pruff-skills 1.3.0 → 1.5.0

package/dist/cli.mjs

@@ -7,8 +7,8 @@ import "./_chunks/libs/@kwsites/promise-deferred.mjs";
 import { t as esm_default } from "./_chunks/libs/simple-git.mjs";
 import { t as xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
 import { t as require_dist } from "./_chunks/libs/@vercel/detect-agent.mjs";
-import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
-import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import { basename, delimiter, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { stripVTControlCharacters } from "node:util";
 import { homedir, platform, tmpdir } from "os";
@@ -941,7 +941,7 @@ function filterSkills(skills, inputNames) {
 const home$1 = homedir();
 const configHome = xdgConfig ?? join(home$1, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home$1, ".codex");
-const claudeHome$1 = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home$1, ".claude");
+const claudeHome$2 = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home$1, ".claude");
 const vibeHome = process.env.VIBE_HOME?.trim() || join(home$1, ".vibe");
 const hermesHome = process.env.HERMES_HOME?.trim() || join(home$1, ".hermes");
 const autohandHome = process.env.AUTOHAND_HOME?.trim() || join(home$1, ".autohand");
@@ -1030,9 +1030,9 @@ const agents = {
 		name: "claude-code",
 		displayName: "Claude Code",
 		skillsDir: ".claude/skills",
-		globalSkillsDir: join(claudeHome$1, "skills"),
+		globalSkillsDir: join(claudeHome$2, "skills"),
 		detectInstalled: async () => {
-			return existsSync(claudeHome$1);
+			return existsSync(claudeHome$2);
 		}
 	},
 	openclaw: {
@@ -4032,23 +4032,24 @@ function parseAddOptions(args) {
 	};
 }
 const execFileAsync$4 = promisify(execFile);
-const claudeAgentsDir = (global) => global ? join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "agents") : join(process.cwd(), ".claude", "agents");
-async function fetchAgentFile(source, name) {
-	const rel = `agents/${name}.md`;
-	if (source.startsWith(".") || isAbsolute(source)) {
+const isLocalSource = (source) => source.startsWith(".") || isAbsolute(source);
+const isGitHubSource = (source) => /^[^/]+\/[^/]+$/.test(source);
+const ghEnv = () => ({
+	...process.env,
+	GIT_TERMINAL_PROMPT: "0"
+});
+async function fetchCatalogFile(source, rel) {
+	if (isLocalSource(source)) {
 		const file = join(source, rel);
 		return existsSync(file) ? readFile(file, "utf8") : null;
 	}
-	if (/^[^/]+\/[^/]+$/.test(source)) try {
+	if (isGitHubSource(source)) try {
 		const { stdout } = await execFileAsync$4("gh", [
 			"api",
 			`repos/${source}/contents/${rel}`,
 			"--jq",
 			".content"
-		], { env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		} });
+		], { env: ghEnv() });
 		return Buffer.from(stdout.trim(), "base64").toString("utf8");
 	} catch {
 		return null;
@@ -4060,33 +4061,35 @@ async function fetchAgentFile(source, name) {
 		return null;
 	}
 }
-async function listCatalogAgents(source) {
-	const toNames = (files) => files.filter((f) => f.endsWith(".md")).map((f) => f.slice(0, -3));
-	if (source.startsWith(".") || isAbsolute(source)) try {
-		return toNames(await readdir(join(source, "agents")));
+async function listCatalogDir(source, dir) {
+	if (isLocalSource(source)) try {
+		return await readdir(join(source, dir));
 	} catch {
 		return null;
 	}
-	if (/^[^/]+\/[^/]+$/.test(source)) try {
+	if (isGitHubSource(source)) try {
 		const { stdout } = await execFileAsync$4("gh", [
 			"api",
-			`repos/${source}/contents/agents`,
+			`repos/${source}/contents/${dir}`,
 			"--jq",
 			".[].name"
-		], { env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		} });
-		return toNames(stdout.trim().split("\n").filter(Boolean));
+		], { env: ghEnv() });
+		return stdout.trim().split("\n").filter(Boolean);
 	} catch {
 		return null;
 	}
 	try {
-		return toNames(await readdir(join(await cloneRepo$1(source), "agents")));
+		return await readdir(join(await cloneRepo$1(source), dir));
 	} catch {
 		return null;
 	}
 }
+const claudeAgentsDir = (global) => global ? join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "agents") : join(process.cwd(), ".claude", "agents");
+const fetchAgentFile = (source, name) => fetchCatalogFile(source, `agents/${name}.md`);
+async function listCatalogAgents(source) {
+	const files = await listCatalogDir(source, "agents");
+	return files ? files.filter((f) => f.endsWith(".md")).map((f) => f.slice(0, -3)) : null;
+}
 async function listInstalledAgents(targetDir) {
 	try {
 		return (await readdir(targetDir, { withFileTypes: true })).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => e.name.slice(0, -3));
@@ -6276,6 +6279,641 @@ function fail(message) {
 	process.exit(1);
 }
 var UseCommandError = class extends Error {};
+const claudeHome$1 = () => process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude");
+const claudeSettingsPath$1 = () => join(claudeHome$1(), "settings.json");
+const pruffHooksDir = () => join(claudeHome$1(), "hooks", "pruff");
+const statePath = () => join(claudeHome$1(), "pruff-skills", "state.json");
+function readClaudeSettings$1() {
+	const path = claudeSettingsPath$1();
+	if (!existsSync(path)) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf-8"));
+	} catch {
+		throw new Error(`${path} is not valid JSON. Fix it (or move it aside) before running this command.`);
+	}
+	return parsed && typeof parsed === "object" ? parsed : {};
+}
+function writeClaudeSettings$1(settings) {
+	const path = claudeSettingsPath$1();
+	const next = `${JSON.stringify(settings, null, 2)}\n`;
+	const current = existsSync(path) ? readFileSync(path, "utf-8") : null;
+	if (current === next) return null;
+	mkdirSync(claudeHome$1(), { recursive: true });
+	let backup = null;
+	if (current !== null) {
+		backup = `${path}.pruff-bak-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+		copyFileSync(path, backup);
+	}
+	writeFileSync(path, next, "utf-8");
+	return backup;
+}
+function readState() {
+	try {
+		const parsed = JSON.parse(readFileSync(statePath(), "utf-8"));
+		return {
+			hooks: parsed.hooks ?? {},
+			env: parsed.env ?? [],
+			files: parsed.files ?? {}
+		};
+	} catch {
+		return {
+			hooks: {},
+			env: [],
+			files: {}
+		};
+	}
+}
+function writeState(state) {
+	mkdirSync(join(claudeHome$1(), "pruff-skills"), { recursive: true });
+	writeFileSync(statePath(), `${JSON.stringify(state, null, 2)}\n`, "utf-8");
+}
+function upsertHook(settings, event, matcher, command) {
+	const hooks = { ...settings.hooks ?? {} };
+	const groups = (hooks[event] ?? []).map((g) => ({
+		...g,
+		hooks: [...g.hooks]
+	}));
+	const existing = groups.find((g) => g.matcher === matcher && g.hooks.some((h) => h.command === command.command));
+	if (existing) existing.hooks = existing.hooks.map((h) => h.command === command.command ? command : h);
+	else groups.push(matcher === void 0 ? { hooks: [command] } : {
+		matcher,
+		hooks: [command]
+	});
+	hooks[event] = groups;
+	return {
+		...settings,
+		hooks
+	};
+}
+function removeHooks(settings, isOwned) {
+	if (!settings.hooks) return settings;
+	const hooks = {};
+	for (const [event, groups] of Object.entries(settings.hooks)) {
+		const kept = groups.map((g) => ({
+			...g,
+			hooks: g.hooks.filter((h) => !isOwned(h.command))
+		})).filter((g) => g.hooks.length > 0);
+		if (kept.length > 0) hooks[event] = kept;
+	}
+	const next = { ...settings };
+	if (Object.keys(hooks).length === 0) delete next.hooks;
+	else next.hooks = hooks;
+	return next;
+}
+function applyOwnedEnv(settings, desired, previouslyOwned) {
+	const env = { ...settings.env ?? {} };
+	const owned = [];
+	const keptUserValues = [];
+	for (const key of previouslyOwned) if (!(key in desired)) delete env[key];
+	for (const [key, value] of Object.entries(desired)) {
+		const isOurs = previouslyOwned.includes(key);
+		if (key in env && env[key] !== value && !isOurs) {
+			keptUserValues.push(key);
+			continue;
+		}
+		env[key] = value;
+		owned.push(key);
+	}
+	const next = { ...settings };
+	if (Object.keys(env).length === 0) delete next.env;
+	else next.env = env;
+	return {
+		settings: next,
+		owned,
+		keptUserValues
+	};
+}
+const HOOK_EVENTS = [
+	"PreToolUse",
+	"PostToolUse",
+	"UserPromptSubmit",
+	"Notification",
+	"Stop",
+	"SubagentStop",
+	"SessionStart",
+	"SessionEnd",
+	"PreCompact"
+];
+const sha256$1 = (content) => createHash("sha256").update(content).digest("hex");
+const hookDir = (name) => join(pruffHooksDir(), name);
+const commandFor = (name, script) => `"${join(hookDir(name), script)}"`;
+const ownedBy = (name) => (command) => command.includes(`${join(pruffHooksDir(), name)}/`);
+function parseHookManifest(raw, expectedName) {
+	let data;
+	try {
+		data = JSON.parse(raw);
+	} catch {
+		throw new Error(`hooks/${expectedName}/hook.json is not valid JSON`);
+	}
+	if (data.name !== expectedName) throw new Error(`hooks/${expectedName}/hook.json: "name" must be "${expectedName}"`);
+	if (!data.script || !/^[\w.-]+$/.test(data.script)) throw new Error(`hooks/${expectedName}/hook.json: "script" must be a bare file name`);
+	if (!Array.isArray(data.registrations) || data.registrations.length === 0) throw new Error(`hooks/${expectedName}/hook.json: needs at least one registration`);
+	for (const r of data.registrations) if (!HOOK_EVENTS.includes(r.event)) throw new Error(`hooks/${expectedName}/hook.json: unknown event "${String(r.event)}"`);
+	return data;
+}
+async function listCatalogHooks(source = PRUFF_CATALOG) {
+	const entries = await listCatalogDir(source, "hooks");
+	return entries ? entries.filter(isBareSkillName).sort() : null;
+}
+function applyHook(settings, manifest) {
+	const command = commandFor(manifest.name, manifest.script);
+	const registrations = manifest.registrations.map((r) => ({
+		event: r.event,
+		...r.matcher ? { matcher: r.matcher } : {},
+		command
+	}));
+	const hookFor = (r) => ({
+		type: "command",
+		command,
+		...r.timeout ? { timeout: r.timeout } : {}
+	});
+	const owned = ownedBy(manifest.name);
+	const current = Object.entries(settings.hooks ?? {}).flatMap(([event, groups]) => groups.flatMap((g) => g.hooks.filter((h) => owned(h.command)).map((h) => ({
+		event,
+		matcher: g.matcher,
+		hook: h
+	}))));
+	if (current.length === manifest.registrations.length && manifest.registrations.every((r) => current.some((c) => c.event === r.event && c.matcher === r.matcher && JSON.stringify(c.hook) === JSON.stringify(hookFor(r))))) return {
+		settings,
+		registrations
+	};
+	let next = removeHooks(settings, owned);
+	for (const r of manifest.registrations) next = upsertHook(next, r.event, r.matcher, hookFor(r));
+	return {
+		settings: next,
+		registrations
+	};
+}
+async function installHooks(names, options = {}) {
+	const result = {
+		installed: [],
+		unchanged: [],
+		skippedLocalEdits: [],
+		failed: [],
+		backup: null
+	};
+	const state = readState();
+	let settings = readClaudeSettings$1();
+	const writes = [];
+	for (const name of names) {
+		if (!isBareSkillName(name)) {
+			result.failed.push({
+				name,
+				reason: "invalid hook name"
+			});
+			continue;
+		}
+		const rawManifest = await fetchCatalogFile(PRUFF_CATALOG, `hooks/${name}/hook.json`);
+		if (rawManifest === null) {
+			result.failed.push({
+				name,
+				reason: `not found in the catalog (${PRUFF_CATALOG})`
+			});
+			continue;
+		}
+		let manifest;
+		try {
+			manifest = parseHookManifest(rawManifest, name);
+		} catch (error) {
+			result.failed.push({
+				name,
+				reason: error.message
+			});
+			continue;
+		}
+		const script = await fetchCatalogFile(PRUFF_CATALOG, `hooks/${name}/${manifest.script}`);
+		if (script === null) {
+			result.failed.push({
+				name,
+				reason: `script ${manifest.script} missing from the catalog`
+			});
+			continue;
+		}
+		const target = join(hookDir(name), manifest.script);
+		const current = existsSync(target) ? readFileSync(target, "utf-8") : null;
+		const recorded = state.hooks[name]?.files[manifest.script];
+		if (current !== null && sha256$1(current) !== recorded && current !== script && !options.force) {
+			result.skippedLocalEdits.push(name);
+			continue;
+		}
+		const applied = applyHook(settings, manifest);
+		const settingsChanged = JSON.stringify(applied.settings) !== JSON.stringify(settings);
+		settings = applied.settings;
+		if (current === script && !settingsChanged && recorded === sha256$1(script)) {
+			result.unchanged.push(name);
+			continue;
+		}
+		if (current !== script) writes.push({
+			path: target,
+			content: script
+		});
+		state.hooks[name] = {
+			files: { [manifest.script]: sha256$1(script) },
+			registrations: applied.registrations
+		};
+		result.installed.push(name);
+	}
+	if (options.dryRun || result.installed.length === 0) return result;
+	for (const w of writes) {
+		mkdirSync(join(w.path, ".."), { recursive: true });
+		writeFileSync(w.path, w.content, "utf-8");
+		chmodSync(w.path, 493);
+	}
+	result.backup = writeClaudeSettings$1(settings);
+	writeState(state);
+	return result;
+}
+function uninstallHooks(names, options = {}) {
+	const state = readState();
+	let settings = readClaudeSettings$1();
+	const removed = [];
+	for (const name of names) {
+		if (!isBareSkillName(name)) continue;
+		const next = removeHooks(settings, ownedBy(name));
+		const hadFiles = existsSync(hookDir(name));
+		if (!state.hooks[name] && !hadFiles && JSON.stringify(next) === JSON.stringify(settings)) continue;
+		settings = next;
+		delete state.hooks[name];
+		removed.push(name);
+		if (!options.dryRun) rmSync(hookDir(name), {
+			recursive: true,
+			force: true
+		});
+	}
+	if (!options.dryRun && removed.length > 0) {
+		writeClaudeSettings$1(settings);
+		writeState(state);
+	}
+	return removed;
+}
+function parseHooksOptions(args) {
+	const names = [];
+	const options = {};
+	for (const arg of args) if (arg === "--dry-run") options.dryRun = true;
+	else if (arg === "--force" || arg === "-f") options.force = true;
+	else if (!arg.startsWith("-")) names.push(arg);
+	return {
+		names,
+		options
+	};
+}
+async function addCommand(names, options) {
+	Ie(import_picocolors.default.cyan(`pruff-skills hooks${options.dryRun ? " (dry run)" : ""}`));
+	if (names.length === 0) {
+		M.error("Specify at least one hook name, e.g. `pruff-skills hooks add <name>`.");
+		M.message(import_picocolors.default.dim("List them with `npx pruff-skills hooks list`."));
+		process.exit(1);
+	}
+	let result;
+	try {
+		result = await installHooks(names, options);
+	} catch (error) {
+		M.error(error.message);
+		process.exit(1);
+	}
+	const verb = options.dryRun ? "would install" : "installed";
+	for (const name of result.installed) M.success(`${import_picocolors.default.green(name)} ${verb}`);
+	for (const name of result.unchanged) M.info(`${name} already up to date`);
+	for (const name of result.skippedLocalEdits) M.warn(`${import_picocolors.default.yellow(name)} skipped — the installed script was edited locally. Re-run with --force to overwrite it.`);
+	for (const f of result.failed) M.error(`${import_picocolors.default.yellow(f.name)}: ${f.reason}`);
+	if (result.backup) M.message(import_picocolors.default.dim(`Previous settings saved to ${result.backup}`));
+	if (result.installed.length + result.unchanged.length === 0) {
+		Se(import_picocolors.default.red("No hooks installed."));
+		process.exit(1);
+	}
+	Se(options.dryRun ? "Dry run — nothing was written." : import_picocolors.default.dim("Hooks apply to new Claude Code sessions. They run with full agent permissions."));
+}
+async function listCommand() {
+	const state = readState();
+	const catalog = await listCatalogHooks();
+	const installed = Object.keys(state.hooks).sort();
+	console.log(import_picocolors.default.bold("Installed"));
+	if (installed.length === 0) console.log(import_picocolors.default.dim("  none"));
+	for (const name of installed) {
+		const events = state.hooks[name].registrations.map((r) => `${r.event}${r.matcher ? ` [${r.matcher}]` : ""}`);
+		console.log(`  ${import_picocolors.default.green(name)}  ${import_picocolors.default.dim(events.join(", "))}`);
+	}
+	if (catalog === null) {
+		console.log(import_picocolors.default.yellow(`\nCould not read the catalog (${PRUFF_CATALOG}).`));
+		return;
+	}
+	const available = catalog.filter((n) => !state.hooks[n]);
+	console.log(import_picocolors.default.bold("\nAvailable"));
+	if (available.length === 0) console.log(import_picocolors.default.dim("  none"));
+	for (const name of available) console.log(`  ${name}`);
+}
+const HOOKS_HELP = `${import_picocolors.default.bold("Usage:")} pruff-skills hooks <command> [options]
+
+${import_picocolors.default.bold("Commands:")}
+  add <name...>      Install hooks into ~/.claude/hooks/pruff/ and register them in ~/.claude/settings.json
+  list               Show installed and available hooks
+  remove <name...>   Unregister hooks and delete their scripts
+
+${import_picocolors.default.bold("Options:")}
+  --dry-run          Show what would change without writing anything
+  -f, --force        Overwrite a hook script that was edited locally
+
+Hooks always install at user scope: Claude Code only reads a project settings file
+in the directory a session starts from, so a user-level hook is the only one that
+reaches every repo and worktree. Your own settings and hooks are never modified;
+~/.claude/settings.json is backed up before every change.`;
+async function runHooks(args) {
+	const sub = args[0];
+	const { names, options } = parseHooksOptions(args.slice(1));
+	if (!sub || sub === "--help" || sub === "-h") {
+		console.log(HOOKS_HELP);
+		return;
+	}
+	if (sub === "add" || sub === "a" || sub === "install" || sub === "i") {
+		await addCommand(names, options);
+		return;
+	}
+	if (sub === "list" || sub === "ls") {
+		await listCommand();
+		return;
+	}
+	if (sub === "remove" || sub === "rm") {
+		const removed = uninstallHooks(names, options);
+		if (removed.length === 0) console.log(import_picocolors.default.dim("Nothing to remove."));
+		for (const name of removed) console.log(`${import_picocolors.default.green("✓")} ${name} ${options.dryRun ? "would be removed" : "removed"}`);
+		return;
+	}
+	console.log(`Unknown hooks command: ${sub}`);
+	console.log(HOOKS_HELP);
+}
+const DB_READER_REGION = "us-east-1";
+const DB_READER_SERVICE = "pruff-db-reader";
+const DB_READER_SECRET_PREFIX = "pruff/db-reader/";
+const DB_READER_ALLOW_ENTRY = "Bash(pruff-db-query:*)";
+const DB_READER_VERIFY_DATABASE = "pruff-sii";
+const DB_READER_SKILL = "prod-db-query";
+const DB_READER_SCRIPTS = ["pruff-db-query", "pruff-db-verify"];
+const RDS_CA_URL = `https://truststore.pki.rds.amazonaws.com/${DB_READER_REGION}/${DB_READER_REGION}-bundle.pem`;
+const MAX_SUGGESTED_NAME_LENGTH = 23;
+const dbReaderConfigPath = () => join(homedir(), ".config", "pruff", "db-reader.json");
+const dbReaderCaPath = () => join(homedir(), ".config", "pruff", `rds-${DB_READER_REGION}-bundle.pem`);
+const dbReaderBinDir = () => join(homedir(), ".local", "bin");
+function aws(args) {
+	const r = spawnSync("aws", args, {
+		encoding: "utf-8",
+		stdio: "pipe"
+	});
+	return {
+		ok: r.status === 0,
+		out: (r.stdout ?? "").trim(),
+		err: (r.stderr ?? "").trim()
+	};
+}
+function iamUserFromArn(arn) {
+	const match = /^arn:[^:]*:iam::\d+:user\/(?:.*\/)?([^/\s]+)$/.exec(arn.trim());
+	return match ? match[1] : null;
+}
+function suggestMysqlName(email, iamUser) {
+	const clean = (value) => value.toLowerCase().replace(/[^a-z0-9_]/g, "").slice(0, MAX_SUGGESTED_NAME_LENGTH);
+	return clean(email.split("@")[0] ?? "") || clean(iamUser) || "engineer";
+}
+function parseReaderSecret(raw) {
+	try {
+		const data = JSON.parse(raw);
+		if (typeof data.username !== "string" || typeof data.password !== "string") return null;
+		if (!/^[A-Za-z0-9_]+$/.test(data.username)) return null;
+		if (data.password.length === 0 || /[\u0000-\u001f\u007f]/.test(data.password)) return null;
+		return {
+			username: data.username,
+			password: data.password
+		};
+	} catch {
+		return null;
+	}
+}
+function quoteForSecurityShell(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function storeInKeychain(username, password) {
+	if (spawnSync("security", ["-i"], {
+		input: `add-generic-password -U -s ${DB_READER_SERVICE} -a ${quoteForSecurityShell(username)} -w ${quoteForSecurityShell(password)}\n`,
+		encoding: "utf-8",
+		stdio: "pipe"
+	}).status !== 0) return false;
+	return spawnSync("security", [
+		"find-generic-password",
+		"-s",
+		DB_READER_SERVICE,
+		"-a",
+		username
+	], { stdio: "ignore" }).status === 0;
+}
+function writeConfig(username) {
+	const path = dbReaderConfigPath();
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify({ username }, null, 2)}\n`, "utf-8");
+}
+function downloadCaBundle() {
+	const target = dbReaderCaPath();
+	mkdirSync(dirname(target), { recursive: true });
+	return spawnSync("curl", [
+		"-sSfo",
+		target,
+		RDS_CA_URL
+	], { stdio: "ignore" }).status === 0;
+}
+async function installScripts() {
+	const dir = dbReaderBinDir();
+	mkdirSync(dir, { recursive: true });
+	for (const name of DB_READER_SCRIPTS) {
+		const content = await fetchCatalogFile(PRUFF_CATALOG, `db-reader/${name}`);
+		if (content === null) return `${name} could not be read from the catalog`;
+		const target = join(dir, name);
+		if ((existsSync(target) ? readFileSync(target, "utf-8") : null) !== content) writeFileSync(target, content, "utf-8");
+		chmodSync(target, 493);
+	}
+	return null;
+}
+function runVerify$1() {
+	const dir = dbReaderBinDir();
+	const r = spawnSync(join(dir, "pruff-db-verify"), [DB_READER_VERIFY_DATABASE], {
+		encoding: "utf-8",
+		stdio: "pipe",
+		env: {
+			...process.env,
+			PRUFF_DB_QUERY_CMD: join(dir, "pruff-db-query")
+		}
+	});
+	return {
+		ok: r.status === 0,
+		out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim()
+	};
+}
+function mergeAllowlist(workspace) {
+	const path = join(workspace, ".claude", "settings.json");
+	let settings = {};
+	let current = null;
+	if (existsSync(path)) {
+		current = readFileSync(path, "utf-8");
+		try {
+			const parsed = JSON.parse(current);
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "invalid";
+			settings = parsed;
+		} catch {
+			return "invalid";
+		}
+	}
+	const permissions = settings.permissions && typeof settings.permissions === "object" ? settings.permissions : {};
+	const allow = Array.isArray(permissions.allow) ? permissions.allow : [];
+	if (allow.includes(DB_READER_ALLOW_ENTRY)) return "present";
+	const next = {
+		...settings,
+		permissions: {
+			...permissions,
+			allow: [...allow, DB_READER_ALLOW_ENTRY]
+		}
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	if (current !== null) copyFileSync(path, `${path}.pruff-bak-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, "utf-8");
+	renameSync(tmp, path);
+	return "added";
+}
+async function installReaderSkill(workspace, note) {
+	if (existsSync(join(workspace, ".claude", "skills", DB_READER_SKILL, "SKILL.md"))) return;
+	const prevCwd = process.cwd();
+	try {
+		process.chdir(workspace);
+		await runAdd([PRUFF_CATALOG], {
+			skill: [DB_READER_SKILL],
+			agent: ["claude-code"],
+			yes: true
+		});
+	} catch {} finally {
+		process.chdir(prevCwd);
+	}
+	if (existsSync(join(workspace, ".claude", "skills", DB_READER_SKILL, "SKILL.md"))) M.success(`Skill ${DB_READER_SKILL} installed`);
+	else note(`Skill ${DB_READER_SKILL} not installed — run ${import_picocolors.default.cyan(`npx pruff-skills add ${PRUFF_CATALOG} --skill ${DB_READER_SKILL}`)} from ${workspace}.`);
+}
+async function setupDbReader({ workspace, note }) {
+	M.step("Setting up read-only prod database access…");
+	const identity = aws([
+		"sts",
+		"get-caller-identity",
+		"--query",
+		"Arn",
+		"--output",
+		"text"
+	]);
+	if (!identity.ok) {
+		note(`Prod DB access not set up — no AWS credentials. Ask your team for AWS access, run ${import_picocolors.default.cyan("aws configure")}, then ${import_picocolors.default.cyan("npx pruff-skills onboarding --db-access")}.`);
+		return;
+	}
+	const iamUser = iamUserFromArn(identity.out);
+	if (!iamUser) {
+		note(`Prod DB access not set up — the AWS identity is not an IAM user. Use your personal IAM user credentials and re-run ${import_picocolors.default.cyan("npx pruff-skills onboarding --db-access")}.`);
+		return;
+	}
+	const secretId = `${DB_READER_SECRET_PREFIX}${iamUser}`;
+	const fetched = aws([
+		"secretsmanager",
+		"get-secret-value",
+		"--secret-id",
+		secretId,
+		"--region",
+		DB_READER_REGION,
+		"--query",
+		"SecretString",
+		"--output",
+		"text"
+	]);
+	if (!fetched.ok) {
+		if (/ResourceNotFound/.test(fetched.err)) {
+			const name = suggestMysqlName((spawnSync("git", [
+				"config",
+				"--global",
+				"user.email"
+			], {
+				encoding: "utf-8",
+				stdio: "pipe"
+			}).stdout ?? "").trim(), iamUser);
+			note(`Prod DB access pending — ask the infra owner to run: ${import_picocolors.default.cyan(`stacks/buzz-db-reader/scripts/create-reader ${name} ${iamUser}`)}, then re-run ${import_picocolors.default.cyan("npx pruff-skills onboarding --db-access")}.`);
+		} else note(`Prod DB access not set up — could not read ${secretId}. Check it manually: ${import_picocolors.default.cyan(`aws secretsmanager describe-secret --secret-id ${secretId} --region ${DB_READER_REGION}`)}`);
+		return;
+	}
+	const secret = parseReaderSecret(fetched.out);
+	if (!secret) {
+		note(`Prod DB access not set up — ${secretId} does not hold a valid username and password.`);
+		return;
+	}
+	if (!storeInKeychain(secret.username, secret.password)) {
+		note(`Prod DB access not set up — the Keychain write failed. Add it by hand: ${import_picocolors.default.cyan(`security add-generic-password -U -s ${DB_READER_SERVICE} -a ${secret.username} -w`)} (prompts for the password).`);
+		return;
+	}
+	writeConfig(secret.username);
+	M.success(`Keychain entry ${DB_READER_SERVICE} stored for ${secret.username}`);
+	if (!downloadCaBundle()) {
+		note(`Prod DB access not set up — the RDS CA bundle download failed. Run: ${import_picocolors.default.cyan(`curl -sSfo ${dbReaderCaPath()} ${RDS_CA_URL}`)}`);
+		return;
+	}
+	const installError = await installScripts();
+	if (installError) {
+		note(`Prod DB access not set up — ${installError}. Re-run once the catalog is reachable.`);
+		return;
+	}
+	M.success(`Installed ${DB_READER_SCRIPTS.join(" and ")} in ${dbReaderBinDir()}`);
+	if (!(process.env.PATH ?? "").split(delimiter).includes(dbReaderBinDir())) M.warn(`${dbReaderBinDir()} is not on your PATH. Add ${import_picocolors.default.cyan("export PATH=\"$HOME/.local/bin:$PATH\"")} to ~/.zshrc.`);
+	const verify = runVerify$1();
+	if (!verify.ok) {
+		note(`Prod DB access not enabled — ${import_picocolors.default.cyan("pruff-db-verify")} failed. Run ${import_picocolors.default.cyan(`${join(dbReaderBinDir(), "pruff-db-verify")} ${DB_READER_VERIFY_DATABASE}`)} and share the output with the infra owner.`);
+		M.warn(verify.out);
+		return;
+	}
+	M.success("Read-only access verified");
+	if (mergeAllowlist(workspace) === "invalid") note(`Add ${import_picocolors.default.cyan(DB_READER_ALLOW_ENTRY)} to permissions.allow in ${join(workspace, ".claude", "settings.json")} by hand — the file is not valid JSON.`);
+	const hooks = await installHooks(["prod-db-guard"]);
+	for (const failure of hooks.failed) note(`Hook ${failure.name} not installed: ${failure.reason}`);
+	await installReaderSkill(workspace, note);
+	if (!existsSync(join(workspace, ".claude", "rules", "prod-db-reads.md"))) note(`The prod-db-reads rule is missing from the workspace — run ${import_picocolors.default.cyan("npx pruff-skills rules add --all")} from ${workspace}.`);
+}
+const WORKSPACE_DIRS = [".claude/scripts"];
+const sha256 = (content) => createHash("sha256").update(content).digest("hex");
+const isExecutable = (name) => /\.(sh|zsh|bash)$/.test(name);
+async function installWorkspaceFiles(workspace, source = PRUFF_CATALOG) {
+	const result = {
+		written: [],
+		unchanged: [],
+		skippedLocalEdits: [],
+		catalogUnavailable: false
+	};
+	const state = readState();
+	for (const dir of WORKSPACE_DIRS) {
+		const names = await listCatalogDir(source, `workspace/${dir}`);
+		if (names === null) {
+			result.catalogUnavailable = true;
+			continue;
+		}
+		for (const name of names.sort()) {
+			const content = await fetchCatalogFile(source, `workspace/${dir}/${name}`);
+			if (content === null) continue;
+			const target = join(workspace, dir, name);
+			const current = existsSync(target) ? readFileSync(target, "utf-8") : null;
+			if (current === content) {
+				state.files[target] = sha256(content);
+				result.unchanged.push(target);
+				continue;
+			}
+			if (current !== null && sha256(current) !== state.files[target]) {
+				result.skippedLocalEdits.push(target);
+				continue;
+			}
+			mkdirSync(dirname(target), { recursive: true });
+			writeFileSync(target, content, "utf-8");
+			if (isExecutable(name)) chmodSync(target, 493);
+			state.files[target] = sha256(content);
+			result.written.push(target);
+		}
+	}
+	writeState(state);
+	return result;
+}
 const RESET = "\x1B[0m";
 const DIM = "\x1B[38;5;102m";
 const BLUES = [
@@ -6395,9 +7033,10 @@ async function showBlockLogo(lines, letterCuts, { slow = false, palette = BLUES
 }
 const WORKSPACE_CLAUDE_TEMPLATE = `# Pruff — Working Directory
 
-This folder is the working directory for Pruff's frontend and backend. The two main git repos are:
+This folder is the working directory for Pruff's frontend and backend. The three main git repos are:
 
-- **\`Pruff-Client/\`** — React frontend
+- **\`Pruff-Client/\`** — React frontend (customer-facing, tenant-scoped)
+- **\`Pruff-Backoffice/\`** — React frontend (internal staff, cross-tenant)
 - **\`Pruff-server/\`** — Node.js/Express backend
 
 Other directories (\`sls-*/\`, \`slsl-*/\`, \`AWS-Tools/\`, etc.) are serverless microservices and tooling —
@@ -6408,14 +7047,33 @@ workspace-level context only.
 
 ---
 
+## Read the repo's own rules before touching its files
+
+When the session is rooted at the workspace folder, a repo's \`CLAUDE.md\` and \`.claude/rules/\` are **not**
+loaded automatically — only this file is. The repo-level rules are the authoritative, most current
+source for that codebase; this file is a workspace-level summary. Where they disagree, the repo rule wins.
+
+Before your first edit to any file inside a repo subdirectory, read that repo's rules (once per session):
+
+\`\`\`bash
+cat Pruff-server/CLAUDE.md Pruff-server/.claude/rules/*.md     # backend work
+cat Pruff-Client/CLAUDE.md Pruff-Client/.claude/rules/*.md     # frontend work
+cat Pruff-Backoffice/CLAUDE.md Pruff-Backoffice/.claude/rules/*.md
+\`\`\`
+
+If the session is already rooted inside the repo (or one of its worktrees), they load automatically.
+
+---
+
 ## Workspace Layout
 
 ### Main applications (modify freely when asked)
 
 | Folder | What it is |
 |---|---|
-| \`Pruff-Client/\` | React 18 + Vite + MUI frontend. React Query + Redux Toolkit. |
-| \`Pruff-server/\` | Node.js 22 / Express / Prisma backend. Multi-tenant (DB-per-tenant). |
+| \`Pruff-Client/\` | React 18 + Vite + MUI frontend. Many feature pages, React Query + Redux Toolkit. |
+| \`Pruff-Backoffice/\` | React 19 + Vite + MUI v7 internal staff frontend. Cross-tenant views, tenant config, roles/permissions. React Query + Zustand. Consumes \`/api/backoffice\`. Branches from \`main\` (no \`dev\`); no test suite. |
+| \`Pruff-server/\` | Node.js 22 / Express / Prisma backend. Multi-tenant (DB-per-tenant), many domains and routes. |
 
 ### Serverless microservices (\`sls-*/\`, \`slsl-*/\` — clone as needed, don't modify unless asked)
 
@@ -6434,27 +7092,57 @@ over HTTPS with an \`x-api-key\`.
 | \`sls-Notification-Service/\` | **Outbound notifications** (email, in-app, collections). |
 | \`sls-Pruff-Webhooks/\` | **Outbound webhook delivery** to client integrations. |
 | \`sls-Pruff-Workers/\` | **Async background jobs for Pruff-server** (PDF rendering, tenant document/summary sync crons). |
+| \`sls-Judiciary-Extraction/\` | **PJUD (Poder Judicial) scraper.** Given a RUT, returns every *causa* across the jurisdictional competences; no database, writes the aggregate to S3. Build on \`extractCourtCases\`; \`judiciaryOrchestrator\` + \`judiciaryScrapper\` is the legacy rollback path — don't add features to it. |
+| \`sls-external-databases/\` | **External compliance/risk data sources behind API Gateway** (Bankruptcy, Rutificator, DepartmentOfLabor): scheduled bulk extractors plus query endpoints. Also read synchronously by Pruff-server via \`externalDatabasesModule\`, so it sits on the request path. |
+| \`sls-server-scheduler/\` | **Cron triggers for Pruff-server's jobs.** EventBridge-scheduled Lambdas, each a thin \`POST\` to an \`/api/external/jobs/*\` endpoint with an \`x-api-key\`. Schedules are UTC only. Jobs are migrating to \`Pruff-infra/stacks/pruff-job-runner\`. |
+
+#### Deprecated / being retired — don't invest in these
+
+| Folder | Status |
+|---|---|
+| \`sls-financial-statements/\` | **Deprecated.** Leave it out of workspace-wide sweeps (lockfiles, Dependabot, OIDC, CODEOWNERS). |
+| \`sls-TGR-Extraction/\` | **Slated for deprecation.** Still live and deployed, so it stays in the table above; check the tracking issue before starting non-trivial work in it. |
+
+If you add a new \`sls-*\` repo, add it to the table above — workspace-wide sweeps are derived from this list.
+
+**Not every Lambda is an \`sls-*\` repo.** Several live in \`Pruff-infra/stacks/\` and deploy with
+\`terraform apply\` instead (e.g. \`newsletter-automation\`, \`github-release-automation\`,
+\`intelligence-recompute\`, \`reconcile-credit-note-links\`, \`posthog-error-digest\`, \`buzz-relay\`).
+
+**Scheduled Pruff-server jobs are a third list.** \`Pruff-infra/stacks/pruff-job-runner\` runs them as
+one-shot Fargate tasks (EventBridge Scheduler → \`ecs:RunTask\`, \`America/Santiago\`), one task definition
+and one schedule per job. They are not Lambdas and do not appear in \`aws lambda list-functions\`.
 
 ### Tooling & utilities
 
 | Folder | What it is |
 |---|---|
 | \`AWS-Tools/\` | Standalone Node/TypeScript scripts for AWS ops — not deployed; run locally with AWS creds. |
+| \`dte-signer/\` | \`@pruff/dte-signer\` — TypeScript library to emit and cede DTEs before the SII. Published as a package, not deployed. Prototype: most of the public surface is not implemented yet. Single \`main\` branch. |
+
+### Worktrees & scratch (do not touch)
+
+| Folder | What it is |
+|---|---|
+| \`.worktrees/\`, \`worktrees/\` | Git worktrees created by the harness for isolated agent runs. |
+| \`Pruff-Client-boneyard/\` | Archived/deleted frontend components kept for reference. |
+| \`Pruff-Client-pru-*/\`, \`Pruff-server-pru-*/\` | Per-ticket worktrees for in-progress PRs. Work in \`Pruff-Client/\` and \`Pruff-server/\` unless pointed at one of these. |
 
 ### Cross-service data flow (mental model)
 
 \`\`\`
-sls-SII-Services ─┐
-sls-TGR-Extraction ├─► slsl-Data-Injection-Syncronizer ─► Pruff-server (per-tenant DBs)
-sls-Public-Market ─┘                          │
-                                              ▼
-                                    sls-Decision-Engine ──► Pruff-server
-                                              │
-                                              ▼
-                    sls-Notification-Service / sls-Pruff-Webhooks (outbound)
+sls-SII-Services      ─┐
+sls-TGR-Extraction     ├─► slsl-Data-Injection-Syncronizer ─► Pruff-server (per-tenant DBs)
+sls-Public-Market      │                       │                        ▲
+sls-external-databases ┘                       ▼                        │
+                                     sls-Decision-Engine ──► Pruff-server
+                                               │            (pull, via API Gateway:
+                                               ▼             externalDatabasesModule)
+                     sls-Notification-Service / sls-Pruff-Webhooks (outbound)
 \`\`\`
 
 \`sls-Pruff-Workers\` sits beside \`Pruff-server\` handling async/scheduled jobs that would block the API.
+\`sls-external-databases\` is also read synchronously (Pruff-server calls its \`/consult\` endpoints on demand).
 
 ---
 
@@ -6534,7 +7222,7 @@ src/
     internal/      # Staff endpoints (JWT auth)
     clients/       # Customer-facing endpoints (API key)
     external/      # Scraper/lambda endpoints (API key)
-    public/        # No auth
+    public/        # No auth at tier level
   modules/         # Infrastructure wrappers (S3, SQS, SII, GoFirmex, etc.)
   middlewares/     # Auth, tenant resolution, rate limiting, error handling
   jobs/            # Cron jobs (iterate over all tenants)
@@ -6544,33 +7232,43 @@ src/
 
 ### API Tiers
 
+Six tiers, all mounted in \`src/routes/api.ts\`:
+
 | Tier | Base Route | Auth | Middleware |
 |------|-----------|------|-----------|
-| Internal | \`/api/internal\` | JWT | \`authenticateJWT\` + \`attachUserPermissions\` |
-| External | \`/api/external\` | API Key | \`authenticateWithApiKey\` |
-| Clients | \`/api/clients\` | Client API Key | \`authenticateClientsWithApiKey\` |
-| Public | \`/api/public\` | None | — |
+| Internal | \`/api/internal\` | JWT | \`tenantMiddleware(JWTTenantResolver)\` + \`loadUser\` + \`attachUserPermissions\` |
+| External | \`/api/external\` | API Key (one shared key) | \`authenticateWithApiKey\` |
+| Clients | \`/api/clients\` | Client API Key | \`tenantMiddleware(ClientApiKeyTenantResolver)\` + \`logApiKeyRequest\` |
+| Public | \`/api/public\` | None at tier level — each endpoint self-guards | — |
+| Backoffice | \`/api/backoffice\` | None at tier level — validated per sub-router | — |
+| Service | \`/api/service\` | Pruff-ai service token | \`requirePruffAiServiceToken\` |
 
 ### Service Pattern — Result\\<T\\>
 
-All services return \`Result<T>\`. Never throw from services.
+All services return \`Result<T>\` (where \`T extends Record<string, unknown>\`). Never throw from services.
+Services extend \`BaseService\` so \`serviceName\` is inferred — never pass a string literal.
 
 \`\`\`typescript
-type Result<T> = { ok: true; value: T } | { ok: false; error: AppError };
-
-return { ok: true, value };
-return { ok: false, error: { status: APP_CODES.NOT_FOUND, message: 'NOT_FOUND', service: 'MyService', displayMessage: 'No encontrado' } };
+class CreateFeatureService extends BaseService {
+  async execute(prisma: PrismaClient, dto: CreateFeatureDto): Promise<Result<Feature>> {
+    return Result.success({ feature });
+    return Result.failure({ service: this.serviceName, status: APP_CODES.NOT_FOUND, message: 'NOT_FOUND', displayMessage: 'No encontrado' });
+  }
+}
+export default new CreateFeatureService();
 \`\`\`
 
 ### Controller Pattern — handleApiOutput / handleApiError
 
+Pass the **service instance**, not a string.
+
 \`\`\`typescript
 async someAction(req: UserRequest, res: Response) {
   try {
     const result = await SomeService.execute(req.prisma, req.body);
-    return handleApiOutput('SomeService', req, res, result);
+    return handleApiOutput(SomeService, req, res, result);
   } catch (error) {
-    handleApiError('SomeService', req, res, error);
+    handleApiError(SomeService, req, res, error);
   }
 }
 \`\`\`
@@ -6580,7 +7278,7 @@ async someAction(req: UserRequest, res: Response) {
 - **Services:** \`PascalCase\` + \`Service\` suffix → \`CreateFactoringRequestService.ts\`
 - **DTOs/interfaces:** \`PascalCase\` + \`Dto\` suffix → \`CreateFactoringRequestDto\`
 - **Controllers:** \`camelCase\` + \`Controller\` suffix → \`invoicesController.ts\`
-- **Services are singletons:** \`export default new MyService();\`
+- **Services are singletons extending \`BaseService\`:** \`export default new MyService();\`
 - **\`prisma\` is always the first parameter** when the service needs DB access
 
 ### Accounting Rules
@@ -6718,10 +7416,17 @@ Notes are frontmatter/filenames in English (\`kebab-case\`), body in Spanish. Se
 
 - **Always use \`/commit\`** — invoke the \`commit\` skill for all git commits. Never run \`git commit\` manually.
 - **Always use \`/create-pr\`** — invoke the \`create-pr\` skill for all pull requests. Never run \`gh pr create\` manually.
-- **Commits are authored to the human running Claude Code** — never set \`--author\` to Claude or any co-author.
-- **In \`sls-*/\` and \`slsl-*/\` repos, branch from \`origin/main\`** — verify this against each repo's actual
-  \`dev\` vs \`main\` state before assuming; it has drifted before. Exception: \`Pruff-server\` and
-  \`Pruff-Client\` branch from \`dev\` (their deploy flow promotes \`dev → main\`).
+- **You, the human, are the sole author of every commit** — never set \`--author\` to Claude and never add Claude as a co-author.
+- **In \`sls-*/\` and \`slsl-*/\` repos, branch from \`origin/main\`** — these repos deploy from \`main\` and
+  their \`dev\` branches are stale/abandoned. PR target = branch base = \`main\`. Exception: \`Pruff-server\`
+  and \`Pruff-Client\` branch from \`dev\` (their deploy flow promotes \`dev → main\`). \`Pruff-Backoffice\`
+  and \`dte-signer\` have no \`dev\` — branch and target \`main\`.
+- **Create worktrees with \`.claude/scripts/wt-new.sh\`** (or \`wt new <repo> <branch>\` after sourcing
+  \`.claude/scripts/wt.zsh\`) — never by hand. It picks the correct base (\`dev\` for
+  Pruff-server/Pruff-Client/Pruff-ai, \`main\` for everything else), fetches it first, clones
+  \`node_modules\` copy-on-write and symlinks \`test.env\`/\`local.env\`/\`dev.env\` from the main checkout.
+  For a hotfix pass \`--hotfix\` so the branch comes off \`origin/main\`, or \`--base <branch>\` for any
+  other base. Remove one with \`.claude/scripts/wt-rm.sh\`; diagnose with \`.claude/scripts/wt-doctor.sh\`.
 - **Branch names embed the Linear issue code; PRs map 1:1 with Linear issues** — name branches so they
   contain the issue code (e.g. \`pru-1355-...\`) for Linear's git automation. When splitting work, plan
   the PR grouping first, create one Linear issue per PR (1:1), and stack dependent PRs
@@ -6802,56 +7507,6 @@ async function main() {
   console.log('RUT_HOLDER=' + (company ? company.secretId : ''));
 }
 
-main()
-  .catch((e) => {
-    console.error(e);
-    process.exit(1);
-  })
-  .finally(() => process.exit(0));
-`;
-const TENANT_USER_BACKFILL_SCRIPT = `import PrismaClientManager from './src/modules/prismaClient';
-import EncryptionModule from './src/modules/encryptionModule';
-
-const SUPER_ADMIN_ROLE_ID = 4;
-
-async function main() {
-  const email = process.argv[2];
-  const password = process.argv[3];
-  const clientId = process.env.CLIENT_ID;
-  if (!clientId) throw new Error('CLIENT_ID is required');
-
-  const tenantPrisma = PrismaClientManager.getGlobalClient();
-  const existing = await tenantPrisma.user.findFirst({ where: { email } });
-
-  if (existing) {
-    // create-intel-tenant-local resets tenant roles to Administrador only;
-    // reconnect Super Administrador so the local admin keeps full access.
-    await tenantPrisma.user.update({
-      where: { id: existing.id },
-      data: { roles: { connect: [{ id: SUPER_ADMIN_ROLE_ID }] } },
-    });
-    console.log('tenant user present: ' + email + ' (super-admin role ensured)');
-    return;
-  }
-
-  const globalPrisma = PrismaClientManager.getGlobalClientFromTenantBase(clientId);
-  const globalUser = await globalPrisma.user.findFirstOrThrow({ where: { email } });
-  const encryptedPassword = await EncryptionModule.encrypt(password);
-
-  await tenantPrisma.user.create({
-    data: {
-      id: globalUser.id,
-      email,
-      name: email.split('@')[0],
-      password: encryptedPassword,
-      active: true,
-      companyId: globalUser.companyId,
-      roles: { connect: [{ id: SUPER_ADMIN_ROLE_ID }] },
-    },
-  });
-  console.log('tenant user created: ' + email + ' (id=' + globalUser.id + ')');
-}
-
 main()
   .catch((e) => {
     console.error(e);
@@ -6888,72 +7543,28 @@ main()
   })
   .finally(() => process.exit(0));
 `;
-const MIGRATE_TENANTS_LOCAL_SCRIPT = `import { exec } from 'child_process';
-import dotenv from 'dotenv';
-import PrismaClientManager from '../src/modules/prismaClient';
-const env = 'local.env';
-dotenv.config({ path: env });
-
-async function getActiveTenants() {
-  const prismaGlobal = PrismaClientManager.getGlobalClient();
-  const companies = await prismaGlobal.company.findMany({
-    where: { tenant: true },
-    select: { secretId: true },
-  });
-  console.log('Companies:', companies.length);
-  return companies.map((company) => company.secretId);
-}
-
-function migrate(label: string, databaseUrl: string) {
-  return new Promise((resolve, reject) => {
-    const command = \`DATABASE_URL="\${databaseUrl}" npx prisma migrate deploy\`;
-    console.log(\`Running command: \${command}\`);
-    exec(command, (error, stdout, stderr) => {
-      if (error) {
-        console.error(\`Error migrating \${label}:\`, error);
-        reject(error);
-        return;
-      }
-      if (stderr) {
-        console.error(\`Stderr for \${label}:\`, stderr);
-        reject(new Error(stderr));
-        return;
-      }
-      console.log(\`Migration output for \${label}:\`, stdout);
-      resolve(stdout);
-    });
-  });
-}
-
-async function migrateTenants() {
-  console.log('Migrating main database');
-  try {
-    await migrate('local database', process.env.DATABASE_URL!);
-  } catch (error) {
-    console.error('Failed to migrate local database:', error);
-  }
-
-  try {
-    const tenantIds = await getActiveTenants();
-    for (const tenantId of tenantIds) {
-      console.log(\`Migrating tenant: \${tenantId}\`);
-      const databaseUrl = process.env.DATABASE_URL!.replace(
-        '/${CONTROL_PLANE_DB}',
-        \`/tenant-\${tenantId}\`,
-      );
-      try {
-        await migrate(\`tenant \${tenantId}\`, databaseUrl);
-      } catch (error) {
-        console.error(\`Failed to migrate tenant \${tenantId}:\`, error);
-      }
-    }
-  } catch (error) {
-    console.error('Error fetching tenants or migrating:', error);
-  }
-}
+const TENANT_CONFIG_PATH = join("scripts", "tenant", "tenant.config.ts");
+function renderTenantConfig(v) {
+	return `import { CompanyType } from './consts';
+import { TenantScriptConfig } from './types';
+
+const config: TenantScriptConfig = {
+  secretId: ${JSON.stringify(v.secretId)},
+  taxIdentifier: ${JSON.stringify(v.taxIdentifier)},
+  companyName: ${JSON.stringify(v.companyName)},
+  companyTypes: [CompanyType.Intelligence],
+  admin: {
+    email: ${JSON.stringify(v.adminEmail)},
+    password: ${JSON.stringify(v.adminPassword)},
+    superAdmin: true,
+  },
+  additionalUsers: [],
+  configurationFlags: [],
+};
 
-migrateTenants();
+export default config;
 `;
+}
 function mysqlUrl(dbPassword, db, query = "") {
 	return `mysql://${dbPassword ? `root:${encodeURIComponent(dbPassword)}` : "root"}@localhost:3306/${db}${query}`;
 }
@@ -7090,11 +7701,17 @@ const WORKSPACE_SETTINGS_JSON = `${JSON.stringify({ permissions: { allow: [
 	"mcp__linear-server__get_project"
 ] } }, null, 2)}\n`;
 const CLAUDE_CODE_PKG = "@anthropic-ai/claude-code";
-const INTELLIGENCE_SCHEMA = "prisma/intelligence/schema.prisma";
-const SERVER_SCHEMA = "prisma/schema";
+const SERVER_SCRIPT = {
+	migrate: "db-migrate-local",
+	seedControlPlane: "db-seed-control-plane-local",
+	createTenant: "create-tenant-local",
+	openAccountingPeriod: "open-accounting-period-local",
+	intelMigrate: "db-intel-migrate-local",
+	intelGenerate: "db-intel-generate",
+	intelSeedGlobal: "db-seed-intel-global-local",
+	intelCreateTenant: "create-intel-tenant-local"
+};
 const PRISMA_BIN = join("node_modules", ".bin", "prisma");
-const INTELLIGENCE_GLOBAL_SEED = "prisma/intelligence/seeds/seedIntelligenceGlobal.ts";
-const INTELLIGENCE_TENANT_SCRIPT = "scripts/intelligence/createIntelligenceTenant.ts";
 const KNOWLEDGE_REPO = "https://github.com/Pruff-Tech/pruff-knowledge";
 const KNOWLEDGE_DIR = "Pruff Knowledge";
 const DEFAULT_WORKSPACE = join(homedir(), "pruff");
@@ -7129,6 +7746,27 @@ const CORE_AGENTS = [
 	"db-query-reviewer",
 	"pruff-logs-investigator"
 ];
+const TEAM_HOOKS = [
+	"sweep-nudge",
+	"prod-db-guard",
+	"handoff-nudge",
+	"save-session"
+];
+const TEAM_USER_ENV = { CLAUDE_CODE_SUBAGENT_MODEL: "sonnet" };
+function catalogInstallNames(rawIndex) {
+	if (!rawIndex) return {
+		skills: CORE_SKILLS,
+		agents: CORE_AGENTS
+	};
+	const index = parseCatalogIndex(rawIndex, PRUFF_CATALOG);
+	const names = (entries) => Array.isArray(entries) ? entries.map((e) => e.name).filter((n) => typeof n === "string") : [];
+	const skills = names(index.skills);
+	const agents = names(index.agents);
+	return {
+		skills: skills.length > 0 ? [...new Set([...skills, "find-skills"])] : CORE_SKILLS,
+		agents: agents.length > 0 ? agents : CORE_AGENTS
+	};
+}
 const issues = [];
 function note(issue) {
 	issues.push(issue);
@@ -7138,8 +7776,21 @@ async function runOnboarding(args) {
 		M.error(`${import_picocolors.default.bold("onboarding")} currently supports macOS only (detected ${import_picocolors.default.cyan(process.platform)}).`);
 		return;
 	}
+	if (args.includes("--print-claude-md")) {
+		process.stdout.write(WORKSPACE_CLAUDE_TEMPLATE);
+		return;
+	}
 	Ie(import_picocolors.default.bold("Pruff onboarding"));
 	issues.length = 0;
+	if (args.includes("--db-access")) {
+		await setupDbReader({
+			workspace: await resolveWorkspace(args),
+			note
+		});
+		showIssues();
+		Se(issues.length === 0 ? import_picocolors.default.green("Done.") : import_picocolors.default.yellow("Prod DB access is not complete — fix the items above and re-run."));
+		return;
+	}
 	if (!await preflight()) {
 		Se(import_picocolors.default.yellow("Onboarding stopped — fix the items above and re-run."));
 		return;
@@ -7156,10 +7807,16 @@ async function runOnboarding(args) {
 	writeWorkspaceClaudeMd(workspace);
 	writeHarnessConfig(workspace);
 	await installCatalog(workspace);
+	await installHarness(workspace);
 	if (await shouldSetupDatabase(args)) await setupLocalEnvironment(join(workspace, "Pruff-server"));
+	if (await shouldSetupDbAccess(args)) await setupDbReader({
+		workspace,
+		note
+	});
 	await showGuidance(workspace);
 	showTeamCredentialsAsk(workspace);
 	showIssues();
+	showLocalLogin();
 	if (issues.length === 0) Se(`${import_picocolors.default.green("Done.")} Welcome to Pruff — happy building.`);
 	else Se(`${import_picocolors.default.yellow(`Finished with ${issues.length} issue${issues.length === 1 ? "" : "s"}.`)} Fix them and re-run — every step is idempotent.`);
 }
@@ -7425,12 +8082,19 @@ function installDeps(repo, workspace) {
 }
 function writeWorkspaceClaudeMd(workspace) {
 	const target = join(workspace, "CLAUDE.md");
-	if (existsSync(target)) {
-		M.success("Workspace CLAUDE.md already present — leaving it untouched");
+	const hash = (s) => createHash("sha256").update(s).digest("hex");
+	const state = readState();
+	const current = existsSync(target) ? readFileSync(target, "utf-8") : null;
+	if (current === WORKSPACE_CLAUDE_TEMPLATE) M.success("Workspace CLAUDE.md is up to date");
+	else if (current !== null && hash(current) !== state.files[target]) {
+		M.warn(`Workspace CLAUDE.md has your own edits — left untouched. The team template changed; compare with ${import_picocolors.default.cyan("npx pruff-skills onboarding --print-claude-md")}.`);
 		return;
+	} else {
+		writeFileSync(target, WORKSPACE_CLAUDE_TEMPLATE, "utf-8");
+		M.success(current === null ? "Wrote workspace CLAUDE.md" : "Updated workspace CLAUDE.md");
 	}
-	writeFileSync(target, WORKSPACE_CLAUDE_TEMPLATE, "utf-8");
-	M.success("Wrote workspace CLAUDE.md");
+	state.files[target] = hash(WORKSPACE_CLAUDE_TEMPLATE);
+	writeState(state);
 }
 function writeHarnessConfig(workspace) {
 	writeIfAbsent(join(workspace, ".mcp.json"), WORKSPACE_MCP_JSON, "MCP servers (.mcp.json)");
@@ -7452,9 +8116,10 @@ async function installCatalog(workspace) {
 	try {
 		process.chdir(workspace);
 		await runRules(["add", "--all"]);
-		await runAgents(["add", ...CORE_AGENTS]);
+		const { skills, agents } = catalogInstallNames(await fetchCatalogFile(PRUFF_CATALOG, ".well-known/agent-skills/index.json"));
+		await runAgents(["add", ...agents]);
 		await runAdd([PRUFF_CATALOG], {
-			skill: CORE_SKILLS,
+			skill: skills,
 			agent: ["claude-code"],
 			yes: true
 		});
@@ -7465,6 +8130,53 @@ async function installCatalog(workspace) {
 		process.chdir(prevCwd);
 	}
 }
+async function installHarness(workspace) {
+	M.step("Installing the team harness (hooks, settings, scripts)…");
+	try {
+		const state = readState();
+		const env = applyOwnedEnv(readClaudeSettings$1(), TEAM_USER_ENV, state.env);
+		writeClaudeSettings$1(env.settings);
+		writeState({
+			...readState(),
+			env: env.owned
+		});
+		for (const key of env.keptUserValues) M.info(`${key} already set in ~/.claude/settings.json — kept your value`);
+		const hooks = await installHooks(TEAM_HOOKS);
+		const ready = [...hooks.installed, ...hooks.unchanged];
+		if (ready.length > 0) M.success(`Hooks: ${ready.join(", ")}`);
+		for (const name of hooks.skippedLocalEdits) M.warn(`Hook ${name} was edited locally — kept. Overwrite with ${import_picocolors.default.cyan(`npx pruff-skills hooks add ${name} --force`)}`);
+		for (const f of hooks.failed) note(`Hook ${f.name} not installed: ${f.reason}`);
+		const files = await installWorkspaceFiles(workspace);
+		if (files.catalogUnavailable) note("Workspace scripts could not be read from the catalog.");
+		for (const path of files.skippedLocalEdits) M.warn(`${path} has local edits — kept`);
+		M.message(import_picocolors.default.dim(`Worktree helper: add ${import_picocolors.default.cyan(`source ${join(workspace, ".claude", "scripts", "wt.zsh")}`)} to ~/.zshrc`));
+	} catch (error) {
+		note("Team harness did not finish installing.");
+		M.warn(error instanceof Error ? error.message : String(error));
+	}
+	ensureRtk();
+}
+function ensureRtk() {
+	if (!has("rtk")) {
+		const s = Y();
+		s.start("Installing RTK…");
+		const ok = run("brew", ["install", "rtk"]);
+		s.stop(ok ? "RTK installed" : import_picocolors.default.yellow("RTK install failed"));
+		if (!ok) {
+			note(`RTK not installed — run ${import_picocolors.default.cyan("brew install rtk")}.`);
+			return;
+		}
+	}
+	if (spawnSync("rtk", ["gain"], { stdio: "ignore" }).status !== 0) {
+		note(`The ${import_picocolors.default.cyan("rtk")} on PATH is not RTK (name collision with Rust Type Kit).`);
+		return;
+	}
+	if (!run("rtk", [
+		"init",
+		"-g",
+		"--auto-patch"
+	])) note("`rtk init -g` failed.");
+}
 async function setupLocalEnvironment(serverPath) {
 	if (!existsSync(join(serverPath, ".git"))) {
 		note("Local database not set up — Pruff-server was not cloned.");
@@ -7481,7 +8193,6 @@ async function setupLocalEnvironment(serverPath) {
 	const dbPassword = await resolveRootPassword();
 	if (dbPassword === null) return;
 	generateLocalEnv(serverPath, dbPassword);
-	writeMigrateTenantsLocal(serverPath);
 	const env = parseEnvFile(join(serverPath, "local.env"));
 	if (!env.DATABASE_URL || !env.CLIENT_ID) {
 		note("Local database not set up — local.env is missing DATABASE_URL / CLIENT_ID.");
@@ -7490,6 +8201,15 @@ async function setupLocalEnvironment(serverPath) {
 	}
 	setupLocalDatabase(serverPath, env);
 }
+async function shouldSetupDbAccess(args) {
+	if (args.includes("--yes") || args.includes("-y") || !process.stdout.isTTY) return true;
+	const answer = await ye({
+		message: "Set up read-only production database access now? (needs your AWS credentials; stores your personal reader password in the macOS Keychain)",
+		initialValue: true
+	});
+	if (pD(answer)) return false;
+	return answer === true;
+}
 async function shouldSetupDatabase(args) {
 	if (args.includes("--no-db")) return false;
 	if (args.includes("--db")) return true;
@@ -7627,11 +8347,6 @@ function generateLocalEnv(serverPath, dbPassword) {
 	}), "utf-8");
 	M.success("Wrote local.env (minimal bootable — fill third-party keys when needed)");
 }
-function writeMigrateTenantsLocal(serverPath) {
-	const target = join(serverPath, "sincronizations", "migrateTenantsLocal.ts");
-	if (!existsSync(join(serverPath, "sincronizations"))) return;
-	writeIfAbsent(target, MIGRATE_TENANTS_LOCAL_SCRIPT, "sincronizations/migrateTenantsLocal.ts");
-}
 function parseEnvFile(path) {
 	if (!existsSync(path)) return {};
 	const out = {};
@@ -7647,11 +8362,6 @@ function parseEnvFile(path) {
 	}
 	return out;
 }
-function decideTenantAction(tenantDbExists, adminUserExists) {
-	if (tenantDbExists && adminUserExists) return "already-provisioned";
-	if (tenantDbExists) return "reset-and-seed";
-	return "create-and-seed";
-}
 function parseMysqlUrl(url) {
 	const u = new URL(url);
 	return {
@@ -7681,15 +8391,6 @@ function mysqlArgs(conn) {
 	if (conn.password) args.push(`-p${conn.password}`);
 	return args;
 }
-function mysqlQuery(conn, sql) {
-	return capture("mysql", [
-		...mysqlArgs(conn),
-		"-N",
-		"-B",
-		"-e",
-		sql
-	]);
-}
 function mysqlExec(conn, sql) {
 	return run("mysql", [
 		...mysqlArgs(conn),
@@ -7697,33 +8398,12 @@ function mysqlExec(conn, sql) {
 		sql
 	]);
 }
-function dbExists(conn, name) {
-	const { out } = mysqlQuery(conn, `SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME = '${name}'`);
-	return out.length > 0;
-}
-function tableExists(conn, db, table) {
-	const { out } = mysqlQuery(conn, `SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = '${db}' AND TABLE_NAME = '${table}'`);
-	return out.length > 0;
-}
-function adminUserExists(conn, db, email) {
-	if (!tableExists(conn, db, "User")) return false;
-	const { ok, out } = mysqlQuery(conn, `SELECT COUNT(*) FROM \`${db}\`.\`User\` WHERE email = '${email}'`);
-	return ok && parseInt(out, 10) > 0;
-}
 function prismaBin(serverPath) {
 	return join(serverPath, PRISMA_BIN);
 }
 function prismaInstalled(serverPath) {
 	return existsSync(prismaBin(serverPath));
 }
-function migrateDeploy(serverPath, url) {
-	return run(prismaBin(serverPath), [
-		"migrate",
-		"deploy",
-		"--schema",
-		SERVER_SCHEMA
-	], serverPath, { DATABASE_URL: url });
-}
 function rutConflict(holderSecretId, clientId) {
 	return holderSecretId !== "" && holderSecretId !== clientId;
 }
@@ -7763,6 +8443,37 @@ function runDisposableScript(serverPath, fileName, contents, env, extraArgs = []
 		rmSync(scriptPath, { force: true });
 	}
 }
+function readServerScripts(serverPath) {
+	try {
+		return JSON.parse(readFileSync(join(serverPath, "package.json"), "utf-8")).scripts ?? {};
+	} catch {
+		return {};
+	}
+}
+function makeServerRunner(serverPath, env) {
+	const pm = has("bun") ? "bun" : "npm";
+	return {
+		exec: (script, extraEnv) => run(pm, ["run", script], serverPath, {
+			...env,
+			...extraEnv
+		}),
+		rerun: (script) => `cd Pruff-server && ${pm} run ${script}`
+	};
+}
+const ONBOARDING_RERUN = "npx pruff-skills onboarding --db";
+function withTenantConfig(serverPath, contents, fn) {
+	const target = join(serverPath, TENANT_CONFIG_PATH);
+	const previous = existsSync(target) ? readFileSync(target, "utf-8") : null;
+	writeFileSync(target, contents, "utf-8");
+	let ok = false;
+	try {
+		ok = fn();
+	} finally {
+		if (previous !== null) writeFileSync(target, previous, "utf-8");
+		else if (ok) rmSync(target, { force: true });
+	}
+	return ok;
+}
 function setupLocalDatabase(serverPath, env) {
 	const controlPlaneUrl = env.DATABASE_URL;
 	const clientId = env.CLIENT_ID;
@@ -7774,134 +8485,125 @@ function setupLocalDatabase(serverPath, env) {
 	const conn = parseMysqlUrl(controlPlaneUrl);
 	const controlPlaneName = dbNameFromUrl(controlPlaneUrl);
 	const tenantName = `tenant-${clientId}`;
-	const tenantUrl = swapDbName(controlPlaneUrl, tenantName);
 	const adminEmail = `admin@${clientId}.com`;
 	if (controlPlaneName !== CONTROL_PLANE_DB) {
 		note(`Local database not set up — DATABASE_URL must point at "${CONTROL_PLANE_DB}".`);
 		M.warn(`DATABASE_URL points at ${import_picocolors.default.cyan(controlPlaneName)}, but Pruff-server hardcodes the local control plane as ${import_picocolors.default.cyan(CONTROL_PLANE_DB)}.\n  Company/user seeds would silently write to the wrong database — fix local.env and re-run with --db.`);
 		return;
 	}
+	const scripts = readServerScripts(serverPath);
+	const missing = [SERVER_SCRIPT.migrate, SERVER_SCRIPT.createTenant].filter((name) => !scripts[name]);
+	if (missing.length > 0) {
+		note(`Local database not set up — Pruff-server has no ${missing.join(" / ")} script (update it to the latest dev).`);
+		M.warn(`Pruff-server's package.json has no ${import_picocolors.default.cyan(missing.join(", "))}.\n  Pull the latest ${import_picocolors.default.dim("dev")} in Pruff-server, then re-run with ${import_picocolors.default.cyan("--db")}.`);
+		return;
+	}
+	const server = makeServerRunner(serverPath, env);
 	M.step(`Setting up local databases (${controlPlaneName} + ${tenantName})…`);
 	mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${controlPlaneName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
-	if (!migrateDeploy(serverPath, controlPlaneUrl)) {
-		note("Local database not set up — control-plane migration failed.");
+	if (!server.exec(SERVER_SCRIPT.migrate)) {
+		note(`Local database not set up — control-plane migration failed. Rerun: ${server.rerun(SERVER_SCRIPT.migrate)}`);
 		M.warn("Control-plane migration failed — skipping the rest of database setup.");
 		return;
 	}
-	runDisposableScript(serverPath, ".pruff-onboarding-preseed.ts", CONTROL_PLANE_PRESEED_SCRIPT, {
+	const hasControlPlaneSeed = Boolean(scripts[SERVER_SCRIPT.seedControlPlane]);
+	if (!(hasControlPlaneSeed ? server.exec(SERVER_SCRIPT.seedControlPlane) : runDisposableScript(serverPath, ".pruff-onboarding-preseed.ts", CONTROL_PLANE_PRESEED_SCRIPT, {
 		...env,
 		DATABASE_URL: controlPlaneUrl
-	});
-	const action = decideTenantAction(dbExists(conn, tenantName), adminUserExists(conn, tenantName, adminEmail));
-	if (action !== "already-provisioned") {
-		const holder = findRutHolder(serverPath, env, controlPlaneUrl);
-		if (rutConflict(holder, clientId)) {
-			note(`Tenant "${clientId}" not seeded — CLIENT_RUT is already used by "${holder}".`);
-			M.warn(`CLIENT_RUT ${import_picocolors.default.cyan(env.CLIENT_RUT ?? "")} already belongs to tenant ${import_picocolors.default.cyan(holder)} in ${controlPlaneName}.\n  Seeding would reuse that company and never register "${clientId}" — the tenant could not be logged into.\n  Change CLIENT_RUT (or CLIENT_ID) in local.env and re-run with --db.`);
-			return;
-		}
-		if (action === "reset-and-seed") {
-			M.warn(`Tenant "${clientId}" partially provisioned — resetting (Pruff-server seed is not idempotent).`);
-			mysqlExec(conn, `DROP DATABASE IF EXISTS \`${tenantName}\``);
-		}
-		mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${tenantName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
-		if (!migrateDeploy(serverPath, tenantUrl)) {
-			note("Local database not set up — tenant migration failed.");
-			M.warn("Tenant migration failed — skipping seed.");
-			return;
-		}
-		const s = Y();
-		s.start(`Seeding tenant "${clientId}"…`);
-		const seeded = run(prismaBin(serverPath), ["db", "seed"], serverPath, {
-			...env,
-			DATABASE_URL: tenantUrl
-		});
-		s.stop(seeded ? `Tenant "${clientId}" seeded` : import_picocolors.default.yellow("Tenant seed failed"));
-		if (!seeded) {
-			note(`Tenant "${clientId}" seed failed.`);
-			return;
-		}
-	} else M.success(`Tenant "${clientId}" already provisioned — skipping seed.`);
-	setupIntelligence(serverPath, env, conn, controlPlaneUrl, adminEmail, adminPassword);
-	if (!runDisposableScript(serverPath, ".pruff-onboarding-tenant-user.ts", TENANT_USER_BACKFILL_SCRIPT, {
-		...env,
-		DATABASE_URL: tenantUrl
-	}, [adminEmail, adminPassword])) {
-		note("Tenant admin user may be missing — the backfill script failed.");
-		M.warn("Tenant admin-user backfill failed — you may need to create the user manually.");
+	}))) {
+		note(`Local database not set up — control-plane seed failed. Rerun: ${hasControlPlaneSeed ? server.rerun(SERVER_SCRIPT.seedControlPlane) : ONBOARDING_RERUN}`);
+		M.warn("Control-plane seed failed — skipping the rest of database setup.");
 		return;
 	}
-	if (!runDisposableScript(serverPath, ".pruff-onboarding-accounting-period.ts", ACCOUNTING_PERIOD_SCRIPT, {
+	const holder = findRutHolder(serverPath, env, controlPlaneUrl);
+	if (rutConflict(holder, clientId)) {
+		note(`Tenant "${clientId}" not seeded — CLIENT_RUT is already used by "${holder}".`);
+		M.warn(`CLIENT_RUT ${import_picocolors.default.cyan(env.CLIENT_RUT ?? "")} already belongs to tenant ${import_picocolors.default.cyan(holder)} in ${controlPlaneName}.\n  Seeding would reuse that company and never register "${clientId}" — the tenant could not be logged into.\n  Change CLIENT_RUT (or CLIENT_ID) in local.env and re-run with --db.`);
+		return;
+	}
+	const s = Y();
+	s.start(`Provisioning tenant "${clientId}"…`);
+	const tenantCreated = withTenantConfig(serverPath, renderTenantConfig({
+		secretId: clientId,
+		taxIdentifier: env.CLIENT_RUT ?? "",
+		companyName: env.CLIENT_NAME ?? clientId,
+		adminEmail,
+		adminPassword
+	}), () => server.exec(SERVER_SCRIPT.createTenant));
+	s.stop(tenantCreated ? `Tenant "${clientId}" provisioned` : import_picocolors.default.yellow("Tenant provisioning failed"));
+	if (!tenantCreated) {
+		note(`Tenant "${clientId}" not provisioned — ${SERVER_SCRIPT.createTenant} failed. Rerun: ${server.rerun(SERVER_SCRIPT.createTenant)} (reads ${TENANT_CONFIG_PATH})`);
+		return;
+	}
+	const hasPeriodScript = Boolean(scripts[SERVER_SCRIPT.openAccountingPeriod]);
+	if (!(hasPeriodScript ? server.exec(SERVER_SCRIPT.openAccountingPeriod) : runDisposableScript(serverPath, ".pruff-onboarding-accounting-period.ts", ACCOUNTING_PERIOD_SCRIPT, {
 		...env,
-		DATABASE_URL: tenantUrl
-	}, [String((/* @__PURE__ */ new Date()).getFullYear())])) {
-		note("No open AccountingPeriod — accounting entries will be rejected until one exists.");
+		DATABASE_URL: swapDbName(controlPlaneUrl, tenantName)
+	}, [String((/* @__PURE__ */ new Date()).getFullYear())]))) {
+		note(`No open AccountingPeriod — accounting entries will be rejected until one exists. Rerun: ${hasPeriodScript ? server.rerun(SERVER_SCRIPT.openAccountingPeriod) : ONBOARDING_RERUN}`);
 		M.warn("Could not open the current-year accounting period — create one under Contabilidad → Períodos.");
 	}
+	setupIntelligence(env, conn, scripts, server, adminEmail, adminPassword);
 	M.success(`Local tenant "${clientId}" ready.`);
 	printLoginHint(clientId, adminEmail, adminPassword);
 }
-function setupIntelligence(serverPath, env, conn, controlPlaneUrl, adminEmail, adminPassword) {
+function setupIntelligence(env, conn, scripts, server, adminEmail, adminPassword) {
 	const intelligenceUrl = env.INTELLIGENCE_DATABASE_URL;
 	if (!intelligenceUrl) {
 		note("Intelligence module unavailable — INTELLIGENCE_DATABASE_URL is not set in local.env.");
 		M.warn(`local.env has no ${import_picocolors.default.cyan("INTELLIGENCE_DATABASE_URL")} — skipping Intelligence setup.`);
 		return;
 	}
+	const steps = [
+		SERVER_SCRIPT.intelMigrate,
+		SERVER_SCRIPT.intelGenerate,
+		SERVER_SCRIPT.intelSeedGlobal,
+		SERVER_SCRIPT.intelCreateTenant
+	];
+	const missing = steps.filter((name) => !scripts[name]);
+	if (missing.length > 0) {
+		note(`Intelligence module unavailable — Pruff-server has no ${missing.join(" / ")} script (update it to the latest dev).`);
+		M.warn(`Pruff-server's package.json has no ${import_picocolors.default.cyan(missing.join(", "))} — skipping Intelligence setup.`);
+		return;
+	}
 	const s = Y();
 	s.start("Setting up Intelligence…");
 	mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${dbNameFromUrl(intelligenceUrl)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
-	const intelligenceEnv = {
-		...env,
-		INTELLIGENCE_DATABASE_URL: intelligenceUrl
-	};
-	if (!(run(prismaBin(serverPath), [
-		"migrate",
-		"deploy",
-		"--schema",
-		INTELLIGENCE_SCHEMA
-	], serverPath, intelligenceEnv) && run(prismaBin(serverPath), [
-		"generate",
-		"--schema",
-		INTELLIGENCE_SCHEMA
-	], serverPath, intelligenceEnv))) {
-		s.stop(import_picocolors.default.yellow("Intelligence database setup failed"));
-		note(`Intelligence module unavailable — could not migrate/generate ${INTELLIGENCE_DB}.`);
-		return;
-	}
-	if (!(run("npx", [
-		"ts-node",
-		"--transpile-only",
-		"-r",
-		"tsconfig-paths/register",
-		INTELLIGENCE_GLOBAL_SEED
-	], serverPath, {
-		...env,
-		DATABASE_URL: controlPlaneUrl
-	}) && run("npx", [
-		"ts-node",
-		"--transpile-only",
-		"-r",
-		"tsconfig-paths/register",
-		INTELLIGENCE_TENANT_SCRIPT
-	], serverPath, {
-		...env,
-		DATABASE_URL: controlPlaneUrl,
+	const enrolment = {
 		TENANT_SECRET_ID: env.CLIENT_ID,
 		TENANT_RUT: env.CLIENT_RUT,
 		TENANT_NAME: env.CLIENT_NAME,
 		USER_EMAIL: adminEmail,
 		USER_PASSWORD: adminPassword,
 		USER_NAME: "Pruff Local Admin"
-	}))) {
-		s.stop(import_picocolors.default.yellow("Intelligence tenant enrolment failed"));
-		note("Intelligence module unavailable — tenant enrolment failed.");
+	};
+	for (const script of steps) {
+		if (server.exec(script, script === SERVER_SCRIPT.intelCreateTenant ? enrolment : void 0)) continue;
+		s.stop(import_picocolors.default.yellow(`Intelligence setup failed at ${script}`));
+		note(`Intelligence module unavailable — ${script} failed. Rerun: ${server.rerun(script)}`);
 		return;
 	}
 	s.stop("Intelligence ready");
 }
+let localLogin = null;
 function printLoginHint(clientId, email, password) {
-	M.info(`Log in locally with:\n  ${import_picocolors.default.dim("secretId:")} ${import_picocolors.default.cyan(clientId)}\n  ${import_picocolors.default.dim("email:   ")} ${import_picocolors.default.cyan(email)}\n  ${import_picocolors.default.dim("password:")} ${import_picocolors.default.cyan(password)}`);
+	localLogin = {
+		clientId,
+		email,
+		password
+	};
+}
+function showLocalLogin() {
+	if (!localLogin) return;
+	const line = (s) => console.log(`  ${s}`);
+	console.log();
+	line(import_picocolors.default.bold("Your local Pruff login") + import_picocolors.default.dim("  (Super Administrador)"));
+	line(`${import_picocolors.default.dim("url:     ")} ${import_picocolors.default.cyan(FRONTEND_URL)}`);
+	line(`${import_picocolors.default.dim("tenant:  ")} ${import_picocolors.default.cyan(localLogin.clientId)}`);
+	line(`${import_picocolors.default.dim("email:   ")} ${import_picocolors.default.cyan(localLogin.email)}`);
+	line(`${import_picocolors.default.dim("password:")} ${import_picocolors.default.cyan(localLogin.password)}`);
+	line(import_picocolors.default.dim("Local only: this user exists in your local databases, never in dev or prod."));
+	console.log();
 }
 async function showGuidance(workspace) {
 	console.log();
@@ -7931,6 +8633,8 @@ async function showGuidance(workspace) {
 	line(`${import_picocolors.default.dim("3.")} Dependencies are installed — ${import_picocolors.default.dim("cd Pruff-server && npm run local")} / ${import_picocolors.default.dim("cd Pruff-Client && yarn start-local")}.`);
 	line(`${import_picocolors.default.dim("4.")} Run ${import_picocolors.default.dim("/mcp")} inside Claude Code to authenticate Linear + PostHog (already configured in ${import_picocolors.default.dim(".mcp.json")}).`);
 	line(`${import_picocolors.default.dim("5.")} Clone any serverless service into this folder with ${import_picocolors.default.dim("git clone <repo>")}.`);
+	line(`${import_picocolors.default.dim("6.")} Install the ${import_picocolors.default.bold("Claude in Chrome")} extension and run ${import_picocolors.default.dim("claude --chrome")} — UI checks and PR screenshots drive the browser through it.`);
+	line(`${import_picocolors.default.dim("7.")} Prod data is read-only: ${import_picocolors.default.dim("pruff-db-query <database> -e \"SELECT …\"")} — your own reader user, password in the Keychain, verified TLS. Finish a pending request with ${import_picocolors.default.dim("npx pruff-skills onboarding --db-access")}.`);
 	console.log();
 }
 function showTeamCredentialsAsk(workspace) {
@@ -8913,6 +9617,11 @@ ${BOLD}Rules:${RESET}
   rules add --scope <client|server|common>
                        Install a whole repo's rule set (client/server also pull in common)
 
+${BOLD}Hooks:${RESET}
+  hooks add <name>     Install a Claude Code hook into ~/.claude/hooks/pruff/ and register it
+  hooks list           Show installed and available hooks
+  hooks remove <name>  Unregister a hook and delete its script
+
 ${BOLD}Usage analytics:${RESET}
   analytics status     Is Claude Code reporting usage to Pruff's PostHog? (alias: telemetry)
   analytics enable     Turn it on in ~/.claude/settings.json
@@ -8941,6 +9650,7 @@ ${BOLD}Onboarding:${RESET}
 ${BOLD}Onboarding Options:${RESET}
   --db                 Force the local database step (non-interactive shells)
   --no-db              Skip the local database step
+  --db-access          Only set up read-only prod database access (needs AWS credentials)
 
 ${BOLD}Updates:${RESET}
   update [skills...]   Update skills to latest versions (alias: upgrade)
@@ -9151,6 +9861,11 @@ async function main() {
 			if (!inAgent) await showLogo();
 			await runRules(restArgs);
 			break;
+		case "hooks":
+		case "hook":
+			if (!inAgent) await showLogo();
+			await runHooks(restArgs);
+			break;
 		case "buzz":
 			if (!inAgent) await showBuzzLogo();
 			await runBuzz(restArgs);