@whittlelabs/sifter 0.30.7 → 0.30.8

package/bin.js

@@ -11861,12 +11861,38 @@ var require_environment = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/branding/scaffold.js
+var require_scaffold = __commonJS({
+  "../../packages/shuttle/dist/branding/scaffold.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.scaffoldedConfigPath = scaffoldedConfigPath2;
+    exports2.planScaffold = planScaffold2;
+    var path_1 = require("path");
+    function scaffoldedConfigPath2(brand, configDir) {
+      return (0, path_1.join)(configDir, `${brand.product.id}.yaml`);
+    }
+    function planScaffold2(brand, setupOptions, existing) {
+      const pools = Array.isArray(existing.pools) ? existing.pools : [];
+      const first = pools[0];
+      const prior = first !== null && typeof first === "object" && typeof first.executor === "string" ? first.executor : void 0;
+      const executor = setupOptions.executor ?? prior ?? brand.defaultExecutor;
+      const source = setupOptions.executor !== void 0 ? "flag" : prior !== void 0 ? "existing" : "default";
+      const executors = existing.executors !== null && typeof existing.executors === "object" ? existing.executors : {};
+      const block = executor === void 0 ? void 0 : executors[executor];
+      const keptBlock = setupOptions.executor === void 0 && block !== null && typeof block === "object" ? block : void 0;
+      return { executor, source, keptBlock };
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/preflight/checks.js
 var require_checks = __commonJS({
   "../../packages/shuttle/dist/preflight/checks.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.PREFLIGHT_FLOORS = exports2.CHECKS = void 0;
+    var path_1 = require("path");
     var registry_1 = require_registry();
     var claude_code_1 = require_claude_code();
     var http_api_1 = require_http_api();
@@ -11877,6 +11903,7 @@ var require_checks = __commonJS({
     var version_check_1 = require_version_check();
     var apply_1 = require_apply();
     var environment_1 = require_environment();
+    var scaffold_1 = require_scaffold();
     var NODE_FLOOR = "20.0.0";
     var DISK_FLOOR_BYTES = 1024 * 1024 * 1024;
     var WORKSPACE_EXECUTOR = "claude-code";
@@ -11923,11 +11950,67 @@ var require_checks = __commonJS({
       return typeof tmpDir === "string" && tmpDir.length > 0 ? (0, apply_1.expandHome)(tmpDir) : osTmpDir;
     }
     async function withConfig(name, probes, body) {
+      if (!hasReadablePairing(probes))
+        return skip(name, NO_PAIRING);
       const result = probes.readConfig();
       if (!result.ok)
         return skip(name, "the config did not load; see config-loadable");
       return body(result.value);
     }
+    var NO_PAIRING = "no readable pairing; see pairing-present";
+    function hasReadablePairing(probes) {
+      const stored = probes.readPairing();
+      return stored.ok && stored.value !== null;
+    }
+    function initPlan(probes, subject) {
+      const existing = probes.readScaffoldedConfig();
+      if (!existing.ok)
+        return existing;
+      return {
+        ok: true,
+        value: (0, scaffold_1.planScaffold)(subject.brand, subject.requestedExecutor !== void 0 ? { executor: subject.requestedExecutor } : {}, existing.value ?? {})
+      };
+    }
+    function initRunRoot(plan, subject, osTmpDir) {
+      if (plan.executor !== WORKSPACE_EXECUTOR)
+        return osTmpDir;
+      if (subject.requestedTmpDir !== void 0 && subject.requestedTmpDir.length > 0) {
+        return (0, apply_1.expandHome)(subject.requestedTmpDir);
+      }
+      const settings = {
+        ...subject.brand.executorDefaults?.[WORKSPACE_EXECUTOR] ?? {},
+        ...plan.keptBlock ?? {}
+      };
+      const tmpDir = settings.tmpDir;
+      return typeof tmpDir === "string" && tmpDir.length > 0 ? (0, apply_1.expandHome)(tmpDir) : osTmpDir;
+    }
+    function belowNodeFloor(probes) {
+      return (0, version_check_1.compareSemver)(bareVersion(probes.nodeVersion()), NODE_FLOOR) < 0;
+    }
+    function needsFetch(check) {
+      return {
+        ...check,
+        async run(probes, subject) {
+          if (belowNodeFloor(probes)) {
+            return skip(check.name, "no network call on a runtime below the Node floor; see node-version");
+          }
+          return check.run(probes, subject);
+        }
+      };
+    }
+    var platformSupported = {
+      name: "platform-supported",
+      phases: ["init", "run", "doctor"],
+      prerequisite: true,
+      async run(probes, subject) {
+        const platform = probes.platform();
+        if (platform === "win32") {
+          return fail("platform-supported", "native Windows is not supported", `install WSL (https://learn.microsoft.com/windows/wsl/install), then install and run ${subject.brand.product.cliBinary} inside it`);
+        }
+        return pass("platform-supported", PLATFORM_NAMES[platform] ?? platform);
+      }
+    };
+    var PLATFORM_NAMES = { darwin: "macOS", linux: "Linux" };
     var nodeVersion = {
       name: "node-version",
       phases: ["init", "run", "doctor"],
@@ -11961,6 +12044,8 @@ var require_checks = __commonJS({
       name: "config-loadable",
       phases: ["run", "doctor"],
       async run(probes, subject) {
+        if (!hasReadablePairing(probes))
+          return skip("config-loadable", NO_PAIRING);
         const result = probes.readConfig();
         if (!result.ok) {
           return fail("config-loadable", oneLine(result.error), `fix the config, or run \`${subject.brand.product.cliBinary} init\` to rewrite it from this pairing`);
@@ -12045,15 +12130,20 @@ var require_checks = __commonJS({
       phases: ["init", "run", "doctor"],
       async run(probes, subject) {
         if (subject.phase === "init") {
-          const requested = subject.requestedExecutor;
-          if (requested === void 0) {
-            return skip("executor-coverage", "no --executor given; the brand default will be scaffolded");
+          const plan = initPlan(probes, subject);
+          if (!plan.ok) {
+            return fail("executor-coverage", `the existing config could not be read: ${oneLine(plan.error)}`, `fix that file or remove it (init writes a fresh one), then run ${subject.brand.product.cliBinary} init again`);
+          }
+          const executor = plan.value.executor;
+          if (executor === void 0) {
+            return skip("executor-coverage", "init configures no executor for this build");
           }
+          const origin = PLAN_SOURCE[plan.value.source];
           const allowed = subject.brand.executorAllowlist;
-          if (!allowed.includes("*") && !allowed.includes(requested)) {
-            return fail("executor-coverage", `--executor=${requested} is not in this build's allowlist`, `choose one of: ${allowed.join(", ")}`);
+          if (!allowed.includes("*") && !allowed.includes(executor)) {
+            return fail("executor-coverage", `${executor} (${origin}) is not in this build's allowlist`, `choose one of: ${allowed.join(", ")}`);
           }
-          return pass("executor-coverage", `--executor=${requested} is allowed by this build`);
+          return pass("executor-coverage", `init will configure ${executor} (${origin})`);
         }
         return withConfig("executor-coverage", probes, (config) => {
           const names = configuredExecutors(config);
@@ -12082,8 +12172,13 @@ var require_checks = __commonJS({
     };
     var gitCli = {
       name: "git-cli",
-      phases: ["run", "doctor"],
+      phases: ["init", "run", "doctor"],
       async run(probes, subject) {
+        if (subject.phase === "init") {
+          return atInit("git-cli", probes, subject, () => toolVerdict("git-cli", "git", probes, subject, {
+            missingRemedy: "install git, or configure an executor that needs no checkout"
+          }));
+        }
         return withConfig("git-cli", probes, async (config) => {
           if (!configuredExecutors(config).includes(WORKSPACE_EXECUTOR)) {
             return skip("git-cli", `no ${WORKSPACE_EXECUTOR} executor configured; nothing checks out a workspace`);
@@ -12096,15 +12191,16 @@ var require_checks = __commonJS({
     };
     var claudeCli = {
       name: "claude-cli",
-      phases: ["run", "doctor"],
+      phases: ["init", "run", "doctor"],
       async run(probes, subject) {
+        if (subject.phase === "init") {
+          return atInit("claude-cli", probes, subject, () => toolVerdict("claude-cli", "claude", probes, subject, { missingRemedy: CLAUDE_INSTALL }));
+        }
         return withConfig("claude-cli", probes, async (config) => {
           if (!configuredExecutors(config).includes(WORKSPACE_EXECUTOR)) {
             return skip("claude-cli", `no ${WORKSPACE_EXECUTOR} executor configured`);
           }
-          return toolVerdict("claude-cli", "claude", probes, subject, {
-            missingRemedy: "install Claude Code (npm install -g @anthropic-ai/claude-code)"
-          });
+          return toolVerdict("claude-cli", "claude", probes, subject, { missingRemedy: CLAUDE_INSTALL });
         });
       }
     };
@@ -12119,6 +12215,9 @@ var require_checks = __commonJS({
           if (config.credentials !== void 0) {
             return skip("claude-auth", "hosted mode: the model key is revealed per job, not read from a login");
           }
+          if (await probes.which("claude") === null || !(await probes.versionOf("claude")).ran) {
+            return skip("claude-auth", "no working claude CLI to be signed in to; see claude-cli");
+          }
           if (subject.deep) {
             const round = await probes.claudeRoundTrip();
             if (!round.ok) {
@@ -12139,23 +12238,45 @@ var require_checks = __commonJS({
     };
     var runRootWritable = {
       name: "run-root-writable",
-      phases: ["run", "doctor"],
+      phases: ["init", "run", "doctor"],
       async run(probes, subject) {
-        return withConfig("run-root-writable", probes, async (config) => {
-          const targets = [
-            ["config dir", subject.paths.configDir],
-            ["run root", runRoot(config, subject, osTmpDirOf(probes))]
-          ];
-          for (const [label, dir] of targets) {
-            const probe = await probes.mkdtemp(dir);
-            if (!probe.ok) {
-              return fail("run-root-writable", `cannot create a directory in the ${label} ${dir}: ${oneLine(probe.error)}`, `make ${dir} writable by the user running this (chown -R $(whoami) ${dir})`);
-            }
-          }
-          return pass("run-root-writable", targets.map(([, dir]) => dir).join(" and "));
-        });
+        if (subject.phase === "init") {
+          const plan = initPlan(probes, subject);
+          if (!plan.ok)
+            return skip("run-root-writable", "the existing config could not be read; see executor-coverage");
+          const configBase = await nearestExisting(probes, subject.paths.configDir);
+          return writableVerdict(probes, [
+            ["config dir", configBase, subject.paths.configDir],
+            ["run root", initRunRoot(plan.value, subject, osTmpDirOf(probes))]
+          ]);
+        }
+        return withConfig("run-root-writable", probes, async (config) => writableVerdict(probes, [
+          ["config dir", subject.paths.configDir],
+          ["run root", runRoot(config, subject, osTmpDirOf(probes))]
+        ]));
       }
     };
+    async function writableVerdict(probes, targets) {
+      for (const [label, dir, about] of targets) {
+        const probe = await probes.mkdtemp(dir);
+        if (!probe.ok) {
+          const what = about !== void 0 && about !== dir ? `the ${label} ${about} (in ${dir})` : `the ${label} ${dir}`;
+          return fail("run-root-writable", `cannot create a directory for ${what}: ${oneLine(probe.error)}`, `make ${dir} writable by the user running this (chown -R $(whoami) ${dir})`);
+        }
+      }
+      return pass("run-root-writable", targets.map(([, dir, about]) => about ?? dir).join(" and "));
+    }
+    async function nearestExisting(probes, dir) {
+      let current = dir;
+      for (; ; ) {
+        if (await probes.stat(current) !== null)
+          return current;
+        const parent = (0, path_1.dirname)(current);
+        if (parent === current)
+          return current;
+        current = parent;
+      }
+    }
     var diskSpace = {
       name: "disk-space",
       phases: ["run", "doctor"],
@@ -12207,12 +12328,13 @@ var require_checks = __commonJS({
       }
     };
     exports2.CHECKS = [
+      platformSupported,
       nodeVersion,
       pairingPresent,
       configLoadable,
-      pairingLive,
+      needsFetch(pairingLive),
       pairingEnvironment,
-      keepReachable,
+      needsFetch(keepReachable),
       executorCoverage,
       gitCli,
       claudeCli,
@@ -12220,7 +12342,7 @@ var require_checks = __commonJS({
       runRootWritable,
       diskSpace,
       overlayHosts,
-      jobsReachable,
+      needsFetch(jobsReachable),
       versionCurrent
     ];
     async function toolVerdict(name, bin, probes, subject, opts) {
@@ -12229,7 +12351,11 @@ var require_checks = __commonJS({
         return fail(name, `${bin} is not on PATH`, opts.missingRemedy);
       }
       const floor = subject.brand.minimumToolVersions?.[bin];
-      const version = await probes.versionOf(bin);
+      const outcome = await probes.versionOf(bin);
+      if (!outcome.ran) {
+        return fail(name, `${bin} at ${found} is there but cannot run: \`${bin} --version\` ${oneLine(outcome.reason)}`, cannotRunRemedy(bin, found, outcome.reason, probes.platform(), opts.missingRemedy));
+      }
+      const version = outcome.version;
       if (version === null) {
         return warn(name, `${bin} at ${found}, version unreadable`);
       }
@@ -12238,6 +12364,27 @@ var require_checks = __commonJS({
       }
       return pass(name, `${bin} ${version} at ${found}`);
     }
+    function cannotRunRemedy(bin, found, reason, platform, missingRemedy) {
+      if (bin === "git" && (platform === "darwin" || /xcrun|developer path/i.test(reason))) {
+        return "this is the macOS placeholder git: install the Command Line Tools with `xcode-select --install`, or install git another way (e.g. Homebrew) ahead of it on PATH";
+      }
+      return `run \`${bin} --version\` to see why ${found} fails, then reinstall it (${missingRemedy})`;
+    }
+    var CLAUDE_INSTALL = "install Claude Code (npm install -g @anthropic-ai/claude-code)";
+    async function atInit(name, probes, subject, body) {
+      const plan = initPlan(probes, subject);
+      if (!plan.ok)
+        return skip(name, "the existing config could not be read; see executor-coverage");
+      if (plan.value.executor !== WORKSPACE_EXECUTOR) {
+        return skip(name, plan.value.executor === void 0 ? "init configures no executor for this build" : `init configures ${plan.value.executor}, which needs no ${WORKSPACE_EXECUTOR} tools`);
+      }
+      return body();
+    }
+    var PLAN_SOURCE = {
+      flag: "from --executor",
+      existing: "kept from your existing config",
+      default: "the default"
+    };
     function mergedExecutorConfigs(config, subject) {
       const user = config.executors;
       const defaults = subject.brand.executorDefaults;
@@ -12277,1514 +12424,967 @@ var require_typed_exit = __commonJS({
   }
 });
 
-// ../../packages/jobs/dist/response.js
-var require_response = __commonJS({
-  "../../packages/jobs/dist/response.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
+var require_identity = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.NonJsonResponseError = exports2.ServiceUnavailableError = void 0;
-    exports2.readJsonResponse = readJsonResponse;
-    var EXCERPT_LIMIT = 120;
-    var UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
-    var UnreadableResponseError = class extends Error {
-      host;
-      statusCode;
-      statusText;
-      contentType;
-      bodyExcerpt;
-      constructor(message, detail) {
-        super(message);
-        this.host = detail.host;
-        this.statusCode = detail.statusCode;
-        this.statusText = detail.statusText;
-        this.contentType = detail.contentType;
-        this.bodyExcerpt = detail.bodyExcerpt;
-      }
-    };
-    var ServiceUnavailableError = class extends UnreadableResponseError {
-      code = "SERVICE_UNAVAILABLE";
-      constructor(detail) {
-        super(`${detail.host} answered ${formatStatus(detail)} (content-type: ${detail.contentType ?? "none"})${detail.bodyExcerpt ? `: ${detail.bodyExcerpt}` : ""}`, detail);
-        this.name = "ServiceUnavailableError";
-      }
-    };
-    exports2.ServiceUnavailableError = ServiceUnavailableError;
-    var NonJsonResponseError = class extends UnreadableResponseError {
-      code = "RESPONSE_NOT_JSON";
-      constructor(detail) {
-        super(`${detail.host} answered ${formatStatus(detail)} with content-type ${detail.contentType ?? "none"}, not JSON${detail.bodyExcerpt ? `: ${detail.bodyExcerpt}` : ""}`, detail);
-        this.name = "NonJsonResponseError";
-      }
-    };
-    exports2.NonJsonResponseError = NonJsonResponseError;
-    function formatStatus(detail) {
-      return detail.statusText ? `${detail.statusCode} ${detail.statusText}` : `${detail.statusCode}`;
-    }
-    function isJson(contentType) {
-      if (!contentType)
-        return false;
-      const essence = contentType.split(";")[0].trim().toLowerCase();
-      return essence === "application/json" || essence.endsWith("+json");
-    }
-    function excerpt(body) {
-      const collapsed = body.replace(/\s+/g, " ").trim();
-      return collapsed.length > EXCERPT_LIMIT ? `${collapsed.slice(0, EXCERPT_LIMIT)}...` : collapsed;
-    }
-    function hostOf(url) {
-      try {
-        return new URL(url).host;
-      } catch {
-        return url;
-      }
+    var ALIAS = Symbol.for("yaml.alias");
+    var DOC = Symbol.for("yaml.document");
+    var MAP = Symbol.for("yaml.map");
+    var PAIR = Symbol.for("yaml.pair");
+    var SCALAR = Symbol.for("yaml.scalar");
+    var SEQ = Symbol.for("yaml.seq");
+    var NODE_TYPE = Symbol.for("yaml.node.type");
+    var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
+    var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
+    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
+    var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
+    var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
+    function isCollection(node) {
+      if (node && typeof node === "object")
+        switch (node[NODE_TYPE]) {
+          case MAP:
+          case SEQ:
+            return true;
+        }
+      return false;
     }
-    async function readJsonResponse(response, url) {
-      const contentType = response.headers.get("content-type");
-      const unavailable = UNAVAILABLE_STATUSES.has(response.status);
-      if (unavailable || !isJson(contentType)) {
-        const body = await response.text().catch(() => "");
-        const detail = {
-          host: hostOf(url),
-          statusCode: response.status,
-          statusText: response.statusText ?? "",
-          contentType,
-          bodyExcerpt: excerpt(body)
-        };
-        throw unavailable ? new ServiceUnavailableError(detail) : new NonJsonResponseError(detail);
-      }
-      return await response.json();
+    function isNode(node) {
+      if (node && typeof node === "object")
+        switch (node[NODE_TYPE]) {
+          case ALIAS:
+          case MAP:
+          case SCALAR:
+          case SEQ:
+            return true;
+        }
+      return false;
     }
+    var hasAnchor = (node) => (isScalar(node) || isCollection(node)) && !!node.anchor;
+    exports2.ALIAS = ALIAS;
+    exports2.DOC = DOC;
+    exports2.MAP = MAP;
+    exports2.NODE_TYPE = NODE_TYPE;
+    exports2.PAIR = PAIR;
+    exports2.SCALAR = SCALAR;
+    exports2.SEQ = SEQ;
+    exports2.hasAnchor = hasAnchor;
+    exports2.isAlias = isAlias;
+    exports2.isCollection = isCollection;
+    exports2.isDocument = isDocument;
+    exports2.isMap = isMap;
+    exports2.isNode = isNode;
+    exports2.isPair = isPair;
+    exports2.isScalar = isScalar;
+    exports2.isSeq = isSeq;
   }
 });
 
-// ../../packages/jobs/dist/client.js
-var require_client2 = __commonJS({
-  "../../packages/jobs/dist/client.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/visit.js
+var require_visit = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/visit.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.JobsClient = void 0;
-    var response_1 = require_response();
-    var JobsClient = class {
-      baseUrl;
-      apiKey;
-      accessToken;
-      getAccessToken;
-      onResponse;
-      constructor(config) {
-        this.baseUrl = config.baseUrl.replace(/\/$/, "");
-        this.apiKey = config.apiKey;
-        this.accessToken = config.accessToken;
-        this.getAccessToken = config.getAccessToken;
-        this.onResponse = config.onResponse;
-      }
-      /**
-       * Headers for one request. The auth header is resolved per call so a
-       * long-lived client picks up a refreshed token from `getAccessToken`
-       * (the manager behind it re-mints before expiry) instead of pinning the
-       * token it happened to hold at construction.
-       */
-      async buildHeaders(forceRefresh = false) {
-        const headers = { "Content-Type": "application/json" };
-        if (this.apiKey) {
-          headers["X-API-Key"] = this.apiKey;
-        } else if (this.getAccessToken) {
-          const token = await this.getAccessToken({ forceRefresh });
-          if (token)
-            headers["Authorization"] = `Bearer ${token}`;
-        } else if (this.accessToken) {
-          headers["Authorization"] = `Bearer ${this.accessToken}`;
-        }
-        return headers;
+    var identity = require_identity();
+    var BREAK = Symbol("break visit");
+    var SKIP = Symbol("skip children");
+    var REMOVE = Symbol("remove node");
+    function visit(node, visitor) {
+      const visitor_ = initVisitor(visitor);
+      if (identity.isDocument(node)) {
+        const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
+        if (cd === REMOVE)
+          node.contents = null;
+      } else
+        visit_(null, node, visitor_, Object.freeze([]));
+    }
+    visit.BREAK = BREAK;
+    visit.SKIP = SKIP;
+    visit.REMOVE = REMOVE;
+    function visit_(key, node, visitor, path) {
+      const ctrl = callVisitor(key, node, visitor, path);
+      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
+        replaceNode(key, path, ctrl);
+        return visit_(key, ctrl, visitor, path);
       }
-      /**
-       * Fetch with one auth retry. A 401 on a token-provider client usually means
-       * the token was invalidated server-side (Keep restart, key rotation,
-       * revoke-then-repair, clock skew) while the local expiry timer still thinks
-       * it's valid. Force a re-mint and retry once before surfacing the failure.
-       * `onResponse` (min-version contract) fires on the response we actually act
-       * on. `body` is a string, so it is safe to resend.
-       */
-      async fetchWithAuthRetry(method, url, body) {
-        let response = await fetch(url, { method, headers: await this.buildHeaders(), body });
-        if (response.status === 401 && this.getAccessToken) {
-          response = await fetch(url, { method, headers: await this.buildHeaders(true), body });
+      if (typeof ctrl !== "symbol") {
+        if (identity.isCollection(node)) {
+          path = Object.freeze(path.concat(node));
+          for (let i = 0; i < node.items.length; ++i) {
+            const ci = visit_(i, node.items[i], visitor, path);
+            if (typeof ci === "number")
+              i = ci - 1;
+            else if (ci === BREAK)
+              return BREAK;
+            else if (ci === REMOVE) {
+              node.items.splice(i, 1);
+              i -= 1;
+            }
+          }
+        } else if (identity.isPair(node)) {
+          path = Object.freeze(path.concat(node));
+          const ck = visit_("key", node.key, visitor, path);
+          if (ck === BREAK)
+            return BREAK;
+          else if (ck === REMOVE)
+            node.key = null;
+          const cv = visit_("value", node.value, visitor, path);
+          if (cv === BREAK)
+            return BREAK;
+          else if (cv === REMOVE)
+            node.value = null;
         }
-        this.onResponse?.(response);
-        return response;
-      }
-      // ── Job Pools ──────────────────────────────────────────────
-      async createJobPool(options) {
-        return this.request("POST", "/api/job-pools", options);
-      }
-      /**
-       * Idempotent upsert by `(principal_class, principal_id, name)`. When the
-       * pool exists, returns the existing row without modifying membership
-       * constraints. The Sift provisioning hook relies on this semantics.
-       */
-      async findOrCreateJobPool(options) {
-        return this.request("POST", "/api/job-pools?idempotent=true", options);
-      }
-      async listJobPools(filters) {
-        const params = new URLSearchParams();
-        if (filters?.principalClass)
-          params.set("principalClass", filters.principalClass);
-        if (filters?.principalId)
-          params.set("principalId", filters.principalId);
-        if (filters?.name)
-          params.set("name", filters.name);
-        const qs = params.toString();
-        const { pools } = await this.request("GET", `/api/job-pools${qs ? `?${qs}` : ""}`);
-        return pools;
       }
-      async getJobPool(poolId) {
-        return this.request("GET", `/api/job-pools/${poolId}`);
+      return ctrl;
+    }
+    async function visitAsync(node, visitor) {
+      const visitor_ = initVisitor(visitor);
+      if (identity.isDocument(node)) {
+        const cd = await visitAsync_(null, node.contents, visitor_, Object.freeze([node]));
+        if (cd === REMOVE)
+          node.contents = null;
+      } else
+        await visitAsync_(null, node, visitor_, Object.freeze([]));
+    }
+    visitAsync.BREAK = BREAK;
+    visitAsync.SKIP = SKIP;
+    visitAsync.REMOVE = REMOVE;
+    async function visitAsync_(key, node, visitor, path) {
+      const ctrl = await callVisitor(key, node, visitor, path);
+      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
+        replaceNode(key, path, ctrl);
+        return visitAsync_(key, ctrl, visitor, path);
       }
-      /**
-       * Resolve a pool by exact name. Names are unique per OWNER, not globally
-       * (whittlelabs#763), and this method lists without a principal filter, so
-       * the same name can legitimately come back under several owners. That
-       * reference is inherently ambiguous — and silently picking one (the old
-       * behavior took the server's newest-first ordering) is exactly the
-       * capture vector the per-owner constraint closed, re-opened cross-owner.
-       * So it refuses instead: reference the pool by id, or list with explicit
-       * principal filters, when more than one owner holds the name.
-       */
-      async resolveJobPoolByName(name) {
-        const pools = await this.listJobPools({ name });
-        const matches = pools.filter((p) => p.name === name);
-        const owners = new Set(matches.map((p) => `${p.principalClass ?? ""}/${p.principalId ?? ""}`));
-        if (owners.size > 1) {
-          const error = new Error(`Job pool name "${name}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with explicit principal filters (listJobPools).`);
-          error.code = "JOB_POOL_NAME_AMBIGUOUS";
-          throw error;
+      if (typeof ctrl !== "symbol") {
+        if (identity.isCollection(node)) {
+          path = Object.freeze(path.concat(node));
+          for (let i = 0; i < node.items.length; ++i) {
+            const ci = await visitAsync_(i, node.items[i], visitor, path);
+            if (typeof ci === "number")
+              i = ci - 1;
+            else if (ci === BREAK)
+              return BREAK;
+            else if (ci === REMOVE) {
+              node.items.splice(i, 1);
+              i -= 1;
+            }
+          }
+        } else if (identity.isPair(node)) {
+          path = Object.freeze(path.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path);
+          if (ck === BREAK)
+            return BREAK;
+          else if (ck === REMOVE)
+            node.key = null;
+          const cv = await visitAsync_("value", node.value, visitor, path);
+          if (cv === BREAK)
+            return BREAK;
+          else if (cv === REMOVE)
+            node.value = null;
         }
-        return matches[0];
       }
-      /** Internal: resolve a `PoolRef` to a pool id. */
-      async resolvePoolRef(ref) {
-        if ("id" in ref)
-          return ref.id;
-        const pool = await this.resolveJobPoolByName(ref.name);
-        if (!pool)
-          throw new Error(`Job pool not found by name: "${ref.name}"`);
-        return pool.id;
+      return ctrl;
+    }
+    function initVisitor(visitor) {
+      if (typeof visitor === "object" && (visitor.Collection || visitor.Node || visitor.Value)) {
+        return Object.assign({
+          Alias: visitor.Node,
+          Map: visitor.Node,
+          Scalar: visitor.Node,
+          Seq: visitor.Node
+        }, visitor.Value && {
+          Map: visitor.Value,
+          Scalar: visitor.Value,
+          Seq: visitor.Value
+        }, visitor.Collection && {
+          Map: visitor.Collection,
+          Seq: visitor.Collection
+        }, visitor);
       }
-      // ── Members ──────────────────────────────────────────────────────
-      // A subscriber joins a pool by registering as a member of it. These
-      // map to the server's `/api/job-pools/:poolId/members` routes.
-      async listMembers(poolId) {
-        const { members } = await this.request("GET", `/api/job-pools/${poolId}/members`);
-        return members;
+      return visitor;
+    }
+    function callVisitor(key, node, visitor, path) {
+      if (typeof visitor === "function")
+        return visitor(key, node, path);
+      if (identity.isMap(node))
+        return visitor.Map?.(key, node, path);
+      if (identity.isSeq(node))
+        return visitor.Seq?.(key, node, path);
+      if (identity.isPair(node))
+        return visitor.Pair?.(key, node, path);
+      if (identity.isScalar(node))
+        return visitor.Scalar?.(key, node, path);
+      if (identity.isAlias(node))
+        return visitor.Alias?.(key, node, path);
+      return void 0;
+    }
+    function replaceNode(key, path, node) {
+      const parent = path[path.length - 1];
+      if (identity.isCollection(parent)) {
+        parent.items[key] = node;
+      } else if (identity.isPair(parent)) {
+        if (key === "key")
+          parent.key = node;
+        else
+          parent.value = node;
+      } else if (identity.isDocument(parent)) {
+        parent.contents = node;
+      } else {
+        const pt = identity.isAlias(parent) ? "alias" : "scalar";
+        throw new Error(`Cannot replace node with ${pt} parent`);
       }
-      async registerMember(poolId, options) {
-        return this.request("POST", `/api/job-pools/${poolId}/members`, options);
+    }
+    exports2.visit = visit;
+    exports2.visitAsync = visitAsync;
+  }
+});
+
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/directives.js
+var require_directives = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/directives.js"(exports2) {
+    "use strict";
+    var identity = require_identity();
+    var visit = require_visit();
+    var escapeChars = {
+      "!": "%21",
+      ",": "%2C",
+      "[": "%5B",
+      "]": "%5D",
+      "{": "%7B",
+      "}": "%7D"
+    };
+    var escapeTagName = (tn) => tn.replace(/[!,[\]{}]/g, (ch) => escapeChars[ch]);
+    var Directives = class _Directives {
+      constructor(yaml, tags) {
+        this.docStart = null;
+        this.docEnd = false;
+        this.yaml = Object.assign({}, _Directives.defaultYaml, yaml);
+        this.tags = Object.assign({}, _Directives.defaultTags, tags);
       }
-      async updateMember(poolId, memberId, options) {
-        return this.request("PUT", `/api/job-pools/${poolId}/members/${memberId}`, options);
+      clone() {
+        const copy = new _Directives(this.yaml, this.tags);
+        copy.docStart = this.docStart;
+        return copy;
       }
-      // ── Jobs (producer) ──────────────────────────────────────────────
       /**
-       * Enqueue a job into a job pool. The `inputs` are opaque to Jobs; a Shuttle
-       * reads the strategy header inside them to decide how to run it (ADR 0005).
+       * During parsing, get a Directives instance for the current document and
+       * update the stream state according to the current version's spec.
        */
-      async enqueueJob(options) {
-        const jobPoolId = await this.resolvePoolRef(options.pool);
-        const body = {
-          jobPoolId,
-          title: options.title,
-          instructions: options.instructions,
-          maxAttempts: options.maxAttempts,
-          deadlineDuration: options.deadlineDuration,
-          claimDeadlineDuration: options.claimDeadlineDuration,
-          priority: options.priority,
-          tags: options.tags,
-          clientRef: options.clientRef,
-          clientContext: options.clientContext,
-          inputs: options.inputs
-        };
-        return this.request("POST", "/api/jobs", body);
-      }
-      async getJob(jobId) {
-        return this.request("GET", `/api/jobs/${jobId}`);
-      }
-      async updateJob(jobId, options) {
-        return this.request("PATCH", `/api/jobs/${jobId}`, options);
-      }
-      async cancelJob(jobId) {
-        return this.request("PUT", `/api/jobs/${jobId}`);
-      }
-      // ── Outputs ──────────────────────────────────────────────────────
-      async listOutputs(jobId) {
-        const all = [];
-        const pageSize = 100;
-        for (let offset = 0; ; offset += pageSize) {
-          const { outputs, total } = await this.request("GET", `/api/jobs/${jobId}/output?limit=${pageSize}&offset=${offset}`);
-          all.push(...outputs);
-          if (outputs.length === 0 || all.length >= total)
-            break;
-        }
-        return all;
-      }
-      async createOutput(jobId, options) {
-        return this.request("POST", `/api/jobs/${jobId}/output`, options);
+      atDocument() {
+        const res = new _Directives(this.yaml, this.tags);
+        switch (this.yaml.version) {
+          case "1.1":
+            this.atNextDocument = true;
+            break;
+          case "1.2":
+            this.atNextDocument = false;
+            this.yaml = {
+              explicit: _Directives.defaultYaml.explicit,
+              version: "1.2"
+            };
+            this.tags = Object.assign({}, _Directives.defaultTags);
+            break;
+        }
+        return res;
       }
       /**
-       * Post a batch of live progress frames for a running job. Best-effort
-       * telemetry: the service publishes it over core NATS and never derives
-       * authoritative state from it, so callers should swallow failures rather than
-       * let a dropped frame affect the job.
+       * @param onError - May be called even if the action was successful
+       * @returns `true` on success
        */
-      async postProgress(jobId, options) {
-        await this.request("POST", `/api/jobs/${jobId}/progress`, options);
+      add(line, onError) {
+        if (this.atNextDocument) {
+          this.yaml = { explicit: _Directives.defaultYaml.explicit, version: "1.1" };
+          this.tags = Object.assign({}, _Directives.defaultTags);
+          this.atNextDocument = false;
+        }
+        const parts = line.trim().split(/[ \t]+/);
+        const name = parts.shift();
+        switch (name) {
+          case "%TAG": {
+            if (parts.length !== 2) {
+              onError(0, "%TAG directive should contain exactly two parts");
+              if (parts.length < 2)
+                return false;
+            }
+            const [handle, prefix] = parts;
+            this.tags[handle] = prefix;
+            return true;
+          }
+          case "%YAML": {
+            this.yaml.explicit = true;
+            if (parts.length !== 1) {
+              onError(0, "%YAML directive should contain exactly one part");
+              return false;
+            }
+            const [version] = parts;
+            if (version === "1.1" || version === "1.2") {
+              this.yaml.version = version;
+              return true;
+            } else {
+              const isValid = /^\d+\.\d+$/.test(version);
+              onError(6, `Unsupported YAML version ${version}`, isValid);
+              return false;
+            }
+          }
+          default:
+            onError(0, `Unknown directive ${name}`, true);
+            return false;
+        }
       }
-      // ── Attendance (subscriber dispatch lifecycle) ───────────────────
       /**
-       * Accept a dispatched job. The subscribe loop calls this; direct
-       * callers should be rare. Returns the dispatched-job context the
-       * subscriber needs to execute and submit.
+       * Resolves a tag, matching handles to those defined in %TAG directives.
+       *
+       * @returns Resolved tag, which may also be the non-specific tag `'!'` or a
+       *   `'!local'` tag, or `null` if unresolvable.
        */
-      async acceptDispatch(jobId) {
-        return this.request("POST", `/api/jobs/${jobId}/attendance`);
-      }
-      async submit(jobId, options) {
-        return this.request("PUT", `/api/jobs/${jobId}/attendance`, options);
-      }
-      // ── Discovery (rare) ─────────────────────────────────────────────
-      async listDispatchableJobs(options) {
-        const params = new URLSearchParams();
-        if (options?.pools?.length)
-          params.set("pools", options.pools.join(","));
-        if (options?.tags?.length)
-          params.set("tags", options.tags.join(","));
-        if (options?.maxAttempts !== void 0)
-          params.set("maxAttempts", String(options.maxAttempts));
-        if (options?.minPriority !== void 0)
-          params.set("minPriority", String(options.minPriority));
-        if (options?.limit !== void 0)
-          params.set("limit", String(options.limit));
-        if (options?.offset !== void 0)
-          params.set("offset", String(options.offset));
-        if (options?.sort)
-          params.set("sort", options.sort);
-        const qs = params.toString();
-        const { jobs, total, directives } = await this.request("GET", `/api/my/jobs${qs ? `?${qs}` : ""}`);
-        return {
-          data: jobs,
-          pagination: { total, limit: options?.limit ?? 25, offset: options?.offset ?? 0 },
-          directives: directives ?? null
-        };
+      tagName(source, onError) {
+        if (source === "!")
+          return "!";
+        if (source[0] !== "!") {
+          onError(`Not a valid tag: ${source}`);
+          return null;
+        }
+        if (source[1] === "<") {
+          const verbatim = source.slice(2, -1);
+          if (verbatim === "!" || verbatim === "!!") {
+            onError(`Verbatim tags aren't resolved, so ${source} is invalid.`);
+            return null;
+          }
+          if (source[source.length - 1] !== ">")
+            onError("Verbatim tags must end with a >");
+          return verbatim;
+        }
+        const [, handle, suffix] = source.match(/^(.*!)([^!]*)$/s);
+        if (!suffix)
+          onError(`The ${source} tag has no suffix`);
+        const prefix = this.tags[handle];
+        if (prefix) {
+          try {
+            return prefix + decodeURIComponent(suffix);
+          } catch (error) {
+            onError(String(error));
+            return null;
+          }
+        }
+        if (handle === "!")
+          return source;
+        onError(`Could not resolve tag: ${source}`);
+        return null;
       }
-      // ── HTTP plumbing ────────────────────────────────────────────────
       /**
-       * Every call's one reader. `readJsonResponse` refuses to parse a reply that
-       * is not the API's JSON — an ingress 502/503/504 while a pod rolls, or any
-       * non-JSON body — and throws a named failure instead of a parse error. What
-       * comes back here is the API's own envelope, success or not.
+       * Given a fully resolved tag, returns its printable string form,
+       * taking into account current tag prefixes and defaults.
        */
-      async request(method, path, body) {
-        const url = `${this.baseUrl}${path}`;
-        const response = await this.fetchWithAuthRetry(method, url, body ? JSON.stringify(body) : void 0);
-        const json = await (0, response_1.readJsonResponse)(response, url);
-        if (!response.ok || !json.success) {
-          const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
-          const error = new Error(errorMessage);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
+      tagString(tag) {
+        for (const [handle, prefix] of Object.entries(this.tags)) {
+          if (tag.startsWith(prefix))
+            return handle + escapeTagName(tag.substring(prefix.length));
         }
-        return json.data;
+        return tag[0] === "!" ? tag : `!<${tag}>`;
+      }
+      toString(doc) {
+        const lines = this.yaml.explicit ? [`%YAML ${this.yaml.version || "1.2"}`] : [];
+        const tagEntries = Object.entries(this.tags);
+        let tagNames;
+        if (doc && tagEntries.length > 0 && identity.isNode(doc.contents)) {
+          const tags = {};
+          visit.visit(doc.contents, (_key, node) => {
+            if (identity.isNode(node) && node.tag)
+              tags[node.tag] = true;
+          });
+          tagNames = Object.keys(tags);
+        } else
+          tagNames = [];
+        for (const [handle, prefix] of tagEntries) {
+          if (handle === "!!" && prefix === "tag:yaml.org,2002:")
+            continue;
+          if (!doc || tagNames.some((tn) => tn.startsWith(prefix)))
+            lines.push(`%TAG ${handle} ${prefix}`);
+        }
+        return lines.join("\n");
       }
     };
-    exports2.JobsClient = JobsClient;
+    Directives.defaultYaml = { explicit: false, version: "1.2" };
+    Directives.defaultTags = { "!!": "tag:yaml.org,2002:" };
+    exports2.Directives = Directives;
   }
 });
 
-// ../../packages/jobs/dist/subscribe.js
-var require_subscribe = __commonJS({
-  "../../packages/jobs/dist/subscribe.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/anchors.js
+var require_anchors = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/anchors.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.subscribe = subscribe;
-    var response_1 = require_response();
-    var NULL_LOGGER = {
-      debug: () => {
-      },
-      info: () => {
-      },
-      warn: () => {
-      },
-      error: () => {
+    var identity = require_identity();
+    var visit = require_visit();
+    function anchorIsValid(anchor) {
+      if (/[\x00-\x19\s,[\]{}]/.test(anchor)) {
+        const sa = JSON.stringify(anchor);
+        const msg = `Anchor must not contain whitespace or control characters: ${sa}`;
+        throw new Error(msg);
       }
-    };
-    function sleep(ms) {
-      return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    function formatDuration(ms) {
-      const seconds = Math.round(ms / 1e3);
-      if (seconds < 60)
-        return `${seconds}s`;
-      const minutes = Math.floor(seconds / 60);
-      const rest = seconds % 60;
-      return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`;
+      return true;
     }
-    function subscribe(opts) {
-      const logger = opts.logger ?? NULL_LOGGER;
-      const pollIntervalMs = opts.pollIntervalMs ?? 2e3;
-      const maxConcurrency = opts.maxConcurrency ?? 1;
-      let stopped = true;
-      let pollTimer = null;
-      let inflight = 0;
-      let resolvedPoolIds = [];
-      let unavailableSince = null;
-      async function start() {
-        if (!stopped)
-          return;
-        stopped = false;
-        resolvedPoolIds = [];
-        for (const ref of opts.pools) {
-          const id = await opts.jobsClient.resolvePoolRef(ref);
-          resolvedPoolIds.push(id);
-          await opts.jobsClient.registerMember(id, {
-            identityType: opts.subscriber.identityType,
-            identityId: opts.subscriber.identityId,
-            intelligence: opts.subscriber.intelligence,
-            ...opts.subscriber.displayName !== void 0 ? { displayName: opts.subscriber.displayName } : {},
-            ...opts.subscriber.metadata !== void 0 ? { metadata: opts.subscriber.metadata } : {}
-          });
+    function anchorNames(root) {
+      const anchors = /* @__PURE__ */ new Set();
+      visit.visit(root, {
+        Value(_key, node) {
+          if (node.anchor)
+            anchors.add(node.anchor);
         }
-        logger.info("subscribe loop started", { pools: resolvedPoolIds, maxConcurrency });
-        schedulePoll(pollIntervalMs);
-      }
-      async function stop() {
-        if (stopped)
-          return;
-        stopped = true;
-        if (pollTimer !== null) {
-          clearTimeout(pollTimer);
-          pollTimer = null;
-        }
-        while (inflight > 0) {
-          await sleep(100);
-        }
-        logger.info("subscribe loop stopped");
-      }
-      function schedulePoll(delayMs) {
-        pollTimer = setTimeout(() => {
-          void poll();
-        }, delayMs);
+      });
+      return anchors;
+    }
+    function findNewAnchor(prefix, exclude) {
+      for (let i = 1; true; ++i) {
+        const name = `${prefix}${i}`;
+        if (!exclude.has(name))
+          return name;
       }
-      async function poll() {
-        if (stopped)
-          return;
-        if (inflight >= maxConcurrency) {
-          schedulePoll(pollIntervalMs);
-          return;
-        }
-        try {
-          const { data, directives } = await opts.jobsClient.listDispatchableJobs({
-            pools: resolvedPoolIds,
-            limit: maxConcurrency - inflight,
-            sort: "priority:desc,queued_at:asc"
-          });
-          if (unavailableSince !== null) {
-            logger.info(`Sift is reachable again after ${formatDuration(Date.now() - unavailableSince)}`);
-            unavailableSince = null;
-          }
-          if (directives && Object.keys(directives).length > 0 && opts.onDirectives) {
-            try {
-              await opts.onDirectives(directives);
-            } catch (err) {
-              logger.error("onDirectives handler failed", {
-                error: err instanceof Error ? err.message : String(err)
-              });
-            }
-          }
-          if (stopped)
-            return;
-          for (const job of data) {
-            if (inflight >= maxConcurrency)
-              break;
-            inflight++;
-            void runOnce(job).finally(() => {
-              inflight--;
-            });
-          }
-        } catch (err) {
-          if (err instanceof response_1.ServiceUnavailableError) {
-            if (unavailableSince === null) {
-              unavailableSince = Date.now();
-              logger.warn(`Sift is unavailable (${err.host} answered ${err.statusCode}${err.statusText ? ` ${err.statusText}` : ""}). This is typical during a deployment window; the Sifter will keep trying.`);
+    }
+    function createNodeAnchors(doc, prefix) {
+      const aliasObjects = [];
+      const sourceObjects = /* @__PURE__ */ new Map();
+      let prevAnchors = null;
+      return {
+        onAnchor: (source) => {
+          aliasObjects.push(source);
+          prevAnchors ?? (prevAnchors = anchorNames(doc));
+          const anchor = findNewAnchor(prefix, prevAnchors);
+          prevAnchors.add(anchor);
+          return anchor;
+        },
+        /**
+         * With circular references, the source node is only resolved after all
+         * of its child nodes are. This is why anchors are set only after all of
+         * the nodes have been created.
+         */
+        setAnchors: () => {
+          for (const source of aliasObjects) {
+            const ref = sourceObjects.get(source);
+            if (typeof ref === "object" && ref.anchor && (identity.isScalar(ref.node) || identity.isCollection(ref.node))) {
+              ref.node.anchor = ref.anchor;
             } else {
-              logger.debug?.("Sift still unavailable", {
-                host: err.host,
-                status: err.statusCode,
-                unavailableFor: formatDuration(Date.now() - unavailableSince)
-              });
+              const error = new Error("Failed to resolve repeated object (this should not happen)");
+              error.source = source;
+              throw error;
             }
-          } else {
-            logger.error("poll failed", { error: err instanceof Error ? err.message : String(err) });
           }
-        }
-        if (!stopped)
-          schedulePoll(pollIntervalMs);
-      }
-      async function runOnce(available) {
-        let dispatch;
-        try {
-          dispatch = await opts.jobsClient.acceptDispatch(available.id);
-        } catch (err) {
-          const statusCode = err.statusCode;
-          if (statusCode === 409) {
-            logger.debug?.("claim conflict; another member accepted", { jobId: available.id });
-            return;
+        },
+        sourceObjects
+      };
+    }
+    exports2.anchorIsValid = anchorIsValid;
+    exports2.anchorNames = anchorNames;
+    exports2.createNodeAnchors = createNodeAnchors;
+    exports2.findNewAnchor = findNewAnchor;
+  }
+});
+
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/applyReviver.js
+var require_applyReviver = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/applyReviver.js"(exports2) {
+    "use strict";
+    function applyReviver(reviver, obj, key, val) {
+      if (val && typeof val === "object") {
+        if (Array.isArray(val)) {
+          for (let i = 0, len = val.length; i < len; ++i) {
+            const v0 = val[i];
+            const v1 = applyReviver(reviver, val, String(i), v0);
+            if (v1 === void 0)
+              delete val[i];
+            else if (v1 !== v0)
+              val[i] = v1;
           }
-          logger.error("failed to accept dispatch", {
-            jobId: available.id,
-            error: err instanceof Error ? err.message : String(err)
-          });
-          return;
-        }
-        const controller = new AbortController();
-        let quietTimer = null;
-        const quietWindowMs = dispatch.deadline ? new Date(dispatch.deadline).getTime() - Date.now() : null;
-        const armQuietTimer = () => {
-          if (quietWindowMs === null)
-            return;
-          if (quietTimer !== null)
-            clearTimeout(quietTimer);
-          const ms = quietWindowMs - 3e4;
-          if (ms > 0) {
-            quietTimer = setTimeout(() => controller.abort(), ms);
-          } else {
-            controller.abort();
+        } else if (val instanceof Map) {
+          for (const k of Array.from(val.keys())) {
+            const v0 = val.get(k);
+            const v1 = applyReviver(reviver, val, k, v0);
+            if (v1 === void 0)
+              val.delete(k);
+            else if (v1 !== v0)
+              val.set(k, v1);
           }
-        };
-        armQuietTimer();
-        const activity = {
-          record: () => {
-            if (!controller.signal.aborted)
-              armQuietTimer();
+        } else if (val instanceof Set) {
+          for (const v0 of Array.from(val)) {
+            const v1 = applyReviver(reviver, val, v0, v0);
+            if (v1 === void 0)
+              val.delete(v0);
+            else if (v1 !== v0) {
+              val.delete(v0);
+              val.add(v1);
+            }
           }
-        };
-        let result;
-        try {
-          result = await opts.onJob(dispatch, controller.signal, activity);
-        } catch (err) {
-          result = {
-            status: "failed",
-            reason: `onJob threw: ${err instanceof Error ? err.message : String(err)}`
-          };
-        } finally {
-          if (quietTimer !== null)
-            clearTimeout(quietTimer);
-        }
-        try {
-          for (const output of result.outputs ?? []) {
-            await opts.jobsClient.createOutput(dispatch.job.id, {
-              label: output.label,
-              content: output.content
-            });
+        } else {
+          for (const [k, v0] of Object.entries(val)) {
+            const v1 = applyReviver(reviver, val, k, v0);
+            if (v1 === void 0)
+              delete val[k];
+            else if (v1 !== v0)
+              val[k] = v1;
           }
-          await opts.jobsClient.submit(dispatch.job.id, {
-            status: result.status,
-            ...result.reason !== void 0 ? { reason: result.reason } : {}
-          });
-        } catch (err) {
-          logger.error("submit/close failed", {
-            jobId: dispatch.job.id,
-            error: err instanceof Error ? err.message : String(err)
-          });
         }
       }
-      return { start, stop };
+      return reviver.call(obj, key, val);
     }
+    exports2.applyReviver = applyReviver;
   }
 });
 
-// ../../packages/jobs/dist/index.js
-var require_dist3 = __commonJS({
-  "../../packages/jobs/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.subscribe = exports2.ServiceUnavailableError = exports2.NonJsonResponseError = exports2.JobsClient = void 0;
-    var client_1 = require_client2();
-    Object.defineProperty(exports2, "JobsClient", { enumerable: true, get: function() {
-      return client_1.JobsClient;
-    } });
-    var response_1 = require_response();
-    Object.defineProperty(exports2, "NonJsonResponseError", { enumerable: true, get: function() {
-      return response_1.NonJsonResponseError;
-    } });
-    Object.defineProperty(exports2, "ServiceUnavailableError", { enumerable: true, get: function() {
-      return response_1.ServiceUnavailableError;
-    } });
-    var subscribe_1 = require_subscribe();
-    Object.defineProperty(exports2, "subscribe", { enumerable: true, get: function() {
-      return subscribe_1.subscribe;
-    } });
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
-var require_identity = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/toJS.js
+var require_toJS = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/toJS.js"(exports2) {
     "use strict";
-    var ALIAS = Symbol.for("yaml.alias");
-    var DOC = Symbol.for("yaml.document");
-    var MAP = Symbol.for("yaml.map");
-    var PAIR = Symbol.for("yaml.pair");
-    var SCALAR = Symbol.for("yaml.scalar");
-    var SEQ = Symbol.for("yaml.seq");
-    var NODE_TYPE = Symbol.for("yaml.node.type");
-    var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
-    var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
-    var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
-    var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
-    var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
-    function isCollection(node) {
-      if (node && typeof node === "object")
-        switch (node[NODE_TYPE]) {
-          case MAP:
-          case SEQ:
-            return true;
-        }
-      return false;
-    }
-    function isNode(node) {
-      if (node && typeof node === "object")
-        switch (node[NODE_TYPE]) {
-          case ALIAS:
-          case MAP:
-          case SCALAR:
-          case SEQ:
-            return true;
-        }
-      return false;
+    var identity = require_identity();
+    function toJS(value, arg, ctx) {
+      if (Array.isArray(value))
+        return value.map((v, i) => toJS(v, String(i), ctx));
+      if (value && typeof value.toJSON === "function") {
+        if (!ctx || !identity.hasAnchor(value))
+          return value.toJSON(arg, ctx);
+        const data = { aliasCount: 0, count: 1, res: void 0 };
+        ctx.anchors.set(value, data);
+        ctx.onCreate = (res2) => {
+          data.res = res2;
+          delete ctx.onCreate;
+        };
+        const res = value.toJSON(arg, ctx);
+        if (ctx.onCreate)
+          ctx.onCreate(res);
+        return res;
+      }
+      if (typeof value === "bigint" && !ctx?.keep)
+        return Number(value);
+      return value;
     }
-    var hasAnchor = (node) => (isScalar(node) || isCollection(node)) && !!node.anchor;
-    exports2.ALIAS = ALIAS;
-    exports2.DOC = DOC;
-    exports2.MAP = MAP;
-    exports2.NODE_TYPE = NODE_TYPE;
-    exports2.PAIR = PAIR;
-    exports2.SCALAR = SCALAR;
-    exports2.SEQ = SEQ;
-    exports2.hasAnchor = hasAnchor;
-    exports2.isAlias = isAlias;
-    exports2.isCollection = isCollection;
-    exports2.isDocument = isDocument;
-    exports2.isMap = isMap;
-    exports2.isNode = isNode;
-    exports2.isPair = isPair;
-    exports2.isScalar = isScalar;
-    exports2.isSeq = isSeq;
+    exports2.toJS = toJS;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/visit.js
-var require_visit = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/visit.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Node.js
+var require_Node = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Node.js"(exports2) {
     "use strict";
+    var applyReviver = require_applyReviver();
     var identity = require_identity();
-    var BREAK = Symbol("break visit");
-    var SKIP = Symbol("skip children");
-    var REMOVE = Symbol("remove node");
-    function visit(node, visitor) {
-      const visitor_ = initVisitor(visitor);
-      if (identity.isDocument(node)) {
-        const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
-        if (cd === REMOVE)
-          node.contents = null;
-      } else
-        visit_(null, node, visitor_, Object.freeze([]));
-    }
-    visit.BREAK = BREAK;
-    visit.SKIP = SKIP;
-    visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path) {
-      const ctrl = callVisitor(key, node, visitor, path);
-      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path, ctrl);
-        return visit_(key, ctrl, visitor, path);
-      }
-      if (typeof ctrl !== "symbol") {
-        if (identity.isCollection(node)) {
-          path = Object.freeze(path.concat(node));
-          for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path);
-            if (typeof ci === "number")
-              i = ci - 1;
-            else if (ci === BREAK)
-              return BREAK;
-            else if (ci === REMOVE) {
-              node.items.splice(i, 1);
-              i -= 1;
-            }
-          }
-        } else if (identity.isPair(node)) {
-          path = Object.freeze(path.concat(node));
-          const ck = visit_("key", node.key, visitor, path);
-          if (ck === BREAK)
-            return BREAK;
-          else if (ck === REMOVE)
-            node.key = null;
-          const cv = visit_("value", node.value, visitor, path);
-          if (cv === BREAK)
-            return BREAK;
-          else if (cv === REMOVE)
-            node.value = null;
-        }
-      }
-      return ctrl;
-    }
-    async function visitAsync(node, visitor) {
-      const visitor_ = initVisitor(visitor);
-      if (identity.isDocument(node)) {
-        const cd = await visitAsync_(null, node.contents, visitor_, Object.freeze([node]));
-        if (cd === REMOVE)
-          node.contents = null;
-      } else
-        await visitAsync_(null, node, visitor_, Object.freeze([]));
-    }
-    visitAsync.BREAK = BREAK;
-    visitAsync.SKIP = SKIP;
-    visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path) {
-      const ctrl = await callVisitor(key, node, visitor, path);
-      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path, ctrl);
-        return visitAsync_(key, ctrl, visitor, path);
-      }
-      if (typeof ctrl !== "symbol") {
-        if (identity.isCollection(node)) {
-          path = Object.freeze(path.concat(node));
-          for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path);
-            if (typeof ci === "number")
-              i = ci - 1;
-            else if (ci === BREAK)
-              return BREAK;
-            else if (ci === REMOVE) {
-              node.items.splice(i, 1);
-              i -= 1;
-            }
-          }
-        } else if (identity.isPair(node)) {
-          path = Object.freeze(path.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path);
-          if (ck === BREAK)
-            return BREAK;
-          else if (ck === REMOVE)
-            node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path);
-          if (cv === BREAK)
-            return BREAK;
-          else if (cv === REMOVE)
-            node.value = null;
-        }
+    var toJS = require_toJS();
+    var NodeBase = class {
+      constructor(type) {
+        Object.defineProperty(this, identity.NODE_TYPE, { value: type });
       }
-      return ctrl;
-    }
-    function initVisitor(visitor) {
-      if (typeof visitor === "object" && (visitor.Collection || visitor.Node || visitor.Value)) {
-        return Object.assign({
-          Alias: visitor.Node,
-          Map: visitor.Node,
-          Scalar: visitor.Node,
-          Seq: visitor.Node
-        }, visitor.Value && {
-          Map: visitor.Value,
-          Scalar: visitor.Value,
-          Seq: visitor.Value
-        }, visitor.Collection && {
-          Map: visitor.Collection,
-          Seq: visitor.Collection
-        }, visitor);
+      /** Create a copy of this node.  */
+      clone() {
+        const copy = Object.create(Object.getPrototypeOf(this), Object.getOwnPropertyDescriptors(this));
+        if (this.range)
+          copy.range = this.range.slice();
+        return copy;
       }
-      return visitor;
-    }
-    function callVisitor(key, node, visitor, path) {
-      if (typeof visitor === "function")
-        return visitor(key, node, path);
-      if (identity.isMap(node))
-        return visitor.Map?.(key, node, path);
-      if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path);
-      if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path);
-      if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path);
-      if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path);
-      return void 0;
-    }
-    function replaceNode(key, path, node) {
-      const parent = path[path.length - 1];
-      if (identity.isCollection(parent)) {
-        parent.items[key] = node;
-      } else if (identity.isPair(parent)) {
-        if (key === "key")
-          parent.key = node;
-        else
-          parent.value = node;
-      } else if (identity.isDocument(parent)) {
-        parent.contents = node;
-      } else {
-        const pt = identity.isAlias(parent) ? "alias" : "scalar";
-        throw new Error(`Cannot replace node with ${pt} parent`);
+      /** A plain JavaScript representation of this node. */
+      toJS(doc, { mapAsMap, maxAliasCount, onAnchor, reviver } = {}) {
+        if (!identity.isDocument(doc))
+          throw new TypeError("A document argument is required");
+        const ctx = {
+          anchors: /* @__PURE__ */ new Map(),
+          doc,
+          keep: true,
+          mapAsMap: mapAsMap === true,
+          mapKeyWarned: false,
+          maxAliasCount: typeof maxAliasCount === "number" ? maxAliasCount : 100
+        };
+        const res = toJS.toJS(this, "", ctx);
+        if (typeof onAnchor === "function")
+          for (const { count, res: res2 } of ctx.anchors.values())
+            onAnchor(res2, count);
+        return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
       }
-    }
-    exports2.visit = visit;
-    exports2.visitAsync = visitAsync;
+    };
+    exports2.NodeBase = NodeBase;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/directives.js
-var require_directives = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/directives.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Alias.js
+var require_Alias = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Alias.js"(exports2) {
     "use strict";
-    var identity = require_identity();
+    var anchors = require_anchors();
     var visit = require_visit();
-    var escapeChars = {
-      "!": "%21",
-      ",": "%2C",
-      "[": "%5B",
-      "]": "%5D",
-      "{": "%7B",
-      "}": "%7D"
-    };
-    var escapeTagName = (tn) => tn.replace(/[!,[\]{}]/g, (ch) => escapeChars[ch]);
-    var Directives = class _Directives {
-      constructor(yaml, tags) {
-        this.docStart = null;
-        this.docEnd = false;
-        this.yaml = Object.assign({}, _Directives.defaultYaml, yaml);
-        this.tags = Object.assign({}, _Directives.defaultTags, tags);
-      }
-      clone() {
-        const copy = new _Directives(this.yaml, this.tags);
-        copy.docStart = this.docStart;
-        return copy;
+    var identity = require_identity();
+    var Node = require_Node();
+    var toJS = require_toJS();
+    var Alias = class extends Node.NodeBase {
+      constructor(source) {
+        super(identity.ALIAS);
+        this.source = source;
+        Object.defineProperty(this, "tag", {
+          set() {
+            throw new Error("Alias nodes cannot have tags");
+          }
+        });
       }
       /**
-       * During parsing, get a Directives instance for the current document and
-       * update the stream state according to the current version's spec.
+       * Resolve the value of this alias within `doc`, finding the last
+       * instance of the `source` anchor before this node.
        */
-      atDocument() {
-        const res = new _Directives(this.yaml, this.tags);
-        switch (this.yaml.version) {
-          case "1.1":
-            this.atNextDocument = true;
-            break;
-          case "1.2":
-            this.atNextDocument = false;
-            this.yaml = {
-              explicit: _Directives.defaultYaml.explicit,
-              version: "1.2"
-            };
-            this.tags = Object.assign({}, _Directives.defaultTags);
+      resolve(doc, ctx) {
+        if (ctx?.maxAliasCount === 0)
+          throw new ReferenceError("Alias resolution is disabled");
+        let nodes;
+        if (ctx?.aliasResolveCache) {
+          nodes = ctx.aliasResolveCache;
+        } else {
+          nodes = [];
+          visit.visit(doc, {
+            Node: (_key, node) => {
+              if (identity.isAlias(node) || identity.hasAnchor(node))
+                nodes.push(node);
+            }
+          });
+          if (ctx)
+            ctx.aliasResolveCache = nodes;
+        }
+        let found = void 0;
+        for (const node of nodes) {
+          if (node === this)
             break;
+          if (node.anchor === this.source)
+            found = node;
         }
-        return res;
+        return found;
       }
-      /**
-       * @param onError - May be called even if the action was successful
-       * @returns `true` on success
-       */
-      add(line, onError) {
-        if (this.atNextDocument) {
-          this.yaml = { explicit: _Directives.defaultYaml.explicit, version: "1.1" };
-          this.tags = Object.assign({}, _Directives.defaultTags);
-          this.atNextDocument = false;
-        }
-        const parts = line.trim().split(/[ \t]+/);
-        const name = parts.shift();
-        switch (name) {
-          case "%TAG": {
-            if (parts.length !== 2) {
-              onError(0, "%TAG directive should contain exactly two parts");
-              if (parts.length < 2)
-                return false;
-            }
-            const [handle, prefix] = parts;
-            this.tags[handle] = prefix;
-            return true;
-          }
-          case "%YAML": {
-            this.yaml.explicit = true;
-            if (parts.length !== 1) {
-              onError(0, "%YAML directive should contain exactly one part");
-              return false;
-            }
-            const [version] = parts;
-            if (version === "1.1" || version === "1.2") {
-              this.yaml.version = version;
-              return true;
-            } else {
-              const isValid = /^\d+\.\d+$/.test(version);
-              onError(6, `Unsupported YAML version ${version}`, isValid);
-              return false;
-            }
-          }
-          default:
-            onError(0, `Unknown directive ${name}`, true);
-            return false;
+      toJSON(_arg, ctx) {
+        if (!ctx)
+          return { source: this.source };
+        const { anchors: anchors2, doc, maxAliasCount } = ctx;
+        const source = this.resolve(doc, ctx);
+        if (!source) {
+          const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
+          throw new ReferenceError(msg);
         }
-      }
-      /**
-       * Resolves a tag, matching handles to those defined in %TAG directives.
-       *
-       * @returns Resolved tag, which may also be the non-specific tag `'!'` or a
-       *   `'!local'` tag, or `null` if unresolvable.
-       */
-      tagName(source, onError) {
-        if (source === "!")
-          return "!";
-        if (source[0] !== "!") {
-          onError(`Not a valid tag: ${source}`);
-          return null;
+        let data = anchors2.get(source);
+        if (!data) {
+          toJS.toJS(source, null, ctx);
+          data = anchors2.get(source);
         }
-        if (source[1] === "<") {
-          const verbatim = source.slice(2, -1);
-          if (verbatim === "!" || verbatim === "!!") {
-            onError(`Verbatim tags aren't resolved, so ${source} is invalid.`);
-            return null;
-          }
-          if (source[source.length - 1] !== ">")
-            onError("Verbatim tags must end with a >");
-          return verbatim;
+        if (data?.res === void 0) {
+          const msg = "This should not happen: Alias anchor was not resolved?";
+          throw new ReferenceError(msg);
         }
-        const [, handle, suffix] = source.match(/^(.*!)([^!]*)$/s);
-        if (!suffix)
-          onError(`The ${source} tag has no suffix`);
-        const prefix = this.tags[handle];
-        if (prefix) {
-          try {
-            return prefix + decodeURIComponent(suffix);
-          } catch (error) {
-            onError(String(error));
-            return null;
+        if (maxAliasCount >= 0) {
+          data.count += 1;
+          if (data.aliasCount === 0)
+            data.aliasCount = getAliasCount(doc, source, anchors2);
+          if (data.count * data.aliasCount > maxAliasCount) {
+            const msg = "Excessive alias count indicates a resource exhaustion attack";
+            throw new ReferenceError(msg);
           }
         }
-        if (handle === "!")
-          return source;
-        onError(`Could not resolve tag: ${source}`);
-        return null;
+        return data.res;
       }
-      /**
-       * Given a fully resolved tag, returns its printable string form,
-       * taking into account current tag prefixes and defaults.
-       */
-      tagString(tag) {
-        for (const [handle, prefix] of Object.entries(this.tags)) {
-          if (tag.startsWith(prefix))
-            return handle + escapeTagName(tag.substring(prefix.length));
+      toString(ctx, _onComment, _onChompKeep) {
+        const src = `*${this.source}`;
+        if (ctx) {
+          anchors.anchorIsValid(this.source);
+          if (ctx.options.verifyAliasOrder && !ctx.anchors.has(this.source)) {
+            const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
+            throw new Error(msg);
+          }
+          if (ctx.implicitKey)
+            return `${src} `;
         }
-        return tag[0] === "!" ? tag : `!<${tag}>`;
+        return src;
       }
-      toString(doc) {
-        const lines = this.yaml.explicit ? [`%YAML ${this.yaml.version || "1.2"}`] : [];
-        const tagEntries = Object.entries(this.tags);
-        let tagNames;
-        if (doc && tagEntries.length > 0 && identity.isNode(doc.contents)) {
-          const tags = {};
-          visit.visit(doc.contents, (_key, node) => {
-            if (identity.isNode(node) && node.tag)
-              tags[node.tag] = true;
-          });
-          tagNames = Object.keys(tags);
-        } else
-          tagNames = [];
-        for (const [handle, prefix] of tagEntries) {
-          if (handle === "!!" && prefix === "tag:yaml.org,2002:")
-            continue;
-          if (!doc || tagNames.some((tn) => tn.startsWith(prefix)))
-            lines.push(`%TAG ${handle} ${prefix}`);
+    };
+    function getAliasCount(doc, node, anchors2) {
+      if (identity.isAlias(node)) {
+        const source = node.resolve(doc);
+        const anchor = anchors2 && source && anchors2.get(source);
+        return anchor ? anchor.count * anchor.aliasCount : 0;
+      } else if (identity.isCollection(node)) {
+        let count = 0;
+        for (const item of node.items) {
+          const c = getAliasCount(doc, item, anchors2);
+          if (c > count)
+            count = c;
         }
-        return lines.join("\n");
+        return count;
+      } else if (identity.isPair(node)) {
+        const kc = getAliasCount(doc, node.key, anchors2);
+        const vc = getAliasCount(doc, node.value, anchors2);
+        return Math.max(kc, vc);
       }
-    };
-    Directives.defaultYaml = { explicit: false, version: "1.2" };
-    Directives.defaultTags = { "!!": "tag:yaml.org,2002:" };
-    exports2.Directives = Directives;
+      return 1;
+    }
+    exports2.Alias = Alias;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/anchors.js
-var require_anchors = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/anchors.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Scalar.js
+var require_Scalar = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Scalar.js"(exports2) {
     "use strict";
     var identity = require_identity();
-    var visit = require_visit();
-    function anchorIsValid(anchor) {
-      if (/[\x00-\x19\s,[\]{}]/.test(anchor)) {
-        const sa = JSON.stringify(anchor);
-        const msg = `Anchor must not contain whitespace or control characters: ${sa}`;
-        throw new Error(msg);
+    var Node = require_Node();
+    var toJS = require_toJS();
+    var isScalarValue = (value) => !value || typeof value !== "function" && typeof value !== "object";
+    var Scalar = class extends Node.NodeBase {
+      constructor(value) {
+        super(identity.SCALAR);
+        this.value = value;
       }
-      return true;
-    }
-    function anchorNames(root) {
-      const anchors = /* @__PURE__ */ new Set();
-      visit.visit(root, {
-        Value(_key, node) {
-          if (node.anchor)
-            anchors.add(node.anchor);
-        }
-      });
-      return anchors;
-    }
-    function findNewAnchor(prefix, exclude) {
-      for (let i = 1; true; ++i) {
-        const name = `${prefix}${i}`;
-        if (!exclude.has(name))
-          return name;
+      toJSON(arg, ctx) {
+        return ctx?.keep ? this.value : toJS.toJS(this.value, arg, ctx);
       }
-    }
-    function createNodeAnchors(doc, prefix) {
-      const aliasObjects = [];
-      const sourceObjects = /* @__PURE__ */ new Map();
-      let prevAnchors = null;
-      return {
-        onAnchor: (source) => {
-          aliasObjects.push(source);
-          prevAnchors ?? (prevAnchors = anchorNames(doc));
-          const anchor = findNewAnchor(prefix, prevAnchors);
-          prevAnchors.add(anchor);
-          return anchor;
-        },
-        /**
-         * With circular references, the source node is only resolved after all
-         * of its child nodes are. This is why anchors are set only after all of
-         * the nodes have been created.
-         */
-        setAnchors: () => {
-          for (const source of aliasObjects) {
-            const ref = sourceObjects.get(source);
-            if (typeof ref === "object" && ref.anchor && (identity.isScalar(ref.node) || identity.isCollection(ref.node))) {
-              ref.node.anchor = ref.anchor;
-            } else {
-              const error = new Error("Failed to resolve repeated object (this should not happen)");
-              error.source = source;
-              throw error;
-            }
-          }
-        },
-        sourceObjects
-      };
-    }
-    exports2.anchorIsValid = anchorIsValid;
-    exports2.anchorNames = anchorNames;
-    exports2.createNodeAnchors = createNodeAnchors;
-    exports2.findNewAnchor = findNewAnchor;
+      toString() {
+        return String(this.value);
+      }
+    };
+    Scalar.BLOCK_FOLDED = "BLOCK_FOLDED";
+    Scalar.BLOCK_LITERAL = "BLOCK_LITERAL";
+    Scalar.PLAIN = "PLAIN";
+    Scalar.QUOTE_DOUBLE = "QUOTE_DOUBLE";
+    Scalar.QUOTE_SINGLE = "QUOTE_SINGLE";
+    exports2.Scalar = Scalar;
+    exports2.isScalarValue = isScalarValue;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/applyReviver.js
-var require_applyReviver = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/applyReviver.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/createNode.js
+var require_createNode = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/createNode.js"(exports2) {
     "use strict";
-    function applyReviver(reviver, obj, key, val) {
-      if (val && typeof val === "object") {
-        if (Array.isArray(val)) {
-          for (let i = 0, len = val.length; i < len; ++i) {
-            const v0 = val[i];
-            const v1 = applyReviver(reviver, val, String(i), v0);
-            if (v1 === void 0)
-              delete val[i];
-            else if (v1 !== v0)
-              val[i] = v1;
-          }
-        } else if (val instanceof Map) {
-          for (const k of Array.from(val.keys())) {
-            const v0 = val.get(k);
-            const v1 = applyReviver(reviver, val, k, v0);
-            if (v1 === void 0)
-              val.delete(k);
-            else if (v1 !== v0)
-              val.set(k, v1);
-          }
-        } else if (val instanceof Set) {
-          for (const v0 of Array.from(val)) {
-            const v1 = applyReviver(reviver, val, v0, v0);
-            if (v1 === void 0)
-              val.delete(v0);
-            else if (v1 !== v0) {
-              val.delete(v0);
-              val.add(v1);
-            }
-          }
+    var Alias = require_Alias();
+    var identity = require_identity();
+    var Scalar = require_Scalar();
+    var defaultTagPrefix = "tag:yaml.org,2002:";
+    function findTagObject(value, tagName, tags) {
+      if (tagName) {
+        const match = tags.filter((t) => t.tag === tagName);
+        const tagObj = match.find((t) => !t.format) ?? match[0];
+        if (!tagObj)
+          throw new Error(`Tag ${tagName} not found`);
+        return tagObj;
+      }
+      return tags.find((t) => t.identify?.(value) && !t.format);
+    }
+    function createNode(value, tagName, ctx) {
+      if (identity.isDocument(value))
+        value = value.contents;
+      if (identity.isNode(value))
+        return value;
+      if (identity.isPair(value)) {
+        const map = ctx.schema[identity.MAP].createNode?.(ctx.schema, null, ctx);
+        map.items.push(value);
+        return map;
+      }
+      if (value instanceof String || value instanceof Number || value instanceof Boolean || typeof BigInt !== "undefined" && value instanceof BigInt) {
+        value = value.valueOf();
+      }
+      const { aliasDuplicateObjects, onAnchor, onTagObj, schema, sourceObjects } = ctx;
+      let ref = void 0;
+      if (aliasDuplicateObjects && value && typeof value === "object") {
+        ref = sourceObjects.get(value);
+        if (ref) {
+          ref.anchor ?? (ref.anchor = onAnchor(value));
+          return new Alias.Alias(ref.anchor);
         } else {
-          for (const [k, v0] of Object.entries(val)) {
-            const v1 = applyReviver(reviver, val, k, v0);
-            if (v1 === void 0)
-              delete val[k];
-            else if (v1 !== v0)
-              val[k] = v1;
-          }
+          ref = { anchor: null, node: null };
+          sourceObjects.set(value, ref);
         }
       }
-      return reviver.call(obj, key, val);
+      if (tagName?.startsWith("!!"))
+        tagName = defaultTagPrefix + tagName.slice(2);
+      let tagObj = findTagObject(value, tagName, schema.tags);
+      if (!tagObj) {
+        if (value && typeof value.toJSON === "function") {
+          value = value.toJSON();
+        }
+        if (!value || typeof value !== "object") {
+          const node2 = new Scalar.Scalar(value);
+          if (ref)
+            ref.node = node2;
+          return node2;
+        }
+        tagObj = value instanceof Map ? schema[identity.MAP] : Symbol.iterator in Object(value) ? schema[identity.SEQ] : schema[identity.MAP];
+      }
+      if (onTagObj) {
+        onTagObj(tagObj);
+        delete ctx.onTagObj;
+      }
+      const node = tagObj?.createNode ? tagObj.createNode(ctx.schema, value, ctx) : typeof tagObj?.nodeClass?.from === "function" ? tagObj.nodeClass.from(ctx.schema, value, ctx) : new Scalar.Scalar(value);
+      if (tagName)
+        node.tag = tagName;
+      else if (!tagObj.default)
+        node.tag = tagObj.tag;
+      if (ref)
+        ref.node = node;
+      return node;
     }
-    exports2.applyReviver = applyReviver;
+    exports2.createNode = createNode;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/toJS.js
-var require_toJS = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/toJS.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Collection.js
+var require_Collection = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Collection.js"(exports2) {
     "use strict";
+    var createNode = require_createNode();
     var identity = require_identity();
-    function toJS(value, arg, ctx) {
-      if (Array.isArray(value))
-        return value.map((v, i) => toJS(v, String(i), ctx));
-      if (value && typeof value.toJSON === "function") {
-        if (!ctx || !identity.hasAnchor(value))
-          return value.toJSON(arg, ctx);
-        const data = { aliasCount: 0, count: 1, res: void 0 };
-        ctx.anchors.set(value, data);
-        ctx.onCreate = (res2) => {
-          data.res = res2;
-          delete ctx.onCreate;
-        };
-        const res = value.toJSON(arg, ctx);
-        if (ctx.onCreate)
-          ctx.onCreate(res);
-        return res;
+    var Node = require_Node();
+    function collectionFromPath(schema, path, value) {
+      let v = value;
+      for (let i = path.length - 1; i >= 0; --i) {
+        const k = path[i];
+        if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
+          const a = [];
+          a[k] = v;
+          v = a;
+        } else {
+          v = /* @__PURE__ */ new Map([[k, v]]);
+        }
       }
-      if (typeof value === "bigint" && !ctx?.keep)
-        return Number(value);
-      return value;
+      return createNode.createNode(v, void 0, {
+        aliasDuplicateObjects: false,
+        keepUndefined: false,
+        onAnchor: () => {
+          throw new Error("This should not happen, please report a bug.");
+        },
+        schema,
+        sourceObjects: /* @__PURE__ */ new Map()
+      });
     }
-    exports2.toJS = toJS;
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Node.js
-var require_Node = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Node.js"(exports2) {
-    "use strict";
-    var applyReviver = require_applyReviver();
-    var identity = require_identity();
-    var toJS = require_toJS();
-    var NodeBase = class {
-      constructor(type) {
-        Object.defineProperty(this, identity.NODE_TYPE, { value: type });
+    var isEmptyPath = (path) => path == null || typeof path === "object" && !!path[Symbol.iterator]().next().done;
+    var Collection = class extends Node.NodeBase {
+      constructor(type, schema) {
+        super(type);
+        Object.defineProperty(this, "schema", {
+          value: schema,
+          configurable: true,
+          enumerable: false,
+          writable: true
+        });
       }
-      /** Create a copy of this node.  */
-      clone() {
+      /**
+       * Create a copy of this collection.
+       *
+       * @param schema - If defined, overwrites the original's schema
+       */
+      clone(schema) {
         const copy = Object.create(Object.getPrototypeOf(this), Object.getOwnPropertyDescriptors(this));
+        if (schema)
+          copy.schema = schema;
+        copy.items = copy.items.map((it) => identity.isNode(it) || identity.isPair(it) ? it.clone(schema) : it);
         if (this.range)
           copy.range = this.range.slice();
         return copy;
       }
-      /** A plain JavaScript representation of this node. */
-      toJS(doc, { mapAsMap, maxAliasCount, onAnchor, reviver } = {}) {
-        if (!identity.isDocument(doc))
-          throw new TypeError("A document argument is required");
-        const ctx = {
-          anchors: /* @__PURE__ */ new Map(),
-          doc,
-          keep: true,
-          mapAsMap: mapAsMap === true,
-          mapKeyWarned: false,
-          maxAliasCount: typeof maxAliasCount === "number" ? maxAliasCount : 100
-        };
-        const res = toJS.toJS(this, "", ctx);
-        if (typeof onAnchor === "function")
-          for (const { count, res: res2 } of ctx.anchors.values())
-            onAnchor(res2, count);
-        return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
+      /**
+       * Adds a value to the collection. For `!!map` and `!!omap` the value must
+       * be a Pair instance or a `{ key, value }` object, which may not have a key
+       * that already exists in the map.
+       */
+      addIn(path, value) {
+        if (isEmptyPath(path))
+          this.add(value);
+        else {
+          const [key, ...rest] = path;
+          const node = this.get(key, true);
+          if (identity.isCollection(node))
+            node.addIn(rest, value);
+          else if (node === void 0 && this.schema)
+            this.set(key, collectionFromPath(this.schema, rest, value));
+          else
+            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+        }
       }
-    };
-    exports2.NodeBase = NodeBase;
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Alias.js
-var require_Alias = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Alias.js"(exports2) {
-    "use strict";
-    var anchors = require_anchors();
-    var visit = require_visit();
-    var identity = require_identity();
-    var Node = require_Node();
-    var toJS = require_toJS();
-    var Alias = class extends Node.NodeBase {
-      constructor(source) {
-        super(identity.ALIAS);
-        this.source = source;
-        Object.defineProperty(this, "tag", {
-          set() {
-            throw new Error("Alias nodes cannot have tags");
-          }
-        });
+      /**
+       * Removes a value from the collection.
+       * @returns `true` if the item was found and removed.
+       */
+      deleteIn(path) {
+        const [key, ...rest] = path;
+        if (rest.length === 0)
+          return this.delete(key);
+        const node = this.get(key, true);
+        if (identity.isCollection(node))
+          return node.deleteIn(rest);
+        else
+          throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
       }
       /**
-       * Resolve the value of this alias within `doc`, finding the last
-       * instance of the `source` anchor before this node.
+       * Returns item at `key`, or `undefined` if not found. By default unwraps
+       * scalar values from their surrounding node; to disable set `keepScalar` to
+       * `true` (collections are always returned intact).
        */
-      resolve(doc, ctx) {
-        if (ctx?.maxAliasCount === 0)
-          throw new ReferenceError("Alias resolution is disabled");
-        let nodes;
-        if (ctx?.aliasResolveCache) {
-          nodes = ctx.aliasResolveCache;
-        } else {
-          nodes = [];
-          visit.visit(doc, {
-            Node: (_key, node) => {
-              if (identity.isAlias(node) || identity.hasAnchor(node))
-                nodes.push(node);
-            }
-          });
-          if (ctx)
-            ctx.aliasResolveCache = nodes;
-        }
-        let found = void 0;
-        for (const node of nodes) {
-          if (node === this)
-            break;
-          if (node.anchor === this.source)
-            found = node;
-        }
-        return found;
+      getIn(path, keepScalar) {
+        const [key, ...rest] = path;
+        const node = this.get(key, true);
+        if (rest.length === 0)
+          return !keepScalar && identity.isScalar(node) ? node.value : node;
+        else
+          return identity.isCollection(node) ? node.getIn(rest, keepScalar) : void 0;
       }
-      toJSON(_arg, ctx) {
-        if (!ctx)
-          return { source: this.source };
-        const { anchors: anchors2, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
-        if (!source) {
-          const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
-          throw new ReferenceError(msg);
-        }
-        let data = anchors2.get(source);
-        if (!data) {
-          toJS.toJS(source, null, ctx);
-          data = anchors2.get(source);
-        }
-        if (data?.res === void 0) {
-          const msg = "This should not happen: Alias anchor was not resolved?";
-          throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-          data.count += 1;
-          if (data.aliasCount === 0)
-            data.aliasCount = getAliasCount(doc, source, anchors2);
-          if (data.count * data.aliasCount > maxAliasCount) {
-            const msg = "Excessive alias count indicates a resource exhaustion attack";
-            throw new ReferenceError(msg);
-          }
-        }
-        return data.res;
+      hasAllNullValues(allowScalar) {
+        return this.items.every((node) => {
+          if (!identity.isPair(node))
+            return false;
+          const n = node.value;
+          return n == null || allowScalar && identity.isScalar(n) && n.value == null && !n.commentBefore && !n.comment && !n.tag;
+        });
       }
-      toString(ctx, _onComment, _onChompKeep) {
-        const src = `*${this.source}`;
-        if (ctx) {
-          anchors.anchorIsValid(this.source);
-          if (ctx.options.verifyAliasOrder && !ctx.anchors.has(this.source)) {
-            const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
-            throw new Error(msg);
-          }
-          if (ctx.implicitKey)
-            return `${src} `;
-        }
-        return src;
+      /**
+       * Checks if the collection includes a value with the key `key`.
+       */
+      hasIn(path) {
+        const [key, ...rest] = path;
+        if (rest.length === 0)
+          return this.has(key);
+        const node = this.get(key, true);
+        return identity.isCollection(node) ? node.hasIn(rest) : false;
       }
-    };
-    function getAliasCount(doc, node, anchors2) {
-      if (identity.isAlias(node)) {
-        const source = node.resolve(doc);
-        const anchor = anchors2 && source && anchors2.get(source);
-        return anchor ? anchor.count * anchor.aliasCount : 0;
-      } else if (identity.isCollection(node)) {
-        let count = 0;
-        for (const item of node.items) {
-          const c = getAliasCount(doc, item, anchors2);
-          if (c > count)
-            count = c;
+      /**
+       * Sets a value in this collection. For `!!set`, `value` needs to be a
+       * boolean to add/remove the item from the set.
+       */
+      setIn(path, value) {
+        const [key, ...rest] = path;
+        if (rest.length === 0) {
+          this.set(key, value);
+        } else {
+          const node = this.get(key, true);
+          if (identity.isCollection(node))
+            node.setIn(rest, value);
+          else if (node === void 0 && this.schema)
+            this.set(key, collectionFromPath(this.schema, rest, value));
+          else
+            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
         }
-        return count;
-      } else if (identity.isPair(node)) {
-        const kc = getAliasCount(doc, node.key, anchors2);
-        const vc = getAliasCount(doc, node.value, anchors2);
-        return Math.max(kc, vc);
       }
-      return 1;
-    }
-    exports2.Alias = Alias;
+    };
+    exports2.Collection = Collection;
+    exports2.collectionFromPath = collectionFromPath;
+    exports2.isEmptyPath = isEmptyPath;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Scalar.js
-var require_Scalar = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Scalar.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyComment.js
+var require_stringifyComment = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyComment.js"(exports2) {
     "use strict";
-    var identity = require_identity();
-    var Node = require_Node();
-    var toJS = require_toJS();
-    var isScalarValue = (value) => !value || typeof value !== "function" && typeof value !== "object";
-    var Scalar = class extends Node.NodeBase {
-      constructor(value) {
-        super(identity.SCALAR);
-        this.value = value;
-      }
-      toJSON(arg, ctx) {
-        return ctx?.keep ? this.value : toJS.toJS(this.value, arg, ctx);
-      }
-      toString() {
-        return String(this.value);
-      }
-    };
-    Scalar.BLOCK_FOLDED = "BLOCK_FOLDED";
-    Scalar.BLOCK_LITERAL = "BLOCK_LITERAL";
-    Scalar.PLAIN = "PLAIN";
-    Scalar.QUOTE_DOUBLE = "QUOTE_DOUBLE";
-    Scalar.QUOTE_SINGLE = "QUOTE_SINGLE";
-    exports2.Scalar = Scalar;
-    exports2.isScalarValue = isScalarValue;
+    var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
+    function indentComment(comment, indent) {
+      if (/^\n+$/.test(comment))
+        return comment.substring(1);
+      return indent ? comment.replace(/^(?! *$)/gm, indent) : comment;
+    }
+    var lineComment = (str, indent, comment) => str.endsWith("\n") ? indentComment(comment, indent) : comment.includes("\n") ? "\n" + indentComment(comment, indent) : (str.endsWith(" ") ? "" : " ") + comment;
+    exports2.indentComment = indentComment;
+    exports2.lineComment = lineComment;
+    exports2.stringifyComment = stringifyComment;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/createNode.js
-var require_createNode = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/doc/createNode.js"(exports2) {
-    "use strict";
-    var Alias = require_Alias();
-    var identity = require_identity();
-    var Scalar = require_Scalar();
-    var defaultTagPrefix = "tag:yaml.org,2002:";
-    function findTagObject(value, tagName, tags) {
-      if (tagName) {
-        const match = tags.filter((t) => t.tag === tagName);
-        const tagObj = match.find((t) => !t.format) ?? match[0];
-        if (!tagObj)
-          throw new Error(`Tag ${tagName} not found`);
-        return tagObj;
-      }
-      return tags.find((t) => t.identify?.(value) && !t.format);
-    }
-    function createNode(value, tagName, ctx) {
-      if (identity.isDocument(value))
-        value = value.contents;
-      if (identity.isNode(value))
-        return value;
-      if (identity.isPair(value)) {
-        const map = ctx.schema[identity.MAP].createNode?.(ctx.schema, null, ctx);
-        map.items.push(value);
-        return map;
-      }
-      if (value instanceof String || value instanceof Number || value instanceof Boolean || typeof BigInt !== "undefined" && value instanceof BigInt) {
-        value = value.valueOf();
-      }
-      const { aliasDuplicateObjects, onAnchor, onTagObj, schema, sourceObjects } = ctx;
-      let ref = void 0;
-      if (aliasDuplicateObjects && value && typeof value === "object") {
-        ref = sourceObjects.get(value);
-        if (ref) {
-          ref.anchor ?? (ref.anchor = onAnchor(value));
-          return new Alias.Alias(ref.anchor);
-        } else {
-          ref = { anchor: null, node: null };
-          sourceObjects.set(value, ref);
-        }
-      }
-      if (tagName?.startsWith("!!"))
-        tagName = defaultTagPrefix + tagName.slice(2);
-      let tagObj = findTagObject(value, tagName, schema.tags);
-      if (!tagObj) {
-        if (value && typeof value.toJSON === "function") {
-          value = value.toJSON();
-        }
-        if (!value || typeof value !== "object") {
-          const node2 = new Scalar.Scalar(value);
-          if (ref)
-            ref.node = node2;
-          return node2;
-        }
-        tagObj = value instanceof Map ? schema[identity.MAP] : Symbol.iterator in Object(value) ? schema[identity.SEQ] : schema[identity.MAP];
-      }
-      if (onTagObj) {
-        onTagObj(tagObj);
-        delete ctx.onTagObj;
-      }
-      const node = tagObj?.createNode ? tagObj.createNode(ctx.schema, value, ctx) : typeof tagObj?.nodeClass?.from === "function" ? tagObj.nodeClass.from(ctx.schema, value, ctx) : new Scalar.Scalar(value);
-      if (tagName)
-        node.tag = tagName;
-      else if (!tagObj.default)
-        node.tag = tagObj.tag;
-      if (ref)
-        ref.node = node;
-      return node;
-    }
-    exports2.createNode = createNode;
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Collection.js
-var require_Collection = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/Collection.js"(exports2) {
-    "use strict";
-    var createNode = require_createNode();
-    var identity = require_identity();
-    var Node = require_Node();
-    function collectionFromPath(schema, path, value) {
-      let v = value;
-      for (let i = path.length - 1; i >= 0; --i) {
-        const k = path[i];
-        if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
-          const a = [];
-          a[k] = v;
-          v = a;
-        } else {
-          v = /* @__PURE__ */ new Map([[k, v]]);
-        }
-      }
-      return createNode.createNode(v, void 0, {
-        aliasDuplicateObjects: false,
-        keepUndefined: false,
-        onAnchor: () => {
-          throw new Error("This should not happen, please report a bug.");
-        },
-        schema,
-        sourceObjects: /* @__PURE__ */ new Map()
-      });
-    }
-    var isEmptyPath = (path) => path == null || typeof path === "object" && !!path[Symbol.iterator]().next().done;
-    var Collection = class extends Node.NodeBase {
-      constructor(type, schema) {
-        super(type);
-        Object.defineProperty(this, "schema", {
-          value: schema,
-          configurable: true,
-          enumerable: false,
-          writable: true
-        });
-      }
-      /**
-       * Create a copy of this collection.
-       *
-       * @param schema - If defined, overwrites the original's schema
-       */
-      clone(schema) {
-        const copy = Object.create(Object.getPrototypeOf(this), Object.getOwnPropertyDescriptors(this));
-        if (schema)
-          copy.schema = schema;
-        copy.items = copy.items.map((it) => identity.isNode(it) || identity.isPair(it) ? it.clone(schema) : it);
-        if (this.range)
-          copy.range = this.range.slice();
-        return copy;
-      }
-      /**
-       * Adds a value to the collection. For `!!map` and `!!omap` the value must
-       * be a Pair instance or a `{ key, value }` object, which may not have a key
-       * that already exists in the map.
-       */
-      addIn(path, value) {
-        if (isEmptyPath(path))
-          this.add(value);
-        else {
-          const [key, ...rest] = path;
-          const node = this.get(key, true);
-          if (identity.isCollection(node))
-            node.addIn(rest, value);
-          else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
-          else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
-        }
-      }
-      /**
-       * Removes a value from the collection.
-       * @returns `true` if the item was found and removed.
-       */
-      deleteIn(path) {
-        const [key, ...rest] = path;
-        if (rest.length === 0)
-          return this.delete(key);
-        const node = this.get(key, true);
-        if (identity.isCollection(node))
-          return node.deleteIn(rest);
-        else
-          throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
-      }
-      /**
-       * Returns item at `key`, or `undefined` if not found. By default unwraps
-       * scalar values from their surrounding node; to disable set `keepScalar` to
-       * `true` (collections are always returned intact).
-       */
-      getIn(path, keepScalar) {
-        const [key, ...rest] = path;
-        const node = this.get(key, true);
-        if (rest.length === 0)
-          return !keepScalar && identity.isScalar(node) ? node.value : node;
-        else
-          return identity.isCollection(node) ? node.getIn(rest, keepScalar) : void 0;
-      }
-      hasAllNullValues(allowScalar) {
-        return this.items.every((node) => {
-          if (!identity.isPair(node))
-            return false;
-          const n = node.value;
-          return n == null || allowScalar && identity.isScalar(n) && n.value == null && !n.commentBefore && !n.comment && !n.tag;
-        });
-      }
-      /**
-       * Checks if the collection includes a value with the key `key`.
-       */
-      hasIn(path) {
-        const [key, ...rest] = path;
-        if (rest.length === 0)
-          return this.has(key);
-        const node = this.get(key, true);
-        return identity.isCollection(node) ? node.hasIn(rest) : false;
-      }
-      /**
-       * Sets a value in this collection. For `!!set`, `value` needs to be a
-       * boolean to add/remove the item from the set.
-       */
-      setIn(path, value) {
-        const [key, ...rest] = path;
-        if (rest.length === 0) {
-          this.set(key, value);
-        } else {
-          const node = this.get(key, true);
-          if (identity.isCollection(node))
-            node.setIn(rest, value);
-          else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
-          else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
-        }
-      }
-    };
-    exports2.Collection = Collection;
-    exports2.collectionFromPath = collectionFromPath;
-    exports2.isEmptyPath = isEmptyPath;
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyComment.js
-var require_stringifyComment = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyComment.js"(exports2) {
-    "use strict";
-    var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
-    function indentComment(comment, indent) {
-      if (/^\n+$/.test(comment))
-        return comment.substring(1);
-      return indent ? comment.replace(/^(?! *$)/gm, indent) : comment;
-    }
-    var lineComment = (str, indent, comment) => str.endsWith("\n") ? indentComment(comment, indent) : comment.includes("\n") ? "\n" + indentComment(comment, indent) : (str.endsWith(" ") ? "" : " ") + comment;
-    exports2.indentComment = indentComment;
-    exports2.lineComment = lineComment;
-    exports2.stringifyComment = stringifyComment;
-  }
-});
-
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/foldFlowLines.js
-var require_foldFlowLines = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/foldFlowLines.js"(exports2) {
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/foldFlowLines.js
+var require_foldFlowLines = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/foldFlowLines.js"(exports2) {
     "use strict";
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
@@ -20028,126 +19628,673 @@ var require_public_api = __commonJS({
           doc.errors.forEach(errors.prettifyError(source, lineCounter2));
           doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
         }
-      if (docs.length > 0)
-        return docs;
-      return Object.assign([], { empty: true }, composer$1.streamInfo());
-    }
-    function parseDocument(source, options = {}) {
-      const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
-      const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
-      const composer$1 = new composer.Composer(options);
-      let doc = null;
-      for (const _doc of composer$1.compose(parser$1.parse(source), true, source.length)) {
-        if (!doc)
-          doc = _doc;
-        else if (doc.options.logLevel !== "silent") {
-          doc.errors.push(new errors.YAMLParseError(_doc.range.slice(0, 2), "MULTIPLE_DOCS", "Source contains multiple documents; please use YAML.parseAllDocuments()"));
-          break;
+      if (docs.length > 0)
+        return docs;
+      return Object.assign([], { empty: true }, composer$1.streamInfo());
+    }
+    function parseDocument(source, options = {}) {
+      const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
+      const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
+      const composer$1 = new composer.Composer(options);
+      let doc = null;
+      for (const _doc of composer$1.compose(parser$1.parse(source), true, source.length)) {
+        if (!doc)
+          doc = _doc;
+        else if (doc.options.logLevel !== "silent") {
+          doc.errors.push(new errors.YAMLParseError(_doc.range.slice(0, 2), "MULTIPLE_DOCS", "Source contains multiple documents; please use YAML.parseAllDocuments()"));
+          break;
+        }
+      }
+      if (prettyErrors && lineCounter2) {
+        doc.errors.forEach(errors.prettifyError(source, lineCounter2));
+        doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
+      }
+      return doc;
+    }
+    function parse(src, reviver, options) {
+      let _reviver = void 0;
+      if (typeof reviver === "function") {
+        _reviver = reviver;
+      } else if (options === void 0 && reviver && typeof reviver === "object") {
+        options = reviver;
+      }
+      const doc = parseDocument(src, options);
+      if (!doc)
+        return null;
+      doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
+      if (doc.errors.length > 0) {
+        if (doc.options.logLevel !== "silent")
+          throw doc.errors[0];
+        else
+          doc.errors = [];
+      }
+      return doc.toJS(Object.assign({ reviver: _reviver }, options));
+    }
+    function stringify(value, replacer, options) {
+      let _replacer = null;
+      if (typeof replacer === "function" || Array.isArray(replacer)) {
+        _replacer = replacer;
+      } else if (options === void 0 && replacer) {
+        options = replacer;
+      }
+      if (typeof options === "string")
+        options = options.length;
+      if (typeof options === "number") {
+        const indent = Math.round(options);
+        options = indent < 1 ? void 0 : indent > 8 ? { indent: 8 } : { indent };
+      }
+      if (value === void 0) {
+        const { keepUndefined } = options ?? replacer ?? {};
+        if (!keepUndefined)
+          return void 0;
+      }
+      if (identity.isDocument(value) && !_replacer)
+        return value.toString(options);
+      return new Document.Document(value, _replacer, options).toString(options);
+    }
+    exports2.parse = parse;
+    exports2.parseAllDocuments = parseAllDocuments;
+    exports2.parseDocument = parseDocument;
+    exports2.stringify = stringify;
+  }
+});
+
+// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/index.js
+var require_dist3 = __commonJS({
+  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/index.js"(exports2) {
+    "use strict";
+    var composer = require_composer();
+    var Document = require_Document();
+    var Schema = require_Schema();
+    var errors = require_errors3();
+    var Alias = require_Alias();
+    var identity = require_identity();
+    var Pair = require_Pair();
+    var Scalar = require_Scalar();
+    var YAMLMap = require_YAMLMap();
+    var YAMLSeq = require_YAMLSeq();
+    var cst = require_cst();
+    var lexer = require_lexer();
+    var lineCounter = require_line_counter();
+    var parser = require_parser();
+    var publicApi = require_public_api();
+    var visit = require_visit();
+    exports2.Composer = composer.Composer;
+    exports2.Document = Document.Document;
+    exports2.Schema = Schema.Schema;
+    exports2.YAMLError = errors.YAMLError;
+    exports2.YAMLParseError = errors.YAMLParseError;
+    exports2.YAMLWarning = errors.YAMLWarning;
+    exports2.Alias = Alias.Alias;
+    exports2.isAlias = identity.isAlias;
+    exports2.isCollection = identity.isCollection;
+    exports2.isDocument = identity.isDocument;
+    exports2.isMap = identity.isMap;
+    exports2.isNode = identity.isNode;
+    exports2.isPair = identity.isPair;
+    exports2.isScalar = identity.isScalar;
+    exports2.isSeq = identity.isSeq;
+    exports2.Pair = Pair.Pair;
+    exports2.Scalar = Scalar.Scalar;
+    exports2.YAMLMap = YAMLMap.YAMLMap;
+    exports2.YAMLSeq = YAMLSeq.YAMLSeq;
+    exports2.CST = cst;
+    exports2.Lexer = lexer.Lexer;
+    exports2.LineCounter = lineCounter.LineCounter;
+    exports2.Parser = parser.Parser;
+    exports2.parse = publicApi.parse;
+    exports2.parseAllDocuments = publicApi.parseAllDocuments;
+    exports2.parseDocument = publicApi.parseDocument;
+    exports2.stringify = publicApi.stringify;
+    exports2.visit = visit.visit;
+    exports2.visitAsync = visit.visitAsync;
+  }
+});
+
+// ../../packages/jobs/dist/response.js
+var require_response = __commonJS({
+  "../../packages/jobs/dist/response.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.NonJsonResponseError = exports2.ServiceUnavailableError = void 0;
+    exports2.readJsonResponse = readJsonResponse;
+    var EXCERPT_LIMIT = 120;
+    var UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+    var UnreadableResponseError = class extends Error {
+      host;
+      statusCode;
+      statusText;
+      contentType;
+      bodyExcerpt;
+      constructor(message, detail) {
+        super(message);
+        this.host = detail.host;
+        this.statusCode = detail.statusCode;
+        this.statusText = detail.statusText;
+        this.contentType = detail.contentType;
+        this.bodyExcerpt = detail.bodyExcerpt;
+      }
+    };
+    var ServiceUnavailableError = class extends UnreadableResponseError {
+      code = "SERVICE_UNAVAILABLE";
+      constructor(detail) {
+        super(`${detail.host} answered ${formatStatus(detail)} (content-type: ${detail.contentType ?? "none"})${detail.bodyExcerpt ? `: ${detail.bodyExcerpt}` : ""}`, detail);
+        this.name = "ServiceUnavailableError";
+      }
+    };
+    exports2.ServiceUnavailableError = ServiceUnavailableError;
+    var NonJsonResponseError = class extends UnreadableResponseError {
+      code = "RESPONSE_NOT_JSON";
+      constructor(detail) {
+        super(`${detail.host} answered ${formatStatus(detail)} with content-type ${detail.contentType ?? "none"}, not JSON${detail.bodyExcerpt ? `: ${detail.bodyExcerpt}` : ""}`, detail);
+        this.name = "NonJsonResponseError";
+      }
+    };
+    exports2.NonJsonResponseError = NonJsonResponseError;
+    function formatStatus(detail) {
+      return detail.statusText ? `${detail.statusCode} ${detail.statusText}` : `${detail.statusCode}`;
+    }
+    function isJson(contentType) {
+      if (!contentType)
+        return false;
+      const essence = contentType.split(";")[0].trim().toLowerCase();
+      return essence === "application/json" || essence.endsWith("+json");
+    }
+    function excerpt(body) {
+      const collapsed = body.replace(/\s+/g, " ").trim();
+      return collapsed.length > EXCERPT_LIMIT ? `${collapsed.slice(0, EXCERPT_LIMIT)}...` : collapsed;
+    }
+    function hostOf(url) {
+      try {
+        return new URL(url).host;
+      } catch {
+        return url;
+      }
+    }
+    async function readJsonResponse(response, url) {
+      const contentType = response.headers.get("content-type");
+      const unavailable = UNAVAILABLE_STATUSES.has(response.status);
+      if (unavailable || !isJson(contentType)) {
+        const body = await response.text().catch(() => "");
+        const detail = {
+          host: hostOf(url),
+          statusCode: response.status,
+          statusText: response.statusText ?? "",
+          contentType,
+          bodyExcerpt: excerpt(body)
+        };
+        throw unavailable ? new ServiceUnavailableError(detail) : new NonJsonResponseError(detail);
+      }
+      return await response.json();
+    }
+  }
+});
+
+// ../../packages/jobs/dist/client.js
+var require_client2 = __commonJS({
+  "../../packages/jobs/dist/client.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.JobsClient = void 0;
+    var response_1 = require_response();
+    var JobsClient = class {
+      baseUrl;
+      apiKey;
+      accessToken;
+      getAccessToken;
+      onResponse;
+      constructor(config) {
+        this.baseUrl = config.baseUrl.replace(/\/$/, "");
+        this.apiKey = config.apiKey;
+        this.accessToken = config.accessToken;
+        this.getAccessToken = config.getAccessToken;
+        this.onResponse = config.onResponse;
+      }
+      /**
+       * Headers for one request. The auth header is resolved per call so a
+       * long-lived client picks up a refreshed token from `getAccessToken`
+       * (the manager behind it re-mints before expiry) instead of pinning the
+       * token it happened to hold at construction.
+       */
+      async buildHeaders(forceRefresh = false) {
+        const headers = { "Content-Type": "application/json" };
+        if (this.apiKey) {
+          headers["X-API-Key"] = this.apiKey;
+        } else if (this.getAccessToken) {
+          const token = await this.getAccessToken({ forceRefresh });
+          if (token)
+            headers["Authorization"] = `Bearer ${token}`;
+        } else if (this.accessToken) {
+          headers["Authorization"] = `Bearer ${this.accessToken}`;
+        }
+        return headers;
+      }
+      /**
+       * Fetch with one auth retry. A 401 on a token-provider client usually means
+       * the token was invalidated server-side (Keep restart, key rotation,
+       * revoke-then-repair, clock skew) while the local expiry timer still thinks
+       * it's valid. Force a re-mint and retry once before surfacing the failure.
+       * `onResponse` (min-version contract) fires on the response we actually act
+       * on. `body` is a string, so it is safe to resend.
+       */
+      async fetchWithAuthRetry(method, url, body) {
+        let response = await fetch(url, { method, headers: await this.buildHeaders(), body });
+        if (response.status === 401 && this.getAccessToken) {
+          response = await fetch(url, { method, headers: await this.buildHeaders(true), body });
+        }
+        this.onResponse?.(response);
+        return response;
+      }
+      // ── Job Pools ──────────────────────────────────────────────
+      async createJobPool(options) {
+        return this.request("POST", "/api/job-pools", options);
+      }
+      /**
+       * Idempotent upsert by `(principal_class, principal_id, name)`. When the
+       * pool exists, returns the existing row without modifying membership
+       * constraints. The Sift provisioning hook relies on this semantics.
+       */
+      async findOrCreateJobPool(options) {
+        return this.request("POST", "/api/job-pools?idempotent=true", options);
+      }
+      async listJobPools(filters) {
+        const params = new URLSearchParams();
+        if (filters?.principalClass)
+          params.set("principalClass", filters.principalClass);
+        if (filters?.principalId)
+          params.set("principalId", filters.principalId);
+        if (filters?.name)
+          params.set("name", filters.name);
+        const qs = params.toString();
+        const { pools } = await this.request("GET", `/api/job-pools${qs ? `?${qs}` : ""}`);
+        return pools;
+      }
+      async getJobPool(poolId) {
+        return this.request("GET", `/api/job-pools/${poolId}`);
+      }
+      /**
+       * Resolve a pool by exact name. Names are unique per OWNER, not globally
+       * (whittlelabs#763), and this method lists without a principal filter, so
+       * the same name can legitimately come back under several owners. That
+       * reference is inherently ambiguous — and silently picking one (the old
+       * behavior took the server's newest-first ordering) is exactly the
+       * capture vector the per-owner constraint closed, re-opened cross-owner.
+       * So it refuses instead: reference the pool by id, or list with explicit
+       * principal filters, when more than one owner holds the name.
+       */
+      async resolveJobPoolByName(name) {
+        const pools = await this.listJobPools({ name });
+        const matches = pools.filter((p) => p.name === name);
+        const owners = new Set(matches.map((p) => `${p.principalClass ?? ""}/${p.principalId ?? ""}`));
+        if (owners.size > 1) {
+          const error = new Error(`Job pool name "${name}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with explicit principal filters (listJobPools).`);
+          error.code = "JOB_POOL_NAME_AMBIGUOUS";
+          throw error;
+        }
+        return matches[0];
+      }
+      /** Internal: resolve a `PoolRef` to a pool id. */
+      async resolvePoolRef(ref) {
+        if ("id" in ref)
+          return ref.id;
+        const pool = await this.resolveJobPoolByName(ref.name);
+        if (!pool)
+          throw new Error(`Job pool not found by name: "${ref.name}"`);
+        return pool.id;
+      }
+      // ── Members ──────────────────────────────────────────────────────
+      // A subscriber joins a pool by registering as a member of it. These
+      // map to the server's `/api/job-pools/:poolId/members` routes.
+      async listMembers(poolId) {
+        const { members } = await this.request("GET", `/api/job-pools/${poolId}/members`);
+        return members;
+      }
+      async registerMember(poolId, options) {
+        return this.request("POST", `/api/job-pools/${poolId}/members`, options);
+      }
+      async updateMember(poolId, memberId, options) {
+        return this.request("PUT", `/api/job-pools/${poolId}/members/${memberId}`, options);
+      }
+      // ── Jobs (producer) ──────────────────────────────────────────────
+      /**
+       * Enqueue a job into a job pool. The `inputs` are opaque to Jobs; a Shuttle
+       * reads the strategy header inside them to decide how to run it (ADR 0005).
+       */
+      async enqueueJob(options) {
+        const jobPoolId = await this.resolvePoolRef(options.pool);
+        const body = {
+          jobPoolId,
+          title: options.title,
+          instructions: options.instructions,
+          maxAttempts: options.maxAttempts,
+          deadlineDuration: options.deadlineDuration,
+          claimDeadlineDuration: options.claimDeadlineDuration,
+          priority: options.priority,
+          tags: options.tags,
+          clientRef: options.clientRef,
+          clientContext: options.clientContext,
+          inputs: options.inputs
+        };
+        return this.request("POST", "/api/jobs", body);
+      }
+      async getJob(jobId) {
+        return this.request("GET", `/api/jobs/${jobId}`);
+      }
+      async updateJob(jobId, options) {
+        return this.request("PATCH", `/api/jobs/${jobId}`, options);
+      }
+      async cancelJob(jobId) {
+        return this.request("PUT", `/api/jobs/${jobId}`);
+      }
+      // ── Outputs ──────────────────────────────────────────────────────
+      async listOutputs(jobId) {
+        const all = [];
+        const pageSize = 100;
+        for (let offset = 0; ; offset += pageSize) {
+          const { outputs, total } = await this.request("GET", `/api/jobs/${jobId}/output?limit=${pageSize}&offset=${offset}`);
+          all.push(...outputs);
+          if (outputs.length === 0 || all.length >= total)
+            break;
+        }
+        return all;
+      }
+      async createOutput(jobId, options) {
+        return this.request("POST", `/api/jobs/${jobId}/output`, options);
+      }
+      /**
+       * Post a batch of live progress frames for a running job. Best-effort
+       * telemetry: the service publishes it over core NATS and never derives
+       * authoritative state from it, so callers should swallow failures rather than
+       * let a dropped frame affect the job.
+       */
+      async postProgress(jobId, options) {
+        await this.request("POST", `/api/jobs/${jobId}/progress`, options);
+      }
+      // ── Attendance (subscriber dispatch lifecycle) ───────────────────
+      /**
+       * Accept a dispatched job. The subscribe loop calls this; direct
+       * callers should be rare. Returns the dispatched-job context the
+       * subscriber needs to execute and submit.
+       */
+      async acceptDispatch(jobId) {
+        return this.request("POST", `/api/jobs/${jobId}/attendance`);
+      }
+      async submit(jobId, options) {
+        return this.request("PUT", `/api/jobs/${jobId}/attendance`, options);
+      }
+      // ── Discovery (rare) ─────────────────────────────────────────────
+      async listDispatchableJobs(options) {
+        const params = new URLSearchParams();
+        if (options?.pools?.length)
+          params.set("pools", options.pools.join(","));
+        if (options?.tags?.length)
+          params.set("tags", options.tags.join(","));
+        if (options?.maxAttempts !== void 0)
+          params.set("maxAttempts", String(options.maxAttempts));
+        if (options?.minPriority !== void 0)
+          params.set("minPriority", String(options.minPriority));
+        if (options?.limit !== void 0)
+          params.set("limit", String(options.limit));
+        if (options?.offset !== void 0)
+          params.set("offset", String(options.offset));
+        if (options?.sort)
+          params.set("sort", options.sort);
+        const qs = params.toString();
+        const { jobs, total, directives } = await this.request("GET", `/api/my/jobs${qs ? `?${qs}` : ""}`);
+        return {
+          data: jobs,
+          pagination: { total, limit: options?.limit ?? 25, offset: options?.offset ?? 0 },
+          directives: directives ?? null
+        };
+      }
+      // ── HTTP plumbing ────────────────────────────────────────────────
+      /**
+       * Every call's one reader. `readJsonResponse` refuses to parse a reply that
+       * is not the API's JSON — an ingress 502/503/504 while a pod rolls, or any
+       * non-JSON body — and throws a named failure instead of a parse error. What
+       * comes back here is the API's own envelope, success or not.
+       */
+      async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const response = await this.fetchWithAuthRetry(method, url, body ? JSON.stringify(body) : void 0);
+        const json = await (0, response_1.readJsonResponse)(response, url);
+        if (!response.ok || !json.success) {
+          const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
+          const error = new Error(errorMessage);
+          error.code = json.error?.code;
+          error.statusCode = response.status;
+          throw error;
+        }
+        return json.data;
+      }
+    };
+    exports2.JobsClient = JobsClient;
+  }
+});
+
+// ../../packages/jobs/dist/subscribe.js
+var require_subscribe = __commonJS({
+  "../../packages/jobs/dist/subscribe.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.subscribe = subscribe;
+    var response_1 = require_response();
+    var NULL_LOGGER = {
+      debug: () => {
+      },
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      }
+    };
+    function sleep(ms) {
+      return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    function formatDuration(ms) {
+      const seconds = Math.round(ms / 1e3);
+      if (seconds < 60)
+        return `${seconds}s`;
+      const minutes = Math.floor(seconds / 60);
+      const rest = seconds % 60;
+      return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`;
+    }
+    function subscribe(opts) {
+      const logger = opts.logger ?? NULL_LOGGER;
+      const pollIntervalMs = opts.pollIntervalMs ?? 2e3;
+      const maxConcurrency = opts.maxConcurrency ?? 1;
+      let stopped = true;
+      let pollTimer = null;
+      let inflight = 0;
+      let resolvedPoolIds = [];
+      let unavailableSince = null;
+      async function start() {
+        if (!stopped)
+          return;
+        stopped = false;
+        resolvedPoolIds = [];
+        for (const ref of opts.pools) {
+          const id = await opts.jobsClient.resolvePoolRef(ref);
+          resolvedPoolIds.push(id);
+          await opts.jobsClient.registerMember(id, {
+            identityType: opts.subscriber.identityType,
+            identityId: opts.subscriber.identityId,
+            intelligence: opts.subscriber.intelligence,
+            ...opts.subscriber.displayName !== void 0 ? { displayName: opts.subscriber.displayName } : {},
+            ...opts.subscriber.metadata !== void 0 ? { metadata: opts.subscriber.metadata } : {}
+          });
+        }
+        logger.info("subscribe loop started", { pools: resolvedPoolIds, maxConcurrency });
+        schedulePoll(pollIntervalMs);
+      }
+      async function stop() {
+        if (stopped)
+          return;
+        stopped = true;
+        if (pollTimer !== null) {
+          clearTimeout(pollTimer);
+          pollTimer = null;
+        }
+        while (inflight > 0) {
+          await sleep(100);
+        }
+        logger.info("subscribe loop stopped");
+      }
+      function schedulePoll(delayMs) {
+        pollTimer = setTimeout(() => {
+          void poll();
+        }, delayMs);
+      }
+      async function poll() {
+        if (stopped)
+          return;
+        if (inflight >= maxConcurrency) {
+          schedulePoll(pollIntervalMs);
+          return;
+        }
+        try {
+          const { data, directives } = await opts.jobsClient.listDispatchableJobs({
+            pools: resolvedPoolIds,
+            limit: maxConcurrency - inflight,
+            sort: "priority:desc,queued_at:asc"
+          });
+          if (unavailableSince !== null) {
+            logger.info(`Sift is reachable again after ${formatDuration(Date.now() - unavailableSince)}`);
+            unavailableSince = null;
+          }
+          if (directives && Object.keys(directives).length > 0 && opts.onDirectives) {
+            try {
+              await opts.onDirectives(directives);
+            } catch (err) {
+              logger.error("onDirectives handler failed", {
+                error: err instanceof Error ? err.message : String(err)
+              });
+            }
+          }
+          if (stopped)
+            return;
+          for (const job of data) {
+            if (inflight >= maxConcurrency)
+              break;
+            inflight++;
+            void runOnce(job).finally(() => {
+              inflight--;
+            });
+          }
+        } catch (err) {
+          if (err instanceof response_1.ServiceUnavailableError) {
+            if (unavailableSince === null) {
+              unavailableSince = Date.now();
+              logger.warn(`Sift is unavailable (${err.host} answered ${err.statusCode}${err.statusText ? ` ${err.statusText}` : ""}). This is typical during a deployment window; the Sifter will keep trying.`);
+            } else {
+              logger.debug?.("Sift still unavailable", {
+                host: err.host,
+                status: err.statusCode,
+                unavailableFor: formatDuration(Date.now() - unavailableSince)
+              });
+            }
+          } else {
+            logger.error("poll failed", { error: err instanceof Error ? err.message : String(err) });
+          }
+        }
+        if (!stopped)
+          schedulePoll(pollIntervalMs);
+      }
+      async function runOnce(available) {
+        let dispatch;
+        try {
+          dispatch = await opts.jobsClient.acceptDispatch(available.id);
+        } catch (err) {
+          const statusCode = err.statusCode;
+          if (statusCode === 409) {
+            logger.debug?.("claim conflict; another member accepted", { jobId: available.id });
+            return;
+          }
+          logger.error("failed to accept dispatch", {
+            jobId: available.id,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          return;
+        }
+        const controller = new AbortController();
+        let quietTimer = null;
+        const quietWindowMs = dispatch.deadline ? new Date(dispatch.deadline).getTime() - Date.now() : null;
+        const armQuietTimer = () => {
+          if (quietWindowMs === null)
+            return;
+          if (quietTimer !== null)
+            clearTimeout(quietTimer);
+          const ms = quietWindowMs - 3e4;
+          if (ms > 0) {
+            quietTimer = setTimeout(() => controller.abort(), ms);
+          } else {
+            controller.abort();
+          }
+        };
+        armQuietTimer();
+        const activity = {
+          record: () => {
+            if (!controller.signal.aborted)
+              armQuietTimer();
+          }
+        };
+        let result;
+        try {
+          result = await opts.onJob(dispatch, controller.signal, activity);
+        } catch (err) {
+          result = {
+            status: "failed",
+            reason: `onJob threw: ${err instanceof Error ? err.message : String(err)}`
+          };
+        } finally {
+          if (quietTimer !== null)
+            clearTimeout(quietTimer);
+        }
+        try {
+          for (const output of result.outputs ?? []) {
+            await opts.jobsClient.createOutput(dispatch.job.id, {
+              label: output.label,
+              content: output.content
+            });
+          }
+          await opts.jobsClient.submit(dispatch.job.id, {
+            status: result.status,
+            ...result.reason !== void 0 ? { reason: result.reason } : {}
+          });
+        } catch (err) {
+          logger.error("submit/close failed", {
+            jobId: dispatch.job.id,
+            error: err instanceof Error ? err.message : String(err)
+          });
         }
       }
-      if (prettyErrors && lineCounter2) {
-        doc.errors.forEach(errors.prettifyError(source, lineCounter2));
-        doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
-      }
-      return doc;
-    }
-    function parse(src, reviver, options) {
-      let _reviver = void 0;
-      if (typeof reviver === "function") {
-        _reviver = reviver;
-      } else if (options === void 0 && reviver && typeof reviver === "object") {
-        options = reviver;
-      }
-      const doc = parseDocument(src, options);
-      if (!doc)
-        return null;
-      doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
-      if (doc.errors.length > 0) {
-        if (doc.options.logLevel !== "silent")
-          throw doc.errors[0];
-        else
-          doc.errors = [];
-      }
-      return doc.toJS(Object.assign({ reviver: _reviver }, options));
-    }
-    function stringify(value, replacer, options) {
-      let _replacer = null;
-      if (typeof replacer === "function" || Array.isArray(replacer)) {
-        _replacer = replacer;
-      } else if (options === void 0 && replacer) {
-        options = replacer;
-      }
-      if (typeof options === "string")
-        options = options.length;
-      if (typeof options === "number") {
-        const indent = Math.round(options);
-        options = indent < 1 ? void 0 : indent > 8 ? { indent: 8 } : { indent };
-      }
-      if (value === void 0) {
-        const { keepUndefined } = options ?? replacer ?? {};
-        if (!keepUndefined)
-          return void 0;
-      }
-      if (identity.isDocument(value) && !_replacer)
-        return value.toString(options);
-      return new Document.Document(value, _replacer, options).toString(options);
+      return { start, stop };
     }
-    exports2.parse = parse;
-    exports2.parseAllDocuments = parseAllDocuments;
-    exports2.parseDocument = parseDocument;
-    exports2.stringify = stringify;
   }
 });
 
-// ../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/index.js
+// ../../packages/jobs/dist/index.js
 var require_dist4 = __commonJS({
-  "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/index.js"(exports2) {
+  "../../packages/jobs/dist/index.js"(exports2) {
     "use strict";
-    var composer = require_composer();
-    var Document = require_Document();
-    var Schema = require_Schema();
-    var errors = require_errors3();
-    var Alias = require_Alias();
-    var identity = require_identity();
-    var Pair = require_Pair();
-    var Scalar = require_Scalar();
-    var YAMLMap = require_YAMLMap();
-    var YAMLSeq = require_YAMLSeq();
-    var cst = require_cst();
-    var lexer = require_lexer();
-    var lineCounter = require_line_counter();
-    var parser = require_parser();
-    var publicApi = require_public_api();
-    var visit = require_visit();
-    exports2.Composer = composer.Composer;
-    exports2.Document = Document.Document;
-    exports2.Schema = Schema.Schema;
-    exports2.YAMLError = errors.YAMLError;
-    exports2.YAMLParseError = errors.YAMLParseError;
-    exports2.YAMLWarning = errors.YAMLWarning;
-    exports2.Alias = Alias.Alias;
-    exports2.isAlias = identity.isAlias;
-    exports2.isCollection = identity.isCollection;
-    exports2.isDocument = identity.isDocument;
-    exports2.isMap = identity.isMap;
-    exports2.isNode = identity.isNode;
-    exports2.isPair = identity.isPair;
-    exports2.isScalar = identity.isScalar;
-    exports2.isSeq = identity.isSeq;
-    exports2.Pair = Pair.Pair;
-    exports2.Scalar = Scalar.Scalar;
-    exports2.YAMLMap = YAMLMap.YAMLMap;
-    exports2.YAMLSeq = YAMLSeq.YAMLSeq;
-    exports2.CST = cst;
-    exports2.Lexer = lexer.Lexer;
-    exports2.LineCounter = lineCounter.LineCounter;
-    exports2.Parser = parser.Parser;
-    exports2.parse = publicApi.parse;
-    exports2.parseAllDocuments = publicApi.parseAllDocuments;
-    exports2.parseDocument = publicApi.parseDocument;
-    exports2.stringify = publicApi.stringify;
-    exports2.visit = visit.visit;
-    exports2.visitAsync = visit.visitAsync;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.subscribe = exports2.ServiceUnavailableError = exports2.NonJsonResponseError = exports2.JobsClient = void 0;
+    var client_1 = require_client2();
+    Object.defineProperty(exports2, "JobsClient", { enumerable: true, get: function() {
+      return client_1.JobsClient;
+    } });
+    var response_1 = require_response();
+    Object.defineProperty(exports2, "NonJsonResponseError", { enumerable: true, get: function() {
+      return response_1.NonJsonResponseError;
+    } });
+    Object.defineProperty(exports2, "ServiceUnavailableError", { enumerable: true, get: function() {
+      return response_1.ServiceUnavailableError;
+    } });
+    var subscribe_1 = require_subscribe();
+    Object.defineProperty(exports2, "subscribe", { enumerable: true, get: function() {
+      return subscribe_1.subscribe;
+    } });
   }
 });
 
@@ -20280,7 +20427,7 @@ var require_loader = __commonJS({
     var fs_1 = require("fs");
     var path_1 = require("path");
     var os_1 = require("os");
-    var yaml_1 = require_dist4();
+    var yaml_1 = require_dist3();
     var schema_1 = require_schema4();
     var apply_1 = require_apply();
     function fileExists(filePath) {
@@ -20470,8 +20617,10 @@ var require_probes = __commonJS({
     var promises_1 = require("fs/promises");
     var os_1 = __importDefault(require("os"));
     var path_1 = __importDefault(require("path"));
+    var yaml_1 = require_dist3();
     var keep_1 = require_dist2();
-    var jobs_1 = require_dist3();
+    var jobs_1 = require_dist4();
+    var scaffold_1 = require_scaffold();
     var loader_1 = require_loader();
     var store_1 = require_store();
     var version_check_1 = require_version_check();
@@ -20495,9 +20644,11 @@ var require_probes = __commonJS({
       };
       let pairingRead;
       let configRead;
+      let scaffoldedRead;
       const versions = /* @__PURE__ */ new Map();
       return {
         nodeVersion: () => process.version,
+        platform: () => process.platform,
         osTmpDir: () => os_1.default.tmpdir(),
         async which(bin) {
           const dirs = (process.env.PATH ?? "").split(path_1.default.delimiter).filter(Boolean);
@@ -20512,12 +20663,13 @@ var require_probes = __commonJS({
           return null;
         },
         async versionOf(bin) {
-          if (versions.has(bin))
-            return versions.get(bin) ?? null;
-          const raw = await runForOutput(bin, ["--version"], VERSION_TIMEOUT_MS);
-          const parsed = raw === null ? null : raw.match(/\d+\.\d+\.\d+/)?.[0] ?? null;
-          versions.set(bin, parsed);
-          return parsed;
+          const known = versions.get(bin);
+          if (known !== void 0)
+            return known;
+          const outcome = await runCapturing(bin, ["--version"], VERSION_TIMEOUT_MS);
+          const result = outcome.ok ? { ran: true, version: outcome.stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? null } : { ran: false, reason: outcome.reason };
+          versions.set(bin, result);
+          return result;
         },
         async reach(url) {
           const controller = new AbortController();
@@ -20595,6 +20747,28 @@ var require_probes = __commonJS({
           }
           return configRead;
         },
+        readScaffoldedConfig() {
+          if (scaffoldedRead !== void 0)
+            return scaffoldedRead;
+          const file = (0, scaffold_1.scaffoldedConfigPath)(options.brand, options.paths.configDir);
+          let raw;
+          try {
+            raw = (0, fs_1.readFileSync)(file, "utf-8");
+          } catch (err) {
+            scaffoldedRead = err.code === "ENOENT" ? { ok: true, value: null } : { ok: false, error: `${file}: ${describe(err)}` };
+            return scaffoldedRead;
+          }
+          try {
+            const parsed = (0, yaml_1.parse)(raw);
+            scaffoldedRead = {
+              ok: true,
+              value: parsed !== null && typeof parsed === "object" ? parsed : {}
+            };
+          } catch (err) {
+            scaffoldedRead = { ok: false, error: `${file}: ${describe(err)}` };
+          }
+          return scaffoldedRead;
+        },
         async mintAgentToken(pairing) {
           const tokens = new keep_1.AgentTokenManager({
             keepApiUrl: pairing.keepApiUrl,
@@ -20661,16 +20835,21 @@ var require_probes = __commonJS({
         latestVersion: () => observedLatest
       };
     }
-    function runForOutput(bin, args, timeoutMs) {
+    async function runForOutput(bin, args, timeoutMs) {
+      const outcome = await runCapturing(bin, args, timeoutMs);
+      return outcome.ok ? outcome.stdout : null;
+    }
+    function runCapturing(bin, args, timeoutMs) {
       return new Promise((resolve) => {
         let child;
         try {
           child = (0, child_process_1.spawn)(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
-        } catch {
-          resolve(null);
+        } catch (err) {
+          resolve({ ok: false, reason: describe(err) });
           return;
         }
         let stdout = "";
+        let stderr = "";
         let settled = false;
         const settle = (value) => {
           if (settled)
@@ -20680,18 +20859,27 @@ var require_probes = __commonJS({
         };
         const timer = setTimeout(() => {
           child.kill("SIGKILL");
-          settle(null);
+          settle({ ok: false, reason: `did not finish within ${Math.round(timeoutMs / 1e3)}s` });
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
           stdout += chunk.toString("utf8");
         });
-        child.on("error", () => {
+        child.stderr?.on("data", (chunk) => {
+          stderr += chunk.toString("utf8");
+        });
+        child.on("error", (err) => {
           clearTimeout(timer);
-          settle(null);
+          settle({ ok: false, reason: describe(err) });
         });
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
           clearTimeout(timer);
-          settle(code === 0 ? stdout.trim() : null);
+          if (code === 0) {
+            settle({ ok: true, stdout: stdout.trim() });
+            return;
+          }
+          const status = code === null ? `was killed by ${signal ?? "a signal"}` : `exited ${code}`;
+          const said = stderr.split("\n").map((line) => line.trim()).find((line) => line.length > 0);
+          settle({ ok: false, reason: said ? `${status}: ${said}` : status });
         });
       });
     }
@@ -20782,11 +20970,19 @@ var require_preflight = __commonJS({
     var typed_exit_1 = require_typed_exit();
     async function runPreflight(probes, subject) {
       const verdicts = [];
+      let blockedBy;
       for (const check of checks_1.CHECKS) {
         if (!check.phases.includes(subject.phase))
           continue;
+        if (blockedBy !== void 0) {
+          verdicts.push({ name: check.name, status: "SKIP", detail: `not checked; see ${blockedBy}` });
+          continue;
+        }
         try {
-          verdicts.push(await check.run(probes, subject));
+          const verdict = await check.run(probes, subject);
+          verdicts.push(verdict);
+          if (check.prerequisite === true && verdict.status === "FAIL")
+            blockedBy = check.name;
         } catch (err) {
           if ((0, typed_exit_1.isTypedExit)(err))
             throw err;
@@ -22627,6 +22823,8 @@ var require_device_code = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.pair = pair;
     exports2.webFirstRemedy = webFirstRemedy;
+    exports2.noPoolRefusal = noPoolRefusal;
+    exports2.issuedButNotKept = issuedButNotKept;
     var os_1 = require("os");
     var apply_1 = require_apply();
     var version_check_1 = require_version_check();
@@ -22690,14 +22888,22 @@ var require_device_code = __commonJS({
         });
         log(opts.brand.strings?.pairingDoneMessage ?? `Paired ${displayName}.`);
       }
-      const jobPools = await discoverMemberPools({
-        keepApiUrl: reg.keepApiUrl,
-        jobsApiUrl: reg.jobsApiUrl,
-        clientId: token.clientId,
-        clientSecret: token.clientSecret,
-        fetcher,
-        brand: opts.brand
-      });
+      let jobPools;
+      try {
+        jobPools = await discoverMemberPools({
+          keepApiUrl: reg.keepApiUrl,
+          jobsApiUrl: reg.jobsApiUrl,
+          clientId: token.clientId,
+          clientSecret: token.clientSecret,
+          fetcher,
+          brand: opts.brand
+        });
+      } catch (err) {
+        if ((0, typed_exit_1.isTypedExit)(err))
+          throw err;
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(issuedButNotKept(opts.brand, token.serviceIdentity.displayName, `"${token.serviceIdentity.displayName}" was paired, but its pools could not be read from Jobs: ${reason}`, true));
+      }
       return {
         schemaVersion: 1,
         keepApiUrl: reg.keepApiUrl,
@@ -22747,7 +22953,7 @@ var require_device_code = __commonJS({
     }
     function webFirstRemedy(brand, cause) {
       const reason = cause instanceof Error ? cause.message : String(cause);
-      const where = brand.product.webPairingUrl ? brand.product.webPairingUrl : `your ${brand.product.title} web app, under Settings, Sifters`;
+      const where = webPairingPlace(brand);
       return [
         `Could not start browser pairing: ${reason}`,
         "",
@@ -22755,6 +22961,27 @@ var require_device_code = __commonJS({
         `command it shows (${brand.product.cliBinary} init --pairing-code=<code>).`
       ].join("\n");
     }
+    function noPoolRefusal(brand, identity) {
+      return [
+        `"${identity}" was paired, but it has no pool to take work from, so it would never be sent any.`,
+        "Nothing was saved on this machine.",
+        "",
+        `Pools are set up when a pairing starts from the web: open ${webPairingPlace(brand)},`,
+        `remove "${identity}" if it is listed, press Pair a Sifter, and run the command it shows.`
+      ].join("\n");
+    }
+    function issuedButNotKept(brand, identity, reason, restored) {
+      return [
+        reason,
+        "",
+        restored ? "Nothing was saved on this machine, so it is as it was before init." : `Some of what init wrote could not be put back; check ${brand.paths.configDir} before pairing again.`,
+        `Keep has already issued "${identity}", which this machine will not use: open`,
+        `${webPairingPlace(brand)}, remove "${identity}", then pair again from there.`
+      ].join("\n");
+    }
+    function webPairingPlace(brand) {
+      return brand.product.webPairingUrl ? brand.product.webPairingUrl : `your ${brand.product.title} web app, under Settings, Sifters`;
+    }
     function columnsOf(opts) {
       return opts.columns ?? process.stdout.columns;
     }
@@ -23008,7 +23235,9 @@ var require_init = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.buildInitCommand = buildInitCommand;
     var fsp = __importStar(require("fs/promises"));
+    var path_1 = require("path");
     var commander_1 = require_commander();
+    var scaffold_1 = require_scaffold();
     var apply_1 = require_apply();
     var environment_1 = require_environment();
     var device_code_1 = require_device_code();
@@ -23036,17 +23265,6 @@ var require_init = __commonJS({
                 console.log(line);
           }
           const paths = (0, apply_1.resolvePaths)(effectiveBrand, profile);
-          await fsp.mkdir(paths.configDir, { recursive: true });
-          for (const step of effectiveBrand.setupSteps ?? []) {
-            if (step.phase === "pre-pair") {
-              await step.run({
-                brand: effectiveBrand,
-                configDir: paths.configDir,
-                log: (line) => console.log(line),
-                setupOptions
-              });
-            }
-          }
           const preflight = await (0, preflight_1.runPreflight)((0, preflight_1.createProbes)({
             brand: effectiveBrand,
             paths,
@@ -23056,42 +23274,77 @@ var require_init = __commonJS({
             paths,
             phase: "init",
             deep: false,
-            ...setupOptions.executor ? { requestedExecutor: setupOptions.executor } : {}
+            ...setupOptions.executor ? { requestedExecutor: setupOptions.executor } : {},
+            ...setupOptions.tmpDir ? { requestedTmpDir: setupOptions.tmpDir } : {}
           });
           (0, preflight_1.printReport)(preflight.verdicts, false);
           if ((0, preflight_1.hasFailure)(preflight.verdicts)) {
             process.exit(preflight_1.PREFLIGHT_EXIT_CODE);
           }
-          const pairing = await (0, device_code_1.pair)({
-            brand: effectiveBrand,
-            pairingCode: options.pairingCode,
-            // Keep's answer is the half no local table can predict: it
-            // builds `verification_uri` from its OWN configuration, so a
-            // tier pointed at a page nobody serves looks exactly like a
-            // healthy one until an operator opens the link.
-            ...report ? {
-              onVerificationUri: (uri) => console.log(asJson ? (0, environment_1.verificationJson)(uri) : (0, environment_1.renderVerificationLine)(uri))
-            } : {}
-          });
-          const store = new store_1.PairingConfigStore(paths.configFile);
-          await store.write(pairing);
-          const spendStore = new spend_store_1.SpendStore(paths.spendStateFile);
-          const seedCaps = {
-            dailyTokens: setupOptions.dailyCap ?? effectiveBrand.defaultCaps.dailyTokens,
-            monthlyTokens: setupOptions.monthlyCap ?? effectiveBrand.defaultCaps.monthlyTokens,
-            dailyUsd: effectiveBrand.defaultCaps.dailyUsd,
-            monthlyUsd: effectiveBrand.defaultCaps.monthlyUsd
-          };
-          await spendStore.setCaps(seedCaps);
-          for (const step of effectiveBrand.setupSteps ?? []) {
-            if (step.phase === "post-pair") {
-              await step.run({
-                brand: effectiveBrand,
-                configDir: paths.configDir,
-                log: (line) => console.log(line),
-                setupOptions
-              });
+          const createdDir = await fsp.mkdir(paths.configDir, { recursive: true });
+          try {
+            for (const step of effectiveBrand.setupSteps ?? []) {
+              if (step.phase === "pre-pair") {
+                await step.run({
+                  brand: effectiveBrand,
+                  configDir: paths.configDir,
+                  log: (line) => console.log(line),
+                  setupOptions
+                });
+              }
+            }
+            const pairing = await (0, device_code_1.pair)({
+              brand: effectiveBrand,
+              pairingCode: options.pairingCode,
+              // Keep's answer is the half no local table can predict: it
+              // builds `verification_uri` from its OWN configuration, so a
+              // tier pointed at a page nobody serves looks exactly like a
+              // healthy one until an operator opens the link.
+              ...report ? {
+                onVerificationUri: (uri) => console.log(asJson ? (0, environment_1.verificationJson)(uri) : (0, environment_1.renderVerificationLine)(uri))
+              } : {}
+            });
+            const identity = pairing.serviceIdentity.displayName;
+            if (pairing.jobPools.length === 0) {
+              throw new Error((0, device_code_1.noPoolRefusal)(effectiveBrand, identity));
+            }
+            const written = await snapshot([
+              paths.configFile,
+              paths.spendStateFile,
+              (0, scaffold_1.scaffoldedConfigPath)(effectiveBrand, paths.configDir)
+            ]);
+            try {
+              const store = new store_1.PairingConfigStore(paths.configFile);
+              await store.write(pairing);
+              const spendStore = new spend_store_1.SpendStore(paths.spendStateFile);
+              const seedCaps = {
+                dailyTokens: setupOptions.dailyCap ?? effectiveBrand.defaultCaps.dailyTokens,
+                monthlyTokens: setupOptions.monthlyCap ?? effectiveBrand.defaultCaps.monthlyTokens,
+                dailyUsd: effectiveBrand.defaultCaps.dailyUsd,
+                monthlyUsd: effectiveBrand.defaultCaps.monthlyUsd
+              };
+              await spendStore.setCaps(seedCaps);
+              for (const step of effectiveBrand.setupSteps ?? []) {
+                if (step.phase === "post-pair") {
+                  await step.run({
+                    brand: effectiveBrand,
+                    configDir: paths.configDir,
+                    log: (line) => console.log(line),
+                    setupOptions
+                  });
+                }
+              }
+            } catch (err) {
+              if ((0, typed_exit_1.isTypedExit)(err))
+                throw err;
+              const restored = await restore(written);
+              const reason = err instanceof Error ? err.message : String(err);
+              throw new Error((0, device_code_1.issuedButNotKept)(effectiveBrand, identity, `"${identity}" was paired, but saving it on this machine failed: ${reason}`, restored));
             }
+          } catch (err) {
+            if (createdDir !== void 0)
+              await removeEmptyDirs(paths.configDir, createdDir);
+            throw err;
           }
           const profileFlag = profile === apply_1.DEFAULT_PROFILE ? "" : ` --profile ${profile}`;
           console.log("");
@@ -23111,6 +23364,52 @@ var require_init = __commonJS({
         }
       });
     }
+    async function snapshot(files) {
+      const out = [];
+      for (const path of files) {
+        try {
+          out.push({ path, before: await fsp.readFile(path) });
+        } catch (err) {
+          if (err.code !== "ENOENT")
+            throw err;
+          out.push({ path, before: null });
+        }
+      }
+      return out;
+    }
+    async function restore(files) {
+      let clean = true;
+      for (const { path, before } of files) {
+        await fsp.rm(`${path}.tmp`, { force: true }).catch(() => {
+          clean = false;
+        });
+        try {
+          if (before === null)
+            await fsp.rm(path, { force: true });
+          else
+            await fsp.writeFile(path, before);
+        } catch {
+          clean = false;
+        }
+      }
+      return clean;
+    }
+    async function removeEmptyDirs(deepest, top) {
+      let current = deepest;
+      for (; ; ) {
+        try {
+          await fsp.rmdir(current);
+        } catch {
+          return;
+        }
+        if (current === top)
+          return;
+        const parent = (0, path_1.dirname)(current);
+        if (parent === current)
+          return;
+        current = parent;
+      }
+    }
     function profileFlagDescription(brand) {
       const known = Object.keys(brand.environments ?? {}).sort();
       const base = 'Config profile to pair into (isolates this pairing under its own dir; default "default")';
@@ -24650,7 +24949,7 @@ var require_shuttle = __commonJS({
     exports2.mergeExecutorDefaults = mergeExecutorDefaults;
     exports2.resolveAuth = resolveAuth;
     var os_1 = require("os");
-    var jobs_1 = require_dist3();
+    var jobs_1 = require_dist4();
     var self_update_1 = require_self_update();
     var decommission_1 = require_decommission();
     var loom_1 = require_dist();
@@ -25415,8 +25714,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.environmentReportJson = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
-    exports2.revokePairing = void 0;
+    exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.environmentReportJson = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -25578,6 +25877,13 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "DEFAULT_REFUSAL_MESSAGE", { enumerable: true, get: function() {
       return defaults_1.DEFAULT_REFUSAL_MESSAGE;
     } });
+    var scaffold_1 = require_scaffold();
+    Object.defineProperty(exports2, "planScaffold", { enumerable: true, get: function() {
+      return scaffold_1.planScaffold;
+    } });
+    Object.defineProperty(exports2, "scaffoldedConfigPath", { enumerable: true, get: function() {
+      return scaffold_1.scaffoldedConfigPath;
+    } });
     var device_code_1 = require_device_code();
     Object.defineProperty(exports2, "pair", { enumerable: true, get: function() {
       return device_code_1.pair;
@@ -25602,9 +25908,9 @@ var import_shuttle2 = __toESM(require_dist5());
 // src/brand.ts
 var import_path = require("path");
 var import_promises = require("fs/promises");
-var import_yaml = __toESM(require_dist4());
+var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.7" : pkg.version;
+var buildVersion = true ? "0.30.8" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -25628,6 +25934,10 @@ var sifterBrand = {
     configSearchPaths: ["~/.sifter/sifter.yaml"]
   },
   executorAllowlist: ["claude-code", "anthropic-api", "http-api", "webhook", "custom-script"],
+  // What `init` configures when neither --executor nor an existing
+  // sifter.yaml names one. The init pre-flight reads it too, to check git and
+  // claude before the pairing code is spent.
+  defaultExecutor: "claude-code",
   // Floors the pre-flight enforces on the binaries the claude-code executor
   // spawns. Both are deliberately conservative — below the floor FAILS, so a
   // number chosen for tidiness rather than necessity would refuse a working
@@ -25727,14 +26037,14 @@ var sifterBrand = {
       // executor block (e.g. a claude-code `tmpDir`) and polling unless a fresh
       // flag overrides them, and log what happened. We only (re)scaffold an
       // executor block when there isn't one to preserve.
+      //
+      // Which executor, and whether its block is kept, is `planScaffold`'s
+      // call, the same one the init pre-flight made before the pairing code
+      // was spent. A pairing with no pools never reaches this step: init
+      // refuses it before writing anything.
       run: async (ctx) => {
-        const yamlPath = (0, import_path.join)(ctx.configDir, "sifter.yaml");
+        const yamlPath = (0, import_shuttle.scaffoldedConfigPath)(ctx.brand, ctx.configDir);
         const pairing = new import_shuttle.PairingConfigStore((0, import_path.join)(ctx.configDir, "config.json")).read();
-        if (pairing.jobPools.length === 0) {
-          throw new Error(
-            "Pairing returned no job pools. The Sift backend should have provisioned one for this user during pre-pair."
-          );
-        }
         let existing = {};
         try {
           existing = (0, import_yaml.parse)(await (0, import_promises.readFile)(yamlPath, "utf8")) ?? {};
@@ -25743,10 +26053,15 @@ var sifterBrand = {
         }
         const isUpdate = Object.keys(existing).length > 0;
         const existingExecutors = existing.executors ?? {};
-        const existingPools = Array.isArray(existing.pools) ? existing.pools : [];
-        const priorExecutor = typeof existingPools[0]?.executor === "string" ? existingPools[0].executor : void 0;
-        const executor = ctx.setupOptions.executor ?? priorExecutor ?? "claude-code";
-        const executorBlock = !ctx.setupOptions.executor && existingExecutors[executor] !== void 0 ? existingExecutors[executor] : await buildExecutorBlock(executor, ctx);
+        const plan = (0, import_shuttle.planScaffold)(ctx.brand, ctx.setupOptions, existing);
+        const executor = plan.executor;
+        if (executor === void 0) {
+          throw new Error("No executor to configure: pass --executor.");
+        }
+        const executorBlock = plan.keptBlock !== void 0 ? {
+          ...plan.keptBlock,
+          ...executor === "claude-code" && ctx.setupOptions.tmpDir ? { tmpDir: ctx.setupOptions.tmpDir } : {}
+        } : await buildExecutorBlock(executor, ctx);
         const doc = {
           auth: {
             jobsApiUrl: pairing.jobsApiUrl