@rness/cli 0.4.0 → 0.5.0

package/dist/chunk-WSGPDTPQ.js

@@ -0,0 +1,3857 @@
+// src/core/fs.ts
+import {
+  access,
+  lstat,
+  readFile,
+  rename,
+  rm,
+  writeFile
+} from "fs/promises";
+import { basename, dirname, join } from "path";
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isSymlink(p) {
+  try {
+    return (await lstat(p)).isSymbolicLink();
+  } catch (e) {
+    if (e.code === "ENOENT") return false;
+    throw e;
+  }
+}
+async function readOrNull(p) {
+  try {
+    return await readFile(p, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+var sequence = 0;
+async function writeFileAtomic(p, text) {
+  sequence += 1;
+  const tmp = join(dirname(p), `.${basename(p)}.${process.pid}.${sequence}.tmp`);
+  await writeFile(tmp, text, "utf8");
+  try {
+    await rename(tmp, p);
+  } catch (e) {
+    await rm(tmp, { force: true }).catch(() => void 0);
+    throw e;
+  }
+}
+
+// src/core/auth.ts
+import { chmod, mkdir, open, readFile as readFile2, rm as rm2, stat } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/core/device-flow.ts
+var GITHUB_CLIENT_ID = "Ov23liv1ia2UWeWttsOK";
+var GITHUB_WEB = "https://github.com";
+var SCOPES = "repo read:org";
+function clientId() {
+  return process.env["RNESS_GITHUB_CLIENT_ID"] ?? GITHUB_CLIENT_ID;
+}
+function webBase() {
+  return (process.env["RNESS_GITHUB_WEB"] ?? GITHUB_WEB).replace(/\/+$/, "");
+}
+var LoginError = class extends Error {
+};
+var RefreshRejected = class extends Error {
+};
+function reason(e) {
+  if (e instanceof Error) {
+    return e.name === "TimeoutError" ? "timed out" : e.message;
+  }
+  return String(e);
+}
+async function post(path, params) {
+  let res;
+  try {
+    res = await fetch(`${webBase()}${path}`, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": "rness-cli"
+      },
+      body: new URLSearchParams(params).toString(),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (e) {
+    throw new Error(`cannot reach github.com: ${reason(e)}`, { cause: e });
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch (e) {
+    throw new Error(`github.com answered ${res.status} for ${path}`, {
+      cause: e
+    });
+  }
+  if (body === null || typeof body !== "object")
+    throw new Error(`github.com answered an unexpected body for ${path}`);
+  return body;
+}
+var str = (v) => typeof v === "string" ? v : null;
+var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+function tokenSet(body, now) {
+  const accessToken = str(body["access_token"]);
+  if (accessToken === null) return null;
+  const expiresIn = num(body["expires_in"]);
+  const refreshIn = num(body["refresh_token_expires_in"]);
+  return {
+    accessToken,
+    expiresAt: expiresIn === null ? null : now + expiresIn * 1e3,
+    refreshToken: str(body["refresh_token"]),
+    refreshExpiresAt: refreshIn === null ? null : now + refreshIn * 1e3,
+    scopes: str(body["scope"]) ?? ""
+  };
+}
+async function requestDeviceCode() {
+  const id = clientId();
+  if (id === "")
+    throw new LoginError(
+      "rness has no GitHub client ID yet; set RNESS_GITHUB_CLIENT_ID"
+    );
+  const body = await post("/login/device/code", {
+    client_id: id,
+    scope: SCOPES
+  });
+  const deviceCode = str(body["device_code"]);
+  const userCode = str(body["user_code"]);
+  const verificationUri = str(body["verification_uri"]);
+  if (deviceCode === null || userCode === null || verificationUri === null) {
+    const error = str(body["error"]);
+    throw new LoginError(
+      error === "device_flow_disabled" ? "the device flow is not enabled on the rness GitHub app" : `github.com refused to start the login${error === null ? "" : ` (${error})`}`
+    );
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    expiresIn: num(body["expires_in"]) ?? 900,
+    interval: num(body["interval"]) ?? 5
+  };
+}
+async function pollForToken(code, deps = {}) {
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = now() + code.expiresIn * 1e3;
+  let interval = code.interval;
+  for (; ; ) {
+    await sleep(interval * 1e3);
+    const body = await post("/login/oauth/access_token", {
+      client_id: clientId(),
+      device_code: code.deviceCode,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    const tokens = tokenSet(body, now());
+    if (tokens !== null) return tokens;
+    const error = str(body["error"]);
+    if (error === "authorization_pending") {
+      if (now() > deadline)
+        throw new LoginError("the code expired before it was approved");
+      continue;
+    }
+    if (error === "slow_down") {
+      interval = (num(body["interval"]) ?? interval) + 5;
+      continue;
+    }
+    if (error === "expired_token")
+      throw new LoginError("the code expired before it was approved");
+    if (error === "access_denied")
+      throw new LoginError("the login was cancelled on github.com");
+    throw new LoginError(`github.com refused the login (${error ?? "unknown"})`);
+  }
+}
+async function refreshTokenSet(refreshToken, now = Date.now) {
+  const body = await post("/login/oauth/access_token", {
+    client_id: clientId(),
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  const tokens = tokenSet(body, now());
+  if (tokens !== null) return tokens;
+  throw new RefreshRejected(str(body["error"]) ?? "refused");
+}
+
+// src/core/auth.ts
+function configDir() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg !== void 0 && xdg !== "") return join2(xdg, "rness");
+  const appData = process.env["APPDATA"];
+  if (process.platform === "win32" && appData !== void 0 && appData !== "")
+    return join2(appData, "rness");
+  return join2(homedir(), ".config", "rness");
+}
+var authFile = () => join2(configDir(), "auth.json");
+var lockFile = () => join2(configDir(), "auth.lock");
+function isTokenSet(v) {
+  if (v === null || typeof v !== "object") return false;
+  const t = v;
+  return typeof t["accessToken"] === "string" && t["accessToken"] !== "";
+}
+async function readAuth() {
+  try {
+    const parsed = JSON.parse(await readFile2(authFile(), "utf8"));
+    const entry = parsed !== null && typeof parsed === "object" ? parsed["github.com"] : void 0;
+    if (entry === null || typeof entry !== "object") return null;
+    const { login, tokens } = entry;
+    if (typeof login !== "string" || !isTokenSet(tokens)) return null;
+    return {
+      login,
+      tokens: {
+        accessToken: tokens.accessToken,
+        expiresAt: tokens.expiresAt ?? null,
+        refreshToken: tokens.refreshToken ?? null,
+        refreshExpiresAt: tokens.refreshExpiresAt ?? null,
+        scopes: tokens.scopes ?? ""
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+async function writeAuth(login) {
+  const dir = configDir();
+  await mkdir(dir, { recursive: true, mode: 448 });
+  const file = authFile();
+  await writeFileAtomic(
+    file,
+    `${JSON.stringify({ "github.com": login }, null, 2)}
+`
+  );
+  await chmod(file, 384);
+}
+async function clearAuth() {
+  await rm2(authFile(), { force: true });
+}
+function envToken() {
+  for (const source of ["GITHUB_TOKEN", "GH_TOKEN"]) {
+    const token = process.env[source];
+    if (token !== void 0 && token !== "")
+      return { token, source, login: null };
+  }
+  return null;
+}
+var REFRESH_MARGIN_MS = 5 * 6e4;
+var LOCK_WAIT_MS = 1e4;
+var LOCK_STALE_MS = 3e4;
+var fresh = (tokens, now) => tokens.expiresAt === null || tokens.expiresAt - now > REFRESH_MARGIN_MS;
+async function withLock(work) {
+  await mkdir(configDir(), { recursive: true, mode: 448 });
+  const file = lockFile();
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (; ; ) {
+    try {
+      const handle = await open(file, "wx");
+      await handle.close();
+      break;
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+      const age = await stat(file).then(
+        (s) => Date.now() - s.mtimeMs,
+        () => 0
+      );
+      if (age > LOCK_STALE_MS) await rm2(file, { force: true });
+      else if (Date.now() > deadline) return null;
+      else await new Promise((r) => setTimeout(r, 50));
+    }
+  }
+  try {
+    return await work();
+  } finally {
+    await rm2(file, { force: true });
+  }
+}
+async function resolveToken(deps = {}) {
+  const env = envToken();
+  if (env !== null) return env;
+  const now = deps.now ?? Date.now;
+  const stored = await readAuth();
+  if (stored === null) return null;
+  const answer = (s) => ({
+    token: s.tokens.accessToken,
+    source: "login",
+    login: s.login
+  });
+  if (fresh(stored.tokens, now())) return answer(stored);
+  const refreshed = await withLock(async () => {
+    const current = await readAuth();
+    if (current === null) return null;
+    if (fresh(current.tokens, now())) return current;
+    if (current.tokens.refreshToken === null) return null;
+    try {
+      const tokens = await refreshTokenSet(current.tokens.refreshToken, now);
+      const next = { login: current.login, tokens };
+      await writeAuth(next);
+      return next;
+    } catch (e) {
+      if (e instanceof RefreshRejected) {
+        await clearAuth();
+        (deps.notify ?? ((l) => process.stderr.write(`${l}
+`)))(
+          "your GitHub login expired; run rness login"
+        );
+        return null;
+      }
+      const expiresAt = current.tokens.expiresAt;
+      return expiresAt !== null && expiresAt > now() ? current : null;
+    }
+  });
+  return refreshed === null ? null : answer(refreshed);
+}
+
+// src/core/github.ts
+var DEFAULT_GITHUB_API = "https://api.github.com";
+var MAX_PAGES = 50;
+var PER_PAGE = 100;
+var ADD_LATER = "; add repositories later with rness add <repo>";
+var NEXT = /<[^>]*>\s*;\s*rel="next"/;
+function isRepository(value) {
+  if (value === null || typeof value !== "object") return false;
+  const r = value;
+  return typeof r["name"] === "string" && typeof r["private"] === "boolean" && typeof r["archived"] === "boolean";
+}
+function reason2(e) {
+  if (e instanceof Error && e.cause instanceof Error) return e.cause.message;
+  return e instanceof Error ? e.message : String(e);
+}
+async function getPage(url, headers, timeoutMs) {
+  const signal = AbortSignal.timeout(timeoutMs);
+  let res;
+  try {
+    res = await fetch(url, { headers, signal });
+  } catch (e) {
+    throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
+  }
+  if (!res.ok) {
+    await res.body?.cancel().catch(() => void 0);
+    return { status: res.status, headers: res.headers, body: void 0 };
+  }
+  let text;
+  try {
+    text = await res.text();
+  } catch (e) {
+    throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
+  }
+  try {
+    return { status: res.status, headers: res.headers, body: JSON.parse(text) };
+  } catch (e) {
+    throw new Error(
+      `GitHub API answered invalid JSON for ${new URL(url).pathname}`,
+      { cause: e }
+    );
+  }
+}
+function httpError(page, path) {
+  const cause = { status: page.status, path };
+  if (page.status === 401)
+    return new Error("GitHub rejected the token (401)", { cause });
+  if (page.status === 429 || page.status === 403 && (page.headers.get("x-ratelimit-remaining") === "0" || page.headers.has("retry-after"))) {
+    return new Error(
+      "GitHub API rate limit reached; set GITHUB_TOKEN or add repositories later with rness add",
+      { cause }
+    );
+  }
+  return new Error(
+    `GitHub API answered ${page.status} for ${path}${ADD_LATER}`,
+    { cause }
+  );
+}
+async function listRepositories(owner, options) {
+  const base = (options.apiBase ?? DEFAULT_GITHUB_API).replace(/\/+$/, "");
+  const timeoutMs = options.timeoutMs ?? 15e3;
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "rness-cli"
+  };
+  if (options.token !== void 0 && options.token !== "")
+    headers["Authorization"] = `Bearer ${options.token}`;
+  const encoded = encodeURIComponent(owner);
+  const ORG = {
+    path: `/orgs/${encoded}/repos`,
+    query: "type=all",
+    owner: "org"
+  };
+  const USER = {
+    path: `/users/${encoded}/repos`,
+    query: "type=owner",
+    owner: "user"
+  };
+  const SELF = {
+    path: "/user/repos",
+    query: "affiliation=owner",
+    owner: "self"
+  };
+  const url = (k, n) => `${base}${k.path}?${k.query}&per_page=${PER_PAGE}&page=${n}`;
+  let kind = ORG;
+  const repositories = [];
+  for (let n = 1; n <= MAX_PAGES; n++) {
+    let page = await getPage(url(kind, n), headers, timeoutMs);
+    if (n === 1 && page.status === 404) {
+      const self = await options.self?.() ?? null;
+      kind = self?.toLowerCase() === owner.toLowerCase() ? SELF : USER;
+      page = await getPage(url(kind, n), headers, timeoutMs);
+      if (page.status === 404) {
+        throw new Error(
+          `GitHub has no organization or user named "${owner}" (or it is not visible to you)${ADD_LATER}`,
+          { cause: { status: 404, path: kind.path } }
+        );
+      }
+    }
+    if (page.status < 200 || page.status >= 300)
+      throw httpError(page, kind.path);
+    if (!Array.isArray(page.body) || !page.body.every(isRepository)) {
+      throw new Error(
+        `GitHub API answered an unexpected body for ${kind.path}`,
+        {
+          cause: page.body
+        }
+      );
+    }
+    for (const r of page.body)
+      repositories.push({
+        name: r.name,
+        private: r.private,
+        archived: r.archived
+      });
+    if (!NEXT.test(page.headers.get("link") ?? ""))
+      return {
+        repositories,
+        owner: kind.owner,
+        truncated: false
+      };
+  }
+  return {
+    repositories,
+    owner: kind.owner,
+    truncated: true
+  };
+}
+function apiHeaders(token) {
+  return {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "rness-cli",
+    Authorization: `Bearer ${token}`
+  };
+}
+async function getJson(path, options) {
+  const base = (options.apiBase ?? DEFAULT_GITHUB_API).replace(/\/+$/, "");
+  let res;
+  try {
+    res = await fetch(`${base}${path}`, {
+      headers: apiHeaders(options.token),
+      signal: AbortSignal.timeout(options.timeoutMs ?? 15e3)
+    });
+  } catch (e) {
+    throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
+  }
+  const body = await res.json().catch(() => void 0);
+  return { status: res.status, body };
+}
+async function getUser(options) {
+  const { status: status2, body } = await getJson("/user", options);
+  if (status2 === 401) throw new Error("GitHub rejected the token (401)");
+  const login = body !== null && typeof body === "object" ? body["login"] : void 0;
+  if (status2 !== 200 || typeof login !== "string")
+    throw new Error(`GitHub API answered ${status2} for /user`);
+  return { login };
+}
+async function listUserOrganizations(options) {
+  const { status: status2, body } = await getJson(
+    `/user/orgs?per_page=${PER_PAGE}`,
+    options
+  );
+  if (status2 !== 200 || !Array.isArray(body))
+    throw new Error(`GitHub API answered ${status2} for /user/orgs`);
+  return body.map(
+    (o) => o !== null && typeof o === "object" ? o["login"] : void 0
+  ).filter((l) => typeof l === "string");
+}
+async function getOrgMembership(org, options) {
+  const { status: status2, body } = await getJson(
+    `/user/memberships/orgs/${encodeURIComponent(org)}`,
+    options
+  );
+  if (status2 === 200) {
+    const state = body !== null && typeof body === "object" ? body["state"] : void 0;
+    return state === "active" ? "member" : "not-member";
+  }
+  if (status2 === 404) return "not-member";
+  if (status2 === 403) {
+    const message = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    if (/OAuth App access restrictions/i.test(message)) return "restricted";
+  }
+  return "unknown";
+}
+async function createRepository(owner, name, options) {
+  const base = (options.apiBase ?? DEFAULT_GITHUB_API).replace(/\/+$/, "");
+  const post2 = async (path) => {
+    let res;
+    try {
+      res = await fetch(`${base}${path}`, {
+        method: "POST",
+        headers: {
+          ...apiHeaders(options.token),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ name, private: true }),
+        signal: AbortSignal.timeout(options.timeoutMs ?? 15e3)
+      });
+    } catch (e) {
+      throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
+    }
+    const body = await res.json().catch(() => void 0);
+    const message = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    return { status: res.status, message };
+  };
+  let answer = await post2(`/orgs/${encodeURIComponent(owner)}/repos`);
+  if (answer.status === 404 && options.self !== void 0 && options.self !== null && options.self.toLowerCase() === owner.toLowerCase())
+    answer = await post2("/user/repos");
+  if (answer.status === 201) return { kind: "created" };
+  if (answer.status === 422) return { kind: "exists" };
+  return {
+    kind: "refused",
+    reason: answer.message === "" ? `GitHub answered ${answer.status}` : `${answer.message} (${answer.status})`
+  };
+}
+
+// src/core/github-oauth-provider.ts
+var GITHUB_HTTPS = "https://github.com/";
+var GitHubOAuthProvider = class {
+  #token;
+  #apiBase;
+  #login;
+  get authenticated() {
+    return this.#token !== null;
+  }
+  constructor(options) {
+    this.#token = options.token;
+    this.#apiBase = options.apiBase;
+  }
+  #api(token) {
+    return this.#apiBase === void 0 ? { token } : { token, apiBase: this.#apiBase };
+  }
+  identity() {
+    this.#login ??= (async () => {
+      const t = this.#token;
+      if (t === null) return null;
+      if (t.login !== null) return { login: t.login };
+      try {
+        return await getUser(this.#api(t.token));
+      } catch {
+        return null;
+      }
+    })();
+    return this.#login;
+  }
+  async listOrganizations() {
+    if (this.#token === null) return [];
+    const logins = await listUserOrganizations(this.#api(this.#token.token));
+    return logins.map((login) => ({ login }));
+  }
+  async organizationAccess(org) {
+    if (this.#token === null) return "unknown";
+    try {
+      return await getOrgMembership(org, this.#api(this.#token.token));
+    } catch {
+      return "unknown";
+    }
+  }
+  async listRepositories(owner) {
+    return listRepositories(owner, {
+      token: this.#token?.token,
+      ...this.#apiBase === void 0 ? {} : { apiBase: this.#apiBase },
+      self: async () => (await this.identity())?.login ?? null
+    });
+  }
+  async createRepository(owner, name) {
+    if (this.#token === null)
+      return { kind: "refused", reason: "not logged in" };
+    return createRepository(owner, name, {
+      ...this.#api(this.#token.token),
+      self: (await this.identity())?.login ?? null
+    });
+  }
+  credentialsFor(url) {
+    if (this.#token === null || !url.startsWith(GITHUB_HTTPS)) return null;
+    return { username: "x-access-token", password: this.#token.token };
+  }
+};
+async function githubProvider(apiBase) {
+  return new GitHubOAuthProvider({
+    token: await resolveToken(),
+    ...apiBase === void 0 ? {} : { apiBase }
+  });
+}
+
+// src/core/remote.ts
+import { spawn } from "child_process";
+
+// src/core/git.ts
+import { execFile } from "child_process";
+import { dirname as dirname2, resolve } from "path";
+import { promisify } from "util";
+var execFileP = promisify(execFile);
+var ENV_HELPER = '!f() { test "$1" = get && printf "username=%s\\npassword=%s\\n" "$RNESS_GIT_USERNAME" "$RNESS_GIT_TOKEN"; }; f';
+function withCredentials(credentials) {
+  if (credentials === null || credentials === void 0)
+    return { args: [], env: {} };
+  return {
+    args: ["-c", "credential.helper=", "-c", `credential.helper=${ENV_HELPER}`],
+    env: {
+      RNESS_GIT_USERNAME: credentials.username,
+      RNESS_GIT_TOKEN: credentials.password
+    }
+  };
+}
+async function git(args, cwd, credentials) {
+  const auth = withCredentials(credentials);
+  try {
+    const { stdout } = await execFileP("git", [...auth.args, ...args], {
+      ...cwd === void 0 ? {} : { cwd },
+      env: {
+        ...process.env,
+        ...auth.env,
+        GIT_TERMINAL_PROMPT: "0",
+        // Pin the command to `cwd` itself: without a ceiling, git walks up and
+        // a plain directory under `org/` would report — or be pulled into —
+        // whatever repository happens to sit above the workspace root. git
+        // ignores a relative ceiling entry, hence the resolve().
+        ...cwd === void 0 ? {} : { GIT_CEILING_DIRECTORIES: dirname2(resolve(cwd)) }
+      },
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return stdout;
+  } catch (e) {
+    const err = e;
+    const text = err.stderr !== void 0 && err.stderr !== "" ? err.stderr : err.message ?? "unknown error";
+    const first = text.split("\n").find((l) => l.trim() !== "") ?? "unknown error";
+    throw new Error(`git ${args[0] ?? ""} failed: ${first.trim()}`, {
+      cause: e
+    });
+  }
+}
+function positional(value, what) {
+  if (value.startsWith("-"))
+    throw new Error(`refusing suspicious ${what}: ${value}`);
+  return value;
+}
+async function clone(url, dir, credentials) {
+  await git(
+    [
+      "clone",
+      "--quiet",
+      "--",
+      positional(url, "repository url"),
+      positional(dir, "directory")
+    ],
+    void 0,
+    credentials
+  );
+}
+async function isClean(dir, ignore = []) {
+  const pathspec = ignore.map((p) => `:!${p}`);
+  return (await git(
+    [
+      "status",
+      "--porcelain",
+      ...pathspec.length > 0 ? ["--", ...pathspec] : []
+    ],
+    dir
+  )).trim() === "";
+}
+async function pullFastForward(dir, credentials) {
+  await git(["pull", "--ff-only", "--quiet"], dir, credentials);
+}
+async function publish(dir, url, credentials) {
+  await git(["remote", "add", "origin", positional(url, "repository url")], dir);
+  await git(["push", "--quiet", "-u", "origin", "main"], dir, credentials);
+}
+async function originUrl(dir) {
+  try {
+    return (await git(["remote", "get-url", "origin"], dir)).trim();
+  } catch {
+    return null;
+  }
+}
+async function init(dir) {
+  await git(["init", "-q", "-b", "main"], dir);
+}
+async function commitAll(dir, message) {
+  await git(["add", "-A"], dir);
+  await git(["commit", "-q", "-m", message], dir);
+}
+
+// src/core/remote.ts
+var DEFAULT_HOST = "https://github.com/";
+var SSH_HOST = "git@github.com:";
+function repoUrl(host, org, repo) {
+  return `${host}${org}/${repo}.git`;
+}
+var AUTH = [
+  /authentication failed/i,
+  /permission denied/i,
+  /could not read username/i,
+  /terminal prompts disabled/i
+];
+var NOT_FOUND = [
+  /repository .*not found/i,
+  /does not appear to be a git repository/i
+];
+function firstLine(text) {
+  return text.split("\n").find((l) => l.trim() !== "")?.trim() ?? "unknown error";
+}
+function classifyProbe(url, exitCode, stderr) {
+  if (exitCode === 0 || exitCode === 2) return { kind: "found" };
+  if (AUTH.some((r) => r.test(stderr)))
+    return {
+      kind: "error",
+      message: `cannot access ${url}: ${firstLine(stderr)}`
+    };
+  if (NOT_FOUND.some((r) => r.test(stderr))) return { kind: "not-found" };
+  return { kind: "error", message: `cannot reach ${url}: ${firstLine(stderr)}` };
+}
+var STDERR_FLUSH_MS = 200;
+async function probeRemote(url, timeoutMs = 6e4, credentials) {
+  positional(url, "repository url");
+  return new Promise((resolve4) => {
+    const auth = withCredentials(credentials);
+    const child = spawn(
+      "git",
+      [...auth.args, "ls-remote", "--exit-code", url, "HEAD"],
+      {
+        stdio: ["ignore", "ignore", "pipe"],
+        env: { ...process.env, ...auth.env, GIT_TERMINAL_PROMPT: "0" }
+      }
+    );
+    const chunks = [];
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => chunks.push(chunk));
+    let settled = false;
+    const settle = (probe) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.stderr?.destroy();
+      resolve4(probe);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      settle({
+        kind: "error",
+        message: `cannot reach ${url}: timed out after ${Math.round(timeoutMs / 1e3)}s`
+      });
+    }, timeoutMs);
+    child.on("error", (e) => settle(classifyProbe(url, 1, e.message)));
+    child.on("exit", (code) => {
+      const finish = () => settle(classifyProbe(url, code ?? 1, chunks.join("")));
+      const stderr = child.stderr;
+      if (stderr === null || stderr.readableEnded || stderr.destroyed)
+        return finish();
+      const flush = setTimeout(finish, STDERR_FLUSH_MS);
+      const done = () => {
+        clearTimeout(flush);
+        finish();
+      };
+      stderr.once("end", done);
+      stderr.once("error", done);
+    });
+  });
+}
+
+// src/core/manifest.ts
+import { readFile as readFile3 } from "fs/promises";
+import { basename as basename2, join as join3 } from "path";
+var NAME = /^(?!\.{1,2}$)[a-z0-9._][a-z0-9._-]*$/;
+var NAME_RULE = "lowercase letters, digits, '.', '_' and '-', not starting with '-'";
+var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+var KEYS = ["contract", "org", "repos", "scopes"];
+function fail(message) {
+  throw new Error(`rness.json: ${message}`);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function checkPath(scope, path) {
+  if (typeof path !== "string" || path === "")
+    fail(`scope "${scope}" needs a string "path"`);
+  if (path.startsWith("/")) fail(`scope "${scope}" path must be relative`);
+  if (path.split("/").includes(".."))
+    fail(`scope "${scope}" path must not contain ".."`);
+  if (path.split("/").some((segment) => segment === ""))
+    fail(`scope "${scope}" path must not contain empty segments`);
+  return path;
+}
+function readOrg(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "string" || !ORG_NAME.test(value)) {
+    fail(
+      `"org" must be a GitHub organization name (got ${JSON.stringify(value)})`
+    );
+  }
+  return value;
+}
+function resolveOrg(manifest, root) {
+  if (manifest.org !== null) return { org: manifest.org, warning: null };
+  const name = basename2(root);
+  return {
+    org: name,
+    warning: `rness.json: no "org"; using the directory name "${name}"`
+  };
+}
+function readRepos(value) {
+  const raw = value ?? {};
+  if (!isRecord(raw)) fail('"repos" must be an object');
+  const repos = {};
+  for (const [name, entry] of Object.entries(raw)) {
+    if (!NAME.test(name))
+      fail(`repo name "${name}" may only contain ${NAME_RULE}`);
+    if (!isRecord(entry) || typeof entry.url !== "string")
+      fail(`repo "${name}" needs a string "url"`);
+    repos[name] = { url: entry.url };
+  }
+  return repos;
+}
+function readScopes(value) {
+  const raw = value ?? {};
+  if (!isRecord(raw)) fail('"scopes" must be an object');
+  const scopes = {};
+  for (const [name, entry] of Object.entries(raw)) {
+    if (!NAME.test(name))
+      fail(`scope name "${name}" may only contain ${NAME_RULE}`);
+    if (!isRecord(entry)) fail(`scope "${name}" must be an object`);
+    const path = checkPath(name, entry.path);
+    const ext = entry.extends ?? [];
+    if (!Array.isArray(ext) || !ext.every((t) => typeof t === "string")) {
+      fail(`scope "${name}" extends must be an array of scope names`);
+    }
+    scopes[name] = { path, extends: ext };
+  }
+  for (const [name, entry] of Object.entries(scopes)) {
+    for (const target of entry.extends) {
+      if (!Object.hasOwn(scopes, target))
+        fail(`scope "${name}" extends unknown scope "${target}"`);
+    }
+  }
+  return scopes;
+}
+async function loadManifest(rnessDir) {
+  let raw;
+  try {
+    raw = await readFile3(join3(rnessDir, "rness.json"), "utf8");
+  } catch {
+    fail("not found");
+  }
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (e) {
+    fail(`invalid JSON (${e instanceof Error ? e.message : String(e)})`);
+  }
+  if (!isRecord(data)) fail("must be a JSON object");
+  if (data.contract !== 1)
+    fail(`unsupported contract: ${JSON.stringify(data.contract)} (expected 1)`);
+  for (const key of Object.keys(data)) {
+    if (!KEYS.includes(key)) fail(`unknown key ${JSON.stringify(key)}`);
+  }
+  return {
+    contract: 1,
+    org: readOrg(data.org),
+    repos: readRepos(data.repos),
+    scopes: readScopes(data.scopes)
+  };
+}
+async function writeManifest(rnessDir, manifest) {
+  const repos = Object.entries(manifest.repos).map(
+    ([name, r]) => `    ${JSON.stringify(name)}: { "url": ${JSON.stringify(r.url)} }`
+  );
+  const scopes = Object.entries(manifest.scopes).map(([name, s]) => {
+    const ext = s.extends.length === 0 ? "" : `, "extends": [${s.extends.map((e) => JSON.stringify(e)).join(", ")}]`;
+    return `    ${JSON.stringify(name)}: { "path": ${JSON.stringify(s.path)}${ext} }`;
+  });
+  const lines = ["{", '  "contract": 1,'];
+  if (manifest.org !== null)
+    lines.push(`  "org": ${JSON.stringify(manifest.org)},`);
+  lines.push(
+    '  "repos": {',
+    repos.join(",\n"),
+    "  },",
+    '  "scopes": {',
+    scopes.join(",\n"),
+    "  }",
+    "}"
+  );
+  const text = `${lines.filter((l) => l !== "").join("\n")}
+`;
+  await writeFileAtomic(join3(rnessDir, "rness.json"), text);
+}
+var FULL_URL = /^(https?:\/\/|git@|ssh:\/\/|file:\/\/)/;
+function parseRepoSpec(spec, org, host) {
+  let url;
+  if (FULL_URL.test(spec)) {
+    url = spec;
+  } else {
+    const parts = spec.split("/");
+    if (parts.length === 1) url = repoUrl(host, org, spec);
+    else if (parts.length === 2 && parts[0] !== void 0 && parts[1] !== void 0)
+      url = repoUrl(host, parts[0], parts[1]);
+    else
+      throw new Error(
+        `repository name "${spec}" is not a name (use <repo>, <owner>/<repo>, or a URL)`
+      );
+  }
+  const last = url.replace(/\/+$/, "").split(/[/:]/).at(-1) ?? "";
+  const name = last.endsWith(".git") ? last.slice(0, -4) : last;
+  if (!NAME.test(name))
+    throw new Error(`repository name "${name}" may only contain ${NAME_RULE}`);
+  return { name, url };
+}
+
+// src/core/repos.ts
+import { glob, readFile as readFile4, rm as rm3 } from "fs/promises";
+import { join as join4, posix, sep } from "path";
+async function addRepository(input) {
+  const { name, url } = parseRepoSpec(input.spec, input.org, input.host);
+  const dir = join4(input.root, "org", name);
+  const repoPath = `org/${name}`;
+  const current = input.manifest.scopes[name];
+  if (current !== void 0 && current.path !== repoPath)
+    throw new Error(`scope "${name}" already points at ${current.path}`);
+  const scopes = {
+    ...input.manifest.scopes,
+    [name]: { path: repoPath, extends: current?.extends ?? [] }
+  };
+  const subs = [];
+  for (const sub of input.scopes) {
+    const clean = sub.replace(/^\/+|\/+$/g, "");
+    const segments = clean.split("/");
+    if (segments.some((s) => s === "" || s === "." || s === ".."))
+      throw new Error(
+        `sub-scope "${clean}" must be a relative path inside the repository`
+      );
+    const base = segments.at(-1) ?? "";
+    const path = `org/${name}/${clean}`;
+    if (!NAME.test(base))
+      throw new Error(
+        `the last segment of sub-scope "${clean}" may only contain ${NAME_RULE}`
+      );
+    const existing = scopes[base];
+    if (existing !== void 0 && existing.path !== path)
+      throw new Error(`scope "${base}" already points at ${existing.path}`);
+    scopes[base] = { path, extends: [name] };
+    subs.push({ path, base });
+  }
+  let action;
+  if (await exists(dir)) {
+    const origin = await originUrl(dir);
+    if (origin === null)
+      throw new Error(`org/${name} exists and is not a git clone`);
+    if (origin !== url)
+      throw new Error(`org/${name} is a clone of ${origin}, not ${url}`);
+    action = "adopted";
+  } else {
+    await clone(url, dir, input.credentialsFor?.(url) ?? null);
+    action = "cloned";
+  }
+  const declared = [name];
+  for (const { path, base } of subs) {
+    if (!await exists(join4(input.root, ...path.split("/")))) {
+      if (action === "cloned") await rm3(dir, { recursive: true, force: true });
+      throw new Error(`${path} does not exist`);
+    }
+    declared.push(base);
+  }
+  const manifest = {
+    ...input.manifest,
+    repos: { ...input.manifest.repos, [name]: { url } },
+    scopes
+  };
+  await writeManifest(input.rnessDir, manifest);
+  return { manifest, name, url, action, declared };
+}
+async function workspaceDirs(repoDir) {
+  let patterns = [];
+  try {
+    const pkg = JSON.parse(
+      await readFile4(join4(repoDir, "package.json"), "utf8")
+    );
+    const w = pkg.workspaces;
+    if (Array.isArray(w))
+      patterns = w.filter((p) => typeof p === "string");
+    else if (w !== null && typeof w === "object" && Array.isArray(w.packages)) {
+      patterns = w.packages.filter(
+        (p) => typeof p === "string"
+      );
+    }
+  } catch {
+    return [];
+  }
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of patterns) {
+    for await (const match of glob(pattern, { cwd: repoDir })) {
+      const rel = match.split(sep).join(posix.sep);
+      if (await exists(join4(repoDir, ...rel.split(posix.sep), "package.json")))
+        dirs.add(rel);
+    }
+  }
+  return [...dirs].sort();
+}
+
+// src/core/terminal.ts
+var defaultTerminal = {
+  isTty: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+  // Lazy: the prompt library stays off every non-interactive path.
+  prompts: () => import("@clack/prompts")
+};
+
+// src/core/transport.ts
+import { spawn as spawn2 } from "child_process";
+
+// src/core/style.ts
+import { styleText } from "util";
+var FORMAT = {
+  done: "green",
+  idle: "dim",
+  info: "cyan",
+  warn: "yellow",
+  error: "red"
+};
+function noColor() {
+  const off = process.env["NO_COLOR"];
+  return off !== void 0 && off !== "" && process.env["FORCE_COLOR"] === void 0;
+}
+function paint(tone, text, stream = process.stdout) {
+  if (noColor()) return text;
+  return styleText(FORMAT[tone], text, { stream, validateStream: true });
+}
+var IDLE = /* @__PURE__ */ new Set(["unchanged", "skipped", "not cloned"]);
+var DONE = /* @__PURE__ */ new Set([
+  "created",
+  "cloned",
+  "adopted",
+  "declared",
+  "installed",
+  "committed",
+  "updated",
+  "upgraded",
+  "pulled",
+  "pushed",
+  "logged in",
+  "logged out",
+  "synced",
+  "listed"
+]);
+function toneOf(verb) {
+  if (DONE.has(verb)) return "done";
+  if (IDLE.has(verb)) return "idle";
+  if (verb === "stale") return "warn";
+  return "info";
+}
+var COLUMN = 8;
+function status(verb, rest, stream = process.stdout) {
+  const pad = " ".repeat(Math.max(0, COLUMN - verb.length));
+  return `${paint(toneOf(verb), verb, stream)}${pad} ${rest}`;
+}
+function bold(text, stream = process.stdout) {
+  if (noColor()) return text;
+  return styleText("bold", text, { stream, validateStream: true });
+}
+function badge(text, stream = process.stdout) {
+  if (noColor()) return text;
+  const padded = ` ${text} `;
+  const painted = styleText(["bgCyan", "black", "bold"], padded, {
+    stream,
+    validateStream: true
+  });
+  return painted === padded ? text : painted;
+}
+function grey(text, stream = process.stdout) {
+  if (noColor()) return text;
+  return styleText("gray", text, { stream, validateStream: true });
+}
+function unicode() {
+  if (process.platform !== "win32") return process.env["TERM"] !== "linux";
+  return process.env["WT_SESSION"] !== void 0 || process.env["TERM_PROGRAM"] === "vscode";
+}
+var PRIVATE_MARK = "\u{1F512}";
+function warn(text) {
+  return `${paint("warn", "warning:", process.stderr)} ${text}`;
+}
+var WORD = [" \u2588\u2580\u2588 \u2588\u2584 \u2588 \u2588\u2580\u2580 \u2588\u2580\u2580 \u2588\u2580\u2580", " \u2588\u2580\u2584 \u2588 \u2580\u2588 \u2588\u2588\u2584 \u2584\u2584\u2588 \u2584\u2584\u2588"];
+var FROM = [63, 185, 80];
+var TO = [57, 197, 207];
+function gradient(line) {
+  const chars = [...line];
+  const last = Math.max(1, chars.length - 1);
+  const painted = chars.map((ch, i) => {
+    if (ch === " ") return ch;
+    const [r, g, b] = FROM.map(
+      (from, c) => Math.round(from + ((TO[c] ?? from) - from) * i / last)
+    );
+    return `\x1B[38;2;${r};${g};${b}m${ch}`;
+  });
+  return `${painted.join("")}\x1B[39m`;
+}
+function banner(version, stream = process.stdout) {
+  const forced = process.env["FORCE_COLOR"] !== void 0 && process.env["FORCE_COLOR"] !== "0";
+  if (stream.isTTY !== true && !forced) return "";
+  const coloured = paint("done", "x", stream) !== "x";
+  const trueColour = coloured && typeof stream.hasColors === "function" && stream.hasColors(2 ** 24);
+  const word = WORD.map(
+    (line) => trueColour ? gradient(line) : paint("done", line, stream)
+  );
+  return [
+    "",
+    ...word,
+    "",
+    ` ${bold(`rness v${version}`, stream)}`,
+    ` ${paint("idle", "Context for AI coding agents, across an organization\u2019s repositories", stream)}`,
+    "",
+    ""
+  ].join("\n");
+}
+
+// src/core/transport.ts
+var GITHUB_HOSTS = { ssh: SSH_HOST, https: DEFAULT_HOST };
+var GREETING = /^Hi ([^!\s]+)! You've successfully authenticated/m;
+function parseSshGreeting(stderr) {
+  return GREETING.exec(stderr)?.[1] ?? null;
+}
+function firstLine2(text) {
+  return text.split("\n").find((l) => l.trim() !== "")?.trim() ?? null;
+}
+var STDERR_FLUSH_MS2 = 200;
+async function detectGithubSsh(opts) {
+  const timeoutMs = opts.timeoutMs ?? (opts.interactive ? 12e4 : 1e4);
+  const args = [
+    "-T",
+    "-o",
+    "ConnectTimeout=5",
+    ...opts.interactive ? [] : ["-o", "BatchMode=yes"],
+    "git@github.com"
+  ];
+  return new Promise((resolve4) => {
+    const child = spawn2(opts.command ?? "ssh", args, {
+      stdio: [opts.interactive ? "inherit" : "ignore", "ignore", "pipe"]
+    });
+    const chunks = [];
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => chunks.push(chunk));
+    let settled = false;
+    const settle = (access2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.stderr?.destroy();
+      resolve4(access2);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      settle({ ok: false, reason: `timed out after ${timeoutMs / 1e3}s` });
+    }, timeoutMs);
+    child.on("error", (e) => settle({ ok: false, reason: e.message }));
+    child.on("exit", (code) => {
+      const finish = () => {
+        const stderr2 = chunks.join("");
+        const login = parseSshGreeting(stderr2);
+        settle(
+          login !== null ? { ok: true, login } : {
+            ok: false,
+            reason: firstLine2(stderr2) ?? `ssh exited with code ${code ?? "?"}`
+          }
+        );
+      };
+      const stderr = child.stderr;
+      if (stderr === null || stderr.readableEnded || stderr.destroyed)
+        return finish();
+      const flush = setTimeout(finish, STDERR_FLUSH_MS2);
+      const done = () => {
+        clearTimeout(flush);
+        finish();
+      };
+      stderr.once("end", done);
+      stderr.once("error", done);
+    });
+  });
+}
+var defaultTransport = {
+  hosts: GITHUB_HOSTS,
+  detect: detectGithubSsh
+};
+async function testGithubSsh(transport, interactive, announce) {
+  const batch = await transport.detect({ interactive: false });
+  if (batch.ok || !interactive) return { access: batch, unattended: batch.ok };
+  announce();
+  return {
+    access: await transport.detect({ interactive: true }),
+    unattended: false
+  };
+}
+var loggedInAs = (login) => login === void 0 || login === null ? "" : `, logged in as ${login}`;
+function usingSentence(access2, login) {
+  return access2.ok ? `SSH works for github.com (as ${access2.login}) \u2014 repositories are cloned over SSH` : `No SSH access to github.com (${access2.reason}) \u2014 repositories are cloned over HTTPS${loggedInAs(login)}`;
+}
+function isSshUrl(url, hosts) {
+  return url.startsWith(hosts.ssh);
+}
+var CHECKING_LINE = status("checking", "ssh access to github.com\u2026");
+var CHECKING = [
+  "checking",
+  "ssh access to github.com\u2026",
+  "Checking SSH access to github.com \u2014 ssh may ask for your passphrase"
+];
+function usingRest(access2, login) {
+  return access2.ok ? `ssh (github.com as ${access2.login})` : `https (ssh to github.com unavailable: ${access2.reason}${loggedInAs(login)})`;
+}
+function sshWorkspaceLines(reason3) {
+  return [
+    `this workspace clones over SSH (rness.json) but ssh to github.com fails: ${reason3}`,
+    "set up an SSH key: https://docs.github.com/authentication/connecting-to-github-with-ssh"
+  ];
+}
+var INSTEAD_OF_LINES = [
+  "or make git use HTTPS for github.com on this machine:",
+  '  git config --global url."https://github.com/".insteadOf git@github.com:'
+];
+function httpsFlagLine(spec) {
+  return `or clone this repository over HTTPS: rness add ${spec} --https`;
+}
+
+// src/core/workspace.ts
+import { dirname as dirname3, join as join5, parse, resolve as resolve2 } from "path";
+async function findWorkspace(startDir) {
+  const start = resolve2(startDir);
+  const { root: fsRoot } = parse(start);
+  const ancestors = [];
+  for (let dir = start; ; dir = dirname3(dir)) {
+    ancestors.push(dir);
+    if (dir === fsRoot) break;
+  }
+  for (const dir of ancestors) {
+    if (await exists(join5(dir, ".rness", "rness.json")))
+      return { root: dir, rnessDir: join5(dir, ".rness") };
+  }
+  for (const dir of ancestors) {
+    if (await exists(join5(dir, "rness.json")))
+      return { root: dirname3(dir), rnessDir: dir };
+  }
+  throw new Error(`no rness workspace found above ${startDir}`);
+}
+
+// src/report.ts
+function reportError(e) {
+  const debug = process.env["RNESS_DEBUG"] === "1";
+  if (debug && e instanceof Error && e.stack) {
+    process.stderr.write(`${e.stack}
+`);
+  } else {
+    const message = e instanceof Error ? e.message : String(e);
+    process.stderr.write(`${paint("error", message, process.stderr)}
+`);
+  }
+  return 1;
+}
+
+// src/core/block.ts
+import { createHash } from "crypto";
+var BEGIN = "<!-- BEGIN rness -->";
+var END = "<!-- END rness -->";
+var BLOCK_SIZE_WARNING = 32 * 1024;
+var HEADER = /^<!-- rness (?:(\S+) )?· scope: (\S+) · contract: 1 · hash: ([0-9a-f]{12}) · generated: run `rness sync`, never edit inside this block -->$/;
+function toLf(s) {
+  return s.replace(/\r\n?/g, "\n");
+}
+function blockHash(body) {
+  return createHash("sha256").update(toLf(body), "utf8").digest("hex").slice(0, 12);
+}
+function intro(scope, org, depth) {
+  if (scope === null) {
+    return [
+      `This is the root of rness workspace \`${org}\`. Full context lives in \`.rness/\` \u2014`,
+      "read `STATUS.md`, then task-relevant `adr/`, `specs/`, `plans/`; live: `rness context`.",
+      "Every `org/<repo>/` carries its own block with the rules that apply there."
+    ].join("\n");
+  }
+  const rel = `${"../".repeat(depth)}.rness/`;
+  return [
+    `This directory is scope \`${scope}\` of rness workspace \`${org}\`. Full context lives in`,
+    `\`${rel}\` \u2014 read \`STATUS.md\`, then task-relevant \`adr/\`, \`specs/\`, \`plans/\`;`,
+    `live: \`rness context --scope ${scope}\`. If \`.rness/\` is not reachable, this is a`,
+    "standalone clone: the rules below are all you have."
+  ].join("\n");
+}
+function header(scope, hash) {
+  return `<!-- rness \xB7 scope: ${scope ?? "global"} \xB7 contract: 1 \xB7 hash: ${hash} \xB7 generated: run \`rness sync\`, never edit inside this block -->`;
+}
+function renderBlock({
+  scope,
+  org,
+  depth,
+  context
+}) {
+  const standards = context.collections.find((c) => c.name === "standards")?.files ?? [];
+  const rules = standards.length === 0 ? ["_No standards apply to this scope yet._"] : standards.map(
+    (f) => `<!-- rness: standards/${f.rel} -->
+${toLf(f.content).trim()}`
+  );
+  const body = `${intro(scope, org, depth)}
+
+## Rules
+${rules.join("\n\n")}`;
+  const hash = blockHash(body);
+  const text = [BEGIN, header(scope, hash), body, END].join("\n");
+  return { text, hash, bytes: Buffer.byteLength(text, "utf8") };
+}
+function parseHeader(line) {
+  const m = HEADER.exec(line.trimEnd());
+  if (m === null) return null;
+  return { version: m[1] ?? null, scope: m[2] ?? "", hash: m[3] ?? "" };
+}
+function bodyOf(blockLines) {
+  return blockLines.slice(2, -1).join("\n");
+}
+function isCurrentBlock(blockLines, freshHash) {
+  const header2 = parseHeader(blockLines[1] ?? "");
+  return header2 !== null && header2.hash === freshHash && blockHash(bodyOf(blockLines)) === freshHash;
+}
+
+// src/core/frontmatter.ts
+import { parse as parse2 } from "yaml";
+var FRONT_MATTER = /^---\r?\n(?:([\s\S]*?)\r?\n)?---(?:\r?\n|$)/;
+function fail2(message) {
+  throw new Error(`front matter: ${message}`);
+}
+function stripBom(source) {
+  return source.startsWith("\uFEFF") ? source.slice(1) : source;
+}
+function parseFrontMatter(source) {
+  const match = stripBom(source).match(FRONT_MATTER);
+  if (match === null) return null;
+  const block = match[1] ?? "";
+  if (block.trim() === "") return {};
+  let doc;
+  try {
+    doc = parse2(block, { logLevel: "error" });
+  } catch (e) {
+    fail2(
+      e instanceof Error ? (e.message.split("\n")[0] ?? "invalid YAML").replace(/:$/, "") : "invalid YAML"
+    );
+  }
+  if (doc === null || doc === void 0) return {};
+  if (typeof doc !== "object" || Array.isArray(doc))
+    fail2("block must be a mapping of keys to values");
+  return doc;
+}
+function stripFrontMatter(source) {
+  const text = stripBom(source);
+  const match = text.match(FRONT_MATTER);
+  if (match === null) return text;
+  return text.slice(match[0].length).replace(/^(?:[ \t]*\r?\n)+/, "");
+}
+function extractTitle(source) {
+  return stripBom(source).match(/^# (.+)$/m)?.[1]?.trim() ?? null;
+}
+
+// src/core/collect.ts
+import { glob as glob2, readFile as readFile5 } from "fs/promises";
+import { join as join6, posix as posix2, sep as sep2 } from "path";
+function toPosix(rel) {
+  return rel.split(sep2).join(posix2.sep);
+}
+async function collectMarkdown(dir) {
+  const rels = [];
+  for await (const rel of glob2("**/*.md", { cwd: dir })) rels.push(toPosix(rel));
+  const items = await Promise.all(
+    rels.map(async (rel) => {
+      const path = join6(dir, ...rel.split(posix2.sep));
+      const body = await readFile5(path, "utf8");
+      let fields = null;
+      let fieldsError = null;
+      try {
+        fields = parseFrontMatter(body);
+      } catch (e) {
+        fieldsError = e instanceof Error ? e.message : String(e);
+      }
+      return {
+        path,
+        rel,
+        fields,
+        fieldsError,
+        title: extractTitle(body),
+        body,
+        content: stripFrontMatter(body)
+      };
+    })
+  );
+  return items.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+}
+
+// src/core/scope.ts
+function isPrefix(prefix, target) {
+  return prefix === target || target.startsWith(`${prefix}/`);
+}
+function resolveScope(manifest, relDir) {
+  let best = null;
+  let bestLen = -1;
+  for (const [name, entry] of Object.entries(manifest.scopes)) {
+    if (isPrefix(entry.path, relDir) && entry.path.length > bestLen) {
+      best = name;
+      bestLen = entry.path.length;
+    }
+  }
+  return best;
+}
+function scopeChain(manifest, scope) {
+  if (scope === null) return [];
+  const chain = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (name, stack) => {
+    if (stack.has(name)) throw new Error(`extends cycle at scope "${name}"`);
+    if (seen.has(name)) return;
+    seen.add(name);
+    chain.push(name);
+    stack.add(name);
+    const entry = Object.hasOwn(manifest.scopes, name) ? manifest.scopes[name] : void 0;
+    for (const target of entry?.extends ?? []) visit(target, stack);
+    stack.delete(name);
+  };
+  visit(scope, /* @__PURE__ */ new Set());
+  return chain;
+}
+
+// src/core/context.ts
+import { join as join7 } from "path";
+var COLLECTIONS = [
+  "standards",
+  "adr",
+  "specs",
+  "plans",
+  "skills"
+];
+function ownerScope(rel) {
+  const slash = rel.indexOf("/");
+  return slash === -1 ? null : rel.slice(0, slash);
+}
+async function assembleCollection(dir, name, chain) {
+  const items = await collectMarkdown(dir);
+  const groups = new Map(chain.map((s) => [s, []]));
+  const rootFiles = [];
+  for (const item of items) {
+    const owner = ownerScope(item.rel);
+    if (owner === null) rootFiles.push({ ...item, scope: null });
+    else groups.get(owner)?.push({ ...item, scope: owner });
+  }
+  const files = [];
+  const push = (f) => {
+    files.push({
+      rel: f.rel,
+      scope: f.scope,
+      title: f.title,
+      body: f.body,
+      content: f.content
+    });
+  };
+  for (const s of chain) for (const f of groups.get(s) ?? []) push(f);
+  for (const f of rootFiles) push(f);
+  return { name, files };
+}
+async function assembleContext({
+  rnessDir,
+  manifest,
+  scope
+}) {
+  const chain = scopeChain(manifest, scope);
+  const collections = await Promise.all(
+    COLLECTIONS.map(
+      (name) => assembleCollection(join7(rnessDir, name), name, chain)
+    )
+  );
+  return { scope, collections };
+}
+
+// src/core/merge.ts
+import { join as join8 } from "path";
+function findBlock(lines) {
+  const begins = [];
+  const ends = [];
+  lines.forEach((line, i) => {
+    const l = line.trimEnd();
+    if (l === BEGIN) begins.push(i);
+    if (l === END) ends.push(i);
+  });
+  if (begins.length === 0 && ends.length === 0) return { kind: "none" };
+  const begin = begins[0];
+  const end = ends[0];
+  if (begins.length !== 1 || ends.length !== 1 || begin === void 0 || end === void 0) {
+    return {
+      kind: "error",
+      message: `expected exactly one ${BEGIN} \u2026 ${END} span, found ${begins.length} BEGIN and ${ends.length} END`
+    };
+  }
+  if (end < begin)
+    return { kind: "error", message: `${END} comes before ${BEGIN}` };
+  return { kind: "one", begin, end };
+}
+function mergeBlock(existing, block) {
+  if (existing === null) return { ok: true, text: `${block}
+`, changed: true };
+  const eol = existing.includes("\r\n") ? "\r\n" : "\n";
+  const lines = existing.split(/\r?\n/);
+  const found = findBlock(lines);
+  if (found.kind === "error") return { ok: false, error: found.message };
+  const rendered = block.split("\n").join(eol);
+  const starts = [0];
+  for (const m of existing.matchAll(/\r?\n/g))
+    starts.push((m.index ?? 0) + m[0].length);
+  const lineStart = (i) => starts[i] ?? existing.length;
+  let text;
+  if (found.kind === "one") {
+    const endLine = lines[found.end] ?? "";
+    const afterEnd = lineStart(found.end) + endLine.length;
+    text = `${existing.slice(0, lineStart(found.begin))}${rendered}${existing.slice(afterEnd)}`;
+  } else if (lines.length >= 3 && (lines[0] ?? "").startsWith("# ") && lines[1] === "") {
+    const at = lineStart(2);
+    text = `${existing.slice(0, at)}${rendered}${eol}${eol}${existing.slice(at)}`;
+  } else {
+    text = `${rendered}${eol}${eol}${existing}`;
+  }
+  return { ok: true, text, changed: text !== existing };
+}
+async function ensureClaudeMd(dir) {
+  const file = join8(dir, "CLAUDE.md");
+  if (await isSymlink(file)) return "unchanged";
+  const existing = await readOrNull(file);
+  if (existing === null) {
+    await writeFileAtomic(file, "@AGENTS.md\n");
+    return "created";
+  }
+  if (existing.split(/\r?\n/).some((l) => l.trim() === "@AGENTS.md"))
+    return "unchanged";
+  const eol = existing.includes("\r\n") ? "\r\n" : "\n";
+  await writeFileAtomic(file, `@AGENTS.md${eol}${existing}`);
+  return "prepended";
+}
+
+// src/commands/sync.ts
+import { readdir } from "fs/promises";
+import { join as join9 } from "path";
+
+// src/core/progress.ts
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var INTERVAL_MS = 80;
+var CLEAR_LINE = "\r\x1B[2K";
+function isLive(stream) {
+  return stream.isTTY === true && process.env["TERM"] !== "dumb" && process.env["CI"] === void 0;
+}
+async function step(options, work) {
+  const stream = options.stream ?? process.stdout;
+  if (!isLive(stream)) return work();
+  const draw = (frame) => {
+    rawWrite(
+      `${CLEAR_LINE}${paint("info", frame, stream)} ${paint("idle", options.label, stream)}`
+    );
+  };
+  let timer;
+  let shown = true;
+  const erase = () => {
+    if (!shown) return;
+    shown = false;
+    if (timer !== void 0) clearInterval(timer);
+    rawWrite(CLEAR_LINE);
+  };
+  const rawWrite = stream.write.bind(stream);
+  const rawErr = process.stderr.write.bind(
+    process.stderr
+  );
+  const guard = (raw) => ((...args) => {
+    erase();
+    return raw(...args);
+  });
+  if (options.animate) {
+    let i = 0;
+    draw(FRAMES[0] ?? "");
+    timer = setInterval(() => {
+      i = (i + 1) % FRAMES.length;
+      if (shown) draw(FRAMES[i] ?? "");
+    }, INTERVAL_MS);
+    timer.unref();
+  } else {
+    draw("\u2026");
+  }
+  stream.write = guard(rawWrite);
+  if (process.stderr !== stream) process.stderr.write = guard(rawErr);
+  try {
+    return await work();
+  } finally {
+    stream.write = rawWrite;
+    if (process.stderr !== stream) process.stderr.write = rawErr;
+    erase();
+  }
+}
+
+// src/core/ui.ts
+var capitalise = (s) => s === "" ? s : `${s[0]?.toUpperCase() ?? ""}${s.slice(1)}`;
+var tidy = (label) => capitalise(label.replace(/\s+/g, " ").trim());
+var plainUi = {
+  session: false,
+  gitIsSilent: false,
+  intro: () => void 0,
+  outro: () => void 0,
+  line: (verb, rest) => {
+    process.stdout.write(`${status(verb, rest)}
+`);
+  },
+  warn: (text) => {
+    process.stderr.write(`${warn(text)}
+`);
+  },
+  note: (title, lines) => {
+    process.stdout.write(
+      ["", `${title}:`, ...lines.map((l) => `  ${l}`), ""].join("\n")
+    );
+  },
+  hint: (text, stream = "stdout") => {
+    process[stream].write(`${text}
+`);
+  },
+  error: (text) => {
+    process.stderr.write(`${text}
+`);
+  },
+  cancelled: () => {
+    process.stderr.write("cancelled\n");
+  },
+  async step(options, work, done) {
+    const result = await step(
+      { label: options.doing, animate: options.git !== true },
+      work
+    );
+    const line = options.quiet === true ? null : done?.(result) ?? null;
+    if (line !== null) this.line(line[0], line[1]);
+    return result;
+  }
+};
+function sessionUi(p) {
+  const say = (verb, text) => {
+    const tone = toneOf(verb);
+    if (tone === "done") p.log.step(text);
+    else if (tone === "warn") p.log.warn(text);
+    else if (tone === "idle") p.log.message(paint("idle", text));
+    else p.log.info(text);
+  };
+  return {
+    session: true,
+    gitIsSilent: false,
+    intro: (title) => {
+      p.intro(badge(title));
+    },
+    outro: (message, tone = "done") => {
+      p.outro(paint(tone, message));
+    },
+    line: (verb, rest, sentence) => {
+      say(verb, sentence ?? tidy(`${verb} ${rest}`));
+    },
+    warn: (text) => {
+      p.log.warn(text);
+    },
+    note: (title, lines) => {
+      p.note(lines.join("\n"), title, { format: (line) => grey(line) });
+    },
+    hint: (text) => {
+      p.log.message(paint("idle", text));
+    },
+    error: (text) => {
+      p.log.error(text);
+    },
+    cancelled: () => {
+      p.cancel("Cancelled");
+    },
+    async step(options, work, done) {
+      const label = options.sentence ?? tidy(options.doing);
+      const finish = (result) => {
+        const line = done?.(result) ?? null;
+        return line === null ? null : tidy(`${line[0]} ${line[1]}`);
+      };
+      if (options.git === true && !this.gitIsSilent) {
+        p.log.message(paint("idle", `${label}\u2026`));
+        const result = await work();
+        const text = finish(result);
+        if (text !== null) p.log.step(text);
+        return result;
+      }
+      const spin = p.spinner();
+      spin.start(label);
+      try {
+        const result = await work();
+        spin.stop(finish(result) ?? label);
+        return result;
+      } catch (e) {
+        spin.error(`${label} \u2014 failed`);
+        throw e;
+      }
+    }
+  };
+}
+async function makeUi(terminal) {
+  const live = terminal.isTty() && process.stdout.isTTY === true && process.env["CI"] === void 0 && process.env["TERM"] !== "dumb";
+  if (!live) return { ...plainUi };
+  const p = await terminal.prompts();
+  if (p.intro === void 0 || p.outro === void 0 || p.cancel === void 0 || p.note === void 0 || p.log === void 0 || p.spinner === void 0)
+    return { ...plainUi };
+  return sessionUi({
+    intro: p.intro,
+    outro: p.outro,
+    cancel: p.cancel,
+    note: p.note,
+    log: p.log,
+    spinner: p.spinner
+  });
+}
+
+// src/commands/sync.ts
+var MANAGED_FILES = ["AGENTS.md", "CLAUDE.md"];
+function targetsOf(manifest, root, only) {
+  const targets = [];
+  if (only === void 0)
+    targets.push({ scope: null, dir: root, depth: 0, label: "AGENTS.md" });
+  for (const [name, entry] of Object.entries(manifest.scopes)) {
+    if (only !== void 0 && name !== only) continue;
+    const segments = entry.path.split("/");
+    targets.push({
+      scope: name,
+      dir: join9(root, ...segments),
+      depth: segments.length,
+      label: `${entry.path}/AGENTS.md`
+    });
+  }
+  return targets;
+}
+var SELECT_ALL = "*";
+async function clonesIn(root) {
+  try {
+    const entries = await readdir(join9(root, "org"), { withFileTypes: true });
+    return new Set(
+      entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name)
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function askWhatToSync(input) {
+  if (!input.terminal.isTty()) {
+    process.stderr.write(
+      "rness sync writes files; pass --yes to run without a prompt\n"
+    );
+    return 2;
+  }
+  const p = await input.terminal.prompts();
+  const cancelled2 = () => {
+    input.ui.cancelled();
+    return 1;
+  };
+  if (input.offer && input.missing.length > 0) {
+    const answer = await p.autocompleteMultiselect({
+      message: "Do you want to sync as well?",
+      options: [
+        {
+          value: SELECT_ALL,
+          label: "Select all",
+          hint: `${input.missing.length} repositories from rness.json`
+        },
+        ...input.missing.map((name) => ({ value: name, label: name }))
+      ],
+      required: false,
+      placeholder: "Type to filter"
+    });
+    if (p.isCancel(answer) || !Array.isArray(answer)) return cancelled2();
+    return answer.includes(SELECT_ALL) ? [...input.missing] : answer.filter((name) => name !== SELECT_ALL);
+  }
+  const ok = await p.confirm({
+    message: `Sync workspace \`${input.org}\`: rewrite the rness blocks of your clones?`
+  });
+  if (p.isCancel(ok) || ok !== true) return cancelled2();
+  return [];
+}
+async function syncCommand(opts, deps = {}) {
+  const terminal = deps.terminal ?? defaultTerminal;
+  const transport = deps.transport ?? defaultTransport;
+  let provider = deps.provider;
+  const credentialsFor = async (url) => (provider ??= await githubProvider()).credentialsFor(url);
+  const cwd = opts.cwd ?? process.cwd();
+  const check = opts.check === true;
+  const ownUi = deps.ui === void 0;
+  const ui = deps.ui ?? (opts.yes !== true && !check ? await makeUi(terminal) : { ...plainUi });
+  try {
+    const ws = await findWorkspace(cwd);
+    const manifest = await loadManifest(ws.rnessDir);
+    const { org, warning } = resolveOrg(manifest, ws.root);
+    if (ownUi) ui.intro(`Sync workspace ${org}`);
+    if (warning !== null) ui.warn(warning);
+    if (opts.scope !== void 0 && !Object.hasOwn(manifest.scopes, opts.scope)) {
+      process.stderr.write(`unknown scope: ${opts.scope}
+`);
+      return 1;
+    }
+    const clones = await clonesIn(ws.root);
+    const missing = Object.keys(manifest.repos).filter((n) => !clones.has(n));
+    let toClone = new Set(opts.all === true && !check ? missing : []);
+    if (!check && opts.yes !== true) {
+      const answer = await askWhatToSync({
+        org,
+        missing,
+        // `--all` already answers; `--scope` is about one block, not the workspace.
+        offer: opts.all !== true && opts.scope === void 0,
+        terminal,
+        ui
+      });
+      if (typeof answer === "number") return answer;
+      if (opts.all !== true) toClone = new Set(answer);
+    }
+    const overSsh = [...toClone].some((name) => {
+      const repo = manifest.repos[name];
+      return repo !== void 0 && isSshUrl(repo.url, transport.hosts);
+    });
+    if (!overSsh) ui.gitIsSilent = true;
+    if (overSsh) {
+      const interactive = opts.yes !== true && terminal.isTty();
+      const { access: access2, unattended } = await testGithubSsh(
+        transport,
+        interactive,
+        () => ui.line(...CHECKING)
+      );
+      if (unattended) ui.gitIsSilent = true;
+      if (!access2.ok) {
+        process.stderr.write(
+          `${[...sshWorkspaceLines(access2.reason), ...INSTEAD_OF_LINES].join("\n")}
+`
+        );
+        return 1;
+      }
+    }
+    const lines = [];
+    const problems = [];
+    try {
+      const notCloned = /* @__PURE__ */ new Set();
+      for (const [name, repo] of Object.entries(manifest.repos)) {
+        const dir = join9(ws.root, "org", name);
+        const label = `org/${name}`;
+        if (!await exists(dir)) {
+          if (!toClone.has(name)) {
+            notCloned.add(name);
+            continue;
+          }
+          try {
+            const credentials = await credentialsFor(repo.url);
+            await ui.step(
+              { doing: `cloning  ${label}`, git: true },
+              () => clone(repo.url, dir, credentials)
+            );
+            lines.push(["cloned", `${label}`]);
+          } catch (e) {
+            problems.push(
+              `${label}: ${e instanceof Error ? e.message : String(e)}`
+            );
+          }
+        } else if (opts.pull === true && !check) {
+          try {
+            if (!await isClean(dir, MANAGED_FILES)) {
+              lines.push(["skipped", `${label} (working tree not clean)`]);
+              continue;
+            }
+            const credentials = await credentialsFor(repo.url);
+            await ui.step(
+              { doing: `pulling  ${label}`, git: true },
+              () => pullFastForward(dir, credentials)
+            );
+            lines.push(["pulled", `${label}`]);
+          } catch (e) {
+            problems.push(
+              `${label}: ${e instanceof Error ? e.message : String(e)}`
+            );
+          }
+        }
+      }
+      if (notCloned.size > 0)
+        lines.push(
+          `not cloned: ${[...notCloned].join(", ")} (rness add <name>, or rness sync --all)`
+        );
+      const scoped = new Set(
+        Object.values(manifest.scopes).map((s) => s.path.split("/")[1])
+      );
+      const undeclared = [...clones].filter(
+        (n) => !Object.hasOwn(manifest.repos, n) && !scoped.has(n)
+      );
+      if (undeclared.length > 0)
+        lines.push(
+          `not in rness.json: ${undeclared.join(", ")} (rness add <name> declares it)`
+        );
+      if (!await exists(join9(ws.root, "org"))) {
+        lines.push(["skipped", "blocks (no org/ directory here)"]);
+      } else {
+        let differences = 0;
+        for (const t of targetsOf(manifest, ws.root, opts.scope)) {
+          if (!await exists(t.dir)) {
+            const repo = t.label.split("/")[1];
+            if (!t.label.startsWith("org/") || repo === void 0 || !notCloned.has(repo))
+              lines.push(["skipped", `${t.label} (directory not present)`]);
+            continue;
+          }
+          const linked = await Promise.all(
+            MANAGED_FILES.map((f) => isSymlink(join9(t.dir, f)))
+          );
+          if (linked.includes(true)) {
+            lines.push(["skipped", `${t.label} (symlink)`]);
+            continue;
+          }
+          const context = await assembleContext({
+            rnessDir: ws.rnessDir,
+            manifest,
+            scope: t.scope
+          });
+          const block = renderBlock({
+            scope: t.scope,
+            org,
+            depth: t.depth,
+            context
+          });
+          if (block.bytes > BLOCK_SIZE_WARNING) {
+            ui.warn(
+              `${t.label}: block is ${Math.round(block.bytes / 1024)} KB (over 32 KB)`
+            );
+          }
+          const file = join9(t.dir, "AGENTS.md");
+          const existing = await readOrNull(file);
+          const existingLines = existing === null ? [] : existing.split(/\r?\n/);
+          const span = findBlock(existingLines);
+          const current = span.kind === "one" && isCurrentBlock(
+            existingLines.slice(span.begin, span.end + 1),
+            block.hash
+          );
+          const merged = current ? { ok: true, text: existing ?? "", changed: false } : mergeBlock(existing, block.text);
+          if (!merged.ok) {
+            problems.push(`${t.label}: ${merged.error}`);
+            continue;
+          }
+          if (!merged.changed) {
+            lines.push(["unchanged", `${t.label}`]);
+            if (!check) await ensureClaudeMd(t.dir);
+            continue;
+          }
+          if (check) {
+            lines.push(["stale", `${t.label}`]);
+            differences += 1;
+            continue;
+          }
+          await writeFileAtomic(file, merged.text);
+          await ensureClaudeMd(t.dir);
+          lines.push(["updated", `${t.label}`]);
+        }
+        if (check && differences > 0)
+          problems.push(`${differences} block(s) out of date \u2014 run rness sync`);
+      }
+      return problems.length > 0 ? 1 : 0;
+    } finally {
+      for (const l of lines)
+        if (typeof l === "string") ui.hint(l);
+        else ui.line(l[0], l[1]);
+      for (const p of problems) ui.error(p);
+      if (ownUi)
+        ui.outro(
+          problems.length > 0 ? "Done, with problems" : check ? "Checked" : "Your clones carry the current context",
+          problems.length > 0 ? "warn" : "done"
+        );
+    }
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/commands/add.ts
+import { join as join10 } from "path";
+function printDeclared(ui, result, already) {
+  for (const name of result.declared) {
+    if (already.has(name)) continue;
+    const entry = result.manifest.scopes[name];
+    if (entry === void 0) continue;
+    const ext = entry.extends.length === 0 ? "" : `, extends ${entry.extends.join(", ")}`;
+    ui.line("declared", `scope ${name} (${entry.path}${ext})`);
+  }
+}
+var FULL_URL2 = /^(https?:\/\/|git@|ssh:\/\/|file:\/\/)/;
+async function addCommand(spec, opts, deps = {}) {
+  const terminal = deps.terminal ?? defaultTerminal;
+  const transport = deps.transport ?? defaultTransport;
+  let provider = deps.provider;
+  const credentialsFor = async (url) => (provider ??= await githubProvider()).credentialsFor(url);
+  const cwd = opts.cwd ?? process.cwd();
+  if (opts.ssh === true && opts.https === true) {
+    process.stderr.write("--ssh and --https cannot be combined\n");
+    return 2;
+  }
+  try {
+    const ws = await findWorkspace(cwd);
+    const manifest = await loadManifest(ws.rnessDir);
+    const { org, warning } = resolveOrg(manifest, ws.root);
+    if (warning !== null) process.stderr.write(`${warn(warning)}
+`);
+    let parsed;
+    try {
+      parsed = parseRepoSpec(spec, org, transport.hosts.https);
+    } catch (e) {
+      process.stderr.write(`${e instanceof Error ? e.message : String(e)}
+`);
+      return 2;
+    }
+    const interactive = opts.yes !== true;
+    const ownUi = deps.ui === void 0;
+    if (interactive && !terminal.isTty()) {
+      process.stderr.write(
+        "rness add clones and writes files; pass --yes to run without a prompt\n"
+      );
+      return 2;
+    }
+    const ui = deps.ui ?? (interactive ? await makeUi(terminal) : { ...plainUi });
+    if (ownUi) ui.intro(`Add ${parsed.name} to workspace ${org}`);
+    if (opts.host !== void 0 || opts.https === true) ui.gitIsSilent = true;
+    let host = opts.host;
+    if (host === void 0 && opts.ssh === true) host = transport.hosts.ssh;
+    if (host === void 0 && opts.https === true) host = transport.hosts.https;
+    if (host === void 0 && FULL_URL2.test(spec)) host = transport.hosts.https;
+    if (host === void 0) {
+      const { access: access2, unattended } = await testGithubSsh(
+        transport,
+        interactive,
+        () => ui.line(...CHECKING)
+      );
+      if (unattended || !access2.ok) ui.gitIsSilent = true;
+      const overSsh = Object.values(manifest.repos).some(
+        (r) => isSshUrl(r.url, transport.hosts)
+      );
+      if (access2.ok || !overSsh) {
+        ui.line("using", usingRest(access2), usingSentence(access2));
+        host = access2.ok ? transport.hosts.ssh : transport.hosts.https;
+      } else {
+        const lines = sshWorkspaceLines(access2.reason);
+        if (!interactive) {
+          process.stderr.write(
+            `${[...lines, httpsFlagLine(spec)].join("\n")}
+`
+          );
+          return 1;
+        }
+        ui.error(lines[0]);
+        ui.hint(lines[1], "stderr");
+        const p = await terminal.prompts();
+        const https = await p.confirm({
+          message: `Clone ${parsed.name} over HTTPS instead?`,
+          initialValue: false
+        });
+        if (p.isCancel(https) || https !== true) return 1;
+        host = transport.hosts.https;
+      }
+    }
+    parsed = parseRepoSpec(spec, org, host);
+    const scopes = (opts.scopes ?? "").split(",").map((s) => s.trim()).filter((s) => s !== "");
+    const dir = join10(ws.root, "org", parsed.name);
+    const present = await exists(dir);
+    if (interactive) {
+      const { confirm, isCancel } = await terminal.prompts();
+      const plan = present ? `adopt org/${parsed.name}` : `clone ${parsed.url} into org/${parsed.name}`;
+      const ok = await confirm({
+        message: `${plan}, declare scope "${parsed.name}" in rness.json, then sync?`
+      });
+      if (isCancel(ok) || ok !== true) {
+        ui.cancelled();
+        return 1;
+      }
+    }
+    const credentials = await credentialsFor(parsed.url);
+    const chosenHost = host;
+    let result = await ui.step(
+      {
+        doing: `${present ? "adopting" : "cloning "} org/${parsed.name}`,
+        git: true
+      },
+      () => addRepository({
+        root: ws.root,
+        rnessDir: ws.rnessDir,
+        manifest,
+        spec,
+        org,
+        host: chosenHost,
+        scopes,
+        credentialsFor: () => credentials
+      }),
+      (r) => [r.action, `org/${r.name}`]
+    );
+    const announced = /* @__PURE__ */ new Set();
+    printDeclared(ui, result, announced);
+    for (const name of result.declared) announced.add(name);
+    if (opts.yes !== true && scopes.length === 0) {
+      const candidates = await workspaceDirs(dir);
+      if (candidates.length > 0) {
+        const { isCancel, multiselect } = await terminal.prompts();
+        const picked = await multiselect({
+          message: "Declare these workspace packages as scopes?",
+          options: candidates.map((c) => ({ value: c, label: c })),
+          required: false
+        });
+        if (isCancel(picked)) {
+          ui.cancelled();
+          return 1;
+        }
+        if (Array.isArray(picked) && picked.length > 0) {
+          result = await addRepository({
+            root: ws.root,
+            rnessDir: ws.rnessDir,
+            manifest: result.manifest,
+            spec,
+            org,
+            host,
+            scopes: picked,
+            credentialsFor: () => credentials
+          });
+          printDeclared(ui, result, announced);
+        }
+      }
+    }
+    const code = await syncCommand({ yes: true, cwd: ws.root }, { ui });
+    if (ownUi)
+      ui.outro(
+        code === 0 ? `${result.name} is in your workspace` : "Done, with problems",
+        code === 0 ? "done" : "warn"
+      );
+    return code;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/commands/context.ts
+import { posix as posix3, relative, sep as sep3 } from "path";
+function renderMarkdown(ctx) {
+  const parts = [];
+  for (const collection of ctx.collections) {
+    if (collection.files.length === 0) continue;
+    parts.push(`## ${collection.name}
+`);
+    for (const file of collection.files) {
+      parts.push(
+        `<!-- rness: ${collection.name}/${file.rel} -->
+${file.content.trim()}
+`
+      );
+    }
+  }
+  return `${parts.join("\n")}
+`;
+}
+async function contextCommand(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  try {
+    const ws = await findWorkspace(cwd);
+    const manifest = await loadManifest(ws.rnessDir);
+    let scope;
+    if (opts.scope !== void 0) {
+      if (!Object.hasOwn(manifest.scopes, opts.scope)) {
+        process.stderr.write(`unknown scope: ${opts.scope}
+`);
+        return 1;
+      }
+      scope = opts.scope;
+    } else {
+      const rel = relative(ws.root, cwd).split(sep3).join(posix3.sep);
+      scope = resolveScope(manifest, rel);
+    }
+    const ctx = await assembleContext({
+      rnessDir: ws.rnessDir,
+      manifest,
+      scope
+    });
+    process.stdout.write(
+      opts.json ? `${JSON.stringify(ctx, null, 2)}
+` : renderMarkdown(ctx)
+    );
+    return 0;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/core/delegate.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join11 } from "path";
+var DEFAULT_BIN = "dist/bin/rness.js";
+async function readPinnedCli(rnessDir) {
+  const dir = join11(rnessDir, "node_modules", "@rness", "cli");
+  let pkg;
+  try {
+    pkg = JSON.parse(await readFile6(join11(dir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+  const declared = pkg.bin;
+  let bin = DEFAULT_BIN;
+  if (typeof declared === "string") bin = declared;
+  else if (declared !== null && typeof declared === "object") {
+    const named = declared["rness"];
+    if (typeof named === "string") bin = named;
+  }
+  return {
+    dir,
+    bin,
+    version: typeof pkg.version === "string" ? pkg.version : null
+  };
+}
+async function findDelegate(cwd, ownVersion) {
+  let root;
+  let rnessDir;
+  try {
+    const ws = await findWorkspace(cwd);
+    root = ws.root;
+    rnessDir = ws.rnessDir;
+  } catch {
+    return null;
+  }
+  const pinned = await readPinnedCli(rnessDir);
+  if (pinned === null) return null;
+  const { version } = pinned;
+  if (version === null || version === ownVersion) return null;
+  return { entry: join11(pinned.dir, "dist", "index.js"), version, root };
+}
+
+// src/core/pm.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileP2 = promisify2(execFile2);
+var PACKAGE_MANAGERS = [
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun"
+];
+function isPackageManager(value) {
+  return PACKAGE_MANAGERS.includes(value);
+}
+function detectPackageManager(userAgent = process.env["npm_config_user_agent"] ?? "") {
+  const name = userAgent.split("/")[0] ?? "";
+  return isPackageManager(name) ? name : "npm";
+}
+function firstLine3(text) {
+  return text.split("\n").find((l) => l.trim() !== "")?.trim() ?? "unknown error";
+}
+async function packageManagerVersion(pm) {
+  try {
+    const { stdout } = await execFileP2(pm, ["--version"]);
+    return stdout.trim();
+  } catch (e) {
+    throw new Error(`${pm} is not available on PATH`, { cause: e });
+  }
+}
+var BARE_NPM_CODE = /^npm (error|ERR!) code \S+$/;
+function installErrorLine(stderr) {
+  const lines = stderr.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  return lines.find((l) => !BARE_NPM_CODE.test(l)) ?? firstLine3(stderr);
+}
+async function installDependencies(pm, dir) {
+  try {
+    await execFileP2(pm, ["install"], { cwd: dir, maxBuffer: 16 * 1024 * 1024 });
+  } catch (e) {
+    const err = e;
+    throw new Error(
+      `${pm} install failed in ${dir}: ${installErrorLine(err.stderr ?? err.message)}`,
+      { cause: e }
+    );
+  }
+}
+
+// src/core/pinned.ts
+import { execFile as execFile3 } from "child_process";
+import { readFile as readFile7 } from "fs/promises";
+import { basename as basename3, join as join12 } from "path";
+import { promisify as promisify3 } from "util";
+var execFileP3 = promisify3(execFile3);
+var PACKAGE = "@rness/cli";
+var EXACT_VERSION = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+function compareVersions(a, b) {
+  const split = (v) => {
+    const dash = v.indexOf("-");
+    const core = dash === -1 ? v : v.slice(0, dash);
+    return [core.split(".").map(Number), dash === -1 ? null : v.slice(dash + 1)];
+  };
+  const [coreA, preA] = split(a);
+  const [coreB, preB] = split(b);
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (coreA[i] ?? 0) - (coreB[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  if (preA === preB) return 0;
+  if (preA === null) return 1;
+  if (preB === null) return -1;
+  return preA.localeCompare(preB, "en", { numeric: true });
+}
+async function readPackageJson(rnessDir) {
+  try {
+    const parsed = JSON.parse(
+      await readFile7(join12(rnessDir, "package.json"), "utf8")
+    );
+    return parsed !== null && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readPin(rnessDir) {
+  const pkg = await readPackageJson(rnessDir);
+  if (pkg === null) return null;
+  for (const field of ["devDependencies", "dependencies"]) {
+    const deps = pkg[field];
+    if (deps === null || typeof deps !== "object") continue;
+    const spec = deps[PACKAGE];
+    if (typeof spec === "string") return { spec, field };
+  }
+  return null;
+}
+async function writePin(rnessDir, from, to) {
+  const file = join12(rnessDir, "package.json");
+  const text = await readFile7(file, "utf8");
+  const entry = new RegExp(
+    `("${PACKAGE}"\\s*:\\s*")${from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(")`
+  );
+  if (!entry.test(text))
+    throw new Error(`"${PACKAGE}": "${from}" not found in package.json`);
+  await writeFileAtomic(file, text.replace(entry, `$1${to}$2`));
+}
+var LOCKFILES = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["package-lock.json", "npm"]
+];
+async function workspacePackageManager(rnessDir) {
+  const declared = (await readPackageJson(rnessDir))?.["packageManager"];
+  if (typeof declared === "string") {
+    const name = declared.split("@")[0] ?? "";
+    if (isPackageManager(name)) return name;
+  }
+  for (const [lockfile, pm] of LOCKFILES)
+    if (await exists(join12(rnessDir, lockfile))) return pm;
+  return "npm";
+}
+async function pinDrift(rnessDir) {
+  const pin = await readPin(rnessDir);
+  if (pin === null || !EXACT_VERSION.test(pin.spec)) return null;
+  const installed = (await readPinnedCli(rnessDir))?.version ?? null;
+  return installed === pin.spec ? null : { pin: pin.spec, installed };
+}
+async function driftWarning(cwd) {
+  let root;
+  let rnessDir;
+  try {
+    const ws = await findWorkspace(cwd);
+    root = ws.root;
+    rnessDir = ws.rnessDir;
+  } catch {
+    return null;
+  }
+  const drift = await pinDrift(rnessDir);
+  if (drift === null) return null;
+  const pm = await workspacePackageManager(rnessDir);
+  return warn(
+    `${basename3(root)}/.rness pins @rness/cli ${drift.pin} but ${drift.installed ?? "nothing"} is installed \u2014 run ${pm} install in .rness`
+  );
+}
+async function runPinnedSync(root) {
+  const installed = await readPinnedCli(join12(root, ".rness"));
+  if (installed === null) return null;
+  const pinned = join12(installed.dir, ...installed.bin.split("/"));
+  if (!await exists(pinned))
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `@rness/cli in .rness is not installed correctly (missing ${installed.bin}); reinstall in .rness/
+`
+    };
+  try {
+    const { stdout, stderr } = await execFileP3(
+      process.execPath,
+      [pinned, "sync", "--yes"],
+      { cwd: root, maxBuffer: 16 * 1024 * 1024 }
+    );
+    return { code: 0, stdout, stderr };
+  } catch (e) {
+    const err = e;
+    return {
+      code: typeof err.code === "number" ? err.code : 1,
+      stdout: err.stdout ?? "",
+      stderr: err.stderr ?? ""
+    };
+  }
+}
+function summariseSync(stdout) {
+  const counts = /* @__PURE__ */ new Map();
+  const others = [];
+  for (const line of stdout.split("\n")) {
+    if (line.trim() === "") continue;
+    const verb = /^(updated|unchanged|stale)\s/.exec(line)?.[1];
+    if (verb === void 0) others.push(line);
+    else counts.set(verb, (counts.get(verb) ?? 0) + 1);
+  }
+  const total = [...counts.values()].reduce((a, b) => a + b, 0);
+  const detail = [...counts].map(([verb, n]) => `${n} ${verb}`).join(", ");
+  return {
+    summary: `${total} block${total === 1 ? "" : "s"}${detail === "" ? "" : `: ${detail}`}`,
+    others
+  };
+}
+async function syncPinned(root, shown, fallback) {
+  const rnessDir = join12(root, ".rness");
+  const installed = await readPinnedCli(rnessDir);
+  if (installed === null) {
+    if (fallback !== void 0) return fallback();
+    process.stderr.write(
+      `@rness/cli is not installed in ${shown}/.rness; install in .rness/, then rness sync
+`
+    );
+    return 1;
+  }
+  const pinned = join12(installed.dir, ...installed.bin.split("/"));
+  if (!await exists(pinned)) {
+    process.stderr.write(
+      `@rness/cli in ${shown}/.rness is not installed correctly (missing ${installed.bin}); reinstall in .rness/
+`
+    );
+    return 1;
+  }
+  try {
+    const { stdout, stderr } = await execFileP3(
+      process.execPath,
+      [pinned, "sync", "--yes"],
+      { cwd: root, maxBuffer: 16 * 1024 * 1024 }
+    );
+    process.stdout.write(stdout);
+    if (stderr !== "") process.stderr.write(stderr);
+    return 0;
+  } catch (e) {
+    const err = e;
+    if (err.stdout !== void 0 && err.stdout !== "")
+      process.stdout.write(err.stdout);
+    if (err.stderr !== void 0 && err.stderr !== "")
+      process.stderr.write(err.stderr);
+    return typeof err.code === "number" ? err.code : 1;
+  }
+}
+
+// src/core/scaffold.ts
+import { statSync } from "fs";
+import { dirname as dirname4, join as join13 } from "path";
+import { fileURLToPath } from "url";
+var SCAFFOLD_FILES = [
+  "AGENTS.md",
+  "CONVENTIONS.md",
+  "README.md",
+  "WORKSPACE.md",
+  "rness.json",
+  "package.json",
+  "_gitignore",
+  ".githooks/pre-commit",
+  ".github/workflows/validate.yml",
+  "pnpm-workspace.yaml",
+  "adr/0000-template.md",
+  "standards/.gitkeep",
+  "specs/.gitkeep",
+  "plans/.gitkeep",
+  "skills/.gitkeep",
+  "docs/.gitkeep"
+];
+function scaffoldDir() {
+  let dir = dirname4(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 4; i += 1) {
+    const candidate = join13(dir, "scaffold");
+    try {
+      if (statSync(join13(candidate, "rness.json")).isFile()) return candidate;
+    } catch {
+    }
+    dir = dirname4(dir);
+  }
+  throw new Error("scaffold directory not found next to the @rness/cli package");
+}
+
+// src/core/scaffold-copy.ts
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile8, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname5, join as join14 } from "path";
+var TOKENISED = /* @__PURE__ */ new Set(["package.json"]);
+async function copyScaffold(dest, tokens) {
+  const source = scaffoldDir();
+  for (const rel of SCAFFOLD_FILES) {
+    if (rel === "rness.json") continue;
+    const from = join14(source, ...rel.split("/"));
+    const targetRel = rel === "_gitignore" ? ".gitignore" : rel;
+    const to = join14(dest, ...targetRel.split("/"));
+    await mkdir2(dirname5(to), { recursive: true });
+    let content = await readFile8(from, "utf8");
+    if (TOKENISED.has(rel)) {
+      content = content.replaceAll("__RNESS_VERSION__", tokens.version).replaceAll("__RNESS_PM__", tokens.packageManager);
+    }
+    await writeFile2(to, content, "utf8");
+    const mode = (await stat2(from)).mode & 511;
+    if (mode & 73) await chmod2(to, mode);
+  }
+}
+
+// src/version.ts
+var VERSION = "0.5.0";
+
+// src/commands/login.ts
+import { spawn as spawn3 } from "child_process";
+import { realpath } from "fs/promises";
+
+// src/core/setup-git.ts
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var execFileP4 = promisify4(execFile4);
+var KEY = "credential.https://github.com.helper";
+function helperValue(node, bin) {
+  return `!'${node}' '${bin}' git-credential`;
+}
+var isOurs = (value) => /^!'[^']+' '[^']*rness[^']*' git-credential$/.test(value);
+async function config(args) {
+  const { stdout } = await execFileP4("git", ["config", "--global", ...args]);
+  return stdout;
+}
+async function values() {
+  try {
+    const out = await config(["--get-all", KEY]);
+    return out.replace(/\n$/, "").split("\n");
+  } catch {
+    return [];
+  }
+}
+function isStableInstall(bin) {
+  return !/[\\/]_npx[\\/]/.test(bin);
+}
+async function setupGit(node, bin) {
+  const ours = helperValue(node, bin);
+  if ((await values()).includes(ours)) return false;
+  await removeGitSetup();
+  await config(["--add", KEY, ""]);
+  await config(["--add", KEY, ours]);
+  return true;
+}
+async function removeGitSetup() {
+  const current = await values();
+  if (!current.some(isOurs)) return false;
+  const kept = current.filter(
+    (value, i) => !isOurs(value) && !(value === "" && isOurs(current[i + 1] ?? ""))
+  );
+  await config(["--unset-all", KEY]);
+  for (const value of kept) await config(["--add", KEY, value]);
+  return true;
+}
+
+// src/commands/login.ts
+function openInBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn3(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+async function offerSetupGit(opts, terminal, bin, ui) {
+  if (opts.setupGit === false) return;
+  if (!isStableInstall(bin)) {
+    ui.hint(
+      "install rness globally to let git use your login: npm i -g @rness/cli"
+    );
+    return;
+  }
+  if (opts.setupGit !== true) {
+    if (!terminal.isTty()) return;
+    const p = await terminal.prompts();
+    const ok = await p.confirm({
+      message: "Use rness to authenticate git over HTTPS for github.com?",
+      initialValue: true
+    });
+    if (p.isCancel(ok) || ok !== true) return;
+  }
+  const changed = await setupGit(process.execPath, bin);
+  ui.line(
+    changed ? "updated" : "unchanged",
+    "git: rness answers for https://github.com (rness logout undoes it)",
+    "git now asks rness for your github.com login over HTTPS (rness logout undoes it)"
+  );
+}
+async function loginCommand(opts, deps = {}) {
+  const terminal = deps.terminal ?? defaultTerminal;
+  const own = deps.ui === void 0;
+  const ui = deps.ui ?? await makeUi(terminal);
+  if (own) ui.intro("Log in to GitHub");
+  try {
+    const bin = deps.bin ?? await realpath(process.argv[1] ?? "").catch(() => "");
+    const env = envToken();
+    if (env !== null)
+      ui.hint(`${env.source} is set and wins over a stored login`);
+    const stored = await readAuth();
+    if (stored !== null && await resolveToken() !== null) {
+      ui.line(
+        "logged in",
+        `as ${stored.login} (github.com); rness logout to switch`
+      );
+      await offerSetupGit(opts, terminal, bin, ui);
+      if (own) ui.outro("Nothing to do", "idle");
+      return 0;
+    }
+    const code = await requestDeviceCode();
+    if (ui.session)
+      ui.line(
+        "open",
+        code.verificationUri,
+        `Open ${code.verificationUri} and enter the code ${code.userCode}`
+      );
+    else {
+      ui.line("open", code.verificationUri);
+      ui.line("code", code.userCode);
+    }
+    if (terminal.isTty() && process.env["SSH_CONNECTION"] === void 0)
+      (deps.open ?? openInBrowser)(code.verificationUri);
+    if (!ui.session)
+      ui.line("waiting", "for you to approve rness on github.com\u2026");
+    const login = await ui.step(
+      {
+        doing: "waiting  for you to approve rness on github.com",
+        sentence: "Waiting for your approval on github.com",
+        quiet: true
+      },
+      async () => {
+        const tokens = await pollForToken(code, deps);
+        const user = await getUser({
+          token: tokens.accessToken,
+          apiBase: opts.githubApi ?? DEFAULT_GITHUB_API
+        });
+        await writeAuth({ login: user.login, tokens });
+        return user.login;
+      },
+      (name) => ["logged in", `as ${name} (github.com)`]
+    );
+    if (!ui.session) ui.line("logged in", `as ${login} (github.com)`);
+    await offerSetupGit(opts, terminal, bin, ui);
+    if (own) ui.outro(`You are logged in as ${login}`);
+    return 0;
+  } catch (e) {
+    if (e instanceof LoginError) {
+      ui.error(e.message);
+      return 1;
+    }
+    return reportError(e);
+  }
+}
+function revokeUrl() {
+  return `https://github.com/settings/connections/applications/${clientId()}`;
+}
+
+// src/commands/create.ts
+import { mkdir as mkdir3, mkdtemp, readdir as readdir2, rename as rename2, rm as rm4, stat as stat3 } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname6, join as join15, relative as relative2, resolve as resolve3 } from "path";
+
+// src/core/sync-blocks.ts
+async function syncBlocks(ui, root, shown, inPlace) {
+  if (!ui.session)
+    return ui.step(
+      { doing: "syncing  the blocks", git: true },
+      () => syncPinned(root, shown, inPlace)
+    );
+  const result = await ui.step(
+    {
+      doing: "syncing  the blocks",
+      sentence: "Writing the rness block into every AGENTS.md"
+    },
+    () => runPinnedSync(root),
+    (r) => r === null || r.code !== 0 ? null : ["synced", summariseSync(r.stdout).summary]
+  );
+  if (result === null) {
+    if (inPlace !== void 0) return inPlace();
+    ui.error(
+      `@rness/cli is not installed in ${shown}/.rness; install in .rness/, then rness sync`
+    );
+    return 1;
+  }
+  for (const line of summariseSync(result.stdout).others) ui.hint(line);
+  for (const line of result.stderr.split("\n"))
+    if (line.trim() !== "") ui.error(line);
+  return result.code;
+}
+
+// src/commands/create.ts
+async function isEmptyDir(dir) {
+  return (await readdir2(dir)).length === 0;
+}
+async function insideWorkspace(dir) {
+  try {
+    await findWorkspace(dir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function firstLine4(text) {
+  return text.split("\n").find((l) => l.trim() !== "")?.trim() ?? "unknown error";
+}
+function splitSpecs(list) {
+  return list.split(",").map((s) => s.trim()).filter((s) => s !== "");
+}
+async function targetProblem(cwd, root, pm) {
+  const shown = relative2(cwd, root) || ".";
+  if (await insideWorkspace(cwd) || await insideWorkspace(dirname6(root)))
+    return "already inside an rness workspace; create runs from outside one";
+  if (!await exists(root)) return null;
+  if (await exists(join15(root, ".rness", "rness.json"))) {
+    if (!await exists(join15(root, ".rness", "node_modules")))
+      return `${shown} holds an rness workspace whose dependencies are not installed; cd ${shown}/.rness && ${pm} install, then rness sync`;
+    return `${shown} already holds an rness workspace (.rness/); run rness add inside it to add repositories`;
+  }
+  if (!(await stat3(root)).isDirectory()) return `${shown} is not a directory`;
+  if (!await isEmptyDir(root)) return `${shown} is not empty`;
+  return null;
+}
+function cancelled(ui) {
+  ui.cancelled();
+  return 0;
+}
+async function pickRepositories(input) {
+  const { org, prompts, provider, ui } = input;
+  if (provider.authenticated) {
+    const access2 = await provider.organizationAccess(org);
+    const login = (await provider.identity())?.login;
+    if (access2 === "member")
+      ui.line(
+        "member",
+        `${org}${login === void 0 ? "" : ` (as ${login})`}`,
+        `You are a member of ${org}${login === void 0 ? "" : ` (as ${login})`}`
+      );
+    else if (access2 === "restricted") {
+      ui.warn(
+        `${org} restricts OAuth apps, so its private repositories are hidden from rness`
+      );
+      ui.hint(`ask an owner to approve it: ${revokeUrl()}`, "stderr");
+    }
+  }
+  let listed = [];
+  let failed = false;
+  if (!ui.session) ui.line("listing", `${org} repositories\u2026`);
+  try {
+    const listing = await ui.step(
+      {
+        doing: `listing  ${org} repositories`,
+        sentence: `Listing the repositories of ${org}`,
+        quiet: true
+      },
+      () => provider.listRepositories(org),
+      (l) => ["listed", `${l.repositories.length} repositories of ${org}`]
+    );
+    listed = listing.repositories;
+    if (listing.owner === "user")
+      ui.hint(
+        `only public repositories of ${org} are listed; add private ones later with rness add <repo>`
+      );
+    else if (!provider.authenticated)
+      ui.hint(
+        "only public repositories are listed; rness login lists the private ones you can access"
+      );
+    if (listing.truncated)
+      ui.hint(`listed the first ${MAX_PAGES * PER_PAGE} repositories of ${org}`);
+  } catch (e) {
+    failed = true;
+    ui.warn(firstLine4(e instanceof Error ? e.message : String(e)));
+  }
+  const inCatalogue = (name) => Object.hasOwn(input.catalogue, name);
+  const byLabel = (a, b) => a.label.localeCompare(b.label, "en", { sensitivity: "base" });
+  const candidates = listed.filter(
+    (r) => !r.archived && !r.name.startsWith(".")
+  );
+  const padlock = unicode();
+  const hint = (isPrivate, catalogued) => [isPrivate && !padlock ? "private" : null, catalogued ? "in .rness" : null].filter((h) => h !== null).join(" \xB7 ") || null;
+  const declarable = candidates.filter((r) => NAME.test(r.name.toLowerCase())).map((r) => {
+    const value = r.name.toLowerCase();
+    const h = hint(r.private, inCatalogue(value));
+    const label = r.private && padlock ? `${r.name} ${PRIVATE_MARK}` : r.name;
+    return { value, label, ...h === null ? {} : { hint: h } };
+  });
+  const offered = new Set(declarable.map((o) => o.value));
+  for (const name of Object.keys(input.catalogue)) {
+    if (!offered.has(name))
+      declarable.push({ value: name, label: name, hint: "in .rness" });
+  }
+  declarable.sort(byLabel);
+  const unsupported = candidates.filter((r) => !NAME.test(r.name.toLowerCase())).map((r) => ({
+    value: r.name,
+    label: r.name,
+    hint: "name not supported yet",
+    disabled: true
+  })).sort(byLabel);
+  if (unsupported.length > 0) {
+    const names = unsupported.slice(0, 5).map((o) => o.label);
+    const more = unsupported.length > names.length ? ` and ${unsupported.length - names.length} more` : "";
+    ui.hint(
+      `names rness cannot declare yet (struck through): ${names.join(", ")}${more}`
+    );
+  }
+  if (declarable.length === 0) {
+    if (!failed) ui.warn(`no repositories to list for ${org}`);
+    return { picked: [], prompted: false };
+  }
+  const initialValues = Object.keys(input.catalogue);
+  const answer = await prompts.autocompleteMultiselect({
+    message: "Which repositories do you want in your workspace?",
+    options: [...declarable, ...unsupported],
+    ...initialValues.length > 0 ? { initialValues } : {},
+    required: false,
+    placeholder: "Type to filter"
+  });
+  if (prompts.isCancel(answer)) return null;
+  const allowed = new Set(declarable.map((o) => o.value));
+  return {
+    picked: Array.isArray(answer) ? answer.filter((v) => allowed.has(v)) : [],
+    prompted: true
+  };
+}
+async function cloneSelection(input) {
+  const { ui } = input;
+  let manifest = input.manifest;
+  const failures = [];
+  for (const spec of new Set(input.specs)) {
+    try {
+      let name = null;
+      try {
+        name = parseRepoSpec(spec, input.org, input.host).name;
+      } catch {
+      }
+      const entry = name === null ? void 0 : manifest.repos[name];
+      if (name !== null && entry !== void 0) {
+        const repo = name;
+        await ui.step(
+          { doing: `cloning  org/${repo}`, git: true },
+          () => clone(
+            entry.url,
+            join15(input.root, "org", repo),
+            input.provider.credentialsFor(entry.url)
+          ),
+          () => ["cloned", `org/${repo}`]
+        );
+        continue;
+      }
+      const current = manifest;
+      const result = await ui.step(
+        { doing: `cloning  ${spec}`, git: true },
+        () => addRepository({
+          root: input.root,
+          rnessDir: input.rnessDir,
+          manifest: current,
+          spec,
+          org: input.org,
+          host: input.host,
+          scopes: [],
+          credentialsFor: (url) => input.provider.credentialsFor(url)
+        }),
+        (r) => [r.action, `org/${r.name}`]
+      );
+      manifest = result.manifest;
+      ui.line("declared", `scope ${result.name} (org/${result.name})`);
+    } catch (e) {
+      const message = firstLine4(e instanceof Error ? e.message : String(e));
+      ui.error(`${spec}: ${message}`);
+      failures.push({ spec, message });
+    }
+  }
+  return failures;
+}
+async function placeContext(staged, rnessDir, url, credentials) {
+  try {
+    await rename2(staged, rnessDir);
+  } catch (e) {
+    if (e.code !== "EXDEV") throw e;
+    await clone(url, rnessDir, credentials);
+  }
+}
+var OTHER = /* @__PURE__ */ Symbol("another organization");
+async function chooseOrganization(provider, prompts) {
+  if (!provider.authenticated) return OTHER;
+  let names;
+  try {
+    const self = (await provider.identity())?.login;
+    names = (await provider.listOrganizations()).map((o) => o.login);
+    if (self !== void 0) names.push(self);
+  } catch {
+    return OTHER;
+  }
+  if (names.length === 0) return OTHER;
+  const answer = await prompts.select({
+    message: "Which GitHub organization?",
+    options: [
+      ...names.map((name) => ({ value: name, label: name })),
+      { value: "", label: "another one\u2026" }
+    ]
+  });
+  if (prompts.isCancel(answer)) return null;
+  if (typeof answer !== "string" || answer === "") return OTHER;
+  return answer;
+}
+async function publishContext(input) {
+  const { ui, prompts, provider, org } = input;
+  if (!provider.authenticated) return false;
+  const ok = await prompts.confirm({
+    message: `Create ${org}/.rness on GitHub (private) and push it?`,
+    initialValue: true
+  });
+  if (prompts.isCancel(ok)) return null;
+  if (ok !== true) return false;
+  try {
+    const result = await ui.step(
+      { doing: `creating ${org}/.rness on GitHub` },
+      () => provider.createRepository(org, ".rness")
+    );
+    if (result.kind === "exists") {
+      ui.warn(`${org}/.rness already exists on GitHub; nothing was pushed`);
+      return false;
+    }
+    if (result.kind === "refused") {
+      ui.warn(`GitHub did not create ${org}/.rness: ${result.reason}`);
+      return false;
+    }
+    ui.line("created", `github.com/${org}/.rness (private)`);
+    await ui.step(
+      { doing: `pushing  ${org}/.rness`, git: true },
+      () => publish(input.rnessDir, input.url, provider.credentialsFor(input.url)),
+      () => ["pushed", `${org}/.rness`]
+    );
+    return true;
+  } catch (e) {
+    ui.warn(firstLine4(e instanceof Error ? e.message : String(e)));
+    return false;
+  }
+}
+async function createCommand(opts, deps = {}) {
+  const terminal = deps.terminal ?? defaultTerminal;
+  const transport = deps.transport ?? defaultTransport;
+  let provider = deps.provider;
+  const getProvider = async () => provider ??= await githubProvider(opts.githubApi);
+  const cwd = opts.cwd ?? process.cwd();
+  if (opts.template !== void 0) {
+    process.stderr.write("--template is reserved for a later version\n");
+    return 2;
+  }
+  if (opts.pm !== void 0 && !isPackageManager(opts.pm)) {
+    process.stderr.write(`--pm must be one of ${PACKAGE_MANAGERS.join(", ")}
+`);
+    return 2;
+  }
+  if (opts.ssh === true && opts.https === true) {
+    process.stderr.write("--ssh and --https cannot be combined\n");
+    return 2;
+  }
+  if (opts.org !== void 0 && !ORG_NAME.test(opts.org)) {
+    process.stderr.write(
+      `organization name "${opts.org}" is not a valid GitHub organization name
+`
+    );
+    return 2;
+  }
+  const pm = opts.pm !== void 0 && isPackageManager(opts.pm) ? opts.pm : detectPackageManager();
+  const interactive = opts.yes !== true && terminal.isTty();
+  const ui = interactive ? await makeUi(terminal) : { ...plainUi };
+  let sshTest;
+  const testSsh = async () => {
+    if (sshTest === void 0) {
+      sshTest = await testGithubSsh(
+        transport,
+        interactive,
+        () => ui.line(...CHECKING)
+      );
+      if (sshTest.unattended) ui.gitIsSilent = true;
+    }
+    return sshTest.access;
+  };
+  const chooseHost = async () => {
+    if (opts.host !== void 0 || opts.https === true) ui.gitIsSilent = true;
+    if (opts.host !== void 0) return opts.host;
+    if (opts.ssh === true) return transport.hosts.ssh;
+    if (opts.https === true) return transport.hosts.https;
+    const access2 = await testSsh();
+    const github = access2.ok ? null : await getProvider();
+    const login = github?.authenticated ? (await github.identity())?.login : void 0;
+    ui.line("using", usingRest(access2, login), usingSentence(access2, login));
+    if (!access2.ok) ui.gitIsSilent = true;
+    return access2.ok ? transport.hosts.ssh : transport.hosts.https;
+  };
+  let loaded;
+  const prompts = async () => loaded ??= await terminal.prompts();
+  let staging;
+  if (interactive) process.stdout.write(banner(VERSION));
+  ui.intro("Create a workspace");
+  try {
+    if (interactive && await insideWorkspace(cwd)) {
+      process.stderr.write(
+        "already inside an rness workspace; create runs from outside one\n"
+      );
+      return 1;
+    }
+    let prompted = false;
+    let org = opts.org;
+    if (org === void 0 && !interactive) {
+      process.stderr.write("rness create needs --org <name> without a prompt\n");
+      return 2;
+    }
+    if (interactive && opts.repos === void 0 && !(await getProvider()).authenticated) {
+      const p = await prompts();
+      const login = await p.confirm({
+        message: "Log in to GitHub to list private repositories?",
+        initialValue: true
+      });
+      if (p.isCancel(login)) return cancelled(ui);
+      if (login === true) {
+        const code2 = await loginCommand(
+          opts.githubApi === void 0 ? {} : { githubApi: opts.githubApi },
+          { terminal, ui }
+        );
+        if (code2 !== 0) return code2;
+        provider = await githubProvider(opts.githubApi);
+      }
+    }
+    if (org === void 0) {
+      const chosen = await chooseOrganization(
+        await getProvider(),
+        await prompts()
+      );
+      if (chosen === null) return cancelled(ui);
+      if (chosen !== OTHER) {
+        org = chosen;
+        prompted = true;
+      }
+    }
+    if (org === void 0) {
+      const p = await prompts();
+      const answer = await p.text({
+        message: "What is your GitHub organization named?",
+        placeholder: "acme",
+        validate: (value) => {
+          const v = value?.trim() ?? "";
+          return ORG_NAME.test(v) ? void 0 : `"${v}" is not a valid GitHub organization name`;
+        }
+      });
+      if (p.isCancel(answer) || typeof answer !== "string") return cancelled(ui);
+      org = answer.trim();
+      prompted = true;
+    }
+    const root = resolve3(cwd, org);
+    const shown = relative2(cwd, root) || ".";
+    const problem = await targetProblem(cwd, root, pm);
+    if (problem !== null) {
+      process.stderr.write(`${problem}
+`);
+      return 1;
+    }
+    if (opts.yes !== true && !terminal.isTty()) {
+      process.stderr.write(
+        "rness create writes files; pass --yes to run without a prompt\n"
+      );
+      return 2;
+    }
+    const host = await chooseHost();
+    const contextUrl = repoUrl(host, org, ".rness");
+    const gitProvider = await getProvider();
+    const probe = await probeRemote(
+      contextUrl,
+      void 0,
+      gitProvider.credentialsFor(contextUrl)
+    );
+    if (probe.kind === "error") {
+      process.stderr.write(`${probe.message}
+`);
+      return 1;
+    }
+    const joining = probe.kind === "found";
+    if (joining)
+      ui.line(
+        "found",
+        `${org}/.rness \u2014 joining`,
+        `${org} has a workspace \u2014 joining it`
+      );
+    else
+      ui.line(
+        "not found",
+        `${org}/.rness (or not visible to you) \u2014 starting a new workspace`,
+        `${org} has no workspace yet (or none you can see) \u2014 starting one`
+      );
+    let catalogue = { contract: 1, org, repos: {}, scopes: {} };
+    const staged = async () => {
+      staging ??= await mkdtemp(join15(tmpdir(), "rness-join-"));
+      return join15(staging, ".rness");
+    };
+    if (joining) {
+      const stagedDir = await staged();
+      await ui.step(
+        {
+          doing: `cloning  ${org}/.rness`,
+          sentence: `Reading the catalogue of ${org}`,
+          git: true
+        },
+        () => clone(contextUrl, stagedDir, gitProvider.credentialsFor(contextUrl))
+      );
+      catalogue = await loadManifest(await staged());
+      const overSsh = Object.values(catalogue.repos).some(
+        (r) => isSshUrl(r.url, transport.hosts)
+      );
+      if (overSsh && opts.ssh !== true && opts.host === void 0) {
+        const access2 = await testSsh();
+        if (!access2.ok) {
+          process.stderr.write(
+            `${[...sshWorkspaceLines(access2.reason), ...INSTEAD_OF_LINES].join("\n")}
+`
+          );
+          return 1;
+        }
+      }
+    }
+    let specs;
+    if (opts.repos !== void 0) specs = splitSpecs(opts.repos);
+    else if (interactive) {
+      const result = await pickRepositories({
+        org,
+        provider: gitProvider,
+        ui,
+        prompts: await prompts(),
+        catalogue: catalogue.repos
+      });
+      if (result === null) return cancelled(ui);
+      specs = result.picked;
+      prompted ||= result.prompted;
+    } else {
+      specs = Object.keys(catalogue.repos);
+    }
+    if (interactive && !prompted) {
+      const p = await prompts();
+      const ok = await p.confirm({
+        message: `Create workspace ${org} in ./${shown}?`
+      });
+      if (p.isCancel(ok) || ok !== true) return cancelled(ui);
+    }
+    const rnessDir = join15(root, ".rness");
+    const install = async () => {
+      if (opts.skipInstall === true) {
+        ui.line("skipped", "install (--skip-install)");
+        return;
+      }
+      await ui.step(
+        { doing: `installing dependencies with ${pm}` },
+        () => installDependencies(pm, rnessDir),
+        () => ["installed", `dependencies with ${pm}`]
+      );
+    };
+    if (joining) {
+      await mkdir3(root, { recursive: true });
+      await placeContext(
+        await staged(),
+        rnessDir,
+        contextUrl,
+        gitProvider.credentialsFor(contextUrl)
+      );
+      ui.line("cloned", `${shown}/.rness (joined ${org})`);
+      const pin = (await readPin(rnessDir))?.spec;
+      if (pin !== void 0 && EXACT_VERSION.test(pin) && compareVersions(pin, VERSION) < 0)
+        ui.hint(
+          `${org}/.rness pins @rness/cli ${pin} \u2014 you run ${VERSION}; rness upgrade moves the workspace`
+        );
+      await install();
+      await mkdir3(join15(root, "org"), { recursive: true });
+      const failures2 = await cloneSelection({
+        root,
+        rnessDir,
+        manifest: catalogue,
+        org,
+        host,
+        specs,
+        provider: gitProvider,
+        ui
+      });
+      const code2 = await syncBlocks(
+        ui,
+        root,
+        shown,
+        () => syncCommand({ yes: true, cwd: root })
+      );
+      if (code2 !== 0) return code2;
+      if (failures2.length > 0)
+        ui.note(
+          "Next steps",
+          failures2.map((f) => `rness add ${f.spec}   # failed: ${f.message}`)
+        );
+      ui.outro(`You joined ${org} \u2014 your workspace is in ${shown}/`);
+      return failures2.length > 0 ? 1 : 0;
+    }
+    const pmVersion = await packageManagerVersion(pm);
+    await mkdir3(root, { recursive: true });
+    try {
+      await copyScaffold(rnessDir, {
+        version: VERSION,
+        packageManager: `${pm}@${pmVersion}`
+      });
+      await writeManifest(rnessDir, catalogue);
+      ui.line("created", `${shown}/.rness (new workspace)`);
+      await install();
+    } catch (e) {
+      reportError(e);
+      await rm4(rnessDir, { recursive: true, force: true }).catch(
+        () => void 0
+      );
+      if (await isEmptyDir(root).catch(() => false))
+        await rm4(root, { recursive: true, force: true }).catch(() => void 0);
+      process.stderr.write(
+        `removed ${shown}/.rness after the failure; fix it and retry
+`
+      );
+      return 1;
+    }
+    await mkdir3(join15(root, "org"), { recursive: true });
+    const failures = await cloneSelection({
+      root,
+      rnessDir,
+      manifest: catalogue,
+      org,
+      host,
+      specs,
+      provider: gitProvider,
+      ui
+    });
+    await init(rnessDir);
+    try {
+      await commitAll(rnessDir, "chore: rness workspace context");
+      ui.line("committed", `${shown}/.rness`);
+    } catch (e) {
+      ui.warn(
+        `${e instanceof Error ? e.message : String(e)} \u2014 commit ${shown}/.rness yourself`
+      );
+    }
+    const code = await syncBlocks(
+      ui,
+      root,
+      shown,
+      () => syncCommand({ yes: true, cwd: root })
+    );
+    if (code !== 0) return code;
+    const name = org;
+    const published = interactive ? await publishContext({
+      ui,
+      prompts: await prompts(),
+      provider: gitProvider,
+      org: name,
+      rnessDir,
+      url: contextUrl
+    }) : false;
+    if (published === null) return cancelled(ui);
+    const next = [
+      `cd ${shown}/.rness`,
+      // What was asked for and did not happen, as the command that retries
+      // it — the workspace is complete otherwise.
+      ...failures.map((f) => `rness add ${f.spec}   # failed: ${f.message}`),
+      ...published ? [] : [
+        `# create the empty private repository ${org}/.rness on github.com, then:`,
+        `git remote add origin ${contextUrl} && git push -u origin main`,
+        // git first: everyone has it. The GitHub CLI second, for those
+        // who do — it creates the repository and pushes in one step.
+        "# or, with the GitHub CLI (gh) installed, in one step:",
+        `gh repo create ${org}/.rness --private --source . --push`
+      ],
+      `# then, for every teammate: npm create rness ${org}`
+    ];
+    if (ui.session) {
+      ui.note("Next steps", next);
+      ui.outro(`Workspace for ${org} is ready in ${shown}/`);
+    } else
+      process.stdout.write(
+        [
+          "",
+          `Workspace for \`${org}\` is ready in ${shown}/.`,
+          "",
+          "Next:",
+          ...next.map((line) => `  ${line}`),
+          ""
+        ].join("\n")
+      );
+    return failures.length > 0 ? 1 : 0;
+  } catch (e) {
+    return reportError(e);
+  } finally {
+    if (staging !== void 0)
+      await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+
+// src/commands/logout.ts
+async function logoutCommand() {
+  try {
+    const stored = await readAuth();
+    await clearAuth();
+    const undone = await removeGitSetup().catch(() => false);
+    if (stored === null && !undone) {
+      process.stdout.write("not logged in\n");
+      return 0;
+    }
+    if (stored !== null)
+      process.stdout.write(
+        `${status("logged out", `${stored.login} (github.com)`)}
+`
+      );
+    if (undone)
+      process.stdout.write(
+        `${status("updated", "git: rness no longer answers for https://github.com")}
+`
+      );
+    process.stdout.write(`revoke rness on GitHub: ${revokeUrl()}
+`);
+    return 0;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/commands/upgrade.ts
+import { execFile as execFile5 } from "child_process";
+import { readFile as readFile9, readdir as readdir3 } from "fs/promises";
+import { basename as basename4, join as join16, relative as relative3 } from "path";
+import { promisify as promisify5 } from "util";
+var execFileP5 = promisify5(execFile5);
+var NOTES = "https://github.com/rness-dev/rness/tree/main/packages/cli#readme";
+var OLD_WORKFLOW_RUN = /npx --yes @rness\/cli@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?) validate/;
+var WORKFLOW_RUN = `npx --yes "@rness/cli@$(node -p "require('./package.json').devDependencies['@rness/cli']")" validate`;
+async function latestVersion() {
+  try {
+    const { stdout } = await execFileP5(
+      "npm",
+      ["view", "@rness/cli@latest", "version"],
+      { timeout: 3e4 }
+    );
+    const version = stdout.trim();
+    return EXACT_VERSION.test(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function upgradeCommand(version, opts, terminal = defaultTerminal) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (version !== void 0 && !EXACT_VERSION.test(version)) {
+    process.stderr.write(
+      `version "${version}" is not an exact version (for example 0.5.0)
+`
+    );
+    return 2;
+  }
+  try {
+    const ws = await findWorkspace(cwd);
+    const label = `${basename4(ws.root)}/.rness`;
+    const pin = await readPin(ws.rnessDir);
+    if (pin === null) {
+      process.stderr.write(
+        `no @rness/cli entry in ${label}/package.json; add it to devDependencies, then run rness upgrade
+`
+      );
+      return 1;
+    }
+    const interactive = opts.yes !== true;
+    if (interactive && !terminal.isTty()) {
+      process.stderr.write(
+        "rness upgrade installs and writes files; pass --yes to run without a prompt\n"
+      );
+      return 2;
+    }
+    const ui = interactive ? await makeUi(terminal) : { ...plainUi };
+    ui.intro(`Upgrade workspace ${basename4(ws.root)}`);
+    const target = version ?? await ui.step(
+      { doing: "asking   the registry for the latest release", quiet: true },
+      () => latestVersion(),
+      (v) => v === null ? null : ["latest", `@rness/cli ${v}`]
+    );
+    if (target === null) {
+      process.stderr.write(
+        "cannot reach the registry; name the version: rness upgrade <version>\n"
+      );
+      return 1;
+    }
+    const installed = (await readPinnedCli(ws.rnessDir))?.version ?? null;
+    if (pin.spec === target && installed === target) {
+      if (ui.session) ui.outro(`Already at ${target}`);
+      else process.stdout.write(`already at ${target}
+`);
+      return 0;
+    }
+    const downgrading = EXACT_VERSION.test(pin.spec) && compareVersions(target, pin.spec) < 0;
+    if (downgrading && version === void 0) {
+      process.stderr.write(
+        `${label} pins @rness/cli ${pin.spec}, newer than the latest release ${target}; to downgrade: rness upgrade ${target}
+`
+      );
+      return 1;
+    }
+    const pm = await workspacePackageManager(ws.rnessDir);
+    if (pin.spec === target)
+      ui.line(
+        "install",
+        `@rness/cli ${target} in ${label} (${pm}) \u2014 ${installed ?? "nothing"} is installed`
+      );
+    else {
+      ui.line(
+        "upgrade",
+        `@rness/cli ${pin.spec} \u2192 ${target} in ${label} (${pm})${downgrading ? " \u2014 downgrading" : ""}`
+      );
+      ui.line("notes", NOTES, `Release notes: ${NOTES}`);
+    }
+    if (interactive) {
+      const p = await terminal.prompts();
+      const ok = await p.confirm({
+        message: `Upgrade @rness/cli to ${target}?`
+      });
+      if (p.isCancel(ok) || ok !== true) {
+        ui.cancelled();
+        return 1;
+      }
+    }
+    const packageFile = join16(ws.rnessDir, "package.json");
+    const restore = /* @__PURE__ */ new Map([
+      [packageFile, await readFile9(packageFile, "utf8")]
+    ]);
+    if (pin.spec !== target) await writePin(ws.rnessDir, pin.spec, target);
+    const workflows = join16(ws.rnessDir, ".github", "workflows");
+    for (const name of await readdir3(workflows).catch(() => [])) {
+      if (!/\.ya?ml$/.test(name)) continue;
+      const file = join16(workflows, name);
+      const text = await readOrNull(file);
+      if (text === null) continue;
+      const shown = `.github/workflows/${name}`;
+      if (name === "validate.yml" && OLD_WORKFLOW_RUN.test(text)) {
+        restore.set(file, text);
+        await writeFileAtomic(
+          file,
+          text.replace(OLD_WORKFLOW_RUN, () => WORKFLOW_RUN)
+        );
+        ui.line(
+          "updated",
+          `${shown} (it now reads the version from package.json)`
+        );
+      } else if (pin.spec !== target && text.includes(`@rness/cli@${pin.spec}`)) {
+        ui.warn(`${shown} names @rness/cli@${pin.spec}; update it by hand`);
+      }
+    }
+    try {
+      await ui.step(
+        { doing: `installing dependencies with ${pm}` },
+        () => installDependencies(pm, ws.rnessDir),
+        () => ["installed", `dependencies with ${pm}`]
+      );
+    } catch (e) {
+      for (const [file, text] of restore) await writeFileAtomic(file, text);
+      const message = e instanceof Error ? e.message : String(e);
+      ui.error(message);
+      ui.hint(`restored ${relative3(cwd, packageFile) || packageFile}`, "stderr");
+      if (/minimum.?release.?age|NO_MATURE/i.test(message))
+        ui.hint(
+          "pnpm refuses versions published less than 24 h ago: add '@rness/cli' under minimumReleaseAgeExclude in .rness/pnpm-workspace.yaml",
+          "stderr"
+        );
+      return 1;
+    }
+    const now = (await readPinnedCli(ws.rnessDir))?.version ?? null;
+    if (now !== target) {
+      process.stderr.write(
+        `${pm} install left @rness/cli ${now ?? "not installed"} in ${label}, not ${target}
+`
+      );
+      return 1;
+    }
+    ui.gitIsSilent = true;
+    const code = await syncBlocks(ui, ws.root, basename4(ws.root));
+    if (code !== 0) return code;
+    const rel = relative3(cwd, ws.rnessDir) || ".";
+    const next = [
+      `git -C ${rel} add -A && git -C ${rel} commit -m "chore: rness ${target}"`,
+      `# teammates: git pull, then ${pm} install in .rness`
+    ];
+    if (ui.session) {
+      ui.note("Next steps", next);
+      ui.outro(`${label} runs @rness/cli ${target}`);
+    } else
+      process.stdout.write(
+        [
+          "",
+          status("upgraded", `${label} to @rness/cli ${target}`),
+          "",
+          "Next:",
+          ...next.map((line) => `  ${line}`),
+          ""
+        ].join("\n")
+      );
+    return 0;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/core/blocks.ts
+import { join as join17 } from "path";
+async function checkBlocks({
+  root,
+  rnessDir,
+  manifest,
+  org
+}) {
+  const problems = [];
+  const warnings = [];
+  if (!await exists(join17(root, "org"))) return { problems, warnings };
+  const targets = [{ scope: null, dir: root, depth: 0, label: "AGENTS.md" }];
+  for (const [name, entry] of Object.entries(manifest.scopes)) {
+    const segments = entry.path.split("/");
+    targets.push({
+      scope: name,
+      dir: join17(root, ...segments),
+      depth: segments.length,
+      label: `${entry.path}/AGENTS.md`
+    });
+  }
+  for (const t of targets) {
+    if (!await exists(t.dir)) {
+      warnings.push(`${t.label}: directory not present, block not checked`);
+      continue;
+    }
+    const text = await readOrNull(join17(t.dir, "AGENTS.md"));
+    const lines = text === null ? [] : text.split(/\r?\n/);
+    const found = findBlock(lines);
+    if (found.kind === "none") {
+      warnings.push(`${t.label}: no rness block yet (run rness sync)`);
+      continue;
+    }
+    if (found.kind === "error") {
+      problems.push(`${t.label}: ${found.message}`);
+      continue;
+    }
+    const context = await assembleContext({
+      rnessDir,
+      manifest,
+      scope: t.scope
+    });
+    const fresh2 = renderBlock({
+      scope: t.scope,
+      org,
+      depth: t.depth,
+      context
+    });
+    if (!isCurrentBlock(lines.slice(found.begin, found.end + 1), fresh2.hash)) {
+      problems.push(`${t.label}: stale rness block (run rness sync)`);
+    }
+  }
+  return { problems, warnings };
+}
+
+// src/core/contract.ts
+import { join as join18 } from "path";
+var STATUSES = {
+  adr: ["Proposed", "Accepted", "Rejected", "Superseded"],
+  specs: [
+    "Draft",
+    "Proposed",
+    "Approved",
+    "Implemented",
+    "Superseded",
+    "Rejected"
+  ],
+  plans: ["Draft", "Ready", "In progress", "Blocked", "Completed", "Abandoned"]
+};
+var SKIP = /* @__PURE__ */ new Set(["adr/0000-template.md"]);
+var PLACEMENT_KEYS = ["scopes", "scope"];
+async function checkContract(rnessDir) {
+  const problems = [];
+  for (const name of COLLECTIONS) {
+    const allowed = STATUSES[name];
+    const items = await collectMarkdown(join18(rnessDir, name));
+    for (const item of items) {
+      const where = `${name}/${item.rel}`;
+      if (SKIP.has(where)) continue;
+      if (item.fieldsError !== null) {
+        problems.push(`${where}: invalid front matter (${item.fieldsError})`);
+        continue;
+      }
+      if (item.fields !== null) {
+        for (const key of PLACEMENT_KEYS) {
+          if (Object.hasOwn(item.fields, key)) {
+            problems.push(
+              `${where}: front matter "${key}" is not supported \u2014 the directory decides the scope; move the file`
+            );
+          }
+        }
+      }
+      if (allowed === void 0) continue;
+      if (item.fields === null) {
+        problems.push(`${where}: missing a front-matter block`);
+        continue;
+      }
+      if (item.title === null) problems.push(`${where}: missing a "# " title`);
+      const status2 = item.fields["status"];
+      if (status2 === void 0 || status2 === null || status2 === "") {
+        problems.push(`${where}: missing "status"`);
+      } else if (typeof status2 !== "string" || !allowed.includes(status2)) {
+        problems.push(
+          `${where}: unknown status ${JSON.stringify(status2)} (expected ${allowed.join(", ")})`
+        );
+      }
+    }
+  }
+  return problems;
+}
+
+// src/commands/validate.ts
+async function validateCommand(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  try {
+    const ws = await findWorkspace(cwd);
+    const manifest = await loadManifest(ws.rnessDir);
+    for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
+    const { org, warning } = resolveOrg(manifest, ws.root);
+    const warnings = warning === null ? [] : [warning];
+    const problems = await checkContract(ws.rnessDir);
+    const blocks = await checkBlocks({
+      root: ws.root,
+      rnessDir: ws.rnessDir,
+      manifest,
+      org
+    });
+    problems.push(...blocks.problems);
+    warnings.push(...blocks.warnings);
+    for (const p of problems) process.stderr.write(`${p}
+`);
+    for (const w of warnings) process.stderr.write(`${warn(w)}
+`);
+    if (problems.length > 0) return 1;
+    process.stdout.write("context ok\n");
+    return 0;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
+// src/cli.ts
+import { Command, CommanderError, Option } from "commander";
+
+// src/commands/git-credential.ts
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function gitCredentialCommand(operation, input) {
+  if (operation !== "get") return 0;
+  const fields = /* @__PURE__ */ new Map();
+  for (const line of (input ?? await readStdin()).split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0) fields.set(line.slice(0, eq), line.slice(eq + 1).trimEnd());
+  }
+  if (fields.get("protocol") !== "https" || fields.get("host") !== "github.com")
+    return 0;
+  const resolved = await resolveToken().catch(() => null);
+  if (resolved === null) return 0;
+  process.stdout.write(`username=x-access-token
+password=${resolved.token}
+`);
+  return 0;
+}
+
+// src/cli.ts
+function buildProgram(state) {
+  const program = new Command().name("rness").description("Configuration-plane CLI for rness workspaces").version(VERSION, "-v, --version", "print the version").exitOverride().showHelpAfterError().configureOutput({
+    writeOut: (s) => {
+      process.stdout.write(s);
+    },
+    writeErr: (s) => {
+      process.stderr.write(s);
+    },
+    outputError: (s, write) => {
+      write(paint("error", s, process.stderr));
+    }
+  }).configureHelp({
+    styleTitle: (s) => bold(s),
+    styleUsage: (s) => paint("done", s),
+    styleCommandText: (s) => paint("info", s),
+    styleSubcommandText: (s) => paint("info", s),
+    styleArgumentText: (s) => paint("info", s),
+    styleOptionText: (s) => paint("warn", s),
+    styleDescriptionText: (s) => paint("idle", s)
+  }).addHelpText("before", () => banner(VERSION));
+  program.command("context").description("Resolve and print the context for a scope").option(
+    "--scope <name>",
+    "scope to resolve (default: the scope owning the current directory)"
+  ).option("--json", "print JSON instead of Markdown").addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
+    state.code = await contextCommand(opts);
+  });
+  program.command("validate").description(
+    "Check the .rness/ tree against the contract and every generated block"
+  ).addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
+    state.code = await validateCommand(opts);
+  });
+  program.command("sync").description(
+    "Write the rness block into every AGENTS.md of the cloned repositories"
+  ).option("--scope <name>", "only this scope (the root block is skipped)").option(
+    "--check",
+    "render and compare only; exit 1 when a block is out of date"
+  ).option("--pull", "git pull --ff-only in every clean clone").option("--all", "clone every rness.json repository missing from org/").option("-y, --yes", "do not ask for confirmation").addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
+    state.code = await syncCommand(opts);
+  });
+  program.command("add").description(
+    "Clone (or adopt) a repository under org/ and declare it in rness.json"
+  ).argument("<repo>", "<repo>, <owner>/<repo>, or a clone URL").option(
+    "--scopes <list>",
+    "comma-separated sub-directories to declare as scopes extending the repository"
+  ).option(
+    "--ssh",
+    "force git@github.com: (default: SSH when it works, else HTTPS)"
+  ).option("--https", "force https://github.com/").option("-y, --yes", "do not ask for confirmation").addOption(new Option("--host <base>").hideHelp()).addOption(new Option("--cwd <dir>").hideHelp()).action(async (repo, opts) => {
+    state.code = await addCommand(repo, opts);
+  });
+  program.command("login").description("Log in to GitHub, to list and clone private repositories").option("--setup-git", "make rness git's credential helper for github.com").option("--no-setup-git", "do not ask about git").addOption(new Option("--github-api <base>").hideHelp()).action(async (opts) => {
+    state.code = await loginCommand(opts);
+  });
+  program.command("logout").description("Forget the GitHub login of this machine").action(async () => {
+    state.code = await logoutCommand();
+  });
+  program.command("git-credential", { hidden: true }).argument("<operation>").action(async (operation) => {
+    state.code = await gitCredentialCommand(operation);
+  });
+  program.command("upgrade").alias("update").description(
+    "Move this workspace to another @rness/cli: pin it in .rness/package.json, install, sync"
+  ).argument("[version]", "an exact version (default: the latest release)").option("-y, --yes", "do not ask for confirmation").addOption(new Option("--cwd <dir>").hideHelp()).action(async (version, opts) => {
+    state.code = await upgradeCommand(version, opts);
+  });
+  program.command("create").description(
+    "Create a workspace for a GitHub organization, or join its existing .rness"
+  ).argument("[org]", "the GitHub organization, same as --org").option(
+    "--org <name>",
+    "the GitHub organization, exact name (github.com/<name>)"
+  ).option(
+    "--repos <list>",
+    "comma-separated repositories for your workspace (catalogue entries are cloned, others added)"
+  ).option(
+    "--pm <name>",
+    `package manager for .rness/ (${PACKAGE_MANAGERS.join(", ")}; default: the one running this command)`
+  ).option(
+    "--ssh",
+    "force git@github.com: (default: SSH when it works, else HTTPS)"
+  ).option("--https", "force https://github.com/").option("--skip-install", "do not install .rness/ dependencies").option("-y, --yes", "do not ask for confirmation").option("--template <name>", "reserved").addOption(new Option("--host <base>").hideHelp()).addOption(new Option("--github-api <base>").hideHelp()).addOption(new Option("--cwd <dir>").hideHelp()).action(async (orgArg, opts) => {
+    if (orgArg !== void 0 && opts.org !== void 0 && orgArg !== opts.org) {
+      process.stderr.write(
+        `organization given twice: "${orgArg}" and --org "${opts.org}"
+`
+      );
+      state.code = 2;
+      return;
+    }
+    const org = opts.org ?? orgArg;
+    state.code = await createCommand(
+      org === void 0 ? opts : { ...opts, org }
+    );
+  });
+  return program;
+}
+async function run(argv) {
+  const state = { code: 0 };
+  const program = buildProgram(state);
+  if (argv.length === 0) {
+    process.stdout.write(banner(VERSION) + program.helpInformation());
+    return 0;
+  }
+  try {
+    await program.parseAsync(argv, { from: "user" });
+  } catch (e) {
+    if (e instanceof CommanderError) {
+      return e.exitCode === 0 ? 0 : 2;
+    }
+    throw e;
+  }
+  return state.code;
+}
+
+export {
+  exists,
+  readOrNull,
+  writeFileAtomic,
+  GitHubOAuthProvider,
+  githubProvider,
+  DEFAULT_HOST,
+  SSH_HOST,
+  repoUrl,
+  classifyProbe,
+  probeRemote,
+  NAME,
+  NAME_RULE,
+  ORG_NAME,
+  loadManifest,
+  writeManifest,
+  parseRepoSpec,
+  addRepository,
+  workspaceDirs,
+  defaultTerminal,
+  GITHUB_HOSTS,
+  detectGithubSsh,
+  defaultTransport,
+  findWorkspace,
+  reportError,
+  BEGIN,
+  END,
+  BLOCK_SIZE_WARNING,
+  blockHash,
+  renderBlock,
+  parseHeader,
+  bodyOf,
+  parseFrontMatter,
+  extractTitle,
+  collectMarkdown,
+  resolveScope,
+  scopeChain,
+  COLLECTIONS,
+  assembleContext,
+  findBlock,
+  mergeBlock,
+  ensureClaudeMd,
+  syncCommand,
+  addCommand,
+  renderMarkdown,
+  contextCommand,
+  findDelegate,
+  PACKAGE_MANAGERS,
+  isPackageManager,
+  detectPackageManager,
+  packageManagerVersion,
+  installDependencies,
+  driftWarning,
+  SCAFFOLD_FILES,
+  scaffoldDir,
+  copyScaffold,
+  VERSION,
+  loginCommand,
+  createCommand,
+  logoutCommand,
+  upgradeCommand,
+  checkBlocks,
+  STATUSES,
+  checkContract,
+  validateCommand,
+  run
+};
+//# sourceMappingURL=chunk-WSGPDTPQ.js.map