startup-builder 0.2.0 → 0.3.0

package/dist/chunk-ZR74VEI2.js

@@ -0,0 +1,2322 @@
+// src/next/api.ts
+import { randomUUID } from "crypto";
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function originOf(u) {
+  try {
+    const o = new URL(u).origin;
+    return o === "null" ? void 0 : o;
+  } catch {
+    return void 0;
+  }
+}
+function checkBase(base) {
+  let u;
+  try {
+    u = new URL(base);
+  } catch {
+    throw new Error(`refusing the API base "${base}": not a URL`);
+  }
+  if (u.protocol === "https:" || u.protocol === "http:" && LOOPBACK.has(u.hostname)) return u;
+  throw new Error(`refusing the API base ${u.origin || base}: https only (http only on 127.0.0.1, localhost or [::1])`);
+}
+var Api = class {
+  base;
+  token;
+  /** the base’s origin: the only one the bearer is sent to */
+  origin;
+  /** every URL this client read, in order (a worklist lists them as its sources) */
+  reads = [];
+  f;
+  ua;
+  constructor(o) {
+    this.base = o.base.replace(/\/+$/, "");
+    this.origin = checkBase(this.base).origin;
+    this.token = o.token && (o.bind === void 0 || originOf(o.bind) === this.origin) ? o.token : void 0;
+    this.f = o.fetch ?? fetch;
+    this.ua = o.userAgent ?? "startup-builder";
+  }
+  /** A path (`/barcoding.dev/actions`) or a full URL (an `$id`), as a URL on this API. */
+  url(pathOrUrl) {
+    if (/^https?:\/\//.test(pathOrUrl)) return pathOrUrl;
+    return this.base + (pathOrUrl.startsWith("/") ? pathOrUrl : `/${pathOrUrl}`);
+  }
+  /** is this URL on the base’s origin (scheme, host and port)? */
+  sameOrigin(url) {
+    try {
+      return new URL(url).origin === this.origin;
+    } catch {
+      return false;
+    }
+  }
+  headers(url, extra = {}) {
+    return {
+      accept: "application/json",
+      "user-agent": this.ua,
+      ...this.token && this.sameOrigin(url) ? { authorization: `Bearer ${this.token}` } : {},
+      ...extra
+    };
+  }
+  async get(pathOrUrl, accept) {
+    const url = this.url(pathOrUrl);
+    this.reads.push(url);
+    const r = await this.f(url, { headers: this.headers(url, accept ? { accept } : {}) });
+    return wrap(r, url);
+  }
+  /** POST a Verb (`<$id>:<verb>`). Idempotency-Key: a retry with the same key never runs it twice. api.sb wants one on
+   *  every POST not in try Mode; the CLI sends one always (a fresh UUID unless the caller reuses one for a retry). */
+  async post(pathOrUrl, body, o = {}) {
+    const url = this.url(pathOrUrl);
+    if (!this.sameOrigin(url)) {
+      let origin = url;
+      try {
+        origin = new URL(url).origin;
+      } catch {
+      }
+      throw new Error(`refusing to POST to ${origin}: not ${this.origin}, the API this CLI points at (--api or SB_API). A Verb goes to that API only`);
+    }
+    const idempotencyKey = o.idempotencyKey || randomUUID();
+    const r = await this.f(url, {
+      method: "POST",
+      headers: this.headers(url, { "content-type": "application/json", "idempotency-key": idempotencyKey, ...o.prefer ? { prefer: o.prefer } : {} }),
+      body: JSON.stringify(body ?? {})
+    });
+    return { ...await wrap(r, url), idempotencyKey };
+  }
+};
+async function wrap(r, url) {
+  const text = await r.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    json = void 0;
+  }
+  const status = typeof json?.error?.status === "number" && r.status === 200 ? json.error.status : r.status;
+  const headers = {};
+  r.headers.forEach((v, k) => headers[k.toLowerCase()] = v);
+  return { status, ok: status >= 200 && status < 300, url, json, text, headers };
+}
+
+// src/next/config.ts
+import { homedir } from "os";
+import { join } from "path";
+var DEFAULT_API = "https://api.sb";
+var ISSUER = "https://id.org.ai";
+var DEFAULT_RUNNER = "https://claude-runner.workers.do";
+var LOOPBACK_PORTS = [8976, 8977, 8978];
+var SCOPE = "openid profile email offline_access";
+var API_VARS = ["SB_API", "STARTUP_BUILDER_API", "API_SB_URL"];
+function batchApi(flag, env = process.env) {
+  const batch = env.SB_BATCH;
+  if (!batch) return void 0;
+  if (flag !== void 0) throw new Error("--api is refused inside a batch (SB_BATCH is set): the loop sets the API");
+  const set = API_VARS.map((k) => [k, env[k]]).filter(([, v]) => v);
+  const own = originOf(batch);
+  if (!own) {
+    const origins = new Set(set.map(([, v]) => originOf(v) ?? v));
+    if (origins.size > 1) throw new Error(`refusing ${set.map(([k]) => k).join(", ")}: they name different APIs inside a batch (SB_BATCH is set)`);
+    return (set[0]?.[1] ?? DEFAULT_API).replace(/\/+$/, "");
+  }
+  for (const [k, v] of set) if (originOf(v) !== own) throw new Error(`refusing ${k}=${originOf(v) ?? v}: inside a batch (SB_BATCH is set) the API is the batch's own, ${own}`);
+  return own;
+}
+function apiBase(flag, env = process.env) {
+  const b = batchApi(flag, env);
+  if (b) return b;
+  return (flag || env.SB_API || env.STARTUP_BUILDER_API || env.API_SB_URL || DEFAULT_API).replace(/\/+$/, "");
+}
+function tokenFile(env = process.env) {
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "api.sb", "token.json");
+}
+function runnerBase(flag, env = process.env) {
+  return (flag || env.SB_RUNNER_URL || DEFAULT_RUNNER).replace(/\/+$/, "");
+}
+
+// src/next/auth.ts
+import { createServer } from "http";
+import { spawn } from "child_process";
+import { createHash, randomBytes } from "crypto";
+import { mkdir, readFile, writeFile, rm, chmod } from "fs/promises";
+import { dirname } from "path";
+import { platform } from "os";
+var b64url = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function pkce(verifier = b64url(randomBytes(32))) {
+  return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()) };
+}
+function unwrapState(s) {
+  if (!s) return s;
+  try {
+    const o = JSON.parse(Buffer.from(s, "base64url").toString("utf8"));
+    if (typeof o?.csrf === "string" && typeof o.s === "string") return o.s;
+  } catch {
+  }
+  return s;
+}
+function openDefaultBrowser(url) {
+  const os = platform();
+  if (os === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return false;
+  const [cmd, args] = os === "darwin" ? ["open", [url]] : os === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var Auth = class {
+  api;
+  file;
+  issuer;
+  f;
+  open;
+  log;
+  now;
+  ports;
+  timeoutMs;
+  fixedClient;
+  constructor(d) {
+    this.api = d.api;
+    this.file = d.file;
+    this.issuer = d.issuer ?? ISSUER;
+    this.f = d.fetch ?? fetch;
+    this.open = d.openBrowser ?? openDefaultBrowser;
+    this.log = d.log ?? ((l) => process.stderr.write(l + "\n"));
+    this.now = d.now ?? Date.now;
+    this.ports = d.ports ?? LOOPBACK_PORTS;
+    this.timeoutMs = d.timeoutMs ?? 3e5;
+    this.fixedClient = d.clientId ?? process.env.API_SB_CLIENT_ID;
+  }
+  async stored() {
+    try {
+      return JSON.parse(await readFile(this.file, "utf8"));
+    } catch {
+      return void 0;
+    }
+  }
+  /** `api`: the API this sign-in is for (a refresh keeps the one it was issued for, never the current --api) */
+  async save(client, j, api = this.api) {
+    const s = {
+      issuer: this.issuer,
+      client_id: client,
+      access_token: j.access_token,
+      refresh_token: j.refresh_token,
+      expires_at: j.expires_in ? this.now() + j.expires_in * 1e3 : void 0,
+      api
+    };
+    await mkdir(dirname(this.file), { recursive: true, mode: 448 });
+    await writeFile(this.file, JSON.stringify(s, null, 2), { mode: 384 });
+    await chmod(this.file, 384);
+    return s;
+  }
+  /** api.sb's public CLI client, named at /.well-known/agents.json (auth.cli_client_id) */
+  async clientId() {
+    if (this.fixedClient) return this.fixedClient;
+    const r = await this.f(`${this.api}/.well-known/agents.json`, { headers: { accept: "application/json" } });
+    const id = (await r.json().catch(() => ({}))).auth?.cli_client_id;
+    if (!id) throw new Error(`${this.api}/.well-known/agents.json names no auth.cli_client_id; set API_SB_CLIENT_ID`);
+    return id;
+  }
+  async token(params) {
+    const r = await this.f(`${this.issuer}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams(params)
+    });
+    const j = await r.json().catch(() => ({}));
+    return { ok: r.ok, j };
+  }
+  /** loopback + PKCE: a one-shot listener on 127.0.0.1, the browser opened at id.org.ai, the code caught.
+   *  Undefined when no browser can open here (the caller falls back to the device flow). */
+  async loopback(client) {
+    const { verifier, challenge } = pkce();
+    const state = b64url(randomBytes(16));
+    for (const port of this.ports) {
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      const got = await new Promise((resolve2) => {
+        let timer;
+        const server = createServer((req, res) => {
+          const u = new URL(req.url ?? "/", redirectUri);
+          if (u.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+          }
+          const ok = unwrapState(u.searchParams.get("state")) === state && u.searchParams.get("code");
+          res.writeHead(200, { "content-type": "text/html; charset=utf-8", connection: "close" }).end(
+            ok ? '<!doctype html><title>startup-builder</title><body style="font:16px system-ui;margin:3em">Signed in to api.sb. You can close this tab.</body>' : '<!doctype html><title>startup-builder</title><body style="font:16px system-ui;margin:3em">Sign-in failed. Return to the terminal.</body>'
+          );
+          if (timer) clearTimeout(timer);
+          server.close();
+          server.closeAllConnections?.();
+          resolve2(ok ? { code: u.searchParams.get("code") } : { error: u.searchParams.get("error") ?? "state mismatch" });
+        });
+        server.once("error", () => resolve2("busy"));
+        server.listen(port, "127.0.0.1", () => {
+          const url = new URL(`${this.issuer}/oauth/authorize`);
+          const q = { response_type: "code", client_id: client, redirect_uri: redirectUri, scope: SCOPE, state, code_challenge: challenge, code_challenge_method: "S256" };
+          for (const [k, v] of Object.entries(q)) url.searchParams.set(k, v);
+          if (!this.open(url.toString())) {
+            server.close();
+            resolve2({ error: "no-browser" });
+            return;
+          }
+          this.log("Opened your browser to sign in with id.org.ai. Waiting\u2026");
+          timer = setTimeout(() => {
+            server.close();
+            resolve2({ error: `timed out after ${Math.round(this.timeoutMs / 1e3)}s` });
+          }, this.timeoutMs);
+          timer.unref();
+        });
+      });
+      if (got === "busy") continue;
+      if (got.error === "no-browser") return void 0;
+      if (got.error) throw new Error(`sign-in failed: ${got.error}`);
+      const t2 = await this.token({ grant_type: "authorization_code", code: got.code, redirect_uri: redirectUri, code_verifier: verifier, client_id: client });
+      if (!t2.ok) throw new Error(`id.org.ai refused the code: ${t2.j.error ?? ""} ${t2.j.error_description ?? ""}`.trim());
+      return t2.j;
+    }
+    throw new Error(`ports ${this.ports.join(", ")} are all in use`);
+  }
+  /** the fallback where no browser can open here: the device-code flow */
+  async device(client) {
+    const r = await this.f(`${this.issuer}/oauth/device`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ client_id: client, scope: SCOPE })
+    });
+    const d = await r.json();
+    if (!d.device_code) throw new Error(`device authorization failed: ${d.error ?? r.status}`);
+    this.log(`On any device, open ${d.verification_uri_complete ?? d.verification_uri}${d.verification_uri_complete ? "" : ` and enter ${d.user_code}`}`);
+    let wait = (d.interval ?? 5) * 1e3;
+    const until = this.now() + (d.expires_in ?? 600) * 1e3;
+    while (this.now() < until) {
+      await new Promise((res) => setTimeout(res, wait));
+      const t2 = await this.token({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: d.device_code, client_id: client });
+      if (t2.ok) return t2.j;
+      if (t2.j.error === "slow_down") wait += 5e3;
+      else if (t2.j.error !== "authorization_pending") throw new Error(`device sign-in failed: ${t2.j.error}`);
+    }
+    throw new Error("device sign-in expired");
+  }
+  /** The stored token when still valid, else a refreshed one; undefined when neither (never opens a browser).
+   *  What every API call uses: an absent or dead token means the call goes anonymous. */
+  async current() {
+    const s = await this.stored();
+    if (!s) return void 0;
+    if (!s.expires_at || s.expires_at > this.now() + 3e4) return s;
+    if (s.refresh_token) {
+      const t2 = await this.token({ grant_type: "refresh_token", refresh_token: s.refresh_token, client_id: s.client_id });
+      if (t2.ok) return this.save(s.client_id, t2.j, s.api || DEFAULT_API);
+    }
+    return void 0;
+  }
+  /** Sign in: the stored or refreshed token, else the browser (loopback), else the device flow. */
+  async login(opts = {}) {
+    if (opts.force) await rm(this.file, { force: true });
+    const have = await this.current();
+    if (have) return { stored: have, fresh: false };
+    const client = await this.clientId();
+    const j = !opts.device && await this.loopback(client) || await this.device(client);
+    return { stored: await this.save(client, j), fresh: true };
+  }
+  async logout() {
+    const s = await this.stored();
+    if (s?.refresh_token) {
+      await this.f(`${this.issuer}/oauth/revoke`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: s.refresh_token, client_id: s.client_id })
+      }).catch(() => void 0);
+    }
+    await rm(this.file, { force: true });
+  }
+};
+
+// src/next/worklist.ts
+var WorklistError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+  }
+};
+function worklistPath(worker, startups, limit, md = false, page) {
+  const q = [...startups.length ? [`startup=${startups.map(encodeURIComponent).join(",")}`] : [], `limit=${limit}`, ...page && page > 1 ? [`page=${page}`] : [], ...md ? ["md"] : []];
+  return `/workers/${encodeURIComponent(worker)}/worklist?${q.join("&")}`;
+}
+var heldByNames = (h) => Array.isArray(h) ? h : h && typeof h === "object" ? Object.keys(h) : [];
+function apiError(r, what) {
+  const e = r.json?.error;
+  const msg = typeof e === "string" ? e : e?.message ?? (r.text && !r.json ? r.text.slice(0, 300) : `HTTP ${r.status}`);
+  const code = typeof e?.code === "string" ? ` (${e.code})` : "";
+  const workers = Array.isArray(r.json?.workers) ? r.json.workers.map((u) => u.replace(/\/worklist$/, "").split("/").pop()) : [];
+  return `${what} answered ${r.status}: ${msg}${code}${workers.length ? ` (Workers: ${workers.join(", ")})` : ""}`;
+}
+async function fetchWorklistMarkdown(api, o) {
+  const worker = parseWorker(o.worker);
+  if (!worker) throw new Error("name a Worker: worklist for:<worker>");
+  const path = worklistPath(worker, o.startups, o.limit ?? 5, true, o.page);
+  const r = await api.get(path, "text/markdown");
+  if (!r.ok) throw new WorklistError(apiError(r, `GET ${path}`), r.status, r.json ?? r.text);
+  return r.text;
+}
+function parseWorker(arg) {
+  if (!arg) return void 0;
+  const w = arg.replace(/^for:/i, "").trim().toLowerCase().replace(/\s+/g, "-");
+  return w || void 0;
+}
+var dayMs = 864e5;
+var daysBetween = (from, to) => Math.round((Date.parse(to.slice(0, 10)) - Date.parse(from.slice(0, 10))) / dayMs);
+function derivePriority(t2, today) {
+  if (typeof t2.priority === "number") return { priority: t2.priority, why: [`${t2.priority} from api.sb`] };
+  const why = [];
+  let p = 50;
+  const overdue = Number(t2.overdue ?? 0);
+  const dueIn = t2.due ? daysBetween(today, String(t2.due)) : void 0;
+  if (overdue > 0) {
+    p = 80 + Math.min(overdue, 10);
+    why.push(`overdue ${overdue}d: ${p}`);
+  } else if (dueIn !== void 0 && dueIn <= 2) {
+    p = 70 + (2 - Math.max(dueIn, 0)) * 3;
+    why.push(`due in ${Math.max(dueIn, 0)}d: ${p}`);
+  } else if ((t2.$type ?? t2.type) === "Issue") {
+    p = 60;
+    why.push("an open Issue: 60");
+  } else {
+    why.push("Normal: 50");
+  }
+  const weeks = Math.min(Math.floor(Number(t2.age ?? 0) / 7), 9);
+  if (weeks > 0) {
+    p += weeks;
+    why.push(`+${weeks} for ${t2.age}d waiting`);
+  }
+  return { priority: Math.min(p, overdue > 0 ? 99 : 89), why };
+}
+function belowStartup(url, domain) {
+  if (!url) return void 0;
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  const segs = path.split("/").filter(Boolean);
+  const at = segs.lastIndexOf(domain.split("/").pop());
+  return at >= 0 ? segs.slice(at + 1).join("/") : segs.join("/");
+}
+function stepOf(t2, domain) {
+  if (typeof t2.step === "string" && t2.step) return t2.step;
+  const obj = belowStartup(t2.object, domain);
+  if (obj) return obj;
+  return t2.verb ? `${t2.verb}` : "other";
+}
+var PAST = { send: "sent", win: "won", lose: "lost", buy: "bought", sell: "sold", pay: "paid", hold: "held", rerun: "reran" };
+var DOUBLE = /* @__PURE__ */ new Set(["stop", "plan", "win", "ship", "drop"]);
+function eventForm(verb) {
+  const w = verb;
+  if (PAST[w]) return PAST[w];
+  if (/e$/.test(w)) return `${w}d`;
+  if (/[^aeiou]y$/.test(w)) return `${w.slice(0, -1)}ied`;
+  return `${DOUBLE.has(w) ? w + w.at(-1) : w}ed`;
+}
+function byPriority(a, b) {
+  return b.priority - a.priority || (b.overdue ?? 0) - (a.overdue ?? 0) || (b.age ?? 0) - (a.age ?? 0) || a.name.localeCompare(b.name);
+}
+function selectBatch(tasks, limit) {
+  const top = [...tasks].sort(byPriority).slice(0, Math.max(limit, 0));
+  const clusters = /* @__PURE__ */ new Map();
+  for (const t2 of top) {
+    const key = `${t2.worker}\0${t2.startup}\0${t2.step}`;
+    let c = clusters.get(key);
+    if (!c) clusters.set(key, c = { worker: t2.worker, startup: t2.startup, step: t2.step, tasks: [] });
+    c.tasks.push(t2);
+  }
+  const order = (k) => {
+    const seen = [];
+    for (const c of clusters.values()) if (!seen.includes(k(c))) seen.push(k(c));
+    return (c) => seen.indexOf(k(c));
+  };
+  const w = order((c) => c.worker);
+  const s = order((c) => `${c.worker}/${c.startup}`);
+  return [...clusters.values()].sort((a, b) => w(a) - w(b) || s(a) - s(b));
+}
+function groupBatch(batch) {
+  const groups = [];
+  for (const c of batch) {
+    let g = groups.find((x) => x.startup === c.startup);
+    if (!g) groups.push(g = { startup: c.startup, steps: [] });
+    let s = g.steps.find((x) => x.step === c.step);
+    if (!s) g.steps.push(s = { step: c.step, ...c.stepTitle ? { stepTitle: c.stepTitle } : {}, tasks: [] });
+    s.tasks.push(...c.tasks);
+  }
+  for (const g of groups) for (const s of g.steps) s.tasks.sort(byPriority);
+  return groups;
+}
+var today0 = () => (/* @__PURE__ */ new Date()).toLocaleDateString("en-CA");
+var keysOf = (o) => o && typeof o === "object" && !Array.isArray(o) ? Object.keys(o) : [];
+async function openTasks(api, domain, worker) {
+  const out = [];
+  let next = `/${domain}/actions?assignee=${encodeURIComponent(worker)}&status=Pending&limit=50`;
+  for (let page = 0; next && page < 10; page++) {
+    const r = await api.get(next);
+    if (!r.ok) break;
+    for (const a of r.json?.actions ?? r.json?.tasks ?? []) out.push(a);
+    next = r.json?.links?.next ?? void 0;
+  }
+  return out;
+}
+async function roleDesk(api, url, name) {
+  const [desk, perms] = await Promise.all([api.get(url), api.get(`${url}/permissions?limit=50`)]);
+  const d = desk.json ?? {};
+  return {
+    name: d.role?.name ?? name,
+    $id: d.role?.$id ?? url,
+    owns: d.role?.owns,
+    summary: Array.isArray(d.summary) ? d.summary.map(String) : [],
+    permissions: (perms.json?.permissions ?? []).map((p) => String(p.name)),
+    limits: Object.entries(d.limits ?? {}).map(([n, l]) => ({ name: n, limit: l?.limit, used: l?.used, text: l?.usedShareText ? `${l.usedText ?? l.used} of ${l.limitText ?? l.limit} used (${l.usedShareText})` : void 0 })),
+    tools: keysOf(d.tools)
+  };
+}
+function guessClosesOn(t2, tools) {
+  if (!t2.verb) return void 0;
+  const tool = tools.find((x) => x.endsWith(`.${t2.verb}`));
+  if (tool) {
+    const noun = tool.slice(0, tool.lastIndexOf("."));
+    return { event: `${noun}.${eventForm(t2.verb)}`, verb: tool, url: `${t2.$id}:${t2.verb}`, via: "derived" };
+  }
+  return { event: `${t2.type}.${eventForm(t2.verb)}`, verb: `${t2.type}.${t2.verb}`, url: `${t2.$id}:${t2.verb}`, target: t2.$id, via: "derived" };
+}
+async function preview(api, t2, roleNames, tools) {
+  if (!t2.verb) return void 0;
+  const url = `${t2.$id}:${t2.verb}`;
+  const r = await api.get(url);
+  const j = r.json ?? {};
+  if (r.ok && j.verb?.event) {
+    const heldBy = j.checks?.permission?.heldBy ?? {};
+    return {
+      event: String(j.verb.event),
+      verb: String(j.verb.name ?? `${t2.type}.${t2.verb}`),
+      url,
+      target: t2.$id,
+      via: "preview",
+      ...j.checks?.permission?.needs ? { permission: { needs: String(j.checks.permission.needs), heldBy, held: Object.keys(heldBy).some((h) => roleNames.includes(h)) } } : {},
+      ...typeof j.checks?.approval?.needed === "boolean" ? { approvalNeeded: j.checks.approval.needed } : {},
+      ...j.action?.status === "Refused" ? { refused: String(j.action.reason ?? "refused") } : {}
+    };
+  }
+  return guessClosesOn(t2, tools);
+}
+async function buildWorklist(api, o) {
+  const worker = parseWorker(o.worker);
+  if (!worker) throw new Error("name a Worker: worklist for:<worker>");
+  const limit = o.limit ?? 5;
+  const today = o.today ?? today0();
+  const gaps = [];
+  if (!o.stubOnly) {
+    const path = worklistPath(worker, o.startups, limit, false, o.page);
+    let live;
+    try {
+      live = await api.get(path);
+    } catch (e) {
+      gaps.push(`OFFLINE FALLBACK: api.sb unreachable (${e?.message ?? e}); the CLI's stub assembled this, api.sb did not serve it`);
+    }
+    if (live) {
+      if (live.ok && live.json?.worklist) {
+        const first = served(live);
+        return o.all ? followAll(api, first) : first;
+      }
+      if (live.status < 500) throw new WorklistError(apiError(live, `GET ${path}`), live.status, live.json ?? live.text);
+      gaps.push(`OFFLINE FALLBACK: ${apiError(live, `GET ${path}`)}; the CLI's stub assembled this, api.sb did not serve it`);
+    }
+  }
+  if (!o.startups.length) throw new Error("the offline stub needs --startup <domain>");
+  return stubWorklist(api, worker, o, limit, today, gaps).catch((e) => {
+    throw new Error(`api.sb is unreachable and the offline stub reads api.sb too: ${e?.message ?? e}`);
+  });
+}
+function served(r) {
+  const w = r.json.worklist;
+  const l = r.json.links ?? {};
+  const links = Object.fromEntries(["next", "prev", "first", "last", "self"].filter((k) => typeof l[k] === "string").map((k) => [k, l[k]]));
+  return { ...w, source: w.source ?? "api.sb", ...Object.keys(links).length && !w.links ? { links } : {} };
+}
+async function followAll(api, first) {
+  const pages = [first];
+  const seen = /* @__PURE__ */ new Set();
+  let next = first.next ?? first.links?.next;
+  while (next && !seen.has(next) && pages.length < 100) {
+    seen.add(next);
+    const r = await api.get(next);
+    if (!r.ok || !r.json?.worklist) throw new WorklistError(apiError(r, `GET ${next}`), r.status, r.json ?? r.text);
+    const w = served(r);
+    pages.push(w);
+    next = w.next ?? w.links?.next;
+  }
+  if (pages.length === 1) return first;
+  const last2 = pages[pages.length - 1];
+  const tasks = pages.flatMap((p) => p.tasks);
+  return {
+    ...first,
+    batch: pages.flatMap((p) => p.batch),
+    tasks,
+    page: first.page ?? 1,
+    pages: last2.pages ?? pages.length,
+    more: last2.more ?? 0,
+    // the CLI's words, not api.sb's: the served moreText describes one page
+    moreText: `${tasks.length} of ${first.open} open Tasks, ${pages.length} pages (--all followed next)${last2.more ? `; ${last2.more} more` : ""}`,
+    next: last2.next,
+    links: { ...first.links ?? {}, next: last2.links?.next },
+    sources: [...new Set(pages.flatMap((p) => p.sources ?? []))]
+  };
+}
+async function stubWorklist(api, worker, o, limit, today, gaps) {
+  const desks = [];
+  const all = [];
+  const rolesOf = /* @__PURE__ */ new Map();
+  const toolsOf = /* @__PURE__ */ new Map();
+  let who = { handle: worker, name: worker };
+  for (const domain of o.startups) {
+    const [w, raw, ctx] = await Promise.all([
+      api.get(`/${domain}/workers/${encodeURIComponent(worker)}`),
+      openTasks(api, domain, worker),
+      api.get(`/${domain}/context?md`, "text/markdown")
+    ]);
+    const wk = w.ok ? w.json?.worker : void 0;
+    if (!wk) gaps.push(`${domain}: no Worker "${worker}" (${w.status})`);
+    else who = { handle: wk.handle ?? worker, name: wk.name ?? worker, kind: wk.kind, model: wk.model };
+    const fills = wk?.fills ? Object.entries(wk.fills) : (wk?.roles ?? []).map((u) => [u.split("/").pop(), u]);
+    const roles = await Promise.all(fills.map(([n, u]) => roleDesk(api, u, n)));
+    rolesOf.set(domain, roles.map((r) => r.name));
+    toolsOf.set(domain, roles.flatMap((r) => r.tools));
+    const glossaryOk = ctx.ok && !ctx.text.trimStart().startsWith("{");
+    if (!glossaryOk) gaps.push(`${domain}: no Startup-scoped glossary at /${domain}/context (${ctx.status})`);
+    desks.push({
+      domain,
+      $id: api.url(`/${domain}`),
+      ...wk ? { worker: { name: wk.name, kind: wk.kind, model: wk.model, $id: wk.$id, skills: keysOf(wk.equippedWith) } } : {},
+      roles,
+      open: raw.length,
+      ...glossaryOk ? { glossary: ctx.text.trim() } : {},
+      glossaryUrl: api.url(`/${domain}/context`)
+    });
+    for (const a of raw) {
+      const { priority, why } = derivePriority(a, today);
+      all.push({
+        $id: a.$id,
+        type: a.$type ?? a.type ?? "Task",
+        name: a.name,
+        status: a.status,
+        ...a.reason ? { reason: a.reason } : {},
+        startup: domain,
+        worker,
+        ...pick(a, ["role", "verb", "object", "about", "conversation", "due", "overdue", "age", "since"]),
+        priority,
+        priorityWhy: why,
+        step: stepOf(a, domain)
+      });
+    }
+  }
+  const batch = selectBatch(all, limit);
+  const tasks = batch.flatMap((c) => c.tasks);
+  if (o.previews !== false) {
+    await Promise.all(tasks.map(async (t2) => t2.closesOn = await preview(api, t2, rolesOf.get(t2.startup) ?? [], toolsOf.get(t2.startup) ?? [])));
+  }
+  if (all.some((t2) => !t2.priorityWhy[0]?.endsWith("from api.sb"))) gaps.push("priority: api.sb serves none on a Task; derived by the CLI (derivePriority)");
+  gaps.push("step: api.sb serves none on a Task; taken from the Thing it acts on, else its Verb");
+  const derived = tasks.filter((t2) => t2.closesOn?.via === "derived").length;
+  if (derived) gaps.push(`closesOn: ${derived} of ${tasks.length} Tasks have no Verb preview; the closing Event is guessed from the Verb`);
+  return {
+    source: "stub",
+    worker: who,
+    startups: desks,
+    open: all.length,
+    limit,
+    batch,
+    tasks,
+    gaps,
+    sources: [...new Set(api.reads)],
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function pick(o, keys) {
+  const out = {};
+  for (const k of keys) if (o[k] !== void 0 && o[k] !== null) out[k] = o[k];
+  return out;
+}
+
+// src/next/close.ts
+var THING_KEYS = ["task", "issue", "approval", "action"];
+function thingOf(page) {
+  if (!page) return void 0;
+  for (const k of THING_KEYS) if (page[k]?.$id) return page[k];
+  for (const [k, v] of Object.entries(page)) if (!["api", "links", "nav", "user"].includes(k) && v && typeof v === "object" && v.$id && v.$type) return v;
+  return void 0;
+}
+var lastSeg = (u) => u ? new URL(u, "https://x").pathname.split("/").filter(Boolean).pop() ?? "" : "";
+var closedText = (c) => typeof c === "string" ? c : c && typeof c === "object" ? Object.entries(c).filter(([, v]) => typeof v !== "object").map(([k, v]) => `${k} ${v}`).join(", ") : "";
+async function findClosesOn(api, taskRef) {
+  const g = await api.get(taskRef);
+  const thing = thingOf(g.json);
+  if (!g.ok || !thing) throw new Error(`GET ${g.url} answered ${g.status}: ${g.json?.error?.message ?? "no Task there"}`);
+  const domain = lastSeg(thing.$context ?? thing.for);
+  const worker = lastSeg(thing.assignee ?? thing.by);
+  if (thing.closedOn !== void 0) {
+    throw new Error(`${thing.$id} is closed (${[thing.status, closedText(thing.closedOn), thing.closedBy ? `by ${thing.closedBy}` : ""].filter(Boolean).join(", ")}): nothing to close`);
+  }
+  if (thing.closesOn) {
+    return {
+      task: { $id: thing.$id, name: thing.name, type: thing.$type ?? "Task", status: thing.status, startup: domain, worker, ...thing.priorityText ? { priorityText: thing.priorityText } : {}, ...thing.stepTitle ? { stepTitle: thing.stepTitle } : {}, closesOn: thing.closesOn },
+      thing
+    };
+  }
+  if (!domain || !worker) throw new Error(`${thing.$id} names no Startup ($context) or assignee: api.sb cannot say what closes it`);
+  const path = worklistPath(worker, [domain], 50);
+  const w = await api.get(path);
+  const wl = w.json?.worklist;
+  if (!w.ok || !wl) throw new Error(`GET ${path} answered ${w.status}: ${w.json?.error?.message ?? "no worklist"}`);
+  const task = wl.tasks.find((t2) => t2.$id === thing.$id);
+  if (!task) throw new Error(`${thing.$id} is not on for:${worker}'s worklist in ${domain} (it is ${thing.status}${thing.reason ? `, ${thing.reason}` : ""}): nothing to close`);
+  if (!task.closesOn) throw new Error(`api.sb serves no closesOn for ${thing.$id}: it does not say which Event closes it`);
+  return { task, thing, worklist: wl };
+}
+function withAs(url, as) {
+  if (!as) return url;
+  const u = new URL(url);
+  u.searchParams.set("as", as);
+  return u.toString();
+}
+function outcomeOf(r) {
+  if (r.headers["idempotent-replayed"] === "true") return "Replayed";
+  if (r.status === 201) return "Done";
+  if (r.status === 202) return "Pending";
+  if (r.status === 403) return "Refused";
+  if (r.status === 422) return "KeyReused";
+  if (r.status === 400 || r.status === 401 || r.status === 409) return "Blocked";
+  if (r.status === 200) return r.json?.action?.status === "Pending" ? "Pending" : r.json?.action?.status === "Refused" ? "Refused" : "Done";
+  return r.ok ? "Done" : "Error";
+}
+async function closeTask(api, o) {
+  const mode = o.mode ?? "try";
+  const { task } = await findClosesOn(api, o.task);
+  const c = task.closesOn;
+  const as = o.as ?? task.worker;
+  const url = withAs(api.url(c.url), as);
+  const base = {
+    task: { $id: task.$id, name: task.name, type: task.type, ...task.status ? { status: task.status } : {}, startup: task.startup, worker: task.worker, ...task.priorityText ? { priorityText: task.priorityText } : {}, ...task.stepTitle ? { stepTitle: task.stepTitle } : {} },
+    closesOn: c,
+    mode,
+    as
+  };
+  const stop = mode !== "try" && !o.force ? c.blocked ?? c.refused : void 0;
+  if (stop) {
+    return { ...base, request: { method: "POST", url, prefer: `mode=${mode}`, idempotencyKey: o.idempotencyKey ?? "" }, status: 0, outcome: "NotSent", replayed: false, tried: false, note: `${stop} (--force to send anyway; api.sb will refuse it)`, body: void 0 };
+  }
+  const prep = o.prepare?.(c);
+  if (prep?.error) {
+    return { ...base, request: { method: "POST", url, prefer: `mode=${mode}`, idempotencyKey: o.idempotencyKey ?? "" }, status: 0, outcome: "NotSent", replayed: false, tried: false, note: prep.error, body: void 0 };
+  }
+  const r = await api.post(url, prep?.input ?? o.input ?? {}, { idempotencyKey: o.idempotencyKey, prefer: `mode=${mode}` });
+  const j = r.json ?? {};
+  const outcome = outcomeOf(r);
+  const e = j.error && typeof j.error === "object" ? j.error : void 0;
+  return {
+    ...base,
+    request: { method: "POST", url, prefer: `mode=${mode}`, idempotencyKey: r.idempotencyKey },
+    status: r.status,
+    outcome,
+    ...j.action && typeof j.action === "object" ? { action: j.action } : {},
+    replayed: outcome === "Replayed",
+    tried: j.action?.stored === false,
+    ...typeof j.sink === "string" ? { sink: j.sink } : {},
+    ...e && (e.code || e.message) ? { blocked: { ...e.code ? { code: String(e.code) } : {}, ...e.message ? { message: String(e.message) } : {} } } : {},
+    body: r.json ?? r.text.slice(0, 2e3)
+  };
+}
+var closesOf = (a) => (Array.isArray(a?.closes) ? a.closes : []).map((x) => typeof x === "string" ? x : String(x?.$id ?? JSON.stringify(x)));
+
+// src/next/render.ts
+import pc from "picocolors";
+var dim = pc.dim;
+function taskBlock(t2, n) {
+  const c = t2.closesOn;
+  const due = t2.overdue ? ` \xB7 ${t2.overdue}d overdue` : t2.due ? ` \xB7 due ${t2.due}` : "";
+  const lines = [`    ${n}. ${pc.bold(`[${t2.priorityText ?? t2.priority}]`)} ${t2.name} ${dim(`\xB7 ${t2.type}${due}`)}`, `       ${dim(t2.$id)}`];
+  if (c) {
+    const p = c.permission;
+    const perm = p ? ` \xB7 needs "${p.needs}"${p.held ? p.why ? dim(` (${p.why})`) : "" : pc.yellow(` (held by ${heldByNames(p.heldBy).join(", ") || "no Role"}, not ${t2.worker})`)}` : "";
+    lines.push(`       closes on ${pc.cyan(c.event)}${c.via === "derived" ? "?" : ""} via ${c.verb}${perm}${c.approvalNeeded ? pc.yellow(" \xB7 needs an Approval") : ""}`);
+    if (c.blocked) lines.push(`       ${pc.yellow("blocked")}: ${c.blocked}`);
+    if (c.refused) lines.push(`       ${pc.red("refused")}: ${c.refused}`);
+    if (c.says) lines.push(`       ${dim(`says: ${c.says}`)}`);
+  }
+  return lines;
+}
+function batchText(w, o = {}) {
+  const bin = o.bin ?? "npx startup-builder";
+  const who = `${w.worker.name}${w.worker.kind ? ` (${w.worker.kind}${w.worker.model ? `, ${w.worker.model}` : ""})` : ""}`;
+  const src = w.source === "stub" ? pc.yellow("OFFLINE FALLBACK: the CLI's stub assembled this; api.sb did not serve it") : pc.green("api.sb");
+  const paged = w.pages && w.pages > 1 && !w.moreText?.includes("--all") ? ` \xB7 page ${w.page ?? 1} of ${w.pages}` : "";
+  const lines = [`${pc.bold(`worklist for:${w.worker.handle}`)} \xB7 ${who} \xB7 ${w.tasks.length} of ${w.open} open${paged}${w.asOf ? ` \xB7 as of ${w.asOf.slice(0, 10)}` : ""} \xB7 ${src}`];
+  if (w.clock) lines.push(dim(`  ${w.clock}`));
+  let n = 0;
+  for (const g of groupBatch(w.batch)) {
+    lines.push("", pc.bold(g.startup));
+    for (const s of g.steps) {
+      lines.push(`  ${pc.cyan(s.stepTitle ?? s.step)}${s.stepTitle ? dim(` (${s.step})`) : ""}`);
+      for (const t2 of s.tasks) lines.push(...taskBlock(t2, ++n));
+    }
+  }
+  if (!w.tasks.length) lines.push("", "  Nothing open.");
+  if (w.planned?.length) {
+    lines.push("", `planned (no Task yet: propose, do not start):`);
+    for (const p of w.planned) lines.push(`  - ${p.title ?? p.name ?? p.step ?? JSON.stringify(p)}`);
+  }
+  if (w.moreText) {
+    const again = `${bin} worklist for:${w.worker.handle}${w.startups.length ? ` --startup ${w.startups.map((d) => d.domain).join(",")}` : ""}${w.limit !== 5 ? ` --limit ${w.limit}` : ""}`;
+    const left = w.more && w.more > 0 ? ` (next: ${again} --page ${(w.page ?? 1) + 1}, or --all)` : "";
+    lines.push("", `${w.moreText}${dim(left)}`);
+  }
+  if (w.limitAsked) lines.push(pc.yellow(`limit ${w.limitAsked} asked; api.sb serves at most ${w.limitMax ?? w.limit} a page`));
+  if (w.tasks.length) lines.push("", dim(`close one: ${bin} close <task $id>  (a try-Mode preview; --do or --send to run it)`));
+  if (w.gaps.length) {
+    lines.push(dim(w.source === "stub" ? "gaps (the stub made these up or could not find them):" : "gaps (api.sb says):"));
+    for (const gap of w.gaps) lines.push(dim(`  - ${gap}`));
+  }
+  return lines.join("\n");
+}
+function closeText(r) {
+  const c = r.closesOn;
+  const t2 = r.task;
+  const a = r.action;
+  const lines = [
+    `${pc.bold(t2.name)} ${dim(`\xB7 ${t2.type}${t2.priorityText ? ` \xB7 ${t2.priorityText}` : ""} \xB7 ${t2.startup}${t2.stepTitle ? ` \u203A ${t2.stepTitle}` : ""}`)}`,
+    `  closes on ${pc.cyan(c.event)} via ${c.verb}${c.target && c.target !== t2.$id ? ` on ${c.target}` : ""}`
+  ];
+  if (c.blocked) lines.push(`  ${pc.yellow("blocked")}: ${c.blocked}`);
+  if (c.refused) lines.push(`  ${pc.red("refused")}: ${c.refused}`);
+  lines.push(dim(`  POST ${r.request.url} \xB7 Prefer: ${r.request.prefer}${r.request.idempotencyKey ? ` \xB7 Idempotency-Key ${r.request.idempotencyKey}` : ""}`));
+  if (r.outcome === "NotSent") {
+    lines.push(`  ${pc.yellow("not sent")}: ${r.note}`);
+    return lines.join("\n");
+  }
+  const tag = r.outcome === "Refused" ? pc.red("Refused") : r.outcome === "Blocked" || r.outcome === "KeyReused" || r.outcome === "Error" ? pc.red(r.outcome) : r.outcome === "Pending" ? pc.yellow("Pending") : pc.green(r.outcome);
+  const status = a?.status && a.status !== r.outcome ? ` (${a.status})` : "";
+  lines.push(`  \u2192 ${r.status} ${r.tried ? "try: " : ""}${tag}${status}${a?.event ? ` \xB7 ${a.event}` : ""}`);
+  if (a?.reason || a?.says) lines.push(`  ${a.reason ? `${a.reason}: ` : ""}${a.says ?? ""}`);
+  if (r.blocked) lines.push(`  ${r.blocked.code ? `${r.blocked.code}: ` : ""}${r.blocked.message ?? ""}`);
+  if (r.outcome === "KeyReused" && r.body?.action) lines.push(dim(`  the key's Action: ${r.body.action}`));
+  const closes = closesOf(a);
+  if (closes.length) lines.push(`  ${r.tried ? "would close" : "closes"}: ${closes.join(", ")}`);
+  if (a?.$id) lines.push(`  Action: ${a.$id}`);
+  if (Array.isArray(a?.events) && a.events.length) lines.push(dim(`  events: ${a.events.map((e) => e?.name ?? e).join(" \u2192 ")}`));
+  if (r.sink) lines.push(dim(`  sink: ${r.sink}`));
+  if (r.tried) lines.push(dim("  (a preview: nothing stored. --do or --send to run it)"));
+  return lines.join("\n");
+}
+
+// src/next/prompt.ts
+var dueText = (t2) => t2.overdue ? `${t2.overdue}d overdue (due ${t2.due})` : t2.due ? `due ${t2.due}` : t2.since ? `since ${t2.since}` : "";
+function closeCommand(t2, bin = "npx startup-builder") {
+  return `${bin} close ${t2.$id}`;
+}
+function doCommand(t2, bin = "npx startup-builder") {
+  const verb = t2.closesOn?.verb ?? `${t2.type}.${t2.verb ?? "work"}`;
+  const noun = verb.slice(0, verb.lastIndexOf("."));
+  const target = t2.closesOn ? t2.closesOn.target ?? `<the ${noun}'s $id>` : t2.$id;
+  return `${bin} do ${verb} ${target} --startup ${t2.startup}`;
+}
+function taskLines(t2, n, bin) {
+  const c = t2.closesOn;
+  const lines = [
+    `${n}. **${t2.name}** \xB7 ${t2.type} \xB7 priority ${t2.priorityText ?? t2.priority} (${t2.priorityWhy.join("; ")})${dueText(t2) ? ` \xB7 ${dueText(t2)}` : ""}`,
+    `   - $id: ${t2.$id}`
+  ];
+  if (t2.object) lines.push(`   - acts on: ${t2.object}`);
+  if (t2.about) lines.push(`   - about: ${t2.about}`);
+  if (t2.conversation) lines.push(`   - conversation: ${t2.conversation}`);
+  if (c && c.via === "api.sb") {
+    lines.push(`   - closes on: **${c.event}**${c.target ? ` on ${c.target}` : ""}${c.says ? ` (${c.says})` : ""}`);
+    lines.push(`   - close it: \`${closeCommand(t2, bin)}\` previews it (try Mode, nothing stored); add \`--do\` to run it. It POSTs ${c.verb} at ${c.url}`);
+    if (c.blocked) lines.push(`   - not yet: ${c.blocked}`);
+  } else if (c) {
+    lines.push(`   - closes on: **${c.event}**${c.via === "derived" ? " (guessed from the Verb: api.sb has no preview for it yet)" : ""}`);
+    lines.push(`   - the Verb: \`${doCommand(t2, bin)}\` (preview first with \`--preview\`${c.via === "preview" ? `; GET ${c.url} shows it` : ""})`);
+  }
+  if (c) {
+    if (c.permission) lines.push(`   - needs the Permission "${c.permission.needs}": ${c.permission.held ? c.permission.why ? `you hold it (${c.permission.why})` : "your Role holds it" : `held by ${heldByNames(c.permission.heldBy).join(", ") || "no Role"}, not you: ask, do not act`}`);
+    if (c.approvalNeeded) lines.push("   - needs an Approval before it runs: request it and stop");
+    if (c.refused) lines.push(`   - api.sb would refuse it now: ${c.refused}`);
+  }
+  return lines;
+}
+function renderPrompt(w, o = {}) {
+  const bin = o.bin ?? "npx startup-builder";
+  const domains = w.startups.map((s) => s.domain);
+  const roles = [...new Set(w.startups.flatMap((s) => s.roles.map((r) => r.name)))];
+  const out = [];
+  out.push(`# Worklist: ${w.worker.name}${roles.length ? ` (${roles.join(", ")})` : ""} \xB7 ${domains.join(", ")} \xB7 ${w.tasks.length} of ${w.open} open Tasks`);
+  out.push("");
+  out.push(
+    `You are ${w.worker.name}${w.worker.kind ? `, ${w.worker.kind === "Agent" ? "an agent" : "a"} Worker` : ""} in ${domains.join(" and ")}${roles.length ? `, filling the ${roles.join(" and ")} Role` : ""}. Work the Tasks below in order. Each one is already decided and assigned to you: do not re-plan them, and do not pick up other work.`
+  );
+  out.push("");
+  out.push("## Rules");
+  out.push('- **A Task closes when the Event that satisfies it happens** (its "closes on" line). Never mark a Task done by hand and never call `complete` on it. Do the work, then invoke the Verb that emits that Event.');
+  out.push(
+    w.source === "api.sb" ? `- Close a Task with \`${bin} close <task $id>\`: it invokes the Verb api.sb names for it, as a preview (try Mode, nothing stored) until you add \`--do\`. Every call carries an Idempotency-Key, so repeating a call never runs it twice.` : `- Invoke a Verb with \`${bin} do <Noun.verb> <$id> --startup <domain>\`. Add \`--preview\` first to see what it would do and whether it is allowed. Every call carries an Idempotency-Key, so repeating a call never runs it twice.`
+  );
+  out.push("- Stay inside your Permissions and Limits (below). Where a Verb needs a Permission you do not hold or an Approval, stop that Task and say so; do not work around it.");
+  out.push("- Use the Startup's own words (its glossary is below) in everything you write.");
+  out.push('- Read any `$id` with `curl -H "accept: application/json" <$id>` (or `?md` for Markdown) when you need more about a Thing.');
+  out.push("- End with a report, one line per Task: what you did, the Verb you invoked, and the Action URL it returned (or why you stopped).");
+  for (const r of w.rules ?? []) out.push(`- ${r}`);
+  if (w.clock) out.push(`- ${w.clock}`);
+  out.push("");
+  out.push("## The batch");
+  let n = 0;
+  for (const c of w.batch) {
+    out.push("");
+    out.push(`### ${c.startup} \u203A ${c.stepTitle ?? c.step}`);
+    for (const t2 of c.tasks) out.push(...taskLines(t2, ++n, bin));
+  }
+  if (w.more) out.push("", `(${w.more} more open Tasks wait after this batch: they are for a later worklist, not this run.)`);
+  if (w.planned?.length) {
+    out.push("", "## Planned (no Task yet: propose Tasks for these, do not start them unasked)");
+    for (const p of w.planned) out.push(`- ${p.title ?? p.name ?? p.step ?? JSON.stringify(p)}${p.step && (p.title ?? p.name) ? ` (${p.step})` : ""}`);
+  }
+  for (const s of w.startups) {
+    for (const r of s.roles) {
+      out.push("");
+      out.push(`## Your desk: ${r.name} in ${s.domain}`);
+      if (r.owns) out.push(`Owns: ${r.owns}.`);
+      if (r.summary.length) out.push(...r.summary.map((l) => `- ${l}`));
+      if (r.permissions.length) {
+        out.push("", "Permissions:");
+        out.push(...r.permissions.map((p) => `- ${p}`));
+      }
+      if (r.limits.length) {
+        out.push("", "Limits:");
+        out.push(...r.limits.map((l) => `- ${l.name}${l.text ? `: ${l.text}` : ""}`));
+      }
+      if (r.tools.length) out.push("", `Tools: ${r.tools.join(", ")}`);
+    }
+    if (s.worker?.skills.length) out.push("", `Skills: ${s.worker.skills.join(", ")}`);
+  }
+  for (const s of w.startups) {
+    if (!s.glossary) continue;
+    out.push("");
+    out.push(`## Glossary: ${s.domain} (from ${s.glossaryUrl})`);
+    out.push("");
+    out.push(s.glossary.replace(/^(#{1,4}) /gm, (_, h) => `${"#".repeat(Math.min(h.length + 2, 6))} `));
+  }
+  return out.join("\n") + "\n";
+}
+
+// src/next/run.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function forStartup(w, domain) {
+  const batch = w.batch.filter((c) => c.startup === domain);
+  return {
+    ...w,
+    startups: w.startups.filter((s) => s.domain === domain),
+    batch,
+    tasks: batch.flatMap((c) => c.tasks),
+    open: w.startups.find((s) => s.domain === domain)?.open ?? w.open
+  };
+}
+async function runCloud(api, w, o) {
+  const f = o.fetch ?? fetch;
+  const out = [];
+  for (const s of w.startups) {
+    const sub = forStartup(w, s.domain);
+    const first = sub.tasks[0];
+    if (!first) continue;
+    const prompt = renderPrompt(sub, { bin: o.bin });
+    const priority = Math.max(...sub.tasks.map((t2) => t2.priority));
+    const id = randomUUID2();
+    const role = s.roles[0]?.name ?? first.role;
+    const viaApi = { url: api.url(`${first.$id}:work`), body: { prompt, priority, ...o.model ? { model: o.model } : {} } };
+    const viaRunner = {
+      url: `${o.runner}/sessions`,
+      body: { id, prompt, startup: s.domain, worker: w.worker.handle, role, priority, task: first.$id, verb: "work", ...o.model ? { model: o.model } : {} }
+    };
+    if (o.dryRun) {
+      out.push({ startup: s.domain, via: "none", request: viaApi, note: `dry run; fallback would be POST ${viaRunner.url}` });
+      continue;
+    }
+    const a = await api.post(viaApi.url, viaApi.body, { idempotencyKey: id });
+    if (a.ok) {
+      out.push({ startup: s.domain, via: "api.sb", status: a.status, url: a.json?.action?.$id ?? a.json?.links?.self, session: id, request: viaApi });
+      continue;
+    }
+    if (!o.runnerToken) {
+      out.push({
+        startup: s.domain,
+        via: "none",
+        status: a.status,
+        request: viaRunner,
+        note: `api.sb answered ${a.status} to POST ${viaApi.url} (not served yet); set SB_RUNNER_TOKEN to go to claude-runner directly`
+      });
+      continue;
+    }
+    const r = await f(viaRunner.url, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json", authorization: `Bearer ${o.runnerToken}` },
+      body: JSON.stringify(viaRunner.body)
+    });
+    const j = await r.json().catch(() => ({}));
+    out.push({ startup: s.domain, via: "claude-runner", status: r.status, url: r.headers.get("location") ?? j.session?.$id ?? j.links?.self, session: id, request: viaRunner });
+  }
+  return out;
+}
+
+// src/next/verb.ts
+var COLLECTION = {
+  Task: "actions",
+  Issue: "actions",
+  Action: "actions",
+  Person: "people",
+  Startup: ""
+};
+function collectionOf(noun) {
+  if (noun in COLLECTION) return COLLECTION[noun];
+  const kebab = noun.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (/[^aeiou]y$/.test(kebab)) return `${kebab.slice(0, -1)}ies`;
+  if (/(s|x|z|ch|sh)$/.test(kebab)) return `${kebab}es`;
+  return `${kebab}s`;
+}
+function parseVerb(spec) {
+  const m = /^([A-Z][A-Za-z0-9]*)\.([a-z][A-Za-z0-9]*)$/.exec(spec);
+  if (!m) throw new Error(`name a Verb as Noun.verb (e.g. Offer.publish), not "${spec}"`);
+  return { noun: m[1], verb: m[2] };
+}
+function verbPath(spec, target, startup) {
+  const { noun, verb } = parseVerb(spec);
+  if (target && /^https?:\/\//.test(target)) return `${target}:${verb}`;
+  if (target && target.startsWith("/")) return `${target}:${verb}`;
+  if (!startup) throw new Error("name the Startup: --startup <domain> (or pass the target as a full $id)");
+  const coll = collectionOf(noun);
+  const base = `/${startup}${coll ? `/${coll}` : ""}`;
+  return `${target ? `${base}/${encodeURIComponent(target)}` : base}:${verb}`;
+}
+function parseInput(pairs = [], json) {
+  const out = json ? JSON.parse(json) : {};
+  for (const p of pairs) {
+    const i = p.indexOf("=");
+    if (i < 1) throw new Error(`--input takes key=value, not "${p}"`);
+    const k = p.slice(0, i);
+    const v = p.slice(i + 1);
+    out[k] = v === "true" ? true : v === "false" ? false : v !== "" && !Number.isNaN(Number(v)) ? Number(v) : v;
+  }
+  return out;
+}
+function readPreview(url, status, j) {
+  j ??= {};
+  return {
+    url,
+    status,
+    ...j.verb?.name ? { name: String(j.verb.name) } : {},
+    ...j.verb?.does ? { does: String(j.verb.does) } : {},
+    ...j.verb?.event ? { event: String(j.verb.event) } : {},
+    ...j.verb?.mode ? { mode: String(j.verb.mode) } : {},
+    ...j.checks?.state ? { state: String(j.checks.state) } : {},
+    ...j.action?.status === "Refused" ? { refused: String(j.action.reason ?? "refused") } : {},
+    ...j.checks?.permission?.needs ? { permission: { needs: String(j.checks.permission.needs), heldBy: Object.keys(j.checks.permission.heldBy ?? {}) } } : {},
+    ...typeof j.checks?.approval?.needed === "boolean" ? { approvalNeeded: j.checks.approval.needed } : {},
+    inputs: Object.keys(j.input ?? {}),
+    ...j.error ? { error: String(j.error.message ?? j.error) } : {}
+  };
+}
+function noteOf(p) {
+  const e = p.json?.error;
+  const msg = e?.message ? `${e.code ? `${e.code}: ` : ""}${e.message}` : void 0;
+  if (!p.ok && (p.status === 404 || p.status === 405)) return `api.sb does not take this Verb here (${p.status})${msg ? `: ${msg}` : ""}`;
+  return msg;
+}
+async function doVerb(api, o) {
+  const path = verbPath(o.spec, o.target, o.startup);
+  const postPath = o.as ? `${path}${path.includes("?") ? "&" : "?"}as=${encodeURIComponent(o.as)}` : path;
+  const g = await api.get(path);
+  const preview2 = readPreview(g.url, g.status, g.json);
+  if (o.previewOnly || !g.ok) return { preview: preview2, invoked: false };
+  if (preview2.refused && !o.force) return { preview: preview2, invoked: false };
+  const p = await api.post(postPath, { ...o.input ?? {} }, { idempotencyKey: o.idempotencyKey, ...o.mode ? { prefer: `mode=${o.mode}` } : {} });
+  const action = p.json?.action?.$id;
+  return {
+    preview: preview2,
+    invoked: p.ok,
+    post: {
+      status: p.status,
+      idempotencyKey: p.idempotencyKey,
+      body: p.json ?? p.text.slice(0, 500),
+      ...action ? { action } : {},
+      ...p.json?.action?.status ? { actionStatus: String(p.json.action.status) } : {},
+      ...p.json?.action?.says ? { says: String(p.json.action.says) } : {},
+      ...noteOf(p) ? { note: noteOf(p) } : {}
+    }
+  };
+}
+
+// src/next/body.ts
+import { realpathSync, statSync } from "fs";
+import { resolve, sep } from "path";
+var VERDICTS = ["confirmed", "corrected", "unsure"];
+var isUrl = (s) => typeof s === "string" && /^https?:\/\/\S+$/.test(s);
+function coordinatesReviewed(body) {
+  const reviews = Array.isArray(body) ? body : body?.reviews;
+  const errors = [];
+  if (!Array.isArray(reviews) || !reviews.length) return { errors: ["body: {reviews:[{field,verdict,value?,sources,note}]} with at least one review"] };
+  const seen = /* @__PURE__ */ new Set();
+  reviews.forEach((r, i) => {
+    const at = `reviews[${i}]`;
+    if (!r || typeof r !== "object") return errors.push(`${at}: an object`);
+    if (typeof r.field !== "string" || !r.field.trim()) errors.push(`${at}.field: a field name`);
+    else if (seen.has(r.field)) errors.push(`${at}.field: ${r.field} twice`);
+    else seen.add(r.field);
+    if (!VERDICTS.includes(r.verdict)) errors.push(`${at}.verdict: ${VERDICTS.join("|")}`);
+    if (r.verdict === "corrected" && (r.value === void 0 || r.value === null || r.value === "")) errors.push(`${at}.value: required when corrected`);
+    if (!Array.isArray(r.sources) || r.sources.some((s) => !isUrl(s))) errors.push(`${at}.sources: an array of URLs`);
+    else if (VERDICTS.includes(r.verdict) && r.verdict !== "unsure" && !r.sources.length) errors.push(`${at}.sources: at least one URL when ${r.verdict}`);
+    if (typeof r.note !== "string") errors.push(`${at}.note: a string`);
+    const extra = Object.keys(r).filter((k) => !["field", "verdict", "value", "sources", "note"].includes(k));
+    if (extra.length) errors.push(`${at}: unknown ${extra.join(", ")}`);
+    return void 0;
+  });
+  return errors.length ? { errors } : { body: Array.isArray(body) ? { reviews } : body, errors };
+}
+var SHAPES = {
+  "Coordinates.reviewed": coordinatesReviewed
+};
+function checkBody(event, body) {
+  const f = SHAPES[event];
+  if (!f) return { body: body ?? {}, errors: [] };
+  if (body === void 0) return { errors: [`${event} needs a body (--body <file|->)`] };
+  return f(body);
+}
+function parseBody(text) {
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw new Error(`--body is not JSON: ${e.message}`);
+  }
+}
+var inside = (p, root) => p === root || p.startsWith(root.endsWith(sep) ? root : root + sep);
+function batchBodyPath(p, workdir) {
+  const no = (why) => new Error(`--body ${p}: refused inside a batch (${why}); write the body to a file in the working directory, or use --body -`);
+  if (!p || p.split(/[\\/]+/).includes("..")) throw no("no '..'");
+  const root = resolve(workdir);
+  let realRoot;
+  try {
+    realRoot = realpathSync(root);
+  } catch {
+    throw no("the working directory is gone");
+  }
+  const abs = resolve(root, p);
+  if (!inside(abs, root) && !inside(abs, realRoot)) throw no("outside the working directory");
+  let real;
+  try {
+    real = realpathSync(abs);
+  } catch {
+    throw new Error(`--body ${p}: no such file in the working directory`);
+  }
+  if (!inside(real, realRoot)) throw no("a link out of the working directory");
+  if (!statSync(real).isFile()) throw no("not a regular file");
+  return real;
+}
+
+// src/next/agents.ts
+import { spawn as nodeSpawn } from "child_process";
+
+// src/next/models.ts
+var DEFAULT_MODEL = "claude-opus-5-5";
+
+// src/next/agents.ts
+var CLAUDE_TOOLS = [
+  "Bash(startup-builder close:*)",
+  "Bash(startup-builder show:*)",
+  "Bash(startup-builder prompt)",
+  "Bash(startup-builder versions:*)",
+  // the CLI's own help, read-only: `close --help` is already under `close:*`, these are the bare forms (#376)
+  "Bash(startup-builder --help)",
+  "Bash(startup-builder help:*)",
+  "Read",
+  "Write",
+  "Edit",
+  "Glob",
+  "Grep",
+  "WebFetch",
+  "WebSearch"
+];
+function printRunner(o = {}) {
+  const out = o.out ?? ((s) => process.stdout.write(s.endsWith("\n") ? s : `${s}
+`));
+  return async (r) => {
+    out(r.prompt);
+    while (!r.signal.aborted) {
+      if (await r.done()) return { exitCode: 0, note: "every Task closed" };
+      await new Promise((res) => {
+        const h = setTimeout(res, o.pollMs ?? 5e3);
+        r.signal.addEventListener("abort", () => (clearTimeout(h), res()), { once: true });
+      });
+    }
+    return { exitCode: null };
+  };
+}
+var CLAUDE_BUILTINS = ["Bash", "Read", "Write", "Edit", "Glob", "Grep", "WebFetch", "WebSearch"];
+function claudeArgs(model = DEFAULT_MODEL) {
+  return [
+    "-p",
+    "--model",
+    model,
+    "--restricted",
+    "--strict-mcp-config",
+    "--permission-mode",
+    "dontAsk",
+    "--tools",
+    ...CLAUDE_BUILTINS,
+    "--allowedTools",
+    ...CLAUDE_TOOLS,
+    "--output-format",
+    "stream-json",
+    "--verbose"
+  ];
+}
+function resultNote(streamJson) {
+  const lines = streamJson.trim().split("\n").reverse();
+  for (const l of lines) {
+    try {
+      const e = JSON.parse(l);
+      if (e.type !== "result") continue;
+      const bits = [e.subtype, e.num_turns !== void 0 ? `${e.num_turns} turns` : "", e.duration_ms ? `${Math.round(e.duration_ms / 1e3)}s` : ""];
+      return bits.filter(Boolean).join(" \xB7 ");
+    } catch {
+    }
+  }
+  return void 0;
+}
+function processRunner(cmd, args, o) {
+  const sp = o.spawn ?? nodeSpawn;
+  return (r) => new Promise((resolve2, reject) => {
+    let tail = "";
+    const child = sp(cmd, args, { cwd: r.cwd, env: r.env, stdio: ["pipe", "pipe", "pipe"] });
+    const kill = () => child.kill("SIGTERM");
+    r.signal.addEventListener("abort", kill, { once: true });
+    child.stdout?.on("data", (b) => {
+      const s = b.toString();
+      r.log.out(s);
+      tail = (tail + s).slice(-64e3);
+    });
+    child.stderr?.on("data", (b) => r.log.err(b.toString()));
+    child.once("error", (e) => {
+      r.signal.removeEventListener("abort", kill);
+      reject(e.code === "ENOENT" ? new Error(`${cmd} is not on PATH; install it, or use --agent print`) : e);
+    });
+    child.once("close", (code) => {
+      r.signal.removeEventListener("abort", kill);
+      resolve2({ exitCode: code, note: o.note?.(tail) });
+    });
+    child.stdin?.end(r.prompt);
+  });
+}
+function claudeRunner(o = {}) {
+  return processRunner("claude", claudeArgs(o.model), { spawn: o.spawn, note: resultNote });
+}
+function codexRunner(o = {}) {
+  return processRunner("codex", ["exec", ...o.model ? ["--model", o.model] : [], "-"], { spawn: o.spawn });
+}
+function agentRunner(name, o = {}) {
+  if (name === "print") return printRunner(o);
+  if (name === "claude") return claudeRunner(o);
+  if (name === "codex") return codexRunner(o);
+  throw new Error(`--agent ${name}: expected print, claude or codex`);
+}
+
+// src/next/lease.ts
+import { chmodSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+function configDir(env = process.env) {
+  return join2(env.XDG_CONFIG_HOME || join2(homedir2(), ".config"), "startup-builder");
+}
+function leasesDir(env = process.env) {
+  return env.SB_LEASES || join2(configDir(env), "leases");
+}
+var slug = (batch) => batch.replace(/^https?:\/\//, "").replace(/[^A-Za-z0-9._-]+/g, "_").slice(-180);
+var Leases = class {
+  constructor(dir, now = Date.now, env = process.env) {
+    this.dir = dir;
+    this.now = now;
+    this.env = env;
+  }
+  /** the container-mode lease: in memory, never on disk */
+  memory;
+  ensure() {
+    mkdirSync(this.dir, { recursive: true, mode: 448 });
+  }
+  write(name, data) {
+    this.ensure();
+    const f = join2(this.dir, name);
+    writeFileSync(f, JSON.stringify(data, null, 2), { mode: 384 });
+    chmodSync(f, 384);
+  }
+  file(batch) {
+    return join2(this.dir, `${slug(batch)}.json`);
+  }
+  save(l) {
+    if (l.held === "dispatcher" || this.memory && l.batch === this.memory.batch) {
+      this.memory = l;
+      return l;
+    }
+    this.write(`${slug(l.batch)}.json`, l);
+    return l;
+  }
+  /** keep a lease the dispatcher holds (container mode): memory only, never written */
+  adopt(l) {
+    this.memory = { ...l, held: "dispatcher" };
+    return this.memory;
+  }
+  /** the SB_BATCH pin, if any */
+  get pin() {
+    return this.env.SB_BATCH || void 0;
+  }
+  /** SB_BATCH is set and no lease file holds it: the dispatcher's lease (container mode) is what is needed */
+  needsAdoption() {
+    const pin = this.pin;
+    return !!pin && !this.get(pin);
+  }
+  all() {
+    let names;
+    try {
+      names = readdirSync(this.dir);
+    } catch {
+      return [];
+    }
+    const out = [];
+    for (const n of names) {
+      if (!n.endsWith(".json") || n.startsWith("last-")) continue;
+      try {
+        const l = JSON.parse(readFileSync(join2(this.dir, n), "utf8"));
+        if (l?.batch && l.token) out.push(l);
+      } catch {
+      }
+    }
+    return out.sort((a, b) => b.claimedAt.localeCompare(a.claimedAt));
+  }
+  /** a dispatcher's lease is live until api.sb says it ended (409 lease_ended): the dispatcher renews it, not us */
+  live(l) {
+    return l.held === "dispatcher" || Date.parse(l.until) > this.now();
+  }
+  /** a batch by `$id`, path, or a suffix of it */
+  get(ref) {
+    const r = ref.replace(/^https?:\/\/[^/]+\//, "").replace(/^\/+/, "");
+    const hit = (l) => l.batch === ref || l.batch.endsWith(`/${r}`);
+    if (this.memory && hit(this.memory)) return this.memory;
+    return this.all().find(hit);
+  }
+  /** SB_BATCH, else the newest lease that has not expired */
+  current() {
+    const pin = this.env.SB_BATCH;
+    if (pin) return this.get(pin);
+    return this.all().find((l) => this.live(l));
+  }
+  /** the live lease whose batch holds this Task */
+  holding(task) {
+    const pin = this.env.SB_BATCH ? this.get(this.env.SB_BATCH) : void 0;
+    const pool = pin ? [pin] : this.all();
+    return pool.find((l) => this.live(l) && l.tasks.includes(task));
+  }
+  /** re-read, merge, write: another process (the agent's own CLI) may have written the file since it was read */
+  update(batch, patch) {
+    const l = this.get(batch);
+    if (!l) return void 0;
+    patch(l);
+    return this.save(l);
+  }
+  markClosed(batch, task) {
+    return this.update(batch, (l) => {
+      if (!l.closed.includes(task)) l.closed.push(task);
+    });
+  }
+  remove(batch) {
+    if (this.memory && this.memory.batch === batch) {
+      this.memory = void 0;
+      return;
+    }
+    rmSync(this.file(batch), { force: true });
+  }
+  /** the last listing a command printed, so its indexes resolve */
+  remember(kind, ids) {
+    this.write(`last-${kind}.json`, { at: new Date(this.now()).toISOString(), ids });
+  }
+  recall(kind) {
+    try {
+      return JSON.parse(readFileSync(join2(this.dir, `last-${kind}.json`), "utf8")).ids ?? [];
+    } catch {
+      return [];
+    }
+  }
+};
+
+// src/next/loop.ts
+import { appendFileSync, mkdirSync as mkdirSync2, mkdtempSync, writeFileSync as writeFileSync2, chmodSync as chmodSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+var DEFAULT_WALL_MINUTES = 30;
+var SCRUB = [
+  // api.sb and claude-runner bearers, and where the caller keeps its leases
+  "SB_TOKEN",
+  "SB_BATCH",
+  "SB_LEASES",
+  "SB_RUNNER_TOKEN",
+  // Anthropic: an API key, a gateway, or a cloud provider instead of the subscription
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_CUSTOM_HEADERS",
+  "ANTHROPIC_BEDROCK_BASE_URL",
+  "ANTHROPIC_VERTEX_BASE_URL",
+  "ANTHROPIC_FOUNDRY_API_KEY",
+  "ANTHROPIC_FOUNDRY_BASE_URL",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "AWS_BEARER_TOKEN_BEDROCK",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_PROFILE",
+  // codex logs in on its own (`codex login`); an API key would bill instead
+  "OPENAI_API_KEY",
+  "CODEX_API_KEY",
+  // the parent Claude Code session, when `work` runs inside one
+  "CLAUDECODE",
+  "CLAUDE_CODE_ENTRYPOINT",
+  "CLAUDE_CODE_SSE_PORT"
+];
+function agentEnv(base, lease, api, binDir, configHome, workdir) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (v !== void 0 && !SCRUB.includes(k)) env[k] = v;
+  env.SB_TOKEN = lease.token;
+  env.SB_BATCH = lease.batch;
+  env.SB_API = api;
+  if (configHome) env.XDG_CONFIG_HOME = configHome;
+  if (workdir) env.SB_WORKDIR = workdir;
+  if (binDir) env.PATH = [binDir, ...(env.PATH ?? "").split(":").filter((p) => p.startsWith("/"))].join(":");
+  return env;
+}
+function unlock(dir) {
+  try {
+    chmodSync2(dir, 448);
+  } catch {
+  }
+}
+function agentPrompt(md, n) {
+  const body = md.replace(/npx startup-builder/g, "startup-builder").trimEnd();
+  return `${body}
+
+---
+Run by \`startup-builder work\`: this batch is claimed and its lease renews itself. \`startup-builder\` is on your PATH and holds the lease: write a Task's JSON body to a file in this directory, then \`startup-builder close <1-${n}> --body <file>\` closes it (\`--body -\` reads stdin); \`startup-builder show <1-${n}>\` reads one. Do not claim or release; stop when every Task is closed or you cannot go on.
+`;
+}
+var ms = (a, b) => {
+  const s = Math.round((b - a) / 1e3);
+  return s < 60 ? `${s}s` : `${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s`;
+};
+var sleep = (t2, signal) => new Promise((resolve2) => {
+  if (signal.aborted) return resolve2();
+  const h = setTimeout(done, t2);
+  function done() {
+    clearTimeout(h);
+    signal.removeEventListener("abort", done);
+    resolve2();
+  }
+  signal.addEventListener("abort", done, { once: true });
+});
+async function work(s, o) {
+  const now = o.now ?? Date.now;
+  const t0 = now();
+  const sum = { batches: 0, tasks: 0, closed: 0, errors: 0, ms: 0, stopped: "empty" };
+  const stamp = () => new Date(now()).toISOString().slice(11, 19);
+  const line = (x) => o.line(`${stamp()} ${x}`);
+  mkdirSync2(o.logDir, { recursive: true, mode: 448 });
+  const worked = /* @__PURE__ */ new Set();
+  while (true) {
+    if (o.signal.aborted) {
+      sum.stopped = "signal";
+      break;
+    }
+    if (o.maxBatches && sum.batches >= o.maxBatches) {
+      sum.stopped = "max";
+      break;
+    }
+    const c = await s.claim({ worker: o.worker, skip: worked }).catch((e) => ({ text: `claim: ${e.message}`, data: { taken: [] }, exit: 1 }));
+    if (c.exit === 1) {
+      line(c.text);
+      sum.errors++;
+      sum.stopped = "error";
+      break;
+    }
+    const got = "lease" in c.data && c.data.lease ? s.leases.get(c.data.lease.batch) : void 0;
+    if (!got) {
+      if (!o.wait) {
+        line(c.text);
+        sum.stopped = "empty";
+        break;
+      }
+      await sleep(o.pollMs ?? 3e4, o.signal);
+      continue;
+    }
+    worked.add(got.batch);
+    sum.batches++;
+    sum.tasks += got.tasks.length;
+    const closed = await runBatch(s, o, got, line);
+    sum.closed += closed.closed;
+    sum.errors += closed.errors;
+  }
+  sum.ms = now() - t0;
+  o.line(`work: ${sum.batches} batch${sum.batches === 1 ? "" : "es"}, ${sum.closed}/${sum.tasks} Tasks closed, ${ms(t0, now())}, ${sum.errors} error${sum.errors === 1 ? "" : "s"} (${sum.stopped})`);
+  return sum;
+}
+async function runBatch(s, o, lease, line) {
+  const now = o.now ?? Date.now;
+  const t0 = now();
+  let errors = 0;
+  line(`claimed ${lease.startup} ${lease.step}: ${lease.tasks.length} Tasks, until ${s.when(lease.until)} (${s.short(lease.batch)})`);
+  const idx = (t2) => lease.tasks.indexOf(t2) + 1;
+  const slug2 = s.short(lease.batch).replace(/[^A-Za-z0-9._-]+/g, "_").slice(-120);
+  const logBase = join3(o.logDir, `${new Date(t0).toISOString().replace(/[:.]/g, "-")}-${slug2}`);
+  const log = { out: (c) => appendFileSync(`${logBase}.jsonl`, c), err: (c) => appendFileSync(`${logBase}.err.log`, c) };
+  const p = await s.batchPrompt(lease);
+  if (p.exit) {
+    line(p.text);
+    const r2 = await s.release({ batch: lease });
+    line(r2.text);
+    return { closed: 0, errors: 1 };
+  }
+  const root = o.tmpRoot ?? tmpdir();
+  const cwd = mkdtempSync(join3(root, "sb-work-"));
+  const home = mkdtempSync(join3(root, "sb-home-"));
+  chmodSync2(home, 448);
+  let binDir;
+  if (o.selfCli) {
+    binDir = join3(home, "bin");
+    mkdirSync2(binDir);
+    const shim = join3(binDir, "startup-builder");
+    writeFileSync2(shim, `#!/bin/sh
+exec ${o.selfCli} "$@"
+`);
+    chmodSync2(shim, 365);
+    chmodSync2(binDir, 365);
+  }
+  const configHome = join3(home, "config");
+  const mine = new Leases(leasesDir({ XDG_CONFIG_HOME: configHome }), now, { SB_BATCH: lease.batch });
+  mine.save({ ...lease, closed: [...lease.closed] });
+  const env = agentEnv(o.env ?? process.env, lease, s.base, binDir, configHome, cwd);
+  const cleanup = () => {
+    if (binDir) unlock(binDir);
+    rmSync2(home, { recursive: true, force: true });
+    rmSync2(cwd, { recursive: true, force: true });
+  };
+  const notAfter = t0 + (o.wallMinutes ?? DEFAULT_WALL_MINUTES) * 6e4;
+  let capped = false;
+  const seen = /* @__PURE__ */ new Set();
+  const watch = () => {
+    const l = mine.get(lease.batch);
+    for (const t2 of l?.closed ?? []) if (!seen.has(t2)) {
+      seen.add(t2);
+      line(`closed ${idx(t2)} (${seen.size}/${lease.tasks.length}) ${s.short(t2)}`);
+    }
+    return l;
+  };
+  const ac = new AbortController();
+  const stopAgent = () => ac.abort();
+  o.signal.addEventListener("abort", stopAgent, { once: true });
+  const watcher = setInterval(watch, o.watchMs ?? 2e3);
+  const capTimer = setTimeout(() => {
+    capped = true;
+    line(`wall-clock cap (${o.wallMinutes ?? DEFAULT_WALL_MINUTES}m) reached: stopping the agent`);
+    ac.abort();
+  }, Math.max(0, notAfter - now()));
+  let lost = false;
+  const renewer = setInterval(async () => {
+    if (!mine.get(lease.batch) || capped) return;
+    const r2 = await s.renew({ batch: lease, notAfter }).catch((e) => ({ text: `renew: ${e.message}`, exit: 1, data: {} }));
+    const renewed = r2.exit ? void 0 : s.leases.get(lease.batch);
+    if (renewed) mine.update(lease.batch, (x) => {
+      x.token = renewed.token;
+      x.until = renewed.until;
+    });
+    if (r2.exit) {
+      line(r2.text);
+      if (r2.data?.lost) {
+        lost = true;
+        ac.abort();
+      }
+    }
+  }, o.renewMs ?? Math.max(5e3, (lease.leaseSeconds ?? 900) * 1e3 / 3));
+  const fromApi = async () => {
+    for (const t2 of await s.closedOf(lease).catch(() => [])) if (!seen.has(t2)) {
+      seen.add(t2);
+      line(`closed ${idx(t2)} (${seen.size}/${lease.tasks.length}) ${s.short(t2)}`);
+    }
+  };
+  const done = async () => {
+    const l = watch();
+    if (!l || !l.tasks.every((t2) => l.closed.includes(t2))) await fromApi();
+    return lease.tasks.every((t2) => seen.has(t2));
+  };
+  line(`agent ${o.agentName} started \xB7 log ${logBase}.jsonl`);
+  const ta = now();
+  let res;
+  try {
+    res = await o.agent({ prompt: agentPrompt(p.text, lease.tasks.length), env, cwd, batch: lease.batch, log, signal: ac.signal, done });
+  } catch (e) {
+    res = { exitCode: 1, note: e.message };
+  }
+  clearInterval(watcher);
+  clearInterval(renewer);
+  clearTimeout(capTimer);
+  o.signal.removeEventListener("abort", stopAgent);
+  watch();
+  const exitText = res.exitCode === null ? "stopped" : `exited ${res.exitCode}`;
+  line(`agent ${exitText} after ${ms(ta, now())}${res.note ? ` \xB7 ${res.note}` : ""}`);
+  if (res.exitCode && !o.signal.aborted && !lost && !capped) errors++;
+  let r;
+  try {
+    await fromApi();
+    r = await s.release({ batch: lease });
+  } finally {
+    mine.remove(lease.batch);
+    cleanup();
+  }
+  if (r.exit) errors++;
+  const already = r.data?.already;
+  line(r.exit ? r.text : `released${already ? " (lease had ended)" : ""} ${lease.startup} ${lease.step}: ${seen.size}/${lease.tasks.length} closed in ${ms(t0, now())}`);
+  return { closed: seen.size, errors };
+}
+
+// src/next/mcp.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+var S = { type: "string" };
+var N = { type: "number" };
+var B = { type: "boolean" };
+var str = (v) => v === void 0 || v === null ? void 0 : String(v);
+var num = (v) => v === void 0 || v === null || v === "" ? void 0 : Number(v);
+var list = (v) => v === void 0 ? void 0 : String(v).split(",").map((s) => s.trim()).filter(Boolean);
+var t = (name, description, properties, run, required) => ({
+  name,
+  description,
+  inputSchema: { type: "object", properties, ...required ? { required } : {} },
+  run
+});
+var TOOLS = [
+  t("queue", "Open batches, best first.", { worker: S, limit: N }, (s, a) => s.queue({ worker: str(a.worker), limit: num(a.limit) })),
+  t("claim", "Claim a batch (n from queue); default the best free one.", { batch: S, worker: S }, (s, a) => s.claim({ ref: str(a.batch), worker: str(a.worker) })),
+  t("prompt", "The claimed batch's prompt, or a named Prompt.", { name: S }, async (s, a) => a.set !== void 0 ? { text: "prompt: set is an Owner tool, off on this server (startup-builder mcp --owner)", data: null, exit: 1 } : s.prompt({ name: str(a.name) })),
+  t("show", "Read a Task or Thing: index, path or $id.", { ref: S }, (s, a) => s.show({ ref: String(a.ref) }), ["ref"]),
+  t("close", "Close a Task via its Verb. In a claimed batch it runs; try:true previews.", { task: S, body: {}, try: B }, (s, a) => s.close({ ref: String(a.task), body: a.body, mode: a.try ? "try" : void 0 }), ["task"]),
+  t("renew", "Extend the lease.", {}, (s) => s.renew()),
+  t("release", "Give the batch back; open Tasks requeue.", {}, (s) => s.release()),
+  t("worklist", "A Worker's open Tasks.", { worker: S, startup: S, limit: N, page: N }, (s, a) => s.worklist({ worker: String(a.worker), startups: list(a.startup), limit: num(a.limit), page: num(a.page) }), ["worker"]),
+  t("versions", "A Thing's versions.", { ref: S }, (s, a) => s.versions({ ref: String(a.ref) }), ["ref"]),
+  t("changes", "Recent writes.", { worker: S, startup: S, limit: N }, (s, a) => s.changes({ worker: str(a.worker), startup: str(a.startup), limit: num(a.limit) }))
+];
+var OWNER_TOOLS = [
+  t("prompt", "The claimed batch's prompt, or a named Prompt; set: its new text (Owner).", { name: S, set: S }, (s, a) => s.prompt({ name: str(a.name), set: str(a.set) })),
+  t("revert", "Revert a Thing to a version (Owner); do:true runs it.", { ref: S, to: S, do: B }, (s, a) => s.revert({ ref: String(a.ref), to: String(a.to), mode: a.do ? "do" : "try" }), ["ref", "to"])
+];
+function toolsFor(o = {}) {
+  if (!o.owner) return TOOLS;
+  const own = new Map(OWNER_TOOLS.map((x) => [x.name, x]));
+  return [...TOOLS.map((x) => own.get(x.name) ?? x), ...OWNER_TOOLS.filter((x) => !TOOLS.some((y) => y.name === x.name))];
+}
+function mcpServer(session, version, o = {}) {
+  const tools = toolsFor(o);
+  const server = new Server({ name: "startup-builder", version }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: tools.map(({ run: _r, ...d }) => d) }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const def = tools.find((x) => x.name === req.params.name);
+    if (!def) return { content: [{ type: "text", text: `no tool ${req.params.name}` }], isError: true };
+    try {
+      const out = await def.run(session, req.params.arguments ?? {});
+      return { content: [{ type: "text", text: out.text }], ...out.exit === 1 || out.exit === 4 ? { isError: true } : {} };
+    } catch (e) {
+      return { content: [{ type: "text", text: e?.message ?? String(e) }], isError: true };
+    }
+  });
+  return server;
+}
+async function serveStdio(session, version, o = {}) {
+  await mcpServer(session, version, o).connect(new StdioServerTransport());
+}
+
+// src/next/session.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var LEASE_ENDED = 4;
+var isLeaseEnded = (r) => r.status === 409 && (r.json?.error?.code === "lease_ended" || /lease_ended/.test(r.text));
+function lineDelta(before, after) {
+  const count = (xs) => xs.reduce((m, x) => m.set(x, (m.get(x) ?? 0) + 1), /* @__PURE__ */ new Map());
+  const a = count(before.split("\n"));
+  const b = count(after.split("\n"));
+  let added = 0;
+  let removed = 0;
+  for (const [k, n] of b) added += Math.max(0, n - (a.get(k) ?? 0));
+  for (const [k, n] of a) removed += Math.max(0, n - (b.get(k) ?? 0));
+  return `+${added} \u2212${removed} lines`;
+}
+function jwtClaims(t2) {
+  const p = t2.split(".");
+  if (p.length !== 3) return void 0;
+  try {
+    return JSON.parse(Buffer.from(p[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+var last = (u) => u ? u.split("?")[0].split("/").filter(Boolean).pop() ?? u : "";
+var isIndex = (s) => /^\d{1,3}$/.test(s);
+var Session = class {
+  base;
+  leases;
+  d;
+  constructor(d) {
+    this.d = d;
+    this.base = d.base.replace(/\/+$/, "");
+    this.leases = d.leases;
+  }
+  // ---- plumbing ---------------------------------------------------------------------------------------------------
+  /** a client on the base, carrying `c` only if it belongs to the base's origin (Api drops a token bound elsewhere) */
+  api(c) {
+    const cred = this.cred(c);
+    return new Api({ base: this.base, token: cred?.token, bind: cred?.api, fetch: this.d.fetch, userAgent: this.d.userAgent });
+  }
+  cred(c) {
+    if (!c) return void 0;
+    return typeof c === "string" ? { token: c, api: this.base } : c;
+  }
+  /** a lease's token, bound to the API it was claimed on */
+  leaseCred(l) {
+    return { token: l.token, api: l.api || originOf(l.batch) || this.base };
+  }
+  now = () => (this.d.now ?? Date.now)();
+  get env() {
+    return this.d.env ?? process.env;
+  }
+  adopting;
+  /**
+   * Container mode: SB_BATCH is set and no lease file holds it, so build the lease the dispatcher holds from
+   * `GET <SB_BATCH>`, in memory only. Undefined when there is nothing to do or it worked; else why not (exit 1, or 4 when
+   * the lease has ended).
+   */
+  ensureLease() {
+    if (!this.leases.needsAdoption()) return Promise.resolve(void 0);
+    return this.adopting ??= this.adopt().then((r) => {
+      if (r) this.adopting = void 0;
+      return r;
+    });
+  }
+  async adopt() {
+    const pin = this.leases.pin;
+    const token = this.env.SB_TOKEN || void 0;
+    if (!token) return this.none(`SB_BATCH is set (${this.short(pin)}) but no lease file holds it and SB_TOKEN is unset: claim it, or unset SB_BATCH`);
+    const id = this.api().url(pin.replace(/^\/+/, ""));
+    const r = await this.api(token).get(id);
+    if (isLeaseEnded(r)) return this.ended(r, `batch ${this.short(id)}`);
+    if (!r.ok) return this.fail(r, `batch ${this.short(id)}`);
+    const b = r.json?.batch ?? (r.json?.$id ? r.json : void 0);
+    const raw = Array.isArray(b?.tasks) ? b.tasks : [];
+    const tasks = raw.map((t2) => typeof t2 === "string" ? t2 : String(t2.$id)).filter(Boolean);
+    if (!b || !tasks.length) return this.none(`batch ${this.short(id)}: api.sb answered ${r.status} with no Tasks`);
+    const closed = raw.filter((t2) => typeof t2 === "object" && (t2.closedOn !== void 0 || t2.status === "Done")).map((t2) => String(t2.$id));
+    const first = raw.find((t2) => typeof t2 === "object");
+    this.leases.adopt({
+      batch: String(b.$id ?? id),
+      worker: last(b.worker) || String(b.worker ?? ""),
+      startup: last(b.startup ?? first?.startup) || String(b.startup ?? first?.startup ?? ""),
+      step: String(b.stepTitle ?? b.step ?? first?.stepTitle ?? first?.step ?? ""),
+      ...typeof b.priority === "number" ? { priority: b.priority } : {},
+      tasks,
+      prompt: String(b.prompt ?? `${b.$id ?? id}?md`),
+      until: String(b.lease?.until ?? ""),
+      token,
+      session: String(b.lease?.session ?? this.env.SB_SESSION ?? ""),
+      claimedAt: new Date(this.now()).toISOString(),
+      leaseSeconds: 0,
+      api: this.base,
+      closed,
+      held: "dispatcher"
+    });
+    return void 0;
+  }
+  /** 409 lease_ended: stop. A lease file for it goes (the lease is over); a dispatcher's lease is the dispatcher's. */
+  ended(r, what, l) {
+    if (l && l.held !== "dispatcher") this.leases.remove(l.batch);
+    const e = r.json?.error;
+    const msg = typeof e === "string" ? e : e?.message ?? "";
+    return { text: `${what}: lease ended, stop${msg ? ` (${msg})` : ""}`, data: { status: r.status, code: "lease_ended", stop: true }, exit: LEASE_ENDED };
+  }
+  /** a `$id` shown relative to api.sb: `demo.startups.studio/barcoding.dev/actions/fix-fnc1` */
+  short(u) {
+    if (!u) return "";
+    return u.startsWith(`${this.base}/`) ? u.slice(this.base.length + 1) : u;
+  }
+  /** `10:14Z` today, else `2026-09-28 10:14Z` */
+  when(iso) {
+    if (!iso) return "?";
+    const d = new Date(iso);
+    if (Number.isNaN(+d)) return iso;
+    const s = d.toISOString();
+    return s.slice(0, 10) === new Date(this.now()).toISOString().slice(0, 10) ? `${s.slice(11, 16)}Z` : `${s.slice(0, 10)} ${s.slice(11, 16)}Z`;
+  }
+  async baseToken(interactive = false) {
+    const t2 = this.cred(await this.d.token());
+    if (t2 || !interactive || !this.d.login) return t2;
+    return this.cred(await this.d.login());
+  }
+  fail(r, what, data) {
+    const e = r.json?.error;
+    const msg = typeof e === "string" ? e : e?.message ?? (r.text && !r.json ? r.text.slice(0, 200) : "");
+    const code = typeof e?.code === "string" ? ` ${e.code}` : "";
+    return { text: `${what} ${r.status}${code}${msg ? `: ${msg}` : ""}`, data: data ?? r.json ?? { status: r.status }, exit: 1 };
+  }
+  none(what) {
+    return { text: what, data: null, exit: 1 };
+  }
+  /** A Task (or Thing) ref as a `$id`: an index into the claimed batch (else the last worklist), a path, or a URL. */
+  resolve(ref, o = {}) {
+    const r = ref.trim();
+    if (isIndex(r)) {
+      const n = Number(r);
+      if (o.kind === "batch") {
+        const ids2 = this.leases.recall("queue");
+        if (!ids2[n - 1]) throw new Error(`no batch ${n} in the last queue listing (${ids2.length}): run queue`);
+        return ids2[n - 1];
+      }
+      const lease = this.leases.current();
+      const ids = lease?.tasks ?? this.leases.recall("worklist");
+      if (!ids[n - 1]) throw new Error(lease ? `the batch has Tasks 1-${ids.length}, not ${n}` : `no Task ${n}: claim a batch, or list a worklist first`);
+      return ids[n - 1];
+    }
+    return this.api().url(r.replace(/^\/+/, ""));
+  }
+  label(ref, id) {
+    return isIndex(ref.trim()) ? ref.trim() : this.short(id);
+  }
+  /** the token for a read of this `$id`: a lease that holds it, else SB_TOKEN/sign-in, else any live lease (it reads) */
+  async readToken(id) {
+    const held = this.leases.holding(id);
+    if (held) return this.leaseCred(held);
+    const lease = this.leases.current();
+    if (lease && (id === lease.prompt || id.startsWith(lease.batch))) return this.leaseCred(lease);
+    return await this.baseToken() ?? (lease && this.leases.live(lease) ? this.leaseCred(lease) : void 0);
+  }
+  // ---- the queue ----------------------------------------------------------------------------------------------------
+  batchLine(b, i, withWorker) {
+    const step = b.stepTitle ?? b.step;
+    const where = b.startups && b.startups.length > 1 ? `${last(b.startups[0])}+${b.startups.length - 1}` : last(b.startup) || b.startup;
+    return `${i} ${where} ${step} ${b.tasks.length} Tasks p${b.priority}${withWorker ? ` ${last(b.worker)}` : ""}`;
+  }
+  async listQueue(o = {}) {
+    const q = new URLSearchParams({ limit: String(o.limit ?? 5) });
+    const w = parseWorker(o.worker);
+    if (w) q.set("worker", w);
+    const r = await this.api(await this.baseToken()).get(`/queue?${q}`);
+    return { r, batches: r.ok ? r.json?.batches ?? [] : [] };
+  }
+  /** `queue [for:w] [--limit n]`: open batches, highest priority first (claimed ones excluded by api.sb) */
+  async queue(o = {}) {
+    const { r, batches } = await this.listQueue(o);
+    if (!r.ok) return this.fail(r, "queue");
+    this.leases.remember("queue", batches.map((b) => b.$id));
+    if (!batches.length) return { text: "queue empty", data: { batches }, exit: 3 };
+    const withWorker = !o.worker && new Set(batches.map((b) => b.worker)).size > 1;
+    return { text: batches.map((b, i) => this.batchLine(b, i + 1, withWorker)).join("\n"), data: { batches }, exit: 0 };
+  }
+  async batchOf(id, worker) {
+    const { batches } = await this.listQueue({ worker, limit: 50 });
+    const hit = batches.find((b2) => b2.$id === id);
+    if (hit) return hit;
+    const r = await this.api(await this.baseToken()).get(id);
+    const b = r.json?.batch ?? (r.json?.$id ? r.json : void 0);
+    return r.ok && b?.$id ? b : void 0;
+  }
+  /** POST one claim: the lease, 'taken' on 409, or the failure */
+  async claimOne(b, token, leaseSeconds) {
+    const session = this.d.session ?? randomUUID3();
+    const url = b.claim || `${b.$id}:claim`;
+    const r = await this.api(token).post(url, { leaseSeconds, session });
+    if (r.status === 409) return "taken";
+    if (!r.ok) return this.fail(r, `claim ${this.short(b.$id)}`);
+    const l = r.json?.lease ?? {};
+    if (!l.token) return this.none(`claim ${this.short(b.$id)}: api.sb answered ${r.status} with no lease token`);
+    return this.leases.save({
+      batch: b.$id,
+      worker: last(b.worker) || b.worker,
+      startup: last(b.startup) || b.startup,
+      step: b.stepTitle ?? b.step,
+      priority: b.priority,
+      tasks: b.tasks,
+      prompt: b.prompt,
+      until: l.until ?? new Date(this.now() + leaseSeconds * 1e3).toISOString(),
+      token: l.token,
+      session,
+      claimedAt: new Date(this.now()).toISOString(),
+      leaseSeconds,
+      api: this.base,
+      closed: []
+    });
+  }
+  /** `claim [n|batch]`: a named batch, or (no argument) the best free one, falling through a 409 to the next */
+  async claim(o = {}) {
+    const leaseSeconds = o.leaseSeconds ?? this.d.leaseSeconds ?? 900;
+    const token = await this.baseToken(true);
+    let candidates;
+    if (o.ref && o.ref !== "next") {
+      const id = this.resolve(o.ref, { kind: "batch" });
+      const b = await this.batchOf(id, o.worker);
+      if (!b) return { text: `claim: no open batch ${this.short(id)}`, data: { taken: [] }, exit: 1 };
+      candidates = [b];
+    } else {
+      const skip = o.skip ?? /* @__PURE__ */ new Set();
+      const { r, batches } = await this.listQueue({ worker: o.worker, limit: Math.min(50, 5 + skip.size) });
+      if (!r.ok) return this.fail(r, "queue", { taken: [] });
+      candidates = batches.filter((b) => !skip.has(b.$id));
+    }
+    const taken = [];
+    for (const b of candidates) {
+      const got = await this.claimOne(b, token, leaseSeconds);
+      if (got === "taken") {
+        taken.push(b.$id);
+        continue;
+      }
+      if ("exit" in got) return { ...got, data: { taken } };
+      const { token: _t, ...safe } = got;
+      return { text: `claimed ${got.startup} ${got.step}: ${got.tasks.length} Tasks, until ${this.when(got.until)}`, data: { lease: safe, taken }, exit: 0 };
+    }
+    return { text: taken.length ? `nothing free: ${taken.length} taken` : "queue empty", data: { taken }, exit: 3 };
+  }
+  /** the lease as its file says now (another process may have written it), else the object passed */
+  leaseOf(batch) {
+    if (batch && typeof batch === "object") return this.leases.get(batch.batch) ?? batch;
+    return batch ? this.leases.get(batch) : this.leases.current();
+  }
+  /** POST a lease Verb with the lease token, then SB_TOKEN/sign-in if api.sb refuses the lease token */
+  async leasePost(l, verb, body) {
+    let r = await this.api(this.leaseCred(l)).post(`${l.batch}:${verb}`, body);
+    if (r.status === 401 || r.status === 403) {
+      const t2 = await this.baseToken();
+      if (t2 && t2.token !== l.token) r = await this.api(t2).post(`${l.batch}:${verb}`, body);
+    }
+    return r;
+  }
+  /** `renew`: extend the current lease; never past `notAfter` (epoch ms: the work loop's wall-clock cap) */
+  async renew(o = {}) {
+    const bad = await this.ensureLease();
+    if (bad) return bad;
+    const l = this.leaseOf(o.batch);
+    if (!l) return this.none("no claimed batch");
+    if (l.held === "dispatcher") return { text: "renew: the dispatcher holds this lease and renews it; nothing to do here", data: { dispatcher: true }, exit: 0 };
+    let leaseSeconds = o.leaseSeconds ?? l.leaseSeconds ?? this.d.leaseSeconds ?? 900;
+    if (o.notAfter !== void 0) {
+      const left = Math.floor((o.notAfter - this.now()) / 1e3);
+      if (left <= 0) return { text: "renew: the wall-clock cap is reached; not renewed", data: { capped: true }, exit: 1 };
+      leaseSeconds = Math.min(leaseSeconds, left);
+    }
+    const r = await this.leasePost(l, "renew", { leaseSeconds, session: l.session });
+    if (r.status === 404 || r.status === 409 || r.status === 410) {
+      this.leases.remove(l.batch);
+      return { ...this.fail(r, "lease lost"), data: { lost: true } };
+    }
+    if (!r.ok) return this.fail(r, "renew");
+    const nl = r.json?.lease ?? {};
+    let until = nl.until ?? new Date(this.now() + leaseSeconds * 1e3).toISOString();
+    if (o.notAfter !== void 0 && Date.parse(until) > o.notAfter) until = new Date(o.notAfter).toISOString();
+    const patch = (x) => {
+      x.until = until;
+      if (nl.token) x.token = nl.token;
+      x.leaseSeconds = leaseSeconds;
+    };
+    patch(l);
+    this.leases.update(l.batch, patch);
+    return { text: `renewed until ${this.when(l.until)}`, data: { until: l.until }, exit: 0 };
+  }
+  /** `release`: give the batch back; its unclosed Tasks return to the queue */
+  async release(o = {}) {
+    const bad = await this.ensureLease();
+    if (bad) return bad;
+    const l = this.leaseOf(o.batch);
+    if (!l) return this.none("no claimed batch");
+    if (l.held === "dispatcher") return { text: "release: the dispatcher holds this lease and releases it when the session ends; nothing to do here", data: { closed: l.closed.length, returned: 0, dispatcher: true }, exit: 0 };
+    const r = await this.leasePost(l, "release", { session: l.session });
+    const closed = typeof r.json?.closed === "number" ? r.json.closed : l.closed.length;
+    const returned = typeof r.json?.returned === "number" ? r.json.returned : l.tasks.length - closed;
+    if (r.ok || r.status === 404 || r.status === 409 || r.status === 410) this.leases.remove(l.batch);
+    if (r.status === 404 || r.status === 409 || r.status === 410) return { text: `released (lease had already ended): ${closed}/${l.tasks.length} closed`, data: { closed, returned, already: true }, exit: 0 };
+    if (!r.ok) return this.fail(r, "release");
+    return { text: `released ${l.startup} ${l.step}: ${closed}/${l.tasks.length} closed${returned ? `, ${returned} back on the queue` : ""}`, data: { closed, returned }, exit: 0 };
+  }
+  // ---- reading ------------------------------------------------------------------------------------------------------
+  /** the claimed batch's prompt (its `?md`), verbatim */
+  async batchPrompt(l) {
+    const r = await this.api(this.leaseCred(l)).get(l.prompt, "text/markdown");
+    if (isLeaseEnded(r)) return this.ended(r, "prompt", l);
+    if (!r.ok) return this.fail(r, "prompt", { url: l.prompt });
+    return { text: r.text.trimEnd(), data: { url: l.prompt }, exit: 0 };
+  }
+  /** `prompt [name]`: the claimed batch's prompt, or a versioned Prompt at /prompts/{name} */
+  async prompt(o = {}) {
+    if (o.set !== void 0) {
+      if (!o.name) return this.none("prompt --set: name the Prompt (prompt <name> --set <file|->)");
+      return this.promptSet({ name: o.name, text: o.set });
+    }
+    if (!o.name) {
+      const bad = await this.ensureLease();
+      if (bad) return bad;
+      const l = this.leases.current();
+      if (!l) return this.none("no claimed batch: claim first, or prompt <name>");
+      return this.batchPrompt(l);
+    }
+    const path = /^https?:\/\//.test(o.name) || o.name.includes("/prompts/") ? o.name : `/prompts/${o.name.replace(/^\/+/, "")}`;
+    const r = await this.api(await this.baseToken()).get(path);
+    if (!r.ok) return this.fail(r, `prompt ${o.name}`);
+    const p = r.json?.prompt ?? thingOf(r.json) ?? r.json ?? {};
+    const text = p.text ?? p.body ?? p.content ?? p.template;
+    if (typeof text === "string") return { text: text.trimEnd(), data: p, exit: 0 };
+    const md = await this.api(await this.baseToken()).get(`${path}${path.includes("?") ? "&" : "?"}md`, "text/markdown");
+    return md.ok ? { text: md.text.trimEnd(), data: p, exit: 0 } : this.fail(md, `prompt ${o.name}`);
+  }
+  /** is this bearer a batch's lease token (a lease we hold, the container's SB_TOKEN, or a JWT naming a batch)? */
+  isLeaseToken(t2) {
+    if (this.leases.all().some((l) => l.token === t2)) return true;
+    if (this.leases.pin && this.env.SB_TOKEN === t2) return true;
+    const c = jwtClaims(t2);
+    return !!c && (c.batch !== void 0 || c.sid !== void 0);
+  }
+  /**
+   * `prompt <name> --set <file|->`: a new version of a Prompt (POST /prompts/{name}:update {text}, an Idempotency-Key),
+   * as the Owner: the stored sign-in (or an Owner's SB_TOKEN), never a lease token. Answers the new version and a
+   * one-line summary of what changed; every batch claimed after it reads the new text.
+   */
+  async promptSet(o) {
+    const name = o.name.replace(/^https?:\/\/[^/]+/, "").replace(/^\/*(prompts\/)?/, "").replace(/[:?].*$/, "");
+    const text = o.text.replace(/\s+$/, "");
+    if (!text.trim()) return this.none(`prompt ${name} --set: the new text is empty`);
+    const token = await this.baseToken(true);
+    if (!token) return this.none(`prompt ${name} --set: sign in as the Owner (startup-builder login)`);
+    if (this.isLeaseToken(token.token)) return this.none(`prompt ${name} --set: a lease token cannot edit prompts; sign in as the Owner (startup-builder login, without SB_TOKEN)`);
+    const api = this.api(token);
+    const path = `/prompts/${name}`;
+    const cur = await api.get(path);
+    if (!cur.ok) return this.fail(cur, `prompt ${name}`);
+    const p = cur.json?.prompt ?? {};
+    const before = String(p.text ?? "").replace(/\s+$/, "");
+    const was = p.version ?? p.n;
+    if (before === text) return { text: `prompt ${name} unchanged${was !== void 0 ? ` (v${was})` : ""}: nothing sent`, data: p, exit: 0 };
+    const r = await api.post(`${path}:update`, { text }, { idempotencyKey: o.idempotencyKey });
+    if (r.status === 403) return this.fail(r, `prompt ${name} --set (the Owner only)`);
+    if (!r.ok) return this.fail(r, `prompt ${name} --set`);
+    const a = r.json?.action ?? {};
+    const v = a.version ?? (typeof was === "number" ? was + 1 : void 0);
+    const replay = r.headers["idempotent-replayed"] === "true" ? " (replayed)" : "";
+    return { text: `prompt ${name} ${was !== void 0 ? `v${was} \u2192 ` : ""}v${v ?? "?"}: ${lineDelta(before, text)}${replay}`, data: r.json ?? {}, exit: 0 };
+  }
+  /** `show <ref>`: a Task or Thing, compact (`md` for its `?md`) */
+  async show(o) {
+    const bad = await this.ensureLease();
+    if (bad) return bad;
+    const id = this.resolve(o.ref);
+    const api = this.api(await this.readToken(id));
+    if (o.md) {
+      const r2 = await api.get(`${id}${id.includes("?") ? "&" : "?"}md`, "text/markdown");
+      return r2.ok ? { text: r2.text.trimEnd(), data: { $id: id }, exit: 0 } : this.fail(r2, `show ${this.label(o.ref, id)}`);
+    }
+    const r = await api.get(id);
+    if (!r.ok) return this.fail(r, `show ${this.label(o.ref, id)}`);
+    const t2 = thingOf(r.json) ?? r.json ?? {};
+    return { text: this.thingText(t2), data: t2, exit: 0 };
+  }
+  /** A Thing in a few lines: `$type name · status`, then its scalar fields, URLs made relative, long values cut. */
+  thingText(t2) {
+    const head = [t2.$type ?? "Thing", t2.name ? `"${t2.name}"` : this.short(t2.$id), t2.status, t2.priorityText ?? (t2.priority !== void 0 ? `p${t2.priority}` : void 0)].filter(Boolean).join(" \xB7 ");
+    const lines = [head];
+    if (t2.name && t2.$id) lines.push(this.short(t2.$id));
+    const c = t2.closesOn;
+    if (c?.event) lines.push(`closes on ${c.event} via ${c.verb}${c.blocked ? ` (blocked: ${c.blocked})` : ""}${c.refused ? ` (refused: ${c.refused})` : ""}${c.approvalNeeded ? " (needs Approval)" : ""}`);
+    if (t2.closedOn) lines.push(`closed on ${typeof t2.closedOn === "string" ? t2.closedOn : JSON.stringify(t2.closedOn)}${t2.closedBy ? ` by ${this.short(t2.closedBy)}` : ""}`);
+    const skip = /* @__PURE__ */ new Set(["$id", "$type", "name", "status", "priority", "priorityText", "priorityWhy", "closesOn", "closedOn", "closedBy", "$context", "api", "links", "nav", "user"]);
+    if (t2.$id) skip.add("id");
+    const shown = /* @__PURE__ */ new Set();
+    for (const [k, v] of Object.entries(t2)) {
+      if (skip.has(k) || v === null || v === void 0 || v === "" || `${k}Text` in t2) continue;
+      const s = this.value(v);
+      if (!s || shown.has(s)) continue;
+      shown.add(s);
+      lines.push(`${k}: ${s}`);
+      if (lines.length >= 24) {
+        lines.push("\u2026 (--json for all)");
+        break;
+      }
+    }
+    return lines.join("\n");
+  }
+  /** one value, compact: URLs relative, objects inline when short, else their size */
+  value(v, max = 100) {
+    if (typeof v === "string") {
+      const s = /^https?:\/\//.test(v) ? this.short(v) : v.replace(/\s+/g, " ");
+      return s.length > max ? `${s.slice(0, max - 1)}\u2026` : s;
+    }
+    if (typeof v === "number" || typeof v === "boolean") return String(v);
+    if (Array.isArray(v)) {
+      if (!v.length) return "";
+      const s = v.map((x) => this.value(x, 40)).join(", ");
+      return s.length > max ? `${v.length} items` : s;
+    }
+    if (v && typeof v === "object") {
+      const s = JSON.stringify(v, (_k, x) => typeof x === "string" && x.startsWith(`${this.base}/`) ? this.short(x) : x);
+      return s.length > max ? `{${Object.keys(v).length} keys}` : s;
+    }
+    return "";
+  }
+  // ---- closing ------------------------------------------------------------------------------------------------------
+  /** `field: old → new` for each change a versioned write reports, in whatever of the likely shapes api.sb serves */
+  diffText(a) {
+    if (!a) return "";
+    const raw = a.changed ?? a.changes ?? a.diff ?? a.version?.changes ?? a.version?.diff;
+    const rows = Array.isArray(raw) ? raw.map((x) => ({ field: x.field ?? x.path ?? x.name, from: x.from ?? x.old ?? x.before, to: x.to ?? x.new ?? x.after ?? x.value, verdict: x.verdict })) : raw && typeof raw === "object" ? Object.entries(raw).map(([field, x]) => {
+      const b = x?.from ?? x?.old ?? x?.before;
+      const t2 = x?.to ?? x?.new ?? x?.after;
+      const val = (c) => c && typeof c === "object" && "value" in c ? c.value : c;
+      const same = JSON.stringify(val(b)) === JSON.stringify(val(t2));
+      const mark = t2?.mark;
+      return same && mark ? { field, verdict: `\u2713 ${mark}` } : { field, from: val(b), to: val(t2) };
+    }) : [];
+    const v = a.version === void 0 ? "" : typeof a.version === "object" ? String(a.version.n ?? a.version.version ?? last(a.version.$id)) : String(a.version);
+    const cut = (x) => x === void 0 ? "\u2205" : this.value(x, 40) || "\u2205";
+    const parts = rows.filter((r) => r.field).map((r) => r.verdict && r.verdict !== "corrected" && r.from === void 0 ? `${r.field} ${r.verdict}` : `${r.field}: ${cut(r.from)} \u2192 ${cut(r.to)}`);
+    const shown = parts.slice(0, 6).join("; ") + (parts.length > 6 ? `; +${parts.length - 6}` : "");
+    return [v ? /^v/i.test(v) ? v : `v${v}` : "", shown].filter(Boolean).join(" ");
+  }
+  closeLine(label, r, left) {
+    const a = r.action;
+    const bits = [label];
+    if (r.outcome === "NotSent") return `${label} not sent: ${r.note}`;
+    if (r.outcome === "Blocked" || r.outcome === "KeyReused" || r.outcome === "Error") {
+      return `${label} ${r.outcome} ${r.status}${r.blocked?.code ? ` ${r.blocked.code}` : ""}${r.blocked?.message ? `: ${r.blocked.message}` : ""}`;
+    }
+    bits.push(r.tried ? `try ${r.outcome}` : r.outcome);
+    if (r.outcome === "Refused") {
+      bits.push(`${a?.reason ?? ""}${a?.says ? `: ${a.says}` : ""}`.trim());
+      return bits.filter(Boolean).join(" ");
+    }
+    if (a?.status === "Pending" && a.reason) bits.push(a.reason);
+    bits.push(a?.event ?? r.closesOn.event);
+    const d = this.diffText(a);
+    if (d) bits.push(d);
+    if (r.tried) bits.push("(nothing stored; --do runs it)");
+    if (left !== void 0) bits.push(left ? `\xB7 ${left} left` : "\xB7 batch done");
+    return bits.filter(Boolean).join(" ");
+  }
+  /**
+   * `close <ref> [--body]`: invoke the Verb whose Event closes the Task. Inside a claimed batch the default Mode is do
+   * (the claim was the first click) and the lease token acts; elsewhere a try preview with SB_TOKEN or the sign-in.
+   */
+  async close(o) {
+    const noLease = await this.ensureLease();
+    if (noLease) return noLease;
+    const id = this.resolve(o.ref);
+    const lease = this.leases.holding(id);
+    const mode = o.mode ?? (lease ? "do" : "try");
+    const label = this.label(o.ref, id);
+    let token = lease ? this.leaseCred(lease) : await this.baseToken(true);
+    if (!token) return this.none(`${label}: sign in (startup-builder login) or set SB_TOKEN`);
+    const opts = {
+      task: id,
+      mode,
+      as: o.as,
+      force: o.force,
+      idempotencyKey: o.idempotencyKey,
+      prepare: (c) => {
+        const b = checkBody(c.event, o.body);
+        return b.errors.length ? { error: `body: ${b.errors.join("; ")}` } : { input: b.body };
+      }
+    };
+    let r;
+    try {
+      r = await closeTask(this.api(token), opts);
+    } catch (e) {
+      const msg = e.message;
+      if (/ is closed \(/.test(msg)) {
+        if (lease) this.leases.markClosed(lease.batch, id);
+        return { text: `${label} already closed${/\(([^)]*)\)/.exec(msg)?.[1] ? ` (${this.short(/\(([^)]*)\)/.exec(msg)[1])})` : ""}`, data: null, exit: 0 };
+      }
+      if (lease && / answered 409: .*lease/.test(msg)) return { text: `${label}: lease ended, stop (${msg.replaceAll(`${this.base}/`, "")})`, data: null, exit: LEASE_ENDED };
+      return { text: `${label}: ${msg.replaceAll(`${this.base}/`, "")}`, data: null, exit: 1 };
+    }
+    if (r.status === 409 && r.blocked?.code === "lease_ended") {
+      if (lease && lease.held !== "dispatcher") this.leases.remove(lease.batch);
+      return { text: `${label}: lease ended, stop${r.blocked.message ? ` (${r.blocked.message})` : ""}`, data: r, exit: LEASE_ENDED };
+    }
+    if (r.status === 401 && !lease && this.d.login) {
+      token = this.cred(await this.d.login());
+      r = await closeTask(this.api(token), { ...opts, idempotencyKey: r.request.idempotencyKey });
+    }
+    let left;
+    let released;
+    const closedNow = !r.tried && (r.outcome === "Done" || r.outcome === "Replayed" && r.action?.status === "Done") && (closesOf(r.action).includes(id) || r.status === 201);
+    if (lease) {
+      const l = closedNow ? this.leases.markClosed(lease.batch, id) ?? lease : lease;
+      left = l.tasks.filter((t2) => !l.closed.includes(t2)).length;
+      if (closedNow && left === 0) released = await this.release({ batch: l });
+    }
+    const text = this.closeLine(label, r, lease && !r.tried ? left : void 0) + (released?.exit ? `
+${released.text}` : "");
+    const bad = ["Refused", "Blocked", "KeyReused", "Error", "NotSent"].includes(r.outcome);
+    return { text, data: r, exit: bad ? 1 : 0 };
+  }
+  /** the batch's Tasks api.sb shows closed (their page carries `closedOn`, or status Done) */
+  async closedOf(l) {
+    const api = this.api(this.leaseCred(l));
+    const fallback = this.api(await this.baseToken());
+    const out = [];
+    for (const t2 of l.tasks) {
+      let r = await api.get(t2).catch(() => void 0);
+      if (r && (r.status === 401 || r.status === 403)) r = await fallback.get(t2).catch(() => void 0);
+      const th = r?.ok ? thingOf(r.json) : void 0;
+      if (th && (th.closedOn !== void 0 || th.status === "Done")) out.push(t2);
+    }
+    return out;
+  }
+  // ---- the worklist, versions, changes --------------------------------------------------------------------------------
+  worklistText(w) {
+    const lines = [`for:${w.worker.handle} ${w.tasks.length} of ${w.open} open${w.page && w.page > 1 ? ` (page ${w.page})` : ""}`];
+    let n = 0;
+    let head = "";
+    for (const c of w.batch) {
+      const h = `# ${c.startup} ${c.step}`;
+      if (h !== head) lines.push(head = h);
+      for (const t2 of c.tasks) lines.push(this.taskLine(t2, ++n));
+    }
+    if (w.more) lines.push(`${w.more} more: --page ${(w.page ?? 1) + 1}`);
+    return lines.join("\n");
+  }
+  taskLine(t2, n) {
+    const c = t2.closesOn;
+    const flags = [
+      c?.blocked ? `blocked: ${c.blocked}` : "",
+      c?.refused ? `refused: ${c.refused}` : "",
+      c?.approvalNeeded ? "needs Approval" : "",
+      c?.permission && !c.permission.held ? `needs ${Object.keys(c.permission.heldBy ?? {}).join("|") || "a Role"}` : "",
+      t2.overdue ? `${t2.overdue}d overdue` : ""
+    ].filter(Boolean);
+    return `${n} p${t2.priority} ${t2.name}${c ? ` \u2192 ${c.event}` : ""}${flags.length ? ` (${flags.join("; ")})` : ""}`;
+  }
+  async worklist(o) {
+    const w = await buildWorklist(this.api(await this.baseToken()), { worker: o.worker, startups: o.startups ?? [], limit: o.limit, page: o.page });
+    this.leases.remember("worklist", w.tasks.map((t2) => t2.$id));
+    return { text: this.worklistText(w), data: w, exit: 0 };
+  }
+  /** `versions <ref>`: a Thing's versions, newest first */
+  async versions(o) {
+    const bad = await this.ensureLease();
+    if (bad) return bad;
+    const id = this.resolve(o.ref);
+    const r = await this.api(await this.readToken(id)).get(`${id}${id.includes("?") ? "&" : "?"}versions`);
+    if (!r.ok) return this.fail(r, `versions ${this.label(o.ref, id)}`);
+    const vs = r.json?.versions ?? r.json?.items ?? [];
+    if (!Array.isArray(vs) || !vs.length) return { text: `${this.label(o.ref, id)}: no versions`, data: r.json, exit: 0 };
+    const lines = vs.slice(0, o.limit ?? 20).map((v) => {
+      const n = v.version ?? v.n ?? last(v.$id);
+      const who = v.by ? ` ${last(v.by)}` : "";
+      const d = this.diffText({ changes: v.changes ?? v.diff ?? v.changed });
+      return `${/^v/i.test(String(n)) ? n : `v${n}`}${v.current ? "*" : ""} ${this.when(v.at ?? v.createdAt ?? v.since)}${who}${d ? ` ${d}` : v.name ? ` ${v.name}` : ""}`;
+    });
+    return { text: lines.join("\n"), data: r.json, exit: 0 };
+  }
+  /** `revert <ref> --to <v>`: POST <$id>:revert {to}; a try preview unless do */
+  async revert(o) {
+    const id = this.resolve(o.ref);
+    const mode = o.mode ?? "try";
+    const token = await this.baseToken(true);
+    if (!token) return this.none("revert: sign in (startup-builder login) or set SB_TOKEN");
+    const to = o.to.replace(/^v(?=\d)/i, "");
+    const r = await this.api(token).post(`${id}:revert`, { to: /^\d+$/.test(to) ? Number(to) : o.to }, { prefer: `mode=${mode}`, idempotencyKey: o.idempotencyKey });
+    const label = this.label(o.ref, id);
+    if (!r.ok && r.status !== 403) return this.fail(r, `revert ${label}`);
+    const a = r.json?.action ?? r.json ?? {};
+    const status = r.status === 403 ? "Refused" : a.status ?? "Done";
+    const d = this.diffText(a);
+    const tail = r.status === 403 ? `${a.reason ?? ""}${a.says ? `: ${a.says}` : ""}` : d;
+    return { text: `revert ${label} to v${to}: ${mode === "try" ? "try " : ""}${status}${tail ? ` ${tail}` : ""}${mode === "try" && r.ok ? " (nothing stored; --do runs it)" : ""}`, data: r.json, exit: r.ok ? 0 : 1 };
+  }
+  /** `changes [--worker w] [--startup s]`: the feed of recent writes */
+  async changes(o = {}) {
+    const q = new URLSearchParams({ limit: String(o.limit ?? 20) });
+    const w = parseWorker(o.worker);
+    if (w) q.set("worker", w);
+    if (o.startup) q.set("startup", o.startup);
+    const r = await this.api(await this.baseToken()).get(`/versions?${q}`);
+    if (!r.ok) return this.fail(r, "changes");
+    const cs = r.json?.versions ?? r.json?.changes ?? r.json?.items ?? [];
+    if (!cs.length) return { text: "no changes", data: r.json, exit: 0 };
+    const lines = cs.map((c) => {
+      const at = this.when(c.at ?? c.createdAt ?? c.since);
+      const who = c.as ?? c.by ?? c.worker ?? c.author;
+      const what = this.short(c.thing ?? c.object ?? c.to ?? c.$id);
+      const d = this.diffText(c);
+      return [at, who ? last(who) : "", what, d || c.name || "", c.status && !d ? `(${c.status})` : ""].filter(Boolean).join(" ");
+    });
+    return { text: lines.join("\n"), data: r.json, exit: 0 };
+  }
+};
+
+export {
+  Api,
+  DEFAULT_API,
+  apiBase,
+  tokenFile,
+  runnerBase,
+  pkce,
+  unwrapState,
+  Auth,
+  WorklistError,
+  worklistPath,
+  heldByNames,
+  fetchWorklistMarkdown,
+  parseWorker,
+  derivePriority,
+  stepOf,
+  selectBatch,
+  groupBatch,
+  buildWorklist,
+  findClosesOn,
+  closeTask,
+  closesOf,
+  batchText,
+  closeText,
+  renderPrompt,
+  runCloud,
+  collectionOf,
+  verbPath,
+  parseInput,
+  doVerb,
+  VERDICTS,
+  checkBody,
+  parseBody,
+  batchBodyPath,
+  DEFAULT_MODEL,
+  printRunner,
+  agentRunner,
+  configDir,
+  leasesDir,
+  Leases,
+  DEFAULT_WALL_MINUTES,
+  agentEnv,
+  agentPrompt,
+  work,
+  TOOLS,
+  mcpServer,
+  serveStdio,
+  Session
+};