brnch-cli 0.18.3 → 0.19.0

package/README.md

@@ -1,4 +1,4 @@
-# brnch 0.18.3
+# brnch 0.19.0
 
 Command-line client for [Brnch](https://brnch.io) — Git hosting for humans and agents. Single file, no runtime dependencies, Node 20 or newer.
 

package/brnch.mjs

@@ -29789,8 +29789,8 @@ function convertBaseSchema(schema, ctx) {
       });
     }
     ctx.processing.add(refPath);
-    const resolved = resolveRef(refPath, ctx);
-    const zodSchema2 = convertSchema(resolved, ctx);
+    const resolved2 = resolveRef(refPath, ctx);
+    const zodSchema2 = convertSchema(resolved2, ctx);
     ctx.refs.set(refPath, zodSchema2);
     ctx.processing.delete(refPath);
     return zodSchema2;
@@ -30578,7 +30578,7 @@ var PLATFORM_TOKEN_PREFIXES = {
 var PLATFORM_TOKEN_RE = new RegExp(`^(${Object.keys(PLATFORM_TOKEN_PREFIXES).join("|")})_[0-9a-f]{64}$`);
 
 // packages/domain/src/capabilities.ts
-var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read"];
+var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read", "migrations:read"];
 var REVIEWER = [...VIEWER, "review:comment", "review:resolve", "review:approve"];
 var DEVELOPER = [
   ...VIEWER,
@@ -30591,9 +30591,11 @@ var DEVELOPER = [
   "review:comment",
   "evidence:report",
   "promotion:request",
-  "packages:write"
+  "packages:write",
+  "deploy:read"
 ];
-var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
+var DEPLOY_AND_MIGRATIONS = ["deploy:write", "deploy:trigger", "deploy:manage", "migrations:manage", "migrations:approve"];
+var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", ...DEPLOY_AND_MIGRATIONS, "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
 var ADMIN = [
   ...MAINTAINER,
   "org:admin",
@@ -32159,12 +32161,16 @@ var CreateInvitationRequest = external_exports.object({ email: external_exports.
 var AcceptInvitationRequest = external_exports.object({ token: external_exports.string() });
 var CreateTeamRequest = external_exports.object({ slug: Slug, name: displayLine().min(1).max(100) });
 var AddTeamMemberRequest = external_exports.object({ user_id: external_exports.string() });
+var GrantExtraCapabilitySchema = external_exports.enum(["deploy:read", "deploy:trigger", "deploy:manage", "migrations:read", "migrations:manage", "migrations:approve"]);
 var CreateGrantRequest = external_exports.object({
   principal_type: external_exports.enum(["user", "team"]),
   principal_id: external_exports.string().min(1).max(100),
   role: RepoGrantRoleSchema,
+  /** Beyond the role, e.g. a developers team that approves a database's migrations. */
+  capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6).optional(),
   expires_at: external_exports.iso.datetime().nullable().optional()
 });
+var UpdateGrantRequest = external_exports.object({ capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6) });
 var CreateRepoRequest = external_exports.object({
   name: RepoName,
   description: displayText().max(500).default(""),
@@ -32253,11 +32259,16 @@ var PolicyRulesSchema = external_exports.object({
 });
 var AdoptPolicyRequest = external_exports.object({ rules: PolicyRulesSchema, expected_version: external_exports.number().int().nonnegative(), note: external_exports.string().max(1e3).optional() });
 var ApplySecureDefaultsRequest = external_exports.object({ expected_version: external_exports.number().int().nonnegative() });
+var MAX_TASK_BLOCKERS = 50;
+var TaskRef = external_exports.union([external_exports.number().int().positive(), external_exports.string().trim().regex(/^(task_[0-9a-z]{1,64}|#?\d{1,9})$/, "expected a task number (12 or #12) or a task_\u2026 id")]);
+var blockedBy = external_exports.array(TaskRef).max(MAX_TASK_BLOCKERS);
 var CreateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300),
   description: external_exports.string().max(65536).default(""),
   acceptance_criteria: external_exports.array(external_exports.string().max(1e3)).max(100).default([]),
-  labels: external_exports.array(external_exports.string().max(50)).max(20).default([])
+  labels: external_exports.array(external_exports.string().max(50)).max(20).default([]),
+  /** Tasks in the same repository this one is blocked by. */
+  blocked_by: blockedBy.default([])
 });
 var UpdateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300).optional(),
@@ -32266,8 +32277,13 @@ var UpdateTaskRequest = external_exports.object({
   labels: external_exports.array(external_exports.string().max(50)).max(20).optional(),
   state: external_exports.enum(["open", "in_progress", "blocked", "done", "cancelled"]).optional(),
   owner_id: external_exports.string().nullable().optional(),
+  /** Replaces the whole set of blockers. Links are not task fields: changing them alone leaves `version` as it is. */
+  blocked_by: blockedBy.optional(),
   version: external_exports.number().int()
 });
+var AddTaskDependencyRequest = external_exports.object({ blocker: TaskRef });
+var TaskListQuery = external_exports.object({ ready: external_exports.enum(["true", "false"]).optional().transform((v) => v === void 0 ? void 0 : v === "true") });
+var TaskNumberParam = external_exports.coerce.number().int().positive().max(999999999);
 var ClaimTaskRequest = external_exports.object({ session_id: external_exports.string().optional() });
 var AddLinkRequest = external_exports.object({ kind: external_exports.enum(["external", "change", "task"]), url: external_exports.url().optional(), target_id: external_exports.string().optional(), title: external_exports.string().max(300).optional() });
 var CreateCommentRequest = external_exports.object({ body: external_exports.string().min(1).max(65536) });
@@ -33888,18 +33904,26 @@ var UpsertWorkerEnvRequest = external_exports.object({
 });
 
 // packages/protocol/src/db-migrations.ts
-var DB_MIGRATION_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
-var DB_ENGINE_KINDS = ["postgres", "vitess"];
 var DB_EXEC_ORDERS = ["linear", "linear_skip", "non_linear"];
 var DB_CREDENTIAL_MODES = ["managed_role", "dsn", "branch_password"];
+var DB_APPLY_ON = ["merge", "deploy", "manual"];
+var DB_LINT_LEVELS = ["error", "warning", "off"];
+var DB_DRIFT_MODES = ["off", "on_run", "daily"];
+var DbLintPolicySchema = external_exports.object({
+  levels: external_exports.record(external_exports.string().regex(/^[A-Za-z0-9_]{1,40}$/), external_exports.enum(DB_LINT_LEVELS)).refine((r) => Object.keys(r).length <= 50, "at most 50 entries").default({}),
+  nolint: external_exports.enum(["honor", "ignore"]).default("honor"),
+  /** Drift found by the last check fails the deploy's migrations step. */
+  drift_blocks_deploy: external_exports.boolean().default(false)
+});
 var Ident2 = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_$]{0,62}$/, "letters, digits and _ only (at most 63)");
 var PsName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/, "a PlanetScale name: letters, digits, '.', '_' and '-'");
 var SourceFields = {
   name: external_exports.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9_-]*$/, "lowercase letters, digits, - and _"),
   /** Directory relative to the repository root ("" = the root). */
   path: external_exports.string().max(300),
-  format: external_exports.enum(DB_MIGRATION_FORMATS),
-  engine: external_exports.enum(DB_ENGINE_KINDS),
+  /** `wrangler` directories are D1 sources, which come from the Wrangler configuration. */
+  format: external_exports.enum(["atlas", "plain", "golang_migrate", "drizzle", "prisma"]),
+  engine: external_exports.enum(["postgres", "vitess"]),
   /** Branch whose merges create runs; the repository's default branch when omitted. */
   branch: external_exports.string().min(1).max(200).optional(),
   /** PlanetScale connection (purpose `db_migrations`) of the organization or the repository. */
@@ -33921,12 +33945,19 @@ var SourceFields = {
   credential_mode: external_exports.enum(DB_CREDENTIAL_MODES).optional(),
   /** Postgres: the role new objects belong to (`SET ROLE`); `postgres` by default for managed roles, none for a DSN. */
   run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable().optional(),
-  /** `approval`: merges create runs that wait for approval. `manual_only`: runs start only by hand. */
-  on_merge: external_exports.enum(["approval", "manual_only"]).default("approval"),
+  /** Deprecated: `apply_on` (`approval` = `merge`, `manual_only` = `manual`). */
+  on_merge: external_exports.enum(["approval", "manual_only"]).optional(),
+  apply_on: external_exports.enum(DB_APPLY_ON).optional(),
+  /** `deploy` and `manual` only: whether a person approves before anything is applied (`merge` always requires it). */
+  require_approval: external_exports.boolean().optional(),
   /** Validate the directory on changes (evidence `migrations/<name>`). */
-  change_checks: external_exports.boolean().default(true)
+  change_checks: external_exports.boolean().default(true),
+  lint: DbLintPolicySchema.optional(),
+  drift_mode: external_exports.enum(DB_DRIFT_MODES).optional()
 };
 var CreateDbMigrationSourceRequest = external_exports.object({
+  /** Only PlanetScale sources are created here: D1 sources come from the Wrangler configuration. */
+  provider: external_exports.literal("planetscale").default("planetscale"),
   ...SourceFields,
   /** Postgres `credential_mode: dsn` only: `postgresql://user:password@host:5432/db?sslmode=verify-full`. Write-only. */
   dsn: external_exports.string().min(10).max(2e3).optional()
@@ -33948,7 +33979,11 @@ var UpdateDbMigrationSourceRequest = external_exports.object({
   credential_mode: external_exports.enum(DB_CREDENTIAL_MODES),
   run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable(),
   on_merge: external_exports.enum(["approval", "manual_only"]),
+  apply_on: external_exports.enum(DB_APPLY_ON),
+  require_approval: external_exports.boolean(),
   change_checks: external_exports.boolean(),
+  lint: DbLintPolicySchema,
+  drift_mode: external_exports.enum(DB_DRIFT_MODES),
   state: external_exports.enum(["active", "disabled"]),
   dsn: external_exports.string().min(10).max(2e3).nullable()
 }).partial().extend({ version: external_exports.number().int().min(1) });
@@ -33956,7 +33991,22 @@ var StartDbMigrationRunRequest = external_exports.object({
   /** Branch, tag or commit to apply; the source's branch when omitted. */
   ref: external_exports.string().min(1).max(200).optional()
 });
-var DecideDbMigrationRunRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
+var DecideDbMigrationRunRequest = external_exports.object({
+  reason: external_exports.string().max(500).optional(),
+  /** Approving a run a deploy waits on: redeploy that deploy at the same commit once the run succeeds. */
+  redeploy: external_exports.boolean().optional()
+});
+
+// packages/protocol/src/approvals.ts
+var PutApprovalRuleRequest = external_exports.object({
+  required: external_exports.number().int().min(1).max(10),
+  users: external_exports.array(external_exports.string().min(1).max(100)).max(20).default([]),
+  teams: external_exports.array(external_exports.string().min(1).max(100)).max(10).default([]),
+  separation_of_duties: external_exports.boolean().default(false),
+  /** The rule's version when replacing one (optimistic concurrency); omit to create. */
+  version: external_exports.number().int().positive().optional()
+});
+var DecideDeploymentRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
 
 // packages/protocol/src/buildkite.ts
 var BUILDKITE_TRUST_MODES = ["contributor_controlled", "pipeline_settings", "target_ref_upload"];
@@ -36299,6 +36349,8 @@ function reposGroup(t) {
     grants: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/grants`, query: { ...q }, options: o }),
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/grants`, json: validate2(CreateGrantRequest, body, "CreateGrantRequest"), options: o }),
+      /** Replace the capabilities the grant carries beyond its role (ADR-0088), e.g. `["migrations:approve"]`. */
+      update: (repo, grant, body, o) => t.json({ method: "PATCH", path: path2`/v1/repos/${repo}/grants/${grant}`, json: validate2(UpdateGrantRequest, body, "UpdateGrantRequest"), options: o }),
       delete: (repo, grant, o) => t.void({ method: "DELETE", path: path2`/v1/repos/${repo}/grants/${grant}`, options: o })
     }
   };
@@ -36501,9 +36553,13 @@ function delegationsGroup(t) {
 function tasksGroup(t) {
   return {
     create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/tasks`, json: validate2(CreateTaskRequest, body, "CreateTaskRequest"), options: o }),
-    /** `label` (name or id) and `assignee` (handle or user id) filter the list. */
+    /**
+     * `label` (name or id) and `assignee` (handle or user id) filter the list. `ready: true` keeps only the frontier:
+     * open tasks whose blockers are all done or cancelled (`false`: every other task).
+     */
     list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks`, query: { ...q }, options: o }),
     get: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}`, options: o }),
+    byNumber: (repo, number4, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks/by-number/${number4}`, options: o }),
     /** `version` is required: a stale version fails with VERSION_CONFLICT instead of overwriting someone else's edit. */
     update: (task, body, o) => t.json({ method: "PATCH", path: path2`/v1/tasks/${task}`, json: validate2(UpdateTaskRequest, body, "UpdateTaskRequest"), options: o }),
     /** Advisory claim; CONFLICT when someone else holds it. */
@@ -36513,28 +36569,50 @@ function tasksGroup(t) {
       create: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/comments`, json: validate2(CreateCommentRequest, body, "CreateCommentRequest"), options: o }),
       list: (task, q = {}, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/comments`, query: { ...q }, options: o })
     },
+    /** "Blocked by" links within the task's repository (ADR-0089). A blocker is a task number or `task_…` id. */
+    dependencies: {
+      list: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/dependencies`, options: o }),
+      /** Idempotent: adding an existing link changes nothing. CYCLE_DETECTED if the blocker already waits on this task. */
+      add: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/dependencies`, json: validate2(AddTaskDependencyRequest, body, "AddTaskDependencyRequest"), options: o }),
+      remove: (task, blocker, o) => t.void({ method: "DELETE", path: path2`/v1/tasks/${task}/dependencies/${String(blocker)}`, options: o })
+    },
     addLink: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/links`, json: validate2(AddLinkRequest, body, "AddLinkRequest"), options: o })
   };
 }
 
 // packages/sdk/src/groups/db-migrations.ts
 function dbMigrationsGroup(t) {
-  const decide = (decision) => (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, reason ? { reason } : {}, "DecideDbMigrationRunRequest"), options: o });
+  const decide = (decision) => (id2, reason, o) => {
+    const body = typeof reason === "string" ? { reason } : { ...reason?.reason ? { reason: reason.reason } : {}, ...reason?.redeploy ? { redeploy: true } : {} };
+    return t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, body, "DecideDbMigrationRunRequest"), options: o });
+  };
   return {
     sources: {
       list: (repo, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/sources`, options: o }),
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/db-migrations/sources`, json: validate2(CreateDbMigrationSourceRequest, body, "CreateDbMigrationSourceRequest"), options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
       update: (id2, body, o) => t.json({ method: "PATCH", path: path2`/v1/db-migration-sources/${id2}`, json: validate2(UpdateDbMigrationSourceRequest, body, "UpdateDbMigrationSourceRequest"), options: o }),
-      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o })
+      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
+      /** Who may approve the source's runs now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}/approvers`, options: o }),
+      /** Protect the database: every run waits for these approvals, and it can no longer apply without approval. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, options: o })
     },
     /** Migration directories found in the repository tree; `configured` marks those a source already covers. */
     suggestions: (repo, ref, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/suggestions`, query: ref ? { ref } : {}, options: o }),
     /** What applying the source at `ref` would do. `live` reads the database now instead of the last snapshot. */
     plan: (sourceId2, q = {}, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/plan`, query: { ref: q.ref, live: q.live ? "true" : void 0 }, options: o }),
+    /** The schema the source's migrations produce at `ref` (the source's branch by default), from replaying them. */
+    schema: (sourceId2, ref, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/schema`, query: ref ? { ref } : {}, options: o }),
+    /** Compares the database with what its applied migrations produce, now, and stores the result (admins). */
+    checkDrift: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/drift`, options: o }),
     /** Reads the applied versions from the database again and returns the plan at the source's branch. */
     refresh: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/refresh`, options: o }),
-    /** A manual run: the caller's request is the approval. `run` is null when nothing is pending. */
+    /**
+     * A manual run (`migrations:manage`). The request is the approval when the caller also holds `migrations:approve` and
+     * the source is not protected; otherwise the run waits for approval. `run` is null when nothing is pending.
+     */
     startRun: (sourceId2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/runs`, json: validate2(StartDbMigrationRunRequest, body, "StartDbMigrationRunRequest"), options: o }),
     runs: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/runs`, query: { ...q }, options: o }),
@@ -36544,7 +36622,7 @@ function dbMigrationsGroup(t) {
     reject: decide("reject"),
     retry: decide("retry"),
     cancel: decide("cancel"),
-    /** The plan of every source a change touches, with the files the change adds or edits marked. */
+    /** The plan of every source a change touches: the files the change adds (with statements), lint, schema effect. */
     changePlans: (changeId, o) => t.json({ method: "GET", path: path2`/v1/changes/${changeId}/db-migrations`, options: o })
   };
 }
@@ -36566,12 +36644,22 @@ function deployGroup(t) {
       remove: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}`, options: o }),
       /** Deploy the branch head again (or a commit this target deployed before). */
       deploy: (id2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/deploy`, json: validate2(RedeployRequest, body, "RedeployRequest"), options: o }),
-      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o })
+      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o }),
+      /** Who may approve the target's production deploys now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/deploy-targets/${id2}/approvers`, options: o }),
+      /** Protect the target: production deploys and rollbacks wait for these approvals. Pass `version` to replace a rule. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/deploy-targets/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      /** Remove the rule; deploys waiting for it go on. */
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}/approval-rule`, options: o })
     },
     deployments: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deployments`, query: { ...q }, options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/deployments/${id2}`, options: o }),
       cancel: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/cancel`, options: o }),
+      /** Approve a deploy of a protected target (people only; the last approval needed starts it). */
+      approve: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/approve`, json: {}, options: o }),
+      /** Reject it: the deployment is cancelled. */
+      reject: (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/reject`, json: validate2(DecideDeploymentRequest, reason ? { reason } : {}, "DecideDeploymentRequest"), options: o }),
       ofChange: (change, o) => t.json({ method: "GET", path: path2`/v1/changes/${change}/deployments`, options: o })
     }
   };
@@ -37050,7 +37138,7 @@ function invalidAgentToolFlag(flag) {
 }
 
 // packages/cli/package.json
-var version2 = "0.18.3";
+var version2 = "0.19.0";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -38787,18 +38875,13 @@ async function gitConfigPath(deps) {
 }
 
 // packages/cli/src/work-ref.ts
-var MAX_PAGES = 20;
-var PAGE = 100;
 async function issueByNumber(client, repo, n) {
-  let cursor2;
-  for (let i = 0; i < MAX_PAGES; i++) {
-    const page = await client.tasks.list(repo, { limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
-    const hit = page.items.find((t) => t.number === n);
-    if (hit) return hit.id;
-    if (!page.next_cursor) return null;
-    cursor2 = page.next_cursor;
+  try {
+    return (await client.tasks.byNumber(repo, n)).id;
+  } catch (e) {
+    if (isBrnchApiError(e) && e.code === "NOT_FOUND") return null;
+    throw e;
   }
-  return null;
 }
 async function changeByNumber(client, repo, n) {
   try {
@@ -38824,6 +38907,21 @@ async function resolveChangeId(spec, client, repo) {
   if (!id2) throw notFound(`change #${n}`, repo.spec());
   return id2;
 }
+var TASK_ARG = "task number (12 or #12) in --repo, or a task_\u2026 id";
+async function resolveTaskId(spec, client, repo) {
+  const text2 = spec.trim();
+  const rest = text2.startsWith("issue:") ? text2.slice("issue:".length) : text2;
+  if (rest.startsWith("task_")) return rest;
+  const digits = /^#?(\d{1,9})$/.exec(rest)?.[1];
+  if (!digits) {
+    if (rest.startsWith("chg_") || rest.startsWith("change:")) throw usage(`${spec} is a change, not a task`);
+    throw usage(`cannot read task "${spec}": expected a number (12 or #12) or a task_\u2026 id`);
+  }
+  const n = Number(digits);
+  const id2 = await issueByNumber(client, await repo.id(), n);
+  if (!id2) throw notFound(`task #${n}`, repo.spec());
+  return id2;
+}
 async function resolveWorkRef(spec, client, repoId) {
   const m = /^(issue|change):(.+)$/.exec(spec.trim());
   const kind = m?.[1] ?? null;
@@ -39449,6 +39547,9 @@ async function createContext(deps, globals, state2) {
   function changeId(spec, pref = "agent") {
     return resolveChangeId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
   }
+  function taskId(spec, pref = "agent") {
+    return resolveTaskId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
+  }
   function org() {
     const o = targetOrg ?? storedCred?.account?.default_org;
     if (!o) {
@@ -39519,6 +39620,7 @@ async function createContext(deps, globals, state2) {
     repoSpec,
     repoId,
     changeId,
+    taskId,
     org,
     sessionId,
     info,
@@ -39638,6 +39740,15 @@ function cell(v) {
   if (typeof v === "number" || typeof v === "boolean") return String(v);
   return JSON.stringify(v);
 }
+function actorLabel(a) {
+  const person = a.handle ? `@${a.handle}` : a.user_name ?? null;
+  if (a.type === "human") return person ?? a.display_name ?? `${a.type} ${a.id}`;
+  if (a.type === "agent") {
+    const name = a.display_name ?? `agent ${a.id}`;
+    return person ? `${name} (agent for ${person})` : name;
+  }
+  return a.display_name ?? `${a.type} ${a.id}`;
+}
 var tildePath = (path3, home2) => home2 && path3.startsWith(`${home2}/`) ? `~${path3.slice(home2.length)}` : path3;
 function kv(obj3, keys) {
   const o = obj3 ?? {};
@@ -39737,7 +39848,7 @@ ${snippet}
 
 // packages/cli/src/commands/session.ts
 var renderSession = (s) => kv(
-  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: `${s.sponsor.type} ${s.sponsor.id}` },
+  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: actorLabel(s.sponsor) },
   ["id", "title", "agent", "state", "presence", "attention", "repository_id", "task_id", "claimed_task_id", "sponsor", "scopes", "open_blockers", "last_seen_at", "expires_at", "max_expires_at", "end_reason"]
 );
 var renderStarted = (s) => `${renderSession(s.session)}
@@ -41242,7 +41353,7 @@ function sessionLines(s, now, you) {
     ...s.paths.length ? [`  touching: ${pathList(s.paths)}`] : []
   ];
 }
-var claimLine = (c8) => `  ${c8.key}  ${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
+var claimLine = (c8) => `  ${c8.key}  ${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
 function renderStatus(st, now = Date.now()) {
   const others = st.sessions.filter((s) => s.id !== st.you);
   const out = [others.length ? `${others.length} other agent session${others.length === 1 ? "" : "s"} working in this repository.` : "No other agent sessions are working in this repository."];
@@ -41797,9 +41908,9 @@ async function runHook(deps, state2, tool, eventArg) {
     let meta3 = await readMeta(deps.env, id2);
     if (!meta3) {
       const baseUrl = await baseUrlOf(deps);
-      const resolved = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
-      if (!resolved) return;
-      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved.repo, repo_root: resolved.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+      const resolved2 = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
+      if (!resolved2) return;
+      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
     }
     if (info.model && !meta3.model) meta3.model = redactText(info.model).text.slice(0, 200);
     if (!meta3.model && t === "claude-code" && typeof payload.transcript_path === "string" && /^(Stop|SessionEnd)$/.test(info.event)) meta3.model = await modelFromTranscript(deps, payload.transcript_path);
@@ -42003,22 +42114,22 @@ function registerCapture(program2, rt) {
     act(rt, async (ctx, o, words) => {
       const summary = words.join(" ").trim();
       if (!summary) throw usage("decision text is required");
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
-      if (!resolved) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      if (!resolved2) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
       const now = Date.now();
-      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
+      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved2.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
       let id2;
       let meta3;
       if (live) {
         id2 = live.id;
         meta3 = live.meta;
       } else {
-        const key = `manual:${spoolId(resolved.root)}:${new Date(now).toISOString().slice(0, 10)}`;
+        const key = `manual:${spoolId(resolved2.root)}:${new Date(now).toISOString().slice(0, 10)}`;
         id2 = spoolId(key);
-        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
       }
       const paths = (o.file ?? []).map((f) => {
-        const rel = relative2(canonical(resolved.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
+        const rel = relative2(canonical(resolved2.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
         if (!rel || rel.startsWith("..") || isAbsolute6(rel)) throw usage(`${f} is outside the repository`);
         return rel.split(sep2).join("/");
       });
@@ -42062,22 +42173,22 @@ ${report3.errors.join("\n")}` : ""}`);
       rt.state.noUpdateHint = true;
       const [cmd, ...args] = argv;
       if (!cmd) throw usage(`usage: ${BRAND.cli} capture wrap -- <command> [args\u2026]`);
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
       const cfg = await readCaptureConfig(ctx.deps.env);
-      const before = resolved && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved.root) : null;
-      if (!resolved) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
+      const before = resolved2 && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved2.root) : null;
+      if (!resolved2) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
       const code = await runInherit(cmd, args, ctx.deps.cwd, ctx.deps.env);
       ctx.setExit(code);
-      if (!resolved || !before) return;
-      const after = await snapshotWorktree(ctx.deps, resolved.root);
+      if (!resolved2 || !before) return;
+      const after = await snapshotWorktree(ctx.deps, resolved2.root);
       if (!after) return;
-      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved.root, timeoutMs: 12e4 });
+      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved2.root, timeoutMs: 12e4 });
       const label2 = (o.tool ?? cmd.split(/[\\/]/).pop() ?? "command").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
       const now = Date.now();
       const key = `wrapped:${label2}:${randomBytes4(8).toString("hex")}`;
       const id2 = spoolId(key);
-      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
-      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
+      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
+      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved2.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
       await writeMeta(ctx.deps.env, id2, meta3);
       await appendEvents(ctx.deps.env, id2, [{ type: "capture.started", payload: { source: label2 } }, ...edits, { type: "capture.ended", payload: { reason: `exit ${code}` } }], now);
       startFlush(ctx.deps);
@@ -45918,12 +46029,35 @@ function seedJson(p) {
 }
 
 // packages/cli/src/commands/task.ts
-var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? `${t.claim.actor.type} ${t.claim.actor.id}` : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.description ? `
+var BLOCKER_ARG = "the task it is blocked by: number (12 or #12) or task_\u2026 id";
+var resolved = (t) => t.state === "done" || t.state === "cancelled";
+var summaries = (list3) => list3.map((t) => `#${t.number} ${t.title} (${t.state})`).join("\n  ") || "(none)";
+function renderDependencies(d) {
+  const more = d.blocks_count > d.blocks.length ? `
+  \u2026 and ${d.blocks_count - d.blocks.length} more` : "";
+  return `Ready: ${d.is_ready ? "yes" : "no"}
+Blocked by:
+  ${summaries(d.blocked_by)}
+Blocks:
+  ${summaries(d.blocks)}${more}`;
+}
+var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? actorLabel(t.claim.actor) : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.blocked_by?.length || t.blocks_count ? `
+
+${renderDependencies(t)}` : "") + (t.description ? `
 
 ${t.description}` : "") + (t.acceptance_criteria.length ? `
 
 Acceptance criteria:
 ${t.acceptance_criteria.map((c8) => `  - ${c8}`).join("\n")}` : "");
+var waitingOn = (t) => (t.blocked_by ?? []).filter((b) => !resolved(b)).map((b) => `#${b.number}`).join(" ");
+function blockersFrom(values, allowNone) {
+  if (!values) return void 0;
+  if (values.length === 1 && values[0] === "none") {
+    if (!allowNone) throw usage("--blocked-by none only clears blockers on task update");
+    return [];
+  }
+  return values.map((v) => v.trim().replace(/^issue:/, ""));
+}
 async function bodyFrom(ctx, o, required2 = true) {
   if (o.body !== void 0 && o.file !== void 0) throw usage("pass either --body or --file, not both");
   if (o.file !== void 0) return readText(fileSpec(o.file), ctx.input);
@@ -45933,23 +46067,24 @@ async function bodyFrom(ctx, o, required2 = true) {
 }
 function registerTask(program2, rt) {
   const task = program2.command("task").description("Tasks (issues) in --repo");
-  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).action(
+  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).option("--blocked-by <task>", `${BLOCKER_ARG} (repeatable)`, repeat).action(
     act(rt, async (ctx, o) => {
       const description = await bodyFrom(ctx, o, false);
-      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label });
+      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label, blocked_by: blockersFrom(o.blockedBy, false) });
       ctx.result(t, renderTask);
     })
   );
-  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--ready", "only tasks ready to start: open, with every blocker done or cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
-      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "id"]));
+      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, ...o.ready ? { ready: true } : {}, limit: o.limit, cursor: o.cursor });
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((t) => ({ ...t, waiting_on: waitingOn(t) })) }, ["number", "state", "title", "waiting_on", "id"]));
     })
   );
-  task.command("view <task>").description("Show a task").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().tasks.get(id2), renderTask)));
-  task.command("update <task>").description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("view").argument("<task>", TASK_ARG).description("Show a task, with what it is blocked by and what it blocks").action(act(rt, async (ctx, _o, [spec]) => ctx.result(await ctx.client().tasks.get(await ctx.taskId(spec)), renderTask)));
+  task.command("update").argument("<task>", TASK_ARG).description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--blocked-by <task>", `replace the blockers: ${BLOCKER_ARG} (repeatable; 'none' to clear)`, repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
+    act(rt, async (ctx, o, [spec]) => {
       const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
       const version4 = o.expectedVersion ?? (await c8.tasks.get(id2)).version;
       const t = await c8.tasks.update(id2, {
         title: o.title,
@@ -45957,17 +46092,35 @@ function registerTask(program2, rt) {
         state: o.state,
         owner_id: o.owner === void 0 ? void 0 : o.owner === "none" ? null : o.owner,
         labels: o.label,
+        blocked_by: blockersFrom(o.blockedBy, true),
         version: version4
       });
       ctx.result(t, renderTask);
     })
   );
-  task.command("claim <task>").description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.claim(id2, { session_id: o.session }), renderTask)));
-  task.command("release <task>").description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.release(id2, { session_id: o.session }), renderTask)));
-  task.command("comment <task>").description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("depend").argument("<task>", TASK_ARG).argument("[blocker]", BLOCKER_ARG).description("Mark <task> as blocked by [blocker] (same repository); without it, show what <task> is blocked by and blocks").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
+      const deps = blocker ? await c8.tasks.dependencies.add(id2, { blocker: blockersFrom([blocker], false)[0] }) : await c8.tasks.dependencies.list(id2);
+      ctx.result(deps, renderDependencies);
+    })
+  );
+  task.command("undepend").argument("<task>", TASK_ARG).argument("<blocker>", BLOCKER_ARG).description("Remove <blocker> from what <task> is blocked by").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const id2 = await ctx.taskId(spec);
+      const ref = blockersFrom([blocker], false)[0];
+      await ctx.client().tasks.dependencies.remove(id2, ref);
+      ctx.result({ task_id: id2, removed: ref }, `${spec} is no longer blocked by ${ref}`);
+    })
+  );
+  task.command("claim").argument("<task>", TASK_ARG).description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.claim(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("release").argument("<task>", TASK_ARG).description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.release(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("comment").argument("<task>", TASK_ARG).description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
+    act(rt, async (ctx, o, [spec]) => {
+      const id2 = await ctx.taskId(spec);
       const comment = await ctx.client().tasks.comments.create(id2, { body: await bodyFrom(ctx, o) });
-      ctx.result(comment, `Comment ${comment.id} added to ${id2}`);
+      ctx.result(comment, `Comment ${comment.id} added to ${spec}`);
     })
   );
 }
@@ -46249,7 +46402,7 @@ var how = (strategy) => strategy ? `with ${strategy}` : "with the policy's defau
 function renderAutoMerge(a, change, p, now) {
   const ref = change ? String(change.number) : a.change_id;
   const name = change ? `${p.bold(`#${change.number}`)} ${change.title}` : p.bold(a.change_id);
-  const who3 = a.enabled_by ? a.enabled_by.display_name ?? a.enabled_by.id : null;
+  const who3 = a.enabled_by ? actorLabel(a.enabled_by) : null;
   const out = [];
   switch (a.state) {
     case "enabled":
@@ -46269,7 +46422,7 @@ function renderAutoMerge(a, change, p, now) {
       out.push(p.dim(`  Turn it on: ${BRAND.cli} change auto-merge ${ref}`));
   }
   if (a.history.length) {
-    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: h.actor.display_name ?? h.actor.id, reason: h.reason }));
+    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: actorLabel(h.actor), reason: h.reason }));
     const w = { when: Math.max(...rows2.map((r) => r.when.length)), action: Math.max(...rows2.map((r) => r.action.length)) };
     out.push("", p.bold("History"));
     for (const r of rows2) out.push(`  ${p.dim(r.when.padEnd(w.when))}  ${r.action.padEnd(w.action)}  ${r.actor}${r.reason ? p.dim(` \xB7 ${r.reason}`) : ""}`);
@@ -46335,11 +46488,11 @@ function stepOf(state2, previous) {
 
 // packages/cli/src/commands/change.ts
 var renderChange = (c8) => kv(
-  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: `${c8.author.type} ${c8.author.id}`, revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
+  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: actorLabel(c8.author), revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
   ["number", "id", "title", "state", "target_ref", "source", "task_id", "author", "revision", "current_revision.head_oid", "revision_count", "merged", "version"]
 );
 var renderThread = (t) => `${t.id} [${t.state}${t.blocking ? ", blocking" : ""}${t.anchor.outdated ? ", outdated" : ""}] ${t.anchor.path ?? "(change)"}${t.anchor.start_line ? `:${t.anchor.start_line}` : ""}
-` + t.comments.map((c8) => `  ${c8.author.display_name ?? c8.author.id}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
+` + t.comments.map((c8) => `  ${actorLabel(c8.author)}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
 function registerChange(program2, rt) {
   const change = program2.command("change").description("Changes (proposed updates to a protected ref)");
   change.command("create").description("Create a change from a workspace or a ref in --repo").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or -").option("--workspace <id>", "source workspace").option("--ref <ref>", "source ref (e.g. refs/heads/feature)").option("--target <ref>", "target ref (default: the repository's default branch)").option("--task <id>", "linked task").option("--draft", "create as draft").action(
@@ -46359,7 +46512,7 @@ function registerChange(program2, rt) {
   change.command("list").description("List changes in --repo").option("--state <state>", "draft | open | merged | closed").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const page = await ctx.client().changes.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "target_ref", "id"]));
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((c8) => ({ ...c8, author: actorLabel(c8.author) })) }, ["number", "state", "title", "author", "target_ref", "id"]));
     })
   );
   change.command("view").argument("<change>", CHANGE_ARG).description("Show a change").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.get(await ctx.changeId(id2)), renderChange)));
@@ -46448,7 +46601,7 @@ function registerReview(program2, rt) {
       const id2 = await ctx.changeId(spec);
       const revision = o.revision ?? (await c8.changes.get(id2)).current_revision.id;
       const r = await c8.reviews.create(id2, { revision_id: revision, decision, body: await bodyFrom(ctx, o, bodyRequired) });
-      ctx.result(r, (v) => kv({ ...v, reviewer: `${v.reviewer.type} ${v.reviewer.id}` }, ["id", "decision", "revision_id", "reviewer", "current"]));
+      ctx.result(r, (v) => kv({ ...v, reviewer: actorLabel(v.reviewer) }, ["id", "decision", "revision_id", "reviewer", "current"]));
     })
   );
   decide("approve", "approved", "Approve a revision (approvals are bound to that revision)", false);
@@ -46569,7 +46722,7 @@ Wait for the findings: code-review wait ${spec}`);
 
 // packages/cli/src/commands/evidence.ts
 import { basename as basename4, extname, isAbsolute as isAbsolute8, resolve as resolve8 } from "node:path";
-var renderEvidence = (e) => kv({ ...e, issuer: `${e.issuer.type} ${e.issuer.id}` }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
+var renderEvidence = (e) => kv({ ...e, issuer: actorLabel(e.issuer) }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
 var CONTENT_TYPES = { ".txt": "text/plain", ".log": "text/plain", ".json": "application/json", ".xml": "application/xml", ".html": "text/plain" };
 function registerEvidence(program2, rt) {
   const ev = program2.command("evidence").description("Verification evidence");
@@ -46746,7 +46899,7 @@ var renderCoverage = (c8) => [
   `code owner review ${c8.required ? "required" : "not required"} by policy v${c8.policy_version} (revision ${c8.revision_id})${c8.complete ? "" : " \u2014 path list truncated"}`,
   table(c8.paths.map((p) => ({ ...p, owners: p.owners.join(" ") || "-", approved_by: p.approved_by.join(" ") || "-" })), ["path", "owners", "satisfied", "approved_by"])
 ].join("\n");
-var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: a.pushed_by.display_name ?? a.pushed_by.id })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
+var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: actorLabel(a.pushed_by) })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
 function registerGovernance(program2, rt) {
   const change = program2.commands.find((c8) => c8.name() === "change") ?? program2.command("change");
   change.command("draft").argument("<change>", CHANGE_ARG).description("Convert an open change back to a draft (drafts cannot merge and notify nobody)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.draft(await ctx.changeId(id2)), (c8) => kv(c8, ["id", "number", "title", "state"]))));
@@ -46836,7 +46989,7 @@ new revision #${r.revision.number} ${r.revision.id}`);
       }
       const b = await ctx.client("user").pushProtection.bypasses.create(await ctx.repoId(), { rule: o.rule, path: o.path, blob_oid: o.blob, reason: o.reason, ...principal ? { principal } : {}, ...o.ref ? { ref: o.ref } : {} });
       ctx.result(b, (v) => {
-        const who3 = v.principal ? v.principal.display_name ?? `${v.principal.type}:${v.principal.id}` : "nobody";
+        const who3 = v.principal ? actorLabel(v.principal) : "nobody";
         return `${kv({ ...v, for: who3, ref: v.ref ?? "any" }, ["id", "rule", "path", "blob_oid", "for", "ref", "expires_at"])}
 Only ${who3} can use it, for one push, before it expires.`;
       });
@@ -46847,7 +47000,7 @@ Only ${who3} can use it, for one push, before it expires.`;
       rt,
       async (ctx, o) => ctx.result(
         await ctx.client().pushProtection.bypasses.list(await ctx.repoId(), { limit: o.limit, cursor: o.cursor }),
-        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? b.principal.display_name ?? b.principal.id : "-", created_by: b.created_by.display_name ?? b.created_by.id, used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
+        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? actorLabel(b.principal) : "-", created_by: actorLabel(b.created_by), used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
       )
     )
   );
@@ -46888,7 +47041,7 @@ var renderAlerts2 = (p) => listWithCursor(
   ["id", "state", "resolution", "confidence", "rule", "repo", "where", "masked", "source", "created_at"]
 );
 var renderAlert = (a) => [
-  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? a.resolved_by.display_name ?? a.resolved_by.id : null, looks_fake: a.looks_fake?.label ?? null }, [
+  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? actorLabel(a.resolved_by) : null, looks_fake: a.looks_fake?.label ?? null }, [
     "id",
     "state",
     "resolution",
@@ -47229,8 +47382,8 @@ var renderDevices = (v) => v.items.length ? table(
   v.items.map((d) => ({ id: d.id, name: d.name ?? "-", environment: d.environment, app_version: d.app_version ?? "-", last_seen: d.last_seen_at, current: d.current ? "yes" : "" })),
   ["id", "name", "environment", "app_version", "last_seen", "current"]
 ) : "No push devices. The iOS app registers itself when you allow notifications.";
-var PAGE2 = 100;
-var MAX_PAGES2 = 10;
+var PAGE = 100;
+var MAX_PAGES = 10;
 async function findItems(client, specs) {
   const wanted = specs.map((s) => s.trim().toLowerCase());
   for (const s of wanted) if (s.length < 4) throw usage(`"${s}" is too short to name an inbox item: use the id \`${c4} inbox list\` shows`);
@@ -47238,8 +47391,8 @@ async function findItems(client, specs) {
   const seen = /* @__PURE__ */ new Set();
   for (const view of ["all", "snoozed", "done"]) {
     let cursor2;
-    for (let i = 0; i < MAX_PAGES2; i++) {
-      const page = await client.inbox.list({ view, limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
+    for (let i = 0; i < MAX_PAGES; i++) {
+      const page = await client.inbox.list({ view, limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
       for (const item of page.items) {
         if (seen.has(item.id)) continue;
         seen.add(item.id);
@@ -47694,13 +47847,13 @@ function renderEntry(e, verb) {
   if (e.flags.length) lines2.push(`flagged: ${e.flags.join(", ")}${e.flags.includes("instructions") ? "; never given to the assistant on its own" : ""}`);
   return lines2.join("\n");
 }
-var PAGE3 = 100;
-var MAX_PAGES3 = 10;
+var PAGE2 = 100;
+var MAX_PAGES2 = 10;
 async function reviewable(ctx, org, q) {
   const out = [];
   let cursor2;
-  for (let i = 0; i < MAX_PAGES3; i++) {
-    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE3, ...cursor2 ? { cursor: cursor2 } : {} });
+  for (let i = 0; i < MAX_PAGES2; i++) {
+    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
     out.push(...page.items.filter((e) => e.can_review));
     if (!page.next_cursor) break;
     cursor2 = page.next_cursor;
@@ -48008,6 +48161,38 @@ function registerIntegrations(program2, rt) {
   integrations.command("inherit <provider> <purpose>").description("Drop --repo's choice and inherit the nearest shared connection again").action(act(rt, async (ctx, _o, [provider, purpose]) => ctx.result(await ctx.client("user").grants.inherit(await ctx.repoId(void 0, "user"), provider, purpose), renderRepo)));
 }
 
+// packages/cli/src/commands/approvals.ts
+function protectOptions(cmd) {
+  return cmd.option("--user <handle>", "a person who may approve (@handle or id; repeatable)", repeat).option("--team <slug>", "a team whose members may approve (slug or id; repeatable)", repeat).option("--required <n>", "approvals needed from different people (default 1)", (v) => parseIntOption(v, "--required")).option("--separation-of-duties", "the change's author, its merger and whoever requested the deploy or run cannot approve it");
+}
+function protectBody(o, current) {
+  const users = o.user ?? [];
+  const teams = o.team ?? [];
+  if (!users.length && !teams.length && o.required === void 0 && !o.separationOfDuties) throw usage("give --user, --team, --required or --separation-of-duties");
+  return { required: o.required ?? 1, users, teams, separation_of_duties: !!o.separationOfDuties, ...current ? { version: current.version } : {} };
+}
+var who2 = (p) => p.handle ? `@${p.handle}` : p.name;
+var ruleSummary = (r) => r ? `${r.required} approval${r.required === 1 ? "" : "s"} from ${[...r.teams.map((t) => `@${t.slug} team`), ...r.users.map(who2)].join(", ") || "anyone who may approve"}${r.separation_of_duties ? "; not the author, merger or requester" : ""}` : "not protected";
+var renderApprovers = (v) => kv(
+  {
+    protected: ruleSummary(v.rule),
+    capability: v.capability,
+    eligible: v.eligible.map(who2).join(", ") || "nobody",
+    lacking_capability: v.lacking_capability.length ? `${v.lacking_capability.map(who2).join(", ")} (named, but cannot approve without ${v.capability})` : null,
+    unsatisfiable: v.unsatisfiable ? "yes: fewer people can approve than it needs" : null
+  },
+  ["protected", "capability", "eligible", "lacking_capability", "unsatisfiable"]
+);
+var renderRule = (r) => `protected: ${ruleSummary(r)} (version ${r.version})`;
+function approvalLines(a) {
+  if (!a) return "";
+  const by2 = a.approvals.filter((x) => x.counted).map((x) => who2(x.user));
+  const lines2 = [a.line ?? (a.satisfied ? `approved (${a.counted} of ${a.required})` : null), by2.length ? `approved by ${by2.join(", ")}` : null, a.you && !a.you.can_approve && a.line ? `you cannot approve: ${a.you.message}` : null].filter(Boolean);
+  return lines2.length ? `
+
+${lines2.join("\n")}` : "";
+}
+
 // packages/cli/src/commands/db.ts
 async function sourceId(ctx, ref, repo) {
   if (ref.startsWith("dms_")) return ref;
@@ -48018,18 +48203,58 @@ async function sourceId(ctx, ref, repo) {
 }
 var plural3 = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 var short = (oid) => oid.slice(0, 12);
-var database = (s) => `${s.ps_organization}/${s.ps_database}@${s.ps_branch}`;
+var database = (s) => {
+  const t = s.target;
+  return t.provider === "cloudflare_d1" ? `d1:${t.binding}\u2192${t.database_name ?? t.database_id}${t.environment ? ` (env ${t.environment})` : ""}` : `${t.organization}/${t.database}@${t.branch}`;
+};
+var PS_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
+var PS_ENGINES = ["postgres", "vitess"];
+var LEVELS = ["error", "warning", "off"];
+function lintLines(findings2) {
+  if (!findings2?.length) return [];
+  return ["lint:", ...findings2.map((f) => `  ${f.level.padEnd(12)}  ${(f.atlas_code ?? f.code).padEnd(6)}  ${f.file}:${f.line}  ${f.message}`)];
+}
+function diffLines(d) {
+  if (!d) return [];
+  const t = d.tables;
+  const out = [];
+  for (const x of t.added) out.push(`  + table ${x.name} (${x.columns.map((c8) => c8.name).join(", ")})`);
+  for (const x of t.renamed) out.push(`  ~ table ${x.from} \u2192 ${x.to}`);
+  for (const x of t.changed) {
+    for (const c8 of x.columns.added) out.push(`  + ${x.name}.${c8.name} ${c8.type}${c8.nullable ? "" : " NOT NULL"}`);
+    for (const c8 of x.columns.renamed) out.push(`  ~ ${x.name}.${c8.from} \u2192 ${c8.to}`);
+    for (const c8 of x.columns.changed) out.push(`  ~ ${x.name}.${c8.name} ${c8.before.type} \u2192 ${c8.after.type}`);
+    for (const c8 of x.columns.dropped) out.push(`  - ${x.name}.${c8}`);
+    for (const i of x.indexes.added) out.push(`  + index ${i} on ${x.name}`);
+    for (const i of x.indexes.dropped) out.push(`  - index ${i} on ${x.name}`);
+    for (const k of x.foreign_keys.added) out.push(`  + foreign key ${k} on ${x.name}`);
+    for (const k of x.foreign_keys.dropped) out.push(`  - foreign key ${k} on ${x.name}`);
+  }
+  for (const x of t.dropped) out.push(`  - table ${x.name}`);
+  if (!out.length && !d.unparsed.length) return ["schema effect: none"];
+  return ["schema effect:", ...out, ...d.unparsed.length ? [`  (${plural3(d.unparsed.length, "statement")} could not be interpreted, first at ${d.unparsed[0].file}:${d.unparsed[0].line})`] : []];
+}
+function renderDrift(d) {
+  if (!d) return "drift: not checked yet";
+  const lines2 = [`drift: ${d.status} (checked ${d.checked_at} against ${plural3(d.applied, "applied migration")})`];
+  if (d.note) lines2.push(`note: ${d.note}`);
+  for (const f of d.findings) lines2.push(`  ${f.kind.padEnd(20)}  ${f.object}  ${f.detail}`);
+  return lines2.join("\n");
+}
 function issueLines(issues) {
   if (!issues.length) return [];
   return ["issues:", ...issues.map((i) => `  ${i.level.padEnd(7)}  ${i.code}  ${i.file ? `${i.file}: ` : ""}${i.message}`)];
 }
 var renderSources = (v) => table(
-  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet" })),
-  ["name", "id", "path", "format", "engine", "database", "branch", "on_merge", "state", "applied"]
+  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet", drift: s.drift?.status ?? "-" })),
+  ["name", "id", "provider", "path", "format", "database", "branch", "apply_on", "state", "applied", "drift"]
 );
-var renderSource = (s) => `${kv({ ...s, database: database(s), path: s.path || "(repository root)" }, ["id", "name", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "on_merge", "change_checks", "state", "version"])}
+var renderSource = (s) => `${kv(
+  { ...s, approvers: ruleSummary(s.approval_rule), database: database(s), path: s.path || "(repository root)", destructive: s.lint.levels.destructive ?? "error", nolint: s.lint.nolint, ...s.target.provider === "cloudflare_d1" ? { from: `${s.target.config_path} on ${s.branch}` } : {} },
+  s.provider === "cloudflare_d1" ? ["id", "name", "provider", "path", "format", "database", "from", "branch", "revisions_location", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"] : ["id", "name", "provider", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"]
+)}
 
-` + (s.on_merge === "approval" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
+` + (s.apply_on === "merge" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : s.apply_on === "deploy" ? `The production deploy's migrations step applies them${s.require_approval ? ", once the run is approved" : ""}` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
 var renderSuggestions = (v) => v.items.length ? table(
   v.items.map((s) => ({ ...s, path: s.path || "(root)", configured: s.configured ? "yes" : "no" })),
   ["path", "format", "files", "revisions_schema", "baseline_version", "configured", "evidence"]
@@ -48048,16 +48273,17 @@ function renderPlan2(p) {
       lines2.push(`  ${f.name}  ${plural3(f.statements, "statement")}${notes.length ? `  (${notes.join(", ")})` : ""}`);
     }
   }
-  return [...lines2, ...issueLines(p.issues)].join("\n");
+  return [...lines2, ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(p.schema_diff)].join("\n");
 }
 var renderPlans = (v) => v.items.length ? v.items.map(renderPlan2).join("\n\n") : "no migration sources";
 var NEXT = {
-  awaiting_approval: (id2) => `Waiting for a repository admin: ${BRAND.cli} db approve ${id2} (or reject)`,
+  awaiting_approval: (id2) => `Waiting for approval: ${BRAND.cli} db approve ${id2} (or reject)`,
   failed: (id2) => `Fix the migration and merge it, then: ${BRAND.cli} db retry ${id2}`,
-  needs_attention: (id2) => `Look at the run in PlanetScale, then: ${BRAND.cli} db retry ${id2} or cancel`
+  needs_attention: (id2) => `Look at the database (PlanetScale, or the D1 bookmark's restore command), then: ${BRAND.cli} db retry ${id2} or cancel`
 };
 function renderRun(r) {
-  const ps = r.planetscale;
+  const ps = r.backend?.provider === "planetscale" ? r.backend : null;
+  const d1 = r.backend?.provider === "cloudflare_d1" ? r.backend : null;
   const head = kv(
     {
       ...r,
@@ -48065,16 +48291,18 @@ function renderRun(r) {
       change: r.change_id ?? "-",
       requested_by: r.requested_by ? `${r.requested_by.type} ${r.requested_by.id}` : "-",
       deploy_request: ps?.deploy_request_url ?? (ps?.deploy_request ? `#${ps.deploy_request}` : null),
-      deployment_state: ps?.deployment_state ?? null
+      deployment_state: ps?.deployment_state ?? null,
+      bookmark: d1?.bookmark ?? null,
+      restore: d1?.restore?.wrangler ?? null
     },
-    ["id", "source_name", "status", "kind", "engine", "commit", "change", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "error", "note", "created_at"]
+    ["id", "source_name", "status", "kind", "provider", "engine", "commit", "change", "deployment_id", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "bookmark", "restore", "error", "note", "created_at"]
   );
   const files = r.files.length ? table(
     r.files.map((f) => ({ ...f, statements: f.applied_statements ? `${f.applied_statements}/${f.statements}` : f.statements, error: f.error ? `${f.error}${f.error_statement ? ` (in: ${f.error_statement})` : ""}` : null })),
     ["name", "status", "statements", "execution_ms", "error"]
   ) : "no files";
   const next = NEXT[r.status]?.(r.id);
-  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n");
+  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n") + approvalLines(r.approval);
 }
 var renderRuns = (v) => listWithCursor(
   { ...v, items: v.items.map((r) => ({ ...r, commit: short(r.commit_oid), files: `${r.files.filter((f) => f.status === "applied").length}/${r.files.length} applied` })) },
@@ -48095,9 +48323,9 @@ function sessionSettings(pairs) {
   return out;
 }
 function registerDb(program2, rt) {
-  const db = program2.command("db").description("Database migrations on PlanetScale for --repo: sources, plans, and runs applied after merge and approval");
-  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
-  sources.command("add").description("Add a migration source (repository admins). The source is checked against PlanetScale; `db suggest` shows the directories found").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", DB_MIGRATION_FORMATS.join(" | "), oneOf("--format", DB_MIGRATION_FORMATS)).requiredOption("--engine <engine>", DB_ENGINE_KINDS.join(" | "), oneOf("--engine", DB_ENGINE_KINDS)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "approval (merges create runs waiting for approval) | manual_only", oneOf("--on-merge", ["approval", "manual_only"])).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
+  const db = program2.command("db").description("Database migrations on PlanetScale and Cloudflare D1 for --repo: sources, plans, lint, runs applied after approval, and drift");
+  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch or a D1 database (D1 sources come from the Wrangler configuration)").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
+  sources.command("add").description("Add a PlanetScale migration source (migrations:manage). The source is checked against PlanetScale; `db suggest` shows the directories found. D1 sources need no adding: they come from the Wrangler configuration").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", PS_FORMATS.join(" | "), oneOf("--format", PS_FORMATS)).requiredOption("--engine <engine>", PS_ENGINES.join(" | "), oneOf("--engine", PS_ENGINES)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "deprecated: --apply-on (approval = merge, manual_only = manual)", oneOf("--on-merge", ["approval", "manual_only"])).option("--apply-on <when>", `${DB_APPLY_ON.join(" | ")} (default merge: runs wait for approval after merge)`, oneOf("--apply-on", DB_APPLY_ON)).option("--no-approval", "--apply-on deploy or manual: apply without a person's approval").option("--destructive <level>", "lint level for destructive changes: error (default, fails the check) | warning | off", oneOf("--destructive", LEVELS)).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
     act(rt, async (ctx, o) => {
       let dsn;
       if (o.dsnFile !== void 0) {
@@ -48124,6 +48352,10 @@ function registerDb(program2, rt) {
         ...o.baseline ? { baseline_version: o.baseline } : {},
         ...o.execOrder ? { exec_order: o.execOrder } : {},
         ...o.onMerge ? { on_merge: o.onMerge } : {},
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval === false ? { require_approval: false } : {},
+        ...o.destructive ? { lint: { levels: { destructive: o.destructive }, nolint: "honor", drift_blocks_deploy: false } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
         ...o.credentialMode ? { credential_mode: o.credentialMode } : {},
         ...o.runAsRole ? { run_as_role: o.runAsRole } : {},
         ...o.sessionSetting ? { session_settings: sessionSettings(o.sessionSetting) } : {},
@@ -48134,6 +48366,45 @@ function registerDb(program2, rt) {
       ctx.result(await ctx.client("user").dbMigrations.sources.create(await ctx.repoId(void 0, "user"), body), renderSource);
     })
   );
+  sources.command("set <source>").description("Change how a source applies, its lint and drift checks (migrations:manage; D1 sources: only these)").option("--apply-on <when>", DB_APPLY_ON.join(" | "), oneOf("--apply-on", DB_APPLY_ON)).option("--approval", "each run waits for approval (migrations:approve; a protected source's approvers)").option("--no-approval", "--apply-on deploy or manual: apply without approval").option("--destructive <level>", "lint level for destructive changes: error | warning | off", oneOf("--destructive", LEVELS)).option("--nolint <mode>", "honor | ignore: whether `-- atlas:nolint` in a file acknowledges a finding", oneOf("--nolint", ["honor", "ignore"])).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--drift-blocks-deploy <yes|no>", "drift found by the last check fails the deploy's migrations step", oneOf("--drift-blocks-deploy", ["yes", "no"])).option("--enable", "activate the source").option("--disable", "disable the source (no runs, no checks)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      if (o.enable && o.disable) throw usage("--enable and --disable exclude each other");
+      const c8 = ctx.client("user").dbMigrations;
+      const s = await c8.sources.get(await sourceId(ctx, ref));
+      const levels = { ...s.lint.levels };
+      if (o.destructive) {
+        if (o.destructive === "error") delete levels.destructive;
+        else levels.destructive = o.destructive;
+      }
+      const lintChanged = o.destructive || o.nolint || o.driftBlocksDeploy;
+      const body = {
+        version: s.version,
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval !== void 0 ? { require_approval: o.approval } : {},
+        ...lintChanged ? { lint: { levels, nolint: o.nolint ?? s.lint.nolint, drift_blocks_deploy: o.driftBlocksDeploy ? o.driftBlocksDeploy === "yes" : s.lint.drift_blocks_deploy } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
+        ...o.enable ? { state: "active" } : o.disable ? { state: "disabled" } : {}
+      };
+      if (Object.keys(body).length === 1) throw usage("nothing to change: give --apply-on, --approval, --destructive, --nolint, --drift, --drift-blocks-deploy, --enable or --disable");
+      ctx.result(await c8.sources.update(s.id, body), renderSource);
+    })
+  );
+  protectOptions(sources.command("protect <source>").description("Require approvals for every run of the source (people with migrations:manage). A protected database can no longer apply without approval. Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations.sources;
+      const s = await c8.get(await sourceId(ctx, ref));
+      ctx.result(await c8.protect(s.id, protectBody(o, s.approval_rule)), renderRule);
+    })
+  );
+  sources.command("unprotect <source>").description("Remove the source's approval rule (runs still need approval as its apply mode says). Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}`);
+      await ctx.client("user").dbMigrations.sources.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  sources.command("approvers <source>").description("Who may approve the source's runs now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.sources.approvers(await sourceId(ctx, ref)), renderApprovers)));
   sources.command("rm <source>").description("Delete a migration source (name or id; its runs stay listed). Requires --yes when non-interactive").action(
     act(rt, async (ctx, _o, [ref]) => {
       const id2 = await sourceId(ctx, ref);
@@ -48143,7 +48414,7 @@ function registerDb(program2, rt) {
     })
   );
   db.command("suggest").description("Migration directories found in --repo (atlas.sum, drizzle journals, *.up.sql, numbered SQL files), and whether a source covers each").option("--ref <ref>", "branch, tag or commit (default: the default branch)").action(act(rt, async (ctx, o) => ctx.result(await ctx.client("user").dbMigrations.suggestions(await ctx.repoId(void 0, "user"), o.ref), renderSuggestions)));
-  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (repository admins)").action(
+  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (migrations:manage)").action(
     act(rt, async (ctx, o, [ref]) => {
       const c8 = ctx.client("user").dbMigrations;
       const q = { ref: o.ref, live: o.live };
@@ -48159,7 +48430,29 @@ function registerDb(program2, rt) {
       if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
     })
   );
-  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (repository admins)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
+  db.command("diff <change>").description("What a change's migrations do: per source, the files it adds, lint findings and the schema effect. Exits 7 when a source would block the change").action(
+    act(rt, async (ctx, _o, [change]) => {
+      const plans = await ctx.client("user").dbMigrations.changePlans(await ctx.changeId(change, "user"));
+      ctx.result(
+        plans,
+        (v) => v.items.length ? v.items.map((p) => {
+          const mine = p.pending.filter((f) => f.introduced_by_change);
+          return [`${p.source_name} (${p.provider === "cloudflare_d1" ? "Cloudflare D1" : `PlanetScale ${p.engine}`} ${p.target_label}): ${p.ok ? "ok" : "blocked"}`, mine.length ? `this change adds: ${mine.map((f) => f.name).join(", ")}` : "this change adds no migrations", ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(mine.length ? p.schema_diff : null)].join("\n");
+        }).join("\n\n") : "no migration sources follow the change's target branch"
+      );
+      if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("drift <source>").description("The source's last drift check: its database against what the applied migrations produce. --check reads the database now (migrations:manage)").option("--check", "check now").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations;
+      const id2 = await sourceId(ctx, ref);
+      const d = o.check ? await c8.checkDrift(id2) : (await c8.sources.get(id2)).drift;
+      ctx.result(d, renderDrift);
+      if (d?.status === "drift") ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (migrations:manage)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
   db.command("runs").description("Migration runs of --repo, newest first").option("--source <source>", "only this source (name or id)").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const repo = { id: await ctx.repoId(void 0, "user") };
@@ -48168,7 +48461,7 @@ function registerDb(program2, rt) {
     })
   );
   db.command("run <run>").description("One migration run: status, files and issues").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").dbMigrations.runs.get(id2), renderRun)));
-  db.command("apply <source>").description("Apply a source's pending migrations now (repository admins; your request is the approval). Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
+  db.command("apply <source>").description("Apply a source's pending migrations now (migrations:manage). Your request is the approval when you may approve and the source is not protected; otherwise the run waits for approval. Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
     act(rt, async (ctx, o, [ref]) => {
       const id2 = await sourceId(ctx, ref);
       await ctx.confirm(`apply the pending migrations of ${ref}${o.ref ? ` at ${o.ref}` : ""} to its database`);
@@ -48179,13 +48472,15 @@ ${renderPlan2(v.plan)}`);
     })
   );
   const decisions = [
-    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows (repository admins)"],
-    ["reject", "Reject a run waiting for approval; nothing is applied (repository admins)"],
-    ["retry", "Retry a failed run from where it stopped (repository admins)"],
-    ["cancel", "Cancel a run that has not finished (repository admins)"]
+    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows once it has the approvals it needs (migrations:approve; a protected source's approvers)"],
+    ["reject", "Reject a run waiting for approval; nothing is applied (migrations:approve)"],
+    ["retry", "Retry a failed run from where it stopped (migrations:approve)"],
+    ["cancel", "Cancel a run that has not finished (migrations:approve)"]
   ];
   for (const [decision, description] of decisions) {
-    db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.reason), renderRun)));
+    const cmd = db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)");
+    if (decision === "approve") cmd.option("--redeploy", "a run a production deploy waits on: deploy the same commit again, which applies it");
+    cmd.action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.redeploy ? { reason: o.reason, redeploy: true } : o.reason), renderRun)));
   }
 }
 
@@ -48196,7 +48491,7 @@ var renderTargets = (v) => table(
   v.items.map((t) => ({ ...t, resource: t.resource_name, env: t.environment ?? "-", last_production: t.last_production ? `${t.last_production.status} ${t.last_production.commit_oid.slice(0, 12)}` : "-" })),
   ["name", "id", "platform", "resource", "env", "branch", "runs_on", "previews", "state", "last_production"]
 );
-var renderTarget = (t) => kv({ ...t, watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
+var renderTarget = (t) => kv({ ...t, approvers: ruleSummary(t.approval_rule), watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
   "id",
   "name",
   "platform",
@@ -48214,12 +48509,13 @@ var renderTarget = (t) => kv({ ...t, watch_paths: t.watch_paths?.length ? t.watc
   "watch_paths",
   "previews",
   "preview_check_name",
+  "approvers",
   "last_production",
   "version"
 ]);
 var renderDeployment = (d) => kv({ ...d, change: d.change ? `#${d.change.number}` : "-", logs: d.run?.logs_url ?? "-" }, ["id", "target_name", "kind", "environment", "status", "status_reason", "trigger", "commit_oid", "change", "version_id", "url", "alias_url", "verified", "duration_ms", "logs", "created_at"]) + (d.steps.length ? `
 
-${table(d.steps, ["name", "phase", "status", "summary"])}` : "");
+${table(d.steps, ["name", "phase", "status", "summary"])}` : "") + approvalLines(d.approval);
 var renderDeployments = (v) => listWithCursor({ ...v, items: v.items.map((d) => ({ ...d, commit: d.commit_oid.slice(0, 12), change: d.change ? `#${d.change.number}` : "-" })) }, ["id", "target_name", "kind", "status", "commit", "change", "trigger", "created_at"]);
 async function pick3(ctx, what, flag, options, label2) {
   if (options.length === 1) return options[0];
@@ -48355,7 +48651,23 @@ function registerDeploy(program2, rt) {
 Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}`);
     })
   );
-  deploy.command("targets").description("Deploy targets of --repo").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user")), renderTargets)));
+  const targets2 = deploy.command("targets").description("Deploy targets of --repo; `protect` requires approvers for a target's production deploys").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user")), renderTargets)));
+  protectOptions(targets2.command("protect <target>").description("Require approvals for the target's production deploys and rollbacks (people with deploy:manage). Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").deploy.targets;
+      const t = await c8.get(await targetId(ctx, ref));
+      ctx.result(await c8.protect(t.id, protectBody(o, t.approval_rule)), renderRule);
+    })
+  );
+  targets2.command("unprotect <target>").description("Remove the target's approval rule; deploys waiting for it go on. Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await targetId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}: its production deploys will no longer wait for approval`);
+      await ctx.client("user").deploy.targets.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  targets2.command("approvers <target>").description("Who may approve the target's production deploys now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.approvers(await targetId(ctx, ref)), renderApprovers)));
   deploy.command("target <target>").description("One deploy target (id, or name in --repo)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.get(await targetId(ctx, ref)), renderTarget)));
   targetOptions(deploy.command("update <target>").description("Change a deploy target (only the given flags; an empty value clears a command or the environment)")).option("--disable", "stop deploying (merges no longer deploy)").option("--enable", "deploy again").action(
     act(rt, async (ctx, o, [ref]) => {
@@ -48414,6 +48726,8 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
   );
   deploy.command("show <deployment>").description("One deployment with its steps").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.get(id2), renderDeployment)));
   deploy.command("cancel <deployment>").description("Cancel a queued or running deployment").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.cancel(id2), renderDeployment)));
+  deploy.command("approve <deployment>").description("Approve a deploy of a protected target (people who may approve; the last approval needed starts it)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.approve(id2), renderDeployment)));
+  deploy.command("reject <deployment>").description("Reject a deploy waiting for approval; it is cancelled").option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.reject(id2, o.reason), renderDeployment)));
   deploy.command("rollback <target>").description("Send all traffic back to the version of an earlier verified production deployment").requiredOption("--to <deployment>", "the deployment to roll back to (dpl_\u2026)").option("--message <text>", "deployment message").action(
     act(rt, async (ctx, o, [ref]) => {
       const id2 = await targetId(ctx, ref);
@@ -48426,7 +48740,6 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
 // packages/cli/src/commands/delegation.ts
 var ITERATION_DONE = /* @__PURE__ */ new Set(["succeeded", "no_changes", "failed", "cancelled"]);
 var STATES = ["working", "waiting", "stopped"];
-var who2 = (a) => a.display_name ?? `${a.type} ${a.id}`;
 var short2 = (oid) => oid ? oid.slice(0, 12) : null;
 function vendorArg(v) {
   if (!CODING_AGENT_VENDORS.includes(v)) throw usage(`unknown agent "${v}"; one of ${CODING_AGENT_VENDORS.join(", ")}`);
@@ -48446,7 +48759,7 @@ function renderIterations(d) {
   const rows2 = d.iterations.map((i) => ({
     ...i,
     trigger: i.trigger_ref ? `${i.trigger} (${i.trigger_ref})` : i.trigger,
-    by: who2(i.trigger_actor),
+    by: actorLabel(i.trigger_actor),
     head: short2(i.head_oid)
   }));
   const claims = d.iterations.map(reported).filter((x) => !!x);
@@ -48468,7 +48781,7 @@ var renderDelegation = (d) => kv(
     ...d,
     agent: `${d.agent.name} (${d.agent.vendor})`,
     status: delegationStatusLabel(d),
-    sponsor: who2(d.sponsor),
+    sponsor: actorLabel(d.sponsor),
     branch: `${d.source_ref} \u2192 ${d.target_ref}`,
     automatic: `on review ${d.auto_on_review ? "on" : "off"}, on check failure ${d.auto_on_check_failure ? "on" : "off"}`,
     budget: `iterations ${d.usage.iterations_used}/${d.budget.max_iterations}, tokens ${d.usage.tokens_used}/${d.budget.max_tokens}, ${d.budget.iteration_minutes} min per iteration`
@@ -49150,7 +49463,18 @@ function registerRepo(program2, rt) {
         await new Promise((r) => setTimeout(r, 2e3));
         job2 = await c8.migrations.get(job2.id);
       }
-      const view = { id: job2.id, state: job2.state, issues: job2.report.counts.issues, pull_requests: job2.report.counts.pull_requests, comments: job2.report.counts.comments, releases: job2.report.counts.releases, missing: job2.report.missing.join("; ") || "-" };
+      const deps = job2.report.dependencies;
+      const view = {
+        id: job2.id,
+        state: job2.state,
+        issues: job2.report.counts.issues,
+        pull_requests: job2.report.counts.pull_requests,
+        comments: job2.report.counts.comments,
+        releases: job2.report.counts.releases,
+        ...deps ? { blocked_by_links: `${deps.imported} imported${deps.skipped ? `, ${deps.skipped} skipped` : ""}` } : {},
+        missing: job2.report.missing.join("; ") || "-",
+        warnings: job2.report.warnings.join("; ") || "-"
+      };
       ctx.result(job2, () => kv(view, Object.keys(view)));
       if (o.wait && job2.state !== "completed") throw new CliError(`migration ${job2.state}: ${job2.error ?? job2.report.missing.join("; ")}`, EXIT.NOT_READY);
     })
@@ -49183,24 +49507,39 @@ function registerRepo(program2, rt) {
       if (t.transport === "ssh") {
         if (!t.ssh.ready) throw usage(`this machine is not set up for SSH${t.ssh.alias ? ` to ${t.ssh.alias}` : ""} yet: run \`${BRAND.cli} ssh setup\`, or clone with --https`);
         const url2 = sshCloneUrl(t.ssh.alias, r.org_slug, r.name);
-        const code2 = await ctx.deps.spawnGit(["clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
+        const code2 = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
         if (code2 !== 0) throw new CliError(`git clone over SSH exited with status ${code2}; \`${BRAND.cli} ssh test\` explains SSH problems, --https clones without SSH`, EXIT.UNEXPECTED, "GIT_FAILED");
         return ctx.result({ repository: r, directory, transport: "ssh", transport_reason: t.reason, clone_url: url2 }, cloned(r, directory, `over SSH (${url2})`, paint(colorEnabled(ctx.deps, "stdout"))));
       }
       if (t.approval) ctx.info(`Cloning over HTTPS: ${t.reason}. Pass --ssh to use SSH anyway.`);
       const token = await ctx.freshToken("agent");
-      const code = await ctx.deps.spawnGit(["clone", "--", r.clone_url, directory], {
+      const helper2 = await credentialHelperConfigured(ctx);
+      const list3 = helper2 && await gitAtLeast(ctx, "2.40.0") && await bundlesOffered(ctx, r.clone_url, token) ? [`--bundle-uri=${r.clone_url}/bundles`] : [];
+      const code = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", ...list3, "--", r.clone_url, directory], {
         env: gitAuthEnv(ctx.deps.env, token, r.clone_url),
         cwd: ctx.deps.cwd,
         stdoutToStderr: true
       });
       if (code !== 0) throw new CliError(`git clone exited with status ${code}`, EXIT.UNEXPECTED, "GIT_FAILED");
-      const helper2 = await credentialHelperConfigured(ctx);
       ctx.info(authGuidance(BRAND.cli, helper2));
       ctx.result({ repository: r, directory, transport: "https", transport_reason: t.reason, clone_url: r.clone_url, credential_helper: helper2 }, cloned(r, directory, "over HTTPS", paint(colorEnabled(ctx.deps, "stdout"))));
     })
   );
 }
+var SNAPSHOT_CLONE = ["-c", "transfer.bundleURI=true"];
+async function bundlesOffered(ctx, cloneUrl, token) {
+  try {
+    const res = await ctx.deps.sys.fetch(`${cloneUrl}/bundles`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(5e3) });
+    return res.ok && (await res.text()).includes('[bundle "');
+  } catch {
+    return false;
+  }
+}
+async function gitAtLeast(ctx, min) {
+  const r = await ctx.deps.sys.run("git", ["--version"], { timeoutMs: 1e4 }).catch(() => null);
+  const version4 = r?.code === 0 ? /git version (\d+\.\d+\.\d+)/.exec(r.stdout)?.[1] : void 0;
+  return !!version4 && compareVersions(version4, min) >= 0;
+}
 var hasRepo = (ctx) => {
   try {
     ctx.repoSpec();
@@ -49268,7 +49607,7 @@ function registerGit(program2, rt) {
 }
 
 // packages/cli/src/commands/release.ts
-var renderRelease = (r) => kv({ ...r, author: r.author.display_name ?? r.author.id }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
+var renderRelease = (r) => kv({ ...r, author: actorLabel(r.author) }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
 function registerRelease(program2, rt) {
   const release = program2.command("release").description("Releases of --repo (a tag with notes)");
   release.command("list").description("Releases, newest first").action(
@@ -49711,7 +50050,7 @@ var renderRangeDiff = (r) => {
   if (r.truncated) lines2.push("(truncated)");
   return lines2.join("\n");
 };
-var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${o.actor.display_name ?? o.actor.id}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
+var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${actorLabel(o.actor)}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
 async function waitForPromotion(ctx, p, timeout, interval) {
   const deadline = Date.now() + timeout * 1e3;
   let last = p.state;
@@ -49788,7 +50127,7 @@ next: --cursor ${v.next_cursor}` : "") : listWithCursor(v, ["id"]));
 }
 
 // packages/cli/src/commands/coordination.ts
-var holderOf = (c8) => `${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}`;
+var holderOf = (c8) => `${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}`;
 var renderClaim = (r) => [
   `${r.already_held ? "Already yours" : "Claimed"}: ${r.claim.key}${r.claim.change ? ` (change #${r.claim.change.number})` : ""}`,
   ...r.skipped.length ? [`Taken by others: ${r.skipped.join(", ")}`] : [],
@@ -52091,7 +52430,7 @@ function safeLegs(m) {
 }
 
 // packages/cli/src/commands/actions.ts
-var renderRun2 = (r) => kv({ ...r, actor: r.actor.display_name ?? r.actor.id, trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
+var renderRun2 = (r) => kv({ ...r, actor: actorLabel(r.actor), trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
   "id",
   "workflow_name",
   "run_number",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brnch-cli",
-  "version": "0.18.3",
+  "version": "0.19.0",
   "description": "Brnch CLI: Git hosting for humans and agents, from the command line",
   "keywords": [
     "git",