overlane 0.1.130 → 0.1.132

package/dist/overlane.mjs

@@ -17,15 +17,15 @@ var __esm = (fn, res, err2) => function __init() {
   if (err2) throw err2[0];
   try {
     return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-  } catch (e) {
-    throw err2 = [e], e;
+  } catch (e2) {
+    throw err2 = [e2], e2;
   }
 };
 var __commonJS = (cb, mod) => function __require2() {
   try {
     return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
+  } catch (e2) {
+    throw mod = 0, e2;
   }
 };
 var __export = (target, all) => {
@@ -1239,8 +1239,8 @@ function failure(Err, issues, ctx) {
       }
       return error62;
     },
-    set error(e) {
-      error62 = e;
+    set error(e2) {
+      error62 = e2;
       issues = void 0;
       ctx = void 0;
     }
@@ -1275,9 +1275,9 @@ var init_parse = __esm({
           throw new $ZodAsyncError();
         }
         if (result.issues.length) {
-          const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
-          captureStackTrace(e, _params?.callee ?? fn);
-          throw e;
+          const e2 = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
+          captureStackTrace(e2, _params?.callee ?? fn);
+          throw e2;
         }
         return result.value;
       };
@@ -1291,9 +1291,9 @@ var init_parse = __esm({
         if (result instanceof Promise)
           result = await result;
         if (result.issues.length) {
-          const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
-          captureStackTrace(e, params?.callee ?? fn);
-          throw e;
+          const e2 = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
+          captureStackTrace(e2, params?.callee ?? fn);
+          throw e2;
         }
         return result.value;
       };
@@ -2073,13 +2073,13 @@ var init_doc = __esm({
           this.indent -= 1;
         }
       }
-      write(arg) {
-        if (typeof arg === "function") {
-          arg(this, { execution: "sync" });
-          arg(this, { execution: "async" });
+      write(arg4) {
+        if (typeof arg4 === "function") {
+          arg4(this, { execution: "sync" });
+          arg4(this, { execution: "async" });
           return;
         }
-        const content = arg;
+        const content = arg4;
         const lines = content.split("\n").filter((x) => x);
         const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
         const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
@@ -4545,7 +4545,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve14) {
+function isRecursive(inst, stack, resolve16) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4555,7 +4555,7 @@ function isRecursive(inst, stack, resolve14) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve14);
+      const answer = isRecursive(child, stack, resolve16);
       if (answer > result)
         result = answer;
     }
@@ -4566,7 +4566,7 @@ function isRecursive(inst, stack, resolve14) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve14) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve16) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4630,7 +4630,7 @@ function isRecursive(inst, stack, resolve14) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve14 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve16 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -7291,15 +7291,15 @@ var init_he = __esm({
       };
       const typeEntry = (t) => t ? TypeNames[t] : void 0;
       const typeLabel = (t) => {
-        const e = typeEntry(t);
-        if (e)
-          return e.label;
+        const e2 = typeEntry(t);
+        if (e2)
+          return e2.label;
         return t ?? TypeNames.unknown.label;
       };
       const withDefinite = (t) => `\u05D4${typeLabel(t)}`;
       const verbFor = (t) => {
-        const e = typeEntry(t);
-        const gender = e?.gender ?? "m";
+        const e2 = typeEntry(t);
+        const gender = e2?.gender ?? "m";
         return gender === "f" ? "\u05E6\u05E8\u05D9\u05DB\u05D4 \u05DC\u05D4\u05D9\u05D5\u05EA" : "\u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D9\u05D5\u05EA";
       };
       const getSizing = (origin) => {
@@ -17693,8 +17693,8 @@ function currencyCode2(_params) {
   return _stringFormat(ZodCustomStringFormat, "currency_code", currencyCode, _params);
 }
 function hash(alg, params) {
-  const enc = params?.enc ?? "hex";
-  const format = `${alg}_${enc}`;
+  const enc2 = params?.enc ?? "hex";
+  const format = `${alg}_${enc2}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -18146,11 +18146,11 @@ var init_schemas2 = __esm({
       array() {
         return array(this);
       },
-      or(arg) {
-        return union([this, arg]);
+      or(arg4) {
+        return union([this, arg4]);
       },
-      and(arg) {
-        return intersection(this, arg);
+      and(arg4) {
+        return intersection(this, arg4);
       },
       transform(tx) {
         return pipe(this, transform(tx));
@@ -22431,20 +22431,20 @@ function sha256Hex(text) {
       const s1 = rotr(b2, 17) ^ rotr(b2, 19) ^ b2 >>> 10;
       w[i2] = w[i2 - 16] + s0 + w[i2 - 7] + s1 >>> 0;
     }
-    let [a, b, c, d, e, f, g, hh] = h;
+    let [a, b, c, d, e2, f, g, hh] = h;
     for (let i2 = 0; i2 < 64; i2 += 1) {
-      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[i2] + w[i2] >>> 0;
+      const t1 = hh + (rotr(e2, 6) ^ rotr(e2, 11) ^ rotr(e2, 25)) + (e2 & f ^ ~e2 & g) + K[i2] + w[i2] >>> 0;
       const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
       hh = g;
       g = f;
-      f = e;
-      e = d + t1 >>> 0;
+      f = e2;
+      e2 = d + t1 >>> 0;
       d = c;
       c = b;
       b = a;
       a = t1 + t2 >>> 0;
     }
-    const sums = [a, b, c, d, e, f, g, hh];
+    const sums = [a, b, c, d, e2, f, g, hh];
     for (let i2 = 0; i2 < 8; i2 += 1) h[i2] = h[i2] + sums[i2] >>> 0;
   }
   return [...h].map((n) => n.toString(16).padStart(8, "0")).join("");
@@ -24039,6 +24039,881 @@ var init_billing = __esm({
   }
 });
 
+// ../contracts/src/git.ts
+var RepoId, RepoName, BranchName, PrincipalRef, RemoteUrl, ExternalRepoRef, WritableSide, RepoMirror, RepoMode, Repo, CreateRepoRequest, Branch, CreateBranchRequest, PushFile, PushCommit, PushRequest, PushResult, BranchProtection, PutProtectionRequest, MERGE_METHODS, MergeMethod, PR_STATES, PullRequest, OpenPullRequest, REVIEW_STATES, PullReview, SubmitReviewRequest, MergeRequest, MergeBlocker, PullStatus, GIT_EVENT_KINDS, GitEvent, GIT_TOKEN_SCOPES, GitToken, MintGitTokenRequest, GitTokenGrant, ImportRepoRequest, StaleMark, RepoIndexJob, ShardPlan, NativeRepoCapability, RepoListResponse, BranchListResponse, PullListResponse, MergeResult, DeleteRepoResponse, MirrorSyncResponse, IndexJobsResponse, PushCheckRequest, repoBase, e, gitPaths;
+var init_git = __esm({
+  "../contracts/src/git.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    RepoId = external_exports.string().regex(/^repo_[A-Za-z0-9]{6,40}$/);
+    RepoName = external_exports.string().regex(/^[a-z0-9][a-z0-9._-]{0,62}$/, "use lowercase letters, digits, . _ - (at most 63 characters)");
+    BranchName = external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._/-]+$/).refine((name2) => !name2.startsWith("/") && !name2.endsWith("/") && !name2.includes("//") && !name2.includes(".."), "not a valid branch name");
+    PrincipalRef = external_exports.object({ kind: external_exports.enum(["user", "agent"]), id: external_exports.string().min(1).max(128) }).strict();
+    RemoteUrl = external_exports.string().max(500).refine((value) => {
+      let url2;
+      try {
+        url2 = new URL(value);
+      } catch {
+        return false;
+      }
+      if (url2.protocol !== "https:") return false;
+      if (url2.username !== "" || url2.password !== "") return false;
+      for (const key of url2.searchParams.keys()) if (/token|secret|password|key|auth|expires/i.test(key)) return false;
+      return !value.includes("@");
+    }, "a remote URL must be https and carry no credential");
+    ExternalRepoRef = external_exports.object({ provider: Provider.exclude(["overlane"]), owner: external_exports.string().min(1).max(100), name: external_exports.string().min(1).max(100) }).strict();
+    WritableSide = external_exports.enum(["overlane", "external"]);
+    RepoMirror = external_exports.object({
+      external: ExternalRepoRef,
+      writableSide: WritableSide,
+      lastSyncedAt: Timestamp.nullable(),
+      lastSyncedSha: CommitSha.nullable()
+    }).strict();
+    RepoMode = external_exports.enum(["native", "github-only"]);
+    Repo = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      repoId: RepoId,
+      name: RepoName,
+      provider: Provider,
+      mode: RepoMode,
+      defaultBranch: BranchName,
+      sizeBytes: external_exports.number().int().nonnegative(),
+      capBytes: external_exports.number().int().positive(),
+      remote: RemoteUrl,
+      mirror: RepoMirror.nullable(),
+      createdBy: PrincipalRef,
+      createdAt: Timestamp,
+      deletedAt: Timestamp.nullable()
+    }).strict();
+    CreateRepoRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      name: RepoName,
+      defaultBranch: BranchName.default("main"),
+      /** Seed the default branch with one commit holding a README, so the first clone is not empty. */
+      seed: external_exports.boolean().default(true)
+    }).strict();
+    Branch = external_exports.object({ tenantId: TenantId, repoId: RepoId, name: BranchName, sha: CommitSha, protected: external_exports.boolean() }).strict();
+    CreateBranchRequest = external_exports.object({ name: BranchName, from: external_exports.union([BranchName, CommitSha]).optional() }).strict();
+    PushFile = external_exports.object({ path: external_exports.string().min(1).max(500), content: external_exports.string().max(5e6).nullable() }).strict();
+    PushCommit = external_exports.object({ message: external_exports.string().min(1).max(5e3), files: external_exports.array(PushFile).min(1).max(500) }).strict();
+    PushRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      ref: BranchName,
+      /** The SHA the caller believes the branch is at; null creates the branch. */
+      expectedOld: CommitSha.nullable(),
+      force: external_exports.boolean().default(false),
+      /** The commit the pushed commits are built on. Defaults to the current tip (none for a new branch). A different parent with `force` rewrites history. */
+      parent: CommitSha.nullable().optional(),
+      commits: external_exports.array(PushCommit).min(1).max(100)
+    }).strict();
+    PushResult = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      ref: BranchName,
+      before: CommitSha.nullable(),
+      after: CommitSha,
+      forced: external_exports.boolean(),
+      eventId: external_exports.string(),
+      sequence: external_exports.number().int().positive(),
+      replay: external_exports.boolean()
+    }).strict();
+    BranchProtection = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      /** A branch name or a glob such as `release/**`. */
+      pattern: external_exports.string().min(1).max(200),
+      requiredChecks: external_exports.array(external_exports.string().min(1).max(128)).max(50),
+      requiredApprovals: external_exports.number().int().min(0).max(10),
+      allowForcePush: external_exports.literal(false),
+      allowedMergeMethods: external_exports.array(external_exports.enum(["merge", "squash", "rebase"])).min(1),
+      updatedAt: Timestamp
+    }).strict();
+    PutProtectionRequest = external_exports.object({
+      pattern: external_exports.string().min(1).max(200),
+      requiredChecks: external_exports.array(external_exports.string().min(1).max(128)).max(50).default([]),
+      requiredApprovals: external_exports.number().int().min(0).max(10).default(1),
+      allowedMergeMethods: external_exports.array(external_exports.enum(["merge", "squash", "rebase"])).min(1).default(["merge", "squash", "rebase"])
+    }).strict();
+    MERGE_METHODS = ["merge", "squash", "rebase"];
+    MergeMethod = external_exports.enum(MERGE_METHODS);
+    PR_STATES = ["open", "merged", "closed"];
+    PullRequest = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      repoId: RepoId,
+      provider: Provider,
+      number: external_exports.number().int().positive(),
+      title: external_exports.string().min(1).max(500),
+      body: external_exports.string().max(6e4),
+      state: external_exports.enum(PR_STATES),
+      draft: external_exports.boolean(),
+      head: external_exports.object({ branch: BranchName, sha: CommitSha }).strict(),
+      base: external_exports.object({ branch: BranchName, sha: CommitSha }).strict(),
+      author: PrincipalRef,
+      /** The head comes from a fork: no secrets reach CI or review (REQ-CI-04, REQ-REV-09). */
+      fork: external_exports.boolean(),
+      mergeMethod: MergeMethod.nullable(),
+      mergedSha: CommitSha.nullable(),
+      createdAt: Timestamp,
+      updatedAt: Timestamp
+    }).strict();
+    OpenPullRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      title: external_exports.string().min(1).max(500),
+      body: external_exports.string().max(6e4).default(""),
+      head: BranchName,
+      base: BranchName.optional(),
+      draft: external_exports.boolean().default(false)
+    }).strict();
+    REVIEW_STATES = ["approved", "changes_requested", "commented"];
+    PullReview = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      number: external_exports.number().int().positive(),
+      reviewId: external_exports.string().min(1).max(64),
+      reviewer: PrincipalRef,
+      state: external_exports.enum(REVIEW_STATES),
+      /** The head a review applies to: a push after an approval makes it stale (the approval is for the old head). */
+      headSha: CommitSha,
+      body: external_exports.string().max(2e4),
+      at: Timestamp
+    }).strict();
+    SubmitReviewRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), state: external_exports.enum(REVIEW_STATES), body: external_exports.string().max(2e4).default("") }).strict();
+    MergeRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), method: MergeMethod.default("squash") }).strict();
+    MergeBlocker = external_exports.object({ code: external_exports.enum(["checks_missing", "checks_failed", "approvals_missing", "changes_requested", "stale_approval", "not_open", "draft", "method_not_allowed", "conflict", "approval_required"]), message: external_exports.string() }).strict();
+    PullStatus = external_exports.object({
+      tenantId: TenantId,
+      pull: PullRequest,
+      reviews: external_exports.array(PullReview),
+      checks: external_exports.array(external_exports.object({ name: external_exports.string(), state: external_exports.enum(["pending", "success", "failure"]), runId: external_exports.string().nullable() }).strict()),
+      approvals: external_exports.number().int().nonnegative(),
+      mergeable: external_exports.boolean(),
+      blockers: external_exports.array(MergeBlocker)
+    }).strict();
+    GIT_EVENT_KINDS = ["push", "branch_created", "branch_deleted", "force_push", "pr_opened", "pr_updated", "pr_merged", "pr_closed", "import_completed", "mirror_synced"];
+    GitEvent = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      repoId: RepoId,
+      /** Idempotency key: the same push delivered twice has the same eventId. */
+      eventId: external_exports.string().min(1).max(200),
+      sequence: external_exports.number().int().positive(),
+      kind: external_exports.enum(GIT_EVENT_KINDS),
+      ref: external_exports.string().max(200).nullable(),
+      beforeSha: CommitSha.nullable(),
+      afterSha: CommitSha.nullable(),
+      forced: external_exports.boolean(),
+      actor: PrincipalRef.nullable(),
+      at: Timestamp
+    }).strict();
+    GIT_TOKEN_SCOPES = ["read", "write"];
+    GitToken = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      tokenId: external_exports.string().min(1).max(64),
+      principal: PrincipalRef,
+      scope: external_exports.enum(GIT_TOKEN_SCOPES),
+      tokenDigest: Sha256Digest,
+      createdAt: Timestamp,
+      expiresAt: Timestamp,
+      revokedAt: Timestamp.nullable()
+    }).strict();
+    MintGitTokenRequest = external_exports.object({ scope: external_exports.enum(GIT_TOKEN_SCOPES).default("write"), ttlSeconds: external_exports.number().int().min(60).max(86400).default(3600) }).strict();
+    GitTokenGrant = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      tokenId: external_exports.string(),
+      scope: external_exports.enum(GIT_TOKEN_SCOPES),
+      expiresAt: Timestamp,
+      remote: RemoteUrl,
+      token: external_exports.string().min(20),
+      usage: external_exports.string()
+    }).strict();
+    ImportRepoRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      source: ExternalRepoRef,
+      name: RepoName.optional(),
+      /** `mirror` keeps syncing from the external side, which stays the only writer; `copy` is a one-time import that makes Overlane the origin. */
+      mode: external_exports.enum(["mirror", "copy"]).default("mirror")
+    }).strict();
+    StaleMark = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      /** Commits that a rewritten history made unreachable; evidence recorded for them is stale (REQ-GIT-08). */
+      shas: external_exports.array(CommitSha),
+      ref: external_exports.string(),
+      reason: external_exports.enum(["force_push", "rewritten_history"]),
+      at: Timestamp
+    }).strict();
+    RepoIndexJob = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      jobId: external_exports.string(),
+      /** The event sequence that started the job. An older sequence never replaces a newer snapshot (REQ-MAP-01, REQ-COD-08). */
+      sequence: external_exports.number().int().positive(),
+      sha: CommitSha,
+      shard: external_exports.object({ id: external_exports.string(), prefixes: external_exports.array(external_exports.string()), fileCount: external_exports.number().int().nonnegative() }).strict().nullable(),
+      status: external_exports.enum(["queued", "applied", "ignored_stale", "failed"]),
+      at: Timestamp
+    }).strict();
+    ShardPlan = external_exports.object({
+      tenantId: TenantId,
+      repoId: RepoId,
+      sha: CommitSha,
+      totalFiles: external_exports.number().int().nonnegative(),
+      shards: external_exports.array(external_exports.object({ id: external_exports.string(), prefixes: external_exports.array(external_exports.string()), fileCount: external_exports.number().int().nonnegative() }).strict()),
+      /** Partial checkout: each shard job fetches only its prefixes (REQ-EDGE-10). */
+      partialCheckout: external_exports.boolean()
+    }).strict();
+    NativeRepoCapability = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      available: external_exports.boolean(),
+      defaultOn: external_exports.boolean(),
+      mode: RepoMode,
+      host: external_exports.enum(["artifacts", "fake", "unavailable"]),
+      /** A plain sentence for the person: why it is on, off or pending. */
+      reason: external_exports.string(),
+      importAvailable: external_exports.boolean(),
+      capBytes: external_exports.number().int().positive(),
+      /** How many repositories the project has; a project with none is still complete. */
+      repoCount: external_exports.number().int().nonnegative()
+    }).strict();
+    RepoListResponse = external_exports.object({ tenantId: TenantId, repos: external_exports.array(Repo) }).strict();
+    BranchListResponse = external_exports.object({ tenantId: TenantId, repoId: RepoId, branches: external_exports.array(Branch) }).strict();
+    PullListResponse = external_exports.object({ tenantId: TenantId, repoId: RepoId, pulls: external_exports.array(PullRequest) }).strict();
+    MergeResult = external_exports.object({ tenantId: TenantId, pull: PullRequest, mergeSha: CommitSha, replay: external_exports.boolean() }).strict();
+    DeleteRepoResponse = external_exports.object({ tenantId: TenantId, repoId: RepoId, deleted: external_exports.literal(true) }).strict();
+    MirrorSyncResponse = external_exports.object({ tenantId: TenantId, repo: Repo, applied: external_exports.number().int().nonnegative(), staleShas: external_exports.array(CommitSha), refused: external_exports.string().nullable() }).strict();
+    IndexJobsResponse = external_exports.object({ tenantId: TenantId, repoId: RepoId, jobs: external_exports.array(RepoIndexJob), plan: ShardPlan.nullable() }).strict();
+    PushCheckRequest = external_exports.object({ ref: BranchName, before: CommitSha.nullable(), after: CommitSha.nullable(), forced: external_exports.boolean().default(false), paths: external_exports.array(external_exports.string()).max(2e3).default([]) }).strict();
+    repoBase = (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/repos`;
+    e = encodeURIComponent;
+    gitPaths = {
+      repos: repoBase,
+      capability: (t, p) => `${repoBase(t, p)}/capability`,
+      repo: (t, p, r) => `${repoBase(t, p)}/${e(r)}`,
+      import: (t, p) => `${repoBase(t, p)}/import`,
+      sync: (t, p, r) => `${repoBase(t, p)}/${e(r)}/sync`,
+      branches: (t, p, r) => `${repoBase(t, p)}/${e(r)}/branches`,
+      branch: (t, p, r, b) => `${repoBase(t, p)}/${e(r)}/branches/${e(b)}`,
+      push: (t, p, r) => `${repoBase(t, p)}/${e(r)}/push`,
+      pushCheck: (t, p, r) => `${repoBase(t, p)}/${e(r)}/push-check`,
+      protection: (t, p, r) => `${repoBase(t, p)}/${e(r)}/protection`,
+      tokens: (t, p, r) => `${repoBase(t, p)}/${e(r)}/tokens`,
+      token: (t, p, r, id2) => `${repoBase(t, p)}/${e(r)}/tokens/${e(id2)}`,
+      pulls: (t, p, r) => `${repoBase(t, p)}/${e(r)}/pulls`,
+      pull: (t, p, r, n) => `${repoBase(t, p)}/${e(r)}/pulls/${n}`,
+      reviews: (t, p, r, n) => `${repoBase(t, p)}/${e(r)}/pulls/${n}/reviews`,
+      merge: (t, p, r, n) => `${repoBase(t, p)}/${e(r)}/pulls/${n}/merge`,
+      index: (t, p, r) => `${repoBase(t, p)}/${e(r)}/index`
+    };
+  }
+});
+
+// ../contracts/src/ci.ts
+function stripComment(text) {
+  let quote3 = null;
+  for (let i2 = 0; i2 < text.length; i2 += 1) {
+    const ch = text[i2];
+    if (quote3 !== null) {
+      if (ch === quote3) quote3 = null;
+    } else if (ch === '"' || ch === "'") {
+      if (i2 === 0 || /[\s[,{:]/.test(text[i2 - 1] ?? " ")) quote3 = ch;
+    } else if (ch === "#" && (i2 === 0 || /\s/.test(text[i2 - 1] ?? ""))) {
+      return text.slice(0, i2);
+    }
+  }
+  return text;
+}
+function parseScalar(raw, line2) {
+  const text = raw.trim();
+  if (text === "" || text === "~" || text === "null") return null;
+  if (text === "true") return true;
+  if (text === "false") return false;
+  if (/^-?\d+$/.test(text)) return Number(text);
+  if (text.startsWith('"')) {
+    if (!text.endsWith('"') || text.length < 2) throw new YamlFail(line2, "unterminated double-quoted string");
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new YamlFail(line2, "bad escape in double-quoted string");
+    }
+  }
+  if (text.startsWith("'")) {
+    if (!text.endsWith("'") || text.length < 2) throw new YamlFail(line2, "unterminated single-quoted string");
+    return text.slice(1, -1).replaceAll("''", "'");
+  }
+  if (text === "{}") return {};
+  if (text === "[]") return [];
+  if (text.startsWith("[")) {
+    if (!text.endsWith("]")) throw new YamlFail(line2, "unterminated list; write the list on one line or use '- ' items");
+    const inner = text.slice(1, -1);
+    const items = [];
+    let current2 = "";
+    let quote3 = null;
+    for (const ch of inner) {
+      if (quote3 !== null) {
+        current2 += ch;
+        if (ch === quote3) quote3 = null;
+      } else if (ch === '"' || ch === "'") {
+        quote3 = ch;
+        current2 += ch;
+      } else if (ch === ",") {
+        items.push(parseScalar(current2, line2));
+        current2 = "";
+      } else current2 += ch;
+    }
+    if (current2.trim() !== "" || items.length > 0) items.push(parseScalar(current2, line2));
+    return items;
+  }
+  if (text.startsWith("{")) throw new YamlFail(line2, "flow maps are not supported; use an indented block");
+  if (/^[&*!%@`]/.test(text)) throw new YamlFail(line2, `'${text[0]}' (anchors, aliases and tags) is not supported`);
+  return text;
+}
+function parseYaml(source) {
+  const lines = source.replaceAll("\r\n", "\n").split("\n");
+  const lineMap = /* @__PURE__ */ new Map();
+  let i2 = 0;
+  let pending = null;
+  const keyOf = (path) => JSON.stringify(path);
+  function indentOf(raw, line2) {
+    let n = 0;
+    while (raw[n] === " ") n += 1;
+    if (raw[n] === "	") throw new YamlFail(line2, "tabs are not allowed for indentation; use spaces");
+    return n;
+  }
+  function peek() {
+    if (pending !== null) return pending;
+    while (i2 < lines.length) {
+      const raw = lines[i2] ?? "";
+      const stripped = stripComment(raw);
+      if (stripped.trim() === "") {
+        i2 += 1;
+        continue;
+      }
+      if (/^---\s*$/.test(raw)) {
+        if (i2 === 0) {
+          i2 += 1;
+          continue;
+        }
+        throw new YamlFail(i2 + 1, "multiple documents are not supported");
+      }
+      return { indent: indentOf(raw, i2 + 1), text: stripped.trim(), line: i2 + 1 };
+    }
+    return null;
+  }
+  function advance2() {
+    if (pending !== null) pending = null;
+    i2 += 1;
+  }
+  function blockScalar(parentIndent) {
+    const collected = [];
+    let baseIndent = -1;
+    while (i2 < lines.length) {
+      const raw = lines[i2] ?? "";
+      if (raw.trim() === "") {
+        collected.push("");
+        i2 += 1;
+        continue;
+      }
+      const indent = indentOf(raw, i2 + 1);
+      if (indent <= parentIndent) break;
+      if (baseIndent < 0) baseIndent = indent;
+      collected.push(raw.slice(Math.min(baseIndent, indent)));
+      i2 += 1;
+    }
+    return collected.join("\n").replace(/\n+$/, "");
+  }
+  function parseBlock(indent, path) {
+    const entry = peek();
+    if (entry === null) return null;
+    return entry.text === "-" || entry.text.startsWith("- ") ? parseSeq(indent, path) : parseMap(indent, path);
+  }
+  function parseMap(indent, path) {
+    const out2 = {};
+    for (; ; ) {
+      const entry = peek();
+      if (entry === null || entry.indent < indent) return out2;
+      if (entry.indent > indent) throw new YamlFail(entry.line, "unexpected indentation");
+      if (entry.text === "-" || entry.text.startsWith("- ")) return out2;
+      const match = KEY.exec(entry.text);
+      if (match === null) throw new YamlFail(entry.line, `expected 'key: value', found '${entry.text.slice(0, 60)}'`);
+      let key = match[1] ?? "";
+      if (key.startsWith('"')) key = JSON.parse(key);
+      else if (key.startsWith("'")) key = key.slice(1, -1);
+      if (Object.hasOwn(out2, key)) throw new YamlFail(entry.line, `duplicate key '${key}'`);
+      if (key === "__proto__") throw new YamlFail(entry.line, "key not allowed");
+      const rest = (match[2] ?? "").trim();
+      const childPath = [...path, key];
+      lineMap.set(keyOf(childPath), entry.line);
+      advance2();
+      if (rest === "|" || rest === "|-") {
+        out2[key] = blockScalar(indent);
+      } else if (rest === "") {
+        const next = peek();
+        if (next !== null && (next.indent > indent || next.indent === indent && (next.text === "-" || next.text.startsWith("- ")))) {
+          out2[key] = parseBlock(next.indent, childPath);
+        } else out2[key] = null;
+      } else {
+        out2[key] = parseScalar(rest, entry.line);
+      }
+    }
+  }
+  function parseSeq(indent, path) {
+    const out2 = [];
+    for (; ; ) {
+      const entry = peek();
+      if (entry === null || entry.indent < indent) return out2;
+      if (entry.indent > indent) throw new YamlFail(entry.line, "unexpected indentation");
+      if (!(entry.text === "-" || entry.text.startsWith("- "))) return out2;
+      const childPath = [...path, out2.length];
+      lineMap.set(keyOf(childPath), entry.line);
+      const rest = entry.text.slice(1).trim();
+      const offset = entry.text.length - entry.text.slice(1).trimStart().length;
+      if (rest === "") {
+        advance2();
+        const next = peek();
+        out2.push(next !== null && next.indent > indent ? parseBlock(next.indent, childPath) : null);
+      } else if (KEY.test(rest) && !rest.startsWith('"') && !rest.startsWith("'") && !rest.startsWith("[")) {
+        pending = { indent: indent + offset, text: rest, line: entry.line };
+        out2.push(parseMap(indent + offset, childPath));
+      } else {
+        advance2();
+        out2.push(parseScalar(rest, entry.line));
+      }
+    }
+  }
+  const first = peek();
+  if (first === null) throw new YamlFail(1, "the file is empty");
+  if (first.indent !== 0) throw new YamlFail(first.line, "the file must start at column 1");
+  const value = parseBlock(0, []);
+  const trailing = peek();
+  if (trailing !== null) throw new YamlFail(trailing.line, "unexpected content after the document");
+  return {
+    value,
+    lineOf(path) {
+      for (let n = path.length; n >= 0; n -= 1) {
+        const line2 = n === 0 ? 1 : lineMap.get(keyOf(path.slice(0, n)));
+        if (line2 !== void 0) return line2;
+      }
+      return 1;
+    }
+  };
+}
+function mapKeys(value, canon, orig, paths) {
+  paths.set(JSON.stringify(canon), orig);
+  if (Array.isArray(value)) return value.map((item, index) => mapKeys(item, [...canon, index], [...orig, index], paths));
+  if (typeof value === "object" && value !== null) {
+    const out2 = {};
+    for (const [key, child] of Object.entries(value)) {
+      const isData = canon.length === 1 && canon[0] === "jobs" || canon[canon.length - 1] === "env";
+      const renamed = isData ? key : KEY_ALIASES[key] ?? key;
+      out2[renamed] = mapKeys(child, [...canon, renamed], [...orig, key], paths);
+    }
+    return out2;
+  }
+  return value;
+}
+function parsePipelineConfig(text) {
+  let located;
+  try {
+    located = parseYaml(text);
+  } catch (error62) {
+    if (error62 instanceof YamlFail) return { ok: false, issues: [{ line: error62.line, message: error62.message }] };
+    throw error62;
+  }
+  const paths = /* @__PURE__ */ new Map();
+  const value = mapKeys(located.value, [], [], paths);
+  const result = PipelineConfig.safeParse(value);
+  const lineFor = (path) => {
+    const segments = path.map((segment) => typeof segment === "symbol" ? String(segment) : segment);
+    for (let n = segments.length; n >= 0; n -= 1) {
+      const original = paths.get(JSON.stringify(segments.slice(0, n)));
+      if (original !== void 0) return located.lineOf(original);
+    }
+    return 1;
+  };
+  const issues = [];
+  if (!result.success) {
+    for (const issue2 of result.error.issues) {
+      const path = [...issue2.path];
+      if (issue2.code === "unrecognized_keys") {
+        for (const key of issue2.keys) issues.push({ line: lineFor([...path, key]), message: `unknown key '${key}'` });
+        continue;
+      }
+      const where = path.length === 0 ? "" : `${path.map(String).join(".")}: `;
+      issues.push({ line: lineFor(path), message: `${where}${issue2.message}` });
+    }
+    return { ok: false, issues: dedupeIssues(issues) };
+  }
+  const config2 = result.data;
+  for (const [name2, job] of Object.entries(config2.jobs)) {
+    job.needs.forEach((need, index) => {
+      if (config2.jobs[need] === void 0) issues.push({ line: lineFor(["jobs", name2, "needs", index]), message: `job '${name2}' needs '${need}', which is not defined` });
+      if (need === name2) issues.push({ line: lineFor(["jobs", name2, "needs", index]), message: `job '${name2}' needs itself` });
+    });
+    job.cache?.keyFiles.forEach((file2, index) => {
+      if (file2.startsWith("/") || file2.includes("..")) issues.push({ line: lineFor(["jobs", name2, "cache", "keyFiles", index]), message: "a cache key file is a path inside the repository" });
+    });
+    if (job.affectedTests && !job.steps.some((step2) => step2.test && step2.run.includes("{affected}"))) {
+      issues.push({ line: lineFor(["jobs", name2, "affectedTests"]), message: "affectedTests needs a test step whose run contains {affected}" });
+    }
+  }
+  const cycle = findCycle(config2);
+  if (cycle !== null) issues.push({ line: lineFor(["jobs", cycle]), message: `job '${cycle}' is part of a needs cycle` });
+  config2.on.schedule?.forEach((cron, index) => {
+    if (!cron.split(/\s+/).every((field2) => CRON_FIELD.test(field2))) issues.push({ line: lineFor(["on", "schedule", index]), message: "not a valid cron expression" });
+  });
+  return issues.length > 0 ? { ok: false, issues: dedupeIssues(issues) } : { ok: true, config: config2 };
+}
+function dedupeIssues(issues) {
+  const seen = /* @__PURE__ */ new Set();
+  return issues.filter((issue2) => {
+    const key = `${issue2.line}:${issue2.message}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function findCycle(config2) {
+  const state = /* @__PURE__ */ new Map();
+  const visit2 = (name2) => {
+    if (state.get(name2) === 2) return null;
+    if (state.get(name2) === 1) return name2;
+    state.set(name2, 1);
+    for (const need of config2.jobs[name2]?.needs ?? []) {
+      if (config2.jobs[need] === void 0) continue;
+      const found = visit2(need);
+      if (found !== null) return found;
+    }
+    state.set(name2, 2);
+    return null;
+  };
+  for (const name2 of Object.keys(config2.jobs)) {
+    const found = visit2(name2);
+    if (found !== null) return found;
+  }
+  return null;
+}
+function formatConfigIssues(path, issues) {
+  return issues.map((issue2) => `${path}:${issue2.line}: ${issue2.message}`);
+}
+var PIPELINE_CONFIG_PATH, MAX_JOB_TIMEOUT_MINUTES, RUNNER_INSTANCES, SecretName, Host, Glob, PipelineStep, PipelineJob, PipelineConfig, YamlFail, KEY, KEY_ALIASES, CRON_FIELD, RunnerRoute, RUN_STATUSES, RunStatus, TRIGGERS, StepRun, JobRun, PipelineRun, FlakyRecord, ArtifactDigest, CiSettings, UpdateCiSettingsRequest, CiSecretMeta, SetCiSecretRequest, StartCiRunRequest, RunResponse, RunListResponse, RunLogResponse, CiUsageResponse, CiSecretListResponse, ValidateConfigRequest, ValidateConfigResponse, ciBase, ciPaths;
+var init_ci = __esm({
+  "../contracts/src/ci.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    PIPELINE_CONFIG_PATH = ".overlane/ci.yml";
+    MAX_JOB_TIMEOUT_MINUTES = 360;
+    RUNNER_INSTANCES = ["standard-3", "standard-4"];
+    SecretName = external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/, "a secret name is UPPER_SNAKE_CASE");
+    Host = external_exports.string().regex(/^(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/, "a hostname such as registry.npmjs.org (no scheme, no path)");
+    Glob = external_exports.string().min(1).max(200);
+    PipelineStep = external_exports.object({
+      name: external_exports.string().min(1).max(100).optional(),
+      run: external_exports.string().min(1).max(1e4),
+      /** A test step: a failure is re-run once, and pass-after-rerun is recorded as flaky (REQ-CI-06). */
+      test: external_exports.boolean().default(false),
+      /** An artifact this step produces (path); its digest is recorded at build and verified at deploy (REQ-SEC-15). */
+      artifact: external_exports.string().min(1).max(300).optional()
+    }).strict();
+    PipelineJob = external_exports.object({
+      runsOn: external_exports.enum(["standard", "large"]).default("standard"),
+      timeoutMinutes: external_exports.number().int().min(1).max(MAX_JOB_TIMEOUT_MINUTES).default(15),
+      needs: external_exports.array(external_exports.string().min(1).max(64)).max(20).default([]),
+      cache: external_exports.object({ keyFiles: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(10), paths: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20) }).strict().optional(),
+      /** Secret names; values live in the platform and are handed to the job through the broker (REQ-CI-04). */
+      secrets: external_exports.array(SecretName).max(50).default([]),
+      env: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), external_exports.string().max(2e3)).default({}),
+      /** Run the job only when a changed file matches (CI waste control, ADR 0052). */
+      paths: external_exports.array(Glob).max(50).optional(),
+      /** Replace `{affected}` in test steps with the tests the change can affect (ADR 0052). */
+      affectedTests: external_exports.boolean().default(false),
+      steps: external_exports.array(PipelineStep).min(1).max(100)
+    }).strict();
+    PipelineConfig = external_exports.object({
+      version: external_exports.literal(1),
+      name: external_exports.string().min(1).max(100).optional(),
+      on: external_exports.object({
+        push: external_exports.object({ branches: external_exports.array(Glob).max(50).optional() }).strict().nullable().optional(),
+        pullRequest: external_exports.object({ branches: external_exports.array(Glob).max(50).optional() }).strict().nullable().optional(),
+        schedule: external_exports.array(external_exports.string().regex(/^\S+(?:\s+\S+){4}$/, "a cron expression has five fields")).max(10).optional()
+      }).strict().default({ push: {} }),
+      /** `cancel-superseded` (default) stops older runs on the same ref when a newer commit arrives (ADR 0052). */
+      concurrency: external_exports.enum(["cancel-superseded", "queue"]).default("cancel-superseded"),
+      /** Hosts a job may reach; narrowed further by guardrail egress rules (REQ-CI-09, ADR 0052). */
+      egress: external_exports.array(Host).max(50).default([]),
+      jobs: external_exports.record(external_exports.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/), PipelineJob).refine((jobs) => Object.keys(jobs).length >= 1 && Object.keys(jobs).length <= 50, "between 1 and 50 jobs")
+    }).strict();
+    YamlFail = class extends Error {
+      constructor(line2, message) {
+        super(message);
+        this.line = line2;
+      }
+      line;
+    };
+    KEY = /^("(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_.*/-]+)\s*:(?:\s+(.*))?$/;
+    KEY_ALIASES = { "runs-on": "runsOn", "timeout-minutes": "timeoutMinutes", "key-files": "keyFiles", "pull_request": "pullRequest", "affected-tests": "affectedTests" };
+    CRON_FIELD = /^[\d*/,-]+$/;
+    RunnerRoute = external_exports.object({ target: external_exports.literal("containers"), instance: external_exports.enum(RUNNER_INSTANCES), reason: external_exports.string().max(300) }).strict();
+    RUN_STATUSES = ["queued", "running", "passed", "failed", "cancelled", "held"];
+    RunStatus = external_exports.enum(RUN_STATUSES);
+    TRIGGERS = ["push", "pull_request", "schedule", "manual"];
+    StepRun = external_exports.object({
+      name: external_exports.string(),
+      exitCode: external_exports.number().int(),
+      durationMs: external_exports.number().int().nonnegative(),
+      /** 1, or 2 when this is the one re-run of a failed test step. */
+      attempt: external_exports.number().int().min(1).max(2),
+      skipped: external_exports.boolean().default(false)
+    }).strict();
+    JobRun = external_exports.object({
+      tenantId: TenantId,
+      jobId: external_exports.string(),
+      name: external_exports.string(),
+      status: RunStatus,
+      route: RunnerRoute,
+      steps: external_exports.array(StepRun),
+      cache: external_exports.object({ key: external_exports.string().nullable(), hit: external_exports.boolean() }).strict(),
+      /** Set when a test failed and passed on its one re-run (REQ-CI-06). */
+      flaky: external_exports.boolean(),
+      logUri: external_exports.string().nullable(),
+      logDigest: Sha256Digest.nullable(),
+      durationMs: external_exports.number().int().nonnegative(),
+      billedMinutes: external_exports.number().int().nonnegative(),
+      costMicros: external_exports.number().int().nonnegative(),
+      startedAt: Timestamp.nullable(),
+      finishedAt: Timestamp.nullable()
+    }).strict();
+    PipelineRun = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      runId: external_exports.string().min(1).max(64),
+      provider: Provider,
+      repoId: external_exports.string().nullable(),
+      repository: external_exports.string().nullable(),
+      commitSha: CommitSha,
+      ref: external_exports.string().max(200),
+      trigger: external_exports.enum(TRIGGERS),
+      pullNumber: external_exports.number().int().positive().nullable(),
+      /** A fork pull request runs with an empty secret environment (REQ-CI-04, REQ-EDGE-13). */
+      fork: external_exports.boolean(),
+      status: RunStatus,
+      /** Why a run did not start or stopped early: `superseded`, `cost_gate`, `config`, `cap`. */
+      reason: external_exports.string().max(300).nullable(),
+      supersededBy: external_exports.string().nullable(),
+      configDigest: Sha256Digest,
+      jobs: external_exports.array(JobRun),
+      totalMinutes: external_exports.number().int().nonnegative(),
+      totalCostMicros: external_exports.number().int().nonnegative(),
+      createdAt: Timestamp,
+      finishedAt: Timestamp.nullable()
+    }).strict();
+    FlakyRecord = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      /** The test step's name. */
+      test: external_exports.string(),
+      runId: external_exports.string(),
+      commitSha: CommitSha,
+      at: Timestamp
+    }).strict();
+    ArtifactDigest = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      runId: external_exports.string(),
+      jobId: external_exports.string(),
+      name: external_exports.string().max(300),
+      digest: Sha256Digest,
+      sizeBytes: external_exports.number().int().nonnegative(),
+      commitSha: CommitSha,
+      uri: external_exports.string().max(500),
+      recordedAt: Timestamp
+    }).strict();
+    CiSettings = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      /** CI minutes one pull request may spend before further runs are held for a decision (ADR 0052 cost gate). */
+      maxMinutesPerPull: external_exports.number().int().min(1).max(1e4),
+      maxConcurrentRuns: external_exports.number().int().min(1).max(50),
+      /** Cancel older runs on the same ref when a newer commit arrives. */
+      cancelSuperseded: external_exports.boolean(),
+      updatedAt: Timestamp.nullable()
+    }).strict();
+    UpdateCiSettingsRequest = external_exports.object({ maxMinutesPerPull: external_exports.number().int().min(1).max(1e4).optional(), maxConcurrentRuns: external_exports.number().int().min(1).max(50).optional(), cancelSuperseded: external_exports.boolean().optional() }).strict();
+    CiSecretMeta = external_exports.object({ tenantId: TenantId, projectId: ProjectId, name: external_exports.string(), updatedAt: Timestamp }).strict();
+    SetCiSecretRequest = external_exports.object({ name: external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/), value: external_exports.string().min(8).max(1e4) }).strict();
+    StartCiRunRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      repoId: external_exports.string().optional(),
+      ref: external_exports.string().min(1).max(200),
+      commitSha: CommitSha,
+      trigger: external_exports.enum(TRIGGERS).default("manual"),
+      pullNumber: external_exports.number().int().positive().optional(),
+      /** Pipeline file text for a repository the engine cannot read (GitHub projects through the App supply it). */
+      config: external_exports.string().max(1e5).optional()
+    }).strict();
+    RunResponse = external_exports.object({ tenantId: TenantId, run: PipelineRun, replay: external_exports.boolean(), cancelled: external_exports.array(external_exports.string()) }).strict();
+    RunListResponse = external_exports.object({ tenantId: TenantId, runs: external_exports.array(PipelineRun) }).strict();
+    RunLogResponse = external_exports.object({ tenantId: TenantId, runId: external_exports.string(), jobs: external_exports.array(external_exports.object({ name: external_exports.string(), log: external_exports.string() }).strict()) }).strict();
+    CiUsageResponse = external_exports.object({ tenantId: TenantId, month: external_exports.string(), minutes: external_exports.number().int().nonnegative(), costMicros: external_exports.number().int().nonnegative(), runs: external_exports.number().int().nonnegative(), flaky: external_exports.array(external_exports.object({ test: external_exports.string(), count: external_exports.number().int() }).strict()) }).strict();
+    CiSecretListResponse = external_exports.object({ tenantId: TenantId, secrets: external_exports.array(CiSecretMeta) }).strict();
+    ValidateConfigRequest = external_exports.object({ config: external_exports.string().min(1).max(1e5) }).strict();
+    ValidateConfigResponse = external_exports.object({ tenantId: TenantId, ok: external_exports.boolean(), issues: external_exports.array(external_exports.object({ line: external_exports.number().int().positive(), message: external_exports.string() }).strict()), jobs: external_exports.array(external_exports.string()) }).strict();
+    ciBase = (t, p) => `/v1/tenants/${encodeURIComponent(t)}/projects/${encodeURIComponent(p)}/ci`;
+    ciPaths = {
+      runs: (t, p) => `${ciBase(t, p)}/runs`,
+      run: (t, p, id2) => `${ciBase(t, p)}/runs/${encodeURIComponent(id2)}`,
+      cancel: (t, p, id2) => `${ciBase(t, p)}/runs/${encodeURIComponent(id2)}/cancel`,
+      logs: (t, p, id2) => `${ciBase(t, p)}/runs/${encodeURIComponent(id2)}/logs`,
+      rerun: (t, p, id2) => `${ciBase(t, p)}/runs/${encodeURIComponent(id2)}/rerun`,
+      validate: (t, p) => `${ciBase(t, p)}/validate`,
+      settings: (t, p) => `${ciBase(t, p)}/settings`,
+      secrets: (t, p) => `${ciBase(t, p)}/secrets`,
+      secret: (t, p, name2) => `${ciBase(t, p)}/secrets/${encodeURIComponent(name2)}`,
+      usage: (t, p) => `${ciBase(t, p)}/usage`
+    };
+  }
+});
+
+// ../contracts/src/deploy.ts
+var DEPLOY_KINDS, DeployKind, Ref, DeployTargetConfig, DeployTarget, CreateTargetRequest, Environment, CreateEnvironmentRequest, SetEnvironmentSecretRequest, RELEASE_STATUSES, DeployRelease, RollbackRecord, DeployRequest, PreviewRequest, RollbackRequest, DeployResponse, RollbackResponse, ReleaseListResponse, TargetListResponse, EnvironmentResponse, TargetResponse, depBase, enc, deployPaths;
+var init_deploy = __esm({
+  "../contracts/src/deploy.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_git();
+    DEPLOY_KINDS = ["workers", "vercel", "netlify", "fly"];
+    DeployKind = external_exports.enum(DEPLOY_KINDS);
+    Ref = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/);
+    DeployTargetConfig = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("workers"), scriptName: Ref, accountId: Ref }).strict(),
+      external_exports.object({ kind: external_exports.literal("vercel"), projectRef: Ref, teamId: Ref.optional() }).strict(),
+      external_exports.object({ kind: external_exports.literal("netlify"), siteId: Ref }).strict(),
+      external_exports.object({ kind: external_exports.literal("fly"), app: Ref, machineId: Ref.optional() }).strict()
+    ]);
+    DeployTarget = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      targetId: external_exports.string().min(1).max(64),
+      name: external_exports.string().regex(/^[a-z][a-z0-9-]{0,40}$/),
+      config: DeployTargetConfig,
+      /** Name of the secret in the connector vault. */
+      vaultRef: external_exports.string().max(128).nullable(),
+      createdAt: Timestamp
+    }).strict();
+    CreateTargetRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      name: external_exports.string().regex(/^[a-z][a-z0-9-]{0,40}$/),
+      config: DeployTargetConfig,
+      /** The provider token (for Workers, a token for the customer account). It goes to the vault and is never stored in a record or echoed (REQ-DEP-08). */
+      credential: external_exports.string().min(8).max(4e3)
+    }).strict();
+    Environment = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      name: external_exports.string().regex(/^[a-z][a-z0-9-]{0,40}$/),
+      targetId: external_exports.string(),
+      /** A protected environment needs the approval its guardrail rule demands; production is protected by the platform rule. */
+      protected: external_exports.boolean(),
+      /** Preview environments are made per branch and deleted with it. */
+      kind: external_exports.enum(["permanent", "preview"]),
+      branch: external_exports.string().nullable(),
+      secretNames: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/)).max(100),
+      createdAt: Timestamp
+    }).strict();
+    CreateEnvironmentRequest = external_exports.object({
+      name: external_exports.string().regex(/^[a-z][a-z0-9-]{0,40}$/),
+      targetId: external_exports.string(),
+      protected: external_exports.boolean().optional(),
+      secretNames: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/)).max(100).default([])
+    }).strict();
+    SetEnvironmentSecretRequest = external_exports.object({ name: external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/), value: external_exports.string().min(8).max(1e4) }).strict();
+    RELEASE_STATUSES = ["pending", "succeeded", "failed", "superseded", "rolled_back"];
+    DeployRelease = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      releaseId: external_exports.string().min(1).max(64),
+      environment: external_exports.string(),
+      targetId: external_exports.string(),
+      commitSha: CommitSha,
+      /** The artifact built by CI, verified at deploy (REQ-SEC-15). */
+      artifactDigest: Sha256Digest,
+      runId: external_exports.string().nullable(),
+      /** Evidence IDs and CI run that back this deploy (REQ-DEP-06). */
+      evidenceIds: external_exports.array(external_exports.string()).max(100),
+      actor: PrincipalRef,
+      status: external_exports.enum(RELEASE_STATUSES),
+      /** The release this environment served before this one; rollback restores it. */
+      previousReleaseId: external_exports.string().nullable(),
+      live: external_exports.boolean(),
+      providerDeploymentId: external_exports.string().nullable(),
+      url: external_exports.string().max(500).nullable(),
+      error: external_exports.string().max(500).nullable(),
+      approvalId: external_exports.string().nullable(),
+      createdAt: Timestamp,
+      finishedAt: Timestamp.nullable()
+    }).strict();
+    RollbackRecord = external_exports.object({
+      schemaVersion: SchemaVersion,
+      tenantId: TenantId,
+      projectId: ProjectId,
+      rollbackId: external_exports.string(),
+      environment: external_exports.string(),
+      fromReleaseId: external_exports.string(),
+      toReleaseId: external_exports.string(),
+      actor: PrincipalRef,
+      reason: external_exports.string().max(500),
+      at: Timestamp
+    }).strict();
+    DeployRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      environment: external_exports.string().regex(/^[a-z][a-z0-9-]{0,40}$/),
+      commitSha: CommitSha,
+      /** The CI run whose artifact is deployed. */
+      runId: external_exports.string().min(1).max(64),
+      artifact: external_exports.string().min(1).max(300).optional(),
+      /** Digest the caller expects. A different stored digest refuses the deploy. */
+      expectedDigest: Sha256Digest.optional()
+    }).strict();
+    PreviewRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), branch: external_exports.string().min(1).max(200), targetId: external_exports.string(), commitSha: CommitSha, runId: external_exports.string().min(1).max(64), artifact: external_exports.string().max(300).optional() }).strict();
+    RollbackRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), reason: external_exports.string().min(1).max(500), toReleaseId: external_exports.string().optional() }).strict();
+    DeployResponse = external_exports.object({
+      tenantId: TenantId,
+      release: DeployRelease.nullable(),
+      approval: external_exports.object({ id: external_exports.string(), summary: external_exports.string(), nextCommand: external_exports.string() }).strict().nullable(),
+      replay: external_exports.boolean()
+    }).strict();
+    RollbackResponse = external_exports.object({ tenantId: TenantId, rollback: RollbackRecord, restored: DeployRelease, replay: external_exports.boolean() }).strict();
+    ReleaseListResponse = external_exports.object({ tenantId: TenantId, environment: external_exports.string().nullable(), releases: external_exports.array(DeployRelease) }).strict();
+    TargetListResponse = external_exports.object({ tenantId: TenantId, targets: external_exports.array(DeployTarget), environments: external_exports.array(Environment) }).strict();
+    EnvironmentResponse = external_exports.object({ tenantId: TenantId, environment: Environment }).strict();
+    TargetResponse = external_exports.object({ tenantId: TenantId, target: DeployTarget }).strict();
+    depBase = (t, p) => `/v1/tenants/${encodeURIComponent(t)}/projects/${encodeURIComponent(p)}/deploy`;
+    enc = encodeURIComponent;
+    deployPaths = {
+      targets: (t, p) => `${depBase(t, p)}/targets`,
+      environments: (t, p) => `${depBase(t, p)}/environments`,
+      deploys: (t, p) => `${depBase(t, p)}/releases`,
+      releases: (t, p, env) => `${depBase(t, p)}/releases${env === void 0 ? "" : `?environment=${enc(env)}`}`,
+      previews: (t, p) => `${depBase(t, p)}/previews`,
+      rollback: (t, p, env) => `${depBase(t, p)}/environments/${enc(env)}/rollback`,
+      secrets: (t, p, env) => `${depBase(t, p)}/environments/${enc(env)}/secrets`
+    };
+  }
+});
+
 // ../contracts/src/decision.ts
 var DECISION_MODELS, DecisionModel, MAX_QUESTIONS, MAX_IMAGES, QuestionId, Text, NoulQuestion, ChoiceQuestion, ScoreQuestion, ClefQuestion, ClefQuestions, JsonValue, Base64Image, ClefRequest, Probability, NoulAnswer, ChoiceAnswer, ScoreAnswer, ClefAnswer, ClefResponse, DECISION_USES, DecisionUse, DECISION_OUTCOMES, DecisionOutcome, FALLBACK_REASONS, FallbackReason, DecisionRecord;
 var init_decision = __esm({
@@ -24147,6 +25022,9 @@ var init_src = __esm({
     init_agent();
     init_plans();
     init_billing();
+    init_git();
+    init_ci();
+    init_deploy();
     init_decision();
   }
 });
@@ -24662,19 +25540,19 @@ var require_toJS = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/toJS.js"(exports) {
     "use strict";
     var identity = require_identity();
-    function toJS(value, arg, ctx) {
+    function toJS(value, arg4, ctx) {
       if (Array.isArray(value))
         return value.map((v, i2) => toJS(v, String(i2), ctx));
       if (value && typeof value.toJSON === "function") {
         if (!ctx || !identity.hasAnchor(value))
-          return value.toJSON(arg, ctx);
+          return value.toJSON(arg4, ctx);
         const data = { aliasCount: 0, count: 1, res: void 0 };
         ctx.anchors.set(value, data);
         ctx.onCreate = (res2) => {
           data.res = res2;
           delete ctx.onCreate;
         };
-        const res = value.toJSON(arg, ctx);
+        const res = value.toJSON(arg4, ctx);
         if (ctx.onCreate)
           ctx.onCreate(res);
         return res;
@@ -24859,8 +25737,8 @@ var require_Scalar = __commonJS({
         super(identity.SCALAR);
         this.value = value;
       }
-      toJSON(arg, ctx) {
-        return ctx?.keep ? this.value : toJS.toJS(this.value, arg, ctx);
+      toJSON(arg4, ctx) {
+        return ctx?.keep ? this.value : toJS.toJS(this.value, arg4, ctx);
       }
       toString() {
         return String(this.value);
@@ -31482,12 +32360,12 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename5, join as join24, resolve as resolve11 } from "node:path";
+import { basename as basename5, join as join24, resolve as resolve13 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
   if (override !== void 0 && override !== "") return override;
-  return resolve11(fileURLToPath(new URL(".", import.meta.url)), "..");
+  return resolve13(fileURLToPath(new URL(".", import.meta.url)), "..");
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
@@ -31500,7 +32378,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.130" : "0.0.0-dev";
+    VERSION = true ? "0.1.132" : "0.0.0-dev";
   }
 });
 
@@ -31511,15 +32389,15 @@ var init_types = __esm({
 });
 
 // ../../node_modules/.pnpm/@bufbuild+protobuf@2.16.0/node_modules/@bufbuild/protobuf/dist/esm/is-message.js
-function isMessage(arg, schema) {
-  const isMessage2 = arg !== null && typeof arg == "object" && "$typeName" in arg && typeof arg.$typeName == "string";
+function isMessage(arg4, schema) {
+  const isMessage2 = arg4 !== null && typeof arg4 == "object" && "$typeName" in arg4 && typeof arg4.$typeName == "string";
   if (!isMessage2) {
     return false;
   }
   if (schema === void 0) {
     return true;
   }
-  return schema.typeName === arg.$typeName;
+  return schema.typeName === arg4.$typeName;
 }
 var init_is_message = __esm({
   "../../node_modules/.pnpm/@bufbuild+protobuf@2.16.0/node_modules/@bufbuild/protobuf/dist/esm/is-message.js"() {
@@ -31883,8 +32761,8 @@ var init_unsafe = __esm({
 });
 
 // ../../node_modules/.pnpm/@bufbuild+protobuf@2.16.0/node_modules/@bufbuild/protobuf/dist/esm/reflect/guard.js
-function isObject2(arg) {
-  return arg !== null && typeof arg == "object" && !Array.isArray(arg);
+function isObject2(arg4) {
+  return arg4 !== null && typeof arg4 == "object" && !Array.isArray(arg4);
 }
 var init_guard = __esm({
   "../../node_modules/.pnpm/@bufbuild+protobuf@2.16.0/node_modules/@bufbuild/protobuf/dist/esm/reflect/guard.js"() {
@@ -32495,8 +33373,8 @@ function wktValueToReflect(json2) {
           values: []
         };
         if (Array.isArray(json2)) {
-          for (const e of json2) {
-            listValue.values.push(wktValueToReflect(e));
+          for (const e2 of json2) {
+            listValue.values.push(wktValueToReflect(e2));
           }
         }
         value.kind = {
@@ -32918,7 +33796,7 @@ function createFileRegistry(...args2) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve14(protoFileName);
+        const dep = resolve16(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file2.name}`);
         }
@@ -32932,7 +33810,7 @@ function createFileRegistry(...args2) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input2 = args2[0];
-    const resolve14 = args2[1];
+    const resolve16 = args2[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file2 of [input2, ...recurseDeps(input2)].reverse()) {
       addFile(file2, registry2);
@@ -33727,7 +34605,7 @@ function bootDescriptorProto(init2) {
     extension: [],
     nestedType: (_d = (_c = init2.nestedType) === null || _c === void 0 ? void 0 : _c.map(bootDescriptorProto)) !== null && _d !== void 0 ? _d : [],
     enumType: (_f = (_e = init2.enumType) === null || _e === void 0 ? void 0 : _e.map(bootEnumDescriptorProto)) !== null && _f !== void 0 ? _f : [],
-    extensionRange: (_h = (_g = init2.extensionRange) === null || _g === void 0 ? void 0 : _g.map((e) => Object.assign({ $typeName: "google.protobuf.DescriptorProto.ExtensionRange" }, e))) !== null && _h !== void 0 ? _h : [],
+    extensionRange: (_h = (_g = init2.extensionRange) === null || _g === void 0 ? void 0 : _g.map((e2) => Object.assign({ $typeName: "google.protobuf.DescriptorProto.ExtensionRange" }, e2))) !== null && _h !== void 0 ? _h : [],
     oneofDecl: [],
     reservedRange: [],
     reservedName: []
@@ -33758,7 +34636,7 @@ function bootFieldOptions(init2) {
     debugRedact: false,
     retention: 0
   });
-  return Object.assign(proto, Object.assign(Object.assign({ $typeName: "google.protobuf.FieldOptions" }, init2), { targets: (_a3 = init2.targets) !== null && _a3 !== void 0 ? _a3 : [], editionDefaults: (_c = (_b = init2.editionDefaults) === null || _b === void 0 ? void 0 : _b.map((e) => Object.assign({ $typeName: "google.protobuf.FieldOptions.EditionDefault" }, e))) !== null && _c !== void 0 ? _c : [], uninterpretedOption: [] }));
+  return Object.assign(proto, Object.assign(Object.assign({ $typeName: "google.protobuf.FieldOptions" }, init2), { targets: (_a3 = init2.targets) !== null && _a3 !== void 0 ? _a3 : [], editionDefaults: (_c = (_b = init2.editionDefaults) === null || _b === void 0 ? void 0 : _b.map((e2) => Object.assign({ $typeName: "google.protobuf.FieldOptions.EditionDefault" }, e2))) !== null && _c !== void 0 ? _c : [], uninterpretedOption: [] }));
 }
 function bootEnumDescriptorProto(init2) {
   const proto = /* @__PURE__ */ Object.create({
@@ -33769,7 +34647,7 @@ function bootEnumDescriptorProto(init2) {
     name: init2.name,
     reservedName: [],
     reservedRange: [],
-    value: init2.value.map((e) => Object.assign({ $typeName: "google.protobuf.EnumValueDescriptorProto" }, e))
+    value: init2.value.map((e2) => Object.assign({ $typeName: "google.protobuf.EnumValueDescriptorProto" }, e2))
   });
 }
 var init_boot = __esm({
@@ -35142,8 +36020,8 @@ function setModule(module2) {
 function newFinalizer(handler) {
   try {
     return new FinalizationRegistry(handler);
-  } catch (e) {
-    console.error("Unsupported FinalizationRegistry:", e);
+  } catch (e2) {
+    console.error("Unsupported FinalizationRegistry:", e2);
     return;
   }
 }
@@ -35345,13 +36223,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve14, reject) => {
+          return new Promise((resolve16, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve14(xhr.response);
+                resolve16(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -35455,9 +36333,9 @@ async function Module2(moduleArg = {}) {
     err(what);
     ABORT = true;
     what += ". Build with -sASSERTIONS for more info.";
-    var e = new WebAssembly.RuntimeError(what);
-    readyPromiseReject?.(e);
-    throw e;
+    var e2 = new WebAssembly.RuntimeError(what);
+    readyPromiseReject?.(e2);
+    throw e2;
   }
   __name(abort, "abort");
   var wasmBinaryFile;
@@ -35547,9 +36425,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve16, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve14(receiveInstance(mod, inst));
+          resolve16(receiveInstance(mod, inst));
         });
       });
     }
@@ -35963,15 +36841,15 @@ async function Module2(moduleArg = {}) {
   }, "updateGOT");
   var relocateExports = /* @__PURE__ */ __name((exports, memoryBase22, replace) => {
     var relocated = {};
-    for (var e in exports) {
-      var value = exports[e];
+    for (var e2 in exports) {
+      var value = exports[e2];
       if (typeof value == "object") {
         value = value.value;
       }
       if (typeof value == "number") {
         value += memoryBase22;
       }
-      relocated[e] = value;
+      relocated[e2] = value;
     }
     updateGOT(relocated, replace);
     return relocated;
@@ -35998,9 +36876,9 @@ async function Module2(moduleArg = {}) {
     var sp = stackSave();
     try {
       return dynCall(sig, ptr, args2);
-    } catch (e) {
+    } catch (e2) {
       stackRestore(sp);
-      if (e !== e + 0) throw e;
+      if (e2 !== e2 + 0) throw e2;
       _setThrew(1, 0);
       if (sig[0] == "j") return 0n;
     }
@@ -36385,7 +37263,7 @@ async function Module2(moduleArg = {}) {
       wasmMemory.grow(pages);
       updateMemoryViews();
       return 1;
-    } catch (e) {
+    } catch (e2) {
     }
   }, "growMemory");
   var _emscripten_resize_heap = /* @__PURE__ */ __name((requestedSize) => {
@@ -36498,11 +37376,11 @@ async function Module2(moduleArg = {}) {
     EXITSTATUS = status;
     _proc_exit(status);
   }, "exitJS");
-  var handleException = /* @__PURE__ */ __name((e) => {
-    if (e instanceof ExitStatus || e == "unwind") {
+  var handleException = /* @__PURE__ */ __name((e2) => {
+    if (e2 instanceof ExitStatus || e2 == "unwind") {
       return EXITSTATUS;
     }
-    quit_(1, e);
+    quit_(1, e2);
   }, "handleException");
   var lengthBytesUTF8 = /* @__PURE__ */ __name((str) => {
     var len = 0;
@@ -36825,8 +37703,8 @@ async function Module2(moduleArg = {}) {
     var argc = args2.length;
     var argv = stackAlloc((argc + 1) * 4);
     var argv_ptr = argv;
-    args2.forEach((arg) => {
-      LE_HEAP_STORE_U32((argv_ptr >> 2) * 4, stringToUTF8OnStack(arg));
+    args2.forEach((arg4) => {
+      LE_HEAP_STORE_U32((argv_ptr >> 2) * 4, stringToUTF8OnStack(arg4));
       argv_ptr += 4;
     });
     LE_HEAP_STORE_U32((argv_ptr >> 2) * 4, 0);
@@ -36838,8 +37716,8 @@ async function Module2(moduleArg = {}) {
         true
       );
       return ret;
-    } catch (e) {
-      return handleException(e);
+    } catch (e2) {
+      return handleException(e2);
     }
   }
   __name(callMain, "callMain");
@@ -36882,8 +37760,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve14, reject) => {
-      readyPromiseResolve = resolve14;
+    moduleRtn = new Promise((resolve16, reject) => {
+      readyPromiseResolve = resolve16;
       readyPromiseReject = reject;
     });
   }
@@ -36918,8 +37796,8 @@ function parseAnyPredicate(steps, index, operator, textPredicates) {
         if (c.name === captureName1) nodes1.push(c.node);
         if (c.name === captureName2) nodes2.push(c.node);
       }
-      const compare = /* @__PURE__ */ __name((n1, n2, positive) => {
-        return positive ? n1.text === n2.text : n1.text !== n2.text;
+      const compare = /* @__PURE__ */ __name((n1, n2, positive2) => {
+        return positive2 ? n1.text === n2.text : n1.text !== n2.text;
       }, "compare");
       return matchAll ? nodes1.every((n1) => nodes2.some((n2) => compare(n1, n2, isPositive))) : nodes1.some((n1) => nodes2.some((n2) => compare(n1, n2, isPositive)));
     });
@@ -36963,8 +37841,8 @@ function parseMatchPredicate(steps, index, operator, textPredicates) {
     for (const c of captures) {
       if (c.name === captureName) nodes.push(c.node.text);
     }
-    const test = /* @__PURE__ */ __name((text, positive) => {
-      return positive ? regex.test(text) : !regex.test(text);
+    const test = /* @__PURE__ */ __name((text, positive2) => {
+      return positive2 ? regex.test(text) : !regex.test(text);
     }, "test");
     if (nodes.length === 0) return !isPositive;
     return matchAll ? nodes.every((text) => test(text, isPositive)) : nodes.some((text) => test(text, isPositive));
@@ -39562,7 +40440,7 @@ async function uploadSnapshot(options) {
         failure4 = error62 instanceof Error ? error62.message : String(error62);
         if (attempt2 >= ATTEMPTS) throw new Error(`POST ${path} failed: ${failure4}`);
       }
-      await new Promise((resolve14) => setTimeout(resolve14, (options.retryDelayMs ?? 500) * attempt2));
+      await new Promise((resolve16) => setTimeout(resolve16, (options.retryDelayMs ?? 500) * attempt2));
     }
   };
   const manifestPath = byProject ? codePaths.projectUploadManifest(tenantId, projectId ?? "") : codePaths.uploadManifest(tenantId, repository?.owner ?? "", repository?.name ?? "");
@@ -39641,7 +40519,7 @@ var init_oidc = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readdir as readdir4, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join26, resolve as resolve12 } from "node:path";
+import { join as join26, resolve as resolve14 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify2 } from "node:util";
 async function git3(root, args2) {
@@ -39662,7 +40540,7 @@ async function repositoryFromRemote(root) {
   }
 }
 async function snapshotFromArgs(values, env) {
-  const root = resolve12(typeof values["root"] === "string" ? values["root"] : process.cwd());
+  const root = resolve14(typeof values["root"] === "string" ? values["root"] : process.cwd());
   const projectId = typeof values["project"] === "string" ? values["project"] : void 0;
   if (projectId !== void 0 && !ProjectId.safeParse(projectId).success) throw new UsageError2(`--project must be a project identifier, got "${projectId}"`);
   const repoText = projectId !== void 0 ? typeof values["repo"] === "string" ? values["repo"] : void 0 : (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
@@ -39674,7 +40552,7 @@ async function snapshotFromArgs(values, env) {
   const scip = Array.isArray(values["scip"]) ? values["scip"] : [];
   return buildSnapshot({
     repoRoot: root,
-    scipFiles: scip.map((file2) => resolve12(file2)),
+    scipFiles: scip.map((file2) => resolve14(file2)),
     tenantId: tenant,
     ...repoText ? { repository: parseRepository(repoText) } : {},
     ...projectId !== void 0 ? { projectId } : {},
@@ -39690,8 +40568,8 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
       const outDir = values.out;
       if (!outDir) throw new UsageError2("build needs --out DIR");
       const built = await snapshotFromArgs({ ...values, tenant: values.tenant ?? env["HARNESS_TENANT"] ?? "local" }, env);
-      await writeSnapshot(resolve12(outDir), built);
-      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve12(outDir)}`);
+      await writeSnapshot(resolve14(outDir), built);
+      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve14(outDir)}`);
       return 0;
     }
     if (command === "upload") {
@@ -43323,14 +44201,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve16, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve14();
+      resolve16();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -45126,7 +46004,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve14, reject) => {
+        return new Promise((resolve16, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -45194,7 +46072,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve14(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve16(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -45206,11 +46084,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema2, legOptions)
               };
-              return resolve14(this._resolveNonCompleteResult(decoded, flow));
+              return resolve16(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema2, result).then((parseResult) => {
-              if (parseResult.success) resolve14(parseResult.data);
+              if (parseResult.success) resolve16(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -45528,10 +46406,10 @@ var init_ajvProvider_CEoC_sr = __esm({
         return new _Code(expr);
       }
       exports.str = str;
-      function addCodeArg(code2, arg) {
-        if (arg instanceof _Code) code2.push(...arg._items);
-        else if (arg instanceof Name2) code2.push(arg);
-        else code2.push(interpolate(arg));
+      function addCodeArg(code2, arg4) {
+        if (arg4 instanceof _Code) code2.push(...arg4._items);
+        else if (arg4 instanceof Name2) code2.push(arg4);
+        else code2.push(interpolate(arg4));
       }
       exports.addCodeArg = addCodeArg;
       function optimize(expr) {
@@ -45980,15 +46858,15 @@ var init_ajvProvider_CEoC_sr = __esm({
           super.optimizeNodes();
           const cond = this.condition;
           if (cond === true) return this.nodes;
-          let e = this.else;
-          if (e) {
-            const ns = e.optimizeNodes();
-            e = this.else = Array.isArray(ns) ? new Else(ns) : ns;
+          let e2 = this.else;
+          if (e2) {
+            const ns = e2.optimizeNodes();
+            e2 = this.else = Array.isArray(ns) ? new Else(ns) : ns;
           }
-          if (e) {
-            if (cond === false) return e instanceof If2 ? e : e.nodes;
+          if (e2) {
+            if (cond === false) return e2 instanceof If2 ? e2 : e2.nodes;
             if (this.nodes.length) return this;
-            return new If2(not(cond), e instanceof If2 ? [e] : e.nodes);
+            return new If2(not(cond), e2 instanceof If2 ? [e2] : e2.nodes);
           }
           if (cond === false || !this.nodes.length) return void 0;
           return this;
@@ -46365,8 +47243,8 @@ var init_ajvProvider_CEoC_sr = __esm({
           delete names[n.str];
           return c;
         }
-        function canOptimize(e) {
-          return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== void 0);
+        function canOptimize(e2) {
+          return e2 instanceof code_1._Code && e2._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== void 0);
         }
       }
       function subtractNames(names, from) {
@@ -47116,7 +47994,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
         function validateAsync3() {
           const ruleErrs = gen.let("ruleErrs", null);
-          gen.try(() => assignValid((0, codegen_1._)`await `), (e) => gen.assign(valid, false).if((0, codegen_1._)`${e} instanceof ${it.ValidationError}`, () => gen.assign(ruleErrs, (0, codegen_1._)`${e}.errors`), () => gen.throw(e)));
+          gen.try(() => assignValid((0, codegen_1._)`await `), (e2) => gen.assign(valid, false).if((0, codegen_1._)`${e2} instanceof ${it.ValidationError}`, () => gen.assign(ruleErrs, (0, codegen_1._)`${e2}.errors`), () => gen.throw(e2)));
           return ruleErrs;
         }
         function validateSync() {
@@ -48011,11 +48889,11 @@ var init_ajvProvider_CEoC_sr = __esm({
           }
           sch.validate = validate2;
           return sch;
-        } catch (e) {
+        } catch (e2) {
           delete sch.validate;
           delete sch.validateName;
           if (sourceCode) this.logger.error("Error compiling schema, function code:", sourceCode);
-          throw e;
+          throw e2;
         } finally {
           this._compilations.delete(sch);
         }
@@ -48026,7 +48904,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve14.call(this, root, ref);
+        let _sch = resolve16.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -48052,7 +48930,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve14(root, ref) {
+      function resolve16(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -48502,7 +49380,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse5(serialize(uri, options), options);
         return uri;
       }
-      function resolve14(baseURI, relativeURI, options) {
+      function resolve16(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
@@ -48657,8 +49535,8 @@ var init_ajvProvider_CEoC_sr = __esm({
           if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
             if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
-            } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+            } catch (e2) {
+              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e2;
             }
           }
           if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
@@ -48676,7 +49554,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve14,
+        resolve: resolve16,
         resolveComponent,
         equal,
         serialize,
@@ -48909,10 +49787,10 @@ var init_ajvProvider_CEoC_sr = __esm({
           async function _compileAsync(sch) {
             try {
               return this._compileSchemaEnv(sch);
-            } catch (e) {
-              if (!(e instanceof ref_error_1.default)) throw e;
-              checkLoaded.call(this, e);
-              await loadMissingSchema.call(this, e.missingSchema);
+            } catch (e2) {
+              if (!(e2 instanceof ref_error_1.default)) throw e2;
+              checkLoaded.call(this, e2);
+              await loadMissingSchema.call(this, e2.missingSchema);
               return _compileAsync.call(this, sch);
             }
           }
@@ -49074,7 +49952,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
         errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
           if (!errors || errors.length === 0) return "No errors";
-          return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+          return errors.map((e2) => `${dataVar}${e2.instancePath} ${e2.message}`).reduce((text, msg) => text + separator + msg);
         }
         $dataMetaSchema(metaSchema, keywordsJsonPointers) {
           const rules = this.RULES.all;
@@ -49337,9 +50215,9 @@ var init_ajvProvider_CEoC_sr = __esm({
             gen.code((0, codegen_1._)`await ${(0, code_1.callValidateCode)(cxt, v, passCxt)}`);
             addEvaluatedFrom(v);
             if (!allErrors) gen.assign(valid, true);
-          }, (e) => {
-            gen.if((0, codegen_1._)`!(${e} instanceof ${it.ValidationError})`, () => gen.throw(e));
-            addErrorsFrom(e);
+          }, (e2) => {
+            gen.if((0, codegen_1._)`!(${e2} instanceof ${it.ValidationError})`, () => gen.throw(e2));
+            addErrorsFrom(e2);
             if (!allErrors) gen.assign(valid, false);
           });
           cxt.ok(valid);
@@ -52276,7 +53154,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         try {
           new RegExp(str);
           return true;
-        } catch (e) {
+        } catch (e2) {
           return false;
         }
       }
@@ -54373,7 +55251,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve14, reject) => {
+        return new Promise((resolve16, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -54388,14 +55266,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve14();
+            resolve16();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve14();
+            resolve16();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -54449,14 +55327,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve14) => {
+        return await new Promise((resolve16) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve14(true);
+            resolve16(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve14(false);
+            resolve16(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -54628,14 +55506,14 @@ function readWorkingCopyState(root) {
   if (raw === null) return { head, dirty: /* @__PURE__ */ new Set(), deleted: /* @__PURE__ */ new Set(), renamed: /* @__PURE__ */ new Map() };
   return { head, ...parseStatus(raw, (path) => existsSync8(join30(root, path))) };
 }
-var init_git = __esm({
+var init_git2 = __esm({
   "../code-shim/src/git.ts"() {
     "use strict";
   }
 });
 
 // ../code-shim/src/config.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join31 } from "node:path";
 function configDir(env) {
@@ -54646,7 +55524,7 @@ function findToken2(env, serviceUrl, now) {
   const fromEnv = env["HARNESS_TOKEN"];
   if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
   try {
-    const file2 = JSON.parse(readFileSync12(join31(configDir(env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync14(join31(configDir(env), "credentials.json"), "utf8"));
     const stored = file2[serviceUrl];
     if (stored === void 0 || typeof stored.accessToken !== "string" || stored.accessToken.length === 0) return null;
     if (typeof stored.expiresAt === "number" && stored.expiresAt <= now) return null;
@@ -54658,7 +55536,7 @@ function findToken2(env, serviceUrl, now) {
 function resolveCloudConfig(root, env, now) {
   let binding;
   try {
-    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync12(join31(root, ".harness", "project.json"), "utf8")));
+    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync14(join31(root, ".harness", "project.json"), "utf8")));
     if (!parsed.success) return null;
     binding = parsed.data;
   } catch {
@@ -54675,15 +55553,15 @@ var init_config = __esm({
   "../code-shim/src/config.ts"() {
     "use strict";
     init_src();
-    init_git();
+    init_git2();
   }
 });
 
 // ../code-shim/src/local.ts
-import { readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve13, sep as sep2 } from "node:path";
+import { readFileSync as readFileSync15, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve15, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
-  const absolute = resolve13(root, path);
+  const absolute = resolve15(root, path);
   const rel = relative3(root, absolute);
   if (rel.length === 0 || rel.startsWith("..") || isAbsolute2(rel)) return null;
   return absolute;
@@ -54789,7 +55667,7 @@ var init_local = __esm({
         if (absolute === null || !this.supports(path)) return null;
         let key;
         try {
-          const stat = statSync2(absolute);
+          const stat = statSync3(absolute);
           if (!stat.isFile() || stat.size > MAX_PARSE_BYTES2) return null;
           key = `${stat.mtimeMs}:${stat.size}`;
         } catch {
@@ -54800,7 +55678,7 @@ var init_local = __esm({
         let shard;
         try {
           this.parses += 1;
-          shard = await this.parse(path, readFileSync13(absolute, "utf8"));
+          shard = await this.parse(path, readFileSync15(absolute, "utf8"));
         } catch {
           shard = null;
         }
@@ -54812,7 +55690,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return null;
         try {
-          return readFileSync13(absolute, "utf8");
+          return readFileSync15(absolute, "utf8");
         } catch {
           return null;
         }
@@ -54822,7 +55700,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return void 0;
         try {
-          const lines = readFileSync13(absolute, "utf8").split("\n");
+          const lines = readFileSync15(absolute, "utf8").split("\n");
           const start2 = range[0];
           if (start2 >= lines.length) return void 0;
           const end = Math.min(Math.max(range[2], start2), start2 + maxLines - 1, lines.length - 1);
@@ -55049,7 +55927,7 @@ var init_nav = __esm({
 
 // ../code-shim/src/edit.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
 function lineStarts(text) {
   const starts = [0];
   for (let i2 = 0; i2 < text.length; i2 += 1) if (text[i2] === "\n") starts.push(i2 + 1);
@@ -55090,7 +55968,7 @@ async function editSymbol(index, args2) {
   if (!found.ok) return found;
   const absolute = resolveInside(index.root, args2.path);
   if (absolute === null) return { ok: false, reason: `path ${args2.path} is outside the repository` };
-  const original = readFileSync14(absolute, "utf8");
+  const original = readFileSync16(absolute, "utf8");
   const starts = lineStarts(original);
   const range = found.symbol.enclosingRange ?? found.symbol.range;
   const from = offsetOf(starts, original, range[0], range[1]);
@@ -55157,7 +56035,7 @@ async function renameSymbol(deps, args2) {
     if (absolute === null) return { ok: false, reason: `reference path ${path} is outside the repository` };
     let text;
     try {
-      text = readFileSync14(absolute, "utf8");
+      text = readFileSync16(absolute, "utf8");
     } catch {
       return { ok: false, reason: `cannot read ${path}` };
     }
@@ -55291,7 +56169,7 @@ var init_server = __esm({
     init_cloud();
     init_config();
     init_edit();
-    init_git();
+    init_git2();
     init_local();
     init_nav();
     ok = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }] });
@@ -55355,7 +56233,7 @@ var init_src3 = __esm({
     init_cloud();
     init_config();
     init_edit();
-    init_git();
+    init_git2();
     init_local();
     init_merge2();
     init_nav();
@@ -55669,6 +56547,21 @@ var SERVICE_CODES = {
   invalid_rules: { exit: EXIT.usage, hint: "overlane guard rules test --file <rules.json> --tool <tool>" },
   finding_not_open: { exit: EXIT.conflict, hint: "overlane review findings --status open" },
   live_leg_pending: { exit: EXIT.failure, hint: "overlane review status" },
+  // native git, CI and deploy (MS-A6)
+  mirror_read_only: { exit: EXIT.blocked, hint: "overlane repo mirror set <repo> --writable overlane" },
+  repo_too_large: { exit: EXIT.blocked, hint: "overlane connect --provider github" },
+  git_unavailable: { exit: EXIT.failure, hint: "overlane connect --provider github" },
+  merge_blocked: { exit: EXIT.conflict, hint: "overlane repo pr show <repo> <number>" },
+  invalid_pipeline: { exit: EXIT.usage, hint: "overlane ci validate" },
+  no_pipeline: { exit: EXIT.usage, hint: "overlane ci validate" },
+  secret_in_config: { exit: EXIT.usage, hint: "overlane ci secret set <NAME> --from-env <VAR>" },
+  artifact_tampered: { exit: EXIT.blocked, hint: "overlane ci run" },
+  digest_mismatch: { exit: EXIT.blocked, hint: "overlane ci show <run>" },
+  run_not_passed: { exit: EXIT.conflict, hint: "overlane ci list" },
+  invalid_git_token: { exit: EXIT.auth, hint: "overlane repo token <repo>" },
+  git_token_scope: { exit: EXIT.blocked, hint: "overlane repo token <repo> --scope write" },
+  git_token_principal: { exit: EXIT.blocked, hint: "overlane repo token <repo>" },
+  self_review: { exit: EXIT.conflict, hint: "overlane repo pr show <repo> <number>" },
   // generic
   unauthorized: { exit: EXIT.auth, hint: "overlane auth login" },
   // identity (MS-A1): a revoked or expired token needs a new sign-in; a role that may not do this is blocked by policy
@@ -56167,19 +57060,19 @@ function pkcePair() {
   return { verifier, challenge: base64url3(createHash("sha256").update(verifier).digest()) };
 }
 function listen(server, port) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve16, reject) => {
     const onError = (error62) => reject(error62);
     server.once("error", onError);
     server.listen(port, "127.0.0.1", () => {
       server.off("error", onError);
-      resolve14();
+      resolve16();
     });
   });
 }
 async function startLoopback(preferredPort, state) {
   let settle2;
-  const code2 = new Promise((resolve14, reject) => {
-    settle2 = { resolve: resolve14, reject };
+  const code2 = new Promise((resolve16, reject) => {
+    settle2 = { resolve: resolve16, reject };
   });
   code2.catch(() => void 0);
   const server = createServer((request, response) => {
@@ -56956,8 +57849,8 @@ function withTimeout(deps, ms) {
 }
 async function attempt(deps, ms, work) {
   let timer;
-  const deadline = new Promise((resolve14) => {
-    timer = setTimeout(() => resolve14("unreachable"), ms);
+  const deadline = new Promise((resolve16) => {
+    timer = setTimeout(() => resolve16("unreachable"), ms);
   });
   try {
     return await Promise.race([work(withTimeout(deps, ms)).catch((error62) => error62 instanceof ServiceError && error62.exit === EXIT.auth ? "unauthenticated" : "unreachable"), deadline]);
@@ -60114,7 +61007,7 @@ async function post(deps, base4, path, body2) {
   return { status: response.status, json: json2 };
 }
 function sleep(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function deviceLogin(deps, service, options) {
   const started = await post(deps, service, "/auth/device", {});
@@ -60737,25 +61630,1155 @@ var billingCommands = [
   billingCapsRemoveCommand
 ];
 
-// ../cli/src/commands/guard.ts
+// ../cli/src/commands/repo.ts
 init_src();
 init_zod();
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync8, statSync } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 var common3 = { needsAuth: true, needsNetwork: true };
 var requestId4 = () => `cli-${randomUUID4()}`;
-async function connected2(inv) {
+async function connected2(inv, label) {
+  const project = await connectedProject(inv.deps, label);
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned2(inv, label, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, label);
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+var APPROVAL_FLAG = { name: "approval", type: "string", value: "ID", description: "Run an action that an approval covers; get the ID from `overlane guard approvals list`" };
+var approvalHeaders = (inv) => {
+  const id2 = textFlag(inv, "approval");
+  return id2 === void 0 ? void 0 : { [APPROVAL_HEADER]: id2 };
+};
+function positive(text, flag) {
+  if (text === void 0) return void 0;
+  if (!/^\d+$/.test(text) || Number(text) < 1) throw new UsageError(`--${flag} must be a whole number of at least 1`);
+  return Number(text);
+}
+function arg(inv, index, what, hint) {
+  const value = inv.positionals[index];
+  if (value === void 0) throw new UsageError(`${what} is required`, { hint });
+  return value;
+}
+var REPO_ARG = { name: "repo", required: true, description: "The repository name or ID" };
+var REPO_ARG_LATE = { name: "repo", required: false, description: "The repository name or ID (required)" };
+var PULL_ARG = { name: "number", required: true, description: "The pull request number" };
+function pullNumber(inv, index, hint) {
+  const number4 = Number(arg(inv, index, "a pull request number", hint));
+  if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("the pull request number must be a whole number", { hint });
+  return number4;
+}
+var repoListCommand = defineCommand({
+  path: ["repo", "list"],
+  summary: "List the project's repositories",
+  description: "Lists the native Overlane repositories of this project, with the default branch, size against the 1 GB limit, and the mirror's writable side when the repository mirrors GitHub.",
+  examples: ["overlane repo list", "overlane repo list --json"],
+  effect: "read",
+  ...common3,
+  keywords: ["repositories", "repos", "git", "list repos", "native repo"],
+  result: RepoListResponse,
+  text: (d) => d.repos.length === 0 ? ["No repositories yet. Create one with: overlane repo create <name>"] : d.repos.map((repo) => `${repo.name}  ${repo.repoId}  ${repo.defaultBranch}  ${(repo.sizeBytes / 1048576).toFixed(1)} MB${repo.mirror === null ? "" : `  mirror of ${repo.mirror.external.owner}/${repo.mirror.external.name} (writable: ${repo.mirror.writableSide})`}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(RepoListResponse, "GET", gitPaths.repos(tenantId, projectId)) };
+  }
+});
+var repoStatusCommand = defineCommand({
+  path: ["repo", "status"],
+  summary: "Show whether this project can get a native repository now",
+  description: "Shows the flag the onboarding flow reads: whether native repositories are live, whether one is offered by default (only when the git host is live), whether import works, and how many repositories the project has. A project with none is complete: a repository stays optional.",
+  examples: ["overlane repo status", "overlane repo status --json"],
+  effect: "read",
+  ...common3,
+  keywords: ["native repo available", "is git hosting live", "can i create a repo", "repository optional"],
+  result: NativeRepoCapability,
+  text: (d) => [`native repositories: ${d.available ? "available" : "not available"}${d.defaultOn ? " (offered by default)" : ""}; ${d.repoCount} in this project`, d.reason],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(NativeRepoCapability, "GET", gitPaths.capability(tenantId, projectId)) };
+  }
+});
+var repoShowCommand = defineCommand({
+  path: ["repo", "show"],
+  summary: "Show one repository and its remote",
+  description: "Shows a repository's record. The remote URL carries no credential: use `overlane repo token` for a scoped token and hand it to a git credential helper.",
+  args: [REPO_ARG],
+  examples: ["overlane repo show app"],
+  effect: "read",
+  ...common3,
+  keywords: ["repository details", "remote url", "clone url"],
+  result: Repo,
+  text: (d) => [`${d.name} (${d.repoId}): ${d.remote}`, `default branch ${d.defaultBranch}, ${(d.sizeBytes / 1048576).toFixed(1)} MB of ${(d.capBytes / 1073741824).toFixed(0)} GB`],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(Repo, "GET", gitPaths.repo(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"))) };
+  }
+});
+var repoCreateCommand = defineCommand({
+  path: ["repo", "create"],
+  summary: "Create a native repository for the project",
+  description: "Creates a git repository on Overlane for this project. No GitHub account is needed. The default branch starts with a README commit unless you pass --no-seed. A repository stays optional: a project works without one.",
+  args: [{ name: "name", required: true, description: "Lowercase letters, digits, dots, dashes and underscores" }],
+  flags: [
+    { name: "branch", type: "string", value: "NAME", description: "The default branch (default: main)" },
+    { name: "no-seed", type: "boolean", description: "Create the repository empty, with no README commit" }
+  ],
+  examples: ["overlane repo create app", "overlane repo create app --branch trunk --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["new repository", "create repo", "git hosting", "native git", "start a repo"],
+  result: withDryRun(Repo),
+  text: (d) => "repoId" in d ? [`Created ${d.name} (${d.repoId}). Remote: ${d.remote}`, `Next: overlane repo token ${d.name} --scope write`] : [],
+  handler: async (inv) => {
+    const name2 = arg(inv, 0, "a repository name", "overlane repo create app");
+    const body2 = { requestId: requestId4(), name: name2, defaultBranch: textFlag(inv, "branch") ?? "main", seed: !boolFlag(inv, "no-seed") };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", gitPaths.repos, body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(Repo, "POST", gitPaths.repos(tenantId, projectId), body2) };
+  }
+});
+var repoImportCommand = defineCommand({
+  path: ["repo", "import"],
+  summary: "Import or mirror a GitHub repository",
+  description: "Copies a GitHub repository's history, branches and tags into a native repository. By default it is a mirror: GitHub stays the only writable side and a push to the Overlane copy is refused with a message saying where to push. With --copy Overlane becomes the origin. A repository over the 1 GB limit is refused with guidance to keep it on GitHub.",
+  args: [{ name: "source", required: true, description: "OWNER/NAME (or github:OWNER/NAME)" }],
+  flags: [
+    { name: "name", type: "string", value: "NAME", description: "The native repository's name (default: the source name)" },
+    { name: "copy", type: "boolean", description: "A one-time copy that makes Overlane the origin instead of a mirror" }
+  ],
+  examples: ["overlane repo import acme/app", "overlane repo import acme/app --copy --name app-native --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["import from github", "mirror github", "migrate repository", "bring my repo", "copy repo"],
+  result: withDryRun(Repo),
+  text: (d) => "repoId" in d ? [`Imported ${d.name}${d.mirror === null ? "" : ` as a mirror of ${d.mirror.external.owner}/${d.mirror.external.name}; ${d.mirror.writableSide} is the writable side`}.`] : [],
+  handler: async (inv) => {
+    const source = arg(inv, 0, "a source repository", "overlane repo import acme/app").replace(/^github:/, "");
+    const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(source);
+    if (match === null) throw new UsageError("the source must be OWNER/NAME", { hint: "overlane repo import acme/app" });
+    const name2 = textFlag(inv, "name");
+    const body2 = { requestId: requestId4(), source: { provider: "github", owner: match[1], name: match[2] }, mode: boolFlag(inv, "copy") ? "copy" : "mirror", ...name2 === void 0 ? {} : { name: name2 } };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", gitPaths.import, body2, "reads the repository through the GitHub App and imports it");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(Repo, "POST", gitPaths.import(tenantId, projectId), body2) };
+  }
+});
+var repoDeleteCommand = defineCommand({
+  path: ["repo", "delete"],
+  summary: "Delete a native repository and its history",
+  description: "Deletes the repository, revokes its git tokens and frees its name. Deleting history cannot be undone, so without a terminal the command needs --force. Deletion is a safety class: it needs an approval from an independent agent (evidence and a reason) or a person first.",
+  args: [REPO_ARG_LATE],
+  examples: ["overlane repo delete app --force"],
+  effect: "destructive",
+  ...common3,
+  keywords: ["remove repository", "delete repo"],
+  result: withDryRun(DeleteRepoResponse),
+  text: (d) => "deleted" in d ? [`Deleted ${d.repoId}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    if (inv.dryRun) return planned2(inv, "repo", "DELETE", (t, p) => gitPaths.repo(t, p, repo));
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(DeleteRepoResponse, "DELETE", gitPaths.repo(tenantId, projectId, repo), void 0, approvalHeaders(inv)) };
+  },
+  flags: [APPROVAL_FLAG]
+});
+var repoBranchesCommand = defineCommand({
+  path: ["repo", "branches"],
+  summary: "List a repository's branches and which are protected",
+  description: "Lists branches with their tip commits and whether branch protection applies.",
+  args: [REPO_ARG],
+  examples: ["overlane repo branches app"],
+  effect: "read",
+  ...common3,
+  keywords: ["branches", "list branches", "protected branches"],
+  result: BranchListResponse,
+  text: (d) => d.branches.map((branch) => `${branch.name}  ${branch.sha.slice(0, 12)}${branch.protected ? "  protected" : ""}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(BranchListResponse, "GET", gitPaths.branches(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"))) };
+  }
+});
+var repoBranchCreateCommand = defineCommand({
+  path: ["repo", "branch", "create"],
+  summary: "Create a branch from the default branch or another start point",
+  description: "Creates a branch. The start point is the default branch unless --from names a branch or a commit. Refused on the read-only side of a mirror.",
+  args: [REPO_ARG, { name: "name", required: true, description: "The new branch" }],
+  flags: [{ name: "from", type: "string", value: "BRANCH|SHA", description: "Start point (default: the default branch)" }],
+  examples: ["overlane repo branch create app feature/login", "overlane repo branch create app hotfix --from release/1.2 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["new branch", "create branch", "git branch"],
+  result: withDryRun(external_exports.object({ name: external_exports.string(), sha: external_exports.string() }).strict()),
+  text: (d) => "sha" in d ? [`Created ${d.name} at ${d.sha.slice(0, 12)}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const from = textFlag(inv, "from");
+    const body2 = { name: arg(inv, 1, "a branch name", "overlane repo branch create app feature/x"), ...from === void 0 ? {} : { from } };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", (t, p) => gitPaths.branches(t, p, repo), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(external_exports.object({ name: external_exports.string(), sha: external_exports.string() }).strict(), "POST", gitPaths.branches(tenantId, projectId, repo), body2) };
+  }
+});
+var repoBranchDeleteCommand = defineCommand({
+  path: ["repo", "branch", "delete"],
+  summary: "Delete a branch",
+  description: "Deletes a branch and closes the pull requests that were open from it. The default branch and protected branches cannot be deleted. Needs --force without a terminal.",
+  args: [REPO_ARG_LATE, { name: "name", required: false, description: "The branch to delete (required)" }],
+  examples: ["overlane repo branch delete app feature/login --force"],
+  effect: "destructive",
+  ...common3,
+  keywords: ["remove branch", "delete branch"],
+  result: withDryRun(external_exports.object({ name: external_exports.string() }).strict()),
+  text: (d) => "name" in d ? [`Deleted branch ${d.name}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const name2 = arg(inv, 1, "a branch name", "overlane repo branches app");
+    if (inv.dryRun) return planned2(inv, "repo", "DELETE", (t, p) => gitPaths.branch(t, p, repo, name2));
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(external_exports.object({ name: external_exports.string() }).strict(), "DELETE", gitPaths.branch(tenantId, projectId, repo, name2), void 0, approvalHeaders(inv)) };
+  },
+  flags: [APPROVAL_FLAG]
+});
+function readPushFiles(inv) {
+  const files = [];
+  for (const path of listFlag(inv, "file")) {
+    const absolute = resolve8(inv.deps.paths.cwd, path);
+    let content;
+    try {
+      if (statSync(absolute).size > 5e6) throw new UsageError(`${path} is larger than 5 MB; push it with git and a token instead`, { hint: `overlane repo token <repo> --scope write` });
+      content = readFileSync8(absolute, "utf8");
+    } catch (error62) {
+      if (error62 instanceof UsageError) throw error62;
+      throw new UsageError(`could not read ${path}`);
+    }
+    if (content.includes("\0")) throw new UsageError(`${path} is a binary file; push it with git and a token instead`, { hint: "overlane repo token <repo> --scope write" });
+    files.push({ path: path.replace(/^\.\//, ""), content });
+  }
+  for (const path of listFlag(inv, "delete")) files.push({ path, content: null });
+  return files;
+}
+var repoPushCommand = defineCommand({
+  path: ["repo", "push"],
+  summary: "Commit files to a branch through the API",
+  description: "Commits the given files (and deletions) as one commit on a branch, for agents and clients without a git binary. The guardrail rules run on the server first: a protected branch takes changes through a pull request, an agent's push to a protected branch waits for an approval, and a credential in a file is refused. With git installed, use `overlane repo token` and a normal push instead.",
+  args: [REPO_ARG],
+  flags: [
+    { name: "branch", type: "string", required: true, value: "NAME", description: "The branch to commit to" },
+    { name: "message", type: "string", required: true, value: "TEXT", description: "The commit message" },
+    { name: "file", type: "string", multiple: true, value: "PATH", description: "A text file to add or change; repeat for more" },
+    { name: "delete", type: "string", multiple: true, value: "PATH", description: "A path to delete; repeat for more" },
+    { name: "expect", type: "string", value: "SHA", description: "The commit the branch should be at (default: its current tip)" },
+    { name: "rewrite", type: "boolean", description: "Allow a history rewrite on an unprotected branch: the commit is built on --parent instead of the tip" },
+    { name: "parent", type: "string", value: "SHA", description: "With --rewrite: the commit to build on (the orphaned commits become stale)" },
+    APPROVAL_FLAG
+  ],
+  examples: ['overlane repo push app --branch feature/login --message "Add login" --file src/login.ts', 'overlane repo push app --branch main --message "Fix" --file a.ts --dry-run'],
+  effect: "write",
+  ...common3,
+  keywords: ["commit and push", "push files", "git push", "commit to branch"],
+  result: withDryRun(PushResult),
+  text: (d) => "after" in d ? [`${d.ref}: ${d.before === null ? "created at" : `${d.before.slice(0, 12)} ->`} ${d.after.slice(0, 12)}${d.forced ? " (forced)" : ""}${d.replay ? " (replayed)" : ""}`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const branch = textFlag(inv, "branch");
+    const message = textFlag(inv, "message");
+    if (branch === void 0 || message === void 0) throw new UsageError("--branch and --message are required", { hint: 'overlane repo push app --branch feature/x --message "change" --file a.ts' });
+    const files = readPushFiles(inv);
+    if (files.length === 0) throw new UsageError("nothing to push: give --file or --delete", { hint: 'overlane repo push app --branch feature/x --message "change" --file a.ts' });
+    const parent = textFlag(inv, "parent");
+    if (parent !== void 0 && !boolFlag(inv, "rewrite")) throw new UsageError("--parent only makes sense with --rewrite");
+    const body2 = (expectedOld) => ({ requestId: requestId4(), ref: branch, expectedOld, force: boolFlag(inv, "rewrite"), ...parent === void 0 ? {} : { parent }, commits: [{ message, files }] });
+    if (inv.dryRun) {
+      const shown2 = { ...body2(textFlag(inv, "expect") ?? null), commits: [{ message, files: files.map((file2) => ({ path: file2.path, content: file2.content === null ? null : `<${file2.content.length} characters>` })) }] };
+      return planned2(inv, "repo", "POST", (t, p) => gitPaths.push(t, p, repo), shown2, "one commit; the server checks protection and guardrail rules first");
+    }
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    let expected = textFlag(inv, "expect") ?? null;
+    if (expected === null) {
+      const branches = await call2(BranchListResponse, "GET", gitPaths.branches(tenantId, projectId, repo));
+      expected = branches.branches.find((entry) => entry.name === branch)?.sha ?? null;
+    }
+    return { data: await call2(PushResult, "POST", gitPaths.push(tenantId, projectId, repo), body2(expected), approvalHeaders(inv)) };
+  }
+});
+var repoProtectCommand = defineCommand({
+  path: ["repo", "protect"],
+  summary: "Protect a branch: pull requests, approvals and required checks",
+  description: "Sets branch protection for a branch name or pattern such as release/**. Direct pushes are refused and changes go through a pull request that needs the approvals and the required checks (CI job names). Force-push is never allowed on a protected branch. Agents and people with write access set it; under supervised autonomy it waits for approval.",
+  args: [REPO_ARG],
+  flags: [
+    { name: "branch", type: "string", required: true, value: "PATTERN", description: "The branch or pattern to protect" },
+    { name: "approvals", type: "string", value: "N", description: "Approvals a pull request needs (default 1)" },
+    { name: "check", type: "string", multiple: true, value: "JOB", description: "A CI job that must pass; repeat for more" },
+    { name: "merge-method", type: "string", multiple: true, enum: ["merge", "squash", "rebase"], value: "METHOD", description: "A merge method to allow; repeat for more (default: all)" }
+  ],
+  examples: ["overlane repo protect app --branch main --approvals 1 --check unit_tests", "overlane repo protect app --branch release/** --approvals 2 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["branch protection", "protect main", "required checks", "require review"],
+  result: withDryRun(BranchProtection),
+  text: (d) => "pattern" in d ? [`${d.pattern}: ${d.requiredApprovals} approval(s), checks ${d.requiredChecks.length === 0 ? "none" : d.requiredChecks.join(", ")}, merge ${d.allowedMergeMethods.join("/")}`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const pattern = textFlag(inv, "branch");
+    if (pattern === void 0) throw new UsageError("--branch is required", { hint: "overlane repo protect app --branch main" });
+    const approvals = textFlag(inv, "approvals");
+    const methods = listFlag(inv, "merge-method");
+    const body2 = { pattern, ...approvals === void 0 ? {} : { requiredApprovals: Number(approvals) }, requiredChecks: listFlag(inv, "check"), ...methods.length === 0 ? {} : { allowedMergeMethods: methods } };
+    if (approvals !== void 0 && (!/^\d+$/.test(approvals) || Number(approvals) > 10)) throw new UsageError("--approvals must be a number from 0 to 10");
+    if (inv.dryRun) return planned2(inv, "repo", "PUT", (t, p) => gitPaths.protection(t, p, repo), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(BranchProtection, "PUT", gitPaths.protection(tenantId, projectId, repo), body2) };
+  }
+});
+var ProtectionList = external_exports.object({ tenantId: external_exports.string(), protections: external_exports.array(BranchProtection) }).strict();
+var repoProtectionCommand = defineCommand({
+  path: ["repo", "protection"],
+  summary: "Show a repository's branch protection rules",
+  description: "Lists the protection rules: pattern, approvals, required checks and allowed merge methods.",
+  args: [REPO_ARG],
+  examples: ["overlane repo protection app"],
+  effect: "read",
+  ...common3,
+  keywords: ["protection rules", "what is protected"],
+  result: ProtectionList,
+  text: (d) => d.protections.length === 0 ? ["No protection rules."] : d.protections.map((rule) => `${rule.pattern}: ${rule.requiredApprovals} approval(s), checks ${rule.requiredChecks.join(", ") || "none"}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(ProtectionList, "GET", gitPaths.protection(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"))) };
+  }
+});
+var repoTokenCommand = defineCommand({
+  path: ["repo", "token"],
+  summary: "Mint a scoped git token for one repository",
+  description: "Mints a token bound to this repository, a scope (read or write), your principal and an expiry. It is shown once. Hand it to a git credential helper or an Authorization header; never put it in a remote URL or a file in the working copy. Revoke it with `overlane repo token revoke`.",
+  args: [REPO_ARG],
+  flags: [
+    { name: "scope", type: "string", enum: ["read", "write"], value: "read|write", description: "What the token may do (default: write)" },
+    { name: "ttl", type: "string", value: "SECONDS", description: "Lifetime in seconds, 60 to 86400 (default 3600)" }
+  ],
+  examples: ["overlane repo token app --scope read", "overlane repo token app --scope write --ttl 600 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["git credentials", "clone token", "push token", "git access token"],
+  result: withDryRun(GitTokenGrant),
+  text: (d) => "token" in d ? [`Token ${d.tokenId} (${d.scope}, expires ${d.expiresAt}). Shown once:`, d.token, d.usage, `remote: ${d.remote}`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const ttl = positive(textFlag(inv, "ttl"), "ttl");
+    const body2 = { scope: textFlag(inv, "scope") ?? "write", ...ttl === void 0 ? {} : { ttlSeconds: ttl } };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", (t, p) => gitPaths.tokens(t, p, repo), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(GitTokenGrant, "POST", gitPaths.tokens(tenantId, projectId, repo), body2) };
+  }
+});
+var repoTokenRevokeCommand = defineCommand({
+  path: ["repo", "token", "revoke"],
+  summary: "Revoke a git token",
+  description: "Revokes a token at once; any clone or push using it is refused from the next call.",
+  args: [REPO_ARG_LATE, { name: "token-id", required: false, description: "The token ID shown when it was minted (required)" }],
+  examples: ["overlane repo token revoke app gtk_abc123 --force"],
+  effect: "destructive",
+  ...common3,
+  keywords: ["revoke git token", "invalidate token"],
+  result: withDryRun(external_exports.object({ tokenId: external_exports.string(), revoked: external_exports.literal(true) }).strict()),
+  text: (d) => "revoked" in d ? [`Revoked ${d.tokenId}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const id2 = arg(inv, 1, "a token ID", "overlane repo token app");
+    if (inv.dryRun) return planned2(inv, "repo", "DELETE", (t, p) => gitPaths.token(t, p, repo, id2));
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(external_exports.object({ tokenId: external_exports.string(), revoked: external_exports.literal(true) }).strict(), "DELETE", gitPaths.token(tenantId, projectId, repo, id2)) };
+  }
+});
+var repoMirrorSetCommand = defineCommand({
+  path: ["repo", "mirror", "set"],
+  summary: "Choose which side of a mirror is writable",
+  description: "Exactly one side of a mirror takes pushes. `external` keeps GitHub as the origin and makes the Overlane copy read-only; `overlane` makes Overlane the origin (then make the GitHub side read-only or archive it, and syncing from GitHub is refused). Agents and people with write access change it; under supervised autonomy it waits for approval.",
+  args: [REPO_ARG],
+  flags: [{ name: "writable", type: "string", required: true, enum: ["overlane", "external"], value: "overlane|external", description: "The side that takes pushes" }],
+  examples: ["overlane repo mirror set app --writable overlane", "overlane repo mirror set app --writable external --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["single writer", "make overlane the origin", "read only mirror", "switch origin"],
+  result: withDryRun(Repo),
+  text: (d) => "repoId" in d ? [`${d.name}: ${d.mirror?.writableSide ?? "overlane"} is writable.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const writable = textFlag(inv, "writable");
+    if (writable === void 0) throw new UsageError("--writable is required", { hint: "overlane repo mirror set app --writable overlane" });
+    const path = (t, p) => `${gitPaths.repo(t, p, repo)}/mirror`;
+    if (inv.dryRun) return planned2(inv, "repo", "PUT", path, { writable });
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(Repo, "PUT", path(tenantId, projectId), { writable }) };
+  }
+});
+var repoSyncCommand = defineCommand({
+  path: ["repo", "sync"],
+  summary: "Sync a mirror from its GitHub source",
+  description: "Brings new commits, branches and tags from GitHub into the mirror. A rewritten branch marks the commits it dropped, the code index and the evidence recorded for those commits stale. Refused when Overlane is the writable side, because it would overwrite pushes made here.",
+  args: [REPO_ARG],
+  examples: ["overlane repo sync app", "overlane repo sync app --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["update mirror", "pull from github", "refresh mirror"],
+  result: withDryRun(MirrorSyncResponse),
+  text: (d) => "applied" in d ? [`${d.applied} ref(s) updated${d.staleShas.length === 0 ? "" : `; ${d.staleShas.length} commit(s) are stale after a rewritten history`}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const path = (t, p) => gitPaths.sync(t, p, repo);
+    if (inv.dryRun) return planned2(inv, "repo", "POST", path);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(MirrorSyncResponse, "POST", path(tenantId, projectId)) };
+  }
+});
+var IndexStatus = IndexJobsResponse.extend({ stale: external_exports.boolean() });
+var repoIndexShowCommand = defineCommand({
+  path: ["repo", "index", "show"],
+  summary: "Show the code index jobs and shard plan",
+  description: "Shows the index jobs started by pushes, their status, whether the index is stale after a rewrite, and the shard plan of the newest snapshot (a large repository is indexed by shard, each shard checking out only its paths).",
+  args: [REPO_ARG],
+  examples: ["overlane repo index show app"],
+  effect: "read",
+  ...common3,
+  keywords: ["index jobs", "shard plan", "is the index stale", "code map index"],
+  result: IndexStatus,
+  text: (d) => [`index ${d.stale ? "STALE (rebuild queued)" : "current"}; ${d.jobs.length} job(s)`, ...d.plan === null ? [] : [`newest snapshot ${d.plan.sha.slice(0, 12)}: ${d.plan.totalFiles} files in ${d.plan.shards.length} shard(s)${d.plan.partialCheckout ? " (partial checkout)" : ""}`]],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(IndexStatus, "GET", gitPaths.index(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"))) };
+  }
+});
+var repoIndexRunCommand = defineCommand({
+  path: ["repo", "index", "run"],
+  summary: "Run the queued index jobs now",
+  description: "Applies the queued index jobs. The rebuild after a force-push otherwise waits for the scheduled sweep or the next push. An older job never replaces a newer snapshot.",
+  args: [REPO_ARG],
+  examples: ["overlane repo index run app", "overlane repo index run app --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["rebuild index", "run index jobs", "refresh code map"],
+  result: withDryRun(external_exports.object({ tenantId: external_exports.string(), applied: external_exports.number(), ignored: external_exports.number() }).strict()),
+  text: (d) => "applied" in d ? [`${d.applied} job(s) applied, ${d.ignored} ignored as stale.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const path = (t, p) => gitPaths.index(t, p, repo);
+    if (inv.dryRun) return planned2(inv, "repo", "POST", path);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(external_exports.object({ tenantId: external_exports.string(), applied: external_exports.number(), ignored: external_exports.number() }).strict(), "POST", path(tenantId, projectId)) };
+  }
+});
+var prListCommand = defineCommand({
+  path: ["repo", "pr", "list"],
+  summary: "List pull requests",
+  description: "Lists a repository's pull requests, newest first; --state narrows to open, merged or closed.",
+  args: [REPO_ARG],
+  flags: [{ name: "state", type: "string", enum: ["open", "merged", "closed"], value: "STATE", description: "Only pull requests in this state" }],
+  examples: ["overlane repo pr list app --state open"],
+  effect: "read",
+  ...common3,
+  keywords: ["pull requests", "list prs", "open prs", "merge requests"],
+  result: PullListResponse,
+  text: (d) => d.pulls.length === 0 ? ["No pull requests."] : d.pulls.map((pull) => `#${pull.number} ${pull.state.padEnd(6)} ${pull.head.branch} -> ${pull.base.branch}  ${pull.title}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    const state = textFlag(inv, "state");
+    return { data: await call2(PullListResponse, "GET", `${gitPaths.pulls(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"))}${state === void 0 ? "" : `?state=${state}`}`) };
+  }
+});
+var prShowCommand = defineCommand({
+  path: ["repo", "pr", "show"],
+  summary: "Show a pull request: reviews, checks and what blocks the merge",
+  description: "Shows the pull request with its reviews, required checks, approvals counted against the current head, and each blocker with a plain reason.",
+  args: [REPO_ARG, PULL_ARG],
+  examples: ["overlane repo pr show app 7"],
+  effect: "read",
+  ...common3,
+  keywords: ["pull request status", "can i merge", "pr checks", "what blocks the merge"],
+  result: PullStatus,
+  text: (d) => [`#${d.pull.number} ${d.pull.title} (${d.pull.state}), ${d.approvals} approval(s)`, ...d.checks.map((check2) => `check ${check2.name}: ${check2.state}`), d.mergeable ? "Ready to merge." : `Blocked: ${d.blockers.map((blocker) => blocker.message).join("; ")}`],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(PullStatus, "GET", gitPaths.pull(tenantId, projectId, arg(inv, 0, "a repository", "overlane repo list"), pullNumber(inv, 1, "overlane repo pr list app"))) };
+  }
+});
+var prOpenCommand = defineCommand({
+  path: ["repo", "pr", "open"],
+  summary: "Open a pull request",
+  description: "Opens a pull request from a branch into the default branch (or --base). The review service reviews it with deterministic checks first, and CI runs the pipeline for the head.",
+  args: [REPO_ARG],
+  flags: [
+    { name: "head", type: "string", required: true, value: "BRANCH", description: "The branch with the changes" },
+    { name: "title", type: "string", required: true, value: "TEXT", description: "The title" },
+    { name: "base", type: "string", value: "BRANCH", description: "The branch to merge into (default: the default branch)" },
+    { name: "body", type: "string", value: "TEXT", description: "The description" },
+    { name: "draft", type: "boolean", description: "Open as a draft, which cannot be merged until it is ready" }
+  ],
+  examples: ['overlane repo pr open app --head feature/login --title "Add login"', 'overlane repo pr open app --head fix --title "Fix" --dry-run'],
+  effect: "write",
+  ...common3,
+  keywords: ["open pull request", "create pr", "new pull request"],
+  result: withDryRun(PullRequest),
+  text: (d) => "number" in d ? [`Opened #${d.number}: ${d.title}`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const head = textFlag(inv, "head");
+    const title = textFlag(inv, "title");
+    if (head === void 0 || title === void 0) throw new UsageError("--head and --title are required", { hint: 'overlane repo pr open app --head feature/x --title "Add x"' });
+    const base4 = textFlag(inv, "base");
+    const text = textFlag(inv, "body");
+    const body2 = { requestId: requestId4(), title, head, ...base4 === void 0 ? {} : { base: base4 }, ...text === void 0 ? {} : { body: text }, draft: boolFlag(inv, "draft") };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", (t, p) => gitPaths.pulls(t, p, repo), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(PullRequest, "POST", gitPaths.pulls(tenantId, projectId, repo), body2) };
+  }
+});
+var prReviewCommand = defineCommand({
+  path: ["repo", "pr", "review"],
+  summary: "Approve, request changes on, or comment on a pull request",
+  description: "Records a review against the pull request's current head, so a later push makes an approval stale. The author cannot approve their own pull request; another person or an independent agent does.",
+  args: [REPO_ARG, PULL_ARG],
+  flags: [
+    { name: "state", type: "string", required: true, enum: ["approved", "changes_requested", "commented"], value: "STATE", description: "Your review" },
+    { name: "body", type: "string", value: "TEXT", description: "What you checked or what must change" }
+  ],
+  examples: ['overlane repo pr review app 7 --state approved --body "checked the tests"', "overlane repo pr review app 7 --state changes_requested --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["approve pr", "review pull request", "request changes"],
+  result: withDryRun(PullReview),
+  text: (d) => "reviewId" in d ? [`${d.state} on ${d.headSha.slice(0, 12)}`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const number4 = pullNumber(inv, 1, "overlane repo pr list app");
+    const state = textFlag(inv, "state");
+    if (state === void 0) throw new UsageError("--state is required", { hint: "overlane repo pr review app 7 --state approved" });
+    const body2 = { requestId: requestId4(), state, body: textFlag(inv, "body") ?? "" };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", (t, p) => gitPaths.reviews(t, p, repo, number4), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(PullReview, "POST", gitPaths.reviews(tenantId, projectId, repo, number4), body2) };
+  }
+});
+var prMergeCommand = defineCommand({
+  path: ["repo", "pr", "merge"],
+  summary: "Merge a pull request",
+  description: "Merges when the protection rules allow: approvals on the current head, required checks passed, no changes requested, a merge method the branch allows. An agent's merge into a protected branch waits for an approval; the answer names each blocker. Exit 5 when blocked, 6 when waiting for an approval.",
+  args: [REPO_ARG, PULL_ARG],
+  flags: [{ name: "method", type: "string", enum: ["merge", "squash", "rebase"], value: "METHOD", description: "How to merge (default: squash)" }, APPROVAL_FLAG],
+  examples: ["overlane repo pr merge app 7 --method squash", "overlane repo pr merge app 7 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["merge pr", "merge pull request", "squash merge"],
+  result: withDryRun(MergeResult),
+  text: (d) => "mergeSha" in d ? [`Merged #${d.pull.number} as ${d.mergeSha.slice(0, 12)}${d.replay ? " (replayed)" : ""}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const number4 = pullNumber(inv, 1, "overlane repo pr list app");
+    const body2 = { requestId: requestId4(), method: textFlag(inv, "method") ?? "squash" };
+    if (inv.dryRun) return planned2(inv, "repo", "POST", (t, p) => gitPaths.merge(t, p, repo, number4), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(MergeResult, "POST", gitPaths.merge(tenantId, projectId, repo, number4), body2, approvalHeaders(inv)) };
+  }
+});
+var prCloseCommand = defineCommand({
+  path: ["repo", "pr", "close"],
+  summary: "Close a pull request without merging",
+  description: "Closes an open pull request. It can be reopened by opening a new one from the same branch.",
+  args: [REPO_ARG, PULL_ARG],
+  examples: ["overlane repo pr close app 7"],
+  effect: "write",
+  ...common3,
+  keywords: ["close pr", "abandon pull request"],
+  result: withDryRun(PullRequest),
+  text: (d) => "number" in d ? [`Closed #${d.number}.`] : [],
+  handler: async (inv) => {
+    const repo = arg(inv, 0, "a repository", "overlane repo list");
+    const number4 = pullNumber(inv, 1, "overlane repo pr list app");
+    const path = (t, p) => `${gitPaths.pull(t, p, repo, number4)}/close`;
+    if (inv.dryRun) return planned2(inv, "repo", "POST", path);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
+    return { data: await call2(PullRequest, "POST", path(tenantId, projectId), {}) };
+  }
+});
+var repoCommands = [
+  repoListCommand,
+  repoStatusCommand,
+  repoShowCommand,
+  repoCreateCommand,
+  repoImportCommand,
+  repoDeleteCommand,
+  repoBranchesCommand,
+  repoBranchCreateCommand,
+  repoBranchDeleteCommand,
+  repoPushCommand,
+  repoProtectCommand,
+  repoProtectionCommand,
+  repoTokenCommand,
+  repoTokenRevokeCommand,
+  repoMirrorSetCommand,
+  repoSyncCommand,
+  repoIndexShowCommand,
+  repoIndexRunCommand,
+  prListCommand,
+  prShowCommand,
+  prOpenCommand,
+  prReviewCommand,
+  prMergeCommand,
+  prCloseCommand
+];
+
+// ../cli/src/commands/ci.ts
+init_src();
+init_zod();
+import { readFileSync as readFileSync9 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
+var RUN_ARG = { name: "run", required: true, description: "The run ID" };
+function arg2(inv, index, what, hint) {
+  const value = inv.positionals[index];
+  if (value === void 0) throw new UsageError(`${what} is required`, { hint });
+  return value;
+}
+function runExit(run3) {
+  if (run3.status === "failed" || run3.status === "cancelled") return EXIT.failure;
+  if (run3.status === "held") return EXIT.blocked;
+  return void 0;
+}
+var runLine = (run3) => `${run3.runId}  ${run3.status.padEnd(9)} ${run3.trigger.padEnd(12)} ${run3.ref}@${run3.commitSha.slice(0, 12)}  ${run3.totalMinutes} min`;
+var jobLines = (run3) => run3.jobs.map((job) => `  ${job.name}: ${job.status}${job.flaky ? " (flaky: passed on the re-run)" : ""}${job.cache.key === null ? "" : job.cache.hit ? ", cache hit" : ", cache miss"}, ${job.route.instance}, ${job.billedMinutes} min`);
+var ciValidateCommand = defineCommand({
+  path: ["ci", "validate"],
+  summary: "Check the pipeline file and show the line of each error",
+  description: "Parses .overlane/ci.yml (or --file) with the parser the service runs before every run, offline. Errors are printed as path:line: message and the command exits 2; a valid file lists its jobs. Run it before pushing a change to the pipeline.",
+  flags: [{ name: "file", type: "string", value: "PATH", description: "The pipeline file (default: .overlane/ci.yml)" }],
+  examples: ["overlane ci validate", "overlane ci validate --file ci/test.yml --json"],
+  effect: "read",
+  keywords: ["validate pipeline", "check ci config", "lint workflow", "pipeline errors"],
+  result: external_exports.object({ ok: external_exports.boolean(), file: external_exports.string(), jobs: external_exports.array(external_exports.string()), issues: external_exports.array(external_exports.object({ line: external_exports.number(), message: external_exports.string() }).strict()) }).strict(),
+  text: (d) => d.ok ? [`${d.file} is valid: jobs ${d.jobs.join(", ")}`] : formatConfigIssues(d.file, d.issues),
+  handler: async (inv) => {
+    const file2 = textFlag(inv, "file") ?? PIPELINE_CONFIG_PATH;
+    let text;
+    try {
+      text = readFileSync9(resolve9(inv.deps.paths.cwd, file2), "utf8");
+    } catch {
+      throw new UsageError(`could not read ${file2}`, { hint: "overlane ci validate --file <path>" });
+    }
+    const parsed = parsePipelineConfig(text);
+    const data = { ok: parsed.ok, file: file2, jobs: parsed.ok ? Object.keys(parsed.config.jobs) : [], issues: parsed.ok ? [] : parsed.issues };
+    return parsed.ok ? { data } : { data, exit: EXIT.usage };
+  }
+});
+async function gitFact(inv, args2) {
+  const out2 = await inv.deps.exec("git", args2, { cwd: inv.deps.paths.cwd });
+  const text = out2.stdout.trim();
+  return out2.code === 0 && text.length > 0 ? text : void 0;
+}
+var ciRunCommand = defineCommand({
+  path: ["ci", "run"],
+  summary: "Start a pipeline run for a commit",
+  description: "Starts the pipeline from .overlane/ci.yml at a commit (default: the working copy's HEAD and branch). The file is read from the repository, never sent. A failed run exits 1; a run held by the pull request's cost gate exits 6 and names the setting to raise. A native project needs a repository (`overlane repo create`).",
+  flags: [
+    { name: "commit", type: "string", value: "SHA", description: "The full commit SHA (default: HEAD)" },
+    { name: "ref", type: "string", value: "BRANCH", description: "The branch (default: the current branch)" },
+    { name: "repo", type: "string", value: "REPO", description: "The repository, when the project has several" },
+    { name: "pull", type: "string", value: "N", description: "Run as the pull request with this number (its head must be the commit)" },
+    APPROVAL_FLAG
+  ],
+  examples: ["overlane ci run", "overlane ci run --commit 0123456789abcdef0123456789abcdef01234567 --ref main --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["run pipeline", "start ci", "trigger build", "run tests in ci"],
+  result: withDryRun(RunResponse),
+  text: (d) => "run" in d ? [runLine(d.run), ...jobLines(d.run), ...d.run.reason === null ? [] : [d.run.reason], ...d.cancelled.length === 0 ? [] : [`cancelled superseded: ${d.cancelled.join(", ")}`]] : [],
+  handler: async (inv) => {
+    const commit = textFlag(inv, "commit") ?? await gitFact(inv, ["rev-parse", "HEAD"]);
+    const ref = textFlag(inv, "ref") ?? await gitFact(inv, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    if (commit === void 0 || ref === void 0) throw new UsageError("could not read the commit and branch from the working copy; give --commit and --ref", { hint: "overlane ci run --commit <sha> --ref main" });
+    const pull = positive(textFlag(inv, "pull"), "pull");
+    const repo = textFlag(inv, "repo");
+    const body2 = { requestId: requestId4(), ref, commitSha: commit, trigger: pull === void 0 ? "manual" : "pull_request", ...repo === void 0 ? {} : { repoId: repo }, ...pull === void 0 ? {} : { pullNumber: pull } };
+    if (inv.dryRun) return planned2(inv, "ci", "POST", ciPaths.runs, body2, "the service reads .overlane/ci.yml at that commit and validates it first");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    const result = await call2(RunResponse, "POST", ciPaths.runs(tenantId, projectId), body2, approvalHeaders(inv));
+    const exit = runExit(result.run);
+    return exit === void 0 ? { data: result } : { data: result, exit };
+  }
+});
+var ciListCommand = defineCommand({
+  path: ["ci", "list"],
+  summary: "List recent pipeline runs",
+  description: "Lists the project's recent runs with status, trigger, commit and minutes used.",
+  examples: ["overlane ci list", "overlane ci list --json"],
+  effect: "read",
+  ...common3,
+  keywords: ["pipeline runs", "ci status", "recent builds"],
+  result: RunListResponse,
+  text: (d) => d.runs.length === 0 ? ["No runs yet."] : d.runs.map(runLine),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(RunListResponse, "GET", ciPaths.runs(tenantId, projectId)) };
+  }
+});
+var ciShowCommand = defineCommand({
+  path: ["ci", "show"],
+  summary: "Show a run with its jobs, routing and cache result",
+  description: "Shows a run's jobs with status, the runner each used and why (a job over 20 minutes runs on Containers), the cache hit or miss, flaky marks, minutes and cost.",
+  args: [RUN_ARG],
+  examples: ["overlane ci show run_abc123"],
+  effect: "read",
+  ...common3,
+  keywords: ["run details", "job status", "why did the build fail"],
+  result: PipelineRun,
+  text: (d) => [runLine(d), ...jobLines(d), ...d.jobs.map((job) => `  ${job.name} route: ${job.route.reason}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(PipelineRun, "GET", ciPaths.run(tenantId, projectId, arg2(inv, 0, "a run ID", "overlane ci list"))) };
+  }
+});
+var ciLogsCommand = defineCommand({
+  path: ["ci", "logs"],
+  summary: "Show a run's logs, with secrets masked",
+  description: "Prints each job's log from R2. Secret values and anything shaped like a provider key are masked before storage and again here.",
+  args: [RUN_ARG],
+  examples: ["overlane ci logs run_abc123"],
+  effect: "read",
+  ...common3,
+  keywords: ["build log", "ci output", "test output"],
+  result: RunLogResponse,
+  text: (d) => d.jobs.flatMap((job) => [`==== ${job.name} ====`, job.log]),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(RunLogResponse, "GET", ciPaths.logs(tenantId, projectId, arg2(inv, 0, "a run ID", "overlane ci list"))) };
+  }
+});
+var ciCancelCommand = defineCommand({
+  path: ["ci", "cancel"],
+  summary: "Cancel a queued or running pipeline run",
+  description: "Stops the run and marks its unfinished jobs cancelled. A finished run is returned unchanged.",
+  args: [RUN_ARG],
+  examples: ["overlane ci cancel run_abc123", "overlane ci cancel run_abc123 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["stop build", "cancel run"],
+  result: withDryRun(PipelineRun),
+  text: (d) => "runId" in d ? [runLine(d)] : [],
+  handler: async (inv) => {
+    const run3 = arg2(inv, 0, "a run ID", "overlane ci list");
+    if (inv.dryRun) return planned2(inv, "ci", "POST", (t, p) => ciPaths.cancel(t, p, run3), {});
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(PipelineRun, "POST", ciPaths.cancel(tenantId, projectId, run3), {}) };
+  }
+});
+var ciRerunCommand = defineCommand({
+  path: ["ci", "rerun"],
+  summary: "Run a finished or held run again",
+  description: "Starts a new run for the same commit, branch and pull request. Use it after raising the cost gate (`overlane ci settings set --max-minutes-per-pull`) for a held run.",
+  args: [RUN_ARG],
+  examples: ["overlane ci rerun run_abc123", "overlane ci rerun run_abc123 --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["retry build", "rerun pipeline", "run again"],
+  result: withDryRun(RunResponse),
+  text: (d) => "run" in d ? [runLine(d.run), ...jobLines(d.run)] : [],
+  handler: async (inv) => {
+    const run3 = arg2(inv, 0, "a run ID", "overlane ci list");
+    const body2 = { requestId: requestId4() };
+    if (inv.dryRun) return planned2(inv, "ci", "POST", (t, p) => ciPaths.rerun(t, p, run3), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    const result = await call2(RunResponse, "POST", ciPaths.rerun(tenantId, projectId, run3), body2);
+    const exit = runExit(result.run);
+    return exit === void 0 ? { data: result } : { data: result, exit };
+  }
+});
+var ciSecretsCommand = defineCommand({
+  path: ["ci", "secrets"],
+  summary: "List the project's CI secret names",
+  description: "Lists secret names and when each changed. Values are never shown: they sit encrypted in the vault and reach a job only through its one-job credential, never a fork pull request.",
+  examples: ["overlane ci secrets"],
+  effect: "read",
+  ...common3,
+  keywords: ["ci secrets", "pipeline secrets", "build secrets"],
+  result: CiSecretListResponse,
+  text: (d) => d.secrets.length === 0 ? ["No secrets set."] : d.secrets.map((secret) => `${secret.name}  updated ${secret.updatedAt}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(CiSecretListResponse, "GET", ciPaths.secrets(tenantId, projectId)) };
+  }
+});
+async function secretValue(inv, hint) {
+  const envName = textFlag(inv, "from-env");
+  if (envName !== void 0) {
+    const value = inv.deps.env[envName];
+    if (value === void 0 || value.length === 0) throw new UsageError(`${envName} is not set in the environment`, { hint });
+    return { value, from: `the ${envName} environment variable` };
+  }
+  if (boolFlag(inv, "stdin")) {
+    if (inv.deps.stdin === void 0) throw new UsageError("--stdin reads standard input, which is not available here", { hint });
+    return { value: (await inv.deps.stdin.read()).replace(/\r?\n$/, ""), from: "standard input" };
+  }
+  throw new UsageError("give the value with --from-env VAR or --stdin; a secret is never taken from an argument", { hint });
+}
+var ciSecretSetCommand = defineCommand({
+  path: ["ci", "secret", "set"],
+  summary: "Set a CI secret from the environment or standard input",
+  description: "Stores a secret in the encrypted vault under an UPPER_SNAKE_CASE name a pipeline lists in `secrets:`. The value comes from an environment variable (--from-env) or standard input (--stdin), never an argument that would land in shell history. Values under 8 characters are refused because they cannot be masked in logs reliably. Setting a secret is a safety class: it needs an approval from an independent agent (evidence and a reason) or a person first.",
+  args: [{ name: "name", required: true, description: "The secret name, for example NPM_TOKEN" }],
+  flags: [
+    { name: "from-env", type: "string", value: "VAR", description: "Read the value from this environment variable" },
+    { name: "stdin", type: "boolean", description: "Read the value from standard input" }
+  ],
+  examples: ["overlane ci secret set NPM_TOKEN --from-env NPM_TOKEN", "overlane ci secret set NPM_TOKEN --stdin --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["set secret", "add secret to ci", "pipeline credential"],
+  result: withDryRun(external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), name: external_exports.string(), updatedAt: external_exports.string() }).strict()),
+  text: (d) => "updatedAt" in d ? [`Set ${d.name}. Its value is not shown again.`] : [],
+  handler: async (inv) => {
+    const name2 = arg2(inv, 0, "a secret name", "overlane ci secret set NPM_TOKEN --from-env NPM_TOKEN");
+    if (inv.dryRun) {
+      const project = await offlineProject(inv.deps, "ci");
+      return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method: "PUT", path: ciPaths.secrets(project.binding.tenantId, project.binding.projectId), body: { name: name2, value: "<hidden>" }, note: "the value is read from the environment or standard input when run for real" }] }));
+    }
+    const { value } = await secretValue(inv, "overlane ci secret set NPM_TOKEN --from-env NPM_TOKEN");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), name: external_exports.string(), updatedAt: external_exports.string() }).strict(), "PUT", ciPaths.secrets(tenantId, projectId), { name: name2, value }) };
+  }
+});
+var ciSecretDeleteCommand = defineCommand({
+  path: ["ci", "secret", "delete"],
+  summary: "Delete a CI secret",
+  description: "Removes the secret from the vault. Pipelines that list it fail with a plain message until it is set again. Needs --force without a terminal.",
+  args: [{ name: "name", required: false, description: "The secret name (required; checked after the --force confirmation)" }],
+  examples: ["overlane ci secret delete NPM_TOKEN --force"],
+  effect: "destructive",
+  ...common3,
+  keywords: ["remove secret", "delete ci secret", "rotate secret"],
+  result: withDryRun(external_exports.object({ tenantId: external_exports.string(), name: external_exports.string(), deleted: external_exports.literal(true) }).strict()),
+  text: (d) => "deleted" in d ? [`Deleted ${d.name}.`] : [],
+  handler: async (inv) => {
+    const name2 = arg2(inv, 0, "a secret name", "overlane ci secrets");
+    if (inv.dryRun) return planned2(inv, "ci", "DELETE", (t, p) => ciPaths.secret(t, p, name2));
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(external_exports.object({ tenantId: external_exports.string(), name: external_exports.string(), deleted: external_exports.literal(true) }).strict(), "DELETE", ciPaths.secret(tenantId, projectId, name2)) };
+  }
+});
+var ciSettingsCommand = defineCommand({
+  path: ["ci", "settings"],
+  summary: "Show the CI cost gate and concurrency settings",
+  description: "Shows the minutes one pull request may use before further runs are held, the number of runs that execute at once, and whether a newer commit cancels superseded runs.",
+  examples: ["overlane ci settings"],
+  effect: "read",
+  ...common3,
+  keywords: ["ci limits", "cost gate", "cancel superseded", "concurrency"],
+  result: CiSettings,
+  text: (d) => [`cost gate: ${d.maxMinutesPerPull} minutes per pull request; ${d.maxConcurrentRuns} runs at once; superseded runs ${d.cancelSuperseded ? "are cancelled" : "keep running"}`],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(CiSettings, "GET", ciPaths.settings(tenantId, projectId)) };
+  }
+});
+var ciSettingsSetCommand = defineCommand({
+  path: ["ci", "settings", "set"],
+  summary: "Change the cost gate, concurrency or superseded-run cancelling",
+  description: "Sets CI limits for the project. Raising a limit is a spend action and needs an approval from an independent agent (evidence and a reason) or a person; the cost gate is how a team caps the minutes one pull request can spend.",
+  flags: [
+    { name: "max-minutes-per-pull", type: "string", value: "N", description: "Minutes one pull request may use (1 to 10000)" },
+    { name: "max-concurrent", type: "string", value: "N", description: "Runs that execute at once (1 to 50)" },
+    { name: "cancel-superseded", type: "string", enum: ["true", "false"], value: "true|false", description: "Cancel older runs on a ref when a newer commit arrives" }
+  ],
+  examples: ["overlane ci settings set --max-minutes-per-pull 120", "overlane ci settings set --cancel-superseded false --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["raise cost gate", "ci limits", "set minutes per pr"],
+  result: withDryRun(CiSettings),
+  text: (d) => "maxMinutesPerPull" in d ? [`cost gate ${d.maxMinutesPerPull} minutes per pull request, ${d.maxConcurrentRuns} concurrent, superseded runs ${d.cancelSuperseded ? "cancelled" : "kept"}`] : [],
+  handler: async (inv) => {
+    const minutes = positive(textFlag(inv, "max-minutes-per-pull"), "max-minutes-per-pull");
+    const concurrent = positive(textFlag(inv, "max-concurrent"), "max-concurrent");
+    const cancel = textFlag(inv, "cancel-superseded");
+    const body2 = { ...minutes === void 0 ? {} : { maxMinutesPerPull: minutes }, ...concurrent === void 0 ? {} : { maxConcurrentRuns: concurrent }, ...cancel === void 0 ? {} : { cancelSuperseded: cancel === "true" } };
+    if (Object.keys(body2).length === 0) throw new UsageError("nothing to change", { hint: "overlane ci settings set --max-minutes-per-pull 120" });
+    if (inv.dryRun) return planned2(inv, "ci", "PUT", ciPaths.settings, body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(CiSettings, "PUT", ciPaths.settings(tenantId, projectId), body2) };
+  }
+});
+var ciUsageCommand = defineCommand({
+  path: ["ci", "usage"],
+  summary: "Show this month's CI minutes, cost and flaky tests",
+  description: "Shows the minutes metered for the team this month, the cost at the runner rates, and tests marked flaky in the last 7 days (two marks in a week open an issue).",
+  examples: ["overlane ci usage"],
+  effect: "read",
+  ...common3,
+  keywords: ["ci minutes", "ci cost", "flaky tests", "build minutes"],
+  result: CiUsageResponse,
+  text: (d) => [`${d.month}: ${d.minutes} minutes over ${d.runs} run(s), $${(d.costMicros / 1e6).toFixed(4)}`, ...d.flaky.map((entry) => `flaky ${entry.test}: ${entry.count} in 7 days`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "ci");
+    return { data: await call2(CiUsageResponse, "GET", ciPaths.usage(tenantId, projectId)) };
+  }
+});
+var ciCommands = [ciValidateCommand, ciRunCommand, ciListCommand, ciShowCommand, ciLogsCommand, ciCancelCommand, ciRerunCommand, ciSecretsCommand, ciSecretSetCommand, ciSecretDeleteCommand, ciSettingsCommand, ciSettingsSetCommand, ciUsageCommand];
+
+// ../cli/src/commands/deploy.ts
+init_src();
+init_zod();
+function arg3(inv, index, what, hint) {
+  const value = inv.positionals[index];
+  if (value === void 0) throw new UsageError(`${what} is required`, { hint });
+  return value;
+}
+var releaseLine = (release) => `${release.releaseId}  ${release.environment.padEnd(18)} ${release.status.padEnd(11)}${release.live ? " live" : "     "} ${release.commitSha.slice(0, 12)}  ${release.url ?? ""}`;
+function deployExit(release) {
+  return release !== null && release.status === "failed" ? EXIT.failure : void 0;
+}
+async function secretFrom(inv, flagHint) {
+  const envName = textFlag(inv, "credential-env") ?? textFlag(inv, "from-env");
+  if (envName !== void 0) {
+    const value = inv.deps.env[envName];
+    if (value === void 0 || value.length === 0) throw new UsageError(`${envName} is not set in the environment`, { hint: flagHint });
+    return value;
+  }
+  if (boolFlag(inv, "stdin")) {
+    if (inv.deps.stdin === void 0) throw new UsageError("--stdin reads standard input, which is not available here", { hint: flagHint });
+    return (await inv.deps.stdin.read()).replace(/\r?\n$/, "");
+  }
+  throw new UsageError("give the value with an environment variable or --stdin; a secret is never taken from an argument", { hint: flagHint });
+}
+function targetConfig(inv) {
+  const kind = textFlag(inv, "kind");
+  const pairs = Object.fromEntries(listFlag(inv, "set").map((entry) => {
+    const at = entry.indexOf("=");
+    if (at < 1) throw new UsageError(`--set takes KEY=VALUE, not ${entry}`, { hint: "overlane deploy target add site --kind workers --set scriptName=site --set accountId=abc --credential-env CF_TOKEN" });
+    return [entry.slice(0, at), entry.slice(at + 1)];
+  }));
+  return { kind: kind ?? "", ...pairs };
+}
+var deployTargetsCommand = defineCommand({
+  path: ["deploy", "targets"],
+  summary: "List deploy targets and environments",
+  description: "Lists the places this project deploys to (Workers, Vercel, Netlify, Fly) and the environments on them, with which are protected. Provider tokens are never shown.",
+  examples: ["overlane deploy targets"],
+  effect: "read",
+  ...common3,
+  keywords: ["deploy targets", "environments", "where do we deploy", "staging production"],
+  result: TargetListResponse,
+  text: (d) => [...d.targets.map((target) => `target ${target.name} (${target.config.kind}) ${target.targetId}`), ...d.environments.map((env) => `environment ${env.name}${env.protected ? " (protected)" : ""}${env.kind === "preview" ? ` (preview of ${env.branch})` : ""} -> ${env.targetId}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(TargetListResponse, "GET", deployPaths.targets(tenantId, projectId)) };
+  }
+});
+var deployTargetAddCommand = defineCommand({
+  path: ["deploy", "target", "add"],
+  summary: "Add a deploy target with its provider token",
+  description: "Adds a target of kind workers, vercel, netlify or fly. Kind settings come from --set: workers needs scriptName and accountId; vercel needs projectRef (teamId optional); netlify needs siteId; fly needs app (machineId optional). The provider token comes from an environment variable or standard input and goes to the encrypted vault. Storing the provider token is a safety class: it needs an approval from an independent agent (evidence and a reason) or a person first.",
+  args: [{ name: "name", required: true, description: "A name for the target, lowercase letters, digits and dashes" }],
+  flags: [
+    { name: "kind", type: "string", required: true, enum: [...DEPLOY_KINDS], value: "KIND", description: "The provider" },
+    { name: "set", type: "string", multiple: true, value: "KEY=VALUE", description: "A setting for the kind; repeat for more" },
+    { name: "credential-env", type: "string", value: "VAR", description: "Read the provider token from this environment variable" },
+    { name: "stdin", type: "boolean", description: "Read the provider token from standard input" }
+  ],
+  examples: ["overlane deploy target add site --kind workers --set scriptName=site --set accountId=abc123 --credential-env CF_API_TOKEN", "overlane deploy target add web --kind netlify --set siteId=my-site --stdin --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["add deploy target", "connect vercel", "connect netlify", "connect fly", "deploy to workers"],
+  result: withDryRun(TargetResponse),
+  text: (d) => "target" in d ? [`Added ${d.target.name} (${d.target.config.kind}) ${d.target.targetId}. The token is in the vault and is not shown again.`] : [],
+  handler: async (inv) => {
+    const name2 = arg3(inv, 0, "a target name", "overlane deploy target add site --kind workers");
+    const config2 = targetConfig(inv);
+    if (inv.dryRun) {
+      const project = await offlineProject(inv.deps, "deploy");
+      return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method: "POST", path: deployPaths.targets(project.binding.tenantId, project.binding.projectId), body: { name: name2, config: config2, credential: "<hidden>" }, note: "the token is read from the environment or standard input when run for real" }] }));
+    }
+    const credential = await secretFrom(inv, "overlane deploy target add site --kind workers --credential-env CF_API_TOKEN");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(TargetResponse, "POST", deployPaths.targets(tenantId, projectId), { requestId: requestId4(), name: name2, config: config2, credential }) };
+  }
+});
+var deployEnvCreateCommand = defineCommand({
+  path: ["deploy", "env", "create"],
+  summary: "Create an environment on a target",
+  description: "Creates an environment such as staging or production. production and prod are protected by default: a deploy waits for the approval its rule demands, and verified work does not grant it. Pass --protected to protect another one. Creating one is a policy change: under supervised autonomy it waits for approval.",
+  args: [{ name: "name", required: true, description: "The environment name" }],
+  flags: [
+    { name: "target", type: "string", required: true, value: "TARGET", description: "The target it deploys to (name or ID)" },
+    { name: "protected", type: "boolean", description: "Require an approval for every deploy" }
+  ],
+  examples: ["overlane deploy env create staging --target site", "overlane deploy env create canary --target site --protected --dry-run"],
+  effect: "write",
+  ...common3,
+  keywords: ["new environment", "create staging", "protected environment"],
+  result: withDryRun(EnvironmentResponse),
+  text: (d) => "environment" in d ? [`Created ${d.environment.name}${d.environment.protected ? " (protected)" : ""}.`] : [],
+  handler: async (inv) => {
+    const name2 = arg3(inv, 0, "an environment name", "overlane deploy env create staging --target site");
+    const target = textFlag(inv, "target");
+    if (target === void 0) throw new UsageError("--target is required", { hint: "overlane deploy targets" });
+    const body2 = { name: name2, targetId: target, ...boolFlag(inv, "protected") ? { protected: true } : {} };
+    if (inv.dryRun) return planned2(inv, "deploy", "POST", deployPaths.environments, body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(EnvironmentResponse, "POST", deployPaths.environments(tenantId, projectId), body2) };
+  }
+});
+var deployEnvSecretCommand = defineCommand({
+  path: ["deploy", "env", "secret", "set"],
+  summary: "Set a deploy secret for an environment",
+  description: "Stores a secret in the vault for one environment; only its name is recorded on the environment. The value comes from an environment variable or standard input. Values under 8 characters are refused.",
+  args: [{ name: "env", required: true, description: "The environment" }, { name: "name", required: true, description: "The secret name, UPPER_SNAKE_CASE" }],
+  flags: [
+    { name: "from-env", type: "string", value: "VAR", description: "Read the value from this environment variable" },
+    { name: "stdin", type: "boolean", description: "Read the value from standard input" }
+  ],
+  examples: ["overlane deploy env secret set staging API_KEY --from-env STAGING_API_KEY"],
+  effect: "write",
+  ...common3,
+  keywords: ["environment secret", "deploy secret", "set env var secret"],
+  result: withDryRun(external_exports.object({ tenantId: external_exports.string(), environment: external_exports.string(), name: external_exports.string() }).strict()),
+  text: (d) => "name" in d ? [`Set ${d.name} for ${d.environment}.`] : [],
+  handler: async (inv) => {
+    const env = arg3(inv, 0, "an environment", "overlane deploy targets");
+    const name2 = arg3(inv, 1, "a secret name", "overlane deploy env secret set staging API_KEY --from-env API_KEY");
+    if (inv.dryRun) {
+      const project = await offlineProject(inv.deps, "deploy");
+      return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method: "PUT", path: deployPaths.secrets(project.binding.tenantId, project.binding.projectId, env), body: { name: name2, value: "<hidden>" } }] }));
+    }
+    const value = await secretFrom(inv, "overlane deploy env secret set staging API_KEY --from-env API_KEY");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(external_exports.object({ tenantId: external_exports.string(), environment: external_exports.string(), name: external_exports.string() }).strict(), "PUT", deployPaths.secrets(tenantId, projectId, env), { name: name2, value }) };
+  }
+});
+var deployReleasesCommand = defineCommand({
+  path: ["deploy", "releases"],
+  summary: "List releases and which is live in each environment",
+  description: "Lists deploys newest first with status, whether each is live, the commit, who deployed, and the preview or environment URL.",
+  flags: [{ name: "env", type: "string", value: "ENV", description: "Only this environment" }],
+  examples: ["overlane deploy releases", "overlane deploy releases --env production"],
+  effect: "read",
+  ...common3,
+  keywords: ["what is deployed", "deploy history", "release list", "who deployed"],
+  result: ReleaseListResponse,
+  text: (d) => d.releases.length === 0 ? ["No deploys yet."] : d.releases.map(releaseLine),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(ReleaseListResponse, "GET", deployPaths.releases(tenantId, projectId, textFlag(inv, "env"))) };
+  }
+});
+var deployRunCommand = defineCommand({
+  path: ["deploy", "run"],
+  summary: "Deploy a passed CI run's artifact to an environment",
+  description: "Deploys the artifact a passed pipeline run built. The service re-hashes the stored artifact against the digest recorded at build and refuses a changed one (exit 6). Production and protected environments wait for an approval (exit 6, with the command to answer it); a failed provider deploy exits 1 and the previous release keeps serving. Roll back with `overlane deploy rollback`.",
+  flags: [
+    { name: "env", type: "string", required: true, value: "ENV", description: "The environment" },
+    { name: "commit", type: "string", required: true, value: "SHA", description: "The commit the run built" },
+    { name: "run", type: "string", required: true, value: "RUN", description: "The CI run ID" },
+    { name: "artifact", type: "string", value: "NAME", description: "The artifact, when the run produced several" },
+    { name: "expect-digest", type: "string", value: "DIGEST", description: "Refuse unless the recorded artifact digest equals this" },
+    APPROVAL_FLAG
+  ],
+  examples: ["overlane deploy run --env staging --commit 0123456789abcdef0123456789abcdef01234567 --run run_abc123", "overlane deploy run --env production --commit 0123456789abcdef0123456789abcdef01234567 --run run_abc123 --approval apr_1"],
+  effect: "write",
+  ...common3,
+  keywords: ["deploy", "ship to production", "release to staging", "publish build"],
+  result: withDryRun(DeployResponse),
+  text: (d) => "release" in d && d.release !== null ? [releaseLine(d.release), ...d.release.status === "failed" ? [`Failed: ${d.release.error ?? "the provider refused"}. The previous release is still live.`] : [], `evidence: ${d.release.evidenceIds.length} record(s); actor ${d.release.actor.kind}:${d.release.actor.id}`] : [],
+  handler: async (inv) => {
+    const env = textFlag(inv, "env");
+    const commit = textFlag(inv, "commit");
+    const run3 = textFlag(inv, "run");
+    if (env === void 0 || commit === void 0 || run3 === void 0) throw new UsageError("--env, --commit and --run are required", { hint: "overlane deploy run --env staging --commit <sha> --run <run>" });
+    const artifact = textFlag(inv, "artifact");
+    const digest = textFlag(inv, "expect-digest");
+    const body2 = { requestId: requestId4(), environment: env, commitSha: commit, runId: run3, ...artifact === void 0 ? {} : { artifact }, ...digest === void 0 ? {} : { expectedDigest: digest } };
+    if (inv.dryRun) return planned2(inv, "deploy", "POST", deployPaths.deploys, body2, "verifies the artifact digest and asks the guardrail rules before anything is deployed");
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    const result = await call2(DeployResponse, "POST", deployPaths.deploys(tenantId, projectId), body2, approvalHeaders(inv));
+    const exit = deployExit(result.release);
+    return exit === void 0 ? { data: result } : { data: result, exit };
+  }
+});
+var deployPreviewCommand = defineCommand({
+  path: ["deploy", "preview"],
+  summary: "Deploy a branch preview",
+  description: "Makes (or updates) the preview environment for a branch from a passed run on that branch and deploys the artifact to its own preview URL. Previews are never promoted to the live URL and need no approval.",
+  flags: [
+    { name: "branch", type: "string", required: true, value: "BRANCH", description: "The branch" },
+    { name: "target", type: "string", required: true, value: "TARGET", description: "The target (name or ID)" },
+    { name: "commit", type: "string", required: true, value: "SHA", description: "The commit the run built" },
+    { name: "run", type: "string", required: true, value: "RUN", description: "The CI run ID, on that branch" },
+    { name: "artifact", type: "string", value: "NAME", description: "The artifact, when the run produced several" }
+  ],
+  examples: ["overlane deploy preview --branch feature/login --target site --commit 0123456789abcdef0123456789abcdef01234567 --run run_abc123"],
+  effect: "write",
+  ...common3,
+  keywords: ["preview deploy", "branch preview", "preview url", "pr preview"],
+  result: withDryRun(DeployResponse),
+  text: (d) => "release" in d && d.release !== null ? [releaseLine(d.release)] : [],
+  handler: async (inv) => {
+    const branch = textFlag(inv, "branch");
+    const target = textFlag(inv, "target");
+    const commit = textFlag(inv, "commit");
+    const run3 = textFlag(inv, "run");
+    if (branch === void 0 || target === void 0 || commit === void 0 || run3 === void 0) throw new UsageError("--branch, --target, --commit and --run are required", { hint: "overlane deploy preview --branch feature/x --target site --commit <sha> --run <run>" });
+    const artifact = textFlag(inv, "artifact");
+    const body2 = { requestId: requestId4(), branch, targetId: target, commitSha: commit, runId: run3, ...artifact === void 0 ? {} : { artifact } };
+    if (inv.dryRun) return planned2(inv, "deploy", "POST", deployPaths.previews, body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    const result = await call2(DeployResponse, "POST", deployPaths.previews(tenantId, projectId), body2);
+    const exit = deployExit(result.release);
+    return exit === void 0 ? { data: result } : { data: result, exit };
+  }
+});
+var deployRollbackCommand = defineCommand({
+  path: ["deploy", "rollback"],
+  summary: "Restore an environment's previous release",
+  description: "Puts the environment back on its previous release (or --to a named earlier one) in one call, and records who did it and why. The restored release was approved and verified at its own deploy, so a rollback is not held for a new approval. If the provider fails, nothing changes and the current release keeps serving. Needs --force without a terminal.",
+  args: [{ name: "env", required: false, description: "The environment (required)" }],
+  flags: [
+    { name: "reason", type: "string", value: "TEXT", description: "Why; kept in the rollback record (required)" },
+    { name: "to", type: "string", value: "RELEASE", description: "A specific earlier release (default: the previous one)" }
+  ],
+  examples: ['overlane deploy rollback production --reason "checkout is failing" --force', 'overlane deploy rollback staging --reason "bad copy" --dry-run'],
+  effect: "destructive",
+  ...common3,
+  keywords: ["roll back deploy", "revert release", "undo deploy", "restore previous version"],
+  result: withDryRun(RollbackResponse),
+  text: (d) => "rollback" in d ? [`${d.rollback.environment}: ${d.rollback.fromReleaseId} -> ${d.restored.releaseId} by ${d.rollback.actor.kind}:${d.rollback.actor.id}`, `reason: ${d.rollback.reason}`] : [],
+  handler: async (inv) => {
+    const env = arg3(inv, 0, "an environment", "overlane deploy targets");
+    const reason = textFlag(inv, "reason");
+    if (reason === void 0) throw new UsageError("--reason is required", { hint: 'overlane deploy rollback production --reason "why"' });
+    const to = textFlag(inv, "to");
+    const body2 = { requestId: requestId4(), reason, ...to === void 0 ? {} : { toReleaseId: to } };
+    if (inv.dryRun) return planned2(inv, "deploy", "POST", (t, p) => deployPaths.rollback(t, p, env), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
+    return { data: await call2(RollbackResponse, "POST", deployPaths.rollback(tenantId, projectId, env), body2) };
+  }
+});
+var deployCommands = [deployTargetsCommand, deployTargetAddCommand, deployEnvCreateCommand, deployEnvSecretCommand, deployReleasesCommand, deployRunCommand, deployPreviewCommand, deployRollbackCommand];
+
+// ../cli/src/commands/guard.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+var common4 = { needsAuth: true, needsNetwork: true };
+var requestId5 = () => `cli-${randomUUID5()}`;
+async function connected3(inv) {
   const project = await connectedProject(inv.deps, "guard");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned2(inv, method, path, body2, note) {
+async function planned3(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "guard");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
 function readText3(inv, path) {
   try {
-    return readFileSync8(resolve8(inv.deps.paths.cwd, path), "utf8");
+    return readFileSync10(resolve10(inv.deps.paths.cwd, path), "utf8");
   } catch {
     throw new UsageError(`could not read ${path}`, { hint: "overlane guard rules test --file rules.json --tool git.push" });
   }
@@ -60798,12 +62821,12 @@ var guardRulesListCommand = defineCommand({
   description: "Lists the platform rules (always in force), then the team and project rule files and their rules. A rule change is an audit event; every file version is listed with its digest and author.",
   examples: ["overlane guard rules list", "overlane guard rules list --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["guardrails", "policy as code", "rules in force", "protected branches", "what is blocked", "rule files"],
   result: GuardRulesResponse,
   text: (d) => [...d.rules.map((rule) => `${rule.layer.padEnd(8)} ${rule.effect.padEnd(16)} ${rule.id}${rule.dryRun ? "  [dry-run]" : ""}  ${rule.description}`), ...d.files.map((file2) => `file ${file2.layer} v${file2.version} ${file2.digest.slice(0, 19)} by ${file2.author}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(GuardRulesResponse, "GET", `${guardPaths.rules(tenantId)}?projectId=${encodeURIComponent(projectId)}`) };
   }
 });
@@ -60873,7 +62896,7 @@ var guardRulesPutCommand = defineCommand({
   ],
   examples: ['overlane guard rules put --file rules.json --reason "freeze deploys on Fridays"', "overlane guard rules put --file rules.json --layer project --dry-run"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["publish rules", "update guardrails", "change policy", "upload rule file", "freeze deploys"],
   result: withDryRun(GuardRuleFileRecord),
   text: (d) => "version" in d ? [`Published ${d.layer} rule file v${d.version} (${d.ruleCount} rules, ${d.digest.slice(0, 19)}).`] : [],
@@ -60887,12 +62910,12 @@ var guardRulesPutCommand = defineCommand({
       return planOutcome(inv.deps, dryRunPlan({ service: offline.serviceUrl, requests: [{ method: "PUT", path: guardPaths.rules(offline.binding.tenantId), body: { requestId: "<generated>", layer, ...layer === "project" ? { projectId: offline.binding.projectId } : {}, content: `<contents of ${file2}>`, ...reason === void 0 ? {} : { reason } }, note: "the file is validated and scanned for credentials on the server" }] }));
     }
     const content = readText3(inv, file2);
-    const { call: call2, tenantId, projectId } = await connected2(inv);
-    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId4(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
+    const { call: call2, tenantId, projectId } = await connected3(inv);
+    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId5(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
   }
 });
 async function evaluate(inv, dryRun) {
-  const { call: call2, tenantId, projectId } = await connected2(inv);
+  const { call: call2, tenantId, projectId } = await connected3(inv);
   const contentFile = textFlag(inv, "content-file");
   const body2 = {
     ...actionOf(inv),
@@ -60918,12 +62941,12 @@ var guardCheckCommand = defineCommand({
   flags: [...DECISION_FLAGS, { name: "approval", type: "string", value: "ID", description: "An approval that covers exactly this action" }],
   examples: ["overlane guard check --tool git.push --branch main --task held", 'overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-run'],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["check action", "pre push check", "ci gate", "is this allowed", "approval required", "blocked by policy"],
   result: withDryRun(GuardEvaluateResponse),
   text: (d) => "decision" in d ? describeDecision(d.decision) : [],
   handler: async (inv) => {
-    if (inv.dryRun) return planned2(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
+    if (inv.dryRun) return planned3(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
     const reply = await evaluate(inv, false);
     return reply.decision.allowed ? { data: reply } : refusalOutcome(reply, reply.decision);
   }
@@ -60935,7 +62958,7 @@ var guardDryRunCommand = defineCommand({
   flags: DECISION_FLAGS,
   examples: ["overlane guard dry-run --tool git.push --branch main --task held", "overlane guard dry-run --tool egress.fetch --host registry.example.com --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["dry run rules", "what would block", "test policy", "simulate", "would be refused"],
   result: GuardEvaluateResponse,
   text: (d) => describeDecision(d.decision),
@@ -60951,14 +62974,14 @@ var guardScanCommand = defineCommand({
   ],
   examples: ["overlane guard scan --path src/config.ts", "overlane guard scan --path ci.log --source log --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["secret scan", "find credentials", "leaked key", "push protection", "scan file"],
   result: SecretScanResult,
   text: (d) => d.findings.length === 0 ? ["No credentials found."] : d.findings.map((finding) => `${finding.disposition.padEnd(8)} ${finding.rule}${finding.path === void 0 ? "" : ` ${finding.path}`}${finding.line === void 0 ? "" : `:${finding.line}`}`),
   handler: async (inv) => {
     const path = textFlag(inv, "path");
     if (path === void 0) throw new UsageError("scan needs --path", { hint: "overlane guard scan --path src/config.ts" });
-    const { call: call2, tenantId } = await connected2(inv);
+    const { call: call2, tenantId } = await connected3(inv);
     const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText3(inv, path), path });
     return result.blocked ? { data: result, exit: EXIT.blocked, error: new CliError("a credential was found; nothing should be pushed until it is removed and rotated", { code: "secret_detected", exit: EXIT.blocked, hint: "overlane guard scan --path <file>" }) } : { data: result };
   }
@@ -60971,12 +62994,12 @@ var guardApprovalsListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["pending", "approved", "denied"], description: "Only approvals with this status" }],
   examples: ["overlane guard approvals list", "overlane guard approvals list --status pending --json"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["pending approvals", "approve before write", "who needs to approve", "approval queue"],
   result: ApprovalList2,
   text: (d) => d.approvals.length === 0 ? ["No approvals."] : d.approvals.flatMap((a) => [`${a.status.padEnd(9)} ${a.id}  ${a.tool}  by ${a.requestedBy}  (rule ${a.ruleId})`, `  ${a.summary}`]),
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected2(inv);
+    const { call: call2, tenantId } = await connected3(inv);
     const status = textFlag(inv, "status");
     return { data: await call2(ApprovalList2, "GET", `${guardPaths.approvals(tenantId)}${status === void 0 ? "" : `?status=${status}`}`) };
   }
@@ -60993,7 +63016,7 @@ var guardApprovalsAnswerCommand = defineCommand({
   ],
   examples: ["overlane guard approvals answer apr_1 --decision approve", 'overlane guard approvals answer apr_1 --decision approve --evidence "diff reviewed" --reason "matches the task" --dry-run'],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["approve action", "deny action", "answer approval", "allow push", "sign off"],
   result: withDryRun(GuardApproval),
   text: (d) => "status" in d ? [`${d.id} is ${d.status}.`] : [],
@@ -61004,8 +63027,8 @@ var guardApprovalsAnswerCommand = defineCommand({
     const evidence = listFlag(inv, "evidence");
     const parsed = AnswerGuardApprovalRequest.safeParse({ decision: textFlag(inv, "decision"), ...reason === void 0 ? {} : { reason }, ...evidence.length === 0 ? {} : { evidence } });
     if (!parsed.success) throw new UsageError("--decision must be approve or deny", { hint: `overlane guard approvals answer ${approvalId} --decision approve` });
-    if (inv.dryRun) return planned2(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
-    const { call: call2, tenantId } = await connected2(inv);
+    if (inv.dryRun) return planned3(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
+    const { call: call2, tenantId } = await connected3(inv);
     return { data: await call2(GuardApproval, "POST", guardPaths.answer(tenantId, approvalId), parsed.data) };
   }
 });
@@ -61014,10 +63037,10 @@ var guardCommands = [guardRulesListCommand, guardRulesTestCommand, guardRulesPut
 // ../cli/src/commands/memory.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 var SERVICE_FLAG3 = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG3 = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
-var common4 = { needsAuth: true, needsNetwork: true };
+var common5 = { needsAuth: true, needsNetwork: true };
 async function authed3(inv) {
   const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const token = await requireToken(inv.deps, target.storeKey);
@@ -61036,7 +63059,7 @@ async function plan2(inv, method, path, body2, note) {
   const tenant = textFlag(inv, "team") ?? ":your-team";
   return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
-var requestId5 = () => `cli-${randomUUID5()}`;
+var requestId6 = () => `cli-${randomUUID6()}`;
 var memorySearchCommand = defineCommand({
   path: ["memory", "search"],
   summary: "Search memory across project, team, user and global scopes",
@@ -61051,7 +63074,7 @@ var memorySearchCommand = defineCommand({
   ],
   examples: ['overlane memory search "how do we deploy"', 'overlane memory search "indentation" --scope team --json'],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["recall", "remember", "what do we know", "find memory", "lookup", "notes", "conventions", "decisions"],
   result: MemorySearchResponse,
   text: (d) => d.items.length === 0 ? ["No memories match."] : d.items.map((i2) => `${i2.scope.padEnd(7)} ${i2.status.padEnd(9)} ${i2.id}  ${i2.title}${i2.stale ? "  [stale]" : ""}${i2.overriddenBy === null ? "" : `  [overridden by ${i2.overriddenBy}]`}`),
@@ -61085,7 +63108,7 @@ var memoryAddCommand = defineCommand({
   ],
   examples: ['overlane memory add --title "Deploy day" "Deploys go out on Tuesdays" --project prj_1', 'overlane memory add --title "Editor" --scope user "I prefer a dark theme" --dry-run'],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["remember this", "save a note", "record a decision", "store convention", "candidate"],
   result: AddResult,
   handler: async (inv) => {
@@ -61093,7 +63116,7 @@ var memoryAddCommand = defineCommand({
     if (title === void 0) throw new UsageError("add needs --title", { hint: 'overlane memory add --title "..." "<text>"' });
     const project = textFlag(inv, "project");
     const parsed = MemoryCandidate.safeParse({
-      requestId: requestId5(),
+      requestId: requestId6(),
       scope: textFlag(inv, "scope") ?? "project",
       ...project === void 0 ? {} : { projectId: project },
       category: textFlag(inv, "category") ?? "fact",
@@ -61124,7 +63147,7 @@ var memoryConfirmCommand = defineCommand({
   ],
   examples: ["overlane memory confirm mem_ab12", "overlane memory confirm mem_ab12 --basis ci_evidence --evidence 0123abc:unit_tests --dry-run"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["approve memory", "verify", "promote candidate", "second observer", "ci evidence"],
   result: ConfirmResult,
   handler: async (inv) => {
@@ -61148,7 +63171,7 @@ var memoryPromoteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3, { name: "to", type: "string", enum: ["team", "global"], default: "team", description: "Where to promote it" }],
   examples: ["overlane memory promote mem_ab12 --to team", "overlane memory promote mem_cd34 --to global --dry-run"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["share with team", "contribute", "global memory", "make team wide"],
   result: withDryRun(MemoryPromoteResponse),
   handler: async (inv) => {
@@ -61176,7 +63199,7 @@ var memoryExportCommand = defineCommand({
   ],
   examples: ["overlane memory export --json", "overlane memory export --scope user --user usr_1 --json"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["download memory", "backup", "data portability", "gdpr", "subject access"],
   result: MemoryExportRecord,
   text: (d) => [`${d.items.length} memories exported at ${d.exportedAt}. Use --json for the full content.`],
@@ -61200,7 +63223,7 @@ var memoryDeleteCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory delete mem_ab12 --force", "overlane memory delete mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common4,
+  ...common5,
   keywords: ["remove memory", "forget", "erase", "wrong memory", "gdpr deletion"],
   result: withDryRun(MemoryDeleteResponse),
   handler: async (inv) => {
@@ -61221,7 +63244,7 @@ var memoryUnlearnCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory unlearn mem_ab12 --force", "overlane memory unlearn mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common4,
+  ...common5,
   keywords: ["unlearn", "forget everything derived", "retract", "poisoned memory", "bad memory"],
   result: withDryRun(MemoryUnlearnRecord),
   handler: async (inv) => {
@@ -61241,7 +63264,7 @@ var memoryStatusCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory status", "overlane memory status --json"],
   effect: "read",
-  ...common4,
+  ...common5,
   keywords: ["memory health", "stale memory", "how many memories", "contribution", "opt in"],
   result: MemoryStatusResponse,
   text: (d) => [...Object.entries(d.counts).map(([key, n]) => `${key}: ${n}`), `stale: ${d.stale}`, `global contribution: ${d.settings.globalContribution ? "on" : "off"}`, `pending jobs: ${d.pendingJobs}`],
@@ -61259,7 +63282,7 @@ var memoryContributionCommand = defineCommand({
   flags: [SERVICE_FLAG3, TEAM_FLAG3],
   examples: ["overlane memory contribution on", "overlane memory contribution off --dry-run"],
   effect: "write",
-  ...common4,
+  ...common5,
   keywords: ["opt in", "opt out", "share patterns", "global pool", "contribute"],
   result: withDryRun(MemorySettings),
   handler: async (inv) => {
@@ -61279,10 +63302,10 @@ var memoryCommands = [memorySearchCommand, memoryAddCommand, memoryConfirmComman
 // ../cli/src/commands/issue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID6 } from "node:crypto";
-import { readFileSync as readFileSync9 } from "node:fs";
-var common5 = { needsAuth: true, needsNetwork: true };
-var requestId6 = () => `cli-${randomUUID6()}`;
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { readFileSync as readFileSync11 } from "node:fs";
+var common6 = { needsAuth: true, needsNetwork: true };
+var requestId7 = () => `cli-${randomUUID7()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var STATUSES = ["backlog", "todo", "in_progress", "in_review", "cancelled"];
 async function send(deps, label, schema, method, path, body2, dryRun) {
@@ -61319,7 +63342,7 @@ var issueListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["backlog", "todo", "in_progress", "in_review", "done", "cancelled"], description: "Only issues in this status" }],
   examples: ["overlane issue list", "overlane issue list --status todo --json"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["issues", "backlog", "tickets", "work items", "what is open", "list issues"],
   result: external_exports.object({ issues: external_exports.array(IssueShown) }),
   handler: async (inv) => {
@@ -61340,7 +63363,7 @@ var issueShowCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID, for example iss_ab12cd34ef56gh78" }],
   examples: ["overlane issue show iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["issue details", "ticket", "view issue", "who is working on"],
   result: IssueShown,
   handler: async (inv) => {
@@ -61363,7 +63386,7 @@ var issueEventsCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID" }],
   examples: ["overlane issue events iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["audit", "history", "who changed", "field changes", "issue log"],
   result: IssueEventList,
   handler: async (inv) => {
@@ -61388,12 +63411,12 @@ var issueNewCommand = defineCommand({
   ],
   examples: ['overlane issue new "Back-time drifts by a second"', 'overlane issue new "Fix export" --priority P0 --description "Fails on empty notes"'],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["create issue", "new issue", "file a ticket", "add work item", "report bug"],
   result: withDryRun(Issue),
   handler: async (inv) => {
     const estimate = textFlag(inv, "estimate");
-    const body2 = { requestId: requestId6(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
+    const body2 = { requestId: requestId7(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
     const result = await send(inv.deps, "issue", Issue, "POST", issuePaths.issues, body2, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Created #${result.value.number} ${result.value.issueId}`);
     return result;
@@ -61413,7 +63436,7 @@ var issueUpdateCommand = defineCommand({
   ],
   examples: ["overlane issue update iss_ab12cd34ef56gh78 --priority P0", 'overlane issue update iss_ab12cd34ef56gh78 --status in_progress --title "New title"'],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["edit issue", "change status", "change priority", "rename issue", "update ticket"],
   result: withDryRun(Issue),
   handler: async (inv) => {
@@ -61421,7 +63444,7 @@ var issueUpdateCommand = defineCommand({
     if (id2 === void 0) throw new UsageError("update needs an ISSUE_ID");
     const estimate = textFlag(inv, "estimate");
     const body2 = {
-      requestId: requestId6(),
+      requestId: requestId7(),
       ...textFlag(inv, "title") === void 0 ? {} : { title: textFlag(inv, "title") },
       ...textFlag(inv, "description") === void 0 ? {} : { description: textFlag(inv, "description") },
       ...textFlag(inv, "status") === void 0 ? {} : { status: textFlag(inv, "status") },
@@ -61442,14 +63465,14 @@ var issueAssignCommand = defineCommand({
   ],
   examples: ["overlane issue assign iss_ab12cd34ef56gh78 agent:claude-code", "overlane issue assign iss_ab12cd34ef56gh78 none"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["assign", "give to agent", "hand to bot", "delegate", "who works on this", "unassign"],
   result: withDryRun(AssignResult),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("assign needs an ISSUE_ID and an assignee");
     const assignee = parseAssignee(inv.positionals[1]);
-    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId6(), assignee }, inv.dryRun);
+    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId7(), assignee }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, result.value.taskId === null ? "Assigned." : `Assigned. Task: ${result.value.taskId}${result.value.createdTask ? " (new)" : ""}`);
     return result;
   }
@@ -61465,7 +63488,7 @@ var issueImportCommand = defineCommand({
   flags: [{ name: "preview", type: "boolean", description: "Report what the import would create or update, and write nothing" }],
   examples: ["overlane issue import linear ./linear-export.json --preview", "overlane issue import jira ./jira-search.json"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["import", "migrate from linear", "migrate from jira", "github projects import", "bring issues in"],
   result: withDryRun(ImportReport),
   handler: async (inv) => {
@@ -61474,11 +63497,11 @@ var issueImportCommand = defineCommand({
     if (file2 === void 0) throw new UsageError("import needs the path of the export file");
     let data;
     try {
-      data = JSON.parse(readFileSync9(file2, "utf8"));
+      data = JSON.parse(readFileSync11(file2, "utf8"));
     } catch {
       throw new UsageError(`${file2} is not a readable JSON file`);
     }
-    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId6(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
+    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId7(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
     if (result.value !== void 0) {
       const r = result.value;
       say(inv.deps, `${r.dryRun ? "Would import" : "Imported"} from ${r.source}: ${r.created} new, ${r.updated} updated, ${r.unchanged} unchanged, ${r.skipped.length} skipped.`);
@@ -61492,7 +63515,7 @@ var issueSyncCommand = defineCommand({
   description: "Overlane issues work with no sync; syncing with GitHub is optional. Shows the repository and mode: off (default), read_only (GitHub changes flow in, nothing is written to GitHub) or write_back (switched on with `overlane issue sync set`).",
   examples: ["overlane issue sync"],
   effect: "read",
-  ...common5,
+  ...common6,
   keywords: ["github sync", "sync status", "two-way sync", "write back"],
   result: SyncConfig,
   handler: async (inv) => {
@@ -61512,13 +63535,13 @@ var issueSyncSetCommand = defineCommand({
   ],
   examples: ["overlane issue sync set acme/app read_only", "overlane issue sync set acme/app off"],
   effect: "write",
-  ...common5,
+  ...common6,
   keywords: ["enable github sync", "write back", "turn off sync", "read only sync"],
   result: withDryRun(SyncConfig),
   handler: async (inv) => {
     const [repository, mode] = inv.positionals;
     if (repository === void 0 || mode === void 0) throw new UsageError("sync set needs REPOSITORY and MODE");
-    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId6(), repository, mode }, inv.dryRun);
+    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId7(), repository, mode }, inv.dryRun);
   }
 });
 var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, issueNewCommand, issueUpdateCommand, issueAssignCommand, issueImportCommand, issueSyncCommand, issueSyncSetCommand];
@@ -61526,7 +63549,7 @@ var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, iss
 // ../cli/src/commands/issue-views.ts
 init_src();
 init_zod();
-var common6 = { needsAuth: true, needsNetwork: true };
+var common7 = { needsAuth: true, needsNetwork: true };
 var Deleted = external_exports.object({ deleted: external_exports.literal(true) });
 var FIELDS = ["status", "priority", "assigneeType", "assignee", "labelId", "workProjectId", "cycleId", "estimate", "source", "title", "number", "createdAt", "updatedAt"];
 function parseCondition(text) {
@@ -61542,7 +63565,7 @@ var viewListCommand = defineCommand({
   description: "Lists saved views: a filter plus a group-by and sort over any issue field.",
   examples: ["overlane view list"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["saved views", "filters", "board", "group by"],
   result: ViewList,
   handler: async (inv) => {
@@ -61560,7 +63583,7 @@ var viewRunCommand = defineCommand({
   args: [{ name: "view-id", required: true, description: "The saved view ID" }],
   examples: ["overlane view run viw_ab12cd34ef56gh78"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["run view", "show board", "group issues"],
   result: ViewResult,
   handler: async (inv) => {
@@ -61588,12 +63611,12 @@ var viewNewCommand = defineCommand({
   ],
   examples: ["overlane view new Urgent --filter priority=P0 --group-by status", 'overlane view new "Agent work" --filter assigneeType=agent --group-by status'],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["create view", "save filter", "board", "group by status"],
   result: withDryRun(SavedView),
   handler: async (inv) => {
     const definition = { filter: listFlag(inv, "filter").map(parseCondition), groupBy: textFlag(inv, "group-by") ?? null, sortBy: textFlag(inv, "sort-by") ?? "number", sortDirection: boolFlag(inv, "desc") ? "desc" : "asc" };
-    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId6(), name: inv.positionals.join(" "), definition }, inv.dryRun);
+    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId7(), name: inv.positionals.join(" "), definition }, inv.dryRun);
   }
 });
 var viewDeleteCommand = defineCommand({
@@ -61603,7 +63626,7 @@ var viewDeleteCommand = defineCommand({
   args: [{ name: "view-id", required: false, description: "The saved view ID (required; checked after the --force confirmation)" }],
   examples: ["overlane view delete viw_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common6,
+  ...common7,
   keywords: ["remove view", "delete filter"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -61618,7 +63641,7 @@ var loopListCommand = defineCommand({
   description: "Lists loops: a trigger (schedule or event), a filter over issues and the executor they dispatch.",
   examples: ["overlane loop list"],
   effect: "read",
-  ...common6,
+  ...common7,
   keywords: ["loops", "scheduled work", "recurring", "automation"],
   result: LoopList,
   handler: async (inv) => {
@@ -61642,7 +63665,7 @@ var loopNewCommand = defineCommand({
   ],
   examples: ["overlane loop new Nightly --every 1440 --filter priority=P0", "overlane loop new OnAssign --on issue.assigned"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["schedule agent", "recurring work", "event trigger", "automation", "nightly"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
@@ -61650,7 +63673,7 @@ var loopNewCommand = defineCommand({
     const on = textFlag(inv, "on");
     if (every === void 0 === (on === void 0)) throw new UsageError("pass exactly one of --every MINUTES or --on EVENT");
     const trigger = every !== void 0 ? { kind: "schedule", everyMinutes: Number(every) } : { kind: "event", on };
-    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId6(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId7(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
   }
 });
 var loopSetCommand = defineCommand({
@@ -61663,13 +63686,13 @@ var loopSetCommand = defineCommand({
   ],
   examples: ["overlane loop set lop_ab12cd34ef56gh78 off"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["disable loop", "enable loop", "stop schedule"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
     const [id2, state] = inv.positionals;
     if (id2 === void 0 || state !== "on" && state !== "off") throw new UsageError("set needs a LOOP_ID and on or off");
-    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId6(), enabled: state === "on" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId7(), enabled: state === "on" }, inv.dryRun);
   }
 });
 var loopFireCommand = defineCommand({
@@ -61679,13 +63702,13 @@ var loopFireCommand = defineCommand({
   args: [{ name: "loop-id", required: true, description: "The loop ID" }],
   examples: ["overlane loop fire lop_ab12cd34ef56gh78"],
   effect: "write",
-  ...common6,
+  ...common7,
   keywords: ["run loop", "trigger loop", "dispatch agent"],
   result: withDryRun(LoopRun),
   handler: async (inv) => {
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("fire needs a LOOP_ID");
-    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId6(), trigger: "schedule" }, inv.dryRun);
+    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId7(), trigger: "schedule" }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Loop run ${result.value.runId ?? "(none)"}: ${result.value.claimed.length} claimed, stopped: ${result.value.stopReason}.`);
     return result;
   }
@@ -61697,7 +63720,7 @@ var loopDeleteCommand = defineCommand({
   args: [{ name: "loop-id", required: false, description: "The loop ID (required; checked after the --force confirmation)" }],
   examples: ["overlane loop delete lop_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common6,
+  ...common7,
   keywords: ["remove loop", "delete schedule"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
@@ -61711,15 +63734,15 @@ var loopCommands = [loopListCommand, loopNewCommand, loopSetCommand, loopFireCom
 
 // ../cli/src/commands/review.ts
 init_src();
-import { randomUUID as randomUUID7 } from "node:crypto";
-import { resolve as resolve9 } from "node:path";
-var common7 = { needsAuth: true, needsNetwork: true };
-var requestId7 = () => `cli-${randomUUID7()}`;
-async function connected3(inv) {
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { resolve as resolve11 } from "node:path";
+var common8 = { needsAuth: true, needsNetwork: true };
+var requestId8 = () => `cli-${randomUUID8()}`;
+async function connected4(inv) {
   const project = await connectedProject(inv.deps, "review");
   return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned3(inv, method, path, body2, note) {
+async function planned4(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "review");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -61747,7 +63770,7 @@ async function diffOf(inv) {
       text = await inv.deps.stdin.read();
     } else {
       from = flag;
-      text = readText(resolve9(inv.deps.paths.cwd, flag));
+      text = readText(resolve11(inv.deps.paths.cwd, flag));
       if (text === null) throw new UsageError(`could not read the diff file ${flag}`, { hint: "git diff > change.patch && overlane review run --diff change.patch" });
     }
   } else if (pull === void 0) {
@@ -61782,7 +63805,7 @@ var reviewRunCommand = defineCommand({
   ],
   examples: ["overlane review run --diff change.patch", "overlane review run --diff -", "overlane review run 7 --repo acme/app --dry-run"],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["code review", "review diff", "review patch", "review pull request", "review pr", "check my pr", "findings"],
   result: withDryRun(ReviewRunResponse),
   text: (d) => "run" in d ? [`${d.run.status} review of ${d.run.repository}#${d.run.pullNumber} (${d.run.mode}${d.run.posted ? ", posted" : ", nothing posted"}): ${d.run.findings.open} open, ${d.run.findings.fixed} fixed, ${d.run.findings.dismissed} dismissed.`, ...d.findings.filter((finding) => finding.status === "open").map(FINDING_LINE)] : [],
@@ -61792,9 +63815,9 @@ var reviewRunCommand = defineCommand({
       const title = textFlag(inv, "title");
       const label = textFlag(inv, "label");
       const source = { kind: "patch", diff: diff.text, ...title === void 0 ? {} : { title }, ...label === void 0 ? {} : { label } };
-      const patchBody = { requestId: requestId7(), trigger: "manual", source };
-      if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, { ...patchBody, source: { ...source, diff: `<${diff.text.length} characters from ${diff.from}>` } }, "runs the deterministic checks on the diff, then an optional model pass; nothing is posted");
-      const sent = await connected3(inv);
+      const patchBody = { requestId: requestId8(), trigger: "manual", source };
+      if (inv.dryRun) return planned4(inv, "POST", reviewPaths.runs, { ...patchBody, source: { ...source, diff: `<${diff.text.length} characters from ${diff.from}>` } }, "runs the deterministic checks on the diff, then an optional model pass; nothing is posted");
+      const sent = await connected4(inv);
       const patched = await sent.call(ReviewRunResponse, "POST", reviewPaths.runs(sent.tenantId, sent.projectId), patchBody);
       if (patched.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
       return { data: patched };
@@ -61802,9 +63825,9 @@ var reviewRunCommand = defineCommand({
     const number4 = Number(inv.positionals[0]);
     if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number, or a diff with --diff", { hint: "overlane review run --diff change.patch" });
     const repository = await repositoryOf(inv);
-    const body2 = { requestId: requestId7(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
-    if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub connection and runs the review");
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const body2 = { requestId: requestId8(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
+    if (inv.dryRun) return planned4(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub connection and runs the review");
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     const result = await call2(ReviewRunResponse, "POST", reviewPaths.runs(tenantId, projectId), body2);
     if (result.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
     return { data: result };
@@ -61816,12 +63839,12 @@ var reviewStatusCommand = defineCommand({
   description: "Shows whether review posts comments or is log-only, the token cap, the latest runs and the number of open findings. States the data-use terms: diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review status", "overlane review status --json"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["review mode", "log only", "review settings", "recent reviews", "how is review doing"],
   result: ReviewStatusResponse,
   text: (d) => [`Review mode: ${d.settings.mode}. Token cap per pull request: ${d.settings.tokenCap}. Open findings: ${d.openFindings}.`, d.settings.privacy, ...d.runs.slice(0, 5).map((run3) => `${run3.startedAt}  ${run3.repository}#${run3.pullNumber}  ${run3.status}  ${run3.tokensUsed} tokens  ${run3.model}`)],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(ReviewStatusResponse, "GET", reviewPaths.status(tenantId, projectId)) };
   }
 });
@@ -61836,12 +63859,12 @@ var reviewFindingsCommand = defineCommand({
   ],
   examples: ["overlane review findings --status open", "overlane review findings --pull 7 --json"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["list findings", "open comments", "review comments", "what did review find", "defects"],
   result: ReviewFindingsResponse,
   text: (d) => d.findings.length === 0 ? ["No findings."] : d.findings.map(FINDING_LINE),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     const params = new URLSearchParams();
     for (const name2 of ["pull", "repo", "status"]) {
       const value = textFlag(inv, name2);
@@ -61862,16 +63885,16 @@ var reviewDismissCommand = defineCommand({
   ],
   examples: ['overlane review dismiss fnd_1 --note "intended"', "overlane review dismiss fnd_2 --accept"],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["dismiss finding", "ignore comment", "false positive", "accept finding", "teach reviewer", "feedback"],
   result: withDryRun(FeedbackResponse),
   text: (d) => "finding" in d ? [`${d.finding.id} is ${d.finding.status}.${d.learned === null ? "" : ` Learned: ${d.learned.direction} ${d.learned.rule} (${d.learned.evidence} reviews).`}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "dismiss");
     const note = textFlag(inv, "note");
-    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId7() };
-    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId8() };
+    if (inv.dryRun) return planned4(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(FeedbackResponse, "POST", reviewPaths.feedback(tenantId, projectId, findingId), body2) };
   }
 });
@@ -61883,16 +63906,16 @@ var reviewAutofixCommand = defineCommand({
   flags: [{ name: "assign", type: "string", value: "AGENT", description: "The agent or bot to assign, for example agent:fixer" }],
   examples: ["overlane review autofix fnd_1", "overlane review autofix fnd_1 --assign agent:fixer --dry-run"],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["auto fix", "autofix", "fix finding", "create task from finding", "assign to agent"],
   result: withDryRun(AutofixResponse),
   text: (d) => "taskId" in d ? [`Task ${d.taskId} created${d.assignee === null ? "" : ` for ${d.assignee}`}. Start it with: overlane task start ${d.taskId}`] : [],
   handler: async (inv) => {
     const findingId = id(inv, "autofix");
     const assignee = textFlag(inv, "assign");
-    const body2 = { requestId: requestId7(), ...assignee === void 0 ? {} : { assignee } };
-    if (inv.dryRun) return planned3(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const body2 = { requestId: requestId8(), ...assignee === void 0 ? {} : { assignee } };
+    if (inv.dryRun) return planned4(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(AutofixResponse, "POST", reviewPaths.autofix(tenantId, projectId, findingId), body2) };
   }
 });
@@ -61902,12 +63925,12 @@ var reviewSettingsCommand = defineCommand({
   description: "Shows the mode (log-only until comments are enabled), the per-PR token cap, extra skip patterns and the statement that diffs go to model providers only under terms that exclude training.",
   examples: ["overlane review settings"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["review configuration", "token cap", "skip patterns", "privacy", "no training", "data use"],
   result: ReviewSettings,
   text: (d) => [`Mode: ${d.mode}. Token cap: ${d.tokenCap}. Extra skip patterns: ${d.skipPatterns.length === 0 ? "none" : d.skipPatterns.join(", ")}.`, d.privacy],
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(ReviewSettings, "GET", reviewPaths.settings(tenantId, projectId)) };
   }
 });
@@ -61922,7 +63945,7 @@ var reviewSettingsSetCommand = defineCommand({
   ],
   examples: ["overlane review settings set --mode comments", "overlane review settings set --token-cap 40000 --skip 'docs/**' --dry-run"],
   effect: "write",
-  ...common7,
+  ...common8,
   keywords: ["enable review comments", "turn on review", "log only", "set token cap", "skip files"],
   result: withDryRun(ReviewSettings),
   text: (d) => "mode" in d ? [`Review is ${d.mode}. Token cap ${d.tokenCap}.`] : [],
@@ -61936,8 +63959,8 @@ var reviewSettingsSetCommand = defineCommand({
     });
     if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "), { hint: "overlane review settings set --mode comments" });
     if (Object.keys(parsed.data).length === 0) throw new UsageError("nothing to change", { hint: "overlane review settings set --mode comments" });
-    if (inv.dryRun) return planned3(inv, "PUT", reviewPaths.settings, parsed.data);
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    if (inv.dryRun) return planned4(inv, "PUT", reviewPaths.settings, parsed.data);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(ReviewSettings, "PUT", reviewPaths.settings(tenantId, projectId), parsed.data) };
   }
 });
@@ -61947,12 +63970,12 @@ var codeMapStatusCommand = defineCommand({
   description: "Lists every supported client in its local and cloud setting, and the bots, review service, cross-repository questions and wiki, with whether the code map is on and the reason. The default for a setting follows the latest GATE-07 result for that setting: off for a local agent with grep (the local run failed, ADR 0018), on where there is no checkout until a re-run says otherwise.",
   examples: ["overlane code-map status", "overlane code-map status --json"],
   effect: "read",
-  ...common7,
+  ...common8,
   keywords: ["code map", "code tools", "is the code map on", "gate-07", "code layer", "per client"],
   result: CodeMapStatus,
   text: (d) => d.clients.map((row) => `${row.on ? "on " : "off"}  ${row.subject}: ${row.reason}`),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected3(inv);
+    const { call: call2, tenantId, projectId } = await connected4(inv);
     return { data: await call2(CodeMapStatus, "GET", codeMapPaths.status(tenantId, projectId)) };
   }
 });
@@ -61967,9 +63990,9 @@ function flagUsage(flag) {
   const repeated = flag.multiple === true ? "..." : "";
   return flag.required === true ? `${body2}${repeated}` : `[${body2}${repeated}]`;
 }
-function argUsage(arg) {
-  const name2 = `${arg.name}${arg.variadic === true ? "..." : ""}`;
-  return arg.required ? name2 : `[${name2}]`;
+function argUsage(arg4) {
+  const name2 = `${arg4.name}${arg4.variadic === true ? "..." : ""}`;
+  return arg4.required ? name2 : `[${name2}]`;
 }
 function usageLine(spec, compact = false) {
   const flags2 = compact ? spec.flags.filter((flag) => flag.name !== "dry-run" && flag.name !== "force") : spec.flags;
@@ -61980,7 +64003,7 @@ function commandHelp(spec) {
   const lines = [`overlane ${commandName(spec)} - ${spec.summary}`, "", spec.description, "", "Usage:", `  ${usageLine(spec)}`];
   if (spec.args.length > 0) {
     lines.push("", "Arguments:");
-    for (const arg of spec.args) lines.push(`  ${arg.name}${arg.variadic === true ? "..." : ""}${arg.required ? "" : " (optional)"}  ${arg.description}`);
+    for (const arg4 of spec.args) lines.push(`  ${arg4.name}${arg4.variadic === true ? "..." : ""}${arg4.required ? "" : " (optional)"}  ${arg4.description}`);
   }
   if (spec.flags.length > 0) {
     lines.push("", "Flags:");
@@ -62175,7 +64198,7 @@ function schemaOf(spec) {
     needsAuth: spec.needsAuth,
     needsNetwork: spec.needsNetwork,
     safety: { dryRun: spec.flags.some((flag) => flag.name === "dry-run"), force: spec.flags.some((flag) => flag.name === "force") },
-    args: spec.args.map((arg) => ({ name: arg.name, required: arg.required, variadic: arg.variadic === true, description: arg.description })),
+    args: spec.args.map((arg4) => ({ name: arg4.name, required: arg4.required, variadic: arg4.variadic === true, description: arg4.description })),
     flags: spec.flags.map((flag) => ({
       name: `--${flag.name}`,
       type: flag.type,
@@ -62456,7 +64479,7 @@ async function disconnect(deps, options) {
 }
 
 // ../cli/src/doctor.ts
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 init_zod();
 var DoctorResult = external_exports.object({
   project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
@@ -62476,7 +64499,7 @@ async function doctor(deps, options) {
   const root = project.root;
   const binding = readBindingFile(root);
   const owned = readOwned(root);
-  const marketplaceRoot2 = resolve10(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
+  const marketplaceRoot2 = resolve12(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
   const infos = await detectAgents(deps, options.agents, root);
   let service = "reachable";
   let hasToken = false;
@@ -62536,7 +64559,7 @@ async function doctor(deps, options) {
 
 // ../cli/src/kit/setup.ts
 init_src();
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
 import { join as join22 } from "node:path";
 
@@ -62753,11 +64776,11 @@ async function connectKit(deps, options) {
   const agentConfig = [join22(".claude", "settings.json"), join22(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
   const preExisting = new Set(agentConfig.filter((file2) => existsSync6(join22(root, file2))));
-  const connected4 = await connect(deps, { ...options, yes: true });
-  if (connected4.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const connected5 = await connect(deps, { ...options, yes: true });
+  if (connected5.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected4.data !== void 0 && !("dryRun" in connected4.data) ? connected4.data : void 0;
+  const connectData = connected5.data !== void 0 && !("dryRun" in connected5.data) ? connected5.data : void 0;
   for (const file2 of agentConfig) {
     if (!existsSync6(join22(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
@@ -62776,7 +64799,7 @@ async function connectKit(deps, options) {
   const kit = kitClient(deps, serviceUrl, binding.binding, token.token);
   await kit.putPolicy({ ...DEFAULT_RUN_POLICY, buildAheadLimit: firstMilestone });
   say(deps, `Run policy set (build-ahead limit ${firstMilestone}).`);
-  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID8()}`, sourceCommit: sha, plan: await readPlan(root) }));
+  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID9()}`, sourceCommit: sha, plan: await readPlan(root) }));
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
   const pr = await openPullRequest(deps, root, project.name);
   say(deps);
@@ -63064,7 +65087,7 @@ var ReleaseRollbackResult = external_exports.union([
 ]);
 
 // ../cli/src/commands/release.ts
-var common8 = { needsAuth: true, needsNetwork: true };
+var common9 = { needsAuth: true, needsNetwork: true };
 var APPROVE = { name: "approve", type: "string", value: "DIGEST", description: "Approve this exact release digest when it changes executable files or policy" };
 var releaseListCommand = defineCommand({
   path: ["release", "list"],
@@ -63072,7 +65095,7 @@ var releaseListCommand = defineCommand({
   description: "Lists releases with version, short digest, channel, change kinds, restart rule, compatibility and which projects pin them.",
   examples: ["overlane release list"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["releases", "versions", "available", "published", "what versions", "all releases"],
   result: ReleaseListResult,
   handler: async (inv) => listReleases(inv.deps)
@@ -63083,7 +65106,7 @@ var releaseStatusCommand = defineCommand({
   description: `Compares the installed release (.harness/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
   examples: ["overlane release status"],
   effect: "read",
-  ...common8,
+  ...common9,
   keywords: ["installed", "version", "in sync", "update available", "which release", "pinned", "am i up to date", "current release"],
   result: ReleaseStatusResult,
   handler: async (inv) => releaseStatus(inv.deps)
@@ -63095,7 +65118,7 @@ var releaseUpdateCommand = defineCommand({
   flags: [{ name: "to", type: "string", value: "DIGEST", description: "Install this release instead of the project's pin" }, APPROVE],
   examples: ["overlane release update --dry-run", "overlane release update", "overlane release update --approve sha256:..."],
   effect: "write",
-  ...common8,
+  ...common9,
   keywords: ["upgrade", "install release", "new version", "pull latest", "plugin update", "approve", "update plugin", "get newest"],
   result: ReleaseUpdateResult,
   handler: async (inv) => updateRelease(inv.deps, { to: textFlag(inv, "to"), approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -63107,7 +65130,7 @@ var releaseRollbackCommand = defineCommand({
   flags: [APPROVE],
   examples: ["overlane release rollback --dry-run", "overlane release rollback --force"],
   effect: "destructive",
-  ...common8,
+  ...common9,
   keywords: ["roll back", "revert", "undo update", "previous version", "downgrade", "go back", "restore", "undo release", "bad release"],
   result: ReleaseRollbackResult,
   handler: async (inv) => rollbackRelease(inv.deps, { approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -63174,7 +65197,7 @@ var RunStatusResult = external_exports.object({
 var RunPolicyChangeResult = withDryRun(external_exports.object({ changed: external_exports.boolean(), policy: PolicyShape }));
 
 // ../cli/src/commands/run.ts
-var common9 = { needsAuth: true, needsNetwork: true };
+var common10 = { needsAuth: true, needsNetwork: true };
 var EXECUTOR = { name: "executor", type: "string", enum: ["claude-code", "codex"], description: "Which agent this is (default: detected from the environment)" };
 var STOP_NOTE = "A stop (policy paused, a budget spent, nothing runnable) exits 6 with the reason in the error code and the exact `overlane run end --reason ...` as the hint.";
 var runStartCommand = defineCommand({
@@ -63184,7 +65207,7 @@ var runStartCommand = defineCommand({
   flags: [{ name: "trigger", type: "string", enum: ["schedule", "interactive", "event"], default: "interactive", description: "What started the run" }, EXECUTOR],
   examples: ["overlane run start --trigger schedule", "overlane run start --dry-run"],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["begin run", "bounded step", "autonomous", "start working", "new run", "schedule", "kick off"],
   result: RunStartResult,
   handler: async (inv) => startRun(inv.deps, { trigger: textFlag(inv, "trigger"), executor: textFlag(inv, "executor"), dryRun: inv.dryRun })
@@ -63196,7 +65219,7 @@ var runNextCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run next"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["what should I work on next", "next task", "runnable", "what to do", "pick a task", "which task", "what's next", "work on", "what is next", "todo"],
   result: RunNextResult,
   handler: async (inv) => nextTask(inv.deps, { executor: textFlag(inv, "executor") })
@@ -63208,7 +65231,7 @@ var runClaimCommand = defineCommand({
   args: [{ name: "task-id", required: false, description: "The task to claim (default: the next runnable one)" }],
   examples: ["overlane run claim", "overlane run claim T003"],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["take task", "lease task", "grab", "assign", "pick up task", "get a task"],
   result: RunClaimResult,
   handler: async (inv) => claimTask(inv.deps, { positionals: inv.positionals, dryRun: inv.dryRun })
@@ -63225,7 +65248,7 @@ var runDecideCommand = defineCommand({
   ],
   examples: ['overlane run decide --question "Which date library?" --decision "Use the built-in Intl" --evidence "package.json has no date library"'],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["record decision", "question", "unblocked", "owner override", "judgement call", "log choice", "do not ask", "decide"],
   result: RunDecideResult,
   handler: async (inv) => decide(inv.deps, { question: textFlag(inv, "question"), decision: textFlag(inv, "decision"), evidence: listFlag(inv, "evidence"), task: textFlag(inv, "task"), dryRun: inv.dryRun })
@@ -63237,7 +65260,7 @@ var runEndCommand = defineCommand({
   flags: [{ name: "reason", type: "string", required: true, enum: RUN_STOP_REASONS, description: "Why the run ended" }],
   examples: ["overlane run end --reason nothing_runnable", "overlane run end --reason error"],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["finish run", "stop", "wrap up", "close run", "release leases", "done with run", "end the run"],
   result: RunEndResult,
   handler: async (inv) => endRun(inv.deps, { reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -63249,7 +65272,7 @@ var runStatusCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run status"],
   effect: "read",
-  ...common9,
+  ...common10,
   keywords: ["policy", "budget", "limits", "how much left", "remaining", "state of run", "is it paused", "run policy"],
   result: RunStatusResult,
   handler: async (inv) => runStatus(inv.deps, { executor: textFlag(inv, "executor") })
@@ -63260,7 +65283,7 @@ var runPauseCommand = defineCommand({
   description: "Sets the project's run policy to paused. Every run then stops at its next check (`STOP paused`). Undo with `overlane run resume`. Safe to repeat.",
   examples: ["overlane run pause", "overlane run pause --dry-run"],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["pause", "halt", "freeze", "stop all", "emergency brake", "disable autonomous runs", "policy", "no new runs", "stop agents", "turn off", "suspend"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "paused", inv.dryRun)
@@ -63271,7 +65294,7 @@ var runResumeCommand = defineCommand({
   description: "Sets the project's run policy back to active so runs can start and tasks can be claimed again. Safe to repeat.",
   examples: ["overlane run resume", "overlane run resume --dry-run"],
   effect: "write",
-  ...common9,
+  ...common10,
   keywords: ["unpause", "re-enable", "continue autonomous", "reactivate", "policy active", "turn on", "restart runs", "lift the pause"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "active", inv.dryRun)
@@ -63281,7 +65304,7 @@ var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCo
 // ../cli/src/task/queue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { mkdirSync as mkdirSync8, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname8, join as join23 } from "node:path";
 var TASK_POLICY_PATH = join23(".harness", "task-policy.json");
@@ -63301,7 +65324,7 @@ var TaskQueueResult = TaskQueue;
 var TaskPrioritiseResult = withDryRun(external_exports.object({ ...PrioritiseResult.shape, next: external_exports.string() }));
 var TaskPolicyResult = external_exports.object({ enforcement: TaskEnforcement, reason: external_exports.string().optional(), changedBy: external_exports.string().optional(), updatedAt: external_exports.string().optional(), localFile: external_exports.string() });
 var TaskPolicySetResult = withDryRun(TaskPolicyResult);
-var requestId8 = () => `cli-${randomUUID9()}`;
+var requestId9 = () => `cli-${randomUUID10()}`;
 function priorityOf(value, fallback) {
   const parsed = TaskPriority.safeParse(value ?? fallback);
   if (!parsed.success) throw new UsageError(`--priority must be one of ${TASK_PRIORITIES.join(", ")}`);
@@ -63340,7 +65363,7 @@ async function prioritiseTask(deps, input2) {
   const name2 = detectExecutorName(deps.env);
   let request;
   try {
-    request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+    request = PrioritiseRequest.parse({ requestId: requestId9(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   } catch (error62) {
     throw new UsageError(String(error62));
   }
@@ -63369,7 +65392,7 @@ async function newTask(deps, input2) {
   const begun = data;
   const project = await connectedProject(deps, "task");
   const name2 = detectExecutorName(deps.env);
-  const request = PrioritiseRequest.parse({ requestId: requestId8(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
+  const request = PrioritiseRequest.parse({ requestId: requestId9(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
   try {
     const ranked = await serviceCall(deps, project.serviceUrl, project.token)(PrioritiseResult, "POST", taskQueuePaths.prioritise(project.binding.tenantId, project.binding.projectId, begun.taskId), request);
     say(deps, `Ranked ${begun.taskId} ${ranked.priority}${input2.top ? " (first)" : ""}.`);
@@ -63390,7 +65413,7 @@ async function setPolicy(deps, input2) {
   const enforcement = TaskEnforcement.safeParse(input2.enforcement);
   if (!enforcement.success) throw new UsageError(`set needs ${TASK_ENFORCEMENT.join(" or ")}`);
   const name2 = detectExecutorName(deps.env);
-  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId8(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId9(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
   if (input2.dryRun) {
     const project2 = await offlineProject(deps, "task");
@@ -63417,7 +65440,7 @@ async function startExisting(deps, taskId, dryRun) {
 }
 
 // ../cli/src/commands/queue.ts
-var common10 = { needsAuth: true, needsNetwork: true };
+var common11 = { needsAuth: true, needsNetwork: true };
 var PRIORITIES2 = ["P0", "P1", "P2", "P3"];
 var taskNewCommand = defineCommand({
   path: ["task", "new"],
@@ -63433,7 +65456,7 @@ var taskNewCommand = defineCommand({
   ],
   examples: ['overlane task new "Fix login redirect"', 'overlane task new "Hotfix the build" --priority P0 --top'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["new task", "create task", "no active task", "blocked no task", "start work", "need a task", "begin", "quick task"],
   result: TaskNewResult,
   handler: async (inv) => newTask(inv.deps, {
@@ -63452,7 +65475,7 @@ var taskNextCommand = defineCommand({
   description: "Picks the best ready or paused task: P0 before P3, then rank, then milestone and dependency order. When this working copy holds a task and the next one outranks it, says so (preempt) and prints the commands to checkpoint and switch; the preempted task comes back through this command afterwards.",
   examples: ["overlane task next"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["what next", "next task", "priority", "what should i work on", "pick work", "resume after", "queue"],
   result: TaskNextResult,
   handler: async (inv) => taskNext(inv.deps)
@@ -63463,7 +65486,7 @@ var taskQueueCommand = defineCommand({
   description: "Lists ready, running, paused and blocked tasks by priority, then rank, then plan order, with each task's priority.",
   examples: ["overlane task queue"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["priority list", "ranking", "order", "backlog", "what is queued", "p0"],
   result: TaskQueueResult,
   handler: async (inv) => taskQueue(inv.deps)
@@ -63480,7 +65503,7 @@ var taskPrioritiseCommand = defineCommand({
   ],
   examples: ["overlane task prioritise task-7 --priority P0 --top", 'overlane task prioritise task-9 --priority P2 --reason "user said later"'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["reprioritize", "reprioritise", "bump", "urgent", "move to top", "rank", "lower priority", "p0", "p1", "p2", "p3"],
   result: TaskPrioritiseResult,
   handler: async (inv) => prioritiseTask(inv.deps, { taskId: inv.positionals[0], priority: textFlag(inv, "priority"), top: boolFlag(inv, "top"), reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -63491,7 +65514,7 @@ var taskPolicyCommand = defineCommand({
   description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .harness/task-policy.json for the hooks.",
   examples: ["overlane task policy"],
   effect: "read",
-  ...common10,
+  ...common11,
   keywords: ["enforcement", "require task", "task gate", "relax", "blocked", "policy"],
   result: TaskPolicyResult,
   handler: async (inv) => showPolicy2(inv.deps)
@@ -63504,7 +65527,7 @@ var taskPolicySetCommand = defineCommand({
   flags: [{ name: "reason", type: "string", value: "TEXT", description: "Why the rule is relaxed (required for relaxed)" }],
   examples: ["overlane task policy set required", 'overlane task policy set relaxed --reason "docs-only repository"'],
   effect: "write",
-  ...common10,
+  ...common11,
   keywords: ["relax", "turn off task requirement", "require tasks", "allow edits without task", "enforcement"],
   result: TaskPolicySetResult,
   handler: async (inv) => setPolicy(inv.deps, { enforcement: inv.positionals[0], reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -63514,7 +65537,7 @@ var queueCommands = [taskNewCommand, taskNextCommand, taskQueueCommand, taskPrio
 // ../cli/src/commands/autonomy.ts
 init_src();
 init_zod();
-var common11 = { needsAuth: true, needsNetwork: true };
+var common12 = { needsAuth: true, needsNetwork: true };
 var Requirements = external_exports.array(external_exports.object({ class: external_exports.string(), label: external_exports.string(), mode: external_exports.string(), requirement: external_exports.string() }));
 var SettingsReply = external_exports.object({ settings: AutonomySettings, requirements: Requirements });
 var ShowResult = external_exports.object({ tenantId: external_exports.string(), mode: external_exports.string(), source: external_exports.string(), plan: external_exports.string(), version: external_exports.number(), requirements: Requirements, next: external_exports.string() });
@@ -63531,7 +65554,7 @@ var autonomyShowCommand = defineCommand({
   description: "Prints the mode (autonomous, supervised or manual), where it came from (the plan default or a change), and for each action class what an agent needs before it acts. Safety classes (deletion, spend, secrets, production deploy without CI, the autonomy setting) keep an independent-agent guard in every mode. Payments and legal terms are human only.",
   examples: ["overlane autonomy show", "overlane autonomy show --json"],
   effect: "read",
-  ...common11,
+  ...common12,
   keywords: ["autonomy", "supervised", "autonomous", "manual", "approval mode", "what can agents do"],
   result: ShowResult,
   handler: async (inv) => {
@@ -63577,7 +65600,7 @@ var autonomySetCommand = defineCommand({
   ],
   examples: ["overlane autonomy set autonomous", "overlane autonomy set supervised --class release_promotion=manual", "overlane autonomy set autonomous --project my-app=supervised --dry-run"],
   effect: "write",
-  ...common11,
+  ...common12,
   keywords: ["autonomy", "set mode", "supervised", "autonomous", "manual"],
   result: SetResult,
   handler: async (inv) => {
@@ -63607,7 +65630,7 @@ var autonomyApprovalsListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["pending", "approved", "denied", "consumed", "expired"], description: "Only approvals with this status" }],
   examples: ["overlane autonomy approvals list", "overlane autonomy approvals list --status pending --json"],
   effect: "read",
-  ...common11,
+  ...common12,
   keywords: ["approvals", "pending approvals", "who approved", "audit approvals"],
   result: ListResult,
   handler: async (inv) => {
@@ -63635,7 +65658,7 @@ var autonomyApprovalsRequestCommand = defineCommand({
   ],
   examples: ['overlane autonomy approvals request --class deletion --subject "memory.purge:all:-:-" --summary "Purge stale project memory"'],
   effect: "write",
-  ...common11,
+  ...common12,
   keywords: ["request approval", "ask for approval", "independent agent", "second agent"],
   result: RequestResult,
   handler: async (inv) => {
@@ -63673,7 +65696,7 @@ var autonomyApprovalsAnswerCommand = defineCommand({
   ],
   examples: ['overlane autonomy approvals answer apr_1 --decision approve --reason "within policy" --evidence "read the diff" --evidence "tests pass"'],
   effect: "write",
-  ...common11,
+  ...common12,
   keywords: ["approve", "deny", "second agent", "independent approval", "answer approval"],
   result: AnswerResult,
   handler: async (inv) => {
@@ -63701,7 +65724,7 @@ var autonomyCommands = [autonomyShowCommand, autonomySetCommand, autonomyApprova
 // ../cli/src/commands/onboarding.ts
 init_src();
 init_zod();
-var common12 = { needsAuth: true, needsNetwork: true };
+var common13 = { needsAuth: true, needsNetwork: true };
 var EvidenceShape = external_exports.object({ task: external_exports.object({ projectId: external_exports.string(), taskId: external_exports.string(), state: external_exports.string() }).optional(), review: external_exports.object({ projectId: external_exports.string(), runId: external_exports.string() }).optional() });
 var StatusResult = external_exports.object({
   step: external_exports.string(),
@@ -63725,7 +65748,7 @@ var onboardingStatusCommand = defineCommand({
   description: "Prints the six onboarding steps (the same names as the web app), their state, the task and review records behind finished steps, any repair action for a failed step, and the next command an agent runs. An agent with a team token completes every step; a person in the web app is the override.",
   examples: ["overlane onboarding status"],
   effect: "read",
-  ...common12,
+  ...common13,
   keywords: ["onboarding", "get started", "setup progress", "first task", "what next", "steps"],
   result: StatusResult,
   handler: async (inv) => {
@@ -63766,7 +65789,7 @@ var onboardingAdvanceCommand = defineCommand({
   ],
   examples: ["overlane onboarding advance agents --agents claude-code", "overlane onboarding advance repo --repo acme/widgets", "overlane onboarding advance first-task", "overlane onboarding advance invite"],
   effect: "write",
-  ...common12,
+  ...common13,
   keywords: ["onboarding", "advance step", "complete step", "accept first review", "finish setup"],
   result: AdvanceResult,
   handler: async (inv) => {
@@ -63813,7 +65836,7 @@ var onboardingReviewCommand = defineCommand({
   description: `Prints the team's latest completed review. With no review yet it prints a labelled example (source fixture). ${EVIDENCE_COMMANDS["first-review"]} Then finish the step with \`overlane onboarding advance first-review\`.`,
   examples: ["overlane onboarding review", "overlane onboarding review --json"],
   effect: "read",
-  ...common12,
+  ...common13,
   keywords: ["first review", "onboarding review", "accept review", "see review"],
   result: ReviewResult,
   handler: async (inv) => {
@@ -63836,7 +65859,7 @@ var onboardingInviteCommand = defineCommand({
   flags: [{ name: "role", type: "string", enum: ["admin", "member", "viewer"], default: "member", description: "The role the invitations grant" }],
   examples: ["overlane onboarding invite pat@example.com lee@example.com", "overlane onboarding invite --role viewer pat@example.com", "overlane onboarding invite"],
   effect: "write",
-  ...common12,
+  ...common13,
   keywords: ["onboarding invite", "finish invite step"],
   result: InviteResult,
   handler: async (inv) => {
@@ -63909,14 +65932,14 @@ var TaskHandoffResult = withDryRun(
 );
 
 // ../cli/src/commands/task.ts
-var common13 = { needsAuth: true, needsNetwork: true };
+var common14 = { needsAuth: true, needsNetwork: true };
 var taskListCommand = defineCommand({
   path: ["task", "list"],
   summary: "List the project's tasks and their states",
   description: "Lists every task of the connected project with its state, pause reason, version, lease holder, checks and latest checkpoint.",
   examples: ["overlane task list"],
   effect: "read",
-  ...common13,
+  ...common14,
   keywords: ["tasks", "show all tasks", "see tasks", "backlog", "what tasks exist", "work items"],
   result: TaskListResult,
   handler: async (inv) => listTasks(inv.deps)
@@ -63934,7 +65957,7 @@ var taskStartCommand = defineCommand({
   ],
   examples: ["overlane task start task-7", 'overlane task start --outcome "Add CSV export" --criterion "export works" --check unit_tests:L2 --path "src/**"', 'overlane task start --outcome "Fix login" --criterion "login passes" --path "src/auth/**" --dry-run'],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["begin", "create task", "new task", "open", "claim new", "work item", "contract", "acceptance criteria", "start working"],
   result: TaskStartResult,
   handler: async (inv) => inv.positionals[0] !== void 0 ? startExisting(inv.deps, inv.positionals[0], inv.dryRun) : startTask(inv.deps, { outcome: textFlag(inv, "outcome"), criteria: listFlag(inv, "criterion"), paths: listFlag(inv, "path"), checks: listFlag(inv, "check"), dryRun: inv.dryRun })
@@ -63945,7 +65968,7 @@ var taskStatusCommand = defineCommand({
   description: "Shows the held task from the service: state, lease, acceptance criteria, checks, evidence count and the latest checkpoint. Says so when nothing is held or the lease was lost.",
   examples: ["overlane task status"],
   effect: "read",
-  ...common13,
+  ...common14,
   keywords: ["current task", "what am i working on", "lease", "active task", "progress", "held task"],
   result: TaskStatusResult,
   handler: async (inv) => taskStatus(inv.deps)
@@ -63961,7 +65984,7 @@ var taskCheckpointCommand = defineCommand({
   ],
   examples: ['overlane task checkpoint --summary "Parser done" --next "Write the tests"', 'overlane task checkpoint --summary "Out of budget" --next "Resume" --pause quota'],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["save", "progress", "pause", "stop work", "park", "quota", "limit reached", "remember place", "snapshot", "save state", "out of budget"],
   result: TaskCheckpointResult,
   handler: async (inv) => checkpointTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), pause: textFlag(inv, "pause"), dryRun: inv.dryRun })
@@ -63973,7 +65996,7 @@ var taskResumeCommand = defineCommand({
   args: [{ name: "task-id", required: true, description: "The task to resume" }],
   examples: ["overlane task resume task-1"],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["continue", "pick up", "restart", "reclaim", "after pause", "take over", "carry on"],
   result: TaskResumeResult,
   handler: async (inv) => resumeTask(inv.deps, { taskId: inv.positionals[0], dryRun: inv.dryRun })
@@ -63984,7 +66007,7 @@ var taskSubmitCommand = defineCommand({
   description: "Asks for verification at HEAD. The task is verified only when evidence at or above each required check's level exists for that commit: L2 comes from CI on the pushed commit, L1 from `overlane task evidence`.",
   examples: ["overlane task submit", "overlane task submit --dry-run"],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["finish", "done", "complete", "verify", "ready for review", "request verification", "hand in", "turn in"],
   result: TaskSubmitResult,
   handler: async (inv) => submitTask(inv.deps, { dryRun: inv.dryRun })
@@ -64000,7 +66023,7 @@ var taskEvidenceCommand = defineCommand({
   ],
   examples: ["overlane task evidence --level L1 -- pnpm test"],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["tests", "prove", "record test result", "verification", "run checks", "L1", "attest", "run the tests and record"],
   result: TaskEvidenceResult,
   handler: async (inv) => recordEvidence(inv.deps, { level: textFlag(inv, "level"), task: textFlag(inv, "task"), words: inv.positionals, dryRun: inv.dryRun })
@@ -64016,7 +66039,7 @@ var taskHandoffCommand = defineCommand({
   ],
   examples: ["overlane task handoff --to codex", 'overlane task handoff --to claude --summary "API done" --next "Add tests"'],
   effect: "write",
-  ...common13,
+  ...common14,
   keywords: ["hand off", "transfer", "give to", "switch agent", "other agent", "codex", "claude", "pass the task", "delegate", "move work", "swap agents"],
   result: TaskHandoffResult,
   handler: async (inv) => handoffTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), to: textFlag(inv, "to"), dryRun: inv.dryRun })
@@ -64050,7 +66073,10 @@ function coreCommands() {
     ...libCommands,
     ...reviewCommands,
     ...guardCommands,
-    ...billingCommands
+    ...billingCommands,
+    ...repoCommands,
+    ...ciCommands,
+    ...deployCommands
   ];
 }
 function createRegistry(extra = []) {
@@ -64088,10 +66114,10 @@ function parseFor(spec, tokens) {
       }
     }
   }
-  const required2 = spec.args.filter((arg) => arg.required).length;
-  const variadic = spec.args.some((arg) => arg.variadic === true);
+  const required2 = spec.args.filter((arg4) => arg4.required).length;
+  const variadic = spec.args.some((arg4) => arg4.variadic === true);
   if (positionals.length < required2) {
-    const missing = spec.args.filter((arg) => arg.required)[positionals.length];
+    const missing = spec.args.filter((arg4) => arg4.required)[positionals.length];
     throw new UsageError(`${last} needs ${missing?.name ?? "an argument"}`, { hint });
   }
   if (!variadic && positionals.length > spec.args.length) {
@@ -64283,14 +66309,14 @@ function marketplaceRoot(env = process.env, home = homedir()) {
 }
 
 // src/plugin.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { join as join29 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/marketplace.ts
 init_src();
 import { createHash as createHash7 } from "node:crypto";
-import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync10, renameSync as renameSync6, rmSync as rmSync4, statSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync12, renameSync as renameSync6, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname9, join as join28, relative as relative2, sep } from "node:path";
 var CLIENT_DIRS = ["claude", "codex"];
 var EMBEDDED_MANIFEST = "release-manifest.json";
@@ -64301,7 +66327,7 @@ function loadEmbedded(packageRoot2) {
   const dir = join28(packageRoot2, "plugins");
   const path = join28(dir, EMBEDDED_MANIFEST);
   if (!existsSync7(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
-  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync10(path, "utf8")));
+  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync12(path, "utf8")));
   if (!parsed.success) throw new MarketplaceError(`the embedded release manifest is invalid: ${parsed.error.message}`);
   return { dir, manifest: parsed.data };
 }
@@ -64329,7 +66355,7 @@ async function verifyTree(treeRoot, manifest) {
       problems.push(`missing: ${file2.path}`);
       continue;
     }
-    if (sha2562(readFileSync10(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
+    if (sha2562(readFileSync12(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
   }
   for (const client of CLIENT_DIRS) {
     for (const found of listFiles(join28(treeRoot, client))) {
@@ -64340,7 +66366,7 @@ async function verifyTree(treeRoot, manifest) {
 }
 function readInstalledManifest(target) {
   try {
-    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync10(join28(target, INSTALLED_MANIFEST), "utf8")));
+    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync12(join28(target, INSTALLED_MANIFEST), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -64391,7 +66417,7 @@ async function syncMarketplace(embedded, target) {
 }
 async function ensureMarketplace(embedded, target) {
   const installed = readInstalledManifest(target);
-  const present = existsSync7(target) && statSync(target).isDirectory();
+  const present = existsSync7(target) && statSync2(target).isDirectory();
   if (installed !== null && present && !isNewer(embedded.manifest.version, installed.version)) return false;
   await syncMarketplace(embedded, target);
   return true;
@@ -64404,7 +66430,7 @@ var PluginUsageError = class extends Error {
 };
 function readNames(treeRoot, client) {
   const file2 = client === "claude" ? join29(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join29(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
-  const parsed = JSON.parse(readFileSync11(file2, "utf8"));
+  const parsed = JSON.parse(readFileSync13(file2, "utf8"));
   const record3 = parsed;
   const plugin = record3.plugins?.[0]?.name;
   if (typeof record3.name !== "string" || typeof plugin !== "string") throw new MarketplaceError(`${file2} names no marketplace or plugin`);