@zocomputer/cli 0.2.1 → 0.3.0

package/dist/generated/commands.js

@@ -1,6 +1,6 @@
 // Generated by scripts/generate-commands.mjs. Do not edit.
 export const commandManifest = {
-    schemaDigest: "sha256:86eea2bc2e1d9b8d45c59a74750d572cc5c40f97b64786b2ef57dee9f77f9114",
+    schemaDigest: "sha256:72a660c4863ad100211dacc6ed13014d46a5311230b0e648e2870e2d4c3f0be4",
     commands: [
         {
             action: "zo.activity.list",
@@ -355,8 +355,8 @@ export const commandManifest = {
             versions: [
                 {
                     version: 1,
-                    description: "Create a managed Postgres database and return it, usually already `available`. The required `idempotency_key` is ignored until central deduplication lands: a retried create can make a second database, so after an uncertain response (lost or timed out), list the workspace's databases before creating again.",
-                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"idempotency_key":{"description":"Required but ignored: a retried create can make a second database.","maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"},"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"What the database holds. Members and their agents choose a database from `zo.database.list` by it.","maxLength":2000,"title":"Description","type":"string"},"engine":{"const":"postgres","default":"postgres","title":"Engine","type":"string"},"postgres":{"additionalProperties":false,"default":{},"properties":{"major_version":{"default":18,"description":"One of the offered major versions. Fixed for the life of the database.","maximum":2147483647,"minimum":1,"title":"Major Version","type":"integer"},"compute":{"additionalProperties":false,"default":{},"properties":{"min_memory_mib":{"default":1024,"description":"The autoscaling floor while the compute is awake, one of the shapes `zo.database.list_configurations` offers. Equal to `max_memory_mib`, it fixes the size. Above 4,096, set `max_memory_mib` too.","maximum":2147483647,"minimum":1,"title":"Min Memory Mib","type":"integer"},"max_memory_mib":{"default":4096,"description":"The autoscaling ceiling, from the same shapes and at least `min_memory_mib`. CPU scales with memory.","maximum":2147483647,"minimum":1,"title":"Max Memory Mib","type":"integer"},"scale_to_zero":{"default":true,"description":"Whether the compute suspends when idle. `false` keeps it running at its minimum or above around the clock, and is billed for it, on plans whose offer includes `false`.","title":"Scale To Zero","type":"boolean"},"idle_timeout_seconds":{"default":300,"description":"Seconds without a call before the compute scales to zero, within the offered bounds. No effect while `scale_to_zero` is `false`.","maximum":2147483647,"minimum":1,"title":"Idle Timeout Seconds","type":"integer"}},"title":"DatabaseComputeInput","type":"object","required":[]}},"title":"DatabasePostgresInput","type":"object","required":[]},"region":{"default":"us","description":"One of the offered regions. Fixed at creation.","pattern":"^[a-z0-9][a-z0-9-]{0,31}$","title":"Region","type":"string"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see it and use it as their role allows. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","idempotency_key","display_name"],"title":"DatabaseCreateInput","type":"object"}',
+                    description: "Create a managed Postgres database and return it, usually already `available`. A retried create can make a second database, so after an uncertain response (lost or timed out), list the workspace's databases before creating again.",
+                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"},"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"What the database holds. Members and their agents choose a database from `zo.database.list` by it.","maxLength":2000,"title":"Description","type":"string"},"engine":{"const":"postgres","default":"postgres","title":"Engine","type":"string"},"postgres":{"additionalProperties":false,"default":{},"properties":{"major_version":{"default":18,"description":"One of the offered major versions. Fixed for the life of the database.","maximum":2147483647,"minimum":1,"title":"Major Version","type":"integer"},"compute":{"additionalProperties":false,"default":{},"properties":{"min_memory_mib":{"default":1024,"description":"The autoscaling floor while the compute is awake, one of the shapes `zo.database.list_configurations` offers. Equal to `max_memory_mib`, it fixes the size. Above 4,096, set `max_memory_mib` too.","maximum":2147483647,"minimum":1,"title":"Min Memory Mib","type":"integer"},"max_memory_mib":{"default":4096,"description":"The autoscaling ceiling, from the same shapes and at least `min_memory_mib`. CPU scales with memory.","maximum":2147483647,"minimum":1,"title":"Max Memory Mib","type":"integer"},"scale_to_zero":{"default":true,"description":"Whether the compute suspends when idle. `false` keeps it running at its minimum or above around the clock, and is billed for it, on plans whose offer includes `false`.","title":"Scale To Zero","type":"boolean"},"idle_timeout_seconds":{"default":300,"description":"Seconds without a call before the compute scales to zero, within the offered bounds. No effect while `scale_to_zero` is `false`.","maximum":2147483647,"minimum":1,"title":"Idle Timeout Seconds","type":"integer"}},"title":"DatabaseComputeInput","type":"object","required":[]}},"title":"DatabasePostgresInput","type":"object","required":[]},"region":{"default":"us","description":"One of the offered regions. Fixed at creation.","pattern":"^[a-z0-9][a-z0-9-]{0,31}$","title":"Region","type":"string"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see it and use it as their role allows. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","display_name"],"title":"DatabaseCreateInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -507,7 +507,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Validate a payload against an active event definition and publish the occurrence durably under a caller-scoped idempotency key.",
-                    inputJson: '{"additionalProperties":false,"description":"The payload and its caller-scoped idempotency key (1 to 255 printable ASCII\\ncharacters). Every envelope attribute (``id``, ``source``, ``type``, ``time``,\\nthe workspace, the definition and the causal fields) is derived by the server\\nand rejected as input.","properties":{"event_id":{"title":"Event Id","type":"string"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"},"data":{"additionalProperties":{"x-zo-json-value":true},"title":"Data","type":"object"},"subject":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Subject"}},"required":["event_id","idempotency_key","data"],"title":"EventDispatchInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"description":"The payload and an optional caller-scoped idempotency key (1 to 255 printable ASCII\\ncharacters). Every envelope attribute (``id``, ``source``, ``type``, ``time``,\\nthe workspace, the definition and the causal fields) is derived by the server\\nand rejected as input.","properties":{"event_id":{"title":"Event Id","type":"string"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"title":"Idempotency Key"},"data":{"additionalProperties":{"x-zo-json-value":true},"title":"Data","type":"object"},"subject":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Subject"}},"required":["event_id","data"],"title":"EventDispatchInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -732,7 +732,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Create a managed machine from a machine image and return its current view. Describe what this machine is for in the user's terms.",
-                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"title":"Workspace Id","type":"string"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"},"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this machine is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"source":{"$ref":"#/$defs/MachineSourceInput"},"resources":{"$ref":"#/$defs/MachineResourcesInput"},"lifecycle":{"$ref":"#/$defs/MachineLifecycleInput"},"region":{"default":"us","pattern":"^[a-z0-9][a-z0-9-]{0,31}$","title":"Region","type":"string"},"init":{"default":"none","description":"Which process runs first at boot. `none` (default): nothing; the machine waits for exec. `image`: the init system inside the machine\'s image (systemd, OpenRC) becomes PID 1 and starts the services enabled on its disk. This does not choose the image; `source.machine_image_id` does. Debian and Ubuntu images need `systemd systemd-sysv` installed first. A unit restarts after a crash only when it sets `Restart=`. GPU machines require `none`.","enum":["none","image"],"title":"Init","type":"string"},"command":{"anyOf":[{"items":{"minLength":1,"type":"string"},"maxItems":64,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Run these arguments as the main process on every boot, without a shell. Use [\\"sh\\", \\"-c\\", ...] for shell syntax. Find ENTRYPOINT and CMD on the image\'s registry page; Zo does not return them. Pass ENTRYPOINT then CMD. With `init: image`, the command must wait for services it needs. The machine stops when it exits; resume runs it again. It may run more than once after a lost create or resume response, so make it safe to rerun. Each argument is at most 4,096 UTF-8 bytes and all arguments total at most 65,536 bytes. A running command is not activity: set `idle_timeout_seconds` at least as long as the job. The maximum is published by `zo.machine.list_configurations`: 3,600 s for CPU machines and 86,400 s for GPU machines. Longer CPU jobs need Zo exec or file calls, or HTTP through a tunnel or connect token. After exit, `get` may show `running` for a few minutes until the stop is recorded. Zo reports no exit reason or code. Write a job\'s result to disk. A resume runs the command again, so to read it, clear the command, resume, then use `zo.machine.read_bytes`. With `init: image` and a command, a missing `/sbin/init` ends the generation as an exit stop, without `incompatible_image`.","title":"Command"},"environment":{"additionalProperties":{"maxLength":4096,"type":"string"},"default":{},"description":"Environment variables set, exactly as written, in the boot process and every command run on the machine. Plain strings, not secrets: they are part of the machine\'s configuration, which anyone who can read the machine sees. Names are upper-case letters, digits and underscores, and reserved names such as `PATH` or ones starting with `ZO_` are refused; at most 64 variables of at most 4096 characters each. A variable here wins over a connection in `credentials` that sets the same name.","maxProperties":64,"title":"Environment","type":"object"},"credentials":{"default":[],"description":"Connection IDs whose credentials the machine receives as environment variables, in the boot process and every command. Each slot of a listed connection sets the variable its definition names, with the variables the slot and the connection declare. The machine also needs a use grant on each connection (`zo.grant.create` with the machine as assignee); a listed connection without one delivers nothing. When two listed connections set the same variable, the later one in the list wins. At most 100 connections, each listed once.","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":100,"title":"Credentials","type":"array"},"outbound_network_policies":{"default":[],"description":"Header rules: on HTTPS requests from the machine to a rule\'s hosts, Zo sets a header built from a connection\'s credential, and the credential never enters the machine. A rule names the connection (`credential`) and one of its definition\'s slots (`slot`). With only those two, it uses the hosts, header and format the slot declares in its `injections`. It may give its own `hosts`, `location` and `format`, all three together, only for a slot that declares an `environment_variable`. Formats: `bearer` (`Bearer <value>`), `basic` with a `username` (`Basic` with base64 of `<username>:<value>`) and `raw` (the value as stored). A rule sets its header only while the machine holds a use grant on the connection. Two rules can\'t set the same header on the same host, and all rules together set at most 25 header values. Requests to a host with a rule use HTTP/1.1.","items":{"$ref":"#/$defs/OutboundNetworkPolicy"},"maxItems":25,"title":"Outbound Network Policies","type":"array"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see and use it. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","idempotency_key","display_name","source","resources","lifecycle"],"title":"MachineCreateInput","type":"object","$defs":{"BasicFormat":{"additionalProperties":false,"properties":{"type":{"const":"basic","description":"`Basic` with base64 of `<username>:<value>`.","title":"Type","type":"string"},"username":{"pattern":"^[^:]{1,256}$","title":"Username","type":"string"}},"required":["type","username"],"title":"BasicFormat","type":"object"},"BearerFormat":{"additionalProperties":false,"properties":{"type":{"const":"bearer","description":"`Bearer <value>`.","title":"Type","type":"string"}},"required":["type"],"title":"BearerFormat","type":"object"},"GpuType":{"enum":["T4","L4","A10","L40S","A100","A100-40GB","A100-80GB","RTX-PRO-6000","H100","H100!","H200","B200","B200+","B300"],"type":"string"},"HeaderLocation":{"additionalProperties":false,"properties":{"type":{"const":"header","title":"Type","type":"string"},"name":{"description":"The header to set, such as `Authorization` or `X-API-Key`.","pattern":"^[A-Za-z0-9!#$%&\'*+.^_`|~-]{1,128}$","title":"Name","type":"string"}},"required":["type","name"],"title":"HeaderLocation","type":"object"},"MachineGpu":{"additionalProperties":false,"properties":{"type":{"$ref":"#/$defs/GpuType"},"count":{"maximum":8,"minimum":1,"title":"Count","type":"integer"}},"required":["type","count"],"title":"MachineGpu","type":"object"},"MachineLifecycleInput":{"additionalProperties":false,"properties":{"idle_timeout_seconds":{"anyOf":[{"maximum":86400,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"description":"Omit for 900 seconds on CPU. For GPU, the default is the smaller of 300 seconds and max_run_seconds. An explicit GPU idle timeout must not exceed max_run_seconds.","title":"Idle Timeout Seconds"},"max_run_seconds":{"maximum":86400,"minimum":1,"title":"Max Run Seconds","type":"integer"}},"required":["max_run_seconds"],"title":"MachineLifecycleInput","type":"object"},"MachineResourcesInput":{"additionalProperties":false,"properties":{"vcpus":{"description":"Whole vCPUs of CPU capacity; each is half a Modal physical core. A quarter is reserved; the full allocation can burst when capacity allows. Guest logical CPU count is separate.","maximum":2147483647,"minimum":1,"title":"Vcpus","type":"integer"},"memory_mib":{"maximum":2147483647,"minimum":1,"title":"Memory Mib","type":"integer"},"gpu":{"anyOf":[{"$ref":"#/$defs/MachineGpu"},{"type":"null"}],"default":null}},"required":["vcpus","memory_mib"],"title":"MachineResourcesInput","type":"object"},"MachineSourceInput":{"additionalProperties":false,"properties":{"machine_image_id":{"description":"The machine image to boot (from `zo.machine_image.import`). Separate from `init`, which only chooses what runs first at boot.","minLength":1,"title":"Machine Image Id","type":"string"}},"required":["machine_image_id"],"title":"MachineSourceInput","type":"object"},"OutboundNetworkPolicy":{"additionalProperties":false,"description":"Send one slot\'s credential as a header on HTTPS requests to some hosts.","properties":{"credential":{"description":"The connection ID.","maxLength":200,"minLength":1,"title":"Credential","type":"string"},"slot":{"description":"The connection definition\'s slot, by name.","maxLength":200,"minLength":1,"title":"Slot","type":"string"},"hosts":{"anyOf":[{"items":{"description":"An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.","maxLength":253,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$","type":"string"},"maxItems":20,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"title":"Hosts"},"location":{"anyOf":[{"$ref":"#/$defs/HeaderLocation"},{"type":"null"}],"default":null},"format":{"anyOf":[{"discriminator":{"mapping":{"basic":"#/$defs/BasicFormat","bearer":"#/$defs/BearerFormat","raw":"#/$defs/RawFormat"},"propertyName":"type"},"oneOf":[{"$ref":"#/$defs/BearerFormat"},{"$ref":"#/$defs/BasicFormat"},{"$ref":"#/$defs/RawFormat"}]},{"type":"null"}],"default":null,"title":"Format"}},"required":["credential","slot"],"title":"OutboundNetworkPolicy","type":"object"},"RawFormat":{"additionalProperties":false,"properties":{"type":{"const":"raw","description":"The value as it is.","title":"Type","type":"string"}},"required":["type"],"title":"RawFormat","type":"object"}}}',
+                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"title":"Workspace Id","type":"string"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"},"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this machine is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"source":{"$ref":"#/$defs/MachineSourceInput"},"resources":{"$ref":"#/$defs/MachineResourcesInput"},"lifecycle":{"$ref":"#/$defs/MachineLifecycleInput"},"region":{"default":"us","pattern":"^[a-z0-9][a-z0-9-]{0,31}$","title":"Region","type":"string"},"init":{"default":"none","description":"Which process runs first at boot. `none` (default): nothing; the machine waits for exec. `image`: the init system inside the machine\'s image (systemd, OpenRC) becomes PID 1 and starts the services enabled on its disk. This does not choose the image; `source.machine_image_id` does. Debian and Ubuntu images need `systemd systemd-sysv` installed first. A unit restarts after a crash only when it sets `Restart=`. GPU machines require `none`.","enum":["none","image"],"title":"Init","type":"string"},"command":{"anyOf":[{"items":{"minLength":1,"type":"string"},"maxItems":64,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Run these arguments as the main process on every boot, without a shell. Use [\\"sh\\", \\"-c\\", ...] for shell syntax. Find ENTRYPOINT and CMD on the image\'s registry page; Zo does not return them. Pass ENTRYPOINT then CMD. With `init: image`, the command must wait for services it needs. The machine stops when it exits; resume runs it again. It may run more than once after a lost create or resume response, so make it safe to rerun. Each argument is at most 4,096 UTF-8 bytes and all arguments total at most 65,536 bytes. A running command is not activity: set `idle_timeout_seconds` at least as long as the job. The maximum is published by `zo.machine.list_configurations`: 3,600 s for CPU machines and 86,400 s for GPU machines. Longer CPU jobs need Zo exec or file calls, or HTTP through a tunnel or connect token. After exit, `get` may show `running` for a few minutes until the stop is recorded. Zo reports no exit reason or code. Write a job\'s result to disk. A resume runs the command again, so to read it, clear the command, resume, then use `zo.machine.read_bytes`. With `init: image` and a command, a missing `/sbin/init` ends the generation as an exit stop, without `incompatible_image`.","title":"Command"},"environment":{"additionalProperties":{"maxLength":4096,"type":"string"},"default":{},"description":"Environment variables set, exactly as written, in the boot process and every command run on the machine. Plain strings, not secrets: they are part of the machine\'s configuration, which anyone who can read the machine sees. Names are upper-case letters, digits and underscores, and reserved names such as `PATH` or ones starting with `ZO_` are refused; at most 64 variables of at most 4096 characters each. A variable here wins over a connection in `credentials` that sets the same name.","maxProperties":64,"title":"Environment","type":"object"},"credentials":{"default":[],"description":"Connection IDs whose credentials the machine receives as environment variables, in the boot process and every command. Each slot of a listed connection sets the variable its definition names, with the variables the slot and the connection declare. The machine also needs a use grant on each connection (`zo.grant.create` with the machine as assignee); a listed connection without one delivers nothing. When two listed connections set the same variable, the later one in the list wins. At most 100 connections, each listed once.","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":100,"title":"Credentials","type":"array"},"outbound_network_policies":{"default":[],"description":"Header rules: on HTTPS requests from the machine to a rule\'s hosts, Zo sets a header built from a connection\'s credential, and the credential never enters the machine. A rule names the connection (`credential`) and one of its definition\'s slots (`slot`). With only those two, it uses the hosts, header and format the slot declares in its `injections`. It may give its own `hosts`, `location` and `format`, all three together, only for a slot that declares an `environment_variable`. Formats: `bearer` (`Bearer <value>`), `basic` with a `username` (`Basic` with base64 of `<username>:<value>`) and `raw` (the value as stored). A rule sets its header only while the machine holds a use grant on the connection. Two rules can\'t set the same header on the same host, and all rules together set at most 25 header values. Requests to a host with a rule use HTTP/1.1.","items":{"$ref":"#/$defs/OutboundNetworkPolicy"},"maxItems":25,"title":"Outbound Network Policies","type":"array"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see and use it. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","display_name","source","resources","lifecycle"],"title":"MachineCreateInput","type":"object","$defs":{"BasicFormat":{"additionalProperties":false,"properties":{"type":{"const":"basic","description":"`Basic` with base64 of `<username>:<value>`.","title":"Type","type":"string"},"username":{"pattern":"^[^:]{1,256}$","title":"Username","type":"string"}},"required":["type","username"],"title":"BasicFormat","type":"object"},"BearerFormat":{"additionalProperties":false,"properties":{"type":{"const":"bearer","description":"`Bearer <value>`.","title":"Type","type":"string"}},"required":["type"],"title":"BearerFormat","type":"object"},"GpuType":{"enum":["T4","L4","A10","L40S","A100","A100-40GB","A100-80GB","RTX-PRO-6000","H100","H100!","H200","B200","B200+","B300"],"type":"string"},"HeaderLocation":{"additionalProperties":false,"properties":{"type":{"const":"header","title":"Type","type":"string"},"name":{"description":"The header to set, such as `Authorization` or `X-API-Key`.","pattern":"^[A-Za-z0-9!#$%&\'*+.^_`|~-]{1,128}$","title":"Name","type":"string"}},"required":["type","name"],"title":"HeaderLocation","type":"object"},"MachineGpu":{"additionalProperties":false,"properties":{"type":{"$ref":"#/$defs/GpuType"},"count":{"maximum":8,"minimum":1,"title":"Count","type":"integer"}},"required":["type","count"],"title":"MachineGpu","type":"object"},"MachineLifecycleInput":{"additionalProperties":false,"properties":{"idle_timeout_seconds":{"anyOf":[{"maximum":86400,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"description":"Omit for 900 seconds on CPU. For GPU, the default is the smaller of 300 seconds and max_run_seconds. An explicit GPU idle timeout must not exceed max_run_seconds.","title":"Idle Timeout Seconds"},"max_run_seconds":{"maximum":86400,"minimum":1,"title":"Max Run Seconds","type":"integer"}},"required":["max_run_seconds"],"title":"MachineLifecycleInput","type":"object"},"MachineResourcesInput":{"additionalProperties":false,"properties":{"vcpus":{"description":"Whole vCPUs of CPU capacity; each is half a Modal physical core. A quarter is reserved; the full allocation can burst when capacity allows. Guest logical CPU count is separate.","maximum":2147483647,"minimum":1,"title":"Vcpus","type":"integer"},"memory_mib":{"maximum":2147483647,"minimum":1,"title":"Memory Mib","type":"integer"},"gpu":{"anyOf":[{"$ref":"#/$defs/MachineGpu"},{"type":"null"}],"default":null}},"required":["vcpus","memory_mib"],"title":"MachineResourcesInput","type":"object"},"MachineSourceInput":{"additionalProperties":false,"properties":{"machine_image_id":{"description":"The machine image to boot (from `zo.machine_image.import`). Separate from `init`, which only chooses what runs first at boot.","minLength":1,"title":"Machine Image Id","type":"string"}},"required":["machine_image_id"],"title":"MachineSourceInput","type":"object"},"OutboundNetworkPolicy":{"additionalProperties":false,"description":"Send one slot\'s credential as a header on HTTPS requests to some hosts.","properties":{"credential":{"description":"The connection ID.","maxLength":200,"minLength":1,"title":"Credential","type":"string"},"slot":{"description":"The connection definition\'s slot, by name.","maxLength":200,"minLength":1,"title":"Slot","type":"string"},"hosts":{"anyOf":[{"items":{"description":"An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.","maxLength":253,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$","type":"string"},"maxItems":20,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"title":"Hosts"},"location":{"anyOf":[{"$ref":"#/$defs/HeaderLocation"},{"type":"null"}],"default":null},"format":{"anyOf":[{"discriminator":{"mapping":{"basic":"#/$defs/BasicFormat","bearer":"#/$defs/BearerFormat","raw":"#/$defs/RawFormat"},"propertyName":"type"},"oneOf":[{"$ref":"#/$defs/BearerFormat"},{"$ref":"#/$defs/BasicFormat"},{"$ref":"#/$defs/RawFormat"}]},{"type":"null"}],"default":null,"title":"Format"}},"required":["credential","slot"],"title":"OutboundNetworkPolicy","type":"object"},"RawFormat":{"additionalProperties":false,"properties":{"type":{"const":"raw","description":"The value as it is.","title":"Type","type":"string"}},"required":["type"],"title":"RawFormat","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -744,7 +744,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Destroy a managed machine and return its current view.",
-                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"}},"required":["machine_id","expected_revision","idempotency_key"],"title":"MachineLifecycleActionInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"}},"required":["machine_id","expected_revision"],"title":"MachineLifecycleActionInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -830,7 +830,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Start a stopped managed machine again and return its current view.",
-                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"},"accept_recovery":{"default":false,"title":"Accept Recovery","type":"boolean"}},"required":["machine_id","expected_revision","idempotency_key"],"title":"MachineResumeInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"},"accept_recovery":{"default":false,"title":"Accept Recovery","type":"boolean"}},"required":["machine_id","expected_revision"],"title":"MachineResumeInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -854,7 +854,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Stop a managed machine, keeping its files, and return its current view.",
-                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"}},"required":["machine_id","expected_revision","idempotency_key"],"title":"MachineLifecycleActionInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"properties":{"machine_id":{"title":"Machine Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"}},"required":["machine_id","expected_revision"],"title":"MachineLifecycleActionInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -902,7 +902,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Delete a machine image no machine uses and return the image view.",
-                    inputJson: '{"additionalProperties":false,"properties":{"machine_image_id":{"title":"Machine Image Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"}},"required":["machine_image_id","expected_revision","idempotency_key"],"title":"MachineImageDeleteInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"properties":{"machine_image_id":{"title":"Machine Image Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"}},"required":["machine_image_id","expected_revision"],"title":"MachineImageDeleteInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -926,7 +926,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Import a registry image, pinned to its manifest digest, and return the image view. Describe what this machine image is for in the user's terms.",
-                    inputJson: '{"additionalProperties":false,"properties":{"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this machine image is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see and use it. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"},"workspace_id":{"title":"Workspace Id","type":"string"},"idempotency_key":{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","title":"Idempotency Key","type":"string"},"source":{"$ref":"#/$defs/RegistrySourceInput"}},"required":["display_name","workspace_id","idempotency_key","source"],"title":"MachineImageImportInput","type":"object","$defs":{"RegistrySourceInput":{"additionalProperties":false,"properties":{"kind":{"const":"registry","title":"Kind","type":"string"},"ref":{"maxLength":1024,"minLength":1,"pattern":"^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[0-9]{1,5})?/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[0-9a-f]{64})?$","title":"Ref","type":"string"},"platform":{"const":"linux/amd64","default":"linux/amd64","title":"Platform","type":"string"}},"required":["kind","ref"],"title":"RegistrySourceInput","type":"object"}}}',
+                    inputJson: '{"additionalProperties":false,"properties":{"display_name":{"maxLength":120,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this machine image is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can see and use it. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"},"workspace_id":{"title":"Workspace Id","type":"string"},"idempotency_key":{"anyOf":[{"maxLength":255,"minLength":1,"pattern":"^[!-~]{1,255}$","type":"string"},{"type":"null"}],"default":null,"deprecated":true,"description":"Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.","title":"Idempotency Key"},"source":{"$ref":"#/$defs/RegistrySourceInput"}},"required":["display_name","workspace_id","source"],"title":"MachineImageImportInput","type":"object","$defs":{"RegistrySourceInput":{"additionalProperties":false,"properties":{"kind":{"const":"registry","title":"Kind","type":"string"},"ref":{"maxLength":1024,"minLength":1,"pattern":"^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[0-9]{1,5})?/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[0-9a-f]{64})?$","title":"Ref","type":"string"},"platform":{"const":"linux/amd64","default":"linux/amd64","title":"Platform","type":"string"}},"required":["kind","ref"],"title":"RegistrySourceInput","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -1207,14 +1207,14 @@ export const commandManifest = {
                     version: 1,
                     description: "List subscriptions accessible to the caller in a workspace, optionally for one event definition.",
                     inputJson: '{"additionalProperties":false,"properties":{"workspace_id":{"title":"Workspace Id","type":"string"}},"required":["workspace_id"],"title":"SubscriptionListInput","type":"object"}',
-                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":7,"description":"Rows per page, at most 7; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"filter":{"additionalProperties":false,"properties":{"event_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"Only subscriptions to this event definition.","title":"Event Id"},"handler":{"anyOf":[{"$ref":"#/$defs/SubscriptionHandlerRef"},{"type":"null"}],"default":null,"description":"Only subscriptions whose handler is this resource: its handler_resource_type and handler_resource_id, such as an Agent."}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"SubscriptionHandlerRef":{"additionalProperties":false,"properties":{"type":{"enum":["function","workflow","agent"],"title":"Type","type":"string"},"id":{"maxLength":200,"minLength":1,"title":"Id","type":"string"}},"required":["type","id"],"title":"SubscriptionHandlerRef","type":"object"}}}',
+                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":100,"description":"Rows per page, at most 100; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"filter":{"additionalProperties":false,"properties":{"event_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"Only subscriptions to this event definition.","title":"Event Id"},"handler":{"anyOf":[{"$ref":"#/$defs/SubscriptionHandlerRef"},{"type":"null"}],"default":null,"description":"Only subscriptions whose handler is this resource: its handler_resource_type and handler_resource_id, such as an Agent."}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"SubscriptionHandlerRef":{"additionalProperties":false,"properties":{"type":{"enum":["function","workflow","agent"],"title":"Type","type":"string"},"id":{"maxLength":200,"minLength":1,"title":"Id","type":"string"}},"required":["type","id"],"title":"SubscriptionHandlerRef","type":"object"}}}',
                     resultKind: "inline",
                 },
                 {
                     version: 2,
                     description: "List subscriptions accessible to the caller in a workspace, optionally for one event definition.",
                     inputJson: '{"additionalProperties":false,"properties":{"workspace_id":{"title":"Workspace Id","type":"string"}},"required":["workspace_id"],"title":"SubscriptionListInput","type":"object"}',
-                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":7,"description":"Rows per page, at most 7; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"filter":{"additionalProperties":false,"properties":{"event_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"Only subscriptions to this event definition.","title":"Event Id"},"handler":{"anyOf":[{"$ref":"#/$defs/SubscriptionHandlerRef"},{"type":"null"}],"default":null,"description":"Only subscriptions whose handler is this resource: its handler_resource_type and handler_resource_id, such as an Agent."}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"SubscriptionHandlerRef":{"additionalProperties":false,"properties":{"type":{"enum":["function","workflow","agent"],"title":"Type","type":"string"},"id":{"maxLength":200,"minLength":1,"title":"Id","type":"string"}},"required":["type","id"],"title":"SubscriptionHandlerRef","type":"object"}}}',
+                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":100,"description":"Rows per page, at most 100; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"filter":{"additionalProperties":false,"properties":{"event_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"Only subscriptions to this event definition.","title":"Event Id"},"handler":{"anyOf":[{"$ref":"#/$defs/SubscriptionHandlerRef"},{"type":"null"}],"default":null,"description":"Only subscriptions whose handler is this resource: its handler_resource_type and handler_resource_id, such as an Agent."}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"SubscriptionHandlerRef":{"additionalProperties":false,"properties":{"type":{"enum":["function","workflow","agent"],"title":"Type","type":"string"},"id":{"maxLength":200,"minLength":1,"title":"Id","type":"string"}},"required":["type","id"],"title":"SubscriptionHandlerRef","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -1440,7 +1440,7 @@ export const commandManifest = {
                     version: 1,
                     description: 'List the workspace\'s tasks, most recently updated first. Filter by status, assignee (principals or "unassigned"), parent and blocked state. Summaries carry no body or comments.',
                     inputJson: '{"additionalProperties":false,"properties":{"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"parent":{"anyOf":[{"description":"The task\'s number (\\"42\\" or \\"#42\\") or its tsk_ ID.","pattern":"^(#?[1-9][0-9]{0,15}|tsk_[0-9A-Za-z]{16})$","type":"string"},{"type":"null"}],"default":null,"description":"Only this task\'s subtasks.","title":"Parent"}},"required":["workspace_id"],"title":"TaskListInput","type":"object"}',
-                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":50,"description":"Rows per page, at most 200; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"sort":{"type":"string","enum":["updated_at.desc","number.asc"],"default":"updated_at.desc"},"filter":{"additionalProperties":false,"properties":{"status":{"anyOf":[{"items":{"enum":["backlog","ready","in_progress","failed","done","cancelled"],"type":"string"},"maxItems":6,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Tasks in any of these statuses.","title":"Status"},"assignee":{"anyOf":[{"items":{"$ref":"#/$defs/AssigneeFilter"},"maxItems":32,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Tasks assigned to any of these; {\\"type\\": \\"unassigned\\"} matches tasks with no assignee.","title":"Assignee"},"is_blocked":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"Only blocked tasks, or only unblocked ones.","title":"Is Blocked"}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"AssigneeFilter":{"additionalProperties":false,"description":"A principal, or ``{\\"type\\": \\"unassigned\\"}`` for tasks with no assignee.","properties":{"type":{"enum":["user","agent","service_account","unassigned"],"title":"Type","type":"string"},"id":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"description":"The principal\'s ID; omitted for \\"unassigned\\".","title":"Id"}},"required":["type"],"title":"AssigneeFilter","type":"object"}}}',
+                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":50,"description":"Rows per page, at most 200; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"sort":{"type":"string","enum":["updated_at.desc","number.asc"],"default":"updated_at.desc"},"filter":{"additionalProperties":false,"properties":{"status":{"anyOf":[{"items":{"enum":["backlog","ready","in_progress","failed","done","cancelled"],"type":"string"},"maxItems":6,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Tasks in any of these statuses.","title":"Status"},"assignee":{"anyOf":[{"items":{"$ref":"#/$defs/AssigneeFilter"},"maxItems":32,"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Tasks assigned to any of these; {\\"type\\": \\"unassigned\\"} matches tasks with no assignee.","title":"Assignee"},"is_blocked":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"Only blocked tasks, or only unblocked ones.","title":"Is Blocked"},"tags":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"default":null,"description":"Tasks carrying any of these workspace tag IDs.","title":"Tags"}},"type":"object","required":[],"default":{}}},"required":[],"$defs":{"AssigneeFilter":{"additionalProperties":false,"description":"A principal, or ``{\\"type\\": \\"unassigned\\"}`` for tasks with no assignee.","properties":{"type":{"enum":["user","agent","service_account","unassigned"],"title":"Type","type":"string"},"id":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"description":"The principal\'s ID; omitted for \\"unassigned\\".","title":"Id"}},"required":["type"],"title":"AssigneeFilter","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -1457,79 +1457,6 @@ export const commandManifest = {
                 },
             ],
         },
-        {
-            action: "zo.vault.create",
-            path: ["vault", "create"],
-            versions: [
-                {
-                    version: 1,
-                    description: "Store a pasted credential, such as an API key, with the hosts it may be sent to. The value is never returned.",
-                    inputJson: '{"additionalProperties":false,"properties":{"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"display_name":{"maxLength":256,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","maxLength":2000,"title":"Description","type":"string"},"value":{"description":"Secret: the credential. Stored sealed and never returned.","maxLength":16384,"minLength":1,"title":"Value","type":"string"},"environment_variable":{"anyOf":[{"pattern":"^[A-Z_][A-Z0-9_]{0,127}$","type":"string"},{"type":"null"}],"default":null,"description":"The environment variable name a machine gets the value under, such as `OPENAI_API_KEY`.","title":"Environment Variable"},"injections":{"default":[],"items":{"$ref":"#/$defs/VaultInjection"},"maxItems":10,"title":"Injections","type":"array"},"visibility":{"default":"workspace","description":"`workspace` (default): every member can use it. `protected`: only you, and whoever you share it with; workspace-wide grants don\'t reach it. Fixed at creation.","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","display_name","value"],"title":"VaultCreateInput","type":"object","$defs":{"BasicFormat":{"additionalProperties":false,"properties":{"type":{"const":"basic","description":"`Basic` with base64 of `<username>:<value>`.","title":"Type","type":"string"},"username":{"pattern":"^[^:]{1,256}$","title":"Username","type":"string"}},"required":["type","username"],"title":"BasicFormat","type":"object"},"BearerFormat":{"additionalProperties":false,"properties":{"type":{"const":"bearer","description":"`Bearer <value>`.","title":"Type","type":"string"}},"required":["type"],"title":"BearerFormat","type":"object"},"HeaderLocation":{"additionalProperties":false,"properties":{"type":{"const":"header","title":"Type","type":"string"},"name":{"description":"The header to set, such as `Authorization` or `X-API-Key`.","pattern":"^[A-Za-z0-9!#$%&\'*+.^_`|~-]{1,128}$","title":"Name","type":"string"}},"required":["type","name"],"title":"HeaderLocation","type":"object"},"RawFormat":{"additionalProperties":false,"properties":{"type":{"const":"raw","description":"The value as it is.","title":"Type","type":"string"}},"required":["type"],"title":"RawFormat","type":"object"},"VaultInjection":{"additionalProperties":false,"description":"Where and how the value is sent on requests to ``hosts``. A host appears\\nin at most one entry of a vault\'s list.","properties":{"hosts":{"items":{"description":"An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.","maxLength":253,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$","type":"string"},"maxItems":20,"minItems":1,"title":"Hosts","type":"array"},"location":{"$ref":"#/$defs/HeaderLocation"},"format":{"discriminator":{"mapping":{"basic":"#/$defs/BasicFormat","bearer":"#/$defs/BearerFormat","raw":"#/$defs/RawFormat"},"propertyName":"type"},"oneOf":[{"$ref":"#/$defs/BearerFormat"},{"$ref":"#/$defs/BasicFormat"},{"$ref":"#/$defs/RawFormat"}],"title":"Format"}},"required":["hosts","location","format"],"title":"VaultInjection","type":"object"}}}',
-                    resultKind: "inline",
-                },
-            ],
-        },
-        {
-            action: "zo.vault.delete",
-            path: ["vault", "delete"],
-            versions: [
-                {
-                    version: 1,
-                    description: "Delete a vault: its value is destroyed and every grant on it is revoked.",
-                    inputJson: '{"additionalProperties":false,"properties":{"vault_id":{"maxLength":200,"minLength":1,"title":"Vault Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"}},"required":["vault_id","expected_revision"],"title":"VaultTargetInput","type":"object"}',
-                    resultKind: "inline",
-                },
-            ],
-        },
-        {
-            action: "zo.vault.get",
-            path: ["vault", "get"],
-            versions: [
-                {
-                    version: 1,
-                    description: "Read a vault's settings. The value is never returned.",
-                    inputJson: '{"additionalProperties":false,"properties":{"vault_id":{"maxLength":200,"minLength":1,"title":"Vault Id","type":"string"}},"required":["vault_id"],"title":"VaultGetInput","type":"object"}',
-                    resultKind: "inline",
-                },
-            ],
-        },
-        {
-            action: "zo.vault.list",
-            path: ["vault", "list"],
-            versions: [
-                {
-                    version: 1,
-                    description: "List the vaults the caller can read in a workspace.",
-                    inputJson: '{"additionalProperties":false,"properties":{"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"}},"required":["workspace_id"],"title":"VaultListInput","type":"object"}',
-                    queryJson: '{"type":"object","additionalProperties":false,"properties":{"limit":{"type":"integer","minimum":1,"default":50,"description":"Rows per page, at most 100; a larger value is reduced to it."},"cursor":{"type":"string","minLength":1,"maxLength":5504,"description":"The previous page\'s next_cursor, sent with the same sort, filter and search."},"sort":{"type":"string","enum":["id.asc","created_at.desc","created_at.asc","display_name.asc"],"default":"id.asc"}},"required":[]}',
-                    resultKind: "inline",
-                },
-            ],
-        },
-        {
-            action: "zo.vault.rotate",
-            path: ["vault", "rotate"],
-            versions: [
-                {
-                    version: 1,
-                    description: "Replace a vault's value. The previous value is destroyed.",
-                    inputJson: '{"additionalProperties":false,"properties":{"vault_id":{"maxLength":200,"minLength":1,"title":"Vault Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"value":{"description":"Secret: the credential. Stored sealed and never returned.","maxLength":16384,"minLength":1,"title":"Value","type":"string"}},"required":["vault_id","expected_revision","value"],"title":"VaultRotateInput","type":"object"}',
-                    resultKind: "inline",
-                },
-            ],
-        },
-        {
-            action: "zo.vault.update",
-            path: ["vault", "update"],
-            versions: [
-                {
-                    version: 1,
-                    description: "Change a vault's name, description, environment variable or injections against its current revision.",
-                    inputJson: '{"additionalProperties":false,"description":"Omitted fields keep their value; ``injections`` replaces the whole list.","properties":{"vault_id":{"maxLength":200,"minLength":1,"title":"Vault Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"display_name":{"anyOf":[{"maxLength":256,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Display Name"},"description":{"anyOf":[{"maxLength":2000,"type":"string"},{"type":"null"}],"default":null,"description":"`\\"\\"` clears the description.","title":"Description"},"environment_variable":{"anyOf":[{"pattern":"^([A-Z_][A-Z0-9_]{0,127})?$","type":"string"},{"type":"null"}],"default":null,"description":"`\\"\\"` clears the variable.","title":"Environment Variable"},"injections":{"anyOf":[{"items":{"$ref":"#/$defs/VaultInjection"},"maxItems":10,"type":"array"},{"type":"null"}],"default":null,"title":"Injections"}},"required":["vault_id","expected_revision"],"title":"VaultUpdateInput","type":"object","$defs":{"BasicFormat":{"additionalProperties":false,"properties":{"type":{"const":"basic","description":"`Basic` with base64 of `<username>:<value>`.","title":"Type","type":"string"},"username":{"pattern":"^[^:]{1,256}$","title":"Username","type":"string"}},"required":["type","username"],"title":"BasicFormat","type":"object"},"BearerFormat":{"additionalProperties":false,"properties":{"type":{"const":"bearer","description":"`Bearer <value>`.","title":"Type","type":"string"}},"required":["type"],"title":"BearerFormat","type":"object"},"HeaderLocation":{"additionalProperties":false,"properties":{"type":{"const":"header","title":"Type","type":"string"},"name":{"description":"The header to set, such as `Authorization` or `X-API-Key`.","pattern":"^[A-Za-z0-9!#$%&\'*+.^_`|~-]{1,128}$","title":"Name","type":"string"}},"required":["type","name"],"title":"HeaderLocation","type":"object"},"RawFormat":{"additionalProperties":false,"properties":{"type":{"const":"raw","description":"The value as it is.","title":"Type","type":"string"}},"required":["type"],"title":"RawFormat","type":"object"},"VaultInjection":{"additionalProperties":false,"description":"Where and how the value is sent on requests to ``hosts``. A host appears\\nin at most one entry of a vault\'s list.","properties":{"hosts":{"items":{"description":"An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.","maxLength":253,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$","type":"string"},"maxItems":20,"minItems":1,"title":"Hosts","type":"array"},"location":{"$ref":"#/$defs/HeaderLocation"},"format":{"discriminator":{"mapping":{"basic":"#/$defs/BasicFormat","bearer":"#/$defs/BearerFormat","raw":"#/$defs/RawFormat"},"propertyName":"type"},"oneOf":[{"$ref":"#/$defs/BearerFormat"},{"$ref":"#/$defs/BasicFormat"},{"$ref":"#/$defs/RawFormat"}],"title":"Format"}},"required":["hosts","location","format"],"title":"VaultInjection","type":"object"}}}',
-                    resultKind: "inline",
-                },
-            ],
-        },
         {
             action: "zo.web.fetch",
             path: ["web", "fetch"],
@@ -1561,7 +1488,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Create a Website address in a workspace. Describe what this Website is for in the user's terms.",
-                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"slug":{"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","title":"Slug","type":"string"},"display_name":{"maxLength":200,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this Website is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"visibility":{"default":"workspace","enum":["workspace","protected"],"title":"Visibility","type":"string"}},"required":["workspace_id","slug","display_name"],"title":"WebsiteCreateInput","type":"object"}',
+                    inputJson: '{"additionalProperties":false,"properties":{"tags":{"default":[],"items":{"description":"A tag ID or name; unknown names are created, unknown IDs are refused.","maxLength":256,"minLength":1,"type":"string"},"maxItems":100,"title":"Tags","type":"array"},"workspace_id":{"maxLength":200,"minLength":1,"title":"Workspace Id","type":"string"},"slug":{"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","title":"Slug","type":"string"},"display_name":{"maxLength":200,"minLength":1,"title":"Display Name","type":"string"},"description":{"default":"","description":"Describe what this Website is for in the user\'s terms.","maxLength":2000,"title":"Description","type":"string"},"visibility":{"default":"workspace","enum":["workspace","protected"],"title":"Visibility","type":"string"},"access":{"default":"public","enum":["public","authenticated"],"title":"Access","type":"string"}},"required":["workspace_id","slug","display_name"],"title":"WebsiteCreateInput","type":"object"}',
                     resultKind: "inline",
                 },
             ],
@@ -1610,7 +1537,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Update a Website display name or custom hostname.",
-                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"display_name":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Display Name"},"description":{"anyOf":[{"maxLength":2000,"type":"string"},{"type":"null"}],"default":null,"description":"Describe what this Website is for in the user\'s terms.","title":"Description"},"custom_hostname":{"anyOf":[{"$ref":"#/$defs/CustomHostnameChange"},{"type":"null"}],"default":null}},"required":["website_id","expected_revision"],"title":"WebsiteUpdateInput","type":"object","$defs":{"CustomHostnameChange":{"additionalProperties":false,"properties":{"hostname":{"anyOf":[{"maxLength":253,"minLength":4,"type":"string"},{"type":"null"}],"title":"Hostname"}},"required":["hostname"],"title":"CustomHostnameChange","type":"object"}}}',
+                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"display_name":{"anyOf":[{"maxLength":200,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Display Name"},"description":{"anyOf":[{"maxLength":2000,"type":"string"},{"type":"null"}],"default":null,"description":"Describe what this Website is for in the user\'s terms.","title":"Description"},"custom_hostname":{"anyOf":[{"$ref":"#/$defs/CustomHostnameChange"},{"type":"null"}],"default":null},"access":{"anyOf":[{"enum":["public","authenticated"],"type":"string"},{"type":"null"}],"default":null,"title":"Access"}},"required":["website_id","expected_revision"],"title":"WebsiteUpdateInput","type":"object","$defs":{"CustomHostnameChange":{"additionalProperties":false,"properties":{"hostname":{"anyOf":[{"maxLength":253,"minLength":4,"type":"string"},{"type":"null"}],"title":"Hostname"}},"required":["hostname"],"title":"CustomHostnameChange","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -1622,7 +1549,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Create an unpublished Website route.",
-                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"path":{"maxLength":1024,"minLength":1,"title":"Path","type":"string"},"target":{"discriminator":{"mapping":{"function":"#/$defs/FunctionRouteConfigInput","kb":"#/$defs/KbRouteConfigInput","machine":"#/$defs/MachineRouteConfigInput"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/FunctionRouteConfigInput"},{"$ref":"#/$defs/MachineRouteConfigInput"},{"$ref":"#/$defs/KbRouteConfigInput"}],"title":"Target"},"acknowledge_bound_accounts":{"default":[],"items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":8,"title":"Acknowledge Bound Accounts","type":"array"}},"required":["website_id","expected_revision","path","target"],"title":"RouteCreateInput","type":"object","$defs":{"FunctionInputMapping":{"additionalProperties":false,"properties":{"handler":{"default":"http","maxLength":200,"minLength":1,"title":"Handler","type":"string"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"title":"FunctionInputMapping","type":"object","required":[]},"FunctionRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"function","title":"Kind","type":"string"},"function_id":{"maxLength":200,"minLength":1,"title":"Function Id","type":"string"},"deployment_id":{"maxLength":200,"minLength":1,"title":"Deployment Id","type":"string"},"input_mapping":{"$ref":"#/$defs/FunctionInputMapping"}},"required":["kind","function_id","deployment_id"],"title":"FunctionRouteConfigInput","type":"object"},"KbRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"kb","title":"Kind","type":"string"},"kb_path":{"maxLength":4096,"minLength":1,"title":"Kb Path","type":"string"},"spa_fallback":{"default":false,"title":"Spa Fallback","type":"boolean"},"published_as_of":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Published As Of"}},"required":["kind","kb_path"],"title":"KbRouteConfigInput","type":"object"},"MachineRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"machine","title":"Kind","type":"string"},"machine_id":{"maxLength":200,"minLength":1,"title":"Machine Id","type":"string"},"port":{"maximum":65535,"minimum":1,"title":"Port","type":"integer"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"required":["kind","machine_id","port"],"title":"MachineRouteConfigInput","type":"object"}}}',
+                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"path":{"maxLength":1024,"minLength":1,"title":"Path","type":"string"},"target":{"discriminator":{"mapping":{"function":"#/$defs/FunctionRouteConfigInput","kb":"#/$defs/KbRouteConfigInput","machine":"#/$defs/MachineRouteConfigInput"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/FunctionRouteConfigInput"},{"$ref":"#/$defs/MachineRouteConfigInput"},{"$ref":"#/$defs/KbRouteConfigInput"}],"title":"Target"},"acknowledge_bound_accounts":{"default":[],"items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":8,"title":"Acknowledge Bound Accounts","type":"array"},"access":{"default":"authenticated","enum":["public","authenticated"],"title":"Access","type":"string"}},"required":["website_id","expected_revision","path","target"],"title":"RouteCreateInput","type":"object","$defs":{"FunctionInputMapping":{"additionalProperties":false,"properties":{"handler":{"default":"http","maxLength":200,"minLength":1,"title":"Handler","type":"string"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"title":"FunctionInputMapping","type":"object","required":[]},"FunctionRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"function","title":"Kind","type":"string"},"function_id":{"maxLength":200,"minLength":1,"title":"Function Id","type":"string"},"deployment_id":{"maxLength":200,"minLength":1,"title":"Deployment Id","type":"string"},"input_mapping":{"$ref":"#/$defs/FunctionInputMapping"}},"required":["kind","function_id","deployment_id"],"title":"FunctionRouteConfigInput","type":"object"},"KbRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"kb","title":"Kind","type":"string"},"kb_path":{"maxLength":4096,"minLength":1,"title":"Kb Path","type":"string"},"spa_fallback":{"default":false,"title":"Spa Fallback","type":"boolean"},"published_as_of":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Published As Of"}},"required":["kind","kb_path"],"title":"KbRouteConfigInput","type":"object"},"MachineRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"machine","title":"Kind","type":"string"},"machine_id":{"maxLength":200,"minLength":1,"title":"Machine Id","type":"string"},"port":{"maximum":65535,"minimum":1,"title":"Port","type":"integer"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"required":["kind","machine_id","port"],"title":"MachineRouteConfigInput","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],
@@ -1695,7 +1622,7 @@ export const commandManifest = {
                 {
                     version: 1,
                     description: "Update a Website route and recheck its published source.",
-                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"route_id":{"maxLength":200,"minLength":1,"title":"Route Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"path":{"anyOf":[{"maxLength":1024,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Path"},"target":{"anyOf":[{"discriminator":{"mapping":{"function":"#/$defs/FunctionRouteConfigInput","kb":"#/$defs/KbRouteConfigInput","machine":"#/$defs/MachineRouteConfigInput"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/FunctionRouteConfigInput"},{"$ref":"#/$defs/MachineRouteConfigInput"},{"$ref":"#/$defs/KbRouteConfigInput"}]},{"type":"null"}],"default":null,"title":"Target"},"acknowledge_bound_accounts":{"default":[],"items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":8,"title":"Acknowledge Bound Accounts","type":"array"}},"required":["website_id","route_id","expected_revision"],"title":"RouteUpdateInput","type":"object","$defs":{"FunctionInputMapping":{"additionalProperties":false,"properties":{"handler":{"default":"http","maxLength":200,"minLength":1,"title":"Handler","type":"string"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"title":"FunctionInputMapping","type":"object","required":[]},"FunctionRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"function","title":"Kind","type":"string"},"function_id":{"maxLength":200,"minLength":1,"title":"Function Id","type":"string"},"deployment_id":{"maxLength":200,"minLength":1,"title":"Deployment Id","type":"string"},"input_mapping":{"$ref":"#/$defs/FunctionInputMapping"}},"required":["kind","function_id","deployment_id"],"title":"FunctionRouteConfigInput","type":"object"},"KbRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"kb","title":"Kind","type":"string"},"kb_path":{"maxLength":4096,"minLength":1,"title":"Kb Path","type":"string"},"spa_fallback":{"default":false,"title":"Spa Fallback","type":"boolean"},"published_as_of":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Published As Of"}},"required":["kind","kb_path"],"title":"KbRouteConfigInput","type":"object"},"MachineRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"machine","title":"Kind","type":"string"},"machine_id":{"maxLength":200,"minLength":1,"title":"Machine Id","type":"string"},"port":{"maximum":65535,"minimum":1,"title":"Port","type":"integer"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"required":["kind","machine_id","port"],"title":"MachineRouteConfigInput","type":"object"}}}',
+                    inputJson: '{"additionalProperties":false,"properties":{"website_id":{"maxLength":200,"minLength":1,"title":"Website Id","type":"string"},"route_id":{"maxLength":200,"minLength":1,"title":"Route Id","type":"string"},"expected_revision":{"exclusiveMinimum":0,"maximum":9007199254740991,"title":"Expected Revision","type":"integer"},"path":{"anyOf":[{"maxLength":1024,"minLength":1,"type":"string"},{"type":"null"}],"default":null,"title":"Path"},"target":{"anyOf":[{"discriminator":{"mapping":{"function":"#/$defs/FunctionRouteConfigInput","kb":"#/$defs/KbRouteConfigInput","machine":"#/$defs/MachineRouteConfigInput"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/FunctionRouteConfigInput"},{"$ref":"#/$defs/MachineRouteConfigInput"},{"$ref":"#/$defs/KbRouteConfigInput"}]},{"type":"null"}],"default":null,"title":"Target"},"acknowledge_bound_accounts":{"default":[],"items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":8,"title":"Acknowledge Bound Accounts","type":"array"},"access":{"anyOf":[{"enum":["public","authenticated"],"type":"string"},{"type":"null"}],"default":null,"title":"Access"}},"required":["website_id","route_id","expected_revision"],"title":"RouteUpdateInput","type":"object","$defs":{"FunctionInputMapping":{"additionalProperties":false,"properties":{"handler":{"default":"http","maxLength":200,"minLength":1,"title":"Handler","type":"string"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"title":"FunctionInputMapping","type":"object","required":[]},"FunctionRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"function","title":"Kind","type":"string"},"function_id":{"maxLength":200,"minLength":1,"title":"Function Id","type":"string"},"deployment_id":{"maxLength":200,"minLength":1,"title":"Deployment Id","type":"string"},"input_mapping":{"$ref":"#/$defs/FunctionInputMapping"}},"required":["kind","function_id","deployment_id"],"title":"FunctionRouteConfigInput","type":"object"},"KbRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"kb","title":"Kind","type":"string"},"kb_path":{"maxLength":4096,"minLength":1,"title":"Kb Path","type":"string"},"spa_fallback":{"default":false,"title":"Spa Fallback","type":"boolean"},"published_as_of":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Published As Of"}},"required":["kind","kb_path"],"title":"KbRouteConfigInput","type":"object"},"MachineRouteConfigInput":{"additionalProperties":false,"properties":{"kind":{"const":"machine","title":"Kind","type":"string"},"machine_id":{"maxLength":200,"minLength":1,"title":"Machine Id","type":"string"},"port":{"maximum":65535,"minimum":1,"title":"Port","type":"integer"},"strip_prefix":{"default":false,"title":"Strip Prefix","type":"boolean"}},"required":["kind","machine_id","port"],"title":"MachineRouteConfigInput","type":"object"}}}',
                     resultKind: "inline",
                 },
             ],

package/dist/login.d.ts

@@ -1,16 +1,22 @@
 export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-export interface LoginPrompt {
+/** The browser opened at `url` on this machine, or a device flow to approve anywhere. */
+export type LoginPrompt = {
+    flow: "browser";
+    url: string;
+} | {
+    flow: "device";
     url: string;
     userCode: string;
-    /** False when the CLI won't open a browser: --no-browser, SSH or no display. */
-    browser: boolean;
-}
+};
 export interface LoginOptions {
-    noBrowser?: boolean;
+    /** Use the device flow even when this machine can open a browser. */
+    device?: boolean;
     signal?: AbortSignal;
     platform?: NodeJS.Platform;
     announce?: (prompt: LoginPrompt) => void;
     openBrowser?: (url: string) => Promise<void>;
+    /** How long the loopback listener waits for the browser's callback. */
+    callbackTimeoutMs?: number;
 }
 export interface DeviceAuthorization {
     deviceCode: string;
@@ -25,6 +31,25 @@ export declare function openBrowser(url: string): Promise<void>;
  * nowhere. xdg-open needs a display on every system other than macOS.
  */
 export declare function browserAvailable(env: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+export declare const CALLBACK_TIMEOUT_MS = 600000;
+export interface LoopbackAuthorization {
+    /** The authorization URL to open in the browser. */
+    url: string;
+    redirectUri: string;
+    codeVerifier: string;
+    /** Resolves with the authorization code from the one callback whose state matches. */
+    code: Promise<string>;
+    close: () => Promise<void>;
+}
+/**
+ * RFC 8252 loopback redirect with PKCE (RFC 7636): listen on 127.0.0.1 at an
+ * OS-assigned port until one callback carries the matching state, the timeout
+ * passes, or the signal aborts. The listener closes in every case.
+ */
+export declare function loopbackAuthorization(issuer: string, audience: string, clientId: string, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<LoopbackAuthorization>;
 export declare function pause(ms: number, signal?: AbortSignal | null): Promise<void>;
 export declare function parseDeviceAuthorization(raw: unknown, issuer: string): DeviceAuthorization;
 export declare function deviceAuthorization(issuer: string, audience: string, clientId: string, fetcher: typeof fetch, signal?: AbortSignal): Promise<DeviceAuthorization>;

package/dist/login.js

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
 import { CliError, record, throwIfInterrupted } from "./errors.js";
 import { requestJson, RequestFailure } from "./http.js";
 export const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
@@ -19,6 +21,85 @@ export function browserAvailable(env, platform = process.platform) {
         return false;
     return platform === "darwin" || !!env.DISPLAY || !!env.WAYLAND_DISPLAY;
 }
+export const CALLBACK_TIMEOUT_MS = 600_000;
+const base64url = (bytes) => bytes.toString("base64url");
+const page = (heading, detail) => `<!doctype html><meta charset="utf-8"><title>Zo CLI</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem"><h1 style="font-size:1.25rem">${heading}</h1><p>${detail}</p></body>`;
+/**
+ * Sends the page, then runs `then` once it is flushed: settling the login
+ * closes every connection, which would otherwise cut the page off.
+ */
+function answer(response, status, html, then) {
+    response.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        connection: "close",
+    });
+    response.end(html, then);
+}
+/**
+ * RFC 8252 loopback redirect with PKCE (RFC 7636): listen on 127.0.0.1 at an
+ * OS-assigned port until one callback carries the matching state, the timeout
+ * passes, or the signal aborts. The listener closes in every case.
+ */
+export async function loopbackAuthorization(issuer, audience, clientId, options = {}) {
+    throwIfInterrupted(options.signal);
+    const codeVerifier = base64url(randomBytes(32));
+    const state = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(codeVerifier).digest());
+    const result = Promise.withResolvers();
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (request.method !== "GET" || url.pathname !== "/callback")
+            return answer(response, 404);
+        const params = url.searchParams;
+        if (params.get("state") !== state)
+            return answer(response, 400, page("This sign-in link doesn't match", "Return to your terminal and run zo login again if it is still waiting."));
+        // RFC 9207: a response from another issuer is a mix-up, never a code to redeem.
+        if (params.get("iss") !== issuer) {
+            return answer(response, 400, page("Sign-in failed", "Return to your terminal and try again."), () => result.reject(new CliError("The sign-in service returned an invalid response.", 5, "invalid_response")));
+        }
+        const code = params.get("code");
+        if (params.get("error") === "access_denied") {
+            return answer(response, 200, page("Sign-in denied", "You can close this tab."), () => result.reject(new CliError("Authorization was denied. Run zo login to try again.", 4, "access_denied")));
+        }
+        if (params.has("error") || !code)
+            return answer(response, 400, page("Sign-in failed", "Return to your terminal and try again."), () => result.reject(new CliError("The sign-in service returned an invalid response.", 5, "invalid_response")));
+        answer(response, 200, page("Signed in to the Zo CLI", "You can close this tab and return to your terminal."), () => result.resolve(code));
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const { port } = server.address();
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const timer = setTimeout(() => result.reject(new CliError("Login timed out. Run zo login to try again.", 3, "login_timeout")), options.timeoutMs ?? CALLBACK_TIMEOUT_MS);
+    const abort = () => result.reject(new CliError("Interrupted.", 130, "interrupted"));
+    options.signal?.addEventListener("abort", abort, { once: true });
+    let closed;
+    const close = () => (closed ??= new Promise((resolve) => {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", abort);
+        server.close(() => resolve());
+        server.closeAllConnections();
+    }));
+    // Stop listening after the one accepted callback, a failure or the timeout.
+    const code = result.promise.finally(close);
+    code.catch(() => { });
+    const url = new URL(`${issuer}/zo-system-api/oauth/authorize`);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        code_challenge_method: "S256",
+        code_challenge: challenge,
+        state,
+        resource: audience,
+    }).toString();
+    return { url: url.href, redirectUri, codeVerifier, code, close };
+}
 export function pause(ms, signal) {
     throwIfInterrupted(signal);
     return new Promise((resolve, reject) => {

package/dist/main.d.ts

@@ -1,15 +1,2 @@
 #!/usr/bin/env node
-import { Profiles } from "./profiles.ts";
-import type { InvocationContext } from "./catalog.ts";
-import type { OutputOptions } from "./output.ts";
-import type { RpcOptions } from "./rpc.ts";
-export { parseGlobals } from "./argv.ts";
-export interface RunOptions extends OutputOptions {
-    profiles?: Profiles;
-    env?: NodeJS.ProcessEnv;
-    fetch?: InvocationContext["fetch"];
-    stdin?: RpcOptions["stdin"];
-    signal?: AbortSignal;
-}
-export declare function run(argv?: string[], runtime?: RunOptions): Promise<void>;
-export declare function execute(argv?: string[], runtime?: RunOptions): Promise<number>;
+export * from "./runner.ts";