overlane 0.1.123 → 0.1.125

package/dist/overlane.mjs

@@ -4545,7 +4545,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve13) {
+function isRecursive(inst, stack, resolve14) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4555,7 +4555,7 @@ function isRecursive(inst, stack, resolve13) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve13);
+      const answer = isRecursive(child, stack, resolve14);
       if (answer > result)
         result = answer;
     }
@@ -4566,7 +4566,7 @@ function isRecursive(inst, stack, resolve13) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve13) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve14) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4630,7 +4630,7 @@ function isRecursive(inst, stack, resolve13) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve13 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve14 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -20409,7 +20409,14 @@ var init_zod = __esm({
 });
 
 // ../contracts/src/common.ts
-var identifier, TenantId, ProjectId, TaskId, CommitSha, Sha256Digest, Timestamp, SemVer, SchemaVersion;
+function withCompat(fill, schema) {
+  return external_exports.preprocess((raw) => typeof raw === "object" && raw !== null && !Array.isArray(raw) ? fill(raw) : raw, schema);
+}
+function resolveProvider(record3) {
+  if (record3.provider !== void 0) return record3.provider;
+  return record3.repository !== void 0 && record3.repository !== null ? "github" : DEFAULT_PROVIDER;
+}
+var identifier, TenantId, ProjectId, TaskId, CommitSha, Sha256Digest, Timestamp, SemVer, SchemaVersion, PROVIDERS, Provider, DEFAULT_PROVIDER;
 var init_common = __esm({
   "../contracts/src/common.ts"() {
     "use strict";
@@ -20423,6 +20430,9 @@ var init_common = __esm({
     Timestamp = external_exports.iso.datetime({ offset: true });
     SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/, "must be a semantic version");
     SchemaVersion = external_exports.literal("1");
+    PROVIDERS = ["overlane", "github", "gitlab"];
+    Provider = external_exports.enum(PROVIDERS);
+    DEFAULT_PROVIDER = "overlane";
   }
 });
 
@@ -20448,7 +20458,7 @@ var init_executor = __esm({
 });
 
 // ../contracts/src/evidence.ts
-var EvidenceLevel, EvidenceSubject, InputDigests, recordBase, MachineEvidence, HumanEvidence, EvidenceRecord;
+var EvidenceLevel, EvidenceSubject, InputDigests, recordBase, MachineRunner, MachineEvidence, HumanEvidence, EvidenceRecord;
 var init_evidence = __esm({
   "../contracts/src/evidence.ts"() {
     "use strict";
@@ -20477,15 +20487,20 @@ var init_evidence = __esm({
       recordedAt: Timestamp,
       executor: Executor
     };
+    MachineRunner = withCompat(
+      (runner) => runner["provider"] === void 0 ? { ...runner, provider: runner["environment"] === "github-checks" ? "github" : "overlane" } : runner,
+      external_exports.object({
+        provider: Provider,
+        identity: external_exports.string().min(1),
+        environment: external_exports.string().min(1)
+      }).strict()
+    );
     MachineEvidence = external_exports.object({
       ...recordBase,
       level: external_exports.enum(["L0", "L1", "L2", "L3"]),
       checkId: external_exports.string().min(1),
       checkDefinitionDigest: Sha256Digest,
-      runner: external_exports.object({
-        identity: external_exports.string().min(1),
-        environment: external_exports.string().min(1)
-      }).strict(),
+      runner: MachineRunner,
       startedAt: Timestamp,
       finishedAt: Timestamp,
       exitStatus: external_exports.number().int(),
@@ -20700,7 +20715,21 @@ var init_domain_event = __esm({
 });
 
 // ../contracts/src/api.ts
-var apiPaths, HARNESS_SCOPES, HarnessScope, RepositoryRef, CreateProjectRequest, UpdateProjectRequest, ProjectRecord, WhoAmI, ApiError;
+function checkProviderShape(value, ctx) {
+  const provider = resolveProvider(value);
+  const nested = value.repository?.provider;
+  if (nested !== void 0 && nested !== provider) {
+    ctx.addIssue({ code: "custom", path: ["repository", "provider"], message: "repository.provider must match provider" });
+  }
+  if (provider !== "overlane" && value.repository === void 0) {
+    ctx.addIssue({ code: "custom", path: ["repository"], message: `a ${provider} project needs a repository` });
+  }
+  const host = value.repository?.host;
+  if (host !== void 0 && host !== HOSTS[provider]) {
+    ctx.addIssue({ code: "custom", path: ["repository", "host"], message: `host must be ${HOSTS[provider]} for provider ${provider}; name the provider for a repository that is not on github.com` });
+  }
+}
+var apiPaths, HARNESS_SCOPES, HarnessScope, RepositoryRef, ProjectConnection, HOSTS, ProjectRepository, fillProvider, CreateProjectRequest, UpdateProjectRequest, ProjectRecord, WhoAmI, ApiError;
 var init_api2 = __esm({
   "../contracts/src/api.ts"() {
     "use strict";
@@ -20720,24 +20749,58 @@ var init_api2 = __esm({
       owner: external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/),
       name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/)
     }).strict();
-    CreateProjectRequest = external_exports.object({
-      repository: RepositoryRef,
-      name: external_exports.string().min(1).max(100),
-      /** ADR 0018: the hosted code layer is off unless a project turns it on. Missing means false. */
-      codeLayer: external_exports.boolean().optional()
+    ProjectConnection = external_exports.object({
+      provider: Provider,
+      /** The GitHub App installation number; GitHub only. */
+      installationId: external_exports.number().int().positive().optional(),
+      /** The provider's own identifier for the repository or project. */
+      externalId: external_exports.string().min(1).max(200).optional()
     }).strict();
+    HOSTS = { overlane: "overlane", github: "github.com", gitlab: "gitlab.com" };
+    ProjectRepository = external_exports.object({
+      provider: Provider.optional(),
+      host: external_exports.enum(["github.com", "gitlab.com", "overlane"]).optional(),
+      owner: external_exports.string().min(1).max(200),
+      name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/)
+    }).strict().superRefine((repository, ctx) => {
+      const provider = repository.provider ?? (repository.host === "gitlab.com" ? "gitlab" : repository.host === "overlane" ? "overlane" : "github");
+      if (repository.host !== void 0 && repository.host !== HOSTS[provider]) {
+        ctx.addIssue({ code: "custom", path: ["host"], message: `host must be ${HOSTS[provider]} for provider ${provider}` });
+      }
+      const pattern = provider === "gitlab" ? /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/ : /^[A-Za-z0-9-]{1,39}$/;
+      if (!pattern.test(repository.owner)) ctx.addIssue({ code: "custom", path: ["owner"], message: "owner is not valid for this provider" });
+    });
+    fillProvider = (record3) => record3["provider"] === void 0 ? { ...record3, provider: resolveProvider({ repository: record3["repository"] }) } : record3;
+    CreateProjectRequest = withCompat(
+      fillProvider,
+      external_exports.object({
+        provider: Provider,
+        repository: ProjectRepository.optional(),
+        connection: ProjectConnection.optional(),
+        name: external_exports.string().min(1).max(100),
+        /** ADR 0018: the hosted code layer is off unless a project turns it on. Missing means false. */
+        codeLayer: external_exports.boolean().optional()
+      }).strict().superRefine(checkProviderShape)
+    );
     UpdateProjectRequest = external_exports.object({ codeLayer: external_exports.boolean() }).strict();
-    ProjectRecord = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      name: external_exports.string().min(1).max(100),
-      repository: RepositoryRef,
-      releaseVersion: external_exports.string().min(1),
-      releaseDigest: Sha256Digest,
-      createdAt: Timestamp,
-      /** ADR 0018: registers the MCP `code` tool and opens the code routes. Missing in older records means false. */
-      codeLayer: external_exports.boolean().default(false)
-    }).strict();
+    ProjectRecord = withCompat(
+      fillProvider,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        name: external_exports.string().min(1).max(100),
+        /** Missing in records from before ADR 0050: reads as `github` with a repository, else `overlane`. */
+        provider: Provider,
+        /** Absent for a native project that has no repository yet. */
+        repository: ProjectRepository.optional(),
+        connection: ProjectConnection.optional(),
+        releaseVersion: external_exports.string().min(1),
+        releaseDigest: Sha256Digest,
+        createdAt: Timestamp,
+        /** ADR 0018: registers the MCP `code` tool and opens the code routes. Missing in older records means false. */
+        codeLayer: external_exports.boolean().default(false)
+      }).strict().superRefine(checkProviderShape)
+    );
     WhoAmI = external_exports.object({
       tenantId: TenantId,
       userId: external_exports.string().min(1),
@@ -20813,7 +20876,7 @@ var init_task_api = __esm({
 });
 
 // ../contracts/src/code-index.ts
-var SourceRange, PRECISION, Precision, SYMBOL_KINDS, SymbolKind, IndexedSymbol, Occurrence, FileShard, ManifestEntry, ManifestUploadResponse, ShardUploadRequest, SnapshotManifest, AnswerProvenance, SymbolHit, ReferenceHit, codePaths;
+var SourceRange, PRECISION, Precision, SYMBOL_KINDS, SymbolKind, IndexedSymbol, Occurrence, FileShard, ManifestEntry, ManifestUploadResponse, ShardUploadRequest, SnapshotManifest, AnswerProvenance, SymbolHit, ReferenceHit, projectBase, codePaths;
 var init_code_index = __esm({
   "../contracts/src/code-index.ts"() {
     "use strict";
@@ -20856,13 +20919,14 @@ var init_code_index = __esm({
     SnapshotManifest = external_exports.object({
       schemaVersion: external_exports.literal("1"),
       tenantId: TenantId,
-      repository: RepositoryRef,
+      repository: RepositoryRef.optional(),
+      projectId: ProjectId.optional(),
       commitSha: CommitSha,
       branch: external_exports.string().min(1).optional(),
       indexers: external_exports.array(external_exports.object({ name: external_exports.string().min(1), version: external_exports.string().min(1) }).strict()).min(1),
       files: external_exports.array(ManifestEntry),
       createdAt: Timestamp
-    }).strict();
+    }).strict().refine((manifest) => manifest.repository !== void 0 || manifest.projectId !== void 0, { message: "a manifest names a repository or a projectId" });
     AnswerProvenance = external_exports.object({
       requestedCommit: CommitSha.nullable(),
       indexedCommit: CommitSha.nullable(),
@@ -20874,7 +20938,12 @@ var init_code_index = __esm({
     }).strict();
     SymbolHit = external_exports.object({ path: external_exports.string().min(1), symbol: external_exports.string().min(1), name: external_exports.string().min(1), kind: SymbolKind, range: SourceRange, precision: Precision, source: external_exports.enum(["cloud", "local"]) }).strict();
     ReferenceHit = external_exports.object({ path: external_exports.string().min(1), symbol: external_exports.string().min(1), range: SourceRange, enclosingSymbol: external_exports.string().optional(), source: external_exports.enum(["cloud", "local"]) }).strict();
+    projectBase = (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}`;
     codePaths = {
+      projectUploadManifest: (tenantId, projectId) => `${projectBase(tenantId, projectId)}/snapshots`,
+      projectUploadShards: (tenantId, projectId, commit) => `${projectBase(tenantId, projectId)}/snapshots/${commit}/shards`,
+      projectPublish: (tenantId, projectId, commit) => `${projectBase(tenantId, projectId)}/snapshots/${commit}/publish`,
+      projectQuery: (tenantId, projectId, tool) => `${projectBase(tenantId, projectId)}/code/${tool}`,
       uploadManifest: (tenantId, owner, repo) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots`,
       uploadShards: (tenantId, owner, repo, commit) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots/${commit}/shards`,
       publish: (tenantId, owner, repo, commit) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots/${commit}/publish`,
@@ -21938,7 +22007,7 @@ function forAgent(issue2) {
   const source = issue2.external?.source ?? "overlane";
   return AgentIssueView.parse({ ...issue2, title: { trust: "untrusted_data", source, text: issue2.title }, description: { trust: "untrusted_data", source, text: issue2.description }, notice: UNTRUSTED_NOTICE });
 }
-var prefixed, IssueId, WorkProjectId, CycleId, LabelId, ViewId, LoopId, RequestId3, Title, Description, Name, ISSUE_STATUSES, IssueStatus, SettableIssueStatus, ASSIGNEE_TYPES, AssigneeType, Assignee, ACTOR_TYPES, ActorType, Actor, TASK_LINK_STATES, IssueTaskLink, IssueTaskLinks, IssueLinks, ISSUE_SOURCES, IssueSource, ExternalRef, record2, Label, WorkProject, Cycle, Issue, UNTRUSTED_NOTICE, UntrustedText, AgentIssueView, ISSUE_FIELDS, IssueField, FieldChangeEvent, VIEW_FIELDS, ViewField, ViewCondition, ViewDefinition, SavedView, ViewGroup, ViewResult, SyncFields, SyncEnvelope, SYNC_MODES, SyncMode, SyncConfig, SetSyncConfigRequest, SyncOutcome, SyncResult, LoopTrigger, LoopDefinition, LOOP_STOP_REASONS, LoopStopReason, LoopRun, IMPORT_SOURCES, ImportSource, ImportRequest, ImportReport, CreateIssueRequest, UpdateIssueRequest, AssignIssueRequest, AssignResult, CreateLabelRequest, CreateWorkProjectRequest, UpdateWorkProjectRequest, CreateCycleRequest, CreateViewRequest, CreateLoopRequest, UpdateLoopRequest, FireLoopRequest, IssueList, LabelList, WorkProjectList, CycleList, ViewList, LoopList, IssueEventList, base2, issuePaths;
+var prefixed, IssueId, WorkProjectId, CycleId, LabelId, ViewId, LoopId, RequestId3, Title, Description, Name, ISSUE_STATUSES, IssueStatus, SettableIssueStatus, ASSIGNEE_TYPES, AssigneeType, Assignee, ACTOR_TYPES, ActorType, Actor, TASK_LINK_STATES, IssueTaskLink, IssueTaskLinks, IssueLinks, ISSUE_SOURCES, IssueSource, ExternalRef, record2, Label, WorkProject, Cycle, Issue, UNTRUSTED_NOTICE, UntrustedText, AgentIssueView, ISSUE_FIELDS, IssueField, FieldChangeEvent, VIEW_FIELDS, ViewField, ViewCondition, ViewDefinition, SavedView, ViewGroup, ViewResult, SyncFields, SYNC_PROVIDERS, SyncProvider, SyncEnvelope, SYNC_MODES, SyncMode, SyncConfig, SetSyncConfigRequest, SyncOutcome, SyncResult, LoopTrigger, LoopDefinition, LOOP_STOP_REASONS, LoopStopReason, LoopRun, IMPORT_SOURCES, ImportSource, ImportRequest, ImportReport, CreateIssueRequest, UpdateIssueRequest, AssignIssueRequest, AssignResult, CreateLabelRequest, CreateWorkProjectRequest, UpdateWorkProjectRequest, CreateCycleRequest, CreateViewRequest, CreateLoopRequest, UpdateLoopRequest, FireLoopRequest, IssueList, LabelList, WorkProjectList, CycleList, ViewList, LoopList, IssueEventList, base2, issuePaths;
 var init_issues = __esm({
   "../contracts/src/issues.ts"() {
     "use strict";
@@ -22050,35 +22119,47 @@ var init_issues = __esm({
     ViewGroup = external_exports.object({ key: external_exports.string(), issues: external_exports.array(Issue) }).strict();
     ViewResult = external_exports.object({ tenantId: TenantId, viewId: ViewId.nullable(), total: external_exports.number().int().nonnegative(), groups: external_exports.array(ViewGroup) }).strict();
     SyncFields = external_exports.object({ title: Title.optional(), description: Description.optional(), status: SettableIssueStatus.optional(), labels: external_exports.array(external_exports.string().min(1).max(100)).optional(), assigneeLogin: external_exports.string().max(100).nullable().optional() }).strict();
-    SyncEnvelope = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      /** Unique per delivery or change; a second arrival does nothing. */
-      idempotencyKey: external_exports.string().min(8).max(200),
-      /** Per issue, from the source. A change at or below the highest applied sequence is late. */
-      sequence: external_exports.number().int().nonnegative(),
-      source: external_exports.enum(["github", "overlane"]),
-      /** The source's own clock; resolves a conflict inside the sync window with the server receive time. */
-      sourceTimestamp: Timestamp,
-      issue: external_exports.object({ externalId: external_exports.string().min(1).max(200), url: external_exports.string().url().max(500).optional() }).strict(),
-      change: external_exports.discriminatedUnion("kind", [
-        external_exports.object({ kind: external_exports.literal("upsert"), fields: SyncFields }).strict(),
-        /** A close carries the issue's other fields too: deliveries are snapshots, so a late earlier edit loses nothing. */
-        external_exports.object({ kind: external_exports.literal("external_close"), fields: SyncFields.optional() }).strict(),
-        external_exports.object({ kind: external_exports.literal("external_reopen"), fields: SyncFields.optional() }).strict()
-      ])
-    }).strict();
+    SYNC_PROVIDERS = [...PROVIDERS, "linear", "jira"];
+    SyncProvider = external_exports.enum(SYNC_PROVIDERS);
+    SyncEnvelope = withCompat(
+      (envelope) => envelope["provider"] === void 0 ? { ...envelope, provider: envelope["source"] } : envelope,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        /** Unique per delivery or change; a second arrival does nothing. */
+        idempotencyKey: external_exports.string().min(8).max(200),
+        /** Per issue, from the source. A change at or below the highest applied sequence is late. */
+        sequence: external_exports.number().int().nonnegative(),
+        source: external_exports.enum(["github", "overlane"]),
+        /** The system on the other side of the sync. Missing reads as `source` (github or overlane); linear, jira and gitlab name themselves here. */
+        provider: SyncProvider,
+        /** The source's own clock; resolves a conflict inside the sync window with the server receive time. */
+        sourceTimestamp: Timestamp,
+        issue: external_exports.object({ externalId: external_exports.string().min(1).max(200), url: external_exports.string().url().max(500).optional() }).strict(),
+        change: external_exports.discriminatedUnion("kind", [
+          external_exports.object({ kind: external_exports.literal("upsert"), fields: SyncFields }).strict(),
+          /** A close carries the issue's other fields too: deliveries are snapshots, so a late earlier edit loses nothing. */
+          external_exports.object({ kind: external_exports.literal("external_close"), fields: SyncFields.optional() }).strict(),
+          external_exports.object({ kind: external_exports.literal("external_reopen"), fields: SyncFields.optional() }).strict()
+        ])
+      }).strict()
+    );
     SYNC_MODES = ["off", "read_only", "write_back"];
     SyncMode = external_exports.enum(SYNC_MODES);
-    SyncConfig = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/).nullable(),
-      mode: SyncMode,
-      updatedBy: external_exports.string().nullable(),
-      updatedAt: Timestamp.nullable()
-    }).strict();
-    SetSyncConfigRequest = external_exports.object({ requestId: RequestId3, repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/), mode: SyncMode }).strict();
+    SyncConfig = withCompat(
+      (config2) => config2["provider"] === void 0 ? { ...config2, provider: config2["repository"] === null || config2["repository"] === void 0 ? "overlane" : "github" } : config2,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        /** Missing reads as `github` when a repository is set, otherwise `overlane` (ADR 0050). */
+        provider: SyncProvider,
+        repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/).nullable(),
+        mode: SyncMode,
+        updatedBy: external_exports.string().nullable(),
+        updatedAt: Timestamp.nullable()
+      }).strict()
+    );
+    SetSyncConfigRequest = external_exports.object({ requestId: RequestId3, provider: SyncProvider.optional(), repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/), mode: SyncMode }).strict();
     SyncOutcome = external_exports.enum(["applied", "replayed", "late", "ignored_off", "conflict_resolved", "external_close_recorded"]);
     SyncResult = external_exports.object({ tenantId: TenantId, outcome: SyncOutcome, issueId: IssueId.nullable(), idempotencyKey: external_exports.string() }).strict();
     LoopTrigger = external_exports.discriminatedUnion("kind", [
@@ -22192,13 +22273,23 @@ var init_issues = __esm({
 });
 
 // ../contracts/src/onboarding.ts
+function readLegacyRepoChoice(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return raw;
+  const { kind, installationId, ...rest } = raw;
+  if (kind === void 0 && installationId === void 0) return raw;
+  const out2 = { ...rest };
+  if (out2["provider"] === void 0 && kind !== void 0) out2["provider"] = kind === "native" ? "overlane" : kind;
+  if (out2["provider"] === void 0 && installationId !== void 0) out2["provider"] = "github";
+  if (installationId !== void 0 && out2["connection"] === void 0) out2["connection"] = { installationId };
+  return out2;
+}
 function initialSteps() {
   return STEP_NAMES.map((step2, i2) => ({ step: step2, status: i2 === 0 ? "done" : i2 === 1 ? "active" : "pending" }));
 }
 function newProgress(tenantId, userId, at) {
   return { tenantId, userId, step: "agents", steps: initialSteps(), data: {}, version: 0, complete: false, updatedAt: at };
 }
-var STEP_NAMES, StepName, StepStatus, RepairAction, FAILURE_REPAIRS, FAILURE_CODES, FailureCodeSchema, StepState, Slug, RepoChoice, OnboardingData, OnboardingProgress, AdvanceRequest, AdvanceResponse, OnboardingEvent, FirstReview, onboardingPaths, PROGRESS_FIXTURE;
+var STEP_NAMES, StepName, StepStatus, RepairAction, FAILURE_REPAIRS, FAILURE_CODES, FailureCodeSchema, StepState, Slug, RepoChoiceShape, RepoChoice, OnboardingData, OnboardingProgress, AdvanceRequest, AdvanceResponse, OnboardingEvent, FirstReview, onboardingPaths, PROGRESS_FIXTURE;
 var init_onboarding = __esm({
   "../contracts/src/onboarding.ts"() {
     "use strict";
@@ -22212,8 +22303,8 @@ var init_onboarding = __esm({
       "sign-in-cancelled": { id: "retry-sign-in", text: "Sign-in was cancelled. Try again, or use the email link." },
       "agent-not-connected": { id: "retry-connect", text: "The agent has not connected yet. Run the plugin command shown, then check again." },
       "agent-oauth-denied": { id: "reauthorise", text: "Access was denied in the agent's own sign-in. Approve it there, then check again." },
-      "install-cancelled": { id: "retry-install", text: "The GitHub App install was cancelled. Retry the install, or use a native repository." },
-      "repo-unreachable": { id: "pick-another-repo", text: "That repository could not be read. Pick another, or re-run the install to grant access." },
+      "install-cancelled": { id: "retry-install", text: "The GitHub App install was cancelled. Retry the install, or continue with a native Overlane project (no GitHub account needed)." },
+      "repo-unreachable": { id: "pick-another-repo", text: "That repository could not be read. Pick another, continue with a native Overlane project, or re-run the connection to grant access." },
       "task-failed": { id: "retry-task", text: "The first task did not finish. Retry it, or pick a smaller template." },
       "review-unavailable": { id: "reload-review", text: "The review is not ready. Reload it, or open the task to see its evidence." },
       "invite-failed": { id: "retry-invite", text: "An invitation could not be sent. Check the address and try again, or skip this step." }
@@ -22227,13 +22318,14 @@ var init_onboarding = __esm({
       repair: RepairAction.optional()
     }).strict().refine((s) => s.status === "failed" === (s.repair !== void 0 && s.failure !== void 0), { message: "a failed step carries a failure code and a repair action, and no other step does" });
     Slug = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/);
-    RepoChoice = external_exports.object({
-      kind: external_exports.enum(["github", "native"]),
+    RepoChoiceShape = external_exports.object({
+      provider: Provider.default("overlane"),
       owner: external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/),
       name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/),
-      /** The GitHub App installation number; absent for a native repository. */
-      installationId: external_exports.number().int().positive().optional()
+      /** Absent for a native repository. */
+      connection: external_exports.object({ installationId: external_exports.number().int().positive().optional(), externalId: external_exports.string().min(1).max(200).optional() }).strict().optional()
     }).strict();
+    RepoChoice = external_exports.preprocess(readLegacyRepoChoice, RepoChoiceShape);
     OnboardingData = external_exports.object({
       agents: external_exports.array(Slug).max(20).optional(),
       bots: external_exports.array(Slug).max(20).optional(),
@@ -22505,7 +22597,7 @@ var init_docs_service = __esm({
 function base3(tenantId, projectId) {
   return `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/review`;
 }
-var SEVERITIES, Severity, FINDING_STATUSES, FindingStatus, counts, Finding, REVIEW_SKIP_REASONS, SkipEntry, SkipList, TokenCapNotice, REVIEW_MODES, ReviewMode, REVIEW_TRIGGERS, REVIEW_STATUSES, ReviewSummary, ReviewRun, REVIEW_PRIVACY_TEXT, ReviewSettings, UpdateReviewSettingsRequest, PullFile, PullRequestSnapshot, ReviewRunRequest, ReviewRunResponse, ReviewStatusResponse, ReviewFindingsResponse, FEEDBACK_KINDS, FeedbackRequest, LearnedRule, FeedbackResponse, AutofixRequest, AutofixResponse, RawFinding, reviewPaths;
+var SEVERITIES, Severity, FINDING_STATUSES, FindingStatus, counts, Finding, REVIEW_SKIP_REASONS, SkipEntry, SkipList, TokenCapNotice, REVIEW_MODES, ReviewMode, REVIEW_TRIGGERS, REVIEW_STATUSES, ReviewSummary, ReviewRun, REVIEW_PRIVACY_TEXT, ReviewSettings, UpdateReviewSettingsRequest, PullFile, PullRequestSnapshot, MAX_PATCH_BYTES, ReviewRunRequest, ReviewRunResponse, ReviewStatusResponse, ReviewFindingsResponse, FEEDBACK_KINDS, FeedbackRequest, LearnedRule, FeedbackResponse, AutofixRequest, AutofixResponse, RawFinding, reviewPaths;
 var init_review = __esm({
   "../contracts/src/review.ts"() {
     "use strict";
@@ -22520,6 +22612,9 @@ var init_review = __esm({
       tenantId: TenantId,
       id: external_exports.string().min(1),
       projectId: ProjectId,
+      /** Where the change lives. A record from before ADR 0050 has none: read it with `reviewProvider`, which gives `github`. */
+      provider: Provider.optional(),
+      /** The repository key: `owner/name` for a connection, `overlane/<projectId>` or `patch/<projectId>` for native reviews. */
       repository: external_exports.string().min(1),
       pullNumber: external_exports.number().int().positive(),
       path: external_exports.string().min(1),
@@ -22573,6 +22668,7 @@ var init_review = __esm({
       tenantId: TenantId,
       id: external_exports.string().min(1),
       projectId: ProjectId,
+      provider: Provider.optional(),
       repository: external_exports.string().min(1),
       pullNumber: external_exports.number().int().positive(),
       headSha: CommitSha,
@@ -22613,6 +22709,7 @@ var init_review = __esm({
       patch: external_exports.string().max(4e5).optional()
     }).strict();
     PullRequestSnapshot = external_exports.object({
+      provider: Provider.optional(),
       repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
       number: external_exports.number().int().positive(),
       headSha: CommitSha,
@@ -22623,10 +22720,20 @@ var init_review = __esm({
       fork: external_exports.boolean().default(false),
       files: external_exports.array(PullFile).max(3e3)
     }).strict();
+    MAX_PATCH_BYTES = 2e6;
     ReviewRunRequest = external_exports.object({
       requestId: external_exports.string().min(1).max(128),
       trigger: external_exports.enum(REVIEW_TRIGGERS).default("manual"),
       source: external_exports.discriminatedUnion("kind", [
+        external_exports.object({
+          kind: external_exports.literal("patch"),
+          diff: external_exports.string().min(1).max(MAX_PATCH_BYTES),
+          title: external_exports.string().max(500).optional(),
+          /** Names this change so a re-review of the same change merges its findings; defaults to `patch`. */
+          label: external_exports.string().regex(/^[A-Za-z0-9._-]{1,64}$/).optional(),
+          author: external_exports.string().min(1).max(100).optional()
+        }).strict(),
+        external_exports.object({ kind: external_exports.literal("overlane"), number: external_exports.number().int().positive(), repository: external_exports.string().min(1).optional() }).strict(),
         external_exports.object({ kind: external_exports.literal("github"), repository: external_exports.string().min(1), number: external_exports.number().int().positive() }).strict(),
         external_exports.object({ kind: external_exports.literal("inline"), pull: PullRequestSnapshot }).strict()
       ])
@@ -23049,6 +23156,375 @@ var init_code_map = __esm({
   }
 });
 
+// ../contracts/src/plans.ts
+var PLAN_IDS, BillingPlanId, CHECKOUT_PLANS, CheckoutPlanId, METERS, Meter, AllowanceValue, PlanAllowances, PlanData, OverageRates, FreeTierControls, PlanCatalog, TenantPlanLimits;
+var init_plans = __esm({
+  "../contracts/src/plans.ts"() {
+    "use strict";
+    init_zod();
+    PLAN_IDS = ["free", "pro", "team", "business", "enterprise"];
+    BillingPlanId = external_exports.enum(PLAN_IDS);
+    CHECKOUT_PLANS = ["pro", "team", "business"];
+    CheckoutPlanId = external_exports.enum(CHECKOUT_PLANS);
+    METERS = ["reviews", "ciMinutes", "docsCalls", "hostedInference"];
+    Meter = external_exports.enum(METERS);
+    AllowanceValue = external_exports.union([external_exports.number().int().nonnegative(), external_exports.literal("unlimited"), external_exports.null()]);
+    PlanAllowances = external_exports.object({
+      privateProjects: AllowanceValue,
+      tasks: AllowanceValue,
+      reviews: AllowanceValue,
+      docsCalls: AllowanceValue,
+      ciMinutes: AllowanceValue
+    }).strict();
+    PlanData = external_exports.object({
+      id: BillingPlanId,
+      name: external_exports.string().min(1),
+      audience: external_exports.string().min(1),
+      /** Per month (per seat for per-seat plans), billed monthly. Null for Free and Enterprise. */
+      monthlyCents: external_exports.number().int().positive().nullable(),
+      /** Per month (per seat for per-seat plans), billed annually. */
+      annualMonthlyCents: external_exports.number().int().positive().nullable(),
+      unit: external_exports.enum(["free", "month", "seat / month", "custom"]),
+      perSeat: external_exports.boolean(),
+      /** Seat allowances are pooled across the workspace (Team) rather than held per person (REQ-BIL-07). */
+      pooled: external_exports.boolean(),
+      minimumSeats: external_exports.number().int().positive().optional(),
+      maximumSeats: external_exports.number().int().positive().optional(),
+      /** An allowance on a per-seat plan is per seat; on a workspace plan (Free) it is for the whole workspace. */
+      allowances: PlanAllowances,
+      /** Observability retention in days; null when the plan states none. */
+      retentionDays: external_exports.number().int().positive().nullable(),
+      /** Memory levels, as shown on the pricing page. */
+      memory: external_exports.string().nullable(),
+      /** Whether usage beyond an allowance is billed. Free has no card on file, so it stops instead (REQ-BIL-11). */
+      overage: external_exports.boolean()
+    }).strict();
+    OverageRates = external_exports.object({
+      /** Micro-dollars per review beyond the allowance ($0.10). */
+      reviewMicros: external_exports.number().int().positive(),
+      /** Micro-dollars per CI minute beyond the allowance ($0.006). */
+      ciMinuteMicros: external_exports.number().int().positive(),
+      /** Markup on hosted inference and compute at provider cost, in basis points (10% = 1000). BYOK is free. */
+      hostedMarkupBps: external_exports.number().int().nonnegative()
+    }).strict();
+    FreeTierControls = external_exports.object({
+      /** CPU seconds one CI job may use on a plan with no card on file. */
+      ciJobCpuSeconds: external_exports.number().int().positive(),
+      /** Requests per minute per tenant on Free, and on a paid plan. */
+      requestsPerMinute: external_exports.number().int().positive(),
+      paidRequestsPerMinute: external_exports.number().int().positive(),
+      /** Only when the person has chosen to connect an account on another service (GitHub, GitLab, ...): how old it must be. No account is ever required (ADR 0050). */
+      minimumConnectedAccountAgeDays: external_exports.number().int().nonnegative(),
+      /** CI beyond the free allowance needs a card, which means a paid plan. */
+      cardRequiredForCiBeyondAllowance: external_exports.literal(true)
+    }).strict();
+    PlanCatalog = external_exports.object({
+      version: external_exports.literal("1"),
+      currency: external_exports.literal("USD"),
+      /** Every plan, in order. */
+      plans: external_exports.array(PlanData).length(PLAN_IDS.length),
+      overage: OverageRates,
+      /** Length of the failed-payment grace period, in days, before any restriction (REQ-BIL-09). */
+      graceDays: external_exports.number().int().positive(),
+      /** Days before the end of grace that a reminder notice is sent. */
+      graceReminderDays: external_exports.array(external_exports.number().int().positive()),
+      freeTier: FreeTierControls
+    }).strict().superRefine((catalog, ctx) => {
+      catalog.plans.forEach((plan3, index) => {
+        if (plan3.id !== PLAN_IDS[index]) ctx.addIssue({ code: "custom", path: ["plans", index, "id"], message: `plans are listed in order: expected ${PLAN_IDS[index]}` });
+        if (plan3.monthlyCents === null !== (plan3.annualMonthlyCents === null)) ctx.addIssue({ code: "custom", path: ["plans", index], message: "monthly and annual prices are both set or both null" });
+        if (plan3.monthlyCents !== null && plan3.annualMonthlyCents !== null && plan3.annualMonthlyCents >= plan3.monthlyCents) {
+          ctx.addIssue({ code: "custom", path: ["plans", index, "annualMonthlyCents"], message: "annual billing is cheaper per month" });
+        }
+      });
+    });
+    TenantPlanLimits = external_exports.object({
+      tenantId: external_exports.string().min(1),
+      plan: BillingPlanId,
+      seats: external_exports.number().int().positive(),
+      /** Total for the workspace this period: per-seat allowance times seats on a per-seat plan. */
+      allowances: PlanAllowances,
+      retentionDays: external_exports.number().int().positive().nullable(),
+      /** True once the tenant is past a downgrade or grace restriction: reads work, writes do not (REQ-BIL-06, REQ-BIL-09). */
+      readOnly: external_exports.boolean(),
+      /** Whether usage beyond an allowance is billed (true) or refused (false). */
+      overage: external_exports.boolean(),
+      periodStart: external_exports.iso.datetime({ offset: true }),
+      periodEnd: external_exports.iso.datetime({ offset: true })
+    }).strict();
+  }
+});
+
+// ../contracts/src/billing.ts
+var BillingInterval, SUBSCRIPTION_STATUSES, SubscriptionStatus, Subscription, Seat, UsageEventInput, UsageEvent, RecordUsageResponse, INVOICE_STATUSES, InvoiceStatus, InvoiceLine, Invoice, GRACE_STATES, GraceState, GraceNotice, Grace, CAP_SCOPES, CapScope, Cap, PutCapRequest, DeleteCapRequest, MeterUsage, UsageSummary, CheckoutRequest, CheckoutResponse, ChangePlanRequest, OverLimit, ChangePlanResponse, SeatChangeRequest, SeatChangeResponse, CancelRequest, PortalResponse, BillingStatus, UsageDecision, STRIPE_EVENT_TYPES, StripeEventType, epochSeconds, StripeSubscriptionObject, StripeInvoiceObject, StripeCheckoutObject, StripeEvent, WEBHOOK_OUTCOMES, WebhookOutcome, WebhookResult, billingPaths;
+var init_billing = __esm({
+  "../contracts/src/billing.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_plans();
+    BillingInterval = external_exports.enum(["month", "year"]);
+    SUBSCRIPTION_STATUSES = ["active", "past_due", "canceled", "incomplete"];
+    SubscriptionStatus = external_exports.enum(SUBSCRIPTION_STATUSES);
+    Subscription = external_exports.object({
+      tenantId: TenantId,
+      plan: BillingPlanId,
+      interval: BillingInterval,
+      seats: external_exports.number().int().positive(),
+      status: SubscriptionStatus,
+      stripeCustomerId: external_exports.string().min(1).optional(),
+      stripeSubscriptionId: external_exports.string().min(1).optional(),
+      currentPeriodStart: Timestamp,
+      currentPeriodEnd: Timestamp,
+      cancelAtPeriodEnd: external_exports.boolean(),
+      /** Set by a downgrade over the new limits or by the end of a failed-payment grace period. Reads work; writes are refused; nothing is deleted (REQ-BIL-06). */
+      readOnly: external_exports.boolean(),
+      readOnlyReason: external_exports.enum(["downgrade_over_limit", "payment_failed"]).optional(),
+      updatedAt: Timestamp
+    }).strict();
+    Seat = external_exports.object({
+      tenantId: TenantId,
+      purchased: external_exports.number().int().positive(),
+      minimum: external_exports.number().int().positive(),
+      maximum: external_exports.number().int().positive().nullable(),
+      assigned: external_exports.number().int().nonnegative()
+    }).strict();
+    UsageEventInput = external_exports.object({
+      meter: Meter,
+      quantity: external_exports.number().int().positive().max(1e9),
+      idempotencyKey: external_exports.string().min(1).max(200),
+      /** When the usage happened (not when it arrived). */
+      at: Timestamp,
+      feature: external_exports.string().min(1).max(64).optional(),
+      projectId: external_exports.string().min(1).max(128).optional(),
+      agentId: external_exports.string().min(1).max(128).optional(),
+      /** Provider cost in micro-dollars, for hosted inference. The platform adds the markup. */
+      costMicros: external_exports.number().int().nonnegative().optional()
+    }).strict();
+    UsageEvent = UsageEventInput.extend({
+      tenantId: TenantId,
+      /** Monotonic per tenant, assigned when first recorded; a replay returns the first one. */
+      sequence: external_exports.number().int().positive(),
+      /** Start of the billing period whose invoice carries this usage. Late usage after an invoice closed lands on the next one (REQ-BIL-08). */
+      periodStart: Timestamp,
+      receivedAt: Timestamp,
+      /** True when the event arrived after its own period's invoice closed. */
+      late: external_exports.boolean()
+    }).strict();
+    RecordUsageResponse = external_exports.object({ event: UsageEvent, duplicate: external_exports.boolean() }).strict();
+    INVOICE_STATUSES = ["draft", "open", "paid", "void", "uncollectible"];
+    InvoiceStatus = external_exports.enum(INVOICE_STATUSES);
+    InvoiceLine = external_exports.object({
+      kind: external_exports.enum(["subscription", "proration", "usage"]),
+      meter: Meter.optional(),
+      description: external_exports.string().min(1).max(200),
+      quantity: external_exports.number().int().nonnegative(),
+      unitMicros: external_exports.number().int().nonnegative().optional(),
+      amountCents: external_exports.number().int()
+    }).strict();
+    Invoice = external_exports.object({
+      tenantId: TenantId,
+      invoiceId: external_exports.string().min(1),
+      status: InvoiceStatus,
+      periodStart: Timestamp,
+      periodEnd: Timestamp,
+      lines: external_exports.array(InvoiceLine),
+      totalCents: external_exports.number().int(),
+      /** The invoice stopped taking new usage at this time. Usage that arrives later goes on the next invoice. */
+      closedAt: Timestamp.optional(),
+      paidAt: Timestamp.optional(),
+      failedAttempts: external_exports.number().int().nonnegative()
+    }).strict();
+    GRACE_STATES = ["none", "grace", "restricted"];
+    GraceState = external_exports.enum(GRACE_STATES);
+    GraceNotice = external_exports.object({
+      id: external_exports.string().min(1),
+      kind: external_exports.enum(["payment_failed", "reminder", "restricted", "recovered"]),
+      at: Timestamp,
+      message: external_exports.string().min(1)
+    }).strict();
+    Grace = external_exports.object({
+      tenantId: TenantId,
+      state: GraceState,
+      invoiceId: external_exports.string().min(1).optional(),
+      startedAt: Timestamp.optional(),
+      endsAt: Timestamp.optional(),
+      notices: external_exports.array(GraceNotice)
+    }).strict();
+    CAP_SCOPES = ["team", "project", "agent"];
+    CapScope = external_exports.enum(CAP_SCOPES);
+    Cap = external_exports.object({
+      tenantId: TenantId,
+      scope: CapScope,
+      /** Project ID or agent token ID; absent for the whole team. */
+      scopeId: external_exports.string().min(1).max(128).optional(),
+      /** Per billing period, in cents of metered spend (overage plus hosted inference with markup). */
+      limitCents: external_exports.number().int().positive().max(1e8),
+      updatedBy: external_exports.string().min(1),
+      updatedAt: Timestamp
+    }).strict().superRefine((cap, ctx) => {
+      if (cap.scope === "team" && cap.scopeId !== void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: "a team cap has no scope ID" });
+      if (cap.scope !== "team" && cap.scopeId === void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: "a project or agent cap names its project or agent" });
+    });
+    PutCapRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      scope: CapScope,
+      scopeId: external_exports.string().min(1).max(128).optional(),
+      limitCents: external_exports.number().int().positive().max(1e8)
+    }).strict();
+    DeleteCapRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), scope: CapScope, scopeId: external_exports.string().min(1).max(128).optional() }).strict();
+    MeterUsage = external_exports.object({
+      meter: Meter,
+      used: external_exports.number().int().nonnegative(),
+      /** Total allowance for the workspace this period (per-seat allowance times seats). Null when the plan states none. */
+      allowance: AllowanceValue,
+      overUnits: external_exports.number().int().nonnegative(),
+      /** Price of one unit beyond the allowance, in micro-dollars; null for hosted inference (provider cost plus markup) and unmetered-for-billing meters. */
+      rateMicros: external_exports.number().int().nonnegative().nullable(),
+      overageMicros: external_exports.number().int().nonnegative()
+    }).strict();
+    UsageSummary = external_exports.object({
+      tenantId: TenantId,
+      plan: BillingPlanId,
+      periodStart: Timestamp,
+      periodEnd: Timestamp,
+      meters: external_exports.array(MeterUsage),
+      /** Metered spend this period: overage plus hosted inference with markup, in micro-dollars. */
+      spendMicros: external_exports.number().int().nonnegative(),
+      /** Plain-language messages: an allowance reached, overage starting, a cap near. */
+      notices: external_exports.array(external_exports.string().min(1))
+    }).strict();
+    CheckoutRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      plan: CheckoutPlanId,
+      interval: BillingInterval.default("month"),
+      seats: external_exports.number().int().positive().max(1e4).default(1)
+    }).strict();
+    CheckoutResponse = external_exports.object({
+      tenantId: TenantId,
+      sessionId: external_exports.string().min(1),
+      /** A Stripe-hosted page. Card details are entered there and never reach Overlane (REQ-BIL-13). */
+      url: external_exports.string().url(),
+      plan: CheckoutPlanId,
+      interval: BillingInterval,
+      seats: external_exports.number().int().positive(),
+      /** What the first period costs before tax, in cents. Stripe Tax adds tax at checkout. */
+      firstPeriodCents: external_exports.number().int().nonnegative()
+    }).strict();
+    ChangePlanRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      plan: BillingPlanId.exclude(["enterprise"]),
+      interval: BillingInterval.optional(),
+      seats: external_exports.number().int().positive().max(1e4).optional()
+    }).strict();
+    OverLimit = external_exports.object({ what: external_exports.string().min(1), used: external_exports.number().int().nonnegative(), limit: external_exports.number().int().nonnegative() }).strict();
+    ChangePlanResponse = external_exports.object({
+      subscription: Subscription,
+      /** Charge (positive) or credit (negative) for the rest of the period, in cents. */
+      prorationCents: external_exports.number().int(),
+      /** What the new plan's limits are exceeded by. When non-empty the workspace is read-only; nothing is deleted. */
+      overLimit: external_exports.array(OverLimit),
+      deleted: external_exports.literal(0)
+    }).strict();
+    SeatChangeRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), seats: external_exports.number().int().positive().max(1e4) }).strict();
+    SeatChangeResponse = external_exports.object({
+      subscription: Subscription,
+      seat: Seat,
+      /** Prorated charge (positive) or credit (negative) for the remainder of the period, in cents (REQ-BIL-05). */
+      prorationCents: external_exports.number().int()
+    }).strict();
+    CancelRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), atPeriodEnd: external_exports.boolean().default(true) }).strict();
+    PortalResponse = external_exports.object({ tenantId: TenantId, url: external_exports.string().url() }).strict();
+    BillingStatus = external_exports.object({
+      tenantId: TenantId,
+      subscription: Subscription,
+      seat: Seat,
+      grace: Grace,
+      limits: TenantPlanLimits,
+      usage: UsageSummary,
+      caps: external_exports.array(Cap),
+      invoices: external_exports.array(Invoice),
+      /** True when Stripe is configured; false while the live leg is pending and the in-process fake serves. */
+      live: external_exports.boolean()
+    }).strict();
+    UsageDecision = external_exports.object({
+      tenantId: TenantId,
+      meter: Meter,
+      outcome: external_exports.enum(["within_allowance", "overage", "refused", "cap_reached", "read_only"]),
+      allowed: external_exports.boolean(),
+      /** Micro-dollars this unit costs; zero within the allowance. */
+      chargeMicros: external_exports.number().int().nonnegative(),
+      message: external_exports.string().min(1),
+      nextCommand: external_exports.string().nullable(),
+      exitCode: external_exports.union([external_exports.literal(0), external_exports.literal(6)])
+    }).strict();
+    STRIPE_EVENT_TYPES = [
+      "checkout.session.completed",
+      "customer.subscription.created",
+      "customer.subscription.updated",
+      "customer.subscription.deleted",
+      "invoice.created",
+      "invoice.finalized",
+      "invoice.paid",
+      "invoice.payment_failed"
+    ];
+    StripeEventType = external_exports.enum(STRIPE_EVENT_TYPES);
+    epochSeconds = external_exports.number().int().nonnegative();
+    StripeSubscriptionObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      status: external_exports.enum(["active", "past_due", "canceled", "incomplete", "unpaid", "trialing", "incomplete_expired"]),
+      cancel_at_period_end: external_exports.boolean(),
+      current_period_start: epochSeconds,
+      current_period_end: epochSeconds,
+      quantity: external_exports.number().int().positive(),
+      metadata: external_exports.object({ tenantId: TenantId, plan: CheckoutPlanId, interval: BillingInterval }).passthrough()
+    }).passthrough();
+    StripeInvoiceObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      subscription: external_exports.string().min(1).nullable(),
+      status: external_exports.enum(["draft", "open", "paid", "void", "uncollectible"]),
+      amount_due: external_exports.number().int().nonnegative(),
+      amount_paid: external_exports.number().int().nonnegative(),
+      period_start: epochSeconds,
+      period_end: epochSeconds,
+      attempt_count: external_exports.number().int().nonnegative().default(0),
+      metadata: external_exports.object({ tenantId: TenantId.optional() }).passthrough().default({})
+    }).passthrough();
+    StripeCheckoutObject = external_exports.object({
+      id: external_exports.string().min(1),
+      customer: external_exports.string().min(1),
+      subscription: external_exports.string().min(1).nullable(),
+      metadata: external_exports.object({ tenantId: TenantId }).passthrough()
+    }).passthrough();
+    StripeEvent = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.string().min(1),
+      created: epochSeconds,
+      data: external_exports.object({ object: external_exports.record(external_exports.string(), external_exports.unknown()) })
+    }).passthrough();
+    WEBHOOK_OUTCOMES = ["applied", "replayed", "stale", "ignored"];
+    WebhookOutcome = external_exports.enum(WEBHOOK_OUTCOMES);
+    WebhookResult = external_exports.object({ ok: external_exports.literal(true), outcome: WebhookOutcome, eventId: external_exports.string().min(1) }).strict();
+    billingPaths = {
+      status: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing`,
+      checkout: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/checkout`,
+      plan: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/plan`,
+      seats: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/seats`,
+      cancel: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/cancel`,
+      portal: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/portal`,
+      usage: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/usage`,
+      decision: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/usage/decision`,
+      caps: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/caps`,
+      invoices: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/invoices`,
+      limits: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/billing/limits`,
+      stripeWebhook: "/webhooks/billing/stripe",
+      workosWebhook: "/webhooks/billing/workos"
+    };
+  }
+});
+
 // ../contracts/src/index.ts
 var init_src = __esm({
   "../contracts/src/index.ts"() {
@@ -23079,6 +23555,8 @@ var init_src = __esm({
     init_review();
     init_guardrails();
     init_code_map();
+    init_plans();
+    init_billing();
   }
 });
 
@@ -30413,25 +30891,25 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename4, join as join24, resolve as resolve10 } from "node:path";
+import { basename as basename5, join as join24, resolve as resolve11 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
   if (override !== void 0 && override !== "") return override;
-  return resolve10(fileURLToPath(new URL(".", import.meta.url)), "..");
+  return resolve11(fileURLToPath(new URL(".", import.meta.url)), "..");
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
   return override !== void 0 && override !== "" ? override : join24(packageRoot(env), "assets");
 }
 function assetFile(name2) {
-  return join24(assetDir(), basename4(name2));
+  return join24(assetDir(), basename5(name2));
 }
 var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.123" : "0.0.0-dev";
+    VERSION = true ? "0.1.125" : "0.0.0-dev";
   }
 });
 
@@ -31849,7 +32327,7 @@ function createFileRegistry(...args2) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve13(protoFileName);
+        const dep = resolve14(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file2.name}`);
         }
@@ -31863,7 +32341,7 @@ function createFileRegistry(...args2) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input2 = args2[0];
-    const resolve13 = args2[1];
+    const resolve14 = args2[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file2 of [input2, ...recurseDeps(input2)].reverse()) {
       addFile(file2, registry2);
@@ -34276,13 +34754,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve13, reject) => {
+          return new Promise((resolve14, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve13(xhr.response);
+                resolve14(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -34478,9 +34956,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve13(receiveInstance(mod, inst));
+          resolve14(receiveInstance(mod, inst));
         });
       });
     }
@@ -35813,8 +36291,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve13, reject) => {
-      readyPromiseResolve = resolve13;
+    moduleRtn = new Promise((resolve14, reject) => {
+      readyPromiseResolve = resolve14;
       readyPromiseReject = reject;
     });
   }
@@ -38441,7 +38919,8 @@ async function buildSnapshot(options) {
   const manifest = SnapshotManifest.parse({
     schemaVersion: "1",
     tenantId: options.tenantId,
-    repository: options.repository,
+    ...options.repository !== void 0 ? { repository: options.repository } : {},
+    ...options.projectId !== void 0 ? { projectId: options.projectId } : {},
     commitSha: options.commitSha,
     ...options.branch !== void 0 ? { branch: options.branch } : {},
     indexers: [...indexers.values()].sort((a, b) => compareStrings(a.name, b.name) || compareStrings(a.version, b.version)),
@@ -38472,7 +38951,9 @@ async function uploadSnapshot(options) {
   const doFetch = options.fetch ?? fetch;
   const base4 = options.serviceUrl.replace(/\/+$/, "");
   const manifest = SnapshotManifest.parse(options.manifest);
-  const { tenantId, repository, commitSha } = manifest;
+  const { tenantId, repository, projectId, commitSha } = manifest;
+  const byProject = projectId !== void 0 && (repository === void 0 || options.byProject === true);
+  if (!byProject && repository === void 0) throw new Error("the manifest names neither a repository nor a project");
   const headers = { authorization: `Bearer ${options.token}`, "content-type": "application/json" };
   const send2 = async (path, body2) => {
     for (let attempt2 = 1; ; attempt2 += 1) {
@@ -38490,16 +38971,17 @@ async function uploadSnapshot(options) {
         failure4 = error62 instanceof Error ? error62.message : String(error62);
         if (attempt2 >= ATTEMPTS) throw new Error(`POST ${path} failed: ${failure4}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, (options.retryDelayMs ?? 500) * attempt2));
+      await new Promise((resolve14) => setTimeout(resolve14, (options.retryDelayMs ?? 500) * attempt2));
     }
   };
-  const manifestResponse = await send2(codePaths.uploadManifest(tenantId, repository.owner, repository.name), JSON.stringify(manifest));
+  const manifestPath = byProject ? codePaths.projectUploadManifest(tenantId, projectId ?? "") : codePaths.uploadManifest(tenantId, repository?.owner ?? "", repository?.name ?? "");
+  const manifestResponse = await send2(manifestPath, JSON.stringify(manifest));
   const { missing } = ManifestUploadResponse.parse(await manifestResponse.json());
   const wanted = new Set(missing);
   for (const hash2 of options.existing ?? []) wanted.delete(hash2);
   const maxShards = options.maxBatchShards ?? MAX_BATCH_SHARDS;
   const maxBytes = options.maxBatchBytes ?? MAX_BATCH_BYTES;
-  const shardsPath = codePaths.uploadShards(tenantId, repository.owner, repository.name, commitSha);
+  const shardsPath = byProject ? codePaths.projectUploadShards(tenantId, projectId ?? "", commitSha) : codePaths.uploadShards(tenantId, repository?.owner ?? "", repository?.name ?? "", commitSha);
   let batch = [];
   let batchBytes = 0;
   let uploadedShards = 0;
@@ -38523,7 +39005,7 @@ async function uploadSnapshot(options) {
     batchBytes += size;
   }
   await flush();
-  await send2(codePaths.publish(tenantId, repository.owner, repository.name, commitSha), "{}");
+  await send2(byProject ? codePaths.projectPublish(tenantId, projectId ?? "", commitSha) : codePaths.publish(tenantId, repository?.owner ?? "", repository?.name ?? "", commitSha), "{}");
   return { missing: missing.length, uploadedShards, batches };
 }
 var MAX_BATCH_SHARDS, MAX_BATCH_BYTES, ATTEMPTS, HttpError;
@@ -38568,7 +39050,7 @@ var init_oidc = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readdir as readdir4, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join26, resolve as resolve11 } from "node:path";
+import { join as join26, resolve as resolve12 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify2 } from "node:util";
 async function git3(root, args2) {
@@ -38589,9 +39071,11 @@ async function repositoryFromRemote(root) {
   }
 }
 async function snapshotFromArgs(values, env) {
-  const root = resolve11(typeof values["root"] === "string" ? values["root"] : process.cwd());
-  const repoText = (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
-  if (!repoText) throw new UsageError2("cannot determine the repository; pass --repo owner/name");
+  const root = resolve12(typeof values["root"] === "string" ? values["root"] : process.cwd());
+  const projectId = typeof values["project"] === "string" ? values["project"] : void 0;
+  if (projectId !== void 0 && !ProjectId.safeParse(projectId).success) throw new UsageError2(`--project must be a project identifier, got "${projectId}"`);
+  const repoText = projectId !== void 0 ? typeof values["repo"] === "string" ? values["repo"] : void 0 : (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
+  if (!repoText && projectId === void 0) throw new UsageError2("cannot determine the repository; pass --project ID, or --repo owner/name");
   const commit = (typeof values["commit"] === "string" ? values["commit"] : void 0) ?? env["GITHUB_SHA"] ?? await git3(root, ["rev-parse", "HEAD"]);
   const branch = typeof values["branch"] === "string" ? values["branch"] : void 0;
   const tenant = (typeof values["tenant"] === "string" ? values["tenant"] : void 0) ?? env["HARNESS_TENANT"];
@@ -38599,9 +39083,10 @@ async function snapshotFromArgs(values, env) {
   const scip = Array.isArray(values["scip"]) ? values["scip"] : [];
   return buildSnapshot({
     repoRoot: root,
-    scipFiles: scip.map((file2) => resolve11(file2)),
+    scipFiles: scip.map((file2) => resolve12(file2)),
     tenantId: tenant,
-    repository: parseRepository(repoText),
+    ...repoText ? { repository: parseRepository(repoText) } : {},
+    ...projectId !== void 0 ? { projectId } : {},
     commitSha: commit,
     ...branch !== void 0 ? { branch } : {}
   });
@@ -38614,17 +39099,18 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
       const outDir = values.out;
       if (!outDir) throw new UsageError2("build needs --out DIR");
       const built = await snapshotFromArgs({ ...values, tenant: values.tenant ?? env["HARNESS_TENANT"] ?? "local" }, env);
-      await writeSnapshot(resolve11(outDir), built);
-      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve11(outDir)}`);
+      await writeSnapshot(resolve12(outDir), built);
+      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve12(outDir)}`);
       return 0;
     }
     if (command === "upload") {
       const service = values.service;
       if (!service) throw new UsageError2("upload needs --service URL");
       const built = await snapshotFromArgs(values, env);
-      const token = env["ACTIONS_ID_TOKEN_REQUEST_URL"] ? await getOidcToken(values.audience ?? service, env) : env["HARNESS_TOKEN"];
-      if (!token) throw new UsageError2("no credentials: run in GitHub Actions with id-token: write, or set HARNESS_TOKEN");
-      const result = await uploadSnapshot({ serviceUrl: service, token, manifest: built.manifest, shards: built.shards });
+      const byProject = values.project !== void 0;
+      const token = !byProject && env["ACTIONS_ID_TOKEN_REQUEST_URL"] ? await getOidcToken(values.audience ?? service, env) : env["HARNESS_TOKEN"];
+      if (!token) throw new UsageError2(byProject ? "no credentials: set HARNESS_TOKEN" : "no credentials: run in GitHub Actions with id-token: write, or set HARNESS_TOKEN");
+      const result = await uploadSnapshot({ serviceUrl: service, token, manifest: built.manifest, shards: built.shards, ...byProject ? { byProject: true } : {} });
       out2(`published ${built.manifest.commitSha}: ${built.shards.length} shards, ${result.missing} new, ${result.batches} batches`);
       return 0;
     }
@@ -38659,10 +39145,12 @@ var init_run = __esm({
     init_upload();
     execFileAsync2 = promisify2(execFile2);
     USAGE = `usage:
-  mvrx-index build  --scip FILE [--scip FILE ...] --out DIR [--repo owner/name] [--tenant ID] [--commit SHA] [--branch B] [--root DIR]
-  mvrx-index upload --service URL --tenant ID --repo owner/name --commit SHA [--branch B] [--scip FILE ...] [--root DIR] [--audience URL]
+  mvrx-index build  --scip FILE [--scip FILE ...] --out DIR [--project ID | --repo owner/name] [--tenant ID] [--commit SHA] [--branch B] [--root DIR]
+  mvrx-index upload --service URL --tenant ID (--project ID | --repo owner/name) --commit SHA [--branch B] [--scip FILE ...] [--root DIR] [--audience URL]
 
-Authentication for upload: the GitHub Actions OIDC token when ACTIONS_ID_TOKEN_REQUEST_URL is set, otherwise HARNESS_TOKEN.
+--project indexes an Overlane project (no GitHub repository needed) and uploads with HARNESS_TOKEN.
+--repo names a GitHub repository; in GitHub Actions the OIDC token is used when ACTIONS_ID_TOKEN_REQUEST_URL is set.
+Authentication for upload: HARNESS_TOKEN (always for --project), or the GitHub Actions OIDC token for --repo.
 `;
     UsageError2 = class extends Error {
     };
@@ -38672,6 +39160,7 @@ Authentication for upload: the GitHub Actions OIDC token when ACTIONS_ID_TOKEN_R
       service: { type: "string" },
       tenant: { type: "string" },
       repo: { type: "string" },
+      project: { type: "string" },
       commit: { type: "string" },
       branch: { type: "string" },
       root: { type: "string" },
@@ -42243,14 +42732,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve13();
+      resolve14();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -44046,7 +44535,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve13, reject) => {
+        return new Promise((resolve14, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -44114,7 +44603,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve13(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve14(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -44126,11 +44615,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema2, legOptions)
               };
-              return resolve13(this._resolveNonCompleteResult(decoded, flow));
+              return resolve14(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema2, result).then((parseResult) => {
-              if (parseResult.success) resolve13(parseResult.data);
+              if (parseResult.success) resolve14(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -46946,7 +47435,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve13.call(this, root, ref);
+        let _sch = resolve14.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -46972,7 +47461,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve13(root, ref) {
+      function resolve14(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -47422,7 +47911,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse5(serialize(uri, options), options);
         return uri;
       }
-      function resolve13(baseURI, relativeURI, options) {
+      function resolve14(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
@@ -47596,7 +48085,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve13,
+        resolve: resolve14,
         resolveComponent,
         equal,
         serialize,
@@ -53293,7 +53782,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve13, reject) => {
+        return new Promise((resolve14, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -53308,14 +53797,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve13();
+            resolve14();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve13();
+            resolve14();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -53369,14 +53858,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve13) => {
+        return await new Promise((resolve14) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve13(true);
+            resolve14(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve13(false);
+            resolve14(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -53601,9 +54090,9 @@ var init_config = __esm({
 
 // ../code-shim/src/local.ts
 import { readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve12, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve13, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
-  const absolute = resolve12(root, path);
+  const absolute = resolve13(root, path);
   const rel = relative3(root, absolute);
   if (rel.length === 0 || rel.startsWith("..") || isAbsolute2(rel)) return null;
   return absolute;
@@ -55077,19 +55566,19 @@ function pkcePair() {
   return { verifier, challenge: base64url3(createHash("sha256").update(verifier).digest()) };
 }
 function listen(server, port) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const onError = (error62) => reject(error62);
     server.once("error", onError);
     server.listen(port, "127.0.0.1", () => {
       server.off("error", onError);
-      resolve13();
+      resolve14();
     });
   });
 }
 async function startLoopback(preferredPort, state) {
   let settle2;
-  const code2 = new Promise((resolve13, reject) => {
-    settle2 = { resolve: resolve13, reject };
+  const code2 = new Promise((resolve14, reject) => {
+    settle2 = { resolve: resolve14, reject };
   });
   code2.catch(() => void 0);
   const server = createServer((request, response) => {
@@ -55277,7 +55766,7 @@ async function requireToken(deps, serviceUrl) {
 
 // ../cli/src/project.ts
 init_src();
-import { join as join5 } from "node:path";
+import { basename, join as join5 } from "node:path";
 var REMOTE_PATTERNS = [
   /^(?:https?|git|ssh):\/\/(?:[^@/]+@)?github\.com(?::\d+)?\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
   /^(?:[^@/]+@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?\/?$/i
@@ -55292,21 +55781,49 @@ function parseGitHubRemote(url2) {
   }
   return null;
 }
-async function detectProject(deps) {
+function parseProvider(value) {
+  if (value === void 0) return void 0;
+  if (PROVIDERS.includes(value)) return value;
+  throw new UsageError(`--provider must be one of ${PROVIDERS.join(", ")}`, { hint: "overlane connect --provider overlane" });
+}
+function safeName(text) {
+  const cleaned = text.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|-+$/g, "");
+  return cleaned.slice(0, 100) === "" ? "project" : cleaned.slice(0, 100);
+}
+function projectLabel(project) {
+  return project.repository === void 0 ? project.name : `${project.repository.owner}/${project.repository.name}`;
+}
+function projectSummary(project) {
+  return { provider: project.provider, ...project.repository === void 0 ? {} : { owner: project.repository.owner }, name: project.repository?.name ?? project.name, root: project.root };
+}
+function projectRequest(project) {
+  if (project.provider === "github" && project.repository !== void 0) {
+    return { provider: "github", repository: project.repository, name: project.name };
+  }
+  return { provider: "overlane", name: project.name };
+}
+async function detectProject(deps, choice = {}) {
   const top = await deps.exec("git", ["rev-parse", "--show-toplevel"], { cwd: deps.paths.cwd });
   if (top.code !== 0 || top.stdout.trim().length === 0) {
-    throw new UsageError("not inside a git repository (or git is not installed); run overlane from a GitHub-hosted project");
+    throw new UsageError("not inside a git repository (or git is not installed); run overlane from your project folder (`git init` makes one)");
   }
   const root = top.stdout.trim();
+  if (choice.name !== void 0 && (choice.name.trim().length === 0 || choice.name.length > 100)) throw new UsageError("--name must be 1 to 100 characters");
   const remote = await deps.exec("git", ["remote", "get-url", "origin"], { cwd: root });
-  if (remote.code !== 0 || remote.stdout.trim().length === 0) {
-    throw new UsageError("the repository has no `origin` remote; add the GitHub remote and run overlane again");
+  const originUrl = remote.code === 0 ? remote.stdout.trim() : "";
+  const github = originUrl.length === 0 ? null : parseGitHubRemote(originUrl);
+  const wanted = choice.provider;
+  if (wanted === "gitlab") {
+    throw new UsageError("--provider gitlab is not available from the CLI yet; use --provider overlane (the default) and connect GitLab from the web app", { hint: "overlane connect --provider overlane" });
+  }
+  if (wanted === "github" && github === null) {
+    const why = originUrl.length === 0 ? "this repository has no `origin` remote" : `origin is ${originUrl}, which is not a github.com repository`;
+    throw new UsageError(`--provider github needs a github.com origin, and ${why}. Leave --provider off to make a native Overlane project, or add the GitHub remote first`, { hint: "overlane connect --provider overlane" });
   }
-  const repository = parseGitHubRemote(remote.stdout);
-  if (repository === null) {
-    throw new UsageError(`origin is ${remote.stdout.trim()}, which is not a github.com repository; only GitHub projects are supported`);
+  if (github !== null && wanted !== "overlane") {
+    return { root, provider: "github", name: choice.name ?? github.name, repository: github };
   }
-  return { root, repository };
+  return { root, provider: "overlane", name: choice.name ?? (basename(root).slice(0, 100) || "project") };
 }
 async function headCommit(deps, root) {
   const head = await deps.exec("git", ["rev-parse", "HEAD"], { cwd: root });
@@ -55546,7 +56063,7 @@ var DEFAULT_SERVICE_URL = "https://api.overlane.dev";
 var CONNECT_STEPS = {
   "sign-up": "sign in through the browser (OAuth with PKCE), or use HARNESS_TOKEN",
   agents: "register the plugin with each agent's own commands (no vendor token is asked for)",
-  repo: "bind this GitHub project to the service",
+  repo: "bind this project to the service: a native Overlane project by default, or your GitHub repository",
   "first-task": 'start your first task with `overlane task new "<title>"`',
   "first-review": "read the first review in the web app",
   invite: "invite teammates from the web app (optional, never blocks)"
@@ -55595,10 +56112,9 @@ async function connect(deps, options) {
   if (active.length === 0) {
     throw new CliError("none of the selected agents is installed, so there is nothing to connect", { code: "no_agent", exit: EXIT.conflict, hint: "overlane doctor" });
   }
-  const project = await detectProject(deps);
+  const project = await detectProject(deps, { name: options.name, provider: options.provider });
   const root = project.root;
-  const { repository } = project;
-  say(deps, `Project: ${repository.owner}/${repository.name} at ${root}`);
+  say(deps, `Project: ${projectLabel(project)}${project.provider === "overlane" ? " (native Overlane project; no GitHub account needed)" : " (GitHub)"} at ${root}`);
   const existing = readBindingFile(root);
   const serviceInput = options.service ?? deps.env["HARNESS_SERVICE_URL"] ?? (existing.kind === "ok" ? existing.binding.serviceUrl : DEFAULT_SERVICE_URL);
   if (serviceInput === void 0 || serviceInput.length === 0) {
@@ -55646,7 +56162,7 @@ async function connect(deps, options) {
   say(deps, `Steps (the same names as the web onboarding): ${STEP_NAMES.join(", ")}`);
   say(deps, "Plan");
   say(deps, `  sign-in: ${existingToken === null ? `browser sign-in to ${serviceUrl} (OAuth with PKCE), token kept in the OS keychain or a 0600 file in your user config directory` : `${describeStore(deps, existingToken.source)}`}`);
-  say(deps, `  service: GET ${serviceUrl}/v1/me, then create or look up the project for ${repository.owner}/${repository.name}`);
+  say(deps, `  service: GET ${serviceUrl}/v1/me, then create or look up the project ${projectLabel(project)}`);
   for (const step2 of steps) say(deps, `  ${step2.agent}: ${step2.summary}
     $ ${formatCommand(step2)}`);
   if (codexEdit !== null) {
@@ -55674,7 +56190,7 @@ async function connect(deps, options) {
       service: serviceUrl,
       requests: [
         { method: "GET", path: apiPaths.whoami, note: existingToken === null ? "after browser sign-in" : "with the stored token" },
-        { method: "POST", path: apiPaths.projects("<tenantId from /v1/me>"), body: { repository, name: repository.name }, note: "creates the project or returns the existing one" },
+        { method: "POST", path: apiPaths.projects("<tenantId from /v1/me>"), body: projectRequest(project), note: "creates the project or returns the existing one" },
         { method: "GET", path: releasePaths.publicKey(), note: "the release-signing key; a failure here does not fail connect" }
       ],
       commands: steps.map((step2) => formatCommand(step2)),
@@ -55694,7 +56210,7 @@ async function connect(deps, options) {
     }
     if (!await deps.confirm("Apply this plan?")) {
       say(deps, "Cancelled; nothing changed.");
-      return { data: emptyResult(repository, root, serviceUrl, infos, true) };
+      return { data: emptyResult(project, serviceUrl, infos, true) };
     }
   }
   const token = await ensureToken(deps, serviceUrl);
@@ -55703,8 +56219,7 @@ async function connect(deps, options) {
   const wrote = [];
   const applied = [];
   const me = await whoAmI(deps, serviceUrl, token.token);
-  const request = { repository, name: repository.name };
-  const record3 = await createProject(deps, serviceUrl, me.tenantId, token.token, request);
+  const record3 = await createProject(deps, serviceUrl, me.tenantId, token.token, projectRequest(project));
   if (record3.tenantId !== me.tenantId) throw new CliError("the service returned a project for another tenant");
   const servicePublicKey = await fetchServicePublicKey(deps, serviceUrl, token.token) ?? (existing.kind === "ok" ? existing.binding.servicePublicKey ?? null : null);
   const binding = ProjectBinding.parse({
@@ -55743,7 +56258,7 @@ async function connect(deps, options) {
     owned.binding = true;
     if (excludeNeeded && await addExclude(deps, root)) owned.excludeLine = true;
     say(deps, `[repo] ${CONNECT_STEPS.repo}: done`);
-    const next = await reportStep(deps, serviceUrl, token.token, me.tenantId, "repo", { repo: { kind: "github", owner: repository.owner, name: repository.name } });
+    const next = await reportStep(deps, serviceUrl, token.token, me.tenantId, "repo", { repo: repoChoice(project) });
     if (next !== null) say(deps, `Next in onboarding: ${next === "repo" ? "first-task" : next} (${CONNECT_STEPS[next === "repo" ? "first-task" : next]})`);
   } finally {
     if (previousOwned !== null || owned.binding || owned.claude !== void 0 || owned.codex !== void 0) writeOwned(root, owned);
@@ -55757,7 +56272,7 @@ async function connect(deps, options) {
   for (const line2 of renderReports(reports)) say(deps, `  ${line2}`);
   return {
     data: {
-      project: { owner: repository.owner, name: repository.name, root },
+      project: projectSummary(project),
       serviceUrl,
       tenantId: binding.tenantId,
       projectId: binding.projectId,
@@ -55771,9 +56286,13 @@ async function connect(deps, options) {
     }
   };
 }
-function emptyResult(repository, root, serviceUrl, infos, cancelled) {
+function repoChoice(project) {
+  if (project.provider === "github" && project.repository !== void 0) return { provider: "github", owner: project.repository.owner, name: project.repository.name };
+  return { provider: "overlane", owner: "native", name: safeName(project.name) };
+}
+function emptyResult(project, serviceUrl, infos, cancelled) {
   return {
-    project: { owner: repository.owner, name: repository.name, root },
+    project: projectSummary(project),
     serviceUrl,
     credentials: "unchanged",
     agents: infos.map((info2) => ({ agent: info2.agent, installed: info2.installed, detail: info2.detail })),
@@ -55836,8 +56355,8 @@ function withTimeout(deps, ms) {
 }
 async function attempt(deps, ms, work) {
   let timer;
-  const deadline = new Promise((resolve13) => {
-    timer = setTimeout(() => resolve13("unreachable"), ms);
+  const deadline = new Promise((resolve14) => {
+    timer = setTimeout(() => resolve14("unreachable"), ms);
   });
   try {
     return await Promise.race([work(withTimeout(deps, ms)).catch((error62) => error62 instanceof ServiceError && error62.exit === EXIT.auth ? "unauthenticated" : "unreachable"), deadline]);
@@ -56976,13 +57495,13 @@ async function readPlan(repoDir) {
 init_src();
 init_zod();
 import { mkdir as mkdir2, readdir as readdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname7, join as join17, resolve as resolve6 } from "node:path";
+import { basename as basename3, dirname as dirname7, join as join17, resolve as resolve6 } from "node:path";
 
 // ../kit/src/detect.ts
 var import_yaml2 = __toESM(require_dist(), 1);
 init_src();
 import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import { basename, join as join16, resolve as resolve5 } from "node:path";
+import { basename as basename2, join as join16, resolve as resolve5 } from "node:path";
 var KINDS = ["typecheck", "lint", "build", "test"];
 async function readOptional(file2) {
   try {
@@ -57127,7 +57646,7 @@ async function draftPlanForExisting(repoDir, opts = {}) {
     } catch {
     }
   }
-  const name2 = (opts.name ?? pkgName ?? basename(root)).slice(0, 100);
+  const name2 = (opts.name ?? pkgName ?? basename2(root)).slice(0, 100);
   const milestone = opts.milestoneId ?? "M1";
   const allowedPaths = opts.allowedPaths ?? ["."];
   const tasks = [];
@@ -57325,7 +57844,7 @@ async function importSpecKit(repoDir) {
   const constitution = await findConstitution(root);
   const parsedConstitution = constitution ? parseConstitution(constitution.text) : void 0;
   const firstInput = /\*\*Input\*\*:\s*User description:\s*"(.*)"/.exec(features[0]?.specText ?? "")?.[1];
-  const name2 = (parsedConstitution?.name ?? basename2(root)).slice(0, 100);
+  const name2 = (parsedConstitution?.name ?? basename3(root)).slice(0, 100);
   const goal = (parsedConstitution?.goal ?? firstInput ?? `Deliver ${name2}.`).slice(0, 2e3);
   const multi = features.length > 1;
   const counts2 = /* @__PURE__ */ new Map();
@@ -58698,7 +59217,7 @@ var contextCommand = defineCommand({
 init_src();
 init_zod();
 import { existsSync as existsSync4, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename3, resolve as resolve7 } from "node:path";
+import { basename as basename4, resolve as resolve7 } from "node:path";
 var SERVICE_FLAG = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
 var ECOSYSTEM_FLAG = { name: "ecosystem", type: "string", enum: DOCS_ECOSYSTEMS, default: "npm", description: "Where the library is published" };
@@ -58810,7 +59329,7 @@ function readLockfiles(paths) {
   const files = paths.length > 0 ? paths : DEFAULT_LOCKFILES.filter((name2) => existsSync4(resolve7(name2)));
   if (files.length === 0) throw new UsageError("no lockfile found in this directory", { hint: "overlane lib pins --project <id> --lockfile pnpm-lock.yaml" });
   return files.map((file2) => {
-    const kind = LOCKFILES.find(([pattern]) => pattern.test(basename3(file2)))?.[1];
+    const kind = LOCKFILES.find(([pattern]) => pattern.test(basename4(file2)))?.[1];
     if (kind === void 0) throw new UsageError(`${file2} is not a lockfile this command reads`, { hint: "supported: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, uv.lock, Cargo.lock, go.sum" });
     try {
       return { kind, content: readFileSync7(resolve7(file2), "utf8") };
@@ -58906,7 +59425,7 @@ var libAddCommand = defineCommand({
     if (version2 === void 0 || files.length === 0) throw new UsageError("add needs --version and at least one --file", { hint: "overlane lib add <library> --version 1.0.0 --file README.md" });
     const pages = files.map((file2) => {
       try {
-        return { title: basename3(file2), text: readFileSync7(resolve7(file2), "utf8") };
+        return { title: basename4(file2), text: readFileSync7(resolve7(file2), "utf8") };
       } catch {
         throw new UsageError(`cannot read ${file2}`);
       }
@@ -58982,7 +59501,7 @@ async function post(deps, base4, path, body2) {
   return { status: response.status, json: json2 };
 }
 function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 async function deviceLogin(deps, service, options) {
   const started = await post(deps, service, "/auth/device", {});
@@ -59337,19 +59856,287 @@ var tokenRevokeCommand = defineCommand({
 });
 var identityCommands = [authLoginCommand, authLogoutCommand, authTokenCommand, teamListCommand, teamInviteCommand, tokenCreateCommand, tokenListCommand, tokenRevokeCommand];
 
-// ../cli/src/commands/guard.ts
+// ../cli/src/commands/billing.ts
 init_src();
 init_zod();
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
 var common2 = { needsAuth: true, needsNetwork: true };
 var requestId3 = () => `cli-${randomUUID3()}`;
 async function connected(inv) {
+  const project = await connectedProject(inv.deps, "billing");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId };
+}
+async function planned(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "billing");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+var usd = (cents) => `$${Math.trunc(cents / 100)}.${String(cents % 100).padStart(2, "0")}`;
+var micros = (value) => value % 1e4 === 0 ? usd(value / 1e4) : `$${(value / 1e6).toFixed(3)}`;
+function parseUsdToCents(text) {
+  const match = /^(\d{1,7})(?:\.(\d{1,2}))?$/.exec(text.trim());
+  if (match === null) throw new UsageError("--usd must be an amount like 50 or 12.50", { hint: "overlane billing caps set --scope team --usd 50" });
+  return Number(match[1]) * 100 + Number((match[2] ?? "").padEnd(2, "0") || "0");
+}
+function positiveInt(text, flag) {
+  if (text === void 0) return void 0;
+  if (!/^\d+$/.test(text) || Number(text) < 1) throw new UsageError(`--${flag} must be a whole number of at least 1`);
+  return Number(text);
+}
+var PLAN_FLAG = (plans, required2) => ({ name: "plan", type: "string", required: required2, enum: plans, value: "PLAN", description: "The plan" });
+var INTERVAL_FLAG = { name: "interval", type: "string", enum: ["month", "year"], value: "month|year", description: "Billing period; annual billing is cheaper per month" };
+var SEATS_FLAG = { name: "seats", type: "string", value: "N", description: "Seats (Business needs at least 10; Pro is one person)" };
+var billingStatusCommand = defineCommand({
+  path: ["billing", "status"],
+  summary: "Show the plan, seats, usage against allowances, caps, grace period and invoices",
+  description: "Shows what this workspace is on, what the plan allows (from the one plan data file the pricing page also reads), what is used this period, any spending caps, and whether a failed payment has started a grace period. Read-only for every role, agents included.",
+  examples: ["overlane billing status", "overlane billing status --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["billing", "plan", "subscription", "invoice", "what plan am i on", "seats", "grace period", "read-only"],
+  result: BillingStatus,
+  text: (d) => [
+    `plan: ${d.subscription.plan} (${d.subscription.status}), ${d.subscription.seats} seat${d.subscription.seats === 1 ? "" : "s"}, ${d.subscription.interval}ly${d.subscription.cancelAtPeriodEnd ? ", ends at the period end" : ""}`,
+    ...d.limits.readOnly ? ["this workspace is READ-ONLY: nothing was deleted; reading works"] : [],
+    ...d.grace.state === "none" ? [] : [`payment: ${d.grace.state}${d.grace.endsAt === void 0 ? "" : ` until ${d.grace.endsAt.slice(0, 10)}`}`],
+    ...d.usage.meters.map((m) => `${m.meter}: ${m.used}${typeof m.allowance === "number" ? ` of ${m.allowance}` : m.allowance === "unlimited" ? " (unlimited)" : ""}${m.overageMicros > 0 ? `, overage ${micros(m.overageMicros)}` : ""}`),
+    `metered spend this period: ${micros(d.usage.spendMicros)}`,
+    ...d.caps.map((c) => `cap ${c.scope}${c.scopeId === void 0 ? "" : ` ${c.scopeId}`}: ${usd(c.limitCents)}`),
+    ...d.usage.notices,
+    ...d.grace.notices.slice(-1).map((n) => n.message),
+    ...d.live ? [] : ["payments: not connected to Stripe in this deployment (live leg pending)"]
+  ],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(BillingStatus, "GET", billingPaths.status(tenantId)) };
+  }
+});
+var billingUsageCommand = defineCommand({
+  path: ["billing", "usage"],
+  summary: "Show usage this period against each allowance, with the overage price from the plan data file",
+  description: "Lists reviews, CI minutes, docs calls and hosted inference used this period, the allowance each plan gives, units beyond it and what they cost. Beyond an allowance nothing stops unless a spending cap is set.",
+  examples: ["overlane billing usage", "overlane billing usage --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["usage", "allowance", "overage", "reviews used", "ci minutes", "how much have i used"],
+  result: UsageSummary,
+  text: (d) => [`period: ${d.periodStart.slice(0, 10)} to ${d.periodEnd.slice(0, 10)}`, ...d.meters.map((m) => `${m.meter}: ${m.used}${typeof m.allowance === "number" ? ` / ${m.allowance}` : ""}${m.rateMicros === null ? "" : `  (${micros(m.rateMicros)} each beyond)`}${m.overageMicros > 0 ? `  overage ${micros(m.overageMicros)}` : ""}`), `metered spend: ${micros(d.spendMicros)}`, ...d.notices],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(UsageSummary, "GET", billingPaths.usage(tenantId)) };
+  }
+});
+var billingCheckCommand = defineCommand({
+  path: ["billing", "check"],
+  summary: "Ask whether a spend is allowed now; exits 6 when a limit or cap refuses it",
+  description: "Asks the billing service before a review, CI run or hosted inference call: within the allowance, over it and billed (with a notice), or refused (a plan with no overage path, a reached spending cap, a read-only workspace). A refusal exits 6 and names the next command.",
+  flags: [
+    { name: "meter", type: "string", required: true, enum: METERS, value: "METER", description: "What is being spent" },
+    { name: "quantity", type: "string", value: "N", description: "Units, default 1" },
+    { name: "cost-micros", type: "string", value: "N", description: "Provider cost of a hosted inference call, in millionths of a dollar" },
+    { name: "project", type: "string", value: "ID", description: "The project, for a project cap" },
+    { name: "agent", type: "string", value: "ID", description: "The agent token, for an agent cap" },
+    { name: "byok", type: "boolean", description: "The call runs on your own key: no platform charge" }
+  ],
+  examples: ["overlane billing check --meter reviews", "overlane billing check --meter hostedInference --cost-micros 2000 --agent tok_1"],
+  effect: "read",
+  ...common2,
+  keywords: ["can i spend", "spending cap reached", "limit check", "exit 6", "budget gate"],
+  result: UsageDecision,
+  text: (d) => [`${d.allowed ? "ALLOWED" : "REFUSED"} (${d.outcome})  ${d.message}`, ...d.nextCommand === null ? [] : [`next: ${d.nextCommand}`]],
+  handler: async (inv) => {
+    const meter = textFlag(inv, "meter");
+    if (meter === void 0) throw new UsageError("check needs --meter", { hint: "overlane billing check --meter reviews" });
+    const { call: call2, tenantId } = await connected(inv);
+    const quantity = positiveInt(textFlag(inv, "quantity"), "quantity");
+    const cost = textFlag(inv, "cost-micros");
+    const body2 = { meter, ...quantity === void 0 ? {} : { quantity }, ...cost === void 0 ? {} : { costMicros: Number(cost) }, ...textFlag(inv, "project") === void 0 ? {} : { projectId: textFlag(inv, "project") }, ...textFlag(inv, "agent") === void 0 ? {} : { agentId: textFlag(inv, "agent") }, ...boolFlag(inv, "byok") ? { byok: true } : {} };
+    const decision = await call2(UsageDecision, "POST", billingPaths.decision(tenantId), body2);
+    return decision.allowed ? { data: decision } : { data: decision, exit: EXIT.blocked, error: new CliError(decision.message, { code: decision.outcome, exit: EXIT.blocked, ...decision.nextCommand === null ? {} : { hint: decision.nextCommand } }) };
+  }
+});
+var billingCheckoutCommand = defineCommand({
+  path: ["billing", "checkout"],
+  summary: "Start buying a plan: prints a Stripe-hosted checkout link (a person pays; agents cannot)",
+  description: "Opens a checkout for Pro, Team or Business. Business needs at least 10 seats. The link is a Stripe-hosted page where the card is entered; Overlane never sees it. The plan is active when the payment webhook arrives. Enterprise is contract-only.",
+  flags: [PLAN_FLAG(["pro", "team", "business"], true), INTERVAL_FLAG, SEATS_FLAG],
+  examples: ["overlane billing checkout --plan team --seats 5", "overlane billing checkout --plan business --seats 10 --interval year --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["upgrade", "buy", "subscribe", "pay", "checkout", "choose plan"],
+  result: withDryRun(CheckoutResponse),
+  text: (d) => "url" in d ? [`${d.plan} x ${d.seats} (${d.interval}ly): first period ${usd(d.firstPeriodCents)} before tax`, `open: ${d.url}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), plan: textFlag(inv, "plan"), interval: textFlag(inv, "interval") ?? "month", ...textFlag(inv, "seats") === void 0 ? {} : { seats: positiveInt(textFlag(inv, "seats"), "seats") } };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.checkout, body2, "opens a Stripe-hosted checkout; nothing is charged");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CheckoutResponse, "POST", billingPaths.checkout(tenantId), body2) };
+  }
+});
+var billingPlanCommand = defineCommand({
+  path: ["billing", "plan"],
+  summary: "Upgrade or downgrade the plan; a downgrade over the new limits makes the workspace read-only and deletes nothing",
+  description: "Changes a paid plan with proration for the rest of the period. `--plan free` ends the paid plan at the end of the period already paid for. If data is over the new plan's limits the workspace becomes read-only (reads keep working) and nothing is ever deleted; upgrading restores it.",
+  flags: [PLAN_FLAG(["free", "pro", "team", "business"], true), INTERVAL_FLAG, SEATS_FLAG],
+  examples: ["overlane billing plan --plan team --seats 4", "overlane billing plan --plan free --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["downgrade", "upgrade", "change plan", "switch plan", "go back to free"],
+  result: withDryRun(ChangePlanResponse),
+  text: (d) => "subscription" in d ? [`plan: ${d.subscription.plan}, ${d.subscription.seats} seats`, `proration: ${d.prorationCents >= 0 ? "charge" : "credit"} ${usd(Math.abs(d.prorationCents))}`, ...d.overLimit.map((o) => `over the limit: ${o.what} ${o.used} of ${o.limit}; the workspace is read-only, nothing is deleted`)] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), plan: textFlag(inv, "plan"), ...textFlag(inv, "interval") === void 0 ? {} : { interval: textFlag(inv, "interval") }, ...textFlag(inv, "seats") === void 0 ? {} : { seats: positiveInt(textFlag(inv, "seats"), "seats") } };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.plan, body2, "prorates the rest of the period");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(ChangePlanResponse, "POST", billingPaths.plan(tenantId), body2) };
+  }
+});
+var billingSeatsCommand = defineCommand({
+  path: ["billing", "seats"],
+  summary: "Change the number of seats mid-cycle; the change prorates",
+  description: "Sets the seat count on a per-seat plan. The charge or credit for the rest of the period is prorated by the second. Business never goes below 10 seats, and seats cannot drop below the people who hold one.",
+  flags: [{ ...SEATS_FLAG, required: true }],
+  examples: ["overlane billing seats --seats 8", "overlane billing seats --seats 12 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["add seats", "remove seats", "more people", "proration", "seat count"],
+  result: withDryRun(SeatChangeResponse),
+  text: (d) => "seat" in d ? [`seats: ${d.seat.purchased} (${d.seat.assigned} in use)`, `proration: ${d.prorationCents >= 0 ? "charge" : "credit"} ${usd(Math.abs(d.prorationCents))}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), seats: positiveInt(textFlag(inv, "seats"), "seats") };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.seats, body2, "prorates the rest of the period");
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(SeatChangeResponse, "POST", billingPaths.seats(tenantId), body2) };
+  }
+});
+var billingCancelCommand = defineCommand({
+  path: ["billing", "cancel"],
+  summary: "Cancel the paid plan at the end of the period already paid for",
+  description: "Cancels at the period end by default, so everything keeps working until then. With --now the plan ends immediately. Data over the Free limits becomes read-only; nothing is deleted.",
+  flags: [{ name: "now", type: "boolean", description: "End the plan immediately instead of at the period end" }],
+  examples: ["overlane billing cancel", "overlane billing cancel --dry-run"],
+  effect: "destructive",
+  ...common2,
+  keywords: ["cancel subscription", "stop paying", "end plan"],
+  result: withDryRun(Subscription),
+  text: (d) => "plan" in d ? [`plan: ${d.plan}${d.cancelAtPeriodEnd ? `, ends ${d.currentPeriodEnd.slice(0, 10)}` : ""}`] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), atPeriodEnd: !boolFlag(inv, "now") };
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.cancel, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(Subscription, "POST", billingPaths.cancel(tenantId), body2) };
+  }
+});
+var billingPortalCommand = defineCommand({
+  path: ["billing", "portal"],
+  summary: "Print a link to Stripe's billing portal: card, invoices and tax details",
+  description: "Opens a Stripe-hosted portal where a person updates the card, downloads invoices and edits tax details. Overlane never stores card data.",
+  examples: ["overlane billing portal"],
+  effect: "write",
+  ...common2,
+  keywords: ["update card", "invoices", "tax id", "payment method", "billing portal"],
+  result: withDryRun(PortalResponse),
+  text: (d) => "url" in d ? [`open: ${d.url}`] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned(inv, "POST", billingPaths.portal, {});
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(PortalResponse, "POST", billingPaths.portal(tenantId), {}) };
+  }
+});
+var CapList = external_exports.object({ tenantId: external_exports.string(), caps: external_exports.array(Cap) }).strict();
+var CapRemoved = external_exports.object({ tenantId: external_exports.string(), removed: external_exports.literal(true) }).strict();
+var CAP_FLAGS = [
+  { name: "scope", type: "string", required: true, enum: CAP_SCOPES, value: "SCOPE", description: "team, project or agent" },
+  { name: "id", type: "string", value: "ID", description: "The project or agent token the cap applies to (not for team)" }
+];
+function capTarget(inv) {
+  const scope = textFlag(inv, "scope");
+  const id2 = textFlag(inv, "id");
+  if (scope === void 0) throw new UsageError("this command needs --scope", { hint: "overlane billing caps set --scope team --usd 50" });
+  if (scope === "team" && id2 !== void 0) throw new UsageError("a team cap has no --id");
+  if (scope !== "team" && id2 === void 0) throw new UsageError(`a ${scope} cap needs --id`, { hint: `overlane billing caps set --scope ${scope} --id <${scope} id> --usd 50` });
+  return { scope, ...id2 === void 0 ? {} : { scopeId: id2 } };
+}
+var billingCapsListCommand = defineCommand({
+  path: ["billing", "caps", "list"],
+  summary: "List spending caps per team, project and agent",
+  description: "Shows each cap in dollars per billing period. With a cap set, reviews, CI and hosted inference stop at it (exit 6); with none, usage beyond an allowance is billed.",
+  examples: ["overlane billing caps list", "overlane billing caps list --json"],
+  effect: "read",
+  ...common2,
+  keywords: ["spending cap", "budget", "limit spend", "caps"],
+  result: CapList,
+  text: (d) => d.caps.length === 0 ? ["No spending caps: usage beyond an allowance is billed, nothing stops."] : d.caps.map((c) => `${c.scope}${c.scopeId === void 0 ? "" : ` ${c.scopeId}`}: ${usd(c.limitCents)} per period`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CapList, "GET", billingPaths.caps(tenantId)) };
+  }
+});
+var billingCapsSetCommand = defineCommand({
+  path: ["billing", "caps", "set"],
+  summary: "Set a spending cap per period for the team, a project or an agent",
+  description: "Sets the most metered spend (overage plus hosted inference with markup) allowed per billing period. At the cap, hosted inference, AI reviews and CI stop with exit code 6 and a visible message until the next period or until the cap is raised. Only a signed-in owner can set one.",
+  flags: [...CAP_FLAGS, { name: "usd", type: "string", required: true, value: "AMOUNT", description: "Dollars per period, for example 50 or 12.50" }],
+  examples: ["overlane billing caps set --scope team --usd 50", "overlane billing caps set --scope agent --id tok_1 --usd 5 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["set cap", "limit spending", "budget", "stop at"],
+  result: withDryRun(Cap),
+  text: (d) => "limitCents" in d ? [`cap ${d.scope}${d.scopeId === void 0 ? "" : ` ${d.scopeId}`}: ${usd(d.limitCents)} per period`] : [],
+  handler: async (inv) => {
+    const target = capTarget(inv);
+    const usdText = textFlag(inv, "usd");
+    if (usdText === void 0) throw new UsageError("set needs --usd", { hint: "overlane billing caps set --scope team --usd 50" });
+    const body2 = { requestId: requestId3(), ...target, limitCents: parseUsdToCents(usdText) };
+    if (inv.dryRun) return planned(inv, "PUT", billingPaths.caps, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(Cap, "PUT", billingPaths.caps(tenantId), body2) };
+  }
+});
+var billingCapsRemoveCommand = defineCommand({
+  path: ["billing", "caps", "remove"],
+  summary: "Remove a spending cap",
+  description: "Removes a cap. Without a team cap, usage beyond an allowance is billed and nothing stops.",
+  flags: CAP_FLAGS,
+  examples: ["overlane billing caps remove --scope team", "overlane billing caps remove --scope project --id prj_1 --dry-run"],
+  effect: "write",
+  ...common2,
+  keywords: ["remove cap", "no limit", "delete cap"],
+  result: withDryRun(CapRemoved),
+  text: (d) => "removed" in d ? ["Cap removed."] : [],
+  handler: async (inv) => {
+    const body2 = { requestId: requestId3(), ...capTarget(inv) };
+    if (inv.dryRun) return planned(inv, "DELETE", billingPaths.caps, body2);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(CapRemoved, "DELETE", billingPaths.caps(tenantId), body2) };
+  }
+});
+var billingCommands = [
+  billingStatusCommand,
+  billingUsageCommand,
+  billingCheckCommand,
+  billingCheckoutCommand,
+  billingPlanCommand,
+  billingSeatsCommand,
+  billingCancelCommand,
+  billingPortalCommand,
+  billingCapsListCommand,
+  billingCapsSetCommand,
+  billingCapsRemoveCommand
+];
+
+// ../cli/src/commands/guard.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
+var common3 = { needsAuth: true, needsNetwork: true };
+var requestId4 = () => `cli-${randomUUID4()}`;
+async function connected2(inv) {
   const project = await connectedProject(inv.deps, "guard");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned(inv, method, path, body2, note) {
+async function planned2(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "guard");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -59398,12 +60185,12 @@ var guardRulesListCommand = defineCommand({
   description: "Lists the platform rules (always in force), then the team and project rule files and their rules. A rule change is an audit event; every file version is listed with its digest and author.",
   examples: ["overlane guard rules list", "overlane guard rules list --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["guardrails", "policy as code", "rules in force", "protected branches", "what is blocked", "rule files"],
   result: GuardRulesResponse,
   text: (d) => [...d.rules.map((rule) => `${rule.layer.padEnd(8)} ${rule.effect.padEnd(16)} ${rule.id}${rule.dryRun ? "  [dry-run]" : ""}  ${rule.description}`), ...d.files.map((file2) => `file ${file2.layer} v${file2.version} ${file2.digest.slice(0, 19)} by ${file2.author}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected(inv);
+    const { call: call2, tenantId, projectId } = await connected2(inv);
     return { data: await call2(GuardRulesResponse, "GET", `${guardPaths.rules(tenantId)}?projectId=${encodeURIComponent(projectId)}`) };
   }
 });
@@ -59473,7 +60260,7 @@ var guardRulesPutCommand = defineCommand({
   ],
   examples: ['overlane guard rules put --file rules.json --reason "freeze deploys on Fridays"', "overlane guard rules put --file rules.json --layer project --dry-run"],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["publish rules", "update guardrails", "change policy", "upload rule file", "freeze deploys"],
   result: withDryRun(GuardRuleFileRecord),
   text: (d) => "version" in d ? [`Published ${d.layer} rule file v${d.version} (${d.ruleCount} rules, ${d.digest.slice(0, 19)}).`] : [],
@@ -59487,12 +60274,12 @@ var guardRulesPutCommand = defineCommand({
       return planOutcome(inv.deps, dryRunPlan({ service: offline.serviceUrl, requests: [{ method: "PUT", path: guardPaths.rules(offline.binding.tenantId), body: { requestId: "<generated>", layer, ...layer === "project" ? { projectId: offline.binding.projectId } : {}, content: `<contents of ${file2}>`, ...reason === void 0 ? {} : { reason } }, note: "the file is validated and scanned for credentials on the server" }] }));
     }
     const content = readText3(inv, file2);
-    const { call: call2, tenantId, projectId } = await connected(inv);
-    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId3(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId4(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
   }
 });
 async function evaluate(inv, dryRun) {
-  const { call: call2, tenantId, projectId } = await connected(inv);
+  const { call: call2, tenantId, projectId } = await connected2(inv);
   const contentFile = textFlag(inv, "content-file");
   const body2 = {
     ...actionOf(inv),
@@ -59518,12 +60305,12 @@ var guardCheckCommand = defineCommand({
   flags: [...DECISION_FLAGS, { name: "approval", type: "string", value: "ID", description: "An approval that covers exactly this action" }],
   examples: ["overlane guard check --tool git.push --branch main --task held", 'overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-run'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["check action", "pre push check", "ci gate", "is this allowed", "approval required", "blocked by policy"],
   result: withDryRun(GuardEvaluateResponse),
   text: (d) => "decision" in d ? describeDecision(d.decision) : [],
   handler: async (inv) => {
-    if (inv.dryRun) return planned(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
+    if (inv.dryRun) return planned2(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
     const reply = await evaluate(inv, false);
     return reply.decision.allowed ? { data: reply } : refusalOutcome(reply, reply.decision);
   }
@@ -59535,7 +60322,7 @@ var guardDryRunCommand = defineCommand({
   flags: DECISION_FLAGS,
   examples: ["overlane guard dry-run --tool git.push --branch main --task held", "overlane guard dry-run --tool egress.fetch --host registry.example.com --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["dry run rules", "what would block", "test policy", "simulate", "would be refused"],
   result: GuardEvaluateResponse,
   text: (d) => describeDecision(d.decision),
@@ -59551,14 +60338,14 @@ var guardScanCommand = defineCommand({
   ],
   examples: ["overlane guard scan --path src/config.ts", "overlane guard scan --path ci.log --source log --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["secret scan", "find credentials", "leaked key", "push protection", "scan file"],
   result: SecretScanResult,
   text: (d) => d.findings.length === 0 ? ["No credentials found."] : d.findings.map((finding) => `${finding.disposition.padEnd(8)} ${finding.rule}${finding.path === void 0 ? "" : ` ${finding.path}`}${finding.line === void 0 ? "" : `:${finding.line}`}`),
   handler: async (inv) => {
     const path = textFlag(inv, "path");
     if (path === void 0) throw new UsageError("scan needs --path", { hint: "overlane guard scan --path src/config.ts" });
-    const { call: call2, tenantId } = await connected(inv);
+    const { call: call2, tenantId } = await connected2(inv);
     const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText3(inv, path), path });
     return result.blocked ? { data: result, exit: EXIT.blocked, error: new CliError("a credential was found; nothing should be pushed until it is removed and rotated", { code: "secret_detected", exit: EXIT.blocked, hint: "overlane guard scan --path <file>" }) } : { data: result };
   }
@@ -59571,12 +60358,12 @@ var guardApprovalsListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["pending", "approved", "denied"], description: "Only approvals with this status" }],
   examples: ["overlane guard approvals list", "overlane guard approvals list --status pending --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["pending approvals", "approve before write", "who needs to approve", "approval queue"],
   result: ApprovalList2,
   text: (d) => d.approvals.length === 0 ? ["No approvals."] : d.approvals.flatMap((a) => [`${a.status.padEnd(9)} ${a.id}  ${a.tool}  by ${a.requestedBy}  (rule ${a.ruleId})`, `  ${a.summary}`]),
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected(inv);
+    const { call: call2, tenantId } = await connected2(inv);
     const status = textFlag(inv, "status");
     return { data: await call2(ApprovalList2, "GET", `${guardPaths.approvals(tenantId)}${status === void 0 ? "" : `?status=${status}`}`) };
   }
@@ -59593,7 +60380,7 @@ var guardApprovalsAnswerCommand = defineCommand({
   ],
   examples: ["overlane guard approvals answer apr_1 --decision approve", 'overlane guard approvals answer apr_1 --decision approve --evidence "diff reviewed" --reason "matches the task" --dry-run'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["approve action", "deny action", "answer approval", "allow push", "sign off"],
   result: withDryRun(GuardApproval),
   text: (d) => "status" in d ? [`${d.id} is ${d.status}.`] : [],
@@ -59604,8 +60391,8 @@ var guardApprovalsAnswerCommand = defineCommand({
     const evidence = listFlag(inv, "evidence");
     const parsed = AnswerGuardApprovalRequest.safeParse({ decision: textFlag(inv, "decision"), ...reason === void 0 ? {} : { reason }, ...evidence.length === 0 ? {} : { evidence } });
     if (!parsed.success) throw new UsageError("--decision must be approve or deny", { hint: `overlane guard approvals answer ${approvalId} --decision approve` });
-    if (inv.dryRun) return planned(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
-    const { call: call2, tenantId } = await connected(inv);
+    if (inv.dryRun) return planned2(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
+    const { call: call2, tenantId } = await connected2(inv);
     return { data: await call2(GuardApproval, "POST", guardPaths.answer(tenantId, approvalId), parsed.data) };
   }
 });
@@ -59614,10 +60401,10 @@ var guardCommands = [guardRulesListCommand, guardRulesTestCommand, guardRulesPut
 // ../cli/src/commands/memory.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var SERVICE_FLAG3 = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG3 = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
-var common3 = { needsAuth: true, needsNetwork: true };
+var common4 = { needsAuth: true, needsNetwork: true };
 async function authed3(inv) {
   const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const token = await requireToken(inv.deps, target.storeKey);
@@ -59636,7 +60423,7 @@ async function plan2(inv, method, path, body2, note) {
   const tenant = textFlag(inv, "team") ?? ":your-team";
   return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
-var requestId4 = () => `cli-${randomUUID4()}`;
+var requestId5 = () => `cli-${randomUUID5()}`;
 var memorySearchCommand = defineCommand({
   path: ["memory", "search"],
   summary: "Search memory across project, team, user and global scopes",
@@ -59651,7 +60438,7 @@ var memorySearchCommand = defineCommand({
   ],
   examples: ['overlane memory search "how do we deploy"', 'overlane memory search "indentation" --scope team --json'],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["recall", "remember", "what do we know", "find memory", "lookup", "notes", "conventions", "decisions"],
   result: MemorySearchResponse,
   text: (d) => d.items.length === 0 ? ["No memories match."] : d.items.map((i2) => `${i2.scope.padEnd(7)} ${i2.status.padEnd(9)} ${i2.id}  ${i2.title}${i2.stale ? "  [stale]" : ""}${i2.overriddenBy === null ? "" : `  [overridden by ${i2.overriddenBy}]`}`),
@@ -59685,7 +60472,7 @@ var memoryAddCommand = defineCommand({
   ],
   examples: ['overlane memory add --title "Deploy day" "Deploys go out on Tuesdays" --project prj_1', 'overlane memory add --title "Editor" --scope user "I prefer a dark theme" --dry-run'],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["remember this", "save a note", "record a decision", "store convention", "candidate"],
   result: AddResult,
   handler: async (inv) => {
@@ -59693,7 +60480,7 @@ var memoryAddCommand = defineCommand({
     if (title === void 0) throw new UsageError("add needs --title", { hint: 'overlane memory add --title "..." "<text>"' });
     const project = textFlag(inv, "project");
     const parsed = MemoryCandidate.safeParse({
-      requestId: requestId4(),
+      requestId: requestId5(),
       scope: textFlag(inv, "scope") ?? "project",
       ...project === void 0 ? {} : { projectId: project },
       category: textFlag(inv, "category") ?? "fact",
@@ -59724,7 +60511,7 @@ var memoryConfirmCommand = defineCommand({
   ],
   examples: ["overlane memory confirm mem_ab12", "overlane memory confirm mem_ab12 --basis ci_evidence --evidence 0123abc:unit_tests --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["approve memory", "verify", "promote candidate", "second observer", "ci evidence"],
   result: ConfirmResult,
   handler: async (inv) => {
@@ -59748,7 +60535,7 @@ var memoryPromoteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3, { name: "to", type: "string", enum: ["team", "global"], default: "team", description: "Where to promote it" }],
   examples: ["overlane memory promote mem_ab12 --to team", "overlane memory promote mem_cd34 --to global --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["share with team", "contribute", "global memory", "make team wide"],
   result: withDryRun(MemoryPromoteResponse),
   handler: async (inv) => {
@@ -59776,7 +60563,7 @@ var memoryExportCommand = defineCommand({
   ],
   examples: ["overlane memory export --json", "overlane memory export --scope user --user usr_1 --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["download memory", "backup", "data portability", "gdpr", "subject access"],
   result: MemoryExportRecord,
   text: (d) => [`${d.items.length} memories exported at ${d.exportedAt}. Use --json for the full content.`],
@@ -59800,7 +60587,7 @@ var memoryDeleteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory delete mem_ab12 --force", "overlane memory delete mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["remove memory", "forget", "erase", "wrong memory", "gdpr deletion"],
   result: withDryRun(MemoryDeleteResponse),
   handler: async (inv) => {
@@ -59821,7 +60608,7 @@ var memoryUnlearnCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory unlearn mem_ab12 --force", "overlane memory unlearn mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["unlearn", "forget everything derived", "retract", "poisoned memory", "bad memory"],
   result: withDryRun(MemoryUnlearnRecord),
   handler: async (inv) => {
@@ -59841,7 +60628,7 @@ var memoryStatusCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory status", "overlane memory status --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["memory health", "stale memory", "how many memories", "contribution", "opt in"],
   result: MemoryStatusResponse,
   text: (d) => [...Object.entries(d.counts).map(([key, n]) => `${key}: ${n}`), `stale: ${d.stale}`, `global contribution: ${d.settings.globalContribution ? "on" : "off"}`, `pending jobs: ${d.pendingJobs}`],
@@ -59859,7 +60646,7 @@ var memoryContributionCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory contribution on", "overlane memory contribution off --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["opt in", "opt out", "share patterns", "global pool", "contribute"],
   result: withDryRun(MemorySettings),
   handler: async (inv) => {
@@ -59879,10 +60666,10 @@ var memoryCommands = [memorySearchCommand, memoryAddCommand, memoryConfirmComman
 // ../cli/src/commands/issue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { readFileSync as readFileSync9 } from "node:fs";
-var common4 = { needsAuth: true, needsNetwork: true };
-var requestId5 = () => `cli-${randomUUID5()}`;
+var common5 = { needsAuth: true, needsNetwork: true };
+var requestId6 = () => `cli-${randomUUID6()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var STATUSES = ["backlog", "todo", "in_progress", "in_review", "cancelled"];
 async function send(deps, label, schema, method, path, body2, dryRun) {
@@ -59919,7 +60706,7 @@ var issueListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["backlog", "todo", "in_progress", "in_review", "done", "cancelled"], description: "Only issues in this status" }],
   examples: ["overlane issue list", "overlane issue list --status todo --json"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["issues", "backlog", "tickets", "work items", "what is open", "list issues"],
   result: external_exports.object({ issues: external_exports.array(IssueShown) }),
   handler: async (inv) => {
@@ -59940,7 +60727,7 @@ var issueShowCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID, for example iss_ab12cd34ef56gh78" }],
   examples: ["overlane issue show iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["issue details", "ticket", "view issue", "who is working on"],
   result: IssueShown,
   handler: async (inv) => {
@@ -59963,7 +60750,7 @@ var issueEventsCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID" }],
   examples: ["overlane issue events iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["audit", "history", "who changed", "field changes", "issue log"],
   result: IssueEventList,
   handler: async (inv) => {
@@ -59988,12 +60775,12 @@ var issueNewCommand = defineCommand({
   ],
   examples: ['overlane issue new "Back-time drifts by a second"', 'overlane issue new "Fix export" --priority P0 --description "Fails on empty notes"'],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["create issue", "new issue", "file a ticket", "add work item", "report bug"],
   result: withDryRun(Issue),
   handler: async (inv) => {
     const estimate = textFlag(inv, "estimate");
-    const body2 = { requestId: requestId5(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
+    const body2 = { requestId: requestId6(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
     const result = await send(inv.deps, "issue", Issue, "POST", issuePaths.issues, body2, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Created #${result.value.number} ${result.value.issueId}`);
     return result;
@@ -60013,7 +60800,7 @@ var issueUpdateCommand = defineCommand({
   ],
   examples: ["overlane issue update iss_ab12cd34ef56gh78 --priority P0", 'overlane issue update iss_ab12cd34ef56gh78 --status in_progress --title "New title"'],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["edit issue", "change status", "change priority", "rename issue", "update ticket"],
   result: withDryRun(Issue),
   handler: async (inv) => {
@@ -60021,7 +60808,7 @@ var issueUpdateCommand = defineCommand({
     if (id2 === void 0) throw new UsageError("update needs an ISSUE_ID");
     const estimate = textFlag(inv, "estimate");
     const body2 = {
-      requestId: requestId5(),
+      requestId: requestId6(),
       ...textFlag(inv, "title") === void 0 ? {} : { title: textFlag(inv, "title") },
       ...textFlag(inv, "description") === void 0 ? {} : { description: textFlag(inv, "description") },
       ...textFlag(inv, "status") === void 0 ? {} : { status: textFlag(inv, "status") },
@@ -60042,14 +60829,14 @@ var issueAssignCommand = defineCommand({
   ],
   examples: ["overlane issue assign iss_ab12cd34ef56gh78 agent:claude-code", "overlane issue assign iss_ab12cd34ef56gh78 none"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["assign", "give to agent", "hand to bot", "delegate", "who works on this", "unassign"],
   result: withDryRun(AssignResult),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("assign needs an ISSUE_ID and an assignee");
     const assignee = parseAssignee(inv.positionals[1]);
-    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId5(), assignee }, inv.dryRun);
+    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId6(), assignee }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, result.value.taskId === null ? "Assigned." : `Assigned. Task: ${result.value.taskId}${result.value.createdTask ? " (new)" : ""}`);
     return result;
   }
@@ -60065,7 +60852,7 @@ var issueImportCommand = defineCommand({
   flags: [{ name: "preview", type: "boolean", description: "Report what the import would create or update, and write nothing" }],
   examples: ["overlane issue import linear ./linear-export.json --preview", "overlane issue import jira ./jira-search.json"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["import", "migrate from linear", "migrate from jira", "github projects import", "bring issues in"],
   result: withDryRun(ImportReport),
   handler: async (inv) => {
@@ -60078,7 +60865,7 @@ var issueImportCommand = defineCommand({
     } catch {
       throw new UsageError(`${file2} is not a readable JSON file`);
     }
-    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId5(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
+    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId6(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
     if (result.value !== void 0) {
       const r = result.value;
       say(inv.deps, `${r.dryRun ? "Would import" : "Imported"} from ${r.source}: ${r.created} new, ${r.updated} updated, ${r.unchanged} unchanged, ${r.skipped.length} skipped.`);
@@ -60092,7 +60879,7 @@ var issueSyncCommand = defineCommand({
   description: "Overlane issues work with no sync; syncing with GitHub is optional. Shows the repository and mode: off (default), read_only (GitHub changes flow in, nothing is written to GitHub) or write_back (an owner or admin opted in).",
   examples: ["overlane issue sync"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["github sync", "sync status", "two-way sync", "write back"],
   result: SyncConfig,
   handler: async (inv) => {
@@ -60112,13 +60899,13 @@ var issueSyncSetCommand = defineCommand({
   ],
   examples: ["overlane issue sync set acme/app read_only", "overlane issue sync set acme/app off"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["enable github sync", "write back", "turn off sync", "read only sync"],
   result: withDryRun(SyncConfig),
   handler: async (inv) => {
     const [repository, mode] = inv.positionals;
     if (repository === void 0 || mode === void 0) throw new UsageError("sync set needs REPOSITORY and MODE");
-    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId5(), repository, mode }, inv.dryRun);
+    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId6(), repository, mode }, inv.dryRun);
   }
 });
 var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, issueNewCommand, issueUpdateCommand, issueAssignCommand, issueImportCommand, issueSyncCommand, issueSyncSetCommand];
@@ -60126,7 +60913,7 @@ var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, iss
 // ../cli/src/commands/issue-views.ts
 init_src();
 init_zod();
-var common5 = { needsAuth: true, needsNetwork: true };
+var common6 = { needsAuth: true, needsNetwork: true };
 var Deleted = external_exports.object({ deleted: external_exports.literal(true) });
 var FIELDS = ["status", "priority", "assigneeType", "assignee", "labelId", "workProjectId", "cycleId", "estimate", "source", "title", "number", "createdAt", "updatedAt"];
 function parseCondition(text) {
@@ -60142,7 +60929,7 @@ var viewListCommand = defineCommand({
   description: "Lists saved views: a filter plus a group-by and sort over any issue field.",
   examples: ["overlane view list"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["saved views", "filters", "board", "group by"],
   result: ViewList,
   handler: async (inv) => {
@@ -60160,7 +60947,7 @@ var viewRunCommand = defineCommand({
   args: [{ name: "view-id", required: true, description: "The saved view ID" }],
   examples: ["overlane view run viw_ab12cd34ef56gh78"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["run view", "show board", "group issues"],
   result: ViewResult,
   handler: async (inv) => {
@@ -60188,12 +60975,12 @@ var viewNewCommand = defineCommand({
   ],
   examples: ["overlane view new Urgent --filter priority=P0 --group-by status", 'overlane view new "Agent work" --filter assigneeType=agent --group-by status'],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["create view", "save filter", "board", "group by status"],
   result: withDryRun(SavedView),
   handler: async (inv) => {
     const definition = { filter: listFlag(inv, "filter").map(parseCondition), groupBy: textFlag(inv, "group-by") ?? null, sortBy: textFlag(inv, "sort-by") ?? "number", sortDirection: boolFlag(inv, "desc") ? "desc" : "asc" };
-    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId5(), name: inv.positionals.join(" "), definition }, inv.dryRun);
+    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId6(), name: inv.positionals.join(" "), definition }, inv.dryRun);
   }
 });
 var viewDeleteCommand = defineCommand({
@@ -60203,7 +60990,7 @@ var viewDeleteCommand = defineCommand({
   args: [{ name: "view-id", required: false, description: "The saved view ID (required; checked after the --force confirmation)" }],
   examples: ["overlane view delete viw_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common5,
+  ...common6,
   keywords: ["remove view", "delete filter"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -60218,7 +61005,7 @@ var loopListCommand = defineCommand({
   description: "Lists loops: a trigger (schedule or event), a filter over issues and the executor they dispatch.",
   examples: ["overlane loop list"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["loops", "scheduled work", "recurring", "automation"],
   result: LoopList,
   handler: async (inv) => {
@@ -60242,7 +61029,7 @@ var loopNewCommand = defineCommand({
   ],
   examples: ["overlane loop new Nightly --every 1440 --filter priority=P0", "overlane loop new OnAssign --on issue.assigned"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["schedule agent", "recurring work", "event trigger", "automation", "nightly"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
@@ -60250,7 +61037,7 @@ var loopNewCommand = defineCommand({
     const on = textFlag(inv, "on");
     if (every === void 0 === (on === void 0)) throw new UsageError("pass exactly one of --every MINUTES or --on EVENT");
     const trigger = every !== void 0 ? { kind: "schedule", everyMinutes: Number(every) } : { kind: "event", on };
-    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId5(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId6(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
   }
 });
 var loopSetCommand = defineCommand({
@@ -60263,13 +61050,13 @@ var loopSetCommand = defineCommand({
   ],
   examples: ["overlane loop set lop_ab12cd34ef56gh78 off"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["disable loop", "enable loop", "stop schedule"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
     const [id2, state] = inv.positionals;
     if (id2 === void 0 || state !== "on" && state !== "off") throw new UsageError("set needs a LOOP_ID and on or off");
-    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId5(), enabled: state === "on" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId6(), enabled: state === "on" }, inv.dryRun);
   }
 });
 var loopFireCommand = defineCommand({
@@ -60279,13 +61066,13 @@ var loopFireCommand = defineCommand({
   args: [{ name: "loop-id", required: true, description: "The loop ID" }],
   examples: ["overlane loop fire lop_ab12cd34ef56gh78"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["run loop", "trigger loop", "dispatch agent"],
   result: withDryRun(LoopRun),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("fire needs a LOOP_ID");
-    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId5(), trigger: "schedule" }, inv.dryRun);
+    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId6(), trigger: "schedule" }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Loop run ${result.value.runId ?? "(none)"}: ${result.value.claimed.length} claimed, stopped: ${result.value.stopReason}.`);
     return result;
   }
@@ -60297,7 +61084,7 @@ var loopDeleteCommand = defineCommand({
   args: [{ name: "loop-id", required: false, description: "The loop ID (required; checked after the --force confirmation)" }],
   examples: ["overlane loop delete lop_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common5,
+  ...common6,
   keywords: ["remove loop", "delete schedule"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -60311,14 +61098,15 @@ var loopCommands = [loopListCommand, loopNewCommand, loopSetCommand, loopFireCom
 
 // ../cli/src/commands/review.ts
 init_src();
-import { randomUUID as randomUUID6 } from "node:crypto";
-var common6 = { needsAuth: true, needsNetwork: true };
-var requestId6 = () => `cli-${randomUUID6()}`;
-async function connected2(inv) {
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { resolve as resolve9 } from "node:path";
+var common7 = { needsAuth: true, needsNetwork: true };
+var requestId7 = () => `cli-${randomUUID7()}`;
+async function connected3(inv) {
   const project = await connectedProject(inv.deps, "review");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned2(inv, method, path, body2, note) {
+async function planned3(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "review");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -60330,9 +61118,38 @@ async function repositoryOf(inv) {
   }
   const remote = await inv.deps.exec("git", ["remote", "get-url", "origin"], { cwd: inv.deps.paths.cwd });
   const match = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\s*$/.exec(remote.stdout.trim());
-  if (remote.code !== 0 || match === null) throw new UsageError("could not read the repository from the origin remote", { hint: "overlane review run 7 --repo OWNER/NAME" });
+  if (remote.code !== 0 || match === null) throw new UsageError("could not read a GitHub repository from the origin remote; to review a change without one, give the diff", { hint: "overlane review run --diff change.patch" });
   return `${match[1]}/${match[2]}`;
 }
+async function diffOf(inv) {
+  const flag = textFlag(inv, "diff");
+  const pull = inv.positionals[0];
+  if (flag !== void 0 && pull !== void 0) throw new UsageError("give a pull request number or --diff, not both", { hint: "overlane review run --diff change.patch" });
+  let from;
+  let text;
+  if (flag !== void 0) {
+    if (flag === "-") {
+      if (inv.deps.stdin === void 0) throw new UsageError("--diff - reads standard input, which is not available here", { hint: "overlane review run --diff change.patch" });
+      from = "standard input";
+      text = await inv.deps.stdin.read();
+    } else {
+      from = flag;
+      text = readText(resolve9(inv.deps.paths.cwd, flag));
+      if (text === null) throw new UsageError(`could not read the diff file ${flag}`, { hint: "git diff > change.patch && overlane review run --diff change.patch" });
+    }
+  } else if (pull === void 0) {
+    if (inv.deps.stdin === void 0 || inv.deps.stdin.isTTY) {
+      throw new UsageError("nothing to review: give a diff (--diff change.patch, or pipe one in) or a pull request number", { hint: "overlane review run --diff change.patch" });
+    }
+    from = "standard input";
+    text = await inv.deps.stdin.read();
+  } else {
+    return void 0;
+  }
+  if (text.trim().length === 0) throw new UsageError(`the diff from ${from} is empty: there is nothing to review`, { hint: "git diff > change.patch && overlane review run --diff change.patch" });
+  if (text.length > MAX_PATCH_BYTES) throw new UsageError(`the diff is larger than ${MAX_PATCH_BYTES} characters; review it in parts`);
+  return { text, from };
+}
 function id(inv, what) {
   const value = inv.positionals[0];
   if (value === void 0) throw new UsageError(`${what} needs a finding ID`, { hint: "overlane review findings" });
@@ -60341,23 +61158,40 @@ function id(inv, what) {
 var FINDING_LINE = (finding) => `${finding.status.padEnd(9)} ${finding.severity.padEnd(8)} ${finding.path}:${finding.line}  ${finding.rule ?? "see reason"}  ${finding.id}`;
 var reviewRunCommand = defineCommand({
   path: ["review", "run"],
-  summary: "Review a GitHub pull request now and report the findings",
-  description: "Runs the review service on a pull request: triage, review passes under the per-PR token cap, inline findings and one updated summary. Until the project owner enables comments (`overlane review settings set --mode comments`) the run is log-only and posts nothing. Pull request text and code are data, never instructions. Needs the GitHub App's pull-request access; without it the command says the live leg is pending.",
-  args: [{ name: "pull", required: true, description: "The pull request number" }],
-  flags: [{ name: "repo", type: "string", value: "OWNER/NAME", description: "The repository (default: the origin remote of this working copy)" }],
-  examples: ["overlane review run 7", "overlane review run 7 --repo acme/app --dry-run"],
+  summary: "Review a diff (no repository needed) or a pull request now and report the findings",
+  description: "Runs the review service. The native way is a diff: `--diff change.patch`, or `--diff -` (or a pipe) to read it from standard input; it needs no repository and no GitHub account, and it is log-only. A pull request number reviews a pull request instead (native pull requests arrive with Overlane git; a GitHub one needs the GitHub connection and the App's pull-request access, otherwise the command says the live leg is pending). Deterministic checks (secret scan, static rules, diff validation) run first and alone when no model is available; a model pass is an optional second pass under the per-PR token cap. Until the project owner enables comments (`overlane review settings set --mode comments`) a pull request run is log-only and posts nothing. Diff text and code are data, never instructions.",
+  args: [{ name: "pull", required: false, description: "A pull request number (omit it to review a diff)" }],
+  flags: [
+    { name: "diff", type: "string", value: "FILE", description: "Review this unified diff (a file, or - for standard input); needs no repository" },
+    { name: "title", type: "string", value: "TEXT", description: "A title for the diff, shown in the summary" },
+    { name: "label", type: "string", value: "NAME", description: "Names the diff so a re-review of the same change merges its findings (default: patch)" },
+    { name: "repo", type: "string", value: "OWNER/NAME", description: "For a pull request number: the GitHub repository (default: the origin remote); not used with --diff" }
+  ],
+  examples: ["overlane review run --diff change.patch", "overlane review run --diff -", "overlane review run 7 --repo acme/app --dry-run"],
   effect: "write",
-  ...common6,
-  keywords: ["code review", "review pull request", "review pr", "ai review", "check my pr", "findings"],
+  ...common7,
+  keywords: ["code review", "review diff", "review patch", "review pull request", "review pr", "check my pr", "findings"],
   result: withDryRun(ReviewRunResponse),
   text: (d) => "run" in d ? [`${d.run.status} review of ${d.run.repository}#${d.run.pullNumber} (${d.run.mode}${d.run.posted ? ", posted" : ", nothing posted"}): ${d.run.findings.open} open, ${d.run.findings.fixed} fixed, ${d.run.findings.dismissed} dismissed.`, ...d.findings.filter((finding) => finding.status === "open").map(FINDING_LINE)] : [],
   handler: async (inv) => {
+    const diff = await diffOf(inv);
+    if (diff !== void 0) {
+      const title = textFlag(inv, "title");
+      const label = textFlag(inv, "label");
+      const source = { kind: "patch", diff: diff.text, ...title === void 0 ? {} : { title }, ...label === void 0 ? {} : { label } };
+      const patchBody = { requestId: requestId7(), trigger: "manual", source };
+      if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, { ...patchBody, source: { ...source, diff: `<${diff.text.length} characters from ${diff.from}>` } }, "runs the deterministic checks on the diff, then an optional model pass; nothing is posted");
+      const sent = await connected3(inv);
+      const patched = await sent.call(ReviewRunResponse, "POST", reviewPaths.runs(sent.tenantId, sent.projectId), patchBody);
+      if (patched.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
+      return { data: patched };
+    }
     const number4 = Number(inv.positionals[0]);
-    if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number", { hint: "overlane review run 7" });
+    if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number, or a diff with --diff", { hint: "overlane review run --diff change.patch" });
     const repository = await repositoryOf(inv);
-    const body2 = { requestId: requestId6(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
-    if (inv.dryRun) return planned2(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub App and runs the review");
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { requestId: requestId7(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
+    if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub connection and runs the review");
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     const result = await call2(ReviewRunResponse, "POST", reviewPaths.runs(tenantId, projectId), body2);
     if (result.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
     return { data: result };
@@ -60369,12 +61203,12 @@ var reviewStatusCommand = defineCommand({
   description: "Shows whether review posts comments or is log-only, the token cap, the latest runs and the number of open findings. States the data-use terms: diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review status", "overlane review status --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["review mode", "log only", "review settings", "recent reviews", "how is review doing"],
   result: ReviewStatusResponse,
   text: (d) => [`Review mode: ${d.settings.mode}. Token cap per pull request: ${d.settings.tokenCap}. Open findings: ${d.openFindings}.`, d.settings.privacy, ...d.runs.slice(0, 5).map((run3) => `${run3.startedAt}  ${run3.repository}#${run3.pullNumber}  ${run3.status}  ${run3.tokensUsed} tokens  ${run3.model}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewStatusResponse, "GET", reviewPaths.status(tenantId, projectId)) };
   }
 });
@@ -60389,12 +61223,12 @@ var reviewFindingsCommand = defineCommand({
   ],
   examples: ["overlane review findings --status open", "overlane review findings --pull 7 --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["list findings", "open comments", "review comments", "what did review find", "defects"],
   result: ReviewFindingsResponse,
   text: (d) => d.findings.length === 0 ? ["No findings."] : d.findings.map(FINDING_LINE),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     const params = new URLSearchParams();
     for (const name2 of ["pull", "repo", "status"]) {
       const value = textFlag(inv, name2);
@@ -60415,16 +61249,16 @@ var reviewDismissCommand = defineCommand({
   ],
   examples: ['overlane review dismiss fnd_1 --note "intended"', "overlane review dismiss fnd_2 --accept"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["dismiss finding", "ignore comment", "false positive", "accept finding", "teach reviewer", "feedback"],
   result: withDryRun(FeedbackResponse),
   text: (d) => "finding" in d ? [`${d.finding.id} is ${d.finding.status}.${d.learned === null ? "" : ` Learned: ${d.learned.direction} ${d.learned.rule} (${d.learned.evidence} reviews).`}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "dismiss");
     const note = textFlag(inv, "note");
-    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId6() };
-    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId7() };
+    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(FeedbackResponse, "POST", reviewPaths.feedback(tenantId, projectId, findingId), body2) };
   }
 });
@@ -60436,16 +61270,16 @@ var reviewAutofixCommand = defineCommand({
   flags: [{ name: "assign", type: "string", value: "AGENT", description: "The agent or bot to assign, for example agent:fixer" }],
   examples: ["overlane review autofix fnd_1", "overlane review autofix fnd_1 --assign agent:fixer --dry-run"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["auto fix", "autofix", "fix finding", "create task from finding", "assign to agent"],
   result: withDryRun(AutofixResponse),
   text: (d) => "taskId" in d ? [`Task ${d.taskId} created${d.assignee === null ? "" : ` for ${d.assignee}`}. Start it with: overlane task start ${d.taskId}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "autofix");
     const assignee = textFlag(inv, "assign");
-    const body2 = { requestId: requestId6(), ...assignee === void 0 ? {} : { assignee } };
-    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const body2 = { requestId: requestId7(), ...assignee === void 0 ? {} : { assignee } };
+    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(AutofixResponse, "POST", reviewPaths.autofix(tenantId, projectId, findingId), body2) };
   }
 });
@@ -60455,19 +61289,19 @@ var reviewSettingsCommand = defineCommand({
   description: "Shows the mode (log-only until comments are enabled), the per-PR token cap, extra skip patterns and the statement that diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review settings"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["review configuration", "token cap", "skip patterns", "privacy", "no training", "data use"],
   result: ReviewSettings,
   text: (d) => [`Mode: ${d.mode}. Token cap: ${d.tokenCap}. Extra skip patterns: ${d.skipPatterns.length === 0 ? "none" : d.skipPatterns.join(", ")}.`, d.privacy],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewSettings, "GET", reviewPaths.settings(tenantId, projectId)) };
   }
 });
 var reviewSettingsSetCommand = defineCommand({
   path: ["review", "settings", "set"],
   summary: "Change the review mode, token cap or skip patterns",
-  description: "Sets how review behaves for the project. Enabling comments (`--mode comments`) lets review post inline comments and the summary on GitHub; it is log-only until then. An agent or a person can change them; a read-only viewer cannot.",
+  description: "Sets how review behaves for the project. Enabling comments (`--mode comments`) lets review post inline comments and the summary on the pull request (GitHub today; native pull requests with Overlane git); it is log-only until then. A diff review never posts. An agent or a person can change them; a read-only viewer cannot.",
   flags: [
     { name: "mode", type: "string", enum: ["log_only", "comments"], description: "log_only records findings only; comments posts them" },
     { name: "token-cap", type: "string", value: "N", description: "Most tokens one pull request may use (1,000 to 2,000,000)" },
@@ -60475,7 +61309,7 @@ var reviewSettingsSetCommand = defineCommand({
   ],
   examples: ["overlane review settings set --mode comments", "overlane review settings set --token-cap 40000 --skip 'docs/**' --dry-run"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["enable review comments", "turn on review", "log only", "set token cap", "skip files"],
   result: withDryRun(ReviewSettings),
   text: (d) => "mode" in d ? [`Review is ${d.mode}. Token cap ${d.tokenCap}.`] : [],
@@ -60489,8 +61323,8 @@ var reviewSettingsSetCommand = defineCommand({
     });
     if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "), { hint: "overlane review settings set --mode comments" });
     if (Object.keys(parsed.data).length === 0) throw new UsageError("nothing to change", { hint: "overlane review settings set --mode comments" });
-    if (inv.dryRun) return planned2(inv, "PUT", reviewPaths.settings, parsed.data);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    if (inv.dryRun) return planned3(inv, "PUT", reviewPaths.settings, parsed.data);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(ReviewSettings, "PUT", reviewPaths.settings(tenantId, projectId), parsed.data) };
   }
 });
@@ -60500,12 +61334,12 @@ var codeMapStatusCommand = defineCommand({
   description: "Lists every supported client in its local and cloud setting, and the bots, review service, cross-repository questions and wiki, with whether the code map is on and the reason. The default for a setting follows the latest GATE-07 result for that setting: off for a local agent with grep (the local run failed, ADR 0018), on where there is no checkout until a re-run says otherwise.",
   examples: ["overlane code-map status", "overlane code-map status --json"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["code map", "code tools", "is the code map on", "gate-07", "code layer", "per client"],
   result: CodeMapStatus,
   text: (d) => d.clients.map((row) => `${row.on ? "on " : "off"}  ${row.subject}: ${row.reason}`),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(CodeMapStatus, "GET", codeMapPaths.status(tenantId, projectId)) };
   }
 });
@@ -60553,7 +61387,7 @@ function rootHelp(specs, version2) {
   const lines = [
     ROOT_FIRST_LINE,
     "",
-    `overlane${version2 === "" ? "" : ` ${version2}`} - connect a GitHub project to Overlane, and run its tasks`,
+    `overlane${version2 === "" ? "" : ` ${version2}`} - connect a project to Overlane (no GitHub account needed), and run its tasks`,
     "",
     "Usage: overlane <command> [flags]      overlane <command> --help      overlane schema <command>",
     "",
@@ -60864,7 +61698,7 @@ init_zod();
 // ../cli/src/connect-result.ts
 init_zod();
 var ConnectResult = external_exports.object({
-  project: external_exports.object({ owner: external_exports.string(), name: external_exports.string(), root: external_exports.string() }),
+  project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
   serviceUrl: external_exports.string(),
   tenantId: external_exports.string().optional(),
   projectId: external_exports.string().optional(),
@@ -61009,10 +61843,10 @@ async function disconnect(deps, options) {
 }
 
 // ../cli/src/doctor.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 init_zod();
 var DoctorResult = external_exports.object({
-  project: external_exports.object({ owner: external_exports.string(), name: external_exports.string(), root: external_exports.string() }),
+  project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
   binding: external_exports.enum(["ok", "missing", "invalid"]),
   service: external_exports.string().optional(),
   credentials: external_exports.string().optional(),
@@ -61029,13 +61863,13 @@ async function doctor(deps, options) {
   const root = project.root;
   const binding = readBindingFile(root);
   const owned = readOwned(root);
-  const marketplaceRoot2 = resolve9(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
+  const marketplaceRoot2 = resolve10(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
   const infos = await detectAgents(deps, options.agents, root);
   let service = "reachable";
   let hasToken = false;
   let credentials;
   let checked2 = false;
-  say(deps, `Project: ${project.repository.owner}/${project.repository.name} at ${root}`);
+  say(deps, `Project: ${projectLabel(project)} at ${root}`);
   if (binding.kind === "ok") {
     const { serviceUrl } = binding.binding;
     const token = await findToken(deps, serviceUrl);
@@ -61059,7 +61893,7 @@ async function doctor(deps, options) {
   const installedStates = reports.filter((report2, index) => infos[index]?.installed === true).map((report2) => report2.state);
   const ready = installedStates.length > 0 && installedStates.every((state) => state === "ready");
   const data = {
-    project: { owner: project.repository.owner, name: project.repository.name, root },
+    project: projectSummary(project),
     binding: binding.kind,
     ...binding.kind === "ok" ? { service: binding.binding.serviceUrl } : {},
     ...credentials === void 0 ? {} : { credentials },
@@ -61089,7 +61923,7 @@ async function doctor(deps, options) {
 
 // ../cli/src/kit/setup.ts
 init_src();
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
 import { join as join22 } from "node:path";
 
@@ -61179,7 +62013,7 @@ function newPlan(name2, goal, withCiTask) {
         id: "T001",
         title: "Add CI",
         milestone: "M1",
-        outcome: "A GitHub Actions workflow runs the project's install, typecheck and test commands on every push and pull request.",
+        outcome: "A CI workflow (GitHub Actions today; Overlane CI once native CI is available) runs the project's install, typecheck and test commands on every push and pull request.",
         allowedPaths: [".github/**"],
         acceptance: ["A workflow in .github/workflows runs on push and pull_request"],
         verification: ['test -n "$(ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null)"'],
@@ -61218,7 +62052,8 @@ function schedulerSetup(projectId) {
 }
 async function connectKit(deps, options) {
   if (options.mode === "new" && (options.goal === void 0 || options.goal.trim().length === 0)) throw new UsageError("--kit new needs --goal TEXT");
-  const { root, repository } = await detectProject(deps);
+  const project = await detectProject(deps, { name: options.name, provider: options.provider });
+  const { root } = project;
   if (await headCommit(deps, root) === null) throw new CliError("the repository has no commit yet; make an initial commit first");
   const planDir = join22(root, PLAN_DIR);
   const planExists = existsSync6(join22(planDir, "project.md"));
@@ -61230,7 +62065,7 @@ async function connectKit(deps, options) {
       plan3 = await readPlan(root);
       planSource = `${PLAN_DIR}/ already exists; kept as it is`;
     } else if (options.mode === "new") {
-      plan3 = newPlan(repository.name, options.goal ?? "", !ciExists);
+      plan3 = newPlan(project.name, options.goal ?? "", !ciExists);
       planSource = "minimal plan from --goal";
     } else if (hasSpecKit(root)) {
       plan3 = await importSpecKit(root);
@@ -61253,7 +62088,7 @@ async function connectKit(deps, options) {
   const touched = [...INSTRUCTION_FILES, CI_FILE];
   const unsaved = await dirty(deps, root, touched);
   if (unsaved.length > 0 && !options.dryRun) throw new CliError(`uncommitted changes in ${unsaved.join(", ")}; commit or stash them so the kit commit holds only its own lines`);
-  say(deps, `Kit setup (${options.mode}) for ${repository.owner}/${repository.name}`);
+  say(deps, `Kit setup (${options.mode}) for ${projectLabel(project)}`);
   say(deps, `  branch: create ${KIT_BRANCH}`);
   say(deps, `  plan: ${planSource} (${plan3.milestones.length} milestone(s), ${plan3.tasks.length} task(s))${planExists ? "" : `, written to ${PLAN_DIR}/`}`);
   say(deps, ciExists ? "  ci: a workflow already exists; left alone" : workflow === null ? "  ci: no install, typecheck or test command detected, so no workflow is written (the plan task adds it)" : `  ci: write ${CI_FILE} (pinned actions; runs ${[detected.install, ...detected.typecheck ?? [], ...detected.test].filter((c) => c !== void 0).join("; ")})`);
@@ -61305,11 +62140,11 @@ async function connectKit(deps, options) {
   const agentConfig = [join22(".claude", "settings.json"), join22(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
   const preExisting = new Set(agentConfig.filter((file2) => existsSync6(join22(root, file2))));
-  const connected3 = await connect(deps, { ...options, yes: true });
-  if (connected3.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const connected4 = await connect(deps, { ...options, yes: true });
+  if (connected4.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected3.data !== void 0 && !("dryRun" in connected3.data) ? connected3.data : void 0;
+  const connectData = connected4.data !== void 0 && !("dryRun" in connected4.data) ? connected4.data : void 0;
   for (const file2 of agentConfig) {
     if (!existsSync6(join22(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
@@ -61328,9 +62163,9 @@ async function connectKit(deps, options) {
   const kit = kitClient(deps, serviceUrl, binding.binding, token.token);
   await kit.putPolicy({ ...DEFAULT_RUN_POLICY, buildAheadLimit: firstMilestone });
   say(deps, `Run policy set (build-ahead limit ${firstMilestone}).`);
-  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID7()}`, sourceCommit: sha, plan: await readPlan(root) }));
+  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID8()}`, sourceCommit: sha, plan: await readPlan(root) }));
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
-  const pr = await openPullRequest(deps, root, repository.name);
+  const pr = await openPullRequest(deps, root, project.name);
   say(deps);
   for (const line2 of schedulerSetup(binding.binding.projectId)) say(deps, line2);
   return {
@@ -61376,18 +62211,20 @@ var AGENTS_FLAG = { name: "agents", type: "string", value: "claude,codex", descr
 var ROOT_FLAG = { name: "marketplace-root", type: "string", value: "DIR", description: "Folder holding the built claude/ and codex/ plugin marketplaces" };
 var connectCommand = defineCommand({
   path: ["connect"],
-  summary: "Connect this GitHub project: sign in, bind it, register the plugin; --kit also sets up a plan",
-  description: "Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .harness/project.json and records what it added in .harness/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
+  summary: "Connect this project (native Overlane, or your GitHub repository): sign in, bind it, register the plugin; --kit also sets up a plan",
+  description: "Works in any git project, with no GitHub account: without a GitHub origin the project is a native Overlane project named after the folder (--name renames it). With a github.com origin it binds that repository instead (--provider overlane keeps it native). Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .harness/project.json and records what it added in .harness/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
   flags: [
     { name: "service", type: "string", value: "URL", description: "Service address (https); default is the hosted service or HARNESS_SERVICE_URL" },
     ROOT_FLAG,
     AGENTS_FLAG,
     { name: "dry-run", type: "boolean", description: "Print the plan, the requests it would send and the files it would write; change nothing. Needs no credentials." },
     { name: "yes", type: "boolean", description: "Apply the plan without asking (required when there is no terminal)" },
+    { name: "name", type: "string", value: "NAME", description: "The project name (default: the GitHub repository name, else this folder's name)" },
+    { name: "provider", type: "string", enum: ["overlane", "github"], description: "Where the project lives: overlane (native, the default without a GitHub origin) or github (needs a github.com origin)" },
     { name: "kit", type: "string", enum: ["existing", "new"], description: "Also set up the project kit: plan files, CI, instruction blocks and one pull request" },
     { name: "goal", type: "string", value: "TEXT", description: "The project's goal; required with --kit new" }
   ],
-  examples: ["overlane connect --dry-run", "overlane connect --yes", 'overlane connect --kit new --goal "A rundown service" --yes', "overlane connect --kit existing --yes"],
+  examples: ["overlane connect --dry-run", "overlane connect --yes", "overlane connect --name my-app --yes", "overlane connect --provider github --yes", 'overlane connect --kit new --goal "A rundown service" --yes', "overlane connect --kit existing --yes"],
   effect: "write",
   needsNetwork: true,
   keywords: ["setup", "install", "bind", "link", "onboard", "register plugin", "bootstrap", "autonomous", "plan", "kit", "get started", "initialise", "enable harness", "ci workflow", "pull request"],
@@ -61398,7 +62235,9 @@ var connectCommand = defineCommand({
       marketplaceRoot: textFlag(inv, "marketplace-root"),
       agents: parseAgentList(textFlag(inv, "agents")),
       dryRun: inv.dryRun,
-      yes: boolFlag(inv, "yes")
+      yes: boolFlag(inv, "yes"),
+      name: textFlag(inv, "name"),
+      provider: parseProvider(textFlag(inv, "provider"))
     };
     const kit = textFlag(inv, "kit");
     const goal = textFlag(inv, "goal");
@@ -61612,7 +62451,7 @@ var ReleaseRollbackResult = external_exports.union([
 ]);
 
 // ../cli/src/commands/release.ts
-var common7 = { needsAuth: true, needsNetwork: true };
+var common8 = { needsAuth: true, needsNetwork: true };
 var APPROVE = { name: "approve", type: "string", value: "DIGEST", description: "Approve this exact release digest when it changes executable files or policy" };
 var releaseListCommand = defineCommand({
   path: ["release", "list"],
@@ -61620,7 +62459,7 @@ var releaseListCommand = defineCommand({
   description: "Lists releases with version, short digest, channel, change kinds, restart rule, compatibility and which projects pin them.",
   examples: ["overlane release list"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["releases", "versions", "available", "published", "what versions", "all releases"],
   result: ReleaseListResult,
   handler: async (inv) => listReleases(inv.deps)
@@ -61631,7 +62470,7 @@ var releaseStatusCommand = defineCommand({
   description: `Compares the installed release (.harness/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
   examples: ["overlane release status"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["installed", "version", "in sync", "update available", "which release", "pinned", "am i up to date", "current release"],
   result: ReleaseStatusResult,
   handler: async (inv) => releaseStatus(inv.deps)
@@ -61643,7 +62482,7 @@ var releaseUpdateCommand = defineCommand({
   flags: [{ name: "to", type: "string", value: "DIGEST", description: "Install this release instead of the project's pin" }, APPROVE],
   examples: ["overlane release update --dry-run", "overlane release update", "overlane release update --approve sha256:..."],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["upgrade", "install release", "new version", "pull latest", "plugin update", "approve", "update plugin", "get newest"],
   result: ReleaseUpdateResult,
   handler: async (inv) => updateRelease(inv.deps, { to: textFlag(inv, "to"), approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -61655,7 +62494,7 @@ var releaseRollbackCommand = defineCommand({
   flags: [APPROVE],
   examples: ["overlane release rollback --dry-run", "overlane release rollback --force"],
   effect: "destructive",
-  ...common7,
+  ...common8,
   keywords: ["roll back", "revert", "undo update", "previous version", "downgrade", "go back", "restore", "undo release", "bad release"],
   result: ReleaseRollbackResult,
   handler: async (inv) => rollbackRelease(inv.deps, { approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -61722,7 +62561,7 @@ var RunStatusResult = external_exports.object({
 var RunPolicyChangeResult = withDryRun(external_exports.object({ changed: external_exports.boolean(), policy: PolicyShape }));
 
 // ../cli/src/commands/run.ts
-var common8 = { needsAuth: true, needsNetwork: true };
+var common9 = { needsAuth: true, needsNetwork: true };
 var EXECUTOR = { name: "executor", type: "string", enum: ["claude-code", "codex"], description: "Which agent this is (default: detected from the environment)" };
 var STOP_NOTE = "A stop (policy paused, a budget spent, nothing runnable) exits 6 with the reason in the error code and the exact `overlane run end --reason ...` as the hint.";
 var runStartCommand = defineCommand({
@@ -61732,7 +62571,7 @@ var runStartCommand = defineCommand({
   flags: [{ name: "trigger", type: "string", enum: ["schedule", "interactive", "event"], default: "interactive", description: "What started the run" }, EXECUTOR],
   examples: ["overlane run start --trigger schedule", "overlane run start --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["begin run", "bounded step", "autonomous", "start working", "new run", "schedule", "kick off"],
   result: RunStartResult,
   handler: async (inv) => startRun(inv.deps, { trigger: textFlag(inv, "trigger"), executor: textFlag(inv, "executor"), dryRun: inv.dryRun })
@@ -61744,7 +62583,7 @@ var runNextCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run next"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["what should I work on next", "next task", "runnable", "what to do", "pick a task", "which task", "what's next", "work on", "what is next", "todo"],
   result: RunNextResult,
   handler: async (inv) => nextTask(inv.deps, { executor: textFlag(inv, "executor") })
@@ -61756,7 +62595,7 @@ var runClaimCommand = defineCommand({
   args: [{ name: "task-id", required: false, description: "The task to claim (default: the next runnable one)" }],
   examples: ["overlane run claim", "overlane run claim T003"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["take task", "lease task", "grab", "assign", "pick up task", "get a task"],
   result: RunClaimResult,
   handler: async (inv) => claimTask(inv.deps, { positionals: inv.positionals, dryRun: inv.dryRun })
@@ -61773,7 +62612,7 @@ var runDecideCommand = defineCommand({
   ],
   examples: ['overlane run decide --question "Which date library?" --decision "Use the built-in Intl" --evidence "package.json has no date library"'],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["record decision", "question", "unblocked", "owner override", "judgement call", "log choice", "do not ask", "decide"],
   result: RunDecideResult,
   handler: async (inv) => decide(inv.deps, { question: textFlag(inv, "question"), decision: textFlag(inv, "decision"), evidence: listFlag(inv, "evidence"), task: textFlag(inv, "task"), dryRun: inv.dryRun })
@@ -61785,7 +62624,7 @@ var runEndCommand = defineCommand({
   flags: [{ name: "reason", type: "string", required: true, enum: RUN_STOP_REASONS, description: "Why the run ended" }],
   examples: ["overlane run end --reason nothing_runnable", "overlane run end --reason error"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["finish run", "stop", "wrap up", "close run", "release leases", "done with run", "end the run"],
   result: RunEndResult,
   handler: async (inv) => endRun(inv.deps, { reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -61797,7 +62636,7 @@ var runStatusCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run status"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["policy", "budget", "limits", "how much left", "remaining", "state of run", "is it paused", "run policy"],
   result: RunStatusResult,
   handler: async (inv) => runStatus(inv.deps, { executor: textFlag(inv, "executor") })
@@ -61808,7 +62647,7 @@ var runPauseCommand = defineCommand({
   description: "Sets the project's run policy to paused. Every run then stops at its next check (`STOP paused`). Undo with `overlane run resume`. Safe to repeat.",
   examples: ["overlane run pause", "overlane run pause --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["pause", "halt", "freeze", "stop all", "emergency brake", "disable autonomous runs", "policy", "no new runs", "stop agents", "turn off", "suspend"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "paused", inv.dryRun)
@@ -61819,7 +62658,7 @@ var runResumeCommand = defineCommand({
   description: "Sets the project's run policy back to active so runs can start and tasks can be claimed again. Safe to repeat.",
   examples: ["overlane run resume", "overlane run resume --dry-run"],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["unpause", "re-enable", "continue autonomous", "reactivate", "policy active", "turn on", "restart runs", "lift the pause"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "active", inv.dryRun)
@@ -61829,7 +62668,7 @@ var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCo
 // ../cli/src/task/queue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname8, join as join23 } from "node:path";
 var TASK_POLICY_PATH = join23(".harness", "task-policy.json");
@@ -61849,7 +62688,7 @@ var TaskQueueResult = TaskQueue;
 var TaskPrioritiseResult = withDryRun(external_exports.object({ ...PrioritiseResult.shape, next: external_exports.string() }));
 var TaskPolicyResult = external_exports.object({ enforcement: TaskEnforcement, reason: external_exports.string().optional(), changedBy: external_exports.string().optional(), updatedAt: external_exports.string().optional(), localFile: external_exports.string() });
 var TaskPolicySetResult = withDryRun(TaskPolicyResult);
-var requestId7 = () => `cli-${randomUUID8()}`;
+var requestId8 = () => `cli-${randomUUID9()}`;
 function priorityOf(value, fallback) {
   const parsed = TaskPriority.safeParse(value ?? fallback);
   if (!parsed.success) throw new UsageError(`--priority must be one of ${TASK_PRIORITIES.join(", ")}`);
@@ -61888,7 +62727,7 @@ async function prioritiseTask(deps, input2) {
   const name2 = detectExecutorName(deps.env);
   let request;
   try {
-    request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+    request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   } catch (error62) {
     throw new UsageError(String(error62));
   }
@@ -61917,7 +62756,7 @@ async function newTask(deps, input2) {
   const begun = data;
   const project = await connectedProject(deps, "task");
   const name2 = detectExecutorName(deps.env);
-  const request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
+  const request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
   try {
     const ranked = await serviceCall(deps, project.serviceUrl, project.token)(PrioritiseResult, "POST", taskQueuePaths.prioritise(project.binding.tenantId, project.binding.projectId, begun.taskId), request);
     say(deps, `Ranked ${begun.taskId} ${ranked.priority}${input2.top ? " (first)" : ""}.`);
@@ -61938,7 +62777,7 @@ async function setPolicy(deps, input2) {
   const enforcement = TaskEnforcement.safeParse(input2.enforcement);
   if (!enforcement.success) throw new UsageError(`set needs ${TASK_ENFORCEMENT.join(" or ")}`);
   const name2 = detectExecutorName(deps.env);
-  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId7(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId8(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
   if (input2.dryRun) {
     const project2 = await offlineProject(deps, "task");
@@ -61965,7 +62804,7 @@ async function startExisting(deps, taskId, dryRun) {
 }
 
 // ../cli/src/commands/queue.ts
-var common9 = { needsAuth: true, needsNetwork: true };
+var common10 = { needsAuth: true, needsNetwork: true };
 var PRIORITIES2 = ["P0", "P1", "P2", "P3"];
 var taskNewCommand = defineCommand({
   path: ["task", "new"],
@@ -61981,7 +62820,7 @@ var taskNewCommand = defineCommand({
   ],
   examples: ['overlane task new "Fix login redirect"', 'overlane task new "Hotfix the build" --priority P0 --top'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["new task", "create task", "no active task", "blocked no task", "start work", "need a task", "begin", "quick task"],
   result: TaskNewResult,
   handler: async (inv) => newTask(inv.deps, {
@@ -62000,7 +62839,7 @@ var taskNextCommand = defineCommand({
   description: "Picks the best ready or paused task: P0 before P3, then rank, then milestone and dependency order. When this working copy holds a task and the next one outranks it, says so (preempt) and prints the commands to checkpoint and switch; the preempted task comes back through this command afterwards.",
   examples: ["overlane task next"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["what next", "next task", "priority", "what should i work on", "pick work", "resume after", "queue"],
   result: TaskNextResult,
   handler: async (inv) => taskNext(inv.deps)
@@ -62011,7 +62850,7 @@ var taskQueueCommand = defineCommand({
   description: "Lists ready, running, paused and blocked tasks by priority, then rank, then plan order, with each task's priority.",
   examples: ["overlane task queue"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["priority list", "ranking", "order", "backlog", "what is queued", "p0"],
   result: TaskQueueResult,
   handler: async (inv) => taskQueue(inv.deps)
@@ -62028,7 +62867,7 @@ var taskPrioritiseCommand = defineCommand({
   ],
   examples: ["overlane task prioritise task-7 --priority P0 --top", 'overlane task prioritise task-9 --priority P2 --reason "user said later"'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["reprioritize", "reprioritise", "bump", "urgent", "move to top", "rank", "lower priority", "p0", "p1", "p2", "p3"],
   result: TaskPrioritiseResult,
   handler: async (inv) => prioritiseTask(inv.deps, { taskId: inv.positionals[0], priority: textFlag(inv, "priority"), top: boolFlag(inv, "top"), reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -62039,7 +62878,7 @@ var taskPolicyCommand = defineCommand({
   description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .harness/task-policy.json for the hooks.",
   examples: ["overlane task policy"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["enforcement", "require task", "task gate", "relax", "blocked", "policy"],
   result: TaskPolicyResult,
   handler: async (inv) => showPolicy2(inv.deps)
@@ -62052,7 +62891,7 @@ var taskPolicySetCommand = defineCommand({
   flags: [{ name: "reason", type: "string", value: "TEXT", description: "Why the rule is relaxed (required for relaxed)" }],
   examples: ["overlane task policy set required", 'overlane task policy set relaxed --reason "docs-only repository"'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["relax", "turn off task requirement", "require tasks", "allow edits without task", "enforcement"],
   result: TaskPolicySetResult,
   handler: async (inv) => setPolicy(inv.deps, { enforcement: inv.positionals[0], reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -62097,14 +62936,14 @@ var TaskHandoffResult = withDryRun(
 );
 
 // ../cli/src/commands/task.ts
-var common10 = { needsAuth: true, needsNetwork: true };
+var common11 = { needsAuth: true, needsNetwork: true };
 var taskListCommand = defineCommand({
   path: ["task", "list"],
   summary: "List the project's tasks and their states",
   description: "Lists every task of the connected project with its state, pause reason, version, lease holder, checks and latest checkpoint.",
   examples: ["overlane task list"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["tasks", "show all tasks", "see tasks", "backlog", "what tasks exist", "work items"],
   result: TaskListResult,
   handler: async (inv) => listTasks(inv.deps)
@@ -62122,7 +62961,7 @@ var taskStartCommand = defineCommand({
   ],
   examples: ["overlane task start task-7", 'overlane task start --outcome "Add CSV export" --criterion "export works" --check unit_tests:L2 --path "src/**"', 'overlane task start --outcome "Fix login" --criterion "login passes" --path "src/auth/**" --dry-run'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["begin", "create task", "new task", "open", "claim new", "work item", "contract", "acceptance criteria", "start working"],
   result: TaskStartResult,
   handler: async (inv) => inv.positionals[0] !== void 0 ? startExisting(inv.deps, inv.positionals[0], inv.dryRun) : startTask(inv.deps, { outcome: textFlag(inv, "outcome"), criteria: listFlag(inv, "criterion"), paths: listFlag(inv, "path"), checks: listFlag(inv, "check"), dryRun: inv.dryRun })
@@ -62133,7 +62972,7 @@ var taskStatusCommand = defineCommand({
   description: "Shows the held task from the service: state, lease, acceptance criteria, checks, evidence count and the latest checkpoint. Says so when nothing is held or the lease was lost.",
   examples: ["overlane task status"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["current task", "what am i working on", "lease", "active task", "progress", "held task"],
   result: TaskStatusResult,
   handler: async (inv) => taskStatus(inv.deps)
@@ -62149,7 +62988,7 @@ var taskCheckpointCommand = defineCommand({
   ],
   examples: ['overlane task checkpoint --summary "Parser done" --next "Write the tests"', 'overlane task checkpoint --summary "Out of budget" --next "Resume" --pause quota'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["save", "progress", "pause", "stop work", "park", "quota", "limit reached", "remember place", "snapshot", "save state", "out of budget"],
   result: TaskCheckpointResult,
   handler: async (inv) => checkpointTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), pause: textFlag(inv, "pause"), dryRun: inv.dryRun })
@@ -62161,7 +63000,7 @@ var taskResumeCommand = defineCommand({
   args: [{ name: "task-id", required: true, description: "The task to resume" }],
   examples: ["overlane task resume task-1"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["continue", "pick up", "restart", "reclaim", "after pause", "take over", "carry on"],
   result: TaskResumeResult,
   handler: async (inv) => resumeTask(inv.deps, { taskId: inv.positionals[0], dryRun: inv.dryRun })
@@ -62172,7 +63011,7 @@ var taskSubmitCommand = defineCommand({
   description: "Asks for verification at HEAD. The task is verified only when evidence at or above each required check's level exists for that commit: L2 comes from CI on the pushed commit, L1 from `overlane task evidence`.",
   examples: ["overlane task submit", "overlane task submit --dry-run"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["finish", "done", "complete", "verify", "ready for review", "request verification", "hand in", "turn in"],
   result: TaskSubmitResult,
   handler: async (inv) => submitTask(inv.deps, { dryRun: inv.dryRun })
@@ -62188,7 +63027,7 @@ var taskEvidenceCommand = defineCommand({
   ],
   examples: ["overlane task evidence --level L1 -- pnpm test"],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["tests", "prove", "record test result", "verification", "run checks", "L1", "attest", "run the tests and record"],
   result: TaskEvidenceResult,
   handler: async (inv) => recordEvidence(inv.deps, { level: textFlag(inv, "level"), task: textFlag(inv, "task"), words: inv.positionals, dryRun: inv.dryRun })
@@ -62204,7 +63043,7 @@ var taskHandoffCommand = defineCommand({
   ],
   examples: ["overlane task handoff --to codex", 'overlane task handoff --to claude --summary "API done" --next "Add tests"'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["hand off", "transfer", "give to", "switch agent", "other agent", "codex", "claude", "pass the task", "delegate", "move work", "swap agents"],
   result: TaskHandoffResult,
   handler: async (inv) => handoffTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), to: textFlag(inv, "to"), dryRun: inv.dryRun })
@@ -62235,7 +63074,8 @@ function coreCommands() {
     ...memoryCommands,
     ...libCommands,
     ...reviewCommands,
-    ...guardCommands
+    ...guardCommands,
+    ...billingCommands
   ];
 }
 function createRegistry(extra = []) {