brnch-cli 0.14.0 → 0.15.0

package/brnch.mjs

@@ -718,9 +718,9 @@ var require_Alias = __commonJS({
       } else if (identity.isCollection(node2)) {
         let count = 0;
         for (const item of node2.items) {
-          const c4 = getAliasCount(doc, item, anchors2);
-          if (c4 > count)
-            count = c4;
+          const c5 = getAliasCount(doc, item, anchors2);
+          if (c5 > count)
+            count = c5;
         }
         return count;
       } else if (identity.isPair(node2)) {
@@ -5829,11 +5829,11 @@ var require_lexer = __commonJS({
       hasChars(n) {
         return this.pos + n <= this.buffer.length;
       }
-      setNext(state) {
+      setNext(state2) {
         this.buffer = this.buffer.substring(this.pos);
         this.pos = 0;
         this.lineEndPos = null;
-        this.next = state;
+        this.next = state2;
         return null;
       }
       peek(n) {
@@ -13766,7 +13766,7 @@ var base64urlCharset = /^[A-Za-z0-9_-]*$/;
 function isValidBase64URL(data) {
   if (!base64urlCharset.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c4) => c4 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c5) => c5 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -15903,11 +15903,11 @@ function settle(inst, answer) {
 function isRecursiveSchema(inst) {
   return isRecursive(inst, /* @__PURE__ */ new Set(), true) !== NONE;
 }
-function bucketFor(state, inst) {
-  let bucket = state.buckets.get(inst);
+function bucketFor(state2, inst) {
+  let bucket = state2.buckets.get(inst);
   if (!bucket) {
     bucket = /* @__PURE__ */ new WeakMap();
-    state.buckets.set(inst, bucket);
+    state2.buckets.set(inst, bucket);
   }
   return bucket;
 }
@@ -15965,16 +15965,16 @@ var memo = {
         const input2 = payload.value;
         if (!isRef(input2))
           return base2(payload, ctx);
-        let state = ctx[STATE];
-        if (!state) {
-          state = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
-          ctx[STATE] = state;
+        let state2 = ctx[STATE];
+        if (!state2) {
+          state2 = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
+          ctx[STATE] = state2;
         }
         let bucket;
         if (lastCtx === ctx) {
           bucket = lastBucket;
         } else {
-          bucket = bucketFor(state, inst);
+          bucket = bucketFor(state2, inst);
           lastCtx = ctx;
           lastBucket = bucket;
         }
@@ -15986,8 +15986,8 @@ var memo = {
               payload.issues.push(...cloneIssues(hit.issues));
           } else {
             payload.memo = true;
-            state.backEdges ?? (state.backEdges = /* @__PURE__ */ new WeakSet());
-            state.backEdges.add(hit.value);
+            state2.backEdges ?? (state2.backEdges = /* @__PURE__ */ new WeakSet());
+            state2.backEdges.add(hit.value);
           }
           return payload;
         }
@@ -30642,7 +30642,7 @@ var ReactionRequest = external_exports.object({
   content: external_exports.enum(REACTION_CONTENTS)
 });
 var LabelName = external_exports.string().trim().min(1).max(50).regex(/^[^\u0000-\u001f\u007f]+$/, "control characters are not allowed");
-var LabelColor = external_exports.string().trim().regex(/^#?[0-9a-fA-F]{6}$/, "six-digit hex color").transform((c4) => `#${c4.replace(/^#/, "").toLowerCase()}`);
+var LabelColor = external_exports.string().trim().regex(/^#?[0-9a-fA-F]{6}$/, "six-digit hex color").transform((c5) => `#${c5.replace(/^#/, "").toLowerCase()}`);
 var CreateLabelRequest = external_exports.object({ name: LabelName, color: LabelColor, description: external_exports.string().max(100).default("") });
 var UpdateLabelRequest = external_exports.object({ name: LabelName.optional(), color: LabelColor.optional(), description: external_exports.string().max(100).optional(), version: external_exports.number().int() });
 var INTERACTION_LIMIT_LEVELS = ["none", "prior_contributors", "collaborators"];
@@ -30946,12 +30946,6 @@ var CreateReleaseRequest = external_exports.object({
   draft: external_exports.boolean().default(false)
 });
 var CreateTagRequest = external_exports.object({ name: external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._\/-]+$/), target: external_exports.string().max(255) });
-var NotificationSettingsSchema = external_exports.object({
-  email_immediate: external_exports.array(external_exports.enum(["review_requested", "response_required", "check_failed", "permission_request", "merge_conflict", "promotion_blocked", "session_blocked", "watching", "secret_alert"])).default([]),
-  email_digest: external_exports.enum(["off", "daily"]).default("off"),
-  muted: external_exports.array(external_exports.string().max(200)).max(500).default([])
-});
-var MuteRequest = external_exports.object({ group_key: external_exports.string().max(200).optional(), change_id: external_exports.string().optional(), session_id: external_exports.string().optional() });
 
 // packages/protocol/src/auth-unified.ts
 var DeliverableEmail = external_exports.email().max(254).refine((e) => !/\.invalid$/i.test(e), "this address cannot receive email");
@@ -31239,11 +31233,11 @@ var ConnectorVariants = external_exports.discriminatedUnion("kind", [
     credentials: external_exports.object({ api_key: Secret })
   })
 ]);
-var CreateConnectorRequest = ConnectorVariants.superRefine((v, c4) => {
+var CreateConnectorRequest = ConnectorVariants.superRefine((v, c5) => {
   const withConnection = "connection_id" in v && !!v.connection_id;
   const withCredentials = "credentials" in v && v.credentials !== void 0 && Object.keys(v.credentials).length > 0;
   if (v.kind === "cloudflare" || v.kind === "planetscale" || v.kind === "sentry") {
-    if (withConnection === withCredentials) c4.addIssue({ code: "custom", path: ["credentials"], message: "give either credentials or connection_id (a connected account), not both" });
+    if (withConnection === withCredentials) c5.addIssue({ code: "custom", path: ["credentials"], message: "give either credentials or connection_id (a connected account), not both" });
   }
 });
 var FactRequestSchema = external_exports.object({
@@ -32254,11 +32248,11 @@ var UpsertWorkerEnvRequest = external_exports.object({
   store_id: external_exports.string().regex(/^[A-Za-z0-9]{1,64}$/).optional(),
   store_secret_name: external_exports.string().regex(/^[A-Za-z0-9_-]{1,255}$/).optional(),
   expected_version: external_exports.number().int().positive().optional()
-}).superRefine((v, c4) => {
-  if (v.source === "value" && v.value === void 0) c4.addIssue({ code: "custom", message: "value is required for source=value", path: ["value"] });
-  if (v.source === "actions_secret" && !v.secret_name) c4.addIssue({ code: "custom", message: "secret_name is required for source=actions_secret", path: ["secret_name"] });
-  if (v.source === "secrets_store" && (!v.store_id || !v.store_secret_name)) c4.addIssue({ code: "custom", message: "store_id and store_secret_name are required for source=secrets_store", path: ["store_id"] });
-  if (v.kind === "var" && v.source !== "value") c4.addIssue({ code: "custom", message: "plain vars take a value", path: ["source"] });
+}).superRefine((v, c5) => {
+  if (v.source === "value" && v.value === void 0) c5.addIssue({ code: "custom", message: "value is required for source=value", path: ["value"] });
+  if (v.source === "actions_secret" && !v.secret_name) c5.addIssue({ code: "custom", message: "secret_name is required for source=actions_secret", path: ["secret_name"] });
+  if (v.source === "secrets_store" && (!v.store_id || !v.store_secret_name)) c5.addIssue({ code: "custom", message: "store_id and store_secret_name are required for source=secrets_store", path: ["store_id"] });
+  if (v.kind === "var" && v.source !== "value") c5.addIssue({ code: "custom", message: "plain vars take a value", path: ["source"] });
 });
 
 // packages/protocol/src/buildkite.ts
@@ -32495,19 +32489,19 @@ function parseGreptileJson(stdout, stderr, exitCode) {
     return done({ status: "failed", summary: null, findings: [], error: { code: "output_invalid", message: "greptile did not print its JSON result" } });
   }
   const findings2 = [];
-  for (const c4 of Array.isArray(out.comments) ? out.comments.map(rec) : []) {
-    const body = str2(c4.body);
+  for (const c5 of Array.isArray(out.comments) ? out.comments.map(rec) : []) {
+    const body = str2(c5.body);
     if (!body) continue;
     findings2.push(
       finding({
-        path: relPath(c4.path),
-        start: line(c4.startLine),
-        end: line(c4.endLine),
-        side: c4.side === "old" ? "old" : "new",
-        severity: GREPTILE_SEVERITY[String(c4.severity ?? "")] ?? "info",
+        path: relPath(c5.path),
+        start: line(c5.startLine),
+        end: line(c5.endLine),
+        side: c5.side === "old" ? "old" : "new",
+        severity: GREPTILE_SEVERITY[String(c5.severity ?? "")] ?? "info",
         body,
-        suggestion: str2(c4.suggestion),
-        security: c4.securityIssue === true
+        suggestion: str2(c5.suggestion),
+        security: c5.securityIssue === true
       })
     );
   }
@@ -32766,6 +32760,53 @@ var StaffRiskQuery = external_exports.object({
   cursor: external_exports.string().max(200).optional()
 });
 
+// packages/protocol/src/notifications.ts
+var NOTIFICATION_REASONS = [
+  "review_requested",
+  "review_available",
+  "response_required",
+  "check_failed",
+  "permission_request",
+  "merge_conflict",
+  "promotion_blocked",
+  "session_blocked",
+  "watching",
+  "secret_alert",
+  "mentioned",
+  "assigned",
+  "comment",
+  "approved",
+  "merged"
+];
+var NotificationReasonSchema = external_exports.enum(NOTIFICATION_REASONS);
+var NOTIFICATION_CHANNELS = ["in_app", "email", "push"];
+var NotificationModeSchema = external_exports.enum(["off", "on", "immediate", "digest"]);
+var ChannelModesSchema = external_exports.object({ in_app: external_exports.enum(["on", "off"]).optional(), email: external_exports.enum(["off", "immediate", "digest"]).optional(), push: external_exports.enum(["on", "off"]).optional() }).strict();
+var HHMM = external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "HH:MM, 24-hour");
+var ReasonModes = external_exports.partialRecord(NotificationReasonSchema, ChannelModesSchema);
+var NotificationSettingsSchema = external_exports.object({
+  reasons: ReasonModes.optional(),
+  orgs: external_exports.record(external_exports.string().max(64), ReasonModes).refine((o) => Object.keys(o).length <= 100, "at most 100 organizations").optional(),
+  digest: external_exports.object({ frequency: external_exports.enum(["off", "daily", "weekly"]), hour: external_exports.number().int().min(0).max(23).default(8), time_zone: external_exports.string().max(64).default("UTC") }).optional(),
+  quiet_hours: external_exports.object({ start: HHMM, end: HHMM }).nullable().optional(),
+  push_previews: external_exports.boolean().optional(),
+  muted: external_exports.array(external_exports.string().max(200)).max(500).optional(),
+  email_immediate: external_exports.array(NotificationReasonSchema).optional(),
+  email_digest: external_exports.enum(["off", "daily"]).optional()
+});
+var MuteRequest = external_exports.object({ group_key: external_exports.string().max(200).optional(), change_id: external_exports.string().optional(), session_id: external_exports.string().optional() });
+var SnoozeRequest = external_exports.object({ until: external_exports.iso.datetime() });
+var InboxBulkRequest = external_exports.object({ action: external_exports.enum(["read", "unread", "done"]), ids: external_exports.array(external_exports.string().max(64)).max(100).optional(), all: external_exports.boolean().optional() });
+var RegisterPushDeviceRequest = external_exports.object({
+  platform: external_exports.literal("ios"),
+  /** The APNs device token, hex. */
+  token: external_exports.string().regex(/^[0-9a-fA-F]{32,200}$/),
+  environment: external_exports.enum(["sandbox", "production"]),
+  app_version: external_exports.string().max(40).optional(),
+  name: external_exports.string().max(80).optional()
+});
+var PushTestRequest = external_exports.object({ message: external_exports.string().trim().min(1).max(120).optional() });
+
 // packages/sdk/src/sse.ts
 async function* parseSse(body) {
   const reader2 = body.getReader();
@@ -32803,11 +32844,11 @@ async function* parseSse(body) {
       }
       let start = 0;
       for (let i = 0; i < buf.length; i++) {
-        const c4 = buf[i];
-        if (c4 !== "\n" && c4 !== "\r") continue;
-        if (c4 === "\r" && i === buf.length - 1) break;
+        const c5 = buf[i];
+        if (c5 !== "\n" && c5 !== "\r") continue;
+        if (c5 === "\r" && i === buf.length - 1) break;
         const line2 = buf.slice(start, i);
-        if (c4 === "\r" && buf[i + 1] === "\n") i++;
+        if (c5 === "\r" && buf[i + 1] === "\n") i++;
         start = i + 1;
         const msg = onLine(line2);
         if (msg) yield msg;
@@ -33934,19 +33975,49 @@ function integrationsGroup(t) {
   };
 }
 function eventsGroup(t) {
+  const list2 = (org, q = {}, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}/events`, query: { ...q }, options: o });
   return {
-    /** Permission-filtered replay; pass the previous `next_cursor` (or last event id) as `after`. */
-    list: (org, q = {}, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}/events`, query: { ...q }, options: o }),
+    /** Permission-filtered replay, oldest first; pass the previous `next_cursor` as `after`. */
+    list: list2,
+    /**
+     * Follow an organization's events by polling the replay (there is no push stream for them): each event once, in
+     * order. `after` is a cursor from `list` or an event id; without it the replay starts at the oldest event, or at
+     * the end with `fromNow` (which pages through the history once to find it). Ends when `signal` aborts.
+     */
     async *stream(org, q = {}) {
-      yield* streamJson(t, {
-        method: "GET",
-        path: path2`/v1/orgs/${org}/events/stream`,
-        query: { after: q.after },
-        options: q.signal ? { signal: q.signal } : void 0
-      });
+      const o = q.signal ? { signal: q.signal } : void 0;
+      let after = q.after && isEventId(q.after) ? eventCursor(q.after) : q.after;
+      let skipping = !after && !!q.fromNow;
+      try {
+        while (!q.signal?.aborted) {
+          const page = await list2(org, { ...after ? { after } : {}, limit: 100 }, o);
+          if (!skipping) for (const e of page.items) yield e;
+          const last = page.items.at(-1);
+          after = page.next_cursor ?? (last ? eventCursor(last.id) : after);
+          if (page.next_cursor) continue;
+          skipping = false;
+          await pause(q.pollMs ?? 5e3, q.signal);
+        }
+      } catch (e) {
+        if (!q.signal?.aborted) throw e;
+      }
     }
   };
 }
+var isEventId = (s) => /^[a-z]+_[0-9a-z]+$/.test(s);
+var eventCursor = (id2) => btoa(id2).replace(/=+$/, "");
+function pause(ms, signal) {
+  return new Promise((resolve13) => {
+    if (signal?.aborted) return resolve13();
+    const timer = setTimeout(done2, ms);
+    function done2() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done2);
+      resolve13();
+    }
+    signal?.addEventListener("abort", done2, { once: true });
+  });
+}
 function webhooksGroup(t) {
   return {
     /** The signing `secret` is returned only here. */
@@ -33960,8 +34031,104 @@ function webhooksGroup(t) {
   };
 }
 function inboxGroup(t) {
+  const act2 = (action) => (id2, o) => t.void({ method: "POST", path: path2`/v1/inbox/${id2}/${action}`, options: o });
+  const count = (o) => t.json({ method: "GET", path: "/v1/inbox/count", options: o });
+  return {
+    list: (q = {}, o) => t.json({ method: "GET", path: "/v1/inbox", query: { ...q }, options: o }),
+    count,
+    read: act2("read"),
+    unread: act2("unread"),
+    done: act2("done"),
+    undone: act2("undone"),
+    snooze: (id2, until, o) => t.void({ method: "POST", path: path2`/v1/inbox/${id2}/snooze`, json: validate2(SnoozeRequest, { until }, "SnoozeRequest"), options: o }),
+    bulk: (body, o) => t.json({ method: "POST", path: "/v1/inbox/bulk", json: validate2(InboxBulkRequest, body, "InboxBulkRequest"), options: o }),
+    mute: (body, o) => t.json({ method: "POST", path: "/v1/inbox/mute", json: validate2(MuteRequest, body, "MuteRequest"), options: o }),
+    /**
+     * Live inbox changes. Uses the WebSocket at `/v1/me/inbox/events` when the runtime's WebSocket can send an
+     * Authorization header (Node's), and otherwise polls the unread count every `pollMs`; either way each yield means
+     * "the inbox changed: re-read it". Ends when `signal` aborts.
+     */
+    async *watch(q = {}) {
+      const getToken = async () => t.options.tokenProvider ? await t.options.tokenProvider.getToken() : t.options.token;
+      const WS = globalThis.WebSocket;
+      if (WS && await getToken() && typeof process !== "undefined") {
+        try {
+          while (!q.signal?.aborted) {
+            for await (const e of liveEvents(WS, `${t.baseUrl.replace(/^http/, "ws")}/v1/me/inbox/events`, await getToken(), q.signal)) yield e;
+            await pause(1e3, q.signal);
+          }
+          return;
+        } catch {
+        }
+      }
+      let last = -1;
+      while (!q.signal?.aborted) {
+        const { unread } = await count(q.signal ? { signal: q.signal } : void 0);
+        if (unread !== last) {
+          if (last !== -1) yield { type: "state", ids: [], unread, at: (/* @__PURE__ */ new Date()).toISOString() };
+          last = unread;
+        }
+        await pause(q.pollMs ?? 15e3, q.signal);
+      }
+    }
+  };
+}
+async function* liveEvents(WS, url2, token, signal) {
+  const ws = new WS(url2, { headers: { authorization: `Bearer ${token}` } });
+  const queue = [];
+  let wake = null;
+  const end2 = { closed: null };
+  const notify = () => {
+    wake?.();
+    wake = null;
+  };
+  const ping = setInterval(() => ws.readyState === 1 && ws.send("ping"), 3e4);
+  ws.addEventListener("message", (m) => {
+    if (m.data === "pong") return;
+    try {
+      queue.push(JSON.parse(String(m.data)));
+    } catch {
+      return;
+    }
+    notify();
+  });
+  ws.addEventListener("error", () => {
+    end2.closed ??= { error: true };
+    notify();
+  });
+  ws.addEventListener("close", () => {
+    end2.closed ??= { error: false };
+    notify();
+  });
+  signal?.addEventListener("abort", () => ws.close(1e3), { once: true });
+  try {
+    for (; ; ) {
+      while (queue.length) yield queue.shift();
+      if (end2.closed) {
+        if (end2.closed.error) throw new Error("inbox socket failed");
+        return;
+      }
+      await new Promise((r) => wake = r);
+    }
+  } finally {
+    clearInterval(ping);
+    if (ws.readyState <= 1) ws.close(1e3);
+  }
+}
+function notificationsGroup(t) {
   return {
-    list: (q = {}, o) => t.json({ method: "GET", path: "/v1/inbox", query: { ...q }, options: o })
+    get: (o) => t.json({ method: "GET", path: "/v1/me/notifications", options: o }),
+    /** Changes only what is given; per reason, only the channels given. */
+    update: (body, o) => t.json({ method: "PATCH", path: "/v1/me/notifications", json: validate2(NotificationSettingsSchema, body, "NotificationSettings"), options: o }),
+    /** Turns email off for a reason (or all) from an unsubscribe link's token; needs no sign-in. */
+    unsubscribe: (token, o) => t.json({ method: "POST", path: "/v1/notifications/unsubscribe", query: { token }, anonymous: true, options: o }),
+    devices: {
+      list: (o) => t.json({ method: "GET", path: "/v1/me/push-devices", options: o }),
+      register: (body, o) => t.json({ method: "POST", path: "/v1/me/push-devices", json: validate2(RegisterPushDeviceRequest, body, "RegisterPushDeviceRequest"), options: o }),
+      remove: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/me/push-devices/${id2}`, options: o }),
+      /** A test notification to your own devices; `message` replaces the default text. */
+      test: (body = {}, o) => t.json({ method: "POST", path: "/v1/me/push-devices/test", json: validate2(PushTestRequest, body, "PushTestRequest"), options: o })
+    }
   };
 }
 function auditGroup(t) {
@@ -34378,6 +34545,7 @@ function createClient(options) {
     events: eventsGroup(t),
     webhooks: webhooksGroup(t),
     inbox: inboxGroup(t),
+    notifications: notificationsGroup(t),
     audit: auditGroup(t),
     exports: exportsGroup(t),
     migrations: migrationsGroup(t),
@@ -34631,7 +34799,7 @@ async function verifyReceipt(envelope, keys, opts = {}) {
 }
 
 // packages/cli/package.json
-var version2 = "0.14.0";
+var version2 = "0.15.0";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -35403,7 +35571,7 @@ function createStoredTokenProvider(opts) {
   const skew = opts.skewMs ?? 12e4;
   let cached3;
   let inflight = null;
-  const expiring = (c4) => !!c4.expires_at && Date.parse(c4.expires_at) - skew <= now();
+  const expiring = (c5) => !!c5.expires_at && Date.parse(c5.expires_at) - skew <= now();
   const load = async () => cached3 !== void 0 ? cached3 : cached3 = await lookupCredential(opts.file, opts.baseUrl, opts.account);
   async function doRefresh(stale, force) {
     return withCredentialsLock(
@@ -35438,14 +35606,14 @@ function createStoredTokenProvider(opts) {
   return {
     current: load,
     async getToken() {
-      const c4 = await load();
-      if (!c4) return void 0;
-      if (!c4.refresh_token || !expiring(c4)) return c4.token;
-      return refreshOnce(c4.token, false);
+      const c5 = await load();
+      if (!c5) return void 0;
+      if (!c5.refresh_token || !expiring(c5)) return c5.token;
+      return refreshOnce(c5.token, false);
     },
     async onUnauthorized(token) {
-      const c4 = await load();
-      if (!c4?.refresh_token) return void 0;
+      const c5 = await load();
+      if (!c5?.refresh_token) return void 0;
       return refreshOnce(token, true);
     }
   };
@@ -35698,8 +35866,8 @@ async function autoWireHooks(deps, agent) {
   const names = SKILL_NAMES.join(" and ");
   if (await hooksWired(deps, agent.tool) !== false)
     return skill ? `Added the ${names} skills for ${agent.label}: how to coordinate with other agents here and hand changes to people for merge.` : null;
-  const state = await installAgentHooks(tool, "user", home2, null, BRAND.cli);
-  return `Wired ${state.label}'s hooks (${state.file})${skill ? ` and the ${names} skills` : ""} so its sessions report to Brnch by themselves from its next session on. Undo: ${BRAND.cli} hooks uninstall --agent ${tool}`;
+  const state2 = await installAgentHooks(tool, "user", home2, null, BRAND.cli);
+  return `Wired ${state2.label}'s hooks (${state2.file})${skill ? ` and the ${names} skills` : ""} so its sessions report to Brnch by themselves from its next session on. Undo: ${BRAND.cli} hooks uninstall --agent ${tool}`;
 }
 async function wireInstalledTools(deps, tools) {
   if (autoWireOff(deps.env) || deps.env[envName("CAPTURE")] === "0") return [];
@@ -35711,8 +35879,8 @@ async function wireInstalledTools(deps, tools) {
     try {
       await installSkills([tool], home2).catch(() => []);
       if ((await agentHookState(tool, "user", home2, null)).installed.length) continue;
-      const state = await installAgentHooks(tool, "user", home2, null, BRAND.cli);
-      out.push(`${state.label} \u2192 ${state.file}`);
+      const state2 = await installAgentHooks(tool, "user", home2, null, BRAND.cli);
+      out.push(`${state2.label} \u2192 ${state2.file}`);
     } catch {
     }
   }
@@ -35758,16 +35926,16 @@ async function loadBookmark(deps, baseUrl) {
   if (!entry || !isBookmark(entry.bookmark) || !(deps.sys.now() - entry.at < TTL_MS)) return void 0;
   return entry.bookmark;
 }
-async function saveBookmark(deps, state) {
+async function saveBookmark(deps, state2) {
   try {
-    if (!state.bookmarkChanged || !state.bookmark || !state.baseUrl) return;
+    if (!state2.bookmarkChanged || !state2.bookmark || !state2.baseUrl) return;
     const file2 = bookmarkFile(deps.env);
     const data = await readFileSafe(deps, file2);
     const now = deps.sys.now();
     for (const [k, v] of Object.entries(data.hosts)) if (!(now - v.at < TTL_MS)) delete data.hosts[k];
-    const key = hostKey(state.baseUrl);
+    const key = hostKey(state2.baseUrl);
     const prev = data.hosts[key];
-    if (!prev || !isBookmark(prev.bookmark) || state.bookmark > prev.bookmark) data.hosts[key] = { bookmark: state.bookmark, at: now };
+    if (!prev || !isBookmark(prev.bookmark) || state2.bookmark > prev.bookmark) data.hosts[key] = { bookmark: state2.bookmark, at: now };
     else data.hosts[key] = { ...prev, at: now };
     await deps.sys.mkdir(dirname6(file2), 448);
     await deps.writeFile(file2, `${JSON.stringify(data)}
@@ -36239,7 +36407,7 @@ function selectAccount(list2, o) {
   return { account: active, source: active ? "active" : "none" };
 }
 var isPersonToken = (t) => !/^f(ses|int|job|wsg)_/.test(t);
-async function createContext(deps, globals, state) {
+async function createContext(deps, globals, state2) {
   const env = deps.env;
   const credFile = credentialsPath({ XDG_CONFIG_HOME: env.XDG_CONFIG_HOME, HOME: env.HOME }, BRAND.configDir);
   let creds;
@@ -36255,7 +36423,7 @@ async function createContext(deps, globals, state) {
   } catch {
     throw usage(`invalid server URL: ${baseUrl}`);
   }
-  state.baseUrl = baseUrl;
+  state2.baseUrl = baseUrl;
   if (!project.repo && !globals.repo && !env[envName("REPO")]) {
     const inferred = await repoFromGitRemotes(deps, baseUrl);
     if (inferred) project.repo = inferred;
@@ -36268,14 +36436,14 @@ async function createContext(deps, globals, state) {
   const storedCred = selected?.cred;
   const stored = storedCred?.token;
   const accountId = storedCred?.account?.user_id ?? null;
-  if (signedIn2.length > 1 && selected) state.accounts = { using: accountLabel(selected.cred.account), others: signedIn2.filter((a) => a !== selected).map((a) => accountLabel(a.cred.account)) };
-  const interactive = !state.json && !env.CI && deps.stdinIsTTY && deps.stderrIsTTY;
+  if (signedIn2.length > 1 && selected) state2.accounts = { using: accountLabel(selected.cred.account), others: signedIn2.filter((a) => a !== selected).map((a) => accountLabel(a.cred.account)) };
+  const interactive = !state2.json && !env.CI && deps.stdinIsTTY && deps.stderrIsTTY;
   const userAgent2 = `${BRAND.cli}-cli/${BRAND.version}`;
   if (invalidAgentToolFlag(globals.agentTool)) throw usage(`unknown --agent-tool "${globals.agentTool}"; e.g. claude-code, codex, cursor, gemini-cli, opencode, aider, copilot, grok, other`);
   const agent = detectAgent(env, globals.agentTool);
   const headers = agent ? { [CLIENT_RUNTIME_HEADER]: formatClientRuntime({ agent: agent.tool, version: agent.version }) } : void 0;
-  for (const s of [globals.token, env[envName("TOKEN")], env[envName("SESSION_TOKEN")], stored, storedCred?.refresh_token]) if (s) state.secrets.push(s);
-  for (const a of signedIn2) for (const s of [a.cred.token, a.cred.refresh_token]) if (s) state.secrets.push(s);
+  for (const s of [globals.token, env[envName("TOKEN")], env[envName("SESSION_TOKEN")], stored, storedCred?.refresh_token]) if (s) state2.secrets.push(s);
+  for (const a of signedIn2) for (const s of [a.cred.token, a.cred.refresh_token]) if (s) state2.secrets.push(s);
   const providers = /* @__PURE__ */ new Map();
   function storedProvider(url2) {
     const key = hostKey(url2);
@@ -36287,7 +36455,7 @@ async function createContext(deps, globals, state) {
         ...key === hostKey(baseUrl) ? { account: accountId } : {},
         refresh: async (input3) => {
           const r = await deps.createClient({ baseUrl: url2, userAgent: userAgent2, headers }).oauth.refresh(input3);
-          state.secrets.push(r.access_token, ...r.refresh_token ? [r.refresh_token] : []);
+          state2.secrets.push(r.access_token, ...r.refresh_token ? [r.refresh_token] : []);
           return r;
         }
       });
@@ -36306,14 +36474,14 @@ async function createContext(deps, globals, state) {
   }
   const seedBookmark = await loadBookmark(deps, baseUrl);
   const noteBookmark = (b) => {
-    if (state.bookmark && b <= state.bookmark) return;
-    state.bookmark = b;
-    state.bookmarkChanged = true;
+    if (state2.bookmark && b <= state2.bookmark) return;
+    state2.bookmark = b;
+    state2.bookmarkChanged = true;
   };
   const clients = /* @__PURE__ */ new Map();
   function makeClient(t, routed) {
     const dynamic = !!t && t === stored && !!storedCred?.refresh_token;
-    const consistency = { bookmark: state.bookmark ?? seedBookmark, onBookmark: noteBookmark, ...headers ? { headers } : {}, ...routed ? { routeCredential } : {} };
+    const consistency = { bookmark: state2.bookmark ?? seedBookmark, onBookmark: noteBookmark, ...headers ? { headers } : {}, ...routed ? { routeCredential } : {} };
     return dynamic ? deps.createClient({ baseUrl, tokenProvider: storedProvider(baseUrl), userAgent: userAgent2, ...consistency }) : deps.createClient({ baseUrl, token: t, userAgent: userAgent2, ...consistency });
   }
   function client(pref = "agent", opts = {}) {
@@ -36327,32 +36495,32 @@ async function createContext(deps, globals, state) {
     }
     const routed = !!agent && !!t && isPersonToken(t);
     const key = `${routed ? "r:" : ""}${t ?? ""}`;
-    let c4 = clients.get(key);
-    if (!c4) {
-      c4 = makeClient(t, routed);
-      clients.set(key, c4);
+    let c5 = clients.get(key);
+    if (!c5) {
+      c5 = makeClient(t, routed);
+      clients.set(key, c5);
     }
-    return c4;
+    return c5;
   }
   function humanClient() {
     const { token: t } = token("user");
     if (!t) return client("user");
     const key = `h:${t}`;
-    let c4 = clients.get(key);
-    if (!c4) {
-      c4 = makeClient(t, false);
-      clients.set(key, c4);
+    let c5 = clients.get(key);
+    if (!c5) {
+      c5 = makeClient(t, false);
+      clients.set(key, c5);
     }
-    return c4;
+    return c5;
   }
   function sessionClient(t) {
     const key = `s:${t}`;
-    let c4 = clients.get(key);
-    if (!c4) {
-      c4 = deps.createClient({ baseUrl, token: t, userAgent: userAgent2, bookmark: state.bookmark ?? seedBookmark, onBookmark: noteBookmark, ...headers ? { headers } : {} });
-      clients.set(key, c4);
+    let c5 = clients.get(key);
+    if (!c5) {
+      c5 = deps.createClient({ baseUrl, token: t, userAgent: userAgent2, bookmark: state2.bookmark ?? seedBookmark, onBookmark: noteBookmark, ...headers ? { headers } : {} });
+      clients.set(key, c5);
     }
-    return c4;
+    return c5;
   }
   const sessions = /* @__PURE__ */ new Map();
   let announced = false;
@@ -36388,8 +36556,8 @@ async function createContext(deps, globals, state) {
         const r = await repoTarget(spec);
         const target = { baseUrl, repoId: r.id, repo: r.name, tool: agent.tool, toolSession: toolSessionFromEnv(), toolVersion: agent.version, title: env[envName("SESSION_TITLE")]?.trim() || null, accountId };
         const { session, started } = await ensureAgentSession({ file: credFile, human: humanClient, asSession: sessionClient }, target);
-        state.secrets.push(session.token);
-        state.actingAs = session;
+        state2.secrets.push(session.token);
+        state2.actingAs = session;
         if (!announced) {
           announced = true;
           info(`${started ? "Started agent session. " : ""}${actingLine(session)}`);
@@ -36430,7 +36598,7 @@ async function createContext(deps, globals, state) {
       account: userId,
       refresh: async (input3) => {
         const r = await deps.createClient({ baseUrl, userAgent: userAgent2, headers }).oauth.refresh(input3);
-        state.secrets.push(r.access_token, ...r.refresh_token ? [r.refresh_token] : []);
+        state2.secrets.push(r.access_token, ...r.refresh_token ? [r.refresh_token] : []);
         return r;
       }
     });
@@ -36480,13 +36648,13 @@ async function createContext(deps, globals, state) {
     throw usage(`no agent session selected: pass --session <id>, set ${envName("SESSION_ID")}, or authenticate with ${envName("SESSION_TOKEN")}`);
   }
   function info(message) {
-    deps.stderr.write(`${redact(message, state.secrets)}
+    deps.stderr.write(`${redact(message, state2.secrets)}
 `);
   }
   function result(value, human) {
-    if (state.wroteResult) throw new Error("internal: result written twice");
-    state.wroteResult = true;
-    if (state.json) {
+    if (state2.wroteResult) throw new Error("internal: result written twice");
+    state2.wroteResult = true;
+    if (state2.json) {
       deps.stdout.write(`${JSON.stringify(value ?? null, null, 2)}
 `);
       return;
@@ -36505,7 +36673,7 @@ async function createContext(deps, globals, state) {
   return {
     deps,
     globals,
-    json: state.json,
+    json: state2.json,
     interactive,
     baseUrl,
     credentialsFile: credFile,
@@ -36537,9 +36705,9 @@ async function createContext(deps, globals, state) {
     confirm,
     input: input2,
     setExit: (code) => {
-      state.exitCode = code;
+      state2.exitCode = code;
     },
-    addSecret: (s) => state.secrets.push(s)
+    addSecret: (s) => state2.secrets.push(s)
   };
 }
 
@@ -36562,7 +36730,7 @@ function act(rt, handler) {
 }
 function commandPath(cmd) {
   const names = [];
-  for (let c4 = cmd; c4?.parent; c4 = c4.parent) names.unshift(c4.name());
+  for (let c5 = cmd; c5?.parent; c5 = c5.parent) names.unshift(c5.name());
   return names.join(" ");
 }
 async function wireHooks(ctx) {
@@ -36651,10 +36819,10 @@ function pick2(o, key) {
 }
 function table(rows2, columns) {
   if (!rows2.length) return "(none)";
-  const data = rows2.map((r) => columns.map((c4) => cell(pick2(r ?? {}, c4))));
-  const widths = columns.map((c4, i) => Math.max(c4.length, ...data.map((d) => (d[i] ?? "").length)));
+  const data = rows2.map((r) => columns.map((c5) => cell(pick2(r ?? {}, c5))));
+  const widths = columns.map((c5, i) => Math.max(c5.length, ...data.map((d) => (d[i] ?? "").length)));
   const line2 = (cells2) => cells2.map((s, i) => i === cells2.length - 1 ? s : s.padEnd(widths[i] ?? 0)).join("  ");
-  return [line2(columns.map((c4) => c4.toUpperCase())), ...data.map(line2)].join("\n");
+  return [line2(columns.map((c5) => c5.toUpperCase())), ...data.map(line2)].join("\n");
 }
 function listWithCursor(page, columns) {
   const body = table(page.items, columns);
@@ -36754,15 +36922,15 @@ function registerAgent(program2, rt) {
   agent.command("update <agent>").description("Edit an agent's name, description or capability ceiling (requires agent:manage). You can only add capabilities you hold; removing one narrows its running sessions at once").option("--name <name>", "new name").option("--description <text>", "new description").option("--capability <cap>", "replace the ceiling with these, repeatable or comma-separated", list).option("--add-capability <cap>", "add to the ceiling, repeatable or comma-separated", list).option("--remove-capability <cap>", "remove from the ceiling, repeatable or comma-separated", list).action(
     act(rt, async (ctx, o, [id2]) => {
       if (o.capability && (o.addCapability || o.removeCapability)) throw usage("pass --capability (replace) or --add-capability/--remove-capability, not both");
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       let capabilities = o.capability;
       if (o.addCapability || o.removeCapability) {
-        const current = (await c4.agents.get(id2)).capabilities;
+        const current = (await c5.agents.get(id2)).capabilities;
         const remove = new Set(o.removeCapability ?? []);
         capabilities = [.../* @__PURE__ */ new Set([...current, ...o.addCapability ?? []])].filter((x) => !remove.has(x));
       }
       if (o.name === void 0 && o.description === void 0 && capabilities === void 0) throw usage("nothing to update: pass --name, --description or a capability option");
-      const a = await c4.agents.update(id2, { name: o.name, description: o.description, capabilities });
+      const a = await c5.agents.update(id2, { name: o.name, description: o.description, capabilities });
       ctx.result(a, (v) => kv(v, ["id", "name", "integration_type", "state", "capabilities", "repository_ids"]));
     })
   );
@@ -36959,17 +37127,17 @@ function registerActivity(program2, rt) {
     })
   );
 }
-var renderCheckpoint = (c4) => kv(c4, ["id", "session_id", "repository_id", "workspace_id", "source_oid", "manifest_digest", "predecessor_checkpoint_id", "export_state", "created_at"]) + `
+var renderCheckpoint = (c5) => kv(c5, ["id", "session_id", "repository_id", "workspace_id", "source_oid", "manifest_digest", "predecessor_checkpoint_id", "export_state", "created_at"]) + `
 
-intent: ${c4.manifest.intent}`;
+intent: ${c5.manifest.intent}`;
 function registerCheckpoint(program2, rt) {
   const ckp = program2.command("checkpoint").description("Checkpoints and handoff (PRD \xA79.3)");
   ckp.command("create").description("Record a checkpoint from a manifest (validated locally against the protocol schema)").requiredOption("--manifest <file>", "manifest JSON file, @file, or - for stdin").option("--session <id>", "session (default: manifest.session_id, then the current session)").action(
     act(rt, async (ctx, o) => {
       const manifest = await readJsonObject(fileSpec(o.manifest), ctx.input, "--manifest");
       const session = await ctx.sessionId(o.session ?? (typeof manifest.session_id === "string" ? manifest.session_id : void 0));
-      const c4 = await ctx.client("agent").checkpoints.create(session, { manifest });
-      ctx.result(c4, renderCheckpoint);
+      const c5 = await ctx.client("agent").checkpoints.create(session, { manifest });
+      ctx.result(c5, renderCheckpoint);
     })
   );
   ckp.command("list").description("List checkpoints of a session").option("--session <id>", "session (default: current)").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
@@ -37732,7 +37900,7 @@ function isReference(v) {
 }
 function entropy(s) {
   const counts2 = /* @__PURE__ */ new Map();
-  for (const c4 of s) counts2.set(c4, (counts2.get(c4) ?? 0) + 1);
+  for (const c5 of s) counts2.set(c5, (counts2.get(c5) ?? 0) + 1);
   let h = 0;
   for (const n of counts2.values()) {
     const p = n / s.length;
@@ -38086,6 +38254,26 @@ var DISPOSABLE_DOMAINS = new Set(LIST.split(/\s+/).filter(Boolean));
 // packages/domain/src/risk-score.ts
 var NO_VELOCITY = Object.freeze({ sameNetwork24h: 0, sameMailbox: 0, reposFirstDay: 0, invitationsFirstDay: 0, forkChangesFirstDay: 0, starsFirstDay: 0 });
 
+// packages/domain/src/notifications.ts
+var on = (email3, push) => ({ in_app: "on", email: email3, push });
+var DEFAULT_MODES = {
+  review_requested: on("immediate", "on"),
+  review_available: on("off", "off"),
+  response_required: on("off", "on"),
+  check_failed: on("off", "on"),
+  permission_request: on("off", "on"),
+  merge_conflict: on("off", "on"),
+  promotion_blocked: on("off", "on"),
+  session_blocked: on("off", "on"),
+  watching: on("off", "off"),
+  secret_alert: on("immediate", "on"),
+  mentioned: on("immediate", "on"),
+  assigned: on("immediate", "on"),
+  comment: on("off", "off"),
+  approved: on("off", "on"),
+  merged: on("off", "off")
+};
+
 // packages/cli/src/capture/normalize.ts
 import { realpathSync } from "node:fs";
 import { basename, dirname as dirname10, isAbsolute as isAbsolute4, relative, resolve as resolve3, sep } from "node:path";
@@ -38119,10 +38307,10 @@ function extractDecisions(text2, max = 3) {
   return out;
 }
 function classifyCommand(command2) {
-  const c4 = command2.toLowerCase();
-  if (/\b(vitest|jest|pytest|mocha|rspec|phpunit|ctest|go test|cargo test|mvn test|gradle(w)? test|deno test|bun test|playwright test|(npm|pnpm|yarn)( run)? test(:\w+)?)\b/.test(c4) || /\bnpm t\b/.test(c4)) return "test";
-  if (/\b(eslint|prettier --check|ruff|flake8|clippy|golangci-lint|biome (check|lint)|(npm|pnpm|yarn)( run)? lint)\b/.test(c4)) return "lint";
-  if (/\b(tsc|make|cargo build|go build|webpack|vite build|esbuild|gradle(w)? build|mvn (package|compile)|(npm|pnpm|yarn)( run)? (build|typecheck|check))\b/.test(c4)) return "build";
+  const c5 = command2.toLowerCase();
+  if (/\b(vitest|jest|pytest|mocha|rspec|phpunit|ctest|go test|cargo test|mvn test|gradle(w)? test|deno test|bun test|playwright test|(npm|pnpm|yarn)( run)? test(:\w+)?)\b/.test(c5) || /\bnpm t\b/.test(c5)) return "test";
+  if (/\b(eslint|prettier --check|ruff|flake8|clippy|golangci-lint|biome (check|lint)|(npm|pnpm|yarn)( run)? lint)\b/.test(c5)) return "lint";
+  if (/\b(tsc|make|cargo build|go build|webpack|vite build|esbuild|gradle(w)? build|mvn (package|compile)|(npm|pnpm|yarn)( run)? (build|typecheck|check))\b/.test(c5)) return "build";
   return "other";
 }
 
@@ -38841,19 +39029,19 @@ async function flushSpool(env, baseUrl, client, now = Date.now(), agentFor, opts
           for (const b of batches) await rm4(join11(dir, b), { force: true });
         };
         try {
-          const c4 = link?.client ?? client();
+          const c5 = link?.client ?? client();
           if (!meta3.repo_id) {
             const [org, name] = meta3.repo.split("/");
             meta3.repo_id = (await client().repos.getByName(org, name)).id;
           }
           const key = link ? `${meta3.client_key}@${link.sessionId}`.slice(0, 200) : meta3.client_key;
-          const cap = await c4.captures.upsert(meta3.repo_id, { client_key: key, tool: meta3.tool, model: meta3.model, started_at: meta3.started_at });
+          const cap = await c5.captures.upsert(meta3.repo_id, { client_key: key, tool: meta3.tool, model: meta3.model, started_at: meta3.started_at });
           meta3.capture_id = cap.id;
           await writeMeta(env, id2, meta3);
           for (let i = 0; i < events.length; i += MAX_CAPTURE_EVENTS_PER_BATCH) {
             const batch = events.slice(i, i + MAX_CAPTURE_EVENTS_PER_BATCH);
             const along = i === 0 ? ride : [];
-            const submit = (withSession) => c4.captures.submit(cap.id, batch, withSession.length ? { sessionEvents: withSession.map(toSubmission) } : void 0);
+            const submit = (withSession) => c5.captures.submit(cap.id, batch, withSession.length ? { sessionEvents: withSession.map(toSubmission) } : void 0);
             try {
               let res;
               try {
@@ -39173,7 +39361,7 @@ function sessionLines(s, now, you) {
     ...s.paths.length ? [`  touching: ${pathList(s.paths)}`] : []
   ];
 }
-var claimLine = (c4) => `  ${c4.key}  ${c4.holder.display_name ?? c4.holder.id}${c4.session_id ? ` (${c4.session_id})` : ""}${c4.change ? ` \xB7 change #${c4.change.number}` : ""}${c4.note ? ` \xB7 ${c4.note}` : ""}`;
+var claimLine = (c5) => `  ${c5.key}  ${c5.holder.display_name ?? c5.holder.id}${c5.session_id ? ` (${c5.session_id})` : ""}${c5.change ? ` \xB7 change #${c5.change.number}` : ""}${c5.note ? ` \xB7 ${c5.note}` : ""}`;
 function renderStatus(st, now = Date.now()) {
   const others = st.sessions.filter((s) => s.id !== st.you);
   const out = [others.length ? `${others.length} other agent session${others.length === 1 ? "" : "s"} working in this repository.` : "No other agent sessions are working in this repository."];
@@ -39396,7 +39584,7 @@ function agentUploads(ctx) {
   const t = ctx.token("user").token;
   if (!t || !isPersonToken(t) || !agentSessionsEnabled(ctx.deps.env)) return void 0;
   return async (meta3) => {
-    const tool = Object.entries(AGENT_RUNTIME_CAPTURE_TOOL).find(([, c4]) => c4 === meta3.tool)?.[0];
+    const tool = Object.entries(AGENT_RUNTIME_CAPTURE_TOOL).find(([, c5]) => c5 === meta3.tool)?.[0];
     if (!tool) return null;
     if (!meta3.repo_id) {
       const [org, name] = meta3.repo.split("/");
@@ -39428,8 +39616,8 @@ async function readStdinCapped(deps) {
 function startFlush(deps) {
   if (deps.env.BRNCH_CAPTURE_NO_FLUSH !== "1") deps.spawnBackground(["capture", "flush", "--quiet"]);
 }
-async function runHook(deps, state, tool, eventArg) {
-  state.noUpdateHint = true;
+async function runHook(deps, state2, tool, eventArg) {
+  state2.noUpdateHint = true;
   let out = "";
   try {
     if (eventArg === "git-post-commit") return await postCommit(deps);
@@ -39493,7 +39681,7 @@ async function runHook(deps, state, tool, eventArg) {
     await logError(deps.env, `hook ${tool ?? "?"} ${eventArg ?? "?"}: ${e instanceof Error ? e.message : String(e)}`);
   } finally {
     if (out) deps.stdout.write(out);
-    state.exitCode = EXIT.OK;
+    state2.exitCode = EXIT.OK;
   }
 }
 async function postCommit(deps) {
@@ -39752,8 +39940,8 @@ ${report3.errors.join("\n")}` : ""}`);
   );
   capture.command("show <capture>").description("Show a captured session and its events").option("--limit <n>", "events to show", (v) => parseIntOption(v, "--limit"), 100).action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client("user");
-      const [cap, events] = await Promise.all([c4.captures.get(id2), c4.captures.events(id2, { limit: o.limit })]);
+      const c5 = ctx.client("user");
+      const [cap, events] = await Promise.all([c5.captures.get(id2), c5.captures.events(id2, { limit: o.limit })]);
       ctx.result(
         { capture: cap, events: events.items },
         (v) => `${kv(v.capture, ["id", "tool", "model", "provenance", "captured_by.name", "state", "started_at", "edit_count", "linked_commits"])}
@@ -39783,13 +39971,13 @@ ${table(
   );
   capture.command("policy").description("Show or change the organization's capture policy (changes need org admin)").option("--allow <on|off>", "accept capture uploads at all").option("--prompts <on|off>", "accept prompt text").option("--reasoning <on|off>", "accept reasoning summaries and extracted decisions").option("--retention-days <n>", "keep capture data this many days after its last event", (v) => parseIntOption(v, "--retention-days")).action(
     act(rt, async (ctx, o) => {
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       const patch = {};
       if (o.allow !== void 0) patch.allowed = onOff(o.allow, "--allow");
       if (o.prompts !== void 0) patch.prompts_allowed = onOff(o.prompts, "--prompts");
       if (o.reasoning !== void 0) patch.reasoning_allowed = onOff(o.reasoning, "--reasoning");
       if (o.retentionDays !== void 0) patch.retention_days = o.retentionDays;
-      const p = Object.keys(patch).length ? await c4.captures.policy.update(ctx.org(), patch) : await c4.captures.policy.get(ctx.org());
+      const p = Object.keys(patch).length ? await c5.captures.policy.update(ctx.org(), patch) : await c5.captures.policy.get(ctx.org());
       ctx.result(p, (v) => kv(v, ["org_id", "allowed", "prompts_allowed", "reasoning_allowed", "retention_days", "me.opted_out", "updated_at"]));
     })
   );
@@ -39917,7 +40105,7 @@ async function storeVerified(ctx, cred) {
     expires_at: cred.expires_at,
     agent_sign_in: cred.agent_runtime ?? null,
     ...cred.kind === "oauth" ? { scopes: cred.scopes ?? null } : {},
-    other_accounts: Object.values(others).map((c4) => accountLabel(c4.account))
+    other_accounts: Object.values(others).map((c5) => accountLabel(c5.account))
   };
 }
 async function revokeStored(ctx, cred) {
@@ -40193,12 +40381,12 @@ Warning: ${v.remaining === 0 ? "no unused backup codes left" : `only ${v.remaini
       if (!code) throw usage("pass --code <code>: a current authenticator code or an unused backup code (--code - reads it from stdin)");
       ctx.addSecret(code);
       const r = await ctx.client("user").auth.backupCodes.regenerate({ code });
-      for (const c4 of r.backup_codes) ctx.addSecret(c4);
+      for (const c5 of r.backup_codes) ctx.addSecret(c5);
       ctx.result(
         r,
         (v) => `New backup codes. They are shown only now; each works once, and your previous codes no longer work:
 
-${v.backup_codes.map((c4) => `  ${c4}`).join("\n")}
+${v.backup_codes.map((c5) => `  ${c5}`).join("\n")}
 
 Store them somewhere safe and offline (a password manager or on paper).`
       );
@@ -40916,10 +41104,10 @@ async function localKeyRegistered(w, alias) {
   return keys.some((k) => registered.has(k.fingerprint));
 }
 async function stepSsh(w, signedIn2) {
-  const state = { alias: null, keyRegistered: false };
+  const state2 = { alias: null, keyRegistered: false };
   if (!w.o.ssh) {
     w.record("ssh", "skipped", "--no-ssh");
-    return state;
+    return state2;
   }
   let doc;
   try {
@@ -40929,7 +41117,7 @@ async function stepSsh(w, signedIn2) {
   }
   if (!doc?.enabled || !doc.keys.length) {
     w.record("ssh", "skipped", `SSH is not enabled on ${w.ctx.baseUrl}; HTTPS will be used`);
-    return state;
+    return state2;
   }
   const alias = defaultSshAlias(w.ctx, doc.host);
   const configPath = join18(sshDir(w.ctx), "config");
@@ -40939,14 +41127,14 @@ async function stepSsh(w, signedIn2) {
     const ok = w.ctx.interactive && !w.o.dryRun && await w.confirm(`${configPath} already has a "Host ${alias}" entry. Add the ${BRAND.cli} block anyway (yours stays, but the first match wins)?`, false);
     if (!ok) {
       w.record("ssh", "skipped", `${configPath} already has "Host ${alias}" (left untouched)`);
-      return state;
+      return state2;
     }
   }
   const ready = ours2 && signedIn2 && await localKeyRegistered(w, alias);
   const what = signedIn2 ? "adds a block to ~/.ssh/config, pins the host key, registers a key and tests it" : "adds a block to ~/.ssh/config and pins the host key; keys need sign-in";
   if (!w.apply || !ready && !await w.confirm(`Set up git over SSH for ${alias} (${what})?`)) {
     w.record("ssh", w.o.dryRun || w.pendingConsent ? "planned" : "skipped", `\`${BRAND.cli} ssh setup\` (${alias})`);
-    return state;
+    return state2;
   }
   const args = [
     ...w.ctx.globals.yes ? ["--yes"] : [],
@@ -40958,8 +41146,8 @@ async function stepSsh(w, signedIn2) {
   ];
   const r = await w.run(args);
   if (r.code === 0) {
-    state.alias = alias;
-    state.keyRegistered = signedIn2;
+    state2.alias = alias;
+    state2.keyRegistered = signedIn2;
   }
   const untested = r.code === 0 && signedIn2 ? await unattendedApproval(w.ctx, alias) : null;
   w.record(
@@ -40967,7 +41155,7 @@ async function stepSsh(w, signedIn2) {
     r.code !== 0 ? "failed" : ready ? "already" : "done",
     r.code !== 0 ? `\`${BRAND.cli} ssh setup\` exited ${r.code} (see above; \`${BRAND.cli} ssh test\` explains)` : untested ? `${alias}: key registered, not tested: ${untested} asks to approve each use and nobody is at this terminal (\`${BRAND.cli} ssh test\`)` : signedIn2 ? `${alias}: key registered and verified with ssh -T` : `${alias} configured; sign in, then \`${BRAND.cli} ssh setup\` registers a key`
   );
-  return state;
+  return state2;
 }
 async function stepGit(w) {
   const origin = new URL(w.ctx.baseUrl).origin;
@@ -41025,7 +41213,7 @@ async function stepInstructions(w, root) {
     w.record("instructions", "skipped", "not in a git repository");
     return;
   }
-  const detected = (await detectTools(w.ctx.deps)).map((c4) => Object.entries(AGENT_RUNTIME_CAPTURE_TOOL).find(([, x]) => x === c4)?.[0] ?? null);
+  const detected = (await detectTools(w.ctx.deps)).map((c5) => Object.entries(AGENT_RUNTIME_CAPTURE_TOOL).find(([, x]) => x === c5)?.[0] ?? null);
   const tools = [...new Set([w.ctx.agent?.tool ?? null, ...detected].filter((t) => !!t))];
   if (!tools.length) {
     w.record("instructions", "skipped", "no coding agent found");
@@ -41129,8 +41317,8 @@ async function stepRepo(w, me, ns, ssh) {
       if (!files) await w.ctx.deps.writeFile(join18(dir, "README.md"), `# ${name}
 `);
       await git(w, dir, ["add", "-A"]);
-      const c4 = await git(w, dir, ["commit", "-q", "-m", "Initial commit"]);
-      if (c4.code !== 0) throw new Error(`initial commit failed (is git user.name/user.email configured?): ${c4.stderr.trim().slice(0, 200)}`);
+      const c5 = await git(w, dir, ["commit", "-q", "-m", "Initial commit"]);
+      if (c5.code !== 0) throw new Error(`initial commit failed (is git user.name/user.email configured?): ${c5.stderr.trim().slice(0, 200)}`);
     }
     await initialPush(w, repo, remote);
     w.record("repo", "done", `created ${ns}/${name}, remote ${remote} \u2192 ${url2}, pushed ${repo.default_branch}`);
@@ -41148,20 +41336,20 @@ function registerSetup(program2, rt) {
       rt.state.noUpdateHint = true;
       const bad = [...o.skip ?? [], ...o.only ?? []].filter((s) => !SETUP_STEPS.includes(s));
       if (bad.length) throw usage(`unknown step(s) ${bad.join(", ")}; steps: ${SETUP_STEPS.join(", ")}`);
-      const on = (s) => (!o.only?.length || o.only.includes(s)) && !o.skip?.includes(s);
+      const on2 = (s) => (!o.only?.length || o.only.includes(s)) && !o.skip?.includes(s);
       const w = new Wizard(ctx, rt, o);
       if (!ctx.json) ctx.info(`${BRAND.cli} setup for ${ctx.baseUrl}${o.dryRun ? " (dry run: nothing will change)" : !w.apply ? " (non-interactive: showing the plan; pass --yes to apply)" : ""}`);
-      const me = on("signin") ? await stepSignin(w) : await w.me();
+      const me = on2("signin") ? await stepSignin(w) : await w.me();
       const signedIn2 = !!me?.user;
-      const ssh = on("ssh") ? await stepSsh(w, signedIn2) : { alias: null, keyRegistered: false };
+      const ssh = on2("ssh") ? await stepSsh(w, signedIn2) : { alias: null, keyRegistered: false };
       if (o.hooksScope !== "user" && o.hooksScope !== "project") throw usage("--hooks-scope must be user or project");
-      const ns = on("integrations") || on("repo") ? signedIn2 ? await pickNamespace(w, me) : null : null;
-      if (on("repo") && o.hooksScope === "project") await stepRepo(w, me, ns, ssh);
-      if (on("hooks")) await stepHooks(w, await gitToplevel(w.ctx.deps, w.ctx.deps.cwd));
-      if (on("instructions")) await stepInstructions(w, await gitToplevel(w.ctx.deps, w.ctx.deps.cwd));
-      if (on("integrations")) await stepIntegrations(w, ns);
-      if (on("repo") && o.hooksScope !== "project") await stepRepo(w, me, ns, ssh);
-      if (on("git")) await stepGit(w);
+      const ns = on2("integrations") || on2("repo") ? signedIn2 ? await pickNamespace(w, me) : null : null;
+      if (on2("repo") && o.hooksScope === "project") await stepRepo(w, me, ns, ssh);
+      if (on2("hooks")) await stepHooks(w, await gitToplevel(w.ctx.deps, w.ctx.deps.cwd));
+      if (on2("instructions")) await stepInstructions(w, await gitToplevel(w.ctx.deps, w.ctx.deps.cwd));
+      if (on2("integrations")) await stepIntegrations(w, ns);
+      if (on2("repo") && o.hooksScope !== "project") await stepRepo(w, me, ns, ssh);
+      if (on2("git")) await stepGit(w);
       const failed = w.outcomes.some((x) => x.status === "failed");
       const planned = w.outcomes.some((x) => x.status === "planned");
       ctx.result(
@@ -41395,7 +41583,7 @@ function colorEnabled(deps, stream) {
   if (env.TERM === "dumb") return false;
   return stream === "stdout" ? deps.stdoutIsTTY : deps.stderrIsTTY;
 }
-var sgr = (on, code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s;
+var sgr = (on2, code) => (s) => on2 ? `\x1B[${code}m${s}\x1B[0m` : s;
 function paint(enabled) {
   return { ok: sgr(enabled, "32"), warn: sgr(enabled, "33"), fail: sgr(enabled, "31"), dim: sgr(enabled, "2"), bold: sgr(enabled, "1"), accent: sgr(enabled, "38;5;104") };
 }
@@ -41571,12 +41759,12 @@ function cells() {
   const grid = [];
   for (let r = 0; r < ROWS; r++) {
     const row = [];
-    for (let c4 = 0; c4 < COLS; c4++) {
+    for (let c5 = 0; c5 < COLS; c5++) {
       const times = [];
       let head = 0;
       for (let sy = 0; sy < SS; sy++)
         for (let sx = 0; sx < SS; sx++) {
-          const x = VIEW.x0 + (c4 + (sx + 0.5) / SS) / COLS * (VIEW.x1 - VIEW.x0);
+          const x = VIEW.x0 + (c5 + (sx + 0.5) / SS) / COLS * (VIEW.x1 - VIEW.x0);
           const y = VIEW.y0 + (r + (sy + 0.5) / SS) / ROWS * (VIEW.y1 - VIEW.y0);
           if (!insideMark(g2, x, y)) continue;
           times.push(drawTime(g2, x, y));
@@ -42342,7 +42530,7 @@ var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? `${t.claim.actor.type}
 ${t.description}` : "") + (t.acceptance_criteria.length ? `
 
 Acceptance criteria:
-${t.acceptance_criteria.map((c4) => `  - ${c4}`).join("\n")}` : "");
+${t.acceptance_criteria.map((c5) => `  - ${c5}`).join("\n")}` : "");
 async function bodyFrom(ctx, o, required2 = true) {
   if (o.body !== void 0 && o.file !== void 0) throw usage("pass either --body or --file, not both");
   if (o.file !== void 0) return readText(fileSpec(o.file), ctx.input);
@@ -42368,9 +42556,9 @@ function registerTask(program2, rt) {
   task.command("view <task>").description("Show a task").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().tasks.get(id2), renderTask)));
   task.command("update <task>").description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client();
-      const version4 = o.expectedVersion ?? (await c4.tasks.get(id2)).version;
-      const t = await c4.tasks.update(id2, {
+      const c5 = ctx.client();
+      const version4 = o.expectedVersion ?? (await c5.tasks.get(id2)).version;
+      const t = await c5.tasks.update(id2, {
         title: o.title,
         description: await bodyFrom(ctx, o, false),
         state: o.state,
@@ -42411,7 +42599,7 @@ ${table(u.by_feature, ["feature", "calls", "input_tokens", "output_tokens"])}`;
 var citation = (r) => `${r.path}${r.start_line ? `:${r.start_line}${r.end_line && r.end_line !== r.start_line ? `-${r.end_line}` : ""}` : ""}`;
 var renderCited = (label2, a) => [
   label2,
-  a.claims.length ? a.claims.map((c4) => `  - ${c4.text} (${c4.refs.map(citation).join(", ")})`).join("\n") : "  (no verifiable statements)",
+  a.claims.length ? a.claims.map((c5) => `  - ${c5.text} (${c5.refs.map(citation).join(", ")})`).join("\n") : "  (no verifiable statements)",
   a.follow_ups.length ? `follow-up questions:
 ${a.follow_ups.map((f) => `  ? ${f}`).join("\n")}` : "",
   a.dropped.claims ? `${a.dropped.claims} unverifiable statement(s) discarded` : ""
@@ -42481,7 +42669,7 @@ function registerAi(program2, rt) {
       const x = await ctx.client().ai.explainChange(await ctx.changeId(id2));
       const ref = (r) => `${r.path}${r.start_line ? `:${r.start_line}${r.end_line && r.end_line !== r.start_line ? `-${r.end_line}` : ""}` : ""}`;
       const claims = (title, items) => items.length ? `${title}
-${items.map((c4) => `  - ${c4.severity ? `[${c4.severity}] ` : ""}${c4.text} (${c4.refs.map(ref).join(", ")})`).join("\n")}` : "";
+${items.map((c5) => `  - ${c5.severity ? `[${c5.severity}] ` : ""}${c5.text} (${c5.refs.map(ref).join(", ")})`).join("\n")}` : "";
       ctx.result(
         x,
         (v) => [aiLabel(v.ai), claims("Overview", v.overview), claims("Files", v.files.map((f) => ({ text: `${f.path}: ${f.summary}`, refs: [] }))), claims("Risks", v.risks), claims("Notable", v.notable), v.dropped.claims ? `${v.dropped.claims} unverifiable claim(s) discarded` : ""].filter(Boolean).join("\n\n")
@@ -42549,8 +42737,8 @@ ${v.description}`);
 }
 
 // packages/cli/src/commands/change.ts
-var renderChange = (c4) => kv(
-  { ...c4, source: c4.source.workspace_id ?? c4.source.ref, author: `${c4.author.type} ${c4.author.id}`, revision: `#${c4.current_revision.number} ${c4.current_revision.id}` },
+var renderChange = (c5) => kv(
+  { ...c5, source: c5.source.workspace_id ?? c5.source.ref, author: `${c5.author.type} ${c5.author.id}`, revision: `#${c5.current_revision.number} ${c5.current_revision.id}` },
   ["number", "id", "title", "state", "target_ref", "source", "task_id", "author", "revision", "current_revision.head_oid", "revision_count", "merged", "version"]
 );
 var renderReadiness = (r) => [
@@ -42565,13 +42753,13 @@ Checks:
 ${table(r.checks, ["name", "status", "satisfied", "evidence_id"])}` : ""
 ].filter(Boolean).join("\n");
 var renderThread = (t) => `${t.id} [${t.state}${t.blocking ? ", blocking" : ""}${t.anchor.outdated ? ", outdated" : ""}] ${t.anchor.path ?? "(change)"}${t.anchor.start_line ? `:${t.anchor.start_line}` : ""}
-` + t.comments.map((c4) => `  ${c4.author.display_name ?? c4.author.id}: ${c4.body.split("\n").join("\n    ")}`).join("\n");
+` + t.comments.map((c5) => `  ${c5.author.display_name ?? c5.author.id}: ${c5.body.split("\n").join("\n    ")}`).join("\n");
 function registerChange(program2, rt) {
   const change = program2.command("change").description("Changes (proposed updates to a protected ref)");
   change.command("create").description("Create a change from a workspace or a ref in --repo").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or -").option("--workspace <id>", "source workspace").option("--ref <ref>", "source ref (e.g. refs/heads/feature)").option("--target <ref>", "target ref (default: the repository's default branch)").option("--task <id>", "linked task").option("--draft", "create as draft").action(
     act(rt, async (ctx, o) => {
       if (!!o.workspace === !!o.ref) throw usage("pass exactly one of --workspace <id> or --ref <ref>");
-      const c4 = await ctx.client().changes.create(await ctx.repoId(), {
+      const c5 = await ctx.client().changes.create(await ctx.repoId(), {
         title: o.title,
         description: await bodyFrom(ctx, o, false),
         source: o.workspace ? { workspace_id: o.workspace } : { ref: o.ref },
@@ -42579,7 +42767,7 @@ function registerChange(program2, rt) {
         task_id: o.task,
         draft: o.draft ?? false
       });
-      ctx.result(c4, renderChange);
+      ctx.result(c5, renderChange);
     })
   );
   change.command("list").description("List changes in --repo").option("--state <state>", "draft | open | merged | closed").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
@@ -42608,26 +42796,26 @@ function registerChange(program2, rt) {
   );
   change.command("diff").argument("<change>", CHANGE_ARG).description("Changed files, or the diff of one file with --path").option("--revision <id>", "revision (default: current)").option("--against <base|revision-id>", "compare against the base (default) or another revision").option("--path <path>", "show the hunks for this file").action(
     act(rt, async (ctx, o, [spec]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
       if (o.path) {
-        const d = await c4.changes.diff(id2, { revision: o.revision, against: o.against, path: o.path });
+        const d = await c5.changes.diff(id2, { revision: o.revision, against: o.against, path: o.path });
         return ctx.result(d, (v) => unifiedDiff(v));
       }
-      const files = await c4.changes.files(id2, { revision: o.revision, against: o.against });
+      const files = await c5.changes.files(id2, { revision: o.revision, against: o.against });
       ctx.result(files, (v) => table(v.files.map((f) => ({ ...f, path: f.new_path ?? f.old_path })), ["status", "path"]) + (v.truncated ? "\n(truncated)" : ""));
     })
   );
   change.command("depend").argument("<change>", CHANGE_ARG).argument("[predecessor]", `the change it depends on: ${CHANGE_ARG}`).description("Make <change> depend on [predecessor]; without it, list dependencies").option("--remove <dependency-id>", "remove a dependency instead").action(
     act(rt, async (ctx, o, [spec, predecessor]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
       if (o.remove) {
-        await c4.changes.dependencies.remove(id2, o.remove);
+        await c5.changes.dependencies.remove(id2, o.remove);
         return ctx.result({ change_id: id2, removed: o.remove }, `Removed dependency ${o.remove}`);
       }
-      if (predecessor) return ctx.result(await c4.changes.dependencies.add(id2, { predecessor_change_id: await ctx.changeId(predecessor) }), (v) => kv(v, ["id", "predecessor_change_id", "successor_change_id", "predecessor_state"]));
-      const page = await c4.changes.dependencies.list(id2);
+      if (predecessor) return ctx.result(await c5.changes.dependencies.add(id2, { predecessor_change_id: await ctx.changeId(predecessor) }), (v) => kv(v, ["id", "predecessor_change_id", "successor_change_id", "predecessor_state"]));
+      const page = await c5.changes.dependencies.list(id2);
       ctx.result(page, (v) => listWithCursor(v, ["id", "predecessor_change_id", "predecessor_state", "accessible"]));
     })
   );
@@ -42642,10 +42830,10 @@ function registerReview(program2, rt) {
   );
   review.command("comment").argument("<change>", CHANGE_ARG).description("Open a review thread, optionally anchored to a file and line range").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").option("--revision <id>", "revision (default: current)").option("--path <path>", "anchor file").option("--line <n>", "anchor start line", (v) => parseIntOption(v, "--line")).option("--end-line <n>", "anchor end line", (v) => parseIntOption(v, "--end-line")).option("--side <side>", "old | new", "new").option("--non-blocking", "do not block merge on this thread").action(
     act(rt, async (ctx, o, [spec]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
-      const revision = o.revision ?? (await c4.changes.get(id2)).current_revision.id;
-      const t = await c4.threads.create(id2, {
+      const revision = o.revision ?? (await c5.changes.get(id2)).current_revision.id;
+      const t = await c5.threads.create(id2, {
         revision_id: revision,
         body: await bodyFrom(ctx, o),
         path: o.path,
@@ -42660,19 +42848,19 @@ function registerReview(program2, rt) {
   review.command("reply <thread>").description("Reply to a thread").option("--body <text>", "reply (Markdown; @file or - for stdin)").option("--file <path>", "read the reply from a file or -").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().threads.reply(id2, { body: await bodyFrom(ctx, o) }), renderThread)));
   review.command("fix <thread>").description("Link the revision that addresses a thread (state becomes fix_submitted; a reviewer resolves it)").option("--revision <id>", "fixing revision").option("--change <change>", `use this change's current revision (${CHANGE_ARG})`).option("--commit <oid>", "fixing commit").option("--note <text>", "note").action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       if (!o.revision && !o.change) throw usage("pass --revision <id> or --change <change>");
-      const revision = o.revision ?? (await c4.changes.get(await ctx.changeId(o.change))).current_revision.id;
-      ctx.result(await c4.threads.fix(id2, { revision_id: revision, commit_oid: o.commit, note: o.note }), renderThread);
+      const revision = o.revision ?? (await c5.changes.get(await ctx.changeId(o.change))).current_revision.id;
+      ctx.result(await c5.threads.fix(id2, { revision_id: revision, commit_oid: o.commit, note: o.note }), renderThread);
     })
   );
   review.command("resolve <thread>").description("Resolve a thread (requires review:resolve)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().threads.resolve(id2), renderThread)));
   const decide = (name, decision, description, bodyRequired) => review.command(name).argument("<change>", CHANGE_ARG).description(description).option("--body <text>", "review body (Markdown; @file or - for stdin)").option("--file <path>", "read the body from a file or -").option("--revision <id>", "revision being reviewed (default: current)").action(
     act(rt, async (ctx, o, [spec]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
-      const revision = o.revision ?? (await c4.changes.get(id2)).current_revision.id;
-      const r = await c4.reviews.create(id2, { revision_id: revision, decision, body: await bodyFrom(ctx, o, bodyRequired) });
+      const revision = o.revision ?? (await c5.changes.get(id2)).current_revision.id;
+      const r = await c5.reviews.create(id2, { revision_id: revision, decision, body: await bodyFrom(ctx, o, bodyRequired) });
       ctx.result(r, (v) => kv({ ...v, reviewer: `${v.reviewer.type} ${v.reviewer.id}` }, ["id", "decision", "revision_id", "reviewer", "current"]));
     })
   );
@@ -42681,18 +42869,18 @@ function registerReview(program2, rt) {
 }
 
 // packages/cli/src/commands/code-review.ts
-async function allThreads(c4, change) {
+async function allThreads(c5, change) {
   const out = [];
   let cursor2;
   do {
-    const page = await c4.threads.list(change, { limit: 100, cursor: cursor2 });
+    const page = await c5.threads.list(change, { limit: 100, cursor: cursor2 });
     out.push(...page.items);
     cursor2 = page.next_cursor ?? void 0;
   } while (cursor2);
   return out;
 }
-async function findings(c4, change, all) {
-  const [ch, list2, threads] = await Promise.all([c4.changes.get(change), c4.codeReview.reviews.list(change), allThreads(c4, change)]);
+async function findings(c5, change, all) {
+  const [ch, list2, threads] = await Promise.all([c5.changes.get(change), c5.codeReview.reviews.list(change), allThreads(c5, change)]);
   const rev = ch.current_revision.id;
   const latest = /* @__PURE__ */ new Map();
   for (const r of list2.items) if (r.revision_id === rev && !latest.has(r.provider)) latest.set(r.provider, r);
@@ -42719,11 +42907,11 @@ ${f.findings.map(renderThread).join("\n\n")}` : f.pending ? "" : "\n\nNo open fi
   return head + body;
 }
 async function waitDone(ctx, change, interval, timeout) {
-  const c4 = ctx.client();
+  const c5 = ctx.client();
   const deadline = Date.now() + timeout * 1e3;
   let said = "";
   for (; ; ) {
-    const f = await findings(c4, change, false);
+    const f = await findings(c5, change, false);
     const now = f.reviews.map((r) => `${CODE_REVIEW_PROVIDER_NAMES[r.provider]}: ${r.status}`).join(", ");
     if (now && now !== said) ctx.info(now);
     said = now;
@@ -42747,13 +42935,13 @@ function registerCodeReview(program2, rt) {
   );
   cr.command("request").argument("<change>", CHANGE_ARG).description("Review the current revision again (spends the organization's vendor credits; needs repository write)").option("--provider <provider>", `${CODE_REVIEW_PROVIDERS.join(" | ")} (default: every service set up for the repository)`).action(
     act(rt, async (ctx, o, [spec]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
       if (o.provider && !CODE_REVIEW_PROVIDERS.includes(o.provider)) throw usage(`--provider must be one of ${CODE_REVIEW_PROVIDERS.join(", ")}`);
-      const providers = o.provider ? [o.provider] : (await c4.codeReview.reviews.list(id2)).providers;
+      const providers = o.provider ? [o.provider] : (await c5.codeReview.reviews.list(id2)).providers;
       if (!providers.length) throw usage("no AI review service is set up for this repository");
       const items = [];
-      for (const provider of providers) items.push(await c4.codeReview.reviews.request(id2, { provider }));
+      for (const provider of providers) items.push(await c5.codeReview.reviews.request(id2, { provider }));
       ctx.result({ items }, (v) => `${table(v.items.map((r) => ({ service: CODE_REVIEW_PROVIDER_NAMES[r.provider], id: r.id, status: r.status })), ["service", "id", "status"])}
 
 Wait for the findings: code-review wait ${spec}`);
@@ -42769,12 +42957,12 @@ function registerEvidence(program2, rt) {
   const ev = program2.command("evidence").description("Verification evidence");
   ev.command("submit").description("Submit a check result. Origin and independence are assigned by the server from your identity").option("--payload <json>", "base SubmitEvidenceRequest JSON, @file, or -; flags override its fields").option("--check <name>", "check name").option("--result <result>", "queued | running | passed | failed | cancelled | errored | skipped | inconclusive").option("--subject <oid>", "commit the result is about").option("--change <change>", `use this change's current head as subject (and its repository): ${CHANGE_ARG}`).option("--subject-kind <kind>", "head | candidate").option("--promotion <id>", "promotion the candidate belongs to").option("--summary <text>", "summary").option("--command <cmd>", "command that was run").option("--exit-code <n>", "exit code", (v) => parseIntOption(v, "--exit-code")).option("--job-url <url>", "link to the job").option("--external-key <key>", "dedupe key from your system").option("--attach <file>", "upload a file as an attachment (repeatable)", repeat).option("--attachment-id <id>", "existing attachment id (repeatable)", list).action(
     act(rt, async (ctx, o) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const base2 = o.payload ? await readJsonObject(o.payload, ctx.input, "--payload") : {};
       let repo;
       let subject = o.subject;
       if (o.change) {
-        const ch = await c4.changes.get(await ctx.changeId(o.change));
+        const ch = await c5.changes.get(await ctx.changeId(o.change));
         repo = ch.repository_id;
         subject ??= ch.current_revision.head_oid;
       } else {
@@ -42789,7 +42977,7 @@ function registerEvidence(program2, rt) {
         } catch {
           throw new CliError(`cannot read attachment ${file2}`, EXIT.USAGE, "USAGE");
         }
-        const att = await c4.evidence.attachments.upload(repo, data, CONTENT_TYPES[extname(file2).toLowerCase()] ?? "application/octet-stream");
+        const att = await c5.evidence.attachments.upload(repo, data, CONTENT_TYPES[extname(file2).toLowerCase()] ?? "application/octet-stream");
         ctx.info(`uploaded ${basename3(file2)} as ${att.id}`);
         attachmentIds.push(att.id);
       }
@@ -42810,7 +42998,7 @@ function registerEvidence(program2, rt) {
         attachment_ids: attachmentIds
       };
       if (!body.check_name || !body.result || !body.subject_oid) throw usage("--check, --result and --subject (or --change) are required (directly or via --payload)");
-      ctx.result(await c4.evidence.submit(repo, body), renderEvidence);
+      ctx.result(await c5.evidence.submit(repo, body), renderEvidence);
     })
   );
   ev.command("list").argument("<change>", CHANGE_ARG).description("Evidence attached to a change").action(
@@ -42833,7 +43021,7 @@ Blockers:
 ${p.blockers.map((b) => `  ${b.code}: ${b.message}`).join("\n")}` : "") + (p.conflicts.length ? `
 
 Conflicts:
-${p.conflicts.map((c4) => `  ${c4.kind}: ${c4.path}`).join("\n")}` : "");
+${p.conflicts.map((c5) => `  ${c5.kind}: ${c5.path}`).join("\n")}` : "");
 function promotionExit(p) {
   switch (p.state) {
     case "completed":
@@ -42852,15 +43040,15 @@ function registerMerge(program2, rt) {
   const merge2 = program2.command("merge").description("Promotion (protected merge) of changes");
   merge2.command("request").argument("<change>", CHANGE_ARG).description("Request promotion. With --wait, exits 0 only when the merge completed (7 blocked/timeout, 5 conflicts)").option("--strategy <strategy>", "merge | squash | rebase").option("--idempotency-key <key>", "reuse to retry the same request safely").option("--wait", "poll until the promotion reaches a terminal state").option("--timeout <seconds>", "give up waiting after this long", (v) => parseIntOption(v, "--timeout"), 1800).option("--interval <seconds>", "poll interval", (v) => parseIntOption(v, "--interval"), 3).action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client();
-      let p = await c4.promotions.create(await ctx.changeId(id2), { strategy: o.strategy }, o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {});
+      const c5 = ctx.client();
+      let p = await c5.promotions.create(await ctx.changeId(id2), { strategy: o.strategy }, o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {});
       if (o.wait) {
         const deadline = Date.now() + o.timeout * 1e3;
         let last = p.state;
         ctx.info(`promotion ${p.id}: ${p.state}`);
         while (!TERMINAL2.has(p.state) && Date.now() < deadline) {
           await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
-          p = await c4.promotions.get(p.id);
+          p = await c5.promotions.get(p.id);
           if (p.state !== last) ctx.info(`promotion ${p.id}: ${last = p.state}`);
         }
         if (!TERMINAL2.has(p.state)) ctx.info(`timed out after ${o.timeout}s; promotion is still ${p.state}`);
@@ -42874,10 +43062,10 @@ function registerMerge(program2, rt) {
   );
   merge2.command("status [promotion]").description("Show a promotion, or all promotions of --change").option("--change <change>", `list promotions of this change: ${CHANGE_ARG}`).action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client();
-      if (id2) return ctx.result(await c4.promotions.get(id2), renderPromotion);
+      const c5 = ctx.client();
+      if (id2) return ctx.result(await c5.promotions.get(id2), renderPromotion);
       if (!o.change) throw usage("pass a promotion id or --change <change>");
-      ctx.result(await c4.promotions.list(await ctx.changeId(o.change)), (v) => table(v.items, ["id", "state", "strategy", "attempts", "created_at"]));
+      ctx.result(await c5.promotions.list(await ctx.changeId(o.change)), (v) => table(v.items, ["id", "state", "strategy", "attempts", "created_at"]));
     })
   );
   for (const action of ["cancel", "retry"]) {
@@ -42893,9 +43081,9 @@ function registerMerge(program2, rt) {
     act(rt, async (ctx, o) => {
       if (o.disable && o.status) throw usage("pass at most one of --disable and --status");
       if (o.strategy && !["merge", "squash", "rebase"].includes(o.strategy)) throw usage("--strategy must be merge, squash or rebase");
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const repo = await ctx.repoId();
-      const g2 = o.status ? await c4.autoMergeGrant.get(repo) : o.disable ? await c4.autoMergeGrant.revoke(repo) : await c4.autoMergeGrant.set(repo, o.strategy ? { strategy: o.strategy } : {});
+      const g2 = o.status ? await c5.autoMergeGrant.get(repo) : o.disable ? await c5.autoMergeGrant.revoke(repo) : await c5.autoMergeGrant.set(repo, o.strategy ? { strategy: o.strategy } : {});
       ctx.result(g2, (v) => kv(v, ["repository_id", "state", "strategy", "updated_at"]));
     })
   );
@@ -42911,44 +43099,44 @@ ${table(a.history.map((h) => ({ ...h, actor: h.actor.display_name ?? h.actor.id
 var renderRequests = (p) => table(p.items.map((r) => ({ ...r, reviewer: `${r.reviewer.type} ${r.reviewer.name ?? r.reviewer.id}` })), ["id", "reviewer", "source", "state", "created_at"]);
 var renderSuggestion = (s) => kv(s, ["id", "state", "path", "start_line", "end_line", "revision_id", "thread_id", "applied.commit_oid"]);
 var renderOwners = (r) => `${r.path}: ${r.owners.length ? r.owners.join(" ") : "(no owners)"}${r.rule ? `  [rule ${r.rule.index + 1}: ${r.rule.pattern}]` : ""}${r.required ? "  (approval required)" : ""}`;
-var renderCoverage = (c4) => [
-  `code owner review ${c4.required ? "required" : "not required"} by policy v${c4.policy_version} (revision ${c4.revision_id})${c4.complete ? "" : " \u2014 path list truncated"}`,
-  table(c4.paths.map((p) => ({ ...p, owners: p.owners.join(" ") || "-", approved_by: p.approved_by.join(" ") || "-" })), ["path", "owners", "satisfied", "approved_by"])
+var renderCoverage = (c5) => [
+  `code owner review ${c5.required ? "required" : "not required"} by policy v${c5.policy_version} (revision ${c5.revision_id})${c5.complete ? "" : " \u2014 path list truncated"}`,
+  table(c5.paths.map((p) => ({ ...p, owners: p.owners.join(" ") || "-", approved_by: p.approved_by.join(" ") || "-" })), ["path", "owners", "satisfied", "approved_by"])
 ].join("\n");
 var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: a.pushed_by.display_name ?? a.pushed_by.id })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
 function registerGovernance(program2, rt) {
-  const change = program2.commands.find((c4) => c4.name() === "change") ?? program2.command("change");
-  change.command("draft").argument("<change>", CHANGE_ARG).description("Convert an open change back to a draft (drafts cannot merge and notify nobody)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.draft(await ctx.changeId(id2)), (c4) => kv(c4, ["id", "number", "title", "state"]))));
+  const change = program2.commands.find((c5) => c5.name() === "change") ?? program2.command("change");
+  change.command("draft").argument("<change>", CHANGE_ARG).description("Convert an open change back to a draft (drafts cannot merge and notify nobody)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.draft(await ctx.changeId(id2)), (c5) => kv(c5, ["id", "number", "title", "state"]))));
   change.command("request-review").argument("<change>", CHANGE_ARG).description("Request review from people (--user id|email|@handle) or teams (--team slug); --remove <request> withdraws one").option("--user <user>", "reviewer (repeatable or comma-separated)", list).option("--team <team>", "team slug (repeatable or comma-separated)", list).option("--remove <request>", "withdraw a review request by id").action(
     act(rt, async (ctx, o, [spec]) => {
       if (o.remove && (o.user || o.team)) throw usage("--remove cannot be combined with --user/--team");
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
       if (o.remove) {
-        await c4.reviewRequests.remove(id2, o.remove);
+        await c5.reviewRequests.remove(id2, o.remove);
       } else if (o.user?.length || o.team?.length) {
-        await c4.reviewRequests.request(id2, { users: o.user ?? [], teams: o.team ?? [] });
+        await c5.reviewRequests.request(id2, { users: o.user ?? [], teams: o.team ?? [] });
       }
-      ctx.result(await c4.reviewRequests.list(id2), renderRequests);
+      ctx.result(await c5.reviewRequests.list(id2), renderRequests);
     })
   );
   change.command("auto-merge").argument("<change>", CHANGE_ARG).description("Merge automatically once ready (--disable to cancel, --status to show); a new revision by someone else cancels it").option("--strategy <strategy>", "merge | squash (default: the policy default)").option("--disable", "cancel auto-merge").option("--status", "show the auto-merge state and history without changing it").action(
     act(rt, async (ctx, o, [spec]) => {
       if (o.disable && o.status) throw usage("pass at most one of --disable and --status");
       if (o.strategy && o.strategy !== "merge" && o.strategy !== "squash") throw usage("--strategy must be merge or squash");
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
-      const r = o.status ? await c4.autoMerge.get(id2) : o.disable ? await c4.autoMerge.disable(id2) : await c4.autoMerge.enable(id2, o.strategy ? { strategy: o.strategy } : {});
+      const r = o.status ? await c5.autoMerge.get(id2) : o.disable ? await c5.autoMerge.disable(id2) : await c5.autoMerge.enable(id2, o.strategy ? { strategy: o.strategy } : {});
       ctx.result(r, renderAutoMerge);
     })
   );
   const suggestion = program2.command("suggestion").description("Suggested changes on review threads");
   suggestion.command("create").argument("<change>", CHANGE_ARG).description("Suggest replacement text for a line range of the current (or --revision) revision").requiredOption("--path <path>", "file path").requiredOption("--line <n>", "first line", (v) => parseIntOption(v, "--line")).option("--end-line <n>", "last line (default: --line)", (v) => parseIntOption(v, "--end-line")).requiredOption("--replacement <text>", "replacement text (@file or - for stdin; empty string deletes the lines)").option("--revision <id>", "revision (default: current)").option("--body <text>", "comment text").option("--blocking", "make the thread blocking").action(
     act(rt, async (ctx, o, [spec]) => {
-      const c4 = ctx.client();
+      const c5 = ctx.client();
       const id2 = await ctx.changeId(spec);
-      const revision = o.revision ?? (await c4.changes.get(id2)).current_revision.id;
-      const s = await c4.suggestions.create(id2, {
+      const revision = o.revision ?? (await c5.changes.get(id2)).current_revision.id;
+      const s = await c5.suggestions.create(id2, {
         revision_id: revision,
         path: o.path,
         start_line: o.line,
@@ -43126,11 +43314,11 @@ function registerSecretScanning(program2, rt) {
   ss.command("history").description("Scan the full history of --repo in the background (repository admins); --wait polls until it finishes").option("--wait", "wait for the scan to finish").option("--interval <seconds>", "poll interval with --wait", (v) => parseIntOption(v, "--interval"), 3).action(
     act(rt, async (ctx, o) => {
       const repo = await ctx.repoId();
-      const c4 = ctx.client("user");
-      let job2 = await c4.secretScanning.scans.start(repo);
+      const c5 = ctx.client("user");
+      let job2 = await c5.secretScanning.scans.start(repo);
       while (o.wait && (job2.state === "queued" || job2.state === "running")) {
         await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
-        job2 = await c4.secretScanning.scans.get(repo, job2.id);
+        job2 = await c5.secretScanning.scans.get(repo, job2.id);
       }
       ctx.result(job2, renderScan);
       if (job2.state === "failed") ctx.setExit(EXIT.UNAVAILABLE);
@@ -43163,7 +43351,7 @@ ${table(v.matches, ["line", "column", "masked"])}` : "\nno matches in the sample
 
 // packages/cli/src/commands/impact.ts
 var renderStatus2 = (s) => kv(s, ["enabled", "check_name", "integration_id", "webhook_id", "connectors", "settings.llm_summary", "settings.post_suggestions", "settings.hot_table_writes_per_second", "enabled_at"]);
-var renderConnector = (c4) => kv(c4, ["id", "kind", "name", "credentials_set", "config", "last_test", "created_at"]);
+var renderConnector = (c5) => kv(c5, ["id", "kind", "name", "credentials_set", "config", "last_test", "created_at"]);
 function registerImpact(program2, rt) {
   const impact = program2.command("impact").description("Production impact analysis of changes (brnch/impact): reports, installation, read-only connectors");
   impact.command("show").argument("<change>", CHANGE_ARG).description("Show the impact report of a change (the full structured report with --json); exits 7 when it failed").action(
@@ -43226,6 +43414,348 @@ ${v.summary}`);
   );
 }
 
+// packages/cli/src/commands/inbox.ts
+var c3 = BRAND.cli;
+var VIEWS = ["unread", "all", "done", "snoozed"];
+var KIND_LABELS = {
+  review_requested: "review requested",
+  review_available: "review ready",
+  response_required: "needs reply",
+  check_failed: "check failed",
+  permission_request: "permission",
+  merge_conflict: "conflict",
+  promotion_blocked: "merge blocked",
+  session_blocked: "agent blocked",
+  watching: "watching",
+  secret_alert: "secret alert",
+  mentioned: "mentioned",
+  assigned: "assigned",
+  comment: "comment",
+  approved: "approved",
+  merged: "merged"
+};
+var kindLabel = (kind) => KIND_LABELS[kind] ?? kind;
+var shortId = (id2) => id2.slice(-6);
+function age(iso, now) {
+  const min = Math.max(0, Math.floor((now - Date.parse(iso)) / 6e4));
+  if (min < 1) return "now";
+  if (min < 60) return `${min}m`;
+  if (min < 24 * 60) return `${Math.floor(min / 60)}h`;
+  if (min < 14 * 24 * 60) return `${Math.floor(min / (24 * 60))}d`;
+  return `${Math.floor(min / (7 * 24 * 60))}w`;
+}
+var clip2 = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
+function state(i, now) {
+  if (i.done) return "done";
+  if (i.snoozed_until && Date.parse(i.snoozed_until) > now) return `snoozed ${new Date(i.snoozed_until).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" })}`;
+  return i.read ? "read" : "unread";
+}
+function renderInbox(page, view, repos, now) {
+  if (!page.items.length) return view === "unread" ? `Nothing unread. (\`${c3} inbox list --view all\` shows read items)` : "(none)";
+  const rows2 = page.items.map((i) => ({
+    id: shortId(i.id),
+    kind: kindLabel(i.kind),
+    repository: repos.get(i.repository_id) ?? i.repository_id,
+    title: clip2(i.excerpt ? `${i.title}: \u201C${i.excerpt}\u201D` : i.title, i.excerpt ? 110 : 72),
+    age: age(i.updated_at, now),
+    n: i.count > 1 ? `\xD7${i.count}` : "",
+    state: state(i, now)
+  }));
+  const body = table(rows2, ["id", "kind", "repository", "title", "age", "n", "state"]);
+  return page.next_cursor ? `${body}
+(more: --cursor ${page.next_cursor})` : body;
+}
+var HOUR_MS = 36e5;
+var UNIT_MS = { m: 6e4, min: 6e4, h: HOUR_MS, d: 24 * HOUR_MS, w: 7 * 24 * HOUR_MS };
+var MORNING = 8;
+function parseWhen(spec, now) {
+  const s = spec.trim().toLowerCase();
+  const at = (d, h, m = 0) => new Date(d.getFullYear(), d.getMonth(), d.getDate(), h, m);
+  const days = (n) => new Date(now.getFullYear(), now.getMonth(), now.getDate() + n);
+  let when = null;
+  const dur = /^(\d{1,4})\s*(m|min|h|d|w)$/.exec(s);
+  const clock = /^([01]?\d|2[0-3]):([0-5]\d)$/.exec(s);
+  const date5 = /^(\d{4})-(\d{2})-(\d{2})$/.exec(s);
+  if (dur) when = new Date(now.getTime() + Number(dur[1]) * UNIT_MS[dur[2]]);
+  else if (s === "tomorrow") when = at(days(1), MORNING);
+  else if (s === "next-week" || s === "next week") when = at(days((8 - now.getDay()) % 7 || 7), MORNING);
+  else if (clock) {
+    when = at(now, Number(clock[1]), Number(clock[2]));
+    if (when <= now) when = at(days(1), Number(clock[1]), Number(clock[2]));
+  } else if (date5) when = new Date(Number(date5[1]), Number(date5[2]) - 1, Number(date5[3]), MORNING);
+  else if (/^\d{4}-\d{2}-\d{2}t/.test(s) && !Number.isNaN(Date.parse(spec))) when = new Date(Date.parse(spec));
+  if (!when || Number.isNaN(when.getTime())) throw usage(`cannot read "${spec}" as a time: use a duration (30m, 2h, 3d, 1w), tomorrow, next-week, HH:MM, a date (2026-10-07) or an ISO time`);
+  if (when <= now) throw usage(`"${spec}" is in the past`);
+  return when;
+}
+var CHANNEL_ALIASES = { in_app: "in_app", "in-app": "in_app", inapp: "in_app", app: "in_app", email: "email", push: "push" };
+function parseChannelModes(pairs) {
+  if (!pairs.length) throw usage(`give at least one <channel>=<mode>, e.g. push=off email=digest (channels: ${NOTIFICATION_CHANNELS.join(", ")})`);
+  const modes = {};
+  for (const p of pairs) {
+    const [k, v, ...rest] = p.split("=");
+    const channel = CHANNEL_ALIASES[(k ?? "").trim().toLowerCase()];
+    if (!channel || !v || rest.length) throw usage(`"${p}" is not <channel>=<mode> (channels: ${NOTIFICATION_CHANNELS.join(", ")})`);
+    modes[channel] = v.trim().toLowerCase();
+  }
+  const parsed = ChannelModesSchema.safeParse(modes);
+  if (!parsed.success) {
+    const bad = parsed.error.issues[0]?.path[0];
+    throw usage(bad === "email" ? "email is off, immediate or digest" : `${String(bad)} is on or off`);
+  }
+  return parsed.data;
+}
+function parseReason(spec) {
+  if (spec === "all") return "all";
+  const r = NotificationReasonSchema.safeParse(spec.replace(/-/g, "_"));
+  if (!r.success) throw usage(`unknown reason "${spec}"; one of: all, ${NOTIFICATION_REASONS.join(", ")}`);
+  return r.data;
+}
+function parseQuietHours(spec) {
+  if (spec === "off") return null;
+  const m = /^(\d{1,2}:\d{2})\s*[-–]\s*(\d{1,2}:\d{2})$/.exec(spec.trim());
+  const pad = (t) => t.padStart(5, "0");
+  if (!m || ![m[1], m[2]].every((t) => /^([01]\d|2[0-3]):[0-5]\d$/.test(pad(t)))) throw usage(`quiet hours are HH:MM-HH:MM (24-hour, e.g. 22:00-07:00) or off`);
+  return { start: pad(m[1]), end: pad(m[2]) };
+}
+function checkTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en", { timeZone: tz });
+    return tz;
+  } catch {
+    throw usage(`unknown time zone "${tz}" (an IANA name such as Europe/Paris)`);
+  }
+}
+function renderSettings2(s, orgNames2 = /* @__PURE__ */ new Map(), org) {
+  const overrides = org ? s.orgs[org.id] ?? {} : {};
+  const matrix2 = table(
+    NOTIFICATION_REASONS.filter((r) => s.reasons[r]).map((r) => {
+      const m = { ...s.reasons[r], ...overrides[r] };
+      return { reason: r, in_app: m.in_app, email: m.email, push: m.push, ...org ? { override: overrides[r] ? "yes" : "" } : {} };
+    }),
+    ["reason", "in_app", "email", "push", ...org ? ["override"] : []]
+  );
+  const hh = (h) => `${String(h).padStart(2, "0")}:00`;
+  const digest = s.digest.frequency === "off" ? "off" : `${s.digest.frequency} at ${hh(s.digest.hour)}${s.digest.frequency === "weekly" ? " on Mondays" : ""} (${s.digest.time_zone})`;
+  const others = Object.entries(s.orgs).flatMap(
+    ([id2, reasons]) => Object.entries(reasons).map(([r, m]) => `  ${orgNames2.get(id2) ?? id2} ${r}: ${Object.entries(m ?? {}).map(([ch, v]) => `${ch}=${v}`).join(" ")}`)
+  );
+  const lines = [
+    ...org ? [`In ${org.slug}:`] : [],
+    matrix2,
+    "",
+    kv(
+      {
+        digest,
+        quiet_hours: s.quiet_hours ? `${s.quiet_hours.start}-${s.quiet_hours.end} (${s.digest.time_zone}): push waits until they end` : "off",
+        push_previews: s.push_previews ? "on" : "off (push shows the kind, not the title)",
+        email: s.email_deliverable ? "deliverable" : "no verified, deliverable address: nothing is emailed",
+        push_devices: `${s.push_devices} (\`${c3} notifications devices\`)`,
+        muted: s.muted.length ? `${s.muted.join(", ")} (\`${c3} notifications unmute <key>\`)` : "none"
+      },
+      ["digest", "quiet_hours", "push_previews", "email", "push_devices", "muted"]
+    )
+  ];
+  if (!org && others.length) lines.push("", "Organization overrides:", ...others);
+  return lines.join("\n");
+}
+var renderDevices = (v) => v.items.length ? table(
+  v.items.map((d) => ({ id: d.id, name: d.name ?? "-", environment: d.environment, app_version: d.app_version ?? "-", last_seen: d.last_seen_at, current: d.current ? "yes" : "" })),
+  ["id", "name", "environment", "app_version", "last_seen", "current"]
+) : "No push devices. The iOS app registers itself when you allow notifications.";
+var PAGE2 = 100;
+var MAX_PAGES2 = 10;
+async function findItems(client, specs) {
+  const wanted = specs.map((s) => s.trim().toLowerCase());
+  for (const s of wanted) if (s.length < 4) throw usage(`"${s}" is too short to name an inbox item: use the id \`${c3} inbox list\` shows`);
+  const found = new Map(wanted.map((s) => [s, []]));
+  const seen = /* @__PURE__ */ new Set();
+  for (const view of ["all", "snoozed", "done"]) {
+    let cursor2;
+    for (let i = 0; i < MAX_PAGES2; i++) {
+      const page = await client.inbox.list({ view, limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
+      for (const item of page.items) {
+        if (seen.has(item.id)) continue;
+        seen.add(item.id);
+        for (const s of wanted) if (item.id === s || item.id.endsWith(s)) found.get(s).push(item);
+      }
+      if (!page.next_cursor) break;
+      cursor2 = page.next_cursor;
+    }
+    if (wanted.every((s) => found.get(s).length)) break;
+  }
+  return wanted.map((s) => {
+    const hits = found.get(s);
+    const exact = hits.find((h) => h.id === s);
+    if (exact) return exact;
+    if (hits.length > 1) throw usage(`"${s}" matches ${hits.length} inbox items (${hits.map((h) => h.id).join(", ")}); give more of the id`);
+    if (!hits[0]) throw new CliError(`no inbox item "${s}" (muted items are not listed)`, EXIT.NOT_FOUND, "NOT_FOUND");
+    return hits[0];
+  });
+}
+async function itemIds(client, specs) {
+  const full = (s) => /^notif_[0-9a-z]{26}$/.test(s);
+  const short2 = specs.filter((s) => !full(s));
+  const items = short2.length ? await findItems(client, short2) : [];
+  return specs.map((s) => full(s) ? s : items[short2.indexOf(s)].id);
+}
+async function repoNames(client, items) {
+  const ids = [...new Set(items.map((i) => i.repository_id))];
+  const names = await Promise.all(ids.map((id2) => client.repos.get(id2).then((r) => `${r.org_slug}/${r.name}`, () => null)));
+  return new Map(ids.flatMap((id2, k) => names[k] ? [[id2, names[k]]] : []));
+}
+function liveLine(e) {
+  const time3 = new Date(e.at).toLocaleTimeString(void 0, { hour: "2-digit", minute: "2-digit" });
+  return e.type === "item" ? `${time3}  ${shortId(e.item_id)}  ${kindLabel(e.kind)}: ${e.title}  (${e.unread} unread)` : `${time3}  ${e.unread} unread`;
+}
+function registerInbox(program2, rt) {
+  const inbox = program2.command("inbox").description("Your inbox: what needs your attention (people only; agent sessions have no inbox)");
+  inbox.command("list", { isDefault: true }).description("Inbox items, most urgent first. IDS are short ids: pass them to read, done, snooze, mute or open").option("--view <view>", `one of ${VIEWS.join(", ")}`, "unread").option("--limit <n>", "page size (at most 100)", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+    act(rt, async (ctx, o) => {
+      if (!VIEWS.includes(o.view)) throw usage(`--view must be one of ${VIEWS.join(", ")}`);
+      const view = o.view;
+      const client = ctx.client("user");
+      const page = await client.inbox.list({ view, ...o.limit ? { limit: o.limit } : {}, ...o.cursor ? { cursor: o.cursor } : {} });
+      const repos = ctx.json ? /* @__PURE__ */ new Map() : await repoNames(client, page.items);
+      ctx.result(page, (v) => renderInbox(v, view, repos, ctx.deps.sys.now()));
+    })
+  );
+  inbox.command("count").description("Print the number of unread items (for prompts and status lines)").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").inbox.count(), (v) => String(v.unread))));
+  for (const action of ["read", "unread", "done", "undone"]) {
+    const bulk = action !== "undone";
+    const cmd = inbox.command(`${action} [ids...]`).description(`Mark items ${action === "undone" ? "not done (back in the inbox)" : action}${bulk ? `; --all for every item${action === "done" ? " (asks first)" : ""}` : ""}`);
+    if (bulk) cmd.option("--all", "every item in your inbox");
+    cmd.action(
+      act(rt, async (ctx, o, specs) => {
+        const client = ctx.client("user");
+        if (o.all) {
+          if (specs.length) throw usage("give ids or --all, not both");
+          if (action === "done") await ctx.confirm("mark every inbox item done");
+          const r = await client.inbox.bulk({ action, all: true });
+          return ctx.result({ action, ...r }, `${r.changed} marked ${action}`);
+        }
+        if (!specs.length) throw usage(`give the ids of the items to mark ${action} (from \`${c3} inbox list\`)${bulk ? ", or --all" : ""}`);
+        const ids = await itemIds(client, specs);
+        for (const id2 of ids) await client.inbox[action](id2);
+        ctx.result({ action, ids }, `${ids.map(shortId).join(", ")} marked ${action}`);
+      })
+    );
+  }
+  inbox.command("snooze <id> <until>").description("Hide an item until a time: 30m, 2h, 3d, 1w, tomorrow, next-week, 17:30, 2026-10-07 or an ISO time").action(
+    act(rt, async (ctx, _o, [spec, when]) => {
+      const until = parseWhen(when, new Date(ctx.deps.sys.now())).toISOString();
+      const client = ctx.client("user");
+      const [id2] = await itemIds(client, [spec]);
+      await client.inbox.snooze(id2, until);
+      ctx.result({ id: id2, snoozed_until: until }, `${shortId(id2)} snoozed until ${new Date(until).toLocaleString()}`);
+    })
+  );
+  inbox.command("mute <id>").description("Stop notifications about this item's change or agent session, and mark its items done").action(
+    act(rt, async (ctx, _o, [spec]) => {
+      const client = ctx.client("user");
+      const [item] = await findItems(client, [spec]);
+      const target = item.change_id ? { change_id: item.change_id } : item.session_id ? { session_id: item.session_id } : null;
+      if (!target) throw new CliError(`${shortId(item.id)} is not about a change or an agent session, so there is nothing to mute; mark it done instead`, EXIT.VALIDATION, "VALIDATION_FAILED");
+      const settings = await client.inbox.mute(target);
+      ctx.result(settings, `muted ${target.change_id ?? target.session_id} (\`${c3} notifications\` lists mutes)`);
+    })
+  );
+  inbox.command("open <id>").description("Open an item in your browser (prints the link when no browser can be started)").action(
+    act(rt, async (ctx, _o, [spec]) => {
+      const [item] = await findItems(ctx.client("user"), [spec]);
+      const url2 = new URL(item.url, ctx.baseUrl).toString();
+      const opened = ctx.json ? false : await ctx.deps.openUrl(url2);
+      ctx.result({ id: item.id, url: url2, opened }, opened ? `opened ${url2}` : url2);
+    })
+  );
+  inbox.command("watch").description("Print a line for each new item and each change of the unread count until Ctrl-C. With --json, one JSON object per line").action(
+    act(rt, async (ctx) => {
+      const client = ctx.client("user");
+      if (!ctx.json) ctx.info(`watching your inbox: ${(await client.inbox.count()).unread} unread (Ctrl-C to stop)`);
+      for await (const e of client.inbox.watch()) ctx.deps.stdout.write(`${ctx.json ? JSON.stringify(e) : liveLine(e)}
+`);
+    })
+  );
+}
+async function orgNames(client, s) {
+  const ids = Object.keys(s.orgs);
+  const slugs = await Promise.all(ids.map((id2) => client.orgs.get(id2).then((o) => o.slug, () => null)));
+  return new Map(ids.flatMap((id2, k) => slugs[k] ? [[id2, slugs[k]]] : []));
+}
+function registerNotifications(program2, rt) {
+  const n = program2.command("notifications").description("How you are notified: per reason and channel (in_app, email, push), digest, quiet hours, devices");
+  n.command("get", { isDefault: true }).alias("show").description("Your settings: every reason \xD7 channel, digest, quiet hours, push previews, devices and mutes. With --org, what applies in that organization").action(
+    act(rt, async (ctx) => {
+      const client = ctx.client("user");
+      const s = await client.notifications.get();
+      const org = ctx.globals.org ? await client.orgs.get(ctx.globals.org) : void 0;
+      const names = ctx.json || org ? /* @__PURE__ */ new Map() : await orgNames(client, s);
+      ctx.result(s, (v) => renderSettings2(v, names, org));
+    })
+  );
+  n.command("set [reason] [modes...]").description(
+    `Change settings; only what is given changes. <reason> (or all) with channels in_app=on|off, email=off|immediate|digest, push=on|off; with --org, an override in that organization only. Reasons: ${NOTIFICATION_REASONS.join(", ")}`
+  ).option("--reset", "with --org: drop that organization's overrides (your personal choices apply again)").option("--digest <frequency>", "email digest: off, daily or weekly (Mondays)").option("--digest-hour <h>", "hour of the digest, 0-23, in --tz", (v) => parseIntOption(v, "--digest-hour")).option("--tz <zone>", "IANA time zone of the digest and quiet hours, e.g. Europe/Paris").option("--quiet-hours <hours>", "hold push notifications HH:MM-HH:MM (e.g. 22:00-07:00), or off").option("--previews <on|off>", "whether push notifications show titles (on) or only the kind of item (off)").action(
+    act(rt, async (ctx, o, [reason, ...pairs]) => {
+      const orgSpec = ctx.globals.org;
+      if (o.reset && !orgSpec) throw usage("--reset drops an organization's overrides: give --org");
+      if (o.reset && reason) throw usage("give --reset or a reason, not both");
+      if (o.digest !== void 0 && !["off", "daily", "weekly"].includes(o.digest)) throw usage("--digest is off, daily or weekly");
+      if (o.digestHour !== void 0 && (o.digestHour < 0 || o.digestHour > 23)) throw usage("--digest-hour is 0-23");
+      if (o.previews !== void 0 && o.previews !== "on" && o.previews !== "off") throw usage("--previews is on or off");
+      const r = reason ? parseReason(reason) : void 0;
+      const modes = r ? parseChannelModes(pairs) : void 0;
+      const quiet = o.quietHours !== void 0 ? parseQuietHours(o.quietHours) : void 0;
+      const tz = o.tz ? checkTimeZone(o.tz) : void 0;
+      const touchesDigest = o.digest !== void 0 || o.digestHour !== void 0 || tz !== void 0;
+      if (!r && !o.reset && !touchesDigest && quiet === void 0 && o.previews === void 0) {
+        throw usage(`nothing to change: give a reason and channels (e.g. \`${c3} notifications set mentioned push=off\`), --digest, --quiet-hours, --previews, or --org \u2026 --reset`);
+      }
+      const client = ctx.client("user");
+      const org = orgSpec ? await client.orgs.get(orgSpec) : void 0;
+      const patch = {};
+      const byReason = r && modes ? Object.fromEntries((r === "all" ? NOTIFICATION_REASONS : [r]).map((k) => [k, modes])) : void 0;
+      if (org && (byReason || o.reset)) patch.orgs = { [org.id]: o.reset ? {} : byReason };
+      else if (byReason) patch.reasons = byReason;
+      if (touchesDigest) {
+        const current = (await client.notifications.get()).digest;
+        patch.digest = { frequency: o.digest ?? current.frequency, hour: o.digestHour ?? current.hour, time_zone: tz ?? current.time_zone };
+      }
+      if (quiet !== void 0) patch.quiet_hours = quiet;
+      if (o.previews !== void 0) patch.push_previews = o.previews === "on";
+      const s = await client.notifications.update(patch);
+      const names = ctx.json || org ? /* @__PURE__ */ new Map() : await orgNames(client, s);
+      ctx.result(s, (v) => renderSettings2(v, names, org));
+    })
+  );
+  n.command("unmute <key>").description("Notify again about a muted change or agent session (a chg_\u2026 or ses_\u2026 id, or a key `notifications` lists under muted)").action(
+    act(rt, async (ctx, _o, [spec]) => {
+      const key = /^chg_/.test(spec) ? `change:${spec}` : /^ses_/.test(spec) ? `session:${spec}` : spec;
+      const client = ctx.client("user");
+      const { muted } = await client.notifications.get();
+      if (!muted.includes(key)) throw new CliError(`"${key}" is not muted (muted: ${muted.length ? muted.join(", ") : "none"})`, EXIT.NOT_FOUND, "NOT_FOUND");
+      ctx.result(await client.notifications.update({ muted: muted.filter((m) => m !== key) }), (v) => renderSettings2(v));
+    })
+  );
+  const devices = n.command("devices").description("Devices that receive push notifications (the iOS app registers them)");
+  devices.command("list", { isDefault: true }).description("Registered push devices").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").notifications.devices.list(), renderDevices)));
+  devices.command("remove <id>").description("Stop pushing to a device. Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [id2]) => {
+      await ctx.confirm(`stop push notifications to device ${id2}`);
+      await ctx.client("user").notifications.devices.remove(id2);
+      ctx.result({ removed: id2 }, `removed ${id2}`);
+    })
+  );
+  n.command("test-push").description("Send a test push notification to your devices").option("--message <text>", "What the notification says (at most 120 characters)").action(
+    act(rt, async (ctx, o) => {
+      const r = await ctx.client("user").notifications.devices.test(o.message ? { message: o.message } : {});
+      if (r.devices && !r.delivered) ctx.setExit(EXIT.UNAVAILABLE);
+      ctx.result(r, () => r.devices ? `delivered to ${r.delivered} of ${r.devices} device(s)${r.errors.length ? `
+${r.errors.join("\n")}` : ""}` : `No push devices. The iOS app registers itself when you allow notifications.`);
+    })
+  );
+}
+
 // packages/cli/src/commands/integrations.ts
 var where2 = (g2) => g2.repository_name ? `${g2.org_slug}/${g2.repository_name}` : g2.include_repos ? `${g2.org_slug} (and all repositories)` : g2.org_slug;
 var renderGrants = (v) => v.items.length ? table(
@@ -43257,9 +43787,9 @@ function registerIntegrations(program2, rt) {
   );
   integrations.command("shares [credential]").description("Where a credential is shared (owner view), or with no argument what is shared with --org (or --repo with --for-repo)").option("--for-repo", "list what is shared with --repo instead of --org").option("--include-revoked", "include revoked grants").action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client("user").grants;
+      const c5 = ctx.client("user").grants;
       const q = id2 ? subjectOf(id2) : o.forRepo ? { repository: await ctx.repoId(void 0, "user") } : { org: ctx.org() };
-      ctx.result(await c4.list({ ...q, ...o.includeRevoked ? { include_revoked: true } : {} }), renderGrants);
+      ctx.result(await c5.list({ ...q, ...o.includeRevoked ? { include_revoked: true } : {} }), renderGrants);
     })
   );
   integrations.command("accept <grant>").description("Accept a credential a member offered to the organization (org admins)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").grants.accept(id2), (v) => `${v.id}: ${v.state}`)));
@@ -43341,11 +43871,11 @@ function targetOptions(cmd) {
   return cmd.option("--platform <platform>", "workers | pages").option("--connection <connection>", "deploy connection (icn_\u2026)").option("--account-id <id>", "Cloudflare account id").option("--env <name>", "Wrangler environment (deploys with --env)").option("--worker <name>", "Worker name (or Pages project name)").option("--root <dir>", "root directory (where the Wrangler config lives)").option("--branch <name>", "production branch (default: the repository's default branch)").option("--install <cmd>", "install command").option("--build <cmd>", "build command").option("--output-dir <dir>", "Pages: the built site").option("--previews", "upload a preview of every open change").option("--no-previews", "no previews").option("--preview-agent-changes", "also preview changes made by agents or integrations, isolated (Worker Previews only)").option("--no-preview-agent-changes", "previews only for changes people upload").option("--preview-mode <mode>", "versions (preview version with an alias) | worker_previews (`wrangler preview`: Durable Objects allowed, bindings from the `previews` block)").option("--preview-check <name>", "report previews as this check").option("--name <name>", "target name").option("--steps <json>", `pre/post steps as a JSON array, @file or - (replaces the list), e.g. '[{"id":"migrate","kind":"d1_migrations","phase":"pre"}]'`);
 }
 async function planSetup(ctx, repo, o) {
-  const c4 = ctx.client("user").deploy;
+  const c5 = ctx.client("user").deploy;
   const why = [];
   const platform2 = o.platform ?? "workers";
   if (platform2 !== "workers" && platform2 !== "pages") throw usage("--platform must be workers or pages");
-  const conns = (await c4.connections(repo)).items.filter((x) => x.state === "active");
+  const conns = (await c5.connections(repo)).items.filter((x) => x.state === "active");
   let conn;
   if (o.connection) {
     const found = conns.find((x) => x.id === o.connection);
@@ -43361,14 +43891,14 @@ async function planSetup(ctx, repo, o) {
     account = conn.account_id;
     why.push(`account ${conn.account_label ?? account}: the connection's account`);
   } else if (!account) {
-    const accounts = (await c4.resources(repo, conn.id, "accounts")).items;
+    const accounts = (await c5.resources(repo, conn.id, "accounts")).items;
     if (!accounts.length) throw new CliError(`connection ${conn.id} sees no Cloudflare account`, EXIT.NOT_FOUND, "NOT_FOUND");
     const a = await pick3(ctx, "Cloudflare account", "--account-id", accounts, (x) => `${x.id}  ${x.name}`);
     account = a.id;
     why.push(`account ${a.name}${accounts.length === 1 ? ": the only account" : ""}`);
   }
   let suggested = true;
-  const sug = await c4.suggestions(repo).catch((e) => {
+  const sug = await c5.suggestions(repo).catch((e) => {
     if (!o.worker) throw e;
     ctx.info("note: this server suggests no Wrangler configurations; using the flags as given");
     suggested = false;
@@ -43447,8 +43977,8 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
   targetOptions(deploy.command("update <target>").description("Change a deploy target (only the given flags; an empty value clears a command or the environment)")).option("--disable", "stop deploying (merges no longer deploy)").option("--enable", "deploy again").action(
     act(rt, async (ctx, o, [ref]) => {
       if (o.disable && o.enable) throw usage("give either --disable or --enable");
-      const c4 = ctx.client("user").deploy.targets;
-      const cur = await c4.get(await targetId(ctx, ref));
+      const c5 = ctx.client("user").deploy.targets;
+      const cur = await c5.get(await targetId(ctx, ref));
       const patch = {
         name: o.name,
         platform: o.platform,
@@ -43470,7 +44000,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
       };
       const changes = Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== void 0));
       if (!Object.keys(changes).length) throw usage("nothing to change: pass at least one option");
-      ctx.result(await c4.update(cur.id, { ...changes, expected_version: cur.version }), renderTarget);
+      ctx.result(await c5.update(cur.id, { ...changes, expected_version: cur.version }), renderTarget);
     })
   );
   deploy.command("remove <target>").description("Delete a deploy target (its deployments stay listed). Requires --yes when non-interactive").action(
@@ -43559,13 +44089,13 @@ var renderDelegation = (d) => kv(
   },
   ["id", "agent", "status", "origin", "task_id", "change_id", "sponsor", "model", "branch", "automatic", "budget", "updated_at", "version"]
 ) + renderIterations(d);
-async function watchHints(c4, web, d) {
+async function watchHints(c5, web, d) {
   const hints = [];
-  const repo = await c4.repos.get(d.repository_id).catch(() => null);
+  const repo = await c5.repos.get(d.repository_id).catch(() => null);
   if (repo) {
     const base2 = `${web}/${repo.org_slug}/${repo.name}`;
-    const change = d.change_id ? await c4.changes.get(d.change_id).catch(() => null) : null;
-    const task = !change && d.task_id ? await c4.tasks.get(d.task_id).catch(() => null) : null;
+    const change = d.change_id ? await c5.changes.get(d.change_id).catch(() => null) : null;
+    const task = !change && d.task_id ? await c5.tasks.get(d.task_id).catch(() => null) : null;
     if (change) hints.push(`${base2}/changes/${change.number}`);
     else if (task) hints.push(`${base2}/issues/${task.number}`);
     const run3 = d.current_iteration?.run_id;
@@ -43584,7 +44114,7 @@ async function renderStarted2(ctx, d, what) {
   ].join("\n");
 }
 async function waitForIteration(ctx, start, o) {
-  const c4 = ctx.client("user");
+  const c5 = ctx.client("user");
   const target = start.current_iteration?.id ?? null;
   const deadline = Date.now() + (o.timeout ?? start.budget.iteration_minutes * 60 + 300) * 1e3;
   let d = start;
@@ -43597,7 +44127,7 @@ async function waitForIteration(ctx, start, o) {
     if (it ? ITERATION_DONE.has(it.state) : d.state !== "working") return { d, timedOut: false };
     if (Date.now() > deadline) return { d, timedOut: true };
     await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
-    d = await c4.delegations.get(start.id);
+    d = await c5.delegations.get(start.id);
   }
 }
 function waitExit(d, target, timedOut) {
@@ -43614,15 +44144,15 @@ async function finish(ctx, d, o, what) {
   if (r.timedOut) ctx.info(`still working; follow with \`${BRAND.cli} agents status ${d.id}\``);
 }
 async function delegationFor(ctx, spec) {
-  const c4 = ctx.client("user");
-  if (spec.startsWith("dlg_")) return c4.delegations.get(spec);
-  const ref = await resolveWorkRef(spec, c4, () => ctx.repoId(void 0, "user"));
+  const c5 = ctx.client("user");
+  if (spec.startsWith("dlg_")) return c5.delegations.get(spec);
+  const ref = await resolveWorkRef(spec, c5, () => ctx.repoId(void 0, "user"));
   if (ref.kind === "change") {
-    const d2 = await c4.delegations.forChange(ref.id);
+    const d2 = await c5.delegations.forChange(ref.id);
     if (!d2) throw new CliError(`no agent is delegated on change ${spec}`, EXIT.NOT_FOUND, "NOT_FOUND");
     return d2;
   }
-  const { items } = await c4.delegations.forTask(ref.id);
+  const { items } = await c5.delegations.forTask(ref.id);
   const d = items.find((x) => x.state !== "stopped") ?? [...items].sort((a, b) => b.created_at.localeCompare(a.created_at))[0];
   if (!d) throw new CliError(`no agent is delegated on issue ${spec}`, EXIT.NOT_FOUND, "NOT_FOUND");
   return d;
@@ -43639,8 +44169,8 @@ function registerDelegate(program2, rt) {
       const agent = vendorArg(o.agent);
       if (o.prompt !== void 0 && o.promptFile !== void 0) throw usage("pass either --prompt or --prompt-file, not both");
       const prompt2 = o.promptFile !== void 0 ? await readText(fileSpec(o.promptFile), ctx.input) : o.prompt ?? "";
-      const c4 = ctx.client("user");
-      const ref = await resolveWorkRef(target, c4, () => ctx.repoId(void 0, "user"));
+      const c5 = ctx.client("user");
+      const ref = await resolveWorkRef(target, c5, () => ctx.repoId(void 0, "user"));
       const budget = {
         ...o.maxIterations !== void 0 ? { max_iterations: o.maxIterations } : {},
         ...o.maxTokens !== void 0 ? { max_tokens: o.maxTokens } : {},
@@ -43648,7 +44178,7 @@ function registerDelegate(program2, rt) {
       };
       const body = { agent, prompt: prompt2, ...o.model ? { model: o.model } : {}, budget, auto_on_review: !!o.autoReview, auto_on_check_failure: !!o.autoChecks };
       const options = { idempotencyKey: o.idempotencyKey ?? crypto.randomUUID() };
-      const d = ref.kind === "issue" ? await c4.delegations.delegateTask(ref.id, body, options) : await c4.delegations.delegateChange(ref.id, body, options);
+      const d = ref.kind === "issue" ? await c5.delegations.delegateTask(ref.id, body, options) : await c5.delegations.delegateChange(ref.id, body, options);
       await finish(ctx, d, o, `Delegated ${ref.kind} ${target} to`);
     })
   );
@@ -43826,9 +44356,12 @@ function registerCodingAgents(program2, rt) {
 // packages/cli/src/commands/platform.ts
 function registerEvents(program2, rt) {
   const events = program2.command("events").description("Platform and session event streams");
-  events.command("watch").description("Follow live events of --org (or one agent session with --session). With --json, prints one JSON object per line").option("--session <id>", "follow this agent session's activity instead of the org").option("--after <cursor>", "resume after this event id / sequence").option("--max <n>", "stop after this many events", (v) => parseIntOption(v, "--max")).action(
+  events.command("watch").description("Follow new events of --org (or one agent session with --session). With --json, prints one JSON object per line").option("--session <id>", "follow this agent session's activity instead of the org").option("--after <cursor>", "start after this event id / cursor / sequence (replays what came since) instead of now").option("--max <n>", "stop after this many events", (v) => parseIntOption(v, "--max")).action(
     act(rt, async (ctx, o) => {
-      const stream = o.session ? ctx.client("agent").sessions.stream(o.session, { after: o.after }) : ctx.client("user").events.stream(ctx.org(), { after: o.after });
+      const stream = o.session ? ctx.client("agent").sessions.stream(o.session, { after: o.after }) : (
+        // Organization events are polled from the replay (there is no push stream for them); without --after, only new ones.
+        ctx.client("user").events.stream(ctx.org(), o.after ? { after: o.after } : { fromNow: true })
+      );
       let n = 0;
       if (!ctx.json) ctx.info(`watching ${o.session ? `session ${o.session}` : `org ${ctx.org()}`} (Ctrl-C to stop)`);
       for await (const ev of stream) {
@@ -43853,12 +44386,12 @@ function registerPolicy(program2, rt) {
     act(rt, async (ctx, o, [file2]) => {
       const doc = await readJsonObject(fileSpec(file2), ctx.input, "policy file");
       const rules = doc.rules ?? doc;
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       const repo = await ctx.repoId(void 0, "user");
       let expected = o.expectedVersion ?? (typeof doc.expected_version === "number" ? doc.expected_version : void 0);
       if (expected === void 0) {
         try {
-          expected = (await c4.repos.policy.get(repo)).version;
+          expected = (await c5.repos.policy.get(repo)).version;
         } catch (e) {
           if (!isForgeApiError(e) || e.code !== "NOT_FOUND") throw e;
           expected = 0;
@@ -43866,7 +44399,7 @@ function registerPolicy(program2, rt) {
       }
       await ctx.confirm(`adopt a new policy for ${ctx.repoSpec()} (replacing version ${expected})`);
       const note = o.note ?? (typeof doc.note === "string" ? doc.note : void 0);
-      ctx.result(await c4.repos.policy.adopt(repo, { rules, expected_version: expected, note }), renderPolicy);
+      ctx.result(await c5.repos.policy.adopt(repo, { rules, expected_version: expected, note }), renderPolicy);
     })
   );
 }
@@ -43916,15 +44449,15 @@ var renderFork = (r) => kv({ ...r, parent: r.fork?.parent.full_name ?? r.fork?.p
 ]);
 var renderSync = (r) => r.status === "up_to_date" ? `${r.ref} is up to date with ${r.parent.full_name} (${r.new_oid.slice(0, 12)})` : `${r.ref} fast-forwarded ${r.old_oid ? r.old_oid.slice(0, 12) : "(new)"} \u2192 ${r.new_oid.slice(0, 12)} from ${r.parent.full_name}`;
 function registerForks(program2, rt) {
-  const repo = program2.commands.find((c4) => c4.name() === "repo");
+  const repo = program2.commands.find((c5) => c5.name() === "repo");
   if (!repo) throw new Error("internal: repo command must be registered before forks");
   repo.command("fork <namespace>").description("Fork --repo into <namespace> (an organization you can create repositories in)").option("--name <name>", "name of the fork (defaults to the source name)").option("--description <text>", "description (defaults to the source description)").option("--default-branch-only", "copy only the default branch").option("--idempotency-key <key>", "reuse to retry the same request safely").action(
     act(rt, async (ctx, o, [namespace]) => {
       if (!namespace) throw usage("pass the target namespace");
       const source = await ctx.repoId(void 0, "user");
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       ctx.info("forking (this can take a while for large repositories)\u2026");
-      const fork = await c4.forks.create(source, { namespace, name: o.name, description: o.description, default_branch_only: !!o.defaultBranchOnly }, o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {});
+      const fork = await c5.forks.create(source, { namespace, name: o.name, description: o.description, default_branch_only: !!o.defaultBranchOnly }, o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {});
       ctx.result(fork, renderFork);
     })
   );
@@ -43970,7 +44503,7 @@ function render2(v) {
   const checks = p?.readiness.required_checks.length ? `
 
 Required checks:
-${p.readiness.required_checks.map((c4) => `  ${c4.name}: ${c4.status} on ${c4.subject}${c4.covers_merged_tree === void 0 ? "" : c4.covers_merged_tree ? " (covered the merged tree)" : " (did NOT cover the merged tree)"}`).join("\n")}` : "";
+${p.readiness.required_checks.map((c5) => `  ${c5.name}: ${c5.status} on ${c5.subject}${c5.covers_merged_tree === void 0 ? "" : c5.covers_merged_tree ? " (covered the merged tree)" : " (did NOT cover the merged tree)"}`).join("\n")}` : "";
   const evidence = p?.evidence.length ? `
 
 Evidence:
@@ -43987,11 +44520,11 @@ function mergedTreeTested(p) {
   if (t) return `yes: every required check passed on tree ${p.readiness.candidate_tree_oid} (base ${p.readiness.target_oid})`;
   return p.readiness.required_checks.length ? "NO: only the branch head was tested for some required checks; the merged result is untested" : "NO: the policy required no checks";
 }
-async function resolveRepoId(ctx, c4) {
+async function resolveRepoId(ctx, c5) {
   const spec = ctx.repoSpec();
   const slash = spec.indexOf("/");
   if (slash === -1) return spec;
-  return (await c4.repos.getByName(spec.slice(0, slash), spec.slice(slash + 1))).id;
+  return (await c5.repos.getByName(spec.slice(0, slash), spec.slice(slash + 1))).id;
 }
 async function readKeys(ctx, file2) {
   const full = isAbsolute8(file2) ? file2 : resolve8(ctx.deps.cwd, file2);
@@ -44009,7 +44542,7 @@ function registerVerify(program2, rt) {
   program2.command("verify <target>").description("Verify the merge receipt of a commit (or a receipt id rcp_\u2026) offline. Exit 0 verified, 1 invalid, 3 no receipt").option("--keys <file>", "pinned key set (JSON from /.well-known/brnch-keys) instead of fetching it from the server").option("--no-local", "skip the comparison with the local git clone").action(
     act(rt, async (ctx, o, [target]) => {
       if (!target) throw usage("pass a commit or a receipt id");
-      const c4 = ctx.token("user").token ? ctx.client("user") : ctx.client("user", { anonymous: true });
+      const c5 = ctx.token("user").token ? ctx.client("user") : ctx.client("user", { anonymous: true });
       const git3 = (args) => ctx.deps.gitOutput(args, ctx.deps.cwd);
       const inClone = o.local && (await git3(["rev-parse", "--is-inside-work-tree"])).stdout.trim() === "true";
       const out = { verified: false, status: "invalid", target, receipt_id: null, repository: null, ref: null, commit: null, tree: null, key_id: null, key_status: null, digest: null, local: { status: o.local ? "not_a_clone" : "skipped", tree: null }, errors: [], statement: null };
@@ -44017,7 +44550,7 @@ function registerVerify(program2, rt) {
       let expectCommit = null;
       try {
         if (/^rcp_[0-9a-z]+$/.test(target)) {
-          receipt = await c4.receipts.get(target);
+          receipt = await c5.receipts.get(target);
         } else {
           expectCommit = /^[0-9a-f]{40}$/.test(target) ? target : null;
           if (!expectCommit && inClone) {
@@ -44025,7 +44558,7 @@ function registerVerify(program2, rt) {
             if (r.code === 0) expectCommit = r.stdout.trim();
           }
           if (!expectCommit) throw usage("pass a full 40-character commit id or a receipt id (rcp_\u2026); revisions like HEAD resolve only inside a clone");
-          receipt = await c4.receipts.forCommit(await resolveRepoId(ctx, c4), expectCommit);
+          receipt = await c5.receipts.forCommit(await resolveRepoId(ctx, c5), expectCommit);
         }
       } catch (e) {
         if (isForgeApiError(e) && e.code === "NOT_FOUND") {
@@ -44035,7 +44568,7 @@ function registerVerify(program2, rt) {
         }
         throw e;
       }
-      const keys = o.keys ? await readKeys(ctx, o.keys) : (await c4.receipts.keys()).keys;
+      const keys = o.keys ? await readKeys(ctx, o.keys) : (await c5.receipts.keys()).keys;
       if (!keys.length) throw new CliError("the server publishes no signing keys", EXIT.UNAVAILABLE, "NO_KEYS");
       const v = await verifyReceipt(receipt.envelope, keys, { expect: expectCommit ? { commit: expectCommit } : {} });
       const subject = v.statement?.subject?.[0]?.digest;
@@ -44112,7 +44645,7 @@ var REPO_FIELDS = ["id", "org_slug", "name", "description", "visibility", "defau
 var renderRepo2 = (r) => kv(r, REPO_FIELDS) + (r.import ? `
 import    ${r.import.status}${r.import.shallow ? " (shallow)" : ""}` : "");
 function renderLog(p) {
-  const rows2 = p.items.map((c4) => ({ oid: c4.oid.slice(0, 12), date: c4.committer.date.slice(0, 10), author: c4.author.name, subject: c4.message.split("\n", 1)[0] }));
+  const rows2 = p.items.map((c5) => ({ oid: c5.oid.slice(0, 12), date: c5.committer.date.slice(0, 10), author: c5.author.name, subject: c5.message.split("\n", 1)[0] }));
   const lines = [table(rows2, ["oid", "date", "author", "subject"])];
   const s = p.path_scan;
   if (s) lines.push(s.complete ? `scanned ${s.scanned_total} commits: full first-parent history of ${s.path}` : `scanned ${s.scanned_total} commits so far; older history not searched yet (more: --cursor ${p.next_cursor})`);
@@ -44157,7 +44690,7 @@ Yours: ${choices.join(", ")}
 Set it with \`${BRAND.cli} org switch <org>\`.`);
         }
         const n = Number((await ctx.deps.prompt(`? Default organization?
-${choices.map((c4, i) => `  ${i + 1}) ${c4}`).join("\n")}
+${choices.map((c5, i) => `  ${i + 1}) ${c5}`).join("\n")}
   `)).trim());
         if (!Number.isInteger(n) || n < 1 || n > namespaces.length) throw new CliError("aborted", EXIT.USAGE, "ABORTED");
         slug2 = namespaces[n - 1].slug;
@@ -44206,18 +44739,18 @@ function registerRepo(program2, rt) {
   );
   repo.command("list").description("Repositories in --org").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").option("--all", "follow every page").action(
     act(rt, async (ctx, o) => {
-      const c4 = ctx.client("agent");
+      const c5 = ctx.client("agent");
       const orgSlug = ctx.org();
-      const page = o.all ? { items: await collect(paginate((cursor2) => c4.repos.list(orgSlug, { cursor: cursor2, limit: o.limit }))), next_cursor: null } : await c4.repos.list(orgSlug, { limit: o.limit, cursor: o.cursor });
+      const page = o.all ? { items: await collect(paginate((cursor2) => c5.repos.list(orgSlug, { cursor: cursor2, limit: o.limit }))), next_cursor: null } : await c5.repos.list(orgSlug, { limit: o.limit, cursor: o.cursor });
       ctx.result(page, (v) => listWithCursor(v, ["name", "visibility", "lifecycle", "default_branch", "id"]));
     })
   );
   repo.command("migrate <provider> <source>").description("Import GitHub/GitLab issues, pull/merge requests, comments and releases as historical records (provider: github | gitlab; source: owner/repo)").option("--name <name>", "create the repository by importing its default branch").option("--into <repo>", "import metadata into an existing repository (org/name or id), e.g. after git push --mirror").option("--no-pull-requests", "skip pull/merge requests").option("--token-stdin", "read a source read-token from stdin (never pass tokens as arguments)").option("--wait", "poll until the migration finishes; exit 0 only when completed").action(
     act(rt, async (ctx, o, [provider, source]) => {
       if (provider !== "github" && provider !== "gitlab") throw usage("provider must be github or gitlab");
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       const sourceToken = o.tokenStdin ? (await new Response(process.stdin).text()).trim() : void 0;
-      let job2 = await c4.migrations.start(ctx.org(), {
+      let job2 = await c5.migrations.start(ctx.org(), {
         provider,
         source,
         repository_id: o.into ? await ctx.repoId(o.into) : void 0,
@@ -44227,7 +44760,7 @@ function registerRepo(program2, rt) {
       });
       while (o.wait && (job2.state === "queued" || job2.state === "running")) {
         await new Promise((r) => setTimeout(r, 2e3));
-        job2 = await c4.migrations.get(job2.id);
+        job2 = await c5.migrations.get(job2.id);
       }
       const view = { id: job2.id, state: job2.state, issues: job2.report.counts.issues, pull_requests: job2.report.counts.pull_requests, comments: job2.report.counts.comments, releases: job2.report.counts.releases, missing: job2.report.missing.join("; ") || "-" };
       ctx.result(job2, () => kv(view, Object.keys(view)));
@@ -44255,8 +44788,8 @@ function registerRepo(program2, rt) {
   repo.command("clone [repo] [directory]").description("git clone over SSH when this machine is set up for it (`ssh setup`) and the key can be used now, else HTTPS with your login (never written to .git/config)").option("--ssh", "clone over SSH").option("--https", "clone over HTTPS").action(
     act(rt, async (ctx, o, [spec, dir]) => {
       if (o.ssh && o.https) throw usage("--ssh and --https are mutually exclusive");
-      const c4 = ctx.client("agent");
-      const r = await c4.repos.get(await ctx.repoId(spec));
+      const c5 = ctx.client("agent");
+      const r = await c5.repos.get(await ctx.repoId(spec));
       const directory = dir ?? r.name;
       const t = await chooseTransport(ctx, o);
       if (t.transport === "ssh") {
@@ -44342,7 +44875,7 @@ function registerRelease(program2, rt) {
 }
 
 // packages/cli/src/commands/social.ts
-var pageOptions = (c4) => c4.option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor");
+var pageOptions = (c5) => c5.option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor");
 function reader(ctx) {
   return ctx.token("user").token ? ctx.client("user") : ctx.client("user", { anonymous: true });
 }
@@ -44367,7 +44900,7 @@ var renderProfile = (p) => kv({ ...p, orgs: p.orgs.map((o) => o.slug).join(", ")
 var followName = (f) => f.type === "user" ? f.user.handle ?? f.user.id : f.org.slug;
 var renderFollows = (p) => listWithCursor({ ...p, items: p.items.map((f) => ({ type: f.type, name: followName(f), since: f.followed_at })) }, ["type", "name", "since"]);
 var repoColumns = ["org_slug", "name", "stars_count", "visibility", "description"];
-var renderReactions = (s) => REACTION_CONTENTS.filter((c4) => s[c4] > 0).map((c4) => `${c4} ${s[c4]}${s.viewer.includes(c4) ? " (you)" : ""}`).join("  ") || "(no reactions)";
+var renderReactions = (s) => REACTION_CONTENTS.filter((c5) => s[c5] > 0).map((c5) => `${c5} ${s[c5]}${s.viewer.includes(c5) ? " (you)" : ""}`).join("  ") || "(no reactions)";
 function subjectOf2(id2) {
   const prefix = id2.split("_")[0];
   const map2 = { chg: "change", task: "task", cmt: "comment", rel: "release" };
@@ -44425,12 +44958,12 @@ ${table(v.days.filter((d) => d.count > 0), ["date", "count", "pushes", "changes_
     await ctx.client("user").social.unfollow(name);
     ctx.result({ following: null, unfollowed: name, ok: true }, `Unfollowed ${name}`);
   }));
-  const starAction = (on) => act(rt, async (ctx, _o, [repo]) => {
-    const c4 = ctx.client("user");
+  const starAction = (on2) => act(rt, async (ctx, _o, [repo]) => {
+    const c5 = ctx.client("user");
     const id2 = await ctx.repoId(repo, "user");
-    await (on ? c4.social.star(id2) : c4.social.unstar(id2));
-    const r = await c4.repos.get(id2);
-    ctx.result(r, (v) => `${on ? "Starred" : "Unstarred"} ${v.org_slug}/${v.name} (${v.stars_count ?? 0} stars)`);
+    await (on2 ? c5.social.star(id2) : c5.social.unstar(id2));
+    const r = await c5.repos.get(id2);
+    ctx.result(r, (v) => `${on2 ? "Starred" : "Unstarred"} ${v.org_slug}/${v.name} (${v.stars_count ?? 0} stars)`);
   });
   program2.command("star [repo]").description("Star a repository (org/name or id; default --repo)").action(starAction(true));
   program2.command("unstar [repo]").description("Remove your star").action(starAction(false));
@@ -44442,12 +44975,12 @@ ${table(v.days.filter((d) => d.count > 0), ["date", "count", "pushes", "changes_
   );
   program2.command("watch [repo]").description("Set your notification level for a repository").option("--level <level>", SUBSCRIPTION_LEVELS.join(" | "), "watching").option("--reset", "remove your subscription (back to participating)").action(
     act(rt, async (ctx, o, [repo]) => {
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       const id2 = await ctx.repoId(repo, "user");
-      if (o.reset) await c4.social.unsubscribe(id2);
+      if (o.reset) await c5.social.unsubscribe(id2);
       else if (!SUBSCRIPTION_LEVELS.includes(o.level)) throw usage(`--level must be one of ${SUBSCRIPTION_LEVELS.join(", ")}`);
-      else await c4.social.subscribe(id2, o.level);
-      ctx.result(await c4.social.subscription(id2), (v) => `Notification level: ${v.level}${v.explicit ? "" : " (default)"}`);
+      else await c5.social.subscribe(id2, o.level);
+      ctx.result(await c5.social.subscription(id2), (v) => `Notification level: ${v.level}${v.explicit ? "" : " (default)"}`);
     })
   );
   const explore = pageOptions(
@@ -44486,16 +45019,16 @@ ${table(v.days.filter((d) => d.count > 0), ["date", "count", "pushes", "changes_
   );
   label2.command("edit <label>").description("Rename or recolor a label (name or id); uses the current version unless --expected-version pins it").option("--name <name>", "new name").option("--color <hex>", "new color").option("--description <text>", "new description").option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
     act(rt, async (ctx, o, [ref]) => {
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       const repo = await ctx.repoId(void 0, "user");
       let version4 = o.expectedVersion;
       if (version4 === void 0) {
-        const all = await c4.social.labels.list(repo, { limit: 100 });
+        const all = await c5.social.labels.list(repo, { limit: 100 });
         const cur = all.items.find((l2) => l2.id === ref || l2.name.toLowerCase() === ref.toLowerCase());
         if (!cur) throw usage(`no label ${ref} in this repository`);
         version4 = cur.version;
       }
-      const l = await c4.social.labels.update(repo, ref, { name: o.name, color: o.color, description: o.description, version: version4 });
+      const l = await c5.social.labels.update(repo, ref, { name: o.name, color: o.color, description: o.description, version: version4 });
       ctx.result(l, (v) => kv(v, ["id", "name", "color", "description", "version"]));
     })
   );
@@ -44529,8 +45062,8 @@ ${table(v.days.filter((d) => d.count > 0), ["date", "count", "pushes", "changes_
     act(rt, async (ctx, o, [id2, content]) => {
       if (!REACTION_CONTENTS.includes(content)) throw usage(`reaction must be one of: ${REACTION_CONTENTS.join(" ")}`);
       const body = { subject_type: subjectOf2(id2), subject_id: id2, content };
-      const c4 = ctx.client("user").social;
-      ctx.result(await (o.remove ? c4.unreact(body) : c4.react(body)), renderReactions);
+      const c5 = ctx.client("user").social;
+      ctx.result(await (o.remove ? c5.unreact(body) : c5.react(body)), renderReactions);
     })
   );
 }
@@ -44624,7 +45157,7 @@ function registerStack(program2, rt) {
       else if (p.state === "blocked") ctx.setExit(EXIT.NOT_READY);
     })
   );
-  const change = program2.commands.find((c4) => c4.name() === "change") ?? program2.command("change");
+  const change = program2.commands.find((c5) => c5.name() === "change") ?? program2.command("change");
   change.command("range-diff").argument("<change>", CHANGE_ARG).description("Compare two revisions of a change robustly to rebases (like git range-diff)").requiredOption("--from <revision>", "older revision (number or id)").option("--to <revision>", "newer revision (default: current)").option("--creation-factor <percent>", "pairing threshold, as git range-diff", (v) => parseIntOption(v, "--creation-factor")).action(
     act(rt, async (ctx, o, [id2]) => {
       ctx.result(await ctx.client().stacks.rangeDiff(await ctx.changeId(id2), { from: o.from, to: o.to, creation_factor: o.creationFactor }), renderRangeDiff);
@@ -44652,7 +45185,7 @@ next: --cursor ${v.next_cursor}` : "") : listWithCursor(v, ["id"]));
 }
 
 // packages/cli/src/commands/coordination.ts
-var holderOf = (c4) => `${c4.holder.display_name ?? c4.holder.id}${c4.session_id ? ` (${c4.session_id})` : ""}`;
+var holderOf = (c5) => `${c5.holder.display_name ?? c5.holder.id}${c5.session_id ? ` (${c5.session_id})` : ""}`;
 var renderClaim = (r) => [
   `${r.already_held ? "Already yours" : "Claimed"}: ${r.claim.key}${r.claim.change ? ` (change #${r.claim.change.number})` : ""}`,
   ...r.skipped.length ? [`Taken by others: ${r.skipped.join(", ")}`] : [],
@@ -44686,7 +45219,7 @@ function registerCoordination(program2, rt) {
       ctx.result(
         r,
         () => r.items.length ? table(
-          r.items.map((c4) => ({ key: c4.key, status: c4.status, holder: holderOf(c4), change: c4.change ? `#${c4.change.number}` : "", note: c4.note ?? "" })),
+          r.items.map((c5) => ({ key: c5.key, status: c5.status, holder: holderOf(c5), change: c5.change ? `#${c5.change.number}` : "", note: c5.note ?? "" })),
           ["key", "status", "holder", "change", "note"]
         ) : "No claimed keys."
       );
@@ -44698,7 +45231,7 @@ function registerCoordination(program2, rt) {
 var SHELLS2 = ["bash", "zsh", "fish"];
 var HELP = { flags: ["-h", "--help"], description: "display help for command", takesValue: false };
 function completionTree(cmd) {
-  const hidden = (c4) => c4._hidden === true;
+  const hidden = (c5) => c5._hidden === true;
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -44706,7 +45239,7 @@ function completionTree(cmd) {
       ...cmd.options.filter((o) => !o.hidden).map((o) => ({ flags: [o.short, o.long].filter((f) => !!f), description: o.description, takesValue: o.required || o.optional })),
       HELP
     ],
-    subcommands: cmd.commands.filter((c4) => !hidden(c4)).flatMap((c4) => [c4.name(), ...c4.aliases()].map((name) => ({ ...completionTree(c4), name })))
+    subcommands: cmd.commands.filter((c5) => !hidden(c5)).flatMap((c5) => [c5.name(), ...c5.aliases()].map((name) => ({ ...completionTree(c5), name })))
   };
 }
 function rows(root) {
@@ -45207,7 +45740,7 @@ async function runDoctor(ctx) {
   const agentSession = await checkAgentSession(ctx, auth.me).catch((e) => check2("agent_session", "warn", `cannot check the agent session: ${e.message}`));
   const checks = [checkNode(sys.nodeVersion), git3, config2, checkProxy(ctx.deps.env), server.connectivity, server.minVersion, server.clock, auth.check, remote, credentials, ssh, ...agentSession ? [agentSession] : [], update];
   const install2 = detectInstall(sys.scriptPath, sys.platform);
-  return { ok: !checks.some((c4) => c4.status === "fail"), version: BRAND.version, url: ctx.baseUrl, install: { method: install2.method, path: install2.path }, checks };
+  return { ok: !checks.some((c5) => c5.status === "fail"), version: BRAND.version, url: ctx.baseUrl, install: { method: install2.method, path: install2.path }, checks };
 }
 
 // packages/cli/src/commands/tooling.ts
@@ -45284,7 +45817,7 @@ ${manualInstructions(m)}`, EXIT.USAGE, "UPGRADE_UNSUPPORTED", { install_method:
         report3,
         (r) => [
           `${p.bold(`${BRAND.cli} ${r.version}`)} (${r.install.method}) \u2192 ${r.url}`,
-          ...r.checks.map((c4) => `${mark[c4.status]}  ${c4.id.padEnd(14)} ${c4.summary}`),
+          ...r.checks.map((c5) => `${mark[c5.status]}  ${c5.id.padEnd(14)} ${c5.summary}`),
           r.ok ? p.ok("No problems found.") : p.fail("Problems found: see FAIL lines above.")
         ].join("\n")
       );
@@ -45391,19 +45924,19 @@ function parseCron(source) {
   const [mi, h, d, mo, w] = fields.map((x, i) => parseField(x, FIELDS[i]));
   return { source, minutes: mi, hours: h, days: d, months: mo, weekdays: w, daysRestricted: fields[2] !== "*", weekdaysRestricted: fields[4] !== "*" };
 }
-function minIntervalMinutes(c4) {
-  const m = c4.minutes;
+function minIntervalMinutes(c5) {
+  const m = c5.minutes;
   let gap = 60;
   for (let i = 1; i < m.length; i++) gap = Math.min(gap, m[i] - m[i - 1]);
-  const consecutiveHours = c4.hours.some((h) => c4.hours.includes((h + 1) % 24));
+  const consecutiveHours = c5.hours.some((h) => c5.hours.includes((h + 1) % 24));
   if (consecutiveHours) gap = Math.min(gap, 60 - m[m.length - 1] + m[0]);
   return gap;
 }
 function validateCron(source) {
-  const c4 = parseCron(source);
-  const gap = minIntervalMinutes(c4);
+  const c5 = parseCron(source);
+  const gap = minIntervalMinutes(c5);
   if (gap < LIMITS.minCronIntervalMinutes) throw new CronError(`schedule "${source}" fires every ${gap} minute(s); the minimum interval is ${LIMITS.minCronIntervalMinutes} minutes`);
-  return c4;
+  return c5;
 }
 
 // packages/workflows/src/expressions.ts
@@ -45421,12 +45954,12 @@ function tokenize(src) {
   const out = [];
   let i = 0;
   while (i < src.length) {
-    const c4 = src[i];
-    if (c4 === " " || c4 === "	" || c4 === "\n" || c4 === "\r") {
+    const c5 = src[i];
+    if (c5 === " " || c5 === "	" || c5 === "\n" || c5 === "\r") {
       i++;
       continue;
     }
-    if (c4 === "'") {
+    if (c5 === "'") {
       let s = "";
       const at = i;
       i++;
@@ -45447,8 +45980,8 @@ function tokenize(src) {
       out.push({ t: "str", v: s, at });
       continue;
     }
-    if (c4 === '"') throw new ExpressionError("string literals use single quotes", i);
-    if (/[0-9]/.test(c4) || c4 === "-" && /[0-9.]/.test(src[i + 1] ?? "") && !isOperandEnd(out) || c4 === "." && /[0-9]/.test(src[i + 1] ?? "")) {
+    if (c5 === '"') throw new ExpressionError("string literals use single quotes", i);
+    if (/[0-9]/.test(c5) || c5 === "-" && /[0-9.]/.test(src[i + 1] ?? "") && !isOperandEnd(out) || c5 === "." && /[0-9]/.test(src[i + 1] ?? "")) {
       const m = /^-?(0x[0-9a-fA-F]+|(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?)/.exec(src.slice(i));
       if (!m) throw new ExpressionError("invalid number", i);
       const v = Number(m[0]);
@@ -45457,7 +45990,7 @@ function tokenize(src) {
       i += m[0].length;
       continue;
     }
-    if (/[A-Za-z_]/.test(c4)) {
+    if (/[A-Za-z_]/.test(c5)) {
       const m = /^[A-Za-z_][A-Za-z0-9_-]*/.exec(src.slice(i));
       out.push({ t: "ident", v: m[0], at: i });
       i += m[0].length;
@@ -45469,12 +46002,12 @@ function tokenize(src) {
       i += 2;
       continue;
     }
-    if ("!<>.[](),*".includes(c4)) {
-      out.push({ t: "op", v: c4, at: i });
+    if ("!<>.[](),*".includes(c5)) {
+      out.push({ t: "op", v: c5, at: i });
       i++;
       continue;
     }
-    throw new ExpressionError(`unexpected character '${c4}'`, i);
+    throw new ExpressionError(`unexpected character '${c5}'`, i);
   }
   out.push({ t: "end", at: src.length });
   return out;
@@ -45741,8 +46274,8 @@ function bounded(s) {
 function formatString(fmt, args) {
   let out = "";
   for (let i = 0; i < fmt.length; i++) {
-    const c4 = fmt[i];
-    if (c4 === "{") {
+    const c5 = fmt[i];
+    if (c5 === "{") {
       if (fmt[i + 1] === "{") {
         out += "{";
         i++;
@@ -45754,11 +46287,11 @@ function formatString(fmt, args) {
       if (idx >= args.length) throw new ExpressionError(`format(): placeholder {${idx}} has no argument`);
       out += toStr(args[idx]);
       i += m[0].length - 1;
-    } else if (c4 === "}") {
+    } else if (c5 === "}") {
       if (fmt[i + 1] !== "}") throw new ExpressionError(`format(): unescaped '}' in '${fmt}'`);
       out += "}";
       i++;
-    } else out += c4;
+    } else out += c5;
     bounded(out);
   }
   return out;
@@ -45781,9 +46314,9 @@ function evaluateNode(node2, ctx, opts = {}) {
       case "lit":
         return n.v;
       case "ctx": {
-        const c4 = ctx[n.name];
-        if (c4 === void 0 && n.name === "brnch") return ctx.github ?? null;
-        return c4 ?? null;
+        const c5 = ctx[n.name];
+        if (c5 === void 0 && n.name === "brnch") return ctx.github ?? null;
+        return c5 ?? null;
       }
       case "member":
         return getProp(ev(n.obj), n.prop);
@@ -45880,14 +46413,14 @@ function splitTemplate(s) {
     let inStr = false;
     let close = -1;
     while (j < s.length) {
-      const c4 = s[j];
+      const c5 = s[j];
       if (inStr) {
-        if (c4 === "'") {
+        if (c5 === "'") {
           if (s[j + 1] === "'") j++;
           else inStr = false;
         }
-      } else if (c4 === "'") inStr = true;
-      else if (c4 === "}" && s[j + 1] === "}") {
+      } else if (c5 === "'") inStr = true;
+      else if (c5 === "}" && s[j + 1] === "}") {
         close = j;
         break;
       }
@@ -45960,8 +46493,8 @@ function expandMatrix(spec) {
   }
   base2 = base2.filter((combo) => !spec.exclude.some((ex) => Object.entries(ex).every(([k, v]) => deepEqual(combo[k], v))));
   const dimensionKeys = new Set(spec.dimensions.map(([k]) => k));
-  const originals = base2.map((c4) => ({ ...c4 }));
-  const result = base2.map((c4) => ({ ...c4 }));
+  const originals = base2.map((c5) => ({ ...c5 }));
+  const result = base2.map((c5) => ({ ...c5 }));
   const extra = [];
   for (const inc of spec.include) {
     let matched = false;
@@ -45982,24 +46515,24 @@ function expandMatrix(spec) {
 function patternToRegExp(pattern) {
   let re = "^";
   for (let i = 0; i < pattern.length; i++) {
-    const c4 = pattern[i];
-    if (c4 === "\\" && i + 1 < pattern.length) {
+    const c5 = pattern[i];
+    if (c5 === "\\" && i + 1 < pattern.length) {
       re += pattern[++i].replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
-    } else if (c4 === "*") {
+    } else if (c5 === "*") {
       if (pattern[i + 1] === "*") {
         re += ".*";
         i++;
       } else re += "[^/]*";
-    } else if (c4 === "?" || c4 === "+") {
-      re += i === 0 ? `\\${c4}` : c4;
-    } else if (c4 === "[") {
+    } else if (c5 === "?" || c5 === "+") {
+      re += i === 0 ? `\\${c5}` : c5;
+    } else if (c5 === "[") {
       const end2 = pattern.indexOf("]", i + 1);
       if (end2 < 0) re += "\\[";
       else {
         re += `[${pattern.slice(i + 1, end2).replace(/\\/g, "\\\\")}]`;
         i = end2;
       }
-    } else re += c4.replace(/[.^${}()|\]/]/g, "\\$&");
+    } else re += c5.replace(/[.^${}()|\]/]/g, "\\$&");
   }
   return new RegExp(`${re}$`);
 }
@@ -46055,98 +46588,98 @@ var Ctx = class {
 function join22(path3, key) {
   return path3 ? `${path3}.${key}` : key;
 }
-function entries(c4, node2, path3, what = "a mapping") {
+function entries(c5, node2, path3, what = "a mapping") {
   if (!(0, import_yaml.isMap)(node2)) {
-    c4.err(node2, path3, `${path3 || "document"} must be ${what}`);
+    c5.err(node2, path3, `${path3 || "document"} must be ${what}`);
     return null;
   }
   const out = [];
   for (const pair of node2.items) {
     const k = pair.key;
     if (!(0, import_yaml.isScalar)(k) || typeof k.value === "object") {
-      c4.err(k, path3, "keys must be plain strings");
+      c5.err(k, path3, "keys must be plain strings");
       continue;
     }
     const key = String(k.value);
     if (key === "<<") {
-      c4.err(k, path3, "YAML merge keys (<<) are not supported");
+      c5.err(k, path3, "YAML merge keys (<<) are not supported");
       continue;
     }
     out.push({ key, keyNode: k, value: pair.value ?? null, path: join22(path3, key) });
   }
   return out;
 }
-function scalar(c4, node2, path3) {
+function scalar(c5, node2, path3) {
   if (node2 === null) return null;
   if (!(0, import_yaml.isScalar)(node2)) {
-    c4.err(node2, path3, `${path3} must be a single value`);
+    c5.err(node2, path3, `${path3} must be a single value`);
     return void 0;
   }
   const v = node2.value;
   if (v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean") return v;
-  c4.err(node2, path3, `${path3} has an unsupported value type`);
+  c5.err(node2, path3, `${path3} has an unsupported value type`);
   return void 0;
 }
-function str4(c4, node2, path3, opts = {}) {
-  const v = scalar(c4, node2, path3);
+function str4(c5, node2, path3, opts = {}) {
+  const v = scalar(c5, node2, path3);
   if (v === void 0) return null;
   if (v === null || v === "" && !opts.allowEmpty) {
-    c4.err(node2, path3, `${path3} must not be empty`);
+    c5.err(node2, path3, `${path3} must not be empty`);
     return null;
   }
   const s = String(v);
   if (s.length > (opts.max ?? 64 * 1024)) {
-    c4.err(node2, path3, `${path3} is longer than ${opts.max ?? 64 * 1024} characters`);
+    c5.err(node2, path3, `${path3} is longer than ${opts.max ?? 64 * 1024} characters`);
     return null;
   }
   return s;
 }
-function bool(c4, node2, path3) {
-  const v = scalar(c4, node2, path3);
+function bool(c5, node2, path3) {
+  const v = scalar(c5, node2, path3);
   if (typeof v === "boolean") return v;
-  if (v !== void 0) c4.err(node2, path3, `${path3} must be true or false`);
+  if (v !== void 0) c5.err(node2, path3, `${path3} must be true or false`);
   return null;
 }
-function boolOrExpr(c4, node2, path3, allowed) {
-  const v = scalar(c4, node2, path3);
+function boolOrExpr(c5, node2, path3, allowed) {
+  const v = scalar(c5, node2, path3);
   if (typeof v === "boolean") return v;
   if (typeof v === "string" && hasExpressions(v)) {
-    checkExpressions(c4, v, node2, path3, allowed);
+    checkExpressions(c5, v, node2, path3, allowed);
     return v;
   }
-  if (v !== void 0) c4.err(node2, path3, `${path3} must be true, false or a \${{ }} expression`);
+  if (v !== void 0) c5.err(node2, path3, `${path3} must be true, false or a \${{ }} expression`);
   return false;
 }
-function int2(c4, node2, path3, min, max) {
-  const v = scalar(c4, node2, path3);
+function int2(c5, node2, path3, min, max) {
+  const v = scalar(c5, node2, path3);
   if (typeof v === "number" && Number.isInteger(v) && v >= min && v <= max) return v;
-  if (v !== void 0) c4.err(node2, path3, `${path3} must be an integer between ${min} and ${max}`);
+  if (v !== void 0) c5.err(node2, path3, `${path3} must be an integer between ${min} and ${max}`);
   return null;
 }
-function strList(c4, node2, path3) {
+function strList(c5, node2, path3) {
   if ((0, import_yaml.isScalar)(node2)) {
-    const s = str4(c4, node2, path3);
+    const s = str4(c5, node2, path3);
     return s === null ? null : [s];
   }
   if (!(0, import_yaml.isSeq)(node2)) {
-    c4.err(node2, path3, `${path3} must be a list of strings`);
+    c5.err(node2, path3, `${path3} must be a list of strings`);
     return null;
   }
   const out = [];
   node2.items.forEach((item, i) => {
-    const s = str4(c4, item, `${path3}[${i}]`);
+    const s = str4(c5, item, `${path3}[${i}]`);
     if (s !== null) out.push(s);
   });
   return out;
 }
-function checkExpressions(c4, text2, node2, path3, allowed, wholeIsExpression = false) {
+function checkExpressions(c5, text2, node2, path3, allowed, wholeIsExpression = false) {
   const exprs = [];
   if (wholeIsExpression) exprs.push({ expr: conditionExpression(text2), offset: 0 });
   else {
     try {
       for (const p of splitTemplate(text2)) if (p.kind === "expr") exprs.push({ expr: p.expr, offset: p.offset });
     } catch (e) {
-      c4.err(node2, path3, `${path3}: ${e.message}`, locate2(node2, text2, e.offset ?? 0));
+      c5.err(node2, path3, `${path3}: ${e.message}`, locate2(node2, text2, e.offset ?? 0));
       return;
     }
   }
@@ -46154,11 +46687,11 @@ function checkExpressions(c4, text2, node2, path3, allowed, wholeIsExpression =
     try {
       const refs = references(parseExpression(expr));
       for (const ctx of refs.contexts) {
-        if (!allowed.has(ctx)) c4.err(node2, path3, `${path3}: context "${ctx}" is not available here (available: ${[...allowed].join(", ")})`, locate2(node2, text2, offset));
+        if (!allowed.has(ctx)) c5.err(node2, path3, `${path3}: context "${ctx}" is not available here (available: ${[...allowed].join(", ")})`, locate2(node2, text2, offset));
       }
-      if (refs.functions.has("hashfiles") && SERVER_FIELDS.has(allowed)) c4.err(node2, path3, `${path3}: hashFiles() is only available in steps`, locate2(node2, text2, offset));
+      if (refs.functions.has("hashfiles") && SERVER_FIELDS.has(allowed)) c5.err(node2, path3, `${path3}: hashFiles() is only available in steps`, locate2(node2, text2, offset));
     } catch (e) {
-      c4.err(node2, path3, `${path3}: invalid expression: ${e.message}`, locate2(node2, text2, offset));
+      c5.err(node2, path3, `${path3}: invalid expression: ${e.message}`, locate2(node2, text2, offset));
     }
   }
 }
@@ -46169,90 +46702,90 @@ function locate2(node2, text2, valueOffset) {
   const quoted = node2.type === "QUOTE_DOUBLE" || node2.type === "QUOTE_SINGLE" ? 1 : 0;
   return node2.type === "BLOCK_LITERAL" || node2.type === "BLOCK_FOLDED" ? 0 : valueOffset + quoted;
 }
-function envMap(c4, node2, path3, allowed) {
+function envMap(c5, node2, path3, allowed) {
   const out = {};
-  const es = entries(c4, node2, path3);
+  const es = entries(c5, node2, path3);
   if (!es) return out;
-  if (es.length > LIMITS.maxEnvEntries) c4.err(node2, path3, `${path3} has more than ${LIMITS.maxEnvEntries} entries`);
+  if (es.length > LIMITS.maxEnvEntries) c5.err(node2, path3, `${path3} has more than ${LIMITS.maxEnvEntries} entries`);
   for (const e of es) {
     if (!ENV_NAME_RE.test(e.key)) {
-      c4.err(e.keyNode, e.path, `invalid environment variable name "${e.key}"`);
+      c5.err(e.keyNode, e.path, `invalid environment variable name "${e.key}"`);
       continue;
     }
-    const v = scalar(c4, e.value, e.path);
+    const v = scalar(c5, e.value, e.path);
     if (v === void 0) continue;
     const s = v === null ? "" : String(v);
-    checkExpressions(c4, s, e.value, e.path, allowed);
+    checkExpressions(c5, s, e.value, e.path, allowed);
     out[e.key] = s;
   }
   return out;
 }
-function defaults(c4, node2, path3) {
+function defaults(c5, node2, path3) {
   const d = { shell: null, working_directory: null };
-  for (const e of entries(c4, node2, path3) ?? []) {
+  for (const e of entries(c5, node2, path3) ?? []) {
     if (e.key !== "run") {
-      c4.err(e.keyNode, e.path, `unsupported key "${e.key}" in defaults (only defaults.run is supported)`);
+      c5.err(e.keyNode, e.path, `unsupported key "${e.key}" in defaults (only defaults.run is supported)`);
       continue;
     }
-    for (const r of entries(c4, e.value, e.path) ?? []) {
-      if (r.key === "shell") d.shell = shell(c4, r.value, r.path);
-      else if (r.key === "working-directory") d.working_directory = str4(c4, r.value, r.path, { max: 1024 });
-      else c4.err(r.keyNode, r.path, `unsupported key "${r.key}" in defaults.run (supported: shell, working-directory)`);
+    for (const r of entries(c5, e.value, e.path) ?? []) {
+      if (r.key === "shell") d.shell = shell(c5, r.value, r.path);
+      else if (r.key === "working-directory") d.working_directory = str4(c5, r.value, r.path, { max: 1024 });
+      else c5.err(r.keyNode, r.path, `unsupported key "${r.key}" in defaults.run (supported: shell, working-directory)`);
     }
   }
   return d;
 }
-function shell(c4, node2, path3) {
-  const s = str4(c4, node2, path3);
+function shell(c5, node2, path3) {
+  const s = str4(c5, node2, path3);
   if (s === "bash" || s === "sh") return s;
-  if (s !== null) c4.err(node2, path3, `shell "${s}" is not supported (supported: bash, sh)`);
+  if (s !== null) c5.err(node2, path3, `shell "${s}" is not supported (supported: bash, sh)`);
   return null;
 }
-function filterPair(c4, cfg, include, exclude) {
+function filterPair(c5, cfg, include, exclude) {
   const inc = cfg.get(include);
   const exc = cfg.get(exclude);
-  if (inc && exc) c4.err(exc.keyNode, exc.path, `${include} and ${exclude} cannot be used together`);
-  return [inc ? strList(c4, inc.value, inc.path) : null, exc ? strList(c4, exc.value, exc.path) : null];
+  if (inc && exc) c5.err(exc.keyNode, exc.path, `${include} and ${exclude} cannot be used together`);
+  return [inc ? strList(c5, inc.value, inc.path) : null, exc ? strList(c5, exc.value, exc.path) : null];
 }
-function triggers(c4, node2) {
+function triggers(c5, node2) {
   const t = { push: null, change: null, workflow_dispatch: null, schedule: [] };
   let events = [];
   if ((0, import_yaml.isScalar)(node2) || (0, import_yaml.isSeq)(node2)) {
-    const names = strList(c4, node2, "on") ?? [];
+    const names = strList(c5, node2, "on") ?? [];
     events = names.map((n) => ({ key: n, keyNode: node2, value: null, path: `on.${n}` }));
-  } else events = entries(c4, node2, "on", "an event name, a list of event names, or a mapping") ?? [];
-  if (!events.length) c4.err(node2, "on", "on must declare at least one event");
+  } else events = entries(c5, node2, "on", "an event name, a list of event names, or a mapping") ?? [];
+  if (!events.length) c5.err(node2, "on", "on must declare at least one event");
   for (const ev of events) {
-    const cfgEntries = ev.value === null || ev.key === "schedule" ? [] : entries(c4, ev.value, ev.path) ?? [];
+    const cfgEntries = ev.value === null || ev.key === "schedule" ? [] : entries(c5, ev.value, ev.path) ?? [];
     const cfg = new Map(cfgEntries.map((e) => [e.key, e]));
     const allowOnly = (keys) => {
-      for (const e of cfgEntries) if (!keys.includes(e.key)) c4.err(e.keyNode, e.path, `unsupported key "${e.key}" in on.${ev.key} (supported: ${keys.join(", ") || "none"})`);
+      for (const e of cfgEntries) if (!keys.includes(e.key)) c5.err(e.keyNode, e.path, `unsupported key "${e.key}" in on.${ev.key} (supported: ${keys.join(", ") || "none"})`);
     };
     switch (ev.key) {
       case "push": {
         allowOnly(["branches", "branches-ignore", "tags", "tags-ignore", "paths", "paths-ignore"]);
-        const [branches, branches_ignore] = filterPair(c4, cfg, "branches", "branches-ignore");
-        const [tags, tags_ignore] = filterPair(c4, cfg, "tags", "tags-ignore");
-        const [paths, paths_ignore] = filterPair(c4, cfg, "paths", "paths-ignore");
+        const [branches, branches_ignore] = filterPair(c5, cfg, "branches", "branches-ignore");
+        const [tags, tags_ignore] = filterPair(c5, cfg, "tags", "tags-ignore");
+        const [paths, paths_ignore] = filterPair(c5, cfg, "paths", "paths-ignore");
         t.push = { branches, branches_ignore, tags, tags_ignore, paths, paths_ignore };
         break;
       }
       case "change":
       case "pull_request": {
-        if (t.change) c4.err(ev.keyNode, ev.path, "declare either on.change or on.pull_request, not both");
+        if (t.change) c5.err(ev.keyNode, ev.path, "declare either on.change or on.pull_request, not both");
         allowOnly(["types", "branches", "branches-ignore", "paths", "paths-ignore"]);
         let types = ["opened", "revised", "reopened"];
         const ty = cfg.get("types");
         if (ty) {
           types = [];
-          for (const [i, raw] of (strList(c4, ty.value, ty.path) ?? []).entries()) {
+          for (const [i, raw] of (strList(c5, ty.value, ty.path) ?? []).entries()) {
             const v = raw === "synchronize" ? "revised" : raw;
             if (v === "opened" || v === "revised" || v === "reopened") types.push(v);
-            else c4.err((0, import_yaml.isSeq)(ty.value) ? ty.value.items[i] : ty.value, `${ty.path}[${i}]`, `unsupported ${ev.key} type "${raw}" (supported: opened, revised (alias synchronize), reopened)`);
+            else c5.err((0, import_yaml.isSeq)(ty.value) ? ty.value.items[i] : ty.value, `${ty.path}[${i}]`, `unsupported ${ev.key} type "${raw}" (supported: opened, revised (alias synchronize), reopened)`);
           }
         }
-        const [branches, branches_ignore] = filterPair(c4, cfg, "branches", "branches-ignore");
-        const [paths, paths_ignore] = filterPair(c4, cfg, "paths", "paths-ignore");
+        const [branches, branches_ignore] = filterPair(c5, cfg, "branches", "branches-ignore");
+        const [paths, paths_ignore] = filterPair(c5, cfg, "paths", "paths-ignore");
         t.change = { key: ev.key, types, branches, branches_ignore, paths, paths_ignore };
         break;
       }
@@ -46260,28 +46793,28 @@ function triggers(c4, node2) {
         allowOnly(["inputs"]);
         const inputs = {};
         const inEntry = cfg.get("inputs");
-        const ins = inEntry ? entries(c4, inEntry.value, inEntry.path) ?? [] : [];
-        if (ins.length > LIMITS.maxDispatchInputs) c4.err(inEntry.value, inEntry.path, `at most ${LIMITS.maxDispatchInputs} inputs are supported`);
+        const ins = inEntry ? entries(c5, inEntry.value, inEntry.path) ?? [] : [];
+        if (ins.length > LIMITS.maxDispatchInputs) c5.err(inEntry.value, inEntry.path, `at most ${LIMITS.maxDispatchInputs} inputs are supported`);
         for (const inp of ins) {
-          if (!ID_RE.test(inp.key)) c4.err(inp.keyNode, inp.path, `invalid input name "${inp.key}"`);
+          if (!ID_RE.test(inp.key)) c5.err(inp.keyNode, inp.path, `invalid input name "${inp.key}"`);
           const d = { type: "string", description: "", required: false, default: null, options: [] };
-          for (const f of inp.value === null ? [] : entries(c4, inp.value, inp.path) ?? []) {
-            if (f.key === "description") d.description = str4(c4, f.value, f.path, { allowEmpty: true, max: 1e3 }) ?? "";
-            else if (f.key === "required") d.required = bool(c4, f.value, f.path) ?? false;
+          for (const f of inp.value === null ? [] : entries(c5, inp.value, inp.path) ?? []) {
+            if (f.key === "description") d.description = str4(c5, f.value, f.path, { allowEmpty: true, max: 1e3 }) ?? "";
+            else if (f.key === "required") d.required = bool(c5, f.value, f.path) ?? false;
             else if (f.key === "type") {
-              const ty2 = str4(c4, f.value, f.path);
+              const ty2 = str4(c5, f.value, f.path);
               if (ty2 === "string" || ty2 === "boolean" || ty2 === "choice") d.type = ty2;
-              else if (ty2 !== null) c4.err(f.value, f.path, `unsupported input type "${ty2}" (supported: string, boolean, choice)`);
+              else if (ty2 !== null) c5.err(f.value, f.path, `unsupported input type "${ty2}" (supported: string, boolean, choice)`);
             } else if (f.key === "default") {
-              const v = scalar(c4, f.value, f.path);
+              const v = scalar(c5, f.value, f.path);
               if (v !== void 0) d.default = typeof v === "boolean" ? v : v === null ? null : String(v);
-            } else if (f.key === "options") d.options = strList(c4, f.value, f.path) ?? [];
-            else c4.err(f.keyNode, f.path, `unsupported key "${f.key}" in workflow_dispatch input (supported: description, required, type, default, options)`);
+            } else if (f.key === "options") d.options = strList(c5, f.value, f.path) ?? [];
+            else c5.err(f.keyNode, f.path, `unsupported key "${f.key}" in workflow_dispatch input (supported: description, required, type, default, options)`);
           }
-          if (d.type === "choice" && d.options.length === 0) c4.err(inp.value, inp.path, `choice input "${inp.key}" needs options`);
-          if (d.type !== "choice" && d.options.length) c4.err(inp.value, inp.path, `options are only valid for choice inputs`);
-          if (d.type === "boolean" && d.default !== null && typeof d.default !== "boolean") c4.err(inp.value, inp.path, `default of boolean input "${inp.key}" must be true or false`);
-          if (d.type === "choice" && d.default !== null && !d.options.includes(String(d.default))) c4.err(inp.value, inp.path, `default of choice input "${inp.key}" must be one of its options`);
+          if (d.type === "choice" && d.options.length === 0) c5.err(inp.value, inp.path, `choice input "${inp.key}" needs options`);
+          if (d.type !== "choice" && d.options.length) c5.err(inp.value, inp.path, `options are only valid for choice inputs`);
+          if (d.type === "boolean" && d.default !== null && typeof d.default !== "boolean") c5.err(inp.value, inp.path, `default of boolean input "${inp.key}" must be true or false`);
+          if (d.type === "choice" && d.default !== null && !d.options.includes(String(d.default))) c5.err(inp.value, inp.path, `default of choice input "${inp.key}" must be one of its options`);
           inputs[inp.key] = d;
         }
         t.workflow_dispatch = { inputs };
@@ -46289,136 +46822,136 @@ function triggers(c4, node2) {
       }
       case "schedule": {
         if (!(0, import_yaml.isSeq)(ev.value)) {
-          c4.err(ev.value ?? ev.keyNode, ev.path, "on.schedule must be a list of { cron: '\u2026' } entries");
+          c5.err(ev.value ?? ev.keyNode, ev.path, "on.schedule must be a list of { cron: '\u2026' } entries");
           break;
         }
-        if (ev.value.items.length > LIMITS.maxSchedules) c4.err(ev.value, ev.path, `at most ${LIMITS.maxSchedules} schedules are supported`);
+        if (ev.value.items.length > LIMITS.maxSchedules) c5.err(ev.value, ev.path, `at most ${LIMITS.maxSchedules} schedules are supported`);
         ev.value.items.forEach((item, i) => {
           const p = `${ev.path}[${i}]`;
-          const es = entries(c4, item, p) ?? [];
+          const es = entries(c5, item, p) ?? [];
           const cron = es.find((e) => e.key === "cron");
-          for (const e of es) if (e.key !== "cron") c4.err(e.keyNode, e.path, `unsupported key "${e.key}" in schedule (only cron)`);
+          for (const e of es) if (e.key !== "cron") c5.err(e.keyNode, e.path, `unsupported key "${e.key}" in schedule (only cron)`);
           if (!cron) {
-            c4.err(item, p, "schedule entry needs a cron expression");
+            c5.err(item, p, "schedule entry needs a cron expression");
             return;
           }
-          const expr = str4(c4, cron.value, cron.path);
+          const expr = str4(c5, cron.value, cron.path);
           if (expr === null) return;
           try {
             validateCron(expr);
             t.schedule.push(expr);
           } catch (e) {
-            c4.err(cron.value, cron.path, e instanceof CronError ? e.message : String(e));
+            c5.err(cron.value, cron.path, e instanceof CronError ? e.message : String(e));
           }
         });
         break;
       }
       default:
-        c4.err(ev.keyNode, ev.path, UNSUPPORTED_TRIGGERS[ev.key] ?? `unsupported trigger "${ev.key}" (supported: push, change, pull_request, workflow_dispatch, schedule)`);
+        c5.err(ev.keyNode, ev.path, UNSUPPORTED_TRIGGERS[ev.key] ?? `unsupported trigger "${ev.key}" (supported: push, change, pull_request, workflow_dispatch, schedule)`);
     }
   }
   return t;
 }
-function runsOn(c4, node2, path3) {
+function runsOn(c5, node2, path3) {
   if (node2 === null) {
-    c4.err(node2, path3, `${path3} is required`);
+    c5.err(node2, path3, `${path3} is required`);
     return null;
   }
   if ((0, import_yaml.isMap)(node2)) {
     let group = null;
     let labelsNode = null;
-    for (const e of entries(c4, node2, path3) ?? []) {
+    for (const e of entries(c5, node2, path3) ?? []) {
       if (e.key === "group") {
-        group = str4(c4, e.value, e.path, { max: 64 })?.toLowerCase() ?? null;
-        if (group !== null && !LABEL_RE.test(group)) c4.err(e.value, e.path, `invalid runner group "${group}"`);
+        group = str4(c5, e.value, e.path, { max: 64 })?.toLowerCase() ?? null;
+        if (group !== null && !LABEL_RE.test(group)) c5.err(e.value, e.path, `invalid runner group "${group}"`);
       } else if (e.key === "labels") labelsNode = e.value;
-      else c4.err(e.keyNode, e.path, `unsupported key "${e.key}" in runs-on (supported: group, labels)`);
+      else c5.err(e.keyNode, e.path, `unsupported key "${e.key}" in runs-on (supported: group, labels)`);
     }
-    const ls = labelsNode ? strList(c4, labelsNode, `${path3}.labels`) ?? [] : [];
-    if (!group && !ls.length) c4.err(node2, path3, `${path3} needs a group or labels`);
+    const ls = labelsNode ? strList(c5, labelsNode, `${path3}.labels`) ?? [] : [];
+    if (!group && !ls.length) c5.err(node2, path3, `${path3} needs a group or labels`);
     const rest = [...new Set(ls.filter((l) => l !== "self-hosted").map((l) => l.toLowerCase()))];
-    for (const l of rest) if (!LABEL_RE.test(l)) c4.err(labelsNode, `${path3}.labels`, `invalid runner label "${l}"`);
-    if (rest.length > LIMITS.maxLabels) c4.err(labelsNode, `${path3}.labels`, `at most ${LIMITS.maxLabels} labels are supported`);
+    for (const l of rest) if (!LABEL_RE.test(l)) c5.err(labelsNode, `${path3}.labels`, `invalid runner label "${l}"`);
+    if (rest.length > LIMITS.maxLabels) c5.err(labelsNode, `${path3}.labels`, `at most ${LIMITS.maxLabels} labels are supported`);
     return { kind: "self_hosted", labels: rest, group };
   }
-  const labels = strList(c4, node2, path3);
+  const labels = strList(c5, node2, path3);
   if (!labels || !labels.length) return null;
   if (labels.some((l) => hasExpressions(l))) {
-    c4.err(node2, path3, `${path3} must be literal labels; expressions are not supported`);
+    c5.err(node2, path3, `${path3} must be literal labels; expressions are not supported`);
     return null;
   }
   if (labels.includes("self-hosted")) {
     const rest = [...new Set(labels.filter((l) => l !== "self-hosted").map((l) => l.toLowerCase()))];
-    if (rest.length > LIMITS.maxLabels) c4.err(node2, path3, `at most ${LIMITS.maxLabels} labels are supported`);
-    for (const l of rest) if (!LABEL_RE.test(l)) c4.err(node2, path3, `invalid runner label "${l}"`);
+    if (rest.length > LIMITS.maxLabels) c5.err(node2, path3, `at most ${LIMITS.maxLabels} labels are supported`);
+    for (const l of rest) if (!LABEL_RE.test(l)) c5.err(node2, path3, `invalid runner label "${l}"`);
     return { kind: "self_hosted", labels: rest, group: null };
   }
   if (labels.length === 1 && (labels[0] === "ubuntu-latest" || labels[0] === "brnch-hosted")) return { kind: "hosted", label: labels[0] };
-  c4.err(node2, path3, `runs-on ${JSON.stringify(labels.length === 1 ? labels[0] : labels)} is not available: use ubuntu-latest / brnch-hosted (hosted runner) or [self-hosted, <labels>]`);
+  c5.err(node2, path3, `runs-on ${JSON.stringify(labels.length === 1 ? labels[0] : labels)} is not available: use ubuntu-latest / brnch-hosted (hosted runner) or [self-hosted, <labels>]`);
   return null;
 }
-function literal2(c4, node2, path3, depth = 0) {
+function literal2(c5, node2, path3, depth = 0) {
   if (depth > 16) {
-    c4.err(node2, path3, `${path3} is nested too deeply`);
+    c5.err(node2, path3, `${path3} is nested too deeply`);
     return null;
   }
   if ((0, import_yaml.isAlias)(node2)) {
-    c4.err(node2, path3, "YAML aliases are not supported");
+    c5.err(node2, path3, "YAML aliases are not supported");
     return null;
   }
   if ((0, import_yaml.isScalar)(node2)) {
     const v = node2.value;
     if (typeof v === "string" && hasExpressions(v)) {
-      c4.err(node2, path3, `${path3}: matrix values must be literals; expressions are not supported`);
+      c5.err(node2, path3, `${path3}: matrix values must be literals; expressions are not supported`);
       return null;
     }
     return v;
   }
-  if ((0, import_yaml.isSeq)(node2)) return node2.items.map((x, i) => literal2(c4, x, `${path3}[${i}]`, depth + 1));
+  if ((0, import_yaml.isSeq)(node2)) return node2.items.map((x, i) => literal2(c5, x, `${path3}[${i}]`, depth + 1));
   if ((0, import_yaml.isMap)(node2)) {
     const o = {};
-    for (const e of entries(c4, node2, path3) ?? []) o[e.key] = literal2(c4, e.value, e.path, depth + 1);
+    for (const e of entries(c5, node2, path3) ?? []) o[e.key] = literal2(c5, e.value, e.path, depth + 1);
     return o;
   }
   return null;
 }
-function matrix(c4, node2, path3) {
+function matrix(c5, node2, path3) {
   if ((0, import_yaml.isScalar)(node2) && typeof node2.value === "string" && hasExpressions(node2.value)) {
-    c4.err(node2, path3, `${path3}: a matrix computed from an expression is not supported; list the values`);
+    c5.err(node2, path3, `${path3}: a matrix computed from an expression is not supported; list the values`);
     return null;
   }
-  const es = entries(c4, node2, path3);
+  const es = entries(c5, node2, path3);
   if (!es) return null;
   const spec = { dimensions: [], include: [], exclude: [] };
   for (const e of es) {
     if (e.key === "include" || e.key === "exclude") {
       if (!(0, import_yaml.isSeq)(e.value)) {
-        c4.err(e.value ?? e.keyNode, e.path, `${e.path} must be a list of mappings`);
+        c5.err(e.value ?? e.keyNode, e.path, `${e.path} must be a list of mappings`);
         continue;
       }
       e.value.items.forEach((item, i) => {
         if (!(0, import_yaml.isMap)(item)) {
-          c4.err(item, `${e.path}[${i}]`, `${e.path}[${i}] must be a mapping`);
+          c5.err(item, `${e.path}[${i}]`, `${e.path}[${i}] must be a mapping`);
           return;
         }
-        spec[e.key].push(literal2(c4, item, `${e.path}[${i}]`));
+        spec[e.key].push(literal2(c5, item, `${e.path}[${i}]`));
       });
       continue;
     }
-    if (!ID_RE.test(e.key)) c4.err(e.keyNode, e.path, `invalid matrix key "${e.key}"`);
+    if (!ID_RE.test(e.key)) c5.err(e.keyNode, e.path, `invalid matrix key "${e.key}"`);
     if (!(0, import_yaml.isSeq)(e.value) || e.value.items.length === 0) {
-      c4.err(e.value ?? e.keyNode, e.path, `${e.path} must be a non-empty list of values`);
+      c5.err(e.value ?? e.keyNode, e.path, `${e.path} must be a non-empty list of values`);
       continue;
     }
-    spec.dimensions.push([e.key, literal2(c4, e.value, e.path)]);
+    spec.dimensions.push([e.key, literal2(c5, e.value, e.path)]);
   }
   if (productSize(spec) > MAX_MATRIX_PRODUCT) {
-    c4.err(node2, path3, `${path3} has ${productSize(spec)} combinations before include/exclude (limit ${LIMITS.maxMatrixCombinations})`);
+    c5.err(node2, path3, `${path3} has ${productSize(spec)} combinations before include/exclude (limit ${LIMITS.maxMatrixCombinations})`);
     return null;
   }
   const combos = expandMatrix(spec);
-  if (combos.length === 0) c4.err(node2, path3, `${path3} produces no combinations`);
-  if (combos.length > LIMITS.maxMatrixCombinations) c4.err(node2, path3, `${path3} produces ${combos.length} combinations (limit ${LIMITS.maxMatrixCombinations})`);
+  if (combos.length === 0) c5.err(node2, path3, `${path3} produces no combinations`);
+  if (combos.length > LIMITS.maxMatrixCombinations) c5.err(node2, path3, `${path3} produces ${combos.length} combinations (limit ${LIMITS.maxMatrixCombinations})`);
   return spec;
 }
 var ACTION_INPUTS = {
@@ -46430,17 +46963,17 @@ var ACTION_INPUTS = {
 var CONNECTION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/;
 var INFISICAL_ENV_RE = /^[A-Za-z0-9_-]{1,64}$/;
 var INFISICAL_PATH_RE = /^\/[A-Za-z0-9_./-]{0,499}$/;
-function infisicalInputs(c4, node2, path3, w) {
-  for (const [k, v] of Object.entries(w)) if (hasExpressions(v)) c4.err(node2, `${path3}.with.${k}`, `brnch/infisical@v1 inputs must be literal values (they are resolved when the job starts): ${k}`);
-  if (!w.connection) c4.err(node2, path3, "brnch/infisical@v1 requires with.connection (the name of an Infisical connection in the organization's integrations)");
-  else if (!CONNECTION_NAME_RE.test(w.connection)) c4.err(node2, `${path3}.with.connection`, `invalid connection name "${w.connection}"`);
-  if (!w.environment) c4.err(node2, path3, "brnch/infisical@v1 requires with.environment (an Infisical environment slug, e.g. prod)");
-  else if (!INFISICAL_ENV_RE.test(w.environment)) c4.err(node2, `${path3}.with.environment`, `invalid environment slug "${w.environment}"`);
-  if (w.path !== void 0 && (!INFISICAL_PATH_RE.test(w.path) || w.path.includes(".."))) c4.err(node2, `${path3}.with.path`, "with.path must be an absolute secret path such as / or /api");
-  if (w.recursive !== void 0 && w.recursive !== "true" && w.recursive !== "false") c4.err(node2, `${path3}.with.recursive`, "with.recursive must be true or false");
-}
-function step(c4, node2, path3, index) {
-  const es = entries(c4, node2, path3);
+function infisicalInputs(c5, node2, path3, w) {
+  for (const [k, v] of Object.entries(w)) if (hasExpressions(v)) c5.err(node2, `${path3}.with.${k}`, `brnch/infisical@v1 inputs must be literal values (they are resolved when the job starts): ${k}`);
+  if (!w.connection) c5.err(node2, path3, "brnch/infisical@v1 requires with.connection (the name of an Infisical connection in the organization's integrations)");
+  else if (!CONNECTION_NAME_RE.test(w.connection)) c5.err(node2, `${path3}.with.connection`, `invalid connection name "${w.connection}"`);
+  if (!w.environment) c5.err(node2, path3, "brnch/infisical@v1 requires with.environment (an Infisical environment slug, e.g. prod)");
+  else if (!INFISICAL_ENV_RE.test(w.environment)) c5.err(node2, `${path3}.with.environment`, `invalid environment slug "${w.environment}"`);
+  if (w.path !== void 0 && (!INFISICAL_PATH_RE.test(w.path) || w.path.includes(".."))) c5.err(node2, `${path3}.with.path`, "with.path must be an absolute secret path such as / or /api");
+  if (w.recursive !== void 0 && w.recursive !== "true" && w.recursive !== "false") c5.err(node2, `${path3}.with.recursive`, "with.recursive must be true or false");
+}
+function step(c5, node2, path3, index) {
+  const es = entries(c5, node2, path3);
   if (!es) return null;
   const s = { index, id: null, name: null, run: null, uses: null, with: {}, shell: null, working_directory: null, env: {}, if: null, continue_on_error: false, timeout_minutes: null };
   let withEntry = null;
@@ -46448,29 +46981,29 @@ function step(c4, node2, path3, index) {
   for (const e of es) {
     switch (e.key) {
       case "id": {
-        const v = str4(c4, e.value, e.path);
-        if (v !== null && !ID_RE.test(v)) c4.err(e.value, e.path, `invalid step id "${v}" (letters, digits, _ and -; must not start with a digit)`);
+        const v = str4(c5, e.value, e.path);
+        if (v !== null && !ID_RE.test(v)) c5.err(e.value, e.path, `invalid step id "${v}" (letters, digits, _ and -; must not start with a digit)`);
         s.id = v;
         break;
       }
       case "name":
-        s.name = str4(c4, e.value, e.path, { max: 500 });
-        if (s.name) checkExpressions(c4, s.name, e.value, e.path, CTX.runner);
+        s.name = str4(c5, e.value, e.path, { max: 500 });
+        if (s.name) checkExpressions(c5, s.name, e.value, e.path, CTX.runner);
         break;
       case "run":
-        s.run = str4(c4, e.value, e.path);
-        if (s.run) checkExpressions(c4, s.run, e.value, e.path, CTX.runner);
+        s.run = str4(c5, e.value, e.path);
+        if (s.run) checkExpressions(c5, s.run, e.value, e.path, CTX.runner);
         break;
       case "uses": {
         usesNode = e.value;
-        const v = str4(c4, e.value, e.path);
+        const v = str4(c5, e.value, e.path);
         if (v === null) break;
         if (BUILTIN_ACTIONS.includes(v)) s.uses = v;
-        else if (v.startsWith("./") || v.startsWith("docker://")) c4.err(e.value, e.path, `${v.startsWith("./") ? "local/composite" : "Docker"} actions are not supported (built-in actions: ${BUILTIN_ACTIONS.join(", ")})`);
+        else if (v.startsWith("./") || v.startsWith("docker://")) c5.err(e.value, e.path, `${v.startsWith("./") ? "local/composite" : "Docker"} actions are not supported (built-in actions: ${BUILTIN_ACTIONS.join(", ")})`);
         else {
           const base2 = v.split("@")[0];
           const builtin = BUILTIN_ACTIONS.find((a) => a.startsWith(`${base2}@`));
-          c4.err(e.value, e.path, builtin ? `unsupported version "${v}": only ${builtin} is available` : `unsupported action "${v}": only the built-in actions ${BUILTIN_ACTIONS.join(", ")} are available`);
+          c5.err(e.value, e.path, builtin ? `unsupported version "${v}": only ${builtin} is available` : `unsupported action "${v}": only the built-in actions ${BUILTIN_ACTIONS.join(", ")} are available`);
         }
         break;
       }
@@ -46478,59 +47011,59 @@ function step(c4, node2, path3, index) {
         withEntry = e;
         break;
       case "shell":
-        s.shell = shell(c4, e.value, e.path);
+        s.shell = shell(c5, e.value, e.path);
         break;
       case "working-directory":
-        s.working_directory = str4(c4, e.value, e.path, { max: 1024 });
-        if (s.working_directory) checkExpressions(c4, s.working_directory, e.value, e.path, CTX.runner);
+        s.working_directory = str4(c5, e.value, e.path, { max: 1024 });
+        if (s.working_directory) checkExpressions(c5, s.working_directory, e.value, e.path, CTX.runner);
         break;
       case "env":
-        s.env = envMap(c4, e.value, e.path, CTX.runner);
+        s.env = envMap(c5, e.value, e.path, CTX.runner);
         break;
       case "if": {
-        const v = scalar(c4, e.value, e.path);
+        const v = scalar(c5, e.value, e.path);
         if (typeof v === "boolean") s.if = v ? "true" : "false";
         else if (typeof v === "string" && v.trim()) {
           s.if = v;
-          checkExpressions(c4, v, e.value, e.path, CTX.runner, true);
-        } else if (v !== void 0) c4.err(e.value, e.path, `${e.path} must be an expression`);
+          checkExpressions(c5, v, e.value, e.path, CTX.runner, true);
+        } else if (v !== void 0) c5.err(e.value, e.path, `${e.path} must be an expression`);
         break;
       }
       case "continue-on-error":
-        s.continue_on_error = boolOrExpr(c4, e.value, e.path, CTX.runner);
+        s.continue_on_error = boolOrExpr(c5, e.value, e.path, CTX.runner);
         break;
       case "timeout-minutes":
-        s.timeout_minutes = int2(c4, e.value, e.path, 1, LIMITS.maxTimeoutMinutes);
+        s.timeout_minutes = int2(c5, e.value, e.path, 1, LIMITS.maxTimeoutMinutes);
         break;
       default:
-        c4.err(e.keyNode, e.path, `unsupported step key "${e.key}" (supported: name, id, run, uses, with, shell, working-directory, env, if, continue-on-error, timeout-minutes)`);
+        c5.err(e.keyNode, e.path, `unsupported step key "${e.key}" (supported: name, id, run, uses, with, shell, working-directory, env, if, continue-on-error, timeout-minutes)`);
     }
   }
-  if (s.run === null && s.uses === null && !usesNode) c4.err(node2, path3, "a step needs either run or uses");
-  if (s.run !== null && usesNode) c4.err(node2, path3, "a step cannot have both run and uses");
+  if (s.run === null && s.uses === null && !usesNode) c5.err(node2, path3, "a step needs either run or uses");
+  if (s.run !== null && usesNode) c5.err(node2, path3, "a step cannot have both run and uses");
   if (withEntry) {
-    if (!usesNode) c4.err(withEntry.keyNode, withEntry.path, "with is only valid together with uses");
-    for (const w of entries(c4, withEntry.value, withEntry.path) ?? []) {
-      const v = scalar(c4, w.value, w.path);
+    if (!usesNode) c5.err(withEntry.keyNode, withEntry.path, "with is only valid together with uses");
+    for (const w of entries(c5, withEntry.value, withEntry.path) ?? []) {
+      const v = scalar(c5, w.value, w.path);
       if (v === void 0) continue;
       if (s.uses && !ACTION_INPUTS[s.uses].includes(w.key)) {
-        c4.err(w.keyNode, w.path, `${s.uses} does not support input "${w.key}" (supported: ${ACTION_INPUTS[s.uses].join(", ")})`);
+        c5.err(w.keyNode, w.path, `${s.uses} does not support input "${w.key}" (supported: ${ACTION_INPUTS[s.uses].join(", ")})`);
         continue;
       }
       const sv = v === null ? "" : String(v);
-      checkExpressions(c4, sv, w.value, w.path, CTX.runner);
+      checkExpressions(c5, sv, w.value, w.path, CTX.runner);
       s.with[w.key] = sv;
     }
   }
-  if (s.uses === "actions/upload-artifact@v4" && !s.with.path) c4.err(node2, path3, "actions/upload-artifact@v4 requires with.path");
-  if (s.uses === "actions/setup-node@v4" && !s.with["node-version"]) c4.err(node2, path3, "actions/setup-node@v4 requires with.node-version");
-  if (s.uses && (s.shell || s.working_directory)) c4.err(node2, path3, "shell and working-directory are only valid for run steps");
-  if (s.uses === "brnch/infisical@v1") infisicalInputs(c4, node2, path3, s.with);
+  if (s.uses === "actions/upload-artifact@v4" && !s.with.path) c5.err(node2, path3, "actions/upload-artifact@v4 requires with.path");
+  if (s.uses === "actions/setup-node@v4" && !s.with["node-version"]) c5.err(node2, path3, "actions/setup-node@v4 requires with.node-version");
+  if (s.uses && (s.shell || s.working_directory)) c5.err(node2, path3, "shell and working-directory are only valid for run steps");
+  if (s.uses === "brnch/infisical@v1") infisicalInputs(c5, node2, path3, s.with);
   return s;
 }
-function job(c4, id2, keyNode, node2, path3) {
-  if (!ID_RE.test(id2)) c4.err(keyNode, path3, `invalid job id "${id2}" (letters, digits, _ and -; must not start with a digit)`);
-  const es = entries(c4, node2, path3);
+function job(c5, id2, keyNode, node2, path3) {
+  if (!ID_RE.test(id2)) c5.err(keyNode, path3, `invalid job id "${id2}" (letters, digits, _ and -; must not start with a digit)`);
+  const es = entries(c5, node2, path3);
   if (!es) return null;
   const j = {
     id: id2,
@@ -46553,62 +47086,62 @@ function job(c4, id2, keyNode, node2, path3) {
   for (const e of es) {
     switch (e.key) {
       case "name":
-        j.name = str4(c4, e.value, e.path, { max: 200 });
-        if (j.name) checkExpressions(c4, j.name, e.value, e.path, CTX.jobName);
+        j.name = str4(c5, e.value, e.path, { max: 200 });
+        if (j.name) checkExpressions(c5, j.name, e.value, e.path, CTX.jobName);
         break;
       case "runs-on": {
         sawRunsOn = true;
-        const r = runsOn(c4, e.value, e.path);
+        const r = runsOn(c5, e.value, e.path);
         if (r) j.runs_on = r;
         break;
       }
       case "needs":
-        j.needs = strList(c4, e.value, e.path) ?? [];
+        j.needs = strList(c5, e.value, e.path) ?? [];
         break;
       case "if": {
-        const v = scalar(c4, e.value, e.path);
+        const v = scalar(c5, e.value, e.path);
         if (typeof v === "boolean") j.if = v ? "true" : "false";
         else if (typeof v === "string" && v.trim()) {
           j.if = v;
-          checkExpressions(c4, v, e.value, e.path, CTX.jobIf, true);
-        } else if (v !== void 0) c4.err(e.value, e.path, `${e.path} must be an expression`);
+          checkExpressions(c5, v, e.value, e.path, CTX.jobIf, true);
+        } else if (v !== void 0) c5.err(e.value, e.path, `${e.path} must be an expression`);
         break;
       }
       case "env":
-        j.env = envMap(c4, e.value, e.path, CTX.runner);
+        j.env = envMap(c5, e.value, e.path, CTX.runner);
         break;
       case "timeout-minutes":
-        j.timeout_minutes = int2(c4, e.value, e.path, 1, LIMITS.maxTimeoutMinutes) ?? LIMITS.defaultTimeoutMinutes;
+        j.timeout_minutes = int2(c5, e.value, e.path, 1, LIMITS.maxTimeoutMinutes) ?? LIMITS.defaultTimeoutMinutes;
         break;
       case "continue-on-error":
-        j.continue_on_error = boolOrExpr(c4, e.value, e.path, CTX.jobContinue);
+        j.continue_on_error = boolOrExpr(c5, e.value, e.path, CTX.jobContinue);
         break;
       case "strategy":
-        for (const s of entries(c4, e.value, e.path) ?? []) {
-          if (s.key === "matrix") j.strategy.matrix = matrix(c4, s.value, s.path);
-          else if (s.key === "fail-fast") j.strategy.fail_fast = bool(c4, s.value, s.path) ?? true;
-          else if (s.key === "max-parallel") j.strategy.max_parallel = int2(c4, s.value, s.path, 1, LIMITS.maxMatrixCombinations);
-          else c4.err(s.keyNode, s.path, `unsupported key "${s.key}" in strategy (supported: matrix, fail-fast, max-parallel)`);
+        for (const s of entries(c5, e.value, e.path) ?? []) {
+          if (s.key === "matrix") j.strategy.matrix = matrix(c5, s.value, s.path);
+          else if (s.key === "fail-fast") j.strategy.fail_fast = bool(c5, s.value, s.path) ?? true;
+          else if (s.key === "max-parallel") j.strategy.max_parallel = int2(c5, s.value, s.path, 1, LIMITS.maxMatrixCombinations);
+          else c5.err(s.keyNode, s.path, `unsupported key "${s.key}" in strategy (supported: matrix, fail-fast, max-parallel)`);
         }
         break;
       case "defaults":
-        j.defaults = defaults(c4, e.value, e.path);
+        j.defaults = defaults(c5, e.value, e.path);
         break;
       case "permissions":
-        j.permissions = permissions(c4, e.value, e.path);
+        j.permissions = permissions(c5, e.value, e.path);
         break;
       case "container":
         containerEntry = e;
-        j.container = container(c4, e.value, e.path);
+        j.container = container(c5, e.value, e.path);
         break;
       case "outputs": {
-        const os = entries(c4, e.value, e.path) ?? [];
-        if (os.length > LIMITS.maxOutputs) c4.err(e.value, e.path, `at most ${LIMITS.maxOutputs} outputs are supported`);
+        const os = entries(c5, e.value, e.path) ?? [];
+        if (os.length > LIMITS.maxOutputs) c5.err(e.value, e.path, `at most ${LIMITS.maxOutputs} outputs are supported`);
         for (const o of os) {
-          if (!ID_RE.test(o.key)) c4.err(o.keyNode, o.path, `invalid output name "${o.key}"`);
-          const v = str4(c4, o.value, o.path, { allowEmpty: true });
+          if (!ID_RE.test(o.key)) c5.err(o.keyNode, o.path, `invalid output name "${o.key}"`);
+          const v = str4(c5, o.value, o.path, { allowEmpty: true });
           if (v === null) continue;
-          checkExpressions(c4, v, o.value, o.path, CTX.runner);
+          checkExpressions(c5, v, o.value, o.path, CTX.runner);
           j.outputs[o.key] = v;
         }
         break;
@@ -46616,131 +47149,131 @@ function job(c4, id2, keyNode, node2, path3) {
       case "steps": {
         sawSteps = true;
         if (!(0, import_yaml.isSeq)(e.value)) {
-          c4.err(e.value ?? e.keyNode, e.path, `${e.path} must be a list`);
+          c5.err(e.value ?? e.keyNode, e.path, `${e.path} must be a list`);
           break;
         }
-        if (e.value.items.length === 0) c4.err(e.value, e.path, `${e.path} must contain at least one step`);
-        if (e.value.items.length > LIMITS.maxStepsPerJob) c4.err(e.value, e.path, `a job can have at most ${LIMITS.maxStepsPerJob} steps`);
+        if (e.value.items.length === 0) c5.err(e.value, e.path, `${e.path} must contain at least one step`);
+        if (e.value.items.length > LIMITS.maxStepsPerJob) c5.err(e.value, e.path, `a job can have at most ${LIMITS.maxStepsPerJob} steps`);
         e.value.items.slice(0, LIMITS.maxStepsPerJob).forEach((item, i) => {
-          const s = step(c4, item, `${e.path}[${i}]`, i);
+          const s = step(c5, item, `${e.path}[${i}]`, i);
           if (s) j.steps.push(s);
         });
         const ids = /* @__PURE__ */ new Set();
         for (const s of j.steps) {
           if (!s.id) continue;
-          if (ids.has(s.id)) c4.err(e.value.items[s.index], `${e.path}[${s.index}].id`, `duplicate step id "${s.id}"`);
+          if (ids.has(s.id)) c5.err(e.value.items[s.index], `${e.path}[${s.index}].id`, `duplicate step id "${s.id}"`);
           ids.add(s.id);
         }
         break;
       }
       default:
-        c4.err(e.keyNode, e.path, UNSUPPORTED_JOB[e.key] ?? `unsupported job key "${e.key}" (supported: name, runs-on, needs, if, env, timeout-minutes, continue-on-error, strategy, defaults, permissions, outputs, container, steps)`);
+        c5.err(e.keyNode, e.path, UNSUPPORTED_JOB[e.key] ?? `unsupported job key "${e.key}" (supported: name, runs-on, needs, if, env, timeout-minutes, continue-on-error, strategy, defaults, permissions, outputs, container, steps)`);
     }
   }
   if (containerEntry && j.runs_on.kind === "hosted") {
-    c4.err(containerEntry.keyNode, containerEntry.path, "job containers are only supported on self-hosted runners with Docker; hosted jobs already run in the brnch-hosted image");
+    c5.err(containerEntry.keyNode, containerEntry.path, "job containers are only supported on self-hosted runners with Docker; hosted jobs already run in the brnch-hosted image");
   }
-  if (!sawRunsOn) c4.err(node2, path3, `${path3}.runs-on is required`);
-  if (!sawSteps) c4.err(node2, path3, `${path3}.steps is required`);
+  if (!sawRunsOn) c5.err(node2, path3, `${path3}.runs-on is required`);
+  if (!sawSteps) c5.err(node2, path3, `${path3}.steps is required`);
   return j;
 }
 var IMAGE_RE = /^[a-z0-9][a-z0-9._/:@-]{0,254}$/i;
-function container(c4, node2, path3) {
+function container(c5, node2, path3) {
   let image = null;
   let env = {};
-  if ((0, import_yaml.isScalar)(node2)) image = str4(c4, node2, path3);
+  if ((0, import_yaml.isScalar)(node2)) image = str4(c5, node2, path3);
   else {
-    for (const e of entries(c4, node2, path3) ?? []) {
-      if (e.key === "image") image = str4(c4, e.value, e.path);
-      else if (e.key === "env") env = envMap(c4, e.value, e.path, CTX.runner);
-      else c4.err(e.keyNode, e.path, `unsupported key "${e.key}" in container (supported: image, env)`);
+    for (const e of entries(c5, node2, path3) ?? []) {
+      if (e.key === "image") image = str4(c5, e.value, e.path);
+      else if (e.key === "env") env = envMap(c5, e.value, e.path, CTX.runner);
+      else c5.err(e.keyNode, e.path, `unsupported key "${e.key}" in container (supported: image, env)`);
     }
   }
   if (image === null) {
-    c4.err(node2, path3, `${path3}.image is required`);
+    c5.err(node2, path3, `${path3}.image is required`);
     return null;
   }
   if (hasExpressions(image) || !IMAGE_RE.test(image)) {
-    c4.err(node2, path3, `${path3}: invalid image reference "${image}" (literal image names only)`);
+    c5.err(node2, path3, `${path3}: invalid image reference "${image}" (literal image names only)`);
     return null;
   }
   return { image, env };
 }
-function permissions(c4, node2, path3) {
+function permissions(c5, node2, path3) {
   const out = {};
   if ((0, import_yaml.isScalar)(node2)) {
-    const v = str4(c4, node2, path3);
+    const v = str4(c5, node2, path3);
     if (v === "read-all") out.contents = "read";
-    else if (v !== null) c4.err(node2, path3, `${path3}: "${v}" is not supported; job tokens are read-only (use read-all or contents: read)`);
+    else if (v !== null) c5.err(node2, path3, `${path3}: "${v}" is not supported; job tokens are read-only (use read-all or contents: read)`);
     return out;
   }
-  for (const e of entries(c4, node2, path3) ?? []) {
-    const v = str4(c4, e.value, e.path);
+  for (const e of entries(c5, node2, path3) ?? []) {
+    const v = str4(c5, e.value, e.path);
     if (e.key === "id-token") {
       if (v === "write" || v === "none") out[e.key] = v;
-      else if (v !== null) c4.err(e.value, e.path, `${e.path} must be write or none`);
+      else if (v !== null) c5.err(e.value, e.path, `${e.path} must be write or none`);
       continue;
     }
     if (v === "read" || v === "none") out[e.key] = v;
-    else if (v === "write") c4.err(e.value, e.path, `${e.path}: write permissions are not supported; job tokens can only read the repository and report their own results (only id-token: write is accepted)`);
-    else if (v !== null) c4.err(e.value, e.path, `${e.path} must be read or none`);
+    else if (v === "write") c5.err(e.value, e.path, `${e.path}: write permissions are not supported; job tokens can only read the repository and report their own results (only id-token: write is accepted)`);
+    else if (v !== null) c5.err(e.value, e.path, `${e.path} must be read or none`);
   }
   return out;
 }
-function checkNeeds(c4, jobs, keyNodes) {
+function checkNeeds(c5, jobs, keyNodes) {
   const ids = new Set(jobs.map((j) => j.id));
   for (const j of jobs) {
     for (const n of j.needs) {
-      if (n === j.id) c4.err(keyNodes.get(j.id) ?? null, `jobs.${j.id}.needs`, `job "${j.id}" cannot need itself`);
-      else if (!ids.has(n)) c4.err(keyNodes.get(j.id) ?? null, `jobs.${j.id}.needs`, `job "${j.id}" needs unknown job "${n}"`);
+      if (n === j.id) c5.err(keyNodes.get(j.id) ?? null, `jobs.${j.id}.needs`, `job "${j.id}" cannot need itself`);
+      else if (!ids.has(n)) c5.err(keyNodes.get(j.id) ?? null, `jobs.${j.id}.needs`, `job "${j.id}" needs unknown job "${n}"`);
     }
   }
-  const state = /* @__PURE__ */ new Map();
+  const state2 = /* @__PURE__ */ new Map();
   const byId = new Map(jobs.map((j) => [j.id, j]));
   const visit2 = (id2, trail) => {
-    const s = state.get(id2) ?? 0;
+    const s = state2.get(id2) ?? 0;
     if (s === 2) return;
     if (s === 1) {
       const cycle = [...trail.slice(trail.indexOf(id2)), id2];
-      c4.err(keyNodes.get(id2) ?? null, `jobs.${id2}.needs`, `jobs form a cycle: ${cycle.join(" -> ")}`);
+      c5.err(keyNodes.get(id2) ?? null, `jobs.${id2}.needs`, `jobs form a cycle: ${cycle.join(" -> ")}`);
       return;
     }
-    state.set(id2, 1);
+    state2.set(id2, 1);
     for (const n of byId.get(id2)?.needs ?? []) if (byId.has(n)) visit2(n, [...trail, id2]);
-    state.set(id2, 2);
+    state2.set(id2, 2);
   };
   for (const j of jobs) visit2(j.id, []);
 }
 function parseWorkflow(file2, source) {
   const lc = new import_yaml.LineCounter();
-  const c4 = new Ctx(file2, lc);
+  const c5 = new Ctx(file2, lc);
   if (new TextEncoder().encode(source).byteLength > LIMITS.maxFileBytes) {
     return { workflow: null, issues: [{ file: file2, line: 1, column: 1, path: "", message: `workflow file is larger than ${LIMITS.maxFileBytes} bytes` }] };
   }
   const doc = (0, import_yaml.parseDocument)(source, { lineCounter: lc, prettyErrors: false, uniqueKeys: true, version: "1.2", schema: "core" });
   for (const e of doc.errors) {
     const { line: line2, col } = lc.linePos(e.pos[0]);
-    c4.issues.push({ file: file2, line: line2, column: col, path: "", message: `YAML: ${e.message.split("\n")[0]}` });
+    c5.issues.push({ file: file2, line: line2, column: col, path: "", message: `YAML: ${e.message.split("\n")[0]}` });
   }
-  if (c4.issues.length) return { workflow: null, issues: c4.issues.slice(0, MAX_ISSUES) };
+  if (c5.issues.length) return { workflow: null, issues: c5.issues.slice(0, MAX_ISSUES) };
   let aliasFound = false;
   const scan = (n) => {
     if (aliasFound || !n || typeof n !== "object") return;
     if ((0, import_yaml.isAlias)(n)) {
       aliasFound = true;
-      c4.err(n, "", "YAML anchors and aliases are not supported");
+      c5.err(n, "", "YAML anchors and aliases are not supported");
       return;
     }
     if ((0, import_yaml.isMap)(n) || (0, import_yaml.isSeq)(n)) for (const it of n.items) scan((0, import_yaml.isMap)(n) ? it.value : it);
     if ((0, import_yaml.isScalar)(n) && n.anchor) {
       aliasFound = true;
-      c4.err(n, "", "YAML anchors and aliases are not supported");
+      c5.err(n, "", "YAML anchors and aliases are not supported");
     }
   };
   scan(doc.contents);
   const root = doc.contents;
-  const es = entries(c4, root, "", "a mapping with on and jobs");
-  if (!es) return { workflow: null, issues: c4.issues };
+  const es = entries(c5, root, "", "a mapping with on and jobs");
+  if (!es) return { workflow: null, issues: c5.issues };
   const wf = {
     file: file2,
     name: file2,
@@ -46757,68 +47290,68 @@ function parseWorkflow(file2, source) {
   for (const e of es) {
     switch (e.key) {
       case "name":
-        wf.name = str4(c4, e.value, e.path, { max: 200 }) ?? file2;
-        if (hasExpressions(wf.name)) c4.err(e.value, e.path, "the workflow name must be literal");
+        wf.name = str4(c5, e.value, e.path, { max: 200 }) ?? file2;
+        if (hasExpressions(wf.name)) c5.err(e.value, e.path, "the workflow name must be literal");
         break;
       case "on":
         sawOn = true;
-        wf.on = triggers(c4, e.value);
+        wf.on = triggers(c5, e.value);
         break;
       case "env":
-        wf.env = envMap(c4, e.value, e.path, CTX.workflowEnv);
+        wf.env = envMap(c5, e.value, e.path, CTX.workflowEnv);
         break;
       case "concurrency": {
         if ((0, import_yaml.isScalar)(e.value)) {
-          const g2 = str4(c4, e.value, e.path, { max: 400 });
+          const g2 = str4(c5, e.value, e.path, { max: 400 });
           if (g2) {
-            checkExpressions(c4, g2, e.value, e.path, CTX.concurrency);
+            checkExpressions(c5, g2, e.value, e.path, CTX.concurrency);
             wf.concurrency = { group: g2, cancel_in_progress: false };
           }
           break;
         }
         let group = null;
         let cancel = false;
-        for (const f of entries(c4, e.value, e.path) ?? []) {
+        for (const f of entries(c5, e.value, e.path) ?? []) {
           if (f.key === "group") {
-            group = str4(c4, f.value, f.path, { max: 400 });
-            if (group) checkExpressions(c4, group, f.value, f.path, CTX.concurrency);
-          } else if (f.key === "cancel-in-progress") cancel = boolOrExpr(c4, f.value, f.path, CTX.concurrency);
-          else c4.err(f.keyNode, f.path, `unsupported key "${f.key}" in concurrency (supported: group, cancel-in-progress)`);
+            group = str4(c5, f.value, f.path, { max: 400 });
+            if (group) checkExpressions(c5, group, f.value, f.path, CTX.concurrency);
+          } else if (f.key === "cancel-in-progress") cancel = boolOrExpr(c5, f.value, f.path, CTX.concurrency);
+          else c5.err(f.keyNode, f.path, `unsupported key "${f.key}" in concurrency (supported: group, cancel-in-progress)`);
         }
-        if (!group) c4.err(e.value, e.path, "concurrency.group is required");
+        if (!group) c5.err(e.value, e.path, "concurrency.group is required");
         else wf.concurrency = { group, cancel_in_progress: cancel };
         break;
       }
       case "permissions":
-        wf.permissions = permissions(c4, e.value, e.path);
+        wf.permissions = permissions(c5, e.value, e.path);
         break;
       case "defaults":
-        wf.defaults = defaults(c4, e.value, e.path);
+        wf.defaults = defaults(c5, e.value, e.path);
         break;
       case "jobs": {
         sawJobs = true;
-        const js = entries(c4, e.value, "jobs") ?? [];
-        if (js.length === 0) c4.err(e.value ?? e.keyNode, "jobs", "jobs must define at least one job");
-        if (js.length > LIMITS.maxJobs) c4.err(e.value, "jobs", `a workflow can have at most ${LIMITS.maxJobs} jobs`);
+        const js = entries(c5, e.value, "jobs") ?? [];
+        if (js.length === 0) c5.err(e.value ?? e.keyNode, "jobs", "jobs must define at least one job");
+        if (js.length > LIMITS.maxJobs) c5.err(e.value, "jobs", `a workflow can have at most ${LIMITS.maxJobs} jobs`);
         for (const je of js.slice(0, LIMITS.maxJobs)) {
           jobKeyNodes.set(je.key, je.keyNode);
-          const j = job(c4, je.key, je.keyNode, je.value, je.path);
+          const j = job(c5, je.key, je.keyNode, je.value, je.path);
           if (j) wf.jobs.push(j);
         }
         break;
       }
       default:
-        c4.err(e.keyNode, e.path, UNSUPPORTED_TOP[e.key] ?? `unsupported top-level key "${e.key}" (supported: name, on, env, concurrency, permissions, defaults, jobs)`);
+        c5.err(e.keyNode, e.path, UNSUPPORTED_TOP[e.key] ?? `unsupported top-level key "${e.key}" (supported: name, on, env, concurrency, permissions, defaults, jobs)`);
     }
   }
-  if (!sawOn) c4.err(root, "on", "on is required");
-  if (!sawJobs) c4.err(root, "jobs", "jobs is required");
-  checkNeeds(c4, wf.jobs, jobKeyNodes);
+  if (!sawOn) c5.err(root, "on", "on is required");
+  if (!sawJobs) c5.err(root, "jobs", "jobs is required");
+  checkNeeds(c5, wf.jobs, jobKeyNodes);
   const legs = wf.jobs.reduce((n, j) => n + (j.strategy.matrix ? Math.max(1, safeLegs(j.strategy.matrix)) : 1), 0);
-  if (legs > LIMITS.maxJobs) c4.err(root, "jobs", `the workflow expands to ${legs} jobs (limit ${LIMITS.maxJobs} per run)`);
-  c4.issues.sort((a, b) => a.line - b.line || a.column - b.column);
-  c4.issues = c4.issues.slice(0, MAX_ISSUES);
-  return { workflow: c4.issues.length ? null : wf, issues: c4.issues };
+  if (legs > LIMITS.maxJobs) c5.err(root, "jobs", `the workflow expands to ${legs} jobs (limit ${LIMITS.maxJobs} per run)`);
+  c5.issues.sort((a, b) => a.line - b.line || a.column - b.column);
+  c5.issues = c5.issues.slice(0, MAX_ISSUES);
+  return { workflow: c5.issues.length ? null : wf, issues: c5.issues };
 }
 function safeLegs(m) {
   try {
@@ -46899,12 +47432,12 @@ function registerWorkflow(program2, rt) {
   );
 }
 async function watchRun(ctx, runId, interval, timeout, logs) {
-  const c4 = ctx.client("user");
+  const c5 = ctx.client("user");
   const deadline = Date.now() + timeout * 1e3;
   const seen = /* @__PURE__ */ new Map();
   const printed = /* @__PURE__ */ new Map();
   for (; ; ) {
-    const r = await c4.actions.runs.get(runId);
+    const r = await c5.actions.runs.get(runId);
     for (const j of r.jobs) {
       const s = `${j.status}${j.conclusion ? `/${j.conclusion}` : ""}`;
       if (seen.get(j.id) !== s) {
@@ -46913,7 +47446,7 @@ async function watchRun(ctx, runId, interval, timeout, logs) {
       }
       if (logs && j.status === "completed" && !printed.has(j.id)) {
         printed.set(j.id, 1);
-        const text2 = await c4.actions.jobs.logs(j.id).catch(() => "");
+        const text2 = await c5.actions.jobs.logs(j.id).catch(() => "");
         if (text2) ctx.info(`\u2500\u2500 ${j.name} \u2500\u2500
 ${text2.trimEnd()}`);
       }
@@ -46933,10 +47466,10 @@ function registerRun(program2, rt) {
   );
   run3.command("view <run>").description("A run with its jobs; --log prints every job's log").option("--log", "print job logs").action(
     act(rt, async (ctx, o, [id2]) => {
-      const c4 = ctx.client("user");
-      const r = await c4.actions.runs.get(id2);
+      const c5 = ctx.client("user");
+      const r = await c5.actions.runs.get(id2);
       if (o.log) for (const j of r.jobs) ctx.info(`\u2500\u2500 ${j.name} (${j.status}${j.conclusion ? `/${j.conclusion}` : ""}) \u2500\u2500
-${(await c4.actions.jobs.logs(j.id)).trimEnd()}`);
+${(await c5.actions.jobs.logs(j.id)).trimEnd()}`);
       ctx.result(r, renderRun);
     })
   );
@@ -46949,16 +47482,16 @@ ${(await c4.actions.jobs.logs(j.id)).trimEnd()}`);
   );
   run3.command("logs <job>").description("Print a job's log (--follow streams it live)").option("--follow", "stream until the job completes").action(
     act(rt, async (ctx, o, [job2]) => {
-      const c4 = ctx.client("user");
+      const c5 = ctx.client("user");
       if (!o.follow) {
-        const text2 = await c4.actions.jobs.logs(job2);
+        const text2 = await c5.actions.jobs.logs(job2);
         ctx.result({ job_id: job2, log: text2 }, text2);
         return;
       }
       let after = 0;
       let status = null;
       while (status === null) {
-        for await (const m of c4.actions.jobs.streamLogs(job2, { after })) {
+        for await (const m of c5.actions.jobs.streamLogs(job2, { after })) {
           if (m.kind === "log") {
             ctx.deps.stderr.write(m.text);
             after = m.seq;
@@ -47181,9 +47714,9 @@ function writeFresh(path3, data, owner, mode = 420) {
 var shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 async function prepareCapture(spec, host, env) {
   if (spec.vendor === "brnch" || spec.capture !== true || !host.capture) return null;
-  const c4 = host.capture;
+  const c5 = host.capture;
   const tool = CODING_AGENT_CAPTURE_TOOL[spec.vendor];
-  if (!/\.m?js$/.test(c4.program) || !existsSync(c4.program)) {
+  if (!/\.m?js$/.test(c5.program) || !existsSync(c5.program)) {
     host.log("##[warning]agent context capture is unavailable on this runner (its program cannot be run by the hooks); continuing without it");
     return null;
   }
@@ -47194,7 +47727,7 @@ async function prepareCapture(spec, host, env) {
   mkdirSync(claudeHome);
   if (!host.hosted) mkdirSync(home2, { recursive: true });
   const program2 = join25(dir, `${BRAND.cli}.mjs`);
-  writeFresh(program2, readFileSync3(c4.program, "utf8"), null);
+  writeFresh(program2, readFileSync3(c5.program, "utf8"), null);
   const wrapper = join25(dir, BRAND.cli);
   writeFresh(wrapper, `#!/bin/sh
 exec ${shq(process.execPath)} ${shq(program2)} "$@"
@@ -47202,7 +47735,7 @@ exec ${shq(process.execPath)} ${shq(program2)} "$@"
   for (const p of [program2, wrapper, claudeHome, dir, home2]) host.share(p);
   const hookEnv = {
     HOME: home2,
-    [envName("URL")]: c4.apiUrl,
+    [envName("URL")]: c5.apiUrl,
     [envName("NO_UPDATE_CHECK")]: "1",
     BRNCH_CAPTURE_NO_FLUSH: "1"
   };
@@ -47256,7 +47789,7 @@ function readEvents(file2) {
   return out;
 }
 async function uploadCaptures(setup, host) {
-  const c4 = host.capture;
+  const c5 = host.capture;
   const spoolDir = capturePaths({ HOME: setup.home }).spool;
   await settle2(spoolDir, Date.now() + 1e4);
   const entries2 = (await listSpool({ HOME: setup.home })).filter((e) => e.meta.tool === setup.tool);
@@ -47274,7 +47807,7 @@ async function uploadCaptures(setup, host) {
     const kept = events.slice(0, MAX_HOSTED_CAPTURE_EVENTS);
     try {
       for (let i = 0; i === 0 || i < kept.length; i += MAX_CAPTURE_EVENTS_PER_BATCH) {
-        const res = await c4.upload({ client_key: e.meta.client_key, tool: setup.tool, model: e.meta.model, started_at: e.meta.started_at, events: kept.slice(i, i + MAX_CAPTURE_EVENTS_PER_BATCH) });
+        const res = await c5.upload({ client_key: e.meta.client_key, tool: setup.tool, model: e.meta.model, started_at: e.meta.started_at, events: kept.slice(i, i + MAX_CAPTURE_EVENTS_PER_BATCH) });
         for (const r of res.results) {
           if (r.status === "withheld") withheld++;
           else if (r.status === "accepted") accepted++;
@@ -47424,8 +47957,8 @@ async function runAgentStep(spec, startOid, host) {
   await git3(["add", "-A"]);
   const status = await git3(["status", "--porcelain"]);
   if (status.stdout.trim()) {
-    const c4 = await git3(["-c", `user.name=${spec.commit.author_name}`, "-c", `user.email=${spec.commit.author_email}`, "commit", "--no-verify", "-q", "-m", commitMessage.slice(0, 500)]);
-    if (c4.code !== 0) {
+    const c5 = await git3(["-c", `user.name=${spec.commit.author_name}`, "-c", `user.email=${spec.commit.author_email}`, "commit", "--no-verify", "-q", "-m", commitMessage.slice(0, 500)]);
+    if (c5.code !== 0) {
       host.log("##[error]could not commit the agent's changes");
       return { outcome: "failure", outputs: reportOutputs(report3, "", version4) };
     }
@@ -47971,9 +48504,9 @@ function claudePrompt(spec, diffFile, truncated) {
 }
 function command(spec, cli, o) {
   if (spec.provider === "codex") {
-    const c4 = ['sandbox_mode="read-only"', 'approval_policy="never"', 'web_search="disabled"', 'shell_environment_policy.inherit="core"', "check_for_update_on_startup=false"];
+    const c5 = ['sandbox_mode="read-only"', 'approval_policy="never"', 'web_search="disabled"', 'shell_environment_policy.inherit="core"', "check_for_update_on_startup=false"];
     return {
-      argv: [...cli, "exec", "review", "--base", spec.base_branch, "--json", "--ephemeral", "--ignore-user-config", "--ignore-rules", ...c4.flatMap((x) => ["-c", x]), ...spec.model ? ["-m", spec.model] : []],
+      argv: [...cli, "exec", "review", "--base", spec.base_branch, "--json", "--ephemeral", "--ignore-user-config", "--ignore-rules", ...c5.flatMap((x) => ["-c", x]), ...spec.model ? ["-m", spec.model] : []],
       env: { CODEX_API_KEY: spec.api_key, CODEX_HOME: o.codexHome }
     };
   }
@@ -48069,8 +48602,8 @@ async function runCodeReviewStep(spec, host) {
   const inputs = await prepareInputs(spec, host);
   if (typeof inputs === "string") return fail("cli_failed", inputs, cli.version);
   host.log(`##[brnch] ${name} reviews ${spec.head_branch} (${spec.head_oid.slice(0, 12)}) against ${spec.base_branch} (${spec.base_oid.slice(0, 12)}); the diff is sent to ${name}`);
-  const c4 = command(spec, cli.argv, inputs);
-  const res = await host.run(c4.argv, { env: { ...host.env, ...c4.env, HOME: host.home, CI: "1", NO_COLOR: "1" }, timeoutMs: spec.timeout_minutes * 6e4, quiet: true });
+  const c5 = command(spec, cli.argv, inputs);
+  const res = await host.run(c5.argv, { env: { ...host.env, ...c5.env, HOME: host.home, CI: "1", NO_COLOR: "1" }, timeoutMs: spec.timeout_minutes * 6e4, quiet: true });
   if (host.cancelled() || res.code === null) return "cancelled";
   const parsed = parse3(spec, res, host.workspace);
   const counts2 = parsed.findings.reduce((acc, f) => ({ ...acc, [f.severity]: (acc[f.severity] ?? 0) + 1 }), {});
@@ -48921,13 +49454,13 @@ var RunnerAgent = class {
       stepUser: this.opts.stepUser ?? null,
       baseEnv: sanitizedEnv(process.env),
       diag: this.opts.log,
-      onRunnerCredential: (c4) => this.rotated(c4),
+      onRunnerCredential: (c5) => this.rotated(c5),
       ...this.opts.fetch ? { fetch: this.opts.fetch } : {}
     });
     this.opts.log(`job ${a.job_id} started: ${a.workflow.name} / ${a.job.name} (${a.repository.full_name}@${a.head_sha.slice(0, 12)})`);
-    const done2 = exec.run().then((c4) => {
-      this.results.push({ job_id: a.job_id, conclusion: c4 });
-      this.opts.log(`job ${a.job_id} finished: ${c4}`);
+    const done2 = exec.run().then((c5) => {
+      this.results.push({ job_id: a.job_id, conclusion: c5 });
+      this.opts.log(`job ${a.job_id} finished: ${c5}`);
     }).catch((e) => {
       this.results.push({ job_id: a.job_id, conclusion: "aborted" });
       this.opts.log(`job ${a.job_id} failed to report: ${e.message}`);
@@ -49696,85 +50229,105 @@ function nodeDeps() {
 }
 
 // packages/cli/src/help.ts
-var c3 = BRAND.cli;
+var c4 = BRAND.cli;
 var EXAMPLES = {
   "": [
-    `${c3} setup                           # first run: sign in, SSH and HTTPS for git, agents, this directory`,
-    `${c3} auth login                      # browser sign-in (OAuth device code) for humans`,
-    `export ${envName("TOKEN")}=\u2026; ${c3} --json auth status   # CI/agents: token from the environment`,
-    `${c3} repo clone acme/web`,
-    `${c3} doctor                          # diagnose install, network and auth`
+    `${c4} setup                           # first run: sign in, SSH and HTTPS for git, agents, this directory`,
+    `${c4} auth login                      # browser sign-in (OAuth device code) for humans`,
+    `export ${envName("TOKEN")}=\u2026; ${c4} --json auth status   # CI/agents: token from the environment`,
+    `${c4} repo clone acme/web`,
+    `${c4} doctor                          # diagnose install, network and auth`
   ],
-  "auth login": [`${c3} auth login                    # another account? log in again: both stay signed in`, `${c3} auth login --scopes repo:read,change:read --no-browser`, `echo "$PAT" | ${c3} auth login --with-token`, `${c3} --url https://brnch.example.com auth login`],
-  "auth status": [`${c3} auth status                   # which account, why, and the others`, `${c3} --json auth status --agent`],
-  "auth logout": [`${c3} auth logout`, `${c3} --account ada-work auth logout   # one of several accounts`],
-  "auth switch": [`${c3} auth switch                   # toggle between two accounts, or pick`, `${c3} auth switch ada-work`],
-  "auth backup-codes": [`${c3} auth backup-codes`, `${c3} --json auth backup-codes`, `${c3} auth backup-codes --regenerate --code 123456`, `${c3} --yes auth backup-codes --regenerate --code - < code.txt`],
-  "auth step-up": [`${c3} auth step-up                  # approve in the browser; admin actions work for 15 minutes`, `${c3} auth step-up --status`, `${c3} auth step-up --end`],
-  "auth git-credential": [`git config --global credential.${BRAND.defaultUrl}.helper '!${c3} auth git-credential'`],
-  "auth setup-git": [`${c3} auth setup-git                # then plain git clone/fetch/push over HTTPS just work`, `${c3} --url https://brnch.example.com auth setup-git`],
-  "repo clone": [`${c3} repo clone acme/web           # SSH once \`${c3} ssh setup\` ran, else HTTPS`, `${c3} repo clone acme/web ./web --https`],
-  "repo list": [`${c3} --org acme repo list              # an organization`, `${c3} --org your-handle repo list        # your personal account`, `${c3} --json --org acme repo list --limit 50`],
-  "repo create": [`${c3} --org acme repo create web        # in the organization acme`, `${c3} --org your-handle repo create notes   # in your personal account`],
-  "org create": [`${c3} org create acme --name "Acme Inc."`],
-  "org list": [`${c3} org list                           # your personal account and organizations`],
-  "org switch": [`${c3} org switch acme                    # commands default to acme`, `${c3} org switch --unset`, `${c3} --account ada-work org switch vigil   # per account`],
-  "org invitations": [`${c3} org invitations`, `${c3} org invitations accept inv_\u2026`],
-  git: [`${c3} git push origin HEAD:refs/heads/topic`, `${c3} git fetch`],
-  "change create": [`${c3} change create --title "Org-scoped API keys" --workspace ws_123`],
-  "change view": [`${c3} change view 12                 # change #12 of the selected repository`, `${c3} --repo acme/web change view '#12'`, `${c3} change view chg_123`],
-  "change readiness": [`${c3} change readiness 12 || echo "blocked (exit $?)"`, `${c3} change readiness chg_123`],
-  "code-review status": [`${c3} code-review status 12`, `${c3} --json code-review status 12 --all`],
-  "code-review wait": [`${c3} code-review wait 12            # then fix each finding and \`${c3} review fix <thread> --change 12\``, `${c3} code-review wait 12 --timeout 600`],
-  "code-review request": [`${c3} code-review request 12`, `${c3} code-review request 12 --provider codex`],
-  "merge request": [`${c3} merge request 12 --wait --json`],
-  "evidence submit": [`${c3} evidence submit --change 12 --check unit-tests --result passed --command "npm test" --exit-code 0`],
-  "session start": [`${c3} --repo acme/web session start --agent agt_123 --scope repo:read,change:write --json`],
-  "agent instructions": [`${c3} agent instructions --tool claude-code`, `${c3} agent instructions --tool codex --write   # into AGENTS.md here, asks first`],
+  "auth login": [`${c4} auth login                    # another account? log in again: both stay signed in`, `${c4} auth login --scopes repo:read,change:read --no-browser`, `echo "$PAT" | ${c4} auth login --with-token`, `${c4} --url https://brnch.example.com auth login`],
+  "auth status": [`${c4} auth status                   # which account, why, and the others`, `${c4} --json auth status --agent`],
+  "auth logout": [`${c4} auth logout`, `${c4} --account ada-work auth logout   # one of several accounts`],
+  "auth switch": [`${c4} auth switch                   # toggle between two accounts, or pick`, `${c4} auth switch ada-work`],
+  "auth backup-codes": [`${c4} auth backup-codes`, `${c4} --json auth backup-codes`, `${c4} auth backup-codes --regenerate --code 123456`, `${c4} --yes auth backup-codes --regenerate --code - < code.txt`],
+  "auth step-up": [`${c4} auth step-up                  # approve in the browser; admin actions work for 15 minutes`, `${c4} auth step-up --status`, `${c4} auth step-up --end`],
+  "auth git-credential": [`git config --global credential.${BRAND.defaultUrl}.helper '!${c4} auth git-credential'`],
+  "auth setup-git": [`${c4} auth setup-git                # then plain git clone/fetch/push over HTTPS just work`, `${c4} --url https://brnch.example.com auth setup-git`],
+  "repo clone": [`${c4} repo clone acme/web           # SSH once \`${c4} ssh setup\` ran, else HTTPS`, `${c4} repo clone acme/web ./web --https`],
+  "repo list": [`${c4} --org acme repo list              # an organization`, `${c4} --org your-handle repo list        # your personal account`, `${c4} --json --org acme repo list --limit 50`],
+  "repo create": [`${c4} --org acme repo create web        # in the organization acme`, `${c4} --org your-handle repo create notes   # in your personal account`],
+  "org create": [`${c4} org create acme --name "Acme Inc."`],
+  "org list": [`${c4} org list                           # your personal account and organizations`],
+  "org switch": [`${c4} org switch acme                    # commands default to acme`, `${c4} org switch --unset`, `${c4} --account ada-work org switch vigil   # per account`],
+  "org invitations": [`${c4} org invitations`, `${c4} org invitations accept inv_\u2026`],
+  git: [`${c4} git push origin HEAD:refs/heads/topic`, `${c4} git fetch`],
+  "change create": [`${c4} change create --title "Org-scoped API keys" --workspace ws_123`],
+  "change view": [`${c4} change view 12                 # change #12 of the selected repository`, `${c4} --repo acme/web change view '#12'`, `${c4} change view chg_123`],
+  "change readiness": [`${c4} change readiness 12 || echo "blocked (exit $?)"`, `${c4} change readiness chg_123`],
+  "code-review status": [`${c4} code-review status 12`, `${c4} --json code-review status 12 --all`],
+  "code-review wait": [`${c4} code-review wait 12            # then fix each finding and \`${c4} review fix <thread> --change 12\``, `${c4} code-review wait 12 --timeout 600`],
+  "code-review request": [`${c4} code-review request 12`, `${c4} code-review request 12 --provider codex`],
+  "merge request": [`${c4} merge request 12 --wait --json`],
+  "evidence submit": [`${c4} evidence submit --change 12 --check unit-tests --result passed --command "npm test" --exit-code 0`],
+  "session start": [`${c4} --repo acme/web session start --agent agt_123 --scope repo:read,change:write --json`],
+  "agent instructions": [`${c4} agent instructions --tool claude-code`, `${c4} agent instructions --tool codex --write   # into AGENTS.md here, asks first`],
   delegate: [
-    `${c3} --repo acme/web delegate issue:12 --agent claude_code --prompt "Keep the public API unchanged" --wait`,
-    `${c3} delegate chg_123 --agent brnch --auto-review --max-iterations 3`,
-    `${c3} delegate task_123 --agent codex --prompt-file brief.md --json`
+    `${c4} --repo acme/web delegate issue:12 --agent claude_code --prompt "Keep the public API unchanged" --wait`,
+    `${c4} delegate chg_123 --agent brnch --auto-review --max-iterations 3`,
+    `${c4} delegate task_123 --agent codex --prompt-file brief.md --json`
+  ],
+  "agents status": [`${c4} agents status dlg_123`, `${c4} --repo acme/web agents status change:7`],
+  "agents ask": [`${c4} agents ask dlg_123 --instructions "Add a test for the empty case" --wait`, `${c4} agents ask dlg_123 --thread thr_1,thr_2`],
+  "agents take-over": [`${c4} agents take-over dlg_123 --reason "finishing by hand"`],
+  "coding-agents set": [`pbpaste | ${c4} --org acme coding-agents set claude_code --key-stdin --enable`, `${c4} --org acme coding-agents set codex --ai-provider aip_123 --enable`],
+  "events watch": [`${c4} --org acme events watch                # new events from now on`, `${c4} --json --org acme events watch --after evt_123   # replay since, then follow`, `${c4} --json events watch --session ses_123`],
+  inbox: [`${c4} inbox                              # unread, most urgent first`, `${c4} inbox list --view all`, `${c4} inbox done 3f9k2a 8c1d0e`, `${c4} inbox snooze 3f9k2a tomorrow`, `${c4} --json inbox watch | jq -c .`],
+  "inbox list": [`${c4} inbox list --view snoozed`, `${c4} --json inbox list --view all --limit 50 | jq '.items[].title'`],
+  "inbox count": [`${c4} inbox count                        # e.g. in a shell prompt`],
+  "inbox read": [`${c4} inbox read 3f9k2a`, `${c4} inbox read --all`],
+  "inbox done": [`${c4} inbox done 3f9k2a 8c1d0e`, `${c4} --yes inbox done --all`],
+  "inbox snooze": [`${c4} inbox snooze 3f9k2a 2h`, `${c4} inbox snooze 3f9k2a next-week`, `${c4} inbox snooze 3f9k2a 2026-10-07`],
+  "inbox mute": [`${c4} inbox mute 3f9k2a                   # no more notifications about that change`],
+  "inbox open": [`${c4} inbox open 3f9k2a`],
+  "inbox watch": [`${c4} inbox watch`, `${c4} --json inbox watch               # one JSON object per line`],
+  notifications: [`${c4} notifications`, `${c4} --org acme notifications get       # what applies in acme`],
+  "notifications set": [
+    `${c4} notifications set mentioned push=off email=digest`,
+    `${c4} notifications set all email=off`,
+    `${c4} --org acme notifications set watching in_app=off   # only in acme`,
+    `${c4} --org acme notifications set --reset`,
+    `${c4} notifications set --digest weekly --digest-hour 9 --tz Europe/Paris`,
+    `${c4} notifications set --quiet-hours 22:00-07:00 --previews off`
   ],
-  "agents status": [`${c3} agents status dlg_123`, `${c3} --repo acme/web agents status change:7`],
-  "agents ask": [`${c3} agents ask dlg_123 --instructions "Add a test for the empty case" --wait`, `${c3} agents ask dlg_123 --thread thr_1,thr_2`],
-  "agents take-over": [`${c3} agents take-over dlg_123 --reason "finishing by hand"`],
-  "coding-agents set": [`pbpaste | ${c3} --org acme coding-agents set claude_code --key-stdin --enable`, `${c3} --org acme coding-agents set codex --ai-provider aip_123 --enable`],
-  "events watch": [`${c3} --json events watch --session ses_123`],
+  "notifications unmute": [`${c4} notifications unmute chg_123`],
+  "notifications devices remove": [`${c4} --yes notifications devices remove push_123`],
   "ssh setup": [
-    `${c3} ssh setup                                   # config, host key, pick + register a key, test, this clone`,
-    `${c3} ssh setup --key ~/.ssh/id_ed25519.pub`,
-    `op read "op://Private/My SSH Key/public key" | ${c3} ssh setup --key -   # 1Password: only the public key`,
-    `${c3} --yes ssh setup --remote                      # also switch this clone's origin to SSH without asking`,
-    `${c3} --account ada-work ssh setup                  # a second account gets its own alias (brnch.io-ada-work)`
+    `${c4} ssh setup                                   # config, host key, pick + register a key, test, this clone`,
+    `${c4} ssh setup --key ~/.ssh/id_ed25519.pub`,
+    `op read "op://Private/My SSH Key/public key" | ${c4} ssh setup --key -   # 1Password: only the public key`,
+    `${c4} --yes ssh setup --remote                      # also switch this clone's origin to SSH without asking`,
+    `${c4} --account ada-work ssh setup                  # a second account gets its own alias (brnch.io-ada-work)`
   ],
-  "ssh test": [`${c3} ssh test`, `${c3} --json ssh test | jq .error.details.problem`],
-  "ssh-key add": [`${c3} ssh-key add ~/.ssh/id_ed25519.pub --title laptop`, `op read "op://Private/My SSH Key/public key" | ${c3} ssh-key add - --title "My SSH Key"`, `${c3} ssh-key add ~/.ssh/id_ed25519.pub --usage auth+signing`],
-  setup: [`${c3} setup`, `${c3} setup --dry-run`, `${c3} --yes setup --org acme --repo-name api --agents claude-code --no-ssh`],
+  "ssh test": [`${c4} ssh test`, `${c4} --json ssh test | jq .error.details.problem`],
+  "ssh-key add": [`${c4} ssh-key add ~/.ssh/id_ed25519.pub --title laptop`, `op read "op://Private/My SSH Key/public key" | ${c4} ssh-key add - --title "My SSH Key"`, `${c4} ssh-key add ~/.ssh/id_ed25519.pub --usage auth+signing`],
+  setup: [`${c4} setup`, `${c4} setup --dry-run`, `${c4} --yes setup --org acme --repo-name api --agents claude-code --no-ssh`],
   "remotes adopt": [
-    `${c3} remotes adopt ~/code --dry-run      # show what would change`,
-    `${c3} remotes adopt ~/code                # switch clones of imported GitHub repositories to ${c3}`,
-    `${c3} --yes remotes adopt . --push         # also fill repositories too large to import`,
-    `${c3} remotes adopt ~/code --undo         # put origin back on GitHub`
+    `${c4} remotes adopt ~/code --dry-run      # show what would change`,
+    `${c4} remotes adopt ~/code                # switch clones of imported GitHub repositories to ${c4}`,
+    `${c4} --yes remotes adopt . --push         # also fill repositories too large to import`,
+    `${c4} remotes adopt ~/code --undo         # put origin back on GitHub`
   ],
-  "hooks install": [`${c3} hooks install`, `${c3} hooks install --agent claude-code --agent codex --git`, `${c3} hooks install --scope project --agent cursor`],
-  "capture wrap": [`${c3} capture wrap --tool aider -- aider src/keys.ts`],
-  decision: [`${c3} decision "Keep legacy keys valid" --reason "clients cannot rotate yet" --file src/keys.ts`],
+  "hooks install": [`${c4} hooks install`, `${c4} hooks install --agent claude-code --agent codex --git`, `${c4} hooks install --scope project --agent cursor`],
+  "capture wrap": [`${c4} capture wrap --tool aider -- aider src/keys.ts`],
+  decision: [`${c4} decision "Keep legacy keys valid" --reason "clients cannot rotate yet" --file src/keys.ts`],
   "deploy setup": [
-    `${c3} --repo acme/web deploy setup --dry-run        # show what it would create`,
-    `${c3} --repo acme/web deploy setup                  # the only connection, account and Wrangler config`,
-    `${c3} deploy setup --config apps/api/wrangler.jsonc --env staging --name staging`
+    `${c4} --repo acme/web deploy setup --dry-run        # show what it would create`,
+    `${c4} --repo acme/web deploy setup                  # the only connection, account and Wrangler config`,
+    `${c4} deploy setup --config apps/api/wrangler.jsonc --env staging --name staging`
   ],
-  "deploy run": [`${c3} deploy run production --wait || echo "deploy failed (exit $?)"`, `${c3} deploy run dpt_123 --commit 0123456789abcdef0123456789abcdef01234567`],
-  "deploy update": [`${c3} deploy update production --build "npm run build:prod"`, `${c3} deploy update production --disable`],
-  "deploy rollback": [`${c3} deploy rollback production --to dpl_123`],
-  version: [`${c3} version`, `${c3} version --json`],
-  upgrade: [`${c3} upgrade --check`, `${c3} upgrade`, `${c3} upgrade --force`],
-  doctor: [`${c3} doctor`, `${c3} doctor --json | jq '.checks[] | select(.status != "ok")'`],
+  "deploy run": [`${c4} deploy run production --wait || echo "deploy failed (exit $?)"`, `${c4} deploy run dpt_123 --commit 0123456789abcdef0123456789abcdef01234567`],
+  "deploy update": [`${c4} deploy update production --build "npm run build:prod"`, `${c4} deploy update production --disable`],
+  "deploy rollback": [`${c4} deploy rollback production --to dpl_123`],
+  version: [`${c4} version`, `${c4} version --json`],
+  upgrade: [`${c4} upgrade --check`, `${c4} upgrade`, `${c4} upgrade --force`],
+  doctor: [`${c4} doctor`, `${c4} doctor --json | jq '.checks[] | select(.status != "ok")'`],
   completion: [
-    `${c3} completion bash > ~/.local/share/bash-completion/completions/${c3}`,
-    `${c3} completion zsh > "\${fpath[1]}/_${c3}"`,
-    `${c3} completion fish > ~/.config/fish/completions/${c3}.fish`
+    `${c4} completion bash > ~/.local/share/bash-completion/completions/${c4}`,
+    `${c4} completion zsh > "\${fpath[1]}/_${c4}"`,
+    `${c4} completion fish > ~/.config/fish/completions/${c4}.fish`
   ]
 };
 function pathOf(cmd) {
@@ -49801,9 +50354,9 @@ var CHECK_TIMEOUT_MS = 1e3;
 function updateCheckFile(env) {
   return join32(dirname18(credentialsPath({ XDG_CONFIG_HOME: env.XDG_CONFIG_HOME, HOME: env.HOME }, BRAND.configDir)), "update-check.json");
 }
-function updateCheckDisabled(deps, state) {
+function updateCheckDisabled(deps, state2) {
   const flag = deps.env[envName("NO_UPDATE_CHECK")];
-  return !!flag && flag !== "0" || !!deps.env.CI || state.json || !!state.noUpdateHint || !deps.stderrIsTTY || !state.baseUrl;
+  return !!flag && flag !== "0" || !!deps.env.CI || state2.json || !!state2.noUpdateHint || !deps.stderrIsTTY || !state2.baseUrl;
 }
 async function readCache(deps, file2) {
   try {
@@ -49813,10 +50366,10 @@ async function readCache(deps, file2) {
   }
   return { version: 1, hosts: {} };
 }
-async function updateHint(deps, state) {
+async function updateHint(deps, state2) {
   try {
-    if (updateCheckDisabled(deps, state)) return;
-    const baseUrl = state.baseUrl;
+    if (updateCheckDisabled(deps, state2)) return;
+    const baseUrl = state2.baseUrl;
     const file2 = updateCheckFile(deps.env);
     const cache = await readCache(deps, file2);
     const key = hostKey(baseUrl);
@@ -49895,6 +50448,8 @@ function buildProgram(rt) {
   registerIntegration(program2, rt);
   registerTooling(program2, rt);
   registerSocial(program2, rt);
+  registerInbox(program2, rt);
+  registerNotifications(program2, rt);
   registerVerify(program2, rt);
   registerStack(program2, rt);
   registerOplog(program2, rt);
@@ -49941,33 +50496,33 @@ function errorPayload(e, secrets) {
   if (e instanceof CliError) return { code: e.code, message: redact(e.message, secrets), details: e.details ?? null };
   return { code: "UNEXPECTED", message: redact(e instanceof Error ? e.message : String(e), secrets) };
 }
-function report2(e, deps, state) {
+function report2(e, deps, state2) {
   if (e instanceof CommanderError) {
     if (e.exitCode === 0 || e.code === "commander.helpDisplayed" || e.code === "commander.version") return EXIT.OK;
-    if (state.json) deps.stdout.write(`${JSON.stringify({ error: { code: "USAGE", message: e.message, exit_code: EXIT.USAGE } }, null, 2)}
+    if (state2.json) deps.stdout.write(`${JSON.stringify({ error: { code: "USAGE", message: e.message, exit_code: EXIT.USAGE } }, null, 2)}
 `);
     return EXIT.USAGE;
   }
   const exitCode = exitCodeFor(e);
-  const payload = errorPayload(e, state.secrets);
-  if (state.json && !state.wroteResult) deps.stdout.write(`${JSON.stringify({ error: { ...payload, exit_code: exitCode } }, null, 2)}
+  const payload = errorPayload(e, state2.secrets);
+  if (state2.json && !state2.wroteResult) deps.stdout.write(`${JSON.stringify({ error: { ...payload, exit_code: exitCode } }, null, 2)}
 `);
   const reqId = "request_id" in payload && payload.request_id ? ` (request ${payload.request_id})` : "";
   deps.stderr.write(`error: ${payload.message} [${payload.code}]${reqId}
 `);
-  if (state.actingAs && isForgeApiError(e) && (e.code === "PERMISSION_DENIED" || e.code === "NOT_FOUND")) {
-    const s = state.actingAs;
+  if (state2.actingAs && isForgeApiError(e) && (e.code === "PERMISSION_DENIED" || e.code === "NOT_FOUND")) {
+    const s = state2.actingAs;
     const sponsor = s.sponsor_name ?? "your sponsor";
     deps.stderr.write(
       `This ran as agent ${s.agent_name} (session ${s.session_id}), which may only use its session scopes in ${s.repo} (${s.scopes.join(" ")}). Approving, merging and administration stay with people: hand this step to ${sponsor}. For a merge, finish pushing, then ask ${sponsor} to use Merge when ready on the change (or \`${BRAND.cli} change auto-merge <change>\` in their own terminal; \`${BRAND.cli} merge agent-changes\` does it once for all their agents' changes in the repository).
 `
     );
   }
-  if (state.accounts && !state.actingAs && isForgeApiError(e) && (e.code === "PERMISSION_DENIED" || e.code === "NOT_FOUND")) {
-    deps.stderr.write(`This ran as ${state.accounts.using}. You are also signed in as ${state.accounts.others.join(", ")}: retry with --account ${state.accounts.others[0]}, or \`${BRAND.cli} auth switch\`.
+  if (state2.accounts && !state2.actingAs && isForgeApiError(e) && (e.code === "PERMISSION_DENIED" || e.code === "NOT_FOUND")) {
+    deps.stderr.write(`This ran as ${state2.accounts.using}. You are also signed in as ${state2.accounts.others.join(", ")}: retry with --account ${state2.accounts.others[0]}, or \`${BRAND.cli} auth switch\`.
 `);
   }
-  if (deps.env[envName("DEBUG")] && e instanceof Error && e.stack) deps.stderr.write(`${redact(e.stack, state.secrets)}
+  if (deps.env[envName("DEBUG")] && e instanceof Error && e.stack) deps.stderr.write(`${redact(e.stack, state2.secrets)}
 `);
   return exitCode;
 }
@@ -49975,22 +50530,22 @@ async function run2(argv, overrides = {}) {
   const merged = { ...nodeDeps(), ...overrides };
   const deps = merged;
   const split = splitGitArgs(argv);
-  const state = { exitCode: EXIT.OK, wroteResult: false, secrets: [], json: wantsJson(split.argv) };
+  const state2 = { exitCode: EXIT.OK, wroteResult: false, secrets: [], json: wantsJson(split.argv) };
   const invoke2 = async (sub, o = {}) => {
     const out = [];
     const code2 = await run2(sub, o.capture ? { ...deps, stdout: { write: (s) => out.push(s) } } : deps);
     return { code: code2, stdout: out.join("") };
   };
-  const program2 = buildProgram({ deps, state, gitArgs: split.gitArgs, invoke: invoke2 });
+  const program2 = buildProgram({ deps, state: state2, gitArgs: split.gitArgs, invoke: invoke2 });
   let code;
   try {
     await program2.parseAsync(split.argv, { from: "user" });
-    code = state.exitCode;
+    code = state2.exitCode;
   } catch (e) {
-    code = report2(e, deps, state);
+    code = report2(e, deps, state2);
   }
-  await saveBookmark(deps, state);
-  await updateHint(deps, state);
+  await saveBookmark(deps, state2);
+  await updateHint(deps, state2);
   return code;
 }