params: { missingProperty: missing6 }, message: "must have required property '" + missing6 + "'" };
+      let missing5;
+      if (data.error === void 0 && (missing5 = "error") || data.retryAt === void 0 && (missing5 = "retryAt")) {
+        const err25 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/required", keyword: "required", params: { missingProperty: missing5 }, message: "must have required property '" + missing5 + "'" };
         if (vErrors === null) {
-          vErrors = [err34];
+          vErrors = [err25];
         } else {
-          vErrors.push(err34);
+          vErrors.push(err25);
         }
         errors++;
       } else {
-        const _errs38 = errors;
-        for (const key6 in data) {
-          if (!(key6 === "error" || key6 === "retryAt")) {
-            const err35 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key6 }, message: "must NOT have additional properties" };
+        const _errs29 = errors;
+        for (const key5 in data) {
+          if (!(key5 === "error" || key5 === "retryAt")) {
+            const err26 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key5 }, message: "must NOT have additional properties" };
             if (vErrors === null) {
-              vErrors = [err35];
+              vErrors = [err26];
             } else {
-              vErrors.push(err35);
+              vErrors.push(err26);
             }
             errors++;
             break;
           }
         }
-        if (_errs38 === errors) {
+        if (_errs29 === errors) {
           if (data.error !== void 0) {
-            let data8 = data.error;
-            const _errs39 = errors;
-            if (typeof data8 !== "string") {
-              const err36 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+            let data5 = data.error;
+            const _errs30 = errors;
+            if (typeof data5 !== "string") {
+              const err27 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/error/type", keyword: "type", params: { type: "string" }, message: "must be string" };
               if (vErrors === null) {
-                vErrors = [err36];
+                vErrors = [err27];
               } else {
-                vErrors.push(err36);
+                vErrors.push(err27);
               }
               errors++;
             }
-            if ("github_install_intent_rate_limited" !== data8) {
-              const err37 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/properties/error/const", keyword: "const", params: { allowedValue: "github_install_intent_rate_limited" }, message: "must be equal to constant" };
+            if ("github_install_intent_rate_limited" !== data5) {
+              const err28 = { instancePath: instancePath + "/error", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/error/const", keyword: "const", params: { allowedValue: "github_install_intent_rate_limited" }, message: "must be equal to constant" };
               if (vErrors === null) {
-                vErrors = [err37];
+                vErrors = [err28];
               } else {
-                vErrors.push(err37);
+                vErrors.push(err28);
               }
               errors++;
             }
-            var valid8 = _errs39 === errors;
+            var valid7 = _errs30 === errors;
           } else {
-            var valid8 = true;
+            var valid7 = true;
           }
-          if (valid8) {
+          if (valid7) {
             if (data.retryAt !== void 0) {
-              let data9 = data.retryAt;
-              const _errs41 = errors;
-              if (!(typeof data9 == "number" && (!(data9 % 1) && !isNaN(data9)) && isFinite(data9))) {
-                const err38 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/properties/retryAt/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
+              let data6 = data.retryAt;
+              const _errs32 = errors;
+              if (!(typeof data6 == "number" && (!(data6 % 1) && !isNaN(data6)) && isFinite(data6))) {
+                const err29 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/retryAt/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
                 if (vErrors === null) {
-                  vErrors = [err38];
+                  vErrors = [err29];
                 } else {
-                  vErrors.push(err38);
+                  vErrors.push(err29);
                 }
                 errors++;
               }
-              if (errors === _errs41) {
-                if (typeof data9 == "number" && isFinite(data9)) {
-                  if (data9 > 9007199254740991 || isNaN(data9)) {
-                    const err39 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/properties/retryAt/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
+              if (errors === _errs32) {
+                if (typeof data6 == "number" && isFinite(data6)) {
+                  if (data6 > 9007199254740991 || isNaN(data6)) {
+                    const err30 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/retryAt/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
                     if (vErrors === null) {
-                      vErrors = [err39];
+                      vErrors = [err30];
                     } else {
-                      vErrors.push(err39);
+                      vErrors.push(err30);
                     }
                     errors++;
                   } else {
-                    if (data9 < 0 || isNaN(data9)) {
-                      const err40 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/properties/retryAt/minimum", keyword: "minimum", params: { comparison: ">=", limit: 0 }, message: "must be >= 0" };
+                    if (data6 < 0 || isNaN(data6)) {
+                      const err31 = { instancePath: instancePath + "/retryAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/properties/retryAt/minimum", keyword: "minimum", params: { comparison: ">=", limit: 0 }, message: "must be >= 0" };
                       if (vErrors === null) {
-                        vErrors = [err40];
+                        vErrors = [err31];
                       } else {
-                        vErrors.push(err40);
+                        vErrors.push(err31);
                       }
                       errors++;
                     }
                   }
                 }
               }
-              var valid8 = _errs41 === errors;
+              var valid7 = _errs32 === errors;
             } else {
-              var valid8 = true;
+              var valid7 = true;
             }
           }
         }
       }
     } else {
-      const err41 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/6/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+      const err32 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf/5/type", keyword: "type", params: { type: "object" }, message: "must be object" };
       if (vErrors === null) {
-        vErrors = [err41];
+        vErrors = [err32];
       } else {
-        vErrors.push(err41);
+        vErrors.push(err32);
       }
       errors++;
     }
   }
-  var _valid0 = _errs36 === errors;
+  var _valid0 = _errs27 === errors;
   valid1 = valid1 || _valid0;
   if (_valid0) {
     if (props0 !== true) {
@@ -13096,11 +12969,11 @@ function validate46(data, { instancePath = "", parentData, parentDataProperty, r
     }
   }
   if (!valid1) {
-    const err42 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf", keyword: "anyOf", params: {}, message: "must match a schema in anyOf" };
+    const err33 = { instancePath, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/GitHubInstallIntentStartErrorResponse/anyOf", keyword: "anyOf", params: {}, message: "must match a schema in anyOf" };
     if (vErrors === null) {
-      vErrors = [err42];
+      vErrors = [err33];
     } else {
-      vErrors.push(err42);
+      vErrors.push(err33);
     }
     errors++;
     validate46.errors = vErrors;
@@ -15202,7 +15075,7 @@ function validate50(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate50.evaluated = { "dynamicProps": true, "dynamicItems": false };
-var schema93 = { "type": "object", "properties": { "batch": { "type": "array", "items": { "anyOf": [{ "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "const": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType", "capturedOrganizationId", "captureAuthorityKind", "decisionLifecycleProtocolVersion", "envelopeVersion"], "additionalProperties": {} }, { "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "exclusiveMaximum": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType"], "additionalProperties": {} }] } } }, "required": ["batch"], "additionalProperties": {} };
+var schema93 = { "type": "object", "properties": { "batch": { "type": "array", "items": { "anyOf": [{ "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "repositoryContext": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "repository_bound" }, "repoSyncId": { "type": "string", "minLength": 1, "maxLength": 128 } }, "required": ["kind", "repoSyncId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "non_repository" } }, "required": ["kind"], "additionalProperties": false }] }, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "const": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType", "capturedOrganizationId", "captureAuthorityKind", "decisionLifecycleProtocolVersion", "envelopeVersion"], "additionalProperties": {} }, { "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "repositoryContext": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "repository_bound" }, "repoSyncId": { "type": "string", "minLength": 1, "maxLength": 128 } }, "required": ["kind", "repoSyncId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "non_repository" } }, "required": ["kind"], "additionalProperties": false }] }, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "exclusiveMaximum": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType"], "additionalProperties": {} }] } } }, "required": ["batch"], "additionalProperties": {} };
 var pattern8 = new RegExp("^[A-Za-z0-9_-]+$", "u");
 function validate51(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
@@ -15329,13 +15202,18 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                                 var valid4 = true;
                               }
                               if (valid4) {
-                                if (data1.capturedOrganizationId !== void 0) {
-                                  let data7 = data1.capturedOrganizationId;
+                                if (data1.repositoryContext !== void 0) {
+                                  let data7 = data1.repositoryContext;
                                   const _errs20 = errors;
-                                  if (errors === _errs20) {
-                                    if (typeof data7 === "string") {
-                                      if (func1(data7) > 128) {
-                                        const err6 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                                  const _errs21 = errors;
+                                  let valid5 = false;
+                                  let passing0 = null;
+                                  const _errs22 = errors;
+                                  if (errors === _errs22) {
+                                    if (data7 && typeof data7 == "object" && !Array.isArray(data7)) {
+                                      let missing2;
+                                      if (data7.kind === void 0 && (missing2 = "kind") || data7.repoSyncId === void 0 && (missing2 = "repoSyncId")) {
+                                        const err6 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/required", keyword: "required", params: { missingProperty: missing2 }, message: "must have required property '" + missing2 + "'" };
                                         if (vErrors === null) {
                                           vErrors = [err6];
                                         } else {
@@ -15343,184 +15221,392 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                                         }
                                         errors++;
                                       } else {
-                                        if (func1(data7) < 1) {
-                                          const err7 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
-                                          if (vErrors === null) {
-                                            vErrors = [err7];
-                                          } else {
-                                            vErrors.push(err7);
-                                          }
-                                          errors++;
-                                        } else {
-                                          if (!pattern8.test(data7)) {
-                                            const err8 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/pattern", keyword: "pattern", params: { pattern: "^[A-Za-z0-9_-]+$" }, message: 'must match pattern "^[A-Za-z0-9_-]+$"' };
+                                        const _errs24 = errors;
+                                        for (const key0 in data7) {
+                                          if (!(key0 === "kind" || key0 === "repoSyncId")) {
+                                            const err7 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key0 }, message: "must NOT have additional properties" };
                                             if (vErrors === null) {
-                                              vErrors = [err8];
+                                              vErrors = [err7];
                                             } else {
-                                              vErrors.push(err8);
+                                              vErrors.push(err7);
                                             }
                                             errors++;
+                                            break;
+                                          }
+                                        }
+                                        if (_errs24 === errors) {
+                                          if (data7.kind !== void 0) {
+                                            let data8 = data7.kind;
+                                            const _errs25 = errors;
+                                            if (typeof data8 !== "string") {
+                                              const err8 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/properties/kind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                              if (vErrors === null) {
+                                                vErrors = [err8];
+                                              } else {
+                                                vErrors.push(err8);
+                                              }
+                                              errors++;
+                                            }
+                                            if ("repository_bound" !== data8) {
+                                              const err9 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/properties/kind/const", keyword: "const", params: { allowedValue: "repository_bound" }, message: "must be equal to constant" };
+                                              if (vErrors === null) {
+                                                vErrors = [err9];
+                                              } else {
+                                                vErrors.push(err9);
+                                              }
+                                              errors++;
+                                            }
+                                            var valid6 = _errs25 === errors;
+                                          } else {
+                                            var valid6 = true;
+                                          }
+                                          if (valid6) {
+                                            if (data7.repoSyncId !== void 0) {
+                                              let data9 = data7.repoSyncId;
+                                              const _errs27 = errors;
+                                              if (errors === _errs27) {
+                                                if (typeof data9 === "string") {
+                                                  if (func1(data9) > 128) {
+                                                    const err10 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/properties/repoSyncId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                                                    if (vErrors === null) {
+                                                      vErrors = [err10];
+                                                    } else {
+                                                      vErrors.push(err10);
+                                                    }
+                                                    errors++;
+                                                  } else {
+                                                    if (func1(data9) < 1) {
+                                                      const err11 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/properties/repoSyncId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
+                                                      if (vErrors === null) {
+                                                        vErrors = [err11];
+                                                      } else {
+                                                        vErrors.push(err11);
+                                                      }
+                                                      errors++;
+                                                    }
+                                                  }
+                                                } else {
+                                                  const err12 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/properties/repoSyncId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                                  if (vErrors === null) {
+                                                    vErrors = [err12];
+                                                  } else {
+                                                    vErrors.push(err12);
+                                                  }
+                                                  errors++;
+                                                }
+                                              }
+                                              var valid6 = _errs27 === errors;
+                                            } else {
+                                              var valid6 = true;
+                                            }
                                           }
                                         }
                                       }
                                     } else {
-                                      const err9 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                      const err13 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/0/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                                       if (vErrors === null) {
-                                        vErrors = [err9];
+                                        vErrors = [err13];
                                       } else {
-                                        vErrors.push(err9);
+                                        vErrors.push(err13);
                                       }
                                       errors++;
                                     }
                                   }
-                                  var valid4 = _errs20 === errors;
-                                } else {
-                                  var valid4 = true;
-                                }
-                                if (valid4) {
-                                  if (data1.captureAuthorityKind !== void 0) {
-                                    let data8 = data1.captureAuthorityKind;
-                                    const _errs22 = errors;
-                                    if (typeof data8 !== "string") {
-                                      const err10 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/captureAuthorityKind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
-                                      if (vErrors === null) {
-                                        vErrors = [err10];
+                                  var _valid1 = _errs22 === errors;
+                                  if (_valid1) {
+                                    valid5 = true;
+                                    passing0 = 0;
+                                    var props0 = true;
+                                  }
+                                  const _errs29 = errors;
+                                  if (errors === _errs29) {
+                                    if (data7 && typeof data7 == "object" && !Array.isArray(data7)) {
+                                      let missing3;
+                                      if (data7.kind === void 0 && (missing3 = "kind")) {
+                                        const err14 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/1/required", keyword: "required", params: { missingProperty: missing3 }, message: "must have required property '" + missing3 + "'" };
+                                        if (vErrors === null) {
+                                          vErrors = [err14];
+                                        } else {
+                                          vErrors.push(err14);
+                                        }
+                                        errors++;
                                       } else {
-                                        vErrors.push(err10);
+                                        const _errs31 = errors;
+                                        for (const key1 in data7) {
+                                          if (!(key1 === "kind")) {
+                                            const err15 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/1/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key1 }, message: "must NOT have additional properties" };
+                                            if (vErrors === null) {
+                                              vErrors = [err15];
+                                            } else {
+                                              vErrors.push(err15);
+                                            }
+                                            errors++;
+                                            break;
+                                          }
+                                        }
+                                        if (_errs31 === errors) {
+                                          if (data7.kind !== void 0) {
+                                            let data10 = data7.kind;
+                                            if (typeof data10 !== "string") {
+                                              const err16 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/1/properties/kind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                              if (vErrors === null) {
+                                                vErrors = [err16];
+                                              } else {
+                                                vErrors.push(err16);
+                                              }
+                                              errors++;
+                                            }
+                                            if ("non_repository" !== data10) {
+                                              const err17 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/1/properties/kind/const", keyword: "const", params: { allowedValue: "non_repository" }, message: "must be equal to constant" };
+                                              if (vErrors === null) {
+                                                vErrors = [err17];
+                                              } else {
+                                                vErrors.push(err17);
+                                              }
+                                              errors++;
+                                            }
+                                          }
+                                        }
                                       }
-                                      errors++;
-                                    }
-                                    if (!(data8 === "workos" || data8 === "service_token")) {
-                                      const err11 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/captureAuthorityKind/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.captureAuthorityKind.enum }, message: "must be equal to one of the allowed values" };
+                                    } else {
+                                      const err18 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf/1/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                                       if (vErrors === null) {
-                                        vErrors = [err11];
+                                        vErrors = [err18];
                                       } else {
-                                        vErrors.push(err11);
+                                        vErrors.push(err18);
                                       }
                                       errors++;
                                     }
-                                    var valid4 = _errs22 === errors;
+                                  }
+                                  var _valid1 = _errs29 === errors;
+                                  if (_valid1 && valid5) {
+                                    valid5 = false;
+                                    passing0 = [passing0, 1];
                                   } else {
-                                    var valid4 = true;
+                                    if (_valid1) {
+                                      valid5 = true;
+                                      passing0 = 1;
+                                      if (props0 !== true) {
+                                        props0 = true;
+                                      }
+                                    }
                                   }
-                                  if (valid4) {
-                                    if (data1.decisionLifecycleProtocolVersion !== void 0) {
-                                      let data9 = data1.decisionLifecycleProtocolVersion;
-                                      const _errs24 = errors;
-                                      if (!(typeof data9 == "number" && (!(data9 % 1) && !isNaN(data9)) && isFinite(data9))) {
-                                        const err12 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
-                                        if (vErrors === null) {
-                                          vErrors = [err12];
-                                        } else {
-                                          vErrors.push(err12);
-                                        }
-                                        errors++;
+                                  if (!valid5) {
+                                    const err19 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/repositoryContext/oneOf", keyword: "oneOf", params: { passingSchemas: passing0 }, message: "must match exactly one schema in oneOf" };
+                                    if (vErrors === null) {
+                                      vErrors = [err19];
+                                    } else {
+                                      vErrors.push(err19);
+                                    }
+                                    errors++;
+                                  } else {
+                                    errors = _errs21;
+                                    if (vErrors !== null) {
+                                      if (_errs21) {
+                                        vErrors.length = _errs21;
+                                      } else {
+                                        vErrors = null;
                                       }
-                                      if (errors === _errs24) {
-                                        if (typeof data9 == "number" && isFinite(data9)) {
-                                          if (data9 > 9007199254740991 || isNaN(data9)) {
-                                            const err13 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
+                                    }
+                                  }
+                                  var valid4 = _errs20 === errors;
+                                } else {
+                                  var valid4 = true;
+                                }
+                                if (valid4) {
+                                  if (data1.capturedOrganizationId !== void 0) {
+                                    let data11 = data1.capturedOrganizationId;
+                                    const _errs34 = errors;
+                                    if (errors === _errs34) {
+                                      if (typeof data11 === "string") {
+                                        if (func1(data11) > 128) {
+                                          const err20 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                                          if (vErrors === null) {
+                                            vErrors = [err20];
+                                          } else {
+                                            vErrors.push(err20);
+                                          }
+                                          errors++;
+                                        } else {
+                                          if (func1(data11) < 1) {
+                                            const err21 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
                                             if (vErrors === null) {
-                                              vErrors = [err13];
+                                              vErrors = [err21];
                                             } else {
-                                              vErrors.push(err13);
+                                              vErrors.push(err21);
                                             }
                                             errors++;
                                           } else {
-                                            if (data9 < 1 || isNaN(data9)) {
-                                              const err14 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/minimum", keyword: "minimum", params: { comparison: ">=", limit: 1 }, message: "must be >= 1" };
+                                            if (!pattern8.test(data11)) {
+                                              const err22 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/pattern", keyword: "pattern", params: { pattern: "^[A-Za-z0-9_-]+$" }, message: 'must match pattern "^[A-Za-z0-9_-]+$"' };
                                               if (vErrors === null) {
-                                                vErrors = [err14];
+                                                vErrors = [err22];
                                               } else {
-                                                vErrors.push(err14);
+                                                vErrors.push(err22);
                                               }
                                               errors++;
                                             }
                                           }
                                         }
+                                      } else {
+                                        const err23 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/capturedOrganizationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                        if (vErrors === null) {
+                                          vErrors = [err23];
+                                        } else {
+                                          vErrors.push(err23);
+                                        }
+                                        errors++;
+                                      }
+                                    }
+                                    var valid4 = _errs34 === errors;
+                                  } else {
+                                    var valid4 = true;
+                                  }
+                                  if (valid4) {
+                                    if (data1.captureAuthorityKind !== void 0) {
+                                      let data12 = data1.captureAuthorityKind;
+                                      const _errs36 = errors;
+                                      if (typeof data12 !== "string") {
+                                        const err24 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/captureAuthorityKind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                        if (vErrors === null) {
+                                          vErrors = [err24];
+                                        } else {
+                                          vErrors.push(err24);
+                                        }
+                                        errors++;
+                                      }
+                                      if (!(data12 === "workos" || data12 === "service_token")) {
+                                        const err25 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/captureAuthorityKind/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.captureAuthorityKind.enum }, message: "must be equal to one of the allowed values" };
+                                        if (vErrors === null) {
+                                          vErrors = [err25];
+                                        } else {
+                                          vErrors.push(err25);
+                                        }
+                                        errors++;
                                       }
-                                      var valid4 = _errs24 === errors;
+                                      var valid4 = _errs36 === errors;
                                     } else {
                                       var valid4 = true;
                                     }
                                     if (valid4) {
-                                      if (data1.producer !== void 0) {
-                                        let data10 = data1.producer;
-                                        const _errs26 = errors;
-                                        if (typeof data10 !== "string") {
-                                          const err15 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/producer/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                      if (data1.decisionLifecycleProtocolVersion !== void 0) {
+                                        let data13 = data1.decisionLifecycleProtocolVersion;
+                                        const _errs38 = errors;
+                                        if (!(typeof data13 == "number" && (!(data13 % 1) && !isNaN(data13)) && isFinite(data13))) {
+                                          const err26 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
                                           if (vErrors === null) {
-                                            vErrors = [err15];
+                                            vErrors = [err26];
                                           } else {
-                                            vErrors.push(err15);
+                                            vErrors.push(err26);
                                           }
                                           errors++;
                                         }
-                                        if (!(data10 === "claude_code" || data10 === "codex" || data10 === "cursor" || data10 === "hermes")) {
-                                          const err16 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.producer.enum }, message: "must be equal to one of the allowed values" };
-                                          if (vErrors === null) {
-                                            vErrors = [err16];
-                                          } else {
-                                            vErrors.push(err16);
+                                        if (errors === _errs38) {
+                                          if (typeof data13 == "number" && isFinite(data13)) {
+                                            if (data13 > 9007199254740991 || isNaN(data13)) {
+                                              const err27 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
+                                              if (vErrors === null) {
+                                                vErrors = [err27];
+                                              } else {
+                                                vErrors.push(err27);
+                                              }
+                                              errors++;
+                                            } else {
+                                              if (data13 < 1 || isNaN(data13)) {
+                                                const err28 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/decisionLifecycleProtocolVersion/minimum", keyword: "minimum", params: { comparison: ">=", limit: 1 }, message: "must be >= 1" };
+                                                if (vErrors === null) {
+                                                  vErrors = [err28];
+                                                } else {
+                                                  vErrors.push(err28);
+                                                }
+                                                errors++;
+                                              }
+                                            }
                                           }
-                                          errors++;
                                         }
-                                        var valid4 = _errs26 === errors;
+                                        var valid4 = _errs38 === errors;
                                       } else {
                                         var valid4 = true;
                                       }
                                       if (valid4) {
-                                        if (data1.toolOutcome !== void 0) {
-                                          let data11 = data1.toolOutcome;
-                                          const _errs28 = errors;
-                                          if (typeof data11 !== "string") {
-                                            const err17 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/toolOutcome/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                        if (data1.producer !== void 0) {
+                                          let data14 = data1.producer;
+                                          const _errs40 = errors;
+                                          if (typeof data14 !== "string") {
+                                            const err29 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/producer/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                                             if (vErrors === null) {
-                                              vErrors = [err17];
+                                              vErrors = [err29];
                                             } else {
-                                              vErrors.push(err17);
+                                              vErrors.push(err29);
                                             }
                                             errors++;
                                           }
-                                          if (!(data11 === "succeeded" || data11 === "returned" || data11 === "failed" || data11 === "interrupted" || data11 === "prevented" || data11 === "unknown")) {
-                                            const err18 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/toolOutcome/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.toolOutcome.enum }, message: "must be equal to one of the allowed values" };
+                                          if (!(data14 === "claude_code" || data14 === "codex" || data14 === "cursor" || data14 === "hermes")) {
+                                            const err30 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.producer.enum }, message: "must be equal to one of the allowed values" };
                                             if (vErrors === null) {
-                                              vErrors = [err18];
+                                              vErrors = [err30];
                                             } else {
-                                              vErrors.push(err18);
+                                              vErrors.push(err30);
                                             }
                                             errors++;
                                           }
-                                          var valid4 = _errs28 === errors;
+                                          var valid4 = _errs40 === errors;
                                         } else {
                                           var valid4 = true;
                                         }
                                         if (valid4) {
-                                          if (data1.envelopeVersion !== void 0) {
-                                            let data12 = data1.envelopeVersion;
-                                            const _errs30 = errors;
-                                            if (!(typeof data12 == "number" && isFinite(data12))) {
-                                              const err19 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/envelopeVersion/type", keyword: "type", params: { type: "number" }, message: "must be number" };
+                                          if (data1.toolOutcome !== void 0) {
+                                            let data15 = data1.toolOutcome;
+                                            const _errs42 = errors;
+                                            if (typeof data15 !== "string") {
+                                              const err31 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/toolOutcome/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                                               if (vErrors === null) {
-                                                vErrors = [err19];
+                                                vErrors = [err31];
                                               } else {
-                                                vErrors.push(err19);
+                                                vErrors.push(err31);
                                               }
                                               errors++;
                                             }
-                                            if (4 !== data12) {
-                                              const err20 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/envelopeVersion/const", keyword: "const", params: { allowedValue: 4 }, message: "must be equal to constant" };
+                                            if (!(data15 === "succeeded" || data15 === "returned" || data15 === "failed" || data15 === "interrupted" || data15 === "prevented" || data15 === "unknown")) {
+                                              const err32 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/toolOutcome/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.toolOutcome.enum }, message: "must be equal to one of the allowed values" };
                                               if (vErrors === null) {
-                                                vErrors = [err20];
+                                                vErrors = [err32];
                                               } else {
-                                                vErrors.push(err20);
+                                                vErrors.push(err32);
                                               }
                                               errors++;
                                             }
-                                            var valid4 = _errs30 === errors;
+                                            var valid4 = _errs42 === errors;
                                           } else {
                                             var valid4 = true;
                                           }
+                                          if (valid4) {
+                                            if (data1.envelopeVersion !== void 0) {
+                                              let data16 = data1.envelopeVersion;
+                                              const _errs44 = errors;
+                                              if (!(typeof data16 == "number" && isFinite(data16))) {
+                                                const err33 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/envelopeVersion/type", keyword: "type", params: { type: "number" }, message: "must be number" };
+                                                if (vErrors === null) {
+                                                  vErrors = [err33];
+                                                } else {
+                                                  vErrors.push(err33);
+                                                }
+                                                errors++;
+                                              }
+                                              if (4 !== data16) {
+                                                const err34 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/envelopeVersion/const", keyword: "const", params: { allowedValue: 4 }, message: "must be equal to constant" };
+                                                if (vErrors === null) {
+                                                  vErrors = [err34];
+                                                } else {
+                                                  vErrors.push(err34);
+                                                }
+                                                errors++;
+                                              }
+                                              var valid4 = _errs44 === errors;
+                                            } else {
+                                              var valid4 = true;
+                                            }
+                                          }
                                         }
                                       }
                                     }
@@ -15533,11 +15619,11 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                       }
                     }
                   } else {
-                    const err21 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+                    const err35 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                     if (vErrors === null) {
-                      vErrors = [err21];
+                      vErrors = [err35];
                     } else {
-                      vErrors.push(err21);
+                      vErrors.push(err35);
                     }
                     errors++;
                   }
@@ -15545,296 +15631,509 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                 var _valid0 = _errs7 === errors;
                 valid3 = valid3 || _valid0;
                 if (_valid0) {
-                  var props0 = true;
+                  var props1 = true;
                 }
-                const _errs32 = errors;
-                if (errors === _errs32) {
+                const _errs46 = errors;
+                if (errors === _errs46) {
                   if (data1 && typeof data1 == "object" && !Array.isArray(data1)) {
-                    let missing2;
-                    if (data1.moveId === void 0 && (missing2 = "moveId") || data1.capturedAt === void 0 && (missing2 = "capturedAt") || data1.sessionId === void 0 && (missing2 = "sessionId") || data1.eventType === void 0 && (missing2 = "eventType")) {
-                      const err22 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/required", keyword: "required", params: { missingProperty: missing2 }, message: "must have required property '" + missing2 + "'" };
+                    let missing4;
+                    if (data1.moveId === void 0 && (missing4 = "moveId") || data1.capturedAt === void 0 && (missing4 = "capturedAt") || data1.sessionId === void 0 && (missing4 = "sessionId") || data1.eventType === void 0 && (missing4 = "eventType")) {
+                      const err36 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/required", keyword: "required", params: { missingProperty: missing4 }, message: "must have required property '" + missing4 + "'" };
                       if (vErrors === null) {
-                        vErrors = [err22];
+                        vErrors = [err36];
                       } else {
-                        vErrors.push(err22);
+                        vErrors.push(err36);
                       }
                       errors++;
                     } else {
                       if (data1.moveId !== void 0) {
-                        const _errs35 = errors;
+                        const _errs49 = errors;
                         if (typeof data1.moveId !== "string") {
-                          const err23 = { instancePath: instancePath + "/batch/" + i0 + "/moveId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/moveId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                          const err37 = { instancePath: instancePath + "/batch/" + i0 + "/moveId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/moveId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                           if (vErrors === null) {
-                            vErrors = [err23];
+                            vErrors = [err37];
                           } else {
-                            vErrors.push(err23);
+                            vErrors.push(err37);
                           }
                           errors++;
                         }
-                        var valid5 = _errs35 === errors;
+                        var valid8 = _errs49 === errors;
                       } else {
-                        var valid5 = true;
+                        var valid8 = true;
                       }
-                      if (valid5) {
+                      if (valid8) {
                         if (data1.capturedAt !== void 0) {
-                          let data14 = data1.capturedAt;
-                          const _errs37 = errors;
-                          if (!(typeof data14 == "number" && isFinite(data14))) {
-                            const err24 = { instancePath: instancePath + "/batch/" + i0 + "/capturedAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedAt/type", keyword: "type", params: { type: "number" }, message: "must be number" };
+                          let data18 = data1.capturedAt;
+                          const _errs51 = errors;
+                          if (!(typeof data18 == "number" && isFinite(data18))) {
+                            const err38 = { instancePath: instancePath + "/batch/" + i0 + "/capturedAt", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedAt/type", keyword: "type", params: { type: "number" }, message: "must be number" };
                             if (vErrors === null) {
-                              vErrors = [err24];
+                              vErrors = [err38];
                             } else {
-                              vErrors.push(err24);
+                              vErrors.push(err38);
                             }
                             errors++;
                           }
-                          var valid5 = _errs37 === errors;
+                          var valid8 = _errs51 === errors;
                         } else {
-                          var valid5 = true;
+                          var valid8 = true;
                         }
-                        if (valid5) {
+                        if (valid8) {
                           if (data1.sessionId !== void 0) {
-                            const _errs39 = errors;
+                            const _errs53 = errors;
                             if (typeof data1.sessionId !== "string") {
-                              const err25 = { instancePath: instancePath + "/batch/" + i0 + "/sessionId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/sessionId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                              const err39 = { instancePath: instancePath + "/batch/" + i0 + "/sessionId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/sessionId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                               if (vErrors === null) {
-                                vErrors = [err25];
+                                vErrors = [err39];
                               } else {
-                                vErrors.push(err25);
+                                vErrors.push(err39);
                               }
                               errors++;
                             }
-                            var valid5 = _errs39 === errors;
+                            var valid8 = _errs53 === errors;
                           } else {
-                            var valid5 = true;
+                            var valid8 = true;
                           }
-                          if (valid5) {
+                          if (valid8) {
                             if (data1.invocationId !== void 0) {
-                              const _errs41 = errors;
+                              const _errs55 = errors;
                               if (typeof data1.invocationId !== "string") {
-                                const err26 = { instancePath: instancePath + "/batch/" + i0 + "/invocationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/invocationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                const err40 = { instancePath: instancePath + "/batch/" + i0 + "/invocationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/invocationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                                 if (vErrors === null) {
-                                  vErrors = [err26];
+                                  vErrors = [err40];
                                 } else {
-                                  vErrors.push(err26);
+                                  vErrors.push(err40);
                                 }
                                 errors++;
                               }
-                              var valid5 = _errs41 === errors;
+                              var valid8 = _errs55 === errors;
                             } else {
-                              var valid5 = true;
+                              var valid8 = true;
                             }
-                            if (valid5) {
+                            if (valid8) {
                               if (data1.eventType !== void 0) {
-                                const _errs43 = errors;
+                                const _errs57 = errors;
                                 if (typeof data1.eventType !== "string") {
-                                  const err27 = { instancePath: instancePath + "/batch/" + i0 + "/eventType", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/eventType/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                  const err41 = { instancePath: instancePath + "/batch/" + i0 + "/eventType", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/eventType/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                                   if (vErrors === null) {
-                                    vErrors = [err27];
+                                    vErrors = [err41];
                                   } else {
-                                    vErrors.push(err27);
+                                    vErrors.push(err41);
                                   }
                                   errors++;
                                 }
-                                var valid5 = _errs43 === errors;
+                                var valid8 = _errs57 === errors;
                               } else {
-                                var valid5 = true;
+                                var valid8 = true;
                               }
-                              if (valid5) {
-                                if (data1.capturedOrganizationId !== void 0) {
-                                  let data18 = data1.capturedOrganizationId;
-                                  const _errs45 = errors;
-                                  if (errors === _errs45) {
-                                    if (typeof data18 === "string") {
-                                      if (func1(data18) > 128) {
-                                        const err28 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                              if (valid8) {
+                                if (data1.repositoryContext !== void 0) {
+                                  let data22 = data1.repositoryContext;
+                                  const _errs59 = errors;
+                                  const _errs60 = errors;
+                                  let valid9 = false;
+                                  let passing1 = null;
+                                  const _errs61 = errors;
+                                  if (errors === _errs61) {
+                                    if (data22 && typeof data22 == "object" && !Array.isArray(data22)) {
+                                      let missing5;
+                                      if (data22.kind === void 0 && (missing5 = "kind") || data22.repoSyncId === void 0 && (missing5 = "repoSyncId")) {
+                                        const err42 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/required", keyword: "required", params: { missingProperty: missing5 }, message: "must have required property '" + missing5 + "'" };
                                         if (vErrors === null) {
-                                          vErrors = [err28];
+                                          vErrors = [err42];
                                         } else {
-                                          vErrors.push(err28);
+                                          vErrors.push(err42);
                                         }
                                         errors++;
                                       } else {
-                                        if (func1(data18) < 1) {
-                                          const err29 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
-                                          if (vErrors === null) {
-                                            vErrors = [err29];
-                                          } else {
-                                            vErrors.push(err29);
-                                          }
-                                          errors++;
-                                        } else {
-                                          if (!pattern8.test(data18)) {
-                                            const err30 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/pattern", keyword: "pattern", params: { pattern: "^[A-Za-z0-9_-]+$" }, message: 'must match pattern "^[A-Za-z0-9_-]+$"' };
+                                        const _errs63 = errors;
+                                        for (const key2 in data22) {
+                                          if (!(key2 === "kind" || key2 === "repoSyncId")) {
+                                            const err43 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key2 }, message: "must NOT have additional properties" };
                                             if (vErrors === null) {
-                                              vErrors = [err30];
+                                              vErrors = [err43];
                                             } else {
-                                              vErrors.push(err30);
+                                              vErrors.push(err43);
                                             }
                                             errors++;
+                                            break;
+                                          }
+                                        }
+                                        if (_errs63 === errors) {
+                                          if (data22.kind !== void 0) {
+                                            let data23 = data22.kind;
+                                            const _errs64 = errors;
+                                            if (typeof data23 !== "string") {
+                                              const err44 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/properties/kind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                              if (vErrors === null) {
+                                                vErrors = [err44];
+                                              } else {
+                                                vErrors.push(err44);
+                                              }
+                                              errors++;
+                                            }
+                                            if ("repository_bound" !== data23) {
+                                              const err45 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/properties/kind/const", keyword: "const", params: { allowedValue: "repository_bound" }, message: "must be equal to constant" };
+                                              if (vErrors === null) {
+                                                vErrors = [err45];
+                                              } else {
+                                                vErrors.push(err45);
+                                              }
+                                              errors++;
+                                            }
+                                            var valid10 = _errs64 === errors;
+                                          } else {
+                                            var valid10 = true;
+                                          }
+                                          if (valid10) {
+                                            if (data22.repoSyncId !== void 0) {
+                                              let data24 = data22.repoSyncId;
+                                              const _errs66 = errors;
+                                              if (errors === _errs66) {
+                                                if (typeof data24 === "string") {
+                                                  if (func1(data24) > 128) {
+                                                    const err46 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/properties/repoSyncId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                                                    if (vErrors === null) {
+                                                      vErrors = [err46];
+                                                    } else {
+                                                      vErrors.push(err46);
+                                                    }
+                                                    errors++;
+                                                  } else {
+                                                    if (func1(data24) < 1) {
+                                                      const err47 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/properties/repoSyncId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
+                                                      if (vErrors === null) {
+                                                        vErrors = [err47];
+                                                      } else {
+                                                        vErrors.push(err47);
+                                                      }
+                                                      errors++;
+                                                    }
+                                                  }
+                                                } else {
+                                                  const err48 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/repoSyncId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/properties/repoSyncId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                                  if (vErrors === null) {
+                                                    vErrors = [err48];
+                                                  } else {
+                                                    vErrors.push(err48);
+                                                  }
+                                                  errors++;
+                                                }
+                                              }
+                                              var valid10 = _errs66 === errors;
+                                            } else {
+                                              var valid10 = true;
+                                            }
                                           }
                                         }
                                       }
                                     } else {
-                                      const err31 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                      const err49 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/0/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                                       if (vErrors === null) {
-                                        vErrors = [err31];
+                                        vErrors = [err49];
                                       } else {
-                                        vErrors.push(err31);
+                                        vErrors.push(err49);
                                       }
                                       errors++;
                                     }
                                   }
-                                  var valid5 = _errs45 === errors;
-                                } else {
-                                  var valid5 = true;
-                                }
-                                if (valid5) {
-                                  if (data1.captureAuthorityKind !== void 0) {
-                                    let data19 = data1.captureAuthorityKind;
-                                    const _errs47 = errors;
-                                    if (typeof data19 !== "string") {
-                                      const err32 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/captureAuthorityKind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
-                                      if (vErrors === null) {
-                                        vErrors = [err32];
+                                  var _valid2 = _errs61 === errors;
+                                  if (_valid2) {
+                                    valid9 = true;
+                                    passing1 = 0;
+                                    var props2 = true;
+                                  }
+                                  const _errs68 = errors;
+                                  if (errors === _errs68) {
+                                    if (data22 && typeof data22 == "object" && !Array.isArray(data22)) {
+                                      let missing6;
+                                      if (data22.kind === void 0 && (missing6 = "kind")) {
+                                        const err50 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/1/required", keyword: "required", params: { missingProperty: missing6 }, message: "must have required property '" + missing6 + "'" };
+                                        if (vErrors === null) {
+                                          vErrors = [err50];
+                                        } else {
+                                          vErrors.push(err50);
+                                        }
+                                        errors++;
                                       } else {
-                                        vErrors.push(err32);
+                                        const _errs70 = errors;
+                                        for (const key3 in data22) {
+                                          if (!(key3 === "kind")) {
+                                            const err51 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/1/additionalProperties", keyword: "additionalProperties", params: { additionalProperty: key3 }, message: "must NOT have additional properties" };
+                                            if (vErrors === null) {
+                                              vErrors = [err51];
+                                            } else {
+                                              vErrors.push(err51);
+                                            }
+                                            errors++;
+                                            break;
+                                          }
+                                        }
+                                        if (_errs70 === errors) {
+                                          if (data22.kind !== void 0) {
+                                            let data25 = data22.kind;
+                                            if (typeof data25 !== "string") {
+                                              const err52 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/1/properties/kind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                              if (vErrors === null) {
+                                                vErrors = [err52];
+                                              } else {
+                                                vErrors.push(err52);
+                                              }
+                                              errors++;
+                                            }
+                                            if ("non_repository" !== data25) {
+                                              const err53 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext/kind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/1/properties/kind/const", keyword: "const", params: { allowedValue: "non_repository" }, message: "must be equal to constant" };
+                                              if (vErrors === null) {
+                                                vErrors = [err53];
+                                              } else {
+                                                vErrors.push(err53);
+                                              }
+                                              errors++;
+                                            }
+                                          }
+                                        }
                                       }
-                                      errors++;
-                                    }
-                                    if (!(data19 === "workos" || data19 === "service_token")) {
-                                      const err33 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/captureAuthorityKind/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.captureAuthorityKind.enum }, message: "must be equal to one of the allowed values" };
+                                    } else {
+                                      const err54 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf/1/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                                       if (vErrors === null) {
-                                        vErrors = [err33];
+                                        vErrors = [err54];
                                       } else {
-                                        vErrors.push(err33);
+                                        vErrors.push(err54);
                                       }
                                       errors++;
                                     }
-                                    var valid5 = _errs47 === errors;
+                                  }
+                                  var _valid2 = _errs68 === errors;
+                                  if (_valid2 && valid9) {
+                                    valid9 = false;
+                                    passing1 = [passing1, 1];
                                   } else {
-                                    var valid5 = true;
+                                    if (_valid2) {
+                                      valid9 = true;
+                                      passing1 = 1;
+                                      if (props2 !== true) {
+                                        props2 = true;
+                                      }
+                                    }
                                   }
-                                  if (valid5) {
-                                    if (data1.decisionLifecycleProtocolVersion !== void 0) {
-                                      let data20 = data1.decisionLifecycleProtocolVersion;
-                                      const _errs49 = errors;
-                                      if (!(typeof data20 == "number" && (!(data20 % 1) && !isNaN(data20)) && isFinite(data20))) {
-                                        const err34 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
-                                        if (vErrors === null) {
-                                          vErrors = [err34];
-                                        } else {
-                                          vErrors.push(err34);
-                                        }
-                                        errors++;
+                                  if (!valid9) {
+                                    const err55 = { instancePath: instancePath + "/batch/" + i0 + "/repositoryContext", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/repositoryContext/oneOf", keyword: "oneOf", params: { passingSchemas: passing1 }, message: "must match exactly one schema in oneOf" };
+                                    if (vErrors === null) {
+                                      vErrors = [err55];
+                                    } else {
+                                      vErrors.push(err55);
+                                    }
+                                    errors++;
+                                  } else {
+                                    errors = _errs60;
+                                    if (vErrors !== null) {
+                                      if (_errs60) {
+                                        vErrors.length = _errs60;
+                                      } else {
+                                        vErrors = null;
                                       }
-                                      if (errors === _errs49) {
-                                        if (typeof data20 == "number" && isFinite(data20)) {
-                                          if (data20 > 9007199254740991 || isNaN(data20)) {
-                                            const err35 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
+                                    }
+                                  }
+                                  var valid8 = _errs59 === errors;
+                                } else {
+                                  var valid8 = true;
+                                }
+                                if (valid8) {
+                                  if (data1.capturedOrganizationId !== void 0) {
+                                    let data26 = data1.capturedOrganizationId;
+                                    const _errs73 = errors;
+                                    if (errors === _errs73) {
+                                      if (typeof data26 === "string") {
+                                        if (func1(data26) > 128) {
+                                          const err56 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/maxLength", keyword: "maxLength", params: { limit: 128 }, message: "must NOT have more than 128 characters" };
+                                          if (vErrors === null) {
+                                            vErrors = [err56];
+                                          } else {
+                                            vErrors.push(err56);
+                                          }
+                                          errors++;
+                                        } else {
+                                          if (func1(data26) < 1) {
+                                            const err57 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/minLength", keyword: "minLength", params: { limit: 1 }, message: "must NOT have fewer than 1 characters" };
                                             if (vErrors === null) {
-                                              vErrors = [err35];
+                                              vErrors = [err57];
                                             } else {
-                                              vErrors.push(err35);
+                                              vErrors.push(err57);
                                             }
                                             errors++;
                                           } else {
-                                            if (data20 < 1 || isNaN(data20)) {
-                                              const err36 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/minimum", keyword: "minimum", params: { comparison: ">=", limit: 1 }, message: "must be >= 1" };
+                                            if (!pattern8.test(data26)) {
+                                              const err58 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/pattern", keyword: "pattern", params: { pattern: "^[A-Za-z0-9_-]+$" }, message: 'must match pattern "^[A-Za-z0-9_-]+$"' };
                                               if (vErrors === null) {
-                                                vErrors = [err36];
+                                                vErrors = [err58];
                                               } else {
-                                                vErrors.push(err36);
+                                                vErrors.push(err58);
                                               }
                                               errors++;
                                             }
                                           }
                                         }
+                                      } else {
+                                        const err59 = { instancePath: instancePath + "/batch/" + i0 + "/capturedOrganizationId", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/capturedOrganizationId/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                        if (vErrors === null) {
+                                          vErrors = [err59];
+                                        } else {
+                                          vErrors.push(err59);
+                                        }
+                                        errors++;
+                                      }
+                                    }
+                                    var valid8 = _errs73 === errors;
+                                  } else {
+                                    var valid8 = true;
+                                  }
+                                  if (valid8) {
+                                    if (data1.captureAuthorityKind !== void 0) {
+                                      let data27 = data1.captureAuthorityKind;
+                                      const _errs75 = errors;
+                                      if (typeof data27 !== "string") {
+                                        const err60 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/captureAuthorityKind/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                        if (vErrors === null) {
+                                          vErrors = [err60];
+                                        } else {
+                                          vErrors.push(err60);
+                                        }
+                                        errors++;
+                                      }
+                                      if (!(data27 === "workos" || data27 === "service_token")) {
+                                        const err61 = { instancePath: instancePath + "/batch/" + i0 + "/captureAuthorityKind", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/captureAuthorityKind/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.captureAuthorityKind.enum }, message: "must be equal to one of the allowed values" };
+                                        if (vErrors === null) {
+                                          vErrors = [err61];
+                                        } else {
+                                          vErrors.push(err61);
+                                        }
+                                        errors++;
                                       }
-                                      var valid5 = _errs49 === errors;
+                                      var valid8 = _errs75 === errors;
                                     } else {
-                                      var valid5 = true;
+                                      var valid8 = true;
                                     }
-                                    if (valid5) {
-                                      if (data1.producer !== void 0) {
-                                        let data21 = data1.producer;
-                                        const _errs51 = errors;
-                                        if (typeof data21 !== "string") {
-                                          const err37 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/producer/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                    if (valid8) {
+                                      if (data1.decisionLifecycleProtocolVersion !== void 0) {
+                                        let data28 = data1.decisionLifecycleProtocolVersion;
+                                        const _errs77 = errors;
+                                        if (!(typeof data28 == "number" && (!(data28 % 1) && !isNaN(data28)) && isFinite(data28))) {
+                                          const err62 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/type", keyword: "type", params: { type: "integer" }, message: "must be integer" };
                                           if (vErrors === null) {
-                                            vErrors = [err37];
+                                            vErrors = [err62];
                                           } else {
-                                            vErrors.push(err37);
+                                            vErrors.push(err62);
                                           }
                                           errors++;
                                         }
-                                        if (!(data21 === "claude_code" || data21 === "codex" || data21 === "cursor" || data21 === "hermes")) {
-                                          const err38 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.producer.enum }, message: "must be equal to one of the allowed values" };
-                                          if (vErrors === null) {
-                                            vErrors = [err38];
-                                          } else {
-                                            vErrors.push(err38);
+                                        if (errors === _errs77) {
+                                          if (typeof data28 == "number" && isFinite(data28)) {
+                                            if (data28 > 9007199254740991 || isNaN(data28)) {
+                                              const err63 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/maximum", keyword: "maximum", params: { comparison: "<=", limit: 9007199254740991 }, message: "must be <= 9007199254740991" };
+                                              if (vErrors === null) {
+                                                vErrors = [err63];
+                                              } else {
+                                                vErrors.push(err63);
+                                              }
+                                              errors++;
+                                            } else {
+                                              if (data28 < 1 || isNaN(data28)) {
+                                                const err64 = { instancePath: instancePath + "/batch/" + i0 + "/decisionLifecycleProtocolVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/decisionLifecycleProtocolVersion/minimum", keyword: "minimum", params: { comparison: ">=", limit: 1 }, message: "must be >= 1" };
+                                                if (vErrors === null) {
+                                                  vErrors = [err64];
+                                                } else {
+                                                  vErrors.push(err64);
+                                                }
+                                                errors++;
+                                              }
+                                            }
                                           }
-                                          errors++;
                                         }
-                                        var valid5 = _errs51 === errors;
+                                        var valid8 = _errs77 === errors;
                                       } else {
-                                        var valid5 = true;
+                                        var valid8 = true;
                                       }
-                                      if (valid5) {
-                                        if (data1.toolOutcome !== void 0) {
-                                          let data22 = data1.toolOutcome;
-                                          const _errs53 = errors;
-                                          if (typeof data22 !== "string") {
-                                            const err39 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/toolOutcome/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                      if (valid8) {
+                                        if (data1.producer !== void 0) {
+                                          let data29 = data1.producer;
+                                          const _errs79 = errors;
+                                          if (typeof data29 !== "string") {
+                                            const err65 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/producer/type", keyword: "type", params: { type: "string" }, message: "must be string" };
                                             if (vErrors === null) {
-                                              vErrors = [err39];
+                                              vErrors = [err65];
                                             } else {
-                                              vErrors.push(err39);
+                                              vErrors.push(err65);
                                             }
                                             errors++;
                                           }
-                                          if (!(data22 === "succeeded" || data22 === "returned" || data22 === "failed" || data22 === "interrupted" || data22 === "prevented" || data22 === "unknown")) {
-                                            const err40 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/toolOutcome/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.toolOutcome.enum }, message: "must be equal to one of the allowed values" };
+                                          if (!(data29 === "claude_code" || data29 === "codex" || data29 === "cursor" || data29 === "hermes")) {
+                                            const err66 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.producer.enum }, message: "must be equal to one of the allowed values" };
                                             if (vErrors === null) {
-                                              vErrors = [err40];
+                                              vErrors = [err66];
                                             } else {
-                                              vErrors.push(err40);
+                                              vErrors.push(err66);
                                             }
                                             errors++;
                                           }
-                                          var valid5 = _errs53 === errors;
+                                          var valid8 = _errs79 === errors;
                                         } else {
-                                          var valid5 = true;
+                                          var valid8 = true;
                                         }
-                                        if (valid5) {
-                                          if (data1.envelopeVersion !== void 0) {
-                                            let data23 = data1.envelopeVersion;
-                                            const _errs55 = errors;
-                                            if (errors === _errs55) {
-                                              if (typeof data23 == "number" && isFinite(data23)) {
-                                                if (data23 >= 4 || isNaN(data23)) {
-                                                  const err41 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/envelopeVersion/exclusiveMaximum", keyword: "exclusiveMaximum", params: { comparison: "<", limit: 4 }, message: "must be < 4" };
+                                        if (valid8) {
+                                          if (data1.toolOutcome !== void 0) {
+                                            let data30 = data1.toolOutcome;
+                                            const _errs81 = errors;
+                                            if (typeof data30 !== "string") {
+                                              const err67 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/toolOutcome/type", keyword: "type", params: { type: "string" }, message: "must be string" };
+                                              if (vErrors === null) {
+                                                vErrors = [err67];
+                                              } else {
+                                                vErrors.push(err67);
+                                              }
+                                              errors++;
+                                            }
+                                            if (!(data30 === "succeeded" || data30 === "returned" || data30 === "failed" || data30 === "interrupted" || data30 === "prevented" || data30 === "unknown")) {
+                                              const err68 = { instancePath: instancePath + "/batch/" + i0 + "/toolOutcome", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/toolOutcome/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.toolOutcome.enum }, message: "must be equal to one of the allowed values" };
+                                              if (vErrors === null) {
+                                                vErrors = [err68];
+                                              } else {
+                                                vErrors.push(err68);
+                                              }
+                                              errors++;
+                                            }
+                                            var valid8 = _errs81 === errors;
+                                          } else {
+                                            var valid8 = true;
+                                          }
+                                          if (valid8) {
+                                            if (data1.envelopeVersion !== void 0) {
+                                              let data31 = data1.envelopeVersion;
+                                              const _errs83 = errors;
+                                              if (errors === _errs83) {
+                                                if (typeof data31 == "number" && isFinite(data31)) {
+                                                  if (data31 >= 4 || isNaN(data31)) {
+                                                    const err69 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/envelopeVersion/exclusiveMaximum", keyword: "exclusiveMaximum", params: { comparison: "<", limit: 4 }, message: "must be < 4" };
+                                                    if (vErrors === null) {
+                                                      vErrors = [err69];
+                                                    } else {
+                                                      vErrors.push(err69);
+                                                    }
+                                                    errors++;
+                                                  }
+                                                } else {
+                                                  const err70 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/envelopeVersion/type", keyword: "type", params: { type: "number" }, message: "must be number" };
                                                   if (vErrors === null) {
-                                                    vErrors = [err41];
+                                                    vErrors = [err70];
                                                   } else {
-                                                    vErrors.push(err41);
+                                                    vErrors.push(err70);
                                                   }
                                                   errors++;
                                                 }
-                                              } else {
-                                                const err42 = { instancePath: instancePath + "/batch/" + i0 + "/envelopeVersion", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/envelopeVersion/type", keyword: "type", params: { type: "number" }, message: "must be number" };
-                                                if (vErrors === null) {
-                                                  vErrors = [err42];
-                                                } else {
-                                                  vErrors.push(err42);
-                                                }
-                                                errors++;
                                               }
+                                              var valid8 = _errs83 === errors;
+                                            } else {
+                                              var valid8 = true;
                                             }
-                                            var valid5 = _errs55 === errors;
-                                          } else {
-                                            var valid5 = true;
                                           }
                                         }
                                       }
@@ -15848,28 +16147,28 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                       }
                     }
                   } else {
-                    const err43 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/type", keyword: "type", params: { type: "object" }, message: "must be object" };
+                    const err71 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/type", keyword: "type", params: { type: "object" }, message: "must be object" };
                     if (vErrors === null) {
-                      vErrors = [err43];
+                      vErrors = [err71];
                     } else {
-                      vErrors.push(err43);
+                      vErrors.push(err71);
                     }
                     errors++;
                   }
                 }
-                var _valid0 = _errs32 === errors;
+                var _valid0 = _errs46 === errors;
                 valid3 = valid3 || _valid0;
                 if (_valid0) {
-                  if (props0 !== true) {
-                    props0 = true;
+                  if (props1 !== true) {
+                    props1 = true;
                   }
                 }
                 if (!valid3) {
-                  const err44 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf", keyword: "anyOf", params: {}, message: "must match a schema in anyOf" };
+                  const err72 = { instancePath: instancePath + "/batch/" + i0, schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf", keyword: "anyOf", params: {}, message: "must match a schema in anyOf" };
                   if (vErrors === null) {
-                    vErrors = [err44];
+                    vErrors = [err72];
                   } else {
-                    vErrors.push(err44);
+                    vErrors.push(err72);
                   }
                   errors++;
                   validate51.errors = vErrors;
@@ -20292,6 +20591,53 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { delimiter, dirname as dirname6, isAbsolute as isAbsolute4, join as join9, resolve as resolve3 } from "path";
+
+// src/lib/git-hook-contract.ts
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
+// src/lib/hook-runtime.ts
 var RELEASE_PREFIX = "release-";
 var MAX_MANIFEST_BYTES = 64 * 1024;
 var RELEASE_GRACE_MS = 10 * 60 * 1e3;
@@ -24964,7 +25310,7 @@ var COMMAND_OPTIONS = {
     longOptionalValues: set("--color")
   },
   grep: {
-    shortFlags: "EFGHIPRTUVabcdhLlnqrsuvwxyZz",
+    shortFlags: "EFGHIPRTUVabcdhiLlnoqrsuvwxyZz",
     shortValues: "ABCDefm",
     longFlags: set(
       "--basic-regexp --binary-files-without-match --byte-offset --count --extended-regexp --files-with-matches --files-without-match --fixed-regexp --fixed-strings --help --ignore-case --initial-tab --invert-match --line-buffered --line-number --line-regexp --null --null-data --only-matching --perl-regexp --quiet --recursive --silent --unix-byte-offsets --version --with-filename --word-regexp"
@@ -24975,12 +25321,14 @@ var COMMAND_OPTIONS = {
     longOptionalValues: set("--color")
   },
   head: {
+    numericCount: true,
     shortFlags: "qvz",
     shortValues: "cn",
     longFlags: set("--help --quiet --verbose --version --zero-terminated"),
     longValues: set("--bytes --lines")
   },
   tail: {
+    numericCount: true,
     shortFlags: "Fqsvz",
     shortValues: "cn",
     longFlags: set("--help --quiet --retry --silent --verbose --version --zero-terminated"),
@@ -25005,6 +25353,7 @@ var COMMAND_OPTIONS = {
   }
 };
 var GIT_INSPECTION_OPTIONS = {
+  numericCount: true,
   shortFlags: "abcdfhiklmnprstuvwz",
   shortValues: "ABCGLMSU",
   longFlags: set(
@@ -25147,6 +25496,7 @@ function parseOptions(args, spec) {
       optionsEnded = true;
       continue;
     }
+    if (spec.numericCount && /^-\d+$/.test(arg)) continue;
     if (arg.startsWith("--")) {
       const separator = arg.indexOf("=");
       const option = separator === -1 ? arg : arg.slice(0, separator);
@@ -25703,6 +26053,15 @@ function hermesAdvisory(result, aggregate) {
   const message = [...new Set(parts.filter(Boolean))].join("\n");
   return message.startsWith("[primitive]") ? message : message ? `[primitive] ${message}` : "";
 }
+function preflightFailure(error) {
+  if (!(error instanceof HttpError && error.status === 401)) {
+    return "enforcement service unavailable; change was not verified";
+  }
+  if (resolveAuthCredential()?.source === "environment") {
+    return "PRIM_TOKEN was rejected; change was not verified";
+  }
+  return "authentication required; run `prim auth login`; change was not verified";
+}
 async function emitUnverified(message, envelope) {
   const result = unverifiedResult(message);
   if (agent === "hermes") {
@@ -25824,8 +26183,8 @@ async function main() {
       return;
     }
     result = resultForPreflight(response);
-  } catch {
-    await emitUnverified("enforcement service unavailable; change was not verified", envelope);
+  } catch (error) {
+    await emitUnverified(preflightFailure(error), envelope);
     return;
   }
   const aggregate = demoteForMode(