@wairon/cli 5.0.2-dev.13 → 5.0.2-dev.15

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.13";
+    WAIRON_VERSION = "5.0.2-dev.15";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -458,7 +458,7 @@ var init_domain = __esm({
 });
 
 // src/models/project.ts
-var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProjectConfigSchema;
+var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
@@ -582,6 +582,24 @@ var init_project = __esm({
       /** Base directory containing SDD specification files, relative to project root */
       specsDir: import_zod3.z.string().default(".wai/specs")
     });
+    ProfileSelectionSubjectSchema = import_zod3.z.object({
+      userId: import_zod3.z.string(),
+      kind: import_zod3.z.string(),
+      issuer: import_zod3.z.string(),
+      externalSubject: import_zod3.z.string().optional(),
+      displayName: import_zod3.z.string().optional(),
+      email: import_zod3.z.string().optional()
+    });
+    ProjectProfileSelectionSchema = import_zod3.z.object({
+      /** Selected architectural profile ids. The first resolvable one is applied as projectType. */
+      profileIds: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names the governing policy requires for this project. */
+      requiredPackNames: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names applied by default unless explicitly overridden. */
+      defaultPackNames: import_zod3.z.array(import_zod3.z.string()).optional(),
+      selectedBy: ProfileSelectionSubjectSchema.optional(),
+      selectedAt: import_zod3.z.string()
+    });
     ProjectConfigSchema = import_zod3.z.object({
       /**
        * Schema version — used to detect incompatible config formats in future
@@ -622,6 +640,13 @@ var init_project = __esm({
         useGlobalPacks: import_zod3.z.boolean().default(true)
       }).optional(),
       paths: PathsConfigSchema.default({}),
+      /**
+       * The profile/pack selection a hosted policy workflow applied to this project.
+       * The RECORD of what was chosen; `projectType` above is what actually governs
+       * validation. Modeled so the parse/write round trip preserves it (see
+       * ProjectProfileSelectionSchema).
+       */
+      profileSelection: ProjectProfileSelectionSchema.optional(),
       /**
        * Path to a directory containing org/user-level default templates.
        * Resolved before built-in templates but after project-local templates.
@@ -1914,6 +1939,47 @@ var init_loader = __esm({
   }
 });
 
+// src/core/statehash.ts
+function computeStateId() {
+  const tree = {
+    system: loadSystemSpec(),
+    subsystems: loadSubsystemSpecs(),
+    components: loadComponentSpecs(),
+    interfaces: loadInterfaceSpecs(),
+    implementations: loadImplementationSpecs(),
+    types: loadTypeSpecs()
+  };
+  const digest = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
+  return { algorithm: "sha256", digest };
+}
+function stateIdEquals(a, b) {
+  return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
+}
+function canonicalize(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(v) {
+  if (Array.isArray(v)) return v.map(sortKeys);
+  if (v && typeof v === "object") {
+    const src = v;
+    const out = {};
+    for (const k of Object.keys(src).sort()) {
+      if (k === "createdAt" || k === "updatedAt") continue;
+      out[k] = sortKeys(src[k]);
+    }
+    return out;
+  }
+  return v;
+}
+var crypto;
+var init_statehash = __esm({
+  "src/core/statehash.ts"() {
+    "use strict";
+    crypto = __toESM(require("crypto"));
+    init_specs2();
+  }
+});
+
 // src/core/narrative-labels.ts
 function resolveNarrativeLabels(methodName, steps) {
   const errors = [];
@@ -7272,7 +7338,7 @@ var init_extensions = __esm({
 });
 
 // src/core/rules/types.ts
-var BUILTIN_PROFILES;
+var BUILTIN_PROFILES, PROJECT_KINDS;
 var init_types = __esm({
   "src/core/rules/types.ts"() {
     "use strict";
@@ -7285,6 +7351,7 @@ var init_types = __esm({
       "realtime-embedded",
       "plc-cyclic"
     ];
+    PROJECT_KINDS = ["fullstack", "system-of-systems", "monorepo"];
   }
 });
 
@@ -7475,47 +7542,6 @@ var init_filenames = __esm({
   }
 });
 
-// src/core/statehash.ts
-function computeStateId() {
-  const tree = {
-    system: loadSystemSpec(),
-    subsystems: loadSubsystemSpecs(),
-    components: loadComponentSpecs(),
-    interfaces: loadInterfaceSpecs(),
-    implementations: loadImplementationSpecs(),
-    types: loadTypeSpecs()
-  };
-  const digest = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
-  return { algorithm: "sha256", digest };
-}
-function stateIdEquals(a, b) {
-  return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
-}
-function canonicalize(value) {
-  return JSON.stringify(sortKeys(value));
-}
-function sortKeys(v) {
-  if (Array.isArray(v)) return v.map(sortKeys);
-  if (v && typeof v === "object") {
-    const src = v;
-    const out = {};
-    for (const k of Object.keys(src).sort()) {
-      if (k === "createdAt" || k === "updatedAt") continue;
-      out[k] = sortKeys(src[k]);
-    }
-    return out;
-  }
-  return v;
-}
-var crypto;
-var init_statehash = __esm({
-  "src/core/statehash.ts"() {
-    "use strict";
-    crypto = __toESM(require("crypto"));
-    init_specs2();
-  }
-});
-
 // src/core/openapi.ts
 function schemaFor(typeRef, closureIds) {
   const trimmed = typeRef.trim().replace(/^promise\s*<(.+)>$/i, "$1").trim();
@@ -7969,6 +7995,57 @@ function projectOwnSurface(maxAudience) {
 function projectChildSurface() {
   return projectOwnSurface("project");
 }
+function localName(id) {
+  return id.split("::").pop();
+}
+function projectSubsystemSurface(subsystemId) {
+  const system = loadSystemSpec();
+  if (!system) {
+    throw new Error("Cannot project a subsystem surface: the L0 system spec is missing.");
+  }
+  const subsystems = loadSubsystemSpecs();
+  const target = subsystems.find((s) => s.id === subsystemId);
+  if (!target) {
+    throw new Error(`Cannot project a subsystem surface: subsystem "${subsystemId}" does not exist.`);
+  }
+  const components = loadComponentSpecs();
+  const interfaces = loadInterfaceSpecs();
+  const types = loadTypeSpecs();
+  const entries = [];
+  for (const pub of target.publicInterfaces ?? []) {
+    if (!pub.component) continue;
+    const comp = components.find((c) => c.id === pub.component || c.id === `${subsystemId}::${pub.component}`);
+    if (!comp) continue;
+    if (comp.componentType !== "Portal") continue;
+    const compInterfaces = interfaces.filter((i) => i.component === comp.id && (!pub.interface || i.id === pub.interface || i.id === `${subsystemId}::${pub.interface}`));
+    const methods = compInterfaces.flatMap((i) => i.methods);
+    entries.push({
+      id: localName(pub.interface ?? comp.id),
+      name: comp.name,
+      // Family ceiling: a sibling surface is consumable by the system family only.
+      audience: "project",
+      type: pub.type ?? "Custom",
+      // The snapshot carries the LOCAL portal name — consumers resolve cross-tree
+      // refs by their final segment.
+      component: localName(comp.id),
+      methods,
+      ...comp.dispatch && comp.dispatch.length ? { dispatch: comp.dispatch } : {},
+      // Project the backing Portal's auth + basePath so the codec can emit
+      // OpenAPI security + per-portal servers self-contained from the snapshot.
+      ...comp.auth && comp.auth.scheme !== "none" ? { auth: comp.auth } : {},
+      ...comp.basePath ? { basePath: comp.basePath } : {},
+      details: pub.details ?? ""
+    });
+  }
+  return SurfaceSnapshotSchema.parse({
+    projectName: `${system.name}::${subsystemId}`,
+    origin: "generated",
+    stateId: stateIdString(),
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    interfaces: entries,
+    types: computeTypeClosure(entries, types)
+  });
+}
 function listSnapshots(rootDir = getProjectRoot()) {
   const dir = surfacesDir(rootDir);
   if (!fs9.existsSync(dir)) return [];
@@ -7985,10 +8062,13 @@ function listSnapshots(rootDir = getProjectRoot()) {
 function getSnapshot(projectName, rootDir = getProjectRoot()) {
   return listSnapshots(rootDir).find((s) => s.projectName === projectName) ?? null;
 }
+function snapshotFilename(projectName) {
+  return `${safeFilenamePart(projectName)}.yaml`;
+}
 function saveSnapshot(snapshot, rootDir = getProjectRoot()) {
   const dir = surfacesDir(rootDir);
   fs9.mkdirSync(dir, { recursive: true });
-  const p = path10.join(dir, `${snapshot.projectName}.yaml`);
+  const p = path10.join(dir, snapshotFilename(snapshot.projectName));
   writeYamlFile(p, SurfaceSnapshotSchema.parse(snapshot));
   return p;
 }
@@ -8061,17 +8141,54 @@ function importSurface(sourcePath, origin) {
   return snapshot;
 }
 function generateChildSnapshots(rootDir = getProjectRoot()) {
-  const children = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::"));
+  const topLevel = loadSubsystemSpecs().filter((s) => !s.id.includes("::"));
+  const children = topLevel.filter((s) => s.projectPath);
   if (!children.length) return [];
-  const snapshot = projectChildSurface();
+  const familySnapshot = projectChildSurface();
+  const siblingSnapshots = /* @__PURE__ */ new Map();
+  const siblingSurface = (subsystemId) => {
+    let snap = siblingSnapshots.get(subsystemId);
+    if (!snap) {
+      snap = projectSubsystemSurface(subsystemId);
+      siblingSnapshots.set(subsystemId, snap);
+    }
+    return snap;
+  };
   const written = [];
   for (const child of children) {
     const childDir = path10.resolve(rootDir, child.projectPath);
     if (!fs9.existsSync(childDir)) continue;
-    written.push(saveSnapshot(snapshot, childDir));
+    written.push(saveSnapshot(familySnapshot, childDir));
+    for (const sibling of topLevel) {
+      if (sibling.id === child.id) continue;
+      written.push(saveSnapshot(siblingSurface(sibling.id), childDir));
+    }
   }
   return written;
 }
+function computeParentStateId(parentRoot) {
+  return computeStateIdAt(parentRoot);
+}
+function listExternalInterfaces() {
+  const snapshots = listSnapshots();
+  const chainingParent = resolveChainingParent();
+  const parentStateId = chainingParent ? computeParentStateId(chainingParent.parentRoot) : null;
+  return snapshots.map((snapshot) => {
+    const generated = snapshot.origin === "generated";
+    const sourceKind = !generated ? "foreign" : snapshot.projectName.includes("::") ? "sibling" : "parent";
+    const freshness = generated && parentStateId ? snapshot.stateId === parentStateId ? "fresh" : "stale" : "unverifiable";
+    return {
+      projectName: snapshot.projectName,
+      origin: snapshot.origin,
+      sourceKind,
+      generatedAt: snapshot.generatedAt,
+      ...snapshot.stateId ? { stateId: snapshot.stateId } : {},
+      ...snapshot.version ? { version: snapshot.version } : {},
+      freshness,
+      interfaceIds: snapshot.interfaces.map((e) => e.id)
+    };
+  });
+}
 function surfaceContentKey(snapshot) {
   const { stateId, generatedAt, origin, ...content } = snapshot;
   return JSON.stringify(content);
@@ -8280,7 +8397,8 @@ var init_contracts = __esm({
                           "SURFACE_REF_NOT_EXPOSED",
                           `Method "${implMethod.name}" in implementation "${impl.id}" dispatches capability "${step.capability}" through cross-tree portal "${step.targetComponent}" (step ${step.stepNumber}), but the surface snapshot of "${resolved.snapshot.projectName}" does not serve that capability on "${resolved.entry.id}".`,
                           impl.id,
-                          isDraftCtx
+                          isDraftCtx,
+                          true
                         );
                       }
                       continue;
@@ -8337,7 +8455,8 @@ var init_contracts = __esm({
                         "SURFACE_REF_NOT_EXPOSED",
                         `Method "${implMethod.name}" in implementation "${impl.id}" calls "${step.targetMethod}" on cross-tree component "${step.targetComponent}" (step ${step.stepNumber}), but the surface snapshot of "${resolved.snapshot.projectName}" does not expose that method on "${resolved.entry.id}".`,
                         impl.id,
-                        isDraftCtx
+                        isDraftCtx,
+                        true
                       );
                     } else if (step.assertsGuarantees) {
                       const declared = new Set(surfaceMethod.guarantees ?? []);
@@ -8348,7 +8467,8 @@ var init_contracts = __esm({
                             "NARRATIVE_SEMANTIC_UNBACKED",
                             `Step ${step.stepNumber} of "${implMethod.name}" in implementation "${impl.id}" asserts guarantee "${g}", but the surface snapshot of "${resolved.snapshot.projectName}" does not declare it on "${resolved.entry.id}.${step.targetMethod}".`,
                             impl.id,
-                            isDraftCtx
+                            isDraftCtx,
+                            true
                           );
                         }
                       }
@@ -9836,7 +9956,8 @@ var init_stereotype_deps = __esm({
                       "CROSS_SUBSYSTEM_NON_ADAPTER",
                       `Boundary violation: ${comp.componentType} "${comp.id}" depends directly on "${depId}", a surface of project "${resolved.snapshot.projectName}". Only a local client Adapter may cross a project boundary \u2014 route this hop through an Adapter.`,
                       comp.id,
-                      isDraftCtx
+                      isDraftCtx,
+                      true
                     );
                   }
                   continue;
@@ -10414,14 +10535,14 @@ var init_declarative_assertions = __esm({
 });
 
 // src/core/rules/profiles.ts
-var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS, profilesRule;
+var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS2, profilesRule;
 var init_profiles = __esm({
   "src/core/rules/profiles.ts"() {
     "use strict";
     init_types();
     BACKEND_LIKE = /* @__PURE__ */ new Set(["backend", "lowlevel-os", "game-ecs", "realtime-embedded", "plc-cyclic"]);
     FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
-    PROJECT_KINDS = /* @__PURE__ */ new Set(["fullstack", "system-of-systems", "monorepo"]);
+    PROJECT_KINDS2 = new Set(PROJECT_KINDS);
     profilesRule = {
       name: "architectural-profiles",
       description: "Per-profile stereotype constraints: View/FeatureComponent/RouterComponent only in frontend profiles; Actor/Supervisor forbidden in plc-cyclic (single scan cycle); Actor/Supervisor in frontend profiles warned. Extension packs may register custom profiles (family + forbidden/discouraged stereotype lists); unknown profile names are flagged.",
@@ -10445,7 +10566,7 @@ var init_profiles = __esm({
             );
           }
         }
-        if (!registered.has(ctx.projectType) && !PROJECT_KINDS.has(ctx.projectType)) {
+        if (!registered.has(ctx.projectType) && !PROJECT_KINDS2.has(ctx.projectType)) {
           ctx.addIssue(
             "warning",
             "UNKNOWN_PROFILE",
@@ -11699,11 +11820,11 @@ var init_narrative_antipatterns = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => a.fromKey.localeCompare(b.fromKey))[0];
-          const path62 = [...keys].sort().join(" \u2192 ");
+          const path61 = [...keys].sort().join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path62} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path61} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -13090,9 +13211,15 @@ function buildRuleContext(opts) {
     ...[...SDD_RULES, ...extensions.rules].flatMap((r) => r.codes.map((c) => c.code)),
     // Declarative assertions bring their own namespaced codes — lint.allow
     // and severity overrides treat them exactly like builtins.
-    ...extensions.assertions.map((a) => a.fullCode)
+    ...extensions.assertions.map((a) => a.fullCode),
+    // Entry-point emitted codes: validateSddTree's chained-subproject pass
+    // raises these AFTER the rule run (it post-processes the aggregated issue
+    // list), so no registered rule declares them — but lint.allow validation
+    // must still recognize them as real codes.
+    "CHAINED_SUBPROJECT_CONTEXT",
+    "UNVERIFIED_EXTERNAL_REF"
   ]);
-  const addIssue = (defaultSeverity, code, message, specId, isDraftContext) => {
+  const addIssue = (defaultSeverity, code, message, specId, isDraftContext, surfaceResolved) => {
     if (scopeSubsystem && specId && !isSpecInScope(specId)) {
       return;
     }
@@ -13110,7 +13237,14 @@ function buildRuleContext(opts) {
         if (severity === "warning") return;
       }
     }
-    issues.push({ severity, code, message, specId, ...isDraftContext ? { draftContext: true } : {} });
+    issues.push({
+      severity,
+      code,
+      message,
+      specId,
+      ...isDraftContext ? { draftContext: true } : {},
+      ...surfaceResolved ? { surfaceResolved: true } : {}
+    });
   };
   return {
     system,
@@ -13535,24 +13669,54 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
     for (const rule of ruleSequence()) {
       rule.check(ctx);
     }
-    const hasCrossTreeSuspects = issues.some((i) => SUBPROJECT_LENIENT_CODES.has(i.code));
+    const hasCrossTreeSuspects = issues.some(
+      (i) => SUBPROJECT_REFERENCE_CODES.has(i.code) || SUBPROJECT_CONFORMANCE_CODES.has(i.code)
+    );
     const chainingParent = hasCrossTreeSuspects ? findChainingParent(getProjectRoot()) : null;
     if (chainingParent) {
+      let unverified = 0;
       let downgraded = 0;
-      for (const iss of issues) {
-        if (!SUBPROJECT_LENIENT_CODES.has(iss.code)) continue;
-        if (iss.severity === "error") {
-          iss.severity = "warning";
-          downgraded++;
+      for (let at = 0; at < issues.length; at++) {
+        const iss = issues[at];
+        if (SUBPROJECT_REFERENCE_CODES.has(iss.code) && !iss.surfaceResolved) {
+          issues[at] = {
+            severity: "warning",
+            code: "UNVERIFIED_EXTERNAL_REF",
+            crossTreeContext: true,
+            // --ci waives it (parent root is authoritative)
+            specId: iss.specId,
+            ...iss.agentId ? { agentId: iss.agentId } : {},
+            ...iss.draftContext ? { draftContext: true } : {},
+            message: `Unverified external reference (${iss.code}): ${iss.message} No vendored surface snapshot covers this reference, so it cannot be verified from this chained subproject standalone \u2014 re-lock the parent so fresh family/sibling snapshots ship, or inspect what this project can consume via \`wairon surface externals\` / sdd_list_external_interfaces.`
+          };
+          unverified++;
+          continue;
+        }
+        if (SUBPROJECT_CONFORMANCE_CODES.has(iss.code)) {
+          if (iss.severity === "error") {
+            iss.severity = "warning";
+            downgraded++;
+          }
+          iss.crossTreeContext = true;
         }
-        iss.crossTreeContext = true;
       }
-      if (downgraded > 0) {
+      if (unverified > 0 || downgraded > 0) {
+        const notes = [];
+        if (unverified > 0) {
+          notes.push(
+            `${unverified} cross-tree reference(s) have no vendored surface snapshot covering them and were reported as UNVERIFIED_EXTERNAL_REF warnings \u2014 re-lock the parent so fresh family/sibling snapshots ship, or inspect via \`wairon surface externals\` / sdd_list_external_interfaces.`
+          );
+        }
+        if (downgraded > 0) {
+          notes.push(
+            `${downgraded} code\u2194spec conformance finding(s) (parent-root-relative source paths) were downgraded to warnings.`
+          );
+        }
         issues.unshift({
           severity: "warning",
           code: "CHAINED_SUBPROJECT_CONTEXT",
           crossTreeContext: true,
-          message: `This project is a chained subproject ("${chainingParent.subsystemId}") of the parent project at "${chainingParent.parentRoot}". ${downgraded} reference(s) resolve only in the parent tree (shared types, sibling subsystems, or cross-tree components that live above this root) and were downgraded to warnings \u2014 validating a subproject standalone cannot verify them. Run validation from the parent root for full cross-tree verification.`
+          message: `This project is a chained subproject ("${chainingParent.subsystemId}") of the parent project at "${chainingParent.parentRoot}". ${notes.join(" ")} Full cross-tree verification runs from the parent root.`
         });
       }
     }
@@ -13569,7 +13733,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
 function validateAsComplete(options) {
   return validateSddTree({ ...options ?? {}, treatAllAsComplete: true });
 }
-var SUBPROJECT_LENIENT_CODES;
+var SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
 var init_validation = __esm({
   "src/core/validation.ts"() {
     "use strict";
@@ -13582,8 +13746,7 @@ var init_validation = __esm({
     init_source_analysis();
     init_specs2();
     init_fs();
-    SUBPROJECT_LENIENT_CODES = /* @__PURE__ */ new Set([
-      // reference resolution
+    SUBPROJECT_REFERENCE_CODES = /* @__PURE__ */ new Set([
       "UNDEFINED_TYPE_REFERENCE",
       "INVALID_DEPENDENCY_REFERENCE",
       "INVALID_TARGET_COMPONENT_REFERENCE",
@@ -13591,8 +13754,9 @@ var init_validation = __esm({
       "UNDECLARED_DEPENDENCY_CALL",
       "INVALID_TRUSTED_LINK",
       "CROSS_SUBSYSTEM_NON_ADAPTER",
-      "CROSS_TREE_REF_UNRESOLVED",
-      // code↔spec conformance (root-relative sourcePaths / import graph)
+      "CROSS_TREE_REF_UNRESOLVED"
+    ]);
+    SUBPROJECT_CONFORMANCE_CODES = /* @__PURE__ */ new Set([
       "MISSING_SOURCE_FILE",
       "SOURCE_PATH_ESCAPES_ROOT",
       "MISSING_SOURCE_PATH",
@@ -14134,6 +14298,7 @@ __export(specs_exports, {
   buildProjectGraph: () => buildProjectGraph,
   clearLoaderIssues: () => clearLoaderIssues,
   collectPromotableSpecs: () => collectPromotableSpecs,
+  computeStateIdAt: () => computeStateIdAt,
   deleteComponentSpec: () => deleteComponentSpec,
   deleteGroupSpec: () => deleteGroupSpec,
   deleteImplementationSpec: () => deleteImplementationSpec,
@@ -14166,6 +14331,7 @@ __export(specs_exports, {
   loadTypeSpec: () => loadTypeSpec,
   loadTypeSpecs: () => loadTypeSpecs,
   normalizeComponentLayout: () => normalizeComponentLayout,
+  resolveChainingParent: () => resolveChainingParent,
   resolveSubprojectForNamespace: () => resolveSubprojectForNamespace,
   restoreSpecFiles: () => restoreSpecFiles,
   saveComponentSpec: () => saveComponentSpec,
@@ -14570,6 +14736,19 @@ function dryRunSerializeSpecs(include) {
 function buildProjectGraph(level) {
   return buildGraphModel(level);
 }
+function resolveChainingParent() {
+  return findChainingParent(getProjectRoot());
+}
+function computeStateIdAt(root) {
+  const resolved = path14.resolve(root);
+  return runWithProjectRoot(resolved, () => {
+    workspaceFor(resolved).invalidate();
+    const system = loadSystemSpec();
+    if (!system) return null;
+    const s = computeStateId();
+    return `${s.algorithm}:${s.digest}`;
+  });
+}
 function deleteTypeSpec(id) {
   return current().deleteTypeSpec(id);
 }
@@ -14613,6 +14792,7 @@ var init_specs2 = __esm({
     path14 = __toESM(require("path"));
     init_loader();
     init_fs();
+    init_statehash();
     init_yaml();
     init_models();
     init_narrative_labels();
@@ -17206,6 +17386,9 @@ function requireSpecs() {
 function requireProvision() {
   return init_provision(), __toCommonJS(provision_exports);
 }
+function listExternalInterfaces2() {
+  return listExternalInterfaces();
+}
 function text(content) {
   return { content: [{ type: "text", text: content }] };
 }
@@ -18172,7 +18355,36 @@ NOTICE:
       }
     }
   );
+  reg(
+    server,
+    "sdd_list_external_interfaces",
+    {
+      description: "List the bound project's consumable external surfaces (parent family, siblings, foreign imports) as discovery entries with origin, provenance, and freshness \u2014 the tool an agent inside a subproject uses to SEE its outward world instead of discovering it by failed reference resolution. Full contracts stay in the vendored snapshots (.wai/surfaces/); each entry summarizes the interface ids it exposes."
+    },
+    () => {
+      try {
+        return json(listExternalInterfaces2());
+      } catch (e) {
+        return errText(String(e));
+      }
+    }
+  );
   registerSkillResources(server);
+  try {
+    const chainingParent = resolveChainingParent();
+    if (chainingParent) {
+      let externalSurfaceCount = 0;
+      try {
+        externalSurfaceCount = listExternalInterfaces2().length;
+      } catch {
+      }
+      process.stderr.write(
+        `[wairon mcp] chained subproject: this root is mounted as subsystem "${chainingParent.subsystemId}" of the parent project at ${chainingParent.parentRoot} \u2014 ${externalSurfaceCount} vendored external surface(s) discoverable via sdd_list_external_interfaces
+`
+      );
+    }
+  } catch {
+  }
   if (options.hostedTools) {
     const hostedStub = () => errText("This hosted tool is dispatched by the hosting data plane before reaching the MCP server; it is unavailable outside a hosted request.");
     reg(server, "sdd_host_lock_project", {
@@ -18308,6 +18520,8 @@ var init_server = __esm({
     init_narrative_labels();
     init_specs();
     init_skills();
+    init_specs2();
+    init_surfaces();
     SERVER_BUILD_STAMP = captureBuildStamp(__filename);
     STALE_SERVER_WARNING = "\n\n\u26A0 STALE SERVER: the wairon build on disk changed after this MCP server started. Restart the MCP session (e.g. /mcp reconnect) before further spec edits \u2014 writes through a stale server can silently drop fields introduced by newer schemas.";
     SKILL_RESOURCE_MIME = "text/markdown";
@@ -21381,7 +21595,7 @@ var require_dist = __commonJS({
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
     var fs51 = __toESM2(require("fs"));
-    var path62 = __toESM2(require("path"));
+    var path61 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -21419,8 +21633,8 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path62.join(destDir, file.path);
-        fs51.mkdirSync(path62.dirname(absolute), { recursive: true });
+        const absolute = path61.join(destDir, file.path);
+        fs51.mkdirSync(path61.dirname(absolute), { recursive: true });
         fs51.writeFileSync(absolute, file.contents);
       }
     }
@@ -21433,10 +21647,10 @@ var require_dist = __commonJS({
       for (const entry of fs51.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path62.join(current2, entry.name), out);
+          walkPackDir(root, path61.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path62.join(current2, entry.name);
-          const relative22 = path62.relative(root, absolute).split(path62.sep).join("/");
+          const absolute = path61.join(current2, entry.name);
+          const relative22 = path61.relative(root, absolute).split(path61.sep).join("/");
           out.push({ path: relative22, contents: fs51.readFileSync(absolute) });
         }
       }
@@ -22847,86 +23061,216 @@ async function generateLayer(options = {}) {
 }
 
 // src/commands/lock.ts
+var os7 = __toESM(require("os"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_logger();
-init_loader();
-init_fs();
-init_validation();
-init_specs2();
-async function runLock(options = {}) {
-  assertProjectInitialized();
-  if (!pathExists(AI_PATHS.specsSystem())) {
-    logger.error("No SDD spec tree found (.wai/specs). Nothing to lock.");
-    process.exit(1);
+init_defaults();
+
+// src/core/detection.ts
+var fs18 = __toESM(require("fs"));
+var path27 = __toESM(require("path"));
+init_defaults();
+var PACKAGE_MARKERS = [
+  "package.json",
+  "pyproject.toml",
+  "Cargo.toml",
+  "go.mod",
+  "build.gradle",
+  "build.gradle.kts",
+  "pom.xml"
+];
+var MAX_SCAN_DEPTH = 5;
+function detectDomainCandidates(projectRoot2, alreadyTrackedPaths = /* @__PURE__ */ new Set(), alreadyTrackedIds = /* @__PURE__ */ new Set()) {
+  const candidates = /* @__PURE__ */ new Map();
+  for (const c of detectGitSubmodules(projectRoot2)) {
+    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
   }
-  const projectConfig = loadProjectConfig();
-  logger.info("Analyzing and validating specifications in-memory...");
-  const index = scanAllSpecs({ recursive: options.recursive ?? true });
-  const promotable = collectPromotableSpecs(options.subsystem);
-  const originalStatuses = /* @__PURE__ */ new Map();
-  const isSpecInSubsystemScope = (specSubsystem) => {
-    if (!options.subsystem) return true;
-    if (!specSubsystem) return false;
-    return specSubsystem === options.subsystem || specSubsystem.startsWith(`${options.subsystem}::`);
-  };
-  for (const s of index.subsystems) {
-    if (!options.subsystem || s.id === options.subsystem || s.id.startsWith(`${options.subsystem}::`)) {
-      originalStatuses.set(s, s.status);
-      s.status = "complete";
+  for (const c of detectNestedGitRepos(projectRoot2)) {
+    if (!candidates.has(c.path)) {
+      candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
     }
   }
-  for (const c of index.components) {
-    if (isSpecInSubsystemScope(c.subsystem)) {
-      originalStatuses.set(c, c.status);
-      c.status = "complete";
-    }
+  const gitPaths = new Set(
+    Array.from(candidates.values()).filter((c) => c.type === "git-submodule" || c.type === "git-repo").map((c) => c.path)
+  );
+  for (const c of detectPackageRoots(projectRoot2)) {
+    if (candidates.has(c.path)) continue;
+    const insideGit = Array.from(gitPaths).some(
+      (gp) => c.path === gp || c.path.startsWith(gp + "/")
+    );
+    if (insideGit) continue;
+    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
   }
-  for (const i of index.interfaces) {
-    const comp = index.components.find((c) => c.id === i.component);
-    if (comp && isSpecInSubsystemScope(comp.subsystem)) {
-      originalStatuses.set(i, i.status);
-      i.status = "complete";
-    }
+  const sorted = Array.from(candidates.values()).sort((a, b) => a.path.localeCompare(b.path));
+  return deduplicateIds(sorted, alreadyTrackedIds);
+}
+function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
+  const idCount = /* @__PURE__ */ new Map();
+  for (const id of existingIds) {
+    idCount.set(id, (idCount.get(id) ?? 0) + 1);
   }
-  for (const m of index.implementations) {
-    const intf = index.interfaces.find((i) => i.id === m.contract);
-    const comp = intf ? index.components.find((c) => c.id === intf.component) : null;
-    if (comp && isSpecInSubsystemScope(comp.subsystem)) {
-      originalStatuses.set(m, m.status);
-      m.status = "complete";
-    }
+  for (const c of candidates) {
+    idCount.set(c.suggestedId, (idCount.get(c.suggestedId) ?? 0) + 1);
   }
-  const dry = validateSddTree({
-    rules: projectConfig.rules,
-    projectType: projectConfig.projectType,
-    scopeSubsystem: options.subsystem,
-    recursive: options.recursive ?? true
+  return candidates.map((c) => {
+    if ((idCount.get(c.suggestedId) ?? 0) <= 1) return c;
+    const parts = c.path.split("/");
+    const qualifiedId2 = parts.length >= 2 ? pathToId(`${parts[parts.length - 2]}-${parts[parts.length - 1]}`) : c.suggestedId;
+    return { ...c, suggestedId: qualifiedId2 };
   });
-  for (const [spec, status2] of originalStatuses.entries()) {
-    spec.status = status2;
+}
+function parseGitmodules(filePath) {
+  const content = fs18.readFileSync(filePath, "utf-8");
+  const entries = [];
+  let current2 = {};
+  for (const line2 of content.split("\n")) {
+    const trimmed = line2.trim();
+    const headerMatch = trimmed.match(/^\[submodule "(.+)"\]$/);
+    if (headerMatch) {
+      if (current2.path) entries.push(current2);
+      current2 = { name: headerMatch[1] };
+      continue;
+    }
+    const keyVal = trimmed.match(/^(\w+)\s*=\s*(.+)$/);
+    if (keyVal) {
+      const [, key, value] = keyVal;
+      if (key === "path") current2.path = value.trim();
+      if (key === "url") current2.url = value.trim();
+    }
   }
-  const errors = dry.issues.filter((i) => i.severity === "error");
-  if (errors.length > 0) {
-    logger.header("Cannot lock \u2014 the spec tree does not validate as complete");
-    let errorCount = 0;
-    const MAX_PRINT = 100;
-    let skippedErrors = 0;
-    for (const i of errors) {
-      if (errorCount < MAX_PRINT) {
-        logger.error(`${i.specId ? `[${i.specId}] ` : ""}[${i.code}] ${i.message}`);
-        errorCount++;
-      } else {
-        skippedErrors++;
-      }
+  if (current2.path) entries.push(current2);
+  return entries;
+}
+function detectGitSubmodules(projectRoot2) {
+  const gitmodulesPath = path27.join(projectRoot2, ".gitmodules");
+  if (!fs18.existsSync(gitmodulesPath)) return [];
+  return parseGitmodules(gitmodulesPath).map((entry) => ({
+    suggestedId: pathToId(entry.path),
+    suggestedName: pathToName(entry.path),
+    path: normalizePath3(entry.path),
+    type: "git-submodule",
+    alreadyTracked: false
+  }));
+}
+function detectNestedGitRepos(projectRoot2) {
+  const results = [];
+  walkForGit(projectRoot2, projectRoot2, 0, results);
+  return results;
+}
+function walkForGit(projectRoot2, currentDir, depth, results) {
+  if (depth > MAX_SCAN_DEPTH) return;
+  let entries;
+  try {
+    entries = fs18.readdirSync(currentDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
+    const fullPath = path27.join(currentDir, entry.name);
+    const relPath = normalizePath3(path27.relative(projectRoot2, fullPath));
+    if (relPath === "" || relPath === ".") continue;
+    const gitPath = path27.join(fullPath, ".git");
+    if (fs18.existsSync(gitPath)) {
+      results.push({
+        suggestedId: pathToId(relPath),
+        suggestedName: pathToName(relPath),
+        path: relPath,
+        type: "git-repo",
+        alreadyTracked: false
+      });
+      continue;
     }
-    if (skippedErrors > 0) {
-      logger.error(`... and ${skippedErrors} more error(s) omitted.`);
+    walkForGit(projectRoot2, fullPath, depth + 1, results);
+  }
+}
+function detectPackageRoots(projectRoot2) {
+  const results = [];
+  walkForPackages(projectRoot2, projectRoot2, 0, results);
+  return results;
+}
+function walkForPackages(projectRoot2, currentDir, depth, results) {
+  if (depth > MAX_SCAN_DEPTH) return;
+  let entries;
+  try {
+    entries = fs18.readdirSync(currentDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
+    const fullPath = path27.join(currentDir, entry.name);
+    const relPath = normalizePath3(path27.relative(projectRoot2, fullPath));
+    if (relPath === "" || relPath === ".") continue;
+    const hasMarker = PACKAGE_MARKERS.some((m) => fs18.existsSync(path27.join(fullPath, m)));
+    if (hasMarker) {
+      results.push({
+        suggestedId: pathToId(relPath),
+        suggestedName: pathToName(relPath),
+        path: relPath,
+        type: "package-root",
+        alreadyTracked: false
+      });
     }
-    logger.blank();
-    logger.info("Fix the errors above, then run `wairon lock` again. Nothing was changed.");
-    process.exit(1);
+    walkForPackages(projectRoot2, fullPath, depth + 1, results);
   }
-  logger.header("Lock SDD specs");
+}
+function pathToId(relPath) {
+  const basename11 = path27.basename(relPath);
+  return basename11.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function pathToName(relPath) {
+  const id = pathToId(relPath);
+  return id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function normalizePath3(p) {
+  return p.replace(/\\/g, "/");
+}
+
+// src/core/index.ts
+init_domains();
+init_validation();
+init_extensions();
+init_variants();
+init_rules();
+init_specs2();
+init_provision();
+init_diagram();
+
+// src/core/lockfile.ts
+var fs19 = __toESM(require("fs"));
+var path28 = __toESM(require("path"));
+init_fs();
+function lockPath() {
+  return aiDir("lock.json");
+}
+function readLockRecord() {
+  try {
+    return JSON.parse(fs19.readFileSync(lockPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeLockRecord(record2) {
+  const p = lockPath();
+  fs19.mkdirSync(path28.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs19.writeFileSync(tmp, JSON.stringify(record2, null, 2) + "\n");
+  fs19.renameSync(tmp, p);
+}
+
+// src/core/index.ts
+init_statehash();
+init_agent_resolver();
+init_skills();
+init_surfaces();
+init_openapi();
+
+// src/commands/lock.ts
+async function runLock(options = {}, gate) {
+  const promotable = collectPromotableSpecs(options.subsystem);
   if (promotable.length === 0) {
     logger.info("All specs are already complete \u2014 this will re-validate and regenerate the agent topology.");
   } else {
@@ -22950,23 +23294,36 @@ async function runLock(options = {}) {
         default: false
       }
     ]);
-    if (!confirmed) {
-      logger.info("Cancelled. Nothing was changed.");
-      return;
-    }
+    if (!confirmed) return null;
+  }
+  if (options.subsystem) {
+    for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
+    invalidateSpecCache();
+  } else {
+    promoteAllComplete();
   }
-  for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
-  invalidateSpecCache();
   if (promotable.length > 0) {
     logger.success(`Locked ${promotable.length} spec(s) as complete.`);
   }
-  logger.blank();
-  await runGenerate({ domain: options.subsystem });
-  logger.blank();
-  logger.success("Specs locked and agent topology generated.");
-  logger.warn(
-    "Restart any running AI agent sessions (Claude Code / Antigravity / Codex) so the newly generated implementer agents load \u2014 they are not picked up mid-session."
-  );
+  let lockedBy = "local";
+  try {
+    lockedBy = `local:${os7.userInfo().username}`;
+  } catch {
+  }
+  const record2 = {
+    stateId: computeStateId(),
+    lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lockedBy,
+    validatorVersion: WAIRON_VERSION,
+    validationResult: {
+      valid: true,
+      errors: 0,
+      warnings: gate ? gate.issues.filter((i) => i.severity === "warning").length : 0
+    },
+    status: "ready"
+  };
+  writeLockRecord(record2);
+  return record2;
 }
 
 // src/commands/validate.ts
@@ -23105,6 +23462,10 @@ async function runValidate(options = {}) {
   }
 }
 
+// src/cli/index.ts
+init_loader();
+init_fs();
+
 // src/commands/list.ts
 var import_chalk7 = __toESM(require("chalk"));
 init_logger();
@@ -23219,9 +23580,9 @@ init_mcp();
 // src/commands/update.ts
 var https = __toESM(require("https"));
 var http = __toESM(require("http"));
-var fs18 = __toESM(require("fs"));
-var path27 = __toESM(require("path"));
-var os7 = __toESM(require("os"));
+var fs20 = __toESM(require("fs"));
+var path29 = __toESM(require("path"));
+var os8 = __toESM(require("os"));
 var crypto2 = __toESM(require("crypto"));
 var import_child_process2 = require("child_process");
 init_logger();
@@ -23284,8 +23645,8 @@ async function runUpdate(options = {}) {
     logger.info(`Download manually from: ${release.html_url}`);
     process.exit(1);
   }
-  const tmpDir = os7.tmpdir();
-  const tmpFile = path27.join(tmpDir, assetName);
+  const tmpDir = os8.tmpdir();
+  const tmpFile = path29.join(tmpDir, assetName);
   logger.info(`Downloading ${assetName}...`);
   try {
     await downloadFile(asset.browser_download_url, tmpFile);
@@ -23302,16 +23663,16 @@ async function runUpdate(options = {}) {
   const checksumAssetName = assetName + ".sha256";
   const checksumAsset = release.assets.find((a) => a.name === checksumAssetName);
   if (checksumAsset) {
-    const tmpChecksum = path27.join(tmpDir, checksumAssetName);
+    const tmpChecksum = path29.join(tmpDir, checksumAssetName);
     logger.info(`Verifying checksum...`);
     try {
       await downloadFile(checksumAsset.browser_download_url, tmpChecksum);
       verifyChecksum(tmpFile, tmpChecksum, assetName);
-      fs18.unlinkSync(tmpChecksum);
+      fs20.unlinkSync(tmpChecksum);
     } catch (err) {
       logger.error(`Checksum verification failed: ${err.message}`);
       try {
-        fs18.unlinkSync(tmpFile);
+        fs20.unlinkSync(tmpFile);
       } catch {
       }
       process.exit(1);
@@ -23377,7 +23738,7 @@ function fetchReleases(repo) {
 }
 function downloadFile(url, dest) {
   return new Promise((resolve24, reject) => {
-    const file = fs18.createWriteStream(dest);
+    const file = fs20.createWriteStream(dest);
     const get3 = url.startsWith("https://") ? https.get : http.get;
     get3(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
@@ -23399,21 +23760,21 @@ function downloadFile(url, dest) {
       });
       file.on("error", (err) => {
         res.destroy();
-        fs18.unlink(dest, () => {
+        fs20.unlink(dest, () => {
         });
         reject(err);
       });
     }).on("error", (err) => {
-      fs18.unlink(dest, () => {
+      fs20.unlink(dest, () => {
       });
       reject(err);
     });
   });
 }
 function verifyChecksum(filePath, checksumFile, expectedFilename) {
-  const checksumContent = fs18.readFileSync(checksumFile, "utf-8").trim();
+  const checksumContent = fs20.readFileSync(checksumFile, "utf-8").trim();
   const expectedHash = checksumContent.split(/\s+/)[0].toLowerCase();
-  const fileBuffer = fs18.readFileSync(filePath);
+  const fileBuffer = fs20.readFileSync(filePath);
   const actualHash = crypto2.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
   if (actualHash !== expectedHash) {
     throw new Error(
@@ -23444,9 +23805,9 @@ function isPkgBinary2() {
 function installBinary(tmpFile, destPath) {
   const platform = process.platform;
   const isZip = tmpFile.endsWith(".zip");
-  const extractDir = path27.join(os7.tmpdir(), "wairon-extract");
-  if (fs18.existsSync(extractDir)) fs18.rmSync(extractDir, { recursive: true });
-  fs18.mkdirSync(extractDir, { recursive: true });
+  const extractDir = path29.join(os8.tmpdir(), "wairon-extract");
+  if (fs20.existsSync(extractDir)) fs20.rmSync(extractDir, { recursive: true });
+  fs20.mkdirSync(extractDir, { recursive: true });
   if (isZip) {
     (0, import_child_process2.execSync)(
       `powershell -NoProfile -NonInteractive -Command "Expand-Archive -Path '${tmpFile}' -DestinationPath '${extractDir}' -Force"`,
@@ -23456,18 +23817,18 @@ function installBinary(tmpFile, destPath) {
     (0, import_child_process2.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
   }
   const binaryName = platform === "win32" ? "wairon.exe" : "wairon";
-  const extractedBinary = path27.join(extractDir, binaryName);
-  if (!fs18.existsSync(extractedBinary)) {
+  const extractedBinary = path29.join(extractDir, binaryName);
+  if (!fs20.existsSync(extractedBinary)) {
     throw new Error(`Extracted binary not found at ${extractedBinary}`);
   }
   if (platform === "win32") {
     const oldPath = destPath + ".old";
     try {
       cleanStaleBinary(oldPath);
-      fs18.renameSync(destPath, oldPath);
-      fs18.copyFileSync(extractedBinary, destPath);
+      fs20.renameSync(destPath, oldPath);
+      fs20.copyFileSync(extractedBinary, destPath);
       try {
-        fs18.unlinkSync(oldPath);
+        fs20.unlinkSync(oldPath);
       } catch {
       }
     } catch (err) {
@@ -23481,25 +23842,25 @@ function installBinary(tmpFile, destPath) {
     }
   } else {
     const tmpDest = destPath + ".new";
-    fs18.copyFileSync(extractedBinary, tmpDest);
-    fs18.chmodSync(tmpDest, 493);
-    fs18.renameSync(tmpDest, destPath);
+    fs20.copyFileSync(extractedBinary, tmpDest);
+    fs20.chmodSync(tmpDest, 493);
+    fs20.renameSync(tmpDest, destPath);
   }
   try {
-    fs18.unlinkSync(tmpFile);
+    fs20.unlinkSync(tmpFile);
   } catch {
   }
   try {
-    fs18.rmSync(extractDir, { recursive: true });
+    fs20.rmSync(extractDir, { recursive: true });
   } catch {
   }
 }
 function cleanStaleBinary(oldPath) {
   const target = oldPath ?? (isPkgBinary2() ? process.execPath + ".old" : null);
   if (!target) return;
-  if (fs18.existsSync(target)) {
+  if (fs20.existsSync(target)) {
     try {
-      fs18.unlinkSync(target);
+      fs20.unlinkSync(target);
     } catch {
     }
   }
@@ -23745,171 +24106,6 @@ async function filteredCheckbox(config) {
 
 // src/commands/domains.ts
 init_loader();
-
-// src/core/detection.ts
-var fs19 = __toESM(require("fs"));
-var path28 = __toESM(require("path"));
-init_defaults();
-var PACKAGE_MARKERS = [
-  "package.json",
-  "pyproject.toml",
-  "Cargo.toml",
-  "go.mod",
-  "build.gradle",
-  "build.gradle.kts",
-  "pom.xml"
-];
-var MAX_SCAN_DEPTH = 5;
-function detectDomainCandidates(projectRoot2, alreadyTrackedPaths = /* @__PURE__ */ new Set(), alreadyTrackedIds = /* @__PURE__ */ new Set()) {
-  const candidates = /* @__PURE__ */ new Map();
-  for (const c of detectGitSubmodules(projectRoot2)) {
-    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-  }
-  for (const c of detectNestedGitRepos(projectRoot2)) {
-    if (!candidates.has(c.path)) {
-      candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-    }
-  }
-  const gitPaths = new Set(
-    Array.from(candidates.values()).filter((c) => c.type === "git-submodule" || c.type === "git-repo").map((c) => c.path)
-  );
-  for (const c of detectPackageRoots(projectRoot2)) {
-    if (candidates.has(c.path)) continue;
-    const insideGit = Array.from(gitPaths).some(
-      (gp) => c.path === gp || c.path.startsWith(gp + "/")
-    );
-    if (insideGit) continue;
-    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-  }
-  const sorted = Array.from(candidates.values()).sort((a, b) => a.path.localeCompare(b.path));
-  return deduplicateIds(sorted, alreadyTrackedIds);
-}
-function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
-  const idCount = /* @__PURE__ */ new Map();
-  for (const id of existingIds) {
-    idCount.set(id, (idCount.get(id) ?? 0) + 1);
-  }
-  for (const c of candidates) {
-    idCount.set(c.suggestedId, (idCount.get(c.suggestedId) ?? 0) + 1);
-  }
-  return candidates.map((c) => {
-    if ((idCount.get(c.suggestedId) ?? 0) <= 1) return c;
-    const parts = c.path.split("/");
-    const qualifiedId2 = parts.length >= 2 ? pathToId(`${parts[parts.length - 2]}-${parts[parts.length - 1]}`) : c.suggestedId;
-    return { ...c, suggestedId: qualifiedId2 };
-  });
-}
-function parseGitmodules(filePath) {
-  const content = fs19.readFileSync(filePath, "utf-8");
-  const entries = [];
-  let current2 = {};
-  for (const line2 of content.split("\n")) {
-    const trimmed = line2.trim();
-    const headerMatch = trimmed.match(/^\[submodule "(.+)"\]$/);
-    if (headerMatch) {
-      if (current2.path) entries.push(current2);
-      current2 = { name: headerMatch[1] };
-      continue;
-    }
-    const keyVal = trimmed.match(/^(\w+)\s*=\s*(.+)$/);
-    if (keyVal) {
-      const [, key, value] = keyVal;
-      if (key === "path") current2.path = value.trim();
-      if (key === "url") current2.url = value.trim();
-    }
-  }
-  if (current2.path) entries.push(current2);
-  return entries;
-}
-function detectGitSubmodules(projectRoot2) {
-  const gitmodulesPath = path28.join(projectRoot2, ".gitmodules");
-  if (!fs19.existsSync(gitmodulesPath)) return [];
-  return parseGitmodules(gitmodulesPath).map((entry) => ({
-    suggestedId: pathToId(entry.path),
-    suggestedName: pathToName(entry.path),
-    path: normalizePath3(entry.path),
-    type: "git-submodule",
-    alreadyTracked: false
-  }));
-}
-function detectNestedGitRepos(projectRoot2) {
-  const results = [];
-  walkForGit(projectRoot2, projectRoot2, 0, results);
-  return results;
-}
-function walkForGit(projectRoot2, currentDir, depth, results) {
-  if (depth > MAX_SCAN_DEPTH) return;
-  let entries;
-  try {
-    entries = fs19.readdirSync(currentDir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path28.join(currentDir, entry.name);
-    const relPath = normalizePath3(path28.relative(projectRoot2, fullPath));
-    if (relPath === "" || relPath === ".") continue;
-    const gitPath = path28.join(fullPath, ".git");
-    if (fs19.existsSync(gitPath)) {
-      results.push({
-        suggestedId: pathToId(relPath),
-        suggestedName: pathToName(relPath),
-        path: relPath,
-        type: "git-repo",
-        alreadyTracked: false
-      });
-      continue;
-    }
-    walkForGit(projectRoot2, fullPath, depth + 1, results);
-  }
-}
-function detectPackageRoots(projectRoot2) {
-  const results = [];
-  walkForPackages(projectRoot2, projectRoot2, 0, results);
-  return results;
-}
-function walkForPackages(projectRoot2, currentDir, depth, results) {
-  if (depth > MAX_SCAN_DEPTH) return;
-  let entries;
-  try {
-    entries = fs19.readdirSync(currentDir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path28.join(currentDir, entry.name);
-    const relPath = normalizePath3(path28.relative(projectRoot2, fullPath));
-    if (relPath === "" || relPath === ".") continue;
-    const hasMarker = PACKAGE_MARKERS.some((m) => fs19.existsSync(path28.join(fullPath, m)));
-    if (hasMarker) {
-      results.push({
-        suggestedId: pathToId(relPath),
-        suggestedName: pathToName(relPath),
-        path: relPath,
-        type: "package-root",
-        alreadyTracked: false
-      });
-    }
-    walkForPackages(projectRoot2, fullPath, depth + 1, results);
-  }
-}
-function pathToId(relPath) {
-  const basename12 = path28.basename(relPath);
-  return basename12.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-}
-function pathToName(relPath) {
-  const id = pathToId(relPath);
-  return id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-}
-function normalizePath3(p) {
-  return p.replace(/\\/g, "/");
-}
-
-// src/commands/domains.ts
 init_domains();
 init_domain();
 async function runDomainsList() {
@@ -24099,9 +24295,9 @@ async function runSkillsInstall() {
 }
 
 // src/commands/doctor.ts
-var fs20 = __toESM(require("fs"));
-var os8 = __toESM(require("os"));
-var path29 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var os9 = __toESM(require("os"));
+var path30 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 init_logger();
 init_defaults();
@@ -24131,10 +24327,10 @@ function stampVerdict(content) {
   return { mark: "warn", note: `v${v} \u2014 stale, installed is v${WAIRON_VERSION}` };
 }
 function mcpEntryHealth(settingsPath) {
-  if (!fs20.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
+  if (!fs21.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
   let entry;
   try {
-    const s = JSON.parse(fs20.readFileSync(settingsPath, "utf8"));
+    const s = JSON.parse(fs21.readFileSync(settingsPath, "utf8"));
     entry = s.mcpServers?.["wairon"];
   } catch {
     return { mark: "error", note: "parse error" };
@@ -24142,7 +24338,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs20.existsSync(scriptPath)) {
+    if (!fs21.existsSync(scriptPath)) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -24194,7 +24390,7 @@ async function runDoctor(options = {}) {
     const { findChainingSubprojectsMissingConfig: findChainingSubprojectsMissingConfig2 } = (init_provision(), __toCommonJS(provision_exports));
     const missing = findChainingSubprojectsMissingConfig2(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path29.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path30.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -24232,7 +24428,7 @@ async function runDoctor(options = {}) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path29.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path30.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -24266,17 +24462,17 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path29.join(os8.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path30.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
-    if (fs20.existsSync(projPath)) {
+    if (fs21.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path29.join(os8.homedir(), ".gemini", "config", "plugins", "wairon");
-  if (fs20.existsSync(pluginDir)) {
+  const pluginDir = path30.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
+  if (fs21.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
   logger.blank();
@@ -24307,7 +24503,7 @@ async function applyFixes() {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
       for (const { path: oldPath, expected: newPath } of legacySpecs) {
-        fs20.renameSync(oldPath, newPath);
+        fs21.renameSync(oldPath, newPath);
       }
       console.log(`  ${icon("ok")} Migrated ${legacySpecs.length} legacy spec file(s) to the new dot-prefixed unified schema.`);
     }
@@ -24361,8 +24557,8 @@ function printSummary(tally) {
 }
 
 // src/commands/diagram.ts
-var fs21 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var fs22 = __toESM(require("fs"));
+var path31 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -24397,8 +24593,8 @@ function collectIssues() {
 }
 function writeCanvas(dest) {
   const model = buildCanvasModel(collectIssues());
-  ensureDir(path30.dirname(path30.resolve(dest)));
-  fs21.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
+  ensureDir(path31.dirname(path31.resolve(dest)));
+  fs22.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
 }
 function parseSequenceRef(ref) {
   const sep6 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
@@ -24413,55 +24609,55 @@ async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
-    ensureDir(path30.dirname(path30.resolve(dest2)));
-    fs21.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    ensureDir(path31.dirname(path31.resolve(dest2)));
+    fs22.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
-    ensureDir(path30.dirname(path30.resolve(dest2)));
-    fs21.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    ensureDir(path31.dirname(path31.resolve(dest2)));
+    fs22.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
     return;
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      const dest2 = path30.join(outDir, file.relPath);
-      ensureDir(path30.dirname(dest2));
-      fs21.writeFileSync(dest2, toMarkdown(file), "utf-8");
+      const dest2 = path31.join(outDir, file.relPath);
+      ensureDir(path31.dirname(dest2));
+      fs22.writeFileSync(dest2, toMarkdown(file), "utf-8");
     }
-    writeCanvas(path30.join(outDir, "canvas.html"));
+    writeCanvas(path31.join(outDir, "canvas.html"));
     const exportModel = buildCanvasModel();
-    fs21.writeFileSync(path30.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
-    fs21.writeFileSync(path30.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
+    fs22.writeFileSync(path31.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
+    fs22.writeFileSync(path31.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
     const graph = loadSpecGraph();
-    const indexPath = path30.join(outDir, "README.md");
-    fs21.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
+    const indexPath = path31.join(outDir, "README.md");
+    fs22.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
       logger.info(`  ${file.relPath}`);
@@ -24472,26 +24668,26 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path30.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path31.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path30.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path31.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path30.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path31.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = generateComponentDiagram();
     title = "Component architecture";
-    defaultDest = path30.join(diagramsDir, "system.md");
+    defaultDest = path31.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
-  ensureDir(path30.dirname(path30.resolve(dest)));
+  ensureDir(path31.dirname(path31.resolve(dest)));
   const content = dest.endsWith(".mmd") ? `${mermaid}
 ` : toMarkdown({ relPath: dest, title, mermaid });
-  fs21.writeFileSync(dest, content, "utf-8");
+  fs22.writeFileSync(dest, content, "utf-8");
   logger.success(`Mermaid diagram written to ${dest}`);
   logger.info("Renders on GitHub/IDE previews; use a .mmd --out path for raw Mermaid.");
 }
@@ -24600,8 +24796,8 @@ Component variants (${variants.length})
 }
 
 // src/commands/packs.ts
-var fs22 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
+var fs23 = __toESM(require("fs"));
+var path32 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -24627,11 +24823,11 @@ function describe(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path31.resolve(source);
-  if (!fs22.existsSync(abs)) {
+  const abs = path32.resolve(source);
+  if (!fs23.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
-  const isDir = fs22.statSync(abs).isDirectory();
+  const isDir = fs23.statSync(abs).isDirectory();
   if (isDir && !packDirEntry(abs)) {
     throw new Error(`"${source}" is a directory without a pack entry file (pack.yaml | pack.cjs | index.cjs | ...).`);
   }
@@ -24647,7 +24843,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path31.dirname(abs), scope);
+  const probe2 = probePack(abs, path32.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -24655,10 +24851,10 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path31.join(destDir, path31.basename(abs));
-    if (path31.resolve(dest2) !== abs) {
-      fs22.mkdirSync(destDir, { recursive: true });
-      fs22.cpSync(abs, dest2, { recursive: true, force: true });
+    const dest2 = path32.join(destDir, path32.basename(abs));
+    if (path32.resolve(dest2) !== abs) {
+      fs23.mkdirSync(destDir, { recursive: true });
+      fs23.cpSync(abs, dest2, { recursive: true, force: true });
     }
     logger.success(`Installed pack "${probe2.name}" globally: ${dest2}`);
     logger.info(`${describe(probe2)} \u2014 auto-loaded for every project on this machine (WAIRON_PACKS_DIR / ~/.wairon/packs).`);
@@ -24671,11 +24867,11 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path31.basename(abs)}`;
-  const dest = path31.join(root, ".wai", "packs", path31.basename(abs));
-  if (path31.resolve(dest) !== abs) {
-    fs22.mkdirSync(path31.dirname(dest), { recursive: true });
-    fs22.cpSync(abs, dest, { recursive: true, force: true });
+  const relRef = `.wai/packs/${path32.basename(abs)}`;
+  const dest = path32.join(root, ".wai", "packs", path32.basename(abs));
+  if (path32.resolve(dest) !== abs) {
+    fs23.mkdirSync(path32.dirname(dest), { recursive: true });
+    fs23.cpSync(abs, dest, { recursive: true, force: true });
   }
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
@@ -24684,14 +24880,14 @@ async function addPack(source, options = {}) {
     saveProjectConfig(config);
     logger.success(`Vendored pack "${probe2.name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    fs22.cpSync(abs, dest, { recursive: true, force: true });
+    fs23.cpSync(abs, dest, { recursive: true, force: true });
     logger.success(`Pack "${probe2.name}" already registered \u2014 refreshed ${relRef} from the source.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path31.resolve(source);
-  if (!fs22.existsSync(abs) || !fs22.statSync(abs).isFile()) {
+  const abs = path32.resolve(source);
+  if (!fs23.existsSync(abs) || !fs23.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return;
@@ -24706,27 +24902,27 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path31.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path32.join(getProjectRoot(), ".wai", "packs");
   }
-  const bytes = fs22.readFileSync(abs);
-  fs22.mkdirSync(baseDir, { recursive: true });
-  const staging = fs22.mkdtempSync(path31.join(baseDir, ".wpack-staging-"));
+  const bytes = fs23.readFileSync(abs);
+  fs23.mkdirSync(baseDir, { recursive: true });
+  const staging = fs23.mkdtempSync(path32.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
-    fs22.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path31.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    fs23.rmSync(staging, { recursive: true, force: true });
+    logger.error(`Failed to extract pack archive "${path32.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path31.join(baseDir, name);
-  if (fs22.existsSync(destDir)) fs22.rmSync(destDir, { recursive: true, force: true });
-  fs22.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path31.dirname(destDir), scope);
+  const destDir = path32.join(baseDir, name);
+  if (fs23.existsSync(destDir)) fs23.rmSync(destDir, { recursive: true, force: true });
+  fs23.renameSync(staging, destDir);
+  const probe2 = probePack(destDir, path32.dirname(destDir), scope);
   if (probe2.error) {
-    fs22.rmSync(destDir, { recursive: true, force: true });
+    fs23.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
     process.exitCode = 1;
     return;
@@ -24744,7 +24940,7 @@ async function addPackFromArchive(source, options) {
     saveProjectConfig(config);
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path31.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path32.basename(abs)}.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -24765,7 +24961,7 @@ async function buildPack(source, options = {}) {
   const sourceDir = source && source.length > 0 ? source : ".";
   const result = (0, import_sdk.buildPack)(sourceDir);
   const outPath = options.out ?? result.suggestedFileName;
-  fs22.writeFileSync(outPath, result.archive);
+  fs23.writeFileSync(outPath, result.archive);
   logger.success(`Built pack "${result.info.name}" v${result.info.version} \u2192 ${outPath} (${result.archive.byteLength} bytes)`);
   logger.info(`Install it with \`wairon pack add ${outPath}\`, or upload it to a hosted instance.`);
 }
@@ -24779,9 +24975,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path31.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path31.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path31.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
+    const probe2 = probePack(ref, path32.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path32.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path32.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -24802,9 +24998,9 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path31.dirname(ref), "global");
-      if (probe2.name === name || path31.basename(ref) === name) {
-        fs22.rmSync(ref, { recursive: true, force: true });
+      const probe2 = probePack(ref, path32.dirname(ref), "global");
+      if (probe2.name === name || path32.basename(ref) === name) {
+        fs23.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
       }
@@ -24823,16 +25019,16 @@ async function removePack(name, options = {}) {
   const packs = config.extensions?.packs ?? [];
   for (const ref of packs) {
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path31.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path32.basename(ref) === name) {
       config.extensions = {
         packs: packs.filter((p) => p !== ref),
         useGlobalPacks: config.extensions?.useGlobalPacks ?? true
       };
       saveProjectConfig(config);
-      const resolved = path31.resolve(root, ref);
-      const vendorDir = path31.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path31.sep)) {
-        fs22.rmSync(resolved, { recursive: true, force: true });
+      const resolved = path32.resolve(root, ref);
+      const vendorDir = path32.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path32.sep)) {
+        fs23.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
         logger.success(`Deregistered pack "${probe2.name ?? name}" (files at ${ref} left in place).`);
@@ -24846,8 +25042,8 @@ async function removePack(name, options = {}) {
 
 // src/commands/host.ts
 var fs50 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
-var os9 = __toESM(require("os"));
+var path59 = __toESM(require("path"));
+var os10 = __toESM(require("os"));
 var crypto20 = __toESM(require("crypto"));
 var import_child_process5 = require("child_process");
 var import_chalk17 = __toESM(require("chalk"));
@@ -24874,29 +25070,29 @@ var UNAUTHENTICATED = {
 var WEB_SESSION_PREFIX = "ws_";
 
 // src/server/credentials.ts
-var fs23 = __toESM(require("fs"));
-var path32 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var path33 = __toESM(require("path"));
 var crypto3 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
   return crypto3.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path32.join(dataDir, "auth", "credentials.json");
+  return path33.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
-    return JSON.parse(fs23.readFileSync(storePath(dataDir), "utf8"));
+    return JSON.parse(fs24.readFileSync(storePath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs23.mkdirSync(path32.dirname(p), { recursive: true });
+  fs24.mkdirSync(path33.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs23.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs23.renameSync(tmp, p);
+  fs24.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs24.renameSync(tmp, p);
 }
 function digestEquals(a, b) {
   const ab = Buffer.from(a, "hex");
@@ -24941,17 +25137,17 @@ function listByOwner(dataDir, ownerUserId) {
 }
 
 // src/server/websessions.ts
-var fs24 = __toESM(require("fs"));
-var path33 = __toESM(require("path"));
+var fs25 = __toESM(require("fs"));
+var path34 = __toESM(require("path"));
 var crypto4 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path33.join(dataDir, "web-sessions.json");
+  return path34.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
   let raw;
   try {
-    raw = fs24.readFileSync(p, "utf8");
+    raw = fs25.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read web session store at ${p}: ${e.message}`);
@@ -24966,10 +25162,10 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs24.mkdirSync(path33.dirname(p), { recursive: true });
+  fs25.mkdirSync(path34.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs24.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
-  fs24.renameSync(tmp, p);
+  fs25.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
+  fs25.renameSync(tmp, p);
 }
 function mintSessionId() {
   return `${WEB_SESSION_PREFIX}${crypto4.randomBytes(24).toString("hex")}`;
@@ -25130,17 +25326,17 @@ function listWebSessionsBySubject(dataDir, userId) {
 }
 
 // src/server/users.ts
-var fs25 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var fs26 = __toESM(require("fs"));
+var path35 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path34.join(dataDir, "users.json");
+  return path35.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
   let raw;
   try {
-    raw = fs25.readFileSync(p, "utf8");
+    raw = fs26.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read hosted-user store at ${p}: ${err.message}`);
@@ -25158,10 +25354,10 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs25.mkdirSync(path34.dirname(p), { recursive: true });
+  fs26.mkdirSync(path35.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs25.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs25.renameSync(tmp, p);
+  fs26.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs26.renameSync(tmp, p);
 }
 function registryUpsert(dataDir, record2) {
   const records = loadStore(dataDir);
@@ -25263,11 +25459,11 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 }
 
 // src/server/instance.ts
-var fs26 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs27 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 var import_crypto = require("crypto");
 function storePath4(dataDir) {
-  return path35.join(dataDir, "instance.json");
+  return path36.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -25284,7 +25480,7 @@ var InstanceIdentityStore = class {
     const p = storePath4(this.dataDir);
     let raw;
     try {
-      raw = fs26.readFileSync(p, "utf8");
+      raw = fs27.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read instance identity at ${p}: ${err.message}`);
@@ -25307,10 +25503,10 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs26.mkdirSync(path35.dirname(p), { recursive: true });
+    fs27.mkdirSync(path36.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs26.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
-    fs26.renameSync(tmp, p);
+    fs27.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
+    fs27.renameSync(tmp, p);
   }
 };
 var InstanceIdentityRegistry = class {
@@ -25366,8 +25562,8 @@ function getInstanceIdentity(dataDir) {
 }
 
 // src/utils/secrets.ts
-var fs27 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -25376,13 +25572,13 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path36.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path37.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
   if (!p) return {};
   try {
-    return JSON.parse(fs27.readFileSync(p, "utf8"));
+    return JSON.parse(fs28.readFileSync(p, "utf8"));
   } catch {
     return {};
   }
@@ -25407,10 +25603,10 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs27.mkdirSync(path36.dirname(p), { recursive: true });
+  fs28.mkdirSync(path37.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs27.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  fs27.renameSync(tmp, p);
+  fs28.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
+  fs28.renameSync(tmp, p);
 }
 function listSecretKeys() {
   return Object.keys(readStore());
@@ -25618,17 +25814,17 @@ function verifySsoState(state) {
 }
 
 // src/server/organization.ts
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 var crypto6 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path37.join(dataDir, "organization.json");
+  return path38.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
   let raw;
   try {
-    raw = fs28.readFileSync(p, "utf8");
+    raw = fs29.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return { units: [], placements: [] };
     throw new Error(`Failed to read organization store at ${p}: ${e.message}`);
@@ -25645,10 +25841,10 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs28.mkdirSync(path37.dirname(p), { recursive: true });
+  fs29.mkdirSync(path38.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs28.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
-  fs28.renameSync(tmp, p);
+  fs29.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs29.renameSync(tmp, p);
 }
 var SLUG_PATTERN = /^[a-z0-9-]+$/;
 var UNIT_KINDS = ["business_entity", "department", "team", "group"];
@@ -26017,11 +26213,11 @@ function getOrganizationUnit(dataDir, id) {
 }
 
 // src/server/permissions.ts
-var fs29 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs30 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath7(dataDir) {
-  return path38.join(dataDir, "permissions.json");
+  return path39.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -26030,7 +26226,7 @@ function load4(dataDir) {
   const p = storePath7(dataDir);
   let raw;
   try {
-    raw = fs29.readFileSync(p, "utf8");
+    raw = fs30.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read permission store at ${p}: ${err.message}`);
@@ -26048,10 +26244,10 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs29.mkdirSync(path38.dirname(p), { recursive: true });
+  fs30.mkdirSync(path39.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs29.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
-  fs29.renameSync(tmp, p);
+  fs30.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
+  fs30.renameSync(tmp, p);
 }
 function registrySet(dataDir, assignment) {
   const assignments = load4(dataDir);
@@ -26137,8 +26333,8 @@ function getAssignment(dataDir, assignmentId) {
 }
 
 // src/server/roles.ts
-var fs30 = __toESM(require("fs"));
-var path39 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path40 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -26156,13 +26352,13 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path39.join(dataDir, "roles.json");
+  return path40.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
   let raw;
   try {
-    raw = fs30.readFileSync(p, "utf8");
+    raw = fs31.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read role store at ${p}: ${err.message}`);
@@ -26180,10 +26376,10 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs30.mkdirSync(path39.dirname(p), { recursive: true });
+  fs31.mkdirSync(path40.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs30.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
-  fs30.renameSync(tmp, p);
+  fs31.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
+  fs31.renameSync(tmp, p);
 }
 function registryCreate(dataDir, role) {
   if (isBuiltinRoleId(role.id)) {
@@ -26417,131 +26613,14 @@ function actionableUnitIds(scopes) {
 }
 
 // src/server/projects.ts
-var fs31 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
-var ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
-function isValidProjectId(id) {
-  return typeof id === "string" && ID_RE.test(id);
-}
-function registryPath(dataDir) {
-  return path40.join(dataDir, "projects.json");
-}
-function load6(dataDir) {
-  try {
-    return JSON.parse(fs31.readFileSync(registryPath(dataDir), "utf8"));
-  } catch {
-    return [];
-  }
-}
-function save2(dataDir, records) {
-  const p = registryPath(dataDir);
-  fs31.mkdirSync(path40.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs31.renameSync(tmp, p);
-}
-function projectRoot(dataDir, id) {
-  return path40.join(dataDir, "projects", id);
-}
-function existingProjectRoot(dataDir, id) {
-  if (!isValidProjectId(id)) return null;
-  const rec = load6(dataDir).find((r) => r.id === id);
-  return rec ? rec.rootPath : null;
-}
-function createProjectRecord(dataDir, id) {
-  if (!isValidProjectId(id)) {
-    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
-  }
-  const records = load6(dataDir);
-  if (records.some((r) => r.id === id)) {
-    throw new Error(`Project "${id}" already exists.`);
-  }
-  const root = projectRoot(dataDir, id);
-  fs31.mkdirSync(root, { recursive: true });
-  const record2 = {
-    id,
-    rootPath: root,
-    status: "active",
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  records.push(record2);
-  save2(dataDir, records);
-  return record2;
-}
-function registerLocalDevProject(dataDir, id, rootPath) {
-  if (!isValidProjectId(id)) {
-    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
-  }
-  const records = load6(dataDir);
-  const existing = records.find((r) => r.id === id);
-  const record2 = {
-    id,
-    rootPath,
-    status: "active",
-    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const next = existing ? records.map((r) => r.id === id ? record2 : r) : [...records, record2];
-  save2(dataDir, next);
-  return record2;
-}
-function listProjectRecords(dataDir) {
-  return load6(dataDir);
-}
-function removeProjectRecord(dataDir, id) {
-  const records = load6(dataDir);
-  const rec = records.find((r) => r.id === id);
-  if (rec) {
-    try {
-      fs31.rmSync(rec.rootPath, { recursive: true, force: true });
-    } catch {
-    }
-  }
-  save2(dataDir, records.filter((r) => r.id !== id));
-}
-function resolveProjectRoot(dataDir, principal, selector) {
-  const authorized = principal.projects;
-  const wildcard = authorized.includes("*");
-  let target;
-  if (selector) {
-    if (!wildcard && !authorized.includes(selector)) return null;
-    target = selector;
-  } else if (!wildcard && authorized.length === 1) {
-    target = authorized[0];
-  } else {
-    return null;
-  }
-  if (!isValidProjectId(target)) return null;
-  const rec = load6(dataDir).find((r) => r.id === target);
-  if (!rec || rec.status !== "active") return null;
-  return rec.rootPath;
-}
-
-// src/server/adapters.ts
-init_statehash();
-
-// src/core/lockfile.ts
-var fs32 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
+init_loader();
+init_yaml();
 init_fs();
-function lockPath() {
-  return aiDir("lock.json");
-}
-function readLockRecord() {
-  try {
-    return JSON.parse(fs32.readFileSync(lockPath(), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeLockRecord(record2) {
-  const p = lockPath();
-  fs32.mkdirSync(path41.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp`;
-  fs32.writeFileSync(tmp, JSON.stringify(record2, null, 2) + "\n");
-  fs32.renameSync(tmp, p);
-}
 
 // src/server/adapters.ts
+init_statehash();
 init_specs2();
 init_provision();
 init_validation();
@@ -26552,37 +26631,37 @@ init_types();
 init_server();
 
 // src/git/config.ts
-var fs33 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var fs32 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
 }
 function readGitConfig() {
   try {
-    return JSON.parse(fs33.readFileSync(configPath(), "utf8"));
+    return JSON.parse(fs32.readFileSync(configPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs33.mkdirSync(path42.dirname(p), { recursive: true });
+  fs32.mkdirSync(path41.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs33.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
-  fs33.renameSync(tmp, p);
+  fs32.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+  fs32.renameSync(tmp, p);
 }
 function clearGitConfig() {
   try {
-    fs33.rmSync(configPath(), { force: true });
+    fs32.rmSync(configPath(), { force: true });
   } catch {
   }
 }
 
 // src/git/adapter.ts
 var import_child_process3 = require("child_process");
-var fs34 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path42 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
   return (0, import_child_process3.execFileSync)("git", args, {
@@ -26634,10 +26713,10 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path43.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path42.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs34.mkdirSync(path43.dirname(excludePath), { recursive: true });
-    fs34.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
+    fs33.mkdirSync(path42.dirname(excludePath), { recursive: true });
+    fs33.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
   } catch {
   }
 }
@@ -26702,39 +26781,39 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 }
 
 // src/producers/config.ts
-var fs35 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
 }
-function load7() {
+function load6() {
   try {
-    return JSON.parse(fs35.readFileSync(configPath2(), "utf8"));
+    return JSON.parse(fs34.readFileSync(configPath2(), "utf8"));
   } catch {
     return [];
   }
 }
-function save3(configs) {
+function save2(configs) {
   const p = configPath2();
-  fs35.mkdirSync(path44.dirname(p), { recursive: true });
+  fs34.mkdirSync(path43.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs35.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
-  fs35.renameSync(tmp, p);
+  fs34.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
+  fs34.renameSync(tmp, p);
 }
 function readProducerConfig(target) {
-  return load7().find((c) => c.target === target) ?? null;
+  return load6().find((c) => c.target === target) ?? null;
 }
 function writeProducerConfig(config) {
-  const configs = load7().filter((c) => c.target !== config.target);
+  const configs = load6().filter((c) => c.target !== config.target);
   configs.push(config);
-  save3(configs);
+  save2(configs);
 }
 function clearProducerConfig(target) {
-  save3(load7().filter((c) => c.target !== target));
+  save2(load6().filter((c) => c.target !== target));
 }
 function listProducerConfigs() {
-  return load7();
+  return load6();
 }
 
 // src/producers/core-adapter.ts
@@ -27073,8 +27152,19 @@ var hostCore = {
   /** The ids of wairon's built-in architectural profiles, read from the core rules
    *  registry's built-in profile set (BUILTIN_PROFILES) — a pure, side-effect-free
    *  read of a bundled constant. */
-  builtinProfileIds: () => [...BUILTIN_PROFILES]
+  builtinProfileIds: () => [...BUILTIN_PROFILES],
+  /** The ids of wairon's built-in COMPOSITE PROJECT KINDS, read from the core
+   *  rules registry's bundled constant (PROJECT_KINDS) — a pure, side-effect-free
+   *  read. The counterpart of builtinProfileIds: legal projectType values that
+   *  are not architectural profiles and carry no profile doctrine of their own,
+   *  so the hosted profile-application path recognizes a project kind as
+   *  resolvable-as-is (no contributing pack to adopt) instead of refusing it as
+   *  an unknown profile. */
+  builtinProjectKinds: () => [...PROJECT_KINDS]
 };
+function resolveContainedProjectPath(projectRoot2, projectPath) {
+  return assertContainedProjectPath(projectRoot2, projectPath);
+}
 function validateProjectAsComplete() {
   const config = loadProjectConfig();
   return validateAsComplete({ rules: config.rules, projectType: config.projectType });
@@ -27106,6 +27196,180 @@ var hostSdk = {
   extractArchive: (archive, destDir, limits) => sdkPortal.extractPack(archive, destDir, limits)
 };
 
+// src/server/projects.ts
+var ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function isValidProjectId(id) {
+  return typeof id === "string" && ID_RE.test(id);
+}
+function registryPath(dataDir) {
+  return path44.join(dataDir, "projects.json");
+}
+function load7(dataDir) {
+  try {
+    return JSON.parse(fs35.readFileSync(registryPath(dataDir), "utf8"));
+  } catch {
+    return [];
+  }
+}
+function save3(dataDir, records) {
+  const p = registryPath(dataDir);
+  fs35.mkdirSync(path44.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs35.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs35.renameSync(tmp, p);
+}
+function projectRoot(dataDir, id) {
+  return path44.join(dataDir, "projects", id);
+}
+function existingProjectRoot(dataDir, id) {
+  if (!isValidProjectId(id)) return null;
+  const rec = load7(dataDir).find((r) => r.id === id);
+  return rec ? rec.rootPath : null;
+}
+function createProjectRecord(dataDir, id) {
+  if (!isValidProjectId(id)) {
+    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
+  }
+  const records = load7(dataDir);
+  if (records.some((r) => r.id === id)) {
+    throw new Error(`Project "${id}" already exists.`);
+  }
+  const root = projectRoot(dataDir, id);
+  fs35.mkdirSync(root, { recursive: true });
+  const record2 = {
+    id,
+    rootPath: root,
+    status: "active",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  records.push(record2);
+  save3(dataDir, records);
+  return record2;
+}
+function registerLocalDevProject(dataDir, id, rootPath) {
+  if (!isValidProjectId(id)) {
+    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
+  }
+  const records = load7(dataDir);
+  const existing = records.find((r) => r.id === id);
+  const record2 = {
+    id,
+    rootPath,
+    status: "active",
+    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const next = existing ? records.map((r) => r.id === id ? record2 : r) : [...records, record2];
+  save3(dataDir, next);
+  return record2;
+}
+function listProjectRecords(dataDir) {
+  return load7(dataDir);
+}
+function removeProjectRecord(dataDir, id) {
+  const records = load7(dataDir);
+  const rec = records.find((r) => r.id === id);
+  if (rec) {
+    try {
+      fs35.rmSync(rec.rootPath, { recursive: true, force: true });
+    } catch {
+    }
+  }
+  save3(dataDir, records.filter((r) => r.id !== id));
+}
+var SUBPROJECT_SEPARATOR = "::";
+function parseQualifiedSelector(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  const [projectId, ...mounts] = value.split(SUBPROJECT_SEPARATOR);
+  if (!isValidProjectId(projectId)) return null;
+  if (mounts.some((m) => m.trim() === "")) return null;
+  return { projectId, mounts };
+}
+function findSubsystemSpec(root, subsystemId) {
+  const specsDir = aiPathsAt(root).specsDir();
+  if (!fs35.existsSync(specsDir)) return null;
+  for (const file of listFilesRecursive(specsDir, ".yaml")) {
+    let raw;
+    try {
+      raw = readYamlFile(file);
+    } catch {
+      continue;
+    }
+    if (!raw || typeof raw !== "object" || !("parentSystem" in raw)) continue;
+    if (raw.id !== subsystemId) continue;
+    const pp = raw.projectPath;
+    return typeof pp === "string" && pp.trim() !== "" ? { projectPath: pp } : {};
+  }
+  return null;
+}
+function resolveSubprojectMounts(projectId, projectRoot2, mounts) {
+  let root = projectRoot2;
+  let at = projectId;
+  for (const mount of mounts) {
+    const sub = findSubsystemSpec(root, mount);
+    if (!sub) {
+      throw new Error(
+        `unknown subproject mount "${mount}" on "${at}" \u2014 no subsystem with that id exists in its spec tree`
+      );
+    }
+    if (!sub.projectPath) {
+      throw new Error(
+        `subsystem "${mount}" on "${at}" is not a chained subproject (it carries no projectPath) \u2014 only a subsystem mounted via projectPath can be bound as a subproject`
+      );
+    }
+    root = resolveContainedProjectPath(root, sub.projectPath);
+    at = `${at}${SUBPROJECT_SEPARATOR}${mount}`;
+  }
+  return root;
+}
+function assertMintableNarrowingEntry(dataDir, entry) {
+  if (entry === "*") return;
+  const parsed = parseQualifiedSelector(entry);
+  if (!parsed) {
+    throw new Error(
+      `invalid project narrowing entry "${entry}" (expected a project id, optionally subproject-qualified as projectId::subsystemId)`
+    );
+  }
+  const rec = load7(dataDir).find((r) => r.id === parsed.projectId);
+  if (!rec) throw new Error(`unknown project "${parsed.projectId}"`);
+  if (parsed.mounts.length > 0) {
+    resolveSubprojectMounts(parsed.projectId, rec.rootPath, parsed.mounts);
+  }
+}
+function narrowingCovers(entry, target) {
+  return target === entry || target.startsWith(entry + SUBPROJECT_SEPARATOR);
+}
+function resolveProjectBinding(dataDir, principal, selector) {
+  const authorized = principal.projects;
+  const wildcard = authorized.includes("*");
+  let target;
+  if (selector) {
+    if (!wildcard && !authorized.some((e) => e !== "*" && narrowingCovers(e, selector))) return null;
+    target = selector;
+  } else if (!wildcard && authorized.length === 1) {
+    target = authorized[0];
+  } else {
+    return null;
+  }
+  const parsed = parseQualifiedSelector(target);
+  if (!parsed) return null;
+  const rec = load7(dataDir).find((r) => r.id === parsed.projectId);
+  if (!rec || rec.status !== "active") return null;
+  let rootPath = rec.rootPath;
+  if (parsed.mounts.length > 0) {
+    try {
+      rootPath = resolveSubprojectMounts(parsed.projectId, rec.rootPath, parsed.mounts);
+    } catch {
+      return null;
+    }
+  }
+  const binding = { rootPath, projectId: parsed.projectId };
+  if (parsed.mounts.length > 0) binding.subproject = parsed.mounts.join(SUBPROJECT_SEPARATOR);
+  return binding;
+}
+function resolveProjectRoot(dataDir, principal, selector) {
+  return resolveProjectBinding(dataDir, principal, selector)?.rootPath ?? null;
+}
+
 // src/server/errors.ts
 var UnauthenticatedError = class extends Error {
   constructor() {
@@ -27517,6 +27781,35 @@ function storeListGlobalPacks() {
   );
   return [...instance, ...image];
 }
+function scanGlobalPackProfiles() {
+  const out = [];
+  for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
+    for (const full of hostCore.discoverPacks(dir)) {
+      try {
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
+        if (loaded.errors.length) continue;
+        const source = loaded.packNames[0] ?? path45.basename(full);
+        for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function scanProjectPackProfiles() {
+  const root = getProjectRoot();
+  const out = [];
+  for (const ref of loadProjectConfig().extensions?.packs ?? []) {
+    try {
+      const loaded = hostCore.loadExtensionPacks([{ ref, scope: "project" }], root);
+      if (loaded.errors.length) continue;
+      const source = loaded.packNames[0] ?? stem(ref);
+      for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+    } catch {
+    }
+  }
+  return out;
+}
 function storeListAvailableProfiles() {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -27527,19 +27820,21 @@ function storeListAvailableProfiles() {
     out.push(family ? { id, source, family } : { id, source });
   };
   for (const id of hostCore.builtinProfileIds()) emit(id, "builtin");
-  const scanTier = (dir) => {
-    for (const full of hostCore.discoverPacks(dir)) {
-      try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
-        if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path45.basename(full);
-        for (const [id, def] of Object.entries(loaded.profiles)) emit(id, source, def.family);
-      } catch {
-      }
-    }
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, c.family);
+  return out;
+}
+function storeListProjectProfiles() {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const emit = (id, source, installed, family) => {
+    const key = JSON.stringify([id, source]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ id, source, ...family ? { family } : {}, installed });
   };
-  scanTier(hostCore.globalPacksDir());
-  scanTier(imagePacksDir());
+  for (const id of hostCore.builtinProfileIds()) emit(id, "builtin", true);
+  for (const c of scanProjectPackProfiles()) emit(c.id, c.source, true, c.family);
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, false, c.family);
   return out;
 }
 function readPackContent(full) {
@@ -27732,6 +28027,10 @@ function listAvailableProfiles(cfg, credential) {
   requirePrincipal2(cfg, credential);
   return storeListAvailableProfiles();
 }
+function listProjectProfiles(cfg, credential, project2) {
+  requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing a project's selectable profiles requires project:read over the project");
+  return executeApprovedListProjectProfiles(cfg, project2);
+}
 function listAdoptableProjectPacks(cfg, credential, project2) {
   requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing adoptable packs requires project:read over the project");
   return storeListGlobalPacks();
@@ -27754,6 +28053,26 @@ function executeApprovedInstallProjectPack(cfg, project2, name, content) {
 function executeApprovedResolveGlobalPacks(names) {
   return storeResolveGlobalPacks(names);
 }
+function executeApprovedListProjectProfiles(cfg, project2) {
+  return runWithProjectRoot(boundProject2(cfg, project2), () => storeListProjectProfiles());
+}
+function executeApprovedEnsureProfileInstalled(cfg, project2, profileId) {
+  if (hostCore.builtinProjectKinds().includes(profileId) || hostCore.builtinProfileIds().includes(profileId)) {
+    return { profileId, source: "builtin" };
+  }
+  const contributors = executeApprovedListProjectProfiles(cfg, project2).filter((p) => p.id === profileId);
+  const installed = contributors.find((p) => p.installed);
+  if (installed) return { profileId, source: installed.source };
+  const adoptable = contributors[0];
+  const resolved = adoptable ? executeApprovedResolveGlobalPacks([adoptable.source]).resolved[0] : void 0;
+  if (!resolved) {
+    throw new Error(
+      `Unknown profile "${profileId}" \u2014 no built-in profile or project kind carries it, no pack registered in project "${project2}" contributes it, and no server-global pack (mutable instance tier or immutable image tier) contributes it. Writing an unresolvable id as the projectType would silently disable the whole profile doctrine (UNKNOWN_PROFILE), so it is refused instead of applied.`
+    );
+  }
+  executeApprovedInstallProjectPack(cfg, project2, resolved.name, resolved.content);
+  return { profileId, source: resolved.name, adoptedPackName: resolved.name };
+}
 function removeProjectPack(cfg, credential, project2, name) {
   requireCap(cfg, credential, "project:admin", "project", project2, "Forbidden \u2014 removing a project pack requires project:admin over the project");
   runWithProjectRoot(boundProject2(cfg, project2), () => storeRemoveProjectPack(name));
@@ -28748,6 +29067,40 @@ function requestPackNames(request) {
   if (!sel) return [];
   return [.../* @__PURE__ */ new Set([...sel.requiredPackNames ?? [], ...sel.defaultPackNames ?? []])];
 }
+function classifyProfile(projectType, catalog) {
+  if (hostCore.builtinProfileIds().includes(projectType) || hostCore.builtinProjectKinds().includes(projectType)) {
+    return { source: "builtin", resolvable: true };
+  }
+  const installed = catalog.find((p) => p.id === projectType && p.installed);
+  if (installed) return { source: installed.source, resolvable: true };
+  return { resolvable: false };
+}
+function firstApplicableProfileId(candidates, catalog) {
+  const kinds = hostCore.builtinProjectKinds();
+  const catalogIds = new Set(catalog.map((p) => p.id));
+  return candidates.find((id) => kinds.includes(id) || catalogIds.has(id));
+}
+function unappliedIds(selectedProfileIds, governingProfileId) {
+  return selectedProfileIds.filter((id) => id !== governingProfileId);
+}
+function foldAppliedProfile(root, profileId, actor) {
+  const recorded = readProjectProfileSelection(root);
+  const folded = {
+    profileIds: [profileId, ...unappliedIds(recorded?.profileIds ?? [], profileId)],
+    requiredPackNames: recorded?.requiredPackNames ?? [],
+    selectedBy: actor,
+    selectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (recorded?.defaultPackNames) folded.defaultPackNames = recorded.defaultPackNames;
+  recordProjectProfileSelection(root, folded);
+  return folded;
+}
+function overridingSubsystemIds(root) {
+  return runWithProjectRoot(
+    root,
+    () => hostCore.loadSubsystemSpecs().filter((s) => !!s.profile).map((s) => s.id)
+  );
+}
 function resolvedSelection(request, policy, selectedBy) {
   const sel = request.profileSelection;
   const selection = {
@@ -28766,7 +29119,8 @@ function buildEvaluation(input) {
     selectedProfileIds,
     hasSelection,
     countMissingPacksAsViolation,
-    requiredDefaultResolution
+    requiredDefaultResolution,
+    governingProfileId
   } = input;
   const present = new Set(presentPackNames);
   let missingPackNames;
@@ -28787,6 +29141,7 @@ function buildEvaluation(input) {
   const allowed = policy.allowedProfileIds;
   const disallowedProfileIds = allowed && allowed.length > 0 ? selectedProfileIds.filter((id) => !allowed.includes(id)) : [];
   const selectionRequiredUnmet = policy.requireProfileSelection && !hasSelection;
+  const unappliedProfileIds = governingProfileId ? unappliedIds(selectedProfileIds, governingProfileId) : [];
   const messages = [];
   if (selectionRequiredUnmet) {
     messages.push("Profile selection is required by policy but none was provided.");
@@ -28798,16 +29153,24 @@ function buildEvaluation(input) {
   for (const n of blockedPackNames) messages.push(`Pack "${n}" is blocked by policy.`);
   for (const id of missingProfileIds) messages.push(`Required profile "${id}" is not selected.`);
   for (const id of disallowedProfileIds) messages.push(`Profile "${id}" is not permitted by policy.`);
+  for (const id of unappliedProfileIds) {
+    messages.push(
+      `Selected profile "${id}" is recorded but does not govern the project (projectType is "${governingProfileId}") \u2014 a project has exactly one governing profile.`
+    );
+  }
   const violation = selectionRequiredUnmet || blockedPackNames.length > 0 || missingProfileIds.length > 0 || disallowedProfileIds.length > 0 || countMissingPacksAsViolation && (missingPackNames.length > 0 || unresolvedPacks.length > 0);
-  return {
+  const result = {
     compliant: !violation,
     mode: policy.enforcementMode,
     missingPackNames,
     blockedPackNames,
     missingProfileIds,
     unresolvedPacks,
+    unappliedProfileIds,
     messages
   };
+  if (governingProfileId) result.governingProfileId = governingProfileId;
+  return result;
 }
 function performInit(cfg, request, principal) {
   const policy = effectivePolicy(cfg.dataDir);
@@ -28827,17 +29190,24 @@ function performInit(cfg, request, principal) {
     request.ownerUnitId,
     principal ? principalSubject3(principal) : void 0
   );
-  installResolvedPacks(
-    cfg,
-    record2.id,
-    executeApprovedResolveGlobalPacks([
-      ...policy.requiredGlobalPacks,
-      ...policy.defaultProjectPacks,
-      ...requestPackNames(request)
-    ])
-  );
+  const packResolution = executeApprovedResolveGlobalPacks([
+    ...policy.requiredGlobalPacks,
+    ...policy.defaultProjectPacks,
+    ...requestPackNames(request)
+  ]);
+  installResolvedPacks(cfg, record2.id, packResolution);
   const selectedBy = principal ? principalSubject3(principal) : void 0;
-  recordProjectProfileSelection(record2.rootPath, resolvedSelection(request, policy, selectedBy));
+  const selection = resolvedSelection(request, policy, selectedBy);
+  recordProjectProfileSelection(record2.rootPath, selection);
+  const catalog = executeApprovedListProjectProfiles(cfg, record2.id);
+  const appliedProfileId = firstApplicableProfileId(selection.profileIds, catalog);
+  let appliedSource;
+  if (appliedProfileId) {
+    const application = executeApprovedEnsureProfileInstalled(cfg, record2.id, appliedProfileId);
+    writeProjectType(record2.rootPath, application.profileId);
+    appliedSource = application.source;
+  }
+  const unapplied = appliedProfileId ? unappliedIds(selection.profileIds, appliedProfileId) : [...selection.profileIds];
   const actor = principal ? principalSubject3(principal) : SYSTEM_SUBJECT;
   tryAppendAudit2(
     cfg,
@@ -28846,7 +29216,18 @@ function performInit(cfg, request, principal) {
       "project.init.policy",
       "info",
       "project",
-      { target: record2.id, projectId: record2.id },
+      {
+        target: record2.id,
+        projectId: record2.id,
+        metadata: JSON.stringify({
+          ...appliedProfileId ? { appliedProfileId, profileSource: appliedSource } : {
+            appliedProfileId: null,
+            profileNotApplied: selection.profileIds.length === 0 ? "no profile was selected \u2014 the default projectType stands" : "no selected profile is resolvable on this instance \u2014 the default projectType stands"
+          },
+          ...unapplied.length > 0 ? { unappliedProfileIds: unapplied } : {},
+          ...packResolution.unresolved.length > 0 ? { unresolvedPacks: packResolution.unresolved } : {}
+        })
+      },
       principal?.tokenId
     )
   );
@@ -28887,6 +29268,7 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const policy = effectivePolicy(cfg.dataDir);
+  const governingProfileId = readProjectType(root);
   const selection = readProjectProfileSelection(root);
   return buildEvaluation({
     policy,
@@ -28894,7 +29276,8 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
     selectedProfileIds: selection?.profileIds ?? [],
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy))
+    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy)),
+    governingProfileId
   });
 }
 function reconcileProjectPolicy(cfg, credential, projectId) {
@@ -28909,20 +29292,41 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
   const policy = effectivePolicy(cfg.dataDir);
   const selection = readProjectProfileSelection(root);
   const resolution = executeApprovedResolveGlobalPacks(requiredDefaultNames(policy));
-  let installed = installedPackNames(cfg, projectId);
-  const installedSet = new Set(installed);
+  const installedSet = new Set(installedPackNames(cfg, projectId));
   const toApply = resolution.resolved.filter((p) => !installedSet.has(p.name));
+  const appliedPackNames = toApply.map((p) => p.name);
   if (toApply.length > 0) {
     installResolvedPacks(cfg, projectId, { resolved: toApply, unresolved: [] });
-    installed = installedPackNames(cfg, projectId);
+  }
+  const catalog = executeApprovedListProjectProfiles(cfg, projectId);
+  const previousProfileId = readProjectType(root);
+  let governingProfileId = previousProfileId;
+  const requiredProfileIds = policy.requiredProfileIds ?? [];
+  const policyUnsatisfied = requiredProfileIds.length > 0 && !requiredProfileIds.includes(governingProfileId);
+  const governingUnresolvable = !classifyProfile(governingProfileId, catalog).resolvable;
+  let repairedProfileId;
+  let selectedProfileIds = selection?.profileIds ?? [];
+  if (policyUnsatisfied || governingUnresolvable) {
+    const target = firstApplicableProfileId(
+      [...requiredProfileIds, ...selection?.profileIds ?? []],
+      catalog
+    );
+    if (target) {
+      const application = executeApprovedEnsureProfileInstalled(cfg, projectId, target);
+      writeProjectType(root, application.profileId);
+      governingProfileId = application.profileId;
+      repairedProfileId = application.profileId;
+      selectedProfileIds = foldAppliedProfile(root, application.profileId, principalSubject3(principal)).profileIds;
+    }
   }
   const result = buildEvaluation({
     policy,
-    presentPackNames: installed,
-    selectedProfileIds: selection?.profileIds ?? [],
+    presentPackNames: installedPackNames(cfg, projectId),
+    selectedProfileIds,
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: resolution
+    requiredDefaultResolution: resolution,
+    governingProfileId
   });
   tryAppendAudit2(
     cfg,
@@ -28931,7 +29335,15 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
       "policy.reconcile",
       "info",
       "policy",
-      { target: projectId, projectId },
+      {
+        target: projectId,
+        projectId,
+        metadata: JSON.stringify({
+          ...appliedPackNames.length > 0 ? { appliedPackNames } : {},
+          ...repairedProfileId ? { repairedProfileId, previousProfileId } : {},
+          ...resolution.unresolved.length > 0 ? { unresolvedPacks: resolution.unresolved } : {}
+        })
+      },
       principal.tokenId
     )
   );
@@ -28947,8 +29359,19 @@ function getProjectConfig(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const projectType = readProjectType(root);
+  const selection = readProjectProfileSelection(root);
+  const classified = classifyProfile(projectType, executeApprovedListProjectProfiles(cfg, projectId));
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType,
+    locked,
+    profileResolvable: classified.resolvable,
+    unappliedProfileIds: unappliedIds(selection?.profileIds ?? [], projectType),
+    overridingSubsystemIds: overriding
+  };
+  if (classified.source) view.profileSource = classified.source;
+  return view;
 }
 function setProjectType(cfg, credential, projectId, projectType) {
   const principal = requirePrincipal4(cfg, credential);
@@ -28959,9 +29382,23 @@ function setProjectType(cfg, credential, projectId, projectType) {
   }
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
-  writeProjectType(root, projectType);
+  const application = executeApprovedEnsureProfileInstalled(cfg, projectId, projectType);
+  writeProjectType(root, application.profileId);
+  const folded = foldAppliedProfile(root, application.profileId, principalSubject3(principal));
+  const remainder = folded.profileIds.slice(1);
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType: application.profileId,
+    locked,
+    profileSource: application.source,
+    // The write path guarantees resolvability — the ensure seam refused anything else.
+    profileResolvable: true,
+    unappliedProfileIds: remainder,
+    overridingSubsystemIds: overriding
+  };
+  if (application.adoptedPackName) view.adoptedPackName = application.adoptedPackName;
+  return view;
 }
 function getPackPolicy(cfg, credential) {
   requirePrincipal4(cfg, credential);
@@ -29131,11 +29568,8 @@ function mintToken(cfg, credential, request) {
   }
   assertNotReservedSubjectId(cfg, [request.ownerUserId]);
   const projects = request.projects?.length ? request.projects : ["*"];
-  const knownProjects = new Set(listProjectRecords(cfg.dataDir).map((p) => p.id));
   for (const p of projects) {
-    if (p !== "*" && !knownProjects.has(p)) {
-      throw new Error(`unknown project "${p}"`);
-    }
+    assertMintableNarrowingEntry(cfg.dataDir, p);
   }
   const owner = findUserByRecordOrSubjectId(cfg.dataDir, request.ownerUserId);
   if (owner && owner.status !== "active") {
@@ -29172,12 +29606,21 @@ function revokeToken(cfg, credential, tokenId) {
 }
 function mintSelfToken(cfg, credential, projectId, write) {
   const principal = requirePrincipal5(cfg, credential);
-  if (authorize(cfg.dataDir, principal, PROJECT_READ_CAPABILITY2, "project", projectId).value !== "yes") {
+  const parsed = parseQualifiedSelector(projectId);
+  if (!parsed) {
+    throw new Error(
+      `invalid project id "${projectId}" (expected a project id, optionally subproject-qualified as projectId::subsystemId)`
+    );
+  }
+  if (authorize(cfg.dataDir, principal, PROJECT_READ_CAPABILITY2, "project", parsed.projectId).value !== "yes") {
     throw new ForbiddenError("caller lacks project:read on the requested project");
   }
-  if (write && authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY2, "project", projectId).value !== "yes") {
+  if (write && authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY2, "project", parsed.projectId).value !== "yes") {
     throw new ForbiddenError("caller lacks project:write on the requested project");
   }
+  if (parsed.mounts.length > 0) {
+    assertMintableNarrowingEntry(cfg.dataDir, projectId);
+  }
   const token = "wk_" + crypto10.randomBytes(24).toString("hex");
   const owner = auditActor(principal);
   const record2 = {
@@ -29789,12 +30232,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path62 = chainOf(placement.unitId, unitById);
-    if (!path62.length) continue;
-    const closedOk = path62.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path61 = chainOf(placement.unitId, unitById);
+    if (!path61.length) continue;
+    const closedOk = path61.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path62[path62.length - 1].id);
-    if (crossTenant && !path62.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path61[path61.length - 1].id);
+    if (crossTenant && !path61.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -30733,10 +31176,9 @@ function migratePermissionModel(dataDir, apply) {
 // src/server/http.ts
 var http2 = __toESM(require("http"));
 var fs49 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var path58 = __toESM(require("path"));
 
 // src/server/request.ts
-var path58 = __toESM(require("path"));
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 init_fs();
 
@@ -31950,6 +32392,9 @@ function getProjectConfig2(cfg, credential, projectId) {
 function setProjectType2(cfg, credential, projectId, projectType) {
   return setProjectType(cfg, credential, projectId, projectType);
 }
+function listProjectProfiles2(cfg, credential, project2) {
+  return listProjectProfiles(cfg, credential, project2);
+}
 function listProducers2(cfg, credential, project2) {
   return listProducers(cfg, credential, project2);
 }
@@ -35311,6 +35756,9 @@ function opsGetProjectConfig(cfg, sessionId, url, res) {
 function opsSetProjectConfig(cfg, sessionId, body, res) {
   sendJson(res, 200, setProjectType2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
 }
+function opsListProjectProfiles(cfg, sessionId, url, res) {
+  sendJson(res, 200, { profiles: listProjectProfiles2(cfg, sessionId, q(url, "projectId") ?? "") });
+}
 function opsListProducers(cfg, sessionId, url, res) {
   sendJson(res, 200, { producers: listProducers2(cfg, sessionId, q(url, "projectId") ?? "") });
 }
@@ -35550,6 +35998,9 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "config") {
         return opsSetProjectConfig(cfg, sessionId, body, res);
       }
+      if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
+        return opsListProjectProfiles(cfg, sessionId, url, res);
+      }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
         return opsPolicyEvaluate(cfg, sessionId, url, res);
       }
@@ -35774,8 +36225,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path62 = (req.url ?? "/").split("?")[0];
-    if (path62 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path61 = (req.url ?? "/").split("?")[0];
+    if (path61 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -35920,7 +36371,7 @@ function deriveMcpOutcome(response) {
   if (r.result && typeof r.result === "object" && r.result.isError) return "failed";
   return "success";
 }
-function auditToolCall(dataDir, principal, projectId, body, outcome) {
+function auditToolCall(dataDir, principal, projectId, body, outcome, subproject) {
   const target = mcpToolTarget(body);
   if (!target) return;
   const actor = principal.subject ?? {
@@ -35938,7 +36389,8 @@ function auditToolCall(dataDir, principal, projectId, body, outcome) {
     actor,
     tokenId: principal.tokenId,
     projectId,
-    target
+    target,
+    ...subproject ? { metadata: JSON.stringify({ subproject }) } : {}
   };
   try {
     appendAuditEvent(dataDir, event, DEFAULT_AUDIT_POLICY);
@@ -36142,8 +36594,8 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
       permissionSubject: { subjectId: "anonymous", roleBindings: [], instanceAdmin: true }
     };
   }
-  const root = resolveProjectRoot(cfg.dataDir, principal, projectSelector(req));
-  if (!root) {
+  const binding = resolveProjectBinding(cfg.dataDir, principal, projectSelector(req));
+  if (!binding) {
     sendJson(res, 403, { error: "project not authorized, unknown, or not specified" });
     return;
   }
@@ -36158,19 +36610,20 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
     });
     return;
   }
-  await runWithProjectRoot(root, async () => {
-    const projectId = path58.basename(root);
+  await runWithProjectRoot(binding.rootPath, async () => {
+    const projectId = binding.projectId;
+    const subproject = binding.subproject;
     const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body);
     if (dispatchedResponse !== void 0) {
       sendJson(res, 200, dispatchedResponse);
-      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse));
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse), subproject);
       for (const ch of mcpChangeChannels(body, projectId, dispatchedResponse)) publishChange(ch);
       return;
     }
     const permissionError = dataPlanePermissionError(cfg, principal, projectId, body);
     if (permissionError !== void 0) {
       sendJson(res, 200, permissionError);
-      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(permissionError));
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(permissionError), subproject);
       return;
     }
     const server = createScopedServer();
@@ -36191,7 +36644,7 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
     };
     await server.connect(transport);
     await transport.handleRequest(req, res, body);
-    auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(response));
+    auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(response), subproject);
     for (const ch of mcpChangeChannels(body, projectId, response)) publishChange(ch);
   });
 }
@@ -36626,7 +37079,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs49.readFileSync(path59.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs49.readFileSync(path58.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -37311,9 +37764,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path60.join(os9.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path59.join(os10.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path60.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path59.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -37438,13 +37891,13 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs50.existsSync(path60.join(cwd, ".wai"))) {
+  if (!fs50.existsSync(path59.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
   const hash = crypto20.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path60.join(os9.tmpdir(), "wairon-dev", hash);
+  const dataDir = path59.join(os10.tmpdir(), "wairon-dev", hash);
   fs50.mkdirSync(dataDir, { recursive: true });
   registerLocalDevProject(dataDir, "local", cwd);
   const port = options.port ? Number(options.port) : 8080;
@@ -37853,8 +38306,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path60.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs50.readFileSync(path60.resolve(options.file), "utf8");
+        const name = options.name ?? path59.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs50.readFileSync(path59.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -38060,13 +38513,27 @@ async function runSurface(action, options = {}) {
       for (const p of written) logger.info(`  ${p}`);
       return;
     }
+    case "externals": {
+      const entries = listExternalInterfaces();
+      if (!entries.length) {
+        logger.info("No external surfaces available (.wai/surfaces/ holds no snapshots).");
+        return;
+      }
+      const freshness = (f) => f === "fresh" ? import_chalk19.default.green(f) : f === "stale" ? import_chalk19.default.yellow(f) : import_chalk19.default.gray(f);
+      for (const e of entries) {
+        logger.info(
+          `${e.sourceKind.padEnd(8)} ${import_chalk19.default.cyan(e.projectName)} [${e.origin}] ${freshness(e.freshness)} \u2014 ${e.interfaceIds.length ? e.interfaceIds.join(", ") : "(no interfaces)"}`
+        );
+      }
+      return;
+    }
     default:
-      throw new WaironError(`Unknown surface action "${action}" (supported: export, import, list, generate-children).`);
+      throw new WaironError(`Unknown surface action "${action}" (supported: export, import, list, generate-children, externals).`);
   }
 }
 
 // src/commands/subsystem.ts
-var path61 = __toESM(require("path"));
+var path60 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -38102,9 +38569,9 @@ async function runSubsystemAdd(id, options = {}) {
     updatedAt: now
   };
   createChainedSubsystem(subsystem, displayName);
-  const childDir = path61.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path60.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Added external subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Scaffolded child project at ${path61.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path60.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -38127,9 +38594,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path61.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path60.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path61.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path60.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -38168,8 +38635,64 @@ program.command("generate").description("Generate agent output files from the sp
     dryRun: opts.dryRun
   });
 });
+async function runLock2(options) {
+  assertProjectInitialized();
+  if (!pathExists(AI_PATHS.specsSystem())) {
+    logger.error("No SDD spec tree found (.wai/specs). Nothing to lock.");
+    process.exit(1);
+  }
+  const projectConfig = loadProjectConfig();
+  logger.info("Analyzing and validating specifications in-memory...");
+  const dry = validateAsComplete({
+    rules: projectConfig.rules,
+    projectType: projectConfig.projectType,
+    scopeSubsystem: options.subsystem,
+    recursive: options.recursive ?? true
+  });
+  const errors = dry.issues.filter((i) => i.severity === "error");
+  if (errors.length > 0) {
+    logger.header("Cannot lock \u2014 the spec tree does not validate as complete");
+    let errorCount = 0;
+    const MAX_PRINT = 100;
+    let skippedErrors = 0;
+    for (const i of errors) {
+      if (errorCount < MAX_PRINT) {
+        logger.error(`${i.specId ? `[${i.specId}] ` : ""}[${i.code}] ${i.message}`);
+        errorCount++;
+      } else {
+        skippedErrors++;
+      }
+    }
+    if (skippedErrors > 0) {
+      logger.error(`... and ${skippedErrors} more error(s) omitted.`);
+    }
+    logger.blank();
+    logger.info("Fix the errors above, then run `wairon lock` again. Nothing was changed.");
+    process.exit(1);
+  }
+  logger.header("Lock SDD specs");
+  const record2 = await runLock(options, dry);
+  if (!record2) {
+    logger.info("Cancelled. Nothing was changed.");
+    return;
+  }
+  const childPaths = generateChildSnapshots();
+  if (childPaths.length > 0) {
+    logger.blank();
+    logger.success(`Regenerated the family/sibling surfaces into ${childPaths.length} chained child snapshot(s):`);
+    for (const p of childPaths) logger.info(`  ${p}`);
+  }
+  logger.blank();
+  await runGenerate({ domain: options.subsystem });
+  logger.blank();
+  logger.success("Specs locked and agent topology generated.");
+  logger.info(`Lock record written (.wai/lock.json): stateId ${record2.stateId.algorithm}:${record2.stateId.digest} \u2014 status ${record2.status}.`);
+  logger.warn(
+    "Restart any running AI agent sessions (Claude Code / Antigravity / Codex) so the newly generated implementer agents load \u2014 they are not picked up mid-session."
+  );
+}
 program.command("lock").description("Final check before implementation: validate the spec tree as complete, freeze all specs to complete, and (re)generate the agent topology \u2014 only if it validates").option("-y, --yes", "skip the confirmation prompt (for scripts / CI)").option("--subsystem <id>", "only lock specs in the specified subsystem").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
-  await runLock({ yes: opts.yes, subsystem: opts.subsystem, recursive: opts.recursive });
+  await runLock2({ yes: opts.yes, subsystem: opts.subsystem, recursive: opts.recursive });
 });
 program.command("validate").description("Validate the project configuration and the SDD Spec Tree").option("--ci", "treat warnings as errors for CI pipelines").option("--subsystem <id>", "only validate the specified subsystem (granular)").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
   await runValidate({ ci: opts.ci, subsystem: opts.subsystem, recursive: opts.recursive });
@@ -38285,7 +38808,7 @@ mcpCmd.command("status").description("Show whether the wairon MCP server is regi
 program.command("produce <target>").description("project the local project's specs to a producer target (notion | miro)").option("--page <id>", "parent page/board id in the target").option("--token <token>", "integration token (else env, else interactive prompt)").action(async (target, opts) => {
   await runProduce(target, { page: opts.page, token: opts.token });
 });
-program.command("surface <action>").description("public surface exchange: export | import | list | generate-children").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--portal <id>", "export: select one portal's OpenAPI spec (a multi-portal project renders one document per portal)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
+program.command("surface <action>").description("public surface exchange: export | import | list | generate-children | externals").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--portal <id>", "export: select one portal's OpenAPI spec (a multi-portal project renders one document per portal)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
   await runSurface(action, {
     audience: opts.audience,
     format: opts.format,