@apilift/cli 1.5.3 → 1.5.4

package/dist/apilift-collector.js

@@ -28013,11 +28013,13 @@ var init_schema = __esm({
     });
     proofPointer = pointerSchema.refine((value) => value.split("/").every((part) => !/\{(?:input|result|generated)\./u.test(part) || /^\{input\.[A-Za-z][A-Za-z0-9_-]*\}$/u.test(part)), "A dynamic JSON Pointer segment must be exactly {input.name}");
     proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: pointerSchema }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
-    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
+    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: external_exports.strictObject({ path: proofPointer.optional(), schema: jsonSchema }).optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
       if (!!v2.equals === !!v2.absent)
         ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
       if (v2.select && v2.absent)
         ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
+      if (v2.response && v2.absent)
+        ctx.addIssue({ code: "custom", path: ["response"], message: "An HTTP-404 absence proof has no response schema" });
       if (!v2.effect && !["GET", "HEAD"].includes(v2.request.method))
         ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
     });

package/dist/apilift-native-host.js

@@ -29459,11 +29459,13 @@ var responseSchema = external_exports.strictObject({ schema: jsonSchema.optional
 });
 var proofPointer = pointerSchema.refine((value) => value.split("/").every((part) => !/\{(?:input|result|generated)\./u.test(part) || /^\{input\.[A-Za-z][A-Za-z0-9_-]*\}$/u.test(part)), "A dynamic JSON Pointer segment must be exactly {input.name}");
 var proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: pointerSchema }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
-var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
+var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: external_exports.strictObject({ path: proofPointer.optional(), schema: jsonSchema }).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
   if (!!v.equals === !!v.absent)
     ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
   if (v.select && v.absent)
     ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
+  if (v.response && v.absent)
+    ctx.addIssue({ code: "custom", path: ["response"], message: "An HTTP-404 absence proof has no response schema" });
   if (!v.effect && !["GET", "HEAD"].includes(v.request.method))
     ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
 });
@@ -29644,7 +29646,7 @@ function validateDefinition(kind, name, value) {
     for (const [i, comparison] of (definition2.proof?.select?.where ?? []).entries())
       if ("input" in comparison && !names2.includes(comparison.input))
         issues.push({ path: `/proof/select/where/${i}/input`, message: "Unknown input" });
-    const proofPaths = [...definition2.proof?.equals ?? [], ...definition2.proof?.select?.where ?? [], ...definition2.proof?.select ? [definition2.proof.select] : []];
+    const proofPaths = [...definition2.proof?.equals ?? [], ...definition2.proof?.select?.where ?? [], ...definition2.proof?.select ? [definition2.proof.select] : [], ...definition2.proof?.response?.path !== void 0 ? [{ path: definition2.proof.response.path }] : []];
     for (const item of proofPaths)
       for (const match of item.path.matchAll(/\{input\.([^{}]+)\}/gu))
         if (!names2.includes(match[1]))

package/dist/apilift.js

@@ -28077,11 +28077,13 @@ var init_schema = __esm({
     });
     proofPointer = pointerSchema.refine((value) => value.split("/").every((part) => !/\{(?:input|result|generated)\./u.test(part) || /^\{input\.[A-Za-z][A-Za-z0-9_-]*\}$/u.test(part)), "A dynamic JSON Pointer segment must be exactly {input.name}");
     proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: pointerSchema }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
-    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
+    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: external_exports.strictObject({ path: proofPointer.optional(), schema: jsonSchema }).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
       if (!!v.equals === !!v.absent)
         ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
       if (v.select && v.absent)
         ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
+      if (v.response && v.absent)
+        ctx.addIssue({ code: "custom", path: ["response"], message: "An HTTP-404 absence proof has no response schema" });
       if (!v.effect && !["GET", "HEAD"].includes(v.request.method))
         ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
     });
@@ -28496,7 +28498,7 @@ function validateDefinition(kind, name, value) {
     for (const [i, comparison] of (definition2.proof?.select?.where ?? []).entries())
       if ("input" in comparison && !names2.includes(comparison.input))
         issues.push({ path: `/proof/select/where/${i}/input`, message: "Unknown input" });
-    const proofPaths = [...definition2.proof?.equals ?? [], ...definition2.proof?.select?.where ?? [], ...definition2.proof?.select ? [definition2.proof.select] : []];
+    const proofPaths = [...definition2.proof?.equals ?? [], ...definition2.proof?.select?.where ?? [], ...definition2.proof?.select ? [definition2.proof.select] : [], ...definition2.proof?.response?.path !== void 0 ? [{ path: definition2.proof.response.path }] : []];
     for (const item of proofPaths)
       for (const match of item.path.matchAll(/\{input\.([^{}]+)\}/gu))
         if (!names2.includes(match[1]))
@@ -28797,346 +28799,10 @@ var init_api2 = __esm({
   }
 });
 
-// src/version.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-var cliVersion;
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-    cliVersion = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
-  }
-});
-
-// src/api.ts
-function retryDelay(response, attempt) {
-  const value = response.headers.get("retry-after");
-  if (value) {
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, 5e3);
-    const date5 = Date.parse(value);
-    if (Number.isFinite(date5)) return Math.min(Math.max(date5 - Date.now(), 0), 5e3);
-  }
-  return 250 * 2 ** attempt;
-}
-function sleep(ms) {
-  return new Promise((resolve10) => setTimeout(resolve10, ms));
-}
-function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
-  const transport = async (input2, init) => {
-    const method = init?.method ?? "GET";
-    const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1");
-    headers.set("Apilift-Client", `cli/${cliVersion}`);
-    if (token) headers.set("Authorization", `Bearer ${token}`);
-    if (sessionId) headers.set("Apilift-Session", sessionId);
-    const path2 = new URL(input2 instanceof Request ? input2.url : String(input2), baseUrl).pathname;
-    const timeoutMs = method === "POST" && path2 === "/api/v1/installations" ? 3e4 : 1e4;
-    for (let attempt = 0; ; attempt++) {
-      try {
-        const response = await fetcher(input2, { ...init, headers, signal: init?.signal ?? AbortSignal.timeout(timeoutMs) });
-        if (method !== "GET" || attempt >= 2 || !retryStatuses.has(response.status)) {
-          if (response.status !== 204 && !response.headers.get("content-type")?.toLowerCase().includes("json")) throw new ApiClientError(response.status, null);
-          if (response.status !== 204) {
-            try {
-              await response.clone().json();
-            } catch {
-              throw new ApiClientError(response.status, null);
-            }
-          }
-          return response;
-        }
-        await sleep(retryDelay(response, attempt));
-      } catch (error62) {
-        if (error62 instanceof ApiClientError) throw error62;
-        if (method !== "GET") throw new ApiDeliveryUncertainError(error62);
-        if (attempt >= 2) throw new ApiReadUnavailableError(error62);
-        await sleep(250 * 2 ** attempt);
-      }
-    }
-  };
-  return createApiClient(baseUrl, transport);
-}
-var retryStatuses, ApiDeliveryUncertainError, ApiReadUnavailableError;
-var init_api3 = __esm({
-  "src/api.ts"() {
-    "use strict";
-    init_version();
-    init_api2();
-    retryStatuses = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
-    ApiDeliveryUncertainError = class extends Error {
-      constructor(cause) {
-        super("The Registry did not confirm whether the mutation was applied");
-        this.cause = cause;
-      }
-    };
-    ApiReadUnavailableError = class extends Error {
-      constructor(cause) {
-        super("The Registry could not be reached after three attempts");
-        this.cause = cause;
-      }
-    };
-  }
-});
-
-// src/commands/registry.ts
-function parseInvocation(argv) {
-  const issues = [];
-  let cursor = 0;
-  let sessionLabel;
-  let version2 = false;
-  while (cursor < argv.length) {
-    const token = argv[cursor];
-    if (token === "--session") {
-      const value = argv[cursor + 1];
-      if (!value || value.startsWith("--")) issues.push("--session needs a worker label");
-      else if (sessionLabel) issues.push("--session may appear only once");
-      else sessionLabel = value;
-      cursor += value && !value.startsWith("--") ? 2 : 1;
-    } else if (token === "--version") {
-      version2 = true;
-      cursor++;
-    } else break;
-  }
-  if (sessionLabel && (sessionLabel.length > 80 || !/^[A-Za-z0-9_-]+$/u.test(sessionLabel))) issues.push("--session must be 1 to 80 letters, digits, hyphens or underscores");
-  const base2 = { sessionLabel, positionals: [], options: {}, flags: [], repeats: {}, actionArgs: [] };
-  if (version2) {
-    if (cursor < argv.length) issues.push("--version takes no command");
-    return { ...issues.length ? {} : { invocation: { key: "version", ...base2 } }, issues };
-  }
-  const remaining = argv.slice(cursor);
-  if (remaining.length === 1 && remaining[0] === "--help") return { invocation: { key: "helpCommands", ...base2 }, issues };
-  const selected = Object.entries(commandRegistry).filter(([, command7]) => command7.path.every((part, index) => remaining[index] === part)).sort((left, right) => right[1].path.length - left[1].path.length)[0];
-  if (!selected) return { issues: [`Unknown command: ${remaining.slice(0, 2).join(" ")}`] };
-  const [key, command6] = selected;
-  const positionals = [];
-  const options2 = {};
-  const flags = [];
-  const repeats = {};
-  const actionArgs = [];
-  for (let index = command6.path.length; index < remaining.length; index++) {
-    const token = remaining[index];
-    if (token.startsWith("--")) {
-      const name = token.slice(2);
-      if (name === "session") {
-        issues.push("--session must appear before the command");
-        continue;
-      }
-      if (command6.values?.includes(name) || command6.repeat?.includes(name)) {
-        const value = remaining[index + 1];
-        if (!value || value.startsWith("--")) {
-          issues.push(`--${name} needs a value`);
-          continue;
-        }
-        if (command6.repeat?.includes(name)) (repeats[name] ??= []).push(value);
-        else if (Object.hasOwn(options2, name)) issues.push(`--${name} may appear only once`);
-        else options2[name] = value;
-        index++;
-      } else if (command6.flags?.includes(name)) {
-        if (flags.includes(name)) issues.push(`--${name} may appear only once`);
-        else flags.push(name);
-      } else if (command6.actionFlags && positionals.length >= 2) actionArgs.push(token);
-      else issues.push(`Unknown option --${name}`);
-    } else if (command6.actionFlags && positionals.length >= 2 && actionArgs.length) actionArgs.push(token);
-    else if (positionals.length < command6.max) positionals.push(token);
-    else issues.push(`Unexpected argument ${token}`);
-  }
-  if (positionals.length < command6.min) issues.push(`${command6.path.join(" ") || "command"} needs ${command6.min} argument${command6.min === 1 ? "" : "s"}`);
-  return { ...issues.length ? {} : { invocation: { key, sessionLabel, positionals, options: options2, flags, repeats, actionArgs } }, issues };
-}
-var commandRegistry;
-var init_registry = __esm({
-  "src/commands/registry.ts"() {
-    "use strict";
-    commandRegistry = {
-      root: { path: [], min: 0, max: 0 },
-      setup: { path: ["setup"], min: 0, max: 0, values: ["code"] },
-      setupContinue: { path: ["setup", "continue"], min: 0, max: 0 },
-      doctor: { path: ["doctor"], min: 0, max: 0, values: ["app"] },
-      update: { path: ["update"], min: 0, max: 0 },
-      helpCommands: { path: ["help", "commands"], min: 0, max: 0 },
-      appsSearch: { path: ["apps", "search"], min: 1, max: 1, values: ["domain", "limit", "cursor"] },
-      appsUse: { path: ["apps", "use"], min: 1, max: 1 },
-      appsRelease: { path: ["apps", "release"], min: 1, max: 1 },
-      appsRefresh: { path: ["apps", "refresh"], min: 1, max: 1, values: ["action"] },
-      appsNew: { path: ["apps", "new"], min: 1, max: 1 },
-      appsUpdate: { path: ["apps", "update"], min: 1, max: 1 },
-      appsHistory: { path: ["apps", "history"], min: 1, max: 1, values: ["resource", "limit", "cursor"] },
-      actionsList: { path: ["actions", "list"], min: 1, max: 1, values: ["entity", "limit", "cursor"], flags: ["all"] },
-      actionsSearch: { path: ["actions", "search"], min: 2, max: 2, values: ["entity", "limit", "cursor"] },
-      actionsShow: { path: ["actions", "show"], min: 2, max: 11, values: ["input-template"], flags: ["schema"] },
-      run: { path: ["run"], min: 2, max: 2, values: ["input", "output"], flags: ["check", "no-context"], repeat: ["select"], actionFlags: true },
-      credentialsList: { path: ["credentials", "list"], min: 1, max: 2 },
-      credentialsUse: { path: ["credentials", "use"], min: 3, max: 3 },
-      credentialsAdd: { path: ["credentials", "add"], min: 2, max: 2 },
-      credentialsRemove: { path: ["credentials", "remove"], min: 3, max: 3 },
-      credentialsUnbound: { path: ["credentials", "unbound"], min: 0, max: 0 },
-      credentialsAttach: { path: ["credentials", "attach"], min: 3, max: 3 },
-      transportsShow: { path: ["transports", "show"], min: 1, max: 2 },
-      browserCheck: { path: ["browser", "check"], min: 1, max: 1 },
-      browserTabs: { path: ["browser", "tabs"], min: 1, max: 1, values: ["select"] },
-      contextSet: { path: ["context", "set"], min: 2, max: 2, values: ["app"] },
-      contextShow: { path: ["context", "show"], min: 0, max: 0, values: ["app"] },
-      contextUnset: { path: ["context", "unset"], min: 1, max: 1, values: ["app"] },
-      contextClear: { path: ["context", "clear"], min: 0, max: 0, values: ["app"] },
-      discoverDraft: { path: ["discover", "draft"], min: 1, max: 2 },
-      discoverCheck: { path: ["discover", "check"], min: 0, max: 0 },
-      discoverRun: { path: ["discover", "run"], min: 0, max: 0, flags: ["proof-only"] },
-      discoverPublish: { path: ["discover", "publish"], min: 0, max: 0 },
-      discoverStatus: { path: ["discover", "status"], min: 0, max: 0 },
-      discoverDefer: { path: ["discover", "defer"], min: 0, max: 0 },
-      discoverDiscard: { path: ["discover", "discard"], min: 0, max: 0 },
-      discoverRebase: { path: ["discover", "rebase"], min: 0, max: 0 },
-      discoverRemove: { path: ["discover", "remove"], min: 2, max: 2 },
-      discoverClose: { path: ["discover", "close"], min: 0, max: 0 },
-      discoverApiAssess: { path: ["discover", "api", "assess"], min: 1, max: 1 },
-      discoverApiSave: { path: ["discover", "api", "save"], min: 0, max: 0 },
-      discoverApiStatus: { path: ["discover", "api", "status"], min: 0, max: 1 },
-      discoverCaptureStart: { path: ["discover", "capture", "start"], min: 0, max: 0 },
-      discoverCaptureStop: { path: ["discover", "capture", "stop"], min: 0, max: 0 },
-      discoverCaptureList: { path: ["discover", "capture", "list"], min: 0, max: 0, values: ["limit", "cursor"] },
-      discoverCaptureShow: { path: ["discover", "capture", "show"], min: 1, max: 1, values: ["part", "pointer"] },
-      discoverCaptureSelect: { path: ["discover", "capture", "select"], min: 1, max: 1 },
-      discoverCaptureAuth: { path: ["discover", "capture", "auth"], min: 1, max: 1 },
-      discoverCaptureCancel: { path: ["discover", "capture", "cancel"], min: 0, max: 0 }
-    };
-  }
-});
-
-// src/session.ts
-import { createHash as createHash2 } from "node:crypto";
-function apiSessionId(installationId, session) {
-  if (!session) return void 0;
-  const hex3 = createHash2("sha256").update("apilift-api-session/v1\0").update(installationId).update("\0").update(session.id).digest("hex");
-  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-5${hex3.slice(13, 16)}-a${hex3.slice(17, 20)}-${hex3.slice(20, 32)}`;
-}
-function agentSession(env, explicitLabel) {
-  explicitLabel ??= env.APILIFT_SESSION;
-  if (explicitLabel !== void 0 && !/^[A-Za-z0-9_-]{1,80}$/u.test(explicitLabel)) return null;
-  const codex = env.CODEX_THREAD_ID || env.CODEX_SESSION_ID;
-  const claude = env.CLAUDE_CODE_SESSION_ID;
-  if (explicitLabel) {
-    const agent2 = claude || env.CLAUDECODE ? "claude" : codex || env.CODEX_HOME ? "codex" : null;
-    return agent2 ? { id: `${agent2}:label:${explicitLabel}`, agent: agent2 } : null;
-  }
-  if (codex && !claude) return { id: `codex:${codex}`, agent: "codex" };
-  if (claude && !codex) return { id: `claude:${claude}`, agent: "claude" };
-  return null;
-}
-function commandPrefix(label2) {
-  return `apilift${label2 ? ` --session ${label2}` : ""}`;
-}
-var init_session = __esm({
-  "src/session.ts"() {
-    "use strict";
-  }
-});
-
-// src/browser-response.ts
-import { createHash as createHash3 } from "node:crypto";
-async function browserResponseBody(client, scopeId, value, maxBytes = 48 * 1024 * 1024) {
-  if (value.bodyArtifact !== void 0) {
-    const artifact = value.bodyArtifact;
-    if (value.body != null || !artifact || typeof artifact.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(artifact.sha256) || !Number.isInteger(artifact.bytes) || Number(artifact.bytes) < 1 || Number(artifact.bytes) > maxBytes || artifact.encoding !== "utf-8") throw new Error("Chrome returned invalid response evidence metadata");
-    const bytes = await client.blob(scopeId, artifact.sha256);
-    if (!bytes || bytes.length !== artifact.bytes || createHash3("sha256").update(bytes).digest("hex") !== artifact.sha256) throw new Error("Chrome response evidence is missing or failed its integrity check");
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }
-  if (value.body == null) return null;
-  if (typeof value.body !== "string" || Buffer.byteLength(value.body, "utf8") > maxBytes) throw new Error("Chrome did not return complete response evidence");
-  return value.body;
-}
-var init_browser_response = __esm({
-  "src/browser-response.ts"() {
-    "use strict";
-  }
-});
-
-// src/timings.ts
-import { appendFileSync } from "node:fs";
-import { resolve } from "node:path";
-function executionTimings() {
-  return { brokerMs: 0, bridgeMs: 0, registryMs: 0, bindingMs: 0, replayMs: 0, appMs: 0, proofMs: 0, reportingMs: 0 };
-}
-async function timed(timings, stage, work) {
-  const started = performance.now();
-  try {
-    return await work();
-  } finally {
-    if (timings) timings[stage] += performance.now() - started;
-  }
-}
-function saveTimings(timings, commandMs) {
-  if (!process.env.APILIFT_TIMING_FILE) return;
-  try {
-    appendFileSync(resolve(process.env.APILIFT_TIMING_FILE), JSON.stringify({ ...Object.fromEntries(Object.entries(timings).map(([key, value]) => [key, Math.round(value * 100) / 100])), commandMs: Math.round(commandMs * 100) / 100 }) + "\n", { mode: 384 });
-  } catch {
-  }
-}
-var init_timings = __esm({
-  "src/timings.ts"() {
-    "use strict";
-  }
-});
-
-// src/files.ts
-import { randomUUID } from "node:crypto";
-import { accessSync, constants, existsSync, statSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname, join as join2, resolve as resolve2 } from "node:path";
-function outputDestination(file2) {
-  const target = resolve2(file2);
-  if (existsSync(target)) {
-    if (!statSync(target).isFile()) throw new Error("Output destination must be a regular file");
-    accessSync(target, constants.W_OK);
-  }
-  const probe = join2(dirname(target), `.apilift-output-check-${randomUUID()}`);
-  try {
-    writeFileSync2(probe, "", { flag: "wx", mode: 384 });
-  } finally {
-    try {
-      unlinkSync(probe);
-    } catch {
-    }
-  }
-  return target;
-}
-var init_files = __esm({
-  "src/files.ts"() {
-    "use strict";
-  }
-});
-
-// src/execution-reports.ts
-async function flushExecutionReports(api, state, budgetMs = 1e4) {
-  const pending = state.pendingExecutionReports();
-  if (!pending.length) return;
-  const controller = new AbortController();
-  let timer;
-  try {
-    const acknowledgment = await Promise.race([
-      api.call("postExecutions", { body: { reports: pending.map((item) => item.report) }, signal: controller.signal }),
-      new Promise((_, reject) => {
-        timer = setTimeout(() => {
-          controller.abort();
-          reject(new Error("Report delivery deferred"));
-        }, budgetMs);
-      })
-    ]);
-    state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
-  } catch {
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var init_execution_reports = __esm({
-  "src/execution-reports.ts"() {
-    "use strict";
-  }
-});
-
 // src/usage/ledger.ts
-import { createHmac, randomBytes, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
+import { createHmac, randomBytes, randomUUID } from "node:crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 function purposeFor(key) {
   return key.startsWith("discover") || key === "appsNew" || key === "appsUpdate" ? "discovery" : key.startsWith("setup") ? "setup" : "unknown";
@@ -29145,7 +28811,7 @@ function countedCommand(key) {
   return !["root", "version", "helpCommands", "appsSearch", "actionsList", "actionsSearch", "actionsShow", "transportsShow", "appsHistory", "contextShow"].includes(key);
 }
 function newInvocationId() {
-  return randomUUID2();
+  return randomUUID();
 }
 var UsageLedger;
 var init_ledger = __esm({
@@ -29155,10 +28821,10 @@ var init_ledger = __esm({
       db;
       root;
       constructor(dataRoot2) {
-        this.root = join3(dataRoot2, "usage");
+        this.root = join2(dataRoot2, "usage");
         mkdirSync3(this.root, { recursive: true, mode: 448 });
         chmodSync2(this.root, 448);
-        const file2 = join3(this.root, "ledger.sqlite");
+        const file2 = join2(this.root, "ledger.sqlite");
         this.db = new DatabaseSync2(file2);
         chmodSync2(file2, 384);
         this.db.exec("PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL");
@@ -29182,8 +28848,8 @@ var init_ledger = __esm({
         return createHmac("sha256", this.secret()).update(JSON.stringify([runtime, nativeId])).digest("hex");
       }
       save(value) {
-        const path2 = join3(this.root, `pending-${value.id}.json`);
-        writeFileSync3(path2, JSON.stringify({ argv: value.argv, stdout: value.stdout, stderr: value.stderr }), { mode: 384, flag: "wx" });
+        const path2 = join2(this.root, `pending-${value.id}.json`);
+        writeFileSync2(path2, JSON.stringify({ argv: value.argv, stdout: value.stdout, stderr: value.stderr }), { mode: 384, flag: "wx" });
         this.db.prepare("INSERT INTO invocation (id,command_key,session_id,agent,started_at,finished_at,duration_ms,argv_json,output_path,purpose,execution_id) VALUES (?,?,?,?,?,?,?,?,?,?,?)").run(value.id, value.commandKey, value.session.id, value.session.agent, value.startedAt, value.finishedAt, value.durationMs, JSON.stringify(value.argv), path2, purposeFor(value.commandKey), value.executionId ?? null);
       }
       attachExecution(invocationId, executionId) {
@@ -29214,7 +28880,7 @@ var init_ledger = __esm({
         this.db.prepare("INSERT INTO usage_meta (key,value) VALUES ('account_id',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(accountId);
       }
       clearForRevocation() {
-        this.clearForAccountChange(`revoked:${randomUUID2()}`);
+        this.clearForAccountChange(`revoked:${randomUUID()}`);
         this.db.prepare("DELETE FROM usage_meta WHERE key='account_id'").run();
       }
       prune() {
@@ -29236,9 +28902,9 @@ var init_ledger = __esm({
 });
 
 // src/usage/baselines.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join4 } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
 function withBaselines(root, work) {
   try {
     const ledger = new UsageLedger(root);
@@ -29275,10 +28941,10 @@ var init_baselines = __esm({
       finishPreparation(sessionId, appSlug, appId, method, at = /* @__PURE__ */ new Date()) {
         const row = this.ledger.db.prepare("SELECT started_at FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").get(sessionId, appSlug);
         if (!row || this.ledger.db.prepare("SELECT 1 FROM baseline_candidate WHERE draft_id=?").get(`preparation:${sessionId}:${appId}:${method}`)) return;
-        this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at) VALUES (?,?,?,?,?,?,?)").run(randomUUID3(), `preparation:${sessionId}:${appId}:${method}`, appId, sessionId, method, row.started_at, at.toISOString());
+        this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at) VALUES (?,?,?,?,?,?,?)").run(randomUUID2(), `preparation:${sessionId}:${appId}:${method}`, appId, sessionId, method, row.started_at, at.toISOString());
       }
       startCapture(draftId, appId, sessionId, at = /* @__PURE__ */ new Date()) {
-        const id2 = randomUUID3();
+        const id2 = randomUUID2();
         this.ledger.db.prepare("UPDATE baseline_candidate SET observation_finished_at=?,observation_reason='next-capture' WHERE session_id=? AND observation_version=1 AND observation_finished_at IS NULL").run(at.toISOString(), sessionId);
         this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,observation_version) VALUES (?,?,?,?,?,?,1)").run(id2, draftId, appId, sessionId, "browser", at.toISOString());
         return id2;
@@ -29293,12 +28959,12 @@ var init_baselines = __esm({
         this.ledger.db.prepare("UPDATE baseline_candidate SET observation_finished_at=?,observation_reason=CASE WHEN stopped_at IS NULL THEN 'cancelled' ELSE 'released' END WHERE draft_id=? AND method='browser' AND observation_version=1 AND observation_finished_at IS NULL").run(at.toISOString(), draftId);
       }
       recordDirect(input2) {
-        const id2 = randomUUID3(), at = input2.at ?? /* @__PURE__ */ new Date();
-        const dir = join4(this.ledger.root, "pending-baselines");
+        const id2 = randomUUID2(), at = input2.at ?? /* @__PURE__ */ new Date();
+        const dir = join3(this.ledger.root, "pending-baselines");
         mkdirSync4(dir, { recursive: true, mode: 448 });
         chmodSync3(dir, 448);
-        const path2 = join4(dir, `${id2}.json`);
-        writeFileSync4(path2, JSON.stringify({ request: input2.request, response: input2.response }), { mode: 384, flag: "wx" });
+        const path2 = join3(dir, `${id2}.json`);
+        writeFileSync3(path2, JSON.stringify({ request: input2.request, response: input2.response }), { mode: 384, flag: "wx" });
         this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at,duration_ms,payload_path,coverage,time_coverage) VALUES (?,?,?,?,?,?,?,?,?,'final','final')").run(id2, input2.draftId, input2.appId, input2.sessionId, "direct", at.toISOString(), at.toISOString(), Math.max(0, Math.round(input2.durationMs)), path2);
         if (input2.invocationId) this.ledger.db.prepare("UPDATE baseline_candidate SET invocation_id=?,http_started_at=?,http_finished_at=? WHERE id=?").run(input2.invocationId, input2.startedAt ?? null, input2.finishedAt ?? null, id2);
         return id2;
@@ -30826,7 +30492,7 @@ function draftTemplate(kind) {
     ""
   ].join("\n") : "";
   const tabGuidance = ["action", "transport"].includes(kind) ? "// capture.tab is a selector returned by browser tabs; it selects the same signed-in Chrome tab for capture and discover run, including connection probes. Leave other sessions' tabs untouched.\n" : "";
-  const captureGuidance = kind === "action" ? '// Public descriptions explain behavior, consequences and limits; do not instruct consumers to repeat runtime proof or browser checks. Author verification is separate from consumer judgment.\n// Request JSON/query uses typed {"$input":"name"} bindings; URL segments use {input.name}. Resolve every {unresolved.N} marker from retained evidence before running.\n// Keep only invariant protocol values constant; selected app values are inputs, even when public. Generalize one action across its supported choices.\n// Before discover run, construct verification.inputs from the consumer contract and published value sources. Use a materially different selection and configuration from the captured or documented example, not just another label. Resolve missing configuration sources first; unexplained JSON is not a substitute.\n// Accept verification.review only when the result confirms that selection and configuration and consumers can obtain the required inputs.\n// A readback through POST requires proof.effect: "read" alongside proof.request; HTTP method alone does not determine semantic effect.\n// JSON object keys may use {input.name}, e.g. {"{input.attribute_id}":{"$input":"value"}}.\n// Discovery-only mutation proof compares a readback path with exactly one input, primary result path or internal JSON value: equals: [{"path":"/ready","value":true}]. Public literals require semantic review; fixed proof expectations are not caller flags.\n// Proof URLs bind returned identifiers with {result./id}; JSON bodies/query use {"$result":"/id"}. Readback pointers may use a complete {input.name} segment for a dynamic key; slashes and tildes in its value are escaped.\n// For one member of a nested list: select: {"path":"/ticket/fields","where":[{"path":"/id","result":"/id"}]}; equals paths then refer to the single matching member. Compare identity and meaningful changed fields, not entire objects.\n// Repair a failed response/proof with discover run --proof-only; it reuses the saved primary response and sends only the readback. Publication still needs a successful test and accepted semantic review.\n// For large collections, investigate native search/filter/detail routes before enumeration. Search saved results locally and inspect only matching records; preserve structured dynamic fields.\n// After selecting a captured request, discover capture auth runs a bounded default search without authField or authScope. Set either only to narrow an observed field or location; browser-managed cookies need no locator.\n' : "";
+  const captureGuidance = kind === "action" ? '// Public descriptions explain behavior, consequences and limits; do not instruct consumers to repeat runtime proof or browser checks. Author verification is separate from consumer judgment.\n// Request JSON/query uses typed {"$input":"name"} bindings; URL segments use {input.name}. Resolve every {unresolved.N} marker from retained evidence before running.\n// App-owned input source annotation: {"x-source":{"action":"ticket.list","path":"/*/id"}}. Run the source explicitly; it never runs implicitly.\n// Keep only invariant protocol values constant; selected app values are inputs, even when public. Generalize one action across its supported choices.\n// Before discover run, construct verification.inputs from the consumer contract and published value sources. Use a materially different selection and configuration from the captured or documented example, not just another label. Resolve missing configuration sources first; unexplained JSON is not a substitute.\n// Accept verification.review only when the result confirms that selection and configuration and consumers can obtain the required inputs.\n// A readback through POST requires proof.effect: "read" alongside proof.request; HTTP method alone does not determine semantic effect.\n// JSON object keys may use {input.name}, e.g. {"{input.attribute_id}":{"$input":"value"}}.\n// Discovery-only mutation proof compares a readback path with exactly one input, primary result path or internal JSON value: equals: [{"path":"/ready","value":true}]. Public literals require semantic review; fixed proof expectations are not caller flags.\n// Proof URLs bind returned identifiers with {result./id}; JSON bodies/query use {"$result":"/id"}. Readback pointers may use a complete {input.name} segment for a dynamic key; slashes and tildes in its value are escaped.\n// For one member of a nested list: select: {"path":"/ticket/fields","where":[{"path":"/id","result":"/id"}]}; equals paths then refer to the single matching member. Compare identity and meaningful changed fields, not entire objects.\n// For valid readback variants, keep identity equals and add proof.response: {path:"/state",schema:{enum:["ready","empty"]}}, relative to the selected member. Exclude pending states; use proof-only reads after completion.\n// Repair a failed response/proof with discover run --proof-only; it reuses the saved primary response and sends only the readback. Publication still needs a successful test and accepted semantic review.\n// For large collections, investigate native search/filter/detail routes before enumeration. Search saved results locally and inspect only matching records; preserve structured dynamic fields.\n// After selecting a captured request, discover capture auth runs a bounded default search without authField or authScope. Set either only to narrow an observed field or location; browser-managed cookies need no locator.\n' : "";
   return `${head}${probeGuidance}${tabGuidance}${captureGuidance}${JSON.stringify(templates[kind], null, 2)}
 `;
 }
@@ -30844,13 +30510,13 @@ var init_envelope = __esm({
 });
 
 // src/discovery/drafts.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync4, renameSync, rmSync as rmSync3, rmdirSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename, dirname as dirname2, join as join5 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { chmodSync as chmodSync4, existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync3, renameSync, rmSync as rmSync3, rmdirSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename, dirname, join as join4 } from "node:path";
 function pathFor(root, appSlug, kind, name) {
   if (!slugPattern.test(appSlug)) throw new Error("App slug is invalid");
   if (kind === "action" ? !actionPattern.test(name) : kind !== "app" && !resourcePattern.test(name)) throw new Error("Resource name is invalid");
-  return kind === "app" ? join5(root, "drafts", diskName(appSlug), "app.jsonc") : join5(root, "drafts", diskName(appSlug), paths[kind], `${diskName(name)}.jsonc`);
+  return kind === "app" ? join4(root, "drafts", diskName(appSlug), "app.jsonc") : join4(root, "drafts", diskName(appSlug), paths[kind], `${diskName(name)}.jsonc`);
 }
 function record2(row) {
   return { id: String(row.id), appSlug: String(row.app_slug), appId: row.app_id === null ? null : String(row.app_id), kind: String(row.kind), name: String(row.name), ownerSessionId: row.owner_session_id === null ? null : String(row.owner_session_id), filePath: String(row.file_path), intent: row.intent === "remove" ? "remove" : "edit", baseVersion: row.base_version === null ? null : Number(row.base_version) };
@@ -30917,12 +30583,12 @@ var init_drafts = __esm({
           }
           const previousSessions = this.state.db.prepare("SELECT session_id FROM discovery_session WHERE app_slug=? AND app_id IS NOT ?").all(appSlug, appId);
           const changed = stale.length > 0 || previousSessions.length > 0;
-          const archivedDrafts = changed ? join5(this.root, "retired-drafts", randomUUID4()) : void 0;
+          const archivedDrafts = changed ? join4(this.root, "retired-drafts", randomUUID3()) : void 0;
           if (archivedDrafts) mkdirSync5(archivedDrafts, { recursive: true, mode: 448 });
           for (const draft of stale) {
-            if (existsSync2(draft.filePath)) {
-              const archived = join5(archivedDrafts, paths[draft.kind], basename(draft.filePath));
-              mkdirSync5(dirname2(archived), { recursive: true, mode: 448 });
+            if (existsSync(draft.filePath)) {
+              const archived = join4(archivedDrafts, paths[draft.kind], basename(draft.filePath));
+              mkdirSync5(dirname(archived), { recursive: true, mode: 448 });
               renameSync(draft.filePath, archived);
               moved.push({ from: draft.filePath, to: archived });
             }
@@ -30933,9 +30599,9 @@ var init_drafts = __esm({
           }
           if (changed && this.hasTable("discovery_research")) {
             const research = this.state.db.prepare("SELECT file_path FROM discovery_research WHERE app_slug=?").all(appSlug);
-            for (const row of research) if (existsSync2(row.file_path)) {
-              const archived = join5(archivedDrafts, "api", basename(row.file_path));
-              mkdirSync5(dirname2(archived), { recursive: true, mode: 448 });
+            for (const row of research) if (existsSync(row.file_path)) {
+              const archived = join4(archivedDrafts, "api", basename(row.file_path));
+              mkdirSync5(dirname(archived), { recursive: true, mode: 448 });
               renameSync(row.file_path, archived);
               moved.push({ from: row.file_path, to: archived });
             }
@@ -30998,7 +30664,7 @@ var init_drafts = __esm({
         const serialized = JSON.stringify(body);
         const existing = this.publication(draftId);
         if (existing) return existing;
-        const intent = { requestId: randomUUID4(), requestBody: serialized };
+        const intent = { requestId: randomUUID3(), requestBody: serialized };
         this.state.db.prepare("INSERT INTO discovery_publication (draft_id,request_id,request_body) VALUES (?,?,?)").run(draftId, intent.requestId, serialized);
         return intent;
       }
@@ -31035,9 +30701,9 @@ var init_drafts = __esm({
         this.state.db.prepare("INSERT INTO discovery_request_attempt (draft_id,fingerprint,state,response_path,response_digest) VALUES (?,?,?,?,?) ON CONFLICT(draft_id,fingerprint) DO UPDATE SET state=excluded.state,response_path=CASE WHEN excluded.state='possibly-dispatched' AND excluded.response_path IS NULL THEN NULL ELSE COALESCE(excluded.response_path,discovery_request_attempt.response_path) END,response_digest=CASE WHEN excluded.state='possibly-dispatched' AND excluded.response_path IS NULL THEN NULL ELSE COALESCE(excluded.response_digest,discovery_request_attempt.response_digest) END").run(draftId, fingerprint2, state, responsePath ?? null, responseDigest ?? null);
       }
       artifactPath(draftId, name) {
-        const directory = join5(this.root, "draft-evidence", draftId, randomUUID4());
+        const directory = join4(this.root, "draft-evidence", draftId, randomUUID3());
         mkdirSync5(directory, { recursive: true, mode: 448 });
-        return join5(directory, name);
+        return join4(directory, name);
       }
       finished(sessionId) {
         const row = this.state.db.prepare("SELECT result_json FROM discovery_finished WHERE session_id=?").get(sessionId);
@@ -31048,7 +30714,7 @@ var init_drafts = __esm({
         if (!draft) return null;
         if (publishedResult === void 0 && this.publication(draft.id)) throw new DraftConflict("selected-draft", "A publication request may have been sent; reconcile it before discarding this draft");
         withBaselines(this.root, (baselines) => baselines.closeObservation(draft.id, "released"));
-        const paths2 = [draft.filePath, `${draft.filePath}.current.json`, join5(this.root, "draft-evidence", draft.id)];
+        const paths2 = [draft.filePath, `${draft.filePath}.current.json`, join4(this.root, "draft-evidence", draft.id)];
         const evidence = this.evidence(draft.id);
         if (evidence) paths2.push(evidence.resultPath);
         if (this.hasTable("discovery_request_attempt")) for (const row of this.state.db.prepare("SELECT response_path FROM discovery_request_attempt WHERE draft_id=? AND response_path IS NOT NULL").all(draft.id)) paths2.push(row.response_path);
@@ -31079,12 +30745,12 @@ var init_drafts = __esm({
       async cleanup(closeScope) {
         for (const row of this.state.db.prepare("SELECT * FROM discovery_cleanup").all()) {
           for (const path2 of new Set(JSON.parse(row.paths_json))) {
-            rmSync3(path2, { force: true, recursive: path2 === join5(this.root, "draft-evidence", row.draft_id) });
-            let parent = dirname2(path2);
-            while (parent !== this.root && parent.startsWith(`${join5(this.root, "drafts")}/`)) {
+            rmSync3(path2, { force: true, recursive: path2 === join4(this.root, "draft-evidence", row.draft_id) });
+            let parent = dirname(path2);
+            while (parent !== this.root && parent.startsWith(`${join4(this.root, "drafts")}/`)) {
               try {
                 rmdirSync(parent);
-                parent = dirname2(parent);
+                parent = dirname(parent);
               } catch {
                 break;
               }
@@ -31110,13 +30776,13 @@ var init_drafts = __esm({
           if (existing?.owner_session_id && existing.owner_session_id !== input2.sessionId) throw new DraftConflict("owned-draft", `${input2.kind} ${name} is owned by another agent session; its file was preserved`);
           if (existing && existing.app_id !== (input2.appId ?? null)) throw new DraftConflict("selected-draft", "The retained draft belongs to a different app; reopen the app from its current registry identity before editing");
           if (existing) filePath = String(existing.file_path);
-          const id2 = existing ? String(existing.id) : randomUUID4();
+          const id2 = existing ? String(existing.id) : randomUUID3();
           if (!existing) this.state.db.prepare("INSERT INTO discovery_draft (id,app_slug,app_id,kind,name,owner_session_id,file_path,base_version) VALUES (?,?,?,?,?,?,?,?)").run(id2, input2.appSlug, input2.appId ?? null, input2.kind, name, input2.sessionId, filePath, input2.baseVersion ?? null);
           else this.state.db.prepare("UPDATE discovery_draft SET owner_session_id=? WHERE id=?").run(input2.sessionId, id2);
           this.state.db.prepare("DELETE FROM discovery_deferred WHERE draft_id=?").run(id2);
           this.state.db.prepare("INSERT INTO selected_discovery_draft (session_id,draft_id) VALUES (?,?) ON CONFLICT(session_id) DO UPDATE SET draft_id=excluded.draft_id").run(input2.sessionId, id2);
-          mkdirSync5(dirname2(filePath), { recursive: true, mode: 448 });
-          if (!existsSync2(filePath) && existing?.intent !== "remove") writeFileSync5(filePath, draftTemplate(input2.kind), { flag: "wx", mode: 384 });
+          mkdirSync5(dirname(filePath), { recursive: true, mode: 448 });
+          if (!existsSync(filePath) && existing?.intent !== "remove") writeFileSync4(filePath, draftTemplate(input2.kind), { flag: "wx", mode: 384 });
           chmodSync4(filePath, 384);
           const result3 = this.selected(input2.sessionId);
           this.state.db.exec("COMMIT");
@@ -31142,11 +30808,11 @@ var init_drafts = __esm({
             this.state.db.exec("COMMIT");
             return this.selected(input2.sessionId);
           }
-          const id2 = randomUUID4();
+          const id2 = randomUUID3();
           this.state.db.prepare("INSERT INTO discovery_draft (id,app_slug,app_id,kind,name,owner_session_id,file_path,base_version,intent) VALUES (?,?,?,?,?,?,?,?,'remove')").run(id2, input2.appSlug, input2.appId, input2.kind, input2.name, input2.sessionId, filePath, input2.baseVersion);
           this.state.db.prepare("INSERT INTO selected_discovery_draft (session_id,draft_id) VALUES (?,?)").run(input2.sessionId, id2);
-          mkdirSync5(dirname2(filePath), { recursive: true, mode: 448 });
-          writeFileSync5(filePath, `// Publish to remove this resource. No records inside the app are changed.
+          mkdirSync5(dirname(filePath), { recursive: true, mode: 448 });
+          writeFileSync4(filePath, `// Publish to remove this resource. No records inside the app are changed.
 ${JSON.stringify({ remove: true, expectedVersion: input2.baseVersion }, null, 2)}
 `, { flag: "wx", mode: 384 });
           this.state.db.exec("COMMIT");
@@ -31156,31 +30822,367 @@ ${JSON.stringify({ remove: true, expectedVersion: input2.baseVersion }, null, 2)
           throw error62;
         }
       }
-      defer(sessionId) {
-        this.state.db.exec("BEGIN IMMEDIATE");
-        try {
-          const draft = this.selected(sessionId);
-          if (draft) {
-            withBaselines(this.root, (baselines) => baselines.closeObservation(draft.id, "released"));
-            this.state.db.prepare("INSERT INTO discovery_deferred (draft_id,session_id) VALUES (?,?) ON CONFLICT(draft_id) DO UPDATE SET session_id=excluded.session_id").run(draft.id, sessionId);
-            this.state.db.prepare("DELETE FROM selected_discovery_draft WHERE session_id=?").run(sessionId);
-            this.state.db.prepare("UPDATE discovery_draft SET owner_session_id=NULL WHERE id=? AND owner_session_id=?").run(draft.id, sessionId);
-          }
-          this.state.db.exec("COMMIT");
-          return draft;
-        } catch (error62) {
-          this.state.db.exec("ROLLBACK");
-          throw error62;
+      defer(sessionId) {
+        this.state.db.exec("BEGIN IMMEDIATE");
+        try {
+          const draft = this.selected(sessionId);
+          if (draft) {
+            withBaselines(this.root, (baselines) => baselines.closeObservation(draft.id, "released"));
+            this.state.db.prepare("INSERT INTO discovery_deferred (draft_id,session_id) VALUES (?,?) ON CONFLICT(draft_id) DO UPDATE SET session_id=excluded.session_id").run(draft.id, sessionId);
+            this.state.db.prepare("DELETE FROM selected_discovery_draft WHERE session_id=?").run(sessionId);
+            this.state.db.prepare("UPDATE discovery_draft SET owner_session_id=NULL WHERE id=? AND owner_session_id=?").run(draft.id, sessionId);
+          }
+          this.state.db.exec("COMMIT");
+          return draft;
+        } catch (error62) {
+          this.state.db.exec("ROLLBACK");
+          throw error62;
+        }
+      }
+      readSelected(sessionId) {
+        const draft = this.selected(sessionId);
+        return draft ? { draft, source: readFileSync3(draft.filePath, "utf8") } : null;
+      }
+    };
+  }
+});
+
+// src/version.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+var cliVersion;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    cliVersion = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+  }
+});
+
+// src/api.ts
+function retryDelay(response, attempt) {
+  const value = response.headers.get("retry-after");
+  if (value) {
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, 5e3);
+    const date5 = Date.parse(value);
+    if (Number.isFinite(date5)) return Math.min(Math.max(date5 - Date.now(), 0), 5e3);
+  }
+  return 250 * 2 ** attempt;
+}
+function sleep(ms) {
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
+}
+function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
+  const transport = async (input2, init) => {
+    const method = init?.method ?? "GET";
+    const headers = new Headers(init?.headers);
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1");
+    headers.set("Apilift-Client", `cli/${cliVersion}`);
+    if (token) headers.set("Authorization", `Bearer ${token}`);
+    if (sessionId) headers.set("Apilift-Session", sessionId);
+    const path2 = new URL(input2 instanceof Request ? input2.url : String(input2), baseUrl).pathname;
+    const timeoutMs = method === "POST" && path2 === "/api/v1/installations" ? 3e4 : 1e4;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const response = await fetcher(input2, { ...init, headers, signal: init?.signal ?? AbortSignal.timeout(timeoutMs) });
+        if (method !== "GET" || attempt >= 2 || !retryStatuses.has(response.status)) {
+          if (response.status !== 204 && !response.headers.get("content-type")?.toLowerCase().includes("json")) throw new ApiClientError(response.status, null);
+          if (response.status !== 204) {
+            try {
+              await response.clone().json();
+            } catch {
+              throw new ApiClientError(response.status, null);
+            }
+          }
+          return response;
+        }
+        await sleep(retryDelay(response, attempt));
+      } catch (error62) {
+        if (error62 instanceof ApiClientError) throw error62;
+        if (method !== "GET") throw new ApiDeliveryUncertainError(error62);
+        if (attempt >= 2) throw new ApiReadUnavailableError(error62);
+        await sleep(250 * 2 ** attempt);
+      }
+    }
+  };
+  return createApiClient(baseUrl, transport);
+}
+var retryStatuses, ApiDeliveryUncertainError, ApiReadUnavailableError;
+var init_api3 = __esm({
+  "src/api.ts"() {
+    "use strict";
+    init_version();
+    init_api2();
+    retryStatuses = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
+    ApiDeliveryUncertainError = class extends Error {
+      constructor(cause) {
+        super("The Registry did not confirm whether the mutation was applied");
+        this.cause = cause;
+      }
+    };
+    ApiReadUnavailableError = class extends Error {
+      constructor(cause) {
+        super("The Registry could not be reached after three attempts");
+        this.cause = cause;
+      }
+    };
+  }
+});
+
+// src/commands/registry.ts
+function parseInvocation(argv) {
+  const issues = [];
+  let cursor = 0;
+  let sessionLabel;
+  let version2 = false;
+  while (cursor < argv.length) {
+    const token = argv[cursor];
+    if (token === "--session") {
+      const value = argv[cursor + 1];
+      if (!value || value.startsWith("--")) issues.push("--session needs a worker label");
+      else if (sessionLabel) issues.push("--session may appear only once");
+      else sessionLabel = value;
+      cursor += value && !value.startsWith("--") ? 2 : 1;
+    } else if (token === "--version") {
+      version2 = true;
+      cursor++;
+    } else break;
+  }
+  if (sessionLabel && (sessionLabel.length > 80 || !/^[A-Za-z0-9_-]+$/u.test(sessionLabel))) issues.push("--session must be 1 to 80 letters, digits, hyphens or underscores");
+  const base2 = { sessionLabel, positionals: [], options: {}, flags: [], repeats: {}, actionArgs: [] };
+  if (version2) {
+    if (cursor < argv.length) issues.push("--version takes no command");
+    return { ...issues.length ? {} : { invocation: { key: "version", ...base2 } }, issues };
+  }
+  const remaining = argv.slice(cursor);
+  if (remaining.length === 1 && remaining[0] === "--help") return { invocation: { key: "helpCommands", ...base2 }, issues };
+  const selected = Object.entries(commandRegistry).filter(([, command7]) => command7.path.every((part, index) => remaining[index] === part)).sort((left, right) => right[1].path.length - left[1].path.length)[0];
+  if (!selected) return { issues: [`Unknown command: ${remaining.slice(0, 2).join(" ")}`] };
+  const [key, command6] = selected;
+  const positionals = [];
+  const options2 = {};
+  const flags = [];
+  const repeats = {};
+  const actionArgs = [];
+  for (let index = command6.path.length; index < remaining.length; index++) {
+    const token = remaining[index];
+    if (token.startsWith("--")) {
+      const name = token.slice(2);
+      if (name === "session") {
+        issues.push("--session must appear before the command");
+        continue;
+      }
+      if (command6.values?.includes(name) || command6.repeat?.includes(name)) {
+        const value = remaining[index + 1];
+        if (!value || value.startsWith("--")) {
+          issues.push(`--${name} needs a value`);
+          continue;
         }
-      }
-      readSelected(sessionId) {
-        const draft = this.selected(sessionId);
-        return draft ? { draft, source: readFileSync4(draft.filePath, "utf8") } : null;
-      }
+        if (command6.repeat?.includes(name)) (repeats[name] ??= []).push(value);
+        else if (Object.hasOwn(options2, name)) issues.push(`--${name} may appear only once`);
+        else options2[name] = value;
+        index++;
+      } else if (command6.flags?.includes(name)) {
+        if (flags.includes(name)) issues.push(`--${name} may appear only once`);
+        else flags.push(name);
+      } else if (command6.actionFlags && positionals.length >= 2) actionArgs.push(token);
+      else issues.push(`Unknown option --${name}`);
+    } else if (command6.actionFlags && positionals.length >= 2 && actionArgs.length) actionArgs.push(token);
+    else if (positionals.length < command6.max) positionals.push(token);
+    else issues.push(`Unexpected argument ${token}`);
+  }
+  if (positionals.length < command6.min) issues.push(`${command6.path.join(" ") || "command"} needs ${command6.min} argument${command6.min === 1 ? "" : "s"}`);
+  return { ...issues.length ? {} : { invocation: { key, sessionLabel, positionals, options: options2, flags, repeats, actionArgs } }, issues };
+}
+var commandRegistry;
+var init_registry = __esm({
+  "src/commands/registry.ts"() {
+    "use strict";
+    commandRegistry = {
+      root: { path: [], min: 0, max: 0 },
+      setup: { path: ["setup"], min: 0, max: 0, values: ["code"] },
+      setupContinue: { path: ["setup", "continue"], min: 0, max: 0 },
+      doctor: { path: ["doctor"], min: 0, max: 0, values: ["app"] },
+      update: { path: ["update"], min: 0, max: 0 },
+      helpCommands: { path: ["help", "commands"], min: 0, max: 0 },
+      appsSearch: { path: ["apps", "search"], min: 1, max: 1, values: ["domain", "limit", "cursor"] },
+      appsUse: { path: ["apps", "use"], min: 1, max: 1 },
+      appsRelease: { path: ["apps", "release"], min: 1, max: 1 },
+      appsRefresh: { path: ["apps", "refresh"], min: 1, max: 1, values: ["action"] },
+      appsNew: { path: ["apps", "new"], min: 1, max: 1 },
+      appsUpdate: { path: ["apps", "update"], min: 1, max: 1 },
+      appsHistory: { path: ["apps", "history"], min: 1, max: 1, values: ["resource", "limit", "cursor"] },
+      actionsList: { path: ["actions", "list"], min: 1, max: 1, values: ["entity", "limit", "cursor"], flags: ["all"] },
+      actionsSearch: { path: ["actions", "search"], min: 2, max: 2, values: ["entity", "limit", "cursor"] },
+      actionsShow: { path: ["actions", "show"], min: 2, max: 11, values: ["input-template"], flags: ["schema"] },
+      run: { path: ["run"], min: 2, max: 2, values: ["input", "output"], flags: ["check", "no-context"], repeat: ["select"], actionFlags: true },
+      credentialsList: { path: ["credentials", "list"], min: 1, max: 2 },
+      credentialsUse: { path: ["credentials", "use"], min: 3, max: 3 },
+      credentialsAdd: { path: ["credentials", "add"], min: 2, max: 2 },
+      credentialsRemove: { path: ["credentials", "remove"], min: 3, max: 3 },
+      credentialsUnbound: { path: ["credentials", "unbound"], min: 0, max: 0 },
+      credentialsAttach: { path: ["credentials", "attach"], min: 3, max: 3 },
+      transportsShow: { path: ["transports", "show"], min: 1, max: 2 },
+      browserCheck: { path: ["browser", "check"], min: 1, max: 1 },
+      browserTabs: { path: ["browser", "tabs"], min: 1, max: 1, values: ["select"] },
+      contextSet: { path: ["context", "set"], min: 2, max: 2, values: ["app"] },
+      contextShow: { path: ["context", "show"], min: 0, max: 0, values: ["app"] },
+      contextUnset: { path: ["context", "unset"], min: 1, max: 1, values: ["app"] },
+      contextClear: { path: ["context", "clear"], min: 0, max: 0, values: ["app"] },
+      discoverDraft: { path: ["discover", "draft"], min: 1, max: 2 },
+      discoverCheck: { path: ["discover", "check"], min: 0, max: 0 },
+      discoverRun: { path: ["discover", "run"], min: 0, max: 0, flags: ["proof-only"] },
+      discoverPublish: { path: ["discover", "publish"], min: 0, max: 0 },
+      discoverStatus: { path: ["discover", "status"], min: 0, max: 0 },
+      discoverDefer: { path: ["discover", "defer"], min: 0, max: 0 },
+      discoverDiscard: { path: ["discover", "discard"], min: 0, max: 0 },
+      discoverRebase: { path: ["discover", "rebase"], min: 0, max: 0 },
+      discoverRemove: { path: ["discover", "remove"], min: 2, max: 2 },
+      discoverClose: { path: ["discover", "close"], min: 0, max: 0 },
+      discoverApiAssess: { path: ["discover", "api", "assess"], min: 1, max: 1 },
+      discoverApiSave: { path: ["discover", "api", "save"], min: 0, max: 0 },
+      discoverApiStatus: { path: ["discover", "api", "status"], min: 0, max: 1 },
+      discoverCaptureStart: { path: ["discover", "capture", "start"], min: 0, max: 0 },
+      discoverCaptureStop: { path: ["discover", "capture", "stop"], min: 0, max: 0 },
+      discoverCaptureList: { path: ["discover", "capture", "list"], min: 0, max: 0, values: ["limit", "cursor"] },
+      discoverCaptureShow: { path: ["discover", "capture", "show"], min: 1, max: 1, values: ["part", "pointer"] },
+      discoverCaptureSelect: { path: ["discover", "capture", "select"], min: 1, max: 1 },
+      discoverCaptureAuth: { path: ["discover", "capture", "auth"], min: 1, max: 1 },
+      discoverCaptureCancel: { path: ["discover", "capture", "cancel"], min: 0, max: 0 }
     };
   }
 });
 
+// src/session.ts
+import { createHash as createHash2 } from "node:crypto";
+function apiSessionId(installationId, session) {
+  if (!session) return void 0;
+  const hex3 = createHash2("sha256").update("apilift-api-session/v1\0").update(installationId).update("\0").update(session.id).digest("hex");
+  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-5${hex3.slice(13, 16)}-a${hex3.slice(17, 20)}-${hex3.slice(20, 32)}`;
+}
+function agentSession(env, explicitLabel) {
+  explicitLabel ??= env.APILIFT_SESSION;
+  if (explicitLabel !== void 0 && !/^[A-Za-z0-9_-]{1,80}$/u.test(explicitLabel)) return null;
+  const codex = env.CODEX_THREAD_ID || env.CODEX_SESSION_ID;
+  const claude = env.CLAUDE_CODE_SESSION_ID;
+  if (explicitLabel) {
+    const agent2 = claude || env.CLAUDECODE ? "claude" : codex || env.CODEX_HOME ? "codex" : null;
+    return agent2 ? { id: `${agent2}:label:${explicitLabel}`, agent: agent2 } : null;
+  }
+  if (codex && !claude) return { id: `codex:${codex}`, agent: "codex" };
+  if (claude && !codex) return { id: `claude:${claude}`, agent: "claude" };
+  return null;
+}
+function commandPrefix(label2) {
+  return `apilift${label2 ? ` --session ${label2}` : ""}`;
+}
+var init_session = __esm({
+  "src/session.ts"() {
+    "use strict";
+  }
+});
+
+// src/browser-response.ts
+import { createHash as createHash3 } from "node:crypto";
+async function browserResponseBody(client, scopeId, value, maxBytes = 48 * 1024 * 1024) {
+  if (value.bodyArtifact !== void 0) {
+    const artifact = value.bodyArtifact;
+    if (value.body != null || !artifact || typeof artifact.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(artifact.sha256) || !Number.isInteger(artifact.bytes) || Number(artifact.bytes) < 1 || Number(artifact.bytes) > maxBytes || artifact.encoding !== "utf-8") throw new Error("Chrome returned invalid response evidence metadata");
+    const bytes = await client.blob(scopeId, artifact.sha256);
+    if (!bytes || bytes.length !== artifact.bytes || createHash3("sha256").update(bytes).digest("hex") !== artifact.sha256) throw new Error("Chrome response evidence is missing or failed its integrity check");
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  }
+  if (value.body == null) return null;
+  if (typeof value.body !== "string" || Buffer.byteLength(value.body, "utf8") > maxBytes) throw new Error("Chrome did not return complete response evidence");
+  return value.body;
+}
+var init_browser_response = __esm({
+  "src/browser-response.ts"() {
+    "use strict";
+  }
+});
+
+// src/timings.ts
+import { appendFileSync } from "node:fs";
+import { resolve } from "node:path";
+function executionTimings() {
+  return { brokerMs: 0, bridgeMs: 0, registryMs: 0, bindingMs: 0, replayMs: 0, appMs: 0, proofMs: 0, reportingMs: 0 };
+}
+async function timed(timings, stage, work) {
+  const started = performance.now();
+  try {
+    return await work();
+  } finally {
+    if (timings) timings[stage] += performance.now() - started;
+  }
+}
+function saveTimings(timings, commandMs) {
+  if (!process.env.APILIFT_TIMING_FILE) return;
+  try {
+    appendFileSync(resolve(process.env.APILIFT_TIMING_FILE), JSON.stringify({ ...Object.fromEntries(Object.entries(timings).map(([key, value]) => [key, Math.round(value * 100) / 100])), commandMs: Math.round(commandMs * 100) / 100 }) + "\n", { mode: 384 });
+  } catch {
+  }
+}
+var init_timings = __esm({
+  "src/timings.ts"() {
+    "use strict";
+  }
+});
+
+// src/files.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { accessSync, constants, existsSync as existsSync2, statSync, unlinkSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname2, join as join5, resolve as resolve2 } from "node:path";
+function outputDestination(file2) {
+  const target = resolve2(file2);
+  if (existsSync2(target)) {
+    if (!statSync(target).isFile()) throw new Error("Output destination must be a regular file");
+    accessSync(target, constants.W_OK);
+  }
+  const probe = join5(dirname2(target), `.apilift-output-check-${randomUUID4()}`);
+  try {
+    writeFileSync5(probe, "", { flag: "wx", mode: 384 });
+  } finally {
+    try {
+      unlinkSync(probe);
+    } catch {
+    }
+  }
+  return target;
+}
+var init_files = __esm({
+  "src/files.ts"() {
+    "use strict";
+  }
+});
+
+// src/execution-reports.ts
+async function flushExecutionReports(api, state, budgetMs = 1e4) {
+  const pending = state.pendingExecutionReports();
+  if (!pending.length) return;
+  const controller = new AbortController();
+  let timer;
+  try {
+    const acknowledgment = await Promise.race([
+      api.call("postExecutions", { body: { reports: pending.map((item) => item.report) }, signal: controller.signal }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new Error("Report delivery deferred"));
+        }, budgetMs);
+      })
+    ]);
+    state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var init_execution_reports = __esm({
+  "src/execution-reports.ts"() {
+    "use strict";
+  }
+});
+
 // src/discovery/credential-draft.ts
 import { createHash as createHash4 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -32908,6 +32910,11 @@ function confirmProof(proof, body, primary, inputs, status) {
   for (const comparison of proof.equals ?? []) {
     if (!matches(comparison, selected)) throw new ResponseContractFailure(`Readback comparison failed at ${comparison.path || "/"}`);
   }
+  if (proof.response) {
+    const value = proof.response.path !== void 0 ? pointer2(selected, proofPath(proof.response.path, inputs)) : selected;
+    const validate2 = ajv3.compile(proof.response.schema);
+    if (!validate2(value)) throw new ResponseContractFailure(`Readback response contract mismatch: ${ajv3.errorsText(validate2.errors, { dataVar: "readback" })}`);
+  }
 }
 async function handleRun(invocation, api, state, session, fetcher, root, stdin = () => readFileSync7(0, "utf8"), onReport) {
   const [appName, actionName] = invocation.positionals;
@@ -33152,7 +33159,7 @@ async function executeDraftVerification(input2) {
   const generated = input2.primaryEvidence?.generated ?? (input2.kind === "action" && action && "generated" in action ? Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID7()}`])) : {});
   try {
     values = effectiveInputs(schema, input2.primaryEvidence?.inputs ?? input2.sampleInputs, {}, true).values;
-    if (action && "proof" in action && action.proof) for (const item of [...action.proof.equals ?? [], ...action.proof.select?.where ?? [], ...action.proof.select ? [action.proof.select] : []]) proofPath(item.path, values);
+    if (action && "proof" in action && action.proof) for (const item of [...action.proof.equals ?? [], ...action.proof.select?.where ?? [], ...action.proof.select ? [action.proof.select] : [], ...action.proof.response?.path !== void 0 ? [{ path: action.proof.response.path }] : []]) proofPath(item.path, values);
     const request2 = input2.kind === "action" ? action.request : probe.request;
     prepared = prepareRequest(request2, input2.kind === "transport" && input2.probeOrigin ? { ...transport, baseUrl: input2.probeOrigin } : transport, values, generated);
   } catch (error62) {
@@ -34245,7 +34252,7 @@ Publish removal: ${command4(invocation, "discover publish")}
 Abandon removal: ${command4(invocation, "discover discard")}
 `);
 }
-function draftGuidance(invocation, draft, unavailable = false) {
+function draftGuidance(invocation, draft, unavailable = false, resumed = false) {
   if (draft.intent === "remove") return `Selected the retained removal of ${label(draft.kind)} ${draft.name}. Nothing has been removed.
 Review: ${draft.filePath}
 Check dependencies: ${command4(invocation, "discover check")}
@@ -34259,6 +34266,10 @@ Recover this file: ${command4(invocation, "discover status")}
 Keep for later (including evidence): ${command4(invocation, "discover defer")}
 Abandon unpublished edits: ${command4(invocation, "discover discard")}
 `;
+  if (resumed) return `Resumed ${prefix}. Existing edits and evidence were retained.
+Edit: ${draft.filePath}
+
+${local}`;
   if (draft.kind === "app") return `Created an app draft for ${draft.appSlug}. Nothing has been published.
 Edit: ${draft.filePath}
 
@@ -34322,6 +34333,7 @@ Create or edit it with ${command4(invocation, "discover draft action <entity.ver
 File: ${selected.filePath}
 `, 12);
   const resource = current.appId ? await currentResource(api, current.appId, kind, name ?? "app") : null;
+  const resumed = store.retained(current.appSlug).some((item) => item.kind === kind && item.name === (name ?? "app") && existsSync4(item.filePath));
   const draft = store.open({ appSlug: current.appSlug, appId: current.appId ?? void 0, kind, name, sessionId: session.id, baseVersion: resource?.version });
   if (draft.intent === "remove" && store.publication(draft.id)) return fail5(`A removal publication may have been sent. Reconcile its retained request with ${command4(invocation, "discover publish")} before changing, deferring or discarding it.
 File: ${draft.filePath}
@@ -34334,7 +34346,7 @@ File: ${draft.filePath}
 `, { mode: 384 });
   }
   void root;
-  return ok4(draftGuidance(invocation, draft, Boolean(parseDraftEnvelope(readFileSync8(draft.filePath, "utf8")).envelope?.definition.unavailable)));
+  return ok4(draftGuidance(invocation, draft, Boolean(parseDraftEnvelope(readFileSync8(draft.filePath, "utf8")).envelope?.definition.unavailable), resumed));
 }
 function requireDiscovery(store, session, invocation) {
   const current = store.session(session.id);
@@ -35502,7 +35514,7 @@ async function finalizeOutput(output2, sink, directory = tmpdir2()) {
   const size = () => Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
   try {
     if (size() > displayBudget) {
-      const root = await mkdtemp(join13(directory, "apilift-output-"));
+      const root = await mkdtemp(join13(output2.outputDirectory ?? directory, "apilift-output-"));
       await chmod(root, 448);
       const streams = ["stdout", "stderr"];
       streams.sort((left, right) => Buffer.byteLength(output2[right]) - Buffer.byteLength(output2[left]));
@@ -38892,6 +38904,7 @@ __export(cli_exports, {
   runCli: () => runCli
 });
 import { hostname as hostname3, platform as platform3, arch } from "node:os";
+import { dirname as dirname13 } from "node:path";
 function result2(stdout = "", exitCode = 0, stderr = "", dispatched = false) {
   return { stdout, stderr, exitCode, dispatched };
 }
@@ -39009,7 +39022,14 @@ Open ${site}/dashboard/get-started and then run:
     }
     if (invocation.key.startsWith("credentials") || invocation.key === "transportsShow") return await handleCredentials(invocation, api, state, session, site, dataRoot(env));
     if (invocation.key.startsWith("browser")) return await handleBrowser(invocation, api, state, session, dataRoot(env));
-    if (invocation.key.startsWith("discover") || ["appsNew", "appsUpdate", "appsHistory"].includes(invocation.key)) return await handleDiscover(invocation, api, state, session, fetcher, dataRoot(env), invocationId);
+    if (invocation.key.startsWith("discover") || ["appsNew", "appsUpdate", "appsHistory"].includes(invocation.key)) {
+      const output2 = await handleDiscover(invocation, api, state, session, fetcher, dataRoot(env), invocationId);
+      if (session && Buffer.byteLength(output2.stdout) + Buffer.byteLength(output2.stderr) > displayBudget) {
+        const store = new DraftStore(state, dataRoot(env)), draft = store.selected(session.id);
+        if (draft?.ownerSessionId === session.id) output2.outputDirectory = dirname13(store.artifactPath(draft.id, "output"));
+      }
+      return output2;
+    }
     if (invocation.key === "run") return await handleRun(invocation, api, state, session, fetcher, dataRoot(env), void 0, onReport);
     if (invocation.key === "setupContinue") {
       await api.call("me");
@@ -39200,6 +39220,7 @@ var init_cli = __esm({
     "use strict";
     init_receipts();
     init_lock();
+    init_drafts();
     init_api2();
     init_api3();
     init_registry();

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apilift/cli",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "private": false,
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
   "engines": {
     "node": ">=24.16.0 <27"
   },
-  "gitHead": "35e5b85595e90273e189e53c1f0f3cf89400cdae",
+  "gitHead": "77f4acfa3f2652928fea0a82245cc55b52a84e64",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/egor-sergeev/apilift.git",