ignitify 1.2.0 → 1.2.2

package/ignitify.cjs

@@ -942,10 +942,25 @@ function bareValueFlag(args, valueFlags2) {
 function needsValueMessage(flag) {
   return `--${flag} needs a value`;
 }
+function strOpt(args, key) {
+  let bare = bareValueFlag(args, [key]);
+  if (bare !== void 0) throw new Error(needsValueMessage(bare));
+  let v = args.options[key];
+  return typeof v == "string" ? v : void 0;
+}
+function flagParams(args, map2) {
+  return Object.fromEntries(Object.entries(map2).flatMap(([flag, param]) => {
+    let v = strOpt(args, flag);
+    return v === void 0 ? [] : [[param, v]];
+  }));
+}
 var init_args = __esm({ "../../packages/http-client/args.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
+function boolFlagSpec(flags) {
+  return { boolFlags: new Set(Object.keys(flags).filter((flag) => flags[flag] === "bool")) };
+}
 function unknownFlagText(flag, command) {
   return `unknown flag ${flag} for ${command}`;
 }
@@ -978,13 +993,49 @@ function shapeRefusal(command, args, flags, maxPositionals) {
 function isHelpRequest(args) {
   return HELP_TOKENS.includes(args.command) || args.options.help === true;
 }
-var didYouMean, itsFlags, flagTakesNoValue, tooManyArgs, HELP_TOKENS, init_invocation = __esm({ "../../packages/http-client/invocation.ts"() {
+var looksShort, didYouMean, itsFlags, flagTakesNoValue, tooManyArgs, HELP_TOKENS, init_invocation = __esm({ "../../packages/http-client/invocation.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_args();
+  looksShort = (tok) => tok.length > 1 && tok.startsWith("-") && !tok.startsWith("--");
   didYouMean = (flag) => `Did you mean --${flag}?`, itsFlags = (own, global) => `Its flags: ${own.length === 0 ? "(none)" : own.map((f) => `--${f}`).join(" ")}. Global: ${global.map((f) => `--${f}`).join(" ")}.`, flagTakesNoValue = (flag) => `--${flag} takes no value`, tooManyArgs = (command, max, extra, got) => `${command} takes ${max} argument${max === 1 ? "" : "s"}; got ${got} (${extra.map((e) => JSON.stringify(e)).join(", ")} ${extra.length === 1 ? "is" : "are"} extra)`;
   HELP_TOKENS = ["", "help", "--help", "-h"];
 } });
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function keyUrlRefusal(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return "not-url";
+  }
+  return u.protocol === "https:" || u.protocol === "http:" && isLoopbackHost(u.hostname) ? null : "insecure";
+}
+var init_key_url = __esm({ "../../packages/http-client/key-url.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function scale(n, units) {
+  let step = (v, i) => v >= 1024 && i < units.length - 1 ? step(v / 1024, i + 1) : i === 0 ? `${n} ${units[0]}` : `${v.toFixed(1)} ${units[i]}`;
+  return step(n, 0);
+}
+function duration(ms) {
+  if (ms < 1e3) return `${ms} ms`;
+  let s = Math.round(ms / 1e3);
+  if (s < 60) return `${s} s`;
+  let m = Math.floor(s / 60);
+  return m < 60 ? `${m}m ${s % 60}s` : `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+function formatUsageQuantity(n, unit) {
+  return unit === "bytes" ? scale(n, BYTE_UNITS) : unit === "ms" ? duration(n) : unit === "byte-hours" ? scale(n, BYTE_HOUR_UNITS) : `${n}`;
+}
+var BYTE_UNITS, BYTE_HOUR_UNITS, init_usage_format = __esm({ "../../packages/http-client/usage-format.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  BYTE_UNITS = ["B", "KiB", "MiB", "GiB", "TiB"], BYTE_HOUR_UNITS = ["B\xB7h", "KiB\xB7h", "MiB\xB7h", "GiB\xB7h", "TiB\xB7h", "PiB\xB7h"];
+} });
 function csvRow(values) {
   return values.map((v) => `"${v.replace(/"/g, '""')}"`).join(",");
 }
@@ -1027,6 +1078,16 @@ var PAGE_CURSOR_FLAG, PAGE_FLAG_PARAMS, init_page = __esm({ "../../packages/http
   init_define_IGNITIFY_CLIENT_FILES();
   PAGE_CURSOR_FLAG = "after-id", PAGE_FLAG_PARAMS = { limit: "limit", after: "after", "after-id": "after_id" };
 } });
+function httpErrorJson(e) {
+  if (!(e instanceof HttpError)) return null;
+  let body;
+  try {
+    body = JSON.parse(e.body);
+  } catch {
+    return null;
+  }
+  return typeof body != "object" || body === null || Array.isArray(body) ? null : { status: e.status, body };
+}
 async function parseJson(res) {
   let text = await res.text();
   if (!res.ok) throw new HttpError(res.status, text, res.statusText, res.headers.get(TRACE_HEADER));
@@ -1052,6 +1113,8 @@ var DEFAULT_REQUEST_TIMEOUT_MS, TRACE_HEADER, HttpError, init_http_client = __es
   init_define_IGNITIFY_CLIENT_FILES();
   init_args();
   init_invocation();
+  init_key_url();
+  init_usage_format();
   init_csv();
   init_page();
   DEFAULT_REQUEST_TIMEOUT_MS = 12e4, TRACE_HEADER = "x-correlation-id", HttpError = class extends Error {
@@ -1073,11 +1136,14 @@ function fill(pattern, ...params) {
   if (i !== params.length) throw new Error(`route ${pattern}: takes ${i} parameter(s), given ${params.length}`);
   return out2;
 }
-var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, CLI_VERSION_HEADER, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
+function isTerminalRunStatus(status) {
+  return TERMINAL_RUN_STATUSES.includes(status);
+}
+var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, CLI_VERSION_HEADER, TERMINAL_RUN_STATUSES, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   DOT_SEGMENTS = /* @__PURE__ */ new Set([".", ".."]);
-  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", RUN_LOGS: "/runs/:id/logs", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", CLI_VERSION_HEADER = "X-Ignitify-Cli";
+  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", RUN_LOGS: "/runs/:id/logs", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", CLI_VERSION_HEADER = "X-Ignitify-Cli", TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "CANCELLED"];
 } });
 var CALLBACK_PATH_PREFIX, init_callback_path = __esm({ "../../packages/contract/callback-path.ts"() {
   "use strict";
@@ -1097,14 +1163,49 @@ var TASK_CONFIG_FILENAMES, RUNTIME_REGISTRY, RUNTIME_IDS, LIVE_RUNTIME_IDS, isRu
   init_define_IGNITIFY_CLIENT_FILES();
   TASK_CONFIG_FILENAMES = ["task.yaml", "task.yml", "task.json"], RUNTIME_REGISTRY = Object.freeze({ node: Object.freeze({ entryFile: "index.ts", depManifest: "package.json", lockfile: "package-lock.json", wireRuntime: "node22", status: "live" }), python: Object.freeze({ entryFile: "main.py", depManifest: "requirements.txt", lockfile: "requirements.txt", wireRuntime: "python3.11", status: "live" }), go: Object.freeze({ entryFile: "main.go", depManifest: "go.mod", lockfile: "go.sum", wireRuntime: "go", status: "live" }), rust: Object.freeze({ entryFile: "src/main.rs", depManifest: "Cargo.toml", lockfile: "Cargo.lock", wireRuntime: "rust", status: "live" }) }), RUNTIME_IDS = Object.keys(RUNTIME_REGISTRY), LIVE_RUNTIME_IDS = RUNTIME_IDS.filter((id) => RUNTIME_REGISTRY[id].status === "live"), isRuntimeId = (v) => typeof v == "string" && Object.prototype.hasOwnProperty.call(RUNTIME_REGISTRY, v), TASK_CONFIG_AJV_OPTIONS = Object.freeze({ allErrors: true, strict: true, useDefaults: false }), TASK_CONFIG_SCHEMA = Object.freeze({ $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://ignitify.dev/schemas/task-config/v1.json", title: "Ignitify task configuration", type: "object", required: ["schema_version", "slug", "runtime"], additionalProperties: false, properties: { schema_version: { const: 1 }, slug: { type: "string", minLength: 1 }, runtime: { enum: [...RUNTIME_IDS] }, entry: { type: "string", minLength: 1 }, execution: { type: "object" }, secrets: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, run: { type: "object", additionalProperties: false, properties: { payload: { type: "object" }, preset: { type: "string", minLength: 1 }, timeout_sec: { type: "integer", exclusiveMinimum: 0 } } }, build: { type: "object", additionalProperties: false, properties: { allowed_hosts: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, ship: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, system_packages: { type: "array", items: { type: "string", minLength: 1 } } } } } }), BUILD_REFUSAL_STAGES = ["read", "fetch", "build", "smoke"], BUILD_STAGES = ["done", ...BUILD_REFUSAL_STAGES, "builder", "image", "cap"];
 } });
+function parseJsonText(text) {
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch {
+    return { ok: false };
+  }
+}
+var isRecord, init_wire_json = __esm({ "../../packages/contract/wire-json.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  isRecord = (v) => typeof v == "object" && v !== null && !Array.isArray(v);
+} });
+function errText(err2) {
+  if (err2 instanceof Error) return err2.message;
+  try {
+    return String(err2);
+  } catch {
+    return "unprintable error";
+  }
+}
+function errCode(err2) {
+  let code = isRecord(err2) ? err2.code : void 0;
+  return typeof code == "string" ? code : "error";
+}
+var isMissing, init_err_text = __esm({ "../../packages/contract/err-text.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_wire_json();
+  isMissing = (err2) => errCode(err2) === "ENOENT";
+} });
+var SHA256_HEX, SHA256_PREFIX, isSha256Hex, stripSha256Prefix, init_digest = __esm({ "../../packages/contract/digest.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  SHA256_HEX = /^[0-9a-f]{64}$/, SHA256_PREFIX = "sha256:", isSha256Hex = (v) => typeof v == "string" && SHA256_HEX.test(v), stripSha256Prefix = (s) => s.startsWith(SHA256_PREFIX) ? s.slice(SHA256_PREFIX.length) : s;
+} });
 function rootConfigName(paths) {
   return TASK_CONFIG_FILENAMES.find((n) => paths.includes(n)) ?? null;
 }
 function configKeyText(value) {
-  let top = value !== null && typeof value == "object" && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).filter(([k]) => !RUN_ONLY_CONFIG_KEYS.includes(k))) : value, parts = [], bytes2 = 0, over = () => {
+  let top = value !== null && typeof value == "object" && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).filter(([k]) => !RUN_ONLY_CONFIG_KEYS.includes(k))) : value, parts = [], bytes = 0, over = () => {
     throw new Error(`its build settings are over ${CONFIG_KEY_TEXT_MAX_BYTES / 1024} KiB as canonical JSON (a YAML alias is expanded each time it is used)`);
   }, emit2 = (s) => {
-    bytes2 += utf8Bytes(s), bytes2 > CONFIG_KEY_TEXT_MAX_BYTES && over(), parts.push(s);
+    bytes += utf8Bytes(s), bytes > CONFIG_KEY_TEXT_MAX_BYTES && over(), parts.push(s);
   }, walk = (v, depth) => {
     if (depth > CONFIG_KEY_MAX_DEPTH) throw new Error(`it is nested deeper than ${CONFIG_KEY_MAX_DEPTH} levels`);
     if (v === null || typeof v == "boolean") return emit2(String(v));
@@ -1150,39 +1251,39 @@ function privateKeyFileWarning(relPath) {
   let base = relPath.slice(relPath.lastIndexOf("/") + 1).toLowerCase();
   return base.endsWith(".pem") || base.endsWith(".key") || base.startsWith("id_rsa") && !base.endsWith(".pub") ? `${relPath} looks like a private key and is uploaded with the task, then stored in the image. If it is a secret, remove it (secrets go through \`secret:set\`); to keep a harmless file out, list it in \`.ignitifyignore\`` : null;
 }
-function sourceManifest(entries, config) {
+function checkSourceManifest(entries, config) {
   let expected = rootConfigName(entries.map((e) => e.path));
-  if ((config?.name ?? null) !== expected) throw new Error(`source manifest: the task config in the key must be ${expected ?? "none"}, not ${config?.name ?? "none"}`);
+  if ((config?.name ?? null) !== expected) return refused(`the task config in the key must be ${expected ?? "none"}, not ${config?.name ?? "none"}`);
   let configLine = [];
   if (config !== null) try {
     configLine = [`config	${config.name}	${configKeyText(config.value)}`];
   } catch (e) {
-    throw new Error(`source manifest: ${config.name}: ${e.message}`, { cause: e });
+    return refused(`${config.name}: ${errText(e)}`);
   }
   let seen = /* @__PURE__ */ new Set();
   for (let e of entries) {
-    if (typeof e.path != "string" || e.path === "") throw new Error("source manifest: empty path");
-    if (e.path.includes("\\")) throw new Error(`source manifest: path contains a backslash: ${JSON.stringify(e.path)}. Separators must be normalised to "/" before hashing, or the same tree hashes differently per platform.`);
-    if (e.path.startsWith("/")) throw new Error(`source manifest: absolute path: ${e.path}`);
-    if (!isCanonicalRelativePath(e.path)) throw new Error(`source manifest: non-canonical path: ${e.path}`);
-    if (e.path.includes(`
-`) || e.path.includes("	")) throw new Error(`source manifest: path contains a tab or newline: ${JSON.stringify(e.path)}`);
-    if (!Number.isSafeInteger(e.size) || e.size < 0) throw new Error(`source manifest: bad size for ${e.path}: ${String(e.size)}`);
-    if (!HEX64.test(e.sha256)) throw new Error(`source manifest: sha256 for ${e.path} must be 64 lowercase hex chars`);
-    if (seen.has(e.path)) throw new Error(`source manifest: duplicate path: ${e.path}`);
+    let bad = entryRefusal(e, seen);
+    if (bad !== null) return refused(bad);
     seen.add(e.path);
   }
   let lines = entries.filter((e) => e.path !== config?.name).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0).map((e) => `${e.exec ? "755" : "644"}	${e.size}	${e.sha256}	${e.path}`);
-  return [`ignitify-source/${SOURCE_MANIFEST_VERSION}`, ...configLine, ...lines, ""].join(`
-`);
+  return { ok: true, text: [`ignitify-source/${SOURCE_MANIFEST_VERSION}`, ...configLine, ...lines, ""].join(`
+`) };
 }
-var SOURCE_MANIFEST_VERSION, RUN_ONLY_CONFIG_KEYS, CONFIG_KEY_TEXT_MAX_BYTES, UPLOAD_MAX_BYTES, CONFIG_KEY_MAX_DEPTH, SOURCE_EXCLUDED_DIRS, SOURCE_EXCLUDED_ROOT_DIRS, SOURCE_EXCLUDED_FILE_PREFIXES, CREDENTIAL_KEYS, CREDENTIAL_CHECKED_FILES, HEX64, isCanonicalRelativePath, init_source_manifest = __esm({ "../../packages/contract/source-manifest.ts"() {
+function entryRefusal(e, seen) {
+  return typeof e.path != "string" || e.path === "" ? "empty path" : e.path.includes("\\") ? `path contains a backslash: ${JSON.stringify(e.path)}. Separators must be normalised to "/" before hashing, or the same tree hashes differently per platform.` : e.path.startsWith("/") ? `absolute path: ${e.path}` : isCanonicalRelativePath(e.path) ? e.path.includes(`
+`) || e.path.includes("	") ? `path contains a tab or newline: ${JSON.stringify(e.path)}` : !Number.isSafeInteger(e.size) || e.size < 0 ? `bad size for ${e.path}: ${String(e.size)}` : isSha256Hex(e.sha256) ? seen.has(e.path) ? `duplicate path: ${e.path}` : null : `sha256 for ${e.path} must be 64 lowercase hex chars` : `non-canonical path: ${e.path}`;
+}
+var SOURCE_MANIFEST_VERSION, RUN_ONLY_CONFIG_KEYS, CONFIG_KEY_TEXT_MAX_BYTES, UPLOAD_MAX_BYTES, CONFIG_KEY_MAX_DEPTH, SOURCE_EXCLUDED_DIRS, SOURCE_EXCLUDED_ROOT_DIRS, SOURCE_EXCLUDED_FILE_PREFIXES, CREDENTIAL_KEYS, CREDENTIAL_CHECKED_FILES, isCanonicalRelativePath, refused, init_source_manifest = __esm({ "../../packages/contract/source-manifest.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_task_config();
+  init_err_text();
+  init_digest();
   SOURCE_MANIFEST_VERSION = "v2", RUN_ONLY_CONFIG_KEYS = Object.freeze(["execution", "secrets", "run"]), CONFIG_KEY_TEXT_MAX_BYTES = 64 * 1024, UPLOAD_MAX_BYTES = 64 * 1024 * 1024, CONFIG_KEY_MAX_DEPTH = 64;
   SOURCE_EXCLUDED_DIRS = Object.freeze([".git", ".ignitify", "node_modules", "__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]), SOURCE_EXCLUDED_ROOT_DIRS = Object.freeze(["target", "dist"]), SOURCE_EXCLUDED_FILE_PREFIXES = Object.freeze([".env"]), CREDENTIAL_KEYS = Object.freeze({ ".npmrc": /^[ \t]*(?![#;])[^=\n]*_(?:authToken|auth|password)[ \t]*=[ \t]*(?!\$\{\w+\}[ \t]*$)\S/m, ".yarnrc.yml": /^[ \t]*npmAuth(?:Token|Ident)[ \t]*:[ \t]*(?!["']?\$\{\w+\}["']?[ \t]*$)\S/m }), CREDENTIAL_CHECKED_FILES = Object.freeze(Object.keys(CREDENTIAL_KEYS));
-  HEX64 = /^[0-9a-f]{64}$/, isCanonicalRelativePath = (p) => !p.startsWith("/") && !p.includes("\\") && p.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+  isCanonicalRelativePath = (p) => !p.startsWith("/") && !p.includes("\\") && p.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+  refused = (reason) => ({ ok: false, reason });
 } });
 function normaliseSystemPackages(declared) {
   return [...new Set(declared)].sort();
@@ -1206,6 +1307,23 @@ var USAGE_AXES, USAGE_DETAIL_COMMAND, RESETS_AT_NEXT_RENEWAL, init_usage = __esm
   init_define_IGNITIFY_CLIENT_FILES();
   USAGE_AXES = ["compute", "network", "network_in", "disk", "scratch", "runs", "pin", "build"], USAGE_DETAIL_COMMAND = "ignitify quota", RESETS_AT_NEXT_RENEWAL = "your next paid renewal";
 } });
+function formatUserCode(code) {
+  if (code.length !== 8) return code;
+  let half = 8 / 2;
+  return `${code.slice(0, half)}-${code.slice(half)}`;
+}
+var init_device_code = __esm({ "../../packages/contract/device-code.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function cappedExponentialMs(step, baseMs, maxMs) {
+  let n = Number.isNaN(step) ? 0 : Math.min(Math.max(0, Math.floor(step)), 32);
+  return Math.min(baseMs * 2 ** n, maxMs);
+}
+var init_backoff = __esm({ "../../packages/contract/backoff.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
 var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -1217,23 +1335,26 @@ var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   init_system_packages();
   init_package_advice();
   init_usage();
+  init_wire_json();
+  init_err_text();
+  init_digest();
+  init_device_code();
+  init_backoff();
 } });
 function valueFlags(map2) {
   return Object.fromEntries(Object.keys(map2).map((flag) => [flag, "value"]));
 }
-function isTerminalRunStatus(status) {
-  return TERMINAL_RUN_STATUSES.includes(status);
-}
-var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SERVER_FLAGS, HIDDEN_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, USAGE_FILTERS, COMMAND_META, VERSION_META, MESSAGES, RUN_STATUS, TERMINAL_RUN_STATUSES, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, init_constants = __esm({ "src/constants/index.ts"() {
+var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SERVER_FLAGS, HIDDEN_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, USAGE_FLAG_PARAMS, USAGE_FILTERS, COMMAND_META, VERSION_META, MESSAGES, RUN_STATUS, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, init_constants = __esm({ "src/constants/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
   init_tenant();
   init_tenant();
+  init_tenant();
   COMMANDS = { HELP: "help", LOGIN: "login", LOGOUT: "logout", WHOAMI: "whoami", QUOTA: "quota", TASK_CREATE: "task:create", TASK_LIST: "task:list", TASK_GET: "task:get", TASK_DELETE: "task:delete", TASK_VALIDATE: "task:validate", TASK_PACK: "task:pack", TASK_DEPLOY: "task:deploy", TASK_RUN: "task:run", DEPLOYMENT_LIST: "deployment:list", DEPLOYMENT_GET: "deployment:get", DEPLOYMENT_LOGS: "deployment:logs", DEPLOYMENT_DELETE: "deployment:delete", RUN_LIST: "run:list", RUN_GET: "run:get", RUN_LOGS: "run:logs", RUN_DELETE: "run:delete", RUN_CANCEL: "run:cancel", VM_LIST: "vm:list", VM_GET: "vm:get", VM_DELETE: "vm:delete", SECRET_SET: "secret:set", SECRET_LIST: "secret:list", SECRET_DELETE: "secret:delete", SCHEDULE_LIST: "schedule:list", SCHEDULE_CANCEL: "schedule:cancel", HOOK_CREATE: "hook:create", HOOK_LIST: "hook:list", HOOK_DELETE: "hook:delete", NOTIFY_SET: "notify:set", INTEGRATION_ADD: "integration:add", USAGE: "usage", USAGE_EXPORT: "usage:export" }, IGNORE_FILE = ".ignitifyignore", STATE = { DIR: ".ignitify", FILE: "state.json", GITIGNORE_FILE: ".gitignore", GITIGNORE_TEXT: `# written by ignitify: local state, never commit
 *
 ` }, CREDENTIALS = { DIR_NAME: "ignitify", FILE_NAME: "credentials.json", DIR_MODE: 448, FILE_MODE: 384 }, LOGIN = { MAX_RETRIES: 3, KEY_TTL_DAYS: 90, MIN_POLL_INTERVAL_SEC: 5, BROWSER_SCHEMES: ["https:", "http:"] }, LOGIN_VIEW = { TITLE: "Sign in to Ignitify", OPEN_PAGE: "Open this page:", ASK_OPERATOR: "Give this code to your operator, who approves it:", CHECK_CODE: "Check this code", SAME_CODE: "The page must show the same code.", WAITING_STATIC: (minutes) => `Waiting for approval. The code expires in ${minutes} minutes.`, WAITING_LIVE: (left) => `Waiting for approval... code expires in ${left}`, CANCELLED: "Sign-in cancelled. Nothing was saved.", SIGNED_IN: "Signed in", SIGNED_OUT: "Signed out", KEY_EXPIRES: (days) => `${days} days after last use; each use renews it`, YES: "yes", ROWS: { ACCOUNT: "Account", ACCOUNT_ID: "Account id", KEY_LABEL: "Key label", KEY_EXPIRES: "Key expires", SAVED_TO: "Saved to", REVOKED: "Revoked", DELETED: "Deleted" } }, NETWORK = { REASONS: { ECONNREFUSED: "nothing accepts connections there", ENOTFOUND: "the host name is unknown", EAI_AGAIN: "the host name lookup failed", ETIMEDOUT: "the connection timed out", UND_ERR_CONNECT_TIMEOUT: "the connection timed out", ECONNRESET: "the connection was reset" }, TLS_WORDS: "the TLS certificate was not accepted", TLS_CODES: ["CERT_HAS_EXPIRED", "CERT_NOT_YET_VALID", "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN", "UNABLE_TO_VERIFY_LEAF_SIGNATURE", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"], TLS_CODE_PREFIXES: ["ERR_TLS_", "ERR_SSL_"], CODE_PATTERN: /^[A-Z][A-Z0-9_]*$/, DETAIL_MAX_CHARS: 80 }, ENV = { TASKS_DIR: "IGNITIFY_TASKS_DIR", KEY: "IGNITIFY_API_KEY" }, DEFAULT_TASKS_DIR = "tasks", DEFAULTS = { API_URL: "https://api.ignitify.dev" }, UPGRADE_COMMAND = "npm install --global ignitify@latest", PAYLOAD_LIMIT_FALLBACK_BYTES = 10240, RESULT_LIMIT_FALLBACK_BYTES = 10240, RUN_LIST_FLAG_PARAMS = { status: "status", "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "correlation-id": "correlation_id", "vm-id": "vm_id", ...PAGE_FLAG_PARAMS }, VM_LIST_FLAG_PARAMS = { "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "older-than": "older_than", ...PAGE_FLAG_PARAMS }, GLOBAL_FLAGS = { json: "bool", help: "bool" }, SERVER_FLAGS = { api: "value" }, HIDDEN_FLAGS = ["api"], SHORT_FLAGS = { h: "help", y: "yes" }, VERSION_TOKENS = ["--version", "-v"];
-  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, USAGE_FILTERS = { period: "value", axis: "value", vm: "value", run: "value" }, COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { ...SERVER_FLAGS, "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...SERVER_FLAGS, ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: { ...SERVER_FLAGS, ...DIR }, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...SERVER_FLAGS, ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...SERVER_FLAGS, ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...SERVER_FLAGS, ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", wait: "bool", ...DIR, ...SERVER_FLAGS }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(RUN_LIST_FLAG_PARAMS) }, positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { ...SERVER_FLAGS, full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { ...SERVER_FLAGS, stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { ...SERVER_FLAGS, "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { ...SERVER_FLAGS, url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false } }, VERSION_META = { flags: SERVER_FLAGS, positionals: 0, confirms: false }, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login --api ${url}'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes2, limit) => `payload is ${bytes2} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes2, limit) => `${source}: run.payload is ${bytes2} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
+  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, USAGE_FLAG_PARAMS = { period: "period", axis: "axis", vm: "vm", run: "run" }, USAGE_FILTERS = valueFlags(USAGE_FLAG_PARAMS), COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { ...SERVER_FLAGS, "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...SERVER_FLAGS, ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: { ...SERVER_FLAGS, ...DIR }, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...SERVER_FLAGS, ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...SERVER_FLAGS, ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...SERVER_FLAGS, ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", wait: "bool", ...DIR, ...SERVER_FLAGS }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(RUN_LIST_FLAG_PARAMS) }, positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { ...SERVER_FLAGS, full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { ...SERVER_FLAGS, stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { ...SERVER_FLAGS, "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { ...SERVER_FLAGS, url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false } }, VERSION_META = { flags: SERVER_FLAGS, positionals: 0, confirms: false }, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login --api ${url}'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes, limit) => `payload is ${bytes} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes, limit) => `${source}: run.payload is ${bytes} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
   ignitify secret:set <NAME> --stdin < value-file
   printf %s "$VALUE" | ignitify secret:set <NAME> --stdin
 \u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.`, NOTIFY_SECRET_ON_ARGV: '--secret is not accepted: a value on argv is visible in `ps` and is written to your shell history. Use --secret-stdin, e.g.\n  printf %s "$SECRET" | ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin\n\u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.', HOOK_CREATE_USAGE: "usage: ignitify hook:create <deployment-id> --task-name <name>", HOOK_TASK_NAME_REQUIRED: `--task-name <name> is required: a hook starts a run of ONE task in the deployment, and a run without a task name fails.
@@ -1241,15 +1362,14 @@ usage: ignitify hook:create <deployment-id> --task-name <name>`, HOOK_LIST_USAGE
        ignitify notify:set <deployment-id> --clear
   --secret-stdin reads the signing secret (at least ${32} characters) from stdin; it is
   required with --url. There is no --secret flag: a value on argv is visible in \`ps\`
-  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed` }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, TERMINAL_RUN_STATUSES = [RUN_STATUS.COMPLETED, RUN_STATUS.FAILED, RUN_STATUS.CANCELLED];
-  ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
+  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed` }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
 Check it with: ignitify deployment:get ${deploymentId}`, INTERRUPTED_RUN: (runId) => `Stopped waiting. The run keeps going on the server \u2014 nothing was cancelled.
 Check it with: ignitify run:get ${runId}` };
 } });
 var ANSI, GLYPHS, LAYOUT, LABELS, EMPTY_LISTS, DISPLAY_CAPS, TITLES, PER_BRAIN_MARKER, PER_BRAIN_FOOTNOTE, POLICY_UNIT_NOTES, HIDDEN_FIELDS, RESULT_MESSAGES, RUN_CANCEL_OUTCOME, init_constants2 = __esm({ "src/output/constants.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
+  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, SCHEDULE_CANCEL_PREVIEW: (id) => `Will cancel schedule ${id} \u2014 it will never fire.`, SCHEDULE_NOT_CANCELLED: (id) => `Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`, HOOK_DELETE_PREVIEW: (id) => `Will delete webhook ${id}. A sender that posts to it is refused from then on.`, SECRET_DELETE_PREVIEW: (name) => `Will delete secret ${name}. Its value cannot be read back.`, DEPLOYMENT_DELETE_PREVIEW: (id) => `Will soft-delete deployment ${id} and all its runs (cascade).`, RUN_DELETE_PREVIEW: (id) => `Will soft-delete run ${id}.`, RUN_ALREADY_OVER: (id, status) => `Run ${id} is already ${status} \u2014 nothing to cancel.`, RUN_CANCEL_PREVIEW: (id, force) => force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`, RUN_STOPPING: (id, grace, was) => `Run ${id} is stopping${grace}${was} \u2014 still RUNNING until it finishes or the grace expires.`, RUN_CANCELLED: (id, was) => `Run cancelled: ${id}${was}`, LOG_TRUNCATED: (lines) => `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`, NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
 } });
 function makeStyle(o) {
   let p = (...codes) => paint(o.colour, ...codes), columns = Math.max(o.width, 1);
@@ -1509,7 +1629,7 @@ var init_execution = __esm({ "../../packages/execution/index.ts"() {
   init_egress_match();
   init_ingress_hostname();
 } });
-var sectionHeader, layout, filterScalars, filterDisplayKeys, BYTE_UNITS, formatBytes, quotaLine, storeLine, renderWhoami, hasUnits, renderUnitWeights, showEnforced, renderEnforcedBlock, renderPolicyValue, renderPolicyBlock, renderUsageBlocks, renderUsage, renderTaskCreate, renderPack, renderDeploy, renderRunSubmit, renderRunNotices, renderCapacity, capacityBlock, renderRunGet, renderList, imageSize, renderDeploymentList, packagesLine, renderDeploymentGet, formatDuration, renderVmList, pinLines, renderVmRows, renderVmGet, nextStepBanner, init_formatters = __esm({ "src/output/formatters.ts"() {
+var sectionHeader, layout, filterScalars, filterDisplayKeys, BYTE_UNITS2, formatBytes, quotaLine, storeLine, renderWhoami, hasUnits, renderUnitWeights, showEnforced, renderEnforcedBlock, renderPolicyValue, renderPolicyBlock, renderUsageBlocks, renderUsage, renderTaskCreate, renderPack, renderDeploy, renderRunSubmit, renderRunNotices, isStorageClamped, renderCapacity, capacityBlock, renderRunGet, renderList, imageSize, renderDeploymentList, packagesLine, renderDeploymentGet, formatDuration, renderVmList, pinLines, renderVmRows, renderVmGet, nextStepBanner, init_formatters = __esm({ "src/output/formatters.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants();
@@ -1523,17 +1643,13 @@ var sectionHeader, layout, filterScalars, filterDisplayKeys, BYTE_UNITS, formatB
 ${heading(st, title, success)}
 `, layout = (header, content, footer = "") => `${header}${content}${footer ? `
 ` + footer : `
-`}`, filterScalars = (data) => {
-    let filtered = {};
-    for (let [k, v] of Object.entries(data)) typeof v != "object" && !HIDDEN_FIELDS.SCALAR.includes(k) && (filtered[k] = v);
-    return filtered;
-  }, filterDisplayKeys = (data) => {
+`}`, filterScalars = (data) => Object.fromEntries(Object.entries(data).filter(([k, v]) => typeof v != "object" && !HIDDEN_FIELDS.SCALAR.includes(k))), filterDisplayKeys = (data) => {
     let { slug: _slug, ...rest } = data;
     return rest;
-  }, BYTE_UNITS = ["B", "KiB", "MiB", "GiB", "TiB"], formatBytes = (bytes2) => {
-    if (!Number.isFinite(bytes2) || bytes2 <= 0) return "0 B";
-    let exp = Math.min(Math.floor(Math.log2(bytes2) / 10), BYTE_UNITS.length - 1), value = bytes2 / 2 ** (10 * exp);
-    return `${exp === 0 ? value : value.toFixed(1)} ${BYTE_UNITS[exp]}`;
+  }, BYTE_UNITS2 = ["B", "KiB", "MiB", "GiB", "TiB"], formatBytes = (bytes) => {
+    if (!Number.isFinite(bytes) || bytes <= 0) return "0 B";
+    let exp = Math.min(Math.floor(Math.log2(bytes) / 10), BYTE_UNITS2.length - 1), value = bytes / 2 ** (10 * exp);
+    return `${exp === 0 ? value : value.toFixed(1)} ${BYTE_UNITS2[exp]}`;
   }, quotaLine = (used, max) => `${used} / ${max ?? "unlimited"}`, storeLine = (used, max) => max === void 0 ? formatBytes(used) : `${formatBytes(used)} / ${max === null ? "unlimited" : formatBytes(max)}`, renderWhoami = (data, st = PLAIN) => {
     if (!data) return "";
     let { limits, usage, tier, policy, bound_by, status_reason, policy_scope, enforced, unit_weights, capacity, ...identity } = data, identityRows = { ...identity };
@@ -1541,20 +1657,16 @@ ${heading(st, title, success)}
     let out2 = layout(sectionHeader(st, TITLES.TENANT_PROFILE), renderFields(st, filterDisplayKeys(identityRows)));
     return (limits || usage) && (out2 += renderUsageBlocks(st, limits, usage)), out2 += capacityBlock(st, capacity), hasUnits(limits) && unit_weights && (out2 += renderUnitWeights(st, unit_weights)), policy && (out2 += renderPolicyBlock(st, policy, policy_scope?.per_brain ?? [])), enforced && enforced.length > 0 && (out2 += renderEnforcedBlock(st, enforced)), out2;
   }, hasUnits = (limits) => typeof limits?.max_units == "number", renderUnitWeights = (st, weights) => layout(sectionHeader(st, TITLES.UNIT_WEIGHTS), renderFields(st, Object.fromEntries(Object.entries(weights).map(([p, w]) => [p, String(w)])))), showEnforced = (v) => v === null ? "\u2014" : String(v), renderEnforcedBlock = (st, rows) => {
-    let out2 = {};
-    for (let r of rows) {
+    let enforcedText = (r) => {
       let value = showEnforced(r.enforced);
-      out2[r.column] = r.winner === "host-clamp" ? `${value}  (platform cap; tier asked ${showEnforced(r.tier)})` : r.winner === "host-default" ? `${value}  (platform default)` : value;
-    }
+      return r.winner === "host-clamp" ? `${value}  (platform cap; tier asked ${showEnforced(r.tier)})` : r.winner === "host-default" ? `${value}  (platform default)` : value;
+    }, out2 = Object.fromEntries(rows.map((r) => [r.column, enforcedText(r)]));
     return layout(sectionHeader(st, TITLES.ENFORCED), renderFields(st, out2));
   }, renderPolicyValue = (key, v) => key === "allowed_presets" ? Array.isArray(v) ? v.join(", ") : "all" : v == null ? "unlimited" : typeof v == "boolean" ? v ? "yes" : "no" : String(v), renderPolicyBlock = (st, policy, perBrain = []) => {
-    let scoped = new Set(perBrain), rows = {};
-    for (let [k, v] of Object.entries(policy)) {
-      if (k === "tier_id" || k === "tier_name" || k === "tier_version") continue;
+    let scoped = new Set(perBrain), policyText = (k, v) => {
       let value = POLICY_UNIT_NOTES[k] ? `${renderPolicyValue(k, v)}  ${POLICY_UNIT_NOTES[k]}` : renderPolicyValue(k, v);
-      rows[k] = scoped.has(k) ? `${value}  ${PER_BRAIN_MARKER}` : value;
-    }
-    let block = layout(sectionHeader(st, TITLES.ENTITLEMENTS), renderFields(st, rows));
+      return scoped.has(k) ? `${value}  ${PER_BRAIN_MARKER}` : value;
+    }, rows = Object.fromEntries(Object.entries(policy).filter(([k]) => k !== "tier_id" && k !== "tier_name" && k !== "tier_version").map(([k, v]) => [k, policyText(k, v)])), block = layout(sectionHeader(st, TITLES.ENTITLEMENTS), renderFields(st, rows));
     return scoped.size === 0 ? block : `${block}
 ${st.dim(PER_BRAIN_FOOTNOTE)}
 `;
@@ -1581,12 +1693,13 @@ ${bullets(st, [LABELS.PLATFORM_BUILT_IMAGE])}
     return layout(sectionHeader(st, TITLES.RUN_SUBMITTED, true), renderFields(st, filterDisplayKeys(rest))) + (noticeText ? `
 ${st.yellow(noticeText)}
 ` : "") + capacityBlock(st, capacity);
-  }, renderRunNotices = (notices) => Array.isArray(notices) ? notices.map((n) => n.code === "storage-clamped" ? STORAGE_MESSAGES.clamped(n.requested, n.preset, n.effective) : "").filter((line) => line !== "").join(`
-`) : "", renderCapacity = (capacity, st = PLAIN) => {
-    let c = capacity;
-    if (!c || !Array.isArray(c.limits) || c.limits.length === 0) return "";
-    let lines = c.limits.map((l) => `Monthly ${l.text}`), since = typeof c.period_start == "string" ? `Since ${c.period_start} \xB7 ` : "";
-    return lines.push(st.dim(`${since}Resets ${c.resets_at ?? `at ${RESETS_AT_NEXT_RENEWAL}`} \xB7 details: ${c.usage_command ?? USAGE_DETAIL_COMMAND}`)), lines.join(`
+  }, renderRunNotices = (notices) => Array.isArray(notices) ? notices.filter(isStorageClamped).map((n) => STORAGE_MESSAGES.clamped(n.requested, n.preset, n.effective)).join(`
+`) : "", isStorageClamped = (n) => isRecord(n) && n.code === "storage-clamped" && typeof n.preset == "string" && typeof n.requested == "number" && typeof n.effective == "number", renderCapacity = (capacity, st = PLAIN) => {
+    if (!isRecord(capacity) || !Array.isArray(capacity.limits)) return "";
+    let texts = capacity.limits.flatMap((l) => isRecord(l) && typeof l.text == "string" ? [l.text] : []);
+    if (texts.length === 0) return "";
+    let { period_start: periodStart, resets_at: resetsAt, usage_command: usageCommand } = capacity, since = typeof periodStart == "string" ? `Since ${periodStart} \xB7 ` : "", resets = typeof resetsAt == "string" ? resetsAt : `at ${RESETS_AT_NEXT_RENEWAL}`, details = typeof usageCommand == "string" ? usageCommand : USAGE_DETAIL_COMMAND;
+    return [...texts.map((t) => `Monthly ${t}`), st.dim(`${since}Resets ${resets} \xB7 details: ${details}`)].join(`
 `);
   }, capacityBlock = (st, capacity) => {
     let text = renderCapacity(capacity, st);
@@ -1608,7 +1721,7 @@ ${emptyState(st, empty.message, empty.next)}
     return `
 ${renderTable(st, columns, rows)}
 `;
-  }, imageSize = (bytes2, present) => present === false ? "(missing)" : bytes2 === null ? "unknown" : formatBytes(Number(bytes2)), renderDeploymentList = (data, st = PLAIN) => {
+  }, imageSize = (bytes, present) => present === false ? "(missing)" : bytes === null ? "unknown" : formatBytes(Number(bytes)), renderDeploymentList = (data, st = PLAIN) => {
     let rows = data.deployments ?? [], total = data.tenant_total_bytes, limit = data.tenant_limit_bytes, display = rows.map(({ image_bytes, image_present, ...rest }) => ({ ...rest, ...image_bytes !== void 0 ? { size: imageSize(image_bytes, image_present) } : {} })), out2 = renderList(display, st, EMPTY_LISTS.DEPLOYMENTS);
     if (total !== void 0 && rows.length > 0) {
       let of = typeof limit == "number" ? ` of ${formatBytes(limit)}` : "";
@@ -1617,10 +1730,10 @@ ${renderTable(st, columns, rows)}
     }
     return out2;
   }, packagesLine = (v) => {
-    if (typeof v != "object" || v === null) return;
+    if (!isRecord(v)) return;
     let { names, drive } = v;
     if (!Array.isArray(names) || names.length === 0) return;
-    let d = drive, size = d != null && typeof d.bytes == "number" ? `drive ${formatBytes(d.bytes)} (snapshot ${String(d.snapshot)})` : "drive not built yet";
+    let size = isRecord(drive) && typeof drive.bytes == "number" ? `drive ${formatBytes(drive.bytes)} (snapshot ${String(drive.snapshot)})` : "drive not built yet";
     return `${names.join(", ")} \xB7 ${size}`;
   }, renderDeploymentGet = (data, st = PLAIN) => {
     if (!data) return "";
@@ -1647,10 +1760,11 @@ ${st.dim("Command template for next step:")} ${st.bold(LABELS.NEXT_STEP)} ${temp
 ${st.dim("Full command:")}                 ${st.cyan(actual)}
 `;
 } });
-var str, slug, WORKFLOW, isRecord, resolveNextStep, init_next_step = __esm({ "src/output/next-step.ts"() {
+var str, slug, WORKFLOW, resolveNextStep, init_next_step = __esm({ "src/output/next-step.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  str = (v) => typeof v == "string" && v !== "" ? v : void 0, slug = (data) => str(data.slug) ?? str(data.task_id) ?? "<task_id>", WORKFLOW = { "task:create": { template: "ignitify task:deploy <task_id>", resolve: (d) => `ignitify task:deploy ${slug(d)}` }, "task:pack": { template: "ignitify task:deploy <task_id>", resolve: (d) => `ignitify task:deploy ${slug(d)}` }, "task:deploy": { template: "ignitify task:run <task_id>", resolve: (d) => `ignitify task:run ${slug(d)}` }, "task:run": { template: "ignitify run:get <run_id>", resolve: (d) => `ignitify run:get ${str(d.resource_id) ?? str(d.run_id) ?? "<run_id>"}` } }, isRecord = (v) => typeof v == "object" && v !== null && !Array.isArray(v), resolveNextStep = (command, data) => {
+  init_tenant();
+  str = (v) => typeof v == "string" && v !== "" ? v : void 0, slug = (data) => str(data.slug) ?? str(data.task_id) ?? "<task_id>", WORKFLOW = { "task:create": { template: "ignitify task:deploy <task_id>", resolve: (d) => `ignitify task:deploy ${slug(d)}` }, "task:pack": { template: "ignitify task:deploy <task_id>", resolve: (d) => `ignitify task:deploy ${slug(d)}` }, "task:deploy": { template: "ignitify task:run <task_id>", resolve: (d) => `ignitify task:run ${slug(d)}` }, "task:run": { template: "ignitify run:get <run_id>", resolve: (d) => `ignitify run:get ${str(d.resource_id) ?? str(d.run_id) ?? "<run_id>"}` } }, resolveNextStep = (command, data) => {
     let step = WORKFLOW[command];
     return step ? { template: step.template, actual: step.resolve(isRecord(data) ? data : {}) } : null;
   };
@@ -1696,8 +1810,8 @@ var RENDERERS, jsonMode, sayStream, outStyle, errStyle, writeRaw, out, sayOk, wa
   RENDERERS = { whoami: renderWhoami, quota: renderUsage, "task:create": renderTaskCreate, "task:pack": renderPack, "task:deploy": renderDeploy, "task:run": renderRunSubmit, "run:get": renderRunGet, "task:list": (d, st) => renderList(d, st, EMPTY_LISTS.TASKS), "deployment:list": renderDeploymentList, "deployment:get": renderDeploymentGet, "run:list": (d, st) => renderList(d, st, EMPTY_LISTS.RUNS), "vm:list": renderVmList, "vm:get": renderVmGet, "schedule:list": (d, st) => renderList(d, st, EMPTY_LISTS.SCHEDULES) }, jsonMode = false;
   sayStream = () => jsonMode ? process.stderr : process.stdout;
   outStyle = () => streamStyle(process.stdout), errStyle = () => streamStyle(process.stderr);
-  writeRaw = (bytes2) => {
-    process.stdout.write(bytes2);
+  writeRaw = (bytes) => {
+    process.stdout.write(bytes);
   }, out = (text) => console.log(text), sayOk = (text) => say(successLine(screenStyle(), text));
   warn = (text) => console.error(noteLine(errStyle(), text)), tell = (text) => console.error(text), printWarnings = (ws) => ws.forEach((w) => console.error(warnMark(errStyle(), w))), printErrors = (es) => es.forEach((e) => console.error(errorMark(errStyle(), e)));
   CliOutputManager = { render(command, data) {
@@ -1936,66 +2050,38 @@ var FATE_TEXT, printDeletionPlan, init_deletion_plan = __esm({ "src/output/delet
   FATE_TEXT = { "cancelled-via-vm-teardown": "its VM is destroyed and the run is recorded as CANCELLED", "deleted-while-pending": "never dispatched \u2014 deleted before it could start", "unknown-status": "unrecognised status; this CLI cannot say what happens to it" };
   printDeletionPlan = (plan) => say(renderDeletionPlan(screenStyle(), plan));
 } });
-function explainRunRefusal(message) {
-  let body = apiErrorBody(message)?.body, pinned = body?.reason === "bidirectional-busy" ? body.pinned === true : message.includes("bidirectional deployment runs one VM at a time") ? message.includes("PINNED") : null;
+function explainRunRefusal(e) {
+  let body = httpErrorJson(e)?.body, message = errText(e), pinned = body?.reason === "bidirectional-busy" ? body.pinned === true : message.includes("bidirectional deployment runs one VM at a time") ? message.includes("PINNED") : null;
   if (pinned === null) return null;
   let lines = ["\u2717 Run refused \u2014 this bidirectional deployment already has a live VM.", "", "  Concurrent VMs for bidirectional-network tasks are not supported", "  (one VM at a time)."];
   if (pinned) {
-    let vmId = typeof body?.vm_id == "string" && body.vm_id !== "" ? body.vm_id : "<vm-id>";
+    let vmField = body?.vm_id, vmId = typeof vmField == "string" && vmField !== "" ? vmField : "<vm-id>";
     lines.push("", "  Why it was not queued, even if you asked for --on-busy=queue:", "    A PINNED VM has no idle timeout \u2014 it stays up until it is explicitly", "    removed, so queueing behind it could wait forever.", "", "  What you can do now:", "    \u2022 Reuse the pinned VM \u2014 submit the run against it instead", '    \u2022 Use network.type "egress" if this task needs no inbound traffic', `    \u2022 Remove it yourself: ignitify vm:delete ${vmId} --force`);
   } else lines.push("", "  Retry when the live VM finishes, or omit --on-busy=reject to queue instead.");
   return lines.join(`
 `);
 }
-function explainLimitRefusal(message) {
-  let refused = apiErrorBody(message);
-  if (!refused || refused.status !== 429) return null;
-  let body = refused.body;
-  return typeof body.summary != "string" || body.summary === "" ? null : [`\u2717 Run refused \u2014 a monthly limit is reached (${body.reason ?? "429"}).`, `  ${body.summary}`].join(`
+function explainLimitRefusal(e) {
+  let refused2 = httpErrorJson(e);
+  if (!refused2 || refused2.status !== 429) return null;
+  let { summary, reason } = refused2.body;
+  return typeof summary != "string" || summary === "" ? null : [`\u2717 Run refused \u2014 a monthly limit is reached (${typeof reason == "string" ? reason : "429"}).`, `  ${summary}`].join(`
 `);
 }
-function apiErrorBody(message) {
-  let m = /^API (\d{3}): (\{[\s\S]*\})$/.exec(message.trim());
-  if (!m) return null;
-  try {
-    let body = JSON.parse(m[2]);
-    return typeof body != "object" || body === null || Array.isArray(body) ? null : { status: Number(m[1]), body };
-  } catch {
-    return null;
-  }
-}
 var isPayloadTooLarge, init_run_refusal = __esm({ "src/output/run-refusal.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  isPayloadTooLarge = (message) => apiErrorBody(message)?.status === 413;
+  init_http_client();
+  init_tenant();
+  isPayloadTooLarge = (e) => e instanceof HttpError && e.status === 413;
 } });
-function quantity(n, unit) {
-  return unit === "bytes" ? bytes(n) : unit === "ms" ? duration(n) : unit === "byte-hours" ? byteHours(n) : `${n}`;
-}
-function byteHours(n) {
-  let u = ["B\xB7h", "KiB\xB7h", "MiB\xB7h", "GiB\xB7h", "TiB\xB7h", "PiB\xB7h"], i = 0, v = n;
-  for (; v >= 1024 && i < u.length - 1; ) v /= 1024, i += 1;
-  return i === 0 ? `${n} B\xB7h` : `${v.toFixed(1)} ${u[i]}`;
-}
-function bytes(n) {
-  let u = ["B", "KB", "MB", "GB", "TB"], i = 0, v = n;
-  for (; v >= 1024 && i < u.length - 1; ) v /= 1024, i += 1;
-  return i === 0 ? `${n} B` : `${v.toFixed(1)} ${u[i]}`;
-}
-function duration(ms) {
-  if (ms < 1e3) return `${ms} ms`;
-  let s = Math.round(ms / 1e3);
-  if (s < 60) return `${s} s`;
-  let m = Math.floor(s / 60);
-  return m < 60 ? `${m}m ${s % 60}s` : `${Math.floor(m / 60)}h ${m % 60}m`;
-}
 function renderUsageReport(st, r, opts = { lines: false }) {
   let I2 = LAYOUT.INDENT, out2 = [`${heading(st, `usage for ${r.period}`)}${r.filtered ? st.dim("  (filtered)") : ""}`, ""];
-  return out2.push(renderTable(st, [{ header: "AXIS", keep: true }, { header: "QUANTITY", keep: true }, { header: "LINES", keep: true }, { header: "RECONCILIATION" }], r.totals.map((t) => [t.axis, quantity(t.quantity, t.unit), t.lines, reconcileNote(t)]), { indent: I2 })), r.totals.some((t) => t.axis === "disk" || t.axis === "scratch") && (out2.push("", st.dim(`${I2}note: \`disk\` = your build images \xD7 the hours each was held this month (still-held images included);`)), out2.push(st.dim(`${I2}      \`scratch\` = each VM's scratch drive \xD7 the hours the VM ran. 1 GiB\xB7h = 1 GiB for one hour.`))), r.totals.some((t) => t.axis === "compute") && out2.push("", st.dim(`${I2}note: \`compute\` = VM time (boot to teardown). Your monthly compute limit counts run seconds instead.`)), out2.push("", `${I2}runs started ${r.counters.runs_started}   deployments created ${r.counters.deployments_created}   API requests ${r.counters.api_requests_approx} (approx)`), opts.lines && out2.push("", renderTable(st, [{ header: "AXIS", keep: true }, { header: "QUANTITY", keep: true }, { header: "VM / RUN", keep: true }, { header: "DETAIL" }], r.lines.map((l) => [l.axis, quantity(l.quantity, l.unit), l.run_id ?? l.vm_id ?? l.deployment_id ?? st.glyphs.dash, l.detail ?? ""]), { indent: I2 })), out2.join(`
+  return out2.push(renderTable(st, [{ header: "AXIS", keep: true }, { header: "QUANTITY", keep: true }, { header: "LINES", keep: true }, { header: "RECONCILIATION" }], r.totals.map((t) => [t.axis, formatUsageQuantity(t.quantity, t.unit), t.lines, reconcileNote(t)]), { indent: I2 })), r.totals.some((t) => t.axis === "disk" || t.axis === "scratch") && (out2.push("", st.dim(`${I2}note: \`disk\` = your build images \xD7 the hours each was held this month (still-held images included);`)), out2.push(st.dim(`${I2}      \`scratch\` = each VM's scratch drive \xD7 the hours the VM ran. 1 GiB\xB7h = 1 GiB for one hour.`))), r.totals.some((t) => t.axis === "compute") && out2.push("", st.dim(`${I2}note: \`compute\` = VM time (boot to teardown). Your monthly compute limit counts run seconds instead.`)), out2.push("", `${I2}runs started ${r.counters.runs_started}   deployments created ${r.counters.deployments_created}   API requests ${r.counters.api_requests_approx} (approx)`), opts.lines && out2.push("", renderTable(st, [{ header: "AXIS", keep: true }, { header: "QUANTITY", keep: true }, { header: "VM / RUN", keep: true }, { header: "DETAIL" }], r.lines.map((l) => [l.axis, formatUsageQuantity(l.quantity, l.unit), l.run_id ?? l.vm_id ?? l.deployment_id ?? st.glyphs.dash, l.detail ?? ""]), { indent: I2 })), out2.join(`
 `);
 }
 function reconcileNote(t) {
-  return !t.reconcilable || t.counter === null || t.drift === null ? t.reconciliation === "none" ? "\u2014" : "not checked (filtered)" : t.drift === 0 ? "agrees with the meter" : t.reconciliation === "inequality" && t.drift > 0 ? `${t.drift} still in flight` : `meter differs by ${quantity(Math.abs(t.drift), t.unit)}`;
+  return !t.reconcilable || t.counter === null || t.drift === null ? t.reconciliation === "none" ? "\u2014" : "not checked (filtered)" : t.drift === 0 ? "agrees with the meter" : t.reconciliation === "inequality" && t.drift > 0 ? `${t.drift} still in flight` : `meter differs by ${formatUsageQuantity(Math.abs(t.drift), t.unit)}`;
 }
 function toCsv(r) {
   let head = "axis,vm_id,run_id,deployment_id,window_start,window_end,quantity,unit,detail", rows = r.lines.map((l) => csvRow([l.axis, l.vm_id ?? "", l.run_id ?? "", l.deployment_id ?? "", l.window_start ?? "", l.window_end ?? "", String(l.quantity), l.unit, l.detail ?? ""]));
@@ -2034,50 +2120,27 @@ function planAdvice(config) {
   let checked = checkSystemPackages(declared);
   return checked.ok ? { kind: "call", request: { names: checked.names, runtime: config.runtime } } : { kind: "skip", reason: checked.reason === "bad-names" ? ADVICE.BAD_NAMES(checked.bad) : ADVICE.TOO_MANY(checked.count, 64) };
 }
-function jsonBody(body) {
-  try {
-    let v = JSON.parse(body);
-    return typeof v == "object" && v !== null ? v : {};
-  } catch {
-    return {};
-  }
-}
-function adviceFailure(status, body) {
-  let parsed = jsonBody(body);
+function adviceFailure(e) {
+  let { status, body } = e, parsed = httpErrorJson(e)?.body ?? {};
   return status === 429 && typeof parsed.retry_after_s == "number" ? { kind: "rate-limited", retryAfterS: parsed.retry_after_s } : status === 503 && typeof parsed.reason == "string" ? { kind: "unavailable", reason: parsed.reason } : { kind: "error", status, message: body };
 }
 var init_package_advice3 = __esm({ "src/core/package-advice.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
   init_tenant();
   init_constants();
 } });
 var version, init_package = __esm({ "package.json"() {
-  version = "1.2.0";
+  version = "1.2.2";
 } });
 var byCreatedAtDesc, init_sort = __esm({ "src/utils/sort.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   byCreatedAtDesc = (rows) => [...rows].sort((a, b) => (b.created_at ?? "").localeCompare(a.created_at ?? ""));
 } });
-var normalizeContentHash, init_hash = __esm({ "src/utils/hash.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  normalizeContentHash = (hash) => hash.replace(/^sha256:/, "");
-} });
-function strOpt(args, key) {
-  let bare = bareValueFlag(args, [key]);
-  if (bare !== void 0) throw new Error(needsValueMessage(bare));
-  let v = args.options[key];
-  return typeof v == "string" ? v : void 0;
-}
-function flagParams(args, map2) {
-  let params = {};
-  for (let [flag, param] of Object.entries(map2)) {
-    let v = strOpt(args, flag);
-    v !== void 0 && (params[param] = v);
-  }
-  return params;
+function apiUrlOf(args) {
+  return strOpt(args, "api") ?? DEFAULTS.API_URL;
 }
 function boolFlag(args, key) {
   return args.options[key] === true;
@@ -2092,33 +2155,23 @@ function requireArg(args, label) {
 var init_args2 = __esm({ "src/utils/args.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
   init_constants();
   init_output();
+  init_http_client();
+  init_http_client();
 } });
-function errorMessage(e) {
-  return e instanceof Error ? e.message : String(e);
-}
 function traceLine(e) {
   return e instanceof HttpError && e.traceId ? MESSAGES.SERVER_TRACE_ID(e.traceId) : null;
 }
 function keyExpiredHint(e) {
-  if (!(e instanceof HttpError) || e.status !== 401) return null;
-  try {
-    return JSON.parse(e.body)?.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
-  } catch {
-    return null;
-  }
+  let refused2 = httpErrorJson(e);
+  return refused2?.status === 401 && refused2.body.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
 }
 function printError(e) {
-  fail(errorMessage(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
+  fail(errText(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
 }
 async function guard(body) {
-  try {
-    return await body();
-  } catch (e) {
-    return printError(e), 1;
-  }
+  return await guardValue(body) ?? 1;
 }
 async function guardValue(body) {
   try {
@@ -2194,7 +2247,6 @@ var init_utils = __esm({ "src/utils/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_sort();
-  init_hash();
   init_args2();
   init_guard();
   init_prompt_flow();
@@ -2229,7 +2281,7 @@ async function describeServer(baseUrl, fetchImpl = fetch, check = noteServerVers
   return `API: ${api} at ${baseUrl}${floor ? ` (minimum client ${floor})` : ""}`;
 }
 async function runVersion(args, fetchImpl = fetch) {
-  let baseUrl = strOpt(args, "api") ?? DEFAULTS.API_URL, st = outStyle();
+  let baseUrl = apiUrlOf(args), st = outStyle();
   return out(`${st.bold(`ignitify ${CLIENT_VERSION}`)} ${st.dim(`(built for API ${API_VERSION})`)}`), out(st.dim(await describeServer(baseUrl, fetchImpl))), 0;
 }
 var CLIENT_VERSION, PROBE_TIMEOUT_MS, noteServerVersion, init_version = __esm({ "src/io/version.ts"() {
@@ -2249,7 +2301,7 @@ function openNoFollow(file, fsx = import_node_fs.default) {
   try {
     fd = fsx.openSync(file, NO_FOLLOW_READ_FLAGS);
   } catch (e) {
-    let code = e?.code;
+    let code = errCode(e);
     if (code === "ENOENT") return { kind: "missing" };
     if (code === "ELOOP") return { kind: "symlink" };
     throw e;
@@ -2263,7 +2315,9 @@ function openNoFollow(file, fsx = import_node_fs.default) {
 var import_node_fs, NO_FOLLOW_READ_FLAGS, init_no_follow = __esm({ "src/io/no-follow.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs = __toESM(require("node:fs"), 1), NO_FOLLOW_READ_FLAGS = import_node_fs.default.constants.O_RDONLY | (import_node_fs.default.constants.O_NOFOLLOW ?? 0) | (import_node_fs.default.constants.O_NONBLOCK ?? 0);
+  import_node_fs = __toESM(require("node:fs"), 1);
+  init_tenant();
+  NO_FOLLOW_READ_FLAGS = import_node_fs.default.constants.O_RDONLY | (import_node_fs.default.constants.O_NOFOLLOW ?? 0) | (import_node_fs.default.constants.O_NONBLOCK ?? 0);
 } });
 function credentialsPath(env = process.env, home = import_node_os.default.homedir()) {
   let xdg = env.XDG_CONFIG_HOME, base = xdg && import_node_path.default.isAbsolute(xdg) ? xdg : import_node_path.default.join(home, ".config");
@@ -2288,10 +2342,9 @@ function parseCredentials(text) {
   } catch {
     return null;
   }
-  let d = doc;
-  if (!d || typeof d != "object" || d.version !== 1) return null;
-  for (let k of ["api_url", "api_key", "key_id", "label", "saved_at"]) if (typeof d[k] != "string" || d[k] === "") return null;
-  return d;
+  if (!isRecord(doc) || doc.version !== 1) return null;
+  let { api_url, api_key, key_id, label, saved_at } = doc;
+  return !isFilled(api_url) || !isFilled(api_key) || !isFilled(key_id) || !isFilled(label) || !isFilled(saved_at) ? null : { version: 1, api_url, api_key, key_id, label, saved_at };
 }
 function readCredentials(file = credentialsPath(), fsx = import_node_fs2.default) {
   let opened = openNoFollow(file, fsx);
@@ -2331,13 +2384,15 @@ function deleteCredentials(file = credentialsPath(), fsx = import_node_fs2.defau
     throw e;
   }
 }
-var import_node_fs2, import_node_os, import_node_path, import_node_crypto, myUid, isMissing, init_credentials = __esm({ "src/io/credentials.ts"() {
+var import_node_fs2, import_node_os, import_node_path, import_node_crypto, isFilled, myUid, init_credentials = __esm({ "src/io/credentials.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_node_fs2 = __toESM(require("node:fs"), 1), import_node_os = __toESM(require("node:os"), 1), import_node_path = __toESM(require("node:path"), 1), import_node_crypto = require("node:crypto");
+  init_tenant();
   init_constants();
   init_no_follow();
-  myUid = () => typeof process.getuid == "function" ? process.getuid() : null, isMissing = (e) => e?.code === "ENOENT";
+  isFilled = (v) => typeof v == "string" && v !== "";
+  myUid = () => typeof process.getuid == "function" ? process.getuid() : null;
 } });
 function codeOf(cause) {
   let code = cause?.code;
@@ -2385,17 +2440,15 @@ var UnreachableError, init_unreachable = __esm({ "src/core/unreachable.ts"() {
     }
   };
 } });
-function isLoopbackHost(hostname) {
-  return hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
-}
 function apiUrlRefusal(url) {
-  let u;
-  try {
-    u = new URL(url);
-  } catch {
-    return MESSAGES.API_URL_NOT_URL(url);
+  switch (keyUrlRefusal(url)) {
+    case "not-url":
+      return MESSAGES.API_URL_NOT_URL(url);
+    case "insecure":
+      return MESSAGES.API_URL_NOT_HTTPS(url);
+    case null:
+      return null;
   }
-  return u.protocol === "https:" || u.protocol === "http:" && isLoopbackHost(u.hostname) ? null : MESSAGES.API_URL_NOT_HTTPS(url);
 }
 function assertApiUrl(url) {
   let refusal = apiUrlRefusal(url);
@@ -2405,6 +2458,7 @@ function assertApiUrl(url) {
 var init_api_url = __esm({ "src/core/api-url.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
   init_constants();
 } });
 function resolveApiConfig(apiOverride, env = process.env, read = () => readCredentials(), note = noteEnvOverride) {
@@ -2456,7 +2510,7 @@ async function pollDeviceLogin(cfg, deviceCode, fetchImpl) {
   try {
     body = await request(`${cfg.baseUrl}${TENANT_PATHS.AUTH_DEVICE_TOKEN}`, { method: "POST", headers: { "content-type": "application/json", ...versionHeader }, body: { device_code: deviceCode }, fetchImpl: viaApi(fetchImpl), ...readHeaders });
   } catch (e) {
-    let wait = e instanceof HttpError && e.status === 429 ? slowDownOf(e.body) : null;
+    let wait = slowDownOf(e);
     if (wait === null) throw e;
     return { kind: "wait", interval: wait };
   }
@@ -2466,13 +2520,11 @@ async function pollDeviceLogin(cfg, deviceCode, fetchImpl) {
   if (!key || typeof key.api_key != "string" || key.api_key === "" || typeof key.key_id != "string" || typeof key.label != "string" || typeof key.tenant?.resource_id != "string") throw new BadAnswerError(MESSAGES.LOGIN_BAD_ANSWER);
   return { kind: "key", key };
 }
-function slowDownOf(text) {
-  try {
-    let b = JSON.parse(text);
-    return b.status === "slow_down" && typeof b.interval == "number" ? b.interval : null;
-  } catch {
-    return null;
-  }
+function slowDownOf(e) {
+  let refused2 = httpErrorJson(e);
+  if (refused2?.status !== 429 || refused2.body.status !== "slow_down") return null;
+  let interval = refused2.body.interval;
+  return typeof interval == "number" ? interval : null;
 }
 function revokeOwnKey(cfg, fetchImpl) {
   return apiDelete(cfg, TENANT_PATHS.AUTH_KEY, fetchImpl);
@@ -2484,8 +2536,9 @@ async function postDeployment(cfg, taskId, manifest, tar, fetchImpl) {
   let form = new FormData();
   return form.set("task_id", taskId), form.set("manifest", JSON.stringify(manifest)), form.set("bundle", new Blob([new Uint8Array(tar)], { type: "application/x-tar" }), "bundle.tar"), await request(`${cfg.baseUrl}${TENANT_PATHS.DEPLOYMENTS}`, { method: "POST", headers: authHeaders(cfg), body: form, fetchImpl: viaApi(fetchImpl), timeoutMs: 3e5, ...readHeaders });
 }
-async function postRun(cfg, run2, fetchImpl) {
-  return await request(`${cfg.baseUrl}${TENANT_PATHS.RUNS}`, { method: "POST", headers: { ...authHeaders(cfg), "content-type": "application/json" }, body: { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at }, fetchImpl: viaApi(fetchImpl), ...readHeaders });
+function postRun(cfg, run2, fetchImpl) {
+  let body = { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at };
+  return apiPost(cfg, TENANT_PATHS.RUNS, body, fetchImpl);
 }
 async function listSchedules(cfg, fetchImpl) {
   return apiGet(cfg, TENANT_PATHS.SCHEDULES, fetchImpl);
@@ -2536,7 +2589,7 @@ async function postPackageAdvice(cfg, body, fetchImpl) {
   try {
     return { kind: "ok", response: await apiPost(cfg, TENANT_PATHS.PACKAGE_ADVICE, body, fetchImpl, ADVICE.TIMEOUT_MS) };
   } catch (e) {
-    return e instanceof HttpError ? adviceFailure(e.status, e.body) : { kind: "error", status: null, message: e instanceof Error ? e.message : String(e) };
+    return e instanceof HttpError ? adviceFailure(e) : { kind: "error", status: null, message: errText(e) };
   }
 }
 async function createTask(cfg, slug2, fetchImpl) {
@@ -2621,8 +2674,8 @@ var readHeaders, noteEnvOverride, versionHeader, BadAnswerError, init_api = __es
   };
 } });
 function payloadRefusal(payload, limit) {
-  let bytes2 = payloadBytes(payload);
-  return bytes2 > limit ? MESSAGES.PAYLOAD_OVER_LIMIT(bytes2, limit) : null;
+  let bytes = payloadBytes(payload);
+  return bytes > limit ? MESSAGES.PAYLOAD_OVER_LIMIT(bytes, limit) : null;
 }
 var payloadBytes, limitOrFallback, formatLimit, limitsNote, init_payload_limit = __esm({ "src/core/payload-limit.ts"() {
   "use strict";
@@ -2630,7 +2683,7 @@ var payloadBytes, limitOrFallback, formatLimit, limitsNote, init_payload_limit =
   init_constants();
   init_output();
   payloadBytes = (payload) => Buffer.byteLength(JSON.stringify(payload) ?? "", "utf8"), limitOrFallback = (limit, fallback) => typeof limit == "number" && Number.isFinite(limit) && limit > 0 ? limit : fallback;
-  formatLimit = (bytes2) => formatBytes(bytes2).replace(/\.0 /, " "), limitsNote = () => MESSAGES.TASK_LIMITS(formatLimit(PAYLOAD_LIMIT_FALLBACK_BYTES), formatLimit(RESULT_LIMIT_FALLBACK_BYTES));
+  formatLimit = (bytes) => formatBytes(bytes).replace(/\.0 /, " "), limitsNote = () => MESSAGES.TASK_LIMITS(formatLimit(PAYLOAD_LIMIT_FALLBACK_BYTES), formatLimit(RESULT_LIMIT_FALLBACK_BYTES));
 } });
 function apiConfig(args) {
   return resolveApiConfig(strOpt(args, "api"));
@@ -2639,20 +2692,27 @@ async function payloadLimit(cfg) {
   let whoami = await getWhoami(cfg).catch(() => null);
   return limitOrFallback(whoami?.limits.max_payload_bytes, PAYLOAD_LIMIT_FALLBACK_BYTES);
 }
-function consoleLogText(bytes2, out2) {
-  return out2.raw ? bytes2 : terminalSafe(bytes2, out2.colour);
+function consoleLogText(bytes, out2) {
+  return out2.raw ? bytes : terminalSafe(bytes, out2.colour);
 }
 function printConsoleLog(data, raw, colour = outStyle().colour) {
   if (writeRaw(consoleLogText(typeof data?.bytes == "string" ? data.bytes : "", { raw, colour })), data?.truncated === true) {
     let lines = typeof data.lines == "number" ? data.lines : 0;
     tell(`
-${warnMark(errStyle(), `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`)}`);
+${warnMark(errStyle(), RESULT_MESSAGES.LOG_TRUNCATED(lines))}`);
   }
 }
 function noteNextPage(args, list2, rows) {
   let note = nextPageNoteFor2(args, list2, rows);
   note !== void 0 && warn(note);
 }
+async function runPagedList(args, verb) {
+  let badLimit = limitRefusal(args);
+  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
+    let data = await verb.fetchPage(apiConfig(args), { ...flagParams(args, verb.list.flags), ...verb.extra });
+    return verb.show(data), noteNextPage(args, verb.list, verb.rowsOf(data)), 0;
+  });
+}
 var init_shared = __esm({ "src/commands/shared.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -2682,6 +2742,41 @@ var init_identity = __esm({ "src/commands/identity.ts"() {
   init_output();
   init_shared();
 } });
+function backoffDelayMs(attempt, cadence) {
+  return cappedExponentialMs(attempt, cadence.BASE_MS, cadence.MAX_MS);
+}
+function isTransientError(e) {
+  return e instanceof HttpError ? e.status === 408 || e.status === 429 || e.status >= 500 && e.status <= 599 : e instanceof TypeError ? true : e instanceof Error && isRecord(e.cause) && e.cause.name === "TimeoutError";
+}
+function decidePollError(e, failuresInARow, failingForMs) {
+  return isTransientError(e) ? failuresInARow >= POLL.ERROR.MIN_TRIES && failingForMs >= POLL.ERROR.GRACE_MS ? "give-up" : "retry" : "give-up";
+}
+async function pollUntil(loop) {
+  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), failures = 0, firstFailureAt = 0;
+  for (let attempt = 0; ; ) {
+    let view;
+    try {
+      view = await loop.fetch();
+    } catch (error) {
+      if (failures === 0 && (firstFailureAt = now()), failures += 1, decidePollError(error, failures, now() - firstFailureAt) === "give-up") return { kind: "lost", error };
+      loop.onRetry?.(error), await sleep(loop.retryDelayMs);
+      continue;
+    }
+    failures = 0, loop.onView?.(view);
+    let action = loop.decide(view, now() - startedAt, attempt);
+    if (!isWait(action)) return { action, view };
+    loop.onWait?.(view, attempt), await sleep(action.delayMs), attempt += 1;
+  }
+}
+var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_tenant();
+  init_constants();
+  init_utils();
+  isWait = (action) => action.kind === "wait", isLost = (end) => "kind" in end && end.kind === "lost";
+} });
 function shortenHome(file, home) {
   if (home === "" || !file.startsWith(home)) return file;
   let rest = file.slice(home.length);
@@ -2710,9 +2805,6 @@ var INDENT, renderWaitingStatic, init_login_view = __esm({ "src/commands/login-v
   INDENT = "  ";
   renderWaitingStatic = (minutes) => LOGIN_VIEW.WAITING_STATIC(minutes);
 } });
-function formatUserCode(code) {
-  return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
-}
 function replacedKeyNote(replacedKeyId, ownKeyId, label) {
   return !replacedKeyId || replacedKeyId === ownKeyId ? null : MESSAGES.LOGIN_REPLACED(label);
 }
@@ -2745,15 +2837,8 @@ async function withRetries(baseUrl, clock, waitMs, call) {
     await clock.sleep(waitMs);
   }
 }
-function bodyOf(e) {
-  try {
-    return JSON.parse(e.body);
-  } catch {
-    return {};
-  }
-}
 function pollFailure(e, userCode) {
-  let body = bodyOf(e);
+  let body = httpErrorJson(e)?.body ?? {};
   switch (e.status) {
     case 410:
       return MESSAGES.LOGIN_EXPIRED(formatUserCode(userCode));
@@ -2782,7 +2867,7 @@ async function pollForKey(baseUrl, started, deadline, deps) {
 }
 async function runLogin(args, deps = {}) {
   return guard(async () => {
-    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(strOpt(args, "api") ?? DEFAULTS.API_URL), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
+    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(apiUrlOf(args)), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
       throw e instanceof HttpError && e.status === 429 ? new Error(MESSAGES.LOGIN_TOO_MANY, { cause: e }) : e;
     }), env = deps.env ?? process.env, st = screenStyle(deps.screen, env), url = started.verification_uri_complete;
     if (say(renderLoginStart(st, { code: formatUserCode(started.user_code), url })), say(""), url !== null) {
@@ -2830,35 +2915,28 @@ var import_node_os2, import_node_child_process, START_RETRY_MS, retryable, reach
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_node_os2 = __toESM(require("node:os"), 1), import_node_child_process = require("node:child_process");
+  init_tenant();
   init_http_client();
+  init_tenant();
   init_api();
   init_credentials();
   init_version();
   init_unreachable();
+  init_poll();
   init_api_url();
   init_constants();
   init_utils();
   init_output();
   init_login_view();
-  START_RETRY_MS = 1e3, retryable = (e) => !(e instanceof BadAnswerError) && (!(e instanceof HttpError) || e.status >= 500), reachDetail = (e) => e instanceof UnreachableError ? e.detail : null;
-} });
-function filters(args) {
-  let q = {}, period = strOpt(args, "period");
-  period !== void 0 && (q.period = period);
-  let axis = strOpt(args, "axis");
-  axis !== void 0 && (q.axis = axis);
-  let vm = strOpt(args, "vm");
-  vm !== void 0 && (q.vm = vm);
-  let run2 = strOpt(args, "run");
-  return run2 !== void 0 && (q.run = run2), q;
-}
+  START_RETRY_MS = 1e3, retryable = (e) => isTransientError(e) && !(e instanceof HttpError && e.status === 429), reachDetail = (e) => e instanceof UnreachableError ? e.detail : isTransientError(e) && !(e instanceof HttpError) && !(e instanceof TypeError) ? errText(e) : null;
+} });
 function selectLines(lines, runs, vms) {
   return lines.filter((l) => runs && l.run_id !== null || vms && l.vm_id !== null);
 }
 async function runUsageShow(args) {
   return guard(async () => {
     let report = await getUsage(apiConfig(args), filters(args));
-    if (boolFlag(args, "json")) return out(JSON.stringify(report, null, 2)), 0;
+    if (boolFlag(args, "json")) return emit(report), 0;
     let runs = boolFlag(args, "runs"), vms = boolFlag(args, "vms"), shown = { ...report, lines: selectLines(report.lines, runs, vms) };
     return out(renderUsageReport(outStyle(), shown, { lines: runs || vms })), 0;
   });
@@ -2871,7 +2949,7 @@ async function runUsageExport(args) {
     return out(json2 ? JSON.stringify(report.lines, null, 2) : toCsv(report)), 0;
   });
 }
-var init_usage_report = __esm({ "src/commands/usage-report.ts"() {
+var filters, init_usage_report = __esm({ "src/commands/usage-report.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_api();
@@ -2880,10 +2958,10 @@ var init_usage_report = __esm({ "src/commands/usage-report.ts"() {
   init_usage2();
   init_output();
   init_constants();
+  filters = (args) => flagParams(args, USAGE_FLAG_PARAMS);
 } });
 function planTaskDeletion(input) {
-  let affected = [];
-  for (let run2 of input.runs) isTerminalRunStatus(run2.status) || affected.push({ runId: run2.id, status: run2.status, ...run2.vm_id ? { vmId: run2.vm_id } : {}, fate: fateOf(run2.status) });
+  let affected = input.runs.filter((run2) => !isTerminalRunStatus(run2.status)).map((run2) => ({ runId: run2.id, status: run2.status, ...run2.vm_id ? { vmId: run2.vm_id } : {}, fate: fateOf(run2.status) }));
   return { taskSlug: input.taskSlug, deploymentCount: input.deploymentCount, runCount: input.runCount, affected, unlinkDirs: linkedDirs(input.taskId, input.folders), hasInFlight: affected.length > 0 };
 }
 function linkedDirs(taskId, folders) {
@@ -2915,7 +2993,7 @@ var init_resolve_deployment = __esm({ "src/core/resolve-deployment.ts"() {
 function parseRunOptions(args, config) {
   let bare = bareValueFlag(args, VALUE_FLAGS);
   if (bare !== void 0) return { ok: false, error: needsValueMessage(bare) };
-  let payloadArg = strOpt(args, "payload"), payload = payloadArg === void 0 ? { ok: true, value: config.run?.payload ?? {} } : parseJson2(payloadArg);
+  let payloadArg = strOpt(args, "payload"), payload = payloadArg === void 0 ? { ok: true, value: config.run?.payload ?? {} } : parseJsonText(payloadArg);
   if (!payload.ok) return { ok: false, error: `--payload is not valid JSON: ${payloadArg}` };
   let timeoutArg = strOpt(args, "timeout-sec"), timeoutOverride = timeoutArg === void 0 ? void 0 : Number(timeoutArg);
   if (timeoutOverride !== void 0 && !(Number.isFinite(timeoutOverride) && timeoutOverride > 0)) return { ok: false, error: `--timeout-sec must be a positive number, got: ${timeoutArg}` };
@@ -2926,21 +3004,35 @@ function parseRunOptions(args, config) {
   let wait = boolFlag(args, "wait");
   return at !== void 0 && wait ? { ok: false, error: MESSAGES.RUN_AT_WITH_WAIT } : { ok: true, deploymentFlag: strOpt(args, "deployment"), wait, run: { payload: payload.value, preset: config.run?.preset, timeoutSec: timeoutOverride ?? config.run?.timeout_sec, execution: onBusy === void 0 ? config.execution : { ...config.execution ?? {}, on_busy: onBusy }, at } };
 }
-function parseJson2(text) {
-  try {
-    return { ok: true, value: JSON.parse(text) };
-  } catch {
-    return { ok: false };
-  }
-}
 var VALUE_FLAGS, init_run_options = __esm({ "src/core/run-options.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
   init_http_client();
   init_constants();
   init_utils();
   VALUE_FLAGS = Object.entries(COMMAND_META[COMMANDS.TASK_RUN].flags).filter(([, kind]) => kind === "value").map(([flag]) => flag);
 } });
+function classifyRunAnswer(res, at, wait) {
+  return at !== void 0 ? res.schedule_id ? { kind: "scheduled", scheduleId: res.schedule_id, firesAt: res.fires_at ?? at } : res.run_id ? { kind: "skew-ran-now", runId: res.run_id } : { kind: "skew-no-schedule" } : wait && res.run_id ? { kind: "wait", runId: res.run_id } : { kind: "submitted" };
+}
+var init_run_answer = __esm({ "src/core/run-answer.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function writeFileAtomic(file, text) {
+  let exists = import_node_fs3.default.existsSync(file), target = exists ? import_node_fs3.default.realpathSync(file) : file, mode = exists ? import_node_fs3.default.statSync(target).mode & 511 : NEW_FILE_MODE, name = `.${import_node_path2.default.basename(target)}.${process.pid}.${(0, import_node_crypto2.randomBytes)(6).toString("hex")}.tmp`, tmp = import_node_path2.default.join(import_node_path2.default.dirname(target), name);
+  try {
+    import_node_fs3.default.writeFileSync(tmp, text, { mode, flag: "wx" }), exists && import_node_fs3.default.chmodSync(tmp, mode), import_node_fs3.default.renameSync(tmp, target);
+  } finally {
+    import_node_fs3.default.rmSync(tmp, { force: true });
+  }
+}
+var import_node_crypto2, import_node_fs3, import_node_path2, NEW_FILE_MODE, init_fs_atomic = __esm({ "src/io/fs-atomic.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  import_node_crypto2 = require("node:crypto"), import_node_fs3 = __toESM(require("node:fs"), 1), import_node_path2 = __toESM(require("node:path"), 1), NEW_FILE_MODE = 438;
+} });
 function parseState(raw) {
   let parsed;
   try {
@@ -2948,9 +3040,12 @@ function parseState(raw) {
   } catch {
     return {};
   }
-  if (typeof parsed != "object" || parsed === null) return {};
-  let obj = parsed, out2 = {};
-  for (let key of STATE_KEYS) typeof obj[key] == "string" && (out2[key] = obj[key]);
+  if (!isRecord(parsed)) return {};
+  let out2 = {};
+  for (let key of STATE_KEYS) {
+    let value = parsed[key];
+    typeof value == "string" && (out2[key] = value);
+  }
   return out2;
 }
 function serializeState(state) {
@@ -2964,19 +3059,19 @@ function writeState(taskDir, patch2) {
   let merged = { ...readState(taskDir), ...patch2 }, statePath = import_path.default.join(taskDir, STATE.DIR, STATE.FILE);
   import_fs.default.mkdirSync(import_path.default.dirname(statePath), { recursive: true });
   let ignorePath = import_path.default.join(import_path.default.dirname(statePath), STATE.GITIGNORE_FILE);
-  import_fs.default.existsSync(ignorePath) || import_fs.default.writeFileSync(ignorePath, STATE.GITIGNORE_TEXT);
-  let tmpPath = `${statePath}.tmp`;
-  return import_fs.default.writeFileSync(tmpPath, serializeState(merged)), import_fs.default.renameSync(tmpPath, statePath), merged;
+  return import_fs.default.existsSync(ignorePath) || import_fs.default.writeFileSync(ignorePath, STATE.GITIGNORE_TEXT), writeFileAtomic(statePath, serializeState(merged)), merged;
 }
 var import_fs, import_path, STATE_KEYS, init_state = __esm({ "src/io/state.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_fs = __toESM(require("fs"), 1), import_path = __toESM(require("path"), 1);
+  init_tenant();
+  init_fs_atomic();
   init_constants();
   STATE_KEYS = ["task_id", "task_resource_id", "deployment_id"];
 } });
 function buildTaskReport(inputs) {
-  let { slug: slug2, deployments, runs, usage } = inputs, taskDeployments = deployments === null ? null : deployments.filter((d) => d.task_slug === slug2), firstPage = (rows) => rows.length >= inputs.pageLimit ? ` (first ${inputs.pageLimit} shown; more may exist)` : "", newDeployment = decideNewDeployment(inputs.localContentHash, taskDeployments), newVm = decideNewVm(inputs.declared, inputs.declaredPreset, inputs.stateDeploymentId, newDeployment, runs), deployed = taskDeployments === null ? { yes: "unknown", detail: inputs.stateDeploymentId ? `server unreachable; .ignitify/state.json points at ${inputs.stateDeploymentId}` : "server unreachable; no local deployment pointer either" } : taskDeployments.length > 0 ? { yes: true, detail: `${taskDeployments.length} live deployment(s)${firstPage(taskDeployments)}${inputs.stateDeploymentId && !taskDeployments.some((d) => d.id === inputs.stateDeploymentId) ? ` \u2014 WARNING: state.json points at ${inputs.stateDeploymentId}, which is not among them (deleted?)` : ""}` } : { yes: false, detail: "no live deployments for this task" }, deploymentSummaries = taskDeployments === null ? "unknown" : byCreatedAtDesc(taskDeployments).map((d) => ({ id: d.id ?? "?", created_at: d.created_at ?? "?", status: d.status ?? "?", content_hash: normalizeContentHash(d.content_hash ?? "").slice(0, 12), image_bytes: d.image_bytes ?? 0, detailCommand: `ignitify deployment:get ${d.id ?? "<id>"}` })), runsSummary = runs === null ? "unknown" : { total: runs.length, firstPageOnly: runs.length >= inputs.pageLimit, byStatus: runs.reduce((acc, r) => {
+  let { slug: slug2, deployments, runs, usage } = inputs, taskDeployments = deployments === null ? null : deployments.filter((d) => d.task_slug === slug2), firstPage = (rows) => rows.length >= inputs.pageLimit ? ` (first ${inputs.pageLimit} shown; more may exist)` : "", newDeployment = decideNewDeployment(inputs.localContentHash, taskDeployments), newVm = decideNewVm(inputs.declared, inputs.declaredPreset, inputs.stateDeploymentId, newDeployment, runs), deployed = taskDeployments === null ? { yes: "unknown", detail: inputs.stateDeploymentId ? `server unreachable; .ignitify/state.json points at ${inputs.stateDeploymentId}` : "server unreachable; no local deployment pointer either" } : taskDeployments.length > 0 ? { yes: true, detail: `${taskDeployments.length} live deployment(s)${firstPage(taskDeployments)}${inputs.stateDeploymentId && !taskDeployments.some((d) => d.id === inputs.stateDeploymentId) ? ` \u2014 WARNING: state.json points at ${inputs.stateDeploymentId}, which is not among them (deleted?)` : ""}` } : { yes: false, detail: "no live deployments for this task" }, deploymentSummaries = taskDeployments === null ? "unknown" : byCreatedAtDesc(taskDeployments).map((d) => ({ id: d.id ?? "?", created_at: d.created_at ?? "?", status: d.status ?? "?", content_hash: stripSha256Prefix(d.content_hash ?? "").slice(0, 12), image_bytes: d.image_bytes ?? 0, detailCommand: `ignitify deployment:get ${d.id ?? "<id>"}` })), runsSummary = runs === null ? "unknown" : { total: runs.length, firstPageOnly: runs.length >= inputs.pageLimit, byStatus: runs.reduce((acc, r) => {
     let s = r.status ?? "?";
     return acc[s] = (acc[s] ?? 0) + 1, acc;
   }, /* @__PURE__ */ Object.create(null)), recent: byCreatedAtDesc(runs).slice(0, 5).map((r) => ({ id: r.id ?? "?", created_at: r.created_at ?? "?", status: r.status ?? "?", detailCommand: `ignitify run:get ${r.id ?? "<id>"}` })), listCommand: `ignitify run:list --task-name ${slug2}` };
@@ -2984,7 +3079,7 @@ function buildTaskReport(inputs) {
 }
 function formatTaskReport(r) {
   let lines = [];
-  if (lines.push(`Task report: ${r.slug}`), lines.push(""), lines.push(`Deployed: ${r.deployed.yes === "unknown" ? "UNKNOWN" : r.deployed.yes ? "YES" : "NO"} \u2014 ${r.deployed.detail}`), lines.push(""), lines.push("Resources:"), lines.push(`  task images on disk: ${r.resources.taskImageBytes === "unknown" ? "unknown (server unreachable)" : formatBytes(r.resources.taskImageBytes)}`), r.resources.tenant) {
+  if (lines.push(`Task report: ${r.slug}`), lines.push(""), lines.push(`Deployed: ${yesNoUnknown(r.deployed.yes)} \u2014 ${r.deployed.detail}`), lines.push(""), lines.push("Resources:"), lines.push(`  task images on disk: ${r.resources.taskImageBytes === "unknown" ? "unknown (server unreachable)" : formatBytes(r.resources.taskImageBytes)}`), r.resources.tenant) {
     let u = r.resources.tenant;
     lines.push(`  tenant-wide (whoami): tasks ${u.task_count ?? "?"}, active runs ${u.active_runs ?? "?"}, deployments ${u.deployment_count ?? "?"}, images ${formatBytes(u.total_image_bytes ?? 0)}, egress this month ${formatBytes(u.net_egress_bytes ?? 0)}`), lines.push("  more: ignitify quota");
   }
@@ -3007,27 +3102,25 @@ function formatTaskReport(r) {
     }
     lines.push("");
   }
-  lines.push(`New deployment needed: ${verdictLine(r.newDeployment)}`);
+  lines.push(`New deployment needed: ${yesNoUnknown(r.newDeployment.needed)}`);
   for (let reason of r.newDeployment.reasons) lines.push(`  - ${reason}`);
-  lines.push(""), lines.push(`New VM on next run: ${verdictLine(r.newVm)}`);
+  lines.push(""), lines.push(`New VM on next run: ${yesNoUnknown(r.newVm.needed)}`);
   for (let reason of r.newVm.reasons) lines.push(`  - ${reason}`);
   return lines.join(`
 `);
 }
-var FINGERPRINT_AXES, resolveOrNull, runNature, fingerprintDiffs, presetIndeterminate, decideNewDeployment, decideNewVm, decideInbound, verdictLine, init_report = __esm({ "src/core/report.ts"() {
+var FINGERPRINT_AXES, resolveOrNull, DEFAULT_NATURE, runNature, fingerprintDiffs, presetIndeterminate, decideNewDeployment, decideNewVm, decideInbound, yesNoUnknown, init_report = __esm({ "src/core/report.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_execution();
   init_output();
+  init_tenant();
   init_utils();
   init_constants();
   FINGERPRINT_AXES = ["network", "storage_mib", "cardinality", "state", "interaction", "duration", "residency"], resolveOrNull = (declared) => {
     let r = resolveNature(declared, PLATFORM_DEFAULT_NATURE);
     return r.ok ? r.nature : null;
-  }, runNature = (run2) => {
-    let declared = run2.execution ?? void 0;
-    return resolveOrNull(declared) ?? resolveNature(void 0, PLATFORM_DEFAULT_NATURE).nature;
-  }, fingerprintDiffs = (prev, next, prevPreset, nextPreset) => {
+  }, DEFAULT_NATURE = resolveOrNull(void 0) ?? PLATFORM_DEFAULT_NATURE, runNature = (run2) => resolveOrNull(run2.execution ?? void 0) ?? DEFAULT_NATURE, fingerprintDiffs = (prev, next, prevPreset, nextPreset) => {
     let diffs = [];
     prevPreset !== void 0 && nextPreset !== void 0 && prevPreset !== nextPreset && diffs.push(`preset ${prevPreset}\u2192${nextPreset}`);
     for (let axis of FINGERPRINT_AXES) prev[axis] !== next[axis] && diffs.push(`${axis} ${String(prev[axis] ?? "default")}\u2192${String(next[axis] ?? "default")}`);
@@ -3036,7 +3129,7 @@ var FINGERPRINT_AXES, resolveOrNull, runNature, fingerprintDiffs, presetIndeterm
     if (taskDeployments === null) return { needed: "unknown", reasons: ["server unreachable \u2014 cannot compare against live deployments"] };
     if (taskDeployments.length === 0) return { needed: true, reasons: ["no live deployment exists for this task (never deployed, or all deleted)"] };
     if (localContentHash === null) return { needed: "unknown", reasons: ["the local content hash could not be computed \u2014 the upload would be refused (run `ignitify task:pack` to see why)"] };
-    let localHash = normalizeContentHash(localContentHash), match = taskDeployments.find((d) => normalizeContentHash(d.content_hash ?? "") === localHash);
+    let localHash = stripSha256Prefix(localContentHash), match = taskDeployments.find((d) => stripSha256Prefix(d.content_hash ?? "") === localHash);
     if (match) {
       let rebuild = match.image_present === false;
       return { needed: false, reasons: [`local code is identical to deployment ${match.id ?? "?"} (content_hash dedup \u2014 deploy would return reused: true)`, ...rebuild ? ["note: its image is no longer in the store (archived by the GC) \u2014 a deploy would rebuild the image under the SAME deployment id"] : []] };
@@ -3057,10 +3150,10 @@ var FINGERPRINT_AXES, resolveOrNull, runNature, fingerprintDiffs, presetIndeterm
   }, decideInbound = (declared, taskDeployments, runs) => {
     let nature = resolveOrNull(declared);
     if (nature === null || nature.network !== "bidirectional" || nature.inbound_port === void 0) return null;
-    let serving = (runs ?? []).some((r) => ACTIVE_RUN_STATUSES.has(r.status ?? "")), routes = taskDeployments === null ? "unknown" : taskDeployments.filter((d) => d.id).map((d) => ({ deploymentId: d.id, routeId: deriveRouteId(d.id) }));
+    let serving = (runs ?? []).some((r) => ACTIVE_RUN_STATUSES.has(r.status ?? "")), routes = taskDeployments === null ? "unknown" : taskDeployments.flatMap((d) => d.id ? [{ deploymentId: d.id, routeId: deriveRouteId(d.id) }] : []);
     return { port: nature.inbound_port, serving, routes };
   };
-  verdictLine = (v) => v.needed === "unknown" ? "UNKNOWN" : v.needed ? "YES" : "NO";
+  yesNoUnknown = (answer) => answer === "unknown" ? "UNKNOWN" : answer ? "YES" : "NO";
 } });
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x.default : x;
@@ -3721,7 +3814,7 @@ function requireLoader() {
   function mergeMappings(state, destination, source, overridableKeys) {
     common2.isObject(source) || throwError(state, "cannot merge mappings; the provided source object is unacceptable"), chargeMergeWork(state);
     let sourceKeys = Object.keys(source);
-    for (let index = 0, quantity2 = sourceKeys.length; index < quantity2; index += 1) {
+    for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
       let key = sourceKeys[index];
       chargeMergeWork(state), _hasOwnProperty.call(destination, key) || (setProperty(destination, key, source[key]), overridableKeys[key] = true);
     }
@@ -3729,11 +3822,11 @@ function requireLoader() {
   function storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valueNode, startLine, startLineStart, startPos) {
     if (Array.isArray(keyNode)) {
       keyNode = Array.prototype.slice.call(keyNode);
-      for (let index = 0, quantity2 = keyNode.length; index < quantity2; index += 1) Array.isArray(keyNode[index]) && throwError(state, "nested arrays are not supported inside keys"), typeof keyNode == "object" && _class(keyNode[index]) === "[object Object]" && (keyNode[index] = "[object Object]");
+      for (let index = 0, quantity = keyNode.length; index < quantity; index += 1) Array.isArray(keyNode[index]) && throwError(state, "nested arrays are not supported inside keys"), typeof keyNode == "object" && _class(keyNode[index]) === "[object Object]" && (keyNode[index] = "[object Object]");
     }
     if (typeof keyNode == "object" && _class(keyNode) === "[object Object]" && (keyNode = "[object Object]"), keyNode = String(keyNode), _result === null && (_result = {}), keyTag === "tag:yaml.org,2002:merge") if (Array.isArray(valueNode)) {
       valueNode.length > 100 && throwError(state, "abnormal merge sequence size");
-      for (let index = 0, quantity2 = valueNode.length; index < quantity2; index += 1) mergeMappings(state, _result, valueNode[index], overridableKeys);
+      for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) mergeMappings(state, _result, valueNode[index], overridableKeys);
     } else mergeMappings(state, _result, valueNode, overridableKeys);
     else !state.json && !_hasOwnProperty.call(overridableKeys, keyNode) && _hasOwnProperty.call(_result, keyNode) && (state.line = startLine || state.line, state.lineStart = startLineStart || state.lineStart, state.position = startPos || state.position, throwError(state, "duplicated mapping key")), setProperty(_result, keyNode, valueNode), delete overridableKeys[keyNode];
     return _result;
@@ -8200,8 +8293,8 @@ function validateConfig(config, source = "task.yaml", payloadLimit2 = PAYLOAD_LI
   let run2 = config.run;
   if (run2) {
     run2.preset !== void 0 && (typeof run2.preset != "string" || run2.preset.trim() === "") ? errors.push(MESSAGES.PRESET_INVALID) : run2.preset !== void 0 && !isKnownPreset(run2.preset) && errors.push(MESSAGES.PRESET_UNKNOWN(source, run2.preset, PRESET_NAMES)), run2.timeout_sec !== void 0 && !(typeof run2.timeout_sec == "number" && run2.timeout_sec > 0) && errors.push(MESSAGES.TIMEOUT_INVALID);
-    let bytes2 = run2.payload === void 0 ? 0 : payloadBytes(run2.payload);
-    bytes2 > payloadLimit2 && errors.push(MESSAGES.DEFAULT_PAYLOAD_OVER_LIMIT(source, bytes2, payloadLimit2));
+    let bytes = run2.payload === void 0 ? 0 : payloadBytes(run2.payload);
+    bytes > payloadLimit2 && errors.push(MESSAGES.DEFAULT_PAYLOAD_OVER_LIMIT(source, bytes, payloadLimit2));
   }
   let resolved = resolveNature(config.execution, PLATFORM_DEFAULT_NATURE);
   return resolved.ok ? warnings.push(...resolved.warnings) : errors.push(resolved.error), { ok: errors.length === 0, errors, warnings };
@@ -8223,26 +8316,26 @@ function checkTaskConfigText(text, source) {
   return errors.push(...shared.errors), errors.length > 0 ? { ok: false, errors, warnings: shared.warnings } : { ok: true, config, errors, warnings: shared.warnings };
 }
 function slugDirRefusal(slug2, taskDir) {
-  let dirName = import_node_path2.default.basename(taskDir);
+  let dirName = import_node_path3.default.basename(taskDir);
   return slug2 === dirName ? null : `task.yaml slug "${slug2}" must match the task directory name "${dirName}". Every local lookup names the task by its directory, but runs dispatch by slug. Set slug: "${dirName}" or rename the directory.`;
 }
 function findTaskConfigFile(taskDir) {
-  let name = import_node_fs3.default.existsSync(taskDir) ? rootConfigName(import_node_fs3.default.readdirSync(taskDir)) : null;
-  return name === null ? null : import_node_path2.default.join(taskDir, name);
+  let name = import_node_fs4.default.existsSync(taskDir) ? rootConfigName(import_node_fs4.default.readdirSync(taskDir)) : null;
+  return name === null ? null : import_node_path3.default.join(taskDir, name);
 }
 function readTaskConfigFile(taskDir) {
   let file = findTaskConfigFile(taskDir);
   if (!file) return { ok: false, file: null, errors: [`No ${TASK_CONFIG_FILENAMES.join(" / ")} found in ${taskDir}`], warnings: [] };
-  let parsed = checkTaskConfigText(import_node_fs3.default.readFileSync(file, "utf8"), import_node_path2.default.basename(file)), slugError = parsed.ok ? slugDirRefusal(parsed.config.slug, taskDir) : null;
+  let parsed = checkTaskConfigText(import_node_fs4.default.readFileSync(file, "utf8"), import_node_path3.default.basename(file)), slugError = parsed.ok ? slugDirRefusal(parsed.config.slug, taskDir) : null;
   return slugError !== null ? { ok: false, file, errors: [slugError], warnings: parsed.warnings } : { ...parsed, file };
 }
 function resolvedEntry(config) {
   return config.entry ?? RUNTIME_REGISTRY[config.runtime].entryFile;
 }
-var import_node_fs3, import_node_path2, init_task_config3 = __esm({ "src/io/task-config.ts"() {
+var import_node_fs4, import_node_path3, init_task_config3 = __esm({ "src/io/task-config.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs3 = __toESM(require("node:fs"), 1), import_node_path2 = __toESM(require("node:path"), 1);
+  import_node_fs4 = __toESM(require("node:fs"), 1), import_node_path3 = __toESM(require("node:path"), 1);
   init_tenant();
   init_task_config2();
   init_validate2();
@@ -8256,7 +8349,7 @@ function readTaskFolders(baseDir) {
     try {
       return { dir, state: readState(dir) };
     } catch (e) {
-      throw new Error(`cannot read ${taskLinkPath(dir)}: ${errorMessage(e)}`, { cause: e });
+      throw new Error(`cannot read ${taskLinkPath(dir)}: ${errText(e)}`, { cause: e });
     }
   }) : [];
 }
@@ -8279,7 +8372,7 @@ async function prepareTask(args, cwd, taskId = requiredArg(args)) {
     for (let e of read.errors) fail(e);
     return null;
   }
-  return { taskDir, config: read.config, warnings: read.warnings };
+  return { taskDir, config: read.config, slug: read.config.slug ?? import_path2.default.basename(taskDir), warnings: read.warnings };
 }
 var import_fs2, import_path2, init_task_path = __esm({ "src/io/task-path.ts"() {
   "use strict";
@@ -8290,7 +8383,7 @@ var import_fs2, import_path2, init_task_path = __esm({ "src/io/task-path.ts"() {
   init_output();
   init_constants();
   init_args2();
-  init_guard();
+  init_tenant();
 } });
 function compile(body, anchored) {
   let segs = body.split("/");
@@ -8337,11 +8430,11 @@ var UNSUPPORTED_CHARS, escapeRegex, segmentSource, init_ignore_file = __esm({ "s
 } });
 function scanSourceTree(root, maxBytes = UPLOAD_MAX_BYTES, ignoreRules = []) {
   let entries = [], data = /* @__PURE__ */ new Map(), errors = [], warnings = [], ignored = [], totalBytes = 0, over = false;
-  if (!import_node_fs4.default.existsSync(root)) return { entries, data, errors: [`Task directory does not exist: ${root}`], warnings, ignored, totalBytes, truncated: false };
+  if (!import_node_fs5.default.existsSync(root)) return { entries, data, errors: [`Task directory does not exist: ${root}`], warnings, ignored, totalBytes, truncated: false };
   let walk = (dir) => {
-    for (let dirent of import_node_fs4.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1)) {
+    for (let dirent of import_node_fs5.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1)) {
       if (over) return;
-      let abs = import_node_path3.default.join(dir, dirent.name), rel = import_node_path3.default.relative(root, abs).split(import_node_path3.default.sep).join("/"), skip = excludeReason(rel);
+      let abs = import_node_path4.default.join(dir, dirent.name), rel = import_node_path4.default.relative(root, abs).split(import_node_path4.default.sep).join("/"), skip = excludeReason(rel);
       if (skip) {
         dirent.isDirectory() || warnings.push(`excluded ${rel} \u2014 ${skip}`);
         continue;
@@ -8369,7 +8462,7 @@ function scanSourceTree(root, maxBytes = UPLOAD_MAX_BYTES, ignoreRules = []) {
         errors.push(symlinkRefusal(rel));
         continue;
       }
-      let { fd, st } = opened, bytes2;
+      let { fd, st } = opened, bytes;
       try {
         if (!st.isFile()) {
           errors.push(notRegularRefusal(rel));
@@ -8379,34 +8472,35 @@ function scanSourceTree(root, maxBytes = UPLOAD_MAX_BYTES, ignoreRules = []) {
           over = true, errors.push(`the task directory holds more than ${maxBytes / MIB} MiB of files (reached at ${rel}); the server refuses a larger upload`);
           return;
         }
-        bytes2 = import_node_fs4.default.readFileSync(fd);
+        bytes = import_node_fs5.default.readFileSync(fd);
       } finally {
-        import_node_fs4.default.closeSync(fd);
+        import_node_fs5.default.closeSync(fd);
       }
       if (CREDENTIAL_CHECKED_FILES.includes(dirent.name)) {
-        let cred = credentialReason(rel, bytes2.toString("utf8"));
+        let cred = credentialReason(rel, bytes.toString("utf8"));
         if (cred !== null) {
           errors.push(cred);
           continue;
         }
       }
       let keyWarning = privateKeyFileWarning(rel);
-      keyWarning !== null && warnings.push(keyWarning), entries.push({ path: rel, exec: (st.mode & 73) !== 0, size: bytes2.length, sha256: import_node_crypto2.default.createHash("sha256").update(bytes2).digest("hex") }), data.set(rel, bytes2), totalBytes += bytes2.length;
+      keyWarning !== null && warnings.push(keyWarning), entries.push({ path: rel, exec: (st.mode & 73) !== 0, size: bytes.length, sha256: import_node_crypto3.default.createHash("sha256").update(bytes).digest("hex") }), data.set(rel, bytes), totalBytes += bytes.length;
     }
   };
   return walk(root), { entries, data, errors, warnings, ignored, totalBytes, truncated: over };
 }
 function computeSourceHash(entries, config) {
-  return `sha256:${import_node_crypto2.default.createHash("sha256").update(sourceManifest(entries, config), "utf8").digest("hex")}`;
+  let manifest = checkSourceManifest(entries, config);
+  return manifest.ok ? { ok: true, hash: `sha256:${import_node_crypto3.default.createHash("sha256").update(manifest.text, "utf8").digest("hex")}` } : manifest;
 }
 function checkLockfile(entries, runtime) {
   let required = RUNTIME_REGISTRY[runtime].lockfile;
   return entries.some((e) => e.path === required) ? null : `${required} is missing. A ${runtime} task must upload its lockfile: without one the build is not reproducible and two deployments of the same source can resolve different versions.`;
 }
-var import_node_fs4, import_node_path3, import_node_crypto2, MIB, symlinkRefusal, notRegularRefusal, init_source_tree = __esm({ "src/io/source-tree.ts"() {
+var import_node_fs5, import_node_path4, import_node_crypto3, MIB, symlinkRefusal, notRegularRefusal, init_source_tree = __esm({ "src/io/source-tree.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs4 = __toESM(require("node:fs"), 1), import_node_path3 = __toESM(require("node:path"), 1), import_node_crypto2 = __toESM(require("node:crypto"), 1);
+  import_node_fs5 = __toESM(require("node:fs"), 1), import_node_path4 = __toESM(require("node:path"), 1), import_node_crypto3 = __toESM(require("node:crypto"), 1);
   init_tenant();
   init_ignore_file();
   init_constants();
@@ -8504,8 +8598,8 @@ var NAME_BYTES, MODE_FILE, MODE_EXEC, TYPE_FILE, TYPE_PAX, PAX_HEADER_NAME, TarF
   };
 } });
 function readIgnoreRules(taskDir, protectedPaths) {
-  let file = import_node_path4.default.join(taskDir, IGNORE_FILE);
-  return import_node_fs5.default.existsSync(file) ? parseIgnoreFile(import_node_fs5.default.readFileSync(file, "utf8"), IGNORE_FILE, protectedPaths) : { ok: true, rules: [] };
+  let file = import_node_path5.default.join(taskDir, IGNORE_FILE);
+  return import_node_fs6.default.existsSync(file) ? parseIgnoreFile(import_node_fs6.default.readFileSync(file, "utf8"), IGNORE_FILE, protectedPaths) : { ok: true, rules: [] };
 }
 function checkSourceUpload(taskDir) {
   let read = readTaskConfigFile(taskDir), warnings = [...read.warnings];
@@ -8520,13 +8614,8 @@ function checkSourceUpload(taskDir) {
     scan.entries.some((e) => e.path === entry) || errors.push(`the entry file "${entry}" is not in the upload.`);
   }
   if (errors.length > 0) return { ok: false, errors, warnings };
-  let contentHash;
-  try {
-    contentHash = computeSourceHash(scan.entries, { name: import_node_path4.default.basename(read.file ?? ""), value: config });
-  } catch (e) {
-    return { ok: false, errors: [e.message.replace(/^source manifest: /, "")], warnings };
-  }
-  return { ok: true, source: { config, entries: scan.entries, data: scan.data, totalBytes: scan.totalBytes, ignored: scan.ignored, contentHash }, warnings };
+  let key = computeSourceHash(scan.entries, { name: import_node_path5.default.basename(read.file ?? ""), value: config });
+  return key.ok ? { ok: true, source: { config, entries: scan.entries, data: scan.data, totalBytes: scan.totalBytes, ignored: scan.ignored, contentHash: key.hash }, warnings } : { ok: false, errors: [key.reason], warnings };
 }
 function prepareSourceUpload(taskDir) {
   let check = checkSourceUpload(taskDir);
@@ -8534,10 +8623,10 @@ function prepareSourceUpload(taskDir) {
   let { warnings } = check, { config, entries, data, totalBytes, ignored, contentHash } = check.source, tar = packTarball(entries.map((e) => ({ name: e.path, data: data.get(e.path), exec: e.exec })));
   return { ok: true, upload: { manifest: { contentHash, format: "source", ...config.execution ? { execution: config.execution } : {}, ...config.secrets?.length ? { secrets: [...config.secrets] } : {} }, tar, slug: config.slug, files: entries.length, totalBytes, ignored }, warnings };
 }
-var import_node_fs5, import_node_path4, init_source_upload = __esm({ "src/io/source-upload.ts"() {
+var import_node_fs6, import_node_path5, init_source_upload = __esm({ "src/io/source-upload.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs5 = __toESM(require("node:fs"), 1), import_node_path4 = __toESM(require("node:path"), 1);
+  import_node_fs6 = __toESM(require("node:fs"), 1), import_node_path5 = __toESM(require("node:path"), 1);
   init_tenant();
   init_ignore_file();
   init_constants();
@@ -8798,9 +8887,9 @@ function packagesRoot() {
 }
 function checkoutReader(root = packagesRoot()) {
   return (pkg, rel) => {
-    let abs = import_node_path5.default.join(root, pkg, rel);
+    let abs = import_node_path6.default.join(root, pkg, rel);
     try {
-      return import_node_fs6.default.readFileSync(abs, "utf8");
+      return import_node_fs7.default.readFileSync(abs, "utf8");
     } catch {
       throw new Error(`the runtime client source ${abs} is not readable. A Go or Rust scaffold carries the client from packages/${pkg}, so this CLI must run from a checkout of the repository.`);
     }
@@ -8878,10 +8967,10 @@ function rustScaffoldLock(pkgName, read = clientReader()) {
 `) + `
 `;
 }
-var import_node_fs6, import_node_path5, import_node_sea, import_node_url, VENDOR_DIR, CLIENT_FILES, CARGO_RESERVED, init_vendor = __esm({ "src/scaffold/vendor.ts"() {
+var import_node_fs7, import_node_path6, import_node_sea, import_node_url, VENDOR_DIR, CLIENT_FILES, CARGO_RESERVED, init_vendor = __esm({ "src/scaffold/vendor.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs6 = __toESM(require("node:fs"), 1), import_node_path5 = __toESM(require("node:path"), 1), import_node_sea = __toESM(require("node:sea"), 1), import_node_url = require("node:url"), VENDOR_DIR = "ignitify", CLIENT_FILES = { go: { pkg: "runtime-go", files: ["go.mod", "runtime.go"] }, rust: { pkg: "runtime-rust", files: ["Cargo.toml", "src/lib.rs"] } };
+  import_node_fs7 = __toESM(require("node:fs"), 1), import_node_path6 = __toESM(require("node:path"), 1), import_node_sea = __toESM(require("node:sea"), 1), import_node_url = require("node:url"), VENDOR_DIR = "ignitify", CLIENT_FILES = { go: { pkg: "runtime-go", files: ["go.mod", "runtime.go"] }, rust: { pkg: "runtime-rust", files: ["Cargo.toml", "src/lib.rs"] } };
   CARGO_RESERVED = /* @__PURE__ */ new Set(["build", "deps", "examples", "incremental"]);
 } });
 function templateFiles(taskId, runtime, withInit, dirFlag) {
@@ -8906,7 +8995,7 @@ function scaffoldTaskFiles(taskId, taskDir, withInit, dirFlag, runtime = "node")
   try {
     files = templateFiles(taskId, runtime, withInit, dirFlag);
   } catch (e) {
-    return e instanceof Error ? e.message : String(e);
+    return errText(e);
   }
   if (import_fs3.default.existsSync(taskDir)) {
     let clashes = [.../* @__PURE__ */ new Set([...TASK_CONFIG_FILENAMES, ...Object.keys(files)])].filter((f) => import_fs3.default.existsSync(import_path3.default.join(taskDir, f)));
@@ -8926,40 +9015,6 @@ var import_fs3, import_path3, init_scaffold = __esm({ "src/scaffold/index.ts"()
   init_templates();
   init_vendor();
 } });
-function backoffDelayMs(attempt, cadence) {
-  return Math.min(cadence.BASE_MS * 2 ** Math.max(0, attempt), cadence.MAX_MS);
-}
-function isTransientPollError(e) {
-  return e instanceof HttpError ? e.status === 408 || e.status === 429 || e.status >= 500 && e.status <= 599 : e instanceof TypeError ? true : e instanceof Error && e.cause?.name === "TimeoutError";
-}
-function decidePollError(e, failuresInARow, failingForMs) {
-  return isTransientPollError(e) ? failuresInARow >= POLL.ERROR.MIN_TRIES && failingForMs >= POLL.ERROR.GRACE_MS ? "give-up" : "retry" : "give-up";
-}
-async function pollUntil(loop) {
-  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), failures = 0, firstFailureAt = 0;
-  for (let attempt = 0; ; ) {
-    let view;
-    try {
-      view = await loop.fetch();
-    } catch (error) {
-      if (failures === 0 && (firstFailureAt = now()), failures += 1, decidePollError(error, failures, now() - firstFailureAt) === "give-up") return { kind: "lost", error };
-      loop.onRetry?.(error), await sleep(loop.retryDelayMs);
-      continue;
-    }
-    failures = 0, loop.onView?.(view);
-    let action = loop.decide(view, now() - startedAt, attempt);
-    if (!isWait(action)) return { action, view };
-    loop.onWait?.(view, attempt), await sleep(action.delayMs), attempt += 1;
-  }
-}
-var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
-  init_constants();
-  init_utils();
-  isWait = (action) => action.kind === "wait", isLost = (end) => "kind" in end && end.kind === "lost";
-} });
 function decidePoll(status, elapsedMs, attempt, failureReason) {
   return status === READY ? { kind: "ready" } : status === FAILED ? { kind: "failed", reason: failureReason ?? "the build failed without recording a reason" } : status !== BUILDING ? { kind: "failed", reason: `deployment entered an unexpected status: ${status}` } : elapsedMs >= POLL.DEPLOY.TIMEOUT_MS ? { kind: "timeout" } : { kind: "wait", delayMs: nextDelayMs(attempt) };
 }
@@ -9001,14 +9056,14 @@ async function waitForBuild(cfg, deploymentId, progress, reused = false) {
     let view = await getApiDeploymentStatus(cfg, deploymentId);
     return retrying && (retrying = false, progress.update(WAIT.BUILDING(deploymentId), WAIT.HINT_BUILD)), view;
   }, fetchLog: async () => {
-    let { bytes: bytes2 } = await getApiDeploymentLogs(cfg, deploymentId);
-    return typeof bytes2 == "string" && bytes2 !== "" ? bytes2 : null;
+    let { bytes } = await getApiDeploymentLogs(cfg, deploymentId);
+    return typeof bytes == "string" && bytes !== "" ? bytes : null;
   }, onBuilding: () => {
     building = true, progress.update(WAIT.BUILDING(deploymentId), WAIT.HINT_BUILD);
   }, onRetry: () => {
     retrying = true, progress.update(WAIT.BUILDING(deploymentId), WAIT.HINT_RETRYING);
   } }));
-  if (built.kind === "lost") return progress.fail(WAIT.LOST), fail(WAIT.LOST_BUILD_DETAIL(deploymentId, errorMessage(built.error))), 1;
+  if (built.kind === "lost") return progress.fail(WAIT.LOST), fail(WAIT.LOST_BUILD_DETAIL(deploymentId, errText(built.error))), 1;
   if (built.kind === "failed") {
     if (progress.fail(WAIT.BUILD_FAILED), fail(WAIT.BUILD_FAILED_DETAIL(deploymentId, built.reason)), built.log) {
       let st = errStyle();
@@ -9024,7 +9079,7 @@ async function waitForRun(cfg, runId) {
   let progress = startProgress(WAIT.RUN_SUBMITTED(runId)), lastStatus, settled = await withInterruptNotice(progress, () => WAIT.INTERRUPTED_RUN(runId), () => pollUntilSettled({ fetchRun: () => getApiRun(cfg, runId), onStatus: (status) => {
     lastStatus = status, progress.update(WAIT.RUN(runId, status), WAIT.HINT_RUN);
   }, onRetry: () => progress.update(lastStatus === void 0 ? WAIT.RUN_SUBMITTED(runId) : WAIT.RUN(runId, lastStatus), WAIT.HINT_RETRYING) }));
-  if (isLost(settled)) return progress.fail(WAIT.LOST), fail(WAIT.LOST_RUN_DETAIL(runId, errorMessage(settled.error))), 1;
+  if (isLost(settled)) return progress.fail(WAIT.LOST), fail(WAIT.LOST_RUN_DETAIL(runId, errText(settled.error))), 1;
   let { action, run: run2 } = settled;
   if (action.kind === "timeout") return progress.fail(WAIT.RUN_TIMEOUT(action.status)), warn(WAIT.RUN_TIMEOUT_DETAIL(runId)), 1;
   let completed = action.status === RUN_STATUS.COMPLETED;
@@ -9039,7 +9094,7 @@ var init_wait = __esm({ "src/commands/wait.ts"() {
   init_poll();
   init_output();
   init_constants();
-  init_utils();
+  init_tenant();
 } });
 var MANIFEST_FILE, PACKAGE_SCOPE, RUNTIMES, NETWORK_TYPES, PRESETS, DURATIONS, INTERACTIONS, NAME_PATTERN, CALLBACK_ROUTE_PREFIX, EGRESS_HINT_PATTERN, DNS_LABEL, HOST_PATTERN, HOST_MAX_LENGTH, init_constants3 = __esm({ "../../node_modules/@ignitify-integrations/core/dist/constants.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
@@ -12715,8 +12770,8 @@ var require_parser = __commonJS({ "../../node_modules/yaml/dist/parse/parser.js"
           case "scalar":
           case "single-quoted-scalar":
           case "double-quoted-scalar": {
-            let fs13 = this.flowScalar(this.type);
-            atNextItem || it.value ? (map2.items.push({ start, key: fs13, sep: [] }), this.onKeyLine = true) : it.sep ? this.stack.push(fs13) : (Object.assign(it, { key: fs13, sep: [] }), this.onKeyLine = true);
+            let fs14 = this.flowScalar(this.type);
+            atNextItem || it.value ? (map2.items.push({ start, key: fs14, sep: [] }), this.onKeyLine = true) : it.sep ? this.stack.push(fs14) : (Object.assign(it, { key: fs14, sep: [] }), this.onKeyLine = true);
             return;
           }
           default: {
@@ -12805,8 +12860,8 @@ var require_parser = __commonJS({ "../../node_modules/yaml/dist/parse/parser.js"
           case "scalar":
           case "single-quoted-scalar":
           case "double-quoted-scalar": {
-            let fs13 = this.flowScalar(this.type);
-            !it || it.value ? fc.items.push({ start: [], key: fs13, sep: [] }) : it.sep ? this.stack.push(fs13) : Object.assign(it, { key: fs13, sep: [] });
+            let fs14 = this.flowScalar(this.type);
+            !it || it.value ? fc.items.push({ start: [], key: fs14, sep: [] }) : it.sep ? this.stack.push(fs14) : Object.assign(it, { key: fs14, sep: [] });
             return;
           }
           case "flow-map-end":
@@ -12981,21 +13036,25 @@ var ok, err, init_result2 = __esm({ "../../node_modules/@ignitify-integrations/r
 var init_ctx = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/ctx.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
 } });
-var SECRET_NAME_PATTERN, init_secrets = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/secrets.js"() {
+var SECRET_NAME_MAX_LENGTH, SECRET_NAME_PATTERN, init_secrets = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/secrets.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_result2();
-  SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+  SECRET_NAME_MAX_LENGTH = 64, SECRET_NAME_PATTERN = new RegExp(`^[A-Z][A-Z0-9_]{0,${SECRET_NAME_MAX_LENGTH - 1}}$`);
 } });
 var ROUTE_PREFIX_PATTERN, init_platform = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/platform.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   ROUTE_PREFIX_PATTERN = "^/[a-z0-9._~-]+(/[a-z0-9._~-]+)*/$";
 } });
+var init_stop = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/stop.js"() {
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
 var init_dist = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/index.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_result2();
   init_ctx();
   init_secrets();
   init_platform();
+  init_stop();
 } });
 var list, MANIFEST_MESSAGES, PLAN_MESSAGES, COVERAGE_MESSAGES, init_messages = __esm({ "../../node_modules/@ignitify-integrations/core/dist/messages.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
@@ -13006,7 +13065,7 @@ var nonEmptyString, uniqueStrings, closed, network, MANIFEST_SCHEMA, init_schema
   init_define_IGNITIFY_CLIENT_FILES();
   init_dist();
   init_constants3();
-  nonEmptyString = { type: "string", minLength: 1 }, uniqueStrings = { type: "array", items: nonEmptyString, uniqueItems: true }, closed = (properties, required = []) => ({ type: "object", additionalProperties: false, properties, required }), network = closed({ type: { enum: NETWORK_TYPES }, egress_allow: { type: "array", items: { type: "string", minLength: 1, maxLength: HOST_MAX_LENGTH }, uniqueItems: true, maxItems: 32 }, egress_hint: { type: "string", minLength: 1, maxLength: 200, pattern: EGRESS_HINT_PATTERN }, inbound_port: { type: "integer", minimum: 1024, maximum: 65535 }, inbound_routes: { type: "array", minItems: 1, items: closed({ prefix: { type: "string", pattern: ROUTE_PREFIX_PATTERN } }, ["prefix"]) }, inbound_max_concurrent: { type: "integer", minimum: 1 } }, ["type"]), MANIFEST_SCHEMA = { $schema: "https://json-schema.org/draft/2020-12/schema", title: "ignitify integration manifest", ...closed({ schema_version: { const: 1 }, name: { type: "string", pattern: NAME_PATTERN }, runtimes: { type: "array", items: { enum: RUNTIMES }, minItems: 1, uniqueItems: true }, secrets: { type: "array", items: { type: "string", pattern: SECRET_NAME_PATTERN.source }, uniqueItems: true }, network, execution: closed({ duration: { enum: DURATIONS }, interaction: { enum: INTERACTIONS } }), system_packages: uniqueStrings, min_preset: { enum: PRESETS } }, ["schema_version", "name", "runtimes"]) };
+  nonEmptyString = { type: "string", minLength: 1 }, uniqueStrings = { type: "array", items: nonEmptyString, uniqueItems: true }, closed = (properties, required = []) => ({ type: "object", additionalProperties: false, properties, required }), network = closed({ type: { enum: NETWORK_TYPES }, egress_allow: { type: "array", items: { type: "string", minLength: 1, maxLength: HOST_MAX_LENGTH }, uniqueItems: true, maxItems: 32 }, egress_hint: { type: "string", minLength: 1, maxLength: 200, pattern: EGRESS_HINT_PATTERN }, inbound_port: { type: "integer", minimum: 1024, maximum: 65535 }, inbound_routes: { type: "array", minItems: 1, maxItems: 32, items: closed({ prefix: { type: "string", maxLength: 256, pattern: ROUTE_PREFIX_PATTERN } }, ["prefix"]) }, inbound_max_concurrent: { type: "integer", minimum: 1 } }, ["type"]), MANIFEST_SCHEMA = { $schema: "https://json-schema.org/draft/2020-12/schema", title: "ignitify integration manifest", ...closed({ schema_version: { const: 1 }, name: { type: "string", pattern: NAME_PATTERN }, runtimes: { type: "array", items: { enum: RUNTIMES }, minItems: 1, uniqueItems: true }, secrets: { type: "array", items: { type: "string", maxLength: SECRET_NAME_MAX_LENGTH, pattern: SECRET_NAME_PATTERN.source }, uniqueItems: true }, network, execution: closed({ duration: { enum: DURATIONS }, interaction: { enum: INTERACTIONS } }), system_packages: uniqueStrings, min_preset: { enum: PRESETS } }, ["schema_version", "name", "runtimes"]) };
 } });
 var import__2, import_yaml, INBOUND_KEYS, EGRESS_KEYS, ROOT_PATH, NUMERIC_LABEL, validate, isHostName, loadYaml, formatError, semanticIssues, parseManifest, init_manifest = __esm({ "../../node_modules/@ignitify-integrations/core/dist/manifest.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
@@ -13041,7 +13100,7 @@ var packageName, hasCode, rank, maxOf, union, optional, init_utils2 = __esm({ ".
   init_constants3();
   packageName = (name) => `${PACKAGE_SCOPE}/${name}`, hasCode = (packageJson) => typeof packageJson == "object" && packageJson !== null && "exports" in packageJson, rank = (order, value) => order.indexOf(value), maxOf = (order, a, b) => rank(order, a) >= rank(order, b) ? a : b, union = (a, b) => [.../* @__PURE__ */ new Set([...a, ...b])], optional = (key, value) => value === void 0 ? {} : { [key]: value };
 } });
-var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes, egressFor, networkFor, presetFor, planAdd, coverageIssues, checkCoverage, init_plan = __esm({ "../../node_modules/@ignitify-integrations/core/dist/plan.js"() {
+var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, prefixOf, unionRoutes, egressFor, networkFor, presetFor, planAdd, coverageIssues, checkCoverage, init_plan = __esm({ "../../node_modules/@ignitify-integrations/core/dist/plan.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_dist();
   init_constants3();
@@ -13050,7 +13109,7 @@ var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes,
   EXECUTION_FIELDS = ["duration", "interaction"], INBOUND_FIELDS = ["inbound_port", "inbound_max_concurrent"], needsOf = (manifest) => ({ hosts: manifest.network?.egress_allow ?? [], secrets: manifest.secrets ?? [], networkType: manifest.network?.type ?? "none", inbound_port: manifest.network?.inbound_port, inbound_max_concurrent: manifest.network?.inbound_max_concurrent, inboundRoutes: manifest.network?.inbound_routes ?? [], execution: manifest.execution ?? {}, systemPackages: manifest.system_packages ?? [], minPreset: manifest.min_preset }), planHeadline = (manifest, version2, hasCode2) => {
     let packages = manifest.system_packages ?? [];
     return [`${packageName(manifest.name)}@${version2}`, hasCode2 ? PLAN_MESSAGES.settingsAndCode : PLAN_MESSAGES.settingsOnly, ...packages.length > 0 ? [PLAN_MESSAGES.runs(packages)] : []].join(" \xB7 ");
-  }, pick = (field, current, wanted, label) => wanted === void 0 || current === wanted ? { value: current } : current === void 0 ? { value: wanted } : { value: current, conflict: PLAN_MESSAGES.conflict(field, current, wanted, label) }, unionRoutes = (current, wanted) => [...current, ...wanted.filter((route2) => !current.some((have) => have.prefix === route2.prefix))], egressFor = (current, needs, notes) => {
+  }, pick = (field, current, wanted, label) => wanted === void 0 || current === wanted ? { value: current } : current === void 0 ? { value: wanted } : { value: current, conflict: PLAN_MESSAGES.conflict(field, current, wanted, label) }, prefixOf = (route2) => "prefix" in route2 ? route2.prefix : void 0, unionRoutes = (current, wanted) => [...current, ...wanted.filter((route2) => !current.some((have) => prefixOf(have) === route2.prefix))], egressFor = (current, needs, notes) => {
     if (current?.egress_allow !== void 0) return union(current.egress_allow, needs.hosts);
     if ((current?.type ?? "none") !== "none") {
       needs.hosts.length > 0 && notes.push(PLAN_MESSAGES.egressAnywhere(needs.hosts));
@@ -13088,7 +13147,7 @@ var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes,
     }), ...INBOUND_FIELDS.flatMap((field) => {
       let need = needs[field];
       return need === void 0 || network2?.[field] === need ? [] : [COVERAGE_MESSAGES.fieldMismatch(label, `execution.network.${field}`, network2?.[field], need)];
-    }), ...needs.inboundRoutes.filter((route2) => !routes.some((present) => present.prefix === route2.prefix)).map((route2) => COVERAGE_MESSAGES.routeMissing(label, route2.prefix)), ...needs.systemPackages.filter((name) => !packages.includes(name)).map((name) => COVERAGE_MESSAGES.packageMissing(label, name)), ...needs.minPreset !== void 0 && (preset === void 0 || presetRank >= 0 && presetRank < rank(PRESETS, needs.minPreset)) ? [COVERAGE_MESSAGES.presetTooSmall(label, preset, needs.minPreset)] : []];
+    }), ...needs.inboundRoutes.filter((route2) => !routes.some((present) => prefixOf(present) === route2.prefix)).map((route2) => COVERAGE_MESSAGES.routeMissing(label, route2.prefix)), ...needs.systemPackages.filter((name) => !packages.includes(name)).map((name) => COVERAGE_MESSAGES.packageMissing(label, name)), ...needs.minPreset !== void 0 && (preset === void 0 || presetRank >= 0 && presetRank < rank(PRESETS, needs.minPreset)) ? [COVERAGE_MESSAGES.presetTooSmall(label, preset, needs.minPreset)] : []];
   }, checkCoverage = (config, manifests) => manifests.flatMap((manifest) => coverageIssues(config, packageName(manifest.name), needsOf(manifest)));
 } });
 var init_dist2 = __esm({ "../../node_modules/@ignitify-integrations/core/dist/index.js"() {
@@ -13105,31 +13164,38 @@ function diffLines(before, after, path12 = []) {
     let had = Array.isArray(before) ? before : [], added = after.filter((item) => !had.some((old2) => (0, import_node_util.isDeepStrictEqual)(old2, item)));
     return added.length > 0 ? [`+ ${here}: ${added.map(itemText).join(", ")}`] : [];
   }
-  if (!isPlainObject(after)) return before === void 0 || (0, import_node_util.isDeepStrictEqual)(before, after) || INTEGRATION.NOTED_FIELDS.includes(here) ? [] : [`${here}: ${String(before)} -> ${String(after)}`];
-  let old = isPlainObject(before) ? before : {}, newScalars = [], nested = [];
+  if (!isRecord(after)) return before === void 0 || (0, import_node_util.isDeepStrictEqual)(before, after) || INTEGRATION.NOTED_FIELDS.includes(here) ? [] : [`${here}: ${String(before)} -> ${String(after)}`];
+  let old = isRecord(before) ? before : {}, newScalars = [], nested = [];
   for (let [key, value] of Object.entries(after)) {
     let fieldPath = [...path12, key];
-    old[key] === void 0 && !Array.isArray(value) && !isPlainObject(value) ? INTEGRATION.NOTED_FIELDS.includes(fieldPath.join(".")) || newScalars.push(`${key} ${String(value)}`) : nested.push(...diffLines(old[key], value, fieldPath));
+    old[key] === void 0 && !Array.isArray(value) && !isRecord(value) ? INTEGRATION.NOTED_FIELDS.includes(fieldPath.join(".")) || newScalars.push(`${key} ${String(value)}`) : nested.push(...diffLines(old[key], value, fieldPath));
   }
   return [...newScalars.length > 0 ? [`+ ${here}: ${newScalars.join(", ")}`] : [], ...nested];
 }
 function planIntegrationAdd(config, manifest, version2, hasCode2) {
-  let before = asCoreConfig(config), headline = planHeadline(manifest, version2, hasCode2), outcome = planAdd(before, manifest);
+  let headline = planHeadline(manifest, version2, hasCode2), outcome = planAdd(config, manifest);
   if (!outcome.ok) return { ok: false, headline, refusals: outcome.error };
   let after = outcome.value.config;
-  return { ok: true, headline, changes: [...outcome.value.notes, ...diffLines(before, after)], youAdd: outcome.value.youAdd, config: after, changed: !(0, import_node_util.isDeepStrictEqual)(before, after) };
+  return { ok: true, headline, changes: [...outcome.value.notes, ...diffLines(config, after)], youAdd: outcome.value.youAdd, config: after, changed: !(0, import_node_util.isDeepStrictEqual)(config, after) };
 }
 function renderAddPlan(plan) {
   return [plan.headline, ...plan.changes.map((line) => `  ${line}`), ...plan.youAdd.length > 0 ? [INTEGRATION.YOU_ADD, ...plan.youAdd.map((line) => `  ${line}`)] : []];
 }
-var import_node_util, asCoreConfig, isPlainObject, itemText, init_integration_plan = __esm({ "src/core/integration-plan.ts"() {
+var import_node_util, itemText, init_integration_plan = __esm({ "src/core/integration-plan.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_node_util = require("node:util");
   init_dist2();
+  init_tenant();
   init_constants();
-  asCoreConfig = (config) => config, isPlainObject = (v) => typeof v == "object" && v !== null && !Array.isArray(v), itemText = (item) => isPlainObject(item) && typeof item.prefix == "string" ? item.prefix : typeof item == "string" ? item : JSON.stringify(item);
+  itemText = (item) => isRecord(item) && typeof item.prefix == "string" ? item.prefix : isRecord(item) && typeof item.path == "string" ? item.path : typeof item == "string" ? item : JSON.stringify(item);
 } });
+function assessIntegrations(installed, config) {
+  let missing = installed.filter((entry) => entry.read.kind === "missing").map((entry) => entry.pkg);
+  if (missing.length > 0) return { ok: false, missing };
+  let integrations = installed.flatMap(({ pkg, read }) => read.kind === "installed" ? [{ pkg, version: read.version, manifest: parseManifest(read.manifestText) }] : []), manifests = integrations.flatMap(({ manifest }) => manifest.ok ? [manifest.value] : []);
+  return { ok: true, errors: [...integrations.flatMap(({ pkg, manifest }) => manifest.ok ? [] : manifest.error.map((issue) => INTEGRATION.BAD_MANIFEST(pkg, issue))), ...checkCoverage(config, manifests)], versions: integrations.map(({ pkg, version: version2 }) => ({ pkg, version: version2 })) };
+}
 function integrationDeps(packageJson) {
   let deps = packageJson?.dependencies;
   return typeof deps != "object" || deps === null ? [] : Object.keys(deps).filter((name) => name.startsWith(`${PACKAGE_SCOPE}/`));
@@ -13151,7 +13217,7 @@ var init_integration_coverage = __esm({ "src/core/integration-coverage.ts"() {
 function patch(doc, before, after, path12) {
   if ((0, import_node_util2.isDeepStrictEqual)(before, after)) return;
   let node = path12.length === 0 ? doc.contents : doc.getIn(path12, true);
-  if (isPlainObject2(after) && isPlainObject2(before) && (0, import_yaml2.isMap)(node)) {
+  if (isRecord(after) && isRecord(before) && (0, import_yaml2.isMap)(node)) {
     for (let [key, value] of Object.entries(after)) patch(doc, before[key], value, [...path12, key]);
     return;
   }
@@ -13159,7 +13225,7 @@ function patch(doc, before, after, path12) {
     for (let item of after.slice(before.length)) node.add(doc.createNode(item));
     return;
   }
-  (0, import_yaml2.isScalar)(node) && !Array.isArray(after) && !isPlainObject2(after) ? node.value = after : doc.setIn(path12, doc.createNode(after));
+  (0, import_yaml2.isScalar)(node) && !Array.isArray(after) && !isRecord(after) ? node.value = after : doc.setIn(path12, doc.createNode(after));
 }
 function renderTaskConfigText(text, before, after, isJson) {
   if ((0, import_node_util2.isDeepStrictEqual)(before, after)) return text;
@@ -13168,10 +13234,11 @@ function renderTaskConfigText(text, before, after, isJson) {
   let doc = (0, import_yaml2.parseDocument)(text, { schema: "core" });
   return patch(doc, before, after, []), doc.toString({ flowCollectionPadding: false });
 }
-var import_node_util2, import_yaml2, isPlainObject2, init_task_yaml_edit = __esm({ "src/core/task-yaml-edit.ts"() {
+var import_node_util2, import_yaml2, init_task_yaml_edit = __esm({ "src/core/task-yaml-edit.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_util2 = require("node:util"), import_yaml2 = __toESM(require_dist(), 1), isPlainObject2 = (v) => typeof v == "object" && v !== null && !Array.isArray(v);
+  import_node_util2 = require("node:util"), import_yaml2 = __toESM(require_dist(), 1);
+  init_tenant();
 } });
 function integrationPackage(manifestText, packageJson) {
   if (manifestText === null) return { kind: "not-integration" };
@@ -13180,25 +13247,25 @@ function integrationPackage(manifestText, packageJson) {
 }
 function readInstalledPackage(taskDir, pkg) {
   let dir = packageDir(taskDir, pkg);
-  if (!import_node_fs7.default.existsSync(dir)) return { kind: "missing" };
-  let manifestFile = import_node_path6.default.join(dir, MANIFEST_FILE);
-  return import_node_fs7.default.existsSync(manifestFile) ? integrationPackage(readText(manifestFile), readJson(import_node_path6.default.join(dir, INTEGRATION.PACKAGE_JSON))) : { kind: "not-integration" };
+  if (!import_node_fs8.default.existsSync(dir)) return { kind: "missing" };
+  let manifestFile = import_node_path7.default.join(dir, MANIFEST_FILE);
+  return import_node_fs8.default.existsSync(manifestFile) ? integrationPackage(readText(manifestFile), readJson(import_node_path7.default.join(dir, INTEGRATION.PACKAGE_JSON))) : { kind: "not-integration" };
 }
 function readPackedPackage(packDir) {
-  let tarball = import_node_fs7.default.readdirSync(packDir).find((f) => f.endsWith(INTEGRATION.TARBALL_EXT));
+  let tarball = import_node_fs8.default.readdirSync(packDir).find((f) => f.endsWith(INTEGRATION.TARBALL_EXT));
   if (tarball === void 0) return { kind: "missing" };
-  let file = import_node_path6.default.join(packDir, tarball);
+  let file = import_node_path7.default.join(packDir, tarball);
   try {
-    let members = readTar((0, import_node_zlib.gunzipSync)(import_node_fs7.default.readFileSync(file), { maxOutputLength: INTEGRATION.PACKED_MAX_BYTES })), text = (name) => members.find((m) => m.kind === "file" && m.name === `${INTEGRATION.PACKED_ROOT}/${name}`)?.data.toString("utf8") ?? null, packageJson = text(INTEGRATION.PACKAGE_JSON);
+    let members = readTar((0, import_node_zlib.gunzipSync)(import_node_fs8.default.readFileSync(file), { maxOutputLength: INTEGRATION.PACKED_MAX_BYTES })), text = (name) => members.find((m) => m.kind === "file" && m.name === `${INTEGRATION.PACKED_ROOT}/${name}`)?.data.toString("utf8") ?? null, packageJson = text(INTEGRATION.PACKAGE_JSON);
     return integrationPackage(text(MANIFEST_FILE), packageJson === null ? null : JSON.parse(packageJson));
   } catch (e) {
     let tooBig = e.code === INTEGRATION.ZLIB_TOO_BIG;
-    throw new Error(tooBig ? INTEGRATION.PACKED_TOO_BIG(file, INTEGRATION.PACKED_MAX_BYTES) : INTEGRATION.UNREADABLE(file, errorMessage(e)), { cause: e });
+    throw new Error(tooBig ? INTEGRATION.PACKED_TOO_BIG(file, INTEGRATION.PACKED_MAX_BYTES) : INTEGRATION.UNREADABLE(file, errText(e)), { cause: e });
   }
 }
 function readTaskPackageJson(taskDir) {
-  let file = import_node_path6.default.join(taskDir, INTEGRATION.PACKAGE_JSON);
-  return import_node_fs7.default.existsSync(file) ? readJson(file) : null;
+  let file = import_node_path7.default.join(taskDir, INTEGRATION.PACKAGE_JSON);
+  return import_node_fs8.default.existsSync(file) ? readJson(file) : null;
 }
 async function fetchPackument(pkg, fetchImpl = fetch) {
   try {
@@ -13208,19 +13275,11 @@ async function fetchPackument(pkg, fetchImpl = fetch) {
     return { ok: false, reason: INTEGRATION.REGISTRY_UNREACHABLE };
   }
 }
-function writeFileAtomic(file, text) {
-  let target = import_node_fs7.default.realpathSync(file), mode = import_node_fs7.default.statSync(target).mode & 511, name = `.${import_node_path6.default.basename(target)}.${process.pid}.${(0, import_node_crypto3.randomBytes)(6).toString("hex")}.tmp`, tmp = import_node_path6.default.join(import_node_path6.default.dirname(target), name);
-  try {
-    import_node_fs7.default.writeFileSync(tmp, text, { mode, flag: "wx" }), import_node_fs7.default.chmodSync(tmp, mode), import_node_fs7.default.renameSync(tmp, target);
-  } finally {
-    import_node_fs7.default.rmSync(tmp, { force: true });
-  }
-}
 function readText(file) {
   try {
-    return import_node_fs7.default.readFileSync(file, "utf8");
+    return import_node_fs8.default.readFileSync(file, "utf8");
   } catch (e) {
-    throw new Error(INTEGRATION.UNREADABLE(file, errorMessage(e)), { cause: e });
+    throw new Error(INTEGRATION.UNREADABLE(file, errText(e)), { cause: e });
   }
 }
 function readJson(file) {
@@ -13228,19 +13287,23 @@ function readJson(file) {
   try {
     return JSON.parse(text);
   } catch (e) {
-    throw new Error(INTEGRATION.UNREADABLE(file, errorMessage(e)), { cause: e });
+    throw new Error(INTEGRATION.UNREADABLE(file, errText(e)), { cause: e });
   }
 }
-var import_node_child_process2, import_node_crypto3, import_node_fs7, import_node_path6, import_node_zlib, spawnNpm, packageDir, init_integrations = __esm({ "src/io/integrations.ts"() {
+var import_node_child_process2, import_node_fs8, import_node_path7, import_node_zlib, NPM_OUTPUT_MAX_BYTES, npmOutputToShow, spawnNpm, packageDir, init_integrations = __esm({ "src/io/integrations.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_child_process2 = require("node:child_process"), import_node_crypto3 = require("node:crypto"), import_node_fs7 = __toESM(require("node:fs"), 1), import_node_path6 = __toESM(require("node:path"), 1), import_node_zlib = require("node:zlib");
+  import_node_child_process2 = require("node:child_process"), import_node_fs8 = __toESM(require("node:fs"), 1), import_node_path7 = __toESM(require("node:path"), 1), import_node_zlib = require("node:zlib");
   init_dist2();
   init_tar();
   init_constants();
   init_integration_coverage();
-  init_guard();
-  spawnNpm = (cwd, args) => (0, import_node_child_process2.spawnSync)(INTEGRATION.NPM, args, { cwd, stdio: ["ignore", 2, 2] }).status, packageDir = (taskDir, pkg) => import_node_path6.default.join(taskDir, INTEGRATION.NODE_MODULES, ...pkg.split("/"));
+  init_manager();
+  init_tenant();
+  NPM_OUTPUT_MAX_BYTES = 16 * 1024 * 1024, npmOutputToShow = (status, output) => status === 0 ? "" : output, spawnNpm = (cwd, args) => {
+    let r = (0, import_node_child_process2.spawnSync)(INTEGRATION.NPM, args, { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", maxBuffer: NPM_OUTPUT_MAX_BYTES }), shown = npmOutputToShow(r.status, `${r.stdout ?? ""}${r.stderr ?? ""}`);
+    return shown !== "" && tell(shown.trimEnd()), r.status;
+  }, packageDir = (taskDir, pkg) => import_node_path7.default.join(taskDir, INTEGRATION.NODE_MODULES, ...pkg.split("/"));
 } });
 async function runIntegrationAdd(args, cwd = process.cwd(), deps = REAL_INTEGRATION_ADD_DEPS) {
   let name = requiredArg(args);
@@ -13254,16 +13317,17 @@ async function runIntegrationAdd(args, cwd = process.cwd(), deps = REAL_INTEGRAT
   let task = await prepareTask(args, cwd, slug2);
   if (!task) return 1;
   if (printWarnings([...task.warnings]), task.config.runtime !== INTEGRATION.RUNTIME) return fail(INTEGRATION.NOT_NODE(task.config.runtime)), 1;
-  if (readTaskPackageJson(task.taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(task.taskDir)), 1;
+  let taskDir = import_node_fs9.default.realpathSync(task.taskDir);
+  if (readTaskPackageJson(taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(taskDir)), 1;
   let pkg = packageName(name);
-  return guard(() => withPackDir((packDir) => addIntegration(args, task.taskDir, task.config, pkg, packDir, dryRun, deps)));
+  return guard(() => withPackDir((packDir) => addIntegration(args, taskDir, task.config, pkg, packDir, dryRun, deps)));
 }
 async function withPackDir(fn) {
-  let packDir = import_node_fs8.default.mkdtempSync(import_node_path7.default.join(import_node_os3.default.tmpdir(), INTEGRATION.PACK_TMP_PREFIX));
+  let packDir = import_node_fs9.default.mkdtempSync(import_node_path8.default.join(import_node_os3.default.tmpdir(), INTEGRATION.PACK_TMP_PREFIX));
   try {
     return await fn(packDir);
   } finally {
-    import_node_fs8.default.rmSync(packDir, { recursive: true, force: true });
+    import_node_fs9.default.rmSync(packDir, { recursive: true, force: true });
   }
 }
 async function addIntegration(args, taskDir, config, pkg, packDir, dryRun, deps) {
@@ -13288,26 +13352,19 @@ async function addIntegration(args, taskDir, config, pkg, packDir, dryRun, deps)
     if (installCode !== 0) return fail(INTEGRATION.INSTALL_FAILED(spec, installCode)), 1;
     sayOk(INTEGRATION.INSTALLED(spec));
   }
-  return edit === null ? (emit({ ...result, written: false }), 0) : (writeFileAtomic(edit.file, edit.text), sayOk(INTEGRATION.WRITTEN(import_node_path7.default.basename(edit.file))), emit({ ...result, written: true }), 0);
+  return edit === null ? (emit({ ...result, written: false }), 0) : (writeFileAtomic(edit.file, edit.text), sayOk(INTEGRATION.WRITTEN(import_node_path8.default.basename(edit.file))), emit({ ...result, written: true }), 0);
 }
 function taskConfigEdit(taskDir, config, planned) {
   let file = findTaskConfigFile(taskDir);
   if (file === null) throw new Error(INTEGRATION.UNREADABLE(taskDir, "no task.yaml"));
-  let source = import_node_path7.default.basename(file), text = renderTaskConfigText(import_node_fs8.default.readFileSync(file, "utf8"), config, planned, source.endsWith(".json")), check = checkTaskConfigText(text, source);
+  let source = import_node_path8.default.basename(file), text = renderTaskConfigText(import_node_fs9.default.readFileSync(file, "utf8"), config, planned, source.endsWith(".json")), check = checkTaskConfigText(text, source);
   return !check.ok || !(0, import_node_util3.isDeepStrictEqual)(check.config, planned) ? (printErrors(check.errors), fail(INTEGRATION.WRITE_MISMATCH(source)), { ok: false }) : { ok: true, file, text };
 }
 async function checkIntegrations(taskDir, config, fetchImpl) {
   let pkgs = integrationDeps(readTaskPackageJson(taskDir));
   if (pkgs.length === 0) return true;
-  let installed = pkgs.map((pkg) => ({ pkg, read: readInstalledPackage(taskDir, pkg) })), missing = installed.filter((entry) => entry.read.kind === "missing").map((entry) => entry.pkg);
-  if (missing.length > 0) return fail(INTEGRATION.NOT_INSTALLED(missing)), false;
-  let manifests = [], errors = [], versions = [];
-  for (let { pkg, read } of installed) {
-    if (read.kind !== "installed") continue;
-    let manifest = parseManifest(read.manifestText);
-    manifest.ok ? manifests.push(manifest.value) : errors.push(...manifest.error.map((issue) => INTEGRATION.BAD_MANIFEST(pkg, issue))), versions.push({ pkg, version: read.version });
-  }
-  return await warnObsolete(versions, fetchImpl), errors.push(...checkCoverage(asCoreConfig(config), manifests)), printErrors(errors), errors.length === 0;
+  let installed = pkgs.map((pkg) => ({ pkg, read: readInstalledPackage(taskDir, pkg) })), assessed = assessIntegrations(installed, config);
+  return assessed.ok ? (await warnObsolete(assessed.versions, fetchImpl), printErrors(assessed.errors), assessed.errors.length === 0) : (fail(INTEGRATION.NOT_INSTALLED(assessed.missing)), false);
 }
 async function warnObsolete(versions, fetchImpl) {
   let lookups = await Promise.all(versions.map(async (entry) => ({ ...entry, lookup: await fetchPackument(entry.pkg, fetchImpl) }))), skipped = /* @__PURE__ */ new Set();
@@ -13321,16 +13378,17 @@ async function warnObsolete(versions, fetchImpl) {
   }
   for (let reason of skipped) warn(INTEGRATION.OBSOLETE_SKIPPED(reason));
 }
-var import_node_fs8, import_node_os3, import_node_path7, import_node_util3, REAL_INTEGRATION_ADD_DEPS, NAME_RE, init_integration = __esm({ "src/commands/integration.ts"() {
+var import_node_fs9, import_node_os3, import_node_path8, import_node_util3, REAL_INTEGRATION_ADD_DEPS, NAME_RE, init_integration = __esm({ "src/commands/integration.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_node_fs8 = __toESM(require("node:fs"), 1), import_node_os3 = __toESM(require("node:os"), 1), import_node_path7 = __toESM(require("node:path"), 1), import_node_util3 = require("node:util");
+  import_node_fs9 = __toESM(require("node:fs"), 1), import_node_os3 = __toESM(require("node:os"), 1), import_node_path8 = __toESM(require("node:path"), 1), import_node_util3 = require("node:util");
   init_dist2();
   init_constants();
   init_integration_plan();
   init_integration_coverage();
   init_task_yaml_edit();
   init_integrations();
+  init_fs_atomic();
   init_prompt();
   init_task_config3();
   init_task_path();
@@ -13345,24 +13403,24 @@ async function printPackageAdvice(args, config, fetchImpl) {
     let outcome = await postPackageAdvice(apiConfig(args), plan.request, fetchImpl), { lines, fault } = renderAdvice(outcome, screenStyle());
     for (let line of lines) (fault ? tell : say)(line);
   } catch (e) {
-    fail(errorMessage(e));
+    fail(errText(e));
   }
 }
 async function runTaskValidate(args, cwd = process.cwd(), fetchImpl) {
   let task = await prepareTask(args, cwd);
-  return !task || (printWarnings([...task.warnings]), !await checkIntegrations(task.taskDir, task.config, fetchImpl)) ? 1 : (emit({ task_id: task.config.slug ?? import_path4.default.basename(task.taskDir), valid: true }, (st) => successLine(st, VALIDATE.VALID)), boolFlag(args, ADVICE.FLAG) && await printPackageAdvice(args, task.config, fetchImpl), 0);
+  return !task || (printWarnings([...task.warnings]), !await checkIntegrations(task.taskDir, task.config, fetchImpl)) ? 1 : (emit({ task_id: task.slug, valid: true }, (st) => successLine(st, VALIDATE.VALID)), boolFlag(args, ADVICE.FLAG) && await printPackageAdvice(args, task.config, fetchImpl), 0);
 }
 async function runTaskGet(args, cwd = process.cwd()) {
   let task = await prepareTask(args, cwd);
   if (!task) return 1;
-  let slug2 = task.config.slug ?? import_path4.default.basename(task.taskDir), state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(args), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
+  let { slug: slug2 } = task, state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(args), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
   return emit(snakeCaseKeys(report), () => formatTaskReport(report)), 0;
 }
 function offlineTolerantConfig(args) {
   try {
     return apiConfig(args);
   } catch (e) {
-    return warn(RESULT_MESSAGES.TASK_GET_OFFLINE(errorMessage(e))), null;
+    return warn(RESULT_MESSAGES.TASK_GET_OFFLINE(errText(e))), null;
   }
 }
 async function surveyTaskContents(cfg, taskRef) {
@@ -13409,7 +13467,7 @@ async function runTaskRun(args, cwd = process.cwd()) {
   printWarnings([...task.warnings]);
   let opts = parseRunOptions(args, task.config);
   if (!opts.ok) return fail(opts.error), 1;
-  let { run: run2 } = opts, taskName = task.config.slug ?? import_path4.default.basename(task.taskDir), cfg = apiConfig(args);
+  let { run: run2 } = opts, taskName = task.slug, cfg = apiConfig(args);
   if (payloadBytes(run2.payload) > PAYLOAD_LIMIT_FALLBACK_BYTES) {
     let refusal = payloadRefusal(run2.payload, await payloadLimit(cfg));
     if (refusal !== null) return fail(refusal), 1;
@@ -13428,26 +13486,37 @@ async function runTaskRun(args, cwd = process.cwd()) {
     } catch (e) {
       if (isJsonOutput()) throw e;
       let trace = traceLine(e);
-      if (isPayloadTooLarge(errorMessage(e))) return fail(MESSAGES.PAYLOAD_REFUSED_BY_SERVER(await payloadLimit(cfg)), { trace }), 1;
-      let explained = explainRunRefusal(errorMessage(e)) ?? explainLimitRefusal(errorMessage(e));
+      if (isPayloadTooLarge(e)) return fail(MESSAGES.PAYLOAD_REFUSED_BY_SERVER(await payloadLimit(cfg)), { trace }), 1;
+      let explained = explainRunRefusal(e) ?? explainLimitRefusal(e);
       if (!explained) throw e;
       return tell(explained), trace !== null && tell(errStyle().dim(trace)), 1;
     }
-    if (run2.at !== void 0) {
-      if (!res.schedule_id) return fail(res.run_id ? `this server does not support scheduling \u2014 it IGNORED --at and ran the job NOW (run ${res.run_id}). Cancel it with 'ignitify run:cancel ${res.run_id}' if that is not what you wanted.` : "this server does not support scheduling (no schedule_id in the response)."), 1;
-      if (isJsonOutput()) return emit(res), 0;
-      let st = outStyle();
-      out(successLine(st, `Scheduled: ${res.schedule_id} fires at ${res.fires_at ?? run2.at}`)), out(st.dim(`No run exists until it fires. List with 'ignitify schedule:list'; cancel with 'ignitify schedule:cancel ${res.schedule_id}'.`));
-      let scheduledNotices = renderRunNotices(res.notices);
-      scheduledNotices && out(st.yellow(scheduledNotices));
-      let capacity2 = renderCapacity(res.capacity, st);
-      return capacity2 && out(capacity2), 0;
-    }
-    if (!opts.wait || !res.run_id) return CliOutputManager.render("task:run", { ...res }), 0;
-    let notices = isJsonOutput() ? "" : renderRunNotices(res.notices);
-    notices && out(outStyle().yellow(notices));
-    let capacity = isJsonOutput() ? "" : renderCapacity(res.capacity, outStyle());
-    return capacity && out(capacity), waitForRun(cfg, res.run_id);
+    let answer = classifyRunAnswer(res, run2.at, opts.wait);
+    switch (answer.kind) {
+      case "skew-ran-now":
+        return fail(`this server does not support scheduling \u2014 it IGNORED --at and ran the job NOW (run ${answer.runId}). Cancel it with 'ignitify run:cancel ${answer.runId}' if that is not what you wanted.`), 1;
+      case "skew-no-schedule":
+        return fail("this server does not support scheduling (no schedule_id in the response)."), 1;
+      case "scheduled": {
+        if (isJsonOutput()) return emit(res), 0;
+        let st = outStyle();
+        out(successLine(st, `Scheduled: ${answer.scheduleId} fires at ${answer.firesAt}`)), out(st.dim(`No run exists until it fires. List with 'ignitify schedule:list'; cancel with 'ignitify schedule:cancel ${answer.scheduleId}'.`));
+        let scheduledNotices = renderRunNotices(res.notices);
+        scheduledNotices && out(st.yellow(scheduledNotices));
+        let capacity = renderCapacity(res.capacity, st);
+        return capacity && out(capacity), 0;
+      }
+      case "submitted":
+        return CliOutputManager.render("task:run", { ...res }), 0;
+      case "wait": {
+        let notices = isJsonOutput() ? "" : renderRunNotices(res.notices);
+        notices && out(outStyle().yellow(notices));
+        let capacity = isJsonOutput() ? "" : renderCapacity(res.capacity, outStyle());
+        return capacity && out(capacity), waitForRun(cfg, answer.runId);
+      }
+      default:
+        return answer;
+    }
   });
 }
 async function runTaskCreate(args, cwd = process.cwd()) {
@@ -13473,12 +13542,8 @@ async function runTaskCreate(args, cwd = process.cwd()) {
     return CliOutputManager.render("task:create", { ...res, slug: taskId, ...local_dir ? { local_dir } : {} }), say(screenStyle().dim(limitsNote())), 0;
   });
 }
-async function runTaskList(args, _cwd = process.cwd()) {
-  let badLimit = limitRefusal(args);
-  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), data = await listApiTasks(cfg, flagParams(args, PAGE_FLAG_PARAMS));
-    return CliOutputManager.render("task:list", data.tasks), noteNextPage(args, { command: COMMANDS.TASK_LIST, flags: PAGE_FLAG_PARAMS }, data.tasks), 0;
-  });
+function runTaskList(args, _cwd = process.cwd()) {
+  return runPagedList(args, { list: { command: COMMANDS.TASK_LIST, flags: PAGE_FLAG_PARAMS }, fetchPage: listApiTasks, rowsOf: (data) => data.tasks, show: (data) => CliOutputManager.render("task:list", data.tasks) });
 }
 async function runTaskDelete(args, cwd = process.cwd(), prompter = ttyPrompter) {
   let id = requiredArg(args);
@@ -13495,21 +13560,22 @@ async function runTaskDelete(args, cwd = process.cwd(), prompter = ttyPrompter)
       try {
         import_fs4.default.rmSync(link, { recursive: true, force: true }), say(`${MESSAGES.TASK_LINK_REMOVED}: ${link}`);
       } catch (e) {
-        warn(MESSAGES.TASK_LINK_NOT_REMOVED(link, errorMessage(e)));
+        warn(MESSAGES.TASK_LINK_NOT_REMOVED(link, errText(e)));
       }
     }
     return emit({ plan: snakeCaseKeys(plan), deleted: d ?? null }), 0;
   });
 }
-var import_fs4, import_path4, TASK_REPORT_PAGE, init_task = __esm({ "src/commands/task.ts"() {
+var import_fs4, TASK_REPORT_PAGE, init_task = __esm({ "src/commands/task.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  import_fs4 = __toESM(require("fs"), 1), import_path4 = __toESM(require("path"), 1);
+  import_fs4 = __toESM(require("fs"), 1);
   init_prompt();
   init_api();
   init_plan_task_delete();
   init_resolve_deployment();
   init_run_options();
+  init_run_answer();
   init_state();
   init_constants();
   init_payload_limit();
@@ -13527,12 +13593,8 @@ var import_fs4, import_path4, TASK_REPORT_PAGE, init_task = __esm({ "src/command
   init_shared();
   TASK_REPORT_PAGE = 100;
 } });
-async function runDeploymentList(args) {
-  let badLimit = limitRefusal(args);
-  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), data = await listApiDeployments(cfg, flagParams(args, PAGE_FLAG_PARAMS));
-    return CliOutputManager.render("deployment:list", data), noteNextPage(args, { command: COMMANDS.DEPLOYMENT_LIST, flags: PAGE_FLAG_PARAMS }, data.deployments), 0;
-  });
+function runDeploymentList(args) {
+  return runPagedList(args, { list: { command: COMMANDS.DEPLOYMENT_LIST, flags: PAGE_FLAG_PARAMS }, fetchPage: listApiDeployments, rowsOf: (data) => data.deployments, show: (data) => CliOutputManager.render("deployment:list", data) });
 }
 async function runDeploymentGet(args) {
   let id = requireArg(args, "deployment-id");
@@ -13549,7 +13611,7 @@ async function runDeploymentDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "deployment-id");
   return id ? guard(async () => {
     let cfg = apiConfig(args);
-    if (say(`Will soft-delete deployment ${id} and all its runs (cascade).`), !await confirmOrAbort(args, prompter)) return 1;
+    if (say(RESULT_MESSAGES.DEPLOYMENT_DELETE_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await deleteDeployment(cfg, id);
     emit(res);
     let d = res.deleted;
@@ -13577,12 +13639,8 @@ var WHOLE_MS, init_grace = __esm({ "src/core/grace.ts"() {
   init_constants();
   WHOLE_MS = /^\d+$/;
 } });
-async function runRunList(args) {
-  let badLimit = limitRefusal(args);
-  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), data = await listApiRuns(cfg, flagParams(args, RUN_LIST_FLAG_PARAMS));
-    return CliOutputManager.render("run:list", data.runs), noteNextPage(args, { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, data.runs), 0;
-  });
+function runRunList(args) {
+  return runPagedList(args, { list: { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, fetchPage: listApiRuns, rowsOf: (data) => data.runs, show: (data) => CliOutputManager.render("run:list", data.runs) });
 }
 async function runRunGet(args) {
   let id = requireArg(args, "run-id");
@@ -13602,7 +13660,7 @@ async function runRunDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "run-id");
   return id ? guard(async () => {
     let cfg = apiConfig(args);
-    return say(`Will soft-delete run ${id}.`), await confirmOrAbort(args, prompter) ? (emit(await deleteRun(cfg, id)), sayOk(`${MESSAGES.RUN_DELETED}: ${id}`), 0) : 1;
+    return say(RESULT_MESSAGES.RUN_DELETE_PREVIEW(id)), await confirmOrAbort(args, prompter) ? (emit(await deleteRun(cfg, id)), sayOk(`${MESSAGES.RUN_DELETED}: ${id}`), 0) : 1;
   }) : 1;
 }
 async function runRunCancel(args, prompter = ttyPrompter) {
@@ -13613,16 +13671,16 @@ async function runRunCancel(args, prompter = ttyPrompter) {
     let grace = parseGraceMs(strOpt(args, "grace"), force);
     if (!grace.ok) return fail(grace.error), 1;
     let graceMs = grace.graceMs, cfg = apiConfig(args), run2 = await getApiRun(cfg, id);
-    if (run2?.status && isTerminalRunStatus(run2.status)) return emit({ run_id: id, outcome: RUN_CANCEL_OUTCOME.ALREADY_TERMINAL, status: run2.status }), say(`Run ${id} is already ${run2.status} \u2014 nothing to cancel.`), 0;
-    if (say(force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`), !await confirmOrAbort(args, prompter)) return 1;
+    if (run2?.status && isTerminalRunStatus(run2.status)) return emit({ run_id: id, outcome: RUN_CANCEL_OUTCOME.ALREADY_TERMINAL, status: run2.status }), say(RESULT_MESSAGES.RUN_ALREADY_OVER(id, run2.status)), 0;
+    if (say(RESULT_MESSAGES.RUN_CANCEL_PREVIEW(id, force)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await cancelApiRun(cfg, id, force, graceMs);
     emit({ run_id: id, outcome: res?.cancelled?.draining ? RUN_CANCEL_OUTCOME.DRAINING : RUN_CANCEL_OUTCOME.CANCELLED, ...res });
     let prior = res?.cancelled?.prior_state, was = prior ? ` (was ${prior})` : "";
     if (res?.cancelled?.draining) {
       let armed = res.cancelled.grace_ms, window = armed === void 0 ? "" : ` (grace ${armed} ms)`;
-      return say(`Run ${id} is stopping${window}${was} \u2014 still RUNNING until it finishes or the grace expires.`), 0;
+      return say(RESULT_MESSAGES.RUN_STOPPING(id, window, was)), 0;
     }
-    return sayOk(`Run cancelled: ${id}${was}`), 0;
+    return sayOk(RESULT_MESSAGES.RUN_CANCELLED(id, was)), 0;
   });
 }
 var init_run = __esm({ "src/commands/run.ts"() {
@@ -13638,8 +13696,8 @@ var init_run = __esm({ "src/commands/run.ts"() {
 } });
 function decideVmDelete(vm, force, vmId) {
   if (vm.residency === "pinned" && !force) {
-    let ageH = vm.age_ms !== void 0 ? (vm.age_ms / 36e5).toFixed(1) : "?";
-    return { refuse: true, message: `Refusing to delete ${vmId}: this VM is PINNED (permanent standby, alive ${ageH}h).
+    let age = vm.age_ms !== void 0 ? formatDuration(vm.age_ms) : "?";
+    return { refuse: true, message: `Refusing to delete ${vmId}: this VM is PINNED (permanent standby, alive ${age}).
 Deleting it is exactly what "permanent" protects against \u2014 re-run with --force if you mean it.` };
   }
   let pinnedNote = vm.residency === "pinned" ? " (PINNED \u2014 --force given)" : "", busyNote = vm.state === "busy" ? " \u2014 BUSY: its in-flight run will FAIL" : "";
@@ -13648,15 +13706,10 @@ Deleting it is exactly what "permanent" protects against \u2014 re-run with --fo
 var init_decide_vm_delete = __esm({ "src/core/decide-vm-delete.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_output();
 } });
-async function runVmList(args) {
-  let badLimit = limitRefusal(args);
-  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), params = flagParams(args, VM_LIST_FLAG_PARAMS);
-    boolFlag(args, "pinned") && (params.residency = "pinned");
-    let data = await listApiVms(cfg, params);
-    return CliOutputManager.render("vm:list", data), noteNextPage(args, VM_LIST_PAGE, data.vms ?? []), 0;
-  });
+function runVmList(args) {
+  return runPagedList(args, { list: VM_LIST_PAGE, fetchPage: listApiVms, extra: boolFlag(args, "pinned") ? { residency: "pinned" } : {}, rowsOf: (data) => data.vms ?? [], show: (data) => CliOutputManager.render("vm:list", data) });
 }
 async function runVmGet(args) {
   let id = requireArg(args, "vm-id");
@@ -13712,7 +13765,7 @@ async function runSecretDelete(args, prompter = ttyPrompter) {
   let name = args.positionals[0];
   return name ? guard(async () => {
     let cfg = apiConfig(args);
-    if (tell(`Will delete secret ${name}. Its value cannot be read back.`), !await confirmOrAbort(args, prompter)) return 1;
+    if (tell(RESULT_MESSAGES.SECRET_DELETE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await rmSecret(cfg, name);
     return emit(res), sayOk(MESSAGES.SECRET_REMOVED(name)), 0;
   }) : (tell(MESSAGES.SECRET_DELETE_USAGE), 1);
@@ -13739,11 +13792,11 @@ async function runScheduleCancel(args, prompter = ttyPrompter) {
   let id = requireArg(args, "schedule-id");
   return id ? guard(async () => {
     let cfg = apiConfig(args);
-    if (say(`Will cancel schedule ${id} \u2014 it will never fire.`), !await confirmOrAbort(args, prompter)) return 1;
+    if (say(RESULT_MESSAGES.SCHEDULE_CANCEL_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     try {
       await deleteSchedule(cfg, id);
     } catch (e) {
-      if (e instanceof HttpError && e.status === 404) return fail(`Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`), 1;
+      if (e instanceof HttpError && e.status === 404) return fail(RESULT_MESSAGES.SCHEDULE_NOT_CANCELLED(id)), 1;
       throw e;
     }
     return emit({ schedule_id: id, cancelled: true }), sayOk(RESULT_MESSAGES.SCHEDULE_CANCELLED(id)), 0;
@@ -13760,11 +13813,11 @@ var init_schedule = __esm({ "src/commands/schedule.ts"() {
   init_shared();
 } });
 function withAbsoluteUrl(created, baseUrl) {
-  let url = created.url;
+  let { url } = created;
   return typeof url != "string" || !url.startsWith("/") ? created : { ...created, url: `${baseUrl.replace(/\/+$/, "")}${url}` };
 }
 function renderHookCreated(st, created) {
-  let { secret, ...rest } = created, rows = secret === void 0 ? rest : { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
+  let { secret, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
   return `
 ${heading(st, RESULT_MESSAGES.HOOK_CREATED_TITLE, true)}
 ${renderFields(st, rows, void 0, paint2)}
@@ -13775,7 +13828,7 @@ async function runHookCreate(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_CREATE_USAGE), 1;
   let taskName = args.options["task-name"];
   return typeof taskName != "string" || taskName.trim() === "" ? (fail(MESSAGES.HOOK_TASK_NAME_REQUIRED), 1) : guard(async () => {
-    let cfg = apiConfig(args), created = withAbsoluteUrl(asRecord(await createHook(cfg, deploymentId, { task_name: taskName })), cfg.baseUrl);
+    let cfg = apiConfig(args), created = withAbsoluteUrl(await createHook(cfg, deploymentId, { task_name: taskName }), cfg.baseUrl);
     return warn(MESSAGES.HOOK_SECRET_SHOWN_ONCE), tell(MESSAGES.HOOK_PAYLOAD_LIMIT(formatLimit(await payloadLimit(cfg)))), emit(created, (st) => renderHookCreated(st, created)), 0;
   });
 }
@@ -13784,15 +13837,15 @@ async function runHookList(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_LIST_USAGE), 1;
   let badLimit = limitRefusal(args);
   return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), res = asRecord(await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS))), hooks = Array.isArray(res.hooks) ? res.hooks : [];
-    return emit(res, (st) => renderList(hooks, st, EMPTY_LISTS.HOOKS)), noteNextPage(args, { command: COMMANDS.HOOK_LIST, flags: PAGE_FLAG_PARAMS }, hooks), 0;
+    let cfg = apiConfig(args), res = await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS)), hooks = Array.isArray(res.hooks) ? res.hooks : [];
+    return emit(res, (st) => renderList(hooks.map((h) => ({ ...h })), st, EMPTY_LISTS.HOOKS)), noteNextPage(args, { command: COMMANDS.HOOK_LIST, flags: PAGE_FLAG_PARAMS }, hooks), 0;
   });
 }
 async function runHookDelete(args, prompter = ttyPrompter) {
   let hookId = args.positionals[0];
   return hookId ? guard(async () => {
     let cfg = apiConfig(args);
-    return tell(`Will delete webhook ${hookId}. A sender that posts to it is refused from then on.`), await confirmOrAbort(args, prompter) ? (emit(await deleteHook(cfg, hookId)), sayOk(RESULT_MESSAGES.HOOK_DELETED(hookId)), 0) : 1;
+    return tell(RESULT_MESSAGES.HOOK_DELETE_PREVIEW(hookId)), await confirmOrAbort(args, prompter) ? (emit(await deleteHook(cfg, hookId)), sayOk(RESULT_MESSAGES.HOOK_DELETED(hookId)), 0) : 1;
   }) : (tell(MESSAGES.HOOK_DELETE_USAGE), 1);
 }
 async function runNotifySet(args) {
@@ -13801,10 +13854,10 @@ async function runNotifySet(args) {
   if (args.options.secret !== void 0) return fail(MESSAGES.NOTIFY_SECRET_ON_ARGV), 1;
   let refusal = notifySetRefusal(args, url !== void 0, clear);
   if (refusal !== null) return refuseNotifySet(refusal);
-  let secret;
-  return args.options["secret-stdin"] === true && (secret = import_fs6.default.readFileSync(0, "utf8").replace(/\n$/, ""), secret === "") ? refuseNotifySet(MESSAGES.NOTIFY_SECRET_EMPTY) : guard(async () => {
-    let cfg = apiConfig(args), body = { url: clear ? null : url };
-    return secret !== void 0 && (body.secret = secret), emit(await setNotify(cfg, deploymentId, body)), sayOk(body.url === null ? RESULT_MESSAGES.NOTIFY_CLEARED(deploymentId) : RESULT_MESSAGES.NOTIFY_SET(deploymentId, body.url)), 0;
+  let secret = args.options["secret-stdin"] === true ? import_fs6.default.readFileSync(0, "utf8").replace(/\n$/, "") : void 0;
+  return secret === "" ? refuseNotifySet(MESSAGES.NOTIFY_SECRET_EMPTY) : guard(async () => {
+    let cfg = apiConfig(args), target = clear || typeof url != "string" ? null : url;
+    return emit(await setNotify(cfg, deploymentId, { url: target, ...secret !== void 0 ? { secret } : {} })), sayOk(target === null ? RESULT_MESSAGES.NOTIFY_CLEARED(deploymentId) : RESULT_MESSAGES.NOTIFY_SET(deploymentId, target)), 0;
   });
 }
 function notifySetRefusal(args, hasUrl, clear) {
@@ -13814,7 +13867,7 @@ function notifySetRefusal(args, hasUrl, clear) {
 function refuseNotifySet(reason) {
   return fail(reason), tell(MESSAGES.NOTIFY_SET_USAGE), 1;
 }
-var import_fs6, asRecord, init_hook = __esm({ "src/commands/hook.ts"() {
+var import_fs6, init_hook = __esm({ "src/commands/hook.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_fs6 = __toESM(require("fs"), 1);
@@ -13825,7 +13878,6 @@ var import_fs6, asRecord, init_hook = __esm({ "src/commands/hook.ts"() {
   init_utils();
   init_shared();
   init_output();
-  asRecord = (v) => typeof v == "object" && v !== null && !Array.isArray(v) ? v : {};
 } });
 var init_commands = __esm({ "src/commands/index.ts"() {
   "use strict";
@@ -13850,9 +13902,7 @@ function allowedFlags(meta) {
   return { ...meta.flags, ...GLOBAL_FLAGS };
 }
 function parserSpec(meta) {
-  let bools = new Set(Object.keys(GLOBAL_FLAGS));
-  if (meta !== void 0 && meta.secretArgv !== true) for (let [flag, kind] of Object.entries(meta.flags)) kind === "bool" && bools.add(flag);
-  return { boolFlags: bools };
+  return boolFlagSpec(meta === void 0 || meta.secretArgv === true ? GLOBAL_FLAGS : allowedFlags(meta));
 }
 function parseInvocation(argv) {
   return parseArgs([...argv], parserSpec(metaFor(argv[0] ?? "")));
@@ -13893,12 +13943,11 @@ function planInvocation(argv) {
   let refusal = checkInvocation(command, meta, pass);
   return refusal === null ? { kind: "run", command, args } : { kind: "error", message: refusal };
 }
-var looksShort, init_invocation2 = __esm({ "src/core/invocation.ts"() {
+var init_invocation2 = __esm({ "src/core/invocation.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
   init_constants();
-  looksShort = (tok) => tok.length > 1 && tok.startsWith("-") && !tok.startsWith("--");
 } });
 var index_exports = {};
 __export(index_exports, { main: () => main, run: () => run });