@backifydev/cli 0.3.8 → 0.3.9

package/dist/index.js

@@ -4598,9 +4598,9 @@ var require_resolve_block_scalar = __commonJS({
           default: {
             const message = `Unexpected token in block scalar header: ${token.type}`;
             onError(token, "UNEXPECTED_TOKEN", message);
-            const ts2 = token.source;
-            if (ts2 && typeof ts2 === "string")
-              length += ts2.length;
+            const ts3 = token.source;
+            if (ts3 && typeof ts3 === "string")
+              length += ts3.length;
           }
         }
       }
@@ -4910,9 +4910,9 @@ var require_compose_scalar = __commonJS({
       if (schema.compat) {
         const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
         if (tag.tag !== compat.tag) {
-          const ts2 = directives.tagString(tag.tag);
+          const ts3 = directives.tagString(tag.tag);
           const cs = directives.tagString(compat.tag);
-          const msg = `Value may be parsed as either ${ts2} or ${cs}`;
+          const msg = `Value may be parsed as either ${ts3} or ${cs}`;
           onError(token, "TAG_RESOLVE_FAILED", msg, true);
         }
       }
@@ -7812,7 +7812,7 @@ var require_luxon = __commonJS({
        * @param {string} opts.locale - What locale to return the offset name in.
        * @return {string}
        */
-      offsetName(ts2, opts) {
+      offsetName(ts3, opts) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7823,7 +7823,7 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts2, format) {
+      formatOffset(ts3, format) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7832,7 +7832,7 @@ var require_luxon = __commonJS({
        * @param {number} ts - Epoch milliseconds for which to compute the offset
        * @return {number}
        */
-      offset(ts2) {
+      offset(ts3) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7878,19 +7878,19 @@ var require_luxon = __commonJS({
         return false;
       }
       /** @override **/
-      offsetName(ts2, {
+      offsetName(ts3, {
         format,
         locale
       }) {
-        return parseZoneInfo(ts2, format, locale);
+        return parseZoneInfo(ts3, format, locale);
       }
       /** @override **/
-      formatOffset(ts2, format) {
-        return formatOffset(this.offset(ts2), format);
+      formatOffset(ts3, format) {
+        return formatOffset(this.offset(ts3), format);
       }
       /** @override **/
-      offset(ts2) {
-        return -new Date(ts2).getTimezoneOffset();
+      offset(ts3) {
+        return -new Date(ts3).getTimezoneOffset();
       }
       /** @override **/
       equals(otherZone) {
@@ -8042,11 +8042,11 @@ var require_luxon = __commonJS({
        * @param {string} opts.locale - What locale to return the offset name in.
        * @return {string}
        */
-      offsetName(ts2, {
+      offsetName(ts3, {
         format,
         locale
       }) {
-        return parseZoneInfo(ts2, format, locale, this.name);
+        return parseZoneInfo(ts3, format, locale, this.name);
       }
       /**
        * Returns the offset's value as a string
@@ -8056,8 +8056,8 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts2, format) {
-        return formatOffset(this.offset(ts2), format);
+      formatOffset(ts3, format) {
+        return formatOffset(this.offset(ts3), format);
       }
       /**
        * Return the offset in minutes for this zone at the specified timestamp.
@@ -8065,9 +8065,9 @@ var require_luxon = __commonJS({
        * @param {number} ts - Epoch milliseconds for which to compute the offset
        * @return {number}
        */
-      offset(ts2) {
+      offset(ts3) {
         if (!this.valid) return NaN;
-        const date = new Date(ts2);
+        const date = new Date(ts3);
         if (isNaN(date)) return NaN;
         const dtf = makeDTF(this.name);
         let [year, month, day, adOrBc, hour, minute, second] = dtf.formatToParts ? partsOffset(dtf, date) : hackyOffset(dtf, date);
@@ -8654,7 +8654,7 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts2, format) {
+      formatOffset(ts3, format) {
         return formatOffset(this.fixed, format);
       }
       /**
@@ -9340,8 +9340,8 @@ var require_luxon = __commonJS({
         return year;
       } else return year > Settings.twoDigitCutoffYear ? 1900 + year : 2e3 + year;
     }
-    function parseZoneInfo(ts2, offsetFormat, locale, timeZone = null) {
-      const date = new Date(ts2), intlOpts = {
+    function parseZoneInfo(ts3, offsetFormat, locale, timeZone = null) {
+      const date = new Date(ts3), intlOpts = {
         hourCycle: "h23",
         year: "numeric",
         month: "2-digit",
@@ -12218,9 +12218,9 @@ var require_luxon = __commonJS({
       }
       return [localTS - Math.min(o2, o3) * 60 * 1e3, Math.max(o2, o3)];
     }
-    function tsToObj(ts2, offset2) {
-      ts2 += offset2 * 60 * 1e3;
-      const d = new Date(ts2);
+    function tsToObj(ts3, offset2) {
+      ts3 += offset2 * 60 * 1e3;
+      const d = new Date(ts3);
       return {
         year: d.getUTCFullYear(),
         month: d.getUTCMonth() + 1,
@@ -12251,13 +12251,13 @@ var require_luxon = __commonJS({
         seconds: dur.seconds,
         milliseconds: dur.milliseconds
       }).as("milliseconds"), localTS = objToLocalTS(c);
-      let [ts2, o] = fixOffset(localTS, oPre, inst.zone);
+      let [ts3, o] = fixOffset(localTS, oPre, inst.zone);
       if (millisToAdd !== 0) {
-        ts2 += millisToAdd;
-        o = inst.zone.offset(ts2);
+        ts3 += millisToAdd;
+        o = inst.zone.offset(ts3);
       }
       return {
-        ts: ts2,
+        ts: ts3,
         o
       };
     }
@@ -12444,7 +12444,7 @@ var require_luxon = __commonJS({
         return DateTime.invalid(unsupportedZone(zone));
       }
       const loc = Locale.fromObject(opts);
-      let ts2, o;
+      let ts3, o;
       if (!isUndefined(obj.year)) {
         for (const u of orderedUnits) {
           if (isUndefined(obj[u])) {
@@ -12456,12 +12456,12 @@ var require_luxon = __commonJS({
           return DateTime.invalid(invalid2);
         }
         const offsetProvis = guessOffsetForZone(zone);
-        [ts2, o] = objToTS(obj, offsetProvis, zone);
+        [ts3, o] = objToTS(obj, offsetProvis, zone);
       } else {
-        ts2 = Settings.now();
+        ts3 = Settings.now();
       }
       return new DateTime({
-        ts: ts2,
+        ts: ts3,
         zone,
         loc,
         o
@@ -12624,8 +12624,8 @@ var require_luxon = __commonJS({
        * @return {DateTime}
        */
       static fromJSDate(date, options = {}) {
-        const ts2 = isDate(date) ? date.valueOf() : NaN;
-        if (Number.isNaN(ts2)) {
+        const ts3 = isDate(date) ? date.valueOf() : NaN;
+        if (Number.isNaN(ts3)) {
           return _DateTime.invalid("invalid input");
         }
         const zoneToUse = normalizeZone(options.zone, Settings.defaultZone);
@@ -12633,7 +12633,7 @@ var require_luxon = __commonJS({
           return _DateTime.invalid(unsupportedZone(zoneToUse));
         }
         return new _DateTime({
-          ts: ts2,
+          ts: ts3,
           zone: zoneToUse,
           loc: Locale.fromObject(options)
         });
@@ -13287,14 +13287,14 @@ var require_luxon = __commonJS({
           return [this];
         }
         const ts1 = localTS - o1 * minuteMs;
-        const ts2 = localTS - o2 * minuteMs;
+        const ts22 = localTS - o2 * minuteMs;
         const c1 = tsToObj(ts1, o1);
-        const c2 = tsToObj(ts2, o2);
+        const c2 = tsToObj(ts22, o2);
         if (c1.hour === c2.hour && c1.minute === c2.minute && c1.second === c2.second && c1.millisecond === c2.millisecond) {
           return [clone(this, {
             ts: ts1
           }), clone(this, {
-            ts: ts2
+            ts: ts22
           })];
         }
         return [this];
@@ -13493,9 +13493,9 @@ var require_luxon = __commonJS({
             mixed.day = Math.min(daysInMonth(mixed.year, mixed.month), mixed.day);
           }
         }
-        const [ts2, o] = objToTS(mixed, this.o, this.zone);
+        const [ts3, o] = objToTS(mixed, this.o, this.zone);
         return clone(this, {
-          ts: ts2,
+          ts: ts3,
           o
         });
       }
@@ -17666,7 +17666,7 @@ import { hostname, platform, release, arch } from "node:os";
 // package.json
 var package_default = {
   name: "@backifydev/cli",
-  version: "0.3.8",
+  version: "0.3.9",
   description: "Command-line setup and diagnostics for Backify applications",
   type: "module",
   bin: {
@@ -17725,154 +17725,20 @@ async function registerCliSession(client, applicationId, apiUrl) {
   return { ...session, apiUrl };
 }
 
-// src/local-runtime.ts
-import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync, readdirSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join, resolve as resolve2, sep } from "node:path";
-import { homedir } from "node:os";
-import { spawnSync } from "node:child_process";
-
-// src/local-state.ts
-import { renameSync } from "node:fs";
-function replaceLocalFile(source, destination, rename, platform2, wait) {
-  for (let attempt = 0; ; attempt++) {
-    try {
-      rename(source, destination);
-      return;
-    } catch (error) {
-      if (platform2 !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
-      wait(10 * 2 ** attempt);
-    }
-  }
-}
-function renameLocalFile(source, destination) {
-  replaceLocalFile(source, destination, renameSync, process.platform, (milliseconds) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds));
-}
-
-// src/local-runtime.ts
-var maxArchiveBytes = 256 * 1024 * 1024;
-var maxExpandedBytes = 512 * 1024 * 1024;
-var hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function runtimeIdentifier(platform2 = process.platform, architecture = process.arch) {
-  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform2];
-  if (!system || !["x64", "arm64"].includes(architecture)) throw new Error("Local runtime supports Windows, macOS and Linux on x64/arm64");
-  return system + "-" + architecture;
-}
-function checkedPath(root, filename2) {
-  const target = resolve2(root, filename2);
-  if (target !== resolve2(root) && !target.startsWith(resolve2(root) + sep)) throw new Error("Runtime path escapes its installation");
-  let current = target;
-  while (true) {
-    if (existsSync2(current) && lstatSync(current).isSymbolicLink()) throw new Error("Runtime installation must not follow links");
-    if (dirname2(current) === current) break;
-    current = dirname2(current);
-  }
-  return target;
-}
-function verifyInstallationFiles(root, expected, directory2 = root) {
-  for (const entry of readdirSync(directory2, { withFileTypes: true })) {
-    const path = checkedPath(root, join(directory2, entry.name));
-    if (entry.isDirectory()) verifyInstallationFiles(root, expected, path);
-    else if (!entry.isFile() || !Object.hasOwn(expected, path.slice(root.length + 1).split(sep).join("/"))) throw new Error("Installed runtime contains unexpected files; reinstall a reviewed version");
-  }
-}
-function installedLocalRuntime(base = join(homedir(), ".backify")) {
-  const pointer = checkedPath(base, "runtime.json");
-  if (!existsSync2(pointer)) return void 0;
-  const installed = JSON.parse(readFileSync(pointer, "utf8"));
-  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(installed.version) || installed.rid !== runtimeIdentifier() || !installed.files || Object.keys(installed.files).length > 3e3) throw new Error("Invalid local runtime installation receipt");
-  const root = checkedPath(base, join("runtimes", installed.version, installed.rid));
-  verifyInstallationFiles(root, installed.files);
-  for (const [filename2, digest4] of Object.entries(installed.files)) {
-    const path = checkedPath(root, filename2);
-    if (!/^[a-f0-9]{64}$/.test(digest4) || !lstatSync(path).isFile() || lstatSync(path).size > maxArchiveBytes || hash(readFileSync(path)) !== digest4) throw new Error("Installed runtime bytes changed; reinstall a reviewed version");
-  }
-  const executableName = installed.rid.startsWith("win-") ? "Backify.Hcr.exe" : "Backify.Hcr";
-  if (!installed.files["Backify.Hcr.dll"] || !installed.files[executableName]) throw new Error("Runtime archive requires the self-contained HCR executable and DLL");
-  return { path: join(root, "Backify.Hcr.dll"), executable: join(root, executableName), version: installed.version, rid: installed.rid };
-}
-function installLocalRuntime(archive, options) {
-  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(options.version) || !/^[a-f0-9]{64}$/.test(options.sha256)) throw new Error("Provide a release version vX.Y.Z and an independently reviewed SHA-256");
-  if (archive.byteLength > maxArchiveBytes || hash(archive) !== options.sha256) throw new Error("Runtime archive digest does not match the reviewed SHA-256");
-  let expanded = 0, count = 0;
-  const files = unzipSync(archive, { filter: (file) => {
-    if (++count > 3e3 || (expanded += file.originalSize) > maxExpandedBytes || file.originalSize > maxArchiveBytes) throw new Error("Runtime archive exceeds extraction limits");
-    if (!file.name || file.name.includes("\\") || file.name.startsWith("/") || file.name.includes(":") || file.name.split("/").some((part) => part === "." || part === "..")) throw new Error("Runtime archive contains an unsafe path");
-    return !file.name.endsWith("/");
-  } });
-  const rid = runtimeIdentifier();
-  const executable = rid.startsWith("win-") ? "Backify.Hcr.exe" : "Backify.Hcr";
-  if (!files["Backify.Hcr.dll"] || !files[executable] || !files["sql/events-v1.sql"] || !files["sql/jobs-v1.sql"]) throw new Error("Runtime archive is missing required host assets");
-  const base = options.base ?? join(homedir(), ".backify");
-  const parent = checkedPath(base, join("runtimes", options.version));
-  mkdirSync2(parent, { recursive: true, mode: 448 });
-  const destination = checkedPath(parent, rid);
-  const receipt = { version: options.version, rid, files: Object.fromEntries(Object.entries(files).map(([name2, bytes]) => [name2, hash(bytes)])) };
-  if (!existsSync2(destination)) {
-    const staging = checkedPath(parent, ".install-" + randomUUID());
-    mkdirSync2(staging, { mode: 448 });
-    for (const [name2, bytes] of Object.entries(files)) {
-      const filename2 = checkedPath(staging, name2);
-      mkdirSync2(dirname2(filename2), { recursive: true, mode: 448 });
-      writeFileSync2(filename2, bytes, { flag: "wx", mode: name2 === executable ? 448 : 384 });
-    }
-    if (process.platform !== "win32") chmodSync(join(staging, executable), 448);
-    renameLocalFile(staging, destination);
-  } else {
-    verifyInstallationFiles(destination, receipt.files);
-    for (const [name2, digest4] of Object.entries(receipt.files)) if (hash(readFileSync(checkedPath(destination, name2))) !== digest4) throw new Error("Runtime version already exists with different bytes; never overwrite an installation");
-  }
-  const pointer = checkedPath(base, "runtime.json");
-  const temporary = checkedPath(base, ".runtime-" + randomUUID() + ".json");
-  writeFileSync2(temporary, JSON.stringify(receipt), { flag: "wx", mode: 384 });
-  renameLocalFile(temporary, pointer);
-  return installedLocalRuntime(base);
-}
-async function downloadLocalRuntime(version) {
-  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(version)) throw new Error("Provide a release version vX.Y.Z");
-  let url = new URL("https://github.com/frejnorling/backify/releases/download/runtime-" + version + "/backify-hcr-" + runtimeIdentifier() + ".zip");
-  for (let redirects = 0; redirects < 5; redirects++) {
-    if (url.protocol !== "https:" || !["github.com", "release-assets.githubusercontent.com", "objects.githubusercontent.com"].includes(url.hostname) || url.username || url.password) throw new Error("Runtime download left the approved release hosts");
-    const response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(6e4) });
-    if ([301, 302, 303, 307, 308].includes(response.status)) {
-      url = new URL(response.headers.get("location") ?? "", url);
-      continue;
-    }
-    if (!response.ok || !response.body) throw new Error("The requested runtime release is unavailable");
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of response.body) {
-      size += chunk.byteLength;
-      if (size > maxArchiveBytes) throw new Error("Runtime archive exceeds its size limit");
-      chunks.push(chunk);
-    }
-    return Buffer.concat(chunks);
-  }
-  throw new Error("Too many runtime download redirects");
-}
-function localPrerequisites() {
-  const runtime = installedLocalRuntime();
-  const directory2 = process.env.BACKIFY_LOCAL_POSTGRES_BIN ?? (process.platform === "win32" ? join(process.env.ProgramFiles ?? "C:/Program Files", "PostgreSQL", "17", "bin") : void 0);
-  const checks = ["initdb", "pg_ctl", "psql"].map((name2) => {
-    const executable = directory2 ? join(directory2, name2 + (process.platform === "win32" ? ".exe" : "")) : name2;
-    const result = spawnSync(executable, ["--version"], { windowsHide: true, timeout: 1e4, encoding: "utf8" });
-    return { name: name2, available: result.status === 0 };
-  });
-  return { rid: runtimeIdentifier(), runtime: runtime ? { installed: true, version: runtime.version } : { installed: false }, postgres: checks, ready: !!runtime && checks.every((check) => check.available) };
-}
+// src/browser-auth.ts
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
 
-// src/workload.ts
-import { build as build2 } from "esbuild";
-import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync16, realpathSync as realpathSync6, readdirSync as readdirSync4, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute13, join as join10, relative as relative8, resolve as resolve16 } from "node:path";
+// src/development.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync4, renameSync, rmSync, mkdtempSync, lstatSync as lstatSync2, cpSync } from "node:fs";
+import { dirname as dirname4, join as join3, resolve as resolve3 } from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { randomUUID } from "node:crypto";
 
-// src/local-development.ts
-import { context as context2 } from "esbuild";
-import { spawn as spawn4 } from "node:child_process";
-import { randomBytes as randomBytes5, randomUUID as randomUUID8, createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync15, realpathSync as realpathSync5, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4 } from "node:fs";
-import { resolve as resolve15, join as join9, relative as relative7, isAbsolute as isAbsolute12, dirname as dirname9 } from "node:path";
+// src/setup.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, readdirSync, lstatSync } from "node:fs";
+import { basename, dirname as dirname3, join as join2, resolve as resolve2, isAbsolute } from "node:path";
+import { spawnSync } from "node:child_process";
 
 // ../platform/dist/manifest.js
 var import_yaml = __toESM(require_dist(), 1);
@@ -17905,6 +17771,8 @@ function parseApplicationManifest(source) {
     if (!object(settings))
       throw new Error("Capability configuration must be a mapping: " + name2);
     validatePortableSettings(settings);
+    if (name2 === "auth")
+      validateAuthSettings(settings);
     if (settings.enabled !== void 0 && typeof settings.enabled !== "boolean")
       throw new Error("enabled must be boolean: " + name2);
     if (name2 === "database" && settings.engine !== void 0 && settings.engine !== "postgres")
@@ -17934,8 +17802,32 @@ function validatePortableSettings(settings) {
     }
   }
 }
-function manifestDiagnostics(manifest, used) {
-  return [...new Set(used)].filter((name2) => !manifest.capabilities[name2] || manifest.capabilities[name2]?.enabled === false).map((name2) => ({ code: "undeclared-capability", severity: "error", message: "Declare capabilities." + name2 + " in backify.yaml before deployment" }));
+function validateAuthSettings(settings) {
+  const supported = ["entra", "google", "email"];
+  if (Object.keys(settings).some((key) => !["enabled", "providers", "defaultProvider", "session", "roles"].includes(key)))
+    throw new Error("Unknown authentication setting");
+  if (settings.providers !== void 0 && (!Array.isArray(settings.providers) || settings.providers.length === 0 || settings.providers.some((provider) => typeof provider !== "string" || !supported.includes(provider)) || new Set(settings.providers).size !== settings.providers.length))
+    throw new Error("Authentication requires distinct supported providers: entra, google, email");
+  if (settings.defaultProvider !== void 0 && (!Array.isArray(settings.providers) || !settings.providers.includes(settings.defaultProvider)))
+    throw new Error("The default authentication provider must be declared");
+  if (settings.session !== void 0 && (!object(settings.session) || Object.keys(settings.session).some((key) => !["duration", "refresh"].includes(key)) || typeof settings.session.duration !== "string" || settings.session.duration.trim() !== settings.session.duration || !/^(?:[1-9]|1[0-9]|2[0-4])h$/.test(settings.session.duration) || settings.session.refresh !== void 0 && typeof settings.session.refresh !== "boolean"))
+    throw new Error("Authentication sessions require a 1h-24h duration and an optional boolean refresh setting");
+  if (settings.roles !== void 0 && (!Array.isArray(settings.roles) || settings.roles.length > 32 || settings.roles.some((role) => typeof role !== "string" || !role.trim() || role.length > 100) || new Set(settings.roles).size !== settings.roles.length))
+    throw new Error("Authentication roles must be distinct bounded names");
+}
+function manifestDiagnostics(manifest, used, authentication) {
+  const diagnostics = [...new Set(used)].filter((name2) => !manifest.capabilities[name2] || manifest.capabilities[name2]?.enabled === false).map((name2) => ({ code: "undeclared-capability", severity: "error", message: "Declare capabilities." + name2 + " in backify.yaml before deployment" }));
+  if (authentication) {
+    const declared = manifest.capabilities.auth?.providers;
+    if (authentication.dynamicProviders === true && (!Array.isArray(declared) || declared.length === 0))
+      diagnostics.push({ code: "undeclared-auth-providers", severity: "error", message: "Dynamic sign-in requires an explicit capabilities.auth.providers list" });
+    if (Array.isArray(authentication.providers)) {
+      for (const provider of authentication.providers)
+        if (!Array.isArray(declared) || !declared.includes(provider))
+          diagnostics.push({ code: "undeclared-auth-provider", severity: "error", message: "Declare authentication provider " + String(provider) + " before deployment" });
+    }
+  }
+  return diagnostics;
 }
 
 // ../platform/dist/delivery.js
@@ -17968,6 +17860,10 @@ Run the following to discover the connected hosting target, repository, branch,
 
 Connection and initialization may proceed without application requirements. Then ask what to build if none were supplied; never invent requirements or record this setup text as a user requirement.
 
+## Reauthenticate CLI access
+
+If CLI authentication expires or is rejected, ask the user to reauthenticate. Run npx @backifydev/cli@latest connect --reauth from the application folder (or supply --app <app-id> and --organization <organization-id>). It opens https://auth.backify.dev for sign-in and explicit approval of 7, 14, 30, or 90 days of application CLI access. Keep the command running while the user signs in; it saves the new credential automatically and the browser can then be closed. Never ask the user to paste tokens, inspect credential files, or copy a new setup prompt just to reconnect. Ordinary authenticated commands also open browser recovery on expiry or HTTP 401 and retry once after approval. For unattended execution use --no-browser; with --json an authentication_required error includes a reauthenticationCommand. After explicit reconnection, retry only an operation known to have failed authentication; do not repeat a completed deployment or other successful write.
+
 ## Record each user request
 
 For EVERY user request to build or modify this application, including the initial requirements supplied alongside or after setup, record only the user's own requirement text before changing application code. Submit the text through standard input to:
@@ -18049,7 +17945,7 @@ var MAIL_LIMITS = Object.freeze({
 });
 var capability = (name2, imp, description, stateful = false, provisioner = name2) => ({ name: name2, import: imp, version: 1, stateful, provisioner, docs: `${DOCS_URL}/capabilities/${name2}`, description, destructiveRemovalRequiresApproval: stateful });
 var CAPABILITIES = [
-  capability("auth", "auth", "Application users, organizations, roles, and permissions"),
+  capability("auth", "auth", "Application users, organizations, roles, and permissions", true),
   capability("database", "db", "Persistent application data", true),
   capability("storage", "storage", "Persistent files and objects", true),
   capability("functions", "functions", "Server function declarations"),
@@ -18163,113 +18059,931 @@ function validateConfig(value) {
 }
 var BACKIFY_SCHEMA = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: `${DOCS_URL}/schema/backify.json`, type: "object", additionalProperties: false, required: ["$schema", "platform", "sdk", "appId", "instructionVersion", "docs", "instructions"], properties: { $schema: { const: `${DOCS_URL}/schema/backify.json` }, platform: { const: "backify" }, sdk: { const: SDK_PACKAGE }, appId: { type: "string", pattern: "^app_[A-Za-z0-9_-]+$" }, instructionVersion: { type: "integer", minimum: 1 }, agent: { enum: ["codex", "claude", "copilot", "gemini", "custom"] }, instructionFile: { type: "string", minLength: 1 }, docs: { type: "string", format: "uri" }, instructions: { type: "object", additionalProperties: false, required: ["preferBackifyCapabilities", "allowDirectCloudInfrastructure"], properties: { preferBackifyCapabilities: { const: true }, allowDirectCloudInfrastructure: { const: false } } } } };
 
-// ../analyzer/dist/index.js
-import ts from "typescript";
-import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "node:fs";
-import { join as join2, extname } from "node:path";
-var bypass = { "@azure/storage-blob": { capability: "storage", replacement: "storage" }, "@aws-sdk/client-s3": { capability: "storage", replacement: "storage" }, "firebase-admin": { capability: "database", replacement: "db" }, "@supabase/supabase-js": { capability: "database", replacement: "db" }, "@azure/service-bus": { capability: "jobs", replacement: "jobs" } };
-function analyzeSources(files, options = {}) {
-  const used = /* @__PURE__ */ new Set(), diagnostics = [];
-  for (const file of files)
-    analyzeFile(file, used, diagnostics);
-  if (used.has("http"))
-    used.add("events");
-  return { schemaVersion: 1, applicationId: options.applicationId ?? "unknown", commit: options.commit ?? "unknown", sdkVersion: options.sdkVersion ?? "unknown", capabilities: Object.fromEntries([...used].sort().map((name2) => [name2, { version: CAPABILITY_REGISTRY[name2].version }])), diagnostics };
+// src/delivery.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join, relative as relativePath } from "node:path";
+import { createHash } from "node:crypto";
+var previousGeneratedWorkflowHashes = /* @__PURE__ */ new Set(["33e962274e8493f7cbac2afbac05a4e96afeec49ee08cf2bf82f8add9081b28b", "578dfb4c771c623fd04454e8a604efd701d5563d11e11191324862369bd24718", "6eb280ae7bdb14c390011686c41400f59c023304c3015d8440b7e80aaafa1c11", "545e03a1d5b996ade179e0e60ed5c86accdadc1982c1c25efd094e34f72f47ee"]);
+function validateDeliveryInstructions(root) {
+  for (const filename2 of ["BACKIFY.md", "BACKIFY-WORKFLOW.md"]) {
+    const path = join(root, filename2);
+    if (existsSync2(path)) {
+      const existing = readFileSync(path, "utf8").replace(/\r\n/g, "\n");
+      if (existing !== deliveryInstructions && !previousGeneratedWorkflowHashes.has(createHash("sha256").update(existing).digest("hex"))) throw new Error(filename2 + " contains different instructions. Review it before initializing; it will not be overwritten.");
+    }
+  }
 }
-function analyzeFile(file, used, diagnostics) {
-  const source = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS), named = /* @__PURE__ */ new Map(), namespaces = /* @__PURE__ */ new Set(), roots = /* @__PURE__ */ new Set(), factories = /* @__PURE__ */ new Set();
-  source.forEachChild((node) => {
-    if (!ts.isImportDeclaration(node) || !ts.isStringLiteral(node.moduleSpecifier))
-      return;
-    const module = node.moduleSpecifier.text;
-    if (bypass[module]) {
-      const rule = bypass[module];
-      diagnostics.push({ severity: "warning", code: "direct-provider-sdk", file: file.path, docs: CAPABILITY_REGISTRY[rule.capability].docs, message: `Direct provider dependency '${module}' detected. Use import { ${rule.replacement} } from "@backifydev/sdk" so Backify can provision and bind ${rule.capability}.` });
+function installDeliveryInstructions(root, instructionFiles2) {
+  validateDeliveryInstructions(root);
+  writeFileSync2(join(root, "BACKIFY.md"), deliveryInstructions);
+  for (const relative11 of instructionFiles2) {
+    const instructionPath = join(root, relative11), content = readFileSync(instructionPath, "utf8");
+    const link = relativePath(dirname2(instructionPath), join(root, "BACKIFY.md")).replaceAll("\\", "/");
+    const legacyLink = relativePath(dirname2(instructionPath), join(root, "BACKIFY-WORKFLOW.md")).replaceAll("\\", "/");
+    const legacy = "For application delivery and recording each user request, follow [BACKIFY-WORKFLOW.md](" + legacyLink + ").";
+    const guidance = "For application delivery and recording each user request, follow [BACKIFY.md](" + link + ").";
+    if (content.includes(legacy)) writeFileSync2(instructionPath, content.replace(legacy, guidance));
+    else if (!content.includes("## Backify delivery")) writeFileSync2(instructionPath, content.trimEnd() + "\n\n## Backify delivery\n\n" + guidance + "\n");
+  }
+}
+
+// src/setup.ts
+var instructionFiles = ["AGENTS.md"];
+var agentInstructionFiles = { codex: "AGENTS.md", claude: "CLAUDE.md", copilot: join2(".github", "copilot-instructions.md"), gemini: "GEMINI.md" };
+function instructionSelection(root, agent, instructionFile) {
+  const configPath2 = join2(root, "backify.json"), configured = existsSync3(configPath2) ? JSON.parse(readFileSync2(configPath2, "utf8")) : {};
+  const custom = instructionFile ?? (agent === void 0 ? configured.instructionFile : void 0);
+  const selected = instructionFile !== void 0 ? "custom" : agent ?? configured.agent ?? "codex";
+  if (typeof selected !== "string" || selected !== "custom" && !Object.hasOwn(agentInstructionFiles, selected)) throw new Error("Select the current tool with --agent or --instruction-file <relative-path>.");
+  const filename2 = custom ?? agentInstructionFiles[selected];
+  if (typeof filename2 !== "string" || !filename2.trim()) throw new Error("Select the current tool with --agent codex, claude, copilot, or gemini, or --instruction-file <relative-path> for any other tool.");
+  const normalized = filename2.replaceAll("\\", "/"), parts = normalized.split("/");
+  if (isAbsolute(filename2) || /^[A-Za-z]:/.test(filename2) || parts.some((part) => !part || part === "." || part === ".." || part.toLowerCase() === ".git") || ["backify.md", "backify-workflow.md", "backify.json", "package.json", "package-lock.json"].includes(normalized.toLowerCase())) throw new Error("Instruction file must be a relative tool-instruction path inside the project, not Git metadata or a Backify configuration file.");
+  for (let index = 1; index <= parts.length; index++) {
+    const entry = join2(root, ...parts.slice(0, index));
+    try {
+      const metadata = lstatSync(entry);
+      if (metadata.isSymbolicLink() || index < parts.length && !metadata.isDirectory() || index === parts.length && !metadata.isFile()) throw new Error("Instruction file path cannot traverse symlinks or replace a directory.");
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
     }
-    if (module !== "@backifydev/sdk" && module !== "@backifydev/sdk/server" || !node.importClause)
-      return;
-    const bindings = node.importClause.namedBindings;
-    if (!bindings)
-      return;
-    if (ts.isNamespaceImport(bindings))
-      namespaces.add(bindings.name.text);
-    else if (ts.isNamedImports(bindings))
-      for (const element of bindings.elements) {
-        const imported = (element.propertyName ?? element.name).text, local = element.name.text;
-        if (imported === "createServerClient")
-          factories.add(local);
-        else if (imported === "backify")
-          roots.add(local);
-        else {
-          const cap = SDK_IMPORT_CAPABILITIES[imported];
-          if (cap)
-            named.set(local, cap);
-        }
-      }
+  }
+  return { agent: selected, instructionFile: normalized, files: [normalized] };
+}
+function selectedInstructionFiles(root = process.cwd(), agent, instructionFile) {
+  return instructionSelection(root, agent, instructionFile).files;
+}
+function isToolWorkspaceEntry(entry, root = process.cwd()) {
+  if (entry.name.toLowerCase() === ".git" || entry.name.toLowerCase() === ".env" || entry.name.toLowerCase().startsWith(".env.")) return false;
+  return entry.isDirectory() && (entry.name.startsWith(".") || ["work", "outputs"].includes(entry.name) || readdirSync(join2(root, entry.name)).length === 0) || entry.isFile() && (entry.name.startsWith(".") || /\.(md|mdc)$/i.test(entry.name));
+}
+function detectPackageManager(root = process.cwd()) {
+  for (const [file, name2] of [["pnpm-lock.yaml", "pnpm"], ["yarn.lock", "yarn"], ["bun.lockb", "bun"], ["bun.lock", "bun"], ["package-lock.json", "npm"]]) if (existsSync3(join2(root, file))) return name2;
+  return "npm";
+}
+function updateInstructions(root = process.cwd(), agent, instructionFile) {
+  const updates = selectedInstructionFiles(root, agent, instructionFile).map((relative11) => {
+    const path = join2(root, relative11);
+    return { path, content: updateManagedInstructions(existsSync3(path) ? readFileSync2(path, "utf8") : "") };
   });
-  const visit = (node) => {
-    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && ts.isCallExpression(node.initializer) && ts.isIdentifier(node.initializer.expression) && factories.has(node.initializer.expression.text))
-      roots.add(node.name.text);
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && named.get(node.expression.text) === "jobs" && node.arguments.some((argument) => ts.isObjectLiteralExpression(argument) && argument.properties.some((property) => ts.isPropertyAssignment(property) && property.name.getText(source) === "schedule")))
-      used.add("scheduler");
-    if (ts.isIdentifier(node)) {
-      const parent = node.parent;
-      if (named.has(node.text) && !ts.isImportSpecifier(parent) && isValueUse(node))
-        used.add(named.get(node.text));
-    }
-    if (ts.isPropertyAccessExpression(node)) {
-      if (ts.isIdentifier(node.expression)) {
-        if (namespaces.has(node.expression.text)) {
-          const cap = SDK_IMPORT_CAPABILITIES[node.name.text];
-          if (cap)
-            used.add(cap);
-        }
-        if (roots.has(node.expression.text)) {
-          const cap = SDK_IMPORT_CAPABILITIES[node.name.text];
-          if (cap)
-            used.add(cap);
-        }
-      }
-      if (node.name.text === "schedule" && rootCapability(node.expression, named, namespaces, roots) === "jobs")
-        used.add("scheduler");
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(source);
+  for (const { path, content } of updates) {
+    mkdirSync2(dirname3(path), { recursive: true });
+    writeFileSync3(path, content);
+  }
 }
-function isValueUse(node) {
-  const p = node.parent;
-  return !(ts.isImportSpecifier(p) || ts.isExportSpecifier(p) || ts.isTypeReferenceNode(p) || ts.isTypeQueryNode(p));
+function synchronize(root = process.cwd(), agent, instructionFile) {
+  const path = join2(root, "backify.json");
+  if (!existsSync3(path)) throw new Error("backify.json is missing; run backify init --app app_xxxxx");
+  const value = JSON.parse(readFileSync2(path, "utf8")), issues = validateConfig(value);
+  if (issues.length) throw new Error(issues.join("; "));
+  if (value.instructionVersion > INSTRUCTION_VERSION) throw new Error("This app uses newer instructions. Install a matching or newer CLI before syncing.");
+  const selected = instructionSelection(root, agent, instructionFile);
+  validateDeliveryInstructions(root);
+  updateInstructions(root, selected.agent, selected.instructionFile);
+  installDeliveryInstructions(root, selected.files);
+  value.agent = selected.agent;
+  value.instructionFile = selected.instructionFile;
+  value.instructionVersion = INSTRUCTION_VERSION;
+  writeFileSync3(path, JSON.stringify(value, null, 2) + "\n");
 }
-function rootCapability(node, named, namespaces, roots) {
-  if (ts.isIdentifier(node))
-    return named.get(node.text);
-  if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
-    if (namespaces.has(node.expression.text) || roots.has(node.expression.text))
-      return SDK_IMPORT_CAPABILITIES[node.name.text];
+function sdkInstalled(root = process.cwd()) {
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(root, "package.json"), "utf8"));
+    return Boolean(pkg.dependencies?.[SDK_PACKAGE] || pkg.devDependencies?.[SDK_PACKAGE]);
+  } catch {
+    return false;
   }
-  return void 0;
 }
-function repositorySources(root) {
-  const result = [];
-  const walk = (dir) => {
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".backify" || entry.name.startsWith(".git"))
-        continue;
-      const path = join2(dir, entry.name);
-      if (entry.isDirectory())
-        walk(path);
-      else if ([".ts", ".tsx", ".js", ".jsx", ".mts", ".mjs"].includes(extname(path)))
-        result.push({ path, content: readFileSync2(path, "utf8") });
-    }
-  };
-  if (existsSync3(root))
-    walk(root);
-  return result;
+function installSdk(root = process.cwd()) {
+  if (sdkInstalled(root)) return;
+  const manager = detectPackageManager(root), args2 = manager === "npm" ? ["install", SDK_PACKAGE] : ["add", SDK_PACKAGE], result = spawnSync(manager, args2, { cwd: root, stdio: "inherit", shell: process.platform === "win32" });
+  if (result.status !== 0) throw new Error(`Could not install ${SDK_PACKAGE} with ${manager}`);
 }
-
-// src/local-inspection.ts
-function createLocalDataInspector(runtime, options) {
+function ensurePackageManifest(root) {
+  const path = join2(root, "package.json");
+  if (existsSync3(path)) return;
+  const setupFiles = /* @__PURE__ */ new Set([".git", ".gitignore", ".github", "AGENTS.md", "CLAUDE.md", "GEMINI.md", "BACKIFY.md", "BACKIFY-WORKFLOW.md", "README.md", "LICENSE", "backify.json"]);
+  if (readdirSync(root, { withFileTypes: true }).some((entry) => !setupFiles.has(entry.name) && !isToolWorkspaceEntry(entry, root))) throw new Error("package.json is missing. Run backify init from the existing application's JavaScript/TypeScript package directory, or start in an empty folder. See https://agent.backify.dev/");
+  const name2 = basename(resolve2(root)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "backify-app";
+  writeFileSync3(path, JSON.stringify({ name: name2, version: "0.0.0", private: true, type: "module" }, null, 2) + "\n", { flag: "wx" });
+}
+function initialize(appId, root = process.cwd(), install = true, agent, instructionFile) {
+  if (!/^app_[A-Za-z0-9_-]+$/.test(appId)) throw new Error("Provide an application ID using --app app_xxxxx");
+  const selected = instructionSelection(root, agent, instructionFile), files = selected.files;
+  validateDeliveryInstructions(root);
+  for (const relative11 of files) if (existsSync3(join2(root, relative11))) updateManagedInstructions(readFileSync2(join2(root, relative11), "utf8"));
+  ensurePackageManifest(root);
+  if (install) installSdk(root);
+  const configPath2 = join2(root, "backify.json"), existing = existsSync3(configPath2) ? JSON.parse(readFileSync2(configPath2, "utf8")) : {};
+  writeFileSync3(configPath2, JSON.stringify({ ...existing, ...createConfig(appId), agent: selected.agent, instructionFile: selected.instructionFile }, null, 2) + "\n");
+  updateInstructions(root, selected.agent, selected.instructionFile);
+  installDeliveryInstructions(root, files);
+}
+function doctor(root = process.cwd(), agent, instructionFile) {
+  const issues = [], warnings = [];
+  if (!sdkInstalled(root)) issues.push(`${SDK_PACKAGE} is not installed`);
+  let config;
+  try {
+    config = JSON.parse(readFileSync2(join2(root, "backify.json"), "utf8"));
+    issues.push(...validateConfig(config));
+  } catch {
+    issues.push("backify.json is missing or invalid JSON");
+  }
+  if (config && config.instructionVersion !== INSTRUCTION_VERSION) issues.push(`Repository instruction version ${config.instructionVersion}; CLI version ${INSTRUCTION_VERSION}. Use the matching CLI or run backify sync to upgrade.`);
+  let files = instructionFiles;
+  try {
+    files = selectedInstructionFiles(root, agent, instructionFile);
+  } catch (reason) {
+    issues.push(reason instanceof Error ? reason.message : String(reason));
+  }
+  for (const relative11 of files) {
+    const path = join2(root, relative11);
+    if (!existsSync3(path)) {
+      issues.push(`${relative11} is missing`);
+      continue;
+    }
+    issues.push(...managedInstructionIssues(readFileSync2(path, "utf8")).map((issue) => `${relative11} ${issue}`));
+  }
+  let version = "unknown";
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(root, "package.json"), "utf8"));
+    version = pkg.dependencies?.[SDK_PACKAGE] ?? pkg.devDependencies?.[SDK_PACKAGE] ?? "missing";
+  } catch {
+  }
+  return { valid: issues.length === 0, appId: config?.appId, sdkVersion: version, instructionVersion: config?.instructionVersion, currentInstructionVersion: INSTRUCTION_VERSION, issues, warnings };
+}
+
+// src/development.ts
+function promptMetadata(args2) {
+  const fields5 = [["--model", "model", 200], ["--ai-tool", "aiTool", 200], ["--access-level", "accessLevel", 500]];
+  const metadata = {};
+  for (const [flag, field, maxLength] of fields5) {
+    const index = args2.indexOf(flag);
+    if (index < 0) continue;
+    const value = args2[index + 1]?.trim();
+    if (!value || value.startsWith("--") || value.length > maxLength || /[\u0000-\u001f\u007f-\u009f]|bfcli_[0-9a-f]{64}|--pair\s+[0-9a-f]{64}/i.test(value))
+      throw new Error(`Provide ${flag} with a nonempty value of at most ${maxLength} characters without control characters or credentials.`);
+    metadata[field] = value;
+  }
+  return metadata;
+}
+function applicationGuid(appId) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(appId)) return appId.toLowerCase();
+  const match = /^app_([0-9a-f]{32})$/i.exec(appId);
+  if (!match) throw new Error("Use the application ID supplied by Backify.");
+  const value = match[1];
+  return [value.slice(0, 8), value.slice(8, 12), value.slice(12, 16), value.slice(16, 20), value.slice(20)].join("-");
+}
+function projectApplication(root = process.cwd()) {
+  if (!existsSync4(join3(root, "backify.json"))) throw new Error("Run backify connect --app <application-id>, then backify init.");
+  return JSON.parse(readFileSync3(join3(root, "backify.json"), "utf8")).appId;
+}
+function apiAddress(value) {
+  const address = new URL(value);
+  if (address.username || address.password || address.search || address.hash || address.protocol !== "https:" && !(address.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(address.hostname))) throw new Error("Backify API must use HTTPS (HTTP is allowed only on loopback for local development).");
+  return address.toString().replace(/\/$/, "");
+}
+var CliAuthenticationRequired = class extends Error {
+  code = "authentication_required";
+  constructor() {
+    super("Backify CLI authentication expired or was revoked. Ask the user to sign in, then run backify connect --reauth. The browser lets them choose 7, 14, 30, or 90 days.");
+  }
+};
+function apiClient(session, transport = fetch) {
+  const base = apiAddress(session.apiUrl);
+  return async (path, init) => {
+    if (!path.startsWith("/") || path.startsWith("//")) throw new Error("Invalid API path.");
+    if (session.expiresAt && Date.parse(session.expiresAt) <= Date.now()) throw new CliAuthenticationRequired();
+    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "user-agent": cliUserAgent, "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
+    if (!response.ok) {
+      if (response.status === 401) throw new CliAuthenticationRequired();
+      let message = "Backify request failed (" + response.status + ").";
+      try {
+        const problem = await response.json();
+        message = [problem.code, problem.title].filter(Boolean).join(": ") || message;
+      } catch {
+      }
+      throw new Error(message);
+    }
+    return response.status === 204 ? void 0 : await response.json();
+  };
+}
+function saveUserConfig(path, config) {
+  const temporary = path + "." + randomUUID() + ".tmp";
+  try {
+    writeFileSync4(temporary, JSON.stringify(config, null, 2) + "\n", { mode: 384, flag: "wx" });
+    if (process.platform === "win32") {
+      const account = [process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join("\\");
+      if (!account) throw new Error("Cannot identify the account to protect CLI credentials.");
+      const secured = spawnSync2("icacls", [temporary, "/inheritance:r", "/grant:r", account + ":(F)"], { windowsHide: true, encoding: "utf8" });
+      if (secured.status !== 0) throw new Error("Could not restrict CLI credential file permissions.");
+    }
+    renameSync(temporary, path);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+function repositoryName(remote) {
+  const match = /^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/i.exec(remote);
+  if (!match) throw new Error("Repository must be a credential-free GitHub URL.");
+  return match[1].toLowerCase();
+}
+function git(args2, root = process.cwd(), environment = process.env) {
+  const result = spawnSync2("git", args2, { cwd: root, env: environment, encoding: "utf8", windowsHide: true, maxBuffer: 2 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error("Git " + args2[0] + " failed. Check repository access, branch protection, and local changes.");
+  return result.stdout.trim();
+}
+function gitEnvironment(repository, token) {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) throw new Error("Invalid repository.");
+  return { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_COUNT: "3", GIT_CONFIG_KEY_0: "http.https://github.com/" + repository + ".git.extraheader", GIT_CONFIG_VALUE_0: "Authorization: Basic " + Buffer.from("x-access-token:" + token).toString("base64"), GIT_CONFIG_KEY_1: "credential.helper", GIT_CONFIG_VALUE_1: "", GIT_CONFIG_KEY_2: "http.followRedirects", GIT_CONFIG_VALUE_2: "false" };
+}
+function validateCloneMerge(source, target) {
+  for (const entry of readdirSync2(source, { withFileTypes: true })) {
+    const destination = join3(target, entry.name);
+    let existing;
+    try {
+      existing = lstatSync2(destination);
+    } catch (reason) {
+      if (reason.code === "ENOENT") continue;
+      throw reason;
+    }
+    if (entry.isDirectory() && existing.isDirectory() && !existing.isSymbolicLink()) validateCloneMerge(join3(source, entry.name), destination);
+    else throw new Error("Clone conflicts with existing workspace entry: " + destination + ". Existing files are never overwritten; reconcile the conflict or use a new folder.");
+  }
+}
+async function cloneProject(call2, appId, root = process.cwd()) {
+  const status = await call2("/apps/" + applicationGuid(appId) + "/developer");
+  if (!status.repository || !status.branch || !status.workflowReady) throw new Error("Connect the repository in Backify and wait for workflow setup.");
+  if (readdirSync2(root, { withFileTypes: true }).some((entry) => !isToolWorkspaceEntry(entry, root))) throw new Error("--clone requires an empty directory or a workspace containing only AI tool metadata and default work/outputs directories. Existing application files and Git repositories are never overwritten.");
+  const credential = await call2("/apps/" + applicationGuid(appId) + "/developer/git-credential", { method: "POST" });
+  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed. Run connect again.");
+  const staging = mkdtempSync(join3(dirname4(resolve3(root)), ".backify-clone-"));
+  try {
+    git(["clone", "--single-branch", "--branch", status.branch, "--", "https://github.com/" + status.repository + ".git", "."], staging, gitEnvironment(status.repository, credential.token));
+    validateCloneMerge(staging, root);
+    for (const entry of readdirSync2(staging)) cpSync(join3(staging, entry), join3(root, entry), { recursive: true, force: false, errorOnExist: true, dereference: false });
+  } finally {
+    if (dirname4(staging) !== dirname4(resolve3(root)) || !staging.startsWith(join3(dirname4(resolve3(root)), ".backify-clone-"))) throw new Error("Refusing to clean up an unexpected clone staging path.");
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+async function pullProject(call2, appId, root = process.cwd()) {
+  if (existsSync4(join3(root, "backify.json")) && applicationGuid(projectApplication(root)) !== applicationGuid(appId)) throw new Error("Local application ID does not match the connected application.");
+  const prefix = "/apps/" + applicationGuid(appId);
+  const status = await call2(prefix + "/developer");
+  if (!status.repository || !status.branch) throw new Error("Connect the repository and branch in Backify before pulling.");
+  if (resolve3(git(["rev-parse", "--show-toplevel"], root)) !== resolve3(root)) throw new Error("Run pull from the connected repository root.");
+  if (repositoryName(git(["remote", "get-url", "origin"], root)) !== status.repository.toLowerCase()) throw new Error("Local origin does not match the repository connected in Backify.");
+  if (git(["branch", "--show-current"], root) !== status.branch) throw new Error("Local branch does not match the branch connected in Backify. The CLI never switches branches automatically.");
+  git(["check-ref-format", "--branch", status.branch], root);
+  const credential = await call2(prefix + "/developer/git-credential", { method: "POST" });
+  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed; reconnect before pulling.");
+  git(["fetch", "--no-tags", "--", "https://github.com/" + status.repository + ".git", "refs/heads/" + status.branch + ":refs/remotes/origin/" + status.branch], root, gitEnvironment(status.repository, credential.token));
+  const remoteCommit = git(["rev-parse", "FETCH_HEAD"], root);
+  const counts = git(["rev-list", "--left-right", "--count", "HEAD..." + remoteCommit], root).split(/\s+/).map(Number);
+  if (counts.length !== 2 || counts.some((count) => !Number.isSafeInteger(count) || count < 0)) throw new Error("Could not compare local and remote history.");
+  const [ahead, behind] = counts;
+  if (!behind) return { status: "up-to-date", ahead, behind, commit: git(["rev-parse", "HEAD"], root) };
+  if (ahead) return { status: "blocked", reason: "Local and GitHub history have diverged. Review and reconcile them explicitly; no rebase, reset, or force-push was performed.", ahead, behind };
+  if (git(["status", "--porcelain"], root)) return { status: "blocked", reason: "Local changes or untracked files are present. Commit, ignore, or otherwise resolve them explicitly before updating; nothing was stashed or overwritten.", ahead, behind };
+  git(["merge", "--ff-only", "--", remoteCommit], root);
+  return { status: "updated", ahead: 0, behind: 0, commit: git(["rev-parse", "HEAD"], root) };
+}
+async function readPrompt(input) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of input) {
+    const bytes = Buffer.from(chunk);
+    size += bytes.length;
+    if (size > 128e3) throw new Error("Prompt exceeds the size limit.");
+    chunks.push(bytes);
+  }
+  const text3 = Buffer.concat(chunks).toString("utf8");
+  if (!text3.trim() || text3.length > 32e3) throw new Error("Provide between 1 and 32000 characters of user prompt text.");
+  if (/\bbfcli_[0-9a-f]{64}\b|--pair\s+[0-9a-f]{64}/i.test(text3)) throw new Error("Do not record setup prompts or Backify credentials.");
+  return text3;
+}
+function attachmentNames(values) {
+  if (values.length > 50) throw new Error("At most 50 attachment filenames are allowed.");
+  return [...new Set(values.map((value) => {
+    const filename2 = value.replace(/\\/g, "/").split("/").pop();
+    if (!filename2 || filename2 === "." || filename2 === ".." || filename2.length > 255 || /[\x00-\x1f\x7f]/.test(filename2)) throw new Error("Invalid attachment filename.");
+    return filename2;
+  }))];
+}
+function localReport(runChecks, root = process.cwd()) {
+  const pkg = JSON.parse(readFileSync3(join3(root, "package.json"), "utf8"));
+  const dependencies = { ...pkg.devDependencies, ...pkg.dependencies };
+  const framework = ["next", "vite", "astro", "@sveltejs/kit", "nuxt", "react", "express"].find((name2) => dependencies[name2]) ?? "unknown";
+  const setup = doctor(root);
+  const checks = [{ name: "backify doctor", status: setup.valid ? "passed" : "failed" }];
+  const manager = detectPackageManager(root);
+  for (const name2 of ["typecheck", "lint", "test", "build"]) {
+    if (!pkg.scripts?.[name2]) continue;
+    const result = runChecks ? spawnSync2(manager, ["run", name2], { cwd: root, stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, CI: "true" }, shell: process.platform === "win32", windowsHide: true, timeout: 10 * 6e4 }) : void 0;
+    checks.push({ name: name2, status: result ? result.status === 0 ? "passed" : "failed" : "not-run" });
+  }
+  let branch = null, commitSha = null, dirty = true;
+  try {
+    branch = git(["branch", "--show-current"], root);
+    commitSha = git(["rev-parse", "HEAD"], root);
+    dirty = Boolean(git(["status", "--porcelain"], root));
+  } catch {
+  }
+  const outputDirectory = ["dist", "build", "out", "."].find((directory2) => existsSync4(join3(root, directory2, "index.html"))) ?? null;
+  return { framework, sdkVersion: dependencies["@backifydev/sdk"] ?? null, branch, commitSha, dirty, buildCommand: pkg.scripts?.build ? manager + " run build" : null, outputDirectory, hasDockerfile: existsSync4(join3(root, "Dockerfile")), checks };
+}
+function matchesSource(release2, commit) {
+  return release2?.commitSha === commit || release2?.sourceCommitSha === commit;
+}
+function pushSource(appId, commit, branch, destination, root, environment) {
+  const remoteHead = git(["ls-remote", "--", destination, "refs/heads/" + branch], root, environment).split(/\s+/)[0];
+  if (remoteHead === commit) return true;
+  if (remoteHead) {
+    git(["fetch", "--no-tags", "--", destination, "refs/heads/" + branch], root, environment);
+    const fetchedHead = git(["rev-parse", "FETCH_HEAD"], root);
+    if (fetchedHead === commit) return true;
+    const parent = git(["show", "-s", "--format=%P", fetchedHead], root);
+    const message = git(["show", "-s", "--format=%B", fetchedHead], root);
+    if (parent === commit && message === "Backify build " + applicationGuid(appId).replaceAll("-", "") + ": " + commit) return true;
+    if (git(["merge-base", commit, fetchedHead], root) !== fetchedHead) throw new Error("Remote history contains other changes. Run backify pull and reconcile them before shipping; nothing was pushed or overwritten.");
+  }
+  git(["push", "--", destination, commit + ":refs/heads/" + branch], root, environment);
+  return false;
+}
+async function waitForPreview(call2, prefix, commit, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 20 * 6e4);
+  const sleep = options.sleep ?? ((delay) => new Promise((resolve24) => setTimeout(resolve24, delay)));
+  do {
+    const deployments = await call2(prefix + "/deployments");
+    const matching = deployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit) && !options.previousDeploymentIds?.includes(release2.id));
+    if (matching?.status === "failed") throw new Error("Deployment of this source failed. Run backify status and inspect its deployment steps.");
+    const overview = await call2(prefix + "/releases");
+    if (matchesSource(overview.preview, commit) && overview.preview?.status === "succeeded" && overview.preview.healthResult === "healthy") return overview;
+    const build3 = await call2(prefix + "/developer/build?commitSha=" + commit);
+    if ((options.previousBuildRunId === void 0 || build3.runId !== options.previousBuildRunId) && ["failure", "cancelled", "timed_out", "action_required", "startup_failure"].includes(build3.conclusion ?? "")) throw new Error("GitHub build " + build3.conclusion + ". " + (build3.url ?? "Run backify status for details."));
+    await sleep(options.intervalMs ?? 4e3);
+  } while (Date.now() < deadline);
+  throw new Error("Timed out waiting for this commit's healthy preview. Run backify status; no production release was requested.");
+}
+async function ship(call2, appId, options = {}) {
+  const root = options.root ?? process.cwd(), prefix = "/apps/" + applicationGuid(appId);
+  const status = await call2(prefix + "/developer");
+  if (!status.repository || !status.branch || !status.workflowReady) throw new Error("The application's repository and build workflow must be connected in Backify.");
+  if (!doctor(root).valid) throw new Error("Run backify doctor and fix project setup before shipping.");
+  if (applicationGuid(projectApplication(root)) !== applicationGuid(appId)) throw new Error("Local application ID does not match the application being shipped.");
+  const actualRoot = git(["rev-parse", "--show-toplevel"], root);
+  if (resolve3(actualRoot).toLowerCase() !== resolve3(root).toLowerCase()) throw new Error("Shipping currently requires the application at the repository root.");
+  const origin = git(["remote", "get-url", "origin"], root);
+  const pushOrigin = git(["remote", "get-url", "--push", "origin"], root);
+  if (repositoryName(origin) !== status.repository.toLowerCase() || repositoryName(pushOrigin) !== status.repository.toLowerCase()) throw new Error("Local repository does not match this Backify application.");
+  if (git(["branch", "--show-current"], root) !== status.branch) throw new Error("Use the connected branch: " + status.branch);
+  if (git(["status", "--porcelain"], root)) throw new Error("Commit application changes before shipping. The CLI never stages or commits unrelated files.");
+  const commit = git(["rev-parse", "HEAD"], root);
+  const report = localReport(true, root);
+  await call2(prefix + "/developer/report", { method: "POST", body: JSON.stringify(report) });
+  if (report.checks.some((check) => check.status === "failed")) throw new Error("Checks failed; nothing was pushed.");
+  if (status.hostingTargetType === "backify-cloud" && !report.outputDirectory && !report.hasDockerfile) throw new Error("Backify Cloud requires a static build containing index.html or a Dockerfile serving port 8080.");
+  if (status.hostingTargetType === "azure" && !report.hasDockerfile) throw new Error("Customer Azure requires a repository-root Dockerfile.");
+  if (git(["status", "--porcelain"], root) || git(["rev-parse", "HEAD"], root) !== commit) throw new Error("Checks changed tracked source. Review and commit those changes before shipping.");
+  const previousDeployments = await call2(prefix + "/deployments");
+  const previousBuild = await call2(prefix + "/developer/build?commitSha=" + commit);
+  const credential = await call2(prefix + "/developer/git-credential", { method: "POST" });
+  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed; reconnect before shipping.");
+  const environment = gitEnvironment(status.repository, credential.token);
+  const destination = "https://github.com/" + status.repository + ".git";
+  const alreadyPushed = pushSource(appId, commit, status.branch, destination, root, environment);
+  const currentPreview = previousDeployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit));
+  if (alreadyPushed && (!currentPreview || currentPreview.status === "failed") && !(matchesSource(status.releases.preview, commit) && status.releases.preview?.status === "succeeded")) await call2(prefix + "/deployments/preview", { method: "POST", body: JSON.stringify({ sourceRevision: "latest" }) });
+  const overview = await waitForPreview(call2, prefix, commit, { timeoutMs: options.timeoutMs, previousDeploymentIds: previousDeployments.filter((deployment) => deployment.status === "failed").map((deployment) => deployment.id), previousBuildRunId: previousBuild.runId ?? null });
+  if (overview.preview.commitSha !== commit) {
+    if (git(["status", "--porcelain"], root) || git(["rev-parse", "HEAD"], root) !== commit) throw new Error("Local work changed while the preview built. Review it before synchronizing the build commit.");
+    const refreshed = await call2(prefix + "/developer/git-credential", { method: "POST" });
+    if (refreshed.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed while building.");
+    git(["fetch", "--", destination, "refs/heads/" + status.branch], root, gitEnvironment(status.repository, refreshed.token));
+    git(["merge", "--ff-only", overview.preview.commitSha], root);
+  }
+  return publishPreview(call2, prefix, overview, options);
+}
+async function publishPreview(call2, prefix, overview, options = {}) {
+  if (!overview.preview || overview.preview.status !== "succeeded" || overview.preview.healthResult !== "healthy") throw new Error("Only a verified healthy preview can be published.");
+  const preview = overview.preview;
+  if (options.previewOnly) return { status: "preview-ready", url: preview.url };
+  if (overview.policy.requirePreviewTesting && !preview.testedAt) return { status: "testing-required", url: preview.url };
+  if (overview.live?.previewDeploymentId === preview.id && overview.live.status === "succeeded") return { status: "live", url: overview.live.url };
+  const promotion = await call2(prefix + "/deployments/promote", { method: "POST", headers: { "Idempotency-Key": "cli-ship-" + preview.id }, body: JSON.stringify({ previewDeploymentId: preview.id, tested: false }) });
+  if (promotion.status === "awaiting-approval" || promotion.approvalId) return { status: "awaiting-approval", url: preview.url };
+  if (!promotion.operationId) throw new Error("Publication returned no operation to verify. Run backify status.");
+  const deadline = Date.now() + (options.timeoutMs ?? 20 * 6e4);
+  do {
+    const operation = await call2("/operations/" + promotion.operationId);
+    if (operation.status === "failed" || operation.status === "cancelled") throw new Error(operation.errorMessage ?? "Production deployment did not complete.");
+    if (operation.status === "succeeded") {
+      const releases = await call2(prefix + "/releases");
+      if (releases.live?.previewDeploymentId !== preview.id || releases.live.status !== "succeeded" || releases.live.healthResult !== "healthy") throw new Error("Production did not activate this healthy release. Run backify status.");
+      return { status: "live", url: releases.live.url };
+    }
+    await new Promise((resolve24) => setTimeout(resolve24, 4e3));
+  } while (Date.now() < deadline);
+  throw new Error("Publication is still pending. Run backify status; deployment success has not been verified.");
+}
+
+// src/browser-auth.ts
+async function browserAuthenticate(options) {
+  const auth = new URL(apiAddress(options.authUrl));
+  const state = randomBytes(32).toString("base64url");
+  let resolveSession = () => {
+  };
+  let rejectSession = () => {
+  };
+  const completed = new Promise((resolve24, reject) => {
+    resolveSession = resolve24;
+    rejectSession = reject;
+  });
+  let accepted = false;
+  const server = createServer((request, response) => {
+    if (request.headers.origin !== auth.origin) {
+      response.writeHead(403);
+      response.end();
+      return;
+    }
+    response.setHeader("Access-Control-Allow-Origin", auth.origin);
+    response.setHeader("Vary", "Origin");
+    response.setHeader("Cache-Control", "no-store");
+    if (accepted) {
+      response.writeHead(409);
+      response.end();
+      return;
+    }
+    if (request.url !== "/callback") {
+      response.writeHead(404);
+      response.end();
+      return;
+    }
+    if (request.method === "OPTIONS") {
+      response.writeHead(204, { "Access-Control-Allow-Methods": "POST", "Access-Control-Allow-Headers": "content-type", "Access-Control-Allow-Private-Network": "true" });
+      response.end();
+      return;
+    }
+    if (request.method !== "POST" || !request.headers["content-type"]?.startsWith("application/json")) {
+      response.writeHead(405);
+      response.end();
+      return;
+    }
+    let raw = "";
+    request.setEncoding("utf8");
+    request.on("data", (part) => {
+      raw += part;
+      if (raw.length > 65536) request.destroy();
+    });
+    request.on("end", () => {
+      try {
+        const value = JSON.parse(raw);
+        if (value.state !== state || typeof value.token !== "string" || !value.token || value.token.length > 32768 || typeof value.organizationId !== "string" || !/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value.organizationId) || options.organizationId && value.organizationId !== options.organizationId) throw new Error("Invalid callback");
+        if (options.applicationId && (value.applicationId !== options.applicationId || !/^bfcli_[0-9a-f]{64}$/i.test(value.token) || typeof value.expiresAt !== "string" || !Number.isFinite(Date.parse(value.expiresAt)) || Date.parse(value.expiresAt) <= Date.now() || Date.parse(value.expiresAt) > Date.now() + 90 * 864e5 + 6e4)) throw new Error("Invalid application session");
+        const session = { token: value.token, organizationId: value.organizationId, apiUrl: options.apiUrl, ...options.applicationId ? { expiresAt: value.expiresAt } : {} };
+        options.save(session);
+        accepted = true;
+        response.writeHead(200, { "Content-Type": "text/plain" });
+        response.end("Backify CLI connected. You can close this tab.");
+        resolveSession(session);
+      } catch {
+        response.writeHead(400);
+        response.end("The CLI could not accept or save this connection. Retry or start a new CLI sign-in.");
+      }
+    });
+  });
+  server.on("error", rejectSession);
+  server.listen(0, "127.0.0.1", () => {
+    try {
+      const address = server.address();
+      if (!address || typeof address === "string") throw new Error("Could not start the local CLI callback.");
+      auth.searchParams.set("cli_callback", "http://127.0.0.1:" + address.port + "/callback");
+      auth.searchParams.set("cli_state", state);
+      if (options.applicationId) auth.searchParams.set("cli_app", options.applicationId);
+      if (options.organizationId) auth.searchParams.set("cli_organization", options.organizationId);
+      auth.searchParams.set("cli_device", JSON.stringify(cliDevice()));
+      options.openBrowser(auth.toString());
+    } catch (error) {
+      rejectSession(error instanceof Error ? error : new Error("Could not open sign-in."));
+    }
+  });
+  const timeout = setTimeout(() => rejectSession(new Error("Backify sign-in timed out. Ask the user to sign in and run backify connect --reauth again.")), options.timeoutMs ?? 5 * 6e4);
+  try {
+    return await completed;
+  } finally {
+    clearTimeout(timeout);
+    server.close();
+    server.closeAllConnections();
+  }
+}
+function reconnectingApiClient(session, reconnect, transport = fetch) {
+  let current = session;
+  let pending;
+  return async (path, init) => {
+    const attempted = current;
+    try {
+      return await apiClient(attempted, transport)(path, init);
+    } catch (error) {
+      if (!(error instanceof CliAuthenticationRequired)) throw error;
+      if (current === attempted) {
+        pending ??= reconnect().then((updated) => {
+          current = updated;
+          return updated;
+        }).finally(() => {
+          pending = void 0;
+        });
+        await pending;
+      }
+      return apiClient(current, transport)(path, init);
+    }
+  };
+}
+
+// src/local-runtime.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync, existsSync as existsSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join4, resolve as resolve4, sep } from "node:path";
+import { homedir } from "node:os";
+import { spawnSync as spawnSync3 } from "node:child_process";
+
+// src/local-state.ts
+import { renameSync as renameSync2 } from "node:fs";
+function replaceLocalFile(source, destination, rename, platform2, wait) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      rename(source, destination);
+      return;
+    } catch (error) {
+      if (platform2 !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
+      wait(10 * 2 ** attempt);
+    }
+  }
+}
+function renameLocalFile(source, destination) {
+  replaceLocalFile(source, destination, renameSync2, process.platform, (milliseconds) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds));
+}
+
+// src/local-runtime.ts
+var maxArchiveBytes = 256 * 1024 * 1024;
+var maxExpandedBytes = 512 * 1024 * 1024;
+var hash = (bytes) => createHash2("sha256").update(bytes).digest("hex");
+function runtimeIdentifier(platform2 = process.platform, architecture = process.arch) {
+  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform2];
+  if (!system || !["x64", "arm64"].includes(architecture)) throw new Error("Local runtime supports Windows, macOS and Linux on x64/arm64");
+  return system + "-" + architecture;
+}
+function checkedPath(root, filename2) {
+  const target = resolve4(root, filename2);
+  if (target !== resolve4(root) && !target.startsWith(resolve4(root) + sep)) throw new Error("Runtime path escapes its installation");
+  let current = target;
+  while (true) {
+    if (existsSync5(current) && lstatSync3(current).isSymbolicLink()) throw new Error("Runtime installation must not follow links");
+    if (dirname5(current) === current) break;
+    current = dirname5(current);
+  }
+  return target;
+}
+function verifyInstallationFiles(root, expected, directory2 = root) {
+  for (const entry of readdirSync3(directory2, { withFileTypes: true })) {
+    const path = checkedPath(root, join4(directory2, entry.name));
+    if (entry.isDirectory()) verifyInstallationFiles(root, expected, path);
+    else if (!entry.isFile() || !Object.hasOwn(expected, path.slice(root.length + 1).split(sep).join("/"))) throw new Error("Installed runtime contains unexpected files; reinstall a reviewed version");
+  }
+}
+function installedLocalRuntime(base = join4(homedir(), ".backify")) {
+  const pointer = checkedPath(base, "runtime.json");
+  if (!existsSync5(pointer)) return void 0;
+  const installed = JSON.parse(readFileSync4(pointer, "utf8"));
+  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(installed.version) || installed.rid !== runtimeIdentifier() || !installed.files || Object.keys(installed.files).length > 3e3) throw new Error("Invalid local runtime installation receipt");
+  const root = checkedPath(base, join4("runtimes", installed.version, installed.rid));
+  verifyInstallationFiles(root, installed.files);
+  for (const [filename2, digest4] of Object.entries(installed.files)) {
+    const path = checkedPath(root, filename2);
+    if (!/^[a-f0-9]{64}$/.test(digest4) || !lstatSync3(path).isFile() || lstatSync3(path).size > maxArchiveBytes || hash(readFileSync4(path)) !== digest4) throw new Error("Installed runtime bytes changed; reinstall a reviewed version");
+  }
+  const executableName = installed.rid.startsWith("win-") ? "Backify.Hcr.exe" : "Backify.Hcr";
+  if (!installed.files["Backify.Hcr.dll"] || !installed.files[executableName]) throw new Error("Runtime archive requires the self-contained HCR executable and DLL");
+  return { path: join4(root, "Backify.Hcr.dll"), executable: join4(root, executableName), version: installed.version, rid: installed.rid };
+}
+function installLocalRuntime(archive, options) {
+  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(options.version) || !/^[a-f0-9]{64}$/.test(options.sha256)) throw new Error("Provide a release version vX.Y.Z and an independently reviewed SHA-256");
+  if (archive.byteLength > maxArchiveBytes || hash(archive) !== options.sha256) throw new Error("Runtime archive digest does not match the reviewed SHA-256");
+  let expanded = 0, count = 0;
+  const files = unzipSync(archive, { filter: (file) => {
+    if (++count > 3e3 || (expanded += file.originalSize) > maxExpandedBytes || file.originalSize > maxArchiveBytes) throw new Error("Runtime archive exceeds extraction limits");
+    if (!file.name || file.name.includes("\\") || file.name.startsWith("/") || file.name.includes(":") || file.name.split("/").some((part) => part === "." || part === "..")) throw new Error("Runtime archive contains an unsafe path");
+    return !file.name.endsWith("/");
+  } });
+  const rid = runtimeIdentifier();
+  const executable = rid.startsWith("win-") ? "Backify.Hcr.exe" : "Backify.Hcr";
+  if (!files["Backify.Hcr.dll"] || !files[executable] || !files["sql/events-v1.sql"] || !files["sql/jobs-v1.sql"]) throw new Error("Runtime archive is missing required host assets");
+  const base = options.base ?? join4(homedir(), ".backify");
+  const parent = checkedPath(base, join4("runtimes", options.version));
+  mkdirSync3(parent, { recursive: true, mode: 448 });
+  const destination = checkedPath(parent, rid);
+  const receipt = { version: options.version, rid, files: Object.fromEntries(Object.entries(files).map(([name2, bytes]) => [name2, hash(bytes)])) };
+  if (!existsSync5(destination)) {
+    const staging = checkedPath(parent, ".install-" + randomUUID2());
+    mkdirSync3(staging, { mode: 448 });
+    for (const [name2, bytes] of Object.entries(files)) {
+      const filename2 = checkedPath(staging, name2);
+      mkdirSync3(dirname5(filename2), { recursive: true, mode: 448 });
+      writeFileSync5(filename2, bytes, { flag: "wx", mode: name2 === executable ? 448 : 384 });
+    }
+    if (process.platform !== "win32") chmodSync(join4(staging, executable), 448);
+    renameLocalFile(staging, destination);
+  } else {
+    verifyInstallationFiles(destination, receipt.files);
+    for (const [name2, digest4] of Object.entries(receipt.files)) if (hash(readFileSync4(checkedPath(destination, name2))) !== digest4) throw new Error("Runtime version already exists with different bytes; never overwrite an installation");
+  }
+  const pointer = checkedPath(base, "runtime.json");
+  const temporary = checkedPath(base, ".runtime-" + randomUUID2() + ".json");
+  writeFileSync5(temporary, JSON.stringify(receipt), { flag: "wx", mode: 384 });
+  renameLocalFile(temporary, pointer);
+  return installedLocalRuntime(base);
+}
+async function downloadLocalRuntime(version) {
+  if (!/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(version)) throw new Error("Provide a release version vX.Y.Z");
+  let url = new URL("https://github.com/frejnorling/backify/releases/download/runtime-" + version + "/backify-hcr-" + runtimeIdentifier() + ".zip");
+  for (let redirects = 0; redirects < 5; redirects++) {
+    if (url.protocol !== "https:" || !["github.com", "release-assets.githubusercontent.com", "objects.githubusercontent.com"].includes(url.hostname) || url.username || url.password) throw new Error("Runtime download left the approved release hosts");
+    const response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(6e4) });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      url = new URL(response.headers.get("location") ?? "", url);
+      continue;
+    }
+    if (!response.ok || !response.body) throw new Error("The requested runtime release is unavailable");
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.byteLength;
+      if (size > maxArchiveBytes) throw new Error("Runtime archive exceeds its size limit");
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+  }
+  throw new Error("Too many runtime download redirects");
+}
+function localPrerequisites() {
+  const runtime = installedLocalRuntime();
+  const directory2 = process.env.BACKIFY_LOCAL_POSTGRES_BIN ?? (process.platform === "win32" ? join4(process.env.ProgramFiles ?? "C:/Program Files", "PostgreSQL", "17", "bin") : void 0);
+  const checks = ["initdb", "pg_ctl", "psql"].map((name2) => {
+    const executable = directory2 ? join4(directory2, name2 + (process.platform === "win32" ? ".exe" : "")) : name2;
+    const result = spawnSync3(executable, ["--version"], { windowsHide: true, timeout: 1e4, encoding: "utf8" });
+    return { name: name2, available: result.status === 0 };
+  });
+  return { rid: runtimeIdentifier(), runtime: runtime ? { installed: true, version: runtime.version } : { installed: false }, postgres: checks, ready: !!runtime && checks.every((check) => check.available) };
+}
+
+// src/workload.ts
+import { build as build2 } from "esbuild";
+import { createHash as createHash14 } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync19, realpathSync as realpathSync6, readdirSync as readdirSync6, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname13, isAbsolute as isAbsolute14, join as join13, relative as relative8, resolve as resolve18 } from "node:path";
+
+// src/local-development.ts
+import { context as context2 } from "esbuild";
+import { spawn as spawn4 } from "node:child_process";
+import { randomBytes as randomBytes6, randomUUID as randomUUID9, createHash as createHash13 } from "node:crypto";
+import { existsSync as existsSync11, lstatSync as lstatSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync18, realpathSync as realpathSync5, writeFileSync as writeFileSync10, unlinkSync as unlinkSync4 } from "node:fs";
+import { resolve as resolve17, join as join12, relative as relative7, isAbsolute as isAbsolute13, dirname as dirname12 } from "node:path";
+
+// ../analyzer/dist/index.js
+import ts2 from "typescript";
+import { readFileSync as readFileSync5, readdirSync as readdirSync4, existsSync as existsSync6 } from "node:fs";
+import { join as join5, extname } from "node:path";
+
+// ../analyzer/dist/authentication.js
+import ts from "typescript";
+function analyzeAuthentication(files) {
+  const providers = /* @__PURE__ */ new Set();
+  const dynamicFiles = /* @__PURE__ */ new Set();
+  let used = false;
+  for (const file of files) {
+    const sourcePath = file.path.replaceAll(String.fromCharCode(92), "/");
+    const source = ts.createSourceFile(sourcePath, file.content, ts.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+    const program = ts.createProgram([sourcePath], { noLib: true, noResolve: true, allowJs: true }, {
+      getSourceFile: (path) => path === sourcePath ? source : void 0,
+      getDefaultLibFileName: () => "",
+      writeFile: () => {
+      },
+      getCurrentDirectory: () => "/",
+      getDirectories: () => [],
+      fileExists: (path) => path === sourcePath,
+      readFile: (path) => path === sourcePath ? file.content : void 0,
+      getCanonicalFileName: (path) => path,
+      useCaseSensitiveFileNames: () => true,
+      getNewLine: () => String.fromCharCode(10)
+    });
+    const checker = program.getTypeChecker();
+    const authSymbols = /* @__PURE__ */ new Set(), namespaceSymbols = /* @__PURE__ */ new Set(), rootSymbols = /* @__PURE__ */ new Set(), factorySymbols = /* @__PURE__ */ new Set();
+    const contains = (symbols, node) => {
+      const symbol = checker.getSymbolAtLocation(node);
+      return symbol !== void 0 && symbols.has(symbol);
+    };
+    for (const statement of source.statements) {
+      if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || !["@backifydev/sdk", "@backifydev/sdk/server"].includes(statement.moduleSpecifier.text) || statement.importClause?.isTypeOnly)
+        continue;
+      const bindings = statement.importClause?.namedBindings;
+      if (bindings && ts.isNamespaceImport(bindings)) {
+        const symbol = checker.getSymbolAtLocation(bindings.name);
+        if (symbol)
+          namespaceSymbols.add(symbol);
+      }
+      if (bindings && ts.isNamedImports(bindings))
+        for (const item of bindings.elements) {
+          if (item.isTypeOnly)
+            continue;
+          const imported = (item.propertyName ?? item.name).text, symbol = checker.getSymbolAtLocation(item.name);
+          if (!symbol)
+            continue;
+          if (imported === "auth")
+            authSymbols.add(symbol);
+          if (imported === "backify")
+            rootSymbols.add(symbol);
+          if (imported === "createServerClient")
+            factorySymbols.add(symbol);
+        }
+    }
+    const isNamespace = (expression) => ts.isIdentifier(expression) && contains(namespaceSymbols, expression);
+    const isFactory = (expression) => ts.isIdentifier(expression) ? contains(factorySymbols, expression) : ts.isPropertyAccessExpression(expression) && expression.name.text === "createServerClient" && isNamespace(expression.expression);
+    const isRoot = (expression) => ts.isIdentifier(expression) ? contains(rootSymbols, expression) : ts.isCallExpression(expression) ? isFactory(expression.expression) : ts.isPropertyAccessExpression(expression) && expression.name.text === "backify" && isNamespace(expression.expression);
+    const isAuth = (expression) => ts.isIdentifier(expression) ? contains(authSymbols, expression) : ts.isPropertyAccessExpression(expression) && expression.name.text === "auth" && (isRoot(expression.expression) || isNamespace(expression.expression));
+    const register = (symbols, identifier2) => {
+      const symbol = checker.getSymbolAtLocation(identifier2);
+      if (symbol)
+        symbols.add(symbol);
+    };
+    const collectRoots = (node) => {
+      if (ts.isVariableDeclaration(node) && node.initializer) {
+        if (ts.isIdentifier(node.name)) {
+          if (isRoot(node.initializer))
+            register(rootSymbols, node.name);
+          if (isAuth(node.initializer))
+            register(authSymbols, node.name);
+        } else if (ts.isObjectBindingPattern(node.name)) {
+          for (const binding of node.name.elements) {
+            if (!ts.isIdentifier(binding.name) || binding.dotDotDotToken || binding.initializer)
+              continue;
+            const property = binding.propertyName ?? binding.name;
+            if (!ts.isIdentifier(property) && !ts.isStringLiteral(property))
+              continue;
+            if (property.text === "auth" && (isRoot(node.initializer) || isNamespace(node.initializer)))
+              register(authSymbols, binding.name);
+            if (property.text === "backify" && isNamespace(node.initializer))
+              register(rootSymbols, binding.name);
+            if (property.text === "createServerClient" && isNamespace(node.initializer))
+              register(factorySymbols, binding.name);
+          }
+        }
+      }
+      ts.forEachChild(node, collectRoots);
+    };
+    let previousSize = -1;
+    while (previousSize !== authSymbols.size + rootSymbols.size + factorySymbols.size) {
+      previousSize = authSymbols.size + rootSymbols.size + factorySymbols.size;
+      collectRoots(source);
+    }
+    const visit = (node) => {
+      if (ts.isIdentifier(node) && contains(authSymbols, node) && !ts.isImportSpecifier(node.parent) && !ts.isTypeReferenceNode(node.parent) && !ts.isTypeQueryNode(node.parent) && !ts.isExportSpecifier(node.parent))
+        used = true;
+      if (ts.isPropertyAccessExpression(node) && isAuth(node))
+        used = true;
+      if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === "signIn" && isAuth(node.expression.expression)) {
+        const options = node.arguments[0];
+        if (options) {
+          const property = ts.isObjectLiteralExpression(options) ? options.properties.find((value) => ts.isPropertyAssignment(value) && (ts.isIdentifier(value.name) || ts.isStringLiteral(value.name)) && value.name.text === "provider") : void 0;
+          if (property && ts.isPropertyAssignment(property) && ts.isStringLiteral(property.initializer) && (!ts.isObjectLiteralExpression(options) || !options.properties.some(ts.isSpreadAssignment)))
+            providers.add(property.initializer.text);
+          else
+            dynamicFiles.add(file.path);
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(source);
+  }
+  return { used, providers: [...providers].sort(), dynamicFiles: [...dynamicFiles].sort() };
+}
+
+// ../analyzer/dist/index.js
+var bypass = { "@azure/storage-blob": { capability: "storage", replacement: "storage" }, "@aws-sdk/client-s3": { capability: "storage", replacement: "storage" }, "firebase-admin": { capability: "database", replacement: "db" }, "@supabase/supabase-js": { capability: "database", replacement: "db" }, "@azure/service-bus": { capability: "jobs", replacement: "jobs" } };
+function analyzeSources(files, options = {}) {
+  const used = /* @__PURE__ */ new Set(), diagnostics = [];
+  for (const file of files)
+    analyzeFile(file, used, diagnostics);
+  if (used.has("http"))
+    used.add("events");
+  const authentication = analyzeAuthentication(files);
+  if (authentication.used)
+    used.add("auth");
+  else
+    used.delete("auth");
+  const capabilities = Object.fromEntries([...used].sort().map((name2) => [name2, { version: CAPABILITY_REGISTRY[name2].version }]));
+  if (capabilities.auth && (authentication.providers.length || authentication.dynamicFiles.length))
+    capabilities.auth.configuration = { providers: authentication.providers, dynamicProviders: authentication.dynamicFiles.length > 0 };
+  for (const file of authentication.dynamicFiles)
+    diagnostics.push({ severity: "warning", code: "dynamic-auth-provider", file, docs: CAPABILITY_REGISTRY.auth.docs, message: "Declare every possible authentication provider in backify.yaml; dynamic provider selection cannot be provisioned from source alone." });
+  for (const provider of authentication.providers)
+    if (!["entra", "google", "email"].includes(provider))
+      diagnostics.push({ severity: "error", code: "unsupported-auth-provider", docs: CAPABILITY_REGISTRY.auth.docs, message: "Authentication provider is not implemented: " + provider });
+  return { schemaVersion: 1, applicationId: options.applicationId ?? "unknown", commit: options.commit ?? "unknown", sdkVersion: options.sdkVersion ?? "unknown", capabilities, diagnostics };
+}
+function analyzeFile(file, used, diagnostics) {
+  const source = ts2.createSourceFile(file.path, file.content, ts2.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts2.ScriptKind.TSX : ts2.ScriptKind.TS), named = /* @__PURE__ */ new Map(), namespaces = /* @__PURE__ */ new Set(), roots = /* @__PURE__ */ new Set(), factories = /* @__PURE__ */ new Set();
+  source.forEachChild((node) => {
+    if (!ts2.isImportDeclaration(node) || !ts2.isStringLiteral(node.moduleSpecifier))
+      return;
+    const module = node.moduleSpecifier.text;
+    if (bypass[module]) {
+      const rule = bypass[module];
+      diagnostics.push({ severity: "warning", code: "direct-provider-sdk", file: file.path, docs: CAPABILITY_REGISTRY[rule.capability].docs, message: `Direct provider dependency '${module}' detected. Use import { ${rule.replacement} } from "@backifydev/sdk" so Backify can provision and bind ${rule.capability}.` });
+    }
+    if (module !== "@backifydev/sdk" && module !== "@backifydev/sdk/server" || !node.importClause)
+      return;
+    const bindings = node.importClause.namedBindings;
+    if (!bindings)
+      return;
+    if (ts2.isNamespaceImport(bindings))
+      namespaces.add(bindings.name.text);
+    else if (ts2.isNamedImports(bindings))
+      for (const element of bindings.elements) {
+        const imported = (element.propertyName ?? element.name).text, local = element.name.text;
+        if (imported === "createServerClient")
+          factories.add(local);
+        else if (imported === "backify")
+          roots.add(local);
+        else {
+          const cap = SDK_IMPORT_CAPABILITIES[imported];
+          if (cap)
+            named.set(local, cap);
+        }
+      }
+  });
+  const visit = (node) => {
+    if (ts2.isVariableDeclaration(node) && ts2.isIdentifier(node.name) && node.initializer && ts2.isCallExpression(node.initializer) && ts2.isIdentifier(node.initializer.expression) && factories.has(node.initializer.expression.text))
+      roots.add(node.name.text);
+    if (ts2.isCallExpression(node) && ts2.isIdentifier(node.expression) && named.get(node.expression.text) === "jobs" && node.arguments.some((argument) => ts2.isObjectLiteralExpression(argument) && argument.properties.some((property) => ts2.isPropertyAssignment(property) && property.name.getText(source) === "schedule")))
+      used.add("scheduler");
+    if (ts2.isIdentifier(node)) {
+      const parent = node.parent;
+      if (named.has(node.text) && !ts2.isImportSpecifier(parent) && isValueUse(node))
+        used.add(named.get(node.text));
+    }
+    if (ts2.isPropertyAccessExpression(node)) {
+      if (ts2.isIdentifier(node.expression)) {
+        if (namespaces.has(node.expression.text)) {
+          const cap = SDK_IMPORT_CAPABILITIES[node.name.text];
+          if (cap)
+            used.add(cap);
+        }
+        if (roots.has(node.expression.text)) {
+          const cap = SDK_IMPORT_CAPABILITIES[node.name.text];
+          if (cap)
+            used.add(cap);
+        }
+      }
+      if (node.name.text === "schedule" && rootCapability(node.expression, named, namespaces, roots) === "jobs")
+        used.add("scheduler");
+    }
+    ts2.forEachChild(node, visit);
+  };
+  visit(source);
+}
+function isValueUse(node) {
+  const p = node.parent;
+  return !(ts2.isImportSpecifier(p) || ts2.isExportSpecifier(p) || ts2.isTypeReferenceNode(p) || ts2.isTypeQueryNode(p));
+}
+function rootCapability(node, named, namespaces, roots) {
+  if (ts2.isIdentifier(node))
+    return named.get(node.text);
+  if (ts2.isPropertyAccessExpression(node) && ts2.isIdentifier(node.expression)) {
+    if (namespaces.has(node.expression.text) || roots.has(node.expression.text))
+      return SDK_IMPORT_CAPABILITIES[node.name.text];
+  }
+  return void 0;
+}
+function repositorySources(root) {
+  const result = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+      if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".backify" || entry.name.startsWith(".git"))
+        continue;
+      const path = join5(dir, entry.name);
+      if (entry.isDirectory())
+        walk(path);
+      else if ([".ts", ".tsx", ".js", ".jsx", ".mts", ".mjs"].includes(extname(path)))
+        result.push({ path, content: readFileSync5(path, "utf8") });
+    }
+  };
+  if (existsSync6(root))
+    walk(root);
+  return result;
+}
+
+// src/local-inspection.ts
+function createLocalDataInspector(runtime, options) {
   const tableName = (value) => typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(value) && !/^__backify/i.test(value);
   const bucketName = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(value);
   if (typeof window !== "undefined" || options.buckets.length > 100 || options.buckets.some((name2) => !bucketName(name2)) || new Set(options.buckets).size !== options.buckets.length) throw new Error("invalid_local_inspection");
@@ -18472,9 +19186,9 @@ function createLocalNativeEvents(local, native) {
 
 // src/local-job-executor.ts
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
-import { lstatSync as lstatSync9, readFileSync as readFileSync9 } from "node:fs";
-import { isAbsolute as isAbsolute7, join as join5, relative as relative3, resolve as resolve9 } from "node:path";
+import { createHash as createHash10 } from "node:crypto";
+import { lstatSync as lstatSync11, readFileSync as readFileSync12 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join8, relative as relative3, resolve as resolve11 } from "node:path";
 
 // ../sdk/dist/schedules.js
 var import_cron_parser = __toESM(require_dist2(), 1);
@@ -18685,28 +19399,28 @@ function createApplicationAuthProvider(source, options) {
 }
 
 // ../sdk/dist/application-auth-state.js
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { closeSync, constants, fstatSync, fsyncSync, lstatSync as lstatSync2, openSync, readSync, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, isAbsolute, parse, resolve as resolve3, sep as sep2 } from "node:path";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync as lstatSync4, openSync, readSync, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute2, parse, resolve as resolve5, sep as sep2 } from "node:path";
 function unavailable2() {
   throw new ApplicationAuthenticationError("application_identity_unavailable");
 }
 function safePath(filename2) {
-  if (!isAbsolute(filename2) || resolve3(filename2) !== filename2 || filename2 === parse(filename2).root)
+  if (!isAbsolute2(filename2) || resolve5(filename2) !== filename2 || filename2 === parse(filename2).root)
     unavailable2();
   if (process.platform === "win32" && filename2.slice(parse(filename2).root.length).split(sep2).some((component) => component.includes(":") || /[. ]$/.test(component) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(component)))
     unavailable2();
-  const directory2 = dirname3(filename2);
+  const directory2 = dirname6(filename2);
   let ancestor = directory2;
   for (; ; ) {
-    const metadata = lstatSync2(ancestor);
+    const metadata = lstatSync4(ancestor);
     if (!metadata.isDirectory() || metadata.isSymbolicLink())
       unavailable2();
     if (ancestor === parse(ancestor).root)
       break;
-    ancestor = dirname3(ancestor);
+    ancestor = dirname6(ancestor);
   }
-  const parent = lstatSync2(directory2);
+  const parent = lstatSync4(directory2);
   if (process.platform !== "win32" && ((parent.mode & 63) !== 0 || parent.uid !== process.getuid?.()))
     unavailable2();
 }
@@ -18717,7 +19431,7 @@ function safeFile(metadata) {
 function syncDirectory(filename2) {
   if (process.platform === "win32")
     return;
-  const descriptor2 = openSync(dirname3(filename2), constants.O_RDONLY | constants.O_DIRECTORY);
+  const descriptor2 = openSync(dirname6(filename2), constants.O_RDONLY | constants.O_DIRECTORY);
   try {
     fsyncSync(descriptor2);
   } finally {
@@ -18725,7 +19439,7 @@ function syncDirectory(filename2) {
   }
 }
 function readState(filename2) {
-  const metadata = lstatSync2(filename2);
+  const metadata = lstatSync4(filename2);
   safeFile(metadata);
   if (metadata.size > 2048)
     unavailable2();
@@ -18758,30 +19472,30 @@ function readState(filename2) {
   }
 }
 function persist(filename2, state) {
-  const temporary = filename2 + "." + randomUUID2() + ".tmp";
+  const temporary = filename2 + "." + randomUUID3() + ".tmp";
   const descriptor2 = openSync(temporary, "wx", 384);
   try {
-    writeFileSync3(descriptor2, JSON.stringify(state));
+    writeFileSync6(descriptor2, JSON.stringify(state));
     fsyncSync(descriptor2);
   } finally {
     closeSync(descriptor2);
   }
-  renameSync2(temporary, filename2);
+  renameSync3(temporary, filename2);
   syncDirectory(filename2);
 }
 function checkpoint(filename2, trust, initialize2) {
   try {
-    if (!isAbsolute(filename2))
+    if (!isAbsolute2(filename2))
       unavailable2();
-    filename2 = resolve3(filename2);
+    filename2 = resolve5(filename2);
     safePath(filename2);
     const lock = filename2 + ".lock";
-    const next = { version: 1, scope: trust.scope, revision: trust.revision, digest: createHash2("sha256").update(trust.content).digest("hex") };
+    const next = { version: 1, scope: trust.scope, revision: trust.revision, digest: createHash3("sha256").update(trust.content).digest("hex") };
     if (!initialize2) {
       const previous = readState(filename2);
       if (previous.scope.organizationId === next.scope.organizationId && previous.scope.applicationId === next.scope.applicationId && previous.scope.environmentId === next.scope.environmentId && previous.revision === next.revision && previous.digest === next.digest) {
         try {
-          lstatSync2(lock);
+          lstatSync4(lock);
         } catch (error) {
           if (error.code === "ENOENT")
             return;
@@ -18792,7 +19506,7 @@ function checkpoint(filename2, trust, initialize2) {
     }
     const descriptor2 = openSync(lock, "wx", 384);
     try {
-      writeFileSync3(descriptor2, "backify-application-auth-state-v1");
+      writeFileSync6(descriptor2, "backify-application-auth-state-v1");
       fsyncSync(descriptor2);
     } finally {
       closeSync(descriptor2);
@@ -18802,7 +19516,7 @@ function checkpoint(filename2, trust, initialize2) {
     try {
       if (initialize2) {
         try {
-          lstatSync2(filename2);
+          lstatSync4(filename2);
           unavailable2();
         } catch (error) {
           if (error.code !== "ENOENT")
@@ -18839,18 +19553,18 @@ function createPersistentApplicationAuthProvider(source, options) {
 }
 
 // ../sdk/dist/application-auth-sync.js
-import { createHash as createHash3, createPublicKey as createPublicKey2, randomUUID as randomUUID3, verify as verify2 } from "node:crypto";
-import { closeSync as closeSync2, constants as constants2, fsyncSync as fsyncSync2, lstatSync as lstatSync3, openSync as openSync2, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, parse as parse2, resolve as resolve4, sep as sep3 } from "node:path";
+import { createHash as createHash4, createPublicKey as createPublicKey2, randomUUID as randomUUID4, verify as verify2 } from "node:crypto";
+import { closeSync as closeSync2, constants as constants2, fsyncSync as fsyncSync2, lstatSync as lstatSync5, openSync as openSync2, readFileSync as readFileSync6, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname7, isAbsolute as isAbsolute3, parse as parse2, resolve as resolve6, sep as sep3 } from "node:path";
 var maximumBytes = 512 * 1024;
 var identifier = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) && value !== "00000000-0000-0000-0000-000000000000";
 function unavailable3() {
   throw new ApplicationAuthenticationError("application_identity_unavailable");
 }
 function filename(value) {
-  if (typeof value !== "string" || /[\x00-\x1f\x7f]/.test(value) || !isAbsolute2(value))
+  if (typeof value !== "string" || /[\x00-\x1f\x7f]/.test(value) || !isAbsolute3(value))
     unavailable3();
-  const result = resolve4(value);
+  const result = resolve6(value);
   if (result === parse2(result).root || process.platform === "win32" && result.slice(parse2(result).root.length).split(sep3).some((component) => component.includes(":") || /[. ]$/.test(component) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(component)))
     unavailable3();
   return result;
@@ -18879,28 +19593,28 @@ function prepare(options) {
 function planApplicationAuthSynchronization(options) {
   try {
     const prepared = prepare(options);
-    return { schemaVersion: 1, status: "planned", scope: structuredClone(options.expectedScope), agentId: options.agentId, endpoint: prepared.endpoint.href, managementKeySha256: createHash3("sha256").update(prepared.key.export({ type: "spki", format: "der" })).digest("hex"), trustFile: prepared.trustFile, stateFile: prepared.stateFile, requiresInitializedOperatorJournal: true, workloadCredentialsRequired: false, deploymentReady: false };
+    return { schemaVersion: 1, status: "planned", scope: structuredClone(options.expectedScope), agentId: options.agentId, endpoint: prepared.endpoint.href, managementKeySha256: createHash4("sha256").update(prepared.key.export({ type: "spki", format: "der" })).digest("hex"), trustFile: prepared.trustFile, stateFile: prepared.stateFile, requiresInitializedOperatorJournal: true, workloadCredentialsRequired: false, deploymentReady: false };
   } catch {
     return unavailable3();
   }
 }
 function directory(filename2, privateState) {
-  const parent = dirname4(filename2);
-  for (let ancestor = parent; ; ancestor = dirname4(ancestor)) {
-    const metadata2 = lstatSync3(ancestor);
+  const parent = dirname7(filename2);
+  for (let ancestor = parent; ; ancestor = dirname7(ancestor)) {
+    const metadata2 = lstatSync5(ancestor);
     if (!metadata2.isDirectory() || metadata2.isSymbolicLink())
       unavailable3();
     if (ancestor === parse2(ancestor).root)
       break;
   }
-  const metadata = lstatSync3(parent);
+  const metadata = lstatSync5(parent);
   if (process.platform !== "win32" && (metadata.uid !== process.getuid?.() || (metadata.mode & (privateState ? 63 : 18)) !== 0))
     unavailable3();
 }
 function syncDirectory2(filename2) {
   if (process.platform === "win32")
     return;
-  const descriptor2 = openSync2(dirname4(filename2), constants2.O_RDONLY | constants2.O_DIRECTORY);
+  const descriptor2 = openSync2(dirname7(filename2), constants2.O_RDONLY | constants2.O_DIRECTORY);
   try {
     fsyncSync2(descriptor2);
   } finally {
@@ -18909,10 +19623,10 @@ function syncDirectory2(filename2) {
 }
 function currentPublicFile(filename2) {
   try {
-    const metadata = lstatSync3(filename2);
+    const metadata = lstatSync5(filename2);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 131072 || process.platform !== "win32" && (metadata.uid !== process.getuid?.() || (metadata.mode & 18) !== 0))
       unavailable3();
-    const bytes = readFileSync3(filename2);
+    const bytes = readFileSync6(filename2);
     if (bytes.length > 131072)
       unavailable3();
     return new TextDecoder("utf8", { fatal: true }).decode(bytes);
@@ -18979,7 +19693,7 @@ async function synchronizeApplicationAuthTrustWithDigest(options) {
     const lock = prepared.stateFile + ".delivery.lock";
     const descriptor2 = openSync2(lock, "wx", 384);
     try {
-      writeFileSync4(descriptor2, "backify-application-auth-delivery-v1");
+      writeFileSync7(descriptor2, "backify-application-auth-delivery-v1");
       fsyncSync2(descriptor2);
     } finally {
       closeSync2(descriptor2);
@@ -18990,19 +19704,19 @@ async function synchronizeApplicationAuthTrustWithDigest(options) {
       const current = currentPublicFile(prepared.trustFile);
       createPersistentApplicationAuthProvider(trust, { expectedScope: options.expectedScope, stateFile: prepared.stateFile, now: options.now });
       const content = JSON.stringify(trust);
-      const trustDigest = createHash3("sha256").update(content).digest("hex");
+      const trustDigest = createHash4("sha256").update(content).digest("hex");
       if (current === content)
         return { status: "unchanged", revision: trust.revision, validUntil: trust.validUntil, trustDigest };
       writePending = true;
-      const temporary = prepared.trustFile + "." + randomUUID3() + ".tmp";
+      const temporary = prepared.trustFile + "." + randomUUID4() + ".tmp";
       const output = openSync2(temporary, "wx", process.platform === "win32" ? 384 : 292);
       try {
-        writeFileSync4(output, content);
+        writeFileSync7(output, content);
         fsyncSync2(output);
       } finally {
         closeSync2(output);
       }
-      renameSync3(temporary, prepared.trustFile);
+      renameSync4(temporary, prepared.trustFile);
       syncDirectory2(prepared.trustFile);
       writePending = false;
       return { status: "updated", revision: trust.revision, validUntil: trust.validUntil, trustDigest };
@@ -19579,16 +20293,16 @@ function jsonValue(value) {
 
 // src/local-services.ts
 import { spawn, execFile } from "node:child_process";
-import { createHash as createHash5, generateKeyPairSync, randomBytes as randomBytes2, randomUUID as randomUUID5, sign } from "node:crypto";
-import { createServer } from "node:net";
-import { existsSync as existsSync5, lstatSync as lstatSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, realpathSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename, dirname as dirname6, isAbsolute as isAbsolute3, join as join4, relative, resolve as resolve5 } from "node:path";
+import { createHash as createHash6, generateKeyPairSync, randomBytes as randomBytes3, randomUUID as randomUUID6, sign } from "node:crypto";
+import { createServer as createServer2 } from "node:net";
+import { existsSync as existsSync8, lstatSync as lstatSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { basename as basename2, dirname as dirname9, isAbsolute as isAbsolute4, join as join7, relative, resolve as resolve7 } from "node:path";
 
 // src/local-job-services.ts
-import { createHash as createHash4, randomBytes, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync as lstatSync4, readFileSync as readFileSync4 } from "node:fs";
+import { createHash as createHash5, randomBytes as randomBytes2, randomUUID as randomUUID5 } from "node:crypto";
+import { existsSync as existsSync7, lstatSync as lstatSync6, readFileSync as readFileSync7 } from "node:fs";
 import { isIP } from "node:net";
-import { dirname as dirname5, join as join3 } from "node:path";
+import { dirname as dirname8, join as join6 } from "node:path";
 function fields3(value, names) {
   return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === names.length && names.every((name2) => Object.hasOwn(value, name2));
 }
@@ -19639,12 +20353,12 @@ function validLocalJobState(value, otherIds) {
 function prepareLocalJobService(hcrPath, retained, artifacts, applyMigrations) {
   const requested = validateLocalJobArtifacts(artifacts);
   const readSchema = (name2) => {
-    const filename2 = join3(dirname5(hcrPath), "sql", name2), info = existsSync4(filename2) ? lstatSync4(filename2) : void 0;
+    const filename2 = join6(dirname8(hcrPath), "sql", name2), info = existsSync7(filename2) ? lstatSync6(filename2) : void 0;
     if (!info?.isFile() || info.isSymbolicLink() || info.size > 65536) throw new Error("Native jobs require the reviewed jobs-v1.sql and jobs-producer-v1.sql assets beside the HCR host");
-    return readFileSync4(filename2, "utf8");
+    return readFileSync7(filename2, "utf8");
   };
   const base = readSchema("jobs-v1.sql"), producer = readSchema("jobs-producer-v1.sql");
-  const schemaDigests = { base: createHash4("sha256").update(base).digest("hex"), producer: createHash4("sha256").update(producer).digest("hex") };
+  const schemaDigests = { base: createHash5("sha256").update(base).digest("hex"), producer: createHash5("sha256").update(producer).digest("hex") };
   if (retained && (retained.schemaDigests.base !== schemaDigests.base || retained.schemaDigests.producer !== schemaDigests.producer)) throw new Error("Native job schema changed; preserve its database and plan an explicit migration");
   if (!retained?.initialized && !applyMigrations) throw new Error("Review both HCR job SQL assets and pass --apply-migrations for explicit native job schema approval");
   const retainedArtifacts = retained ? validateLocalJobArtifacts(retained.artifacts) : [];
@@ -19653,20 +20367,20 @@ function prepareLocalJobService(hcrPath, retained, artifacts, applyMigrations) {
     if (previous && JSON.stringify(previous) !== JSON.stringify(artifact)) throw new Error("Retained local job artifact metadata cannot change; preserve the original pins and policies");
     if (!previous) retainedArtifacts.push(artifact);
   }
-  const state = { ...retained ?? { id: randomUUID4(), password: randomBytes(32).toString("hex"), initialized: false }, schemaDigests, artifacts: validateLocalJobArtifacts(retainedArtifacts) };
+  const state = { ...retained ?? { id: randomUUID5(), password: randomBytes2(32).toString("hex"), initialized: false }, schemaDigests, artifacts: validateLocalJobArtifacts(retainedArtifacts) };
   return { state, base, producer };
 }
 
 // src/local-services.ts
 function writePrivate(filename2, value) {
   if (isLink(filename2)) throw new Error("Local service files must not be symbolic links");
-  const temporary = filename2 + "." + randomUUID5() + ".tmp";
-  writeFileSync5(temporary, value, { flag: "wx", mode: 384 });
+  const temporary = filename2 + "." + randomUUID6() + ".tmp";
+  writeFileSync8(temporary, value, { flag: "wx", mode: 384 });
   renameLocalFile(temporary, filename2);
 }
 function isLink(filename2) {
   try {
-    return lstatSync5(filename2).isSymbolicLink();
+    return lstatSync7(filename2).isSymbolicLink();
   } catch (error) {
     if (error.code === "ENOENT") return false;
     throw error;
@@ -19674,9 +20388,9 @@ function isLink(filename2) {
 }
 function assertLocalStatePath(root, filename2) {
   const base = realpathSync(root);
-  for (let current = resolve5(filename2); current !== base; current = resolve5(current, "..")) {
+  for (let current = resolve7(filename2); current !== base; current = resolve7(current, "..")) {
     const part = relative(base, current);
-    if (part === ".." || part.startsWith(".." + (process.platform === "win32" ? "\\" : "/")) || isAbsolute3(part)) throw new Error("Local service state must stay inside the repository");
+    if (part === ".." || part.startsWith(".." + (process.platform === "win32" ? "\\" : "/")) || isAbsolute4(part)) throw new Error("Local service state must stay inside the repository");
     if (isLink(current)) throw new Error("Local service paths must not contain links");
   }
 }
@@ -19687,22 +20401,22 @@ function stateValid(value) {
   return value?.version === 1 && value.scope && [value.scope.organizationId, value.scope.applicationId, value.scope.environmentId, value.databaseId, value.storageId].every((identifier2) => typeof identifier2 === "string" && uuid5.test(identifier2)) && Number.isSafeInteger(value.configurationVersion) && value.configurationVersion >= 0 && /^[a-f0-9]{64}$/.test(value.adminPassword) && /^[a-f0-9]{64}$/.test(value.databasePassword) && (value.retainedDatabasePort === void 0 || Number.isInteger(value.retainedDatabasePort) && value.retainedDatabasePort > 0 && value.retainedDatabasePort <= 65535);
 }
 function acquireLocalLease(root, relativePath2 = ".backify/dev/development.lock") {
-  const filename2 = join4(root, relativePath2);
+  const filename2 = join7(root, relativePath2);
   assertLocalStatePath(root, filename2);
-  mkdirSync3(resolve5(filename2, ".."), { recursive: true, mode: 448 });
-  const owner = JSON.stringify({ version: 1, pid: process.pid, id: randomUUID5() });
+  mkdirSync4(resolve7(filename2, ".."), { recursive: true, mode: 448 });
+  const owner = JSON.stringify({ version: 1, pid: process.pid, id: randomUUID6() });
   try {
-    writeFileSync5(filename2, owner, { flag: "wx", mode: 384 });
+    writeFileSync8(filename2, owner, { flag: "wx", mode: 384 });
   } catch {
     throw new Error("Local development already owns this repository, or a stale lifecycle lock requires explicit recovery");
   }
   return () => {
-    if (existsSync5(filename2) && readFileSync5(filename2, "utf8") === owner) unlinkSync3(filename2);
+    if (existsSync8(filename2) && readFileSync8(filename2, "utf8") === owner) unlinkSync3(filename2);
   };
 }
 async function allocateLocalPort(requested) {
   if (requested !== void 0 && (!Number.isInteger(requested) || requested < 0 || requested > 65535)) throw new Error("Local service ports must be 0-65535");
-  const server = createServer();
+  const server = createServer2();
   return new Promise((resolvePort, reject) => {
     server.once("error", reject);
     server.listen(requested ?? 0, "127.0.0.1", () => {
@@ -19718,7 +20432,7 @@ async function allocateLocalPort(requested) {
 }
 function command(executable, args2, options = {}) {
   const failure2 = () => new Error("Local service command failed; verify installed tools, port availability and local state permissions");
-  if (basename(executable).replace(/\.exe$/i, "") === "pg_ctl") return new Promise((resolveOutput, reject) => {
+  if (basename2(executable).replace(/\.exe$/i, "") === "pg_ctl") return new Promise((resolveOutput, reject) => {
     const child = spawn(executable, args2, { ...options, windowsHide: true, stdio: "ignore" });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -19740,29 +20454,29 @@ function command(executable, args2, options = {}) {
   });
 }
 function postgresExecutable(name2, bin) {
-  const directory2 = bin ?? process.env.BACKIFY_LOCAL_POSTGRES_BIN ?? (process.platform === "win32" ? join4(process.env.ProgramFiles ?? "C:/Program Files", "PostgreSQL", "17", "bin") : void 0);
-  return directory2 ? join4(directory2, name2 + (process.platform === "win32" ? ".exe" : "")) : name2;
+  const directory2 = bin ?? process.env.BACKIFY_LOCAL_POSTGRES_BIN ?? (process.platform === "win32" ? join7(process.env.ProgramFiles ?? "C:/Program Files", "PostgreSQL", "17", "bin") : void 0);
+  return directory2 ? join7(directory2, name2 + (process.platform === "win32" ? ".exe" : "")) : name2;
 }
 function localMigrationFiles(root, directory2) {
   if (directory2 === void 0) return [];
   if (typeof directory2 !== "string") throw new Error("Local migrations require a repository-relative directory");
-  const folder = resolve5(root, directory2);
+  const folder = resolve7(root, directory2);
   assertLocalStatePath(root, folder);
-  if (!existsSync5(folder)) throw new Error("Declared migration directory does not exist");
-  const entries = readdirSync3(folder);
+  if (!existsSync8(folder)) throw new Error("Declared migration directory does not exist");
+  const entries = readdirSync5(folder);
   const filenames = entries.filter((entry) => entry.endsWith(".sql")).sort();
   if (filenames.length > 100 || entries.some((entry) => !entry.endsWith(".sql"))) throw new Error("Migrations require at most 100 flat .sql files");
   let total = 0;
   return filenames.map((name2) => {
     if (!/^[A-Za-z0-9_.-]{1,150}\.sql$/.test(name2)) throw new Error("Invalid migration filename");
-    const filename2 = join4(folder, name2);
+    const filename2 = join7(folder, name2);
     assertLocalStatePath(root, filename2);
-    const info = lstatSync5(filename2);
+    const info = lstatSync7(filename2);
     if (!info.isFile() || info.size > 1024 * 1024 || (total += info.size) > 4 * 1024 * 1024) throw new Error("Migration SQL exceeds supported limits");
-    const sql = readFileSync5(filename2, "utf8");
+    const sql = readFileSync8(filename2, "utf8");
     if (!sql.trim()) throw new Error("Migration SQL must not be empty");
     validateLocalMigrationSql(sql);
-    return { name: name2, digest: createHash5("sha256").update(sql).digest("hex"), sql };
+    return { name: name2, digest: createHash6("sha256").update(sql).digest("hex"), sql };
   });
 }
 function validateLocalMigrationSql(sql) {
@@ -19836,19 +20550,19 @@ async function startLocalServices(root, manifest, options = {}) {
   const reviewedScope = options.jobIdentityScope;
   if (reviewedScope !== void 0 && (!jobs || !manifest.capabilities.auth || manifest.capabilities.auth.enabled === false || !reviewedScope || Object.keys(reviewedScope).sort().join(",") !== "applicationId,environmentId,organizationId" || Object.values(reviewedScope).some((value) => typeof value !== "string" || value.length !== 36 || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) || value === "00000000-0000-0000-0000-000000000000"))) throw new Error("Native worker identity scope requires reviewed jobs and enabled auth");
   const installed = options.hcrPath || process.env.BACKIFY_LOCAL_HCR_PATH ? void 0 : installedLocalRuntime();
-  const hcrPath = resolve5(options.hcrPath ?? process.env.BACKIFY_LOCAL_HCR_PATH ?? installed?.path ?? join4(root, "apps/hcr/bin/Debug/net9.0/Backify.Hcr.dll"));
-  if (!existsSync5(hcrPath) || !lstatSync5(hcrPath).isFile() || !hcrPath.endsWith(".dll")) throw new Error("Full-fidelity mode requires a built Backify.Hcr.dll; set --hcr-path or BACKIFY_LOCAL_HCR_PATH");
-  const directory2 = join4(root, ".backify", "dev", "services");
+  const hcrPath = resolve7(options.hcrPath ?? process.env.BACKIFY_LOCAL_HCR_PATH ?? installed?.path ?? join7(root, "apps/hcr/bin/Debug/net9.0/Backify.Hcr.dll"));
+  if (!existsSync8(hcrPath) || !lstatSync7(hcrPath).isFile() || !hcrPath.endsWith(".dll")) throw new Error("Full-fidelity mode requires a built Backify.Hcr.dll; set --hcr-path or BACKIFY_LOCAL_HCR_PATH");
+  const directory2 = join7(root, ".backify", "dev", "services");
   assertLocalStatePath(root, directory2);
-  mkdirSync3(directory2, { recursive: true, mode: 448 });
+  mkdirSync4(directory2, { recursive: true, mode: 448 });
   assertLocalStatePath(root, directory2);
-  const statePath = join4(directory2, "host.json");
+  const statePath = join7(directory2, "host.json");
   assertLocalStatePath(root, statePath);
   let existing;
-  if (existsSync5(statePath)) {
-    if (lstatSync5(statePath).size > 16384) throw new Error("Local ownership state exceeds supported limits");
+  if (existsSync8(statePath)) {
+    if (lstatSync7(statePath).size > 16384) throw new Error("Local ownership state exceeds supported limits");
     try {
-      existing = JSON.parse(readFileSync5(statePath, "utf8"));
+      existing = JSON.parse(readFileSync8(statePath, "utf8"));
     } catch {
       throw new Error("Invalid local service ownership state; preserve the data and repair explicitly");
     }
@@ -19856,31 +20570,31 @@ async function startLocalServices(root, manifest, options = {}) {
   }
   const state = existing ?? {
     version: 1,
-    scope: reviewedScope ? structuredClone(reviewedScope) : { organizationId: randomUUID5(), applicationId: randomUUID5(), environmentId: randomUUID5() },
-    databaseId: randomUUID5(),
-    storageId: randomUUID5(),
+    scope: reviewedScope ? structuredClone(reviewedScope) : { organizationId: randomUUID6(), applicationId: randomUUID6(), environmentId: randomUUID6() },
+    databaseId: randomUUID6(),
+    storageId: randomUUID6(),
     configurationVersion: 0,
-    adminPassword: randomBytes2(32).toString("hex"),
-    databasePassword: randomBytes2(32).toString("hex")
+    adminPassword: randomBytes3(32).toString("hex"),
+    databasePassword: randomBytes3(32).toString("hex")
   };
   if (!stateValid(state)) throw new Error("Invalid local service ownership state; preserve the data and repair explicitly");
   if (reviewedScope && ["organizationId", "applicationId", "environmentId"].some((name2) => state.scope[name2] !== reviewedScope[name2])) throw new Error("Reviewed native worker identity scope conflicts with retained local ownership; preserve data and use a separate reviewed workspace");
   let eventSchema;
   if (events) {
-    const filename2 = join4(dirname6(hcrPath), "sql", "events-v1.sql");
-    if (!existsSync5(filename2) || lstatSync5(filename2).isSymbolicLink() || !lstatSync5(filename2).isFile() || lstatSync5(filename2).size > 65536) throw new Error("Native events require the reviewed events-v1.sql asset beside the HCR host.");
-    eventSchema = readFileSync5(filename2, "utf8");
-    const digest4 = createHash5("sha256").update(eventSchema).digest("hex");
+    const filename2 = join7(dirname9(hcrPath), "sql", "events-v1.sql");
+    if (!existsSync8(filename2) || lstatSync7(filename2).isSymbolicLink() || !lstatSync7(filename2).isFile() || lstatSync7(filename2).size > 65536) throw new Error("Native events require the reviewed events-v1.sql asset beside the HCR host.");
+    eventSchema = readFileSync8(filename2, "utf8");
+    const digest4 = createHash6("sha256").update(eventSchema).digest("hex");
     if (state.events && state.events.schemaDigest !== digest4) throw new Error("Native event schema changed; preserve its database and plan an explicit migration.");
     if (!state.events?.initialized && !options.applyMigrations) throw new Error("Review the HCR events-v1.sql asset and pass --apply-migrations for explicit native event schema approval.");
-    state.events ??= { id: randomUUID5(), password: randomBytes2(32).toString("hex"), schemaDigest: digest4, initialized: false };
+    state.events ??= { id: randomUUID6(), password: randomBytes3(32).toString("hex"), schemaDigest: digest4, initialized: false };
   }
   const jobSchema = jobs ? prepareLocalJobService(hcrPath, state.jobs, options.jobArtifacts, options.applyMigrations) : void 0;
   if (jobSchema) state.jobs = jobSchema.state;
   const storageNames = manifest.capabilities.storage?.buckets === void 0 ? ["default"] : manifest.capabilities.storage.buckets.map((bucket) => bucket.name);
   state.storageBindings ??= { default: state.storageId };
   if (typeof state.storageBindings !== "object" || state.storageBindings === null || Array.isArray(state.storageBindings) || Object.entries(state.storageBindings).some(([name2, identifier2]) => !/^[A-Za-z0-9_-]{1,100}$/.test(name2) || typeof identifier2 !== "string" || !/^[0-9a-f-]{36}$/i.test(identifier2))) throw new Error("Invalid local storage binding ownership state");
-  for (const name2 of storageNames) state.storageBindings[name2] ??= randomUUID5();
+  for (const name2 of storageNames) state.storageBindings[name2] ??= randomUUID6();
   if (Object.keys(state.storageBindings).length > 100) throw new Error("Local storage ownership history exceeds 100 bindings; preserve the data and plan an explicit migration");
   if (Buffer.byteLength(JSON.stringify({ ...state, configurationVersion: Number.MAX_SAFE_INTEGER, retainedDatabasePort: 65535 }), "utf8") > 16384) throw new Error("Local ownership history exceeds supported limits; preserve state and plan an explicit migration");
   const migrations = database ? localMigrationFiles(root, manifest.capabilities.database?.migrations) : [];
@@ -19888,7 +20602,7 @@ async function startLocalServices(root, manifest, options = {}) {
   const databasePort = database || events || jobs ? await allocateLocalPort(options.databasePort) : void 0;
   if (databasePort !== void 0) state.retainedDatabasePort = databasePort;
   if (databasePort === hcrPort) throw new Error("HCR and PostgreSQL require separate ports");
-  const cluster = join4(directory2, "postgres");
+  const cluster = join7(directory2, "postgres");
   assertLocalStatePath(root, cluster);
   const release2 = acquireLocalLease(root, ".backify/dev/services/lifecycle.lock");
   let postgresStarted = false;
@@ -19904,7 +20618,7 @@ async function startLocalServices(root, manifest, options = {}) {
     }
   };
   const runtimeUrl = "http://127.0.0.1:" + hcrPort;
-  const tokenPath = join4(directory2, "workload-token");
+  const tokenPath = join7(directory2, "workload-token");
   const stop = () => stopping ??= (async () => {
     if (timer) clearInterval(timer);
     if (snapshotTimer) clearInterval(snapshotTimer);
@@ -19923,9 +20637,9 @@ async function startLocalServices(root, manifest, options = {}) {
     }
     notify("hcr", "stopped");
     try {
-      if (postgresStarted && existsSync5(join4(cluster, "postmaster.pid"))) await command(postgresExecutable("pg_ctl", options.postgresBin), ["-D", cluster, "-m", "fast", "-w", "stop"]);
+      if (postgresStarted && existsSync8(join7(cluster, "postmaster.pid"))) await command(postgresExecutable("pg_ctl", options.postgresBin), ["-D", cluster, "-m", "fast", "-w", "stop"]);
       if (postgresStarted) notify("postgres", "stopped");
-      if (existsSync5(tokenPath)) unlinkSync3(tokenPath);
+      if (existsSync8(tokenPath)) unlinkSync3(tokenPath);
     } finally {
       release2();
     }
@@ -19935,28 +20649,28 @@ async function startLocalServices(root, manifest, options = {}) {
     writePrivate(statePath, JSON.stringify(state));
     if (database || events || jobs) {
       notify("postgres", "starting");
-      if (!existsSync5(join4(cluster, "PG_VERSION"))) {
-        const passwordPath = join4(directory2, "init-password");
+      if (!existsSync8(join7(cluster, "PG_VERSION"))) {
+        const passwordPath = join7(directory2, "init-password");
         writePrivate(passwordPath, state.adminPassword);
         try {
           await command(postgresExecutable("initdb", options.postgresBin), ["-D", cluster, "-U", "backify_admin", "--auth-host=scram-sha-256", "--auth-local=scram-sha-256", "--pwfile=" + passwordPath, "--no-locale", "--encoding=UTF8"]);
         } finally {
-          if (existsSync5(passwordPath)) unlinkSync3(passwordPath);
+          if (existsSync8(passwordPath)) unlinkSync3(passwordPath);
         }
       }
-      if (existsSync5(join4(cluster, "postmaster.pid"))) throw new Error("A retained local PostgreSQL server is still running; stop or recover that exact owned cluster before restarting dev");
+      if (existsSync8(join7(cluster, "postmaster.pid"))) throw new Error("A retained local PostgreSQL server is still running; stop or recover that exact owned cluster before restarting dev");
       postgresStarted = true;
-      await command(postgresExecutable("pg_ctl", options.postgresBin), ["-D", cluster, "-l", join4(directory2, "postgres.log"), "-o", "-h 127.0.0.1 -p " + databasePort, "-w", "start"]);
+      await command(postgresExecutable("pg_ctl", options.postgresBin), ["-D", cluster, "-l", join7(directory2, "postgres.log"), "-o", "-h 127.0.0.1 -p " + databasePort, "-w", "start"]);
       notify("postgres", "ready");
       const sql = (query, application = false) => command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", application ? "backify_local" : "backify_admin", "-d", application ? "backify_local" : "postgres", "-X", "-q", "-t", "-A", "-v", "ON_ERROR_STOP=1", "-c", query], { env: { ...process.env, PGPASSWORD: application ? state.databasePassword : state.adminPassword } });
       if (database) {
         if ((await sql("SELECT count(*) FROM pg_roles WHERE rolname='backify_local'")).trim() === "0") {
-          const filename2 = join4(directory2, "role-" + randomUUID5() + ".sql");
+          const filename2 = join7(directory2, "role-" + randomUUID6() + ".sql");
           writePrivate(filename2, "CREATE ROLE backify_local LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '" + state.databasePassword + "';");
           try {
             await command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", "backify_admin", "-d", "postgres", "-X", "-q", "-v", "ON_ERROR_STOP=1", "-f", filename2], { env: { ...process.env, PGPASSWORD: state.adminPassword } });
           } finally {
-            if (existsSync5(filename2)) unlinkSync3(filename2);
+            if (existsSync8(filename2)) unlinkSync3(filename2);
           }
         }
         if ((await sql("SELECT count(*) FROM pg_database WHERE datname='backify_local'")).trim() === "0") await sql("CREATE DATABASE backify_local OWNER backify_local");
@@ -19971,12 +20685,12 @@ async function startLocalServices(root, manifest, options = {}) {
         notify("migrations", "starting");
         if (pending.length) await sql("CREATE TABLE IF NOT EXISTS public.__backify_migrations (name text PRIMARY KEY, digest text NOT NULL, applied_at timestamptz NOT NULL DEFAULT now())", true);
         for (const migration of pending) {
-          const filename2 = join4(directory2, "apply-" + randomUUID5() + ".sql");
+          const filename2 = join7(directory2, "apply-" + randomUUID6() + ".sql");
           writePrivate(filename2, "BEGIN;\n" + migration.sql + "\n;\nINSERT INTO public.__backify_migrations(name,digest) VALUES ('" + migration.name + "','" + migration.digest + "');\nCOMMIT;\n");
           try {
             await command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", "backify_local", "-d", "backify_local", "-X", "-q", "-v", "ON_ERROR_STOP=1", "-f", filename2], { env: { ...process.env, PGPASSWORD: state.databasePassword } });
           } finally {
-            if (existsSync5(filename2)) unlinkSync3(filename2);
+            if (existsSync8(filename2)) unlinkSync3(filename2);
           }
           applied.push(migration.name);
         }
@@ -19987,20 +20701,20 @@ async function startLocalServices(root, manifest, options = {}) {
         const eventSql = (query) => command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", "backify_events", "-d", "backify_events", "-X", "-q", "-t", "-A", "-v", "ON_ERROR_STOP=1", "-c", query], { env: { ...process.env, PGPASSWORD: eventState.password } });
         if (!eventState.initialized) {
           if ((await sql("SELECT count(*) FROM pg_database WHERE datname='backify_events'")).trim() !== "0" || (await sql("SELECT count(*) FROM pg_roles WHERE rolname='backify_events'")).trim() !== "0") throw new Error("Uninitialized native event ownership conflicts with retained state; preserve it and repair explicitly.");
-          const roleFile = join4(directory2, "event-role-" + randomUUID5() + ".sql");
+          const roleFile = join7(directory2, "event-role-" + randomUUID6() + ".sql");
           writePrivate(roleFile, "CREATE ROLE backify_events LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '" + eventState.password + "';");
           try {
             await command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", "backify_admin", "-d", "postgres", "-X", "-q", "-v", "ON_ERROR_STOP=1", "-f", roleFile], { env: { ...process.env, PGPASSWORD: state.adminPassword } });
           } finally {
-            if (existsSync5(roleFile)) unlinkSync3(roleFile);
+            if (existsSync8(roleFile)) unlinkSync3(roleFile);
           }
           await sql("CREATE DATABASE backify_events OWNER backify_events");
-          const schemaFile = join4(directory2, "event-schema-" + randomUUID5() + ".sql");
+          const schemaFile = join7(directory2, "event-schema-" + randomUUID6() + ".sql");
           writePrivate(schemaFile, eventSchema);
           try {
             await command(postgresExecutable("psql", options.postgresBin), ["-h", "127.0.0.1", "-p", String(databasePort), "-U", "backify_events", "-d", "backify_events", "-X", "-q", "-v", "ON_ERROR_STOP=1", "-f", schemaFile], { env: { ...process.env, PGPASSWORD: eventState.password } });
           } finally {
-            if (existsSync5(schemaFile)) unlinkSync3(schemaFile);
+            if (existsSync8(schemaFile)) unlinkSync3(schemaFile);
           }
           eventState.initialized = true;
           writePrivate(statePath, JSON.stringify(state));
@@ -20014,21 +20728,21 @@ async function startLocalServices(root, manifest, options = {}) {
       const adminSql = (query, databaseName = "postgres") => jobCommand("backify_admin", state.adminPassword, databaseName, ["-c", query]);
       if (!jobState.initialized) {
         if ((await adminSql("SELECT count(*) FROM pg_database WHERE datname='backify_jobs'")).trim() !== "0" || (await adminSql("SELECT count(*) FROM pg_roles WHERE rolname='backify_jobs'")).trim() !== "0") throw new Error("Uninitialized native job ownership conflicts with retained state; preserve it and repair explicitly");
-        const roleFile = join4(directory2, "job-role-" + randomUUID5() + ".sql");
+        const roleFile = join7(directory2, "job-role-" + randomUUID6() + ".sql");
         writePrivate(roleFile, "CREATE ROLE backify_jobs LOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD '" + jobState.password + "';");
         try {
           await jobCommand("backify_admin", state.adminPassword, "postgres", ["-f", roleFile]);
         } finally {
-          if (existsSync5(roleFile)) unlinkSync3(roleFile);
+          if (existsSync8(roleFile)) unlinkSync3(roleFile);
         }
         await adminSql("CREATE DATABASE backify_jobs OWNER backify_admin");
         for (const schema of [jobSchema.base, jobSchema.producer]) {
-          const filename2 = join4(directory2, "job-schema-" + randomUUID5() + ".sql");
+          const filename2 = join7(directory2, "job-schema-" + randomUUID6() + ".sql");
           writePrivate(filename2, schema);
           try {
             await jobCommand("backify_admin", state.adminPassword, "backify_jobs", ["-f", filename2]);
           } finally {
-            if (existsSync5(filename2)) unlinkSync3(filename2);
+            if (existsSync8(filename2)) unlinkSync3(filename2);
           }
         }
         await adminSql("REVOKE ALL ON DATABASE backify_jobs FROM PUBLIC; GRANT CONNECT ON DATABASE backify_jobs TO backify_jobs; REVOKE CREATE ON SCHEMA public FROM PUBLIC; GRANT USAGE ON SCHEMA __backify_jobs TO backify_jobs; GRANT SELECT ON __backify_jobs.schema_version,__backify_jobs.producer_schema_version TO backify_jobs; GRANT SELECT,INSERT,UPDATE ON __backify_jobs.runs,__backify_jobs.attempts TO backify_jobs; GRANT SELECT,INSERT ON __backify_jobs.producers TO backify_jobs", "backify_jobs");
@@ -20057,7 +20771,7 @@ async function startLocalServices(root, manifest, options = {}) {
       ...events ? [{ id: state.events.id, scope: state.scope, capability: "events", contractVersion: 1, logicalBinding: "default", provider: "postgres-events", resourceReference: "backify_events", ownership: "Managed", accessMode: "Gateway", permissions: ["events.emit", "events.receive", "events.complete", "events.inspect"], status: "ready" }] : [],
       ...jobs ? [{ id: state.jobs.id, scope: state.scope, capability: "jobs", contractVersion: 1, logicalBinding: "default", provider: "postgres-jobs", resourceReference: "backify_jobs", ownership: "Managed", accessMode: "Gateway", permissions: ["jobs.enqueue", "jobs.receive", "jobs.complete", "jobs.cancel", "jobs.inspect", "jobs.retry"], status: "ready" }] : []
     ];
-    const snapshotPath = join4(directory2, "snapshot.json");
+    const snapshotPath = join7(directory2, "snapshot.json");
     const writeSnapshot = () => writePrivate(snapshotPath, JSON.stringify({ schemaVersion: 1, configurationVersion: state.configurationVersion, expiresAt: new Date(Date.now() + 7 * 864e5).toISOString(), bindings }));
     const renewConfiguration = () => {
       if (stopping) throw new Error("Stopped local services cannot renew configuration");
@@ -20067,15 +20781,15 @@ async function startLocalServices(root, manifest, options = {}) {
       writeSnapshot();
     };
     writeSnapshot();
-    const settingsPath = join4(directory2, "appsettings.json");
+    const settingsPath = join7(directory2, "appsettings.json");
     writePrivate(settingsPath, JSON.stringify({ Hcr: {
       Authentication: { PublicKeyPem: publicKey.export({ type: "spki", format: "pem" }), Issuer: "backify-local", Audience: "backify-local-hcr" },
       SnapshotPath: snapshotPath,
-      SnapshotJournalPath: join4(directory2, "journal.json"),
+      SnapshotJournalPath: join7(directory2, "journal.json"),
       Postgres: { Bindings: state.retainedDatabasePort ? { [state.databaseId]: { Scope: state.scope, ConnectionString: "Host=127.0.0.1;Port=" + state.retainedDatabasePort + ";Database=backify_local;Username=backify_local;Password=" + state.databasePassword } } : {} },
       Events: { Bindings: state.retainedDatabasePort && state.events?.initialized ? { [state.events.id]: { Scope: state.scope, ConnectionString: "Host=127.0.0.1;Port=" + state.retainedDatabasePort + ";Database=backify_events;Username=backify_events;Password=" + state.events.password } } : {} },
       Jobs: { Bindings: state.retainedDatabasePort && state.jobs?.initialized ? { [state.jobs.id]: { Scope: state.scope, ConnectionString: "Host=127.0.0.1;Port=" + state.retainedDatabasePort + ";Database=backify_jobs;Username=backify_jobs;Password=" + state.jobs.password, Artifacts: state.jobs.artifacts } } : {} },
-      Storage: { Bindings: Object.fromEntries(Object.entries(state.storageBindings).map(([name2, identifier2]) => [identifier2, { Scope: state.scope, ResourceReference: name2, RootPath: join4(directory2, "objects", identifier2) }])) }
+      Storage: { Bindings: Object.fromEntries(Object.entries(state.storageBindings).map(([name2, identifier2]) => [identifier2, { Scope: state.scope, ResourceReference: name2, RootPath: join7(directory2, "objects", identifier2) }])) }
     } }));
     issueToken();
     notify("hcr", "starting");
@@ -20089,7 +20803,7 @@ async function startLocalServices(root, manifest, options = {}) {
     while (true) {
       if (spawnFailed || hcr.exitCode !== null || hcr.signalCode !== null || Date.now() > deadline) throw new Error("Local HCR could not become ready; check the .NET runtime, bindings and retained journal");
       try {
-        const response = await fetch(runtimeUrl + "/v1/health", { headers: { authorization: "Bearer " + readFileSync5(tokenPath, "utf8") }, signal: AbortSignal.timeout(500), redirect: "error", credentials: "omit", cache: "no-store" });
+        const response = await fetch(runtimeUrl + "/v1/health", { headers: { authorization: "Bearer " + readFileSync8(tokenPath, "utf8") }, signal: AbortSignal.timeout(500), redirect: "error", credentials: "omit", cache: "no-store" });
         if (response.ok) {
           const status = await response.json();
           if (status.status === "ready" && status.configurationVersion === state.configurationVersion) break;
@@ -20098,8 +20812,8 @@ async function startLocalServices(root, manifest, options = {}) {
       }
       await new Promise((resolveDelay) => setTimeout(resolveDelay, 100));
     }
-    if (events) await createHcrEventsProvider({ runtimeUrl, token: () => readFileSync5(tokenPath, "utf8") }).inspect();
-    if (jobs) await createHcrJobsProvider({ runtimeUrl, token: () => readFileSync5(tokenPath, "utf8") }).inspect();
+    if (events) await createHcrEventsProvider({ runtimeUrl, token: () => readFileSync8(tokenPath, "utf8") }).inspect();
+    if (jobs) await createHcrJobsProvider({ runtimeUrl, token: () => readFileSync8(tokenPath, "utf8") }).inspect();
     timer = setInterval(() => {
       try {
         issueToken();
@@ -20115,7 +20829,7 @@ async function startLocalServices(root, manifest, options = {}) {
       }
     }, 36e5);
     notify("hcr", "ready");
-    const configurationFingerprint = createHash5("sha256").update(JSON.stringify({ mode: "full", capabilities: manifest.capabilities, migrations: migrations.map(({ name: name2, digest: digest4 }) => ({ name: name2, digest: digest4 })), ...jobs ? { jobArtifacts: state.jobs.artifacts } : {} })).digest("hex");
+    const configurationFingerprint = createHash6("sha256").update(JSON.stringify({ mode: "full", capabilities: manifest.capabilities, migrations: migrations.map(({ name: name2, digest: digest4 }) => ({ name: name2, digest: digest4 })), ...jobs ? { jobArtifacts: state.jobs.artifacts } : {} })).digest("hex");
     return { identityScope: { ...state.scope }, runtimeUrl, tokenPath, database, storage, events, jobs, databasePort, migrations: applied, configurationFingerprint, renewConfiguration, stop };
   } catch (error) {
     await stop();
@@ -20124,29 +20838,29 @@ async function startLocalServices(root, manifest, options = {}) {
 }
 
 // src/local-job-auth.ts
-import { createHash as createHash6 } from "node:crypto";
-import { lstatSync as lstatSync6, readFileSync as readFileSync6 } from "node:fs";
-import { isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { lstatSync as lstatSync8, readFileSync as readFileSync9 } from "node:fs";
+import { isAbsolute as isAbsolute5, resolve as resolve8 } from "node:path";
 function prepareLocalJobAuth(root, filename2) {
   const read = (path, maximum) => {
     assertLocalStatePath(root, path);
-    const metadata = lstatSync6(path);
+    const metadata = lstatSync8(path);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > maximum) throw new Error();
-    const bytes = readFileSync6(path);
+    const bytes = readFileSync9(path);
     if (bytes.length > maximum) throw new Error();
     return bytes;
   };
   try {
-    if (!filename2 || isAbsolute4(filename2)) throw new Error();
-    const input = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(read(resolve6(root, filename2), 16384)));
+    if (!filename2 || isAbsolute5(filename2)) throw new Error();
+    const input = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(read(resolve8(root, filename2), 16384)));
     if (!input || Object.keys(input).sort().join(",") !== "revision,schemaVersion,scope,stateFile,trustDigest,trustFile" || input.schemaVersion !== 1 || !Number.isSafeInteger(input.revision) || input.revision < 1 || typeof input.trustDigest !== "string" || input.trustDigest.length !== 64 || !/^[a-f0-9]{64}$/.test(input.trustDigest)) throw new Error();
     if (!input.scope || Object.keys(input.scope).sort().join(",") !== "applicationId,environmentId,organizationId" || Object.values(input.scope).some((value) => typeof value !== "string" || value.length !== 36 || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) || value === "00000000-0000-0000-0000-000000000000")) throw new Error();
-    if ([input.trustFile, input.stateFile].some((path) => typeof path !== "string" || !path || isAbsolute4(path))) throw new Error();
-    const trustFile = resolve6(root, input.trustFile), stateFile = resolve6(root, input.stateFile);
+    if ([input.trustFile, input.stateFile].some((path) => typeof path !== "string" || !path || isAbsolute5(path))) throw new Error();
+    const trustFile = resolve8(root, input.trustFile), stateFile = resolve8(root, input.stateFile);
     if (trustFile === stateFile) throw new Error();
     const bytes = read(trustFile, 131072), trust = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(bytes));
     read(stateFile, 2048);
-    if (createHash6("sha256").update(bytes).digest("hex") !== input.trustDigest || trust.revision !== input.revision) throw new Error();
+    if (createHash7("sha256").update(bytes).digest("hex") !== input.trustDigest || trust.revision !== input.revision) throw new Error();
     createPersistentApplicationAuthProvider(trust, { expectedScope: input.scope, stateFile });
     return { trustFile, stateFile, scope: structuredClone(input.scope), revision: input.revision, trustDigest: input.trustDigest };
   } catch {
@@ -20155,39 +20869,39 @@ function prepareLocalJobAuth(root, filename2) {
 }
 
 // src/local-job-trust-renewal.ts
-import { createHash as createHash8 } from "node:crypto";
-import { lstatSync as lstatSync8, readFileSync as readFileSync8 } from "node:fs";
-import { isAbsolute as isAbsolute6, relative as relative2, resolve as resolve8 } from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { lstatSync as lstatSync10, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute7, relative as relative2, resolve as resolve10 } from "node:path";
 
 // src/workload-trust-sync.ts
-import { lstatSync as lstatSync7, readFileSync as readFileSync7 } from "node:fs";
-import { isAbsolute as isAbsolute5, resolve as resolve7 } from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import { lstatSync as lstatSync9, readFileSync as readFileSync10 } from "node:fs";
+import { isAbsolute as isAbsolute6, resolve as resolve9 } from "node:path";
+import { createHash as createHash8 } from "node:crypto";
 function prepareWorkloadTrustSynchronization(filename2) {
   try {
-    if (!isAbsolute5(filename2)) throw new Error();
-    const metadata = lstatSync7(filename2);
+    if (!isAbsolute6(filename2)) throw new Error();
+    const metadata = lstatSync9(filename2);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 65536) throw new Error();
-    const bytes = readFileSync7(filename2);
+    const bytes = readFileSync10(filename2);
     if (bytes.length > 65536) throw new Error();
     const value = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(bytes));
     const allowed = ["controlPlaneUrl", "agentId", "expectedScope", "managementIssuer", "managementAudience", "managementPublicKeyPem", "credentialFile", "trustFile", "stateFile", "intervalSeconds"];
-    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((name2) => !allowed.includes(name2)) || typeof value.credentialFile !== "string" || !isAbsolute5(value.credentialFile) || typeof value.trustFile !== "string" || !isAbsolute5(value.trustFile) || typeof value.stateFile !== "string" || !isAbsolute5(value.stateFile)) throw new Error();
-    const credentialFile = resolve7(value.credentialFile), trustFile = resolve7(value.trustFile), stateFile = resolve7(value.stateFile);
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((name2) => !allowed.includes(name2)) || typeof value.credentialFile !== "string" || !isAbsolute6(value.credentialFile) || typeof value.trustFile !== "string" || !isAbsolute6(value.trustFile) || typeof value.stateFile !== "string" || !isAbsolute6(value.stateFile)) throw new Error();
+    const credentialFile = resolve9(value.credentialFile), trustFile = resolve9(value.trustFile), stateFile = resolve9(value.stateFile);
     const comparison = (filename3) => process.platform === "win32" ? filename3.toLowerCase() : filename3;
     if ([trustFile, stateFile, stateFile + ".lock", stateFile + ".delivery.lock"].map(comparison).includes(comparison(credentialFile))) throw new Error();
     const intervalSeconds = value.intervalSeconds ?? 30;
     if (!Number.isSafeInteger(intervalSeconds) || intervalSeconds < 10 || intervalSeconds > 300) throw new Error();
     const credential = () => {
-      const metadata2 = lstatSync7(credentialFile);
+      const metadata2 = lstatSync9(credentialFile);
       if (!metadata2.isFile() || metadata2.isSymbolicLink() || metadata2.nlink !== 1 || metadata2.size > 256 || process.platform !== "win32" && (metadata2.uid !== process.getuid?.() || (metadata2.mode & 63) !== 0)) throw new Error("Management credential unavailable");
-      const bytes2 = readFileSync7(credentialFile);
+      const bytes2 = readFileSync10(credentialFile);
       if (bytes2.length > 256) throw new Error("Management credential unavailable");
       return new TextDecoder("utf8", { fatal: true }).decode(bytes2).trim();
     };
     const options = { controlPlaneUrl: value.controlPlaneUrl, agentId: value.agentId, expectedScope: value.expectedScope, managementIssuer: value.managementIssuer, managementAudience: value.managementAudience, managementPublicKeyPem: value.managementPublicKeyPem, credential, trustFile, stateFile };
     const plan = planApplicationAuthSynchronization(options);
-    return { options, plan, intervalSeconds, credentialFile, configurationDigest: createHash7("sha256").update(bytes).digest("hex") };
+    return { options, plan, intervalSeconds, credentialFile, configurationDigest: createHash8("sha256").update(bytes).digest("hex") };
   } catch {
     throw new Error("Invalid operator trust-sync configuration");
   }
@@ -20238,22 +20952,22 @@ async function workloadTrustSynchronization(args2, settings = {}) {
 // src/local-job-trust-renewal.ts
 function prepareLocalJobTrustRenewal(root, filename2, mount) {
   try {
-    if (!filename2 || isAbsolute6(filename2)) throw new Error();
-    const configurationFile = resolve8(root, filename2);
+    if (!filename2 || isAbsolute7(filename2)) throw new Error();
+    const configurationFile = resolve10(root, filename2);
     assertLocalStatePath(root, configurationFile);
     const configured = prepareWorkloadTrustSynchronization(configurationFile);
     const { credential, ...options } = configured.options;
     const same = (first, second) => process.platform === "win32" ? first.toLowerCase() === second.toLowerCase() : first === second;
     if (!same(options.trustFile, mount.trustFile) || !same(options.stateFile, mount.stateFile) || ["organizationId", "applicationId", "environmentId"].some((name2) => options.expectedScope[name2] !== mount.scope[name2])) throw new Error();
     assertLocalStatePath(root, configured.credentialFile);
-    const metadata = lstatSync8(configured.credentialFile);
+    const metadata = lstatSync10(configured.credentialFile);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 256 || process.platform !== "win32" && (metadata.uid !== process.getuid?.() || (metadata.mode & 63) !== 0)) throw new Error();
     return { configurationFile, configurationDigest: configured.configurationDigest, credentialFile: configured.credentialFile, intervalSeconds: configured.intervalSeconds, options };
   } catch {
     throw new Error("Invalid reviewed native worker trust renewal; preserve trust and state and review explicitly");
   }
 }
-function createLocalJobTrustRenewal(root, mounts, settings = {}, dependencies = { createHash: createHash8, lstatSync: lstatSync8, readFileSync: readFileSync8, isAbsolute: isAbsolute6, relative: relative2, resolve: resolve8, createPersistentApplicationAuthProvider, synchronizeApplicationAuthTrustWithDigest }) {
+function createLocalJobTrustRenewal(root, mounts, settings = {}, dependencies = { createHash: createHash9, lstatSync: lstatSync10, readFileSync: readFileSync11, isAbsolute: isAbsolute7, relative: relative2, resolve: resolve10, createPersistentApplicationAuthProvider, synchronizeApplicationAuthTrustWithDigest }) {
   const { createHash: createHash16, lstatSync: lstatSync20, readFileSync: readFileSync25, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve24, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2, synchronizeApplicationAuthTrustWithDigest: synchronizeApplicationAuthTrustWithDigest2 } = dependencies;
   const key = (filename2) => process.platform === "win32" ? resolve24(filename2).toLowerCase() : resolve24(filename2);
   const groups = [];
@@ -20352,34 +21066,34 @@ function applyLocalJobTrustRenewal(workers, updates, check) {
 
 // src/local-job-executor.ts
 function prepareLocalJobWorker(root, directory2, artifacts, manifest, authFile, trustSyncFile) {
-  if (typeof directory2 !== "string" || !directory2 || isAbsolute7(directory2)) throw new Error("Native jobs require a repository-relative packaged worker directory");
+  if (typeof directory2 !== "string" || !directory2 || isAbsolute8(directory2)) throw new Error("Native jobs require a repository-relative packaged worker directory");
   const authenticationEnabled = !!manifest.capabilities.auth && manifest.capabilities.auth.enabled !== false;
   if (authenticationEnabled && authFile === void 0) throw new Error("Native local packaged workers require separately reviewed application-auth trust mounts; local identity fixtures are not production issuer trust");
   if (!authenticationEnabled && authFile !== void 0) throw new Error("Native worker trust mounts require an enabled auth capability");
   if (trustSyncFile !== void 0 && authFile === void 0) throw new Error("Native worker trust renewal requires explicit reviewed auth mounts");
   const authTrust = authFile === void 0 ? void 0 : prepareLocalJobAuth(root, authFile);
   if (authTrust && trustSyncFile !== void 0) authTrust.renewal = prepareLocalJobTrustRenewal(root, trustSyncFile, authTrust);
-  const workerFile = join5(resolve9(root, directory2), "workload.mjs"), metadataFile = join5(resolve9(root, directory2), "artifact.json");
+  const workerFile = join8(resolve11(root, directory2), "workload.mjs"), metadataFile = join8(resolve11(root, directory2), "artifact.json");
   for (const filename2 of [workerFile, metadataFile]) assertLocalStatePath(root, filename2);
-  if (!lstatSync9(workerFile).isFile() || lstatSync9(workerFile).size > 16777216 || !lstatSync9(metadataFile).isFile() || lstatSync9(metadataFile).size > 65536) throw new Error("Invalid bounded native worker artifact");
-  const metadata = JSON.parse(readFileSync9(metadataFile, "utf8"));
-  const bundle = readFileSync9(workerFile);
-  const actual = createHash9("sha256").update(bundle).digest("hex");
+  if (!lstatSync11(workerFile).isFile() || lstatSync11(workerFile).size > 16777216 || !lstatSync11(metadataFile).isFile() || lstatSync11(metadataFile).size > 65536) throw new Error("Invalid bounded native worker artifact");
+  const metadata = JSON.parse(readFileSync12(metadataFile, "utf8"));
+  const bundle = readFileSync12(workerFile);
+  const actual = createHash10("sha256").update(bundle).digest("hex");
   const scheduleDiscovery = bundle.subarray(0, 100).toString("utf8").startsWith('var __backifyWorkerProtocols = ["hcr-v1","hcr-schedules-v1"];\n');
-  if (!metadata || metadata.schemaVersion !== 1 || metadata.kind !== "worker" || metadata.artifactVersion !== actual || metadata.manifestVersion !== createHash9("sha256").update(JSON.stringify(manifest)).digest("hex")) throw new Error("Native worker kind, bundle or manifest pin does not match the reviewed artifact");
+  if (!metadata || metadata.schemaVersion !== 1 || metadata.kind !== "worker" || metadata.artifactVersion !== actual || metadata.manifestVersion !== createHash10("sha256").update(JSON.stringify(manifest)).digest("hex")) throw new Error("Native worker kind, bundle or manifest pin does not match the reviewed artifact");
   const artifact = validateLocalJobArtifacts(artifacts).find((item) => item.artifactVersion === actual);
   if (!artifact) throw new Error("Native worker bundle is not an explicitly reviewed job artifact");
   if (metadata.workerProtocols !== void 0 && (!scheduleDiscovery || JSON.stringify(metadata.workerProtocols) !== JSON.stringify(["hcr-v1", "hcr-schedules-v1"]))) throw new Error("Invalid worker protocol admission");
   return { root, workerFile, artifact, schedulerEnabled: !!manifest.capabilities.scheduler && manifest.capabilities.scheduler.enabled !== false, ...scheduleDiscovery ? { scheduleDiscovery: true } : {}, ...authTrust ? { authTrust } : {} };
 }
 function readLocalJobArtifacts(root, filename2) {
-  if (!filename2 || isAbsolute7(filename2)) throw new Error("Job artifact admission requires a repository-relative reviewed JSON file");
-  const path = resolve9(root, filename2);
+  if (!filename2 || isAbsolute8(filename2)) throw new Error("Job artifact admission requires a repository-relative reviewed JSON file");
+  const path = resolve11(root, filename2);
   assertLocalStatePath(root, path);
-  if (!lstatSync9(path).isFile() || lstatSync9(path).size > 16384) throw new Error("Reviewed job artifact admission exceeds supported bounds");
-  return validateLocalJobArtifacts(JSON.parse(readFileSync9(path, "utf8")));
+  if (!lstatSync11(path).isFile() || lstatSync11(path).size > 16384) throw new Error("Reviewed job artifact admission exceeds supported bounds");
+  return validateLocalJobArtifacts(JSON.parse(readFileSync12(path, "utf8")));
 }
-function createLocalJobExecutor(options, dependencies = { spawn: spawn2, createHash: createHash9, lstatSync: lstatSync9, readFileSync: readFileSync9, isAbsolute: isAbsolute7, relative: relative3, resolve: resolve9, validateWorkloadJobSchedules, createPersistentApplicationAuthProvider }) {
+function createLocalJobExecutor(options, dependencies = { spawn: spawn2, createHash: createHash10, lstatSync: lstatSync11, readFileSync: readFileSync12, isAbsolute: isAbsolute8, relative: relative3, resolve: resolve11, validateWorkloadJobSchedules, createPersistentApplicationAuthProvider }) {
   const { spawn: spawn6, createHash: createHash16, lstatSync: lstatSync20, readFileSync: readFileSync25, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve24, validateWorkloadJobSchedules: validateWorkloadJobSchedules2, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2 } = dependencies;
   const assertReady = () => {
     for (let current = resolve24(options.workerFile); current !== options.root; current = resolve24(current, "..")) {
@@ -20512,9 +21226,9 @@ function createLocalJobExecutor(options, dependencies = { spawn: spawn2, createH
 }
 
 // src/local-native-jobs.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function createLocalNativeJobs(local, native, executor, artifact, scope, onFailure = () => {
-}, hash2 = createHash10, catalog = { workloadJobSchedules, validateWorkloadJobSchedules, HcrJobsRequestError }, historical = []) {
+}, hash2 = createHash11, catalog = { workloadJobSchedules, validateWorkloadJobSchedules, HcrJobsRequestError }, historical = []) {
   const workers = [{ artifact, executor }, ...historical];
   if (historical.length > 15 || new Set(workers.map((worker) => worker.artifact.artifactVersion)).size !== workers.length) throw new Error("Historical workers require bounded unique artifact pins");
   const lanes = workers.flatMap((worker) => worker.artifact.jobs.map((policy) => ({ ...worker, policy })));
@@ -20772,9 +21486,9 @@ process.on("SIGTERM", stop); process.on("SIGINT", stop); process.once("disconnec
 
 // src/local-frontend.ts
 import { spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync11, realpathSync as realpathSync3, existsSync as existsSync6, statSync } from "node:fs";
+import { readFileSync as readFileSync14, realpathSync as realpathSync3, existsSync as existsSync9, statSync } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname7, isAbsolute as isAbsolute9, join as join7, relative as relative5, resolve as resolve11 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute10, join as join10, relative as relative5, resolve as resolve13 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/local-frontend-guard.ts
@@ -20841,24 +21555,24 @@ await server.listen();
 `;
 
 // src/local-static-frontend.ts
-import { createServer as createServer2 } from "node:http";
-import { lstatSync as lstatSync10, readFileSync as readFileSync10, realpathSync as realpathSync2, watch } from "node:fs";
-import { extname as extname2, isAbsolute as isAbsolute8, join as join6, relative as relative4, resolve as resolve10, sep as sep4 } from "node:path";
+import { createServer as createServer3 } from "node:http";
+import { lstatSync as lstatSync12, readFileSync as readFileSync13, realpathSync as realpathSync2, watch } from "node:fs";
+import { extname as extname2, isAbsolute as isAbsolute9, join as join9, relative as relative4, resolve as resolve12, sep as sep4 } from "node:path";
 var contentTypes = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json", ".txt": "text/plain; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp", ".ico": "image/x-icon", ".woff": "font/woff", ".woff2": "font/woff2", ".ttf": "font/ttf" };
 var publicParts = (parts) => parts.every((part) => part.length > 0 && !part.startsWith(".") && !part.includes(":") && !part.includes("\\") && !part.includes("\0") && !["node_modules", "__backify"].includes(part.toLowerCase()));
 function publicFile(directory2, pathname) {
   const parts = pathname.split("/").slice(1);
   if (parts.at(-1) === "") parts[parts.length - 1] = "index.html";
   if (!publicParts(parts)) throw new Error("refused");
-  const filename2 = resolve10(directory2, ...parts), part = relative4(directory2, filename2);
-  if (part === ".." || part.startsWith(".." + sep4) || isAbsolute8(part) || !contentTypes[extname2(filename2).toLowerCase()]) throw new Error("refused");
+  const filename2 = resolve12(directory2, ...parts), part = relative4(directory2, filename2);
+  if (part === ".." || part.startsWith(".." + sep4) || isAbsolute9(part) || !contentTypes[extname2(filename2).toLowerCase()]) throw new Error("refused");
   let current = directory2;
-  if (lstatSync10(current).isSymbolicLink() || realpathSync2(current) !== directory2) throw new Error("refused");
+  if (lstatSync12(current).isSymbolicLink() || realpathSync2(current) !== directory2) throw new Error("refused");
   for (const segment of parts) {
-    current = join6(current, segment);
-    if (lstatSync10(current).isSymbolicLink()) throw new Error("refused");
+    current = join9(current, segment);
+    if (lstatSync12(current).isSymbolicLink()) throw new Error("refused");
   }
-  const stat = lstatSync10(filename2);
+  const stat = lstatSync12(filename2);
   if (!stat.isFile() || stat.nlink !== 1 || stat.size > 5242880) throw new Error("refused");
   return filename2;
 }
@@ -20873,7 +21587,7 @@ async function startLocalStaticFrontend(directory2, port, backendUrl) {
   const watcher = watch(directory2, { recursive: true }, (_, filename2) => {
     if (filename2 && publicParts(filename2.toString().split(/[\\/]/)) && contentTypes[extname2(filename2.toString()).toLowerCase()]) revision++;
   });
-  const server = createServer2((request, response) => {
+  const server = createServer3((request, response) => {
     const send = (status, type, body) => {
       response.writeHead(status, { "content-type": type, "cache-control": "no-store", "x-content-type-options": "nosniff", "content-length": Buffer.byteLength(body) });
       response.end(request.method === "HEAD" ? void 0 : body);
@@ -20886,7 +21600,7 @@ async function startLocalStaticFrontend(directory2, port, backendUrl) {
       if (pathname === "/__backify/revision") return send(200, "text/plain", String(revision));
       if (pathname === "/__backify/config.json") return send(200, "application/json", JSON.stringify({ backendUrl: backendUrl ?? null }));
       const filename2 = publicFile(directory2, pathname);
-      const content = readFileSync10(filename2);
+      const content = readFileSync13(filename2);
       if (content.length > 5242880) throw new Error("refused");
       const extension = extname2(filename2).toLowerCase();
       const body = extension === ".html" ? content.toString("utf8") + '\n<script src="/__backify/reload.js?revision=' + revision + '"></script>\n' : content;
@@ -20929,31 +21643,31 @@ function prepareLocalFrontend(root, options, privateFiles = []) {
     if (options.frontendPort !== void 0) throw new Error("Frontend port requires an explicit frontend directory");
     return void 0;
   }
-  const directory2 = realpathSync3(resolve11(root, options.frontend));
+  const directory2 = realpathSync3(resolve13(root, options.frontend));
   const part = relative5(realpathSync3(root), directory2);
-  if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute9(part) || !statSync(directory2).isDirectory()) throw new Error("Frontend must be a directory inside this repository");
+  if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute10(part) || !statSync(directory2).isDirectory()) throw new Error("Frontend must be a directory inside this repository");
   if (options.frontendAdapter === "static") {
     if (part && part.split(/[\\/]/).some((segment) => segment.startsWith(".") || segment.toLowerCase() === "node_modules")) throw new Error("Static frontend must not use a private state or dependency directory");
     return prepareLocalStaticFrontend(directory2);
   }
-  if (!existsSync6(join7(directory2, "package.json"))) throw new Error("Frontend requires an existing package.json and installed Vite");
-  const require3 = createRequire3(join7(directory2, "package.json"));
+  if (!existsSync9(join10(directory2, "package.json"))) throw new Error("Frontend requires an existing package.json and installed Vite");
+  const require3 = createRequire3(join10(directory2, "package.json"));
   let packagePath;
   try {
     packagePath = require3.resolve("vite/package.json");
   } catch {
     throw new Error("Frontend requires locally installed Vite; Backify does not install dependencies automatically");
   }
-  const metadata = JSON.parse(readFileSync11(packagePath, "utf8"));
+  const metadata = JSON.parse(readFileSync14(packagePath, "utf8"));
   if (metadata.name !== "vite" || typeof metadata.bin?.vite !== "string") throw new Error("Installed Vite has no supported CLI entrypoint");
-  const executable = realpathSync3(resolve11(dirname7(packagePath), metadata.bin.vite));
-  const executablePart = relative5(realpathSync3(dirname7(packagePath)), executable);
-  if (executablePart === ".." || executablePart.startsWith("../") || executablePart.startsWith("..\\") || isAbsolute9(executablePart)) throw new Error("Vite CLI entrypoint must remain inside its package");
+  const executable = realpathSync3(resolve13(dirname10(packagePath), metadata.bin.vite));
+  const executablePart = relative5(realpathSync3(dirname10(packagePath)), executable);
+  if (executablePart === ".." || executablePart.startsWith("../") || executablePart.startsWith("..\\") || isAbsolute10(executablePart)) throw new Error("Vite CLI entrypoint must remain inside its package");
   const timeout = options.frontendStartupTimeoutMs ?? 3e4;
   if (!Number.isInteger(timeout) || timeout < 100 || timeout > 12e4) throw new Error("Frontend startup timeout must be 100-120000 milliseconds");
   const modulePath = realpathSync3(require3.resolve("vite"));
-  const modulePart = relative5(realpathSync3(dirname7(packagePath)), modulePath);
-  if (modulePart === ".." || modulePart.startsWith("../") || modulePart.startsWith("..\\") || isAbsolute9(modulePart)) throw new Error("Vite module must remain inside its package");
+  const modulePart = relative5(realpathSync3(dirname10(packagePath)), modulePath);
+  if (modulePart === ".." || modulePart.startsWith("../") || modulePart.startsWith("..\\") || isAbsolute10(modulePart)) throw new Error("Vite module must remain inside its package");
   return { adapter: "vite", directory: directory2, modulePath, timeout, privateFiles };
 }
 async function stopFrontend(child) {
@@ -21008,17 +21722,19 @@ async function startLocalFrontend(prepared, port, backendUrl) {
 }
 
 // src/local-identity.ts
-import { readFileSync as readFileSync12, statSync as statSync2 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync15, statSync as statSync2 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 
 // ../sdk/dist/local-identity.js
-import { createHash as createHash11, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash12, randomBytes as randomBytes4 } from "node:crypto";
 function createLocalIdentityProvider(options) {
   const serverOnly = () => {
     if (typeof window !== "undefined")
       throw new Error("Local development identities are server-only");
   };
   serverOnly();
+  if (typeof process !== "undefined" && process.env.NODE_ENV === "production")
+    throw new Error("Local Backify identities must not run in production");
   const uuid5 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) && value !== "00000000-0000-0000-0000-000000000000";
   const text3 = (value, maximum) => typeof value === "string" && value.length > 0 && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value);
   if (!options.scope || Object.keys(options.scope).length !== 3 || !uuid5(options.scope.organizationId) || !uuid5(options.scope.applicationId) || !uuid5(options.scope.environmentId) || !text3(options.organizationName, 200) || !Array.isArray(options.users) || options.users.length < 1 || options.users.length > 32 || !Array.isArray(options.requestOrigins) || options.requestOrigins.length < 1 || options.requestOrigins.length > 8)
@@ -21026,9 +21742,11 @@ function createLocalIdentityProvider(options) {
   const scope = { ...options.scope }, organizationName = options.organizationName;
   const users = /* @__PURE__ */ new Map();
   for (const user of options.users) {
-    if (!user || Object.keys(user).some((name2) => !["id", "displayName", "email"].includes(name2)) || !uuid5(user.id) || users.has(user.id) || !text3(user.displayName, 200) || user.email !== void 0 && !text3(user.email, 320))
+    if (!user || Object.keys(user).some((name2) => !["id", "displayName", "email", "roles"].includes(name2)) || !uuid5(user.id) || users.has(user.id) || !text3(user.displayName, 200) || user.email !== void 0 && !text3(user.email, 320))
       throw new Error("Invalid local identity user");
-    users.set(user.id, { ...user });
+    if (user.roles !== void 0 && (!Array.isArray(user.roles) || user.roles.length > 32 || user.roles.some((role) => !role || Object.keys(role).some((name2) => !["name", "permissions"].includes(name2)) || !text3(role.name, 100) || !Array.isArray(role.permissions) || role.permissions.length > 128 || role.permissions.some((permission) => !text3(permission, 100)) || new Set(role.permissions).size !== role.permissions.length) || new Set(user.roles.map((role) => role.name)).size !== user.roles.length))
+      throw new Error("Invalid local identity roles");
+    users.set(user.id, structuredClone(user));
   }
   const origins = /* @__PURE__ */ new Set();
   for (const value of options.requestOrigins) {
@@ -21051,7 +21769,7 @@ function createLocalIdentityProvider(options) {
     return value;
   };
   const sessions = /* @__PURE__ */ new Map();
-  const digest4 = (token) => createHash11("sha256").update(token).digest("hex");
+  const digest4 = (token) => createHash12("sha256").update(token).digest("hex");
   const tokenPattern = /^backify-local-user_[a-zA-Z0-9_-]{43}$/;
   const requestAuth = {
     forRequest(request) {
@@ -21068,7 +21786,7 @@ function createLocalIdentityProvider(options) {
         if (!session || session.issued > time || session.expires <= time)
           throw new ApplicationAuthenticationError("application_identity_invalid");
         const user = users.get(session.userId);
-        return { ...user, roles: [], claims: { ...scope, localDevelopment: true } };
+        return { ...structuredClone(user), roles: structuredClone(user.roles ?? []), claims: { ...scope, localDevelopment: true } };
       };
       return { currentUser: async () => identity(), currentOrganization: async () => identity() ? { id: scope.organizationId, name: organizationName } : null };
     }
@@ -21077,7 +21795,7 @@ function createLocalIdentityProvider(options) {
     requestAuth,
     profiles() {
       serverOnly();
-      return [...users.values()].map((user) => ({ ...user }));
+      return [...users.values()].map((user) => structuredClone(user));
     },
     issue(userId, lifetimeSeconds = 300) {
       const time = now();
@@ -21088,7 +21806,7 @@ function createLocalIdentityProvider(options) {
           sessions.delete(hash2);
       if (sessions.size >= 128)
         throw new ApplicationAuthenticationError("application_identity_unavailable");
-      const accessToken = "backify-local-user_" + randomBytes3(32).toString("base64url"), expires = time + lifetimeSeconds;
+      const accessToken = "backify-local-user_" + randomBytes4(32).toString("base64url"), expires = time + lifetimeSeconds;
       sessions.set(digest4(accessToken), { userId, issued: time, expires });
       return { accessToken, tokenType: "Bearer", expiresAt: new Date(expires * 1e3).toISOString() };
     },
@@ -21104,22 +21822,22 @@ function createLocalIdentityProvider(options) {
 }
 
 // src/local-identity.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 function prepareLocalIdentity(root, filename2) {
   if (filename2 === void 0) return void 0;
-  const path = resolve12(root, filename2);
+  const path = resolve14(root, filename2);
   assertLocalStatePath(root, path);
   if (!statSync2(path).isFile() || statSync2(path).size > 16384) throw new Error("Local identity profiles require a file at most 16 KiB");
   let input;
   try {
-    input = JSON.parse(readFileSync12(path, "utf8"));
+    input = JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     throw new Error("Invalid local identity profile JSON");
   }
   if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some((name2) => !["version", "organizationName", "users"].includes(name2))) throw new Error("Invalid local identity profiles");
   const value = input;
   if (value.version !== 1) throw new Error("Invalid local identity profile version");
-  const identity = createLocalIdentityProvider({ scope: { organizationId: randomUUID6(), applicationId: randomUUID6(), environmentId: randomUUID6() }, organizationName: value.organizationName, users: value.users, requestOrigins: ["http://127.0.0.1:3000"] });
+  const identity = createLocalIdentityProvider({ scope: { organizationId: randomUUID7(), applicationId: randomUUID7(), environmentId: randomUUID7() }, organizationName: value.organizationName, users: value.users, requestOrigins: ["http://127.0.0.1:3000"] });
   return { organizationName: value.organizationName, users: identity.profiles() };
 }
 function localIdentityCommand(args2) {
@@ -21145,17 +21863,17 @@ function localIdentityCommand(args2) {
 }
 
 // src/local-job-history.ts
-import { lstatSync as lstatSync11, readFileSync as readFileSync13 } from "node:fs";
-import { isAbsolute as isAbsolute10, resolve as resolve13 } from "node:path";
+import { lstatSync as lstatSync13, readFileSync as readFileSync16 } from "node:fs";
+import { isAbsolute as isAbsolute11, resolve as resolve15 } from "node:path";
 function prepareLocalJobHistory(root, filename2, artifacts, manifest, current) {
   if (filename2 === void 0) return [];
   const read = (filename3, maximum) => {
-    if (typeof filename3 !== "string" || !filename3 || isAbsolute10(filename3)) throw new Error();
-    const path = resolve13(root, filename3);
+    if (typeof filename3 !== "string" || !filename3 || isAbsolute11(filename3)) throw new Error();
+    const path = resolve15(root, filename3);
     assertLocalStatePath(root, path);
-    const metadata = lstatSync11(path);
+    const metadata = lstatSync13(path);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > maximum) throw new Error();
-    const bytes = readFileSync13(path);
+    const bytes = readFileSync16(path);
     if (bytes.length > maximum) throw new Error();
     return new TextDecoder("utf8", { fatal: true }).decode(bytes);
   };
@@ -21165,7 +21883,7 @@ function prepareLocalJobHistory(root, filename2, artifacts, manifest, current) {
     if (!input || Object.keys(input).sort().join(",") !== "schemaVersion,workers" || input.schemaVersion !== 1 || !Array.isArray(input.workers) || input.workers.length < 1 || input.workers.length > 15) throw new Error();
     const versions = /* @__PURE__ */ new Set([current.artifact.artifactVersion]);
     for (const item of input.workers) {
-      if (!item || Object.keys(item).some((name2) => !["artifactVersion", "authFile", "trustSyncFile", "manifestFile", "workerDirectory"].includes(name2)) || ["artifactVersion", "manifestFile", "workerDirectory"].some((name2) => !Object.hasOwn(item, name2)) || typeof item.artifactVersion !== "string" || item.artifactVersion.length !== 64 || !/^[a-f0-9]{64}$/.test(item.artifactVersion) || versions.has(item.artifactVersion) || !artifacts.some((artifact) => artifact.artifactVersion === item.artifactVersion) || typeof item.workerDirectory !== "string" || !item.workerDirectory || isAbsolute10(item.workerDirectory)) throw new Error();
+      if (!item || Object.keys(item).some((name2) => !["artifactVersion", "authFile", "trustSyncFile", "manifestFile", "workerDirectory"].includes(name2)) || ["artifactVersion", "manifestFile", "workerDirectory"].some((name2) => !Object.hasOwn(item, name2)) || typeof item.artifactVersion !== "string" || item.artifactVersion.length !== 64 || !/^[a-f0-9]{64}$/.test(item.artifactVersion) || versions.has(item.artifactVersion) || !artifacts.some((artifact) => artifact.artifactVersion === item.artifactVersion) || typeof item.workerDirectory !== "string" || !item.workerDirectory || isAbsolute11(item.workerDirectory)) throw new Error();
       versions.add(item.artifactVersion);
     }
     return input.workers.map((item) => {
@@ -21201,30 +21919,30 @@ function prepareLocalJobHistory(root, filename2, artifacts, manifest, current) {
 }
 
 // src/local-secrets.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, randomUUID as randomUUID7 } from "node:crypto";
-import { closeSync as closeSync3, existsSync as existsSync7, fsyncSync as fsyncSync3, lstatSync as lstatSync12, mkdirSync as mkdirSync4, openSync as openSync3, readFileSync as readFileSync14, realpathSync as realpathSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname8, isAbsolute as isAbsolute11, join as join8, relative as relative6, resolve as resolve14 } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes5, randomUUID as randomUUID8 } from "node:crypto";
+import { closeSync as closeSync3, existsSync as existsSync10, fsyncSync as fsyncSync3, lstatSync as lstatSync14, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync17, realpathSync as realpathSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute12, join as join11, relative as relative6, resolve as resolve16 } from "node:path";
 var maximumBytes2 = 1048576;
 var secretName = /^[A-Z][A-Z0-9_]{0,127}$/;
 var failure = () => new Error("Local secret vault unavailable or invalid; review the vault and external key privately");
 function vaultPath(root) {
-  return join8(realpathSync4(root), ".backify", "dev", "secrets.enc.json");
+  return join11(realpathSync4(root), ".backify", "dev", "secrets.enc.json");
 }
 function inside(root, filename2) {
   const part = relative6(root, filename2);
-  return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute11(part);
+  return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute12(part);
 }
 function privateFile(filename2, limit) {
-  for (let current = resolve14(filename2); ; current = dirname8(current)) {
-    if (lstatSync12(current).isSymbolicLink()) throw failure();
-    if (dirname8(current) === current) break;
+  for (let current = resolve16(filename2); ; current = dirname11(current)) {
+    if (lstatSync14(current).isSymbolicLink()) throw failure();
+    if (dirname11(current) === current) break;
   }
-  const stat = lstatSync12(filename2);
+  const stat = lstatSync14(filename2);
   if (!stat.isFile() || stat.size > limit || stat.nlink !== 1 || process.platform !== "win32" && (stat.mode & 63) !== 0) throw failure();
-  return readFileSync14(filename2);
+  return readFileSync17(filename2);
 }
 function externalKey(root, filename2) {
-  const keyFile = resolve14(filename2);
+  const keyFile = resolve16(filename2);
   if (inside(realpathSync4(root), keyFile) || inside(realpathSync4(root), realpathSync4(keyFile))) throw failure();
   const encoded = privateFile(keyFile, 64).toString("utf8");
   if (!/^[a-f0-9]{64}$/.test(encoded)) throw failure();
@@ -21238,7 +21956,7 @@ function context(root, application) {
 }
 function encrypt(root, application, key, secrets) {
   validateSecrets(secrets);
-  const nonce = randomBytes4(12), cipher = createCipheriv("aes-256-gcm", key, nonce);
+  const nonce = randomBytes5(12), cipher = createCipheriv("aes-256-gcm", key, nonce);
   cipher.setAAD(context(root, application));
   const plaintext = Buffer.from(JSON.stringify(secrets));
   try {
@@ -21253,22 +21971,22 @@ function encrypt(root, application, key, secrets) {
 function writePrivate2(filename2, value) {
   const descriptor2 = openSync3(filename2, "wx", 384);
   try {
-    writeFileSync6(descriptor2, value);
+    writeFileSync9(descriptor2, value);
     fsyncSync3(descriptor2);
   } finally {
     closeSync3(descriptor2);
   }
 }
 function ensureIgnored(root) {
-  const filename2 = join8(root, ".gitignore");
+  const filename2 = join11(root, ".gitignore");
   assertLocalStatePath(root, filename2);
-  const current = existsSync7(filename2) ? readFileSync14(filename2, "utf8") : "";
-  if (!current.split(/\r?\n/).some((line) => line.trim() === ".backify/")) writeFileSync6(filename2, current + (current && !current.endsWith("\n") ? "\n" : "") + ".backify/\n");
+  const current = existsSync10(filename2) ? readFileSync17(filename2, "utf8") : "";
+  if (!current.split(/\r?\n/).some((line) => line.trim() === ".backify/")) writeFileSync9(filename2, current + (current && !current.endsWith("\n") ? "\n" : "") + ".backify/\n");
 }
 function readLocalSecrets(root, application, keyFile) {
   const filename2 = vaultPath(root);
   assertLocalStatePath(root, filename2);
-  if (!existsSync7(filename2) && keyFile === void 0) return {};
+  if (!existsSync10(filename2) && keyFile === void 0) return {};
   if (!keyFile) throw new Error("Encrypted local secrets require --local-secrets-key <external-key-file>");
   let key, plaintext;
   try {
@@ -21296,22 +22014,22 @@ function readLocalSecrets(root, application, keyFile) {
   }
 }
 function initializeLocalSecrets(root, application, keyFile) {
-  const filename2 = vaultPath(root), external = resolve14(keyFile);
+  const filename2 = vaultPath(root), external = resolve16(keyFile);
   assertLocalStatePath(root, filename2);
-  if (existsSync7(filename2) || existsSync7(external)) throw new Error("Local secret initialization never overwrites an existing vault or key");
-  if (inside(realpathSync4(root), external) || inside(realpathSync4(root), realpathSync4(dirname8(external)))) throw new Error("Local secret key must be outside the repository in an existing private directory");
-  for (let current = dirname8(external); ; current = dirname8(current)) {
-    const stat = lstatSync12(current);
+  if (existsSync10(filename2) || existsSync10(external)) throw new Error("Local secret initialization never overwrites an existing vault or key");
+  if (inside(realpathSync4(root), external) || inside(realpathSync4(root), realpathSync4(dirname11(external)))) throw new Error("Local secret key must be outside the repository in an existing private directory");
+  for (let current = dirname11(external); ; current = dirname11(current)) {
+    const stat = lstatSync14(current);
     if (stat.isSymbolicLink()) throw failure();
-    if (current === dirname8(external) && process.platform !== "win32" && (stat.mode & 63) !== 0) throw failure();
-    if (dirname8(current) === current) break;
+    if (current === dirname11(external) && process.platform !== "win32" && (stat.mode & 63) !== 0) throw failure();
+    if (dirname11(current) === current) break;
   }
   ensureIgnored(root);
   const release2 = acquireLocalLease(root, ".backify/dev/secrets.lock");
-  const key = randomBytes4(32);
+  const key = randomBytes5(32);
   try {
-    if (existsSync7(filename2)) throw failure();
-    mkdirSync4(dirname8(filename2), { recursive: true, mode: 448 });
+    if (existsSync10(filename2)) throw failure();
+    mkdirSync5(dirname11(filename2), { recursive: true, mode: 448 });
     writePrivate2(external, key.toString("hex"));
     writePrivate2(filename2, encrypt(root, application, key, {}));
   } finally {
@@ -21330,7 +22048,7 @@ function setLocalSecret(root, application, keyFile, name2, value) {
     const secrets = readLocalSecrets(root, application, keyFile);
     secrets[name2] = value;
     key = externalKey(root, keyFile);
-    const temporary = filename2 + "." + randomUUID7() + ".tmp";
+    const temporary = filename2 + "." + randomUUID8() + ".tmp";
     assertLocalStatePath(root, temporary);
     writePrivate2(temporary, encrypt(root, application, key, secrets));
     renameLocalFile(temporary, filename2);
@@ -21367,27 +22085,27 @@ async function localSecretsCommand(args2, root, application, input = process.std
 
 // src/local-development.ts
 function localManifest(root = process.cwd()) {
-  const filename2 = join9(root, "backify.yaml");
-  if (!existsSync8(filename2)) throw new Error("Create backify.yaml with version, application, runtime and explicit capabilities before running backify dev");
-  const manifest = parseApplicationManifest(readFileSync15(filename2, "utf8"));
-  const entry = resolve15(root, manifest.runtime.entrypoint);
-  if (!existsSync8(entry) || !inside2(root, realpathSync5(entry))) throw new Error("Runtime entrypoint must exist inside this repository");
+  const filename2 = join12(root, "backify.yaml");
+  if (!existsSync11(filename2)) throw new Error("Create backify.yaml with version, application, runtime and explicit capabilities before running backify dev");
+  const manifest = parseApplicationManifest(readFileSync18(filename2, "utf8"));
+  const entry = resolve17(root, manifest.runtime.entrypoint);
+  if (!existsSync11(entry) || !inside2(root, realpathSync5(entry))) throw new Error("Runtime entrypoint must exist inside this repository");
   const discovered = analyzeSources(repositorySources(root));
-  const diagnostics = manifestDiagnostics(manifest, Object.keys(discovered.capabilities));
+  const diagnostics = manifestDiagnostics(manifest, Object.keys(discovered.capabilities), discovered.capabilities.auth?.configuration);
   if (diagnostics.length) throw new Error(diagnostics.map((diagnostic) => diagnostic.message).join("; "));
   return manifest;
 }
 function inside2(root, path) {
   const part = relative7(realpathSync5(root), path);
-  return part !== ".." && !part.startsWith(".." + (process.platform === "win32" ? "\\" : "/")) && !isAbsolute12(part);
+  return part !== ".." && !part.startsWith(".." + (process.platform === "win32" ? "\\" : "/")) && !isAbsolute13(part);
 }
 function sessionPath(root) {
-  return join9(root, ".backify", "dev", "session.json");
+  return join12(root, ".backify", "dev", "session.json");
 }
 async function localRequest(path, input, root = process.cwd()) {
   if (!/^\/v1\/[a-z/-]+$/.test(path)) throw new Error("Invalid local command path");
-  if (!existsSync8(sessionPath(root))) throw new Error("Start backify dev before using local commands");
-  const session = JSON.parse(readFileSync15(sessionPath(root), "utf8"));
+  if (!existsSync11(sessionPath(root))) throw new Error("Start backify dev before using local commands");
+  const session = JSON.parse(readFileSync18(sessionPath(root), "utf8"));
   if (session.version !== 1 || !Number.isInteger(session.port) || session.port < 1 || session.port > 65535 || !/^[a-f0-9]{64}$/.test(session.token)) throw new Error("Invalid local session");
   const response = await fetch("http://127.0.0.1:" + session.port + path, { method: input === void 0 ? "GET" : "POST", headers: { authorization: "Bearer " + session.token, "content-type": "application/json" }, body: input === void 0 ? void 0 : JSON.stringify(input), redirect: "error", signal: AbortSignal.timeout(35e3) });
   if (!response.ok) {
@@ -21420,7 +22138,7 @@ async function startLocalDevelopment(options = {}) {
   if (options.jobTrustSyncFile !== void 0 && options.jobAuthFile === void 0) throw new Error("Native worker trust renewal requires explicit reviewed auth mounts");
   if (options.jobHistoryFile !== void 0 && options.jobWorkerDirectory === void 0) throw new Error("Historical workers require paired reviewed job artifacts and current worker");
   if (options.jobAuthFile !== void 0 && options.identityUsers !== void 0) throw new Error("Reviewed worker issuer trust cannot be mixed with local identity fixtures");
-  const root = resolve15(options.root ?? process.cwd());
+  const root = resolve17(options.root ?? process.cwd());
   const manifest = localManifest(root);
   const validateSecretIntent = (values, intent = manifest) => {
     if (Object.keys(values).length && (!intent.capabilities.secrets || intent.capabilities.secrets.enabled === false)) throw new Error("Encrypted local secrets require enabled capabilities.secrets");
@@ -21437,18 +22155,18 @@ async function startLocalDevelopment(options = {}) {
   createLocalJobTrustRenewal(root, authMounts);
   const identityProfiles = prepareLocalIdentity(root, options.identityUsers);
   if (identityProfiles && (!manifest.capabilities.auth || manifest.capabilities.auth.enabled === false || options.backendPort === void 0)) throw new Error("Explicit local identities require capabilities.auth and --backend-port");
-  const preparedFrontend = prepareLocalFrontend(root, options, options.localSecretsKey ? [realpathSync5(resolve15(options.localSecretsKey))] : []);
-  const ignorePath = join9(root, ".gitignore");
-  if (existsSync8(ignorePath) && lstatSync13(ignorePath).isSymbolicLink()) throw new Error("Local development cannot update a symlinked .gitignore");
-  const ignore = existsSync8(ignorePath) ? readFileSync15(ignorePath, "utf8") : "";
-  if (!ignore.split(/\r?\n/).some((line) => line.trim() === ".backify/")) writeFileSync7(ignorePath, ignore + (ignore.endsWith("\n") || !ignore ? "" : "\n") + ".backify/\n");
+  const preparedFrontend = prepareLocalFrontend(root, options, options.localSecretsKey ? [realpathSync5(resolve17(options.localSecretsKey))] : []);
+  const ignorePath = join12(root, ".gitignore");
+  if (existsSync11(ignorePath) && lstatSync15(ignorePath).isSymbolicLink()) throw new Error("Local development cannot update a symlinked .gitignore");
+  const ignore = existsSync11(ignorePath) ? readFileSync18(ignorePath, "utf8") : "";
+  if (!ignore.split(/\r?\n/).some((line) => line.trim() === ".backify/")) writeFileSync10(ignorePath, ignore + (ignore.endsWith("\n") || !ignore ? "" : "\n") + ".backify/\n");
   if (options.port !== void 0 && (!Number.isInteger(options.port) || options.port < 0 || options.port > 65535)) throw new Error("Dashboard port must be 0-65535");
-  const directory2 = join9(root, ".backify", "dev");
+  const directory2 = join12(root, ".backify", "dev");
   assertLocalStatePath(root, directory2);
-  for (const filename2 of ["session.json", "session.json.tmp", "worker.mjs", "worker.mjs.map", "state.json", "state.json.tmp"]) assertLocalStatePath(root, join9(directory2, filename2));
-  mkdirSync5(directory2, { recursive: true });
+  for (const filename2 of ["session.json", "session.json.tmp", "worker.mjs", "worker.mjs.map", "state.json", "state.json.tmp"]) assertLocalStatePath(root, join12(directory2, filename2));
+  mkdirSync6(directory2, { recursive: true });
   if (!inside2(root, realpathSync5(directory2))) throw new Error("Local state directory must remain inside this repository");
-  if (existsSync8(sessionPath(root))) {
+  if (existsSync11(sessionPath(root))) {
     try {
       await localRequest("/v1/status", void 0, root);
       throw new Error("Backify dev is already running for this repository");
@@ -21478,15 +22196,15 @@ async function startLocalDevelopment(options = {}) {
     }
     throw error;
   }
-  const token = randomBytes5(32).toString("hex");
-  const identityScope = services?.identityScope ?? { organizationId: randomUUID8(), applicationId: randomUUID8(), environmentId: randomUUID8() };
+  const token = randomBytes6(32).toString("hex");
+  const identityScope = services?.identityScope ?? { organizationId: randomUUID9(), applicationId: randomUUID9(), environmentId: randomUUID9() };
   const workerEnvironment = (worker) => {
     if (!worker.authTrust) return worker;
     const { renewal, ...authTrust } = worker.authTrust;
     return { ...worker, authTrust };
   };
   const identityEnvironment = () => ({ BACKIFY_LOCAL_IDENTITY: identityProfiles ? JSON.stringify({ ...identityProfiles, scope: identityScope, requestOrigins: [backendUrl, frontend?.url].filter(Boolean) }) : "", BACKIFY_LOCAL_JOB_WORKER: jobWorker ? JSON.stringify({ ...workerEnvironment(jobWorker), scope: identityScope, historicalWorkers: historicalWorkers.map(workerEnvironment) }) : "", BACKIFY_LOCAL_JOBS: services?.jobs ? "postgres-jobs" : "snapshot-emulator" });
-  const outfile = join9(directory2, "worker.mjs");
+  const outfile = join12(directory2, "worker.mjs");
   let child;
   const trustRenewal = createLocalJobTrustRenewal(root, authMounts, { onFailure: () => console.error("Native worker trust renewal unavailable; existing validity and pin guards remain enforced."), onUpdate: () => {
     if (child?.connected) child.send({ type: "trust-renewed", workers: activeWorkers.filter((worker) => worker.authTrust).map((worker) => ({ artifactVersion: worker.artifact.artifactVersion, revision: worker.authTrust.revision, trustDigest: worker.authTrust.trustDigest })) }, (error) => {
@@ -21524,8 +22242,8 @@ async function startLocalDevelopment(options = {}) {
     }
     await stopChild(child);
     if (stopping) return;
-    const version = createHash12("sha256").update(readFileSync15(outfile)).update(services?.configurationFingerprint ?? "lightweight").digest("hex");
-    const worker = spawn4(process.execPath, [outfile], { cwd: root, windowsHide: true, stdio: ["ignore", 2, 2, "ipc"], env: { ...process.env, ...identityEnvironment(), BACKIFY_LOCAL_SECRETS_IPC: "1", HOST: "127.0.0.1", ...backendPort === void 0 ? {} : { PORT: String(backendPort) }, BACKIFY_LOCAL_BACKEND_URL: backendUrl ?? "", BACKIFY_LOCAL_FRONTEND_URL: frontend?.url ?? "", BACKIFY_LOCAL_DATABASE_ENABLED: manifest.capabilities.database && manifest.capabilities.database.enabled !== false ? "1" : "0", BACKIFY_LOCAL_STORAGE_ENABLED: manifest.capabilities.storage && manifest.capabilities.storage.enabled !== false ? "1" : "0", BACKIFY_LOCAL_STORAGE_BUCKETS: JSON.stringify(manifest.capabilities.storage?.buckets?.map((bucket) => bucket.name) ?? (manifest.capabilities.storage ? ["default"] : [])), BACKIFY_LOCAL_TOKEN: token, BACKIFY_LOCAL_PORT: String(dashboardPort), BACKIFY_LOCAL_STATE: join9(directory2, "state.json"), BACKIFY_LOCAL_VERSION: version, BACKIFY_LOCAL_HCR_URL: services?.runtimeUrl ?? "", BACKIFY_LOCAL_WORKLOAD_TOKEN_PATH: services?.tokenPath ?? "", BACKIFY_LOCAL_DATABASE: services ? services.database ? "postgres" : "disabled" : "document-emulator", BACKIFY_LOCAL_EVENTS: services?.events ? "postgres-events" : services ? "disabled" : "snapshot-emulator", BACKIFY_LOCAL_STORAGE: services ? services.storage ? "filesystem" : "disabled" : "snapshot-emulator" } });
+    const version = createHash13("sha256").update(readFileSync18(outfile)).update(services?.configurationFingerprint ?? "lightweight").digest("hex");
+    const worker = spawn4(process.execPath, [outfile], { cwd: root, windowsHide: true, stdio: ["ignore", 2, 2, "ipc"], env: { ...process.env, ...identityEnvironment(), BACKIFY_LOCAL_SECRETS_IPC: "1", HOST: "127.0.0.1", ...backendPort === void 0 ? {} : { PORT: String(backendPort) }, BACKIFY_LOCAL_BACKEND_URL: backendUrl ?? "", BACKIFY_LOCAL_FRONTEND_URL: frontend?.url ?? "", BACKIFY_LOCAL_DATABASE_ENABLED: manifest.capabilities.database && manifest.capabilities.database.enabled !== false ? "1" : "0", BACKIFY_LOCAL_STORAGE_ENABLED: manifest.capabilities.storage && manifest.capabilities.storage.enabled !== false ? "1" : "0", BACKIFY_LOCAL_STORAGE_BUCKETS: JSON.stringify(manifest.capabilities.storage?.buckets?.map((bucket) => bucket.name) ?? (manifest.capabilities.storage ? ["default"] : [])), BACKIFY_LOCAL_TOKEN: token, BACKIFY_LOCAL_PORT: String(dashboardPort), BACKIFY_LOCAL_STATE: join12(directory2, "state.json"), BACKIFY_LOCAL_VERSION: version, BACKIFY_LOCAL_HCR_URL: services?.runtimeUrl ?? "", BACKIFY_LOCAL_WORKLOAD_TOKEN_PATH: services?.tokenPath ?? "", BACKIFY_LOCAL_DATABASE: services ? services.database ? "postgres" : "disabled" : "document-emulator", BACKIFY_LOCAL_EVENTS: services?.events ? "postgres-events" : services ? "disabled" : "snapshot-emulator", BACKIFY_LOCAL_STORAGE: services ? services.storage ? "filesystem" : "disabled" : "snapshot-emulator" } });
     child = worker;
     worker.send({ type: "local-secrets", secrets }, (error) => {
       if (error) {
@@ -21547,7 +22265,7 @@ async function startLocalDevelopment(options = {}) {
       workerReady = true;
       const session = { version: 1, port: message.port, token, pid: worker.pid };
       const temp = sessionPath(root) + ".tmp";
-      writeFileSync7(temp, JSON.stringify(session), { mode: 384 });
+      writeFileSync10(temp, JSON.stringify(session), { mode: 384 });
       renameLocalFile(temp, sessionPath(root));
       const url = "http://127.0.0.1:" + message.port;
       options.onReady?.(url, { frontendUrl: frontend?.url, backendUrl });
@@ -21559,17 +22277,17 @@ async function startLocalDevelopment(options = {}) {
     });
   };
   try {
-    buildContext = await context2({ absWorkingDir: root, stdin: { contents: localWorkerSource(resolve15(root, manifest.runtime.entrypoint)), resolveDir: root, sourcefile: "backify-local-worker.ts", loader: "ts" }, bundle: true, platform: "node", format: "esm", target: "node20", outfile, sourcemap: true, banner: { js: 'import { createRequire as __backifyCreateRequire } from "node:module"; var require = __backifyCreateRequire(import.meta.url);' }, plugins: [{ name: "backify-local-lifecycle", setup(build3) {
+    buildContext = await context2({ absWorkingDir: root, stdin: { contents: localWorkerSource(resolve17(root, manifest.runtime.entrypoint)), resolveDir: root, sourcefile: "backify-local-worker.ts", loader: "ts" }, bundle: true, platform: "node", format: "esm", target: "node20", outfile, sourcemap: true, banner: { js: 'import { createRequire as __backifyCreateRequire } from "node:module"; var require = __backifyCreateRequire(import.meta.url);' }, plugins: [{ name: "backify-local-lifecycle", setup(build3) {
       build3.onLoad({ filter: /./, namespace: "file" }, (input) => {
-        if (input.path !== resolve15(root, manifest.runtime.entrypoint)) return;
+        if (input.path !== resolve17(root, manifest.runtime.entrypoint)) return;
         try {
           const updated = localManifest(root);
           if (services && JSON.stringify(updated.capabilities) !== JSON.stringify(manifest.capabilities)) throw new Error("Full-fidelity capability or migration intent changed; restart backify dev to review and apply it");
           if (updated.runtime.entrypoint !== manifest.runtime.entrypoint) throw new Error("Runtime entrypoint changed; restart backify dev");
         } catch (error) {
-          return { errors: [{ text: error instanceof Error ? error.message : "Manifest validation failed" }], watchFiles: [join9(root, "backify.yaml")] };
+          return { errors: [{ text: error instanceof Error ? error.message : "Manifest validation failed" }], watchFiles: [join12(root, "backify.yaml")] };
         }
-        return { contents: readFileSync15(input.path, "utf8"), loader: input.path.endsWith(".tsx") ? "tsx" : /\.(ts|mts|cts)$/.test(input.path) ? "ts" : input.path.endsWith(".jsx") ? "jsx" : "js", watchFiles: [join9(root, "backify.yaml")] };
+        return { contents: readFileSync18(input.path, "utf8"), loader: input.path.endsWith(".tsx") ? "tsx" : /\.(ts|mts|cts)$/.test(input.path) ? "ts" : input.path.endsWith(".jsx") ? "jsx" : "js", watchFiles: [join12(root, "backify.yaml")] };
       });
       build3.onEnd((result) => {
         if (result.errors.length) rejectStartup(new Error("Local application build failed"));
@@ -21625,8 +22343,8 @@ async function startLocalDevelopment(options = {}) {
         }
       }
     }
-    if (existsSync8(sessionPath(root))) {
-      const session = JSON.parse(readFileSync15(sessionPath(root), "utf8"));
+    if (existsSync11(sessionPath(root))) {
+      const session = JSON.parse(readFileSync18(sessionPath(root), "utf8"));
       if (session.token === token) unlinkSync4(sessionPath(root));
     }
   };
@@ -21640,11 +22358,11 @@ async function startLocalDevelopment(options = {}) {
 }
 async function runLocalTests(root = process.cwd()) {
   const manifest = localManifest(root);
-  const project = JSON.parse(readFileSync15(join9(root, "package.json"), "utf8"));
+  const project = JSON.parse(readFileSync18(join12(root, "package.json"), "utf8"));
   if (!project.scripts?.test) throw new Error("Add a test script to package.json so AI agents can run backify test");
   const result = await new Promise((resolveResult, reject) => {
-    const npmPath = process.platform === "win32" ? process.env.npm_execpath ?? join9(dirname9(process.execPath), "node_modules", "npm", "bin", "npm-cli.js") : void 0;
-    if (npmPath && !existsSync8(npmPath)) {
+    const npmPath = process.platform === "win32" ? process.env.npm_execpath ?? join12(dirname12(process.execPath), "node_modules", "npm", "bin", "npm-cli.js") : void 0;
+    if (npmPath && !existsSync11(npmPath)) {
       reject(new Error("Cannot locate npm-cli.js; run backify test through npx or npm"));
       return;
     }
@@ -21664,15 +22382,15 @@ async function runLocalTests(root = process.cwd()) {
 // src/workload.ts
 function inside3(root, filename2) {
   const part = relative8(root, filename2);
-  return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute13(part);
+  return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute14(part);
 }
 function digest3(contents) {
-  return createHash13("sha256").update(contents).digest("hex");
+  return createHash14("sha256").update(contents).digest("hex");
 }
 function packageDirectory(filename2) {
-  for (let current = dirname10(filename2); ; current = dirname10(current)) {
-    if (existsSync9(join10(current, "package.json"))) return current;
-    if (dirname10(current) === current) throw new Error("Cannot locate an installed dependency package");
+  for (let current = dirname13(filename2); ; current = dirname13(current)) {
+    if (existsSync12(join13(current, "package.json"))) return current;
+    if (dirname13(current) === current) throw new Error("Cannot locate an installed dependency package");
   }
 }
 function workloadSource(entry, kind, capabilities) {
@@ -21753,11 +22471,11 @@ main().catch(() => finish({ schemaVersion: 1, status: "failed", error: "workload
 `.replace("__KIND__", JSON.stringify(kind)).replace("__CAPABILITIES__", JSON.stringify(capabilities)).replace("__AUTH_ENABLED__", String(capabilities.includes("auth"))).replace("__ENTRY__", JSON.stringify(entry));
 }
 async function prepareWorkload(options) {
-  const root = realpathSync6(resolve16(options.root ?? process.cwd()));
+  const root = realpathSync6(resolve18(options.root ?? process.cwd()));
   const manifest = localManifest(root);
   if (options.kind !== "http" && options.kind !== "worker") throw new Error("Workload kind must be http or worker");
   if (options.kind === "worker" && !options.entry) throw new Error("Workers require an explicit declaration-only entrypoint");
-  const entry = realpathSync6(resolve16(root, options.entry ?? manifest.runtime.entrypoint));
+  const entry = realpathSync6(resolve18(root, options.entry ?? manifest.runtime.entrypoint));
   if (!inside3(root, entry)) throw new Error("Workload entrypoint must stay inside this repository");
   const enabled = Object.entries(manifest.capabilities).filter(([, settings]) => settings?.enabled !== false).map(([name2]) => name2).sort();
   if (options.kind === "worker" && !enabled.includes("jobs")) throw new Error("Workers require declared jobs capability");
@@ -21783,14 +22501,14 @@ async function prepareWorkload(options) {
       context3.onResolve({ filter: /./ }, async (input) => {
         if (input.pluginData?.backifyResolved) return;
         if (input.path === "@backifydev/sdk/local" || input.path === "@backifydev/sdk/runtime" && input.namespace !== "backify-workload-host") return { errors: [{ text: "Production application code must not import local emulators or host-only runtime configuration" }] };
-        const resolved = await context3.resolve(input.path, { importer: input.namespace === "backify-workload-host" ? join10(root, input.importer) : input.importer, resolveDir: input.resolveDir, kind: input.kind, pluginData: { backifyResolved: true } });
+        const resolved = await context3.resolve(input.path, { importer: input.namespace === "backify-workload-host" ? join13(root, input.importer) : input.importer, resolveDir: input.resolveDir, kind: input.kind, pluginData: { backifyResolved: true } });
         if (!resolved.external && !resolved.errors.length && resolved.path) {
           const directory2 = realpathSync6(packageDirectory(resolved.path));
           const target = relative8(directory2, realpathSync6(resolved.path)).replaceAll("\\", "/");
-          if (JSON.parse(readFileSync16(join10(directory2, "package.json"), "utf8")).name === "@backifydev/sdk") {
+          if (JSON.parse(readFileSync19(join13(directory2, "package.json"), "utf8")).name === "@backifydev/sdk") {
             if (/^(src|dist)\/local\.(ts|js)$/.test(target) || /^(src|dist)\/runtime\.(ts|js)$/.test(target) && input.namespace !== "backify-workload-host" && !inside3(directory2, realpathSync6(input.importer))) return { errors: [{ text: "Production application code must not import local emulators or host-only runtime configuration" }] };
           }
-          if (!isAbsolute13(input.path) && !input.path.startsWith(".")) trustedPackages.add(directory2);
+          if (!isAbsolute14(input.path) && !input.path.startsWith(".")) trustedPackages.add(directory2);
         }
         return resolved;
       });
@@ -21849,34 +22567,34 @@ async function packageWorkload(options) {
   if (plan.blockers.includes("bundle-warning-review-required")) throw new Error("Workload bundle warnings require review before packaging");
   const dockerfile = ["FROM " + options.baseImage, "WORKDIR /app", "COPY --chown=1000:1000 workload.mjs artifact.json ./", "ENV NODE_ENV=production PORT=8080 BACKIFY_ARTIFACT_SHA256=" + plan.artifactVersion + " BACKIFY_WORKLOAD_TOKEN_FILE=/run/backify/workload/token", "USER 1000:1000", ...options.kind === "http" ? ["EXPOSE 8080"] : [], "STOPSIGNAL SIGTERM", 'ENTRYPOINT ["node", "workload.mjs"]', ""].join("\n");
   const files = { "workload.mjs": bundle, "artifact.json": JSON.stringify(plan, null, 2) + "\n", "Dockerfile": dockerfile, ".dockerignore": "**\n!Dockerfile\n!workload.mjs\n!artifact.json\n!.dockerignore\n" };
-  const output = resolve16(root, options.output ?? ".backify/artifacts/" + options.kind + "-" + plan.artifactVersion.slice(0, 16));
+  const output = resolve18(root, options.output ?? ".backify/artifacts/" + options.kind + "-" + plan.artifactVersion.slice(0, 16));
   assertLocalStatePath(root, output);
-  if (existsSync9(output)) {
-    if (JSON.stringify(readdirSync4(output).sort()) !== JSON.stringify(Object.keys(files).sort()) || Object.entries(files).some(([name2, value]) => {
-      assertLocalStatePath(root, join10(output, name2));
-      return !readFileSync16(join10(output, name2)).equals(Buffer.from(value));
+  if (existsSync12(output)) {
+    if (JSON.stringify(readdirSync6(output).sort()) !== JSON.stringify(Object.keys(files).sort()) || Object.entries(files).some(([name2, value]) => {
+      assertLocalStatePath(root, join13(output, name2));
+      return !readFileSync19(join13(output, name2)).equals(Buffer.from(value));
     })) throw new Error("Refusing to overwrite an existing workload artifact directory");
   } else {
-    mkdirSync6(output, { recursive: true });
-    for (const [name2, value] of Object.entries(files)) writeFileSync8(join10(output, name2), value, { flag: "wx", mode: 384 });
+    mkdirSync7(output, { recursive: true });
+    for (const [name2, value] of Object.entries(files)) writeFileSync11(join13(output, name2), value, { flag: "wx", mode: 384 });
   }
   return { ...plan, outputDirectory: relative8(root, output).replaceAll("\\", "/") };
 }
 
 // src/workload-provenance.ts
 import { execFileSync } from "node:child_process";
-import { mkdirSync as mkdirSync7, mkdtempSync, readdirSync as readdirSync5, rmSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync2, readdirSync as readdirSync7, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename2, dirname as dirname12, isAbsolute as isAbsolute14, join as join12, relative as relative9, resolve as resolve18 } from "node:path";
+import { basename as basename3, dirname as dirname15, isAbsolute as isAbsolute15, join as join15, relative as relative9, resolve as resolve20 } from "node:path";
 
 // src/workload-provenance-oci.ts
-import { createHash as createHash14 } from "node:crypto";
-import { createReadStream, lstatSync as lstatSync14, readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname11, join as join11, parse as parse3, resolve as resolve17 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import { createReadStream, lstatSync as lstatSync16, readFileSync as readFileSync20 } from "node:fs";
+import { dirname as dirname14, join as join14, parse as parse3, resolve as resolve19 } from "node:path";
 import { Transform, Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
-var provenanceHash = (bytes) => "sha256:" + createHash14("sha256").update(bytes).digest("hex");
+var provenanceHash = (bytes) => "sha256:" + createHash15("sha256").update(bytes).digest("hex");
 var maximumLayer = 256 * 1024 * 1024;
 var maximumImage = 1024 * 1024 * 1024;
 var manifestTypes = ["application/vnd.oci.image.manifest.v1+json", "application/vnd.docker.distribution.manifest.v2+json"];
@@ -21887,14 +22605,14 @@ function provenanceRef(value) {
   return value.slice(value.lastIndexOf("@") + 1);
 }
 function provenanceFile(filename2, maximum) {
-  const absolute = resolve17(filename2);
-  for (let ancestor = absolute; ; ancestor = dirname11(ancestor)) {
-    if (lstatSync14(ancestor).isSymbolicLink()) throw new Error("Provenance paths must not contain links");
+  const absolute = resolve19(filename2);
+  for (let ancestor = absolute; ; ancestor = dirname14(ancestor)) {
+    if (lstatSync16(ancestor).isSymbolicLink()) throw new Error("Provenance paths must not contain links");
     if (ancestor === parse3(absolute).root) break;
   }
-  const stat = lstatSync14(absolute);
+  const stat = lstatSync16(absolute);
   if (!stat.isFile() || stat.nlink !== 1 || stat.size < 1 || stat.size > maximum) throw new Error("Invalid provenance file");
-  const bytes = readFileSync17(absolute);
+  const bytes = readFileSync20(absolute);
   if (bytes.length !== stat.size) throw new Error("Provenance file changed during read");
   return bytes;
 }
@@ -21903,7 +22621,7 @@ function descriptor(value) {
   return value;
 }
 function blobPath(root, value) {
-  return join11(root, "blobs", "sha256", descriptor(value).digest.slice(7));
+  return join14(root, "blobs", "sha256", descriptor(value).digest.slice(7));
 }
 function jsonBlob(root, value) {
   const bytes = provenanceFile(blobPath(root, value), 1024 * 1024);
@@ -21912,8 +22630,8 @@ function jsonBlob(root, value) {
 }
 async function inspectProvenanceImage(root, architecture, requestedDigest) {
   if (!["amd64", "arm64"].includes(architecture) || requestedDigest && !digestPattern.test(requestedDigest)) throw new Error("Invalid OCI platform or digest");
-  if (JSON.parse(provenanceFile(join11(root, "oci-layout"), 1024).toString()).imageLayoutVersion !== "1.0.0") throw new Error("OCI layout required");
-  const indexBytes = provenanceFile(join11(root, "index.json"), 1024 * 1024);
+  if (JSON.parse(provenanceFile(join14(root, "oci-layout"), 1024).toString()).imageLayoutVersion !== "1.0.0") throw new Error("OCI layout required");
+  const indexBytes = provenanceFile(join14(root, "index.json"), 1024 * 1024);
   let current = JSON.parse(indexBytes.toString());
   let selected;
   let manifestDigest = provenanceHash(indexBytes);
@@ -21944,7 +22662,7 @@ async function inspectProvenanceImage(root, architecture, requestedDigest) {
     if (!digestPattern.test(config.rootfs.diff_ids[index])) throw new Error("Invalid OCI diff ID");
     const filename2 = blobPath(root, layer);
     provenanceFileMetadata(filename2, layer.size);
-    const storedHash = createHash14("sha256"), expandedHash = createHash14("sha256");
+    const storedHash = createHash15("sha256"), expandedHash = createHash15("sha256");
     let stored = 0, expanded = 0;
     const counter = new Transform({ transform(chunk, _encoding, callback) {
       stored += chunk.length;
@@ -21970,12 +22688,12 @@ async function inspectProvenanceImage(root, architecture, requestedDigest) {
   return { manifestDigest, configDigest: configuration.digest, architecture, layers };
 }
 function provenanceFileMetadata(filename2, expectedSize) {
-  const absolute = resolve17(filename2);
-  for (let ancestor = absolute; ; ancestor = dirname11(ancestor)) {
-    if (lstatSync14(ancestor).isSymbolicLink()) throw new Error("Provenance paths must not contain links");
+  const absolute = resolve19(filename2);
+  for (let ancestor = absolute; ; ancestor = dirname14(ancestor)) {
+    if (lstatSync16(ancestor).isSymbolicLink()) throw new Error("Provenance paths must not contain links");
     if (ancestor === parse3(absolute).root) break;
   }
-  const stat = lstatSync14(absolute);
+  const stat = lstatSync16(absolute);
   if (!stat.isFile() || stat.nlink !== 1 || stat.size !== expectedSize) throw new Error("Invalid OCI layer file");
 }
 function verifyBaseLineage(base, image2) {
@@ -21998,7 +22716,7 @@ function canonical(value) {
   if (value && typeof value === "object") return "{" + Object.entries(value).sort(([left], [right]) => left.localeCompare(right, "en")).map(([name2, item]) => JSON.stringify(name2) + ":" + canonical(item)).join(",") + "}";
   return JSON.stringify(value);
 }
-function git(root, args2) {
+function git2(root, args2) {
   try {
     return execFileSync("git", ["-C", root, ...args2], { encoding: "utf8", windowsHide: true, timeout: 3e4, maxBuffer: 16 * 1024 * 1024 }).trim();
   } catch {
@@ -22033,28 +22751,28 @@ function dependencyMaterials(lock) {
   return { digest: provenanceHash(canonical(materials.sort((left, right) => left.path.localeCompare(right.path, "en")))), count: materials.length };
 }
 async function captureWorkloadProvenance(options) {
-  const root = resolve18(options.root ?? process.cwd());
+  const root = resolve20(options.root ?? process.cwd());
   if (!repositoryPattern.test(options.repository) || !["first", "second"].includes(options.replica)) throw new Error("Invalid provenance repository or replica");
-  const applicationPath = relative9(root, resolve18(root, options.application)).replaceAll("\\", "/");
-  if (!applicationPath || isAbsolute14(applicationPath) || applicationPath.split("/").includes("..")) throw new Error("Application must be inside the source checkout");
-  if (git(root, ["rev-parse", "--show-toplevel"]).replaceAll("\\", "/").toLowerCase() !== root.replaceAll("\\", "/").toLowerCase() || git(root, ["status", "--porcelain", "--untracked-files=all"]) || git(root, ["ls-files", "--stage"]).split("\n").some((line) => line.startsWith("160000 "))) throw new Error("Clean root checkout without submodules required");
-  const commit = git(root, ["rev-parse", "HEAD"]), tree = git(root, ["rev-parse", "HEAD^{tree}"]);
+  const applicationPath = relative9(root, resolve20(root, options.application)).replaceAll("\\", "/");
+  if (!applicationPath || isAbsolute15(applicationPath) || applicationPath.split("/").includes("..")) throw new Error("Application must be inside the source checkout");
+  if (git2(root, ["rev-parse", "--show-toplevel"]).replaceAll("\\", "/").toLowerCase() !== root.replaceAll("\\", "/").toLowerCase() || git2(root, ["status", "--porcelain", "--untracked-files=all"]) || git2(root, ["ls-files", "--stage"]).split("\n").some((line) => line.startsWith("160000 "))) throw new Error("Clean root checkout without submodules required");
+  const commit = git2(root, ["rev-parse", "HEAD"]), tree = git2(root, ["rev-parse", "HEAD^{tree}"]);
   if (!sha.test(commit) || !sha.test(tree)) throw new Error("Full Git commit and tree required");
-  const origin = git(root, ["remote", "get-url", "origin"]);
+  const origin = git2(root, ["remote", "get-url", "origin"]);
   if (!["https://github.com/" + options.repository, "https://github.com/" + options.repository + ".git", "git@github.com:" + options.repository + ".git"].includes(origin)) throw new Error("Source repository does not match origin");
-  const lockBytes = provenanceFile(join12(root, "package-lock.json"), 16 * 1024 * 1024);
+  const lockBytes = provenanceFile(join15(root, "package-lock.json"), 16 * 1024 * 1024);
   const dependencies = dependencyMaterials(JSON.parse(lockBytes.toString("utf8")));
-  const context3 = resolve18(root, options.context);
-  if (canonical(readdirSync5(context3).sort()) !== canonical(contextNames)) throw new Error("Exact allowlisted workload context required");
+  const context3 = resolve20(root, options.context);
+  if (canonical(readdirSync7(context3).sort()) !== canonical(contextNames)) throw new Error("Exact allowlisted workload context required");
   const contextDigests = {};
-  for (const name2 of contextNames) contextDigests[name2] = provenanceHash(provenanceFile(join12(context3, name2), name2 === "workload.mjs" ? 16 * 1024 * 1024 : 65536));
-  const plan = boundedJson(join12(context3, "artifact.json"));
+  for (const name2 of contextNames) contextDigests[name2] = provenanceHash(provenanceFile(join15(context3, name2), name2 === "workload.mjs" ? 16 * 1024 * 1024 : 65536));
+  const plan = boundedJson(join15(context3, "artifact.json"));
   const baseDigest = provenanceRef(options.baseImage);
   if (plan.schemaVersion !== 1 || plan.kind !== "worker" || plan.baseImage !== options.baseImage || !/^[a-f0-9]{64}$/.test(plan.artifactVersion) || !/^[a-f0-9]{64}$/.test(plan.manifestVersion) || contextDigests["workload.mjs"] !== "sha256:" + plan.artifactVersion || typeof plan.entrypoint !== "string") throw new Error("Worker context does not match artifact metadata");
   const dockerfile = ["FROM " + options.baseImage, "WORKDIR /app", "COPY --chown=1000:1000 workload.mjs artifact.json ./", "ENV NODE_ENV=production PORT=8080 BACKIFY_ARTIFACT_SHA256=" + plan.artifactVersion + " BACKIFY_WORKLOAD_TOKEN_FILE=/run/backify/workload/token", "USER 1000:1000", "STOPSIGNAL SIGTERM", 'ENTRYPOINT ["node", "workload.mjs"]', ""].join("\n");
-  if (!provenanceFile(join12(context3, "Dockerfile"), 65536).equals(Buffer.from(dockerfile)) || provenanceFile(join12(context3, ".dockerignore"), 65536).toString() !== "**\n!Dockerfile\n!workload.mjs\n!artifact.json\n!.dockerignore\n") throw new Error("Unreviewed workload build recipe");
-  const base = await inspectProvenanceImage(resolve18(root, options.baseLayout), options.architecture, baseDigest);
-  const image2 = await inspectProvenanceImage(resolve18(root, options.imageLayout), options.architecture);
+  if (!provenanceFile(join15(context3, "Dockerfile"), 65536).equals(Buffer.from(dockerfile)) || provenanceFile(join15(context3, ".dockerignore"), 65536).toString() !== "**\n!Dockerfile\n!workload.mjs\n!artifact.json\n!.dockerignore\n") throw new Error("Unreviewed workload build recipe");
+  const base = await inspectProvenanceImage(resolve20(root, options.baseLayout), options.architecture, baseDigest);
+  const image2 = await inspectProvenanceImage(resolve20(root, options.imageLayout), options.architecture);
   verifyBaseLineage(base, image2);
   let npm;
   try {
@@ -22076,7 +22794,7 @@ function validateReport(report) {
   if (report.schemaVersion !== 1 || report.kind !== "worker-build-provenance" || !repositoryPattern.test(report.source.repository) || !sha.test(report.source.commit) || !sha.test(report.source.tree) || !digestPattern.test(report.source.lockfileDigest) || !digestPattern.test(report.source.dependencyMaterialsDigest) || !Number.isSafeInteger(report.source.dependencyCount) || report.source.dependencyCount < 1 || !/^v[0-9]+\.[0-9]+\.[0-9]+$/.test(report.toolchain.node) || !/^[0-9]+\.[0-9]+\.[0-9]+$/.test(report.toolchain.npm) || !/^[a-f0-9]{64}$/.test(report.build.artifactVersion) || !/^[a-f0-9]{64}$/.test(report.build.manifestVersion) || Object.values(report.build.context).some((value) => !digestPattern.test(value)) || report.build.context["workload.mjs"] !== "sha256:" + report.build.artifactVersion || !/^[1-9][0-9]*$/.test(report.invocation.runId) || !/^[1-9][0-9]*$/.test(report.invocation.attempt) || !["first", "second"].includes(report.invocation.replica)) throw new Error("Invalid build provenance report");
   for (const path of [report.build.applicationPath, report.build.entry]) {
     text2(path);
-    if (isAbsolute14(path) || path.includes(":") || path.includes("\\") || path.split("/").includes("..")) throw new Error("Invalid build source path");
+    if (isAbsolute15(path) || path.includes(":") || path.includes("\\") || path.split("/").includes("..")) throw new Error("Invalid build source path");
   }
   provenanceRef(report.build.baseImage);
   for (const image2 of [report.base, report.image]) {
@@ -22127,17 +22845,17 @@ function verifyWorkloadProvenance(options, now = /* @__PURE__ */ new Date()) {
     if (provenanceHash(baseSubject) !== provenanceRef(policy.baseImage)) throw new Error("Base attestation subject does not match the approved image digest");
     evidence.push({ bytes: baseSubject, bundle: provenanceFile(options.baseBundle, 4 * 1024 * 1024), identity: { ...policy, ...supplier } });
   }
-  const scratchRoot = resolve18(tmpdir());
-  const scratch = mkdtempSync(join12(scratchRoot, "backify-provenance-"));
-  if (dirname12(scratch) !== scratchRoot || !basename2(scratch).startsWith("backify-provenance-")) throw new Error("Unsafe provenance evidence directory");
+  const scratchRoot = resolve20(tmpdir());
+  const scratch = mkdtempSync2(join15(scratchRoot, "backify-provenance-"));
+  if (dirname15(scratch) !== scratchRoot || !basename3(scratch).startsWith("backify-provenance-")) throw new Error("Unsafe provenance evidence directory");
   try {
-    mkdirSync7(join12(scratch, "evidence"), { mode: 448 });
-    const trustedRoot = join12(scratch, "evidence", "trusted-root.jsonl");
-    writeFileSync9(trustedRoot, rootBytes, { flag: "wx", mode: 384 });
+    mkdirSync8(join15(scratch, "evidence"), { mode: 448 });
+    const trustedRoot = join15(scratch, "evidence", "trusted-root.jsonl");
+    writeFileSync12(trustedRoot, rootBytes, { flag: "wx", mode: 384 });
     for (const [index, { bytes, bundle: bundleBytes, identity }] of evidence.entries()) {
-      const report = join12(scratch, "evidence", "report-" + index + ".json"), bundle = join12(scratch, "evidence", "bundle-" + index + ".jsonl");
-      writeFileSync9(report, bytes, { flag: "wx", mode: 384 });
-      writeFileSync9(bundle, bundleBytes, { flag: "wx", mode: 384 });
+      const report = join15(scratch, "evidence", "report-" + index + ".json"), bundle = join15(scratch, "evidence", "bundle-" + index + ".jsonl");
+      writeFileSync12(report, bytes, { flag: "wx", mode: 384 });
+      writeFileSync12(bundle, bundleBytes, { flag: "wx", mode: 384 });
       try {
         const result = execFileSync("gh", ["attestation", "verify", report, "--bundle", bundle, "--custom-trusted-root", trustedRoot, "--hostname", "github.com", "--repo", identity.repository, "--signer-workflow", identity.signerWorkflow, "--signer-digest", identity.signerDigest, "--source-digest", identity.sourceCommit, "--source-ref", identity.sourceRef, "--deny-self-hosted-runners", "--predicate-type", "https://slsa.dev/provenance/v1", "--format", "json"], { encoding: "utf8", windowsHide: true, timeout: 12e4, maxBuffer: 4 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
         if (!Array.isArray(JSON.parse(result)) || !JSON.parse(result).length) throw new Error();
@@ -22146,7 +22864,7 @@ function verifyWorkloadProvenance(options, now = /* @__PURE__ */ new Date()) {
       }
     }
   } finally {
-    rmSync(scratch, { recursive: true, force: true });
+    rmSync2(scratch, { recursive: true, force: true });
   }
   return { schemaVersion: 1, status: "build-provenance-verified", sourceCommitVerified: true, dependencyMaterialsVerified: true, dependencyReproductionVerified: Boolean(second), imageReproductionVerified: Boolean(second), baseDigestPinned: true, baseLineageVerified: true, baseSupplierProvenanceVerified: Boolean(supplier), baseImageVerified: Boolean(supplier), imageContentVerified: false, deploymentReady: false, verifiedAt: now.toISOString(), expiresAt: policy.expiresAt, policyDigest: provenanceHash(policyBytes), sourceCommit: policy.sourceCommit, imageDigest: first.image.manifestDigest, artifactVersion: first.build.artifactVersion, manifestVersion: first.build.manifestVersion, reportDigests: reportBytes.map(provenanceHash), blockers: ["separate-hcr-image-content-verification-required", "base-runtime-job-conformance-required", "reviewed-signed-fleet-installation-required", "production-workload-credential-isolation-required"] };
 }
@@ -22168,13 +22886,13 @@ async function workloadProvenanceCommand(args2) {
     return verifyWorkloadProvenance({ policy: required("--policy"), firstReport: options.get("--report") ?? required("--first-report"), firstBundle: options.get("--bundle") ?? required("--first-bundle"), secondReport: options.get("--second-report"), secondBundle: options.get("--second-bundle"), baseSubject: options.get("--base-subject"), baseBundle: options.get("--base-bundle"), trustedRoot: required("--trusted-root") });
   }
   const result = await captureWorkloadProvenance({ root: options.get("--root"), repository: required("--repository"), application: required("--application"), context: required("--context"), baseLayout: required("--base-layout"), imageLayout: required("--image-layout"), baseImage: required("--base-image"), architecture: required("--architecture"), replica: options.get("--replica") ?? "first" });
-  writeFileSync9(resolve18(required("--output")), JSON.stringify(result, null, 2) + "\n", { flag: "wx", mode: 384 });
+  writeFileSync12(resolve20(required("--output")), JSON.stringify(result, null, 2) + "\n", { flag: "wx", mode: 384 });
   return { schemaVersion: 1, status: "captured-unsigned", deploymentReady: false, reportDigest: provenanceHash(JSON.stringify(result, null, 2) + "\n") };
 }
 
 // src/workload-artifact-plan.ts
-import { existsSync as existsSync10, lstatSync as lstatSync15, readFileSync as readFileSync18, realpathSync as realpathSync7 } from "node:fs";
-import { resolve as resolve19 } from "node:path";
+import { existsSync as existsSync13, lstatSync as lstatSync17, readFileSync as readFileSync21, realpathSync as realpathSync7 } from "node:fs";
+import { resolve as resolve21 } from "node:path";
 function uuid4(value) {
   return typeof value === "string" && value.length === 36 && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value) && value !== "00000000-0000-0000-0000-000000000000";
 }
@@ -22212,14 +22930,14 @@ function parseWorkerArtifactPlan(args2) {
 }
 async function planWorkerArtifactRegistration(options) {
   if (![options.organizationId, options.applicationId, options.environmentId, options.deploymentId].every(uuid4) || typeof options.sourceCommit !== "string" || ![40, 64].includes(options.sourceCommit.length) || !/^[a-f0-9]+$/.test(options.sourceCommit) || !validImage(options.imageReference)) throw new Error("Invalid worker artifact scope, source or image pin");
-  const root = realpathSync7(resolve19(options.root ?? process.cwd()));
+  const root = realpathSync7(resolve21(options.root ?? process.cwd()));
   if (typeof options.jobsFile !== "string" || !options.jobsFile || typeof options.entry !== "string" || !options.entry) throw new Error("Worker artifact planning requires explicit jobs and entry files");
-  const filename2 = resolve19(root, options.jobsFile);
+  const filename2 = resolve21(root, options.jobsFile);
   assertLocalStatePath(root, filename2);
-  if (!existsSync10(filename2) || !lstatSync15(filename2).isFile() || lstatSync15(filename2).size > 32768) throw new Error("Worker job metadata file must be a bounded repository file");
+  if (!existsSync13(filename2) || !lstatSync17(filename2).isFile() || lstatSync17(filename2).size > 32768) throw new Error("Worker job metadata file must be a bounded repository file");
   let jobs;
   try {
-    jobs = jobMetadata(JSON.parse(readFileSync18(filename2, "utf8")));
+    jobs = jobMetadata(JSON.parse(readFileSync21(filename2, "utf8")));
   } catch {
     throw new Error("Invalid bounded worker job metadata");
   }
@@ -22240,8 +22958,8 @@ async function planWorkerArtifactRegistration(options) {
 }
 
 // src/workload-trust-state.ts
-import { lstatSync as lstatSync16, readFileSync as readFileSync19 } from "node:fs";
-import { isAbsolute as isAbsolute15, resolve as resolve20 } from "node:path";
+import { lstatSync as lstatSync18, readFileSync as readFileSync22 } from "node:fs";
+import { isAbsolute as isAbsolute16, resolve as resolve22 } from "node:path";
 function parseWorkloadTrustState(args2) {
   const action = args2[0];
   if (action !== "plan" && action !== "initialize") throw new Error("Use backify workload trust-state plan|initialize");
@@ -22263,12 +22981,12 @@ function parseWorkloadTrustState(args2) {
   return { action, trustFile: values.get("--trust-file"), stateFile: values.get("--state-file"), expectedRevision: Number(values.get("--revision")), expectedScope: { organizationId: values.get("--organization"), applicationId: values.get("--application"), environmentId: values.get("--environment") }, confirmed: values.has("--confirm") };
 }
 function workloadTrustState(options) {
-  if (!["plan", "initialize"].includes(options.action) || !isAbsolute15(options.trustFile) || !isAbsolute15(options.stateFile) || resolve20(options.trustFile) === resolve20(options.stateFile) || !Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 1) throw new Error("Specify separate absolute trust/state paths and a positive reviewed revision");
+  if (!["plan", "initialize"].includes(options.action) || !isAbsolute16(options.trustFile) || !isAbsolute16(options.stateFile) || resolve22(options.trustFile) === resolve22(options.stateFile) || !Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 1) throw new Error("Specify separate absolute trust/state paths and a positive reviewed revision");
   let trust;
   try {
-    const metadata = lstatSync16(options.trustFile);
+    const metadata = lstatSync18(options.trustFile);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 131072) throw new Error();
-    const bytes = readFileSync19(options.trustFile);
+    const bytes = readFileSync22(options.trustFile);
     if (bytes.length > 131072) throw new Error();
     trust = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(bytes));
   } catch {
@@ -22278,14 +22996,14 @@ function workloadTrustState(options) {
   if (trust.revision !== options.expectedRevision) throw new Error("Application identity trust revision changed; review again");
   if (options.action === "initialize") {
     if (!options.confirmed) throw new Error("Initialization requires explicit --confirm after reviewing the plan");
-    initializeApplicationAuthState(trust, { expectedScope: options.expectedScope, stateFile: resolve20(options.stateFile) });
+    initializeApplicationAuthState(trust, { expectedScope: options.expectedScope, stateFile: resolve22(options.stateFile) });
   }
-  return { schemaVersion: 1, status: options.action === "plan" ? "planned" : "initialized", scope: options.expectedScope, revision: trust.revision, validUntil: trust.validUntil, stateFile: resolve20(options.stateFile), requiresPrivatePersistentDirectory: true, recoveryAutomatic: false, productionChanges: false };
+  return { schemaVersion: 1, status: options.action === "plan" ? "planned" : "initialized", scope: options.expectedScope, revision: trust.revision, validUntil: trust.validUntil, stateFile: resolve22(options.stateFile), requiresPrivatePersistentDirectory: true, recoveryAutomatic: false, productionChanges: false };
 }
 
 // src/scaffold.ts
-import { existsSync as existsSync11, lstatSync as lstatSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync20, readdirSync as readdirSync6, realpathSync as realpathSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname13, join as join13, relative as relative10, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync14, lstatSync as lstatSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync23, readdirSync as readdirSync8, realpathSync as realpathSync8, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname16, join as join16, relative as relative10, resolve as resolve23 } from "node:path";
 function json2(value) {
   return JSON.stringify(value, null, 2) + "\n";
 }
@@ -22457,519 +23175,84 @@ server/jobs.ts; it is a declaration-only entry loaded by a trusted Backify host.
 The Dockerfile builds the HTTP server and web/dist frontend and serves both from
 one origin, with HOST/PORT from its host. Keep package-lock.json in source control.
 Use backify ship for Preview and promote that tested release to Live. No production
-provider-readiness claim, cloud deployment or browser authentication is implied.
-`
-  };
-}
-function scaffoldFullStack(options) {
-  const files = fullStackTemplate(options.appId, options.name);
-  const root = resolve21(options.root ?? process.cwd());
-  if (!existsSync11(root) || !lstatSync17(root).isDirectory() || lstatSync17(root).isSymbolicLink()) throw new Error("Scaffold destination must be an existing non-linked directory");
-  const allowed = /* @__PURE__ */ new Set([...Object.keys(files).map((filename2) => filename2.split("/")[0]), ".git", "node_modules", "package-lock.json", ".backify"]);
-  if (readdirSync6(root).some((filename2) => !allowed.has(filename2))) throw new Error("Scaffolding requires an empty folder or an unchanged generated starter");
-  const canonicalRoot = realpathSync8(root);
-  const pending = [];
-  for (const [filename2, content] of Object.entries(files)) {
-    const destination = join13(root, filename2);
-    let current = destination;
-    while (current !== root) {
-      try {
-        const stat = lstatSync17(current);
-        if (stat.isSymbolicLink() || current !== destination && !stat.isDirectory()) throw new Error("Scaffolding refuses linked or invalid output paths: " + filename2);
-        if (relative10(canonicalRoot, realpathSync8(current)).startsWith("..")) throw new Error("Scaffold output must remain inside its directory");
-        if (current === destination && (!stat.isFile() || readFileSync20(current, "utf8") !== content)) throw new Error("Scaffolding refuses to overwrite existing content: " + filename2);
-      } catch (error) {
-        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") throw error;
-        if (current === destination) pending.push(filename2);
-      }
-      current = dirname13(current);
-    }
-  }
-  for (const filename2 of pending) {
-    const destination = join13(root, filename2);
-    mkdirSync8(dirname13(destination), { recursive: true });
-    writeFileSync10(destination, files[filename2], { flag: "wx" });
-  }
-  return { template: "react-vite-hono", created: pending, unchanged: Object.keys(files).length - pending.length, installed: false, deployed: false };
-}
-
-// src/local-inspection-command.ts
-function localInspectionCommand(args2) {
-  const routes = { tables: "/v1/database/tables", rows: "/v1/database/rows", buckets: "/v1/storage/buckets", objects: "/v1/storage/objects", preview: "/v1/storage/preview", events: "/v1/events" };
-  const kind = args2[0];
-  if (!Object.hasOwn(routes, kind)) throw new Error("Use backify inspect tables|rows|buckets|objects|preview|events --local [--json]");
-  const allowed = kind === "rows" ? ["--table", "--limit", "--offset"] : kind === "objects" ? ["--bucket", "--prefix", "--limit", "--offset"] : kind === "preview" ? ["--bucket", "--key"] : [];
-  const values = /* @__PURE__ */ new Map();
-  const flags = /* @__PURE__ */ new Set();
-  for (let index = 1; index < args2.length; index++) {
-    const name2 = args2[index];
-    if (["--local", "--json"].includes(name2)) {
-      if (flags.has(name2)) throw new Error("Duplicate inspection flag");
-      flags.add(name2);
-      continue;
-    }
-    if (!allowed.includes(name2) || values.has(name2) || args2[index + 1] === void 0 || args2[index + 1].startsWith("--")) throw new Error("Invalid or missing inspection option");
-    values.set(name2, args2[++index]);
-  }
-  if (!flags.has("--local")) throw new Error("Inspection requires --local; no cloud or production data is queried");
-  const required = (name2) => {
-    const value = values.get(name2);
-    if (!value) throw new Error("Required inspection option: " + name2);
-    return value;
-  };
-  const page = () => {
-    const number = (name2, fallback, minimum, maximum) => {
-      const value = values.get(name2);
-      if (value !== void 0 && !/^\d+$/.test(value)) throw new Error("Invalid inspection page");
-      const parsed = value === void 0 ? fallback : Number(value);
-      if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) throw new Error("Invalid inspection page");
-      return parsed;
-    };
-    return { limit: number("--limit", 25, 1, 50), offset: number("--offset", 0, 0, 1e4) };
-  };
-  const input = kind === "rows" ? { table: required("--table"), ...page() } : kind === "objects" ? { bucket: required("--bucket"), ...page(), ...values.has("--prefix") ? { prefix: values.get("--prefix") } : {} } : kind === "preview" ? { bucket: required("--bucket"), key: required("--key") } : void 0;
-  return { kind, path: routes[kind], input };
-}
-
-// src/development.ts
-import { existsSync as existsSync14, readFileSync as readFileSync23, readdirSync as readdirSync8, writeFileSync as writeFileSync13, renameSync as renameSync4, rmSync as rmSync2, mkdtempSync as mkdtempSync2, lstatSync as lstatSync19, cpSync } from "node:fs";
-import { dirname as dirname16, join as join16, resolve as resolve23 } from "node:path";
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { randomUUID as randomUUID9 } from "node:crypto";
-
-// src/setup.ts
-import { existsSync as existsSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync7, lstatSync as lstatSync18 } from "node:fs";
-import { basename as basename3, dirname as dirname15, join as join15, resolve as resolve22, isAbsolute as isAbsolute16 } from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
-
-// src/delivery.ts
-import { existsSync as existsSync12, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname14, join as join14, relative as relativePath } from "node:path";
-import { createHash as createHash15 } from "node:crypto";
-var previousGeneratedWorkflowHashes = /* @__PURE__ */ new Set(["33e962274e8493f7cbac2afbac05a4e96afeec49ee08cf2bf82f8add9081b28b", "578dfb4c771c623fd04454e8a604efd701d5563d11e11191324862369bd24718", "6eb280ae7bdb14c390011686c41400f59c023304c3015d8440b7e80aaafa1c11", "545e03a1d5b996ade179e0e60ed5c86accdadc1982c1c25efd094e34f72f47ee"]);
-function validateDeliveryInstructions(root) {
-  for (const filename2 of ["BACKIFY.md", "BACKIFY-WORKFLOW.md"]) {
-    const path = join14(root, filename2);
-    if (existsSync12(path)) {
-      const existing = readFileSync21(path, "utf8").replace(/\r\n/g, "\n");
-      if (existing !== deliveryInstructions && !previousGeneratedWorkflowHashes.has(createHash15("sha256").update(existing).digest("hex"))) throw new Error(filename2 + " contains different instructions. Review it before initializing; it will not be overwritten.");
-    }
-  }
-}
-function installDeliveryInstructions(root, instructionFiles2) {
-  validateDeliveryInstructions(root);
-  writeFileSync11(join14(root, "BACKIFY.md"), deliveryInstructions);
-  for (const relative11 of instructionFiles2) {
-    const instructionPath = join14(root, relative11), content = readFileSync21(instructionPath, "utf8");
-    const link = relativePath(dirname14(instructionPath), join14(root, "BACKIFY.md")).replaceAll("\\", "/");
-    const legacyLink = relativePath(dirname14(instructionPath), join14(root, "BACKIFY-WORKFLOW.md")).replaceAll("\\", "/");
-    const legacy = "For application delivery and recording each user request, follow [BACKIFY-WORKFLOW.md](" + legacyLink + ").";
-    const guidance = "For application delivery and recording each user request, follow [BACKIFY.md](" + link + ").";
-    if (content.includes(legacy)) writeFileSync11(instructionPath, content.replace(legacy, guidance));
-    else if (!content.includes("## Backify delivery")) writeFileSync11(instructionPath, content.trimEnd() + "\n\n## Backify delivery\n\n" + guidance + "\n");
-  }
-}
-
-// src/setup.ts
-var instructionFiles = ["AGENTS.md"];
-var agentInstructionFiles = { codex: "AGENTS.md", claude: "CLAUDE.md", copilot: join15(".github", "copilot-instructions.md"), gemini: "GEMINI.md" };
-function instructionSelection(root, agent, instructionFile) {
-  const configPath2 = join15(root, "backify.json"), configured = existsSync13(configPath2) ? JSON.parse(readFileSync22(configPath2, "utf8")) : {};
-  const custom = instructionFile ?? (agent === void 0 ? configured.instructionFile : void 0);
-  const selected = instructionFile !== void 0 ? "custom" : agent ?? configured.agent ?? "codex";
-  if (typeof selected !== "string" || selected !== "custom" && !Object.hasOwn(agentInstructionFiles, selected)) throw new Error("Select the current tool with --agent or --instruction-file <relative-path>.");
-  const filename2 = custom ?? agentInstructionFiles[selected];
-  if (typeof filename2 !== "string" || !filename2.trim()) throw new Error("Select the current tool with --agent codex, claude, copilot, or gemini, or --instruction-file <relative-path> for any other tool.");
-  const normalized = filename2.replaceAll("\\", "/"), parts = normalized.split("/");
-  if (isAbsolute16(filename2) || /^[A-Za-z]:/.test(filename2) || parts.some((part) => !part || part === "." || part === ".." || part.toLowerCase() === ".git") || ["backify.md", "backify-workflow.md", "backify.json", "package.json", "package-lock.json"].includes(normalized.toLowerCase())) throw new Error("Instruction file must be a relative tool-instruction path inside the project, not Git metadata or a Backify configuration file.");
-  for (let index = 1; index <= parts.length; index++) {
-    const entry = join15(root, ...parts.slice(0, index));
-    try {
-      const metadata = lstatSync18(entry);
-      if (metadata.isSymbolicLink() || index < parts.length && !metadata.isDirectory() || index === parts.length && !metadata.isFile()) throw new Error("Instruction file path cannot traverse symlinks or replace a directory.");
-    } catch (reason) {
-      if (reason.code !== "ENOENT") throw reason;
-    }
-  }
-  return { agent: selected, instructionFile: normalized, files: [normalized] };
-}
-function selectedInstructionFiles(root = process.cwd(), agent, instructionFile) {
-  return instructionSelection(root, agent, instructionFile).files;
-}
-function isToolWorkspaceEntry(entry, root = process.cwd()) {
-  if (entry.name.toLowerCase() === ".git" || entry.name.toLowerCase() === ".env" || entry.name.toLowerCase().startsWith(".env.")) return false;
-  return entry.isDirectory() && (entry.name.startsWith(".") || ["work", "outputs"].includes(entry.name) || readdirSync7(join15(root, entry.name)).length === 0) || entry.isFile() && (entry.name.startsWith(".") || /\.(md|mdc)$/i.test(entry.name));
-}
-function detectPackageManager(root = process.cwd()) {
-  for (const [file, name2] of [["pnpm-lock.yaml", "pnpm"], ["yarn.lock", "yarn"], ["bun.lockb", "bun"], ["bun.lock", "bun"], ["package-lock.json", "npm"]]) if (existsSync13(join15(root, file))) return name2;
-  return "npm";
-}
-function updateInstructions(root = process.cwd(), agent, instructionFile) {
-  const updates = selectedInstructionFiles(root, agent, instructionFile).map((relative11) => {
-    const path = join15(root, relative11);
-    return { path, content: updateManagedInstructions(existsSync13(path) ? readFileSync22(path, "utf8") : "") };
-  });
-  for (const { path, content } of updates) {
-    mkdirSync9(dirname15(path), { recursive: true });
-    writeFileSync12(path, content);
-  }
-}
-function synchronize(root = process.cwd(), agent, instructionFile) {
-  const path = join15(root, "backify.json");
-  if (!existsSync13(path)) throw new Error("backify.json is missing; run backify init --app app_xxxxx");
-  const value = JSON.parse(readFileSync22(path, "utf8")), issues = validateConfig(value);
-  if (issues.length) throw new Error(issues.join("; "));
-  if (value.instructionVersion > INSTRUCTION_VERSION) throw new Error("This app uses newer instructions. Install a matching or newer CLI before syncing.");
-  const selected = instructionSelection(root, agent, instructionFile);
-  validateDeliveryInstructions(root);
-  updateInstructions(root, selected.agent, selected.instructionFile);
-  installDeliveryInstructions(root, selected.files);
-  value.agent = selected.agent;
-  value.instructionFile = selected.instructionFile;
-  value.instructionVersion = INSTRUCTION_VERSION;
-  writeFileSync12(path, JSON.stringify(value, null, 2) + "\n");
-}
-function sdkInstalled(root = process.cwd()) {
-  try {
-    const pkg = JSON.parse(readFileSync22(join15(root, "package.json"), "utf8"));
-    return Boolean(pkg.dependencies?.[SDK_PACKAGE] || pkg.devDependencies?.[SDK_PACKAGE]);
-  } catch {
-    return false;
-  }
-}
-function installSdk(root = process.cwd()) {
-  if (sdkInstalled(root)) return;
-  const manager = detectPackageManager(root), args2 = manager === "npm" ? ["install", SDK_PACKAGE] : ["add", SDK_PACKAGE], result = spawnSync2(manager, args2, { cwd: root, stdio: "inherit", shell: process.platform === "win32" });
-  if (result.status !== 0) throw new Error(`Could not install ${SDK_PACKAGE} with ${manager}`);
-}
-function ensurePackageManifest(root) {
-  const path = join15(root, "package.json");
-  if (existsSync13(path)) return;
-  const setupFiles = /* @__PURE__ */ new Set([".git", ".gitignore", ".github", "AGENTS.md", "CLAUDE.md", "GEMINI.md", "BACKIFY.md", "BACKIFY-WORKFLOW.md", "README.md", "LICENSE", "backify.json"]);
-  if (readdirSync7(root, { withFileTypes: true }).some((entry) => !setupFiles.has(entry.name) && !isToolWorkspaceEntry(entry, root))) throw new Error("package.json is missing. Run backify init from the existing application's JavaScript/TypeScript package directory, or start in an empty folder. See https://agent.backify.dev/");
-  const name2 = basename3(resolve22(root)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "backify-app";
-  writeFileSync12(path, JSON.stringify({ name: name2, version: "0.0.0", private: true, type: "module" }, null, 2) + "\n", { flag: "wx" });
-}
-function initialize(appId, root = process.cwd(), install = true, agent, instructionFile) {
-  if (!/^app_[A-Za-z0-9_-]+$/.test(appId)) throw new Error("Provide an application ID using --app app_xxxxx");
-  const selected = instructionSelection(root, agent, instructionFile), files = selected.files;
-  validateDeliveryInstructions(root);
-  for (const relative11 of files) if (existsSync13(join15(root, relative11))) updateManagedInstructions(readFileSync22(join15(root, relative11), "utf8"));
-  ensurePackageManifest(root);
-  if (install) installSdk(root);
-  const configPath2 = join15(root, "backify.json"), existing = existsSync13(configPath2) ? JSON.parse(readFileSync22(configPath2, "utf8")) : {};
-  writeFileSync12(configPath2, JSON.stringify({ ...existing, ...createConfig(appId), agent: selected.agent, instructionFile: selected.instructionFile }, null, 2) + "\n");
-  updateInstructions(root, selected.agent, selected.instructionFile);
-  installDeliveryInstructions(root, files);
-}
-function doctor(root = process.cwd(), agent, instructionFile) {
-  const issues = [], warnings = [];
-  if (!sdkInstalled(root)) issues.push(`${SDK_PACKAGE} is not installed`);
-  let config;
-  try {
-    config = JSON.parse(readFileSync22(join15(root, "backify.json"), "utf8"));
-    issues.push(...validateConfig(config));
-  } catch {
-    issues.push("backify.json is missing or invalid JSON");
-  }
-  if (config && config.instructionVersion !== INSTRUCTION_VERSION) issues.push(`Repository instruction version ${config.instructionVersion}; CLI version ${INSTRUCTION_VERSION}. Use the matching CLI or run backify sync to upgrade.`);
-  let files = instructionFiles;
-  try {
-    files = selectedInstructionFiles(root, agent, instructionFile);
-  } catch (reason) {
-    issues.push(reason instanceof Error ? reason.message : String(reason));
-  }
-  for (const relative11 of files) {
-    const path = join15(root, relative11);
-    if (!existsSync13(path)) {
-      issues.push(`${relative11} is missing`);
-      continue;
-    }
-    issues.push(...managedInstructionIssues(readFileSync22(path, "utf8")).map((issue) => `${relative11} ${issue}`));
-  }
-  let version = "unknown";
-  try {
-    const pkg = JSON.parse(readFileSync22(join15(root, "package.json"), "utf8"));
-    version = pkg.dependencies?.[SDK_PACKAGE] ?? pkg.devDependencies?.[SDK_PACKAGE] ?? "missing";
-  } catch {
-  }
-  return { valid: issues.length === 0, appId: config?.appId, sdkVersion: version, instructionVersion: config?.instructionVersion, currentInstructionVersion: INSTRUCTION_VERSION, issues, warnings };
-}
-
-// src/development.ts
-function promptMetadata(args2) {
-  const fields5 = [["--model", "model", 200], ["--ai-tool", "aiTool", 200], ["--access-level", "accessLevel", 500]];
-  const metadata = {};
-  for (const [flag, field, maxLength] of fields5) {
-    const index = args2.indexOf(flag);
-    if (index < 0) continue;
-    const value = args2[index + 1]?.trim();
-    if (!value || value.startsWith("--") || value.length > maxLength || /[\u0000-\u001f\u007f-\u009f]|bfcli_[0-9a-f]{64}|--pair\s+[0-9a-f]{64}/i.test(value))
-      throw new Error(`Provide ${flag} with a nonempty value of at most ${maxLength} characters without control characters or credentials.`);
-    metadata[field] = value;
-  }
-  return metadata;
-}
-function applicationGuid(appId) {
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(appId)) return appId.toLowerCase();
-  const match = /^app_([0-9a-f]{32})$/i.exec(appId);
-  if (!match) throw new Error("Use the application ID supplied by Backify.");
-  const value = match[1];
-  return [value.slice(0, 8), value.slice(8, 12), value.slice(12, 16), value.slice(16, 20), value.slice(20)].join("-");
-}
-function projectApplication(root = process.cwd()) {
-  if (!existsSync14(join16(root, "backify.json"))) throw new Error("Run backify connect --app <application-id>, then backify init.");
-  return JSON.parse(readFileSync23(join16(root, "backify.json"), "utf8")).appId;
-}
-function apiAddress(value) {
-  const address = new URL(value);
-  if (address.username || address.password || address.search || address.hash || address.protocol !== "https:" && !(address.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(address.hostname))) throw new Error("Backify API must use HTTPS (HTTP is allowed only on loopback for local development).");
-  return address.toString().replace(/\/$/, "");
+provider-readiness claim, cloud deployment or browser authentication is implied.
+`
+  };
 }
-function apiClient(session, transport = fetch) {
-  const base = apiAddress(session.apiUrl);
-  return async (path, init) => {
-    if (!path.startsWith("/") || path.startsWith("//")) throw new Error("Invalid API path.");
-    if (session.expiresAt && Date.parse(session.expiresAt) <= Date.now()) throw new Error("CLI session expired. Copy a new setup prompt or run backify login.");
-    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "user-agent": cliUserAgent, "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
-    if (!response.ok) {
-      let message = "Backify request failed (" + response.status + ").";
+function scaffoldFullStack(options) {
+  const files = fullStackTemplate(options.appId, options.name);
+  const root = resolve23(options.root ?? process.cwd());
+  if (!existsSync14(root) || !lstatSync19(root).isDirectory() || lstatSync19(root).isSymbolicLink()) throw new Error("Scaffold destination must be an existing non-linked directory");
+  const allowed = /* @__PURE__ */ new Set([...Object.keys(files).map((filename2) => filename2.split("/")[0]), ".git", "node_modules", "package-lock.json", ".backify"]);
+  if (readdirSync8(root).some((filename2) => !allowed.has(filename2))) throw new Error("Scaffolding requires an empty folder or an unchanged generated starter");
+  const canonicalRoot = realpathSync8(root);
+  const pending = [];
+  for (const [filename2, content] of Object.entries(files)) {
+    const destination = join16(root, filename2);
+    let current = destination;
+    while (current !== root) {
       try {
-        const problem = await response.json();
-        message = [problem.code, problem.title].filter(Boolean).join(": ") || message;
-      } catch {
+        const stat = lstatSync19(current);
+        if (stat.isSymbolicLink() || current !== destination && !stat.isDirectory()) throw new Error("Scaffolding refuses linked or invalid output paths: " + filename2);
+        if (relative10(canonicalRoot, realpathSync8(current)).startsWith("..")) throw new Error("Scaffold output must remain inside its directory");
+        if (current === destination && (!stat.isFile() || readFileSync23(current, "utf8") !== content)) throw new Error("Scaffolding refuses to overwrite existing content: " + filename2);
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") throw error;
+        if (current === destination) pending.push(filename2);
       }
-      throw new Error(message);
-    }
-    return response.status === 204 ? void 0 : await response.json();
-  };
-}
-function saveUserConfig(path, config) {
-  const temporary = path + "." + randomUUID9() + ".tmp";
-  try {
-    writeFileSync13(temporary, JSON.stringify(config, null, 2) + "\n", { mode: 384, flag: "wx" });
-    if (process.platform === "win32") {
-      const account = [process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join("\\");
-      if (!account) throw new Error("Cannot identify the account to protect CLI credentials.");
-      const secured = spawnSync3("icacls", [temporary, "/inheritance:r", "/grant:r", account + ":(F)"], { windowsHide: true, encoding: "utf8" });
-      if (secured.status !== 0) throw new Error("Could not restrict CLI credential file permissions.");
-    }
-    renameSync4(temporary, path);
-  } finally {
-    rmSync2(temporary, { force: true });
-  }
-}
-function repositoryName(remote) {
-  const match = /^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/i.exec(remote);
-  if (!match) throw new Error("Repository must be a credential-free GitHub URL.");
-  return match[1].toLowerCase();
-}
-function git2(args2, root = process.cwd(), environment = process.env) {
-  const result = spawnSync3("git", args2, { cwd: root, env: environment, encoding: "utf8", windowsHide: true, maxBuffer: 2 * 1024 * 1024 });
-  if (result.status !== 0) throw new Error("Git " + args2[0] + " failed. Check repository access, branch protection, and local changes.");
-  return result.stdout.trim();
-}
-function gitEnvironment(repository, token) {
-  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) throw new Error("Invalid repository.");
-  return { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_COUNT: "3", GIT_CONFIG_KEY_0: "http.https://github.com/" + repository + ".git.extraheader", GIT_CONFIG_VALUE_0: "Authorization: Basic " + Buffer.from("x-access-token:" + token).toString("base64"), GIT_CONFIG_KEY_1: "credential.helper", GIT_CONFIG_VALUE_1: "", GIT_CONFIG_KEY_2: "http.followRedirects", GIT_CONFIG_VALUE_2: "false" };
-}
-function validateCloneMerge(source, target) {
-  for (const entry of readdirSync8(source, { withFileTypes: true })) {
-    const destination = join16(target, entry.name);
-    let existing;
-    try {
-      existing = lstatSync19(destination);
-    } catch (reason) {
-      if (reason.code === "ENOENT") continue;
-      throw reason;
+      current = dirname16(current);
     }
-    if (entry.isDirectory() && existing.isDirectory() && !existing.isSymbolicLink()) validateCloneMerge(join16(source, entry.name), destination);
-    else throw new Error("Clone conflicts with existing workspace entry: " + destination + ". Existing files are never overwritten; reconcile the conflict or use a new folder.");
-  }
-}
-async function cloneProject(call2, appId, root = process.cwd()) {
-  const status = await call2("/apps/" + applicationGuid(appId) + "/developer");
-  if (!status.repository || !status.branch || !status.workflowReady) throw new Error("Connect the repository in Backify and wait for workflow setup.");
-  if (readdirSync8(root, { withFileTypes: true }).some((entry) => !isToolWorkspaceEntry(entry, root))) throw new Error("--clone requires an empty directory or a workspace containing only AI tool metadata and default work/outputs directories. Existing application files and Git repositories are never overwritten.");
-  const credential = await call2("/apps/" + applicationGuid(appId) + "/developer/git-credential", { method: "POST" });
-  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed. Run connect again.");
-  const staging = mkdtempSync2(join16(dirname16(resolve23(root)), ".backify-clone-"));
-  try {
-    git2(["clone", "--single-branch", "--branch", status.branch, "--", "https://github.com/" + status.repository + ".git", "."], staging, gitEnvironment(status.repository, credential.token));
-    validateCloneMerge(staging, root);
-    for (const entry of readdirSync8(staging)) cpSync(join16(staging, entry), join16(root, entry), { recursive: true, force: false, errorOnExist: true, dereference: false });
-  } finally {
-    if (dirname16(staging) !== dirname16(resolve23(root)) || !staging.startsWith(join16(dirname16(resolve23(root)), ".backify-clone-"))) throw new Error("Refusing to clean up an unexpected clone staging path.");
-    rmSync2(staging, { recursive: true, force: true });
-  }
-}
-async function pullProject(call2, appId, root = process.cwd()) {
-  if (existsSync14(join16(root, "backify.json")) && applicationGuid(projectApplication(root)) !== applicationGuid(appId)) throw new Error("Local application ID does not match the connected application.");
-  const prefix = "/apps/" + applicationGuid(appId);
-  const status = await call2(prefix + "/developer");
-  if (!status.repository || !status.branch) throw new Error("Connect the repository and branch in Backify before pulling.");
-  if (resolve23(git2(["rev-parse", "--show-toplevel"], root)) !== resolve23(root)) throw new Error("Run pull from the connected repository root.");
-  if (repositoryName(git2(["remote", "get-url", "origin"], root)) !== status.repository.toLowerCase()) throw new Error("Local origin does not match the repository connected in Backify.");
-  if (git2(["branch", "--show-current"], root) !== status.branch) throw new Error("Local branch does not match the branch connected in Backify. The CLI never switches branches automatically.");
-  git2(["check-ref-format", "--branch", status.branch], root);
-  const credential = await call2(prefix + "/developer/git-credential", { method: "POST" });
-  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed; reconnect before pulling.");
-  git2(["fetch", "--no-tags", "--", "https://github.com/" + status.repository + ".git", "refs/heads/" + status.branch + ":refs/remotes/origin/" + status.branch], root, gitEnvironment(status.repository, credential.token));
-  const remoteCommit = git2(["rev-parse", "FETCH_HEAD"], root);
-  const counts = git2(["rev-list", "--left-right", "--count", "HEAD..." + remoteCommit], root).split(/\s+/).map(Number);
-  if (counts.length !== 2 || counts.some((count) => !Number.isSafeInteger(count) || count < 0)) throw new Error("Could not compare local and remote history.");
-  const [ahead, behind] = counts;
-  if (!behind) return { status: "up-to-date", ahead, behind, commit: git2(["rev-parse", "HEAD"], root) };
-  if (ahead) return { status: "blocked", reason: "Local and GitHub history have diverged. Review and reconcile them explicitly; no rebase, reset, or force-push was performed.", ahead, behind };
-  if (git2(["status", "--porcelain"], root)) return { status: "blocked", reason: "Local changes or untracked files are present. Commit, ignore, or otherwise resolve them explicitly before updating; nothing was stashed or overwritten.", ahead, behind };
-  git2(["merge", "--ff-only", "--", remoteCommit], root);
-  return { status: "updated", ahead: 0, behind: 0, commit: git2(["rev-parse", "HEAD"], root) };
-}
-async function readPrompt(input) {
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of input) {
-    const bytes = Buffer.from(chunk);
-    size += bytes.length;
-    if (size > 128e3) throw new Error("Prompt exceeds the size limit.");
-    chunks.push(bytes);
-  }
-  const text3 = Buffer.concat(chunks).toString("utf8");
-  if (!text3.trim() || text3.length > 32e3) throw new Error("Provide between 1 and 32000 characters of user prompt text.");
-  if (/\bbfcli_[0-9a-f]{64}\b|--pair\s+[0-9a-f]{64}/i.test(text3)) throw new Error("Do not record setup prompts or Backify credentials.");
-  return text3;
-}
-function attachmentNames(values) {
-  if (values.length > 50) throw new Error("At most 50 attachment filenames are allowed.");
-  return [...new Set(values.map((value) => {
-    const filename2 = value.replace(/\\/g, "/").split("/").pop();
-    if (!filename2 || filename2 === "." || filename2 === ".." || filename2.length > 255 || /[\x00-\x1f\x7f]/.test(filename2)) throw new Error("Invalid attachment filename.");
-    return filename2;
-  }))];
-}
-function localReport(runChecks, root = process.cwd()) {
-  const pkg = JSON.parse(readFileSync23(join16(root, "package.json"), "utf8"));
-  const dependencies = { ...pkg.devDependencies, ...pkg.dependencies };
-  const framework = ["next", "vite", "astro", "@sveltejs/kit", "nuxt", "react", "express"].find((name2) => dependencies[name2]) ?? "unknown";
-  const setup = doctor(root);
-  const checks = [{ name: "backify doctor", status: setup.valid ? "passed" : "failed" }];
-  const manager = detectPackageManager(root);
-  for (const name2 of ["typecheck", "lint", "test", "build"]) {
-    if (!pkg.scripts?.[name2]) continue;
-    const result = runChecks ? spawnSync3(manager, ["run", name2], { cwd: root, stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, CI: "true" }, shell: process.platform === "win32", windowsHide: true, timeout: 10 * 6e4 }) : void 0;
-    checks.push({ name: name2, status: result ? result.status === 0 ? "passed" : "failed" : "not-run" });
-  }
-  let branch = null, commitSha = null, dirty = true;
-  try {
-    branch = git2(["branch", "--show-current"], root);
-    commitSha = git2(["rev-parse", "HEAD"], root);
-    dirty = Boolean(git2(["status", "--porcelain"], root));
-  } catch {
-  }
-  const outputDirectory = ["dist", "build", "out", "."].find((directory2) => existsSync14(join16(root, directory2, "index.html"))) ?? null;
-  return { framework, sdkVersion: dependencies["@backifydev/sdk"] ?? null, branch, commitSha, dirty, buildCommand: pkg.scripts?.build ? manager + " run build" : null, outputDirectory, hasDockerfile: existsSync14(join16(root, "Dockerfile")), checks };
-}
-function matchesSource(release2, commit) {
-  return release2?.commitSha === commit || release2?.sourceCommitSha === commit;
-}
-function pushSource(appId, commit, branch, destination, root, environment) {
-  const remoteHead = git2(["ls-remote", "--", destination, "refs/heads/" + branch], root, environment).split(/\s+/)[0];
-  if (remoteHead === commit) return true;
-  if (remoteHead) {
-    git2(["fetch", "--no-tags", "--", destination, "refs/heads/" + branch], root, environment);
-    const fetchedHead = git2(["rev-parse", "FETCH_HEAD"], root);
-    if (fetchedHead === commit) return true;
-    const parent = git2(["show", "-s", "--format=%P", fetchedHead], root);
-    const message = git2(["show", "-s", "--format=%B", fetchedHead], root);
-    if (parent === commit && message === "Backify build " + applicationGuid(appId).replaceAll("-", "") + ": " + commit) return true;
-    if (git2(["merge-base", commit, fetchedHead], root) !== fetchedHead) throw new Error("Remote history contains other changes. Run backify pull and reconcile them before shipping; nothing was pushed or overwritten.");
   }
-  git2(["push", "--", destination, commit + ":refs/heads/" + branch], root, environment);
-  return false;
-}
-async function waitForPreview(call2, prefix, commit, options = {}) {
-  const deadline = Date.now() + (options.timeoutMs ?? 20 * 6e4);
-  const sleep = options.sleep ?? ((delay) => new Promise((resolve24) => setTimeout(resolve24, delay)));
-  do {
-    const deployments = await call2(prefix + "/deployments");
-    const matching = deployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit) && !options.previousDeploymentIds?.includes(release2.id));
-    if (matching?.status === "failed") throw new Error("Deployment of this source failed. Run backify status and inspect its deployment steps.");
-    const overview = await call2(prefix + "/releases");
-    if (matchesSource(overview.preview, commit) && overview.preview?.status === "succeeded" && overview.preview.healthResult === "healthy") return overview;
-    const build3 = await call2(prefix + "/developer/build?commitSha=" + commit);
-    if ((options.previousBuildRunId === void 0 || build3.runId !== options.previousBuildRunId) && ["failure", "cancelled", "timed_out", "action_required", "startup_failure"].includes(build3.conclusion ?? "")) throw new Error("GitHub build " + build3.conclusion + ". " + (build3.url ?? "Run backify status for details."));
-    await sleep(options.intervalMs ?? 4e3);
-  } while (Date.now() < deadline);
-  throw new Error("Timed out waiting for this commit's healthy preview. Run backify status; no production release was requested.");
-}
-async function ship(call2, appId, options = {}) {
-  const root = options.root ?? process.cwd(), prefix = "/apps/" + applicationGuid(appId);
-  const status = await call2(prefix + "/developer");
-  if (!status.repository || !status.branch || !status.workflowReady) throw new Error("The application's repository and build workflow must be connected in Backify.");
-  if (!doctor(root).valid) throw new Error("Run backify doctor and fix project setup before shipping.");
-  if (applicationGuid(projectApplication(root)) !== applicationGuid(appId)) throw new Error("Local application ID does not match the application being shipped.");
-  const actualRoot = git2(["rev-parse", "--show-toplevel"], root);
-  if (resolve23(actualRoot).toLowerCase() !== resolve23(root).toLowerCase()) throw new Error("Shipping currently requires the application at the repository root.");
-  const origin = git2(["remote", "get-url", "origin"], root);
-  const pushOrigin = git2(["remote", "get-url", "--push", "origin"], root);
-  if (repositoryName(origin) !== status.repository.toLowerCase() || repositoryName(pushOrigin) !== status.repository.toLowerCase()) throw new Error("Local repository does not match this Backify application.");
-  if (git2(["branch", "--show-current"], root) !== status.branch) throw new Error("Use the connected branch: " + status.branch);
-  if (git2(["status", "--porcelain"], root)) throw new Error("Commit application changes before shipping. The CLI never stages or commits unrelated files.");
-  const commit = git2(["rev-parse", "HEAD"], root);
-  const report = localReport(true, root);
-  await call2(prefix + "/developer/report", { method: "POST", body: JSON.stringify(report) });
-  if (report.checks.some((check) => check.status === "failed")) throw new Error("Checks failed; nothing was pushed.");
-  if (status.hostingTargetType === "backify-cloud" && !report.outputDirectory && !report.hasDockerfile) throw new Error("Backify Cloud requires a static build containing index.html or a Dockerfile serving port 8080.");
-  if (status.hostingTargetType === "azure" && !report.hasDockerfile) throw new Error("Customer Azure requires a repository-root Dockerfile.");
-  if (git2(["status", "--porcelain"], root) || git2(["rev-parse", "HEAD"], root) !== commit) throw new Error("Checks changed tracked source. Review and commit those changes before shipping.");
-  const previousDeployments = await call2(prefix + "/deployments");
-  const previousBuild = await call2(prefix + "/developer/build?commitSha=" + commit);
-  const credential = await call2(prefix + "/developer/git-credential", { method: "POST" });
-  if (credential.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed; reconnect before shipping.");
-  const environment = gitEnvironment(status.repository, credential.token);
-  const destination = "https://github.com/" + status.repository + ".git";
-  const alreadyPushed = pushSource(appId, commit, status.branch, destination, root, environment);
-  const currentPreview = previousDeployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit));
-  if (alreadyPushed && (!currentPreview || currentPreview.status === "failed") && !(matchesSource(status.releases.preview, commit) && status.releases.preview?.status === "succeeded")) await call2(prefix + "/deployments/preview", { method: "POST", body: JSON.stringify({ sourceRevision: "latest" }) });
-  const overview = await waitForPreview(call2, prefix, commit, { timeoutMs: options.timeoutMs, previousDeploymentIds: previousDeployments.filter((deployment) => deployment.status === "failed").map((deployment) => deployment.id), previousBuildRunId: previousBuild.runId ?? null });
-  if (overview.preview.commitSha !== commit) {
-    if (git2(["status", "--porcelain"], root) || git2(["rev-parse", "HEAD"], root) !== commit) throw new Error("Local work changed while the preview built. Review it before synchronizing the build commit.");
-    const refreshed = await call2(prefix + "/developer/git-credential", { method: "POST" });
-    if (refreshed.repository.toLowerCase() !== status.repository.toLowerCase()) throw new Error("Repository changed while building.");
-    git2(["fetch", "--", destination, "refs/heads/" + status.branch], root, gitEnvironment(status.repository, refreshed.token));
-    git2(["merge", "--ff-only", overview.preview.commitSha], root);
+  for (const filename2 of pending) {
+    const destination = join16(root, filename2);
+    mkdirSync9(dirname16(destination), { recursive: true });
+    writeFileSync13(destination, files[filename2], { flag: "wx" });
   }
-  return publishPreview(call2, prefix, overview, options);
+  return { template: "react-vite-hono", created: pending, unchanged: Object.keys(files).length - pending.length, installed: false, deployed: false };
 }
-async function publishPreview(call2, prefix, overview, options = {}) {
-  if (!overview.preview || overview.preview.status !== "succeeded" || overview.preview.healthResult !== "healthy") throw new Error("Only a verified healthy preview can be published.");
-  const preview = overview.preview;
-  if (options.previewOnly) return { status: "preview-ready", url: preview.url };
-  if (overview.policy.requirePreviewTesting && !preview.testedAt) return { status: "testing-required", url: preview.url };
-  if (overview.live?.previewDeploymentId === preview.id && overview.live.status === "succeeded") return { status: "live", url: overview.live.url };
-  const promotion = await call2(prefix + "/deployments/promote", { method: "POST", headers: { "Idempotency-Key": "cli-ship-" + preview.id }, body: JSON.stringify({ previewDeploymentId: preview.id, tested: false }) });
-  if (promotion.status === "awaiting-approval" || promotion.approvalId) return { status: "awaiting-approval", url: preview.url };
-  if (!promotion.operationId) throw new Error("Publication returned no operation to verify. Run backify status.");
-  const deadline = Date.now() + (options.timeoutMs ?? 20 * 6e4);
-  do {
-    const operation = await call2("/operations/" + promotion.operationId);
-    if (operation.status === "failed" || operation.status === "cancelled") throw new Error(operation.errorMessage ?? "Production deployment did not complete.");
-    if (operation.status === "succeeded") {
-      const releases = await call2(prefix + "/releases");
-      if (releases.live?.previewDeploymentId !== preview.id || releases.live.status !== "succeeded" || releases.live.healthResult !== "healthy") throw new Error("Production did not activate this healthy release. Run backify status.");
-      return { status: "live", url: releases.live.url };
+
+// src/local-inspection-command.ts
+function localInspectionCommand(args2) {
+  const routes = { tables: "/v1/database/tables", rows: "/v1/database/rows", buckets: "/v1/storage/buckets", objects: "/v1/storage/objects", preview: "/v1/storage/preview", events: "/v1/events" };
+  const kind = args2[0];
+  if (!Object.hasOwn(routes, kind)) throw new Error("Use backify inspect tables|rows|buckets|objects|preview|events --local [--json]");
+  const allowed = kind === "rows" ? ["--table", "--limit", "--offset"] : kind === "objects" ? ["--bucket", "--prefix", "--limit", "--offset"] : kind === "preview" ? ["--bucket", "--key"] : [];
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  for (let index = 1; index < args2.length; index++) {
+    const name2 = args2[index];
+    if (["--local", "--json"].includes(name2)) {
+      if (flags.has(name2)) throw new Error("Duplicate inspection flag");
+      flags.add(name2);
+      continue;
     }
-    await new Promise((resolve24) => setTimeout(resolve24, 4e3));
-  } while (Date.now() < deadline);
-  throw new Error("Publication is still pending. Run backify status; deployment success has not been verified.");
+    if (!allowed.includes(name2) || values.has(name2) || args2[index + 1] === void 0 || args2[index + 1].startsWith("--")) throw new Error("Invalid or missing inspection option");
+    values.set(name2, args2[++index]);
+  }
+  if (!flags.has("--local")) throw new Error("Inspection requires --local; no cloud or production data is queried");
+  const required = (name2) => {
+    const value = values.get(name2);
+    if (!value) throw new Error("Required inspection option: " + name2);
+    return value;
+  };
+  const page = () => {
+    const number = (name2, fallback, minimum, maximum) => {
+      const value = values.get(name2);
+      if (value !== void 0 && !/^\d+$/.test(value)) throw new Error("Invalid inspection page");
+      const parsed = value === void 0 ? fallback : Number(value);
+      if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) throw new Error("Invalid inspection page");
+      return parsed;
+    };
+    return { limit: number("--limit", 25, 1, 50), offset: number("--offset", 0, 0, 1e4) };
+  };
+  const input = kind === "rows" ? { table: required("--table"), ...page() } : kind === "objects" ? { bucket: required("--bucket"), ...page(), ...values.has("--prefix") ? { prefix: values.get("--prefix") } : {} } : kind === "preview" ? { bucket: required("--bucket"), key: required("--key") } : void 0;
+  return { kind, path: routes[kind], input };
 }
 
 // src/index.ts
 import { readFileSync as readFileSync24, existsSync as existsSync15, rmSync as rmSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join17 } from "node:path";
-import { randomBytes as randomBytes6 } from "node:crypto";
-import { createServer as createServer3 } from "node:http";
 import { spawn as spawn5 } from "node:child_process";
 var configPath = join17(homedir2(), ".backify.json");
 var userConfig = existsSync15(configPath) ? JSON.parse(readFileSync24(configPath, "utf8")) : {};
@@ -22977,73 +23260,42 @@ var [command2, ...args] = process.argv.slice(2);
 async function call(path, init) {
   let appId = option("--app");
   if (!appId && existsSync15(join17(process.cwd(), "backify.json"))) appId = projectApplication();
-  const session = appId ? userConfig.sessions?.["app_" + applicationGuid(appId).replaceAll("-", "")] : void 0;
-  return apiClient(session ?? { token: userConfig.token ?? "", organizationId: userConfig.organizationId ?? "", apiUrl: process.env.BACKIFY_API_URL ?? userConfig.apiUrl ?? "https://api.backify.dev/api" })(path, init);
+  const session = appId ? userConfig.sessions?.[sessionKey(appId)] : void 0;
+  const credential = session ?? { token: userConfig.token ?? "", organizationId: userConfig.organizationId ?? "", apiUrl: process.env.BACKIFY_API_URL ?? userConfig.apiUrl ?? "https://api.backify.dev/api" };
+  return (appId ? applicationClient(credential, appId) : apiClient(credential))(path, init);
 }
 var option = (name2) => {
   const index = args.indexOf(name2);
   return index >= 0 ? args[index + 1] : void 0;
 };
 function openBrowser(url) {
-  const command3 = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open", args2 = process.platform === "win32" ? ["/c", "start", "", '"' + url + '"'] : [url];
-  const child = spawn5(command3, args2, { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+  const executable = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open", browserArgs = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  const child = spawn5(executable, browserArgs, { stdio: "ignore", detached: true, windowsHide: true });
+  child.on("error", () => console.error("Could not open a browser automatically. Open the sign-in URL printed above."));
   child.unref();
 }
-async function browserLogin() {
-  const state = randomBytes6(24).toString("base64url"), server = createServer3((req, res) => {
-    if (req.method === "OPTIONS") {
-      res.writeHead(204, { "access-control-allow-origin": "*", "access-control-allow-methods": "POST, OPTIONS", "access-control-allow-headers": "content-type" });
-      return res.end();
-    }
-    if (req.method !== "POST" || req.url !== "/callback") {
-      res.writeHead(404);
-      return res.end();
+function sessionKey(appId) {
+  return "app_" + applicationGuid(appId).replaceAll("-", "");
+}
+async function browserLogin(appId, organizationId, apiUrl) {
+  if (args.includes("--no-browser")) throw new CliAuthenticationRequired();
+  const address = apiAddress(apiUrl ?? process.env.BACKIFY_API_URL ?? userConfig.apiUrl ?? "https://api.backify.dev/api");
+  return browserAuthenticate({ authUrl: process.env.BACKIFY_AUTH_URL ?? process.env.BACKIFY_PORTAL_URL ?? userConfig.portalUrl ?? "https://auth.backify.dev", apiUrl: address, applicationId: appId ? applicationGuid(appId) : void 0, organizationId, openBrowser: (url) => {
+    console.error("Sign in to reconnect Backify CLI access. Choose the expiration in your browser; the CLI will continue automatically.\n" + url);
+    openBrowser(url);
+  }, save: (session) => {
+    if (appId) {
+      userConfig.sessions ??= {};
+      userConfig.sessions[sessionKey(appId)] = session;
+    } else {
+      userConfig.token = session.token;
+      userConfig.organizationId = session.organizationId;
     }
-    let raw = "";
-    req.setEncoding("utf8");
-    req.on("data", (part) => raw += part);
-    req.on("end", () => {
-      try {
-        const value = JSON.parse(raw);
-        if (value.state !== state || typeof value.token !== "string" || typeof value.organizationId !== "string") throw new Error("Invalid callback");
-        res.writeHead(200, { "access-control-allow-origin": "*", "content-type": "text/plain" });
-        res.end("Backify CLI connected. You can close this tab.");
-        userConfig.token = value.token;
-        userConfig.organizationId = value.organizationId;
-        saveUserConfig(configPath, userConfig);
-        server.close();
-        resolveLogin();
-      } catch {
-        res.writeHead(400, { "access-control-allow-origin": "*" });
-        res.end("Invalid or expired Backify CLI login.");
-      }
-    });
-  });
-  let resolveLogin = () => {
-  };
-  const completed = new Promise((resolve24) => resolveLogin = resolve24);
-  server.listen(0, "127.0.0.1", () => {
-    const address = server.address();
-    if (!address || typeof address === "string") throw new Error("Could not start local login callback");
-    const callback = `http://127.0.0.1:${address.port}/callback`;
-    const portal = new URL(process.env.BACKIFY_PORTAL_URL ?? userConfig.portalUrl ?? "https://backify.dev");
-    portal.searchParams.set("cli_callback", callback);
-    portal.searchParams.set("cli_state", state);
-    console.log(`Opening ${portal.origin} to sign in to Backify\u2026`);
-    openBrowser(portal.toString());
-  });
-  const timeout = setTimeout(() => {
-    server.close();
-    rejectLogin(new Error("Backify login timed out. Run backify login to try again."));
-  }, 5 * 6e4);
-  let rejectLogin = () => {
-  };
-  const failed = new Promise((_, reject) => rejectLogin = reject);
-  try {
-    await Promise.race([completed, failed]);
-  } finally {
-    clearTimeout(timeout);
-  }
+    saveUserConfig(configPath, userConfig);
+  } });
+}
+function applicationClient(session, appId) {
+  return reconnectingApiClient(session, () => browserLogin(appId, session.organizationId, session.apiUrl));
 }
 async function main() {
   switch (command2) {
@@ -23191,11 +23443,11 @@ async function main() {
       break;
     }
     case "login":
-      if (args[0]) {
+      if (args[0] && !args[0].startsWith("--")) {
         userConfig.token = args[0];
         userConfig.organizationId = args[1] ?? userConfig.organizationId;
         saveUserConfig(configPath, userConfig);
-      } else await browserLogin();
+      } else await browserLogin(option("--app") ?? (existsSync15(join17(process.cwd(), "backify.json")) ? projectApplication() : void 0), option("--organization"));
       console.log("Logged in to Backify");
       break;
     case "logout":
@@ -23204,7 +23456,7 @@ async function main() {
       break;
     case "connect": {
       const appId = option("--app") ?? projectApplication(), key = "app_" + applicationGuid(appId).replaceAll("-", "");
-      const code = option("--pair"), organizationId = option("--organization") ?? userConfig.organizationId;
+      const code = option("--pair"), organizationId = option("--organization") ?? userConfig.sessions?.[key]?.organizationId ?? userConfig.organizationId;
       const address = apiAddress(option("--api") ?? process.env.BACKIFY_API_URL ?? userConfig.apiUrl ?? "https://api.backify.dev/api");
       if (code) {
         if (!organizationId) throw new Error("The setup prompt must supply the organization.");
@@ -23213,20 +23465,25 @@ async function main() {
         userConfig.sessions ??= {};
         userConfig.sessions[key] = { ...paired, apiUrl: address };
         saveUserConfig(configPath, userConfig);
-      } else if (!userConfig.sessions?.[key] && !userConfig.token) {
-        await browserLogin();
+      } else if (args.includes("--reauth") || !userConfig.sessions?.[key] && !userConfig.token) {
+        await browserLogin(appId, organizationId, address);
       }
       let session = userConfig.sessions?.[key] ?? { token: userConfig.token ?? "", organizationId: organizationId ?? userConfig.organizationId ?? "", apiUrl: address };
       if (!session.token.startsWith("bfcli_")) {
-        session = await registerCliSession(apiClient(session), applicationGuid(appId), session.apiUrl);
+        try {
+          session = await registerCliSession(apiClient(session), applicationGuid(appId), session.apiUrl);
+        } catch (error) {
+          if (!(error instanceof CliAuthenticationRequired)) throw error;
+          session = await browserLogin(appId, session.organizationId, session.apiUrl);
+        }
         userConfig.sessions ??= {};
         userConfig.sessions[key] = session;
         saveUserConfig(configPath, userConfig);
       }
-      const client = apiClient(session);
+      const client = applicationClient(session, appId);
       await client("/apps/" + applicationGuid(appId) + "/developer");
       userConfig.sessions ??= {};
-      userConfig.sessions[key] = session;
+      userConfig.sessions[key] ??= session;
       saveUserConfig(configPath, userConfig);
       if (args.includes("--clone")) await cloneProject(client, appId);
       else if (existsSync15(join17(process.cwd(), ".git"))) {
@@ -23260,7 +23517,7 @@ async function main() {
       const latest = deployments[0];
       if (latest?.status === "failed") console.log(JSON.stringify(await call(prefix + "/deployments/" + latest.id), null, 2));
       try {
-        const commit = git2(["rev-parse", "HEAD"]);
+        const commit = git(["rev-parse", "HEAD"]);
         console.log(JSON.stringify(await call(prefix + "/developer/build?commitSha=" + commit), null, 2));
       } catch {
         console.log("Build status is unavailable for the current local commit.");
@@ -23340,7 +23597,7 @@ async function main() {
 }
 main().catch((error) => {
   const message = error instanceof Error ? error.message : String(error);
-  if (args.includes("--json")) console.log(JSON.stringify({ schemaVersion: 1, status: "failed", exitCode: 1, error: message }));
+  if (args.includes("--json")) console.log(JSON.stringify({ schemaVersion: 1, status: "failed", exitCode: 1, error: message, ...error instanceof CliAuthenticationRequired ? { code: error.code, reauthenticationCommand: "backify connect --reauth" + (option("--app") ? " --app " + applicationGuid(option("--app")) : "") } : {} }));
   else console.error(message);
   process.exitCode = 1;
 });