brnch-cli 0.18.2 → 0.19.0

package/brnch.mjs

@@ -6044,9 +6044,9 @@ var require_lexer = __commonJS({
         }
       }
       *parseQuotedScalar() {
-        const quote2 = this.charAt(0);
-        let end2 = this.buffer.indexOf(quote2, this.pos + 1);
-        if (quote2 === "'") {
+        const quote3 = this.charAt(0);
+        let end2 = this.buffer.indexOf(quote3, this.pos + 1);
+        if (quote3 === "'") {
           while (end2 !== -1 && this.buffer[end2 + 1] === "'")
             end2 = this.buffer.indexOf("'", end2 + 2);
         } else {
@@ -9960,7 +9960,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
     const negativeNumberArg = (arg) => {
       if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
       return !this._getCommandAndAncestors().some(
-        (cmd) => cmd.options.map((opt) => opt.short).some((short2) => /^-\d$/.test(short2))
+        (cmd) => cmd.options.map((opt) => opt.short).some((short3) => /^-\d$/.test(short3))
       );
     };
     let activeVariadicOption = null;
@@ -21407,8 +21407,8 @@ var error43 = () => {
       case "not_multiple_of":
         return `N\xFAmero inv\xE1lido: deve ser m\xFAltiplo de ${issue2.divisor}`;
       case "unrecognized_keys": {
-        const plural3 = issue2.keys.length > 1 ? "s" : "";
-        return `Chave${plural3} inv\xE1lida${plural3}: ${joinValues(issue2.keys, ", ")}`;
+        const plural4 = issue2.keys.length > 1 ? "s" : "";
+        return `Chave${plural4} inv\xE1lida${plural4}: ${joinValues(issue2.keys, ", ")}`;
       }
       case "invalid_key":
         return `Entrada inv\xE1lida n${translateOriginWithArticle(issue2.origin, "definite")}`;
@@ -21552,8 +21552,8 @@ var error44 = () => {
       case "not_multiple_of":
         return `N\xFAmero inv\xE1lido: deve ser m\xFAltiplo de ${issue2.divisor}`;
       case "unrecognized_keys": {
-        const plural3 = issue2.keys.length > 1 ? "s" : "";
-        return `Chave${plural3} inv\xE1lida${plural3}: ${joinValues(issue2.keys, ", ")}`;
+        const plural4 = issue2.keys.length > 1 ? "s" : "";
+        return `Chave${plural4} inv\xE1lida${plural4}: ${joinValues(issue2.keys, ", ")}`;
       }
       case "invalid_key":
         return `Entrada inv\xE1lida n${translateOriginWithArticle(issue2.origin, "definite")}`;
@@ -29789,8 +29789,8 @@ function convertBaseSchema(schema, ctx) {
       });
     }
     ctx.processing.add(refPath);
-    const resolved = resolveRef(refPath, ctx);
-    const zodSchema2 = convertSchema(resolved, ctx);
+    const resolved2 = resolveRef(refPath, ctx);
+    const zodSchema2 = convertSchema(resolved2, ctx);
     ctx.refs.set(refPath, zodSchema2);
     ctx.processing.delete(refPath);
     return zodSchema2;
@@ -30572,12 +30572,13 @@ var PLATFORM_TOKEN_PREFIXES = {
   finv: "organization invitation token",
   fsfa: "pending second-factor sign-in",
   fbkc: "Buildkite checkout token",
-  fsvw: "staff read-only view"
+  fsvw: "staff read-only view",
+  fcrt: "container registry token"
 };
 var PLATFORM_TOKEN_RE = new RegExp(`^(${Object.keys(PLATFORM_TOKEN_PREFIXES).join("|")})_[0-9a-f]{64}$`);
 
 // packages/domain/src/capabilities.ts
-var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read"];
+var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read", "migrations:read"];
 var REVIEWER = [...VIEWER, "review:comment", "review:resolve", "review:approve"];
 var DEVELOPER = [
   ...VIEWER,
@@ -30590,9 +30591,11 @@ var DEVELOPER = [
   "review:comment",
   "evidence:report",
   "promotion:request",
-  "packages:write"
+  "packages:write",
+  "deploy:read"
 ];
-var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
+var DEPLOY_AND_MIGRATIONS = ["deploy:write", "deploy:trigger", "deploy:manage", "migrations:manage", "migrations:approve"];
+var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", ...DEPLOY_AND_MIGRATIONS, "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
 var ADMIN = [
   ...MAINTAINER,
   "org:admin",
@@ -31545,15 +31548,15 @@ function redactText(input3, opts = {}) {
     hit("auth-header");
     return `${prefix}${REDACTED}`;
   });
-  text2 = text2.replace(ASSIGNMENT, (w, prefix, quote2, value) => {
+  text2 = text2.replace(ASSIGNMENT, (w, prefix, quote3, value) => {
     if (isReference(value) || value.startsWith(REDACTED)) return w;
     hit("assignment");
-    return `${prefix}${quote2}${REDACTED}${quote2}`;
+    return `${prefix}${quote3}${REDACTED}${quote3}`;
   });
-  text2 = text2.replace(FLAG, (w, prefix, quote2, value) => {
+  text2 = text2.replace(FLAG, (w, prefix, quote3, value) => {
     if (isReference(value) || value.startsWith(REDACTED)) return w;
     hit("flag");
-    return `${prefix}${quote2}${REDACTED}${quote2}`;
+    return `${prefix}${quote3}${REDACTED}${quote3}`;
   });
   if (opts.entropy !== false) {
     text2 = text2.replace(TOKENISH, (w) => {
@@ -31632,6 +31635,7 @@ var looksLikeHostedLabel = (label2) => /^brnch-hosted(?:-|$)/.test(label2);
 // packages/domain/src/deploy.ts
 var DEPLOY_LIMITS = {
   maxStepsPerTarget: 12,
+  maxWatchPaths: 50,
   maxTargetsPerRepository: 10,
   maxCommandLength: 2e3,
   maxSummaryLength: 500,
@@ -31645,6 +31649,21 @@ var DEPLOY_LIMITS = {
 var DEPLOY_RUNNER_LABELS = HOSTED_SIZES.map((s) => HOSTED_SIZE_SPECS[s].label);
 var DEFAULT_DEPLOY_RUNNER = HOSTED_SIZE_SPECS.basic.label;
 
+// packages/domain/src/db-migrations.ts
+var DB_MIGRATION_LIMITS = {
+  sourcesPerRepo: 20,
+  /** Migration files read from one directory. */
+  files: 2e3,
+  fileBytes: 1024 * 1024,
+  dirBytes: 16 * 1024 * 1024,
+  /** Per statement; queue work is bounded by the platform's 15-minute limit. */
+  statementTimeoutMaxS: 600,
+  lockTimeoutMaxS: 60,
+  sessionSettings: 20,
+  /** How long a worker holds a run before another may take it over. */
+  leaseMs: 15 * 6e4
+};
+
 // packages/domain/src/isolated-preview.ts
 function parseJsonc(text2) {
   let out = "";
@@ -31683,6 +31702,8 @@ var DELEGATION_MATRIX = Object.freeze({
   "cloudflare/resources": { userToOrg: false, userToRepo: false, orgToRepo: true },
   "cloudflare/d1_migrations": { userToOrg: false, userToRepo: false, orgToRepo: true },
   "cloudflare/secrets_store": { userToOrg: false, userToRepo: false, orgToRepo: true },
+  // Database migrations (ADR-0084) apply one repository's migration directory to the PlanetScale database it is bound to.
+  "planetscale/db_migrations": { userToOrg: false, userToRepo: false, orgToRepo: true },
   // A secret source is read by a repository's workflow runs.
   "infisical/secrets_source": { userToOrg: false, userToRepo: false, orgToRepo: true },
   // AI code review keys (ADR-0051): an organization's key reviews the changes of its repositories.
@@ -31734,7 +31755,7 @@ var PLANS = Object.freeze({
     monthly_cents: 800,
     annual_cents: 8e3,
     per_seat: false,
-    features: ["private_review_rules", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "assistant"],
+    features: ["private_review_rules", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "assistant"],
     minutes_base: 5e3,
     minutes_per_seat: 0,
     concurrent_hosted_jobs: 4,
@@ -31753,7 +31774,7 @@ var PLANS = Object.freeze({
     monthly_cents: 1e3,
     annual_cents: 9600,
     per_seat: true,
-    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
+    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
     minutes_base: 3e3,
     minutes_per_seat: 1e3,
     concurrent_hosted_jobs: 10,
@@ -31772,7 +31793,7 @@ var PLANS = Object.freeze({
     monthly_cents: null,
     annual_cents: null,
     per_seat: true,
-    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
+    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
     minutes_base: 5e4,
     minutes_per_seat: 0,
     concurrent_hosted_jobs: 50,
@@ -32140,12 +32161,16 @@ var CreateInvitationRequest = external_exports.object({ email: external_exports.
 var AcceptInvitationRequest = external_exports.object({ token: external_exports.string() });
 var CreateTeamRequest = external_exports.object({ slug: Slug, name: displayLine().min(1).max(100) });
 var AddTeamMemberRequest = external_exports.object({ user_id: external_exports.string() });
+var GrantExtraCapabilitySchema = external_exports.enum(["deploy:read", "deploy:trigger", "deploy:manage", "migrations:read", "migrations:manage", "migrations:approve"]);
 var CreateGrantRequest = external_exports.object({
   principal_type: external_exports.enum(["user", "team"]),
   principal_id: external_exports.string().min(1).max(100),
   role: RepoGrantRoleSchema,
+  /** Beyond the role, e.g. a developers team that approves a database's migrations. */
+  capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6).optional(),
   expires_at: external_exports.iso.datetime().nullable().optional()
 });
+var UpdateGrantRequest = external_exports.object({ capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6) });
 var CreateRepoRequest = external_exports.object({
   name: RepoName,
   description: displayText().max(500).default(""),
@@ -32234,11 +32259,16 @@ var PolicyRulesSchema = external_exports.object({
 });
 var AdoptPolicyRequest = external_exports.object({ rules: PolicyRulesSchema, expected_version: external_exports.number().int().nonnegative(), note: external_exports.string().max(1e3).optional() });
 var ApplySecureDefaultsRequest = external_exports.object({ expected_version: external_exports.number().int().nonnegative() });
+var MAX_TASK_BLOCKERS = 50;
+var TaskRef = external_exports.union([external_exports.number().int().positive(), external_exports.string().trim().regex(/^(task_[0-9a-z]{1,64}|#?\d{1,9})$/, "expected a task number (12 or #12) or a task_\u2026 id")]);
+var blockedBy = external_exports.array(TaskRef).max(MAX_TASK_BLOCKERS);
 var CreateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300),
   description: external_exports.string().max(65536).default(""),
   acceptance_criteria: external_exports.array(external_exports.string().max(1e3)).max(100).default([]),
-  labels: external_exports.array(external_exports.string().max(50)).max(20).default([])
+  labels: external_exports.array(external_exports.string().max(50)).max(20).default([]),
+  /** Tasks in the same repository this one is blocked by. */
+  blocked_by: blockedBy.default([])
 });
 var UpdateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300).optional(),
@@ -32247,8 +32277,13 @@ var UpdateTaskRequest = external_exports.object({
   labels: external_exports.array(external_exports.string().max(50)).max(20).optional(),
   state: external_exports.enum(["open", "in_progress", "blocked", "done", "cancelled"]).optional(),
   owner_id: external_exports.string().nullable().optional(),
+  /** Replaces the whole set of blockers. Links are not task fields: changing them alone leaves `version` as it is. */
+  blocked_by: blockedBy.optional(),
   version: external_exports.number().int()
 });
+var AddTaskDependencyRequest = external_exports.object({ blocker: TaskRef });
+var TaskListQuery = external_exports.object({ ready: external_exports.enum(["true", "false"]).optional().transform((v) => v === void 0 ? void 0 : v === "true") });
+var TaskNumberParam = external_exports.coerce.number().int().positive().max(999999999);
 var ClaimTaskRequest = external_exports.object({ session_id: external_exports.string().optional() });
 var AddLinkRequest = external_exports.object({ kind: external_exports.enum(["external", "change", "task"]), url: external_exports.url().optional(), target_id: external_exports.string().optional(), title: external_exports.string().max(300).optional() });
 var CreateCommentRequest = external_exports.object({ body: external_exports.string().min(1).max(65536) });
@@ -32864,6 +32899,22 @@ var ActionsSettingsRequest = external_exports.object({
   allow_untrusted_jobs_on_self_hosted_runners: external_exports.boolean().optional()
 });
 var RunnerLabel = external_exports.string().min(1).max(50).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "letters, digits, '.', '_' and '-'");
+var ResourceBytes = external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var RunnerResourceSnapshot = external_exports.object({
+  cpu_percent: external_exports.number().min(0).max(100).nullable(),
+  cpu_count: external_exports.number().int().min(1).max(65536),
+  cpu_interval_ms: external_exports.number().int().min(1).max(6e5).nullable(),
+  memory_total_bytes: ResourceBytes.positive(),
+  memory_available_bytes: ResourceBytes,
+  disk_total_bytes: ResourceBytes.positive().nullable(),
+  disk_available_bytes: ResourceBytes.nullable(),
+  uptime_seconds: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  job_slots: external_exports.number().int().min(1).max(32)
+}).strict().superRefine((s, ctx) => {
+  if (s.memory_available_bytes > s.memory_total_bytes) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["memory_available_bytes"], message: "available memory exceeds total memory" });
+  if (s.disk_total_bytes === null !== (s.disk_available_bytes === null) || s.disk_available_bytes !== null && s.disk_available_bytes > s.disk_total_bytes) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["disk_available_bytes"], message: "disk readings must be a valid pair" });
+  if (s.cpu_percent === null !== (s.cpu_interval_ms === null)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["cpu_interval_ms"], message: "CPU usage requires a sample interval" });
+});
 var TestRunnerRequest = external_exports.object({
   repository_id: external_exports.string().max(64).nullable().default(null)
 });
@@ -32888,8 +32939,9 @@ var PollJobsRequest = external_exports.object({
   wait_seconds: external_exports.number().int().min(0).max(25).default(20)
 });
 var HeartbeatRequest = external_exports.object({
-  running_jobs: external_exports.array(external_exports.string().max(64)).max(32).default([])
-});
+  running_jobs: external_exports.array(external_exports.string().max(64)).max(32).default([]),
+  resources: RunnerResourceSnapshot.optional()
+}).strict();
 var StepUpdateRequest = external_exports.object({
   name: external_exports.string().max(500),
   status: external_exports.enum(["in_progress", "completed"]),
@@ -33618,7 +33670,7 @@ var CODING_AGENT_SESSION_SCOPES = [
 var EnsureCodingAgentRequest = external_exports.object({ tool: external_exports.enum(AGENT_RUNTIMES) }).strict();
 
 // packages/protocol/src/connections.ts
-var CONNECTION_PURPOSES = ["impact", "secrets_store", "import", "secrets_source", "deploy", "resources", "d1_migrations", "code_review"];
+var CONNECTION_PURPOSES = ["impact", "secrets_store", "import", "secrets_source", "deploy", "resources", "d1_migrations", "db_migrations", "code_review"];
 var Name3 = external_exports.string().trim().min(1).max(100);
 var Secret2 = external_exports.string().min(1).max(4e3);
 var Id2 = external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/, "letters, digits, '.', '_', ':' and '-' only");
@@ -33657,9 +33709,10 @@ var CreateConnectionRequest = external_exports.discriminatedUnion("auth", [
     auth: external_exports.literal("api_token"),
     // Cloudflare API tokens (impact, secrets_store, deploy), GitHub fine-grained personal access tokens (import) and
     // AI code review keys (code_review, ADR-0051): CodeRabbit, Greptile, an OpenAI key for Codex, an Anthropic key for
-    // Claude Code. The provider/purpose pair is checked server-side.
-    provider: external_exports.enum(["cloudflare", "github", "coderabbit", "greptile", "codex", "claude"]),
-    purpose: external_exports.enum(["impact", "secrets_store", "import", "deploy", "resources", "d1_migrations", "code_review"]),
+    // Claude Code, a PlanetScale service token (`<id>:<token>`, db_migrations). The provider/purpose pair is checked
+    // server-side.
+    provider: external_exports.enum(["cloudflare", "planetscale", "github", "coderabbit", "greptile", "codex", "claude"]),
+    purpose: external_exports.enum(["impact", "secrets_store", "import", "deploy", "resources", "d1_migrations", "db_migrations", "code_review"]),
     name: Name3,
     credentials: external_exports.object({ api_token: Secret2 })
   }),
@@ -33762,6 +33815,11 @@ var targetFields = {
   preview_check_name: external_exports.string().trim().min(1).max(100).nullable(),
   /** The hosted runner size the deploy jobs run on, by its `runs-on` label: `brnch-hosted` … `brnch-hosted-4` (ADR-0066). */
   runs_on: external_exports.string().trim().min(1).max(40),
+  /**
+   * Paths whose changes deploy the target (CODEOWNERS patterns such as `apps/web/` or `packages/**`, `!` excludes; the
+   * last matching pattern decides). Empty: every change deploys it.
+   */
+  watch_paths: external_exports.array(external_exports.string().trim().min(1).max(500)).max(50),
   steps: external_exports.array(DeployStepSpecBody).max(12)
 };
 var CreateDeployTargetRequest = external_exports.object({
@@ -33779,6 +33837,7 @@ var CreateDeployTargetRequest = external_exports.object({
   preview_agent_changes: targetFields.preview_agent_changes.default(false),
   preview_check_name: targetFields.preview_check_name.default(null),
   runs_on: targetFields.runs_on.default("brnch-hosted"),
+  watch_paths: targetFields.watch_paths.default([]),
   steps: targetFields.steps.default([])
 });
 var UpdateDeployTargetRequest = external_exports.object(targetFields).partial().extend({
@@ -33844,6 +33903,111 @@ var UpsertWorkerEnvRequest = external_exports.object({
   if (v.kind === "var" && v.source !== "value") c8.addIssue({ code: "custom", message: "plain vars take a value", path: ["source"] });
 });
 
+// packages/protocol/src/db-migrations.ts
+var DB_EXEC_ORDERS = ["linear", "linear_skip", "non_linear"];
+var DB_CREDENTIAL_MODES = ["managed_role", "dsn", "branch_password"];
+var DB_APPLY_ON = ["merge", "deploy", "manual"];
+var DB_LINT_LEVELS = ["error", "warning", "off"];
+var DB_DRIFT_MODES = ["off", "on_run", "daily"];
+var DbLintPolicySchema = external_exports.object({
+  levels: external_exports.record(external_exports.string().regex(/^[A-Za-z0-9_]{1,40}$/), external_exports.enum(DB_LINT_LEVELS)).refine((r) => Object.keys(r).length <= 50, "at most 50 entries").default({}),
+  nolint: external_exports.enum(["honor", "ignore"]).default("honor"),
+  /** Drift found by the last check fails the deploy's migrations step. */
+  drift_blocks_deploy: external_exports.boolean().default(false)
+});
+var Ident2 = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_$]{0,62}$/, "letters, digits and _ only (at most 63)");
+var PsName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/, "a PlanetScale name: letters, digits, '.', '_' and '-'");
+var SourceFields = {
+  name: external_exports.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9_-]*$/, "lowercase letters, digits, - and _"),
+  /** Directory relative to the repository root ("" = the root). */
+  path: external_exports.string().max(300),
+  /** `wrangler` directories are D1 sources, which come from the Wrangler configuration. */
+  format: external_exports.enum(["atlas", "plain", "golang_migrate", "drizzle", "prisma"]),
+  engine: external_exports.enum(["postgres", "vitess"]),
+  /** Branch whose merges create runs; the repository's default branch when omitted. */
+  branch: external_exports.string().min(1).max(200).optional(),
+  /** PlanetScale connection (purpose `db_migrations`) of the organization or the repository. */
+  connection_id: external_exports.string().min(1).max(64),
+  ps_organization: PsName,
+  ps_database: PsName,
+  /** The production branch migrations are applied to. */
+  ps_branch: PsName.default("main"),
+  /** Where the format's revisions table lives (Postgres schema; Atlas default `atlas_schema_revisions`). */
+  revisions_schema: Ident2.nullable().default(null),
+  revisions_table: Ident2.nullable().default(null),
+  /** With no revision history yet, record this version as a baseline instead of applying files up to it. */
+  baseline_version: external_exports.string().min(1).max(100).nullable().default(null),
+  exec_order: external_exports.enum(DB_EXEC_ORDERS).default("linear"),
+  /** Postgres session settings for migration sessions (`lock_timeout`, custom `prefix.name`, …). */
+  session_settings: external_exports.record(external_exports.string().max(126), external_exports.string().max(500)).default({}),
+  statement_timeout_s: external_exports.number().int().min(1).max(600).default(300),
+  lock_timeout_s: external_exports.number().int().min(1).max(60).default(10),
+  credential_mode: external_exports.enum(DB_CREDENTIAL_MODES).optional(),
+  /** Postgres: the role new objects belong to (`SET ROLE`); `postgres` by default for managed roles, none for a DSN. */
+  run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable().optional(),
+  /** Deprecated: `apply_on` (`approval` = `merge`, `manual_only` = `manual`). */
+  on_merge: external_exports.enum(["approval", "manual_only"]).optional(),
+  apply_on: external_exports.enum(DB_APPLY_ON).optional(),
+  /** `deploy` and `manual` only: whether a person approves before anything is applied (`merge` always requires it). */
+  require_approval: external_exports.boolean().optional(),
+  /** Validate the directory on changes (evidence `migrations/<name>`). */
+  change_checks: external_exports.boolean().default(true),
+  lint: DbLintPolicySchema.optional(),
+  drift_mode: external_exports.enum(DB_DRIFT_MODES).optional()
+};
+var CreateDbMigrationSourceRequest = external_exports.object({
+  /** Only PlanetScale sources are created here: D1 sources come from the Wrangler configuration. */
+  provider: external_exports.literal("planetscale").default("planetscale"),
+  ...SourceFields,
+  /** Postgres `credential_mode: dsn` only: `postgresql://user:password@host:5432/db?sslmode=verify-full`. Write-only. */
+  dsn: external_exports.string().min(10).max(2e3).optional()
+});
+var UpdateDbMigrationSourceRequest = external_exports.object({
+  path: SourceFields.path,
+  branch: SourceFields.branch,
+  connection_id: SourceFields.connection_id,
+  ps_organization: SourceFields.ps_organization,
+  ps_database: SourceFields.ps_database,
+  ps_branch: PsName,
+  revisions_schema: Ident2.nullable(),
+  revisions_table: Ident2.nullable(),
+  baseline_version: external_exports.string().min(1).max(100).nullable(),
+  exec_order: external_exports.enum(DB_EXEC_ORDERS),
+  session_settings: external_exports.record(external_exports.string().max(126), external_exports.string().max(500)),
+  statement_timeout_s: SourceFields.statement_timeout_s.unwrap(),
+  lock_timeout_s: SourceFields.lock_timeout_s.unwrap(),
+  credential_mode: external_exports.enum(DB_CREDENTIAL_MODES),
+  run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable(),
+  on_merge: external_exports.enum(["approval", "manual_only"]),
+  apply_on: external_exports.enum(DB_APPLY_ON),
+  require_approval: external_exports.boolean(),
+  change_checks: external_exports.boolean(),
+  lint: DbLintPolicySchema,
+  drift_mode: external_exports.enum(DB_DRIFT_MODES),
+  state: external_exports.enum(["active", "disabled"]),
+  dsn: external_exports.string().min(10).max(2e3).nullable()
+}).partial().extend({ version: external_exports.number().int().min(1) });
+var StartDbMigrationRunRequest = external_exports.object({
+  /** Branch, tag or commit to apply; the source's branch when omitted. */
+  ref: external_exports.string().min(1).max(200).optional()
+});
+var DecideDbMigrationRunRequest = external_exports.object({
+  reason: external_exports.string().max(500).optional(),
+  /** Approving a run a deploy waits on: redeploy that deploy at the same commit once the run succeeds. */
+  redeploy: external_exports.boolean().optional()
+});
+
+// packages/protocol/src/approvals.ts
+var PutApprovalRuleRequest = external_exports.object({
+  required: external_exports.number().int().min(1).max(10),
+  users: external_exports.array(external_exports.string().min(1).max(100)).max(20).default([]),
+  teams: external_exports.array(external_exports.string().min(1).max(100)).max(10).default([]),
+  separation_of_duties: external_exports.boolean().default(false),
+  /** The rule's version when replacing one (optimistic concurrency); omit to create. */
+  version: external_exports.number().int().positive().optional()
+});
+var DecideDeploymentRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
+
 // packages/protocol/src/buildkite.ts
 var BUILDKITE_TRUST_MODES = ["contributor_controlled", "pipeline_settings", "target_ref_upload"];
 var Slug3 = external_exports.string().trim().min(1).max(100).regex(/^[a-z0-9][a-z0-9-_]*$/i, "a Buildkite slug (letters, digits, '-' and '_')");
@@ -36185,6 +36349,8 @@ function reposGroup(t) {
     grants: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/grants`, query: { ...q }, options: o }),
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/grants`, json: validate2(CreateGrantRequest, body, "CreateGrantRequest"), options: o }),
+      /** Replace the capabilities the grant carries beyond its role (ADR-0088), e.g. `["migrations:approve"]`. */
+      update: (repo, grant, body, o) => t.json({ method: "PATCH", path: path2`/v1/repos/${repo}/grants/${grant}`, json: validate2(UpdateGrantRequest, body, "UpdateGrantRequest"), options: o }),
       delete: (repo, grant, o) => t.void({ method: "DELETE", path: path2`/v1/repos/${repo}/grants/${grant}`, options: o })
     }
   };
@@ -36387,9 +36553,13 @@ function delegationsGroup(t) {
 function tasksGroup(t) {
   return {
     create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/tasks`, json: validate2(CreateTaskRequest, body, "CreateTaskRequest"), options: o }),
-    /** `label` (name or id) and `assignee` (handle or user id) filter the list. */
+    /**
+     * `label` (name or id) and `assignee` (handle or user id) filter the list. `ready: true` keeps only the frontier:
+     * open tasks whose blockers are all done or cancelled (`false`: every other task).
+     */
     list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks`, query: { ...q }, options: o }),
     get: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}`, options: o }),
+    byNumber: (repo, number4, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks/by-number/${number4}`, options: o }),
     /** `version` is required: a stale version fails with VERSION_CONFLICT instead of overwriting someone else's edit. */
     update: (task, body, o) => t.json({ method: "PATCH", path: path2`/v1/tasks/${task}`, json: validate2(UpdateTaskRequest, body, "UpdateTaskRequest"), options: o }),
     /** Advisory claim; CONFLICT when someone else holds it. */
@@ -36399,10 +36569,64 @@ function tasksGroup(t) {
       create: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/comments`, json: validate2(CreateCommentRequest, body, "CreateCommentRequest"), options: o }),
       list: (task, q = {}, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/comments`, query: { ...q }, options: o })
     },
+    /** "Blocked by" links within the task's repository (ADR-0089). A blocker is a task number or `task_…` id. */
+    dependencies: {
+      list: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/dependencies`, options: o }),
+      /** Idempotent: adding an existing link changes nothing. CYCLE_DETECTED if the blocker already waits on this task. */
+      add: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/dependencies`, json: validate2(AddTaskDependencyRequest, body, "AddTaskDependencyRequest"), options: o }),
+      remove: (task, blocker, o) => t.void({ method: "DELETE", path: path2`/v1/tasks/${task}/dependencies/${String(blocker)}`, options: o })
+    },
     addLink: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/links`, json: validate2(AddLinkRequest, body, "AddLinkRequest"), options: o })
   };
 }
 
+// packages/sdk/src/groups/db-migrations.ts
+function dbMigrationsGroup(t) {
+  const decide = (decision) => (id2, reason, o) => {
+    const body = typeof reason === "string" ? { reason } : { ...reason?.reason ? { reason: reason.reason } : {}, ...reason?.redeploy ? { redeploy: true } : {} };
+    return t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, body, "DecideDbMigrationRunRequest"), options: o });
+  };
+  return {
+    sources: {
+      list: (repo, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/sources`, options: o }),
+      create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/db-migrations/sources`, json: validate2(CreateDbMigrationSourceRequest, body, "CreateDbMigrationSourceRequest"), options: o }),
+      get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
+      update: (id2, body, o) => t.json({ method: "PATCH", path: path2`/v1/db-migration-sources/${id2}`, json: validate2(UpdateDbMigrationSourceRequest, body, "UpdateDbMigrationSourceRequest"), options: o }),
+      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
+      /** Who may approve the source's runs now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}/approvers`, options: o }),
+      /** Protect the database: every run waits for these approvals, and it can no longer apply without approval. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, options: o })
+    },
+    /** Migration directories found in the repository tree; `configured` marks those a source already covers. */
+    suggestions: (repo, ref, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/suggestions`, query: ref ? { ref } : {}, options: o }),
+    /** What applying the source at `ref` would do. `live` reads the database now instead of the last snapshot. */
+    plan: (sourceId2, q = {}, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/plan`, query: { ref: q.ref, live: q.live ? "true" : void 0 }, options: o }),
+    /** The schema the source's migrations produce at `ref` (the source's branch by default), from replaying them. */
+    schema: (sourceId2, ref, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/schema`, query: ref ? { ref } : {}, options: o }),
+    /** Compares the database with what its applied migrations produce, now, and stores the result (admins). */
+    checkDrift: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/drift`, options: o }),
+    /** Reads the applied versions from the database again and returns the plan at the source's branch. */
+    refresh: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/refresh`, options: o }),
+    /**
+     * A manual run (`migrations:manage`). The request is the approval when the caller also holds `migrations:approve` and
+     * the source is not protected; otherwise the run waits for approval. `run` is null when nothing is pending.
+     */
+    startRun: (sourceId2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/runs`, json: validate2(StartDbMigrationRunRequest, body, "StartDbMigrationRunRequest"), options: o }),
+    runs: {
+      list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/runs`, query: { ...q }, options: o }),
+      get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-runs/${id2}`, options: o })
+    },
+    approve: decide("approve"),
+    reject: decide("reject"),
+    retry: decide("retry"),
+    cancel: decide("cancel"),
+    /** The plan of every source a change touches: the files the change adds (with statements), lint, schema effect. */
+    changePlans: (changeId, o) => t.json({ method: "GET", path: path2`/v1/changes/${changeId}/db-migrations`, options: o })
+  };
+}
+
 // packages/sdk/src/groups/deploy.ts
 function deployGroup(t) {
   return {
@@ -36420,12 +36644,22 @@ function deployGroup(t) {
       remove: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}`, options: o }),
       /** Deploy the branch head again (or a commit this target deployed before). */
       deploy: (id2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/deploy`, json: validate2(RedeployRequest, body, "RedeployRequest"), options: o }),
-      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o })
+      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o }),
+      /** Who may approve the target's production deploys now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/deploy-targets/${id2}/approvers`, options: o }),
+      /** Protect the target: production deploys and rollbacks wait for these approvals. Pass `version` to replace a rule. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/deploy-targets/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      /** Remove the rule; deploys waiting for it go on. */
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}/approval-rule`, options: o })
     },
     deployments: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deployments`, query: { ...q }, options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/deployments/${id2}`, options: o }),
       cancel: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/cancel`, options: o }),
+      /** Approve a deploy of a protected target (people only; the last approval needed starts it). */
+      approve: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/approve`, json: {}, options: o }),
+      /** Reject it: the deployment is cancelled. */
+      reject: (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/reject`, json: validate2(DecideDeploymentRequest, reason ? { reason } : {}, "DecideDeploymentRequest"), options: o }),
       ofChange: (change, o) => t.json({ method: "GET", path: path2`/v1/changes/${change}/deployments`, options: o })
     }
   };
@@ -36475,6 +36709,8 @@ function packagesGroup(t) {
     list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/packages`, query: { ...q }, options: o }),
     get: (image, o) => t.json({ method: "GET", path: path2`/v1/packages/${image}`, options: o }),
     versions: (image, q = {}, o) => t.json({ method: "GET", path: path2`/v1/packages/${image}/versions`, query: { ...q }, options: o }),
+    /** Deletes an image with no versions left (`CONFLICT` otherwise). */
+    delete: (image, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}`, options: o }),
     deleteVersion: (image, digest, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}/versions/${digest}`, options: o }),
     deleteTag: (image, tag, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}/tags/${tag}`, options: o }),
     usage: (org, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}/registry`, options: o }),
@@ -36569,6 +36805,7 @@ function createClient(options) {
     secretSyncs: secretSyncsGroup(t),
     grants: grantsGroup(t),
     deploy: deployGroup(t),
+    dbMigrations: dbMigrationsGroup(t),
     codeReview: codeReviewGroup(t),
     releases: releasesGroup(t),
     packages: packagesGroup(t),
@@ -36901,7 +37138,7 @@ function invalidAgentToolFlag(flag) {
 }
 
 // packages/cli/package.json
-var version2 = "0.18.2";
+var version2 = "0.19.0";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -38638,18 +38875,13 @@ async function gitConfigPath(deps) {
 }
 
 // packages/cli/src/work-ref.ts
-var MAX_PAGES = 20;
-var PAGE = 100;
 async function issueByNumber(client, repo, n) {
-  let cursor2;
-  for (let i = 0; i < MAX_PAGES; i++) {
-    const page = await client.tasks.list(repo, { limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
-    const hit = page.items.find((t) => t.number === n);
-    if (hit) return hit.id;
-    if (!page.next_cursor) return null;
-    cursor2 = page.next_cursor;
+  try {
+    return (await client.tasks.byNumber(repo, n)).id;
+  } catch (e) {
+    if (isBrnchApiError(e) && e.code === "NOT_FOUND") return null;
+    throw e;
   }
-  return null;
 }
 async function changeByNumber(client, repo, n) {
   try {
@@ -38675,6 +38907,21 @@ async function resolveChangeId(spec, client, repo) {
   if (!id2) throw notFound(`change #${n}`, repo.spec());
   return id2;
 }
+var TASK_ARG = "task number (12 or #12) in --repo, or a task_\u2026 id";
+async function resolveTaskId(spec, client, repo) {
+  const text2 = spec.trim();
+  const rest = text2.startsWith("issue:") ? text2.slice("issue:".length) : text2;
+  if (rest.startsWith("task_")) return rest;
+  const digits = /^#?(\d{1,9})$/.exec(rest)?.[1];
+  if (!digits) {
+    if (rest.startsWith("chg_") || rest.startsWith("change:")) throw usage(`${spec} is a change, not a task`);
+    throw usage(`cannot read task "${spec}": expected a number (12 or #12) or a task_\u2026 id`);
+  }
+  const n = Number(digits);
+  const id2 = await issueByNumber(client, await repo.id(), n);
+  if (!id2) throw notFound(`task #${n}`, repo.spec());
+  return id2;
+}
 async function resolveWorkRef(spec, client, repoId) {
   const m = /^(issue|change):(.+)$/.exec(spec.trim());
   const kind = m?.[1] ?? null;
@@ -38972,6 +39219,67 @@ ${final.join("\n")}
   deps.stderr.write("\n");
 }
 
+// packages/cli/src/program-status.ts
+var MSG_MAX_BYTES = 512;
+function encodeMsg(text2) {
+  let line2 = text2.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
+  const enc3 = new TextEncoder();
+  while (enc3.encode(line2).length > MSG_MAX_BYTES) line2 = [...line2].slice(0, -1).join("");
+  return Buffer.from(line2, "utf8").toString("base64");
+}
+function programStatus(r) {
+  const pairs = [`state=${r.state}`, `app=${BRAND.cli}`];
+  if (r.state === "blocked") pairs.push(`kind=${r.kind}`);
+  if (r.state === "working" && r.progress !== void 0 && Number.isFinite(r.progress)) pairs.push(`progress=${Math.min(100, Math.max(0, Math.round(r.progress)))}`);
+  if (r.msg) pairs.push(`msg=${encodeMsg(r.msg)}`);
+  return `\x1B]7501;${pairs.join(":")}\x1B\\`;
+}
+function programStatusEnabled(deps, agent) {
+  const off = deps.env[envName("PROGRAM_STATUS")]?.trim().toLowerCase();
+  if (off === "0" || off === "false" || off === "off" || off === "no") return false;
+  return deps.stderrIsTTY && !agent && !deps.env.CI && deps.env.TERM !== "dumb";
+}
+var silentStatus = {
+  working: () => {
+  },
+  blocked: () => {
+  },
+  ask: () => () => {
+  },
+  finish: () => {
+  }
+};
+function statusReporter(out) {
+  let current = null;
+  let waited = false;
+  let last = "";
+  const send = (r) => {
+    const s = programStatus(r);
+    if (s === last) return;
+    last = s;
+    out.write(s);
+  };
+  const report3 = (r) => {
+    current = r;
+    waited = true;
+    send(r);
+  };
+  return {
+    working: (msg, progress) => report3({ state: "working", msg, ...progress !== void 0 ? { progress } : {} }),
+    blocked: (kind, msg) => report3({ state: "blocked", kind, msg }),
+    ask() {
+      send({ state: "blocked", kind: "question", msg: "Waiting for your answer" });
+      return () => send(current ?? { state: "working" });
+    },
+    finish(ok, msg) {
+      if (!waited) return;
+      send({ state: ok ? "done" : "error", msg });
+      waited = false;
+      current = null;
+    }
+  };
+}
+
 // packages/cli/src/context.ts
 async function findProjectFile(deps) {
   let dir = deps.cwd;
@@ -39239,6 +39547,9 @@ async function createContext(deps, globals, state2) {
   function changeId(spec, pref = "agent") {
     return resolveChangeId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
   }
+  function taskId(spec, pref = "agent") {
+    return resolveTaskId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
+  }
   function org() {
     const o = targetOrg ?? storedCred?.account?.default_org;
     if (!o) {
@@ -39309,6 +39620,7 @@ async function createContext(deps, globals, state2) {
     repoSpec,
     repoId,
     changeId,
+    taskId,
     org,
     sessionId,
     info,
@@ -39316,6 +39628,8 @@ async function createContext(deps, globals, state2) {
     busy: (label2) => {
       if (motion) state2.spinner?.start(label2);
     },
+    /** Tell the terminal what the command waits on (program-status.ts): the server (`working`) or the person (`blocked`). */
+    status: state2.status ?? silentStatus,
     /** Clear the spinner before handing the terminal to something that does not write through `deps` (rt.invoke). */
     idle: () => state2.spinner?.stop(),
     result,
@@ -39426,6 +39740,15 @@ function cell(v) {
   if (typeof v === "number" || typeof v === "boolean") return String(v);
   return JSON.stringify(v);
 }
+function actorLabel(a) {
+  const person = a.handle ? `@${a.handle}` : a.user_name ?? null;
+  if (a.type === "human") return person ?? a.display_name ?? `${a.type} ${a.id}`;
+  if (a.type === "agent") {
+    const name = a.display_name ?? `agent ${a.id}`;
+    return person ? `${name} (agent for ${person})` : name;
+  }
+  return a.display_name ?? `${a.type} ${a.id}`;
+}
 var tildePath = (path3, home2) => home2 && path3.startsWith(`${home2}/`) ? `~${path3.slice(home2.length)}` : path3;
 function kv(obj3, keys) {
   const o = obj3 ?? {};
@@ -39525,7 +39848,7 @@ ${snippet}
 
 // packages/cli/src/commands/session.ts
 var renderSession = (s) => kv(
-  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: `${s.sponsor.type} ${s.sponsor.id}` },
+  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: actorLabel(s.sponsor) },
   ["id", "title", "agent", "state", "presence", "attention", "repository_id", "task_id", "claimed_task_id", "sponsor", "scopes", "open_blockers", "last_seen_at", "expires_at", "max_expires_at", "end_reason"]
 );
 var renderStarted = (s) => `${renderSession(s.session)}
@@ -41030,7 +41353,7 @@ function sessionLines(s, now, you) {
     ...s.paths.length ? [`  touching: ${pathList(s.paths)}`] : []
   ];
 }
-var claimLine = (c8) => `  ${c8.key}  ${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
+var claimLine = (c8) => `  ${c8.key}  ${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
 function renderStatus(st, now = Date.now()) {
   const others = st.sessions.filter((s) => s.id !== st.you);
   const out = [others.length ? `${others.length} other agent session${others.length === 1 ? "" : "s"} working in this repository.` : "No other agent sessions are working in this repository."];
@@ -41585,9 +41908,9 @@ async function runHook(deps, state2, tool, eventArg) {
     let meta3 = await readMeta(deps.env, id2);
     if (!meta3) {
       const baseUrl = await baseUrlOf(deps);
-      const resolved = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
-      if (!resolved) return;
-      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved.repo, repo_root: resolved.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+      const resolved2 = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
+      if (!resolved2) return;
+      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
     }
     if (info.model && !meta3.model) meta3.model = redactText(info.model).text.slice(0, 200);
     if (!meta3.model && t === "claude-code" && typeof payload.transcript_path === "string" && /^(Stop|SessionEnd)$/.test(info.event)) meta3.model = await modelFromTranscript(deps, payload.transcript_path);
@@ -41791,22 +42114,22 @@ function registerCapture(program2, rt) {
     act(rt, async (ctx, o, words) => {
       const summary = words.join(" ").trim();
       if (!summary) throw usage("decision text is required");
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
-      if (!resolved) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      if (!resolved2) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
       const now = Date.now();
-      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
+      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved2.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
       let id2;
       let meta3;
       if (live) {
         id2 = live.id;
         meta3 = live.meta;
       } else {
-        const key = `manual:${spoolId(resolved.root)}:${new Date(now).toISOString().slice(0, 10)}`;
+        const key = `manual:${spoolId(resolved2.root)}:${new Date(now).toISOString().slice(0, 10)}`;
         id2 = spoolId(key);
-        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
       }
       const paths = (o.file ?? []).map((f) => {
-        const rel = relative2(canonical(resolved.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
+        const rel = relative2(canonical(resolved2.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
         if (!rel || rel.startsWith("..") || isAbsolute6(rel)) throw usage(`${f} is outside the repository`);
         return rel.split(sep2).join("/");
       });
@@ -41850,22 +42173,22 @@ ${report3.errors.join("\n")}` : ""}`);
       rt.state.noUpdateHint = true;
       const [cmd, ...args] = argv;
       if (!cmd) throw usage(`usage: ${BRAND.cli} capture wrap -- <command> [args\u2026]`);
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
       const cfg = await readCaptureConfig(ctx.deps.env);
-      const before = resolved && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved.root) : null;
-      if (!resolved) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
+      const before = resolved2 && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved2.root) : null;
+      if (!resolved2) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
       const code = await runInherit(cmd, args, ctx.deps.cwd, ctx.deps.env);
       ctx.setExit(code);
-      if (!resolved || !before) return;
-      const after = await snapshotWorktree(ctx.deps, resolved.root);
+      if (!resolved2 || !before) return;
+      const after = await snapshotWorktree(ctx.deps, resolved2.root);
       if (!after) return;
-      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved.root, timeoutMs: 12e4 });
+      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved2.root, timeoutMs: 12e4 });
       const label2 = (o.tool ?? cmd.split(/[\\/]/).pop() ?? "command").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
       const now = Date.now();
       const key = `wrapped:${label2}:${randomBytes4(8).toString("hex")}`;
       const id2 = spoolId(key);
-      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
-      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
+      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
+      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved2.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
       await writeMeta(ctx.deps.env, id2, meta3);
       await appendEvents(ctx.deps.env, id2, [{ type: "capture.started", payload: { source: label2 } }, ...edits, { type: "capture.ended", payload: { reason: `exit ${code}` } }], now);
       startFlush(ctx.deps);
@@ -42198,6 +42521,7 @@ function sameOrigin(ctx, start) {
 }
 async function awaitStepUp(ctx, start) {
   const deadline = Date.parse(start.expires_at);
+  ctx.status.blocked("auth", `Confirm it's you in the browser (code ${start.user_code})`);
   for (; ; ) {
     await ctx.deps.sleep(start.interval * 1e3);
     const s = await ctx.client("user").auth.stepUp.status(start.id);
@@ -42395,6 +42719,7 @@ var accountChoice = (a) => ({
 });
 async function finishLogin(ctx, start, agentRuntime, hooks) {
   const oauth = ctx.client("user", { anonymous: true }).oauth;
+  ctx.status.blocked("auth", `Approve the sign-in in your browser (code ${start.user_code})`);
   let tok;
   try {
     tok = await pollDeviceToken(oauth, start, CLI_OAUTH_CLIENT_ID, { sleep: ctx.deps.sleep });
@@ -43467,6 +43792,7 @@ var Wizard = class {
   /** The spinner says what the step is checking until it prints, asks, or hands over to a composed command. */
   busy(step2) {
     this.ctx.busy(STEP_BUSY[step2]);
+    this.ctx.status.working(STEP_BUSY[step2]);
   }
   /** Global flags every composed command must keep (same server, credential and account). */
   globalArgs() {
@@ -44367,6 +44693,7 @@ var Quickstart = class {
   /** The board row says what is happening now (no-op without a board). */
   running(row, text2) {
     this.board?.run(row, text2);
+    this.ctx.status.working(text2);
   }
   /** A step's outcome: kept for the result, and shown on the board (`show`) or as a line. */
   record(step2, status, detail, show2 = detail) {
@@ -44681,6 +45008,7 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
       q.running("deploy", "waiting for Cloudflare to be connected");
       q.board.hint(`${todo} ${q.errPaint.dim("(Ctrl-C stops; the repository is ready either way)")}`);
     } else ctx.info(`  ${todo}. Waiting for it (Ctrl-C stops; the repository is ready either way)\u2026`);
+    ctx.status.blocked("auth", "Connect Cloudflare in the browser");
     const deadline2 = ctx.deps.sys.now() + o.connectTimeout * 1e3;
     let ready = false;
     while (!ready && ctx.deps.sys.now() < deadline2) {
@@ -45701,12 +46029,35 @@ function seedJson(p) {
 }
 
 // packages/cli/src/commands/task.ts
-var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? `${t.claim.actor.type} ${t.claim.actor.id}` : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.description ? `
+var BLOCKER_ARG = "the task it is blocked by: number (12 or #12) or task_\u2026 id";
+var resolved = (t) => t.state === "done" || t.state === "cancelled";
+var summaries = (list3) => list3.map((t) => `#${t.number} ${t.title} (${t.state})`).join("\n  ") || "(none)";
+function renderDependencies(d) {
+  const more = d.blocks_count > d.blocks.length ? `
+  \u2026 and ${d.blocks_count - d.blocks.length} more` : "";
+  return `Ready: ${d.is_ready ? "yes" : "no"}
+Blocked by:
+  ${summaries(d.blocked_by)}
+Blocks:
+  ${summaries(d.blocks)}${more}`;
+}
+var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? actorLabel(t.claim.actor) : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.blocked_by?.length || t.blocks_count ? `
+
+${renderDependencies(t)}` : "") + (t.description ? `
 
 ${t.description}` : "") + (t.acceptance_criteria.length ? `
 
 Acceptance criteria:
 ${t.acceptance_criteria.map((c8) => `  - ${c8}`).join("\n")}` : "");
+var waitingOn = (t) => (t.blocked_by ?? []).filter((b) => !resolved(b)).map((b) => `#${b.number}`).join(" ");
+function blockersFrom(values, allowNone) {
+  if (!values) return void 0;
+  if (values.length === 1 && values[0] === "none") {
+    if (!allowNone) throw usage("--blocked-by none only clears blockers on task update");
+    return [];
+  }
+  return values.map((v) => v.trim().replace(/^issue:/, ""));
+}
 async function bodyFrom(ctx, o, required2 = true) {
   if (o.body !== void 0 && o.file !== void 0) throw usage("pass either --body or --file, not both");
   if (o.file !== void 0) return readText(fileSpec(o.file), ctx.input);
@@ -45716,23 +46067,24 @@ async function bodyFrom(ctx, o, required2 = true) {
 }
 function registerTask(program2, rt) {
   const task = program2.command("task").description("Tasks (issues) in --repo");
-  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).action(
+  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).option("--blocked-by <task>", `${BLOCKER_ARG} (repeatable)`, repeat).action(
     act(rt, async (ctx, o) => {
       const description = await bodyFrom(ctx, o, false);
-      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label });
+      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label, blocked_by: blockersFrom(o.blockedBy, false) });
       ctx.result(t, renderTask);
     })
   );
-  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--ready", "only tasks ready to start: open, with every blocker done or cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
-      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "id"]));
+      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, ...o.ready ? { ready: true } : {}, limit: o.limit, cursor: o.cursor });
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((t) => ({ ...t, waiting_on: waitingOn(t) })) }, ["number", "state", "title", "waiting_on", "id"]));
     })
   );
-  task.command("view <task>").description("Show a task").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().tasks.get(id2), renderTask)));
-  task.command("update <task>").description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("view").argument("<task>", TASK_ARG).description("Show a task, with what it is blocked by and what it blocks").action(act(rt, async (ctx, _o, [spec]) => ctx.result(await ctx.client().tasks.get(await ctx.taskId(spec)), renderTask)));
+  task.command("update").argument("<task>", TASK_ARG).description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--blocked-by <task>", `replace the blockers: ${BLOCKER_ARG} (repeatable; 'none' to clear)`, repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
+    act(rt, async (ctx, o, [spec]) => {
       const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
       const version4 = o.expectedVersion ?? (await c8.tasks.get(id2)).version;
       const t = await c8.tasks.update(id2, {
         title: o.title,
@@ -45740,17 +46092,35 @@ function registerTask(program2, rt) {
         state: o.state,
         owner_id: o.owner === void 0 ? void 0 : o.owner === "none" ? null : o.owner,
         labels: o.label,
+        blocked_by: blockersFrom(o.blockedBy, true),
         version: version4
       });
       ctx.result(t, renderTask);
     })
   );
-  task.command("claim <task>").description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.claim(id2, { session_id: o.session }), renderTask)));
-  task.command("release <task>").description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.release(id2, { session_id: o.session }), renderTask)));
-  task.command("comment <task>").description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("depend").argument("<task>", TASK_ARG).argument("[blocker]", BLOCKER_ARG).description("Mark <task> as blocked by [blocker] (same repository); without it, show what <task> is blocked by and blocks").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
+      const deps = blocker ? await c8.tasks.dependencies.add(id2, { blocker: blockersFrom([blocker], false)[0] }) : await c8.tasks.dependencies.list(id2);
+      ctx.result(deps, renderDependencies);
+    })
+  );
+  task.command("undepend").argument("<task>", TASK_ARG).argument("<blocker>", BLOCKER_ARG).description("Remove <blocker> from what <task> is blocked by").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const id2 = await ctx.taskId(spec);
+      const ref = blockersFrom([blocker], false)[0];
+      await ctx.client().tasks.dependencies.remove(id2, ref);
+      ctx.result({ task_id: id2, removed: ref }, `${spec} is no longer blocked by ${ref}`);
+    })
+  );
+  task.command("claim").argument("<task>", TASK_ARG).description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.claim(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("release").argument("<task>", TASK_ARG).description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.release(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("comment").argument("<task>", TASK_ARG).description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
+    act(rt, async (ctx, o, [spec]) => {
+      const id2 = await ctx.taskId(spec);
       const comment = await ctx.client().tasks.comments.create(id2, { body: await bodyFrom(ctx, o) });
-      ctx.result(comment, `Comment ${comment.id} added to ${id2}`);
+      ctx.result(comment, `Comment ${comment.id} added to ${spec}`);
     })
   );
 }
@@ -46032,7 +46402,7 @@ var how = (strategy) => strategy ? `with ${strategy}` : "with the policy's defau
 function renderAutoMerge(a, change, p, now) {
   const ref = change ? String(change.number) : a.change_id;
   const name = change ? `${p.bold(`#${change.number}`)} ${change.title}` : p.bold(a.change_id);
-  const who3 = a.enabled_by ? a.enabled_by.display_name ?? a.enabled_by.id : null;
+  const who3 = a.enabled_by ? actorLabel(a.enabled_by) : null;
   const out = [];
   switch (a.state) {
     case "enabled":
@@ -46052,7 +46422,7 @@ function renderAutoMerge(a, change, p, now) {
       out.push(p.dim(`  Turn it on: ${BRAND.cli} change auto-merge ${ref}`));
   }
   if (a.history.length) {
-    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: h.actor.display_name ?? h.actor.id, reason: h.reason }));
+    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: actorLabel(h.actor), reason: h.reason }));
     const w = { when: Math.max(...rows2.map((r) => r.when.length)), action: Math.max(...rows2.map((r) => r.action.length)) };
     out.push("", p.bold("History"));
     for (const r of rows2) out.push(`  ${p.dim(r.when.padEnd(w.when))}  ${r.action.padEnd(w.action)}  ${r.actor}${r.reason ? p.dim(` \xB7 ${r.reason}`) : ""}`);
@@ -46118,11 +46488,11 @@ function stepOf(state2, previous) {
 
 // packages/cli/src/commands/change.ts
 var renderChange = (c8) => kv(
-  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: `${c8.author.type} ${c8.author.id}`, revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
+  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: actorLabel(c8.author), revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
   ["number", "id", "title", "state", "target_ref", "source", "task_id", "author", "revision", "current_revision.head_oid", "revision_count", "merged", "version"]
 );
 var renderThread = (t) => `${t.id} [${t.state}${t.blocking ? ", blocking" : ""}${t.anchor.outdated ? ", outdated" : ""}] ${t.anchor.path ?? "(change)"}${t.anchor.start_line ? `:${t.anchor.start_line}` : ""}
-` + t.comments.map((c8) => `  ${c8.author.display_name ?? c8.author.id}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
+` + t.comments.map((c8) => `  ${actorLabel(c8.author)}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
 function registerChange(program2, rt) {
   const change = program2.command("change").description("Changes (proposed updates to a protected ref)");
   change.command("create").description("Create a change from a workspace or a ref in --repo").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or -").option("--workspace <id>", "source workspace").option("--ref <ref>", "source ref (e.g. refs/heads/feature)").option("--target <ref>", "target ref (default: the repository's default branch)").option("--task <id>", "linked task").option("--draft", "create as draft").action(
@@ -46142,7 +46512,7 @@ function registerChange(program2, rt) {
   change.command("list").description("List changes in --repo").option("--state <state>", "draft | open | merged | closed").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const page = await ctx.client().changes.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "target_ref", "id"]));
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((c8) => ({ ...c8, author: actorLabel(c8.author) })) }, ["number", "state", "title", "author", "target_ref", "id"]));
     })
   );
   change.command("view").argument("<change>", CHANGE_ARG).description("Show a change").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.get(await ctx.changeId(id2)), renderChange)));
@@ -46231,7 +46601,7 @@ function registerReview(program2, rt) {
       const id2 = await ctx.changeId(spec);
       const revision = o.revision ?? (await c8.changes.get(id2)).current_revision.id;
       const r = await c8.reviews.create(id2, { revision_id: revision, decision, body: await bodyFrom(ctx, o, bodyRequired) });
-      ctx.result(r, (v) => kv({ ...v, reviewer: `${v.reviewer.type} ${v.reviewer.id}` }, ["id", "decision", "revision_id", "reviewer", "current"]));
+      ctx.result(r, (v) => kv({ ...v, reviewer: actorLabel(v.reviewer) }, ["id", "decision", "revision_id", "reviewer", "current"]));
     })
   );
   decide("approve", "approved", "Approve a revision (approvals are bound to that revision)", false);
@@ -46285,6 +46655,7 @@ async function waitDone(ctx, change, interval, timeout) {
     const now = f.reviews.map((r) => `${CODE_REVIEW_PROVIDER_NAMES[r.provider]}: ${r.status}`).join(", ");
     if (now && now !== said) ctx.info(now);
     said = now;
+    ctx.status.working(now ? `AI review: ${now}` : "Waiting for AI review");
     if (!f.pending || Date.now() > deadline) return f;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
   }
@@ -46351,7 +46722,7 @@ Wait for the findings: code-review wait ${spec}`);
 
 // packages/cli/src/commands/evidence.ts
 import { basename as basename4, extname, isAbsolute as isAbsolute8, resolve as resolve8 } from "node:path";
-var renderEvidence = (e) => kv({ ...e, issuer: `${e.issuer.type} ${e.issuer.id}` }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
+var renderEvidence = (e) => kv({ ...e, issuer: actorLabel(e.issuer) }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
 var CONTENT_TYPES = { ".txt": "text/plain", ".log": "text/plain", ".json": "application/json", ".xml": "application/xml", ".html": "text/plain" };
 function registerEvidence(program2, rt) {
   const ev = program2.command("evidence").description("Verification evidence");
@@ -46450,6 +46821,7 @@ async function followLive(ctx, c8, first2, deadline, interval) {
   const stop = ctx.deps.ticker(250, draw2);
   try {
     while (!TERMINAL3.has(cur.state) && Date.now() < deadline) {
+      ctx.status.working(`Merge ${cur.state}`);
       await ctx.deps.sleep(Math.max(1, interval) * 1e3);
       cur = await c8.promotions.get(cur.id);
       reached = stepOf(cur.state, reached);
@@ -46474,6 +46846,7 @@ function registerMerge(program2, rt) {
           let last = p.state;
           ctx.info(`promotion ${p.id}: ${p.state}`);
           while (!TERMINAL3.has(p.state) && Date.now() < deadline) {
+            ctx.status.working(`Merge ${p.state}`);
             await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
             p = await c8.promotions.get(p.id);
             if (p.state !== last) ctx.info(`promotion ${p.id}: ${last = p.state}`);
@@ -46526,7 +46899,7 @@ var renderCoverage = (c8) => [
   `code owner review ${c8.required ? "required" : "not required"} by policy v${c8.policy_version} (revision ${c8.revision_id})${c8.complete ? "" : " \u2014 path list truncated"}`,
   table(c8.paths.map((p) => ({ ...p, owners: p.owners.join(" ") || "-", approved_by: p.approved_by.join(" ") || "-" })), ["path", "owners", "satisfied", "approved_by"])
 ].join("\n");
-var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: a.pushed_by.display_name ?? a.pushed_by.id })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
+var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: actorLabel(a.pushed_by) })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
 function registerGovernance(program2, rt) {
   const change = program2.commands.find((c8) => c8.name() === "change") ?? program2.command("change");
   change.command("draft").argument("<change>", CHANGE_ARG).description("Convert an open change back to a draft (drafts cannot merge and notify nobody)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.draft(await ctx.changeId(id2)), (c8) => kv(c8, ["id", "number", "title", "state"]))));
@@ -46616,7 +46989,7 @@ new revision #${r.revision.number} ${r.revision.id}`);
       }
       const b = await ctx.client("user").pushProtection.bypasses.create(await ctx.repoId(), { rule: o.rule, path: o.path, blob_oid: o.blob, reason: o.reason, ...principal ? { principal } : {}, ...o.ref ? { ref: o.ref } : {} });
       ctx.result(b, (v) => {
-        const who3 = v.principal ? v.principal.display_name ?? `${v.principal.type}:${v.principal.id}` : "nobody";
+        const who3 = v.principal ? actorLabel(v.principal) : "nobody";
         return `${kv({ ...v, for: who3, ref: v.ref ?? "any" }, ["id", "rule", "path", "blob_oid", "for", "ref", "expires_at"])}
 Only ${who3} can use it, for one push, before it expires.`;
       });
@@ -46627,7 +47000,7 @@ Only ${who3} can use it, for one push, before it expires.`;
       rt,
       async (ctx, o) => ctx.result(
         await ctx.client().pushProtection.bypasses.list(await ctx.repoId(), { limit: o.limit, cursor: o.cursor }),
-        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? b.principal.display_name ?? b.principal.id : "-", created_by: b.created_by.display_name ?? b.created_by.id, used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
+        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? actorLabel(b.principal) : "-", created_by: actorLabel(b.created_by), used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
       )
     )
   );
@@ -46668,7 +47041,7 @@ var renderAlerts2 = (p) => listWithCursor(
   ["id", "state", "resolution", "confidence", "rule", "repo", "where", "masked", "source", "created_at"]
 );
 var renderAlert = (a) => [
-  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? a.resolved_by.display_name ?? a.resolved_by.id : null, looks_fake: a.looks_fake?.label ?? null }, [
+  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? actorLabel(a.resolved_by) : null, looks_fake: a.looks_fake?.label ?? null }, [
     "id",
     "state",
     "resolution",
@@ -46751,6 +47124,7 @@ function registerSecretScanning(program2, rt) {
       const c8 = ctx.client("user");
       let job2 = await c8.secretScanning.scans.start(repo);
       while (o.wait && (job2.state === "queued" || job2.state === "running")) {
+        ctx.status.working(`History scan ${job2.state}`);
         await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
         job2 = await c8.secretScanning.scans.get(repo, job2.id);
       }
@@ -47008,8 +47382,8 @@ var renderDevices = (v) => v.items.length ? table(
   v.items.map((d) => ({ id: d.id, name: d.name ?? "-", environment: d.environment, app_version: d.app_version ?? "-", last_seen: d.last_seen_at, current: d.current ? "yes" : "" })),
   ["id", "name", "environment", "app_version", "last_seen", "current"]
 ) : "No push devices. The iOS app registers itself when you allow notifications.";
-var PAGE2 = 100;
-var MAX_PAGES2 = 10;
+var PAGE = 100;
+var MAX_PAGES = 10;
 async function findItems(client, specs) {
   const wanted = specs.map((s) => s.trim().toLowerCase());
   for (const s of wanted) if (s.length < 4) throw usage(`"${s}" is too short to name an inbox item: use the id \`${c4} inbox list\` shows`);
@@ -47017,8 +47391,8 @@ async function findItems(client, specs) {
   const seen = /* @__PURE__ */ new Set();
   for (const view of ["all", "snoozed", "done"]) {
     let cursor2;
-    for (let i = 0; i < MAX_PAGES2; i++) {
-      const page = await client.inbox.list({ view, limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
+    for (let i = 0; i < MAX_PAGES; i++) {
+      const page = await client.inbox.list({ view, limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
       for (const item of page.items) {
         if (seen.has(item.id)) continue;
         seen.add(item.id);
@@ -47040,9 +47414,9 @@ async function findItems(client, specs) {
 }
 async function itemIds(client, specs) {
   const full = (s) => /^notif_[0-9a-z]{26}$/.test(s);
-  const short2 = specs.filter((s) => !full(s));
-  const items = short2.length ? await findItems(client, short2) : [];
-  return specs.map((s) => full(s) ? s : items[short2.indexOf(s)].id);
+  const short3 = specs.filter((s) => !full(s));
+  const items = short3.length ? await findItems(client, short3) : [];
+  return specs.map((s) => full(s) ? s : items[short3.indexOf(s)].id);
 }
 async function repoNames(client, items) {
   const ids = [...new Set(items.map((i) => i.repository_id))];
@@ -47473,13 +47847,13 @@ function renderEntry(e, verb) {
   if (e.flags.length) lines2.push(`flagged: ${e.flags.join(", ")}${e.flags.includes("instructions") ? "; never given to the assistant on its own" : ""}`);
   return lines2.join("\n");
 }
-var PAGE3 = 100;
-var MAX_PAGES3 = 10;
+var PAGE2 = 100;
+var MAX_PAGES2 = 10;
 async function reviewable(ctx, org, q) {
   const out = [];
   let cursor2;
-  for (let i = 0; i < MAX_PAGES3; i++) {
-    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE3, ...cursor2 ? { cursor: cursor2 } : {} });
+  for (let i = 0; i < MAX_PAGES2; i++) {
+    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
     out.push(...page.items.filter((e) => e.can_review));
     if (!page.next_cursor) break;
     cursor2 = page.next_cursor;
@@ -47787,6 +48161,329 @@ function registerIntegrations(program2, rt) {
   integrations.command("inherit <provider> <purpose>").description("Drop --repo's choice and inherit the nearest shared connection again").action(act(rt, async (ctx, _o, [provider, purpose]) => ctx.result(await ctx.client("user").grants.inherit(await ctx.repoId(void 0, "user"), provider, purpose), renderRepo)));
 }
 
+// packages/cli/src/commands/approvals.ts
+function protectOptions(cmd) {
+  return cmd.option("--user <handle>", "a person who may approve (@handle or id; repeatable)", repeat).option("--team <slug>", "a team whose members may approve (slug or id; repeatable)", repeat).option("--required <n>", "approvals needed from different people (default 1)", (v) => parseIntOption(v, "--required")).option("--separation-of-duties", "the change's author, its merger and whoever requested the deploy or run cannot approve it");
+}
+function protectBody(o, current) {
+  const users = o.user ?? [];
+  const teams = o.team ?? [];
+  if (!users.length && !teams.length && o.required === void 0 && !o.separationOfDuties) throw usage("give --user, --team, --required or --separation-of-duties");
+  return { required: o.required ?? 1, users, teams, separation_of_duties: !!o.separationOfDuties, ...current ? { version: current.version } : {} };
+}
+var who2 = (p) => p.handle ? `@${p.handle}` : p.name;
+var ruleSummary = (r) => r ? `${r.required} approval${r.required === 1 ? "" : "s"} from ${[...r.teams.map((t) => `@${t.slug} team`), ...r.users.map(who2)].join(", ") || "anyone who may approve"}${r.separation_of_duties ? "; not the author, merger or requester" : ""}` : "not protected";
+var renderApprovers = (v) => kv(
+  {
+    protected: ruleSummary(v.rule),
+    capability: v.capability,
+    eligible: v.eligible.map(who2).join(", ") || "nobody",
+    lacking_capability: v.lacking_capability.length ? `${v.lacking_capability.map(who2).join(", ")} (named, but cannot approve without ${v.capability})` : null,
+    unsatisfiable: v.unsatisfiable ? "yes: fewer people can approve than it needs" : null
+  },
+  ["protected", "capability", "eligible", "lacking_capability", "unsatisfiable"]
+);
+var renderRule = (r) => `protected: ${ruleSummary(r)} (version ${r.version})`;
+function approvalLines(a) {
+  if (!a) return "";
+  const by2 = a.approvals.filter((x) => x.counted).map((x) => who2(x.user));
+  const lines2 = [a.line ?? (a.satisfied ? `approved (${a.counted} of ${a.required})` : null), by2.length ? `approved by ${by2.join(", ")}` : null, a.you && !a.you.can_approve && a.line ? `you cannot approve: ${a.you.message}` : null].filter(Boolean);
+  return lines2.length ? `
+
+${lines2.join("\n")}` : "";
+}
+
+// packages/cli/src/commands/db.ts
+async function sourceId(ctx, ref, repo) {
+  if (ref.startsWith("dms_")) return ref;
+  const { items } = await ctx.client("user").dbMigrations.sources.list(repo?.id ?? await ctx.repoId(void 0, "user"));
+  const s = items.find((x) => x.name === ref);
+  if (!s) throw new CliError(`no migration source named "${ref}" (have: ${items.map((x) => x.name).join(", ") || "none"})`, EXIT.NOT_FOUND, "NOT_FOUND");
+  return s.id;
+}
+var plural3 = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+var short = (oid) => oid.slice(0, 12);
+var database = (s) => {
+  const t = s.target;
+  return t.provider === "cloudflare_d1" ? `d1:${t.binding}\u2192${t.database_name ?? t.database_id}${t.environment ? ` (env ${t.environment})` : ""}` : `${t.organization}/${t.database}@${t.branch}`;
+};
+var PS_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
+var PS_ENGINES = ["postgres", "vitess"];
+var LEVELS = ["error", "warning", "off"];
+function lintLines(findings2) {
+  if (!findings2?.length) return [];
+  return ["lint:", ...findings2.map((f) => `  ${f.level.padEnd(12)}  ${(f.atlas_code ?? f.code).padEnd(6)}  ${f.file}:${f.line}  ${f.message}`)];
+}
+function diffLines(d) {
+  if (!d) return [];
+  const t = d.tables;
+  const out = [];
+  for (const x of t.added) out.push(`  + table ${x.name} (${x.columns.map((c8) => c8.name).join(", ")})`);
+  for (const x of t.renamed) out.push(`  ~ table ${x.from} \u2192 ${x.to}`);
+  for (const x of t.changed) {
+    for (const c8 of x.columns.added) out.push(`  + ${x.name}.${c8.name} ${c8.type}${c8.nullable ? "" : " NOT NULL"}`);
+    for (const c8 of x.columns.renamed) out.push(`  ~ ${x.name}.${c8.from} \u2192 ${c8.to}`);
+    for (const c8 of x.columns.changed) out.push(`  ~ ${x.name}.${c8.name} ${c8.before.type} \u2192 ${c8.after.type}`);
+    for (const c8 of x.columns.dropped) out.push(`  - ${x.name}.${c8}`);
+    for (const i of x.indexes.added) out.push(`  + index ${i} on ${x.name}`);
+    for (const i of x.indexes.dropped) out.push(`  - index ${i} on ${x.name}`);
+    for (const k of x.foreign_keys.added) out.push(`  + foreign key ${k} on ${x.name}`);
+    for (const k of x.foreign_keys.dropped) out.push(`  - foreign key ${k} on ${x.name}`);
+  }
+  for (const x of t.dropped) out.push(`  - table ${x.name}`);
+  if (!out.length && !d.unparsed.length) return ["schema effect: none"];
+  return ["schema effect:", ...out, ...d.unparsed.length ? [`  (${plural3(d.unparsed.length, "statement")} could not be interpreted, first at ${d.unparsed[0].file}:${d.unparsed[0].line})`] : []];
+}
+function renderDrift(d) {
+  if (!d) return "drift: not checked yet";
+  const lines2 = [`drift: ${d.status} (checked ${d.checked_at} against ${plural3(d.applied, "applied migration")})`];
+  if (d.note) lines2.push(`note: ${d.note}`);
+  for (const f of d.findings) lines2.push(`  ${f.kind.padEnd(20)}  ${f.object}  ${f.detail}`);
+  return lines2.join("\n");
+}
+function issueLines(issues) {
+  if (!issues.length) return [];
+  return ["issues:", ...issues.map((i) => `  ${i.level.padEnd(7)}  ${i.code}  ${i.file ? `${i.file}: ` : ""}${i.message}`)];
+}
+var renderSources = (v) => table(
+  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet", drift: s.drift?.status ?? "-" })),
+  ["name", "id", "provider", "path", "format", "database", "branch", "apply_on", "state", "applied", "drift"]
+);
+var renderSource = (s) => `${kv(
+  { ...s, approvers: ruleSummary(s.approval_rule), database: database(s), path: s.path || "(repository root)", destructive: s.lint.levels.destructive ?? "error", nolint: s.lint.nolint, ...s.target.provider === "cloudflare_d1" ? { from: `${s.target.config_path} on ${s.branch}` } : {} },
+  s.provider === "cloudflare_d1" ? ["id", "name", "provider", "path", "format", "database", "from", "branch", "revisions_location", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"] : ["id", "name", "provider", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"]
+)}
+
+` + (s.apply_on === "merge" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : s.apply_on === "deploy" ? `The production deploy's migrations step applies them${s.require_approval ? ", once the run is approved" : ""}` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
+var renderSuggestions = (v) => v.items.length ? table(
+  v.items.map((s) => ({ ...s, path: s.path || "(root)", configured: s.configured ? "yes" : "no" })),
+  ["path", "format", "files", "revisions_schema", "baseline_version", "configured", "evidence"]
+) : "no migration directories found";
+function renderPlan2(p) {
+  const db = p.database === "live" ? "read now" : p.database === "snapshot" ? `as last read${p.read_at ? ` ${p.read_at}` : ""}` : `not read${p.note ? `: ${p.note}` : ""}`;
+  const lines2 = [`${p.source_name} at ${p.ref} (${short(p.commit_oid)}): ${p.ok ? "ok" : "has errors"}`, `database: ${db}`, `files: ${p.files}, applied: ${p.applied.length}${p.applied.length ? ` (latest ${p.applied[p.applied.length - 1]})` : ""}`];
+  if (p.baseline) lines2.push(`baseline: ${p.baseline}${p.no_history ? " (recorded, not applied: the database has no revision history)" : ""}`);
+  else if (p.no_history && p.database !== "none") lines2.push("no revision history yet: every file is pending");
+  if (p.database !== "live" && p.note) lines2.push(`note: ${p.note}`);
+  if (!p.pending.length) lines2.push("nothing pending");
+  else {
+    lines2.push(`pending (${p.pending.length}):`);
+    for (const f of p.pending) {
+      const notes = [f.resume_from ? `resumes at statement ${f.resume_from + 1}` : "", f.tx_mode === "none" ? "no transaction" : "", f.introduced_by_change ? "in this change" : ""].filter(Boolean);
+      lines2.push(`  ${f.name}  ${plural3(f.statements, "statement")}${notes.length ? `  (${notes.join(", ")})` : ""}`);
+    }
+  }
+  return [...lines2, ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(p.schema_diff)].join("\n");
+}
+var renderPlans = (v) => v.items.length ? v.items.map(renderPlan2).join("\n\n") : "no migration sources";
+var NEXT = {
+  awaiting_approval: (id2) => `Waiting for approval: ${BRAND.cli} db approve ${id2} (or reject)`,
+  failed: (id2) => `Fix the migration and merge it, then: ${BRAND.cli} db retry ${id2}`,
+  needs_attention: (id2) => `Look at the database (PlanetScale, or the D1 bookmark's restore command), then: ${BRAND.cli} db retry ${id2} or cancel`
+};
+function renderRun(r) {
+  const ps = r.backend?.provider === "planetscale" ? r.backend : null;
+  const d1 = r.backend?.provider === "cloudflare_d1" ? r.backend : null;
+  const head = kv(
+    {
+      ...r,
+      commit: short(r.commit_oid),
+      change: r.change_id ?? "-",
+      requested_by: r.requested_by ? `${r.requested_by.type} ${r.requested_by.id}` : "-",
+      deploy_request: ps?.deploy_request_url ?? (ps?.deploy_request ? `#${ps.deploy_request}` : null),
+      deployment_state: ps?.deployment_state ?? null,
+      bookmark: d1?.bookmark ?? null,
+      restore: d1?.restore?.wrangler ?? null
+    },
+    ["id", "source_name", "status", "kind", "provider", "engine", "commit", "change", "deployment_id", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "bookmark", "restore", "error", "note", "created_at"]
+  );
+  const files = r.files.length ? table(
+    r.files.map((f) => ({ ...f, statements: f.applied_statements ? `${f.applied_statements}/${f.statements}` : f.statements, error: f.error ? `${f.error}${f.error_statement ? ` (in: ${f.error_statement})` : ""}` : null })),
+    ["name", "status", "statements", "execution_ms", "error"]
+  ) : "no files";
+  const next = NEXT[r.status]?.(r.id);
+  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n") + approvalLines(r.approval);
+}
+var renderRuns = (v) => listWithCursor(
+  { ...v, items: v.items.map((r) => ({ ...r, commit: short(r.commit_oid), files: `${r.files.filter((f) => f.status === "applied").length}/${r.files.length} applied` })) },
+  ["id", "source_name", "status", "kind", "commit", "files", "created_at"]
+);
+var oneOf = (flag, values) => (v) => {
+  if (!values.includes(v)) throw usage(`${flag} must be one of ${values.join(", ")}`);
+  return v;
+};
+function sessionSettings(pairs) {
+  if (!pairs) return void 0;
+  const out = {};
+  for (const p of pairs) {
+    const eq = p.indexOf("=");
+    if (eq < 1) throw usage(`--session-setting must be name=value (got "${p}")`);
+    out[p.slice(0, eq)] = p.slice(eq + 1);
+  }
+  return out;
+}
+function registerDb(program2, rt) {
+  const db = program2.command("db").description("Database migrations on PlanetScale and Cloudflare D1 for --repo: sources, plans, lint, runs applied after approval, and drift");
+  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch or a D1 database (D1 sources come from the Wrangler configuration)").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
+  sources.command("add").description("Add a PlanetScale migration source (migrations:manage). The source is checked against PlanetScale; `db suggest` shows the directories found. D1 sources need no adding: they come from the Wrangler configuration").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", PS_FORMATS.join(" | "), oneOf("--format", PS_FORMATS)).requiredOption("--engine <engine>", PS_ENGINES.join(" | "), oneOf("--engine", PS_ENGINES)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "deprecated: --apply-on (approval = merge, manual_only = manual)", oneOf("--on-merge", ["approval", "manual_only"])).option("--apply-on <when>", `${DB_APPLY_ON.join(" | ")} (default merge: runs wait for approval after merge)`, oneOf("--apply-on", DB_APPLY_ON)).option("--no-approval", "--apply-on deploy or manual: apply without a person's approval").option("--destructive <level>", "lint level for destructive changes: error (default, fails the check) | warning | off", oneOf("--destructive", LEVELS)).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
+    act(rt, async (ctx, o) => {
+      let dsn;
+      if (o.dsnFile !== void 0) {
+        if (o.dsnFile === "-" && ctx.deps.stdinIsTTY) throw usage(`pipe the connection string on stdin, e.g. \`pbpaste | ${BRAND.cli} db sources add \u2026 --dsn-file -\``);
+        dsn = (await readText(fileSpec(o.dsnFile), ctx.input)).trim();
+        if (!dsn) throw usage("the connection string is empty");
+        ctx.addSecret(dsn);
+        const password = /^[a-z]+:\/\/[^:/@]*:([^@]+)@/i.exec(dsn)?.[1];
+        if (password) ctx.addSecret(password);
+      }
+      const body = {
+        name: o.name,
+        path: o.path,
+        format: o.format,
+        engine: o.engine,
+        connection_id: o.connection,
+        ps_organization: o.organization,
+        ps_database: o.database,
+        ps_branch: o.psBranch,
+        change_checks: o.changeChecks,
+        ...o.branch ? { branch: o.branch } : {},
+        ...o.revisionsSchema ? { revisions_schema: o.revisionsSchema } : {},
+        ...o.revisionsTable ? { revisions_table: o.revisionsTable } : {},
+        ...o.baseline ? { baseline_version: o.baseline } : {},
+        ...o.execOrder ? { exec_order: o.execOrder } : {},
+        ...o.onMerge ? { on_merge: o.onMerge } : {},
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval === false ? { require_approval: false } : {},
+        ...o.destructive ? { lint: { levels: { destructive: o.destructive }, nolint: "honor", drift_blocks_deploy: false } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
+        ...o.credentialMode ? { credential_mode: o.credentialMode } : {},
+        ...o.runAsRole ? { run_as_role: o.runAsRole } : {},
+        ...o.sessionSetting ? { session_settings: sessionSettings(o.sessionSetting) } : {},
+        ...o.statementTimeout !== void 0 ? { statement_timeout_s: o.statementTimeout } : {},
+        ...o.lockTimeout !== void 0 ? { lock_timeout_s: o.lockTimeout } : {},
+        ...dsn ? { dsn } : {}
+      };
+      ctx.result(await ctx.client("user").dbMigrations.sources.create(await ctx.repoId(void 0, "user"), body), renderSource);
+    })
+  );
+  sources.command("set <source>").description("Change how a source applies, its lint and drift checks (migrations:manage; D1 sources: only these)").option("--apply-on <when>", DB_APPLY_ON.join(" | "), oneOf("--apply-on", DB_APPLY_ON)).option("--approval", "each run waits for approval (migrations:approve; a protected source's approvers)").option("--no-approval", "--apply-on deploy or manual: apply without approval").option("--destructive <level>", "lint level for destructive changes: error | warning | off", oneOf("--destructive", LEVELS)).option("--nolint <mode>", "honor | ignore: whether `-- atlas:nolint` in a file acknowledges a finding", oneOf("--nolint", ["honor", "ignore"])).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--drift-blocks-deploy <yes|no>", "drift found by the last check fails the deploy's migrations step", oneOf("--drift-blocks-deploy", ["yes", "no"])).option("--enable", "activate the source").option("--disable", "disable the source (no runs, no checks)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      if (o.enable && o.disable) throw usage("--enable and --disable exclude each other");
+      const c8 = ctx.client("user").dbMigrations;
+      const s = await c8.sources.get(await sourceId(ctx, ref));
+      const levels = { ...s.lint.levels };
+      if (o.destructive) {
+        if (o.destructive === "error") delete levels.destructive;
+        else levels.destructive = o.destructive;
+      }
+      const lintChanged = o.destructive || o.nolint || o.driftBlocksDeploy;
+      const body = {
+        version: s.version,
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval !== void 0 ? { require_approval: o.approval } : {},
+        ...lintChanged ? { lint: { levels, nolint: o.nolint ?? s.lint.nolint, drift_blocks_deploy: o.driftBlocksDeploy ? o.driftBlocksDeploy === "yes" : s.lint.drift_blocks_deploy } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
+        ...o.enable ? { state: "active" } : o.disable ? { state: "disabled" } : {}
+      };
+      if (Object.keys(body).length === 1) throw usage("nothing to change: give --apply-on, --approval, --destructive, --nolint, --drift, --drift-blocks-deploy, --enable or --disable");
+      ctx.result(await c8.sources.update(s.id, body), renderSource);
+    })
+  );
+  protectOptions(sources.command("protect <source>").description("Require approvals for every run of the source (people with migrations:manage). A protected database can no longer apply without approval. Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations.sources;
+      const s = await c8.get(await sourceId(ctx, ref));
+      ctx.result(await c8.protect(s.id, protectBody(o, s.approval_rule)), renderRule);
+    })
+  );
+  sources.command("unprotect <source>").description("Remove the source's approval rule (runs still need approval as its apply mode says). Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}`);
+      await ctx.client("user").dbMigrations.sources.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  sources.command("approvers <source>").description("Who may approve the source's runs now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.sources.approvers(await sourceId(ctx, ref)), renderApprovers)));
+  sources.command("rm <source>").description("Delete a migration source (name or id; its runs stay listed). Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`delete migration source ${ref}`);
+      await ctx.client("user").dbMigrations.sources.delete(id2);
+      ctx.result({ deleted: id2 }, `deleted ${ref}`);
+    })
+  );
+  db.command("suggest").description("Migration directories found in --repo (atlas.sum, drizzle journals, *.up.sql, numbered SQL files), and whether a source covers each").option("--ref <ref>", "branch, tag or commit (default: the default branch)").action(act(rt, async (ctx, o) => ctx.result(await ctx.client("user").dbMigrations.suggestions(await ctx.repoId(void 0, "user"), o.ref), renderSuggestions)));
+  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (migrations:manage)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations;
+      const q = { ref: o.ref, live: o.live };
+      if (ref) {
+        const p = await c8.plan(await sourceId(ctx, ref), q);
+        ctx.result(p, renderPlan2);
+        if (!p.ok) ctx.setExit(EXIT.NOT_READY);
+        return;
+      }
+      const { items } = await c8.sources.list(await ctx.repoId(void 0, "user"));
+      const plans = { items: await Promise.all(items.filter((s) => s.state === "active").map((s) => c8.plan(s.id, q))) };
+      ctx.result(plans, renderPlans);
+      if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("diff <change>").description("What a change's migrations do: per source, the files it adds, lint findings and the schema effect. Exits 7 when a source would block the change").action(
+    act(rt, async (ctx, _o, [change]) => {
+      const plans = await ctx.client("user").dbMigrations.changePlans(await ctx.changeId(change, "user"));
+      ctx.result(
+        plans,
+        (v) => v.items.length ? v.items.map((p) => {
+          const mine = p.pending.filter((f) => f.introduced_by_change);
+          return [`${p.source_name} (${p.provider === "cloudflare_d1" ? "Cloudflare D1" : `PlanetScale ${p.engine}`} ${p.target_label}): ${p.ok ? "ok" : "blocked"}`, mine.length ? `this change adds: ${mine.map((f) => f.name).join(", ")}` : "this change adds no migrations", ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(mine.length ? p.schema_diff : null)].join("\n");
+        }).join("\n\n") : "no migration sources follow the change's target branch"
+      );
+      if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("drift <source>").description("The source's last drift check: its database against what the applied migrations produce. --check reads the database now (migrations:manage)").option("--check", "check now").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations;
+      const id2 = await sourceId(ctx, ref);
+      const d = o.check ? await c8.checkDrift(id2) : (await c8.sources.get(id2)).drift;
+      ctx.result(d, renderDrift);
+      if (d?.status === "drift") ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (migrations:manage)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
+  db.command("runs").description("Migration runs of --repo, newest first").option("--source <source>", "only this source (name or id)").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+    act(rt, async (ctx, o) => {
+      const repo = { id: await ctx.repoId(void 0, "user") };
+      const q = { ...o.source ? { source_id: await sourceId(ctx, o.source, repo) } : {}, ...o.limit ? { limit: o.limit } : {}, ...o.cursor ? { cursor: o.cursor } : {} };
+      ctx.result(await ctx.client("user").dbMigrations.runs.list(repo.id, q), renderRuns);
+    })
+  );
+  db.command("run <run>").description("One migration run: status, files and issues").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").dbMigrations.runs.get(id2), renderRun)));
+  db.command("apply <source>").description("Apply a source's pending migrations now (migrations:manage). Your request is the approval when you may approve and the source is not protected; otherwise the run waits for approval. Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`apply the pending migrations of ${ref}${o.ref ? ` at ${o.ref}` : ""} to its database`);
+      const r = await ctx.client("user").dbMigrations.startRun(id2, o.ref ? { ref: o.ref } : {});
+      ctx.result(r, (v) => v.run ? renderRun(v.run) : `nothing to apply
+
+${renderPlan2(v.plan)}`);
+    })
+  );
+  const decisions = [
+    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows once it has the approvals it needs (migrations:approve; a protected source's approvers)"],
+    ["reject", "Reject a run waiting for approval; nothing is applied (migrations:approve)"],
+    ["retry", "Retry a failed run from where it stopped (migrations:approve)"],
+    ["cancel", "Cancel a run that has not finished (migrations:approve)"]
+  ];
+  for (const [decision, description] of decisions) {
+    const cmd = db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)");
+    if (decision === "approve") cmd.option("--redeploy", "a run a production deploy waits on: deploy the same commit again, which applies it");
+    cmd.action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.redeploy ? { reason: o.reason, redeploy: true } : o.reason), renderRun)));
+  }
+}
+
 // packages/cli/src/commands/deploy.ts
 var TERMINAL4 = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled", "superseded", "blocked"]);
 var NO_DO_PREVIEWS = "previews off: Cloudflare makes no version URLs for Workers that implement a Durable Object (--previews --preview-mode worker_previews uses Worker Previews; it needs a `previews` block in the Wrangler configuration)";
@@ -47794,7 +48491,7 @@ var renderTargets = (v) => table(
   v.items.map((t) => ({ ...t, resource: t.resource_name, env: t.environment ?? "-", last_production: t.last_production ? `${t.last_production.status} ${t.last_production.commit_oid.slice(0, 12)}` : "-" })),
   ["name", "id", "platform", "resource", "env", "branch", "runs_on", "previews", "state", "last_production"]
 );
-var renderTarget = (t) => kv({ ...t, connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
+var renderTarget = (t) => kv({ ...t, approvers: ruleSummary(t.approval_rule), watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
   "id",
   "name",
   "platform",
@@ -47809,14 +48506,16 @@ var renderTarget = (t) => kv({ ...t, connection: t.connection ? `${t.connection.
   "build_command",
   "output_directory",
   "runs_on",
+  "watch_paths",
   "previews",
   "preview_check_name",
+  "approvers",
   "last_production",
   "version"
 ]);
 var renderDeployment = (d) => kv({ ...d, change: d.change ? `#${d.change.number}` : "-", logs: d.run?.logs_url ?? "-" }, ["id", "target_name", "kind", "environment", "status", "status_reason", "trigger", "commit_oid", "change", "version_id", "url", "alias_url", "verified", "duration_ms", "logs", "created_at"]) + (d.steps.length ? `
 
-${table(d.steps, ["name", "phase", "status", "summary"])}` : "");
+${table(d.steps, ["name", "phase", "status", "summary"])}` : "") + approvalLines(d.approval);
 var renderDeployments = (v) => listWithCursor({ ...v, items: v.items.map((d) => ({ ...d, commit: d.commit_oid.slice(0, 12), change: d.change ? `#${d.change.number}` : "-" })) }, ["id", "target_name", "kind", "status", "commit", "change", "trigger", "created_at"]);
 async function pick3(ctx, what, flag, options, label2) {
   if (options.length === 1) return options[0];
@@ -47845,7 +48544,7 @@ async function stepsOf(ctx, spec) {
   return v;
 }
 function targetOptions(cmd) {
-  return cmd.option("--platform <platform>", "workers | pages").option("--connection <connection>", "deploy connection (icn_\u2026)").option("--account-id <id>", "Cloudflare account id").option("--env <name>", "Wrangler environment (deploys with --env)").option("--worker <name>", "Worker name (or Pages project name)").option("--root <dir>", "root directory (where the Wrangler config lives)").option("--branch <name>", "production branch (default: the repository's default branch)").option("--install <cmd>", "install command").option("--build <cmd>", "build command").option("--output-dir <dir>", "Pages: the built site").option("--previews", "upload a preview of every open change").option("--no-previews", "no previews").option("--preview-agent-changes", "also preview changes made by agents or integrations, isolated (Worker Previews only)").option("--no-preview-agent-changes", "previews only for changes people upload").option("--preview-mode <mode>", "versions (preview version with an alias) | worker_previews (`wrangler preview`: Durable Objects allowed, bindings from the `previews` block)").option("--preview-check <name>", "report previews as this check").option("--runs-on <label>", "hosted runner size for the deploy jobs: brnch-hosted (default), brnch-hosted-1 \u2026 brnch-hosted-4 (your plan sets the largest)").option("--name <name>", "target name").option("--steps <json>", `pre/post steps as a JSON array, @file or - (replaces the list), e.g. '[{"id":"migrate","kind":"d1_migrations","phase":"pre"}]'`);
+  return cmd.option("--platform <platform>", "workers | pages").option("--connection <connection>", "deploy connection (icn_\u2026)").option("--account-id <id>", "Cloudflare account id").option("--env <name>", "Wrangler environment (deploys with --env)").option("--worker <name>", "Worker name (or Pages project name)").option("--root <dir>", "root directory (where the Wrangler config lives)").option("--branch <name>", "production branch (default: the repository's default branch)").option("--install <cmd>", "install command").option("--build <cmd>", "build command").option("--output-dir <dir>", "Pages: the built site").option("--previews", "upload a preview of every open change").option("--no-previews", "no previews").option("--preview-agent-changes", "also preview changes made by agents or integrations, isolated (Worker Previews only)").option("--no-preview-agent-changes", "previews only for changes people upload").option("--preview-mode <mode>", "versions (preview version with an alias) | worker_previews (`wrangler preview`: Durable Objects allowed, bindings from the `previews` block)").option("--preview-check <name>", "report previews as this check").option("--runs-on <label>", "hosted runner size for the deploy jobs: brnch-hosted (default), brnch-hosted-1 \u2026 brnch-hosted-4 (your plan sets the largest)").option("--watch-path <pattern>", "deploy only when these paths change (repeatable; replaces the list): CODEOWNERS patterns like apps/web/ or packages/**, ! excludes", (v, prev = []) => [...prev, v]).option("--watch-all", "deploy on every change (clears the watch paths)").option("--name <name>", "target name").option("--steps <json>", `pre/post steps as a JSON array, @file or - (replaces the list), e.g. '[{"id":"migrate","kind":"d1_migrations","phase":"pre"}]'`);
 }
 async function planSetup(ctx, repo, o) {
   const c8 = ctx.client("user").deploy;
@@ -47920,6 +48619,7 @@ async function planSetup(ctx, repo, o) {
     ...o.previewAgentChanges !== void 0 ? { preview_agent_changes: o.previewAgentChanges } : {},
     preview_check_name: o.previewCheck ?? null,
     ...o.runsOn ? { runs_on: o.runsOn } : {},
+    ...o.watchPath ? { watch_paths: o.watchPath } : {},
     ...o.branch ? { branch: o.branch } : {},
     ...o.steps !== void 0 ? { steps: await stepsOf(ctx, o.steps) } : {}
   };
@@ -47931,6 +48631,7 @@ async function waitFor(ctx, d, interval, timeout) {
   for (; ; ) {
     if (d.status !== last) ctx.info(`${d.id}: ${d.status}${d.status_reason ? ` (${d.status_reason})` : ""}`);
     last = d.status;
+    ctx.status.working(`Deploy ${d.status}`);
     if (TERMINAL4.has(d.status) || Date.now() > deadline) return d;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
     d = await ctx.client("user").deploy.deployments.get(d.id);
@@ -47950,11 +48651,28 @@ function registerDeploy(program2, rt) {
 Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}`);
     })
   );
-  deploy.command("targets").description("Deploy targets of --repo").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user")), renderTargets)));
+  const targets2 = deploy.command("targets").description("Deploy targets of --repo; `protect` requires approvers for a target's production deploys").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user")), renderTargets)));
+  protectOptions(targets2.command("protect <target>").description("Require approvals for the target's production deploys and rollbacks (people with deploy:manage). Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").deploy.targets;
+      const t = await c8.get(await targetId(ctx, ref));
+      ctx.result(await c8.protect(t.id, protectBody(o, t.approval_rule)), renderRule);
+    })
+  );
+  targets2.command("unprotect <target>").description("Remove the target's approval rule; deploys waiting for it go on. Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await targetId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}: its production deploys will no longer wait for approval`);
+      await ctx.client("user").deploy.targets.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  targets2.command("approvers <target>").description("Who may approve the target's production deploys now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.approvers(await targetId(ctx, ref)), renderApprovers)));
   deploy.command("target <target>").description("One deploy target (id, or name in --repo)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.get(await targetId(ctx, ref)), renderTarget)));
   targetOptions(deploy.command("update <target>").description("Change a deploy target (only the given flags; an empty value clears a command or the environment)")).option("--disable", "stop deploying (merges no longer deploy)").option("--enable", "deploy again").action(
     act(rt, async (ctx, o, [ref]) => {
       if (o.disable && o.enable) throw usage("give either --disable or --enable");
+      if (o.watchAll && o.watchPath) throw usage("give either --watch-path or --watch-all");
       const c8 = ctx.client("user").deploy.targets;
       const cur = await c8.get(await targetId(ctx, ref));
       const patch = {
@@ -47974,6 +48692,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
         preview_agent_changes: o.previewAgentChanges,
         preview_check_name: orNull(o.previewCheck),
         runs_on: o.runsOn,
+        watch_paths: o.watchAll ? [] : o.watchPath,
         state: o.disable ? "disabled" : o.enable ? "active" : void 0,
         steps: await stepsOf(ctx, o.steps)
       };
@@ -48007,6 +48726,8 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
   );
   deploy.command("show <deployment>").description("One deployment with its steps").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.get(id2), renderDeployment)));
   deploy.command("cancel <deployment>").description("Cancel a queued or running deployment").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.cancel(id2), renderDeployment)));
+  deploy.command("approve <deployment>").description("Approve a deploy of a protected target (people who may approve; the last approval needed starts it)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.approve(id2), renderDeployment)));
+  deploy.command("reject <deployment>").description("Reject a deploy waiting for approval; it is cancelled").option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.reject(id2, o.reason), renderDeployment)));
   deploy.command("rollback <target>").description("Send all traffic back to the version of an earlier verified production deployment").requiredOption("--to <deployment>", "the deployment to roll back to (dpl_\u2026)").option("--message <text>", "deployment message").action(
     act(rt, async (ctx, o, [ref]) => {
       const id2 = await targetId(ctx, ref);
@@ -48019,8 +48740,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
 // packages/cli/src/commands/delegation.ts
 var ITERATION_DONE = /* @__PURE__ */ new Set(["succeeded", "no_changes", "failed", "cancelled"]);
 var STATES = ["working", "waiting", "stopped"];
-var who2 = (a) => a.display_name ?? `${a.type} ${a.id}`;
-var short = (oid) => oid ? oid.slice(0, 12) : null;
+var short2 = (oid) => oid ? oid.slice(0, 12) : null;
 function vendorArg(v) {
   if (!CODING_AGENT_VENDORS.includes(v)) throw usage(`unknown agent "${v}"; one of ${CODING_AGENT_VENDORS.join(", ")}`);
   return v;
@@ -48039,8 +48759,8 @@ function renderIterations(d) {
   const rows2 = d.iterations.map((i) => ({
     ...i,
     trigger: i.trigger_ref ? `${i.trigger} (${i.trigger_ref})` : i.trigger,
-    by: who2(i.trigger_actor),
-    head: short(i.head_oid)
+    by: actorLabel(i.trigger_actor),
+    head: short2(i.head_oid)
   }));
   const claims = d.iterations.map(reported).filter((x) => !!x);
   const errors = d.iterations.filter((i) => i.error).map((i) => `  #${i.number}: ${i.error}`);
@@ -48061,7 +48781,7 @@ var renderDelegation = (d) => kv(
     ...d,
     agent: `${d.agent.name} (${d.agent.vendor})`,
     status: delegationStatusLabel(d),
-    sponsor: who2(d.sponsor),
+    sponsor: actorLabel(d.sponsor),
     branch: `${d.source_ref} \u2192 ${d.target_ref}`,
     automatic: `on review ${d.auto_on_review ? "on" : "off"}, on check failure ${d.auto_on_check_failure ? "on" : "off"}`,
     budget: `iterations ${d.usage.iterations_used}/${d.budget.max_iterations}, tokens ${d.usage.tokens_used}/${d.budget.max_tokens}, ${d.budget.iteration_minutes} min per iteration`
@@ -48103,6 +48823,7 @@ async function waitForIteration(ctx, start, o) {
     const line2 = `${delegationStatusLabel(d)}${it ? ` (iteration #${it.number}: ${it.state})` : ""}`;
     if (line2 !== last) ctx.info(line2);
     last = line2;
+    ctx.status.working(`${d.agent.name}: ${line2}`);
     if (it ? ITERATION_DONE.has(it.state) : d.state !== "working") return { d, timedOut: false };
     if (Date.now() > deadline) return { d, timedOut: true };
     await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
@@ -48742,7 +49463,18 @@ function registerRepo(program2, rt) {
         await new Promise((r) => setTimeout(r, 2e3));
         job2 = await c8.migrations.get(job2.id);
       }
-      const view = { id: job2.id, state: job2.state, issues: job2.report.counts.issues, pull_requests: job2.report.counts.pull_requests, comments: job2.report.counts.comments, releases: job2.report.counts.releases, missing: job2.report.missing.join("; ") || "-" };
+      const deps = job2.report.dependencies;
+      const view = {
+        id: job2.id,
+        state: job2.state,
+        issues: job2.report.counts.issues,
+        pull_requests: job2.report.counts.pull_requests,
+        comments: job2.report.counts.comments,
+        releases: job2.report.counts.releases,
+        ...deps ? { blocked_by_links: `${deps.imported} imported${deps.skipped ? `, ${deps.skipped} skipped` : ""}` } : {},
+        missing: job2.report.missing.join("; ") || "-",
+        warnings: job2.report.warnings.join("; ") || "-"
+      };
       ctx.result(job2, () => kv(view, Object.keys(view)));
       if (o.wait && job2.state !== "completed") throw new CliError(`migration ${job2.state}: ${job2.error ?? job2.report.missing.join("; ")}`, EXIT.NOT_READY);
     })
@@ -48775,24 +49507,39 @@ function registerRepo(program2, rt) {
       if (t.transport === "ssh") {
         if (!t.ssh.ready) throw usage(`this machine is not set up for SSH${t.ssh.alias ? ` to ${t.ssh.alias}` : ""} yet: run \`${BRAND.cli} ssh setup\`, or clone with --https`);
         const url2 = sshCloneUrl(t.ssh.alias, r.org_slug, r.name);
-        const code2 = await ctx.deps.spawnGit(["clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
+        const code2 = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
         if (code2 !== 0) throw new CliError(`git clone over SSH exited with status ${code2}; \`${BRAND.cli} ssh test\` explains SSH problems, --https clones without SSH`, EXIT.UNEXPECTED, "GIT_FAILED");
         return ctx.result({ repository: r, directory, transport: "ssh", transport_reason: t.reason, clone_url: url2 }, cloned(r, directory, `over SSH (${url2})`, paint(colorEnabled(ctx.deps, "stdout"))));
       }
       if (t.approval) ctx.info(`Cloning over HTTPS: ${t.reason}. Pass --ssh to use SSH anyway.`);
       const token = await ctx.freshToken("agent");
-      const code = await ctx.deps.spawnGit(["clone", "--", r.clone_url, directory], {
+      const helper2 = await credentialHelperConfigured(ctx);
+      const list3 = helper2 && await gitAtLeast(ctx, "2.40.0") && await bundlesOffered(ctx, r.clone_url, token) ? [`--bundle-uri=${r.clone_url}/bundles`] : [];
+      const code = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", ...list3, "--", r.clone_url, directory], {
         env: gitAuthEnv(ctx.deps.env, token, r.clone_url),
         cwd: ctx.deps.cwd,
         stdoutToStderr: true
       });
       if (code !== 0) throw new CliError(`git clone exited with status ${code}`, EXIT.UNEXPECTED, "GIT_FAILED");
-      const helper2 = await credentialHelperConfigured(ctx);
       ctx.info(authGuidance(BRAND.cli, helper2));
       ctx.result({ repository: r, directory, transport: "https", transport_reason: t.reason, clone_url: r.clone_url, credential_helper: helper2 }, cloned(r, directory, "over HTTPS", paint(colorEnabled(ctx.deps, "stdout"))));
     })
   );
 }
+var SNAPSHOT_CLONE = ["-c", "transfer.bundleURI=true"];
+async function bundlesOffered(ctx, cloneUrl, token) {
+  try {
+    const res = await ctx.deps.sys.fetch(`${cloneUrl}/bundles`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(5e3) });
+    return res.ok && (await res.text()).includes('[bundle "');
+  } catch {
+    return false;
+  }
+}
+async function gitAtLeast(ctx, min) {
+  const r = await ctx.deps.sys.run("git", ["--version"], { timeoutMs: 1e4 }).catch(() => null);
+  const version4 = r?.code === 0 ? /git version (\d+\.\d+\.\d+)/.exec(r.stdout)?.[1] : void 0;
+  return !!version4 && compareVersions(version4, min) >= 0;
+}
 var hasRepo = (ctx) => {
   try {
     ctx.repoSpec();
@@ -48860,7 +49607,7 @@ function registerGit(program2, rt) {
 }
 
 // packages/cli/src/commands/release.ts
-var renderRelease = (r) => kv({ ...r, author: r.author.display_name ?? r.author.id }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
+var renderRelease = (r) => kv({ ...r, author: actorLabel(r.author) }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
 function registerRelease(program2, rt) {
   const release = program2.command("release").description("Releases of --repo (a tag with notes)");
   release.command("list").description("Releases, newest first").action(
@@ -49054,15 +49801,16 @@ function registerImage(program2, rt) {
       ctx.result(page, (p) => listWithCursor(p, ["reference", "tags", "versions", "updated_at"]));
     })
   );
-  image.command("delete <ref>").description("Delete a tag (`<image>:<tag>`) or a version and all its tags (`<image>@sha256:\u2026`); untagged versions are also collected after the retention window").action(
+  image.command("delete <ref>").description("Delete a tag (`<image>:<tag>`), a version and all its tags (`<image>@sha256:\u2026`), or an image with no versions left (`<image>`); untagged versions are also collected after the retention window").action(
     act(rt, async (ctx, _o, [spec]) => {
       const ref = parseImageRef(spec, await registryHost(ctx));
-      if (!ref || !ref.tag && !ref.digest) throw usage(`invalid image reference "${spec}": expected <namespace>/<repository>[/<image>]:<tag> or \u2026@sha256:<digest>`);
+      if (!ref) throw usage(`invalid image reference "${spec}": expected <namespace>/<repository>[/<image>][:<tag>|@sha256:<digest>]`);
       const img = await findImage(ctx, ref.name);
       if (ref.digest) await ctx.client().packages.deleteVersion(img.id, ref.digest);
-      else await ctx.client().packages.deleteTag(img.id, ref.tag);
-      const what = ref.digest ? `version ${ref.digest}` : `tag ${ref.tag}`;
-      ctx.result({ image: img.full_name, deleted: ref.digest ? { digest: ref.digest } : { tag: ref.tag } }, `Deleted ${what} of ${img.full_name}.`);
+      else if (ref.tag) await ctx.client().packages.deleteTag(img.id, ref.tag);
+      else await ctx.client().packages.delete(img.id);
+      const what = ref.digest ? `version ${ref.digest} of ${img.full_name}` : ref.tag ? `tag ${ref.tag} of ${img.full_name}` : `image ${img.full_name}`;
+      ctx.result({ image: img.full_name, deleted: ref.digest ? { digest: ref.digest } : ref.tag ? { tag: ref.tag } : { image: img.id } }, `Deleted ${what}.`);
     })
   );
 }
@@ -49302,12 +50050,13 @@ var renderRangeDiff = (r) => {
   if (r.truncated) lines2.push("(truncated)");
   return lines2.join("\n");
 };
-var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${o.actor.display_name ?? o.actor.id}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
+var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${actorLabel(o.actor)}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
 async function waitForPromotion(ctx, p, timeout, interval) {
   const deadline = Date.now() + timeout * 1e3;
   let last = p.state;
   ctx.info(`promotion ${p.id}: ${p.state}`);
   while (!TERMINAL5.has(p.state) && Date.now() < deadline) {
+    ctx.status.working(`Merge ${p.state}`);
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
     p = await ctx.client().promotions.get(p.id);
     if (p.state !== last) ctx.info(`promotion ${p.id}: ${last = p.state}`);
@@ -49378,7 +50127,7 @@ next: --cursor ${v.next_cursor}` : "") : listWithCursor(v, ["id"]));
 }
 
 // packages/cli/src/commands/coordination.ts
-var holderOf = (c8) => `${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}`;
+var holderOf = (c8) => `${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}`;
 var renderClaim = (r) => [
   `${r.already_held ? "Already yours" : "Claimed"}: ${r.claim.key}${r.claim.change ? ` (change #${r.claim.change.number})` : ""}`,
   ...r.skipped.length ? [`Taken by others: ${r.skipped.join(", ")}`] : [],
@@ -51681,7 +52430,7 @@ function safeLegs(m) {
 }
 
 // packages/cli/src/commands/actions.ts
-var renderRun = (r) => kv({ ...r, actor: r.actor.display_name ?? r.actor.id, trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
+var renderRun2 = (r) => kv({ ...r, actor: actorLabel(r.actor), trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
   "id",
   "workflow_name",
   "run_number",
@@ -51746,7 +52495,7 @@ function registerWorkflow(program2, rt) {
         inputs[kvp.slice(0, i)] = kvp.slice(i + 1);
       }
       const r = await ctx.client("user").actions.workflows.dispatch(await ctx.repoId(void 0, "user"), file2, { ...o.ref ? { ref: o.ref } : {}, inputs });
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
     })
   );
 }
@@ -51770,6 +52519,8 @@ async function watchRun(ctx, runId, interval, timeout, logs) {
 ${text2.trimEnd()}`);
       }
     }
+    const finished = r.jobs.filter((j) => j.status === "completed").length;
+    ctx.status.working(`Run ${r.status}: ${finished}/${r.jobs.length} jobs done`, r.jobs.length ? finished / r.jobs.length * 100 : void 0);
     if (TERMINAL6.has(r.status) || Date.now() > deadline) return r;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
   }
@@ -51789,13 +52540,13 @@ function registerRun(program2, rt) {
       const r = await c8.actions.runs.get(id2);
       if (o.log) for (const j of r.jobs) ctx.info(`\u2500\u2500 ${j.name} (${j.status}${j.conclusion ? `/${j.conclusion}` : ""}) \u2500\u2500
 ${(await c8.actions.jobs.logs(j.id)).trimEnd()}`);
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
     })
   );
   run3.command("watch <run>").description("Follow a run until it completes. Exit 0 when it succeeded, 1 when it failed or was cancelled, 7 on timeout").option("--interval <seconds>", "poll interval", (v) => parseIntOption(v, "--interval"), 2).option("--timeout <seconds>", "give up after", (v) => parseIntOption(v, "--timeout"), 3600).option("--log", "print each job's log when it completes").action(
     act(rt, async (ctx, o, [id2]) => {
       const r = await watchRun(ctx, id2, o.interval, o.timeout, !!o.log);
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
       ctx.setExit(runExit(r));
     })
   );
@@ -51820,8 +52571,8 @@ ${(await c8.actions.jobs.logs(j.id)).trimEnd()}`);
       ctx.result({ job_id: job2, conclusion: status }, `job ${job2}: ${status}`);
     })
   );
-  run3.command("cancel <run>").description("Cancel a run (running jobs are stopped on their runners)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").actions.runs.cancel(id2), renderRun)));
-  run3.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed/cancelled jobs and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun)));
+  run3.command("cancel <run>").description("Cancel a run (running jobs are stopped on their runners)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").actions.runs.cancel(id2), renderRun2)));
+  run3.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed/cancelled jobs and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun2)));
 }
 function registerSecret(program2, rt) {
   const secret = program2.command("secret").description("Actions secrets of --repo (default) or the organization (--org-level). Values are write-only");
@@ -52402,6 +53153,10 @@ ${res.stdout.slice(-8e3)}`;
 // packages/cli/src/runner/build-image-step.ts
 var BUILDKIT_IMAGE = "moby/buildkit:v0.34.0@sha256:b059f8d7226d0b326bc871af489a5dddf65e36af4d20d14251b072974d9ee87c";
 var COSIGN_IMAGE = "ghcr.io/sigstore/cosign/cosign:v3.1.3@sha256:9e5c2f2edc34351160407ca3416c61855bdf9403c3c5936e0f0be7fc261611b8";
+var BUILDKIT_RELEASE = { url: "https://github.com/moby/buildkit/releases/download/v0.34.0/buildkit-v0.34.0.linux-amd64.tar.gz", sha256: "14813b1fb2a40082114e6d386c6fc5e7dd5298176ce7ee1a18bc33e73e109ac3" };
+var COSIGN_RELEASE = { url: "https://github.com/sigstore/cosign/releases/download/v3.1.3/cosign-linux-amd64", sha256: "4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71" };
+var HOSTED_DIRS = { tools: "/opt/brnch/tools", state: "/var/lib/brnch-buildkit", run: "/run/brnch-buildkit", client: "/run/brnch-buildkit-client", context: "/run/brnch-build-context" };
+var BUILD_UID = 10999;
 var MAX_METADATA_OUTPUT = 32 * 1024;
 var list2 = (v) => (v ?? "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
 var lines = (v) => (v ?? "").split("\n").map((s) => s.trim()).filter(Boolean);
@@ -52454,15 +53209,15 @@ function inside2(p) {
   }
   return parts.join("/");
 }
-function buildctlArgs(i, metadataFile) {
-  const ctx = inside2(i.context);
+function buildLayout(i) {
+  const context = inside2(i.context);
   const file2 = inside2(i.file ?? `${i.context}/Dockerfile`);
-  if (ctx === null) return `context: ${i.context} is outside the workspace`;
-  if (file2 === null) return `file: ${i.file} is outside the workspace`;
-  const slash = file2.lastIndexOf("/");
-  const dir = slash >= 0 ? file2.slice(0, slash) : "";
-  const base2 = slash >= 0 ? file2.slice(slash + 1) : file2;
-  const args = ["build", "--frontend", "dockerfile.v0", "--local", `context=/workspace/${ctx}`.replace(/\/$/, ""), "--local", `dockerfile=/workspace/${dir}`.replace(/\/$/, ""), "--opt", `filename=${base2}`];
+  if (context === null) return `context: ${i.context} is outside the workspace`;
+  if (file2 === null || file2 === "") return `file: ${i.file} is outside the workspace`;
+  return { context, file: file2, filename: file2.slice(file2.lastIndexOf("/") + 1) };
+}
+function buildctlArgs(i, layout, metadataFile, root = "/workspace") {
+  const args = ["build", "--frontend", "dockerfile.v0", "--local", `context=${root}/context`, "--local", `dockerfile=${root}/dockerfile`, "--opt", `filename=${layout.filename}`];
   args.push("--opt", `platform=${i.platforms.join(",")}`);
   if (i.target) args.push("--opt", `target=${i.target}`);
   for (const [k, v] of Object.entries(i.buildArgs)) args.push("--opt", `build-arg:${k}=${v}`);
@@ -52475,6 +53230,215 @@ function buildctlArgs(i, metadataFile) {
   args.push("--metadata-file", metadataFile);
   return args;
 }
+var quote2 = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+async function copyContext(d, layout, owner) {
+  const fresh2 = async (hosted) => {
+    if (d.hosted) return await d.run(["sh", "-c", `rm -rf ${hosted} && install -d -m 0700 ${hosted}`], { env: d.env, timeoutMs: 6e4 }) === 0 ? hosted : null;
+    const made = await d.capture(["mktemp", "-d", "/tmp/brnch-build-context.XXXXXXXX"], { env: d.env });
+    const dir2 = made.stdout.trim();
+    return made.code === 0 && dir2.startsWith("/tmp/brnch-build-context.") ? dir2 : null;
+  };
+  const staging = await fresh2(`${HOSTED_DIRS.context}-staging`);
+  const dir = staging && await fresh2(HOSTED_DIRS.context);
+  if (!staging || !dir) {
+    if (staging) await d.run(["rm", "-rf", staging], { env: d.env, timeoutMs: 6e4 });
+    return { error: "could not prepare the build context" };
+  }
+  const asStep = d.stepUser ? ["setpriv", `--reuid=${d.stepUser.uid}`, `--regid=${d.stepUser.gid}`, "--clear-groups", "--"] : [];
+  const asOwner = owner !== null && owner !== 0 ? ["setpriv", `--reuid=${owner}`, `--regid=${owner}`, "--clear-groups", "--"] : [];
+  const ws = (rel) => rel ? `${d.workspace}/${rel}` : d.workspace;
+  const ignore = `${layout.filename}.dockerignore`;
+  const stage = [
+    "set -e",
+    `w=$(cd -- ${quote2(d.workspace)} && pwd -P)`,
+    'inside() { case "$1" in "$w"/*) ;; *) echo "brnch/build-image@v1: $2 is outside the workspace" >&2; exit 3;; esac; }',
+    `c=$(cd -- ${quote2(ws(layout.context))} && pwd -P)`,
+    'case "$c" in "$w"|"$w"/*) ;; *) echo "brnch/build-image@v1: the context is outside the workspace" >&2; exit 3;; esac',
+    `fd=$(cd -- "$(dirname -- ${quote2(ws(layout.file))})" && pwd -P)`,
+    `r=$(realpath -- "$fd/$(basename -- ${quote2(ws(layout.file))})")`,
+    `inside "$r" ${quote2(layout.file)}`,
+    `cp -a -- "$c/." ${quote2(`${staging}/context`)}`,
+    `mkdir -- ${quote2(`${staging}/dockerfile`)}`,
+    `cp -- "$r" ${quote2(`${staging}/dockerfile/${layout.filename}`)}`,
+    // The name is the step's input: quoted into a variable, never into shell source (review of #287).
+    `ig=${quote2(ignore)}`,
+    'if [ -e "$fd/$ig" ]; then i=$(realpath -- "$fd/$ig"); inside "$i" "$ig"; cp -- "$i" ' + quote2(`${staging}/dockerfile/${ignore}`) + "; fi",
+    // Readable by the builder user for stage 2; the step's own files, nothing else.
+    `chmod -R a+rX ${quote2(staging)}`
+  ].join("; ");
+  const fail = async () => {
+    await d.run(["rm", "-rf", staging, dir], { env: d.env, timeoutMs: 6e4 });
+    return { error: `could not copy the build context (${layout.context || "."}) and ${layout.file}: they must be a directory and a file in the workspace that the job can read` };
+  };
+  for (const cmd of [
+    ...d.stepUser ? [["chown", `${d.stepUser.uid}:${d.stepUser.gid}`, staging], ["chmod", "0755", staging]] : [],
+    [...asStep, "sh", "-c", stage],
+    ...owner === null ? [] : [["chown", `${owner}:${owner}`, dir]],
+    // No trailing "/.": a top directory swapped for a link is copied as that link, and refused below.
+    [...asOwner, "cp", "-a", "--", `${staging}/context`, `${staging}/dockerfile`, `${dir}/`],
+    ["sh", "-c", 'for p in "$1/context" "$1/dockerfile"; do [ -d "$p" ] && [ ! -L "$p" ] || exit 1; done', "sh", dir],
+    ["rm", "-rf", staging]
+  ]) {
+    const done2 = await d.run(cmd, { env: d.env, timeoutMs: 10 * 6e4 });
+    if (done2 === null) return null;
+    if (done2 !== 0) return fail();
+  }
+  return dir;
+}
+function buildScopes(i, host, repository = "", dockerfile = "") {
+  const name = (ref) => ref.slice(host.length + 1).replace(/@.*$/, "").replace(/:[^/]*$/, "");
+  const want = /* @__PURE__ */ new Map();
+  const add = (ref, actions) => {
+    const n = name(ref);
+    want.set(n, /* @__PURE__ */ new Set([...want.get(n) ?? [], ...actions]));
+  };
+  if (i.push) for (const t of i.tags) add(t, ["pull", "push"]);
+  for (const c8 of i.cacheTo) add(/(?:^|,)ref=([^,]+)/.exec(c8)[1], ["pull", "push"]);
+  for (const c8 of i.cacheFrom) add(/(?:^|,)ref=([^,]+)/.exec(c8)[1], ["pull"]);
+  if (repository && dockerfile) {
+    for (const ref of dockerfileImages(dockerfile)) if (ownImage(ref, host, repository)) add(ref, ["pull"]);
+  }
+  return [...want].map(([n, a]) => `repository:${n}:${[...a].sort().join(",")}`);
+}
+function dockerfileImages(dockerfile) {
+  const out = [];
+  const all = dockerfile.replace(/\r\n/g, "\n").split("\n");
+  let escape = "\\";
+  for (const l of all) {
+    const d = /^\s*#\s*(syntax|escape|check)\s*=\s*(\S+)\s*$/i.exec(l);
+    if (!d) break;
+    if (d[1].toLowerCase() === "escape" && (d[2] === "`" || d[2] === "\\")) escape = d[2];
+  }
+  const uncommented = all.filter((l) => !l.trim().startsWith("#")).join("\n");
+  const lines2 = uncommented.split(`${escape}
+`).join(" ").split("\n");
+  const value = String.raw`("[^"]*"|'[^']*'|[^\s,]+)`;
+  const unquote = (v) => /^(["']).*\1$/.test(v) ? v.slice(1, -1) : v;
+  for (const raw of lines2) {
+    const line2 = raw.trim();
+    if (!line2) continue;
+    const from = /^FROM\s+(?:--platform=\S+\s+)?(\S+)/i.exec(line2);
+    if (from) out.push(from[1]);
+    if (/^(COPY|ADD)\s/i.test(line2)) for (const m of line2.matchAll(new RegExp(`--from=${value}`, "g"))) out.push(unquote(m[1]));
+    if (/^RUN\s/i.test(line2)) for (const m of line2.matchAll(new RegExp(String.raw`--mount=\S*?\bfrom=${value}`, "g"))) out.push(unquote(m[1]));
+  }
+  return out;
+}
+var OCI_PATH = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+function ownImage(ref, host, repository) {
+  const m = /^([^/]+)\/([^:@]+)(?::[\w][\w.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$/.exec(ref);
+  if (!m || m[1] !== host || !OCI_PATH.test(m[2])) return false;
+  const own2 = repository.toLowerCase();
+  return m[2] === own2 || m[2].startsWith(`${own2}/`);
+}
+var BUILD_TOKEN_SECONDS = 21600;
+async function mintBuildToken(d, host, scopes) {
+  const url2 = new URL(`${new URL(d.baseUrl).protocol}//${host}/v2/token`);
+  url2.searchParams.set("service", host);
+  for (const s of scopes) url2.searchParams.append("scope", s);
+  url2.searchParams.set("expires_in", String(BUILD_TOKEN_SECONDS));
+  try {
+    const res = await d.fetch(url2.toString(), { headers: { authorization: `Bearer ${d.jobToken}` } });
+    const body = await res.json().catch(() => null);
+    if (res.ok && typeof body?.token === "string" && body.token) return body.token;
+    return { error: `the registry did not issue a token for this build (HTTP ${res.status})` };
+  } catch (e) {
+    return { error: `could not reach the registry for a token: ${e.message}` };
+  }
+}
+function dockerBuilder(d, auth, context) {
+  const name = `brnch-buildkit-${d.jobId.replace(/[^a-z0-9]/gi, "").toLowerCase()}`;
+  const docker = (a, timeoutMs = 10 * 6e4, env = d.env) => d.run(["docker", ...a], { env, timeoutMs });
+  return {
+    metadataFile: "/tmp/brnch-metadata.json",
+    contextRoot: "/workspace",
+    async start() {
+      d.log(`##[group]Start BuildKit (${BUILDKIT_IMAGE.split("@")[0]})`);
+      try {
+        const started = await docker(["run", "-d", "--rm", "--privileged", "--name", name, "-v", `${context}:/workspace:ro`, "-v", `${auth}:/root/.docker:ro`, BUILDKIT_IMAGE]);
+        if (started === null) return null;
+        if (started !== 0) return "could not start the BuildKit container";
+        return await waitReady(() => d.capture(["docker", "exec", name, "buildctl", "debug", "workers"], { env: d.env })) ? "" : "BuildKit did not become ready within 30 seconds";
+      } finally {
+        d.log("##[endgroup]");
+      }
+    },
+    buildctl: (args) => docker(["exec", name, "buildctl", ...args], null),
+    readMetadata: async () => (await d.capture(["docker", "exec", name, "cat", "/tmp/brnch-metadata.json"], { env: d.env })).stdout,
+    sign: (args, env) => docker(["run", "--rm", "--user", "0", "-v", `${auth}:/root/.docker:ro`, "-e", "DOCKER_CONFIG=/root/.docker", "-e", "COSIGN_KEY", "-e", "COSIGN_PASSWORD", COSIGN_IMAGE, ...args], 5 * 6e4, { ...d.env, ...env }),
+    stop: async () => {
+      await d.capture(["docker", "rm", "-f", name], { env: d.env });
+    }
+  };
+}
+function hostedBuilder(d, auth, signing, context) {
+  const tools = `${HOSTED_DIRS.tools}/build-image`;
+  const bin = `${tools}/buildkit/bin`;
+  const sock = `unix://${HOSTED_DIRS.client}/buildkitd.sock`;
+  const asBuilder = (cmd) => ["setpriv", `--reuid=${BUILD_UID}`, `--regid=${BUILD_UID}`, "--clear-groups", "--", ...cmd];
+  const buildctl = `${HOSTED_DIRS.client}/buildctl`;
+  const clientEnv = { ...d.env, DOCKER_CONFIG: auth, HOME: HOSTED_DIRS.client };
+  const run3 = (cmd, timeoutMs = 10 * 6e4, env = d.env) => d.run(cmd, { env, timeoutMs });
+  const fetchChecked = async (url2, sha2562, out) => {
+    const got = await run3(["curl", "-fsSL", "--retry", "3", "-o", out, url2], 5 * 6e4);
+    if (got === null) return null;
+    if (got !== 0) return `could not download ${url2}`;
+    const sum = (await d.capture(["sha256sum", out], { env: d.env })).stdout.split(/\s/)[0];
+    return sum === sha2562 ? "" : `${url2} has sha256 ${sum || "(unreadable)"}, not the pinned ${sha2562}`;
+  };
+  return {
+    metadataFile: `${HOSTED_DIRS.client}/metadata.json`,
+    contextRoot: context,
+    async start() {
+      d.log(`##[group]Start BuildKit (${BUILDKIT_RELEASE.url.split("/").at(-1)}, beside the job)`);
+      try {
+        for (const dir of [HOSTED_DIRS.tools, tools, `${tools}/buildkit`, HOSTED_DIRS.state, HOSTED_DIRS.run]) {
+          const made = await run3(["install", "-d", "-m", "0700", dir]);
+          if (made !== 0) return made === null ? null : `could not create ${dir}`;
+        }
+        for (const cmd of [["install", "-d", "-m", "0700", "-o", String(BUILD_UID), "-g", String(BUILD_UID), HOSTED_DIRS.client], ["chown", "-R", `${BUILD_UID}:${BUILD_UID}`, auth]]) {
+          const done2 = await run3(cmd);
+          if (done2 !== 0) return done2 === null ? null : `could not prepare the build user (${cmd[0]})`;
+        }
+        const tgz = `${tools}/buildkit.tar.gz`;
+        const got = await fetchChecked(BUILDKIT_RELEASE.url, BUILDKIT_RELEASE.sha256, tgz);
+        if (got !== "") return got;
+        const unpacked = await run3(["tar", "-xzf", tgz, "-C", `${tools}/buildkit`]);
+        if (unpacked !== 0) return unpacked === null ? null : "could not unpack BuildKit";
+        const client = await run3(["install", "-m", "0755", `${bin}/buildctl`, buildctl]);
+        if (client !== 0) return client === null ? null : "could not install buildctl for the build user";
+        if (signing) {
+          const cosign = await fetchChecked(COSIGN_RELEASE.url, COSIGN_RELEASE.sha256, `${tools}/cosign`);
+          if (cosign !== "") return cosign;
+          if (await run3(["chmod", "0700", `${tools}/cosign`]) !== 0) return "could not install cosign";
+        }
+        const daemon = `${bin}/buildkitd --root ${HOSTED_DIRS.state} --addr ${sock} --group ${BUILD_UID} --oci-worker-snapshotter=overlayfs --containerd-worker=false`;
+        const started = await run3(["sh", "-c", `PATH=${bin}:$PATH nohup ${daemon} > ${HOSTED_DIRS.run}/buildkitd.log 2>&1 & echo $! > ${HOSTED_DIRS.run}/buildkitd.pid`]);
+        if (started !== 0) return started === null ? null : "could not start buildkitd";
+        if (await waitReady(() => d.capture(asBuilder([buildctl, "--addr", sock, "debug", "workers"]), { env: clientEnv }))) return "";
+        d.log((await d.capture(["tail", "-20", `${HOSTED_DIRS.run}/buildkitd.log`], { env: d.env })).stdout);
+        return "BuildKit did not become ready within 30 seconds";
+      } finally {
+        d.log("##[endgroup]");
+      }
+    },
+    // buildctl reads registry credentials from DOCKER_CONFIG on the client side and hands them to buildkitd's session.
+    buildctl: (args) => run3(asBuilder([buildctl, "--addr", sock, ...args]), null, clientEnv),
+    readMetadata: async () => (await d.capture(["cat", `${HOSTED_DIRS.client}/metadata.json`], { env: d.env })).stdout,
+    sign: (args, env) => run3([`${tools}/cosign`, ...args], 5 * 6e4, { ...d.env, ...env, DOCKER_CONFIG: auth, HOME: auth }),
+    stop: async () => {
+      const pid = `${HOSTED_DIRS.run}/buildkitd.pid`;
+      await d.capture(["sh", "-c", `p=$(cat ${pid} 2>/dev/null); if [ -n "$p" ]; then kill $p 2>/dev/null; for i in 1 2 3 4 5 6 7 8 9 10; do kill -0 $p 2>/dev/null || break; sleep 1; done; kill -9 $p 2>/dev/null; fi; rm -rf ${HOSTED_DIRS.client} ${pid}`], { env: d.env });
+    }
+  };
+}
+async function waitReady(probe) {
+  for (let i = 0; i < 30; i++) {
+    if ((await probe()).code === 0) return true;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
 async function runBuildImage(w, d) {
   const fail = (msg) => {
     d.log(`##[error]brnch/build-image@v1: ${msg}`);
@@ -52486,41 +53450,46 @@ async function runBuildImage(w, d) {
   const bad = checkRefs(parsed, host, d.repository);
   if (bad) return fail(bad);
   if (parsed.push && !parsed.tags.length) return fail("tags are required when pushing (or set push: false)");
-  if (d.hosted) {
-    return fail("hosted runners cannot build images yet: BuildKit inside Cloudflare Containers is waiting on a capability probe (ADR-0083 \xA76). Run this job on a self-hosted runner with Docker (runs-on: [self-hosted, \u2026]).");
-  }
-  if ((await d.capture(["docker", "info", "--format", "{{.ServerVersion}}"], { env: d.env })).code !== 0) {
+  if (d.hosted && parsed.platforms.some((p) => p !== "linux/amd64")) return fail("hosted runners are x86_64 and build linux/amd64 only; build linux/arm64 on a self-hosted runner that can");
+  if (!d.hosted && (await d.capture(["docker", "info", "--format", "{{.ServerVersion}}"], { env: d.env })).code !== 0) {
     return fail("this runner has no usable Docker (docker info failed); install Docker or run the job on a runner that has it");
   }
-  const args = buildctlArgs(parsed, "/tmp/brnch-metadata.json");
-  if (typeof args === "string") return fail(args);
-  const auth = `${d.temp}/build-image-${d.jobId}`;
-  d.writePrivate(`${auth}/config.json`, JSON.stringify({ auths: { [host]: { auth: btoa(`brnch:${d.jobToken}`) } } }));
-  const name = `brnch-buildkit-${d.jobId.replace(/[^a-z0-9]/gi, "").toLowerCase()}`;
-  const docker = (a, timeoutMs = 10 * 6e4, env = d.env) => d.run(["docker", ...a], { env, timeoutMs });
+  const layout = buildLayout(parsed);
+  if (typeof layout === "string") return fail(layout);
+  const context = await copyContext(d, layout, d.hosted ? BUILD_UID : d.stepUser ? 0 : null);
+  if (context === null) return { outcome: "cancelled", outputs: {} };
+  if (typeof context !== "string") return fail(context.error);
+  const auth = d.hosted ? `${HOSTED_DIRS.client}/docker` : `${d.temp}/build-image-${d.jobId}`;
+  const builder = d.hosted ? hostedBuilder(d, auth, !!parsed.cosignKey && parsed.push, context) : dockerBuilder(d, auth, context);
+  const args = buildctlArgs(parsed, layout, builder.metadataFile, builder.contextRoot);
+  const dockerfile = (await d.capture(["cat", "--", `${context}/dockerfile/${layout.filename}`], { env: d.env })).stdout;
+  const scopes = buildScopes(parsed, host, d.repository, dockerfile);
+  let credential = null;
+  if (scopes.length) {
+    const minted = await mintBuildToken(d, host, scopes);
+    if (typeof minted !== "string") {
+      await d.run(["rm", "-rf", context], { env: d.env, timeoutMs: 6e4 });
+      return fail(minted.error);
+    }
+    credential = minted;
+  }
+  d.writePrivate(`${auth}/config.json`, JSON.stringify({ auths: credential ? { [host]: { auth: btoa(`brnch:${credential}`) } } : {} }));
   try {
-    d.log(`##[group]Start BuildKit (${BUILDKIT_IMAGE.split("@")[0]})`);
-    const started = await docker(["run", "-d", "--rm", "--privileged", "--name", name, "-v", `${d.workspace}:/workspace:ro`, "-v", `${auth}:/root/.docker:ro`, BUILDKIT_IMAGE]);
-    if (started !== 0) return started === null ? { outcome: "cancelled", outputs: {} } : fail("could not start the BuildKit container");
-    let ready = false;
-    for (let i = 0; i < 30 && !ready; i++) {
-      ready = (await d.capture(["docker", "exec", name, "buildctl", "debug", "workers"], { env: d.env })).code === 0;
-      if (!ready) await new Promise((r) => setTimeout(r, 1e3));
-    }
-    d.log("##[endgroup]");
-    if (!ready) return fail("BuildKit did not become ready within 30 seconds");
+    const started = await builder.start();
+    if (started === null) return { outcome: "cancelled", outputs: {} };
+    if (started) return fail(started);
     d.log(`##[group]Build ${parsed.tags.join(", ") || "(no tags)"} for ${parsed.platforms.join(", ")}`);
-    const built = await docker(["exec", name, "buildctl", ...args], null);
+    const built = await builder.buildctl(args);
     d.log("##[endgroup]");
     if (built === null) return { outcome: "cancelled", outputs: {} };
     if (built !== 0) return fail(`the build failed (buildctl exited ${built})`);
-    const meta3 = await d.capture(["docker", "exec", name, "cat", "/tmp/brnch-metadata.json"], { env: d.env });
+    const meta3 = await builder.readMetadata();
     let digest = "";
     try {
-      digest = String(JSON.parse(meta3.stdout)["containerimage.digest"] ?? "");
+      digest = String(JSON.parse(meta3)["containerimage.digest"] ?? "");
     } catch {
     }
-    const outputs = { metadata: meta3.stdout.slice(0, MAX_METADATA_OUTPUT) };
+    const outputs = { metadata: meta3.slice(0, MAX_METADATA_OUTPUT) };
     if (parsed.push) {
       if (!/^sha256:[a-f0-9]{64}$/.test(digest)) return fail("the build pushed, but BuildKit reported no image digest");
       const first2 = parsed.tags[0].replace(/[:@][^/]*$/, "");
@@ -52529,9 +53498,9 @@ async function runBuildImage(w, d) {
       d.log(`pushed ${outputs.image}`);
       if (parsed.cosignKey) {
         d.log(`##[group]Sign ${outputs.image} with cosign`);
-        const signArgs = ["run", "--rm", "--user", "0", "-v", `${auth}:/root/.docker:ro`, "-e", "DOCKER_CONFIG=/root/.docker", "-e", "COSIGN_KEY", "-e", "COSIGN_PASSWORD", COSIGN_IMAGE, "sign", "--key", "env://COSIGN_KEY", "--yes"];
+        const signArgs = ["sign", "--key", "env://COSIGN_KEY", "--yes"];
         if (!parsed.cosignTlog) signArgs.push("--use-signing-config=false", "--tlog-upload=false");
-        const signed = await docker([...signArgs, outputs.image], 5 * 6e4, { ...d.env, COSIGN_KEY: parsed.cosignKey, COSIGN_PASSWORD: parsed.cosignPassword ?? "" });
+        const signed = await builder.sign([...signArgs, outputs.image], { COSIGN_KEY: parsed.cosignKey, COSIGN_PASSWORD: parsed.cosignPassword ?? "" });
         d.log("##[endgroup]");
         if (signed === null) return { outcome: "cancelled", outputs };
         if (signed !== 0) return fail(`cosign could not sign ${outputs.image} (exit ${signed})`);
@@ -52542,8 +53511,9 @@ async function runBuildImage(w, d) {
     }
     return { outcome: "success", outputs };
   } finally {
-    await d.capture(["docker", "rm", "-f", name], { env: d.env });
+    await builder.stop();
     d.removeDir(auth);
+    await d.run(["rm", "-rf", context], { env: d.env, timeoutMs: 6e4 });
   }
 }
 
@@ -53218,6 +54188,14 @@ async function runCodeReviewStep(spec, host) {
   return ok && parsed.status !== "failed" ? "success" : "failure";
 }
 
+// packages/cli/src/runner/checkout-retry.ts
+var CHECKOUT_RETRY_DELAYS_MS = [15e3, 3e4, 6e4, 12e4, 24e4];
+var RPC_FAILED = /\bRPC failed; (?:HTTP (?:429|5\d\d)\b|curl (?:6|7|16|18|28|35|52|55|56|92)\b)/;
+var UNABLE_TO_ACCESS = /\bunable to access '[^']*': (?:The requested URL returned error: (?:429|5\d\d)\b|Failed to connect|Could not resolve host|Connection timed out|Operation timed out|Recv failure|Send failure|Empty reply from server|OpenSSL SSL_)/;
+function transientGitFailure(line2) {
+  return RPC_FAILED.test(line2) || UNABLE_TO_ACCESS.test(line2);
+}
+
 // packages/cli/src/runner/executor.ts
 var NODE_OS = { linux: "Linux", darwin: "macOS", win32: "Windows" };
 var NODE_ARCH = { x64: "X64", arm64: "ARM64", arm: "ARM" };
@@ -53467,6 +54445,12 @@ var JobExecution = class {
     }
     spawnSync2("rm", ["-rf", "--", gone], { uid: this.owner.uid, gid: this.owner.gid, stdio: "ignore" });
   }
+  /** Wait `ms`, cut short when the job is cancelled: whether the job may go on. */
+  async pause(ms) {
+    const until = Date.now() + ms;
+    while (!this.cancelled && Date.now() < until) await new Promise((r) => setTimeout(r, Math.min(1e3, until - Date.now())));
+    return !this.cancelled;
+  }
   /** Run one process with streamed, masked output. Resolves to its exit code, or null if it was killed. */
   exec(cmd, o) {
     return new Promise((resolveExit) => {
@@ -53744,18 +54728,41 @@ var JobExecution = class {
     }
     const depth = w["fetch-depth"] === void 0 ? 1 : Number(w["fetch-depth"]);
     const env = this.gitEnv();
-    const git4 = (args) => this.exec(["git", ...args], { cwd: this.workspace, env, asStepUser: false, timeoutMs: 30 * 6e4 });
+    let transient = false;
+    const onLine = (l) => {
+      if (transientGitFailure(l)) transient = true;
+      return false;
+    };
+    const git4 = (args) => {
+      transient = false;
+      return this.exec(["git", ...args], { cwd: this.workspace, env, asStepUser: false, timeoutMs: 30 * 6e4, onLine });
+    };
+    const fetchCommit = async (args) => {
+      for (let attempt = 0; ; attempt++) {
+        const code2 = await git4(["fetch", ...args]);
+        const delay = CHECKOUT_RETRY_DELAYS_MS[attempt];
+        if (code2 === 0 || code2 === null || !transient) return code2;
+        if (delay === void 0 || Date.now() + delay >= this.deadline) {
+          this.log("##[error]the server kept failing the fetch; the repository's storage may be busy. Run the job again in a few minutes");
+          return code2;
+        }
+        this.log(`##[brnch] the server could not answer the fetch; retrying in ${delay / 1e3} s (attempt ${attempt + 2} of ${CHECKOUT_RETRY_DELAYS_MS.length + 1})`);
+        if (!await this.pause(delay)) return null;
+      }
+    };
     this.discard(this.workspace);
     mkdirSync3(this.workspace, { mode: 493 });
     const branch = a.ref.startsWith("refs/heads/") ? a.ref.slice("refs/heads/".length) : null;
     const fetchAndCheckout = async () => {
       for (const args of [["init", "-q"], ["remote", "add", "origin", this.gitUrl()]]) if (await git4(args) !== 0) return 1;
-      let code2 = depth > 0 ? await git4(["fetch", "--no-tags", "--prune", `--depth=${depth}`, "origin", a.head_sha]) : 1;
-      if (code2 !== 0) {
-        if (this.cancelled) return null;
-        if (depth > 0) this.log("##[brnch] shallow fetch is not available here; fetching full history of the commit");
-        code2 = await git4(["fetch", "--no-tags", "origin", a.head_sha]);
-      }
+      let code2;
+      if (depth > 0) {
+        code2 = await fetchCommit(["--no-tags", "--prune", `--depth=${depth}`, "origin", a.head_sha]);
+        if (code2 !== 0 && code2 !== null && !transient) {
+          this.log("##[brnch] the shallow fetch failed; fetching full history of the commit");
+          code2 = await fetchCommit(["--no-tags", "origin", a.head_sha]);
+        }
+      } else code2 = await fetchCommit(["--no-tags", "origin", a.head_sha]);
       if (code2 !== 0) return code2;
       return git4(branch ? ["checkout", "-q", "-B", branch, a.head_sha] : ["checkout", "-q", "--detach", a.head_sha]);
     };
@@ -53800,6 +54807,7 @@ var JobExecution = class {
   async buildImageStep(w, env) {
     const r = await runBuildImage(w, {
       baseUrl: this.opts.baseUrl,
+      fetch: (url2, init) => fetch(url2, init),
       registryHost: this.a.registry_host ?? null,
       repository: this.a.repository.full_name,
       jobToken: this.a.job_token,
@@ -53807,6 +54815,7 @@ var JobExecution = class {
       workspace: this.workspace,
       temp: this.temp,
       hosted: this.opts.hosted,
+      stepUser: this.opts.stepUser ? { uid: this.opts.stepUser.uid, gid: this.opts.stepUser.gid } : null,
       log: (l) => this.log(l),
       run: (cmd, o) => this.exec(cmd, { cwd: this.workspace, env: o.env, asStepUser: false, timeoutMs: o.timeoutMs, onLine: this.onCommandLine }),
       capture: async (cmd, o) => {
@@ -54021,12 +55030,81 @@ function sanitizedEnv(env) {
   return out;
 }
 
+// packages/cli/src/runner/resources.ts
+import { statfs } from "node:fs/promises";
+import { cpus, freemem, totalmem, uptime } from "node:os";
+function cpuPercent(before, after) {
+  if (!before.length || before.length !== after.length) return null;
+  let idle = 0;
+  let total = 0;
+  for (let i = 0; i < after.length; i++) {
+    for (const key of ["user", "nice", "sys", "idle", "irq"]) {
+      const delta = after[i].times[key] - before[i].times[key];
+      if (delta < 0 || !Number.isFinite(delta)) return null;
+      total += delta;
+      if (key === "idle") idle += delta;
+    }
+  }
+  return total > 0 ? Math.round((1 - idle / total) * 1e3) / 10 : null;
+}
+var RunnerResourceCollector = class {
+  constructor(workDir, jobSlots) {
+    this.workDir = workDir;
+    this.jobSlots = jobSlots;
+  }
+  workDir;
+  jobSlots;
+  previous = null;
+  disk = null;
+  diskPending = false;
+  sample() {
+    const at = performance.now();
+    try {
+      this.refreshDisk();
+      const current = cpus();
+      const interval = this.previous ? Math.round(at - this.previous.at) : 0;
+      const cpu = this.previous && interval > 0 && interval <= 6e5 ? cpuPercent(this.previous.cpus, current) : null;
+      this.previous = { cpus: current, at };
+      const disk = this.disk && at - this.disk.at <= 6e4 ? this.disk : null;
+      const totalMemory = totalmem();
+      const parsed = RunnerResourceSnapshot.safeParse({
+        cpu_percent: cpu,
+        cpu_count: current.length,
+        cpu_interval_ms: cpu === null ? null : interval,
+        memory_total_bytes: totalMemory,
+        memory_available_bytes: Math.min(totalMemory, Math.max(0, freemem())),
+        disk_total_bytes: disk?.total ?? null,
+        disk_available_bytes: disk?.available ?? null,
+        uptime_seconds: Math.floor(uptime()),
+        job_slots: this.jobSlots
+      });
+      return parsed.success ? parsed.data : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  refreshDisk() {
+    if (this.diskPending) return;
+    this.diskPending = true;
+    void statfs(this.workDir).then((s) => {
+      const total = s.blocks * s.bsize;
+      const available = Math.min(total, Math.max(0, s.bavail * s.bsize));
+      this.disk = Number.isSafeInteger(total) && total > 0 && Number.isSafeInteger(available) ? { total, available, at: performance.now() } : null;
+    }).catch(() => {
+      this.disk = null;
+    }).finally(() => {
+      this.diskPending = false;
+    });
+  }
+};
+
 // packages/cli/src/runner/agent.ts
 var RunnerAgent = class {
   constructor(cfg, opts) {
     this.cfg = cfg;
     this.opts = opts;
     this.client = this.clientFor(cfg);
+    this.resources = new RunnerResourceCollector(opts.workDir, opts.once || cfg.ephemeral ? 1 : opts.jobs);
   }
   cfg;
   opts;
@@ -54038,6 +55116,7 @@ var RunnerAgent = class {
   exit = null;
   heartbeatTimer = null;
   taken = 0;
+  resources;
   clientFor(cfg) {
     return createClient({ baseUrl: cfg.url, token: cfg.credential, userAgent: `${BRAND.cli}-runner/${BRAND.version}`, headers: { "x-brnch-runner-version": BRAND.version }, ...this.opts.fetch ? { fetch: this.opts.fetch } : {} });
   }
@@ -54075,7 +55154,7 @@ var RunnerAgent = class {
   }
   async heartbeat() {
     try {
-      const r = await this.client.runner.heartbeat({ running_jobs: [...this.running.keys()] });
+      const r = await this.client.runner.heartbeat({ running_jobs: [...this.running.keys()], resources: this.resources.sample() });
       for (const id2 of r.cancel_jobs) this.running.get(id2)?.exec.cancel("cancelled by the server");
       for (const id2 of r.forget_jobs) this.running.get(id2)?.exec.abort("the server reassigned this job");
       if (r.removed) {
@@ -54122,6 +55201,7 @@ var RunnerAgent = class {
     await this.client.runner.diagnostics(diagnostics(this.cfg)).catch(() => void 0);
     const unhook = this.opts.onSignal?.((s) => this.shutdown(s)) ?? (() => void 0);
     this.heartbeatTimer = setInterval(() => void this.heartbeat(), Math.max(1, me.heartbeat_seconds) * 1e3);
+    await this.heartbeat();
     const single = this.opts.once || this.cfg.ephemeral;
     let backoff = 1e3;
     try {
@@ -55139,6 +56219,13 @@ var EXAMPLES = {
   "deploy run": [`${c7} deploy run production --wait || echo "deploy failed (exit $?)"`, `${c7} deploy run dpt_123 --commit 0123456789abcdef0123456789abcdef01234567`],
   "deploy update": [`${c7} deploy update production --build "npm run build:prod"`, `${c7} deploy update production --disable`],
   "deploy rollback": [`${c7} deploy rollback production --to dpl_123`],
+  "db sources add": [
+    `${c7} db suggest                                  # the migration directories found`,
+    `${c7} db sources add --name app --path db/migrations --format atlas --engine postgres --connection icn_123 --organization acme --database app --revisions-schema app_atlas`,
+    `op read "op://Infra/app-dsn/credential" | ${c7} db sources add --name app \u2026 --credential-mode dsn --dsn-file -`
+  ],
+  "db plan": [`${c7} db plan app`, `${c7} db plan app --ref my-branch --live`],
+  "db approve": [`${c7} db runs --source app`, `${c7} db approve dmr_123 --reason "reviewed the plan"`],
   version: [`${c7} version`, `${c7} version --json`],
   upgrade: [`${c7} upgrade --check`, `${c7} upgrade`, `${c7} upgrade --force`],
   doctor: [`${c7} doctor`, `${c7} doctor --json | jq '.checks[] | select(.status != "ok")'`],
@@ -55279,6 +56366,7 @@ function buildProgram(rt) {
   registerMemory(program2, rt);
   registerIntegrations(program2, rt);
   registerDeploy(program2, rt);
+  registerDb(program2, rt);
   registerDelegate(program2, rt);
   registerAgents(program2, rt);
   registerCodingAgents(program2, rt);
@@ -55353,17 +56441,44 @@ function report2(e, deps, state2) {
 `);
   return exitCode;
 }
-async function run2(argv, overrides = {}) {
+function agentToolFlag(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--agent-tool") return argv[i + 1] ?? null;
+    if (argv[i].startsWith("--agent-tool=")) return argv[i].slice("--agent-tool=".length);
+  }
+  return null;
+}
+async function run2(argv, overrides = {}, parentStatus) {
   const merged = { ...nodeDeps(), ...overrides };
-  const deps = merged;
   const split = splitGitArgs(argv);
   const state2 = { exitCode: EXIT.OK, wroteResult: false, secrets: [], json: wantsJson(split.argv) };
+  state2.status = parentStatus ?? (programStatusEnabled(merged, detectAgent(merged.env, agentToolFlag(split.argv))) ? statusReporter(merged.stderr) : silentStatus);
+  const status = state2.status;
+  const deps = {
+    ...merged,
+    prompt: async (q) => {
+      const answered2 = status.ask();
+      try {
+        return await merged.prompt(q);
+      } finally {
+        answered2();
+      }
+    },
+    keys: merged.keys ? (fn2) => {
+      const answered2 = status.ask();
+      const stop = merged.keys(fn2);
+      return () => {
+        stop();
+        answered2();
+      };
+    } : null
+  };
   const invoke2 = async (sub, o = {}) => {
     const out = [];
     const err = [];
     const errSink = (s) => void err.push(s);
-    const quiet = o.quiet ? { stderr: { write: errSink }, stderrIsTTY: false, spawnGit: (args, g2) => deps.spawnGit(args, { ...g2, onOutput: errSink }) } : {};
-    const code2 = await run2(sub, { ...deps, ...o.cwd ? { cwd: o.cwd } : {}, ...o.capture ? { stdout: { write: (s) => out.push(s) } } : {}, ...quiet });
+    const quiet = o.quiet ? { stderr: { write: errSink }, stderrIsTTY: false, spawnGit: (args, g2) => merged.spawnGit(args, { ...g2, onOutput: errSink }) } : {};
+    const code2 = await run2(sub, { ...merged, ...o.cwd ? { cwd: o.cwd } : {}, ...o.capture ? { stdout: { write: (s) => out.push(s) } } : {}, ...quiet }, status);
     return { code: code2, stdout: out.join(""), stderr: err.join("") };
   };
   const program2 = buildProgram({ deps, state: state2, gitArgs: split.gitArgs, invoke: invoke2 });
@@ -55378,6 +56493,11 @@ async function run2(argv, overrides = {}) {
       await sendCrashReport(r, { baseUrl: state2.baseUrl ?? crashServer(deps.env), fetch: deps.sys.fetch, stderr: deps.stderr });
     }
   }
+  if (!parentStatus) {
+    const name = commandPath(program2, split.argv);
+    const what = name ? `${BRAND.cli} ${name}` : BRAND.cli;
+    status.finish(code === EXIT.OK, code === EXIT.OK ? `${what} finished` : `${what} failed (exit ${code})`);
+  }
   await saveBookmark(deps, state2);
   await updateHint(deps, state2);
   return code;