contract-driven-delivery 2.0.9 → 2.0.11

package/dist/cli/index.js

@@ -376,24 +376,44 @@ var init_update = __esm({
   }
 });
 
-// src/commands/context-scan.ts
-var context_scan_exports = {};
-__export(context_scan_exports, {
-  contextScan: () => contextScan
-});
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
+// src/utils/digest.ts
+import { readFileSync as readFileSync6 } from "fs";
 import { createHash as createHash2 } from "crypto";
-import { basename, dirname as dirname3, join as join8, relative as relative2 } from "path";
-function sha256OfFile(path) {
+function normalizeContentForHash(buf) {
+  if (!buf.includes(13))
+    return buf;
+  const text = buf.toString("utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  return Buffer.from(text, "utf8");
+}
+function sha256OfFileNormalized(path) {
+  let buf;
   try {
-    return createHash2("sha256").update(readFileSync6(path)).digest("hex");
+    buf = readFileSync6(path);
   } catch {
     return "";
   }
+  return createHash2("sha256").update(normalizeContentForHash(buf)).digest("hex");
 }
-function inputsDigest(paths) {
-  const combined = paths.slice().sort().map((p) => `${p}:${sha256OfFile(p)}`).join("\n");
-  return createHash2("sha256").update(combined).digest("hex");
+var init_digest = __esm({
+  "src/utils/digest.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/context-scan.ts
+var context_scan_exports = {};
+__export(context_scan_exports, {
+  contextScan: () => contextScan
+});
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { basename, dirname as dirname3, join as join8, relative as relative2 } from "path";
+function inputsDigest(paths, cwd) {
+  const combined = paths.slice().sort().map((p) => {
+    const rel = relative2(cwd, p).replace(/\\/g, "/");
+    return `${rel}:${sha256OfFileNormalized(p)}`;
+  }).join("\n");
+  return createHash3("sha256").update(combined).digest("hex");
 }
 function stripGlobSuffix(pattern) {
   return pattern.replace(/\/\*\*$/, "").replace(/\/\*$/, "");
@@ -403,7 +423,7 @@ function getForbiddenPaths(cwd) {
   const policyPath = join8(cwd, ".cdd", "context-policy.json");
   try {
     if (existsSync7(policyPath)) {
-      const policy = JSON.parse(readFileSync6(policyPath, "utf8"));
+      const policy = JSON.parse(readFileSync7(policyPath, "utf8"));
       for (const pattern of policy.forbiddenPaths ?? []) {
         forbidden.add(stripGlobSuffix(pattern));
       }
@@ -549,7 +569,7 @@ async function contextScan(opts = {}) {
       `visible-files: ${treeStats.files}`,
       `omitted-dirs: ${treeStats.omittedDirs}`,
       `truncated-dirs: ${treeStats.truncatedDirs}`,
-      `inputs-digest: ${inputsDigest(projectMapInputs)}`,
+      `inputs-digest: ${inputsDigest(projectMapInputs, cwd)}`,
       "---",
       "",
       "# Project Map",
@@ -577,7 +597,7 @@ async function contextScan(opts = {}) {
   for (const file of contractFiles) {
     const relPath = relative2(cwd, file).replace(/\\/g, "/");
     const dir = dirname3(relPath).replace(/\\/g, "/");
-    const { title, summary, metadata } = parseContractMetadata(readFileSync6(file, "utf8"));
+    const { title, summary, metadata } = parseContractMetadata(readFileSync7(file, "utf8"));
     const contractType = deriveContractType(relPath, metadata);
     const owner = metadata.owner ?? "unknown";
     const surface2 = metadata.surface ?? dir;
@@ -615,7 +635,7 @@ async function contextScan(opts = {}) {
     "schema-version: 1",
     `contract-count: ${contractFiles.length}`,
     `missing-summary-count: ${missingSummary}`,
-    `inputs-digest: ${inputsDigest(contractFiles)}`,
+    `inputs-digest: ${inputsDigest(contractFiles, cwd)}`,
     "---",
     "",
     "# Contracts Index",
@@ -644,6 +664,7 @@ var init_context_scan = __esm({
   "src/commands/context-scan.ts"() {
     "use strict";
     init_logger();
+    init_digest();
     DEFAULT_FORBIDDEN = [
       ".claude",
       ".git",
@@ -661,9 +682,13 @@ var init_context_scan = __esm({
       ".cdd/runtime"
     ];
     FORBIDDEN_DIRECTORY_NAMES = /* @__PURE__ */ new Set([
-      // Node — also caught by top-level prefix, but a nested
-      // `frontend/node_modules` requires basename matching
+      // Node / generic build outputs — also in DEFAULT_FORBIDDEN at top level,
+      // but nested cases like `frontend/dist`, `apps/foo/build`, `packages/x/out`
+      // require basename matching.
       "node_modules",
+      "dist",
+      "build",
+      "out",
       // Python
       "__pycache__",
       ".pytest_cache",
@@ -4263,49 +4288,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative6, options, skipNormalization) {
+    function resolveComponent(base, relative9, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative6 = parse3(serialize(relative6, options), options);
+        relative9 = parse3(serialize(relative9, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative6.scheme) {
-        target.scheme = relative6.scheme;
-        target.userinfo = relative6.userinfo;
-        target.host = relative6.host;
-        target.port = relative6.port;
-        target.path = removeDotSegments(relative6.path || "");
-        target.query = relative6.query;
+      if (!options.tolerant && relative9.scheme) {
+        target.scheme = relative9.scheme;
+        target.userinfo = relative9.userinfo;
+        target.host = relative9.host;
+        target.port = relative9.port;
+        target.path = removeDotSegments(relative9.path || "");
+        target.query = relative9.query;
       } else {
-        if (relative6.userinfo !== void 0 || relative6.host !== void 0 || relative6.port !== void 0) {
-          target.userinfo = relative6.userinfo;
-          target.host = relative6.host;
-          target.port = relative6.port;
-          target.path = removeDotSegments(relative6.path || "");
-          target.query = relative6.query;
+        if (relative9.userinfo !== void 0 || relative9.host !== void 0 || relative9.port !== void 0) {
+          target.userinfo = relative9.userinfo;
+          target.host = relative9.host;
+          target.port = relative9.port;
+          target.path = removeDotSegments(relative9.path || "");
+          target.query = relative9.query;
         } else {
-          if (!relative6.path) {
+          if (!relative9.path) {
             target.path = base.path;
-            if (relative6.query !== void 0) {
-              target.query = relative6.query;
+            if (relative9.query !== void 0) {
+              target.query = relative9.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative6.path[0] === "/") {
-              target.path = removeDotSegments(relative6.path);
+            if (relative9.path[0] === "/") {
+              target.path = removeDotSegments(relative9.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative6.path;
+                target.path = "/" + relative9.path;
               } else if (!base.path) {
-                target.path = relative6.path;
+                target.path = relative9.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative6.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative9.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative6.query;
+            target.query = relative9.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -4313,7 +4338,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative6.fragment;
+      target.fragment = relative9.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -7475,7 +7500,7 @@ var require_dist = __commonJS({
 });
 
 // src/code-map/config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 import { join as join11 } from "path";
 import { load as yamlLoad } from "js-yaml";
 function asStringArray(value, key, where) {
@@ -7502,7 +7527,7 @@ function loadCodeMapConfig(cwd) {
   }
   let text;
   try {
-    text = readFileSync8(filePath, "utf8");
+    text = readFileSync9(filePath, "utf8");
   } catch (err) {
     throw new Error(`failed to read ${CONFIG_REL_PATH}: ${err.message}`);
   }
@@ -7625,1569 +7650,1605 @@ var init_include_exclude = __esm({
   }
 });
 
-// src/code-map/freshness.ts
-var freshness_exports = {};
-__export(freshness_exports, {
-  checkCodeMapFreshness: () => checkCodeMapFreshness
-});
-import { existsSync as existsSync11, statSync as statSync3 } from "fs";
-import { join as join13 } from "path";
-function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclude) {
-  const mapPath = join13(cwd, mapRel);
-  let cfg;
-  try {
-    cfg = loadCodeMapConfig(cwd);
-  } catch (err) {
-    return {
-      status: "config-error",
-      staleFiles: [],
-      staleCount: 0,
-      mapPath,
-      configError: err.message
-    };
+// src/code-map/yaml-writer.ts
+function quoteScalar(s) {
+  if (s.startsWith(".") || YAML_RESERVED.test(s) || s.includes(" ") || s === "" || s === "null" || s === "true" || s === "false") {
+    return `'${s.replace(/'/g, "''")}'`;
   }
-  const includeFinal = [...cfg.include, ...include ?? []];
-  const excludeFinal = [...cfg.exclude, ...exclude ?? []];
-  const sourceFiles = walkRepo(cwd, { include: includeFinal, exclude: excludeFinal });
-  if (!existsSync11(mapPath)) {
-    if (sourceFiles.length === 0) {
-      return { status: "missing-greenfield", staleFiles: [], staleCount: 0, mapPath };
+  return s;
+}
+function quotePath(p) {
+  if (YAML_RESERVED.test(p) || p.includes(" ")) {
+    return `'${p.replace(/'/g, "''")}'`;
+  }
+  return p;
+}
+function renderItems(items) {
+  if (items.length === 0)
+    return "[]";
+  return `[${items.map(quoteScalar).join(", ")}]`;
+}
+function truncateDecorator(d, max = 80) {
+  const cleaned = d.replace(/\r?\n/g, " ");
+  return cleaned.length <= max ? cleaned : cleaned.slice(0, max) + "...";
+}
+function renderClass(c) {
+  const lines = [];
+  lines.push(`    - name: ${c.name}`);
+  lines.push(`      lines: ${c.lines[0]}-${c.lines[1]}`);
+  if (c.methods.length > 0) {
+    lines.push("      methods:");
+    for (const m of c.methods) {
+      const asyncPrefix = m.async ? "async " : "";
+      lines.push(`        - { name: ${asyncPrefix}${m.name}, lines: ${m.lines[0]}-${m.lines[1]} }`);
     }
-    return { status: "missing-with-sources", staleFiles: [], staleCount: 0, mapPath };
   }
-  const mapMtime = statSync3(mapPath).mtimeMs;
-  const staleAll = [];
-  for (const absPath of sourceFiles) {
-    try {
-      const mtime = statSync3(absPath).mtimeMs;
-      if (mtime > mapMtime) {
-        const rel = absPath.replace(/\\/g, "/").replace(cwd.replace(/\\/g, "/") + "/", "");
-        staleAll.push(rel);
+  return lines;
+}
+function renderFunction(f) {
+  const asyncPrefix = f.async ? "async " : "";
+  let comment = "";
+  if (f.decorators.length > 0) {
+    const truncated = truncateDecorator(f.decorators[0]);
+    comment = `  # @${truncated}`;
+  }
+  return `    - { name: ${asyncPrefix}${f.name}, lines: ${f.lines[0]}-${f.lines[1]} }${comment}`;
+}
+function renderTypeDef(t) {
+  const exportedSuffix = t.exported ? "" : "  # local";
+  return `    - { name: ${t.name}, lines: ${t.lines[0]}-${t.lines[1]} }${exportedSuffix}`;
+}
+function renderEnum(e) {
+  const lines = [];
+  const exportedSuffix = e.exported ? "" : "  # local";
+  lines.push(`    - name: ${e.name}`);
+  lines.push(`      lines: ${e.lines[0]}-${e.lines[1]}${exportedSuffix}`);
+  if (e.members.length > 0) {
+    lines.push(`      members: [${e.members.join(", ")}]`);
+  }
+  return lines;
+}
+function renderYaml(entries, opts) {
+  const now = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
+  const totalSrc = entries.reduce((s, e) => s + e.total_lines, 0);
+  const bodyLines = [];
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    if (i > 0)
+      bodyLines.push("");
+    const pathKey = quotePath(e.path);
+    bodyLines.push(`${pathKey}:  # ${e.total_lines} lines`);
+    if (e.imports.length > 0) {
+      bodyLines.push("  imports:");
+      for (const imp of e.imports) {
+        const mod = quoteScalar(imp.module);
+        bodyLines.push(`    - { module: ${mod}, items: ${renderItems(imp.items)}, line: ${imp.line} }`);
+      }
+    }
+    if (e.constants.length > 0) {
+      bodyLines.push("  constants:");
+      for (const c of e.constants) {
+        bodyLines.push(`    - { name: ${c.name}, line: ${c.line} }`);
+      }
+    }
+    if (e.classes.length > 0) {
+      bodyLines.push("  classes:");
+      for (const c of e.classes) {
+        bodyLines.push(...renderClass(c));
+      }
+    }
+    if (e.functions.length > 0) {
+      bodyLines.push("  functions:");
+      for (const f of e.functions) {
+        bodyLines.push(renderFunction(f));
+      }
+    }
+    if (e.interfaces && e.interfaces.length > 0) {
+      bodyLines.push("  interfaces:");
+      for (const t of e.interfaces) {
+        bodyLines.push(renderTypeDef(t));
+      }
+    }
+    if (e.types && e.types.length > 0) {
+      bodyLines.push("  types:");
+      for (const t of e.types) {
+        bodyLines.push(renderTypeDef(t));
+      }
+    }
+    if (e.enums && e.enums.length > 0) {
+      bodyLines.push("  enums:");
+      for (const en of e.enums) {
+        bodyLines.push(...renderEnum(en));
       }
-    } catch {
     }
   }
-  if (staleAll.length === 0) {
-    return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+  const headerLineCount = opts.sourcesDigest ? 3 : 2;
+  const mapLines = bodyLines.length + headerLineCount;
+  const compression = totalSrc === 0 ? 0 : totalSrc / mapLines;
+  const fileCount = entries.length;
+  const header = [
+    `# generated: ${now} by ${opts.generator}`,
+    `# files: ${fileCount}, src-lines: ${totalSrc}, map-lines: ${mapLines}, compression: ${compression.toFixed(1)}x`
+  ];
+  if (opts.sourcesDigest) {
+    header.push(`# sources-digest: ${opts.sourcesDigest}`);
   }
-  return {
-    status: "stale",
-    staleFiles: staleAll.slice(0, 5),
-    staleCount: staleAll.length,
-    mapPath
-  };
+  return [...header, ...bodyLines].join("\n") + "\n";
 }
-var init_freshness = __esm({
-  "src/code-map/freshness.ts"() {
+var YAML_RESERVED;
+var init_yaml_writer = __esm({
+  "src/code-map/yaml-writer.ts"() {
     "use strict";
-    init_include_exclude();
-    init_config();
+    YAML_RESERVED = /[:[\]{},&*!|>'"%@`#]/;
   }
 });
 
-// src/commands/migrate.ts
-var migrate_exports = {};
-__export(migrate_exports, {
-  migrate: () => migrate
-});
-import { join as join16 } from "path";
-import { cpSync as cpSync2, existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync8, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import yaml3 from "js-yaml";
-function backupChangeDir(cwd, changeId, sessionStamp) {
-  const backupRoot = join16(cwd, ".cdd", "migrate-backup", sessionStamp);
-  const backupDir2 = join16(backupRoot, changeId);
-  mkdirSync6(backupRoot, { recursive: true });
-  const sourceDir = join16(cwd, "specs", "changes", changeId);
-  if (existsSync14(sourceDir)) {
-    cpSync2(sourceDir, backupDir2, { recursive: true });
+// src/code-map/orchestrator.ts
+async function scanInProcess(scanner, absolutePaths, repoRoot) {
+  const entries = [];
+  const warnings = [];
+  for (const absPath of absolutePaths) {
+    try {
+      const entry = await scanner.scan(absPath, repoRoot);
+      if (entry === null) {
+        const rel = absPath.replace(/\\/g, "/").replace(repoRoot.replace(/\\/g, "/") + "/", "");
+        warnings.push({ path: rel, message: "parse error (scanner returned null)" });
+      } else {
+        entries.push(entry);
+      }
+    } catch (err) {
+      const rel = absPath.replace(/\\/g, "/").replace(repoRoot.replace(/\\/g, "/") + "/", "");
+      warnings.push({ path: rel, message: `IO error: ${err.message}` });
+    }
   }
-  return backupDir2;
+  return { entries, warnings };
 }
-function buildLegacyContextManifest(changeId) {
-  return [
-    "# Context Manifest",
-    "",
-    "Generated by `cdd-kit migrate` for an existing change.",
-    "Legacy manifest. Forbidden paths come from `.cdd/context-policy.json`.",
-    "",
-    "## Affected Surfaces",
-    "- legacy-unknown",
-    "",
-    "## Allowed Paths",
-    `- specs/changes/${changeId}/`,
-    "",
-    "## Required Contracts",
-    "- legacy-unknown",
-    "",
-    "## Required Tests",
-    "- legacy-unknown",
-    "",
-    "## Agent Work Packets",
-    "",
-    "## Context Expansion Requests",
-    "-",
-    "",
-    "## Approved Expansions",
-    "-",
-    ""
-  ].join("\n");
+function bucketByExtension(files) {
+  const out = {};
+  for (const f of files) {
+    const dot = f.lastIndexOf(".");
+    const ext = dot >= 0 ? f.slice(dot).toLowerCase() : "";
+    if (!out[ext])
+      out[ext] = [];
+    out[ext].push(f);
+  }
+  return out;
 }
-function buildContextGovernedManifest(changeId) {
-  return [
-    "# Context Manifest",
-    "",
-    "Generated by `cdd-kit migrate --enable-context-governance` for an existing change.",
-    "Review and narrow the allowed paths before assigning implementation work.",
-    "Forbidden paths come from `.cdd/context-policy.json`.",
-    "",
-    "## Affected Surfaces",
-    "- legacy-unknown",
-    "",
-    "## Allowed Paths",
-    `- specs/changes/${changeId}/`,
-    "- specs/context/project-map.md",
-    "- specs/context/contracts-index.md",
-    "",
-    "## Required Contracts",
-    "- legacy-unknown",
-    "",
-    "## Required Tests",
-    "- legacy-unknown",
-    "",
-    "## Agent Work Packets",
-    "",
-    "### change-classifier",
-    "- allowed:",
-    `  - specs/changes/${changeId}/`,
-    "  - specs/context/project-map.md",
-    "  - specs/context/contracts-index.md",
-    "",
-    "## Context Expansion Requests",
-    "",
-    "<!--",
-    "Agents must request context expansion instead of reading outside their work packet.",
-    "Use this format only for real requests:",
-    "",
-    "- request-id: CER-001",
-    "  requested_paths:",
-    "    - src/example.ts",
-    "  reason: why this file is required",
-    "  status: pending",
-    "-->",
-    "",
-    "## Approved Expansions",
-    "-",
-    ""
-  ].join("\n");
-}
-function parseLegacyFrontmatter(content) {
-  const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!m)
-    return {};
-  const out = {};
-  for (const line of m[1].split(/\r?\n/)) {
-    const colon = line.indexOf(":");
-    if (colon === -1)
-      continue;
-    const key = line.slice(0, colon).trim();
-    if (!key)
-      continue;
-    out[key] = line.slice(colon + 1).trim();
+var init_orchestrator = __esm({
+  "src/code-map/orchestrator.ts"() {
+    "use strict";
+    init_include_exclude();
   }
-  return out;
+});
+
+// src/code-map/scanners/common.ts
+import { relative as relative4 } from "path";
+function canonicalRelPath(absolutePath, repoRoot) {
+  const rel = relative4(repoRoot, absolutePath);
+  return rel.replace(/\\/g, "/").normalize("NFC");
 }
-function parseListField(raw) {
-  if (!raw)
-    return [];
-  const trimmed = raw.trim();
-  if (!trimmed || trimmed === "[]")
-    return [];
-  const inner = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-  return inner.split(",").map((item) => item.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+function isAllCapsConst(name) {
+  return name.length >= 2 && /^[A-Z][A-Z0-9_]*$/.test(name);
 }
-function parseLegacyTaskList(body) {
-  const lines = body.split(/\r?\n/);
-  const rows = [];
-  let currentSection;
-  for (const raw of lines) {
-    const headerMatch = raw.match(/^##\s+\d+\.\s+(.*)\s*$/);
-    if (headerMatch) {
-      currentSection = headerMatch[1].trim();
-      continue;
-    }
-    const itemMatch = raw.match(/^\s*-\s*\[([ xX\-])\]\s+(\d+(?:\.\d+)*)\s+(.*)\s*$/);
-    if (!itemMatch)
-      continue;
-    const mark = itemMatch[1];
-    const id = itemMatch[2];
-    const title = itemMatch[3].trim();
-    let status = "pending";
-    if (mark === "x" || mark === "X")
-      status = "done";
-    else if (mark === "-")
-      status = "skipped";
-    rows.push({ id, title, status, section: currentSection });
-  }
-  return rows;
+function isBinary(content) {
+  const head = content.slice(0, 4096);
+  return head.includes("\0");
 }
-function migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pendingWrites, pendingDeletes) {
-  const newPath = join16(changeDir, "tasks.yml");
-  const legacyPath = join16(changeDir, "tasks.md");
-  if (existsSync14(newPath)) {
-    return;
-  }
-  if (!existsSync14(legacyPath)) {
-    warnings.push("tasks.md not found and tasks.yml missing \u2014 skipping tasks migration");
-    return;
-  }
-  const raw = readFileSync11(legacyPath, "utf8");
-  const fm = parseLegacyFrontmatter(raw);
-  const bodyMatch = raw.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?([\s\S]*)$/);
-  const body = bodyMatch ? bodyMatch[1] : raw;
-  const tasksRows = parseLegacyTaskList(body);
-  const data = {};
-  data["change-id"] = fm["change-id"] || changeId;
-  data["status"] = fm["status"] || "in-progress";
-  if (fm["tier"] && /^\d+$/.test(fm["tier"])) {
-    data["tier"] = parseInt(fm["tier"], 10);
-  } else if (detectedTier) {
-    data["tier"] = parseInt(detectedTier, 10);
-  } else {
-    data["tier"] = null;
+var init_common = __esm({
+  "src/code-map/scanners/common.ts"() {
+    "use strict";
   }
-  if (enableContextGovernance || fm["context-governance"] === "v1") {
-    data["context-governance"] = "v1";
+});
+
+// src/code-map/scanners/python.ts
+var python_exports = {};
+__export(python_exports, {
+  pythonScanner: () => pythonScanner
+});
+import { spawnSync as spawnSync2 } from "child_process";
+import { writeFileSync as writeFileSync5, unlinkSync } from "fs";
+import { join as join13 } from "path";
+import { tmpdir } from "os";
+function detectPython2() {
+  for (const candidate of ["python3", "python"]) {
+    try {
+      const result = spawnSync2(candidate, ["--version"], {
+        encoding: "utf8",
+        timeout: 5e3
+      });
+      if (result.status === 0)
+        return candidate;
+    } catch {
+    }
   }
-  const archive2 = parseListField(fm["archive-tasks"]);
-  data["archive-tasks"] = archive2.length > 0 ? archive2 : ["7.1", "7.2"];
-  const deps = parseListField(fm["depends-on"]);
-  data["depends-on"] = deps;
-  data["tasks"] = tasksRows.map((r) => {
-    const out = { id: r.id, title: r.title, status: r.status };
-    if (r.section)
-      out["section"] = r.section;
-    return out;
-  });
-  const yamlOut = yaml3.dump(data, { lineWidth: -1, noRefs: true });
-  pendingWrites.push({ path: newPath, content: yamlOut });
-  pendingDeletes.push({ path: legacyPath });
-  changed.push(`tasks.md -> tasks.yml (${tasksRows.length} task(s) migrated)`);
+  return null;
 }
-function parseLegacyAgentLog(content) {
-  const lines = content.split(/\r?\n/);
-  const data = {};
-  let i = 0;
-  const topFieldRe = /^[ ]{0,1}-\s*([\w-]+):\s*(.*)$/;
-  while (i < lines.length) {
-    const line = lines[i];
-    const fieldMatch = line.match(topFieldRe);
-    if (!fieldMatch) {
-      i++;
-      continue;
-    }
-    const key = fieldMatch[1];
-    const inline = fieldMatch[2].trim();
-    if (key === "files-read" || key === "artifacts") {
-      const items = [];
-      let j = i + 1;
-      while (j < lines.length) {
-        const sub = lines[j];
-        if (topFieldRe.test(sub))
-          break;
-        if (/^#/.test(sub))
-          break;
-        const itemMatch = sub.match(/^\s{2,}-\s+(.+?)\s*$/);
-        if (itemMatch) {
-          items.push(itemMatch[1].trim());
+var TIMEOUT_MS, PythonScanner, pythonScanner;
+var init_python = __esm({
+  "src/code-map/scanners/python.ts"() {
+    "use strict";
+    init_paths();
+    init_common();
+    TIMEOUT_MS = parseInt(process.env["CDD_CODE_MAP_TIMEOUT_MS"] ?? "30000", 10);
+    PythonScanner = class {
+      extensions = [".py"];
+      _interpreter = void 0;
+      getInterpreter() {
+        if (this._interpreter === void 0) {
+          this._interpreter = detectPython2();
         }
-        j++;
+        return this._interpreter;
       }
-      if (key === "files-read") {
-        data["files-read"] = items;
-      } else {
-        data["artifacts"] = items.map((s) => {
-          const idx = s.indexOf(":");
-          if (idx === -1) {
-            return { type: "note", pointer: s };
-          }
-          const type = s.slice(0, idx).trim();
-          const pointer = s.slice(idx + 1).trim();
-          return { type, pointer };
-        });
+      async scan(absolutePath, repoRoot) {
+        const result = await this.scanBatch([absolutePath], repoRoot);
+        return result.entries[0] ?? null;
       }
-      i = j;
-      continue;
-    }
-    data[key] = inline;
-    i++;
-  }
-  return data;
-}
-function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
-  const agentLogDir = join16(changeDir, "agent-log");
-  if (!existsSync14(agentLogDir))
-    return;
-  const mdLogs = readdirSync8(agentLogDir).filter((f) => f.endsWith(".md"));
-  for (const f of mdLogs) {
-    const fullPath = join16(agentLogDir, f);
-    const yamlName = f.replace(/\.md$/, ".yml");
-    const yamlFull = join16(agentLogDir, yamlName);
-    if (existsSync14(yamlFull))
-      continue;
-    const raw = readFileSync11(fullPath, "utf8");
-    const parsed = parseLegacyAgentLog(raw);
-    const yamlOut = yaml3.dump(parsed, { lineWidth: -1, noRefs: true });
-    pendingWrites.push({ path: yamlFull, content: yamlOut });
-    pendingDeletes.push({ path: fullPath });
-    changed.push(`agent-log/${f} -> agent-log/${yamlName}`);
-  }
-}
-function migrateOne(changeId, changeDir, enableContextGovernance) {
-  const changed = [];
-  const warnings = [];
-  const pending = [];
-  const deletes = [];
-  let detectedTier = null;
-  const classifPath = join16(changeDir, "change-classification.md");
-  if (existsSync14(classifPath)) {
-    const content = readFileSync11(classifPath, "utf8");
-    const hasNewTierFormat = /^## Tier\s*\n\s*-\s*\d\s*$/m.test(content);
-    const oldMatch = content.match(/\*\*Tier[:\*]+\s*(?:Tier\s*)?(\d)/i) ?? content.match(/^-?\s*Tier:\s*(?:Tier\s*)?(\d)/mi);
-    if (oldMatch)
-      detectedTier = oldMatch[1];
-    if (!hasNewTierFormat) {
-      if (detectedTier) {
-        const addition = `
-## Tier
-- ${detectedTier}
-`;
-        if (!content.includes("\n## Tier\n")) {
-          changed.push(
-            `change-classification.md: appended "## Tier\\n- ${detectedTier}" (converted from old format)`
+      async scanBatch(absolutePaths, repoRoot) {
+        const interpreter = this.getInterpreter();
+        const entries = [];
+        const warnings = [];
+        if (!interpreter) {
+          const count = absolutePaths.length;
+          warnings.push({
+            path: "",
+            message: `python interpreter not found on PATH; skipping ${count} .py file${count === 1 ? "" : "s"}`
+          });
+          return { entries, warnings };
+        }
+        const scriptPath = ASSET.codeMapPython;
+        const rand = Math.random().toString(36).slice(2);
+        const listFile = join13(tmpdir(), `cdd-codemap-${process.pid}-${rand}.txt`);
+        writeFileSync5(listFile, absolutePaths.join("\n") + "\n", "utf8");
+        let stdout = "";
+        let stderr = "";
+        let exitCode = 0;
+        try {
+          const result = spawnSync2(
+            interpreter,
+            [scriptPath, "--batch-file", listFile, "--repo-root", repoRoot],
+            {
+              encoding: "utf8",
+              timeout: TIMEOUT_MS,
+              maxBuffer: 50 * 1024 * 1024
+              // 50MB
+            }
           );
-          pending.push({ path: classifPath, content: content + addition });
+          stdout = result.stdout ?? "";
+          stderr = result.stderr ?? "";
+          exitCode = result.status ?? -1;
+          if (result.error) {
+            const errMsg = result.error.message ?? String(result.error);
+            if (errMsg.includes("ENOENT")) {
+              warnings.push({
+                path: "",
+                message: `python interpreter not found (ENOENT); skipping ${absolutePaths.length} .py file(s)`
+              });
+              return { entries, warnings };
+            }
+            if (errMsg.includes("ETIMEDOUT") || errMsg.includes("timeout")) {
+              warnings.push({
+                path: "",
+                message: `python scanner timed out after ${TIMEOUT_MS}ms; skipping .py files`
+              });
+              return { entries, warnings };
+            }
+            warnings.push({
+              path: "",
+              message: `python scanner error: ${errMsg}; skipping .py files`
+            });
+            return { entries, warnings };
+          }
+        } finally {
+          try {
+            unlinkSync(listFile);
+          } catch {
+          }
         }
-      } else {
-        warnings.push(
-          "change-classification.md: could not detect tier (no **Tier:** N or ## Tier N found). Set `tier: <0-5>` in tasks.yml frontmatter to enable tier-based gate checks."
-        );
+        if (exitCode === 3) {
+          warnings.push({
+            path: "",
+            message: "python interpreter is < 3.9 (need ast.unparse); skipping .py files"
+          });
+          return { entries, warnings };
+        }
+        for (const line of stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed)
+            continue;
+          let parsed;
+          try {
+            parsed = JSON.parse(trimmed);
+          } catch {
+            continue;
+          }
+          if (!parsed.ok) {
+            warnings.push({ path: parsed.path, message: parsed.error });
+            continue;
+          }
+          const r = parsed;
+          entries.push({
+            path: canonicalRelPath(join13(repoRoot, r.path), repoRoot),
+            total_lines: r.total_lines,
+            imports: r.imports ?? [],
+            constants: r.constants ?? [],
+            classes: (r.classes ?? []).map((c) => ({
+              name: c.name,
+              lines: [c.lines[0], c.lines[1]],
+              methods: (c.methods ?? []).map((m) => ({
+                name: m.name,
+                lines: [m.lines[0], m.lines[1]],
+                async: m.async
+              }))
+            })),
+            functions: (r.functions ?? []).map((f) => ({
+              name: f.name,
+              lines: [f.lines[0], f.lines[1]],
+              decorators: f.decorators ?? [],
+              async: f.async
+            }))
+          });
+        }
+        if (exitCode === 2) {
+          warnings.push({
+            path: "",
+            message: `python scanner exited with code 2 (fatal); partial results only. stderr: ${stderr.slice(0, 200)}`
+          });
+        }
+        return { entries, warnings };
       }
-    } else {
-      const structured = content.match(/^## Tier\s*\n\s*-\s*(\d)\s*$/m);
-      if (structured)
-        detectedTier = structured[1];
-    }
-  }
-  migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pending, deletes);
-  migrateAgentLogs(changeDir, changed, pending, deletes);
-  const manifestPath = join16(changeDir, "context-manifest.md");
-  if (!existsSync14(manifestPath)) {
-    changed.push(enableContextGovernance ? "context-manifest.md: added context-governance v1 manifest scaffold" : "context-manifest.md: added legacy context manifest scaffold");
-    pending.push({
-      path: manifestPath,
-      content: enableContextGovernance ? buildContextGovernedManifest(changeId) : buildLegacyContextManifest(changeId)
-    });
-  } else if (enableContextGovernance) {
-    warnings.push("context-manifest.md already exists \u2014 review allowed paths before relying on context-governance: v1");
+    };
+    pythonScanner = new PythonScanner();
   }
-  return { result: { changed, warnings }, pending, deletes };
+});
+
+// src/code-map/scanners/javascript.ts
+var javascript_exports = {};
+__export(javascript_exports, {
+  COMMON_PLUGINS: () => COMMON_PLUGINS,
+  countSourceLines: () => countSourceLines,
+  jsScanner: () => jsScanner,
+  parseAndExtract: () => parseAndExtract,
+  parseJsSource: () => parseJsSource,
+  parseSourceWithPlugins: () => parseSourceWithPlugins
+});
+import { readFileSync as readFileSync11 } from "fs";
+import { parse } from "@babel/parser";
+function parseSourceWithPlugins(source, plugins) {
+  return parse(source, {
+    sourceType: "unambiguous",
+    allowReturnOutsideFunction: true,
+    allowAwaitOutsideFunction: true,
+    errorRecovery: true,
+    plugins
+  });
 }
-function commitWritesAtomically(pending, deletes) {
-  const renames = [];
-  try {
-    for (const write of pending) {
-      const tmp = `${write.path}.cdd-migrate.tmp`;
-      writeFileSync6(tmp, write.content, "utf8");
-      renames.push({ tmp, final: write.path });
-    }
-  } catch (err) {
-    for (const r of renames) {
-      try {
-        rmSync2(r.tmp, { force: true });
-      } catch {
-      }
+function isCallExpression(node, callee) {
+  if (!node || node.type !== "CallExpression")
+    return false;
+  const c = node.callee;
+  return c.type === "Identifier" && c.name === callee;
+}
+function extractRequireModule(node) {
+  if (!node || node.type !== "CallExpression")
+    return null;
+  const c = node.callee;
+  if (c.type !== "Identifier" || c.name !== "require")
+    return null;
+  const arg = node.arguments[0];
+  if (!arg || arg.type !== "StringLiteral")
+    return null;
+  return arg.value;
+}
+function getLineRange(node) {
+  const start = node.loc?.start.line ?? 1;
+  const end = node.loc?.end.line ?? start;
+  return [start, end];
+}
+function processImportDeclaration(node) {
+  const items = [];
+  for (const spec of node.specifiers) {
+    if (spec.type === "ImportDefaultSpecifier") {
+      items.push(`default:${spec.local.name}`);
+    } else if (spec.type === "ImportNamespaceSpecifier") {
+      items.push(`*:${spec.local.name}`);
+    } else if (spec.type === "ImportSpecifier") {
+      const imported = spec.imported;
+      items.push(imported.type === "Identifier" ? imported.name : spec.local.name);
     }
-    throw err;
-  }
-  for (const r of renames) {
-    renameSync(r.tmp, r.final);
   }
-  for (const d of deletes) {
-    try {
-      rmSync2(d.path, { force: true });
-    } catch {
+  return {
+    module: node.source.value,
+    items,
+    line: node.loc?.start.line ?? 1
+  };
+}
+function processFunctionDeclaration(node, nameOverride) {
+  const name = nameOverride ?? node.id?.name;
+  if (!name)
+    return null;
+  return {
+    name,
+    lines: getLineRange(node),
+    decorators: [],
+    async: node.async
+  };
+}
+function processClassDeclaration(node, nameOverride) {
+  const name = nameOverride ?? node.id?.name;
+  if (!name)
+    return null;
+  const methods = [];
+  for (const member of node.body.body) {
+    if (member.type === "ClassMethod" || member.type === "ClassPrivateMethod") {
+      const m = member;
+      let methodName;
+      if (m.key.type === "Identifier") {
+        methodName = m.key.name;
+      } else if (m.key.type === "PrivateName") {
+        methodName = `#${m.key.id.name}`;
+      } else {
+        methodName = "<computed>";
+      }
+      methods.push({
+        name: methodName,
+        lines: getLineRange(m),
+        async: m.async
+      });
     }
   }
+  return {
+    name,
+    lines: getLineRange(node),
+    methods
+  };
 }
-async function migrate(changeId, opts = {}) {
-  const cwd = process.cwd();
-  const dryRun = opts.dryRun ?? false;
-  const enableContextGovernance = opts.enableContextGovernance ?? false;
-  const noBackup = opts.noBackup ?? false;
-  const idsToMigrate = [];
-  if (opts.all) {
-    const changesDir = join16(cwd, "specs", "changes");
-    if (!existsSync14(changesDir)) {
-      log.info("No specs/changes/ directory found \u2014 nothing to migrate.");
-      return;
-    }
-    idsToMigrate.push(
-      ...readdirSync8(changesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name)
-    );
-  } else if (changeId) {
-    const specificDir = join16(cwd, "specs", "changes", changeId);
-    if (!existsSync14(specificDir)) {
-      log.error(`Change not found: specs/changes/${changeId}`);
-      process.exit(1);
-    }
-    idsToMigrate.push(changeId);
-  } else {
-    log.error("Usage: cdd-kit migrate <change-id>  |  cdd-kit migrate --all  [--dry-run] [--no-backup]");
-    process.exit(1);
-  }
-  if (idsToMigrate.length === 0) {
-    log.info("No changes found to migrate.");
-    return;
-  }
-  if (dryRun) {
-    log.info("Dry run \u2014 no files will be written.");
-    log.blank();
-  }
-  const sessionStamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  let migratedCount = 0;
-  let upToDateCount = 0;
-  const backupRoot = join16(cwd, ".cdd", "migrate-backup", sessionStamp);
-  for (const id of idsToMigrate) {
-    const changeDir = join16(cwd, "specs", "changes", id);
-    if (!existsSync14(changeDir)) {
-      log.warn(`  ${id}: directory not found \u2014 skipping`);
+function processVariableDeclaration(node, imports, constants, functions) {
+  for (const decl of node.declarations) {
+    if (!decl.id || decl.id.type !== "Identifier")
       continue;
-    }
-    const { result, pending, deletes } = migrateOne(id, changeDir, enableContextGovernance);
-    const { changed, warnings } = result;
-    if (changed.length === 0) {
-      log.info(`  ${id}: already up to date`);
-      upToDateCount++;
-      for (const w of warnings)
-        log.warn(`  ${id}: ${w}`);
+    const varName = decl.id.name;
+    const init2 = decl.init;
+    if (init2 && isCallExpression(init2, "require")) {
+      const mod = extractRequireModule(init2);
+      if (mod) {
+        imports.push({ module: mod, items: [`default:${varName}`], line: node.loc?.start.line ?? 1 });
+      }
       continue;
     }
-    if (!dryRun) {
-      try {
-        if (!noBackup)
-          backupChangeDir(cwd, id, sessionStamp);
-        commitWritesAtomically(pending, deletes);
-      } catch (err) {
-        log.error(`  ${id}: migration failed \u2014 ${err.message}`);
-        if (!noBackup) {
-          log.error(`  ${id}: restore from .cdd/migrate-backup/${sessionStamp}/${id}/`);
-        }
-        process.exit(1);
-      }
+    if (isAllCapsConst(varName) && init2 !== null && init2 !== void 0) {
+      constants.push({ name: varName, line: node.loc?.start.line ?? 1 });
+      continue;
     }
-    log.ok(`  ${id}: migrated`);
-    for (const c of changed)
-      log.info(`    + ${c}`);
-    migratedCount++;
-    for (const w of warnings)
-      log.warn(`  ${id}: ${w}`);
-  }
-  log.blank();
-  if (dryRun) {
-    log.info(`Dry run complete: ${migratedCount} change(s) would be updated, ${upToDateCount} already up to date.`);
-  } else {
-    log.ok(`Migration complete: ${migratedCount} updated, ${upToDateCount} already up to date.`);
-    if (migratedCount > 0 && !noBackup) {
-      log.info(`Backup: ${backupRoot}`);
-      if (ensureGitignoreEntry(cwd, ".cdd/migrate-backup/")) {
-        log.info("Added `.cdd/migrate-backup/` to .gitignore");
-      }
-      log.info('Next: git add specs/changes/ && git commit -m "chore: migrate changes to YAML format"');
-      log.info("When stable, remove backup: rm -rf .cdd/migrate-backup/");
+    if (init2 && (init2.type === "ArrowFunctionExpression" || init2.type === "FunctionExpression")) {
+      functions.push({
+        name: varName,
+        lines: getLineRange(node),
+        decorators: [],
+        async: init2.async
+      });
+    } else if (init2 && init2.type === "CallExpression" && /^[A-Z]/.test(varName)) {
+      functions.push({
+        name: varName,
+        lines: getLineRange(node),
+        decorators: [],
+        async: false
+      });
     }
   }
 }
-function ensureGitignoreEntry(cwd, entry) {
-  const path = join16(cwd, ".gitignore");
-  const trimmed = entry.trim();
-  if (!trimmed)
-    return false;
-  const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
-  let existing = "";
-  if (existsSync14(path))
-    existing = readFileSync11(path, "utf8");
-  if (re.test(existing))
-    return false;
-  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const block = existing.length === 0 ? `# cdd-kit generated backups (do not commit)
-${trimmed}
-` : `${sep}
-# cdd-kit generated backups (do not commit)
-${trimmed}
-`;
-  writeFileSync6(path, existing + block, "utf8");
-  return true;
+function processTsInterfaceDeclaration(node, exported) {
+  if (!node || node.type !== "TSInterfaceDeclaration")
+    return null;
+  if (!node.id || node.id.type !== "Identifier")
+    return null;
+  return {
+    name: node.id.name,
+    lines: getLineRange(node),
+    exported
+  };
 }
-var init_migrate = __esm({
-  "src/commands/migrate.ts"() {
-    "use strict";
-    init_logger();
-  }
-});
-
-// src/commands/upgrade.ts
-var upgrade_exports = {};
-__export(upgrade_exports, {
-  upgrade: () => upgrade
-});
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync9, copyFileSync as copyFileSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4, join as join17, relative as relative3 } from "path";
-function planMissingFiles(srcDir, destDir, label, planned) {
-  if (!existsSync15(srcDir))
-    return;
-  for (const entry of readdirSync9(srcDir, { withFileTypes: true })) {
-    const src = join17(srcDir, entry.name);
-    const dest = join17(destDir, entry.name);
-    if (entry.isDirectory()) {
-      planMissingFiles(src, dest, join17(label, entry.name), planned);
+function processTsTypeAliasDeclaration(node, exported) {
+  if (!node || node.type !== "TSTypeAliasDeclaration")
+    return null;
+  if (!node.id || node.id.type !== "Identifier")
+    return null;
+  return {
+    name: node.id.name,
+    lines: getLineRange(node),
+    exported
+  };
+}
+function processTsEnumDeclaration(node, exported) {
+  if (!node || node.type !== "TSEnumDeclaration")
+    return null;
+  if (!node.id || node.id.type !== "Identifier")
+    return null;
+  const members = [];
+  for (const m of node.members ?? []) {
+    if (!m || !m.id)
       continue;
-    }
-    if (!existsSync15(dest)) {
-      planned.push({ src, dest, rel: join17(label, relative3(srcDir, src)) });
-    }
+    if (m.id.type === "Identifier")
+      members.push(m.id.name);
+    else if (m.id.type === "StringLiteral")
+      members.push(m.id.value);
   }
+  return {
+    name: node.id.name,
+    lines: getLineRange(node),
+    exported,
+    members
+  };
 }
-function planProviderGuidance(cwd, provider, planned) {
-  if (provider === "claude" || provider === "both") {
-    if (!existsSync15(join17(cwd, "CLAUDE.md"))) {
-      planned.push({ src: ASSET.claudeTemplate, dest: join17(cwd, "CLAUDE.md"), rel: "CLAUDE.md" });
-    }
-    if (!existsSync15(join17(cwd, "AGENTS.md"))) {
-      planned.push({ src: ASSET.agentsTemplate, dest: join17(cwd, "AGENTS.md"), rel: "AGENTS.md" });
-    }
+function processStatement(stmt, buckets, extractTsTypes, exportedFromWrapper = false) {
+  if (stmt.type === "ExportNamedDeclaration" && stmt.declaration) {
+    processStatement(stmt.declaration, buckets, extractTsTypes, true);
+    return;
   }
-  if ((provider === "codex" || provider === "both") && !existsSync15(join17(cwd, "CODEX.md"))) {
-    planned.push({ src: ASSET.codexTemplate, dest: join17(cwd, "CODEX.md"), rel: "CODEX.md" });
+  if (stmt.type === "ExportDefaultDeclaration") {
+    const decl = stmt.declaration;
+    if (decl.type === "FunctionDeclaration") {
+      const fe = processFunctionDeclaration(decl, decl.id?.name ?? "default");
+      if (fe)
+        buckets.functions.push(fe);
+    } else if (decl.type === "ClassDeclaration") {
+      const ce = processClassDeclaration(decl, decl.id?.name ?? "default");
+      if (ce)
+        buckets.classes.push(ce);
+    }
+    return;
   }
-}
-function applyCopy(plan) {
-  for (const item of plan) {
-    mkdirSync7(dirname4(item.dest), { recursive: true });
-    copyFileSync3(item.src, item.dest);
+  if (stmt.type === "ImportDeclaration") {
+    buckets.imports.push(processImportDeclaration(stmt));
+    return;
   }
-}
-async function upgrade(opts = {}) {
-  const cwd = process.cwd();
-  const requestedProvider = opts.provider ?? "auto";
-  if (!validateProviderOption(requestedProvider)) {
-    log.error(`Invalid provider: ${requestedProvider}. Use auto, claude, codex, or both.`);
-    process.exit(1);
+  if (stmt.type === "FunctionDeclaration") {
+    const fe = processFunctionDeclaration(stmt);
+    if (fe)
+      buckets.functions.push(fe);
+    return;
   }
-  const provider = inferProvider(cwd, requestedProvider);
-  const plan = [];
-  planMissingFiles(ASSET.contracts, join17(cwd, "contracts"), "contracts", plan);
-  planMissingFiles(ASSET.specsTemplates, join17(cwd, "specs", "templates"), "specs/templates", plan);
-  planMissingFiles(ASSET.testsTemplates, join17(cwd, "tests", "templates"), "tests/templates", plan);
-  planMissingFiles(ASSET.ci, join17(cwd, "ci"), "ci", plan);
-  planMissingFiles(ASSET.githubWorkflows, join17(cwd, ".github", "workflows"), ".github/workflows", plan);
-  planMissingFiles(ASSET.cddConfig, join17(cwd, ".cdd"), ".cdd", plan);
-  planProviderGuidance(cwd, provider, plan);
-  log.blank();
-  log.info(`Upgrade provider: ${provider}`);
-  if (plan.length === 0) {
-    log.ok("No missing cdd-kit project files found.");
-    if (opts.migrateChanges) {
-      log.blank();
-      log.info("Running change migration flow...");
-      await migrate(void 0, {
-        all: true,
-        dryRun: !opts.yes,
-        enableContextGovernance: opts.enableContextGovernance
-      });
-    }
-    log.blank();
+  if (stmt.type === "ClassDeclaration") {
+    const ce = processClassDeclaration(stmt);
+    if (ce)
+      buckets.classes.push(ce);
     return;
   }
-  log.info(`${plan.length} missing file(s) detected:`);
-  for (const item of plan)
-    log.dim(`  + ${item.rel.replace(/\\/g, "/")}`);
-  if (!opts.yes) {
-    log.blank();
-    log.info("Dry run only. Re-run with --yes to write missing files.");
-    if (opts.migrateChanges) {
-      log.blank();
-      log.info("Previewing existing change migration because --migrate-changes was requested.");
-      await migrate(void 0, {
-        all: true,
-        dryRun: true,
-        enableContextGovernance: opts.enableContextGovernance
-      });
-    }
-    log.blank();
+  if (stmt.type === "VariableDeclaration") {
+    processVariableDeclaration(stmt, buckets.imports, buckets.constants, buckets.functions);
     return;
   }
-  applyCopy(plan);
-  const modelPolicyPath = join17(cwd, ".cdd", "model-policy.json");
-  if (existsSync15(modelPolicyPath)) {
-    let existing = {};
-    try {
-      existing = JSON.parse(readFileSync12(modelPolicyPath, "utf8"));
-    } catch {
-    }
-    const merged = {
-      ...existing,
-      provider,
-      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-      roles: existing.roles && typeof existing.roles === "object" ? existing.roles : {}
-    };
-    writeFileSync7(modelPolicyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
-  }
-  log.blank();
-  log.ok(`Upgrade complete: ${plan.length} missing file(s) added.`);
-  log.info("Existing project guidance and contracts were preserved.");
-  if (opts.migrateChanges) {
-    log.blank();
-    log.info("Running change migration flow...");
-    await migrate(void 0, {
-      all: true,
-      dryRun: false,
-      enableContextGovernance: opts.enableContextGovernance
-    });
-  }
-  log.blank();
-}
-var init_upgrade = __esm({
-  "src/commands/upgrade.ts"() {
-    "use strict";
-    init_paths();
-    init_logger();
-    init_provider();
-    init_migrate();
-  }
-});
-
-// src/code-map/yaml-writer.ts
-function quoteScalar(s) {
-  if (s.startsWith(".") || YAML_RESERVED.test(s) || s.includes(" ") || s === "" || s === "null" || s === "true" || s === "false") {
-    return `'${s.replace(/'/g, "''")}'`;
-  }
-  return s;
-}
-function quotePath(p) {
-  if (YAML_RESERVED.test(p) || p.includes(" ")) {
-    return `'${p.replace(/'/g, "''")}'`;
-  }
-  return p;
-}
-function renderItems(items) {
-  if (items.length === 0)
-    return "[]";
-  return `[${items.map(quoteScalar).join(", ")}]`;
-}
-function truncateDecorator(d, max = 80) {
-  const cleaned = d.replace(/\r?\n/g, " ");
-  return cleaned.length <= max ? cleaned : cleaned.slice(0, max) + "...";
-}
-function renderClass(c) {
-  const lines = [];
-  lines.push(`    - name: ${c.name}`);
-  lines.push(`      lines: ${c.lines[0]}-${c.lines[1]}`);
-  if (c.methods.length > 0) {
-    lines.push("      methods:");
-    for (const m of c.methods) {
-      const asyncPrefix = m.async ? "async " : "";
-      lines.push(`        - { name: ${asyncPrefix}${m.name}, lines: ${m.lines[0]}-${m.lines[1]} }`);
-    }
-  }
-  return lines;
-}
-function renderFunction(f) {
-  const asyncPrefix = f.async ? "async " : "";
-  let comment = "";
-  if (f.decorators.length > 0) {
-    const truncated = truncateDecorator(f.decorators[0]);
-    comment = `  # @${truncated}`;
-  }
-  return `    - { name: ${asyncPrefix}${f.name}, lines: ${f.lines[0]}-${f.lines[1]} }${comment}`;
-}
-function renderTypeDef(t) {
-  const exportedSuffix = t.exported ? "" : "  # local";
-  return `    - { name: ${t.name}, lines: ${t.lines[0]}-${t.lines[1]} }${exportedSuffix}`;
-}
-function renderEnum(e) {
-  const lines = [];
-  const exportedSuffix = e.exported ? "" : "  # local";
-  lines.push(`    - name: ${e.name}`);
-  lines.push(`      lines: ${e.lines[0]}-${e.lines[1]}${exportedSuffix}`);
-  if (e.members.length > 0) {
-    lines.push(`      members: [${e.members.join(", ")}]`);
-  }
-  return lines;
-}
-function renderYaml(entries, opts) {
-  const now = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
-  const totalSrc = entries.reduce((s, e) => s + e.total_lines, 0);
-  const bodyLines = [];
-  for (let i = 0; i < entries.length; i++) {
-    const e = entries[i];
-    if (i > 0)
-      bodyLines.push("");
-    const pathKey = quotePath(e.path);
-    bodyLines.push(`${pathKey}:  # ${e.total_lines} lines`);
-    if (e.imports.length > 0) {
-      bodyLines.push("  imports:");
-      for (const imp of e.imports) {
-        const mod = quoteScalar(imp.module);
-        bodyLines.push(`    - { module: ${mod}, items: ${renderItems(imp.items)}, line: ${imp.line} }`);
-      }
-    }
-    if (e.constants.length > 0) {
-      bodyLines.push("  constants:");
-      for (const c of e.constants) {
-        bodyLines.push(`    - { name: ${c.name}, line: ${c.line} }`);
-      }
-    }
-    if (e.classes.length > 0) {
-      bodyLines.push("  classes:");
-      for (const c of e.classes) {
-        bodyLines.push(...renderClass(c));
-      }
-    }
-    if (e.functions.length > 0) {
-      bodyLines.push("  functions:");
-      for (const f of e.functions) {
-        bodyLines.push(renderFunction(f));
-      }
-    }
-    if (e.interfaces && e.interfaces.length > 0) {
-      bodyLines.push("  interfaces:");
-      for (const t of e.interfaces) {
-        bodyLines.push(renderTypeDef(t));
-      }
+  if (extractTsTypes) {
+    const anyStmt = stmt;
+    if (anyStmt.type === "TSInterfaceDeclaration") {
+      const e = processTsInterfaceDeclaration(anyStmt, exportedFromWrapper);
+      if (e)
+        buckets.interfaces.push(e);
+      return;
     }
-    if (e.types && e.types.length > 0) {
-      bodyLines.push("  types:");
-      for (const t of e.types) {
-        bodyLines.push(renderTypeDef(t));
-      }
+    if (anyStmt.type === "TSTypeAliasDeclaration") {
+      const e = processTsTypeAliasDeclaration(anyStmt, exportedFromWrapper);
+      if (e)
+        buckets.types.push(e);
+      return;
     }
-    if (e.enums && e.enums.length > 0) {
-      bodyLines.push("  enums:");
-      for (const en of e.enums) {
-        bodyLines.push(...renderEnum(en));
-      }
+    if (anyStmt.type === "TSEnumDeclaration") {
+      const e = processTsEnumDeclaration(anyStmt, exportedFromWrapper);
+      if (e)
+        buckets.enums.push(e);
+      return;
     }
   }
-  const mapLines = bodyLines.length + 2;
-  const compression = totalSrc === 0 ? 0 : totalSrc / mapLines;
-  const fileCount = entries.length;
-  const header = [
-    `# generated: ${now} by ${opts.generator}`,
-    `# files: ${fileCount}, src-lines: ${totalSrc}, map-lines: ${mapLines}, compression: ${compression.toFixed(1)}x`
-  ];
-  return [...header, ...bodyLines].join("\n") + "\n";
-}
-var YAML_RESERVED;
-var init_yaml_writer = __esm({
-  "src/code-map/yaml-writer.ts"() {
-    "use strict";
-    YAML_RESERVED = /[:[\]{},&*!|>'"%@`#]/;
-  }
-});
-
-// src/code-map/orchestrator.ts
-async function scanInProcess(scanner, absolutePaths, repoRoot) {
-  const entries = [];
-  const warnings = [];
-  for (const absPath of absolutePaths) {
-    try {
-      const entry = await scanner.scan(absPath, repoRoot);
-      if (entry === null) {
-        const rel = absPath.replace(/\\/g, "/").replace(repoRoot.replace(/\\/g, "/") + "/", "");
-        warnings.push({ path: rel, message: "parse error (scanner returned null)" });
-      } else {
-        entries.push(entry);
+  if (stmt.type === "ExpressionStatement") {
+    const expr = stmt.expression;
+    if (isCallExpression(expr, "require")) {
+      const mod = extractRequireModule(expr);
+      if (mod) {
+        buckets.imports.push({ module: mod, items: [], line: stmt.loc?.start.line ?? 1 });
       }
-    } catch (err) {
-      const rel = absPath.replace(/\\/g, "/").replace(repoRoot.replace(/\\/g, "/") + "/", "");
-      warnings.push({ path: rel, message: `IO error: ${err.message}` });
     }
   }
-  return { entries, warnings };
 }
-function bucketByExtension(files) {
-  const out = {};
-  for (const f of files) {
-    const dot = f.lastIndexOf(".");
-    const ext = dot >= 0 ? f.slice(dot).toLowerCase() : "";
-    if (!out[ext])
-      out[ext] = [];
-    out[ext].push(f);
+function parseAndExtract(source, opts) {
+  let ast;
+  try {
+    ast = parseSourceWithPlugins(source, opts.plugins);
+  } catch {
+    return null;
   }
-  return out;
-}
-var init_orchestrator = __esm({
-  "src/code-map/orchestrator.ts"() {
-    "use strict";
-    init_include_exclude();
+  const buckets = {
+    imports: [],
+    constants: [],
+    functions: [],
+    classes: [],
+    interfaces: [],
+    types: [],
+    enums: []
+  };
+  for (const stmt of ast.program.body) {
+    processStatement(stmt, buckets, !!opts.extractTsTypes);
   }
-});
-
-// src/code-map/scanners/common.ts
-import { relative as relative4 } from "path";
-function canonicalRelPath(absolutePath, repoRoot) {
-  const rel = relative4(repoRoot, absolutePath);
-  return rel.replace(/\\/g, "/").normalize("NFC");
+  return buckets;
 }
-function isAllCapsConst(name) {
-  return name.length >= 2 && /^[A-Z][A-Z0-9_]*$/.test(name);
+function countSourceLines(source) {
+  if (source === "")
+    return 0;
+  return source.split(/\r?\n/).length - (source.endsWith("\n") || source.endsWith("\r\n") ? 1 : 0);
 }
-function isBinary(content) {
-  const head = content.slice(0, 4096);
-  return head.includes("\0");
+function parseJsSource(source, relPath) {
+  const total_lines = countSourceLines(source);
+  const r = parseAndExtract(source, { plugins: JS_PLUGINS, extractTsTypes: false });
+  if (!r)
+    return null;
+  return {
+    path: relPath,
+    total_lines,
+    imports: r.imports,
+    constants: r.constants,
+    classes: r.classes,
+    functions: r.functions
+  };
 }
-var init_common = __esm({
-  "src/code-map/scanners/common.ts"() {
-    "use strict";
-  }
+var COMMON_PLUGINS, JS_PLUGINS, JavaScriptScanner, jsScanner;
+var init_javascript = __esm({
+  "src/code-map/scanners/javascript.ts"() {
+    "use strict";
+    init_common();
+    COMMON_PLUGINS = [
+      "classProperties",
+      "classPrivateProperties",
+      "classPrivateMethods",
+      "decorators-legacy",
+      "topLevelAwait",
+      "dynamicImport",
+      "optionalChaining",
+      "nullishCoalescingOperator",
+      "objectRestSpread",
+      "asyncGenerators",
+      "numericSeparator",
+      "logicalAssignment"
+    ];
+    JS_PLUGINS = ["jsx", ...COMMON_PLUGINS];
+    JavaScriptScanner = class {
+      extensions = [".js"];
+      async scan(absolutePath, repoRoot) {
+        let source;
+        try {
+          source = readFileSync11(absolutePath, "utf8");
+        } catch (err) {
+          throw err;
+        }
+        if (isBinary(source)) {
+          return null;
+        }
+        const relPath = canonicalRelPath(absolutePath, repoRoot);
+        return parseJsSource(source, relPath);
+      }
+    };
+    jsScanner = new JavaScriptScanner();
+  }
 });
 
-// src/code-map/scanners/python.ts
-var python_exports = {};
-__export(python_exports, {
-  pythonScanner: () => pythonScanner
+// src/code-map/scanners/typescript.ts
+var typescript_exports = {};
+__export(typescript_exports, {
+  tsScanner: () => tsScanner
 });
-import { spawnSync as spawnSync2 } from "child_process";
-import { writeFileSync as writeFileSync8, unlinkSync } from "fs";
-import { join as join18 } from "path";
-import { tmpdir } from "os";
-function detectPython2() {
-  for (const candidate of ["python3", "python"]) {
-    try {
-      const result = spawnSync2(candidate, ["--version"], {
-        encoding: "utf8",
-        timeout: 5e3
-      });
-      if (result.status === 0)
-        return candidate;
-    } catch {
-    }
-  }
-  return null;
-}
-var TIMEOUT_MS, PythonScanner, pythonScanner;
-var init_python = __esm({
-  "src/code-map/scanners/python.ts"() {
+import { readFileSync as readFileSync12 } from "fs";
+var TypeScriptScanner, tsScanner;
+var init_typescript = __esm({
+  "src/code-map/scanners/typescript.ts"() {
     "use strict";
-    init_paths();
     init_common();
-    TIMEOUT_MS = parseInt(process.env["CDD_CODE_MAP_TIMEOUT_MS"] ?? "30000", 10);
-    PythonScanner = class {
-      extensions = [".py"];
-      _interpreter = void 0;
-      getInterpreter() {
-        if (this._interpreter === void 0) {
-          this._interpreter = detectPython2();
+    init_javascript();
+    TypeScriptScanner = class {
+      extensions = [".ts", ".tsx"];
+      async scan(absolutePath, repoRoot) {
+        let source;
+        try {
+          source = readFileSync12(absolutePath, "utf8");
+        } catch (err) {
+          throw err;
         }
-        return this._interpreter;
+        if (isBinary(source)) {
+          return null;
+        }
+        const isTsx = absolutePath.toLowerCase().endsWith(".tsx");
+        const plugins = isTsx ? ["typescript", "jsx", ...COMMON_PLUGINS] : ["typescript", ...COMMON_PLUGINS];
+        const r = parseAndExtract(source, { plugins, extractTsTypes: true });
+        if (!r)
+          return null;
+        const relPath = canonicalRelPath(absolutePath, repoRoot);
+        const total_lines = countSourceLines(source);
+        return {
+          path: relPath,
+          total_lines,
+          imports: r.imports,
+          constants: r.constants,
+          classes: r.classes,
+          functions: r.functions,
+          interfaces: r.interfaces,
+          types: r.types,
+          enums: r.enums
+        };
       }
+    };
+    tsScanner = new TypeScriptScanner();
+  }
+});
+
+// src/code-map/scanners/vue.ts
+var vue_exports = {};
+__export(vue_exports, {
+  vueScanner: () => vueScanner
+});
+import { readFileSync as readFileSync13 } from "fs";
+import { parse as parse2 } from "@vue/compiler-sfc";
+var VueScanner, vueScanner;
+var init_vue = __esm({
+  "src/code-map/scanners/vue.ts"() {
+    "use strict";
+    init_common();
+    init_javascript();
+    VueScanner = class {
+      extensions = [".vue"];
       async scan(absolutePath, repoRoot) {
-        const result = await this.scanBatch([absolutePath], repoRoot);
-        return result.entries[0] ?? null;
-      }
-      async scanBatch(absolutePaths, repoRoot) {
-        const interpreter = this.getInterpreter();
-        const entries = [];
-        const warnings = [];
-        if (!interpreter) {
-          const count = absolutePaths.length;
-          warnings.push({
-            path: "",
-            message: `python interpreter not found on PATH; skipping ${count} .py file${count === 1 ? "" : "s"}`
-          });
-          return { entries, warnings };
-        }
-        const scriptPath = ASSET.codeMapPython;
-        const rand = Math.random().toString(36).slice(2);
-        const listFile = join18(tmpdir(), `cdd-codemap-${process.pid}-${rand}.txt`);
-        writeFileSync8(listFile, absolutePaths.join("\n") + "\n", "utf8");
-        let stdout = "";
-        let stderr = "";
-        let exitCode = 0;
+        let source;
         try {
-          const result = spawnSync2(
-            interpreter,
-            [scriptPath, "--batch-file", listFile, "--repo-root", repoRoot],
-            {
-              encoding: "utf8",
-              timeout: TIMEOUT_MS,
-              maxBuffer: 50 * 1024 * 1024
-              // 50MB
-            }
-          );
-          stdout = result.stdout ?? "";
-          stderr = result.stderr ?? "";
-          exitCode = result.status ?? -1;
-          if (result.error) {
-            const errMsg = result.error.message ?? String(result.error);
-            if (errMsg.includes("ENOENT")) {
-              warnings.push({
-                path: "",
-                message: `python interpreter not found (ENOENT); skipping ${absolutePaths.length} .py file(s)`
-              });
-              return { entries, warnings };
-            }
-            if (errMsg.includes("ETIMEDOUT") || errMsg.includes("timeout")) {
-              warnings.push({
-                path: "",
-                message: `python scanner timed out after ${TIMEOUT_MS}ms; skipping .py files`
-              });
-              return { entries, warnings };
-            }
-            warnings.push({
-              path: "",
-              message: `python scanner error: ${errMsg}; skipping .py files`
-            });
-            return { entries, warnings };
-          }
-        } finally {
-          try {
-            unlinkSync(listFile);
-          } catch {
-          }
+          source = readFileSync13(absolutePath, "utf8");
+        } catch (err) {
+          throw err;
         }
-        if (exitCode === 3) {
-          warnings.push({
-            path: "",
-            message: "python interpreter is < 3.9 (need ast.unparse); skipping .py files"
-          });
-          return { entries, warnings };
+        if (isBinary(source)) {
+          return null;
         }
-        for (const line of stdout.split("\n")) {
-          const trimmed = line.trim();
-          if (!trimmed)
+        const relPath = canonicalRelPath(absolutePath, repoRoot);
+        const total_lines = source.split(/\r?\n/).length - (source.endsWith("\n") || source.endsWith("\r\n") ? 1 : 0);
+        const { descriptor } = parse2(source, { filename: absolutePath });
+        const allImports = [];
+        const allConstants = [];
+        const allFunctions = [];
+        const allClasses = [];
+        const warnings = [];
+        const scriptBlocks = [descriptor.script, descriptor.scriptSetup].filter(Boolean);
+        if (scriptBlocks.length === 0) {
+          return {
+            path: relPath,
+            total_lines,
+            imports: [],
+            constants: [],
+            classes: [],
+            functions: []
+          };
+        }
+        for (const block of scriptBlocks) {
+          if (!block)
             continue;
-          let parsed;
-          try {
-            parsed = JSON.parse(trimmed);
-          } catch {
+          if (block.lang === "ts" || block.lang === "tsx") {
+            warnings.push({
+              path: relPath,
+              message: `skipping <script lang=${block.lang}> block (TypeScript not supported in v1)`
+            });
             continue;
           }
-          if (!parsed.ok) {
-            warnings.push({ path: parsed.path, message: parsed.error });
+          const blockContent = block.content;
+          const lineOffset = block.loc.start.line;
+          const scriptEntry = parseJsSource(blockContent, relPath);
+          if (!scriptEntry) {
+            warnings.push({ path: relPath, message: "parse error in script block" });
             continue;
           }
-          const r = parsed;
-          entries.push({
-            path: canonicalRelPath(join18(repoRoot, r.path), repoRoot),
-            total_lines: r.total_lines,
-            imports: r.imports ?? [],
-            constants: r.constants ?? [],
-            classes: (r.classes ?? []).map((c) => ({
-              name: c.name,
-              lines: [c.lines[0], c.lines[1]],
-              methods: (c.methods ?? []).map((m) => ({
-                name: m.name,
-                lines: [m.lines[0], m.lines[1]],
-                async: m.async
-              }))
-            })),
-            functions: (r.functions ?? []).map((f) => ({
-              name: f.name,
-              lines: [f.lines[0], f.lines[1]],
-              decorators: f.decorators ?? [],
-              async: f.async
-            }))
-          });
-        }
-        if (exitCode === 2) {
-          warnings.push({
-            path: "",
-            message: `python scanner exited with code 2 (fatal); partial results only. stderr: ${stderr.slice(0, 200)}`
-          });
+          const offset = lineOffset - 1;
+          for (const imp of scriptEntry.imports) {
+            allImports.push({ ...imp, line: imp.line + offset });
+          }
+          for (const c of scriptEntry.constants) {
+            allConstants.push({ ...c, line: c.line + offset });
+          }
+          for (const fn of scriptEntry.functions) {
+            allFunctions.push({
+              ...fn,
+              lines: [fn.lines[0] + offset, fn.lines[1] + offset]
+            });
+          }
+          for (const cls of scriptEntry.classes) {
+            allClasses.push({
+              ...cls,
+              lines: [cls.lines[0] + offset, cls.lines[1] + offset],
+              methods: cls.methods.map((m) => ({
+                ...m,
+                lines: [m.lines[0] + offset, m.lines[1] + offset]
+              }))
+            });
+          }
         }
-        return { entries, warnings };
+        return {
+          path: relPath,
+          total_lines,
+          imports: allImports,
+          constants: allConstants,
+          classes: allClasses,
+          functions: allFunctions
+        };
       }
     };
-    pythonScanner = new PythonScanner();
+    vueScanner = new VueScanner();
   }
 });
 
-// src/code-map/scanners/javascript.ts
-var javascript_exports = {};
-__export(javascript_exports, {
-  COMMON_PLUGINS: () => COMMON_PLUGINS,
-  countSourceLines: () => countSourceLines,
-  jsScanner: () => jsScanner,
-  parseAndExtract: () => parseAndExtract,
-  parseJsSource: () => parseJsSource,
-  parseSourceWithPlugins: () => parseSourceWithPlugins
+// src/commands/code-map.ts
+var code_map_exports = {};
+__export(code_map_exports, {
+  codeMap: () => codeMap,
+  computeSourcesDigest: () => computeSourcesDigest
 });
-import { readFileSync as readFileSync14 } from "fs";
-import { parse } from "@babel/parser";
-function parseSourceWithPlugins(source, plugins) {
-  return parse(source, {
-    sourceType: "unambiguous",
-    allowReturnOutsideFunction: true,
-    allowAwaitOutsideFunction: true,
-    errorRecovery: true,
-    plugins
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { resolve, dirname as dirname4, relative as relative5 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { createRequire } from "module";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { join as join14 } from "path";
+function computeSourcesDigest(absolutePaths, cwd) {
+  const lines = absolutePaths.slice().sort().map((p) => {
+    const rel = relative5(cwd, p).replace(/\\/g, "/");
+    const contentHash = sha256OfFileNormalized(p) || "missing";
+    return `${rel}:${contentHash}`;
   });
+  return createHash5("sha256").update(lines.join("\n")).digest("hex");
 }
-function isCallExpression(node, callee) {
-  if (!node || node.type !== "CallExpression")
-    return false;
-  const c = node.callee;
-  return c.type === "Identifier" && c.name === callee;
-}
-function extractRequireModule(node) {
-  if (!node || node.type !== "CallExpression")
-    return null;
-  const c = node.callee;
-  if (c.type !== "Identifier" || c.name !== "require")
-    return null;
-  const arg = node.arguments[0];
-  if (!arg || arg.type !== "StringLiteral")
-    return null;
-  return arg.value;
-}
-function getLineRange(node) {
-  const start = node.loc?.start.line ?? 1;
-  const end = node.loc?.end.line ?? start;
-  return [start, end];
-}
-function processImportDeclaration(node) {
-  const items = [];
-  for (const spec of node.specifiers) {
-    if (spec.type === "ImportDefaultSpecifier") {
-      items.push(`default:${spec.local.name}`);
-    } else if (spec.type === "ImportNamespaceSpecifier") {
-      items.push(`*:${spec.local.name}`);
-    } else if (spec.type === "ImportSpecifier") {
-      const imported = spec.imported;
-      items.push(imported.type === "Identifier" ? imported.name : spec.local.name);
+async function codeMap(opts) {
+  const root = resolve(process.cwd(), opts.path);
+  const start = Date.now();
+  let cfg;
+  try {
+    cfg = loadCodeMapConfig(root);
+  } catch (err) {
+    log.error(`code-map: ${err.message}`);
+    return 1;
+  }
+  const include = [...cfg.include, ...opts.include];
+  const exclude = [...cfg.exclude, ...opts.exclude];
+  const files = walkRepo(root, { include, exclude });
+  const buckets = bucketByExtension(files);
+  const result = { entries: [], warnings: [] };
+  const tasks = [];
+  if (buckets[".py"]?.length) {
+    const { pythonScanner: pythonScanner2 } = await Promise.resolve().then(() => (init_python(), python_exports));
+    if (pythonScanner2.scanBatch) {
+      tasks.push(pythonScanner2.scanBatch(buckets[".py"], root));
     }
   }
-  return {
-    module: node.source.value,
-    items,
-    line: node.loc?.start.line ?? 1
-  };
-}
-function processFunctionDeclaration(node, nameOverride) {
-  const name = nameOverride ?? node.id?.name;
-  if (!name)
-    return null;
-  return {
-    name,
-    lines: getLineRange(node),
-    decorators: [],
-    async: node.async
-  };
-}
-function processClassDeclaration(node, nameOverride) {
-  const name = nameOverride ?? node.id?.name;
-  if (!name)
-    return null;
-  const methods = [];
-  for (const member of node.body.body) {
-    if (member.type === "ClassMethod" || member.type === "ClassPrivateMethod") {
-      const m = member;
-      let methodName;
-      if (m.key.type === "Identifier") {
-        methodName = m.key.name;
-      } else if (m.key.type === "PrivateName") {
-        methodName = `#${m.key.id.name}`;
-      } else {
-        methodName = "<computed>";
-      }
-      methods.push({
-        name: methodName,
-        lines: getLineRange(m),
-        async: m.async
+  const jsFiles = [
+    ...buckets[".js"] ?? [],
+    ...buckets[".jsx"] ?? [],
+    ...buckets[".mjs"] ?? [],
+    ...buckets[".cjs"] ?? []
+  ];
+  if (jsFiles.length) {
+    const { jsScanner: jsScanner2 } = await Promise.resolve().then(() => (init_javascript(), javascript_exports));
+    tasks.push(scanInProcess(jsScanner2, jsFiles, root));
+  }
+  const tsFiles = [
+    ...buckets[".ts"] ?? [],
+    ...buckets[".tsx"] ?? []
+  ];
+  if (tsFiles.length) {
+    const { tsScanner: tsScanner2 } = await Promise.resolve().then(() => (init_typescript(), typescript_exports));
+    tasks.push(scanInProcess(tsScanner2, tsFiles, root));
+  }
+  if (buckets[".vue"]?.length) {
+    const { vueScanner: vueScanner2 } = await Promise.resolve().then(() => (init_vue(), vue_exports));
+    tasks.push(scanInProcess(vueScanner2, buckets[".vue"], root));
+  }
+  for (const r of await Promise.all(tasks)) {
+    result.entries.push(...r.entries);
+    result.warnings.push(...r.warnings);
+  }
+  result.entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  for (const e of result.entries) {
+    if (e.total_lines > opts.maxLines) {
+      result.warnings.push({
+        path: e.path,
+        message: `file exceeds --max-lines (${e.total_lines} > ${opts.maxLines})`
       });
     }
   }
-  return {
-    name,
-    lines: getLineRange(node),
-    methods
-  };
-}
-function processVariableDeclaration(node, imports, constants, functions) {
-  for (const decl of node.declarations) {
-    if (!decl.id || decl.id.type !== "Identifier")
-      continue;
-    const varName = decl.id.name;
-    const init2 = decl.init;
-    if (init2 && isCallExpression(init2, "require")) {
-      const mod = extractRequireModule(init2);
-      if (mod) {
-        imports.push({ module: mod, items: [`default:${varName}`], line: node.loc?.start.line ?? 1 });
-      }
-      continue;
-    }
-    if (isAllCapsConst(varName) && init2 !== null && init2 !== void 0) {
-      constants.push({ name: varName, line: node.loc?.start.line ?? 1 });
-      continue;
-    }
-    if (init2 && (init2.type === "ArrowFunctionExpression" || init2.type === "FunctionExpression")) {
-      functions.push({
-        name: varName,
-        lines: getLineRange(node),
-        decorators: [],
-        async: init2.async
-      });
-    } else if (init2 && init2.type === "CallExpression" && /^[A-Z]/.test(varName)) {
-      functions.push({
-        name: varName,
-        lines: getLineRange(node),
-        decorators: [],
-        async: false
-      });
+  const sourcesDigest = computeSourcesDigest(files, root);
+  const yamlBody = renderYaml(result.entries, {
+    generator: `cdd-kit ${_pkg.version}`,
+    sourcesDigest
+  });
+  const totalSrc = result.entries.reduce((s, e) => s + e.total_lines, 0);
+  const mapLines = yamlBody.split("\n").length;
+  const compression = totalSrc === 0 ? 0 : totalSrc / mapLines;
+  const summaryLine = `scanned ${result.entries.length} files, ${totalSrc} src lines -> ${opts.out} (${mapLines} lines, compression ${compression.toFixed(1)}x)`;
+  for (const w of result.warnings) {
+    log.warn(`${w.path}: ${w.message}`);
+  }
+  if (opts.check) {
+    const existing = existsSync11(opts.out) ? readFileSync14(opts.out, "utf8") : "";
+    const normalize = (s) => s.replace(/^# generated: [^\n]+\n/m, "# generated: <normalized>\n");
+    if (normalize(existing) !== normalize(yamlBody)) {
+      log.error(`code-map out of date: ${opts.out} would change. Run \`cdd-kit code-map\` to regenerate.`);
+      return 1;
     }
+    log.ok(`code-map up to date: ${opts.out}`);
+    return 0;
   }
+  mkdirSync5(dirname4(opts.out), { recursive: true });
+  writeFileSync6(opts.out, yamlBody, "utf8");
+  log.ok(`${summaryLine} (${Date.now() - start}ms)`);
+  return 0;
 }
-function processTsInterfaceDeclaration(node, exported) {
-  if (!node || node.type !== "TSInterfaceDeclaration")
-    return null;
-  if (!node.id || node.id.type !== "Identifier")
-    return null;
-  return {
-    name: node.id.name,
-    lines: getLineRange(node),
-    exported
-  };
-}
-function processTsTypeAliasDeclaration(node, exported) {
-  if (!node || node.type !== "TSTypeAliasDeclaration")
-    return null;
-  if (!node.id || node.id.type !== "Identifier")
-    return null;
-  return {
-    name: node.id.name,
-    lines: getLineRange(node),
-    exported
-  };
-}
-function processTsEnumDeclaration(node, exported) {
-  if (!node || node.type !== "TSEnumDeclaration")
-    return null;
-  if (!node.id || node.id.type !== "Identifier")
-    return null;
-  const members = [];
-  for (const m of node.members ?? []) {
-    if (!m || !m.id)
-      continue;
-    if (m.id.type === "Identifier")
-      members.push(m.id.name);
-    else if (m.id.type === "StringLiteral")
-      members.push(m.id.value);
+var _require, _pkgPath, _pkg;
+var init_code_map = __esm({
+  "src/commands/code-map.ts"() {
+    "use strict";
+    init_logger();
+    init_yaml_writer();
+    init_orchestrator();
+    init_config();
+    init_digest();
+    _require = createRequire(import.meta.url);
+    _pkgPath = join14(fileURLToPath2(import.meta.url), "..", "..", "..", "package.json");
+    _pkg = JSON.parse(readFileSync14(_pkgPath, "utf8"));
   }
-  return {
-    name: node.id.name,
-    lines: getLineRange(node),
-    exported,
-    members
-  };
-}
-function processStatement(stmt, buckets, extractTsTypes, exportedFromWrapper = false) {
-  if (stmt.type === "ExportNamedDeclaration" && stmt.declaration) {
-    processStatement(stmt.declaration, buckets, extractTsTypes, true);
-    return;
+});
+
+// src/code-map/freshness.ts
+var freshness_exports = {};
+__export(freshness_exports, {
+  checkCodeMapFreshness: () => checkCodeMapFreshness
+});
+import { existsSync as existsSync12, readFileSync as readFileSync15, statSync as statSync3 } from "fs";
+import { join as join15 } from "path";
+function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclude) {
+  const mapPath = join15(cwd, mapRel);
+  let cfg;
+  try {
+    cfg = loadCodeMapConfig(cwd);
+  } catch (err) {
+    return {
+      status: "config-error",
+      staleFiles: [],
+      staleCount: 0,
+      mapPath,
+      configError: err.message
+    };
   }
-  if (stmt.type === "ExportDefaultDeclaration") {
-    const decl = stmt.declaration;
-    if (decl.type === "FunctionDeclaration") {
-      const fe = processFunctionDeclaration(decl, decl.id?.name ?? "default");
-      if (fe)
-        buckets.functions.push(fe);
-    } else if (decl.type === "ClassDeclaration") {
-      const ce = processClassDeclaration(decl, decl.id?.name ?? "default");
-      if (ce)
-        buckets.classes.push(ce);
+  const includeFinal = [...cfg.include, ...include ?? []];
+  const excludeFinal = [...cfg.exclude, ...exclude ?? []];
+  const sourceFiles = walkRepo(cwd, { include: includeFinal, exclude: excludeFinal });
+  if (!existsSync12(mapPath)) {
+    if (sourceFiles.length === 0) {
+      return { status: "missing-greenfield", staleFiles: [], staleCount: 0, mapPath };
     }
-    return;
-  }
-  if (stmt.type === "ImportDeclaration") {
-    buckets.imports.push(processImportDeclaration(stmt));
-    return;
-  }
-  if (stmt.type === "FunctionDeclaration") {
-    const fe = processFunctionDeclaration(stmt);
-    if (fe)
-      buckets.functions.push(fe);
-    return;
-  }
-  if (stmt.type === "ClassDeclaration") {
-    const ce = processClassDeclaration(stmt);
-    if (ce)
-      buckets.classes.push(ce);
-    return;
-  }
-  if (stmt.type === "VariableDeclaration") {
-    processVariableDeclaration(stmt, buckets.imports, buckets.constants, buckets.functions);
-    return;
+    return { status: "missing-with-sources", staleFiles: [], staleCount: 0, mapPath };
   }
-  if (extractTsTypes) {
-    const anyStmt = stmt;
-    if (anyStmt.type === "TSInterfaceDeclaration") {
-      const e = processTsInterfaceDeclaration(anyStmt, exportedFromWrapper);
-      if (e)
-        buckets.interfaces.push(e);
-      return;
-    }
-    if (anyStmt.type === "TSTypeAliasDeclaration") {
-      const e = processTsTypeAliasDeclaration(anyStmt, exportedFromWrapper);
-      if (e)
-        buckets.types.push(e);
-      return;
-    }
-    if (anyStmt.type === "TSEnumDeclaration") {
-      const e = processTsEnumDeclaration(anyStmt, exportedFromWrapper);
-      if (e)
-        buckets.enums.push(e);
-      return;
+  const mapMtime = statSync3(mapPath).mtimeMs;
+  const staleAll = [];
+  for (const absPath of sourceFiles) {
+    try {
+      const mtime = statSync3(absPath).mtimeMs;
+      if (mtime > mapMtime) {
+        const rel = absPath.replace(/\\/g, "/").replace(cwd.replace(/\\/g, "/") + "/", "");
+        staleAll.push(rel);
+      }
+    } catch {
     }
   }
-  if (stmt.type === "ExpressionStatement") {
-    const expr = stmt.expression;
-    if (isCallExpression(expr, "require")) {
-      const mod = extractRequireModule(expr);
-      if (mod) {
-        buckets.imports.push({ module: mod, items: [], line: stmt.loc?.start.line ?? 1 });
-      }
+  if (staleAll.length === 0) {
+    return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+  }
+  const declaredDigest = readSourcesDigest(mapPath);
+  if (declaredDigest !== null) {
+    const actualDigest = computeSourcesDigest(sourceFiles, cwd);
+    if (actualDigest === declaredDigest) {
+      return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
     }
   }
+  return {
+    status: "stale",
+    staleFiles: staleAll.slice(0, 5),
+    staleCount: staleAll.length,
+    mapPath
+  };
 }
-function parseAndExtract(source, opts) {
-  let ast;
+function readSourcesDigest(mapPath) {
   try {
-    ast = parseSourceWithPlugins(source, opts.plugins);
+    const head = readFileSync15(mapPath, "utf8").slice(0, 2048);
+    const m = head.match(/^# sources-digest:\s*([a-f0-9]+)/m);
+    return m ? m[1] : null;
   } catch {
     return null;
   }
-  const buckets = {
-    imports: [],
-    constants: [],
-    functions: [],
-    classes: [],
-    interfaces: [],
-    types: [],
-    enums: []
-  };
-  for (const stmt of ast.program.body) {
-    processStatement(stmt, buckets, !!opts.extractTsTypes);
-  }
-  return buckets;
-}
-function countSourceLines(source) {
-  if (source === "")
-    return 0;
-  return source.split(/\r?\n/).length - (source.endsWith("\n") || source.endsWith("\r\n") ? 1 : 0);
-}
-function parseJsSource(source, relPath) {
-  const total_lines = countSourceLines(source);
-  const r = parseAndExtract(source, { plugins: JS_PLUGINS, extractTsTypes: false });
-  if (!r)
-    return null;
-  return {
-    path: relPath,
-    total_lines,
-    imports: r.imports,
-    constants: r.constants,
-    classes: r.classes,
-    functions: r.functions
-  };
 }
-var COMMON_PLUGINS, JS_PLUGINS, JavaScriptScanner, jsScanner;
-var init_javascript = __esm({
-  "src/code-map/scanners/javascript.ts"() {
+var init_freshness = __esm({
+  "src/code-map/freshness.ts"() {
     "use strict";
-    init_common();
-    COMMON_PLUGINS = [
-      "classProperties",
-      "classPrivateProperties",
-      "classPrivateMethods",
-      "decorators-legacy",
-      "topLevelAwait",
-      "dynamicImport",
-      "optionalChaining",
-      "nullishCoalescingOperator",
-      "objectRestSpread",
-      "asyncGenerators",
-      "numericSeparator",
-      "logicalAssignment"
-    ];
-    JS_PLUGINS = ["jsx", ...COMMON_PLUGINS];
-    JavaScriptScanner = class {
-      extensions = [".js"];
-      async scan(absolutePath, repoRoot) {
-        let source;
-        try {
-          source = readFileSync14(absolutePath, "utf8");
-        } catch (err) {
-          throw err;
-        }
-        if (isBinary(source)) {
-          return null;
-        }
-        const relPath = canonicalRelPath(absolutePath, repoRoot);
-        return parseJsSource(source, relPath);
-      }
-    };
-    jsScanner = new JavaScriptScanner();
+    init_include_exclude();
+    init_config();
+    init_code_map();
   }
 });
 
-// src/code-map/scanners/typescript.ts
-var typescript_exports = {};
-__export(typescript_exports, {
-  tsScanner: () => tsScanner
+// src/commands/migrate.ts
+var migrate_exports = {};
+__export(migrate_exports, {
+  migrate: () => migrate
 });
-import { readFileSync as readFileSync15 } from "fs";
-var TypeScriptScanner, tsScanner;
-var init_typescript = __esm({
-  "src/code-map/scanners/typescript.ts"() {
-    "use strict";
-    init_common();
-    init_javascript();
-    TypeScriptScanner = class {
-      extensions = [".ts", ".tsx"];
-      async scan(absolutePath, repoRoot) {
-        let source;
-        try {
-          source = readFileSync15(absolutePath, "utf8");
-        } catch (err) {
-          throw err;
-        }
-        if (isBinary(source)) {
-          return null;
-        }
-        const isTsx = absolutePath.toLowerCase().endsWith(".tsx");
-        const plugins = isTsx ? ["typescript", "jsx", ...COMMON_PLUGINS] : ["typescript", ...COMMON_PLUGINS];
-        const r = parseAndExtract(source, { plugins, extractTsTypes: true });
-        if (!r)
-          return null;
-        const relPath = canonicalRelPath(absolutePath, repoRoot);
-        const total_lines = countSourceLines(source);
-        return {
-          path: relPath,
-          total_lines,
-          imports: r.imports,
-          constants: r.constants,
-          classes: r.classes,
-          functions: r.functions,
-          interfaces: r.interfaces,
-          types: r.types,
-          enums: r.enums
-        };
-      }
-    };
-    tsScanner = new TypeScriptScanner();
+import { join as join18 } from "path";
+import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync18, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
+import yaml3 from "js-yaml";
+function backupChangeDir(cwd, changeId, sessionStamp) {
+  const backupRoot = join18(cwd, ".cdd", "migrate-backup", sessionStamp);
+  const backupDir2 = join18(backupRoot, changeId);
+  mkdirSync7(backupRoot, { recursive: true });
+  const sourceDir = join18(cwd, "specs", "changes", changeId);
+  if (existsSync15(sourceDir)) {
+    cpSync2(sourceDir, backupDir2, { recursive: true });
   }
-});
-
-// src/code-map/scanners/vue.ts
-var vue_exports = {};
-__export(vue_exports, {
-  vueScanner: () => vueScanner
-});
-import { readFileSync as readFileSync16 } from "fs";
-import { parse as parse2 } from "@vue/compiler-sfc";
-var VueScanner, vueScanner;
-var init_vue = __esm({
-  "src/code-map/scanners/vue.ts"() {
-    "use strict";
-    init_common();
-    init_javascript();
-    VueScanner = class {
-      extensions = [".vue"];
-      async scan(absolutePath, repoRoot) {
-        let source;
-        try {
-          source = readFileSync16(absolutePath, "utf8");
-        } catch (err) {
-          throw err;
-        }
-        if (isBinary(source)) {
-          return null;
-        }
-        const relPath = canonicalRelPath(absolutePath, repoRoot);
-        const total_lines = source.split(/\r?\n/).length - (source.endsWith("\n") || source.endsWith("\r\n") ? 1 : 0);
-        const { descriptor } = parse2(source, { filename: absolutePath });
-        const allImports = [];
-        const allConstants = [];
-        const allFunctions = [];
-        const allClasses = [];
-        const warnings = [];
-        const scriptBlocks = [descriptor.script, descriptor.scriptSetup].filter(Boolean);
-        if (scriptBlocks.length === 0) {
-          return {
-            path: relPath,
-            total_lines,
-            imports: [],
-            constants: [],
-            classes: [],
-            functions: []
-          };
+  return backupDir2;
+}
+function buildLegacyContextManifest(changeId) {
+  return [
+    "# Context Manifest",
+    "",
+    "Generated by `cdd-kit migrate` for an existing change.",
+    "Legacy manifest. Forbidden paths come from `.cdd/context-policy.json`.",
+    "",
+    "## Affected Surfaces",
+    "- legacy-unknown",
+    "",
+    "## Allowed Paths",
+    `- specs/changes/${changeId}/`,
+    "",
+    "## Required Contracts",
+    "- legacy-unknown",
+    "",
+    "## Required Tests",
+    "- legacy-unknown",
+    "",
+    "## Agent Work Packets",
+    "",
+    "## Context Expansion Requests",
+    "-",
+    "",
+    "## Approved Expansions",
+    "-",
+    ""
+  ].join("\n");
+}
+function buildContextGovernedManifest(changeId) {
+  return [
+    "# Context Manifest",
+    "",
+    "Generated by `cdd-kit migrate --enable-context-governance` for an existing change.",
+    "Review and narrow the allowed paths before assigning implementation work.",
+    "Forbidden paths come from `.cdd/context-policy.json`.",
+    "",
+    "## Affected Surfaces",
+    "- legacy-unknown",
+    "",
+    "## Allowed Paths",
+    `- specs/changes/${changeId}/`,
+    "- specs/context/project-map.md",
+    "- specs/context/contracts-index.md",
+    "",
+    "## Required Contracts",
+    "- legacy-unknown",
+    "",
+    "## Required Tests",
+    "- legacy-unknown",
+    "",
+    "## Agent Work Packets",
+    "",
+    "### change-classifier",
+    "- allowed:",
+    `  - specs/changes/${changeId}/`,
+    "  - specs/context/project-map.md",
+    "  - specs/context/contracts-index.md",
+    "",
+    "## Context Expansion Requests",
+    "",
+    "<!--",
+    "Agents must request context expansion instead of reading outside their work packet.",
+    "Use this format only for real requests:",
+    "",
+    "- request-id: CER-001",
+    "  requested_paths:",
+    "    - src/example.ts",
+    "  reason: why this file is required",
+    "  status: pending",
+    "-->",
+    "",
+    "## Approved Expansions",
+    "-",
+    ""
+  ].join("\n");
+}
+function parseLegacyFrontmatter(content) {
+  const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!m)
+    return {};
+  const out = {};
+  for (const line of m[1].split(/\r?\n/)) {
+    const colon = line.indexOf(":");
+    if (colon === -1)
+      continue;
+    const key = line.slice(0, colon).trim();
+    if (!key)
+      continue;
+    out[key] = line.slice(colon + 1).trim();
+  }
+  return out;
+}
+function parseListField(raw) {
+  if (!raw)
+    return [];
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed === "[]")
+    return [];
+  const inner = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  return inner.split(",").map((item) => item.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+}
+function parseLegacyTaskList(body) {
+  const lines = body.split(/\r?\n/);
+  const rows = [];
+  let currentSection;
+  for (const raw of lines) {
+    const headerMatch = raw.match(/^##\s+\d+\.\s+(.*)\s*$/);
+    if (headerMatch) {
+      currentSection = headerMatch[1].trim();
+      continue;
+    }
+    const itemMatch = raw.match(/^\s*-\s*\[([ xX\-])\]\s+(\d+(?:\.\d+)*)\s+(.*)\s*$/);
+    if (!itemMatch)
+      continue;
+    const mark = itemMatch[1];
+    const id = itemMatch[2];
+    const title = itemMatch[3].trim();
+    let status = "pending";
+    if (mark === "x" || mark === "X")
+      status = "done";
+    else if (mark === "-")
+      status = "skipped";
+    rows.push({ id, title, status, section: currentSection });
+  }
+  return rows;
+}
+function migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pendingWrites, pendingDeletes) {
+  const newPath = join18(changeDir, "tasks.yml");
+  const legacyPath = join18(changeDir, "tasks.md");
+  if (existsSync15(newPath)) {
+    return;
+  }
+  if (!existsSync15(legacyPath)) {
+    warnings.push("tasks.md not found and tasks.yml missing \u2014 skipping tasks migration");
+    return;
+  }
+  const raw = readFileSync18(legacyPath, "utf8");
+  const fm = parseLegacyFrontmatter(raw);
+  const bodyMatch = raw.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?([\s\S]*)$/);
+  const body = bodyMatch ? bodyMatch[1] : raw;
+  const tasksRows = parseLegacyTaskList(body);
+  const data = {};
+  data["change-id"] = fm["change-id"] || changeId;
+  data["status"] = fm["status"] || "in-progress";
+  if (fm["tier"] && /^\d+$/.test(fm["tier"])) {
+    data["tier"] = parseInt(fm["tier"], 10);
+  } else if (detectedTier) {
+    data["tier"] = parseInt(detectedTier, 10);
+  } else {
+    data["tier"] = null;
+  }
+  if (enableContextGovernance || fm["context-governance"] === "v1") {
+    data["context-governance"] = "v1";
+  }
+  const archive2 = parseListField(fm["archive-tasks"]);
+  data["archive-tasks"] = archive2.length > 0 ? archive2 : ["7.1", "7.2"];
+  const deps = parseListField(fm["depends-on"]);
+  data["depends-on"] = deps;
+  data["tasks"] = tasksRows.map((r) => {
+    const out = { id: r.id, title: r.title, status: r.status };
+    if (r.section)
+      out["section"] = r.section;
+    return out;
+  });
+  const yamlOut = yaml3.dump(data, { lineWidth: -1, noRefs: true });
+  pendingWrites.push({ path: newPath, content: yamlOut });
+  pendingDeletes.push({ path: legacyPath });
+  changed.push(`tasks.md -> tasks.yml (${tasksRows.length} task(s) migrated)`);
+}
+function parseLegacyAgentLog(content) {
+  const lines = content.split(/\r?\n/);
+  const data = {};
+  let i = 0;
+  const topFieldRe = /^[ ]{0,1}-\s*([\w-]+):\s*(.*)$/;
+  while (i < lines.length) {
+    const line = lines[i];
+    const fieldMatch = line.match(topFieldRe);
+    if (!fieldMatch) {
+      i++;
+      continue;
+    }
+    const key = fieldMatch[1];
+    const inline = fieldMatch[2].trim();
+    if (key === "files-read" || key === "artifacts") {
+      const items = [];
+      let j = i + 1;
+      while (j < lines.length) {
+        const sub = lines[j];
+        if (topFieldRe.test(sub))
+          break;
+        if (/^#/.test(sub))
+          break;
+        const itemMatch = sub.match(/^\s{2,}-\s+(.+?)\s*$/);
+        if (itemMatch) {
+          items.push(itemMatch[1].trim());
         }
-        for (const block of scriptBlocks) {
-          if (!block)
-            continue;
-          if (block.lang === "ts" || block.lang === "tsx") {
-            warnings.push({
-              path: relPath,
-              message: `skipping <script lang=${block.lang}> block (TypeScript not supported in v1)`
-            });
-            continue;
-          }
-          const blockContent = block.content;
-          const lineOffset = block.loc.start.line;
-          const scriptEntry = parseJsSource(blockContent, relPath);
-          if (!scriptEntry) {
-            warnings.push({ path: relPath, message: "parse error in script block" });
-            continue;
-          }
-          const offset = lineOffset - 1;
-          for (const imp of scriptEntry.imports) {
-            allImports.push({ ...imp, line: imp.line + offset });
-          }
-          for (const c of scriptEntry.constants) {
-            allConstants.push({ ...c, line: c.line + offset });
-          }
-          for (const fn of scriptEntry.functions) {
-            allFunctions.push({
-              ...fn,
-              lines: [fn.lines[0] + offset, fn.lines[1] + offset]
-            });
-          }
-          for (const cls of scriptEntry.classes) {
-            allClasses.push({
-              ...cls,
-              lines: [cls.lines[0] + offset, cls.lines[1] + offset],
-              methods: cls.methods.map((m) => ({
-                ...m,
-                lines: [m.lines[0] + offset, m.lines[1] + offset]
-              }))
-            });
+        j++;
+      }
+      if (key === "files-read") {
+        data["files-read"] = items;
+      } else {
+        data["artifacts"] = items.map((s) => {
+          const idx = s.indexOf(":");
+          if (idx === -1) {
+            return { type: "note", pointer: s };
           }
+          const type = s.slice(0, idx).trim();
+          const pointer = s.slice(idx + 1).trim();
+          return { type, pointer };
+        });
+      }
+      i = j;
+      continue;
+    }
+    data[key] = inline;
+    i++;
+  }
+  return data;
+}
+function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
+  const agentLogDir = join18(changeDir, "agent-log");
+  if (!existsSync15(agentLogDir))
+    return;
+  const mdLogs = readdirSync8(agentLogDir).filter((f) => f.endsWith(".md"));
+  for (const f of mdLogs) {
+    const fullPath = join18(agentLogDir, f);
+    const yamlName = f.replace(/\.md$/, ".yml");
+    const yamlFull = join18(agentLogDir, yamlName);
+    if (existsSync15(yamlFull))
+      continue;
+    const raw = readFileSync18(fullPath, "utf8");
+    const parsed = parseLegacyAgentLog(raw);
+    const yamlOut = yaml3.dump(parsed, { lineWidth: -1, noRefs: true });
+    pendingWrites.push({ path: yamlFull, content: yamlOut });
+    pendingDeletes.push({ path: fullPath });
+    changed.push(`agent-log/${f} -> agent-log/${yamlName}`);
+  }
+}
+function migrateOne(changeId, changeDir, enableContextGovernance) {
+  const changed = [];
+  const warnings = [];
+  const pending = [];
+  const deletes = [];
+  let detectedTier = null;
+  const classifPath = join18(changeDir, "change-classification.md");
+  if (existsSync15(classifPath)) {
+    const content = readFileSync18(classifPath, "utf8");
+    const hasNewTierFormat = /^## Tier\s*\n\s*-\s*\d\s*$/m.test(content);
+    const oldMatch = content.match(/\*\*Tier[:\*]+\s*(?:Tier\s*)?(\d)/i) ?? content.match(/^-?\s*Tier:\s*(?:Tier\s*)?(\d)/mi);
+    if (oldMatch)
+      detectedTier = oldMatch[1];
+    if (!hasNewTierFormat) {
+      if (detectedTier) {
+        const addition = `
+## Tier
+- ${detectedTier}
+`;
+        if (!content.includes("\n## Tier\n")) {
+          changed.push(
+            `change-classification.md: appended "## Tier\\n- ${detectedTier}" (converted from old format)`
+          );
+          pending.push({ path: classifPath, content: content + addition });
+        }
+      } else {
+        warnings.push(
+          "change-classification.md: could not detect tier (no **Tier:** N or ## Tier N found). Set `tier: <0-5>` in tasks.yml frontmatter to enable tier-based gate checks."
+        );
+      }
+    } else {
+      const structured = content.match(/^## Tier\s*\n\s*-\s*(\d)\s*$/m);
+      if (structured)
+        detectedTier = structured[1];
+    }
+  }
+  migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pending, deletes);
+  migrateAgentLogs(changeDir, changed, pending, deletes);
+  const manifestPath = join18(changeDir, "context-manifest.md");
+  if (!existsSync15(manifestPath)) {
+    changed.push(enableContextGovernance ? "context-manifest.md: added context-governance v1 manifest scaffold" : "context-manifest.md: added legacy context manifest scaffold");
+    pending.push({
+      path: manifestPath,
+      content: enableContextGovernance ? buildContextGovernedManifest(changeId) : buildLegacyContextManifest(changeId)
+    });
+  } else if (enableContextGovernance) {
+    warnings.push("context-manifest.md already exists \u2014 review allowed paths before relying on context-governance: v1");
+  }
+  return { result: { changed, warnings }, pending, deletes };
+}
+function commitWritesAtomically(pending, deletes) {
+  const renames = [];
+  try {
+    for (const write of pending) {
+      const tmp = `${write.path}.cdd-migrate.tmp`;
+      writeFileSync8(tmp, write.content, "utf8");
+      renames.push({ tmp, final: write.path });
+    }
+  } catch (err) {
+    for (const r of renames) {
+      try {
+        rmSync2(r.tmp, { force: true });
+      } catch {
+      }
+    }
+    throw err;
+  }
+  for (const r of renames) {
+    renameSync(r.tmp, r.final);
+  }
+  for (const d of deletes) {
+    try {
+      rmSync2(d.path, { force: true });
+    } catch {
+    }
+  }
+}
+async function migrate(changeId, opts = {}) {
+  const cwd = process.cwd();
+  const dryRun = opts.dryRun ?? false;
+  const enableContextGovernance = opts.enableContextGovernance ?? false;
+  const noBackup = opts.noBackup ?? false;
+  const idsToMigrate = [];
+  if (opts.all) {
+    const changesDir = join18(cwd, "specs", "changes");
+    if (!existsSync15(changesDir)) {
+      log.info("No specs/changes/ directory found \u2014 nothing to migrate.");
+      return;
+    }
+    idsToMigrate.push(
+      ...readdirSync8(changesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name)
+    );
+  } else if (changeId) {
+    const specificDir = join18(cwd, "specs", "changes", changeId);
+    if (!existsSync15(specificDir)) {
+      log.error(`Change not found: specs/changes/${changeId}`);
+      process.exit(1);
+    }
+    idsToMigrate.push(changeId);
+  } else {
+    log.error("Usage: cdd-kit migrate <change-id>  |  cdd-kit migrate --all  [--dry-run] [--no-backup]");
+    process.exit(1);
+  }
+  if (idsToMigrate.length === 0) {
+    log.info("No changes found to migrate.");
+    return;
+  }
+  if (dryRun) {
+    log.info("Dry run \u2014 no files will be written.");
+    log.blank();
+  }
+  const sessionStamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  let migratedCount = 0;
+  let upToDateCount = 0;
+  const backupRoot = join18(cwd, ".cdd", "migrate-backup", sessionStamp);
+  for (const id of idsToMigrate) {
+    const changeDir = join18(cwd, "specs", "changes", id);
+    if (!existsSync15(changeDir)) {
+      log.warn(`  ${id}: directory not found \u2014 skipping`);
+      continue;
+    }
+    const { result, pending, deletes } = migrateOne(id, changeDir, enableContextGovernance);
+    const { changed, warnings } = result;
+    if (changed.length === 0) {
+      log.info(`  ${id}: already up to date`);
+      upToDateCount++;
+      for (const w of warnings)
+        log.warn(`  ${id}: ${w}`);
+      continue;
+    }
+    if (!dryRun) {
+      try {
+        if (!noBackup)
+          backupChangeDir(cwd, id, sessionStamp);
+        commitWritesAtomically(pending, deletes);
+      } catch (err) {
+        log.error(`  ${id}: migration failed \u2014 ${err.message}`);
+        if (!noBackup) {
+          log.error(`  ${id}: restore from .cdd/migrate-backup/${sessionStamp}/${id}/`);
         }
-        return {
-          path: relPath,
-          total_lines,
-          imports: allImports,
-          constants: allConstants,
-          classes: allClasses,
-          functions: allFunctions
-        };
+        process.exit(1);
       }
-    };
-    vueScanner = new VueScanner();
+    }
+    log.ok(`  ${id}: migrated`);
+    for (const c of changed)
+      log.info(`    + ${c}`);
+    migratedCount++;
+    for (const w of warnings)
+      log.warn(`  ${id}: ${w}`);
+  }
+  log.blank();
+  if (dryRun) {
+    log.info(`Dry run complete: ${migratedCount} change(s) would be updated, ${upToDateCount} already up to date.`);
+  } else {
+    log.ok(`Migration complete: ${migratedCount} updated, ${upToDateCount} already up to date.`);
+    if (migratedCount > 0 && !noBackup) {
+      log.info(`Backup: ${backupRoot}`);
+      if (ensureGitignoreEntry(cwd, ".cdd/migrate-backup/")) {
+        log.info("Added `.cdd/migrate-backup/` to .gitignore");
+      }
+      log.info('Next: git add specs/changes/ && git commit -m "chore: migrate changes to YAML format"');
+      log.info("When stable, remove backup: rm -rf .cdd/migrate-backup/");
+    }
+  }
+}
+function ensureGitignoreEntry(cwd, entry) {
+  const path = join18(cwd, ".gitignore");
+  const trimmed = entry.trim();
+  if (!trimmed)
+    return false;
+  const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
+  let existing = "";
+  if (existsSync15(path))
+    existing = readFileSync18(path, "utf8");
+  if (re.test(existing))
+    return false;
+  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  const block = existing.length === 0 ? `# cdd-kit generated backups (do not commit)
+${trimmed}
+` : `${sep}
+# cdd-kit generated backups (do not commit)
+${trimmed}
+`;
+  writeFileSync8(path, existing + block, "utf8");
+  return true;
+}
+var init_migrate = __esm({
+  "src/commands/migrate.ts"() {
+    "use strict";
+    init_logger();
   }
 });
 
-// src/commands/code-map.ts
-var code_map_exports = {};
-__export(code_map_exports, {
-  codeMap: () => codeMap
+// src/commands/upgrade.ts
+var upgrade_exports = {};
+__export(upgrade_exports, {
+  upgrade: () => upgrade
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
-import { resolve, dirname as dirname5 } from "path";
-import { createRequire } from "module";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { join as join19 } from "path";
-async function codeMap(opts) {
-  const root = resolve(process.cwd(), opts.path);
-  const start = Date.now();
-  let cfg;
-  try {
-    cfg = loadCodeMapConfig(root);
-  } catch (err) {
-    log.error(`code-map: ${err.message}`);
-    return 1;
-  }
-  const include = [...cfg.include, ...opts.include];
-  const exclude = [...cfg.exclude, ...opts.exclude];
-  const files = walkRepo(root, { include, exclude });
-  const buckets = bucketByExtension(files);
-  const result = { entries: [], warnings: [] };
-  const tasks = [];
-  if (buckets[".py"]?.length) {
-    const { pythonScanner: pythonScanner2 } = await Promise.resolve().then(() => (init_python(), python_exports));
-    if (pythonScanner2.scanBatch) {
-      tasks.push(pythonScanner2.scanBatch(buckets[".py"], root));
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync9, copyFileSync as copyFileSync3, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname5, join as join19, relative as relative6 } from "path";
+function planMissingFiles(srcDir, destDir, label, planned) {
+  if (!existsSync16(srcDir))
+    return;
+  for (const entry of readdirSync9(srcDir, { withFileTypes: true })) {
+    const src = join19(srcDir, entry.name);
+    const dest = join19(destDir, entry.name);
+    if (entry.isDirectory()) {
+      planMissingFiles(src, dest, join19(label, entry.name), planned);
+      continue;
+    }
+    if (!existsSync16(dest)) {
+      planned.push({ src, dest, rel: join19(label, relative6(srcDir, src)) });
     }
   }
-  const jsFiles = [
-    ...buckets[".js"] ?? [],
-    ...buckets[".jsx"] ?? [],
-    ...buckets[".mjs"] ?? [],
-    ...buckets[".cjs"] ?? []
-  ];
-  if (jsFiles.length) {
-    const { jsScanner: jsScanner2 } = await Promise.resolve().then(() => (init_javascript(), javascript_exports));
-    tasks.push(scanInProcess(jsScanner2, jsFiles, root));
+}
+function planProviderGuidance(cwd, provider, planned) {
+  if (provider === "claude" || provider === "both") {
+    if (!existsSync16(join19(cwd, "CLAUDE.md"))) {
+      planned.push({ src: ASSET.claudeTemplate, dest: join19(cwd, "CLAUDE.md"), rel: "CLAUDE.md" });
+    }
+    if (!existsSync16(join19(cwd, "AGENTS.md"))) {
+      planned.push({ src: ASSET.agentsTemplate, dest: join19(cwd, "AGENTS.md"), rel: "AGENTS.md" });
+    }
   }
-  const tsFiles = [
-    ...buckets[".ts"] ?? [],
-    ...buckets[".tsx"] ?? []
-  ];
-  if (tsFiles.length) {
-    const { tsScanner: tsScanner2 } = await Promise.resolve().then(() => (init_typescript(), typescript_exports));
-    tasks.push(scanInProcess(tsScanner2, tsFiles, root));
+  if ((provider === "codex" || provider === "both") && !existsSync16(join19(cwd, "CODEX.md"))) {
+    planned.push({ src: ASSET.codexTemplate, dest: join19(cwd, "CODEX.md"), rel: "CODEX.md" });
   }
-  if (buckets[".vue"]?.length) {
-    const { vueScanner: vueScanner2 } = await Promise.resolve().then(() => (init_vue(), vue_exports));
-    tasks.push(scanInProcess(vueScanner2, buckets[".vue"], root));
+}
+function applyCopy(plan) {
+  for (const item of plan) {
+    mkdirSync8(dirname5(item.dest), { recursive: true });
+    copyFileSync3(item.src, item.dest);
   }
-  for (const r of await Promise.all(tasks)) {
-    result.entries.push(...r.entries);
-    result.warnings.push(...r.warnings);
+}
+async function upgrade(opts = {}) {
+  const cwd = process.cwd();
+  const requestedProvider = opts.provider ?? "auto";
+  if (!validateProviderOption(requestedProvider)) {
+    log.error(`Invalid provider: ${requestedProvider}. Use auto, claude, codex, or both.`);
+    process.exit(1);
   }
-  result.entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  for (const e of result.entries) {
-    if (e.total_lines > opts.maxLines) {
-      result.warnings.push({
-        path: e.path,
-        message: `file exceeds --max-lines (${e.total_lines} > ${opts.maxLines})`
+  const provider = inferProvider(cwd, requestedProvider);
+  const plan = [];
+  planMissingFiles(ASSET.contracts, join19(cwd, "contracts"), "contracts", plan);
+  planMissingFiles(ASSET.specsTemplates, join19(cwd, "specs", "templates"), "specs/templates", plan);
+  planMissingFiles(ASSET.testsTemplates, join19(cwd, "tests", "templates"), "tests/templates", plan);
+  planMissingFiles(ASSET.ci, join19(cwd, "ci"), "ci", plan);
+  planMissingFiles(ASSET.githubWorkflows, join19(cwd, ".github", "workflows"), ".github/workflows", plan);
+  planMissingFiles(ASSET.cddConfig, join19(cwd, ".cdd"), ".cdd", plan);
+  planProviderGuidance(cwd, provider, plan);
+  log.blank();
+  log.info(`Upgrade provider: ${provider}`);
+  if (plan.length === 0) {
+    log.ok("No missing cdd-kit project files found.");
+    if (opts.migrateChanges) {
+      log.blank();
+      log.info("Running change migration flow...");
+      await migrate(void 0, {
+        all: true,
+        dryRun: !opts.yes,
+        enableContextGovernance: opts.enableContextGovernance
       });
     }
+    log.blank();
+    return;
   }
-  const yamlBody = renderYaml(result.entries, { generator: `cdd-kit ${_pkg.version}` });
-  const totalSrc = result.entries.reduce((s, e) => s + e.total_lines, 0);
-  const mapLines = yamlBody.split("\n").length;
-  const compression = totalSrc === 0 ? 0 : totalSrc / mapLines;
-  const summaryLine = `scanned ${result.entries.length} files, ${totalSrc} src lines -> ${opts.out} (${mapLines} lines, compression ${compression.toFixed(1)}x)`;
-  for (const w of result.warnings) {
-    log.warn(`${w.path}: ${w.message}`);
+  log.info(`${plan.length} missing file(s) detected:`);
+  for (const item of plan)
+    log.dim(`  + ${item.rel.replace(/\\/g, "/")}`);
+  if (!opts.yes) {
+    log.blank();
+    log.info("Dry run only. Re-run with --yes to write missing files.");
+    if (opts.migrateChanges) {
+      log.blank();
+      log.info("Previewing existing change migration because --migrate-changes was requested.");
+      await migrate(void 0, {
+        all: true,
+        dryRun: true,
+        enableContextGovernance: opts.enableContextGovernance
+      });
+    }
+    log.blank();
+    return;
   }
-  if (opts.check) {
-    const existing = existsSync16(opts.out) ? readFileSync17(opts.out, "utf8") : "";
-    const normalize = (s) => s.replace(/^# generated: [^\n]+\n/m, "# generated: <normalized>\n");
-    if (normalize(existing) !== normalize(yamlBody)) {
-      log.error(`code-map out of date: ${opts.out} would change. Run \`cdd-kit code-map\` to regenerate.`);
-      return 1;
+  applyCopy(plan);
+  const modelPolicyPath = join19(cwd, ".cdd", "model-policy.json");
+  if (existsSync16(modelPolicyPath)) {
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync19(modelPolicyPath, "utf8"));
+    } catch {
     }
-    log.ok(`code-map up to date: ${opts.out}`);
-    return 0;
+    const merged = {
+      ...existing,
+      provider,
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      roles: existing.roles && typeof existing.roles === "object" ? existing.roles : {}
+    };
+    writeFileSync9(modelPolicyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
   }
-  mkdirSync8(dirname5(opts.out), { recursive: true });
-  writeFileSync9(opts.out, yamlBody, "utf8");
-  log.ok(`${summaryLine} (${Date.now() - start}ms)`);
-  return 0;
+  log.blank();
+  log.ok(`Upgrade complete: ${plan.length} missing file(s) added.`);
+  log.info("Existing project guidance and contracts were preserved.");
+  if (opts.migrateChanges) {
+    log.blank();
+    log.info("Running change migration flow...");
+    await migrate(void 0, {
+      all: true,
+      dryRun: false,
+      enableContextGovernance: opts.enableContextGovernance
+    });
+  }
+  log.blank();
 }
-var _require, _pkgPath, _pkg;
-var init_code_map = __esm({
-  "src/commands/code-map.ts"() {
+var init_upgrade = __esm({
+  "src/commands/upgrade.ts"() {
     "use strict";
+    init_paths();
     init_logger();
-    init_yaml_writer();
-    init_orchestrator();
-    init_config();
-    _require = createRequire(import.meta.url);
-    _pkgPath = join19(fileURLToPath2(import.meta.url), "..", "..", "..", "package.json");
-    _pkg = JSON.parse(readFileSync17(_pkgPath, "utf8"));
+    init_provider();
+    init_migrate();
   }
 });
 
@@ -9196,11 +9257,11 @@ var refresh_exports = {};
 __export(refresh_exports, {
   refresh: () => refresh
 });
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname6, join as join20, relative as relative5 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname6, join as join20, relative as relative7 } from "path";
+import { createHash as createHash6 } from "crypto";
 function fileHash2(filePath) {
-  return createHash4("sha256").update(readFileSync18(filePath)).digest("hex");
+  return createHash6("sha256").update(readFileSync20(filePath)).digest("hex");
 }
 function planForceRefresh(srcDir, destDir, sectionLabel) {
   const plan = [];
@@ -9222,7 +9283,7 @@ function planForceRefresh(srcDir, destDir, sectionLabel) {
       }
       if (!item.isFile())
         continue;
-      const rel = join20(sectionLabel, relative5(srcDir, sp)).replace(/\\/g, "/");
+      const rel = join20(sectionLabel, relative7(srcDir, sp)).replace(/\\/g, "/");
       if (!existsSync17(dp)) {
         plan.push({ src: sp, dest: dp, rel, action: "add" });
       } else if (fileHash2(sp) !== fileHash2(dp)) {
@@ -9252,7 +9313,7 @@ function ensureGitignoreEntry2(cwd, entry) {
   const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
   let existing = "";
   if (existsSync17(path))
-    existing = readFileSync18(path, "utf8");
+    existing = readFileSync20(path, "utf8");
   if (re.test(existing))
     return false;
   const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
@@ -9308,7 +9369,7 @@ function resyncModelPolicy(cwd) {
   const desired = {};
   const agentFiles = readdirSync10(AGENTS_HOME, { withFileTypes: true }).filter((d) => d.isFile() && d.name.endsWith(".md"));
   for (const f of agentFiles) {
-    const content = readFileSync18(join20(AGENTS_HOME, f.name), "utf8");
+    const content = readFileSync20(join20(AGENTS_HOME, f.name), "utf8");
     const fm = parseAgentFrontmatter(content);
     if (fm.name && fm.model)
       desired[fm.name] = fm.model;
@@ -9318,7 +9379,7 @@ function resyncModelPolicy(cwd) {
   let existing = {};
   if (existsSync17(policyPath)) {
     try {
-      existing = JSON.parse(readFileSync18(policyPath, "utf8"));
+      existing = JSON.parse(readFileSync20(policyPath, "utf8"));
     } catch {
     }
   }
@@ -9422,7 +9483,7 @@ async function refresh(opts) {
         templateOverwritten = result.overwritten;
         log.ok(`  applied: +${templateAdded} added, ~${templateOverwritten} overwritten`);
         if (templateOverwritten > 0) {
-          log.info(`  backup saved to: ${relative5(cwd, backupRoot).replace(/\\/g, "/")}`);
+          log.info(`  backup saved to: ${relative7(cwd, backupRoot).replace(/\\/g, "/")}`);
           if (ensureGitignoreEntry2(cwd, ".cdd/.refresh-backup/")) {
             log.info("  added `.cdd/.refresh-backup/` to .gitignore");
           }
@@ -9498,7 +9559,7 @@ async function refresh(opts) {
   if (apply) {
     log.ok("refresh complete.");
     if (backupRoot) {
-      log.info(`Backup of overwritten templates: ${relative5(cwd, backupRoot).replace(/\\/g, "/")}`);
+      log.info(`Backup of overwritten templates: ${relative7(cwd, backupRoot).replace(/\\/g, "/")}`);
     }
     log.info("Next: review changes with `git diff`, then commit:");
     log.dim("  git add .cdd/code-map.yml .cdd/model-policy.json specs/templates tests/templates ci-templates .github/workflows");
@@ -9527,9 +9588,9 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctor: () => doctor
 });
-import { existsSync as existsSync18, readdirSync as readdirSync11, readFileSync as readFileSync19 } from "fs";
-import { createHash as createHash5 } from "crypto";
-import { join as join21 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync11, readFileSync as readFileSync21 } from "fs";
+import { createHash as createHash7 } from "crypto";
+import { join as join21, relative as relative8 } from "path";
 function fileExists(cwd, relPath) {
   return existsSync18(join21(cwd, relPath));
 }
@@ -9545,21 +9606,17 @@ function findFiles(dir, predicate, found = []) {
   }
   return found;
 }
-function sha256OfFile3(path) {
-  try {
-    return createHash5("sha256").update(readFileSync19(path)).digest("hex");
-  } catch {
-    return "";
-  }
-}
-function inputDigest(paths) {
-  const combined = paths.slice().sort().map((p) => `${p}:${sha256OfFile3(p)}`).join("\n");
-  return createHash5("sha256").update(combined).digest("hex");
+function inputDigest(paths, cwd) {
+  const combined = paths.slice().sort().map((p) => {
+    const rel = relative8(cwd, p).replace(/\\/g, "/");
+    return `${rel}:${sha256OfFileNormalized(p)}`;
+  }).join("\n");
+  return createHash7("sha256").update(combined).digest("hex");
 }
 function readContextIndexMetadata(filePath) {
   if (!existsSync18(filePath))
     return {};
-  const text = readFileSync19(filePath, "utf8");
+  const text = readFileSync21(filePath, "utf8");
   const out = {};
   const digestMatch = text.match(/^inputs-digest:\s*([a-f0-9]+)/m);
   if (digestMatch)
@@ -9587,7 +9644,7 @@ function checkContextFreshness(cwd) {
   }
   const projectMapMeta = readContextIndexMetadata(projectMap);
   const contractsIndexMeta = readContextIndexMetadata(contractsIndex);
-  const projectInputDigest = inputDigest([contextPolicy].filter(existsSync18));
+  const projectInputDigest = inputDigest([contextPolicy].filter(existsSync18), cwd);
   if (projectMapMeta.inputsDigest === void 0) {
     findings.push({
       level: "warning",
@@ -9599,7 +9656,7 @@ function checkContextFreshness(cwd) {
       message: "specs/context/project-map.md inputs changed (.cdd/context-policy.json); re-run cdd-kit context-scan"
     });
   }
-  const contractsInputDigest = inputDigest(contractFiles);
+  const contractsInputDigest = inputDigest(contractFiles, cwd);
   if (contractsIndexMeta.inputsDigest === void 0) {
     findings.push({
       level: "warning",
@@ -9624,7 +9681,7 @@ function checkContextFreshness(cwd) {
 }
 function readAgentModel(path) {
   try {
-    const text = readFileSync19(path, "utf8");
+    const text = readFileSync21(path, "utf8");
     const m = text.match(/^model:\s*(\S+)/m);
     return m ? m[1] : null;
   } catch {
@@ -9637,7 +9694,7 @@ function checkModelPolicyDrift(cwd) {
     return [];
   let policy;
   try {
-    policy = JSON.parse(readFileSync19(policyPath, "utf8"));
+    policy = JSON.parse(readFileSync21(policyPath, "utf8"));
   } catch {
     return [{ level: "warning", message: ".cdd/model-policy.json is not valid JSON" }];
   }
@@ -9738,7 +9795,7 @@ function checkCodeMap(cwd) {
     const more = probe.staleCount > 3 ? ` (+${probe.staleCount - 3} more)` : "";
     findings.push({ level: "warning", message: `code-map stale: ${top}${more}; run \`cdd-kit code-map\`` });
   }
-  const text = readFileSync19(mapPath, "utf8");
+  const text = readFileSync21(mapPath, "utf8");
   const m = text.match(/^# files: (\d+), src-lines: (\d+), map-lines: (\d+), compression: ([\d.]+)x/m);
   if (m) {
     findings.push({ level: "ok", message: `code-map: ${m[1]} files, ${m[4]}x compression` });
@@ -9818,7 +9875,7 @@ async function attemptAutoFixes(cwd, report) {
       try {
         let existing = {};
         try {
-          existing = JSON.parse(readFileSync19(policyPath, "utf8"));
+          existing = JSON.parse(readFileSync21(policyPath, "utf8"));
         } catch {
         }
         const merged = {
@@ -9911,6 +9968,7 @@ var init_doctor = __esm({
     init_logger();
     init_provider();
     init_freshness();
+    init_digest();
   }
 });
 
@@ -9919,7 +9977,7 @@ var lint_agents_exports = {};
 __export(lint_agents_exports, {
   lintAgents: () => lintAgents
 });
-import { readdirSync as readdirSync12, readFileSync as readFileSync20 } from "fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync22 } from "fs";
 import { join as join22 } from "path";
 import { load as yamlLoad2 } from "js-yaml";
 function extractRequiredArtifactsSection(content) {
@@ -9974,7 +10032,7 @@ async function lintAgents(opts) {
     const filePath = join22(agentsDir, filename);
     let content;
     try {
-      content = readFileSync20(filePath, "utf8");
+      content = readFileSync22(filePath, "utf8");
     } catch {
       violations.push({
         file: filename,
@@ -10087,7 +10145,7 @@ __export(archive_exports, {
   archive: () => archive
 });
 import { join as join23 } from "path";
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync21, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync23, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
 import yaml4 from "js-yaml";
 async function archive(changeId) {
   const cwd = process.cwd();
@@ -10107,7 +10165,7 @@ async function archive(changeId) {
   const tasksPath = join23(changeDir, "tasks.yml");
   if (existsSync19(tasksPath)) {
     try {
-      const raw = readFileSync21(tasksPath, "utf8");
+      const raw = readFileSync23(tasksPath, "utf8");
       const data = yaml4.load(raw);
       if (data?.status === "gate-blocked") {
         log.warn("tasks.yml has status: gate-blocked \u2014 archiving anyway (change was paused).");
@@ -10163,7 +10221,7 @@ __export(abandon_exports, {
   abandon: () => abandon
 });
 import { join as join24 } from "path";
-import { existsSync as existsSync20, readFileSync as readFileSync22, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync24, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import yaml5 from "js-yaml";
 async function abandon(changeId, opts) {
   const cwd = process.cwd();
@@ -10174,7 +10232,7 @@ async function abandon(changeId, opts) {
     process.exit(1);
   }
   if (existsSync20(tasksPath)) {
-    const raw = readFileSync22(tasksPath, "utf8");
+    const raw = readFileSync24(tasksPath, "utf8");
     const data = yaml5.load(raw) ?? {};
     data["status"] = "abandoned";
     if (!data["change-id"]) {
@@ -10217,7 +10275,7 @@ __export(list_changes_exports, {
   listChanges: () => listChanges
 });
 import { join as join25 } from "path";
-import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync25 } from "fs";
 import yaml6 from "js-yaml";
 async function listChanges() {
   const cwd = process.cwd();
@@ -10237,7 +10295,7 @@ async function listChanges() {
       let pending = 0;
       if (existsSync21(tasksPath)) {
         try {
-          const raw = readFileSync23(tasksPath, "utf8");
+          const raw = readFileSync25(tasksPath, "utf8");
           const data = yaml6.load(raw);
           if (data?.status)
             status = data.status;
@@ -10268,7 +10326,7 @@ __export(context_exports, {
   rejectContextExpansion: () => rejectContextExpansion,
   requestContextExpansion: () => requestContextExpansion
 });
-import { existsSync as existsSync22, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "fs";
 import { join as join26 } from "path";
 function normalizePath(path) {
   return path.replace(/\\/g, "/").replace(/^\.\//, "").trim();
@@ -10291,7 +10349,7 @@ function readManifest(changeId) {
     log.error(`context manifest not found: specs/changes/${changeId}/context-manifest.md`);
     process.exit(1);
   }
-  return readFileSync24(manifestPath, "utf8");
+  return readFileSync26(manifestPath, "utf8");
 }
 function writeManifest(changeId, content) {
   writeFileSync13(manifestPathFor(changeId), content.endsWith("\n") ? content : `${content}
@@ -10519,7 +10577,7 @@ var init_context = __esm({
 });
 
 // src/cli/index.ts
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { dirname as dirname7, join as join27 } from "path";
 import { Command } from "commander";
@@ -10941,22 +10999,19 @@ init_update();
 
 // src/commands/new-change.ts
 init_paths();
-import { join as join9 } from "path";
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9, relative as relative3 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
 import yaml from "js-yaml";
 init_logger();
 init_context_scan();
-function sha256OfFile2(path) {
-  try {
-    return createHash3("sha256").update(readFileSync7(path)).digest("hex");
-  } catch {
-    return "";
-  }
-}
-function inputsDigest2(paths) {
-  const combined = paths.slice().sort().map((p) => `${p}:${sha256OfFile2(p)}`).join("\n");
-  return createHash3("sha256").update(combined).digest("hex");
+init_digest();
+function inputsDigest2(paths, cwd) {
+  const combined = paths.slice().sort().map((p) => {
+    const rel = relative3(cwd, p).replace(/\\/g, "/");
+    return `${rel}:${sha256OfFileNormalized(p)}`;
+  }).join("\n");
+  return createHash4("sha256").update(combined).digest("hex");
 }
 function findContractFiles2(dir, found = []) {
   if (!existsSync8(dir))
@@ -10974,7 +11029,7 @@ function findContractFiles2(dir, found = []) {
 function readIndexDigest(filePath) {
   if (!existsSync8(filePath))
     return null;
-  const m = readFileSync7(filePath, "utf8").match(/^inputs-digest:\s*([a-f0-9]+)/m);
+  const m = readFileSync8(filePath, "utf8").match(/^inputs-digest:\s*([a-f0-9]+)/m);
   return m ? m[1] : null;
 }
 async function ensureFreshContextIndexes(cwd) {
@@ -10983,8 +11038,8 @@ async function ensureFreshContextIndexes(cwd) {
   const policyPath = join9(cwd, ".cdd", "context-policy.json");
   const policyInputs = [policyPath].filter(existsSync8);
   const contractFiles = findContractFiles2(join9(cwd, "contracts"));
-  const wantProjectDigest = inputsDigest2(policyInputs);
-  const wantContractsDigest = inputsDigest2(contractFiles);
+  const wantProjectDigest = inputsDigest2(policyInputs, cwd);
+  const wantContractsDigest = inputsDigest2(contractFiles, cwd);
   const haveProjectDigest = readIndexDigest(projectMap);
   const haveContractsDigest = readIndexDigest(contractsIndex);
   const needsScan = !existsSync8(projectMap) || !existsSync8(contractsIndex) || haveProjectDigest !== wantProjectDigest || haveContractsDigest !== wantContractsDigest;
@@ -11066,7 +11121,7 @@ async function newChange(name, opts) {
   if (dependencies.length > 0) {
     const tasksPath = join9(changeDir, "tasks.yml");
     if (existsSync8(tasksPath)) {
-      const raw = readFileSync7(tasksPath, "utf8");
+      const raw = readFileSync8(tasksPath, "utf8");
       const data = yaml.load(raw) ?? {};
       data["depends-on"] = dependencies;
       writeFileSync4(tasksPath, yaml.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
@@ -11170,9 +11225,9 @@ async function validate(opts) {
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 init_logger();
-import { existsSync as existsSync12, readFileSync as readFileSync9, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 import yaml2 from "js-yaml";
 import picomatch2 from "picomatch";
 
@@ -11350,15 +11405,15 @@ function parseContextManifest(content) {
 }
 function extractRequiredArtifactTypes(cwd, agentName) {
   const candidates = [
-    join14(cwd, ".claude", "agents", `${agentName}.md`),
-    join14(homedir3(), ".claude", "agents", `${agentName}.md`)
+    join16(cwd, ".claude", "agents", `${agentName}.md`),
+    join16(homedir3(), ".claude", "agents", `${agentName}.md`)
   ];
   let content = null;
   for (const candidate of candidates) {
-    if (!existsSync12(candidate))
+    if (!existsSync13(candidate))
       continue;
     try {
-      content = readFileSync9(candidate, "utf8");
+      content = readFileSync16(candidate, "utf8");
       break;
     } catch {
     }
@@ -11395,11 +11450,11 @@ function loadContextPolicy(cwd) {
       unknownFilesRead: "warn-for-legacy-fail-for-new"
     }
   };
-  const policyPath = join14(cwd, ".cdd", "context-policy.json");
-  if (!existsSync12(policyPath))
+  const policyPath = join16(cwd, ".cdd", "context-policy.json");
+  if (!existsSync13(policyPath))
     return defaults;
   try {
-    const custom = JSON.parse(readFileSync9(policyPath, "utf8"));
+    const custom = JSON.parse(readFileSync16(policyPath, "utf8"));
     return {
       ...defaults,
       ...custom,
@@ -11413,7 +11468,7 @@ function loadContextPolicy(cwd) {
 }
 function loadYamlFile(path) {
   try {
-    const raw = readFileSync9(path, "utf8");
+    const raw = readFileSync16(path, "utf8");
     return { data: yaml2.load(raw), parseError: null };
   } catch (err) {
     return { data: null, parseError: err.message };
@@ -11444,8 +11499,8 @@ function ajvErrorsToMessages(errors, prefix, knownKeys) {
   return out;
 }
 function isContextGovernedChange(changeDir) {
-  const tasksPath = join14(changeDir, "tasks.yml");
-  if (!existsSync12(tasksPath))
+  const tasksPath = join16(changeDir, "tasks.yml");
+  if (!existsSync13(tasksPath))
     return false;
   const { data } = loadYamlFile(tasksPath);
   return data?.["context-governance"] === "v1";
@@ -11473,12 +11528,12 @@ function lintTasksFile(tasksPath, errors, warnings) {
   return data;
 }
 function resolveTier(changeDir) {
-  const classifPath = join14(changeDir, "change-classification.md");
-  const classificationPresent = existsSync12(classifPath);
-  const classificationText = classificationPresent ? readFileSync9(classifPath, "utf8") : "";
+  const classifPath = join16(changeDir, "change-classification.md");
+  const classificationPresent = existsSync13(classifPath);
+  const classificationText = classificationPresent ? readFileSync16(classifPath, "utf8") : "";
   const classificationHasLooseMarker = classificationPresent && TIER_PATTERN.test(classificationText);
-  const tasksPath = join14(changeDir, "tasks.yml");
-  if (existsSync12(tasksPath)) {
+  const tasksPath = join16(changeDir, "tasks.yml");
+  if (existsSync13(tasksPath)) {
     const { data } = loadYamlFile(tasksPath);
     const t = data?.tier;
     if (typeof t === "number" && t >= 0 && t <= 5) {
@@ -11524,7 +11579,7 @@ function enforceTierRequirements(changeDir, agentLogDir, errors, warnings) {
     return;
   }
   const tier = resolution.tier;
-  const agentLogFiles = agentLogDir && existsSync12(agentLogDir) ? readdirSync7(agentLogDir).map((f) => f.replace(/\.ya?ml$/, "")) : [];
+  const agentLogFiles = agentLogDir && existsSync13(agentLogDir) ? readdirSync7(agentLogDir).map((f) => f.replace(/\.ya?ml$/, "")) : [];
   if (tier <= 1) {
     for (const required of ["e2e-resilience-engineer", "monkey-test-engineer", "stress-soak-engineer"]) {
       if (!agentLogFiles.includes(required)) {
@@ -11540,7 +11595,7 @@ function enforceTierRequirements(changeDir, agentLogDir, errors, warnings) {
     }
   }
   if (resolution.source === "tasks-frontmatter" && resolution.classificationPresent) {
-    const text = readFileSync9(join14(changeDir, "change-classification.md"), "utf8");
+    const text = readFileSync16(join16(changeDir, "change-classification.md"), "utf8");
     const structured = text.match(/^## Tier\s*\n\s*-\s*(\d)\s*$/m);
     const bold = text.match(/\*\*Tier:\*\*\s*Tier\s*(\d)\b/i);
     const classifTier = structured ? parseInt(structured[1], 10) : bold ? parseInt(bold[1], 10) : NaN;
@@ -11552,11 +11607,11 @@ function enforceTierRequirements(changeDir, agentLogDir, errors, warnings) {
   }
 }
 function isArchivedChange(cwd, changeId) {
-  const archiveRoot = join14(cwd, "specs", "archive");
-  if (!existsSync12(archiveRoot))
+  const archiveRoot = join16(cwd, "specs", "archive");
+  if (!existsSync13(archiveRoot))
     return false;
   const years = readdirSync7(archiveRoot, { withFileTypes: true }).filter((d) => d.isDirectory());
-  return years.some((year) => existsSync12(join14(archiveRoot, year.name, changeId)));
+  return years.some((year) => existsSync13(join16(archiveRoot, year.name, changeId)));
 }
 function detectDependencyCycle(cwd, startChangeId) {
   const visited = /* @__PURE__ */ new Set();
@@ -11569,8 +11624,8 @@ function detectDependencyCycle(cwd, startChangeId) {
       return null;
     visited.add(id);
     stack.push(id);
-    const tasksPath = join14(cwd, "specs", "changes", id, "tasks.yml");
-    if (existsSync12(tasksPath)) {
+    const tasksPath = join16(cwd, "specs", "changes", id, "tasks.yml");
+    if (existsSync13(tasksPath)) {
       const { data } = loadYamlFile(tasksPath);
       const deps = data?.["depends-on"] ?? [];
       for (const dep of deps) {
@@ -11585,8 +11640,8 @@ function detectDependencyCycle(cwd, startChangeId) {
   return visit(startChangeId);
 }
 function validateDependencies(cwd, changeId, changeDir) {
-  const tasksPath = join14(changeDir, "tasks.yml");
-  if (!existsSync12(tasksPath))
+  const tasksPath = join16(changeDir, "tasks.yml");
+  if (!existsSync13(tasksPath))
     return [];
   const { data } = loadYamlFile(tasksPath);
   const dependencies = data?.["depends-on"] ?? [];
@@ -11600,10 +11655,10 @@ function validateDependencies(cwd, changeId, changeDir) {
       errors.push(`tasks.yml: change cannot depend on itself (${dep})`);
       continue;
     }
-    const upstreamDir = join14(cwd, "specs", "changes", dep);
-    if (existsSync12(upstreamDir)) {
-      const upstreamTasks = join14(upstreamDir, "tasks.yml");
-      if (!existsSync12(upstreamTasks)) {
+    const upstreamDir = join16(cwd, "specs", "changes", dep);
+    if (existsSync13(upstreamDir)) {
+      const upstreamTasks = join16(upstreamDir, "tasks.yml");
+      if (!existsSync13(upstreamTasks)) {
         errors.push(`dependency ${dep}: missing tasks.yml`);
         continue;
       }
@@ -11624,8 +11679,8 @@ async function gate(changeId, opts = {}) {
   const strict = opts.strict ?? false;
   const lax = opts.lax ?? false;
   const cwd = process.cwd();
-  const changeDir = join14(cwd, "specs", "changes", changeId);
-  if (!existsSync12(changeDir)) {
+  const changeDir = join16(cwd, "specs", "changes", changeId);
+  if (!existsSync13(changeDir)) {
     log.error(`change not found: ${changeId} (looked in ${changeDir})`);
     process.exit(1);
   }
@@ -11651,13 +11706,13 @@ async function gate(changeId, opts = {}) {
   }
   const contextPolicy = loadContextPolicy(cwd);
   const isNewChange = isContextGovernedChange(changeDir);
-  const manifestPath = join14(changeDir, "context-manifest.md");
-  const hasManifest = existsSync12(manifestPath);
+  const manifestPath = join16(changeDir, "context-manifest.md");
+  const hasManifest = existsSync13(manifestPath);
   let allowedPaths = [];
   let approvedExpansions = [];
   errors.push(...validateDependencies(cwd, changeId, changeDir));
   if (hasManifest) {
-    const manifest = parseContextManifest(readFileSync9(manifestPath, "utf8"));
+    const manifest = parseContextManifest(readFileSync16(manifestPath, "utf8"));
     allowedPaths = manifest.allowedPaths;
     approvedExpansions = manifest.approvedExpansions;
     if (manifest.pendingExpansions > 0) {
@@ -11675,7 +11730,7 @@ async function gate(changeId, opts = {}) {
       }
       continue;
     }
-    if (!existsSync12(join14(changeDir, f))) {
+    if (!existsSync13(join16(changeDir, f))) {
       errors.push(`missing required artifact: ${f}`);
     }
   }
@@ -11685,21 +11740,21 @@ async function gate(changeId, opts = {}) {
         continue;
       if (f === "tasks.yml")
         continue;
-      const content = readFileSync9(join14(changeDir, f), "utf8");
+      const content = readFileSync16(join16(changeDir, f), "utf8");
       const minChars = MIN_CHARS[f] ?? 100;
       if (meaningfulChars(content) < minChars) {
         errors.push(`${f}: appears to be a stub (< ${minChars} meaningful chars)`);
       }
     }
-    const classifPath = join14(changeDir, "change-classification.md");
+    const classifPath = join16(changeDir, "change-classification.md");
     const tierResolution = resolveTier(changeDir);
-    if (tierResolution.tier === null && existsSync12(classifPath) && !tierResolution.classificationHasLooseMarker) {
+    if (tierResolution.tier === null && existsSync13(classifPath) && !tierResolution.classificationHasLooseMarker) {
       errors.push("change-classification.md: missing tier/risk marker (set tier in tasks.yml frontmatter, or include Tier 0-5 / low|medium|high|critical in change-classification.md)");
     }
   }
-  const tasksPath = join14(changeDir, "tasks.yml");
+  const tasksPath = join16(changeDir, "tasks.yml");
   let tasksData = null;
-  if (existsSync12(tasksPath)) {
+  if (existsSync13(tasksPath)) {
     tasksData = lintTasksFile(tasksPath, errors, warnings);
   }
   if (tasksData) {
@@ -11713,11 +11768,11 @@ async function gate(changeId, opts = {}) {
       }
     }
   }
-  const agentLogDir = join14(changeDir, "agent-log");
-  if (existsSync12(agentLogDir)) {
+  const agentLogDir = join16(changeDir, "agent-log");
+  if (existsSync13(agentLogDir)) {
     const logFiles = readdirSync7(agentLogDir).filter((f) => f.endsWith(".yml"));
     for (const f of logFiles) {
-      const fullPath = join14(agentLogDir, f);
+      const fullPath = join16(agentLogDir, f);
       const { data, parseError } = loadYamlFile(fullPath);
       if (parseError) {
         errors.push(`agent-log/${f}: invalid YAML: ${parseError}`);
@@ -11785,9 +11840,9 @@ async function gate(changeId, opts = {}) {
             errors.push(`agent-log/${f}: read unauthorized path -> ${p} (not in allowed paths or approved expansions)`);
           }
         }
-        const runtimeLog = join14(cwd, ".cdd", "runtime", `${changeId}-files-read.jsonl`);
-        if (existsSync12(runtimeLog)) {
-          const runtimePaths = readFileSync9(runtimeLog, "utf8").split("\n").filter(Boolean).map((line) => {
+        const runtimeLog = join16(cwd, ".cdd", "runtime", `${changeId}-files-read.jsonl`);
+        if (existsSync13(runtimeLog)) {
+          const runtimePaths = readFileSync16(runtimeLog, "utf8").split("\n").filter(Boolean).map((line) => {
             try {
               return JSON.parse(line).path;
             } catch {
@@ -11823,8 +11878,8 @@ async function gate(changeId, opts = {}) {
             continue;
           const pathPart = pointer.split(":")[0];
           if (pathPart.includes("/") && !pointer.startsWith("http")) {
-            const abs = join14(cwd, pathPart);
-            if (!existsSync12(abs)) {
+            const abs = join16(cwd, pathPart);
+            if (!existsSync13(abs)) {
               errors.push(`agent-log/${f}: artifact pointer not found: ${pathPart}`);
             }
           }
@@ -11873,26 +11928,26 @@ async function gate(changeId, opts = {}) {
 // src/commands/install-hooks.ts
 init_paths();
 init_logger();
-import { existsSync as existsSync13, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync as chmodSync2, mkdirSync as mkdirSync5 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync17, writeFileSync as writeFileSync7, chmodSync as chmodSync2, mkdirSync as mkdirSync6 } from "fs";
+import { join as join17 } from "path";
 var START_MARKER2 = "# cdd-kit-managed-block-start";
 var END_MARKER2 = "# cdd-kit-managed-block-end";
 async function installHooks() {
   const cwd = process.cwd();
-  const gitDir = join15(cwd, ".git");
-  if (!existsSync13(gitDir)) {
+  const gitDir = join17(cwd, ".git");
+  if (!existsSync14(gitDir)) {
     log.error("not a git repository (no .git/ found in cwd)");
     process.exit(1);
   }
-  const hooksDir = join15(gitDir, "hooks");
-  mkdirSync5(hooksDir, { recursive: true });
-  const dest = join15(hooksDir, "pre-commit");
-  const ourHook = readFileSync10(join15(ASSET.hooks, "pre-commit"), "utf8");
+  const hooksDir = join17(gitDir, "hooks");
+  mkdirSync6(hooksDir, { recursive: true });
+  const dest = join17(hooksDir, "pre-commit");
+  const ourHook = readFileSync17(join17(ASSET.hooks, "pre-commit"), "utf8");
   let final;
-  if (!existsSync13(dest)) {
+  if (!existsSync14(dest)) {
     final = ourHook;
   } else {
-    const existing = readFileSync10(dest, "utf8");
+    const existing = readFileSync17(dest, "utf8");
     const startIdx = existing.indexOf(START_MARKER2);
     const endIdx = existing.indexOf(END_MARKER2);
     if (startIdx >= 0 && endIdx > startIdx) {
@@ -11916,7 +11971,7 @@ async function installHooks() {
       }
     }
   }
-  writeFileSync5(dest, final, "utf8");
+  writeFileSync7(dest, final, "utf8");
   try {
     chmodSync2(dest, 493);
   } catch {
@@ -11927,7 +11982,7 @@ async function installHooks() {
 
 // src/cli/index.ts
 var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync25(join27(__dirname2, "..", "..", "package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync27(join27(__dirname2, "..", "..", "package.json"), "utf8"));
 var program = new Command();
 program.name("cdd-kit").description("Contract-Driven Delivery Kit CLI").version(pkg.version);
 program.command("init").description(