overlane 0.1.133 → 0.1.135

package/dist/overlane.mjs

@@ -28,9 +28,9 @@ var __commonJS = (cb, mod) => function __require2() {
     throw mod = 0, e2;
   }
 };
-var __export = (target, all) => {
+var __export = (target2, all) => {
   for (var name2 in all)
-    __defProp(target, name2, { get: all[name2], enumerable: true });
+    __defProp(target2, name2, { get: all[name2], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -40,12 +40,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
   // compatible transform (i.e. "__esModule" has not been set), then set
   // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,
   mod
 ));
 
@@ -201,8 +201,8 @@ function defineLazy(object2, key, getter) {
 function objectClone(obj) {
   return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
 }
-function assignProp(target, prop, value) {
-  Object.defineProperty(target, prop, {
+function assignProp(target2, prop, value) {
+  Object.defineProperty(target2, prop, {
     value,
     writable: true,
     enumerable: true,
@@ -216,8 +216,8 @@ function rawShape(def) {
 function sourceShape(schema) {
   return rawShape(schema._zod.def) ?? schema._zod.def.shape;
 }
-function deferProp(target, key, getter) {
-  Object.defineProperty(target, key, {
+function deferProp(target2, key, getter) {
+  Object.defineProperty(target2, key, {
     get() {
       const value = getter();
       assignProp(this, key, value);
@@ -227,36 +227,36 @@ function deferProp(target, key, getter) {
     configurable: true
   });
 }
-function putProp(target, key, value) {
-  if (key in target)
-    assignProp(target, key, value);
+function putProp(target2, key, value) {
+  if (key in target2)
+    assignProp(target2, key, value);
   else
-    target[key] = value;
+    target2[key] = value;
 }
-function mirrorShape(target, source, keys, wrap) {
+function mirrorShape(target2, source, keys, wrap) {
   const raw = sourceShape(source);
   for (const key of keys) {
     const desc = Object.getOwnPropertyDescriptor(raw, key);
     if (!desc.enumerable)
       continue;
     if (desc.get) {
-      deferProp(target, key, () => {
+      deferProp(target2, key, () => {
         const value = source._zod.def.shape[key];
         return wrap ? wrap(value, key) : value;
       });
     } else
-      putProp(target, key, wrap ? wrap(desc.value, key) : desc.value);
+      putProp(target2, key, wrap ? wrap(desc.value, key) : desc.value);
   }
 }
-function mirrorProps(target, source) {
+function mirrorProps(target2, source) {
   for (const key of Reflect.ownKeys(source)) {
     const desc = Object.getOwnPropertyDescriptor(source, key);
     if (!desc.enumerable)
       continue;
     if (desc.get)
-      deferProp(target, key, () => source[key]);
+      deferProp(target2, key, () => source[key]);
     else
-      putProp(target, key, desc.value);
+      putProp(target2, key, desc.value);
   }
 }
 function mergeDefs(...defs) {
@@ -365,35 +365,35 @@ function normalizeParams(_params) {
   return params;
 }
 function createTransparentProxy(getter) {
-  let target;
+  let target2;
   return new Proxy({}, {
     get(_, prop, receiver) {
-      target ?? (target = getter());
-      return Reflect.get(target, prop, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.get(target2, prop, receiver);
     },
     set(_, prop, value, receiver) {
-      target ?? (target = getter());
-      return Reflect.set(target, prop, value, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.set(target2, prop, value, receiver);
     },
     has(_, prop) {
-      target ?? (target = getter());
-      return Reflect.has(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.has(target2, prop);
     },
     deleteProperty(_, prop) {
-      target ?? (target = getter());
-      return Reflect.deleteProperty(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.deleteProperty(target2, prop);
     },
     ownKeys(_) {
-      target ?? (target = getter());
-      return Reflect.ownKeys(target);
+      target2 ?? (target2 = getter());
+      return Reflect.ownKeys(target2);
     },
     getOwnPropertyDescriptor(_, prop) {
-      target ?? (target = getter());
-      return Reflect.getOwnPropertyDescriptor(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.getOwnPropertyDescriptor(target2, prop);
     },
     defineProperty(_, prop, descriptor) {
-      target ?? (target = getter());
-      return Reflect.defineProperty(target, prop, descriptor);
+      target2 ?? (target2 = getter());
+      return Reflect.defineProperty(target2, prop, descriptor);
     }
   });
 }
@@ -948,10 +948,10 @@ function $constructor(name2, initializer3, proto, params) {
       let up = own2;
       while (up && up !== ctorProto)
         up = Object.getPrototypeOf(up);
-      const target = up ?? own2;
-      if (!initialized.has(target)) {
-        initialized.add(target);
-        members(target, protoMembers);
+      const target2 = up ?? own2;
+      if (!initialized.has(target2)) {
+        initialized.add(target2);
+        members(target2, protoMembers);
       }
     }
     const proto2 = _.prototype;
@@ -2083,8 +2083,8 @@ var init_doc = __esm({
         const lines = content.split("\n").filter((x) => x);
         const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
         const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
-        for (const line2 of dedented) {
-          this.content.push(line2);
+        for (const line3 of dedented) {
+          this.content.push(line3);
         }
       }
       compile() {
@@ -12935,8 +12935,8 @@ function withParser(schema, parser) {
     installCompiledUserMethods(clone2, schema, parser);
   return clone2;
 }
-function installCompiledUserMethods(target, source, parser) {
-  const targetAny = target;
+function installCompiledUserMethods(target2, source, parser) {
+  const targetAny = target2;
   const sourceAny = source;
   if (typeof sourceAny.safeParse === "function") {
     const originalSafeParse = sourceAny.safeParse;
@@ -13140,9 +13140,9 @@ function codePointLengthVar(doc, ctx, accessor, inDoubt) {
   doc.write(`const ${v} = typeof ${accessor} === "string" && ${inDoubt} ? ${cpLen}(${accessor}) : ${accessor}.length;`);
   return v;
 }
-function numericOperand(value, label) {
+function numericOperand(value, label2) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new ZodCompileUnsupportedError(`${label} bound of type ${typeof value}`);
+    throw new ZodCompileUnsupportedError(`${label2} bound of type ${typeof value}`);
   }
   return `${value}`;
 }
@@ -15566,26 +15566,26 @@ var init_api = __esm({
 });
 
 // ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
-function assignProps(target, ...sources) {
+function assignProps(target2, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
       if (Object.prototype.propertyIsEnumerable.call(source, key)) {
-        assignProp(target, key, source[key]);
+        assignProp(target2, key, source[key]);
       }
     }
   }
-  return target;
+  return target2;
 }
 function initializeContext(params) {
-  let target = params?.target ?? "draft-2020-12";
-  if (target === "draft-4")
-    target = "draft-04";
-  if (target === "draft-7")
-    target = "draft-07";
+  let target2 = params?.target ?? "draft-2020-12";
+  if (target2 === "draft-4")
+    target2 = "draft-04";
+  if (target2 === "draft-7")
+    target2 = "draft-07";
   return {
     processors: params.processors ?? {},
     metadataRegistry: params?.metadata ?? globalRegistry,
-    target,
+    target: target2,
     unrepresentable: params?.unrepresentable ?? "throw",
     override: params?.override ?? (() => {
     }),
@@ -16093,8 +16093,8 @@ var init_to_json_schema = __esm({
       return finalize(ctx, schema);
     };
     createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
-      const { libraryOptions, target } = params ?? {};
-      const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
+      const { libraryOptions, target: target2 } = params ?? {};
+      const ctx = initializeContext({ ...libraryOptions ?? {}, target: target2, io, processors });
       processSchema(schema, ctx);
       extractDefs(ctx, schema);
       return finalize(ctx, schema);
@@ -18164,8 +18164,8 @@ var init_schemas2 = __esm({
       catch(params) {
         return _catch2(this, params);
       },
-      pipe(target) {
-        return pipe(this, target);
+      pipe(target2) {
+        return pipe(this, target2);
       },
       readonly() {
         return readonly(this);
@@ -22114,7 +22114,7 @@ var init_issues = __esm({
     init_common();
     init_task_priority();
     init_task_contract();
-    prefixed = (prefix, label) => external_exports.string().regex(new RegExp(`^${prefix}_[A-Za-z0-9]{8,32}$`), `must look like ${prefix}_<id>`).describe(label);
+    prefixed = (prefix, label2) => external_exports.string().regex(new RegExp(`^${prefix}_[A-Za-z0-9]{8,32}$`), `must look like ${prefix}_<id>`).describe(label2);
     IssueId = prefixed("iss", "issue identifier");
     WorkProjectId = prefixed("wpr", "work project identifier");
     CycleId = prefixed("cyc", "cycle identifier");
@@ -23553,7 +23553,7 @@ var init_wording = __esm({
 });
 
 // ../contracts/src/code-map-context.ts
-var CodeMapDigest, CODE_MAP_DIGEST_PATH;
+var CodeMapDigest, CODE_MAP_DIGEST_PATH, CODE_INDEX_PATH;
 var init_code_map_context = __esm({
   "../contracts/src/code-map-context.ts"() {
     "use strict";
@@ -23571,6 +23571,7 @@ var init_code_map_context = __esm({
       seeds: external_exports.array(external_exports.string())
     }).strict();
     CODE_MAP_DIGEST_PATH = ".harness/code-map.json";
+    CODE_INDEX_PATH = ".harness/code-index.json";
   }
 });
 
@@ -24381,28 +24382,28 @@ function stripComment(text) {
   }
   return text;
 }
-function parseScalar(raw, line2) {
+function parseScalar(raw, line3) {
   const text = raw.trim();
   if (text === "" || text === "~" || text === "null") return null;
   if (text === "true") return true;
   if (text === "false") return false;
   if (/^-?\d+$/.test(text)) return Number(text);
   if (text.startsWith('"')) {
-    if (!text.endsWith('"') || text.length < 2) throw new YamlFail(line2, "unterminated double-quoted string");
+    if (!text.endsWith('"') || text.length < 2) throw new YamlFail(line3, "unterminated double-quoted string");
     try {
       return JSON.parse(text);
     } catch {
-      throw new YamlFail(line2, "bad escape in double-quoted string");
+      throw new YamlFail(line3, "bad escape in double-quoted string");
     }
   }
   if (text.startsWith("'")) {
-    if (!text.endsWith("'") || text.length < 2) throw new YamlFail(line2, "unterminated single-quoted string");
+    if (!text.endsWith("'") || text.length < 2) throw new YamlFail(line3, "unterminated single-quoted string");
     return text.slice(1, -1).replaceAll("''", "'");
   }
   if (text === "{}") return {};
   if (text === "[]") return [];
   if (text.startsWith("[")) {
-    if (!text.endsWith("]")) throw new YamlFail(line2, "unterminated list; write the list on one line or use '- ' items");
+    if (!text.endsWith("]")) throw new YamlFail(line3, "unterminated list; write the list on one line or use '- ' items");
     const inner = text.slice(1, -1);
     const items = [];
     let current2 = "";
@@ -24415,15 +24416,15 @@ function parseScalar(raw, line2) {
         quote3 = ch;
         current2 += ch;
       } else if (ch === ",") {
-        items.push(parseScalar(current2, line2));
+        items.push(parseScalar(current2, line3));
         current2 = "";
       } else current2 += ch;
     }
-    if (current2.trim() !== "" || items.length > 0) items.push(parseScalar(current2, line2));
+    if (current2.trim() !== "" || items.length > 0) items.push(parseScalar(current2, line3));
     return items;
   }
-  if (text.startsWith("{")) throw new YamlFail(line2, "flow maps are not supported; use an indented block");
-  if (/^[&*!%@`]/.test(text)) throw new YamlFail(line2, `'${text[0]}' (anchors, aliases and tags) is not supported`);
+  if (text.startsWith("{")) throw new YamlFail(line3, "flow maps are not supported; use an indented block");
+  if (/^[&*!%@`]/.test(text)) throw new YamlFail(line3, `'${text[0]}' (anchors, aliases and tags) is not supported`);
   return text;
 }
 function parseYaml(source) {
@@ -24432,10 +24433,10 @@ function parseYaml(source) {
   let i2 = 0;
   let pending = null;
   const keyOf = (path) => JSON.stringify(path);
-  function indentOf(raw, line2) {
+  function indentOf(raw, line3) {
     let n = 0;
     while (raw[n] === " ") n += 1;
-    if (raw[n] === "	") throw new YamlFail(line2, "tabs are not allowed for indentation; use spaces");
+    if (raw[n] === "	") throw new YamlFail(line3, "tabs are not allowed for indentation; use spaces");
     return n;
   }
   function peek() {
@@ -24549,8 +24550,8 @@ function parseYaml(source) {
     value,
     lineOf(path) {
       for (let n = path.length; n >= 0; n -= 1) {
-        const line2 = n === 0 ? 1 : lineMap.get(keyOf(path.slice(0, n)));
-        if (line2 !== void 0) return line2;
+        const line3 = n === 0 ? 1 : lineMap.get(keyOf(path.slice(0, n)));
+        if (line3 !== void 0) return line3;
       }
       return 1;
     }
@@ -24703,9 +24704,9 @@ var init_ci = __esm({
       jobs: external_exports.record(external_exports.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/), PipelineJob).refine((jobs) => Object.keys(jobs).length >= 1 && Object.keys(jobs).length <= 50, "between 1 and 50 jobs")
     }).strict();
     YamlFail = class extends Error {
-      constructor(line2, message) {
+      constructor(line3, message) {
         super(message);
-        this.line = line2;
+        this.line = line3;
       }
       line;
     };
@@ -25037,6 +25038,878 @@ var init_decision = __esm({
   }
 });
 
+// ../contracts/src/claims.ts
+function mergeTreeArgs(a, b) {
+  return ["merge-tree", "--write-tree", "--name-only", "-z", a, b];
+}
+function parseMergeTree(stdout, exitCode, stderr = "") {
+  const parts2 = stdout.split("\0");
+  const oid = parts2[0]?.trim() ?? "";
+  if (!/^[0-9a-f]{40,64}$/.test(oid) || exitCode !== 0 && exitCode !== 1) {
+    const hint = stderr.trim() || stdout.trim() || `git exited ${exitCode}`;
+    return { status: "error", files: [], message: hint.slice(0, 1e3) };
+  }
+  const files = [];
+  let index = 1;
+  const names = [];
+  while (index < parts2.length && parts2[index] !== "") {
+    names.push(parts2[index]);
+    index += 1;
+  }
+  index += 1;
+  const kinds = /* @__PURE__ */ new Map();
+  while (index < parts2.length) {
+    const count = Number(parts2[index]);
+    if (!Number.isInteger(count) || count < 0) break;
+    const paths = parts2.slice(index + 1, index + 1 + count);
+    const type = parts2[index + 1 + count] ?? "";
+    const kind = /^CONFLICT \((.+)\)$/.exec(type)?.[1];
+    if (kind !== void 0) {
+      for (const path of paths) if (!kinds.has(path)) kinds.set(path, kind);
+    }
+    index += count + 3;
+  }
+  for (const name2 of names) files.push({ path: name2, kind: kinds.get(name2) ?? "content" });
+  if (exitCode === 0) return files.length === 0 ? { status: "clean", treeOid: oid, files: [] } : { status: "error", files: [], message: "git reported a clean exit with conflicted files" };
+  return files.length === 0 ? { status: "error", treeOid: oid, files: [], message: "git reported conflicts but named no file" } : { status: "conflict", treeOid: oid, files: files.slice(0, 500) };
+}
+var CLAIM_SCOPE_KINDS, ClaimScopeKind, MAX_CLAIM_SCOPES, MAX_CLAIM_PATTERNS, MAX_PATTERN_LENGTH, ClaimScopeInput, CLAIM_POLICIES, ClaimPolicy, CLAIM_MODES, ClaimMode, CLAIM_STATUSES, ClaimStatus, CLAIM_LIMITS, ClaimSettings, DEFAULT_CLAIM_SETTINGS, PutClaimSettingsRequest, Ref2, Sha, Claim, AcquireClaimRequest, RenewClaimRequest, ReleaseClaimRequest, CLAIM_DECISIONS, Holder, ClaimOutcome, ClaimListResponse, MERGE_CHECK_STATUSES, MergeCheckStatus, ConflictedFile, MergeTreeResult, RecordMergeCheckRequest, RunMergeCheckRequest, MergeCheckRecord, READINESS_BLOCKERS, ReadinessBlocker, MergeReadiness, claimPaths;
+var init_claims = __esm({
+  "../contracts/src/claims.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    CLAIM_SCOPE_KINDS = ["path", "glob", "module"];
+    ClaimScopeKind = external_exports.enum(CLAIM_SCOPE_KINDS);
+    MAX_CLAIM_SCOPES = 32;
+    MAX_CLAIM_PATTERNS = 128;
+    MAX_PATTERN_LENGTH = 300;
+    ClaimScopeInput = external_exports.object({
+      kind: ClaimScopeKind,
+      value: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
+      /** For a module that is not in the code map: the paths or globs the caller says it covers. */
+      paths: external_exports.array(external_exports.string().min(1).max(MAX_PATTERN_LENGTH)).max(MAX_CLAIM_PATTERNS).optional()
+    }).strict();
+    CLAIM_POLICIES = ["serialise", "refuse", "allow"];
+    ClaimPolicy = external_exports.enum(CLAIM_POLICIES);
+    CLAIM_MODES = ["exclusive", "shared"];
+    ClaimMode = external_exports.enum(CLAIM_MODES);
+    CLAIM_STATUSES = ["active", "queued", "released", "expired"];
+    ClaimStatus = external_exports.enum(CLAIM_STATUSES);
+    CLAIM_LIMITS = {
+      defaultLeaseSeconds: 1800,
+      maxLeaseSeconds: 4 * 3600,
+      /** A claim never lives longer than this from its first grant, however often it is renewed. */
+      maxLifetimeSeconds: 24 * 3600,
+      /** A queued claim that has not been promoted by then expires. */
+      queueSeconds: 4 * 3600,
+      maxActivePerHolder: 20
+    };
+    ClaimSettings = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      policy: ClaimPolicy,
+      leaseSeconds: external_exports.number().int().min(60).max(CLAIM_LIMITS.maxLeaseSeconds),
+      updatedBy: external_exports.string().nullable(),
+      updatedAt: Timestamp.nullable()
+    }).strict();
+    DEFAULT_CLAIM_SETTINGS = { policy: "serialise", leaseSeconds: CLAIM_LIMITS.defaultLeaseSeconds };
+    PutClaimSettingsRequest = external_exports.object({ policy: ClaimPolicy, leaseSeconds: external_exports.number().int().min(60).max(CLAIM_LIMITS.maxLeaseSeconds).optional() }).strict();
+    Ref2 = external_exports.string().min(1).max(200);
+    Sha = external_exports.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full lowercase commit SHA");
+    Claim = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      id: external_exports.string().min(1).max(80),
+      taskId: external_exports.string().min(1).max(128),
+      /** The principal that holds the claim: an agent token ID or a user ID. */
+      holder: external_exports.string().min(1).max(200),
+      /** A free label such as `codex` or `claude`, for people reading the list. */
+      agent: external_exports.string().min(1).max(80).optional(),
+      mode: ClaimMode,
+      status: ClaimStatus,
+      scopes: external_exports.array(ClaimScopeInput).min(1).max(MAX_CLAIM_SCOPES),
+      patterns: external_exports.array(external_exports.string().min(1).max(MAX_PATTERN_LENGTH)).min(1).max(MAX_CLAIM_PATTERNS),
+      resolvedFrom: external_exports.enum(["given", "code-map"]),
+      /** The branch and head the work is on, once it has one; the pre-merge check compares heads. */
+      branch: Ref2.optional(),
+      headSha: Sha.optional(),
+      /** Arrival order within the project; serialised claims are promoted in this order. */
+      sequence: external_exports.number().int().positive(),
+      leaseExpiresAt: Timestamp,
+      /** The ceiling for renewals. */
+      maxExpiresAt: Timestamp,
+      /** The claims this one waits behind while it is queued. */
+      waitingOn: external_exports.array(external_exports.string()).default([]),
+      createdAt: Timestamp,
+      updatedAt: Timestamp,
+      releasedAt: Timestamp.optional(),
+      releaseReason: external_exports.enum(["done", "released", "expired", "queue_timeout", "forced", "refused"]).optional()
+    }).strict();
+    AcquireClaimRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      taskId: external_exports.string().min(1).max(128),
+      scopes: external_exports.array(ClaimScopeInput).min(1).max(MAX_CLAIM_SCOPES),
+      mode: ClaimMode.default("exclusive"),
+      agent: external_exports.string().min(1).max(80).optional(),
+      leaseSeconds: external_exports.number().int().min(60).max(CLAIM_LIMITS.maxLeaseSeconds).optional(),
+      branch: Ref2.optional(),
+      headSha: Sha.optional()
+    }).strict();
+    RenewClaimRequest = external_exports.object({ leaseSeconds: external_exports.number().int().min(60).max(CLAIM_LIMITS.maxLeaseSeconds).optional(), branch: Ref2.optional(), headSha: Sha.optional() }).strict();
+    ReleaseClaimRequest = external_exports.object({ reason: external_exports.enum(["done", "released"]).default("released") }).strict();
+    CLAIM_DECISIONS = ["granted", "queued", "refused"];
+    Holder = external_exports.object({ claimId: external_exports.string(), taskId: external_exports.string(), holder: external_exports.string(), agent: external_exports.string().optional(), patterns: external_exports.array(external_exports.string()), leaseExpiresAt: Timestamp }).strict();
+    ClaimOutcome = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      decision: external_exports.enum(CLAIM_DECISIONS),
+      claim: Claim.nullable(),
+      /** Claims that overlap this one: what it waits behind, what refused it, or what it shares scope with under `allow`. */
+      overlaps: external_exports.array(Holder),
+      /** Position in the queue, 1 for next; 0 when granted or refused. */
+      position: external_exports.number().int().nonnegative(),
+      policy: ClaimPolicy,
+      message: external_exports.string().min(1),
+      nextCommand: external_exports.string().nullable(),
+      replay: external_exports.boolean().default(false)
+    }).strict();
+    ClaimListResponse = external_exports.object({ tenantId: TenantId, projectId: ProjectId, policy: ClaimPolicy, claims: external_exports.array(Claim) }).strict();
+    MERGE_CHECK_STATUSES = ["clean", "conflict", "error"];
+    MergeCheckStatus = external_exports.enum(MERGE_CHECK_STATUSES);
+    ConflictedFile = external_exports.object({ path: external_exports.string().min(1).max(1e3), kind: external_exports.string().min(1).max(80) }).strict();
+    MergeTreeResult = external_exports.object({
+      status: MergeCheckStatus,
+      /** The tree git wrote for a clean merge or with conflict markers. Absent on an error. */
+      treeOid: external_exports.string().regex(/^[0-9a-f]{40,64}$/).optional(),
+      files: external_exports.array(ConflictedFile).max(500),
+      message: external_exports.string().max(1e3).optional()
+    }).strict();
+    RecordMergeCheckRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      a: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().max(80).optional() }).strict(),
+      b: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().max(80).optional() }).strict(),
+      result: MergeTreeResult
+    }).strict();
+    RunMergeCheckRequest = external_exports.object({ a: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().max(80).optional() }).strict(), b: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().max(80).optional() }).strict() }).strict();
+    MergeCheckRecord = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      id: external_exports.string().min(1).max(80),
+      a: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().optional() }).strict(),
+      b: external_exports.object({ ref: Ref2, sha: Sha, claimId: external_exports.string().optional() }).strict(),
+      result: MergeTreeResult,
+      source: external_exports.enum(["runner", "client"]),
+      reportedBy: external_exports.string().min(1),
+      checkedAt: Timestamp
+    }).strict();
+    READINESS_BLOCKERS = ["claim_queued", "claim_inactive", "conflict", "check_required", "check_error", "no_branch"];
+    ReadinessBlocker = external_exports.object({ code: external_exports.enum(READINESS_BLOCKERS), message: external_exports.string().min(1), with: external_exports.string().optional(), files: external_exports.array(ConflictedFile).optional(), nextCommand: external_exports.string().nullable() }).strict();
+    MergeReadiness = external_exports.object({ tenantId: TenantId, projectId: ProjectId, claimId: external_exports.string(), ready: external_exports.boolean(), blockers: external_exports.array(ReadinessBlocker), checkedPairs: external_exports.number().int().nonnegative() }).strict();
+    claimPaths = {
+      claims: (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/claims`,
+      claim: (tenantId, projectId, id2) => `${claimPaths.claims(tenantId, projectId)}/${encodeURIComponent(id2)}`,
+      renew: (tenantId, projectId, id2) => `${claimPaths.claim(tenantId, projectId, id2)}/renew`,
+      release: (tenantId, projectId, id2) => `${claimPaths.claim(tenantId, projectId, id2)}/release`,
+      readiness: (tenantId, projectId, id2) => `${claimPaths.claim(tenantId, projectId, id2)}/readiness`,
+      settings: (tenantId, projectId) => `${claimPaths.claims(tenantId, projectId)}/settings`,
+      checks: (tenantId, projectId) => `${claimPaths.claims(tenantId, projectId)}/merge-checks`,
+      pending: (tenantId, projectId) => `${claimPaths.claims(tenantId, projectId)}/merge-checks/pending`,
+      runCheck: (tenantId, projectId) => `${claimPaths.claims(tenantId, projectId)}/merge-checks/run`
+    };
+  }
+});
+
+// ../contracts/src/budgets.ts
+var BUDGET_SCOPES, BudgetScope, MAX_BUDGET_CENTS, BUDGET_EXIT_CODE, ScopeId, BudgetLimit, PutBudgetRequest, DeleteBudgetRequest, BudgetSubject, BUDGET_SOURCES, BudgetLine, BudgetBindingSchema, BUDGET_STOP_REASONS, BudgetStopReason, BudgetCheckRequest, BudgetDecision, BudgetStop, RecordSpendRequest, BudgetUsageLine, BudgetSummary, BudgetStopList, budgetPaths;
+var init_budgets = __esm({
+  "../contracts/src/budgets.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    BUDGET_SCOPES = ["task", "agent", "project", "team"];
+    BudgetScope = external_exports.enum(BUDGET_SCOPES);
+    MAX_BUDGET_CENTS = 1e8;
+    BUDGET_EXIT_CODE = 6;
+    ScopeId = external_exports.string().min(1).max(128);
+    BudgetLimit = external_exports.object({
+      tenantId: TenantId,
+      scope: BudgetScope,
+      scopeId: ScopeId,
+      /** Task limits count the task's whole life; the others count the current billing period. */
+      limitCents: external_exports.number().int().positive().max(MAX_BUDGET_CENTS),
+      updatedBy: external_exports.string().min(1),
+      updatedAt: Timestamp
+    }).strict();
+    PutBudgetRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      scope: BudgetScope,
+      /** Omitted for the team. */
+      scopeId: ScopeId.optional(),
+      limitCents: external_exports.number().int().positive().max(MAX_BUDGET_CENTS)
+    }).strict().superRefine((request, ctx) => {
+      if (request.scope !== "team" && request.scopeId === void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: `a ${request.scope} budget names its ${request.scope}` });
+    });
+    DeleteBudgetRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), scope: BudgetScope, scopeId: ScopeId.optional() }).strict().superRefine((request, ctx) => {
+      if (request.scope !== "team" && request.scopeId === void 0) ctx.addIssue({ code: "custom", path: ["scopeId"], message: `a ${request.scope} budget names its ${request.scope}` });
+    });
+    BudgetSubject = external_exports.object({
+      projectId: ProjectId.optional(),
+      taskId: external_exports.string().min(1).max(128).optional(),
+      agentId: external_exports.string().min(1).max(128).optional()
+    }).strict();
+    BUDGET_SOURCES = ["budget", "billing_cap"];
+    BudgetLine = external_exports.object({
+      scope: BudgetScope,
+      scopeId: ScopeId,
+      /** `budget` is a control-plane limit; `billing_cap` is the MS-B5 spending cap read through the same check. */
+      source: external_exports.enum(BUDGET_SOURCES),
+      limitCents: external_exports.number().int().nonnegative(),
+      spentCents: external_exports.number().int().nonnegative()
+    }).strict();
+    BudgetBindingSchema = external_exports.object({
+      scope: BudgetScope,
+      scopeId: ScopeId,
+      source: external_exports.enum(BUDGET_SOURCES),
+      limitCents: external_exports.number().int().nonnegative(),
+      spentCents: external_exports.number().int().nonnegative(),
+      roomCents: external_exports.number().int()
+    }).strict();
+    BUDGET_STOP_REASONS = ["budget", "billing_cap", "read_only", "plan_allowance"];
+    BudgetStopReason = external_exports.enum(BUDGET_STOP_REASONS);
+    BudgetCheckRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      estimateCents: external_exports.number().int().nonnegative().max(MAX_BUDGET_CENTS),
+      projectId: ProjectId.optional(),
+      taskId: external_exports.string().min(1).max(128).optional(),
+      /** For a person calling on an agent's behalf. An agent token is always checked as itself. */
+      agentId: external_exports.string().min(1).max(128).optional(),
+      /** What the call is, for the record (`inference`, `ci`, `review`). Free text, never a prompt. */
+      kind: external_exports.string().min(1).max(64).optional(),
+      /** When true and the call is allowed, the estimate is recorded as spent so the next check counts it. */
+      commit: external_exports.boolean().default(false),
+      /** A billing meter, to also check the plan allowance (reviews, CI minutes, hosted inference). */
+      meter: external_exports.enum(["reviews", "ciMinutes", "docsCalls", "hostedInference"]).optional()
+    }).strict();
+    BudgetDecision = external_exports.object({
+      tenantId: TenantId,
+      allowed: external_exports.boolean(),
+      exitCode: external_exports.union([external_exports.literal(0), external_exports.literal(BUDGET_EXIT_CODE)]),
+      reason: BudgetStopReason.nullable(),
+      message: external_exports.string().min(1),
+      nextCommand: external_exports.string().nullable(),
+      estimateCents: external_exports.number().int().nonnegative(),
+      binding: BudgetBindingSchema.nullable(),
+      checked: external_exports.array(BudgetBindingSchema),
+      /** The ID of the stored stop record when refused. */
+      stopId: external_exports.string().nullable(),
+      /** True when this answer is a replay of an earlier request with the same ID. */
+      replay: external_exports.boolean(),
+      recorded: external_exports.boolean()
+    }).strict();
+    BudgetStop = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1),
+      reason: BudgetStopReason,
+      scope: BudgetScope.nullable(),
+      scopeId: external_exports.string().nullable(),
+      limitCents: external_exports.number().int().nonnegative().nullable(),
+      spentCents: external_exports.number().int().nonnegative().nullable(),
+      estimateCents: external_exports.number().int().nonnegative(),
+      projectId: external_exports.string().nullable(),
+      taskId: external_exports.string().nullable(),
+      agentId: external_exports.string().nullable(),
+      kind: external_exports.string().nullable(),
+      message: external_exports.string().min(1),
+      requestedBy: external_exports.string().min(1),
+      at: Timestamp
+    }).strict();
+    RecordSpendRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      cents: external_exports.number().int().positive().max(MAX_BUDGET_CENTS),
+      projectId: ProjectId.optional(),
+      taskId: external_exports.string().min(1).max(128).optional(),
+      agentId: external_exports.string().min(1).max(128).optional(),
+      kind: external_exports.string().min(1).max(64).optional()
+    }).strict();
+    BudgetUsageLine = external_exports.object({
+      scope: BudgetScope,
+      scopeId: ScopeId,
+      source: external_exports.enum(BUDGET_SOURCES),
+      limitCents: external_exports.number().int().nonnegative(),
+      spentCents: external_exports.number().int().nonnegative(),
+      remainingCents: external_exports.number().int()
+    }).strict();
+    BudgetSummary = external_exports.object({ tenantId: TenantId, periodStart: Timestamp, lines: external_exports.array(BudgetUsageLine) }).strict();
+    BudgetStopList = external_exports.object({ tenantId: TenantId, stops: external_exports.array(BudgetStop) }).strict();
+    budgetPaths = {
+      root: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/budgets`,
+      check: (tenantId) => `${budgetPaths.root(tenantId)}/check`,
+      spend: (tenantId) => `${budgetPaths.root(tenantId)}/spend`,
+      stops: (tenantId) => `${budgetPaths.root(tenantId)}/stops`
+    };
+  }
+});
+
+// ../contracts/src/rules-sync.ts
+function rulesRevision(source) {
+  return sha256Hex(normaliseText(source)).slice(0, 12);
+}
+function validateRulesSource(source) {
+  const text = normaliseText(source);
+  if (text.trim() === "") return { ok: false, problem: `${RULES_SOURCE_PATH} is empty` };
+  if (new TextEncoder().encode(text).length > MAX_RULES_BYTES) return { ok: false, problem: `${RULES_SOURCE_PATH} is larger than ${MAX_RULES_BYTES / 1024} KB` };
+  if (text.includes(MARKER)) return { ok: false, problem: `${RULES_SOURCE_PATH} contains the text "${MARKER}", which is reserved for the managed region markers` };
+  return { ok: true, text: text.endsWith("\n") ? text : `${text}
+`, revision: rulesRevision(text) };
+}
+function regionBody(source) {
+  return `<!-- Generated from ${RULES_SOURCE_PATH}. Edit that file, then run \`overlane rules sync\`. A hand edit in this region is reported as drift. -->
+
+${source}`;
+}
+function renderRegion(source) {
+  const check2 = validateRulesSource(source);
+  if (!check2.ok) throw new Error(check2.problem);
+  const body2 = regionBody(check2.text);
+  return `<!-- ${MARKER}:begin rev=${check2.revision} digest=${digestOf(body2)} -->
+${body2}<!-- ${MARKER}:end -->
+`;
+}
+function scanRegion(fileText) {
+  const lines = normaliseText(fileText).split("\n");
+  const regions = [];
+  let open2 = null;
+  for (let i2 = 0; i2 < lines.length; i2 += 1) {
+    const line3 = lines[i2];
+    const begin = BEGIN.exec(line3);
+    if (begin !== null) {
+      if (open2 !== null) return { kind: "damaged", problem: `a second begin marker on line ${i2 + 1} before the end of the region from line ${open2.index + 1}` };
+      open2 = { index: i2, revision: begin[1], digest: begin[2] };
+    } else if (line3.trim().startsWith(`<!-- ${MARKER}:begin`)) {
+      return { kind: "damaged", problem: `line ${i2 + 1} looks like a begin marker but is not well formed` };
+    } else if (line3 === END_LINE) {
+      if (open2 === null) return { kind: "damaged", problem: `an end marker on line ${i2 + 1} with no begin marker` };
+      regions.push({ startLine: open2.index, endLine: i2, revision: open2.revision, digest: open2.digest, body: `${lines.slice(open2.index + 1, i2).join("\n")}
+` });
+      open2 = null;
+    }
+  }
+  if (open2 !== null) return { kind: "damaged", problem: `the begin marker on line ${open2.index + 1} has no end marker` };
+  if (regions.length > 1) return { kind: "damaged", problem: `${regions.length} managed regions in one file` };
+  const only = regions[0];
+  return only === void 0 ? { kind: "none" } : { kind: "one", region: only };
+}
+function firstDifference(found, expected) {
+  const a = found.split("\n");
+  const b = expected.split("\n");
+  const length = Math.max(a.length, b.length);
+  for (let i2 = 0; i2 < length; i2 += 1) {
+    if ((a[i2] ?? "") !== (b[i2] ?? "")) return { line: i2 + 1, found: a[i2] ?? "", expected: b[i2] ?? "" };
+  }
+  return { line: 1, found: "", expected: "" };
+}
+function describeLine(text) {
+  const clean2 = text.trim();
+  return clean2.length > 80 ? `${clean2.slice(0, 77)}...` : clean2;
+}
+function inspectRegionTarget(target2, fileText, source) {
+  const base4 = { id: target2.id, path: target2.path };
+  if (fileText === null) return { ...base4, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
+  const scan = scanRegion(fileText);
+  if (scan.kind === "damaged") return { ...base4, state: "damaged", detail: `${target2.path}: ${scan.problem}; fix the markers by hand, then run sync`, syncable: false };
+  if (scan.kind === "none") return { ...base4, state: "unmanaged", detail: `${target2.path} has no managed region; sync appends one and keeps every existing line`, syncable: true };
+  const { region } = scan;
+  if (digestOf(region.body) !== region.digest) {
+    const expected = regionBody(source.text);
+    const diff = firstDifference(region.body, region.revision === source.revision ? expected : region.body);
+    const where2 = region.revision === source.revision ? `line ${diff.line} of the region` : "the region";
+    return {
+      ...base4,
+      state: "edited",
+      detail: `${target2.path}: ${where2} was edited by hand${region.revision === source.revision ? ` (found "${describeLine(diff.found)}", the source says "${describeLine(diff.expected)}")` : ""}; move the change into ${RULES_SOURCE_PATH}, or run sync --overwrite-edits to replace it`,
+      ...region.revision === source.revision ? { firstDifference: diff } : {},
+      syncable: false
+    };
+  }
+  if (region.revision !== source.revision) return { ...base4, state: "stale", detail: `${target2.path} was written from revision ${region.revision}; the source is ${source.revision}; sync updates it`, syncable: true };
+  return { ...base4, state: "in_sync", detail: `${target2.path} matches revision ${source.revision}`, syncable: true };
+}
+function planRegionSync(target2, fileText, source, force) {
+  const report2 = inspectRegionTarget(target2, fileText, source);
+  const region = renderRegion(source.text);
+  const base4 = { id: target2.id, path: target2.path };
+  switch (report2.state) {
+    case "in_sync":
+      return { ...base4, action: "none", next: null, reason: report2.detail };
+    case "missing":
+      return { ...base4, action: "create", next: `${target2.preamble}${region}`, reason: "created" };
+    case "unmanaged": {
+      const text = normaliseText(fileText);
+      const joined = text === "" ? "" : text.endsWith("\n\n") ? text : text.endsWith("\n") ? `${text}
+` : `${text}
+
+`;
+      return { ...base4, action: "append", next: `${joined}${region}`, reason: "appended a managed region at the end; every existing line is kept" };
+    }
+    case "stale":
+    case "edited": {
+      if (report2.state === "edited" && !force) return { ...base4, action: "refuse", next: null, reason: report2.detail };
+      const scan = scanRegion(fileText);
+      if (scan.kind !== "one") return { ...base4, action: "refuse", next: null, reason: report2.detail };
+      const lines = normaliseText(fileText).split("\n");
+      const before = lines.slice(0, scan.region.startLine).join("\n");
+      const after = lines.slice(scan.region.endLine + 1).join("\n");
+      const next = `${before === "" ? "" : `${before}
+`}${region}${after === "" ? "" : after}`;
+      const replaced = scan.region.body.split("\n").filter((l, i2, all) => !(i2 === all.length - 1 && l === ""));
+      const written = new Set(regionBody(source.text).split("\n"));
+      const going = replaced.filter((l) => l.trim() !== "" && !written.has(l));
+      return {
+        ...base4,
+        action: report2.state === "edited" ? "force_replace" : "replace",
+        next: next.endsWith("\n") ? next : `${next}
+`,
+        ...report2.state === "edited" ? { replaces: { lines: replaced.length, firstLines: (going.length > 0 ? going : replaced).slice(0, 5) } } : {},
+        reason: report2.state === "edited" ? "replaced a hand-edited region because --force was given" : "updated to the current revision"
+      };
+    }
+    case "damaged":
+      return { ...base4, action: "refuse", next: null, reason: report2.detail };
+  }
+}
+function parseSettings(text) {
+  if (text === null || text.trim() === "") return { ok: true, value: {} };
+  try {
+    const value = JSON.parse(text);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return { ok: false, problem: "is not a JSON object" };
+    return { ok: true, value };
+  } catch {
+    return { ok: false, problem: "is not valid JSON (comments are not supported here)" };
+  }
+}
+function contextFileNames(settings) {
+  const context4 = settings["context"];
+  if (context4 === null || typeof context4 !== "object" || Array.isArray(context4)) return { names: [], shape: "none" };
+  const fileName = context4["fileName"];
+  if (typeof fileName === "string") return { names: [fileName], shape: "string" };
+  if (Array.isArray(fileName) && fileName.every((n) => typeof n === "string")) return { names: fileName, shape: "array" };
+  return { names: [], shape: fileName === void 0 ? "none" : "other" };
+}
+function inspectGeminiSettings(target2, fileText) {
+  const base4 = { id: target2.id, path: target2.path };
+  if (fileText === null) return { ...base4, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
+  const parsed = parseSettings(fileText);
+  if (!parsed.ok) return { ...base4, state: "damaged", detail: `${target2.path} ${parsed.problem}; fix it by hand, then run sync`, syncable: false };
+  const { names, shape: shape2 } = contextFileNames(parsed.value);
+  if (shape2 === "other") return { ...base4, state: "damaged", detail: `${target2.path}: context.fileName is neither a string nor a list of strings; fix it by hand, then run sync`, syncable: false };
+  const missing = GEMINI_CONTEXT_FILES.filter((name2) => !names.includes(name2));
+  if (missing.length === 0) return { ...base4, state: "in_sync", detail: `${target2.path} lists ${GEMINI_CONTEXT_FILES.join(" and ")}`, syncable: true };
+  return { ...base4, state: "unmanaged", detail: `${target2.path}: context.fileName does not list ${missing.join(" and ")}; sync adds it and keeps every other setting`, syncable: true };
+}
+function planGeminiSettingsSync(target2, fileText) {
+  const report2 = inspectGeminiSettings(target2, fileText);
+  const base4 = { id: target2.id, path: target2.path };
+  if (report2.state === "in_sync") return { ...base4, action: "none", next: null, reason: report2.detail };
+  if (report2.state === "damaged") return { ...base4, action: "refuse", next: null, reason: report2.detail };
+  const parsed = parseSettings(fileText);
+  if (!parsed.ok) return { ...base4, action: "refuse", next: null, reason: report2.detail };
+  const settings = { ...parsed.value };
+  const existing = contextFileNames(settings).names;
+  const context4 = settings["context"] !== null && typeof settings["context"] === "object" && !Array.isArray(settings["context"]) ? { ...settings["context"] } : {};
+  const names = [...existing];
+  for (const name2 of GEMINI_CONTEXT_FILES) if (!names.includes(name2)) names.push(name2);
+  context4["fileName"] = names;
+  settings["context"] = context4;
+  return { ...base4, action: fileText === null ? "create" : "append", next: `${JSON.stringify(settings, null, 2)}
+`, reason: fileText === null ? "created" : "added the missing names to context.fileName; nothing else changed" };
+}
+function checkRules(source, input2) {
+  if (source === null) return { configured: false, revision: null, sourceProblem: null, drifted: false, targets: [], nextCommand: `create ${RULES_SOURCE_PATH}, then run overlane rules sync` };
+  const check2 = validateRulesSource(source);
+  if (!check2.ok) return { configured: true, revision: null, sourceProblem: check2.problem, drifted: true, targets: [], nextCommand: `fix ${RULES_SOURCE_PATH}` };
+  const targets = RULES_TARGETS.map((target2) => target2.kind === "region" ? inspectRegionTarget(target2, input2.files[target2.path] ?? null, check2) : inspectGeminiSettings(target2, input2.files[target2.path] ?? null));
+  const drifted = targets.some((t) => t.state !== "in_sync");
+  const needsForce = targets.some((t) => t.state === "edited");
+  return { configured: true, revision: check2.revision, sourceProblem: null, drifted, targets, nextCommand: !drifted ? null : needsForce ? "overlane rules sync --overwrite-edits" : "overlane rules sync" };
+}
+function planRulesSync(source, input2, options = {}) {
+  const check2 = validateRulesSource(source);
+  if (!check2.ok) return { ok: false, problem: check2.problem };
+  const steps = RULES_TARGETS.map((target2) => target2.kind === "region" ? planRegionSync(target2, input2.files[target2.path] ?? null, check2, options.force === true) : planGeminiSettingsSync(target2, input2.files[target2.path] ?? null));
+  return { ok: true, plan: { steps, blocked: steps.some((s) => s.action === "refuse") } };
+}
+var RULES_SOURCE_PATH, MAX_RULES_BYTES, MARKER, RULES_TARGET_IDS, RulesTargetId, CURSOR_PREAMBLE, RULES_TARGETS, GEMINI_CONTEXT_FILES, normaliseText, digestOf, BEGIN, END_LINE, TARGET_STATES, TargetState, RulesCheckReport;
+var init_rules_sync = __esm({
+  "../contracts/src/rules-sync.ts"() {
+    "use strict";
+    init_zod();
+    init_audit();
+    RULES_SOURCE_PATH = ".overlane/rules.md";
+    MAX_RULES_BYTES = 64 * 1024;
+    MARKER = "overlane-rules";
+    RULES_TARGET_IDS = ["agents-md", "claude-md", "cursor", "gemini-md", "gemini-settings"];
+    RulesTargetId = external_exports.enum(RULES_TARGET_IDS);
+    CURSOR_PREAMBLE = "---\ndescription: Project rules, generated from .overlane/rules.md\nalwaysApply: true\n---\n\n";
+    RULES_TARGETS = [
+      { id: "agents-md", path: "AGENTS.md", kind: "region", reader: "Codex, Cursor, Gemini CLI and other agents that read AGENTS.md", preamble: "" },
+      { id: "claude-md", path: "CLAUDE.md", kind: "region", reader: "Claude Code", preamble: "" },
+      { id: "cursor", path: ".cursor/rules/overlane.mdc", kind: "region", reader: "Cursor", preamble: CURSOR_PREAMBLE },
+      { id: "gemini-md", path: "GEMINI.md", kind: "region", reader: "Gemini CLI", preamble: "" },
+      { id: "gemini-settings", path: ".gemini/settings.json", kind: "gemini-settings", reader: "Gemini CLI settings (context.fileName)", preamble: "" }
+    ];
+    GEMINI_CONTEXT_FILES = ["GEMINI.md", "AGENTS.md"];
+    normaliseText = (text) => text.replace(/\r\n?/g, "\n");
+    digestOf = (body2) => sha256Hex(body2).slice(0, 16);
+    BEGIN = new RegExp(`^<!-- ${MARKER}:begin rev=([0-9a-f]{12}) digest=([0-9a-f]{16}) -->$`);
+    END_LINE = `<!-- ${MARKER}:end -->`;
+    TARGET_STATES = ["in_sync", "missing", "unmanaged", "stale", "edited", "damaged"];
+    TargetState = external_exports.enum(TARGET_STATES);
+    RulesCheckReport = external_exports.object({
+      configured: external_exports.boolean(),
+      revision: external_exports.string().nullable(),
+      sourceProblem: external_exports.string().nullable(),
+      drifted: external_exports.boolean(),
+      targets: external_exports.array(
+        external_exports.object({
+          id: RulesTargetId,
+          path: external_exports.string(),
+          state: TargetState,
+          detail: external_exports.string(),
+          syncable: external_exports.boolean(),
+          firstDifference: external_exports.object({ line: external_exports.number().int(), found: external_exports.string(), expected: external_exports.string() }).strict().optional()
+        }).strict()
+      ),
+      nextCommand: external_exports.string().nullable()
+    }).strict();
+  }
+});
+
+// ../contracts/src/pr-routing.ts
+var ROUTE_LANES, RouteLane, ROUTE_RISKS, RouteRisk, CHECK_STATES, CheckState, PrChecks, NO_CHECKS, SEG, END, SECRETS2, WORKFLOWS, MIGRATIONS, BILLING2, AUTH, INFRA, DOCS, TESTS, RiskSignal, DeterministicRisk, Blocker, MODEL_STATUSES, ModelStatus, APPROVAL_REQUIREMENTS, RouteDecision, ROUTE_APPROVER_ROLES, RoutingPolicy, PutRoutingPolicyRequest, ROUTE_APPROVAL_SOURCES, RouteApprovalInput, RoutePrRequest, StoredRoute, RouteApproveRequest, prRoutingPaths;
+var init_pr_routing = __esm({
+  "../contracts/src/pr-routing.ts"() {
+    "use strict";
+    init_zod();
+    init_autonomy();
+    init_claims();
+    init_common();
+    init_review();
+    ROUTE_LANES = ["blocked", "fast", "standard", "approver"];
+    RouteLane = external_exports.enum(ROUTE_LANES);
+    ROUTE_RISKS = ["low", "medium", "high"];
+    RouteRisk = external_exports.enum(ROUTE_RISKS);
+    CHECK_STATES = ["passed", "failed", "pending", "missing"];
+    CheckState = external_exports.enum(CHECK_STATES);
+    PrChecks = external_exports.object({
+      ci: CheckState.default("missing"),
+      secretScan: CheckState.default("missing"),
+      guardrails: CheckState.default("missing"),
+      /** The pre-merge conflict check (MS-C1.1): passed means no conflict. */
+      conflict: CheckState.default("missing"),
+      /** Unresolved critical review findings. */
+      criticalFindings: external_exports.number().int().nonnegative().default(0),
+      /** The Overlane review run finished for this head. */
+      reviewDone: external_exports.boolean().default(false)
+    }).strict();
+    NO_CHECKS = { ci: "missing", secretScan: "missing", guardrails: "missing", conflict: "missing", criticalFindings: 0, reviewDone: false };
+    SEG = "(?:^|/)";
+    END = "(?:/|\\.|[-_]|$)";
+    SECRETS2 = [new RegExp(`${SEG}\\.env(?:\\.|$)`), new RegExp(`${SEG}(?:secrets?|credentials?)${END}`), /\.(?:pem|key|p12|pfx|jks|keystore)$/, new RegExp(`${SEG}id_(?:rsa|ed25519|ecdsa)`), /\.tfvars$/, new RegExp(`${SEG}\\.npmrc$`)];
+    WORKFLOWS = [/^\.github\/(?:workflows|actions)\//, /^\.gitlab-ci/, new RegExp(`${SEG}\\.circleci/`), new RegExp(`${SEG}azure-pipelines`), new RegExp(`${SEG}jenkinsfile`), /^\.buildkite\//];
+    MIGRATIONS = [new RegExp(`${SEG}(?:migrations?|db/migrate)/`), /\.sql$/, new RegExp(`${SEG}schema\\.(?:sql|prisma)$`), new RegExp(`${SEG}drizzle/`)];
+    BILLING2 = [new RegExp(`${SEG}(?:billing|payments?|stripe|invoices?|checkout|subscriptions?)${END}`)];
+    AUTH = [new RegExp(`${SEG}(?:auth|authn|authz|oauth|identity|permissions?|rbac|acl|sessions?|login|sso|saml|tokens?)${END}`)];
+    INFRA = [new RegExp(`${SEG}wrangler\\.(?:json|jsonc|toml)$`), new RegExp(`${SEG}dockerfile`), new RegExp(`${SEG}docker-compose`), /\.tf$/, new RegExp(`${SEG}(?:k8s|kubernetes|helm|terraform)/`)];
+    DOCS = [/^docs\//, /^apps\/docs\//, /\.(?:md|mdx|txt|rst)$/, new RegExp(`${SEG}readme`)];
+    TESTS = [new RegExp(`${SEG}(?:tests?|__tests__|spec|e2e)/`), /\.(?:test|spec)\.[cm]?[jt]sx?$/];
+    RiskSignal = external_exports.object({ code: external_exports.string().min(1), message: external_exports.string().min(1) }).strict();
+    DeterministicRisk = external_exports.object({
+      level: RouteRisk,
+      linesChanged: external_exports.number().int().nonnegative(),
+      filesChanged: external_exports.number().int().nonnegative(),
+      sensitive: external_exports.array(external_exports.object({ path: external_exports.string(), category: external_exports.string() }).strict()),
+      kind: external_exports.enum(["docs", "tests", "code", "mixed", "empty"]),
+      signals: external_exports.array(RiskSignal)
+    }).strict();
+    Blocker = external_exports.object({ code: external_exports.string().min(1), message: external_exports.string().min(1), nextCommand: external_exports.string().nullable() }).strict();
+    MODEL_STATUSES = ["off", "skipped", "undecided", "failed", "used"];
+    ModelStatus = external_exports.enum(MODEL_STATUSES);
+    APPROVAL_REQUIREMENTS = ["none", "independent", "approver"];
+    RouteDecision = external_exports.object({
+      lane: RouteLane,
+      /** Risk after the model, if it raised it; equals `deterministic.level` otherwise. */
+      risk: RouteRisk,
+      deterministic: DeterministicRisk,
+      blockers: external_exports.array(Blocker),
+      model: external_exports.object({ status: ModelStatus, level: RouteRisk.nullable(), raised: external_exports.boolean(), note: external_exports.string() }).strict(),
+      approval: external_exports.object({ requirement: external_exports.enum(APPROVAL_REQUIREMENTS), reviewRequired: external_exports.boolean() }).strict(),
+      reasons: external_exports.array(external_exports.string()),
+      nextCommand: external_exports.string().nullable(),
+      /** True when the model may still be asked: the checks are clean and the lane can still rise. */
+      modelEligible: external_exports.boolean()
+    }).strict();
+    ROUTE_APPROVER_ROLES = ["owner", "admin"];
+    RoutingPolicy = external_exports.object({
+      approverUsers: external_exports.array(external_exports.string().min(1).max(200)).max(50).default([]),
+      approverRoles: external_exports.array(external_exports.enum(ROUTE_APPROVER_ROLES)).max(2).default(["owner", "admin"]),
+      /** Off by default: the approver lane is a person's. Turning it on lets an independent agent with evidence approve it too. */
+      allowAgentApprover: external_exports.boolean().default(false),
+      maxBatchSize: external_exports.number().int().min(2).max(20).default(5)
+    }).strict();
+    PutRoutingPolicyRequest = RoutingPolicy.partial().strict();
+    ROUTE_APPROVAL_SOURCES = ["agent", "person", "model"];
+    RouteApprovalInput = external_exports.object({
+      /** Optional: the service derives it from who is signed in (an agent token is `agent`, a signed-in member `person`). `model` is accepted only to be refused. */
+      source: external_exports.enum(ROUTE_APPROVAL_SOURCES).optional(),
+      /** What was checked, for an agent's approval. */
+      evidence: external_exports.array(external_exports.string().min(1).max(400)).max(20).default([]),
+      reason: external_exports.string().max(400).default("")
+    }).strict();
+    RoutePrRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      pull: PullRequestSnapshot,
+      checks: PrChecks.default({ ...NO_CHECKS }),
+      taskId: external_exports.string().min(1).max(128).optional(),
+      branch: external_exports.string().min(1).max(250).optional(),
+      baseRef: external_exports.string().min(1).max(250).optional(),
+      /** The claimed scope patterns, when the task holds a claim (MS-C1.1). */
+      scope: external_exports.array(external_exports.string().min(1).max(300)).max(128).optional(),
+      /** The agent token that opened the pull request, so its lineage is known to the independence check. */
+      authorAgentTokenId: external_exports.string().min(1).max(200).optional(),
+      authorUserId: external_exports.string().min(1).max(200).optional()
+    }).strict();
+    StoredRoute = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      repository: external_exports.string().min(1),
+      number: external_exports.number().int().positive(),
+      headSha: external_exports.string().min(1),
+      title: external_exports.string(),
+      author: external_exports.string(),
+      taskId: external_exports.string().nullable(),
+      branch: external_exports.string().nullable(),
+      baseRef: external_exports.string().nullable(),
+      route: RouteDecision,
+      checks: PrChecks,
+      approvals: external_exports.array(external_exports.object({ id: external_exports.string(), source: external_exports.enum(ROUTE_APPROVAL_SOURCES), approver: external_exports.string(), via: external_exports.string(), at: Timestamp }).strict()),
+      /** The lane's requirement is met by an accepted approval at this head and the checks are still clean. */
+      approved: external_exports.boolean(),
+      routedAt: Timestamp
+    }).strict();
+    RouteApproveRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      repository: external_exports.string().min(1).max(200),
+      number: external_exports.number().int().positive(),
+      headSha: external_exports.string().min(1).max(64),
+      approval: RouteApprovalInput
+    }).strict();
+    prRoutingPaths = {
+      routes: (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/pr-routes`,
+      route: (tenantId, projectId) => `${prRoutingPaths.routes(tenantId, projectId)}/route`,
+      approve: (tenantId, projectId) => `${prRoutingPaths.routes(tenantId, projectId)}/approve`,
+      batch: (tenantId, projectId) => `${prRoutingPaths.routes(tenantId, projectId)}/batch`,
+      policy: (tenantId, projectId) => `${prRoutingPaths.routes(tenantId, projectId)}/policy`
+    };
+  }
+});
+
+// ../contracts/src/egress.ts
+function normaliseHost(raw) {
+  let host = raw.trim().toLowerCase();
+  if (host === "") return { ok: false, reason: "invalid_host" };
+  if (/[^\u0000-\u007f]/.test(host)) return { ok: false, reason: "non_ascii_host" };
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  if (host.includes(":")) return /^[0-9a-f:.]+$/.test(host) && host.length >= 2 ? { ok: true, host, kind: "ip" } : { ok: false, reason: "invalid_host" };
+  if (host.endsWith(".")) host = host.slice(0, -1);
+  if (host === "" || host.length > 253 || host.endsWith(".") || /[\s/\\@#?%*]/.test(host)) return { ok: false, reason: "invalid_host" };
+  const labels = host.split(".");
+  const last = labels[labels.length - 1];
+  if (/^(?:0x[0-9a-f]*|\d+)$/.test(last)) return /^[0-9a-fx.]+$/.test(host) ? { ok: true, host, kind: "ip" } : { ok: false, reason: "invalid_host" };
+  if (!labels.every((label2) => LABEL.test(label2))) return { ok: false, reason: "invalid_host" };
+  return { ok: true, host, kind: "name" };
+}
+function isMetadataHost(host) {
+  return METADATA_NAMES.has(host) || METADATA_ADDRESSES.has(host);
+}
+function isInternalName(host) {
+  return host === "localhost" || INTERNAL_SUFFIXES.some((suffix) => host.endsWith(suffix)) || !host.includes(".");
+}
+function isSharedHostingWildcard(pattern) {
+  if (!pattern.startsWith("*.")) return false;
+  const name2 = pattern.slice(2);
+  return SHARED_HOSTING_SUFFIXES.some((suffix) => name2 === suffix || name2.endsWith(`.${suffix}`));
+}
+var LABEL, METADATA_NAMES, METADATA_ADDRESSES, INTERNAL_SUFFIXES, SHARED_HOSTING_SUFFIXES, HOST_PATTERN, MAX_EGRESS_RULES, EgressRule, EGRESS_MODES, EgressPolicy, EgressPolicyView, PutEgressPolicyRequest, EGRESS_REASONS, EgressReason, EgressDecision, EgressEvent, EvaluateEgressRequest, GRANT_SCOPES, GrantScope, MAX_GRANT_SECONDS, MAX_GRANT_HOSTS, DENIED_HEADERS, GrantAttach, SECRET_NAME, GrantRequest, GRANT_STATUSES, TaskGrant, ResolveRefusal, RevokeGrantRequest, LeakScanRequest, LeakFilesRequest, LeakFinding, LeakScanResult, egressPaths;
+var init_egress = __esm({
+  "../contracts/src/egress.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    METADATA_NAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata", "instance-data", "metadata.azure.com", "metadata.tencentyun.com"]);
+    METADATA_ADDRESSES = /* @__PURE__ */ new Set(["169.254.169.254", "169.254.170.2", "100.100.100.200", "192.0.0.192", "fd00:ec2::254", "::ffff:169.254.169.254"]);
+    INTERNAL_SUFFIXES = [".internal", ".local", ".localhost", ".localdomain", ".lan", ".home.arpa", ".corp", ".intranet", ".cluster.local"];
+    SHARED_HOSTING_SUFFIXES = [
+      "co.uk",
+      "org.uk",
+      "com.au",
+      "co.jp",
+      "co.nz",
+      "co.in",
+      "com.br",
+      "github.io",
+      "githubusercontent.com",
+      "gitlab.io",
+      "herokuapp.com",
+      "vercel.app",
+      "netlify.app",
+      "workers.dev",
+      "pages.dev",
+      "web.app",
+      "firebaseapp.com",
+      "appspot.com",
+      "azurewebsites.net",
+      "cloudfront.net",
+      "amazonaws.com",
+      "blob.core.windows.net",
+      "r2.dev",
+      "ngrok.io",
+      "ngrok-free.app",
+      "trycloudflare.com",
+      "onrender.com",
+      "fly.dev",
+      "glitch.me",
+      "repl.co"
+    ];
+    HOST_PATTERN = external_exports.string().min(3).max(253).refine((value) => {
+      const text = value.trim().toLowerCase();
+      const name2 = text.startsWith("*.") ? text.slice(2) : text;
+      const check2 = normaliseHost(name2);
+      return check2.ok && check2.kind === "name" && name2.includes(".") && !isMetadataHost(name2) && !isInternalName(name2) && !isSharedHostingWildcard(text);
+    }, "must be a host name such as registry.npmjs.org or *.example.com (no address, no internal name, no wildcard over a top-level or shared-hosting domain)");
+    MAX_EGRESS_RULES = 100;
+    EgressRule = external_exports.object({
+      /** An exact host, or `*.example.com`, which matches any subdomain at any depth and never the apex `example.com`. */
+      host: HOST_PATTERN.transform((value) => value.trim().toLowerCase()),
+      /** Allowed destination ports. Default 443. */
+      ports: external_exports.array(external_exports.number().int().min(1).max(65535)).min(1).max(8).default([443]),
+      note: external_exports.string().max(200).optional()
+    }).strict();
+    EGRESS_MODES = ["enforce", "report"];
+    EgressPolicy = external_exports.object({
+      /** `enforce` denies what no rule allows. `report` records it and allows it, to learn what a job needs before enforcing. Raw addresses and metadata services are denied in both. */
+      mode: external_exports.enum(EGRESS_MODES).default("enforce"),
+      rules: external_exports.array(EgressRule).max(MAX_EGRESS_RULES).default([])
+    }).strict();
+    EgressPolicyView = EgressPolicy.extend({ tenantId: TenantId, projectId: ProjectId, version: external_exports.number().int().nonnegative(), updatedAt: Timestamp.nullable() }).strict();
+    PutEgressPolicyRequest = EgressPolicy.extend({ expectedVersion: external_exports.number().int().nonnegative().optional() }).strict();
+    EGRESS_REASONS = ["rule_match", "no_rule", "port_not_allowed", "report_only", "invalid_host", "raw_ip", "metadata", "internal_name", "private_address"];
+    EgressReason = external_exports.enum(EGRESS_REASONS);
+    EgressDecision = external_exports.object({
+      outcome: external_exports.enum(["allowed", "denied", "reported"]),
+      /** False only when the request must not go out. `reported` is allowed. */
+      allowed: external_exports.boolean(),
+      reason: EgressReason,
+      host: external_exports.string(),
+      port: external_exports.number().int(),
+      rule: external_exports.string().nullable(),
+      message: external_exports.string()
+    }).strict();
+    EgressEvent = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      id: external_exports.string().min(1),
+      at: Timestamp,
+      source: external_exports.enum(["runner", "api"]),
+      taskId: external_exports.string().nullable(),
+      runId: external_exports.string().nullable(),
+      host: external_exports.string(),
+      port: external_exports.number().int(),
+      outcome: external_exports.enum(["allowed", "denied", "reported"]),
+      reason: EgressReason,
+      rule: external_exports.string().nullable(),
+      grantId: external_exports.string().nullable()
+    }).strict();
+    EvaluateEgressRequest = external_exports.object({
+      host: external_exports.string().min(1).max(300),
+      port: external_exports.number().int().min(1).max(65535).default(443),
+      taskId: external_exports.string().min(1).max(128).optional(),
+      runId: external_exports.string().min(1).max(128).optional(),
+      /** What the name resolved to, when the caller looked it up. */
+      resolved: external_exports.array(external_exports.string().min(1).max(64)).max(16).optional()
+    }).strict();
+    GRANT_SCOPES = ["task", "project", "team"];
+    GrantScope = external_exports.enum(GRANT_SCOPES);
+    MAX_GRANT_SECONDS = 24 * 3600;
+    MAX_GRANT_HOSTS = 10;
+    DENIED_HEADERS = /* @__PURE__ */ new Set(["host", "content-length", "transfer-encoding", "connection", "upgrade", "te", "trailer", "proxy-authorization", "cookie", "set-cookie", "x-forwarded-for", "x-forwarded-host"]);
+    GrantAttach = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("bearer") }).strict(),
+      external_exports.object({ kind: external_exports.literal("header"), name: external_exports.string().regex(/^[a-z][a-z0-9-]{1,40}$/).refine((n) => !DENIED_HEADERS.has(n), "that header cannot carry a credential") }).strict()
+    ]);
+    SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
+    GrantRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      scope: GrantScope.default("task"),
+      /** Required for a task grant. */
+      taskId: external_exports.string().min(1).max(128).optional(),
+      hosts: external_exports.array(HOST_PATTERN.transform((v) => v.trim().toLowerCase())).min(1).max(MAX_GRANT_HOSTS),
+      /** The secret's name in the project's secret store. The value is never in this request or its answer. */
+      secretName: external_exports.string().regex(SECRET_NAME, "an upper-case secret name such as NPM_TOKEN"),
+      attach: GrantAttach.default({ kind: "bearer" }),
+      ttlSeconds: external_exports.number().int().min(60).max(MAX_GRANT_SECONDS).default(900)
+    }).strict().superRefine((request, ctx) => {
+      if (request.scope === "task" && request.taskId === void 0) ctx.addIssue({ code: "custom", path: ["taskId"], message: "a task grant names its task" });
+      if (request.scope !== "task" && request.taskId !== void 0) ctx.addIssue({ code: "custom", path: ["taskId"], message: "only a task grant names a task" });
+    });
+    GRANT_STATUSES = ["active", "expired", "revoked"];
+    TaskGrant = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      id: external_exports.string().min(1),
+      scope: GrantScope,
+      taskId: external_exports.string().nullable(),
+      hosts: external_exports.array(external_exports.string()),
+      secretName: external_exports.string(),
+      attach: GrantAttach,
+      status: external_exports.enum(GRANT_STATUSES),
+      createdBy: external_exports.string(),
+      createdAt: Timestamp,
+      expiresAt: Timestamp,
+      revokedAt: Timestamp.nullable(),
+      uses: external_exports.number().int().nonnegative(),
+      class: external_exports.enum(["grant", "secrets"])
+    }).strict();
+    ResolveRefusal = external_exports.enum(["no_grant", "expired", "revoked", "host_not_granted", "task_mismatch", "egress_denied", "secret_unavailable", "port_not_allowed"]);
+    RevokeGrantRequest = external_exports.object({ reason: external_exports.string().max(200).optional() }).strict();
+    LeakScanRequest = external_exports.object({
+      texts: external_exports.array(external_exports.object({ name: external_exports.string().min(1).max(300), text: external_exports.string().max(2e6) }).strict()).max(200).default([]),
+      /** The workspace's file listing. */
+      files: external_exports.array(external_exports.string().min(1).max(500)).max(2e4).default([])
+    }).strict();
+    LeakFilesRequest = LeakScanRequest.pick({ files: true }).strict();
+    LeakFinding = external_exports.object({
+      kind: external_exports.enum(["minted_value", "credential_pattern", "credential_file"]),
+      rule: external_exports.string(),
+      place: external_exports.string(),
+      line: external_exports.number().int().nullable(),
+      grantId: external_exports.string().nullable()
+    }).strict();
+    LeakScanResult = external_exports.object({ tenantId: TenantId, projectId: ProjectId, clean: external_exports.boolean(), checkedGrants: external_exports.number().int().nonnegative(), findings: external_exports.array(LeakFinding) }).strict();
+    egressPaths = {
+      base: (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/egress`,
+      policy: (tenantId, projectId) => `${egressPaths.base(tenantId, projectId)}/policy`,
+      evaluate: (tenantId, projectId) => `${egressPaths.base(tenantId, projectId)}/evaluate`,
+      events: (tenantId, projectId) => `${egressPaths.base(tenantId, projectId)}/events`,
+      grants: (tenantId, projectId) => `${egressPaths.base(tenantId, projectId)}/grants`,
+      grant: (tenantId, projectId, id2) => `${egressPaths.grants(tenantId, projectId)}/${encodeURIComponent(id2)}`,
+      revoke: (tenantId, projectId, id2) => `${egressPaths.grant(tenantId, projectId, id2)}/revoke`,
+      leakScan: (tenantId, projectId) => `${egressPaths.base(tenantId, projectId)}/leak-scan`
+    };
+  }
+});
+
 // ../contracts/src/index.ts
 var init_src = __esm({
   "../contracts/src/index.ts"() {
@@ -25078,6 +25951,11 @@ var init_src = __esm({
     init_ci();
     init_deploy();
     init_decision();
+    init_claims();
+    init_budgets();
+    init_rules_sync();
+    init_pr_routing();
+    init_egress();
   }
 });
 
@@ -25348,13 +26226,13 @@ var require_directives = __commonJS({
        * @param onError - May be called even if the action was successful
        * @returns `true` on success
        */
-      add(line2, onError) {
+      add(line3, onError) {
         if (this.atNextDocument) {
           this.yaml = { explicit: _Directives.defaultYaml.explicit, version: "1.1" };
           this.tags = Object.assign({}, _Directives.defaultTags);
           this.atNextDocument = false;
         }
-        const parts2 = line2.trim().split(/[ \t]+/);
+        const parts2 = line3.trim().split(/[ \t]+/);
         const name2 = parts2.shift();
         switch (name2) {
           case "%TAG": {
@@ -26951,9 +27829,9 @@ var require_stringifyCollection = __commonJS({
       } else {
         str = lines[0];
         for (let i2 = 1; i2 < lines.length; ++i2) {
-          const line2 = lines[i2];
-          str += line2 ? `
-${indent}${line2}` : "\n";
+          const line3 = lines[i2];
+          str += line3 ? `
+${indent}${line3}` : "\n";
         }
       }
       if (comment) {
@@ -27011,7 +27889,7 @@ ${indent}${line2}` : "\n";
           str += ",";
         } else if (ctx.options.trailingComma) {
           if (ctx.options.lineWidth > 0) {
-            reqNewline || (reqNewline = lines.reduce((sum, line2) => sum + line2.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+            reqNewline || (reqNewline = lines.reduce((sum, line3) => sum + line3.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
           }
           if (reqNewline) {
             str += ",";
@@ -27027,14 +27905,14 @@ ${indent}${line2}` : "\n";
         return start2 + end;
       } else {
         if (!reqNewline) {
-          const len = lines.reduce((sum, line2) => sum + line2.length + 2, 2);
+          const len = lines.reduce((sum, line3) => sum + line3.length + 2, 2);
           reqNewline = ctx.options.lineWidth > 0 && len > ctx.options.lineWidth;
         }
         if (reqNewline) {
           let str = start2;
-          for (const line2 of lines)
-            str += line2 ? `
-${indentStep}${indent}${line2}` : "\n";
+          for (const line3 of lines)
+            str += line3 ? `
+${indentStep}${indent}${line3}` : "\n";
           return `${str}
 ${indent}${end}`;
         } else {
@@ -28777,10 +29655,10 @@ var require_errors = __commonJS({
       if (error62.pos[0] === -1)
         return;
       error62.linePos = error62.pos.map((pos) => lc.linePos(pos));
-      const { line: line2, col } = error62.linePos[0];
-      error62.message += ` at line ${line2}, column ${col}`;
+      const { line: line3, col } = error62.linePos[0];
+      error62.message += ` at line ${line3}, column ${col}`;
       let ci = col - 1;
-      let lineStr = src.substring(lc.lineStarts[line2 - 1], lc.lineStarts[line2]).replace(/[\n\r]+$/, "");
+      let lineStr = src.substring(lc.lineStarts[line3 - 1], lc.lineStarts[line3]).replace(/[\n\r]+$/, "");
       if (ci >= 60 && lineStr.length > 80) {
         const trimStart = Math.min(ci - 39, lineStr.length - 79);
         lineStr = "\u2026" + lineStr.substring(trimStart);
@@ -28788,8 +29666,8 @@ var require_errors = __commonJS({
       }
       if (lineStr.length > 80)
         lineStr = lineStr.substring(0, 79) + "\u2026";
-      if (line2 > 1 && /^ *$/.test(lineStr.substring(0, ci))) {
-        let prev = src.substring(lc.lineStarts[line2 - 2], lc.lineStarts[line2 - 1]);
+      if (line3 > 1 && /^ *$/.test(lineStr.substring(0, ci))) {
+        let prev = src.substring(lc.lineStarts[line3 - 2], lc.lineStarts[line3 - 1]);
         if (prev.length > 80)
           prev = prev.substring(0, 79) + "\u2026\n";
         lineStr = prev + lineStr;
@@ -28797,7 +29675,7 @@ var require_errors = __commonJS({
       if (/[^ ]/.test(lineStr)) {
         let count = 1;
         const end = error62.linePos[1];
-        if (end?.line === line2 && end.col > col) {
+        if (end?.line === line3 && end.col > col) {
           count = Math.max(1, Math.min(end.col - col, 80 - ci));
         }
         const pointer = " ".repeat(ci) + "^".repeat(count);
@@ -29746,8 +30624,8 @@ var require_resolve_flow_scalar = __commonJS({
       return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
     }
     function unfoldLines(source) {
-      const line2 = /(.*?)\r?\n/sy;
-      let match = line2.exec(source);
+      const line3 = /(.*?)\r?\n/sy;
+      let match = line3.exec(source);
       if (!match)
         return source;
       let trimEnd, trimBoth;
@@ -29760,8 +30638,8 @@ var require_resolve_flow_scalar = __commonJS({
       }
       let res = match[1].replace(trimEnd, "");
       let sep3 = " ";
-      let pos = line2.lastIndex;
-      while (match = line2.exec(source)) {
+      let pos = line3.lastIndex;
+      while (match = line3.exec(source)) {
         const lm = match[1].replace(trimBoth, "");
         if (lm === "") {
           if (sep3 === "\n")
@@ -29772,7 +30650,7 @@ var require_resolve_flow_scalar = __commonJS({
           res += sep3 + lm;
           sep3 = " ";
         }
-        pos = line2.lastIndex;
+        pos = line3.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
@@ -30902,40 +31780,40 @@ var require_lexer = __commonJS({
         }
       }
       *parseStream() {
-        let line2 = this.getLine();
-        if (line2 === null)
+        let line3 = this.getLine();
+        if (line3 === null)
           return this.setNext("stream");
-        if (line2[0] === cst.BOM) {
+        if (line3[0] === cst.BOM) {
           yield* this.pushCount(1);
-          line2 = line2.substring(1);
+          line3 = line3.substring(1);
         }
-        if (line2[0] === "%") {
-          let dirEnd = line2.length;
-          let cs = line2.indexOf("#");
+        if (line3[0] === "%") {
+          let dirEnd = line3.length;
+          let cs = line3.indexOf("#");
           while (cs !== -1) {
-            const ch = line2[cs - 1];
+            const ch = line3[cs - 1];
             if (ch === " " || ch === "	") {
               dirEnd = cs - 1;
               break;
             } else {
-              cs = line2.indexOf("#", cs + 1);
+              cs = line3.indexOf("#", cs + 1);
             }
           }
           while (true) {
-            const ch = line2[dirEnd - 1];
+            const ch = line3[dirEnd - 1];
             if (ch === " " || ch === "	")
               dirEnd -= 1;
             else
               break;
           }
           const n = (yield* this.pushCount(dirEnd)) + (yield* this.pushSpaces(true));
-          yield* this.pushCount(line2.length - n);
+          yield* this.pushCount(line3.length - n);
           this.pushNewline();
           return "stream";
         }
         if (this.atLineEnd()) {
           const sp = yield* this.pushSpaces(true);
-          yield* this.pushCount(line2.length - sp);
+          yield* this.pushCount(line3.length - sp);
           yield* this.pushNewline();
           return "stream";
         }
@@ -30976,13 +31854,13 @@ var require_lexer = __commonJS({
       }
       *parseDocument() {
         yield* this.pushSpaces(true);
-        const line2 = this.getLine();
-        if (line2 === null)
+        const line3 = this.getLine();
+        if (line3 === null)
           return this.setNext("doc");
         let n = yield* this.pushIndicators();
-        switch (line2[n]) {
+        switch (line3[n]) {
           case "#":
-            yield* this.pushCount(line2.length - n);
+            yield* this.pushCount(line3.length - n);
           // fallthrough
           case void 0:
             yield* this.pushNewline();
@@ -31007,7 +31885,7 @@ var require_lexer = __commonJS({
           case ">":
             n += yield* this.parseBlockScalarHeader();
             n += yield* this.pushSpaces(true);
-            yield* this.pushCount(line2.length - n);
+            yield* this.pushCount(line3.length - n);
             yield* this.pushNewline();
             return yield* this.parseBlockScalar();
           default:
@@ -31027,11 +31905,11 @@ var require_lexer = __commonJS({
           }
           sp += yield* this.pushSpaces(true);
         } while (nl + sp > 0);
-        const line2 = this.getLine();
-        if (line2 === null)
+        const line3 = this.getLine();
+        if (line3 === null)
           return this.setNext("flow");
-        if (indent !== -1 && indent < this.indentNext && line2[0] !== "#" || indent === 0 && (line2.startsWith("---") || line2.startsWith("...")) && isEmpty(line2[3])) {
-          const atFlowEndMarker = indent === this.indentNext - 1 && this.flowLevel === 1 && (line2[0] === "]" || line2[0] === "}");
+        if (indent !== -1 && indent < this.indentNext && line3[0] !== "#" || indent === 0 && (line3.startsWith("---") || line3.startsWith("...")) && isEmpty(line3[3])) {
+          const atFlowEndMarker = indent === this.indentNext - 1 && this.flowLevel === 1 && (line3[0] === "]" || line3[0] === "}");
           if (!atFlowEndMarker) {
             this.flowLevel = 0;
             yield cst.FLOW_END;
@@ -31039,17 +31917,17 @@ var require_lexer = __commonJS({
           }
         }
         let n = 0;
-        while (line2[n] === ",") {
+        while (line3[n] === ",") {
           n += yield* this.pushCount(1);
           n += yield* this.pushSpaces(true);
           this.flowKey = false;
         }
         n += yield* this.pushIndicators();
-        switch (line2[n]) {
+        switch (line3[n]) {
           case void 0:
             return "flow";
           case "#":
-            yield* this.pushCount(line2.length - n);
+            yield* this.pushCount(line3.length - n);
             return "flow";
           case "{":
           case "[":
@@ -31459,12 +32337,12 @@ var require_parser = __commonJS({
       }
       return prev.splice(i2, prev.length);
     }
-    function arrayPushArray(target, source) {
+    function arrayPushArray(target2, source) {
       if (source.length < 1e5)
-        Array.prototype.push.apply(target, source);
+        Array.prototype.push.apply(target2, source);
       else
         for (let i2 = 0; i2 < source.length; ++i2)
-          target.push(source[i2]);
+          target2.push(source[i2]);
     }
     function fixFlowSeqItems(fc) {
       if (fc.start.type === "flow-seq-start") {
@@ -32412,7 +33290,7 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename5, join as join24, resolve as resolve13 } from "node:path";
+import { basename as basename5, join as join25, resolve as resolve13 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
@@ -32421,16 +33299,16 @@ function packageRoot(env = process.env) {
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
-  return override !== void 0 && override !== "" ? override : join24(packageRoot(env), "assets");
+  return override !== void 0 && override !== "" ? override : join25(packageRoot(env), "assets");
 }
 function assetFile(name2) {
-  return join24(assetDir(), basename5(name2));
+  return join25(assetDir(), basename5(name2));
 }
 var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.133" : "0.0.0-dev";
+    VERSION = true ? "0.1.135" : "0.0.0-dev";
   }
 });
 
@@ -32792,8 +33670,8 @@ var init_scalar = __esm({
 });
 
 // ../../node_modules/.pnpm/@bufbuild+protobuf@2.16.0/node_modules/@bufbuild/protobuf/dist/esm/reflect/unsafe.js
-function unsafeIsSetExplicit(target, localName) {
-  return Object.prototype.hasOwnProperty.call(target, localName) && target[localName] !== void 0;
+function unsafeIsSetExplicit(target2, localName) {
+  return Object.prototype.hasOwnProperty.call(target2, localName) && target2[localName] !== void 0;
 }
 function setOwn(obj, key, value) {
   if (key === "__proto__") {
@@ -34236,10 +35114,10 @@ function newField(proto, parentOrFile, reg, oneof, mapEntries) {
     enumerable: true,
     configurable: true
   });
-  const label = proto.label;
+  const label2 = proto.label;
   const type = proto.type;
   const jstype = (_c = proto.options) === null || _c === void 0 ? void 0 : _c.jstype;
-  if (label === LABEL_REPEATED) {
+  if (label2 === LABEL_REPEATED) {
     const mapEntry = type == TYPE_MESSAGE ? mapEntries === null || mapEntries === void 0 ? void 0 : mapEntries.get(trimLeadingDot(proto.typeName)) : void 0;
     if (mapEntry) {
       field2.fieldKind = "map";
@@ -35888,8 +36766,8 @@ var init_scip_symbol = __esm({
 function occurrenceRange(occurrence) {
   const typed = occurrence.typedRange;
   if (typed.case === "singleLineRange") {
-    const { line: line2, startCharacter, endCharacter } = typed.value;
-    return checked([line2, startCharacter, line2, endCharacter]);
+    const { line: line3, startCharacter, endCharacter } = typed.value;
+    return checked([line3, startCharacter, line3, endCharacter]);
   }
   if (typed.case === "multiLineRange") {
     const { startLine, startCharacter, endLine, endCharacter } = typed.value;
@@ -35900,8 +36778,8 @@ function occurrenceRange(occurrence) {
 function occurrenceEnclosingRange(occurrence) {
   const typed = occurrence.typedEnclosingRange;
   if (typed.case === "singleLineEnclosingRange") {
-    const { line: line2, startCharacter, endCharacter } = typed.value;
-    return checked([line2, startCharacter, line2, endCharacter]);
+    const { line: line3, startCharacter, endCharacter } = typed.value;
+    return checked([line3, startCharacter, line3, endCharacter]);
   }
   if (typed.case === "multiLineEnclosingRange") {
     const { startLine, startCharacter, endLine, endCharacter } = typed.value;
@@ -37111,9 +37989,9 @@ async function Module2(moduleArg = {}) {
   }, "loadWebAssemblyModule");
   var mergeLibSymbols = /* @__PURE__ */ __name((exports, libName2) => {
     for (var [sym, exp] of Object.entries(exports)) {
-      const setImport = /* @__PURE__ */ __name((target) => {
-        if (!isSymbolDefined(target)) {
-          wasmImports[target] = exp;
+      const setImport = /* @__PURE__ */ __name((target2) => {
+        if (!isSymbolDefined(target2)) {
+          wasmImports[target2] = exp;
         }
       }, "setImport");
       setImport(sym);
@@ -37999,7 +38877,7 @@ var __defProp2, __name, Edit, SIZE_OF_SHORT, SIZE_OF_INT, SIZE_OF_CURSOR, SIZE_O
 var init_web_tree_sitter = __esm({
   "../../node_modules/.pnpm/web-tree-sitter@0.27.0/node_modules/web-tree-sitter/web-tree-sitter.js"() {
     __defProp2 = Object.defineProperty;
-    __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
+    __name = (target2, value) => __defProp2(target2, "name", { value, configurable: true });
     Edit = class {
       static {
         __name(this, "Edit");
@@ -40359,7 +41237,7 @@ var init_treesitter = __esm({
 import { execFile } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { lstat, readFile as readFile4 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { promisify } from "node:util";
 function shardKeyOf(shard) {
   return `sha256:${sha256Hex2(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
@@ -40386,7 +41264,7 @@ async function mapLimit(items, limit, task) {
   return results;
 }
 async function hashRegularFile(repoRoot, path) {
-  const absolute = join25(repoRoot, path);
+  const absolute = join26(repoRoot, path);
   try {
     const stats = await lstat(absolute);
     if (!stats.isFile()) return null;
@@ -40424,7 +41302,7 @@ async function buildSnapshot(options) {
   const needParse = [...hashes.keys()].filter((path) => !byPath.has(path));
   const parsed = await mapLimit(needParse, 8, async (path) => {
     if (languageForPath(path) === null) return { path, shard: null };
-    const bytes = await readFile4(join25(options.repoRoot, path));
+    const bytes = await readFile4(join26(options.repoRoot, path));
     if (bytes.byteLength > MAX_PARSE_BYTES) return { path, shard: null };
     const hash2 = `sha256:${sha256Hex2(bytes)}`;
     if (hash2 !== hashes.get(path)) throw new Error(`${path} changed while the snapshot was being built`);
@@ -40568,10 +41446,7 @@ var init_oidc = __esm({
   }
 });
 
-// ../index-builder/src/context-map.ts
-function stripNoise(text) {
-  return text.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ").replace(/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`/g, '""');
-}
+// ../index-builder/src/rank.ts
 function wordsOf(text) {
   const parts2 = text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").split(/[^A-Za-z0-9]+/);
   const out2 = [];
@@ -40586,106 +41461,6 @@ function wordsOf(text) {
   }
   return out2;
 }
-function resolveImport(from, spec) {
-  if (!spec.startsWith(".")) return null;
-  const parts2 = from.split("/").slice(0, -1);
-  for (const piece of spec.split("/")) {
-    if (piece === "." || piece === "") continue;
-    if (piece === "..") parts2.pop();
-    else parts2.push(piece);
-  }
-  return stripModuleExtension(parts2.join("/"));
-}
-function stripModuleExtension(path) {
-  return path.replace(/\.(?:[cm]?[jt]sx?|d\.ts)$/, "");
-}
-function reaches(visible, path) {
-  const bare = stripModuleExtension(path);
-  return visible.has(bare) || visible.has(path) || bare.endsWith("/index") && visible.has(bare.slice(0, -"/index".length));
-}
-function headerOf(content, symbol2) {
-  const lines = content.split("\n");
-  const start2 = symbol2.range[0];
-  const chunk = [];
-  for (let i2 = start2; i2 < Math.min(lines.length, start2 + 4); i2 += 1) {
-    const line2 = lines[i2] ?? "";
-    chunk.push(line2);
-    if (line2.includes("{")) break;
-  }
-  return chunk.join(" ");
-}
-async function buildRepoIndex(files) {
-  const symbols2 = /* @__PURE__ */ new Map();
-  const byName = /* @__PURE__ */ new Map();
-  const byFile = /* @__PURE__ */ new Map();
-  const imports = /* @__PURE__ */ new Map();
-  const ranges = /* @__PURE__ */ new Map();
-  const headers = /* @__PURE__ */ new Map();
-  const paths = [...files.keys()].filter((path) => languageForPath(path) !== null).sort();
-  for (const path of paths) {
-    const content = files.get(path);
-    const shard = await parseDeclarations(path, content);
-    if (shard === null) continue;
-    const targets = /* @__PURE__ */ new Set();
-    for (const match of content.matchAll(/from\s+["']([^"']+)["']/g)) {
-      const resolved = resolveImport(path, match[1] ?? "");
-      if (resolved !== null) targets.add(resolved);
-    }
-    imports.set(path, targets);
-    for (const symbol2 of shard.symbols) {
-      const hash2 = symbol2.symbol.indexOf("#");
-      const entry = { id: symbol2.symbol, name: symbol2.name, qualified: symbol2.symbol.slice(hash2 + 1), kind: symbol2.kind, path, line: symbol2.range[0] + 1, parent: symbol2.parent };
-      symbols2.set(entry.id, entry);
-      ranges.set(entry.id, symbol2);
-      byName.set(entry.name, [...byName.get(entry.name) ?? [], entry]);
-      byFile.set(path, [...byFile.get(path) ?? [], entry]);
-      if (symbol2.kind === "class" || symbol2.kind === "interface") headers.set(entry.id, headerOf(content, symbol2));
-    }
-  }
-  const callees = /* @__PURE__ */ new Map();
-  const callers = /* @__PURE__ */ new Map();
-  for (const entry of symbols2.values()) {
-    if (!CALLABLE.has(entry.kind)) continue;
-    const range = ranges.get(entry.id)?.enclosingRange;
-    if (range === void 0) continue;
-    const text = stripNoise(files.get(entry.path).split("\n").slice(range[0], range[2] + 1).join("\n"));
-    const visible = imports.get(entry.path) ?? /* @__PURE__ */ new Set();
-    const seen = /* @__PURE__ */ new Set();
-    for (const match of text.matchAll(/[A-Za-z_$][\w$]*/g)) {
-      const id2 = match[0];
-      if (KEYWORDS.has(id2) || seen.has(id2)) continue;
-      seen.add(id2);
-      for (const target of byName.get(id2) ?? []) {
-        if (target.id === entry.id || target.kind === "property" || target.kind === "parameter") continue;
-        if (target.path !== entry.path && !reaches(visible, target.path)) continue;
-        if (target.id === entry.parent) continue;
-        callees.set(entry.id, (callees.get(entry.id) ?? /* @__PURE__ */ new Set()).add(target.id));
-        callers.set(target.id, (callers.get(target.id) ?? /* @__PURE__ */ new Set()).add(entry.id));
-      }
-    }
-  }
-  const heritage = /* @__PURE__ */ new Map();
-  const heirs = /* @__PURE__ */ new Map();
-  const resolve16 = (from, name2) => {
-    const visible = imports.get(from.path) ?? /* @__PURE__ */ new Set();
-    return (byName.get(baseName(name2)) ?? []).find((candidate) => candidate.path === from.path || reaches(visible, candidate.path));
-  };
-  for (const [id2, header] of headers) {
-    const entry = symbols2.get(id2);
-    const stem2 = header.slice(header.indexOf(entry.name) + entry.name.length).replace(/^<[^>]*>/, "").replace(/\{.*$/, "");
-    const ext = /\bextends\s+([A-Za-z_$][\w$.]*)/.exec(stem2)?.[1];
-    const impl = /\bimplements\s+(.+)$/.exec(stem2)?.[1];
-    const extendsIds = ext === void 0 ? [] : [resolve16(entry, ext)?.id].filter((value) => value !== void 0);
-    const implementsIds = (impl === void 0 ? [] : impl.split(/,(?![^<]*>)/).map((part) => resolve16(entry, part.trim()))).filter((value) => value !== void 0).map((value) => value.id);
-    if (extendsIds.length === 0 && implementsIds.length === 0) continue;
-    heritage.set(id2, { extends: extendsIds, implements: implementsIds });
-    for (const target of extendsIds) heirs.set(target, { extendedBy: [...heirs.get(target)?.extendedBy ?? [], id2], implementedBy: heirs.get(target)?.implementedBy ?? [] });
-    for (const target of implementsIds) heirs.set(target, { extendedBy: heirs.get(target)?.extendedBy ?? [], implementedBy: [...heirs.get(target)?.implementedBy ?? [], id2] });
-  }
-  const words = /* @__PURE__ */ new Map();
-  for (const entry of symbols2.values()) for (const word of new Set(wordsOf(entry.name))) words.set(word, (words.get(word) ?? 0) + 1);
-  return { files: paths.length, symbols: symbols2, byName, byFile, callees, callers, heritage, heirs, imports, words, wordDocs: symbols2.size };
-}
 function idf(index, word) {
   return Math.log(index.wordDocs / (1 + (index.words.get(word) ?? 0)));
 }
@@ -40739,8 +41514,8 @@ function pageRank(index, personal) {
   for (const [from, targets] of index.callees) {
     const a = index.symbols.get(from)?.path;
     if (a === void 0) continue;
-    for (const target of targets) {
-      const b = index.symbols.get(target)?.path;
+    for (const target2 of targets) {
+      const b = index.symbols.get(target2)?.path;
       if (b !== void 0) link(a, b, 1);
     }
   }
@@ -40770,14 +41545,14 @@ function callerLines(index, seed) {
   for (let depth = 1; depth <= 3 && frontier.length > 0 && lines.length < 12; depth += 1) {
     const next = [];
     for (const id2 of frontier) {
-      const target = index.symbols.get(id2);
+      const target2 = index.symbols.get(id2);
       const callers = [...index.callers.get(id2) ?? []].filter((caller) => !seen.has(caller)).map((caller) => index.symbols.get(caller)).sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line);
       for (const caller of callers.slice(0, 8)) {
         seen.add(caller.id);
         next.push(caller.id);
-        if (lines.length < 12) lines.push(`${"  ".repeat(depth)}${caller.qualified} ${caller.path}:${caller.line}  -> ${target.qualified}`);
+        if (lines.length < 12) lines.push(`${"  ".repeat(depth)}${caller.qualified} ${caller.path}:${caller.line}  -> ${target2.qualified}`);
       }
-      if (callers.length > 8) lines.push(`${"  ".repeat(depth)}(+${callers.length - 8} more callers of ${target.qualified})`);
+      if (callers.length > 8) lines.push(`${"  ".repeat(depth)}(+${callers.length - 8} more callers of ${target2.qualified})`);
     }
     frontier = next;
   }
@@ -40863,9 +41638,9 @@ function buildCodeMap(index, task, options = DEFAULT_MAP_OPTIONS) {
   const top = ordered[0]?.[1] ?? 0;
   for (const [path, mass] of ordered) {
     if (mass <= 0 || mass < top * 0.05 || related.length >= MAX_RELATED_FILES) break;
-    const line2 = outline(index, path);
-    if (!fits(["", taskFree ? "Central files:" : "Related files:", ...related, line2])) break;
-    related.push(line2);
+    const line3 = outline(index, path);
+    if (!fits(["", taskFree ? "Central files:" : "Related files:", ...related, line3])) break;
+    related.push(line3);
   }
   if (related.length > 0) lines.push("", taskFree ? "Central files:" : "Related files:", ...related);
   const text = `${lines.join("\n")}
@@ -40883,44 +41658,167 @@ function buildCodeMapDigest(input2) {
     seeds: map2.seeds
   };
 }
-var KEYWORDS, CALLABLE, SEEDABLE, MIN_WORD_IDF, MIN_SOFT_SCORE, MAX_RELATED_FILES, STOP, baseName, DEFAULT_MAP_OPTIONS, estimateTokens, where;
-var init_context_map = __esm({
-  "../index-builder/src/context-map.ts"() {
+function serializeRepoIndex(index) {
+  const position = /* @__PURE__ */ new Map();
+  for (const id2 of index.symbols.keys()) position.set(id2, position.size);
+  const at = (id2) => position.get(id2) ?? -1;
+  const symbols2 = [...index.symbols.values()].map((s) => [s.name, s.qualified, s.kind, s.path, s.line, s.parent === void 0 ? -1 : at(s.parent)]);
+  const callees = [...index.callees].map(([from, to]) => [at(from), ...[...to].map(at)]);
+  const heritage = [...index.heritage].map(([id2, h]) => ({ id: at(id2), extends: h.extends.map(at), implements: h.implements.map(at) }));
+  return { schemaVersion: "1", files: index.files, wordDocs: index.wordDocs, symbols: symbols2, callees, heritage, paths: [...index.imports.keys()], words: [...index.words] };
+}
+var SEEDABLE, MIN_WORD_IDF, MIN_SOFT_SCORE, MAX_RELATED_FILES, STOP, DEFAULT_MAP_OPTIONS, estimateTokens, where;
+var init_rank = __esm({
+  "../index-builder/src/rank.ts"() {
     "use strict";
     init_src();
-    init_languages();
-    init_treesitter();
-    KEYWORDS = /* @__PURE__ */ new Set(["const", "let", "var", "function", "return", "if", "else", "new", "this", "class", "extends", "implements", "import", "export", "from", "type", "interface", "async", "await", "string", "number", "boolean", "void", "null", "undefined", "true", "false", "private", "protected", "public", "readonly", "static", "abstract", "super", "typeof", "for", "of", "in", "while", "throw", "try", "catch", "as"]);
-    CALLABLE = /* @__PURE__ */ new Set(["function", "method", "constant", "variable"]);
     SEEDABLE = /* @__PURE__ */ new Set(["function", "method", "class", "interface", "type", "constant"]);
     MIN_WORD_IDF = 2.5;
     MIN_SOFT_SCORE = 3.5;
     MAX_RELATED_FILES = 14;
     STOP = /* @__PURE__ */ new Set(["the", "a", "an", "of", "to", "in", "is", "are", "and", "or", "for", "that", "this", "it", "its", "by", "be", "on", "as", "at", "with", "from", "which", "what", "when", "where", "who", "how", "do", "does", "not", "any", "each", "every", "all", "also", "than", "then", "so", "if", "into", "file", "path", "answer", "end", "final", "message", "line", "start", "follow", "separate", "comma", "give", "name", "modify", "files", "repository", "source", "code", "change", "update", "make", "use", "uses", "used", "other", "only", "about", "will", "can", "should", "need", "needs", "happen", "merely", "share", "same", "return", "returns", "pass", "passes"]);
-    baseName = (name2) => name2.replace(/<.*$/, "").split(".").pop() ?? name2;
     DEFAULT_MAP_OPTIONS = { maxTokens: 3400, maxSeeds: 6 };
     estimateTokens = estimateCodeMapTokens;
     where = (symbol2) => `${symbol2.qualified} ${symbol2.path}:${symbol2.line}`;
   }
 });
 
+// ../index-builder/src/context-map.ts
+function stripNoise(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ").replace(/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`/g, '""');
+}
+function resolveImport(from, spec) {
+  if (!spec.startsWith(".")) return null;
+  const parts2 = from.split("/").slice(0, -1);
+  for (const piece of spec.split("/")) {
+    if (piece === "." || piece === "") continue;
+    if (piece === "..") parts2.pop();
+    else parts2.push(piece);
+  }
+  return stripModuleExtension(parts2.join("/"));
+}
+function stripModuleExtension(path) {
+  return path.replace(/\.(?:[cm]?[jt]sx?|d\.ts)$/, "");
+}
+function reaches(visible, path) {
+  const bare = stripModuleExtension(path);
+  return visible.has(bare) || visible.has(path) || bare.endsWith("/index") && visible.has(bare.slice(0, -"/index".length));
+}
+function headerOf(content, symbol2) {
+  const lines = content.split("\n");
+  const start2 = symbol2.range[0];
+  const chunk = [];
+  for (let i2 = start2; i2 < Math.min(lines.length, start2 + 4); i2 += 1) {
+    const line3 = lines[i2] ?? "";
+    chunk.push(line3);
+    if (line3.includes("{")) break;
+  }
+  return chunk.join(" ");
+}
+async function buildRepoIndex(files) {
+  const symbols2 = /* @__PURE__ */ new Map();
+  const byName = /* @__PURE__ */ new Map();
+  const byFile = /* @__PURE__ */ new Map();
+  const imports = /* @__PURE__ */ new Map();
+  const ranges = /* @__PURE__ */ new Map();
+  const headers = /* @__PURE__ */ new Map();
+  const paths = [...files.keys()].filter((path) => languageForPath(path) !== null).sort();
+  for (const path of paths) {
+    const content = files.get(path);
+    const shard = await parseDeclarations(path, content);
+    if (shard === null) continue;
+    const targets = /* @__PURE__ */ new Set();
+    for (const match of content.matchAll(/from\s+["']([^"']+)["']/g)) {
+      const resolved = resolveImport(path, match[1] ?? "");
+      if (resolved !== null) targets.add(resolved);
+    }
+    imports.set(path, targets);
+    for (const symbol2 of shard.symbols) {
+      const hash2 = symbol2.symbol.indexOf("#");
+      const entry = { id: symbol2.symbol, name: symbol2.name, qualified: symbol2.symbol.slice(hash2 + 1), kind: symbol2.kind, path, line: symbol2.range[0] + 1, parent: symbol2.parent };
+      symbols2.set(entry.id, entry);
+      ranges.set(entry.id, symbol2);
+      byName.set(entry.name, [...byName.get(entry.name) ?? [], entry]);
+      byFile.set(path, [...byFile.get(path) ?? [], entry]);
+      if (symbol2.kind === "class" || symbol2.kind === "interface") headers.set(entry.id, headerOf(content, symbol2));
+    }
+  }
+  const callees = /* @__PURE__ */ new Map();
+  const callers = /* @__PURE__ */ new Map();
+  for (const entry of symbols2.values()) {
+    if (!CALLABLE.has(entry.kind)) continue;
+    const range = ranges.get(entry.id)?.enclosingRange;
+    if (range === void 0) continue;
+    const text = stripNoise(files.get(entry.path).split("\n").slice(range[0], range[2] + 1).join("\n"));
+    const visible = imports.get(entry.path) ?? /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new Set();
+    for (const match of text.matchAll(/[A-Za-z_$][\w$]*/g)) {
+      const id2 = match[0];
+      if (KEYWORDS.has(id2) || seen.has(id2)) continue;
+      seen.add(id2);
+      for (const target2 of byName.get(id2) ?? []) {
+        if (target2.id === entry.id || target2.kind === "property" || target2.kind === "parameter") continue;
+        if (target2.path !== entry.path && !reaches(visible, target2.path)) continue;
+        if (target2.id === entry.parent) continue;
+        callees.set(entry.id, (callees.get(entry.id) ?? /* @__PURE__ */ new Set()).add(target2.id));
+        callers.set(target2.id, (callers.get(target2.id) ?? /* @__PURE__ */ new Set()).add(entry.id));
+      }
+    }
+  }
+  const heritage = /* @__PURE__ */ new Map();
+  const heirs = /* @__PURE__ */ new Map();
+  const resolve16 = (from, name2) => {
+    const visible = imports.get(from.path) ?? /* @__PURE__ */ new Set();
+    return (byName.get(baseName(name2)) ?? []).find((candidate) => candidate.path === from.path || reaches(visible, candidate.path));
+  };
+  for (const [id2, header] of headers) {
+    const entry = symbols2.get(id2);
+    const stem2 = header.slice(header.indexOf(entry.name) + entry.name.length).replace(/^<[^>]*>/, "").replace(/\{.*$/, "");
+    const ext = /\bextends\s+([A-Za-z_$][\w$.]*)/.exec(stem2)?.[1];
+    const impl = /\bimplements\s+(.+)$/.exec(stem2)?.[1];
+    const extendsIds = ext === void 0 ? [] : [resolve16(entry, ext)?.id].filter((value) => value !== void 0);
+    const implementsIds = (impl === void 0 ? [] : impl.split(/,(?![^<]*>)/).map((part) => resolve16(entry, part.trim()))).filter((value) => value !== void 0).map((value) => value.id);
+    if (extendsIds.length === 0 && implementsIds.length === 0) continue;
+    heritage.set(id2, { extends: extendsIds, implements: implementsIds });
+    for (const target2 of extendsIds) heirs.set(target2, { extendedBy: [...heirs.get(target2)?.extendedBy ?? [], id2], implementedBy: heirs.get(target2)?.implementedBy ?? [] });
+    for (const target2 of implementsIds) heirs.set(target2, { extendedBy: heirs.get(target2)?.extendedBy ?? [], implementedBy: [...heirs.get(target2)?.implementedBy ?? [], id2] });
+  }
+  const words = /* @__PURE__ */ new Map();
+  for (const entry of symbols2.values()) for (const word of new Set(wordsOf(entry.name))) words.set(word, (words.get(word) ?? 0) + 1);
+  return { files: paths.length, symbols: symbols2, byName, byFile, callees, callers, heritage, heirs, imports, words, wordDocs: symbols2.size };
+}
+var KEYWORDS, CALLABLE, baseName;
+var init_context_map = __esm({
+  "../index-builder/src/context-map.ts"() {
+    "use strict";
+    init_src();
+    init_languages();
+    init_treesitter();
+    init_rank();
+    init_rank();
+    KEYWORDS = /* @__PURE__ */ new Set(["const", "let", "var", "function", "return", "if", "else", "new", "this", "class", "extends", "implements", "import", "export", "from", "type", "interface", "async", "await", "string", "number", "boolean", "void", "null", "undefined", "true", "false", "private", "protected", "public", "readonly", "static", "abstract", "super", "typeof", "for", "of", "in", "while", "throw", "try", "catch", "as"]);
+    CALLABLE = /* @__PURE__ */ new Set(["function", "method", "constant", "variable"]);
+    baseName = (name2) => name2.replace(/<.*$/, "").split(".").pop() ?? name2;
+  }
+});
+
 // ../index-builder/src/context-map-build.ts
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname9, join as join26 } from "node:path";
+import { dirname as dirname10, join as join27 } from "node:path";
 import { promisify as promisify2 } from "node:util";
-async function git3(root, args2) {
+async function git5(root, args2) {
   const { stdout } = await execFileAsync2("git", args2, { cwd: root, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   return stdout.trim();
 }
-async function buildDigestForCheckout(options) {
+async function buildArtifactsForCheckout(options) {
   const tracked = (await execFileAsync2("git", ["ls-files", "-z"], { cwd: options.root, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 })).stdout.split("\0").filter((path) => path !== "");
   const files = /* @__PURE__ */ new Map();
   let uncovered = 0;
   for (const path of tracked) {
     if (languageForPath(path) === null) continue;
     try {
-      const bytes = await readFile5(join26(options.root, path));
+      const bytes = await readFile5(join27(options.root, path));
       if (bytes.byteLength > MAX_PARSE_BYTES) {
         uncovered += 1;
         continue;
@@ -40931,20 +41829,28 @@ async function buildDigestForCheckout(options) {
     }
   }
   const index = await buildRepoIndex(files);
-  const commitSha = await git3(options.root, ["rev-parse", "HEAD"]);
+  const commitSha = await git5(options.root, ["rev-parse", "HEAD"]);
   let branch;
   try {
-    branch = await git3(options.root, ["symbolic-ref", "--short", "-q", "HEAD"]) || void 0;
+    branch = await git5(options.root, ["symbolic-ref", "--short", "-q", "HEAD"]) || void 0;
   } catch {
     branch = void 0;
   }
-  return CodeMapDigest.parse(
-    buildCodeMapDigest({ index, commitSha, ...branch === void 0 ? {} : { branch }, uncovered, builtAt: options.builtAt ?? (/* @__PURE__ */ new Date()).toISOString(), ...options.task === void 0 ? {} : { task: options.task } })
-  );
+  const builtAt = options.builtAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const digest = CodeMapDigest.parse(buildCodeMapDigest({ index, commitSha, ...branch === void 0 ? {} : { branch }, uncovered, builtAt, ...options.task === void 0 ? {} : { task: options.task } }));
+  const indexFile = { schemaVersion: "1", revision: { commitSha, ...branch === void 0 ? {} : { branch } }, builtAt, uncovered, index: serializeRepoIndex(index) };
+  return { digest, indexFile };
+}
+async function writeIndexFile(root, indexFile) {
+  const path = join27(root, CODE_INDEX_PATH);
+  await mkdir3(dirname10(path), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(indexFile)}
+`);
+  return path;
 }
 async function writeDigest(root, digest, out2) {
-  const path = out2 ?? join26(root, CODE_MAP_DIGEST_PATH);
-  await mkdir3(dirname9(path), { recursive: true });
+  const path = out2 ?? join27(root, CODE_MAP_DIGEST_PATH);
+  await mkdir3(dirname10(path), { recursive: true });
   await writeFile3(path, `${JSON.stringify(digest)}
 `);
   return path;
@@ -40964,10 +41870,10 @@ var init_context_map_build = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile3 } from "node:child_process";
 import { mkdir as mkdir4, readdir as readdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join27, resolve as resolve14 } from "node:path";
+import { join as join28, resolve as resolve14 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify3 } from "node:util";
-async function git4(root, args2) {
+async function git6(root, args2) {
   const { stdout } = await execFileAsync3("git", args2, { cwd: root, encoding: "utf8" });
   return stdout.trim();
 }
@@ -40978,7 +41884,7 @@ function parseRepository(value) {
 }
 async function repositoryFromRemote(root) {
   try {
-    const url2 = await git4(root, ["remote", "get-url", "origin"]);
+    const url2 = await git6(root, ["remote", "get-url", "origin"]);
     return /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(url2)?.slice(1, 3).join("/");
   } catch {
     return void 0;
@@ -40990,7 +41896,7 @@ async function snapshotFromArgs(values, env) {
   if (projectId !== void 0 && !ProjectId.safeParse(projectId).success) throw new UsageError2(`--project must be a project identifier, got "${projectId}"`);
   const repoText = projectId !== void 0 ? typeof values["repo"] === "string" ? values["repo"] : void 0 : (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
   if (!repoText && projectId === void 0) throw new UsageError2("cannot determine the repository; pass --project ID, or --repo owner/name");
-  const commit = (typeof values["commit"] === "string" ? values["commit"] : void 0) ?? env["GITHUB_SHA"] ?? await git4(root, ["rev-parse", "HEAD"]);
+  const commit = (typeof values["commit"] === "string" ? values["commit"] : void 0) ?? env["GITHUB_SHA"] ?? await git6(root, ["rev-parse", "HEAD"]);
   const branch = typeof values["branch"] === "string" ? values["branch"] : void 0;
   const tenant = (typeof values["tenant"] === "string" ? values["tenant"] : void 0) ?? env["HARNESS_TENANT"];
   if (!tenant) throw new UsageError2("missing --tenant (or HARNESS_TENANT)");
@@ -41019,9 +41925,10 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
     }
     if (command === "map") {
       const root = resolve14(values.root ?? process.cwd());
-      const digest = await buildDigestForCheckout({ root, ...values.task === void 0 ? {} : { task: values.task } });
+      const { digest, indexFile } = await buildArtifactsForCheckout({ root, ...values.task === void 0 ? {} : { task: values.task } });
       const path = await writeDigest(root, digest, values.out === void 0 ? void 0 : resolve14(values.out));
-      out2(`wrote the code map digest for ${digest.revision.commitSha.slice(0, 12)} (${digest.coverage.files} files, ${digest.coverage.symbols} symbols, ${digest.lines.length} lines) to ${path}`);
+      const indexPath = values.out === void 0 ? await writeIndexFile(root, indexFile) : null;
+      out2(`wrote the code map digest for ${digest.revision.commitSha.slice(0, 12)} (${digest.coverage.files} files, ${digest.coverage.symbols} symbols, ${digest.lines.length} lines) to ${path}${indexPath === null ? "" : `, and the ranking index to ${indexPath}`}`);
       return 0;
     }
     if (command === "upload") {
@@ -41047,13 +41954,13 @@ ${USAGE}`);
   }
 }
 async function writeSnapshot(dir, built) {
-  await mkdir4(join27(dir, "shards"), { recursive: true });
-  for (const name2 of await readdir4(join27(dir, "shards"))) await rm2(join27(dir, "shards", name2));
-  await writeFile4(join27(dir, "manifest.json"), JSON.stringify(built.manifest, null, 2));
-  await writeFile4(join27(dir, "uncovered.json"), JSON.stringify(built.uncovered, null, 2));
+  await mkdir4(join28(dir, "shards"), { recursive: true });
+  for (const name2 of await readdir4(join28(dir, "shards"))) await rm2(join28(dir, "shards", name2));
+  await writeFile4(join28(dir, "manifest.json"), JSON.stringify(built.manifest, null, 2));
+  await writeFile4(join28(dir, "uncovered.json"), JSON.stringify(built.uncovered, null, 2));
   for (const shard of built.shards) {
     const name2 = shardKeyOf(shard).slice("sha256:".length);
-    await writeFile4(join27(dir, "shards", `${name2}.json`), JSON.stringify(shard));
+    await writeFile4(join28(dir, "shards", `${name2}.json`), JSON.stringify(shard));
   }
 }
 var execFileAsync3, USAGE, UsageError2, OPTIONS;
@@ -41122,17 +42029,17 @@ var init_chunk_Br0eD_fh = __esm({
     __hasOwnProp2 = Object.prototype.hasOwnProperty;
     __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
     __exportAll = (all, symbols2) => {
-      let target = {};
+      let target2 = {};
       for (var name2 in all) {
-        __defProp3(target, name2, {
+        __defProp3(target2, name2, {
           get: all[name2],
           enumerable: true
         });
       }
       if (symbols2) {
-        __defProp3(target, Symbol.toStringTag, { value: "Module" });
+        __defProp3(target2, Symbol.toStringTag, { value: "Module" });
       }
-      return target;
+      return target2;
     };
     __copyProps2 = (to, from, except, desc) => {
       if (from && typeof from === "object" || typeof from === "function") {
@@ -41148,10 +42055,10 @@ var init_chunk_Br0eD_fh = __esm({
       }
       return to;
     };
-    __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps2(isNodeMode || !mod || !mod.__esModule ? __defProp3(target, "default", {
+    __toESM2 = (mod, isNodeMode, target2) => (target2 = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps2(isNodeMode || !mod || !mod.__esModule ? __defProp3(target2, "default", {
       value: mod,
       enumerable: true
-    }) : target, mod));
+    }) : target2, mod));
   }
 });
 
@@ -44815,8 +45722,8 @@ function manualInputRequiredValue(decoded) {
     ...decoded.requestState !== void 0 && { requestState: decoded.requestState }
   };
 }
-function deserializeMessage(line2) {
-  return JSONRPCMessageSchema.parse(JSON.parse(line2));
+function deserializeMessage(line3) {
+  return JSONRPCMessageSchema.parse(JSON.parse(line3));
 }
 function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
@@ -46755,10 +47662,10 @@ var init_src_CX2iR2pK = __esm({
         while (this._buffer) {
           const index = this._buffer.indexOf("\n");
           if (index === -1) return null;
-          const line2 = this._buffer.toString("utf8", 0, index).replace(/\r$/, "");
+          const line3 = this._buffer.toString("utf8", 0, index).replace(/\r$/, "");
           this._buffer = this._buffer.subarray(index + 1);
           try {
-            return deserializeMessage(line2);
+            return deserializeMessage(line3);
           } catch (error62) {
             if (error62 instanceof SyntaxError) continue;
             throw error62;
@@ -46981,7 +47888,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
       };
       exports.ValueScopeName = ValueScopeName;
-      const line2 = (0, code_1._)`\n`;
+      const line3 = (0, code_1._)`\n`;
       var ValueScope = class extends Scope {
         constructor(opts) {
           super(opts);
@@ -46989,7 +47896,7 @@ var init_ajvProvider_CEoC_sr = __esm({
           this._scope = opts.scope;
           this.opts = {
             ...opts,
-            _n: opts.lines ? line2 : code_1.nil
+            _n: opts.lines ? line3 : code_1.nil
           };
         }
         get() {
@@ -47208,9 +48115,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
       };
       var Label2 = class extends Node2 {
-        constructor(label) {
+        constructor(label2) {
           super();
-          this.label = label;
+          this.label = label2;
           this.names = {};
         }
         render({ _n }) {
@@ -47218,9 +48125,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
       };
       var Break = class extends Node2 {
-        constructor(label) {
+        constructor(label2) {
           super();
-          this.label = label;
+          this.label = label2;
           this.names = {};
         }
         render({ _n }) {
@@ -47585,11 +48492,11 @@ var init_ajvProvider_CEoC_sr = __esm({
         endFor() {
           return this._endBlockNode(For);
         }
-        label(label) {
-          return this._leafNode(new Label2(label));
+        label(label2) {
+          return this._leafNode(new Label2(label2));
         }
-        break(label) {
-          return this._leafNode(new Break(label));
+        break(label2) {
+          return this._leafNode(new Break(label2));
         }
         return(value) {
           const node2 = new Return();
@@ -49357,7 +50264,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
       }
       exports.compileSchema = compileSchema;
-      function resolveRef2(root, baseId, ref) {
+      function resolveRef3(root, baseId, ref) {
         var _a3;
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
@@ -49376,7 +50283,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         if (_sch === void 0) return;
         return root.refs[ref] = inlineOrCompile.call(this, _sch);
       }
-      exports.resolveRef = resolveRef2;
+      exports.resolveRef = resolveRef3;
       function inlineOrCompile(sch) {
         if ((0, resolve_1.inlineRef)(sch.schema, this.opts.inlineRefs)) return sch.schema;
         return sch.validate ? sch : compileSchema.call(this, sch);
@@ -49845,49 +50752,49 @@ var init_ajvProvider_CEoC_sr = __esm({
         return serialize(resolved, schemelessOptions);
       }
       function resolveComponent(base4, relative4, options, skipNormalization) {
-        const target = {};
+        const target2 = {};
         if (!skipNormalization) {
           base4 = parse5(serialize(base4, options), options);
           relative4 = parse5(serialize(relative4, options), options);
         }
         options = options || {};
         if (!options.tolerant && relative4.scheme) {
-          target.scheme = relative4.scheme;
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+          target2.scheme = relative4.scheme;
+          target2.userinfo = relative4.userinfo;
+          target2.host = relative4.host;
+          target2.port = relative4.port;
+          target2.path = removeDotSegments(relative4.path || "");
+          target2.query = relative4.query;
         } else {
           if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-            target.userinfo = relative4.userinfo;
-            target.host = relative4.host;
-            target.port = relative4.port;
-            target.path = removeDotSegments(relative4.path || "");
-            target.query = relative4.query;
+            target2.userinfo = relative4.userinfo;
+            target2.host = relative4.host;
+            target2.port = relative4.port;
+            target2.path = removeDotSegments(relative4.path || "");
+            target2.query = relative4.query;
           } else {
             if (!relative4.path) {
-              target.path = base4.path;
-              if (relative4.query !== void 0) target.query = relative4.query;
-              else target.query = base4.query;
+              target2.path = base4.path;
+              if (relative4.query !== void 0) target2.query = relative4.query;
+              else target2.query = base4.query;
             } else {
-              if (relative4.path[0] === "/") target.path = removeDotSegments(relative4.path);
+              if (relative4.path[0] === "/") target2.path = removeDotSegments(relative4.path);
               else {
-                if ((base4.userinfo !== void 0 || base4.host !== void 0 || base4.port !== void 0) && !base4.path) target.path = "/" + relative4.path;
-                else if (!base4.path) target.path = relative4.path;
-                else target.path = base4.path.slice(0, base4.path.lastIndexOf("/") + 1) + relative4.path;
-                target.path = removeDotSegments(target.path);
+                if ((base4.userinfo !== void 0 || base4.host !== void 0 || base4.port !== void 0) && !base4.path) target2.path = "/" + relative4.path;
+                else if (!base4.path) target2.path = relative4.path;
+                else target2.path = base4.path.slice(0, base4.path.lastIndexOf("/") + 1) + relative4.path;
+                target2.path = removeDotSegments(target2.path);
               }
-              target.query = relative4.query;
+              target2.query = relative4.query;
             }
-            target.userinfo = base4.userinfo;
-            target.host = base4.host;
-            target.port = base4.port;
+            target2.userinfo = base4.userinfo;
+            target2.host = base4.host;
+            target2.port = base4.port;
           }
-          target.scheme = base4.scheme;
+          target2.scheme = base4.scheme;
         }
-        target.fragment = relative4.fragment;
-        return target;
+        target2.fragment = relative4.fragment;
+        return target2;
       }
       function equal(uriA, uriB, options) {
         if (typeof uriA === "string") {
@@ -55899,9 +56806,9 @@ var init_cloud = __esm({
 
 // ../code-shim/src/git.ts
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join31 } from "node:path";
-function git5(root, args2) {
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join32 } from "node:path";
+function git7(root, args2) {
   try {
     return execFileSync("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024, timeout: 1e4 });
   } catch {
@@ -55909,12 +56816,12 @@ function git5(root, args2) {
   }
 }
 function headCommit2(root) {
-  const out2 = git5(root, ["rev-parse", "--verify", "HEAD"]);
+  const out2 = git7(root, ["rev-parse", "--verify", "HEAD"]);
   const sha = out2?.trim();
   return sha !== void 0 && /^[0-9a-f]{40,64}$/.test(sha) ? sha : null;
 }
 function originRepository(root) {
-  const url2 = git5(root, ["remote", "get-url", "origin"])?.trim();
+  const url2 = git7(root, ["remote", "get-url", "origin"])?.trim();
   if (url2 === void 0 || url2.length === 0) return null;
   const match = /[:/]([^/:]+)\/([^/]+?)(?:\.git)?\/?$/.exec(url2);
   const owner = match?.[1];
@@ -55960,9 +56867,9 @@ function parseStatus(raw, exists) {
 }
 function readWorkingCopyState(root) {
   const head = headCommit2(root);
-  const raw = git5(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
+  const raw = git7(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
   if (raw === null) return { head, dirty: /* @__PURE__ */ new Set(), deleted: /* @__PURE__ */ new Set(), renamed: /* @__PURE__ */ new Map() };
-  return { head, ...parseStatus(raw, (path) => existsSync8(join31(root, path))) };
+  return { head, ...parseStatus(raw, (path) => existsSync9(join32(root, path))) };
 }
 var init_git2 = __esm({
   "../code-shim/src/git.ts"() {
@@ -55971,18 +56878,18 @@ var init_git2 = __esm({
 });
 
 // ../code-shim/src/config.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 function configDir(env) {
-  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join32(homedir2(), ".config");
-  return join32(base4, "mvrx-harness");
+  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join33(homedir2(), ".config");
+  return join33(base4, "mvrx-harness");
 }
 function findToken2(env, serviceUrl, now) {
   const fromEnv = env["HARNESS_TOKEN"];
   if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
   try {
-    const file2 = JSON.parse(readFileSync14(join32(configDir(env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync15(join33(configDir(env), "credentials.json"), "utf8"));
     const stored = file2[serviceUrl];
     if (stored === void 0 || typeof stored.accessToken !== "string" || stored.accessToken.length === 0) return null;
     if (typeof stored.expiresAt === "number" && stored.expiresAt <= now) return null;
@@ -55994,7 +56901,7 @@ function findToken2(env, serviceUrl, now) {
 function resolveCloudConfig(root, env, now) {
   let binding;
   try {
-    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync14(join32(root, ".harness", "project.json"), "utf8")));
+    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync15(join33(root, ".harness", "project.json"), "utf8")));
     if (!parsed.success) return null;
     binding = parsed.data;
   } catch {
@@ -56016,7 +56923,7 @@ var init_config = __esm({
 });
 
 // ../code-shim/src/local.ts
-import { readFileSync as readFileSync15, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync16, statSync as statSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve15, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
   const absolute = resolve15(root, path);
@@ -56052,12 +56959,12 @@ function scanWord(content, name2, language) {
   const hashComments = language === "python";
   const slashComments = language !== "python";
   const out2 = [];
-  let line2 = 0;
+  let line3 = 0;
   let lineStart = 0;
   let i2 = 0;
   const n = content.length;
   const newline = (at) => {
-    line2 += 1;
+    line3 += 1;
     lineStart = at + 1;
   };
   while (i2 < n) {
@@ -56092,7 +56999,7 @@ function scanWord(content, name2, language) {
     } else if (/[A-Za-z_$]/.test(c)) {
       const start2 = i2;
       while (i2 < n && IDENT_CHAR.test(content.charAt(i2))) i2 += 1;
-      if (content.slice(start2, i2) === name2) out2.push([line2, start2 - lineStart, line2, i2 - lineStart]);
+      if (content.slice(start2, i2) === name2) out2.push([line3, start2 - lineStart, line3, i2 - lineStart]);
     } else {
       i2 += 1;
     }
@@ -56136,7 +57043,7 @@ var init_local = __esm({
         let shard;
         try {
           this.parses += 1;
-          shard = await this.parse(path, readFileSync15(absolute, "utf8"));
+          shard = await this.parse(path, readFileSync16(absolute, "utf8"));
         } catch {
           shard = null;
         }
@@ -56148,7 +57055,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return null;
         try {
-          return readFileSync15(absolute, "utf8");
+          return readFileSync16(absolute, "utf8");
         } catch {
           return null;
         }
@@ -56158,7 +57065,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return void 0;
         try {
-          const lines = readFileSync15(absolute, "utf8").split("\n");
+          const lines = readFileSync16(absolute, "utf8").split("\n");
           const start2 = range[0];
           if (start2 >= lines.length) return void 0;
           const end = Math.min(Math.max(range[2], start2), start2 + maxLines - 1, lines.length - 1);
@@ -56385,25 +57292,25 @@ var init_nav = __esm({
 
 // ../code-shim/src/edit.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "node:fs";
 function lineStarts(text) {
   const starts = [0];
   for (let i2 = 0; i2 < text.length; i2 += 1) if (text[i2] === "\n") starts.push(i2 + 1);
   return starts;
 }
-function offsetOf(starts, text, line2, character) {
-  const start2 = starts[line2];
+function offsetOf(starts, text, line3, character) {
+  const start2 = starts[line3];
   if (start2 === void 0) return null;
-  const next = starts[line2 + 1] ?? text.length + 1;
+  const next = starts[line3 + 1] ?? text.length + 1;
   return Math.min(start2 + character, next - 1);
 }
 function positionAt(text, offset) {
   const starts = lineStarts(text.slice(0, offset));
-  const line2 = starts.length - 1;
-  return [line2, offset - (starts[line2] ?? 0)];
+  const line3 = starts.length - 1;
+  return [line3, offset - (starts[line3] ?? 0)];
 }
-function lineEnd(starts, text, line2) {
-  const next = starts[line2 + 1];
+function lineEnd(starts, text, line3) {
+  const next = starts[line3 + 1];
   return next === void 0 ? text.length : next - 1;
 }
 async function locate(index, path, namePath) {
@@ -56426,7 +57333,7 @@ async function editSymbol(index, args2) {
   if (!found.ok) return found;
   const absolute = resolveInside(index.root, args2.path);
   if (absolute === null) return { ok: false, reason: `path ${args2.path} is outside the repository` };
-  const original = readFileSync16(absolute, "utf8");
+  const original = readFileSync17(absolute, "utf8");
   const starts = lineStarts(original);
   const range = found.symbol.enclosingRange ?? found.symbol.range;
   const from = offsetOf(starts, original, range[0], range[1]);
@@ -56454,7 +57361,7 @@ ${args2.content.replace(/\n+$/, "")}`;
   const before = positionAt(next, changedStart);
   const after = positionAt(next, insertAt + inserted.length);
   const bytes = Buffer.from(next, "utf8");
-  writeFileSync9(absolute, bytes);
+  writeFileSync10(absolute, bytes);
   return {
     ok: true,
     path: args2.path,
@@ -56482,10 +57389,10 @@ async function renameSymbol(deps, args2) {
   }
   const targets = [{ path: args2.path, range: found.symbol.range }, ...answer.references.map((hit) => ({ path: hit.path, range: hit.range }))];
   const byFile = /* @__PURE__ */ new Map();
-  for (const target of targets) {
-    const list = byFile.get(target.path) ?? [];
-    if (!list.some((r) => r.join(",") === target.range.join(","))) list.push(target.range);
-    byFile.set(target.path, list);
+  for (const target2 of targets) {
+    const list = byFile.get(target2.path) ?? [];
+    if (!list.some((r) => r.join(",") === target2.range.join(","))) list.push(target2.range);
+    byFile.set(target2.path, list);
   }
   const plan3 = [];
   for (const [path, ranges] of byFile) {
@@ -56493,7 +57400,7 @@ async function renameSymbol(deps, args2) {
     if (absolute === null) return { ok: false, reason: `reference path ${path} is outside the repository` };
     let text;
     try {
-      text = readFileSync16(absolute, "utf8");
+      text = readFileSync17(absolute, "utf8");
     } catch {
       return { ok: false, reason: `cannot read ${path}` };
     }
@@ -56515,7 +57422,7 @@ async function renameSymbol(deps, args2) {
     let next = item.text;
     for (const offset of offsets) next = next.slice(0, offset) + args2.new_name + next.slice(offset + oldName.length);
     const bytes = Buffer.from(next, "utf8");
-    writeFileSync9(item.absolute, bytes);
+    writeFileSync10(item.absolute, bytes);
     filesChanged.push({ path: item.path, edits: offsets.length, sha256: sha2563(bytes) });
     edits += offsets.length;
   }
@@ -57113,12 +58020,12 @@ function toErrorBody(error62, command) {
 }
 
 // ../cli/src/deps.ts
-function say(deps, line2 = "") {
-  deps.stdout(`${line2}
+function say(deps, line3 = "") {
+  deps.stdout(`${line3}
 `);
 }
-function warn(deps, line2) {
-  deps.stderr(`${redact(line2)}
+function warn(deps, line3) {
+  deps.stderr(`${redact(line3)}
 `);
 }
 
@@ -57140,8 +58047,8 @@ function parseAgentList(value) {
 async function detectAgent(deps, agent, cwd) {
   const result = await deps.exec(agent, ["--version"], { cwd });
   if (result.code === 0) {
-    const line2 = result.stdout.trim().split("\n")[0] ?? "";
-    return { agent, installed: true, detail: line2.length > 0 ? line2 : "version not reported" };
+    const line3 = result.stdout.trim().split("\n")[0] ?? "";
+    return { agent, installed: true, detail: line3.length > 0 ? line3 : "version not reported" };
   }
   const reason = result.code === 127 ? `\`${agent}\` was not found on PATH` : `\`${agent} --version\` failed (exit ${result.code}): ${result.stderr.trim()}`;
   return { agent, installed: false, detail: reason };
@@ -57332,17 +58239,17 @@ var HEADER = /^\s*\[(?!\[)(.+?)\]\s*(?:#.*)?$/;
 function readTables(text) {
   const tables = [];
   let current2 = null;
-  for (const line2 of text.split("\n")) {
-    const match = HEADER.exec(line2);
+  for (const line3 of text.split("\n")) {
+    const match = HEADER.exec(line3);
     if (match !== null && match[1] !== void 0) {
       if (current2 !== null) tables.push({ path: current2.path, body: current2.lines.join("\n") });
       const path = parseKeyPath(match[1]);
       current2 = path === null ? null : { path, lines: [] };
-    } else if (/^\s*\[\[/.test(line2)) {
+    } else if (/^\s*\[\[/.test(line3)) {
       if (current2 !== null) tables.push({ path: current2.path, body: current2.lines.join("\n") });
       current2 = null;
     } else if (current2 !== null) {
-      current2.lines.push(line2);
+      current2.lines.push(line3);
     }
   }
   if (current2 !== null) tables.push({ path: current2.path, body: current2.lines.join("\n") });
@@ -57831,9 +58738,9 @@ function namesCommit(stdout, commit) {
 }
 async function assessAgent(deps, input2) {
   const { agent } = input2.info;
-  const label = AGENT_LABEL[agent];
+  const label2 = AGENT_LABEL[agent];
   if (!input2.info.installed) {
-    return report(agent, "incompatible", input2.info.detail, `install ${label} (\`${agent}\`) and run \`overlane doctor\` again`);
+    return report(agent, "incompatible", input2.info.detail, `install ${label2} (\`${agent}\`) and run \`overlane doctor\` again`);
   }
   if (input2.binding.kind !== "ok") {
     const why = input2.binding.kind === "missing" ? "no .harness/project.json" : `invalid .harness/project.json (${input2.binding.detail})`;
@@ -57843,7 +58750,7 @@ async function assessAgent(deps, input2) {
   if (input2.service === "rejected") return report(agent, "blocked", "the service rejected the stored token", "run `overlane connect` to sign in again");
   const enabled = agent === "claude" ? readClaudeState(input2.root).plugin : readCodexState(deps, input2.root).projectEnabled;
   if (!enabled) {
-    return report(agent, "blocked", `the Overlane plugin (id mvrx-harness) is not installed and enabled for ${label} in this project`, "run `overlane connect`");
+    return report(agent, "blocked", `the Overlane plugin (id mvrx-harness) is not installed and enabled for ${label2} in this project`, "run `overlane connect`");
   }
   if (agent === "codex" && !codexHookTrusted(deps)) {
     return report(agent, "needs_trust", "Codex has not trusted the Overlane hook (listed as mvrx-harness)", "open codex and run /hooks to trust the mvrx-harness hook");
@@ -58119,9 +59026,9 @@ async function connect(deps, options) {
     $ ${formatCommand(step2)}`);
   if (codexEdit !== null) {
     say(deps, `  codex: enable the plugin for this project, appending to ${CODEX_CONFIG_FILE} (other content untouched)`);
-    for (const line2 of codexEdit.block.split("\n")) if (line2.length > 0) say(deps, `    + ${line2}`);
+    for (const line3 of codexEdit.block.split("\n")) if (line3.length > 0) say(deps, `    + ${line3}`);
   }
-  for (const line2 of present) say(deps, `  skip: ${line2}`);
+  for (const line3 of present) say(deps, `  skip: ${line3}`);
   say(deps, `  write ${BINDING_FILE}: project ID, tenant ID, service URL, release digest and the release-signing public key from the service`);
   say(deps, "  write .harness/owned.json: the entries overlane added, so `overlane disconnect` removes only those");
   if (excludeNeeded) say(deps, `  append ${EXCLUDE_LINE} to ${await excludePath(deps, root)}`);
@@ -58149,7 +59056,7 @@ async function connect(deps, options) {
       writes,
       notes: [
         ...existingToken === null ? [`Sign-in: browser sign-in to ${serviceUrl} (OAuth with PKCE); set HARNESS_TOKEN to skip it.`] : [],
-        ...present.map((line2) => `skip: ${line2}`)
+        ...present.map((line3) => `skip: ${line3}`)
       ]
     });
     return { data: plan3 };
@@ -58221,7 +59128,7 @@ async function connect(deps, options) {
   for (const info2 of infos) {
     reports.push(await assessAgent(deps, { root, marketplaceRoot: marketplaceRoot2, info: info2, binding: { kind: "ok", binding }, hasToken: true, service: "reachable" }));
   }
-  for (const line2 of renderReports(reports)) say(deps, `  ${line2}`);
+  for (const line3 of renderReports(reports)) say(deps, `  ${line3}`);
   return {
     data: {
       project: projectSummary(project),
@@ -58513,10 +59420,10 @@ function deepMerge(existing, incoming) {
   }
   return incoming;
 }
-function setAt(target, key, value) {
+function setAt(target2, key, value) {
   const [head, ...rest] = key;
-  if (head === void 0) return target;
-  const out2 = { ...target };
+  if (head === void 0) return target2;
+  const out2 = { ...target2 };
   if (rest.length === 0) {
     out2[head] = deepMerge(out2[head], value);
     return out2;
@@ -58708,7 +59615,7 @@ var clientInstallCommand = defineCommand({
     }
     const files = applyPlan(dir, ops);
     for (const file2 of files) say(inv.deps, `${file2.action.padEnd(9)} ${file2.path}`);
-    for (const line2 of NEXT[name2]) say(inv.deps, line2);
+    for (const line3 of NEXT[name2]) say(inv.deps, line3);
     return { data: { client: name2, surface, dir, files, next: NEXT[name2] } };
   }
 });
@@ -58754,12 +59661,12 @@ async function verifyRelease(record3, publicKey) {
   }
   return manifest;
 }
-function diffFiles(installed, target) {
+function diffFiles(installed, target2) {
   const before = new Map(installed.map((file2) => [file2.path, file2]));
-  const after = new Set(target.map((file2) => file2.path));
+  const after = new Set(target2.map((file2) => file2.path));
   const added = [];
   const changed = [];
-  for (const file2 of target) {
+  for (const file2 of target2) {
     const old = before.get(file2.path);
     if (old === void 0) added.push(file2);
     else if (old.digest !== file2.digest) changed.push(file2);
@@ -58796,8 +59703,8 @@ function diskDigest(marketplaceRoot2, file2) {
     return null;
   }
 }
-function editedManagedFiles(marketplaceRoot2, installed, target) {
-  const wanted = new Map(target.map((file2) => [file2.path, file2.digest]));
+function editedManagedFiles(marketplaceRoot2, installed, target2) {
+  const wanted = new Map(target2.map((file2) => [file2.path, file2.digest]));
   const edited = [];
   for (const file2 of installed) {
     const actual = diskDigest(marketplaceRoot2, file2);
@@ -58805,9 +59712,9 @@ function editedManagedFiles(marketplaceRoot2, installed, target) {
   }
   return edited;
 }
-function mismatchedFiles(marketplaceRoot2, target) {
+function mismatchedFiles(marketplaceRoot2, target2) {
   const bad = [];
-  for (const file2 of target) {
+  for (const file2 of target2) {
     const actual = diskDigest(marketplaceRoot2, file2);
     if (actual !== null && actual !== file2.digest) bad.push(file2.path);
   }
@@ -58926,7 +59833,7 @@ async function verifySourceTree(deps, marketplaceRoot2, files, digest) {
     else if (actual !== file2.digest) problems.push(`${file2.path} differs`);
   }
   const listed = new Set(files.map((file2) => file2.path));
-  const tracked = (await git(deps, marketplaceRoot2, ["ls-tree", "-r", "--name-only", "HEAD"])).text.split("\n").filter((line2) => line2.length > 0);
+  const tracked = (await git(deps, marketplaceRoot2, ["ls-tree", "-r", "--name-only", "HEAD"])).text.split("\n").filter((line3) => line3.length > 0);
   for (const path of tracked) {
     if (!listed.has(path) && !path.startsWith(`${SIDECAR_DIR}/`)) problems.push(`${path} is not in the release`);
   }
@@ -58963,8 +59870,8 @@ function showDiff(deps, diff) {
     for (const file2 of files) say(deps, `    ${sign} ${file2.path} (${file2.kind})`);
   }
 }
-function approvalCommand(target, explicitTo) {
-  return `overlane release update${explicitTo ? ` --to ${target}` : ""} --approve ${target}`;
+function approvalCommand(target2, explicitTo) {
+  return `overlane release update${explicitTo ? ` --to ${target2}` : ""} --approve ${target2}`;
 }
 async function installRelease(deps, ctx, targetDigest, options, isPin) {
   const { root, binding } = ctx;
@@ -59019,7 +59926,7 @@ async function installRelease(deps, ctx, targetDigest, options, isPin) {
     refusals.push(`approval_required: --approve ${options.approve} does not name this release; run: ${approvalCommand(manifest.digest, options.to !== void 0)}`);
   }
   if (options.dryRun) {
-    for (const line2 of refusals) say(deps, `  would refuse - ${line2}`);
+    for (const line3 of refusals) say(deps, `  would refuse - ${line3}`);
     say(deps, refusals.length === 0 ? "Dry run: this update would install; nothing was changed." : "Dry run: nothing was changed.");
     const files = { added: diff.added.length, changed: diff.changed.length, removed: diff.removed.length };
     return {
@@ -59029,7 +59936,7 @@ async function installRelease(deps, ctx, targetDigest, options, isPin) {
           requests: [{ method: "GET", path: releasePaths.one(binding.tenantId, targetDigest) }],
           commands: ["claude", "codex"].flatMap((agent) => updateSteps(agent === "claude" ? "claude" : "codex").map((step2) => `${step2.command} ${step2.args.join(" ")}`)),
           writes: [{ path: RELEASE_FILE, action: "write", description: "the installed release record, written only after the commands succeed" }],
-          notes: refusals.map((line2) => `would refuse - ${line2}`)
+          notes: refusals.map((line3) => `would refuse - ${line3}`)
         }),
         release: { version: manifest.version, digest: manifest.digest, changeKinds: [...kinds], restart: manifest.restart, files },
         wouldInstall: refusals.length === 0,
@@ -59037,7 +59944,7 @@ async function installRelease(deps, ctx, targetDigest, options, isPin) {
       }
     };
   }
-  const taskRefusal = refusals.find((line2) => line2.startsWith("task_in_progress"));
+  const taskRefusal = refusals.find((line3) => line3.startsWith("task_in_progress"));
   if (taskRefusal !== void 0) throw new ReleaseRefusal("task_in_progress", taskRefusal.slice("task_in_progress: ".length));
   const first = refusals[0];
   if (first !== void 0) {
@@ -59266,14 +60173,14 @@ function sectionsOf(body2, level = 2) {
   const sections = /* @__PURE__ */ new Map([["", []]]);
   let current2 = "";
   let fenced = false;
-  for (const line2 of body2.replace(/\r\n/g, "\n").split("\n")) {
-    if (/^\s*```/.test(line2)) fenced = !fenced;
-    if (!fenced && line2.startsWith(marker)) {
-      current2 = line2.slice(marker.length).trim();
+  for (const line3 of body2.replace(/\r\n/g, "\n").split("\n")) {
+    if (/^\s*```/.test(line3)) fenced = !fenced;
+    if (!fenced && line3.startsWith(marker)) {
+      current2 = line3.slice(marker.length).trim();
       if (!sections.has(current2)) sections.set(current2, []);
       continue;
     }
-    sections.get(current2)?.push(line2);
+    sections.get(current2)?.push(line3);
   }
   return sections;
 }
@@ -59282,10 +60189,10 @@ function sectionText(lines) {
 }
 function bulletsOf(lines, where2) {
   const items = [];
-  for (const line2 of lines ?? []) {
-    if (line2.trim() === "") continue;
-    const match = /^- (.*)$/.exec(line2);
-    if (!match) throw new KitError(`${where2}: expected a "- " bullet, found "${line2}"`);
+  for (const line3 of lines ?? []) {
+    if (line3.trim() === "") continue;
+    const match = /^- (.*)$/.exec(line3);
+    if (!match) throw new KitError(`${where2}: expected a "- " bullet, found "${line3}"`);
     items.push(match[1] ?? "");
   }
   return items;
@@ -59388,10 +60295,10 @@ function parseMilestones(text, where2) {
   let current2;
   let inAcceptance = false;
   let fenced = false;
-  for (const line2 of body2.split("\n")) {
-    if (/^\s*```/.test(line2)) fenced = !fenced;
+  for (const line3 of body2.split("\n")) {
+    if (/^\s*```/.test(line3)) fenced = !fenced;
     if (fenced) continue;
-    const heading = /^## ([^:]+): (.+)$/.exec(line2);
+    const heading = /^## ([^:]+): (.+)$/.exec(line3);
     if (heading) {
       current2 = { id: (heading[1] ?? "").trim(), title: (heading[2] ?? "").trim(), acceptance: [], dependsOn: [] };
       milestones.push(current2);
@@ -59399,15 +60306,15 @@ function parseMilestones(text, where2) {
       continue;
     }
     if (!current2) continue;
-    if (/^### Acceptance\s*$/.test(line2)) {
+    if (/^### Acceptance\s*$/.test(line3)) {
       inAcceptance = true;
       continue;
     }
-    if (line2.trim() === "") continue;
-    const depends = /^Depends on: (.+)$/.exec(line2);
+    if (line3.trim() === "") continue;
+    const depends = /^Depends on: (.+)$/.exec(line3);
     if (depends && !inAcceptance) current2.dependsOn = (depends[1] ?? "").split(",").map((id2) => id2.trim());
-    else if (inAcceptance && line2.startsWith("- ")) current2.acceptance.push(line2.slice(2));
-    else throw new KitError(`${where2}: unexpected line under ${current2.id}: "${line2}"`);
+    else if (inAcceptance && line3.startsWith("- ")) current2.acceptance.push(line3.slice(2));
+    else throw new KitError(`${where2}: unexpected line under ${current2.id}: "${line3}"`);
   }
   return milestones;
 }
@@ -59560,18 +60467,18 @@ async function detectCommands(repoDir) {
         if (typeof run3 !== "string") continue;
         const dir = stepDir ?? jobDir;
         const logical = run3.replace(/\\\n\s*/g, " ").split("\n").map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"));
-        for (const line2 of logical) {
-          const kind = classifyCommand(line2);
+        for (const line3 of logical) {
+          const kind = classifyCommand(line3);
           if (kind === void 0) continue;
-          const alias = /^(pnpm|npm|yarn|bun)(?: run)? ([\w:-]+)$/.exec(line2);
-          const normalized = alias && kind !== "install" ? `${alias[1]} run ${alias[2]}` : line2;
+          const alias = /^(pnpm|npm|yarn|bun)(?: run)? ([\w:-]+)$/.exec(line3);
+          const normalized = alias && kind !== "install" ? `${alias[1]} run ${alias[2]}` : line3;
           const command = dir && dir !== "." ? `cd ${dir} && ${normalized}` : normalized;
           if (kind === "install") {
             if (install === void 0) install = command;
             if (!sources.includes(source)) sources.push(source);
             continue;
           }
-          const script = scriptBodies.get(line2);
+          const script = scriptBodies.get(line3);
           if (script !== void 0 && dir === void 0 || dir === void 0 && found[kind].includes(command)) {
             if (!sources.includes(source)) sources.push(source);
             continue;
@@ -59672,8 +60579,8 @@ function parseTasksFile(text, where2) {
     }
     return state.current;
   };
-  for (const line2 of text.replace(BLOCK_PATTERN, "").replace(/\r\n/g, "\n").split("\n")) {
-    const heading = /^##\s+Phase\s+(\d+)\s*[:\u2013\u2014-]\s*(.*?)\s*$/i.exec(line2);
+  for (const line3 of text.replace(BLOCK_PATTERN, "").replace(/\r\n/g, "\n").split("\n")) {
+    const heading = /^##\s+Phase\s+(\d+)\s*[:\u2013\u2014-]\s*(.*?)\s*$/i.exec(line3);
     if (heading) {
       let title2 = heading[2] ?? "";
       const tag = /\s*\{#([^}\s]+)\}\s*$/.exec(title2);
@@ -59682,12 +60589,12 @@ function parseTasksFile(text, where2) {
       phases.push(state.current);
       continue;
     }
-    const checkpoint = /^\*\*Checkpoint\*\*:\s*(.+?)\s*$/.exec(line2);
+    const checkpoint = /^\*\*Checkpoint\*\*:\s*(.+?)\s*$/.exec(line3);
     if (checkpoint && state.current) {
       state.current.checkpoint = checkpoint[1];
       continue;
     }
-    const task = /^\s*- \[[ xX]\]\s+([A-Za-z]*\d[\w.:-]*)((?:\s+\[(?:P|US\d+)\])*)\s+(\S.*?)\s*$/.exec(line2);
+    const task = /^\s*- \[[ xX]\]\s+([A-Za-z]*\d[\w.:-]*)((?:\s+\[(?:P|US\d+)\])*)\s+(\S.*?)\s*$/.exec(line3);
     if (!task) continue;
     const markers = task[2] ?? "";
     let title = task[3] ?? "";
@@ -59705,25 +60612,25 @@ function parseStories(specText) {
   const stories = /* @__PURE__ */ new Map();
   let story;
   let collecting = false;
-  for (const line2 of specText.replace(/\r\n/g, "\n").split("\n")) {
-    const heading = /^###\s+User Story\s+(\d+)\b/i.exec(line2);
+  for (const line3 of specText.replace(/\r\n/g, "\n").split("\n")) {
+    const heading = /^###\s+User Story\s+(\d+)\b/i.exec(line3);
     if (heading) {
       story = [];
       stories.set(Number(heading[1]), story);
       collecting = false;
       continue;
     }
-    if (/^#{1,3}\s/.test(line2) || /^---\s*$/.test(line2)) {
+    if (/^#{1,3}\s/.test(line3) || /^---\s*$/.test(line3)) {
       collecting = false;
-      if (!/^---/.test(line2)) story = void 0;
+      if (!/^---/.test(line3)) story = void 0;
       continue;
     }
     if (!story) continue;
-    if (/\*\*Acceptance Scenarios\*\*/i.test(line2)) {
+    if (/\*\*Acceptance Scenarios\*\*/i.test(line3)) {
       collecting = true;
       continue;
     }
-    const item = /^\s*\d+\.\s+(.+?)\s*$/.exec(line2);
+    const item = /^\s*\d+\.\s+(.+?)\s*$/.exec(line3);
     if (collecting && item) story.push((item[1] ?? "").replace(/\*\*/g, ""));
   }
   return stories;
@@ -59744,8 +60651,8 @@ function parseConstitution(text) {
       constraints.push(body2 && !/^\[.*\]$/.test(body2) ? `${key}: ${body2}` : key);
     }
   } else {
-    for (const line2 of principles) {
-      const bullet = /^- (.+?)\s*$/.exec(line2);
+    for (const line3 of principles) {
+      const bullet = /^- (.+?)\s*$/.exec(line3);
       if (bullet) constraints.push(bullet[1] ?? "");
     }
   }
@@ -59872,10 +60779,10 @@ async function importSpecKit(repoDir) {
 }
 
 // ../cli/src/session.ts
-async function gitRoot(deps, label) {
+async function gitRoot(deps, label2) {
   const top = await deps.exec("git", ["rev-parse", "--show-toplevel"], { cwd: deps.paths.cwd });
   const root = top.stdout.trim();
-  if (top.code !== 0 || root.length === 0) throw new UsageError(`not inside a git repository; run overlane ${label} from the connected project`);
+  if (top.code !== 0 || root.length === 0) throw new UsageError(`not inside a git repository; run overlane ${label2} from the connected project`);
   return root;
 }
 function boundProject(deps, root) {
@@ -59890,11 +60797,11 @@ function boundProject(deps, root) {
   const override = deps.env["HARNESS_SERVICE_URL"];
   return { root, binding: bound.binding, serviceUrl: override !== void 0 && override.length > 0 ? override : bound.binding.serviceUrl };
 }
-async function offlineProject(deps, label) {
-  return boundProject(deps, await gitRoot(deps, label));
+async function offlineProject(deps, label2) {
+  return boundProject(deps, await gitRoot(deps, label2));
 }
-async function connectedProject(deps, label) {
-  const project = await offlineProject(deps, label);
+async function connectedProject(deps, label2) {
+  const project = await offlineProject(deps, label2);
   const token = await requireToken(deps, project.binding.serviceUrl);
   return { ...project, token: token.token };
 }
@@ -59945,24 +60852,24 @@ function current(window3, updatedAt, now) {
 function usageWarnings(usage, now) {
   if (usage === null) return [];
   const out2 = [];
-  const check2 = (label, window3, threshold) => {
+  const check2 = (label2, window3, threshold) => {
     if (window3 === void 0 || window3.usedPercentage < threshold || !current(window3, usage.updatedAt, now)) return;
     const resets = window3.resetsAt === void 0 ? "" : `, resets ${new Date(window3.resetsAt * 1e3).toISOString()}`;
-    out2.push(`Claude ${label} usage is ${Math.round(window3.usedPercentage)}% (warning at ${threshold}%${resets}). Consider \`overlane task checkpoint\` or \`overlane task handoff\` before it runs out.`);
+    out2.push(`Claude ${label2} usage is ${Math.round(window3.usedPercentage)}% (warning at ${threshold}%${resets}). Consider \`overlane task checkpoint\` or \`overlane task handoff\` before it runs out.`);
   };
   check2("5-hour", usage.fiveHour, FIVE_HOUR_WARN_PERCENT);
   check2("weekly", usage.sevenDay, WEEKLY_WARN_PERCENT);
   return out2;
 }
 function warnUsage(deps) {
-  for (const line2 of usageWarnings(readUsage(deps), deps.now())) warn(deps, `warning: ${line2}`);
+  for (const line3 of usageWarnings(readUsage(deps), deps.now())) warn(deps, `warning: ${line3}`);
 }
 function currentUsagePercent(usage, now) {
   if (usage === null) return null;
   let best = null;
-  for (const [label, window3] of [["5-hour", usage.fiveHour], ["weekly", usage.sevenDay]]) {
+  for (const [label2, window3] of [["5-hour", usage.fiveHour], ["weekly", usage.sevenDay]]) {
     if (window3 === void 0 || !current(window3, usage.updatedAt, now)) continue;
-    if (best === null || window3.usedPercentage > best.percent) best = { percent: window3.usedPercentage, label };
+    if (best === null || window3.usedPercentage > best.percent) best = { percent: window3.usedPercentage, label: label2 };
   }
   return best;
 }
@@ -60077,9 +60984,9 @@ async function inspectWorkingCopy(deps, root) {
   const digest = await workingTreeDigest(deps, root);
   const status = await git2(deps, root, ["status", "--porcelain", "--untracked-files=all"]);
   if (digest === null || status === null) return null;
-  const clean2 = status.split("\n").every((line2) => line2.length === 0 || isHarnessPath(line2.slice(3)));
+  const clean2 = status.split("\n").every((line3) => line3.length === 0 || isHarnessPath(line3.slice(3)));
   const remotes = await git2(deps, root, ["branch", "-r", "--contains", "HEAD"]) ?? "";
-  const pushed = remotes.split("\n").some((line2) => line2.trim().length > 0 && !line2.includes("->"));
+  const pushed = remotes.split("\n").some((line3) => line3.trim().length > 0 && !line3.includes("->"));
   return { commitSha: head, workingTreeDigest: digest, clean: clean2, pushed };
 }
 function recoveryRoute(facts2) {
@@ -60568,28 +61475,28 @@ function resumeCommand(agent, taskId) {
 async function handoffTask(deps, input2) {
   const { to } = input2;
   if (to !== void 0 && to !== "claude" && to !== "codex") throw new UsageError("--to must be claude or codex");
-  const target = to ?? otherAgent(detectExecutorName(deps.env));
+  const target2 = to ?? otherAgent(detectExecutorName(deps.env));
   const written = await writeCheckpoint(deps, {
-    summary: typeof input2.summary === "string" ? input2.summary : `Handed off to ${target}`,
+    summary: typeof input2.summary === "string" ? input2.summary : `Handed off to ${target2}`,
     next: typeof input2.next === "string" ? input2.next : "Resume the task",
     pause: "handoff",
     dryRun: input2.dryRun
   });
   if (written.kind === "planned") return written.outcome;
   say(deps, `Task ${written.taskId} is paused for handoff at ${written.copy.commitSha.slice(0, 12)}, ${describeRoute(written.route.route, written.route.localOnly)}.`);
-  say(deps, `To continue it in ${target}, run this yourself from this working tree:`);
-  say(deps, `  ${resumeCommand(target, written.taskId)}`);
+  say(deps, `To continue it in ${target2}, run this yourself from this working tree:`);
+  say(deps, `  ${resumeCommand(target2, written.taskId)}`);
   say(deps, "overlane does not start the other agent. Moving work to another vendor's agent sends code and context to that vendor (REQ-TSK-09).");
   if (written.route.localOnly) say(deps, "The work is not pushed or committed, so only this working tree can continue it; nothing was committed or uploaded for you (REQ-TSK-12).");
   warnUsage(deps);
   return {
     data: {
       taskId: written.taskId,
-      to: target,
+      to: target2,
       commitSha: written.copy.commitSha,
       route: written.route.route,
       localOnly: written.route.localOnly,
-      resumeCommand: resumeCommand(target, written.taskId)
+      resumeCommand: resumeCommand(target2, written.taskId)
     }
   };
 }
@@ -61126,8 +62033,8 @@ async function buildContext(deps, version2) {
   const answers = [releases, policy, next, taskView].filter((value) => value !== null);
   const serviceStatus = answers.some((value) => !isMissing2(value)) ? "reachable" : answers.every((value) => value === "unauthenticated") ? "unauthenticated" : "unreachable";
   const pinnedByService = isMissing2(releases) ? releases : pinnedDigest(releases, binding);
-  const target = isMissing2(pinnedByService) ? binding.releaseDigest : pinnedByService;
-  const inSync = installed === null ? "unknown" : installed.digest === target;
+  const target2 = isMissing2(pinnedByService) ? binding.releaseDigest : pinnedByService;
+  const inSync = installed === null ? "unknown" : installed.digest === target2;
   const nextBlock = isMissing2(next) ? next : next.policyStatus === "paused" ? null : next.task === null ? null : { taskId: next.task.taskId, title: next.task.title, milestone: next.task.milestone };
   const policyBlock = !isMissing2(policy) ? { status: policy.status, budgets: budgetsOf(policy), source: "service" } : run3 !== null ? { status: policy, budgets: budgetsOf(run3.policy), source: "run snapshot" } : { status: policy, budgets: policy, source: "none" };
   const taskBlock = local2 === null ? { active: false } : { active: true, taskId: local2.taskId, state: isMissing2(taskView) ? taskView : taskView === null ? "unreachable" : taskView.state, holder: local2.holder };
@@ -61188,16 +62095,16 @@ var ECOSYSTEM_FLAG = { name: "ecosystem", type: "string", enum: DOCS_ECOSYSTEMS,
 var PROJECT_FLAG = { name: "project", type: "string", value: "PROJECT_ID", description: "The project whose lockfile pins choose the version" };
 var common = { needsAuth: true, needsNetwork: true };
 async function authed(inv) {
-  const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-  const token = await requireToken(inv.deps, target.storeKey);
-  return { target, call: serviceCall(inv.deps, target.service, token.token) };
+  const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+  const token = await requireToken(inv.deps, target2.storeKey);
+  return { target: target2, call: serviceCall(inv.deps, target2.service, token.token) };
 }
 async function tenantOf(call2, inv) {
   return textFlag(inv, "team") ?? (await call2(WhoAmI, "GET", apiPaths.whoami)).tenantId;
 }
 async function plan(inv, method, path, body2, note) {
-  const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-  return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path, ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+  const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+  return planOutcome(inv.deps, dryRunPlan({ service: target2.service, requests: [{ method, path, ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
 function libraryArg(inv) {
   const library = inv.positionals[0];
@@ -61555,9 +62462,9 @@ function shape(token) {
   return { tokenId: token.tokenId, label: token.label, scope: scopeText(token), tools: token.tools, expiresAt: token.expiresAt, ...token.revokedAt === void 0 ? {} : { revokedAt: token.revokedAt } };
 }
 async function authed2(inv) {
-  const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-  const token = await requireToken(inv.deps, target.storeKey);
-  return { target, call: serviceCall(inv.deps, target.service, token.token) };
+  const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+  const token = await requireToken(inv.deps, target2.storeKey);
+  return { target: target2, call: serviceCall(inv.deps, target2.service, token.token) };
 }
 async function tenantOf2(call2, inv) {
   const given = textFlag(inv, "team");
@@ -61575,28 +62482,28 @@ var authLoginCommand = defineCommand({
   keywords: ["sign in", "log in", "login", "authenticate", "browser", "device code", "credentials", "session", "expired", "reauthenticate"],
   result: AuthLoginResult,
   handler: async (inv) => {
-    const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
+    const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
     if (inv.dryRun) {
       return planOutcome(
         inv.deps,
         dryRunPlan({
-          service: target.service,
+          service: target2.service,
           requests: [
             { method: "POST", path: "/auth/device", note: "ask for a device code" },
             { method: "POST", path: "/auth/device/token", note: "poll until the browser approval, then receive the session once" }
           ],
-          writes: [{ path: `${describeStore(inv.deps, "keychain")} (account ${target.storeKey})`, action: "write", description: "store the session token; it falls back to a 0600 file when no keychain exists" }],
+          writes: [{ path: `${describeStore(inv.deps, "keychain")} (account ${target2.storeKey})`, action: "write", description: "store the session token; it falls back to a 0600 file when no keychain exists" }],
           notes: ["The browser is opened to approve the code. No credentials are needed for this step."]
         })
       );
     }
     const tokenEnvSet = (inv.deps.env["HARNESS_TOKEN"] ?? "") !== "";
-    const login = await deviceLogin(inv.deps, target.service, { openBrowser: inv.values["no-browser"] !== true });
-    const how = await saveTokens(inv.deps, target.storeKey, { accessToken: login.accessToken, expiresAt: login.expiresAt });
+    const login = await deviceLogin(inv.deps, target2.service, { openBrowser: inv.values["no-browser"] !== true });
+    const how = await saveTokens(inv.deps, target2.storeKey, { accessToken: login.accessToken, expiresAt: login.expiresAt });
     if (tokenEnvSet) warn(inv.deps, "HARNESS_TOKEN is set and takes priority over this sign-in.");
-    say(inv.deps, `Signed in to ${target.service} (stored in the ${how === "keychain" ? "OS keychain" : "0600 credentials file"}).`);
+    say(inv.deps, `Signed in to ${target2.service} (stored in the ${how === "keychain" ? "OS keychain" : "0600 credentials file"}).`);
     return {
-      data: { signedIn: true, service: target.service, how, tenantId: login.tenantId, expiresAt: new Date(login.expiresAt).toISOString(), tokenEnvSet, next: "overlane context" }
+      data: { signedIn: true, service: target2.service, how, tenantId: login.tenantId, expiresAt: new Date(login.expiresAt).toISOString(), tokenEnvSet, next: "overlane context" }
     };
   }
 });
@@ -61611,24 +62518,24 @@ var authLogoutCommand = defineCommand({
   keywords: ["sign out", "log out", "logout", "forget credentials", "remove token", "end session"],
   result: AuthLogoutResult,
   handler: async (inv) => {
-    const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
+    const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
     if (inv.dryRun) {
       return planOutcome(
         inv.deps,
         dryRunPlan({
-          service: target.service,
+          service: target2.service,
           requests: [{ method: "POST", path: "/v1/auth/logout", note: "revoke the stored session (best effort)" }],
-          writes: [{ path: `${describeStore(inv.deps, "keychain")} (account ${target.storeKey})`, action: "delete", description: "delete the stored session" }]
+          writes: [{ path: `${describeStore(inv.deps, "keychain")} (account ${target2.storeKey})`, action: "delete", description: "delete the stored session" }]
         })
       );
     }
     const tokenEnvSet = (inv.deps.env["HARNESS_TOKEN"] ?? "") !== "";
-    const loaded = await loadTokens(inv.deps, target.storeKey).catch(() => null);
+    const loaded = await loadTokens(inv.deps, target2.storeKey).catch(() => null);
     let revoked = "not_needed";
     if (loaded !== null && loaded.tokens.accessToken.startsWith(SERVER_TOKEN_PREFIX)) {
       rememberSecret(loaded.tokens.accessToken);
       try {
-        const response = await inv.deps.fetch(`${target.service}/v1/auth/logout`, {
+        const response = await inv.deps.fetch(`${target2.service}/v1/auth/logout`, {
           method: "POST",
           headers: { authorization: `Bearer ${loaded.tokens.accessToken}`, accept: "application/json" },
           signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS)
@@ -61638,11 +62545,11 @@ var authLogoutCommand = defineCommand({
         revoked = "unreachable";
       }
     }
-    await deleteTokens(inv.deps, target.storeKey);
+    await deleteTokens(inv.deps, target2.storeKey);
     if (revoked === "unreachable") warn(inv.deps, "The service could not be reached, so the session may stay valid there until it expires.");
     if (tokenEnvSet) warn(inv.deps, "HARNESS_TOKEN is still set in this environment.");
     say(inv.deps, loaded === null ? "Nothing was stored; you were not signed in from this machine." : "Signed out.");
-    return { data: { signedOut: loaded !== null, revoked, service: target.service, tokenEnvSet, next: "overlane auth login" } };
+    return { data: { signedOut: loaded !== null, revoked, service: target2.service, tokenEnvSet, next: "overlane auth login" } };
   }
 });
 var authTokenCommand = defineCommand({
@@ -61658,10 +62565,10 @@ var authTokenCommand = defineCommand({
   result: AuthTokenResult,
   text: (d) => [d.token],
   handler: async (inv) => {
-    const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-    const found = await findToken(inv.deps, target.storeKey);
-    if (found === null) throw new AuthRequiredError(`no credentials for ${target.service}; run \`overlane auth login\` or set HARNESS_TOKEN`, { hint: "overlane auth login" });
-    const stored = found.source === "environment" ? null : await loadTokens(inv.deps, target.storeKey).catch(() => null);
+    const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+    const found = await findToken(inv.deps, target2.storeKey);
+    if (found === null) throw new AuthRequiredError(`no credentials for ${target2.service}; run \`overlane auth login\` or set HARNESS_TOKEN`, { hint: "overlane auth login" });
+    const stored = found.source === "environment" ? null : await loadTokens(inv.deps, target2.storeKey).catch(() => null);
     const expiresAt = stored?.tokens.expiresAt;
     return { data: { token: found.token, how: found.source, ...expiresAt === void 0 ? {} : { expiresAt: new Date(expiresAt).toISOString() } } };
   }
@@ -61703,8 +62610,8 @@ var teamInviteCommand = defineCommand({
     const role = textFlag(inv, "role") ?? "member";
     const body2 = { email: email3, role };
     if (inv.dryRun) {
-      const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-      return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method: "POST", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/invitations`, body: body2 }] }));
+      const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+      return planOutcome(inv.deps, dryRunPlan({ service: target2.service, requests: [{ method: "POST", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/invitations`, body: body2 }] }));
     }
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
@@ -61749,20 +62656,20 @@ var tokenCreateCommand = defineCommand({
   keywords: ["agent token", "api key", "create token", "mint token", "service account", "ci token", "bot credentials", "HARNESS_TOKEN"],
   result: TokenCreateResult,
   handler: async (inv) => {
-    const label = textFlag(inv, "label");
-    if (label === void 0) throw new UsageError("--label is required", { hint: "overlane schema token create" });
+    const label2 = textFlag(inv, "label");
+    if (label2 === void 0) throw new UsageError("--label is required", { hint: "overlane schema token create" });
     const days = Number(textFlag(inv, "ttl-days") ?? "7");
     if (!Number.isInteger(days) || days < 1 || days > 90) throw new UsageError("--ttl-days must be a whole number from 1 to 90", { hint: "overlane schema token create" });
     const project = textFlag(inv, "project");
     const request = {
-      label,
+      label: label2,
       scope: project === void 0 ? { kind: "team" } : { kind: "project", projectId: project },
       tools: listFlag(inv, "tool"),
       ttlSeconds: days * 86400
     };
     if (inv.dryRun) {
-      const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-      return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method: "POST", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens`, body: request }] }));
+      const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+      return planOutcome(inv.deps, dryRunPlan({ service: target2.service, requests: [{ method: "POST", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens`, body: request }] }));
     }
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
@@ -61808,8 +62715,8 @@ var tokenRevokeCommand = defineCommand({
     const id2 = inv.positionals[0];
     if (id2 === void 0) throw new UsageError("a token ID is required", { hint: "overlane token list" });
     if (inv.dryRun) {
-      const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-      return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method: "DELETE", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens/${id2}` }] }));
+      const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+      return planOutcome(inv.deps, dryRunPlan({ service: target2.service, requests: [{ method: "DELETE", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens/${id2}` }] }));
     }
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
@@ -62047,10 +62954,10 @@ var billingCapsSetCommand = defineCommand({
   result: withDryRun(Cap),
   text: (d) => "limitCents" in d ? [`cap ${d.scope}${d.scopeId === void 0 ? "" : ` ${d.scopeId}`}: ${usd(d.limitCents)} per period`] : [],
   handler: async (inv) => {
-    const target = capTarget(inv);
+    const target2 = capTarget(inv);
     const usdText = textFlag(inv, "usd");
     if (usdText === void 0) throw new UsageError("set needs --usd", { hint: "overlane billing caps set --scope team --usd 50" });
-    const body2 = { requestId: requestId3(), ...target, limitCents: parseUsdToCents(usdText) };
+    const body2 = { requestId: requestId3(), ...target2, limitCents: parseUsdToCents(usdText) };
     if (inv.dryRun) return planned(inv, "PUT", billingPaths.caps, body2);
     const { call: call2, tenantId } = await connected(inv);
     return { data: await call2(Cap, "PUT", billingPaths.caps(tenantId), body2) };
@@ -62096,12 +63003,12 @@ import { readFileSync as readFileSync8, statSync } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 var common3 = { needsAuth: true, needsNetwork: true };
 var requestId4 = () => `cli-${randomUUID4()}`;
-async function connected2(inv, label) {
-  const project = await connectedProject(inv.deps, label);
+async function connected2(inv, label2) {
+  const project = await connectedProject(inv.deps, label2);
   return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned2(inv, label, method, path, body2, note) {
-  const project = await offlineProject(inv.deps, label);
+async function planned2(inv, label2, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, label2);
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
 var APPROVAL_FLAG = { name: "approval", type: "string", value: "ID", description: "Run an action that an approval covers; get the ID from `overlane guard approvals list`" };
@@ -63022,7 +63929,7 @@ var deployTargetsCommand = defineCommand({
   ...common3,
   keywords: ["deploy targets", "environments", "where do we deploy", "staging production"],
   result: TargetListResponse,
-  text: (d) => [...d.targets.map((target) => `target ${target.name} (${target.config.kind}) ${target.targetId}`), ...d.environments.map((env) => `environment ${env.name}${env.protected ? " (protected)" : ""}${env.kind === "preview" ? ` (preview of ${env.branch})` : ""} -> ${env.targetId}`)],
+  text: (d) => [...d.targets.map((target2) => `target ${target2.name} (${target2.config.kind}) ${target2.targetId}`), ...d.environments.map((env) => `environment ${env.name}${env.protected ? " (protected)" : ""}${env.kind === "preview" ? ` (preview of ${env.branch})` : ""} -> ${env.targetId}`)],
   handler: async (inv) => {
     const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
     return { data: await call2(TargetListResponse, "GET", deployPaths.targets(tenantId, projectId)) };
@@ -63074,9 +63981,9 @@ var deployEnvCreateCommand = defineCommand({
   text: (d) => "environment" in d ? [`Created ${d.environment.name}${d.environment.protected ? " (protected)" : ""}.`] : [],
   handler: async (inv) => {
     const name2 = arg3(inv, 0, "an environment name", "overlane deploy env create staging --target site");
-    const target = textFlag(inv, "target");
-    if (target === void 0) throw new UsageError("--target is required", { hint: "overlane deploy targets" });
-    const body2 = { name: name2, targetId: target, ...boolFlag(inv, "protected") ? { protected: true } : {} };
+    const target2 = textFlag(inv, "target");
+    if (target2 === void 0) throw new UsageError("--target is required", { hint: "overlane deploy targets" });
+    const body2 = { name: name2, targetId: target2, ...boolFlag(inv, "protected") ? { protected: true } : {} };
     if (inv.dryRun) return planned2(inv, "deploy", "POST", deployPaths.environments, body2);
     const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
     return { data: await call2(EnvironmentResponse, "POST", deployPaths.environments(tenantId, projectId), body2) };
@@ -63177,12 +64084,12 @@ var deployPreviewCommand = defineCommand({
   text: (d) => "release" in d && d.release !== null ? [releaseLine(d.release)] : [],
   handler: async (inv) => {
     const branch = textFlag(inv, "branch");
-    const target = textFlag(inv, "target");
+    const target2 = textFlag(inv, "target");
     const commit = textFlag(inv, "commit");
     const run3 = textFlag(inv, "run");
-    if (branch === void 0 || target === void 0 || commit === void 0 || run3 === void 0) throw new UsageError("--branch, --target, --commit and --run are required", { hint: "overlane deploy preview --branch feature/x --target site --commit <sha> --run <run>" });
+    if (branch === void 0 || target2 === void 0 || commit === void 0 || run3 === void 0) throw new UsageError("--branch, --target, --commit and --run are required", { hint: "overlane deploy preview --branch feature/x --target site --commit <sha> --run <run>" });
     const artifact = textFlag(inv, "artifact");
-    const body2 = { requestId: requestId4(), branch, targetId: target, commitSha: commit, runId: run3, ...artifact === void 0 ? {} : { artifact } };
+    const body2 = { requestId: requestId4(), branch, targetId: target2, commitSha: commit, runId: run3, ...artifact === void 0 ? {} : { artifact } };
     if (inv.dryRun) return planned2(inv, "deploy", "POST", deployPaths.previews, body2);
     const { call: call2, tenantId, projectId } = await connected2(inv, "deploy");
     const result = await call2(DeployResponse, "POST", deployPaths.previews(tenantId, projectId), body2);
@@ -63500,9 +64407,9 @@ var SERVICE_FLAG3 = { name: "service", type: "string", value: "URL", description
 var TEAM_FLAG3 = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
 var common5 = { needsAuth: true, needsNetwork: true };
 async function authed3(inv) {
-  const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-  const token = await requireToken(inv.deps, target.storeKey);
-  return { target, call: serviceCall(inv.deps, target.service, token.token) };
+  const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
+  const token = await requireToken(inv.deps, target2.storeKey);
+  return { target: target2, call: serviceCall(inv.deps, target2.service, token.token) };
 }
 async function tenantOf3(call2, inv) {
   return textFlag(inv, "team") ?? (await call2(WhoAmI, "GET", apiPaths.whoami)).tenantId;
@@ -63513,9 +64420,9 @@ function idArg(inv, what) {
   return id2;
 }
 async function plan2(inv, method, path, body2, note) {
-  const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
+  const target2 = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const tenant = textFlag(inv, "team") ?? ":your-team";
-  return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+  return planOutcome(inv.deps, dryRunPlan({ service: target2.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
 var requestId6 = () => `cli-${randomUUID6()}`;
 var memorySearchCommand = defineCommand({
@@ -63766,12 +64673,12 @@ var common6 = { needsAuth: true, needsNetwork: true };
 var requestId7 = () => `cli-${randomUUID7()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var STATUSES = ["backlog", "todo", "in_progress", "in_review", "cancelled"];
-async function send(deps, label, schema, method, path, body2, dryRun) {
+async function send(deps, label2, schema, method, path, body2, dryRun) {
   if (dryRun) {
-    const project2 = await offlineProject(deps, label);
+    const project2 = await offlineProject(deps, label2);
     return planOutcome(deps, dryRunPlan({ service: project2.serviceUrl, requests: [{ method, path: path(project2.binding.tenantId, project2.binding.projectId), ...body2 === void 0 ? {} : { body: body2 } }] }));
   }
-  const project = await connectedProject(deps, label);
+  const project = await connectedProject(deps, label2);
   const value = await serviceCall(deps, project.serviceUrl, project.token)(schema, method, path(project.binding.tenantId, project.binding.projectId), body2);
   return { data: value, value };
 }
@@ -64271,8 +65178,8 @@ var reviewRunCommand = defineCommand({
     const diff = await diffOf(inv);
     if (diff !== void 0) {
       const title = textFlag(inv, "title");
-      const label = textFlag(inv, "label");
-      const source = { kind: "patch", diff: diff.text, ...title === void 0 ? {} : { title }, ...label === void 0 ? {} : { label } };
+      const label2 = textFlag(inv, "label");
+      const source = { kind: "patch", diff: diff.text, ...title === void 0 ? {} : { title }, ...label2 === void 0 ? {} : { label: label2 } };
       const patchBody = { requestId: requestId8(), trigger: "manual", source };
       if (inv.dryRun) return planned4(inv, "POST", reviewPaths.runs, { ...patchBody, source: { ...source, diff: `<${diff.text.length} characters from ${diff.from}>` } }, "runs the deterministic checks on the diff, then an optional model pass; nothing is posted");
       const sent = await connected4(inv);
@@ -64701,11 +65608,11 @@ function closestCommands(specs, typed, limit = 3) {
     let best = Number.POSITIVE_INFINITY;
     for (const [index, candidate] of candidates.entries()) {
       if (candidate.length === 0) continue;
-      const target = index === 0 ? path : spec.path[0] ?? path;
-      if (index === 1 && candidate === target) continue;
-      const prefix = target.startsWith(candidate) && candidate.length >= 2;
-      const distance = prefix ? 0.5 : editDistance(candidate, target);
-      const allowed = Math.max(2, Math.floor(target.length / 3));
+      const target2 = index === 0 ? path : spec.path[0] ?? path;
+      if (index === 1 && candidate === target2) continue;
+      const prefix = target2.startsWith(candidate) && candidate.length >= 2;
+      const distance = prefix ? 0.5 : editDistance(candidate, target2);
+      const allowed = Math.max(2, Math.floor(target2.length / 3));
       if (distance <= allowed) best = Math.min(best, distance + (index === 1 ? 0.75 : 0));
     }
     if (Number.isFinite(best)) scored.push({ spec, score: best });
@@ -64942,6 +65849,69 @@ async function disconnect(deps, options) {
 // ../cli/src/doctor.ts
 import { resolve as resolve12 } from "node:path";
 init_zod();
+
+// ../cli/src/rules.ts
+init_src();
+import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname8, join as join21 } from "node:path";
+function readIfRegular(root, relative4, unsafe) {
+  const full = join21(root, relative4);
+  if (!existsSync5(full) && !isLink(full)) return null;
+  const stat = lstatSync2(full);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    unsafe.push(relative4);
+    return null;
+  }
+  return readFileSync12(full, "utf8");
+}
+function isLink(path) {
+  try {
+    return lstatSync2(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function readRules(root) {
+  const unsafe = [];
+  const source = readIfRegular(root, RULES_SOURCE_PATH, unsafe);
+  const files = {};
+  for (const target2 of RULES_TARGETS) files[target2.path] = readIfRegular(root, target2.path, unsafe);
+  return { source, files, unsafe };
+}
+function rulesStatus(root) {
+  const read = readRules(root);
+  const report2 = checkRules(read.source, { files: read.files });
+  if (read.unsafe.length > 0 && report2.configured) {
+    const targets = report2.targets.map((t) => read.unsafe.includes(t.path) ? { ...t, state: "damaged", detail: `${t.path} is a symbolic link or not a regular file; replace it with a regular file`, syncable: false } : t);
+    return { report: { ...report2, drifted: true, targets }, unsafe: read.unsafe };
+  }
+  return { report: report2, unsafe: read.unsafe };
+}
+function planFromDisk(root, force) {
+  const read = readRules(root);
+  if (read.source === null) return { read, plan: { ok: false, problem: `${RULES_SOURCE_PATH} does not exist; create it with the rules every agent should follow` } };
+  const plan3 = planRulesSync(read.source, { files: read.files }, { force });
+  if (plan3.ok && read.unsafe.length > 0) {
+    const steps = plan3.plan.steps.map((s) => read.unsafe.includes(s.path) ? { ...s, action: "refuse", next: null, reason: `${s.path} is a symbolic link or not a regular file; replace it with a regular file` } : s);
+    return { read, plan: { ok: true, plan: { steps, blocked: steps.some((s) => s.action === "refuse") } } };
+  }
+  return { read, plan: plan3 };
+}
+function applyPlan2(root, plan3) {
+  const written = [];
+  for (const step2 of plan3.steps) {
+    if (step2.next === null) continue;
+    const full = join21(root, step2.path);
+    mkdirSync8(dirname8(full), { recursive: true });
+    const temp = `${full}.overlane-tmp`;
+    writeFileSync7(temp, step2.next, { encoding: "utf8", mode: 420 });
+    renameSync5(temp, full);
+    written.push(step2.path);
+  }
+  return written;
+}
+
+// ../cli/src/doctor.ts
 var DoctorResult = external_exports.object({
   project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
   binding: external_exports.enum(["ok", "missing", "invalid"]),
@@ -64949,6 +65919,8 @@ var DoctorResult = external_exports.object({
   credentials: external_exports.string().optional(),
   reachability: external_exports.enum(["reachable", "unreachable", "rejected", "not checked"]),
   agents: external_exports.array(external_exports.object({ agent: external_exports.string(), installed: external_exports.boolean(), state: external_exports.string(), detail: external_exports.string(), action: external_exports.string().nullable(), completionGate: external_exports.string() })),
+  /** Present when the project has a rules source (.overlane/rules.md): whether each agent file still matches it (MS-C1.3). */
+  rules: external_exports.object({ drifted: external_exports.boolean(), revision: external_exports.string().nullable(), targets: external_exports.array(external_exports.object({ path: external_exports.string(), state: external_exports.string() })), nextCommand: external_exports.string().nullable() }).optional(),
   ready: external_exports.boolean()
 });
 function commandIn(action) {
@@ -64986,9 +65958,15 @@ async function doctor(deps, options) {
     reports.push(await assessAgent(deps, { root, marketplaceRoot: marketplaceRoot2, info: info2, binding, hasToken, service }));
   }
   say(deps);
-  for (const line2 of renderReports(reports)) say(deps, line2);
+  for (const line3 of renderReports(reports)) say(deps, line3);
+  const rules = rulesStatus(root).report;
+  if (rules.configured) {
+    say(deps, rules.sourceProblem !== null ? `Rules: source problem - ${rules.sourceProblem}` : rules.drifted ? `Rules: drifted - ${rules.targets.filter((t) => t.state !== "in_sync").map((t) => `${t.path} (${t.state})`).join(", ")}; next: ${rules.nextCommand ?? "overlane rules check"}` : `Rules: in sync at revision ${rules.revision}`);
+  }
   const installedStates = reports.filter((report2, index) => infos[index]?.installed === true).map((report2) => report2.state);
-  const ready = installedStates.length > 0 && installedStates.every((state) => state === "ready");
+  const agentsReady = installedStates.length > 0 && installedStates.every((state) => state === "ready");
+  const rulesDrifted = rules.configured && rules.drifted;
+  const ready = agentsReady && !rulesDrifted;
   const data = {
     project: projectSummary(project),
     binding: binding.kind,
@@ -65003,9 +65981,13 @@ async function doctor(deps, options) {
       action: report2.action,
       completionGate: completionGate(report2.agent)
     })),
+    ...rules.configured ? { rules: { drifted: rules.drifted, revision: rules.revision, targets: rules.targets.map((t) => ({ path: t.path, state: t.state })), nextCommand: rules.nextCommand } } : {},
     ready
   };
   if (ready) return { data };
+  if (agentsReady && rulesDrifted) {
+    return { data, error: new CliError(`not ready: the rules files have drifted from the source - ${rules.sourceProblem ?? rules.targets.find((t) => t.state !== "in_sync")?.detail ?? ""}`, { code: "rules_drift", exit: EXIT.conflict, hint: rules.nextCommand ?? "overlane rules check", quiet: true }) };
+  }
   const pending = reports.find((report2) => report2.action !== null);
   return {
     data,
@@ -65021,22 +66003,22 @@ async function doctor(deps, options) {
 // ../cli/src/kit/setup.ts
 init_src();
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // ../cli/src/kit/ci.ts
-import { existsSync as existsSync5, readdirSync } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync6, readdirSync } from "node:fs";
+import { join as join22 } from "node:path";
 var ACTION_PINS = {
   checkout: "actions/checkout@v7.0.1",
   setupNode: "actions/setup-node@v7.0.0",
   pnpm: "pnpm/action-setup@v6.1.0",
   setupPython: "actions/setup-python@v7.0.0"
 };
-var CI_FILE = join21(".github", "workflows", "ci.yml");
+var CI_FILE = join22(".github", "workflows", "ci.yml");
 function hasCi(root) {
   try {
-    return readdirSync(join21(root, ".github", "workflows")).some((name2) => /\.ya?ml$/.test(name2));
+    return readdirSync(join22(root, ".github", "workflows")).some((name2) => /\.ya?ml$/.test(name2));
   } catch {
     return false;
   }
@@ -65048,12 +66030,12 @@ function ciWorkflow(root, detected) {
   for (const run3 of detected.typecheck ?? []) commands.push({ name: "Typecheck", run: run3 });
   for (const run3 of detected.test) commands.push({ name: "Test", run: run3 });
   if (!commands.some((command) => command.name !== "Install")) return null;
-  const node2 = existsSync5(join21(root, "package.json"));
-  const python = existsSync5(join21(root, "pyproject.toml"));
+  const node2 = existsSync6(join22(root, "package.json"));
+  const python = existsSync6(join22(root, "pyproject.toml"));
   const steps = [`      - uses: ${ACTION_PINS.checkout}`];
   if (node2) {
     if (detected.install?.startsWith("pnpm")) steps.push(`      - uses: ${ACTION_PINS.pnpm}`);
-    const version2 = existsSync5(join21(root, ".nvmrc")) ? "node-version-file: .nvmrc" : "node-version: 22";
+    const version2 = existsSync6(join22(root, ".nvmrc")) ? "node-version-file: .nvmrc" : "node-version: 22";
     steps.push(`      - uses: ${ACTION_PINS.setupNode}`, "        with:", `          ${version2}`);
   }
   if (python) {
@@ -65095,7 +66077,7 @@ var INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md"];
 var runPrompt = (projectId) => `Run one bounded step with the run-step skill for project ${projectId}.`;
 function hasSpecKit(root) {
   try {
-    return readdirSync2(join22(root, "specs"), { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync6(join22(root, "specs", entry.name, "tasks.md")));
+    return readdirSync2(join23(root, "specs"), { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync7(join23(root, "specs", entry.name, "tasks.md")));
   } catch {
     return false;
   }
@@ -65132,7 +66114,7 @@ async function gitOk(deps, root, ...args2) {
 }
 async function dirty(deps, root, paths) {
   const status = await deps.exec("git", ["status", "--porcelain", "--", ...paths], { cwd: root });
-  return status.stdout.split("\n").filter((line2) => line2.length > 3).map((line2) => line2.slice(3));
+  return status.stdout.split("\n").filter((line3) => line3.length > 3).map((line3) => line3.slice(3));
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
@@ -65152,8 +66134,8 @@ async function connectKit(deps, options) {
   const project = await detectProject(deps, { name: options.name, provider: options.provider });
   const { root } = project;
   if (await headCommit(deps, root) === null) throw new CliError("the repository has no commit yet; make an initial commit first");
-  const planDir = join22(root, PLAN_DIR);
-  const planExists = existsSync6(join22(planDir, "project.md"));
+  const planDir = join23(root, PLAN_DIR);
+  const planExists = existsSync7(join23(planDir, "project.md"));
   const ciExists = hasCi(root);
   let plan3;
   let planSource;
@@ -65177,7 +66159,7 @@ async function connectKit(deps, options) {
   }
   const detected = await detectCommands(root);
   const workflow = ciExists ? null : ciWorkflow(root, detected);
-  const blocks = INSTRUCTION_FILES.map((file2) => ({ file: file2, before: readText(join22(root, file2)) })).map((entry) => ({ ...entry, after: withBlock2(entry.before) }));
+  const blocks = INSTRUCTION_FILES.map((file2) => ({ file: file2, before: readText(join23(root, file2)) })).map((entry) => ({ ...entry, after: withBlock2(entry.before) }));
   const blockChanges = blocks.filter((entry) => entry.after !== entry.before);
   const firstMilestone = plan3.milestones[0]?.id ?? DEFAULT_RUN_POLICY.buildAheadLimit;
   const branchExists = (await gitOut(deps, root, "rev-parse", "--verify", "--quiet", `refs/heads/${KIT_BRANCH}`)).code === 0;
@@ -65232,18 +66214,18 @@ async function connectKit(deps, options) {
   await gitOk(deps, root, "switch", "-c", KIT_BRANCH);
   if (!planExists) await writePlan(root, plan3);
   const written = [];
-  if (workflow !== null && writeIfDifferent(join22(root, CI_FILE), workflow)) written.push(CI_FILE);
-  for (const entry of blockChanges) if (writeIfDifferent(join22(root, entry.file), entry.after)) written.push(entry.file);
-  const agentConfig = [join22(".claude", "settings.json"), join22(".codex", "config.toml")];
+  if (workflow !== null && writeIfDifferent(join23(root, CI_FILE), workflow)) written.push(CI_FILE);
+  for (const entry of blockChanges) if (writeIfDifferent(join23(root, entry.file), entry.after)) written.push(entry.file);
+  const agentConfig = [join23(".claude", "settings.json"), join23(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
-  const preExisting = new Set(agentConfig.filter((file2) => existsSync6(join22(root, file2))));
-  const connected5 = await connect(deps, { ...options, yes: true });
-  if (connected5.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const preExisting = new Set(agentConfig.filter((file2) => existsSync7(join23(root, file2))));
+  const connected9 = await connect(deps, { ...options, yes: true });
+  if (connected9.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected5.data !== void 0 && !("dryRun" in connected5.data) ? connected5.data : void 0;
+  const connectData = connected9.data !== void 0 && !("dryRun" in connected9.data) ? connected9.data : void 0;
   for (const file2 of agentConfig) {
-    if (!existsSync6(join22(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
+    if (!existsSync7(join23(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
     written.push(file2);
   }
@@ -65264,7 +66246,7 @@ async function connectKit(deps, options) {
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
   const pr = await openPullRequest(deps, root, project.name);
   say(deps);
-  for (const line2 of schedulerSetup(binding.binding.projectId)) say(deps, line2);
+  for (const line3 of schedulerSetup(binding.binding.projectId)) say(deps, line3);
   return {
     data: {
       mode: options.mode,
@@ -65289,14 +66271,14 @@ async function openPullRequest(deps, root, _name) {
   const auth = version2.code === 0 ? await deps.exec("gh", ["auth", "status"], { cwd: root }) : version2;
   if (version2.code !== 0 || auth.code !== 0) {
     say(deps, `No authenticated gh found. The work is committed on branch ${KIT_BRANCH}. To open the pull request, run:`);
-    for (const line2 of manual) say(deps, `  ${line2}`);
+    for (const line3 of manual) say(deps, `  ${line3}`);
     return { url: null, manual };
   }
   const push = await deps.exec("git", ["push", "-u", "origin", KIT_BRANCH], { cwd: root });
   const pr = push.code === 0 ? await deps.exec("gh", ["pr", "create", "--head", KIT_BRANCH, "--title", PR_TITLE, "--body", PR_BODY], { cwd: root }) : push;
   if (push.code !== 0 || pr.code !== 0) {
     warn(deps, `warning: could not open the pull request (${(pr.stderr || pr.stdout).trim()}). Branch ${KIT_BRANCH} is committed. Run:`);
-    for (const line2 of manual) say(deps, `  ${line2}`);
+    for (const line3 of manual) say(deps, `  ${line3}`);
     return { url: null, manual };
   }
   say(deps, `Opened pull request: ${pr.stdout.trim()}`);
@@ -65414,7 +66396,7 @@ async function listReleases(deps) {
     compatSummary(record3),
     record3.pinnedBy.length === 0 ? "-" : record3.pinnedBy.map((id2) => id2 === ctx.binding.projectId ? `${id2} (this)` : id2).join(",")
   ]);
-  for (const line2 of table([header, ...rows])) say(deps, line2);
+  for (const line3 of table([header, ...rows])) say(deps, line3);
   return { data };
 }
 async function releaseStatus(deps) {
@@ -65430,9 +66412,9 @@ async function releaseStatus(deps) {
   say(deps, `installed:  ${installed === null ? "none recorded" : `${installed.version} ${installed.digest}`}`);
   say(deps, `binding:    ${ctx.binding.releaseDigest}`);
   say(deps, `project pin: ${pin ?? `unknown${note}`}`);
-  const target = pin ?? ctx.binding.releaseDigest;
-  const inSync = installed?.digest === target;
-  say(deps, inSync ? "State: in sync." : `State: update available - run \`overlane release update\` (installed ${installed === null ? "none" : shortDigest(installed.digest)}, pinned ${shortDigest(target)}).`);
+  const target2 = pin ?? ctx.binding.releaseDigest;
+  const inSync = installed?.digest === target2;
+  say(deps, inSync ? "State: in sync." : `State: update available - run \`overlane release update\` (installed ${installed === null ? "none" : shortDigest(installed.digest)}, pinned ${shortDigest(target2)}).`);
   const taskRunning = readTaskState(ctx.root) !== null;
   if (taskRunning) say(deps, "A task is running here; an update waits until it is released, paused or submitted.");
   const approvals = readApprovals(deps);
@@ -65472,8 +66454,8 @@ async function updateRelease(deps, input2) {
   }
   const ctx = await context3(deps);
   const pin = pinnedDigest(await ctx.client.list(), ctx.binding);
-  const target = input2.to ?? pin;
-  return installRelease(deps, ctx, target, { to: input2.to, approve: input2.approve, dryRun: input2.dryRun }, target === pin);
+  const target2 = input2.to ?? pin;
+  return installRelease(deps, ctx, target2, { to: input2.to, approve: input2.approve, dryRun: input2.dryRun }, target2 === pin);
 }
 async function rollbackRelease(deps, input2) {
   if (input2.dryRun) {
@@ -65766,16 +66748,16 @@ var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCo
 init_src();
 init_zod();
 import { randomUUID as randomUUID10 } from "node:crypto";
-import { mkdirSync as mkdirSync8, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname8, join as join23 } from "node:path";
-var TASK_POLICY_PATH = join23(".harness", "task-policy.json");
+import { mkdirSync as mkdirSync9, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname9, join as join24 } from "node:path";
+var TASK_POLICY_PATH = join24(".harness", "task-policy.json");
 function writePolicyFile(root, policy, nowMs) {
-  const path = join23(root, TASK_POLICY_PATH);
-  mkdirSync8(dirname8(path), { recursive: true });
+  const path = join24(root, TASK_POLICY_PATH);
+  mkdirSync9(dirname9(path), { recursive: true });
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync7(temp, `${JSON.stringify({ enforcement: policy.enforcement, ...policy.reason === void 0 ? {} : { reason: policy.reason }, checkedAt: new Date(nowMs).toISOString() }, null, 2)}
+  writeFileSync8(temp, `${JSON.stringify({ enforcement: policy.enforcement, ...policy.reason === void 0 ? {} : { reason: policy.reason }, checkedAt: new Date(nowMs).toISOString() }, null, 2)}
 `);
-  renameSync5(temp, path);
+  renameSync6(temp, path);
 }
 var TaskNewResult = withDryRun(
   external_exports.object({ taskId: external_exports.string(), version: external_exports.number(), state: external_exports.string(), holder: external_exports.string(), priority: TaskPriority, rank: external_exports.number(), next: external_exports.string() })
@@ -66507,6 +67489,875 @@ var taskHandoffCommand = defineCommand({
 });
 var taskCommands = [taskListCommand, taskStartCommand, taskStatusCommand, taskCheckpointCommand, taskResumeCommand, taskSubmitCommand, taskEvidenceCommand, taskHandoffCommand];
 
+// ../cli/src/commands/claims.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID11 } from "node:crypto";
+var common15 = { needsAuth: true, needsNetwork: true };
+var requestId10 = () => `cli-${randomUUID11()}`;
+async function connected5(inv) {
+  const project = await connectedProject(inv.deps, "claim");
+  return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned5(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "claim");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+async function git3(deps, args2) {
+  return deps.exec("git", args2, { cwd: deps.paths.cwd });
+}
+async function whereAmI(deps) {
+  const head = await git3(deps, ["rev-parse", "HEAD"]);
+  const branch = await git3(deps, ["symbolic-ref", "--short", "-q", "HEAD"]);
+  const sha = head.stdout.trim();
+  return { ...branch.code === 0 && branch.stdout.trim() !== "" ? { branch: branch.stdout.trim() } : {}, ...head.code === 0 && /^[0-9a-f]{40,64}$/.test(sha) ? { headSha: sha } : {} };
+}
+var SCOPE_FLAGS = [
+  { name: "path", type: "string", multiple: true, value: "PATH", description: "A file or directory to claim (a directory claims everything under it); repeat for more" },
+  { name: "glob", type: "string", multiple: true, value: "GLOB", description: "A glob such as 'src/billing/**'; repeat for more" },
+  { name: "module", type: "string", multiple: true, value: "NAME", description: "A module, resolved through the code map where indexed; repeat for more" },
+  { name: "paths", type: "string", value: "A,B", description: "For a module the code map does not know: the paths it covers (comma separated)" }
+];
+function scopesOf(inv) {
+  const paths = (textFlag(inv, "paths") ?? "").split(",").map((p) => p.trim()).filter((p) => p !== "");
+  const scopes = [
+    ...listFlag(inv, "path").map((value) => ({ kind: "path", value })),
+    ...listFlag(inv, "glob").map((value) => ({ kind: "glob", value })),
+    ...listFlag(inv, "module").map((value) => ({ kind: "module", value, ...paths.length === 0 ? {} : { paths } }))
+  ];
+  if (scopes.length === 0) throw new UsageError("a claim names its scope", { hint: "overlane claim acquire --task TASK --path src/billing/" });
+  return scopes;
+}
+function leaseFlag(inv) {
+  const text = textFlag(inv, "lease-seconds");
+  if (text === void 0) return void 0;
+  if (!/^\d+$/.test(text) || Number(text) < 60) throw new UsageError("--lease-seconds is a whole number of at least 60");
+  return Number(text);
+}
+var claimAcquireCommand = defineCommand({
+  path: ["claim", "acquire"],
+  summary: "Claim the files or modules a task will change; an overlapping claim by another agent is queued or refused",
+  description: "Claims scope before changing it. Paths and globs are repository-relative; a module is resolved through the code map where the project is indexed, else the --paths you give, else the claim is refused without guessing. Under the project's policy an overlapping claim by another agent is queued behind it (serialise, the default), refused (exit 5) or allowed with a warning. Records your branch and head so the pre-merge check can compare them. The lease ends if you stop renewing it.",
+  flags: [
+    { name: "task", type: "string", required: true, value: "TASK", description: "The task this work belongs to" },
+    ...SCOPE_FLAGS,
+    { name: "mode", type: "string", enum: ["exclusive", "shared"], value: "MODE", description: "exclusive (default) or shared read access" },
+    { name: "agent", type: "string", value: "NAME", description: "A label such as codex or claude" },
+    { name: "lease-seconds", type: "string", value: "N", description: "Lease length, 60 to 14400; the project default otherwise" }
+  ],
+  examples: ["overlane claim acquire --task task-12 --path apps/api-worker/src/billing/", "overlane claim acquire --task task-12 --module billing --glob 'docs/billing/**'"],
+  effect: "write",
+  ...common15,
+  keywords: ["claim", "lease", "lock files", "avoid merge conflict", "two agents same file", "reserve scope", "serialise agents"],
+  result: withDryRun(ClaimOutcome),
+  text: (d) => "decision" in d ? [`${d.decision.toUpperCase()}${d.claim === null ? "" : `  claim ${d.claim.id}  lease until ${d.claim.leaseExpiresAt}`}`, d.message, ...d.overlaps.map((o) => `  overlaps ${o.claimId} (task ${o.taskId}, ${o.agent ?? o.holder}): ${o.patterns.slice(0, 3).join(", ")}`), ...d.nextCommand === null ? [] : [`next: ${d.nextCommand}`]] : [],
+  handler: async (inv) => {
+    const task = textFlag(inv, "task");
+    if (task === void 0) throw new UsageError("claim acquire needs --task", { hint: "overlane claim acquire --task TASK --path src/" });
+    const here = await whereAmI(inv.deps);
+    const lease = leaseFlag(inv);
+    const body2 = {
+      requestId: requestId10(),
+      taskId: task,
+      scopes: scopesOf(inv),
+      mode: textFlag(inv, "mode") ?? "exclusive",
+      ...textFlag(inv, "agent") === void 0 ? {} : { agent: textFlag(inv, "agent") },
+      ...lease === void 0 ? {} : { leaseSeconds: lease },
+      ...here
+    };
+    if (inv.dryRun) return planned5(inv, "POST", claimPaths.claims, body2, "claims the scope; nothing changes in your files");
+    const { call: call2, tenantId, projectId } = await connected5(inv);
+    const outcome = await call2(ClaimOutcome, "POST", claimPaths.claims(tenantId, projectId), body2);
+    if (outcome.decision === "refused") return { data: outcome, exit: EXIT.conflict, error: new CliError(outcome.message, { code: "scope_claimed", exit: EXIT.conflict, ...outcome.nextCommand === null ? {} : { hint: outcome.nextCommand }, quiet: true }) };
+    return { data: outcome };
+  }
+});
+var claimListCommand = defineCommand({
+  path: ["claim", "list"],
+  summary: "List the project's claims: who holds which scope, who waits, and when each lease ends",
+  description: "Lists claims newest first with their status (active, queued, released, expired), scope patterns, lease end and the project's overlap policy.",
+  flags: [
+    { name: "task", type: "string", value: "TASK", description: "Only this task's claims" },
+    { name: "status", type: "string", enum: ["active", "queued", "released", "expired"], value: "STATUS", description: "Only claims in this state" }
+  ],
+  examples: ["overlane claim list", "overlane claim list --status active --json"],
+  effect: "read",
+  ...common15,
+  keywords: ["who is working on", "claims", "queued", "lease", "scope held"],
+  result: ClaimListResponse,
+  text: (d) => [`policy: ${d.policy}`, ...d.claims.map((c) => `${c.id}  ${c.status.padEnd(8)} task ${c.taskId}  ${c.agent ?? c.holder}  ${c.patterns.slice(0, 3).join(", ")}${c.status === "active" ? `  until ${c.leaseExpiresAt}` : ""}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected5(inv);
+    const params = new URLSearchParams();
+    if (textFlag(inv, "task") !== void 0) params.set("task", textFlag(inv, "task"));
+    if (textFlag(inv, "status") !== void 0) params.set("status", textFlag(inv, "status"));
+    const query = params.toString();
+    return { data: await call2(ClaimListResponse, "GET", `${claimPaths.claims(tenantId, projectId)}${query === "" ? "" : `?${query}`}`) };
+  }
+});
+var claimRenewCommand = defineCommand({
+  path: ["claim", "renew"],
+  summary: "Extend a claim's lease and report the branch head you are on",
+  description: "Keeps a claim alive while the work continues. Also records the current branch and head so the pre-merge check compares the right commits. A claim that reached its maximum lifetime cannot be renewed; acquire it again.",
+  flags: [
+    { name: "claim", type: "string", required: true, value: "ID", description: "The claim to renew" },
+    { name: "lease-seconds", type: "string", value: "N", description: "New lease length from now" }
+  ],
+  examples: ["overlane claim renew --claim clm_abc123"],
+  effect: "write",
+  ...common15,
+  keywords: ["heartbeat", "keep lease", "extend claim"],
+  result: withDryRun(Claim),
+  text: (d) => "id" in d ? [`claim ${d.id} ${d.status}, lease until ${d.leaseExpiresAt}`] : [],
+  handler: async (inv) => {
+    const id2 = textFlag(inv, "claim");
+    if (id2 === void 0) throw new UsageError("claim renew needs --claim", { hint: "overlane claim list" });
+    const lease = leaseFlag(inv);
+    const here = await whereAmI(inv.deps);
+    const body2 = { ...lease === void 0 ? {} : { leaseSeconds: lease }, ...here };
+    if (inv.dryRun) return planned5(inv, "POST", (t, p) => claimPaths.renew(t, p, id2), body2);
+    const { call: call2, tenantId, projectId } = await connected5(inv);
+    return { data: await call2(Claim, "POST", claimPaths.renew(tenantId, projectId, id2), body2) };
+  }
+});
+var claimReleaseCommand = defineCommand({
+  path: ["claim", "release"],
+  summary: "Release a claim so a queued agent can take the scope",
+  description: "Releases the scope when the task is done or abandoned. The next queued claim on overlapping scope becomes active. Only the holder can release before the lease ends.",
+  flags: [
+    { name: "claim", type: "string", required: true, value: "ID", description: "The claim to release" },
+    { name: "done", type: "boolean", description: "Record the release as the task being done" }
+  ],
+  examples: ["overlane claim release --claim clm_abc123 --done"],
+  effect: "write",
+  ...common15,
+  keywords: ["release claim", "done with files", "free scope"],
+  result: withDryRun(Claim),
+  text: (d) => "id" in d ? [`claim ${d.id} ${d.status}${d.releaseReason === void 0 ? "" : ` (${d.releaseReason})`}`] : [],
+  handler: async (inv) => {
+    const id2 = textFlag(inv, "claim");
+    if (id2 === void 0) throw new UsageError("claim release needs --claim", { hint: "overlane claim list" });
+    const body2 = { reason: inv.values["done"] === true ? "done" : "released" };
+    if (inv.dryRun) return planned5(inv, "POST", (t, p) => claimPaths.release(t, p, id2), body2);
+    const { call: call2, tenantId, projectId } = await connected5(inv);
+    return { data: await call2(Claim, "POST", claimPaths.release(tenantId, projectId, id2), body2) };
+  }
+});
+var claimReadinessCommand = defineCommand({
+  path: ["claim", "readiness"],
+  summary: "Say whether this claim's branch is clear to merge as far as claims and the conflict check can tell",
+  description: "Combines the claim's state and the recorded `git merge-tree` checks of its branch head against every other open branch. Not ready (exit 5) when the claim is queued, a check is missing for the current heads, a check failed or a conflict is recorded.",
+  flags: [{ name: "claim", type: "string", required: true, value: "ID", description: "The claim to evaluate" }],
+  examples: ["overlane claim readiness --claim clm_abc123"],
+  effect: "read",
+  ...common15,
+  keywords: ["ready to merge", "merge conflict check", "pre-merge", "can i merge"],
+  result: MergeReadiness,
+  text: (d) => [d.ready ? `READY  (${d.checkedPairs} pair${d.checkedPairs === 1 ? "" : "s"} checked)` : "NOT READY", ...d.blockers.map((b) => `  ${b.code}: ${b.message}${b.nextCommand === null ? "" : `  -> ${b.nextCommand}`}`)],
+  handler: async (inv) => {
+    const id2 = textFlag(inv, "claim");
+    if (id2 === void 0) throw new UsageError("claim readiness needs --claim", { hint: "overlane claim list" });
+    const { call: call2, tenantId, projectId } = await connected5(inv);
+    const data = await call2(MergeReadiness, "GET", claimPaths.readiness(tenantId, projectId, id2));
+    return data.ready ? { data } : { data, exit: EXIT.conflict, error: new CliError(`not ready to merge: ${data.blockers[0]?.message ?? "see blockers"}`, { code: data.blockers[0]?.code ?? "not_ready", exit: EXIT.conflict, ...data.blockers[0]?.nextCommand ? { hint: data.blockers[0].nextCommand } : {}, quiet: true }) };
+  }
+});
+var CheckedPair = external_exports.object({ a: external_exports.object({ ref: external_exports.string(), sha: external_exports.string() }), b: external_exports.object({ ref: external_exports.string(), sha: external_exports.string() }), result: MergeTreeResult, recorded: external_exports.boolean() }).strict();
+var ConflictsResult = external_exports.object({ checks: external_exports.array(CheckedPair), conflicts: external_exports.number().int().nonnegative(), errors: external_exports.number().int().nonnegative() }).strict();
+async function resolveRef2(deps, ref) {
+  const parsed = await git3(deps, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
+  const sha = parsed.stdout.trim();
+  return parsed.code === 0 && /^[0-9a-f]{40,64}$/.test(sha) ? { ref, sha } : { ref, error: `${ref} is not a commit in this checkout` };
+}
+async function runMergeTree(deps, a, b) {
+  const out2 = await git3(deps, mergeTreeArgs(a, b));
+  const result = parseMergeTree(out2.stdout, out2.code, out2.stderr);
+  if (result.status === "error" && /unknown option|usage: git merge-tree/i.test(out2.stderr)) return { status: "error", files: [], message: "this git does not support `merge-tree --write-tree` (needs 2.38 or later)" };
+  return result;
+}
+var claimConflictsCommand = defineCommand({
+  path: ["claim", "conflicts"],
+  summary: "Check two branch heads for a merge conflict with git merge-tree, before either pull request merges",
+  description: "Runs `git merge-tree --write-tree` between two commits in this checkout, which merges them in memory and touches neither branch nor the working tree, and records the result so `claim readiness` can use it. With --all it checks every pair of open branches that has no check for its current heads. Exit 5 when a conflict is found. Needs git 2.38 or later; both commits must be present locally (fetch first).",
+  flags: [
+    { name: "a", type: "string", value: "REF", description: "First branch, tag or commit" },
+    { name: "b", type: "string", value: "REF", description: "Second branch, tag or commit" },
+    { name: "all", type: "boolean", description: "Check every open pair that has no check for its current heads" },
+    { name: "no-record", type: "boolean", description: "Print the result without recording it (works offline)" }
+  ],
+  examples: ["overlane claim conflicts --a feat/billing --b feat/review", "overlane claim conflicts --all"],
+  effect: "write",
+  needsAuth: false,
+  needsNetwork: false,
+  keywords: ["merge conflict", "merge-tree", "will these branches conflict", "pre-merge check", "conflict between branches"],
+  result: withDryRun(ConflictsResult),
+  text: (d) => "checks" in d ? [...d.checks.map((c) => `${c.result.status.toUpperCase().padEnd(8)} ${c.a.ref} x ${c.b.ref}${c.result.files.length > 0 ? `  ${c.result.files.map((f) => f.path).slice(0, 5).join(", ")}` : ""}${c.result.message === void 0 ? "" : `  ${c.result.message}`}${c.recorded ? "" : "  (not recorded)"}`), `${d.conflicts} conflict${d.conflicts === 1 ? "" : "s"}, ${d.errors} error${d.errors === 1 ? "" : "s"}`] : [],
+  handler: async (inv) => {
+    const a = textFlag(inv, "a");
+    const b = textFlag(inv, "b");
+    const all = inv.values["all"] === true;
+    if (!all && (a === void 0 || b === void 0)) throw new UsageError("give --a and --b, or --all", { hint: "overlane claim conflicts --a feat/one --b feat/two" });
+    if (inv.dryRun) {
+      return planOutcome(inv.deps, dryRunPlan({ commands: [`git ${mergeTreeArgs(a ?? "<branch a>", b ?? "<branch b>").join(" ")}`], notes: ["git merge-tree --write-tree writes tree objects into this repository's object store and changes no branch or file; the result is recorded with the service."] }));
+    }
+    const record3 = inv.values["no-record"] !== true;
+    const session = record3 || all ? await connected5(inv) : null;
+    const pairs = [];
+    const errors = [];
+    const unresolved = (ref, message) => ({ a: { ref, sha: "0".repeat(40) }, b: { ref, sha: "0".repeat(40) }, result: { status: "error", files: [], message }, recorded: false });
+    if (all) {
+      const PendingList = external_exports.object({ pairs: external_exports.array(external_exports.object({ a: external_exports.object({ claimId: external_exports.string(), ref: external_exports.string(), headSha: external_exports.string() }), b: external_exports.object({ claimId: external_exports.string(), ref: external_exports.string(), headSha: external_exports.string() }) }).passthrough()) }).passthrough();
+      const pending = await session.call(PendingList, "GET", claimPaths.pending(session.tenantId, session.projectId));
+      for (const pair of pending.pairs) pairs.push({ a: { ref: pair.a.ref, sha: pair.a.headSha, claimId: pair.a.claimId }, b: { ref: pair.b.ref, sha: pair.b.headSha, claimId: pair.b.claimId } });
+    } else {
+      const left = await resolveRef2(inv.deps, a);
+      const right = await resolveRef2(inv.deps, b);
+      if ("error" in left) errors.push(unresolved(left.ref, left.error));
+      else if ("error" in right) errors.push(unresolved(right.ref, right.error));
+      else pairs.push({ a: left, b: right });
+    }
+    const checks = [...errors];
+    for (const pair of pairs) {
+      const result = await runMergeTree(inv.deps, pair.a.sha, pair.b.sha);
+      let recorded = false;
+      if (record3 && session !== null) {
+        await session.call(MergeCheckRecord, "POST", claimPaths.checks(session.tenantId, session.projectId), { requestId: requestId10(), a: pair.a, b: pair.b, result });
+        recorded = true;
+      }
+      checks.push({ a: { ref: pair.a.ref, sha: pair.a.sha }, b: { ref: pair.b.ref, sha: pair.b.sha }, result, recorded });
+    }
+    const conflicts = checks.filter((c) => c.result.status === "conflict").length;
+    const failures = checks.filter((c) => c.result.status === "error").length;
+    const data = { checks, conflicts, errors: failures };
+    if (conflicts > 0) return { data, exit: EXIT.conflict, error: new CliError(`${conflicts} merge conflict${conflicts === 1 ? "" : "s"} found between open branches`, { code: "merge_conflict", exit: EXIT.conflict, hint: "overlane claim list", quiet: true }) };
+    if (failures > 0) return { data, exit: EXIT.failure, error: new CliError(checks.find((c) => c.result.status === "error")?.result.message ?? "the merge check failed", { code: "merge_check_failed", exit: EXIT.failure, quiet: true }) };
+    return { data };
+  }
+});
+var claimCommands = [claimAcquireCommand, claimListCommand, claimRenewCommand, claimReleaseCommand, claimReadinessCommand, claimConflictsCommand];
+
+// ../cli/src/commands/budget.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID12 } from "node:crypto";
+var common16 = { needsAuth: true, needsNetwork: true };
+var requestId11 = () => `cli-${randomUUID12()}`;
+async function connected6(inv) {
+  const project = await connectedProject(inv.deps, "budget");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned6(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "budget");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+var usd2 = (cents) => `$${Math.trunc(cents / 100)}.${String(cents % 100).padStart(2, "0")}`;
+function target(inv) {
+  const scope = textFlag(inv, "scope");
+  const id2 = textFlag(inv, "id");
+  if (scope === void 0) throw new UsageError("this command needs --scope", { hint: "overlane budget set --scope task --id TASK --usd 5" });
+  if (scope === "team" && id2 !== void 0) throw new UsageError("a team budget has no --id");
+  if (scope !== "team" && id2 === void 0) throw new UsageError(`a ${scope} budget needs --id`, { hint: `overlane budget set --scope ${scope} --id <${scope} id> --usd 5` });
+  return { scope, ...id2 === void 0 ? {} : { scopeId: id2 } };
+}
+var label = (scope, scopeId) => scope === "team" ? "team" : `${scope} ${scopeId}`;
+var Show = external_exports.object({ tenantId: external_exports.string(), limits: external_exports.array(BudgetLimit), summary: BudgetSummary }).strict();
+var SetResult2 = external_exports.object({ tenantId: external_exports.string(), limit: BudgetLimit, change: external_exports.enum(["first", "lower", "same", "raise", "remove"]), previousCents: external_exports.number().int().nullable() }).strict();
+var budgetShowCommand = defineCommand({
+  path: ["budget", "show"],
+  summary: "Show budgets per task, agent, project and team, with what is spent and what is left",
+  description: "Lists every limit with the spend counted against it this billing period (a task's budget counts its whole life). Spending caps set with `overlane billing caps` appear here too, read through the same check.",
+  examples: ["overlane budget show", "overlane budget show --json"],
+  effect: "read",
+  ...common16,
+  keywords: ["budget", "how much left", "spend per task", "cap", "limit"],
+  result: Show,
+  text: (d) => d.summary.lines.length === 0 ? ["No budgets set: nothing stops a run except plan allowances. Set one: overlane budget set --scope team --usd 50"] : d.summary.lines.map((l) => `${label(l.scope, l.scopeId).padEnd(28)} ${usd2(l.spentCents)} of ${usd2(l.limitCents)}  (${usd2(Math.max(l.remainingCents, 0))} left)${l.source === "billing_cap" ? "  billing cap" : ""}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected6(inv);
+    return { data: await call2(Show, "GET", budgetPaths.root(tenantId)) };
+  }
+});
+var budgetSetCommand = defineCommand({
+  path: ["budget", "set"],
+  summary: "Set a budget for a task, an agent, a project or the team",
+  description: "Sets the most that may be spent at that scope. A first limit or a lower one takes effect at once. Raising a limit is spend above the budget: an agent needs an independent agent's approval (set OVERLANE_APPROVAL to the approval ID the refusal names), a person does not.",
+  flags: [
+    { name: "scope", type: "string", required: true, enum: BUDGET_SCOPES, value: "SCOPE", description: "task, agent, project or team" },
+    { name: "id", type: "string", value: "ID", description: "The task, agent token or project (not for team)" },
+    { name: "usd", type: "string", required: true, value: "AMOUNT", description: "Dollars, for example 5 or 12.50" }
+  ],
+  examples: ["overlane budget set --scope task --id task-12 --usd 5", "overlane budget set --scope team --usd 200 --dry-run"],
+  effect: "write",
+  ...common16,
+  keywords: ["set budget", "limit spend", "cap a run", "stop at"],
+  result: withDryRun(SetResult2),
+  text: (d) => "limit" in d ? [`${label(d.limit.scope, d.limit.scopeId)}: ${usd2(d.limit.limitCents)} (${d.change}${d.previousCents === null ? "" : `, was ${usd2(d.previousCents)}`})`] : [],
+  handler: async (inv) => {
+    const usdText = textFlag(inv, "usd");
+    if (usdText === void 0) throw new UsageError("set needs --usd", { hint: "overlane budget set --scope team --usd 50" });
+    const limitCents = parseUsdToCents(usdText);
+    if (limitCents < 1) throw new UsageError("--usd must be more than zero");
+    const body2 = { requestId: requestId11(), ...target(inv), limitCents };
+    if (inv.dryRun) return planned6(inv, "PUT", budgetPaths.root, body2, "raising an existing limit needs an independent agent's approval (class spend) when an agent runs it");
+    const { call: call2, tenantId } = await connected6(inv);
+    return { data: await call2(SetResult2, "PUT", budgetPaths.root(tenantId), body2) };
+  }
+});
+var budgetCheckCommand = defineCommand({
+  path: ["budget", "check"],
+  summary: "Ask before spending: exits 6 and records a stop when the call would reach a budget",
+  description: "Asks whether a call estimated at --usd may go ahead for this task, agent and project. The estimate is counted: spent plus the estimate at or over a limit refuses, and the answer names the tightest limit. A refusal exits 6, stores a record (see `budget stops`) and prints the next command. With --record an allowed estimate is counted as spent so the next check sees it. An agent token is always checked as itself.",
+  flags: [
+    { name: "usd", type: "string", required: true, value: "AMOUNT", description: "The call's estimated cost in dollars, for example 0.40" },
+    { name: "task", type: "string", value: "TASK", description: "The task this call belongs to" },
+    { name: "agent", type: "string", value: "ID", description: "The agent token, for a person checking for an agent" },
+    { name: "kind", type: "string", value: "KIND", description: "What the call is, for the record (inference, ci, review)" },
+    { name: "meter", type: "string", enum: ["reviews", "ciMinutes", "docsCalls", "hostedInference"], value: "METER", description: "Also check the plan allowance for this meter" },
+    { name: "record", type: "boolean", description: "Count the estimate as spent when allowed" }
+  ],
+  examples: ["overlane budget check --usd 0.40 --task task-12", "overlane budget check --usd 0.05 --task task-12 --record --kind inference"],
+  effect: "write",
+  ...common16,
+  keywords: ["can i spend", "budget gate", "stop at cap", "exit 6", "run cost"],
+  result: withDryRun(BudgetDecision),
+  text: (d) => "allowed" in d ? [`${d.allowed ? "ALLOWED" : "STOPPED"}  ${d.message}`, ...d.nextCommand === null ? [] : [`next: ${d.nextCommand}`], ...d.stopId === null ? [] : [`record: ${d.stopId}`]] : [],
+  handler: async (inv) => {
+    const usdText = textFlag(inv, "usd");
+    if (usdText === void 0) throw new UsageError("check needs --usd", { hint: "overlane budget check --usd 0.40 --task task-12" });
+    const body2 = {
+      requestId: requestId11(),
+      estimateCents: parseUsdToCents(usdText),
+      ...textFlag(inv, "task") === void 0 ? {} : { taskId: textFlag(inv, "task") },
+      ...textFlag(inv, "agent") === void 0 ? {} : { agentId: textFlag(inv, "agent") },
+      ...textFlag(inv, "kind") === void 0 ? {} : { kind: textFlag(inv, "kind") },
+      ...textFlag(inv, "meter") === void 0 ? {} : { meter: textFlag(inv, "meter") },
+      commit: boolFlag(inv, "record")
+    };
+    if (inv.dryRun) return planned6(inv, "POST", budgetPaths.check, body2, "asks the service; a refusal stores a stop record");
+    const { call: call2, tenantId, projectId } = await connected6(inv);
+    const decision = await call2(BudgetDecision, "POST", budgetPaths.check(tenantId), { ...body2, projectId });
+    return decision.allowed ? { data: decision } : { data: decision, exit: EXIT.blocked, error: new CliError(decision.message, { code: decision.reason ?? "budget", exit: EXIT.blocked, ...decision.nextCommand === null ? {} : { hint: decision.nextCommand } }) };
+  }
+});
+var budgetStopsCommand = defineCommand({
+  path: ["budget", "stops"],
+  summary: "List the runs a budget stopped, newest first",
+  description: "Every refusal is a stored record: when, which limit, what was spent, what the call was estimated at, and who asked. Read-only for every role.",
+  flags: [{ name: "limit", type: "string", value: "N", description: "How many to list, default 50" }],
+  examples: ["overlane budget stops", "overlane budget stops --limit 10 --json"],
+  effect: "read",
+  ...common16,
+  keywords: ["stopped runs", "budget stops", "what hit the cap", "refusals"],
+  result: BudgetStopList,
+  text: (d) => d.stops.length === 0 ? ["No stops recorded."] : d.stops.map((s) => `${s.at}  ${s.reason}  ${s.scope === null ? "" : label(s.scope, s.scopeId ?? "")}  ${s.spentCents === null ? "" : `${usd2(s.spentCents)} of ${usd2(s.limitCents ?? 0)}`}  call ${usd2(s.estimateCents)}  ${s.id}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected6(inv);
+    const limit = textFlag(inv, "limit");
+    if (limit !== void 0 && !/^\d+$/.test(limit)) throw new UsageError("--limit is a whole number");
+    return { data: await call2(BudgetStopList, "GET", `${budgetPaths.stops(tenantId)}${limit === void 0 ? "" : `?limit=${limit}`}`) };
+  }
+});
+var budgetCommands = [budgetShowCommand, budgetSetCommand, budgetCheckCommand, budgetStopsCommand];
+
+// ../cli/src/commands/rules.ts
+init_src();
+init_zod();
+var common17 = { needsAuth: false, needsNetwork: false };
+var Action2 = external_exports.enum(["create", "append", "replace", "none", "refuse", "force_replace"]);
+var SyncResult2 = external_exports.object({
+  revision: external_exports.string().nullable(),
+  steps: external_exports.array(external_exports.object({ id: external_exports.string(), path: external_exports.string(), action: Action2, reason: external_exports.string(), replaces: external_exports.object({ lines: external_exports.number().int(), firstLines: external_exports.array(external_exports.string()) }).optional(), written: external_exports.boolean() }).passthrough()),
+  written: external_exports.array(external_exports.string()),
+  blocked: external_exports.boolean()
+}).strict();
+var rulesSyncCommand = defineCommand({
+  path: ["rules", "sync"],
+  summary: "Write the project's rules source to AGENTS.md, CLAUDE.md, Cursor, Gemini and the Gemini settings",
+  description: `Reads ${RULES_SOURCE_PATH} and writes it into one managed region in each agent's file. Missing files are created, a hand-written file gets the region appended with every existing line kept, and an out-of-date region is updated. A region someone edited by hand is never overwritten silently: sync refuses with exit 5 and writes nothing, until the change is moved into the source or --overwrite-edits is given, which first prints the lines it replaces. The Gemini settings only gain the missing names in context.fileName. A symbolic link in the way is refused.`,
+  flags: [{ name: "overwrite-edits", type: "boolean", description: "Replace a region that was edited by hand (prints what it replaces first)" }],
+  examples: ["overlane rules sync", "overlane rules sync --dry-run", "overlane rules sync --overwrite-edits"],
+  effect: "write",
+  ...common17,
+  keywords: ["rules", "AGENTS.md", "CLAUDE.md", "cursor rules", "gemini", "one source of rules", "sync instructions", "agent instructions"],
+  result: withDryRun(SyncResult2),
+  text: (d) => "steps" in d ? d.steps.map((s) => `${s.action.toUpperCase().padEnd(13)} ${s.path}  ${s.reason}`) : [],
+  handler: async (inv) => {
+    const project = await detectProject(inv.deps);
+    const root = project.root;
+    const force = boolFlag(inv, "overwrite-edits");
+    const { read, plan: plan3 } = planFromDisk(root, force);
+    if (!plan3.ok && inv.dryRun) return planOutcome(inv.deps, dryRunPlan({ writes: RULES_TARGETS.map((t) => ({ path: t.path, action: "write", description: `would be written from ${RULES_SOURCE_PATH}` })), notes: [`Would stop: ${plan3.problem}`] }));
+    if (!plan3.ok) throw new CliError(plan3.problem, { code: "rules_source_invalid", exit: EXIT.conflict, hint: `create ${RULES_SOURCE_PATH} with the rules every agent should follow, then run overlane rules sync` });
+    if (inv.dryRun) {
+      return planOutcome(
+        inv.deps,
+        dryRunPlan({
+          writes: plan3.plan.steps.filter((s) => s.next !== null).map((s) => ({ path: s.path, action: s.action === "append" ? "append" : "write", description: s.reason })),
+          notes: plan3.plan.steps.filter((s) => s.action === "refuse").map((s) => `Would refuse: ${s.reason}`)
+        })
+      );
+    }
+    const revision = read.source === null ? null : rulesRevision(read.source);
+    for (const step2 of plan3.plan.steps) {
+      if (step2.action === "force_replace" && step2.replaces !== void 0) {
+        warn(inv.deps, `Replacing ${step2.replaces.lines} lines of ${step2.path}; the lines that differ from the source:`);
+        for (const line3 of step2.replaces.firstLines) warn(inv.deps, `  - ${line3}`);
+      }
+    }
+    const written = plan3.plan.blocked ? [] : applyPlan2(root, plan3.plan);
+    const data = { revision, steps: plan3.plan.steps.map((s) => ({ id: s.id, path: s.path, action: s.action, reason: s.reason, ...s.replaces === void 0 ? {} : { replaces: s.replaces }, written: written.includes(s.path) })), written, blocked: plan3.plan.blocked };
+    if (plan3.plan.blocked) {
+      const refused = plan3.plan.steps.find((s) => s.action === "refuse");
+      return { data, exit: EXIT.conflict, error: new CliError(`nothing was written: ${refused?.reason ?? "a rules file needs attention"}`, { code: "rules_drift", exit: EXIT.conflict, hint: "move the change into .overlane/rules.md, or run overlane rules sync --overwrite-edits", quiet: true }) };
+    }
+    return { data };
+  }
+});
+var rulesCheckCommand = defineCommand({
+  path: ["rules", "check"],
+  summary: "Report drift between the rules source and each agent's file; exits 6 on drift, for CI",
+  description: `Compares ${RULES_SOURCE_PATH} with AGENTS.md, CLAUDE.md, the Cursor rule, GEMINI.md and the Gemini settings, and changes nothing. A target is in sync, missing, unmanaged (no managed region yet), stale (the source changed), edited (a hand edit inside the region, with the first differing line) or damaged. Exit 0 when everything is in sync or the project has no rules source; exit 6 on any drift. Run it in CI and see it in overlane doctor.`,
+  examples: ["overlane rules check", "overlane rules check --json"],
+  effect: "read",
+  ...common17,
+  keywords: ["rules drift", "instructions out of date", "hand edit AGENTS.md", "ci check rules", "doctor rules"],
+  result: RulesCheckReport,
+  text: (d) => !d.configured ? [`No rules source: ${d.nextCommand ?? ""}`] : d.sourceProblem !== null ? [`Rules source problem: ${d.sourceProblem}`] : [`Rules revision ${d.revision}`, ...d.targets.map((t) => `${t.state.toUpperCase().padEnd(10)} ${t.path}  ${t.detail}`), ...d.nextCommand === null ? ["All in sync."] : [`next: ${d.nextCommand}`]],
+  handler: async (inv) => {
+    const project = await detectProject(inv.deps);
+    const { report: report2 } = rulesStatus(project.root);
+    if (!report2.drifted) return { data: report2 };
+    const first = report2.targets.find((t) => t.state !== "in_sync");
+    return { data: report2, exit: EXIT.blocked, error: new CliError(report2.sourceProblem ?? first?.detail ?? "the rules files have drifted from the source", { code: "rules_drift", exit: EXIT.blocked, ...report2.nextCommand === null ? {} : { hint: report2.nextCommand }, quiet: true }) };
+  }
+});
+var rulesCommands = [rulesSyncCommand, rulesCheckCommand];
+
+// ../cli/src/commands/pr.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID13 } from "node:crypto";
+var common18 = { needsAuth: true, needsNetwork: true };
+var requestId12 = () => `cli-${randomUUID13()}`;
+async function connected7(inv) {
+  const project = await connectedProject(inv.deps, "pr");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned7(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "pr");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+var git4 = (deps, args2) => deps.exec("git", args2, { cwd: deps.paths.cwd });
+var MAX_PATCH_FILES = 40;
+var MAX_PATCH_CHARS = 8e3;
+async function snapshotOf(inv, head, base4) {
+  const sha = await git4(inv.deps, ["rev-parse", "--verify", "--quiet", `${head}^{commit}`]);
+  if (sha.code !== 0) throw new UsageError(`${head} is not a commit in this checkout`, { hint: "git fetch, then retry" });
+  const stat = await git4(inv.deps, ["diff", "--numstat", "-z", "--no-renames", `${base4}...${head}`]);
+  if (stat.code !== 0) throw new UsageError(`could not compare ${base4} with ${head}: ${stat.stderr.trim().split("\n")[0] ?? "git failed"}`, { hint: "pass --base with a branch that exists, for example --base origin/main" });
+  const files = [];
+  for (const entry of stat.stdout.split("\0")) {
+    const match = /^(\d+|-)\t(\d+|-)\t(.+)$/s.exec(entry);
+    if (match === null) continue;
+    files.push({ path: match[3], status: "modified", additions: match[1] === "-" ? 0 : Number(match[1]), deletions: match[2] === "-" ? 0 : Number(match[2]) });
+  }
+  for (const file2 of files.slice(0, MAX_PATCH_FILES)) {
+    const patch = await git4(inv.deps, ["diff", "--unified=2", `${base4}...${head}`, "--", file2.path]);
+    if (patch.code === 0 && patch.stdout !== "") file2.patch = patch.stdout.slice(0, MAX_PATCH_CHARS);
+  }
+  const project = await detectProject(inv.deps);
+  const repository = textFlag(inv, "repo") ?? (project.repository === void 0 ? `overlane/${project.name.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 80) || "project"}` : `${project.repository.owner}/${project.repository.name}`);
+  return { provider: project.provider === "github" ? "github" : "overlane", repository, headSha: sha.stdout.trim(), baseRef: base4, files };
+}
+function numberOf(inv) {
+  const text = textFlag(inv, "number");
+  if (text === void 0 || !/^[1-9]\d*$/.test(text)) throw new UsageError("give the pull request number with --number", { hint: "overlane pr route --number 7" });
+  return Number(text);
+}
+function checkFlag(inv, name2) {
+  const value = textFlag(inv, name2);
+  return value ?? "missing";
+}
+var CHECK_FLAGS = [
+  { name: "ci", type: "string", enum: CHECK_STATES, value: "STATE", description: "CI result: passed, failed, pending or missing (default missing, which blocks)" },
+  { name: "secret-scan", type: "string", enum: CHECK_STATES, value: "STATE", description: "Secret scan result (default missing, which blocks)" },
+  { name: "guardrails", type: "string", enum: CHECK_STATES, value: "STATE", description: "Guardrails result (default missing, which blocks)" },
+  { name: "conflict", type: "string", enum: CHECK_STATES, value: "STATE", description: "Merge conflict check result, passed meaning no conflict (default missing, which blocks)" },
+  { name: "critical", type: "string", value: "N", description: "Unresolved critical review findings (default 0)" },
+  { name: "review-done", type: "boolean", description: "The review run finished for this head" }
+];
+var LANE_TEXT = {
+  blocked: "BLOCKED",
+  fast: "FAST PATH",
+  standard: "STANDARD",
+  approver: "APPROVER"
+};
+var line2 = (s) => `${LANE_TEXT[s.route.lane] ?? s.route.lane}  ${s.repository}#${s.number}  risk ${s.route.risk}${s.approved ? "  APPROVED" : ""}`;
+var prRouteCommand = defineCommand({
+  path: ["pr", "route"],
+  summary: "Route a pull request by risk: blocked, fast path, standard or approver",
+  description: "Reads the change between --base and --head in this checkout, takes the check results you pass, and asks the service for a lane. Deterministic checks come first: any check that is not passed blocks every lane (a check you do not report counts as missing). Sensitive paths (auth, billing, migrations, workflows, secrets, infrastructure) force the approver lane. Only then, and only if the team switched the review_risk decision on, a decision model labels the risk; it can raise a lane, never lower one, and never approves. A blocked pull request exits 6 and names the first blocker's next command. Pass --author-token when an agent opened the pull request, so its own approval is refused.",
+  flags: [
+    { name: "number", type: "string", required: true, value: "N", description: "The pull request number" },
+    { name: "head", type: "string", value: "REF", description: "The head commit or branch (default HEAD)" },
+    { name: "base", type: "string", value: "REF", description: "The base to compare with (default origin/main, else main)" },
+    { name: "repo", type: "string", value: "OWNER/NAME", description: "The repository name the pull request belongs to (default: the origin remote)" },
+    { name: "title", type: "string", value: "TEXT", description: "The pull request title" },
+    { name: "author", type: "string", value: "NAME", description: "The pull request author's name" },
+    { name: "author-token", type: "string", value: "TOKEN_ID", description: "The agent token that opened it, so its lineage is known to the independence check" },
+    { name: "task", type: "string", value: "TASK", description: "The task this pull request belongs to, for batching" },
+    { name: "scope", type: "string", multiple: true, value: "GLOB", description: "A claimed scope pattern, for batching; repeat for more" },
+    { name: "fork", type: "boolean", description: "The head comes from a fork" },
+    ...CHECK_FLAGS
+  ],
+  examples: ["overlane pr route --number 7 --ci passed --secret-scan passed --guardrails passed --conflict passed --review-done", "overlane pr route --number 7 --base origin/main --task task-12 --dry-run"],
+  effect: "write",
+  ...common18,
+  keywords: ["route pull request", "fast path", "risk lane", "who approves this pr", "triage pull requests", "pr risk"],
+  result: withDryRun(StoredRoute),
+  text: (d) => "route" in d ? [line2(d), ...d.route.reasons.map((r) => `  - ${r}`), `model: ${d.route.model.status} - ${d.route.model.note}`, ...d.route.nextCommand === null ? [] : [`next: ${d.route.nextCommand}`]] : [],
+  handler: async (inv) => {
+    const number4 = numberOf(inv);
+    const head = textFlag(inv, "head") ?? "HEAD";
+    let base4 = textFlag(inv, "base");
+    if (base4 === void 0) base4 = (await git4(inv.deps, ["rev-parse", "--verify", "--quiet", "origin/main"])).code === 0 ? "origin/main" : "main";
+    const critical = textFlag(inv, "critical");
+    if (critical !== void 0 && !/^\d+$/.test(critical)) throw new UsageError("--critical is a whole number");
+    const snapshot = await snapshotOf(inv, head, base4);
+    const body2 = {
+      requestId: requestId12(),
+      pull: { provider: snapshot.provider, repository: snapshot.repository, number: number4, headSha: snapshot.headSha, title: textFlag(inv, "title") ?? `Pull request ${number4}`, body: "", author: textFlag(inv, "author") ?? "unknown", fork: boolFlag(inv, "fork"), files: snapshot.files },
+      checks: { ci: checkFlag(inv, "ci"), secretScan: checkFlag(inv, "secret-scan"), guardrails: checkFlag(inv, "guardrails"), conflict: checkFlag(inv, "conflict"), criticalFindings: critical === void 0 ? 0 : Number(critical), reviewDone: boolFlag(inv, "review-done") },
+      baseRef: snapshot.baseRef,
+      ...textFlag(inv, "task") === void 0 ? {} : { taskId: textFlag(inv, "task") },
+      ...textFlag(inv, "author-token") === void 0 ? {} : { authorAgentTokenId: textFlag(inv, "author-token") },
+      ...listFlag(inv, "scope").length === 0 ? {} : { scope: listFlag(inv, "scope") }
+    };
+    if (inv.dryRun) {
+      const preview = { ...body2, pull: { ...body2.pull, files: body2.pull.files.map((f) => ({ path: f.path, additions: f.additions, deletions: f.deletions })) } };
+      return planned7(inv, "POST", prRoutingPaths.route, preview, "asks for a lane; the decision model is consulted only after the checks and only when switched on");
+    }
+    const { call: call2, tenantId, projectId } = await connected7(inv);
+    const stored = await call2(StoredRoute, "POST", prRoutingPaths.route(tenantId, projectId), body2);
+    if (stored.route.lane === "blocked") {
+      const first = stored.route.blockers[0];
+      return { data: stored, exit: EXIT.blocked, error: new CliError(`blocked: ${first?.message ?? "a check is not clean"}`, { code: first?.code ?? "checks_not_clean", exit: EXIT.blocked, ...first?.nextCommand ? { hint: first.nextCommand } : {}, quiet: true }) };
+    }
+    return { data: stored };
+  }
+});
+var Approved = external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), approvalId: external_exports.string(), replay: external_exports.boolean(), via: external_exports.string(), route: StoredRoute }).strict();
+var prApproveCommand = defineCommand({
+  path: ["pr", "approve"],
+  summary: "Approve a routed pull request as an independent agent with evidence, or as a person",
+  description: "Records an approval for the head you name. An agent's approval needs --evidence (what it checked) and --reason, and is refused when the approver is the author or shares the author's token lineage, run or lease. A person's approval needs neither. The approver lane accepts only the configured approver (a person on the project's list or holding an approver role). Standard and approver lanes wait for the review run. A decision model's label is never an approval. An approval is for one head: after a push, route again and approve the new head.",
+  flags: [
+    { name: "number", type: "string", required: true, value: "N", description: "The pull request number" },
+    { name: "head", type: "string", value: "REF", description: "The head commit being approved (default HEAD)" },
+    { name: "repo", type: "string", value: "OWNER/NAME", description: "The repository name (default: the origin remote)" },
+    { name: "evidence", type: "string", multiple: true, value: "TEXT", description: "What you checked; repeat for more (required for an agent)" },
+    { name: "reason", type: "string", value: "TEXT", description: "Why you approve (required for an agent)" }
+  ],
+  examples: ['overlane pr approve --number 7 --evidence "read the diff" --evidence "ran the tests" --reason "inside the task scope"'],
+  effect: "write",
+  ...common18,
+  keywords: ["approve pull request", "fast path approval", "independent review", "sign off pr"],
+  result: withDryRun(Approved),
+  text: (d) => "approvalId" in d ? [`${d.route.approved ? "APPROVED" : "recorded"}  ${d.route.repository}#${d.route.number}  via ${d.via}  ${d.approvalId}`] : [],
+  handler: async (inv) => {
+    const number4 = numberOf(inv);
+    const head = textFlag(inv, "head") ?? "HEAD";
+    const sha = await git4(inv.deps, ["rev-parse", "--verify", "--quiet", `${head}^{commit}`]);
+    if (sha.code !== 0) throw new UsageError(`${head} is not a commit in this checkout`);
+    const project = await detectProject(inv.deps);
+    const repository = textFlag(inv, "repo") ?? (project.repository === void 0 ? `overlane/${project.name.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 80) || "project"}` : `${project.repository.owner}/${project.repository.name}`);
+    const evidence = listFlag(inv, "evidence");
+    const body2 = { requestId: requestId12(), repository, number: number4, headSha: sha.stdout.trim(), approval: { evidence, reason: textFlag(inv, "reason") ?? "" } };
+    if (inv.dryRun) return planned7(inv, "POST", prRoutingPaths.approve, body2, "the service records the approval only if the independence and lane rules hold");
+    const { call: call2, tenantId, projectId } = await connected7(inv);
+    return { data: await call2(Approved, "POST", prRoutingPaths.approve(tenantId, projectId), body2) };
+  }
+});
+var Batches = external_exports.object({
+  tenantId: external_exports.string(),
+  projectId: external_exports.string(),
+  maxSize: external_exports.number().int(),
+  batches: external_exports.array(external_exports.object({ id: external_exports.string(), lane: external_exports.string(), keys: external_exports.array(external_exports.string()), reasons: external_exports.array(external_exports.string()) }).strict()),
+  unbatched: external_exports.array(external_exports.string())
+}).strict();
+var prBatchCommand = defineCommand({
+  path: ["pr", "batch"],
+  summary: "Group related routed pull requests so one reviewer looks once",
+  description: "Lists batches of routed pull requests in the same lane that share a task, overlap in claimed scope, or are stacked on one another, capped at the project's batch size. A blocked pull request never joins a batch. A batch groups attention and approves nothing: each pull request is approved at its own head.",
+  examples: ["overlane pr batch", "overlane pr batch --json"],
+  effect: "read",
+  ...common18,
+  keywords: ["batch pull requests", "group prs", "review together", "stacked prs"],
+  result: Batches,
+  text: (d) => [...d.batches.map((b) => `${b.lane.toUpperCase().padEnd(9)} ${b.keys.join(", ")}  (${b.reasons.join(", ")})`), ...d.batches.length === 0 ? ["No related pull requests to batch."] : [], ...d.unbatched.length === 0 ? [] : [`alone: ${d.unbatched.join(", ")}`]],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected7(inv);
+    return { data: await call2(Batches, "GET", prRoutingPaths.batch(tenantId, projectId)) };
+  }
+});
+var PolicyResult = external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), policy: RoutingPolicy }).strict();
+var prPolicyCommand = defineCommand({
+  path: ["pr", "policy"],
+  summary: "Show or set who approves the approver lane and how large a batch may be",
+  description: "With no flags, prints the project's routing policy. With flags, changes it: --approver names a person (a user ID) who may approve high-risk pull requests, --approver-role the roles that may (owner, admin), --allow-agent-approver lets an independent agent with evidence approve that lane too (off by default), --max-batch the largest batch. Changing it is a policy change.",
+  flags: [
+    { name: "approver", type: "string", multiple: true, value: "USER_ID", description: "A person who may approve the approver lane; repeat for more" },
+    { name: "approver-role", type: "string", multiple: true, enum: ROUTE_APPROVER_ROLES, value: "ROLE", description: "A role that may approve the approver lane; repeat for more" },
+    { name: "allow-agent-approver", type: "boolean", description: "Let an independent agent with evidence approve the approver lane" },
+    { name: "max-batch", type: "string", value: "N", description: "The largest batch, 2 to 20" }
+  ],
+  examples: ["overlane pr policy", "overlane pr policy --approver user_abc --approver-role owner"],
+  effect: "write",
+  ...common18,
+  keywords: ["who approves high risk", "approver", "routing policy", "batch size"],
+  result: withDryRun(PolicyResult),
+  text: (d) => "policy" in d ? [`approvers: ${d.policy.approverUsers.join(", ") || "(none listed)"}; roles: ${d.policy.approverRoles.join(", ") || "(none)"}; agents may approve the approver lane: ${d.policy.allowAgentApprover ? "yes" : "no"}; max batch ${d.policy.maxBatchSize}`] : [],
+  handler: async (inv) => {
+    const users = listFlag(inv, "approver");
+    const roles = listFlag(inv, "approver-role");
+    const maxBatch = textFlag(inv, "max-batch");
+    if (maxBatch !== void 0 && (!/^\d+$/.test(maxBatch) || Number(maxBatch) < 2 || Number(maxBatch) > 20)) throw new UsageError("--max-batch is a whole number from 2 to 20");
+    const changing = users.length > 0 || roles.length > 0 || maxBatch !== void 0 || inv.values["allow-agent-approver"] === true;
+    const patch = { ...users.length > 0 ? { approverUsers: users } : {}, ...roles.length > 0 ? { approverRoles: roles } : {}, ...inv.values["allow-agent-approver"] === true ? { allowAgentApprover: true } : {}, ...maxBatch === void 0 ? {} : { maxBatchSize: Number(maxBatch) } };
+    if (inv.dryRun) return planned7(inv, changing ? "PUT" : "GET", prRoutingPaths.policy, changing ? patch : void 0);
+    const { call: call2, tenantId, projectId } = await connected7(inv);
+    return { data: await call2(PolicyResult, changing ? "PUT" : "GET", prRoutingPaths.policy(tenantId, projectId), changing ? patch : void 0) };
+  }
+});
+var prCommands = [prRouteCommand, prApproveCommand, prBatchCommand, prPolicyCommand];
+
+// ../cli/src/commands/egress.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID14 } from "node:crypto";
+var common19 = { needsAuth: true, needsNetwork: true };
+var requestId13 = () => `cli-${randomUUID14()}`;
+async function connected8(inv) {
+  const project = await connectedProject(inv.deps, "egress");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned8(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "egress");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+function ruleOf(text) {
+  const [host, ports] = text.split(":");
+  const parsedPorts = ports === void 0 ? [443] : ports.split(",").map((p) => /^\d{1,5}$/.test(p) ? Number(p) : Number.NaN);
+  if (parsedPorts.some((p) => !Number.isInteger(p) || p < 1 || p > 65535)) throw new UsageError(`${text}: ports are whole numbers from 1 to 65535, for example registry.npmjs.org:443,8443`);
+  const checked2 = normaliseHost(host.replace(/^\*\./, "x."));
+  if (!checked2.ok || checked2.kind !== "name") throw new UsageError(`${host} is not a host name; an address cannot be a rule`, { hint: "overlane egress policy set --allow registry.npmjs.org" });
+  return { host: host.toLowerCase(), ports: parsedPorts };
+}
+var PolicyShow = EgressPolicyView;
+var hosts = (policy) => policy.rules.map((r) => `${r.host}${r.ports.length === 1 && r.ports[0] === 443 ? "" : `:${r.ports.join(",")}`}`);
+var egressPolicyShowCommand = defineCommand({
+  path: ["egress", "policy", "show"],
+  summary: "Show the egress allowlist: which hosts native CI and agent sandboxes may reach",
+  description: "Prints the mode (enforce denies what no rule allows; report records and allows) and every rule. The default is deny: with no rule nothing is reachable. Raw IP addresses and cloud metadata services are denied in both modes.",
+  examples: ["overlane egress policy show", "overlane egress policy show --json"],
+  effect: "read",
+  ...common19,
+  keywords: ["egress", "allowlist", "which hosts can a job reach", "network policy", "sandbox network"],
+  result: PolicyShow,
+  text: (d) => [`mode: ${d.mode}  version ${d.version}`, ...d.rules.length === 0 ? ["No rules: nothing is reachable (default deny)."] : hosts(d).map((h) => `allow ${h}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    return { data: await call2(PolicyShow, "GET", egressPaths.policy(tenantId, projectId)) };
+  }
+});
+var egressPolicySetCommand = defineCommand({
+  path: ["egress", "policy", "set"],
+  summary: "Set the egress allowlist and its mode",
+  description: "Replaces the rules with the --allow hosts, or with --add keeps the current rules and adds to them. A rule is a host name such as registry.npmjs.org, optionally with ports (registry.npmjs.org:443,8443), or a wildcard such as *.example.com, which matches any subdomain and never the apex. A wildcard over a top-level or shared-hosting domain is refused. Use --mode report first to learn what a job needs: it records and allows, then switch to enforce. Changing the allowlist is a policy change.",
+  flags: [
+    { name: "allow", type: "string", multiple: true, value: "HOST[:PORTS]", description: "A host the sandbox may reach; repeat for more" },
+    { name: "add", type: "boolean", description: "Keep the current rules and add these" },
+    { name: "mode", type: "string", enum: ["enforce", "report"], value: "MODE", description: "enforce (default) or report" }
+  ],
+  examples: ["overlane egress policy set --allow registry.npmjs.org --allow api.github.com", "overlane egress policy set --add --allow '*.example.com' --mode report"],
+  effect: "write",
+  ...common19,
+  keywords: ["allow host", "egress rule", "add to allowlist", "open a host"],
+  result: withDryRun(PolicyShow),
+  text: (d) => "rules" in d ? [`mode: ${d.mode}  version ${d.version}`, ...hosts(d).map((h) => `allow ${h}`)] : [],
+  handler: async (inv) => {
+    const rules = listFlag(inv, "allow").map(ruleOf);
+    const mode = textFlag(inv, "mode");
+    const add = boolFlag(inv, "add");
+    if (rules.length === 0 && mode === void 0) throw new UsageError("give --allow HOST, or --mode", { hint: "overlane egress policy set --allow registry.npmjs.org" });
+    if (inv.dryRun) return planned8(inv, "PUT", egressPaths.policy, { mode: mode ?? "enforce", rules, ...add ? { merge: "adds to the current rules" } : {} }, "changing the allowlist is a policy change");
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    const current2 = await call2(PolicyShow, "GET", egressPaths.policy(tenantId, projectId));
+    const merged = add || rules.length === 0 ? [...current2.rules, ...rules] : rules;
+    const seen = /* @__PURE__ */ new Set();
+    const unique = merged.filter((rule) => {
+      const key = `${rule.host}:${rule.ports.join(",")}`;
+      return seen.has(key) ? false : (seen.add(key), true);
+    });
+    return { data: await call2(PolicyShow, "PUT", egressPaths.policy(tenantId, projectId), { mode: mode ?? current2.mode, rules: unique, expectedVersion: current2.version }) };
+  }
+});
+var Check = EgressDecision.extend({ eventId: external_exports.string() }).passthrough();
+var egressCheckCommand = defineCommand({
+  path: ["egress", "check"],
+  summary: "Ask whether a host may be reached; exits 6 when the allowlist denies it",
+  description: "Evaluates a host and port against the project's policy and records the answer. Raw IP addresses in any notation, cloud metadata services and internal names are denied whatever the rules say. In report mode a host with no rule is allowed and marked reported.",
+  flags: [
+    { name: "host", type: "string", required: true, value: "HOST", description: "The host name to check" },
+    { name: "port", type: "string", value: "N", description: "The port (default 443)" },
+    { name: "task", type: "string", value: "TASK", description: "The task asking, for the record" }
+  ],
+  examples: ["overlane egress check --host registry.npmjs.org", "overlane egress check --host 169.254.169.254"],
+  effect: "write",
+  ...common19,
+  keywords: ["can the sandbox reach", "is this host allowed", "egress check"],
+  result: withDryRun(Check),
+  text: (d) => "outcome" in d ? [`${d.outcome.toUpperCase()}  ${d.host}:${d.port}  ${d.message}`] : [],
+  handler: async (inv) => {
+    const host = textFlag(inv, "host");
+    if (host === void 0) throw new UsageError("check needs --host", { hint: "overlane egress check --host registry.npmjs.org" });
+    const port = textFlag(inv, "port");
+    if (port !== void 0 && !/^\d{1,5}$/.test(port)) throw new UsageError("--port is a whole number");
+    const body2 = { host, ...port === void 0 ? {} : { port: Number(port) }, ...textFlag(inv, "task") === void 0 ? {} : { taskId: textFlag(inv, "task") } };
+    if (inv.dryRun) return planned8(inv, "POST", egressPaths.evaluate, body2, "records the answer; nothing is connected to");
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    const decision = await call2(Check, "POST", egressPaths.evaluate(tenantId, projectId), body2);
+    return decision.allowed ? { data: decision } : { data: decision, exit: EXIT.blocked, error: new CliError(decision.message, { code: `egress_${decision.reason}`, exit: EXIT.blocked, hint: "overlane egress policy set --add --allow HOST", quiet: true }) };
+  }
+});
+var Events = external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), events: external_exports.array(EgressEvent) }).strict();
+var egressEventsCommand = defineCommand({
+  path: ["egress", "events"],
+  summary: "List recent egress decisions: host, port and outcome, never a path or a body",
+  description: "Newest first. Each row is a host and port, whether it was allowed, denied or reported, why, and which task and run asked.",
+  flags: [
+    { name: "outcome", type: "string", enum: ["allowed", "denied", "reported"], value: "OUTCOME", description: "Only this outcome" },
+    { name: "task", type: "string", value: "TASK", description: "Only this task" }
+  ],
+  examples: ["overlane egress events --outcome denied"],
+  effect: "read",
+  ...common19,
+  keywords: ["what did the sandbox try to reach", "denied requests", "egress log"],
+  result: Events,
+  text: (d) => d.events.length === 0 ? ["No egress decisions recorded."] : d.events.map((e2) => `${e2.at}  ${e2.outcome.padEnd(8)} ${e2.host}:${e2.port}  ${e2.reason}${e2.taskId === null ? "" : `  task ${e2.taskId}`}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    const params = new URLSearchParams();
+    if (textFlag(inv, "outcome") !== void 0) params.set("outcome", textFlag(inv, "outcome"));
+    if (textFlag(inv, "task") !== void 0) params.set("task", textFlag(inv, "task"));
+    const query = params.toString();
+    return { data: await call2(Events, "GET", `${egressPaths.events(tenantId, projectId)}${query === "" ? "" : `?${query}`}`) };
+  }
+});
+var GrantResult = TaskGrant.extend({ replay: external_exports.boolean().optional(), reasons: external_exports.array(external_exports.string()).optional() }).strict();
+var Grants = external_exports.object({ tenantId: external_exports.string(), projectId: external_exports.string(), grants: external_exports.array(TaskGrant) }).strict();
+var egressGrantCommand = defineCommand({
+  path: ["egress", "grant"],
+  summary: "Grant one task a credential for named hosts; the value never reaches the agent",
+  description: "Creates a grant bound to this task, a host list and a lifetime (default 15 minutes). The grant names a secret; the egress proxy attaches its value to requests for the granted hosts, and the value is never returned to you, written to a log or put in the workspace. The hosts must already be on the allowlist. A grant for one task, named hosts and at most an hour is an ordinary action. A wider grant (--scope project or team), a longer one, or a wildcard of hosts is class secrets: an agent needs an independent agent's approval (set OVERLANE_APPROVAL to the ID the refusal names), a person does not.",
+  flags: [
+    { name: "task", type: "string", value: "TASK", description: "The task the grant belongs to (required for a task grant)" },
+    { name: "host", type: "string", multiple: true, required: true, value: "HOST", description: "A host the credential may be attached for; repeat for more" },
+    { name: "secret", type: "string", required: true, value: "NAME", description: "The secret's name in the project's secret store, such as NPM_TOKEN" },
+    { name: "minutes", type: "string", value: "N", description: "Lifetime in minutes, 1 to 1440 (default 15)" },
+    { name: "scope", type: "string", enum: ["task", "project", "team"], value: "SCOPE", description: "task (default), project or team; the wider two are class secrets" },
+    { name: "header", type: "string", value: "NAME", description: "Attach as this header instead of Authorization: Bearer" }
+  ],
+  examples: ["overlane egress grant --task task-12 --host api.github.com --secret GITHUB_TOKEN", "overlane egress grant --task task-12 --host registry.npmjs.org --secret NPM_TOKEN --minutes 30"],
+  effect: "write",
+  ...common19,
+  keywords: ["task credential", "scoped secret", "give the agent a token", "credential broker", "grant access to secret"],
+  result: withDryRun(GrantResult),
+  text: (d) => "secretName" in d ? [`grant ${d.id}  ${d.scope}${d.taskId === null ? "" : ` ${d.taskId}`}  ${d.secretName} for ${d.hosts.join(", ")}  until ${d.expiresAt}`, ...d.class === "secrets" ? ["class: secrets (approved)"] : [], "The value is attached by the egress proxy and is never shown."] : [],
+  handler: async (inv) => {
+    const scope = textFlag(inv, "scope") ?? "task";
+    const task = textFlag(inv, "task");
+    if (scope === "task" && task === void 0) throw new UsageError("a task grant names its task", { hint: "overlane egress grant --task TASK --host api.github.com --secret GITHUB_TOKEN" });
+    const minutes = textFlag(inv, "minutes");
+    if (minutes !== void 0 && (!/^\d+$/.test(minutes) || Number(minutes) < 1 || Number(minutes) > 1440)) throw new UsageError("--minutes is a whole number from 1 to 1440");
+    const header = textFlag(inv, "header");
+    const body2 = {
+      requestId: requestId13(),
+      scope,
+      ...scope === "task" ? { taskId: task } : {},
+      hosts: listFlag(inv, "host"),
+      secretName: textFlag(inv, "secret"),
+      ...header === void 0 ? {} : { attach: { kind: "header", name: header.toLowerCase() } },
+      ...minutes === void 0 ? {} : { ttlSeconds: Number(minutes) * 60 }
+    };
+    if (inv.dryRun) return planned8(inv, "POST", egressPaths.grants, body2, "the secret's value is not part of the request or the answer");
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    return { data: await call2(GrantResult, "POST", egressPaths.grants(tenantId, projectId), body2) };
+  }
+});
+var egressGrantsCommand = defineCommand({
+  path: ["egress", "grants"],
+  summary: "List the project's credential grants and whether each is still active",
+  description: "Lists grants newest first: the task, hosts, the secret's name, the lifetime and how often the proxy used it. No value is ever shown.",
+  flags: [
+    { name: "task", type: "string", value: "TASK", description: "Only this task's grants" },
+    { name: "status", type: "string", enum: ["active", "expired", "revoked"], value: "STATUS", description: "Only grants in this state" }
+  ],
+  examples: ["overlane egress grants --status active"],
+  effect: "read",
+  ...common19,
+  keywords: ["list grants", "which secrets can the task use", "active credentials"],
+  result: Grants,
+  text: (d) => d.grants.length === 0 ? ["No grants."] : d.grants.map((g) => `${g.id}  ${g.status.padEnd(7)} ${g.scope}${g.taskId === null ? "" : ` ${g.taskId}`}  ${g.secretName} -> ${g.hosts.join(", ")}  used ${g.uses}x  until ${g.expiresAt}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    const params = new URLSearchParams();
+    if (textFlag(inv, "task") !== void 0) params.set("task", textFlag(inv, "task"));
+    if (textFlag(inv, "status") !== void 0) params.set("status", textFlag(inv, "status"));
+    const query = params.toString();
+    return { data: await call2(Grants, "GET", `${egressPaths.grants(tenantId, projectId)}${query === "" ? "" : `?${query}`}`) };
+  }
+});
+var egressRevokeCommand = defineCommand({
+  path: ["egress", "revoke"],
+  summary: "Revoke a credential grant at once",
+  description: "Ends a grant: the proxy stops attaching its credential on the next request. Revoking is always allowed and needs no approval.",
+  flags: [{ name: "grant", type: "string", required: true, value: "ID", description: "The grant to revoke" }],
+  examples: ["overlane egress revoke --grant grt_abc123"],
+  effect: "write",
+  ...common19,
+  keywords: ["revoke grant", "take back credential", "end task access"],
+  result: withDryRun(TaskGrant),
+  text: (d) => "secretName" in d ? [`grant ${d.id} is ${d.status}`] : [],
+  handler: async (inv) => {
+    const id2 = textFlag(inv, "grant");
+    if (id2 === void 0) throw new UsageError("revoke needs --grant", { hint: "overlane egress grants" });
+    if (inv.dryRun) return planned8(inv, "POST", (t, p) => egressPaths.revoke(t, p, id2), {});
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    return { data: await call2(TaskGrant, "POST", egressPaths.revoke(tenantId, projectId, id2), {}) };
+  }
+});
+var egressScanCommand = defineCommand({
+  path: ["egress", "scan"],
+  summary: "Check this workspace's file list for files that usually hold a credential",
+  description: "Sends the names of the files git tracks or would add (never their contents) and reports the ones that usually hold a credential: .env files, .npmrc, private keys, cloud credential files. Exits 6 when any is found. Scanning a job's logs for a granted credential's value happens inside the runner, not here.",
+  examples: ["overlane egress scan"],
+  effect: "read",
+  ...common19,
+  keywords: ["credentials in workspace", "leak check", "secret files", "scan for credentials"],
+  result: LeakScanResult,
+  text: (d) => d.clean ? ["No credential files found."] : d.findings.map((f) => `${f.kind}  ${f.place}${f.line === null ? "" : `:${f.line}`}  ${f.rule}`),
+  handler: async (inv) => {
+    const listed = await inv.deps.exec("git", ["ls-files", "-co", "--exclude-standard", "-z"], { cwd: inv.deps.paths.cwd });
+    if (listed.code !== 0) throw new UsageError("could not list the workspace files; run this inside a git repository");
+    const files = listed.stdout.split("\0").filter((name2) => name2 !== "").slice(0, 2e4);
+    const { call: call2, tenantId, projectId } = await connected8(inv);
+    const result = await call2(LeakScanResult, "POST", egressPaths.leakScan(tenantId, projectId), { files });
+    return result.clean ? { data: result } : { data: result, exit: EXIT.blocked, error: new CliError(`${result.findings.length} file${result.findings.length === 1 ? "" : "s"} that usually hold a credential`, { code: "credential_files", exit: EXIT.blocked, hint: "keep them out of the workspace and the repository; grant the task a credential instead: overlane egress grant --help", quiet: true }) };
+  }
+});
+var egressCommands = [egressPolicyShowCommand, egressPolicySetCommand, egressCheckCommand, egressEventsCommand, egressGrantCommand, egressGrantsCommand, egressRevokeCommand, egressScanCommand];
+
 // ../cli/src/commands/index.ts
 function coreCommands() {
   return [
@@ -66535,6 +68386,11 @@ function coreCommands() {
     ...reviewCommands,
     ...guardCommands,
     ...billingCommands,
+    ...claimCommands,
+    ...budgetCommands,
+    ...rulesCommands,
+    ...prCommands,
+    ...egressCommands,
     ...repoCommands,
     ...ciCommands,
     ...deployCommands
@@ -66690,10 +68546,10 @@ async function runCli(argv, deps, options) {
     const parsed = spec.style === "passthrough" ? { values: {}, positionals: [] } : parseFor(spec, rest);
     const safety = spec.style === "passthrough" ? safetyFlags(rest) : { dryRun: parsed.values["dry-run"] === true, force: parsed.values["force"] === true };
     if (spec.effect === "destructive" && !safety.dryRun && !safety.force && !deps.isTTY) {
-      const line2 = ["overlane", ...globals.tokens, "--force"].map(quote2).join(" ");
+      const line3 = ["overlane", ...globals.tokens, "--force"].map(quote2).join(" ");
       throw new UsageError(`overlane ${commandName(spec)} is destructive and there is no terminal to confirm on; pass --force to proceed, or --dry-run to preview`, {
         code: "force_required",
-        hint: line2
+        hint: line3
       });
     }
     const invocation = {
@@ -66758,37 +68614,37 @@ init_src2();
 
 // src/data-dir.ts
 import { homedir } from "node:os";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function dataDir(env = process.env, home = homedir()) {
   const override = env["MVRX_DATA_DIR"];
   if (override !== void 0 && override !== "") return override;
-  const base4 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join28(home, "Library", "Application Support") : join28(home, ".local", "share"));
-  return join28(base4, "mvrx-harness");
+  const base4 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join29(home, "Library", "Application Support") : join29(home, ".local", "share"));
+  return join29(base4, "mvrx-harness");
 }
 function marketplaceRoot(env = process.env, home = homedir()) {
-  return join28(dataDir(env, home), "marketplace");
+  return join29(dataDir(env, home), "marketplace");
 }
 
 // src/plugin.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import { join as join30 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { join as join31 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/marketplace.ts
 init_src();
 import { createHash as createHash7 } from "node:crypto";
-import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync12, renameSync as renameSync6, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname10, join as join29, relative as relative2, sep } from "node:path";
+import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync13, renameSync as renameSync7, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname11, join as join30, relative as relative2, sep } from "node:path";
 var CLIENT_DIRS = ["claude", "codex"];
 var EMBEDDED_MANIFEST = "release-manifest.json";
-var INSTALLED_MANIFEST = join29(".release", "manifest.json");
+var INSTALLED_MANIFEST = join30(".release", "manifest.json");
 var MarketplaceError = class extends Error {
 };
 function loadEmbedded(packageRoot2) {
-  const dir = join29(packageRoot2, "plugins");
-  const path = join29(dir, EMBEDDED_MANIFEST);
-  if (!existsSync7(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
-  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync12(path, "utf8")));
+  const dir = join30(packageRoot2, "plugins");
+  const path = join30(dir, EMBEDDED_MANIFEST);
+  if (!existsSync8(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
+  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync13(path, "utf8")));
   if (!parsed.success) throw new MarketplaceError(`the embedded release manifest is invalid: ${parsed.error.message}`);
   return { dir, manifest: parsed.data };
 }
@@ -66796,10 +68652,10 @@ function sha2562(data) {
   return `sha256:${createHash7("sha256").update(data).digest("hex")}`;
 }
 function listFiles(root, dir = root) {
-  if (!existsSync7(dir)) return [];
+  if (!existsSync8(dir)) return [];
   const out2 = [];
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-    const full = join29(dir, entry.name);
+    const full = join30(dir, entry.name);
     if (entry.isDirectory()) out2.push(...listFiles(root, full));
     else out2.push(relative2(root, full).split(sep).join("/"));
   }
@@ -66811,23 +68667,23 @@ async function verifyTree(treeRoot, manifest) {
   if (recomputed !== manifest.digest) problems.push(`manifest digest ${manifest.digest} does not match its file list (${recomputed})`);
   const listed = new Set(manifest.files.map((file2) => file2.path));
   for (const file2 of manifest.files) {
-    const path = join29(treeRoot, file2.path);
-    if (!existsSync7(path)) {
+    const path = join30(treeRoot, file2.path);
+    if (!existsSync8(path)) {
       problems.push(`missing: ${file2.path}`);
       continue;
     }
-    if (sha2562(readFileSync12(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
+    if (sha2562(readFileSync13(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
   }
   for (const client of CLIENT_DIRS) {
-    for (const found of listFiles(join29(treeRoot, client))) {
+    for (const found of listFiles(join30(treeRoot, client))) {
       if (!listed.has(`${client}/${found}`)) problems.push(`unlisted: ${client}/${found}`);
     }
   }
   return problems;
 }
-function readInstalledManifest(target) {
+function readInstalledManifest(target2) {
   try {
-    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync12(join29(target, INSTALLED_MANIFEST), "utf8")));
+    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync13(join30(target2, INSTALLED_MANIFEST), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -66845,30 +68701,30 @@ function isNewer(a, b) {
   }
   return false;
 }
-async function syncMarketplace(embedded, target) {
+async function syncMarketplace(embedded, target2) {
   const before = await verifyTree(embedded.dir, embedded.manifest);
   if (before.length > 0) throw new MarketplaceError(`the embedded plugin files do not match the release manifest; refusing to install:
   ${before.join("\n  ")}`);
-  const staging = `${target}.new-${process.pid}`;
-  const previous = `${target}.old-${process.pid}`;
+  const staging = `${target2}.new-${process.pid}`;
+  const previous = `${target2}.old-${process.pid}`;
   rmSync4(staging, { recursive: true, force: true });
-  mkdirSync9(staging, { recursive: true });
+  mkdirSync10(staging, { recursive: true });
   try {
     for (const client of CLIENT_DIRS) {
-      if (existsSync7(join29(embedded.dir, client))) cpSync(join29(embedded.dir, client), join29(staging, client), { recursive: true });
+      if (existsSync8(join30(embedded.dir, client))) cpSync(join30(embedded.dir, client), join30(staging, client), { recursive: true });
     }
-    mkdirSync9(join29(staging, ".release"), { recursive: true });
-    writeFileSync8(join29(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
+    mkdirSync10(join30(staging, ".release"), { recursive: true });
+    writeFileSync9(join30(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
 `);
     const after = await verifyTree(staging, embedded.manifest);
     if (after.length > 0) throw new MarketplaceError(`the copied plugin files do not match the release manifest:
   ${after.join("\n  ")}`);
-    mkdirSync9(dirname10(target), { recursive: true });
-    if (existsSync7(target)) renameSync6(target, previous);
+    mkdirSync10(dirname11(target2), { recursive: true });
+    if (existsSync8(target2)) renameSync7(target2, previous);
     try {
-      renameSync6(staging, target);
+      renameSync7(staging, target2);
     } catch (error62) {
-      if (existsSync7(previous)) renameSync6(previous, target);
+      if (existsSync8(previous)) renameSync7(previous, target2);
       throw error62;
     }
     rmSync4(previous, { recursive: true, force: true });
@@ -66876,11 +68732,11 @@ async function syncMarketplace(embedded, target) {
     rmSync4(staging, { recursive: true, force: true });
   }
 }
-async function ensureMarketplace(embedded, target) {
-  const installed = readInstalledManifest(target);
-  const present = existsSync7(target) && statSync2(target).isDirectory();
+async function ensureMarketplace(embedded, target2) {
+  const installed = readInstalledManifest(target2);
+  const present = existsSync8(target2) && statSync2(target2).isDirectory();
   if (installed !== null && present && !isNewer(embedded.manifest.version, installed.version)) return false;
-  await syncMarketplace(embedded, target);
+  await syncMarketplace(embedded, target2);
   return true;
 }
 
@@ -66890,8 +68746,8 @@ var PLUGIN_USAGE = `  overlane plugin install [--scope project|user] [--client c
 var PluginUsageError = class extends Error {
 };
 function readNames(treeRoot, client) {
-  const file2 = client === "claude" ? join30(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join30(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
-  const parsed = JSON.parse(readFileSync13(file2, "utf8"));
+  const file2 = client === "claude" ? join31(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join31(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
+  const parsed = JSON.parse(readFileSync14(file2, "utf8"));
   const record3 = parsed;
   const plugin = record3.plugins?.[0]?.name;
   if (typeof record3.name !== "string" || typeof plugin !== "string") throw new MarketplaceError(`${file2} names no marketplace or plugin`);
@@ -66905,7 +68761,7 @@ async function step(deps, program, args2, cwd) {
 `);
   const result = await deps.exec(program, args2, { cwd });
   const text = `${result.stdout}${result.stderr}`.trim();
-  if (text !== "") deps.stdout(`${text.split("\n").map((line2) => `    ${line2}`).join("\n")}
+  if (text !== "") deps.stdout(`${text.split("\n").map((line3) => `    ${line3}`).join("\n")}
 `);
   return result.code === 0;
 }
@@ -66937,7 +68793,7 @@ ${PLUGIN_USAGE}`);
       const key = `${names.plugin}@${names.marketplace}`;
       if (!await available(deps, client)) {
         if (explicit !== void 0) {
-          deps.stderr(`overlane: \`${client}\` was not found on PATH; the marketplace is at ${join30(root, client)}
+          deps.stderr(`overlane: \`${client}\` was not found on PATH; the marketplace is at ${join31(root, client)}
 `);
           failed = true;
         } else {
@@ -66949,7 +68805,7 @@ ${PLUGIN_USAGE}`);
       ranAny = true;
       deps.stdout(`${client}:
 `);
-      const dir = join30(root, client);
+      const dir = join31(root, client);
       const steps = client === "claude" ? [
         ["claude", ["plugin", "marketplace", "add", dir, "--scope", scope]],
         ["claude", ["plugin", "marketplace", "update", names.marketplace]],
@@ -67012,7 +68868,7 @@ async function indexRun(sub, rest, env) {
   const args2 = [sub, ...rest.filter((token) => token !== "--dry-run" && token !== "--force")];
   const out2 = [];
   const err2 = [];
-  const code2 = await runCli2(args2, env, (line2) => out2.push(line2), (line2) => err2.push(line2));
+  const code2 = await runCli2(args2, env, (line3) => out2.push(line3), (line3) => err2.push(line3));
   if (code2 === 0) return { data: { ok: true, message: out2.join("\n") } };
   const message = err2.join("\n").split("\n")[0] ?? "the indexer failed";
   if (code2 === 2) throw new UsageError(message, { hint: `overlane index ${sub} --help` });
@@ -67117,7 +68973,7 @@ var packageCommands = [indexBuildCommand, indexUploadCommand, shimCommand, plugi
 // src/deps.ts
 import { execFile as execFile4, spawn } from "node:child_process";
 import { homedir as homedir3 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 import { createInterface } from "node:readline/promises";
 function exec(command, args2, options) {
   return new Promise((resolveResult) => {
@@ -67163,8 +69019,8 @@ async function confirm(question) {
   }
 }
 function configDir2(env) {
-  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join33(homedir3(), ".config");
-  return join33(base4, "mvrx-harness");
+  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join34(homedir3(), ".config");
+  return join34(base4, "mvrx-harness");
 }
 function createDeps2(env = process.env) {
   return {