@wairon/cli 5.1.1-dev.75 → 5.1.1-dev.76

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.75";
+    WAIRON_VERSION = "5.1.1-dev.76";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -2900,10 +2900,10 @@ function stepGraph(method2) {
     const s = byNum.get(n);
     if (s.type !== "parallel" || s.endStep === void 0 || !s.branches?.length) continue;
     const entries = s.branches.map((b) => b.step).sort((a, b) => a - b);
-    const join53 = fallNext(s.endStep);
+    const join54 = fallNext(s.endStep);
     for (let i = 0; i < entries.length; i++) {
       const armEnd = i + 1 < entries.length ? prevOf(entries[i + 1]) : s.endStep;
-      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join53);
+      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join54);
     }
   }
   const successorsOf = (n) => {
@@ -9624,21 +9624,21 @@ function buildCodeIndex(model) {
   const declarations = /* @__PURE__ */ new Map();
   const anchors = /* @__PURE__ */ new Map();
   const findingAnchors = /* @__PURE__ */ new Map();
-  const namesAt = (cache2, path72, make) => {
-    const cached = cache2.get(path72);
+  const namesAt = (cache2, path73, make) => {
+    const cached = cache2.get(path73);
     if (cached) return cached;
-    const f = facts.get(path72);
+    const f = facts.get(path73);
     if (!f) return NO_NAMES;
     const built = make(f);
-    cache2.set(path72, built);
+    cache2.set(path73, built);
     return built;
   };
   const republished = /* @__PURE__ */ new Map();
-  const republishedFrom = (path72) => {
-    const cached = republished.get(path72);
+  const republishedFrom = (path73) => {
+    const cached = republished.get(path73);
     if (cached) return cached;
-    const out = /* @__PURE__ */ new Set([path72]);
-    const queue = [path72];
+    const out = /* @__PURE__ */ new Set([path73]);
+    const queue = [path73];
     while (queue.length) {
       const from = queue.pop();
       const f = facts.get(from);
@@ -9651,7 +9651,7 @@ function buildCodeIndex(model) {
         }
       }
     }
-    republished.set(path72, out);
+    republished.set(path73, out);
     return out;
   };
   const NO_ORIGIN = /* @__PURE__ */ new Set();
@@ -9660,9 +9660,9 @@ function buildCodeIndex(model) {
     return to ? republishedFrom(to) : NO_ORIGIN;
   };
   const scopeOf2 = (site, from) => {
-    const path72 = pathKey(site.from ?? from);
-    const f = facts.get(path72);
-    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path72, facts: f } : void 0;
+    const path73 = pathKey(site.from ?? from);
+    const f = facts.get(path73);
+    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path73, facts: f } : void 0;
   };
   const originOf2 = (site, from) => {
     const resolved = scopeOf2(site, from);
@@ -9701,14 +9701,14 @@ function buildCodeIndex(model) {
     if (site.via) for (const typeName of localTypesOf(f, site.via)) widenThroughType(typeName);
     return out;
   };
-  const declarationsAt = (path72) => namesAt(declarations, pathKey(path72), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
+  const declarationsAt = (path73) => namesAt(declarations, pathKey(path73), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
   return {
     paths,
     exactPaths,
-    factsAt: (path72) => facts.get(pathKey(path72)),
+    factsAt: (path73) => facts.get(pathKey(path73)),
     declarationsAt,
-    anchorsAt: (path72) => namesAt(anchors, pathKey(path72), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
-    findingAnchorsAt: (path72) => namesAt(findingAnchors, pathKey(path72), (f) => new Set(f.anchoredNames)),
+    anchorsAt: (path73) => namesAt(anchors, pathKey(path73), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
+    findingAnchorsAt: (path73) => namesAt(findingAnchors, pathKey(path73), (f) => new Set(f.anchoredNames)),
     originOf: originOf2,
     possibleOriginsOf
   };
@@ -9746,10 +9746,10 @@ function buildRealizationIndex(ctx) {
   return {
     paths,
     implementationsOf: (compId) => implsByComponent.get(compId) ?? NONE_IMPL,
-    implementationsAt: (path72) => implsByPath.get(pathKey(path72)) ?? NONE_IMPL,
+    implementationsAt: (path73) => implsByPath.get(pathKey(path73)) ?? NONE_IMPL,
     filesOf: (compId) => filesByComponent.get(compId) ?? NONE_PATH,
     filesIn: (subsystemId) => filesBySubsystem.get(subsystemId) ?? NONE_PATH,
-    componentsAt: (path72) => componentsByPath.get(pathKey(path72)) ?? NONE_COMP
+    componentsAt: (path73) => componentsByPath.get(pathKey(path73)) ?? NONE_COMP
   };
 }
 function buildImportGraph(index, universe) {
@@ -9761,22 +9761,22 @@ function buildImportGraph(index, universe) {
       if (to && to !== from) into.add(to);
     }
   };
-  const importsOf = (path72) => {
-    const cached = imports.get(path72);
+  const importsOf = (path73) => {
+    const cached = imports.get(path73);
     if (cached) return cached;
-    const facts = index.factsAt(path72);
+    const facts = index.factsAt(path73);
     const out = /* @__PURE__ */ new Set();
-    if (facts?.status === "analyzed") resolveAll(path72, facts.imports, out);
-    imports.set(path72, out);
+    if (facts?.status === "analyzed") resolveAll(path73, facts.imports, out);
+    imports.set(path73, out);
     return out;
   };
-  const tracesOf = (path72) => {
-    const cached = traces.get(path72);
+  const tracesOf = (path73) => {
+    const cached = traces.get(path73);
     if (cached) return cached;
-    const facts = index.factsAt(path72);
-    const out = new Set(importsOf(path72));
-    if (facts?.status === "analyzed") resolveAll(path72, facts.reexports, out);
-    traces.set(path72, out);
+    const facts = index.factsAt(path73);
+    const out = new Set(importsOf(path73));
+    if (facts?.status === "analyzed") resolveAll(path73, facts.reexports, out);
+    traces.set(path73, out);
     return out;
   };
   return {
@@ -11279,11 +11279,11 @@ var init_unconditional_call_cycles = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => byCodeUnit(a.fromKey, b.fromKey) || byCodeUnit(a.impl.id, b.impl.id) || a.stepNumber - b.stepNumber)[0];
-          const path72 = [...keys].sort(byCodeUnit).join(" \u2192 ");
+          const path73 = [...keys].sort(byCodeUnit).join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path72} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path73} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -13183,8 +13183,8 @@ var init_lifecycle_entrypoints = __esm({
 });
 
 // src/core/rules/wiring/portal-mounts.ts
-function liesUnder(path72, prefix) {
-  return path72 === prefix || path72.startsWith(prefix + "/");
+function liesUnder(path73, prefix) {
+  return path73 === prefix || path73.startsWith(prefix + "/");
 }
 var portalMountsRule;
 var init_portal_mounts = __esm({
@@ -14473,11 +14473,11 @@ var init_hidden_state = __esm({
             byPath.set(key, list2);
           }
         }
-        for (const path72 of code.exactPaths) {
-          const facts = code.factsAt(path72);
+        for (const path73 of code.exactPaths) {
+          const facts = code.factsAt(path73);
           const bindings = facts.topLevelMutableBindings ?? [];
           if (bindings.length === 0) continue;
-          const mapped = byPath.get(path72) ?? [];
+          const mapped = byPath.get(path73) ?? [];
           if (mapped.length === 0) continue;
           if (!mapped.every((m) => isStatelessLogic(m.component))) continue;
           const anchor = [...mapped].sort((a, b) => a.impl.id.localeCompare(b.impl.id))[0];
@@ -14550,7 +14550,7 @@ var init_dependency_conformance = __esm({
           }
           return false;
         };
-        const draftAt = (path72) => realization.implementationsAt(path72).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path73) => realization.implementationsAt(path73).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromComponents = realization.componentsAt(fromPath);
           for (const toPath of graph.importsOf(fromPath)) {
@@ -14641,7 +14641,7 @@ var init_portal_imports = __esm({
           }
           return files;
         };
-        const draftAt = (path72) => realization.implementationsAt(path72).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path73) => realization.implementationsAt(path73).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromSubsystems = new Set(realization.componentsAt(fromPath).map((c) => c.subsystem));
           for (const toPath of graph.importsOf(fromPath)) {
@@ -15227,8 +15227,8 @@ var init_param_conformance = __esm({
 });
 
 // src/core/rules/conformance/route-coverage.ts
-function liesUnder2(path72, prefix) {
-  return path72 === prefix || path72.startsWith(prefix + "/");
+function liesUnder2(path73, prefix) {
+  return path73 === prefix || path73.startsWith(prefix + "/");
 }
 function normalizeSegment(segment) {
   return /^\{.+\}$/.test(segment) || segment.startsWith(":") ? "*" : segment;
@@ -20126,6 +20126,9 @@ function specChanges(before, after, prefix = "") {
     if (after.length === 0 && before.length > 0) {
       return [{ path: prefix, change: "cleared", before: summarizeValue(before) }];
     }
+    if ((prefix.split(".").pop() ?? prefix) === "narrative" && [...before, ...after].every((i) => i !== null && typeof i === "object" && !Array.isArray(i))) {
+      return narrativeChanges(before, after, prefix);
+    }
     const identified = [...before, ...after].every((i) => reportIdentityOf(prefix.split(".").pop() ?? prefix, i) !== null);
     if (!identified) {
       return JSON.stringify(before) === JSON.stringify(after) ? [] : [{ path: prefix, change: "set", before: summarizeValue(before), after: summarizeValue(after) }];
@@ -20159,6 +20162,150 @@ function specChanges(before, after, prefix = "") {
   if (JSON.stringify(before) === JSON.stringify(after)) return [];
   return [{ path: prefix, change: "set", before: summarizeValue(before), after: summarizeValue(after) }];
 }
+function jumpsOf(step) {
+  const jumps = /* @__PURE__ */ new Map();
+  for (const field of STEP_JUMP_FIELDS) {
+    if (typeof step[field] === "number") jumps.set(field, step[field]);
+  }
+  for (const [list2, name] of STEP_JUMP_LISTS) {
+    const entries = step[list2];
+    if (!Array.isArray(entries)) continue;
+    entries.forEach((entry, i) => {
+      if (entry && typeof entry.step === "number") jumps.set(`${list2}.${String(entry[name] ?? i)}.step`, entry.step);
+    });
+  }
+  return jumps;
+}
+function withoutNumbers(step) {
+  const out = { ...step };
+  delete out.stepNumber;
+  for (const field of STEP_JUMP_FIELDS) delete out[field];
+  for (const [list2] of STEP_JUMP_LISTS) {
+    if (Array.isArray(out[list2])) {
+      out[list2] = out[list2].map((entry) => {
+        if (!entry || typeof entry !== "object") return entry;
+        const { step: _step, ...rest } = entry;
+        return rest;
+      });
+    }
+  }
+  return out;
+}
+function canonicalJson(value) {
+  return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, v[k]])) : v);
+}
+function commonRun(a, b, same) {
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  const table = new Uint32Array(rows * cols);
+  for (let i2 = a.length - 1; i2 >= 0; i2--) {
+    for (let j2 = b.length - 1; j2 >= 0; j2--) {
+      table[i2 * cols + j2] = same(a[i2], b[j2]) ? table[(i2 + 1) * cols + j2 + 1] + 1 : Math.max(table[(i2 + 1) * cols + j2], table[i2 * cols + j2 + 1]);
+    }
+  }
+  const pairs = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (same(a[i], b[j])) {
+      pairs.push([i, j]);
+      i++;
+      j++;
+    } else if (table[(i + 1) * cols + j] >= table[i * cols + j + 1]) i++;
+    else j++;
+  }
+  return pairs;
+}
+function recognisablySame(a, b) {
+  if (typeof a.description === "string" && a.description === b.description) return true;
+  if (typeof a.label === "string" && a.label === b.label) return true;
+  return typeof a.targetComponent === "string" && a.type === b.type && a.targetComponent === b.targetComponent && a.targetMethod === b.targetMethod;
+}
+function pairSteps(before, after) {
+  const keysBefore = before.map((s) => canonicalJson(withoutNumbers(s)));
+  const keysAfter = after.map((s) => canonicalJson(withoutNumbers(s)));
+  const anchors = commonRun(keysBefore, keysAfter, (x, y) => x === y);
+  const pairs = [];
+  const bounds2 = [[-1, -1], ...anchors, [before.length, after.length]];
+  for (let g = 0; g < bounds2.length - 1; g++) {
+    const [oi, ni] = bounds2[g];
+    const [oj, nj] = bounds2[g + 1];
+    const gapBefore = before.slice(oi + 1, oj).map((step, k) => ({ step, at: oi + 1 + k }));
+    const gapAfter = after.slice(ni + 1, nj).map((step, k) => ({ step, at: ni + 1 + k }));
+    const similar = commonRun(gapBefore, gapAfter, (x, y) => recognisablySame(x.step, y.step)).map(([x, y]) => [gapBefore[x].at, gapAfter[y].at]);
+    const inner = [[oi, ni], ...similar, [oj, nj]];
+    for (let k = 0; k < inner.length - 1; k++) {
+      const [a0, b0] = inner[k];
+      const [a1, b1] = inner[k + 1];
+      if (a1 - a0 === b1 - b0) for (let d = 1; d < a1 - a0; d++) pairs.push([a0 + d, b0 + d]);
+      if (k < inner.length - 2) pairs.push(inner[k + 1]);
+    }
+    if (g < bounds2.length - 2) pairs.push(bounds2[g + 1]);
+  }
+  return pairs.sort((x, y) => x[0] - y[0]);
+}
+function numberOf(step, index) {
+  return typeof step.stepNumber === "number" ? step.stepNumber : index + 1;
+}
+function renumberedRuns(moves) {
+  const runs = [];
+  const range = (a, b) => a === b ? `step ${a}` : `steps ${a}-${b}`;
+  let start2 = 0;
+  for (let k = 1; k <= moves.length; k++) {
+    const continues = k < moves.length && moves[k][0] === moves[k - 1][0] + 1 && moves[k][1] - moves[k][0] === moves[start2][1] - moves[start2][0];
+    if (continues) continue;
+    const [firstOld, firstNew] = moves[start2];
+    const [lastOld, lastNew] = moves[k - 1];
+    runs.push({ from: range(firstOld, lastOld), to: range(firstNew, lastNew) });
+    start2 = k;
+  }
+  return runs;
+}
+function narrativeChanges(before, after, prefix) {
+  const pairs = pairSteps(before, after);
+  const oldToNew = /* @__PURE__ */ new Map();
+  for (const [o, n] of pairs) oldToNew.set(numberOf(before[o], o), numberOf(after[n], n));
+  const pairedOld = new Set(pairs.map(([o]) => o));
+  const pairedNew = new Set(pairs.map(([, n]) => n));
+  const removed = before.flatMap((step, o) => pairedOld.has(o) ? [] : [{
+    path: `${prefix}.step ${numberOf(step, o)}`,
+    change: "removed",
+    before: summarizeValue(step)
+  }]);
+  const added = after.flatMap((step, n) => pairedNew.has(n) ? [] : [{
+    path: `${prefix}.step ${numberOf(step, n)}`,
+    change: "added",
+    after: summarizeValue(step)
+  }]);
+  const edited = [];
+  const relocated = [];
+  const moves = [];
+  for (const [o, n] of pairs) {
+    const oldNumber = numberOf(before[o], o);
+    const newNumber = numberOf(after[n], n);
+    const at = oldNumber === newNumber ? `${prefix}.step ${newNumber}` : `${prefix}.step ${newNumber} (was ${oldNumber})`;
+    edited.push(...specChanges(withoutNumbers(before[o]), withoutNumbers(after[n]), at));
+    const oldJumps = jumpsOf(before[o]);
+    const newJumps = jumpsOf(after[n]);
+    for (const field of /* @__PURE__ */ new Set([...oldJumps.keys(), ...newJumps.keys()])) {
+      const was = oldJumps.get(field);
+      const now = newJumps.get(field);
+      if (was === now) continue;
+      if (was === void 0) edited.push({ path: `${at}.${field}`, change: "added", after: String(now) });
+      else if (now === void 0) edited.push({ path: `${at}.${field}`, change: "removed", before: String(was) });
+      else if (oldToNew.get(was) === now) relocated.push({ path: `${at}.${field}`, change: "relocated", before: String(was), after: String(now) });
+      else edited.push({ path: `${at}.${field}`, change: "set", before: String(was), after: String(now) });
+    }
+    if (oldNumber !== newNumber && !edited.some((c) => c.path.startsWith(`${at}.`))) moves.push([oldNumber, newNumber]);
+  }
+  const renumbered = renumberedRuns(moves).map(({ from, to }) => ({
+    path: prefix,
+    change: "renumbered",
+    before: from,
+    after: to
+  }));
+  return [...removed, ...added, ...edited, ...renumbered, ...relocated];
+}
 function identityFieldsOf(field) {
   switch (field) {
     case "dispatch":
@@ -20206,13 +20353,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
   const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
-  const say = (path72, why) => {
-    out.push(`${path72} \u2014 ${why}`);
+  const say = (path73, why) => {
+    out.push(`${path73} \u2014 ${why}`);
   };
-  const walkValue = (d, m, s, path72, field) => {
+  const walkValue = (d, m, s, path73, field) => {
     if (Array.isArray(d)) {
       if (!Array.isArray(m)) {
-        say(path72, "the level does not have this field, so the write dropped it");
+        say(path73, "the level does not have this field, so the write dropped it");
         return;
       }
       if (field === "narrative" && d.some(carriesEditMarker)) return;
@@ -20220,32 +20367,32 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
         if (carriesEditMarker(element)) continue;
         const key = reportIdentityOf(field, element);
         if (key === null) {
-          if (!same(m, d)) say(path72, "the level does not keep this value, so the write dropped it");
-          else if (same(s, d)) say(path72, "the stored spec already held this value");
+          if (!same(m, d)) say(path73, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path73, "the stored spec already held this value");
           return;
         }
         const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
         const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
         if (mMatch === void 0) {
-          say(at(path72, key), "the write did not store this element");
+          say(at(path73, key), "the write did not store this element");
           continue;
         }
-        walk2(element, mMatch, sMatch, at(path72, key), field);
+        walk2(element, mMatch, sMatch, at(path73, key), field);
       }
       return;
     }
     if (isPlain(d)) {
       if (!isPlain(m)) {
-        say(path72, "the level does not have this field, so the write dropped it");
+        say(path73, "the level does not have this field, so the write dropped it");
         return;
       }
-      walk2(d, m, s, path72, field);
+      walk2(d, m, s, path73, field);
       return;
     }
-    if (!same(m, d)) say(path72, "the write did not store it \u2014 the level's schema does not keep this value");
-    else if (same(s, d)) say(path72, "the stored spec already held this value");
+    if (!same(m, d)) say(path73, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path73, "the stored spec already held this value");
   };
-  function walk2(d, m, s, path72, container) {
+  function walk2(d, m, s, path73, container) {
     for (const [key, value] of Object.entries(d)) {
       if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
       if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
@@ -20255,13 +20402,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
           if (typeof name !== "string") continue;
           const had = isPlain(s) && s[name] !== void 0;
           const still = isPlain(m) && m[name] !== void 0;
-          if (!had) say(at(path72, name), "unset named a field the stored spec did not have");
-          else if (still) say(at(path72, name), "unset did not remove it");
+          if (!had) say(at(path73, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path73, name), "unset did not remove it");
         }
         continue;
       }
       if (value === void 0 || value === null) continue;
-      const here = at(path72, key);
+      const here = at(path73, key);
       const mValue = isPlain(m) ? m[key] : void 0;
       const sValue = isPlain(s) ? s[key] : void 0;
       if (mValue === void 0) {
@@ -20337,7 +20484,7 @@ function weighMoveHome(hooks, candidate, reach, dependencyLimit) {
   };
 }
 function moveChangeReports(edits, dryRun) {
-  return edits.map((edit) => ({ edit, changes: specChanges(edit.before, edit.after) })).filter(({ changes }) => changes.length > 0).map(({ edit, changes }) => ({
+  return edits.map((edit) => ({ edit, changes: specChanges(edit.before ?? {}, edit.after) })).filter(({ changes }) => changes.length > 0).map(({ edit, changes }) => ({
     kind: edit.kind,
     id: edit.id,
     written: !dryRun,
@@ -20346,9 +20493,57 @@ function moveChangeReports(edits, dryRun) {
     ineffective: [],
     notices: [],
     testsToRevisit: [],
-    summary: `${dryRun ? "Would move" : "Moved"} into ${edit.kind} "${edit.id}": ${changes.length} change${changes.length === 1 ? "" : "s"}.`
+    summary: edit.before === null ? `${dryRun ? "Would create" : "Created"} ${edit.kind} "${edit.id}" to receive the moved methods.` : `${dryRun ? "Would move" : "Moved"} into ${edit.kind} "${edit.id}": ${changes.length} change${changes.length === 1 ? "" : "s"}.`
   }));
 }
+function createdClause(created, verb) {
+  return created.length ? `, ${verb} ${created.join(" and ")}` : "";
+}
+function createdContract(target, from, methods, contracts) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const status2 = statusOfContracts(contracts, from);
+  return {
+    id: `i${target.id}`,
+    name: `${target.name} Interface`,
+    description: `The contract of ${target.name}, created by moving ${namedMethods(methods)} here from "${from}".`,
+    component: target.id,
+    methods: [],
+    ...status2 ? { status: status2 } : {},
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function createdImplementation(target, contractId, from, travelling, implementations, contracts) {
+  const ofSource = new Set(contracts.filter((i) => i.component === from).map((i) => i.id));
+  const leaving = implementations.filter((impl) => ofSource.has(impl.contract) && impl.methods.some((m) => travelling.some((t) => t.name === m.name)));
+  const paths = [...new Set(leaving.map((impl) => impl.sourcePath))];
+  const inherited = paths.length === 1 ? paths[0] : void 0;
+  const notices = [];
+  if (paths.length > 1) {
+    for (const entry of travelling) {
+      if (entry.sourcePath) continue;
+      const home = leaving.find((impl) => impl.methods.some((m) => m.name === entry.name));
+      if (home?.sourcePath) entry.sourcePath = home.sourcePath;
+    }
+    notices.push(`"${target.id}_impl" is created without a sourcePath: the moved entries come from implementations with different ones, so each keeps the file it was realized in as its own sourcePath.`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const status2 = leaving[0]?.status;
+  const spec = {
+    id: `${target.id}_impl`,
+    name: `${target.name} Implementation`,
+    description: `The implementation of ${target.name}, created by moving methods here from "${from}".`,
+    contract: contractId,
+    ...inherited ? { sourcePath: inherited } : {},
+    methods: travelling,
+    ...status2 ? { status: status2 } : {},
+    createdAt: now,
+    updatedAt: now
+  };
+  const origin = leaving.length === 1 ? ` from "${leaving[0].id}"` : "";
+  const named = inherited ? `implementation "${spec.id}" (sourcePath ${inherited}, inherited${origin})` : `implementation "${spec.id}" (no sourcePath)`;
+  return { spec, named, notices };
+}
 function refusedMoveSummary(from, to, methods, refusals, alternatives) {
   const cheapest = alternatives.find((c) => c.legal);
   return `Refused: moving ${namedMethods(methods)} from "${from}" to "${to}" is refused by ${refusals.join(", ")}. Nothing was written. ` + (cheapest ? `The cheapest legal home is "${cheapest.component}" (${cheapest.newDependencies.length} new dependenc${cheapest.newDependencies.length === 1 ? "y" : "ies"}, ${cheapest.dependencyCount} of ${cheapest.dependencyLimit}).` : `No component of this subsystem can take them as they stand \u2014 ${alternatives.length} were weighed.`);
@@ -20542,7 +20737,7 @@ function updateSpec(kind, id, delta, hooks, dryRun) {
 function moveMethods(from, to, methods, hooks, dryRun) {
   return current().moveMethods(from, to, methods, hooks, dryRun);
 }
-var fs13, path17, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, COMPONENT_AUTH_SOURCE, DELTA_VERBS, JUMP_LABEL_TWINS, LABEL_TWIN_CONTAINERS, SpecWorkspace, DEFAULT_DEPENDENCY_LIMIT, PROSE_FIELDS, workspaces, lastServedBinding;
+var fs13, path17, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, COMPONENT_AUTH_SOURCE, STEP_JUMP_FIELDS, STEP_JUMP_LISTS, DELTA_VERBS, JUMP_LABEL_TWINS, LABEL_TWIN_CONTAINERS, SpecWorkspace, DEFAULT_DEPENDENCY_LIMIT, PROSE_FIELDS, workspaces, lastServedBinding;
 var init_specs2 = __esm({
   "src/core/specs.ts"() {
     "use strict";
@@ -20562,6 +20757,8 @@ var init_specs2 = __esm({
     NO_ROOT_SUBSYSTEMS = /* @__PURE__ */ new Set();
     SIGNATURE_TTL_MS = 2e3;
     COMPONENT_AUTH_SOURCE = "component:";
+    STEP_JUMP_FIELDS = ["onTrueStep", "onFalseStep", "defaultStep", "endStep", "finallyStep", "toStep"];
+    STEP_JUMP_LISTS = [["cases", "value"], ["catches", "error"], ["branches", "name"]];
     DELTA_VERBS = /* @__PURE__ */ new Set(["action", "remove", "captureJumps"]);
     JUMP_LABEL_TWINS = /* @__PURE__ */ new Set([
       "onTrueLabel",
@@ -22530,7 +22727,8 @@ var init_specs2 = __esm({
               notices: plan.notices,
               summary: refusedMoveSummary(from, to, methods, verdict.refusals, alternatives),
               dryRun,
-              mentions
+              mentions,
+              created: []
             };
           }
         }
@@ -22546,9 +22744,10 @@ var init_specs2 = __esm({
             refusals: [],
             alternatives: [],
             notices: plan.notices,
-            summary: `Dry run: moving ${namedMethods(methods)} from "${from}" to "${to}" would touch ${edits2.length} spec${edits2.length === 1 ? "" : "s"} and re-point ${repointed} reference${repointed === 1 ? "" : "s"}. Nothing was written.`,
+            summary: `Dry run: moving ${namedMethods(methods)} from "${from}" to "${to}" would touch ${edits2.length} spec${edits2.length === 1 ? "" : "s"}${createdClause(plan.created, "would create")} and re-point ${repointed} reference${repointed === 1 ? "" : "s"}. Nothing was written.`,
             dryRun: true,
-            mentions
+            mentions,
+            created: plan.created
           };
         }
         const edits = this.writeMoveEdits([...plan.edits.values()]);
@@ -22562,9 +22761,10 @@ var init_specs2 = __esm({
           refusals: [],
           alternatives: [],
           notices: plan.notices,
-          summary: `Moved ${namedMethods(methods)} from "${from}" to "${to}": ${edits.length} spec${edits.length === 1 ? "" : "s"} written, ${repointed} reference${repointed === 1 ? "" : "s"} re-pointed${mentions.length ? `, ${mentions.length} still naming the old home in prose or on the wire` : ""}.`,
+          summary: `Moved ${namedMethods(methods)} from "${from}" to "${to}": ${edits.length} spec${edits.length === 1 ? "" : "s"} written${createdClause(plan.created, "created")}, ${repointed} reference${repointed === 1 ? "" : "s"} re-pointed${mentions.length ? `, ${mentions.length} still naming the old home in prose or on the wire` : ""}.`,
           dryRun: false,
-          mentions
+          mentions,
+          created: plan.created
         };
       }
       /**
@@ -22597,15 +22797,26 @@ var init_specs2 = __esm({
         }
         const receiving = this.moveTargetContract(to, ofTarget);
         if (typeof receiving === "string") return receiving;
-        const travelling = this.loadImplementationSpecs().some((impl) => ofSource.some((i) => i.id === impl.contract) && impl.methods.some((m) => methods.includes(m.name)));
-        if (travelling && !this.loadImplementationSpecs().some((i) => i.contract === receiving.id)) {
-          return `no implementation realizes "${receiving.id}", so the moved methods' narratives would have nowhere to arrive.`;
+        const contractId = receiving?.id ?? `i${to}`;
+        const holder = contracts.find((i) => i.id === contractId);
+        if (!receiving && holder) {
+          return `"${to}" declares no contract, and the one the move would create for it, "${contractId}", is already the id of "${holder.component}"'s contract \u2014 rename that contract, or give "${to}" its own first.`;
+        }
+        const implementations = this.loadImplementationSpecs();
+        const travelling = implementations.some((impl) => ofSource.some((i) => i.id === impl.contract) && impl.methods.some((m) => methods.includes(m.name)));
+        const implId = `${to}_impl`;
+        const implHolder = implementations.find((i) => i.id === implId);
+        if (travelling && !implementations.some((i) => i.contract === contractId) && implHolder) {
+          return `no implementation realizes "${contractId}", and the one the move would create for it, "${implId}", is already the id of the implementation of "${implHolder.contract}" \u2014 rename it, or realize "${contractId}" first.`;
         }
         return null;
       }
-      /** The contract of `to` that receives the methods, or why that cannot be decided. */
+      /**
+       * The contract of `to` that receives the methods; null when it declares none
+       * yet, so the move creates `i<to>`; or why the choice cannot be decided.
+       */
       moveTargetContract(to, ofTarget) {
-        if (ofTarget.length === 0) return `"${to}" declares no contract, so the methods would have nowhere to arrive.`;
+        if (ofTarget.length === 0) return null;
         if (ofTarget.length === 1) return ofTarget[0];
         const named = ofTarget.find((i) => i.id === `i${to}` || i.id.endsWith(`::i${to}`));
         return named ?? `"${to}" declares ${ofTarget.length} contracts and none is named "i${to}", so which one receives the methods is not decidable.`;
@@ -22618,7 +22829,7 @@ var init_specs2 = __esm({
        */
       planMethodMove(source, to, methods, contracts) {
         const target = this.loadComponentSpec(to);
-        const receiving = this.moveTargetContract(to, contracts.filter((i) => i.component === to));
+        const stated = this.moveTargetContract(to, contracts.filter((i) => i.component === to));
         const implementations = this.loadImplementationSpecs();
         const plan = {
           edits: /* @__PURE__ */ new Map(),
@@ -22627,10 +22838,13 @@ var init_specs2 = __esm({
           reach: [],
           newDependencies: [],
           wireBound: [],
-          notices: []
+          notices: [],
+          created: []
         };
+        const receiving = stated ?? createdContract(target, source.id, methods, contracts);
         const arriving = [];
         const travelling = [];
+        const realizedIn = /* @__PURE__ */ new Map();
         for (const contract of contracts.filter((i) => i.component === source.id)) {
           const leaving = contract.methods.filter((m) => methods.includes(m.name));
           if (leaving.length === 0) continue;
@@ -22645,17 +22859,19 @@ var init_specs2 = __esm({
             const moving = impl.methods.filter((m) => methods.includes(m.name));
             if (moving.length === 0) continue;
             travelling.push(...cloneSpec(moving));
+            for (const entry of moving) if (impl.sourcePath) realizedIn.set(entry.name, impl.sourcePath);
             const kept = cloneSpec(impl);
             kept.methods = kept.methods.filter((m) => !methods.includes(m.name));
             this.stageMoveEdit(plan, "implementation", impl.id, impl, kept);
           }
         }
-        this.stageMoveEdit(plan, "interface", receiving.id, receiving, {
+        this.stageMoveEdit(plan, "interface", receiving.id, stated, {
           ...cloneSpec(receiving),
           methods: [...cloneSpec(receiving.methods), ...arriving]
         });
+        if (!stated) plan.created.push(`interface "${receiving.id}"`);
         if (arriving.some((m) => m.endpoint)) plan.wireBound.push(receiving.id);
-        if (receiving.status !== void 0 && receiving.status !== statusOfContracts(contracts, source.id)) {
+        if (stated && receiving.status !== void 0 && receiving.status !== statusOfContracts(contracts, source.id)) {
           plan.notices.push(`"${receiving.id}" is ${receiving.status} where the methods came from a ${statusOfContracts(contracts, source.id)} contract \u2014 the status of a moved method is the status of its new home.`);
         }
         for (const entry of travelling) {
@@ -22665,10 +22881,21 @@ var init_specs2 = __esm({
         }
         const targetImpl = implementations.find((i) => i.contract === receiving.id);
         if (travelling.length > 0 && targetImpl) {
+          for (const entry of travelling) {
+            const file = realizedIn.get(entry.name);
+            if (entry.sourcePath || !file || file === targetImpl.sourcePath) continue;
+            entry.sourcePath = file;
+            plan.notices.push(`"${entry.name}" keeps ${file} as its own sourcePath: it was realized there by default, and "${targetImpl.id}" names ${targetImpl.sourcePath ? targetImpl.sourcePath : "no file"} \u2014 moving a method is not moving its code.`);
+          }
           this.stageMoveEdit(plan, "implementation", targetImpl.id, targetImpl, {
             ...cloneSpec(targetImpl),
             methods: [...cloneSpec(targetImpl.methods), ...travelling]
           });
+        } else if (travelling.length > 0) {
+          const created = createdImplementation(target, receiving.id, source.id, travelling, implementations, contracts);
+          this.stageMoveEdit(plan, "implementation", created.spec.id, null, created.spec);
+          plan.created.push(created.named);
+          plan.notices.push(...created.notices);
         }
         plan.reach = reachOf(travelling, source.id, new Set(methods)).filter((id) => id !== to);
         const held = /* @__PURE__ */ new Set([...target.dependsOn ?? [], ...target.owns ?? []]);
@@ -22712,6 +22939,9 @@ var init_specs2 = __esm({
           }
           this.stageMoveEdit(plan, kind, id, spec, subject);
         }
+        for (const edit of plan.edits.values()) {
+          if (edit.before === null) rewriteSpecRefs(edit.after, remap);
+        }
         plan.notices.push(...this.callersOwingADependency(to, plan));
         return repointed;
       }
@@ -22805,7 +23035,8 @@ var init_specs2 = __esm({
         } catch (e) {
           for (const edit of [...written].reverse()) {
             try {
-              this.saveMovedSpec(edit.kind, edit.before);
+              if (edit.before === null) this.delete(edit.kind, edit.id);
+              else this.saveMovedSpec(edit.kind, edit.before);
             } catch {
             }
           }
@@ -27760,8 +27991,8 @@ var require_dist = __commonJS({
     function slug(name) {
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
-    var fs58 = __toESM2(require("fs"));
-    var path72 = __toESM2(require("path"));
+    var fs59 = __toESM2(require("fs"));
+    var path73 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -27799,9 +28030,9 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path72.join(destDir, file.path);
-        fs58.mkdirSync(path72.dirname(absolute), { recursive: true });
-        fs58.writeFileSync(absolute, file.contents);
+        const absolute = path73.join(destDir, file.path);
+        fs59.mkdirSync(path73.dirname(absolute), { recursive: true });
+        fs59.writeFileSync(absolute, file.contents);
       }
     }
     function classifyKind(name, symlinks) {
@@ -27810,14 +28041,14 @@ var require_dist = __commonJS({
       return "file";
     }
     function walkPackDir(root, current2, out) {
-      for (const entry of fs58.readdirSync(current2, { withFileTypes: true })) {
+      for (const entry of fs59.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path72.join(current2, entry.name), out);
+          walkPackDir(root, path73.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path72.join(current2, entry.name);
-          const relative22 = path72.relative(root, absolute).split(path72.sep).join("/");
-          out.push({ path: relative22, contents: fs58.readFileSync(absolute) });
+          const absolute = path73.join(current2, entry.name);
+          const relative22 = path73.relative(root, absolute).split(path73.sep).join("/");
+          out.push({ path: relative22, contents: fs59.readFileSync(absolute) });
         }
       }
     }
@@ -28124,19 +28355,19 @@ function commitStagedTree(stagingDir, destDir, roots, backupExisting) {
   const backupDir = path28.join(root, BACKUP_DIR, timestampSlug());
   let backedUp = false;
   for (const rootRel of roots) {
-    const relative15 = rootRel === "." ? "" : rootRel;
-    const stagedSpecDir = path28.join(stagingDir, relative15, ".wai");
+    const relative16 = rootRel === "." ? "" : rootRel;
+    const stagedSpecDir = path28.join(stagingDir, relative16, ".wai");
     if (!fs18.existsSync(stagedSpecDir)) continue;
-    const liveSpecDir = liveSpecDirFor(path28.join(root, relative15));
+    const liveSpecDir = liveSpecDirFor(path28.join(root, relative16));
     if (backupExisting && liveSpecDir && fs18.existsSync(liveSpecDir)) {
-      const backupTarget = path28.join(backupDir, relative15, path28.basename(liveSpecDir));
+      const backupTarget = path28.join(backupDir, relative16, path28.basename(liveSpecDir));
       fs18.mkdirSync(path28.dirname(backupTarget), { recursive: true });
       fs18.renameSync(liveSpecDir, backupTarget);
       backedUp = true;
     } else if (liveSpecDir && fs18.existsSync(liveSpecDir)) {
       fs18.rmSync(liveSpecDir, { recursive: true, force: true });
     }
-    const target = path28.join(root, relative15, ".wai");
+    const target = path28.join(root, relative16, ".wai");
     fs18.mkdirSync(path28.dirname(target), { recursive: true });
     if (fs18.existsSync(target)) fs18.rmSync(target, { recursive: true, force: true });
     fs18.renameSync(stagedSpecDir, target);
@@ -29851,6 +30082,78 @@ var init_authoring2 = __esm({
   }
 });
 
+// src/mcp/build.ts
+function captureBuildStamp(entryPath) {
+  try {
+    const s = fs21.statSync(entryPath);
+    return { path: entryPath, mtimeMs: s.mtimeMs, size: s.size };
+  } catch {
+    return null;
+  }
+}
+function isBuildStale(stamp) {
+  if (!stamp) return false;
+  try {
+    const s = fs21.statSync(stamp.path);
+    return s.mtimeMs !== stamp.mtimeMs || s.size !== stamp.size;
+  } catch {
+    return false;
+  }
+}
+function readBuildFingerprint(stamp) {
+  const current2 = fs21.statSync(stamp.path);
+  const key = `${stamp.path}|${current2.mtimeMs}|${current2.size}`;
+  const cached = fingerprintCache.get(key);
+  if (cached !== void 0) return cached;
+  const modulePath = fingerprintModuleFor(stamp.path);
+  const loaderFlags = modulePath.endsWith(".ts") ? process.execArgv : [];
+  let printed;
+  try {
+    printed = (0, import_child_process3.execFileSync)(
+      process.execPath,
+      [...loaderFlags, "-e", "const m = require(process.argv[1]); process.stdout.write(String(m.schemaFingerprint()));", modulePath],
+      { encoding: "utf8", timeout: 6e4, stdio: ["ignore", "pipe", "pipe"], windowsHide: true }
+    ).trim();
+  } catch (e) {
+    const stderr = String(e.stderr ?? "").split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const cause = stderr.find((l) => /^[A-Za-z]*Error\b/.test(l)) ?? stderr[0] ?? e.message;
+    throw new Error(`the build at ${modulePath} could not be asked for its schema fingerprint (${cause})`);
+  }
+  if (!printed) throw new Error(`the build at ${modulePath} answered no schema fingerprint`);
+  fingerprintCache.set(key, printed);
+  return printed;
+}
+function fingerprintModuleFor(entryPath) {
+  let dir = path32.dirname(entryPath);
+  for (; ; ) {
+    const manifest = path32.join(dir, "package.json");
+    if (fs21.existsSync(manifest)) {
+      try {
+        const pkg = JSON.parse(fs21.readFileSync(manifest, "utf8"));
+        const inDist = path32.relative(path32.join(dir, "dist"), entryPath);
+        if (pkg.name === "@wairon/cli" && pkg.main && !inDist.startsWith("..") && !path32.isAbsolute(inDist)) {
+          return path32.resolve(dir, pkg.main);
+        }
+      } catch {
+      }
+      return entryPath;
+    }
+    const parent = path32.dirname(dir);
+    if (parent === dir) return entryPath;
+    dir = parent;
+  }
+}
+var fs21, path32, import_child_process3, fingerprintCache;
+var init_build = __esm({
+  "src/mcp/build.ts"() {
+    "use strict";
+    fs21 = __toESM(require("fs"));
+    path32 = __toESM(require("path"));
+    import_child_process3 = require("child_process");
+    fingerprintCache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/mcp/adapters/skills.ts
 var init_skills2 = __esm({
   "src/mcp/adapters/skills.ts"() {
@@ -29878,10 +30181,10 @@ var init_validator = __esm({
 // src/mcp/server.ts
 var server_exports = {};
 __export(server_exports, {
-  captureBuildStamp: () => captureBuildStamp,
+  assessBuildFreshness: () => assessBuildFreshness,
   createMcpServer: () => createMcpServer,
-  isBuildStale: () => isBuildStale,
   markStale: () => markStale,
+  schemaFingerprint: () => schemaFingerprint,
   startMcpServer: () => startMcpServer,
   statusFamilyContext: () => statusFamilyContext
 });
@@ -29954,7 +30257,7 @@ function json(value) {
   return text(JSON.stringify(value, null, 2));
 }
 function errText(message) {
-  return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
+  return { content: [{ type: "text", text: `Error: ${message.replace(/^(?:\s*Error:\s*)+/, "")}` }], isError: true };
 }
 function errMessage(e) {
   return errText(e instanceof Error ? e.message : String(e));
@@ -30001,40 +30304,134 @@ NOTICE:
   return structured(`${sentence}${noticeBlock}${testsBlock ? `
 ${testsBlock}` : ""}`, receipt);
 }
-function captureBuildStamp(entryPath) {
+function schemaShape(schema, seen = /* @__PURE__ */ new Map()) {
+  const def = schema?._def;
+  if (!def) return null;
+  const known = seen.get(schema);
+  if (known !== void 0) return { ref: known };
+  seen.set(schema, seen.size);
+  const inner = (s) => schemaShape(s, seen);
+  const kind = String(def.typeName);
+  switch (kind) {
+    case "ZodObject": {
+      const shape = typeof def.shape === "function" ? def.shape() : def.shape;
+      return {
+        kind,
+        keys: Object.keys(shape).sort().map((key) => [key, inner(shape[key])]),
+        unknownKeys: def.unknownKeys,
+        catchall: inner(def.catchall)
+      };
+    }
+    case "ZodArray":
+      return { kind, of: inner(def.type), min: def.minLength?.value, max: def.maxLength?.value };
+    case "ZodOptional":
+    case "ZodNullable":
+    case "ZodReadonly":
+    case "ZodBranded":
+    case "ZodCatch":
+      return { kind, of: inner(def.innerType ?? def.type) };
+    case "ZodDefault":
+      return { kind, of: inner(def.innerType), default: JSON.stringify(def.defaultValue?.()) };
+    case "ZodEffects":
+      return { kind, effect: def.effect?.type, of: inner(def.schema) };
+    case "ZodLazy":
+      return { kind, of: inner(def.getter()) };
+    case "ZodUnion":
+    case "ZodDiscriminatedUnion": {
+      const options = def.options instanceof Map ? [...def.options.values()] : def.options;
+      return { kind, discriminator: def.discriminator, of: options.map(inner) };
+    }
+    case "ZodIntersection":
+      return { kind, left: inner(def.left), right: inner(def.right) };
+    case "ZodTuple":
+      return { kind, of: def.items.map(inner), rest: inner(def.rest) };
+    case "ZodRecord":
+    case "ZodMap":
+      return { kind, key: inner(def.keyType), value: inner(def.valueType) };
+    case "ZodSet":
+      return { kind, of: inner(def.valueType) };
+    case "ZodEnum":
+      return { kind, values: def.values };
+    case "ZodNativeEnum":
+      return { kind, values: def.values };
+    case "ZodLiteral":
+      return { kind, value: def.value };
+    case "ZodPipeline":
+      return { kind, in: inner(def.in), out: inner(def.out) };
+    default:
+      return { kind, checks: def.checks?.map((c) => [c.kind, c.value ?? null]) ?? [] };
+  }
+}
+function schemaFingerprint() {
+  if (runningFingerprint !== void 0) return runningFingerprint;
+  const specs = {
+    system: schemaShape(SystemSpecSchema),
+    subsystem: schemaShape(SubsystemSpecSchema),
+    component: schemaShape(ComponentSpecSchema),
+    interface: schemaShape(InterfaceSpecSchema),
+    implementation: schemaShape(ImplementationSpecSchema),
+    type: schemaShape(TypeSpecSchema)
+  };
+  const registered = createMcpServer()._registeredTools;
+  const tools = [...SPEC_WRITE_TOOLS].sort().map((name) => [name, schemaShape(registered[name]?.inputSchema)]);
+  runningFingerprint = crypto5.createHash("sha256").update(JSON.stringify({ version: FINGERPRINT_VERSION, specs, tools })).digest("hex");
+  return runningFingerprint;
+}
+function assessBuildFreshness(stamp) {
+  if (!isBuildStale(stamp)) return { state: "fresh", writesRefused: false, reason: "" };
+  const running = schemaFingerprint();
+  let onDisk;
   try {
-    const s = fs21.statSync(entryPath);
-    return { path: entryPath, mtimeMs: s.mtimeMs, size: s.size };
-  } catch {
-    return null;
+    onDisk = readBuildFingerprint(stamp);
+  } catch (e) {
+    return {
+      state: "unreadable",
+      writesRefused: true,
+      reason: `the wairon build on disk changed after this MCP server started, and its schemas could not be compared (${e instanceof Error ? e.message : String(e)}), so a schema change cannot be ruled out. Every spec write through this server is REFUSED and writes nothing. ${RECONNECT}`
+    };
   }
-}
-function isBuildStale(stamp) {
-  if (!stamp) return false;
-  try {
-    const s = fs21.statSync(stamp.path);
-    return s.mtimeMs !== stamp.mtimeMs || s.size !== stamp.size;
-  } catch {
-    return false;
+  if (onDisk === running) {
+    return {
+      state: "build-changed",
+      writesRefused: false,
+      reason: "the wairon build on disk changed after this MCP server started. Its spec and tool schemas did not change, so spec writes still go through; reconnect the server (/mcp reconnect wairon) to run the new code."
+    };
   }
+  return {
+    state: "schema-changed",
+    writesRefused: true,
+    reason: `the wairon build on disk changed after this MCP server started, and its spec or tool schemas changed with it. A write through this server would silently drop the fields only the new build knows, so every spec write is REFUSED and writes nothing. ${RECONNECT}`
+  };
 }
-function markStale(result) {
-  const marked = result.structuredContent ? { ...result, structuredContent: { ...result.structuredContent, staleServer: true } } : result;
+function markStale(result, freshness = assessedAsChanged, placement = "trail") {
+  const marked = result.structuredContent ? {
+    ...result,
+    structuredContent: {
+      ...result.structuredContent,
+      staleServer: true,
+      ...freshness.writesRefused ? { writesRefused: true } : {}
+    }
+  } : result;
+  const banner = `\u26A0 STALE SERVER: ${freshness.reason}`;
   const first = marked.content?.[0];
   if (first && first.type === "text") {
-    return {
-      ...marked,
-      content: [{ ...first, text: `${first.text}${STALE_SERVER_WARNING}` }, ...marked.content.slice(1)]
-    };
+    const textWithBanner = placement === "lead" ? `${banner}
+
+${first.text}` : `${first.text}
+
+${banner}`;
+    return { ...marked, content: [{ ...first, text: textWithBanner }, ...marked.content.slice(1)] };
   }
   return marked;
 }
-function withStaleWarning(result) {
-  return isBuildStale(SERVER_BUILD_STAMP) ? markStale(result) : result;
-}
 function reg(server, name, config, cb) {
   const guarded = (args) => {
-    const result = withStaleWarning(cb(args));
+    const freshness = assessBuildFreshness(serverBuildStamps.get(server) ?? null);
+    if (freshness.writesRefused && SPEC_WRITE_TOOLS.has(name)) {
+      return errText(`${name} refused \u2014 ${freshness.reason}`);
+    }
+    const answered = cb(args);
+    const result = freshness.state === "fresh" ? answered : markStale(answered, freshness, name === "sdd_get_status" ? "lead" : "trail");
     if (result.isError !== true && SPEC_WRITE_TOOLS.has(name)) listChangedEmitters.get(server)?.();
     return result;
   };
@@ -30152,6 +30549,7 @@ function createMcpServer(options = {}) {
   }, {
     instructions: buildServerInstructions2()
   });
+  serverBuildStamps.set(server, options.buildStamp === void 0 ? SERVER_BUILD_STAMP : options.buildStamp);
   if (!options.hostedTools) {
     listChangedEmitters.set(server, () => {
       try {
@@ -30531,7 +30929,7 @@ ${renderChangeReport(report2)}`,
     server,
     "sdd_move_methods",
     {
-      description: "Move contract methods from one component to another, carrying each method's narrative, calls and bindings, and re-pointing every reference that named the old home: narrative call/register/dispatch steps, dispatch-table bindings, lifecycle entrypoints and `calls` entries. The target gains the dependencies the moved narratives call. ONE all-or-nothing gated write: if a rule refuses the move nothing is written and the report names the rule plus where these methods could live instead, cheapest legal home first, with the requested target among them so its shortfall reads beside the others. Prose is never rewritten and a wire endpoint keeps its address \u2014 moving a method between components must not silently re-address an RPC; both are reported as mentions. Refuses before the first write (unmovable request): a component or method that does not exist, a method name already declared on the target, a source and target that are the same component, and a component inside a chained subproject (move it from that project's own root). A dry run runs the whole move, gate included, and reports what it would have done.",
+      description: "Move contract methods from one component to another, carrying each method's narrative, calls and bindings, and re-pointing every reference that named the old home: narrative call/register/dispatch steps, dispatch-table bindings, lifecycle entrypoints and `calls` entries. The target gains the dependencies the moved narratives call. ONE all-or-nothing gated write: if a rule refuses the move nothing is written and the report names the rule plus where these methods could live instead, cheapest legal home first, with the requested target among them so its shortfall reads beside the others. Prose is never rewritten and a wire endpoint keeps its address \u2014 moving a method between components must not silently re-address an RPC; both are reported as mentions. A target that declares no contract yet receives one, i<target>, and when implementation entries travel and no implementation realizes the receiving contract, <target>_impl is created for them, inheriting the source implementation's sourcePath; the report's `created` names every spec the move created. Refuses before the first write (unmovable request): a component or method that does not exist, a method name already declared on the target, a source and target that are the same component, a target with several contracts none named i<target>, a contract or implementation to create whose id another spec already holds, and a component inside a chained subproject (move it from that project's own root). A dry run runs the whole move, gate included, and reports what it would have done.",
       inputSchema: {
         from: import_zod11.z.string().describe("The component the methods belong to (namespaced if needed)"),
         to: import_zod11.z.string().describe("The component that should receive them (namespaced if needed)"),
@@ -31291,7 +31689,7 @@ async function scopeToClientWorkspace(server) {
     } catch {
       dir = null;
     }
-    if (dir && (fs21.existsSync(path32.join(dir, ".wai")) || fs21.existsSync(path32.join(dir, ".wairon")))) {
+    if (dir && (fs22.existsSync(path33.join(dir, ".wai")) || fs22.existsSync(path33.join(dir, ".wairon")))) {
       setProjectRoot(dir);
       process.stderr.write(`[wairon mcp] scoped to client workspace root: ${dir}
 `);
@@ -31315,7 +31713,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod11, import_types4, fs21, path32, import_url, TYPE_REF_GRAMMAR, staleServerOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, validateTreeOutput, getSpecOutput, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod11, import_types4, fs22, path33, import_url, crypto5, TYPE_REF_GRAMMAR, staleServerOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, validateTreeOutput, getSpecOutput, FINGERPRINT_VERSION, runningFingerprint, RECONNECT, assessedAsChanged, serverBuildStamps, SERVER_BUILD_STAMP, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -31323,25 +31721,31 @@ var init_server = __esm({
     import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
     import_zod11 = require("zod");
     import_types4 = require("@modelcontextprotocol/sdk/types.js");
-    fs21 = __toESM(require("fs"));
-    path32 = __toESM(require("path"));
+    fs22 = __toESM(require("fs"));
+    path33 = __toESM(require("path"));
     import_url = require("url");
     init_fs();
     init_yaml();
     init_errors();
     init_defaults();
+    crypto5 = __toESM(require("crypto"));
+    init_specs();
     init_specs();
     init_paths();
     init_execution();
     init_core2();
     init_authoring2();
+    init_build();
     init_skills2();
     init_surfaces2();
     init_validator();
     TYPE_REF_GRAMMAR = (what) => `${what}: a primitive/builtin or a defined type id (qualified across subsystems, e.g. "billing.Invoice" or "billing::Invoice"). Generics, arrays and UNIONS are all read, at any depth: "Invoice | null" (the commonest shape there is), "Invoice | undefined", "Invoice | Receipt", "Promise<Invoice | null>", "Map<string, Invoice | null>", "Invoice[] | null", "(Invoice | null)[]". Every identifier the string names must resolve \u2014 a union of two defined types means BOTH must exist. A union of string literals ("read" | "write") names no type and resolves to nothing.`;
     staleServerOutput = {
       staleServer: import_zod11.z.boolean().optional().describe(
-        "True when the wairon build on disk changed after this server started \u2014 the structured twin of the text answer's STALE SERVER banner. Writes through a stale process can silently drop fields a newer schema introduced: restart the MCP session before editing further."
+        "True when the wairon build on disk changed after this server started \u2014 the structured twin of the text answer's STALE SERVER banner. When the rebuild left the spec and tool schemas alone, writes still go through; reconnect to run the new code."
+      ),
+      writesRefused: import_zod11.z.boolean().optional().describe(
+        "True when the rebuild changed a spec or tool schema (or its schemas could not be compared): every spec write through this server is refused and writes nothing, because it would silently drop the fields only the new build knows. The human has to reconnect the server (/mcp reconnect wairon)."
       )
     };
     SPEC_KINDS = ["system", "subsystem", "component", "interface", "implementation", "type"];
@@ -31383,7 +31787,9 @@ var init_server = __esm({
     };
     specChangeOutput = {
       path: import_zod11.z.string().describe("The dotted path the change addresses, with names and indexes."),
-      change: import_zod11.z.enum(["set", "added", "removed", "cleared"]).describe("What happened at that path."),
+      change: import_zod11.z.enum(["set", "added", "removed", "cleared", "renumbered", "relocated"]).describe(
+        "What happened at that path. A narrative is compared by step identity: `renumbered` is a run of unchanged steps shifted by an insert or delete (before/after name the ranges), `relocated` a jump field that followed its target to the target's new number."
+      ),
       before: import_zod11.z.string().optional().describe("The previous value, summarized; absent when there was none."),
       after: import_zod11.z.string().optional().describe("The new value, summarized; absent when there is none.")
     };
@@ -31455,8 +31861,15 @@ var init_server = __esm({
       ),
       ...staleServerOutput
     };
+    FINGERPRINT_VERSION = 1;
+    RECONNECT = "The human has to reconnect this MCP server (in Claude Code: /mcp reconnect wairon) \u2014 an agent cannot.";
+    assessedAsChanged = {
+      state: "build-changed",
+      writesRefused: false,
+      reason: "the wairon build on disk changed after this MCP server started. Reconnect the server (/mcp reconnect wairon) before further spec edits \u2014 a write through a stale server can silently drop fields a newer schema introduced."
+    };
+    serverBuildStamps = /* @__PURE__ */ new WeakMap();
     SERVER_BUILD_STAMP = captureBuildStamp(__filename);
-    STALE_SERVER_WARNING = "\n\n\u26A0 STALE SERVER: the wairon build on disk changed after this MCP server started. Restart the MCP session (e.g. /mcp reconnect) before further spec edits \u2014 writes through a stale server can silently drop fields introduced by newer schemas.";
     SPEC_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "sdd_initialize_system",
       "sdd_add_subsystem",
@@ -31473,7 +31886,8 @@ var init_server = __esm({
       "sdd_write_narrative",
       "sdd_add_type",
       "sdd_delete_spec",
-      "sdd_update_spec"
+      "sdd_update_spec",
+      "sdd_move_methods"
     ]);
     listChangedEmitters = /* @__PURE__ */ new WeakMap();
     statusInput = import_zod11.z.enum(STATUS_VALUES).optional().describe(
@@ -31497,34 +31911,34 @@ __export(mcp_exports, {
   validateConfigDir: () => validateConfigDir
 });
 function geminiGlobalDir(override) {
-  return override || process.env["GEMINI_CONFIG_DIR"] || path33.join(os7.homedir(), ".gemini");
+  return override || process.env["GEMINI_CONFIG_DIR"] || path34.join(os7.homedir(), ".gemini");
 }
 function claudeMcpConfigPath(useGlobal, override) {
-  if (!useGlobal) return path33.join(process.cwd(), ".mcp.json");
+  if (!useGlobal) return path34.join(process.cwd(), ".mcp.json");
   const dir = override || process.env["CLAUDE_CONFIG_DIR"];
-  return dir ? path33.join(dir, ".claude.json") : path33.join(os7.homedir(), ".claude.json");
+  return dir ? path34.join(dir, ".claude.json") : path34.join(os7.homedir(), ".claude.json");
 }
 function validateConfigDir(dir, backend) {
-  const resolved = path33.resolve(dir);
+  const resolved = path34.resolve(dir);
   const agent = backend === "claude" ? "Claude" : "Gemini/Antigravity";
-  if (!fs22.existsSync(resolved)) {
-    const parent = path33.dirname(resolved);
-    if (!fs22.existsSync(parent)) {
+  if (!fs23.existsSync(resolved)) {
+    const parent = path34.dirname(resolved);
+    if (!fs23.existsSync(parent)) {
       throw new WaironError(`--config-dir "${dir}" does not exist and its parent is missing \u2014 check the path.`);
     }
     logger.warn(`Config dir "${resolved}" does not exist yet; it will be created.`);
     return;
   }
-  if (!fs22.statSync(resolved).isDirectory()) {
+  if (!fs23.statSync(resolved).isDirectory()) {
     throw new WaironError(`--config-dir "${dir}" is not a directory.`);
   }
   const markers = backend === "claude" ? ["settings.json", "settings.local.json", ".credentials.json", "projects", "statsig", "todos", "shell-snapshots", "CLAUDE.md"] : ["settings.json", "GEMINI.md", "oauth_creds.json", "antigravity-cli", "tmp"];
-  const entries = fs22.readdirSync(resolved);
+  const entries = fs23.readdirSync(resolved);
   if (entries.length === 0) {
     logger.warn(`Config dir "${resolved}" is empty; proceeding (treating it as a fresh ${agent} config dir).`);
     return;
   }
-  if (!markers.some((m) => fs22.existsSync(path33.join(resolved, m)))) {
+  if (!markers.some((m) => fs23.existsSync(path34.join(resolved, m)))) {
     throw new WaironError(
       `"${dir}" does not look like a ${agent} config directory (none of ${markers.slice(0, 4).join(", ")} found). Point --config-dir at the agent's config directory.`
     );
@@ -31532,12 +31946,12 @@ function validateConfigDir(dir, backend) {
 }
 async function runMcpServe() {
   const { setProjectRoot: setProjectRoot2, getProjectRoot: getProjectRoot2, findProjectRoot: findProjectRoot2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
-  const cwd = path33.resolve(process.cwd());
+  const cwd = path34.resolve(process.cwd());
   const envDir = process.env["WAIRON_PROJECT_DIR"];
   let resolved;
   let how;
-  if (envDir && fs22.existsSync(path33.join(envDir, ".wai"))) {
-    resolved = path33.resolve(envDir);
+  if (envDir && fs23.existsSync(path34.join(envDir, ".wai"))) {
+    resolved = path34.resolve(envDir);
     how = "WAIRON_PROJECT_DIR (pinned at install)";
   } else {
     const found = findProjectRoot2(cwd);
@@ -31563,18 +31977,18 @@ async function runMcpServe() {
 }
 function mcpConfigCandidates(cwd) {
   return [
-    path33.join(cwd, ".mcp.json"),
+    path34.join(cwd, ".mcp.json"),
     claudeMcpConfigPath(true),
-    path33.join(cwd, ".gemini", "settings.json"),
-    path33.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json")
+    path34.join(cwd, ".gemini", "settings.json"),
+    path34.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json")
   ];
 }
 function detectHostedMcpSource(cwd = process.cwd()) {
   for (const configPath3 of mcpConfigCandidates(cwd)) {
     let entry;
     try {
-      if (!fs22.existsSync(configPath3)) continue;
-      const parsed = JSON.parse(fs22.readFileSync(configPath3, "utf8"));
+      if (!fs23.existsSync(configPath3)) continue;
+      const parsed = JSON.parse(fs23.readFileSync(configPath3, "utf8"));
       entry = parsed.mcpServers?.["wairon"];
     } catch {
       continue;
@@ -31653,20 +32067,20 @@ async function runMcpInstall(options = {}) {
     let settingsPath;
     if (backend === "gemini") {
       if (useGlobal) {
-        configBase = path33.join(geminiGlobalDir(options.configDir), "antigravity-cli");
-        settingsPath = path33.join(configBase, "mcp_config.json");
+        configBase = path34.join(geminiGlobalDir(options.configDir), "antigravity-cli");
+        settingsPath = path34.join(configBase, "mcp_config.json");
       } else {
-        configBase = path33.join(process.cwd(), ".gemini");
-        settingsPath = path33.join(configBase, "settings.json");
+        configBase = path34.join(process.cwd(), ".gemini");
+        settingsPath = path34.join(configBase, "settings.json");
       }
     } else {
       settingsPath = claudeMcpConfigPath(useGlobal, options.configDir);
-      configBase = path33.dirname(settingsPath);
+      configBase = path34.dirname(settingsPath);
     }
     let settings = {};
-    if (fs22.existsSync(settingsPath)) {
+    if (fs23.existsSync(settingsPath)) {
       try {
-        settings = JSON.parse(fs22.readFileSync(settingsPath, "utf8"));
+        settings = JSON.parse(fs23.readFileSync(settingsPath, "utf8"));
       } catch {
         logger.warn(`Could not parse ${settingsPath} \u2014 starting fresh.`);
       }
@@ -31674,7 +32088,7 @@ async function runMcpInstall(options = {}) {
     const mcpServers = settings["mcpServers"] ?? {};
     const agentLabel = backend === "gemini" ? "Antigravity" : "Claude";
     const isPackaged = typeof process.pkg !== "undefined";
-    const scriptPath = process.argv[1] ? path33.resolve(process.argv[1]).replace(/\\/g, "/") : null;
+    const scriptPath = process.argv[1] ? path34.resolve(process.argv[1]).replace(/\\/g, "/") : null;
     const useDirectNode = !isPackaged && scriptPath && (scriptPath.endsWith(".js") || scriptPath.endsWith(".ts"));
     const env = useGlobal ? {} : { WAIRON_PROJECT_DIR: process.cwd().replace(/\\/g, "/") };
     const desiredEntry = options.hostedUrl ? hostedMcpEntry(options) : useDirectNode ? { command: "node", args: [scriptPath, "mcp", "serve"], env } : { command: "wairon", args: ["mcp", "serve"], env };
@@ -31686,8 +32100,8 @@ async function runMcpInstall(options = {}) {
     const wasStale = !!existingEntry;
     mcpServers["wairon"] = desiredEntry;
     settings["mcpServers"] = mcpServers;
-    if (!fs22.existsSync(configBase)) fs22.mkdirSync(configBase, { recursive: true });
-    fs22.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    if (!fs23.existsSync(configBase)) fs23.mkdirSync(configBase, { recursive: true });
+    fs23.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     logger.success(`wairon MCP server ${wasStale ? "updated (was stale)" : "registered"} for ${agentLabel} in ${import_chalk3.default.cyan(settingsPath)}.`);
     logger.blank();
     logger.info("AI tools using this config will have access to these wairon tools:");
@@ -31713,8 +32127,8 @@ async function runMcpStatus() {
   if (!projectConfig) throw new ProjectNotInitializedError();
   const claudeProject = claudeMcpConfigPath(false);
   const claudeGlobal = claudeMcpConfigPath(true);
-  const geminiProject = path33.join(process.cwd(), ".gemini", "settings.json");
-  const geminiGlobal = path33.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
+  const geminiProject = path34.join(process.cwd(), ".gemini", "settings.json");
+  const geminiGlobal = path34.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
   logger.blank();
   logger.info(`${import_chalk3.default.bold("wairon MCP Server")}`);
   logger.blank();
@@ -31725,12 +32139,12 @@ async function runMcpStatus() {
     { label: "Antigravity (global)", filePath: geminiGlobal, fallbackName: "mcp_config.json" }
   ];
   for (const { label, filePath, fallbackName } of checks) {
-    if (!fs22.existsSync(filePath)) {
+    if (!fs23.existsSync(filePath)) {
       console.log(`  ${label}: ${import_chalk3.default.gray(`${fallbackName} not found`)}`);
       continue;
     }
     try {
-      const s = JSON.parse(fs22.readFileSync(filePath, "utf8"));
+      const s = JSON.parse(fs23.readFileSync(filePath, "utf8"));
       const registered = !!s["mcpServers"]?.["wairon"];
       const mark = registered ? import_chalk3.default.green("\u2713 registered") : import_chalk3.default.gray("not registered");
       console.log(`  ${label}: ${mark}  ${import_chalk3.default.gray(filePath)}`);
@@ -31746,7 +32160,7 @@ async function runMcpStatus() {
   logger.info(`To start manually: ${import_chalk3.default.bold("wairon mcp serve")}`);
   logger.blank();
   const mcpDir = aiDir("mcp");
-  if (fs22.existsSync(mcpDir)) {
+  if (fs23.existsSync(mcpDir)) {
     logger.info(`MCP state dir: ${import_chalk3.default.gray(mcpDir)}`);
   }
 }
@@ -31764,10 +32178,10 @@ function hostedMcpEntry(options) {
 }
 function removeLegacyGlobalPlugin() {
   const home = process.env["USERPROFILE"] ?? process.env["HOME"] ?? os7.homedir();
-  const pluginDir = path33.join(home, ".gemini", "config", "plugins", "wairon");
+  const pluginDir = path34.join(home, ".gemini", "config", "plugins", "wairon");
   try {
-    if (fs22.existsSync(pluginDir)) {
-      fs22.rmSync(pluginDir, { recursive: true, force: true });
+    if (fs23.existsSync(pluginDir)) {
+      fs23.rmSync(pluginDir, { recursive: true, force: true });
       logger.info(`Removed legacy global Antigravity plugin at ${import_chalk3.default.gray(pluginDir)} (it collides with the wairon MCP server).`);
       return true;
     }
@@ -31776,13 +32190,13 @@ function removeLegacyGlobalPlugin() {
   }
   return false;
 }
-var fs22, os7, path33, import_chalk3;
+var fs23, os7, path34, import_chalk3;
 var init_mcp = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
-    fs22 = __toESM(require("fs"));
+    fs23 = __toESM(require("fs"));
     os7 = __toESM(require("os"));
-    path33 = __toESM(require("path"));
+    path34 = __toESM(require("path"));
     import_chalk3 = __toESM(require("chalk"));
     init_logger();
     init_paths();
@@ -31794,7 +32208,7 @@ var init_mcp = __esm({
 });
 
 // src/cli/index.ts
-var path71 = __toESM(require("path"));
+var path72 = __toESM(require("path"));
 var import_commander = require("commander");
 init_defaults();
 init_logger();
@@ -32016,7 +32430,7 @@ function isSupportedAlias(name) {
 }
 
 // src/commands/init.ts
-var path34 = __toESM(require("path"));
+var path35 = __toESM(require("path"));
 var import_chalk4 = __toESM(require("chalk"));
 var import_inquirer = __toESM(require("inquirer"));
 init_logger();
@@ -32041,7 +32455,7 @@ async function runInit(options = {}) {
   logger.header("wairon init");
   const cwd = process.cwd();
   const ancestorRoot = findSystemRoot(cwd);
-  if (ancestorRoot && path34.resolve(ancestorRoot) === path34.resolve(cwd)) {
+  if (ancestorRoot && path35.resolve(ancestorRoot) === path35.resolve(cwd)) {
     logger.info("Project already initialized.");
     logger.info("Design your spec tree with the SDD architect skill, then run `wairon generate`.");
     return;
@@ -32057,8 +32471,8 @@ async function runInit(options = {}) {
   await runInitInteractive();
 }
 async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
-  const relPath = path34.relative(parentRoot, cwd) || ".";
-  const defaultId = path34.basename(cwd);
+  const relPath = path35.relative(parentRoot, cwd) || ".";
+  const defaultId = path35.basename(cwd);
   logger.info(`Detected a parent wairon project at ${parentRoot}`);
   logger.info(`This directory ("${relPath}") is not yet a wairon project.`);
   if (!options.yes) {
@@ -32114,7 +32528,7 @@ async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
 }
 async function runInitNonInteractive() {
   const cwd = process.cwd();
-  const projectName = path34.basename(cwd);
+  const projectName = path35.basename(cwd);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const targets = [defaultTargetConfig("claude"), defaultTargetConfig("agy")];
   const projectConfig = buildProjectConfig(projectName, targets, now, "backend");
@@ -32134,7 +32548,7 @@ async function runInitNonInteractive() {
 }
 async function runInitInteractive() {
   const cwd = process.cwd();
-  const defaultProjectName = path34.basename(cwd);
+  const defaultProjectName = path35.basename(cwd);
   const { projectName } = await import_inquirer.default.prompt([
     {
       type: "input",
@@ -32279,7 +32693,7 @@ async function executeInit(projectName, projectConfig, guidePlan) {
   if (guidePlan.claudeLocal) {
     const p = localGuideFilePath(projectRoot2, "claude");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path34.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path35.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "claude");
     logger.success(`Created root CLAUDE.md delegator pointing to .claude/CLAUDE.md`);
   }
@@ -32291,7 +32705,7 @@ async function executeInit(projectName, projectConfig, guidePlan) {
   if (guidePlan.geminiLocal) {
     const p = localGuideFilePath(projectRoot2, "gemini");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path34.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path35.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "gemini");
     logger.success(`Created root GEMINI.md delegator pointing to .gemini/GEMINI.md`);
   }
@@ -32506,8 +32920,8 @@ A new project initialized with Wairon.
 }
 
 // src/commands/generate.ts
-var fs23 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 init_logger();
 init_paths();
 init_errors();
@@ -32516,29 +32930,29 @@ init_fs();
 init_project();
 var WAIRON_AGENT_FILE = /-(owner|implementer|architect)\.md$/;
 function pruneStaleAgents(expectedPaths, scanDirs) {
-  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path35.dirname(p)));
+  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path36.dirname(p)));
   let pruned = 0;
   for (const dir of dirs) {
     let entries;
     try {
-      entries = fs23.readdirSync(dir);
+      entries = fs24.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (!name.endsWith(".md")) continue;
-      const full = path35.resolve(dir, name);
+      const full = path36.resolve(dir, name);
       if (expectedPaths.has(full)) continue;
       let owned = WAIRON_AGENT_FILE.test(name);
       if (!owned) {
         try {
-          owned = fs23.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
+          owned = fs24.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
         } catch {
           owned = false;
         }
       }
       if (!owned) continue;
-      fs23.unlinkSync(full);
+      fs24.unlinkSync(full);
       pruned++;
       logger.verbose(`Pruned stale: ${full}`);
     }
@@ -32552,7 +32966,7 @@ async function runGenerate(options = {}) {
   const children = listDirectChainedSubprojects(getProjectRoot());
   for (const child of children) {
     logger.blank();
-    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path35.relative(getProjectRoot(), child.dir) || "."}/`);
+    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path36.relative(getProjectRoot(), child.dir) || "."}/`);
     await runWithProjectRoot(child.dir, async () => {
       ensureProjectInitialized(child.subsystemId);
       await runGenerate(options);
@@ -32573,7 +32987,7 @@ async function generateLayer(options = {}) {
   } else if (options.dryRun) {
     logger.info("Dry run \u2014 rules.materializeAgentFiles is off: no agent files are written; leftover managed files would be removed.");
   } else if (options.prune !== false) {
-    const candidateDirs = [...resolveExpectedOutputPaths(agents, projectConfig)].map((p) => path35.dirname(p));
+    const candidateDirs = [...resolveExpectedOutputPaths(agents, projectConfig)].map((p) => path36.dirname(p));
     const removed = pruneStaleAgents(/* @__PURE__ */ new Set(), candidateDirs);
     if (removed > 0) {
       logger.info(`Removed ${removed} previously materialized agent file(s) \u2014 agents are served as live briefs (sdd_get_agent_brief); opt back in with rules.materializeAgentFiles: true.`);
@@ -32658,7 +33072,7 @@ function materializeAgentLayer(agents, projectConfig, options) {
 var import_inquirer2 = __toESM(require("inquirer"));
 init_logger();
 init_defaults();
-var path36 = __toESM(require("path"));
+var path37 = __toESM(require("path"));
 init_core();
 init_lock();
 init_fs();
@@ -32733,7 +33147,7 @@ async function runLock(options = {}, gate) {
   const root = getProjectRoot();
   const scope = options.subsystem ? {
     paths: new Set(
-      specPathsInScope(options.subsystem).map((p) => path36.relative(root, p).split(path36.sep).join("/"))
+      specPathsInScope(options.subsystem).map((p) => path37.relative(root, p).split(path37.sep).join("/"))
     )
   } : void 0;
   const record2 = {
@@ -33032,29 +33446,29 @@ init_mcp();
 
 // src/commands/update.ts
 var https2 = __toESM(require("https"));
-var fs25 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs26 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 var os8 = __toESM(require("os"));
-var crypto5 = __toESM(require("crypto"));
-var import_child_process3 = require("child_process");
+var crypto6 = __toESM(require("crypto"));
+var import_child_process4 = require("child_process");
 init_logger();
 init_defaults();
 init_version();
 
 // src/utils/download.ts
-var fs24 = __toESM(require("fs"));
+var fs25 = __toESM(require("fs"));
 var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve33, reject) => {
-    const file = fs24.createWriteStream(dest);
+  return new Promise((resolve34, reject) => {
+    const file = fs25.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve33).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve34).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -33066,16 +33480,16 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve33());
+        file.close(() => resolve34());
       });
       file.on("error", (err) => {
         res.destroy();
-        fs24.unlink(dest, () => {
+        fs25.unlink(dest, () => {
         });
         reject(err);
       });
     }).on("error", (err) => {
-      fs24.unlink(dest, () => {
+      fs25.unlink(dest, () => {
       });
       reject(err);
     });
@@ -33150,7 +33564,7 @@ async function runUpdate(options = {}) {
     process.exit(1);
   }
   const tmpDir = os8.tmpdir();
-  const tmpFile = path37.join(tmpDir, assetName);
+  const tmpFile = path38.join(tmpDir, assetName);
   logger.info(`Downloading ${assetName}...`);
   try {
     await downloadFile(asset.browser_download_url, tmpFile);
@@ -33168,16 +33582,16 @@ async function runUpdate(options = {}) {
   const checksumAssetName = assetName + ".sha256";
   const checksumAsset = release.assets.find((a) => a.name === checksumAssetName);
   if (checksumAsset) {
-    const tmpChecksum = path37.join(tmpDir, checksumAssetName);
+    const tmpChecksum = path38.join(tmpDir, checksumAssetName);
     logger.info(`Verifying checksum...`);
     try {
       await downloadFile(checksumAsset.browser_download_url, tmpChecksum);
       verifyChecksum(tmpFile, tmpChecksum, assetName);
-      fs25.unlinkSync(tmpChecksum);
+      fs26.unlinkSync(tmpChecksum);
     } catch (err) {
       logger.error(`Checksum verification failed: ${err.message}`);
       try {
-        fs25.unlinkSync(tmpFile);
+        fs26.unlinkSync(tmpFile);
       } catch {
       }
       process.exit(1);
@@ -33243,7 +33657,7 @@ function releaseChannelLabel(tag) {
   return version.slice(dash + 1).replace(/\.\d+$/, "") || "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve33, reject) => {
+  return new Promise((resolve34, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=100`;
     const options = {
       headers: {
@@ -33263,7 +33677,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve33(JSON.parse(data));
+          resolve34(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -33273,10 +33687,10 @@ function fetchReleases(repo) {
   });
 }
 function verifyChecksum(filePath, checksumFile, expectedFilename) {
-  const checksumContent = fs25.readFileSync(checksumFile, "utf-8").trim();
+  const checksumContent = fs26.readFileSync(checksumFile, "utf-8").trim();
   const expectedHash = checksumContent.split(/\s+/)[0].toLowerCase();
-  const fileBuffer = fs25.readFileSync(filePath);
-  const actualHash = crypto5.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
+  const fileBuffer = fs26.readFileSync(filePath);
+  const actualHash = crypto6.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
   if (actualHash !== expectedHash) {
     throw new Error(
       `SHA-256 mismatch for ${expectedFilename}
@@ -33306,30 +33720,30 @@ function isPkgBinary2() {
 function installBinary(tmpFile, destPath) {
   const platform = process.platform;
   const isZip = tmpFile.endsWith(".zip");
-  const extractDir = path37.join(os8.tmpdir(), "wairon-extract");
-  if (fs25.existsSync(extractDir)) fs25.rmSync(extractDir, { recursive: true });
-  fs25.mkdirSync(extractDir, { recursive: true });
+  const extractDir = path38.join(os8.tmpdir(), "wairon-extract");
+  if (fs26.existsSync(extractDir)) fs26.rmSync(extractDir, { recursive: true });
+  fs26.mkdirSync(extractDir, { recursive: true });
   if (isZip) {
-    (0, import_child_process3.execSync)(
+    (0, import_child_process4.execSync)(
       `powershell -NoProfile -NonInteractive -Command "Expand-Archive -Path '${tmpFile}' -DestinationPath '${extractDir}' -Force"`,
       { stdio: ["ignore", "pipe", "pipe"] }
     );
   } else {
-    (0, import_child_process3.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
+    (0, import_child_process4.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
   }
   const binaryName = platform === "win32" ? "wairon.exe" : "wairon";
-  const extractedBinary = path37.join(extractDir, binaryName);
-  if (!fs25.existsSync(extractedBinary)) {
+  const extractedBinary = path38.join(extractDir, binaryName);
+  if (!fs26.existsSync(extractedBinary)) {
     throw new Error(`Extracted binary not found at ${extractedBinary}`);
   }
   if (platform === "win32") {
     const oldPath = destPath + ".old";
     try {
       cleanStaleBinary(oldPath);
-      fs25.renameSync(destPath, oldPath);
-      fs25.copyFileSync(extractedBinary, destPath);
+      fs26.renameSync(destPath, oldPath);
+      fs26.copyFileSync(extractedBinary, destPath);
       try {
-        fs25.unlinkSync(oldPath);
+        fs26.unlinkSync(oldPath);
       } catch {
       }
     } catch (err) {
@@ -33343,25 +33757,25 @@ function installBinary(tmpFile, destPath) {
     }
   } else {
     const tmpDest = destPath + ".new";
-    fs25.copyFileSync(extractedBinary, tmpDest);
-    fs25.chmodSync(tmpDest, 493);
-    fs25.renameSync(tmpDest, destPath);
+    fs26.copyFileSync(extractedBinary, tmpDest);
+    fs26.chmodSync(tmpDest, 493);
+    fs26.renameSync(tmpDest, destPath);
   }
   try {
-    fs25.unlinkSync(tmpFile);
+    fs26.unlinkSync(tmpFile);
   } catch {
   }
   try {
-    fs25.rmSync(extractDir, { recursive: true });
+    fs26.rmSync(extractDir, { recursive: true });
   } catch {
   }
 }
 function cleanStaleBinary(oldPath) {
   const target = oldPath ?? (isPkgBinary2() ? process.execPath + ".old" : null);
   if (!target) return;
-  if (fs25.existsSync(target)) {
+  if (fs26.existsSync(target)) {
     try {
-      fs25.unlinkSync(target);
+      fs26.unlinkSync(target);
     } catch {
     }
   }
@@ -33490,7 +33904,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve33) => {
+  return new Promise((resolve34) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -33557,7 +33971,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve33(result);
+      resolve34(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -33827,9 +34241,9 @@ async function runSkillsInstall() {
 }
 
 // src/commands/doctor.ts
-var fs26 = __toESM(require("fs"));
+var fs27 = __toESM(require("fs"));
 var os9 = __toESM(require("os"));
-var path38 = __toESM(require("path"));
+var path39 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 init_logger();
 init_defaults();
@@ -33861,10 +34275,10 @@ function stampVerdict(content) {
   return { mark: "warn", note: `v${v} \u2014 stale, installed is v${WAIRON_VERSION}` };
 }
 function mcpEntryHealth(settingsPath) {
-  if (!fs26.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
+  if (!fs27.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
   let entry;
   try {
-    const s = JSON.parse(fs26.readFileSync(settingsPath, "utf8"));
+    const s = JSON.parse(fs27.readFileSync(settingsPath, "utf8"));
     entry = s.mcpServers?.["wairon"];
   } catch {
     return { mark: "error", note: "parse error" };
@@ -33872,7 +34286,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs26.existsSync(scriptPath)) {
+    if (!fs27.existsSync(scriptPath)) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -33923,7 +34337,7 @@ async function runDoctor(options = {}) {
   try {
     const missing = findChainingSubprojectsMissingConfig(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path38.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path39.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -33980,7 +34394,7 @@ async function runDoctor(options = {}) {
   }
   console.log(import_chalk12.default.bold(`Generated files ${import_chalk12.default.gray("(stale = older than installed)")}`));
   for (const p of derivedDocPaths()) {
-    const label = path38.relative(getProjectRoot(), p).replace(/\\/g, "/");
+    const label = path39.relative(getProjectRoot(), p).replace(/\\/g, "/");
     if (!pathExists(p)) {
       line(tally, "warn", `${label} \u2014 not generated yet (run \`wairon generate\`)`);
       continue;
@@ -33993,7 +34407,7 @@ async function runDoctor(options = {}) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path38.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path39.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -34042,8 +34456,8 @@ async function runDoctor(options = {}) {
     }
   }
   try {
-    const legacy = path38.join(os9.homedir(), ".wairon", "baselines");
-    const leftovers = fs26.existsSync(legacy) ? fs26.readdirSync(legacy).filter((f) => f.endsWith(".json")) : [];
+    const legacy = path39.join(os9.homedir(), ".wairon", "baselines");
+    const leftovers = fs27.existsSync(legacy) ? fs27.readdirSync(legacy).filter((f) => f.endsWith(".json")) : [];
     if (leftovers.length) {
       console.log(import_chalk12.default.bold("Approvals"));
       line(
@@ -34092,17 +34506,17 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path38.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path39.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
-    if (fs26.existsSync(projPath)) {
+    if (fs27.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path38.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
-  if (fs26.existsSync(pluginDir)) {
+  const pluginDir = path39.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
+  if (fs27.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
   logger.blank();
@@ -34141,7 +34555,7 @@ async function applyFixes() {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
       for (const { path: oldPath, expected: newPath } of legacySpecs) {
-        fs26.renameSync(oldPath, newPath);
+        fs27.renameSync(oldPath, newPath);
       }
       console.log(`  ${icon("ok")} Migrated ${legacySpecs.length} legacy spec file(s) to the new dot-prefixed unified schema.`);
     }
@@ -34217,14 +34631,14 @@ function printSummary(tally) {
 }
 
 // src/commands/diagram.ts
-var fs27 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 init_logger();
 init_paths();
 init_fs();
 
 // src/commands/subsystem.ts
-var path39 = __toESM(require("path"));
+var path40 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -34259,10 +34673,10 @@ async function runSubsystemAdd(id, options = {}) {
   const stored = loadSubsystemSpec(id);
   const restatement = subsystemAddRestatement(id, options.projectPath, options.name, stored);
   const receipt = writeSpec(restatement);
-  const childDir = path39.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path40.resolve(getProjectRoot(), options.projectPath);
   logger.success(`${receipt.replacedExisting ? "Re-authored" : "Added"} external subsystem "${id}" \u2192 ${options.projectPath}`);
   for (const notice of receipt.notices) logger.info(notice);
-  logger.info(`Scaffolded child project at ${path39.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path40.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -34285,9 +34699,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path39.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path40.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path39.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path40.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -34318,8 +34732,8 @@ function applyFormat(options) {
   };
 }
 function writeArtifact(dest, content) {
-  ensureDir(path40.dirname(path40.resolve(dest)));
-  fs27.writeFileSync(dest, content, "utf-8");
+  ensureDir(path41.dirname(path41.resolve(dest)));
+  fs28.writeFileSync(dest, content, "utf-8");
 }
 function parseSequenceRef(ref) {
   const sep9 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
@@ -34334,21 +34748,21 @@ async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path40.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path41.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeArtifact(dest2, renderDiagram("canvas"));
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path40.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    const dest2 = options.out ?? path41.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
     writeArtifact(dest2, renderDiagram("drawio"));
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path40.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    const dest2 = options.out ?? path41.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
     writeArtifact(dest2, renderDiagram("excalidraw"));
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
@@ -34356,27 +34770,27 @@ async function runDiagram(rawOptions = {}) {
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path40.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path41.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeArtifact(dest2, renderDiagram("canvas"));
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path40.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path41.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      writeArtifact(path40.join(outDir, file.relPath), toMarkdown(file));
+      writeArtifact(path41.join(outDir, file.relPath), toMarkdown(file));
     }
-    writeArtifact(path40.join(outDir, "canvas.html"), renderDiagram("canvas"));
-    writeArtifact(path40.join(outDir, "architecture.drawio"), renderDiagram("drawio"));
-    writeArtifact(path40.join(outDir, "architecture.excalidraw"), renderDiagram("excalidraw"));
+    writeArtifact(path41.join(outDir, "canvas.html"), renderDiagram("canvas"));
+    writeArtifact(path41.join(outDir, "architecture.drawio"), renderDiagram("drawio"));
+    writeArtifact(path41.join(outDir, "architecture.excalidraw"), renderDiagram("excalidraw"));
     const graph = loadSpecGraph();
-    const indexPath = path40.join(outDir, "README.md");
+    const indexPath = path41.join(outDir, "README.md");
     writeArtifact(indexPath, diagramSetIndex(files, graph.systemName));
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
@@ -34388,20 +34802,20 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path40.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path41.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path40.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path41.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path40.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path41.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = renderDiagram("mermaid");
     title = "Component architecture";
-    defaultDest = path40.join(diagramsDir, "system.md");
+    defaultDest = path41.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
   const content = dest.endsWith(".mmd") ? `${mermaid}
@@ -34514,9 +34928,9 @@ Component variants (${variants.length})
 }
 
 // src/commands/packs.ts
-var fs28 = __toESM(require("fs"));
+var fs29 = __toESM(require("fs"));
 var os10 = __toESM(require("os"));
-var path41 = __toESM(require("path"));
+var path42 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -34543,11 +34957,11 @@ function describe(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path41.resolve(source);
-  if (!fs28.existsSync(abs)) {
+  const abs = path42.resolve(source);
+  if (!fs29.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
-  const isDir = fs28.statSync(abs).isDirectory();
+  const isDir = fs29.statSync(abs).isDirectory();
   if (isDir && !packDirEntry(abs)) {
     throw new Error(`"${source}" is a directory without a pack entry file (pack.yaml | pack.cjs | index.cjs | ...).`);
   }
@@ -34563,7 +34977,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path41.dirname(abs), scope);
+  const probe2 = probePack(abs, path42.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -34571,10 +34985,10 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path41.join(destDir, path41.basename(abs));
-    if (path41.resolve(dest2) !== abs) {
-      fs28.mkdirSync(destDir, { recursive: true });
-      fs28.cpSync(abs, dest2, { recursive: true, force: true });
+    const dest2 = path42.join(destDir, path42.basename(abs));
+    if (path42.resolve(dest2) !== abs) {
+      fs29.mkdirSync(destDir, { recursive: true });
+      fs29.cpSync(abs, dest2, { recursive: true, force: true });
     }
     logger.success(`Installed pack "${probe2.name}" globally: ${dest2}`);
     logger.info(`${describe(probe2)} \u2014 auto-loaded for every project on this machine (WAIRON_PACKS_DIR / ~/.wairon/packs).`);
@@ -34587,23 +35001,23 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path41.basename(abs)}`;
-  const dest = path41.join(root, ".wai", "packs", path41.basename(abs));
-  if (path41.resolve(dest) !== abs) {
-    fs28.mkdirSync(path41.dirname(dest), { recursive: true });
-    fs28.cpSync(abs, dest, { recursive: true, force: true });
+  const relRef = `.wai/packs/${path42.basename(abs)}`;
+  const dest = path42.join(root, ".wai", "packs", path42.basename(abs));
+  if (path42.resolve(dest) !== abs) {
+    fs29.mkdirSync(path42.dirname(dest), { recursive: true });
+    fs29.cpSync(abs, dest, { recursive: true, force: true });
   }
   if (registerPackRef(relRef)) {
     logger.success(`Vendored pack "${probe2.name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    fs28.cpSync(abs, dest, { recursive: true, force: true });
+    fs29.cpSync(abs, dest, { recursive: true, force: true });
     logger.success(`Pack "${probe2.name}" already registered \u2014 refreshed ${relRef} from the source.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path41.resolve(source);
-  if (!fs28.existsSync(abs) || !fs28.statSync(abs).isFile()) {
+  const abs = path42.resolve(source);
+  if (!fs29.existsSync(abs) || !fs29.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return;
@@ -34618,27 +35032,27 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path41.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path42.join(getProjectRoot(), ".wai", "packs");
   }
-  const bytes = fs28.readFileSync(abs);
-  fs28.mkdirSync(baseDir, { recursive: true });
-  const staging = fs28.mkdtempSync(path41.join(baseDir, ".wpack-staging-"));
+  const bytes = fs29.readFileSync(abs);
+  fs29.mkdirSync(baseDir, { recursive: true });
+  const staging = fs29.mkdtempSync(path42.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
-    fs28.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path41.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    fs29.rmSync(staging, { recursive: true, force: true });
+    logger.error(`Failed to extract pack archive "${path42.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path41.join(baseDir, name);
-  if (fs28.existsSync(destDir)) fs28.rmSync(destDir, { recursive: true, force: true });
-  fs28.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path41.dirname(destDir), scope);
+  const destDir = path42.join(baseDir, name);
+  if (fs29.existsSync(destDir)) fs29.rmSync(destDir, { recursive: true, force: true });
+  fs29.renameSync(staging, destDir);
+  const probe2 = probePack(destDir, path42.dirname(destDir), scope);
   if (probe2.error) {
-    fs28.rmSync(destDir, { recursive: true, force: true });
+    fs29.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
     process.exitCode = 1;
     return;
@@ -34652,7 +35066,7 @@ async function addPackFromArchive(source, options) {
   if (registerPackRef(relRef)) {
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path41.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path42.basename(abs)}.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -34673,7 +35087,7 @@ async function buildPack(source, options = {}) {
   const sourceDir = source && source.length > 0 ? source : ".";
   const result = (0, import_sdk.buildPack)(sourceDir);
   const outPath = options.out ?? result.suggestedFileName;
-  fs28.writeFileSync(outPath, result.archive);
+  fs29.writeFileSync(outPath, result.archive);
   logger.success(`Built pack "${result.info.name}" v${result.info.version} \u2192 ${outPath} (${result.archive.byteLength} bytes)`);
   logger.info(`Install it with \`wairon pack add ${outPath}\`, or upload it to a hosted instance.`);
 }
@@ -34684,8 +35098,8 @@ function expandSource(source, version) {
   return source.replace(/\{version\}/g, version ?? "").replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] ?? "");
 }
 async function fetchArchive(url) {
-  const dir = fs28.mkdtempSync(path41.join(os10.tmpdir(), "wairon-packdl-"));
-  const dest = path41.join(dir, "pack.wpack");
+  const dir = fs29.mkdtempSync(path42.join(os10.tmpdir(), "wairon-packdl-"));
+  const dest = path42.join(dir, "pack.wpack");
   await downloadFile(url, dest);
   return dest;
 }
@@ -34704,7 +35118,7 @@ async function installPack(source) {
     }
     const extracted = extractArchiveToTemp(archive);
     try {
-      fs28.rmSync(path41.dirname(archive), { recursive: true, force: true });
+      fs29.rmSync(path42.dirname(archive), { recursive: true, force: true });
     } catch {
     }
     if (!extracted) return;
@@ -34716,7 +35130,7 @@ async function installPack(source) {
       process.exitCode = 1;
     } finally {
       try {
-        fs28.rmSync(extracted.dir, { recursive: true, force: true });
+        fs29.rmSync(extracted.dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -34727,7 +35141,7 @@ async function installPack(source) {
     if (!extracted) return;
     sourceDir = extracted.dir;
     cleanup = extracted.dir;
-    origin = path41.resolve(source);
+    origin = path42.resolve(source);
   } else {
     let unit;
     try {
@@ -34753,7 +35167,7 @@ async function installPack(source) {
   } finally {
     if (cleanup) {
       try {
-        fs28.rmSync(cleanup, { recursive: true, force: true });
+        fs29.rmSync(cleanup, { recursive: true, force: true });
       } catch {
       }
     }
@@ -34770,20 +35184,20 @@ function reportInstalled(installed, origin) {
   }
 }
 function extractArchiveToTemp(source) {
-  const abs = path41.resolve(source);
-  if (!fs28.existsSync(abs)) {
+  const abs = path42.resolve(source);
+  if (!fs29.existsSync(abs)) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return null;
   }
-  const tempDir = fs28.mkdtempSync(path41.join(os10.tmpdir(), "wairon-packinstall-"));
+  const tempDir = fs29.mkdtempSync(path42.join(os10.tmpdir(), "wairon-packinstall-"));
   try {
-    const result = (0, import_sdk.extractPack)(new Uint8Array(fs28.readFileSync(abs)), tempDir);
+    const result = (0, import_sdk.extractPack)(new Uint8Array(fs29.readFileSync(abs)), tempDir);
     void result;
     return { dir: tempDir };
   } catch (e) {
     try {
-      fs28.rmSync(tempDir, { recursive: true, force: true });
+      fs29.rmSync(tempDir, { recursive: true, force: true });
     } catch {
     }
     logger.error(`Could not extract "${source}": ${e instanceof Error ? e.message : String(e)}`);
@@ -34920,7 +35334,7 @@ async function fetchAndInstall(selection, url) {
   const archive = await fetchArchive(url);
   const extracted = extractArchiveToTemp(archive);
   try {
-    fs28.rmSync(path41.dirname(archive), { recursive: true, force: true });
+    fs29.rmSync(path42.dirname(archive), { recursive: true, force: true });
   } catch {
   }
   if (!extracted) return null;
@@ -34932,7 +35346,7 @@ async function fetchAndInstall(selection, url) {
     return pack;
   } finally {
     try {
-      fs28.rmSync(extracted.dir, { recursive: true, force: true });
+      fs29.rmSync(extracted.dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -34943,10 +35357,10 @@ function bundleTargets(selections, name, all) {
   return selections.filter((s) => s.bundle === true);
 }
 function writeBundle(root, resolved) {
-  const dest = path41.join(root, ".wai", "packs", resolved.name, resolved.version);
-  fs28.rmSync(dest, { recursive: true, force: true });
-  fs28.mkdirSync(path41.dirname(dest), { recursive: true });
-  fs28.cpSync(resolved.path, dest, { recursive: true });
+  const dest = path42.join(root, ".wai", "packs", resolved.name, resolved.version);
+  fs29.rmSync(dest, { recursive: true, force: true });
+  fs29.mkdirSync(path42.dirname(dest), { recursive: true });
+  fs29.cpSync(resolved.path, dest, { recursive: true });
   return dest;
 }
 async function bundlePack(name, options = {}) {
@@ -34977,7 +35391,7 @@ async function bundlePack(name, options = {}) {
     const dest = writeBundle(root, resolved);
     bundledSelections.push({ name: selection.name, version: resolved.version });
     bundled.push(`${resolved.name}@${resolved.version}`);
-    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path41.relative(root, dest).replace(/\\/g, "/"))}`);
+    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path42.relative(root, dest).replace(/\\/g, "/"))}`);
   }
   if (bundled.length === 0) return;
   markSelectionsBundled(bundledSelections);
@@ -35014,9 +35428,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path41.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path41.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path41.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
+    const probe2 = probePack(ref, path42.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path42.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path42.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -35044,9 +35458,9 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path41.dirname(ref), "global");
-      if (probe2.name === name || path41.basename(ref) === name) {
-        fs28.rmSync(ref, { recursive: true, force: true });
+      const probe2 = probePack(ref, path42.dirname(ref), "global");
+      if (probe2.name === name || path42.basename(ref) === name) {
+        fs29.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
       }
@@ -35067,12 +35481,12 @@ async function removePack(name, options = {}) {
     if (typeof entry !== "string") continue;
     const ref = entry;
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path41.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path42.basename(ref) === name) {
       deregisterPackRef(ref);
-      const resolved = path41.resolve(root, ref);
-      const vendorDir = path41.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path41.sep)) {
-        fs28.rmSync(resolved, { recursive: true, force: true });
+      const resolved = path42.resolve(root, ref);
+      const vendorDir = path42.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path42.sep)) {
+        fs29.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
         logger.success(`Deregistered pack "${probe2.name ?? name}" (files at ${ref} left in place).`);
@@ -35085,22 +35499,22 @@ async function removePack(name, options = {}) {
 }
 
 // src/commands/host.ts
-var fs55 = __toESM(require("fs"));
-var path68 = __toESM(require("path"));
+var fs56 = __toESM(require("fs"));
+var path69 = __toESM(require("path"));
 var os11 = __toESM(require("os"));
-var crypto23 = __toESM(require("crypto"));
-var import_child_process6 = require("child_process");
+var crypto24 = __toESM(require("crypto"));
+var import_child_process7 = require("child_process");
 var import_chalk17 = __toESM(require("chalk"));
 init_logger();
 init_errors();
 
 // src/server/admin.ts
-var crypto10 = __toESM(require("crypto"));
+var crypto11 = __toESM(require("crypto"));
 init_fs();
 init_defaults();
 
 // src/server/auth.ts
-var crypto8 = __toESM(require("crypto"));
+var crypto9 = __toESM(require("crypto"));
 
 // src/server/types.ts
 var SSO_ADMIN_ROLE_ID = "sso-admin";
@@ -35113,35 +35527,35 @@ var UNAUTHENTICATED = {
 var WEB_SESSION_PREFIX = "ws_";
 
 // src/server/credentials.ts
-var fs29 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
-var crypto6 = __toESM(require("crypto"));
+var fs30 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
+var crypto7 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
-  return crypto6.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
+  return crypto7.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path42.join(dataDir, "auth", "credentials.json");
+  return path43.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
-    return JSON.parse(fs29.readFileSync(storePath(dataDir), "utf8"));
+    return JSON.parse(fs30.readFileSync(storePath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs29.mkdirSync(path42.dirname(p), { recursive: true });
+  fs30.mkdirSync(path43.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs29.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs29.renameSync(tmp, p);
+  fs30.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs30.renameSync(tmp, p);
 }
 function digestEquals(a, b) {
   const ab = Buffer.from(a, "hex");
   const bb = Buffer.from(b, "hex");
   if (ab.length === 0 || ab.length !== bb.length) return false;
-  return crypto6.timingSafeEqual(ab, bb);
+  return crypto7.timingSafeEqual(ab, bb);
 }
 function findByTokenHash(dataDir, tokenHash) {
   return load3(dataDir).find((r) => digestEquals(r.keyHash, tokenHash)) ?? null;
@@ -35180,17 +35594,17 @@ function listByOwner(dataDir, ownerUserId) {
 }
 
 // src/server/websessions.ts
-var fs30 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
-var crypto7 = __toESM(require("crypto"));
+var fs31 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
+var crypto8 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path43.join(dataDir, "web-sessions.json");
+  return path44.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
   let raw;
   try {
-    raw = fs30.readFileSync(p, "utf8");
+    raw = fs31.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read web session store at ${p}: ${e.message}`);
@@ -35205,13 +35619,13 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs30.mkdirSync(path43.dirname(p), { recursive: true });
+  fs31.mkdirSync(path44.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs30.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
-  fs30.renameSync(tmp, p);
+  fs31.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
+  fs31.renameSync(tmp, p);
 }
 function mintSessionId() {
-  return `${WEB_SESSION_PREFIX}${crypto7.randomBytes(24).toString("hex")}`;
+  return `${WEB_SESSION_PREFIX}${crypto8.randomBytes(24).toString("hex")}`;
 }
 var WebSessionStore = class {
   constructor(dataDir) {
@@ -35369,17 +35783,17 @@ function listWebSessionsBySubject(dataDir, userId) {
 }
 
 // src/server/users.ts
-var fs31 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs32 = __toESM(require("fs"));
+var path45 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path44.join(dataDir, "users.json");
+  return path45.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
   let raw;
   try {
-    raw = fs31.readFileSync(p, "utf8");
+    raw = fs32.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read hosted-user store at ${p}: ${err.message}`);
@@ -35397,10 +35811,10 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs31.mkdirSync(path44.dirname(p), { recursive: true });
+  fs32.mkdirSync(path45.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs31.renameSync(tmp, p);
+  fs32.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs32.renameSync(tmp, p);
 }
 function registryUpsert(dataDir, record2) {
   const records = loadStore(dataDir);
@@ -35502,11 +35916,11 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 }
 
 // src/server/instance.ts
-var fs32 = __toESM(require("fs"));
-var path45 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path46 = __toESM(require("path"));
 var import_crypto = require("crypto");
 function storePath4(dataDir) {
-  return path45.join(dataDir, "instance.json");
+  return path46.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -35523,7 +35937,7 @@ var InstanceIdentityStore = class {
     const p = storePath4(this.dataDir);
     let raw;
     try {
-      raw = fs32.readFileSync(p, "utf8");
+      raw = fs33.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read instance identity at ${p}: ${err.message}`);
@@ -35546,10 +35960,10 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs32.mkdirSync(path45.dirname(p), { recursive: true });
+    fs33.mkdirSync(path46.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs32.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
-    fs32.renameSync(tmp, p);
+    fs33.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
+    fs33.renameSync(tmp, p);
   }
 };
 var InstanceIdentityRegistry = class {
@@ -35605,8 +36019,8 @@ function getInstanceIdentity(dataDir) {
 }
 
 // src/utils/secrets.ts
-var fs33 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path47 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -35615,13 +36029,13 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path46.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path47.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
   if (!p) return {};
   try {
-    return JSON.parse(fs33.readFileSync(p, "utf8"));
+    return JSON.parse(fs34.readFileSync(p, "utf8"));
   } catch {
     return {};
   }
@@ -35646,10 +36060,10 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs33.mkdirSync(path46.dirname(p), { recursive: true });
+  fs34.mkdirSync(path47.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs33.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  fs33.renameSync(tmp, p);
+  fs34.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
+  fs34.renameSync(tmp, p);
 }
 function listSecretKeys() {
   return Object.keys(readStore());
@@ -35727,7 +36141,7 @@ function masterMatches(credential) {
   if (!master || !credential) return false;
   const a = Buffer.from(hashToken(credential), "hex");
   const b = Buffer.from(hashToken(master), "hex");
-  return a.length === b.length && crypto8.timingSafeEqual(a, b);
+  return a.length === b.length && crypto9.timingSafeEqual(a, b);
 }
 function bootstrapAdminPrincipal() {
   const subject = {
@@ -35775,7 +36189,7 @@ function authenticateMaster(token) {
 function hashedEquals(a, b) {
   const ha = Buffer.from(hashToken(a), "hex");
   const hb = Buffer.from(hashToken(b), "hex");
-  return ha.length === hb.length && crypto8.timingSafeEqual(ha, hb);
+  return ha.length === hb.length && crypto9.timingSafeEqual(ha, hb);
 }
 function verifyBuiltinAdmin(cfg, user, password) {
   const configuredUser = cfg.builtinAdminUser ?? "";
@@ -35824,16 +36238,16 @@ function signingKey() {
 }
 function signViewToken(project2, format) {
   const body = Buffer.from(JSON.stringify({ project: project2, format, exp: Date.now() + VIEW_TTL_MS })).toString("base64url");
-  const sig = crypto8.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto9.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifyViewToken(token) {
   const [body, sig] = String(token).split(".");
   if (!body || !sig) throw new Error("invalid view token");
-  const expected = crypto8.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto9.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto8.timingSafeEqual(a, b)) throw new Error("invalid view token");
+  if (a.length !== b.length || !crypto9.timingSafeEqual(a, b)) throw new Error("invalid view token");
   const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > payload.exp) throw new Error("expired view token");
   return { project: payload.project, format: payload.format, expiresAt: new Date(payload.exp).toISOString() };
@@ -35841,33 +36255,33 @@ function verifyViewToken(token) {
 var SSO_STATE_TTL_MS = 10 * 60 * 1e3;
 function signSsoState(payload) {
   const body = Buffer.from(JSON.stringify({ payload, exp: Date.now() + SSO_STATE_TTL_MS })).toString("base64url");
-  const sig = crypto8.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto9.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifySsoState(state) {
   const [body, sig] = String(state).split(".");
   if (!body || !sig) throw new Error("invalid SSO state");
-  const expected = crypto8.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto9.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto8.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
+  if (a.length !== b.length || !crypto9.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
   const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > parsed.exp) throw new Error("expired SSO state");
   return parsed.payload;
 }
 
 // src/server/organization.ts
-var fs34 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
-var crypto9 = __toESM(require("crypto"));
+var fs35 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
+var crypto10 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path47.join(dataDir, "organization.json");
+  return path48.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
   let raw;
   try {
-    raw = fs34.readFileSync(p, "utf8");
+    raw = fs35.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return { units: [], placements: [] };
     throw new Error(`Failed to read organization store at ${p}: ${e.message}`);
@@ -35884,10 +36298,10 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs34.mkdirSync(path47.dirname(p), { recursive: true });
+  fs35.mkdirSync(path48.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs34.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
-  fs34.renameSync(tmp, p);
+  fs35.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs35.renameSync(tmp, p);
 }
 var SLUG_PATTERN = /^[a-z0-9-]+$/;
 var UNIT_KINDS = ["business_entity", "department", "team", "group"];
@@ -36182,7 +36596,7 @@ var OrganizationRegistry = class {
       createdAt: placements[existingIdx].createdAt
     } : {
       ...placement,
-      id: placement.id || crypto9.randomUUID(),
+      id: placement.id || crypto10.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const next = isUpdate ? placements.map((p, i) => i === existingIdx ? stored : p) : [...placements, stored];
@@ -36263,11 +36677,11 @@ function getOrganizationUnit(dataDir, id) {
 }
 
 // src/server/permissions.ts
-var fs35 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
+var fs36 = __toESM(require("fs"));
+var path49 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath7(dataDir) {
-  return path48.join(dataDir, "permissions.json");
+  return path49.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -36276,7 +36690,7 @@ function load4(dataDir) {
   const p = storePath7(dataDir);
   let raw;
   try {
-    raw = fs35.readFileSync(p, "utf8");
+    raw = fs36.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read permission store at ${p}: ${err.message}`);
@@ -36294,10 +36708,10 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs35.mkdirSync(path48.dirname(p), { recursive: true });
+  fs36.mkdirSync(path49.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs35.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
-  fs35.renameSync(tmp, p);
+  fs36.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
+  fs36.renameSync(tmp, p);
 }
 function registrySet(dataDir, assignment) {
   const assignments = load4(dataDir);
@@ -36383,8 +36797,8 @@ function getAssignment(dataDir, assignmentId) {
 }
 
 // src/server/roles.ts
-var fs36 = __toESM(require("fs"));
-var path49 = __toESM(require("path"));
+var fs37 = __toESM(require("fs"));
+var path50 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -36402,13 +36816,13 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path49.join(dataDir, "roles.json");
+  return path50.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
   let raw;
   try {
-    raw = fs36.readFileSync(p, "utf8");
+    raw = fs37.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read role store at ${p}: ${err.message}`);
@@ -36426,10 +36840,10 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs36.mkdirSync(path49.dirname(p), { recursive: true });
+  fs37.mkdirSync(path50.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs36.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
-  fs36.renameSync(tmp, p);
+  fs37.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
+  fs37.renameSync(tmp, p);
 }
 function registryCreate(dataDir, role) {
   if (isBuiltinRoleId(role.id)) {
@@ -36663,8 +37077,8 @@ function actionableUnitIds(scopes) {
 }
 
 // src/server/projects.ts
-var fs37 = __toESM(require("fs"));
-var path50 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path51 = __toESM(require("path"));
 init_paths();
 init_yaml();
 init_fs();
@@ -36678,24 +37092,24 @@ function isValidProjectId(id) {
   return typeof id === "string" && ID_RE.test(id);
 }
 function registryPath(dataDir) {
-  return path50.join(dataDir, "projects.json");
+  return path51.join(dataDir, "projects.json");
 }
 function load6(dataDir) {
   try {
-    return JSON.parse(fs37.readFileSync(registryPath(dataDir), "utf8"));
+    return JSON.parse(fs38.readFileSync(registryPath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save2(dataDir, records) {
   const p = registryPath(dataDir);
-  fs37.mkdirSync(path50.dirname(p), { recursive: true });
+  fs38.mkdirSync(path51.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs37.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs37.renameSync(tmp, p);
+  fs38.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs38.renameSync(tmp, p);
 }
 function projectRoot(dataDir, id) {
-  return path50.join(dataDir, "projects", id);
+  return path51.join(dataDir, "projects", id);
 }
 function existingProjectRoot(dataDir, id) {
   if (!isValidProjectId(id)) return null;
@@ -36711,7 +37125,7 @@ function createProjectRecord(dataDir, id) {
     throw new Error(`Project "${id}" already exists.`);
   }
   const root = projectRoot(dataDir, id);
-  fs37.mkdirSync(root, { recursive: true });
+  fs38.mkdirSync(root, { recursive: true });
   const record2 = {
     id,
     rootPath: root,
@@ -36746,7 +37160,7 @@ function removeProjectRecord(dataDir, id) {
   const rec = records.find((r) => r.id === id);
   if (rec) {
     try {
-      fs37.rmSync(rec.rootPath, { recursive: true, force: true });
+      fs38.rmSync(rec.rootPath, { recursive: true, force: true });
     } catch {
     }
   }
@@ -36762,7 +37176,7 @@ function parseQualifiedSelector(value) {
 }
 function findSubsystemSpec(root, subsystemId) {
   const specsDir = aiPathsAt(root).specsDir();
-  if (!fs37.existsSync(specsDir)) return null;
+  if (!fs38.existsSync(specsDir)) return null;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -36847,40 +37261,40 @@ function resolveProjectRoot(dataDir, principal, selector) {
 }
 
 // src/git/config.ts
-var fs38 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var fs39 = __toESM(require("fs"));
+var path52 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
 }
 function readGitConfig() {
   try {
-    return JSON.parse(fs38.readFileSync(configPath(), "utf8"));
+    return JSON.parse(fs39.readFileSync(configPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs38.mkdirSync(path51.dirname(p), { recursive: true });
+  fs39.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs38.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
-  fs38.renameSync(tmp, p);
+  fs39.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+  fs39.renameSync(tmp, p);
 }
 function clearGitConfig() {
   try {
-    fs38.rmSync(configPath(), { force: true });
+    fs39.rmSync(configPath(), { force: true });
   } catch {
   }
 }
 
 // src/git/adapter.ts
-var import_child_process4 = require("child_process");
-var fs39 = __toESM(require("fs"));
-var path52 = __toESM(require("path"));
+var import_child_process5 = require("child_process");
+var fs40 = __toESM(require("fs"));
+var path53 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
-  return (0, import_child_process4.execFileSync)("git", args, {
+  return (0, import_child_process5.execFileSync)("git", args, {
     cwd: cwd ?? getProjectRoot(),
     encoding: "utf8",
     env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
@@ -36928,17 +37342,17 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path52.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path53.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs39.mkdirSync(path52.dirname(excludePath), { recursive: true });
-    const existing = fs39.existsSync(excludePath) ? fs39.readFileSync(excludePath, "utf8") : "";
+    fs40.mkdirSync(path53.dirname(excludePath), { recursive: true });
+    const existing = fs40.existsSync(excludePath) ? fs40.readFileSync(excludePath, "utf8") : "";
     const lines = existing.split(/\r?\n/).filter((line2) => line2.length > 0);
     const hadLegacyLockExclusion = lines.some((line2) => line2.trim() === ".wai/lock.json");
     const kept = lines.filter((line2) => line2.trim() !== ".wai/lock.json");
     if (!kept.some((line2) => line2.trim() === ".wai/git.json")) {
       kept.push(".wai/git.json");
     }
-    fs39.writeFileSync(excludePath, kept.join("\n") + "\n");
+    fs40.writeFileSync(excludePath, kept.join("\n") + "\n");
     if (hadLegacyLockExclusion) {
       console.warn(
         "[wairon git] removed a .wai/lock.json exclusion left by an earlier version \u2014 the approval it records is committed with the rest of .wai/ now, so it reaches the remote."
@@ -37008,25 +37422,25 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 }
 
 // src/producers/config.ts
-var fs40 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
+var fs41 = __toESM(require("fs"));
+var path54 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
 }
 function load7() {
   try {
-    return JSON.parse(fs40.readFileSync(configPath2(), "utf8"));
+    return JSON.parse(fs41.readFileSync(configPath2(), "utf8"));
   } catch {
     return [];
   }
 }
 function save3(configs) {
   const p = configPath2();
-  fs40.mkdirSync(path53.dirname(p), { recursive: true });
+  fs41.mkdirSync(path54.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
 }
 function readProducerConfig(target) {
   return load7().find((c) => c.target === target) ?? null;
@@ -37450,9 +37864,9 @@ function mintKey(cfg, credential, project2, role) {
       "instance-wide super-admin (*:*) keys cannot be minted \u2014 the built-in admin account (WAIRON_ADMIN_USER) is the only super-admin"
     );
   }
-  const token = "wk_" + crypto10.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto10.randomBytes(6).toString("hex"),
+    id: crypto11.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     role,
     projects: project2 === "*" ? ["*"] : [project2],
@@ -37701,8 +38115,8 @@ function diagramViewLink(cfg, credential, project2) {
 }
 
 // src/server/packs.ts
-var fs41 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
+var fs42 = __toESM(require("fs"));
+var path55 = __toESM(require("path"));
 init_fs();
 init_yaml();
 
@@ -37758,19 +38172,19 @@ function assertNotCodeArchive(info) {
 function extractDeclarativeArchive(archive, destDir) {
   const result = extractArchive(archive, destDir, HOSTED_STRICT_LIMITS);
   try {
-    assertDeclarative(fs41.readFileSync(path54.join(result.directory, result.entryPath), "utf8"));
+    assertDeclarative(fs42.readFileSync(path55.join(result.directory, result.entryPath), "utf8"));
   } catch (e) {
-    fs41.rmSync(destDir, { recursive: true, force: true });
+    fs42.rmSync(destDir, { recursive: true, force: true });
     throw e;
   }
 }
 function probe(loadRef, baseRoot, scope, displayRef) {
   const loaded = loadExtensionPacks([{ ref: loadRef, scope }], baseRoot);
   if (loaded.errors.length) {
-    return { name: path54.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
+    return { name: path55.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
   }
   return {
-    name: loaded.packNames[0] ?? path54.basename(displayRef),
+    name: loaded.packNames[0] ?? path55.basename(displayRef),
     scope,
     ref: displayRef,
     profiles: Object.keys(loaded.profiles).length,
@@ -37784,20 +38198,20 @@ function probe(loadRef, baseRoot, scope, displayRef) {
   };
 }
 function writeFileAtomic(file, content) {
-  fs41.mkdirSync(path54.dirname(file), { recursive: true });
+  fs42.mkdirSync(path55.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs41.writeFileSync(tmp, content);
-  fs41.renameSync(tmp, file);
+  fs42.writeFileSync(tmp, content);
+  fs42.renameSync(tmp, file);
 }
 function stem(ref) {
-  return path54.basename(ref).replace(PACK_EXT_RE2, "");
+  return path55.basename(ref).replace(PACK_EXT_RE2, "");
 }
 function imagePacksDir() {
   return process.env.WAIRON_IMAGE_PACKS_DIR ?? "/opt/wairon/packs";
 }
 function probeTier(dir, tier) {
   return discoverPacks(dir).map((full) => {
-    const d = probe(full, path54.dirname(full), "global", path54.basename(full));
+    const d = probe(full, path55.dirname(full), "global", path55.basename(full));
     d.tier = tier;
     return d;
   });
@@ -37815,9 +38229,9 @@ function scanGlobalPackProfiles() {
   for (const dir of [globalPacksDir(), imagePacksDir()]) {
     for (const full of discoverPacks(dir)) {
       try {
-        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path54.dirname(full));
+        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path55.dirname(full));
         if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path54.basename(full);
+        const source = loaded.packNames[0] ?? path55.basename(full);
         for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
       } catch {
       }
@@ -37869,12 +38283,12 @@ function storeListProjectProfiles(config) {
   return out;
 }
 function readPackContent(full) {
-  const st = fs41.statSync(full);
-  if (st.isFile()) return fs41.readFileSync(full, "utf8");
+  const st = fs42.statSync(full);
+  if (st.isFile()) return fs42.readFileSync(full, "utf8");
   if (st.isDirectory()) {
     for (const entry of ["pack.yaml", "pack.yml"]) {
-      const p = path54.join(full, entry);
-      if (fs41.existsSync(p) && fs41.statSync(p).isFile()) return fs41.readFileSync(p, "utf8");
+      const p = path55.join(full, entry);
+      if (fs42.existsSync(p) && fs42.statSync(p).isFile()) return fs42.readFileSync(p, "utf8");
     }
   }
   return null;
@@ -37883,9 +38297,9 @@ function storeResolveGlobalPacks(names) {
   const index = /* @__PURE__ */ new Map();
   const indexTier = (dir, tier) => {
     for (const full of discoverPacks(dir)) {
-      const manifestName = probe(full, path54.dirname(full), "global", path54.basename(full)).name;
+      const manifestName = probe(full, path55.dirname(full), "global", path55.basename(full)).name;
       const candidate = { full, manifestName, tier };
-      for (const key of [manifestName, stem(full), path54.basename(full)]) {
+      for (const key of [manifestName, stem(full), path55.basename(full)]) {
         if (!index.has(key)) index.set(key, candidate);
       }
     }
@@ -37912,7 +38326,7 @@ function storeInstallGlobalPack(name, content) {
   assertName(name);
   assertDeclarative(content);
   const dir = globalPacksDir();
-  const file = path54.join(dir, `${name}.yaml`);
+  const file = path55.join(dir, `${name}.yaml`);
   writeFileAtomic(file, content);
   const descriptor = probe(file, dir, "global", `${name}.yaml`);
   descriptor.tier = "instance";
@@ -37923,7 +38337,7 @@ function storeInstallGlobalPackArchive(archive, name) {
   assertNotCodeArchive(info);
   const packName = name ?? info.name;
   assertName(packName);
-  const dir = path54.join(globalPacksDir(), packName);
+  const dir = path55.join(globalPacksDir(), packName);
   extractDeclarativeArchive(archive, dir);
   const descriptor = probe(dir, globalPacksDir(), "global", packName);
   descriptor.tier = "instance";
@@ -37934,7 +38348,7 @@ function declaredName2(loadRef, baseRoot, scope) {
   return d.error ? void 0 : d.name;
 }
 function pickByName(candidates, name, fileOf, manifestOf) {
-  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path54.basename(fileOf(c)) === name);
+  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path55.basename(fileOf(c)) === name);
   if (byFile !== void 0) return byFile;
   const byManifest = candidates.filter((c) => manifestOf(c) === name);
   if (byManifest.length > 1) {
@@ -37947,17 +38361,17 @@ function pickByName(candidates, name, fileOf, manifestOf) {
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = globalPacksDir();
-  const manifestOf = (ref) => declaredName2(ref, path54.dirname(ref), "global");
-  const match = pickByName(discoverPacks(dir), name, path54.basename, manifestOf);
+  const manifestOf = (ref) => declaredName2(ref, path55.dirname(ref), "global");
+  const match = pickByName(discoverPacks(dir), name, path55.basename, manifestOf);
   if (!match) {
     const inImage = discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path54.basename(ref) === name || manifestOf(ref) === name
+      (ref) => stem(ref) === name || path55.basename(ref) === name || manifestOf(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
     );
   }
-  fs41.rmSync(match, { recursive: true, force: true });
+  fs42.rmSync(match, { recursive: true, force: true });
 }
 function storeListProjectPacks(config) {
   const root = getProjectRoot();
@@ -37973,7 +38387,7 @@ function storeInstallProjectPack(name, content) {
   assertDeclarative(content);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${name}.yaml`;
-  writeFileAtomic(path54.join(root, ".wai", "packs", `${name}.yaml`), content);
+  writeFileAtomic(path55.join(root, ".wai", "packs", `${name}.yaml`), content);
   return probe(relRef, root, "project", relRef);
 }
 function storeInstallProjectPackArchive(archive, name) {
@@ -37983,16 +38397,16 @@ function storeInstallProjectPackArchive(archive, name) {
   assertName(packName);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${packName}`;
-  extractDeclarativeArchive(archive, path54.join(root, ".wai", "packs", packName));
+  extractDeclarativeArchive(archive, path55.join(root, ".wai", "packs", packName));
   return probe(relRef, root, "project", relRef);
 }
 function storeRemoveProjectPack(name, ref) {
   assertName(name);
   const root = getProjectRoot();
-  const resolved = path54.resolve(root, ref ?? path54.join(".wai", "packs", name));
-  const vendorDir = path54.resolve(root, ".wai", "packs");
-  if (resolved.startsWith(vendorDir + path54.sep)) {
-    fs41.rmSync(resolved, { recursive: true, force: true });
+  const resolved = path55.resolve(root, ref ?? path55.join(".wai", "packs", name));
+  const vendorDir = path55.resolve(root, ".wai", "packs");
+  if (resolved.startsWith(vendorDir + path55.sep)) {
+    fs42.rmSync(resolved, { recursive: true, force: true });
   }
 }
 function requirePrincipal2(cfg, credential) {
@@ -38014,7 +38428,7 @@ function boundProject2(cfg, project2) {
 function findPackRegistration(config, name) {
   const relRef = `.wai/packs/${name}.yaml`;
   const entries = config?.extensions?.packs ?? [];
-  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path54.basename(entry) === name : entry.name === name);
+  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path55.basename(entry) === name : entry.name === name);
   if (direct !== void 0) return direct;
   const root = getProjectRoot();
   const refs = entries.filter((entry) => typeof entry === "string");
@@ -38128,9 +38542,9 @@ function installProjectPackArchive(cfg, credential, project2, archive, name) {
 }
 
 // src/server/audit.ts
-var fs42 = __toESM(require("fs"));
-var path55 = __toESM(require("path"));
-var crypto11 = __toESM(require("crypto"));
+var fs43 = __toESM(require("fs"));
+var path56 = __toESM(require("path"));
+var crypto12 = __toESM(require("crypto"));
 var LEVEL_ORDER = {
   debug: 0,
   info: 1,
@@ -38152,13 +38566,13 @@ var DEFAULT_AUDIT_POLICY = {
   metadataMode: "redacted"
 };
 function storePath9(dataDir) {
-  return path55.join(dataDir, "audit-events.json");
+  return path56.join(dataDir, "audit-events.json");
 }
 function readEvents(dataDir) {
   const p = storePath9(dataDir);
   let raw;
   try {
-    raw = fs42.readFileSync(p, "utf8");
+    raw = fs43.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read audit store at ${p}: ${e.message}`);
@@ -38173,10 +38587,10 @@ function readEvents(dataDir) {
 }
 function persistEvents(dataDir, events) {
   const p = storePath9(dataDir);
-  fs42.mkdirSync(path55.dirname(p), { recursive: true });
+  fs43.mkdirSync(path56.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs42.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
-  fs42.renameSync(tmp, p);
+  fs43.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
+  fs43.renameSync(tmp, p);
 }
 var SECRET_RE = /Bearer\s+\S/i;
 var LONG_HEX_RE = /[0-9a-fA-F]{32,}/;
@@ -38234,7 +38648,7 @@ var AuditRegistry = class {
     }
     const stamped = {
       ...event,
-      id: event.id && event.id.length > 0 ? event.id : crypto11.randomUUID(),
+      id: event.id && event.id.length > 0 ? event.id : crypto12.randomUUID(),
       timestamp: event.timestamp && event.timestamp.length > 0 ? event.timestamp : (/* @__PURE__ */ new Date()).toISOString(),
       metadata
     };
@@ -38501,10 +38915,10 @@ function unbindRole(cfg, credential, userId, roleId, scopeKind, scopeId) {
 }
 
 // src/server/identity.ts
-var crypto13 = __toESM(require("crypto"));
+var crypto14 = __toESM(require("crypto"));
 
 // src/server/idp.ts
-var crypto12 = __toESM(require("crypto"));
+var crypto13 = __toESM(require("crypto"));
 var REQUESTED_SCOPE = "openid email profile";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
@@ -38731,7 +39145,7 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   if (!digest2) return false;
   let keyObject;
   try {
-    keyObject = crypto12.createPublicKey({ key: jwk, format: "jwk" });
+    keyObject = crypto13.createPublicKey({ key: jwk, format: "jwk" });
   } catch {
     return false;
   }
@@ -38739,18 +39153,18 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   const sig = Buffer.from(sigB64url, "base64url");
   try {
     if (alg.startsWith("RS")) {
-      return crypto12.verify(digest2, data, keyObject, sig);
+      return crypto13.verify(digest2, data, keyObject, sig);
     }
     if (alg.startsWith("PS")) {
-      return crypto12.verify(
+      return crypto13.verify(
         digest2,
         data,
-        { key: keyObject, padding: crypto12.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto12.constants.RSA_PSS_SALTLEN_DIGEST },
+        { key: keyObject, padding: crypto13.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto13.constants.RSA_PSS_SALTLEN_DIGEST },
         sig
       );
     }
     if (alg.startsWith("ES")) {
-      return crypto12.verify(digest2, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
+      return crypto13.verify(digest2, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
     }
   } catch {
     return false;
@@ -38864,8 +39278,8 @@ function assertAllowedRedirectUri(provider, redirectUri) {
 }
 
 // src/server/policy.ts
-var fs43 = __toESM(require("fs"));
-var path56 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path57 = __toESM(require("path"));
 init_fs();
 
 // src/server/httpio.ts
@@ -38882,13 +39296,13 @@ function sendJson(res, status2, body) {
 
 // src/server/policy.ts
 function packPolicyPath(dataDir) {
-  return path56.join(dataDir, "pack-policy.json");
+  return path57.join(dataDir, "pack-policy.json");
 }
 function getPackPolicyRecord(dataDir) {
   const p = packPolicyPath(dataDir);
   let raw;
   try {
-    raw = fs43.readFileSync(p, "utf8");
+    raw = fs44.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read pack policy store at ${p}: ${e.message}`);
@@ -38902,14 +39316,14 @@ function getPackPolicyRecord(dataDir) {
 function setPackPolicyRecord(dataDir, policy) {
   const stored = { ...policy, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   const p = packPolicyPath(dataDir);
-  fs43.mkdirSync(path56.dirname(p), { recursive: true });
+  fs44.mkdirSync(path57.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs43.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
-  fs43.renameSync(tmp, p);
+  fs44.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
+  fs44.renameSync(tmp, p);
   return stored;
 }
 function exposurePolicyPath(dataDir) {
-  return path56.join(dataDir, "exposure-policy.json");
+  return path57.join(dataDir, "exposure-policy.json");
 }
 var COMPATIBLE_DEFAULT_EXPOSURE = {
   adminApiMode: "local_only",
@@ -38926,7 +39340,7 @@ function getExposurePolicyRecord(dataDir) {
   const p = exposurePolicyPath(dataDir);
   let raw;
   try {
-    raw = fs43.readFileSync(p, "utf8");
+    raw = fs44.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read exposure policy store at ${p}: ${e.message}`);
@@ -38939,10 +39353,10 @@ function getExposurePolicyRecord(dataDir) {
 }
 function setExposurePolicyRecord(dataDir, policy) {
   const p = exposurePolicyPath(dataDir);
-  fs43.mkdirSync(path56.dirname(p), { recursive: true });
+  fs44.mkdirSync(path57.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs43.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
-  fs43.renameSync(tmp, p);
+  fs44.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
+  fs44.renameSync(tmp, p);
   return policy;
 }
 var PERMISSIVE_DEFAULT_POLICY = {
@@ -38960,7 +39374,7 @@ function effectivePolicy(dataDir) {
   return getPackPolicyRecord(dataDir) ?? PERMISSIVE_DEFAULT_POLICY;
 }
 function identityProvidersPath(dataDir) {
-  return path56.join(dataDir, "identity-providers.json");
+  return path57.join(dataDir, "identity-providers.json");
 }
 function sanitizeIdentityProvider(config) {
   const clean = {
@@ -38984,16 +39398,16 @@ function sanitizeIdentityProvider(config) {
 }
 function writeIdentityProviderRecords(dataDir, records) {
   const p = identityProvidersPath(dataDir);
-  fs43.mkdirSync(path56.dirname(p), { recursive: true });
+  fs44.mkdirSync(path57.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs43.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs43.renameSync(tmp, p);
+  fs44.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs44.renameSync(tmp, p);
 }
 function listIdentityProviderRecords(dataDir) {
   const p = identityProvidersPath(dataDir);
   let raw;
   try {
-    raw = fs43.readFileSync(p, "utf8");
+    raw = fs44.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read identity provider store at ${p}: ${e.message}`);
@@ -39626,9 +40040,9 @@ function mintToken(cfg, credential, request) {
   if (owner && owner.status !== "active") {
     throw new ForbiddenError("cannot mint a token for a deactivated user");
   }
-  const token = "wk_" + crypto13.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto14.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto13.randomBytes(6).toString("hex"),
+    id: crypto14.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -39672,10 +40086,10 @@ function mintSelfToken(cfg, credential, projectId, write) {
   if (parsed.mounts.length > 0) {
     assertMintableNarrowingEntry(cfg.dataDir, projectId);
   }
-  const token = "wk_" + crypto13.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto14.randomBytes(24).toString("hex");
   const owner = auditActor(principal);
   const record2 = {
-    id: crypto13.randomBytes(6).toString("hex"),
+    id: crypto14.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: [projectId],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -39790,7 +40204,7 @@ function resolveEnabledProvider(cfg, providerId) {
 }
 async function startSsoLogin(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
-  const nonce = crypto13.randomBytes(16).toString("hex");
+  const nonce = crypto14.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -39841,9 +40255,9 @@ async function completeSsoLogin(cfg, state, code) {
       ...subject.email ? { email: subject.email } : {}
     });
   }
-  const token = "wk_" + crypto13.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto14.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto13.randomBytes(6).toString("hex"),
+    id: crypto14.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: ["*"],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -40031,17 +40445,17 @@ init_yaml();
 init_paths();
 
 // src/server/relations.ts
-var fs44 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
-var crypto14 = __toESM(require("crypto"));
+var fs45 = __toESM(require("fs"));
+var path58 = __toESM(require("path"));
+var crypto15 = __toESM(require("crypto"));
 function storePath10(dataDir) {
-  return path57.join(dataDir, "relations.json");
+  return path58.join(dataDir, "relations.json");
 }
 function readRelations(dataDir) {
   const p = storePath10(dataDir);
   let raw;
   try {
-    raw = fs44.readFileSync(p, "utf8");
+    raw = fs45.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read relation store at ${p}: ${e.message}`);
@@ -40056,10 +40470,10 @@ function readRelations(dataDir) {
 }
 function persistRelations(dataDir, relations) {
   const p = storePath10(dataDir);
-  fs44.mkdirSync(path57.dirname(p), { recursive: true });
+  fs45.mkdirSync(path58.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs44.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
-  fs44.renameSync(tmp, p);
+  fs45.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
+  fs45.renameSync(tmp, p);
 }
 var ProjectRelationStore = class {
   constructor(dataDir) {
@@ -40102,7 +40516,7 @@ var ProjectRelationRegistry = class {
     const hasStatus = typeof record2.status === "string" && record2.status.trim().length > 0;
     const stored = {
       ...record2,
-      id: hasId ? record2.id : crypto14.randomUUID(),
+      id: hasId ? record2.id : crypto15.randomUUID(),
       status: hasStatus ? record2.status : "active"
     };
     const relations = this.store.all();
@@ -40169,16 +40583,16 @@ function listProjectRelations(dataDir, sourceProjectId, targetProjectId, status2
 }
 
 // src/server/surfaces.ts
-var fs45 = __toESM(require("fs"));
-var path58 = __toESM(require("path"));
+var fs46 = __toESM(require("fs"));
+var path59 = __toESM(require("path"));
 function storePath11(dataDir) {
-  return path58.join(dataDir, "public-surfaces.json");
+  return path59.join(dataDir, "public-surfaces.json");
 }
 function readSnapshots(dataDir) {
   const p = storePath11(dataDir);
   let raw;
   try {
-    raw = fs45.readFileSync(p, "utf8");
+    raw = fs46.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read public surface store at ${p}: ${e.message}`);
@@ -40193,10 +40607,10 @@ function readSnapshots(dataDir) {
 }
 function persistSnapshots(dataDir, snapshots) {
   const p = storePath11(dataDir);
-  fs45.mkdirSync(path58.dirname(p), { recursive: true });
+  fs46.mkdirSync(path59.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs45.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
-  fs45.renameSync(tmp, p);
+  fs46.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
+  fs46.renameSync(tmp, p);
 }
 var PublicSurfaceStore = class {
   constructor(dataDir) {
@@ -40339,12 +40753,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path72 = chainOf(placement.unitId, unitById);
-    if (!path72.length) continue;
-    const closedOk = path72.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path73 = chainOf(placement.unitId, unitById);
+    if (!path73.length) continue;
+    const closedOk = path73.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path72[path72.length - 1].id);
-    if (crossTenant && !path72.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path73[path73.length - 1].id);
+    if (crossTenant && !path73.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -40993,8 +41407,8 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
 }
 
 // src/server/migration.ts
-var fs46 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var fs47 = __toESM(require("fs"));
+var path60 = __toESM(require("path"));
 var LEGACY_CAPABILITY_MAP = {
   "mcp:read": "project:read",
   "operations:read": "project:read",
@@ -41026,16 +41440,16 @@ function scopeOf(grant) {
 }
 function readRaw(file) {
   try {
-    return JSON.parse(fs46.readFileSync(file, "utf8"));
+    return JSON.parse(fs47.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRaw(file, value) {
-  fs46.mkdirSync(path59.dirname(file), { recursive: true });
+  fs47.mkdirSync(path60.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs46.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
-  fs46.renameSync(tmp, file);
+  fs47.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
+  fs47.renameSync(tmp, file);
 }
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "unit";
@@ -41069,13 +41483,13 @@ function migratePermissionModel(dataDir, apply) {
     findings.push({ area, detail });
   };
   const grid = readRaw(
-    path59.join(dataDir, "permissions.json")
+    path60.join(dataDir, "permissions.json")
   ) ?? [];
   if (!getInstanceIdentity(dataDir)) {
     found("instance", "instance identity is not seeded \u2014 the built-in admin/dev subjects have no persisted UUIDs");
     if (apply) ensureInstanceIdentity(dataDir);
   }
-  const orgPath = path59.join(dataDir, "organization.json");
+  const orgPath = path60.join(dataDir, "organization.json");
   const org = readRaw(orgPath);
   if (org?.units?.length) {
     const units = org.units;
@@ -41129,7 +41543,7 @@ function migratePermissionModel(dataDir, apply) {
       found("units", `${remap.length} unit id(s) would be remapped across placements, exposeTo, assignments, and users`);
     }
   }
-  const usersPath = path59.join(dataDir, "users.json");
+  const usersPath = path60.join(dataDir, "users.json");
   const users = readRaw(usersPath);
   if (users) {
     let changed = false;
@@ -41156,7 +41570,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(usersPath, users);
   }
-  const keysPath = path59.join(dataDir, "auth", "credentials.json");
+  const keysPath = path60.join(dataDir, "auth", "credentials.json");
   const keys = readRaw(keysPath);
   if (keys) {
     let changed = false;
@@ -41206,7 +41620,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(keysPath, keys);
   }
-  const sessionsPath = path59.join(dataDir, "web-sessions.json");
+  const sessionsPath = path60.join(dataDir, "web-sessions.json");
   const sessions = readRaw(sessionsPath);
   if (sessions) {
     let changed = false;
@@ -41285,8 +41699,8 @@ function migratePermissionModel(dataDir, apply) {
 
 // src/server/http.ts
 var http2 = __toESM(require("http"));
-var fs54 = __toESM(require("fs"));
-var path67 = __toESM(require("path"));
+var fs55 = __toESM(require("fs"));
+var path68 = __toESM(require("path"));
 
 // src/server/request.ts
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
@@ -41299,17 +41713,17 @@ function createScopedServer() {
 }
 
 // src/server/approvals.ts
-var fs47 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
-var crypto15 = __toESM(require("crypto"));
+var fs48 = __toESM(require("fs"));
+var path61 = __toESM(require("path"));
+var crypto16 = __toESM(require("crypto"));
 function storePath12(dataDir) {
-  return path60.join(dataDir, "approvals.json");
+  return path61.join(dataDir, "approvals.json");
 }
 function readRequests(dataDir) {
   const p = storePath12(dataDir);
   let raw;
   try {
-    raw = fs47.readFileSync(p, "utf8");
+    raw = fs48.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read approval store at ${p}: ${e.message}`);
@@ -41324,10 +41738,10 @@ function readRequests(dataDir) {
 }
 function persistRequests(dataDir, requests) {
   const p = storePath12(dataDir);
-  fs47.mkdirSync(path60.dirname(p), { recursive: true });
+  fs48.mkdirSync(path61.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs47.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
-  fs47.renameSync(tmp, p);
+  fs48.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
+  fs48.renameSync(tmp, p);
 }
 var SECRET_RE2 = /Bearer\s+\S/i;
 var LONG_HEX_RE2 = /[0-9a-fA-F]{32,}/;
@@ -41375,7 +41789,7 @@ var ApprovalRegistry = class {
     }
     const stored = {
       ...request,
-      id: crypto15.randomUUID(),
+      id: crypto16.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: "pending"
     };
@@ -41848,7 +42262,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve33) => setTimeout(resolve33, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve34) => setTimeout(resolve34, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -42135,12 +42549,12 @@ function handleOperationsRequest(cfg, credential, req, res, url) {
 }
 
 // src/server/gitbacking.ts
-var fs48 = __toESM(require("fs"));
-var path61 = __toESM(require("path"));
-var crypto16 = __toESM(require("crypto"));
-var import_child_process5 = require("child_process");
+var fs49 = __toESM(require("fs"));
+var path62 = __toESM(require("path"));
+var crypto17 = __toESM(require("crypto"));
+var import_child_process6 = require("child_process");
 function storePath13(dataDir) {
-  return path61.join(dataDir, "git-backing.json");
+  return path62.join(dataDir, "git-backing.json");
 }
 var GitBackingStore = class {
   constructor(dataDir) {
@@ -42152,7 +42566,7 @@ var GitBackingStore = class {
     const p = storePath13(this.dataDir);
     let raw;
     try {
-      raw = fs48.readFileSync(p, "utf8");
+      raw = fs49.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read git-backing store at ${p}: ${err.message}`);
@@ -42171,10 +42585,10 @@ var GitBackingStore = class {
   /** Swap the persisted collection wholesale via write-temp-then-rename. */
   replaceAll(bindings) {
     const p = storePath13(this.dataDir);
-    fs48.mkdirSync(path61.dirname(p), { recursive: true });
+    fs49.mkdirSync(path62.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs48.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
-    fs48.renameSync(tmp, p);
+    fs49.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
+    fs49.renameSync(tmp, p);
   }
 };
 var GitBackingRegistry = class {
@@ -42193,7 +42607,7 @@ var GitBackingRegistry = class {
     const bindings = this.store.load();
     const stored = {
       ...binding,
-      id: binding.id || crypto16.randomUUID(),
+      id: binding.id || crypto17.randomUUID(),
       createdAt: binding.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     const sameScope = (b) => b.scopeKind === stored.scopeKind && (b.scopeId ?? "") === (stored.scopeId ?? "");
@@ -42248,7 +42662,7 @@ function getBinding(dataDir, bindingId) {
   return new GitBackingIndex(new GitBackingStore(dataDir)).getBinding(bindingId);
 }
 function git2(args, cwd) {
-  return (0, import_child_process5.execFileSync)("git", args, {
+  return (0, import_child_process6.execFileSync)("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
@@ -42279,8 +42693,8 @@ function checkoutBranch(workdir, branch) {
   }
 }
 function cloneOrOpen(remote, branch, workdir, credentialRef) {
-  if (!fs48.existsSync(path61.join(workdir, ".git"))) {
-    fs48.mkdirSync(workdir, { recursive: true });
+  if (!fs49.existsSync(path62.join(workdir, ".git"))) {
+    fs49.mkdirSync(workdir, { recursive: true });
     git2(["clone", authRemote2(remote, credentialRef), "."], workdir);
     git2(["config", "user.name", process.env["WAIRON_GIT_NAME"] || "wairon-bot"], workdir);
     git2(["config", "user.email", process.env["WAIRON_GIT_EMAIL"] || "wairon-bot@localhost"], workdir);
@@ -42292,11 +42706,11 @@ function cloneOrOpen(remote, branch, workdir, credentialRef) {
   return workdir;
 }
 function mirrorTree(sourceDir, targetDir) {
-  fs48.rmSync(targetDir, { recursive: true, force: true });
-  const stat = fs48.statSync(sourceDir, { throwIfNoEntry: false });
+  fs49.rmSync(targetDir, { recursive: true, force: true });
+  const stat = fs49.statSync(sourceDir, { throwIfNoEntry: false });
   if (!stat) return;
-  fs48.mkdirSync(path61.dirname(targetDir), { recursive: true });
-  fs48.cpSync(sourceDir, targetDir, { recursive: true });
+  fs49.mkdirSync(path62.dirname(targetDir), { recursive: true });
+  fs49.cpSync(sourceDir, targetDir, { recursive: true });
 }
 function commitAndPush(workdir, message) {
   git2(["add", "-A"], workdir);
@@ -42418,7 +42832,7 @@ function unbindScope(cfg, credential, bindingId) {
   tryAppendAudit7(cfg, buildAuditEvent6(principal, "git.backing.unbind", "security", bindingId));
 }
 function runMirrorSync(cfg, binding) {
-  const workdir = path61.join(cfg.dataDir, "git-backing", binding.id);
+  const workdir = path62.join(cfg.dataDir, "git-backing", binding.id);
   cloneOrOpen(binding.remote, binding.branch, workdir, binding.credentialRef);
   if (binding.scopeKind === "unit") {
     const units = listOrganizationUnits(cfg.dataDir);
@@ -42426,23 +42840,23 @@ function runMirrorSync(cfg, binding) {
     const placedIds = new Set(
       listProjectPlacements(cfg.dataDir).filter((p) => subtree.has(p.unitId)).map((p) => p.projectId)
     );
-    const projectsDir = path61.join(workdir, "projects");
-    fs48.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path62.join(workdir, "projects");
+    fs49.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
       if (!placedIds.has(rec.id)) continue;
-      mirrorTree(path61.join(rec.rootPath, ".wai"), path61.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path62.join(rec.rootPath, ".wai"), path62.join(projectsDir, rec.id, ".wai"));
     }
   } else {
-    const instanceDir = path61.join(workdir, "instance");
-    fs48.rmSync(instanceDir, { recursive: true, force: true });
+    const instanceDir = path62.join(workdir, "instance");
+    fs49.rmSync(instanceDir, { recursive: true, force: true });
     const files = binding.includeCredentials ? INSTANCE_STRUCTURE_FILES : INSTANCE_STRUCTURE_FILES.filter((rel2) => rel2 !== "auth/credentials.json");
     for (const rel2 of files) {
-      mirrorTree(path61.join(cfg.dataDir, rel2), path61.join(instanceDir, rel2));
+      mirrorTree(path62.join(cfg.dataDir, rel2), path62.join(instanceDir, rel2));
     }
-    const projectsDir = path61.join(workdir, "projects");
-    fs48.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path62.join(workdir, "projects");
+    fs49.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
-      mirrorTree(path61.join(rec.rootPath, ".wai"), path61.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path62.join(rec.rootPath, ".wai"), path62.join(projectsDir, rec.id, ".wai"));
     }
   }
   const published = commitAndPush(
@@ -42594,7 +43008,7 @@ function setExposurePolicy2(cfg, credential, exposure) {
 
 // src/server/websocket.ts
 var import_events = require("events");
-var crypto17 = __toESM(require("crypto"));
+var crypto18 = __toESM(require("crypto"));
 var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 var MAX_PAYLOAD = 1 << 20;
 var OP_CONTINUATION = 0;
@@ -42608,7 +43022,7 @@ function isWebSocketUpgrade(req) {
 function acceptWebSocket(req, socket) {
   const key = req.headers["sec-websocket-key"];
   if (!isWebSocketUpgrade(req) || typeof key !== "string") return null;
-  const accept = crypto17.createHash("sha1").update(key + WS_GUID).digest("base64");
+  const accept = crypto18.createHash("sha1").update(key + WS_GUID).digest("base64");
   socket.write(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
@@ -42758,9 +43172,9 @@ function encodeFrame(opcode, payload) {
 }
 
 // src/server/web.ts
-var crypto22 = __toESM(require("crypto"));
-var fs53 = __toESM(require("fs"));
-var path66 = __toESM(require("path"));
+var crypto23 = __toESM(require("crypto"));
+var fs54 = __toESM(require("fs"));
+var path67 = __toESM(require("path"));
 
 // src/server/webadmin.ts
 function listUsers3(cfg, sessionId, project2) {
@@ -43011,18 +43425,18 @@ function destroyProject2(cfg, sessionId, id) {
 }
 
 // src/server/shareadmin.ts
-var crypto21 = __toESM(require("crypto"));
+var crypto22 = __toESM(require("crypto"));
 
 // src/server/sharesnapshots.ts
-var fs49 = __toESM(require("fs"));
-var path62 = __toESM(require("path"));
-var crypto18 = __toESM(require("crypto"));
+var fs50 = __toESM(require("fs"));
+var path63 = __toESM(require("path"));
+var crypto19 = __toESM(require("crypto"));
 init_fs();
 function snapshotDir(dataDir) {
-  return path62.join(dataDir, "share-snapshots");
+  return path63.join(dataDir, "share-snapshots");
 }
 function snapshotPath(dataDir, id) {
-  return path62.join(snapshotDir(dataDir), `${id}.json`);
+  return path63.join(snapshotDir(dataDir), `${id}.json`);
 }
 var ShareSnapshotStore = class {
   constructor(dataDir) {
@@ -43030,17 +43444,17 @@ var ShareSnapshotStore = class {
   }
   write(snapshot) {
     const p = snapshotPath(this.dataDir, snapshot.id);
-    if (fs49.existsSync(p)) return;
-    fs49.mkdirSync(path62.dirname(p), { recursive: true });
+    if (fs50.existsSync(p)) return;
+    fs50.mkdirSync(path63.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs49.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
-    fs49.renameSync(tmp, p);
+    fs50.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
+    fs50.renameSync(tmp, p);
   }
   read(snapshotId) {
     const p = snapshotPath(this.dataDir, snapshotId);
     let raw;
     try {
-      raw = fs49.readFileSync(p, "utf8");
+      raw = fs50.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read share snapshot at ${p}: ${err.message}`);
@@ -43059,7 +43473,7 @@ var ShareSnapshotRegistry = class {
   put(snapshot) {
     const stored = {
       ...snapshot,
-      id: snapshot.id || crypto18.randomUUID(),
+      id: snapshot.id || crypto19.randomUUID(),
       capturedAt: snapshot.capturedAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.write(stored);
@@ -43132,11 +43546,11 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
 }
 
 // src/server/sharelinks.ts
-var fs50 = __toESM(require("fs"));
-var path63 = __toESM(require("path"));
-var crypto19 = __toESM(require("crypto"));
+var fs51 = __toESM(require("fs"));
+var path64 = __toESM(require("path"));
+var crypto20 = __toESM(require("crypto"));
 function storePath14(dataDir) {
-  return path63.join(dataDir, "share-links.json");
+  return path64.join(dataDir, "share-links.json");
 }
 var ShareLinkStore = class {
   constructor(dataDir) {
@@ -43146,7 +43560,7 @@ var ShareLinkStore = class {
     const p = storePath14(this.dataDir);
     let raw;
     try {
-      raw = fs50.readFileSync(p, "utf8");
+      raw = fs51.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-link store at ${p}: ${err.message}`);
@@ -43164,10 +43578,10 @@ var ShareLinkStore = class {
   }
   replaceAll(links) {
     const p = storePath14(this.dataDir);
-    fs50.mkdirSync(path63.dirname(p), { recursive: true });
+    fs51.mkdirSync(path64.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs50.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
-    fs50.renameSync(tmp, p);
+    fs51.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
+    fs51.renameSync(tmp, p);
   }
 };
 var ShareLinkRegistry = class {
@@ -43178,7 +43592,7 @@ var ShareLinkRegistry = class {
     const links = this.store.load();
     const stored = {
       ...link,
-      id: link.id || crypto19.randomUUID(),
+      id: link.id || crypto20.randomUUID(),
       createdAt: link.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.replaceAll([...links, stored]);
@@ -43235,11 +43649,11 @@ function listProjectLinks(dataDir, projectId) {
 }
 
 // src/server/shareaccesslog.ts
-var fs51 = __toESM(require("fs"));
-var path64 = __toESM(require("path"));
-var crypto20 = __toESM(require("crypto"));
+var fs52 = __toESM(require("fs"));
+var path65 = __toESM(require("path"));
+var crypto21 = __toESM(require("crypto"));
 function storePath15(dataDir) {
-  return path64.join(dataDir, "share-access.json");
+  return path65.join(dataDir, "share-access.json");
 }
 var ShareAccessStore = class {
   constructor(dataDir) {
@@ -43249,7 +43663,7 @@ var ShareAccessStore = class {
     const p = storePath15(this.dataDir);
     let raw;
     try {
-      raw = fs51.readFileSync(p, "utf8");
+      raw = fs52.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-access store at ${p}: ${err.message}`);
@@ -43267,11 +43681,11 @@ var ShareAccessStore = class {
   }
   append(entry) {
     const p = storePath15(this.dataDir);
-    fs51.mkdirSync(path64.dirname(p), { recursive: true });
+    fs52.mkdirSync(path65.dirname(p), { recursive: true });
     const next = [...this.load(), entry];
     const tmp = `${p}.tmp`;
-    fs51.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
-    fs51.renameSync(tmp, p);
+    fs52.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
+    fs52.renameSync(tmp, p);
   }
 };
 var ShareAccessRegistry = class {
@@ -43281,7 +43695,7 @@ var ShareAccessRegistry = class {
   append(entry) {
     const stored = {
       ...entry,
-      id: entry.id || crypto20.randomUUID(),
+      id: entry.id || crypto21.randomUUID(),
       at: entry.at || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.append(stored);
@@ -43345,7 +43759,7 @@ function createShareLink(cfg, sessionId, input) {
   const wantsOpenapi = !!input.allowDownloadOpenapi || (input.artifacts ?? []).includes("openapi");
   const artifacts = artifactsFor({ allowDownloadOpenapi: !!input.allowDownloadOpenapi }, wantsOpenapi);
   const snapshot = putSnapshot(cfg.dataDir, captureSnapshot(cfg.dataDir, principal, input.projectId, input.view, artifacts));
-  const token = crypto21.randomBytes(32).toString("base64url");
+  const token = crypto22.randomBytes(32).toString("base64url");
   const link = createLink(cfg.dataDir, {
     id: "",
     tokenHash: hashToken(token),
@@ -43422,16 +43836,16 @@ function getShareAccessLog(cfg, sessionId, linkId, limit) {
 init_fs();
 
 // src/server/swagger.ts
-var fs52 = __toESM(require("fs"));
-var path65 = __toESM(require("path"));
+var fs53 = __toESM(require("fs"));
+var path66 = __toESM(require("path"));
 var cache;
 function loadAssets() {
   if (cache !== void 0) return cache;
   try {
-    const dir = path65.dirname(require.resolve("swagger-ui-dist/package.json"));
+    const dir = path66.dirname(require.resolve("swagger-ui-dist/package.json"));
     cache = {
-      css: fs52.readFileSync(path65.join(dir, "swagger-ui.css"), "utf8"),
-      js: fs52.readFileSync(path65.join(dir, "swagger-ui-bundle.js"), "utf8")
+      css: fs53.readFileSync(path66.join(dir, "swagger-ui.css"), "utf8"),
+      js: fs53.readFileSync(path66.join(dir, "swagger-ui-bundle.js"), "utf8")
     };
   } catch {
     cache = null;
@@ -43471,7 +43885,7 @@ function getLoginOptions(cfg) {
 async function startSignIn(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
   assertAllowedRedirectUri(provider, redirectUri);
-  const nonce = crypto22.randomBytes(16).toString("hex");
+  const nonce = crypto23.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -43830,20 +44244,20 @@ function clearNonceCookie(secure) {
 }
 function nonceMatches(a, b) {
   if (!a || !b || a.length !== b.length) return false;
-  return crypto22.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  return crypto23.timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
 function loadReactBundle() {
   const candidates = [
-    path66.resolve(__dirname, "webapp.html"),
+    path67.resolve(__dirname, "webapp.html"),
     // dist/index.js -> dist/webapp.html
-    path66.resolve(__dirname, "..", "webapp.html"),
+    path67.resolve(__dirname, "..", "webapp.html"),
     // dist/cli/index.js -> dist/webapp.html
-    path66.resolve(__dirname, "..", "..", "web", "dist", "index.html")
+    path67.resolve(__dirname, "..", "..", "web", "dist", "index.html")
     // tsx dev: src/server -> web/dist
   ];
   for (const candidate of candidates) {
     try {
-      if (fs53.existsSync(candidate)) return fs53.readFileSync(candidate, "utf8");
+      if (fs54.existsSync(candidate)) return fs54.readFileSync(candidate, "utf8");
     } catch {
     }
   }
@@ -46417,8 +46831,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path72 = (req.url ?? "/").split("?")[0];
-    if (path72 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path73 = (req.url ?? "/").split("?")[0];
+    if (path73 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -47311,7 +47725,7 @@ function routeData(cfg, req, res) {
   if (req.method === "GET" && url.pathname === "/readyz") {
     let ready = false;
     try {
-      fs54.accessSync(cfg.dataDir, fs54.constants.W_OK);
+      fs55.accessSync(cfg.dataDir, fs55.constants.W_OK);
       ready = true;
     } catch {
     }
@@ -47413,7 +47827,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs54.readFileSync(path67.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs55.readFileSync(path68.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -48105,9 +48519,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path68.join(os11.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path69.join(os11.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path68.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path69.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -48164,11 +48578,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk17.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve33) => {
+  await new Promise((resolve34) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve33();
+      resolve34();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -48179,7 +48593,7 @@ function openBrowser(url) {
     const platform = process.platform;
     const cmd = platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
     const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-    const child = (0, import_child_process6.spawn)(cmd, args, { stdio: "ignore", detached: true });
+    const child = (0, import_child_process7.spawn)(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -48188,14 +48602,14 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs55.existsSync(path68.join(cwd, ".wai"))) {
+  if (!fs56.existsSync(path69.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
-  const hash = crypto23.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path68.join(os11.tmpdir(), "wairon-dev", hash);
-  fs55.mkdirSync(dataDir, { recursive: true });
+  const hash = crypto24.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  const dataDir = path69.join(os11.tmpdir(), "wairon-dev", hash);
+  fs56.mkdirSync(dataDir, { recursive: true });
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
     adminApiMode: "local_only",
@@ -48233,11 +48647,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve33) => {
+  await new Promise((resolve34) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve33();
+      resolve34();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -48591,8 +49005,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path68.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs55.readFileSync(path68.resolve(options.file), "utf8");
+        const name = options.name ?? path69.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs56.readFileSync(path69.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -48825,8 +49239,8 @@ async function runSurface(action, options = {}) {
 }
 
 // src/commands/remote.ts
-var fs57 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
+var fs58 = __toESM(require("fs"));
+var path71 = __toESM(require("path"));
 var import_chalk20 = __toESM(require("chalk"));
 init_logger();
 init_errors();
@@ -48835,37 +49249,37 @@ init_fs();
 init_mcp();
 
 // src/commands/remotebinding.ts
-var fs56 = __toESM(require("fs"));
+var fs57 = __toESM(require("fs"));
 var os12 = __toESM(require("os"));
-var path69 = __toESM(require("path"));
+var path70 = __toESM(require("path"));
 init_paths();
 var BINDING_FILE = "remote.json";
 var CREDENTIALS_FILE = "credentials.json";
 function bindingPath(root) {
-  return path69.join(aiPathsAt(root).root(), BINDING_FILE);
+  return path70.join(aiPathsAt(root).root(), BINDING_FILE);
 }
 function credentialsPath() {
-  return path69.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
+  return path70.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
 }
 function normalizeInstanceUrl(url) {
   return url.trim().replace(/\/+$/, "").toLowerCase();
 }
 function readJson(file) {
   try {
-    const text2 = fs56.readFileSync(file, "utf8");
+    const text2 = fs57.readFileSync(file, "utf8");
     return text2 ? JSON.parse(text2) : null;
   } catch {
     return null;
   }
 }
 function writeJsonAtomic(file, value, mode) {
-  fs56.mkdirSync(path69.dirname(file), { recursive: true });
+  fs57.mkdirSync(path70.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs56.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", mode !== void 0 ? { mode } : void 0);
-  fs56.renameSync(tmp, file);
+  fs57.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", mode !== void 0 ? { mode } : void 0);
+  fs57.renameSync(tmp, file);
   if (mode !== void 0) {
     try {
-      fs56.chmodSync(file, mode);
+      fs57.chmodSync(file, mode);
     } catch {
     }
   }
@@ -48887,7 +49301,7 @@ function writeBinding(root, binding) {
 }
 function clearBinding(root) {
   try {
-    fs56.rmSync(bindingPath(root), { force: true });
+    fs57.rmSync(bindingPath(root), { force: true });
   } catch {
   }
 }
@@ -49201,7 +49615,7 @@ async function runRemote(action, options = {}) {
         allowPartial: options.allowPartial === true
       };
       if (options.archive) transfer.archivePath = options.archive;
-      if (options.dir) transfer.destDir = path70.resolve(options.dir);
+      if (options.dir) transfer.destDir = path71.resolve(options.dir);
       report(await pullTree(target, transfer));
       return;
     }
@@ -49285,10 +49699,10 @@ function topProjectId2(selector) {
 }
 function writeArchiveIfAsked(archive, archivePath, suggestedFileName) {
   if (!archivePath) return void 0;
-  const resolved = path70.resolve(archivePath);
-  const target = fs57.existsSync(resolved) && fs57.statSync(resolved).isDirectory() ? path70.join(resolved, suggestedFileName) : resolved;
-  fs57.mkdirSync(path70.dirname(target), { recursive: true });
-  fs57.writeFileSync(target, Buffer.from(archive));
+  const resolved = path71.resolve(archivePath);
+  const target = fs58.existsSync(resolved) && fs58.statSync(resolved).isDirectory() ? path71.join(resolved, suggestedFileName) : resolved;
+  fs58.mkdirSync(path71.dirname(target), { recursive: true });
+  fs58.writeFileSync(target, Buffer.from(archive));
   return target;
 }
 function report(outcome) {
@@ -49703,7 +50117,7 @@ async function runAgent(action, id) {
     }
     case "customize": {
       const brief = composeAgentBrief(id);
-      const guidancePath = path71.join(AI_PATHS.root(), "agents", `${id}.md`);
+      const guidancePath = path72.join(AI_PATHS.root(), "agents", `${id}.md`);
       const relPath = `.wai/agents/${id}.md`;
       if (pathExists(guidancePath)) {
         throw new GuidanceFileExistsError(relPath);