@rhize/skill-forge 0.14.0 → 0.16.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import { createRequire } from "module";
 import { join as join21 } from "path";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 
 // src/errors.ts
 var UserError = class extends Error {
@@ -218,10 +218,10 @@ function validatePreference(key, value) {
   if (/[\u0000-\u001F\u007F-\u009F]/.test(value)) {
     throw new UserError(`preference "${key}" contains control characters \u2014 refusing to store terminal escape sequences`);
   }
-  for (const { pattern, label } of SECRET_VALUE_PATTERNS) {
+  for (const { pattern, label: label2 } of SECRET_VALUE_PATTERNS) {
     if (pattern.test(value)) {
       throw new UserError(
-        `refusing to store "${key}": the value looks like ${label}, and config.json is plain text. Keep secrets in your OS keychain or an env var.`
+        `refusing to store "${key}": the value looks like ${label2}, and config.json is plain text. Keep secrets in your OS keychain or an env var.`
       );
     }
   }
@@ -418,14 +418,30 @@ function saveConfig(config) {
   if (!existsSync(home)) {
     mkdirSync(home, { recursive: true });
   }
-  writeFileSync(getConfigPath(), JSON.stringify(config, null, 2) + "\n", "utf-8");
+  const path = getConfigPath();
+  writeFileSync(path, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  chmodSync(path, 384);
 }
 
 // src/install/resolve.ts
 import { existsSync as existsSync2 } from "fs";
 
 // src/util.ts
-import { accessSync, constants, mkdirSync as mkdirSync2, renameSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import {
+  accessSync,
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  renameSync,
+  rmSync,
+  statSync as statSync2,
+  writeSync,
+  writeFileSync as writeFileSync2
+} from "fs";
 import { homedir as homedir2 } from "os";
 import { basename, delimiter, dirname, join as join3 } from "path";
 import { randomUUID } from "crypto";
@@ -484,6 +500,48 @@ function writeNewFile(path, contents, hint) {
     throw err;
   }
 }
+function appendPrivateJsonLine(path, value) {
+  const line = Buffer.from(`${JSON.stringify(value)}
+`, "utf-8");
+  let priorStat;
+  try {
+    priorStat = lstatSync(path);
+    if (priorStat.isSymbolicLink()) throw new UserError(`refusing to append through a symlink: ${path}`);
+    if (!priorStat.isFile()) throw new UserError(`append destination must be a regular file: ${path}`);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | noFollow, 384);
+    const descriptorStat = fstatSync(descriptor);
+    if (!descriptorStat.isFile()) throw new UserError(`append destination must be a regular file: ${path}`);
+    const openedPathStat = lstatSync(path);
+    if (openedPathStat.isSymbolicLink()) throw new UserError(`refusing to append through a symlink: ${path}`);
+    if (!openedPathStat.isFile()) throw new UserError(`append destination must be a regular file: ${path}`);
+    if (openedPathStat.dev !== descriptorStat.dev || openedPathStat.ino !== descriptorStat.ino) {
+      throw new UserError(`append destination changed while opening: ${path}`);
+    }
+    if (priorStat && (priorStat.dev !== descriptorStat.dev || priorStat.ino !== descriptorStat.ino)) {
+      throw new UserError(`append destination changed while opening: ${path}`);
+    }
+    fchmodSync(descriptor, 384);
+    let offset = 0;
+    while (offset < line.byteLength) {
+      const written = writeSync(descriptor, line, offset, line.byteLength - offset);
+      if (written === 0) throw new Error(`unable to append JSONL record to ${path}`);
+      offset += written;
+    }
+  } catch (error) {
+    if (error.code === "ELOOP") {
+      throw new UserError(`refusing to append through a symlink: ${path}`);
+    }
+    throw error;
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
 
 // src/install/resolve.ts
 var GIT_URL_PATTERN = /^(git@|https?:\/\/|ssh:\/\/)/;
@@ -659,7 +717,7 @@ import { basename as basename3, join as join6 } from "path";
 
 // src/install/fingerprint.ts
 import { createHash } from "crypto";
-import { lstatSync, readFileSync as readFileSync3, readdirSync as readdirSync3, readlinkSync, realpathSync } from "fs";
+import { lstatSync as lstatSync2, readFileSync as readFileSync3, readdirSync as readdirSync3, readlinkSync, realpathSync } from "fs";
 import { isAbsolute, join as join5, relative, sep } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set([".git", "node_modules"]);
 function isInside(child, root) {
@@ -730,7 +788,7 @@ function fingerprintDirs(dirs) {
 }
 function isRealDirectory(path) {
   try {
-    return lstatSync(path).isDirectory();
+    return lstatSync2(path).isDirectory();
   } catch {
     return false;
   }
@@ -971,8 +1029,8 @@ function appendProvenance(entry, skillsRoot) {
   appendFileSync(ledgerPath, block, "utf-8");
   return ledgerPath;
 }
-function extractField(block, label) {
-  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function extractField(block, label2) {
+  const escaped = label2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const match = block.match(new RegExp(`\\*\\*${escaped}:\\*\\*\\s*(.*)`));
   return match ? match[1].trim() : void 0;
 }
@@ -1031,7 +1089,7 @@ import { basename as basename7, dirname as dirname5, join as join13 } from "path
 // src/audit.ts
 import {
   existsSync as existsSync9,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdtempSync,
   readFileSync as readFileSync9,
   readdirSync as readdirSync5,
@@ -1465,14 +1523,14 @@ skill skills user claude code based comprehensive enhanced practical including i
 `.split(/\s+/).filter(Boolean)
 );
 var DEFAULT_SET_THRESHOLD = 0.45;
-function splitLimited(text, sep5, maxSplit) {
+function splitLimited(text, sep7, maxSplit) {
   const parts = [];
   let rest = text;
   for (let i = 0; i < maxSplit; i++) {
-    const idx = rest.indexOf(sep5);
+    const idx = rest.indexOf(sep7);
     if (idx === -1) break;
     parts.push(rest.slice(0, idx));
-    rest = rest.slice(idx + sep5.length);
+    rest = rest.slice(idx + sep7.length);
   }
   parts.push(rest);
   return parts;
@@ -2570,7 +2628,7 @@ async function scaffoldFoundationSkill(config, profile, targetRoot) {
   const destDir = join12(resolvedRoot, "business-foundation");
   let destLstat;
   try {
-    destLstat = lstatSync2(destDir);
+    destLstat = lstatSync3(destDir);
   } catch {
     destLstat = void 0;
   }
@@ -2742,10 +2800,10 @@ import { join as join16 } from "path";
 // src/gate/profile.ts
 import { execFileSync } from "child_process";
 import {
-  closeSync,
+  closeSync as closeSync2,
   existsSync as existsSync12,
   mkdtempSync as mkdtempSync2,
-  openSync,
+  openSync as openSync2,
   readFileSync as readFileSync12,
   readdirSync as readdirSync6,
   readSync,
@@ -3073,10 +3131,10 @@ function findSkillMdOneLevelDown(dir) {
 }
 function isZipFile(p) {
   try {
-    const fd = openSync(p, "r");
+    const fd = openSync2(p, "r");
     const buf = Buffer.alloc(4);
     const bytesRead = readSync(fd, buf, 0, 4, 0);
-    closeSync(fd);
+    closeSync2(fd);
     if (bytesRead < 4) return false;
     return buf[0] === 80 && buf[1] === 75 && (buf[2] === 3 || buf[2] === 5 || buf[2] === 7);
   } catch {
@@ -3179,8 +3237,8 @@ function detectLicense(root, fm) {
     const p = join15(root, name);
     if (existsSync12(p) && statSync7(p).isFile()) {
       const head = readFileSync12(p, "utf-8").slice(0, 2e3).toLowerCase();
-      for (const [hint, label] of Object.entries(SPDX_HINTS)) {
-        if (head.includes(hint)) return label;
+      for (const [hint, label2] of Object.entries(SPDX_HINTS)) {
+        if (head.includes(hint)) return label2;
       }
       return "present but unrecognized";
     }
@@ -3458,8 +3516,8 @@ function tagsForNode(map, node) {
     if (edge.from !== node.id) continue;
     if (edge.type !== "topic-tag" && edge.type !== "stack-tag") continue;
     const tagNode = nodeById(map, edge.to);
-    const label = tagNode?.name ?? tagNode?.id;
-    if (label) tags.add(label);
+    const label2 = tagNode?.name ?? tagNode?.id;
+    if (label2) tags.add(label2);
   }
   return Array.from(tags);
 }
@@ -3574,9 +3632,9 @@ function renderListField(labelText, items, placeholder) {
   if (!items || items.length === 0) {
     return `${head}${placeholder}`;
   }
-  const bullets = items.map((item) => `  - ${item}`).join("\n");
+  const bullets2 = items.map((item) => `  - ${item}`).join("\n");
   return `${head.trimEnd()}
-${bullets}`;
+${bullets2}`;
 }
 function renderSafetyLine(safety) {
   const detail = [safety.severity, safety.score !== void 0 ? `score ${safety.score}` : void 0].filter((v) => Boolean(v)).join(", ");
@@ -3836,11 +3894,14 @@ function generateId(existingIds) {
 // src/handoff.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join18, win32 } from "path";
 import { fileURLToPath } from "url";
 var KNOWN_AGENT_BINARIES = ["claude", "codex", "cursor-agent", "windsurf", "opencode", "gemini"];
 var HANDOFF_INSTRUCTION = "Read {prompt} and follow its instructions for the skill installed at {path}";
 function resolvePromptPath(assetName = "ingest-prompt.md") {
+  if (assetName.length === 0 || assetName.includes("\0") || isAbsolute2(assetName) || win32.isAbsolute(assetName) || assetName.split(/[\\/]/).includes("..")) {
+    throw new UserError(`Invalid handoff prompt asset path: ${assetName}`);
+  }
   const here = dirname7(fileURLToPath(import.meta.url));
   const builtCandidate = join18(here, assetName);
   if (existsSync15(builtCandidate)) return builtCandidate;
@@ -3857,29 +3918,35 @@ function substitute(template, vars) {
 function buildHandoffCommand(config, installedPath, deps = {}) {
   const isOnPath = deps.isOnPath ?? defaultIsOnPath;
   const promptPath = resolvePromptPath(deps.promptAsset);
-  const vars = { path: installedPath, prompt: promptPath };
+  const baseVars = { path: installedPath, prompt: promptPath };
+  const instruction = substitute([deps.instruction ?? HANDOFF_INSTRUCTION], baseVars)[0];
+  const vars = { ...baseVars, instruction };
   if (config.handoffCommand && config.handoffCommand.length > 0) {
-    return { argv: substitute(config.handoffCommand, vars), source: "template" };
+    const template = config.handoffCommand.map(
+      (token) => deps.instruction !== void 0 && token === HANDOFF_INSTRUCTION ? "{instruction}" : token
+    );
+    return { argv: substitute(template, vars), source: "template" };
   }
   for (const bin of KNOWN_AGENT_BINARIES) {
     if (isOnPath(bin)) {
-      return { argv: substitute([bin, "-p", HANDOFF_INSTRUCTION], vars), source: "detected" };
+      const template = bin === "codex" ? [bin, "exec", "{instruction}"] : [bin, "-p", "{instruction}"];
+      return { argv: substitute(template, vars), source: "detected" };
     }
   }
   return { argv: [], source: "none" };
 }
-function printOnlyMessage(installedPath, promptAsset) {
+function printOnlyMessage(installedPath, promptAsset, targetLabel = "Skill path") {
   const promptPath = resolvePromptPath(promptAsset);
   return `[skill-forge] no agent handoff available \u2014 run one yourself:
   Prompt:      ${promptPath}
-  Skill path:  ${installedPath}`;
+  ${targetLabel}:  ${installedPath}`;
 }
 function runHandoff(config, installedPath, options = {}) {
   const command = buildHandoffCommand(config, installedPath, options);
   const spawn2 = options.spawn ?? spawnSync;
   const log = options.log ?? console.log;
   if (command.source === "none" || command.argv.length === 0) {
-    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    const printed = printOnlyMessage(installedPath, options.promptAsset, options.targetLabel);
     log(printed);
     return { ran: false, command, printed };
   }
@@ -3887,7 +3954,7 @@ function runHandoff(config, installedPath, options = {}) {
   const result = spawn2(bin, args, { stdio: options.stdio ?? "inherit" });
   const error = result.error;
   if (error?.code === "ENOENT") {
-    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    const printed = printOnlyMessage(installedPath, options.promptAsset, options.targetLabel);
     log(`[skill-forge] ${bin} not found on PATH \u2014 run this yourself:`);
     log(printed);
     return { ran: false, command, printed, error: error.message };
@@ -4150,6 +4217,136 @@ var AGENTS = [
   { id: "adal", displayName: "AdaL", projectRoot: ".adal/skills", globalRoot: "~/.adal/skills" }
 ].map(makeAgent);
 
+// src/gitPreflight.ts
+import { relative as relative2, sep as sep2 } from "path";
+function splitNulTerminated(output) {
+  return output.split("\0").filter((s) => s.length > 0);
+}
+function toPosixPath(p) {
+  return p.split(sep2).join("/");
+}
+var missingResult = (root) => ({
+  root,
+  state: "MISSING",
+  baseline: "NO_HEAD",
+  dirty: false,
+  otherStaged: false,
+  rollbackReady: false
+});
+var notInRepoResult = (root) => ({
+  root,
+  state: "NOT_IN_REPO",
+  baseline: "NO_HEAD",
+  dirty: false,
+  otherStaged: false,
+  rollbackReady: false
+});
+async function evaluateGitPreflight(root, deps = {}) {
+  const exec = deps.exec ?? defaultExec;
+  if (!isDir(root)) return missingResult(root);
+  let toplevel;
+  try {
+    toplevel = await exec("git", ["-C", root, "rev-parse", "--show-toplevel"], { cwd: root });
+  } catch {
+    return notInRepoResult(root);
+  }
+  if (toplevel.code !== 0) return notInRepoResult(root);
+  const repoRoot = toplevel.stdout.trim();
+  if (!repoRoot) return notInRepoResult(root);
+  const rel = toPosixPath(relative2(repoRoot, root));
+  const pathspec = rel === "" ? "." : rel;
+  const tracked = await exec("git", ["--literal-pathspecs", "-C", repoRoot, "ls-files", "-z", "--", pathspec], { cwd: repoRoot });
+  const untracked = await exec(
+    "git",
+    ["--literal-pathspecs", "-C", repoRoot, "ls-files", "-z", "--others", "--exclude-standard", "--", pathspec],
+    { cwd: repoRoot }
+  );
+  const ignored = await exec(
+    "git",
+    ["--literal-pathspecs", "-C", repoRoot, "ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", pathspec],
+    { cwd: repoRoot }
+  );
+  let rootIgnored = false;
+  if (rel !== "") {
+    const checkIgnore = await exec("git", ["-C", repoRoot, "check-ignore", "--no-index", "-q", "--", pathspec], { cwd: repoRoot });
+    rootIgnored = checkIgnore.code === 0;
+  }
+  const hasTracked = splitNulTerminated(tracked.stdout).length > 0;
+  const hasUntracked = splitNulTerminated(untracked.stdout).length > 0;
+  const hasIgnored = splitNulTerminated(ignored.stdout).length > 0 || rootIgnored;
+  let state;
+  if (hasTracked && hasUntracked) state = "MIXED";
+  else if (hasTracked) state = "TRACKED";
+  else if (hasUntracked) state = "UNTRACKED";
+  else if (hasIgnored) state = "IGNORED";
+  else state = "UNTRACKED";
+  const headCheck = await exec("git", ["-C", repoRoot, "rev-parse", "--verify", "HEAD"], { cwd: repoRoot });
+  const hasHead = headCheck.code === 0;
+  const diffCached = await exec("git", ["-C", repoRoot, "diff", "--cached", "--name-only", "-z"], { cwd: repoRoot });
+  const stagedFiles = splitNulTerminated(diffCached.stdout);
+  const otherStaged = rel !== "" && stagedFiles.some((f) => f !== pathspec && !f.startsWith(`${pathspec}/`));
+  if (!hasHead) {
+    return { root, repoRoot, state, baseline: "NO_HEAD", dirty: hasTracked || hasUntracked, otherStaged, rollbackReady: false };
+  }
+  const committed = await exec(
+    "git",
+    ["--literal-pathspecs", "-C", repoRoot, "ls-tree", "-rz", "--name-only", "HEAD", "--", pathspec],
+    { cwd: repoRoot }
+  );
+  const hasCommitted = splitNulTerminated(committed.stdout).length > 0;
+  const statusRes = await exec(
+    "git",
+    ["--literal-pathspecs", "-C", repoRoot, "status", "--porcelain", "-z", "--", pathspec],
+    { cwd: repoRoot }
+  );
+  const dirty = splitNulTerminated(statusRes.stdout).length > 0;
+  const baseline = !hasCommitted ? "UNCOMMITTED" : dirty ? "PARTIAL" : "COMMITTED";
+  return { root, repoRoot, state, baseline, dirty, otherStaged, rollbackReady: hasCommitted };
+}
+function quoteForDisplay(arg) {
+  return /\s/.test(arg) ? `"${arg}"` : arg;
+}
+function formatGitCommand(cmd) {
+  return `git ${cmd.args.map(quoteForDisplay).join(" ")}`;
+}
+var BASELINE_COMMIT_MESSAGE = "skill-forge init: baseline";
+function notInRepoInitCommands(root) {
+  return [
+    { args: ["init", "--", root], cwd: root },
+    { args: ["--literal-pathspecs", "-C", root, "add", "--", "."], cwd: root },
+    { args: ["--literal-pathspecs", "-C", root, "commit", "-m", BASELINE_COMMIT_MESSAGE, "--", "."], cwd: root }
+  ];
+}
+function untrackedAddCommitCommands(root, repoRoot) {
+  return [
+    { args: ["--literal-pathspecs", "-C", repoRoot, "add", "--", root], cwd: repoRoot },
+    { args: ["--literal-pathspecs", "-C", repoRoot, "commit", "-m", BASELINE_COMMIT_MESSAGE, "--", root], cwd: repoRoot }
+  ];
+}
+function ignoredUnignoreSuggestions(root, repoRoot) {
+  const rel = toPosixPath(relative2(repoRoot, root));
+  return [`!${rel}/`, `!${rel}/**`];
+}
+async function runGitCommands(commands, deps = {}) {
+  const exec = deps.exec ?? defaultExec;
+  const results = [];
+  for (const cmd of commands) {
+    const result = await exec("git", cmd.args, { cwd: cmd.cwd });
+    results.push(result);
+    if (result.code !== 0) break;
+  }
+  return results;
+}
+function describeGitPreflight(result) {
+  if (result.state === "MISSING") return "root does not exist";
+  if (result.state === "NOT_IN_REPO") return "not in a Git repository";
+  const parts = [result.state.toLowerCase()];
+  if (result.state !== "IGNORED") parts.push(result.baseline.toLowerCase());
+  if (result.dirty) parts.push("dirty");
+  if (result.otherStaged) parts.push("other staged changes present");
+  return parts.join(", ");
+}
+
 // src/commands/audit.ts
 import { existsSync as existsSync16 } from "fs";
 import { join as join20, resolve as resolvePath3 } from "path";
@@ -4393,6 +4590,15 @@ function presenceNote(presence) {
   if (presence === "absent") return "  [CLI not on PATH]";
   return "";
 }
+async function printGitDetectionColumn(detected, deps = {}) {
+  const groups = groupByRoot(detected);
+  if (groups.length === 0) return;
+  console.log("\n[skill-forge] init \u2014 version control");
+  for (const group of groups) {
+    const result = await evaluateGitPreflight(group.root, deps);
+    console.log(`  ${group.root} \u2014 ${describeGitPreflight(result)}`);
+  }
+}
 function printMcpDetectionResults(detectedMcp) {
   if (detectedMcp.length === 0) return;
   console.log("\n[skill-forge] init \u2014 MCP config detection");
@@ -4422,13 +4628,17 @@ function buildConfig(selected, defaultTargetEntry, handoffAgent, selectedMcp = [
     mcpTargets: selectedMcp.length > 0 ? selectedMcp.map((m) => m.path) : existing.mcpTargets
   };
 }
-function printSummary(config) {
+async function printSummary(config, deps = {}) {
   console.log(`
 [skill-forge] wrote config to ${getConfigPath()}`);
   console.log(`  gate targets: ${config.skillsRoots.join(", ")}`);
   if (config.defaultTarget) console.log(`  default target: ${config.defaultTarget}`);
   if (config.handoffCommand?.length) console.log(`  handoff command: ${config.handoffCommand.join(" ")}`);
   if (config.mcpTargets?.length) console.log(`  mcp targets: ${config.mcpTargets.join(", ")}`);
+  for (const root of config.skillsRoots) {
+    const result = await evaluateGitPreflight(root, deps);
+    console.log(`  version control: ${root} \u2014 ${describeGitPreflight(result)}`);
+  }
 }
 function isPromptAbort(err) {
   return err instanceof Error && (err.name === "AbortError" || err.code === "ABORT_ERR");
@@ -4544,8 +4754,41 @@ async function promptHandoffAgent(rl, detected, narrow) {
   const idx = await promptSingleChoice(rl, `Choose [1-${ordered.length}] or Enter to skip: `, ordered.length, "skip");
   return idx === void 0 ? void 0 : ordered[idx].agent;
 }
+async function promptGitPreflight(rl, selected, deps = {}) {
+  for (const group of selected) {
+    const result = await evaluateGitPreflight(group.root, deps);
+    if (result.state === "IGNORED") {
+      console.log(`
+${group.root} is excluded by a .gitignore pattern.`);
+      console.log("  To track it, add these lines to the relevant .gitignore:");
+      for (const line of ignoredUnignoreSuggestions(group.root, result.repoRoot ?? group.root)) {
+        console.log(`    ${line}`);
+      }
+      continue;
+    }
+    const commands = result.state === "NOT_IN_REPO" ? notInRepoInitCommands(group.root) : result.state === "UNTRACKED" && result.repoRoot ? untrackedAddCommitCommands(group.root, result.repoRoot) : void 0;
+    if (!commands) continue;
+    console.log(
+      result.state === "NOT_IN_REPO" ? `
+${group.root} is not inside a Git repository yet.` : `
+${group.root} is inside a Git repository but isn't tracked yet.`
+    );
+    if (result.otherStaged) {
+      console.log("  Note: this repository has OTHER staged changes outside this root \u2014 they are left untouched below.");
+    }
+    console.log("  Would run:");
+    for (const cmd of commands) console.log(`    ${formatGitCommand(cmd)}`);
+    const answer = (await rl.question("  Commit a Git baseline for this root now? [y/N] ")).trim().toLowerCase();
+    if (answer !== "y" && answer !== "yes") continue;
+    const results = await runGitCommands(commands, deps);
+    if (results.some((r) => r.code !== 0)) {
+      console.log("  git baseline failed \u2014 see output above; the root is left as-is.");
+    }
+  }
+}
 async function init(options = {}, deps = {}) {
   const runAudit = deps.runAudit ?? auditCommand;
+  const gitDeps = deps.gitExec ? { exec: deps.gitExec } : {};
   const cwd = options.cwd ?? process.cwd();
   const home = options.home ?? homedir4();
   const detected = detectAgents(cwd, home, options.pathEnv);
@@ -4553,6 +4796,7 @@ async function init(options = {}, deps = {}) {
   if (options.list) {
     printDetectionResults(detected);
     printMcpDetectionResults(detectedMcp);
+    await printGitDetectionColumn(detected, gitDeps);
     return;
   }
   if (detected.length === 0 && detectedMcp.length === 0) {
@@ -4574,7 +4818,7 @@ async function init(options = {}, deps = {}) {
     const selectedMcpTargets = narrow ? mcpGroups.filter(hasInstalledMember) : mcpGroups;
     const config = buildConfig(selectedRoots, selectedRoots[0], void 0, selectedMcpTargets);
     saveConfig(config);
-    printSummary(config);
+    await printSummary(config, gitDeps);
     await runAudit({ yes: true });
     return;
   }
@@ -4595,9 +4839,10 @@ async function init(options = {}, deps = {}) {
     }
     const target = selected.length > 0 ? await promptDefaultTarget(rl, selected) : void 0;
     const handoffAgent = detected.length > 0 ? await promptHandoffAgent(rl, detected, narrow) : void 0;
+    await promptGitPreflight(rl, selected, gitDeps);
     const config = buildConfig(selected, target, handoffAgent, selectedMcp);
     saveConfig(config);
-    printSummary(config);
+    await printSummary(config, gitDeps);
     if (options.offerAudit !== false) {
       const answer = (await rl.question("\nRun the skills & MCP audit now? [Y/n] ")).trim().toLowerCase();
       runAuditNow = answer === "" || answer === "y" || answer === "yes";
@@ -4896,7 +5141,7 @@ import { existsSync as existsSync19 } from "fs";
 
 // src/commands/held.ts
 import { existsSync as existsSync18, realpathSync as realpathSync3 } from "fs";
-import { basename as basename9, join as join23, resolve as resolvePath4, sep as sep2 } from "path";
+import { basename as basename9, join as join23, resolve as resolvePath4, sep as sep3 } from "path";
 var PRO_FEATURE_LABEL2 = "overlap analysis, the provenance ledger, and the pending-ingestion queue";
 function resolveHeldPath(quarantineDir, id) {
   if (id === "" || id !== basename9(id) || id === "." || id === "..") {
@@ -4908,7 +5153,7 @@ function resolveHeldPath(quarantineDir, id) {
   }
   const realRoot = realpathSync3(resolvePath4(quarantineDir));
   const realCandidate = realpathSync3(candidate);
-  if (!realCandidate.startsWith(realRoot + sep2)) {
+  if (!realCandidate.startsWith(realRoot + sep3)) {
     throw new UserError(`refusing to act on "${id}": it resolves outside the quarantine dir (${realRoot})`);
   }
   return realCandidate;
@@ -5436,6 +5681,10 @@ async function status() {
   if (config.mcpTargets?.length) console.log(`  mcpTargets: ${config.mcpTargets.join(", ")}`);
   console.log(`  quarantineDir: ${config.quarantineDir}`);
   console.log(`  strictness: ${config.strictness}`);
+  for (const root of config.skillsRoots) {
+    const git = await evaluateGitPreflight(root);
+    console.log(`  version control: ${root} \u2014 ${describeGitPreflight(git)}`);
+  }
   console.log(`  last audit: ${formatAuditFreshness(readAuditState())}`);
   console.log(
     `  held in quarantine: ${held.readable ? held.count : "UNREADABLE (quarantine dir cannot be listed)"}` + (held.count > 0 ? "  (`skill-forge promote <id>` / `reject <id>`)" : "")
@@ -5448,9 +5697,9 @@ async function status() {
 // src/evolve.ts
 import { createInterface as createInterface5 } from "readline/promises";
 import { createHash as createHash3 } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync20, lstatSync as lstatSync3, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, rmSync as rmSync6 } from "fs";
+import { cpSync as cpSync3, existsSync as existsSync20, lstatSync as lstatSync4, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, rmSync as rmSync6 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename10, dirname as dirname9, join as join24, resolve as resolvePath5, sep as sep3 } from "path";
+import { basename as basename10, dirname as dirname9, join as join24, resolve as resolvePath5, sep as sep4 } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
 var PRO_FEATURE_LABEL3 = "self-evolution via SkillOpt-Sleep (evolve) \u2014 re-gating, provenance, and the pending-ingestion queue";
 async function evolve(targetSkillDir, options = {}, deps = {}) {
@@ -5518,7 +5767,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
   }
   const stagingRoot = join24(project, ".skillopt-sleep", "staging");
   const stagingDir = resolvePath5(parsed.staging_dir);
-  if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep3)) {
+  if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep4)) {
     throw new UserError(
       `skillopt-sleep reported a staging_dir outside the expected sandbox (${stagingRoot}): ${stagingDir} \u2014 refusing to use it`
     );
@@ -5737,15 +5986,15 @@ function isAlreadyAdopted(stagingDir, manifest) {
   }
   return sawComparison;
 }
-function assertNotSymlink(path, label) {
+function assertNotSymlink(path, label2) {
   let stat;
   try {
-    stat = lstatSync3(path);
+    stat = lstatSync4(path);
   } catch {
     return;
   }
   if (stat.isSymbolicLink()) {
-    throw new UserError(`refusing to re-gate ${label}: ${path} is a symlink (a staged proposal must be a plain file)`);
+    throw new UserError(`refusing to re-gate ${label2}: ${path} is a symlink (a staged proposal must be a plain file)`);
   }
 }
 function sha256File(path) {
@@ -6496,7 +6745,7 @@ import { join as join26, resolve as resolvePath8 } from "path";
 // src/gate/skillMapDrift.ts
 import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync18, existsSync as existsSync23 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve7 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute3, resolve as resolve7 } from "path";
 function sha256(text) {
   return createHash4("sha256").update(text, "utf-8").digest("hex");
 }
@@ -6529,7 +6778,7 @@ function threeWayVerdict(localNormalized, upstreamHash, baselineHash) {
 }
 function resolveLocalPath(path, mapDir) {
   const expanded = expandHome(path);
-  if (isAbsolute2(expanded)) return resolve7(expanded);
+  if (isAbsolute3(expanded)) return resolve7(expanded);
   const candidates = [resolve7(expanded)];
   if (mapDir) {
     candidates.push(resolve7(mapDir, expanded));
@@ -6942,9 +7191,9 @@ function renderRoutineMarkdown(result, audit2, watch, organize) {
   if (result.housekeeping.length > 0) {
     lines.push("", "## Housekeeping", "");
     for (const action of result.housekeeping) {
-      const label = action.outcome === "applied" ? "APPLIED" : action.outcome === "failed" ? "FAILED" : "WOULD APPLY";
+      const label2 = action.outcome === "applied" ? "APPLIED" : action.outcome === "failed" ? "FAILED" : "WOULD APPLY";
       lines.push(
-        `- ${label} ${action.kind}: ${sanitizeForMarkdown(action.target)} \u2014 ${sanitizeForMarkdown(action.reason)}`
+        `- ${label2} ${action.kind}: ${sanitizeForMarkdown(action.target)} \u2014 ${sanitizeForMarkdown(action.reason)}`
       );
     }
   }
@@ -7060,8 +7309,8 @@ async function routineCommand(options = {}) {
     if (result.organize) console.log(`  registry: ${result.organize.skills} skill(s)`);
     console.log(`  pending: ${result.pending.queue} queue, ${result.pending.quarantine} quarantine`);
     for (const action of housekeeping) {
-      const label = action.outcome === "applied" ? "housekeeping" : action.outcome === "failed" ? "FAILED" : "would do";
-      console.log(`  ${label}: ${action.kind} ${action.target}${action.outcome === "failed" ? ` \u2014 ${action.reason}` : ""}`);
+      const label2 = action.outcome === "applied" ? "housekeeping" : action.outcome === "failed" ? "FAILED" : "would do";
+      console.log(`  ${label2}: ${action.kind} ${action.target}${action.outcome === "failed" ? ` \u2014 ${action.reason}` : ""}`);
     }
     for (const item of result.degraded) console.log(`  INCOMPLETE: ${item}`);
     console.log(`  report -> ${result.reportPath}`);
@@ -7080,7 +7329,7 @@ async function routineCommand(options = {}) {
 
 // src/commands/ingest.ts
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute3, relative as relative2, resolve as resolvePath9 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute4, relative as relative3, resolve as resolvePath9 } from "path";
 var PRO_FEATURE_LABEL7 = "the pending-ingestion queue";
 var VALID_STATUSES = ["ingested", "dismissed"];
 function requireProFeature() {
@@ -7127,8 +7376,8 @@ function realpathOrNull(p) {
   }
 }
 function isUnderRoot(candidate, root) {
-  const rel = relative2(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  const rel = relative3(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
 }
 function validatePendingEntries(entries, config) {
   const quarantineRoot = realpathOrNull(resolvePath9(config.quarantineDir));
@@ -7204,195 +7453,2714 @@ async function queueClose(id, options = {}) {
   console.log(`[skill-forge] queue entry ${updated.id} closed -> status: ${updated.status}`);
 }
 
-// src/commands/refine.ts
-import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
-import { chmodSync, existsSync as existsSync27, lstatSync as lstatSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname14, isAbsolute as isAbsolute5, join as join30, relative as relative4, resolve as resolvePath12, sep as sep4 } from "path";
+// src/commands/insight.ts
 import { createInterface as createInterface6 } from "readline/promises";
+import {
+  chmodSync as chmodSync3,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync22,
+  readSync as readSync3,
+  writeFileSync as writeFileSync8
+} from "fs";
+import { dirname as dirname13, isAbsolute as isAbsolute6, join as join32, relative as relative5, resolve as resolvePath10 } from "path";
 
-// src/refine/context.ts
-import { existsSync as existsSync26, realpathSync as realpathSync8, statSync as statSync12 } from "fs";
-import { isAbsolute as isAbsolute4, join as join29, relative as relative3, resolve as resolvePath11 } from "path";
+// src/insights/inventory.ts
+import { readFileSync as readFileSync19 } from "fs";
+import { join as join28 } from "path";
 
-// src/refine/models.ts
-import { randomBytes } from "crypto";
-var REFINEMENT_CATEGORIES = ["trigger", "content", "hook", "tool", "pattern", "config", "new"];
-var OVERRIDE_TYPES = ["patch", "extend", "config", "full", "hook", "script", "new"];
-var PATCH_ACTIONS = ["append", "prepend", "replace-section", "insert-after", "insert-before", "delete-section"];
-var PATTERN_STATUSES = ["tracking", "ready", "generalized", "dismissed"];
-function isRefinementCategory(value) {
-  return REFINEMENT_CATEGORIES.includes(value);
-}
-function isOverrideType(value) {
-  return OVERRIDE_TYPES.includes(value);
+// src/insights/models.ts
+import { createHash as createHash5 } from "crypto";
+var INSIGHT_SCHEMA_VERSION = 1;
+var MAX_EVIDENCE_EXCERPT_CHARS = 500;
+var SOURCE_TYPES = ["url", "file", "directory", "connector", "stdin"];
+var SOURCE_ACCESS_CLASSES = [
+  "public",
+  "user-owned",
+  "client-confidential",
+  "restricted",
+  "unknown"
+];
+var SOURCE_LICENSE_CLASSES = [
+  "public-domain",
+  "permissive",
+  "attribution-required",
+  "copyleft",
+  "proprietary",
+  "unknown"
+];
+var SOURCE_RETENTIONS = ["not-retained", "retained", "deleted"];
+var ANALYSIS_MODES = ["multi-agent", "separate-context", "single-context"];
+var INSIGHT_VALIDATIONS = [
+  "corroborated",
+  "contested",
+  "single-source",
+  "rejected",
+  "unverifiable"
+];
+var FORGE_VERBS2 = ["DEFER", "ABSORB", "FORK", "REJECT", "WATCH"];
+var INVENTORY_COVERAGE_VALUES = ["complete", "partial", "unavailable"];
+var STUDY_STATUSES = [
+  "collecting",
+  "analysis-submitted",
+  "review-ready",
+  "approved",
+  "jira-manifested",
+  "dismissed",
+  "archived"
+];
+function canonicalJson(value) {
+  const normalize = (input) => {
+    if (Array.isArray(input)) return input.map(normalize);
+    if (input !== null && typeof input === "object") {
+      return Object.fromEntries(
+        Object.entries(input).filter(([, child]) => child !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, normalize(child)])
+      );
+    }
+    return input;
+  };
+  return JSON.stringify(normalize(value));
+}
+function stableHash(value) {
+  return createHash5("sha256").update(canonicalJson(value)).digest("hex");
+}
+function stableId(prefix, value, length = 16) {
+  if (!/^[A-Z][A-Z0-9-]*$/.test(prefix)) {
+    throw new Error(`invalid stable id prefix: ${prefix}`);
+  }
+  if (!Number.isInteger(length) || length < 8 || length > 64) {
+    throw new Error(`stable id length must be an integer from 8 to 64`);
+  }
+  return `${prefix}-${stableHash(value).slice(0, length)}`;
+}
+function sourceIdFor(fingerprint) {
+  return stableId("SRC", fingerprint);
+}
+function sourceInventoryHashFor(sources) {
+  return stableHash(
+    sources.map((source) => ({
+      sourceId: source.sourceId,
+      type: source.type,
+      title: source.title,
+      privateLocator: source.privateLocator,
+      publicLocator: source.publicLocator,
+      author: source.author,
+      publisher: source.publisher,
+      publicationDate: source.publicationDate,
+      revisionDate: source.revisionDate,
+      revision: source.revision,
+      etag: source.etag,
+      contentSha256: source.contentSha256,
+      hashUnavailableReason: source.hashUnavailableReason,
+      fingerprint: source.fingerprint,
+      accessClass: source.accessClass,
+      licenseName: source.licenseName,
+      licenseClass: source.licenseClass,
+      byteLength: source.byteLength,
+      mediaType: source.mediaType,
+      includeHidden: source.includeHidden,
+      skippedContent: source.skippedContent,
+      suspiciousInstructionFlags: source.suspiciousInstructionFlags
+    })).sort((a, b) => a.sourceId < b.sourceId ? -1 : a.sourceId > b.sourceId ? 1 : 0)
+  );
 }
-function isPatchAction(value) {
-  return PATCH_ACTIONS.includes(value);
+function insightIdFor(domain, claim, sourceIds) {
+  return stableId("INS", { domain: domain.trim(), claim: claim.trim(), sourceIds: [...sourceIds].sort() });
 }
-function isPatternStatus(value) {
-  return PATTERN_STATUSES.includes(value);
+function domainPlanIdFor(domain, insightIds) {
+  return stableId("DOM", { domain: domain.trim(), insightIds: [...insightIds].sort() });
 }
-var REFINEMENT_STATUSES = ["pending", "applied", "generalized"];
-function isRefinementStatus(value) {
-  return REFINEMENT_STATUSES.includes(value);
+
+// src/insights/inventory.ts
+function compareStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
 }
-function patternCount(pattern) {
-  return new Set(pattern.occurrences.map((o) => o.projectRealpath)).size;
+function declaredMapCoverage(path, claim) {
+  if (!path) return "not-requested";
+  return claim ?? "unknown";
 }
-function defaultRandomHex() {
-  return randomBytes(2).toString("hex");
+function fingerprintInstalledSkill(path) {
+  try {
+    return { fingerprint: stableHash(readFileSync19(join28(path, "SKILL.md"), "utf-8")) };
+  } catch (error) {
+    return { reason: `could not fingerprint SKILL.md: ${error.message}` };
+  }
 }
-function formatYYYYMMDD(date) {
-  const yyyy = date.getUTCFullYear().toString().padStart(4, "0");
-  const mm = (date.getUTCMonth() + 1).toString().padStart(2, "0");
-  const dd = date.getUTCDate().toString().padStart(2, "0");
-  return `${yyyy}${mm}${dd}`;
+function installedEntries(config) {
+  const report = buildOrganizeReport(config);
+  const warnings = [...report.registry.warnings, ...report.notices];
+  const entries = report.registry.skills.map((skill) => {
+    const fingerprint = fingerprintInstalledSkill(skill.path);
+    if (fingerprint.reason) warnings.push(`${skill.name}: ${fingerprint.reason}`);
+    return {
+      capabilityId: skill.id,
+      name: skill.name,
+      source: "installed",
+      fingerprint: fingerprint.fingerprint,
+      fingerprintUnavailableReason: fingerprint.reason,
+      tier: skill.tier,
+      domain: skill.domain,
+      consumes: [...skill.consumes],
+      provenance: skill.provenance,
+      maturity: skill.maturity
+    };
+  });
+  return { entries, warnings, rootCount: report.registry.skillsRoots.length };
 }
-function generateRefinementId(existingIds = /* @__PURE__ */ new Set(), now = /* @__PURE__ */ new Date(), randomHex = defaultRandomHex) {
-  const datePart = formatYYYYMMDD(now);
-  let id;
-  do {
-    id = `REF-${datePart}-${randomHex()}`;
-  } while (existingIds.has(id));
-  return id;
+function skillMapEntries(map) {
+  return map.nodes.filter((node) => node.type === "skill").map((node) => {
+    const validFingerprint = typeof node.contentHash === "string" && /^[0-9a-f]{64}$/.test(node.contentHash);
+    return {
+      capabilityId: node.id,
+      name: node.name ?? node.id,
+      source: "skill-map",
+      fingerprint: validFingerprint ? node.contentHash : void 0,
+      fingerprintUnavailableReason: validFingerprint ? void 0 : "skill-map node has no valid contentHash",
+      consumes: [],
+      description: node.description
+    };
+  });
 }
-function generatePatternId(existingIds = /* @__PURE__ */ new Set(), randomHex = defaultRandomHex) {
-  let id;
-  do {
-    id = `PAT-${randomHex()}`;
-  } while (existingIds.has(id));
-  return id;
+function candidateFor(match, proposal, byId) {
+  const entry = byId.get(match.skillId);
+  const extended = (proposal.extendsCapabilityIds ?? []).some((id) => id === match.skillId || id === match.name);
+  return {
+    capabilityId: match.skillId,
+    label: match.name,
+    fingerprint: entry?.fingerprint,
+    lexicalScore: match.score,
+    relationship: extended ? "extension" : "ambiguous",
+    semanticReviewRequired: true
+  };
 }
-function fingerprintKey(skill, target, overrideType, action) {
-  const normalize = (s) => s.trim().toLowerCase().replace(/\s+/g, " ");
-  return [normalize(skill), normalize(target), overrideType, action ?? ""].join("::");
+function mapProposals(proposals, capabilities, map, coverage) {
+  const byId = new Map(capabilities.map((entry) => [entry.capabilityId, entry]));
+  const installed = capabilities.filter((entry) => entry.source === "installed");
+  return proposals.map((proposal) => {
+    const exact = installed.filter((entry) => entry.name === proposal.label);
+    const overlap = map ? scanMapOverlap({ name: proposal.label, description: proposal.description }, map) : { matches: [], compared: 0, topMatch: void 0 };
+    const candidates = exact.map((entry) => ({
+      capabilityId: entry.capabilityId,
+      label: entry.name,
+      fingerprint: entry.fingerprint,
+      relationship: (proposal.extendsCapabilityIds ?? []).includes(entry.capabilityId) ? "extension" : "existing",
+      semanticReviewRequired: true
+    }));
+    const seen = new Set(candidates.map((candidate) => candidate.capabilityId));
+    for (const match of overlap.matches) {
+      if (!seen.has(match.skillId)) candidates.push(candidateFor(match, proposal, byId));
+    }
+    if (candidates.length === 0) {
+      candidates.push({
+        label: proposal.label,
+        relationship: coverage === "complete" ? "gap" : "ambiguous",
+        semanticReviewRequired: true
+      });
+    }
+    return {
+      proposalId: proposal.proposalId,
+      candidates,
+      installedExactMatches: exact.map((entry) => entry.capabilityId),
+      mapCompared: overlap.compared,
+      mapTopMatch: overlap.topMatch,
+      duplicateCapabilityBlocked: candidates.some(
+        (candidate) => candidate.relationship === "existing" || candidate.relationship === "ambiguous"
+      ),
+      semanticReviewRequired: true
+    };
+  });
 }
-function contentSimilarity(a, b) {
-  const tokenize3 = (s) => new Set(s.toLowerCase().split(/\s+/).filter(Boolean));
-  const tokensA = tokenize3(a);
-  const tokensB = tokenize3(b);
-  if (tokensA.size === 0 || tokensB.size === 0) return 0;
-  let intersectionSize = 0;
-  for (const token of tokensA) {
-    if (tokensB.has(token)) intersectionSize++;
+function buildInsightInventory(config, options = {}) {
+  if (options.skillMapCoverage !== void 0 && options.skillMapPath === void 0) {
+    throw new UserError(`skill-map coverage requires a skill-map path`);
   }
-  const unionSize3 = tokensA.size + tokensB.size - intersectionSize;
-  return unionSize3 === 0 ? 0 : intersectionSize / unionSize3;
+  const installed = installedEntries(config);
+  let map;
+  let mapEntries = [];
+  const warnings = [...installed.warnings];
+  if (options.skillMapPath) {
+    map = loadSkillMap(options.skillMapPath);
+    mapEntries = skillMapEntries(map);
+    const installedIds = new Set(installed.entries.map((entry) => entry.capabilityId));
+    if (mapEntries.some((entry) => installedIds.has(entry.capabilityId))) {
+      throw new UserError(`skill-map capability id collides with installed capability identity`);
+    }
+    for (const entry of mapEntries) {
+      if (entry.fingerprintUnavailableReason) warnings.push(`${entry.name}: ${entry.fingerprintUnavailableReason}`);
+    }
+  }
+  const capabilities = [...installed.entries, ...mapEntries].sort(
+    (a, b) => compareStrings(`${a.source}:${a.capabilityId}`, `${b.source}:${b.capabilityId}`)
+  );
+  const missingFingerprints = capabilities.filter((entry) => !entry.fingerprint).length;
+  const mapCoverage = declaredMapCoverage(options.skillMapPath, options.skillMapCoverage);
+  const coverage = mapCoverage === "resolved" && missingFingerprints === 0 ? "complete" : "partial";
+  const coverageReason = mapCoverage === "not-requested" ? "no resolved skill map was supplied; installed roots were inventoried only" : mapCoverage !== "resolved" ? `${mapCoverage} skill-map coverage cannot prove ecosystem-wide deduplication` : missingFingerprints > 0 ? `${missingFingerprints} capability fingerprint(s) were unavailable` : void 0;
+  const mappings = mapProposals(options.proposals ?? [], capabilities, map, coverage);
+  const capabilityInventoryHash = stableHash({
+    coverage,
+    coverageReason,
+    installedRootCount: installed.rootCount,
+    mapCoverage,
+    capabilities: capabilities.map((entry) => ({
+      capabilityId: entry.capabilityId,
+      name: entry.name,
+      source: entry.source,
+      fingerprint: entry.fingerprint,
+      tier: entry.tier,
+      domain: entry.domain,
+      consumes: entry.consumes,
+      provenance: entry.provenance,
+      maturity: entry.maturity,
+      description: entry.description
+    }))
+  });
+  return {
+    generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    coverage,
+    coverageReason,
+    installedRootCount: installed.rootCount,
+    installedCapabilityCount: installed.entries.length,
+    mapCoverage,
+    mapCapabilityCount: mapEntries.length,
+    capabilities,
+    mappings,
+    warnings,
+    capabilityInventoryHash
+  };
 }
 
-// src/refine/store.ts
-import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync19, statSync as statSync11, realpathSync as realpathSync7 } from "fs";
-import { join as join28, resolve as resolvePath10 } from "path";
-var SIMILARITY_JOIN_THRESHOLD = 0.7;
-var READY_THRESHOLD = 2;
-function getRefinementsDir() {
-  return join28(getHomeDir(), "refinements");
-}
-function getRefinementsPath() {
-  return join28(getRefinementsDir(), "refinements.json");
+// src/insights/jira.ts
+import { existsSync as existsSync26, readFileSync as readFileSync21 } from "fs";
+import { join as join31 } from "path";
+
+// src/insights/store.ts
+import { chmodSync as chmodSync2, existsSync as existsSync25, mkdirSync as mkdirSync8, readFileSync as readFileSync20 } from "fs";
+import { join as join30 } from "path";
+
+// src/insights/sources.ts
+import { createHash as createHash6 } from "crypto";
+import {
+  closeSync as closeSync3,
+  constants as constants2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync5,
+  openSync as openSync3,
+  readSync as readSync2,
+  readdirSync as readdirSync9,
+  realpathSync as realpathSync7,
+  statSync as statSync11
+} from "fs";
+import { basename as basename12, extname as extname6, isAbsolute as isAbsolute5, join as join29, relative as relative4, resolve as resolve8, sep as sep5 } from "path";
+var DEFAULT_MAX_SOURCE_FILE_BYTES = 5 * 1024 * 1024;
+var DEFAULT_MAX_SOURCE_TOTAL_BYTES = 25 * 1024 * 1024;
+var SKIP_DIRS4 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "coverage", ".next", "out", "__pycache__", ".venv", "venv"]);
+var CREDENTIAL_NAME = /(?:^|[._-])(\.env|credentials?|secrets?|tokens?|api[._-]?keys?|id_rsa|id_ed25519)(?:$|[._-])/i;
+var CREDENTIAL_QUERY_KEY = /(?:^|[._-])(?:auth(?:orization)?|token|secret|password|credential|api[._-]?key|sig(?:nature)?)(?:$|[._-])/i;
+var CLOUD_SIGNED_QUERY_KEY = /^(?:(?:x-amz|x-goog)-(?:algorithm|credential|date|expires|security-token|signature|signedheaders)|awsaccesskeyid|googleaccessid|key[-_]pair[-_]id|signed(?:[-_]url)?)$/i;
+var COMPACT_CREDENTIAL_QUERY_KEYS = /* @__PURE__ */ new Set([
+  "apikey",
+  "auth",
+  "authorization",
+  "authtoken",
+  "bearertoken",
+  "clientsecret",
+  "credential",
+  "credentials",
+  "idtoken",
+  "password",
+  "refreshtoken",
+  "secret",
+  "securitytoken",
+  "sig",
+  "signature",
+  "signedurl",
+  "token",
+  "accesstoken"
+]);
+var SUPPORTED_MEDIA_BY_EXTENSION = {
+  ".md": "text/markdown",
+  ".markdown": "text/markdown",
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".pdf": "application/pdf"
+};
+function ensurePositiveLimit(value, label2) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new UserError(`${label2} must be a positive integer number of bytes`);
+  }
+  return value;
 }
-function getPatternsPath() {
-  return join28(getRefinementsDir(), "patterns.json");
+function validateObservedMetadata(sha2562, byteLength) {
+  if (sha2562 !== void 0 && !/^[0-9a-f]{64}$/.test(sha2562)) {
+    throw new UserError(`observedSha256 must be a lowercase SHA-256 digest`);
+  }
+  if (byteLength !== void 0 && (!Number.isSafeInteger(byteLength) || byteLength < 0)) {
+    throw new UserError(`observedByteLength must be a non-negative integer number of bytes`);
+  }
 }
-function getBackupsDir() {
-  return join28(getRefinementsDir(), "backups");
+function compareStrings2(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
 }
-function readJsonFile(path, label) {
-  let raw;
+function canonicalPublicUrl(raw, label2) {
+  let url;
   try {
-    raw = readFileSync19(path, "utf-8");
-  } catch (err) {
-    throw new UserError(`unable to read ${label} at ${path}: ${err.message}`);
+    url = new URL(raw);
+  } catch {
+    throw new UserError(`invalid ${label2}: ${raw}`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new UserError(`${label2} must use http or https: ${raw}`);
+  }
+  if (url.username || url.password || [...url.searchParams.keys()].some(
+    (key) => CREDENTIAL_QUERY_KEY.test(key) || CLOUD_SIGNED_QUERY_KEY.test(key) || COMPACT_CREDENTIAL_QUERY_KEYS.has(key.toLowerCase())
+  )) {
+    throw new UserError(`${label2} must not contain credentials: ${raw}`);
+  }
+  url.hash = "";
+  return url.toString();
+}
+function isInside2(child, root) {
+  const rel = relative4(root, child);
+  return rel === "" || !rel.startsWith(`..${sep5}`) && rel !== ".." && !isAbsolute5(rel);
+}
+function isHiddenName(name) {
+  return name.startsWith(".") && name !== "." && name !== "..";
+}
+function hasCredentialShapedName(name) {
+  return name === ".env" || name.startsWith(".env.") || CREDENTIAL_NAME.test(name);
+}
+function mediaTypeFor(path, declared) {
+  return declared ?? SUPPORTED_MEDIA_BY_EXTENSION[extname6(path).toLowerCase()];
+}
+function suspiciousInstructionFlags(bytes, mediaType) {
+  if (!mediaType.startsWith("text/")) return [];
+  const sample = bytes.subarray(0, 64 * 1024).toString("utf-8");
+  const flags = [];
+  if (/ignore\s+(?:all\s+)?previous\s+instructions/i.test(sample)) flags.push("instruction-override-language");
+  if (/(?:reveal|print|exfiltrate).{0,40}(?:system prompt|credential|secret|token)/i.test(sample)) flags.push("data-exfiltration-language");
+  if (/(?:run|execute)\s+(?:this\s+)?(?:command|script)/i.test(sample)) flags.push("execution-request-language");
+  return flags;
+}
+function observeFile(path, relativePath, declaredMediaType, maxFileBytes, remainingBytes) {
+  const name = basename12(path);
+  if (hasCredentialShapedName(name)) {
+    return { path: relativePath, reason: "credential-shaped-name" };
+  }
+  const mediaType = mediaTypeFor(path, declaredMediaType);
+  if (!mediaType) return { path: relativePath, reason: "unsupported-media-type" };
+  const noFollow = typeof constants2.O_NOFOLLOW === "number" ? constants2.O_NOFOLLOW : 0;
+  let descriptor;
+  let bytes;
+  let descriptorStat;
+  try {
+    descriptor = openSync3(path, constants2.O_RDONLY | noFollow);
+    descriptorStat = fstatSync2(descriptor);
+    if (!descriptorStat.isFile()) return { path: relativePath, reason: "unsupported-media-type" };
+    if (descriptorStat.size > maxFileBytes) {
+      return { path: relativePath, reason: "file-too-large", byteLength: descriptorStat.size };
+    }
+    if (descriptorStat.size > remainingBytes) {
+      return { path: relativePath, reason: "total-byte-limit", byteLength: descriptorStat.size };
+    }
+    const limit = Math.min(maxFileBytes, remainingBytes);
+    const chunks = [];
+    let total = 0;
+    while (true) {
+      const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, limit - total + 1));
+      const count = readSync2(descriptor, chunk, 0, chunk.byteLength, null);
+      if (count === 0) break;
+      total += count;
+      if (total > limit) {
+        const reason = maxFileBytes <= remainingBytes ? "file-too-large" : "total-byte-limit";
+        return { path: relativePath, reason, byteLength: total };
+      }
+      chunks.push(chunk.subarray(0, count));
+    }
+    bytes = Buffer.concat(chunks, total);
+  } catch (error) {
+    throw new UserError(`unable to read source file ${relativePath}: ${error.message}`);
+  } finally {
+    if (descriptor !== void 0) closeSync3(descriptor);
   }
+  if (!bytes || !descriptorStat) throw new UserError(`source file could not be observed: ${relativePath}`);
+  let realPath;
   try {
-    return JSON.parse(raw);
+    realPath = realpathSync7(path);
+    const pathStat = statSync11(realPath);
+    if (pathStat.dev !== descriptorStat.dev || pathStat.ino !== descriptorStat.ino) {
+      throw new Error("path identity changed");
+    }
   } catch {
-    throw new UserError(`malformed ${label} at ${path}: not valid JSON`);
-  }
-}
-function readStore(path, label, validateRecord) {
-  if (!existsSync25(path)) {
-    return { schemaVersion: 1, records: [] };
-  }
-  const parsed = readJsonFile(path, label);
-  if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.records)) {
-    throw new UserError(`malformed ${label} at ${path}: expected an object with a "records" array`);
-  }
-  const records = parsed.records;
-  if (validateRecord) {
-    records.forEach((record, index) => validateRecord(record, index));
-  }
-  return { schemaVersion: 1, records };
-}
-function validateRefinementRecordShape(record, index, path) {
-  if (typeof record !== "object" || record === null) {
-    throw new UserError(`malformed refinements.json at ${path}: record[${index}] is not an object`);
-  }
-  const r = record;
-  if (typeof r.id !== "string" || r.id.length === 0) {
-    throw new UserError(`malformed refinements.json at ${path}: record[${index}] is missing a valid "id"`);
-  }
-  if (typeof r.createdAt !== "string" || r.createdAt.length === 0) {
-    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "createdAt"`);
-  }
-  if (typeof r.status !== "string" || r.status.length === 0) {
-    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "status"`);
+    throw new UserError(`source file changed while it was being observed: ${relativePath}`);
   }
-  if (typeof r.skill !== "string" || r.skill.length === 0) {
-    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "skill"`);
-  }
-  const patchActionsRequiringMarker = /* @__PURE__ */ new Set(["insert-after", "insert-before", "replace-section", "delete-section"]);
-  if (r.overrideType === "patch") {
-    if (typeof r.patchAction !== "string" || r.patchAction.length === 0) {
-      throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" has overrideType "patch" but is missing "patchAction"`);
-    }
-    if (patchActionsRequiringMarker.has(r.patchAction) && (typeof r.patchMarker !== "string" || r.patchMarker.length === 0)) {
-      throw new UserError(
-        `malformed refinements.json at ${path}: record "${r.id}" has patchAction "${r.patchAction}" but is missing "patchMarker"`
-      );
-    }
-    if (typeof r.patchContent !== "string" || r.patchContent.length === 0) {
-      throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" has overrideType "patch" but is missing "patchContent"`);
-    }
-  } else if (r.patchAction !== void 0) {
-    throw new UserError(
-      `malformed refinements.json at ${path}: record "${r.id}" has overrideType "${String(r.overrideType)}" but carries "patchAction" \u2014 only valid when overrideType is "patch"`
-    );
+  if (mediaType !== "application/pdf" && bytes.subarray(0, 512).includes(0)) {
+    return { path: relativePath, reason: "binary", byteLength: bytes.byteLength };
   }
+  return {
+    realPath,
+    relativePath,
+    byteLength: bytes.byteLength,
+    sha256: createHash6("sha256").update(bytes).digest("hex"),
+    mediaType,
+    suspiciousInstructionFlags: suspiciousInstructionFlags(bytes, mediaType),
+    bytes
+  };
 }
-function validatePatternRecordShape(record, index, path) {
-  if (typeof record !== "object" || record === null) {
-    throw new UserError(`malformed patterns.json at ${path}: record[${index}] is not an object`);
-  }
-  const p = record;
-  if (typeof p.id !== "string" || p.id.length === 0) {
-    throw new UserError(`malformed patterns.json at ${path}: record[${index}] is missing a valid "id"`);
-  }
-  if (typeof p.status !== "string" || p.status.length === 0) {
-    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" is missing a valid "status"`);
-  }
-  if (!Array.isArray(p.occurrences)) {
-    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" is missing a valid "occurrences" array`);
-  }
-  if (p.status === "dismissed" && (typeof p.dismissedReason !== "string" || p.dismissedReason.length === 0)) {
-    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "dismissed" but is missing "dismissedReason"`);
-  }
-  if (p.status === "generalized") {
-    if (typeof p.generalizedAt !== "string" || p.generalizedAt.length === 0) {
-      throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "generalized" but is missing "generalizedAt"`);
-    }
-    if (typeof p.generalizedBackupId !== "string" || p.generalizedBackupId.length === 0) {
-      throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "generalized" but is missing "generalizedBackupId"`);
-    }
-  }
+function normalizedCommon(input, retrievedAt) {
+  return {
+    title: input.title?.trim() ?? "",
+    accessClass: input.accessClass ?? "unknown",
+    licenseName: input.licenseName,
+    licenseClass: input.licenseClass ?? "unknown",
+    author: input.author,
+    publisher: input.publisher,
+    publicationDate: input.publicationDate,
+    revisionDate: input.revisionDate,
+    retrievedAt,
+    revision: input.revision,
+    etag: input.etag
+  };
 }
-function readRefinementsStore() {
-  const path = getRefinementsPath();
-  return readStore(path, "refinements.json", (record, index) => validateRefinementRecordShape(record, index, path));
+function normalizeUrl(input, retrievedAt) {
+  validateObservedMetadata(input.observedSha256, input.observedByteLength);
+  const canonicalUrl = canonicalPublicUrl(input.url, "source URL");
+  const fingerprint = stableHash({
+    type: input.type,
+    canonicalUrl,
+    revision: input.revision,
+    etag: input.etag,
+    observedSha256: input.observedSha256
+  });
+  const common = normalizedCommon(input, retrievedAt);
+  return {
+    ...common,
+    title: common.title || canonicalUrl,
+    sourceId: sourceIdFor(fingerprint),
+    type: "url",
+    privateLocator: canonicalUrl,
+    publicLocator: common.accessClass === "public" ? canonicalUrl : void 0,
+    contentSha256: input.observedSha256,
+    hashUnavailableReason: input.observedSha256 ? void 0 : "not fetched by skill-forge",
+    fingerprint,
+    retention: "not-retained",
+    byteLength: input.observedByteLength,
+    mediaType: input.mediaType,
+    skippedContent: [],
+    suspiciousInstructionFlags: []
+  };
 }
-function writeRefinementsStore(store) {
-  writeJsonAtomic(getRefinementsPath(), store);
+function normalizeConnector(input, retrievedAt) {
+  validateObservedMetadata(input.observedSha256, input.observedByteLength);
+  const provider = input.provider.trim();
+  const opaqueId = input.opaqueId.trim();
+  if (!provider || !opaqueId) throw new UserError(`connector sources require a provider and opaque id`);
+  const fingerprint = stableHash({
+    type: input.type,
+    provider,
+    opaqueId,
+    revision: input.revision,
+    observedSha256: input.observedSha256
+  });
+  const common = normalizedCommon(input, retrievedAt);
+  const publicLocator = input.publicLocator ? canonicalPublicUrl(input.publicLocator, "connector public locator") : void 0;
+  return {
+    ...common,
+    title: common.title || `${provider} source`,
+    sourceId: sourceIdFor(fingerprint),
+    type: "connector",
+    privateLocator: `${provider}:${opaqueId}`,
+    publicLocator: common.accessClass === "public" ? publicLocator : void 0,
+    contentSha256: input.observedSha256,
+    hashUnavailableReason: input.observedSha256 ? void 0 : "content is available only through the configured connector",
+    fingerprint,
+    retention: "not-retained",
+    byteLength: input.observedByteLength,
+    mediaType: input.mediaType,
+    skippedContent: [],
+    suspiciousInstructionFlags: []
+  };
+}
+function normalizeStdin(input, retrievedAt, maxFileBytes, remainingBytes) {
+  const bytes = Buffer.from(input.content);
+  if (bytes.byteLength > maxFileBytes) throw new UserError(`stdin source exceeds the per-source byte limit (${maxFileBytes})`);
+  if (bytes.byteLength > remainingBytes) throw new UserError(`stdin source exceeds the total source byte limit`);
+  const contentSha256 = createHash6("sha256").update(bytes).digest("hex");
+  const mediaType = input.mediaType ?? "text/plain";
+  const fingerprint = stableHash({ type: input.type, contentSha256, mediaType });
+  const common = normalizedCommon(input, retrievedAt);
+  return {
+    receipt: {
+      ...common,
+      title: common.title || "stdin source",
+      sourceId: sourceIdFor(fingerprint),
+      type: "stdin",
+      privateLocator: "stdin",
+      contentSha256,
+      fingerprint,
+      retention: "not-retained",
+      byteLength: bytes.byteLength,
+      mediaType,
+      skippedContent: [],
+      suspiciousInstructionFlags: suspiciousInstructionFlags(bytes, mediaType)
+    },
+    consumedBytes: bytes.byteLength
+  };
+}
+function normalizeFile(input, retrievedAt, maxFileBytes, remainingBytes) {
+  const resolved = resolve8(input.path);
+  let lexicalStat;
+  try {
+    lexicalStat = lstatSync5(resolved);
+  } catch (err) {
+    throw new UserError(`unable to read source file ${resolved}: ${err.message}`);
+  }
+  if (lexicalStat.isSymbolicLink()) throw new UserError(`source file must not be a symlink: ${resolved}`);
+  if (!lexicalStat.isFile()) throw new UserError(`source file is not a regular file: ${resolved}`);
+  if (hasCredentialShapedName(basename12(resolved))) throw new UserError(`refusing credential-shaped source file: ${resolved}`);
+  const observed = observeFile(resolved, basename12(resolved), input.mediaType, maxFileBytes, remainingBytes);
+  if (!("realPath" in observed)) {
+    throw new UserError(`source file ${resolved} was rejected: ${observed.reason}`);
+  }
+  const fingerprint = stableHash({
+    type: input.type,
+    path: observed.realPath,
+    sha256: observed.sha256,
+    mediaType: observed.mediaType
+  });
+  const sourceId = sourceIdFor(fingerprint);
+  const common = normalizedCommon(input, retrievedAt);
+  const receipt = {
+    ...common,
+    title: common.title || basename12(observed.realPath),
+    sourceId,
+    type: "file",
+    privateLocator: observed.realPath,
+    contentSha256: observed.sha256,
+    fingerprint,
+    retention: "not-retained",
+    byteLength: observed.byteLength,
+    mediaType: observed.mediaType,
+    skippedContent: [],
+    suspiciousInstructionFlags: observed.suspiciousInstructionFlags
+  };
+  return {
+    receipt,
+    observedFiles: [{
+      sourceId,
+      path: observed.realPath,
+      relativePath: observed.relativePath,
+      byteLength: observed.byteLength,
+      sha256: observed.sha256,
+      mediaType: observed.mediaType,
+      bytes: observed.bytes
+    }],
+    consumedBytes: observed.byteLength
+  };
+}
+function normalizeDirectory(input, retrievedAt, maxFileBytes, remainingBytes) {
+  const resolved = resolve8(input.path);
+  let lexicalStat;
+  try {
+    lexicalStat = lstatSync5(resolved);
+  } catch (err) {
+    throw new UserError(`unable to read source directory ${resolved}: ${err.message}`);
+  }
+  if (lexicalStat.isSymbolicLink()) throw new UserError(`source directory must not be a symlink: ${resolved}`);
+  if (!lexicalStat.isDirectory()) throw new UserError(`source directory is not a directory: ${resolved}`);
+  const realRoot = realpathSync7(resolved);
+  const observations = [];
+  const skipped = [];
+  const seenFiles = /* @__PURE__ */ new Set();
+  const seenDirs = /* @__PURE__ */ new Set([realRoot]);
+  let consumedBytes = 0;
+  const walk2 = (dir, logicalDir) => {
+    let entries;
+    try {
+      entries = readdirSync9(dir, { withFileTypes: true }).sort((a, b) => compareStrings2(a.name, b.name));
+    } catch (err) {
+      throw new UserError(`unable to enumerate source directory ${dir}: ${err.message}`);
+    }
+    for (const entry of entries) {
+      const full = join29(dir, entry.name);
+      const logicalPath = logicalDir ? `${logicalDir}/${entry.name}` : entry.name;
+      if (entry.isDirectory() && SKIP_DIRS4.has(entry.name)) {
+        skipped.push({ path: logicalPath, reason: "ignored-directory" });
+        continue;
+      }
+      if (!input.includeHidden && isHiddenName(entry.name)) {
+        skipped.push({ path: logicalPath, reason: "hidden" });
+        continue;
+      }
+      if (hasCredentialShapedName(entry.name)) {
+        skipped.push({ path: logicalPath, reason: "credential-shaped-name" });
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        let realTarget;
+        try {
+          realTarget = realpathSync7(full);
+        } catch {
+          throw new UserError(`source directory contains an unreadable symlink: ${logicalPath}`);
+        }
+        if (!isInside2(realTarget, realRoot)) {
+          throw new UserError(`source directory symlink escapes its root: ${logicalPath}`);
+        }
+        const targetStat = statSync11(realTarget);
+        if (targetStat.isDirectory()) {
+          if (seenDirs.has(realTarget)) continue;
+          seenDirs.add(realTarget);
+          walk2(realTarget, logicalPath);
+          continue;
+        }
+        if (!targetStat.isFile()) {
+          skipped.push({ path: logicalPath, reason: "unsupported-media-type" });
+          continue;
+        }
+      } else if (entry.isDirectory()) {
+        const realDir = realpathSync7(full);
+        if (seenDirs.has(realDir)) continue;
+        seenDirs.add(realDir);
+        walk2(full, logicalPath);
+        continue;
+      } else if (!entry.isFile()) {
+        skipped.push({ path: logicalPath, reason: "unsupported-media-type" });
+        continue;
+      }
+      const realFile = realpathSync7(full);
+      if (!isInside2(realFile, realRoot)) {
+        throw new UserError(`source directory entry escaped its root while being observed: ${logicalPath}`);
+      }
+      if (seenFiles.has(realFile)) {
+        skipped.push({ path: logicalPath, reason: "duplicate-realpath" });
+        continue;
+      }
+      seenFiles.add(realFile);
+      const observed = observeFile(realFile, logicalPath, void 0, maxFileBytes, remainingBytes - consumedBytes);
+      if (!("realPath" in observed)) {
+        skipped.push(observed);
+        continue;
+      }
+      observations.push(observed);
+      consumedBytes += observed.byteLength;
+    }
+  };
+  walk2(realRoot, "");
+  observations.sort((a, b) => compareStrings2(a.relativePath, b.relativePath));
+  skipped.sort((a, b) => compareStrings2(a.path, b.path) || compareStrings2(a.reason, b.reason));
+  const contentSha256 = createHash6("sha256");
+  for (const file of observations) contentSha256.update(`${file.relativePath}\0${file.sha256}
+`);
+  const aggregateHash = contentSha256.digest("hex");
+  const fingerprint = stableHash({
+    type: input.type,
+    path: realRoot,
+    files: observations.map(({ relativePath, sha256: sha2562, byteLength, mediaType }) => ({ relativePath, sha256: sha2562, byteLength, mediaType }))
+  });
+  const sourceId = sourceIdFor(fingerprint);
+  const common = normalizedCommon(input, retrievedAt);
+  const receipt = {
+    ...common,
+    title: common.title || basename12(realRoot),
+    sourceId,
+    type: "directory",
+    privateLocator: realRoot,
+    contentSha256: aggregateHash,
+    fingerprint,
+    retention: "not-retained",
+    byteLength: consumedBytes,
+    mediaType: input.mediaType ?? "application/x-directory",
+    includeHidden: input.includeHidden === true,
+    skippedContent: skipped,
+    suspiciousInstructionFlags: [...new Set(observations.flatMap((file) => file.suspiciousInstructionFlags))].sort()
+  };
+  return {
+    receipt,
+    observedFiles: observations.map((file) => ({
+      sourceId,
+      path: file.realPath,
+      relativePath: file.relativePath,
+      byteLength: file.byteLength,
+      sha256: file.sha256,
+      mediaType: file.mediaType,
+      bytes: file.bytes
+    })),
+    consumedBytes
+  };
+}
+function normalizeSources(inputs, options = {}) {
+  if (inputs.length === 0) throw new UserError(`at least one source is required`);
+  const maxFileBytes = ensurePositiveLimit(options.maxFileBytes ?? DEFAULT_MAX_SOURCE_FILE_BYTES, "maxFileBytes");
+  const maxTotalBytes = ensurePositiveLimit(options.maxTotalBytes ?? DEFAULT_MAX_SOURCE_TOTAL_BYTES, "maxTotalBytes");
+  const retrievedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const sources = [];
+  const observedFiles = [];
+  let totalBytes = 0;
+  for (const input of inputs) {
+    const remainingBytes = maxTotalBytes - totalBytes;
+    if (remainingBytes <= 0) throw new UserError(`total source byte limit exceeded (${maxTotalBytes})`);
+    if (input.type === "url") {
+      sources.push(normalizeUrl(input, retrievedAt));
+    } else if (input.type === "connector") {
+      sources.push(normalizeConnector(input, retrievedAt));
+    } else if (input.type === "stdin") {
+      const normalized = normalizeStdin(input, retrievedAt, maxFileBytes, remainingBytes);
+      sources.push(normalized.receipt);
+      totalBytes += normalized.consumedBytes;
+    } else if (input.type === "file") {
+      const normalized = normalizeFile(input, retrievedAt, maxFileBytes, remainingBytes);
+      sources.push(normalized.receipt);
+      observedFiles.push(...normalized.observedFiles);
+      totalBytes += normalized.consumedBytes;
+    } else {
+      const normalized = normalizeDirectory(input, retrievedAt, maxFileBytes, remainingBytes);
+      sources.push(normalized.receipt);
+      observedFiles.push(...normalized.observedFiles);
+      totalBytes += normalized.consumedBytes;
+    }
+  }
+  const distinctSources = [...new Map(sources.map((source) => [source.sourceId, source])).values()];
+  const distinctObservedFiles = [
+    ...new Map(observedFiles.map((file) => [`${file.sourceId}\0${file.path}`, file])).values()
+  ];
+  return {
+    sources: distinctSources,
+    sourceInventoryHash: sourceInventoryHashFor(distinctSources),
+    observedFiles: distinctObservedFiles,
+    totalBytes
+  };
+}
+
+// src/insights/store.ts
+var STUDY_ID = /^STUDY-[0-9a-f]{16}$/;
+function getInsightsDir() {
+  return join30(getHomeDir(), "insights");
+}
+function getStudyDir(studyId) {
+  assertStudyId(studyId);
+  return join30(getInsightsDir(), studyId);
+}
+function getStudyPath(studyId) {
+  return join30(getStudyDir(studyId), "study.json");
+}
+function getStudyEventsPath(studyId) {
+  return join30(getStudyDir(studyId), "events.jsonl");
+}
+function createStudyId(sourceInventoryHash, createdAt) {
+  return stableId("STUDY", { sourceInventoryHash, createdAt });
+}
+function assertStudyId(studyId) {
+  if (!STUDY_ID.test(studyId)) throw new UserError(`invalid insight study id: ${studyId}`);
+}
+function ensurePrivateDir(path) {
+  mkdirSync8(path, { recursive: true, mode: 448 });
+  chmodSync2(path, 448);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function assertIsoDate(value, label2, path) {
+  if (!isNonEmptyString(value) || Number.isNaN(Date.parse(value))) {
+    throw new UserError(`malformed insight study at ${path}: ${label2} must be an ISO-8601 timestamp`);
+  }
+}
+function validateSourceReceipt(value, index, path) {
+  if (!isRecord2(value)) throw new UserError(`malformed insight study at ${path}: sources[${index}] is not an object`);
+  if (!isNonEmptyString(value.sourceId) || !value.sourceId.startsWith("SRC-")) {
+    throw new UserError(`malformed insight study at ${path}: sources[${index}] has an invalid sourceId`);
+  }
+  if (!SOURCE_TYPES.includes(value.type)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid type`);
+  }
+  if (!isNonEmptyString(value.title) || !isNonEmptyString(value.privateLocator) || !isNonEmptyString(value.fingerprint)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} is missing required identity fields`);
+  }
+  if (value.publicLocator !== void 0) {
+    if (!isNonEmptyString(value.publicLocator)) {
+      throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid publicLocator`);
+    }
+    try {
+      if (canonicalPublicUrl(value.publicLocator, "source public locator") !== value.publicLocator) {
+        throw new Error("not canonical");
+      }
+    } catch {
+      throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid publicLocator`);
+    }
+  }
+  if (value.type === "directory") {
+    if (typeof value.includeHidden !== "boolean") {
+      throw new UserError(`malformed insight study at ${path}: directory source ${value.sourceId} is missing includeHidden`);
+    }
+  } else if (value.includeHidden !== void 0) {
+    throw new UserError(`malformed insight study at ${path}: non-directory source ${value.sourceId} has includeHidden`);
+  }
+  assertIsoDate(value.retrievedAt, `source ${value.sourceId}.retrievedAt`, path);
+  if (!SOURCE_ACCESS_CLASSES.includes(value.accessClass)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid accessClass`);
+  }
+  if (!SOURCE_LICENSE_CLASSES.includes(value.licenseClass)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid licenseClass`);
+  }
+  if (!SOURCE_RETENTIONS.includes(value.retention)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has an invalid retention value`);
+  }
+  const hasHash = isNonEmptyString(value.contentSha256);
+  const hasUnavailableReason = isNonEmptyString(value.hashUnavailableReason);
+  if (hasHash === hasUnavailableReason) {
+    throw new UserError(
+      `malformed insight study at ${path}: source ${value.sourceId} must have exactly one of contentSha256 or hashUnavailableReason`
+    );
+  }
+  if (!Array.isArray(value.skippedContent) || !isStringArray(value.suspiciousInstructionFlags)) {
+    throw new UserError(`malformed insight study at ${path}: source ${value.sourceId} has invalid evidence arrays`);
+  }
+}
+function validateStudyShape(value, path) {
+  if (!isRecord2(value)) throw new UserError(`malformed insight study at ${path}: expected an object`);
+  if (value.schemaVersion !== INSIGHT_SCHEMA_VERSION) {
+    throw new UserError(`malformed insight study at ${path}: unsupported schemaVersion ${String(value.schemaVersion)}`);
+  }
+  if (!isNonEmptyString(value.studyId) || !STUDY_ID.test(value.studyId)) {
+    throw new UserError(`malformed insight study at ${path}: invalid studyId`);
+  }
+  if (!STUDY_STATUSES.includes(value.status)) {
+    throw new UserError(`malformed insight study at ${path}: invalid status ${String(value.status)}`);
+  }
+  assertIsoDate(value.createdAt, "createdAt", path);
+  assertIsoDate(value.updatedAt, "updatedAt", path);
+  if (value.requestedAnalysisMode !== "independent" && value.requestedAnalysisMode !== "single") {
+    throw new UserError(`malformed insight study at ${path}: invalid requestedAnalysisMode`);
+  }
+  if (!Array.isArray(value.sources)) throw new UserError(`malformed insight study at ${path}: sources must be an array`);
+  value.sources.forEach((source, index) => validateSourceReceipt(source, index, path));
+  if (!isNonEmptyString(value.sourceInventoryHash)) {
+    throw new UserError(`malformed insight study at ${path}: missing sourceInventoryHash`);
+  }
+  if (sourceInventoryHashFor(value.sources) !== value.sourceInventoryHash) {
+    throw new UserError(`malformed insight study at ${path}: sourceInventoryHash does not match sources`);
+  }
+  if (!Array.isArray(value.insights) || !Array.isArray(value.domainPlans)) {
+    throw new UserError(`malformed insight study at ${path}: insights and domainPlans must be arrays`);
+  }
+  if (value.status === "approved" || value.status === "jira-manifested") {
+    if (!isRecord2(value.approval) || !isNonEmptyString(value.planHash)) {
+      throw new UserError(`malformed insight study at ${path}: status ${value.status} requires planHash and approval`);
+    }
+    if (value.approval.planHash !== value.planHash) {
+      throw new UserError(`malformed insight study at ${path}: approval planHash does not match study planHash`);
+    }
+    if (value.approval.sourceInventoryHash !== value.sourceInventoryHash) {
+      throw new UserError(`malformed insight study at ${path}: approval sourceInventoryHash does not match study`);
+    }
+    if (value.approval.capabilityInventoryHash !== value.capabilityInventoryHash) {
+      throw new UserError(`malformed insight study at ${path}: approval capabilityInventoryHash does not match study`);
+    }
+    assertIsoDate(value.approval.approvedAt, "approval.approvedAt", path);
+  } else if (value.approval !== void 0 || value.jira !== void 0) {
+    throw new UserError(`malformed insight study at ${path}: status ${value.status} must not carry approval or Jira state`);
+  }
+  if (value.status === "jira-manifested" && !isRecord2(value.jira)) {
+    throw new UserError(`malformed insight study at ${path}: jira-manifested status requires Jira receipt metadata`);
+  }
+  if (value.status === "dismissed" || value.status === "archived") {
+    assertIsoDate(value.closedAt, "closedAt", path);
+  }
+}
+function parseStudy(path) {
+  let raw;
+  try {
+    raw = readFileSync20(path, "utf-8");
+  } catch (err) {
+    throw new UserError(`unable to read insight study at ${path}: ${err.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new UserError(`malformed insight study at ${path}: not valid JSON`);
+  }
+  validateStudyShape(parsed, path);
+  return parsed;
+}
+function approvalBasisHash(study) {
+  return stableHash({
+    sourceInventoryHash: study.sourceInventoryHash,
+    requestedAnalysisMode: study.requestedAnalysisMode,
+    actualAnalysisMode: study.actualAnalysisMode,
+    capabilityInventoryHash: study.capabilityInventoryHash,
+    insights: study.insights,
+    domainPlans: study.domainPlans,
+    planHash: study.planHash,
+    approvalSelection: study.approval ? {
+      approvedDomainIds: study.approval.approvedDomainIds,
+      acceptedExceptions: study.approval.acceptedExceptions
+    } : void 0
+  });
+}
+function createInsightStudy(input, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const createdAt = now.toISOString();
+  const studyId = options.studyId ?? createStudyId(input.sourceInventoryHash, createdAt);
+  assertStudyId(studyId);
+  const path = getStudyPath(studyId);
+  if (existsSync25(path)) throw new UserError(`insight study already exists: ${studyId}`);
+  const study = {
+    schemaVersion: INSIGHT_SCHEMA_VERSION,
+    studyId,
+    status: "collecting",
+    createdAt,
+    updatedAt: createdAt,
+    requestedAnalysisMode: input.requestedAnalysisMode,
+    sources: input.sources,
+    sourceInventoryHash: input.sourceInventoryHash,
+    insights: [],
+    domainPlans: []
+  };
+  validateStudyShape(study, path);
+  ensurePrivateDir(getInsightsDir());
+  ensurePrivateDir(getStudyDir(studyId));
+  writeJsonAtomic(path, study);
+  return study;
+}
+function readInsightStudy(studyId) {
+  const path = getStudyPath(studyId);
+  if (!existsSync25(path)) throw new UserError(`no insight study with id: ${studyId}`);
+  const study = parseStudy(path);
+  if (study.studyId !== studyId) {
+    throw new UserError(`malformed insight study at ${path}: stored studyId does not match its directory`);
+  }
+  return study;
+}
+function writeInsightStudy(study, now = /* @__PURE__ */ new Date()) {
+  assertStudyId(study.studyId);
+  const path = getStudyPath(study.studyId);
+  if (!existsSync25(path)) throw new UserError(`no insight study with id: ${study.studyId}`);
+  const existing = parseStudy(path);
+  let next = { ...study, updatedAt: now.toISOString() };
+  if (next.status === "dismissed" || next.status === "archived") {
+    next = { ...next, approval: void 0, jira: void 0 };
+  } else if (existing.approval && approvalBasisHash(existing) !== approvalBasisHash(next)) {
+    next = {
+      ...next,
+      status: "review-ready",
+      approval: void 0,
+      jira: void 0
+    };
+  }
+  validateStudyShape(next, path);
+  ensurePrivateDir(getInsightsDir());
+  ensurePrivateDir(getStudyDir(next.studyId));
+  writeJsonAtomic(path, next);
+  return next;
+}
+function appendStudyEvent(studyId, input) {
+  readInsightStudy(studyId);
+  const occurredAt = input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  if (!isNonEmptyString(input.type) || /[\u0000-\u001f\u007f-\u009f]/u.test(input.type)) {
+    throw new UserError(`study event type must be non-empty and contain no control characters`);
+  }
+  assertIsoDate(occurredAt, "event occurredAt", getStudyEventsPath(studyId));
+  const event = {
+    eventId: stableId("EVT", { studyId, type: input.type, occurredAt, detail: input.detail }),
+    studyId,
+    type: input.type,
+    occurredAt,
+    detail: input.detail
+  };
+  const path = getStudyEventsPath(studyId);
+  appendPrivateJsonLine(path, event);
+  return event;
+}
+
+// src/insights/validate.ts
+var CONTROL_OR_ANSI = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]|\u001b\[[0-?]*[ -/]*[@-~]/u;
+var PRIVATE_PATH = /(?:^|[\s("'])(?:~\/|\/(?:Users|home|private|tmp|var|etc|opt|Volumes|root)\/|[A-Za-z]:\\)/u;
+var SECRET_VALUE = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk|ghp|github_pat)-?[A-Za-z0-9_]{16,}|\bAKIA[0-9A-Z]{16}\b|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b|\b(?:password|passwd|api[_-]?key|access[_-]?token)\s*[:=]\s*\S+)/iu;
+var STUDY_ID2 = /^STUDY-[0-9a-f]{16}$/;
+var INSIGHT_ID = /^INS-[0-9a-f]{16}$/;
+var DOMAIN_ID = /^DOM-[0-9a-f]{16}$/;
+var SAFE_WORK_ITEM_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var MAX_EXPORT_TEXT_CHARS = 1e4;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function stringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function assertKeys(value, allowed, label2) {
+  const allowedSet = new Set(allowed);
+  const extra = Object.keys(value).filter((key) => value[key] !== void 0 && !allowedSet.has(key));
+  if (extra.length > 0) throw new UserError(`${label2} contains unsupported field(s): ${extra.join(", ")}`);
+}
+function assertRequired(value, required, label2) {
+  const missing = required.filter((key) => value[key] === void 0);
+  if (missing.length > 0) throw new UserError(`${label2} is missing required field(s): ${missing.join(", ")}`);
+}
+function assertStringArray(value, label2, minItems = 0) {
+  if (!stringArray(value) || value.length < minItems || value.some((entry) => entry.trim().length === 0)) {
+    throw new UserError(`${label2} must be an array of ${minItems > 0 ? "non-empty " : ""}strings${minItems > 0 ? ` with at least ${minItems} item(s)` : ""}`);
+  }
+}
+function assertExportSafeText(value, label2, privateLocators) {
+  if (value.length > MAX_EXPORT_TEXT_CHARS) throw new UserError(`${label2} exceeds ${MAX_EXPORT_TEXT_CHARS} characters`);
+  if (CONTROL_OR_ANSI.test(value)) throw new UserError(`${label2} contains control or terminal escape characters`);
+  if (PRIVATE_PATH.test(value)) throw new UserError(`${label2} contains an absolute private path`);
+  if (SECRET_VALUE.test(value)) throw new UserError(`${label2} contains credential-shaped content`);
+  const disclosedLocator = privateLocators.find((locator) => locator.length >= 4 && value.includes(locator));
+  if (disclosedLocator) throw new UserError(`${label2} contains a private source locator`);
+}
+function exportStrings(value, prefix = "$") {
+  if (typeof value === "string") return [{ path: prefix, value }];
+  if (Array.isArray(value)) return value.flatMap((child, index) => exportStrings(child, `${prefix}[${index}]`));
+  if (!isRecord3(value)) return [];
+  return Object.entries(value).flatMap(([key, child]) => exportStrings(child, `${prefix}.${key}`));
+}
+function privateLocatorsFor(study) {
+  return study.sources.filter((source) => source.privateLocator !== source.publicLocator).map((source) => source.privateLocator).filter((locator) => locator !== "stdin");
+}
+function assertExportSafe(value, study, label2 = "export") {
+  const privateLocators = privateLocatorsFor(study);
+  for (const entry of exportStrings(value)) assertExportSafeText(entry.value, `${label2}${entry.path}`, privateLocators);
+}
+function parseAnchor(value, label2, sourceIds) {
+  if (!isRecord3(value)) throw new UserError(`${label2} must be an object`);
+  assertKeys(value, ["sourceId", "locator", "excerpt"], label2);
+  assertRequired(value, ["sourceId", "locator"], label2);
+  if (!nonEmpty(value.sourceId) || !sourceIds.has(value.sourceId)) throw new UserError(`${label2}.sourceId is unknown`);
+  if (!nonEmpty(value.locator)) throw new UserError(`${label2}.locator must be a non-empty string`);
+  if (value.excerpt !== void 0) {
+    if (typeof value.excerpt !== "string" || value.excerpt.length > MAX_EVIDENCE_EXCERPT_CHARS) {
+      throw new UserError(`${label2}.excerpt must not exceed ${MAX_EVIDENCE_EXCERPT_CHARS} characters`);
+    }
+    if (CONTROL_OR_ANSI.test(value.excerpt)) throw new UserError(`${label2}.excerpt contains control characters`);
+  }
+  return value;
+}
+function parseCapabilityCandidate(value, label2, inventoryById) {
+  if (!isRecord3(value)) throw new UserError(`${label2} must be an object`);
+  assertKeys(value, ["capabilityId", "label", "fingerprint", "lexicalScore", "relationship", "semanticReviewRequired"], label2);
+  assertRequired(value, ["label", "relationship", "semanticReviewRequired"], label2);
+  if (!nonEmpty(value.label)) throw new UserError(`${label2}.label must be a non-empty string`);
+  if (!["existing", "extension", "ambiguous", "gap"].includes(String(value.relationship))) {
+    throw new UserError(`${label2}.relationship is unsupported`);
+  }
+  if (value.semanticReviewRequired !== true) throw new UserError(`${label2}.semanticReviewRequired must be true`);
+  if (value.lexicalScore !== void 0 && (typeof value.lexicalScore !== "number" || value.lexicalScore < 0 || value.lexicalScore > 1)) {
+    throw new UserError(`${label2}.lexicalScore must be a number from 0 to 1`);
+  }
+  if (value.capabilityId !== void 0) {
+    if (!nonEmpty(value.capabilityId) || !inventoryById.has(value.capabilityId)) {
+      throw new UserError(`${label2}.capabilityId is not present in the current inventory`);
+    }
+    const current = inventoryById.get(value.capabilityId);
+    if (value.fingerprint !== void 0 && value.fingerprint !== current.fingerprint) {
+      throw new UserError(`${label2}.fingerprint does not match the current capability inventory`);
+    }
+  } else if (value.fingerprint !== void 0) {
+    throw new UserError(`${label2}.fingerprint requires a capabilityId`);
+  }
+  if (value.relationship === "existing" || value.relationship === "extension") {
+    const currentFingerprint = nonEmpty(value.capabilityId) ? inventoryById.get(value.capabilityId)?.fingerprint : void 0;
+    if (!currentFingerprint || value.fingerprint !== currentFingerprint) {
+      throw new UserError(`${label2}.${String(value.relationship)} requires a capabilityId and exact current fingerprint`);
+    }
+  }
+  if (value.relationship === "gap" && (value.capabilityId !== void 0 || value.fingerprint !== void 0)) {
+    throw new UserError(`${label2}.gap must not claim an existing capability identity`);
+  }
+  return value;
+}
+function parseInsight(value, index, study, inventory) {
+  const label2 = `insights[${index}]`;
+  if (!isRecord3(value)) throw new UserError(`${label2} must be an object`);
+  const allowed = [
+    "insightId",
+    "claim",
+    "domain",
+    "sourceIds",
+    "evidence",
+    "extractionPassIds",
+    "independenceMode",
+    "validation",
+    "contradictingEvidence",
+    "unresolvedQuestions",
+    "relevance",
+    "relevanceBasis",
+    "confidence",
+    "confidenceBasis",
+    "provenanceConstraints",
+    "licenseConstraints",
+    "privacyConstraints",
+    "securityConstraints",
+    "proposedVerb",
+    "capabilityCandidates",
+    "inventoryCoverage",
+    "inventoryCoverageReason"
+  ];
+  assertKeys(value, allowed, label2);
+  assertRequired(value, allowed.filter((key) => key !== "inventoryCoverageReason"), label2);
+  if (!nonEmpty(value.insightId) || !INSIGHT_ID.test(value.insightId)) throw new UserError(`${label2}.insightId is invalid`);
+  if (!nonEmpty(value.claim) || !nonEmpty(value.domain)) throw new UserError(`${label2} requires a claim and domain`);
+  assertStringArray(value.sourceIds, `${label2}.sourceIds`, 1);
+  const knownSources = new Set(study.sources.map((source) => source.sourceId));
+  if (value.sourceIds.some((id) => !knownSources.has(id))) throw new UserError(`${label2}.sourceIds contains an unknown source`);
+  if (new Set(value.sourceIds).size !== value.sourceIds.length) throw new UserError(`${label2}.sourceIds contains duplicates`);
+  const expectedInsightId = insightIdFor(value.domain, value.claim, value.sourceIds);
+  if (value.insightId !== expectedInsightId) throw new UserError(`${label2}.insightId must equal the stable id ${expectedInsightId}`);
+  if (!Array.isArray(value.evidence) || value.evidence.length === 0) throw new UserError(`${label2}.evidence must not be empty`);
+  const sourceIds = new Set(value.sourceIds);
+  const evidence = value.evidence.map((anchor, anchorIndex) => parseAnchor(anchor, `${label2}.evidence[${anchorIndex}]`, sourceIds));
+  assertStringArray(value.extractionPassIds, `${label2}.extractionPassIds`, 1);
+  if (new Set(value.extractionPassIds).size !== value.extractionPassIds.length) {
+    throw new UserError(`${label2}.extractionPassIds contains duplicates`);
+  }
+  if (!ANALYSIS_MODES.includes(value.independenceMode)) throw new UserError(`${label2}.independenceMode is unsupported`);
+  if (!INSIGHT_VALIDATIONS.includes(value.validation)) throw new UserError(`${label2}.validation is unsupported`);
+  if (!Array.isArray(value.contradictingEvidence)) throw new UserError(`${label2}.contradictingEvidence must be an array`);
+  const contradictingEvidence = value.contradictingEvidence.map((item, contradictionIndex) => {
+    const itemLabel = `${label2}.contradictingEvidence[${contradictionIndex}]`;
+    if (!isRecord3(item)) throw new UserError(`${itemLabel} must be an object`);
+    assertKeys(item, ["claim", "anchors"], itemLabel);
+    assertRequired(item, ["claim", "anchors"], itemLabel);
+    if (!nonEmpty(item.claim) || !Array.isArray(item.anchors) || item.anchors.length === 0) {
+      throw new UserError(`${itemLabel} requires a claim and at least one anchor`);
+    }
+    return {
+      claim: item.claim,
+      anchors: item.anchors.map((anchor, anchorIndex) => parseAnchor(anchor, `${itemLabel}.anchors[${anchorIndex}]`, sourceIds))
+    };
+  });
+  const anchoredSourceIds = /* @__PURE__ */ new Set([
+    ...evidence.map((anchor) => anchor.sourceId),
+    ...contradictingEvidence.flatMap((item) => item.anchors.map((anchor) => anchor.sourceId))
+  ]);
+  if (value.sourceIds.some((sourceId) => !anchoredSourceIds.has(sourceId))) {
+    throw new UserError(`${label2}.evidence must anchor every declared sourceId`);
+  }
+  if (value.validation === "contested" && contradictingEvidence.length === 0) {
+    throw new UserError(`${label2} is contested but has no contradicting evidence`);
+  }
+  for (const key of ["unresolvedQuestions", "provenanceConstraints", "licenseConstraints", "privacyConstraints", "securityConstraints"]) {
+    assertStringArray(value[key], `${label2}.${key}`);
+  }
+  if (!["high", "medium", "low"].includes(String(value.relevance)) || !nonEmpty(value.relevanceBasis)) {
+    throw new UserError(`${label2} requires a supported relevance and written basis`);
+  }
+  if (!["high", "medium", "low"].includes(String(value.confidence)) || !nonEmpty(value.confidenceBasis)) {
+    throw new UserError(`${label2} requires a supported confidence and written basis`);
+  }
+  if (!FORGE_VERBS2.includes(value.proposedVerb)) throw new UserError(`${label2}.proposedVerb is unsupported`);
+  if (!INVENTORY_COVERAGE_VALUES.includes(value.inventoryCoverage)) throw new UserError(`${label2}.inventoryCoverage is unsupported`);
+  if (value.inventoryCoverage !== "complete" && !nonEmpty(value.inventoryCoverageReason)) {
+    throw new UserError(`${label2}.inventoryCoverageReason is required when coverage is not complete`);
+  }
+  if (value.inventoryCoverage === "complete" && inventory.coverage !== "complete") {
+    throw new UserError(`${label2} cannot claim complete inventory coverage when the current inventory is ${inventory.coverage}`);
+  }
+  if (!Array.isArray(value.capabilityCandidates)) throw new UserError(`${label2}.capabilityCandidates must be an array`);
+  const inventoryById = new Map(inventory.capabilities.map((entry) => [entry.capabilityId, entry]));
+  const capabilityCandidates = value.capabilityCandidates.map(
+    (candidate, candidateIndex) => parseCapabilityCandidate(candidate, `${label2}.capabilityCandidates[${candidateIndex}]`, inventoryById)
+  );
+  if (value.proposedVerb === "ABSORB" && !capabilityCandidates.some((candidate) => candidate.relationship === "existing" || candidate.relationship === "extension")) {
+    throw new UserError(`${label2}: ABSORB requires an exact existing/extension capability candidate`);
+  }
+  if (value.proposedVerb === "FORK") {
+    if (value.inventoryCoverage !== "complete" || inventory.coverage !== "complete") {
+      throw new UserError(`${label2}: FORK requires complete installed and skill-map inventory coverage`);
+    }
+    if (!capabilityCandidates.some((candidate) => candidate.relationship === "gap")) {
+      throw new UserError(`${label2}: FORK requires an explicitly reviewed capability gap`);
+    }
+    if (capabilityCandidates.some((candidate) => candidate.relationship === "existing" || candidate.relationship === "ambiguous")) {
+      throw new UserError(`${label2}: FORK is blocked while existing or ambiguous capability candidates remain`);
+    }
+  }
+  if (value.validation === "corroborated" && (new Set(value.sourceIds).size < 2 || new Set(value.extractionPassIds).size < 2)) {
+    throw new UserError(`${label2}: corroborated evidence requires at least two sources and two extraction passes`);
+  }
+  const sources = study.sources.filter((source) => sourceIds.has(source.sourceId));
+  const restricted = sources.some(
+    (source) => ["copyleft", "proprietary", "unknown"].includes(source.licenseClass) || ["client-confidential", "restricted"].includes(source.accessClass)
+  );
+  if (restricted && (value.proposedVerb === "ABSORB" || value.proposedVerb === "FORK")) {
+    throw new UserError(`${label2}: restrictive/private evidence cannot authorize ABSORB or FORK without a separately modeled legal exception`);
+  }
+  if (sources.some((source) => source.licenseClass === "attribution-required") && value.licenseConstraints.length === 0) {
+    throw new UserError(`${label2}: attribution-required evidence must carry a license obligation`);
+  }
+  if (sources.some((source) => ["client-confidential", "restricted"].includes(source.accessClass)) && value.privacyConstraints.length === 0) {
+    throw new UserError(`${label2}: private/restricted evidence must carry a privacy obligation`);
+  }
+  if (sources.some((source) => source.suspiciousInstructionFlags.length > 0) && value.securityConstraints.length === 0) {
+    throw new UserError(`${label2}: suspicious source instructions must remain visible as a security constraint`);
+  }
+  const parsed = {
+    ...value,
+    sourceIds: [...value.sourceIds],
+    evidence,
+    contradictingEvidence,
+    capabilityCandidates
+  };
+  assertExportSafe(
+    {
+      claim: parsed.claim,
+      domain: parsed.domain,
+      unresolvedQuestions: parsed.unresolvedQuestions,
+      relevanceBasis: parsed.relevanceBasis,
+      confidenceBasis: parsed.confidenceBasis,
+      provenanceConstraints: parsed.provenanceConstraints,
+      licenseConstraints: parsed.licenseConstraints,
+      privacyConstraints: parsed.privacyConstraints,
+      securityConstraints: parsed.securityConstraints,
+      candidateLabels: parsed.capabilityCandidates.map((candidate) => candidate.label)
+    },
+    study,
+    label2
+  );
+  return parsed;
+}
+function parseDomainPlan(value, index, insightsById, inventory, study) {
+  const label2 = `domainPlans[${index}]`;
+  if (!isRecord3(value)) throw new UserError(`${label2} must be an object`);
+  const required = [
+    "domainId",
+    "domain",
+    "outcome",
+    "acceptedInsightIds",
+    "contestedInsightIds",
+    "rejectedInsightIds",
+    "targetCapabilityIds",
+    "targetFingerprints",
+    "deduplicationEvidence",
+    "selectedVerb",
+    "proposedChanges",
+    "provenanceObligations",
+    "licenseObligations",
+    "privacyObligations",
+    "securityObligations",
+    "dependencies",
+    "acceptanceTests",
+    "measurement",
+    "rollbackMechanism",
+    "rollbackTrigger",
+    "workItems",
+    "nonGoals"
+  ];
+  assertKeys(value, required, label2);
+  assertRequired(value, required, label2);
+  if (!nonEmpty(value.domainId) || !DOMAIN_ID.test(value.domainId) || !nonEmpty(value.domain) || !nonEmpty(value.outcome)) {
+    throw new UserError(`${label2} requires a valid domainId, domain, and outcome`);
+  }
+  const groups = ["acceptedInsightIds", "contestedInsightIds", "rejectedInsightIds"];
+  for (const key of groups) assertStringArray(value[key], `${label2}.${key}`);
+  const allInsightIds = groups.flatMap((key) => value[key]);
+  if (new Set(allInsightIds).size !== allInsightIds.length) throw new UserError(`${label2} classifies an insight more than once`);
+  if (allInsightIds.some((id) => !insightsById.has(id))) throw new UserError(`${label2} references an unknown insight`);
+  const expectedId = domainPlanIdFor(value.domain, allInsightIds);
+  if (value.domainId !== expectedId) throw new UserError(`${label2}.domainId must equal the stable id ${expectedId}`);
+  for (const insightId of allInsightIds) {
+    if (insightsById.get(insightId).domain !== value.domain) throw new UserError(`${label2} contains an insight from another domain`);
+  }
+  for (const insightId of value.acceptedInsightIds) {
+    const insight2 = insightsById.get(insightId);
+    if (["contested", "rejected", "unverifiable"].includes(insight2.validation)) {
+      throw new UserError(`${label2} cannot accept ${insight2.validation} insight ${insightId}`);
+    }
+  }
+  for (const insightId of value.contestedInsightIds) {
+    if (insightsById.get(insightId).validation !== "contested") throw new UserError(`${label2} misclassifies non-contested insight ${insightId}`);
+  }
+  if (!FORGE_VERBS2.includes(value.selectedVerb)) throw new UserError(`${label2}.selectedVerb is unsupported`);
+  const selectedVerb = value.selectedVerb;
+  if (value.acceptedInsightIds.some((id) => insightsById.get(id).proposedVerb !== selectedVerb)) {
+    throw new UserError(`${label2}.selectedVerb must match each accepted insight`);
+  }
+  assertStringArray(value.targetCapabilityIds, `${label2}.targetCapabilityIds`);
+  if (!isRecord3(value.targetFingerprints)) throw new UserError(`${label2}.targetFingerprints must be an object`);
+  const targetFingerprints = value.targetFingerprints;
+  const inventoryById = new Map(inventory.capabilities.map((entry) => [entry.capabilityId, entry]));
+  for (const capabilityId of value.targetCapabilityIds) {
+    const current = inventoryById.get(capabilityId);
+    if (!current) throw new UserError(`${label2} targets an unknown capability ${capabilityId}`);
+    if (!current.fingerprint || targetFingerprints[capabilityId] !== current.fingerprint) {
+      throw new UserError(`${label2} has a stale or unavailable fingerprint for ${capabilityId}`);
+    }
+  }
+  if (Object.keys(targetFingerprints).some((id) => !value.targetCapabilityIds.includes(id))) {
+    throw new UserError(`${label2}.targetFingerprints contains an untargeted capability`);
+  }
+  if (selectedVerb === "ABSORB") {
+    const exactCandidateIds = new Set(
+      value.acceptedInsightIds.flatMap((insightId) => insightsById.get(insightId).capabilityCandidates).flatMap(
+        (candidate) => (candidate.relationship === "existing" || candidate.relationship === "extension") && candidate.capabilityId ? [candidate.capabilityId] : []
+      )
+    );
+    const hasExactTarget = value.targetCapabilityIds.some(
+      (capabilityId) => exactCandidateIds.has(capabilityId)
+    );
+    if (!hasExactTarget) {
+      throw new UserError(`${label2}: ABSORB must bind an exact existing/extension capability candidate and current fingerprint`);
+    }
+  }
+  for (const key of [
+    "deduplicationEvidence",
+    "proposedChanges",
+    "provenanceObligations",
+    "licenseObligations",
+    "privacyObligations",
+    "securityObligations",
+    "dependencies",
+    "acceptanceTests",
+    "nonGoals"
+  ]) assertStringArray(value[key], `${label2}.${key}`);
+  if (value.acceptanceTests.length === 0) throw new UserError(`${label2}.acceptanceTests must not be empty`);
+  if (!nonEmpty(value.rollbackMechanism) || !nonEmpty(value.rollbackTrigger)) throw new UserError(`${label2} requires rollback mechanism and trigger`);
+  if (!isRecord3(value.measurement)) throw new UserError(`${label2}.measurement must be an object`);
+  assertKeys(value.measurement, ["evidenceClass", "baseline", "method", "observationWindow", "stoppingRule", "guardrails"], `${label2}.measurement`);
+  assertRequired(value.measurement, ["evidenceClass", "baseline", "method", "observationWindow", "stoppingRule", "guardrails"], `${label2}.measurement`);
+  if (!["controlled", "natural", "observational"].includes(String(value.measurement.evidenceClass))) {
+    throw new UserError(`${label2}.measurement.evidenceClass is unsupported`);
+  }
+  for (const key of ["baseline", "method", "observationWindow", "stoppingRule"]) {
+    if (!nonEmpty(value.measurement[key])) throw new UserError(`${label2}.measurement.${key} must be non-empty`);
+  }
+  assertStringArray(value.measurement.guardrails, `${label2}.measurement.guardrails`);
+  if (!Array.isArray(value.workItems) || value.workItems.length === 0) throw new UserError(`${label2}.workItems must not be empty`);
+  const workItems = value.workItems.map((item, itemIndex) => {
+    const itemLabel = `${label2}.workItems[${itemIndex}]`;
+    if (!isRecord3(item)) throw new UserError(`${itemLabel} must be an object`);
+    assertKeys(item, ["workItemId", "intent", "summary", "acceptanceCriteria", "dependsOn"], itemLabel);
+    assertRequired(item, ["workItemId", "intent", "summary", "acceptanceCriteria", "dependsOn"], itemLabel);
+    if (!nonEmpty(item.workItemId) || !SAFE_WORK_ITEM_ID.test(item.workItemId)) throw new UserError(`${itemLabel}.workItemId is invalid`);
+    if (!["implementation", "measurement", "research", "prerequisite"].includes(String(item.intent)) || !nonEmpty(item.summary)) {
+      throw new UserError(`${itemLabel} has an invalid intent or summary`);
+    }
+    assertStringArray(item.acceptanceCriteria, `${itemLabel}.acceptanceCriteria`, 1);
+    assertStringArray(item.dependsOn, `${itemLabel}.dependsOn`);
+    return item;
+  });
+  const workIds = new Set(workItems.map((item) => item.workItemId));
+  if (workIds.size !== workItems.length) throw new UserError(`${label2}.workItems contains duplicate ids`);
+  const primaryIntent = selectedVerb === "WATCH" ? "research" : "implementation";
+  const primaryIds = workItems.filter((item) => item.intent === primaryIntent).map((item) => item.workItemId);
+  const measurements = workItems.filter((item) => item.intent === "measurement");
+  if (primaryIds.length === 0 || measurements.length === 0 || measurements.some((item) => !item.dependsOn.some((id) => primaryIds.includes(id)))) {
+    throw new UserError(`${label2} requires ${primaryIntent} work plus dependent measurement work`);
+  }
+  const parsed = value;
+  assertExportSafe({
+    domain: parsed.domain,
+    outcome: parsed.outcome,
+    deduplicationEvidence: parsed.deduplicationEvidence,
+    proposedChanges: parsed.proposedChanges,
+    provenanceObligations: parsed.provenanceObligations,
+    licenseObligations: parsed.licenseObligations,
+    privacyObligations: parsed.privacyObligations,
+    securityObligations: parsed.securityObligations,
+    dependencies: parsed.dependencies,
+    acceptanceTests: parsed.acceptanceTests,
+    measurement: parsed.measurement,
+    rollbackMechanism: parsed.rollbackMechanism,
+    rollbackTrigger: parsed.rollbackTrigger,
+    workItems: parsed.workItems,
+    nonGoals: parsed.nonGoals
+  }, study, label2);
+  return parsed;
+}
+function parseSubmission(value, study, inventory) {
+  if (!isRecord3(value)) throw new UserError(`insight submission must be an object`);
+  const keys = ["schemaVersion", "studyId", "sourceInventoryHash", "capabilityInventoryHash", "actualAnalysisMode", "insights", "domainPlans"];
+  assertKeys(value, keys, "insight submission");
+  assertRequired(value, keys, "insight submission");
+  if (value.schemaVersion !== INSIGHT_SCHEMA_VERSION) throw new UserError(`insight submission has an unsupported schemaVersion`);
+  if (!nonEmpty(value.studyId) || !STUDY_ID2.test(value.studyId) || value.studyId !== study.studyId) {
+    throw new UserError(`insight submission studyId does not match the target study`);
+  }
+  if (value.sourceInventoryHash !== study.sourceInventoryHash) throw new UserError(`source inventory changed; re-run analysis`);
+  if (value.capabilityInventoryHash !== inventory.capabilityInventoryHash) throw new UserError(`capability inventory changed; re-run mapping`);
+  if (!ANALYSIS_MODES.includes(value.actualAnalysisMode)) throw new UserError(`actualAnalysisMode is unsupported`);
+  if (!Array.isArray(value.insights) || !Array.isArray(value.domainPlans)) throw new UserError(`insights and domainPlans must be arrays`);
+  const insights = value.insights.map((insight2, index) => parseInsight(insight2, index, study, inventory));
+  const insightIds = new Set(insights.map((insight2) => insight2.insightId));
+  if (insightIds.size !== insights.length) throw new UserError(`insight submission contains duplicate insight ids`);
+  if (insights.some((insight2) => insight2.independenceMode !== value.actualAnalysisMode)) {
+    throw new UserError(`each insight independenceMode must match actualAnalysisMode`);
+  }
+  const domainPlans = value.domainPlans.map(
+    (plan, index) => parseDomainPlan(plan, index, new Map(insights.map((insight2) => [insight2.insightId, insight2])), inventory, study)
+  );
+  if (new Set(domainPlans.map((plan) => plan.domainId)).size !== domainPlans.length) throw new UserError(`domainPlans contains duplicate ids`);
+  const allWorkItems = domainPlans.flatMap((plan) => plan.workItems);
+  const allWorkItemIds = new Set(allWorkItems.map((item) => item.workItemId));
+  if (allWorkItemIds.size !== allWorkItems.length) throw new UserError(`domainPlans contains duplicate work-item ids`);
+  if (allWorkItems.some((item) => item.dependsOn.some((id) => !allWorkItemIds.has(id)))) {
+    throw new UserError(`domainPlans contains an unknown work-item dependency`);
+  }
+  const classified = domainPlans.flatMap((plan) => [
+    ...plan.acceptedInsightIds,
+    ...plan.contestedInsightIds,
+    ...plan.rejectedInsightIds
+  ]);
+  if (new Set(classified).size !== classified.length || classified.length !== insights.length) {
+    throw new UserError(`every insight must be classified exactly once across domain plans`);
+  }
+  return {
+    schemaVersion: INSIGHT_SCHEMA_VERSION,
+    studyId: study.studyId,
+    sourceInventoryHash: study.sourceInventoryHash,
+    capabilityInventoryHash: inventory.capabilityInventoryHash,
+    actualAnalysisMode: value.actualAnalysisMode,
+    insights,
+    domainPlans
+  };
+}
+function insightPlanHash(value) {
+  return stableHash({
+    sourceInventoryHash: value.sourceInventoryHash,
+    capabilityInventoryHash: value.capabilityInventoryHash,
+    actualAnalysisMode: value.actualAnalysisMode,
+    insights: value.insights,
+    domainPlans: value.domainPlans
+  });
+}
+function validateCurrentSourceFingerprints(study) {
+  const issues = [];
+  for (const source of study.sources) {
+    if (source.type !== "file" && source.type !== "directory") continue;
+    try {
+      const normalized = normalizeSources([
+        source.type === "file" ? { type: "file", path: source.privateLocator, mediaType: source.mediaType } : { type: "directory", path: source.privateLocator, includeHidden: source.includeHidden }
+      ]);
+      if (normalized.sources[0]?.fingerprint !== source.fingerprint) {
+        issues.push({
+          severity: "blocker",
+          code: "source-drift",
+          message: `Local source ${source.sourceId} changed after analysis.`
+        });
+      }
+    } catch (error) {
+      issues.push({
+        severity: "blocker",
+        code: "source-unavailable",
+        message: `Local source ${source.sourceId} cannot be revalidated: ${error.message}`
+      });
+    }
+  }
+  return issues;
+}
+function validateInsightSubmission(study, value, inventory) {
+  if (["approved", "jira-manifested", "dismissed", "archived"].includes(study.status)) {
+    throw new UserError(`study ${study.studyId} is ${study.status} and cannot accept an analysis submission`);
+  }
+  const submission = parseSubmission(value, study, inventory);
+  const next = {
+    ...study,
+    status: "review-ready",
+    actualAnalysisMode: submission.actualAnalysisMode,
+    capabilityInventoryHash: submission.capabilityInventoryHash,
+    insights: submission.insights,
+    domainPlans: submission.domainPlans,
+    approval: void 0,
+    jira: void 0
+  };
+  next.planHash = insightPlanHash(next);
+  return next;
+}
+function validateStudyForReview(study, inventory) {
+  const blockers = [];
+  const warnings = [];
+  const planHash = study.capabilityInventoryHash && study.actualAnalysisMode ? insightPlanHash(study) : stableHash({ studyId: study.studyId, domainPlans: study.domainPlans });
+  if (!study.actualAnalysisMode) blockers.push({ severity: "blocker", code: "analysis-mode-missing", message: "No actual analysis mode is recorded." });
+  if (!study.capabilityInventoryHash) blockers.push({ severity: "blocker", code: "inventory-missing", message: "No capability inventory hash is recorded." });
+  if (study.planHash !== planHash) blockers.push({ severity: "blocker", code: "plan-hash-stale", message: "The stored plan hash does not match current analysis and plans." });
+  if (study.insights.length === 0) blockers.push({ severity: "blocker", code: "insights-empty", message: "No validated insights were submitted." });
+  if (study.domainPlans.length === 0) blockers.push({ severity: "blocker", code: "plans-empty", message: "No domain plans were submitted." });
+  blockers.push(...validateCurrentSourceFingerprints(study));
+  if (inventory && study.capabilityInventoryHash !== inventory.capabilityInventoryHash) {
+    blockers.push({ severity: "blocker", code: "inventory-drift", message: "The capability inventory changed after analysis." });
+  }
+  if (inventory && inventory.coverage !== "complete") {
+    warnings.push({ severity: "warning", code: "inventory-incomplete", message: inventory.coverageReason ?? "Capability inventory coverage is incomplete." });
+  }
+  if (inventory && study.actualAnalysisMode && study.capabilityInventoryHash) {
+    try {
+      parseSubmission({
+        schemaVersion: INSIGHT_SCHEMA_VERSION,
+        studyId: study.studyId,
+        sourceInventoryHash: study.sourceInventoryHash,
+        capabilityInventoryHash: study.capabilityInventoryHash,
+        actualAnalysisMode: study.actualAnalysisMode,
+        insights: study.insights,
+        domainPlans: study.domainPlans
+      }, study, inventory);
+    } catch (error) {
+      blockers.push({
+        severity: "blocker",
+        code: "submission-invalid",
+        message: error.message
+      });
+    }
+  }
+  if (study.requestedAnalysisMode === "independent" && study.actualAnalysisMode === "single-context") {
+    warnings.push({ severity: "warning", code: "independence-degraded", message: "Independent analysis was requested but only a single context was recorded." });
+  }
+  for (const insight2 of study.insights) {
+    if (insight2.validation === "contested") warnings.push({ severity: "warning", code: "contested", message: "Contradicting evidence remains visible.", insightId: insight2.insightId });
+    if (insight2.validation === "single-source") warnings.push({ severity: "warning", code: "single-source", message: "This insight has only single-source support.", insightId: insight2.insightId });
+    if (insight2.inventoryCoverage !== "complete") warnings.push({ severity: "warning", code: "insight-coverage-incomplete", message: insight2.inventoryCoverageReason ?? "Insight mapping coverage is incomplete.", insightId: insight2.insightId });
+  }
+  return { valid: blockers.length === 0, blockers, warnings, planHash };
+}
+function assertCurrentApproval(study) {
+  if (study.status !== "approved" && study.status !== "jira-manifested" || !study.approval || !study.planHash) {
+    throw new UserError(`study ${study.studyId} does not have a current human approval`);
+  }
+  const expectedPlanHash = insightPlanHash(study);
+  if (study.planHash !== expectedPlanHash || study.approval.planHash !== expectedPlanHash) {
+    throw new UserError(`study ${study.studyId} approval is stale because the plan hash changed`);
+  }
+  if (sourceInventoryHashFor(study.sources) !== study.sourceInventoryHash) {
+    throw new UserError(`study ${study.studyId} approval is stale because the source policy changed`);
+  }
+  if (study.approval.sourceInventoryHash !== study.sourceInventoryHash) {
+    throw new UserError(`study ${study.studyId} approval is stale because the source inventory changed`);
+  }
+  if (!study.capabilityInventoryHash || study.approval.capabilityInventoryHash !== study.capabilityInventoryHash) {
+    throw new UserError(`study ${study.studyId} approval is stale because the capability inventory changed`);
+  }
+  const domainIds = new Set(study.domainPlans.map((plan) => plan.domainId));
+  if (study.approval.approvedDomainIds.length === 0 || study.approval.approvedDomainIds.some((id) => !domainIds.has(id))) {
+    throw new UserError(`study ${study.studyId} approval names an unknown domain plan`);
+  }
+  const sourceIssues = validateCurrentSourceFingerprints(study);
+  if (sourceIssues.length > 0) throw new UserError(sourceIssues[0].message);
+  return study.approval;
+}
+
+// src/insights/jira.ts
+var PROJECT_KEY = /^[A-Za-z][A-Za-z0-9_-]{0,31}$/;
+var RECEIPT_EVENT_ID = /^JIRA-EVT-[0-9a-f]{16}$/;
+var RECEIPT_KINDS = ["attempted", "found", "created", "failed"];
+var SAFE_MARKER_PART = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var ISSUE_KEY = /^[A-Za-z][A-Za-z0-9_-]*-[1-9][0-9]*$/;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/u;
+function nonEmpty2(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safeText(value, max = 2e3) {
+  const normalized = value.replace(/\u001b\[[0-?]*[ -/]*[@-~]/gu, "").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu, "").replace(/\s+/gu, " ").trim();
+  return normalized.length <= max ? normalized : `${normalized.slice(0, max)}\u2026`;
+}
+function label(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 64) || "unclassified";
+}
+function markerFor(studyId, workItemId) {
+  if (!SAFE_MARKER_PART.test(workItemId)) throw new UserError(`invalid Jira work-item id for marker: ${workItemId}`);
+  return `skill-forge-study:${studyId}:${workItemId}`;
+}
+function approvedPlans(study) {
+  const approval = assertCurrentApproval(study);
+  const approvedIds = new Set(approval.approvedDomainIds);
+  return study.domainPlans.filter((plan) => approvedIds.has(plan.domainId));
+}
+function sourceIdsFor(plan, study) {
+  const insightIds = /* @__PURE__ */ new Set([
+    ...plan.acceptedInsightIds,
+    ...plan.contestedInsightIds,
+    ...plan.rejectedInsightIds
+  ]);
+  return [...new Set(
+    study.insights.filter((insight2) => insightIds.has(insight2.insightId)).flatMap((insight2) => insight2.sourceIds)
+  )].sort();
+}
+function approvedPublicUrl(value) {
+  if (!value) return void 0;
+  try {
+    return canonicalPublicUrl(value, "source public locator");
+  } catch {
+    return void 0;
+  }
+}
+function implementationRoute(plan) {
+  switch (plan.selectedVerb) {
+    case "ABSORB":
+      return "Use the existing refinement or targeted plugin-change path; preview first and preserve rollback.";
+    case "DEFER":
+      return "Keep the maintained source/capability authoritative; add only a thin wrapper or reference when approved.";
+    case "FORK":
+      return "Gate and deduplicate the proposed custom capability before any promotion or repository implementation.";
+    case "REJECT":
+      return "No capability mutation; document why the existing behavior is sufficient.";
+    case "WATCH":
+      return "Research and measure only; do not implement a capability until evidence and fit are ready.";
+  }
+}
+function measurementText(plan) {
+  const measurement = plan.measurement;
+  return safeText(
+    `${measurement.evidenceClass}: baseline ${measurement.baseline}; method ${measurement.method}; window ${measurement.observationWindow}; stopping rule ${measurement.stoppingRule}`
+  );
+}
+function workItemFor(plan, workItem, study) {
+  const insightIds = [.../* @__PURE__ */ new Set([
+    ...plan.acceptedInsightIds,
+    ...plan.contestedInsightIds,
+    ...plan.rejectedInsightIds
+  ])].sort();
+  return {
+    workItemId: workItem.workItemId,
+    marker: markerFor(study.studyId, workItem.workItemId),
+    issueTypeIntent: workItem.intent,
+    summary: safeText(workItem.summary, 255),
+    context: safeText(`${plan.outcome} Domain plan: ${plan.domainId}. Evidence is referenced by stable source/insight ids only.`),
+    requirements: plan.proposedChanges.map((entry) => safeText(entry)),
+    acceptanceCriteria: workItem.acceptanceCriteria.map((entry) => safeText(entry)),
+    dependencies: workItem.dependsOn.map((entry) => markerFor(study.studyId, entry)),
+    implementationRoute: implementationRoute(plan),
+    measurement: measurementText(plan),
+    rollback: safeText(`${plan.rollbackMechanism} Trigger: ${plan.rollbackTrigger}`),
+    labels: ["skill-forge", "source-insight", `domain-${label(plan.domain)}`, `intent-${label(workItem.intent)}`],
+    domainIds: [plan.domainId],
+    insightIds,
+    sourceIds: sourceIdsFor(plan, study)
+  };
+}
+function buildJiraManifest(study, projectKey, options = {}) {
+  if (!PROJECT_KEY.test(projectKey)) throw new UserError(`invalid Jira project key: ${projectKey}`);
+  const plans = approvedPlans(study);
+  if (plans.length === 0) throw new UserError(`the current approval contains no domain plans`);
+  const workItems = plans.flatMap((plan) => plan.workItems.map((item) => workItemFor(plan, item, study)));
+  const ids = new Set(workItems.map((item) => item.workItemId));
+  if (ids.size !== workItems.length) throw new UserError(`approved plans contain duplicate Jira work-item ids`);
+  if (workItems.some((item) => item.dependencies.some((dependency) => !ids.has(dependency.split(":").at(-1))))) {
+    throw new UserError(`approved plans depend on a work item outside the approved Jira manifest`);
+  }
+  const epicId = stableId("EPIC", { studyId: study.studyId, planHash: study.planHash });
+  const approvedSourceIds = new Set(plans.flatMap((plan) => sourceIdsFor(plan, study)));
+  const approvedSourceLinks = [...new Set(
+    study.sources.filter((source) => approvedSourceIds.has(source.sourceId) && source.accessClass === "public").map((source) => approvedPublicUrl(source.publicLocator)).filter((locator) => locator !== void 0)
+  )].sort();
+  const manifest = {
+    schemaVersion: INSIGHT_SCHEMA_VERSION,
+    generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    studyId: study.studyId,
+    approvedPlanHash: study.planHash,
+    projectKey: projectKey.toUpperCase(),
+    backlogMode: "epic",
+    epic: {
+      workItemId: epicId,
+      marker: markerFor(study.studyId, epicId),
+      summary: safeText(`Source insight improvements \u2014 ${study.studyId}`, 255),
+      overview: "Implement only the human-approved source-insight domain plans. Source material remains untrusted data and private locators are excluded.",
+      objectives: plans.map((plan) => safeText(plan.outcome)),
+      scope: plans.map((plan) => `${plan.domainId}: ${safeText(plan.domain)}`),
+      successCriteria: plans.flatMap((plan) => plan.acceptanceTests.map((entry) => safeText(entry))),
+      approvedSourceLinks,
+      labels: ["skill-forge", "source-insight", `study-${label(study.studyId)}`]
+    },
+    workItems
+  };
+  assertExportSafe(manifest, study, "Jira manifest");
+  return manifest;
+}
+function getJiraReceiptsPath(studyId) {
+  return join31(getStudyDir(studyId), "jira-receipts.jsonl");
+}
+function assertCurrentJiraManifest(study, value) {
+  if (study.status !== "jira-manifested" || !study.jira) {
+    throw new UserError(`study ${study.studyId} does not have a current Jira manifest`);
+  }
+  if (!isRecord4(value) || !nonEmpty2(value.projectKey) || !nonEmpty2(value.generatedAt)) {
+    throw new UserError(`stored Jira manifest for study ${study.studyId} is malformed`);
+  }
+  const generatedAt = new Date(value.generatedAt);
+  if (Number.isNaN(generatedAt.getTime())) {
+    throw new UserError(`stored Jira manifest for study ${study.studyId} has an invalid generatedAt`);
+  }
+  const expected = buildJiraManifest(study, value.projectKey, { now: generatedAt });
+  const manifestHash = stableHash(value);
+  if (stableHash(expected) !== manifestHash || study.jira.manifestHash !== manifestHash || study.jira.projectKey.toUpperCase() !== expected.projectKey || study.jira.generatedAt !== expected.generatedAt) {
+    throw new UserError(`stored Jira manifest for study ${study.studyId} does not match the current approved plan`);
+  }
+  return expected;
+}
+function manifestMarkers(manifest) {
+  return /* @__PURE__ */ new Set([manifest.epic.marker, ...manifest.workItems.map((item) => item.marker)]);
+}
+function assertManifestMarker(marker, manifest, label2) {
+  if (!manifestMarkers(manifest).has(marker)) {
+    throw new UserError(`${label2}: marker is not present in the current approved Jira manifest`);
+  }
+}
+function assertResultProjectKey(event, manifest, label2) {
+  if (event.kind !== "created" && event.kind !== "found") return;
+  const expectedPrefix = `${manifest.projectKey}-`;
+  const issueKey = event.issueKey;
+  if (!nonEmpty2(issueKey) || !issueKey.startsWith(expectedPrefix) || !/^[1-9][0-9]*$/.test(issueKey.slice(expectedPrefix.length))) {
+    throw new UserError(`${label2}: issueKey does not match Jira project ${manifest.projectKey}`);
+  }
+}
+function parseJiraReceiptInput(value) {
+  if (!isRecord4(value)) throw new UserError(`Jira receipt import must be an object`);
+  const allowed = /* @__PURE__ */ new Set(["kind", "marker", "occurredAt", "issueKey", "issueUrl", "error"]);
+  const extra = Object.keys(value).filter((key) => !allowed.has(key));
+  if (extra.length > 0) throw new UserError(`Jira receipt import contains unsupported field(s): ${extra.join(", ")}`);
+  if (!RECEIPT_KINDS.includes(value.kind) || !nonEmpty2(value.marker)) {
+    throw new UserError(`Jira receipt import requires a supported kind and non-empty marker`);
+  }
+  if (value.occurredAt !== void 0 && (!nonEmpty2(value.occurredAt) || Number.isNaN(Date.parse(value.occurredAt)))) {
+    throw new UserError(`Jira receipt import occurredAt must be an ISO-8601 timestamp`);
+  }
+  for (const key of ["issueKey", "issueUrl", "error"]) {
+    if (value[key] !== void 0 && typeof value[key] !== "string") {
+      throw new UserError(`Jira receipt import ${key} must be a string`);
+    }
+  }
+  return value;
+}
+function assertReceiptShape(value, studyId, manifest, line) {
+  const where = line ? ` line ${line}` : "";
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new UserError(`malformed Jira receipts${where}: expected an object`);
+  const event = value;
+  const allowed = /* @__PURE__ */ new Set(["eventId", "studyId", "kind", "marker", "occurredAt", "issueKey", "issueUrl", "error"]);
+  const extra = Object.keys(event).filter((key) => !allowed.has(key));
+  if (extra.length > 0) throw new UserError(`malformed Jira receipts${where}: unsupported fields ${extra.join(", ")}`);
+  if (!nonEmpty2(event.eventId) || !RECEIPT_EVENT_ID.test(event.eventId) || event.studyId !== studyId) {
+    throw new UserError(`malformed Jira receipts${where}: invalid event identity`);
+  }
+  if (!RECEIPT_KINDS.includes(event.kind) || !nonEmpty2(event.marker)) {
+    throw new UserError(`malformed Jira receipts${where}: invalid kind or marker`);
+  }
+  const markerPrefix = `skill-forge-study:${studyId}:`;
+  if (!event.marker.startsWith(markerPrefix) || !SAFE_MARKER_PART.test(event.marker.slice(markerPrefix.length)) || CONTROL.test(event.marker)) {
+    throw new UserError(`malformed Jira receipts${where}: marker does not belong to the study`);
+  }
+  assertManifestMarker(event.marker, manifest, `malformed Jira receipts${where}`);
+  if (!nonEmpty2(event.occurredAt) || Number.isNaN(Date.parse(event.occurredAt))) {
+    throw new UserError(`malformed Jira receipts${where}: occurredAt is invalid`);
+  }
+  if ((event.kind === "created" || event.kind === "found") && (!nonEmpty2(event.issueKey) || !nonEmpty2(event.issueUrl))) {
+    throw new UserError(`malformed Jira receipts${where}: ${event.kind} requires issueKey and issueUrl`);
+  }
+  if (event.issueKey !== void 0 && !ISSUE_KEY.test(String(event.issueKey))) {
+    throw new UserError(`malformed Jira receipts${where}: issueKey is invalid`);
+  }
+  assertResultProjectKey(event, manifest, `malformed Jira receipts${where}`);
+  if (event.issueUrl !== void 0) {
+    try {
+      if (canonicalPublicUrl(String(event.issueUrl), "Jira issue URL") !== event.issueUrl) {
+        throw new Error("non-canonical URL");
+      }
+    } catch {
+      throw new UserError(`malformed Jira receipts${where}: issueUrl violates the public URL policy`);
+    }
+  }
+  if (event.kind === "failed" && !nonEmpty2(event.error)) throw new UserError(`malformed Jira receipts${where}: failed requires error`);
+  for (const key of ["issueKey", "issueUrl", "error"]) {
+    if (event[key] !== void 0 && (typeof event[key] !== "string" || CONTROL.test(event[key]))) {
+      throw new UserError(`malformed Jira receipts${where}: ${key} is invalid`);
+    }
+  }
+  const expectedEventId = stableId("JIRA-EVT", {
+    studyId,
+    kind: event.kind,
+    marker: event.marker,
+    occurredAt: event.occurredAt,
+    issueKey: event.issueKey,
+    issueUrl: event.issueUrl,
+    error: event.error
+  });
+  if (event.eventId !== expectedEventId) throw new UserError(`malformed Jira receipts${where}: eventId does not match event contents`);
+}
+function appendJiraReceipt(studyId, manifest, input) {
+  const currentManifest = assertCurrentJiraManifest(readInsightStudy(studyId), manifest);
+  const occurredAt = input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const identity = {
+    studyId,
+    kind: input.kind,
+    marker: input.marker,
+    occurredAt,
+    issueKey: input.issueKey,
+    issueUrl: input.issueUrl,
+    error: input.error
+  };
+  const event = {
+    eventId: stableId("JIRA-EVT", identity),
+    ...identity
+  };
+  assertReceiptShape(event, studyId, currentManifest);
+  const path = getJiraReceiptsPath(studyId);
+  appendPrivateJsonLine(path, event);
+  return event;
+}
+function readJiraReceipts(studyId, manifest) {
+  const currentManifest = assertCurrentJiraManifest(readInsightStudy(studyId), manifest);
+  const path = getJiraReceiptsPath(studyId);
+  if (!existsSync26(path)) return [];
+  let text;
+  try {
+    text = readFileSync21(path, "utf-8");
+  } catch (error) {
+    throw new UserError(`unable to read Jira receipts at ${path}: ${error.message}`);
+  }
+  return text.split("\n").filter(Boolean).map((line, index) => {
+    let value;
+    try {
+      value = JSON.parse(line);
+    } catch {
+      throw new UserError(`malformed Jira receipts line ${index + 1}: not valid JSON`);
+    }
+    assertReceiptShape(value, studyId, currentManifest, index + 1);
+    return value;
+  });
+}
+function resumeItem(marker, workItemId, kind, receipts) {
+  const events = receipts.filter((event) => event.marker === marker);
+  const completed = [...events].reverse().find((event) => event.kind === "created" || event.kind === "found");
+  if (completed) {
+    return { marker, workItemId, kind, state: "created", issueKey: completed.issueKey, issueUrl: completed.issueUrl };
+  }
+  const last = events.at(-1);
+  if (last) return { marker, workItemId, kind, state: "search-required", lastError: last.error };
+  return { marker, workItemId, kind, state: "create" };
+}
+function buildJiraResumeState(manifest, receipts) {
+  for (const receipt of receipts) {
+    if (receipt.studyId !== manifest.studyId) {
+      throw new UserError(`Jira receipt ${receipt.eventId} belongs to another study`);
+    }
+    assertManifestMarker(receipt.marker, manifest, `Jira receipt ${receipt.eventId}`);
+    assertResultProjectKey(receipt, manifest, `Jira receipt ${receipt.eventId}`);
+  }
+  const epic = resumeItem(manifest.epic.marker, manifest.epic.workItemId, "epic", receipts);
+  const workItems = manifest.workItems.map((item) => resumeItem(item.marker, item.workItemId, "work-item", receipts));
+  const all = [epic, ...workItems];
+  const complete = all.every((item) => item.state === "created");
+  const nextAction = complete ? "complete" : all.some((item) => item.state === "search-required") ? "search-by-marker" : epic.state !== "created" ? "create-epic" : "create-work-item";
+  return { epic, workItems, complete, nextAction };
+}
+
+// src/insights/render.ts
+var ANSI_ESCAPE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\))/gu;
+var UNSAFE_CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu;
+var MAX_RENDERED_TEXT = 4e3;
+function sanitizeRenderedText(value) {
+  const text = String(value ?? "").replace(ANSI_ESCAPE, "").replace(UNSAFE_CONTROL, "").replace(/\r\n?|\u2028|\u2029/gu, "\n");
+  return text.length <= MAX_RENDERED_TEXT ? text : `${text.slice(0, MAX_RENDERED_TEXT)}\u2026`;
+}
+function oneLine(value) {
+  return sanitizeRenderedText(value).replace(/\s+/gu, " ").trim();
+}
+function bullets(values, empty = "none") {
+  return values.length > 0 ? values.map((value) => `  - ${oneLine(value)}`) : [`  - ${empty}`];
+}
+function renderDomainPlan(plan) {
+  const lines = [
+    `${oneLine(plan.domain)} (${oneLine(plan.domainId)})`,
+    `  Outcome: ${oneLine(plan.outcome)}`,
+    `  Forge verb: ${oneLine(plan.selectedVerb)}`,
+    `  Accepted insights: ${plan.acceptedInsightIds.map(oneLine).join(", ") || "none"}`,
+    `  Contested insights: ${plan.contestedInsightIds.map(oneLine).join(", ") || "none"}`,
+    `  Rejected insights: ${plan.rejectedInsightIds.map(oneLine).join(", ") || "none"}`,
+    `  Targets: ${plan.targetCapabilityIds.length} private capability id(s)`,
+    "  Proposed changes:",
+    ...bullets(plan.proposedChanges),
+    "  Acceptance tests:",
+    ...bullets(plan.acceptanceTests),
+    `  Measurement: ${oneLine(plan.measurement.evidenceClass)} \u2014 ${oneLine(plan.measurement.method)}`,
+    `  Stopping rule: ${oneLine(plan.measurement.stoppingRule)}`,
+    `  Rollback: ${oneLine(plan.rollbackMechanism)} (trigger: ${oneLine(plan.rollbackTrigger)})`,
+    "  Non-goals:",
+    ...bullets(plan.nonGoals)
+  ];
+  return lines.join("\n");
+}
+function renderInsightReview(study, inventory, validation = validateStudyForReview(study, inventory)) {
+  const lines = [
+    `Insight study ${oneLine(study.studyId)}`,
+    `Status: ${oneLine(study.status)}`,
+    `Plan hash: ${oneLine(validation.planHash)}`,
+    `Analysis: requested ${oneLine(study.requestedAnalysisMode)}; actual ${oneLine(study.actualAnalysisMode ?? "not submitted")}`,
+    `Inventory: ${inventory ? `${oneLine(inventory.coverage)} (${inventory.installedCapabilityCount} installed, ${inventory.mapCapabilityCount} mapped)` : "not refreshed"}`,
+    `Review gate: ${validation.valid ? "READY FOR HUMAN APPROVAL" : "BLOCKED"}`
+  ];
+  if (validation.blockers.length > 0) {
+    lines.push("Blockers:", ...validation.blockers.map((issue) => `  - [${oneLine(issue.code)}] ${oneLine(issue.message)}`));
+  }
+  if (validation.warnings.length > 0) {
+    lines.push("Warnings:", ...validation.warnings.map((issue) => `  - [${oneLine(issue.code)}] ${oneLine(issue.message)}`));
+  }
+  lines.push("Sources:");
+  for (const source of study.sources) {
+    const publicLink = source.accessClass === "public" && source.publicLocator ? ` \u2014 ${oneLine(source.publicLocator)}` : "";
+    lines.push(`  - ${oneLine(source.sourceId)}: ${oneLine(source.title)}${publicLink}`);
+    if (source.suspiciousInstructionFlags.length > 0) {
+      lines.push(`    untrusted-instruction flags: ${source.suspiciousInstructionFlags.map(oneLine).join(", ")}`);
+    }
+  }
+  lines.push("Insights:");
+  for (const insight2 of study.insights) {
+    lines.push(
+      `  - ${oneLine(insight2.insightId)} [${oneLine(insight2.validation)}/${oneLine(insight2.confidence)}] ${oneLine(insight2.claim)}`
+    );
+  }
+  lines.push("Domain plans:");
+  for (const plan of study.domainPlans) lines.push(renderDomainPlan(plan));
+  lines.push(
+    "",
+    "Approval is human-only. An agent must stop here and ask the user to run `skill-forge insight approve` in an interactive terminal."
+  );
+  return lines.join("\n");
+}
+
+// src/commands/insight.ts
+var PRO_FEATURE_LABEL8 = "source insight planning";
+var WORKFLOW_ASSET = "workflows/source-insight-planning/SKILL.md";
+var CONTEXT_FILENAME = "command-context.json";
+var INVENTORY_FILENAME = "inventory.json";
+var JIRA_MANIFEST_FILENAME = "jira-manifest.json";
+function requireProFeature2() {
+  const status2 = proFeatureStatus(PRO_FEATURE_LABEL8);
+  if (!status2.enabled) {
+    throw new UserError(
+      status2.notice ?? "insight is a Pro feature \u2014 set SKILL_FORGE_LICENSE or config.licenseKey to a valid license to unlock."
+    );
+  }
+  if (status2.notice) console.error(`[skill-forge] ${status2.notice}`);
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value, label2) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new UserError(`${label2} must be a non-empty string`);
+  }
+  return value;
+}
+function parseJsonFile(path, label2) {
+  const resolved = resolvePath10(path);
+  let raw;
+  try {
+    raw = readFileSync22(resolved, "utf-8");
+  } catch (error) {
+    throw new UserError(`unable to read ${label2} at ${resolved}: ${error.message}`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new UserError(`${label2} at ${resolved} is not valid JSON`);
+  }
+}
+var COMMON_DESCRIPTOR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "title",
+  "accessClass",
+  "licenseName",
+  "licenseClass",
+  "author",
+  "publisher",
+  "publicationDate",
+  "revisionDate",
+  "revision",
+  "etag",
+  "mediaType"
+]);
+var COMMON_STRING_DESCRIPTOR_FIELDS = [
+  "title",
+  "licenseName",
+  "author",
+  "publisher",
+  "publicationDate",
+  "revisionDate",
+  "revision",
+  "etag",
+  "mediaType"
+];
+function assertDescriptorKeys(value, specific, label2) {
+  const allowed = /* @__PURE__ */ new Set([...COMMON_DESCRIPTOR_FIELDS, ...specific]);
+  const extra = Object.keys(value).filter((key) => !allowed.has(key));
+  if (extra.length > 0) throw new UserError(`${label2} contains unsupported field(s): ${extra.join(", ")}`);
+}
+function assertCommonDescriptorFields(value, label2) {
+  for (const field of COMMON_STRING_DESCRIPTOR_FIELDS) {
+    if (value[field] !== void 0 && typeof value[field] !== "string") {
+      throw new UserError(`${label2}.${field} must be a string`);
+    }
+  }
+  if (value.accessClass !== void 0 && !SOURCE_ACCESS_CLASSES.includes(value.accessClass)) {
+    throw new UserError(`${label2}.accessClass is unsupported`);
+  }
+  if (value.licenseClass !== void 0 && !SOURCE_LICENSE_CLASSES.includes(value.licenseClass)) {
+    throw new UserError(`${label2}.licenseClass is unsupported`);
+  }
+}
+function pathRelativeTo(baseDir, raw, label2) {
+  const path = nonEmptyString(raw, label2);
+  return isAbsolute6(path) ? path : resolvePath10(baseDir, path);
+}
+function parseManifestDescriptor(value, index, baseDir) {
+  const label2 = `source manifest entry ${index + 1}`;
+  if (!isRecord5(value)) throw new UserError(`${label2} must be an object`);
+  const type = nonEmptyString(value.type, `${label2}.type`);
+  assertCommonDescriptorFields(value, label2);
+  if (type === "url") {
+    assertDescriptorKeys(value, ["url", "observedSha256", "observedByteLength"], label2);
+    return { ...value, type, url: nonEmptyString(value.url, `${label2}.url`) };
+  }
+  if (type === "file" || type === "directory") {
+    assertDescriptorKeys(value, type === "directory" ? ["path", "includeHidden"] : ["path"], label2);
+    if (value.includeHidden !== void 0 && typeof value.includeHidden !== "boolean") {
+      throw new UserError(`${label2}.includeHidden must be a boolean`);
+    }
+    return { ...value, type, path: pathRelativeTo(baseDir, value.path, `${label2}.path`) };
+  }
+  if (type === "connector") {
+    assertDescriptorKeys(value, ["provider", "opaqueId", "publicLocator", "observedSha256", "observedByteLength"], label2);
+    if (value.publicLocator !== void 0 && typeof value.publicLocator !== "string") {
+      throw new UserError(`${label2}.publicLocator must be a string`);
+    }
+    return {
+      ...value,
+      type,
+      provider: nonEmptyString(value.provider, `${label2}.provider`),
+      opaqueId: nonEmptyString(value.opaqueId, `${label2}.opaqueId`)
+    };
+  }
+  if (type === "stdin") {
+    assertDescriptorKeys(value, ["content"], label2);
+    if (typeof value.content !== "string") throw new UserError(`${label2}.content must be a string`);
+    return { ...value, type, content: value.content };
+  }
+  throw new UserError(`${label2}.type must be url|file|directory|connector|stdin`);
+}
+function readManifest2(path) {
+  const resolved = resolvePath10(path);
+  const parsed = parseJsonFile(resolved, "source manifest");
+  let values;
+  if (Array.isArray(parsed)) {
+    values = parsed;
+  } else if (isRecord5(parsed)) {
+    const extra = Object.keys(parsed).filter((key) => key !== "sources");
+    if (extra.length > 0) throw new UserError(`source manifest contains unsupported field(s): ${extra.join(", ")}`);
+    values = parsed.sources;
+  }
+  if (!Array.isArray(values)) throw new UserError(`source manifest must be an array or an object with a sources array`);
+  return values.map((value, index) => parseManifestDescriptor(value, index, dirname13(resolved)));
+}
+function readBoundedStdin(descriptor = 0, maxFileBytes = DEFAULT_MAX_SOURCE_FILE_BYTES) {
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, maxFileBytes + 1 - total));
+    const count = readSync3(descriptor, chunk, 0, chunk.byteLength, null);
+    if (count === 0) return Buffer.concat(chunks, total);
+    total += count;
+    if (total > maxFileBytes) {
+      throw new UserError(`stdin source exceeds the per-source byte limit (${maxFileBytes})`);
+    }
+    chunks.push(chunk.subarray(0, count));
+  }
+}
+function positionalSource(value) {
+  if (/^https?:\/\//iu.test(value)) return { type: "url", url: value };
+  if (value === "-") {
+    if (process.stdin.isTTY) throw new UserError(`stdin source "-" requires piped input`);
+    return { type: "stdin", content: readBoundedStdin() };
+  }
+  const resolved = resolvePath10(value);
+  let stat;
+  try {
+    stat = lstatSync6(resolved);
+  } catch (error) {
+    throw new UserError(`unable to read source ${resolved}: ${error.message}`);
+  }
+  if (stat.isSymbolicLink()) throw new UserError(`source path must not be a symlink: ${resolved}`);
+  if (stat.isFile()) return { type: "file", path: resolved };
+  if (stat.isDirectory()) return { type: "directory", path: resolved };
+  throw new UserError(`source must be a regular file or directory: ${resolved}`);
+}
+function collectSourceInputs(sourceArgs, options) {
+  const inputs = sourceArgs.map(positionalSource);
+  if (options.manifest) inputs.push(...readManifest2(options.manifest));
+  if (inputs.length === 0) throw new UserError(`insight analyze requires at least one source or --manifest`);
+  return inputs;
+}
+function contextPath(studyId) {
+  return join32(getStudyDir(studyId), CONTEXT_FILENAME);
+}
+function inventoryPath(studyId) {
+  return join32(getStudyDir(studyId), INVENTORY_FILENAME);
+}
+function writeCommandContext(studyId, skillMapPath, skillMapCoverage, inventory) {
+  const context = {
+    schemaVersion: 1,
+    skillMapPath: skillMapPath ? resolvePath10(skillMapPath) : void 0,
+    skillMapCoverage
+  };
+  writeJsonAtomic(contextPath(studyId), context);
+  writeJsonAtomic(inventoryPath(studyId), inventory);
+}
+function readCommandContext(studyId) {
+  const path = contextPath(studyId);
+  const parsed = parseJsonFile(path, "insight command context");
+  if (!isRecord5(parsed) || parsed.schemaVersion !== 1 || parsed.skillMapPath !== void 0 && (typeof parsed.skillMapPath !== "string" || !isAbsolute6(parsed.skillMapPath)) || parsed.skillMapCoverage !== void 0 && parsed.skillMapCoverage !== "static" && parsed.skillMapCoverage !== "resolved" || parsed.skillMapCoverage !== void 0 && parsed.skillMapPath === void 0 || Object.keys(parsed).some((key) => !["schemaVersion", "skillMapPath", "skillMapCoverage"].includes(key))) {
+    throw new UserError(`malformed insight command context at ${path}`);
+  }
+  return parsed;
+}
+function currentInventory(study, config) {
+  const storedPath = inventoryPath(study.studyId);
+  const stored = parseJsonFile(storedPath, "insight inventory snapshot");
+  if (!isRecord5(stored) || typeof stored.capabilityInventoryHash !== "string" || stored.capabilityInventoryHash !== study.capabilityInventoryHash) {
+    throw new UserError(`insight inventory snapshot at ${storedPath} does not match study ${study.studyId}`);
+  }
+  const context = readCommandContext(study.studyId);
+  return buildInsightInventory(config, {
+    skillMapPath: context.skillMapPath,
+    skillMapCoverage: context.skillMapCoverage
+  });
+}
+function readCurrentStudy(studyId) {
+  const study = readInsightStudy(studyId);
+  const config = loadConfig();
+  return { study, inventory: currentInventory(study, config), config };
+}
+function retainedPath(root, relativePath) {
+  const candidate = resolvePath10(root, relativePath);
+  const rel = relative5(root, candidate);
+  if (rel.startsWith("..") || isAbsolute6(rel)) throw new UserError(`refusing retained source path outside the study`);
+  return candidate;
+}
+function retainObservedSources(study, observedFiles) {
+  if (observedFiles.length === 0) return study;
+  const root = join32(getStudyDir(study.studyId), "retained-sources");
+  mkdirSync9(root, { recursive: true, mode: 448 });
+  chmodSync3(root, 448);
+  const retainedSourceIds = /* @__PURE__ */ new Set();
+  for (const file of observedFiles) {
+    const sourceRoot = join32(root, file.sourceId);
+    mkdirSync9(sourceRoot, { recursive: true, mode: 448 });
+    chmodSync3(sourceRoot, 448);
+    const destination = retainedPath(sourceRoot, file.relativePath);
+    mkdirSync9(dirname13(destination), { recursive: true, mode: 448 });
+    writeFileSync8(destination, file.bytes, { flag: "wx", mode: 384 });
+    chmodSync3(destination, 384);
+    retainedSourceIds.add(file.sourceId);
+  }
+  const sources = study.sources.map((source) => {
+    if (!retainedSourceIds.has(source.sourceId)) return source;
+    return {
+      ...source,
+      retention: "retained"
+    };
+  });
+  return writeInsightStudy({ ...study, sources });
+}
+function studySummary(study) {
+  const validationCounts = Object.fromEntries(
+    ["corroborated", "contested", "single-source", "rejected", "unverifiable"].map((value) => [
+      value,
+      study.insights.filter((insight2) => insight2.validation === value).length
+    ])
+  );
+  return {
+    studyId: study.studyId,
+    status: study.status,
+    requestedAnalysisMode: study.requestedAnalysisMode,
+    actualAnalysisMode: study.actualAnalysisMode,
+    sourceCount: study.sources.length,
+    insightCount: study.insights.length,
+    validationCounts,
+    domainCount: study.domainPlans.length,
+    planHash: study.planHash,
+    approval: study.approval ? { approvedDomainIds: study.approval.approvedDomainIds, planHash: study.approval.planHash, approvedAt: study.approval.approvedAt } : void 0,
+    jira: study.jira,
+    closedAt: study.closedAt,
+    closeReason: study.closeReason
+  };
+}
+function emit(json, payload, text) {
+  if (json) console.log(JSON.stringify(payload, null, 2));
+  else text();
+}
+function reviewDomainPlan(plan) {
+  return {
+    domainId: plan.domainId,
+    domain: plan.domain,
+    outcome: plan.outcome,
+    acceptedInsightIds: plan.acceptedInsightIds,
+    contestedInsightIds: plan.contestedInsightIds,
+    rejectedInsightIds: plan.rejectedInsightIds,
+    deduplicationEvidence: plan.deduplicationEvidence,
+    selectedVerb: plan.selectedVerb,
+    proposedChanges: plan.proposedChanges,
+    provenanceObligations: plan.provenanceObligations,
+    licenseObligations: plan.licenseObligations,
+    privacyObligations: plan.privacyObligations,
+    securityObligations: plan.securityObligations,
+    dependencies: plan.dependencies,
+    acceptanceTests: plan.acceptanceTests,
+    measurement: plan.measurement,
+    rollbackMechanism: plan.rollbackMechanism,
+    rollbackTrigger: plan.rollbackTrigger,
+    workItems: plan.workItems,
+    nonGoals: plan.nonGoals
+  };
+}
+function runStudyHandoff(config, studyId, instruction, json) {
+  runHandoff(config, getStudyDir(studyId), {
+    promptAsset: WORKFLOW_ASSET,
+    instruction,
+    targetLabel: "Study path",
+    log: json ? console.error : console.log
+  });
+}
+async function insightAnalyze(sourceArgs = [], options = {}) {
+  requireProFeature2();
+  const config = loadConfig();
+  const inputs = collectSourceInputs(sourceArgs, options);
+  const skillMapPath = options.skillMap ? resolvePath10(options.skillMap) : void 0;
+  if (options.skillMapCoverage !== void 0 && skillMapPath === void 0) {
+    throw new UserError("--skill-map-coverage requires --skill-map");
+  }
+  const inventory = buildInsightInventory(config, {
+    skillMapPath,
+    skillMapCoverage: options.skillMapCoverage
+  });
+  const normalized = normalizeSources(inputs);
+  let study = createInsightStudy({
+    sources: normalized.sources,
+    sourceInventoryHash: normalized.sourceInventoryHash,
+    requestedAnalysisMode: options.analysisMode ?? "independent"
+  });
+  study = writeInsightStudy({ ...study, capabilityInventoryHash: inventory.capabilityInventoryHash });
+  writeCommandContext(study.studyId, skillMapPath, options.skillMapCoverage, inventory);
+  if (options.retainSourceCopies) study = retainObservedSources(study, normalized.observedFiles);
+  appendStudyEvent(study.studyId, {
+    type: "study-created",
+    detail: {
+      sourceCount: study.sources.length,
+      requestedAnalysisMode: study.requestedAnalysisMode,
+      retainedLocalSources: options.retainSourceCopies === true,
+      inventoryCoverage: inventory.coverage
+    }
+  });
+  emit(options.json, { ...studySummary(study), inventory: {
+    coverage: inventory.coverage,
+    coverageReason: inventory.coverageReason,
+    installedCapabilityCount: inventory.installedCapabilityCount,
+    mapCapabilityCount: inventory.mapCapabilityCount
+  } }, () => {
+    console.log(`[skill-forge] created insight study ${study.studyId}`);
+    console.log(`  sources: ${study.sources.length}; inventory: ${inventory.coverage}`);
+    console.log(`  study:   ${getStudyDir(study.studyId)}`);
+    console.log(`  next:    skill-forge insight submit ${study.studyId} --file <analysis.json>`);
+  });
+  if (options.handoff) {
+    runStudyHandoff(
+      config,
+      study.studyId,
+      "Read {prompt}. Analyze the untrusted source study at {path}. Write candidate JSON outside the study and import it only through `skill-forge insight submit`. Never approve the study, call Jira, or mutate a capability.",
+      options.json
+    );
+  }
+}
+async function insightSubmit(studyId, options) {
+  requireProFeature2();
+  const { study, inventory } = readCurrentStudy(studyId);
+  const sourceIssue = validateCurrentSourceFingerprints(study)[0];
+  if (sourceIssue) throw new UserError(sourceIssue.message);
+  const candidate = parseJsonFile(options.file, "insight analysis submission");
+  const next = writeInsightStudy(validateInsightSubmission(study, candidate, inventory));
+  appendStudyEvent(studyId, { type: "analysis-submitted", detail: { planHash: next.planHash } });
+  emit(options.json, studySummary(next), () => {
+    console.log(`[skill-forge] imported analysis for ${studyId}`);
+    console.log(`  plan hash: ${next.planHash}`);
+    console.log(`  next: skill-forge insight review ${studyId}`);
+  });
+}
+async function insightReview(studyId, options = {}) {
+  requireProFeature2();
+  const { study, inventory } = readCurrentStudy(studyId);
+  const validation = validateStudyForReview(study, inventory);
+  if (options.json) {
+    const payload = {
+      ...studySummary(study),
+      validation,
+      inventory: {
+        coverage: inventory.coverage,
+        coverageReason: inventory.coverageReason,
+        installedCapabilityCount: inventory.installedCapabilityCount,
+        mapCapabilityCount: inventory.mapCapabilityCount
+      },
+      domainPlans: study.domainPlans.map(reviewDomainPlan)
+    };
+    assertExportSafe(payload, study, "insight review JSON");
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log(renderInsightReview(study, inventory, validation));
+}
+async function insightApprove(studyId, options = {}) {
+  requireProFeature2();
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new UserError(
+      "insight approve is human-only and requires an interactive terminal; there is deliberately no --yes option"
+    );
+  }
+  const { study, inventory } = readCurrentStudy(studyId);
+  if (study.status !== "review-ready") {
+    throw new UserError(`study ${studyId} is ${study.status} and cannot be approved`);
+  }
+  const validation = validateStudyForReview(study, inventory);
+  if (!validation.valid) {
+    throw new UserError(`study ${studyId} is not ready for approval: ${validation.blockers.map((issue) => issue.message).join("; ")}`);
+  }
+  if (!study.capabilityInventoryHash) throw new UserError(`study ${studyId} has no capability inventory hash`);
+  const knownDomains = new Set(study.domainPlans.map((plan) => plan.domainId));
+  const requested = options.domain ?? [];
+  const approvedDomainIds = requested.length > 0 ? [...new Set(requested)] : [...knownDomains];
+  const unknown = approvedDomainIds.filter((id) => !knownDomains.has(id));
+  if (unknown.length > 0) throw new UserError(`unknown domain id(s): ${unknown.join(", ")}`);
+  if (approvedDomainIds.length === 0) throw new UserError(`study ${studyId} has no domain plans to approve`);
+  console.log(renderInsightReview(study, inventory, validation));
+  console.log("\nSelected domain plans:");
+  for (const plan of study.domainPlans.filter((candidate) => approvedDomainIds.includes(candidate.domainId))) {
+    console.log(renderDomainPlan(plan));
+  }
+  console.log(`
+Exact plan hash: ${validation.planHash}`);
+  const rl = createInterface6({ input: process.stdin, output: process.stdout });
+  let confirmed = false;
+  try {
+    const answer = (await rl.question("Approve this exact plan hash and selected domains? [y/N] ")).trim().toLowerCase();
+    confirmed = answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+  if (!confirmed) {
+    console.log(`[skill-forge] study ${studyId} was not approved.`);
+    return;
+  }
+  const approvedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const approval = {
+    approvedDomainIds,
+    planHash: validation.planHash,
+    approvedAt,
+    sourceInventoryHash: study.sourceInventoryHash,
+    capabilityInventoryHash: study.capabilityInventoryHash,
+    acceptedExceptions: validation.warnings.map((issue) => `${issue.code}: ${issue.message}`)
+  };
+  const next = writeInsightStudy({ ...study, status: "approved", planHash: validation.planHash, approval, jira: void 0 });
+  appendStudyEvent(studyId, {
+    type: "plan-approved",
+    occurredAt: approvedAt,
+    detail: { planHash: validation.planHash, approvedDomainIds }
+  });
+  console.log(`[skill-forge] approved ${approvedDomainIds.length} domain plan(s) for ${next.studyId}`);
+  console.log(`  plan hash: ${validation.planHash}`);
+}
+async function insightJira(studyId, options) {
+  requireProFeature2();
+  const localMode = options.receipt !== void 0 || options.resume === true;
+  if (options.receipt !== void 0 && options.resume === true) {
+    throw new UserError("--receipt and --resume are mutually exclusive");
+  }
+  if (localMode && (options.project !== void 0 || options.out !== void 0 || options.handoff === true)) {
+    throw new UserError("--receipt and --resume cannot be combined with --project, --out, or --handoff");
+  }
+  const projectKey = localMode ? void 0 : nonEmptyString(options.project, "--project").trim();
+  const { study, inventory, config } = readCurrentStudy(studyId);
+  const validation = validateStudyForReview(study, inventory);
+  if (!validation.valid) {
+    throw new UserError(`study ${studyId} cannot generate a Jira manifest: ${validation.blockers.map((issue) => issue.message).join("; ")}`);
+  }
+  if (localMode) {
+    const privatePath2 = join32(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
+    const manifest2 = assertCurrentJiraManifest(study, parseJsonFile(privatePath2, "stored Jira manifest"));
+    const receipt = options.receipt === void 0 ? void 0 : appendJiraReceipt(studyId, manifest2, parseJiraReceiptInput(parseJsonFile(options.receipt, "Jira receipt import")));
+    const resume = buildJiraResumeState(manifest2, readJiraReceipts(studyId, manifest2));
+    emit(options.json, receipt ? { receipt, resume } : resume, () => {
+      if (receipt) console.log(`[skill-forge] recorded Jira receipt ${receipt.eventId} for ${studyId}`);
+      console.log(`[skill-forge] Jira resume state for ${studyId}: ${resume.nextAction}`);
+      console.log(`  complete: ${resume.complete ? "yes" : "no"}`);
+    });
+    return;
+  }
+  const manifest = buildJiraManifest(study, projectKey);
+  const privatePath = join32(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
+  writeJsonAtomic(privatePath, manifest);
+  if (options.out) {
+    writeNewFile(resolvePath10(options.out), `${JSON.stringify(manifest, null, 2)}
+`, "--out");
+  }
+  const generatedAt = manifest.generatedAt;
+  const manifestHash = stableHash(manifest);
+  const next = writeInsightStudy({
+    ...study,
+    status: "jira-manifested",
+    jira: { projectKey: manifest.projectKey, manifestHash, generatedAt }
+  });
+  appendStudyEvent(studyId, {
+    type: "jira-manifest-generated",
+    occurredAt: generatedAt,
+    detail: { projectKey: manifest.projectKey, manifestHash, workItemCount: manifest.workItems.length }
+  });
+  emit(options.json, manifest, () => {
+    console.log(`[skill-forge] wrote Jira manifest for ${next.studyId}`);
+    console.log(`  manifest: ${privatePath}`);
+    if (options.out) console.log(`  export:   ${resolvePath10(options.out)}`);
+    console.log("  no Jira issues were created.");
+  });
+  if (options.handoff) {
+    runStudyHandoff(
+      config,
+      studyId,
+      "Read {prompt}. Present the approved Jira manifest in the private study at {path}, resolve live project metadata and every idempotency marker, then obtain literal human confirmation before any Jira write. Never approve the plan or mutate a capability.",
+      options.json
+    );
+  }
+}
+async function insightStatus(studyId, options = {}) {
+  requireProFeature2();
+  const study = readInsightStudy(studyId);
+  const summary = studySummary(study);
+  emit(options.json, summary, () => {
+    console.log(`[skill-forge] insight study ${sanitizeRenderedText(studyId)}`);
+    console.log(`  status:   ${study.status}`);
+    console.log(`  sources:  ${study.sources.length}`);
+    console.log(`  insights: ${study.insights.length}`);
+    console.log(`  domains:  ${study.domainPlans.length}`);
+    console.log(`  plan:     ${study.planHash ?? "not submitted"}`);
+    console.log(`  approval: ${study.approval ? `${study.approval.approvedAt} (${study.approval.approvedDomainIds.length} domain(s))` : "none"}`);
+    console.log(`  Jira:     ${study.jira ? `manifest for ${sanitizeRenderedText(study.jira.projectKey)}; issues not asserted` : "no manifest"}`);
+  });
+}
+async function insightClose(studyId, options) {
+  requireProFeature2();
+  if (options.status !== "dismissed" && options.status !== "archived") {
+    throw new UserError(`--status must be dismissed or archived`);
+  }
+  const study = readInsightStudy(studyId);
+  if (study.status === "dismissed" || study.status === "archived") {
+    throw new UserError(`study ${studyId} is already ${study.status}`);
+  }
+  const closedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const next = writeInsightStudy({
+    ...study,
+    status: options.status,
+    approval: void 0,
+    jira: void 0,
+    closedAt,
+    closeReason: `closed by insight close --status ${options.status}`
+  });
+  appendStudyEvent(studyId, { type: "study-closed", occurredAt: closedAt, detail: { status: options.status } });
+  console.log(`[skill-forge] ${next.studyId} closed as ${next.status}; append-only receipts were preserved.`);
+}
+
+// src/commands/refine.ts
+import { createHash as createHash8, randomUUID as randomUUID5 } from "crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync29, lstatSync as lstatSync7, mkdirSync as mkdirSync11, readFileSync as readFileSync24, realpathSync as realpathSync10, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname15, isAbsolute as isAbsolute8, join as join35, relative as relative7, resolve as resolvePath13, sep as sep6 } from "path";
+import { createInterface as createInterface7 } from "readline/promises";
+
+// src/refine/context.ts
+import { existsSync as existsSync28, realpathSync as realpathSync9, statSync as statSync13 } from "fs";
+import { isAbsolute as isAbsolute7, join as join34, relative as relative6, resolve as resolvePath12 } from "path";
+
+// src/refine/models.ts
+import { randomBytes } from "crypto";
+var REFINEMENT_CATEGORIES = ["trigger", "content", "hook", "tool", "pattern", "config", "new"];
+var OVERRIDE_TYPES = ["patch", "extend", "config", "full", "hook", "script", "new"];
+var PATCH_ACTIONS = ["append", "prepend", "replace-section", "insert-after", "insert-before", "delete-section"];
+var PATTERN_STATUSES = ["tracking", "ready", "generalized", "dismissed"];
+function isRefinementCategory(value) {
+  return REFINEMENT_CATEGORIES.includes(value);
+}
+function isOverrideType(value) {
+  return OVERRIDE_TYPES.includes(value);
+}
+function isPatchAction(value) {
+  return PATCH_ACTIONS.includes(value);
+}
+function isPatternStatus(value) {
+  return PATTERN_STATUSES.includes(value);
+}
+var REFINEMENT_STATUSES = ["pending", "applied", "generalized"];
+function isRefinementStatus(value) {
+  return REFINEMENT_STATUSES.includes(value);
+}
+function patternCount(pattern) {
+  return new Set(pattern.occurrences.map((o) => o.projectRealpath)).size;
+}
+function defaultRandomHex() {
+  return randomBytes(2).toString("hex");
+}
+function formatYYYYMMDD(date) {
+  const yyyy = date.getUTCFullYear().toString().padStart(4, "0");
+  const mm = (date.getUTCMonth() + 1).toString().padStart(2, "0");
+  const dd = date.getUTCDate().toString().padStart(2, "0");
+  return `${yyyy}${mm}${dd}`;
+}
+function generateRefinementId(existingIds = /* @__PURE__ */ new Set(), now = /* @__PURE__ */ new Date(), randomHex = defaultRandomHex) {
+  const datePart = formatYYYYMMDD(now);
+  let id;
+  do {
+    id = `REF-${datePart}-${randomHex()}`;
+  } while (existingIds.has(id));
+  return id;
+}
+function generatePatternId(existingIds = /* @__PURE__ */ new Set(), randomHex = defaultRandomHex) {
+  let id;
+  do {
+    id = `PAT-${randomHex()}`;
+  } while (existingIds.has(id));
+  return id;
+}
+function fingerprintKey(skill, target, overrideType, action) {
+  const normalize = (s) => s.trim().toLowerCase().replace(/\s+/g, " ");
+  return [normalize(skill), normalize(target), overrideType, action ?? ""].join("::");
+}
+function contentSimilarity(a, b) {
+  const tokenize3 = (s) => new Set(s.toLowerCase().split(/\s+/).filter(Boolean));
+  const tokensA = tokenize3(a);
+  const tokensB = tokenize3(b);
+  if (tokensA.size === 0 || tokensB.size === 0) return 0;
+  let intersectionSize = 0;
+  for (const token of tokensA) {
+    if (tokensB.has(token)) intersectionSize++;
+  }
+  const unionSize3 = tokensA.size + tokensB.size - intersectionSize;
+  return unionSize3 === 0 ? 0 : intersectionSize / unionSize3;
+}
+
+// src/refine/store.ts
+import { createHash as createHash7 } from "crypto";
+import { existsSync as existsSync27, readFileSync as readFileSync23, statSync as statSync12, realpathSync as realpathSync8 } from "fs";
+import { join as join33, resolve as resolvePath11 } from "path";
+var SIMILARITY_JOIN_THRESHOLD = 0.7;
+var READY_THRESHOLD = 2;
+function getRefinementsDir() {
+  return join33(getHomeDir(), "refinements");
+}
+function getRefinementsPath() {
+  return join33(getRefinementsDir(), "refinements.json");
+}
+function getPatternsPath() {
+  return join33(getRefinementsDir(), "patterns.json");
+}
+function getBackupsDir() {
+  return join33(getRefinementsDir(), "backups");
+}
+function readJsonFile(path, label2) {
+  let raw;
+  try {
+    raw = readFileSync23(path, "utf-8");
+  } catch (err) {
+    throw new UserError(`unable to read ${label2} at ${path}: ${err.message}`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new UserError(`malformed ${label2} at ${path}: not valid JSON`);
+  }
+}
+function readStore(path, label2, validateRecord) {
+  if (!existsSync27(path)) {
+    return { schemaVersion: 1, records: [] };
+  }
+  const parsed = readJsonFile(path, label2);
+  if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.records)) {
+    throw new UserError(`malformed ${label2} at ${path}: expected an object with a "records" array`);
+  }
+  const records = parsed.records;
+  if (validateRecord) {
+    records.forEach((record, index) => validateRecord(record, index));
+  }
+  return { schemaVersion: 1, records };
+}
+function validateRefinementRecordShape(record, index, path) {
+  if (typeof record !== "object" || record === null) {
+    throw new UserError(`malformed refinements.json at ${path}: record[${index}] is not an object`);
+  }
+  const r = record;
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    throw new UserError(`malformed refinements.json at ${path}: record[${index}] is missing a valid "id"`);
+  }
+  if (typeof r.createdAt !== "string" || r.createdAt.length === 0) {
+    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "createdAt"`);
+  }
+  if (typeof r.status !== "string" || r.status.length === 0) {
+    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "status"`);
+  }
+  if (typeof r.skill !== "string" || r.skill.length === 0) {
+    throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" is missing a valid "skill"`);
+  }
+  const patchActionsRequiringMarker = /* @__PURE__ */ new Set(["insert-after", "insert-before", "replace-section", "delete-section"]);
+  if (r.overrideType === "patch") {
+    if (typeof r.patchAction !== "string" || r.patchAction.length === 0) {
+      throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" has overrideType "patch" but is missing "patchAction"`);
+    }
+    if (patchActionsRequiringMarker.has(r.patchAction) && (typeof r.patchMarker !== "string" || r.patchMarker.length === 0)) {
+      throw new UserError(
+        `malformed refinements.json at ${path}: record "${r.id}" has patchAction "${r.patchAction}" but is missing "patchMarker"`
+      );
+    }
+    if (typeof r.patchContent !== "string" || r.patchContent.length === 0) {
+      throw new UserError(`malformed refinements.json at ${path}: record "${r.id}" has overrideType "patch" but is missing "patchContent"`);
+    }
+  } else if (r.patchAction !== void 0) {
+    throw new UserError(
+      `malformed refinements.json at ${path}: record "${r.id}" has overrideType "${String(r.overrideType)}" but carries "patchAction" \u2014 only valid when overrideType is "patch"`
+    );
+  }
+}
+function validatePatternRecordShape(record, index, path) {
+  if (typeof record !== "object" || record === null) {
+    throw new UserError(`malformed patterns.json at ${path}: record[${index}] is not an object`);
+  }
+  const p = record;
+  if (typeof p.id !== "string" || p.id.length === 0) {
+    throw new UserError(`malformed patterns.json at ${path}: record[${index}] is missing a valid "id"`);
+  }
+  if (typeof p.status !== "string" || p.status.length === 0) {
+    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" is missing a valid "status"`);
+  }
+  if (!Array.isArray(p.occurrences)) {
+    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" is missing a valid "occurrences" array`);
+  }
+  if (p.status === "dismissed" && (typeof p.dismissedReason !== "string" || p.dismissedReason.length === 0)) {
+    throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "dismissed" but is missing "dismissedReason"`);
+  }
+  if (p.status === "generalized") {
+    if (typeof p.generalizedAt !== "string" || p.generalizedAt.length === 0) {
+      throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "generalized" but is missing "generalizedAt"`);
+    }
+    if (typeof p.generalizedBackupId !== "string" || p.generalizedBackupId.length === 0) {
+      throw new UserError(`malformed patterns.json at ${path}: record "${p.id}" has status "generalized" but is missing "generalizedBackupId"`);
+    }
+  }
+}
+function readRefinementsStore() {
+  const path = getRefinementsPath();
+  return readStore(path, "refinements.json", (record, index) => validateRefinementRecordShape(record, index, path));
+}
+function writeRefinementsStore(store) {
+  writeJsonAtomic(getRefinementsPath(), store);
 }
 function readPatternsStore() {
   const path = getPatternsPath();
@@ -7402,9 +10170,9 @@ function writePatternsStore(store) {
   writeJsonAtomic(getPatternsPath(), store);
 }
 function resolveProjectRealpath(projectRoot) {
-  const resolved = resolvePath10(projectRoot);
+  const resolved = resolvePath11(projectRoot);
   try {
-    return realpathSync7(resolved);
+    return realpathSync8(resolved);
   } catch {
     return resolved;
   }
@@ -7536,16 +10304,16 @@ function createBackup(filePaths, deps = {}) {
   const randomHex = deps.randomHex ?? defaultRandomHex;
   const id = `${formatBackupTimestamp(now)}-${randomHex()}`;
   const files = filePaths.map((path) => {
-    if (!existsSync25(path)) {
+    if (!existsSync27(path)) {
       return { path, existed: false, sha256: null, mode: null, contentBase64: null };
     }
-    const bytes = readFileSync19(path);
-    const mode = statSync11(path).mode & 511;
-    const sha2562 = createHash5("sha256").update(bytes).digest("hex");
+    const bytes = readFileSync23(path);
+    const mode = statSync12(path).mode & 511;
+    const sha2562 = createHash7("sha256").update(bytes).digest("hex");
     return { path, existed: true, sha256: sha2562, mode, contentBase64: bytes.toString("base64") };
   });
   const manifest = { id, createdAt: now.toISOString(), files };
-  writeJsonAtomic(join28(getBackupsDir(), id, "manifest.json"), manifest);
+  writeJsonAtomic(join33(getBackupsDir(), id, "manifest.json"), manifest);
   return manifest;
 }
 function validateBackupManifestShape(value, path) {
@@ -7594,8 +10362,8 @@ function readBackupManifest(id) {
   if (!isValidBackupId(id)) {
     throw new UserError(`invalid backup id "${id}" \u2014 expected the format produced by \`skill-forge refine promote\` (e.g. 20260720T142305Z-a1b2)`);
   }
-  const manifestPath = join28(getBackupsDir(), id, "manifest.json");
-  if (!existsSync25(manifestPath)) {
+  const manifestPath = join33(getBackupsDir(), id, "manifest.json");
+  if (!existsSync27(manifestPath)) {
     throw new UserError(`no backup with id: ${id}`);
   }
   const parsed = readJsonFile(manifestPath, "backup manifest");
@@ -7605,7 +10373,7 @@ function readBackupManifest(id) {
 
 // src/refine/context.ts
 function resolveConfiguredRoot2(root) {
-  return resolvePath11(expandHome(root));
+  return resolvePath12(expandHome(root));
 }
 function assertPlainSkillName(name) {
   if (!name || name.trim().length === 0) {
@@ -7617,32 +10385,32 @@ function assertPlainSkillName(name) {
 }
 function realpathOrNull2(p) {
   try {
-    return realpathSync8(p);
+    return realpathSync9(p);
   } catch {
     return null;
   }
 }
 function isUnderRoot2(candidate, root) {
-  const rel = relative3(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+  const rel = relative6(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute7(rel);
 }
 function resolveScopes(config, cwd, skill, userRootFlag) {
   assertPlainSkillName(skill);
-  const resolvedCwd = resolvePath11(cwd);
-  const localDir = join29(resolvedCwd, ".claude", "skills", skill);
-  const sharedDir = join29(resolvedCwd, "skills", skill);
-  const local = { scope: "local", dir: localDir, exists: existsSync26(localDir) };
-  const shared = { scope: "shared", dir: sharedDir, exists: existsSync26(sharedDir) };
+  const resolvedCwd = resolvePath12(cwd);
+  const localDir = join34(resolvedCwd, ".claude", "skills", skill);
+  const sharedDir = join34(resolvedCwd, "skills", skill);
+  const local = { scope: "local", dir: localDir, exists: existsSync28(localDir) };
+  const shared = { scope: "shared", dir: sharedDir, exists: existsSync28(sharedDir) };
   const user = resolveUserScope(config, resolvedCwd, skill, userRootFlag);
   return { local, shared, user };
 }
 function resolveUserScope(config, resolvedCwd, skill, userRootFlag) {
   if (userRootFlag) {
-    const root = resolvePath11(userRootFlag);
-    return { resolved: true, dir: join29(root, skill), root: userRootFlag, reason: "flag" };
+    const root = resolvePath12(userRootFlag);
+    return { resolved: true, dir: join34(root, skill), root: userRootFlag, reason: "flag" };
   }
   const cwdReal = realpathOrNull2(resolvedCwd) ?? resolvedCwd;
-  const candidates = config.skillsRoots.map((root) => ({ root, dir: join29(resolveConfiguredRoot2(root), skill) }));
+  const candidates = config.skillsRoots.map((root) => ({ root, dir: join34(resolveConfiguredRoot2(root), skill) }));
   for (const candidate of candidates) {
     const skillReal = realpathOrNull2(candidate.dir);
     if (skillReal) {
@@ -7660,14 +10428,14 @@ function resolveUserScope(config, resolvedCwd, skill, userRootFlag) {
 }
 function isFile2(p) {
   try {
-    return statSync12(p).isFile();
+    return statSync13(p).isFile();
   } catch {
     return false;
   }
 }
 function isDirectory(p) {
   try {
-    return statSync12(p).isDirectory();
+    return statSync13(p).isDirectory();
   } catch {
     return false;
   }
@@ -7677,12 +10445,12 @@ function inventoryScopeDir(scope, dir) {
     scope,
     dir,
     dirExists: isDirectory(dir),
-    skillMd: isFile2(join29(dir, "SKILL.md")),
-    patchMd: isFile2(join29(dir, "SKILL.patch.md")),
-    extendMd: isFile2(join29(dir, "SKILL.extend.md")),
-    configJson: isFile2(join29(dir, "skill-config.json")),
-    hooksDir: isDirectory(join29(dir, "hooks")),
-    scriptsDir: isDirectory(join29(dir, "scripts"))
+    skillMd: isFile2(join34(dir, "SKILL.md")),
+    patchMd: isFile2(join34(dir, "SKILL.patch.md")),
+    extendMd: isFile2(join34(dir, "SKILL.extend.md")),
+    configJson: isFile2(join34(dir, "skill-config.json")),
+    hooksDir: isDirectory(join34(dir, "hooks")),
+    scriptsDir: isDirectory(join34(dir, "scripts"))
   };
 }
 function inventoryAllScopes(resolution) {
@@ -7915,10 +10683,10 @@ function previewDiff(before, after, path) {
 }
 
 // src/commands/refine.ts
-var PRO_FEATURE_LABEL8 = "skill refinement";
+var PRO_FEATURE_LABEL9 = "skill refinement";
 var REFINE_PROMPT_ASSET = "refine-prompt.md";
-function requireProFeature2() {
-  const status2 = proFeatureStatus(PRO_FEATURE_LABEL8);
+function requireProFeature3() {
+  const status2 = proFeatureStatus(PRO_FEATURE_LABEL9);
   if (!status2.enabled) {
     throw new UserError(status2.notice ?? "refine is a Pro feature \u2014 set SKILL_FORGE_LICENSE or config.licenseKey to a valid license to unlock.");
   }
@@ -7927,7 +10695,7 @@ function requireProFeature2() {
 function isInteractive(json) {
   return !json && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
 }
-function emit(json, payload, renderText) {
+function emit2(json, payload, renderText) {
   if (json) {
     console.log(JSON.stringify(payload, null, 2));
   } else {
@@ -7943,7 +10711,7 @@ async function confirmWrite(yes, json, prompt) {
   if (!isInteractive(json)) {
     throw new UserError("refusing to write without confirmation \u2014 pass --yes, or run interactively.");
   }
-  const rl = createInterface6({ input: process.stdin, output: process.stdout });
+  const rl = createInterface7({ input: process.stdin, output: process.stdout });
   try {
     return await confirmYesNo(rl, prompt);
   } finally {
@@ -7951,18 +10719,18 @@ async function confirmWrite(yes, json, prompt) {
   }
 }
 function resolveConfiguredRoot3(root) {
-  return resolvePath12(expandHome(root));
+  return resolvePath13(expandHome(root));
 }
 function isUnderRoot3(candidate, root) {
-  const rel = relative4(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  const rel = relative7(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute8(rel);
 }
 function sanitizeDiffForConsole(diff) {
   return diff.split("\n").map((line) => sanitizeForMarkdown(line)).join("\n");
 }
 function resolveContentOption(options) {
   if (options.content !== void 0) return options.content;
-  if (options.contentFile) return readFileSync20(resolvePath12(options.contentFile), "utf-8");
+  if (options.contentFile) return readFileSync24(resolvePath13(options.contentFile), "utf-8");
   return void 0;
 }
 function validateCaptureOptions(options) {
@@ -8088,19 +10856,19 @@ ${rendered}` : rendered;
 function ensureScopeDirSafe(scopeDir, resolvedCwd) {
   let lst;
   try {
-    lst = lstatSync4(scopeDir);
+    lst = lstatSync7(scopeDir);
   } catch {
     lst = void 0;
   }
   if (lst?.isSymbolicLink()) {
     throw new UserError(`refusing to write under ${scopeDir}: scope directory is a symlink`);
   }
-  mkdirSync9(scopeDir, { recursive: true });
+  mkdirSync11(scopeDir, { recursive: true });
   const real = resolveConfiguredRoot3(scopeDir);
-  const lexical = resolvePath12(scopeDir);
+  const lexical = resolvePath13(scopeDir);
   let realResolved;
   try {
-    realResolved = realpathSync9(scopeDir);
+    realResolved = realpathSync10(scopeDir);
   } catch {
     realResolved = real;
   }
@@ -8114,28 +10882,28 @@ function ensureScopeDirSafe(scopeDir, resolvedCwd) {
 }
 function writeOverrideFile(scopeDir, relPath, content, resolvedCwd) {
   const realScopeDir = ensureScopeDirSafe(scopeDir, resolvedCwd);
-  const destPath = join30(scopeDir, relPath);
-  const destDir = dirname14(destPath);
-  mkdirSync9(destDir, { recursive: true });
-  const realDestDir = realpathSync9(destDir);
+  const destPath = join35(scopeDir, relPath);
+  const destDir = dirname15(destPath);
+  mkdirSync11(destDir, { recursive: true });
+  const realDestDir = realpathSync10(destDir);
   if (!isUnderRoot3(realDestDir, realScopeDir)) {
     throw new UserError(`refusing to write ${destPath}: resolves outside scope directory ${scopeDir}`);
   }
   let destLst;
   try {
-    destLst = lstatSync4(destPath);
+    destLst = lstatSync7(destPath);
   } catch {
     destLst = void 0;
   }
   if (destLst?.isSymbolicLink()) {
     throw new UserError(`refusing to write ${destPath}: destination is a symlink`);
   }
-  writeFileSync9(destPath, content, { mode: 384 });
-  chmodSync(destPath, 384);
+  writeFileSync10(destPath, content, { mode: 384 });
+  chmodSync4(destPath, 384);
   return destPath;
 }
 async function refineCaptureCommand(rawOptions = {}) {
-  requireProFeature2();
+  requireProFeature3();
   const opts = validateCaptureOptions(rawOptions);
   const config = loadConfig();
   const cwd = process.cwd();
@@ -8147,7 +10915,7 @@ async function refineCaptureCommand(rawOptions = {}) {
   const refinementId = generateRefinementId(existingIds, now, defaultRandomHex);
   const preview = renderCaptureArtifactPreview(opts, content, refinementId, now.toISOString(), scopeDir);
   if (opts.dryRun) {
-    emit(opts.json, { dryRun: true, path: preview.destPath, diff: preview.diff }, () => {
+    emit2(opts.json, { dryRun: true, path: preview.destPath, diff: preview.diff }, () => {
       console.log(`[skill-forge] refine capture \u2014 ${opts.overrideType} override for "${sanitizeForMarkdown(opts.skill)}" at ${opts.scope} scope`);
       console.log(sanitizeDiffForConsole(preview.diff));
     });
@@ -8160,7 +10928,7 @@ async function refineCaptureCommand(rawOptions = {}) {
   const proceed = await confirmWrite(opts.yes, opts.json, `
 Write ${preview.destPath}? [y/N] `);
   if (!proceed) {
-    emit(opts.json, { written: false, cancelled: true, path: preview.destPath }, () => {
+    emit2(opts.json, { written: false, cancelled: true, path: preview.destPath }, () => {
       console.log("[skill-forge] capture cancelled \u2014 nothing written.");
     });
     return;
@@ -8193,7 +10961,7 @@ Write ${preview.destPath}? [y/N] `);
   } catch (err) {
     throw new UserError(`wrote the override artifact at ${writtenPath}, but recording the refinement in the store failed: ${err.message}`);
   }
-  emit(
+  emit2(
     opts.json,
     { written: true, path: writtenPath, refinementId: result.refinement.id, patternId: result.pattern.id, patternBecameReady: result.patternBecameReady },
     () => {
@@ -8210,21 +10978,21 @@ Write ${preview.destPath}? [y/N] `);
 }
 function renderCaptureArtifactPreview(opts, content, refinementId, generatedAt, scopeDir) {
   const probeRelPath = opts.overrideType === "patch" ? "SKILL.patch.md" : opts.overrideType === "extend" || opts.overrideType === "new" ? "SKILL.extend.md" : void 0;
-  const probePath = probeRelPath ? join30(scopeDir, probeRelPath) : void 0;
-  const existingContent = probePath && existsSync27(probePath) ? readFileSync20(probePath, "utf-8") : "";
+  const probePath = probeRelPath ? join35(scopeDir, probeRelPath) : void 0;
+  const existingContent = probePath && existsSync29(probePath) ? readFileSync24(probePath, "utf-8") : "";
   const rendered = renderCaptureArtifact(opts, content, refinementId, generatedAt, existingContent);
   const relPath = rendered.relPath;
-  const destPath = join30(scopeDir, relPath);
-  const before = existsSync27(destPath) ? readFileSync20(destPath, "utf-8") : "";
+  const destPath = join35(scopeDir, relPath);
+  const before = existsSync29(destPath) ? readFileSync24(destPath, "utf-8") : "";
   const diff = previewDiff(before, rendered.content, destPath);
   return { relPath, content: rendered.content, destPath, diff };
 }
 async function refineListCommand(options = {}) {
-  requireProFeature2();
+  requireProFeature3();
   const { records } = readRefinementsStore();
   let rows = records;
   if (options.skill) rows = rows.filter((r) => r.skill === options.skill);
-  if (options.project) rows = rows.filter((r) => r.project === options.project || r.projectRoot === resolvePath12(options.project));
+  if (options.project) rows = rows.filter((r) => r.project === options.project || r.projectRoot === resolvePath13(options.project));
   if (options.status) {
     if (!isRefinementStatus(options.status)) {
       throw new UserError("--status must be one of: pending, applied, generalized");
@@ -8232,7 +11000,7 @@ async function refineListCommand(options = {}) {
     rows = rows.filter((r) => r.status === options.status);
   }
   const filtered = Boolean(options.skill || options.project || options.status);
-  emit(options.json, { records: rows }, () => {
+  emit2(options.json, { records: rows }, () => {
     if (rows.length === 0) {
       if (filtered && records.length > 0) {
         console.log(`[skill-forge] no refinements match the given filter(s) (${records.length} total recorded).`);
@@ -8250,7 +11018,7 @@ async function refineListCommand(options = {}) {
   });
 }
 async function refinePatternsCommand(options = {}) {
-  requireProFeature2();
+  requireProFeature3();
   const { records } = readPatternsStore();
   let rows = records;
   if (options.status) {
@@ -8261,11 +11029,11 @@ async function refinePatternsCommand(options = {}) {
   }
   if (options.skill) rows = rows.filter((p) => p.affectedSkills.includes(options.skill));
   if (options.project) {
-    const resolvedProject = resolvePath12(options.project);
+    const resolvedProject = resolvePath13(options.project);
     rows = rows.filter((p) => p.occurrences.some((o) => o.projectRealpath === resolvedProject));
   }
   const filtered = Boolean(options.skill || options.project || options.status);
-  emit(options.json, { records: rows.map((p) => ({ ...p, count: patternCount(p) })) }, () => {
+  emit2(options.json, { records: rows.map((p) => ({ ...p, count: patternCount(p) })) }, () => {
     if (rows.length === 0) {
       if (filtered && records.length > 0) {
         console.log(`[skill-forge] no patterns match the given filter(s) (${records.length} total recorded).`);
@@ -8294,13 +11062,13 @@ function renderInventoryLine(row) {
   return `  [${row.scope}] ${row.dir}${row.dirExists ? "" : " (missing)"} \u2014 ${present.length > 0 ? present.join(", ") : "(no override files)"}`;
 }
 async function refineWhichCommand(skill, options = {}) {
-  requireProFeature2();
+  requireProFeature3();
   if (!skill) throw new UserError("a skill name is required: skill-forge refine which <skill>");
   const config = loadConfig();
   const cwd = process.cwd();
   const scopes = resolveScopes(config, cwd, skill, options.userRoot);
   const inventory = inventoryAllScopes(scopes);
-  emit(options.json, { scopes, inventory }, () => {
+  emit2(options.json, { scopes, inventory }, () => {
     console.log(`[skill-forge] refine which "${sanitizeForMarkdown(skill)}" \u2014 resolution order (highest precedence first):`);
     for (const row of inventory) console.log(renderInventoryLine(row));
     if (!scopes.user.resolved) {
@@ -8312,16 +11080,16 @@ async function refineWhichCommand(skill, options = {}) {
 }
 function writePostWriteSidecar(backupId, files) {
   const sidecar = { schemaVersion: 1, files };
-  const dir = join30(getBackupsDir(), backupId);
-  mkdirSync9(dir, { recursive: true });
-  writeFileSync9(join30(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
+  const dir = join35(getBackupsDir(), backupId);
+  mkdirSync11(dir, { recursive: true });
+  writeFileSync10(join35(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
 }
 function readPostWriteSidecar(backupId) {
-  const path = join30(getBackupsDir(), backupId, "post.json");
-  if (!existsSync27(path)) return { hashes: /* @__PURE__ */ new Map(), status: "missing" };
+  const path = join35(getBackupsDir(), backupId, "post.json");
+  if (!existsSync29(path)) return { hashes: /* @__PURE__ */ new Map(), status: "missing" };
   let raw;
   try {
-    raw = readFileSync20(path, "utf-8");
+    raw = readFileSync24(path, "utf-8");
   } catch {
     return { hashes: /* @__PURE__ */ new Map(), status: "unreadable" };
   }
@@ -8340,7 +11108,7 @@ function readPostWriteSidecar(backupId) {
   return { hashes, status: "ok" };
 }
 async function refinePromoteCommand(patternId, options = {}) {
-  requireProFeature2();
+  requireProFeature3();
   if (!patternId) throw new UserError("a pattern id is required: skill-forge refine promote <pattern-id>");
   const patternsStore = readPatternsStore();
   const pattern = patternsStore.records.find((p) => p.id === patternId);
@@ -8366,21 +11134,21 @@ async function refinePromoteCommand(patternId, options = {}) {
   const resolvedUserRoot = resolveConfiguredRoot3(scopes.user.root);
   let realUserRoot;
   try {
-    realUserRoot = realpathSync9(resolvedUserRoot);
+    realUserRoot = realpathSync10(resolvedUserRoot);
   } catch {
     realUserRoot = resolvedUserRoot;
   }
   let realSkillDir;
   try {
-    realSkillDir = realpathSync9(skillDir);
+    realSkillDir = realpathSync10(skillDir);
   } catch {
-    realSkillDir = resolvePath12(skillDir);
+    realSkillDir = resolvePath13(skillDir);
   }
   if (!isUnderRoot3(realSkillDir, realUserRoot)) {
     throw new UserError(`refusing to promote: resolved skill directory ${skillDir} is outside the configured user scope root ${scopes.user.root}`);
   }
-  const skillMdPath = join30(skillDir, "SKILL.md");
-  if (!existsSync27(skillMdPath)) {
+  const skillMdPath = join35(skillDir, "SKILL.md");
+  if (!existsSync29(skillMdPath)) {
     throw new UserError(`user-scope SKILL.md not found at ${skillMdPath} \u2014 refusing to promote against a missing base skill.`);
   }
   const refinementsStore = readRefinementsStore();
@@ -8397,11 +11165,11 @@ async function refinePromoteCommand(patternId, options = {}) {
       `pattern ${patternId}'s representative refinement is a '${representative.overrideType}' override \u2014 promote currently only materializes patch/extend/new-type patterns against the user-scope SKILL.md; other override types must be merged manually.`
     );
   }
-  const before = readFileSync20(skillMdPath, "utf-8");
+  const before = readFileSync24(skillMdPath, "utf-8");
   const after = applyPatchBlocks(before, [block]);
   const diff = previewDiff(before, after, skillMdPath);
   if (options.dryRun) {
-    emit(options.json, { dryRun: true, path: skillMdPath, diff }, () => {
+    emit2(options.json, { dryRun: true, path: skillMdPath, diff }, () => {
       console.log(`[skill-forge] refine promote ${patternId} -> ${skillMdPath}`);
       console.log(sanitizeDiffForConsole(diff));
     });
@@ -8414,7 +11182,7 @@ async function refinePromoteCommand(patternId, options = {}) {
   const proceed = await confirmWrite(options.yes, options.json, `
 Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
   if (!proceed) {
-    emit(options.json, { promoted: false, cancelled: true }, () => {
+    emit2(options.json, { promoted: false, cancelled: true }, () => {
       console.log("[skill-forge] promote cancelled \u2014 nothing written.");
     });
     return;
@@ -8422,14 +11190,14 @@ Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
   const backup = createBackup([skillMdPath]);
   const tempPath = `${skillMdPath}.tmp-${randomUUID5()}`;
   try {
-    writeFileSync9(tempPath, after, "utf-8");
+    writeFileSync10(tempPath, after, "utf-8");
     renameSync6(tempPath, skillMdPath);
   } catch (err) {
     rmSync9(tempPath, { force: true });
     throw err;
   }
   try {
-    const postSha256 = createHash6("sha256").update(readFileSync20(skillMdPath)).digest("hex");
+    const postSha256 = createHash8("sha256").update(readFileSync24(skillMdPath)).digest("hex");
     writePostWriteSidecar(backup.id, [{ path: skillMdPath, sha256: postSha256 }]);
     markGeneralized(patternId, backup.id);
     const skillsRoot = resolveConfiguredRoot3(scopes.user.root);
@@ -8449,31 +11217,31 @@ Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
       `the user-scope skill was updated at ${skillMdPath} (backup ${backup.id}), but recording post-write verification and/or pattern/provenance state failed: ${err.message}`
     );
   }
-  emit(options.json, { promoted: true, path: skillMdPath, backupId: backup.id }, () => {
+  emit2(options.json, { promoted: true, path: skillMdPath, backupId: backup.id }, () => {
     console.log(`[skill-forge] promoted pattern ${patternId} -> ${skillMdPath} (backup: ${backup.id})`);
   });
 }
 function assertBackupDirContained(backupId) {
   const backupsDir = getBackupsDir();
-  if (!existsSync27(backupsDir)) return;
-  const realBackupsDir = realpathSync9(backupsDir);
-  const backupDir = join30(backupsDir, backupId);
-  if (!existsSync27(backupDir)) return;
-  const realBackupDir = realpathSync9(backupDir);
+  if (!existsSync29(backupsDir)) return;
+  const realBackupsDir = realpathSync10(backupsDir);
+  const backupDir = join35(backupsDir, backupId);
+  if (!existsSync29(backupDir)) return;
+  const realBackupDir = realpathSync10(backupDir);
   if (!isUnderRoot3(realBackupDir, realBackupsDir)) {
     throw new UserError(`refusing rollback: backup id "${backupId}" resolves outside the backups directory`);
   }
 }
 function resolveTargetRealPath(path) {
-  let lexicalAncestor = resolvePath12(path);
+  let lexicalAncestor = resolvePath13(path);
   while (true) {
     try {
-      const real = realpathSync9(lexicalAncestor);
-      const remainder = relative4(lexicalAncestor, resolvePath12(path));
-      return remainder === "" ? real : join30(real, remainder);
+      const real = realpathSync10(lexicalAncestor);
+      const remainder = relative7(lexicalAncestor, resolvePath13(path));
+      return remainder === "" ? real : join35(real, remainder);
     } catch {
-      const parent = dirname14(lexicalAncestor);
-      if (parent === lexicalAncestor) return resolvePath12(path);
+      const parent = dirname15(lexicalAncestor);
+      if (parent === lexicalAncestor) return resolvePath13(path);
       lexicalAncestor = parent;
     }
   }
@@ -8485,7 +11253,7 @@ function assertManifestPathsWithinRoots(manifest, config) {
   const roots = config.skillsRoots.map((root) => {
     const resolved = resolveConfiguredRoot3(root);
     try {
-      return realpathSync9(resolved);
+      return realpathSync10(resolved);
     } catch {
       return resolved;
     }
@@ -8502,7 +11270,7 @@ function assertNoSymlinkLeaves(manifest) {
   for (const file of manifest.files) {
     let lst;
     try {
-      lst = lstatSync4(file.path);
+      lst = lstatSync7(file.path);
     } catch {
       lst = void 0;
     }
@@ -8512,14 +11280,14 @@ function assertNoSymlinkLeaves(manifest) {
   }
 }
 function findLexicalRoot(filePath, config) {
-  const lexicalTarget = resolvePath12(filePath);
+  const lexicalTarget = resolvePath13(filePath);
   for (const root of config.skillsRoots) {
     const rootLexical = resolveConfiguredRoot3(root);
-    const rel = relative4(rootLexical, lexicalTarget);
-    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute5(rel))) continue;
+    const rel = relative7(rootLexical, lexicalTarget);
+    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep6}`) || isAbsolute8(rel))) continue;
     let rootReal;
     try {
-      rootReal = realpathSync9(rootLexical);
+      rootReal = realpathSync10(rootLexical);
     } catch {
       rootReal = rootLexical;
     }
@@ -8529,8 +11297,8 @@ function findLexicalRoot(filePath, config) {
 }
 function walkRealComponents(filePath, config, createMissing) {
   const { rootLexical, rootReal } = findLexicalRoot(filePath, config);
-  const relPath = relative4(rootLexical, resolvePath12(filePath));
-  const components = relPath.split(sep4).filter((c) => c.length > 0);
+  const relPath = relative7(rootLexical, resolvePath13(filePath));
+  const components = relPath.split(sep6).filter((c) => c.length > 0);
   if (components.length === 0) {
     throw new UserError(`refusing to operate on ${filePath}: resolves to the skills root itself`);
   }
@@ -8539,10 +11307,10 @@ function walkRealComponents(filePath, config, createMissing) {
   let current = rootReal;
   for (const component of dirComponents) {
     if (current === void 0) break;
-    const next = join30(current, component);
+    const next = join35(current, component);
     let lst;
     try {
-      lst = lstatSync4(next);
+      lst = lstatSync7(next);
     } catch {
       lst = void 0;
     }
@@ -8551,7 +11319,7 @@ function walkRealComponents(filePath, config, createMissing) {
         current = void 0;
         continue;
       }
-      mkdirSync9(next);
+      mkdirSync11(next);
       current = next;
       continue;
     }
@@ -8570,13 +11338,13 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
   if (parentReal === void 0) {
     throw new UserError(`refusing to restore ${filePath}: could not establish a real parent directory`);
   }
-  const finalPath = join30(parentReal, leafComponent);
+  const finalPath = join35(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to restore ${filePath}: resolves outside root ${rootReal}`);
   }
   let leafLst;
   try {
-    leafLst = lstatSync4(finalPath);
+    leafLst = lstatSync7(finalPath);
   } catch {
     leafLst = void 0;
   }
@@ -8585,8 +11353,8 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
   }
   const tempPath = `${finalPath}.tmp-${randomUUID5()}`;
   try {
-    writeFileSync9(tempPath, contentBuffer);
-    chmodSync(tempPath, mode);
+    writeFileSync10(tempPath, contentBuffer);
+    chmodSync4(tempPath, mode);
     renameSync6(tempPath, finalPath);
   } catch (err) {
     rmSync9(tempPath, { force: true });
@@ -8596,13 +11364,13 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
 function safeDeleteTombstone(filePath, config) {
   const { parentReal, leafComponent, rootReal } = walkRealComponents(filePath, config, false);
   if (parentReal === void 0) return;
-  const finalPath = join30(parentReal, leafComponent);
+  const finalPath = join35(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to delete ${filePath}: resolves outside root ${rootReal}`);
   }
   let leafLst;
   try {
-    leafLst = lstatSync4(finalPath);
+    leafLst = lstatSync7(finalPath);
   } catch {
     leafLst = void 0;
   }
@@ -8613,7 +11381,7 @@ function safeDeleteTombstone(filePath, config) {
   rmSync9(finalPath, { force: true });
 }
 async function refineRollbackCommand(backupId, options = {}) {
-  requireProFeature2();
+  requireProFeature3();
   if (!backupId) throw new UserError("a backup id is required: skill-forge refine rollback <backup-id>");
   if (!isValidBackupId(backupId)) {
     throw new UserError(`invalid backup id "${backupId}" \u2014 expected the format produced by \`skill-forge refine promote\` (e.g. 20260720T142305Z-a1b2)`);
@@ -8638,7 +11406,7 @@ async function refineRollbackCommand(backupId, options = {}) {
   for (const file of manifest.files) {
     const expected = sidecar.hashes.get(file.path);
     if (expected === void 0) continue;
-    const currentSha256 = existsSync27(file.path) ? createHash6("sha256").update(readFileSync20(file.path)).digest("hex") : null;
+    const currentSha256 = existsSync29(file.path) ? createHash8("sha256").update(readFileSync24(file.path)).digest("hex") : null;
     if (currentSha256 !== expected) mismatches.push(file.path);
   }
   if (mismatches.length > 0 && !options.force) {
@@ -8657,7 +11425,7 @@ Roll back backup ${backupId}? Affected files:
 ${fileList}
 [y/N] `);
   if (!proceed) {
-    emit(options.json, { rolledBack: false, cancelled: true, backupId }, () => {
+    emit2(options.json, { rolledBack: false, cancelled: true, backupId }, () => {
       console.log("[skill-forge] rollback cancelled \u2014 nothing restored.");
     });
     return;
@@ -8686,7 +11454,7 @@ ${fileList}
     pattern.generalizedBackupId = void 0;
     writePatternsStore(patternsStore);
   }
-  emit(options.json, { rolledBack: true, backupId, patternReset: pattern?.id, warnings }, () => {
+  emit2(options.json, { rolledBack: true, backupId, patternReset: pattern?.id, warnings }, () => {
     console.log(`[skill-forge] rollback complete for ${backupId}${pattern ? ` (pattern ${pattern.id} reset to ready)` : ""}`);
     for (const w of warnings) console.log(`[skill-forge] warning: ${w}`);
   });
@@ -8729,6 +11497,27 @@ function parsePruneDays(value) {
   }
   return n;
 }
+function parseInsightAnalysisMode(value) {
+  if (value !== "independent" && value !== "single") {
+    throw new UserError(`--analysis-mode must be "independent" or "single" (got "${value}")`);
+  }
+  return value;
+}
+function parseSkillMapCoverage(value) {
+  if (value !== "static" && value !== "resolved") {
+    throw new UserError(`--skill-map-coverage must be "static" or "resolved" (got "${value}")`);
+  }
+  return value;
+}
+function parseInsightCloseStatus(value) {
+  if (value !== "dismissed" && value !== "archived") {
+    throw new UserError(`--status must be "dismissed" or "archived" (got "${value}")`);
+  }
+  return value;
+}
+function collectValue(value, previous) {
+  return [...previous, value];
+}
 var program = new Command();
 program.name("skill-forge").description("The supply-chain gate for agent skills").version(pkg.version);
 program.command("add <source>").description("Quarantine-install a skill and run it through the safety gate").option("-y, --yes", "skip the interactive prompt; honor the gate verdict automatically").option("-t, --target <dir>", "skills root to promote into (defaults to config defaultTarget, then skillsRoots[0])").option("--json", "print the gate result as JSON instead of the terminal report").option("--ingest", "after a successful promote, hand off the bundled ingest prompt to a coding agent").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).option(
@@ -8772,6 +11561,14 @@ program.command("ingest").description(
 ).option("--list", "print pending queue entries and exit \u2014 no handoff").option("--json", "with --list: print pending entries as JSON").action(ingest);
 var queue = program.command("queue").description("Manage the pending-ingestion queue (Pro)");
 queue.command("close <id>").description("Close a queue entry after the decide pass \u2014 agents use this instead of hand-editing queue.json").requiredOption("--status <status>", 'final status: "ingested" or "dismissed"').action(queueClose);
+var insight = program.command("insight").description("Turn untrusted sources into evidence-backed capability plans and Jira manifests (Pro)");
+insight.command("analyze [source...]").description("Register and fingerprint sources in a private study; never fetches URLs or mutates capabilities").option("--manifest <file>", "JSON source manifest (an array or { sources: [...] })").option("--skill-map <file>", "optional resolved/static skill map used for capability coverage").option("--skill-map-coverage <coverage>", "declare supplied map provenance: static|resolved", parseSkillMapCoverage).option("--analysis-mode <mode>", "requested evidence mode: independent|single (default: independent)", parseInsightAnalysisMode).option("--retain-source-copies", "copy observed local source files into the private study workspace").option("--handoff", "launch the configured agent with the bundled source-insight workflow").option("--json", "print the created study summary as one JSON document").action(insightAnalyze);
+insight.command("submit <study-id>").description("Validate and atomically import agent-produced analysis (cannot approve the study)").requiredOption("--file <analysis.json>", "candidate analysis JSON file").option("--json", "print the updated study summary as one JSON document").action(insightSubmit);
+insight.command("review <study-id>").description("Validate and render the current evidence and domain plans; read-only").option("--json", "print the validation/report payload as one JSON document").action(insightReview);
+insight.command("approve <study-id>").description("Human-only TTY approval of the exact plan hash; agents must never invoke this command").option("--domain <id>", "approve one domain ID (repeatable; default: every domain)", collectValue, []).action(insightApprove);
+insight.command("jira <study-id>").description("Generate a Jira manifest or manage its private local receipts; never calls Jira").option("--project <key>", "destination Jira project key recorded in a new manifest").option("--out <file>", "write an additional export-safe manifest here (refuses an existing file)").option("--handoff", "launch the configured agent to present and confirm the backlog before Jira writes").option("--receipt <file>", "append one validated local receipt for the current manifest").option("--resume", "show local resume state for the current manifest").option("--json", "print the selected mode result as one JSON document").action(insightJira);
+insight.command("status <study-id>").description("Show private study lifecycle and evidence counts; read-only").option("--json", "print the status payload as one JSON document").action(insightStatus);
+insight.command("close <study-id>").description("Close a study while preserving its append-only receipts").requiredOption("--status <status>", "dismissed|archived", parseInsightCloseStatus).action(insightClose);
 var refine = program.command("refine").description("Capture, apply, and generalize improvements to installed skills from usage feedback (Pro)");
 refine.command("capture", { isDefault: true }).description("Record a refinement and write a project-scope override artifact (never touches the base skill)").option("--skill <name>", "target skill name").option("--category <cat>", "trigger|content|hook|tool|pattern|config|new").option("--target <section>", 'heading path or file the refinement targets, e.g. "Hooks > duplicate-check"').option("--override-type <type>", "patch|extend|config|full|hook|script|new").option("--action <action>", "patch action: append|prepend|replace-section|insert-after|insert-before|delete-section").option("--marker <text>", "marker text for insert-* / replace-section / delete-section (filename for full|hook|script)").option("--content <text>", "override content inline").option("--content-file <file>", "read override content from a file").option("--expected <text>", "expected behavior").option("--actual <text>", "actual observed behavior").option("--example <text>", "concrete example of the gap").option("--outcome <text>", "desired outcome").option("--root-cause <text>", "root cause per the gap analysis").option("--pattern-id <id>", "join an existing pattern (PAT-xxxx) instead of fingerprint matching").option("--scope <scope>", 'where to write the artifact: "local" (.claude/skills, default) or "shared" (./skills)').option("--dry-run", "preview the artifact diff; write nothing").option("--json", "print the result as JSON").option("-y, --yes", "skip the interactive confirm; never implies --handoff").option("--handoff", "authorizes launching the configured agent with the bundled refine prompt").action(refineCaptureCommand);
 refine.command("list").description("Show refinement history from the user-scope store").option("--status <status>", "filter by refinement status").option("--skill <name>", "filter by skill").option("--project <name>", "filter by project").option("--json", "print records as JSON").action(refineListCommand);