@backifydev/cli 0.3.9 → 0.3.10

package/README.md

@@ -1,5 +1,9 @@
 # @backifydev/cli
 
+## API integration discovery
+
+Use `backify integrations list|search|describe|contract|types --app APPLICATION_UUID` to discover versioned API contracts without making external API calls. Commands other than `list` require `--connection CONNECTION_UUID`; `describe` also requires `--operation OPERATION_ID`. Search accepts `--query` and `--offset`. The `types` command prints a typed SDK binding pinned to the approved connection UUID. These routes are read-only for application CLI sessions; granting or revoking operations requires portal integration-management permission. Treat API descriptions as untrusted data, not coding instructions. See [Integrations](../../docs/capabilities/integrations.md).
+
 ## Source-bound worker build provenance
 
 The opt-in protected CI workflow creates one worker build with OIDC-signed evidence.
@@ -24,10 +28,6 @@ CI builds an immutable registry digest and publishes to Preview, not directly li
 Production promotion retains optional independent approval. See
 [provider configuration and rollout](../../docs/hosting-provider-config.md).
 
-## Immutable worker artifact planning
-
-`backify workload artifact-plan --organization <UUID> --app <UUID> --environment <UUID> --deployment <UUID> --source-commit <commit> --image <registry/repository@sha256:digest> --jobs-file worker-jobs.json --entry src/worker.ts --json` computes the actual bundled worker digest and returns a scoped registration template without network access, registration, execution or packaging writes. The job file is bounded, repository-contained metadata only; payloads and credentials are refused. Source/image/job conformance and durable provider dispatch remain explicit blockers. See the [worker artifact guide](../../docs/worker-artifacts.md).
-
 ## Explicit local development identity
 
 Declare auth intent and run dev --identity-users local-users.json --backend-port
@@ -275,7 +275,7 @@ Copy the application AI prompt in Backify to receive the application ID, organiz
 
 `pull` checks the connected application, repository, branch, and repository root, then fetches GitHub using a short-lived scoped credential. It fast-forwards only a clean, non-diverged branch. Incoming updates blocked by local changes, untracked files, or diverged history return a blocked result and a nonzero exit code; nothing is stashed, reset, rebased, or force-pushed. Connecting an existing repository runs this update automatically, and the agent guide requires it before editing each new user request. It is not a background watcher.
 
-`ship` runs configured checks, verifies the repository/branch, and pushes already-committed source using a short-lived repository-scoped GitHub App credential. It never stages, commits, force-pushes, or fabricates preview testing. It waits for the exact healthy preview, then publishes when policy and permissions allow. Required testing/approval returns a pending state and preview URL, not a false successful production deployment. Use `--preview-only` to stop at preview, or `--timeout <seconds>` to change the default 1200-second wait. Applications must currently be at the repository root; Backify Cloud needs static index.html output, and customer Azure needs a Dockerfile serving port 8080.
+`ship` runs configured checks, verifies the repository/branch, and pushes already-committed source using a short-lived repository-scoped GitHub App credential. It never stages, commits, force-pushes, or fabricates preview testing. By default it waits for the exact healthy preview and returns its URL without requesting production publication. Promote the preview in the portal, or explicitly run `ship --production-deploy` to request publication through existing policy and permissions. Required testing/approval returns a pending state and preview URL, not a false successful production deployment. The legacy `--preview-only` flag remains supported but cannot be combined with `--production-deploy`. Use `--timeout <seconds>` to change the default 1200-second wait. Applications must currently be at the repository root; Backify Cloud needs static index.html output, and customer Azure needs a Dockerfile serving port 8080.
 
 `disconnect` revokes that user's application CLI sessions. `logout` removes local credentials only. Prompt histories and local reports remain subject to application permissions. Deploy the matching API and publish CLI 0.3.0 before enabling this flow in production.
 

package/dist/index.js

@@ -1275,9 +1275,9 @@ ${indent}`) + "'";
         return quotedString(value, ctx);
       }
       const indent = ctx.indent || (ctx.forceBlockIndent || containsDocumentMarker(value) ? "  " : "");
-      const literal = blockQuote === "literal" ? true : blockQuote === "folded" || type === Scalar.Scalar.BLOCK_FOLDED ? false : type === Scalar.Scalar.BLOCK_LITERAL ? true : !lineLengthOverLimit(value, lineWidth, indent.length);
+      const literal2 = blockQuote === "literal" ? true : blockQuote === "folded" || type === Scalar.Scalar.BLOCK_FOLDED ? false : type === Scalar.Scalar.BLOCK_LITERAL ? true : !lineLengthOverLimit(value, lineWidth, indent.length);
       if (!value)
-        return literal ? "|\n" : ">\n";
+        return literal2 ? "|\n" : ">\n";
       let chomp;
       let endStart;
       for (endStart = value.length; endStart > 0; --endStart) {
@@ -1326,7 +1326,7 @@ ${indent}`) + "'";
         if (onComment)
           onComment();
       }
-      if (!literal) {
+      if (!literal2) {
         const foldedValue = value.replace(/\n+/g, "\n$&").replace(/(?:^|\n)([\t ].*)(?:([\n\t ]*)\n(?![\n\t ]))?/g, "$1$2").replace(/\n+/g, `$&${indent}`);
         let literalFallback = false;
         const foldOptions = getFoldOptions(ctx, true);
@@ -4598,9 +4598,9 @@ var require_resolve_block_scalar = __commonJS({
           default: {
             const message = `Unexpected token in block scalar header: ${token.type}`;
             onError(token, "UNEXPECTED_TOKEN", message);
-            const ts3 = token.source;
-            if (ts3 && typeof ts3 === "string")
-              length += ts3.length;
+            const ts4 = token.source;
+            if (ts4 && typeof ts4 === "string")
+              length += ts4.length;
           }
         }
       }
@@ -4910,9 +4910,9 @@ var require_compose_scalar = __commonJS({
       if (schema.compat) {
         const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
         if (tag.tag !== compat.tag) {
-          const ts3 = directives.tagString(tag.tag);
+          const ts4 = directives.tagString(tag.tag);
           const cs = directives.tagString(compat.tag);
-          const msg = `Value may be parsed as either ${ts3} or ${cs}`;
+          const msg = `Value may be parsed as either ${ts4} or ${cs}`;
           onError(token, "TAG_RESOLVE_FAILED", msg, true);
         }
       }
@@ -7812,7 +7812,7 @@ var require_luxon = __commonJS({
        * @param {string} opts.locale - What locale to return the offset name in.
        * @return {string}
        */
-      offsetName(ts3, opts) {
+      offsetName(ts4, opts) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7823,7 +7823,7 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts3, format) {
+      formatOffset(ts4, format) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7832,7 +7832,7 @@ var require_luxon = __commonJS({
        * @param {number} ts - Epoch milliseconds for which to compute the offset
        * @return {number}
        */
-      offset(ts3) {
+      offset(ts4) {
         throw new ZoneIsAbstractError();
       }
       /**
@@ -7878,19 +7878,19 @@ var require_luxon = __commonJS({
         return false;
       }
       /** @override **/
-      offsetName(ts3, {
+      offsetName(ts4, {
         format,
         locale
       }) {
-        return parseZoneInfo(ts3, format, locale);
+        return parseZoneInfo(ts4, format, locale);
       }
       /** @override **/
-      formatOffset(ts3, format) {
-        return formatOffset(this.offset(ts3), format);
+      formatOffset(ts4, format) {
+        return formatOffset(this.offset(ts4), format);
       }
       /** @override **/
-      offset(ts3) {
-        return -new Date(ts3).getTimezoneOffset();
+      offset(ts4) {
+        return -new Date(ts4).getTimezoneOffset();
       }
       /** @override **/
       equals(otherZone) {
@@ -8042,11 +8042,11 @@ var require_luxon = __commonJS({
        * @param {string} opts.locale - What locale to return the offset name in.
        * @return {string}
        */
-      offsetName(ts3, {
+      offsetName(ts4, {
         format,
         locale
       }) {
-        return parseZoneInfo(ts3, format, locale, this.name);
+        return parseZoneInfo(ts4, format, locale, this.name);
       }
       /**
        * Returns the offset's value as a string
@@ -8056,8 +8056,8 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts3, format) {
-        return formatOffset(this.offset(ts3), format);
+      formatOffset(ts4, format) {
+        return formatOffset(this.offset(ts4), format);
       }
       /**
        * Return the offset in minutes for this zone at the specified timestamp.
@@ -8065,9 +8065,9 @@ var require_luxon = __commonJS({
        * @param {number} ts - Epoch milliseconds for which to compute the offset
        * @return {number}
        */
-      offset(ts3) {
+      offset(ts4) {
         if (!this.valid) return NaN;
-        const date = new Date(ts3);
+        const date = new Date(ts4);
         if (isNaN(date)) return NaN;
         const dtf = makeDTF(this.name);
         let [year, month, day, adOrBc, hour, minute, second] = dtf.formatToParts ? partsOffset(dtf, date) : hackyOffset(dtf, date);
@@ -8654,7 +8654,7 @@ var require_luxon = __commonJS({
        *                          Accepts 'narrow', 'short', or 'techie'. Returning '+6', '+06:00', or '+0600' respectively
        * @return {string}
        */
-      formatOffset(ts3, format) {
+      formatOffset(ts4, format) {
         return formatOffset(this.fixed, format);
       }
       /**
@@ -9340,8 +9340,8 @@ var require_luxon = __commonJS({
         return year;
       } else return year > Settings.twoDigitCutoffYear ? 1900 + year : 2e3 + year;
     }
-    function parseZoneInfo(ts3, offsetFormat, locale, timeZone = null) {
-      const date = new Date(ts3), intlOpts = {
+    function parseZoneInfo(ts4, offsetFormat, locale, timeZone = null) {
+      const date = new Date(ts4), intlOpts = {
         hourCycle: "h23",
         year: "numeric",
         month: "2-digit",
@@ -9867,9 +9867,9 @@ var require_luxon = __commonJS({
             return token;
           }
         }, tokens = _Formatter.parseFormat(fmt), realTokens = tokens.reduce((found, {
-          literal,
+          literal: literal2,
           val
-        }) => literal ? found : found.concat(val), []), collapsed = dur.shiftTo(...realTokens.map(tokenToField).filter((t) => t)), durationInfo = {
+        }) => literal2 ? found : found.concat(val), []), collapsed = dur.shiftTo(...realTokens.map(tokenToField).filter((t) => t)), durationInfo = {
           isNegativeDuration: collapsed < 0,
           // this relies on "collapsed" being based on "shiftTo", which builds up the object
           // in order
@@ -11779,13 +11779,13 @@ var require_luxon = __commonJS({
       return value.replace(/[\-\[\]{}()*+?.,\\\^$|#\s]/g, "\\$&");
     }
     function unitForToken(token, loc) {
-      const one = digitRegex(loc), two = digitRegex(loc, "{2}"), three = digitRegex(loc, "{3}"), four = digitRegex(loc, "{4}"), six = digitRegex(loc, "{6}"), oneOrTwo = digitRegex(loc, "{1,2}"), oneToThree = digitRegex(loc, "{1,3}"), oneToSix = digitRegex(loc, "{1,6}"), oneToNine = digitRegex(loc, "{1,9}"), twoToFour = digitRegex(loc, "{2,4}"), fourToSix = digitRegex(loc, "{4,6}"), literal = (t) => ({
+      const one = digitRegex(loc), two = digitRegex(loc, "{2}"), three = digitRegex(loc, "{3}"), four = digitRegex(loc, "{4}"), six = digitRegex(loc, "{6}"), oneOrTwo = digitRegex(loc, "{1,2}"), oneToThree = digitRegex(loc, "{1,3}"), oneToSix = digitRegex(loc, "{1,6}"), oneToNine = digitRegex(loc, "{1,9}"), twoToFour = digitRegex(loc, "{2,4}"), fourToSix = digitRegex(loc, "{4,6}"), literal2 = (t) => ({
         regex: RegExp(escapeToken(t.val)),
         deser: ([s2]) => s2,
         literal: true
       }), unitate = (t) => {
         if (token.literal) {
-          return literal(t);
+          return literal2(t);
         }
         switch (t.val) {
           // era
@@ -11902,7 +11902,7 @@ var require_luxon = __commonJS({
           case " ":
             return simple(/[^\S\n\r]/);
           default:
-            return literal(t);
+            return literal2(t);
         }
       };
       const unit = unitate(token) || {
@@ -12218,9 +12218,9 @@ var require_luxon = __commonJS({
       }
       return [localTS - Math.min(o2, o3) * 60 * 1e3, Math.max(o2, o3)];
     }
-    function tsToObj(ts3, offset2) {
-      ts3 += offset2 * 60 * 1e3;
-      const d = new Date(ts3);
+    function tsToObj(ts4, offset2) {
+      ts4 += offset2 * 60 * 1e3;
+      const d = new Date(ts4);
       return {
         year: d.getUTCFullYear(),
         month: d.getUTCMonth() + 1,
@@ -12251,13 +12251,13 @@ var require_luxon = __commonJS({
         seconds: dur.seconds,
         milliseconds: dur.milliseconds
       }).as("milliseconds"), localTS = objToLocalTS(c);
-      let [ts3, o] = fixOffset(localTS, oPre, inst.zone);
+      let [ts4, o] = fixOffset(localTS, oPre, inst.zone);
       if (millisToAdd !== 0) {
-        ts3 += millisToAdd;
-        o = inst.zone.offset(ts3);
+        ts4 += millisToAdd;
+        o = inst.zone.offset(ts4);
       }
       return {
-        ts: ts3,
+        ts: ts4,
         o
       };
     }
@@ -12444,7 +12444,7 @@ var require_luxon = __commonJS({
         return DateTime.invalid(unsupportedZone(zone));
       }
       const loc = Locale.fromObject(opts);
-      let ts3, o;
+      let ts4, o;
       if (!isUndefined(obj.year)) {
         for (const u of orderedUnits) {
           if (isUndefined(obj[u])) {
@@ -12456,12 +12456,12 @@ var require_luxon = __commonJS({
           return DateTime.invalid(invalid2);
         }
         const offsetProvis = guessOffsetForZone(zone);
-        [ts3, o] = objToTS(obj, offsetProvis, zone);
+        [ts4, o] = objToTS(obj, offsetProvis, zone);
       } else {
-        ts3 = Settings.now();
+        ts4 = Settings.now();
       }
       return new DateTime({
-        ts: ts3,
+        ts: ts4,
         zone,
         loc,
         o
@@ -12624,8 +12624,8 @@ var require_luxon = __commonJS({
        * @return {DateTime}
        */
       static fromJSDate(date, options = {}) {
-        const ts3 = isDate(date) ? date.valueOf() : NaN;
-        if (Number.isNaN(ts3)) {
+        const ts4 = isDate(date) ? date.valueOf() : NaN;
+        if (Number.isNaN(ts4)) {
           return _DateTime.invalid("invalid input");
         }
         const zoneToUse = normalizeZone(options.zone, Settings.defaultZone);
@@ -12633,7 +12633,7 @@ var require_luxon = __commonJS({
           return _DateTime.invalid(unsupportedZone(zoneToUse));
         }
         return new _DateTime({
-          ts: ts3,
+          ts: ts4,
           zone: zoneToUse,
           loc: Locale.fromObject(options)
         });
@@ -13493,9 +13493,9 @@ var require_luxon = __commonJS({
             mixed.day = Math.min(daysInMonth(mixed.year, mixed.month), mixed.day);
           }
         }
-        const [ts3, o] = objToTS(mixed, this.o, this.zone);
+        const [ts4, o] = objToTS(mixed, this.o, this.zone);
         return clone(this, {
-          ts: ts3,
+          ts: ts4,
           o
         });
       }
@@ -16501,8 +16501,8 @@ var require_CronFileParser = __commonJS({
        * @throws If file cannot be read
        */
       static parseFileSync(filePath) {
-        const { readFileSync: readFileSync25 } = __require("fs");
-        const data = readFileSync25(filePath, "utf8");
+        const { readFileSync: readFileSync24 } = __require("fs");
+        const data = readFileSync24(filePath, "utf8");
         return _CronFileParser.#parseContent(data);
       }
       /**
@@ -17599,7 +17599,7 @@ async function deployFunctions(call2, appId, environmentId, packageBytes, option
   if (!result.operationId) throw new Error("Function deployment did not return a tracking operation. Success has not been verified.");
   const now = options.now ?? Date.now;
   const deadline = now() + (options.timeoutMs ?? 20 * 6e4);
-  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve24) => setTimeout(resolve24, milliseconds)));
+  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve23) => setTimeout(resolve23, milliseconds)));
   options.progress?.("Function deployment queued. Waiting for operation " + result.operationId + ".");
   while (now() < deadline) {
     let operation;
@@ -17660,13 +17660,35 @@ async function packageFunctions(entry, output) {
   return outputPath;
 }
 
+// src/integrations.ts
+function integrationDiscoveryPath(command3, options) {
+  const uuid4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuid4.test(options.applicationId)) throw new Error("An application UUID is required");
+  const base = "/apps/" + options.applicationId + "/integrations/connectors";
+  if (command3 === "list") return base;
+  if (command3 === "catalog") return "/apps/" + options.applicationId + "/integrations/catalog";
+  if (!options.connectionId || !uuid4.test(options.connectionId)) throw new Error("Use --connection with an integration connection UUID");
+  const connection = base + "/" + options.connectionId;
+  if (command3 === "contract" || command3 === "types") return connection + "/" + command3;
+  if (command3 === "describe") {
+    if (!options.operationId) throw new Error("Use --operation to select an operation");
+    return connection + "/operations/" + encodeURIComponent(options.operationId);
+  }
+  if (command3 === "search") {
+    if (!Number.isInteger(options.offset ?? 0) || (options.offset ?? 0) < 0 || (options.offset ?? 0) > 500) throw new Error("Offset must be between 0 and 500");
+    const query = new URLSearchParams({ query: options.query ?? "", offset: String(options.offset ?? 0), limit: "50" });
+    return connection + "/operations?" + query;
+  }
+  throw new Error("Use backify integrations list|catalog|search|describe|contract|types");
+}
+
 // src/cli-session.ts
 import { hostname, platform, release, arch } from "node:os";
 
 // package.json
 var package_default = {
   name: "@backifydev/cli",
-  version: "0.3.9",
+  version: "0.3.10",
   description: "Command-line setup and diagnostics for Backify applications",
   type: "module",
   bin: {
@@ -17773,6 +17795,12 @@ function parseApplicationManifest(source) {
     validatePortableSettings(settings);
     if (name2 === "auth")
       validateAuthSettings(settings);
+    if (name2 === "ai") {
+      if (Object.keys(settings).some((key) => !["enabled", "models"].includes(key)))
+        throw new Error("Unknown AI setting");
+      if (settings.models !== void 0 && (!Array.isArray(settings.models) || settings.models.length === 0 || settings.models.length > 3 || settings.models.some((model) => !["default", "fast", "smart"].includes(String(model))) || new Set(settings.models).size !== settings.models.length))
+        throw new Error("AI models must be distinct logical names: default, fast, smart");
+    }
     if (settings.enabled !== void 0 && typeof settings.enabled !== "boolean")
       throw new Error("enabled must be boolean: " + name2);
     if (name2 === "database" && settings.engine !== void 0 && settings.engine !== "postgres")
@@ -17951,17 +17979,18 @@ var CAPABILITIES = [
   capability("functions", "functions", "Server function declarations"),
   capability("jobs", "jobs", "Reliable background work", true),
   capability("scheduler", "jobs.schedule", "Scheduled job declarations"),
-  capability("events", "events", "Inbound webhooks and governed outbound HTTP", true),
+  capability("events", "events", "Event tracking, inbound webhooks and governed outbound HTTP", true),
   { ...capability("mail", "mail", "Server-only mail.send: to accepts an address or address array; 25 attempts per application per UTC month shared by all environments; 50 total To/CC/BCC recipients; 10 attachments totaling 10 MiB decoded; 256 KiB combined text/HTML; 998-character subject. Identical sends without an explicit idempotency key are deduplicated for a rolling 5 minutes. sensitive: true never stores original subjects or bodies. Read the mail capability guide and mail.limits before implementing sends.", true), limits: MAIL_LIMITS },
   capability("secrets", "secrets", "Server-side secret retrieval", true),
+  capability("integrations", "integrations", "Approved, versioned API contracts and environment-scoped operation grants", true),
   capability("http", "http", "Governed outbound HTTP"),
-  capability("ai", "ai", "Provider-independent generative AI"),
+  capability("ai", "ai", "Server-only ai.generate, ai.extract, ai.classify and ai.embed. Declare capabilities.ai in backify.yaml; optional models: [default, fast, smart] must stay within the application allowed-model policy. Backify provisions isolated Azure Foundry model deployments and supplies scoped runtime credentials automatically. Do not add Azure/OpenAI credentials to application code."),
   capability("audit", "audit", "Structured audit records"),
   capability("logs", "logs", "Structured application logging"),
   capability("config", "config", "Non-secret application configuration")
 ];
 var CAPABILITY_REGISTRY = Object.fromEntries(CAPABILITIES.map((x) => [x.name, x]));
-var SDK_IMPORT_CAPABILITIES = { defineJob: "jobs", database: "database", auth: "auth", db: "database", storage: "storage", functions: "functions", defineFunction: "functions", jobs: "jobs", mail: "mail", events: "events", secrets: "secrets", http: "http", ai: "ai", audit: "audit", logs: "logs", logging: "logs", config: "config" };
+var SDK_IMPORT_CAPABILITIES = { integrations: "integrations", defineJob: "jobs", database: "database", auth: "auth", db: "database", storage: "storage", functions: "functions", defineFunction: "functions", jobs: "jobs", mail: "mail", webhooks: "events", events: "events", secrets: "secrets", http: "http", ai: "ai", audit: "audit", logs: "logs", logging: "logs", config: "config" };
 var MANAGED_START = "<!-- BACKIFY:MANAGED:START -->";
 var MANAGED_END = "<!-- BACKIFY:MANAGED:END -->";
 function managedInstructions() {
@@ -18413,7 +18442,7 @@ function pushSource(appId, commit, branch, destination, root, environment) {
 }
 async function waitForPreview(call2, prefix, commit, options = {}) {
   const deadline = Date.now() + (options.timeoutMs ?? 20 * 6e4);
-  const sleep = options.sleep ?? ((delay) => new Promise((resolve24) => setTimeout(resolve24, delay)));
+  const sleep = options.sleep ?? ((delay) => new Promise((resolve23) => setTimeout(resolve23, delay)));
   do {
     const deployments = await call2(prefix + "/deployments");
     const matching = deployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit) && !options.previousDeploymentIds?.includes(release2.id));
@@ -18468,7 +18497,7 @@ async function ship(call2, appId, options = {}) {
 async function publishPreview(call2, prefix, overview, options = {}) {
   if (!overview.preview || overview.preview.status !== "succeeded" || overview.preview.healthResult !== "healthy") throw new Error("Only a verified healthy preview can be published.");
   const preview = overview.preview;
-  if (options.previewOnly) return { status: "preview-ready", url: preview.url };
+  if (!options.productionDeploy || options.previewOnly) return { status: "preview-ready", url: preview.url };
   if (overview.policy.requirePreviewTesting && !preview.testedAt) return { status: "testing-required", url: preview.url };
   if (overview.live?.previewDeploymentId === preview.id && overview.live.status === "succeeded") return { status: "live", url: overview.live.url };
   const promotion = await call2(prefix + "/deployments/promote", { method: "POST", headers: { "Idempotency-Key": "cli-ship-" + preview.id }, body: JSON.stringify({ previewDeploymentId: preview.id, tested: false }) });
@@ -18483,7 +18512,7 @@ async function publishPreview(call2, prefix, overview, options = {}) {
       if (releases.live?.previewDeploymentId !== preview.id || releases.live.status !== "succeeded" || releases.live.healthResult !== "healthy") throw new Error("Production did not activate this healthy release. Run backify status.");
       return { status: "live", url: releases.live.url };
     }
-    await new Promise((resolve24) => setTimeout(resolve24, 4e3));
+    await new Promise((resolve23) => setTimeout(resolve23, 4e3));
   } while (Date.now() < deadline);
   throw new Error("Publication is still pending. Run backify status; deployment success has not been verified.");
 }
@@ -18496,8 +18525,8 @@ async function browserAuthenticate(options) {
   };
   let rejectSession = () => {
   };
-  const completed = new Promise((resolve24, reject) => {
-    resolveSession = resolve24;
+  const completed = new Promise((resolve23, reject) => {
+    resolveSession = resolve23;
     rejectSession = reject;
   });
   let accepted = false;
@@ -18750,7 +18779,7 @@ import { existsSync as existsSync11, lstatSync as lstatSync15, mkdirSync as mkdi
 import { resolve as resolve17, join as join12, relative as relative7, isAbsolute as isAbsolute13, dirname as dirname12 } from "node:path";
 
 // ../analyzer/dist/index.js
-import ts2 from "typescript";
+import ts3 from "typescript";
 import { readFileSync as readFileSync5, readdirSync as readdirSync4, existsSync as existsSync6 } from "node:fs";
 import { join as join5, extname } from "node:path";
 
@@ -18867,6 +18896,191 @@ function analyzeAuthentication(files) {
   return { used, providers: [...providers].sort(), dynamicFiles: [...dynamicFiles].sort() };
 }
 
+// ../analyzer/dist/schedules.js
+import ts2 from "typescript";
+var dynamic = Symbol("dynamic");
+function literal(node) {
+  if (!node)
+    return void 0;
+  if (ts2.isStringLiteral(node) || ts2.isNoSubstitutionTemplateLiteral(node))
+    return node.text;
+  if (ts2.isNumericLiteral(node))
+    return Number(node.text);
+  if (ts2.isPrefixUnaryExpression(node) && node.operator === ts2.SyntaxKind.MinusToken && ts2.isNumericLiteral(node.operand))
+    return -Number(node.operand.text);
+  if (node.kind === ts2.SyntaxKind.TrueKeyword)
+    return true;
+  if (node.kind === ts2.SyntaxKind.FalseKeyword)
+    return false;
+  if (node.kind === ts2.SyntaxKind.NullKeyword)
+    return null;
+  if (ts2.isParenthesizedExpression(node) || ts2.isAsExpression(node) || ts2.isSatisfiesExpression(node))
+    return literal(node.expression);
+  if (ts2.isArrayLiteralExpression(node)) {
+    const values = node.elements.map((item) => literal(item));
+    return values.includes(dynamic) ? dynamic : values;
+  }
+  if (ts2.isObjectLiteralExpression(node)) {
+    const result = {};
+    for (const property of node.properties) {
+      if (!ts2.isPropertyAssignment(property) || !ts2.isIdentifier(property.name) && !ts2.isStringLiteral(property.name))
+        return dynamic;
+      const value = literal(property.initializer);
+      if (value === dynamic)
+        return dynamic;
+      Object.defineProperty(result, property.name.text, { value, enumerable: true });
+    }
+    return result;
+  }
+  return dynamic;
+}
+function analyzeSchedules(files) {
+  const schedules = [], diagnostics = [];
+  for (const file of files) {
+    const sourcePath = file.path.replaceAll(String.fromCharCode(92), "/");
+    if (/(^|\/)(tests?|__tests__|fixtures)\/|\.(test|spec)\.[cm]?[jt]sx?$/.test(sourcePath))
+      continue;
+    const source = ts2.createSourceFile(sourcePath, file.content, ts2.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts2.ScriptKind.TSX : ts2.ScriptKind.TS);
+    const program = ts2.createProgram([sourcePath], { noLib: true, noResolve: true, allowJs: true }, {
+      getSourceFile: (path) => path === sourcePath ? source : void 0,
+      getDefaultLibFileName: () => "",
+      writeFile: () => {
+      },
+      getCurrentDirectory: () => "/",
+      getDirectories: () => [],
+      fileExists: (path) => path === sourcePath,
+      readFile: (path) => path === sourcePath ? file.content : void 0,
+      getCanonicalFileName: (path) => path,
+      useCaseSensitiveFileNames: () => true,
+      getNewLine: () => "\n"
+    });
+    const checker = program.getTypeChecker();
+    const jobSymbols = /* @__PURE__ */ new Set(), scheduleSymbols = /* @__PURE__ */ new Set(), roots = /* @__PURE__ */ new Set(), namespaces = /* @__PURE__ */ new Set(), factories = /* @__PURE__ */ new Set();
+    const has = (symbols, node) => {
+      const symbol = checker.getSymbolAtLocation(node);
+      return !!symbol && symbols.has(symbol);
+    };
+    const add = (symbols, node) => {
+      const symbol = checker.getSymbolAtLocation(node);
+      if (symbol)
+        symbols.add(symbol);
+    };
+    for (const statement of source.statements) {
+      if (!ts2.isImportDeclaration(statement) || !ts2.isStringLiteral(statement.moduleSpecifier) || !["@backifydev/sdk", "@backifydev/sdk/server"].includes(statement.moduleSpecifier.text) || statement.importClause?.isTypeOnly)
+        continue;
+      const bindings = statement.importClause?.namedBindings;
+      if (bindings && ts2.isNamespaceImport(bindings))
+        add(namespaces, bindings.name);
+      if (bindings && ts2.isNamedImports(bindings))
+        for (const binding of bindings.elements) {
+          if (binding.isTypeOnly)
+            continue;
+          const name2 = (binding.propertyName ?? binding.name).text;
+          if (name2 === "jobs")
+            add(jobSymbols, binding.name);
+          if (name2 === "backify")
+            add(roots, binding.name);
+          if (name2 === "createServerClient")
+            add(factories, binding.name);
+        }
+    }
+    const isNamespace = (node) => ts2.isIdentifier(node) && has(namespaces, node);
+    const isRoot = (node) => ts2.isIdentifier(node) && has(roots, node) || ts2.isPropertyAccessExpression(node) && node.name.text === "backify" && isNamespace(node.expression) || ts2.isCallExpression(node) && (ts2.isIdentifier(node.expression) && has(factories, node.expression) || ts2.isPropertyAccessExpression(node.expression) && node.expression.name.text === "createServerClient" && isNamespace(node.expression.expression));
+    const isJobs = (node) => ts2.isIdentifier(node) && has(jobSymbols, node) || ts2.isPropertyAccessExpression(node) && node.name.text === "jobs" && (isRoot(node.expression) || isNamespace(node.expression));
+    const collect = (node) => {
+      if (ts2.isVariableDeclaration(node) && node.initializer) {
+        if (ts2.isIdentifier(node.name)) {
+          if (isRoot(node.initializer))
+            add(roots, node.name);
+          if (isJobs(node.initializer))
+            add(jobSymbols, node.name);
+          if (ts2.isPropertyAccessExpression(node.initializer) && node.initializer.name.text === "schedule" && isJobs(node.initializer.expression) || ts2.isIdentifier(node.initializer) && has(scheduleSymbols, node.initializer))
+            add(scheduleSymbols, node.name);
+        } else if (ts2.isObjectBindingPattern(node.name)) {
+          for (const binding of node.name.elements) {
+            if (!ts2.isIdentifier(binding.name) || binding.dotDotDotToken || binding.initializer)
+              continue;
+            const propertyName = binding.propertyName ?? binding.name;
+            if (!ts2.isIdentifier(propertyName) && !ts2.isStringLiteral(propertyName))
+              continue;
+            if (propertyName.text === "jobs" && (isRoot(node.initializer) || isNamespace(node.initializer)))
+              add(jobSymbols, binding.name);
+            if (propertyName.text === "schedule" && isJobs(node.initializer))
+              add(scheduleSymbols, binding.name);
+            if (propertyName.text === "backify" && isNamespace(node.initializer))
+              add(roots, binding.name);
+            if (propertyName.text === "createServerClient" && isNamespace(node.initializer))
+              add(factories, binding.name);
+          }
+        }
+      }
+      ts2.forEachChild(node, collect);
+    };
+    let previousSize = -1;
+    while (previousSize !== jobSymbols.size + scheduleSymbols.size + roots.size + factories.size) {
+      previousSize = jobSymbols.size + scheduleSymbols.size + roots.size + factories.size;
+      collect(source);
+    }
+    const report = (code, message, severity = "warning") => diagnostics.push({ code, message, severity, file: file.path, docs: "https://docs.backify.dev/capabilities/scheduler" });
+    const property = (node, name2) => node.properties.find((item) => ts2.isPropertyAssignment(item) && (ts2.isIdentifier(item.name) || ts2.isStringLiteral(item.name)) && item.name.text === name2);
+    const visit = (node) => {
+      if (ts2.isCallExpression(node) && ts2.isPropertyAccessExpression(node.expression)) {
+        const method = node.expression.name.text, receiver = node.expression.expression;
+        let name2, definition;
+        if (method === "define" && isJobs(receiver) && node.arguments[0] && ts2.isObjectLiteralExpression(node.arguments[0])) {
+          const schedule = property(node.arguments[0], "schedule");
+          if (schedule) {
+            name2 = literal(property(node.arguments[0], "name")?.initializer);
+            definition = node.arguments[0].properties.some((item) => ts2.isSpreadAssignment(item) || item.name && ts2.isComputedPropertyName(item.name)) ? dynamic : literal(schedule.initializer);
+          } else if (node.arguments[0].properties.some((item) => ts2.isShorthandPropertyAssignment(item) && item.name.text === "schedule")) {
+            definition = dynamic;
+          }
+        } else if ((ts2.isPropertyAccessExpression(receiver) && receiver.name.text === "schedule" && isJobs(receiver.expression) || ts2.isIdentifier(receiver) && has(scheduleSymbols, receiver)) && ["daily", "weekly", "hourly", "cron", "once", "interval"].includes(method)) {
+          name2 = literal(node.arguments[0]);
+          definition = { kind: method, ...method === "weekly" ? { day: literal(node.arguments[2]) ?? "monday", at: literal(node.arguments[3]) ?? "00:00", timeZone: literal(node.arguments[4]) ?? "UTC" } : method === "interval" ? { intervalSeconds: literal(node.arguments[2]) } : method === "cron" ? { expression: literal(node.arguments[2]), timeZone: literal(node.arguments[3]) ?? "UTC" } : { at: literal(node.arguments[2]), timeZone: literal(node.arguments[3]) ?? "UTC" } };
+        }
+        if (definition !== void 0) {
+          if (typeof name2 !== "string" || !definition || typeof definition !== "object" || Object.values(definition).includes(dynamic))
+            report("dynamic-schedule", "Use literal schedule declarations for automatic deployment provisioning, or jobs.schedule.sync() in a trusted server setup step for dynamic declarations.");
+          else {
+            const settings = definition, kind = settings.kind;
+            const schedule = { name: name2, job: name2, kind: String(kind), timeZone: String(settings.timeZone ?? "UTC"), ...settings.payload !== void 0 ? { payload: settings.payload } : {} };
+            if (["daily", "weekly", "hourly"].includes(String(kind))) {
+              const time = settings.at ?? "00:00", day = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"].indexOf(String(settings.day ?? "monday").toLowerCase());
+              if (typeof time !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(time) || kind === "weekly" && day < 0)
+                report("invalid-schedule", "Use HH:mm and a valid weekday for scheduled jobs.", "error");
+              else {
+                const [hour, minute] = time.split(":").map(Number);
+                schedule.kind = "cron";
+                schedule.expression = kind === "hourly" ? "0 * * * *" : minute + " " + hour + " * * " + (kind === "weekly" ? day : "*");
+                schedules.push(schedule);
+              }
+            } else if (kind === "cron" || kind === "once" || kind === "interval") {
+              if (kind === "cron")
+                schedule.expression = settings.expression;
+              if (kind === "once")
+                schedule.at = settings.at;
+              if (kind === "interval")
+                schedule.intervalSeconds = settings.intervalSeconds;
+              schedules.push(schedule);
+            } else
+              report("invalid-schedule", "Unknown schedule declaration kind.", "error");
+          }
+        }
+      }
+      ts2.forEachChild(node, visit);
+    };
+    visit(source);
+  }
+  const unique = /* @__PURE__ */ new Map();
+  for (const schedule of schedules) {
+    if (unique.has(schedule.name) && JSON.stringify(unique.get(schedule.name)) !== JSON.stringify(schedule))
+      diagnostics.push({ severity: "error", code: "duplicate-schedule", message: "Conflicting schedule declarations: " + schedule.name, docs: "https://docs.backify.dev/capabilities/scheduler" });
+    unique.set(schedule.name, schedule);
+  }
+  return { schedules: [...unique.values()], diagnostics };
+}
+
 // ../analyzer/dist/index.js
 var bypass = { "@azure/storage-blob": { capability: "storage", replacement: "storage" }, "@aws-sdk/client-s3": { capability: "storage", replacement: "storage" }, "firebase-admin": { capability: "database", replacement: "db" }, "@supabase/supabase-js": { capability: "database", replacement: "db" }, "@azure/service-bus": { capability: "jobs", replacement: "jobs" } };
 function analyzeSources(files, options = {}) {
@@ -18875,7 +19089,17 @@ function analyzeSources(files, options = {}) {
     analyzeFile(file, used, diagnostics);
   if (used.has("http"))
     used.add("events");
+  if (used.has("integrations")) {
+    used.add("events");
+    used.add("secrets");
+  }
   const authentication = analyzeAuthentication(files);
+  const scheduling = analyzeSchedules(files);
+  if (scheduling.schedules.length || scheduling.diagnostics.length) {
+    used.add("jobs");
+    used.add("scheduler");
+  }
+  diagnostics.push(...scheduling.diagnostics);
   if (authentication.used)
     used.add("auth");
   else
@@ -18883,6 +19107,8 @@ function analyzeSources(files, options = {}) {
   const capabilities = Object.fromEntries([...used].sort().map((name2) => [name2, { version: CAPABILITY_REGISTRY[name2].version }]));
   if (capabilities.auth && (authentication.providers.length || authentication.dynamicFiles.length))
     capabilities.auth.configuration = { providers: authentication.providers, dynamicProviders: authentication.dynamicFiles.length > 0 };
+  if (capabilities.scheduler && scheduling.schedules.length)
+    capabilities.scheduler.configuration = { schedules: scheduling.schedules };
   for (const file of authentication.dynamicFiles)
     diagnostics.push({ severity: "warning", code: "dynamic-auth-provider", file, docs: CAPABILITY_REGISTRY.auth.docs, message: "Declare every possible authentication provider in backify.yaml; dynamic provider selection cannot be provisioned from source alone." });
   for (const provider of authentication.providers)
@@ -18891,9 +19117,9 @@ function analyzeSources(files, options = {}) {
   return { schemaVersion: 1, applicationId: options.applicationId ?? "unknown", commit: options.commit ?? "unknown", sdkVersion: options.sdkVersion ?? "unknown", capabilities, diagnostics };
 }
 function analyzeFile(file, used, diagnostics) {
-  const source = ts2.createSourceFile(file.path, file.content, ts2.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts2.ScriptKind.TSX : ts2.ScriptKind.TS), named = /* @__PURE__ */ new Map(), namespaces = /* @__PURE__ */ new Set(), roots = /* @__PURE__ */ new Set(), factories = /* @__PURE__ */ new Set();
+  const source = ts3.createSourceFile(file.path, file.content, ts3.ScriptTarget.Latest, true, file.path.endsWith("x") ? ts3.ScriptKind.TSX : ts3.ScriptKind.TS), named = /* @__PURE__ */ new Map(), namespaces = /* @__PURE__ */ new Set(), roots = /* @__PURE__ */ new Set(), factories = /* @__PURE__ */ new Set();
   source.forEachChild((node) => {
-    if (!ts2.isImportDeclaration(node) || !ts2.isStringLiteral(node.moduleSpecifier))
+    if (!ts3.isImportDeclaration(node) || !ts3.isStringLiteral(node.moduleSpecifier))
       return;
     const module = node.moduleSpecifier.text;
     if (bypass[module]) {
@@ -18905,9 +19131,9 @@ function analyzeFile(file, used, diagnostics) {
     const bindings = node.importClause.namedBindings;
     if (!bindings)
       return;
-    if (ts2.isNamespaceImport(bindings))
+    if (ts3.isNamespaceImport(bindings))
       namespaces.add(bindings.name.text);
-    else if (ts2.isNamedImports(bindings))
+    else if (ts3.isNamedImports(bindings))
       for (const element of bindings.elements) {
         const imported = (element.propertyName ?? element.name).text, local = element.name.text;
         if (imported === "createServerClient")
@@ -18922,17 +19148,19 @@ function analyzeFile(file, used, diagnostics) {
       }
   });
   const visit = (node) => {
-    if (ts2.isVariableDeclaration(node) && ts2.isIdentifier(node.name) && node.initializer && ts2.isCallExpression(node.initializer) && ts2.isIdentifier(node.initializer.expression) && factories.has(node.initializer.expression.text))
+    if (ts3.isCallExpression(node) && ts3.isPropertyAccessExpression(node.expression) && ["createWebhook", "create"].includes(node.expression.name.text) && rootCapability(node.expression.expression, named, namespaces, roots) === "events")
+      used.add("functions");
+    if (ts3.isVariableDeclaration(node) && ts3.isIdentifier(node.name) && node.initializer && ts3.isCallExpression(node.initializer) && ts3.isIdentifier(node.initializer.expression) && factories.has(node.initializer.expression.text))
       roots.add(node.name.text);
-    if (ts2.isCallExpression(node) && ts2.isIdentifier(node.expression) && named.get(node.expression.text) === "jobs" && node.arguments.some((argument) => ts2.isObjectLiteralExpression(argument) && argument.properties.some((property) => ts2.isPropertyAssignment(property) && property.name.getText(source) === "schedule")))
+    if (ts3.isCallExpression(node) && ts3.isIdentifier(node.expression) && named.get(node.expression.text) === "jobs" && node.arguments.some((argument) => ts3.isObjectLiteralExpression(argument) && argument.properties.some((property) => ts3.isPropertyAssignment(property) && property.name.getText(source) === "schedule")))
       used.add("scheduler");
-    if (ts2.isIdentifier(node)) {
+    if (ts3.isIdentifier(node)) {
       const parent = node.parent;
-      if (named.has(node.text) && !ts2.isImportSpecifier(parent) && isValueUse(node))
+      if (named.has(node.text) && !ts3.isImportSpecifier(parent) && isValueUse(node))
         used.add(named.get(node.text));
     }
-    if (ts2.isPropertyAccessExpression(node)) {
-      if (ts2.isIdentifier(node.expression)) {
+    if (ts3.isPropertyAccessExpression(node)) {
+      if (ts3.isIdentifier(node.expression)) {
         if (namespaces.has(node.expression.text)) {
           const cap = SDK_IMPORT_CAPABILITIES[node.name.text];
           if (cap)
@@ -18947,18 +19175,18 @@ function analyzeFile(file, used, diagnostics) {
       if (node.name.text === "schedule" && rootCapability(node.expression, named, namespaces, roots) === "jobs")
         used.add("scheduler");
     }
-    ts2.forEachChild(node, visit);
+    ts3.forEachChild(node, visit);
   };
   visit(source);
 }
 function isValueUse(node) {
   const p = node.parent;
-  return !(ts2.isImportSpecifier(p) || ts2.isExportSpecifier(p) || ts2.isTypeReferenceNode(p) || ts2.isTypeQueryNode(p));
+  return !(ts3.isImportSpecifier(p) || ts3.isExportSpecifier(p) || ts3.isTypeReferenceNode(p) || ts3.isTypeQueryNode(p));
 }
 function rootCapability(node, named, namespaces, roots) {
-  if (ts2.isIdentifier(node))
+  if (ts3.isIdentifier(node))
     return named.get(node.text);
-  if (ts2.isPropertyAccessExpression(node) && ts2.isIdentifier(node.expression)) {
+  if (ts3.isPropertyAccessExpression(node) && ts3.isIdentifier(node.expression)) {
     if (namespaces.has(node.expression.text) || roots.has(node.expression.text))
       return SDK_IMPORT_CAPABILITIES[node.name.text];
   }
@@ -19138,6 +19366,10 @@ function createLocalNativeEvents(local, native) {
     if (typeof name2 !== "string" || !/^[a-zA-Z][a-zA-Z0-9_.-]{0,127}$/.test(name2) || /[\r\n]/.test(name2)) throw new Error("Invalid event name");
   };
   return {
+    track: (name2, data, options) => {
+      if (!local.track) throw new Error("Upgrade the local SDK to enable event tracking");
+      return local.track(name2, data, options);
+    },
     async emit(name2, payload, options) {
       validateName2(name2);
       if (options?.idempotencyKey !== void 0 && (typeof options.idempotencyKey !== "string" || !options.idempotencyKey || options.idempotencyKey.length > 128)) throw new Error("Invalid idempotency key");
@@ -20395,10 +20627,10 @@ function assertLocalStatePath(root, filename2) {
   }
 }
 function stateValid(value) {
-  const uuid5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const uuid4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   if (value?.jobs !== void 0 && !validLocalJobState(value.jobs, [value.databaseId, value.storageId, ...Object.values(value.storageBindings ?? {}), ...value.events ? [value.events.id] : []].filter((identifier2) => typeof identifier2 === "string"))) return false;
-  if (value?.events !== void 0 && (!value.events || typeof value.events !== "object" || Array.isArray(value.events) || typeof value.events.id !== "string" || value.events.id.length !== 36 || !uuid5.test(value.events.id) || value.events.id === "00000000-0000-0000-0000-000000000000" || [value.databaseId, value.storageId, ...Object.values(value.storageBindings ?? {})].some((identifier2) => typeof identifier2 === "string" && identifier2.toLowerCase() === value.events.id.toLowerCase()) || typeof value.events.password !== "string" || value.events.password.length !== 64 || !/^[a-f0-9]{64}$/.test(value.events.password) || typeof value.events.schemaDigest !== "string" || value.events.schemaDigest.length !== 64 || !/^[a-f0-9]{64}$/.test(value.events.schemaDigest) || typeof value.events.initialized !== "boolean")) return false;
-  return value?.version === 1 && value.scope && [value.scope.organizationId, value.scope.applicationId, value.scope.environmentId, value.databaseId, value.storageId].every((identifier2) => typeof identifier2 === "string" && uuid5.test(identifier2)) && Number.isSafeInteger(value.configurationVersion) && value.configurationVersion >= 0 && /^[a-f0-9]{64}$/.test(value.adminPassword) && /^[a-f0-9]{64}$/.test(value.databasePassword) && (value.retainedDatabasePort === void 0 || Number.isInteger(value.retainedDatabasePort) && value.retainedDatabasePort > 0 && value.retainedDatabasePort <= 65535);
+  if (value?.events !== void 0 && (!value.events || typeof value.events !== "object" || Array.isArray(value.events) || typeof value.events.id !== "string" || value.events.id.length !== 36 || !uuid4.test(value.events.id) || value.events.id === "00000000-0000-0000-0000-000000000000" || [value.databaseId, value.storageId, ...Object.values(value.storageBindings ?? {})].some((identifier2) => typeof identifier2 === "string" && identifier2.toLowerCase() === value.events.id.toLowerCase()) || typeof value.events.password !== "string" || value.events.password.length !== 64 || !/^[a-f0-9]{64}$/.test(value.events.password) || typeof value.events.schemaDigest !== "string" || value.events.schemaDigest.length !== 64 || !/^[a-f0-9]{64}$/.test(value.events.schemaDigest) || typeof value.events.initialized !== "boolean")) return false;
+  return value?.version === 1 && value.scope && [value.scope.organizationId, value.scope.applicationId, value.scope.environmentId, value.databaseId, value.storageId].every((identifier2) => typeof identifier2 === "string" && uuid4.test(identifier2)) && Number.isSafeInteger(value.configurationVersion) && value.configurationVersion >= 0 && /^[a-f0-9]{64}$/.test(value.adminPassword) && /^[a-f0-9]{64}$/.test(value.databasePassword) && (value.retainedDatabasePort === void 0 || Number.isInteger(value.retainedDatabasePort) && value.retainedDatabasePort > 0 && value.retainedDatabasePort <= 65535);
 }
 function acquireLocalLease(root, relativePath2 = ".backify/dev/development.lock") {
   const filename2 = join7(root, relativePath2);
@@ -20968,8 +21200,8 @@ function prepareLocalJobTrustRenewal(root, filename2, mount) {
   }
 }
 function createLocalJobTrustRenewal(root, mounts, settings = {}, dependencies = { createHash: createHash9, lstatSync: lstatSync10, readFileSync: readFileSync11, isAbsolute: isAbsolute7, relative: relative2, resolve: resolve10, createPersistentApplicationAuthProvider, synchronizeApplicationAuthTrustWithDigest }) {
-  const { createHash: createHash16, lstatSync: lstatSync20, readFileSync: readFileSync25, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve24, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2, synchronizeApplicationAuthTrustWithDigest: synchronizeApplicationAuthTrustWithDigest2 } = dependencies;
-  const key = (filename2) => process.platform === "win32" ? resolve24(filename2).toLowerCase() : resolve24(filename2);
+  const { createHash: createHash16, lstatSync: lstatSync19, readFileSync: readFileSync24, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve23, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2, synchronizeApplicationAuthTrustWithDigest: synchronizeApplicationAuthTrustWithDigest2 } = dependencies;
+  const key = (filename2) => process.platform === "win32" ? resolve23(filename2).toLowerCase() : resolve23(filename2);
   const groups = [];
   for (const mount of mounts) {
     if (!mount.renewal) continue;
@@ -20986,13 +21218,13 @@ function createLocalJobTrustRenewal(root, mounts, settings = {}, dependencies =
     groups.push({ mount, followers, renewal, nextAt: 0, failures: 0, status: "waiting" });
   }
   const read = (filename2, maximum, privateFile2 = false) => {
-    for (let current = resolve24(filename2); current !== root; current = resolve24(current, "..")) {
+    for (let current = resolve23(filename2); current !== root; current = resolve23(current, "..")) {
       const part = relative11(root, current);
-      if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync20(current).isSymbolicLink()) throw new Error();
+      if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync19(current).isSymbolicLink()) throw new Error();
     }
-    const metadata = lstatSync20(filename2);
+    const metadata = lstatSync19(filename2);
     if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > maximum || privateFile2 && process.platform !== "win32" && (metadata.uid !== process.getuid?.() || (metadata.mode & 63) !== 0)) throw new Error();
-    const bytes = readFileSync25(filename2);
+    const bytes = readFileSync24(filename2);
     if (bytes.length > maximum) throw new Error();
     return bytes;
   };
@@ -21094,25 +21326,25 @@ function readLocalJobArtifacts(root, filename2) {
   return validateLocalJobArtifacts(JSON.parse(readFileSync12(path, "utf8")));
 }
 function createLocalJobExecutor(options, dependencies = { spawn: spawn2, createHash: createHash10, lstatSync: lstatSync11, readFileSync: readFileSync12, isAbsolute: isAbsolute8, relative: relative3, resolve: resolve11, validateWorkloadJobSchedules, createPersistentApplicationAuthProvider }) {
-  const { spawn: spawn6, createHash: createHash16, lstatSync: lstatSync20, readFileSync: readFileSync25, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve24, validateWorkloadJobSchedules: validateWorkloadJobSchedules2, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2 } = dependencies;
+  const { spawn: spawn6, createHash: createHash16, lstatSync: lstatSync19, readFileSync: readFileSync24, isAbsolute: isAbsolute17, relative: relative11, resolve: resolve23, validateWorkloadJobSchedules: validateWorkloadJobSchedules2, createPersistentApplicationAuthProvider: createPersistentApplicationAuthProvider2 } = dependencies;
   const assertReady = () => {
-    for (let current = resolve24(options.workerFile); current !== options.root; current = resolve24(current, "..")) {
+    for (let current = resolve23(options.workerFile); current !== options.root; current = resolve23(current, "..")) {
       const part = relative11(options.root, current);
-      if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync20(current).isSymbolicLink()) throw new Error("Native worker paths or pins changed");
+      if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync19(current).isSymbolicLink()) throw new Error("Native worker paths or pins changed");
     }
-    if (!lstatSync20(options.workerFile).isFile() || lstatSync20(options.workerFile).size > 16777216 || createHash16("sha256").update(readFileSync25(options.workerFile)).digest("hex") !== options.artifact.artifactVersion) throw new Error("Native worker paths or pins changed");
+    if (!lstatSync19(options.workerFile).isFile() || lstatSync19(options.workerFile).size > 16777216 || createHash16("sha256").update(readFileSync24(options.workerFile)).digest("hex") !== options.artifact.artifactVersion) throw new Error("Native worker paths or pins changed");
     if (options.authTrust) {
       try {
         const mount = options.authTrust;
         for (const path of [mount.trustFile, mount.stateFile]) {
-          for (let current = resolve24(path); current !== options.root; current = resolve24(current, "..")) {
+          for (let current = resolve23(path); current !== options.root; current = resolve23(current, "..")) {
             const part = relative11(options.root, current);
-            if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync20(current).isSymbolicLink()) throw new Error();
+            if (part === ".." || part.startsWith("../") || part.startsWith("..\\") || isAbsolute17(part) || lstatSync19(current).isSymbolicLink()) throw new Error();
           }
-          const metadata = lstatSync20(path);
+          const metadata = lstatSync19(path);
           if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > (path === mount.trustFile ? 131072 : 2048)) throw new Error();
         }
-        const bytes = readFileSync25(mount.trustFile);
+        const bytes = readFileSync24(mount.trustFile);
         if (bytes.length > 131072 || createHash16("sha256").update(bytes).digest("hex") !== mount.trustDigest) throw new Error();
         const trust = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(bytes));
         if (trust.revision !== mount.revision) throw new Error();
@@ -21735,14 +21967,14 @@ function createLocalIdentityProvider(options) {
   serverOnly();
   if (typeof process !== "undefined" && process.env.NODE_ENV === "production")
     throw new Error("Local Backify identities must not run in production");
-  const uuid5 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) && value !== "00000000-0000-0000-0000-000000000000";
+  const uuid4 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value) && value !== "00000000-0000-0000-0000-000000000000";
   const text3 = (value, maximum) => typeof value === "string" && value.length > 0 && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value);
-  if (!options.scope || Object.keys(options.scope).length !== 3 || !uuid5(options.scope.organizationId) || !uuid5(options.scope.applicationId) || !uuid5(options.scope.environmentId) || !text3(options.organizationName, 200) || !Array.isArray(options.users) || options.users.length < 1 || options.users.length > 32 || !Array.isArray(options.requestOrigins) || options.requestOrigins.length < 1 || options.requestOrigins.length > 8)
+  if (!options.scope || Object.keys(options.scope).length !== 3 || !uuid4(options.scope.organizationId) || !uuid4(options.scope.applicationId) || !uuid4(options.scope.environmentId) || !text3(options.organizationName, 200) || !Array.isArray(options.users) || options.users.length < 1 || options.users.length > 32 || !Array.isArray(options.requestOrigins) || options.requestOrigins.length < 1 || options.requestOrigins.length > 8)
     throw new Error("Invalid local identity configuration");
   const scope = { ...options.scope }, organizationName = options.organizationName;
   const users = /* @__PURE__ */ new Map();
   for (const user of options.users) {
-    if (!user || Object.keys(user).some((name2) => !["id", "displayName", "email", "roles"].includes(name2)) || !uuid5(user.id) || users.has(user.id) || !text3(user.displayName, 200) || user.email !== void 0 && !text3(user.email, 320))
+    if (!user || Object.keys(user).some((name2) => !["id", "displayName", "email", "roles"].includes(name2)) || !uuid4(user.id) || users.has(user.id) || !text3(user.displayName, 200) || user.email !== void 0 && !text3(user.email, 320))
       throw new Error("Invalid local identity user");
     if (user.roles !== void 0 && (!Array.isArray(user.roles) || user.roles.length > 32 || user.roles.some((role) => !role || Object.keys(role).some((name2) => !["name", "permissions"].includes(name2)) || !text3(role.name, 100) || !Array.isArray(role.permissions) || role.permissions.length > 128 || role.permissions.some((permission) => !text3(permission, 100)) || new Set(role.permissions).size !== role.permissions.length) || new Set(user.roles.map((role) => role.name)).size !== user.roles.length))
       throw new Error("Invalid local identity roles");
@@ -22890,76 +23122,9 @@ async function workloadProvenanceCommand(args2) {
   return { schemaVersion: 1, status: "captured-unsigned", deploymentReady: false, reportDigest: provenanceHash(JSON.stringify(result, null, 2) + "\n") };
 }
 
-// src/workload-artifact-plan.ts
-import { existsSync as existsSync13, lstatSync as lstatSync17, readFileSync as readFileSync21, realpathSync as realpathSync7 } from "node:fs";
-import { resolve as resolve21 } from "node:path";
-function uuid4(value) {
-  return typeof value === "string" && value.length === 36 && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value) && value !== "00000000-0000-0000-0000-000000000000";
-}
-function validImage(value) {
-  if (typeof value !== "string" || value.length > 512 || /[\r\n]/.test(value) || !/^[a-z0-9][a-z0-9.:-]*\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*@sha256:[a-f0-9]{64}$/.test(value)) return false;
-  const registry = value.slice(0, value.indexOf("/")), parts = registry.split(":");
-  if (parts.length > 2 || parts[0].length > 253 || parts[0].split(".").some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) || parts.length === 2 && (!/^[0-9]+$/.test(parts[1]) || Number(parts[1]) < 1 || Number(parts[1]) > 65535)) return false;
-  return true;
-}
-function jobMetadata(value) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > 100) throw new Error("Invalid bounded worker job metadata");
-  const names = /* @__PURE__ */ new Set();
-  return value.map((item) => {
-    if (!item || typeof item !== "object" || Array.isArray(item) || Object.keys(item).some((key) => !["name", "retries", "timeoutSeconds", "concurrency", "backoff"].includes(key)) || typeof item.name !== "string" || item.name.length > 100 || /[\r\n]/.test(item.name) || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/.test(item.name) || names.has(item.name)) throw new Error("Invalid bounded worker job metadata");
-    const job = { name: item.name, retries: item.retries === void 0 ? 0 : item.retries, timeoutSeconds: item.timeoutSeconds === void 0 ? 30 : item.timeoutSeconds, concurrency: item.concurrency === void 0 ? 1 : item.concurrency, backoff: item.backoff === void 0 ? "fixed" : item.backoff };
-    if (!Number.isInteger(job.retries) || job.retries < 0 || job.retries > 100 || !Number.isInteger(job.timeoutSeconds) || job.timeoutSeconds < 1 || job.timeoutSeconds > 86400 || !Number.isInteger(job.concurrency) || job.concurrency < 1 || job.concurrency > 100 || !["fixed", "exponential"].includes(job.backoff)) throw new Error("Invalid bounded worker job metadata");
-    names.add(job.name);
-    return job;
-  }).sort((first, second) => first.name < second.name ? -1 : first.name > second.name ? 1 : 0);
-}
-function parseWorkerArtifactPlan(args2) {
-  const fields5 = /* @__PURE__ */ new Map([["--root", "root"], ["--organization", "organizationId"], ["--app", "applicationId"], ["--environment", "environmentId"], ["--deployment", "deploymentId"], ["--source-commit", "sourceCommit"], ["--image", "imageReference"], ["--jobs-file", "jobsFile"], ["--entry", "entry"], ["--base-image", "baseImage"]]);
-  const result = {}, seen = /* @__PURE__ */ new Set();
-  for (let index = 0; index < args2.length; index++) {
-    const option2 = args2[index];
-    if (seen.has(option2)) throw new Error("Duplicate worker artifact planning option");
-    seen.add(option2);
-    if (option2 === "--json") continue;
-    const field = fields5.get(option2), value = args2[++index];
-    if (!field || !value || value.startsWith("--")) throw new Error("Unsupported or missing worker artifact planning option");
-    result[field] = value;
-  }
-  for (const field of ["organizationId", "applicationId", "environmentId", "deploymentId", "sourceCommit", "imageReference", "jobsFile", "entry"]) if (!result[field]) throw new Error("Supply all worker artifact scope, source, image, jobs and entry pins");
-  return result;
-}
-async function planWorkerArtifactRegistration(options) {
-  if (![options.organizationId, options.applicationId, options.environmentId, options.deploymentId].every(uuid4) || typeof options.sourceCommit !== "string" || ![40, 64].includes(options.sourceCommit.length) || !/^[a-f0-9]+$/.test(options.sourceCommit) || !validImage(options.imageReference)) throw new Error("Invalid worker artifact scope, source or image pin");
-  const root = realpathSync7(resolve21(options.root ?? process.cwd()));
-  if (typeof options.jobsFile !== "string" || !options.jobsFile || typeof options.entry !== "string" || !options.entry) throw new Error("Worker artifact planning requires explicit jobs and entry files");
-  const filename2 = resolve21(root, options.jobsFile);
-  assertLocalStatePath(root, filename2);
-  if (!existsSync13(filename2) || !lstatSync17(filename2).isFile() || lstatSync17(filename2).size > 32768) throw new Error("Worker job metadata file must be a bounded repository file");
-  let jobs;
-  try {
-    jobs = jobMetadata(JSON.parse(readFileSync21(filename2, "utf8")));
-  } catch {
-    throw new Error("Invalid bounded worker job metadata");
-  }
-  const workload = await planWorkload({ root, kind: "worker", entry: options.entry, baseImage: options.baseImage });
-  const scope = { organizationId: options.organizationId.toLowerCase(), applicationId: options.applicationId.toLowerCase(), environmentId: options.environmentId.toLowerCase() };
-  const body = { schemaVersion: 1, deploymentId: options.deploymentId.toLowerCase(), artifactVersion: workload.artifactVersion, imageReference: options.imageReference, sourceCommit: options.sourceCommit, jobs };
-  return {
-    schemaVersion: 1,
-    status: "planned",
-    scope,
-    deploymentReady: false,
-    sourceCommitVerified: false,
-    imageVerified: false,
-    registration: { method: "POST", path: "/api/apps/" + scope.applicationId + "/worker-artifacts/environments/" + scope.environmentId, headers: { "X-Organization-ID": scope.organizationId, "content-type": "application/json" }, body },
-    requiredBindings: workload.capabilityBindings,
-    blockers: [.../* @__PURE__ */ new Set([...workload.blockers, "deployment-source-match-required", "artifact-source-conformance-required", "immutable-image-conformance-required", "job-declaration-conformance-required", "durable-provider-dispatch-required", "workload-credential-broker-required"])].sort()
-  };
-}
-
 // src/workload-trust-state.ts
-import { lstatSync as lstatSync18, readFileSync as readFileSync22 } from "node:fs";
-import { isAbsolute as isAbsolute16, resolve as resolve22 } from "node:path";
+import { lstatSync as lstatSync17, readFileSync as readFileSync21 } from "node:fs";
+import { isAbsolute as isAbsolute16, resolve as resolve21 } from "node:path";
 function parseWorkloadTrustState(args2) {
   const action = args2[0];
   if (action !== "plan" && action !== "initialize") throw new Error("Use backify workload trust-state plan|initialize");
@@ -22981,12 +23146,12 @@ function parseWorkloadTrustState(args2) {
   return { action, trustFile: values.get("--trust-file"), stateFile: values.get("--state-file"), expectedRevision: Number(values.get("--revision")), expectedScope: { organizationId: values.get("--organization"), applicationId: values.get("--application"), environmentId: values.get("--environment") }, confirmed: values.has("--confirm") };
 }
 function workloadTrustState(options) {
-  if (!["plan", "initialize"].includes(options.action) || !isAbsolute16(options.trustFile) || !isAbsolute16(options.stateFile) || resolve22(options.trustFile) === resolve22(options.stateFile) || !Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 1) throw new Error("Specify separate absolute trust/state paths and a positive reviewed revision");
+  if (!["plan", "initialize"].includes(options.action) || !isAbsolute16(options.trustFile) || !isAbsolute16(options.stateFile) || resolve21(options.trustFile) === resolve21(options.stateFile) || !Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 1) throw new Error("Specify separate absolute trust/state paths and a positive reviewed revision");
   let trust;
   try {
-    const metadata = lstatSync18(options.trustFile);
+    const metadata = lstatSync17(options.trustFile);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 131072) throw new Error();
-    const bytes = readFileSync22(options.trustFile);
+    const bytes = readFileSync21(options.trustFile);
     if (bytes.length > 131072) throw new Error();
     trust = JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(bytes));
   } catch {
@@ -22996,14 +23161,14 @@ function workloadTrustState(options) {
   if (trust.revision !== options.expectedRevision) throw new Error("Application identity trust revision changed; review again");
   if (options.action === "initialize") {
     if (!options.confirmed) throw new Error("Initialization requires explicit --confirm after reviewing the plan");
-    initializeApplicationAuthState(trust, { expectedScope: options.expectedScope, stateFile: resolve22(options.stateFile) });
+    initializeApplicationAuthState(trust, { expectedScope: options.expectedScope, stateFile: resolve21(options.stateFile) });
   }
-  return { schemaVersion: 1, status: options.action === "plan" ? "planned" : "initialized", scope: options.expectedScope, revision: trust.revision, validUntil: trust.validUntil, stateFile: resolve22(options.stateFile), requiresPrivatePersistentDirectory: true, recoveryAutomatic: false, productionChanges: false };
+  return { schemaVersion: 1, status: options.action === "plan" ? "planned" : "initialized", scope: options.expectedScope, revision: trust.revision, validUntil: trust.validUntil, stateFile: resolve21(options.stateFile), requiresPrivatePersistentDirectory: true, recoveryAutomatic: false, productionChanges: false };
 }
 
 // src/scaffold.ts
-import { existsSync as existsSync14, lstatSync as lstatSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync23, readdirSync as readdirSync8, realpathSync as realpathSync8, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname16, join as join16, relative as relative10, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync13, lstatSync as lstatSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync22, readdirSync as readdirSync8, realpathSync as realpathSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname16, join as join16, relative as relative10, resolve as resolve22 } from "node:path";
 function json2(value) {
   return JSON.stringify(value, null, 2) + "\n";
 }
@@ -23181,21 +23346,21 @@ provider-readiness claim, cloud deployment or browser authentication is implied.
 }
 function scaffoldFullStack(options) {
   const files = fullStackTemplate(options.appId, options.name);
-  const root = resolve23(options.root ?? process.cwd());
-  if (!existsSync14(root) || !lstatSync19(root).isDirectory() || lstatSync19(root).isSymbolicLink()) throw new Error("Scaffold destination must be an existing non-linked directory");
+  const root = resolve22(options.root ?? process.cwd());
+  if (!existsSync13(root) || !lstatSync18(root).isDirectory() || lstatSync18(root).isSymbolicLink()) throw new Error("Scaffold destination must be an existing non-linked directory");
   const allowed = /* @__PURE__ */ new Set([...Object.keys(files).map((filename2) => filename2.split("/")[0]), ".git", "node_modules", "package-lock.json", ".backify"]);
   if (readdirSync8(root).some((filename2) => !allowed.has(filename2))) throw new Error("Scaffolding requires an empty folder or an unchanged generated starter");
-  const canonicalRoot = realpathSync8(root);
+  const canonicalRoot = realpathSync7(root);
   const pending = [];
   for (const [filename2, content] of Object.entries(files)) {
     const destination = join16(root, filename2);
     let current = destination;
     while (current !== root) {
       try {
-        const stat = lstatSync19(current);
+        const stat = lstatSync18(current);
         if (stat.isSymbolicLink() || current !== destination && !stat.isDirectory()) throw new Error("Scaffolding refuses linked or invalid output paths: " + filename2);
-        if (relative10(canonicalRoot, realpathSync8(current)).startsWith("..")) throw new Error("Scaffold output must remain inside its directory");
-        if (current === destination && (!stat.isFile() || readFileSync23(current, "utf8") !== content)) throw new Error("Scaffolding refuses to overwrite existing content: " + filename2);
+        if (relative10(canonicalRoot, realpathSync7(current)).startsWith("..")) throw new Error("Scaffold output must remain inside its directory");
+        if (current === destination && (!stat.isFile() || readFileSync22(current, "utf8") !== content)) throw new Error("Scaffolding refuses to overwrite existing content: " + filename2);
       } catch (error) {
         if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") throw error;
         if (current === destination) pending.push(filename2);
@@ -23250,16 +23415,16 @@ function localInspectionCommand(args2) {
 }
 
 // src/index.ts
-import { readFileSync as readFileSync24, existsSync as existsSync15, rmSync as rmSync3 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync14, rmSync as rmSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join17 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 var configPath = join17(homedir2(), ".backify.json");
-var userConfig = existsSync15(configPath) ? JSON.parse(readFileSync24(configPath, "utf8")) : {};
+var userConfig = existsSync14(configPath) ? JSON.parse(readFileSync23(configPath, "utf8")) : {};
 var [command2, ...args] = process.argv.slice(2);
 async function call(path, init) {
   let appId = option("--app");
-  if (!appId && existsSync15(join17(process.cwd(), "backify.json"))) appId = projectApplication();
+  if (!appId && existsSync14(join17(process.cwd(), "backify.json"))) appId = projectApplication();
   const session = appId ? userConfig.sessions?.[sessionKey(appId)] : void 0;
   const credential = session ?? { token: userConfig.token ?? "", organizationId: userConfig.organizationId ?? "", apiUrl: process.env.BACKIFY_API_URL ?? userConfig.apiUrl ?? "https://api.backify.dev/api" };
   return (appId ? applicationClient(credential, appId) : apiClient(credential))(path, init);
@@ -23299,6 +23464,13 @@ function applicationClient(session, appId) {
 }
 async function main() {
   switch (command2) {
+    case "integrations": {
+      const path = integrationDiscoveryPath(args[0], { applicationId: applicationGuid(option("--app") ?? projectApplication()), connectionId: option("--connection"), operationId: option("--operation"), query: option("--query"), offset: Number(option("--offset") ?? 0) });
+      const value = await call(path);
+      if (args[0] === "types") console.log(value.source);
+      else console.log(JSON.stringify(value, null, 2));
+      break;
+    }
     case "workload": {
       if (args[0] === "provenance") {
         console.log(JSON.stringify(await workloadProvenanceCommand(args.slice(1)), null, 2));
@@ -23323,11 +23495,7 @@ async function main() {
         console.log(JSON.stringify(workloadTrustState(parseWorkloadTrustState(args.slice(1))), null, 2));
         break;
       }
-      if (args[0] === "artifact-plan") {
-        console.log(JSON.stringify(await planWorkerArtifactRegistration(parseWorkerArtifactPlan(args.slice(1))), null, 2));
-        break;
-      }
-      if (args[0] !== "plan" && args[0] !== "package") throw new Error("Use backify workload plan|package --kind http|worker, workload artifact-plan or workload provenance capture|verify");
+      if (args[0] !== "plan" && args[0] !== "package") throw new Error("Use backify workload plan|package --kind http|worker or workload provenance capture|verify");
       const options = { kind: option("--kind"), entry: option("--entry"), baseImage: option("--base-image"), output: option("--output") };
       console.log(JSON.stringify(await (args[0] === "plan" ? planWorkload(options) : packageWorkload(options)), null, 2));
       break;
@@ -23395,7 +23563,7 @@ async function main() {
         const name2 = option("--name");
         if (!name2) throw new Error("Specify --name <job>");
         const payload = option("--payload");
-        console.log(JSON.stringify(await localRequest("/v1/jobs/run", { name: name2, payload: payload ? JSON.parse(readFileSync24(payload, "utf8")) : null }), null, 2));
+        console.log(JSON.stringify(await localRequest("/v1/jobs/run", { name: name2, payload: payload ? JSON.parse(readFileSync23(payload, "utf8")) : null }), null, 2));
       } else if (["retry", "cancel"].includes(args[0])) {
         const id = option("--id");
         if (!id) throw new Error("Specify --id <run>");
@@ -23418,7 +23586,7 @@ async function main() {
         const environmentId = option("--environment");
         const packagePath = option("--package");
         if (!environmentId || !packagePath || !args.includes("--confirm")) throw new Error("Use backify functions deploy --environment <environment-id> --package <functions.zip> --confirm. This replaces the complete function project.");
-        await deployFunctions(call, appId, applicationGuid(environmentId), new Uint8Array(readFileSync24(packagePath)), { progress: (message) => console.log(message) });
+        await deployFunctions(call, appId, applicationGuid(environmentId), new Uint8Array(readFileSync23(packagePath)), { progress: (message) => console.log(message) });
         console.log("Functions deployed.");
       } else throw new Error("Use backify functions package or backify functions deploy");
       break;
@@ -23447,7 +23615,7 @@ async function main() {
         userConfig.token = args[0];
         userConfig.organizationId = args[1] ?? userConfig.organizationId;
         saveUserConfig(configPath, userConfig);
-      } else await browserLogin(option("--app") ?? (existsSync15(join17(process.cwd(), "backify.json")) ? projectApplication() : void 0), option("--organization"));
+      } else await browserLogin(option("--app") ?? (existsSync14(join17(process.cwd(), "backify.json")) ? projectApplication() : void 0), option("--organization"));
       console.log("Logged in to Backify");
       break;
     case "logout":
@@ -23486,7 +23654,7 @@ async function main() {
       userConfig.sessions[key] ??= session;
       saveUserConfig(configPath, userConfig);
       if (args.includes("--clone")) await cloneProject(client, appId);
-      else if (existsSync15(join17(process.cwd(), ".git"))) {
+      else if (existsSync14(join17(process.cwd(), ".git"))) {
         const update = await pullProject(client, appId);
         console.log(JSON.stringify(update, null, 2));
         if (update.status === "blocked") throw new Error(update.reason);
@@ -23549,21 +23717,22 @@ async function main() {
       } else if (args[0] === "install") {
         const version = option("--version"), sha256 = option("--sha256");
         if (!version || !sha256) throw new Error("Use backify runtime install --version vX.Y.Z --sha256 <reviewed-digest> [--archive <local-zip>]");
-        const bytes = option("--archive") ? readFileSync24(option("--archive")) : await downloadLocalRuntime(version);
+        const bytes = option("--archive") ? readFileSync23(option("--archive")) : await downloadLocalRuntime(version);
         console.log(JSON.stringify(installLocalRuntime(bytes, { version, sha256 }), null, 2));
       } else throw new Error("Use backify runtime install or backify runtime doctor");
       break;
     }
     case "ship": {
+      if (args.includes("--production-deploy") && args.includes("--preview-only")) throw new Error("--production-deploy cannot be combined with --preview-only.");
       const timeout = Number(option("--timeout") ?? "1200");
       if (!Number.isFinite(timeout) || timeout < 1 || timeout > 7200) throw new Error("--timeout must be between 1 and 7200 seconds.");
-      console.log(JSON.stringify(await ship(call, projectApplication(), { previewOnly: args.includes("--preview-only"), timeoutMs: timeout * 1e3 }), null, 2));
+      console.log(JSON.stringify(await ship(call, projectApplication(), { productionDeploy: args.includes("--production-deploy"), previewOnly: args.includes("--preview-only"), timeoutMs: timeout * 1e3 }), null, 2));
       break;
     }
     case "request": {
       const workspaceId = option("--workspace"), name2 = option("--name"), slug = option("--slug"), description = option("--description"), configurationFile = option("--configuration");
       if (!workspaceId || !name2 || !slug || !description) throw new Error("Use backify request --workspace <id> --name <name> --slug <slug> --description <purpose> [--configuration <json-file>]");
-      const configuration = configurationFile ? JSON.parse(readFileSync24(configurationFile, "utf8")) : void 0;
+      const configuration = configurationFile ? JSON.parse(readFileSync23(configurationFile, "utf8")) : void 0;
       console.log(await call("/apps/requests", { method: "POST", body: JSON.stringify({ workspaceId, name: name2, slug, description, configuration }) }));
       break;
     }
@@ -23581,7 +23750,7 @@ async function main() {
       else if (args[0] === "test") {
         const name2 = option("--name"), payload = option("--payload");
         if (!name2 || !payload) throw new Error("Specify --name and --payload <json-file>. Never include secrets in event payloads.");
-        console.log(JSON.stringify(await call(path + "/test", { method: "POST", body: JSON.stringify({ name: name2, payload: JSON.parse(readFileSync24(payload, "utf8")), idempotencyKey: option("--idempotency-key") }) }), null, 2));
+        console.log(JSON.stringify(await call(path + "/test", { method: "POST", body: JSON.stringify({ name: name2, payload: JSON.parse(readFileSync23(payload, "utf8")), idempotencyKey: option("--idempotency-key") }) }), null, 2));
       } else throw new Error("Use backify events environments|inspect|test");
       break;
     }
@@ -23592,7 +23761,7 @@ async function main() {
       console.log(await call("/apps/" + applicationGuid(args[0]) + "/deployments/preview", { method: "POST", body: JSON.stringify({ sourceRevision: args[1] ?? "latest" }) }));
       break;
     default:
-      console.log("backify connect | init | doctor | sync | login | logout | disconnect | status | dev | secrets local init|set|list --key-file <external-file> | test --json | inspect tables|rows|buckets|objects|preview|events --local [--json] | identity users|issue|clear --local [--json] | jobs | pull | report [--check] | prompt record --stdin --id <UUID> | ship [--preview-only] | request | events environments|inspect|test | workload plan|package|artifact-plan|trust-state|trust-sync|provenance capture|verify | apps | deploy");
+      console.log("backify connect | init | doctor | sync | login | logout | disconnect | status | dev | secrets local init|set|list --key-file <external-file> | test --json | inspect tables|rows|buckets|objects|preview|events --local [--json] | identity users|issue|clear --local [--json] | jobs | pull | report [--check] | prompt record --stdin --id <UUID> | ship [--production-deploy] | request | events environments|inspect|test | integrations list|catalog|search|describe|contract|types | workload plan|package|artifact-plan|trust-state|trust-sync|provenance capture|verify | apps | deploy");
   }
 }
 main().catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backifydev/cli",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Command-line setup and diagnostics for Backify applications",
   "type": "module",
   "bin": {