overlane 0.1.137 → 0.1.138

package/dist/overlane.mjs

@@ -4545,7 +4545,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve16) {
+function isRecursive(inst, stack, resolve17) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4555,7 +4555,7 @@ function isRecursive(inst, stack, resolve16) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve16);
+      const answer = isRecursive(child, stack, resolve17);
       if (answer > result)
         result = answer;
     }
@@ -4566,7 +4566,7 @@ function isRecursive(inst, stack, resolve16) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve16) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve17) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4630,7 +4630,7 @@ function isRecursive(inst, stack, resolve16) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve16 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve17 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -4732,14 +4732,14 @@ var init_memoizer = __esm({
         var _a3;
         (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
         inst._zod.deferred.push(() => {
-          const base4 = inst._zod.parse;
+          const base5 = inst._zod.parse;
           const wrapped = (payload, ctx) => {
             if (ctx.direction !== "backward" && isBackEdge(ctx, payload.value))
               throw new $ZodCyclicError();
-            return base4(payload, ctx);
+            return base5(payload, ctx);
           };
           inst._zod.parse = wrapped;
-          if (inst._zod.run === base4)
+          if (inst._zod.run === base5)
             inst._zod.run = wrapped;
         });
       },
@@ -4751,15 +4751,15 @@ var init_memoizer = __esm({
         let lastBucket;
         (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
         inst._zod.deferred.push(() => {
-          const base4 = inst._zod.parse;
+          const base5 = inst._zod.parse;
           const wrapped = (payload, ctx) => {
             if (isRecursiveInst === void 0) {
               const walked = isRecursive(inst, /* @__PURE__ */ new Set(), false);
               if (walked === NONE) {
-                inst._zod.parse = base4;
+                inst._zod.parse = base5;
                 if (inst._zod.run === wrapped)
-                  inst._zod.run = base4;
-                return base4(payload, ctx);
+                  inst._zod.run = base5;
+                return base5(payload, ctx);
               }
               if (walked === PROVEN || rechecked)
                 isRecursiveInst = true;
@@ -4768,7 +4768,7 @@ var init_memoizer = __esm({
             }
             const input2 = payload.value;
             if (!isRef(input2))
-              return base4(payload, ctx);
+              return base5(payload, ctx);
             let state = ctx[STATE];
             if (!state) {
               state = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
@@ -4797,7 +4797,7 @@ var init_memoizer = __esm({
             }
             handoff = bucket;
             const depth = open.length;
-            const result = base4(payload, ctx);
+            const result = base5(payload, ctx);
             handoff = void 0;
             const entry = open.length > depth ? open.pop() : void 0;
             if (result instanceof Promise) {
@@ -4812,7 +4812,7 @@ var init_memoizer = __esm({
             return result;
           };
           inst._zod.parse = wrapped;
-          if (inst._zod.run === base4)
+          if (inst._zod.run === base5)
             inst._zod.run = wrapped;
         });
       }
@@ -22552,6 +22552,27 @@ function chainAuditEvent(prevHash, body2) {
   const previous = prevHash ?? AUDIT_GENESIS_HASH;
   return AuditEvent.parse({ ...body2, prevHash: previous, hash: auditHash(previous, body2) });
 }
+function bodyOf(event) {
+  const { prevHash: _p, hash: _h, ...body2 } = event;
+  return body2;
+}
+function verifyAuditChain(tenantId, events, start2 = { prevHash: AUDIT_GENESIS_HASH, seq: 0 }) {
+  let prev = start2.prevHash;
+  let seq = start2.seq;
+  let checked2 = 0;
+  for (const event of events) {
+    const fail = (reason) => ({ tenantId, ok: false, checked: checked2, head: checked2 === 0 ? null : prev, brokenAt: event.seq > 0 ? event.seq : seq + 1, reason });
+    if (event.tenantId !== tenantId) return fail("wrong_tenant");
+    if (event.seq !== seq + 1) return fail("bad_sequence");
+    if (event.prevHash !== prev) return fail("bad_link");
+    if (AUDIT_ACTIONS[event.action] !== event.category) return fail("bad_category");
+    if (auditHash(prev, bodyOf(event)) !== event.hash) return fail("bad_hash");
+    prev = event.hash;
+    seq = event.seq;
+    checked2 += 1;
+  }
+  return { tenantId, ok: true, checked: checked2, head: checked2 === 0 && start2.seq === 0 ? null : prev };
+}
 var AUDIT_CATEGORIES, AuditCategory, AUDIT_ACTIONS, AUDIT_ACTION_NAMES, AuditActionName, AUDIT_RESULTS, AuditResult, AuditPrincipalType, AuditTarget, Hash, AUDIT_GENESIS_HASH, AuditEventBody, AuditEvent, AuditList, AuditVerification, K, FIXTURE_AT, fixtureBodies, AUDIT_FIXTURE;
 var init_audit = __esm({
   "../contracts/src/audit.ts"() {
@@ -22583,7 +22604,26 @@ var init_audit = __esm({
       "bot.revoked": "policy",
       "bot.key_rotated": "policy",
       "token.created": "token",
-      "token.revoked": "token"
+      "token.revoked": "token",
+      // MS-B6 enterprise (additive)
+      "sso.portal_link_issued": "admin",
+      "directory.synced": "admin",
+      "group_mapping.updated": "admin",
+      "audit.exported": "admin",
+      "siem_target.created": "policy",
+      "siem_target.deleted": "policy",
+      "residency.pinned": "policy",
+      "residency.migration_requested": "policy",
+      "byok.key_added": "token",
+      "byok.key_tested": "token",
+      "byok.key_rotated": "token",
+      "byok.key_revoked": "token",
+      "retention.updated": "policy",
+      "retention.purged": "policy",
+      "data.exported": "admin",
+      "data.deleted": "admin",
+      "restore.drill_run": "admin",
+      "mcp_allowlist.updated": "policy"
     };
     AUDIT_ACTION_NAMES = Object.keys(AUDIT_ACTIONS);
     AuditActionName = external_exports.enum(Object.keys(AUDIT_ACTIONS));
@@ -25646,7 +25686,39 @@ var init_route_commands = __esm({
       "webhooks.delete": c("webhook delete"),
       "webhooks.rotate": c("webhook rotate"),
       "webhooks.test": c("webhook test"),
-      "webhooks.deliveries": c("webhook deliveries")
+      "webhooks.deliveries": c("webhook deliveries"),
+      // Enterprise (MS-B6)
+      "enterprise.entitlements": c("enterprise status"),
+      "enterprise.identity.get": c("enterprise sso show"),
+      "enterprise.identity.portal-link": c("enterprise sso link"),
+      "enterprise.identity.test": c("enterprise sso test"),
+      "enterprise.identity.sync": c("enterprise sso sync"),
+      "enterprise.identity.mappings.get": c("enterprise sso show"),
+      "enterprise.identity.mappings.put": c("enterprise sso groups set"),
+      "enterprise.audit-exports.create": c("enterprise audit export"),
+      "enterprise.streams.list": c("enterprise audit stream list"),
+      "enterprise.streams.create": c("enterprise audit stream add"),
+      "enterprise.streams.delete": c("enterprise audit stream remove"),
+      "enterprise.streams.run": c("enterprise audit stream run"),
+      "enterprise.residency.get": c("enterprise region show"),
+      "enterprise.residency.put": c("enterprise region set"),
+      "enterprise.residency.migrate": c("enterprise region set"),
+      "enterprise.residency.stores": c("enterprise region show"),
+      "enterprise.byok.list": c("enterprise keys list"),
+      "enterprise.byok.create": c("enterprise keys add"),
+      "enterprise.byok.revoke": c("enterprise keys revoke"),
+      "enterprise.byok.test": c("enterprise keys test"),
+      "enterprise.byok.rotate": c("enterprise keys rotate"),
+      "enterprise.retention.get": c("enterprise retention show"),
+      "enterprise.retention.put": c("enterprise retention set"),
+      "enterprise.retention.purge": c("enterprise retention purge"),
+      "enterprise.retention.reports": c("enterprise retention reports"),
+      "enterprise.data.export": c("enterprise data export"),
+      "enterprise.data.delete": c("enterprise data delete"),
+      "enterprise.backups.drill": c("enterprise backups drill"),
+      "enterprise.mcp-allowlist.get": c("enterprise mcp-allowlist show"),
+      "enterprise.mcp-allowlist.put": c("enterprise mcp-allowlist set"),
+      "enterprise.evidence-pack": c("enterprise evidence-pack")
     };
   }
 });
@@ -26027,49 +26099,49 @@ function describeLine(text) {
   return clean2.length > 80 ? `${clean2.slice(0, 77)}...` : clean2;
 }
 function inspectRegionTarget(target2, fileText, source) {
-  const base4 = { id: target2.id, path: target2.path };
-  if (fileText === null) return { ...base4, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
+  const base5 = { id: target2.id, path: target2.path };
+  if (fileText === null) return { ...base5, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
   const scan = scanRegion(fileText);
-  if (scan.kind === "damaged") return { ...base4, state: "damaged", detail: `${target2.path}: ${scan.problem}; fix the markers by hand, then run sync`, syncable: false };
-  if (scan.kind === "none") return { ...base4, state: "unmanaged", detail: `${target2.path} has no managed region; sync appends one and keeps every existing line`, syncable: true };
+  if (scan.kind === "damaged") return { ...base5, state: "damaged", detail: `${target2.path}: ${scan.problem}; fix the markers by hand, then run sync`, syncable: false };
+  if (scan.kind === "none") return { ...base5, state: "unmanaged", detail: `${target2.path} has no managed region; sync appends one and keeps every existing line`, syncable: true };
   const { region } = scan;
   if (digestOf(region.body) !== region.digest) {
     const expected = regionBody(source.text);
     const diff = firstDifference(region.body, region.revision === source.revision ? expected : region.body);
     const where2 = region.revision === source.revision ? `line ${diff.line} of the region` : "the region";
     return {
-      ...base4,
+      ...base5,
       state: "edited",
       detail: `${target2.path}: ${where2} was edited by hand${region.revision === source.revision ? ` (found "${describeLine(diff.found)}", the source says "${describeLine(diff.expected)}")` : ""}; move the change into ${RULES_SOURCE_PATH}, or run sync --overwrite-edits to replace it`,
       ...region.revision === source.revision ? { firstDifference: diff } : {},
       syncable: false
     };
   }
-  if (region.revision !== source.revision) return { ...base4, state: "stale", detail: `${target2.path} was written from revision ${region.revision}; the source is ${source.revision}; sync updates it`, syncable: true };
-  return { ...base4, state: "in_sync", detail: `${target2.path} matches revision ${source.revision}`, syncable: true };
+  if (region.revision !== source.revision) return { ...base5, state: "stale", detail: `${target2.path} was written from revision ${region.revision}; the source is ${source.revision}; sync updates it`, syncable: true };
+  return { ...base5, state: "in_sync", detail: `${target2.path} matches revision ${source.revision}`, syncable: true };
 }
 function planRegionSync(target2, fileText, source, force) {
   const report2 = inspectRegionTarget(target2, fileText, source);
   const region = renderRegion(source.text);
-  const base4 = { id: target2.id, path: target2.path };
+  const base5 = { id: target2.id, path: target2.path };
   switch (report2.state) {
     case "in_sync":
-      return { ...base4, action: "none", next: null, reason: report2.detail };
+      return { ...base5, action: "none", next: null, reason: report2.detail };
     case "missing":
-      return { ...base4, action: "create", next: `${target2.preamble}${region}`, reason: "created" };
+      return { ...base5, action: "create", next: `${target2.preamble}${region}`, reason: "created" };
     case "unmanaged": {
       const text = normaliseText(fileText);
       const joined = text === "" ? "" : text.endsWith("\n\n") ? text : text.endsWith("\n") ? `${text}
 ` : `${text}
 
 `;
-      return { ...base4, action: "append", next: `${joined}${region}`, reason: "appended a managed region at the end; every existing line is kept" };
+      return { ...base5, action: "append", next: `${joined}${region}`, reason: "appended a managed region at the end; every existing line is kept" };
     }
     case "stale":
     case "edited": {
-      if (report2.state === "edited" && !force) return { ...base4, action: "refuse", next: null, reason: report2.detail };
+      if (report2.state === "edited" && !force) return { ...base5, action: "refuse", next: null, reason: report2.detail };
       const scan = scanRegion(fileText);
-      if (scan.kind !== "one") return { ...base4, action: "refuse", next: null, reason: report2.detail };
+      if (scan.kind !== "one") return { ...base5, action: "refuse", next: null, reason: report2.detail };
       const lines = normaliseText(fileText).split("\n");
       const before = lines.slice(0, scan.region.startLine).join("\n");
       const after = lines.slice(scan.region.endLine + 1).join("\n");
@@ -26079,7 +26151,7 @@ function planRegionSync(target2, fileText, source, force) {
       const written = new Set(regionBody(source.text).split("\n"));
       const going = replaced.filter((l) => l.trim() !== "" && !written.has(l));
       return {
-        ...base4,
+        ...base5,
         action: report2.state === "edited" ? "force_replace" : "replace",
         next: next.endsWith("\n") ? next : `${next}
 `,
@@ -26088,7 +26160,7 @@ function planRegionSync(target2, fileText, source, force) {
       };
     }
     case "damaged":
-      return { ...base4, action: "refuse", next: null, reason: report2.detail };
+      return { ...base5, action: "refuse", next: null, reason: report2.detail };
   }
 }
 function parseSettings(text) {
@@ -26110,23 +26182,23 @@ function contextFileNames(settings) {
   return { names: [], shape: fileName === void 0 ? "none" : "other" };
 }
 function inspectGeminiSettings(target2, fileText) {
-  const base4 = { id: target2.id, path: target2.path };
-  if (fileText === null) return { ...base4, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
+  const base5 = { id: target2.id, path: target2.path };
+  if (fileText === null) return { ...base5, state: "missing", detail: `${target2.path} does not exist; sync creates it`, syncable: true };
   const parsed = parseSettings(fileText);
-  if (!parsed.ok) return { ...base4, state: "damaged", detail: `${target2.path} ${parsed.problem}; fix it by hand, then run sync`, syncable: false };
+  if (!parsed.ok) return { ...base5, state: "damaged", detail: `${target2.path} ${parsed.problem}; fix it by hand, then run sync`, syncable: false };
   const { names, shape: shape2 } = contextFileNames(parsed.value);
-  if (shape2 === "other") return { ...base4, state: "damaged", detail: `${target2.path}: context.fileName is neither a string nor a list of strings; fix it by hand, then run sync`, syncable: false };
+  if (shape2 === "other") return { ...base5, state: "damaged", detail: `${target2.path}: context.fileName is neither a string nor a list of strings; fix it by hand, then run sync`, syncable: false };
   const missing = GEMINI_CONTEXT_FILES.filter((name2) => !names.includes(name2));
-  if (missing.length === 0) return { ...base4, state: "in_sync", detail: `${target2.path} lists ${GEMINI_CONTEXT_FILES.join(" and ")}`, syncable: true };
-  return { ...base4, state: "unmanaged", detail: `${target2.path}: context.fileName does not list ${missing.join(" and ")}; sync adds it and keeps every other setting`, syncable: true };
+  if (missing.length === 0) return { ...base5, state: "in_sync", detail: `${target2.path} lists ${GEMINI_CONTEXT_FILES.join(" and ")}`, syncable: true };
+  return { ...base5, state: "unmanaged", detail: `${target2.path}: context.fileName does not list ${missing.join(" and ")}; sync adds it and keeps every other setting`, syncable: true };
 }
 function planGeminiSettingsSync(target2, fileText) {
   const report2 = inspectGeminiSettings(target2, fileText);
-  const base4 = { id: target2.id, path: target2.path };
-  if (report2.state === "in_sync") return { ...base4, action: "none", next: null, reason: report2.detail };
-  if (report2.state === "damaged") return { ...base4, action: "refuse", next: null, reason: report2.detail };
+  const base5 = { id: target2.id, path: target2.path };
+  if (report2.state === "in_sync") return { ...base5, action: "none", next: null, reason: report2.detail };
+  if (report2.state === "damaged") return { ...base5, action: "refuse", next: null, reason: report2.detail };
   const parsed = parseSettings(fileText);
-  if (!parsed.ok) return { ...base4, action: "refuse", next: null, reason: report2.detail };
+  if (!parsed.ok) return { ...base5, action: "refuse", next: null, reason: report2.detail };
   const settings = { ...parsed.value };
   const existing = contextFileNames(settings).names;
   const context4 = settings["context"] !== null && typeof settings["context"] === "object" && !Array.isArray(settings["context"]) ? { ...settings["context"] } : {};
@@ -26134,7 +26206,7 @@ function planGeminiSettingsSync(target2, fileText) {
   for (const name2 of GEMINI_CONTEXT_FILES) if (!names.includes(name2)) names.push(name2);
   context4["fileName"] = names;
   settings["context"] = context4;
-  return { ...base4, action: fileText === null ? "create" : "append", next: `${JSON.stringify(settings, null, 2)}
+  return { ...base5, action: fileText === null ? "create" : "append", next: `${JSON.stringify(settings, null, 2)}
 `, reason: fileText === null ? "created" : "added the missing names to context.fileName; nothing else changed" };
 }
 function checkRules(source, input2) {
@@ -26523,6 +26595,281 @@ var init_egress = __esm({
   }
 });
 
+// ../contracts/src/enterprise.ts
+function parseCsv(text) {
+  const rows = [];
+  let row = [];
+  let cell = "";
+  let quoted = false;
+  for (let i2 = 0; i2 < text.length; i2 += 1) {
+    const ch = text[i2];
+    if (quoted) {
+      if (ch === '"' && text[i2 + 1] === '"') {
+        cell += '"';
+        i2 += 1;
+      } else if (ch === '"') quoted = false;
+      else cell += ch;
+    } else if (ch === '"') quoted = true;
+    else if (ch === ",") {
+      row.push(cell);
+      cell = "";
+    } else if (ch === "\n" || ch === "\r") {
+      if (ch === "\r" && text[i2 + 1] === "\n") i2 += 1;
+      row.push(cell);
+      rows.push(row);
+      row = [];
+      cell = "";
+    } else cell += ch;
+  }
+  if (cell !== "" || row.length > 0) {
+    row.push(cell);
+    rows.push(row);
+  }
+  return rows;
+}
+function parseAuditCsv(csv) {
+  const rows = parseCsv(csv);
+  const header = rows[0] ?? [];
+  if (header.join(",") !== AUDIT_CSV_COLUMNS.join(",")) throw new Error("unexpected header");
+  return rows.slice(1).map((cells) => {
+    if (cells.length !== AUDIT_CSV_COLUMNS.length) throw new Error("wrong column count");
+    const value = (name2) => {
+      const raw = cells[AUDIT_CSV_COLUMNS.indexOf(name2)] ?? "";
+      return /^'[=+\-@\t\r]/.test(raw) ? raw.slice(1) : raw;
+    };
+    return AuditEvent.parse({
+      tenantId: value("tenantId"),
+      seq: Number(value("seq")),
+      eventId: value("eventId"),
+      at: value("at"),
+      actor: value("actor"),
+      principalType: value("principalType"),
+      role: value("role") === "" ? null : value("role"),
+      action: value("action"),
+      category: value("category"),
+      target: { type: value("targetType"), id: value("targetId") },
+      result: value("result"),
+      prevHash: value("prevHash"),
+      hash: value("hash")
+    });
+  });
+}
+function verifyAuditExport(tenantId, csv, manifest) {
+  let events;
+  try {
+    events = parseAuditCsv(csv);
+  } catch {
+    return { tenantId, ok: false, checked: 0, head: null, reason: "bad_hash", manifestOk: false };
+  }
+  const chain = verifyAuditChain(tenantId, events, { prevHash: manifest.firstSeq === null || manifest.firstSeq === 1 ? AUDIT_GENESIS_HASH : events[0]?.prevHash ?? AUDIT_GENESIS_HASH, seq: (manifest.firstSeq ?? 1) - 1 });
+  const manifestOk = manifest.tenantId === tenantId && manifest.count === events.length && manifest.lastSeq === (events.at(-1)?.seq ?? null) && manifest.head === (events.at(-1)?.hash ?? null) && manifest.firstSeq === (events[0]?.seq ?? null);
+  return { ...chain, ok: chain.ok && manifestOk, manifestOk };
+}
+var ENTERPRISE_FEATURES, EnterpriseFeature, EnterpriseEntitlements, roleName, shortId, SSO_PROTOCOLS, SsoProtocol, IDENTITY_CONNECTION_STATUSES, ConnectionStatus, SsoConnection, ScimDirectory, PORTAL_INTENTS, PortalIntent, PortalLinkRequest, PortalLink, TestConnectionResult, EnterpriseIdentityStatus, GroupRoleMapping, GROUP_ROLE_CAPS, GroupRoleCap, GroupMappingSet, PutGroupMappingsRequest, DirectorySyncReport, AUDIT_CSV_COLUMNS, AuditExportManifest, AuditExport, STREAM_STATUSES, AuditStreamTarget, CreateAuditStreamTargetRequest, AuditStreamTargetList, AuditStreamDelivery, StreamRunReport, REGIONS, Region, STORE_KINDS, StoreKind, StoreLocation, ResidencyPolicy, PinRegionRequest, RegionMigrationRequest, StoreLocationReport, BYOK_PROVIDERS, ByokProvider, BYOK_STATUSES, ByokStatus, ByokAlias, ByokKey, ByokKeyList, CreateByokKeyRequest, RotateByokKeyRequest, ByokTestResult, RETENTION_CLASSES, RetentionClass, RetentionRule, EnterpriseRetentionPolicy, PutRetentionPolicyRequest, PurgeLine, PurgeReport, PurgeReportList, ExportScope, DataRequest, DataExportReport, DataDeletionReport, RestoreDrillReport, EnterpriseMcpAllowlistEntry, McpAllowlist, PutMcpAllowlistRequest, EvidencePack, base4, enterprisePaths, FIXTURE_AT2, ENTERPRISE_FIXTURES;
+var init_enterprise = __esm({
+  "../contracts/src/enterprise.ts"() {
+    "use strict";
+    init_zod();
+    init_audit();
+    init_common();
+    init_plans();
+    ENTERPRISE_FEATURES = ["sso", "scim", "audit_export", "siem_stream", "data_residency", "byok", "retention", "policy_as_code", "mcp_allowlist"];
+    EnterpriseFeature = external_exports.enum(ENTERPRISE_FEATURES);
+    EnterpriseEntitlements = external_exports.object({ tenantId: TenantId, plan: BillingPlanId, features: external_exports.record(EnterpriseFeature, external_exports.boolean()) }).strict();
+    roleName = external_exports.enum(["owner", "admin", "member", "viewer"]);
+    shortId = external_exports.string().min(1).max(64);
+    SSO_PROTOCOLS = ["saml", "oidc"];
+    SsoProtocol = external_exports.enum(SSO_PROTOCOLS);
+    IDENTITY_CONNECTION_STATUSES = ["not_configured", "pending", "active", "failed", "disabled"];
+    ConnectionStatus = external_exports.enum(IDENTITY_CONNECTION_STATUSES);
+    SsoConnection = external_exports.object({
+      tenantId: TenantId,
+      connectionId: shortId.nullable(),
+      protocol: SsoProtocol.nullable(),
+      status: ConnectionStatus,
+      domains: external_exports.array(external_exports.string().min(1).max(253)).max(20),
+      lastTestedAt: Timestamp.nullable(),
+      lastTestOk: external_exports.boolean().nullable()
+    }).strict();
+    ScimDirectory = external_exports.object({
+      tenantId: TenantId,
+      directoryId: shortId.nullable(),
+      status: ConnectionStatus,
+      userCount: external_exports.number().int().nonnegative(),
+      groupCount: external_exports.number().int().nonnegative(),
+      lastSyncAt: Timestamp.nullable()
+    }).strict();
+    PORTAL_INTENTS = ["sso", "dsync"];
+    PortalIntent = external_exports.enum(PORTAL_INTENTS);
+    PortalLinkRequest = external_exports.object({ intent: PortalIntent }).strict();
+    PortalLink = external_exports.object({ tenantId: TenantId, intent: PortalIntent, url: external_exports.string().url(), expiresAt: Timestamp }).strict();
+    TestConnectionResult = external_exports.object({ tenantId: TenantId, intent: PortalIntent, ok: external_exports.boolean(), checkedAt: Timestamp, detail: external_exports.string().max(300) }).strict();
+    EnterpriseIdentityStatus = external_exports.object({ tenantId: TenantId, sso: SsoConnection, scim: ScimDirectory }).strict();
+    GroupRoleMapping = external_exports.object({ tenantId: TenantId, groupName: external_exports.string().min(1).max(200), role: roleName }).strict();
+    GROUP_ROLE_CAPS = ["admin", "member", "viewer"];
+    GroupRoleCap = external_exports.enum(GROUP_ROLE_CAPS);
+    GroupMappingSet = external_exports.object({ tenantId: TenantId, cap: GroupRoleCap, mappings: external_exports.array(GroupRoleMapping).max(200), updatedAt: Timestamp.nullable() }).strict();
+    PutGroupMappingsRequest = external_exports.object({ cap: GroupRoleCap.default("admin"), mappings: external_exports.array(external_exports.object({ groupName: external_exports.string().min(1).max(200), role: roleName }).strict()).max(200) }).strict();
+    DirectorySyncReport = external_exports.object({
+      tenantId: TenantId,
+      syncedAt: Timestamp,
+      rolesChanged: external_exports.number().int().nonnegative(),
+      deprovisioned: external_exports.number().int().nonnegative(),
+      /** Seconds from the directory marking a user inactive to this sync applying it, per deprovisioned user. */
+      deprovisionLatencySeconds: external_exports.array(external_exports.number().nonnegative()),
+      withinDeadline: external_exports.boolean()
+    }).strict();
+    AUDIT_CSV_COLUMNS = ["tenantId", "seq", "eventId", "at", "actor", "principalType", "role", "action", "category", "targetType", "targetId", "result", "prevHash", "hash"];
+    AuditExportManifest = external_exports.object({
+      tenantId: TenantId,
+      exportId: shortId,
+      format: external_exports.literal("csv"),
+      count: external_exports.number().int().nonnegative(),
+      firstSeq: external_exports.number().int().positive().nullable(),
+      lastSeq: external_exports.number().int().positive().nullable(),
+      head: external_exports.string().regex(/^[0-9a-f]{64}$/).nullable(),
+      exportedAt: Timestamp
+    }).strict();
+    AuditExport = external_exports.object({ manifest: AuditExportManifest, csv: external_exports.string() }).strict();
+    STREAM_STATUSES = ["active", "paused", "failing"];
+    AuditStreamTarget = external_exports.object({
+      tenantId: TenantId,
+      targetId: shortId,
+      /** Where deliveries go. https only. */
+      url: external_exports.string().url().refine((u) => u.startsWith("https://"), "must be https"),
+      status: external_exports.enum(STREAM_STATUSES),
+      /** The newest chain sequence the target has acknowledged. */
+      deliveredThroughSeq: external_exports.number().int().nonnegative(),
+      lastError: external_exports.string().max(200).nullable(),
+      createdAt: Timestamp
+    }).strict();
+    CreateAuditStreamTargetRequest = external_exports.object({ url: external_exports.string().url().refine((u) => u.startsWith("https://"), "must be https"), signingSecret: external_exports.string().min(16).max(200) }).strict();
+    AuditStreamTargetList = external_exports.object({ tenantId: TenantId, targets: external_exports.array(AuditStreamTarget) }).strict();
+    AuditStreamDelivery = external_exports.object({
+      tenantId: TenantId,
+      targetId: shortId,
+      idempotencyKey: external_exports.string().min(1).max(200),
+      batchSeq: external_exports.number().int().positive(),
+      events: external_exports.array(AuditEvent).min(1).max(500)
+    }).strict();
+    StreamRunReport = external_exports.object({ tenantId: TenantId, targetId: shortId, delivered: external_exports.number().int().nonnegative(), batches: external_exports.number().int().nonnegative(), failed: external_exports.boolean(), deliveredThroughSeq: external_exports.number().int().nonnegative() }).strict();
+    REGIONS = ["global", "eu", "us"];
+    Region = external_exports.enum(REGIONS);
+    STORE_KINDS = ["d1", "r2", "kv", "durable_objects", "vectors", "logs", "backups"];
+    StoreKind = external_exports.enum(STORE_KINDS);
+    StoreLocation = external_exports.object({ store: StoreKind, region: Region, detail: external_exports.string().max(200) }).strict();
+    ResidencyPolicy = external_exports.object({
+      tenantId: TenantId,
+      region: Region,
+      pinnedAt: Timestamp.nullable(),
+      /** Supported pin targets, so a refusal and the settings screen show the same list. */
+      supportedRegions: external_exports.array(Region),
+      pendingMigration: external_exports.object({ from: Region, to: Region, requestedAt: Timestamp, requestedBy: external_exports.string().min(1).max(200), status: external_exports.enum(["requested", "running", "done", "failed"]) }).strict().nullable()
+    }).strict();
+    PinRegionRequest = external_exports.object({ region: Region }).strict();
+    RegionMigrationRequest = external_exports.object({ to: Region, reason: external_exports.string().min(1).max(300) }).strict();
+    StoreLocationReport = external_exports.object({ tenantId: TenantId, region: Region, checkedAt: Timestamp, stores: external_exports.array(StoreLocation), ok: external_exports.boolean(), violations: external_exports.array(external_exports.string().max(200)) }).strict();
+    BYOK_PROVIDERS = ["anthropic", "openai", "google"];
+    ByokProvider = external_exports.enum(BYOK_PROVIDERS);
+    BYOK_STATUSES = ["untested", "active", "failed", "revoked"];
+    ByokStatus = external_exports.enum(BYOK_STATUSES);
+    ByokAlias = external_exports.string().min(1).max(60).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and hyphens");
+    ByokKey = external_exports.object({
+      tenantId: TenantId,
+      alias: ByokAlias,
+      provider: ByokProvider,
+      status: ByokStatus,
+      /** Increments on each rotation. */
+      version: external_exports.number().int().positive(),
+      /** No fingerprint and no last characters are kept: the alias is the only reference. */
+      lastTestedAt: Timestamp.nullable(),
+      createdAt: Timestamp,
+      revokedAt: Timestamp.nullable()
+    }).strict();
+    ByokKeyList = external_exports.object({ tenantId: TenantId, keys: external_exports.array(ByokKey) }).strict();
+    CreateByokKeyRequest = external_exports.object({ alias: ByokAlias, provider: ByokProvider, value: external_exports.string().min(8).max(500) }).strict();
+    RotateByokKeyRequest = external_exports.object({ value: external_exports.string().min(8).max(500) }).strict();
+    ByokTestResult = external_exports.object({ tenantId: TenantId, alias: ByokAlias, ok: external_exports.boolean(), checkedAt: Timestamp, detail: external_exports.string().max(200) }).strict();
+    RETENTION_CLASSES = ["memory", "derived_data", "agent_conversations", "ci_artifacts", "run_logs"];
+    RetentionClass = external_exports.enum(RETENTION_CLASSES);
+    RetentionRule = external_exports.object({ dataClass: RetentionClass, days: external_exports.number().int().min(1).max(3650) }).strict();
+    EnterpriseRetentionPolicy = external_exports.object({ tenantId: TenantId, rules: external_exports.array(RetentionRule).max(RETENTION_CLASSES.length), updatedAt: Timestamp.nullable() }).strict();
+    PutRetentionPolicyRequest = external_exports.object({ rules: external_exports.array(RetentionRule).max(RETENTION_CLASSES.length) }).strict();
+    PurgeLine = external_exports.object({ dataClass: RetentionClass, store: StoreKind, cutoff: Timestamp, purged: external_exports.number().int().nonnegative() }).strict();
+    PurgeReport = external_exports.object({ tenantId: TenantId, purgeId: shortId, ranAt: Timestamp, trigger: external_exports.enum(["schedule", "manual"]), lines: external_exports.array(PurgeLine), totalPurged: external_exports.number().int().nonnegative() }).strict();
+    PurgeReportList = external_exports.object({ tenantId: TenantId, reports: external_exports.array(PurgeReport) }).strict();
+    ExportScope = external_exports.enum(["tenant", "project", "user"]);
+    DataRequest = external_exports.object({ scope: ExportScope, subjectId: external_exports.string().min(1).max(128).optional() }).strict();
+    DataExportReport = external_exports.object({ tenantId: TenantId, scope: ExportScope, exportedAt: Timestamp, stores: external_exports.array(external_exports.object({ store: StoreKind, dataClass: external_exports.string().max(60), rows: external_exports.number().int().nonnegative() }).strict()), totalRows: external_exports.number().int().nonnegative(), ndjson: external_exports.string() }).strict();
+    DataDeletionReport = external_exports.object({
+      tenantId: TenantId,
+      scope: ExportScope,
+      deletedAt: Timestamp,
+      stores: external_exports.array(external_exports.object({ store: StoreKind, dataClass: external_exports.string().max(60), rows: external_exports.number().int().nonnegative() }).strict()),
+      totalRows: external_exports.number().int().nonnegative(),
+      backupsPurgedBy: Timestamp
+    }).strict();
+    RestoreDrillReport = external_exports.object({
+      tenantId: TenantId,
+      drillId: shortId,
+      ranAt: Timestamp,
+      restoredFrom: Timestamp,
+      tables: external_exports.array(external_exports.object({ name: external_exports.string().min(1).max(80), expected: external_exports.number().int().nonnegative(), restored: external_exports.number().int().nonnegative() }).strict()),
+      ok: external_exports.boolean(),
+      durationMs: external_exports.number().int().nonnegative()
+    }).strict();
+    EnterpriseMcpAllowlistEntry = external_exports.object({ server: external_exports.string().min(1).max(253), note: external_exports.string().max(200).optional() }).strict();
+    McpAllowlist = external_exports.object({ tenantId: TenantId, mode: external_exports.enum(["off", "allowlist"]), entries: external_exports.array(EnterpriseMcpAllowlistEntry).max(200), updatedAt: Timestamp.nullable() }).strict();
+    PutMcpAllowlistRequest = external_exports.object({ mode: external_exports.enum(["off", "allowlist"]), entries: external_exports.array(EnterpriseMcpAllowlistEntry).max(200) }).strict();
+    EvidencePack = external_exports.object({
+      tenantId: TenantId,
+      generatedAt: Timestamp,
+      chain: external_exports.object({ ok: external_exports.boolean(), checked: external_exports.number().int().nonnegative(), head: external_exports.string().nullable() }).strict(),
+      agentActions: external_exports.object({ total: external_exports.number().int().nonnegative(), byAction: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()), denied: external_exports.number().int().nonnegative() }).strict(),
+      controls: external_exports.array(external_exports.object({ id: external_exports.string().max(40), title: external_exports.string().max(120), state: external_exports.enum(["enabled", "not_configured"]), evidence: external_exports.string().max(200) }).strict())
+    }).strict();
+    base4 = (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/enterprise`;
+    enterprisePaths = {
+      entitlements: (t2) => `${base4(t2)}/entitlements`,
+      identity: (t2) => `${base4(t2)}/identity`,
+      portalLink: (t2) => `${base4(t2)}/identity/portal-link`,
+      testConnection: (t2) => `${base4(t2)}/identity/test`,
+      syncDirectory: (t2) => `${base4(t2)}/identity/sync`,
+      groupMappings: (t2) => `${base4(t2)}/identity/group-mappings`,
+      auditExports: (t2) => `${base4(t2)}/audit-exports`,
+      streamTargets: (t2) => `${base4(t2)}/audit-streams`,
+      streamTarget: (t2, id2) => `${base4(t2)}/audit-streams/${encodeURIComponent(id2)}`,
+      streamRun: (t2, id2) => `${base4(t2)}/audit-streams/${encodeURIComponent(id2)}/run`,
+      residency: (t2) => `${base4(t2)}/residency`,
+      residencyMigrations: (t2) => `${base4(t2)}/residency/migrations`,
+      storeLocations: (t2) => `${base4(t2)}/residency/stores`,
+      byokKeys: (t2) => `${base4(t2)}/byok/keys`,
+      byokKey: (t2, alias) => `${base4(t2)}/byok/keys/${encodeURIComponent(alias)}`,
+      byokTest: (t2, alias) => `${base4(t2)}/byok/keys/${encodeURIComponent(alias)}/test`,
+      byokRotate: (t2, alias) => `${base4(t2)}/byok/keys/${encodeURIComponent(alias)}/rotate`,
+      retention: (t2) => `${base4(t2)}/retention`,
+      purge: (t2) => `${base4(t2)}/retention/purge`,
+      purgeReports: (t2) => `${base4(t2)}/retention/reports`,
+      dataExport: (t2) => `${base4(t2)}/data/export`,
+      dataDelete: (t2) => `${base4(t2)}/data/delete`,
+      restoreDrill: (t2) => `${base4(t2)}/backups/drill`,
+      mcpAllowlist: (t2) => `${base4(t2)}/mcp-allowlist`,
+      evidencePack: (t2) => `${base4(t2)}/evidence-pack`
+    };
+    FIXTURE_AT2 = "2026-10-10T00:00:00.000Z";
+    ENTERPRISE_FIXTURES = {
+      sso: SsoConnection.parse({ tenantId: "tm-1", connectionId: "conn_1", protocol: "saml", status: "active", domains: ["example.com"], lastTestedAt: FIXTURE_AT2, lastTestOk: true }),
+      scim: ScimDirectory.parse({ tenantId: "tm-1", directoryId: "dir_1", status: "active", userCount: 12, groupCount: 3, lastSyncAt: FIXTURE_AT2 }),
+      groupMappings: GroupMappingSet.parse({ tenantId: "tm-1", cap: "admin", mappings: [{ tenantId: "tm-1", groupName: "Engineering", role: "member" }, { tenantId: "tm-1", groupName: "Platform", role: "admin" }], updatedAt: FIXTURE_AT2 }),
+      residency: ResidencyPolicy.parse({ tenantId: "tm-1", region: "eu", pinnedAt: FIXTURE_AT2, supportedRegions: ["global", "eu", "us"], pendingMigration: null }),
+      byok: ByokKey.parse({ tenantId: "tm-1", alias: "team-anthropic", provider: "anthropic", status: "active", version: 1, lastTestedAt: FIXTURE_AT2, createdAt: FIXTURE_AT2, revokedAt: null }),
+      retention: EnterpriseRetentionPolicy.parse({ tenantId: "tm-1", rules: [{ dataClass: "run_logs", days: 90 }], updatedAt: FIXTURE_AT2 }),
+      streamTarget: AuditStreamTarget.parse({ tenantId: "tm-1", targetId: "tgt_1", url: "https://siem.example.com/ingest", status: "active", deliveredThroughSeq: 3, lastError: null, createdAt: FIXTURE_AT2 }),
+      mcpAllowlist: McpAllowlist.parse({ tenantId: "tm-1", mode: "allowlist", entries: [{ server: "mcp.example.com" }], updatedAt: FIXTURE_AT2 })
+    };
+  }
+});
+
 // ../contracts/src/observability.ts
 var RUN_EVENT_TYPES, RunEventType, OBS_RUN_STATUSES, ObsRunStatus, REVIEW_OUTCOMES, ReviewOutcome, Name2, Level, RunEventFields, RunEvent, RunEventInput, IngestRunEventsRequest, RunResume, LogRecord, LogInput, Span, SpanInput, IngestTelemetryRequest, IngestTelemetryResult, LogRecordList, ObsRun, TraceBundle, METRIC_KINDS, MetricKind, METRIC_DIMENSIONS, MetricDimension, MetricDimensions, MetricInput, Metric, IngestMetricsRequest, IngestMetricsResult, MetricTotal, MetricTotals, CostRowV1, CostSummaryV1, CostReport, ReconcileLine, Reconciliation, ALERT_KINDS, AlertKind, ALERT_CHANNELS, AlertChannel, AlertTarget, AlertThreshold, AlertRule, PutAlertRuleRequest, DeleteAlertRuleRequest, AlertDelivery, Incident, AlertOverview, EvaluateAlertsResult, AlertNotice, RETENTION_COVERS, RETENTION_KEEPS, RetentionPolicy, RetentionPurgeResult, ComparisonEntry, ComparisonReport, ReplayResult, EvalRow, EvalReport, RunEvalRequest, DecisionSummary, ObserveStatus, t, p, observePaths;
 var init_observability = __esm({
@@ -26825,6 +27172,7 @@ var init_src = __esm({
     init_rules_sync();
     init_pr_routing();
     init_egress();
+    init_enterprise();
     init_observability();
   }
 });
@@ -34160,12 +34508,12 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename5, join as join25, resolve as resolve13 } from "node:path";
+import { basename as basename5, join as join25, resolve as resolve14 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
   if (override !== void 0 && override !== "") return override;
-  return resolve13(fileURLToPath(new URL(".", import.meta.url)), "..");
+  return resolve14(fileURLToPath(new URL(".", import.meta.url)), "..");
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
@@ -34178,7 +34526,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.137" : "0.0.0-dev";
+    VERSION = true ? "0.1.138" : "0.0.0-dev";
   }
 });
 
@@ -34273,13 +34621,13 @@ function int64FromString(dec) {
   if (minus) {
     dec = dec.slice(1);
   }
-  const base4 = 1e6;
+  const base5 = 1e6;
   let lowBits = 0;
   let highBits = 0;
   function add1e6digit(begin, end) {
     const digit1e6 = Number(dec.slice(begin, end));
-    highBits *= base4;
-    lowBits = lowBits * base4 + digit1e6;
+    highBits *= base5;
+    lowBits = lowBits * base5 + digit1e6;
     if (lowBits >= TWO_PWR_32_DBL) {
       highBits = highBits + (lowBits / TWO_PWR_32_DBL | 0);
       lowBits = lowBits % TWO_PWR_32_DBL;
@@ -34311,14 +34659,14 @@ function uInt64ToString(lo, hi) {
   let digitA = low + mid * 6777216 + high * 6710656;
   let digitB = mid + high * 8147497;
   let digitC = high * 2;
-  const base4 = 1e7;
-  if (digitA >= base4) {
-    digitB += Math.floor(digitA / base4);
-    digitA %= base4;
+  const base5 = 1e7;
+  if (digitA >= base5) {
+    digitB += Math.floor(digitA / base5);
+    digitA %= base5;
   }
-  if (digitB >= base4) {
-    digitC += Math.floor(digitB / base4);
-    digitB %= base4;
+  if (digitB >= base5) {
+    digitC += Math.floor(digitB / base5);
+    digitB %= base5;
   }
   return digitC.toString() + decimalFrom1e7WithLeadingZeros(digitB) + decimalFrom1e7WithLeadingZeros(digitA);
 }
@@ -35596,7 +35944,7 @@ function createFileRegistry(...args2) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve16(protoFileName);
+        const dep = resolve17(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file2.name}`);
         }
@@ -35610,7 +35958,7 @@ function createFileRegistry(...args2) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input2 = args2[0];
-    const resolve16 = args2[1];
+    const resolve17 = args2[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file2 of [input2, ...recurseDeps(input2)].reverse()) {
       addFile(file2, registry2);
@@ -37445,10 +37793,10 @@ var init_scip_pb = __esm({
 
 // ../index-builder/src/languages.ts
 function languageForPath(path) {
-  const base4 = path.slice(path.lastIndexOf("/") + 1);
-  const dot = base4.lastIndexOf(".");
+  const base5 = path.slice(path.lastIndexOf("/") + 1);
+  const dot = base5.lastIndexOf(".");
   if (dot <= 0) return null;
-  return BY_EXTENSION.get(base4.slice(dot).toLowerCase()) ?? null;
+  return BY_EXTENSION.get(base5.slice(dot).toLowerCase()) ?? null;
 }
 var BY_EXTENSION;
 var init_languages = __esm({
@@ -38023,13 +38371,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve16, reject) => {
+          return new Promise((resolve17, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve16(xhr.response);
+                resolve17(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -38225,9 +38573,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve16(receiveInstance(mod, inst));
+          resolve17(receiveInstance(mod, inst));
         });
       });
     }
@@ -39560,8 +39908,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve16, reject) => {
-      readyPromiseResolve = resolve16;
+    moduleRtn = new Promise((resolve17, reject) => {
+      readyPromiseResolve = resolve17;
       readyPromiseReject = reject;
     });
   }
@@ -42218,7 +42566,7 @@ var init_snapshot = __esm({
 // ../index-builder/src/upload.ts
 async function uploadSnapshot(options) {
   const doFetch = options.fetch ?? fetch;
-  const base4 = options.serviceUrl.replace(/\/+$/, "");
+  const base5 = options.serviceUrl.replace(/\/+$/, "");
   const manifest = SnapshotManifest.parse(options.manifest);
   const { tenantId, repository, projectId, commitSha } = manifest;
   const byProject = projectId !== void 0 && (repository === void 0 || options.byProject === true);
@@ -42228,7 +42576,7 @@ async function uploadSnapshot(options) {
     for (let attempt2 = 1; ; attempt2 += 1) {
       let failure4;
       try {
-        const response = await doFetch(`${base4}${path}`, { method: "POST", headers, body: body2 });
+        const response = await doFetch(`${base5}${path}`, { method: "POST", headers, body: body2 });
         if (response.ok) return response;
         const retryable = response.status === 429 || response.status >= 500;
         if (!retryable || attempt2 >= ATTEMPTS) {
@@ -42240,7 +42588,7 @@ async function uploadSnapshot(options) {
         failure4 = error62 instanceof Error ? error62.message : String(error62);
         if (attempt2 >= ATTEMPTS) throw new Error(`POST ${path} failed: ${failure4}`);
       }
-      await new Promise((resolve16) => setTimeout(resolve16, (options.retryDelayMs ?? 500) * attempt2));
+      await new Promise((resolve17) => setTimeout(resolve17, (options.retryDelayMs ?? 500) * attempt2));
     }
   };
   const manifestPath = byProject ? codePaths.projectUploadManifest(tenantId, projectId ?? "") : codePaths.uploadManifest(tenantId, repository?.owner ?? "", repository?.name ?? "");
@@ -42637,7 +42985,7 @@ async function buildRepoIndex(files) {
   }
   const heritage = /* @__PURE__ */ new Map();
   const heirs = /* @__PURE__ */ new Map();
-  const resolve16 = (from, name2) => {
+  const resolve17 = (from, name2) => {
     const visible = imports.get(from.path) ?? /* @__PURE__ */ new Set();
     return (byName.get(baseName(name2)) ?? []).find((candidate) => candidate.path === from.path || reaches(visible, candidate.path));
   };
@@ -42646,8 +42994,8 @@ async function buildRepoIndex(files) {
     const stem2 = header.slice(header.indexOf(entry.name) + entry.name.length).replace(/^<[^>]*>/, "").replace(/\{.*$/, "");
     const ext = /\bextends\s+([A-Za-z_$][\w$.]*)/.exec(stem2)?.[1];
     const impl = /\bimplements\s+(.+)$/.exec(stem2)?.[1];
-    const extendsIds = ext === void 0 ? [] : [resolve16(entry, ext)?.id].filter((value) => value !== void 0);
-    const implementsIds = (impl === void 0 ? [] : impl.split(/,(?![^<]*>)/).map((part) => resolve16(entry, part.trim()))).filter((value) => value !== void 0).map((value) => value.id);
+    const extendsIds = ext === void 0 ? [] : [resolve17(entry, ext)?.id].filter((value) => value !== void 0);
+    const implementsIds = (impl === void 0 ? [] : impl.split(/,(?![^<]*>)/).map((part) => resolve17(entry, part.trim()))).filter((value) => value !== void 0).map((value) => value.id);
     if (extendsIds.length === 0 && implementsIds.length === 0) continue;
     heritage.set(id2, { extends: extendsIds, implements: implementsIds });
     for (const target2 of extendsIds) heirs.set(target2, { extendedBy: [...heirs.get(target2)?.extendedBy ?? [], id2], implementedBy: heirs.get(target2)?.implementedBy ?? [] });
@@ -42740,7 +43088,7 @@ var init_context_map_build = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile3 } from "node:child_process";
 import { mkdir as mkdir4, readdir as readdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join28, resolve as resolve14 } from "node:path";
+import { join as join28, resolve as resolve15 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify3 } from "node:util";
 async function git6(root, args2) {
@@ -42761,7 +43109,7 @@ async function repositoryFromRemote(root) {
   }
 }
 async function snapshotFromArgs(values, env) {
-  const root = resolve14(typeof values["root"] === "string" ? values["root"] : process.cwd());
+  const root = resolve15(typeof values["root"] === "string" ? values["root"] : process.cwd());
   const projectId = typeof values["project"] === "string" ? values["project"] : void 0;
   if (projectId !== void 0 && !ProjectId.safeParse(projectId).success) throw new UsageError2(`--project must be a project identifier, got "${projectId}"`);
   const repoText = projectId !== void 0 ? typeof values["repo"] === "string" ? values["repo"] : void 0 : (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
@@ -42773,7 +43121,7 @@ async function snapshotFromArgs(values, env) {
   const scip = Array.isArray(values["scip"]) ? values["scip"] : [];
   return buildSnapshot({
     repoRoot: root,
-    scipFiles: scip.map((file2) => resolve14(file2)),
+    scipFiles: scip.map((file2) => resolve15(file2)),
     tenantId: tenant,
     ...repoText ? { repository: parseRepository(repoText) } : {},
     ...projectId !== void 0 ? { projectId } : {},
@@ -42789,14 +43137,14 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
       const outDir = values.out;
       if (!outDir) throw new UsageError2("build needs --out DIR");
       const built = await snapshotFromArgs({ ...values, tenant: values.tenant ?? env["HARNESS_TENANT"] ?? "local" }, env);
-      await writeSnapshot(resolve14(outDir), built);
-      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve14(outDir)}`);
+      await writeSnapshot(resolve15(outDir), built);
+      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve15(outDir)}`);
       return 0;
     }
     if (command === "map") {
-      const root = resolve14(values.root ?? process.cwd());
+      const root = resolve15(values.root ?? process.cwd());
       const { digest, indexFile } = await buildArtifactsForCheckout({ root, ...values.task === void 0 ? {} : { task: values.task } });
-      const path = await writeDigest(root, digest, values.out === void 0 ? void 0 : resolve14(values.out));
+      const path = await writeDigest(root, digest, values.out === void 0 ? void 0 : resolve15(values.out));
       const indexPath = values.out === void 0 ? await writeIndexFile(root, indexFile) : null;
       out2(`wrote the code map digest for ${digest.revision.commitSha.slice(0, 12)} (${digest.coverage.files} files, ${digest.coverage.symbols} symbols, ${digest.lines.length} lines) to ${path}${indexPath === null ? "" : `, and the ranking index to ${indexPath}`}`);
       return 0;
@@ -46436,14 +46784,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve16();
+      resolve17();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -46549,8 +46897,8 @@ function setNegotiatedProtocolVersion(instance2, version2) {
 function isPlainObject$1(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function mergeCapabilities(base4, additional) {
-  const result = { ...base4 };
+function mergeCapabilities(base5, additional) {
+  const result = { ...base5 };
   for (const key in additional) {
     const k = key;
     const addValue = additional[k];
@@ -48239,7 +48587,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve16, reject) => {
+        return new Promise((resolve17, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -48307,7 +48655,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve16(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve17(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -48319,11 +48667,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema2, legOptions)
               };
-              return resolve16(this._resolveNonCompleteResult(decoded, flow));
+              return resolve17(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema2, result).then((parseResult) => {
-              if (parseResult.success) resolve16(parseResult.data);
+              if (parseResult.success) resolve17(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -51139,7 +51487,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve16.call(this, root, ref);
+        let _sch = resolve17.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -51165,7 +51513,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve16(root, ref) {
+      function resolve17(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -51615,16 +51963,16 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse5(serialize(uri, options), options);
         return uri;
       }
-      function resolve16(baseURI, relativeURI, options) {
+      function resolve17(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
         return serialize(resolved, schemelessOptions);
       }
-      function resolveComponent(base4, relative4, options, skipNormalization) {
+      function resolveComponent(base5, relative4, options, skipNormalization) {
         const target2 = {};
         if (!skipNormalization) {
-          base4 = parse5(serialize(base4, options), options);
+          base5 = parse5(serialize(base5, options), options);
           relative4 = parse5(serialize(relative4, options), options);
         }
         options = options || {};
@@ -51644,24 +51992,24 @@ var init_ajvProvider_CEoC_sr = __esm({
             target2.query = relative4.query;
           } else {
             if (!relative4.path) {
-              target2.path = base4.path;
+              target2.path = base5.path;
               if (relative4.query !== void 0) target2.query = relative4.query;
-              else target2.query = base4.query;
+              else target2.query = base5.query;
             } else {
               if (relative4.path[0] === "/") target2.path = removeDotSegments(relative4.path);
               else {
-                if ((base4.userinfo !== void 0 || base4.host !== void 0 || base4.port !== void 0) && !base4.path) target2.path = "/" + relative4.path;
-                else if (!base4.path) target2.path = relative4.path;
-                else target2.path = base4.path.slice(0, base4.path.lastIndexOf("/") + 1) + relative4.path;
+                if ((base5.userinfo !== void 0 || base5.host !== void 0 || base5.port !== void 0) && !base5.path) target2.path = "/" + relative4.path;
+                else if (!base5.path) target2.path = relative4.path;
+                else target2.path = base5.path.slice(0, base5.path.lastIndexOf("/") + 1) + relative4.path;
                 target2.path = removeDotSegments(target2.path);
               }
               target2.query = relative4.query;
             }
-            target2.userinfo = base4.userinfo;
-            target2.host = base4.host;
-            target2.port = base4.port;
+            target2.userinfo = base5.userinfo;
+            target2.host = base5.host;
+            target2.port = base5.port;
           }
-          target2.scheme = base4.scheme;
+          target2.scheme = base5.scheme;
         }
         target2.fragment = relative4.fragment;
         return target2;
@@ -51789,7 +52137,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve16,
+        resolve: resolve17,
         resolveComponent,
         equal,
         serialize,
@@ -57486,7 +57834,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve16, reject) => {
+        return new Promise((resolve17, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -57501,14 +57849,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve16();
+            resolve17();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve16();
+            resolve17();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -57562,14 +57910,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve16) => {
+        return await new Promise((resolve17) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve16(true);
+            resolve17(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve16(false);
+            resolve17(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -57748,18 +58096,18 @@ var init_git2 = __esm({
 });
 
 // ../code-shim/src/config.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join33 } from "node:path";
 function configDir(env) {
-  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join33(homedir2(), ".config");
-  return join33(base4, "mvrx-harness");
+  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join33(homedir2(), ".config");
+  return join33(base5, "mvrx-harness");
 }
 function findToken2(env, serviceUrl, now) {
   const fromEnv = env["HARNESS_TOKEN"];
   if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
   try {
-    const file2 = JSON.parse(readFileSync16(join33(configDir(env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync17(join33(configDir(env), "credentials.json"), "utf8"));
     const stored = file2[serviceUrl];
     if (stored === void 0 || typeof stored.accessToken !== "string" || stored.accessToken.length === 0) return null;
     if (typeof stored.expiresAt === "number" && stored.expiresAt <= now) return null;
@@ -57771,7 +58119,7 @@ function findToken2(env, serviceUrl, now) {
 function resolveCloudConfig(root, env, now) {
   let binding;
   try {
-    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync16(join33(root, ".harness", "project.json"), "utf8")));
+    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync17(join33(root, ".harness", "project.json"), "utf8")));
     if (!parsed.success) return null;
     binding = parsed.data;
   } catch {
@@ -57793,10 +58141,10 @@ var init_config = __esm({
 });
 
 // ../code-shim/src/local.ts
-import { readFileSync as readFileSync17, statSync as statSync3 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve15, sep as sep2 } from "node:path";
+import { readFileSync as readFileSync18, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve16, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
-  const absolute = resolve15(root, path);
+  const absolute = resolve16(root, path);
   const rel = relative3(root, absolute);
   if (rel.length === 0 || rel.startsWith("..") || isAbsolute2(rel)) return null;
   return absolute;
@@ -57913,7 +58261,7 @@ var init_local = __esm({
         let shard;
         try {
           this.parses += 1;
-          shard = await this.parse(path, readFileSync17(absolute, "utf8"));
+          shard = await this.parse(path, readFileSync18(absolute, "utf8"));
         } catch {
           shard = null;
         }
@@ -57925,7 +58273,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return null;
         try {
-          return readFileSync17(absolute, "utf8");
+          return readFileSync18(absolute, "utf8");
         } catch {
           return null;
         }
@@ -57935,7 +58283,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return void 0;
         try {
-          const lines = readFileSync17(absolute, "utf8").split("\n");
+          const lines = readFileSync18(absolute, "utf8").split("\n");
           const start2 = range[0];
           if (start2 >= lines.length) return void 0;
           const end = Math.min(Math.max(range[2], start2), start2 + maxLines - 1, lines.length - 1);
@@ -58056,8 +58404,8 @@ async function symbolsOverview(deps, args2) {
   const dirty2 = await parseDirty(deps.index, state, (p2) => isUnder(p2, scope));
   const cloud = await deps.cloud.query("symbols_overview", state.head, args2, SymbolAnswer);
   const local2 = localSymbolHits(dirty2.shards, (shard, i2) => shard.symbols[i2]?.parent === void 0);
-  const base4 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state).filter((hit) => isUnder(hit.path, scope)) : [];
-  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
+  const base5 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state).filter((hit) => isUnder(hit.path, scope)) : [];
+  const merged = uniqueBy([...base5, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
   const limited = limitByTokens(merged, args2.max_tokens ?? 4e3);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
@@ -58074,8 +58422,8 @@ async function findSymbol(deps, args2) {
     const symbol2 = shard.symbols[i2];
     return symbol2 !== void 0 && matchesNamePath(shard, symbol2, wanted);
   });
-  const base4 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state) : [];
-  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
+  const base5 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state) : [];
+  const merged = uniqueBy([...base5, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
     symbols: withSnippets(deps.index, merged, args2.include_snippet === true)
@@ -58095,14 +58443,14 @@ async function findReferences(deps, args2) {
       local2.push({ path, symbol: args2.name, range, source: "local" });
     }
   }
-  const base4 = [];
+  const base5 = [];
   if (cloud.kind === "ok") {
     for (const hit of cloud.data.references) {
       const path = keepCloudPath(hit.path, state);
-      if (path !== null) base4.push({ ...hit, path, source: "cloud" });
+      if (path !== null) base5.push({ ...hit, path, source: "cloud" });
     }
   }
-  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.range.join(",")}`);
+  const merged = uniqueBy([...base5, ...local2], (h) => `${h.path}\0${h.range.join(",")}`);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
     references: withSnippets(deps.index, merged, args2.include_snippet === true)
@@ -58162,7 +58510,7 @@ var init_nav = __esm({
 
 // ../code-shim/src/edit.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "node:fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "node:fs";
 function lineStarts(text) {
   const starts = [0];
   for (let i2 = 0; i2 < text.length; i2 += 1) if (text[i2] === "\n") starts.push(i2 + 1);
@@ -58203,7 +58551,7 @@ async function editSymbol(index, args2) {
   if (!found.ok) return found;
   const absolute = resolveInside(index.root, args2.path);
   if (absolute === null) return { ok: false, reason: `path ${args2.path} is outside the repository` };
-  const original = readFileSync18(absolute, "utf8");
+  const original = readFileSync19(absolute, "utf8");
   const starts = lineStarts(original);
   const range = found.symbol.enclosingRange ?? found.symbol.range;
   const from = offsetOf(starts, original, range[0], range[1]);
@@ -58231,7 +58579,7 @@ ${args2.content.replace(/\n+$/, "")}`;
   const before = positionAt(next, changedStart);
   const after = positionAt(next, insertAt + inserted.length);
   const bytes = Buffer.from(next, "utf8");
-  writeFileSync10(absolute, bytes);
+  writeFileSync11(absolute, bytes);
   return {
     ok: true,
     path: args2.path,
@@ -58270,7 +58618,7 @@ async function renameSymbol(deps, args2) {
     if (absolute === null) return { ok: false, reason: `reference path ${path} is outside the repository` };
     let text;
     try {
-      text = readFileSync18(absolute, "utf8");
+      text = readFileSync19(absolute, "utf8");
     } catch {
       return { ok: false, reason: `cannot read ${path}` };
     }
@@ -58292,7 +58640,7 @@ async function renameSymbol(deps, args2) {
     let next = item.text;
     for (const offset of offsets) next = next.slice(0, offset) + args2.new_name + next.slice(offset + oldName.length);
     const bytes = Buffer.from(next, "utf8");
-    writeFileSync10(item.absolute, bytes);
+    writeFileSync11(item.absolute, bytes);
     filesChanged.push({ path: item.path, edits: offsets.length, sha256: sha2563(bytes) });
     edits += offsets.length;
   }
@@ -58420,12 +58768,12 @@ function shimSetting(env) {
 }
 function codeMapSwitch(env, results) {
   const setting = shimSetting(env);
-  const base4 = results === void 0 ? codeMapDefault(setting) : codeMapDefault(setting, results);
+  const base5 = results === void 0 ? codeMapDefault(setting) : codeMapDefault(setting, results);
   const forced = env["HARNESS_CODE_MAP"];
   if (forced === "on" || forced === "off") {
-    return { ...base4, on: forced === "on", basis: "project-setting", reason: `${forced}: set by HARNESS_CODE_MAP (the default for this setting is ${base4.on ? "on" : "off"}: ${base4.reason})`, source: "env" };
+    return { ...base5, on: forced === "on", basis: "project-setting", reason: `${forced}: set by HARNESS_CODE_MAP (the default for this setting is ${base5.on ? "on" : "off"}: ${base5.reason})`, source: "env" };
   }
-  return { ...base4, source: "default" };
+  return { ...base5, source: "default" };
 }
 function describeSwitch(state) {
   return `code-shim: code map ${state.on ? "on" : "off"} for ${state.setting} (${state.source}). ${state.reason}`;
@@ -58733,8 +59081,8 @@ var AuthRequiredError = class extends MvrxError {
     super(message, { code: "auth_required", exit: EXIT.auth }, { hint: "overlane auth status", ...options });
   }
 };
-function unreachable(base4, cause) {
-  return new CliError(`cannot reach ${base4}: ${cause instanceof Error ? cause.message : String(cause)}`, {
+function unreachable(base5, cause) {
+  return new CliError(`cannot reach ${base5}: ${cause instanceof Error ? cause.message : String(cause)}`, {
     code: "unreachable",
     exit: EXIT.unreachable,
     retryable: true,
@@ -59313,19 +59661,19 @@ function pkcePair() {
   return { verifier, challenge: base64url3(createHash("sha256").update(verifier).digest()) };
 }
 function listen(server2, port) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const onError = (error62) => reject(error62);
     server2.once("error", onError);
     server2.listen(port, "127.0.0.1", () => {
       server2.off("error", onError);
-      resolve16();
+      resolve17();
     });
   });
 }
 async function startLoopback(preferredPort, state) {
   let settle2;
-  const code2 = new Promise((resolve16, reject) => {
-    settle2 = { resolve: resolve16, reject };
+  const code2 = new Promise((resolve17, reject) => {
+    settle2 = { resolve: resolve17, reject };
   });
   code2.catch(() => void 0);
   const server2 = createServer((request, response) => {
@@ -59700,10 +60048,10 @@ async function failure2(response) {
   }
   return { code: void 0, text: `status ${response.status}` };
 }
-async function call(deps, base4, token, schema, method, path, body2) {
+async function call(deps, base5, token, schema, method, path, body2) {
   let response;
   try {
-    response = await deps.fetch(`${base4}${path}`, {
+    response = await deps.fetch(`${base5}${path}`, {
       method,
       headers: {
         accept: "application/json",
@@ -59713,7 +60061,7 @@ async function call(deps, base4, token, schema, method, path, body2) {
       ...body2 === void 0 ? {} : { body: JSON.stringify(body2) }
     });
   } catch (error62) {
-    throw unreachable(base4, error62);
+    throw unreachable(base5, error62);
   }
   if (!response.ok) {
     const failed = await failure2(response);
@@ -59730,12 +60078,12 @@ async function call(deps, base4, token, schema, method, path, body2) {
   return parsed.data;
 }
 function releaseClient(deps, binding, token, serviceUrl = binding.serviceUrl) {
-  const base4 = serviceUrl.replace(/\/+$/, "");
+  const base5 = serviceUrl.replace(/\/+$/, "");
   return {
-    list: () => call(deps, base4, token, external_exports.array(ReleaseRecord), "GET", releasePaths.list(binding.tenantId)),
-    get: (digest) => call(deps, base4, token, ReleaseRecord, "GET", releasePaths.one(binding.tenantId, digest)),
-    pin: (digest) => call(deps, base4, token, ProjectRecord, "PUT", releasePaths.pin(binding.tenantId, binding.projectId), { digest }),
-    rollback: () => call(deps, base4, token, ProjectRecord, "POST", releasePaths.rollback(binding.tenantId, binding.projectId), {})
+    list: () => call(deps, base5, token, external_exports.array(ReleaseRecord), "GET", releasePaths.list(binding.tenantId)),
+    get: (digest) => call(deps, base5, token, ReleaseRecord, "GET", releasePaths.one(binding.tenantId, digest)),
+    pin: (digest) => call(deps, base5, token, ProjectRecord, "PUT", releasePaths.pin(binding.tenantId, binding.projectId), { digest }),
+    rollback: () => call(deps, base5, token, ProjectRecord, "POST", releasePaths.rollback(binding.tenantId, binding.projectId), {})
   };
 }
 async function fetchServicePublicKey(deps, serviceUrl, token) {
@@ -60102,8 +60450,8 @@ function withTimeout(deps, ms) {
 }
 async function attempt(deps, ms, work) {
   let timer;
-  const deadline = new Promise((resolve16) => {
-    timer = setTimeout(() => resolve16("unreachable"), ms);
+  const deadline = new Promise((resolve17) => {
+    timer = setTimeout(() => resolve17("unreachable"), ms);
   });
   try {
     return await Promise.race([work(withTimeout(deps, ms)).catch((error62) => error62 instanceof ServiceError && error62.exit === EXIT.auth ? "unauthenticated" : "unreachable"), deadline]);
@@ -60341,13 +60689,13 @@ function render(op, existing) {
     case "block":
       return withBlock(existing, op.content);
     case "json": {
-      let base4 = op.base ?? {};
+      let base5 = op.base ?? {};
       if (existing !== null && existing.trim() !== "") {
         const parsed = JSON.parse(existing);
         if (!isRecord(parsed)) throw new Error(`${op.path} is not a JSON object; fix it by hand, then run the command again`);
-        base4 = parsed;
+        base5 = parsed;
       }
-      return `${JSON.stringify(setAt(base4, op.key, op.value), null, 2)}
+      return `${JSON.stringify(setAt(base5, op.key, op.value), null, 2)}
 `;
     }
   }
@@ -60900,12 +61248,12 @@ async function failure3(response) {
   return { text: `status ${response.status}`, code: void 0, hint: void 0 };
 }
 function serviceCall(deps, serviceUrl, token) {
-  const base4 = serviceUrl.replace(/\/+$/, "");
+  const base5 = serviceUrl.replace(/\/+$/, "");
   const approval = deps.env["OVERLANE_APPROVAL"];
   return async (schema, method, path, body2, extraHeaders) => {
     let response;
     try {
-      response = await deps.fetch(`${base4}${path}`, {
+      response = await deps.fetch(`${base5}${path}`, {
         method,
         headers: {
           accept: "application/json",
@@ -60917,7 +61265,7 @@ function serviceCall(deps, serviceUrl, token) {
         ...body2 === void 0 ? {} : { body: JSON.stringify(body2) }
       });
     } catch (error62) {
-      throw unreachable(base4, error62);
+      throw unreachable(base5, error62);
     }
     if (!response.ok) {
       const failed = await failure3(response);
@@ -63247,12 +63595,12 @@ init_zod();
 init_src();
 init_zod();
 var ErrorBody = external_exports.object({ error: external_exports.object({ code: external_exports.string(), message: external_exports.string() }).passthrough() }).passthrough();
-async function post(deps, base4, path, body2) {
+async function post(deps, base5, path, body2) {
   let response;
   try {
-    response = await deps.fetch(`${base4}${path}`, { method: "POST", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(body2) });
+    response = await deps.fetch(`${base5}${path}`, { method: "POST", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(body2) });
   } catch (error62) {
-    throw unreachable(base4, error62);
+    throw unreachable(base5, error62);
   }
   let json2 = null;
   try {
@@ -63263,7 +63611,7 @@ async function post(deps, base4, path, body2) {
   return { status: response.status, json: json2 };
 }
 function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 async function deviceLogin(deps, service, options) {
   const started = await post(deps, service, "/auth/device", {});
@@ -63592,8 +63940,8 @@ var tokenListCommand = defineCommand({
 });
 var tokenRevokeCommand = defineCommand({
   path: ["token", "revoke"],
-  summary: "Revoke an agent token; it stops working within seconds",
-  description: "Revokes an agent token. The next call made with it fails with exit 3 (token_revoked). You can revoke your own tokens; a team-wide agent token can revoke any. This cannot be undone: mint a new token instead.",
+  summary: "Revoke a token: an agent token stops working within seconds",
+  description: "Revoke a token that leaked or is no longer needed: the agent token stops working. The next call made with it fails with exit 3 (token_revoked). You can revoke your own tokens; a team-wide agent token can revoke any token. To revoke a token, give its token ID from `overlane token list`. This cannot be undone: mint a new token instead.",
   args: [{ name: "token-id", required: false, description: "The token ID from `overlane token list` (required)" }],
   flags: [SERVICE_FLAG2, TEAM_FLAG2],
   examples: ["overlane token revoke tok_abc123 --force", "overlane token revoke tok_abc123 --dry-run"],
@@ -64382,9 +64730,9 @@ var prOpenCommand = defineCommand({
     const head = textFlag(inv, "head");
     const title = textFlag(inv, "title");
     if (head === void 0 || title === void 0) throw new UsageError("--head and --title are required", { hint: 'overlane repo pr open app --head feature/x --title "Add x"' });
-    const base4 = textFlag(inv, "base");
+    const base5 = textFlag(inv, "base");
     const text = textFlag(inv, "body");
-    const body2 = { requestId: requestId4(), title, head, ...base4 === void 0 ? {} : { base: base4 }, ...text === void 0 ? {} : { body: text }, draft: boolFlag(inv, "draft") };
+    const body2 = { requestId: requestId4(), title, head, ...base5 === void 0 ? {} : { base: base5 }, ...text === void 0 ? {} : { body: text }, draft: boolFlag(inv, "draft") };
     if (inv.dryRun) return planned2(inv, "repo", "POST", (t2, p2) => gitPaths.pulls(t2, p2, repo), body2);
     const { call: call2, tenantId, projectId } = await connected2(inv, "repo");
     return { data: await call2(PullRequest, "POST", gitPaths.pulls(tenantId, projectId, repo), body2) };
@@ -67074,19 +67422,19 @@ async function connectKit(deps, options) {
   if (options.dryRun) {
     const inner = await connect(deps, { ...options, dryRun: true });
     say(deps, "Dry run: no file was written and no branch, commit or service change was made.");
-    const base4 = inner.data !== void 0 && "dryRun" in inner.data ? inner.data : dryRunPlan({});
+    const base5 = inner.data !== void 0 && "dryRun" in inner.data ? inner.data : dryRunPlan({});
     const writes = [
       ...planExists ? [] : [{ path: `${PLAN_DIR}/`, action: "write", description: planSource }],
       ...workflow === null ? [] : [{ path: CI_FILE, action: "write", description: "CI workflow with pinned actions" }],
       ...blockChanges.map((entry) => ({ path: entry.file, action: entry.before === null ? "write" : "append", description: "the run-step block" })),
-      ...base4.writes
+      ...base5.writes
     ];
     return {
       data: {
-        ...base4,
-        commands: [`git switch -c ${KIT_BRANCH}`, ...base4.commands, `git commit -m "Set up the project kit"`],
+        ...base5,
+        commands: [`git switch -c ${KIT_BRANCH}`, ...base5.commands, `git commit -m "Set up the project kit"`],
         writes,
-        notes: [...base4.notes, `Plan: ${planSource} (${summary2.milestones} milestone(s), ${summary2.tasks} task(s)); CI: ${ciSummary}; then the run policy is set, the plan synced and one pull request opened (or its commands printed).`]
+        notes: [...base5.notes, `Plan: ${planSource} (${summary2.milestones} milestone(s), ${summary2.tasks} task(s)); CI: ${ciSummary}; then the run policy is set, the plan synced and one pull request opened (or its commands printed).`]
       }
     };
   }
@@ -67110,11 +67458,11 @@ async function connectKit(deps, options) {
   const agentConfig = [join23(".claude", "settings.json"), join23(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
   const preExisting = new Set(agentConfig.filter((file2) => existsSync7(join23(root, file2))));
-  const connected10 = await connect(deps, { ...options, yes: true });
-  if (connected10.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const connected11 = await connect(deps, { ...options, yes: true });
+  if (connected11.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected10.data !== void 0 && !("dryRun" in connected10.data) ? connected10.data : void 0;
+  const connectData = connected11.data !== void 0 && !("dryRun" in connected11.data) ? connected11.data : void 0;
   for (const file2 of agentConfig) {
     if (!existsSync7(join23(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
@@ -67200,7 +67548,7 @@ var connectCommand = defineCommand({
   keywords: ["setup", "install", "bind", "link", "onboard", "register plugin", "bootstrap", "autonomous", "plan", "kit", "get started", "initialise", "enable harness", "ci workflow", "pull request"],
   result: external_exports.union([ConnectAny, ConnectKitResult]),
   handler: async (inv) => {
-    const base4 = {
+    const base5 = {
       service: textFlag(inv, "service"),
       marketplaceRoot: textFlag(inv, "marketplace-root"),
       agents: parseAgentList(textFlag(inv, "agents")),
@@ -67213,10 +67561,10 @@ var connectCommand = defineCommand({
     const goal = textFlag(inv, "goal");
     if (kit === void 0) {
       if (goal !== void 0) throw new UsageError("--goal belongs to --kit new", { hint: "overlane schema connect" });
-      return connect(inv.deps, base4);
+      return connect(inv.deps, base5);
     }
     if (kit !== "existing" && kit !== "new") throw new UsageError("--kit must be existing or new");
-    return connectKit(inv.deps, { ...base4, mode: kit, goal });
+    return connectKit(inv.deps, { ...base5, mode: kit, goal });
   }
 });
 var doctorCommand = defineCommand({
@@ -69652,11 +70000,11 @@ async function planned7(inv, method, path, body2, note) {
 var git4 = (deps, args2) => deps.exec("git", args2, { cwd: deps.paths.cwd });
 var MAX_PATCH_FILES = 40;
 var MAX_PATCH_CHARS = 8e3;
-async function snapshotOf(inv, head, base4) {
+async function snapshotOf(inv, head, base5) {
   const sha = await git4(inv.deps, ["rev-parse", "--verify", "--quiet", `${head}^{commit}`]);
   if (sha.code !== 0) throw new UsageError(`${head} is not a commit in this checkout`, { hint: "git fetch, then retry" });
-  const stat = await git4(inv.deps, ["diff", "--numstat", "-z", "--no-renames", `${base4}...${head}`]);
-  if (stat.code !== 0) throw new UsageError(`could not compare ${base4} with ${head}: ${stat.stderr.trim().split("\n")[0] ?? "git failed"}`, { hint: "pass --base with a branch that exists, for example --base origin/main" });
+  const stat = await git4(inv.deps, ["diff", "--numstat", "-z", "--no-renames", `${base5}...${head}`]);
+  if (stat.code !== 0) throw new UsageError(`could not compare ${base5} with ${head}: ${stat.stderr.trim().split("\n")[0] ?? "git failed"}`, { hint: "pass --base with a branch that exists, for example --base origin/main" });
   const files = [];
   for (const entry of stat.stdout.split("\0")) {
     const match = /^(\d+|-)\t(\d+|-)\t(.+)$/s.exec(entry);
@@ -69664,12 +70012,12 @@ async function snapshotOf(inv, head, base4) {
     files.push({ path: match[3], status: "modified", additions: match[1] === "-" ? 0 : Number(match[1]), deletions: match[2] === "-" ? 0 : Number(match[2]) });
   }
   for (const file2 of files.slice(0, MAX_PATCH_FILES)) {
-    const patch = await git4(inv.deps, ["diff", "--unified=2", `${base4}...${head}`, "--", file2.path]);
+    const patch = await git4(inv.deps, ["diff", "--unified=2", `${base5}...${head}`, "--", file2.path]);
     if (patch.code === 0 && patch.stdout !== "") file2.patch = patch.stdout.slice(0, MAX_PATCH_CHARS);
   }
   const project = await detectProject(inv.deps);
   const repository = textFlag(inv, "repo") ?? (project.repository === void 0 ? `overlane/${project.name.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 80) || "project"}` : `${project.repository.owner}/${project.repository.name}`);
-  return { provider: project.provider === "github" ? "github" : "overlane", repository, headSha: sha.stdout.trim(), baseRef: base4, files };
+  return { provider: project.provider === "github" ? "github" : "overlane", repository, headSha: sha.stdout.trim(), baseRef: base5, files };
 }
 function numberOf(inv) {
   const text = textFlag(inv, "number");
@@ -69721,11 +70069,11 @@ var prRouteCommand = defineCommand({
   handler: async (inv) => {
     const number4 = numberOf(inv);
     const head = textFlag(inv, "head") ?? "HEAD";
-    let base4 = textFlag(inv, "base");
-    if (base4 === void 0) base4 = (await git4(inv.deps, ["rev-parse", "--verify", "--quiet", "origin/main"])).code === 0 ? "origin/main" : "main";
+    let base5 = textFlag(inv, "base");
+    if (base5 === void 0) base5 = (await git4(inv.deps, ["rev-parse", "--verify", "--quiet", "origin/main"])).code === 0 ? "origin/main" : "main";
     const critical = textFlag(inv, "critical");
     if (critical !== void 0 && !/^\d+$/.test(critical)) throw new UsageError("--critical is a whole number");
-    const snapshot = await snapshotOf(inv, head, base4);
+    const snapshot = await snapshotOf(inv, head, base5);
     const body2 = {
       requestId: requestId12(),
       pull: { provider: snapshot.provider, repository: snapshot.repository, number: number4, headSha: snapshot.headSha, title: textFlag(inv, "title") ?? `Pull request ${number4}`, body: "", author: textFlag(inv, "author") ?? "unknown", fork: boolFlag(inv, "fork"), files: snapshot.files },
@@ -70060,17 +70408,678 @@ var egressScanCommand = defineCommand({
 });
 var egressCommands = [egressPolicyShowCommand, egressPolicySetCommand, egressCheckCommand, egressEventsCommand, egressGrantCommand, egressGrantsCommand, egressRevokeCommand, egressScanCommand];
 
+// ../cli/src/commands/enterprise.ts
+init_src();
+init_zod();
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
+var common20 = { needsAuth: true, needsNetwork: true };
+async function connected9(inv) {
+  const project = await connectedProject(inv.deps, "enterprise");
+  return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId };
+}
+async function planned9(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "enterprise");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+async function secretValue2(inv, envFlag) {
+  const name2 = textFlag(inv, envFlag);
+  if (name2 !== void 0) {
+    const value = inv.deps.env[name2];
+    if (value === void 0 || value === "") throw new UsageError(`${name2} is not set`, { hint: `export ${name2}=... then run the command again` });
+    return value;
+  }
+  if (inv.deps.stdin !== void 0 && !inv.deps.stdin.isTTY) {
+    const text = (await inv.deps.stdin.read()).trim();
+    if (text !== "") return text;
+  }
+  throw new UsageError("give the key through --value-env NAME or on standard input; it is never an argument", { hint: "overlane enterprise keys add --alias team-anthropic --provider anthropic --value-env PROVIDER_KEY" });
+}
+var enterpriseStatusCommand = defineCommand({
+  path: ["enterprise", "status"],
+  summary: "Show which enterprise features this team's plan includes",
+  description: "Lists single sign-on, directory sync, audit export, SIEM stream, data region, bring-your-own-key, retention, policy as code and the MCP allowlist, each as included or not. All are Business and above.",
+  examples: ["overlane enterprise status", "overlane enterprise status --json"],
+  effect: "read",
+  ...common20,
+  keywords: ["enterprise", "sso", "plan features", "what does my plan include"],
+  result: EnterpriseEntitlements,
+  text: (d) => [`plan: ${d.plan}`, ...Object.entries(d.features).map(([name2, on]) => `${on ? "included    " : "not included"}  ${name2}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(EnterpriseEntitlements, "GET", enterprisePaths.entitlements(tenantId)) };
+  }
+});
+var enterpriseSsoLinkCommand = defineCommand({
+  path: ["enterprise", "sso", "link"],
+  summary: "Print a short-lived link to the identity provider's hosted setup portal",
+  description: "Issues a setup link for single sign-on (SAML or OpenID Connect) or for directory sync (SCIM). The link expires in minutes and is the credential: open it yourself or hand it to the person who administers the identity provider. Issuing a link is recorded in the audit log.",
+  flags: [{ name: "intent", type: "string", enum: ["sso", "dsync"], default: "sso", value: "INTENT", description: "sso (default) or dsync for the directory" }],
+  examples: ["overlane enterprise sso link", "overlane enterprise sso link --intent dsync"],
+  effect: "write",
+  ...common20,
+  keywords: ["saml", "oidc", "scim", "directory sync", "admin portal", "set up sso"],
+  result: withDryRun(PortalLink),
+  text: (d) => "url" in d ? [`open: ${d.url}`, `expires: ${d.expiresAt}`] : [],
+  handler: async (inv) => {
+    const intent = textFlag(inv, "intent") ?? "sso";
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.portalLink, { intent }, "returns a short-lived link");
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(PortalLink, "POST", enterprisePaths.portalLink(tenantId), { intent }) };
+  }
+});
+var enterpriseSyncCommand = defineCommand({
+  path: ["enterprise", "sso", "sync"],
+  summary: "Sync the directory now: apply group roles and deprovision removed people",
+  description: "Reads the directory and applies it. A person marked inactive loses access, their agent access ends and their leases are released. The same sync runs every five minutes on its own; the report says how long each removal took against the five-minute deadline.",
+  examples: ["overlane enterprise sso sync"],
+  effect: "write",
+  ...common20,
+  keywords: ["scim sync", "deprovision", "directory"],
+  result: withDryRun(DirectorySyncReport),
+  text: (d) => "syncedAt" in d ? [`synced ${d.syncedAt}: ${d.rolesChanged} role changes, ${d.deprovisioned} removed${d.withinDeadline ? "" : " (some later than five minutes)"}`] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.syncDirectory, {});
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(DirectorySyncReport, "POST", enterprisePaths.syncDirectory(tenantId), {}) };
+  }
+});
+var ExportResult = external_exports.object({ file: external_exports.string(), manifestFile: external_exports.string(), manifest: AuditExportManifest }).strict();
+var enterpriseAuditExportCommand = defineCommand({
+  path: ["enterprise", "audit", "export"],
+  summary: "Export the tamper-evident audit log as CSV, with a manifest, to files",
+  description: "Writes the whole log as CSV (every row with the hashes that chain it) and a manifest with the row count and the head hash. Exporting is itself recorded in the audit log. Check the files later with `overlane enterprise audit verify`.",
+  flags: [{ name: "out", type: "string", default: "audit.csv", value: "FILE", description: "Where to write the CSV (default audit.csv); the manifest goes beside it as FILE.manifest.json" }],
+  examples: ["overlane enterprise audit export --out audit-2026-10.csv"],
+  effect: "write",
+  ...common20,
+  keywords: ["audit csv", "export audit log", "compliance export", "siem file"],
+  result: withDryRun(ExportResult),
+  text: (d) => "manifest" in d ? [`wrote ${d.manifest.count} rows to ${d.file}`, `manifest: ${d.manifestFile}`, `head: ${d.manifest.head ?? "none"}`] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.auditExports, {}, "writes the CSV and the manifest to local files");
+    const { call: call2, tenantId } = await connected9(inv);
+    const exported = await call2(AuditExport, "POST", enterprisePaths.auditExports(tenantId), {});
+    const file2 = resolve13(inv.deps.paths.cwd, textFlag(inv, "out") ?? "audit.csv");
+    const manifestFile = `${file2}.manifest.json`;
+    writeFileSync9(file2, exported.csv);
+    writeFileSync9(manifestFile, `${JSON.stringify(exported.manifest, null, 2)}
+`);
+    return { data: { file: file2, manifestFile, manifest: exported.manifest } };
+  }
+});
+var VerifyResult = external_exports.object({ ok: external_exports.boolean(), tenantId: external_exports.string(), checked: external_exports.number(), head: external_exports.string().nullable(), manifestOk: external_exports.boolean(), brokenAt: external_exports.number().optional(), reason: external_exports.string().optional() }).strict();
+var enterpriseAuditVerifyCommand = defineCommand({
+  path: ["enterprise", "audit", "verify"],
+  summary: "Check an exported audit CSV offline; exits 1 if any row was altered, removed or reordered",
+  description: "Re-computes the hash chain of the file and compares the row count, last sequence and head hash with the manifest, so a removed newest row is found as well. Needs no network and no account.",
+  args: [{ name: "file", required: true, description: "The exported CSV" }],
+  flags: [{ name: "manifest", type: "string", value: "FILE", description: "The manifest (default FILE.manifest.json)" }],
+  examples: ["overlane enterprise audit verify audit.csv"],
+  effect: "read",
+  needsAuth: false,
+  needsNetwork: false,
+  keywords: ["verify audit export", "tamper check", "audit chain"],
+  result: VerifyResult,
+  text: (d) => [d.ok ? `OK: ${d.checked} rows verified, head ${d.head ?? "none"}` : `FAILED${d.brokenAt === void 0 ? "" : ` at row ${d.brokenAt}`}${d.reason === void 0 ? "" : ` (${d.reason})`}${d.manifestOk ? "" : "; the manifest does not match the file"}`],
+  handler: async (inv) => {
+    const file2 = inv.positionals[0];
+    if (file2 === void 0) throw new UsageError("give the exported CSV", { hint: "overlane enterprise audit verify audit.csv" });
+    const path = resolve13(inv.deps.paths.cwd, file2);
+    const manifestPath = resolve13(inv.deps.paths.cwd, textFlag(inv, "manifest") ?? `${file2}.manifest.json`);
+    let manifest;
+    let csv;
+    try {
+      csv = readFileSync14(path, "utf8");
+      manifest = AuditExportManifest.parse(JSON.parse(readFileSync14(manifestPath, "utf8")));
+    } catch {
+      throw new UsageError(`could not read ${file2} and its manifest`, { hint: "overlane enterprise audit export --out audit.csv" });
+    }
+    const result = verifyAuditExport(manifest.tenantId, csv, manifest);
+    const data = { ok: result.ok, tenantId: result.tenantId, checked: result.checked, head: result.head, manifestOk: result.manifestOk, ...result.brokenAt === void 0 ? {} : { brokenAt: result.brokenAt }, ...result.reason === void 0 ? {} : { reason: result.reason } };
+    return result.ok ? { data } : { data, exit: EXIT.failure, error: new CliError("the audit export failed verification", { code: "audit_tampered", exit: EXIT.failure, quiet: true }) };
+  }
+});
+var StreamAdded = external_exports.object({ target: AuditStreamTarget }).strict();
+var enterpriseStreamAddCommand = defineCommand({
+  path: ["enterprise", "audit", "stream", "add"],
+  summary: "Add a SIEM stream target: an https address and a signing secret you choose",
+  description: "Deliveries are signed with HMAC-SHA-256 over `timestamp.body` using your secret and carry an idempotency key, so your SIEM can de-duplicate the at-least-once delivery. The secret is read from an environment variable or standard input, stored encrypted and never shown again.",
+  flags: [
+    { name: "url", type: "string", required: true, value: "URL", description: "The https address that receives deliveries" },
+    { name: "secret-env", type: "string", value: "NAME", description: "Name of the environment variable holding the signing secret (16 characters or more)" }
+  ],
+  examples: ["overlane enterprise audit stream add --url https://siem.example.com/ingest --secret-env SIEM_SECRET"],
+  effect: "write",
+  ...common20,
+  keywords: ["siem", "splunk", "stream audit", "log forwarding"],
+  result: withDryRun(StreamAdded),
+  text: (d) => "target" in d ? [`target ${d.target.targetId} -> ${d.target.url}`, "The signing secret is stored encrypted and will not be shown again."] : [],
+  handler: async (inv) => {
+    const url2 = textFlag(inv, "url");
+    if (url2 === void 0) throw new UsageError("add needs --url", { hint: "overlane enterprise audit stream add --url https://siem.example.com/ingest --secret-env SIEM_SECRET" });
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.streamTargets, { url: url2, signingSecret: "(read from the environment; not shown)" });
+    const signingSecret = await secretValue2(inv, "secret-env");
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(StreamAdded, "POST", enterprisePaths.streamTargets(tenantId), { url: url2, signingSecret }) };
+  }
+});
+var ResidencyShow = external_exports.object({ policy: ResidencyPolicy, stores: StoreLocationReport.nullable() }).strict();
+var enterpriseRegionShowCommand = defineCommand({
+  path: ["enterprise", "region", "show"],
+  summary: "Show the data region and where each store holds the team's data",
+  description: "Prints the pinned region, the supported regions and the store-location check: D1, R2, KV, Durable Objects, vectors, logs and backups, each with the region it holds.",
+  examples: ["overlane enterprise region show"],
+  effect: "read",
+  ...common20,
+  keywords: ["data residency", "region", "where is my data"],
+  result: ResidencyShow,
+  text: (d) => [`region: ${d.policy.region}  (supported: ${d.policy.supportedRegions.join(", ")})`, ...d.stores === null ? [] : [d.stores.ok ? "every store holds the data in the region" : `violations: ${d.stores.violations.join("; ")}`, ...d.stores.stores.map((s) => `${s.store.padEnd(16)} ${s.region}`)]],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    const policy = await call2(ResidencyPolicy, "GET", enterprisePaths.residency(tenantId));
+    const stores = policy.pinnedAt === null ? null : await call2(StoreLocationReport, "GET", enterprisePaths.storeLocations(tenantId));
+    return { data: { policy, stores } };
+  }
+});
+var enterpriseRegionSetCommand = defineCommand({
+  path: ["enterprise", "region", "set"],
+  summary: "Pin the team's data to a region, or request a migration to another one",
+  description: "The first call pins the region (the choice made at team creation). Once pinned, a change needs --reason and is an audited migration; data is never placed outside the chosen region. A region the stores cannot all hold is refused with the supported list.",
+  flags: [
+    { name: "region", type: "string", required: true, enum: ["global", "eu", "us"], value: "REGION", description: "global (no pin), eu or us" },
+    { name: "reason", type: "string", value: "TEXT", description: "Why the region changes (needed when the team is already pinned)" }
+  ],
+  examples: ["overlane enterprise region set --region eu", "overlane enterprise region set --region us --reason 'customer request'"],
+  effect: "write",
+  ...common20,
+  keywords: ["pin region", "move region", "eu data", "residency migration"],
+  result: withDryRun(ResidencyPolicy),
+  text: (d) => "region" in d ? [`region: ${d.region}${d.pendingMigration === null ? "" : `  last migration ${d.pendingMigration.from} to ${d.pendingMigration.to}: ${d.pendingMigration.status}`}`] : [],
+  handler: async (inv) => {
+    const region = textFlag(inv, "region");
+    if (region === void 0) throw new UsageError("set needs --region", { hint: "overlane enterprise region set --region eu" });
+    const reason = textFlag(inv, "reason");
+    if (inv.dryRun) return planned9(inv, reason === void 0 ? "PUT" : "POST", (t2) => reason === void 0 ? enterprisePaths.residency(t2) : enterprisePaths.residencyMigrations(t2), reason === void 0 ? { region } : { to: region, reason });
+    const { call: call2, tenantId } = await connected9(inv);
+    const current2 = await call2(ResidencyPolicy, "GET", enterprisePaths.residency(tenantId));
+    if (current2.pinnedAt === null) return { data: await call2(ResidencyPolicy, "PUT", enterprisePaths.residency(tenantId), { region }) };
+    if (reason === void 0) throw new UsageError("the team is already pinned; a change is a migration and needs --reason", { hint: `overlane enterprise region set --region ${region} --reason 'why'` });
+    return { data: await call2(ResidencyPolicy, "POST", enterprisePaths.residencyMigrations(tenantId), { to: region, reason }) };
+  }
+});
+var KeyList = external_exports.object({ tenantId: external_exports.string(), keys: external_exports.array(ByokKey) }).strict();
+var KeyOne = external_exports.object({ key: ByokKey }).strict();
+var KeyTested = external_exports.object({ result: ByokTestResult, key: ByokKey }).strict();
+var keyLine = (k) => `${k.alias.padEnd(24)} ${k.provider.padEnd(10)} ${k.status.padEnd(9)} v${k.version}  tested ${k.lastTestedAt ?? "never"}`;
+var enterpriseKeysListCommand = defineCommand({
+  path: ["enterprise", "keys", "list"],
+  summary: "List bring-your-own inference keys by alias, provider and status",
+  description: "Shows aliases and states only. A key value is never shown after it is added.",
+  examples: ["overlane enterprise keys list"],
+  effect: "read",
+  ...common20,
+  keywords: ["byok", "inference keys", "api keys"],
+  result: KeyList,
+  text: (d) => d.keys.length === 0 ? ["No keys. Inference runs on the hosted models."] : d.keys.map(keyLine),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(KeyList, "GET", enterprisePaths.byokKeys(tenantId)) };
+  }
+});
+var enterpriseKeysAddCommand = defineCommand({
+  path: ["enterprise", "keys", "add"],
+  summary: "Add an inference key under an alias; the value comes from the environment or stdin",
+  description: "The value is read from the variable named by --value-env, or from standard input, sent once and stored encrypted. It is never an argument, never printed and never shown again. Test it with `overlane enterprise keys test`; inference uses the alias.",
+  flags: [
+    { name: "alias", type: "string", required: true, value: "ALIAS", description: "Lowercase letters, digits and hyphens" },
+    { name: "provider", type: "string", required: true, enum: ["anthropic", "openai", "google"], value: "PROVIDER", description: "The key's provider" },
+    { name: "value-env", type: "string", value: "NAME", description: "Name of the environment variable holding the key (default: read standard input)" }
+  ],
+  examples: ["overlane enterprise keys add --alias team-anthropic --provider anthropic --value-env PROVIDER_KEY", "overlane enterprise keys add --alias team-anthropic --provider anthropic < key.txt"],
+  effect: "write",
+  ...common20,
+  keywords: ["add byok key", "bring your own key", "provider key"],
+  result: withDryRun(KeyOne),
+  text: (d) => "key" in d ? [keyLine(d.key), "The value is stored encrypted and will not be shown again."] : [],
+  handler: async (inv) => {
+    const alias = textFlag(inv, "alias");
+    const provider = textFlag(inv, "provider");
+    if (alias === void 0 || provider === void 0) throw new UsageError("add needs --alias and --provider", { hint: "overlane enterprise keys add --alias team-anthropic --provider anthropic --value-env PROVIDER_KEY" });
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.byokKeys, { alias, provider, value: "(read from the environment; not shown)" });
+    const value = await secretValue2(inv, "value-env");
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(KeyOne, "POST", enterprisePaths.byokKeys(tenantId), { alias, provider, value }) };
+  }
+});
+var aliasArg = [{ name: "alias", required: false, description: "The key's alias (required)" }];
+var aliasOf = (inv) => {
+  const alias = inv.positionals[0];
+  if (alias === void 0) throw new UsageError("give the key's alias", { hint: "overlane enterprise keys test team-anthropic" });
+  return alias;
+};
+var enterpriseKeysTestCommand = defineCommand({
+  path: ["enterprise", "keys", "test"],
+  summary: "Test a key against its provider; a key that fails is not used for inference",
+  description: "Makes a minimal call to the provider with the stored key and records the result. The key is not printed.",
+  args: aliasArg,
+  examples: ["overlane enterprise keys test team-anthropic"],
+  effect: "write",
+  ...common20,
+  keywords: ["check key", "validate key"],
+  result: withDryRun(KeyTested),
+  text: (d) => "result" in d ? [`${d.result.ok ? "passed" : "failed"}: ${d.result.detail}`, keyLine(d.key)] : [],
+  handler: async (inv) => {
+    const alias = aliasOf(inv);
+    if (inv.dryRun) return planned9(inv, "POST", (t2) => enterprisePaths.byokTest(t2, alias), {});
+    const { call: call2, tenantId } = await connected9(inv);
+    const out2 = await call2(KeyTested, "POST", enterprisePaths.byokTest(tenantId, alias), {});
+    return out2.result.ok ? { data: out2 } : { data: out2, exit: EXIT.failure, error: new CliError(`the provider refused ${alias}`, { code: "byok_test_failed", exit: EXIT.failure, quiet: true }) };
+  }
+});
+var enterpriseKeysRotateCommand = defineCommand({
+  path: ["enterprise", "keys", "rotate"],
+  summary: "Replace a key's value under the same alias; the old value stays if the provider refuses the new one",
+  description: "The new value is read like `keys add` reads it, checked with the provider first, then stored encrypted. The alias and everything that uses it stay the same.",
+  args: aliasArg,
+  flags: [{ name: "value-env", type: "string", value: "NAME", description: "Name of the environment variable holding the new key (default: read standard input)" }],
+  examples: ["overlane enterprise keys rotate team-anthropic --value-env NEW_PROVIDER_KEY"],
+  effect: "write",
+  ...common20,
+  keywords: ["rotate key", "replace key"],
+  result: withDryRun(KeyOne),
+  text: (d) => "key" in d ? [keyLine(d.key)] : [],
+  handler: async (inv) => {
+    const alias = aliasOf(inv);
+    if (inv.dryRun) return planned9(inv, "POST", (t2) => enterprisePaths.byokRotate(t2, alias), { value: "(read from the environment; not shown)" });
+    const value = await secretValue2(inv, "value-env");
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(KeyOne, "POST", enterprisePaths.byokRotate(tenantId, alias), { value }) };
+  }
+});
+var enterpriseKeysRevokeCommand = defineCommand({
+  path: ["enterprise", "keys", "revoke"],
+  summary: "Disable a key for good: the stored value is deleted and inference by that alias is refused",
+  description: "This cannot be undone; add a new key to use the provider again. Doing it twice changes nothing.",
+  args: aliasArg,
+  examples: ["overlane enterprise keys revoke team-anthropic"],
+  effect: "destructive",
+  ...common20,
+  keywords: ["delete key", "disable key"],
+  result: withDryRun(KeyOne),
+  text: (d) => "key" in d ? [keyLine(d.key)] : [],
+  handler: async (inv) => {
+    const alias = aliasOf(inv);
+    if (inv.dryRun) return planned9(inv, "DELETE", (t2) => enterprisePaths.byokKey(t2, alias));
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(KeyOne, "DELETE", enterprisePaths.byokKey(tenantId, alias)) };
+  }
+});
+var enterpriseRetentionShowCommand = defineCommand({
+  path: ["enterprise", "retention", "show"],
+  summary: "Show the retention rules per data class",
+  description: "Classes: memory, derived_data, agent_conversations, ci_artifacts and run_logs. The audit log is exported, never purged by age.",
+  examples: ["overlane enterprise retention show"],
+  effect: "read",
+  ...common20,
+  keywords: ["retention policy", "how long is data kept"],
+  result: EnterpriseRetentionPolicy,
+  text: (d) => d.rules.length === 0 ? ["No rules: nothing is purged by age."] : d.rules.map((r) => `${r.dataClass.padEnd(20)} ${r.days} days`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(EnterpriseRetentionPolicy, "GET", enterprisePaths.retention(tenantId)) };
+  }
+});
+var enterpriseRetentionSetCommand = defineCommand({
+  path: ["enterprise", "retention", "set"],
+  summary: "Set retention rules, replacing the current ones",
+  description: "Each --rule is CLASS=DAYS, for example memory=365. Records older than the days are purged on schedule and reported. Changing retention is a policy change.",
+  flags: [{ name: "rule", type: "string", multiple: true, required: true, value: "CLASS=DAYS", description: "A rule; repeat for more" }],
+  examples: ["overlane enterprise retention set --rule memory=365 --rule run_logs=90"],
+  effect: "write",
+  ...common20,
+  keywords: ["set retention", "purge after days"],
+  result: withDryRun(EnterpriseRetentionPolicy),
+  text: (d) => "rules" in d ? d.rules.map((r) => `${r.dataClass.padEnd(20)} ${r.days} days`) : [],
+  handler: async (inv) => {
+    const raw = inv.values["rule"];
+    const texts = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((v) => typeof v === "string");
+    const rules = texts.map((text) => {
+      const [dataClass, days] = text.split("=");
+      if (dataClass === void 0 || days === void 0 || !/^\d{1,4}$/.test(days)) throw new UsageError(`${text}: use CLASS=DAYS, for example memory=365`);
+      return { dataClass, days: Number(days) };
+    });
+    if (inv.dryRun) return planned9(inv, "PUT", enterprisePaths.retention, { rules });
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(EnterpriseRetentionPolicy, "PUT", enterprisePaths.retention(tenantId), { rules }) };
+  }
+});
+var enterprisePurgeCommand = defineCommand({
+  path: ["enterprise", "retention", "purge"],
+  summary: "Run the retention purge now and print the report",
+  description: "Removes records older than each class's days, and derived text and vectors whose item is gone. Idempotent. Purging is an irreversible deletion.",
+  examples: ["overlane enterprise retention purge"],
+  effect: "destructive",
+  ...common20,
+  keywords: ["purge now", "delete old data"],
+  result: withDryRun(PurgeReport),
+  text: (d) => "lines" in d ? [`purge ${d.purgeId}: ${d.totalPurged} records removed`, ...d.lines.map((l) => `${l.dataClass.padEnd(20)} ${l.store.padEnd(8)} ${l.purged}`)] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.purge, {});
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(PurgeReport, "POST", enterprisePaths.purge(tenantId), {}) };
+  }
+});
+var DataFlags = [
+  { name: "scope", type: "string", enum: ["tenant", "project", "user"], default: "tenant", value: "SCOPE", description: "tenant (default), project or user" },
+  { name: "subject", type: "string", value: "ID", description: "The project or user ID for a project or user scope" }
+];
+var dataBody = (inv) => {
+  const scope = textFlag(inv, "scope") ?? "tenant";
+  const subject = textFlag(inv, "subject");
+  if (scope !== "tenant" && subject === void 0) throw new UsageError(`a ${scope} scope needs --subject`, { hint: `overlane enterprise data export --scope ${scope} --subject ID` });
+  return { scope, ...subject === void 0 ? {} : { subjectId: subject } };
+};
+var DataExported = external_exports.object({ file: external_exports.string(), totalRows: external_exports.number(), stores: DataExportReport.shape.stores }).strict();
+var enterpriseDataExportCommand = defineCommand({
+  path: ["enterprise", "data", "export"],
+  summary: "Export the team's own data (or one project's or user's) as NDJSON",
+  description: "Writes memory, derived text, vectors (metadata only), conversations, CI records, logs and, for the tenant scope, the audit log, one JSON record per line. Open to every plan.",
+  flags: [...DataFlags, { name: "out", type: "string", default: "export.ndjson", value: "FILE", description: "Where to write the file" }],
+  examples: ["overlane enterprise data export --out export.ndjson", "overlane enterprise data export --scope project --subject prj-1"],
+  effect: "write",
+  ...common20,
+  keywords: ["export my data", "data portability", "gdpr export"],
+  result: withDryRun(DataExported),
+  text: (d) => "file" in d ? [`wrote ${d.totalRows} records to ${d.file}`] : [],
+  handler: async (inv) => {
+    const body2 = dataBody(inv);
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.dataExport, body2, "writes a local file");
+    const { call: call2, tenantId } = await connected9(inv);
+    const report2 = await call2(DataExportReport, "POST", enterprisePaths.dataExport(tenantId), body2);
+    const file2 = resolve13(inv.deps.paths.cwd, textFlag(inv, "out") ?? "export.ndjson");
+    writeFileSync9(file2, report2.ndjson);
+    return { data: { file: file2, totalRows: report2.totalRows, stores: report2.stores } };
+  }
+});
+var enterpriseDataDeleteCommand = defineCommand({
+  path: ["enterprise", "data", "delete"],
+  summary: "Delete the team's own data (or one project's or user's) from every store",
+  description: "Removes records, derived text, vectors, logs and backup snapshots written by the service. Point-in-time database copies age out within 30 days, and the report states the date. The audit log keeps identifiers only, including this deletion. Irreversible: it needs --force without a terminal, and an agent needs an independent agent's approval.",
+  flags: DataFlags,
+  examples: ["overlane enterprise data delete --scope project --subject prj-1 --dry-run"],
+  effect: "destructive",
+  ...common20,
+  keywords: ["delete my data", "erase", "right to erasure"],
+  result: withDryRun(DataDeletionReport),
+  text: (d) => "backupsPurgedBy" in d ? [`deleted ${d.totalRows} records`, `backups are purged by ${d.backupsPurgedBy}`] : [],
+  handler: async (inv) => {
+    const body2 = dataBody(inv);
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.dataDelete, body2, "deletes from every store");
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(DataDeletionReport, "POST", enterprisePaths.dataDelete(tenantId), body2) };
+  }
+});
+var SsoShow = external_exports.object({ identity: EnterpriseIdentityStatus, groups: GroupMappingSet }).strict();
+var enterpriseSsoShowCommand = defineCommand({
+  path: ["enterprise", "sso", "show"],
+  summary: "Show the single sign-on and directory state, and the group to role mappings",
+  description: "Prints each connection's status (not set up, setup in progress, active, failed), the protocol and domains, when it was last tested, the directory's people and group counts, and the mappings with the highest role a group may grant.",
+  examples: ["overlane enterprise sso show"],
+  effect: "read",
+  ...common20,
+  keywords: ["sso status", "scim status", "group mappings", "connection state"],
+  result: SsoShow,
+  text: (d) => [
+    `sso: ${d.identity.sso.status}${d.identity.sso.protocol === null ? "" : ` (${d.identity.sso.protocol})`}  last test ${d.identity.sso.lastTestedAt ?? "never"}`,
+    `directory: ${d.identity.scim.status}  ${d.identity.scim.userCount} people in ${d.identity.scim.groupCount} groups  last sync ${d.identity.scim.lastSyncAt ?? "never"}`,
+    `groups (cap ${d.groups.cap}): ${d.groups.mappings.length === 0 ? "none mapped" : d.groups.mappings.map((m) => `${m.groupName}=${m.role}`).join(", ")}`
+  ],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: { identity: await call2(EnterpriseIdentityStatus, "GET", enterprisePaths.identity(tenantId)), groups: await call2(GroupMappingSet, "GET", enterprisePaths.groupMappings(tenantId)) } };
+  }
+});
+var enterpriseSsoTestCommand = defineCommand({
+  path: ["enterprise", "sso", "test"],
+  summary: "Test the single sign-on or directory connection end to end; exits 1 when it fails",
+  description: "Asks the identity provider to check the connection (a metadata fetch for sign-on, a directory read for the directory) and records the result.",
+  flags: [{ name: "intent", type: "string", enum: ["sso", "dsync"], default: "sso", value: "INTENT", description: "sso (default) or dsync for the directory" }],
+  examples: ["overlane enterprise sso test", "overlane enterprise sso test --intent dsync"],
+  effect: "write",
+  ...common20,
+  keywords: ["test sso", "check connection", "verify scim"],
+  result: withDryRun(TestConnectionResult),
+  text: (d) => "ok" in d ? [`${d.ok ? "passed" : "failed"}: ${d.detail}`] : [],
+  handler: async (inv) => {
+    const intent = textFlag(inv, "intent") ?? "sso";
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.testConnection, { intent });
+    const { call: call2, tenantId } = await connected9(inv);
+    const result = await call2(TestConnectionResult, "POST", enterprisePaths.testConnection(tenantId), { intent });
+    return result.ok ? { data: result } : { data: result, exit: EXIT.failure, error: new CliError(`the ${intent} connection failed its test`, { code: "connection_test_failed", exit: EXIT.failure, quiet: true }) };
+  }
+});
+var enterpriseSsoGroupsSetCommand = defineCommand({
+  path: ["enterprise", "sso", "groups", "set"],
+  summary: "Replace the group to role mappings and the highest role a group may grant",
+  description: "Each --map is GROUP=ROLE with ROLE viewer, member or admin. A person in several mapped groups gets the highest role, up to --cap (default admin). A mapping above the cap is refused, and the owner role cannot be mapped. Changing mappings is a policy change.",
+  flags: [
+    { name: "map", type: "string", multiple: true, value: "GROUP=ROLE", description: "A mapping; repeat for more (none clears them)" },
+    { name: "cap", type: "string", enum: GROUP_ROLE_CAPS, default: "admin", value: "ROLE", description: "The highest role any group may grant" }
+  ],
+  examples: ["overlane enterprise sso groups set --map Engineering=member --map Platform=admin --cap admin"],
+  effect: "write",
+  ...common20,
+  keywords: ["group mapping", "idp groups", "roles from groups"],
+  result: withDryRun(GroupMappingSet),
+  text: (d) => "cap" in d ? [`cap: ${d.cap}`, ...d.mappings.map((m) => `${m.groupName} -> ${m.role}`)] : [],
+  handler: async (inv) => {
+    const raw = inv.values["map"];
+    const texts = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((v) => typeof v === "string");
+    const mappings = texts.map((text) => {
+      const at = text.lastIndexOf("=");
+      const groupName = at < 1 ? "" : text.slice(0, at);
+      const role = text.slice(at + 1);
+      if (groupName === "" || !["viewer", "member", "admin"].includes(role)) throw new UsageError(`${text}: use GROUP=ROLE with ROLE viewer, member or admin`, { hint: "overlane enterprise sso groups set --map Engineering=member" });
+      return { groupName, role };
+    });
+    const body2 = { cap: textFlag(inv, "cap") ?? "admin", mappings };
+    if (inv.dryRun) return planned9(inv, "PUT", enterprisePaths.groupMappings, body2);
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(GroupMappingSet, "PUT", enterprisePaths.groupMappings(tenantId), body2) };
+  }
+});
+var enterpriseStreamListCommand = defineCommand({
+  path: ["enterprise", "audit", "stream", "list"],
+  summary: "List SIEM stream targets with their status and how far each has been delivered",
+  description: "Shows each target's address, whether it is active, paused or failing, the newest audit row it has acknowledged and the last error. The signing secret is never shown.",
+  examples: ["overlane enterprise audit stream list"],
+  effect: "read",
+  ...common20,
+  keywords: ["siem targets", "stream status", "log forwarding status"],
+  result: AuditStreamTargetList,
+  text: (d) => d.targets.length === 0 ? ["No stream targets."] : d.targets.map((t2) => `${t2.targetId}  ${t2.status.padEnd(8)} ${t2.url}  through row ${t2.deliveredThroughSeq}${t2.lastError === null ? "" : `  error: ${t2.lastError}`}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(AuditStreamTargetList, "GET", enterprisePaths.streamTargets(tenantId)) };
+  }
+});
+var TargetArg = [{ name: "target", required: false, description: "The target ID from `overlane enterprise audit stream list` (required)" }];
+var targetOf = (inv) => {
+  const id2 = inv.positionals[0];
+  if (id2 === void 0) throw new UsageError("give the stream target ID", { hint: "overlane enterprise audit stream list" });
+  return id2;
+};
+var enterpriseStreamRunCommand = defineCommand({
+  path: ["enterprise", "audit", "stream", "run"],
+  summary: "Send the audit rows a target has not acknowledged yet, now",
+  description: "Delivers the rows after the target's cursor in batches, signed and with idempotency keys. A refusal or error stops the run, keeps the cursor and marks the target failing; the next run resends the same batch. Runs also happen every five minutes on their own.",
+  args: TargetArg,
+  examples: ["overlane enterprise audit stream run tgt_abc123"],
+  effect: "write",
+  ...common20,
+  keywords: ["send audit now", "flush stream", "retry siem"],
+  result: withDryRun(StreamRunReport),
+  text: (d) => "delivered" in d ? [`${d.failed ? "failed" : "ok"}: ${d.delivered} rows in ${d.batches} batches, through row ${d.deliveredThroughSeq}`] : [],
+  handler: async (inv) => {
+    const id2 = targetOf(inv);
+    if (inv.dryRun) return planned9(inv, "POST", (t2) => enterprisePaths.streamRun(t2, id2), {});
+    const { call: call2, tenantId } = await connected9(inv);
+    const report2 = await call2(StreamRunReport, "POST", enterprisePaths.streamRun(tenantId, id2), {});
+    return report2.failed ? { data: report2, exit: EXIT.failure, error: new CliError("the target did not accept the delivery", { code: "stream_delivery_failed", exit: EXIT.failure, quiet: true }) } : { data: report2 };
+  }
+});
+var StreamRemoved = external_exports.object({ deleted: external_exports.literal(true) }).strict();
+var enterpriseStreamRemoveCommand = defineCommand({
+  path: ["enterprise", "audit", "stream", "remove"],
+  summary: "Remove a SIEM stream target; its stored signing secret goes with it",
+  description: "Stops deliveries to the target and deletes the sealed signing secret. Rows already delivered stay in your SIEM. Add the target again to resume from the start.",
+  args: TargetArg,
+  examples: ["overlane enterprise audit stream remove tgt_abc123 --dry-run"],
+  effect: "destructive",
+  ...common20,
+  keywords: ["delete siem target", "stop streaming"],
+  result: withDryRun(StreamRemoved),
+  text: (d) => "deleted" in d ? ["Target removed."] : [],
+  handler: async (inv) => {
+    const id2 = targetOf(inv);
+    if (inv.dryRun) return planned9(inv, "DELETE", (t2) => enterprisePaths.streamTarget(t2, id2));
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(StreamRemoved, "DELETE", enterprisePaths.streamTarget(tenantId, id2)) };
+  }
+});
+var enterpriseRetentionReportsCommand = defineCommand({
+  path: ["enterprise", "retention", "reports"],
+  summary: "List the purge reports, newest first",
+  description: "Each report names the trigger (schedule or manual), when it ran, and for each class and store the cutoff and how many records it removed.",
+  examples: ["overlane enterprise retention reports"],
+  effect: "read",
+  ...common20,
+  keywords: ["purge history", "what was deleted by retention"],
+  result: PurgeReportList,
+  text: (d) => d.reports.length === 0 ? ["No purge has run yet."] : d.reports.map((r) => `${r.ranAt}  ${r.trigger.padEnd(8)} ${r.totalPurged} records removed  (${r.purgeId})`),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(PurgeReportList, "GET", enterprisePaths.purgeReports(tenantId)) };
+  }
+});
+var enterpriseBackupsDrillCommand = defineCommand({
+  path: ["enterprise", "backups", "drill"],
+  summary: "Run the backup restore drill; exits 1 if any record count differs or the audit chain breaks",
+  description: "Takes a snapshot of the team's data, reads it back from storage, restores it into a scratch target and compares every table's record count with the source. The restored audit rows must still verify as a chain. Snapshots expire after 30 days.",
+  examples: ["overlane enterprise backups drill"],
+  effect: "write",
+  ...common20,
+  keywords: ["restore drill", "backup test", "disaster recovery"],
+  result: withDryRun(RestoreDrillReport),
+  text: (d) => "tables" in d ? [d.ok ? "restore drill passed" : "restore drill FAILED", ...d.tables.map((t2) => `${t2.name.padEnd(16)} expected ${t2.expected}  restored ${t2.restored}`)] : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned9(inv, "POST", enterprisePaths.restoreDrill, {}, "writes a snapshot and restores it into a scratch target");
+    const { call: call2, tenantId } = await connected9(inv);
+    const report2 = await call2(RestoreDrillReport, "POST", enterprisePaths.restoreDrill(tenantId), {});
+    return report2.ok ? { data: report2 } : { data: report2, exit: EXIT.failure, error: new CliError("the restore drill failed", { code: "restore_drill_failed", exit: EXIT.failure, quiet: true }) };
+  }
+});
+var enterpriseAllowlistShowCommand = defineCommand({
+  path: ["enterprise", "mcp-allowlist", "show"],
+  summary: "Show the MCP server allowlist for the team's agents",
+  description: "With the allowlist on, an agent may connect only to a listed server host or a subdomain of one; any other server is refused before a connection is made.",
+  examples: ["overlane enterprise mcp-allowlist show"],
+  effect: "read",
+  ...common20,
+  keywords: ["mcp servers allowed", "allowlist", "which mcp servers can agents use"],
+  result: McpAllowlist,
+  text: (d) => [`mode: ${d.mode}`, ...d.entries.map((e2) => `allow ${e2.server}${e2.note === void 0 ? "" : `  (${e2.note})`}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(McpAllowlist, "GET", enterprisePaths.mcpAllowlist(tenantId)) };
+  }
+});
+var enterpriseAllowlistSetCommand = defineCommand({
+  path: ["enterprise", "mcp-allowlist", "set"],
+  summary: "Turn the MCP server allowlist on or off and set the listed hosts",
+  description: "Replaces the list with the --allow hosts and sets the mode. Mode allowlist refuses any server not listed (a host or a subdomain of one); mode off allows every server. Changing the allowlist is a policy change.",
+  flags: [
+    { name: "mode", type: "string", enum: ["off", "allowlist"], default: "allowlist", value: "MODE", description: "allowlist (default) or off" },
+    { name: "allow", type: "string", multiple: true, value: "HOST", description: "A host agents may connect to; repeat for more" }
+  ],
+  examples: ["overlane enterprise mcp-allowlist set --allow mcp.example.com", "overlane enterprise mcp-allowlist set --mode off"],
+  effect: "write",
+  ...common20,
+  keywords: ["allow mcp server", "restrict mcp", "mcp gateway"],
+  result: withDryRun(McpAllowlist),
+  text: (d) => "mode" in d ? [`mode: ${d.mode}`, ...d.entries.map((e2) => `allow ${e2.server}`)] : [],
+  handler: async (inv) => {
+    const raw = inv.values["allow"];
+    const hosts2 = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((v) => typeof v === "string");
+    const body2 = { mode: textFlag(inv, "mode") ?? "allowlist", entries: hosts2.map((server2) => ({ server: server2 })) };
+    if (inv.dryRun) return planned9(inv, "PUT", enterprisePaths.mcpAllowlist, body2);
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(McpAllowlist, "PUT", enterprisePaths.mcpAllowlist(tenantId), body2) };
+  }
+});
+var enterpriseEvidencePackCommand = defineCommand({
+  path: ["enterprise", "evidence-pack"],
+  summary: "Print the security review evidence pack: chain state, agent action counts and controls",
+  description: "Verifies the audit chain, counts the audited actions taken by agent tokens (and how many were denied), and lists the controls (single sign-on, directory sync, audit log, SIEM stream, data region, customer keys, retention, MCP allowlist) as enabled or not configured. Identifiers and counts only.",
+  examples: ["overlane enterprise evidence-pack --json"],
+  effect: "read",
+  ...common20,
+  keywords: ["soc 2 evidence", "security review", "agent action audit"],
+  result: EvidencePack,
+  text: (d) => [
+    `audit chain: ${d.chain.ok ? "verified" : "BROKEN"} (${d.chain.checked} rows)`,
+    `agent actions: ${d.agentActions.total} (${d.agentActions.denied} denied)`,
+    ...d.controls.map((c2) => `${c2.state === "enabled" ? "enabled        " : "not configured"}  ${c2.id.padEnd(7)} ${c2.title}: ${c2.evidence}`)
+  ],
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected9(inv);
+    return { data: await call2(EvidencePack, "GET", enterprisePaths.evidencePack(tenantId)) };
+  }
+});
+var enterpriseCommands = [
+  enterpriseSsoShowCommand,
+  enterpriseSsoTestCommand,
+  enterpriseSsoGroupsSetCommand,
+  enterpriseStreamListCommand,
+  enterpriseStreamRunCommand,
+  enterpriseStreamRemoveCommand,
+  enterpriseRetentionReportsCommand,
+  enterpriseBackupsDrillCommand,
+  enterpriseAllowlistShowCommand,
+  enterpriseAllowlistSetCommand,
+  enterpriseEvidencePackCommand,
+  enterpriseStatusCommand,
+  enterpriseSsoLinkCommand,
+  enterpriseSyncCommand,
+  enterpriseAuditExportCommand,
+  enterpriseAuditVerifyCommand,
+  enterpriseStreamAddCommand,
+  enterpriseRegionShowCommand,
+  enterpriseRegionSetCommand,
+  enterpriseKeysListCommand,
+  enterpriseKeysAddCommand,
+  enterpriseKeysTestCommand,
+  enterpriseKeysRotateCommand,
+  enterpriseKeysRevokeCommand,
+  enterpriseRetentionShowCommand,
+  enterpriseRetentionSetCommand,
+  enterprisePurgeCommand,
+  enterpriseDataExportCommand,
+  enterpriseDataDeleteCommand
+];
+
 // ../cli/src/commands/observe.ts
 init_src();
 init_zod();
 import { randomUUID as randomUUID15 } from "node:crypto";
-var common20 = { needsAuth: true, needsNetwork: true };
+var common21 = { needsAuth: true, needsNetwork: true };
 var requestId14 = () => `cli-${randomUUID15()}`;
-async function connected9(inv) {
+async function connected10(inv) {
   const project = await connectedProject(inv.deps, "observe");
   return { call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
 }
-async function planned9(inv, method, path, body2, note) {
+async function planned10(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "observe");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
@@ -70085,7 +71094,7 @@ var observeStatusCommand = defineCommand({
   description: "One read of the team's observability: runs in the last 24 hours by status, open alert incidents, cost and tokens this billing period, the decision-model records (outcomes and latency), and how long telemetry is kept on the plan.",
   examples: ["overlane observe status", "overlane observe status --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["observability", "run status", "open incidents", "how are my agents doing", "telemetry"],
   result: ObserveStatus,
   text: (d) => [
@@ -70096,7 +71105,7 @@ var observeStatusCommand = defineCommand({
     `retention: ${d.retention.retentionDays === null ? "set by contract" : `${d.retention.retentionDays} days`} (${d.retention.plan})`
   ],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(ObserveStatus, "GET", observePaths.status(tenantId)) };
   }
 });
@@ -70110,12 +71119,12 @@ var observeLogsCommand = defineCommand({
   ],
   examples: ["overlane observe logs", "overlane observe logs --run run-12 --limit 50"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["logs", "agent logs", "what happened in the run", "tool output"],
   result: LogRecordList,
   text: (d) => d.logs.length === 0 ? ["No log lines recorded."] : d.logs.map((l) => `${l.at}  ${l.level.toUpperCase().padEnd(5)} ${l.runId}  ${l.source}  ${l.message}${l.redacted ? `  (${l.redactions} redacted)` : ""}`),
   handler: async (inv) => {
-    const { call: call2, tenantId, projectId } = await connected9(inv);
+    const { call: call2, tenantId, projectId } = await connected10(inv);
     const run3 = textFlag(inv, "run");
     const limit = textFlag(inv, "limit");
     if (limit !== void 0 && !/^\d+$/.test(limit)) throw new UsageError("--limit is a whole number");
@@ -70130,7 +71139,7 @@ var observeTraceCommand = defineCommand({
   flags: [{ name: "run", type: "string", required: true, value: "RUN", description: "The run ID" }],
   examples: ["overlane observe trace --run run-12", "overlane observe trace --run run-12 --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["trace", "run trace", "stitched logs", "spans", "run id"],
   result: TraceBundle,
   text: (d) => [
@@ -70142,7 +71151,7 @@ var observeTraceCommand = defineCommand({
   handler: async (inv) => {
     const run3 = textFlag(inv, "run");
     if (run3 === void 0) throw new UsageError("trace needs --run", { hint: "overlane observe trace --run <run id>" });
-    const { call: call2, tenantId, projectId } = await connected9(inv);
+    const { call: call2, tenantId, projectId } = await connected10(inv);
     return { data: await call2(TraceBundle, "GET", observePaths.trace(tenantId, projectId, run3)) };
   }
 });
@@ -70152,7 +71161,7 @@ var observeCostCommand = defineCommand({
   description: "Cost in dollars, tokens and run counts grouped by agent, by project and for the team, from the metrics the runs reported. `overlane observe reconcile` compares the same figures with metered usage.",
   examples: ["overlane observe cost", "overlane observe cost --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["cost per agent", "token usage", "spend per project", "how much did the run cost"],
   result: CostReport,
   text: (d) => [
@@ -70161,7 +71170,7 @@ var observeCostCommand = defineCommand({
     ...d.byProject.map((r) => `  project ${r.key.padEnd(18)} ${usd3(r.costMicros).padStart(10)} ${String(r.tokens).padStart(10)} tokens ${r.runs} runs`)
   ],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(CostReport, "GET", observePaths.cost(tenantId)) };
   }
 });
@@ -70171,7 +71180,7 @@ var observeReconcileCommand = defineCommand({
   description: "Compares the cost the metrics report with the usage the billing ledger meters, per agent, per project and in total. A line outside the tolerance names the key and the error in basis points.",
   examples: ["overlane observe reconcile", "overlane observe reconcile --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["reconcile cost", "metered usage", "cost matches billing", "metrics accuracy"],
   result: Reconciliation,
   text: (d) => [
@@ -70179,7 +71188,7 @@ var observeReconcileCommand = defineCommand({
     ...[...d.byAgent.map((l) => ({ ...l, key: `agent ${l.key}` })), ...d.byProject.map((l) => ({ ...l, key: `project ${l.key}` }))].filter((l) => !l.within).map((l) => `  ${l.key}: metered ${usd3(l.meteredMicros)}, observed ${usd3(l.observedMicros)}, error ${l.errorBps} bps`)
   ],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(Reconciliation, "GET", observePaths.reconcile(tenantId)) };
   }
 });
@@ -70190,7 +71199,7 @@ var observeCompareCommand = defineCommand({
   flags: [{ name: "task", type: "string", required: true, value: "TASK", description: "The task ID" }],
   examples: ["overlane observe compare --task task-77", "overlane observe compare --task task-77 --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["compare agents", "which agent is better", "claude vs codex", "agent report", "same task two agents"],
   result: ComparisonReport,
   text: (d) => d.entries.length === 0 ? [`No runs recorded for task ${d.taskId}.`] : [
@@ -70200,7 +71209,7 @@ var observeCompareCommand = defineCommand({
   handler: async (inv) => {
     const task = textFlag(inv, "task");
     if (task === void 0) throw new UsageError("compare needs --task", { hint: "overlane observe compare --task <task id>" });
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(ComparisonReport, "GET", `${observePaths.compare(tenantId)}?task=${encodeURIComponent(task)}`) };
   }
 });
@@ -70210,12 +71219,12 @@ var observeEvalsCommand = defineCommand({
   description: "Pass rate, mean cost and mean review time per agent and configuration, scored from the stored replays of your own merged pull requests. Scoring is arithmetic over checks, never a model's opinion.",
   examples: ["overlane observe evals", "overlane observe evals --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["evals", "replay merged prs", "agent pass rate", "benchmark my repo", "which config works"],
   result: EvalReport,
   text: (d) => d.rows.length === 0 ? ["No replays recorded. Run some: overlane observe evals run --prs pr-1,pr-2 --agents codex --configs default"] : [...d.rows.map((r) => `${r.agent.padEnd(16)} ${r.config.padEnd(14)} pass ${(r.passRateBps / 100).toFixed(1)}%  ${r.passed}/${r.prs}  cost ${usd3(r.meanCostMicros)}  review ${minutes(r.meanReviewMs)}`), `best: ${d.best === null ? "none" : `${d.best.agent} / ${d.best.config}`}`],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(EvalReport, "GET", observePaths.evals(tenantId)) };
   }
 });
@@ -70235,14 +71244,14 @@ var observeEvalsRunCommand = defineCommand({
   ],
   examples: ["overlane observe evals run --prs pr-1,pr-2 --agents codex,claude-code --configs default,strict", "overlane observe evals run --prs pr-1 --agents codex --configs default --dry-run"],
   effect: "write",
-  ...common20,
+  ...common21,
   keywords: ["run evals", "replay pull requests", "compare configs", "agent benchmark on my repo"],
   result: withDryRun(EvalReport),
   text: (d) => "rows" in d ? d.rows.map((r) => `${r.agent} / ${r.config}: pass ${(r.passRateBps / 100).toFixed(1)}%, cost ${usd3(r.meanCostMicros)}, review ${minutes(r.meanReviewMs)}`) : [],
   handler: async (inv) => {
     const body2 = { requestId: requestId14(), prs: list(textFlag(inv, "prs"), "prs"), agents: list(textFlag(inv, "agents"), "agents"), configs: list(textFlag(inv, "configs"), "configs") };
-    if (inv.dryRun) return planned9(inv, "POST", observePaths.evals, body2, "replays each pull request with each agent and configuration");
-    const { call: call2, tenantId } = await connected9(inv);
+    if (inv.dryRun) return planned10(inv, "POST", observePaths.evals, body2, "replays each pull request with each agent and configuration");
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(EvalReport, "POST", observePaths.evals(tenantId), body2) };
   }
 });
@@ -70252,7 +71261,7 @@ var observeAlertsCommand = defineCommand({
   description: "Alert rules (spend cap reached, failing run, stuck lease, stale index) with where each one goes, and the incidents they opened. An incident fires once; resolving it is a separate notice.",
   examples: ["overlane observe alerts", "overlane observe alerts --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["alerts", "incidents", "notifications", "who gets paged", "failing runs"],
   result: AlertOverview,
   text: (d) => [
@@ -70260,7 +71269,7 @@ var observeAlertsCommand = defineCommand({
     ...d.incidents.map((i2) => `${i2.state.padEnd(8)} ${i2.openedAt}  ${i2.kind}  ${i2.subject}  next: ${i2.nextCommand}`)
   ],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(AlertOverview, "GET", observePaths.alerts(tenantId)) };
   }
 });
@@ -70290,7 +71299,7 @@ var observeAlertsSetCommand = defineCommand({
   ],
   examples: ["overlane observe alerts set --kind failing_run --email ops@example.com --slack ops", "overlane observe alerts set --kind spend_cap --percent 80 --email ops@example.com --dry-run"],
   effect: "write",
-  ...common20,
+  ...common21,
   keywords: ["add alert", "alert on failing runs", "alert on spend", "notify slack", "notify email"],
   result: withDryRun(RuleSet),
   text: (d) => "rule" in d ? [`rule ${d.rule.ruleId}: ${d.rule.kind}, ${d.rule.enabled ? "on" : "off"}, -> ${d.rule.targets.map((t2) => `${t2.channel}:${t2.destination}`).join(", ")}`] : [],
@@ -70312,8 +71321,8 @@ var observeAlertsSetCommand = defineCommand({
       enabled: !boolFlag(inv, "off"),
       ...ruleId === void 0 ? {} : { ruleId }
     };
-    if (inv.dryRun) return planned9(inv, "PUT", observePaths.alertRules, body2);
-    const { call: call2, tenantId } = await connected9(inv);
+    if (inv.dryRun) return planned10(inv, "PUT", observePaths.alertRules, body2);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(RuleSet, "PUT", observePaths.alertRules(tenantId), body2) };
   }
 });
@@ -70325,15 +71334,15 @@ var observeAlertsRemoveCommand = defineCommand({
   flags: [{ name: "rule-id", type: "string", value: "ID", description: "The rule to remove (required)" }],
   examples: ["overlane observe alerts remove --rule-id rule-1 --force", "overlane observe alerts remove --rule-id rule-1 --dry-run"],
   effect: "destructive",
-  ...common20,
+  ...common21,
   keywords: ["delete alert", "remove alert rule", "stop alerts"],
   result: withDryRun(RuleRemoved),
   text: (d) => "removed" in d ? ["rule removed"] : [],
   handler: async (inv) => {
     const ruleId = textFlag(inv, "rule-id");
     if (ruleId === void 0) throw new UsageError("remove needs --rule-id", { hint: "overlane observe alerts" });
-    if (inv.dryRun) return planned9(inv, "DELETE", observePaths.alertRules, { ruleId });
-    const { call: call2, tenantId } = await connected9(inv);
+    if (inv.dryRun) return planned10(inv, "DELETE", observePaths.alertRules, { ruleId });
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(RuleRemoved, "DELETE", observePaths.alertRules(tenantId), { ruleId }) };
   }
 });
@@ -70343,13 +71352,13 @@ var observeAlertsEvaluateCommand = defineCommand({
   description: "Looks at each enabled rule's condition, opens an incident for a new one, resolves one that cleared, and sends each notice once. The service also runs this on a schedule and when a run ends in failure.",
   examples: ["overlane observe alerts evaluate", "overlane observe alerts evaluate --dry-run"],
   effect: "write",
-  ...common20,
+  ...common21,
   keywords: ["check alerts now", "evaluate rules", "send alerts"],
   result: withDryRun(EvaluateAlertsResult),
   text: (d) => "opened" in d ? [`opened ${d.opened.length}, resolved ${d.resolved.length}, still open ${d.stillOpen}`, ...d.opened.map((i2) => `  ${i2.kind}: ${i2.subject}`)] : [],
   handler: async (inv) => {
-    if (inv.dryRun) return planned9(inv, "POST", observePaths.alertsEvaluate, {}, "opens incidents and sends notices");
-    const { call: call2, tenantId } = await connected9(inv);
+    if (inv.dryRun) return planned10(inv, "POST", observePaths.alertsEvaluate, {}, "opens incidents and sends notices");
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(EvaluateAlertsResult, "POST", observePaths.alertsEvaluate(tenantId), {}) };
   }
 });
@@ -70359,12 +71368,12 @@ var observeRetentionCommand = defineCommand({
   description: "The retention period for logs, spans, metrics and run events on the team's plan, and the records no purge ever touches: the task ledger, evidence, the audit log, billing and decision records.",
   examples: ["overlane observe retention", "overlane observe retention --json"],
   effect: "read",
-  ...common20,
+  ...common21,
   keywords: ["retention", "how long are logs kept", "data retention", "purge"],
   result: RetentionPolicy,
   text: (d) => [`plan ${d.plan}: ${d.retentionDays === null ? "no fixed period" : `${d.retentionDays} days`}`, `purged: ${d.covers.join(", ")}`, `never purged: ${d.keeps.join(", ")}`],
   handler: async (inv) => {
-    const { call: call2, tenantId } = await connected9(inv);
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(RetentionPolicy, "GET", observePaths.retention(tenantId)) };
   }
 });
@@ -70374,13 +71383,13 @@ var observeRetentionPurgeCommand = defineCommand({
   description: "Deletes logs, spans, metrics, run events and resolved incidents older than the plan's retention period and prints how many of each. The task ledger, evidence, audit log, billing and decision records are never touched. The service also runs this on a schedule. Destructive: it needs --force without a terminal.",
   examples: ["overlane observe retention purge --force", "overlane observe retention purge --dry-run"],
   effect: "destructive",
-  ...common20,
+  ...common21,
   keywords: ["purge logs", "delete old telemetry", "enforce retention"],
   result: withDryRun(RetentionPurgeResult),
   text: (d) => "deleted" in d ? [`plan ${d.plan}, cutoff ${d.cutoff ?? "none"}`, ...Object.entries(d.deleted).map(([k, v]) => `  ${k}: ${v}`)] : [],
   handler: async (inv) => {
-    if (inv.dryRun) return planned9(inv, "POST", observePaths.retentionPurge, {}, "deletes telemetry older than the plan keeps");
-    const { call: call2, tenantId } = await connected9(inv);
+    if (inv.dryRun) return planned10(inv, "POST", observePaths.retentionPurge, {}, "deletes telemetry older than the plan keeps");
+    const { call: call2, tenantId } = await connected10(inv);
     return { data: await call2(RetentionPurgeResult, "POST", observePaths.retentionPurge(tenantId), {}) };
   }
 });
@@ -70439,7 +71448,8 @@ function coreCommands() {
     ...observeCommands,
     ...repoCommands,
     ...ciCommands,
-    ...deployCommands
+    ...deployCommands,
+    ...enterpriseCommands
   ];
 }
 function createRegistry(extra = []) {
@@ -70664,22 +71674,22 @@ import { join as join29 } from "node:path";
 function dataDir(env = process.env, home = homedir()) {
   const override = env["MVRX_DATA_DIR"];
   if (override !== void 0 && override !== "") return override;
-  const base4 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join29(home, "Library", "Application Support") : join29(home, ".local", "share"));
-  return join29(base4, "mvrx-harness");
+  const base5 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join29(home, "Library", "Application Support") : join29(home, ".local", "share"));
+  return join29(base5, "mvrx-harness");
 }
 function marketplaceRoot(env = process.env, home = homedir()) {
   return join29(dataDir(env, home), "marketplace");
 }
 
 // src/plugin.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { join as join31 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/marketplace.ts
 init_src();
 import { createHash as createHash7 } from "node:crypto";
-import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync14, renameSync as renameSync7, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync9 } from "node:fs";
+import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync15, renameSync as renameSync7, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname11, join as join30, relative as relative2, sep } from "node:path";
 var CLIENT_DIRS = ["claude", "codex"];
 var EMBEDDED_MANIFEST = "release-manifest.json";
@@ -70690,7 +71700,7 @@ function loadEmbedded(packageRoot2) {
   const dir = join30(packageRoot2, "plugins");
   const path = join30(dir, EMBEDDED_MANIFEST);
   if (!existsSync8(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
-  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync14(path, "utf8")));
+  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync15(path, "utf8")));
   if (!parsed.success) throw new MarketplaceError(`the embedded release manifest is invalid: ${parsed.error.message}`);
   return { dir, manifest: parsed.data };
 }
@@ -70718,7 +71728,7 @@ async function verifyTree(treeRoot, manifest) {
       problems.push(`missing: ${file2.path}`);
       continue;
     }
-    if (sha2562(readFileSync14(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
+    if (sha2562(readFileSync15(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
   }
   for (const client of CLIENT_DIRS) {
     for (const found of listFiles(join30(treeRoot, client))) {
@@ -70729,7 +71739,7 @@ async function verifyTree(treeRoot, manifest) {
 }
 function readInstalledManifest(target2) {
   try {
-    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync14(join30(target2, INSTALLED_MANIFEST), "utf8")));
+    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync15(join30(target2, INSTALLED_MANIFEST), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -70760,7 +71770,7 @@ async function syncMarketplace(embedded, target2) {
       if (existsSync8(join30(embedded.dir, client))) cpSync(join30(embedded.dir, client), join30(staging, client), { recursive: true });
     }
     mkdirSync10(join30(staging, ".release"), { recursive: true });
-    writeFileSync9(join30(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
+    writeFileSync10(join30(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
 `);
     const after = await verifyTree(staging, embedded.manifest);
     if (after.length > 0) throw new MarketplaceError(`the copied plugin files do not match the release manifest:
@@ -70793,7 +71803,7 @@ var PluginUsageError = class extends Error {
 };
 function readNames(treeRoot, client) {
   const file2 = client === "claude" ? join31(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join31(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
-  const parsed = JSON.parse(readFileSync15(file2, "utf8"));
+  const parsed = JSON.parse(readFileSync16(file2, "utf8"));
   const record3 = parsed;
   const plugin = record3.plugins?.[0]?.name;
   if (typeof record3.name !== "string" || typeof plugin !== "string") throw new MarketplaceError(`${file2} names no marketplace or plugin`);
@@ -71065,8 +72075,8 @@ async function confirm(question) {
   }
 }
 function configDir2(env) {
-  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join34(homedir3(), ".config");
-  return join34(base4, "mvrx-harness");
+  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join34(homedir3(), ".config");
+  return join34(base5, "mvrx-harness");
 }
 function createDeps2(env = process.env) {
   return {