brnch-cli 0.18.3 → 0.19.1

package/brnch.mjs

@@ -29789,8 +29789,8 @@ function convertBaseSchema(schema, ctx) {
       });
     }
     ctx.processing.add(refPath);
-    const resolved = resolveRef(refPath, ctx);
-    const zodSchema2 = convertSchema(resolved, ctx);
+    const resolved2 = resolveRef(refPath, ctx);
+    const zodSchema2 = convertSchema(resolved2, ctx);
     ctx.refs.set(refPath, zodSchema2);
     ctx.processing.delete(refPath);
     return zodSchema2;
@@ -30573,12 +30573,13 @@ var PLATFORM_TOKEN_PREFIXES = {
   fsfa: "pending second-factor sign-in",
   fbkc: "Buildkite checkout token",
   fsvw: "staff read-only view",
-  fcrt: "container registry token"
+  fcrt: "container registry token",
+  fcpk: "clone-pack build token"
 };
 var PLATFORM_TOKEN_RE = new RegExp(`^(${Object.keys(PLATFORM_TOKEN_PREFIXES).join("|")})_[0-9a-f]{64}$`);
 
 // packages/domain/src/capabilities.ts
-var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read"];
+var VIEWER = ["org:read", "members:read", "repo:read", "task:read", "change:read", "session:read", "packages:read", "migrations:read"];
 var REVIEWER = [...VIEWER, "review:comment", "review:resolve", "review:approve"];
 var DEVELOPER = [
   ...VIEWER,
@@ -30591,9 +30592,11 @@ var DEVELOPER = [
   "review:comment",
   "evidence:report",
   "promotion:request",
-  "packages:write"
+  "packages:write",
+  "deploy:read"
 ];
-var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
+var DEPLOY_AND_MIGRATIONS = ["deploy:write", "deploy:trigger", "deploy:manage", "migrations:manage", "migrations:approve"];
+var MAINTAINER = [...DEVELOPER, ...REVIEWER, "repo:admin", ...DEPLOY_AND_MIGRATIONS, "policy:write", "session:manage", "secret_scanning:read", "secret_scanning:resolve"];
 var ADMIN = [
   ...MAINTAINER,
   "org:admin",
@@ -31634,7 +31637,6 @@ var looksLikeHostedLabel = (label2) => /^brnch-hosted(?:-|$)/.test(label2);
 var DEPLOY_LIMITS = {
   maxStepsPerTarget: 12,
   maxWatchPaths: 50,
-  maxTargetsPerRepository: 10,
   maxCommandLength: 2e3,
   maxSummaryLength: 500,
   maxDetailKeys: 20,
@@ -31744,7 +31746,8 @@ var PLANS = Object.freeze({
     storage_bytes_per_seat: 0,
     ai: { fast: 100, strong: 25, agent: 0, assistant: 0 },
     private_repo_members: 5,
-    overage: false
+    overage: false,
+    deploy_targets_per_repository: 1
   },
   pro: {
     id: "pro",
@@ -31763,7 +31766,8 @@ var PLANS = Object.freeze({
     storage_bytes_per_seat: 0,
     ai: { fast: 300, strong: 100, agent: 10, assistant: 100 },
     private_repo_members: 5,
-    overage: true
+    overage: true,
+    deploy_targets_per_repository: 10
   },
   team: {
     id: "team",
@@ -31782,7 +31786,8 @@ var PLANS = Object.freeze({
     storage_bytes_per_seat: 2 * GB,
     ai: { fast: 600, strong: 200, agent: 10, assistant: 100 },
     private_repo_members: Number.POSITIVE_INFINITY,
-    overage: true
+    overage: true,
+    deploy_targets_per_repository: 10
   },
   enterprise: {
     id: "enterprise",
@@ -31801,7 +31806,8 @@ var PLANS = Object.freeze({
     storage_bytes_per_seat: 5 * GB,
     ai: { fast: 1500, strong: 500, agent: 40, assistant: 300 },
     private_repo_members: Number.POSITIVE_INFINITY,
-    overage: true
+    overage: true,
+    deploy_targets_per_repository: 1e3
   }
 });
 
@@ -32159,12 +32165,16 @@ var CreateInvitationRequest = external_exports.object({ email: external_exports.
 var AcceptInvitationRequest = external_exports.object({ token: external_exports.string() });
 var CreateTeamRequest = external_exports.object({ slug: Slug, name: displayLine().min(1).max(100) });
 var AddTeamMemberRequest = external_exports.object({ user_id: external_exports.string() });
+var GrantExtraCapabilitySchema = external_exports.enum(["deploy:read", "deploy:trigger", "deploy:manage", "migrations:read", "migrations:manage", "migrations:approve"]);
 var CreateGrantRequest = external_exports.object({
   principal_type: external_exports.enum(["user", "team"]),
   principal_id: external_exports.string().min(1).max(100),
   role: RepoGrantRoleSchema,
+  /** Beyond the role, e.g. a developers team that approves a database's migrations. */
+  capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6).optional(),
   expires_at: external_exports.iso.datetime().nullable().optional()
 });
+var UpdateGrantRequest = external_exports.object({ capabilities: external_exports.array(GrantExtraCapabilitySchema).max(6) });
 var CreateRepoRequest = external_exports.object({
   name: RepoName,
   description: displayText().max(500).default(""),
@@ -32205,15 +32215,27 @@ var UpdateRepoRequest = external_exports.object({
   default_branch: external_exports.string().min(1).max(100).optional(),
   /** Replaces the topic list (≤20, lowercase). */
   topics: Topics.optional(),
+  /** The repository Actions switch (ADR-0009 addendum 2026-10-18). Off: no automatic runs, workflow_dispatch refused. */
+  actions_enabled: external_exports.boolean().optional(),
   version: external_exports.number().int()
 });
 var PATH_HISTORY_SCAN_MAX = 500;
 var RepoPathQuery = external_exports.string().min(1).max(4096).transform((p) => p.replace(/\/{2,}/g, "/").replace(/\/+$/, "")).refine((p) => p.length > 0 && !p.startsWith("/"), "path must be relative to the repository root").refine((p) => !/[\u0000-\u001f\u007f]/.test(p), "path must not contain control characters").refine((p) => p.split("/").every((s) => s !== "." && s !== ".."), "path must not contain . or .. segments");
+var isoDate = external_exports.string().max(64).refine((v) => !Number.isNaN(Date.parse(v)), { message: "must be an ISO-8601 date" });
+var queryFlag = external_exports.enum(["1", "true", "0", "false"]).transform((v) => v === "1" || v === "true");
 var CommitListQuery = external_exports.object({
   ref: external_exports.string().optional(),
   path: RepoPathQuery.optional(),
-  scan_limit: external_exports.coerce.number().int().min(1).max(PATH_HISTORY_SCAN_MAX).optional()
-}).refine((q) => q.scan_limit === void 0 || q.path !== void 0, { message: "scan_limit requires path", path: ["scan_limit"] });
+  scan_limit: external_exports.coerce.number().int().min(1).max(PATH_HISTORY_SCAN_MAX).optional(),
+  // Log filters (M6-SCL-02): substring matches, case-insensitive (no regular expressions); dates bound the committer
+  // date, inclusive.
+  author: external_exports.string().min(1).max(200).optional(),
+  grep: external_exports.string().min(1).max(200).optional(),
+  since: isoDate.optional(),
+  until: isoDate.optional(),
+  all_parents: queryFlag.optional()
+}).refine((q) => q.scan_limit === void 0 || q.path !== void 0 || isLogFiltered(q), { message: "scan_limit requires path or a filter", path: ["scan_limit"] });
+var isLogFiltered = (q) => q.author !== void 0 || q.grep !== void 0 || q.since !== void 0 || q.until !== void 0 || q.all_parents === true;
 var RequiredCheckSchema = external_exports.object({
   name: external_exports.string().min(1).max(200),
   subject: external_exports.enum(["head", "candidate"]).default("head"),
@@ -32253,11 +32275,16 @@ var PolicyRulesSchema = external_exports.object({
 });
 var AdoptPolicyRequest = external_exports.object({ rules: PolicyRulesSchema, expected_version: external_exports.number().int().nonnegative(), note: external_exports.string().max(1e3).optional() });
 var ApplySecureDefaultsRequest = external_exports.object({ expected_version: external_exports.number().int().nonnegative() });
+var MAX_TASK_BLOCKERS = 50;
+var TaskRef = external_exports.union([external_exports.number().int().positive(), external_exports.string().trim().regex(/^(task_[0-9a-z]{1,64}|#?\d{1,9})$/, "expected a task number (12 or #12) or a task_\u2026 id")]);
+var blockedBy = external_exports.array(TaskRef).max(MAX_TASK_BLOCKERS);
 var CreateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300),
   description: external_exports.string().max(65536).default(""),
   acceptance_criteria: external_exports.array(external_exports.string().max(1e3)).max(100).default([]),
-  labels: external_exports.array(external_exports.string().max(50)).max(20).default([])
+  labels: external_exports.array(external_exports.string().max(50)).max(20).default([]),
+  /** Tasks in the same repository this one is blocked by. */
+  blocked_by: blockedBy.default([])
 });
 var UpdateTaskRequest = external_exports.object({
   title: displayLine().min(1).max(300).optional(),
@@ -32266,8 +32293,13 @@ var UpdateTaskRequest = external_exports.object({
   labels: external_exports.array(external_exports.string().max(50)).max(20).optional(),
   state: external_exports.enum(["open", "in_progress", "blocked", "done", "cancelled"]).optional(),
   owner_id: external_exports.string().nullable().optional(),
+  /** Replaces the whole set of blockers. Links are not task fields: changing them alone leaves `version` as it is. */
+  blocked_by: blockedBy.optional(),
   version: external_exports.number().int()
 });
+var AddTaskDependencyRequest = external_exports.object({ blocker: TaskRef });
+var TaskListQuery = external_exports.object({ ready: external_exports.enum(["true", "false"]).optional().transform((v) => v === void 0 ? void 0 : v === "true") });
+var TaskNumberParam = external_exports.coerce.number().int().positive().max(999999999);
 var ClaimTaskRequest = external_exports.object({ session_id: external_exports.string().optional() });
 var AddLinkRequest = external_exports.object({ kind: external_exports.enum(["external", "change", "task"]), url: external_exports.url().optional(), target_id: external_exports.string().optional(), title: external_exports.string().max(300).optional() });
 var CreateCommentRequest = external_exports.object({ body: external_exports.string().min(1).max(65536) });
@@ -32438,7 +32470,9 @@ var UpdateOrgRequest = external_exports.object({
   /** Idle timeout of new agent sessions in minutes (ADR-0040). */
   agent_session_idle_minutes: external_exports.number().int().min(15).max(1440).optional(),
   /** Brnch Secure Defaults for new repositories (ADR-0081). Turning it on also requires a second factor for admins. */
-  secure_defaults: external_exports.boolean().optional()
+  secure_defaults: external_exports.boolean().optional(),
+  /** The organization's Actions switch (ADR-0009 addendum 2026-10-19): off, no repository of it starts workflow runs. */
+  actions_enabled: external_exports.boolean().optional()
 });
 var OAuthDecisionRequest = external_exports.object({
   approve: external_exports.boolean(),
@@ -33700,6 +33734,16 @@ var CreateConnectionRequest = external_exports.discriminatedUnion("auth", [
     name: Name3,
     credentials: external_exports.object({ api_token: Secret2 })
   }),
+  external_exports.object({
+    // Codex / Claude Code reviews with the key already saved in Settings → AI providers (an OpenAI or Anthropic
+    // provider of this organization). Nothing is copied: the key is read from the provider at every review, so
+    // rotating it there applies here, and deleting the provider stops the reviews.
+    auth: external_exports.literal("ai_provider"),
+    provider: external_exports.enum(["codex", "claude"]),
+    purpose: external_exports.literal("code_review").default("code_review"),
+    name: Name3,
+    config: external_exports.object({ ai_provider_id: external_exports.string().min(1).max(100) })
+  }),
   external_exports.object({
     auth: external_exports.literal("infisical_oidc"),
     provider: external_exports.literal("infisical"),
@@ -33888,18 +33932,26 @@ var UpsertWorkerEnvRequest = external_exports.object({
 });
 
 // packages/protocol/src/db-migrations.ts
-var DB_MIGRATION_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
-var DB_ENGINE_KINDS = ["postgres", "vitess"];
 var DB_EXEC_ORDERS = ["linear", "linear_skip", "non_linear"];
 var DB_CREDENTIAL_MODES = ["managed_role", "dsn", "branch_password"];
+var DB_APPLY_ON = ["merge", "deploy", "manual"];
+var DB_LINT_LEVELS = ["error", "warning", "off"];
+var DB_DRIFT_MODES = ["off", "on_run", "daily"];
+var DbLintPolicySchema = external_exports.object({
+  levels: external_exports.record(external_exports.string().regex(/^[A-Za-z0-9_]{1,40}$/), external_exports.enum(DB_LINT_LEVELS)).refine((r) => Object.keys(r).length <= 50, "at most 50 entries").default({}),
+  nolint: external_exports.enum(["honor", "ignore"]).default("honor"),
+  /** Drift found by the last check fails the deploy's migrations step. */
+  drift_blocks_deploy: external_exports.boolean().default(false)
+});
 var Ident2 = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_$]{0,62}$/, "letters, digits and _ only (at most 63)");
 var PsName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/, "a PlanetScale name: letters, digits, '.', '_' and '-'");
 var SourceFields = {
   name: external_exports.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9_-]*$/, "lowercase letters, digits, - and _"),
   /** Directory relative to the repository root ("" = the root). */
   path: external_exports.string().max(300),
-  format: external_exports.enum(DB_MIGRATION_FORMATS),
-  engine: external_exports.enum(DB_ENGINE_KINDS),
+  /** `wrangler` directories are D1 sources, which come from the Wrangler configuration. */
+  format: external_exports.enum(["atlas", "plain", "golang_migrate", "drizzle", "prisma"]),
+  engine: external_exports.enum(["postgres", "vitess"]),
   /** Branch whose merges create runs; the repository's default branch when omitted. */
   branch: external_exports.string().min(1).max(200).optional(),
   /** PlanetScale connection (purpose `db_migrations`) of the organization or the repository. */
@@ -33921,12 +33973,19 @@ var SourceFields = {
   credential_mode: external_exports.enum(DB_CREDENTIAL_MODES).optional(),
   /** Postgres: the role new objects belong to (`SET ROLE`); `postgres` by default for managed roles, none for a DSN. */
   run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable().optional(),
-  /** `approval`: merges create runs that wait for approval. `manual_only`: runs start only by hand. */
-  on_merge: external_exports.enum(["approval", "manual_only"]).default("approval"),
+  /** Deprecated: `apply_on` (`approval` = `merge`, `manual_only` = `manual`). */
+  on_merge: external_exports.enum(["approval", "manual_only"]).optional(),
+  apply_on: external_exports.enum(DB_APPLY_ON).optional(),
+  /** `deploy` and `manual` only: whether a person approves before anything is applied (`merge` always requires it). */
+  require_approval: external_exports.boolean().optional(),
   /** Validate the directory on changes (evidence `migrations/<name>`). */
-  change_checks: external_exports.boolean().default(true)
+  change_checks: external_exports.boolean().default(true),
+  lint: DbLintPolicySchema.optional(),
+  drift_mode: external_exports.enum(DB_DRIFT_MODES).optional()
 };
 var CreateDbMigrationSourceRequest = external_exports.object({
+  /** Only PlanetScale sources are created here: D1 sources come from the Wrangler configuration. */
+  provider: external_exports.literal("planetscale").default("planetscale"),
   ...SourceFields,
   /** Postgres `credential_mode: dsn` only: `postgresql://user:password@host:5432/db?sslmode=verify-full`. Write-only. */
   dsn: external_exports.string().min(10).max(2e3).optional()
@@ -33948,7 +34007,11 @@ var UpdateDbMigrationSourceRequest = external_exports.object({
   credential_mode: external_exports.enum(DB_CREDENTIAL_MODES),
   run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable(),
   on_merge: external_exports.enum(["approval", "manual_only"]),
+  apply_on: external_exports.enum(DB_APPLY_ON),
+  require_approval: external_exports.boolean(),
   change_checks: external_exports.boolean(),
+  lint: DbLintPolicySchema,
+  drift_mode: external_exports.enum(DB_DRIFT_MODES),
   state: external_exports.enum(["active", "disabled"]),
   dsn: external_exports.string().min(10).max(2e3).nullable()
 }).partial().extend({ version: external_exports.number().int().min(1) });
@@ -33956,7 +34019,22 @@ var StartDbMigrationRunRequest = external_exports.object({
   /** Branch, tag or commit to apply; the source's branch when omitted. */
   ref: external_exports.string().min(1).max(200).optional()
 });
-var DecideDbMigrationRunRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
+var DecideDbMigrationRunRequest = external_exports.object({
+  reason: external_exports.string().max(500).optional(),
+  /** Approving a run a deploy waits on: redeploy that deploy at the same commit once the run succeeds. */
+  redeploy: external_exports.boolean().optional()
+});
+
+// packages/protocol/src/approvals.ts
+var PutApprovalRuleRequest = external_exports.object({
+  required: external_exports.number().int().min(1).max(10),
+  users: external_exports.array(external_exports.string().min(1).max(100)).max(20).default([]),
+  teams: external_exports.array(external_exports.string().min(1).max(100)).max(10).default([]),
+  separation_of_duties: external_exports.boolean().default(false),
+  /** The rule's version when replacing one (optimistic concurrency); omit to create. */
+  version: external_exports.number().int().positive().optional()
+});
+var DecideDeploymentRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
 
 // packages/protocol/src/buildkite.ts
 var BUILDKITE_TRUST_MODES = ["contributor_controlled", "pipeline_settings", "target_ref_upload"];
@@ -34445,6 +34523,48 @@ var MirrorStatus = external_exports.object({
   timings: external_exports.record(external_exports.string(), external_exports.number())
 });
 
+// packages/protocol/src/clone-pack.ts
+var CLONE_PACK_ID = /^cpk_[0-9a-z]{10,40}$/;
+var Authorization2 = external_exports.string().regex(/^Bearer [A-Za-z0-9+/=._~-]{8,4096}$/);
+var HttpUrl2 = external_exports.string().max(2048).regex(/^https?:\/\/[^\s@]+$/);
+var Oid2 = external_exports.string().regex(/^[0-9a-f]{40}$/);
+var RefName3 = external_exports.string().max(1024).regex(/^refs\/[^\s\0]+$/);
+var PackRef = external_exports.object({ name: RefName3, oid: Oid2 });
+var PackJob = external_exports.object({
+  /** One build; one container per id. */
+  id: external_exports.string().regex(CLONE_PACK_ID),
+  /**
+   * The platform's endpoint for this build, `<base>/git` its git remote (storage behind the storage gate, private refs
+   * hidden) and `<base>/pack/:n`, `<base>/idx`, `<base>/complete` its upload; `authorization` holds for all of them and
+   * for nothing else.
+   */
+  base_url: HttpUrl2,
+  authorization: Authorization2,
+  default_branch: external_exports.string().regex(/^[A-Za-z0-9._\/-]{1,200}$/).refine((b) => !b.includes(".."), "invalid branch"),
+  /** The last ready pack, downloaded from `<base>/previous/pack` and `/previous/idx`, and the refs it holds. */
+  previous: external_exports.object({ pack_sha1: Oid2, refs: external_exports.array(PackRef).max(2e4) }).nullable(),
+  limits: external_exports.object({ max_pack_bytes: external_exports.number().int().positive(), part_bytes: external_exports.number().int().positive() }),
+  expires_at: external_exports.iso.datetime()
+});
+var PackComplete = external_exports.object({
+  pack_sha1: Oid2,
+  pack_bytes: external_exports.number().int().positive(),
+  parts: external_exports.number().int().positive().max(1e4),
+  objects: external_exports.number().int().nonnegative(),
+  refs: external_exports.array(PackRef).max(2e4)
+});
+var PackStatus = external_exports.object({
+  id: external_exports.string(),
+  state: external_exports.enum(["running", "completed", "failed"]),
+  phase: external_exports.string().max(40),
+  reason: external_exports.enum(["fetch_failed", "too_large", "upload_failed", "error"]).optional(),
+  message: external_exports.string().max(4e3).nullable(),
+  pack_bytes: external_exports.number().nullable(),
+  objects: external_exports.number().nullable(),
+  updated_at: external_exports.string(),
+  timings: external_exports.record(external_exports.string(), external_exports.number())
+});
+
 // packages/protocol/src/repo-mirrors.ts
 var StopMirrorRequest = external_exports.object({ confirm: external_exports.string().min(3).max(300), expected_version: external_exports.number().int().positive().optional() }).strict();
 var ResetMirrorRefsRequest = external_exports.object({ refs: external_exports.array(external_exports.string().min(1).max(1024)).min(1).max(100) }).strict();
@@ -35973,6 +36093,7 @@ function orgsGroup(t) {
     create: (body, o) => t.json({ method: "POST", path: "/v1/orgs", json: validate2(CreateOrgRequest, body, "CreateOrgRequest"), options: o }),
     list: (q = {}, o) => t.json({ method: "GET", path: "/v1/orgs", query: { ...q }, options: o }),
     get: (org, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}`, options: o }),
+    update: (org, body, o) => t.json({ method: "PATCH", path: path2`/v1/orgs/${org}`, json: validate2(UpdateOrgRequest, body, "UpdateOrgRequest"), options: o }),
     members: {
       list: (org, q = {}, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}/members`, query: { ...q }, options: o }),
       update: (org, userId, body, o) => t.json({
@@ -36264,13 +36385,25 @@ function reposGroup(t) {
     /** Raw file bytes; never interpret them as HTML. */
     raw: (repo, q, o) => t.bytes({ method: "GET", path: path2`/v1/repos/${repo}/raw`, query: { ...q }, options: o }),
     /** First-parent history of `ref`; with `path`, only commits that changed it — each page examines at most
-     * `scan_limit` commits and reports how many in `path_scan` (`complete` is false until the walk reaches the root). */
+     * `scan_limit` commits and reports how many in `path_scan` (`complete` is false until the walk reaches the root).
+     * With log filters (`author`, `grep`, `since`, `until`, `all_parents`; substring matches), the same in `log_scan`. */
     commits: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/commits`, query: { ...q }, options: o }),
     /** Write text files to a branch as one commit, through the same checks as a push (ADR-0078). Retry with the same
      * `idempotencyKey`: a retry after an uncertain outcome never commits twice. */
     commitFiles: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/commits`, json: validate2(CommitFilesRequest, body, "CommitFilesRequest"), options: o }),
     commit: (repo, oid, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/commits/${oid}`, options: o }),
+    /** The changes that brought a commit onto each ref it landed on (M6-SCL-01). */
+    commitChange: (repo, oid, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/commits/${oid}/change`, options: o }),
+    /** `mode: "two-dot"` diffs the base tree against the head tree instead of against their merge base. */
     compare: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/compare`, query: { ...q }, options: o }),
+    /** The commits in `base..head` (newest first, at most `limit`, max 250) with ahead/behind counts (M6-SCL-02). */
+    compareCommits: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/compare/commits`, query: { ...q }, options: o }),
+    /** Every best common ancestor of two refs or commits (`git merge-base --all`). */
+    mergeBase: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/merge-base`, query: { ...q }, options: o }),
+    /** Whether `ancestor` is in `descendant`'s history; `is_ancestor` is null when the bounded walk cannot decide. */
+    isAncestor: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/is-ancestor`, query: { ...q }, options: o }),
+    /** Branches and tags whose history contains a commit (`git for-each-ref --contains`). */
+    refsContaining: (repo, commit, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/commits/${commit}/refs`, options: o }),
     diff: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/diff`, query: { ...q }, options: o }),
     pushes: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/pushes`, query: { ...q }, options: o }),
     search: (repo, q, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/search`, query: { ...q }, options: o }),
@@ -36299,6 +36432,8 @@ function reposGroup(t) {
     grants: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/grants`, query: { ...q }, options: o }),
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/grants`, json: validate2(CreateGrantRequest, body, "CreateGrantRequest"), options: o }),
+      /** Replace the capabilities the grant carries beyond its role (ADR-0088), e.g. `["migrations:approve"]`. */
+      update: (repo, grant, body, o) => t.json({ method: "PATCH", path: path2`/v1/repos/${repo}/grants/${grant}`, json: validate2(UpdateGrantRequest, body, "UpdateGrantRequest"), options: o }),
       delete: (repo, grant, o) => t.void({ method: "DELETE", path: path2`/v1/repos/${repo}/grants/${grant}`, options: o })
     }
   };
@@ -36501,9 +36636,13 @@ function delegationsGroup(t) {
 function tasksGroup(t) {
   return {
     create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/tasks`, json: validate2(CreateTaskRequest, body, "CreateTaskRequest"), options: o }),
-    /** `label` (name or id) and `assignee` (handle or user id) filter the list. */
+    /**
+     * `label` (name or id) and `assignee` (handle or user id) filter the list. `ready: true` keeps only the frontier:
+     * open tasks whose blockers are all done or cancelled (`false`: every other task).
+     */
     list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks`, query: { ...q }, options: o }),
     get: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}`, options: o }),
+    byNumber: (repo, number4, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/tasks/by-number/${number4}`, options: o }),
     /** `version` is required: a stale version fails with VERSION_CONFLICT instead of overwriting someone else's edit. */
     update: (task, body, o) => t.json({ method: "PATCH", path: path2`/v1/tasks/${task}`, json: validate2(UpdateTaskRequest, body, "UpdateTaskRequest"), options: o }),
     /** Advisory claim; CONFLICT when someone else holds it. */
@@ -36513,28 +36652,50 @@ function tasksGroup(t) {
       create: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/comments`, json: validate2(CreateCommentRequest, body, "CreateCommentRequest"), options: o }),
       list: (task, q = {}, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/comments`, query: { ...q }, options: o })
     },
+    /** "Blocked by" links within the task's repository (ADR-0089). A blocker is a task number or `task_…` id. */
+    dependencies: {
+      list: (task, o) => t.json({ method: "GET", path: path2`/v1/tasks/${task}/dependencies`, options: o }),
+      /** Idempotent: adding an existing link changes nothing. CYCLE_DETECTED if the blocker already waits on this task. */
+      add: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/dependencies`, json: validate2(AddTaskDependencyRequest, body, "AddTaskDependencyRequest"), options: o }),
+      remove: (task, blocker, o) => t.void({ method: "DELETE", path: path2`/v1/tasks/${task}/dependencies/${String(blocker)}`, options: o })
+    },
     addLink: (task, body, o) => t.json({ method: "POST", path: path2`/v1/tasks/${task}/links`, json: validate2(AddLinkRequest, body, "AddLinkRequest"), options: o })
   };
 }
 
 // packages/sdk/src/groups/db-migrations.ts
 function dbMigrationsGroup(t) {
-  const decide = (decision) => (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, reason ? { reason } : {}, "DecideDbMigrationRunRequest"), options: o });
+  const decide = (decision) => (id2, reason, o) => {
+    const body = typeof reason === "string" ? { reason } : { ...reason?.reason ? { reason: reason.reason } : {}, ...reason?.redeploy ? { redeploy: true } : {} };
+    return t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, body, "DecideDbMigrationRunRequest"), options: o });
+  };
   return {
     sources: {
       list: (repo, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/sources`, options: o }),
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/db-migrations/sources`, json: validate2(CreateDbMigrationSourceRequest, body, "CreateDbMigrationSourceRequest"), options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
       update: (id2, body, o) => t.json({ method: "PATCH", path: path2`/v1/db-migration-sources/${id2}`, json: validate2(UpdateDbMigrationSourceRequest, body, "UpdateDbMigrationSourceRequest"), options: o }),
-      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o })
+      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
+      /** Who may approve the source's runs now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}/approvers`, options: o }),
+      /** Protect the database: every run waits for these approvals, and it can no longer apply without approval. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}/approval-rule`, options: o })
     },
     /** Migration directories found in the repository tree; `configured` marks those a source already covers. */
     suggestions: (repo, ref, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/suggestions`, query: ref ? { ref } : {}, options: o }),
     /** What applying the source at `ref` would do. `live` reads the database now instead of the last snapshot. */
     plan: (sourceId2, q = {}, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/plan`, query: { ref: q.ref, live: q.live ? "true" : void 0 }, options: o }),
+    /** The schema the source's migrations produce at `ref` (the source's branch by default), from replaying them. */
+    schema: (sourceId2, ref, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/schema`, query: ref ? { ref } : {}, options: o }),
+    /** Compares the database with what its applied migrations produce, now, and stores the result (admins). */
+    checkDrift: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/drift`, options: o }),
     /** Reads the applied versions from the database again and returns the plan at the source's branch. */
     refresh: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/refresh`, options: o }),
-    /** A manual run: the caller's request is the approval. `run` is null when nothing is pending. */
+    /**
+     * A manual run (`migrations:manage`). The request is the approval when the caller also holds `migrations:approve` and
+     * the source is not protected; otherwise the run waits for approval. `run` is null when nothing is pending.
+     */
     startRun: (sourceId2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/runs`, json: validate2(StartDbMigrationRunRequest, body, "StartDbMigrationRunRequest"), options: o }),
     runs: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/runs`, query: { ...q }, options: o }),
@@ -36544,12 +36705,13 @@ function dbMigrationsGroup(t) {
     reject: decide("reject"),
     retry: decide("retry"),
     cancel: decide("cancel"),
-    /** The plan of every source a change touches, with the files the change adds or edits marked. */
+    /** The plan of every source a change touches: the files the change adds (with statements), lint, schema effect. */
     changePlans: (changeId, o) => t.json({ method: "GET", path: path2`/v1/changes/${changeId}/db-migrations`, options: o })
   };
 }
 
 // packages/sdk/src/groups/deploy.ts
+var isCallOptions = (x) => "signal" in x || "idempotencyKey" in x;
 function deployGroup(t) {
   return {
     stepKinds: (o) => t.json({ method: "GET", path: "/v1/deploy/step-kinds", options: o }),
@@ -36559,19 +36721,36 @@ function deployGroup(t) {
     suggestions: (repo, ref, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deploy-suggestions`, query: ref ? { ref } : {}, options: o }),
     resources: (repo, connection, type, parent, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deploy-connections/${connection}/resources`, query: { type, ...parent ? { parent } : {} }, options: o }),
     targets: {
-      list: (repo, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deploy-targets`, options: o }),
+      /**
+       * A page of the repository's targets (50 by default); `name` finds one target by name. Callers from before
+       * pagination passed call options second: those are still taken as call options.
+       */
+      list: (repo, q = {}, o) => {
+        if (isCallOptions(q)) [q, o] = [{}, q];
+        return t.json({ method: "GET", path: path2`/v1/repos/${repo}/deploy-targets`, query: { ...q }, options: o });
+      },
       create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/deploy-targets`, json: validate2(CreateDeployTargetRequest, body, "CreateDeployTargetRequest"), options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/deploy-targets/${id2}`, options: o }),
       update: (id2, body, o) => t.json({ method: "PATCH", path: path2`/v1/deploy-targets/${id2}`, json: validate2(UpdateDeployTargetRequest, body, "UpdateDeployTargetRequest"), options: o }),
       remove: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}`, options: o }),
       /** Deploy the branch head again (or a commit this target deployed before). */
       deploy: (id2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/deploy`, json: validate2(RedeployRequest, body, "RedeployRequest"), options: o }),
-      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o })
+      rollback: (id2, body, o) => t.json({ method: "POST", path: path2`/v1/deploy-targets/${id2}/rollback`, json: validate2(RollbackRequest, body, "RollbackRequest"), options: o }),
+      /** Who may approve the target's production deploys now (ADR-0088). */
+      approvers: (id2, o) => t.json({ method: "GET", path: path2`/v1/deploy-targets/${id2}/approvers`, options: o }),
+      /** Protect the target: production deploys and rollbacks wait for these approvals. Pass `version` to replace a rule. */
+      protect: (id2, body, o) => t.json({ method: "PUT", path: path2`/v1/deploy-targets/${id2}/approval-rule`, json: validate2(PutApprovalRuleRequest, body, "PutApprovalRuleRequest"), options: o }),
+      /** Remove the rule; deploys waiting for it go on. */
+      unprotect: (id2, o) => t.json({ method: "DELETE", path: path2`/v1/deploy-targets/${id2}/approval-rule`, options: o })
     },
     deployments: {
       list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/deployments`, query: { ...q }, options: o }),
       get: (id2, o) => t.json({ method: "GET", path: path2`/v1/deployments/${id2}`, options: o }),
       cancel: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/cancel`, options: o }),
+      /** Approve a deploy of a protected target (people only; the last approval needed starts it). */
+      approve: (id2, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/approve`, json: {}, options: o }),
+      /** Reject it: the deployment is cancelled. */
+      reject: (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/deployments/${id2}/reject`, json: validate2(DecideDeploymentRequest, reason ? { reason } : {}, "DecideDeploymentRequest"), options: o }),
       ofChange: (change, o) => t.json({ method: "GET", path: path2`/v1/changes/${change}/deployments`, options: o })
     }
   };
@@ -37050,7 +37229,7 @@ function invalidAgentToolFlag(flag) {
 }
 
 // packages/cli/package.json
-var version2 = "0.18.3";
+var version2 = "0.19.1";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -38787,18 +38966,13 @@ async function gitConfigPath(deps) {
 }
 
 // packages/cli/src/work-ref.ts
-var MAX_PAGES = 20;
-var PAGE = 100;
 async function issueByNumber(client, repo, n) {
-  let cursor2;
-  for (let i = 0; i < MAX_PAGES; i++) {
-    const page = await client.tasks.list(repo, { limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
-    const hit = page.items.find((t) => t.number === n);
-    if (hit) return hit.id;
-    if (!page.next_cursor) return null;
-    cursor2 = page.next_cursor;
+  try {
+    return (await client.tasks.byNumber(repo, n)).id;
+  } catch (e) {
+    if (isBrnchApiError(e) && e.code === "NOT_FOUND") return null;
+    throw e;
   }
-  return null;
 }
 async function changeByNumber(client, repo, n) {
   try {
@@ -38824,6 +38998,21 @@ async function resolveChangeId(spec, client, repo) {
   if (!id2) throw notFound(`change #${n}`, repo.spec());
   return id2;
 }
+var TASK_ARG = "task number (12 or #12) in --repo, or a task_\u2026 id";
+async function resolveTaskId(spec, client, repo) {
+  const text2 = spec.trim();
+  const rest = text2.startsWith("issue:") ? text2.slice("issue:".length) : text2;
+  if (rest.startsWith("task_")) return rest;
+  const digits = /^#?(\d{1,9})$/.exec(rest)?.[1];
+  if (!digits) {
+    if (rest.startsWith("chg_") || rest.startsWith("change:")) throw usage(`${spec} is a change, not a task`);
+    throw usage(`cannot read task "${spec}": expected a number (12 or #12) or a task_\u2026 id`);
+  }
+  const n = Number(digits);
+  const id2 = await issueByNumber(client, await repo.id(), n);
+  if (!id2) throw notFound(`task #${n}`, repo.spec());
+  return id2;
+}
 async function resolveWorkRef(spec, client, repoId) {
   const m = /^(issue|change):(.+)$/.exec(spec.trim());
   const kind = m?.[1] ?? null;
@@ -39449,6 +39638,9 @@ async function createContext(deps, globals, state2) {
   function changeId(spec, pref = "agent") {
     return resolveChangeId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
   }
+  function taskId(spec, pref = "agent") {
+    return resolveTaskId(spec, client(pref), { id: () => repoId(void 0, pref), spec: () => repoSpec() });
+  }
   function org() {
     const o = targetOrg ?? storedCred?.account?.default_org;
     if (!o) {
@@ -39519,6 +39711,7 @@ async function createContext(deps, globals, state2) {
     repoSpec,
     repoId,
     changeId,
+    taskId,
     org,
     sessionId,
     info,
@@ -39638,6 +39831,15 @@ function cell(v) {
   if (typeof v === "number" || typeof v === "boolean") return String(v);
   return JSON.stringify(v);
 }
+function actorLabel(a) {
+  const person = a.handle ? `@${a.handle}` : a.user_name ?? null;
+  if (a.type === "human") return person ?? a.display_name ?? `${a.type} ${a.id}`;
+  if (a.type === "agent") {
+    const name = a.display_name ?? `agent ${a.id}`;
+    return person ? `${name} (agent for ${person})` : name;
+  }
+  return a.display_name ?? `${a.type} ${a.id}`;
+}
 var tildePath = (path3, home2) => home2 && path3.startsWith(`${home2}/`) ? `~${path3.slice(home2.length)}` : path3;
 function kv(obj3, keys) {
   const o = obj3 ?? {};
@@ -39710,6 +39912,7 @@ function instructionsSnippet(tool) {
     `  - Commit only what you wrote: stage your paths (\`git add <path>\u2026\`), not the person's uncommitted edits (\`git add -A\` takes them too). Do not squash other sessions' or the person's commits into yours.`,
     `  - Commit authors and trailers (\`Agent-Session:\`, \`Co-Authored-By:\`) are claims and attribute nothing; you do not need them for attribution.`,
     `  - Hooks wired: \`${cli} hooks status\`. Codex runs them only after the person trusts them once (\`${cli} hooks trust\` in their terminal).`,
+    `- Ask Brnch which change brought a commit instead of searching \`git log\` or guessing from commit-message words: \`${cli} repo commit-change <commit>\` (MCP: \`commit_change_get\`), for every merge strategy. The change's description and review say why.`,
     `- Record key decisions as you make them: \`${cli} decision "\u2026" --reason "\u2026" --file <path>\`. Blame shows them with the lines they explain.`,
     `- Other agents may be working here at the same time. Run \`${cli} status\` before you start to see who is working on what.`,
     `- Claim ADR numbers, migration numbers, release versions and exclusive operations before you use them, and use exactly the key you get: \`${cli} claim adr:<n> --next\` (also \`migration:<n>\`, \`version:<pkg>:<x.y.z>\`, \`lock:<operation>\`). If a key is taken, take the next; never reuse another session's key.`,
@@ -39737,7 +39940,7 @@ ${snippet}
 
 // packages/cli/src/commands/session.ts
 var renderSession = (s) => kv(
-  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: `${s.sponsor.type} ${s.sponsor.id}` },
+  { ...s, agent: `${s.agent.name} (${s.agent.id})`, sponsor: actorLabel(s.sponsor) },
   ["id", "title", "agent", "state", "presence", "attention", "repository_id", "task_id", "claimed_task_id", "sponsor", "scopes", "open_blockers", "last_seen_at", "expires_at", "max_expires_at", "end_reason"]
 );
 var renderStarted = (s) => `${renderSession(s.session)}
@@ -41242,7 +41445,7 @@ function sessionLines(s, now, you) {
     ...s.paths.length ? [`  touching: ${pathList(s.paths)}`] : []
   ];
 }
-var claimLine = (c8) => `  ${c8.key}  ${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
+var claimLine = (c8) => `  ${c8.key}  ${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}${c8.change ? ` \xB7 change #${c8.change.number}` : ""}${c8.note ? ` \xB7 ${c8.note}` : ""}`;
 function renderStatus(st, now = Date.now()) {
   const others = st.sessions.filter((s) => s.id !== st.you);
   const out = [others.length ? `${others.length} other agent session${others.length === 1 ? "" : "s"} working in this repository.` : "No other agent sessions are working in this repository."];
@@ -41797,9 +42000,9 @@ async function runHook(deps, state2, tool, eventArg) {
     let meta3 = await readMeta(deps.env, id2);
     if (!meta3) {
       const baseUrl = await baseUrlOf(deps);
-      const resolved = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
-      if (!resolved) return;
-      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved.repo, repo_root: resolved.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+      const resolved2 = await resolveRepo(deps, info.cwd ?? deps.cwd, baseUrl);
+      if (!resolved2) return;
+      meta3 = { client_key: clientKey, tool: t, model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
     }
     if (info.model && !meta3.model) meta3.model = redactText(info.model).text.slice(0, 200);
     if (!meta3.model && t === "claude-code" && typeof payload.transcript_path === "string" && /^(Stop|SessionEnd)$/.test(info.event)) meta3.model = await modelFromTranscript(deps, payload.transcript_path);
@@ -42003,22 +42206,22 @@ function registerCapture(program2, rt) {
     act(rt, async (ctx, o, words) => {
       const summary = words.join(" ").trim();
       if (!summary) throw usage("decision text is required");
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
-      if (!resolved) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      if (!resolved2) throw usage(`this directory is not a repository hosted on ${ctx.baseUrl}`);
       const now = Date.now();
-      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
+      const live = (await listSpool(ctx.deps.env)).filter((s) => s.meta.repo_root === resolved2.root && !s.meta.ended && now - Date.parse(s.meta.last_event_at) < 12 * 36e5).sort((a, b) => b.meta.last_event_at.localeCompare(a.meta.last_event_at))[0];
       let id2;
       let meta3;
       if (live) {
         id2 = live.id;
         meta3 = live.meta;
       } else {
-        const key = `manual:${spoolId(resolved.root)}:${new Date(now).toISOString().slice(0, 10)}`;
+        const key = `manual:${spoolId(resolved2.root)}:${new Date(now).toISOString().slice(0, 10)}`;
         id2 = spoolId(key);
-        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
+        meta3 = await readMeta(ctx.deps.env, id2) ?? { client_key: key, tool: "manual", model: null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: false };
       }
       const paths = (o.file ?? []).map((f) => {
-        const rel = relative2(canonical(resolved.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
+        const rel = relative2(canonical(resolved2.root), canonical(isAbsolute6(f) ? f : resolve4(ctx.deps.cwd, f)));
         if (!rel || rel.startsWith("..") || isAbsolute6(rel)) throw usage(`${f} is outside the repository`);
         return rel.split(sep2).join("/");
       });
@@ -42062,22 +42265,22 @@ ${report3.errors.join("\n")}` : ""}`);
       rt.state.noUpdateHint = true;
       const [cmd, ...args] = argv;
       if (!cmd) throw usage(`usage: ${BRAND.cli} capture wrap -- <command> [args\u2026]`);
-      const resolved = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
+      const resolved2 = await resolveRepo(ctx.deps, ctx.deps.cwd, ctx.baseUrl);
       const cfg = await readCaptureConfig(ctx.deps.env);
-      const before = resolved && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved.root) : null;
-      if (!resolved) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
+      const before = resolved2 && cfg.enabled ? await snapshotWorktree(ctx.deps, resolved2.root) : null;
+      if (!resolved2) ctx.info(`not a repository hosted on ${ctx.baseUrl}: running without capture`);
       const code = await runInherit(cmd, args, ctx.deps.cwd, ctx.deps.env);
       ctx.setExit(code);
-      if (!resolved || !before) return;
-      const after = await snapshotWorktree(ctx.deps, resolved.root);
+      if (!resolved2 || !before) return;
+      const after = await snapshotWorktree(ctx.deps, resolved2.root);
       if (!after) return;
-      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved.root, timeoutMs: 12e4 });
+      const diff = await ctx.deps.sys.run("git", ["-c", "core.hooksPath=/dev/null", "diff", "--no-color", "--no-renames", "--no-ext-diff", "-U0", before, after], { cwd: resolved2.root, timeoutMs: 12e4 });
       const label2 = (o.tool ?? cmd.split(/[\\/]/).pop() ?? "command").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
       const now = Date.now();
       const key = `wrapped:${label2}:${randomBytes4(8).toString("hex")}`;
       const id2 = spoolId(key);
-      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved.repo, repo_root: resolved.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
-      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
+      const meta3 = { client_key: key, tool: "wrapped", model: o.model ? redactText(o.model).text.slice(0, 200) : null, repo: resolved2.repo, repo_root: resolved2.root, base_url: ctx.baseUrl, started_at: new Date(now).toISOString(), last_event_at: new Date(now).toISOString(), ended: true };
+      const edits = await editsFromDiff(diff.stdout, { repoRoot: resolved2.root, config: cfg, readFile: (p) => ctx.deps.readFile(p).catch(() => null) }, label2);
       await writeMeta(ctx.deps.env, id2, meta3);
       await appendEvents(ctx.deps.env, id2, [{ type: "capture.started", payload: { source: label2 } }, ...edits, { type: "capture.ended", payload: { reason: `exit ${code}` } }], now);
       startFlush(ctx.deps);
@@ -45918,12 +46121,35 @@ function seedJson(p) {
 }
 
 // packages/cli/src/commands/task.ts
-var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? `${t.claim.actor.type} ${t.claim.actor.id}` : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.description ? `
+var BLOCKER_ARG = "the task it is blocked by: number (12 or #12) or task_\u2026 id";
+var resolved = (t) => t.state === "done" || t.state === "cancelled";
+var summaries = (list3) => list3.map((t) => `#${t.number} ${t.title} (${t.state})`).join("\n  ") || "(none)";
+function renderDependencies(d) {
+  const more = d.blocks_count > d.blocks.length ? `
+  \u2026 and ${d.blocks_count - d.blocks.length} more` : "";
+  return `Ready: ${d.is_ready ? "yes" : "no"}
+Blocked by:
+  ${summaries(d.blocked_by)}
+Blocks:
+  ${summaries(d.blocks)}${more}`;
+}
+var renderTask = (t) => kv({ ...t, claimed_by: t.claim ? actorLabel(t.claim.actor) : null }, ["id", "number", "title", "state", "owner_id", "claimed_by", "labels", "updated_at", "version"]) + (t.blocked_by?.length || t.blocks_count ? `
+
+${renderDependencies(t)}` : "") + (t.description ? `
 
 ${t.description}` : "") + (t.acceptance_criteria.length ? `
 
 Acceptance criteria:
 ${t.acceptance_criteria.map((c8) => `  - ${c8}`).join("\n")}` : "");
+var waitingOn = (t) => (t.blocked_by ?? []).filter((b) => !resolved(b)).map((b) => `#${b.number}`).join(" ");
+function blockersFrom(values, allowNone) {
+  if (!values) return void 0;
+  if (values.length === 1 && values[0] === "none") {
+    if (!allowNone) throw usage("--blocked-by none only clears blockers on task update");
+    return [];
+  }
+  return values.map((v) => v.trim().replace(/^issue:/, ""));
+}
 async function bodyFrom(ctx, o, required2 = true) {
   if (o.body !== void 0 && o.file !== void 0) throw usage("pass either --body or --file, not both");
   if (o.file !== void 0) return readText(fileSpec(o.file), ctx.input);
@@ -45933,23 +46159,24 @@ async function bodyFrom(ctx, o, required2 = true) {
 }
 function registerTask(program2, rt) {
   const task = program2.command("task").description("Tasks (issues) in --repo");
-  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).action(
+  task.command("create").description("Create a task").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or - for stdin").option("--criterion <text>", "acceptance criterion (repeatable)", repeat).option("--label <label>", "label (repeatable)", repeat).option("--blocked-by <task>", `${BLOCKER_ARG} (repeatable)`, repeat).action(
     act(rt, async (ctx, o) => {
       const description = await bodyFrom(ctx, o, false);
-      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label });
+      const t = await ctx.client().tasks.create(await ctx.repoId(), { title: o.title, description, acceptance_criteria: o.criterion, labels: o.label, blocked_by: blockersFrom(o.blockedBy, false) });
       ctx.result(t, renderTask);
     })
   );
-  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+  task.command("list").description("List tasks").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--ready", "only tasks ready to start: open, with every blocker done or cancelled").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
-      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "id"]));
+      const page = await ctx.client().tasks.list(await ctx.repoId(), { state: o.state, ...o.ready ? { ready: true } : {}, limit: o.limit, cursor: o.cursor });
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((t) => ({ ...t, waiting_on: waitingOn(t) })) }, ["number", "state", "title", "waiting_on", "id"]));
     })
   );
-  task.command("view <task>").description("Show a task").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().tasks.get(id2), renderTask)));
-  task.command("update <task>").description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("view").argument("<task>", TASK_ARG).description("Show a task, with what it is blocked by and what it blocks").action(act(rt, async (ctx, _o, [spec]) => ctx.result(await ctx.client().tasks.get(await ctx.taskId(spec)), renderTask)));
+  task.command("update").argument("<task>", TASK_ARG).description("Update fields; uses the current version unless --expected-version pins it (then stale edits fail with exit 5)").option("--title <title>", "title").option("--body <text>", "description").option("--file <path>", "description from a file or -").option("--state <state>", "open | in_progress | blocked | done | cancelled").option("--owner <user-id>", "owner user id ('none' to clear)").option("--label <label>", "replace labels (repeatable)", repeat).option("--blocked-by <task>", `replace the blockers: ${BLOCKER_ARG} (repeatable; 'none' to clear)`, repeat).option("--expected-version <n>", "expected version (optimistic concurrency)", (v) => parseIntOption(v, "--expected-version")).action(
+    act(rt, async (ctx, o, [spec]) => {
       const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
       const version4 = o.expectedVersion ?? (await c8.tasks.get(id2)).version;
       const t = await c8.tasks.update(id2, {
         title: o.title,
@@ -45957,17 +46184,35 @@ function registerTask(program2, rt) {
         state: o.state,
         owner_id: o.owner === void 0 ? void 0 : o.owner === "none" ? null : o.owner,
         labels: o.label,
+        blocked_by: blockersFrom(o.blockedBy, true),
         version: version4
       });
       ctx.result(t, renderTask);
     })
   );
-  task.command("claim <task>").description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.claim(id2, { session_id: o.session }), renderTask)));
-  task.command("release <task>").description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client().tasks.release(id2, { session_id: o.session }), renderTask)));
-  task.command("comment <task>").description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
-    act(rt, async (ctx, o, [id2]) => {
+  task.command("depend").argument("<task>", TASK_ARG).argument("[blocker]", BLOCKER_ARG).description("Mark <task> as blocked by [blocker] (same repository); without it, show what <task> is blocked by and blocks").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const c8 = ctx.client();
+      const id2 = await ctx.taskId(spec);
+      const deps = blocker ? await c8.tasks.dependencies.add(id2, { blocker: blockersFrom([blocker], false)[0] }) : await c8.tasks.dependencies.list(id2);
+      ctx.result(deps, renderDependencies);
+    })
+  );
+  task.command("undepend").argument("<task>", TASK_ARG).argument("<blocker>", BLOCKER_ARG).description("Remove <blocker> from what <task> is blocked by").action(
+    act(rt, async (ctx, _o, [spec, blocker]) => {
+      const id2 = await ctx.taskId(spec);
+      const ref = blockersFrom([blocker], false)[0];
+      await ctx.client().tasks.dependencies.remove(id2, ref);
+      ctx.result({ task_id: id2, removed: ref }, `${spec} is no longer blocked by ${ref}`);
+    })
+  );
+  task.command("claim").argument("<task>", TASK_ARG).description("Advisory claim (exit 5 if someone else holds it)").option("--session <id>", "claim on behalf of this agent session").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.claim(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("release").argument("<task>", TASK_ARG).description("Release your claim").option("--session <id>", "agent session that holds the claim").action(act(rt, async (ctx, o, [spec]) => ctx.result(await ctx.client().tasks.release(await ctx.taskId(spec), { session_id: o.session }), renderTask)));
+  task.command("comment").argument("<task>", TASK_ARG).description("Add a comment").option("--body <text>", "comment (Markdown; @file or - for stdin)").option("--file <path>", "read the comment from a file or -").action(
+    act(rt, async (ctx, o, [spec]) => {
+      const id2 = await ctx.taskId(spec);
       const comment = await ctx.client().tasks.comments.create(id2, { body: await bodyFrom(ctx, o) });
-      ctx.result(comment, `Comment ${comment.id} added to ${id2}`);
+      ctx.result(comment, `Comment ${comment.id} added to ${spec}`);
     })
   );
 }
@@ -46249,7 +46494,7 @@ var how = (strategy) => strategy ? `with ${strategy}` : "with the policy's defau
 function renderAutoMerge(a, change, p, now) {
   const ref = change ? String(change.number) : a.change_id;
   const name = change ? `${p.bold(`#${change.number}`)} ${change.title}` : p.bold(a.change_id);
-  const who3 = a.enabled_by ? a.enabled_by.display_name ?? a.enabled_by.id : null;
+  const who3 = a.enabled_by ? actorLabel(a.enabled_by) : null;
   const out = [];
   switch (a.state) {
     case "enabled":
@@ -46269,7 +46514,7 @@ function renderAutoMerge(a, change, p, now) {
       out.push(p.dim(`  Turn it on: ${BRAND.cli} change auto-merge ${ref}`));
   }
   if (a.history.length) {
-    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: h.actor.display_name ?? h.actor.id, reason: h.reason }));
+    const rows2 = a.history.map((h) => ({ when: ago2(h.at, now), action: h.action, actor: actorLabel(h.actor), reason: h.reason }));
     const w = { when: Math.max(...rows2.map((r) => r.when.length)), action: Math.max(...rows2.map((r) => r.action.length)) };
     out.push("", p.bold("History"));
     for (const r of rows2) out.push(`  ${p.dim(r.when.padEnd(w.when))}  ${r.action.padEnd(w.action)}  ${r.actor}${r.reason ? p.dim(` \xB7 ${r.reason}`) : ""}`);
@@ -46335,11 +46580,11 @@ function stepOf(state2, previous) {
 
 // packages/cli/src/commands/change.ts
 var renderChange = (c8) => kv(
-  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: `${c8.author.type} ${c8.author.id}`, revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
+  { ...c8, source: c8.source.workspace_id ?? c8.source.ref, author: actorLabel(c8.author), revision: `#${c8.current_revision.number} ${c8.current_revision.id}` },
   ["number", "id", "title", "state", "target_ref", "source", "task_id", "author", "revision", "current_revision.head_oid", "revision_count", "merged", "version"]
 );
 var renderThread = (t) => `${t.id} [${t.state}${t.blocking ? ", blocking" : ""}${t.anchor.outdated ? ", outdated" : ""}] ${t.anchor.path ?? "(change)"}${t.anchor.start_line ? `:${t.anchor.start_line}` : ""}
-` + t.comments.map((c8) => `  ${c8.author.display_name ?? c8.author.id}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
+` + t.comments.map((c8) => `  ${actorLabel(c8.author)}: ${c8.body.split("\n").join("\n    ")}`).join("\n");
 function registerChange(program2, rt) {
   const change = program2.command("change").description("Changes (proposed updates to a protected ref)");
   change.command("create").description("Create a change from a workspace or a ref in --repo").requiredOption("--title <title>", "title").option("--body <text>", "description (Markdown; @file or - for stdin)").option("--file <path>", "read the description from a file or -").option("--workspace <id>", "source workspace").option("--ref <ref>", "source ref (e.g. refs/heads/feature)").option("--target <ref>", "target ref (default: the repository's default branch)").option("--task <id>", "linked task").option("--draft", "create as draft").action(
@@ -46359,7 +46604,7 @@ function registerChange(program2, rt) {
   change.command("list").description("List changes in --repo").option("--state <state>", "draft | open | merged | closed").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const page = await ctx.client().changes.list(await ctx.repoId(), { state: o.state, limit: o.limit, cursor: o.cursor });
-      ctx.result(page, (v) => listWithCursor(v, ["number", "state", "title", "target_ref", "id"]));
+      ctx.result(page, (v) => listWithCursor({ ...v, items: v.items.map((c8) => ({ ...c8, author: actorLabel(c8.author) })) }, ["number", "state", "title", "author", "target_ref", "id"]));
     })
   );
   change.command("view").argument("<change>", CHANGE_ARG).description("Show a change").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.get(await ctx.changeId(id2)), renderChange)));
@@ -46448,7 +46693,7 @@ function registerReview(program2, rt) {
       const id2 = await ctx.changeId(spec);
       const revision = o.revision ?? (await c8.changes.get(id2)).current_revision.id;
       const r = await c8.reviews.create(id2, { revision_id: revision, decision, body: await bodyFrom(ctx, o, bodyRequired) });
-      ctx.result(r, (v) => kv({ ...v, reviewer: `${v.reviewer.type} ${v.reviewer.id}` }, ["id", "decision", "revision_id", "reviewer", "current"]));
+      ctx.result(r, (v) => kv({ ...v, reviewer: actorLabel(v.reviewer) }, ["id", "decision", "revision_id", "reviewer", "current"]));
     })
   );
   decide("approve", "approved", "Approve a revision (approvals are bound to that revision)", false);
@@ -46569,7 +46814,7 @@ Wait for the findings: code-review wait ${spec}`);
 
 // packages/cli/src/commands/evidence.ts
 import { basename as basename4, extname, isAbsolute as isAbsolute8, resolve as resolve8 } from "node:path";
-var renderEvidence = (e) => kv({ ...e, issuer: `${e.issuer.type} ${e.issuer.id}` }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
+var renderEvidence = (e) => kv({ ...e, issuer: actorLabel(e.issuer) }, ["id", "check_name", "result", "subject_kind", "subject_oid", "origin", "independence", "issuer", "summary", "attachment_ids", "revoked_at"]);
 var CONTENT_TYPES = { ".txt": "text/plain", ".log": "text/plain", ".json": "application/json", ".xml": "application/xml", ".html": "text/plain" };
 function registerEvidence(program2, rt) {
   const ev = program2.command("evidence").description("Verification evidence");
@@ -46746,7 +46991,7 @@ var renderCoverage = (c8) => [
   `code owner review ${c8.required ? "required" : "not required"} by policy v${c8.policy_version} (revision ${c8.revision_id})${c8.complete ? "" : " \u2014 path list truncated"}`,
   table(c8.paths.map((p) => ({ ...p, owners: p.owners.join(" ") || "-", approved_by: p.approved_by.join(" ") || "-" })), ["path", "owners", "satisfied", "approved_by"])
 ].join("\n");
-var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: a.pushed_by.display_name ?? a.pushed_by.id })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
+var renderAlerts = (p) => listWithCursor({ ...p, items: p.items.map((a) => ({ ...a, where: `${a.path}:${a.line}`, pushed_by: actorLabel(a.pushed_by) })) }, ["id", "state", "rule", "where", "blob_oid", "masked", "pushed_by", "created_at"]);
 function registerGovernance(program2, rt) {
   const change = program2.commands.find((c8) => c8.name() === "change") ?? program2.command("change");
   change.command("draft").argument("<change>", CHANGE_ARG).description("Convert an open change back to a draft (drafts cannot merge and notify nobody)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client().changes.draft(await ctx.changeId(id2)), (c8) => kv(c8, ["id", "number", "title", "state"]))));
@@ -46836,7 +47081,7 @@ new revision #${r.revision.number} ${r.revision.id}`);
       }
       const b = await ctx.client("user").pushProtection.bypasses.create(await ctx.repoId(), { rule: o.rule, path: o.path, blob_oid: o.blob, reason: o.reason, ...principal ? { principal } : {}, ...o.ref ? { ref: o.ref } : {} });
       ctx.result(b, (v) => {
-        const who3 = v.principal ? v.principal.display_name ?? `${v.principal.type}:${v.principal.id}` : "nobody";
+        const who3 = v.principal ? actorLabel(v.principal) : "nobody";
         return `${kv({ ...v, for: who3, ref: v.ref ?? "any" }, ["id", "rule", "path", "blob_oid", "for", "ref", "expires_at"])}
 Only ${who3} can use it, for one push, before it expires.`;
       });
@@ -46847,7 +47092,7 @@ Only ${who3} can use it, for one push, before it expires.`;
       rt,
       async (ctx, o) => ctx.result(
         await ctx.client().pushProtection.bypasses.list(await ctx.repoId(), { limit: o.limit, cursor: o.cursor }),
-        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? b.principal.display_name ?? b.principal.id : "-", created_by: b.created_by.display_name ?? b.created_by.id, used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
+        (p) => listWithCursor({ ...p, items: p.items.map((b) => ({ ...b, for: b.principal ? actorLabel(b.principal) : "-", created_by: actorLabel(b.created_by), used: b.used_at ? "yes" : "no" })) }, ["id", "rule", "path", "blob_oid", "for", "created_by", "used", "expires_at", "reason"])
       )
     )
   );
@@ -46888,7 +47133,7 @@ var renderAlerts2 = (p) => listWithCursor(
   ["id", "state", "resolution", "confidence", "rule", "repo", "where", "masked", "source", "created_at"]
 );
 var renderAlert = (a) => [
-  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? a.resolved_by.display_name ?? a.resolved_by.id : null, looks_fake: a.looks_fake?.label ?? null }, [
+  kv({ ...a, where: where(a), resolved_by: a.resolved_by ? actorLabel(a.resolved_by) : null, looks_fake: a.looks_fake?.label ?? null }, [
     "id",
     "state",
     "resolution",
@@ -47229,8 +47474,8 @@ var renderDevices = (v) => v.items.length ? table(
   v.items.map((d) => ({ id: d.id, name: d.name ?? "-", environment: d.environment, app_version: d.app_version ?? "-", last_seen: d.last_seen_at, current: d.current ? "yes" : "" })),
   ["id", "name", "environment", "app_version", "last_seen", "current"]
 ) : "No push devices. The iOS app registers itself when you allow notifications.";
-var PAGE2 = 100;
-var MAX_PAGES2 = 10;
+var PAGE = 100;
+var MAX_PAGES = 10;
 async function findItems(client, specs) {
   const wanted = specs.map((s) => s.trim().toLowerCase());
   for (const s of wanted) if (s.length < 4) throw usage(`"${s}" is too short to name an inbox item: use the id \`${c4} inbox list\` shows`);
@@ -47238,8 +47483,8 @@ async function findItems(client, specs) {
   const seen = /* @__PURE__ */ new Set();
   for (const view of ["all", "snoozed", "done"]) {
     let cursor2;
-    for (let i = 0; i < MAX_PAGES2; i++) {
-      const page = await client.inbox.list({ view, limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
+    for (let i = 0; i < MAX_PAGES; i++) {
+      const page = await client.inbox.list({ view, limit: PAGE, ...cursor2 ? { cursor: cursor2 } : {} });
       for (const item of page.items) {
         if (seen.has(item.id)) continue;
         seen.add(item.id);
@@ -47694,13 +47939,13 @@ function renderEntry(e, verb) {
   if (e.flags.length) lines2.push(`flagged: ${e.flags.join(", ")}${e.flags.includes("instructions") ? "; never given to the assistant on its own" : ""}`);
   return lines2.join("\n");
 }
-var PAGE3 = 100;
-var MAX_PAGES3 = 10;
+var PAGE2 = 100;
+var MAX_PAGES2 = 10;
 async function reviewable(ctx, org, q) {
   const out = [];
   let cursor2;
-  for (let i = 0; i < MAX_PAGES3; i++) {
-    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE3, ...cursor2 ? { cursor: cursor2 } : {} });
+  for (let i = 0; i < MAX_PAGES2; i++) {
+    const page = await ctx.client("user").assistant.memory.list(org, { ...q, status: "pending", limit: PAGE2, ...cursor2 ? { cursor: cursor2 } : {} });
     out.push(...page.items.filter((e) => e.can_review));
     if (!page.next_cursor) break;
     cursor2 = page.next_cursor;
@@ -48008,6 +48253,38 @@ function registerIntegrations(program2, rt) {
   integrations.command("inherit <provider> <purpose>").description("Drop --repo's choice and inherit the nearest shared connection again").action(act(rt, async (ctx, _o, [provider, purpose]) => ctx.result(await ctx.client("user").grants.inherit(await ctx.repoId(void 0, "user"), provider, purpose), renderRepo)));
 }
 
+// packages/cli/src/commands/approvals.ts
+function protectOptions(cmd) {
+  return cmd.option("--user <handle>", "a person who may approve (@handle or id; repeatable)", repeat).option("--team <slug>", "a team whose members may approve (slug or id; repeatable)", repeat).option("--required <n>", "approvals needed from different people (default 1)", (v) => parseIntOption(v, "--required")).option("--separation-of-duties", "the change's author, its merger and whoever requested the deploy or run cannot approve it");
+}
+function protectBody(o, current) {
+  const users = o.user ?? [];
+  const teams = o.team ?? [];
+  if (!users.length && !teams.length && o.required === void 0 && !o.separationOfDuties) throw usage("give --user, --team, --required or --separation-of-duties");
+  return { required: o.required ?? 1, users, teams, separation_of_duties: !!o.separationOfDuties, ...current ? { version: current.version } : {} };
+}
+var who2 = (p) => p.handle ? `@${p.handle}` : p.name;
+var ruleSummary = (r) => r ? `${r.required} approval${r.required === 1 ? "" : "s"} from ${[...r.teams.map((t) => `@${t.slug} team`), ...r.users.map(who2)].join(", ") || "anyone who may approve"}${r.separation_of_duties ? "; not the author, merger or requester" : ""}` : "not protected";
+var renderApprovers = (v) => kv(
+  {
+    protected: ruleSummary(v.rule),
+    capability: v.capability,
+    eligible: v.eligible.map(who2).join(", ") || "nobody",
+    lacking_capability: v.lacking_capability.length ? `${v.lacking_capability.map(who2).join(", ")} (named, but cannot approve without ${v.capability})` : null,
+    unsatisfiable: v.unsatisfiable ? "yes: fewer people can approve than it needs" : null
+  },
+  ["protected", "capability", "eligible", "lacking_capability", "unsatisfiable"]
+);
+var renderRule = (r) => `protected: ${ruleSummary(r)} (version ${r.version})`;
+function approvalLines(a) {
+  if (!a) return "";
+  const by2 = a.approvals.filter((x) => x.counted).map((x) => who2(x.user));
+  const lines2 = [a.line ?? (a.satisfied ? `approved (${a.counted} of ${a.required})` : null), by2.length ? `approved by ${by2.join(", ")}` : null, a.you && !a.you.can_approve && a.line ? `you cannot approve: ${a.you.message}` : null].filter(Boolean);
+  return lines2.length ? `
+
+${lines2.join("\n")}` : "";
+}
+
 // packages/cli/src/commands/db.ts
 async function sourceId(ctx, ref, repo) {
   if (ref.startsWith("dms_")) return ref;
@@ -48018,18 +48295,58 @@ async function sourceId(ctx, ref, repo) {
 }
 var plural3 = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 var short = (oid) => oid.slice(0, 12);
-var database = (s) => `${s.ps_organization}/${s.ps_database}@${s.ps_branch}`;
+var database = (s) => {
+  const t = s.target;
+  return t.provider === "cloudflare_d1" ? `d1:${t.binding}\u2192${t.database_name ?? t.database_id}${t.environment ? ` (env ${t.environment})` : ""}` : `${t.organization}/${t.database}@${t.branch}`;
+};
+var PS_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
+var PS_ENGINES = ["postgres", "vitess"];
+var LEVELS = ["error", "warning", "off"];
+function lintLines(findings2) {
+  if (!findings2?.length) return [];
+  return ["lint:", ...findings2.map((f) => `  ${f.level.padEnd(12)}  ${(f.atlas_code ?? f.code).padEnd(6)}  ${f.file}:${f.line}  ${f.message}`)];
+}
+function diffLines(d) {
+  if (!d) return [];
+  const t = d.tables;
+  const out = [];
+  for (const x of t.added) out.push(`  + table ${x.name} (${x.columns.map((c8) => c8.name).join(", ")})`);
+  for (const x of t.renamed) out.push(`  ~ table ${x.from} \u2192 ${x.to}`);
+  for (const x of t.changed) {
+    for (const c8 of x.columns.added) out.push(`  + ${x.name}.${c8.name} ${c8.type}${c8.nullable ? "" : " NOT NULL"}`);
+    for (const c8 of x.columns.renamed) out.push(`  ~ ${x.name}.${c8.from} \u2192 ${c8.to}`);
+    for (const c8 of x.columns.changed) out.push(`  ~ ${x.name}.${c8.name} ${c8.before.type} \u2192 ${c8.after.type}`);
+    for (const c8 of x.columns.dropped) out.push(`  - ${x.name}.${c8}`);
+    for (const i of x.indexes.added) out.push(`  + index ${i} on ${x.name}`);
+    for (const i of x.indexes.dropped) out.push(`  - index ${i} on ${x.name}`);
+    for (const k of x.foreign_keys.added) out.push(`  + foreign key ${k} on ${x.name}`);
+    for (const k of x.foreign_keys.dropped) out.push(`  - foreign key ${k} on ${x.name}`);
+  }
+  for (const x of t.dropped) out.push(`  - table ${x.name}`);
+  if (!out.length && !d.unparsed.length) return ["schema effect: none"];
+  return ["schema effect:", ...out, ...d.unparsed.length ? [`  (${plural3(d.unparsed.length, "statement")} could not be interpreted, first at ${d.unparsed[0].file}:${d.unparsed[0].line})`] : []];
+}
+function renderDrift(d) {
+  if (!d) return "drift: not checked yet";
+  const lines2 = [`drift: ${d.status} (checked ${d.checked_at} against ${plural3(d.applied, "applied migration")})`];
+  if (d.note) lines2.push(`note: ${d.note}`);
+  for (const f of d.findings) lines2.push(`  ${f.kind.padEnd(20)}  ${f.object}  ${f.detail}`);
+  return lines2.join("\n");
+}
 function issueLines(issues) {
   if (!issues.length) return [];
   return ["issues:", ...issues.map((i) => `  ${i.level.padEnd(7)}  ${i.code}  ${i.file ? `${i.file}: ` : ""}${i.message}`)];
 }
 var renderSources = (v) => table(
-  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet" })),
-  ["name", "id", "path", "format", "engine", "database", "branch", "on_merge", "state", "applied"]
+  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet", drift: s.drift?.status ?? "-" })),
+  ["name", "id", "provider", "path", "format", "database", "branch", "apply_on", "state", "applied", "drift"]
 );
-var renderSource = (s) => `${kv({ ...s, database: database(s), path: s.path || "(repository root)" }, ["id", "name", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "on_merge", "change_checks", "state", "version"])}
+var renderSource = (s) => `${kv(
+  { ...s, approvers: ruleSummary(s.approval_rule), database: database(s), path: s.path || "(repository root)", destructive: s.lint.levels.destructive ?? "error", nolint: s.lint.nolint, ...s.target.provider === "cloudflare_d1" ? { from: `${s.target.config_path} on ${s.branch}` } : {} },
+  s.provider === "cloudflare_d1" ? ["id", "name", "provider", "path", "format", "database", "from", "branch", "revisions_location", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"] : ["id", "name", "provider", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "apply_on", "require_approval", "approvers", "change_checks", "destructive", "nolint", "drift_mode", "state", "version"]
+)}
 
-` + (s.on_merge === "approval" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
+` + (s.apply_on === "merge" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : s.apply_on === "deploy" ? `The production deploy's migrations step applies them${s.require_approval ? ", once the run is approved" : ""}` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
 var renderSuggestions = (v) => v.items.length ? table(
   v.items.map((s) => ({ ...s, path: s.path || "(root)", configured: s.configured ? "yes" : "no" })),
   ["path", "format", "files", "revisions_schema", "baseline_version", "configured", "evidence"]
@@ -48048,16 +48365,17 @@ function renderPlan2(p) {
       lines2.push(`  ${f.name}  ${plural3(f.statements, "statement")}${notes.length ? `  (${notes.join(", ")})` : ""}`);
     }
   }
-  return [...lines2, ...issueLines(p.issues)].join("\n");
+  return [...lines2, ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(p.schema_diff)].join("\n");
 }
 var renderPlans = (v) => v.items.length ? v.items.map(renderPlan2).join("\n\n") : "no migration sources";
 var NEXT = {
-  awaiting_approval: (id2) => `Waiting for a repository admin: ${BRAND.cli} db approve ${id2} (or reject)`,
+  awaiting_approval: (id2) => `Waiting for approval: ${BRAND.cli} db approve ${id2} (or reject)`,
   failed: (id2) => `Fix the migration and merge it, then: ${BRAND.cli} db retry ${id2}`,
-  needs_attention: (id2) => `Look at the run in PlanetScale, then: ${BRAND.cli} db retry ${id2} or cancel`
+  needs_attention: (id2) => `Look at the database (PlanetScale, or the D1 bookmark's restore command), then: ${BRAND.cli} db retry ${id2} or cancel`
 };
 function renderRun(r) {
-  const ps = r.planetscale;
+  const ps = r.backend?.provider === "planetscale" ? r.backend : null;
+  const d1 = r.backend?.provider === "cloudflare_d1" ? r.backend : null;
   const head = kv(
     {
       ...r,
@@ -48065,16 +48383,18 @@ function renderRun(r) {
       change: r.change_id ?? "-",
       requested_by: r.requested_by ? `${r.requested_by.type} ${r.requested_by.id}` : "-",
       deploy_request: ps?.deploy_request_url ?? (ps?.deploy_request ? `#${ps.deploy_request}` : null),
-      deployment_state: ps?.deployment_state ?? null
+      deployment_state: ps?.deployment_state ?? null,
+      bookmark: d1?.bookmark ?? null,
+      restore: d1?.restore?.wrangler ?? null
     },
-    ["id", "source_name", "status", "kind", "engine", "commit", "change", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "error", "note", "created_at"]
+    ["id", "source_name", "status", "kind", "provider", "engine", "commit", "change", "deployment_id", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "bookmark", "restore", "error", "note", "created_at"]
   );
   const files = r.files.length ? table(
     r.files.map((f) => ({ ...f, statements: f.applied_statements ? `${f.applied_statements}/${f.statements}` : f.statements, error: f.error ? `${f.error}${f.error_statement ? ` (in: ${f.error_statement})` : ""}` : null })),
     ["name", "status", "statements", "execution_ms", "error"]
   ) : "no files";
   const next = NEXT[r.status]?.(r.id);
-  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n");
+  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n") + approvalLines(r.approval);
 }
 var renderRuns = (v) => listWithCursor(
   { ...v, items: v.items.map((r) => ({ ...r, commit: short(r.commit_oid), files: `${r.files.filter((f) => f.status === "applied").length}/${r.files.length} applied` })) },
@@ -48095,9 +48415,9 @@ function sessionSettings(pairs) {
   return out;
 }
 function registerDb(program2, rt) {
-  const db = program2.command("db").description("Database migrations on PlanetScale for --repo: sources, plans, and runs applied after merge and approval");
-  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
-  sources.command("add").description("Add a migration source (repository admins). The source is checked against PlanetScale; `db suggest` shows the directories found").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", DB_MIGRATION_FORMATS.join(" | "), oneOf("--format", DB_MIGRATION_FORMATS)).requiredOption("--engine <engine>", DB_ENGINE_KINDS.join(" | "), oneOf("--engine", DB_ENGINE_KINDS)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "approval (merges create runs waiting for approval) | manual_only", oneOf("--on-merge", ["approval", "manual_only"])).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
+  const db = program2.command("db").description("Database migrations on PlanetScale and Cloudflare D1 for --repo: sources, plans, lint, runs applied after approval, and drift");
+  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch or a D1 database (D1 sources come from the Wrangler configuration)").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
+  sources.command("add").description("Add a PlanetScale migration source (migrations:manage). The source is checked against PlanetScale; `db suggest` shows the directories found. D1 sources need no adding: they come from the Wrangler configuration").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", PS_FORMATS.join(" | "), oneOf("--format", PS_FORMATS)).requiredOption("--engine <engine>", PS_ENGINES.join(" | "), oneOf("--engine", PS_ENGINES)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "deprecated: --apply-on (approval = merge, manual_only = manual)", oneOf("--on-merge", ["approval", "manual_only"])).option("--apply-on <when>", `${DB_APPLY_ON.join(" | ")} (default merge: runs wait for approval after merge)`, oneOf("--apply-on", DB_APPLY_ON)).option("--no-approval", "--apply-on deploy or manual: apply without a person's approval").option("--destructive <level>", "lint level for destructive changes: error (default, fails the check) | warning | off", oneOf("--destructive", LEVELS)).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
     act(rt, async (ctx, o) => {
       let dsn;
       if (o.dsnFile !== void 0) {
@@ -48124,6 +48444,10 @@ function registerDb(program2, rt) {
         ...o.baseline ? { baseline_version: o.baseline } : {},
         ...o.execOrder ? { exec_order: o.execOrder } : {},
         ...o.onMerge ? { on_merge: o.onMerge } : {},
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval === false ? { require_approval: false } : {},
+        ...o.destructive ? { lint: { levels: { destructive: o.destructive }, nolint: "honor", drift_blocks_deploy: false } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
         ...o.credentialMode ? { credential_mode: o.credentialMode } : {},
         ...o.runAsRole ? { run_as_role: o.runAsRole } : {},
         ...o.sessionSetting ? { session_settings: sessionSettings(o.sessionSetting) } : {},
@@ -48134,6 +48458,45 @@ function registerDb(program2, rt) {
       ctx.result(await ctx.client("user").dbMigrations.sources.create(await ctx.repoId(void 0, "user"), body), renderSource);
     })
   );
+  sources.command("set <source>").description("Change how a source applies, its lint and drift checks (migrations:manage; D1 sources: only these)").option("--apply-on <when>", DB_APPLY_ON.join(" | "), oneOf("--apply-on", DB_APPLY_ON)).option("--approval", "each run waits for approval (migrations:approve; a protected source's approvers)").option("--no-approval", "--apply-on deploy or manual: apply without approval").option("--destructive <level>", "lint level for destructive changes: error | warning | off", oneOf("--destructive", LEVELS)).option("--nolint <mode>", "honor | ignore: whether `-- atlas:nolint` in a file acknowledges a finding", oneOf("--nolint", ["honor", "ignore"])).option("--drift <mode>", DB_DRIFT_MODES.join(" | "), oneOf("--drift", DB_DRIFT_MODES)).option("--drift-blocks-deploy <yes|no>", "drift found by the last check fails the deploy's migrations step", oneOf("--drift-blocks-deploy", ["yes", "no"])).option("--enable", "activate the source").option("--disable", "disable the source (no runs, no checks)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      if (o.enable && o.disable) throw usage("--enable and --disable exclude each other");
+      const c8 = ctx.client("user").dbMigrations;
+      const s = await c8.sources.get(await sourceId(ctx, ref));
+      const levels = { ...s.lint.levels };
+      if (o.destructive) {
+        if (o.destructive === "error") delete levels.destructive;
+        else levels.destructive = o.destructive;
+      }
+      const lintChanged = o.destructive || o.nolint || o.driftBlocksDeploy;
+      const body = {
+        version: s.version,
+        ...o.applyOn ? { apply_on: o.applyOn } : {},
+        ...o.approval !== void 0 ? { require_approval: o.approval } : {},
+        ...lintChanged ? { lint: { levels, nolint: o.nolint ?? s.lint.nolint, drift_blocks_deploy: o.driftBlocksDeploy ? o.driftBlocksDeploy === "yes" : s.lint.drift_blocks_deploy } } : {},
+        ...o.drift ? { drift_mode: o.drift } : {},
+        ...o.enable ? { state: "active" } : o.disable ? { state: "disabled" } : {}
+      };
+      if (Object.keys(body).length === 1) throw usage("nothing to change: give --apply-on, --approval, --destructive, --nolint, --drift, --drift-blocks-deploy, --enable or --disable");
+      ctx.result(await c8.sources.update(s.id, body), renderSource);
+    })
+  );
+  protectOptions(sources.command("protect <source>").description("Require approvals for every run of the source (people with migrations:manage). A protected database can no longer apply without approval. Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations.sources;
+      const s = await c8.get(await sourceId(ctx, ref));
+      ctx.result(await c8.protect(s.id, protectBody(o, s.approval_rule)), renderRule);
+    })
+  );
+  sources.command("unprotect <source>").description("Remove the source's approval rule (runs still need approval as its apply mode says). Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}`);
+      await ctx.client("user").dbMigrations.sources.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  sources.command("approvers <source>").description("Who may approve the source's runs now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.sources.approvers(await sourceId(ctx, ref)), renderApprovers)));
   sources.command("rm <source>").description("Delete a migration source (name or id; its runs stay listed). Requires --yes when non-interactive").action(
     act(rt, async (ctx, _o, [ref]) => {
       const id2 = await sourceId(ctx, ref);
@@ -48143,7 +48506,7 @@ function registerDb(program2, rt) {
     })
   );
   db.command("suggest").description("Migration directories found in --repo (atlas.sum, drizzle journals, *.up.sql, numbered SQL files), and whether a source covers each").option("--ref <ref>", "branch, tag or commit (default: the default branch)").action(act(rt, async (ctx, o) => ctx.result(await ctx.client("user").dbMigrations.suggestions(await ctx.repoId(void 0, "user"), o.ref), renderSuggestions)));
-  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (repository admins)").action(
+  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (migrations:manage)").action(
     act(rt, async (ctx, o, [ref]) => {
       const c8 = ctx.client("user").dbMigrations;
       const q = { ref: o.ref, live: o.live };
@@ -48159,7 +48522,29 @@ function registerDb(program2, rt) {
       if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
     })
   );
-  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (repository admins)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
+  db.command("diff <change>").description("What a change's migrations do: per source, the files it adds, lint findings and the schema effect. Exits 7 when a source would block the change").action(
+    act(rt, async (ctx, _o, [change]) => {
+      const plans = await ctx.client("user").dbMigrations.changePlans(await ctx.changeId(change, "user"));
+      ctx.result(
+        plans,
+        (v) => v.items.length ? v.items.map((p) => {
+          const mine = p.pending.filter((f) => f.introduced_by_change);
+          return [`${p.source_name} (${p.provider === "cloudflare_d1" ? "Cloudflare D1" : `PlanetScale ${p.engine}`} ${p.target_label}): ${p.ok ? "ok" : "blocked"}`, mine.length ? `this change adds: ${mine.map((f) => f.name).join(", ")}` : "this change adds no migrations", ...issueLines(p.issues), ...lintLines(p.lint), ...diffLines(mine.length ? p.schema_diff : null)].join("\n");
+        }).join("\n\n") : "no migration sources follow the change's target branch"
+      );
+      if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("drift <source>").description("The source's last drift check: its database against what the applied migrations produce. --check reads the database now (migrations:manage)").option("--check", "check now").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations;
+      const id2 = await sourceId(ctx, ref);
+      const d = o.check ? await c8.checkDrift(id2) : (await c8.sources.get(id2)).drift;
+      ctx.result(d, renderDrift);
+      if (d?.status === "drift") ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (migrations:manage)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
   db.command("runs").description("Migration runs of --repo, newest first").option("--source <source>", "only this source (name or id)").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const repo = { id: await ctx.repoId(void 0, "user") };
@@ -48168,7 +48553,7 @@ function registerDb(program2, rt) {
     })
   );
   db.command("run <run>").description("One migration run: status, files and issues").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").dbMigrations.runs.get(id2), renderRun)));
-  db.command("apply <source>").description("Apply a source's pending migrations now (repository admins; your request is the approval). Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
+  db.command("apply <source>").description("Apply a source's pending migrations now (migrations:manage). Your request is the approval when you may approve and the source is not protected; otherwise the run waits for approval. Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
     act(rt, async (ctx, o, [ref]) => {
       const id2 = await sourceId(ctx, ref);
       await ctx.confirm(`apply the pending migrations of ${ref}${o.ref ? ` at ${o.ref}` : ""} to its database`);
@@ -48179,24 +48564,26 @@ ${renderPlan2(v.plan)}`);
     })
   );
   const decisions = [
-    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows (repository admins)"],
-    ["reject", "Reject a run waiting for approval; nothing is applied (repository admins)"],
-    ["retry", "Retry a failed run from where it stopped (repository admins)"],
-    ["cancel", "Cancel a run that has not finished (repository admins)"]
+    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows once it has the approvals it needs (migrations:approve; a protected source's approvers)"],
+    ["reject", "Reject a run waiting for approval; nothing is applied (migrations:approve)"],
+    ["retry", "Retry a failed run from where it stopped (migrations:approve)"],
+    ["cancel", "Cancel a run that has not finished (migrations:approve)"]
   ];
   for (const [decision, description] of decisions) {
-    db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.reason), renderRun)));
+    const cmd = db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)");
+    if (decision === "approve") cmd.option("--redeploy", "a run a production deploy waits on: deploy the same commit again, which applies it");
+    cmd.action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.redeploy ? { reason: o.reason, redeploy: true } : o.reason), renderRun)));
   }
 }
 
 // packages/cli/src/commands/deploy.ts
 var TERMINAL4 = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled", "superseded", "blocked"]);
 var NO_DO_PREVIEWS = "previews off: Cloudflare makes no version URLs for Workers that implement a Durable Object (--previews --preview-mode worker_previews uses Worker Previews; it needs a `previews` block in the Wrangler configuration)";
-var renderTargets = (v) => table(
-  v.items.map((t) => ({ ...t, resource: t.resource_name, env: t.environment ?? "-", last_production: t.last_production ? `${t.last_production.status} ${t.last_production.commit_oid.slice(0, 12)}` : "-" })),
+var renderTargets = (v) => listWithCursor(
+  { ...v, items: v.items.map((t) => ({ ...t, resource: t.resource_name, env: t.environment ?? "-", last_production: t.last_production ? `${t.last_production.status} ${t.last_production.commit_oid.slice(0, 12)}` : "-" })) },
   ["name", "id", "platform", "resource", "env", "branch", "runs_on", "previews", "state", "last_production"]
 );
-var renderTarget = (t) => kv({ ...t, watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
+var renderTarget = (t) => kv({ ...t, approvers: ruleSummary(t.approval_rule), watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
   "id",
   "name",
   "platform",
@@ -48214,12 +48601,13 @@ var renderTarget = (t) => kv({ ...t, watch_paths: t.watch_paths?.length ? t.watc
   "watch_paths",
   "previews",
   "preview_check_name",
+  "approvers",
   "last_production",
   "version"
 ]);
 var renderDeployment = (d) => kv({ ...d, change: d.change ? `#${d.change.number}` : "-", logs: d.run?.logs_url ?? "-" }, ["id", "target_name", "kind", "environment", "status", "status_reason", "trigger", "commit_oid", "change", "version_id", "url", "alias_url", "verified", "duration_ms", "logs", "created_at"]) + (d.steps.length ? `
 
-${table(d.steps, ["name", "phase", "status", "summary"])}` : "");
+${table(d.steps, ["name", "phase", "status", "summary"])}` : "") + approvalLines(d.approval);
 var renderDeployments = (v) => listWithCursor({ ...v, items: v.items.map((d) => ({ ...d, commit: d.commit_oid.slice(0, 12), change: d.change ? `#${d.change.number}` : "-" })) }, ["id", "target_name", "kind", "status", "commit", "change", "trigger", "created_at"]);
 async function pick3(ctx, what, flag, options, label2) {
   if (options.length === 1) return options[0];
@@ -48235,10 +48623,12 @@ ${lines2}
 }
 async function targetId(ctx, ref) {
   if (ref.startsWith("dpt_")) return ref;
-  const { items } = await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user"));
-  const t = items.find((x) => x.name === ref);
-  if (!t) throw new CliError(`no deploy target named "${ref}" (have: ${items.map((x) => x.name).join(", ") || "none"})`, EXIT.NOT_FOUND, "NOT_FOUND");
-  return t.id;
+  const client = ctx.client("user");
+  const repo = await ctx.repoId(void 0, "user");
+  const t = (await client.deploy.targets.list(repo, { name: ref })).items.find((x) => x.name === ref);
+  if (t) return t.id;
+  const { items, next_cursor } = await client.deploy.targets.list(repo, { limit: 20 });
+  throw new CliError(`no deploy target named "${ref}" (have: ${items.map((x) => x.name).join(", ") || "none"}${next_cursor ? ", \u2026" : ""})`, EXIT.NOT_FOUND, "NOT_FOUND");
 }
 var orNull = (v) => v === void 0 ? void 0 : v || null;
 async function stepsOf(ctx, spec) {
@@ -48355,7 +48745,23 @@ function registerDeploy(program2, rt) {
 Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}`);
     })
   );
-  deploy.command("targets").description("Deploy targets of --repo").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user")), renderTargets)));
+  const targets2 = deploy.command("targets").description("Deploy targets of --repo; `protect` requires approvers for a target's production deploys").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(act(rt, async (ctx, o) => ctx.result(await ctx.client("user").deploy.targets.list(await ctx.repoId(void 0, "user"), { limit: o.limit, cursor: o.cursor }), renderTargets)));
+  protectOptions(targets2.command("protect <target>").description("Require approvals for the target's production deploys and rollbacks (people with deploy:manage). Replaces the current rule")).action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").deploy.targets;
+      const t = await c8.get(await targetId(ctx, ref));
+      ctx.result(await c8.protect(t.id, protectBody(o, t.approval_rule)), renderRule);
+    })
+  );
+  targets2.command("unprotect <target>").description("Remove the target's approval rule; deploys waiting for it go on. Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await targetId(ctx, ref);
+      await ctx.confirm(`remove the approval rule of ${ref}: its production deploys will no longer wait for approval`);
+      await ctx.client("user").deploy.targets.unprotect(id2);
+      ctx.result({ unprotected: id2 }, `${ref} is no longer protected`);
+    })
+  );
+  targets2.command("approvers <target>").description("Who may approve the target's production deploys now").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.approvers(await targetId(ctx, ref)), renderApprovers)));
   deploy.command("target <target>").description("One deploy target (id, or name in --repo)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").deploy.targets.get(await targetId(ctx, ref)), renderTarget)));
   targetOptions(deploy.command("update <target>").description("Change a deploy target (only the given flags; an empty value clears a command or the environment)")).option("--disable", "stop deploying (merges no longer deploy)").option("--enable", "deploy again").action(
     act(rt, async (ctx, o, [ref]) => {
@@ -48414,6 +48820,8 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
   );
   deploy.command("show <deployment>").description("One deployment with its steps").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.get(id2), renderDeployment)));
   deploy.command("cancel <deployment>").description("Cancel a queued or running deployment").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.cancel(id2), renderDeployment)));
+  deploy.command("approve <deployment>").description("Approve a deploy of a protected target (people who may approve; the last approval needed starts it)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.approve(id2), renderDeployment)));
+  deploy.command("reject <deployment>").description("Reject a deploy waiting for approval; it is cancelled").option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").deploy.deployments.reject(id2, o.reason), renderDeployment)));
   deploy.command("rollback <target>").description("Send all traffic back to the version of an earlier verified production deployment").requiredOption("--to <deployment>", "the deployment to roll back to (dpl_\u2026)").option("--message <text>", "deployment message").action(
     act(rt, async (ctx, o, [ref]) => {
       const id2 = await targetId(ctx, ref);
@@ -48426,7 +48834,6 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
 // packages/cli/src/commands/delegation.ts
 var ITERATION_DONE = /* @__PURE__ */ new Set(["succeeded", "no_changes", "failed", "cancelled"]);
 var STATES = ["working", "waiting", "stopped"];
-var who2 = (a) => a.display_name ?? `${a.type} ${a.id}`;
 var short2 = (oid) => oid ? oid.slice(0, 12) : null;
 function vendorArg(v) {
   if (!CODING_AGENT_VENDORS.includes(v)) throw usage(`unknown agent "${v}"; one of ${CODING_AGENT_VENDORS.join(", ")}`);
@@ -48446,7 +48853,7 @@ function renderIterations(d) {
   const rows2 = d.iterations.map((i) => ({
     ...i,
     trigger: i.trigger_ref ? `${i.trigger} (${i.trigger_ref})` : i.trigger,
-    by: who2(i.trigger_actor),
+    by: actorLabel(i.trigger_actor),
     head: short2(i.head_oid)
   }));
   const claims = d.iterations.map(reported).filter((x) => !!x);
@@ -48468,7 +48875,7 @@ var renderDelegation = (d) => kv(
     ...d,
     agent: `${d.agent.name} (${d.agent.vendor})`,
     status: delegationStatusLabel(d),
-    sponsor: who2(d.sponsor),
+    sponsor: actorLabel(d.sponsor),
     branch: `${d.source_ref} \u2192 ${d.target_ref}`,
     automatic: `on review ${d.auto_on_review ? "on" : "off"}, on check failure ${d.auto_on_check_failure ? "on" : "off"}`,
     budget: `iterations ${d.usage.iterations_used}/${d.budget.max_iterations}, tokens ${d.usage.tokens_used}/${d.budget.max_tokens}, ${d.budget.iteration_minutes} min per iteration`
@@ -49029,15 +49436,78 @@ function authGuidance(cli, helperConfigured) {
 }
 
 // packages/cli/src/commands/repo.ts
-var REPO_FIELDS = ["id", "org_slug", "name", "description", "visibility", "default_branch", "lifecycle", "clone_url", "updated_at"];
+var REPO_FIELDS = ["id", "org_slug", "name", "description", "visibility", "default_branch", "lifecycle", "clone_url", "actions_enabled", "updated_at"];
 var renderRepo2 = (r) => kv(r, REPO_FIELDS) + (r.import ? `
 import    ${r.import.status}${r.import.shallow ? " (shallow)" : ""}` : "");
 function renderLog(p) {
   const rows2 = p.items.map((c8) => ({ oid: c8.oid.slice(0, 12), date: c8.committer.date.slice(0, 10), author: c8.author.name, subject: c8.message.split("\n", 1)[0] }));
   const lines2 = [table(rows2, ["oid", "date", "author", "subject"])];
   const s = p.path_scan;
+  const l = p.log_scan;
   if (s) lines2.push(s.complete ? `scanned ${s.scanned_total} commits: full first-parent history of ${s.path}` : `scanned ${s.scanned_total} commits so far; older history not searched yet (more: --cursor ${p.next_cursor})`);
-  else if (p.next_cursor) lines2.push(`(more: --cursor ${p.next_cursor})`);
+  else if (l) {
+    if (l.complete) lines2.push(`scanned ${l.scanned_total} commits: all matching history searched`);
+    else if (l.exhausted) lines2.push(`scanned ${l.scanned_total} commits, the most one search walks; older history not searched`);
+    else lines2.push(`scanned ${l.scanned_total} commits so far; older history not searched yet (more: --cursor ${p.next_cursor})`);
+  } else if (p.next_cursor) lines2.push(`(more: --cursor ${p.next_cursor})`);
+  return lines2.join("\n");
+}
+function renderCommitChange(r) {
+  const lines2 = r.landings.map((l) => {
+    const how2 = l.role === "landing" ? `${l.strategy} commit of` : `brought in by ${l.strategy} of`;
+    const receipt = l.receipt_id ? `, receipt ${l.receipt_id}` : "";
+    return `${l.target_ref.replace(/^refs\/heads\//, "")}: ${how2} #${l.change.number} ${l.change.title} (${l.change.state}; landing ${l.landing_oid.slice(0, 12)}${receipt})`;
+  });
+  if (!lines2.length) lines2.push(r.indexing ? "no change on record yet: earlier landings are still being indexed, ask again shortly" : "no change brought this commit (pushed straight to a branch, or older than the repository on Brnch)");
+  else if (r.indexing) lines2.push("(earlier landings are still being indexed)");
+  return lines2.join("\n");
+}
+var renderTree = (t) => [`${t.path || "/"} at ${t.commit_oid.slice(0, 12)}`, table(t.entries.map((e) => ({ ...e, name: e.type === "tree" ? `${e.name}/` : e.name })), ["mode", "type", "name"])].join("\n");
+function renderBlob(b) {
+  if (b.binary) return `(binary file, ${b.size} bytes; ${BRAND.cli} --json repo blob for its id)`;
+  if (b.truncated || b.encoding !== "utf8") return `(${b.size} bytes, too large to show inline: clone, or download ${b.path} at ${b.commit_oid.slice(0, 12)})`;
+  return b.content;
+}
+function renderBlame(b) {
+  const rows2 = b.lines.map((l) => ({ line: l.line, oid: l.commit_oid.slice(0, 12), date: l.date.slice(0, 10), author: l.author, summary: l.summary }));
+  const lines2 = [table(rows2, ["line", "oid", "date", "author", "summary"])];
+  if (b.partial) lines2.push("partial: the walk ran out of time, older lines may belong to newer commits; the full blame is being computed, ask again shortly");
+  else if (b.truncated) lines2.push("history not walked to the end: unresolved lines are attributed to the oldest commit examined");
+  return lines2.join("\n");
+}
+function renderSearch(r) {
+  const rows2 = r.items.map((i) => ({ kind: i.kind, where: i.path ?? i.title, snippet: i.snippet.replace(/\s+/g, " ").slice(0, 100) }));
+  const lines2 = [table(rows2, ["kind", "where", "snippet"])];
+  const ref = r.index.ref;
+  if (ref) {
+    lines2.push(
+      ref.complete ? `code as of ${ref.name} (${ref.commit_oid.slice(0, 12)}): the index plus the ${ref.searched_files} files it changed` : `incomplete: ${ref.name} changed ${ref.changed_files}${ref.changed_files >= 500 ? "+" : ""} files and ${ref.searched_files} were searched; a missing hit is not proof of absence`
+    );
+  } else if (r.index.commit_oid && !r.index.fresh) lines2.push(`code index is behind the default branch (indexed ${r.index.commit_oid.slice(0, 12)}); catching up`);
+  else if (!r.index.commit_oid && r.index.indexed_at === null) lines2.push("code index not built yet; catching up");
+  if (r.index.truncated) lines2.push("the code index stopped at its size bounds: some files are not searchable");
+  return lines2.join("\n");
+}
+function renderCompare(c8) {
+  const rows2 = c8.files.map((f) => ({ status: f.status, path: f.status === "renamed" ? `${f.old_path} \u2192 ${f.new_path}` : f.new_path ?? f.old_path }));
+  const head = c8.mode === "two-dot" ? `${c8.base_oid.slice(0, 12)}..${c8.head_oid.slice(0, 12)} (trees)` : `${c8.base_oid.slice(0, 12)}...${c8.head_oid.slice(0, 12)} (since merge base ${c8.merge_base_oid?.slice(0, 12) ?? "none: unrelated histories"})`;
+  return [head, table(rows2, ["status", "path"]), ...c8.truncated ? ["(more files changed than listed)"] : []].join("\n");
+}
+function renderRange(r) {
+  const rows2 = r.commits.map((c8) => ({ oid: c8.oid.slice(0, 12), date: c8.committer.date.slice(0, 10), author: c8.author.name, subject: c8.message.split("\n", 1)[0] }));
+  const count = (n) => n === null ? "unknown" : String(n);
+  return [
+    `ahead ${count(r.ahead_by)}, behind ${count(r.behind_by)}`,
+    table(rows2, ["oid", "date", "author", "subject"]),
+    ...r.truncated ? ["(more commits than listed: --limit up to 250)"] : [],
+    ...r.complete ? [] : ["incomplete: the bounded history walk did not finish; counts and the list may be short"]
+  ].join("\n");
+}
+var renderMergeBase = (m) => m.merge_bases.length ? m.merge_bases.join("\n") : m.complete ? "(none: unrelated histories)" : "unknown: the bounded history walk did not finish";
+var renderAncestry = (a) => a.is_ancestor === null ? "unknown: the bounded history walk could not decide (not a no)" : `${a.is_ancestor ? "yes" : "no"}: ${a.ancestor_oid.slice(0, 12)} is ${a.is_ancestor ? "" : "not "}in the history of ${a.descendant_oid.slice(0, 12)}`;
+function renderContaining(r) {
+  const lines2 = r.refs.length ? [...r.refs] : [r.complete ? "(no branch or tag contains it)" : "(none found so far)"];
+  if (r.unknown.length) lines2.push(`not settled (may contain it): ${r.unknown.join(", ")}`);
   return lines2.join("\n");
 }
 function registerOrg(program2, rt) {
@@ -49048,6 +49518,14 @@ function registerOrg(program2, rt) {
       ctx.result(created, (v) => kv(v, ["id", "slug", "name", "created_at"]));
     })
   );
+  org.command("edit [org]").description("Change an organization's settings (organization admins)").option("--actions <on|off>", "turn Actions on or off for every repository of the organization: off starts no runs from pushes, changes or schedules and refuses workflow_dispatch; runs already started go on. A repository can also turn it off for itself (repo edit --actions)").action(
+    act(rt, async (ctx, o, [spec]) => {
+      if (o.actions === void 0) throw usage("nothing to change: pass --actions on|off");
+      if (o.actions !== "on" && o.actions !== "off") throw usage("--actions must be on or off");
+      const updated = await ctx.client("user").orgs.update(spec ?? ctx.org(), { actions_enabled: o.actions === "on" });
+      ctx.result(updated, (v) => kv({ ...v, actions: v.settings.actions_enabled === false ? "off" : "on" }, ["id", "slug", "name", "actions"]));
+    })
+  );
   org.command("list").description("Your personal account and the organizations you belong to").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
     act(rt, async (ctx, o) => {
       const page = await ctx.client("user").orgs.list({ limit: o.limit, cursor: o.cursor });
@@ -49150,7 +49628,18 @@ function registerRepo(program2, rt) {
         await new Promise((r) => setTimeout(r, 2e3));
         job2 = await c8.migrations.get(job2.id);
       }
-      const view = { id: job2.id, state: job2.state, issues: job2.report.counts.issues, pull_requests: job2.report.counts.pull_requests, comments: job2.report.counts.comments, releases: job2.report.counts.releases, missing: job2.report.missing.join("; ") || "-" };
+      const deps = job2.report.dependencies;
+      const view = {
+        id: job2.id,
+        state: job2.state,
+        issues: job2.report.counts.issues,
+        pull_requests: job2.report.counts.pull_requests,
+        comments: job2.report.counts.comments,
+        releases: job2.report.counts.releases,
+        ...deps ? { blocked_by_links: `${deps.imported} imported${deps.skipped ? `, ${deps.skipped} skipped` : ""}` } : {},
+        missing: job2.report.missing.join("; ") || "-",
+        warnings: job2.report.warnings.join("; ") || "-"
+      };
       ctx.result(job2, () => kv(view, Object.keys(view)));
       if (o.wait && job2.state !== "completed") throw new CliError(`migration ${job2.state}: ${job2.error ?? job2.report.missing.join("; ")}`, EXIT.NOT_READY);
     })
@@ -49166,13 +49655,93 @@ function registerRepo(program2, rt) {
       ctx.result(await ctx.client("agent").repos.get(await ctx.repoId(spec)), renderRepo2);
     })
   );
-  repo.command("log [repo]").description("First-parent commit history of a ref; with --path, only commits that changed that file or directory (no rename detection)").option("--ref <ref>", "branch, tag or commit (default branch when omitted)").option("--path <path>", "repository-relative file or directory").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--scan-limit <n>", "with --path: commits examined per page (server default 200, max 500)", (v) => parseIntOption(v, "--scan-limit")).option("--cursor <cursor>", "page cursor (resumes a --path walk where it stopped)").action(
+  repo.command("edit [repo]").description("Change a repository's settings (repository admins)").option("--actions <on|off>", "turn Actions on or off: off starts no runs from pushes, changes or schedules and refuses workflow_dispatch; runs already started go on").action(
     act(rt, async (ctx, o, [spec]) => {
-      if (o.scanLimit !== void 0 && o.path === void 0) throw usage("--scan-limit requires --path");
-      const page = await ctx.client("agent").repos.commits(await ctx.repoId(spec), { ref: o.ref, path: o.path, limit: o.limit, cursor: o.cursor, scan_limit: o.scanLimit });
+      if (o.actions === void 0) throw usage("nothing to change: pass --actions on|off");
+      if (o.actions !== "on" && o.actions !== "off") throw usage("--actions must be on or off");
+      const c8 = ctx.client("user");
+      const id2 = await ctx.repoId(spec);
+      const current = await c8.repos.get(id2);
+      ctx.result(await c8.repos.update(id2, { actions_enabled: o.actions === "on", version: current.version }), renderRepo2);
+    })
+  );
+  repo.command("log [repo]").description("First-parent commit history of a ref; with --path, only commits that changed that file or directory (no rename detection); filter like git log with --author, --grep, --since, --until (substring matches) and --all-parents (with --path: git log --full-history)").option("--ref <ref>", "branch, tag or commit (default branch when omitted)").option("--path <path>", "repository-relative file or directory").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--scan-limit <n>", "with --path or a filter: commits examined per page (server default 200, 50 with --all-parents; max 500)", (v) => parseIntOption(v, "--scan-limit")).option("--author <text>", "author name or email contains this (case-insensitive)").option("--grep <text>", "commit message contains this (case-insensitive; not a regular expression)").option("--since <date>", "committed at or after this date (ISO-8601)").option("--until <date>", "committed at or before this date (ISO-8601)").option("--all-parents", "walk merged branches too, not just the first-parent line").option("--cursor <cursor>", "page cursor (resumes a --path walk where it stopped)").action(
+    act(rt, async (ctx, o, [spec]) => {
+      const filtered = o.author !== void 0 || o.grep !== void 0 || o.since !== void 0 || o.until !== void 0 || !!o.allParents;
+      if (o.scanLimit !== void 0 && o.path === void 0 && !filtered) throw usage("--scan-limit requires --path or a filter");
+      const page = await ctx.client("agent").repos.commits(await ctx.repoId(spec), {
+        ref: o.ref,
+        path: o.path,
+        limit: o.limit,
+        cursor: o.cursor,
+        scan_limit: o.scanLimit,
+        author: o.author,
+        grep: o.grep,
+        since: o.since,
+        until: o.until,
+        all_parents: o.allParents || void 0
+      });
       ctx.result(page, renderLog);
     })
   );
+  repo.command("tree [repo]").description("List a directory of a ref without a clone").option("--ref <ref>", "branch, tag or commit (default branch when omitted)").option("--path <path>", "repository-relative directory (root when omitted)").action(
+    act(rt, async (ctx, o, [spec]) => {
+      ctx.result(await ctx.client("agent").repos.tree(await ctx.repoId(spec), { ref: o.ref, path: o.path }), renderTree);
+    })
+  );
+  repo.command("blob <path> [repo]").description("Print a file of a ref without a clone (binary and very large files are described, not printed)").option("--ref <ref>", "branch, tag or commit (default branch when omitted)").action(
+    act(rt, async (ctx, o, [path3, spec]) => {
+      ctx.result(await ctx.client("agent").repos.blob(await ctx.repoId(spec), { ref: o.ref, path: path3 }), renderBlob);
+    })
+  );
+  repo.command("blame <path> [repo]").description("Who last changed each line of a file, without a clone").option("--ref <ref>", "branch, tag or commit (default branch when omitted)").action(
+    act(rt, async (ctx, o, [path3, spec]) => {
+      ctx.result(await ctx.client("agent").repos.blame(await ctx.repoId(spec), { ref: o.ref, path: path3 }), renderBlame);
+    })
+  );
+  repo.command("search <query> [repo]").description("Search code, tasks, changes and comments; with --ref, code as of that branch, tag or commit (says when a ref was searched incompletely)").option("--kind <kind>", "code, task, change or comment").option("--ref <ref>", "search code as of this branch, tag or commit instead of the default branch").action(
+    act(rt, async (ctx, o, [q, spec]) => {
+      if (o.kind !== void 0 && !["code", "task", "change", "comment"].includes(o.kind)) throw usage("--kind must be code, task, change or comment");
+      if (o.ref !== void 0 && o.kind !== void 0 && o.kind !== "code") throw usage("--ref searches code only");
+      ctx.result(await ctx.client("agent").repos.search(await ctx.repoId(spec), { q, kind: o.kind, ref: o.ref }), renderSearch);
+    })
+  );
+  repo.command("compare <base> <head> [repo]").description("Files head changed since its merge base with base (git diff base...head); --two-dot compares the trees; --commits lists the commits in base..head with ahead/behind counts").option("--two-dot", "diff base's tree against head's tree (git diff base head)").option("--commits", "list the commits in base..head instead of the files").option("--limit <n>", "with --commits: commits listed (default 100, max 250)", (v) => parseIntOption(v, "--limit")).action(
+    act(rt, async (ctx, o, [base2, head, spec]) => {
+      if (o.commits && o.twoDot) throw usage("--commits cannot be combined with --two-dot");
+      if (o.limit !== void 0 && !o.commits) throw usage("--limit requires --commits");
+      const c8 = ctx.client("agent");
+      const id2 = await ctx.repoId(spec);
+      if (o.commits) return ctx.result(await c8.repos.compareCommits(id2, { base: base2, head, limit: o.limit }), renderRange);
+      ctx.result(await c8.repos.compare(id2, { base: base2, head, mode: o.twoDot ? "two-dot" : void 0 }), renderCompare);
+    })
+  );
+  repo.command("merge-base <base> <head> [repo]").description("Every best common ancestor of two branches, tags or commits (git merge-base --all), without a clone").action(
+    act(rt, async (ctx, _o, [base2, head, spec]) => {
+      ctx.result(await ctx.client("agent").repos.mergeBase(await ctx.repoId(spec), { base: base2, head }), renderMergeBase);
+    })
+  );
+  repo.command("is-ancestor <ancestor> <descendant> [repo]").description("Whether a commit is in another's history (git merge-base --is-ancestor): yes, no, or unknown when the bounded walk cannot decide").action(
+    act(rt, async (ctx, _o, [ancestor, descendant, spec]) => {
+      ctx.result(await ctx.client("agent").repos.isAncestor(await ctx.repoId(spec), { ancestor, descendant }), renderAncestry);
+    })
+  );
+  repo.command("contains <commit> [repo]").description("Branches and tags whose history contains a commit (git for-each-ref --contains), without a clone").action(
+    act(rt, async (ctx, _o, [commit, spec]) => {
+      ctx.result(await ctx.client("agent").repos.refsContaining(await ctx.repoId(spec), commit), renderContaining);
+    })
+  );
+  repo.command("commit-change <commit> [repo]").description("The change that brought a commit onto each branch it landed on, from Brnch's record of the landing (every merge strategy); ask this instead of searching git log").action(
+    act(rt, async (ctx, _o, [commit, spec]) => {
+      let oid = /^[0-9a-f]{40}$/.test(commit) ? commit : null;
+      if (!oid) {
+        const r = await ctx.deps.gitOutput(["rev-parse", "--verify", "--quiet", `${commit}^{commit}`], ctx.deps.cwd);
+        if (r.code !== 0) throw usage("pass a full 40-character commit id; short ids and revisions like HEAD resolve only inside a clone");
+        oid = r.stdout.trim();
+      }
+      ctx.result(await ctx.client("agent").repos.commitChange(await ctx.repoId(spec), oid), renderCommitChange);
+    })
+  );
   repo.command("clone [repo] [directory]").description("git clone over SSH when this machine is set up for it (`ssh setup`) and the key can be used now, else HTTPS with your login (never written to .git/config); at a terminal without a repository, pick one of yours").option("--ssh", "clone over SSH").option("--https", "clone over HTTPS").action(
     act(rt, async (ctx, o, [spec, dir]) => {
       if (o.ssh && o.https) throw usage("--ssh and --https are mutually exclusive");
@@ -49183,24 +49752,39 @@ function registerRepo(program2, rt) {
       if (t.transport === "ssh") {
         if (!t.ssh.ready) throw usage(`this machine is not set up for SSH${t.ssh.alias ? ` to ${t.ssh.alias}` : ""} yet: run \`${BRAND.cli} ssh setup\`, or clone with --https`);
         const url2 = sshCloneUrl(t.ssh.alias, r.org_slug, r.name);
-        const code2 = await ctx.deps.spawnGit(["clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
+        const code2 = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", "--", url2, directory], { env: { ...ctx.deps.env, GIT_TERMINAL_PROMPT: "0" }, cwd: ctx.deps.cwd, stdoutToStderr: true });
         if (code2 !== 0) throw new CliError(`git clone over SSH exited with status ${code2}; \`${BRAND.cli} ssh test\` explains SSH problems, --https clones without SSH`, EXIT.UNEXPECTED, "GIT_FAILED");
         return ctx.result({ repository: r, directory, transport: "ssh", transport_reason: t.reason, clone_url: url2 }, cloned(r, directory, `over SSH (${url2})`, paint(colorEnabled(ctx.deps, "stdout"))));
       }
       if (t.approval) ctx.info(`Cloning over HTTPS: ${t.reason}. Pass --ssh to use SSH anyway.`);
       const token = await ctx.freshToken("agent");
-      const code = await ctx.deps.spawnGit(["clone", "--", r.clone_url, directory], {
+      const helper2 = await credentialHelperConfigured(ctx);
+      const list3 = helper2 && await gitAtLeast(ctx, "2.40.0") && await bundlesOffered(ctx, r.clone_url, token) ? [`--bundle-uri=${r.clone_url}/bundles`] : [];
+      const code = await ctx.deps.spawnGit([...SNAPSHOT_CLONE, "clone", ...list3, "--", r.clone_url, directory], {
         env: gitAuthEnv(ctx.deps.env, token, r.clone_url),
         cwd: ctx.deps.cwd,
         stdoutToStderr: true
       });
       if (code !== 0) throw new CliError(`git clone exited with status ${code}`, EXIT.UNEXPECTED, "GIT_FAILED");
-      const helper2 = await credentialHelperConfigured(ctx);
       ctx.info(authGuidance(BRAND.cli, helper2));
       ctx.result({ repository: r, directory, transport: "https", transport_reason: t.reason, clone_url: r.clone_url, credential_helper: helper2 }, cloned(r, directory, "over HTTPS", paint(colorEnabled(ctx.deps, "stdout"))));
     })
   );
 }
+var SNAPSHOT_CLONE = ["-c", "transfer.bundleURI=true"];
+async function bundlesOffered(ctx, cloneUrl, token) {
+  try {
+    const res = await ctx.deps.sys.fetch(`${cloneUrl}/bundles`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(5e3) });
+    return res.ok && (await res.text()).includes('[bundle "');
+  } catch {
+    return false;
+  }
+}
+async function gitAtLeast(ctx, min) {
+  const r = await ctx.deps.sys.run("git", ["--version"], { timeoutMs: 1e4 }).catch(() => null);
+  const version4 = r?.code === 0 ? /git version (\d+\.\d+\.\d+)/.exec(r.stdout)?.[1] : void 0;
+  return !!version4 && compareVersions(version4, min) >= 0;
+}
 var hasRepo = (ctx) => {
   try {
     ctx.repoSpec();
@@ -49268,7 +49852,7 @@ function registerGit(program2, rt) {
 }
 
 // packages/cli/src/commands/release.ts
-var renderRelease = (r) => kv({ ...r, author: r.author.display_name ?? r.author.id }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
+var renderRelease = (r) => kv({ ...r, author: actorLabel(r.author) }, ["id", "tag", "name", "commit_oid", "draft", "author", "created_at", "notes"]);
 function registerRelease(program2, rt) {
   const release = program2.command("release").description("Releases of --repo (a tag with notes)");
   release.command("list").description("Releases, newest first").action(
@@ -49711,7 +50295,7 @@ var renderRangeDiff = (r) => {
   if (r.truncated) lines2.push("(truncated)");
   return lines2.join("\n");
 };
-var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${o.actor.display_name ?? o.actor.id}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
+var renderOperation = (o) => `${o.id}  ${o.created_at}  ${o.operation}/${o.kind}  ${o.ref}  ${o.old_oid.slice(0, 12)} \u2192 ${o.new_oid.slice(0, 12)}  by ${actorLabel(o.actor)}${o.protected ? "  [protected]" : ""}${o.undone_by ? `  (undone by ${o.undone_by})` : ""}`;
 async function waitForPromotion(ctx, p, timeout, interval) {
   const deadline = Date.now() + timeout * 1e3;
   let last = p.state;
@@ -49788,7 +50372,7 @@ next: --cursor ${v.next_cursor}` : "") : listWithCursor(v, ["id"]));
 }
 
 // packages/cli/src/commands/coordination.ts
-var holderOf = (c8) => `${c8.holder.display_name ?? c8.holder.id}${c8.session_id ? ` (${c8.session_id})` : ""}`;
+var holderOf = (c8) => `${actorLabel(c8.holder)}${c8.session_id ? ` (${c8.session_id})` : ""}`;
 var renderClaim = (r) => [
   `${r.already_held ? "Already yours" : "Claimed"}: ${r.claim.key}${r.claim.change ? ` (change #${r.claim.change.number})` : ""}`,
   ...r.skipped.length ? [`Taken by others: ${r.skipped.join(", ")}`] : [],
@@ -52091,7 +52675,7 @@ function safeLegs(m) {
 }
 
 // packages/cli/src/commands/actions.ts
-var renderRun2 = (r) => kv({ ...r, actor: r.actor.display_name ?? r.actor.id, trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
+var renderRun2 = (r) => kv({ ...r, actor: actorLabel(r.actor), trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
   "id",
   "workflow_name",
   "run_number",