overlane 0.1.123 → 0.1.124

package/dist/overlane.mjs

@@ -23049,6 +23049,375 @@ var init_code_map = __esm({
   }
 });
 
+// ../contracts/src/plans.ts
+var PLAN_IDS, BillingPlanId, CHECKOUT_PLANS, CheckoutPlanId, METERS, Meter, AllowanceValue, PlanAllowances, PlanData, OverageRates, FreeTierControls, PlanCatalog, TenantPlanLimits;
+var init_plans = __esm({
+  "../contracts/src/plans.ts"() {
+    "use strict";
+    init_zod();
+    PLAN_IDS = ["free", "pro", "team", "business", "enterprise"];
+    BillingPlanId = external_exports.enum(PLAN_IDS);
+    CHECKOUT_PLANS = ["pro", "team", "business"];
+    CheckoutPlanId = external_exports.enum(CHECKOUT_PLANS);
+    METERS = ["reviews", "ciMinutes", "docsCalls", "hostedInference"];
+    Meter = external_exports.enum(METERS);
+    AllowanceValue = external_exports.union([external_exports.number().int().nonnegative(), external_exports.literal("unlimited"), external_exports.null()]);
+    PlanAllowances = external_exports.object({
+      privateProjects: AllowanceValue,
+      tasks: AllowanceValue,
+      reviews: AllowanceValue,
+      docsCalls: AllowanceValue,
+      ciMinutes: AllowanceValue
+    }).strict();
+    PlanData = external_exports.object({
+      id: BillingPlanId,
+      name: external_exports.string().min(1),
+      audience: external_exports.string().min(1),
+      /** Per month (per seat for per-seat plans), billed monthly. Null for Free and Enterprise. */
+      monthlyCents: external_exports.number().int().positive().nullable(),
+      /** Per month (per seat for per-seat plans), billed annually. */
+      annualMonthlyCents: external_exports.number().int().positive().nullable(),
+      unit: external_exports.enum(["free", "month", "seat / month", "custom"]),
+      perSeat: external_exports.boolean(),
+      /** Seat allowances are pooled across the workspace (Team) rather than held per person (REQ-BIL-07). */
+      pooled: external_exports.boolean(),
+      minimumSeats: external_exports.number().int().positive().optional(),
+      maximumSeats: external_exports.number().int().positive().optional(),
+      /** An allowance on a per-seat plan is per seat; on a workspace plan (Free) it is for the whole workspace. */
+      allowances: PlanAllowances,
+      /** Observability retention in days; null when the plan states none. */
+      retentionDays: external_exports.number().int().positive().nullable(),
+      /** Memory levels, as shown on the pricing page. */
+      memory: external_exports.string().nullable(),
+      /** Whether usage beyond an allowance is billed. Free has no card on file, so it stops instead (REQ-BIL-11). */
+      overage: external_exports.boolean()
+    }).strict();
+    OverageRates = external_exports.object({
+      /** Micro-dollars per review beyond the allowance ($0.10). */
+      reviewMicros: external_exports.number().int().positive(),
+      /** Micro-dollars per CI minute beyond the allowance ($0.006). */
+      ciMinuteMicros: external_exports.number().int().positive(),
+      /** Markup on hosted inference and compute at provider cost, in basis points (10% = 1000). BYOK is free. */
+      hostedMarkupBps: external_exports.number().int().nonnegative()
+    }).strict();
+    FreeTierControls = external_exports.object({
+      /** CPU seconds one CI job may use on a plan with no card on file. */
+      ciJobCpuSeconds: external_exports.number().int().positive(),
+      /** Requests per minute per tenant on Free, and on a paid plan. */
+      requestsPerMinute: external_exports.number().int().positive(),
+      paidRequestsPerMinute: external_exports.number().int().positive(),
+      /** Only when the person has chosen to connect an account on another service (GitHub, GitLab, ...): how old it must be. No account is ever required (ADR 0050). */
+      minimumConnectedAccountAgeDays: external_exports.number().int().nonnegative(),
+      /** CI beyond the free allowance needs a card, which means a paid plan. */
+      cardRequiredForCiBeyondAllowance: external_exports.literal(true)
+    }).strict();
+    PlanCatalog = external_exports.object({
+      version: external_exports.literal("1"),
+      currency: external_exports.literal("USD"),
+      /** Every plan, in order. */
+      plans: external_exports.array(PlanData).length(PLAN_IDS.length),
+      overage: OverageRates,
+      /** Length of the failed-payment grace period, in days, before any restriction (REQ-BIL-09). */
+      graceDays: external_exports.number().int().positive(),
+      /** Days before the end of grace that a reminder notice is sent. */
+      graceReminderDays: external_exports.array(external_exports.number().int().positive()),
+      freeTier: FreeTierControls
+    }).strict().superRefine((catalog, ctx) => {
+      catalog.plans.forEach((plan3, index) => {
+        if (plan3.id !== PLAN_IDS[index]) ctx.addIssue({ code: "custom", path: ["plans", index, "id"], message: `plans are listed in order: expected ${PLAN_IDS[index]}` });
+        if (plan3.monthlyCents === null !== (plan3.annualMonthlyCents === null)) ctx.addIssue({ code: "custom", path: ["plans", index], message: "monthly and annual prices are both set or both null" });
+        if (plan3.monthlyCents !== null && plan3.annualMonthlyCents !== null && plan3.annualMonthlyCents >= plan3.monthlyCents) {
+          ctx.addIssue({ code: "custom", path: ["plans", index, "annualMonthlyCents"], message: "annual billing is cheaper per month" });
+        }
+      });
+    });
+    TenantPlanLimits = external_exports.object({
+      tenantId: external_exports.string().min(1),
+      plan: BillingPlanId,
+      seats: external_exports.number().int().positive(),
+      /** Total for the workspace this period: per-seat allowance times seats on a per-seat plan. */
+      allowances: PlanAllowances,
+      retentionDays: external_exports.number().int().positive().nullable(),
+      /** True once the tenant is past a downgrade or grace restriction: reads work, writes do not (REQ-BIL-06, REQ-BIL-09). */
+      readOnly: external_exports.boolean(),
+      /** Whether usage beyond an allowance is billed (true) or refused (false). */
+      overage: external_exports.boolean(),
+      periodStart: external_exports.iso.datetime({ offset: true }),
+      periodEnd: external_exports.iso.datetime({ offset: true })
+    }).strict();
+  }
+});
+
+// ../contracts/src/billing.ts
+var BillingInterval, SUBSCRIPTION_STATUSES, SubscriptionStatus, Subscription, Seat, UsageEventInput, UsageEvent, RecordUsageResponse, INVOICE_STATUSES, InvoiceStatus, InvoiceLine, Invoice, GRACE_STATES, GraceState, GraceNotice, Grace, CAP_SCOPES, CapScope, Cap, PutCapRequest, DeleteCapRequest, MeterUsage, UsageSummary, CheckoutRequest, CheckoutResponse, ChangePlanRequest, OverLimit, ChangePlanResponse, SeatChangeRequest, SeatChangeResponse, CancelRequest, PortalResponse, BillingStatus, UsageDecision, STRIPE_EVENT_TYPES, StripeEventType, epochSeconds, StripeSubscriptionObject, StripeInvoiceObject, StripeCheckoutObject, StripeEvent, WEBHOOK_OUTCOMES, WebhookOutcome, WebhookResult, billingPaths;
+var init_billing = __esm({
+  "../contracts/src/billing.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_plans();
+    BillingInterval = external_exports.enum(["month", "year"]);
+    SUBSCRIPTION_STATUSES = ["active", "past_due", "canceled", "incomplete"];
+    SubscriptionStatus = external_exports.enum(SUBSCRIPTION_STATUSES);
+    Subscription = external_exports.object({
+      tenantId: TenantId,
+      plan: BillingPlanId,
+      interval: BillingInterval,
+      seats: external_exports.number().int().positive(),
+      status: SubscriptionStatus,
+      stripeCustomerId: external_exports.string().min(1).optional(),
+      stripeSubscriptionId: external_exports.string().min(1).optional(),
+      currentPeriodStart: Timestamp,
+      currentPeriodEnd: Timestamp,
+      cancelAtPeriodEnd: external_exports.boolean(),
+      /** Set by a downgrade over the new limits or by the end of a failed-payment grace period. Reads work; writes are refused; nothing is deleted (REQ-BIL-06). */
+      readOnly: external_exports.boolean(),
+      readOnlyReason: external_exports.enum(["downgrade_over_limit", "payment_failed"]).optional(),
+      updatedAt: Timestamp
+    }).strict();
+    Seat = external_exports.object({
+      tenantId: TenantId,
+      purchased: external_exports.number().int().positive(),
+      minimum: external_exports.number().int().positive(),
+      maximum: external_exports.number().int().positive().nullable(),
+      assigned: external_exports.number().int().nonnegative()
+    }).strict();
+    UsageEventInput = external_exports.object({
+      meter: Meter,
+      quantity: external_exports.number().int().positive().max(1e9),
+      idempotencyKey: external_exports.string().min(1).max(200),
+      /** When the usage happened (not when it arrived). */
+      at: Timestamp,
+      feature: external_exports.string().min(1).max(64).optional(),
+      projectId: external_exports.string().min(1).max(128).optional(),
+      agentId: external_exports.string().min(1).max(128).optional(),
+      /** Provider cost in micro-dollars, for hosted inference. The platform adds the markup. */
+      costMicros: external_exports.number().int().nonnegative().optional()
+    }).strict();
+    UsageEvent = UsageEventInput.extend({
+      tenantId: TenantId,
+      /** Monotonic per tenant, assigned when first recorded; a replay returns the first one. */
+      sequence: external_exports.number().int().positive(),
+      /** Start of the billing period whose invoice carries this usage. Late usage after an invoice closed lands on the next one (REQ-BIL-08). */
+      periodStart: Timestamp,
+      receivedAt: Timestamp,
+      /** True when the event arrived after its own period's invoice closed. */
+      late: external_exports.boolean()
+    }).strict();
+    RecordUsageResponse = external_exports.object({ event: UsageEvent, duplicate: external_exports.boolean() }).strict();
+    INVOICE_STATUSES = ["draft", "open", "paid", "void", "uncollectible"];
+    InvoiceStatus = external_exports.enum(INVOICE_STATUSES);
+    InvoiceLine = external_exports.object({
+      kind: external_exports.enum(["subscription", "proration", "usage"]),
+      meter: Meter.optional(),
+      description: external_exports.string().min(1).max(200),
+      quantity: external_exports.number().int().nonnegative(),
+      unitMicros: external_exports.number().int().nonnegative().optional(),
+      amountCents: external_exports.number().int()
+    }).strict();
+    Invoice = external_exports.object({
+      tenantId: TenantId,
+      invoiceId: external_exports.string().min(1),
+      status: InvoiceStatus,
+      periodStart: Timestamp,
+      periodEnd: Timestamp,
+      lines: external_exports.array(InvoiceLine),
+      totalCents: external_exports.number().int(),
+      /** The invoice stopped taking new usage at this time. Usage that arrives later goes on the next invoice. */
+      closedAt: Timestamp.optional(),
+      paidAt: Timestamp.optional(),
+      failedAttempts: external_exports.number().int().nonnegative()
+    }).strict();
+    GRACE_STATES = ["none", "grace", "restricted"];
+    GraceState = external_exports.enum(GRACE_STATES);
+    GraceNotice = external_exports.object({
+      id: external_exports.string().min(1),
+      kind: external_exports.enum(["payment_failed", "reminder", "restricted", "recovered"]),
+      at: Timestamp,
+      message: external_exports.string().min(1)
+    }).strict();
+    Grace = external_exports.object({
+      tenantId: TenantId,
+      state: GraceState,
+      invoiceId: external_exports.string().min(1).optional(),
+      startedAt: Timestamp.optional(),
+      endsAt: Timestamp.optional(),
+      notices: external_exports.array(GraceNotice)
+    }).strict();
+    CAP_SCOPES = ["team", "project", "agent"];
+    CapScope = external_exports.enum(CAP_SCOPES);
+    Cap = external_exports.object({
+      tenantId: TenantId,
+      scope: CapScope,
+      /** Project ID or agent token ID; absent for the whole team. */
+      scopeId: external_exports.string().min(1).max(128).optional(),
+      /** Per billing period, in cents of metered spend (overage plus hosted inference with markup). */
+      limitCents: external_exports.number().int().positive().max(1e8),
+      updatedBy: external_exports.string().min(1),
+      updatedAt: Timestamp
+    }).strict().superRefine((cap, ctx) => {
+      if (cap.scope === "team" && cap.scopeId !== void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: "a team cap has no scope ID" });
+      if (cap.scope !== "team" && cap.scopeId === void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: "a project or agent cap names its project or agent" });
+    });
+    PutCapRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      scope: CapScope,
+      scopeId: external_exports.string().min(1).max(128).optional(),
+      limitCents: external_exports.number().int().positive().max(1e8)
+    }).strict();
+    DeleteCapRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), scope: CapScope, scopeId: external_exports.string().min(1).max(128).optional() }).strict();
+    MeterUsage = external_exports.object({
+      meter: Meter,
+      used: external_exports.number().int().nonnegative(),
+      /** Total allowance for the workspace this period (per-seat allowance times seats). Null when the plan states none. */
+      allowance: AllowanceValue,
+      overUnits: external_exports.number().int().nonnegative(),
+      /** Price of one unit beyond the allowance, in micro-dollars; null for hosted inference (provider cost plus markup) and unmetered-for-billing meters. */
+      rateMicros: external_exports.number().int().nonnegative().nullable(),
+      overageMicros: external_exports.number().int().nonnegative()
+    }).strict();
+    UsageSummary = external_exports.object({
+      tenantId: TenantId,
+      plan: BillingPlanId,
+      periodStart: Timestamp,
+      periodEnd: Timestamp,
+      meters: external_exports.array(MeterUsage),
+      /** Metered spend this period: overage plus hosted inference with markup, in micro-dollars. */
+      spendMicros: external_exports.number().int().nonnegative(),
+      /** Plain-language messages: an allowance reached, overage starting, a cap near. */
+      notices: external_exports.array(external_exports.string().min(1))
+    }).strict();
+    CheckoutRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      plan: CheckoutPlanId,
+      interval: BillingInterval.default("month"),
+      seats: external_exports.number().int().positive().max(1e4).default(1)
+    }).strict();
+    CheckoutResponse = external_exports.object({
+      tenantId: TenantId,
+      sessionId: external_exports.string().min(1),
+      /** A Stripe-hosted page. Card details are entered there and never reach Overlane (REQ-BIL-13). */
+      url: external_exports.string().url(),
+      plan: CheckoutPlanId,
+      interval: BillingInterval,
+      seats: external_exports.number().int().positive(),
+      /** What the first period costs before tax, in cents. Stripe Tax adds tax at checkout. */
+      firstPeriodCents: external_exports.number().int().nonnegative()
+    }).strict();
+    ChangePlanRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      plan: BillingPlanId.exclude(["enterprise"]),
+      interval: BillingInterval.optional(),
+      seats: external_exports.number().int().positive().max(1e4).optional()
+    }).strict();
+    OverLimit = external_exports.object({ what: external_exports.string().min(1), used: external_exports.number().int().nonnegative(), limit: external_exports.number().int().nonnegative() }).strict();
+    ChangePlanResponse = external_exports.object({
+      subscription: Subscription,
+      /** Charge (positive) or credit (negative) for the rest of the period, in cents. */
+      prorationCents: external_exports.number().int(),
+      /** What the new plan's limits are exceeded by. When non-empty the workspace is read-only; nothing is deleted. */
+      overLimit: external_exports.array(OverLimit),
+      deleted: external_exports.literal(0)
+    }).strict();
+    SeatChangeRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), seats: external_exports.number().int().positive().max(1e4) }).strict();
+    SeatChangeResponse = external_exports.object({
+      subscription: Subscription,
+      seat: Seat,
+      /** Prorated charge (positive) or credit (negative) for the remainder of the period, in cents (REQ-BIL-05). */
+      prorationCents: external_exports.number().int()
+    }).strict();
+    CancelRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), atPeriodEnd: external_exports.boolean().default(true) }).strict();
+    PortalResponse = external_exports.object({ tenantId: TenantId, url: external_exports.string().url() }).strict();
+    BillingStatus = external_exports.object({
+      tenantId: TenantId,
+      subscription: Subscription,
+      seat: Seat,
+      grace: Grace,
+      limits: TenantPlanLimits,
+      usage: UsageSummary,
+      caps: external_exports.array(Cap),
+      invoices: external_exports.array(Invoice),
+      /** True when Stripe is configured; false while the live leg is pending and the in-process fake serves. */
+      live: external_exports.boolean()
+    }).strict();
+    UsageDecision = external_exports.object({
+      tenantId: TenantId,
+      meter: Meter,
+      outcome: external_exports.enum(["within_allowance", "overage", "refused", "cap_reached", "read_only"]),
+      allowed: external_exports.boolean(),
+      /** Micro-dollars this unit costs; zero within the allowance. */
+      chargeMicros: external_exports.number().int().nonnegative(),
+      message: external_exports.string().min(1),
+      nextCommand: external_exports.string().nullable(),
+      exitCode: external_exports.union([external_exports.literal(0), external_exports.literal(6)])
+    }).strict();
+    STRIPE_EVENT_TYPES = [
+      "checkout.session.completed",
+      "customer.subscription.created",
+      "customer.subscription.updated",
+      "customer.subscription.deleted",
+      "invoice.created",
+      "invoice.finalized",
+      "invoice.paid",
+      "invoice.payment_failed"
+    ];
+    StripeEventType = external_exports.enum(STRIPE_EVENT_TYPES);
+    epochSeconds = external_exports.number().int().nonnegative();
+    StripeSubscriptionObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      status: external_exports.enum(["active", "past_due", "canceled", "incomplete", "unpaid", "trialing", "incomplete_expired"]),
+      cancel_at_period_end: external_exports.boolean(),
+      current_period_start: epochSeconds,
+      current_period_end: epochSeconds,
+      quantity: external_exports.number().int().positive(),
+      metadata: external_exports.object({ tenantId: TenantId, plan: CheckoutPlanId, interval: BillingInterval }).passthrough()
+    }).passthrough();
+    StripeInvoiceObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      subscription: external_exports.string().min(1).nullable(),
+      status: external_exports.enum(["draft", "open", "paid", "void", "uncollectible"]),
+      amount_due: external_exports.number().int().nonnegative(),
+      amount_paid: external_exports.number().int().nonnegative(),
+      period_start: epochSeconds,
+      period_end: epochSeconds,
+      attempt_count: external_exports.number().int().nonnegative().default(0),
+      metadata: external_exports.object({ tenantId: TenantId.optional() }).passthrough().default({})
+    }).passthrough();
+    StripeCheckoutObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      subscription: external_exports.string().min(1).nullable(),
+      metadata: external_exports.object({ tenantId: TenantId }).passthrough()
+    }).passthrough();
+    StripeEvent = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.string().min(1),
+      created: epochSeconds,
+      data: external_exports.object({ object: external_exports.record(external_exports.string(), external_exports.unknown()) })
+    }).passthrough();
+    WEBHOOK_OUTCOMES = ["applied", "replayed", "stale", "ignored"];
+    WebhookOutcome = external_exports.enum(WEBHOOK_OUTCOMES);
+    WebhookResult = external_exports.object({ ok: external_exports.literal(true), outcome: WebhookOutcome, eventId: external_exports.string().min(1) }).strict();
+    billingPaths = {
+      status: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing`,
+      checkout: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/checkout`,
+      plan: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/plan`,
+      seats: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/seats`,
+      cancel: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/cancel`,
+      portal: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/portal`,
+      usage: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/usage`,
+      decision: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/usage/decision`,
+      caps: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/caps`,
+      invoices: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/invoices`,
+      limits: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/limits`,
+      stripeWebhook: "/webhooks/billing/stripe",
+      workosWebhook: "/webhooks/billing/workos"
+    };
+  }
+});
+
 // ../contracts/src/index.ts
 var init_src = __esm({
   "../contracts/src/index.ts"() {
@@ -23079,6 +23448,8 @@ var init_src = __esm({
     init_review();
     init_guardrails();
     init_code_map();
+    init_plans();
+    init_billing();
   }
 });
 
@@ -30431,7 +30802,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.123" : "0.0.0-dev";
+    VERSION = true ? "0.1.124" : "0.0.0-dev";
   }
 });
 
@@ -59337,19 +59708,287 @@ var tokenRevokeCommand = defineCommand({
 });
 var identityCommands = [authLoginCommand, authLogoutCommand, authTokenCommand, teamListCommand, teamInviteCommand, tokenCreateCommand, tokenListCommand, tokenRevokeCommand];
 
-// ../cli/src/commands/guard.ts
+// ../cli/src/commands/billing.ts
 init_src();
 init_zod();
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
 var common2 = { needsAuth: true, needsNetwork: true };
 var requestId3 = () => `cli-${randomUUID3()}`;
 async function connected(inv) {
+  const project = await connectedProject(inv.deps, "billing");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId };
+}
+async function planned(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "billing");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+var usd = (cents) => `$${Math.trunc(cents / 100)}.${String(cents % 100).padStart(2, "0")}`;
+var micros = (value) => value % 1e4 === 0 ? usd(value / 1e4) : `$${(value / 1e6).toFixed(3)}`;
+function parseUsdToCents(text) {
+  const match = /^(\d{1,7})(?:\.(\d{1,2}))?$/.exec(text.trim());
+  if (match === null) throw new UsageError("--usd must be an amount like 50 or 12.50", { hint: "overlane billing caps set --scope team --usd 50" });
+  return Number(match[1]) * 100 + Number((match[2] ?? "").padEnd(2, "0") || "0");
+}
+function positiveInt(text, flag) {
+  if (text === void 0) return void 0;
+  if (!/^\d+$/.test(text) || Number(text) < 1) throw new UsageError(`--${flag} must be a whole number of at least 1`);
+  return Number(text);
+}
+var PLAN_FLAG = (plans, required2) => ({ name: "plan", type: "string", required: required2, enum: plans, value: "PLAN", description: "The plan" });
+var INTERVAL_FLAG = { name: "interval", type: "string", enum: ["month", "year"], value: "month|year", description: "Billing period; annual billing is cheaper per month" };
+var SEATS_FLAG = { name: "seats", type: "string", value: "N", description: "Seats (Business needs at least 10; Pro is one person)" };
+var billingStatusCommand = defineCommand({
+  path: ["billing", "status"],
+  summary: "Show the plan, seats, usage against allowances, caps, grace period and invoices",
+  description: "Shows what this workspace is on, what the plan allows (from the one plan data file the pricing page also reads), what is used this period, any spending caps, and whether a failed payment has started a grace period. Read-only for every role, agents included.",
+  examples: ["overlane billing status", "overlane billing status --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["billing", "plan", "subscription", "invoice", "what plan am i on", "seats", "grace period", "read-only"],
+  result: BillingStatus,
+  text: (d) => [
+    `plan: ${d.subscription.plan} (${d.subscription.status}), ${d.subscription.seats} seat${d.subscription.seats === 1 ? "" : "s"}, ${d.subscription.interval}ly${d.subscription.cancelAtPeriodEnd ? ", ends at the period end" : ""}`,
+    ...d.limits.readOnly ? ["this workspace is READ-ONLY: nothing was deleted; reading works"] : [],
+    ...d.grace.state === "none" ? [] : [`payment: ${d.grace.state}${d.grace.endsAt === void 0 ? "" : ` until ${d.grace.endsAt.slice(0, 10)}`}`],
+    ...d.usage.meters.map((m) => `${m.meter}: ${m.used}${typeof m.allowance === "number" ? ` of ${m.allowance}` : m.allowance === "unlimited" ? " (unlimited)" : ""}${m.overageMicros > 0 ? `, overage ${micros(m.overageMicros)}` : ""}`),
+    `metered spend this period: ${micros(d.usage.spendMicros)}`,
+    ...d.caps.map((c) => `cap ${c.scope}${c.scopeId === void 0 ? "" : ` ${c.scopeId}`}: ${usd(c.limitCents)}`),
+    ...d.usage.notices,
+    ...d.grace.notices.slice(-1).map((n) => n.message),
+    ...d.live ? [] : ["payments: not connected to Stripe in this deployment (live leg pending)"]
+  ],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(BillingStatus, "GET", billingPaths.status(tenantId)) };
+  }
+});
+var billingUsageCommand = defineCommand({
+  path: ["billing", "usage"],
+  summary: "Show usage this period against each allowance, with the overage price from the plan data file",
+  description: "Lists reviews, CI minutes, docs calls and hosted inference used this period, the allowance each plan gives, units beyond it and what they cost. Beyond an allowance nothing stops unless a spending cap is set.",
+  examples: ["overlane billing usage", "overlane billing usage --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["usage", "allowance", "overage", "reviews used", "ci minutes", "how much have i used"],
+  result: UsageSummary,
+  text: (d) => [`period: ${d.periodStart.slice(0, 10)} to ${d.periodEnd.slice(0, 10)}`, ...d.meters.map((m) => `${m.meter}: ${m.used}${typeof m.allowance === "number" ? ` / ${m.allowance}` : ""}${m.rateMicros === null ? "" : `  (${micros(m.rateMicros)} each beyond)`}${m.overageMicros > 0 ? `  overage ${micros(m.overageMicros)}` : ""}`), `metered spend: ${micros(d.spendMicros)}`, ...d.notices],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(UsageSummary, "GET", billingPaths.usage(tenantId)) };
+  }
+});
+var billingCheckCommand = defineCommand({
+  path: ["billing", "check"],
+  summary: "Ask whether a spend is allowed now; exits 6 when a limit or cap refuses it",
+  description: "Asks the billing service before a review, CI run or hosted inference call: within the allowance, over it and billed (with a notice), or refused (a plan with no overage path, a reached spending cap, a read-only workspace). A refusal exits 6 and names the next command.",
+  flags: [
+    { name: "meter", type: "string", required: true, enum: METERS, value: "METER", description: "What is being spent" },
+    { name: "quantity", type: "string", value: "N", description: "Units, default 1" },
+    { name: "cost-micros", type: "string", value: "N", description: "Provider cost of a hosted inference call, in millionths of a dollar" },
+    { name: "project", type: "string", value: "ID", description: "The project, for a project cap" },
+    { name: "agent", type: "string", value: "ID", description: "The agent token, for an agent cap" },
+    { name: "byok", type: "boolean", description: "The call runs on your own key: no platform charge" }
+  ],
+  examples: ["overlane billing check --meter reviews", "overlane billing check --meter hostedInference --cost-micros 2000 --agent tok_1"],
+  effect: "read",
+  ...common2,
+  keywords: ["can i spend", "spending cap reached", "limit check", "exit 6", "budget gate"],
+  result: UsageDecision,
+  text: (d) => [`${d.allowed ? "ALLOWED" : "REFUSED"} (${d.outcome})  ${d.message}`, ...d.nextCommand === null ? [] : [`next: ${d.nextCommand}`]],
+  handler: async (inv) => {
+    const meter = textFlag(inv, "meter");
+    if (meter === void 0) throw new UsageError("check needs --meter", { hint: "overlane billing check --meter reviews" });
+    const { call: call2, tenantId } = await connected(inv);
+    const quantity = positiveInt(textFlag(inv, "quantity"), "quantity");
+    const cost = textFlag(inv, "cost-micros");
+    const body2 = { meter, ...quantity === void 0 ? {} : { quantity }, ...cost === void 0 ? {} : { costMicros: Number(cost) }, ...textFlag(inv, "project") === void 0 ? {} : { projectId: textFlag(inv, "project") }, ...textFlag(inv, "agent") === void 0 ? {} : { agentId: textFlag(inv, "agent") }, ...boolFlag(inv, "byok") ? { byok: true } : {} };
+    const decision = await call2(UsageDecision, "POST", billingPaths.decision(tenantId), body2);
+    return decision.allowed ? { data: decision } : { data: decision, exit: EXIT.blocked, error: new CliError(decision.message, { code: decision.outcome, exit: EXIT.blocked, ...decision.nextCommand === null ? {} : { hint: decision.nextCommand } }) };
+  }
+});
+var billingCheckoutCommand = defineCommand({
+  path: ["billing", "checkout"],
+  summary: "Start buying a plan: prints a Stripe-hosted checkout link (a person pays; agents cannot)",
+  description: "Opens a checkout for Pro, Team or Business. Business needs at least 10 seats. The link is a Stripe-hosted page where the card is entered; Overlane never sees it. The plan is active when the payment webhook arrives. Enterprise is contract-only.",
+  flags: [PLAN_FLAG(["pro", "team", "business"], true), INTERVAL_FLAG, SEATS_FLAG],
+  examples: ["overlane billing checkout --plan team --seats 5", "overlane billing checkout --plan business --seats 10 --interval year --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["upgrade", "buy", "subscribe", "pay", "checkout", "choose plan"],
+  result: withDryRun(CheckoutResponse),
+  text: (d) => "url" in d ? [`${d.plan} x ${d.seats} (${d.interval}ly): first period ${usd(d.firstPeriodCents)} before tax`, `open: ${d.url}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), plan: textFlag(inv, "plan"), interval: textFlag(inv, "interval") ?? "month", ...textFlag(inv, "seats") === void 0 ? {} : { seats: positiveInt(textFlag(inv, "seats"), "seats") } };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.checkout, body2, "opens a Stripe-hosted checkout; nothing is charged");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CheckoutResponse, "POST", billingPaths.checkout(tenantId), body2) };
+  }
+});
+var billingPlanCommand = defineCommand({
+  path: ["billing", "plan"],
+  summary: "Upgrade or downgrade the plan; a downgrade over the new limits makes the workspace read-only and deletes nothing",
+  description: "Changes a paid plan with proration for the rest of the period. `--plan free` ends the paid plan at the end of the period already paid for. If data is over the new plan's limits the workspace becomes read-only (reads keep working) and nothing is ever deleted; upgrading restores it.",
+  flags: [PLAN_FLAG(["free", "pro", "team", "business"], true), INTERVAL_FLAG, SEATS_FLAG],
+  examples: ["overlane billing plan --plan team --seats 4", "overlane billing plan --plan free --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["downgrade", "upgrade", "change plan", "switch plan", "go back to free"],
+  result: withDryRun(ChangePlanResponse),
+  text: (d) => "subscription" in d ? [`plan: ${d.subscription.plan}, ${d.subscription.seats} seats`, `proration: ${d.prorationCents >= 0 ? "charge" : "credit"} ${usd(Math.abs(d.prorationCents))}`, ...d.overLimit.map((o) => `over the limit: ${o.what} ${o.used} of ${o.limit}; the workspace is read-only, nothing is deleted`)] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), plan: textFlag(inv, "plan"), ...textFlag(inv, "interval") === void 0 ? {} : { interval: textFlag(inv, "interval") }, ...textFlag(inv, "seats") === void 0 ? {} : { seats: positiveInt(textFlag(inv, "seats"), "seats") } };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.plan, body2, "prorates the rest of the period");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(ChangePlanResponse, "POST", billingPaths.plan(tenantId), body2) };
+  }
+});
+var billingSeatsCommand = defineCommand({
+  path: ["billing", "seats"],
+  summary: "Change the number of seats mid-cycle; the change prorates",
+  description: "Sets the seat count on a per-seat plan. The charge or credit for the rest of the period is prorated by the second. Business never goes below 10 seats, and seats cannot drop below the people who hold one.",
+  flags: [{ ...SEATS_FLAG, required: true }],
+  examples: ["overlane billing seats --seats 8", "overlane billing seats --seats 12 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["add seats", "remove seats", "more people", "proration", "seat count"],
+  result: withDryRun(SeatChangeResponse),
+  text: (d) => "seat" in d ? [`seats: ${d.seat.purchased} (${d.seat.assigned} in use)`, `proration: ${d.prorationCents >= 0 ? "charge" : "credit"} ${usd(Math.abs(d.prorationCents))}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), seats: positiveInt(textFlag(inv, "seats"), "seats") };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.seats, body2, "prorates the rest of the period");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(SeatChangeResponse, "POST", billingPaths.seats(tenantId), body2) };
+  }
+});
+var billingCancelCommand = defineCommand({
+  path: ["billing", "cancel"],
+  summary: "Cancel the paid plan at the end of the period already paid for",
+  description: "Cancels at the period end by default, so everything keeps working until then. With --now the plan ends immediately. Data over the Free limits becomes read-only; nothing is deleted.",
+  flags: [{ name: "now", type: "boolean", description: "End the plan immediately instead of at the period end" }],
+  examples: ["overlane billing cancel", "overlane billing cancel --dry-run"],
+  effect: "destructive",
+  ...common2,
+  keywords: ["cancel subscription", "stop paying", "end plan"],
+  result: withDryRun(Subscription),
+  text: (d) => "plan" in d ? [`plan: ${d.plan}${d.cancelAtPeriodEnd ? `, ends ${d.currentPeriodEnd.slice(0, 10)}` : ""}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), atPeriodEnd: !boolFlag(inv, "now") };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.cancel, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(Subscription, "POST", billingPaths.cancel(tenantId), body2) };
+  }
+});
+var billingPortalCommand = defineCommand({
+  path: ["billing", "portal"],
+  summary: "Print a link to Stripe's billing portal: card, invoices and tax details",
+  description: "Opens a Stripe-hosted portal where a person updates the card, downloads invoices and edits tax details. Overlane never stores card data.",
+  examples: ["overlane billing portal"],
+  effect: "write",
+  ...common2,
+  keywords: ["update card", "invoices", "tax id", "payment method", "billing portal"],
+  result: withDryRun(PortalResponse),
+  text: (d) => "url" in d ? [`open: ${d.url}`] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.portal, {});
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(PortalResponse, "POST", billingPaths.portal(tenantId), {}) };
+  }
+});
+var CapList = external_exports.object({ tenantId: external_exports.string(), caps: external_exports.array(Cap) }).strict();
+var CapRemoved = external_exports.object({ tenantId: external_exports.string(), removed: external_exports.literal(true) }).strict();
+var CAP_FLAGS = [
+  { name: "scope", type: "string", required: true, enum: CAP_SCOPES, value: "SCOPE", description: "team, project or agent" },
+  { name: "id", type: "string", value: "ID", description: "The project or agent token the cap applies to (not for team)" }
+];
+function capTarget(inv) {
+  const scope = textFlag(inv, "scope");
+  const id2 = textFlag(inv, "id");
+  if (scope === void 0) throw new UsageError("this command needs --scope", { hint: "overlane billing caps set --scope team --usd 50" });
+  if (scope === "team" && id2 !== void 0) throw new UsageError("a team cap has no --id");
+  if (scope !== "team" && id2 === void 0) throw new UsageError(`a ${scope} cap needs --id`, { hint: `overlane billing caps set --scope ${scope} --id <${scope} id> --usd 50` });
+  return { scope, ...id2 === void 0 ? {} : { scopeId: id2 } };
+}
+var billingCapsListCommand = defineCommand({
+  path: ["billing", "caps", "list"],
+  summary: "List spending caps per team, project and agent",
+  description: "Shows each cap in dollars per billing period. With a cap set, reviews, CI and hosted inference stop at it (exit 6); with none, usage beyond an allowance is billed.",
+  examples: ["overlane billing caps list", "overlane billing caps list --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["spending cap", "budget", "limit spend", "caps"],
+  result: CapList,
+  text: (d) => d.caps.length === 0 ? ["No spending caps: usage beyond an allowance is billed, nothing stops."] : d.caps.map((c) => `${c.scope}${c.scopeId === void 0 ? "" : ` ${c.scopeId}`}: ${usd(c.limitCents)} per period`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CapList, "GET", billingPaths.caps(tenantId)) };
+  }
+});
+var billingCapsSetCommand = defineCommand({
+  path: ["billing", "caps", "set"],
+  summary: "Set a spending cap per period for the team, a project or an agent",
+  description: "Sets the most metered spend (overage plus hosted inference with markup) allowed per billing period. At the cap, hosted inference, AI reviews and CI stop with exit code 6 and a visible message until the next period or until the cap is raised. Only a signed-in owner can set one.",
+  flags: [...CAP_FLAGS, { name: "usd", type: "string", required: true, value: "AMOUNT", description: "Dollars per period, for example 50 or 12.50" }],
+  examples: ["overlane billing caps set --scope team --usd 50", "overlane billing caps set --scope agent --id tok_1 --usd 5 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["set cap", "limit spending", "budget", "stop at"],
+  result: withDryRun(Cap),
+  text: (d) => "limitCents" in d ? [`cap ${d.scope}${d.scopeId === void 0 ? "" : ` ${d.scopeId}`}: ${usd(d.limitCents)} per period`] : [],
+  handler: async (inv) => {
+    const target = capTarget(inv);
+    const usdText = textFlag(inv, "usd");
+    if (usdText === void 0) throw new UsageError("set needs --usd", { hint: "overlane billing caps set --scope team --usd 50" });
+    const body2 = { requestId: requestId3(), ...target, limitCents: parseUsdToCents(usdText) };
+    if (inv.dryRun) return planned(inv, "PUT", billingPaths.caps, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(Cap, "PUT", billingPaths.caps(tenantId), body2) };
+  }
+});
+var billingCapsRemoveCommand = defineCommand({
+  path: ["billing", "caps", "remove"],
+  summary: "Remove a spending cap",
+  description: "Removes a cap. Without a team cap, usage beyond an allowance is billed and nothing stops.",
+  flags: CAP_FLAGS,
+  examples: ["overlane billing caps remove --scope team", "overlane billing caps remove --scope project --id prj_1 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["remove cap", "no limit", "delete cap"],
+  result: withDryRun(CapRemoved),
+  text: (d) => "removed" in d ? ["Cap removed."] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), ...capTarget(inv) };
+    if (inv.dryRun) return planned(inv, "DELETE", billingPaths.caps, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CapRemoved, "DELETE", billingPaths.caps(tenantId), body2) };
+  }
+});
+var billingCommands = [
+  billingStatusCommand,
+  billingUsageCommand,
+  billingCheckCommand,
+  billingCheckoutCommand,
+  billingPlanCommand,
+  billingSeatsCommand,
+  billingCancelCommand,
+  billingPortalCommand,
+  billingCapsListCommand,
+  billingCapsSetCommand,
+  billingCapsRemoveCommand
+];
+
+// ../cli/src/commands/guard.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
+var common3 = { needsAuth: true, needsNetwork: true };
+var requestId4 = () => `cli-${randomUUID4()}`;
+async function connected2(inv) {
   const project = await connectedProject(inv.deps, "guard");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned(inv, method, path, body2, note) {
+async function planned2(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "guard");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -59398,12 +60037,12 @@ var guardRulesListCommand = defineCommand({
   description: "Lists the platform rules (always in force), then the team and project rule files and their rules. A rule change is an audit event; every file version is listed with its digest and author.",
   examples: ["overlane guard rules list", "overlane guard rules list --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["guardrails", "policy as code", "rules in force", "protected branches", "what is blocked", "rule files"],
   result: GuardRulesResponse,
   text: (d) => [...d.rules.map((rule) => `${rule.layer.padEnd(8)} ${rule.effect.padEnd(16)} ${rule.id}${rule.dryRun ? "  [dry-run]" : ""}  ${rule.description}`), ...d.files.map((file2) => `file ${file2.layer} v${file2.version} ${file2.digest.slice(0, 19)} by ${file2.author}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected(inv);
+    const { call: call2, tenantId, projectId } = await connected2(inv);
     return { data: await call2(GuardRulesResponse, "GET", `${guardPaths.rules(tenantId)}?projectId=${encodeURIComponent(projectId)}`) };
   }
 });
@@ -59473,7 +60112,7 @@ var guardRulesPutCommand = defineCommand({
   ],
   examples: ['overlane guard rules put --file rules.json --reason "freeze deploys on Fridays"', "overlane guard rules put --file rules.json --layer project --dry-run"],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["publish rules", "update guardrails", "change policy", "upload rule file", "freeze deploys"],
   result: withDryRun(GuardRuleFileRecord),
   text: (d) => "version" in d ? [`Published ${d.layer} rule file v${d.version} (${d.ruleCount} rules, ${d.digest.slice(0, 19)}).`] : [],
@@ -59487,12 +60126,12 @@ var guardRulesPutCommand = defineCommand({
       return planOutcome(inv.deps, dryRunPlan({ service: offline.serviceUrl, requests: [{ method: "PUT", path: guardPaths.rules(offline.binding.tenantId), body: { requestId: "<generated>", layer, ...layer === "project" ? { projectId: offline.binding.projectId } : {}, content: `<contents of ${file2}>`, ...reason === void 0 ? {} : { reason } }, note: "the file is validated and scanned for credentials on the server" }] }));
     }
     const content = readText3(inv, file2);
-    const { call: call2, tenantId, projectId } = await connected(inv);
-    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId3(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId4(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
   }
 });
 async function evaluate(inv, dryRun) {
-  const { call: call2, tenantId, projectId } = await connected(inv);
+  const { call: call2, tenantId, projectId } = await connected2(inv);
   const contentFile = textFlag(inv, "content-file");
   const body2 = {
     ...actionOf(inv),
@@ -59518,12 +60157,12 @@ var guardCheckCommand = defineCommand({
   flags: [...DECISION_FLAGS, { name: "approval", type: "string", value: "ID", description: "An approval that covers exactly this action" }],
   examples: ["overlane guard check --tool git.push --branch main --task held", 'overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-run'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["check action", "pre push check", "ci gate", "is this allowed", "approval required", "blocked by policy"],
   result: withDryRun(GuardEvaluateResponse),
   text: (d) => "decision" in d ? describeDecision(d.decision) : [],
   handler: async (inv) => {
-    if (inv.dryRun) return planned(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
+    if (inv.dryRun) return planned2(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
     const reply = await evaluate(inv, false);
     return reply.decision.allowed ? { data: reply } : refusalOutcome(reply, reply.decision);
   }
@@ -59535,7 +60174,7 @@ var guardDryRunCommand = defineCommand({
   flags: DECISION_FLAGS,
   examples: ["overlane guard dry-run --tool git.push --branch main --task held", "overlane guard dry-run --tool egress.fetch --host registry.example.com --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["dry run rules", "what would block", "test policy", "simulate", "would be refused"],
   result: GuardEvaluateResponse,
   text: (d) => describeDecision(d.decision),
@@ -59551,14 +60190,14 @@ var guardScanCommand = defineCommand({
   ],
   examples: ["overlane guard scan --path src/config.ts", "overlane guard scan --path ci.log --source log --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["secret scan", "find credentials", "leaked key", "push protection", "scan file"],
   result: SecretScanResult,
   text: (d) => d.findings.length === 0 ? ["No credentials found."] : d.findings.map((finding) => `${finding.disposition.padEnd(8)} ${finding.rule}${finding.path === void 0 ? "" : ` ${finding.path}`}${finding.line === void 0 ? "" : `:${finding.line}`}`),
   handler: async (inv) => {
     const path = textFlag(inv, "path");
     if (path === void 0) throw new UsageError("scan needs --path", { hint: "overlane guard scan --path src/config.ts" });
-    const { call: call2, tenantId } = await connected(inv);
+    const { call: call2, tenantId } = await connected2(inv);
     const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText3(inv, path), path });
     return result.blocked ? { data: result, exit: EXIT.blocked, error: new CliError("a credential was found; nothing should be pushed until it is removed and rotated", { code: "secret_detected", exit: EXIT.blocked, hint: "overlane guard scan --path <file>" }) } : { data: result };
   }
@@ -59571,12 +60210,12 @@ var guardApprovalsListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["pending", "approved", "denied"], description: "Only approvals with this status" }],
   examples: ["overlane guard approvals list", "overlane guard approvals list --status pending --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["pending approvals", "approve before write", "who needs to approve", "approval queue"],
   result: ApprovalList2,
   text: (d) => d.approvals.length === 0 ? ["No approvals."] : d.approvals.flatMap((a) => [`${a.status.padEnd(9)} ${a.id}  ${a.tool}  by ${a.requestedBy}  (rule ${a.ruleId})`, `  ${a.summary}`]),
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected(inv);
+    const { call: call2, tenantId } = await connected2(inv);
     const status = textFlag(inv, "status");
     return { data: await call2(ApprovalList2, "GET", `${guardPaths.approvals(tenantId)}${status === void 0 ? "" : `?status=${status}`}`) };
   }
@@ -59593,7 +60232,7 @@ var guardApprovalsAnswerCommand = defineCommand({
   ],
   examples: ["overlane guard approvals answer apr_1 --decision approve", 'overlane guard approvals answer apr_1 --decision approve --evidence "diff reviewed" --reason "matches the task" --dry-run'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["approve action", "deny action", "answer approval", "allow push", "sign off"],
   result: withDryRun(GuardApproval),
   text: (d) => "status" in d ? [`${d.id} is ${d.status}.`] : [],
@@ -59604,8 +60243,8 @@ var guardApprovalsAnswerCommand = defineCommand({
     const evidence = listFlag(inv, "evidence");
     const parsed = AnswerGuardApprovalRequest.safeParse({ decision: textFlag(inv, "decision"), ...reason === void 0 ? {} : { reason }, ...evidence.length === 0 ? {} : { evidence } });
     if (!parsed.success) throw new UsageError("--decision must be approve or deny", { hint: `overlane guard approvals answer ${approvalId} --decision approve` });
-    if (inv.dryRun) return planned(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
-    const { call: call2, tenantId } = await connected(inv);
+    if (inv.dryRun) return planned2(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
+    const { call: call2, tenantId } = await connected2(inv);
     return { data: await call2(GuardApproval, "POST", guardPaths.answer(tenantId, approvalId), parsed.data) };
   }
 });
@@ -59614,10 +60253,10 @@ var guardCommands = [guardRulesListCommand, guardRulesTestCommand, guardRulesPut
 // ../cli/src/commands/memory.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var SERVICE_FLAG3 = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG3 = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
-var common3 = { needsAuth: true, needsNetwork: true };
+var common4 = { needsAuth: true, needsNetwork: true };
 async function authed3(inv) {
   const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const token = await requireToken(inv.deps, target.storeKey);
@@ -59636,7 +60275,7 @@ async function plan2(inv, method, path, body2, note) {
   const tenant = textFlag(inv, "team") ?? ":your-team";
   return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
-var requestId4 = () => `cli-${randomUUID4()}`;
+var requestId5 = () => `cli-${randomUUID5()}`;
 var memorySearchCommand = defineCommand({
   path: ["memory", "search"],
   summary: "Search memory across project, team, user and global scopes",
@@ -59651,7 +60290,7 @@ var memorySearchCommand = defineCommand({
   ],
   examples: ['overlane memory search "how do we deploy"', 'overlane memory search "indentation" --scope team --json'],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["recall", "remember", "what do we know", "find memory", "lookup", "notes", "conventions", "decisions"],
   result: MemorySearchResponse,
   text: (d) => d.items.length === 0 ? ["No memories match."] : d.items.map((i2) => `${i2.scope.padEnd(7)} ${i2.status.padEnd(9)} ${i2.id}  ${i2.title}${i2.stale ? "  [stale]" : ""}${i2.overriddenBy === null ? "" : `  [overridden by ${i2.overriddenBy}]`}`),
@@ -59685,7 +60324,7 @@ var memoryAddCommand = defineCommand({
   ],
   examples: ['overlane memory add --title "Deploy day" "Deploys go out on Tuesdays" --project prj_1', 'overlane memory add --title "Editor" --scope user "I prefer a dark theme" --dry-run'],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["remember this", "save a note", "record a decision", "store convention", "candidate"],
   result: AddResult,
   handler: async (inv) => {
@@ -59693,7 +60332,7 @@ var memoryAddCommand = defineCommand({
     if (title === void 0) throw new UsageError("add needs --title", { hint: 'overlane memory add --title "..." "<text>"' });
     const project = textFlag(inv, "project");
     const parsed = MemoryCandidate.safeParse({
-      requestId: requestId4(),
+      requestId: requestId5(),
       scope: textFlag(inv, "scope") ?? "project",
       ...project === void 0 ? {} : { projectId: project },
       category: textFlag(inv, "category") ?? "fact",
@@ -59724,7 +60363,7 @@ var memoryConfirmCommand = defineCommand({
   ],
   examples: ["overlane memory confirm mem_ab12", "overlane memory confirm mem_ab12 --basis ci_evidence --evidence 0123abc:unit_tests --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["approve memory", "verify", "promote candidate", "second observer", "ci evidence"],
   result: ConfirmResult,
   handler: async (inv) => {
@@ -59748,7 +60387,7 @@ var memoryPromoteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3, { name: "to", type: "string", enum: ["team", "global"], default: "team", description: "Where to promote it" }],
   examples: ["overlane memory promote mem_ab12 --to team", "overlane memory promote mem_cd34 --to global --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["share with team", "contribute", "global memory", "make team wide"],
   result: withDryRun(MemoryPromoteResponse),
   handler: async (inv) => {
@@ -59776,7 +60415,7 @@ var memoryExportCommand = defineCommand({
   ],
   examples: ["overlane memory export --json", "overlane memory export --scope user --user usr_1 --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["download memory", "backup", "data portability", "gdpr", "subject access"],
   result: MemoryExportRecord,
   text: (d) => [`${d.items.length} memories exported at ${d.exportedAt}. Use --json for the full content.`],
@@ -59800,7 +60439,7 @@ var memoryDeleteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory delete mem_ab12 --force", "overlane memory delete mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["remove memory", "forget", "erase", "wrong memory", "gdpr deletion"],
   result: withDryRun(MemoryDeleteResponse),
   handler: async (inv) => {
@@ -59821,7 +60460,7 @@ var memoryUnlearnCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory unlearn mem_ab12 --force", "overlane memory unlearn mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["unlearn", "forget everything derived", "retract", "poisoned memory", "bad memory"],
   result: withDryRun(MemoryUnlearnRecord),
   handler: async (inv) => {
@@ -59841,7 +60480,7 @@ var memoryStatusCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory status", "overlane memory status --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["memory health", "stale memory", "how many memories", "contribution", "opt in"],
   result: MemoryStatusResponse,
   text: (d) => [...Object.entries(d.counts).map(([key, n]) => `${key}: ${n}`), `stale: ${d.stale}`, `global contribution: ${d.settings.globalContribution ? "on" : "off"}`, `pending jobs: ${d.pendingJobs}`],
@@ -59859,7 +60498,7 @@ var memoryContributionCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory contribution on", "overlane memory contribution off --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["opt in", "opt out", "share patterns", "global pool", "contribute"],
   result: withDryRun(MemorySettings),
   handler: async (inv) => {
@@ -59879,10 +60518,10 @@ var memoryCommands = [memorySearchCommand, memoryAddCommand, memoryConfirmComman
 // ../cli/src/commands/issue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { readFileSync as readFileSync9 } from "node:fs";
-var common4 = { needsAuth: true, needsNetwork: true };
-var requestId5 = () => `cli-${randomUUID5()}`;
+var common5 = { needsAuth: true, needsNetwork: true };
+var requestId6 = () => `cli-${randomUUID6()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var STATUSES = ["backlog", "todo", "in_progress", "in_review", "cancelled"];
 async function send(deps, label, schema, method, path, body2, dryRun) {
@@ -59919,7 +60558,7 @@ var issueListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["backlog", "todo", "in_progress", "in_review", "done", "cancelled"], description: "Only issues in this status" }],
   examples: ["overlane issue list", "overlane issue list --status todo --json"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["issues", "backlog", "tickets", "work items", "what is open", "list issues"],
   result: external_exports.object({ issues: external_exports.array(IssueShown) }),
   handler: async (inv) => {
@@ -59940,7 +60579,7 @@ var issueShowCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID, for example iss_ab12cd34ef56gh78" }],
   examples: ["overlane issue show iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["issue details", "ticket", "view issue", "who is working on"],
   result: IssueShown,
   handler: async (inv) => {
@@ -59963,7 +60602,7 @@ var issueEventsCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID" }],
   examples: ["overlane issue events iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["audit", "history", "who changed", "field changes", "issue log"],
   result: IssueEventList,
   handler: async (inv) => {
@@ -59988,12 +60627,12 @@ var issueNewCommand = defineCommand({
   ],
   examples: ['overlane issue new "Back-time drifts by a second"', 'overlane issue new "Fix export" --priority P0 --description "Fails on empty notes"'],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["create issue", "new issue", "file a ticket", "add work item", "report bug"],
   result: withDryRun(Issue),
   handler: async (inv) => {
     const estimate = textFlag(inv, "estimate");
-    const body2 = { requestId: requestId5(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
+    const body2 = { requestId: requestId6(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
     const result = await send(inv.deps, "issue", Issue, "POST", issuePaths.issues, body2, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Created #${result.value.number} ${result.value.issueId}`);
     return result;
@@ -60013,7 +60652,7 @@ var issueUpdateCommand = defineCommand({
   ],
   examples: ["overlane issue update iss_ab12cd34ef56gh78 --priority P0", 'overlane issue update iss_ab12cd34ef56gh78 --status in_progress --title "New title"'],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["edit issue", "change status", "change priority", "rename issue", "update ticket"],
   result: withDryRun(Issue),
   handler: async (inv) => {
@@ -60021,7 +60660,7 @@ var issueUpdateCommand = defineCommand({
     if (id2 === void 0) throw new UsageError("update needs an ISSUE_ID");
     const estimate = textFlag(inv, "estimate");
     const body2 = {
-      requestId: requestId5(),
+      requestId: requestId6(),
       ...textFlag(inv, "title") === void 0 ? {} : { title: textFlag(inv, "title") },
       ...textFlag(inv, "description") === void 0 ? {} : { description: textFlag(inv, "description") },
       ...textFlag(inv, "status") === void 0 ? {} : { status: textFlag(inv, "status") },
@@ -60042,14 +60681,14 @@ var issueAssignCommand = defineCommand({
   ],
   examples: ["overlane issue assign iss_ab12cd34ef56gh78 agent:claude-code", "overlane issue assign iss_ab12cd34ef56gh78 none"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["assign", "give to agent", "hand to bot", "delegate", "who works on this", "unassign"],
   result: withDryRun(AssignResult),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("assign needs an ISSUE_ID and an assignee");
     const assignee = parseAssignee(inv.positionals[1]);
-    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId5(), assignee }, inv.dryRun);
+    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId6(), assignee }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, result.value.taskId === null ? "Assigned." : `Assigned. Task: ${result.value.taskId}${result.value.createdTask ? " (new)" : ""}`);
     return result;
   }
@@ -60065,7 +60704,7 @@ var issueImportCommand = defineCommand({
   flags: [{ name: "preview", type: "boolean", description: "Report what the import would create or update, and write nothing" }],
   examples: ["overlane issue import linear ./linear-export.json --preview", "overlane issue import jira ./jira-search.json"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["import", "migrate from linear", "migrate from jira", "github projects import", "bring issues in"],
   result: withDryRun(ImportReport),
   handler: async (inv) => {
@@ -60078,7 +60717,7 @@ var issueImportCommand = defineCommand({
     } catch {
       throw new UsageError(`${file2} is not a readable JSON file`);
     }
-    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId5(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
+    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId6(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
     if (result.value !== void 0) {
       const r = result.value;
       say(inv.deps, `${r.dryRun ? "Would import" : "Imported"} from ${r.source}: ${r.created} new, ${r.updated} updated, ${r.unchanged} unchanged, ${r.skipped.length} skipped.`);
@@ -60092,7 +60731,7 @@ var issueSyncCommand = defineCommand({
   description: "Overlane issues work with no sync; syncing with GitHub is optional. Shows the repository and mode: off (default), read_only (GitHub changes flow in, nothing is written to GitHub) or write_back (an owner or admin opted in).",
   examples: ["overlane issue sync"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["github sync", "sync status", "two-way sync", "write back"],
   result: SyncConfig,
   handler: async (inv) => {
@@ -60112,13 +60751,13 @@ var issueSyncSetCommand = defineCommand({
   ],
   examples: ["overlane issue sync set acme/app read_only", "overlane issue sync set acme/app off"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["enable github sync", "write back", "turn off sync", "read only sync"],
   result: withDryRun(SyncConfig),
   handler: async (inv) => {
     const [repository, mode] = inv.positionals;
     if (repository === void 0 || mode === void 0) throw new UsageError("sync set needs REPOSITORY and MODE");
-    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId5(), repository, mode }, inv.dryRun);
+    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId6(), repository, mode }, inv.dryRun);
   }
 });
 var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, issueNewCommand, issueUpdateCommand, issueAssignCommand, issueImportCommand, issueSyncCommand, issueSyncSetCommand];
@@ -60126,7 +60765,7 @@ var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, iss
 // ../cli/src/commands/issue-views.ts
 init_src();
 init_zod();
-var common5 = { needsAuth: true, needsNetwork: true };
+var common6 = { needsAuth: true, needsNetwork: true };
 var Deleted = external_exports.object({ deleted: external_exports.literal(true) });
 var FIELDS = ["status", "priority", "assigneeType", "assignee", "labelId", "workProjectId", "cycleId", "estimate", "source", "title", "number", "createdAt", "updatedAt"];
 function parseCondition(text) {
@@ -60142,7 +60781,7 @@ var viewListCommand = defineCommand({
   description: "Lists saved views: a filter plus a group-by and sort over any issue field.",
   examples: ["overlane view list"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["saved views", "filters", "board", "group by"],
   result: ViewList,
   handler: async (inv) => {
@@ -60160,7 +60799,7 @@ var viewRunCommand = defineCommand({
   args: [{ name: "view-id", required: true, description: "The saved view ID" }],
   examples: ["overlane view run viw_ab12cd34ef56gh78"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["run view", "show board", "group issues"],
   result: ViewResult,
   handler: async (inv) => {
@@ -60188,12 +60827,12 @@ var viewNewCommand = defineCommand({
   ],
   examples: ["overlane view new Urgent --filter priority=P0 --group-by status", 'overlane view new "Agent work" --filter assigneeType=agent --group-by status'],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["create view", "save filter", "board", "group by status"],
   result: withDryRun(SavedView),
   handler: async (inv) => {
     const definition = { filter: listFlag(inv, "filter").map(parseCondition), groupBy: textFlag(inv, "group-by") ?? null, sortBy: textFlag(inv, "sort-by") ?? "number", sortDirection: boolFlag(inv, "desc") ? "desc" : "asc" };
-    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId5(), name: inv.positionals.join(" "), definition }, inv.dryRun);
+    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId6(), name: inv.positionals.join(" "), definition }, inv.dryRun);
   }
 });
 var viewDeleteCommand = defineCommand({
@@ -60203,7 +60842,7 @@ var viewDeleteCommand = defineCommand({
   args: [{ name: "view-id", required: false, description: "The saved view ID (required; checked after the --force confirmation)" }],
   examples: ["overlane view delete viw_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common5,
+  ...common6,
   keywords: ["remove view", "delete filter"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -60218,7 +60857,7 @@ var loopListCommand = defineCommand({
   description: "Lists loops: a trigger (schedule or event), a filter over issues and the executor they dispatch.",
   examples: ["overlane loop list"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["loops", "scheduled work", "recurring", "automation"],
   result: LoopList,
   handler: async (inv) => {
@@ -60242,7 +60881,7 @@ var loopNewCommand = defineCommand({
   ],
   examples: ["overlane loop new Nightly --every 1440 --filter priority=P0", "overlane loop new OnAssign --on issue.assigned"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["schedule agent", "recurring work", "event trigger", "automation", "nightly"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
@@ -60250,7 +60889,7 @@ var loopNewCommand = defineCommand({
     const on = textFlag(inv, "on");
     if (every === void 0 === (on === void 0)) throw new UsageError("pass exactly one of --every MINUTES or --on EVENT");
     const trigger = every !== void 0 ? { kind: "schedule", everyMinutes: Number(every) } : { kind: "event", on };
-    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId5(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId6(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
   }
 });
 var loopSetCommand = defineCommand({
@@ -60263,13 +60902,13 @@ var loopSetCommand = defineCommand({
   ],
   examples: ["overlane loop set lop_ab12cd34ef56gh78 off"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["disable loop", "enable loop", "stop schedule"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
     const [id2, state] = inv.positionals;
     if (id2 === void 0 || state !== "on" && state !== "off") throw new UsageError("set needs a LOOP_ID and on or off");
-    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId5(), enabled: state === "on" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId6(), enabled: state === "on" }, inv.dryRun);
   }
 });
 var loopFireCommand = defineCommand({
@@ -60279,13 +60918,13 @@ var loopFireCommand = defineCommand({
   args: [{ name: "loop-id", required: true, description: "The loop ID" }],
   examples: ["overlane loop fire lop_ab12cd34ef56gh78"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["run loop", "trigger loop", "dispatch agent"],
   result: withDryRun(LoopRun),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("fire needs a LOOP_ID");
-    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId5(), trigger: "schedule" }, inv.dryRun);
+    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId6(), trigger: "schedule" }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Loop run ${result.value.runId ?? "(none)"}: ${result.value.claimed.length} claimed, stopped: ${result.value.stopReason}.`);
     return result;
   }
@@ -60297,7 +60936,7 @@ var loopDeleteCommand = defineCommand({
   args: [{ name: "loop-id", required: false, description: "The loop ID (required; checked after the --force confirmation)" }],
   examples: ["overlane loop delete lop_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common5,
+  ...common6,
   keywords: ["remove loop", "delete schedule"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -60311,14 +60950,14 @@ var loopCommands = [loopListCommand, loopNewCommand, loopSetCommand, loopFireCom
 
 // ../cli/src/commands/review.ts
 init_src();
-import { randomUUID as randomUUID6 } from "node:crypto";
-var common6 = { needsAuth: true, needsNetwork: true };
-var requestId6 = () => `cli-${randomUUID6()}`;
-async function connected2(inv) {
+import { randomUUID as randomUUID7 } from "node:crypto";
+var common7 = { needsAuth: true, needsNetwork: true };
+var requestId7 = () => `cli-${randomUUID7()}`;
+async function connected3(inv) {
   const project = await connectedProject(inv.deps, "review");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned2(inv, method, path, body2, note) {
+async function planned3(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "review");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -60347,7 +60986,7 @@ var reviewRunCommand = defineCommand({
   flags: [{ name: "repo", type: "string", value: "OWNER/NAME", description: "The repository (default: the origin remote of this working copy)" }],
   examples: ["overlane review run 7", "overlane review run 7 --repo acme/app --dry-run"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["code review", "review pull request", "review pr", "ai review", "check my pr", "findings"],
   result: withDryRun(ReviewRunResponse),
   text: (d) => "run" in d ? [`${d.run.status} review of ${d.run.repository}#${d.run.pullNumber} (${d.run.mode}${d.run.posted ? ", posted" : ", nothing posted"}): ${d.run.findings.open} open, ${d.run.findings.fixed} fixed, ${d.run.findings.dismissed} dismissed.`, ...d.findings.filter((finding) => finding.status === "open").map(FINDING_LINE)] : [],
@@ -60355,9 +60994,9 @@ var reviewRunCommand = defineCommand({
     const number4 = Number(inv.positionals[0]);
     if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number", { hint: "overlane review run 7" });
     const repository = await repositoryOf(inv);
-    const body2 = { requestId: requestId6(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
-    if (inv.dryRun) return planned2(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub App and runs the review");
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { requestId: requestId7(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
+    if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub App and runs the review");
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     const result = await call2(ReviewRunResponse, "POST", reviewPaths.runs(tenantId, projectId), body2);
     if (result.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
     return { data: result };
@@ -60369,12 +61008,12 @@ var reviewStatusCommand = defineCommand({
   description: "Shows whether review posts comments or is log-only, the token cap, the latest runs and the number of open findings. States the data-use terms: diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review status", "overlane review status --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["review mode", "log only", "review settings", "recent reviews", "how is review doing"],
   result: ReviewStatusResponse,
   text: (d) => [`Review mode: ${d.settings.mode}. Token cap per pull request: ${d.settings.tokenCap}. Open findings: ${d.openFindings}.`, d.settings.privacy, ...d.runs.slice(0, 5).map((run3) => `${run3.startedAt}  ${run3.repository}#${run3.pullNumber}  ${run3.status}  ${run3.tokensUsed} tokens  ${run3.model}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewStatusResponse, "GET", reviewPaths.status(tenantId, projectId)) };
   }
 });
@@ -60389,12 +61028,12 @@ var reviewFindingsCommand = defineCommand({
   ],
   examples: ["overlane review findings --status open", "overlane review findings --pull 7 --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["list findings", "open comments", "review comments", "what did review find", "defects"],
   result: ReviewFindingsResponse,
   text: (d) => d.findings.length === 0 ? ["No findings."] : d.findings.map(FINDING_LINE),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     const params = new URLSearchParams();
     for (const name2 of ["pull", "repo", "status"]) {
       const value = textFlag(inv, name2);
@@ -60415,16 +61054,16 @@ var reviewDismissCommand = defineCommand({
   ],
   examples: ['overlane review dismiss fnd_1 --note "intended"', "overlane review dismiss fnd_2 --accept"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["dismiss finding", "ignore comment", "false positive", "accept finding", "teach reviewer", "feedback"],
   result: withDryRun(FeedbackResponse),
   text: (d) => "finding" in d ? [`${d.finding.id} is ${d.finding.status}.${d.learned === null ? "" : ` Learned: ${d.learned.direction} ${d.learned.rule} (${d.learned.evidence} reviews).`}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "dismiss");
     const note = textFlag(inv, "note");
-    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId6() };
-    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId7() };
+    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(FeedbackResponse, "POST", reviewPaths.feedback(tenantId, projectId, findingId), body2) };
   }
 });
@@ -60436,16 +61075,16 @@ var reviewAutofixCommand = defineCommand({
   flags: [{ name: "assign", type: "string", value: "AGENT", description: "The agent or bot to assign, for example agent:fixer" }],
   examples: ["overlane review autofix fnd_1", "overlane review autofix fnd_1 --assign agent:fixer --dry-run"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["auto fix", "autofix", "fix finding", "create task from finding", "assign to agent"],
   result: withDryRun(AutofixResponse),
   text: (d) => "taskId" in d ? [`Task ${d.taskId} created${d.assignee === null ? "" : ` for ${d.assignee}`}. Start it with: overlane task start ${d.taskId}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "autofix");
     const assignee = textFlag(inv, "assign");
-    const body2 = { requestId: requestId6(), ...assignee === void 0 ? {} : { assignee } };
-    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { requestId: requestId7(), ...assignee === void 0 ? {} : { assignee } };
+    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(AutofixResponse, "POST", reviewPaths.autofix(tenantId, projectId, findingId), body2) };
   }
 });
@@ -60455,12 +61094,12 @@ var reviewSettingsCommand = defineCommand({
   description: "Shows the mode (log-only until comments are enabled), the per-PR token cap, extra skip patterns and the statement that diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review settings"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["review configuration", "token cap", "skip patterns", "privacy", "no training", "data use"],
   result: ReviewSettings,
   text: (d) => [`Mode: ${d.mode}. Token cap: ${d.tokenCap}. Extra skip patterns: ${d.skipPatterns.length === 0 ? "none" : d.skipPatterns.join(", ")}.`, d.privacy],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewSettings, "GET", reviewPaths.settings(tenantId, projectId)) };
   }
 });
@@ -60475,7 +61114,7 @@ var reviewSettingsSetCommand = defineCommand({
   ],
   examples: ["overlane review settings set --mode comments", "overlane review settings set --token-cap 40000 --skip 'docs/**' --dry-run"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["enable review comments", "turn on review", "log only", "set token cap", "skip files"],
   result: withDryRun(ReviewSettings),
   text: (d) => "mode" in d ? [`Review is ${d.mode}. Token cap ${d.tokenCap}.`] : [],
@@ -60489,8 +61128,8 @@ var reviewSettingsSetCommand = defineCommand({
     });
     if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "), { hint: "overlane review settings set --mode comments" });
     if (Object.keys(parsed.data).length === 0) throw new UsageError("nothing to change", { hint: "overlane review settings set --mode comments" });
-    if (inv.dryRun) return planned2(inv, "PUT", reviewPaths.settings, parsed.data);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    if (inv.dryRun) return planned3(inv, "PUT", reviewPaths.settings, parsed.data);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewSettings, "PUT", reviewPaths.settings(tenantId, projectId), parsed.data) };
   }
 });
@@ -60500,12 +61139,12 @@ var codeMapStatusCommand = defineCommand({
   description: "Lists every supported client in its local and cloud setting, and the bots, review service, cross-repository questions and wiki, with whether the code map is on and the reason. The default for a setting follows the latest GATE-07 result for that setting: off for a local agent with grep (the local run failed, ADR 0018), on where there is no checkout until a re-run says otherwise.",
   examples: ["overlane code-map status", "overlane code-map status --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["code map", "code tools", "is the code map on", "gate-07", "code layer", "per client"],
   result: CodeMapStatus,
   text: (d) => d.clients.map((row) => `${row.on ? "on " : "off"}  ${row.subject}: ${row.reason}`),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(CodeMapStatus, "GET", codeMapPaths.status(tenantId, projectId)) };
   }
 });
@@ -61089,7 +61728,7 @@ async function doctor(deps, options) {
 
 // ../cli/src/kit/setup.ts
 init_src();
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
 import { join as join22 } from "node:path";
 
@@ -61305,11 +61944,11 @@ async function connectKit(deps, options) {
   const agentConfig = [join22(".claude", "settings.json"), join22(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
   const preExisting = new Set(agentConfig.filter((file2) => existsSync6(join22(root, file2))));
-  const connected3 = await connect(deps, { ...options, yes: true });
-  if (connected3.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const connected4 = await connect(deps, { ...options, yes: true });
+  if (connected4.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected3.data !== void 0 && !("dryRun" in connected3.data) ? connected3.data : void 0;
+  const connectData = connected4.data !== void 0 && !("dryRun" in connected4.data) ? connected4.data : void 0;
   for (const file2 of agentConfig) {
     if (!existsSync6(join22(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
@@ -61328,7 +61967,7 @@ async function connectKit(deps, options) {
   const kit = kitClient(deps, serviceUrl, binding.binding, token.token);
   await kit.putPolicy({ ...DEFAULT_RUN_POLICY, buildAheadLimit: firstMilestone });
   say(deps, `Run policy set (build-ahead limit ${firstMilestone}).`);
-  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID7()}`, sourceCommit: sha, plan: await readPlan(root) }));
+  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID8()}`, sourceCommit: sha, plan: await readPlan(root) }));
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
   const pr = await openPullRequest(deps, root, repository.name);
   say(deps);
@@ -61612,7 +62251,7 @@ var ReleaseRollbackResult = external_exports.union([
 ]);
 
 // ../cli/src/commands/release.ts
-var common7 = { needsAuth: true, needsNetwork: true };
+var common8 = { needsAuth: true, needsNetwork: true };
 var APPROVE = { name: "approve", type: "string", value: "DIGEST", description: "Approve this exact release digest when it changes executable files or policy" };
 var releaseListCommand = defineCommand({
   path: ["release", "list"],
@@ -61620,7 +62259,7 @@ var releaseListCommand = defineCommand({
   description: "Lists releases with version, short digest, channel, change kinds, restart rule, compatibility and which projects pin them.",
   examples: ["overlane release list"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["releases", "versions", "available", "published", "what versions", "all releases"],
   result: ReleaseListResult,
   handler: async (inv) => listReleases(inv.deps)
@@ -61631,7 +62270,7 @@ var releaseStatusCommand = defineCommand({
   description: `Compares the installed release (.harness/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
   examples: ["overlane release status"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["installed", "version", "in sync", "update available", "which release", "pinned", "am i up to date", "current release"],
   result: ReleaseStatusResult,
   handler: async (inv) => releaseStatus(inv.deps)
@@ -61643,7 +62282,7 @@ var releaseUpdateCommand = defineCommand({
   flags: [{ name: "to", type: "string", value: "DIGEST", description: "Install this release instead of the project's pin" }, APPROVE],
   examples: ["overlane release update --dry-run", "overlane release update", "overlane release update --approve sha256:..."],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["upgrade", "install release", "new version", "pull latest", "plugin update", "approve", "update plugin", "get newest"],
   result: ReleaseUpdateResult,
   handler: async (inv) => updateRelease(inv.deps, { to: textFlag(inv, "to"), approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -61655,7 +62294,7 @@ var releaseRollbackCommand = defineCommand({
   flags: [APPROVE],
   examples: ["overlane release rollback --dry-run", "overlane release rollback --force"],
   effect: "destructive",
-  ...common7,
+  ...common8,
   keywords: ["roll back", "revert", "undo update", "previous version", "downgrade", "go back", "restore", "undo release", "bad release"],
   result: ReleaseRollbackResult,
   handler: async (inv) => rollbackRelease(inv.deps, { approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -61722,7 +62361,7 @@ var RunStatusResult = external_exports.object({
 var RunPolicyChangeResult = withDryRun(external_exports.object({ changed: external_exports.boolean(), policy: PolicyShape }));
 
 // ../cli/src/commands/run.ts
-var common8 = { needsAuth: true, needsNetwork: true };
+var common9 = { needsAuth: true, needsNetwork: true };
 var EXECUTOR = { name: "executor", type: "string", enum: ["claude-code", "codex"], description: "Which agent this is (default: detected from the environment)" };
 var STOP_NOTE = "A stop (policy paused, a budget spent, nothing runnable) exits 6 with the reason in the error code and the exact `overlane run end --reason ...` as the hint.";
 var runStartCommand = defineCommand({
@@ -61732,7 +62371,7 @@ var runStartCommand = defineCommand({
   flags: [{ name: "trigger", type: "string", enum: ["schedule", "interactive", "event"], default: "interactive", description: "What started the run" }, EXECUTOR],
   examples: ["overlane run start --trigger schedule", "overlane run start --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["begin run", "bounded step", "autonomous", "start working", "new run", "schedule", "kick off"],
   result: RunStartResult,
   handler: async (inv) => startRun(inv.deps, { trigger: textFlag(inv, "trigger"), executor: textFlag(inv, "executor"), dryRun: inv.dryRun })
@@ -61744,7 +62383,7 @@ var runNextCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run next"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["what should I work on next", "next task", "runnable", "what to do", "pick a task", "which task", "what's next", "work on", "what is next", "todo"],
   result: RunNextResult,
   handler: async (inv) => nextTask(inv.deps, { executor: textFlag(inv, "executor") })
@@ -61756,7 +62395,7 @@ var runClaimCommand = defineCommand({
   args: [{ name: "task-id", required: false, description: "The task to claim (default: the next runnable one)" }],
   examples: ["overlane run claim", "overlane run claim T003"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["take task", "lease task", "grab", "assign", "pick up task", "get a task"],
   result: RunClaimResult,
   handler: async (inv) => claimTask(inv.deps, { positionals: inv.positionals, dryRun: inv.dryRun })
@@ -61773,7 +62412,7 @@ var runDecideCommand = defineCommand({
   ],
   examples: ['overlane run decide --question "Which date library?" --decision "Use the built-in Intl" --evidence "package.json has no date library"'],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["record decision", "question", "unblocked", "owner override", "judgement call", "log choice", "do not ask", "decide"],
   result: RunDecideResult,
   handler: async (inv) => decide(inv.deps, { question: textFlag(inv, "question"), decision: textFlag(inv, "decision"), evidence: listFlag(inv, "evidence"), task: textFlag(inv, "task"), dryRun: inv.dryRun })
@@ -61785,7 +62424,7 @@ var runEndCommand = defineCommand({
   flags: [{ name: "reason", type: "string", required: true, enum: RUN_STOP_REASONS, description: "Why the run ended" }],
   examples: ["overlane run end --reason nothing_runnable", "overlane run end --reason error"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["finish run", "stop", "wrap up", "close run", "release leases", "done with run", "end the run"],
   result: RunEndResult,
   handler: async (inv) => endRun(inv.deps, { reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -61797,7 +62436,7 @@ var runStatusCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run status"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["policy", "budget", "limits", "how much left", "remaining", "state of run", "is it paused", "run policy"],
   result: RunStatusResult,
   handler: async (inv) => runStatus(inv.deps, { executor: textFlag(inv, "executor") })
@@ -61808,7 +62447,7 @@ var runPauseCommand = defineCommand({
   description: "Sets the project's run policy to paused. Every run then stops at its next check (`STOP paused`). Undo with `overlane run resume`. Safe to repeat.",
   examples: ["overlane run pause", "overlane run pause --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["pause", "halt", "freeze", "stop all", "emergency brake", "disable autonomous runs", "policy", "no new runs", "stop agents", "turn off", "suspend"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "paused", inv.dryRun)
@@ -61819,7 +62458,7 @@ var runResumeCommand = defineCommand({
   description: "Sets the project's run policy back to active so runs can start and tasks can be claimed again. Safe to repeat.",
   examples: ["overlane run resume", "overlane run resume --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["unpause", "re-enable", "continue autonomous", "reactivate", "policy active", "turn on", "restart runs", "lift the pause"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "active", inv.dryRun)
@@ -61829,7 +62468,7 @@ var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCo
 // ../cli/src/task/queue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname8, join as join23 } from "node:path";
 var TASK_POLICY_PATH = join23(".harness", "task-policy.json");
@@ -61849,7 +62488,7 @@ var TaskQueueResult = TaskQueue;
 var TaskPrioritiseResult = withDryRun(external_exports.object({ ...PrioritiseResult.shape, next: external_exports.string() }));
 var TaskPolicyResult = external_exports.object({ enforcement: TaskEnforcement, reason: external_exports.string().optional(), changedBy: external_exports.string().optional(), updatedAt: external_exports.string().optional(), localFile: external_exports.string() });
 var TaskPolicySetResult = withDryRun(TaskPolicyResult);
-var requestId7 = () => `cli-${randomUUID8()}`;
+var requestId8 = () => `cli-${randomUUID9()}`;
 function priorityOf(value, fallback) {
   const parsed = TaskPriority.safeParse(value ?? fallback);
   if (!parsed.success) throw new UsageError(`--priority must be one of ${TASK_PRIORITIES.join(", ")}`);
@@ -61888,7 +62527,7 @@ async function prioritiseTask(deps, input2) {
   const name2 = detectExecutorName(deps.env);
   let request;
   try {
-    request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+    request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   } catch (error62) {
     throw new UsageError(String(error62));
   }
@@ -61917,7 +62556,7 @@ async function newTask(deps, input2) {
   const begun = data;
   const project = await connectedProject(deps, "task");
   const name2 = detectExecutorName(deps.env);
-  const request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
+  const request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
   try {
     const ranked = await serviceCall(deps, project.serviceUrl, project.token)(PrioritiseResult, "POST", taskQueuePaths.prioritise(project.binding.tenantId, project.binding.projectId, begun.taskId), request);
     say(deps, `Ranked ${begun.taskId} ${ranked.priority}${input2.top ? " (first)" : ""}.`);
@@ -61938,7 +62577,7 @@ async function setPolicy(deps, input2) {
   const enforcement = TaskEnforcement.safeParse(input2.enforcement);
   if (!enforcement.success) throw new UsageError(`set needs ${TASK_ENFORCEMENT.join(" or ")}`);
   const name2 = detectExecutorName(deps.env);
-  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId7(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId8(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
   if (input2.dryRun) {
     const project2 = await offlineProject(deps, "task");
@@ -61965,7 +62604,7 @@ async function startExisting(deps, taskId, dryRun) {
 }
 
 // ../cli/src/commands/queue.ts
-var common9 = { needsAuth: true, needsNetwork: true };
+var common10 = { needsAuth: true, needsNetwork: true };
 var PRIORITIES2 = ["P0", "P1", "P2", "P3"];
 var taskNewCommand = defineCommand({
   path: ["task", "new"],
@@ -61981,7 +62620,7 @@ var taskNewCommand = defineCommand({
   ],
   examples: ['overlane task new "Fix login redirect"', 'overlane task new "Hotfix the build" --priority P0 --top'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["new task", "create task", "no active task", "blocked no task", "start work", "need a task", "begin", "quick task"],
   result: TaskNewResult,
   handler: async (inv) => newTask(inv.deps, {
@@ -62000,7 +62639,7 @@ var taskNextCommand = defineCommand({
   description: "Picks the best ready or paused task: P0 before P3, then rank, then milestone and dependency order. When this working copy holds a task and the next one outranks it, says so (preempt) and prints the commands to checkpoint and switch; the preempted task comes back through this command afterwards.",
   examples: ["overlane task next"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["what next", "next task", "priority", "what should i work on", "pick work", "resume after", "queue"],
   result: TaskNextResult,
   handler: async (inv) => taskNext(inv.deps)
@@ -62011,7 +62650,7 @@ var taskQueueCommand = defineCommand({
   description: "Lists ready, running, paused and blocked tasks by priority, then rank, then plan order, with each task's priority.",
   examples: ["overlane task queue"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["priority list", "ranking", "order", "backlog", "what is queued", "p0"],
   result: TaskQueueResult,
   handler: async (inv) => taskQueue(inv.deps)
@@ -62028,7 +62667,7 @@ var taskPrioritiseCommand = defineCommand({
   ],
   examples: ["overlane task prioritise task-7 --priority P0 --top", 'overlane task prioritise task-9 --priority P2 --reason "user said later"'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["reprioritize", "reprioritise", "bump", "urgent", "move to top", "rank", "lower priority", "p0", "p1", "p2", "p3"],
   result: TaskPrioritiseResult,
   handler: async (inv) => prioritiseTask(inv.deps, { taskId: inv.positionals[0], priority: textFlag(inv, "priority"), top: boolFlag(inv, "top"), reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -62039,7 +62678,7 @@ var taskPolicyCommand = defineCommand({
   description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .harness/task-policy.json for the hooks.",
   examples: ["overlane task policy"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["enforcement", "require task", "task gate", "relax", "blocked", "policy"],
   result: TaskPolicyResult,
   handler: async (inv) => showPolicy2(inv.deps)
@@ -62052,7 +62691,7 @@ var taskPolicySetCommand = defineCommand({
   flags: [{ name: "reason", type: "string", value: "TEXT", description: "Why the rule is relaxed (required for relaxed)" }],
   examples: ["overlane task policy set required", 'overlane task policy set relaxed --reason "docs-only repository"'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["relax", "turn off task requirement", "require tasks", "allow edits without task", "enforcement"],
   result: TaskPolicySetResult,
   handler: async (inv) => setPolicy(inv.deps, { enforcement: inv.positionals[0], reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -62097,14 +62736,14 @@ var TaskHandoffResult = withDryRun(
 );
 
 // ../cli/src/commands/task.ts
-var common10 = { needsAuth: true, needsNetwork: true };
+var common11 = { needsAuth: true, needsNetwork: true };
 var taskListCommand = defineCommand({
   path: ["task", "list"],
   summary: "List the project's tasks and their states",
   description: "Lists every task of the connected project with its state, pause reason, version, lease holder, checks and latest checkpoint.",
   examples: ["overlane task list"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["tasks", "show all tasks", "see tasks", "backlog", "what tasks exist", "work items"],
   result: TaskListResult,
   handler: async (inv) => listTasks(inv.deps)
@@ -62122,7 +62761,7 @@ var taskStartCommand = defineCommand({
   ],
   examples: ["overlane task start task-7", 'overlane task start --outcome "Add CSV export" --criterion "export works" --check unit_tests:L2 --path "src/**"', 'overlane task start --outcome "Fix login" --criterion "login passes" --path "src/auth/**" --dry-run'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["begin", "create task", "new task", "open", "claim new", "work item", "contract", "acceptance criteria", "start working"],
   result: TaskStartResult,
   handler: async (inv) => inv.positionals[0] !== void 0 ? startExisting(inv.deps, inv.positionals[0], inv.dryRun) : startTask(inv.deps, { outcome: textFlag(inv, "outcome"), criteria: listFlag(inv, "criterion"), paths: listFlag(inv, "path"), checks: listFlag(inv, "check"), dryRun: inv.dryRun })
@@ -62133,7 +62772,7 @@ var taskStatusCommand = defineCommand({
   description: "Shows the held task from the service: state, lease, acceptance criteria, checks, evidence count and the latest checkpoint. Says so when nothing is held or the lease was lost.",
   examples: ["overlane task status"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["current task", "what am i working on", "lease", "active task", "progress", "held task"],
   result: TaskStatusResult,
   handler: async (inv) => taskStatus(inv.deps)
@@ -62149,7 +62788,7 @@ var taskCheckpointCommand = defineCommand({
   ],
   examples: ['overlane task checkpoint --summary "Parser done" --next "Write the tests"', 'overlane task checkpoint --summary "Out of budget" --next "Resume" --pause quota'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["save", "progress", "pause", "stop work", "park", "quota", "limit reached", "remember place", "snapshot", "save state", "out of budget"],
   result: TaskCheckpointResult,
   handler: async (inv) => checkpointTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), pause: textFlag(inv, "pause"), dryRun: inv.dryRun })
@@ -62161,7 +62800,7 @@ var taskResumeCommand = defineCommand({
   args: [{ name: "task-id", required: true, description: "The task to resume" }],
   examples: ["overlane task resume task-1"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["continue", "pick up", "restart", "reclaim", "after pause", "take over", "carry on"],
   result: TaskResumeResult,
   handler: async (inv) => resumeTask(inv.deps, { taskId: inv.positionals[0], dryRun: inv.dryRun })
@@ -62172,7 +62811,7 @@ var taskSubmitCommand = defineCommand({
   description: "Asks for verification at HEAD. The task is verified only when evidence at or above each required check's level exists for that commit: L2 comes from CI on the pushed commit, L1 from `overlane task evidence`.",
   examples: ["overlane task submit", "overlane task submit --dry-run"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["finish", "done", "complete", "verify", "ready for review", "request verification", "hand in", "turn in"],
   result: TaskSubmitResult,
   handler: async (inv) => submitTask(inv.deps, { dryRun: inv.dryRun })
@@ -62188,7 +62827,7 @@ var taskEvidenceCommand = defineCommand({
   ],
   examples: ["overlane task evidence --level L1 -- pnpm test"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["tests", "prove", "record test result", "verification", "run checks", "L1", "attest", "run the tests and record"],
   result: TaskEvidenceResult,
   handler: async (inv) => recordEvidence(inv.deps, { level: textFlag(inv, "level"), task: textFlag(inv, "task"), words: inv.positionals, dryRun: inv.dryRun })
@@ -62204,7 +62843,7 @@ var taskHandoffCommand = defineCommand({
   ],
   examples: ["overlane task handoff --to codex", 'overlane task handoff --to claude --summary "API done" --next "Add tests"'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["hand off", "transfer", "give to", "switch agent", "other agent", "codex", "claude", "pass the task", "delegate", "move work", "swap agents"],
   result: TaskHandoffResult,
   handler: async (inv) => handoffTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), to: textFlag(inv, "to"), dryRun: inv.dryRun })
@@ -62235,7 +62874,8 @@ function coreCommands() {
     ...memoryCommands,
     ...libCommands,
     ...reviewCommands,
-    ...guardCommands
+    ...guardCommands,
+    ...billingCommands
   ];
 }
 function createRegistry(extra = []) {