@withgauge/cli 0.12.1 → 0.14.0

package/dist/index.js

@@ -755,28 +755,180 @@ var canarySchema = z8.object({
 });
 var canaryListSchema = z8.object({ items: z8.array(canarySchema) });
 
-// ../packages/api-schemas/src/checkpoints.ts
+// ../packages/api-schemas/src/catalog.ts
 import { z as z9 } from "zod";
+var key = z9.string().trim().min(1).max(200);
+var tokens = z9.number().int().positive().max(1e8);
+var capabilities = {
+  tools: z9.boolean().default(true),
+  images: z9.boolean().default(false),
+  reasoning: z9.boolean().default(true),
+  streaming: z9.boolean().default(true)
+};
+var catalogReleaseSchema = z9.object({
+  harness: z9.enum(["claude-code", "codex", "pi", "opencode"]),
+  releaseVersion: key,
+  executableVersion: key,
+  distribution: key,
+  artifactDigest: key,
+  sandboxImageDigest: key,
+  adapterRevision: key,
+  eventContractRevision: key,
+  runtimeVersion: key,
+  freestyleSnapshotId: z9.string().regex(/^sh-[a-f0-9]{32}$/)
+}).strict();
+var catalogManifestSchema = z9.object({
+  revision: key,
+  releases: z9.array(catalogReleaseSchema).max(4).default([]),
+  models: z9.array(
+    z9.object({
+      slug: key,
+      displayName: key,
+      family: key,
+      trainingDataCutoff: key.nullable().optional(),
+      provider: key,
+      providerModelId: key,
+      accountRef: key.optional(),
+      // Reuse an existing deployment when qualifying a new runtime or new rates.
+      deploymentRevision: key.optional(),
+      protocol: z9.enum([
+        "ANTHROPIC_MESSAGES",
+        "OPENAI_RESPONSES",
+        "OPENAI_CHAT_COMPLETIONS",
+        "GOOGLE_GENERATIVE_LANGUAGE"
+      ]),
+      contextWindowTokens: tokens,
+      maxOutputTokens: tokens.nullable(),
+      ...capabilities,
+      pricing: z9.object({
+        revision: key.optional(),
+        effectiveFrom: z9.iso.datetime(),
+        input: z9.number().nonnegative(),
+        output: z9.number().nonnegative(),
+        cacheRead: z9.number().nonnegative().nullable().default(null),
+        cacheWrite: z9.number().nonnegative().nullable().default(null)
+      }).strict(),
+      harnesses: z9.array(
+        z9.object({
+          slug: z9.enum(["claude-code", "codex", "pi", "opencode"]),
+          releaseVersion: key,
+          configRecipe: key,
+          contextWindowTokens: tokens.optional(),
+          maxOutputTokens: tokens.nullable().optional(),
+          resume: z9.boolean().default(false)
+        }).strict()
+      ).min(1).max(4)
+    }).strict()
+  ).min(1).max(100)
+}).strict().superRefine((manifest, ctx) => {
+  const cells = /* @__PURE__ */ new Set();
+  for (const model of manifest.models) {
+    for (const harness of model.harnesses) {
+      const id = `${model.slug}:${harness.slug}`;
+      if (cells.has(id))
+        ctx.addIssue({ code: "custom", message: `Duplicate cell ${id}` });
+      cells.add(id);
+      const protocol = harness.slug === "claude-code" ? "ANTHROPIC_MESSAGES" : harness.slug === "codex" ? "OPENAI_RESPONSES" : "OPENAI_CHAT_COMPLETIONS";
+      if (model.protocol !== protocol)
+        ctx.addIssue({
+          code: "custom",
+          message: `Unsupported harness protocol for ${id}: expected ${protocol}`
+        });
+      if ((harness.contextWindowTokens ?? model.contextWindowTokens) > model.contextWindowTokens)
+        ctx.addIssue({
+          code: "custom",
+          message: `Harness context exceeds deployment for ${id}`
+        });
+      if (model.maxOutputTokens !== null && harness.maxOutputTokens != null && harness.maxOutputTokens > model.maxOutputTokens)
+        ctx.addIssue({
+          code: "custom",
+          message: `Harness output exceeds deployment for ${id}`
+        });
+    }
+  }
+  const releases = /* @__PURE__ */ new Set();
+  for (const release of manifest.releases) {
+    const id = `${release.harness}:${release.releaseVersion}`;
+    if (releases.has(id))
+      ctx.addIssue({ code: "custom", message: `Duplicate release ${id}` });
+    releases.add(id);
+    if (!manifest.models.some(
+      (m) => m.harnesses.some(
+        (h) => h.slug === release.harness && h.releaseVersion === release.releaseVersion
+      )
+    ))
+      ctx.addIssue({ code: "custom", message: `Unused release ${id}` });
+  }
+});
+var catalogRequestSchema = z9.object({
+  action: z9.enum([
+    "plan",
+    "apply",
+    "canary",
+    "status",
+    "activate",
+    "disable"
+  ]),
+  manifest: catalogManifestSchema,
+  runIds: z9.array(key).max(400).optional(),
+  force: z9.boolean().default(false)
+}).strict().superRefine((input, ctx) => {
+  if (input.force && input.action !== "activate")
+    ctx.addIssue({
+      code: "custom",
+      message: "force is only supported by activate"
+    });
+  if (input.runIds && !["activate", "status"].includes(input.action))
+    ctx.addIssue({
+      code: "custom",
+      message: "runIds are only supported by activate or status"
+    });
+});
+function pendingCatalogManifest(manifest, cells) {
+  const models = manifest.models.map((model) => ({
+    ...model,
+    harnesses: model.harnesses.filter(
+      (harness) => !cells.some(
+        (cell2) => cell2.model === model.slug && cell2.harness === harness.slug && cell2.admission === "PUBLIC"
+      )
+    )
+  })).filter((model) => model.harnesses.length > 0);
+  if (!models.length) return null;
+  return {
+    ...manifest,
+    models,
+    releases: manifest.releases.filter(
+      (release) => models.some(
+        (model) => model.harnesses.some(
+          (harness) => harness.slug === release.harness && harness.releaseVersion === release.releaseVersion
+        )
+      )
+    )
+  };
+}
+
+// ../packages/api-schemas/src/checkpoints.ts
+import { z as z10 } from "zod";
 var CHECKPOINT_STORE_VERSION = 2;
 var ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT = "0.0.76-byok-ha-26071639";
 var ALIGNED_RUNSC_VERSION = "release-20260112.0";
 var ALIGNED_RUNSC_PLATFORM = "systrap";
 var SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
 var CHECKPOINT_ARTIFACT_PATTERN = /^alg-checkpoint:v2:sha256:[0-9a-f]{64}$/;
-var sha256DigestSchema = z9.custom(
+var sha256DigestSchema = z10.custom(
   (value) => typeof value === "string" && SHA256_PATTERN.test(value),
   "expected a sha256:<64 lowercase hex> digest"
 );
-var checkpointArtifactRefSchema = z9.custom(
+var checkpointArtifactRefSchema = z10.custom(
   (value) => typeof value === "string" && CHECKPOINT_ARTIFACT_PATTERN.test(value),
   "expected an alg-checkpoint:v2 artifact reference"
 );
-var publicArtifactScopeSchema = z9.object({ kind: z9.literal("public") });
-var orgArtifactScopeSchema = z9.object({
-  kind: z9.literal("org"),
-  organizationId: z9.string().min(1)
+var publicArtifactScopeSchema = z10.object({ kind: z10.literal("public") });
+var orgArtifactScopeSchema = z10.object({
+  kind: z10.literal("org"),
+  organizationId: z10.string().min(1)
 });
-var artifactScopeSchema = z9.discriminatedUnion("kind", [
+var artifactScopeSchema = z10.discriminatedUnion("kind", [
   publicArtifactScopeSchema,
   orgArtifactScopeSchema
 ]);
@@ -792,27 +944,27 @@ function manifestScopeReferenceViolation(manifestScope, referenced) {
   }
   return "a manifest must not reference another organization's object";
 }
-var checkpointStorePrincipalSchema = z9.discriminatedUnion("kind", [
-  z9.object({ kind: z9.literal("system") }),
-  z9.object({
-    kind: z9.literal("organization"),
-    organizationId: z9.string().min(1)
+var checkpointStorePrincipalSchema = z10.discriminatedUnion("kind", [
+  z10.object({ kind: z10.literal("system") }),
+  z10.object({
+    kind: z10.literal("organization"),
+    organizationId: z10.string().min(1)
   })
 ]);
-var checkpointChunkSchema = z9.object({
-  ordinal: z9.number().int().nonnegative(),
+var checkpointChunkSchema = z10.object({
+  ordinal: z10.number().int().nonnegative(),
   digest: sha256DigestSchema,
   rawDigest: sha256DigestSchema,
-  rawBytes: z9.number().int().positive(),
-  storedBytes: z9.number().int().positive()
+  rawBytes: z10.number().int().positive(),
+  storedBytes: z10.number().int().positive()
 });
-var chunkedPayloadSchema = z9.object({
-  format: z9.enum([
+var chunkedPayloadSchema = z10.object({
+  format: z10.enum([
     "canonical-workspace-chunked-zstd-v1",
     "runsc-checkpoint-chunked-zstd-v1",
     "overlay-upper-chunked-zstd-v1"
   ]),
-  chunks: z9.array(checkpointChunkSchema).min(1).superRefine((chunks, context) => {
+  chunks: z10.array(checkpointChunkSchema).min(1).superRefine((chunks, context) => {
     for (const [index, chunk] of chunks.entries()) {
       if (chunk.ordinal !== index) {
         context.addIssue({
@@ -825,10 +977,10 @@ var chunkedPayloadSchema = z9.object({
   })
 });
 var canonicalBaselinePayloadSchema = chunkedPayloadSchema.extend({
-  format: z9.literal("canonical-workspace-chunked-zstd-v1")
+  format: z10.literal("canonical-workspace-chunked-zstd-v1")
 });
-var nydusBaselineBlobSchema = z9.object({
-  nydusBlobId: z9.string().regex(/^[0-9a-f]{64}$/),
+var nydusBaselineBlobSchema = z10.object({
+  nydusBlobId: z10.string().regex(/^[0-9a-f]{64}$/),
   object: checkpointChunkSchema,
   /**
    * CAS scope this blob's object actually lives in, when it is NOT the manifest's own
@@ -846,34 +998,34 @@ var nydusBaselineBlobSchema = z9.object({
    */
   scope: artifactScopeSchema.optional()
 });
-var nydusBaselinePayloadSchema = z9.object({
-  format: z9.literal("nydus-rafs-v6"),
-  fsVersion: z9.literal(6),
+var nydusBaselinePayloadSchema = z10.object({
+  format: z10.literal("nydus-rafs-v6"),
+  fsVersion: z10.literal(6),
   /** Always the manifest's own scope: a build always produces its own bootstrap, so
    *  only inherited BLOBS can be foreign. Confining the override to where a foreign
    *  scope is possible is what keeps the invariant checkable. */
   bootstrap: checkpointChunkSchema,
-  blobs: z9.array(nydusBaselineBlobSchema)
+  blobs: z10.array(nydusBaselineBlobSchema)
 });
-var workspaceBaselinePayloadSchema = z9.discriminatedUnion("format", [
+var workspaceBaselinePayloadSchema = z10.discriminatedUnion("format", [
   canonicalBaselinePayloadSchema,
   nydusBaselinePayloadSchema
 ]);
-var workspaceBaselineManifestV2Schema = z9.object({
-  schemaVersion: z9.literal(CHECKPOINT_STORE_VERSION),
-  kind: z9.literal("workspace-baseline"),
+var workspaceBaselineManifestV2Schema = z10.object({
+  schemaVersion: z10.literal(CHECKPOINT_STORE_VERSION),
+  kind: z10.literal("workspace-baseline"),
   scope: artifactScopeSchema,
   workspaceRoot: sha256DigestSchema,
   payload: workspaceBaselinePayloadSchema,
-  repo: z9.object({
-    canonicalUrl: z9.string().url(),
-    requestedRef: z9.string().min(1),
-    resolvedCommit: z9.string().regex(/^[0-9a-f]{40,64}$/)
+  repo: z10.object({
+    canonicalUrl: z10.string().url(),
+    requestedRef: z10.string().min(1),
+    resolvedCommit: z10.string().regex(/^[0-9a-f]{40,64}$/)
   }),
-  recipe: z9.object({
+  recipe: z10.object({
     digest: sha256DigestSchema,
     sandboxImageDigest: sha256DigestSchema,
-    architecture: z9.string().min(1)
+    architecture: z10.string().min(1)
   })
 }).superRefine((manifest, context) => {
   if (manifest.payload.format !== "nydus-rafs-v6") return;
@@ -891,94 +1043,111 @@ var workspaceBaselineManifestV2Schema = z9.object({
     }
   }
 });
-var checkpointBoundaryV2Schema = z9.object({
-  kind: z9.enum(["tool_call", "assistant_message", "user_message"]),
-  turn: z9.number().int().nonnegative(),
-  ordinal: z9.number().int().nonnegative(),
-  toolName: z9.string().optional(),
-  url: z9.string().url().optional()
+var checkpointBoundaryV2Schema = z10.object({
+  kind: z10.enum(["tool_call", "assistant_message", "user_message"]),
+  turn: z10.number().int().nonnegative(),
+  ordinal: z10.number().int().nonnegative(),
+  toolName: z10.string().optional(),
+  url: z10.string().url().optional()
 });
-var memoryDiskManifestV2Schema = z9.object({
-  schemaVersion: z9.literal(CHECKPOINT_STORE_VERSION),
-  kind: z9.literal("runsc-memory-disk"),
+var memoryDiskManifestV2Schema = z10.object({
+  schemaVersion: z10.literal(CHECKPOINT_STORE_VERSION),
+  kind: z10.literal("runsc-memory-disk"),
   scope: orgArtifactScopeSchema,
   boundary: checkpointBoundaryV2Schema,
   memory: chunkedPayloadSchema.extend({
-    format: z9.literal("runsc-checkpoint-chunked-zstd-v1")
+    format: z10.literal("runsc-checkpoint-chunked-zstd-v1")
   }),
-  disk: z9.object({
+  disk: z10.object({
     baselineArtifact: checkpointArtifactRefSchema,
     baselineScope: artifactScopeSchema,
     baselineWorkspaceRoot: sha256DigestSchema,
     delta: chunkedPayloadSchema.extend({
-      format: z9.literal("overlay-upper-chunked-zstd-v1")
+      format: z10.literal("overlay-upper-chunked-zstd-v1")
     })
   }),
-  runtime: z9.object({
-    runscVersion: z9.string().min(1),
-    platform: z9.string().min(1),
+  runtime: z10.object({
+    runscVersion: z10.string().min(1),
+    platform: z10.string().min(1),
     configDigest: sha256DigestSchema,
-    supervisorArtifact: z9.string().min(1),
-    architecture: z9.string().min(1)
+    supervisorArtifact: z10.string().min(1),
+    architecture: z10.string().min(1)
   }),
-  memorySharing: z9.literal("none")
+  memorySharing: z10.literal("none")
 });
-var workspaceSourceSchema = z9.discriminatedUnion("kind", [
-  z9.object({
-    kind: z9.literal("nvme-baseline"),
+var workspaceSourceSchema = z10.discriminatedUnion("kind", [
+  z10.object({
+    kind: z10.literal("nvme-baseline"),
     artifact: checkpointArtifactRefSchema,
     workspaceRoot: sha256DigestSchema,
     scope: artifactScopeSchema
   }),
-  z9.object({
-    kind: z9.literal("memory-disk"),
+  z10.object({
+    kind: z10.literal("memory-disk"),
     artifact: checkpointArtifactRefSchema,
     boundary: checkpointBoundaryV2Schema
   }),
-  z9.object({
-    kind: z9.literal("legacy-ebs"),
-    volumeSnapshot: z9.string().min(1),
-    resumeSessionId: z9.string().min(1).optional()
+  z10.object({
+    kind: z10.literal("legacy-ebs"),
+    volumeSnapshot: z10.string().min(1),
+    resumeSessionId: z10.string().min(1).optional()
   })
 ]);
-var baselinePayloadFormatSchema = z9.enum([
+var baselinePayloadFormatSchema = z10.enum([
   "canonical-workspace-chunked-zstd-v1",
   "runsc-checkpoint-chunked-zstd-v1",
   "overlay-upper-chunked-zstd-v1",
   "nydus-rafs-v6"
 ]);
-var checkpointStoreCapabilitiesSchema = z9.object({
-  storeVersion: z9.literal(CHECKPOINT_STORE_VERSION),
-  manifestSchemas: z9.array(z9.literal(CHECKPOINT_STORE_VERSION)).min(1),
-  payloadFormats: z9.array(baselinePayloadFormatSchema),
-  runtime: z9.object({
-    runscVersion: z9.literal(ALIGNED_RUNSC_VERSION),
-    platform: z9.literal(ALIGNED_RUNSC_PLATFORM),
-    supervisorArtifact: z9.literal(ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT)
+var checkpointStoreCapabilitiesSchema = z10.object({
+  storeVersion: z10.literal(CHECKPOINT_STORE_VERSION),
+  manifestSchemas: z10.array(z10.literal(CHECKPOINT_STORE_VERSION)).min(1),
+  payloadFormats: z10.array(baselinePayloadFormatSchema),
+  runtime: z10.object({
+    runscVersion: z10.literal(ALIGNED_RUNSC_VERSION),
+    platform: z10.literal(ALIGNED_RUNSC_PLATFORM),
+    supervisorArtifact: z10.literal(ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT)
   })
 });
 
 // ../packages/api-schemas/src/cli-auth.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
-var cliAuthorizationTokenRequestSchema = z10.object({
-  code: z10.string().min(1).max(512),
-  codeVerifier: z10.string().regex(PKCE_VERIFIER_PATTERN)
+var cliAuthorizationTokenRequestSchema = z11.object({
+  code: z11.string().min(1).max(512),
+  codeVerifier: z11.string().regex(PKCE_VERIFIER_PATTERN)
 });
-var cliAuthorizationTokenResponseSchema = z10.object({
-  accessToken: z10.string(),
-  tokenType: z10.literal("bearer"),
-  expiresAt: z10.string().nullable()
+var cliAuthorizationTokenResponseSchema = z11.object({
+  accessToken: z11.string(),
+  tokenType: z11.literal("bearer"),
+  expiresAt: z11.string().nullable()
 });
 
 // ../packages/api-schemas/src/connections.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var MAX_CONNECTION_SET_ENTRIES = 32;
-var exactHostSchema = z11.string().min(1).max(253).regex(
+var exactHostSchema = z12.string().min(1).max(253).regex(
   /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/
 );
-var headerNameSchema = z11.string().min(1).max(128).regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/);
-var parameterNameSchema = z11.string().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
+var headerNameSchema = z12.string().min(1).max(128).regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/);
+var parameterNameSchema = z12.string().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
+var credentialEnvKeySchema = z12.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/);
+var basicCredentialFieldSchema = z12.string().min(1).max(4096).refine(
+  (value) => [...value].every(
+    (character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127
+  ),
+  "Credentials cannot contain control characters"
+);
+var basicCredentialSchema = z12.object({
+  username: basicCredentialFieldSchema.refine(
+    (value) => !value.includes(":"),
+    "Basic username cannot contain a colon"
+  ),
+  password: basicCredentialFieldSchema
+}).strict();
+var basicCredentialDocumentSchema = basicCredentialSchema.extend({
+  version: z12.literal("alg.connection-basic.v1")
+});
 function safeCredentialPathTemplate(value) {
   if (value.split("{credential}").length !== 2 || /[\\?#]/.test(value) || [...value].some((character) => {
     const code = character.charCodeAt(0);
@@ -1003,124 +1172,148 @@ function safeCredentialPathTemplate(value) {
   }
   return false;
 }
-var hostedConnectionPresentationSchema = z11.discriminatedUnion(
+var hostedConnectionPresentationSchema = z12.discriminatedUnion(
   "style",
   [
-    z11.object({ style: z11.literal("bearer") }).strict(),
-    z11.object({
-      style: z11.literal("header"),
+    z12.object({ style: z12.literal("bearer") }).strict(),
+    z12.object({
+      style: z12.literal("header"),
       headerName: headerNameSchema,
-      valuePrefix: z11.string().max(256)
+      valuePrefix: z12.string().max(256)
+    }).strict(),
+    z12.object({
+      style: z12.literal("basic"),
+      fields: z12.object({
+        usernameKey: credentialEnvKeySchema,
+        passwordKey: credentialEnvKeySchema
+      }).strict().refine(
+        (fields) => fields.usernameKey !== fields.passwordKey,
+        "Basic username and password placeholders must differ"
+      ).optional()
     }).strict(),
-    z11.object({ style: z11.literal("basic") }).strict(),
-    z11.object({ style: z11.literal("query"), queryParam: parameterNameSchema }).strict(),
-    z11.object({
-      style: z11.literal("path"),
-      pathTemplate: z11.string().startsWith("/").max(512).refine(
+    z12.object({ style: z12.literal("query"), queryParam: parameterNameSchema }).strict(),
+    z12.object({
+      style: z12.literal("path"),
+      pathTemplate: z12.string().startsWith("/").max(512).refine(
         safeCredentialPathTemplate,
         "path template must contain one credential in an unambiguous path"
       )
     }).strict()
   ]
 );
-var hostedConnectionDeliveryV1Schema = z11.object({
-  version: z11.literal("alg.connection-hosted-delivery.v1"),
-  allowedHosts: z11.array(exactHostSchema).min(1).max(32),
+function pairedBasicGrantIsValid(input) {
+  const presentation = input.presentation;
+  return presentation.style !== "basic" || !presentation.fields || input.credentialKind === "static" && input.credentialKey === presentation.fields.usernameKey;
+}
+var hostedConnectionDeliveryV1Schema = z12.object({
+  version: z12.literal("alg.connection-hosted-delivery.v1"),
+  allowedHosts: z12.array(exactHostSchema).min(1).max(32),
   presentation: hostedConnectionPresentationSchema,
-  credentialKind: z11.enum(["static", "oauth"]),
-  profileGrantDigest: z11.string().regex(/^[0-9a-f]{64}$/)
-}).strict();
-var connectionSetEntrySchema = z11.object({
-  connectionId: z11.string().min(1),
-  handle: z11.string().min(1),
-  profileId: z11.string().min(1),
-  profileSlug: z11.string().min(1),
-  providerName: z11.string().min(1),
-  credentialKey: z11.string().min(1),
+  credentialKind: z12.enum(["static", "oauth"]),
+  profileGrantDigest: z12.string().regex(/^[0-9a-f]{64}$/)
+}).strict().refine(
+  (delivery) => delivery.presentation.style !== "basic" || !delivery.presentation.fields || delivery.credentialKind === "static",
+  "Paired Basic credentials must be static"
+);
+var connectionSetEntrySchema = z12.object({
+  connectionId: z12.string().min(1),
+  handle: z12.string().min(1),
+  profileId: z12.string().min(1),
+  profileSlug: z12.string().min(1),
+  providerName: z12.string().min(1),
+  credentialKey: z12.string().min(1),
   // Empty is the legacy OpenShell representation for basic/query/path. Hosted
   // delivery uses the discriminated presentation below and never invents one.
-  headerName: z11.string(),
-  headerValuePrefix: z11.string(),
+  headerName: z12.string(),
+  headerValuePrefix: z12.string(),
   hostedDelivery: hostedConnectionDeliveryV1Schema.optional()
-}).strict();
-var connectionSetSchema = z11.array(connectionSetEntrySchema).max(
+}).strict().refine(
+  (entry) => !entry.hostedDelivery || pairedBasicGrantIsValid({
+    credentialKey: entry.credentialKey,
+    credentialKind: entry.hostedDelivery.credentialKind,
+    presentation: entry.hostedDelivery.presentation
+  }),
+  "Basic username placeholder must match the connection credential key"
+);
+var connectionSetSchema = z12.array(connectionSetEntrySchema).max(
   MAX_CONNECTION_SET_ENTRIES,
   `a run may attach at most ${MAX_CONNECTION_SET_ENTRIES} connections`
 );
-var connectionSummarySchema = z11.object({
-  id: z11.string(),
-  handle: z11.string(),
-  providerName: z11.string(),
-  credentialKey: z11.string(),
-  allowedHosts: z11.array(z11.string()),
-  profileSlug: z11.string(),
-  profileLabel: z11.string(),
-  kind: z11.enum(["static", "oauth"]),
-  last4: z11.string().nullable(),
-  createdAt: z11.string()
+var connectionSummarySchema = z12.object({
+  id: z12.string(),
+  handle: z12.string(),
+  providerName: z12.string(),
+  credentialKey: z12.string(),
+  basicPasswordKey: credentialEnvKeySchema.nullable().optional(),
+  allowedHosts: z12.array(z12.string()),
+  profileSlug: z12.string(),
+  profileLabel: z12.string(),
+  kind: z12.enum(["static", "oauth"]),
+  last4: z12.string().nullable(),
+  createdAt: z12.string()
 }).strict();
-var listConnectionsResponseSchema = z11.object({ items: z11.array(connectionSummarySchema) }).strict();
+var listConnectionsResponseSchema = z12.object({ items: z12.array(connectionSummarySchema) }).strict();
 
 // ../packages/api-schemas/src/dashboards.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // ../packages/api-schemas/src/query.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // ../packages/api-schemas/src/stats.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var BRAND_KINDS2 = ["OWNED", "COMPETITOR", "OTHER"];
-var brandKindSchema2 = z12.enum(BRAND_KINDS2);
-var brandRankingSchema = z12.object({
-  rank: z12.number().int(),
-  brandId: z12.string(),
-  brandName: z12.string(),
+var brandKindSchema2 = z13.enum(BRAND_KINDS2);
+var brandRankingSchema = z13.object({
+  rank: z13.number().int(),
+  brandId: z13.string(),
+  brandName: z13.string(),
   kind: brandKindSchema2,
-  installs: z12.number().int(),
-  installRate: z12.number(),
-  mentionRate: z12.number(),
+  installs: z13.number().int(),
+  installRate: z13.number(),
+  mentionRate: z13.number(),
   /** Movement between the two most recent batch windows; null if not ranked in both. */
-  deltaRank: z12.number().int().nullable()
+  deltaRank: z13.number().int().nullable()
 });
-var packageRateSchema = z12.object({
-  ecosystem: z12.string(),
-  name: z12.string(),
-  brandName: z12.string().optional(),
+var packageRateSchema = z13.object({
+  ecosystem: z13.string(),
+  name: z13.string(),
+  brandName: z13.string().optional(),
   kind: brandKindSchema2.optional(),
-  installs: z12.number().int(),
-  rate: z12.number()
+  installs: z13.number().int(),
+  rate: z13.number()
 });
-var brandRateSchema = z12.object({
-  brandId: z12.string(),
-  brandName: z12.string(),
+var brandRateSchema = z13.object({
+  brandId: z13.string(),
+  brandName: z13.string(),
   kind: brandKindSchema2,
-  installs: z12.number().int(),
-  rate: z12.number()
+  installs: z13.number().int(),
+  rate: z13.number()
 });
-var brandFunnelRowSchema = z12.object({
-  brandId: z12.string(),
-  brandName: z12.string(),
+var brandFunnelRowSchema = z13.object({
+  brandId: z13.string(),
+  brandName: z13.string(),
   kind: brandKindSchema2,
-  mentionRate: z12.number(),
-  installRate: z12.number()
-});
-var domainRateSchema = z12.object({
-  domain: z12.string(),
-  runs: z12.number().int(),
-  rate: z12.number(),
-  requests: z12.number().int(),
-  brandName: z12.string().optional(),
-  owned: z12.boolean().optional()
-});
-var statsFreshnessSchema = z12.object({
+  mentionRate: z13.number(),
+  installRate: z13.number()
+});
+var domainRateSchema = z13.object({
+  domain: z13.string(),
+  runs: z13.number().int(),
+  rate: z13.number(),
+  requests: z13.number().int(),
+  brandName: z13.string().optional(),
+  owned: z13.boolean().optional()
+});
+var statsFreshnessSchema = z13.object({
   /** Newest run-ingest time across the org (ISO), or null if nothing ingested. */
-  watermark: z12.string().nullable(),
+  watermark: z13.string().nullable(),
   /** Runs that succeeded recently but haven't landed in the warehouse yet. */
-  pending: z12.number().int(),
+  pending: z13.number().int(),
   /** False when the freshness read itself failed (distinguish from genuine zero). */
-  available: z12.boolean()
+  available: z13.boolean()
 });
-var statsResponseSchema = (item) => z12.object({ items: z12.array(item), freshness: statsFreshnessSchema });
+var statsResponseSchema = (item) => z13.object({ items: z13.array(item), freshness: statsFreshnessSchema });
 var rankingsResponseSchema = statsResponseSchema(brandRankingSchema);
 var installsResponseSchema = statsResponseSchema(packageRateSchema);
 var brandsResponseSchema = statsResponseSchema(brandRateSchema);
@@ -1139,7 +1332,7 @@ var DATASETS = [
   "tokens",
   "brand_rollup"
 ];
-var datasetSchema = z13.enum(DATASETS);
+var datasetSchema = z14.enum(DATASETS);
 var WHERE_OPS = [
   "eq",
   "neq",
@@ -1151,234 +1344,234 @@ var WHERE_OPS = [
   "lt",
   "lte"
 ];
-var whereOpSchema = z13.enum(WHERE_OPS);
+var whereOpSchema = z14.enum(WHERE_OPS);
 var GRANULARITIES = ["day", "week", "month"];
-var granularitySchema = z13.enum(GRANULARITIES);
+var granularitySchema = z14.enum(GRANULARITIES);
 var DEFAULT_QUERY_LIMIT = 50;
 var MAX_QUERY_LIMIT = 1e3;
-var scalar = z13.union([z13.string(), z13.number(), z13.boolean()]);
-var whereClauseSchema = z13.object({
-  dimension: z13.string().min(1),
+var scalar = z14.union([z14.string(), z14.number(), z14.boolean()]);
+var whereClauseSchema = z14.object({
+  dimension: z14.string().min(1),
   op: whereOpSchema,
-  value: z13.union([scalar, z13.array(scalar)])
-});
-var queryFiltersSchema = z13.object({
-  prompt: z13.string(),
-  visibilityPrompt: z13.array(z13.string()),
-  preferenceOnly: z13.boolean(),
-  topic: z13.array(z13.string()),
-  tag: z13.array(z13.string()),
-  repo: z13.array(z13.string()),
-  language: z13.array(z13.string()),
-  framework: z13.array(z13.string()),
-  size: z13.array(z13.string()),
-  agent: z13.array(z13.string()),
+  value: z14.union([scalar, z14.array(scalar)])
+});
+var queryFiltersSchema = z14.object({
+  prompt: z14.string(),
+  visibilityPrompt: z14.array(z14.string()),
+  preferenceOnly: z14.boolean(),
+  topic: z14.array(z14.string()),
+  tag: z14.array(z14.string()),
+  repo: z14.array(z14.string()),
+  language: z14.array(z14.string()),
+  framework: z14.array(z14.string()),
+  size: z14.array(z14.string()),
+  agent: z14.array(z14.string()),
   /** Persona UserProfile ids; the NO_PERSONA sentinel = default judge. */
-  persona: z13.array(z13.string()),
-  model: z13.array(z13.string()),
-  scenario: z13.array(z13.string()),
-  experiment: z13.array(z13.string()),
-  branded: z13.boolean()
+  persona: z14.array(z14.string()),
+  model: z14.array(z14.string()),
+  scenario: z14.array(z14.string()),
+  experiment: z14.array(z14.string()),
+  branded: z14.boolean()
 }).partial();
-var dateRangeSchema = z13.object({
-  since: z13.string(),
-  until: z13.string(),
-  lastDays: z13.number().int().positive()
+var dateRangeSchema = z14.object({
+  since: z14.string(),
+  until: z14.string(),
+  lastDays: z14.number().int().positive()
 }).partial();
-var orderBySchema = z13.object({
+var orderBySchema = z14.object({
   /** A selected dimension or metric name. */
-  key: z13.string().min(1),
-  dir: z13.enum(["asc", "desc"]).default("desc")
+  key: z14.string().min(1),
+  dir: z14.enum(["asc", "desc"]).default("desc")
 });
-var querySpecSchema = z13.object({
+var querySpecSchema = z14.object({
   dataset: datasetSchema.default("runs"),
-  dimensions: z13.array(z13.string()).default([]),
-  metrics: z13.array(z13.string()).min(1, "at least one metric is required"),
+  dimensions: z14.array(z14.string()).default([]),
+  metrics: z14.array(z14.string()).min(1, "at least one metric is required"),
   filters: queryFiltersSchema.default({}),
-  where: z13.array(whereClauseSchema).default([]),
+  where: z14.array(whereClauseSchema).default([]),
   dateRange: dateRangeSchema.optional(),
-  orderBy: z13.array(orderBySchema).default([]),
-  limit: z13.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
+  orderBy: z14.array(orderBySchema).default([]),
+  limit: z14.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
   granularity: granularitySchema.default("day"),
   /** When true, the response echoes the compiled SQL (params bound, not inlined). */
-  explain: z13.boolean().default(false)
+  explain: z14.boolean().default(false)
 });
-var columnKindSchema = z13.enum(["dimension", "metric"]);
-var queryColumnSchema = z13.object({
-  key: z13.string(),
+var columnKindSchema = z14.enum(["dimension", "metric"]);
+var queryColumnSchema = z14.object({
+  key: z14.string(),
   kind: columnKindSchema
 });
-var queryRowSchema = z13.record(
-  z13.string(),
-  z13.union([z13.string(), z13.number(), z13.boolean(), z13.null()])
+var queryRowSchema = z14.record(
+  z14.string(),
+  z14.union([z14.string(), z14.number(), z14.boolean(), z14.null()])
 );
-var queryResponseSchema = z13.object({
-  columns: z13.array(queryColumnSchema),
-  rows: z13.array(queryRowSchema),
+var queryResponseSchema = z14.object({
+  columns: z14.array(queryColumnSchema),
+  rows: z14.array(queryRowSchema),
   /** Present only when the request set explain=true. */
-  sql: z13.string().optional(),
+  sql: z14.string().optional(),
   freshness: statsFreshnessSchema
 });
-var fieldTypeSchema = z13.enum([
+var fieldTypeSchema = z14.enum([
   "string",
   "number",
   "rate",
   "date",
   "boolean"
 ]);
-var fieldSchema = z13.object({
-  name: z13.string(),
+var fieldSchema = z14.object({
+  name: z14.string(),
   type: fieldTypeSchema,
   /** One-line human/agent hint. */
-  description: z13.string().optional()
+  description: z14.string().optional()
 });
-var datasetMetaSchema = z13.object({
+var datasetMetaSchema = z14.object({
   name: datasetSchema,
-  grain: z13.string(),
-  dimensions: z13.array(fieldSchema),
-  metrics: z13.array(fieldSchema)
+  grain: z14.string(),
+  dimensions: z14.array(fieldSchema),
+  metrics: z14.array(fieldSchema)
 });
-var metadataResponseSchema = z13.object({
-  datasets: z13.array(datasetMetaSchema)
+var metadataResponseSchema = z14.object({
+  datasets: z14.array(datasetMetaSchema)
 });
 
 // ../packages/api-schemas/src/dashboards.ts
 var VIZ_TYPES = ["line", "bar", "table", "kpi"];
-var vizTypeSchema = z14.enum(VIZ_TYPES);
-var widgetEncodingSchema = z14.object({
-  x: z14.string(),
+var vizTypeSchema = z15.enum(VIZ_TYPES);
+var widgetEncodingSchema = z15.object({
+  x: z15.string(),
   // dimension key for the x axis (line)
-  series: z14.string(),
+  series: z15.string(),
   // dimension key split into one series per value (line)
-  y: z14.array(z14.string())
+  y: z15.array(z15.string())
   // metric keys for the value axis
 }).partial();
-var preferenceSpecSchema = z14.object({
-  dataset: z14.literal("preference"),
-  report: z14.enum([
+var preferenceSpecSchema = z15.object({
+  dataset: z15.literal("preference"),
+  report: z15.enum([
     "ranking",
     "head_to_head",
     "recommended_over_time",
     "mentioned_over_time"
   ])
 });
-var widgetSpecSchema = z14.union([
+var widgetSpecSchema = z15.union([
   querySpecSchema,
   preferenceSpecSchema
 ]);
 var widgetFields = {
-  id: z14.string().min(1),
-  title: z14.string(),
+  id: z15.string().min(1),
+  title: z15.string(),
   viz: vizTypeSchema,
   spec: widgetSpecSchema,
   // 12-col grid placement.
-  x: z14.number().int().min(0).max(11),
-  y: z14.number().int().min(0),
-  w: z14.number().int().min(1).max(12),
-  h: z14.number().int().min(1),
+  x: z15.number().int().min(0).max(11),
+  y: z15.number().int().min(0),
+  w: z15.number().int().min(1).max(12),
+  h: z15.number().int().min(1),
   encoding: widgetEncodingSchema.optional()
 };
-var widgetSchema = z14.object(widgetFields).refine((w) => w.x + w.w <= 12, {
+var widgetSchema = z15.object(widgetFields).refine((w) => w.x + w.w <= 12, {
   message: "widget spills past the 12-column grid (x + w must be \u2264 12)"
 });
-var widgetPatchSchema = z14.object(widgetFields).partial();
-var dashboardFiltersSchema = z14.object({
+var widgetPatchSchema = z15.object(widgetFields).partial();
+var dashboardFiltersSchema = z15.object({
   filters: queryFiltersSchema,
   dateRange: dateRangeSchema
 }).partial();
-var overlayPatchSchema = z14.object({
-  name: z14.string(),
+var overlayPatchSchema = z15.object({
+  name: z15.string(),
   defaultFilters: dashboardFiltersSchema,
-  widgets: z14.record(z14.string(), widgetPatchSchema.nullable()),
+  widgets: z15.record(z15.string(), widgetPatchSchema.nullable()),
   // Explicit widget-id ordering (for reordering and from-scratch widgets).
-  order: z14.array(z14.string())
+  order: z15.array(z15.string())
 }).partial();
-var resolvedDashboardSchema = z14.object({
-  key: z14.string(),
-  name: z14.string(),
-  widgets: z14.array(widgetSchema),
+var resolvedDashboardSchema = z15.object({
+  key: z15.string(),
+  name: z15.string(),
+  widgets: z15.array(widgetSchema),
   defaultFilters: dashboardFiltersSchema,
-  hasOrgOverlay: z14.boolean(),
-  hasUserOverlay: z14.boolean()
-});
-var dashboardTemplateSchema = z14.object({
-  key: z14.string().min(1),
-  name: z14.string(),
-  description: z14.string().optional(),
-  widgets: z14.array(widgetSchema),
+  hasOrgOverlay: z15.boolean(),
+  hasUserOverlay: z15.boolean()
+});
+var dashboardTemplateSchema = z15.object({
+  key: z15.string().min(1),
+  name: z15.string(),
+  description: z15.string().optional(),
+  widgets: z15.array(widgetSchema),
   defaultFilters: dashboardFiltersSchema.optional()
 });
-var dashboardSummarySchema = z14.object({
-  key: z14.string(),
-  name: z14.string(),
-  source: z14.enum(["template", "org", "user"]),
-  isUserDefault: z14.boolean(),
-  isOrgDefault: z14.boolean()
+var dashboardSummarySchema = z15.object({
+  key: z15.string(),
+  name: z15.string(),
+  source: z15.enum(["template", "org", "user"]),
+  isUserDefault: z15.boolean(),
+  isOrgDefault: z15.boolean()
 });
-var listDashboardsResponseSchema = z14.object({
-  items: z14.array(dashboardSummarySchema)
+var listDashboardsResponseSchema = z15.object({
+  items: z15.array(dashboardSummarySchema)
 });
-var createDashboardBodySchema = z14.object({
-  name: z14.string().min(1).max(120),
-  widgets: z14.array(widgetSchema).optional()
+var createDashboardBodySchema = z15.object({
+  name: z15.string().min(1).max(120),
+  widgets: z15.array(widgetSchema).optional()
 });
-var updateDashboardBodySchema = z14.object({
-  name: z14.string().min(1).max(120)
+var updateDashboardBodySchema = z15.object({
+  name: z15.string().min(1).max(120)
 });
 
 // ../packages/api-schemas/src/device.ts
-import { z as z15 } from "zod";
-var deviceAuthorizeRequestSchema = z15.object({
+import { z as z16 } from "zod";
+var deviceAuthorizeRequestSchema = z16.object({
   /** Device label (the CLI's hostname) for display + token naming. */
-  deviceName: z15.string().trim().max(64).optional(),
+  deviceName: z16.string().trim().max(64).optional(),
   /** Optional: email a magic-link that lands on the approval page pre-scoped
    *  to this device (best-effort — the printed URL always works regardless). */
-  email: z15.string().trim().email().max(320).optional()
+  email: z16.string().trim().email().max(320).optional()
 });
-var deviceAuthorizeResponseSchema = z15.object({
+var deviceAuthorizeResponseSchema = z16.object({
   /** The one-time secret the CLI polls with (never shown again). */
-  deviceCode: z15.string(),
+  deviceCode: z16.string(),
   /** Short human-typed code the user confirms in the browser (e.g. WXYZ-1234). */
-  userCode: z15.string(),
+  userCode: z16.string(),
   /** Where the user approves (e.g. https://…/cli/authorize). */
-  verificationUri: z15.string(),
+  verificationUri: z16.string(),
   /** verificationUri with the code pre-filled, for one-click / QR. */
-  verificationUriComplete: z15.string(),
+  verificationUriComplete: z16.string(),
   /** Minimum seconds between polls. */
-  interval: z15.number().int().positive(),
+  interval: z16.number().int().positive(),
   /** Seconds until the device code expires. */
-  expiresIn: z15.number().int().positive(),
+  expiresIn: z16.number().int().positive(),
   /** Whether a magic-link email was dispatched (best-effort). */
-  emailSent: z15.boolean()
+  emailSent: z16.boolean()
 });
-var deviceTokenRequestSchema = z15.object({
-  deviceCode: z15.string().min(1)
+var deviceTokenRequestSchema = z16.object({
+  deviceCode: z16.string().min(1)
 });
-var deviceTokenApprovedSchema = z15.object({
-  status: z15.literal("approved"),
+var deviceTokenApprovedSchema = z16.object({
+  status: z16.literal("approved"),
   /** The `gauge_…` bearer secret. Store it now — never returned again. */
-  accessToken: z15.string(),
-  tokenType: z15.literal("bearer"),
+  accessToken: z16.string(),
+  tokenType: z16.literal("bearer"),
   /** ISO-8601 expiry, or null for no expiry. */
-  expiresAt: z15.string().nullable()
+  expiresAt: z16.string().nullable()
 });
-var deviceTokenResultSchema = z15.discriminatedUnion("status", [
+var deviceTokenResultSchema = z16.discriminatedUnion("status", [
   // Not yet approved — keep polling at `interval`.
-  z15.object({ status: z15.literal("pending") }),
+  z16.object({ status: z16.literal("pending") }),
   // Polled faster than `interval` — back off by `interval` seconds.
-  z15.object({ status: z15.literal("slow_down"), interval: z15.number().int() }),
+  z16.object({ status: z16.literal("slow_down"), interval: z16.number().int() }),
   // The user explicitly denied the request. Stop.
-  z15.object({ status: z15.literal("denied") }),
+  z16.object({ status: z16.literal("denied") }),
   // The device code expired or is unknown/already-redeemed. Stop and restart.
-  z15.object({ status: z15.literal("expired") }),
+  z16.object({ status: z16.literal("expired") }),
   deviceTokenApprovedSchema
 ]);
 
 // ../packages/api-schemas/src/evals.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // ../packages/api-schemas/src/ownedConfigurations.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // ../packages/api-schemas/src/runConfig.ts
 var runConfig_exports = {};
@@ -1394,38 +1587,38 @@ __export(runConfig_exports, {
   schedulableAgentSchema: () => schedulableAgentSchema,
   totalRunsPerCycle: () => totalRunsPerCycle
 });
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // ../packages/api-schemas/src/runs.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // ../packages/api-schemas/src/web-fixtures.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var MAX_WEB_FIXTURE_BYTES = 1e6;
 function normalizeWebFixtureUrl(raw) {
   const url = new URL(raw);
   url.hash = "";
   return url.href;
 }
-var searchResultSchema = z16.object({
-  title: z16.string().min(1),
-  url: z16.url().transform(normalizeWebFixtureUrl),
-  snippet: z16.string()
-});
-var searchFixtureSchema = z16.object({
-  query: z16.string().trim().min(1),
-  results: z16.array(searchResultSchema)
-});
-var pageFixtureSchema = z16.object({
-  url: z16.url().transform(normalizeWebFixtureUrl),
-  status: z16.int().min(100).max(599).default(200),
-  contentType: z16.string().trim().min(1).default("text/html"),
-  body: z16.string()
-});
-var webFixtureSchema = z16.object({
-  version: z16.literal(1),
-  searches: z16.array(searchFixtureSchema).default([]),
-  pages: z16.array(pageFixtureSchema).default([])
+var searchResultSchema = z17.object({
+  title: z17.string().min(1),
+  url: z17.url().transform(normalizeWebFixtureUrl),
+  snippet: z17.string()
+});
+var searchFixtureSchema = z17.object({
+  query: z17.string().trim().min(1),
+  results: z17.array(searchResultSchema)
+});
+var pageFixtureSchema = z17.object({
+  url: z17.url().transform(normalizeWebFixtureUrl),
+  status: z17.int().min(100).max(599).default(200),
+  contentType: z17.string().trim().min(1).default("text/html"),
+  body: z17.string()
+});
+var webFixtureSchema = z17.object({
+  version: z17.literal(1),
+  searches: z17.array(searchFixtureSchema).default([]),
+  pages: z17.array(pageFixtureSchema).default([])
 }).superRefine((fixture, ctx) => {
   const queries = /* @__PURE__ */ new Set();
   fixture.searches.forEach((entry, index) => {
@@ -1469,7 +1662,7 @@ var RUN_STATUSES = [
   "TIMED_OUT",
   "CANCELED"
 ];
-var runStatusSchema = z17.enum(RUN_STATUSES);
+var runStatusSchema = z18.enum(RUN_STATUSES);
 var AGENTS = [
   "CLAUDE_CODE",
   "CODEX_CLI",
@@ -1477,147 +1670,147 @@ var AGENTS = [
   "PI",
   "OPENCODE"
 ];
-var agentSchema = z17.enum(AGENTS);
+var agentSchema = z18.enum(AGENTS);
 var OBSERVED_PROVIDER_SOURCES = [
   "AGENT_STREAM",
   "GATEWAY_RESPONSE",
   "GATEWAY_AUDIT",
   "CANARY"
 ];
-var observedProviderSourceSchema = z17.enum(OBSERVED_PROVIDER_SOURCES);
-var selectedProviderSchema = z17.object({
-  slug: z17.string(),
-  displayName: z17.string()
+var observedProviderSourceSchema = z18.enum(OBSERVED_PROVIDER_SOURCES);
+var selectedProviderSchema = z18.object({
+  slug: z18.string(),
+  displayName: z18.string()
 });
-var observedProviderSchema = z17.object({
-  slug: z17.string(),
+var observedProviderSchema = z18.object({
+  slug: z18.string(),
   source: observedProviderSourceSchema
 });
-var runStatusFilterSchema = z17.string().transform(
+var runStatusFilterSchema = z18.string().transform(
   (raw) => raw.split(",").map((s) => s.trim().toUpperCase()).filter(Boolean)
-).pipe(z17.array(runStatusSchema).min(1));
+).pipe(z18.array(runStatusSchema).min(1));
 var runListQuerySchema = listQuerySchema.extend({
   status: runStatusFilterSchema.optional(),
-  batch: z17.string().optional(),
-  prompt: z17.string().optional(),
-  experiment: z17.string().optional(),
-  evalSet: z17.string().optional(),
-  since: z17.string().optional()
-});
-var runListItemSchema = z17.object({
-  id: z17.string(),
+  batch: z18.string().optional(),
+  prompt: z18.string().optional(),
+  experiment: z18.string().optional(),
+  evalSet: z18.string().optional(),
+  since: z18.string().optional()
+});
+var runListItemSchema = z18.object({
+  id: z18.string(),
   status: runStatusSchema,
   agent: agentSchema,
   /** Requested logical-model pin. Empty means the platform default was used. */
-  model: z17.string(),
+  model: z18.string(),
   /** Model reported by the harness; null until observed or on legacy runs. */
-  resolvedModel: z17.string().nullable().optional(),
+  resolvedModel: z18.string().nullable().optional(),
   /** Catalog presentation label for the selected logical model. */
-  modelDisplayName: z17.string().nullable().optional(),
+  modelDisplayName: z18.string().nullable().optional(),
   /** Catalog provider selected before execution; null on legacy runs. */
   selectedProvider: selectedProviderSchema.nullable().optional(),
   /** Trusted terminal upstream observation; may differ from the selected
    * aggregator and is null when the runtime supplies no provenance. */
   observedProvider: observedProviderSchema.nullable().optional(),
-  promptId: z17.string(),
+  promptId: z18.string(),
   /** First ~80 chars of the batch's prompt snapshot, whitespace-collapsed. */
-  promptSnippet: z17.string(),
-  batchId: z17.string(),
-  experiment: z17.string().nullable(),
+  promptSnippet: z18.string(),
+  batchId: z18.string(),
+  experiment: z18.string().nullable(),
   /** The eval set whose expansion (or backfill) minted the batch; null for
    *  schedule/visibility/ad-hoc runs. */
-  evalSetId: z17.string().nullable(),
-  turns: z17.number().int().nullable(),
-  usdCost: z17.number().nullable(),
-  durationMs: z17.number().int().nullable(),
-  exitReason: z17.string().nullable(),
-  createdAt: z17.string(),
-  startedAt: z17.string().nullable(),
-  finishedAt: z17.string().nullable(),
+  evalSetId: z18.string().nullable(),
+  turns: z18.number().int().nullable(),
+  usdCost: z18.number().nullable(),
+  durationMs: z18.number().int().nullable(),
+  exitReason: z18.string().nullable(),
+  createdAt: z18.string(),
+  startedAt: z18.string().nullable(),
+  finishedAt: z18.string().nullable(),
   /** Fork lineage (fork-simulations WS1): the source run this was forked from,
    *  or null for an organic run. Forks are excluded from aggregate analytics but
    *  kept visible; consumers badge on these fields. */
-  parentRunId: z17.string().nullable(),
+  parentRunId: z18.string().nullable(),
   /** Set when this run is a fetch-fork simulation variant (injected web
    *  content); null otherwise. Distinguishes a "Simulation" badge from a plain
    *  conversation fork. */
-  fetchForkPlanId: z17.string().nullable()
+  fetchForkPlanId: z18.string().nullable()
 });
 var runListResponseSchema = listResponseSchema(runListItemSchema);
 var runDetailSchema = runListItemSchema.omit({ promptSnippet: true }).extend({
-  promptText: z17.string(),
-  attempt: z17.number().int(),
-  cancelRequested: z17.boolean(),
-  failureReason: z17.string().nullable(),
-  repoUrl: z17.string().nullable(),
-  repoRef: z17.string().nullable(),
-  scenario: z17.string(),
-  funding: z17.string(),
+  promptText: z18.string(),
+  attempt: z18.number().int(),
+  cancelRequested: z18.boolean(),
+  failureReason: z18.string().nullable(),
+  repoUrl: z18.string().nullable(),
+  repoRef: z18.string().nullable(),
+  scenario: z18.string(),
+  funding: z18.string(),
   /** Raw harness usage write-back (token counts etc.); shape may evolve. */
-  usage: z17.unknown().nullable(),
+  usage: z18.unknown().nullable(),
   /** Artifact pointer: a working-tree diff exists at GET /runs/{id}/diff. */
-  hasDiff: z17.boolean(),
-  claimedAt: z17.string().nullable(),
+  hasDiff: z18.boolean(),
+  claimedAt: z18.string().nullable(),
   /** Judged criteria verdicts for eval-set runs (empty otherwise). `name`
    *  is the judge-time snapshot; `criterionId` is null once the criterion
    *  was deleted from its set. */
-  criterionResults: z17.array(
-    z17.object({
-      criterionId: z17.string().nullable(),
-      name: z17.string(),
-      passed: z17.boolean(),
-      reasoning: z17.string().nullable()
+  criterionResults: z18.array(
+    z18.object({
+      criterionId: z18.string().nullable(),
+      name: z18.string(),
+      passed: z18.boolean(),
+      reasoning: z18.string().nullable()
     })
   )
 });
-var cancelRunResponseSchema = z17.object({
-  id: z17.string(),
+var cancelRunResponseSchema = z18.object({
+  id: z18.string(),
   status: runStatusSchema,
-  cancelRequested: z17.boolean(),
-  note: z17.string().optional()
+  cancelRequested: z18.boolean(),
+  note: z18.string().optional()
 });
-var regradeRunResponseSchema = z17.object({
-  runId: z17.string(),
-  evalSetId: z17.string(),
-  criteria: z17.number().int()
+var regradeRunResponseSchema = z18.object({
+  runId: z18.string(),
+  evalSetId: z18.string(),
+  criteria: z18.number().int()
 });
-var forkRunBodySchema = z17.object({
-  prompt: z17.string().trim().min(1).max(2e4),
-  turn: z17.number().int().min(0).optional(),
+var forkRunBodySchema = z18.object({
+  prompt: z18.string().trim().min(1).max(2e4),
+  turn: z18.number().int().min(0).optional(),
   webFixture: webFixtureSchema.optional()
 });
-var forkRunResponseSchema = z17.object({
-  runId: z17.string(),
-  batchId: z17.string(),
-  parentRunId: z17.string(),
-  checkpointId: z17.string(),
-  turn: z17.number().int().min(0)
+var forkRunResponseSchema = z18.object({
+  runId: z18.string(),
+  batchId: z18.string(),
+  parentRunId: z18.string(),
+  checkpointId: z18.string(),
+  turn: z18.number().int().min(0)
 });
-var fetchForkAtFetchBodySchema = z17.object({
-  boundarySeq: z17.string().min(1),
-  injectedContent: z17.string(),
-  prompts: z17.array(z17.string()).min(1)
+var fetchForkAtFetchBodySchema = z18.object({
+  boundarySeq: z18.string().min(1),
+  injectedContent: z18.string(),
+  prompts: z18.array(z18.string()).min(1)
 });
-var fetchForkAtFetchResponseSchema = z17.object({
-  planId: z17.string()
+var fetchForkAtFetchResponseSchema = z18.object({
+  planId: z18.string()
 });
-var fetchForkPlanStatusSchema = z17.enum([
+var fetchForkPlanStatusSchema = z18.enum([
   "DRAFT",
   "SURGERY_RUNNING",
   "SURGERY_READY",
   "FORKED",
   "FAILED"
 ]);
-var fetchForkPlanResponseSchema = z17.object({
-  id: z17.string(),
+var fetchForkPlanResponseSchema = z18.object({
+  id: z18.string(),
   status: fetchForkPlanStatusSchema,
-  boundaryUrl: z17.string(),
-  boundaryTurn: z17.number().int(),
-  prompts: z17.array(z17.string()),
-  surgicalCheckpointId: z17.string().nullable(),
-  forkBatchId: z17.string().nullable(),
-  errorText: z17.string().nullable(),
-  forkedRunIds: z17.array(z17.string())
+  boundaryUrl: z18.string(),
+  boundaryTurn: z18.number().int(),
+  prompts: z18.array(z18.string()),
+  surgicalCheckpointId: z18.string().nullable(),
+  forkBatchId: z18.string().nullable(),
+  errorText: z18.string().nullable(),
+  forkedRunIds: z18.array(z18.string())
 });
 var RUN_INSIGHT_STATUSES = [
   "PENDING",
@@ -1626,24 +1819,24 @@ var RUN_INSIGHT_STATUSES = [
   "FAILED",
   "SKIPPED"
 ];
-var runInsightStatusSchema = z17.enum(RUN_INSIGHT_STATUSES);
-var insightPassSchema = z17.object({
+var runInsightStatusSchema = z18.enum(RUN_INSIGHT_STATUSES);
+var insightPassSchema = z18.object({
   status: runInsightStatusSchema,
-  model: z17.string().nullable(),
-  inputTokens: z17.number().int().nullable(),
-  outputTokens: z17.number().int().nullable(),
-  usdCost: z17.number().nullable(),
-  error: z17.string().nullable()
-});
-var runDecisionSchema = z17.object({
-  index: z17.number().int(),
-  category: z17.string(),
-  categoryRaw: z17.string().nullable(),
-  chosenName: z17.string(),
-  chosenEcosystem: z17.string().nullable(),
-  chosenPackage: z17.string().nullable(),
-  reversed: z17.boolean(),
-  detail: z17.unknown()
+  model: z18.string().nullable(),
+  inputTokens: z18.number().int().nullable(),
+  outputTokens: z18.number().int().nullable(),
+  usdCost: z18.number().nullable(),
+  error: z18.string().nullable()
+});
+var runDecisionSchema = z18.object({
+  index: z18.number().int(),
+  category: z18.string(),
+  categoryRaw: z18.string().nullable(),
+  chosenName: z18.string(),
+  chosenEcosystem: z18.string().nullable(),
+  chosenPackage: z18.string().nullable(),
+  reversed: z18.boolean(),
+  detail: z18.unknown()
 });
 var RUN_INSIGHT_PASS_KINDS = [
   "INSTALL",
@@ -1652,26 +1845,26 @@ var RUN_INSIGHT_PASS_KINDS = [
   "EXPERIMENT_DELTA",
   "VISIBILITY"
 ];
-var runInsightPassKindSchema = z17.enum(RUN_INSIGHT_PASS_KINDS);
+var runInsightPassKindSchema = z18.enum(RUN_INSIGHT_PASS_KINDS);
 var insightPipelinePassSchema = insightPassSchema.extend({
   kind: runInsightPassKindSchema
 });
-var runInsightResponseSchema = z17.object({
-  runId: z17.string(),
+var runInsightResponseSchema = z18.object({
+  runId: z18.string(),
   decision: insightPassSchema,
-  passes: z17.array(insightPipelinePassSchema),
-  decisions: z17.array(runDecisionSchema),
-  experimentDelta: z17.unknown().nullable(),
+  passes: z18.array(insightPipelinePassSchema),
+  decisions: z18.array(runDecisionSchema),
+  experimentDelta: z18.unknown().nullable(),
   /** The VISIBILITY pass's output (winners/picks) — loose server JSON, null
    *  for non-visibility runs or before the pass completes. */
-  visibilityVerdict: z17.unknown().nullable()
+  visibilityVerdict: z18.unknown().nullable()
 });
-var runEventSchema = z17.looseObject({
-  run_id: z17.string(),
-  seq: z17.number(),
-  turn: z17.number(),
-  ts: z17.string(),
-  type: z17.string()
+var runEventSchema = z18.looseObject({
+  run_id: z18.string(),
+  seq: z18.number(),
+  turn: z18.number(),
+  ts: z18.string(),
+  type: z18.string()
 });
 
 // ../packages/api-schemas/src/runConfig.ts
@@ -1681,16 +1874,16 @@ var SCHEDULABLE_AGENTS = [
   "PI",
   "OPENCODE"
 ];
-var schedulableAgentSchema = z18.enum(SCHEDULABLE_AGENTS);
-var agentConfigSchema = z18.object({
+var schedulableAgentSchema = z19.enum(SCHEDULABLE_AGENTS);
+var agentConfigSchema = z19.object({
   agent: agentSchema,
-  models: z18.array(z18.string().min(1))
+  models: z19.array(z19.string().min(1))
 });
-var agentConfigInputSchema = z18.object({
+var agentConfigInputSchema = z19.object({
   agent: schedulableAgentSchema,
-  models: z18.array(z18.string().min(1)).default([])
+  models: z19.array(z19.string().min(1)).default([])
 });
-var assetRefSchema = z18.string().max(320).regex(
+var assetRefSchema = z19.string().max(320).regex(
   /^[A-Za-z0-9][A-Za-z0-9._-]*@[^\s,]+$/,
   'asset references must be "name@label"'
 );
@@ -1698,7 +1891,7 @@ function refAssetName(ref) {
   const at = ref.indexOf("@");
   return at < 0 ? ref : ref.slice(0, at);
 }
-var assetRefListSchema = z18.array(assetRefSchema).superRefine((refs, ctx) => {
+var assetRefListSchema = z19.array(assetRefSchema).superRefine((refs, ctx) => {
   const names = /* @__PURE__ */ new Set();
   for (const ref of refs) {
     const name = refAssetName(ref);
@@ -1722,62 +1915,62 @@ function totalRunsPerCycle(owners, samplesPerCycle) {
 }
 
 // ../packages/api-schemas/src/ownedConfigurations.ts
-var sampleCountSchema = z19.number().int().min(1).max(50);
-var nextRunAtInputSchema = z19.string().regex(/^\d{4}-\d{2}-\d{2}/, "Next run must be a calendar date").nullable();
-var ownedCadenceSchema = z19.enum([
+var sampleCountSchema = z20.number().int().min(1).max(50);
+var nextRunAtInputSchema = z20.string().regex(/^\d{4}-\d{2}-\d{2}/, "Next run must be a calendar date").nullable();
+var ownedCadenceSchema = z20.enum([
   "NONE",
   "DAILY",
   "WEEKLY",
   "MONTHLY"
 ]);
 var ownedConfigurationInputShape = {
-  repoUrl: z19.string().nullish(),
-  repoRef: z19.string().nullish(),
-  profileId: z19.string().nullish(),
-  agents: z19.array(agentConfigInputSchema).min(1, "Select at least one agent"),
+  repoUrl: z20.string().nullish(),
+  repoRef: z20.string().nullish(),
+  profileId: z20.string().nullish(),
+  agents: z20.array(agentConfigInputSchema).min(1, "Select at least one agent"),
   skillRefs: assetRefListSchema.optional().default([]),
   mcpRefs: assetRefListSchema.optional().default([]),
-  connectionIds: z19.array(z19.string().min(1)).max(32).optional().default([]),
+  connectionIds: z20.array(z20.string().min(1)).max(32).optional().default([]),
   cadence: ownedCadenceSchema.optional().default("NONE"),
   nextRunAt: nextRunAtInputSchema.optional(),
   sampleCount: sampleCountSchema.optional().default(1)
 };
-var ownedConfigurationInputSchema = z19.object(ownedConfigurationInputShape).strict();
+var ownedConfigurationInputSchema = z20.object(ownedConfigurationInputShape).strict();
 var ownedConfigurationPatchShape = {
-  repoUrl: z19.string().nullish(),
-  repoRef: z19.string().nullish(),
-  profileId: z19.string().nullish(),
-  agents: z19.array(agentConfigInputSchema).min(1, "Select at least one agent").optional(),
+  repoUrl: z20.string().nullish(),
+  repoRef: z20.string().nullish(),
+  profileId: z20.string().nullish(),
+  agents: z20.array(agentConfigInputSchema).min(1, "Select at least one agent").optional(),
   skillRefs: assetRefListSchema.optional(),
   mcpRefs: assetRefListSchema.optional(),
-  connectionIds: z19.array(z19.string().min(1)).max(32).optional(),
+  connectionIds: z20.array(z20.string().min(1)).max(32).optional(),
   cadence: ownedCadenceSchema.optional(),
   nextRunAt: nextRunAtInputSchema.optional(),
   sampleCount: sampleCountSchema.optional()
 };
-var ownedConfigurationSchema = z19.object({
-  repoUrl: z19.string().nullable(),
-  repoRef: z19.string().nullable(),
-  profile: z19.object({ id: z19.string(), name: z19.string() }).nullable(),
-  agents: z19.array(agentConfigSchema),
-  skillRefs: z19.array(z19.string()),
-  mcpRefs: z19.array(z19.string()),
-  connectionIds: z19.array(z19.string()),
+var ownedConfigurationSchema = z20.object({
+  repoUrl: z20.string().nullable(),
+  repoRef: z20.string().nullable(),
+  profile: z20.object({ id: z20.string(), name: z20.string() }).nullable(),
+  agents: z20.array(agentConfigSchema),
+  skillRefs: z20.array(z20.string()),
+  mcpRefs: z20.array(z20.string()),
+  connectionIds: z20.array(z20.string()),
   cadence: ownedCadenceSchema,
   sampleCount: sampleCountSchema,
-  lastScheduledAt: z19.string().nullable(),
-  nextRunAt: z19.string().nullable()
-});
-var visibilityScenarioSchema = z19.object({
-  id: z19.string(),
-  repoUrl: z19.string().nullable(),
-  repoRef: z19.string().nullable(),
-  profile: z19.object({ id: z19.string(), name: z19.string() }).nullable()
-});
-var visibilityScenarioInputSchema = z19.object({
-  repoUrl: z19.string().nullish(),
-  repoRef: z19.string().nullish(),
-  profileId: z19.string().nullish()
+  lastScheduledAt: z20.string().nullable(),
+  nextRunAt: z20.string().nullable()
+});
+var visibilityScenarioSchema = z20.object({
+  id: z20.string(),
+  repoUrl: z20.string().nullable(),
+  repoRef: z20.string().nullable(),
+  profile: z20.object({ id: z20.string(), name: z20.string() }).nullable()
+});
+var visibilityScenarioInputSchema = z20.object({
+  repoUrl: z20.string().nullish(),
+  repoRef: z20.string().nullish(),
+  profileId: z20.string().nullish()
 }).strict();
 var visibilityPromptSettingsInputShape = {
   agents: ownedConfigurationInputShape.agents,
@@ -1797,416 +1990,141 @@ var visibilityPromptSettingsPatchShape = {
   nextRunAt: ownedConfigurationPatchShape.nextRunAt,
   sampleCount: ownedConfigurationPatchShape.sampleCount
 };
-var visibilityPromptSettingsSchema = z19.object({
-  agents: z19.array(agentConfigSchema),
-  skillRefs: z19.array(z19.string()),
-  mcpRefs: z19.array(z19.string()),
-  connectionIds: z19.array(z19.string()),
+var visibilityPromptSettingsSchema = z20.object({
+  agents: z20.array(agentConfigSchema),
+  skillRefs: z20.array(z20.string()),
+  mcpRefs: z20.array(z20.string()),
+  connectionIds: z20.array(z20.string()),
   cadence: ownedCadenceSchema,
   sampleCount: sampleCountSchema,
-  lastScheduledAt: z19.string().nullable(),
-  nextRunAt: z19.string().nullable()
-});
-var runAgentsOverrideSchema = z19.array(agentConfigInputSchema).min(1, "Select at least one agent");
-var runEvalBodySchema = z19.object({ billToOrg: z19.boolean().optional() }).strict();
-var runVisibilityBodySchema = z19.object({
-  billToOrg: z19.boolean().optional(),
-  visibilityScenarioIds: z19.array(z19.string().min(1)).min(1).optional()
+  lastScheduledAt: z20.string().nullable(),
+  nextRunAt: z20.string().nullable()
+});
+var runAgentsOverrideSchema = z20.array(agentConfigInputSchema).min(1, "Select at least one agent");
+var runEvalBodySchema = z20.object({ billToOrg: z20.boolean().optional() }).strict();
+var runVisibilityBodySchema = z20.object({
+  billToOrg: z20.boolean().optional(),
+  visibilityScenarioIds: z20.array(z20.string().min(1)).min(1).optional()
 }).strict();
 
 // ../packages/api-schemas/src/evals.ts
-var criterionSchema = z20.object({
-  id: z20.string(),
-  name: z20.string(),
-  rubric: z20.string(),
-  position: z20.number().int()
+var criterionSchema = z21.object({
+  id: z21.string(),
+  name: z21.string(),
+  rubric: z21.string(),
+  position: z21.number().int()
 });
-var criterionInputSchema = z20.object({
+var criterionInputSchema = z21.object({
   /** Present = update in place; absent = create. */
-  id: z20.string().optional(),
+  id: z21.string().optional(),
   /** Label only; omit and the server derives it from the rubric. */
-  name: z20.string().min(1).optional(),
-  rubric: z20.string().min(1)
+  name: z21.string().min(1).optional(),
+  rubric: z21.string().min(1)
 });
-var evalSetSchema = z20.object({
-  id: z20.string(),
+var evalSetSchema = z21.object({
+  id: z21.string(),
   /** Repository-generated suite provenance; null for ordinary evals. */
-  suiteId: z20.string().nullable(),
-  name: z20.string(),
-  promptText: z20.string(),
-  createdAt: z20.string(),
-  criteria: z20.array(criterionSchema),
+  suiteId: z21.string().nullable(),
+  name: z21.string(),
+  promptText: z21.string(),
+  createdAt: z21.string(),
+  criteria: z21.array(criterionSchema),
   /** User tag names on the hidden backing prompt (Surface:* excluded). */
-  tags: z20.array(z20.string())
+  tags: z21.array(z21.string())
 }).extend(ownedConfigurationSchema.shape);
-var agentPassRateSchema = z20.object({
+var agentPassRateSchema = z21.object({
   agent: agentSchema,
-  model: z20.string(),
-  runId: z20.string(),
-  finishedAt: z20.string().nullable(),
-  passed: z20.number().int(),
-  total: z20.number().int()
-});
-var evalSetStatSchema = z20.object({
-  passRates: z20.array(agentPassRateSchema),
-  runCount: z20.number().int(),
+  model: z21.string(),
+  runId: z21.string(),
+  finishedAt: z21.string().nullable(),
+  passed: z21.number().int(),
+  total: z21.number().int()
+});
+var evalSetStatSchema = z21.object({
+  passRates: z21.array(agentPassRateSchema),
+  runCount: z21.number().int(),
   /** Run-level aggregate: a run passes only when every criterion passed. */
-  judgedRuns: z20.number().int(),
-  passedRuns: z20.number().int()
+  judgedRuns: z21.number().int(),
+  passedRuns: z21.number().int()
 });
-var csv2 = z20.string().transform(
+var csv2 = z21.string().transform(
   (s) => s.split(",").map((x) => x.trim()).filter(Boolean)
 );
-var listEvalSetsQuerySchema = z20.object({
-  agents: csv2.pipe(z20.array(agentSchema)).optional(),
+var listEvalSetsQuerySchema = z21.object({
+  agents: csv2.pipe(z21.array(agentSchema)).optional(),
   models: csv2.optional(),
-  since: z20.coerce.date().optional()
+  since: z21.coerce.date().optional()
 });
 var evalSetListItemSchema = evalSetSchema.extend({
   stats: evalSetStatSchema
 });
-var listEvalSetsResponseSchema = z20.object({
-  items: z20.array(evalSetListItemSchema)
+var listEvalSetsResponseSchema = z21.object({
+  items: z21.array(evalSetListItemSchema)
 });
-var createEvalSetBodySchema = z20.object({
-  name: z20.string().min(1),
-  promptText: z20.string().min(1),
-  criteria: z20.array(criterionInputSchema).min(1),
+var createEvalSetBodySchema = z21.object({
+  name: z21.string().min(1),
+  promptText: z21.string().min(1),
+  criteria: z21.array(criterionInputSchema).min(1),
   /** User tag names, create-on-type (Surface:* rejected/dropped). */
-  tags: z20.array(z20.string()).optional()
+  tags: z21.array(z21.string()).optional()
 }).extend(ownedConfigurationInputSchema.shape).strict();
-var updateEvalSetBodySchema = z20.object({
-  name: z20.string().min(1).optional(),
-  promptText: z20.string().min(1).optional(),
-  criteria: z20.array(criterionInputSchema).min(1).optional(),
-  tags: z20.array(z20.string()).optional()
+var updateEvalSetBodySchema = z21.object({
+  name: z21.string().min(1).optional(),
+  promptText: z21.string().min(1).optional(),
+  criteria: z21.array(criterionInputSchema).min(1).optional(),
+  tags: z21.array(z21.string()).optional()
 }).extend(ownedConfigurationPatchShape).strict();
-var runEvalSetResponseSchema = z20.object({
-  batchIds: z20.array(z20.string()),
-  runIds: z20.array(z20.string()),
+var runEvalSetResponseSchema = z21.object({
+  batchIds: z21.array(z21.string()),
+  runIds: z21.array(z21.string()),
   /** Durable launch request; absent for older and climb-trial launch paths. */
-  runRequestId: z20.string().optional()
+  runRequestId: z21.string().optional()
 });
-var evalSetRunSchema = z20.object({
-  id: z20.string(),
-  status: z20.string(),
+var evalSetRunSchema = z21.object({
+  id: z21.string(),
+  status: z21.string(),
   agent: agentSchema,
-  model: z20.string().nullable(),
-  resolvedModel: z20.string().nullable(),
-  createdAt: z20.string(),
-  startedAt: z20.string().nullable(),
-  finishedAt: z20.string().nullable(),
-  failureReason: z20.string().nullable(),
-  judge: z20.object({ status: z20.string(), error: z20.string().nullable() }).nullable(),
-  criterionResults: z20.array(
-    z20.object({
-      criterionId: z20.string().nullable(),
-      name: z20.string(),
-      passed: z20.boolean(),
-      reasoning: z20.string().nullable()
+  model: z21.string().nullable(),
+  resolvedModel: z21.string().nullable(),
+  createdAt: z21.string(),
+  startedAt: z21.string().nullable(),
+  finishedAt: z21.string().nullable(),
+  failureReason: z21.string().nullable(),
+  judge: z21.object({ status: z21.string(), error: z21.string().nullable() }).nullable(),
+  criterionResults: z21.array(
+    z21.object({
+      criterionId: z21.string().nullable(),
+      name: z21.string(),
+      passed: z21.boolean(),
+      reasoning: z21.string().nullable()
     })
   )
 });
-var listEvalSetRunsResponseSchema = z20.object({
-  items: z20.array(evalSetRunSchema)
+var listEvalSetRunsResponseSchema = z21.object({
+  items: z21.array(evalSetRunSchema)
 });
 
 // ../packages/api-schemas/src/executionTargets.ts
-import { z as z21 } from "zod";
-var executionTargetCapabilitiesSchema = z21.object({
-  skills: z21.boolean(),
-  mcp: z21.boolean(),
-  connections: z21.boolean(),
-  agentContext: z21.boolean(),
-  resume: z21.boolean()
-});
-var executionTargetSchema = z21.object({
+import { z as z22 } from "zod";
+var executionTargetCapabilitiesSchema = z22.object({
+  skills: z22.boolean(),
+  mcp: z22.boolean(),
+  connections: z22.boolean(),
+  agentContext: z22.boolean(),
+  resume: z22.boolean()
+});
+var executionTargetSchema = z22.object({
   harness: agentSchema,
-  harnessSlug: z21.string(),
-  harnessLabel: z21.string(),
-  model: z21.string(),
-  modelLabel: z21.string(),
-  providerSlug: z21.string(),
-  providerLabel: z21.string(),
+  harnessSlug: z22.string(),
+  harnessLabel: z22.string(),
+  model: z22.string(),
+  modelLabel: z22.string(),
+  providerSlug: z22.string(),
+  providerLabel: z22.string(),
   capabilities: executionTargetCapabilitiesSchema
 });
-var executionTargetsResponseSchema = z21.object({
-  items: z21.array(executionTargetSchema)
-});
-
-// ../packages/api-schemas/src/experiments.ts
-var experiments_exports = {};
-__export(experiments_exports, {
-  EXPERIMENT_MODES: () => EXPERIMENT_MODES,
-  EXPERIMENT_STATUSES: () => EXPERIMENT_STATUSES,
-  SUPPORT_CLASSES: () => SUPPORT_CLASSES,
-  TERMINAL_EXPERIMENT_STATUSES: () => TERMINAL_EXPERIMENT_STATUSES,
-  addVariantBodySchema: () => addVariantBodySchema,
-  cancelResponseSchema: () => cancelResponseSchema,
-  createExperimentBodyFields: () => createExperimentBodyFields,
-  createExperimentBodySchema: () => createExperimentBodySchema,
-  createExperimentResponseSchema: () => createExperimentResponseSchema,
-  eligibleExperimentRunSchema: () => eligibleExperimentRunSchema,
-  experimentBoundarySchema: () => experimentBoundarySchema,
-  experimentContentQuerySchema: () => experimentContentQuerySchema,
-  experimentContentResponseSchema: () => experimentContentResponseSchema,
-  experimentContentTypeSchema: () => experimentContentTypeSchema,
-  experimentDetailSchema: () => experimentDetailSchema,
-  experimentListQuerySchema: () => experimentListQuerySchema,
-  experimentListResponseSchema: () => experimentListResponseSchema,
-  experimentModeSchema: () => experimentModeSchema,
-  experimentStatusResponseSchema: () => experimentStatusResponseSchema,
-  experimentStatusSchema: () => experimentStatusSchema,
-  experimentSummarySchema: () => experimentSummarySchema,
-  experimentVariantSchema: () => experimentVariantSchema,
-  fixerEditSchema: () => fixerEditSchema,
-  launchResultSchema: () => launchResultSchema,
-  patchVariantBodySchema: () => patchVariantBodySchema,
-  recommendationSchema: () => recommendationSchema,
-  shipBodySchema: () => shipBodySchema,
-  supportClassSchema: () => supportClassSchema,
-  variantDeltaSchema: () => variantDeltaSchema,
-  variantRefSchema: () => variantRefSchema,
-  variantRunSchema: () => variantRunSchema,
-  writeRoundResponseSchema: () => writeRoundResponseSchema,
-  writeVariantContentBodySchema: () => writeVariantContentBodySchema,
-  writeVariantContentResponseSchema: () => writeVariantContentResponseSchema
-});
-import { z as z22 } from "zod";
-var EXPERIMENT_STATUSES = [
-  "DRAFT",
-  "GENERATING",
-  "LAUNCHING",
-  "RUNNING",
-  "SYNTHESIZING",
-  "COMPLETE",
-  "PARTIAL",
-  "FAILED",
-  "CANCELED"
-];
-var experimentStatusSchema = z22.enum(EXPERIMENT_STATUSES);
-var TERMINAL_EXPERIMENT_STATUSES = [
-  "COMPLETE",
-  "PARTIAL",
-  "FAILED",
-  "CANCELED"
-];
-var SUPPORT_CLASSES = [
-  "RECOMMENDED",
-  "PROMISING",
-  "NOT_SUPPORTED",
-  "NOT_EVALUABLE"
-];
-var supportClassSchema = z22.enum(SUPPORT_CLASSES);
-var jsonValue = z22.unknown();
-var EXPERIMENT_MODES = ["PROPOSE", "DIRECT", "MANUAL"];
-var experimentModeSchema = z22.enum(EXPERIMENT_MODES);
-var createExperimentBodyFields = z22.object({
-  runId: z22.string().min(1),
-  boundarySeq: z22.string().min(1),
-  problemText: z22.string().trim().min(1).optional(),
-  /** OPTIONAL, and it stays optional: a CLI built before the bifurcation must
-   *  keep working, and omitting it means PROPOSE — the behaviour it already
-   *  expects. */
-  mode: experimentModeSchema.optional(),
-  /** DIRECT only: the one change to make, in the author's own words. Ignored
-   *  in the other modes. Carried as the single rewrite's title, and REQUIRED
-   *  when `mode` is DIRECT — see the cross-field check below. */
-  changeInstruction: z22.string().trim().min(1).max(200).optional()
-});
-var createExperimentBodySchema = createExperimentBodyFields.superRefine((body, ctx) => {
-  if (body.mode === "DIRECT" && !body.changeInstruction) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["changeInstruction"],
-      message: "mode DIRECT requires changeInstruction \u2014 the one change to make, in your own words"
-    });
-  }
-});
-var createExperimentResponseSchema = z22.object({
-  experimentId: z22.string(),
-  /** false = an existing draft for this (run, boundary) was resumed. */
-  created: z22.boolean(),
-  /** What is persisted — a resume keeps the statement it was opened with. */
-  problemText: z22.string(),
-  /** The PERSISTED mode, echoed for the same reason `problemText` is: exactly
-   *  one live draft exists per (run, boundary), so a resume returns the mode
-   *  that draft was opened with — which may not be the one this call asked
-   *  for. Clients report what came back, not what they sent. */
-  mode: experimentModeSchema
-});
-var experimentListQuerySchema = z22.object({
-  status: z22.string().transform(
-    (s) => s.split(",").map((x) => x.trim().toUpperCase()).filter(Boolean)
-  ).pipe(z22.array(experimentStatusSchema)).optional(),
-  limit: z22.coerce.number().int().min(1).max(100).default(25)
-});
-var experimentSummarySchema = z22.object({
-  id: z22.string(),
-  status: experimentStatusSchema,
-  problem: z22.string(),
-  boundaryUrl: z22.string().nullable(),
-  sourceRunId: z22.string(),
-  variantCount: z22.number().int(),
-  createdAt: z22.string()
-});
-var experimentListResponseSchema = z22.object({
-  items: z22.array(experimentSummarySchema)
-});
-var eligibleExperimentRunSchema = z22.object({
-  runId: z22.string(),
-  agent: agentSchema,
-  promptText: z22.string(),
-  createdAt: z22.string(),
-  verdict: z22.string().nullable(),
-  boundaryCount: z22.number().int()
-});
-var experimentBoundarySchema = z22.object({
-  boundarySeq: z22.union([z22.string(), z22.number()]),
-  turn: z22.number().int().nullable(),
-  url: z22.string(),
-  domain: z22.string().nullable(),
-  fetchPrompt: z22.string().nullable(),
-  source: z22.string(),
-  boundaryCheckpointId: z22.string().nullable(),
-  boundaryOrdinal: z22.number().int().nullable(),
-  capturedOccurrence: z22.number().int().nullable()
-});
-var variantRunSchema = z22.object({
-  runId: z22.string(),
-  status: z22.string(),
-  failureReason: z22.string().nullable(),
-  integrations: z22.array(jsonValue)
-});
-var experimentVariantSchema = z22.object({
-  variantId: z22.string(),
-  key: z22.string(),
-  title: z22.string(),
-  hypothesis: z22.string(),
-  rewriteChars: z22.number().int(),
-  hasRewrite: z22.boolean(),
-  invalidReason: z22.string().nullable(),
-  planStatus: z22.string().nullable(),
-  planError: z22.string().nullable(),
-  runs: z22.array(variantRunSchema),
-  /** Arm verdict / finding counts / EXPERIMENT_DELTA output — server-owned
-   *  analytic JSON, null until computable. */
-  verdict: jsonValue.nullable(),
-  findings: jsonValue.nullable(),
-  delta: jsonValue.nullable()
-});
-var experimentDetailSchema = z22.object({
-  id: z22.string(),
-  status: experimentStatusSchema,
-  problem: z22.string(),
-  boundaryUrl: z22.string().nullable(),
-  createdAt: z22.string(),
-  editable: z22.boolean(),
-  roundInFlight: z22.boolean(),
-  launching: z22.boolean(),
-  launchError: z22.string().nullable(),
-  planned: z22.boolean(),
-  livePage: jsonValue.nullable(),
-  sourceRun: z22.object({
-    runId: z22.string(),
-    agent: agentSchema,
-    status: z22.string(),
-    task: z22.string(),
-    repoUrl: z22.string().nullable(),
-    verdict: jsonValue.nullable(),
-    integrations: z22.array(jsonValue)
-  }),
-  variants: z22.array(experimentVariantSchema),
-  /** The settled comparison (winners vs baseline) — null until launched. */
-  summary: jsonValue.nullable()
-});
-var experimentStatusResponseSchema = z22.object({
-  id: z22.string(),
-  status: experimentStatusSchema,
-  planned: z22.boolean(),
-  writeStartedAt: z22.string().nullable(),
-  launchStartedAt: z22.string().nullable(),
-  launchError: z22.string().nullable(),
-  shippedVariantId: z22.string().nullable(),
-  shippedAt: z22.string().nullable()
-});
-var addVariantBodySchema = z22.object({
-  title: z22.string().optional(),
-  hypothesis: z22.string().optional()
-});
-var patchVariantBodySchema = z22.object({
-  title: z22.string().optional(),
-  hypothesis: z22.string().optional()
-});
-var fixerEditSchema = z22.object({
-  find: z22.string().min(1),
-  replace: z22.string()
-});
-var experimentContentTypeSchema = z22.string().trim().toLowerCase().max(127).regex(
-  /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/,
-  "contentType must be a MIME type such as text/markdown"
-);
-var writeVariantContentBodySchema = z22.object({
-  content: z22.string().optional(),
-  edits: z22.array(fixerEditSchema).optional(),
-  contentType: experimentContentTypeSchema.optional()
-});
-var writeVariantContentResponseSchema = z22.object({
-  variantId: z22.string(),
-  chars: z22.number().int(),
-  truncated: z22.boolean(),
-  applied: z22.number().int(),
-  skipped: z22.number().int()
-});
-var experimentContentQuerySchema = z22.object({
-  variantId: z22.string().optional(),
-  offset: z22.coerce.number().int().min(0).default(0),
-  maxChars: z22.coerce.number().int().min(1).max(4e4).default(2e4)
-});
-var experimentContentResponseSchema = z22.object({
-  source: z22.string(),
-  totalChars: z22.number().int(),
-  offset: z22.number().int(),
-  returnedChars: z22.number().int(),
-  nextOffset: z22.number().int().nullable(),
-  content: z22.string()
-});
-var writeRoundResponseSchema = z22.object({
-  queued: z22.number().int(),
-  reason: z22.enum(["round_in_flight", "nothing_pending"]).optional()
-});
-var launchResultSchema = z22.object({
-  experimentId: z22.string(),
-  status: z22.literal("LAUNCHING")
-});
-var shipBodySchema = z22.object({ variantId: z22.string().min(1) });
-var cancelResponseSchema = z22.object({
-  id: z22.string(),
-  status: z22.literal("CANCELED")
-});
-var variantDeltaSchema = z22.object({
-  changed: z22.boolean().nullable(),
-  hypothesisSupported: z22.enum(["supported", "refuted", "inconclusive"]).nullable(),
-  summary: z22.string().nullable()
-});
-var variantRefSchema = z22.object({
-  key: z22.string(),
-  title: z22.string(),
-  effect: z22.number().nullable(),
-  consistency: z22.string().nullable(),
-  note: z22.string().nullable(),
-  delta: variantDeltaSchema.nullable().optional()
-});
-var recommendationSchema = z22.object({
-  evaluatorVersion: z22.string(),
-  summary: z22.string(),
-  groups: z22.object({
-    recommended: z22.array(variantRefSchema),
-    promising: z22.array(variantRefSchema),
-    notSupported: z22.array(variantRefSchema),
-    notEvaluable: z22.array(variantRefSchema)
-  }),
-  tradeoffs: z22.array(z22.string())
+var executionTargetsResponseSchema = z22.object({
+  items: z22.array(executionTargetSchema)
 });
 
 // ../packages/api-schemas/src/invites.ts
@@ -2575,7 +2493,7 @@ var token = z28.string().min(1).max(4096);
 var optionFlag = z28.string().regex(/^--?[A-Za-z0-9][A-Za-z0-9-]*$/);
 var envKey = z28.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
 var relativePath = z28.string().min(1).max(1024).refine(
-  (path2) => !path2.startsWith("/") && !path2.includes("\\") && !path2.includes("\0") && path2.split("/").every(
+  (path3) => !path3.startsWith("/") && !path3.includes("\\") && !path3.includes("\0") && path3.split("/").every(
     (part) => part && part !== "." && part !== ".." && ![".git", "node_modules", ".pnpm", ".yarn", ".venv"].includes(part)
   ),
   "Use a workspace-relative path without traversal"
@@ -2702,15 +2620,15 @@ var cliTargetSchema = z28.object({
         path: ["commands", index, "id"],
         message: "Duplicate command ID"
       });
-    const { capabilities } = command;
-    if (new Set(capabilities.operations).size !== capabilities.operations.length)
+    const { capabilities: capabilities2 } = command;
+    if (new Set(capabilities2.operations).size !== capabilities2.operations.length)
       ctx.addIssue({
         code: "custom",
         path: ["commands", index, "capabilities", "operations"],
         message: "Duplicate operation"
       });
     const requires = (kind, valid, message) => {
-      if (capabilities.operations.includes(kind) && !valid)
+      if (capabilities2.operations.includes(kind) && !valid)
         ctx.addIssue({
           code: "custom",
           path: ["commands", index, "capabilities", "operations"],
@@ -2719,42 +2637,42 @@ var cliTargetSchema = z28.object({
     };
     requires(
       "streamOutput",
-      capabilities.outputModes.includes("streaming"),
+      capabilities2.outputModes.includes("streaming"),
       "Streaming output needs a qualified streaming mode"
     );
     requires(
       "completeOutput",
-      capabilities.outputModes.includes("completed"),
+      capabilities2.outputModes.includes("completed"),
       "Completed output needs a qualified completed mode"
     );
     requires(
       "structuredStdin",
-      capabilities.stdinFormats.length > 0,
+      capabilities2.stdinFormats.length > 0,
       "Structured stdin needs a qualified format"
     );
     requires(
       "promptRecipe",
-      capabilities.recipeIds.length > 0,
+      capabilities2.recipeIds.length > 0,
       "Prompt recipes need qualified prompt IDs"
     );
     requires(
       "generatedFile",
-      capabilities.generatedPaths.length > 0,
+      capabilities2.generatedPaths.length > 0,
       "Generated files need attributed output paths"
     );
     requires(
       "setEnv",
-      capabilities.settings.length > 0,
+      capabilities2.settings.length > 0,
       "Environment changes need supported settings"
     );
     requires(
       "ensureOption",
-      capabilities.options.length > 0,
+      capabilities2.options.length > 0,
       "Arguments need supported options"
     );
     requires(
       "replaceOption",
-      capabilities.options.length > 0,
+      capabilities2.options.length > 0,
       "Arguments need supported options"
     );
   }
@@ -2935,7 +2853,7 @@ var cliInterventionSchema = z28.object({
     "template"
   ]).nullable()
 }).strict().superRefine((bundle, ctx) => {
-  const fail = (path2, message) => ctx.addIssue({ code: "custom", path: path2, message });
+  const fail = (path3, message) => ctx.addIssue({ code: "custom", path: path3, message });
   if (bundle.schemaVersion !== bundle.catalog.version)
     fail(["schemaVersion"], "Bundle and catalog schema versions differ");
   if (bundle.identityPolicy && bundle.schemaVersion !== 2)
@@ -3051,24 +2969,24 @@ var cliInterventionSchema = z28.object({
     )
   );
   bundle.operations.forEach((operation, index) => {
-    const path2 = ["operations", index];
+    const path3 = ["operations", index];
     if (!command.capabilities.operations.includes(operation.kind))
-      fail(path2, `${operation.kind} is not qualified for this command`);
+      fail(path3, `${operation.kind} is not qualified for this command`);
     if ("option" in operation && !command.capabilities.options.some(
       (option) => option.flag === operation.option
     ))
-      fail(path2, "Option is not supported by this version");
+      fail(path3, "Option is not supported by this version");
     if (operation.kind === "ensureOption" || operation.kind === "replaceOption") {
       const option = command.capabilities.options.find(
         (item) => item.flag === operation.option
       );
       if (option && option.takesValue !== (operation.value !== void 0))
-        fail(path2, "Option value does not match its qualified arity");
+        fail(path3, "Option value does not match its qualified arity");
     }
     if (operation.kind === "setEnv" && !command.capabilities.settings.includes(operation.key))
-      fail(path2, "Environment setting is not supported by this version");
+      fail(path3, "Environment setting is not supported by this version");
     if (operation.kind === "structuredStdin" && !command.capabilities.stdinFormats.includes(operation.format))
-      fail(path2, "Stdin format is not qualified");
+      fail(path3, "Stdin format is not qualified");
     if (operation.kind === "structuredStdin" && operation.payload.source === "literal" && operation.format !== "text") {
       const records = operation.format === "json" ? [operation.payload.value] : operation.payload.value.trimEnd().split("\n");
       try {
@@ -3077,30 +2995,30 @@ var cliInterventionSchema = z28.object({
         for (const record of records) JSON.parse(record);
       } catch {
         fail(
-          path2,
+          path3,
           "Structured stdin payload does not match its declared JSON format"
         );
       }
     }
     if (operation.kind === "promptRecipe" && !command.capabilities.recipeIds.includes(operation.recipeId))
-      fail(path2, "Prompt recipe is not qualified");
+      fail(path3, "Prompt recipe is not qualified");
     if (operation.kind === "generatedFile" && !command.capabilities.generatedPaths.includes(operation.path))
-      fail(path2, "Output path is not attributed to this command");
+      fail(path3, "Output path is not attributed to this command");
     if (operation.kind === "generatedFile" && !bundle.baselineInvocations.some(
       (invocation) => invocation.targetId === target.id && invocation.commandId === command.id && invocation.recordFiles.some(
         (file) => file.path === operation.path && file.status === "generated" && file.beforeSha256 === operation.beforeSha256 && file.generatedSha256 === operation.generatedSha256
       )
     ))
       fail(
-        path2,
+        path3,
         "No attributed baseline file matches the preimage and real generated bytes"
       );
     if (operation.kind === "streamOutput" && !command.capabilities.outputModes.includes("streaming"))
-      fail(path2, "Streaming output is not qualified");
+      fail(path3, "Streaming output is not qualified");
     if (operation.kind === "completeOutput" && !command.capabilities.outputModes.includes("completed"))
-      fail(path2, "Completed output is not qualified");
+      fail(path3, "Completed output is not qualified");
     if (operation.kind === "streamOutput" && operation.edit.find === operation.edit.replace || operation.kind === "generatedFile" && operation.edit.find === operation.edit.replace || operation.kind === "completeOutput" && operation.matcher.kind === "literal" && operation.matcher.text === operation.replace)
-      fail(path2, "A trial operation must change the matched content");
+      fail(path3, "A trial operation must change the matched content");
     const sources = [
       "value" in operation ? operation.value : null,
       operation.kind === "structuredStdin" ? operation.payload : null,
@@ -3109,17 +3027,17 @@ var cliInterventionSchema = z28.object({
     if (sources.some(
       (source) => source?.source === "localFact" && !command.capabilities.localFacts.includes(source.key)
     ))
-      fail(path2, "Local fact is not declared non-secret for this command");
+      fail(path3, "Local fact is not declared non-secret for this command");
     if (sources.some(
       (source) => source?.source === "localFact" && changedEnvironment.has(source.key)
     ))
       fail(
-        path2,
+        path3,
         "A local fact cannot be changed by another operation in the same trial"
       );
     const conflict = operation.kind === "ensureOption" || operation.kind === "replaceOption" ? `option:${operation.option}` : operation.kind === "setEnv" ? `env:${operation.key}` : operation.kind === "structuredStdin" ? "stdin" : operation.kind === "promptRecipe" ? `prompt:${operation.recipeId}` : operation.kind === "generatedFile" ? `file:${operation.path}` : null;
     if (conflict && seen.has(conflict))
-      fail(path2, "Conflicting operation on the same input or output");
+      fail(path3, "Conflicting operation on the same input or output");
     if (conflict) seen.add(conflict);
   });
   if (bundle.operations.filter((item) => item.kind === "generatedFile").length > bundle.limits.generatedFileCount)
@@ -3173,7 +3091,7 @@ var ecosystemSchema = z29.enum(["npm", "pypi", "cargo", "go", "gem"]);
 var overrideFilesSchema = z29.array(
   z29.object({
     path: z29.string().min(1).refine(
-      (path2) => !path2.startsWith("/") && !path2.includes("\\") && !path2.split("/").includes(".."),
+      (path3) => !path3.startsWith("/") && !path3.includes("\\") && !path3.split("/").includes(".."),
       "Use a relative path within the target"
     ),
     body: z29.string()
@@ -4018,7 +3936,7 @@ var builtDirectoryResourceSchema = z39.object({
     });
 });
 var bundleRelativeScriptSchema = z39.string().min(1).refine(
-  (path2) => !path2.startsWith("/") && !path2.includes("\\") && !path2.includes("\0") && !path2.split("/").includes("..") && path2.split("/").some((part) => part !== "" && part !== "."),
+  (path3) => !path3.startsWith("/") && !path3.includes("\\") && !path3.includes("\0") && !path3.split("/").includes("..") && path3.split("/").some((part) => part !== "" && part !== "."),
   "Install script must be a bundle-relative path without traversal"
 );
 var preparedDirectoryPrepareSchema = z39.union([
@@ -4160,7 +4078,7 @@ var githubCasePathSchema = z40.string().regex(
   /^evals\/[A-Za-z0-9_./-]+\.md$/,
   "Expected an explicit evals/*.md path"
 ).refine(
-  (path2) => path2.split("/").every((part) => part !== "" && part !== "." && part !== ".."),
+  (path3) => path3.split("/").every((part) => part !== "" && part !== "." && part !== ".."),
   "Case path must not contain traversal or empty segments"
 );
 var runDefinitionFileConfigSchema = z40.object({
@@ -4565,8 +4483,8 @@ function writeConfig(config) {
 }
 function updateConfig(patch) {
   const next = { ...readConfig(), ...patch };
-  for (const key of [...CONFIG_KEYS, "staff"]) {
-    if (next[key] === void 0) delete next[key];
+  for (const key2 of [...CONFIG_KEYS, "staff"]) {
+    if (next[key2] === void 0) delete next[key2];
   }
   writeConfig(next);
   return next;
@@ -4642,28 +4560,28 @@ var ApiClient = class {
     this.baseUrl = (options.baseUrl ?? resolveBaseUrl()).replace(/\/+$/, "");
     this.token = options.token !== void 0 ? options.token : resolveToken();
   }
-  async get(path2, query) {
-    return this.request("GET", path2, { query });
+  async get(path3, query) {
+    return this.request("GET", path3, { query });
   }
-  async post(path2, body, query) {
-    return this.request("POST", path2, { body, query });
+  async post(path3, body, query) {
+    return this.request("POST", path3, { body, query });
   }
-  async patch(path2, body, query) {
-    return this.request("PATCH", path2, { body, query });
+  async patch(path3, body, query) {
+    return this.request("PATCH", path3, { body, query });
   }
-  async put(path2, body, query) {
-    return this.request("PUT", path2, { body, query });
+  async put(path3, body, query) {
+    return this.request("PUT", path3, { body, query });
   }
-  async delete(path2, query) {
-    return this.request("DELETE", path2, { query });
+  async delete(path3, query) {
+    return this.request("DELETE", path3, { query });
   }
   /**
    * Tail a server-sent-event endpoint (e.g. GET /runs/{id}/events), invoking
    * `onEvent` per data frame. Resolves when the server closes the stream or
    * `options.signal` aborts.
    */
-  async sse(path2, onEvent, options = {}) {
-    const res = await this.fetch(this.url(path2, options.query), {
+  async sse(path3, onEvent, options = {}) {
+    const res = await this.fetch(this.url(path3, options.query), {
       method: "GET",
       headers: this.headers({ Accept: "text/event-stream" }),
       signal: options.signal
@@ -4695,10 +4613,10 @@ var ApiClient = class {
       throw new CliError("network", `Event stream failed: ${messageOf(error)}`);
     }
   }
-  url(path2, query) {
-    const url = new URL(`${this.baseUrl}${path2}`);
-    for (const [key, value] of Object.entries(query ?? {})) {
-      if (value !== void 0) url.searchParams.set(key, String(value));
+  url(path3, query) {
+    const url = new URL(`${this.baseUrl}${path3}`);
+    for (const [key2, value] of Object.entries(query ?? {})) {
+      if (value !== void 0) url.searchParams.set(key2, String(value));
     }
     return url;
   }
@@ -4727,11 +4645,11 @@ var ApiClient = class {
       );
     }
   }
-  async request(method, path2, options = {}) {
+  async request(method, path3, options = {}) {
     const headers = this.headers(
       options.body === void 0 ? void 0 : { "Content-Type": "application/json" }
     );
-    const res = await this.fetch(this.url(path2, options.query), {
+    const res = await this.fetch(this.url(path3, options.query), {
       method,
       headers,
       body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
@@ -4836,7 +4754,7 @@ function printItems(items, format, columns) {
     console.log("(no results)");
     return;
   }
-  const cols = columns ?? Object.keys(items[0]).map((key) => ({ key }));
+  const cols = columns ?? Object.keys(items[0]).map((key2) => ({ key: key2 }));
   const headers = cols.map((col) => col.header ?? col.key);
   const rows = items.map((item) => cols.map((col) => cell(item[col.key])));
   const widths = headers.map(
@@ -4965,14 +4883,14 @@ var EXAMPLE_SPEC = {
     }
   ]
 };
-function readSpec(path2) {
+function readSpec(path3) {
   let raw;
   try {
-    raw = readFileSync3(path2, "utf8");
+    raw = readFileSync3(path3, "utf8");
   } catch (e) {
     throw new CliError(
       "usage",
-      `cannot read spec file ${path2}: ${e instanceof Error ? e.message : String(e)}`
+      `cannot read spec file ${path3}: ${e instanceof Error ? e.message : String(e)}`
     );
   }
   let parsed;
@@ -5116,11 +5034,11 @@ import { createInterface } from "readline";
 import { setTimeout as sleep } from "timers/promises";
 
 // src/lib/paginate.ts
-async function fetchAllPages(client, path2, query = {}) {
+async function fetchAllPages(client, path3, query = {}) {
   const items = [];
   let cursor;
   do {
-    const page = await client.get(path2, {
+    const page = await client.get(path3, {
       limit: 200,
       ...query,
       cursor
@@ -5269,11 +5187,11 @@ async function browserLogin() {
   }
 }
 var DEVICE_ENDPOINT = "/api/v1/device";
-async function bootstrapPost(path2, body) {
+async function bootstrapPost(path3, body) {
   const base = resolveBaseUrl().replace(/\/+$/, "");
   let res;
   try {
-    res = await fetch(`${base}${path2}`, {
+    res = await fetch(`${base}${path3}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -5535,8 +5453,8 @@ function register3(program2) {
       `Token source: ${source === "env" ? "GAUGE_API_TOKEN environment variable" : credentialsPath()}`
     );
   });
-  const tokens = auth.command("tokens").description("Manage API tokens");
-  tokens.command("list").description("List your API tokens").action(async (_opts, command) => {
+  const tokens2 = auth.command("tokens").description("Manage API tokens");
+  tokens2.command("list").description("List your API tokens").action(async (_opts, command) => {
     const output = resolveOutput(command);
     const items = await fetchAllTokens(createClient());
     if (output === "json") {
@@ -5545,7 +5463,7 @@ function register3(program2) {
     }
     printItems(items.map(tokenRow), "table");
   });
-  tokens.command("create <name>").description("Create an API token (the secret is shown exactly once)").option("--expires-in <duration>", "e.g. 90d, 12h, or never", "never").action(
+  tokens2.command("create <name>").description("Create an API token (the secret is shown exactly once)").option("--expires-in <duration>", "e.g. 90d, 12h, or never", "never").action(
     async (name, opts, command) => {
       const output = resolveOutput(command);
       const expiresAt = parseExpiresIn(opts.expiresIn);
@@ -5566,7 +5484,7 @@ function register3(program2) {
       console.log("Store it now \u2014 it won't be shown again.");
     }
   );
-  tokens.command("revoke <id>").description("Revoke an API token").action(async (id, _opts, command) => {
+  tokens2.command("revoke <id>").description("Revoke an API token").action(async (id, _opts, command) => {
     await createClient().delete(
       `${TOKENS_PATH}/${encodeURIComponent(id)}`
     );
@@ -6009,37 +5927,137 @@ function register7(program2, opts = {}) {
   });
 }
 
+// src/commands/catalog.ts
+import { readFile } from "fs/promises";
+var path2 = "/api/v1/staff/catalog";
+function register8(program2, options = {}) {
+  const catalog = program2.command("catalog", { hidden: options.hidden ?? false }).description(
+    "Staff manifest \u2192 apply \u2192 canary \u2192 activate model catalog flow"
+  );
+  catalog.command("releases").description("List exact harness releases for a manifest").action(async () => printJson(await createClient().get(path2)));
+  for (const action of [
+    "plan",
+    "apply",
+    "canary",
+    "activate",
+    "enable",
+    "disable"
+  ]) {
+    catalog.command(`${action} <manifest>`).option("--runs <ids>", "canary run IDs, comma separated (activate)").option(
+      "--force",
+      "activate without successful canary evidence (activate)"
+    ).option("--timeout <seconds>", "canary wait timeout", "1800").action(
+      async (file, opts) => {
+        if (opts.force && action !== "activate")
+          throw new Error("--force is only supported by activate");
+        if (opts.runs && action !== "activate")
+          throw new Error("--runs is only supported by activate");
+        const seconds = Number(opts.timeout);
+        if (!Number.isFinite(seconds) || seconds <= 0)
+          throw new Error("--timeout must be positive seconds");
+        let manifest = catalogManifestSchema.parse(
+          JSON.parse(await readFile(file, "utf8"))
+        );
+        const client = createClient();
+        const request = async (step, extra = {}) => {
+          const result = await client.post(path2, {
+            action: step,
+            manifest,
+            ...extra
+          });
+          if (result.errors?.length) {
+            printJson(result);
+            throw new Error(
+              result.errors.map((e) => `${e.model}: ${e.message}`).join("; ")
+            );
+          }
+          return result;
+        };
+        if (action === "enable") {
+          const applied = await request("apply");
+          const pending = pendingCatalogManifest(manifest, applied.cells);
+          if (!pending) {
+            printJson(applied);
+            return;
+          }
+          manifest = pending;
+        }
+        if (action === "canary" || action === "enable") {
+          const { runIds, errors } = await client.post(path2, {
+            action: "canary",
+            manifest
+          });
+          process.stderr.write(`Canary runs: ${runIds.join(",")}
+`);
+          if (errors?.length)
+            throw new Error(
+              `Canary launch incomplete: ${JSON.stringify({ runIds, errors })}`
+            );
+          const deadline = Date.now() + seconds * 1e3;
+          while (Date.now() < deadline) {
+            const status = await client.post(path2, {
+              action: "status",
+              manifest,
+              runIds
+            });
+            if (status.passed) {
+              printJson(
+                action === "enable" ? await request("activate", { runIds }) : { runIds, ...status }
+              );
+              return;
+            }
+            if (status.terminal)
+              throw new Error(
+                `Canary failed: ${JSON.stringify(status.runs)}`
+              );
+            await new Promise((resolve2) => setTimeout(resolve2, 5e3));
+          }
+          throw new Error(
+            `Canary timed out; runs continue. Inspect ${runIds.join(",")} then activate with --runs.`
+          );
+        }
+        printJson(
+          await request(action, {
+            ...opts.runs ? { runIds: opts.runs.split(",") } : {},
+            ...opts.force ? { force: true } : {}
+          })
+        );
+      }
+    );
+  }
+}
+
 // src/commands/config.ts
 var config_exports = {};
 __export(config_exports, {
-  register: () => register8
+  register: () => register9
 });
-function assertKey(key) {
-  if (CONFIG_KEYS.includes(key)) {
-    return key;
+function assertKey(key2) {
+  if (CONFIG_KEYS.includes(key2)) {
+    return key2;
   }
   throw new CliError(
     "usage",
-    `Unknown config key '${key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`
+    `Unknown config key '${key2}'. Valid keys: ${CONFIG_KEYS.join(", ")}`
   );
 }
-function register8(program2) {
+function register9(program2) {
   const config = program2.command("config").description("Local client config (~/.config/gauge/config.json)");
-  config.command("get [key]").description("Print the whole config, or a single key's value").action((key) => {
+  config.command("get [key]").description("Print the whole config, or a single key's value").action((key2) => {
     const current = readConfig();
-    if (key === void 0) {
+    if (key2 === void 0) {
       printJson(current);
       return;
     }
-    console.log(current[assertKey(key)] ?? "");
+    console.log(current[assertKey(key2)] ?? "");
   });
-  config.command("set <key> <value>").description(`Set a config key (${CONFIG_KEYS.join(", ")})`).action((key, value) => {
-    const configKey = assertKey(key);
+  config.command("set <key> <value>").description(`Set a config key (${CONFIG_KEYS.join(", ")})`).action((key2, value) => {
+    const configKey = assertKey(key2);
     updateConfig({ [configKey]: value });
     console.log(`${configKey} = ${value} (${configPath()})`);
   });
-  config.command("unset <key>").description("Remove a config key").action((key) => {
-    const configKey = assertKey(key);
+  config.command("unset <key>").description("Remove a config key").action((key2) => {
+    const configKey = assertKey(key2);
     updateConfig({ [configKey]: void 0 });
     console.log(`${configKey} unset (${configPath()})`);
   });
@@ -6048,12 +6066,12 @@ function register8(program2) {
 // src/commands/connections.ts
 var connections_exports2 = {};
 __export(connections_exports2, {
-  register: () => register9
+  register: () => register10
 });
 function connectionsPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/connections`;
 }
-function register9(program2) {
+function register10(program2) {
   const group = program2.command("connections").alias("credentials").description("Inspect the org's stored credentials (no secrets)");
   group.command("list").description("List credentials with the ids --connection accepts").action(async (_opts, cmd) => {
     const org = resolveOrg(cmd);
@@ -6069,7 +6087,7 @@ function register9(program2) {
         id: c.id,
         name: c.handle,
         vendor: c.profileLabel,
-        placeholder: c.credentialKey,
+        placeholder: [c.credentialKey, c.basicPasswordKey].filter(Boolean).join(", "),
         domains: c.allowedHosts.join(", "),
         kind: c.kind,
         value: c.last4 ? `\xB7\xB7\xB7\xB7${c.last4}` : ""
@@ -6082,13 +6100,13 @@ function register9(program2) {
 // src/commands/dashboards.ts
 var dashboards_exports2 = {};
 __export(dashboards_exports2, {
-  register: () => register10
+  register: () => register11
 });
 import { readFileSync as readFileSync5 } from "fs";
 function dashboardsPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/dashboards`;
 }
-function register10(program2) {
+function register11(program2) {
   const group = program2.command("dashboards").description("Saved dashboards (CRUD + view filters; layout is UI-only)");
   group.command("list").description("List your dashboard library").action(async (_opts, cmd) => {
     const org = resolveOrg(cmd);
@@ -6107,10 +6125,10 @@ function register10(program2) {
         "table"
       );
   });
-  group.command("get <key>").description("Show one resolved dashboard (widgets + saved filters)").action(async (key, _opts, cmd) => {
+  group.command("get <key>").description("Show one resolved dashboard (widgets + saved filters)").action(async (key2, _opts, cmd) => {
     const org = resolveOrg(cmd);
     const dashboard = await createClient().get(
-      `${dashboardsPath(org)}/${encodeURIComponent(key)}`
+      `${dashboardsPath(org)}/${encodeURIComponent(key2)}`
     );
     if (resolveOutput(cmd) === "json") {
       printJson(dashboard);
@@ -6132,25 +6150,25 @@ function register10(program2) {
     if (resolveOutput(cmd) === "json") printJson(created);
     else console.log(`Created dashboard ${created.key}`);
   });
-  group.command("rename <key> <name>").description("Rename a dashboard (in your overlay)").action(async (key, name, _opts, cmd) => {
+  group.command("rename <key> <name>").description("Rename a dashboard (in your overlay)").action(async (key2, name, _opts, cmd) => {
     const org = resolveOrg(cmd);
     const updated = await createClient().patch(
-      `${dashboardsPath(org)}/${encodeURIComponent(key)}`,
+      `${dashboardsPath(org)}/${encodeURIComponent(key2)}`,
       { name }
     );
     if (resolveOutput(cmd) === "json") printJson(updated);
     else console.log(`Renamed to ${updated.name}`);
   });
-  group.command("rm <key>").description("Delete a dashboard (built-in templates refuse)").action(async (key, _opts, cmd) => {
+  group.command("rm <key>").description("Delete a dashboard (built-in templates refuse)").action(async (key2, _opts, cmd) => {
     const org = resolveOrg(cmd);
     await createClient().delete(
-      `${dashboardsPath(org)}/${encodeURIComponent(key)}`
+      `${dashboardsPath(org)}/${encodeURIComponent(key2)}`
     );
     if (resolveOutput(cmd) !== "json")
-      console.log(`Deleted dashboard ${key}`);
+      console.log(`Deleted dashboard ${key2}`);
   });
   group.command("filters <key>").description("Replace a dashboard's saved view-level filters").option("--json <json>", "the filters object inline").option("--file <path>", 'the filters object from a file ("-" for stdin)').option("--clear", "remove all saved filters").action(
-    async (key, opts, cmd) => {
+    async (key2, opts, cmd) => {
       const org = resolveOrg(cmd);
       const provided = [opts.json, opts.file, opts.clear].filter(
         (v) => v !== void 0 && v !== false
@@ -6173,7 +6191,7 @@ function register10(program2) {
         }
       }
       const updated = await createClient().put(
-        `${dashboardsPath(org)}/${encodeURIComponent(key)}/filters`,
+        `${dashboardsPath(org)}/${encodeURIComponent(key2)}/filters`,
         filters
       );
       if (resolveOutput(cmd) === "json") printJson(updated);
@@ -6190,7 +6208,7 @@ var evals_exports2 = {};
 __export(evals_exports2, {
   evalSetsPath: () => evalSetsPath,
   parseCriterion: () => parseCriterion,
-  register: () => register11
+  register: () => register12
 });
 import { readFileSync as readFileSync6 } from "fs";
 import { Option as Option2 } from "commander";
@@ -6411,28 +6429,28 @@ import { isAbsolute, relative, resolve, sep } from "path";
 // ../packages/api-schemas/src/compileRunDefinition.ts
 import { createHash as createHash2 } from "crypto";
 import { parseDocument } from "yaml";
-function utf8(bytes, path2) {
+function utf8(bytes, path3) {
   try {
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
-    throw new Error(`${path2} is not UTF-8 text`);
+    throw new Error(`${path3} is not UTF-8 text`);
   }
 }
-function markdownCase(path2, bytes) {
-  const source = utf8(bytes, path2);
+function markdownCase(path3, bytes) {
+  const source = utf8(bytes, path3);
   const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(source);
   if (!match)
-    throw new Error(`${path2}: expected YAML frontmatter between --- lines`);
+    throw new Error(`${path3}: expected YAML frontmatter between --- lines`);
   const document = parseDocument(match[1], { uniqueKeys: true });
   if (document.errors.length)
     throw new Error(
-      `${path2}: ${document.errors.map((error) => error.message).join("; ")}`
+      `${path3}: ${document.errors.map((error) => error.message).join("; ")}`
     );
   const parsed = runDefinitionFrontmatterSchema.safeParse(document.toJS());
-  if (!parsed.success) throw new Error(`${path2}: ${parsed.error.message}`);
+  if (!parsed.success) throw new Error(`${path3}: ${parsed.error.message}`);
   const prompt = match[2].trim();
-  if (!prompt) throw new Error(`${path2}: Markdown body is empty`);
-  return { path: path2, prompt, ...parsed.data };
+  if (!prompt) throw new Error(`${path3}: Markdown body is empty`);
+  return { path: path3, prompt, ...parsed.data };
 }
 function compileRunDefinitionFromBlobs(input) {
   if (!uncredentialedRepoUrlSchema.safeParse(input.repoUrl).success)
@@ -6467,18 +6485,18 @@ function compileRunDefinitionFromBlobs(input) {
     throw new Error("gauge.json: install requires prepare");
   if (preparation && !input.repoUrl.startsWith("https://"))
     throw new Error("Project preparation requires a public HTTPS Git origin");
-  const cases = input.casePaths.map((path2) => {
-    const bytes = input.blobs.get(path2);
-    if (!path2.endsWith(".md") || !bytes)
-      throw new Error(`Missing committed Markdown case: ${path2}`);
-    return markdownCase(path2, bytes);
+  const cases = input.casePaths.map((path3) => {
+    const bytes = input.blobs.get(path3);
+    if (!path3.endsWith(".md") || !bytes)
+      throw new Error(`Missing committed Markdown case: ${path3}`);
+    return markdownCase(path3, bytes);
   });
   const hash = createHash2("sha256");
   hash.update("gauge-run-definition-v1\0");
-  for (const [path2, bytes] of [...input.blobs.entries()].sort(
+  for (const [path3, bytes] of [...input.blobs.entries()].sort(
     ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
   )) {
-    hash.update(path2);
+    hash.update(path3);
     hash.update("\0");
     hash.update(String(bytes.length));
     hash.update("\0");
@@ -6525,20 +6543,20 @@ function git(cwd, args) {
     throw new CliError("usage", `git ${args[0]} failed: ${detail}`);
   }
 }
-function committedBlob(root, commit, path2) {
-  return git(root, ["show", `${commit}:${path2}`]);
+function committedBlob(root, commit, path3) {
+  return git(root, ["show", `${commit}:${path3}`]);
 }
 function relativeGitPath(root, cwd, input) {
   if (!input || input.includes("\0") || /[*?[\]{}]/.test(input))
     throw new CliError("usage", `expected an explicit case path: ${input}`);
   const absolute = resolve(cwd, input);
-  const path2 = relative(root, absolute);
-  if (!path2 || path2 === ".." || path2.startsWith(`..${sep}`) || isAbsolute(path2))
+  const path3 = relative(root, absolute);
+  if (!path3 || path3 === ".." || path3.startsWith(`..${sep}`) || isAbsolute(path3))
     throw new CliError(
       "usage",
       `case path is outside this Git repository: ${input}`
     );
-  const gitPath = path2.split(sep).join("/");
+  const gitPath = path3.split(sep).join("/");
   if (!gitPath.endsWith(".md"))
     throw new CliError("usage", `case path must end in .md: ${input}`);
   return gitPath;
@@ -6577,7 +6595,7 @@ function loadCommittedRunDefinitionWithContext(files, cwd = process.cwd()) {
       committedBlob(root, commit, ".gauge/prepare.sh")
     );
   }
-  for (const path2 of paths) blobs.set(path2, committedBlob(root, commit, path2));
+  for (const path3 of paths) blobs.set(path3, committedBlob(root, commit, path3));
   try {
     const result = compileRunDefinitionFromBlobs({
       repoUrl,
@@ -6614,10 +6632,10 @@ function parseCriterion(raw) {
   }
   return { name: raw.slice(0, idx).trim(), rubric: raw.slice(idx + 1).trim() };
 }
-function readCriteriaFile(path2) {
+function readCriteriaFile(path3) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync6(path2 === "-" ? 0 : path2, "utf8"));
+    parsed = JSON.parse(readFileSync6(path3 === "-" ? 0 : path3, "utf8"));
   } catch (e) {
     throw new CliError(
       "usage",
@@ -6676,7 +6694,7 @@ function printDetail2(e) {
   console.log("criteria:");
   for (const c of e.criteria) console.log(`  [${c.id}] ${c.name}: ${c.rubric}`);
 }
-function register11(program2) {
+function register12(program2) {
   const group = program2.command("evals").description("Manage eval sets (judged agent-experience measurements)");
   group.command("plan").description(
     "Validate committed Markdown cases and preview a Git-native run"
@@ -6929,418 +6947,6 @@ function register11(program2) {
   );
 }
 
-// src/commands/experiments.ts
-var experiments_exports2 = {};
-__export(experiments_exports2, {
-  register: () => register12,
-  rewriteContentType: () => rewriteContentType
-});
-import { readFileSync as readFileSync7 } from "fs";
-import { extname } from "path";
-var TERMINAL = /* @__PURE__ */ new Set(["COMPLETE", "PARTIAL", "FAILED", "CANCELED"]);
-function experimentsPath(org) {
-  return `/api/v1/orgs/${encodeURIComponent(org)}/experiments`;
-}
-function itemPath(org, id) {
-  return `${experimentsPath(org)}/${encodeURIComponent(id)}`;
-}
-function readText(path2) {
-  return readFileSync7(path2 === "-" ? 0 : path2, "utf8");
-}
-var REWRITE_FILE_CONTENT_TYPES = {
-  ".md": "text/markdown",
-  ".markdown": "text/markdown",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".txt": "text/plain"
-};
-function rewriteContentType(path2, explicit) {
-  if (explicit !== void 0) return explicit;
-  if (path2 === void 0 || path2 === "-") return void 0;
-  return REWRITE_FILE_CONTENT_TYPES[extname(path2).toLowerCase()];
-}
-function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-function toRow3(e) {
-  return {
-    id: e.id,
-    status: e.status,
-    problem: e.problem.length > 60 ? `${e.problem.slice(0, 57)}...` : e.problem,
-    page: e.boundaryUrl ?? "",
-    variants: e.variantCount,
-    "source run": e.sourceRunId,
-    created: e.createdAt
-  };
-}
-function printDetail3(e) {
-  console.log(`id:          ${e.id}`);
-  console.log(`status:      ${e.status}`);
-  console.log(`problem:     ${e.problem}`);
-  console.log(`page:        ${e.boundaryUrl ?? "(none)"}`);
-  console.log(`source run:  ${e.sourceRun.runId} (${e.sourceRun.agent})`);
-  if (e.launchError) console.log(`launch err:  ${e.launchError}`);
-  console.log("variants:");
-  for (const v of e.variants) {
-    const rewrite = v.hasRewrite ? `${v.rewriteChars} chars` : "no rewrite yet";
-    const state = v.invalidReason ? `invalid: ${v.invalidReason}` : v.planStatus ?? "draft";
-    console.log(
-      `  [${v.key}] ${v.title || "(untitled)"} \u2014 ${rewrite}, ${state}`
-    );
-    if (v.hypothesis) console.log(`      hypothesis: ${v.hypothesis}`);
-    for (const r of v.runs) {
-      console.log(
-        `      run ${r.runId}: ${r.status}${r.failureReason ? ` (${r.failureReason})` : ""}`
-      );
-    }
-  }
-}
-function register12(program2) {
-  const group = program2.command("experiments").description(
-    "Author, launch, and read content experiments (legacy: orgs with Optimizations reject writes; use `gauge optimizations`)"
-  );
-  group.command("list").description("List the org's experiments").option(
-    "--status <statuses>",
-    "comma-separated statuses (e.g. RUNNING,COMPLETE)"
-  ).option("--limit <n>", "max rows (default 25)").action(async (opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const res = await createClient().get(
-      experimentsPath(org),
-      { status: opts.status, limit: opts.limit }
-    );
-    if (resolveOutput(cmd) === "json") printJson(res.items);
-    else printItems(res.items.map(toRow3), "table");
-  });
-  group.command("eligible").description("Recent runs worth experimenting on (worst verdicts first)").action(async (_opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const res = await createClient().get(`${experimentsPath(org)}/eligible-runs`);
-    if (resolveOutput(cmd) === "json") printJson(res.items);
-    else
-      printItems(
-        res.items.map((r) => ({
-          "run id": r.runId,
-          agent: r.agent,
-          verdict: r.verdict ?? "-",
-          boundaries: r.boundaryCount,
-          created: r.createdAt
-        })),
-        "table"
-      );
-  });
-  group.command("boundaries").description("The forkable fetches of a run (pass boundarySeq to create)").requiredOption("--run <runId>", "source run id").action(async (opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const res = await createClient().get(`${experimentsPath(org)}/boundaries`, { runId: opts.run });
-    if (resolveOutput(cmd) === "json") printJson(res.items);
-    else
-      printItems(
-        res.items.map((b) => ({
-          boundarySeq: String(b.boundarySeq),
-          turn: b.turn ?? "?",
-          url: b.url,
-          prompt: b.fetchPrompt ?? ""
-        })),
-        "table"
-      );
-  });
-  group.command("create").description(
-    "Open (or resume) an experiment draft and start the plan round"
-  ).requiredOption("--run <runId>", "source run id").requiredOption(
-    "--boundary <seq>",
-    "opaque boundarySeq from `experiments boundaries`"
-  ).option("--problem <text>", "problem statement (derived if omitted)").option(
-    "--mode <mode>",
-    "who writes the rewrites: propose (default, directions are proposed then each is written), direct (one --change instruction, one write), manual (no generation \u2014 the rewrite is seeded with the page the agent read)",
-    "propose"
-  ).option(
-    "--change <text>",
-    "--mode direct only: the one change to make, in your words"
-  ).action(
-    async (opts, cmd) => {
-      const org = resolveOrg(cmd);
-      const parsedMode = experiments_exports.experimentModeSchema.safeParse(
-        opts.mode.toUpperCase()
-      );
-      if (!parsedMode.success) {
-        throw new Error(
-          `--mode must be one of ${experiments_exports.EXPERIMENT_MODES.map((m) => m.toLowerCase()).join(", ")}`
-        );
-      }
-      const mode = parsedMode.data;
-      if (mode === "DIRECT" && !opts.change?.trim()) {
-        throw new Error("--mode direct requires --change <text>");
-      }
-      if (mode !== "DIRECT" && opts.change !== void 0) {
-        throw new Error(`--change only applies to --mode direct`);
-      }
-      const body = {
-        runId: opts.run,
-        boundarySeq: opts.boundary,
-        ...opts.problem !== void 0 ? { problemText: opts.problem } : {},
-        mode,
-        ...opts.change !== void 0 ? { changeInstruction: opts.change.trim() } : {}
-      };
-      const result = await createClient().post(
-        experimentsPath(org),
-        body
-      );
-      if (resolveOutput(cmd) === "json") {
-        printJson(result);
-        return;
-      }
-      console.log(
-        `${result.created ? "Created" : "Resumed"} experiment ${result.experimentId}`
-      );
-      console.log(`Problem: ${result.problemText}`);
-      console.log(`Mode: ${result.mode.toLowerCase()}`);
-      if (!result.created && result.mode !== mode) {
-        console.error(
-          `Note: this fetch already had a live ${result.mode.toLowerCase()} draft, so --mode ${mode.toLowerCase()} was not applied \u2014 that draft was resumed instead.`
-        );
-      }
-      console.error(
-        result.mode === "MANUAL" ? `Tip: \`gauge experiments get ${result.experimentId}\` shows the seeded rewrite once the page is recovered` : `Tip: \`gauge experiments watch ${result.experimentId}\` follows the ${result.mode === "DIRECT" ? "write" : "plan"} round`
-      );
-    }
-  );
-  group.command("get <id>").description("Full detail: directions, rewrites, arms, verdicts").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const detail = await createClient().get(
-      itemPath(org, id)
-    );
-    if (resolveOutput(cmd) === "json") printJson(detail);
-    else printDetail3(detail);
-  });
-  group.command("status <id>").description("The async round/launch state (carries launchError)").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const status = await createClient().get(
-      `${itemPath(org, id)}/status`
-    );
-    if (resolveOutput(cmd) === "json") printJson(status);
-    else {
-      console.log(`status: ${status.status}`);
-      if (status.launchError)
-        console.log(`launch error: ${status.launchError}`);
-      if (status.shippedVariantId)
-        console.log(
-          `shipped: ${status.shippedVariantId} at ${status.shippedAt}`
-        );
-    }
-  });
-  const variants = group.command("variants").description("Manage a draft's rewrite directions");
-  variants.command("add <experimentId>").description("Add a direction (a candidate rewrite slot)").option("--title <title>", "direction title").option("--hypothesis <text>", "what this rewrite should change").action(
-    async (experimentId, opts, cmd) => {
-      const org = resolveOrg(cmd);
-      const created = await createClient().post(
-        `${itemPath(org, experimentId)}/variants`,
-        opts
-      );
-      if (resolveOutput(cmd) === "json") printJson(created);
-      else console.log(`Added variant ${created.key} (${created.id})`);
-    }
-  );
-  variants.command("edit <experimentId> <variantId>").description("Retitle / re-hypothesize a direction").option("--title <title>", "direction title").option("--hypothesis <text>", "hypothesis").action(
-    async (experimentId, variantId, opts, cmd) => {
-      if (opts.title === void 0 && opts.hypothesis === void 0)
-        throw new CliError("usage", "nothing to change");
-      const org = resolveOrg(cmd);
-      await createClient().patch(
-        `${itemPath(org, experimentId)}/variants/${encodeURIComponent(variantId)}`,
-        opts
-      );
-      if (resolveOutput(cmd) !== "json") console.log("Updated");
-    }
-  );
-  variants.command("rm <experimentId> <variantId>").description("Remove a direction from the draft").action(
-    async (experimentId, variantId, _o, cmd) => {
-      const org = resolveOrg(cmd);
-      await createClient().delete(
-        `${itemPath(org, experimentId)}/variants/${encodeURIComponent(variantId)}`
-      );
-      if (resolveOutput(cmd) !== "json") console.log("Removed");
-    }
-  );
-  group.command("content <id>").description("Read the live page (or a rewrite) in bounded windows").option("--variant <variantId>", "read this variant's rewrite instead").option("--offset <n>", "start offset (default 0)").option("--max-chars <n>", "window size (default 20000, max 40000)").action(
-    async (id, opts, cmd) => {
-      const org = resolveOrg(cmd);
-      const result = await createClient().get(
-        `${itemPath(org, id)}/content`,
-        {
-          variantId: opts.variant,
-          offset: opts.offset,
-          maxChars: opts.maxChars
-        }
-      );
-      if (resolveOutput(cmd) === "json") {
-        printJson(result);
-        return;
-      }
-      process.stdout.write(result.content);
-      if (result.nextOffset != null)
-        console.error(
-          `
---- ${result.returnedChars}/${result.totalChars} chars; continue with --offset ${result.nextOffset}`
-        );
-    }
-  );
-  group.command("rewrite <id> <variantId>").description(
-    "Write a variant's page: --file replaces it; --edits-file applies {find, replace} ops"
-  ).option("--file <path>", 'full content ("-" for stdin)').option(
-    "--content-type <mime>",
-    "rewrite MIME type (inferred for .md, .markdown, .html, .htm, and .txt)"
-  ).option(
-    "--edits-file <path>",
-    'JSON array of {find, replace} ops ("-" for stdin)'
-  ).action(
-    async (id, variantId, opts, cmd) => {
-      if (opts.file === void 0 === (opts.editsFile === void 0))
-        throw new CliError(
-          "usage",
-          "pass exactly one of --file or --edits-file"
-        );
-      const org = resolveOrg(cmd);
-      const body = {};
-      if (opts.file !== void 0) body.content = readText(opts.file);
-      else {
-        let parsed;
-        try {
-          parsed = JSON.parse(readText(opts.editsFile));
-        } catch (e) {
-          throw new CliError(
-            "usage",
-            `could not read --edits-file: ${e instanceof Error ? e.message : e}`
-          );
-        }
-        if (!Array.isArray(parsed) || parsed.length === 0)
-          throw new CliError(
-            "usage",
-            "--edits-file must be a non-empty JSON array of {find, replace}"
-          );
-        body.edits = parsed;
-      }
-      body.contentType = rewriteContentType(opts.file, opts.contentType);
-      const result = await createClient().put(
-        `${itemPath(org, id)}/variants/${encodeURIComponent(variantId)}/content`,
-        body
-      );
-      if (resolveOutput(cmd) === "json") printJson(result);
-      else {
-        console.log(`Wrote ${result.chars} chars`);
-        if (body.edits)
-          console.log(
-            `Edits: ${result.applied} applied, ${result.skipped} skipped`
-          );
-        if (result.truncated) console.error("warning: content was truncated");
-      }
-    }
-  );
-  group.command("replan <id>").description("Discard the directions and propose fresh ones").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    await createClient().post(`${itemPath(org, id)}/replan`, {});
-    if (resolveOutput(cmd) !== "json")
-      console.log("Replanning \u2014 follow with `gauge experiments watch`");
-  });
-  group.command("write <id>").description("Write rewrites for directions that lack one").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const result = await createClient().post(
-      `${itemPath(org, id)}/write`,
-      {}
-    );
-    if (resolveOutput(cmd) === "json") {
-      printJson(result);
-      return;
-    }
-    if (result.queued > 0) console.log(`Queued ${result.queued} rewrite(s)`);
-    else if (result.reason === "round_in_flight")
-      console.log("A round is already running");
-    else console.log("Nothing pending \u2014 every direction has a rewrite");
-  });
-  group.command("launch <id>").description("Claim the draft for launch (spends credits; async fan-out)").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const result = await createClient().post(
-      `${itemPath(org, id)}/launch`,
-      {}
-    );
-    if (resolveOutput(cmd) === "json") printJson(result);
-    else
-      console.log(
-        `Launching ${result.experimentId} \u2014 \`gauge experiments watch ${result.experimentId}\` follows it`
-      );
-  });
-  group.command("watch <id>").description(
-    "Follow the running round or launch; prints the recommendation on settle"
-  ).option("--interval <seconds>", "poll interval (default 10)").action(async (id, opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const client = createClient();
-    const intervalMs = Math.max(Number(opts.interval ?? 10) * 1e3, 2e3);
-    const GRACE_POLLS = 3;
-    let sawActive = false;
-    let draftPolls = 0;
-    let last = "";
-    for (; ; ) {
-      const status = await client.get(
-        `${itemPath(org, id)}/status`
-      );
-      if (status.status !== last) {
-        last = status.status;
-        console.error(`status: ${status.status}`);
-        if (status.launchError)
-          console.error(`launch error: ${status.launchError}`);
-      }
-      if (TERMINAL.has(status.status)) break;
-      if (status.status === "DRAFT") {
-        if (status.launchError) {
-          process.exitCode = 1;
-          return;
-        }
-        if (sawActive) {
-          console.error(
-            `Round finished \u2014 \`gauge experiments get ${id}\` shows the directions and rewrites.`
-          );
-          return;
-        }
-        draftPolls += 1;
-        if (draftPolls >= GRACE_POLLS) {
-          console.error(
-            `Nothing is running \u2014 \`gauge experiments get ${id}\` shows the draft.`
-          );
-          return;
-        }
-      } else {
-        sawActive = true;
-      }
-      await sleep2(intervalMs);
-    }
-    const rec = await client.get(
-      `${itemPath(org, id)}/recommendation`
-    );
-    printJson(rec);
-  });
-  group.command("export <id>").description("Print the settled recommendation (JSON)").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    const rec = await createClient().get(
-      `${itemPath(org, id)}/recommendation`
-    );
-    printJson(rec);
-  });
-  group.command("ship <id> <variantId>").description("Mark a variant as shipped to your live docs").action(
-    async (id, variantId, _o, cmd) => {
-      const org = resolveOrg(cmd);
-      await createClient().post(`${itemPath(org, id)}/ship`, { variantId });
-      if (resolveOutput(cmd) !== "json") console.log("Marked shipped");
-    }
-  );
-  group.command("unship <id>").description("Clear the shipped mark").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    await createClient().delete(`${itemPath(org, id)}/ship`);
-    if (resolveOutput(cmd) !== "json") console.log("Cleared");
-  });
-  group.command("cancel <id>").description("Cancel a draft/generating/launching experiment").action(async (id, _opts, cmd) => {
-    const org = resolveOrg(cmd);
-    await createClient().post(`${itemPath(org, id)}/cancel`, {});
-    if (resolveOutput(cmd) !== "json") console.log(`Canceled ${id}`);
-  });
-}
-
 // src/commands/instructions.ts
 var instructions_exports = {};
 __export(instructions_exports, {
@@ -7349,38 +6955,133 @@ __export(instructions_exports, {
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3 } from "path";
 
+// src/instructions/evals.ts
+var EVALS = `---
+name: gauge-evals
+description: Create and review Gauge eval prompts, model selections, and judging
+  criteria. Read before creating or editing evals; includes a migration example.
+---
+
+# Evals
+
+- Measure one meaningful developer outcome. Record the learning goal, reproducible starting state, observable finish line, and execution budget; a coherent migration can span browser and server workflows.
+- Write the prompt as a real user's request, in their language. Describe their goal, relevant context, and intended outcome. Preserve constraints they actually supplied; do not assume technical expertise or invent features, UI actions, business rules, commands, filenames, or verification recipes. Leave discovery and implementation choices to the agent.
+- Align a small set of independently assessable criteria with the requested outcome and existing application. Accept equivalent supported approaches and execution evidence; remove hidden requirements when revising the prompt.
+- Keep repository revisions, credentials, connections, runtime setup, and budgets in supported configuration or fixtures where possible. Inspect \`gauge evals create --help\` and \`gauge evals edit --help\` for current controls; do not assume proposed limits are enforced.
+- Saved evals use \`gauge evals create --file <path> --criteria-file <path>\` (criteria JSON: [{"name":"...","rubric":"..."}]). For committed Markdown cases, preview with \`gauge evals plan --files <paths...>\` before \`gauge evals run --files <paths...>\`.
+- Pilot before scaling; confirm before spending credits. Creating definitions does not authorize launching runs. Report sample counts and distinguish incorrect behavior, missing evidence, environment failures, and budget exhaustion.
+
+## Model selection
+
+Choose a roster for the question and budget. For exploratory testing, start with a diverse panel of open models; reserve a smaller set of Claude Code and Codex sessions for calibration and confirmation. Do not automatically use only Claude Opus and GPT Sol. Honor an explicitly requested model or harness when that experience is the measurement.
+
+- **Breadth:** Open models make repetition and coverage across tasks, repositories, personas, skills, and MCP configurations more affordable. Select several available model families rather than treating one model as representative.
+- **Confirmation:** Use frontier sessions to investigate disagreements and confirm consequential findings. Periodically repeat a subset of open-model cases with frontier targets and investigate meaningful drift.
+- **Limits:** Gauge's proxy evidence comes from Agent Preference comparisons. Similar product choices do not establish equal coding ability or identical eval pass rates. Calibrate on your own tasks before generalizing.
+- **Controls:** Run \`gauge models list -o json\` for the current organization catalog. A target combines a model and harness; select supported pairs with repeated \`--agent pi:<model>\`, \`--agent opencode:<model>\`, \`--agent claude-code:<model>\`, or \`--agent codex:<model>\` flags. Pin catalog identifiers explicitly; omitting a model uses the harness default. Treat the harness as part of the comparison.
+- **Comparison:** Keep each case's prompt, fixture, criteria, and other settings fixed when comparing targets. Budget for targets \xD7 samples per case; inspect per-target results and execution evidence rather than only a pooled score.
+
+Background: [Open models as preference proxies](https://www.withgauge.com/blog/open-models-useful-proxies-data-from-1000-sessions/).
+
+## Migration prompt and criteria
+
+This example tests migration of an existing feature-flag application across browser and server workflows. Its starting repository contains the application, while attached connections supply destination credentials. The source account's targeting configuration is unavailable.
+
+### Keep the substantial task
+
+A bad version of this migration prompt would add specific features, such as a flag selector, an account switcher, or an activity log. It might also specify exact UI layouts, clicks to perform, SDK calls, or files to edit. Those directions assume the user already knows the implementation and add requirements beyond their goal.
+
+Use the kind of language a user would naturally use to ask for a change. For example, "Let me pass a feature to the CLI and get instructions for it" describes the desired behavior without prescribing command registration or rendering code. Keep details the user actually requests; do not add exact specifications or UI/UX actions just to make grading easier.
+
+For the migration, express the user's goal:
+
+> Migrate this app from its current feature-flag provider to the replacement provider while preserving its existing functionality. Get it running locally, verify the migration works, and explain any limitations.
+
+If the user also asks for a complete replacement, carry that decision into the rubric. Do not add backward compatibility or a gradual production rollout solely because a migration guide recommends them.
+
+This remains a substantial task. The agent must inspect the application, identify integration boundaries, discover suitable interfaces, implement the migration, and demonstrate the result. A short prompt does not imply a trivial outcome.
+
+### Define observable success
+
+Inspect the starting application and relevant migration guidance before drafting criteria. For this application, success means existing browser and server workflows continue to work through the destination provider, live evaluations drive the running UI, and active dependencies on the source provider are removed when full replacement is requested. The rubric can assess behavior present in the source without dictating SDK methods, edited files, or an exact test sequence.
+
+Suitable criteria for this fixture:
+
+- **Complete migration:** Required flags and code references are accounted for. The active integration uses the destination provider, and the app no longer needs the source provider at runtime when full replacement is requested. A separate demo or hardcoded replacement is insufficient.
+- **Preserved behavior:** Existing browser/server workflows, context changes, and server-provided initial values continue to work. Available configuration is preserved or differences explained. Exact historical targeting parity cannot be established without source rules.
+- **Verified working application:** Execution evidence connects live flag evaluation from the destination provider to the running app's behavior across its browser and server workflows. A build or standalone SDK probe alone does not demonstrate the migration.
+- **Appropriate product surfaces:** Supported SDKs/providers fit the browser and server runtimes; supported management interfaces handle configuration; credentials fit each surface. Equivalent approaches are acceptable, and using every tool is unnecessary.
+
+Keep environment identifiers, credential mappings, repository revision, and resource isolation in supported connection or fixture mechanisms where possible. Authoring notes and source limitations must not become an extra implementation checklist.
+
+Missing source rules limit the parity claim. Record that uncertainty and assess observable application behavior; do not replace it with an invented targeting contract. If account-configuration migration is the requested outcome, prepare the required source data before calling the fixture ready.
+`;
+
 // src/instructions/index.ts
 var ROOT = `---
 name: gauge
-description: The Gauge CLI measures how coding agents handle your product, then
-  improves what they read. Read this before you run a gauge command, and follow
-  what it says.
+description: Understand Gauge, use its CLI, and choose the module guidance
+  for your task. Read before running a gauge command.
 ---
 
 # Gauge
 
-Gauge runs real coding agents against your product in a sandbox and judges what
-they do. Evals and preference prompts measure. Optimizations improve what the
-agents read: your docs and your skills.
+Gauge helps you understand and improve how coding agents discover and use your
+product. It runs real agents in sandboxes under reproducible conditions, then
+judges their work. Evals measure successful product use; Agent Preference
+measures which tools agents choose and why. Optimizations test improvements to
+your docs and skills against those measurements.
+
+## Use Gauge and the CLI
+
+Run \`gauge onboard\` to sign in and set up a workspace, or \`gauge auth login\`
+for an existing account. Select your organization with \`gauge orgs use <org>\`,
+then inspect it with \`gauge status\`. Configure a measurement, run a small
+pilot, inspect sessions and judging evidence, and use those findings to test
+improvements. \`gauge models list\` shows the available agent/model targets.
+
+- Use \`gauge --help\` for commands and \`gauge <group> --help\` for flags.
+- Pass \`-o json\` on reads and parse it. Tables are for people.
+- Confirm before launches spend credits. Use \`--yes\` for work already approved.
+- Retry writes with their supported idempotency flag; blind retries can launch
+  duplicate paid sessions.
+- Report measured results with sample counts and evidence, including limits.
+- Run \`gauge update\` to install the latest published CLI.
+- Exit codes: 0 ok, 1 error, 2 usage, 3 billing-blocked, 4 needs your input.
 
-One section per command group follows. \`gauge instructions <topic>\` reprints
-one of them alone.
+## Module guidance
 
-## Rules for every command
+These summaries cover the essentials. Read the full page before detailed work;
+\`gauge instructions --list\` lists the available modules.
 
-- Pass \`-o json\` on a read and parse that. The table is for people.
-- Every launch spends credits. Confirm before you spend. \`--yes\` is only for a
-  script the user already approved.
-- Retry a write with its idempotency flag, never blindly. A blind retry buys a
-  second set of paid sessions.
-- Report measured results only, with the sample count. Never state a score the
-  sessions did not produce.
-- Exit codes: 0 ok, 1 error, 2 usage, 3 billing-blocked, 4 needs your input.
-- \`gauge <group> --help\` carries every flag. This text carries the judgment.
+### Evals
+
+Measure one developer outcome with a reproducible fixture and observable criteria.
+Write a real user request; leave discovery and implementation to the agent. Keep
+credentials and setup in configuration. Start exploratory testing with a diverse
+open-model panel; use fewer frontier sessions for calibration, disagreements,
+and confirmation. Honor requested targets. Discover supported model/harness pairs
+with \`gauge models list -o json\` and pin selections explicitly. Preference
+similarity does not guarantee equal coding performance; calibrate on your tasks.
+Hold each case's prompt, fixture, and rubric fixed across targets. Pilot before
+scaling, confirm paid launches, and report per-target evidence, sample counts,
+failures, and missing evidence.
 
-## Topics
+Full guidance and migration example: \`gauge instructions evals\`.
 
-    optimizations   improve docs and skills against an eval, measured
+### Optimization
+
+Gauge measures trials; you author the changes. Start from an eval or preference
+prompt, diagnose friction, and write a hypothesis. Change one variable per trial
+against the frozen baseline; keep the measurement and its criteria fixed. Read
+\`nextAction\` on every detail and follow the named step. Use
+\`gauge optimizations watch <id>\` to track progress; exit 4 means your input is
+needed. Submit changes with an idempotency key and confirm paid launches.
+Inspect scores and session evidence before adopting. Adoption updates Gauge's
+measured baseline. Apply the winning text to your source repository in a pull
+request, citing the trial and measured score.
+
+Full guidance: \`gauge instructions optimization\`.
 `;
 var OPTIMIZATIONS = `---
 name: gauge-optimizations
@@ -7431,28 +7132,18 @@ source in a pull request and cite the trial key and its score.
 `;
 var TOPICS = {
   root: { name: "gauge", markdown: ROOT },
-  optimizations: { name: "gauge-optimizations", markdown: OPTIMIZATIONS }
+  evals: { name: "gauge-evals", markdown: EVALS },
+  optimization: { name: "gauge-optimizations", markdown: OPTIMIZATIONS }
 };
 var TOPIC_NAMES = Object.keys(TOPICS).filter(
   (topic) => topic !== "root"
 );
-function documentBody(markdown) {
-  const end = markdown.indexOf("\n---\n", 4);
-  return end === -1 ? markdown : markdown.slice(end + 5);
-}
-function nested(markdown) {
-  return documentBody(markdown).trim().replace(/^(#{1,5}) /gm, "#$1 ");
-}
 function instructions(topic) {
-  if (topic) return resolveTopic(topic).markdown;
-  const bodies = TOPIC_NAMES.map((name) => nested(TOPICS[name].markdown));
-  return `${TOPICS.root.markdown.trimEnd()}
-
-${bodies.join("\n\n")}
-`;
+  return resolveTopic(topic ?? "root").markdown;
 }
 function resolveTopic(topic) {
-  const found = TOPICS[topic.trim().toLowerCase()];
+  const normalized = topic.trim().toLowerCase();
+  const found = TOPICS[normalized === "optimizations" ? "optimization" : normalized];
   if (!found)
     throw new CliError(
       "usage",
@@ -7465,7 +7156,7 @@ function resolveTopic(topic) {
 var INSTALL_ROOT = ".claude/skills";
 function register13(program2) {
   program2.command("instructions [topic]").description(
-    `Instructions for a coding agent using this CLI. Run before your first gauge command; a topic reprints one group: ${TOPIC_NAMES.join(", ")}`
+    `Instructions for a coding agent using this CLI. Run before your first gauge command; a topic loads the full module guidance: ${TOPIC_NAMES.join(", ")}`
   ).option("--list", "print the topic names only").option(
     "--install",
     `write the skill under ${INSTALL_ROOT}/ instead of printing it`
@@ -7482,10 +7173,10 @@ function register13(program2) {
       }
       const name = topic ? resolveTopic(topic).name : TOPICS.root.name;
       const dir = join3(opts.dir ?? INSTALL_ROOT, name);
-      const path2 = join3(dir, "SKILL.md");
+      const path3 = join3(dir, "SKILL.md");
       mkdirSync3(dir, { recursive: true });
-      writeFileSync3(path2, markdown);
-      console.log(`Wrote ${path2}`);
+      writeFileSync3(path3, markdown);
+      console.log(`Wrote ${path3}`);
       console.error(
         "Re-run this after you upgrade the CLI: the instructions ship with it."
       );
@@ -7516,8 +7207,8 @@ async function readKeyInput(opts) {
     process.stderr.write(
       "warning: --key exposes the secret to shell history and process listings; prefer piping it to stdin or setting GAUGE_PROVIDER_KEY.\n"
     );
-    const key2 = opts.key.trim();
-    if (key2) return key2;
+    const key3 = opts.key.trim();
+    if (key3) return key3;
     throw new CliError("usage", "Empty --key value");
   }
   if (!opts.stdin) {
@@ -7530,14 +7221,14 @@ async function readKeyInput(opts) {
   process.stdin.setEncoding("utf8");
   let data = "";
   for await (const chunk of process.stdin) data += chunk;
-  const key = data.trim();
-  if (!key) {
+  const key2 = data.trim();
+  if (!key2) {
     throw new CliError(
       "usage",
       "No key provided. Pipe it to stdin (e.g. `gauge keys set anthropic < key.txt`) or set GAUGE_PROVIDER_KEY."
     );
   }
-  return key;
+  return key2;
 }
 function register14(program2) {
   const group = program2.command("keys").description("Manage BYOK provider keys (write-only; reads show last4)");
@@ -7550,10 +7241,10 @@ function register14(program2) {
     async (provider, opts, cmd) => {
       const type = providerArg(provider);
       const org = resolveOrg(cmd);
-      const key = await readKeyInput(opts);
+      const key2 = await readKeyInput(opts);
       const res = await createClient().put(
         `${keysPath(org)}/${type}`,
-        { key }
+        { key: key2 }
       );
       if (resolveOutput(cmd) === "json") printJson(res);
       else console.log(`Saved ${res.providerType} key (\u2026${res.last4})`);
@@ -7597,7 +7288,7 @@ var mcp_exports2 = {};
 __export(mcp_exports2, {
   register: () => register15
 });
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 function mcpPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/mcp-servers`;
 }
@@ -7613,7 +7304,7 @@ function specFromOpts(opts) {
       throw new CliError("usage", "--spec-file conflicts with --command/--url");
     try {
       return JSON.parse(
-        readFileSync8(opts.specFile === "-" ? 0 : opts.specFile, "utf8")
+        readFileSync7(opts.specFile === "-" ? 0 : opts.specFile, "utf8")
       );
     } catch (e) {
       throw new CliError(
@@ -7822,8 +7513,8 @@ __export(models_exports, {
 function executionTargetsPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/execution-targets`;
 }
-function capabilityLabel(capabilities) {
-  return Object.entries(capabilities).filter(([, supported]) => supported).map(([name]) => name === "agentContext" ? "context" : name).join(", ");
+function capabilityLabel(capabilities2) {
+  return Object.entries(capabilities2).filter(([, supported]) => supported).map(([name]) => name === "agentContext" ? "context" : name).join(", ");
 }
 function register17(program2) {
   const group = program2.command("models").description("Discover supported models, harnesses, and providers");
@@ -7972,23 +7663,23 @@ __export(optimizations_exports2, {
   trialTemplate: () => trialTemplate,
   watchStops: () => watchStops
 });
-import { readdirSync, readFileSync as readFileSync9, statSync } from "fs";
+import { readdirSync, readFileSync as readFileSync8, statSync } from "fs";
 import { join as join4, relative as relative2, sep as sep2 } from "path";
-var TERMINAL2 = /* @__PURE__ */ new Set(["DONE", "ARCHIVED"]);
+var TERMINAL = /* @__PURE__ */ new Set(["DONE", "ARCHIVED"]);
 var EFFORTS = ["low", "medium", "high", "xhigh"];
 function basePath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/optimizations`;
 }
-function itemPath2(org, id) {
+function itemPath(org, id) {
   return `${basePath(org)}/${encodeURIComponent(id)}`;
 }
 function trialPath(org, id, trialId) {
-  return `${itemPath2(org, id)}/trials/${encodeURIComponent(trialId)}`;
+  return `${itemPath(org, id)}/trials/${encodeURIComponent(trialId)}`;
 }
-function readText2(path2) {
-  return readFileSync9(path2 === "-" ? 0 : path2, "utf8");
+function readText(path3) {
+  return readFileSync8(path3 === "-" ? 0 : path3, "utf8");
 }
-function sleep3(ms) {
+function sleep2(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function parseSubject(opts) {
@@ -8041,19 +7732,19 @@ var NEXT_ACTION_HINT = {
   AUTHOR_TRIAL: "author the next trial: `gauge optimizations trials add <id>`",
   LAUNCH_ROUND: "launch the saved round: `gauge optimizations launch <id>`",
   ADOPT: "adopt the winning trial: `gauge optimizations adopt <id> <trial>`",
-  RESUME: "resume it: `gauge optimizations resume <id>`",
+  RESUME: "resume it in the web app, or `gauge optimizations cancel <id>`",
   NONE: "nothing to do in Gauge"
 };
 function awaitingInput(detail) {
   return detail.nextAction !== "WAIT" && detail.nextAction !== "NONE";
 }
 function watchStops(detail, follow) {
-  return TERMINAL2.has(detail.status) || detail.nextAction === "NONE" || !follow && awaitingInput(detail);
+  return TERMINAL.has(detail.status) || detail.nextAction === "NONE" || !follow && awaitingInput(detail);
 }
-function readObject(path2) {
+function readObject(path3) {
   let value;
   try {
-    value = JSON.parse(readText2(path2));
+    value = JSON.parse(readText(path3));
   } catch {
     throw new CliError("usage", "the file must contain valid JSON");
   }
@@ -8086,13 +7777,13 @@ function parseStatuses(raw) {
       );
   return parts.join(",");
 }
-function readSkillDir(dir, read = readText2, walk = listFiles) {
+function readSkillDir(dir, read = readText, walk = listFiles) {
   const paths = walk(dir).sort();
   if (!paths.length)
     throw new CliError("usage", `no files under ${dir} to send`);
-  const files = paths.map((path2) => ({
-    path: relative2(dir, path2).split(sep2).join("/"),
-    body: read(path2)
+  const files = paths.map((path3) => ({
+    path: relative2(dir, path3).split(sep2).join("/"),
+    body: read(path3)
   }));
   if (!files.some((file) => file.path === "SKILL.md"))
     throw new CliError(
@@ -8109,11 +7800,11 @@ function listFiles(dir) {
     throw new CliError("usage", `cannot read the directory ${dir}`);
   }
   return entries.flatMap((entry) => {
-    const path2 = join4(dir, entry);
-    return statSync(path2).isDirectory() ? listFiles(path2) : [path2];
+    const path3 = join4(dir, entry);
+    return statSync(path3).isDirectory() ? listFiles(path3) : [path3];
   });
 }
-function trialBodyFromOpts(opts, read = readText2, walk) {
+function trialBodyFromOpts(opts, read = readText, walk) {
   const launch = opts.launch === true;
   const idempotencyKey = opts.idempotencyKey;
   const fork = opts.forkRun || opts.forkBoundary ? (() => {
@@ -8255,7 +7946,7 @@ function pct(value) {
 function subjectLabel(kind) {
   return kind === "EVAL_SET" ? "eval" : "preference";
 }
-function toRow4(o) {
+function toRow3(o) {
   return {
     id: o.id,
     name: o.name.length > 40 ? `${o.name.slice(0, 37)}...` : o.name,
@@ -8284,7 +7975,7 @@ function trialRow(t) {
     id: t.id
   };
 }
-function printDetail4(o) {
+function printDetail3(o) {
   console.log(`id:        ${o.id}`);
   console.log(`name:      ${o.name}`);
   console.log(
@@ -8356,8 +8047,8 @@ function printRoundPreview(preview) {
       console.log(`=== ${change.path}`);
       console.log(change.hunks);
     }
-    for (const path2 of trial.droppedFiles ?? [])
-      console.log(`  ${path2}: dropped`);
+    for (const path3 of trial.droppedFiles ?? [])
+      console.log(`  ${path3}: dropped`);
   }
   console.log(`previewDigest ${preview.previewDigest}`);
 }
@@ -8430,14 +8121,14 @@ function register19(program2) {
         }
       );
       if (resolveOutput(cmd) === "json") printJson(res.items);
-      else printItems(res.items.map(toRow4), "table");
+      else printItems(res.items.map(toRow3), "table");
     }
   );
   group.command("get <id>").description("One optimization: settings, score, and its trial ladder").action(async (id, _opts, cmd) => {
     const org = resolveOrg(cmd);
-    const detail = await createClient().get(itemPath2(org, id));
+    const detail = await createClient().get(itemPath(org, id));
     if (resolveOutput(cmd) === "json") printJson(detail);
-    else printDetail4(detail);
+    else printDetail3(detail);
   });
   addSubjectOptions(
     group.command("diagnose").description(
@@ -8520,7 +8211,7 @@ function register19(program2) {
       opts.yes
     );
     const detail = await createClient().post(
-      `${itemPath2(org, id)}/cancel`,
+      `${itemPath(org, id)}/cancel`,
       {}
     );
     if (resolveOutput(cmd) === "json") printJson(detail);
@@ -8544,7 +8235,7 @@ function register19(program2) {
         }
       );
       if (resolveOutput(cmd) === "json") printJson(detail);
-      else printDetail4(detail);
+      else printDetail3(detail);
     }
   );
   addPlanOptions(
@@ -8563,11 +8254,11 @@ function register19(program2) {
       if (!Object.keys(body).length)
         throw new CliError("usage", "pass plan flags, --name, or --file");
       const detail = await createClient().patch(
-        itemPath2(resolveOrg(cmd), id),
+        itemPath(resolveOrg(cmd), id),
         body
       );
       if (resolveOutput(cmd) === "json") printJson(detail);
-      else printDetail4(detail);
+      else printDetail3(detail);
     }
   );
   addPlanOptions(
@@ -8578,11 +8269,11 @@ function register19(program2) {
       const client = createClient();
       const plan = planFromOpts(opts);
       const creditCap = parseCreditEstimate(opts.creditCap);
-      const current = await client.get(itemPath2(org, id));
+      const current = await client.get(itemPath(org, id));
       if (current.status !== "DRAFT")
         throw new CliError(
           "usage",
-          "only a draft can start; use resume or continue instead"
+          "only a draft can start; use continue instead"
         );
       const target = plan.target ?? (current.settings.pinnedAgent ? {
         agent: current.settings.pinnedAgent,
@@ -8610,13 +8301,13 @@ function register19(program2) {
         `Start baseline for ${id}? Estimated full optimization: ${creditCap ?? estimate.estimate} credits, not a spending cap.`,
         opts.yes
       );
-      const detail = await client.post(`${itemPath2(org, id)}/start`, {
+      const detail = await client.post(`${itemPath(org, id)}/start`, {
         ...plan,
         name: opts.name,
         creditCap
       });
       if (resolveOutput(cmd) === "json") printJson(detail);
-      else printDetail4(detail);
+      else printDetail3(detail);
     }
   );
   group.command("launch <id>").description(
@@ -8627,7 +8318,7 @@ function register19(program2) {
       opts.yes
     );
     const result = await createClient().post(
-      `${itemPath2(resolveOrg(cmd), id)}/rounds/current/launch`,
+      `${itemPath(resolveOrg(cmd), id)}/rounds/current/launch`,
       {}
     );
     if (resolveOutput(cmd) === "json") printJson(result);
@@ -8651,26 +8342,16 @@ function register19(program2) {
         opts.yes
       );
       const detail = await createClient().post(
-        `${itemPath2(resolveOrg(cmd), id)}/continue`,
+        `${itemPath(resolveOrg(cmd), id)}/continue`,
         { rounds, maxTrialsPerRound }
       );
       if (resolveOutput(cmd) === "json") printJson(detail);
-      else printDetail4(detail);
+      else printDetail3(detail);
     }
   );
-  group.command("resume <id>").description(
-    "Resume a legacy paused optimization with interactive authoring"
-  ).action(async (id, _opts, cmd) => {
-    const detail = await createClient().post(
-      `${itemPath2(resolveOrg(cmd), id)}/resume`,
-      {}
-    );
-    if (resolveOutput(cmd) === "json") printJson(detail);
-    else printDetail4(detail);
-  });
   group.command("activity <id>").description("Read the optimization's decision log").option("--after <timestamp>", "entries after this ISO timestamp").option("--limit <n>", "maximum entries (1\u2013500)").action(
     async (id, opts, cmd) => {
-      const res = await createClient().get(`${itemPath2(resolveOrg(cmd), id)}/activity`, {
+      const res = await createClient().get(`${itemPath(resolveOrg(cmd), id)}/activity`, {
         after: opts.after,
         limit: parseCount(opts.limit, "--limit", 500)
       });
@@ -8689,7 +8370,7 @@ function register19(program2) {
   );
   group.command("chat <id>").description("Resolve your optimization chat and print its URL path").action(async (id, _opts, cmd) => {
     const res = await createClient().post(
-      `${itemPath2(resolveOrg(cmd), id)}/chat`,
+      `${itemPath(resolveOrg(cmd), id)}/chat`,
       {}
     );
     if (resolveOutput(cmd) === "json") printJson(res);
@@ -8700,7 +8381,7 @@ function register19(program2) {
       `Delete optimization ${id}, its rounds, trials, and activity? Session history is kept.`,
       opts.yes
     );
-    await createClient().delete(itemPath2(resolveOrg(cmd), id));
+    await createClient().delete(itemPath(resolveOrg(cmd), id));
     if (resolveOutput(cmd) === "json") printJson({ deleted: id });
     else console.log(`Deleted ${id}.`);
   });
@@ -8712,7 +8393,7 @@ function register19(program2) {
         opts.yes
       );
       const detail = await createClient().post(
-        `${itemPath2(org, id)}/complete`,
+        `${itemPath(org, id)}/complete`,
         opts.adopt ? { adoptTrialId: opts.adopt } : {}
       );
       if (resolveOutput(cmd) === "json") printJson(detail);
@@ -8735,7 +8416,7 @@ function register19(program2) {
       const intervalMs = Math.max(interval * 1e3, 2e3);
       let last = "";
       for (; ; ) {
-        const detail = await client.get(itemPath2(org, id));
+        const detail = await client.get(itemPath(org, id));
         const trials2 = detail.rounds.flatMap((round2) => round2.trials);
         const line = `${detail.status}${detail.stopReason ? ` (${detail.stopReason})` : ""} \xB7 round ${detail.round}/${detail.maxRounds} \xB7 ${pct(detail.before)} \u2192 ${pct(detail.after)} \xB7 ${detail.creditsSpent} credits spent \xB7 ${trials2.filter((t) => t.status === "RUNNING").map((t) => t.key).join(",") || "idle"}`;
         if (line !== last) {
@@ -8745,11 +8426,11 @@ function register19(program2) {
         const needsInput = awaitingInput(detail);
         if (watchStops(detail, !!opts.follow)) {
           if (resolveOutput(cmd) === "json") printJson(detail);
-          else printDetail4(detail);
+          else printDetail3(detail);
           if (needsInput) process.exitCode = NEEDS_INPUT_EXIT;
           return;
         }
-        await sleep3(intervalMs);
+        await sleep2(intervalMs);
       }
     }
   );
@@ -8757,7 +8438,7 @@ function register19(program2) {
     "What the next round may change: kinds, CLI targets and commands, baseline invocations, revision"
   ).action(async (id, _opts, cmd) => {
     printJson(
-      await createClient().get(`${itemPath2(resolveOrg(cmd), id)}/authoring`)
+      await createClient().get(`${itemPath(resolveOrg(cmd), id)}/authoring`)
     );
   });
   group.command("invocation <id> <invocationId>").description(
@@ -8766,7 +8447,7 @@ function register19(program2) {
     async (id, invocationId, _opts, cmd) => {
       printJson(
         await createClient().get(
-          `${itemPath2(resolveOrg(cmd), id)}/authoring/target`,
+          `${itemPath(resolveOrg(cmd), id)}/authoring/target`,
           { cliInvocationId: invocationId }
         )
       );
@@ -8777,7 +8458,7 @@ function register19(program2) {
   ).requiredOption("--file <path>", "the change JSON; '-' for stdin").action(async (id, opts, cmd) => {
     printJson(
       await createClient().post(
-        `${itemPath2(resolveOrg(cmd), id)}/cli-changes`,
+        `${itemPath(resolveOrg(cmd), id)}/cli-changes`,
         readObject(opts.file)
       )
     );
@@ -8787,7 +8468,7 @@ function register19(program2) {
   );
   round.command("preview <id>").description("Validate a round file and print its diff and previewDigest").requiredOption("--file <path>", "the round JSON; '-' for stdin").action(async (id, opts, cmd) => {
     const preview = await createClient().post(
-      `${itemPath2(resolveOrg(cmd), id)}/rounds/current/preview`,
+      `${itemPath(resolveOrg(cmd), id)}/rounds/current/preview`,
       readObject(opts.file)
     );
     if (resolveOutput(cmd) === "json") printJson(preview);
@@ -8798,7 +8479,7 @@ function register19(program2) {
   ).requiredOption("--file <path>", "the round JSON you previewed").requiredOption("--digest <digest>", "previewDigest from `round preview`").action(
     async (id, opts, cmd) => {
       const result = await createClient().put(
-        `${itemPath2(resolveOrg(cmd), id)}/rounds/current`,
+        `${itemPath(resolveOrg(cmd), id)}/rounds/current`,
         { ...readObject(opts.file), previewDigest: opts.digest }
       );
       if (resolveOutput(cmd) === "json") printJson(result);
@@ -8811,7 +8492,7 @@ function register19(program2) {
   trials.command("list <id>").description("Every trial of an optimization with score and verdict").action(async (id, _opts, cmd) => {
     const org = resolveOrg(cmd);
     const res = await createClient().get(
-      `${itemPath2(org, id)}/trials`
+      `${itemPath(org, id)}/trials`
     );
     if (resolveOutput(cmd) === "json") printJson(res.items);
     else printItems(res.items.map(trialRow), "table");
@@ -8829,7 +8510,7 @@ function register19(program2) {
     "local directory holding the complete edited bundle, SKILL.md included"
   ).option("--page <url>", "docs page to rewrite (with --body-file)").option("--body-file <path>", "the rewritten page body; '-' for stdin").option("--fork-run <runId>", "fork-at-fetch source run for a docs rewrite").option(
     "--fork-boundary <seq>",
-    "fork-at-fetch boundary from `gauge experiments boundaries`"
+    "fork-at-fetch boundary from `gauge runs fork-boundaries`"
   ).option(
     "--launch",
     "run the trial after saving (spends credits); otherwise save a draft"
@@ -8845,7 +8526,7 @@ function register19(program2) {
           `Run trial "${body.trial.title}" on ${id} now? Spends credits.`,
           opts.yes
         );
-      const result = await createClient().post(`${itemPath2(org, id)}/trials`, body);
+      const result = await createClient().post(`${itemPath(org, id)}/trials`, body);
       if (resolveOutput(cmd) === "json") printJson(result);
       else if (result.replayed)
         console.log(
@@ -8951,7 +8632,7 @@ function register19(program2) {
   ).requiredOption("--url <url>", "the page URL").action(async (id, opts, cmd) => {
     const org = resolveOrg(cmd);
     const res = await createClient().get(
-      `${itemPath2(org, id)}/page`,
+      `${itemPath(org, id)}/page`,
       { url: opts.url }
     );
     if (resolveOutput(cmd) === "json") printJson(res);
@@ -9183,8 +8864,8 @@ function parseWhere(expr) {
   return { dimension, op: opFor[sym], value: rest.trim() };
 }
 function parseOrderBy(raw) {
-  const [key, dir] = raw.split(":");
-  return { key: key.trim(), dir: dir?.trim() === "asc" ? "asc" : "desc" };
+  const [key2, dir] = raw.split(":");
+  return { key: key2.trim(), dir: dir?.trim() === "asc" ? "asc" : "desc" };
 }
 async function readStdin2() {
   const chunks = [];
@@ -9383,7 +9064,7 @@ function reposPath(org) {
 async function fetchAllRepos(client, org) {
   return fetchAllPages(client, reposPath(org));
 }
-function toRow5(repo) {
+function toRow4(repo) {
   return {
     name: repo.name,
     url: repo.url,
@@ -9408,7 +9089,7 @@ function register24(program2) {
       printJson(items);
       return;
     }
-    printItems(items.map(toRow5), "table");
+    printItems(items.map(toRow4), "table");
   });
   repos.command("add <url>").description("Add a repository (pulls languages/size/stars from GitHub)").option(
     "--ref <ref>",
@@ -9501,11 +9182,11 @@ var pollIntervalMs = 5e3;
 function register25(program2) {
   program2.command("run-requests").description("Read a durable launch and its aggregate verdict").command("wait <id>").description("Wait for all sessions and judging in a launch request").action(async (id, _opts, cmd) => {
     const org = resolveOrg(cmd);
-    const path2 = `/api/v1/orgs/${encodeURIComponent(org)}/run-requests/${encodeURIComponent(id)}`;
+    const path3 = `/api/v1/orgs/${encodeURIComponent(org)}/run-requests/${encodeURIComponent(id)}`;
     const client = createClient();
     let lastStatus = "";
     while (true) {
-      const result = await client.get(path2);
+      const result = await client.get(path3);
       if (resolveOutput(cmd) !== "json" && result.status !== lastStatus) {
         console.error(`Run request ${id}: ${result.status}`);
         lastStatus = result.status;
@@ -9554,7 +9235,7 @@ function compact(value, max = 140) {
   const one = s.replace(/\s+/g, " ").trim();
   return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
 }
-function toRow6(run) {
+function toRow5(run) {
   const selected = run.selectedProvider?.slug ?? "";
   const observed = run.observedProvider?.slug;
   return {
@@ -9816,7 +9497,7 @@ function register26(program2) {
         printJson(page);
         return;
       }
-      printItems(page.items.map(toRow6), "table");
+      printItems(page.items.map(toRow5), "table");
       if (page.nextCursor) {
         console.error(
           `(more results \u2014 rerun with --cursor ${page.nextCursor})`
@@ -9942,8 +9623,8 @@ function skillPath(org, ref) {
 }
 function sourceLabel(s) {
   if (!s) return "";
-  const path2 = s.subpath ? `/${s.subpath}` : "";
-  return `${s.repoFullName}${path2}#${s.ref}${s.autoIngest ? " (auto)" : ""}`;
+  const path3 = s.subpath ? `/${s.subpath}` : "";
+  return `${s.repoFullName}${path3}#${s.ref}${s.autoIngest ? " (auto)" : ""}`;
 }
 async function buildSkillEditBody(opts, fetchCurrentSource) {
   if (opts.note !== void 0 && opts.clearNote)
@@ -10168,7 +9849,7 @@ function noteFreshness2(f) {
     );
   }
 }
-async function runStats(command, resource, opts, toRow8) {
+async function runStats(command, resource, opts, toRow7) {
   const org = resolveOrg(command);
   const output = resolveOutput(command);
   const res = await createClient().get(
@@ -10179,7 +9860,7 @@ async function runStats(command, resource, opts, toRow8) {
     printJson(res);
     return;
   }
-  printItems(res.items.map(toRow8), "table");
+  printItems(res.items.map(toRow7), "table");
   noteFreshness2(res.freshness);
 }
 var rankingRow = (r) => ({
@@ -10367,12 +10048,54 @@ function register30(program2) {
   });
 }
 
+// src/commands/update.ts
+var update_exports = {};
+__export(update_exports, {
+  register: () => register31
+});
+import {
+  spawnSync
+} from "child_process";
+function register31(program2, { run = spawnSync, platform = process.platform } = {}) {
+  program2.command("update").description(
+    "Update the globally installed Gauge CLI to the latest version"
+  ).action((_opts, command) => {
+    const output = resolveOutput(command);
+    console.error("Updating Gauge CLI to the latest published version...");
+    const result = run(
+      platform === "win32" ? "npm.cmd" : "npm",
+      ["install", "--global", "@withgauge/cli@latest"],
+      {
+        // Windows needs a shell for npm.cmd; all arguments are fixed literals.
+        shell: platform === "win32",
+        // Keep npm progress out of machine-readable stdout.
+        stdio: ["inherit", output === "json" ? 2 : "inherit", "inherit"]
+      }
+    );
+    if (result.error || result.status !== 0) {
+      const reason = result.error ? result.error.message : result.signal ? `npm was interrupted by ${result.signal}` : `npm exited with code ${result.status}`;
+      throw new CliError(
+        "internal",
+        `CLI update failed: ${reason}.
+Retry with: npm install --global @withgauge/cli@latest`
+      );
+    }
+    if (output === "json") {
+      printJson({ updated: true, package: "@withgauge/cli", tag: "latest" });
+    } else {
+      console.log(
+        "Updated Gauge CLI. Run `gauge --version` to see the installed version."
+      );
+    }
+  });
+}
+
 // src/commands/usage.ts
 var usage_exports = {};
 __export(usage_exports, {
-  register: () => register31
+  register: () => register32
 });
-function register31(program2) {
+function register32(program2) {
   program2.command("usage").description("List credit ledger entries").option("--since <window>", 'e.g. "30d", "24h", or an ISO date').option("--limit <n>", "page size (1-200)", parseLimit, 50).option("--cursor <cursor>", "resume from a previous page's nextCursor").action(
     async (opts, cmd) => {
       const org = resolveOrg(cmd);
@@ -10419,7 +10142,7 @@ function register31(program2) {
 // src/commands/visibility.ts
 var visibility_exports2 = {};
 __export(visibility_exports2, {
-  register: () => register32,
+  register: () => register33,
   visibilityPath: () => visibilityPath
 });
 import { Option as Option3 } from "commander";
@@ -10451,7 +10174,7 @@ function brandsLabel(v) {
   if (v.kind === "HEAD_TO_HEAD") return `${v.brandA} vs ${v.brandB}`;
   return v.branded ? v.brandA ?? "branded" : "organic";
 }
-function toRow7(v) {
+function toRow6(v) {
   return {
     id: v.id,
     name: v.name,
@@ -10463,7 +10186,7 @@ function toRow7(v) {
     "last run": v.lastRunAt ?? "-"
   };
 }
-function printDetail5(v) {
+function printDetail4(v) {
   console.log(`id:      ${v.id}`);
   console.log(`name:    ${v.name}`);
   console.log(`kind:    ${v.kind}`);
@@ -10498,7 +10221,7 @@ function registerPreferenceGroup(group) {
       visibilityPath(org)
     );
     if (resolveOutput(cmd) === "json") printJson(res.items);
-    else printItems(res.items.map(toRow7), "table");
+    else printItems(res.items.map(toRow6), "table");
   });
   group.command("get <id>").description("Show one preference prompt").action(async (id, _opts, cmd) => {
     const org = resolveOrg(cmd);
@@ -10506,7 +10229,7 @@ function registerPreferenceGroup(group) {
       `${visibilityPath(org)}/${encodeURIComponent(id)}`
     );
     if (resolveOutput(cmd) === "json") printJson(vp);
-    else printDetail5(vp);
+    else printDetail4(vp);
   });
   addRunSettingsCreateOptions(
     group.command("create").description(
@@ -10775,7 +10498,7 @@ function registerPreferenceGroup(group) {
     );
   });
 }
-function register32(program2) {
+function register33(program2) {
   const preference = program2.command("preference").description("Manage Agent Preference prompts and measured markets");
   registerPreferenceGroup(preference);
   const legacy = program2.command("visibility", { hidden: true });
@@ -10794,6 +10517,7 @@ program.name("gauge").description(
 );
 for (const group of [
   instructions_exports,
+  update_exports,
   auth_exports,
   onboard_exports,
   status_exports,
@@ -10811,7 +10535,6 @@ for (const group of [
   runs_exports2,
   runRequests_exports2,
   optimizations_exports2,
-  experiments_exports2,
   apply_exports,
   batches_exports,
   brands_exports2,
@@ -10828,6 +10551,7 @@ for (const group of [
   group.register(program);
 }
 register7(program, { hidden: !staffCommandsVisible() });
+register8(program, { hidden: !staffCommandsVisible() });
 program.exitOverride();
 try {
   await program.parseAsync(process.argv);