@haakco/hostingctl 1.0.333 → 1.0.343

package/dist/main.js

@@ -4793,6 +4793,22 @@ function hostingApplicationCachePurge(options) {
 	}));
 }
 /**
+* {@link /c/:company/hosting/environments/:environmentUuid/applications/:workloadUuid/version}
+*/
+function hostingApplicationsVersion(options) {
+	const { client: request = client, ...config } = options;
+	return withUnwrap(request({
+		method: "PUT",
+		url: "/c/{company}/hosting/environments/{environmentUuid}/applications/{workloadUuid}/version",
+		security: [{
+			type: "http",
+			scheme: "bearer"
+		}],
+		...config,
+		throwOnError: config.throwOnError ?? true
+	}));
+}
+/**
 * {@link /c/:company/hosting/environments/:environmentUuid/applications/:workloadUuid/recovery}
 */
 function hostingApplicationRecoveryShow(options) {
@@ -5961,6 +5977,22 @@ function hostingEnvironmentsProfile(options) {
 	}));
 }
 /**
+* {@link /c/:company/hosting/environments/:environmentUuid/references}
+*/
+function hostingEnvironmentsReferences(options) {
+	const { client: request = client, ...config } = options;
+	return withUnwrap(request({
+		method: "GET",
+		url: "/c/{company}/hosting/environments/{environmentUuid}/references",
+		security: [{
+			type: "http",
+			scheme: "bearer"
+		}],
+		...config,
+		throwOnError: config.throwOnError ?? true
+	}));
+}
+/**
 * {@link /c/:company/hosting/environments/:environmentUuid/secret-connections}
 */
 function hostingExternalSecretIndex(options) {
@@ -8363,7 +8395,7 @@ function yahooFeedbackUpdate(options) {
 }
 //#endregion
 //#region src/commands/auth-account.ts
-var USAGE$48 = [
+var USAGE$50 = [
 	"Usage: hostingctl auth closure show",
 	"       hostingctl auth closure request --reason <text> (--current-password-file <path>|--current-password-stdin)",
 	"       hostingctl auth picture set --image-file <path>",
@@ -8387,26 +8419,26 @@ async function account$1(context, subcommand, rest) {
 	if (subcommand === "closure") return await closure(context, action, tail);
 	if (subcommand === "picture") return await picture(context, action, tail);
 	if (subcommand === "notifications") return await notifications(context, action, tail);
-	throw new UsageError(USAGE$48);
+	throw new UsageError(USAGE$50);
 }
 /** `auth closure show|request`. */
 async function closure(context, action, tail) {
-	if (tail.length > 0) throw new UsageError(USAGE$48);
+	if (tail.length > 0) throw new UsageError(USAGE$50);
 	if (action === "show") return (await accountClosureShow({})).data;
 	if (action === "request") return await closeAccount(context);
-	throw new UsageError(USAGE$48);
+	throw new UsageError(USAGE$50);
 }
 /** `auth picture set|remove`. */
 async function picture(context, action, tail) {
-	if (tail.length > 0) throw new UsageError(USAGE$48);
+	if (tail.length > 0) throw new UsageError(USAGE$50);
 	if (action === "set") return await setPicture(context);
 	if (action === "remove") return await removePicture(context);
-	throw new UsageError(USAGE$48);
+	throw new UsageError(USAGE$50);
 }
 /** `auth notifications`, `read <id>` or `read-all`. */
 async function notifications(context, action, tail) {
 	if (action === void 0) {
-		if (tail.length > 0) throw new UsageError(USAGE$48);
+		if (tail.length > 0) throw new UsageError(USAGE$50);
 		return await allPages(async (page, perPage) => {
 			const answer = await notificationIndex({ query: {
 				page,
@@ -8422,7 +8454,7 @@ async function notifications(context, action, tail) {
 		await notificationMarkAllRead({});
 		return null;
 	});
-	if (action !== "read" || tail.length !== 1) throw new UsageError(USAGE$48);
+	if (action !== "read" || tail.length !== 1) throw new UsageError(USAGE$50);
 	const notification = tail[0] ?? "";
 	return await confirmableWrite(context, `Mark notification ${notification} read.`, async () => {
 		await notificationMarkRead({ path: { notification } });
@@ -8438,11 +8470,11 @@ async function notifications(context, action, tail) {
 */
 async function closeAccount(context) {
 	const reason = context.flags.get("--reason")?.trim() ?? "";
-	if (reason === "") throw new UsageError(`closure request needs --reason.\n\n${USAGE$48}`);
+	if (reason === "") throw new UsageError(`closure request needs --reason.\n\n${USAGE$50}`);
 	return await confirmableWrite(context, ["Close this account, which removes the data the review lists and keeps what it lists as retained.", "  The review is re-read first, so the digest sent is the one you are shown now."].join("\n"), async () => {
 		const review = (await accountClosureShow({})).data;
 		if (review.blockingReasons.length > 0) throw new UsageError(["This account cannot be closed while these reasons block it:", ...review.blockingReasons.map((one) => `  ${one.companySlug} (${one.role}): ${one.reason}`)].join("\n"));
-		const currentPassword = readSecret(context, "current-password", 1024, USAGE$48);
+		const currentPassword = readSecret(context, "current-password", 1024, USAGE$50);
 		return (await accountClosureStore({ body: {
 			reason,
 			reviewedDigest: review.digest,
@@ -8454,7 +8486,7 @@ async function closeAccount(context) {
 async function setPicture(context) {
 	const file = context.flags.get("--image-file") ?? "";
 	return await confirmableWrite(context, file === "" ? "Set the profile picture." : `Set the profile picture to ${file}.`, async () => {
-		return (await profilePictureStore({ body: await imageUpload(file, USAGE$48) })).data;
+		return (await profilePictureStore({ body: await imageUpload(file, USAGE$50) })).data;
 	});
 }
 /** `auth picture remove`. */
@@ -8465,7 +8497,7 @@ async function removePicture(context) {
 }
 //#endregion
 //#region src/commands/auth-identity.ts
-var USAGE$47 = [
+var USAGE$49 = [
 	"Usage: hostingctl auth profile [--name <name>] [--email <email>] [--current-password-file <path>]",
 	"       hostingctl auth password (--current-password-file <path>|--current-password-stdin) (--new-password-file <path>|--new-password-stdin)",
 	"       hostingctl auth register --name <name> --email <email> (--password-file <path>|--password-stdin)",
@@ -8490,12 +8522,12 @@ var MAX_TOKEN_BYTES = 4096;
 /** One required flag's value, or a refusal naming the flag. */
 function required$3(context, flag) {
 	const value = context.flags.get(flag)?.trim() ?? "";
-	if (value === "") throw new UsageError(`${flag} is required.\n\n${USAGE$47}`);
+	if (value === "") throw new UsageError(`${flag} is required.\n\n${USAGE$49}`);
 	return value;
 }
 /** No positional arguments: every input here is a flag or a secret source. */
 function noPositional(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$47);
+	if (rest.length > 0) throw new UsageError(USAGE$49);
 }
 /** The API's password contract takes a confirmation; the CLI's one input is the new password itself. */
 function passwordBody(password) {
@@ -8518,16 +8550,16 @@ async function identity(context, subcommand, rest) {
 	if (subcommand === "forgot-password") return await forgotPassword(context);
 	if (subcommand === "reset-password") return await resetPassword(context);
 	if (subcommand === "verify-email") return await verifyEmail(context);
-	throw new UsageError(USAGE$47);
+	throw new UsageError(USAGE$49);
 }
 /** `auth profile`: the account's own name and email, with the current password only when the email changes. */
 async function profile$1(context) {
 	const name = context.flags.get("--name")?.trim() ?? "";
 	const email = context.flags.get("--email")?.trim() ?? "";
-	if (name === "" && email === "" && !context.flags.has("--current-password-file") && !context.flags.has("--current-password-stdin")) throw new UsageError(`Pass --name, --email, or both.\n\n${USAGE$47}`);
+	if (name === "" && email === "" && !context.flags.has("--current-password-file") && !context.flags.has("--current-password-stdin")) throw new UsageError(`Pass --name, --email, or both.\n\n${USAGE$49}`);
 	return await confirmableWrite(context, `Update the account's ${[name === "" ? null : `name to "${name}"`, email === "" ? null : `email to ${email}`].filter((one) => one !== null).join(" and ")}.`, async () => {
 		const current = (await authMe({})).data;
-		const currentPassword = hasSecret(context, "current-password") ? readSecret(context, "current-password", MAX_PASSWORD_BYTES, USAGE$47) : void 0;
+		const currentPassword = hasSecret(context, "current-password") ? readSecret(context, "current-password", MAX_PASSWORD_BYTES, USAGE$49) : void 0;
 		return (await authUpdateProfile({ body: {
 			name: name === "" ? current.name ?? "" : name,
 			email: email === "" ? current.email ?? "" : email,
@@ -8543,8 +8575,8 @@ function hasSecret(context, name) {
 async function password$1(context) {
 	return await confirmableWrite(context, "Change the account's password.", async () => {
 		return (await authChangePassword({ body: {
-			currentPassword: readSecret(context, "current-password", MAX_PASSWORD_BYTES, USAGE$47),
-			...passwordBody(readSecret(context, "new-password", MAX_PASSWORD_BYTES, USAGE$47))
+			currentPassword: readSecret(context, "current-password", MAX_PASSWORD_BYTES, USAGE$49),
+			...passwordBody(readSecret(context, "new-password", MAX_PASSWORD_BYTES, USAGE$49))
 		} })).data;
 	});
 }
@@ -8556,7 +8588,7 @@ async function register$1(context) {
 		return (await authRegister({ body: {
 			name,
 			email,
-			...passwordBody(readSecret(context, "password", MAX_PASSWORD_BYTES, USAGE$47))
+			...passwordBody(readSecret(context, "password", MAX_PASSWORD_BYTES, USAGE$49))
 		} })).data;
 	});
 }
@@ -8571,8 +8603,8 @@ async function forgotPassword(context) {
 async function resetPassword(context) {
 	const email = required$3(context, "--email");
 	return await confirmableWrite(context, `Reset the password for ${email}.`, async () => {
-		const token = readSecret(context, "token", MAX_TOKEN_BYTES, USAGE$47);
-		const password = readSecret(context, "password", MAX_PASSWORD_BYTES, USAGE$47);
+		const token = readSecret(context, "token", MAX_TOKEN_BYTES, USAGE$49);
+		const password = readSecret(context, "password", MAX_PASSWORD_BYTES, USAGE$49);
 		return (await authResetPassword({ body: {
 			token,
 			email,
@@ -8588,7 +8620,7 @@ async function verifyEmail(context) {
 }
 //#endregion
 //#region src/commands/auth-impersonation.ts
-var USAGE$46 = [
+var USAGE$48 = [
 	"Usage: hostingctl auth impersonate start --target <user-uuid> --company <slug> --reason <text> [--minutes <n>] --store-as <profile>",
 	"       hostingctl auth impersonate status",
 	"       hostingctl auth impersonate stop",
@@ -8621,7 +8653,7 @@ async function impersonation(context, rest) {
 	if (action === "stop" && tail.length === 0) return await stop(context);
 	if (action === "list" && tail.length === 0) return await list$5();
 	if (action === "end" && tail.length === 1) return await end(context, tail[0] ?? "");
-	throw new UsageError(USAGE$46);
+	throw new UsageError(USAGE$48);
 }
 /** `start`: mint a token for another user, and keep it in a profile of its own. */
 async function start(context) {
@@ -8629,8 +8661,8 @@ async function start(context) {
 	const company = context.flags.get("--company")?.trim() ?? "";
 	const reason = context.flags.get("--reason")?.trim() ?? "";
 	const storeAs = context.flags.get("--store-as")?.trim() ?? "";
-	if (target === "" || company === "" || reason === "") throw new UsageError(`start needs --target, --company and --reason.\n\n${USAGE$46}`);
-	if (storeAs === "") throw new UsageError(`start needs --store-as <profile>.\n\n${USAGE$46}`);
+	if (target === "" || company === "" || reason === "") throw new UsageError(`start needs --target, --company and --reason.\n\n${USAGE$48}`);
+	if (storeAs === "") throw new UsageError(`start needs --store-as <profile>.\n\n${USAGE$48}`);
 	const minutes = wholeNumberFlag(context.flags, "--minutes") ?? DEFAULT_MINUTES;
 	const document = await readProfiles();
 	const operator = namedProfile(context.flags, document);
@@ -8643,8 +8675,9 @@ async function start(context) {
 			expiresInMinutes: minutes
 		} })).data;
 		const expiresAt = new Date(Date.now() + answered.expiresIn * 1e3);
+		const namedApiUrl = (context.flags.get("--api-url") ?? process.env.HOSTINGCTL_API_URL ?? "").trim();
 		await saveProfile({
-			apiUrl: document.profiles[operator]?.apiUrl ?? "",
+			apiUrl: namedApiUrl !== "" ? namedApiUrl : document.profiles[operator]?.apiUrl ?? "",
 			clientId: "",
 			refreshToken: "",
 			accessToken: answered.accessToken,
@@ -8723,7 +8756,7 @@ async function list$5() {
 }
 /** `end <uuid>`: end one recorded session by its uuid. */
 async function end(context, uuid) {
-	if (uuid === "") throw new UsageError(USAGE$46);
+	if (uuid === "") throw new UsageError(USAGE$48);
 	return await confirmableWrite(context, `End impersonation session ${uuid}.`, async () => ({
 		...EMPTY,
 		action: "end",
@@ -8732,7 +8765,7 @@ async function end(context, uuid) {
 }
 //#endregion
 //#region src/commands/auth-push.ts
-var USAGE$45 = [
+var USAGE$47 = [
 	"Usage: hostingctl auth push-token set (--token-file <path>|--token-stdin)",
 	"       hostingctl auth push-token remove (--token-file <path>|--token-stdin)",
 	"",
@@ -8743,12 +8776,12 @@ var USAGE$45 = [
 /** `auth push-token set|remove`: this account's mobile push registration. */
 async function authPush(context, rest) {
 	const [action, ...tail] = rest;
-	if (tail.length > 0) throw new UsageError(USAGE$45);
+	if (tail.length > 0) throw new UsageError(USAGE$47);
 	if (action === "set") return {
 		kind: "push-token",
 		action: "set",
 		sent: (await confirmableWrite(context, "Register this device's push token.", async () => {
-			await expoTokenStore({ body: { token: readSecret(context, "token", 4096, USAGE$45) } });
+			await expoTokenStore({ body: { token: readSecret(context, "token", 4096, USAGE$47) } });
 			return null;
 		})).sent
 	};
@@ -8756,11 +8789,11 @@ async function authPush(context, rest) {
 		kind: "push-token",
 		action: "remove",
 		sent: (await confirmableWrite(context, "Remove this device's push token.", async () => {
-			await expoTokenDestroy({ query: { token: readSecret(context, "token", 4096, USAGE$45) } });
+			await expoTokenDestroy({ query: { token: readSecret(context, "token", 4096, USAGE$47) } });
 			return null;
 		})).sent
 	};
-	throw new UsageError(USAGE$45);
+	throw new UsageError(USAGE$47);
 }
 /** The `auth push-token` renderer. */
 function authPushText(report) {
@@ -8911,47 +8944,47 @@ var AUTH_METADATA = {
 var AUTH_TOPICS = [
 	{
 		path: ["profile"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["password"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["register"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["forgot-password"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["reset-password"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["verify-email"],
-		usage: USAGE$47
+		usage: USAGE$49
 	},
 	{
 		path: ["closure"],
-		usage: USAGE$48
+		usage: USAGE$50
 	},
 	{
 		path: ["picture"],
-		usage: USAGE$48
+		usage: USAGE$50
 	},
 	{
 		path: ["notifications"],
-		usage: USAGE$48
+		usage: USAGE$50
 	},
 	{
 		path: ["push-token"],
-		usage: USAGE$45
+		usage: USAGE$47
 	},
 	{
 		path: ["impersonate"],
-		usage: USAGE$46
+		usage: USAGE$48
 	}
 ];
 //#endregion
@@ -9484,7 +9517,7 @@ var MAILBOX_TOPICS = [{
 }];
 //#endregion
 //#region src/commands/mailbox-recovery.ts
-var USAGE$44 = [
+var USAGE$46 = [
 	"Usage: hostingctl mailbox recovery <request|verify|reset> [options]",
 	"",
 	"  request --address <address>            Ask for a self-service reset link for a mailbox address.",
@@ -9512,16 +9545,16 @@ function isSessionlessMailboxCommand(argv) {
 /** `mailbox recovery request|verify|reset`: the unauthenticated, token-authorized recovery journey. */
 async function runMailboxRecovery(context, rest) {
 	const [action, extra] = rest;
-	if (extra !== void 0) throw new UsageError(USAGE$44);
+	if (extra !== void 0) throw new UsageError(USAGE$46);
 	if (action === "request") return await request$1(context);
 	if (action === "verify") return await verify$1(context);
 	if (action === "reset") return await reset(context);
-	throw new UsageError(USAGE$44);
+	throw new UsageError(USAGE$46);
 }
 /** `request`: the answer is deliberately identical whether or not an eligible mailbox exists. */
 async function request$1(context) {
 	const address = context.flags.get("--address");
-	if (address === void 0 || address === "") throw new UsageError(USAGE$44);
+	if (address === void 0 || address === "") throw new UsageError(USAGE$46);
 	return await confirmableWrite(context, `Request a mailbox recovery link for ${address}. The answer is the same for an unknown mailbox, one with no confirmed fallback, and an eligible one.`, async () => (await emailMailboxRecoveryRequest({ body: { address } })).data);
 }
 /** `verify`: the token is read only when the send actually happens, so a dry run never touches a secret. */
@@ -9542,7 +9575,7 @@ async function reset(context) {
 }
 /** One recovery token or new password, read from a private file or stdin under the recovery bound. */
 function recoverySecret(context, name) {
-	return readSecret(context, name, MAX_RECOVERY_SECRET_BYTES, USAGE$44);
+	return readSecret(context, name, MAX_RECOVERY_SECRET_BYTES, USAGE$46);
 }
 //#endregion
 //#region src/commands/mailbox.ts
@@ -9678,7 +9711,7 @@ async function environmentGeneration(path) {
 //#endregion
 //#region src/commands/access-credentials.ts
 /** The usage this module refuses with, owned by the commands it implements. */
-var USAGE$43 = [
+var USAGE$45 = [
 	"Usage: hostingctl access key add <environment-uuid> --company <slug> --access-user <uuid> --name <n> --public-key-file <path>",
 	"       hostingctl access key remove <environment-uuid> --company <slug> --access-user <uuid> <key-uuid>",
 	"       hostingctl access password set <environment-uuid> --company <slug> --access-user <uuid> (--password-file <path>|--password-stdin)",
@@ -9696,12 +9729,12 @@ var USAGE$43 = [
 /** `key add|remove`. */
 async function key(context, path, action, tail) {
 	const accessUserUuid = context.flags.get("--access-user") ?? "";
-	if (accessUserUuid === "") throw new UsageError(`key needs --access-user.\\n\\n${USAGE$43}`);
+	if (accessUserUuid === "") throw new UsageError(`key needs --access-user.\\n\\n${USAGE$45}`);
 	if (action === "add") {
-		if (tail.length > 0) throw new UsageError(USAGE$43);
+		if (tail.length > 0) throw new UsageError(USAGE$45);
 		const name = context.flags.get("--name")?.trim() ?? "";
 		const file = context.flags.get("--public-key-file") ?? "";
-		if (name === "" || file === "") throw new UsageError(`key add needs --name and --public-key-file.\\n\\n${USAGE$43}`);
+		if (name === "" || file === "") throw new UsageError(`key add needs --name and --public-key-file.\\n\\n${USAGE$45}`);
 		const publicKey = readPrivateFile(file, "public key", 8192).trim();
 		return await confirmableWrite(context, `Add key "${name}" to login ${accessUserUuid}.`, async () => {
 			const body = {
@@ -9720,7 +9753,7 @@ async function key(context, path, action, tail) {
 	}
 	if (action === "remove") {
 		const [keyUuid, ...extra] = tail;
-		if (keyUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$43);
+		if (keyUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$45);
 		return await confirmableWrite(context, `Remove key ${keyUuid} from login ${accessUserUuid}.`, async () => {
 			return (await hostingAccessDestroyKey({
 				path: {
@@ -9732,18 +9765,18 @@ async function key(context, path, action, tail) {
 			})).data;
 		});
 	}
-	throw new UsageError(USAGE$43);
+	throw new UsageError(USAGE$45);
 }
 /** `password set|clear`. */
 async function password(context, path, action, tail) {
 	const accessUserUuid = context.flags.get("--access-user") ?? "";
-	if (accessUserUuid === "" || tail.length > 0) throw new UsageError(`password needs --access-user.\\n\\n${USAGE$43}`);
+	if (accessUserUuid === "" || tail.length > 0) throw new UsageError(`password needs --access-user.\\n\\n${USAGE$45}`);
 	const userPath = {
 		...path,
 		accessUserUuid
 	};
 	if (action === "set") return await confirmableWrite(context, "Set this login's password. The previous password stops working when the change is applied.", async () => {
-		const password = readSecret(context, "password", 1024, USAGE$43);
+		const password = readSecret(context, "password", 1024, USAGE$45);
 		const body = {
 			desiredGeneration: await environmentGeneration(path),
 			password,
@@ -9761,7 +9794,7 @@ async function password(context, path, action, tail) {
 			query
 		})).data;
 	});
-	throw new UsageError(USAGE$43);
+	throw new UsageError(USAGE$45);
 }
 //#endregion
 //#region src/commands/booleans.ts
@@ -9786,7 +9819,7 @@ function onOff$5(context, flag, usage) {
 }
 //#endregion
 //#region src/commands/access-admin.ts
-var USAGE$42 = [
+var USAGE$44 = [
 	"Usage: hostingctl access settings <environment-uuid> --company <slug>",
 	"       hostingctl access settings-set <environment-uuid> --company <slug> --password <on|off> --sftp-only <on|off>",
 	"       hostingctl access grants <environment-uuid> --company <slug>",
@@ -9814,7 +9847,7 @@ var USAGE$42 = [
 /** `access settings|settings-set|grants|grant|un-grant|key|password|user-show|user-set|received`. */
 async function accessAdmin(context, subcommand, rest) {
 	if (subcommand === "received") {
-		if (rest.length > 0) throw new UsageError(USAGE$42);
+		if (rest.length > 0) throw new UsageError(USAGE$44);
 		return {
 			kind: "received",
 			grants: (await hostingAccessReceivedIndex({})).data.items
@@ -9822,7 +9855,7 @@ async function accessAdmin(context, subcommand, rest) {
 	}
 	const [first, ...after] = rest;
 	const takesAction = subcommand === "key" || subcommand === "password";
-	const path = await environmentPath(context, takesAction ? after[0] : first, USAGE$42);
+	const path = await environmentPath(context, takesAction ? after[0] : first, USAGE$44);
 	const tail = takesAction ? after.slice(1) : after;
 	return await routed(context, subcommand, path, first ?? "", tail);
 }
@@ -9837,7 +9870,7 @@ async function routed(context, subcommand, path, action, tail) {
 	if (subcommand === "password") return await written$7(password(context, path, action, tail));
 	if (subcommand === "user-show") return await userShow(path, tail);
 	if (subcommand === "user-set") return await written$7(userSet(context, path, tail));
-	throw new UsageError(USAGE$42);
+	throw new UsageError(USAGE$44);
 }
 /** Tag one write's outcome with the group that produced it. */
 async function written$7(pending) {
@@ -9848,7 +9881,7 @@ async function written$7(pending) {
 }
 /** A company-wide read takes no positionals. */
 function noExtra$18(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$42);
+	if (rest.length > 0) throw new UsageError(USAGE$44);
 }
 /** `settings`. */
 async function settings$1(path, rest) {
@@ -9861,8 +9894,8 @@ async function settings$1(path, rest) {
 /** `settings-set --password … --sftp-only …`. */
 async function settingsSet(context, path, rest) {
 	noExtra$18(rest);
-	const passwordEnabled = onOff$5(context, "--password", USAGE$42);
-	const sftpOnly = onOff$5(context, "--sftp-only", USAGE$42);
+	const passwordEnabled = onOff$5(context, "--password", USAGE$44);
+	const sftpOnly = onOff$5(context, "--sftp-only", USAGE$44);
 	return await confirmableWrite(context, [`Set password sign-in ${passwordEnabled ? "on" : "off"} and SFTP-only ${sftpOnly ? "on" : "off"}.`, "  Logins keep their keys either way; this changes how a login may authenticate."].join("\\n"), async () => {
 		return (await hostingAccessUpdate({
 			path,
@@ -9887,7 +9920,7 @@ async function grant(context, path, rest) {
 	noExtra$18(rest);
 	const userUuid = context.flags.get("--user") ?? "";
 	const accessUserUuid = context.flags.get("--access-user") ?? "";
-	if (userUuid === "" || accessUserUuid === "") throw new UsageError(`grant needs --user and --access-user.\\n\\n${USAGE$42}`);
+	if (userUuid === "" || accessUserUuid === "") throw new UsageError(`grant needs --user and --access-user.\\n\\n${USAGE$44}`);
 	return await confirmableWrite(context, `Grant user ${userUuid} the login ${accessUserUuid} on this environment.`, async () => {
 		return (await hostingAccessGrantStore({
 			path,
@@ -9902,7 +9935,7 @@ async function grant(context, path, rest) {
 /** `un-grant <grant-uuid>`. */
 async function unGrant(context, path, rest) {
 	const [grantUuid, ...extra] = rest;
-	if (grantUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$42);
+	if (grantUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$44);
 	return await confirmableWrite(context, `Withdraw grant ${grantUuid}. The login stays; only this account's access to it ends.`, async () => {
 		const query = { desiredGeneration: await environmentGeneration(path) };
 		return (await hostingAccessGrantDestroy({
@@ -9917,7 +9950,7 @@ async function unGrant(context, path, rest) {
 /** `user-show <access-user-uuid>`. */
 async function userShow(path, rest) {
 	const [accessUserUuid, ...extra] = rest;
-	if (accessUserUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$42);
+	if (accessUserUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$44);
 	return {
 		kind: "user",
 		user: (await hostingAccessShowUser({ path: {
@@ -9929,7 +9962,7 @@ async function userShow(path, rest) {
 /** `user-set <access-user-uuid> [--name] [--enabled] [--read-only]`. */
 async function userSet(context, path, rest) {
 	const [accessUserUuid, ...extra] = rest;
-	if (accessUserUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$42);
+	if (accessUserUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$44);
 	const userPath = {
 		...path,
 		accessUserUuid
@@ -9938,7 +9971,7 @@ async function userSet(context, path, rest) {
 	const name = context.flags.get("--name")?.trim();
 	const enabled = onOffFlag(context, "--enabled");
 	const readOnly = onOffFlag(context, "--read-only");
-	if (name === void 0 && enabled === null && readOnly === null) throw new UsageError(`user-set needs --name, --enabled, --read-only or a combination.\\n\\n${USAGE$42}`);
+	if (name === void 0 && enabled === null && readOnly === null) throw new UsageError(`user-set needs --name, --enabled, --read-only or a combination.\\n\\n${USAGE$44}`);
 	const body = {
 		desiredGeneration: await environmentGeneration(path),
 		name: name === void 0 || name === "" ? current.name : name,
@@ -10089,43 +10122,43 @@ var ACCESS_METADATA = {
 var ACCESS_TOPICS = [
 	{
 		path: ["settings"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["settings-set"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["grants"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["grant"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["un-grant"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["user-show"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["user-set"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["received"],
-		usage: USAGE$42
+		usage: USAGE$44
 	},
 	{
 		path: ["key"],
-		usage: USAGE$43
+		usage: USAGE$45
 	},
 	{
 		path: ["password"],
-		usage: USAGE$43
+		usage: USAGE$45
 	}
 ];
 //#endregion
@@ -10345,7 +10378,7 @@ var ADMIN_ACTIONS = /* @__PURE__ */ new Set([
 ]);
 //#endregion
 //#region src/commands/application-admin.ts
-var USAGE$41 = [
+var USAGE$43 = [
 	"Usage: hostingctl application administrator <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application administrator-reset|administrator-reveal <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application recovery-status|recovery-retry|recovery-cancel <environment-uuid> <application-uuid> <recovery-uuid> --company <slug>",
@@ -10372,7 +10405,7 @@ async function applicationAdmin(context, action, path, rest) {
 	if (action === "administrator-reset") return await credential(context, path, rest, "reset");
 	if (action === "administrator-reveal") return await credential(context, path, rest, "reveal");
 	const [recoveryUuid, ...extra] = rest;
-	if (recoveryUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$41);
+	if (recoveryUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$43);
 	const recoveryPath = {
 		...path,
 		recoveryUuid
@@ -10385,7 +10418,7 @@ async function applicationAdmin(context, action, path, rest) {
 		return (await hostingApplicationRecoveryRetry({ path: recoveryPath })).data;
 	}));
 	if (action === "recovery-cancel") return await written$6(confirmableWrite(context, "Cancel this recovery. Writers are released and the application returns to its previous state.", async () => (await hostingApplicationRecoveryCancel({ path: recoveryPath })).data));
-	throw new UsageError(USAGE$41);
+	throw new UsageError(USAGE$43);
 }
 /** `administrator-reset|reveal`: the one place the application's own password is printed. */
 async function credential(context, path, rest, kind) {
@@ -10406,7 +10439,7 @@ async function written$6(pending) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$17(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$41);
+	if (rest.length > 0) throw new UsageError(USAGE$43);
 }
 /** One recovery as one line: what it is doing, how far, and what it holds. */
 function recoveryLines$1(one) {
@@ -10443,7 +10476,7 @@ function applicationAdminText(report) {
 }
 //#endregion
 //#region src/commands/application-builds.ts
-var USAGE$40 = [
+var USAGE$42 = [
 	"Usage: hostingctl application build-log <environment-uuid> <application-uuid> <build-uuid> --company <slug>",
 	"       hostingctl application build-retry|build-cancel <environment-uuid> <application-uuid> <build-uuid> --company <slug>",
 	"       hostingctl application source-bind <environment-uuid> <application-uuid> --company <slug> --selection <uuid> [--branch <name>] [--tag <name>] [--auto-deploy <on|off>]",
@@ -10466,7 +10499,7 @@ async function applicationBuilds(context, action, path, rest) {
 	}
 	if (action === "source-bind") return await bind$1(context, path, rest);
 	const [buildUuid, ...extra] = rest;
-	if (buildUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$40);
+	if (buildUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$42);
 	const buildPath = {
 		...path,
 		buildUuid
@@ -10481,13 +10514,13 @@ async function applicationBuilds(context, action, path, rest) {
 	if (action === "build-cancel") return await written$5(confirmableWrite(context, "Stop this build. A running build stops where it is.", async () => {
 		return (await hostingDeploymentCancel({ path: buildPath })).data;
 	}));
-	throw new UsageError(USAGE$40);
+	throw new UsageError(USAGE$42);
 }
 /** `source-bind --selection … [--branch …] [--tag …] [--auto-deploy …]`. */
 async function bind$1(context, path, rest) {
 	noExtra$16(rest);
 	const repositorySelectionUuid = context.flags.get("--selection") ?? "";
-	if (repositorySelectionUuid === "") throw new UsageError(`source-bind needs --selection.\n\n${USAGE$40}`);
+	if (repositorySelectionUuid === "") throw new UsageError(`source-bind needs --selection.\n\n${USAGE$42}`);
 	const branch = context.flags.get("--branch")?.trim();
 	const tag = context.flags.get("--tag")?.trim();
 	const autoDeploy = onOffFlag(context, "--auto-deploy");
@@ -10513,7 +10546,7 @@ async function written$5(pending) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$16(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$40);
+	if (rest.length > 0) throw new UsageError(USAGE$42);
 }
 /** The write receipt: a build's own fields, or the deployment's source. */
 function writeText$4(report) {
@@ -10542,7 +10575,7 @@ function applicationBuildText(report) {
 }
 //#endregion
 //#region src/commands/application-cache.ts
-var USAGE$39 = [
+var USAGE$41 = [
 	"Usage: hostingctl application cache <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application cache-set <environment-uuid> <application-uuid> --company <slug> [--enabled <on|off>] [--fresh <s>] [--background <s>] [--browser <s>] [--reset <on|off>]",
 	"       hostingctl application cache-purge <environment-uuid> <application-uuid> --company <slug>",
@@ -10578,7 +10611,7 @@ async function applicationCache(context, action, path, rest) {
 	})).data));
 	if (action === "canonical") {
 		const routeUuid = context.flags.get("--route") ?? "";
-		if (routeUuid === "") throw new UsageError(`canonical needs --route.\n\n${USAGE$39}`);
+		if (routeUuid === "") throw new UsageError(`canonical needs --route.\n\n${USAGE$41}`);
 		return await written$4(confirmableWrite(context, `Make route ${routeUuid} this application's canonical address.`, async () => {
 			const desiredGeneration = await generation$1(path);
 			return (await hostingApplicationRouteSelectCanonical({
@@ -10590,7 +10623,7 @@ async function applicationCache(context, action, path, rest) {
 			})).data;
 		}));
 	}
-	throw new UsageError(USAGE$39);
+	throw new UsageError(USAGE$41);
 }
 /** `application routes|route-add|route-remove`, which are environment-scoped. */
 async function applicationRoutes(context, action, path, rest) {
@@ -10604,7 +10637,7 @@ async function applicationRoutes(context, action, path, rest) {
 	if (action === "route-add") return await addRoute(context, path, rest);
 	if (action === "route-remove") {
 		const [routeUuid, ...extra] = rest;
-		if (routeUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$39);
+		if (routeUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$41);
 		return await written$4(confirmableWrite(context, `Remove route ${routeUuid}.`, async () => {
 			const body = { desiredGeneration: await generation$1(path) };
 			return (await hostingApplicationRouteRemove({
@@ -10616,7 +10649,7 @@ async function applicationRoutes(context, action, path, rest) {
 			})).data;
 		}));
 	}
-	throw new UsageError(USAGE$39);
+	throw new UsageError(USAGE$41);
 }
 /** `route-add --source … --target … --path …`. */
 async function addRoute(context, path, rest) {
@@ -10624,7 +10657,7 @@ async function addRoute(context, path, rest) {
 	const sourceWorkloadUuid = context.flags.get("--source") ?? "";
 	const targetWorkloadUuid = context.flags.get("--target") ?? "";
 	const routePath = context.flags.get("--path") ?? "";
-	if (sourceWorkloadUuid === "" || targetWorkloadUuid === "" || routePath === "") throw new UsageError(`route-add needs --source, --target and --path.\n\n${USAGE$39}`);
+	if (sourceWorkloadUuid === "" || targetWorkloadUuid === "" || routePath === "") throw new UsageError(`route-add needs --source, --target and --path.\n\n${USAGE$41}`);
 	const domainUuid = context.flags.get("--domain")?.trim();
 	const canonical = onOffFlag(context, "--canonical") ?? false;
 	return await written$4(confirmableWrite(context, `Route ${routePath} from ${sourceWorkloadUuid} to ${targetWorkloadUuid}${canonical ? " as canonical" : ""}.`, async () => {
@@ -10657,10 +10690,10 @@ function cacheBody(context) {
 		const raw = context.flags.get(flag)?.trim() ?? "";
 		if (raw === "") continue;
 		const value = Number(raw);
-		if (!Number.isInteger(value) || value < 0) throw new UsageError(`${flag} must be a whole number of seconds.\n\n${USAGE$39}`);
+		if (!Number.isInteger(value) || value < 0) throw new UsageError(`${flag} must be a whole number of seconds.\n\n${USAGE$41}`);
 		body[field] = value;
 	}
-	if (Object.keys(body).length === 0) throw new UsageError(`cache-set needs at least one field.\n\n${USAGE$39}`);
+	if (Object.keys(body).length === 0) throw new UsageError(`cache-set needs at least one field.\n\n${USAGE$41}`);
 	return body;
 }
 /** The environment's generation, which every write here must name. */
@@ -10676,7 +10709,7 @@ async function written$4(pending) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$15(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$39);
+	if (rest.length > 0) throw new UsageError(USAGE$41);
 }
 /** The `application cache*|routes|route-*` renderer. */
 function applicationCacheText(report) {
@@ -10701,7 +10734,7 @@ function routeLines(page) {
 }
 //#endregion
 //#region src/commands/application-create.ts
-var USAGE$38 = [
+var USAGE$40 = [
 	"Usage: hostingctl application create <environment-uuid> --company <slug> --type <wordpress|moodle> --name <name>",
 	"         --cpu-request <millicores> --cpu-limit <millicores> --memory-request <MiB> --memory-limit <MiB>",
 	"         [--replicas <count>] [--label <text>] [--hostname <host>]",
@@ -10719,11 +10752,11 @@ var USAGE$38 = [
 var TYPES = /* @__PURE__ */ new Set(["wordpress", "moodle"]);
 /** `application create <env> …`, from the `application` command. */
 async function applicationCreate(context, path, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$38);
+	if (rest.length > 0) throw new UsageError(USAGE$40);
 	const type = context.flags.get("--type")?.trim().toLowerCase() ?? "";
-	if (!TYPES.has(type)) throw new UsageError(`create needs --type wordpress or moodle.\n\n${USAGE$38}`);
+	if (!TYPES.has(type)) throw new UsageError(`create needs --type wordpress or moodle.\n\n${USAGE$40}`);
 	const name = context.flags.get("--name")?.trim() ?? "";
-	if (name === "") throw new UsageError(`create needs --name.\n\n${USAGE$38}`);
+	if (name === "") throw new UsageError(`create needs --name.\n\n${USAGE$40}`);
 	const resources = {
 		cpuRequestMillicores: required$2(context, "--cpu-request"),
 		cpuLimitMillicores: required$2(context, "--cpu-limit"),
@@ -10757,7 +10790,7 @@ async function applicationCreate(context, path, rest) {
 /** One required whole-number flag, or a usage refusal naming the flag. */
 function required$2(context, flag) {
 	const value = wholeNumberFlag(context.flags, flag);
-	if (value === null) throw new UsageError(`create needs ${flag}.\n\n${USAGE$38}`);
+	if (value === null) throw new UsageError(`create needs ${flag}.\n\n${USAGE$40}`);
 	return value;
 }
 //#endregion
@@ -10787,7 +10820,7 @@ function requiredFlag$2(context, flag, usage) {
 }
 //#endregion
 //#region src/commands/application-upload.ts
-var USAGE$37 = [
+var USAGE$39 = [
 	"Usage: hostingctl application import-upload <environment-uuid> <application-uuid> --company <slug>",
 	"         --database <path-to.sql> [--archive <path-to.zip> | --directory <dir>]",
 	"",
@@ -10803,11 +10836,11 @@ var USAGE$37 = [
 ].join("\n");
 /** `application import-upload`, which stages a client site for review. */
 async function applicationUpload(context, path, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$37);
-	const database = requiredFlag$2(context, "--database", USAGE$37);
+	if (rest.length > 0) throw new UsageError(USAGE$39);
+	const database = requiredFlag$2(context, "--database", USAGE$39);
 	const archive = context.flags.get("--archive")?.trim() ?? "";
 	const directory = context.flags.get("--directory")?.trim() ?? "";
-	if (archive !== "" && directory !== "") throw new UsageError(`Send the site files as either --archive or --directory, not both.\n\n${USAGE$37}`);
+	if (archive !== "" && directory !== "") throw new UsageError(`Send the site files as either --archive or --directory, not both.\n\n${USAGE$39}`);
 	const databaseBytes = await sizeOf(database, "database");
 	const files = directory === "" ? [] : await manifestOf(directory);
 	const fileBytes = directory === "" ? 0 : await totalSize(files);
@@ -10885,7 +10918,7 @@ function describe(bytes) {
 }
 //#endregion
 //#region src/commands/application-import.ts
-var USAGE$36 = [
+var USAGE$38 = [
 	"Usage: hostingctl application import <environment-uuid> <application-uuid> <import-uuid> --company <slug>",
 	"       hostingctl application import-upload <environment-uuid> <application-uuid> --company <slug>",
 	"         --database <path-to.sql> [--archive <path-to.zip> | --directory <dir>]",
@@ -10907,7 +10940,7 @@ async function applicationImport(context, action, path, rest) {
 	if (action === "url-repair-preview") return await previewRepair(context, path, rest);
 	if (action === "import-upload") return await applicationUpload(context, path, rest);
 	const [importUuid, ...extra] = rest;
-	if (importUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$36);
+	if (importUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$38);
 	if (action === "import") return {
 		kind: "import",
 		staged: (await hostingWordpressImportShowImport({ path: {
@@ -10920,13 +10953,13 @@ async function applicationImport(context, action, path, rest) {
 		importUuid
 	} })).data));
 	if (action === "url-repair-confirm") return await confirmRepair(context, path, importUuid);
-	throw new UsageError(USAGE$36);
+	throw new UsageError(USAGE$38);
 }
 /** `url-repair-preview --source-url …`: the review a confirmation is made against. */
 async function previewRepair(context, path, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$36);
+	if (rest.length > 0) throw new UsageError(USAGE$38);
 	const sourceUrl = context.flags.get("--source-url")?.trim() ?? "";
-	if (sourceUrl === "") throw new UsageError(`url-repair-preview needs --source-url.\n\n${USAGE$36}`);
+	if (sourceUrl === "") throw new UsageError(`url-repair-preview needs --source-url.\n\n${USAGE$38}`);
 	return {
 		kind: "url-repair",
 		recovery: (await hostingWordpressUrlRepairPreview({
@@ -10938,7 +10971,7 @@ async function previewRepair(context, path, rest) {
 /** `url-repair-confirm <recovery> --confirmation …`: the typed text the review asked for. */
 async function confirmRepair(context, path, recoveryUuid) {
 	const confirmation = context.flags.get("--confirmation")?.trim() ?? "";
-	if (confirmation === "") throw new UsageError(`url-repair-confirm needs --confirmation.\n\n${USAGE$36}`);
+	if (confirmation === "") throw new UsageError(`url-repair-confirm needs --confirmation.\n\n${USAGE$38}`);
 	return await written$3(confirmableWrite(context, `Confirm the URL repair by typing its confirmation ("${confirmation}").`, async () => {
 		const desiredGeneration = (await hostingEnvironmentShow({ path })).data.desiredGeneration;
 		const body = {
@@ -10989,7 +11022,7 @@ function recoveryLines(one) {
 }
 //#endregion
 //#region src/commands/application-recovery.ts
-var USAGE$35 = [
+var USAGE$37 = [
 	"Usage: hostingctl application recovery-review <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application recovery-confirm <environment-uuid> <application-uuid> --company <slug> --confirmation <text>",
 	"",
@@ -11005,16 +11038,16 @@ var USAGE$35 = [
 ].join("\n");
 /** `application recovery-review|recovery-confirm`. */
 async function applicationRecovery(context, action, path, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$35);
+	if (rest.length > 0) throw new UsageError(USAGE$37);
 	const review = (await hostingApplicationRecoveryShow({ path })).data;
 	if (action === "recovery-review") return {
 		kind: "recovery-review",
 		review
 	};
-	if (action !== "recovery-confirm") throw new UsageError(USAGE$35);
+	if (action !== "recovery-confirm") throw new UsageError(USAGE$37);
 	if (review.blockedReason !== null) throw new UsageError(`This restore is blocked: ${review.blockedReason}`);
 	const confirmation = context.flags.get("--confirmation")?.trim() ?? "";
-	if (confirmation === "") throw new UsageError(`recovery-confirm needs --confirmation.\n\n${USAGE$35}`);
+	if (confirmation === "") throw new UsageError(`recovery-confirm needs --confirmation.\n\n${USAGE$37}`);
 	return {
 		kind: "recovery-write",
 		outcome: await confirmableWrite(context, `Confirm ${review.actionName} of ${review.name}${review.installedVersion === null ? "" : ` from ${review.installedVersion}`}: ${String(review.routeUuids.length)} route(s) and ${String(review.hosts.length)} host(s) are rewritten.`, async () => {
@@ -11214,7 +11247,7 @@ function siteAccessText(report) {
 }
 //#endregion
 //#region src/commands/application-site-access.ts
-var USAGE$34 = [
+var USAGE$36 = [
 	"Usage: hostingctl application site-access <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application site-access-set <environment-uuid> <application-uuid> --company <slug> --sign-in <on|off> [--audience <name>]",
 	"       hostingctl application site-access-rotate <environment-uuid> <application-uuid> --company <slug>",
@@ -11257,10 +11290,10 @@ var flow$1 = siteAccessFlow({
 	refresh: async (path) => (await hostingApplicationSiteAccessUsersRefresh({ path })).data,
 	destroy: async (path) => (await hostingApplicationSiteAccessUsersDestroy({ path })).data,
 	rotate: async (path) => (await hostingApplicationSiteAccessRotate({ path })).data
-}, USAGE$34);
+}, USAGE$36);
 /** `application site-access*|site-user*`, which the application dispatcher calls with its resolved path. */
 async function applicationSiteAccess(context, action, path, rest) {
-	if (rest.some((one) => one === "")) throw new UsageError(USAGE$34);
+	if (rest.some((one) => one === "")) throw new UsageError(USAGE$36);
 	return await flow$1(context, action, path, rest);
 }
 //#endregion
@@ -11272,7 +11305,7 @@ async function applicationSiteAccess(context, action, path, rest) {
 * paused. It starts no build and promotes nothing. The pause is the customer's own control: while it holds, a push to
 * the bound ref is read and matched but builds nothing, and the release that is serving is untouched either way.
 */
-var USAGE$33 = [
+var USAGE$35 = [
 	"Usage: hostingctl application updates <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application updates-pause <environment-uuid> <application-uuid> --company <slug>",
 	"       hostingctl application updates-resume <environment-uuid> <application-uuid> --company <slug>",
@@ -11285,7 +11318,7 @@ var USAGE$33 = [
 	"Both writes need --confirm; --dry-run describes the change without sending it."
 ].join("\n");
 async function applicationUpdates(context, action, path, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$33);
+	if (rest.length > 0) throw new UsageError(USAGE$35);
 	if (action === "updates") return {
 		kind: "updates",
 		surface: (await hostingApplicationUpdatesShow({ path })).data
@@ -11297,7 +11330,7 @@ async function applicationUpdates(context, action, path, rest) {
 			outcome: await confirmableWrite(context, pausing ? `Pause updates for application ${path.workloadUuid}: a push to its bound ref stops building it, and the release that is serving is unchanged.` : `Resume updates for application ${path.workloadUuid}: it may be a candidate again. Nothing is deployed by resuming.`, async () => pausing ? (await hostingApplicationUpdatesPause({ path })).data : (await hostingApplicationUpdatesResume({ path })).data)
 		};
 	}
-	throw new UsageError(USAGE$33);
+	throw new UsageError(USAGE$35);
 }
 /**
 * The update state in words.
@@ -11585,83 +11618,83 @@ var APPLICATION_METADATA = {
 var APPLICATION_TOPICS = [
 	{
 		path: ["create"],
-		usage: USAGE$38
+		usage: USAGE$40
 	},
 	{
 		path: ["build-log"],
-		usage: USAGE$40
+		usage: USAGE$42
 	},
 	{
 		path: ["build-retry"],
-		usage: USAGE$40
+		usage: USAGE$42
 	},
 	{
 		path: ["build-cancel"],
-		usage: USAGE$40
+		usage: USAGE$42
 	},
 	{
 		path: ["source-bind"],
-		usage: USAGE$40
+		usage: USAGE$42
 	},
 	{
 		path: ["source-unbind"],
-		usage: USAGE$40
+		usage: USAGE$42
 	},
 	{
 		path: ["cache"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["cache-set"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["cache-purge"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["routes"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["route-add"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["route-remove"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["canonical"],
-		usage: USAGE$39
+		usage: USAGE$41
 	},
 	{
 		path: ["import"],
-		usage: USAGE$36
+		usage: USAGE$38
 	},
 	{
 		path: ["import-upload"],
-		usage: USAGE$37
+		usage: USAGE$39
 	},
 	{
 		path: ["import-discard"],
-		usage: USAGE$36
+		usage: USAGE$38
 	},
 	{
 		path: ["url-repair-preview"],
-		usage: USAGE$36
+		usage: USAGE$38
 	},
 	{
 		path: ["url-repair-confirm"],
-		usage: USAGE$36
+		usage: USAGE$38
 	},
 	{
 		path: ["recovery-review"],
-		usage: USAGE$35
+		usage: USAGE$37
 	},
 	{
 		path: ["recovery-confirm"],
-		usage: USAGE$35
+		usage: USAGE$37
 	},
 	{
 		path: ["runtime"],
@@ -11669,59 +11702,59 @@ var APPLICATION_TOPICS = [
 	},
 	{
 		path: ["site-access"],
-		usage: USAGE$34
+		usage: USAGE$36
 	},
 	{
 		path: ["site-access-set"],
-		usage: USAGE$34
+		usage: USAGE$36
 	},
 	{
 		path: ["site-access-rotate"],
-		usage: USAGE$34
+		usage: USAGE$36
 	},
 	{
 		path: ["site-users"],
-		usage: USAGE$34
+		usage: USAGE$36
 	},
 	{
 		path: ["site-user"],
-		usage: USAGE$34
+		usage: USAGE$36
 	},
 	{
 		path: ["updates"],
-		usage: USAGE$33
+		usage: USAGE$35
 	},
 	{
 		path: ["updates-pause"],
-		usage: USAGE$33
+		usage: USAGE$35
 	},
 	{
 		path: ["updates-resume"],
-		usage: USAGE$33
+		usage: USAGE$35
 	},
 	{
 		path: ["administrator"],
-		usage: USAGE$41
+		usage: USAGE$43
 	},
 	{
 		path: ["administrator-reset"],
-		usage: USAGE$41
+		usage: USAGE$43
 	},
 	{
 		path: ["administrator-reveal"],
-		usage: USAGE$41
+		usage: USAGE$43
 	},
 	{
 		path: ["recovery-status"],
-		usage: USAGE$41
+		usage: USAGE$43
 	},
 	{
 		path: ["recovery-retry"],
-		usage: USAGE$41
+		usage: USAGE$43
 	},
 	{
 		path: ["recovery-cancel"],
-		usage: USAGE$41
+		usage: USAGE$43
 	}
 ];
 //#endregion
@@ -12787,7 +12820,7 @@ function episode(rest) {
 }
 //#endregion
 //#region src/commands/company-assets.ts
-var USAGE$32 = [
+var USAGE$34 = [
 	"Usage: hostingctl company logo|favicon set --image-file <path> --company <slug>",
 	"       hostingctl company logo|favicon remove --company <slug>",
 	"",
@@ -12802,17 +12835,17 @@ var USAGE$32 = [
 */
 async function companyAssets(context, asset, rest) {
 	const [action, ...tail] = rest;
-	if (tail.length > 0) throw new UsageError(USAGE$32);
+	if (tail.length > 0) throw new UsageError(USAGE$34);
 	const company = await requireCompany(context.flags);
 	if (action === "set") return await set(context, asset, company);
 	if (action === "remove") return await remove$2(context, asset, company);
-	throw new UsageError(USAGE$32);
+	throw new UsageError(USAGE$34);
 }
 /** `set --image-file …`: one multipart upload of the asset. */
 async function set(context, asset, company) {
 	const file = context.flags.get("--image-file") ?? "";
 	return await confirmableWrite(context, file === "" ? `Set ${company}'s ${asset}.` : `Set ${company}'s ${asset} to ${file}.`, async () => {
-		const body = await imageUpload(file, USAGE$32);
+		const body = await imageUpload(file, USAGE$34);
 		return asset === "logo" ? (await companyAssetStoreLogo({
 			path: { company },
 			body
@@ -12850,7 +12883,7 @@ function companyRole(raw, usage) {
 }
 //#endregion
 //#region src/commands/company-invitations.ts
-var USAGE$31 = [
+var USAGE$33 = [
 	"Usage: hostingctl company invitations --company <slug>",
 	"       hostingctl company invite --company <slug> --email <email> --name <name> --role <admin|member>",
 	"       hostingctl company cancel-invitation <invitation-uuid> --company <slug>",
@@ -12874,7 +12907,7 @@ var MAX_INVITATION_TOKEN_BYTES = 4096;
 */
 async function companyInvitations(context, subcommand, rest) {
 	if (subcommand === "invitations") {
-		if (rest.length > 0) throw new UsageError(USAGE$31);
+		if (rest.length > 0) throw new UsageError(USAGE$33);
 		const company = await requireCompany(context.flags);
 		return {
 			kind: "invitations",
@@ -12885,20 +12918,20 @@ async function companyInvitations(context, subcommand, rest) {
 	if (subcommand === "invite") return await invite(context, rest);
 	if (subcommand === "cancel-invitation") return await cancel(context, rest);
 	if (subcommand === "invitation-preview") return (await companyInvitationPreview({
-		path: { invitationUuid: oneUuid$7(rest, USAGE$31) },
-		body: { token: readSecret(context, "token", MAX_INVITATION_TOKEN_BYTES, USAGE$31) }
+		path: { invitationUuid: oneUuid$7(rest, USAGE$33) },
+		body: { token: readSecret(context, "token", MAX_INVITATION_TOKEN_BYTES, USAGE$33) }
 	})).data;
 	if (subcommand === "invitation-accept") return await accept(context, rest);
-	throw new UsageError(USAGE$31);
+	throw new UsageError(USAGE$33);
 }
 /** `invite --email … --name … --role …`. */
 async function invite(context, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$31);
+	if (rest.length > 0) throw new UsageError(USAGE$33);
 	const company = await requireCompany(context.flags);
 	const email = context.flags.get("--email")?.trim() ?? "";
 	const name = context.flags.get("--name")?.trim() ?? "";
-	const role = companyRole(context.flags.get("--role"), USAGE$31);
-	if (email === "" || name === "") throw new UsageError(`invite needs --email and --name.\n\n${USAGE$31}`);
+	const role = companyRole(context.flags.get("--role"), USAGE$33);
+	if (email === "" || name === "") throw new UsageError(`invite needs --email and --name.\n\n${USAGE$33}`);
 	return await confirmableWrite(context, `Invite ${name} <${email}> into ${company} as ${role}.`, async () => (await companyInvitationStore({
 		path: { company },
 		body: {
@@ -12910,7 +12943,7 @@ async function invite(context, rest) {
 }
 /** `cancel-invitation <uuid> --company …`. */
 async function cancel(context, rest) {
-	const invitationUuid = oneUuid$7(rest, USAGE$31);
+	const invitationUuid = oneUuid$7(rest, USAGE$33);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, `Cancel invitation ${invitationUuid}.`, async () => {
 		return (await companyInvitationDestroy({ path: {
@@ -12921,11 +12954,11 @@ async function cancel(context, rest) {
 }
 /** `invitation-accept <uuid>`: join the company the invitation names. */
 async function accept(context, rest) {
-	const invitationUuid = oneUuid$7(rest, USAGE$31);
+	const invitationUuid = oneUuid$7(rest, USAGE$33);
 	return await confirmableWrite(context, `Accept invitation ${invitationUuid}.`, async () => {
 		return (await companyInvitationAccept({
 			path: { invitationUuid },
-			body: { token: readSecret(context, "token", MAX_INVITATION_TOKEN_BYTES, USAGE$31) }
+			body: { token: readSecret(context, "token", MAX_INVITATION_TOKEN_BYTES, USAGE$33) }
 		})).data;
 	});
 }
@@ -13026,31 +13059,31 @@ var COMPANY_METADATA = {
 var COMPANY_TOPICS = [
 	{
 		path: ["logo"],
-		usage: USAGE$32
+		usage: USAGE$34
 	},
 	{
 		path: ["favicon"],
-		usage: USAGE$32
+		usage: USAGE$34
 	},
 	{
 		path: ["invitations"],
-		usage: USAGE$31
+		usage: USAGE$33
 	},
 	{
 		path: ["invite"],
-		usage: USAGE$31
+		usage: USAGE$33
 	},
 	{
 		path: ["cancel-invitation"],
-		usage: USAGE$31
+		usage: USAGE$33
 	},
 	{
 		path: ["invitation-preview"],
-		usage: USAGE$31
+		usage: USAGE$33
 	},
 	{
 		path: ["invitation-accept"],
-		usage: USAGE$31
+		usage: USAGE$33
 	}
 ];
 //#endregion
@@ -13871,7 +13904,7 @@ function readJsonObject(file, subject) {
 }
 //#endregion
 //#region src/commands/dns-records.ts
-var USAGE$30 = [
+var USAGE$32 = [
 	"Usage: hostingctl dns enable <domain-uuid> --company <slug>",
 	"       hostingctl dns record set <domain-uuid> --company <slug> --file <set.json>",
 	"       hostingctl dns record remove <domain-uuid> --company <slug> --name <relative> --type <type>",
@@ -13910,7 +13943,7 @@ async function dnsWrites(context, subcommand, rest) {
 	if (subcommand === "record") return await record$4(context, rest);
 	if (subcommand === "dnssec") return await changeDnssec(context, rest);
 	if (subcommand === "handover") return await handover(context, rest);
-	throw new UsageError(USAGE$30);
+	throw new UsageError(USAGE$32);
 }
 /** The zone's current desired generation, which every write must name. */
 async function generation(company, domainUuid) {
@@ -13921,7 +13954,7 @@ async function generation(company, domainUuid) {
 }
 /** `dns enable <uuid>`: take the zone over into managed DNS. */
 async function enable(context, rest) {
-	const domainUuid = oneUuid$7(rest, USAGE$30);
+	const domainUuid = oneUuid$7(rest, USAGE$32);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, "Publish this name's zone in managed DNS.", async () => (await domainsDnsStore({ path: {
 		company,
@@ -13931,16 +13964,16 @@ async function enable(context, rest) {
 /** `dns record set|remove`. */
 async function record$4(context, rest) {
 	const [action, ...tail] = rest;
-	const domainUuid = oneUuid$7(tail, USAGE$30);
+	const domainUuid = oneUuid$7(tail, USAGE$32);
 	const company = await requireCompany(context.flags);
 	if (action === "set") return await setRecord(context, company, domainUuid);
 	if (action === "remove") return await removeRecord(context, company, domainUuid);
-	throw new UsageError(USAGE$30);
+	throw new UsageError(USAGE$32);
 }
 /** `record set --file`: replace one set with the file's own values. */
 async function setRecord(context, company, domainUuid) {
 	const file = context.flags.get("--file") ?? "";
-	if (file === "") throw new UsageError(`record set needs --file <set.json>.\n\n${USAGE$30}`);
+	if (file === "") throw new UsageError(`record set needs --file <set.json>.\n\n${USAGE$32}`);
 	const set = recordSetFromFile(file);
 	return await confirmableWrite(context, [`Replace the ${set.recordType.toUpperCase()} set "${set.relativeName}" (ttl ${String(set.ttlSeconds)}) with:`, ...set.values.map((one) => `  ${one}`)].join("\n"), async () => {
 		const body = {
@@ -13960,7 +13993,7 @@ async function setRecord(context, company, domainUuid) {
 async function removeRecord(context, company, domainUuid) {
 	const relativeName = context.flags.get("--name") ?? "";
 	const recordType = recordTypeFlag(context);
-	if (relativeName === "") throw new UsageError(`record remove needs --name.\n\n${USAGE$30}`);
+	if (relativeName === "") throw new UsageError(`record remove needs --name.\n\n${USAGE$32}`);
 	return await confirmableWrite(context, `Remove the ${recordType.toUpperCase()} set "${relativeName}".`, async () => {
 		const query = {
 			relativeName,
@@ -13979,8 +14012,8 @@ async function removeRecord(context, company, domainUuid) {
 /** `dns dnssec <signed|unsigned> <uuid>`: the signing mode, with the confirmation the API requires. */
 async function changeDnssec(context, rest) {
 	const [mode, uuid, ...extra] = rest;
-	if (mode === void 0 || mode !== "signed" && mode !== "unsigned" || extra.length > 0) throw new UsageError(USAGE$30);
-	const domainUuid = oneUuid$7(uuid === void 0 ? [] : [uuid], USAGE$30);
+	if (mode === void 0 || mode !== "signed" && mode !== "unsigned" || extra.length > 0) throw new UsageError(USAGE$32);
+	const domainUuid = oneUuid$7(uuid === void 0 ? [] : [uuid], USAGE$32);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, [`Set the zone's signing mode to ${mode}.`, ...mode === "signed" ? ["  DNSSEC signing is added; resolvers that fail validation will not answer until DS records match."] : ["  DNSSEC signing is removed; the DS record in the parent zone has to be removed too."]].join("\n"), async () => {
 		const body = {
@@ -13999,7 +14032,7 @@ async function changeDnssec(context, rest) {
 }
 /** `dns handover <uuid>`: hand the zone back, dropping what this platform publishes. */
 async function handover(context, rest) {
-	const domainUuid = oneUuid$7(rest, USAGE$30);
+	const domainUuid = oneUuid$7(rest, USAGE$32);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, ["Hand this name's zone back out of managed DNS.", "  Address records published here stop being published; the name and its applications stay."].join("\n"), async () => {
 		const body = {
@@ -14018,7 +14051,7 @@ async function handover(context, rest) {
 /** A record type flag, refused when it is not one of the API's own values. */
 function recordTypeFlag(context) {
 	const raw = (context.flags.get("--type") ?? "").trim().toLowerCase();
-	if (!RECORD_TYPES.has(raw)) throw new UsageError(`--type must be one of ${[...RECORD_TYPES].join(", ")} (got "${raw}").\n\n${USAGE$30}`);
+	if (!RECORD_TYPES.has(raw)) throw new UsageError(`--type must be one of ${[...RECORD_TYPES].join(", ")} (got "${raw}").\n\n${USAGE$32}`);
 	return raw;
 }
 /**
@@ -14052,7 +14085,7 @@ function recordSetFromValue(value, subject) {
 }
 //#endregion
 //#region src/commands/dns-templates.ts
-var USAGE$29 = [
+var USAGE$31 = [
 	"Usage: hostingctl dns template list --company <slug>",
 	"       hostingctl dns template show <template-uuid> --company <slug>",
 	"       hostingctl dns template save [<template-uuid>] --company <slug> --file <template.json>",
@@ -14074,24 +14107,24 @@ var USAGE$29 = [
 async function dnsTemplates(context, rest) {
 	const [action, ...tail] = rest;
 	if (action === "list") {
-		if (tail.length > 0) throw new UsageError(USAGE$29);
+		if (tail.length > 0) throw new UsageError(USAGE$31);
 		return {
 			kind: "templates",
 			templates: (await dnsTemplatesIndex({ path: { company: await requireCompany(context.flags) } })).data.templates
 		};
 	}
-	if (action === "show") return await show$4(context, oneUuid$7(tail, USAGE$29));
+	if (action === "show") return await show$4(context, oneUuid$7(tail, USAGE$31));
 	if (action === "save") return await save$1(context, tail[0]);
-	if (action === "delete") return await destroy$1(context, oneUuid$7(tail, USAGE$29));
-	if (action === "from-zone") return await fromZone(context, oneUuid$7(tail, USAGE$29));
+	if (action === "delete") return await destroy$1(context, oneUuid$7(tail, USAGE$31));
+	if (action === "from-zone") return await fromZone(context, oneUuid$7(tail, USAGE$31));
 	if (action === "preview") return await preview$1(context, tail);
 	if (action === "apply") return await apply(context, tail);
-	throw new UsageError(USAGE$29);
+	throw new UsageError(USAGE$31);
 }
 /** Two uuids: the template, then the zone it applies to. */
 function templateAndZone(rest) {
 	const [templateUuid, domainUuid, ...extra] = rest;
-	if (templateUuid === void 0 || templateUuid === "" || domainUuid === void 0 || domainUuid === "" || extra.length > 0) throw new UsageError(USAGE$29);
+	if (templateUuid === void 0 || templateUuid === "" || domainUuid === void 0 || domainUuid === "" || extra.length > 0) throw new UsageError(USAGE$31);
 	return {
 		templateUuid,
 		domainUuid
@@ -14110,7 +14143,7 @@ async function show$4(context, templateUuid) {
 /** `save [<uuid>] --file …`: record a new template, or replace the one named. */
 async function save$1(context, templateUuid) {
 	const file = context.flags.get("--file") ?? "";
-	if (file === "") throw new UsageError(`template save needs --file <template.json>.\n\n${USAGE$29}`);
+	if (file === "") throw new UsageError(`template save needs --file <template.json>.\n\n${USAGE$31}`);
 	const company = await requireCompany(context.flags);
 	const document = readJsonObject(file, "template");
 	const name = typeof document.name === "string" ? document.name.trim() : "";
@@ -14146,7 +14179,7 @@ async function destroy$1(context, templateUuid) {
 async function fromZone(context, domainUuid) {
 	const company = await requireCompany(context.flags);
 	const name = context.flags.get("--name")?.trim() ?? "";
-	if (name === "") throw new UsageError(`template from-zone needs --name.\n\n${USAGE$29}`);
+	if (name === "") throw new UsageError(`template from-zone needs --name.\n\n${USAGE$31}`);
 	const zone = (await domainsDnsShow({ path: {
 		company,
 		domainUuid
@@ -14216,7 +14249,7 @@ function recordSetsFromFile$1(document, subject) {
 }
 //#endregion
 //#region src/commands/dns-text.ts
-var USAGE$28 = [
+var USAGE$30 = [
 	"Usage: hostingctl dns <zone|export> <domain-uuid> --company <slug>",
 	"       hostingctl dns import <preview|apply> <domain-uuid> --company <slug> --file <path> [--confirm]",
 	"       hostingctl dns enable <domain-uuid> --company <slug>",
@@ -14287,7 +14320,7 @@ function applyText(result) {
 var DNS_METADATA = {
 	name: "dns",
 	summary: "A managed name's zone, its zone-file export, and the reviewed import write.",
-	usage: USAGE$28,
+	usage: USAGE$30,
 	flags: [
 		{
 			name: "--file",
@@ -14325,23 +14358,23 @@ var DNS_METADATA = {
 var DNS_TOPICS = [
 	{
 		path: ["enable"],
-		usage: USAGE$30
+		usage: USAGE$32
 	},
 	{
 		path: ["record"],
-		usage: USAGE$30
+		usage: USAGE$32
 	},
 	{
 		path: ["dnssec"],
-		usage: USAGE$30
+		usage: USAGE$32
 	},
 	{
 		path: ["handover"],
-		usage: USAGE$30
+		usage: USAGE$32
 	},
 	{
 		path: ["template"],
-		usage: USAGE$29
+		usage: USAGE$31
 	}
 ];
 //#endregion
@@ -14359,7 +14392,7 @@ var IMPORT_LINE = /^(\S+)\s+(\d+)\s+(\S+)\s+(.+)$/;
 * hold customer DNS data, so its contents are never printed; only the API's own answer is shown.
 */
 function recordSetsFromFile(file) {
-	if (file === void 0 || file === "") throw new UsageError(`Importing needs the record sets from disk: pass --file <path>.\n\n${USAGE$28}`);
+	if (file === void 0 || file === "") throw new UsageError(`Importing needs the record sets from disk: pass --file <path>.\n\n${USAGE$30}`);
 	const sets = /* @__PURE__ */ new Map();
 	for (const [index, raw] of readBoundedImportFile(file, "import").split("\n").entries()) addLine(sets, raw.trim(), index + 1);
 	if (sets.size === 0) throw new UsageError(`The import file [${file}] holds no record sets.`);
@@ -14453,7 +14486,7 @@ var dns = {
 		if (subcommand === "import") return await importRecords(context, rest);
 		if (subcommand === "template") return await dnsTemplates(context, rest);
 		if (WRITE_SUBCOMMANDS$1.has(subcommand ?? "")) return await dnsWrites(context, subcommand ?? "", rest);
-		throw new UsageError(USAGE$28);
+		throw new UsageError(USAGE$30);
 	},
 	human(report) {
 		if ("sent" in report) return renderWriteOutcome(report, dnsWriteText);
@@ -14472,7 +14505,7 @@ async function readZone(context, rest, which) {
 /** `import preview|apply <uuid> --file <path>`: the review, or the reviewed write. */
 async function importRecords(context, rest) {
 	const [action, ...tail] = rest;
-	if (action !== "preview" && action !== "apply") throw new UsageError(USAGE$28);
+	if (action !== "preview" && action !== "apply") throw new UsageError(USAGE$30);
 	const path = await domainPath$1(context, tail);
 	const recordSets = recordSetsFromFile(context.flags.get("--file"));
 	if (action === "preview") return (await domainsDnsImportPreview({
@@ -14509,7 +14542,7 @@ async function applyImport(context, path, recordSets) {
 /** The company and the one domain uuid a DNS subcommand needs, or a usage refusal. */
 async function domainPath$1(context, rest) {
 	const [domainUuid, ...extra] = rest;
-	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$28);
+	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$30);
 	return {
 		company: await requireCompany(context.flags),
 		domainUuid
@@ -14678,7 +14711,7 @@ function checkText(check) {
 //#endregion
 //#region src/commands/email-alias.ts
 /** The one usage string this group refuses with, owned by the group it belongs to. */
-var USAGE$27 = [
+var USAGE$29 = [
 	"Usage: hostingctl email alias add <email-domain-uuid> --company <slug> --local <name> --destinations a@x,b@y",
 	"       hostingctl email alias set <email-domain-uuid> <alias-uuid> --company <slug> --destinations a@x,b@y",
 	"       hostingctl email alias remove <email-domain-uuid> <alias-uuid> --company <slug>",
@@ -14702,16 +14735,16 @@ async function aliasGroup(context, action, tail) {
 	if (action === "set") return await aliasSet(context, tail);
 	if (action === "remove") return await aliasRemove(context, tail);
 	if (action === "unroute") return await aliasUnroute(context, tail);
-	throw new UsageError(USAGE$27);
+	throw new UsageError(USAGE$29);
 }
 /** `alias add <domain> --local … --destinations …`: a new forwarding address. */
 async function aliasAdd(context, tail) {
 	const [emailDomainUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$27);
+	if (emailDomainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$29);
 	const company = await requireCompany(context.flags);
 	const localPart = context.flags.get("--local")?.trim().toLowerCase() ?? "";
 	const list = destinations$1(context);
-	if (localPart === "" || list.length === 0) throw new UsageError(`alias add needs --local and --destinations.\n\n${USAGE$27}`);
+	if (localPart === "" || list.length === 0) throw new UsageError(`alias add needs --local and --destinations.\n\n${USAGE$29}`);
 	return await confirmableWrite(context, [`Create ${localPart}@… forwarding to:`, ...list.map((one) => `  ${one}`)].join("\n"), async () => {
 		return (await emailAliasesStore({
 			path: {
@@ -14728,10 +14761,10 @@ async function aliasAdd(context, tail) {
 /** `alias set <domain> <alias> --destinations …`: replace the complete recipient list. */
 async function aliasSet(context, tail) {
 	const [emailDomainUuid, aliasUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || aliasUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$27);
+	if (emailDomainUuid === void 0 || aliasUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$29);
 	const company = await requireCompany(context.flags);
 	const list = destinations$1(context);
-	if (list.length === 0) throw new UsageError(`alias set needs --destinations.\n\n${USAGE$27}`);
+	if (list.length === 0) throw new UsageError(`alias set needs --destinations.\n\n${USAGE$29}`);
 	return await confirmableWrite(context, [`Replace ${aliasUuid}'s destinations with:`, ...list.map((one) => `  ${one}`)].join("\n"), async () => {
 		return (await emailAliasesUpdate({
 			path: {
@@ -14746,7 +14779,7 @@ async function aliasSet(context, tail) {
 /** `alias remove <domain> <alias>`. */
 async function aliasRemove(context, tail) {
 	const [emailDomainUuid, aliasUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || aliasUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$27);
+	if (emailDomainUuid === void 0 || aliasUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$29);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, `Remove alias ${aliasUuid}.`, async () => {
 		return (await emailAliasesDestroy({ path: {
@@ -14759,7 +14792,7 @@ async function aliasRemove(context, tail) {
 /** `alias unroute <domain> <alias> <mailbox>`: drop one destination. */
 async function aliasUnroute(context, tail) {
 	const [emailDomainUuid, aliasUuid, mailboxUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || aliasUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$27);
+	if (emailDomainUuid === void 0 || aliasUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$29);
 	const company = await requireCompany(context.flags);
 	return await confirmableWrite(context, `Stop forwarding ${aliasUuid} to mailbox ${mailboxUuid}.`, async () => {
 		return (await emailAliasesDestinationsDestroy({ path: {
@@ -14772,7 +14805,7 @@ async function aliasUnroute(context, tail) {
 }
 //#endregion
 //#region src/commands/email-address.ts
-var USAGE$26 = [
+var USAGE$28 = [
 	"Usage: hostingctl email alias add <email-domain-uuid> --company <slug> --local <name> --destinations a@x,b@y",
 	"       hostingctl email alias set <email-domain-uuid> <alias-uuid> --company <slug> --destinations a@x,b@y",
 	"       hostingctl email alias remove <email-domain-uuid> <alias-uuid> --company <slug>",
@@ -14798,13 +14831,13 @@ async function emailAddresses(context, subcommand, rest) {
 	if (subcommand === "alias") return await aliasGroup(context, action, tail);
 	if (subcommand === "app-token") return await appToken(context, action, tail);
 	if (subcommand === "send-as") return await sendAs(context, action, tail);
-	throw new UsageError(USAGE$26);
+	throw new UsageError(USAGE$28);
 }
 /** `app-token list|issue|revoke|deliver`. */
 async function appToken(context, action, tail) {
 	const company = await requireCompany(context.flags);
 	const [emailDomainUuid, mailboxUuid, third, ...extra] = tail;
-	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$26);
+	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$28);
 	const path = {
 		company,
 		emailDomainUuid,
@@ -14832,7 +14865,7 @@ async function appToken(context, action, tail) {
 	}
 	if (action === "issue" && third === void 0) {
 		const label = context.flags.get("--label")?.trim() ?? "";
-		if (label === "") throw new UsageError(`app-token issue needs --label.\n\n${USAGE$26}`);
+		if (label === "") throw new UsageError(`app-token issue needs --label.\n\n${USAGE$28}`);
 		return await confirmableWrite(context, `Create an application password labelled "${label}".`, async () => {
 			return (await emailAppTokensStore({
 				path,
@@ -14840,7 +14873,7 @@ async function appToken(context, action, tail) {
 			})).data;
 		});
 	}
-	if (third === void 0) throw new UsageError(USAGE$26);
+	if (third === void 0) throw new UsageError(USAGE$28);
 	const tokenPath = {
 		...path,
 		tokenUuid: third
@@ -14849,14 +14882,14 @@ async function appToken(context, action, tail) {
 		return (await emailAppTokensRevoke({ path: tokenPath })).data;
 	});
 	if (action === "deliver") return await confirmableWrite(context, [`Return application password ${third} once.`, "  The value is printed here and not stored: it cannot be read again after this."].join("\n"), async () => (await emailAppTokensDeliver({ path: tokenPath })).data);
-	throw new UsageError(USAGE$26);
+	throw new UsageError(USAGE$28);
 }
 /** `send-as list|grant|revoke`. */
 async function sendAs(context, action, tail) {
 	const company = await requireCompany(context.flags);
 	if (action === "revoke") {
 		const [grantUuid, ...extra] = tail;
-		if (grantUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$26);
+		if (grantUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$28);
 		return await confirmableWrite(context, `Revoke send-as grant ${grantUuid}.`, async () => {
 			return (await emailSendAsGrantsDestroy({ path: {
 				company,
@@ -14865,7 +14898,7 @@ async function sendAs(context, action, tail) {
 		});
 	}
 	const [emailDomainUuid, mailboxUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$26);
+	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$28);
 	const path = {
 		company,
 		emailDomainUuid,
@@ -14892,7 +14925,7 @@ async function sendAs(context, action, tail) {
 	}
 	if (action === "grant") {
 		const grantedAddressUuid = context.flags.get("--address") ?? "";
-		if (grantedAddressUuid === "") throw new UsageError(`send-as grant needs --address.\n\n${USAGE$26}`);
+		if (grantedAddressUuid === "") throw new UsageError(`send-as grant needs --address.\n\n${USAGE$28}`);
 		return await confirmableWrite(context, `Allow this mailbox to send as address ${grantedAddressUuid}.`, async () => {
 			return (await emailSendAsGrantsStore({
 				path,
@@ -14900,7 +14933,7 @@ async function sendAs(context, action, tail) {
 			})).data;
 		});
 	}
-	throw new UsageError(USAGE$26);
+	throw new UsageError(USAGE$28);
 }
 //#endregion
 //#region src/commands/email-write-text.ts
@@ -14969,7 +15002,7 @@ function emailAddressText(report) {
 }
 //#endregion
 //#region src/commands/email-domain.ts
-var USAGE$25 = [
+var USAGE$27 = [
 	"Usage: hostingctl email offer",
 	"       hostingctl email enroll --company <slug>",
 	"       hostingctl email agree --company <slug> --term <package-term-uuid>",
@@ -14990,7 +15023,7 @@ var USAGE$25 = [
 /** `email offer|agree|provision|domain|catch-all`, dispatched from the `email` command. */
 async function emailDomains(context, subcommand, rest) {
 	if (subcommand === "offer") {
-		if (rest.length > 0) throw new UsageError(USAGE$25);
+		if (rest.length > 0) throw new UsageError(USAGE$27);
 		return {
 			kind: "offers",
 			offers: (await emailOffers({ path: { company: await requireCompany(context.flags) } })).data
@@ -15001,11 +15034,11 @@ async function emailDomains(context, subcommand, rest) {
 	if (subcommand === "provision") return await provision(context, rest);
 	if (subcommand === "domain") return await domain(context, rest);
 	if (subcommand === "catch-all") return await catchAll(context, rest);
-	throw new UsageError(USAGE$25);
+	throw new UsageError(USAGE$27);
 }
 /** A company-wide command takes no positionals. */
 function noExtra$12(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$25);
+	if (rest.length > 0) throw new UsageError(USAGE$27);
 }
 /** `enroll`: create the service record and start provisioning, which is the API's own create. */
 async function enroll(context, rest) {
@@ -15018,7 +15051,7 @@ async function agree(context, rest) {
 	noExtra$12(rest);
 	const company = await requireCompany(context.flags);
 	const packageTermUuid = context.flags.get("--term") ?? "";
-	if (packageTermUuid === "") throw new UsageError(`agree needs --term.\n\n${USAGE$25}`);
+	if (packageTermUuid === "") throw new UsageError(`agree needs --term.\n\n${USAGE$27}`);
 	return await confirmableWrite(context, `Accept email package term ${packageTermUuid} for ${company}.`, async () => (await emailAgreement({
 		path: { company },
 		body: { packageTermUuid }
@@ -15037,7 +15070,7 @@ async function domain(context, rest) {
 	if (action === "add") {
 		noExtra$12(tail);
 		const hostname = context.flags.get("--hostname")?.trim().toLowerCase() ?? "";
-		if (hostname === "") throw new UsageError(`domain add needs --hostname.\n\n${USAGE$25}`);
+		if (hostname === "") throw new UsageError(`domain add needs --hostname.\n\n${USAGE$27}`);
 		return await confirmableWrite(context, `Attach ${hostname} to ${company}'s mail service.`, async () => {
 			return (await emailDomainsStore({
 				path: { company },
@@ -15047,7 +15080,7 @@ async function domain(context, rest) {
 	}
 	const path = {
 		company,
-		emailDomainUuid: oneUuid$7(tail, USAGE$25)
+		emailDomainUuid: oneUuid$7(tail, USAGE$27)
 	};
 	if (action === "recheck") return await confirmableWrite(context, "Re-observe this name's DNS now.", async () => {
 		return (await emailDomainsRecheck({ path })).data;
@@ -15067,14 +15100,14 @@ async function domain(context, rest) {
 			body
 		})).data;
 	});
-	throw new UsageError(USAGE$25);
+	throw new UsageError(USAGE$27);
 }
 /** `catch-all show|set|clear`. */
 async function catchAll(context, rest) {
 	const [action, ...tail] = rest;
 	const path = {
 		company: await requireCompany(context.flags),
-		emailDomainUuid: oneUuid$7(tail, USAGE$25)
+		emailDomainUuid: oneUuid$7(tail, USAGE$27)
 	};
 	if (action === "show") return {
 		kind: "catch-all",
@@ -15082,7 +15115,7 @@ async function catchAll(context, rest) {
 	};
 	if (action === "set") {
 		const destinations = destinationList(context);
-		if (destinations.length === 0) throw new UsageError(`catch-all set needs --destinations a@x,b@y.\n\n${USAGE$25}`);
+		if (destinations.length === 0) throw new UsageError(`catch-all set needs --destinations a@x,b@y.\n\n${USAGE$27}`);
 		return await confirmableWrite(context, [`Enable the catch-all for this name, forwarding to:`, ...destinations.map((one) => `  ${one}`)].join("\n"), async () => {
 			return (await emailCatchAllUpdate({
 				path,
@@ -15094,7 +15127,7 @@ async function catchAll(context, rest) {
 		});
 	}
 	if (action === "clear") return await confirmableWrite(context, "Disable the catch-all: mail to an unknown address at this name is refused rather than forwarded.", async () => (await emailCatchAllDestroy({ path })).data);
-	throw new UsageError(USAGE$25);
+	throw new UsageError(USAGE$27);
 }
 /**
 * The comma-separated `--destinations`.
@@ -15126,7 +15159,7 @@ function catchAllText(one) {
 }
 //#endregion
 //#region src/commands/email-holds.ts
-var USAGE$24 = [
+var USAGE$26 = [
 	"Usage: hostingctl email hold list --company <slug>",
 	"       hostingctl email hold create --company <slug> --reason <compromise|abuse|operator> [--mailbox <uuid>]",
 	"       hostingctl email hold release <hold-uuid> --company <slug>",
@@ -15149,21 +15182,21 @@ async function emailHolds(context, rest) {
 	const [action, ...tail] = rest;
 	const company = await requireCompany(context.flags);
 	if (action === "list") {
-		if (tail.length > 0) throw new UsageError(USAGE$24);
+		if (tail.length > 0) throw new UsageError(USAGE$26);
 		return {
 			kind: "holds",
 			holds: (await emailHoldsIndex({ path: { company } })).data.holds
 		};
 	}
 	if (action === "create") return await create$3(context, tail, company);
-	if (action === "release") return await release(context, oneUuid$7(tail, USAGE$24), company);
-	throw new UsageError(USAGE$24);
+	if (action === "release") return await release(context, oneUuid$7(tail, USAGE$26), company);
+	throw new UsageError(USAGE$26);
 }
 /** `create --reason … [--mailbox …]`. */
 async function create$3(context, tail, company) {
-	if (tail.length > 0) throw new UsageError(USAGE$24);
+	if (tail.length > 0) throw new UsageError(USAGE$26);
 	const raw = context.flags.get("--reason")?.trim() ?? "";
-	if (!REASONS.has(raw)) throw new UsageError(`--reason must be compromise, abuse or operator (got "${raw}").\n\n${USAGE$24}`);
+	if (!REASONS.has(raw)) throw new UsageError(`--reason must be compromise, abuse or operator (got "${raw}").\n\n${USAGE$26}`);
 	const mailboxUuid = context.flags.get("--mailbox")?.trim() ?? "";
 	return await confirmableWrite(context, [`Hold outbound mail for ${mailboxUuid === "" ? "the whole service" : `mailbox ${mailboxUuid}`} because: ${raw}.`, "  Nothing is sent until this hold is released."].join("\n"), async () => {
 		return (await emailHoldsStore({
@@ -15199,7 +15232,7 @@ function emailHoldText(report) {
 }
 //#endregion
 //#region src/commands/email-mailbox-admin.ts
-var USAGE$23 = [
+var USAGE$25 = [
 	"Usage: hostingctl email mailbox add <email-domain-uuid> --company <slug> --local <name> --quota <gb-5|gb-10|gb-20>",
 	"       hostingctl email mailbox change <email-domain-uuid> <mailbox-uuid> --company <slug> [--status enabled|suspended] [--quota <size>]",
 	"       hostingctl email mailbox remove <email-domain-uuid> <mailbox-uuid> --company <slug>",
@@ -15231,7 +15264,7 @@ var STATUSES = /* @__PURE__ */ new Set(["enabled", "suspended"]);
 async function emailMailboxAdmin(context, action, tail) {
 	if (action === "add") return await add$6(context, tail);
 	const [emailDomainUuid, mailboxUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$23);
+	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$25);
 	const path = {
 		company: await requireCompany(context.flags),
 		emailDomainUuid,
@@ -15249,7 +15282,7 @@ async function emailMailboxAdmin(context, action, tail) {
 	if (action === "preferences-set") return await preferences(context, path);
 	if (action === "credential") return await revealCredential(context, path, false);
 	if (action === "reset-credential") return await revealCredential(context, path, true);
-	throw new UsageError(USAGE$23);
+	throw new UsageError(USAGE$25);
 }
 /** A quota flag from the API's own values. */
 function quota(context) {
@@ -15265,11 +15298,11 @@ function destinations(context) {
 /** `add <domain> --local … --quota …`. */
 async function add$6(context, tail) {
 	const [emailDomainUuid, ...extra] = tail;
-	if (emailDomainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$23);
+	if (emailDomainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$25);
 	const company = await requireCompany(context.flags);
 	const localPart = context.flags.get("--local")?.trim().toLowerCase() ?? "";
 	const size = quota(context);
-	if (localPart === "" || size === null) throw new UsageError(`mailbox add needs --local and --quota.\n\n${USAGE$23}`);
+	if (localPart === "" || size === null) throw new UsageError(`mailbox add needs --local and --quota.\n\n${USAGE$25}`);
 	return await confirmableWrite(context, `Create mailbox ${localPart}@… with a ${size} quota.`, async () => {
 		return (await emailMailboxesStore({
 			path: {
@@ -15294,7 +15327,7 @@ function statusFlag(context) {
 async function change$1(context, path) {
 	const status = statusFlag(context);
 	const size = quota(context);
-	if (status === null && size === null) throw new UsageError(`mailbox change needs --status, --quota or both.\n\n${USAGE$23}`);
+	if (status === null && size === null) throw new UsageError(`mailbox change needs --status, --quota or both.\n\n${USAGE$25}`);
 	return await confirmableWrite(context, `Set this mailbox's ${[status === null ? null : `status to ${status}`, size === null ? null : `quota to ${size}`].filter((one) => one !== null).join(" and ")}.`, async () => {
 		return (await emailMailboxesUpdate({
 			path,
@@ -15322,7 +15355,7 @@ async function preferences(context, path) {
 	const markRead = onOff$4(context, "--spam-mark-read");
 	const threshold = context.flags.get("--spam-threshold");
 	const summary = context.flags.get("--vacation-subject");
-	if (vacation === null && markRead === null && threshold === void 0 && summary === void 0) throw new UsageError(`preferences-set needs --vacation, --spam-threshold, --spam-mark-read or --vacation-subject.\n\n${USAGE$23}`);
+	if (vacation === null && markRead === null && threshold === void 0 && summary === void 0) throw new UsageError(`preferences-set needs --vacation, --spam-threshold, --spam-mark-read or --vacation-subject.\n\n${USAGE$25}`);
 	const body = {
 		vacationEnabled: vacation ?? current.vacationEnabled,
 		vacationSubject: context.flags.get("--vacation-subject") ?? current.vacationSubject,
@@ -15377,7 +15410,7 @@ function emailMailboxAdminText(report) {
 }
 //#endregion
 //#region src/commands/email-service.ts
-var USAGE$22 = [
+var USAGE$24 = [
 	"Usage: hostingctl email service <suspend|resume> --company <slug>",
 	"       hostingctl email service cancellation --company <slug>",
 	"       hostingctl email service cancel --company <slug> --ends-at <iso-date>",
@@ -15404,11 +15437,11 @@ async function emailService(context, subcommand, rest) {
 	if (subcommand === "dmarc-set") return await dmarcSet$1(context, rest);
 	if (subcommand === "blocklist-set") return await blocklistSet(context, rest);
 	if (subcommand === "service") return await service(context, rest);
-	throw new UsageError(USAGE$22);
+	throw new UsageError(USAGE$24);
 }
 /** A company-wide command takes no positionals. */
 function noExtra$11(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$22);
+	if (rest.length > 0) throw new UsageError(USAGE$24);
 }
 /** `service suspend|resume|cancellation|cancel|cancel-withdraw`. */
 async function service(context, rest) {
@@ -15434,7 +15467,7 @@ async function service(context, rest) {
 	if (action === "cancel") {
 		noExtra$11(tail);
 		const endsAt = context.flags.get("--ends-at")?.trim() ?? "";
-		if (endsAt === "") throw new UsageError(`service cancel needs --ends-at.\n\n${USAGE$22}`);
+		if (endsAt === "") throw new UsageError(`service cancel needs --ends-at.\n\n${USAGE$24}`);
 		if (Number.isNaN(Date.parse(endsAt))) throw new UsageError(`--ends-at must be an ISO date (got "${endsAt}").`);
 		return await confirmableWrite(context, [`End the mail service at ${endsAt}.`, "  Mail keeps working until then; the cancellation can be withdrawn before that date."].join("\n"), async () => (await emailCancellationStore({
 			path: { company },
@@ -15447,7 +15480,7 @@ async function service(context, rest) {
 			return (await emailCancellationWithdraw({ path: { company } })).data;
 		});
 	}
-	throw new UsageError(USAGE$22);
+	throw new UsageError(USAGE$24);
 }
 /** `dmarc`: DMARC reporting for every attached name. */
 async function dmarc$1(context, rest) {
@@ -15467,7 +15500,7 @@ async function blocklist$1(context, rest) {
 }
 /** `dmarc-set <name> --enabled on|off`. */
 async function dmarcSet$1(context, rest) {
-	const emailDomainUuid = oneUuid$7(rest, USAGE$22);
+	const emailDomainUuid = oneUuid$7(rest, USAGE$24);
 	const company = await requireCompany(context.flags);
 	const enabled = onOff$3(context);
 	return await confirmableWrite(context, `${enabled ? "Enable" : "Disable"} DMARC reporting for this name.`, async () => {
@@ -15482,7 +15515,7 @@ async function dmarcSet$1(context, rest) {
 }
 /** `blocklist-set <name> --enabled on|off`. */
 async function blocklistSet(context, rest) {
-	const emailDomainUuid = oneUuid$7(rest, USAGE$22);
+	const emailDomainUuid = oneUuid$7(rest, USAGE$24);
 	const company = await requireCompany(context.flags);
 	const enabled = onOff$3(context);
 	return await confirmableWrite(context, `${enabled ? "Enable" : "Disable"} blocklist monitoring for this name.`, async () => {
@@ -15499,7 +15532,7 @@ async function blocklistSet(context, rest) {
 async function importSchema(context, rest) {
 	noExtra$11(rest);
 	const version = context.flags.get("--version")?.trim() ?? "";
-	if (version === "") throw new UsageError(`import-schema needs --version.\n\n${USAGE$22}`);
+	if (version === "") throw new UsageError(`import-schema needs --version.\n\n${USAGE$24}`);
 	return {
 		kind: "schema",
 		version,
@@ -15511,7 +15544,7 @@ function onOff$3(context) {
 	const raw = context.flags.get("--enabled")?.trim() ?? "";
 	if (raw === "on" || raw === "true") return true;
 	if (raw === "off" || raw === "false") return false;
-	throw new UsageError(`--enabled must be on or off (got "${raw}").\n\n${USAGE$22}`);
+	throw new UsageError(`--enabled must be on or off (got "${raw}").\n\n${USAGE$24}`);
 }
 /** The `email service|dmarc|blocklist|import-schema` renderer. */
 function emailServiceText(report) {
@@ -15524,7 +15557,7 @@ function emailServiceText(report) {
 //#endregion
 //#region src/commands/email-sync-csv.ts
 /** The usage this group refuses with, owned by the command it belongs to. */
-var USAGE$21 = [
+var USAGE$23 = [
 	"Usage: hostingctl email sync csv <preview|commit> <email-domain-uuid> --company <slug> --file <path>",
 	"",
 	"  preview  What the file's rows would become. Writes nothing.",
@@ -15535,7 +15568,7 @@ var USAGE$21 = [
 /** One named uuid, or a usage refusal. */
 function one$1(rest) {
 	const [uuid, ...extra] = rest;
-	if (uuid === void 0 || uuid === "" || extra.length > 0) throw new UsageError(USAGE$21);
+	if (uuid === void 0 || uuid === "" || extra.length > 0) throw new UsageError(USAGE$23);
 	return uuid;
 }
 /** `csv preview|commit <domain> --file <path>`: one multipart upload of the CSV itself. */
@@ -15543,7 +15576,7 @@ async function csv(context, tail) {
 	const [action, ...args] = tail;
 	const path = await domainPath(context, one$1(args));
 	const file = context.flags.get("--file") ?? "";
-	if (file === "") throw new UsageError(`sync csv needs --file <path>.\n\n${USAGE$21}`);
+	if (file === "") throw new UsageError(`sync csv needs --file <path>.\n\n${USAGE$23}`);
 	if (action === "preview") return {
 		kind: "csv-preview",
 		rows: (await emailMailboxSyncCsvPreview({
@@ -15551,10 +15584,10 @@ async function csv(context, tail) {
 			body: await csvPreviewBody(file)
 		})).data.rows
 	};
-	if (action !== "commit") throw new UsageError(USAGE$21);
+	if (action !== "commit") throw new UsageError(USAGE$23);
 	const recurrence = recurrenceFlag(context) ?? "once";
 	const endsAt = context.flags.get("--ends-at")?.trim() || null;
-	if (recurrence === "until" && endsAt === null) throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$21}`);
+	if (recurrence === "until" && endsAt === null) throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$23}`);
 	return await confirmableWrite(context, [`Commit the sync accounts in ${file}, once the API has reviewed it.`, `  The review is re-read here and only its accepted rows are committed: ${recurrence}${endsAt === null ? "" : ` until ${endsAt}`}.`].join("\n"), async () => {
 		const accepted = (await emailMailboxSyncCsvPreview({
 			path,
@@ -15603,7 +15636,7 @@ async function csvCommitBody(file, accepted, recurrence, endsAt) {
 }
 //#endregion
 //#region src/commands/email-sync.ts
-var USAGE$20 = [
+var USAGE$22 = [
 	"Usage: hostingctl email sync show <email-domain-uuid> --company <slug>",
 	"       hostingctl email sync server <email-domain-uuid> --company <slug> --host <host> --port <n> --encryption <tls|starttls>",
 	"       hostingctl email sync account add <email-domain-uuid> --company <slug> --username <login> (--password-file <path>|--password-stdin) --mailbox <uuid> --recurrence <once|until> [--ends-at <iso>]",
@@ -15628,12 +15661,12 @@ async function emailSync(context, rest) {
 	if (action === "server") return await server(context, tail);
 	if (action === "account") return await account(context, tail);
 	if (action === "csv") return await csv(context, tail);
-	throw new UsageError(USAGE$20);
+	throw new UsageError(USAGE$22);
 }
 /** One named uuid, or a usage refusal. */
 function one(rest) {
 	const [uuid, ...extra] = rest;
-	if (uuid === void 0 || uuid === "" || extra.length > 0) throw new UsageError(USAGE$20);
+	if (uuid === void 0 || uuid === "" || extra.length > 0) throw new UsageError(USAGE$22);
 	return uuid;
 }
 /** `show`: the server and every account. */
@@ -15649,9 +15682,9 @@ async function server(context, tail) {
 	const host = context.flags.get("--host")?.trim() ?? "";
 	const port = Number(context.flags.get("--port") ?? "");
 	const encryption = context.flags.get("--encryption")?.trim() ?? "";
-	if (host === "") throw new UsageError(`sync server needs --host.\n\n${USAGE$20}`);
-	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new UsageError(`--port must be a whole number between 1 and 65535.\n\n${USAGE$20}`);
-	if (!ENCRYPTIONS.has(encryption)) throw new UsageError(`--encryption must be tls or starttls (got "${encryption}").\n\n${USAGE$20}`);
+	if (host === "") throw new UsageError(`sync server needs --host.\n\n${USAGE$22}`);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new UsageError(`--port must be a whole number between 1 and 65535.\n\n${USAGE$22}`);
+	if (!ENCRYPTIONS.has(encryption)) throw new UsageError(`--encryption must be tls or starttls (got "${encryption}").\n\n${USAGE$22}`);
 	return await confirmableWrite(context, `Point the mailbox sync source at ${host}:${String(port)} over ${encryption}.`, async () => {
 		return (await emailMailboxSyncServerUpdate({
 			path,
@@ -15675,9 +15708,9 @@ async function account(context, tail) {
 	const [action, ...args] = tail;
 	if (action === "add") return await accountAdd(context, args);
 	if (action === "change") return await accountChange(context, args);
-	if (action === void 0) throw new UsageError(USAGE$20);
+	if (action === void 0) throw new UsageError(USAGE$22);
 	const [emailDomainUuid, accountUuid, ...extra] = args;
-	if (emailDomainUuid === void 0 || accountUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$20);
+	if (emailDomainUuid === void 0 || accountUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$22);
 	return await accountAction(context, action, {
 		...await domainPath(context, emailDomainUuid),
 		accountUuid
@@ -15696,13 +15729,13 @@ async function accountAction(context, action, path) {
 	if (action === "start") return await startAccount(context, path);
 	if (action === "stop") return await confirmableWrite(context, "Stop this account's scheduled sync. The source credential is kept.", async () => (await emailMailboxSyncAccountsStop({ path })).data);
 	if (action === "forget") return await confirmableWrite(context, "Forget this account's source credential and stop future work.", async () => (await emailMailboxSyncAccountsForget({ path })).data);
-	throw new UsageError(USAGE$20);
+	throw new UsageError(USAGE$22);
 }
 /** `start`: the schedule the account should run on from now. */
 async function startAccount(context, path) {
 	const recurrence = recurrenceFlag(context) ?? "once";
 	const endsAt = context.flags.get("--ends-at")?.trim() || null;
-	if (recurrence === "until" && endsAt === null) throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$20}`);
+	if (recurrence === "until" && endsAt === null) throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$22}`);
 	return await confirmableWrite(context, `Start this account's scheduled sync (${recurrence}${endsAt === null ? "" : ` until ${endsAt}`}).`, async () => (await emailMailboxSyncAccountsStart({
 		path,
 		body: {
@@ -15715,7 +15748,7 @@ async function startAccount(context, path) {
 async function accountAdd(context, args) {
 	const path = await domainPath(context, one(args));
 	const body = accountBody(context);
-	const sourcePassword = readSecret(context, "password", 4096, USAGE$20);
+	const sourcePassword = readSecret(context, "password", 4096, USAGE$22);
 	return await confirmableWrite(context, [`Add a sync account for ${body.sourceUsername} into mailbox ${body.mailboxUuid}.`, `  It runs ${body.recurrence === "once" ? "once" : `until ${String(body.endsAt)}`}.`].join("\n"), async () => (await emailMailboxSyncAccountsStore({
 		path,
 		body: {
@@ -15727,7 +15760,7 @@ async function accountAdd(context, args) {
 /** `account change <domain> <account> [fields]`: only the fields named are sent. */
 async function accountChange(context, args) {
 	const [emailDomainUuid, accountUuid, ...extra] = args;
-	if (emailDomainUuid === void 0 || accountUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$20);
+	if (emailDomainUuid === void 0 || accountUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$22);
 	const path = {
 		...await domainPath(context, emailDomainUuid),
 		accountUuid
@@ -15741,8 +15774,8 @@ async function accountChange(context, args) {
 	if (mailbox !== "") body.mailboxUuid = mailbox;
 	if (recurrence !== null) body.recurrence = recurrence;
 	if (endsAt !== "") body.endsAt = endsAt;
-	if (context.flags.has("--password-file") || context.flags.has("--password-stdin")) body.sourcePassword = readSecret(context, "password", 4096, USAGE$20);
-	if (Object.keys(body).length === 0) throw new UsageError(`account change needs at least one field.\n\n${USAGE$20}`);
+	if (context.flags.has("--password-file") || context.flags.has("--password-stdin")) body.sourcePassword = readSecret(context, "password", 4096, USAGE$22);
+	if (Object.keys(body).length === 0) throw new UsageError(`account change needs at least one field.\n\n${USAGE$22}`);
 	return await confirmableWrite(context, "Change this sync account.", async () => {
 		return (await emailMailboxSyncAccountsUpdate({
 			path,
@@ -15756,8 +15789,8 @@ function accountBody(context) {
 	const mailboxUuid = context.flags.get("--mailbox")?.trim() ?? "";
 	const recurrence = recurrenceFlag(context) ?? "once";
 	const endsAt = context.flags.get("--ends-at")?.trim() ?? "";
-	if (sourceUsername === "" || mailboxUuid === "") throw new UsageError(`account add needs --username and --mailbox.\n\n${USAGE$20}`);
-	if (recurrence === "until" && endsAt === "") throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$20}`);
+	if (sourceUsername === "" || mailboxUuid === "") throw new UsageError(`account add needs --username and --mailbox.\n\n${USAGE$22}`);
+	if (recurrence === "until" && endsAt === "") throw new UsageError(`--recurrence until needs --ends-at.\n\n${USAGE$22}`);
 	return {
 		sourceUsername,
 		mailboxUuid,
@@ -15774,7 +15807,7 @@ function recurrenceFlag(context) {
 }
 //#endregion
 //#region src/commands/email-text.ts
-var USAGE$19 = [
+var USAGE$21 = [
 	"Usage: hostingctl email <show|names> --company <slug>",
 	"       hostingctl email <mailboxes|aliases> <email-domain-uuid> --company <slug>",
 	"       hostingctl email mailbox <email-domain-uuid> <mailbox-uuid> --company <slug>",
@@ -15857,7 +15890,7 @@ function count(shown, total) {
 var EMAIL_METADATA = {
 	name: "email",
 	summary: "A company's email service, its attached names, their mailboxes and aliases.",
-	usage: USAGE$19,
+	usage: USAGE$21,
 	flags: [
 		{
 			name: "--address",
@@ -16037,75 +16070,75 @@ var EMAIL_METADATA = {
 var EMAIL_TOPICS = [
 	{
 		path: ["alias"],
-		usage: USAGE$27
+		usage: USAGE$29
 	},
 	{
 		path: ["app-token"],
-		usage: USAGE$26
+		usage: USAGE$28
 	},
 	{
 		path: ["send-as"],
-		usage: USAGE$26
+		usage: USAGE$28
 	},
 	{
 		path: ["offer"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["enroll"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["agree"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["provision"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["domain"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["catch-all"],
-		usage: USAGE$25
+		usage: USAGE$27
 	},
 	{
 		path: ["service"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["dmarc"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["dmarc-set"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["blocklist"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["blocklist-set"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["import-schema"],
-		usage: USAGE$22
+		usage: USAGE$24
 	},
 	{
 		path: ["sync"],
-		usage: USAGE$20
+		usage: USAGE$22
 	},
 	{
 		path: ["hold"],
-		usage: USAGE$24
+		usage: USAGE$26
 	},
 	{
 		path: ["mailbox"],
-		usage: USAGE$23
+		usage: USAGE$25
 	}
 ];
 //#endregion
@@ -16147,7 +16180,7 @@ async function companyRead(context, subcommand, rest) {
 	if (subcommand === "mailboxes") return await mailboxes(company, rest);
 	if (subcommand === "mailbox") return await mailbox(company, rest);
 	if (subcommand === "aliases") return await aliases(company, rest);
-	throw new UsageError(USAGE$19);
+	throw new UsageError(USAGE$21);
 }
 /** The renderer for a tagged feature read, or null when this command renders the answer itself. */
 function taggedText$1(report) {
@@ -16232,7 +16265,7 @@ var email$2 = {
 	...EMAIL_METADATA,
 	async run(context) {
 		const [subcommand, ...rest] = context.positional;
-		if (subcommand === void 0 || !SUBCOMMANDS.has(subcommand)) throw new UsageError(USAGE$19);
+		if (subcommand === void 0 || !SUBCOMMANDS.has(subcommand)) throw new UsageError(USAGE$21);
 		const feature = dispatched$1(context, subcommand, rest);
 		if (feature !== null) return await feature;
 		return await companyRead(context, subcommand, rest);
@@ -16317,7 +16350,7 @@ async function aliases(company, rest) {
 /** `mailbox <email-domain-uuid> <mailbox-uuid>`: one record, independent of index pagination. */
 async function mailbox(company, rest) {
 	const [emailDomainUuid, mailboxUuid, ...extra] = rest;
-	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$19);
+	if (emailDomainUuid === void 0 || mailboxUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$21);
 	return (await emailMailboxesShow({ path: {
 		company,
 		emailDomainUuid,
@@ -16327,16 +16360,16 @@ async function mailbox(company, rest) {
 /** The one uuid a collection read names, or a usage refusal. */
 function oneUuid$4(rest) {
 	const [uuid, ...extra] = rest;
-	if (uuid === void 0 || extra.length > 0) throw new UsageError(USAGE$19);
+	if (uuid === void 0 || extra.length > 0) throw new UsageError(USAGE$21);
 	return uuid;
 }
 /** A company-wide read takes no positional arguments. */
 function noExtra$10(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$19);
+	if (rest.length > 0) throw new UsageError(USAGE$21);
 }
 //#endregion
 //#region src/commands/environment-admin.ts
-var USAGE$18 = [
+var USAGE$20 = [
 	"Usage: hostingctl environment retention <environment-uuid> --company <slug>",
 	"       hostingctl environment retention-set <environment-uuid> --company <slug> --extra-days <n> --effective-at <iso> --agreement <uuid> [--package <key>]",
 	"       hostingctl environment database-show <environment-uuid> <database-uuid> --company <slug>",
@@ -16360,9 +16393,9 @@ async function environmentAdmin(context, subcommand, rest) {
 	if (subcommand === "retention") return await retention(context, first);
 	if (subcommand === "retention-set") return await retentionSet(context, first);
 	if (subcommand === "database-show" || subcommand === "database-reveal") {
-		if (first === void 0 || tail.length !== 1) throw new UsageError(USAGE$18);
+		if (first === void 0 || tail.length !== 1) throw new UsageError(USAGE$20);
 		const path = {
-			...await environmentPath(context, first, USAGE$18),
+			...await environmentPath(context, first, USAGE$20),
 			databaseUuid: tail[0] ?? ""
 		};
 		if (subcommand === "database-show") return {
@@ -16372,24 +16405,24 @@ async function environmentAdmin(context, subcommand, rest) {
 		return await revealDatabase(context, path);
 	}
 	if (subcommand === "tuning") return await tuning(context, first, tail);
-	throw new UsageError(USAGE$18);
+	throw new UsageError(USAGE$20);
 }
 /** `retention <env>`. */
 async function retention(context, environmentUuid) {
 	return {
 		kind: "retention",
-		retention: (await hostingRetentionShow({ path: await environmentPath(context, environmentUuid, USAGE$18) })).data
+		retention: (await hostingRetentionShow({ path: await environmentPath(context, environmentUuid, USAGE$20) })).data
 	};
 }
 /** `retention-set <env> --extra-days … --effective-at … --agreement …`. */
 async function retentionSet(context, environmentUuid) {
-	const path = await environmentPath(context, environmentUuid, USAGE$18);
+	const path = await environmentPath(context, environmentUuid, USAGE$20);
 	const extraDays = Number(context.flags.get("--extra-days") ?? "");
 	const effectiveAt = context.flags.get("--effective-at")?.trim() ?? "";
 	const baselineAgreementUuid = context.flags.get("--agreement")?.trim() ?? "";
-	if (!Number.isInteger(extraDays) || extraDays < 1) throw new UsageError(`retention-set needs --extra-days as a whole number of at least 1.\n\n${USAGE$18}`);
-	if (effectiveAt === "" || Number.isNaN(Date.parse(effectiveAt))) throw new UsageError(`retention-set needs --effective-at as an ISO date.\n\n${USAGE$18}`);
-	if (baselineAgreementUuid === "") throw new UsageError(`retention-set needs --agreement.\n\n${USAGE$18}`);
+	if (!Number.isInteger(extraDays) || extraDays < 1) throw new UsageError(`retention-set needs --extra-days as a whole number of at least 1.\n\n${USAGE$20}`);
+	if (effectiveAt === "" || Number.isNaN(Date.parse(effectiveAt))) throw new UsageError(`retention-set needs --effective-at as an ISO date.\n\n${USAGE$20}`);
+	if (baselineAgreementUuid === "") throw new UsageError(`retention-set needs --agreement.\n\n${USAGE$20}`);
 	const packageKey = context.flags.get("--package")?.trim();
 	return {
 		kind: "write",
@@ -16416,7 +16449,7 @@ async function revealDatabase(context, path) {
 /** `tuning preview|restore <env>`. */
 async function tuning(context, action, rest) {
 	const environmentUuid = rest[0];
-	const path = await environmentPath(context, environmentUuid, USAGE$18);
+	const path = await environmentPath(context, environmentUuid, USAGE$20);
 	if (action === "preview" && rest.length === 1) {
 		const body = (await hostingEnvironmentShow({ path })).data;
 		return {
@@ -16429,7 +16462,7 @@ async function tuning(context, action, rest) {
 	}
 	if (action === "restore" && rest.length === 1) {
 		const generation = Number(context.flags.get("--generation") ?? "");
-		if (!Number.isInteger(generation) || generation < 1) throw new UsageError(`tuning restore needs --generation.\n\n${USAGE$18}`);
+		if (!Number.isInteger(generation) || generation < 1) throw new UsageError(`tuning restore needs --generation.\n\n${USAGE$20}`);
 		return {
 			kind: "write",
 			outcome: await confirmableWrite(context, `Restore the recorded tuning for generation ${String(generation)}.`, async () => (await hostingTuningRestore({
@@ -16438,7 +16471,7 @@ async function tuning(context, action, rest) {
 			})).data)
 		};
 	}
-	throw new UsageError(USAGE$18);
+	throw new UsageError(USAGE$20);
 }
 /** One retention window as one line, and the write receipt for it. */
 function retentionText(one) {
@@ -16482,6 +16515,37 @@ function environmentAdminText(report) {
 	return tuningText(report.tuning);
 }
 //#endregion
+//#region src/commands/environment-component-version.ts
+var USAGE$19 = [
+	"Usage: hostingctl environment component-version <environment-uuid> <workload-uuid> <version> --company <slug>",
+	"",
+	"  component-version  Move one curated component instance to another version this platform pins an image",
+	"                     for (Infisical, Supabase auth/rest/realtime).",
+	"",
+	"The version must be one the platform pins an image for; anything else is refused by name rather than falling",
+	"back to the pin. The answer names the image the instance will now run, so it can be checked against a manifest",
+	"instead of trusted. This never touches the component's material: an upgrade must not mint a new signing secret."
+].join("\n");
+/**
+* `environment component-version <uuid> <workload-uuid> <version>`: move ONE instance to another pinned version.
+*
+* The alternative was writing the recorded version into the database by hand, which the platform's own rules forbid: a
+* version change is a product operation with a refusal, an answer and a reconcile attached.
+*/
+async function environmentComponentVersion(context, rest) {
+	const [uuid, workloadUuid, version, ...extra] = rest;
+	if (uuid === void 0 || workloadUuid === void 0 || version === void 0 || extra.length > 0) throw new UsageError(USAGE$19);
+	const path = {
+		company: await requireCompany(context.flags),
+		environmentUuid: uuid,
+		workloadUuid
+	};
+	return await confirmableWrite(context, `Move the curated component ${workloadUuid} in environment ${uuid} to version ${version}.`, async () => (await hostingApplicationsVersion({
+		path,
+		body: { version }
+	})).data);
+}
+//#endregion
 //#region src/commands/environment-configuration.ts
 var CONFIGURATION_USAGE = [
 	"Usage: hostingctl environment configuration show <environment-uuid> --company <slug>",
@@ -16615,7 +16679,7 @@ function oneUuid$3(rest) {
 }
 //#endregion
 //#region src/commands/environment-create.ts
-var USAGE$17 = [
+var USAGE$18 = [
 	"Usage: hostingctl environment create --company <slug> --name <name> [--slug <slug>] [--package <key>]",
 	"",
 	"The package is one of the keys this environment's catalog offers; the platform chooses the placement,",
@@ -16623,16 +16687,16 @@ var USAGE$17 = [
 ].join("\n");
 /** `environment create --name … [--slug …] [--package …]`: a new environment from a platform package. */
 async function create$2(context, rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$17);
+	if (rest.length > 0) throw new UsageError(USAGE$18);
 	const name = context.flags.get("--name")?.trim() ?? "";
-	if (name === "") throw new UsageError(`create needs --name.\n\n${USAGE$17}`);
-	const slug = slugFor(context.flags.get("--slug"), name, USAGE$17);
+	if (name === "") throw new UsageError(`create needs --name.\n\n${USAGE$18}`);
+	const slug = slugFor(context.flags.get("--slug"), name, USAGE$18);
 	const company = await requireCompany(context.flags);
 	const packages = (await hostingEnvironmentPackagesIndex({ path: { company } })).data;
 	const offered = packages.map((one) => one.key).join(", ");
 	const requested = context.flags.get("--package")?.trim() ?? "";
 	const chosen = requested === "" ? packages[0] : packages.find((one) => one.key === requested);
-	if (chosen === void 0) throw new UsageError(`--package must be one of ${offered} (got ${requested}).\n\n${USAGE$17}`);
+	if (chosen === void 0) throw new UsageError(`--package must be one of ${offered} (got ${requested}).\n\n${USAGE$18}`);
 	const resourceProfile = chosen.key;
 	return await confirmableWrite(context, describeCreate$1(name, slug, chosen.key), async () => {
 		return (await hostingEnvironmentStore({
@@ -16982,7 +17046,7 @@ function oneUuid$2(rest) {
 }
 //#endregion
 //#region src/commands/environment-domains.ts
-var USAGE$16 = [
+var USAGE$17 = [
 	"Usage: hostingctl environment domains <environment-uuid> --company <slug>",
 	"       hostingctl environment domain-add <environment-uuid> --company <slug> --hostname <host> --workload <uuid> [--intended on|off]",
 	"       hostingctl environment domain-verify|domain-check-routing|domain-intended|domain-primary|domain-remove <environment-uuid> <domain-uuid> --company <slug>",
@@ -17013,7 +17077,7 @@ var DOMAIN_ACTIONS = {
 /** `environment domains|domain-add|domain-*|redirects|redirect-set|redirect-remove`. */
 async function environmentDomains(context, subcommand, rest) {
 	const [environmentUuid, ...tail] = rest;
-	const path = await environmentPath(context, environmentUuid, USAGE$16);
+	const path = await environmentPath(context, environmentUuid, USAGE$17);
 	if (subcommand === "domains") return await domains(path, tail);
 	if (subcommand === "redirects") return await redirects(path, tail);
 	if (subcommand === "domain-add") return await add$5(context, path, tail);
@@ -17022,7 +17086,7 @@ async function environmentDomains(context, subcommand, rest) {
 	if (subcommand === "domain-remove") return await removeDomain(context, path, tail);
 	const action = DOMAIN_ACTIONS[subcommand];
 	if (action !== void 0) return await domainAction(context, subcommand, action, path, tail);
-	throw new UsageError(USAGE$16);
+	throw new UsageError(USAGE$17);
 }
 /** `domains <env>`. */
 async function domains(path, rest) {
@@ -17045,7 +17109,7 @@ async function add$5(context, path, rest) {
 	noExtra$9(rest);
 	const hostname = context.flags.get("--hostname")?.trim().toLowerCase() ?? "";
 	const workloadUuid = context.flags.get("--workload")?.trim() ?? "";
-	if (hostname === "" || workloadUuid === "") throw new UsageError(`domain-add needs --hostname and --workload.\n\n${USAGE$16}`);
+	if (hostname === "" || workloadUuid === "") throw new UsageError(`domain-add needs --hostname and --workload.\n\n${USAGE$17}`);
 	const intended = onOffFlag(context, "--intended") ?? false;
 	return await written$2(confirmableWrite(context, `Serve ${hostname} from workload ${workloadUuid}${intended ? " as an intended name" : ""}.`, async () => {
 		return (await hostingDomainStore({
@@ -17061,7 +17125,7 @@ async function add$5(context, path, rest) {
 /** The five actions that take only the environment and the name. */
 async function domainAction(context, subcommand, action, path, rest) {
 	const [domainUuid, ...extra] = rest;
-	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$16);
+	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$17);
 	const described = {
 		"domain-verify": "Check this name's routing now.",
 		"domain-check-routing": "Check this name's routing now.",
@@ -17079,7 +17143,7 @@ async function domainAction(context, subcommand, action, path, rest) {
 /** `domain-remove <env> <domain>`: stop serving a name. */
 async function removeDomain(context, path, rest) {
 	const [domainUuid, ...extra] = rest;
-	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$16);
+	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$17);
 	const fallBackToGenerated = onOffFlag(context, "--fall-back-to-generated") ?? true;
 	return await written$2(confirmableWrite(context, "Stop serving this name. Its record stays readable, and the environment keeps its generated hostname.", async () => {
 		const body = { fallBackToGenerated };
@@ -17095,13 +17159,13 @@ async function removeDomain(context, path, rest) {
 /** `redirect-set <env> <domain> --target … --mode … [--destination …]`. */
 async function setRedirect(context, path, rest) {
 	const [domainUuid, ...extra] = rest;
-	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$16);
+	if (domainUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$17);
 	const target = context.flags.get("--target")?.trim() ?? "";
 	const mode = context.flags.get("--mode")?.trim() ?? "";
 	const destinationUrl = context.flags.get("--destination")?.trim() ?? "";
-	if (!TARGETS.has(target)) throw new UsageError(`--target must be application or fixed.\n\n${USAGE$16}`);
-	if (!MODES$1.has(mode)) throw new UsageError(`--mode must be temporary or permanent.\n\n${USAGE$16}`);
-	if (target === "fixed" && destinationUrl === "") throw new UsageError(`--target fixed needs --destination <url>.\n\n${USAGE$16}`);
+	if (!TARGETS.has(target)) throw new UsageError(`--target must be application or fixed.\n\n${USAGE$17}`);
+	if (!MODES$1.has(mode)) throw new UsageError(`--mode must be temporary or permanent.\n\n${USAGE$17}`);
+	if (target === "fixed" && destinationUrl === "") throw new UsageError(`--target fixed needs --destination <url>.\n\n${USAGE$17}`);
 	return await written$2(confirmableWrite(context, [`Redirect this name ${mode} to ${target === "fixed" ? destinationUrl : "its application"}.`, "  The redirect activates once the source name's DNS resolves."].join("\n"), async () => {
 		const body = {
 			target,
@@ -17121,7 +17185,7 @@ async function setRedirect(context, path, rest) {
 /** `redirect-remove <env> <redirect-uuid>`. */
 async function removeRedirect(context, path, rest) {
 	const [redirectUuid, ...extra] = rest;
-	if (redirectUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$16);
+	if (redirectUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$17);
 	return await written$2(confirmableWrite(context, `Remove redirect ${redirectUuid}.`, async () => {
 		return (await hostingDomainRedirectDestroy({ path: {
 			...path,
@@ -17138,11 +17202,11 @@ async function written$2(pending) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$9(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$16);
+	if (rest.length > 0) throw new UsageError(USAGE$17);
 }
 //#endregion
 //#region src/commands/environment-exports.ts
-var USAGE$15 = [
+var USAGE$16 = [
 	"Usage: hostingctl environment database-exports <environment-uuid> --company <slug>",
 	"       hostingctl environment database-export-create <environment-uuid> <database-uuid> --company <slug>",
 	"       hostingctl environment database-export-download <environment-uuid> <export-uuid> --company <slug>",
@@ -17162,7 +17226,7 @@ var USAGE$15 = [
 async function environmentExports(context, subcommand, rest) {
 	if (subcommand === "release-bundle") {
 		const [releaseUuid, ...extra] = rest;
-		if (releaseUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$15);
+		if (releaseUuid === void 0 || extra.length > 0) throw new UsageError(USAGE$16);
 		return {
 			kind: "bundle",
 			releaseUuid,
@@ -17170,7 +17234,7 @@ async function environmentExports(context, subcommand, rest) {
 		};
 	}
 	const [environmentUuid, ...tail] = rest;
-	const path = await environmentPath(context, environmentUuid, USAGE$15);
+	const path = await environmentPath(context, environmentUuid, USAGE$16);
 	if (subcommand === "database-exports") {
 		noExtra$8(tail);
 		return {
@@ -17181,11 +17245,11 @@ async function environmentExports(context, subcommand, rest) {
 	if (subcommand === "database-export-create") return await create(context, path, tail);
 	if (subcommand === "database-export-download") return await download(path, tail);
 	if (subcommand === "database-export-remove") return await remove$1(context, path, tail);
-	throw new UsageError(USAGE$15);
+	throw new UsageError(USAGE$16);
 }
 /** `database-export-create <env> <db>`. */
 async function create(context, path, rest) {
-	const databaseUuid = oneUuid$7(rest, USAGE$15);
+	const databaseUuid = oneUuid$7(rest, USAGE$16);
 	return {
 		kind: "export-write",
 		outcome: await confirmableWrite(context, "Take a portable export of this database now. It is downloadable until its expiry.", async () => {
@@ -17201,7 +17265,7 @@ async function create(context, path, rest) {
 }
 /** `database-export-download <env> <export>`: a time-limited URL, which is the customer's copy. */
 async function download(path, rest) {
-	const exportUuid = oneUuid$7(rest, USAGE$15);
+	const exportUuid = oneUuid$7(rest, USAGE$16);
 	return {
 		kind: "download",
 		download: (await hostingDatabaseExportDownload({ path: {
@@ -17212,7 +17276,7 @@ async function download(path, rest) {
 }
 /** `database-export-remove <env> <export>`. */
 async function remove$1(context, path, rest) {
-	const exportUuid = oneUuid$7(rest, USAGE$15);
+	const exportUuid = oneUuid$7(rest, USAGE$16);
 	return {
 		kind: "export-write",
 		outcome: await confirmableWrite(context, `Retire export ${exportUuid}. Its URL stops working once it is gone.`, async () => (await hostingDatabaseExportDestroy({ path: {
@@ -17223,7 +17287,7 @@ async function remove$1(context, path, rest) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$8(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$15);
+	if (rest.length > 0) throw new UsageError(USAGE$16);
 }
 /** One export as one line. */
 function exportLine(one) {
@@ -17495,7 +17559,7 @@ function oneUuid$1(rest) {
 }
 //#endregion
 //#region src/commands/environment-services.ts
-var USAGE$14 = [
+var USAGE$15 = [
 	"Usage: hostingctl environment service-add-review <environment-uuid> <type> --company <slug> [--name <n>] [--replicas <n>]",
 	"       hostingctl environment service-add <environment-uuid> <type> --company <slug> --name <n> [--replicas <n>]",
 	"       hostingctl environment service-runtime <environment-uuid> <type> --company <slug> --running <on|off>",
@@ -17524,8 +17588,8 @@ var SERVICE_TYPES = /* @__PURE__ */ new Set([
 /** `environment service-*`, from the `environment` command. */
 async function environmentServices(context, subcommand, rest) {
 	const [environmentUuid, type, ...tail] = rest;
-	const path = await environmentPath(context, environmentUuid, USAGE$14);
-	if (type === void 0 || type === "" || tail.length > 0) throw new UsageError(USAGE$14);
+	const path = await environmentPath(context, environmentUuid, USAGE$15);
+	if (type === void 0 || type === "" || tail.length > 0) throw new UsageError(USAGE$15);
 	if (subcommand === "service-add-review") return await reviewAddition(context, path, type);
 	if (subcommand === "service-retirement") return {
 		kind: "service-retirement",
@@ -17538,7 +17602,7 @@ async function environmentServices(context, subcommand, rest) {
 	if (subcommand === "service-runtime") return await runtime$1(context, path, type);
 	if (subcommand === "service-protect") return await protect(context, path, type);
 	if (subcommand === "service-retire") return await retire(context, path, type);
-	throw new UsageError(USAGE$14);
+	throw new UsageError(USAGE$15);
 }
 /** `service-add-review <type> [--name …] [--replicas …]`. */
 async function reviewAddition(context, path, type) {
@@ -17561,9 +17625,9 @@ async function reviewAddition(context, path, type) {
 /** `service-add <type> --name … [--replicas …]`. */
 async function add$4(context, path, type) {
 	const name = context.flags.get("--name")?.trim() ?? "";
-	if (name === "") throw new UsageError(`service-add needs --name.\n\n${USAGE$14}`);
+	if (name === "") throw new UsageError(`service-add needs --name.\n\n${USAGE$15}`);
 	const replicas = wholeNumber(context, "--replicas") ?? 1;
-	if (!SERVICE_TYPES.has(type)) throw new UsageError(`--type must be one of ${[...SERVICE_TYPES].join(", ")} (got "${type}").\n\n${USAGE$14}`);
+	if (!SERVICE_TYPES.has(type)) throw new UsageError(`--type must be one of ${[...SERVICE_TYPES].join(", ")} (got "${type}").\n\n${USAGE$15}`);
 	const serviceType = type;
 	return await written$1(confirmableWrite(context, `Add the ${type} service "${name}" with ${String(replicas)} replica(s).`, async () => {
 		const desiredGeneration = await environmentGeneration(path);
@@ -17580,7 +17644,7 @@ async function add$4(context, path, type) {
 }
 /** `service-runtime <type> --running …`. */
 async function runtime$1(context, path, type) {
-	const running = onOff$5(context, "--running", USAGE$14);
+	const running = onOff$5(context, "--running", USAGE$15);
 	return await written$1(confirmableWrite(context, `${running ? "Start" : "Stop"} the ${type} service. Its data is kept either way.`, async () => {
 		const desiredGeneration = await environmentGeneration(path);
 		const body = {
@@ -17598,7 +17662,7 @@ async function runtime$1(context, path, type) {
 }
 /** `service-protect <type> --locked …`. */
 async function protect(context, path, type) {
-	const locked = onOff$5(context, "--locked", USAGE$14);
+	const locked = onOff$5(context, "--locked", USAGE$15);
 	return await written$1(confirmableWrite(context, locked ? `Lock the ${type} service, so no removal path may delete it.` : `Unlock the ${type} service.`, async () => {
 		const desiredGeneration = await environmentGeneration(path);
 		const body = {
@@ -17617,7 +17681,7 @@ async function protect(context, path, type) {
 /** `service-retire <type> --digest …`: the review's digest is the confirmation. */
 async function retire(context, path, type) {
 	const digest = context.flags.get("--digest")?.trim() ?? "";
-	if (digest === "") throw new UsageError(`service-retire needs --digest.\n\n${USAGE$14}`);
+	if (digest === "") throw new UsageError(`service-retire needs --digest.\n\n${USAGE$15}`);
 	return await written$1(confirmableWrite(context, [`Request the retirement of the ${type} service.`, "  The digest binds this request to the review it was made against."].join("\n"), async () => {
 		const desiredGeneration = await environmentGeneration(path);
 		const body = {
@@ -17645,7 +17709,7 @@ function wholeNumber(context, flag) {
 	const raw = context.flags.get(flag)?.trim() ?? "";
 	if (raw === "") return null;
 	const value = Number(raw);
-	if (!Number.isInteger(value) || value < 1) throw new UsageError(`${flag} must be a whole number of at least 1 (got ${raw}).\n\n${USAGE$14}`);
+	if (!Number.isInteger(value) || value < 1) throw new UsageError(`${flag} must be a whole number of at least 1 (got ${raw}).\n\n${USAGE$15}`);
 	return value;
 }
 /** The write receipt, by the shape the API answered with. */
@@ -17683,7 +17747,7 @@ function environmentServicesText(report) {
 }
 //#endregion
 //#region src/commands/environment-shared.ts
-var USAGE$13 = [
+var USAGE$14 = [
 	"Usage: hostingctl environment shared-runtime <environment-uuid> --company <slug>",
 	"       hostingctl environment shared-runtime-adopt|shared-runtime-release <environment-uuid> --company <slug>",
 	"       hostingctl environment shared-app <environment-uuid> --company <slug>",
@@ -17700,7 +17764,7 @@ var USAGE$13 = [
 /** `environment shared-runtime|shared-app|shared-adopt`, from the `environment` command. */
 async function environmentShared(context, subcommand, rest) {
 	const [environmentUuid, ...tail] = rest;
-	const path = await environmentPath(context, environmentUuid, USAGE$13);
+	const path = await environmentPath(context, environmentUuid, USAGE$14);
 	noExtra$7(tail);
 	if (subcommand === "shared-runtime") return {
 		kind: "shared-runtime",
@@ -17715,7 +17779,7 @@ async function environmentShared(context, subcommand, rest) {
 	if (subcommand === "shared-app-adopt") return await app(context, "adopt", path);
 	if (subcommand === "shared-app-release") return await app(context, "release", path);
 	if (subcommand === "shared-adopt") return await environment$1(context, path);
-	throw new UsageError(USAGE$13);
+	throw new UsageError(USAGE$14);
 }
 /** `shared-runtime-adopt|release`: one runtime, adopted or given back. */
 async function runtime(context, kind, path) {
@@ -17743,7 +17807,7 @@ async function environment$1(context, path) {
 }
 /** No positional arguments, or a usage refusal. */
 function noExtra$7(rest) {
-	if (rest.length > 0) throw new UsageError(USAGE$13);
+	if (rest.length > 0) throw new UsageError(USAGE$14);
 }
 /** The line shared by both shared states: adopted, with whom, and the ceiling it lives inside. */
 function sharedLine(one) {
@@ -17767,7 +17831,7 @@ function environmentSharedText(report) {
 }
 //#endregion
 //#region src/commands/environment-site-access.ts
-var USAGE$12 = [
+var USAGE$13 = [
 	"Usage: hostingctl environment site-access <environment-uuid> --company <slug>",
 	"       hostingctl environment site-access-set <environment-uuid> --company <slug> --sign-in <on|off> [--audience <name>]",
 	"       hostingctl environment site-users <environment-uuid> --company <slug>",
@@ -17813,16 +17877,16 @@ var flow = siteAccessFlow({
 	refresh: async (path) => (await hostingSiteAccessUsersRefresh({ path })).data,
 	destroy: async (path) => (await hostingSiteAccessUsersDestroy({ path })).data,
 	rotate: null
-}, USAGE$12);
+}, USAGE$13);
 /** `environment site-access*|site-user*`: resolve the environment, then run the shared flow. */
 async function environmentSiteAccess(context, action, rest) {
 	const [environmentUuid, ...tail] = rest;
-	if (environmentUuid === void 0 || environmentUuid === "") throw new UsageError(USAGE$12);
-	return await flow(context, action, await environmentPath(context, environmentUuid, USAGE$12), tail);
+	if (environmentUuid === void 0 || environmentUuid === "") throw new UsageError(USAGE$13);
+	return await flow(context, action, await environmentPath(context, environmentUuid, USAGE$13), tail);
 }
 //#endregion
 //#region src/commands/environment-tools.ts
-var USAGE$11 = [
+var USAGE$12 = [
 	"Usage: hostingctl environment tools verify <environment-uuid> <tool> --company <slug>",
 	"       hostingctl environment tools select <environment-uuid> <tool> --company <slug> --enabled <on|off>",
 	"",
@@ -17836,8 +17900,8 @@ var USAGE$11 = [
 /** `environment tools verify|select`. */
 async function environmentTools(context, rest) {
 	const [action, environmentUuid, tool, ...extra] = rest;
-	if (action === void 0 || tool === void 0 || extra.length > 0) throw new UsageError(USAGE$11);
-	const path = await environmentPath(context, environmentUuid, USAGE$11);
+	if (action === void 0 || tool === void 0 || extra.length > 0) throw new UsageError(USAGE$12);
+	const path = await environmentPath(context, environmentUuid, USAGE$12);
 	if (action === "verify") return {
 		kind: "tool",
 		tool,
@@ -17847,11 +17911,11 @@ async function environmentTools(context, rest) {
 		} })).data
 	};
 	if (action === "select") return await select$1(context, path, tool);
-	throw new UsageError(USAGE$11);
+	throw new UsageError(USAGE$12);
 }
 /** `select --enabled …`: one tool's presence, echoed with the environment's generation. */
 async function select$1(context, path, tool) {
-	const enabled = onOff$5(context, "--enabled", USAGE$11);
+	const enabled = onOff$5(context, "--enabled", USAGE$12);
 	return {
 		kind: "tools-write",
 		outcome: await confirmableWrite(context, `${enabled ? "Enable" : "Disable"} the ${tool} tool for this environment.`, async () => {
@@ -17971,23 +18035,23 @@ function list$3(values) {
 var ENVIRONMENT_TOPICS = [
 	{
 		path: ["retention"],
-		usage: USAGE$18
+		usage: USAGE$20
 	},
 	{
 		path: ["retention-set"],
-		usage: USAGE$18
+		usage: USAGE$20
 	},
 	{
 		path: ["database-show"],
-		usage: USAGE$18
+		usage: USAGE$20
 	},
 	{
 		path: ["database-reveal"],
-		usage: USAGE$18
+		usage: USAGE$20
 	},
 	{
 		path: ["tuning"],
-		usage: USAGE$18
+		usage: USAGE$20
 	},
 	{
 		path: ["configuration"],
@@ -18011,144 +18075,142 @@ var ENVIRONMENT_TOPICS = [
 	},
 	{
 		path: ["domains"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-add"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-verify"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-check-routing"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-intended"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-primary"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["domain-remove"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["redirects"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["redirect-set"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["redirect-remove"],
-		usage: USAGE$16
+		usage: USAGE$17
 	},
 	{
 		path: ["database-exports"],
-		usage: USAGE$15
+		usage: USAGE$16
 	},
 	{
 		path: ["database-export-create"],
-		usage: USAGE$15
+		usage: USAGE$16
 	},
 	{
 		path: ["database-export-download"],
-		usage: USAGE$15
+		usage: USAGE$16
 	},
 	{
 		path: ["database-export-remove"],
-		usage: USAGE$15
+		usage: USAGE$16
 	},
 	{
 		path: ["release-bundle"],
-		usage: USAGE$15
+		usage: USAGE$16
 	},
 	{
 		path: ["service-add-review"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["service-add"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["service-runtime"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["service-protect"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["service-retirement"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["service-retire"],
-		usage: USAGE$14
+		usage: USAGE$15
 	},
 	{
 		path: ["shared-runtime"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-runtime-adopt"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-runtime-release"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-app"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-app-adopt"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-app-release"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["shared-adopt"],
-		usage: USAGE$13
+		usage: USAGE$14
 	},
 	{
 		path: ["site-access"],
-		usage: USAGE$12
+		usage: USAGE$13
 	},
 	{
 		path: ["site-access-set"],
-		usage: USAGE$12
+		usage: USAGE$13
 	},
 	{
 		path: ["site-users"],
-		usage: USAGE$12
+		usage: USAGE$13
 	},
 	{
 		path: ["site-user"],
-		usage: USAGE$12
+		usage: USAGE$13
 	},
 	{
 		path: ["tools"],
-		usage: USAGE$11
+		usage: USAGE$12
 	}
 ];
 //#endregion
 //#region src/commands/environment-metadata.ts
 /**
-* `environment` — creating an environment, reading one, and the writes that change it.
-*
-* The usage text moves here from the command module, so the description of the command and the command
-* itself hold one copy of it between them.
+* `environment` — creating an environment, reading one, and the writes that change it. The usage text moves here
+* from the command module, so the description of the command and the command itself hold one copy of it between them.
 */
 var ENVIRONMENT_USAGE = [
 	"Usage: hostingctl environment create --company <slug> --name <name> [--slug <slug>] [--package <key>]",
@@ -18159,6 +18221,8 @@ var ENVIRONMENT_USAGE = [
 	"       hostingctl environment configuration <show|preview|save|apply> <uuid> --company <slug> [--file <path>]",
 	"       hostingctl environment secret <write|import|local> <uuid> --company <slug> …",
 	"       hostingctl environment databases|database <uuid> … --company <slug>",
+	"       hostingctl environment component-version <uuid> <workload-uuid> <version> --company <slug>",
+	"       hostingctl environment references <uuid> --company <slug>",
 	"",
 	"  create        Create an environment from a platform package; the platform chooses the placement.",
 	"  show          One environment in detail, including the status the listing does not carry.",
@@ -18171,9 +18235,13 @@ var ENVIRONMENT_USAGE = [
 	"                 declarations' local development values for a local run.",
 	"  databases     List the environment-owned databases, declare one, replace who may consume it, or retire",
 	"                one while retaining its data and its backups.",
+	"  component-version  Move one curated component instance to another version this platform pins an image for.",
+	"  references    Every producer a configuration document for this environment may reference, the kind each",
+	"                is written as, and the fields each admits: the key goes in the shape's first slot, the field",
+	"                in `field`, and a credential field is marked rather than valued.",
 	"",
-	"The writes (create, reconcile, scale, portable prepare/confirm, configuration save/apply, secret write/import,",
-	"database create/bind/retire) need --confirm; --dry-run describes the change without making it.",
+	"The writes (create, reconcile, scale, component-version, portable prepare/confirm, configuration save/apply,",
+	"secret write/import, database create/bind/retire) need --confirm; --dry-run describes the change without making it.",
 	"",
 	"`secret local` is the one exception and is a read: it writes each declaration's local development value - a",
 	"development default such as `password`, not a credential - into an env file for a local run, names the declared",
@@ -18392,6 +18460,8 @@ var ENVIRONMENT_METADATA = {
 		"secret",
 		"databases",
 		"database",
+		"component-version",
+		"references",
 		"retention",
 		"retention-set",
 		"database-show",
@@ -18433,6 +18503,33 @@ var ENVIRONMENT_METADATA = {
 	]
 };
 //#endregion
+//#region src/commands/environment-references.ts
+var USAGE$11 = [
+	"Usage: hostingctl environment references <environment-uuid> --company <slug>",
+	"",
+	"  references  Every producer a configuration document for this environment may reference, the kind",
+	"              each is written as, and the fields each admits.",
+	"",
+	"A producer's key is what goes in its shape's first slot and a field is what goes in `field`. A producer with",
+	"no fields is written without one: {secret: app_token}, {redis: cache}. A field marked (credential) hands",
+	"over a secret when it is read, so it is named here and never printed."
+].join("\n");
+/**
+* `environment references <uuid>`: what a document here may reference, and what each producer admits.
+*
+* The directory is the platform's own projection of the document's secrets and databases, the cache
+* contract and the workloads this environment runs, so this command answers discovery without restating any
+* of those vocabularies and without resolving a single value.
+*/
+async function environmentReferences(context, rest) {
+	const [uuid, ...extra] = rest;
+	if (uuid === void 0 || extra.length > 0) throw new UsageError(USAGE$11);
+	return (await hostingEnvironmentsReferences({ path: {
+		company: await requireCompany(context.flags),
+		environmentUuid: uuid
+	} })).data;
+}
+//#endregion
 //#region src/commands/environment-configuration-text.ts
 /**
 * The phrases the platform writes when the cluster itself answered that it cannot run an engine.
@@ -18482,6 +18579,12 @@ function configurationPageText(page) {
 	lines.push(...revisionLines("known good", page.knownGoodRevision));
 	return lines.join("\n");
 }
+/**
+* One revision's line and the secrets it declares.
+*
+* The page carries one revision in full and names the others, so both shapes are read by the same
+* printing: every field here is one the reference carries too, and the document is not printed.
+*/
 function revisionLines(label, revision) {
 	if (revision === null) return [`  ${label}  none`];
 	const lines = [`  ${label}  ${revision.origin}  ${revision.applied ? "applied" : "draft"}  ${revision.configHash}`];
@@ -18549,6 +18652,7 @@ function taggedText(report) {
 function environmentText(report) {
 	if ("kind" in report) return taggedText(report);
 	if ("sent" in report) return renderWriteOutcome(report, outcomeOf$1);
+	if ("producers" in report) return referenceDirectoryText(report);
 	if ("configuration" in report) return configurationPreviewText(report);
 	if ("canManage" in report && "revision" in report) return configurationPageText(report);
 	if ("canManage" in report && "databases" in report) return databasePageText(report);
@@ -18568,6 +18672,28 @@ function environmentText(report) {
 		`  layout     ${report.applicationLayout}`
 	].join("\n");
 }
+/**
+* The reference directory: one line per producer — its kind, its key, then what may be read from it.
+*
+* A field a read hands a credential over is marked rather than valued, so this renderer cannot print one even
+* if a later payload carried it. A producer with no fields says so and shows the shape it is written with,
+* because "which producer" and "which field" are the two questions a customer actually asks.
+*/
+function referenceDirectoryText(directory) {
+	if (directory.producers.length === 0) return "No producers: a configuration document for this environment may not reference anything yet.";
+	return [
+		`Producers a configuration document for this environment may reference (${String(directory.producers.length)}):`,
+		...directory.producers.map((one) => referenceProducerLine(one)),
+		"",
+		"A (credential) field hands over a secret when it is read, so it is named here and never printed. Write the",
+		"producer's key in the shape's first slot and the field in `field`."
+	].join("\n");
+}
+/** One producer on one line: the kind, the key, then every field it admits. */
+function referenceProducerLine(producer) {
+	const fields = producer.fields.length === 0 ? `no field (write {${producer.kind}: ${producer.key}})` : producer.fields.map((field) => field.secret ? `${field.name} (credential)` : field.name).join(", ");
+	return `  ${producer.kind} ${producer.key} — ${fields}`;
+}
 /** The last observation that was an actual reconcile, or that none is retained. Never derived here. */
 function lastReconcile(data) {
 	if (data === null) return "none observed";
@@ -18575,6 +18701,7 @@ function lastReconcile(data) {
 }
 /** A write's answer: the environment, the configuration page, the database, or a retirement. */
 function outcomeOf$1(result) {
+	if ("previous" in result) return componentVersionText(result);
 	if ("revision" in result && "environmentUuid" in result) return configurationPageText(result);
 	if ("prepared" in result) return portablePreparationText(result);
 	if ("message" in result) return portableResultText(result);
@@ -18582,6 +18709,10 @@ function outcomeOf$1(result) {
 	if ("databaseName" in result) return databaseText(result);
 	return `  status ${result.status.status}  generation ${String(result.desiredGeneration)}`;
 }
+/** A curated component's move: the version it left, the version it now runs, and that version's image. */
+function componentVersionText(data) {
+	return [`  version ${data.previous} → ${data.version}`, `  image   ${data.image}`].join("\n");
+}
 /**
 * The three states, each named for what it means rather than for the comparison: an environment that never
 * adopted the shared set is not participating, not incomplete, and the difference is the whole reason the
@@ -26051,6 +26182,7 @@ var hostingDatabaseDataSchema = object({
 	userName: string(),
 	engine: hostingWorkloadEnumSchema,
 	configurationKey: string().nullable(),
+	extensions: array(string()).nullable().describe("PostgreSQL extensions this identity has enabled. Exposed so a screen can show what the database already loads and keep it when the identity is\nre-declared: a document that silently omitted them would turn a rebind into a removal."),
 	grants: dataCollectionSchema,
 	retirement: union([hostingDatabaseRetirementDataSchema, _null()])
 });
@@ -26644,6 +26776,11 @@ var hostingClusterDataSchema = object({
 	name: string(),
 	baseDomain: string()
 });
+object({
+	previous: string(),
+	version: string(),
+	image: string()
+});
 var hostingConfigurationSourceDataSchema = object({ root: string() });
 var hostingConfigurationEnvironmentDataSchema = object({
 	name: string(),
@@ -26748,7 +26885,8 @@ var hostingConfigurationDatabaseDataSchema = object({
 	engine: string(),
 	application: string().nullable(),
 	bindings: array(string()),
-	server: string().nullable().describe("The server this database belongs to, when the environment runs more than one of its engine. Absent, the engine's single server is resolved as before. An environment may run a second\nserver of an engine because the client asked for one (`DEDICATED`), and then the database\nmust say which one it means: binding by engine alone would silently serve every database\nfrom whichever sorted first.")
+	server: string().nullable().describe("The server this database belongs to, when the environment runs more than one of its engine. Absent, the engine's single server is resolved as before. An environment may run a second\nserver of an engine because the client asked for one (`DEDICATED`), and then the database\nmust say which one it means: binding by engine alone would silently serve every database\nfrom whichever sorted first."),
+	extensions: array(string()).nullable().describe("PostgreSQL extensions this declaration enables. Selecting one has to reach BOTH the cluster (which must load the library at startup) and the\ndatabase (which must enable the extension), so the declaration records the selection and the\nrenderer derives both from it.")
 });
 var hostingConfigurationServiceDataSchema = object({
 	key: string(),
@@ -26819,13 +26957,21 @@ var hostingConfigurationRevisionDataSchema = object({
 	source: union([hostingConfigurationRepositorySourceDataSchema, _null()]),
 	sourceProof: string().nullable()
 });
+var hostingConfigurationRevisionReferenceDataSchema = object({
+	uuid: string(),
+	origin: hostingConfigurationOriginEnumSchema,
+	desiredGeneration: int(),
+	configHash: string(),
+	applied: boolean(),
+	secrets: array(hostingConfigurationSecretStatusDataSchema)
+});
 var hostingConfigurationPageDataSchema = object({
 	environmentUuid: string(),
 	desiredGeneration: int(),
 	canManage: boolean(),
 	revision: union([hostingConfigurationRevisionDataSchema, _null()]),
-	activeRevision: union([hostingConfigurationRevisionDataSchema, _null()]),
-	knownGoodRevision: union([hostingConfigurationRevisionDataSchema, _null()]),
+	activeRevision: union([hostingConfigurationRevisionReferenceDataSchema, _null()]),
+	knownGoodRevision: union([hostingConfigurationRevisionReferenceDataSchema, _null()]),
 	canRestore: boolean().describe("Whether the desired configuration differs from the last known good revision."),
 	capabilities: hostingConfigurationCapabilitiesDataSchema
 });
@@ -26981,7 +27127,8 @@ var hostingDatabaseGrantDataSchema = object({
 var hostingDatabaseInputDataSchema = object({
 	application: string().nullable(),
 	server: string(),
-	bindings: array(string())
+	bindings: array(string()),
+	extensions: array(string()).describe("PostgreSQL extensions to enable.")
 });
 object({
 	environmentUuid: string(),
@@ -27494,6 +27641,21 @@ object({
 });
 var hostingRedirectModeEnumSchema = _enum(["temporary", "permanent"]);
 var hostingRedirectTargetEnumSchema = _enum(["application", "fixed"]).describe("What a whole-domain redirect points at. A redirect is either an application alias that sends the browser to that application's own canonical address — so a later primary change moves the redirect with it — or a fixed HTTPS destination saved by the customer, for a name that redirects without a hosted application. The two are distinct states, not a boolean on one shape, so they are named here rather than left to a nullable column's presence.\n");
+var hostingReferenceKindEnumSchema = _enum([
+	"secret",
+	"database",
+	"redis",
+	"service"
+]).describe("Which document shape a reference is written with. The kind is NOT decoration: it is the first slot of the shape a client writes (`{secret: …}`, `{database: …}`, `{redis: …}`, `{service: …}`), and each shape admits a different vocabulary. Keeping the kind explicit is what lets a refusal say what was wrong at the point the document is read, rather than after something has been resolved.\n");
+var hostingReferenceFieldDataSchema = object({
+	name: string(),
+	secret: boolean()
+});
+object({ producers: array(object({
+	key: string(),
+	kind: hostingReferenceKindEnumSchema.describe("Which document shape a reference is written with. The kind is NOT decoration: it is the first slot of the shape a client writes (`{secret: …}`, `{database: …}`, `{redis: …}`, `{service: …}`), and each shape admits a different vocabulary. Keeping the kind explicit is what lets a refusal say what was wrong at the point the document is read, rather than after something has been resolved.\n"),
+	fields: array(hostingReferenceFieldDataSchema)
+})) });
 var hostingRefusalDataSchema = object({
 	message: string(),
 	detail: string()
@@ -28821,6 +28983,7 @@ var updateHostingApplicationCacheRequestSchema = object({
 	})).optional()
 }).describe("The shape rules for an application's HTTP cache settings.\n\nShape only: types, presence and length. The bounds, the verified-hostname check and every\ncross-field rule live in `HostingHttpCacheService`, because they depend on the platform's\nconfiguration and on the application's own names — neither of which a static rule can see.");
 var updateHostingApplicationRequestSchema = object({ label: string().max(100).nullable() }).describe("Renaming one application.\n\nOnly the label is accepted. Everything a rename must not touch — the workload UUID, the\nimmutable `name` matching key, the generated hostname, the tree path and the database\nidentity — is deliberately absent from this request, so no payload can move them.\n\nThe label is `present` rather than `required` so \"clear it\" is a distinct, expressible\ninstruction: a null or blank label means \"show the application's own name again\", which\nis what every application looked like before it was ever renamed.");
+var updateHostingComponentVersionRequestSchema = object({ version: string().max(64).describe("Which versions this platform pins an image for is decided by the service, from the version catalogue, and\nrefused there by name. This only says the field must be a non-empty string.") }).describe("The version one curated component instance should run.\n\nA FormRequest rather than a bare array because that is what the generated contract can describe: a Spatie Data\nargument was accepted by the action but never appeared as a `requestBody`, so the published client had no body to send\nand the CLI could not call the endpoint at all. The rules live here so the documented contract and the accepted input\nare the same thing.");
 var updateHostingEnvironmentRequestSchema = object({
 	certificateIssuer: hostingCertificateIssuerEnumSchema.optional(),
 	desiredGeneration: int().min(1),
@@ -29904,6 +30067,13 @@ union([
 	messageDataSchema,
 	messageDataSchema
 ]);
+union([
+	object({ message: string().describe("Error overview.") }),
+	object({ message: string().describe("Error overview.") }),
+	messageDataSchema,
+	messageDataSchema
+]);
+updateHostingComponentVersionRequestSchema.describe("The version one curated component instance should run.\n\nA FormRequest rather than a bare array because that is what the generated contract can describe: a Spatie Data\nargument was accepted by the action but never appeared as a `requestBody`, so the published client had no body to send\nand the CLI could not call the endpoint at all. The rules live here so the documented contract and the accepted input\nare the same thing.");
 string().optional().default("restore").describe("The reviewed action: `reset` for a clean installation, `restore` for a retained backup.");
 string().optional().describe("The application version a reset should install.");
 string().optional().default("").describe("The version the collected backup holds.");
@@ -30365,6 +30535,11 @@ union([
 	object({ message: string().describe("Error overview.") }),
 	messageDataSchema
 ]);
+union([
+	object({ message: string().describe("Error overview.") }),
+	object({ message: string().describe("Error overview.") }),
+	messageDataSchema
+]);
 var hostingExternalSecretStoreStatus200Schema = hostingExternalSecretConnectionDataSchema;
 var hostingExternalSecretStoreStatus201Schema = hostingExternalSecretConnectionDataSchema;
 var hostingExternalSecretStoreStatus401Schema = object({ message: string().describe("Error overview.") });
@@ -31537,22 +31712,34 @@ function oneUuid(rest) {
 }
 //#endregion
 //#region src/commands/environment.ts
+/**
+* The subcommands answered by exactly one function, as a table rather than a chain of comparisons.
+*
+* A table is what keeps this cheap to extend: adding a command is an entry, not another branch in a function the
+* complexity guard is already watching.
+*/
+var SIMPLE_SUBCOMMANDS = {
+	tools: environmentTools,
+	create: create$2,
+	portable,
+	configuration,
+	secret,
+	databases,
+	database
+};
 /** Which feature group answers this subcommand and arguments, or null when the command itself does. */
 function dispatched(context, subcommand, rest) {
 	if (subcommand === void 0) return null;
 	if (ADMIN_SUBCOMMANDS.has(subcommand)) return environmentAdmin(context, subcommand, rest);
 	if (DOMAIN_SUBCOMMANDS.has(subcommand)) return environmentDomains(context, subcommand, rest);
 	if (SITE_SUBCOMMANDS.has(subcommand)) return environmentSiteAccess(context, subcommand, rest);
-	if (subcommand === "tools") return environmentTools(context, rest);
 	if (SHARED_SUBCOMMANDS.has(subcommand)) return environmentShared(context, subcommand, rest);
 	if (EXPORT_SUBCOMMANDS.has(subcommand)) return environmentExports(context, subcommand, rest);
 	if (SERVICE_SUBCOMMANDS.has(subcommand)) return environmentServices(context, subcommand, rest);
-	if (subcommand === "create") return create$2(context, rest);
-	if (subcommand === "portable") return portable(context, rest);
-	if (subcommand === "configuration") return configuration(context, rest);
-	if (subcommand === "secret") return secret(context, rest);
-	if (subcommand === "databases") return databases(context, rest);
-	if (subcommand === "database") return database(context, rest);
+	const simple = Object.hasOwn(SIMPLE_SUBCOMMANDS, subcommand) ? SIMPLE_SUBCOMMANDS[subcommand] : void 0;
+	if (simple !== void 0) return simple(context, rest);
+	if (COMPONENT_VERSION_SUBCOMMANDS.has(subcommand)) return environmentComponentVersion(context, rest);
+	if (REFERENCES_SUBCOMMANDS.has(subcommand)) return environmentReferences(context, rest);
 	return null;
 }
 /** The subcommands environment-services.ts owns: adding, stopping, locking and retiring one service. */
@@ -31564,6 +31751,10 @@ var SERVICE_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"service-retirement",
 	"service-retire"
 ]);
+/** The subcommands environment-references.ts owns: what a configuration document here may reference. */
+var REFERENCES_SUBCOMMANDS = /* @__PURE__ */ new Set(["references"]);
+/** The subcommands environment-component-version.ts owns: moving one curated component instance. */
+var COMPONENT_VERSION_SUBCOMMANDS = /* @__PURE__ */ new Set(["component-version"]);
 /** The subcommands environment-exports.ts owns: portable database exports and a release's bundle. */
 var EXPORT_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"database-exports",
@@ -36627,7 +36818,7 @@ function writeUpdateState(state, env = process.env) {
 }
 //#endregion
 //#region src/version.ts
-var VERSION = "1.0.333";
+var VERSION = "1.0.343";
 //#endregion
 //#region src/commands/update.ts
 /**
@@ -36702,7 +36893,7 @@ var update = {
 		}, process.env);
 		return {
 			...known,
-			current: after ?? "1.0.333",
+			current: after ?? "1.0.343",
 			latest: after ?? latest,
 			upToDate: after !== null && (latest === null || !isNewerVersion(latest, after)),
 			action: "run",
@@ -36977,7 +37168,7 @@ async function printUpdateNotice(options) {
 		}, env, { waitMs: NOTICE_LOCK_WAIT_MS });
 	} catch {}
 	if (latest === null) return;
-	if (!isNewerVersion(latest, "1.0.333")) return;
+	if (!isNewerVersion(latest, "1.0.343")) return;
 	process.stderr.write(`A newer hostingctl is published: ${latest} (this copy is ${VERSION}). Run \`hostingctl update\` to update.\n`);
 }
 /** Whether an environment variable is set to something, which is how CI and the opt-out are read. */