ignitify 1.2.1 → 2.0.0

package/ignitify.cjs

@@ -1136,14 +1136,18 @@ function fill(pattern, ...params) {
   if (i !== params.length) throw new Error(`route ${pattern}: takes ${i} parameter(s), given ${params.length}`);
   return out2;
 }
+function isValidIdempotencyKey(key) {
+  return IDEMPOTENCY_KEY_PATTERN.test(key);
+}
 function isTerminalRunStatus(status) {
   return TERMINAL_RUN_STATUSES.includes(status);
 }
-var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, CLI_VERSION_HEADER, TERMINAL_RUN_STATUSES, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
+var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, RETRY_AFTER_HEADER, CLI_VERSION_HEADER, IDEMPOTENCY_KEY_HEADER, IDEMPOTENT_REPLAYED_HEADER, IDEMPOTENCY_KEY_PATTERN, TERMINAL_RUN_STATUSES, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   DOT_SEGMENTS = /* @__PURE__ */ new Set([".", ".."]);
-  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", RUN_LOGS: "/runs/:id/logs", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", CLI_VERSION_HEADER = "X-Ignitify-Cli", TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "CANCELLED"];
+  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", USAGE_SERIES: "/usage/series", RUN_LOGS: "/runs/:id/logs", RUN_TIMELINE: "/runs/:id/timeline", RUN_FAILURES: "/runs/failures", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key", NOTIFICATIONS: "/notifications", USERS: "/users", USER_BY_ID: "/users/:id", GROUPS: "/groups", GROUP_BY_ID: "/groups/:id", GROUP_PERMISSION: "/groups/:id/permissions/:permission", GROUP_USER: "/groups/:id/users/:user", KEYS: "/keys", KEY_BY_ID: "/keys/:id" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), RUN_TIMELINE: (id) => fill(TENANT_ROUTES.RUN_TIMELINE, id), RUN_FAILURES: TENANT_ROUTES.RUN_FAILURES, WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, USAGE_SERIES: TENANT_ROUTES.USAGE_SERIES, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY, NOTIFICATIONS: TENANT_ROUTES.NOTIFICATIONS, USERS: TENANT_ROUTES.USERS, USER_BY_ID: (name) => fill(TENANT_ROUTES.USER_BY_ID, name), GROUPS: TENANT_ROUTES.GROUPS, GROUP_BY_ID: (name) => fill(TENANT_ROUTES.GROUP_BY_ID, name), GROUP_PERMISSION: (name, permission) => fill(TENANT_ROUTES.GROUP_PERMISSION, name, permission), GROUP_USER: (name, user) => fill(TENANT_ROUTES.GROUP_USER, name, user), KEYS: TENANT_ROUTES.KEYS, KEY_BY_ID: (id) => fill(TENANT_ROUTES.KEY_BY_ID, id) }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", RETRY_AFTER_HEADER = "Retry-After", CLI_VERSION_HEADER = "X-Ignitify-Cli", IDEMPOTENCY_KEY_HEADER = "Idempotency-Key", IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed", IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9._:-]{8,255}$/;
+  TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "CANCELLED"];
 } });
 var CALLBACK_PATH_PREFIX, init_callback_path = __esm({ "../../packages/contract/callback-path.ts"() {
   "use strict";
@@ -1158,11 +1162,22 @@ var init_limits = __esm({ "../../packages/contract/limits.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
+var init_currencies = __esm({ "../../packages/contract/currencies.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
 var TASK_CONFIG_FILENAMES, RUNTIME_REGISTRY, RUNTIME_IDS, LIVE_RUNTIME_IDS, isRuntimeId, TASK_CONFIG_AJV_OPTIONS, TASK_CONFIG_SCHEMA, BUILD_REFUSAL_STAGES, BUILD_STAGES, init_task_config = __esm({ "../../packages/contract/task-config.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   TASK_CONFIG_FILENAMES = ["task.yaml", "task.yml", "task.json"], RUNTIME_REGISTRY = Object.freeze({ node: Object.freeze({ entryFile: "index.ts", depManifest: "package.json", lockfile: "package-lock.json", wireRuntime: "node22", status: "live" }), python: Object.freeze({ entryFile: "main.py", depManifest: "requirements.txt", lockfile: "requirements.txt", wireRuntime: "python3.11", status: "live" }), go: Object.freeze({ entryFile: "main.go", depManifest: "go.mod", lockfile: "go.sum", wireRuntime: "go", status: "live" }), rust: Object.freeze({ entryFile: "src/main.rs", depManifest: "Cargo.toml", lockfile: "Cargo.lock", wireRuntime: "rust", status: "live" }) }), RUNTIME_IDS = Object.keys(RUNTIME_REGISTRY), LIVE_RUNTIME_IDS = RUNTIME_IDS.filter((id) => RUNTIME_REGISTRY[id].status === "live"), isRuntimeId = (v) => typeof v == "string" && Object.prototype.hasOwnProperty.call(RUNTIME_REGISTRY, v), TASK_CONFIG_AJV_OPTIONS = Object.freeze({ allErrors: true, strict: true, useDefaults: false }), TASK_CONFIG_SCHEMA = Object.freeze({ $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://ignitify.dev/schemas/task-config/v1.json", title: "Ignitify task configuration", type: "object", required: ["schema_version", "slug", "runtime"], additionalProperties: false, properties: { schema_version: { const: 1 }, slug: { type: "string", minLength: 1 }, runtime: { enum: [...RUNTIME_IDS] }, entry: { type: "string", minLength: 1 }, execution: { type: "object" }, secrets: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, run: { type: "object", additionalProperties: false, properties: { payload: { type: "object" }, preset: { type: "string", minLength: 1 }, timeout_sec: { type: "integer", exclusiveMinimum: 0 } } }, build: { type: "object", additionalProperties: false, properties: { allowed_hosts: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, ship: { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true }, system_packages: { type: "array", items: { type: "string", minLength: 1 } } } } } }), BUILD_REFUSAL_STAGES = ["read", "fetch", "build", "smoke"], BUILD_STAGES = ["done", ...BUILD_REFUSAL_STAGES, "builder", "image", "cap"];
 } });
+function parseJsonText(text) {
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch {
+    return { ok: false };
+  }
+}
 var isRecord, init_wire_json = __esm({ "../../packages/contract/wire-json.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -1244,33 +1259,30 @@ function privateKeyFileWarning(relPath) {
   let base = relPath.slice(relPath.lastIndexOf("/") + 1).toLowerCase();
   return base.endsWith(".pem") || base.endsWith(".key") || base.startsWith("id_rsa") && !base.endsWith(".pub") ? `${relPath} looks like a private key and is uploaded with the task, then stored in the image. If it is a secret, remove it (secrets go through \`secret:set\`); to keep a harmless file out, list it in \`.ignitifyignore\`` : null;
 }
-function sourceManifest(entries, config) {
+function checkSourceManifest(entries, config) {
   let expected = rootConfigName(entries.map((e) => e.path));
-  if ((config?.name ?? null) !== expected) throw new Error(`source manifest: the task config in the key must be ${expected ?? "none"}, not ${config?.name ?? "none"}`);
+  if ((config?.name ?? null) !== expected) return refused(`the task config in the key must be ${expected ?? "none"}, not ${config?.name ?? "none"}`);
   let configLine = [];
   if (config !== null) try {
     configLine = [`config	${config.name}	${configKeyText(config.value)}`];
   } catch (e) {
-    throw new Error(`source manifest: ${config.name}: ${errText(e)}`, { cause: e });
+    return refused(`${config.name}: ${errText(e)}`);
   }
   let seen = /* @__PURE__ */ new Set();
   for (let e of entries) {
-    if (typeof e.path != "string" || e.path === "") throw new Error("source manifest: empty path");
-    if (e.path.includes("\\")) throw new Error(`source manifest: path contains a backslash: ${JSON.stringify(e.path)}. Separators must be normalised to "/" before hashing, or the same tree hashes differently per platform.`);
-    if (e.path.startsWith("/")) throw new Error(`source manifest: absolute path: ${e.path}`);
-    if (!isCanonicalRelativePath(e.path)) throw new Error(`source manifest: non-canonical path: ${e.path}`);
-    if (e.path.includes(`
-`) || e.path.includes("	")) throw new Error(`source manifest: path contains a tab or newline: ${JSON.stringify(e.path)}`);
-    if (!Number.isSafeInteger(e.size) || e.size < 0) throw new Error(`source manifest: bad size for ${e.path}: ${String(e.size)}`);
-    if (!isSha256Hex(e.sha256)) throw new Error(`source manifest: sha256 for ${e.path} must be 64 lowercase hex chars`);
-    if (seen.has(e.path)) throw new Error(`source manifest: duplicate path: ${e.path}`);
+    let bad = entryRefusal(e, seen);
+    if (bad !== null) return refused(bad);
     seen.add(e.path);
   }
   let lines = entries.filter((e) => e.path !== config?.name).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0).map((e) => `${e.exec ? "755" : "644"}	${e.size}	${e.sha256}	${e.path}`);
-  return [`ignitify-source/${SOURCE_MANIFEST_VERSION}`, ...configLine, ...lines, ""].join(`
-`);
+  return { ok: true, text: [`ignitify-source/${SOURCE_MANIFEST_VERSION}`, ...configLine, ...lines, ""].join(`
+`) };
 }
-var SOURCE_MANIFEST_VERSION, RUN_ONLY_CONFIG_KEYS, CONFIG_KEY_TEXT_MAX_BYTES, UPLOAD_MAX_BYTES, CONFIG_KEY_MAX_DEPTH, SOURCE_EXCLUDED_DIRS, SOURCE_EXCLUDED_ROOT_DIRS, SOURCE_EXCLUDED_FILE_PREFIXES, CREDENTIAL_KEYS, CREDENTIAL_CHECKED_FILES, isCanonicalRelativePath, init_source_manifest = __esm({ "../../packages/contract/source-manifest.ts"() {
+function entryRefusal(e, seen) {
+  return typeof e.path != "string" || e.path === "" ? "empty path" : e.path.includes("\\") ? `path contains a backslash: ${JSON.stringify(e.path)}. Separators must be normalised to "/" before hashing, or the same tree hashes differently per platform.` : e.path.startsWith("/") ? `absolute path: ${e.path}` : isCanonicalRelativePath(e.path) ? e.path.includes(`
+`) || e.path.includes("	") ? `path contains a tab or newline: ${JSON.stringify(e.path)}` : !Number.isSafeInteger(e.size) || e.size < 0 ? `bad size for ${e.path}: ${String(e.size)}` : isSha256Hex(e.sha256) ? seen.has(e.path) ? `duplicate path: ${e.path}` : null : `sha256 for ${e.path} must be 64 lowercase hex chars` : `non-canonical path: ${e.path}`;
+}
+var SOURCE_MANIFEST_VERSION, RUN_ONLY_CONFIG_KEYS, CONFIG_KEY_TEXT_MAX_BYTES, UPLOAD_MAX_BYTES, CONFIG_KEY_MAX_DEPTH, SOURCE_EXCLUDED_DIRS, SOURCE_EXCLUDED_ROOT_DIRS, SOURCE_EXCLUDED_FILE_PREFIXES, CREDENTIAL_KEYS, CREDENTIAL_CHECKED_FILES, isCanonicalRelativePath, refused, init_source_manifest = __esm({ "../../packages/contract/source-manifest.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_task_config();
@@ -1279,6 +1291,7 @@ var SOURCE_MANIFEST_VERSION, RUN_ONLY_CONFIG_KEYS, CONFIG_KEY_TEXT_MAX_BYTES, UP
   SOURCE_MANIFEST_VERSION = "v2", RUN_ONLY_CONFIG_KEYS = Object.freeze(["execution", "secrets", "run"]), CONFIG_KEY_TEXT_MAX_BYTES = 64 * 1024, UPLOAD_MAX_BYTES = 64 * 1024 * 1024, CONFIG_KEY_MAX_DEPTH = 64;
   SOURCE_EXCLUDED_DIRS = Object.freeze([".git", ".ignitify", "node_modules", "__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]), SOURCE_EXCLUDED_ROOT_DIRS = Object.freeze(["target", "dist"]), SOURCE_EXCLUDED_FILE_PREFIXES = Object.freeze([".env"]), CREDENTIAL_KEYS = Object.freeze({ ".npmrc": /^[ \t]*(?![#;])[^=\n]*_(?:authToken|auth|password)[ \t]*=[ \t]*(?!\$\{\w+\}[ \t]*$)\S/m, ".yarnrc.yml": /^[ \t]*npmAuth(?:Token|Ident)[ \t]*:[ \t]*(?!["']?\$\{\w+\}["']?[ \t]*$)\S/m }), CREDENTIAL_CHECKED_FILES = Object.freeze(Object.keys(CREDENTIAL_KEYS));
   isCanonicalRelativePath = (p) => !p.startsWith("/") && !p.includes("\\") && p.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+  refused = (reason) => ({ ok: false, reason });
 } });
 function normaliseSystemPackages(declared) {
   return [...new Set(declared)].sort();
@@ -1297,10 +1310,10 @@ var init_package_advice = __esm({ "../../packages/contract/package-advice.ts"()
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
-var USAGE_AXES, USAGE_DETAIL_COMMAND, RESETS_AT_NEXT_RENEWAL, init_usage = __esm({ "../../packages/contract/usage.ts"() {
+var USAGE_AXES, AXIS_UNIT, USAGE_DETAIL_COMMAND, RESETS_AT_NEXT_RENEWAL, init_usage = __esm({ "../../packages/contract/usage.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  USAGE_AXES = ["compute", "network", "network_in", "disk", "scratch", "runs", "pin", "build"], USAGE_DETAIL_COMMAND = "ignitify quota", RESETS_AT_NEXT_RENEWAL = "your next paid renewal";
+  USAGE_AXES = ["compute", "network", "network_in", "disk", "scratch", "runs", "pin", "build"], AXIS_UNIT = { compute: "ms", network: "bytes", network_in: "bytes", disk: "byte-hours", scratch: "byte-hours", runs: "runs", pin: "ms", build: "ms" }, USAGE_DETAIL_COMMAND = "ignitify quota", RESETS_AT_NEXT_RENEWAL = "your next paid renewal";
 } });
 function formatUserCode(code) {
   if (code.length !== 8) return code;
@@ -1319,12 +1332,65 @@ var init_backoff = __esm({ "../../packages/contract/backoff.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
+var init_tenant_account = __esm({ "../../packages/contract/tenant-account.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function retryAfterMs(value, nowMs) {
+  if (value === null || value.trim() === "") return null;
+  let text = value.trim(), ms = /^\d+$/.test(text) ? Number(text) * 1e3 : /[a-z]/i.test(text) ? Date.parse(text) - nowMs : Number.NaN;
+  return Number.isNaN(ms) ? null : Math.min(Math.max(2e3, ms), WEB_POLL.BACKOFF_CEILING_MS);
+}
+var WEB_POLL, NO_TASK_NAME_TEXT, OBS_QUERY, FAILURE_CLASSES, FAILURE_CLASS_TEXT, OBS_REFUSAL, init_tenant_telemetry = __esm({ "../../packages/contract/tenant-telemetry.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  WEB_POLL = { LIVE_MS: 5e3, SUMMARY_MS: 6e4, JITTER: 0.1, BACKOFF_CEILING_MS: 6e4 };
+  NO_TASK_NAME_TEXT = "(no task name)", OBS_QUERY = { CURSOR: "cursor", WAIT_SEC: "wait_sec", FROM_OFFSET: "from_offset", STATUS: "status", DAYS: "days" }, FAILURE_CLASSES = ["task", "limit", "cancelled", "platform"], FAILURE_CLASS_TEXT = { task: { label: "Your task", hint: "The code or the deployment failed: an exit code, a crash, a timeout." }, limit: { label: "A limit", hint: "A limit of your plan stopped the run. You can change it." }, cancelled: { label: "Cancelled", hint: "Someone asked the run to stop." }, platform: { label: "The platform", hint: "Something on our side failed. We see these too." } }, OBS_REFUSAL = { NEVER_RAN: { error: "run-never-ran", detail: "this run was not dispatched to a VM" }, INVALID_CURSOR: { error: "invalid-cursor", detail: "from_offset must be 0 or a next_offset that this run's output returned" }, AGENT_OUTDATED_CURSOR: { error: "agent-outdated-cursor", detail: "the host that ran this run cannot read output from an offset; read it without from_offset" }, HOST_GONE: { error: "host-gone", detail: "the host that ran this VM is no longer in the fleet" }, OUTPUT_GONE: { error: "no-file", detail: "the host no longer holds this run's output" }, INVALID_TIMELINE_CURSOR: { error: "invalid-timeline-cursor", detail: "cursor must be a cursor that this run's timeline returned" }, INVALID_DAYS: { error: "invalid-days", detail: "days must be a whole number of days, 1 or more" }, INVALID_WAIT: { error: "invalid-wait", detail: "wait_sec must be whole seconds from 0 to 20" }, WAIT_REFUSED: { error: "wait-refused", detail: "too many open waits; retry after the Retry-After seconds" }, UNAVAILABLE: { error: "obs-unavailable", detail: "the read cannot be served now; retry after the Retry-After seconds" } };
+} });
+function isPermission(value) {
+  return typeof value == "string" && PERMISSIONS.has(value);
+}
+var PERMISSION, PERMISSIONS, PERMISSION_DESCRIPTION, ACCESS_MARKER, ACCESS_REFUSAL, ACCESS_NAME_PATTERN, ACCESS_NAME_RULE, KEY_LIST_QUERY, init_tenant_access = __esm({ "../../packages/contract/tenant-access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  PERMISSION = { TASKS_READ: "tasks.read", TASKS_WRITE: "tasks.write", DEPLOYMENTS_READ: "deployments.read", DEPLOYMENTS_WRITE: "deployments.write", RUNS_READ: "runs.read", RUNS_WRITE: "runs.write", SECRETS_READ: "secrets.read", SECRETS_WRITE: "secrets.write", HOOKS_READ: "hooks.read", HOOKS_WRITE: "hooks.write", USAGE_READ: "usage.read" }, PERMISSIONS = new Set(Object.values(PERMISSION));
+  PERMISSION_DESCRIPTION = { [PERMISSION.TASKS_READ]: "Read tasks", [PERMISSION.TASKS_WRITE]: "Create and delete tasks", [PERMISSION.DEPLOYMENTS_READ]: "Read deployments and build logs", [PERMISSION.DEPLOYMENTS_WRITE]: "Deploy, delete a deployment, ask for package advice", [PERMISSION.RUNS_READ]: "Read runs, logs, timeline, failures, schedules, VMs", [PERMISSION.RUNS_WRITE]: "Start, cancel, delete runs; cancel schedules; stop VMs", [PERMISSION.SECRETS_READ]: "List secret names (values are never readable)", [PERMISSION.SECRETS_WRITE]: "Set and delete secrets", [PERMISSION.HOOKS_READ]: "List hooks", [PERMISSION.HOOKS_WRITE]: "Create and delete hooks; set notify", [PERMISSION.USAGE_READ]: "Usage, series, notifications" }, ACCESS_MARKER = { ANY_KEY: "any-key", OWNER: "owner" }, ACCESS_REFUSAL = { PERMISSION_DENIED: "permission-denied", OWNER_REQUIRED: "owner-required", USER_NOT_FOUND: "user-not-found", GROUP_NOT_FOUND: "group-not-found", NAME_TAKEN: "name-taken", UNKNOWN_PERMISSION: "unknown-permission" }, ACCESS_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/, ACCESS_NAME_RULE = "1 to 63 lower case letters, digits and '-', starting with a letter or digit", KEY_LIST_QUERY = { USER: "user" };
+} });
+var NOTIFICATION_KINDS, NOTIFICATION_KIND_INFO, ALERT_KINDS, CRITICAL_ALERT_KINDS, NOTIFICATION_FILTERS, NOTIFICATION_RETENTION_DAYS, NOTIFICATION_PAGE_MAX, NOTIFICATION_PAGE_DEFAULT, NOTIFICATION_QUERY, NOTIFICATION_REFUSAL, init_tenant_notifications = __esm({ "../../packages/contract/tenant-notifications.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api_routes();
+  init_tenant_telemetry();
+  NOTIFICATION_KINDS = ["limit.reached", "limit.near", "runs.failing", "callback.failing", "schedule.missed", "pin.lost", "plan.changed"], NOTIFICATION_KIND_INFO = { "limit.reached": { class: "alert", severity: "critical", label: "Monthly limit reached" }, "limit.near": { class: "notification", severity: "warning", label: "Monthly limit near" }, "runs.failing": { class: "alert", severity: "warning", label: "Runs failing" }, "callback.failing": { class: "alert", severity: "warning", label: "Run callbacks failing" }, "schedule.missed": { class: "notification", severity: "warning", label: "Schedule did not run" }, "pin.lost": { class: "notification", severity: "warning", label: "Pinned VM lost" }, "plan.changed": { class: "notification", severity: "info", label: "Plan changed" } }, ALERT_KINDS = NOTIFICATION_KINDS.filter((k) => NOTIFICATION_KIND_INFO[k].class === "alert"), CRITICAL_ALERT_KINDS = ALERT_KINDS.filter((k) => NOTIFICATION_KIND_INFO[k].severity === "critical"), NOTIFICATION_FILTERS = ["all", "unread", "open"], NOTIFICATION_RETENTION_DAYS = 30, NOTIFICATION_PAGE_MAX = 100, NOTIFICATION_PAGE_DEFAULT = 25, NOTIFICATION_QUERY = { FILTER: "filter", KIND: "kind", CURSOR: OBS_QUERY.CURSOR, LIMIT: "limit" }, NOTIFICATION_REFUSAL = { INVALID_FILTER: { error: "invalid-filter", detail: `filter must be one of: ${NOTIFICATION_FILTERS.join(", ")}` }, INVALID_KIND: { error: "invalid-kind", detail: `kind must be one of: ${NOTIFICATION_KINDS.join(", ")}` }, INVALID_LIMIT: { error: "invalid-limit", detail: "limit must be a whole number, 1 or more" }, INVALID_CURSOR: { error: "invalid-cursor", detail: "cursor must be a cursor that this list returned" } };
+} });
+var SITE_LINKS, init_web_nav = __esm({ "../../packages/contract/web-nav.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  SITE_LINKS = { DOCS: "https://ignitify.dev/docs", CLI_REFERENCE: "https://ignitify.dev/docs/cli/all", PRICING: "https://ignitify.dev/pricing" };
+} });
+var init_web_frame = __esm({ "../../packages/contract/web-frame.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api_routes();
+  init_tenant_account();
+  init_web_nav();
+} });
+function stripControl(text, keep = KEEP_NONE) {
+  return text.replace(CONTROL_UNIT, (unit) => keep(unit) ? unit : unit.startsWith("\r") ? `
+` : "");
+}
+var CONTROL_UNIT, KEEP_NONE, init_control_text = __esm({ "../../packages/contract/control-text.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  CONTROL_UNIT = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[PX^_][^\x1b]*(?:\x1b\\)?|[ -/]*[0-~])?|\r\n?|[\u0000-\u0008\u000b\u000c\u000e-\u001a\u001c-\u001f\u007f-\u009f]/g, KEEP_NONE = () => false;
+} });
 var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_api_routes();
   init_callback_path();
   init_limits();
+  init_currencies();
   init_task_config();
   init_source_manifest();
   init_system_packages();
@@ -1335,21 +1401,28 @@ var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   init_digest();
   init_device_code();
   init_backoff();
+  init_tenant_account();
+  init_tenant_telemetry();
+  init_tenant_access();
+  init_tenant_notifications();
+  init_web_nav();
+  init_web_frame();
+  init_control_text();
 } });
 function valueFlags(map2) {
   return Object.fromEntries(Object.keys(map2).map((flag) => [flag, "value"]));
 }
-var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SERVER_FLAGS, HIDDEN_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, USAGE_FLAG_PARAMS, USAGE_FILTERS, COMMAND_META, VERSION_META, MESSAGES, RUN_STATUS, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, init_constants = __esm({ "src/constants/index.ts"() {
+var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, RELEASE_BUILD, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, FOLLOW_FLAG, DAYS_FLAG, USAGE_FLAG_PARAMS, USAGE_FILTERS, NOTIFICATION_LIST_FLAG_PARAMS, COMMAND_META, VERSION_META, KEY_REVOKE_COMMAND, MESSAGES, ACCESS, RUN_STATUS, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, FOLLOW, MS_PER_SECOND, BUSY_READ, FOLLOW_MESSAGES, init_constants = __esm({ "src/constants/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
   init_tenant();
   init_tenant();
   init_tenant();
-  COMMANDS = { HELP: "help", LOGIN: "login", LOGOUT: "logout", WHOAMI: "whoami", QUOTA: "quota", TASK_CREATE: "task:create", TASK_LIST: "task:list", TASK_GET: "task:get", TASK_DELETE: "task:delete", TASK_VALIDATE: "task:validate", TASK_PACK: "task:pack", TASK_DEPLOY: "task:deploy", TASK_RUN: "task:run", DEPLOYMENT_LIST: "deployment:list", DEPLOYMENT_GET: "deployment:get", DEPLOYMENT_LOGS: "deployment:logs", DEPLOYMENT_DELETE: "deployment:delete", RUN_LIST: "run:list", RUN_GET: "run:get", RUN_LOGS: "run:logs", RUN_DELETE: "run:delete", RUN_CANCEL: "run:cancel", VM_LIST: "vm:list", VM_GET: "vm:get", VM_DELETE: "vm:delete", SECRET_SET: "secret:set", SECRET_LIST: "secret:list", SECRET_DELETE: "secret:delete", SCHEDULE_LIST: "schedule:list", SCHEDULE_CANCEL: "schedule:cancel", HOOK_CREATE: "hook:create", HOOK_LIST: "hook:list", HOOK_DELETE: "hook:delete", NOTIFY_SET: "notify:set", INTEGRATION_ADD: "integration:add", USAGE: "usage", USAGE_EXPORT: "usage:export" }, IGNORE_FILE = ".ignitifyignore", STATE = { DIR: ".ignitify", FILE: "state.json", GITIGNORE_FILE: ".gitignore", GITIGNORE_TEXT: `# written by ignitify: local state, never commit
+  COMMANDS = { HELP: "help", LOGIN: "login", LOGOUT: "logout", WHOAMI: "whoami", QUOTA: "quota", TASK_CREATE: "task:create", TASK_LIST: "task:list", TASK_GET: "task:get", TASK_DELETE: "task:delete", TASK_VALIDATE: "task:validate", TASK_PACK: "task:pack", TASK_DEPLOY: "task:deploy", TASK_RUN: "task:run", DEPLOYMENT_LIST: "deployment:list", DEPLOYMENT_GET: "deployment:get", DEPLOYMENT_LOGS: "deployment:logs", DEPLOYMENT_DELETE: "deployment:delete", RUN_LIST: "run:list", RUN_GET: "run:get", RUN_LOGS: "run:logs", RUN_TIMELINE: "run:timeline", RUN_FAILURES: "run:failures", RUN_DELETE: "run:delete", RUN_CANCEL: "run:cancel", VM_LIST: "vm:list", VM_GET: "vm:get", VM_DELETE: "vm:delete", SECRET_SET: "secret:set", SECRET_LIST: "secret:list", SECRET_DELETE: "secret:delete", SCHEDULE_LIST: "schedule:list", SCHEDULE_CANCEL: "schedule:cancel", HOOK_CREATE: "hook:create", HOOK_LIST: "hook:list", HOOK_DELETE: "hook:delete", NOTIFY_SET: "notify:set", INTEGRATION_ADD: "integration:add", USAGE: "usage", USAGE_EXPORT: "usage:export", USAGE_SERIES: "usage:series", NOTIFICATION_LIST: "notification:list", PERMISSION_LIST: "permission:list", USER_CREATE: "user:create", USER_LIST: "user:list", USER_GET: "user:get", USER_REMOVE: "user:remove", GROUP_CREATE: "group:create", GROUP_LIST: "group:list", GROUP_GET: "group:get", GROUP_GRANT: "group:grant", GROUP_REVOKE: "group:revoke", GROUP_ADD_USER: "group:add-user", GROUP_REMOVE_USER: "group:remove-user", GROUP_DELETE: "group:delete", KEY_CREATE: "key:create", KEY_LIST: "key:list", KEY_REVOKE: "key:revoke" }, IGNORE_FILE = ".ignitifyignore", STATE = { DIR: ".ignitify", FILE: "state.json", GITIGNORE_FILE: ".gitignore", GITIGNORE_TEXT: `# written by ignitify: local state, never commit
 *
-` }, CREDENTIALS = { DIR_NAME: "ignitify", FILE_NAME: "credentials.json", DIR_MODE: 448, FILE_MODE: 384 }, LOGIN = { MAX_RETRIES: 3, KEY_TTL_DAYS: 90, MIN_POLL_INTERVAL_SEC: 5, BROWSER_SCHEMES: ["https:", "http:"] }, LOGIN_VIEW = { TITLE: "Sign in to Ignitify", OPEN_PAGE: "Open this page:", ASK_OPERATOR: "Give this code to your operator, who approves it:", CHECK_CODE: "Check this code", SAME_CODE: "The page must show the same code.", WAITING_STATIC: (minutes) => `Waiting for approval. The code expires in ${minutes} minutes.`, WAITING_LIVE: (left) => `Waiting for approval... code expires in ${left}`, CANCELLED: "Sign-in cancelled. Nothing was saved.", SIGNED_IN: "Signed in", SIGNED_OUT: "Signed out", KEY_EXPIRES: (days) => `${days} days after last use; each use renews it`, YES: "yes", ROWS: { ACCOUNT: "Account", ACCOUNT_ID: "Account id", KEY_LABEL: "Key label", KEY_EXPIRES: "Key expires", SAVED_TO: "Saved to", REVOKED: "Revoked", DELETED: "Deleted" } }, NETWORK = { REASONS: { ECONNREFUSED: "nothing accepts connections there", ENOTFOUND: "the host name is unknown", EAI_AGAIN: "the host name lookup failed", ETIMEDOUT: "the connection timed out", UND_ERR_CONNECT_TIMEOUT: "the connection timed out", ECONNRESET: "the connection was reset" }, TLS_WORDS: "the TLS certificate was not accepted", TLS_CODES: ["CERT_HAS_EXPIRED", "CERT_NOT_YET_VALID", "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN", "UNABLE_TO_VERIFY_LEAF_SIGNATURE", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"], TLS_CODE_PREFIXES: ["ERR_TLS_", "ERR_SSL_"], CODE_PATTERN: /^[A-Z][A-Z0-9_]*$/, DETAIL_MAX_CHARS: 80 }, ENV = { TASKS_DIR: "IGNITIFY_TASKS_DIR", KEY: "IGNITIFY_API_KEY" }, DEFAULT_TASKS_DIR = "tasks", DEFAULTS = { API_URL: "https://api.ignitify.dev" }, UPGRADE_COMMAND = "npm install --global ignitify@latest", PAYLOAD_LIMIT_FALLBACK_BYTES = 10240, RESULT_LIMIT_FALLBACK_BYTES = 10240, RUN_LIST_FLAG_PARAMS = { status: "status", "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "correlation-id": "correlation_id", "vm-id": "vm_id", ...PAGE_FLAG_PARAMS }, VM_LIST_FLAG_PARAMS = { "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "older-than": "older_than", ...PAGE_FLAG_PARAMS }, GLOBAL_FLAGS = { json: "bool", help: "bool" }, SERVER_FLAGS = { api: "value" }, HIDDEN_FLAGS = ["api"], SHORT_FLAGS = { h: "help", y: "yes" }, VERSION_TOKENS = ["--version", "-v"];
-  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, USAGE_FLAG_PARAMS = { period: "period", axis: "axis", vm: "vm", run: "run" }, USAGE_FILTERS = valueFlags(USAGE_FLAG_PARAMS), COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { ...SERVER_FLAGS, "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...SERVER_FLAGS, ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: { ...SERVER_FLAGS, ...DIR }, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...SERVER_FLAGS, ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...SERVER_FLAGS, ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...SERVER_FLAGS, ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", wait: "bool", ...DIR, ...SERVER_FLAGS }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(RUN_LIST_FLAG_PARAMS) }, positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { ...SERVER_FLAGS, full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { ...SERVER_FLAGS, stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { ...SERVER_FLAGS, "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { ...SERVER_FLAGS, url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false } }, VERSION_META = { flags: SERVER_FLAGS, positionals: 0, confirms: false }, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login --api ${url}'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes, limit) => `payload is ${bytes} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes, limit) => `${source}: run.payload is ${bytes} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
+` }, CREDENTIALS = { DIR_NAME: "ignitify", FILE_NAME: "credentials.json", DIR_MODE: 448, FILE_MODE: 384 }, LOGIN = { MAX_RETRIES: 3, KEY_TTL_DAYS: 90, MIN_POLL_INTERVAL_SEC: 5, BROWSER_SCHEMES: ["https:", "http:"] }, LOGIN_VIEW = { TITLE: "Sign in to Ignitify", OPEN_PAGE: "Open this page:", ASK_OPERATOR: "Give this code to your operator, who approves it:", CHECK_CODE: "Check this code", SAME_CODE: "The page must show the same code.", WAITING_STATIC: (minutes) => `Waiting for approval. The code expires in ${minutes} minutes.`, WAITING_LIVE: (left) => `Waiting for approval... code expires in ${left}`, CANCELLED: "Sign-in cancelled. Nothing was saved.", SIGNED_IN: "Signed in", SIGNED_OUT: "Signed out", KEY_EXPIRES: (days) => `${days} days after last use; each use renews it`, YES: "yes", ROWS: { ACCOUNT: "Account", ACCOUNT_ID: "Account id", KEY_LABEL: "Key label", KEY_EXPIRES: "Key expires", SAVED_TO: "Saved to", REVOKED: "Revoked", DELETED: "Deleted" } }, NETWORK = { REASONS: { ECONNREFUSED: "nothing accepts connections there", ENOTFOUND: "the host name is unknown", EAI_AGAIN: "the host name lookup failed", ETIMEDOUT: "the connection timed out", UND_ERR_CONNECT_TIMEOUT: "the connection timed out", ECONNRESET: "the connection was reset" }, TLS_WORDS: "the TLS certificate was not accepted", TLS_CODES: ["CERT_HAS_EXPIRED", "CERT_NOT_YET_VALID", "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN", "UNABLE_TO_VERIFY_LEAF_SIGNATURE", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"], TLS_CODE_PREFIXES: ["ERR_TLS_", "ERR_SSL_"], CODE_PATTERN: /^[A-Z][A-Z0-9_]*$/, DETAIL_MAX_CHARS: 80 }, ENV = { TASKS_DIR: "IGNITIFY_TASKS_DIR", KEY: "IGNITIFY_API_KEY", DEV_API_URL: "IGNITIFY_DEV_API_URL" }, DEFAULT_TASKS_DIR = "tasks", RELEASE_BUILD = true, DEFAULTS = { API_URL: "https://api.ignitify.dev" }, UPGRADE_COMMAND = "npm install --global ignitify@latest", PAYLOAD_LIMIT_FALLBACK_BYTES = 10240, RESULT_LIMIT_FALLBACK_BYTES = 10240, RUN_LIST_FLAG_PARAMS = { status: "status", "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "correlation-id": "correlation_id", "vm-id": "vm_id", ...PAGE_FLAG_PARAMS }, VM_LIST_FLAG_PARAMS = { "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "older-than": "older_than", ...PAGE_FLAG_PARAMS }, GLOBAL_FLAGS = { json: "bool", help: "bool" }, SHORT_FLAGS = { h: "help", y: "yes" }, VERSION_TOKENS = ["--version", "-v"];
+  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, FOLLOW_FLAG = { follow: "bool" }, DAYS_FLAG = { days: "value" }, USAGE_FLAG_PARAMS = { period: "period", axis: "axis", vm: "vm", run: "run" }, USAGE_FILTERS = valueFlags(USAGE_FLAG_PARAMS), NOTIFICATION_LIST_FLAG_PARAMS = { kind: NOTIFICATION_QUERY.KIND, limit: NOTIFICATION_QUERY.LIMIT }, COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: PAGE, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", "idempotency-key": "value", wait: "bool", ...DIR }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: PAGE, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: RAW, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: valueFlags(RUN_LIST_FLAG_PARAMS), positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...RAW, ...FOLLOW_FLAG, tail: "value" }, positionals: 1, confirms: false }, [COMMANDS.RUN_TIMELINE]: { flags: FOLLOW_FLAG, positionals: 1, confirms: false }, [COMMANDS.RUN_FAILURES]: { flags: DAYS_FLAG, positionals: 0, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: PAGE, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_SERIES]: { flags: DAYS_FLAG, positionals: 0, confirms: false }, [COMMANDS.NOTIFICATION_LIST]: { flags: { ...valueFlags(NOTIFICATION_LIST_FLAG_PARAMS), unread: "bool", open: "bool" }, positionals: 0, confirms: false }, [COMMANDS.PERMISSION_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.USER_CREATE]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.USER_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.USER_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.USER_REMOVE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.GROUP_CREATE]: { flags: { permissions: "value" }, positionals: 1, confirms: false }, [COMMANDS.GROUP_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.GROUP_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.GROUP_GRANT]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_REVOKE]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_ADD_USER]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_REMOVE_USER]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.KEY_CREATE]: { flags: { user: "value", label: "value", out: "value" }, positionals: 0, confirms: false }, [COMMANDS.KEY_LIST]: { flags: { user: "value" }, positionals: 0, confirms: false }, [COMMANDS.KEY_REVOKE]: { flags: YES, positionals: 1, confirms: true } }, VERSION_META = { flags: NO_FLAGS, positionals: 0, confirms: false }, KEY_REVOKE_COMMAND = (id) => `ignitify ${COMMANDS.KEY_REVOKE} ${id}`, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, TASK_NOT_REGISTERED: (taskId, dirFlag) => `this folder is not registered yet (no task_id in .ignitify/state.json). Run: ignitify task:create ${taskId} --no-scaffold${dirFlag === void 0 ? "" : ` --dir ${dirFlag}`}, then deploy again.`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes, limit) => `payload is ${bytes} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes, limit) => `${source}: run.payload is ${bytes} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
   ignitify secret:set <NAME> --stdin < value-file
   printf %s "$VALUE" | ignitify secret:set <NAME> --stdin
 \u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.`, NOTIFY_SECRET_ON_ARGV: '--secret is not accepted: a value on argv is visible in `ps` and is written to your shell history. Use --secret-stdin, e.g.\n  printf %s "$SECRET" | ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin\n\u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.', HOOK_CREATE_USAGE: "usage: ignitify hook:create <deployment-id> --task-name <name>", HOOK_TASK_NAME_REQUIRED: `--task-name <name> is required: a hook starts a run of ONE task in the deployment, and a run without a task name fails.
@@ -1357,14 +1430,15 @@ usage: ignitify hook:create <deployment-id> --task-name <name>`, HOOK_LIST_USAGE
        ignitify notify:set <deployment-id> --clear
   --secret-stdin reads the signing secret (at least ${32} characters) from stdin; it is
   required with --url. There is no --secret flag: a value on argv is visible in \`ps\`
-  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed` }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
+  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_SECRET_REDACTED: (id) => `the server answered without the secret (a replay of an earlier request), and it is not shown again. Delete ${id} with 'ignitify hook:delete ${id}' and create another to get a new secret.`, HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", DAYS_INVALID: (raw) => `--days must be a whole number of days, 1 or more (got ${JSON.stringify(raw)})`, NOTIFICATION_ONE_VIEW: "Choose --unread or --open, not both.", NOTIFICATION_MORE: (max) => `Older notifications exist. Raise --limit (at most ${max}), or open Notifications in the app.`, NOTIFICATION_MORE_IN_APP: "Older notifications exist. Open Notifications in the app to see them.", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", IDEMPOTENCY_KEY_INVALID: (key) => `--idempotency-key must be 8 to 255 characters of A-Z a-z 0-9 . _ : -, got: ${key}`, RUN_REPLAYED: "this is the answer to an earlier request with the same --idempotency-key; no new run was started.", IDEMPOTENCY_KEY_REUSED_HINT: "Use a new --idempotency-key for a different run. Reuse a key only to retry the same run.", IDEMPOTENCY_IN_PROGRESS_HINT: "If an earlier request with this key is still running, retry with the same key shortly.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed`, ACCESS_NAME_INVALID: (kind, name) => `${kind} name ${JSON.stringify(name)} is not valid: use ${ACCESS_NAME_RULE}`, PERMISSION_UNKNOWN: (permission) => `unknown permission ${JSON.stringify(permission)}. Run 'ignitify permission:list' to see the permissions.`, PERMISSION_NOT_GRANTABLE: (marker) => `${JSON.stringify(marker)} is not a permission and cannot be granted: only owner keys manage access.`, PERMISSIONS_REQUIRED: "--permissions <p1,p2,\u2026> is required: name at least one permission, comma-separated.", KEY_USER_REQUIRED: "--user <name> is required: a key belongs to one user. Owner keys come from ignitify login.", KEY_LABEL_REQUIRED: "--label <text> is required: it tells you later where the key is used.", KEY_SHOWN_ONCE: "\u26A0\uFE0F  The key below is shown ONCE and cannot be read back. Hand it over now; if it is lost, revoke it and create another.", KEY_OUT_EXISTS: (file) => `${file} already exists. key:create --out writes a new file only and never follows a link. Choose another name; no key was created.`, KEY_OUT_FAILED: (file, reason) => `cannot create ${file} (${reason}); no key was created.`, KEY_OUT_WRITE_FAILED: (file, reason, id) => `cannot write ${file} (${reason}). Key ${id} was created but its value is lost: revoke it with '${KEY_REVOKE_COMMAND(id)}' and create another.`, KEY_WRITTEN: (id, file) => `key ${id} written to ${file} (mode 0600). Hand the file over, then delete your copy.`, KEY_REDACTED: (id) => `the server answered without the key (a replay of an earlier request). Revoke ${id} with '${KEY_REVOKE_COMMAND(id)}' and create another.`, USER_CREATED: (name) => `user ${name} created`, USER_REMOVED: (name, keys) => `user ${name} removed; ${keys} key(s) revoked`, GROUP_CREATED: (name) => `group ${name} created`, GROUP_GRANTED: (name, permission) => `group ${name} now has ${permission}`, GROUP_REVOKED: (name, permission) => `group ${name} no longer has ${permission}`, GROUP_USER_ADDED: (group, user) => `user ${user} added to group ${group}`, GROUP_USER_REMOVED: (group, user) => `user ${user} removed from group ${group}`, GROUP_DELETED: (name) => `group ${name} deleted`, KEY_REVOKED: (id) => `key ${id} revoked`, ACCESS_PERMISSION_DENIED: (needed) => needed === null ? "permission denied: this key lacks the permission this command needs. Ask the owner to grant it to one of your groups." : `permission denied: this key needs the ${needed} permission. Ask the owner to grant it to one of your groups.`, ACCESS_OWNER_REQUIRED: "owner key required: only owner keys manage users, groups and keys. This is a user key.", ACCESS_REFUSED: (error, reason) => `${error} (${reason})` }, ACCESS = { OWNER: "owner", SEPARATOR: ",", USER: "user", GROUP: "group", TASKS_WRITE_NOTE: "tasks.write can delete deployments and runs too: deleting a task deletes its deployments, cancels and deletes their runs and stops their VMs. Grant it only where deployments.write and runs.write are acceptable too.", SECRETS_READ_NOTE: "deployments.write plus runs.write can read secret values in practice: deploy code that prints its environment, then run it.", HOOKS_WRITE_NOTE: "hooks.write can start runs (a hook trigger starts a run) and can send run results to any URL. Grant it only where runs.write is acceptable too." }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
 Check it with: ignitify deployment:get ${deploymentId}`, INTERRUPTED_RUN: (runId) => `Stopped waiting. The run keeps going on the server \u2014 nothing was cancelled.
-Check it with: ignitify run:get ${runId}` };
+Check it with: ignitify run:get ${runId}` }, FOLLOW = { WAIT_SEC: 20, IDLE_MS: 2e3, RETRY_FALLBACK_MS: 2e3 }, MS_PER_SECOND = 1e3, BUSY_READ = { MAX_RETRIES: 3, NOTE: (seconds) => `server busy, retrying in ${seconds}s` }, FOLLOW_MESSAGES = { AGENT_OUTDATED: "the host is running an older agent; try again after the update, or read it without --follow or --tail", API_NO_CURSOR: "this API cannot follow output yet; run the command without --follow or --tail", TAIL_INVALID: (raw) => `--tail must be a whole number of lines, 1 or more (got ${JSON.stringify(raw)})`, INTERRUPTED: (runId) => `Stopped following. The run keeps going on the server \u2014 nothing was cancelled.
+Check it with: ignitify run:get ${runId}`, STILL_LIVE: (status) => `Run ${status} \u2014 still live; add --follow to watch it` };
 } });
 var ANSI, GLYPHS, LAYOUT, LABELS, EMPTY_LISTS, DISPLAY_CAPS, TITLES, PER_BRAIN_MARKER, PER_BRAIN_FOOTNOTE, POLICY_UNIT_NOTES, HIDDEN_FIELDS, RESULT_MESSAGES, RUN_CANCEL_OUTCOME, init_constants2 = __esm({ "src/output/constants.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, SCHEDULE_CANCEL_PREVIEW: (id) => `Will cancel schedule ${id} \u2014 it will never fire.`, SCHEDULE_NOT_CANCELLED: (id) => `Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`, HOOK_DELETE_PREVIEW: (id) => `Will delete webhook ${id}. A sender that posts to it is refused from then on.`, SECRET_DELETE_PREVIEW: (name) => `Will delete secret ${name}. Its value cannot be read back.`, DEPLOYMENT_DELETE_PREVIEW: (id) => `Will soft-delete deployment ${id} and all its runs (cascade).`, RUN_DELETE_PREVIEW: (id) => `Will soft-delete run ${id}.`, RUN_ALREADY_OVER: (id, status) => `Run ${id} is already ${status} \u2014 nothing to cancel.`, RUN_CANCEL_PREVIEW: (id, force) => force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`, RUN_STOPPING: (id, grace, was) => `Run ${id} is stopping${grace}${was} \u2014 still RUNNING until it finishes or the grace expires.`, RUN_CANCELLED: (id, was) => `Run cancelled: ${id}${was}`, LOG_TRUNCATED: (lines) => `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`, NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
+  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" }, USERS: { message: "No users yet.", next: "Create one with: ignitify user:create <name>" }, GROUPS: { message: "No groups yet.", next: "Create one with: ignitify group:create <name> --permissions <p1,p2>" }, KEYS: { message: "No live keys." } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", KEY_ACCESS: "This Key", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, SCHEDULE_CANCEL_PREVIEW: (id) => `Will cancel schedule ${id} \u2014 it will never fire.`, SCHEDULE_NOT_CANCELLED: (id) => `Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`, HOOK_DELETE_PREVIEW: (id) => `Will delete webhook ${id}. A sender that posts to it is refused from then on.`, SECRET_DELETE_PREVIEW: (name) => `Will delete secret ${name}. Its value cannot be read back.`, DEPLOYMENT_DELETE_PREVIEW: (id) => `Will soft-delete deployment ${id} and all its runs (cascade).`, RUN_DELETE_PREVIEW: (id) => `Will soft-delete run ${id}.`, RUN_ALREADY_OVER: (id, status) => `Run ${id} is already ${status} \u2014 nothing to cancel.`, RUN_CANCEL_PREVIEW: (id, force) => force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`, RUN_STOPPING: (id, grace, was) => `Run ${id} is stopping${grace}${was} \u2014 still RUNNING until it finishes or the grace expires.`, RUN_CANCELLED: (id, was) => `Run cancelled: ${id}${was}`, LOG_TRUNCATED: (lines) => `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`, USER_REMOVE_PREVIEW: (name) => `Will remove user ${name} and revoke every key of the user. The keys stop working at once.`, GROUP_DELETE_PREVIEW: (name) => `Will delete group ${name}. Its users lose the permissions it grants; users and keys stay.`, KEY_REVOKE_PREVIEW: (id) => `Will revoke key ${id}. A program that uses it is refused from then on.`, KEY_CREATED_TITLE: "Key Created", KEY_RAW_KEY: "key (shown ONCE)", USER_KEYS_TITLE: "Keys", NONE: "-", NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
 } });
 function makeStyle(o) {
   let p = (...codes) => paint(o.colour, ...codes), columns = Math.max(o.width, 1);
@@ -1394,15 +1468,15 @@ function paintStatus(st, status) {
   let s = String(status).toUpperCase(), tone = STATUS_TONE[s];
   return tone === "ok" ? st.green(s) : tone === "busy" ? st.yellow(s) : tone === "bad" ? st.red(s) : st.dim(s);
 }
-var paint, PLAIN, resolveStyle, plain, plainLines, TERMINAL_CONTROL, SGR, terminalSafe, stripAnsi, visibleLength, padVisible, cut, STATUS_TONE, init_style = __esm({ "src/output/style.ts"() {
+var paint, PLAIN, resolveStyle, plain, plainLines, SGR, isColour, terminalSafe, stripAnsi, visibleLength, padVisible, cut, STATUS_TONE, init_style = __esm({ "src/output/style.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
   init_constants2();
   paint = (on, ...codes) => (s) => on && s !== "" ? `${codes.join("")}${s}${ANSI.reset}` : s;
   PLAIN = makeStyle({ colour: false, unicode: true, width: LAYOUT.MAX_WIDTH });
   resolveStyle = (f) => makeStyle({ colour: wantsColour(f), unicode: wantsUnicode(f), width: f.columns !== void 0 && f.columns > 0 ? f.columns : LAYOUT.MAX_WIDTH });
-  plain = (s) => s.replace(/[\u0000-\u001f\u007f-\u009f]/g, ""), plainLines = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, ""), TERMINAL_CONTROL = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[PX^_][^\x1b]*(?:\x1b\\)?|[ -/]*[0-~])?|\r\n?|[\u0000-\u0008\u000b\u000c\u000e-\u001a\u001c-\u001f\u007f-\u009f]/g, SGR = /^\x1b\[[0-9;:]*m$/, terminalSafe = (s, keepColour) => s.replace(TERMINAL_CONTROL, (m) => keepColour && SGR.test(m) ? m : m.startsWith("\r") ? `
-` : ""), stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, ""), visibleLength = (s) => stripAnsi(s).length, padVisible = (s, width) => s + " ".repeat(Math.max(0, width - visibleLength(s))), cut = (s, max, ellipsis) => s.length <= max || max <= ellipsis.length ? s : `${s.slice(0, max - ellipsis.length)}${ellipsis}`;
+  plain = (s) => s.replace(/[\u0000-\u001f\u007f-\u009f]/g, ""), plainLines = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, ""), SGR = /^\x1b\[[0-9;:]*m$/, isColour = (unit) => SGR.test(unit), terminalSafe = (s, keepColour) => keepColour ? stripControl(s, isColour) : stripControl(s), stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, ""), visibleLength = (s) => stripAnsi(s).length, padVisible = (s, width) => s + " ".repeat(Math.max(0, width - visibleLength(s))), cut = (s, max, ellipsis) => s.length <= max || max <= ellipsis.length ? s : `${s.slice(0, max - ellipsis.length)}${ellipsis}`;
   STATUS_TONE = { COMPLETED: "ok", READY: "ok", ACTIVE: "ok", DONE: "ok", OK: "ok", PENDING: "busy", PROVISIONING: "busy", RUNNING: "busy", RETRYING: "busy", BUILDING: "busy", FAILED: "bad" };
 } });
 function cellText(v) {
@@ -1496,6 +1570,94 @@ var heading, successLine, errorMark, warnMark, noteLine, emptyState, init_blocks
   heading = (st, title, ok2 = false) => ok2 ? st.bold(st.green(`${st.glyphs.ok} ${title}`)) : st.bold(title), successLine = (st, text) => `${st.green(st.glyphs.ok)} ${text}`, errorMark = (st, text) => `${st.red(st.glyphs.err)} ${text}`, warnMark = (st, text) => `${st.yellow(st.glyphs.warn)} ${text}`, noteLine = (st, text) => st.yellow(text), emptyState = (st, message, next) => next === void 0 ? st.dim(message) : `${st.dim(message)}
 ${st.dim(next)}`;
 } });
+function checkAccessName(kind, name) {
+  return ACCESS_NAME_PATTERN.test(name) ? { ok: true, value: name } : { ok: false, message: MESSAGES.ACCESS_NAME_INVALID(kind, name) };
+}
+function checkPermission(permission) {
+  return isPermission(permission) ? { ok: true, value: permission } : { ok: false, message: MARKERS.includes(permission) ? MESSAGES.PERMISSION_NOT_GRANTABLE(permission) : MESSAGES.PERMISSION_UNKNOWN(permission) };
+}
+function parsePermissions(raw) {
+  let names = (raw ?? "").split(ACCESS.SEPARATOR).map((p) => p.trim()).filter((p) => p !== "");
+  if (names.length === 0) return { ok: false, message: MESSAGES.PERMISSIONS_REQUIRED };
+  let out2 = [];
+  for (let name of names) {
+    let checked = checkPermission(name);
+    if (!checked.ok) return checked;
+    out2.includes(checked.value) || out2.push(checked.value);
+  }
+  return { ok: true, value: out2 };
+}
+function permissionNote(permission) {
+  if (permission === PERMISSION.TASKS_WRITE) return ACCESS.TASKS_WRITE_NOTE;
+  if (permission === PERMISSION.SECRETS_READ) return ACCESS.SECRETS_READ_NOTE;
+  if (permission === PERMISSION.HOOKS_WRITE) return ACCESS.HOOKS_WRITE_NOTE;
+}
+function permissionRows() {
+  return CATALOGUE.map((permission) => {
+    let note = permissionNote(permission);
+    return { permission, description: PERMISSION_DESCRIPTION[permission], ...note === void 0 ? {} : { note } };
+  });
+}
+function accessRefusalText(e) {
+  let body = httpErrorJson(e)?.body, reason = body?.reason;
+  if (typeof reason != "string" || !REFUSALS.includes(reason)) return null;
+  if (reason === ACCESS_REFUSAL.PERMISSION_DENIED) {
+    let needed = body?.needed;
+    return MESSAGES.ACCESS_PERMISSION_DENIED(typeof needed == "string" && needed !== "" ? needed : null);
+  }
+  if (reason === ACCESS_REFUSAL.OWNER_REQUIRED) return MESSAGES.ACCESS_OWNER_REQUIRED;
+  let error = body?.error;
+  return MESSAGES.ACCESS_REFUSED(typeof error == "string" && error !== "" ? error : reason, reason);
+}
+var CATALOGUE, MARKERS, REFUSALS, keyUser, init_access = __esm({ "src/core/access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_tenant();
+  init_constants();
+  CATALOGUE = Object.values(PERMISSION), MARKERS = Object.values(ACCESS_MARKER), REFUSALS = Object.values(ACCESS_REFUSAL);
+  keyUser = (user) => user ?? ACCESS.OWNER;
+} });
+function renderPermissions(st, rows) {
+  return renderTable(st, [{ header: "permission", keep: true }, { header: "allows", wrap: true }], rows.map((r) => [r.permission, r.note === void 0 ? r.description : `${r.description}. Note: ${r.note}`]));
+}
+function renderUsers(st, users) {
+  return users.length === 0 ? emptyState(st, EMPTY_LISTS.USERS.message, EMPTY_LISTS.USERS.next) : renderTable(st, [{ header: "name", keep: true }, { header: "resource_id", keep: true }, { header: "created_at", keep: true }], users.map((u) => [u.name, u.resource_id, u.created_at]));
+}
+function renderKeys(st, keys) {
+  return keys.length === 0 ? emptyState(st, EMPTY_LISTS.KEYS.message) : renderTable(st, [{ header: "resource_id", keep: true }, { header: "user", keep: true }, { header: "label" }, { header: "created_at", keep: true }, { header: "last_used_at", keep: true }], keys.map((k) => [k.resource_id, keyUser(k.user), k.label, k.created_at, k.last_used_at]));
+}
+function renderUser(st, user) {
+  return `${renderFields(st, { name: user.name, resource_id: user.resource_id, created_at: user.created_at, groups: joined(user.groups), permissions: joined(user.permissions) })}
+
+${heading(st, RESULT_MESSAGES.USER_KEYS_TITLE)}
+${renderKeys(st, user.keys)}`;
+}
+function renderGroups(st, groups) {
+  return groups.length === 0 ? emptyState(st, EMPTY_LISTS.GROUPS.message, EMPTY_LISTS.GROUPS.next) : renderTable(st, [{ header: "name", keep: true }, { header: "permissions", wrap: true }, { header: "created_at", keep: true }], groups.map((g) => [g.name, joined(g.permissions), g.created_at]));
+}
+function renderGroup(st, group) {
+  return renderFields(st, { name: group.name, resource_id: group.resource_id, created_at: group.created_at, permissions: joined(group.permissions), users: joined(group.users) });
+}
+function renderKeyAccess(st, access) {
+  return renderFields(st, { key: access.key, user: keyUser(access.user), groups: joined(access.groups), permissions: joined(access.permissions) });
+}
+function renderKeyCreated(st, created) {
+  let { raw_key, secret_redacted: _redacted, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.KEY_RAW_KEY]: raw_key }, paint2 = { [RESULT_MESSAGES.KEY_RAW_KEY]: (s) => st.bold(st.yellow(s)) };
+  return `
+${heading(st, RESULT_MESSAGES.KEY_CREATED_TITLE, true)}
+${renderFields(st, rows, void 0, paint2)}
+`;
+}
+var joined, init_access2 = __esm({ "src/output/access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_access();
+  init_blocks();
+  init_constants2();
+  init_table();
+  joined = (items) => items.length === 0 ? RESULT_MESSAGES.NONE : items.join(", ");
+} });
 function isStorageMib(value) {
   return typeof value == "number" && Number.isInteger(value) && value > 0;
 }
@@ -1631,6 +1793,7 @@ var sectionHeader, layout, filterScalars, filterDisplayKeys, BYTE_UNITS2, format
   init_table();
   init_blocks();
   init_style();
+  init_access2();
   init_constants2();
   init_tenant();
   init_execution();
@@ -1647,10 +1810,10 @@ ${heading(st, title, success)}
     return `${exp === 0 ? value : value.toFixed(1)} ${BYTE_UNITS2[exp]}`;
   }, quotaLine = (used, max) => `${used} / ${max ?? "unlimited"}`, storeLine = (used, max) => max === void 0 ? formatBytes(used) : `${formatBytes(used)} / ${max === null ? "unlimited" : formatBytes(max)}`, renderWhoami = (data, st = PLAIN) => {
     if (!data) return "";
-    let { limits, usage, tier, policy, bound_by, status_reason, policy_scope, enforced, unit_weights, capacity, ...identity } = data, identityRows = { ...identity };
+    let { limits, usage, tier, policy, bound_by, status_reason, policy_scope, enforced, unit_weights, capacity, access, ...identity } = data, identityRows = { ...identity };
     typeof status_reason == "string" && status_reason !== "" && (identityRows.status_reason = status_reason), tier && (identityRows.tier = `${tier.name} v${tier.version}`), bound_by && (identityRows.bound_by = bound_by);
     let out2 = layout(sectionHeader(st, TITLES.TENANT_PROFILE), renderFields(st, filterDisplayKeys(identityRows)));
-    return (limits || usage) && (out2 += renderUsageBlocks(st, limits, usage)), out2 += capacityBlock(st, capacity), hasUnits(limits) && unit_weights && (out2 += renderUnitWeights(st, unit_weights)), policy && (out2 += renderPolicyBlock(st, policy, policy_scope?.per_brain ?? [])), enforced && enforced.length > 0 && (out2 += renderEnforcedBlock(st, enforced)), out2;
+    return access && (out2 += layout(sectionHeader(st, TITLES.KEY_ACCESS), renderKeyAccess(st, access))), (limits || usage) && (out2 += renderUsageBlocks(st, limits, usage)), out2 += capacityBlock(st, capacity), hasUnits(limits) && unit_weights && (out2 += renderUnitWeights(st, unit_weights)), policy && (out2 += renderPolicyBlock(st, policy, policy_scope?.per_brain ?? [])), enforced && enforced.length > 0 && (out2 += renderEnforcedBlock(st, enforced)), out2;
   }, hasUnits = (limits) => typeof limits?.max_units == "number", renderUnitWeights = (st, weights) => layout(sectionHeader(st, TITLES.UNIT_WEIGHTS), renderFields(st, Object.fromEntries(Object.entries(weights).map(([p, w]) => [p, String(w)])))), showEnforced = (v) => v === null ? "\u2014" : String(v), renderEnforcedBlock = (st, rows) => {
     let enforcedText = (r) => {
       let value = showEnforced(r.enforced);
@@ -1874,7 +2037,7 @@ ${notice()}
     process.removeListener("SIGINT", handler);
   }
 }
-var spinnerGlyph, realEvery, NOOP, init_progress = __esm({ "src/output/progress.ts"() {
+var spinnerGlyph, realEvery, NOOP, NO_PROGRESS, init_progress = __esm({ "src/output/progress.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants2();
@@ -1890,13 +2053,15 @@ var spinnerGlyph, realEvery, NOOP, init_progress = __esm({ "src/output/progress.
   }, fail() {
   }, stop() {
   } };
+  NO_PROGRESS = { stop: () => {
+  } };
 } });
-var AXES, DIR2, YES2, RAW2, PAGE2, VERSION_HELP, COMMAND_HELP, HELP_PAGE, init_help = __esm({ "src/constants/help.ts"() {
+var OWNER_ONLY, PERMISSION_NOTES, AXES, DIR2, YES2, RAW2, SERIES_DAYS, FAILURES_DAYS, PAGE2, VERSION_HELP, COMMAND_HELP, HELP_PAGE, init_help = __esm({ "src/constants/help.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_tenant();
   init_constants();
-  AXES = USAGE_AXES.join("|"), DIR2 = { dir: { text: "Folder that holds your task folders.", default: `$${ENV.TASKS_DIR}, else ${DEFAULT_TASKS_DIR}` } }, YES2 = { yes: { text: "Skip the question (needed when not interactive)." } }, RAW2 = { raw: { text: "Print the bytes exactly as received. Without it, the colours are kept on a colour terminal and every other control code is removed." } }, PAGE2 = { limit: { text: "Rows on the page. The server sets the default and the largest value." }, "after-id": { text: "Page cursor: the id of the last row of the page before." }, after: { text: "Only rows after this ISO 8601 time." } }, VERSION_HELP = { summary: "Print the client version, and the API version if the server answers.", usage: ["ignitify --version"], notes: ["Needs no key. Warns when this client is older than the API supports."] }, COMMAND_HELP = { [COMMANDS.HELP]: { summary: "Print the usage of every command, or of one command.", usage: ["ignitify help [<command>]"], args: { command: "A command name. Leave it out to print every command." }, notes: ["`ignitify <command> --help` prints the same page."], examples: ["ignitify help task:run"] }, [COMMANDS.LOGIN]: { summary: "Sign this machine in and save its API key.", usage: ["ignitify login [--name <label>] [--no-browser]"], flags: { name: { text: "A label for this machine's key; keeps two machines with one hostname apart.", default: "the hostname" }, "no-browser": { text: "Print the sign-in page, but do not open it." } }, notes: ["The key is saved in ~/.config/ignitify/credentials.json (mode 0600)."], examples: ["ignitify login", "ignitify login --name build-server --no-browser"] }, [COMMANDS.LOGOUT]: { summary: "Revoke this machine's key and delete the saved file.", usage: ["ignitify logout"] }, [COMMANDS.WHOAMI]: { summary: "Show who your key belongs to, your limits and usage.", usage: ["ignitify whoami"] }, [COMMANDS.QUOTA]: { summary: "Show what you hold now against your limits.", usage: ["ignitify quota"] }, [COMMANDS.TASK_CREATE]: { summary: "Register a task name and write its starter files.", usage: ["ignitify task:create <task-id> [--lang node|python|go|rust] [--local] [--no-init] [--no-scaffold] [--dir <base-dir>]"], args: { "task-id": "The task name: also the folder name and the slug in task.yaml." }, flags: { lang: { text: "Language of the starter files.", default: "node" }, local: { text: "Write the files only. Calls no server and needs no key." }, "no-init": { text: "Write the short starter that has only run(), without init code." }, "no-scaffold": { text: "Register the task name but write no files." }, ...DIR2 }, examples: ["ignitify task:create image-resize", "ignitify task:create image-resize --lang python --local"] }, [COMMANDS.TASK_LIST]: { summary: "List your tasks, one page at a time.", usage: ["ignitify task:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.TASK_GET]: { summary: "Report a task's deploys, runs and next-step verdicts.", usage: ["ignitify task:get <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2, notes: ["Shows whether the next deploy builds a new image and the next run boots a new VM, with the reasons."] }, [COMMANDS.TASK_VALIDATE]: { summary: "Check task.yaml on your machine; builds nothing.", usage: ["ignitify task:validate <task-id> [--dir <base-dir>] [--review-packages]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, "review-packages": { text: "Then ask the server for an AI review of build.system_packages." } }, notes: ["The review is advice only: the exit code never changes.", "Only package names and the runtime id leave this machine; never code, slug or secrets.", "It also checks that task.yaml still covers each @ignitify-integrations/* package in package.json. A listed package that is not in node_modules stops the check: run npm install first.", "With integrations installed, it sends their package names to the public npm registry (registry.npmjs.org) to find obsolete versions: a warning only. With no network, that warning is skipped with a note."] }, [COMMANDS.TASK_PACK]: { summary: "List the files task:deploy would upload; builds nothing.", usage: ["ignitify task:pack <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2 }, [COMMANDS.TASK_DEPLOY]: { summary: "Upload the task source and wait until the image is built.", usage: ["ignitify task:deploy <task-id> [--dir <base-dir>] [--check]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, check: { text: "Run every local check, then stop. Nothing is uploaded." } }, notes: ["Ctrl+C stops waiting, not the build."], examples: ["ignitify task:deploy image-resize", "ignitify task:deploy image-resize --check"] }, [COMMANDS.TASK_RUN]: { summary: "Start one run of a task from its latest deployment.", usage: ["ignitify task:run <task-id> [--dir <base-dir>] [--deployment <id>] [--payload <json>] [--timeout-sec <n>] [--on-busy queue|reject] [--at <iso>] [--wait]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, deployment: { text: "Run this deployment instead of the task's latest deploy.", default: "the task's latest deploy" }, payload: { text: "JSON input for this run only.", default: "run.payload from task.yaml" }, "timeout-sec": { text: "Time limit in seconds for this run only.", default: "run.timeout_sec from task.yaml" }, "on-busy": { text: "When the run cannot start at once: queue waits for room (a limited time), reject fails at once.", default: "queue" }, at: { text: "Schedule the run for this ISO 8601 time. No run exists until it fires." }, wait: { text: "Follow the run to its end, then print it with its result." } }, notes: ["With --wait the exit code is 0 only when the run is COMPLETED. Ctrl+C stops waiting, not the run.", "--payload and --timeout-sec apply to this run only; task.yaml is never written.", "A bidirectional task runs one VM at a time; --on-busy covers that case too."], examples: ["ignitify task:run image-resize --wait", `ignitify task:run image-resize --payload '{"width":320}'`, "ignitify task:run image-resize --at 2027-01-15T03:00:00Z"] }, [COMMANDS.TASK_DELETE]: { summary: "Delete a task with all its deployments and runs.", usage: ["ignitify task:delete <task-id> [--dir <base-dir>] [--yes] [--json]"], args: { "task-id": "The task folder name, or the task id." }, flags: { ...DIR2, ...YES2, json: { text: "Print the plan and the result as one JSON document." } }, notes: ["Also removes the .ignitify/ link of every local folder linked to it; your files are kept."] }, [COMMANDS.DEPLOYMENT_LIST]: { summary: "List your deployments with the size of each image.", usage: ["ignitify deployment:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.DEPLOYMENT_GET]: { summary: "Show one deployment: status, size, integrity.", usage: ["ignitify deployment:get <deployment-id>"], args: { "deployment-id": "The deployment id, from task:deploy or deployment:list." } }, [COMMANDS.DEPLOYMENT_LOGS]: { summary: "Print the build log of a deployment, as the build wrote it.", usage: ["ignitify deployment:logs <deployment-id> [--raw]"], args: { "deployment-id": "The deployment id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.DEPLOYMENT_DELETE]: { summary: "Delete a deployment together with its runs.", usage: ["ignitify deployment:delete <deployment-id> [--yes]"], args: { "deployment-id": "The deployment id." }, flags: YES2 }, [COMMANDS.RUN_LIST]: { summary: "List your runs, with filters.", usage: ["ignitify run:list [--status S] [--deployment-id D] [--task-name N] [--preset P] [--correlation-id C] [--vm-id V] [--limit N] [--after-id <id>] [--after <iso>]"], flags: { status: { text: "Only runs in this status, for example FAILED." }, "deployment-id": { text: "Only runs of this deployment." }, "task-name": { text: "Only runs of this task." }, preset: { text: "Only runs on this instance class." }, "correlation-id": { text: "Only runs with this correlation id." }, "vm-id": { text: "Only runs that used this VM." }, ...PAGE2 } }, [COMMANDS.RUN_GET]: { summary: "Show one run: status, timing and the result of the task.", usage: ["ignitify run:get <run-id> [--full]"], args: { "run-id": "The run id, from task:run or run:list." }, flags: { full: { text: "Print the whole run as JSON, every field the API returns." } } }, [COMMANDS.RUN_LOGS]: { summary: "Print the console output of a run, as the task wrote it.", usage: ["ignitify run:logs <run-id> [--raw]"], args: { "run-id": "The run id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.RUN_DELETE]: { summary: "Delete the record of a run; does not stop a live run.", usage: ["ignitify run:delete <run-id> [--yes]"], args: { "run-id": "The run id." }, flags: YES2 }, [COMMANDS.RUN_CANCEL]: { summary: "Stop a live run, gracefully by default.", usage: ["ignitify run:cancel <run-id> [--yes] [--force] [--grace <ms>]"], args: { "run-id": "The run id." }, flags: { ...YES2, force: { text: "Kill the run now. Also needed when the run is on a pinned VM." }, grace: { text: "Ask for a longer wind-down, in milliseconds. The server limits it." } } }, [COMMANDS.VM_LIST]: { summary: "List your live VMs with their state, age and idle time.", usage: ["ignitify vm:list [--pinned] [--deployment-id D] [--task-name N] [--preset P] [--older-than 24h] [--limit N] [--after-id <vm-id>] [--after <iso>]"], flags: { pinned: { text: "Only pinned VMs: they stay up until you delete them." }, "deployment-id": { text: "Only VMs of this deployment." }, "task-name": { text: "Only VMs of this task." }, preset: { text: "Only VMs of this instance class." }, "older-than": { text: "Only VMs older than this age, for example 24h." }, limit: PAGE2.limit, "after-id": { text: "Page cursor: the VM id of the last row of the page before." }, after: { text: "Only VMs booted after this ISO 8601 time." } } }, [COMMANDS.VM_GET]: { summary: "Show one VM: residency, state, age and its task nature.", usage: ["ignitify vm:get <vm-id>"], args: { "vm-id": "The VM id, from vm:list." } }, [COMMANDS.VM_DELETE]: { summary: "Tear down a VM by hand.", usage: ["ignitify vm:delete <vm-id> [--yes] [--force]"], args: { "vm-id": "The VM id." }, flags: { ...YES2, force: { text: "Allow the delete of a pinned VM. It does not skip the question." } } }, [COMMANDS.SECRET_SET]: { summary: "Store a secret value under a name, read from stdin.", usage: ["ignitify secret:set <NAME> --stdin"], args: { NAME: "The secret name. List it in `secrets` in task.yaml to use it." }, flags: { stdin: { text: "Read the value from stdin. A value on the command line is refused." } }, examples: ['printf %s "$VALUE" | ignitify secret:set DB_PASSWORD --stdin'] }, [COMMANDS.SECRET_LIST]: { summary: "List the names of your secrets.", usage: ["ignitify secret:list"] }, [COMMANDS.SECRET_DELETE]: { summary: "Delete a secret.", usage: ["ignitify secret:delete <NAME> [--yes]"], args: { NAME: "The secret name." }, flags: YES2 }, [COMMANDS.INTEGRATION_ADD]: { summary: "Add an integration package to a Node task and write its settings into task.yaml.", usage: ["ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]"], args: { name: "The integration name. The npm package is @ignitify-integrations/<name>." }, flags: { task: { text: "The task folder name to add the integration to." }, yes: { text: "Apply the plan without the question (needed when not interactive)." }, "dry-run": { text: "Show the plan, then stop. Nothing in the task is changed." }, ...DIR2 }, notes: ["It downloads the latest @ignitify-integrations/<name> with npm pack into a temporary folder and reads the plan from that file. Nothing in the task changes before you answer y.", "The plan shows every task.yaml change, then what you add yourself: secret values and hosts that differ per task.", "After y (or with --yes), it runs npm install @ignitify-integrations/<name>@<that version> in the task folder (a normal dependency, with --ignore-scripts as the build uses), then writes task.yaml. If the install fails, task.yaml is not written.", "An N, --dry-run or a refusal changes nothing: no package.json, lockfile, node_modules or task.yaml change.", "A setting that conflicts with task.yaml, or more egress hosts than the platform allows, is refused and nothing is written.", "Adding the same integration again changes nothing. To upgrade, add it again. To remove it, run npm uninstall; the settings it added stay yours to delete."], examples: ["ignitify integration:add s3-storage --task launch-event", "ignitify integration:add stream --task launch-event --dry-run"] }, [COMMANDS.SCHEDULE_LIST]: { summary: "List runs that wait for a time, soonest first.", usage: ["ignitify schedule:list"] }, [COMMANDS.SCHEDULE_CANCEL]: { summary: "Cancel one scheduled run so that it never fires.", usage: ["ignitify schedule:cancel <sch-id> [--yes]"], args: { "sch-id": "The schedule id, from task:run --at or schedule:list." }, flags: YES2, notes: ['"0 rows" means it is already firing or fired.'] }, [COMMANDS.HOOK_CREATE]: { summary: "Create a webhook that starts a run of one task.", usage: ["ignitify hook:create <deployment-id> --task-name <name>"], args: { "deployment-id": "The deployment the webhook belongs to." }, flags: { "task-name": { text: "The task that each run starts. Required." } }, notes: ["The reply carries a `secret` shown ONCE: hook:list never returns it."] }, [COMMANDS.HOOK_LIST]: { summary: "List the webhooks of a deployment.", usage: ["ignitify hook:list <deployment-id> [--limit N] [--after-id <id>] [--after <iso>]"], args: { "deployment-id": "The deployment id." }, flags: PAGE2 }, [COMMANDS.HOOK_DELETE]: { summary: "Delete a webhook.", usage: ["ignitify hook:delete <hook-resource-id> [--yes]"], args: { "hook-resource-id": "The HOOK's id (hok_\u2026), not the deployment's." }, flags: YES2 }, [COMMANDS.NOTIFY_SET]: { summary: "Set or clear the callback URL of a deployment.", usage: ["ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin", "ignitify notify:set <deployment-id> --clear"], args: { "deployment-id": "The deployment id." }, flags: { url: { text: "The HTTPS address to call. Needs --secret-stdin." }, "secret-stdin": { text: "Read the signing secret from stdin. Needed with --url." }, clear: { text: "Remove the callback URL. Cannot be used with --url." } }, notes: ["There is no --secret flag: a value on argv is in `ps` and in your shell history."] }, [COMMANDS.USAGE]: { summary: "Show what you used in one month, by axis.", usage: [`ignitify usage [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] [--runs|--vms] [--json]`], flags: { period: { text: "The month to show, as YYYY-MM.", default: "this month" }, axis: { text: "Show one axis only." }, vm: { text: "Only the usage of this VM." }, run: { text: "Only the usage of this run." }, runs: { text: "Add the lines behind the totals, one per run." }, vms: { text: "Add the lines behind the totals, one per VM." }, json: { text: "Print the report as JSON." } } }, [COMMANDS.USAGE_EXPORT]: { summary: "Export the usage lines of a month as JSON or CSV.", usage: [`ignitify usage:export [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] (--json|--csv)`], flags: { period: { text: "The month to export, as YYYY-MM.", default: "this month" }, axis: { text: "Export one axis only." }, vm: { text: "Only the lines of this VM." }, run: { text: "Only the lines of this run." }, json: { text: "Print the lines as a JSON array." }, csv: { text: "Print the lines as CSV." } }, notes: ["Name exactly one format: --json or --csv."] } }, HELP_PAGE = { TITLE: "ignitify", TAGLINE: "create, deploy and run tasks", USAGE: "ignitify <command> [arguments] [flags]", USAGE_NOTE: "Every command is <resource>:<verb>.", QUICK_START: [{ command: "ignitify login", text: "Sign this machine in." }, { command: "ignitify task:create my-task", text: "Register a task and write its files." }, { command: "ignitify task:deploy my-task", text: "Build it on the platform." }, { command: "ignitify task:run my-task --wait", text: "Run it and print the result." }], GROUPS: [{ title: "Tasks", resources: ["task"] }, { title: "Deployments", resources: ["deployment"] }, { title: "Runs", resources: ["run"] }, { title: "VMs", resources: ["vm"] }, { title: "Secrets", resources: ["secret"] }, { title: "Integrations", resources: ["integration"] }, { title: "Schedules", resources: ["schedule"] }, { title: "Webhooks", resources: ["hook", "notify"] }, { title: "Account and usage", resources: ["login", "logout", "whoami", "quota", "usage", "help"] }], GLOBAL_FLAGS: [{ flag: "--json", text: "Print the result as one JSON document on stdout." }, { flag: "-h, --help", text: "Print help for the command." }, { flag: "-y, --yes", text: "Answer yes to a delete's question (for scripts)." }, { flag: "-v, --version", text: "Print the client and API version (first word only)." }], ENV: [{ name: ENV.KEY, text: "Your API key, for CI. Wins over the saved login." }, { name: ENV.TASKS_DIR, text: `Folder that holds your task folders (default: ${DEFAULT_TASKS_DIR}).` }, { name: "NO_COLOR", text: "Set to any value to turn colour off." }], NOTES: ["Delete commands always ask first; --force unlocks a refusal, it does not skip the question.", "A flag or argument a command does not take is refused, not ignored.", "On error the CLI prints a clean message and exits non-zero."], DOCS: "https://ignitify.dev/docs", MORE: "Run 'ignitify <command> --help' for the flags of one command.", H: { USAGE: "Usage", QUICK_START: "Quick start", GLOBAL_FLAGS: "Global flags", ENV: "Environment", NOTES: "Good to know", DOCS: "Docs", DESCRIPTION: "Description", ARGUMENTS: "Arguments", FLAGS: "Flags", EXAMPLES: "Examples" }, COLUMNS: { COMMAND: "COMMAND", WHAT: "WHAT IT DOES", FLAG: "FLAG", VALUE: "VALUE", DEFAULT: "DEFAULT", DESCRIPTION: "DESCRIPTION", NAME: "NAME", ARG: "ARGUMENT" }, SWITCH: "switch", DEFAULT: (value) => `Default: ${value}.`, REQUIRED: "required" };
+  OWNER_ONLY = "Needs an owner key (from ignitify login). A user key is refused with owner-required.", PERMISSION_NOTES = [ACCESS.TASKS_WRITE_NOTE, ACCESS.SECRETS_READ_NOTE, ACCESS.HOOKS_WRITE_NOTE], AXES = USAGE_AXES.join("|"), DIR2 = { dir: { text: "Folder that holds your task folders.", default: `$${ENV.TASKS_DIR}, else ${DEFAULT_TASKS_DIR}` } }, YES2 = { yes: { text: "Skip the question (needed when not interactive)." } }, RAW2 = { raw: { text: "Print the bytes exactly as received. Without it, the colours are kept on a colour terminal and every other control code is removed." } }, SERIES_DAYS = { days: { text: `How many UTC days to show, today included. More than ${92} is read as ${92}.`, default: `${30}` } }, FAILURES_DAYS = { days: { text: `How many UTC days to show, today included. More than ${31} is read as ${31}.`, default: `${30}` } }, PAGE2 = { limit: { text: "Rows on the page. The server sets the default and the largest value." }, "after-id": { text: "Page cursor: the id of the last row of the page before." }, after: { text: "Only rows after this ISO 8601 time." } }, VERSION_HELP = { summary: "Print the client version, and the API version if the server answers.", usage: ["ignitify --version"], notes: ["Needs no key. Warns when this client is older than the API supports."] }, COMMAND_HELP = { [COMMANDS.HELP]: { summary: "Print the usage of every command, or of one command.", usage: ["ignitify help [<command>]"], args: { command: "A command name. Leave it out to print every command." }, notes: ["`ignitify <command> --help` prints the same page."], examples: ["ignitify help task:run"] }, [COMMANDS.LOGIN]: { summary: "Sign this machine in and save its API key.", usage: ["ignitify login [--name <label>] [--no-browser]"], flags: { name: { text: "A label for this machine's key; keeps two machines with one hostname apart.", default: "the hostname" }, "no-browser": { text: "Print the sign-in page, but do not open it." } }, notes: ["The key is saved in ~/.config/ignitify/credentials.json (mode 0600)."], examples: ["ignitify login", "ignitify login --name build-server --no-browser"] }, [COMMANDS.LOGOUT]: { summary: "Revoke this machine's key and delete the saved file.", usage: ["ignitify logout"] }, [COMMANDS.WHOAMI]: { summary: "Show who your key belongs to, your limits and usage.", usage: ["ignitify whoami"] }, [COMMANDS.QUOTA]: { summary: "Show what you hold now against your limits.", usage: ["ignitify quota"] }, [COMMANDS.TASK_CREATE]: { summary: "Register a task name and write its starter files.", usage: ["ignitify task:create <task-id> [--lang node|python|go|rust] [--local] [--no-init] [--no-scaffold] [--dir <base-dir>]"], args: { "task-id": "The task name: also the folder name and the slug in task.yaml." }, flags: { lang: { text: "Language of the starter files.", default: "node" }, local: { text: "Write the files only. Calls no server and needs no key." }, "no-init": { text: "Write the short starter that has only run(), without init code." }, "no-scaffold": { text: "Register the task name but write no files." }, ...DIR2 }, examples: ["ignitify task:create image-resize", "ignitify task:create image-resize --lang python --local"] }, [COMMANDS.TASK_LIST]: { summary: "List your tasks, one page at a time.", usage: ["ignitify task:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.TASK_GET]: { summary: "Report a task's deploys, runs and next-step verdicts.", usage: ["ignitify task:get <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2, notes: ["Shows whether the next deploy builds a new image and the next run boots a new VM, with the reasons."] }, [COMMANDS.TASK_VALIDATE]: { summary: "Check task.yaml on your machine; builds nothing.", usage: ["ignitify task:validate <task-id> [--dir <base-dir>] [--review-packages]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, "review-packages": { text: "Then ask the server for an AI review of build.system_packages." } }, notes: ["The review is advice only: the exit code never changes.", "Only package names and the runtime id leave this machine; never code, slug or secrets.", "It also checks that task.yaml still covers each @ignitify-integrations/* package in package.json. A listed package that is not in node_modules stops the check: run npm install first.", "With integrations installed, it sends their package names to the public npm registry (registry.npmjs.org) to find obsolete versions: a warning only. With no network, that warning is skipped with a note."] }, [COMMANDS.TASK_PACK]: { summary: "List the files task:deploy would upload; builds nothing.", usage: ["ignitify task:pack <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2 }, [COMMANDS.TASK_DEPLOY]: { summary: "Upload the task source and wait until the image is built.", usage: ["ignitify task:deploy <task-id> [--dir <base-dir>] [--check]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, check: { text: "Run every local check, then stop. Nothing is uploaded." } }, notes: ["Ctrl+C stops waiting, not the build."], examples: ["ignitify task:deploy image-resize", "ignitify task:deploy image-resize --check"] }, [COMMANDS.TASK_RUN]: { summary: "Start one run of a task from its latest deployment.", usage: ["ignitify task:run <task-id> [--dir <base-dir>] [--deployment <id>] [--payload <json>] [--timeout-sec <n>] [--on-busy queue|reject] [--at <iso>] [--idempotency-key <key>] [--wait]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, deployment: { text: "Run this deployment instead of the task's latest deploy.", default: "the task's latest deploy" }, payload: { text: "JSON input for this run only.", default: "run.payload from task.yaml" }, "timeout-sec": { text: "Time limit in seconds for this run only.", default: "run.timeout_sec from task.yaml" }, "on-busy": { text: "When the run cannot start at once: queue waits for room (a limited time), reject fails at once.", default: "queue" }, at: { text: "Schedule the run for this ISO 8601 time. No run exists until it fires." }, "idempotency-key": { text: "Start at most one run for this key (8 to 255 characters of A-Z a-z 0-9 . _ : -). A retry with the same key gets the first answer again." }, wait: { text: "Follow the run to its end, then print it with its result." } }, notes: ["With --wait the exit code is 0 only when the run is COMPLETED. Ctrl+C stops waiting, not the run.", "--payload and --timeout-sec apply to this run only; task.yaml is never written.", "A bidirectional task runs one VM at a time; --on-busy covers that case too.", "Use --idempotency-key when a script retries after a network error. Use a new key for each new run; the same key with a different run is refused. Pin --deployment in such a script: a new deploy between two tries changes the request."], examples: ["ignitify task:run image-resize --wait", `ignitify task:run image-resize --payload '{"width":320}'`, "ignitify task:run image-resize --at 2027-01-15T03:00:00Z"] }, [COMMANDS.TASK_DELETE]: { summary: "Delete a task with all its deployments and runs.", usage: ["ignitify task:delete <task-id> [--dir <base-dir>] [--yes] [--json]"], args: { "task-id": "The task folder name, or the task id." }, flags: { ...DIR2, ...YES2, json: { text: "Print the plan and the result as one JSON document." } }, notes: ["Also removes the .ignitify/ link of every local folder linked to it; your files are kept."] }, [COMMANDS.DEPLOYMENT_LIST]: { summary: "List your deployments with the size of each image.", usage: ["ignitify deployment:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.DEPLOYMENT_GET]: { summary: "Show one deployment: status, size, integrity.", usage: ["ignitify deployment:get <deployment-id>"], args: { "deployment-id": "The deployment id, from task:deploy or deployment:list." } }, [COMMANDS.DEPLOYMENT_LOGS]: { summary: "Print the build log of a deployment, as the build wrote it.", usage: ["ignitify deployment:logs <deployment-id> [--raw]"], args: { "deployment-id": "The deployment id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.DEPLOYMENT_DELETE]: { summary: "Delete a deployment together with its runs.", usage: ["ignitify deployment:delete <deployment-id> [--yes]"], args: { "deployment-id": "The deployment id." }, flags: YES2 }, [COMMANDS.RUN_LIST]: { summary: "List your runs, with filters.", usage: ["ignitify run:list [--status S] [--deployment-id D] [--task-name N] [--preset P] [--correlation-id C] [--vm-id V] [--limit N] [--after-id <id>] [--after <iso>]"], flags: { status: { text: "Only runs in this status, for example FAILED." }, "deployment-id": { text: "Only runs of this deployment." }, "task-name": { text: "Only runs of this task." }, preset: { text: "Only runs on this instance class." }, "correlation-id": { text: "Only runs with this correlation id." }, "vm-id": { text: "Only runs that used this VM." }, ...PAGE2 } }, [COMMANDS.RUN_GET]: { summary: "Show one run: status, timing and the result of the task.", usage: ["ignitify run:get <run-id> [--full]"], args: { "run-id": "The run id, from task:run or run:list." }, flags: { full: { text: "Print the whole run as JSON, every field the API returns." } } }, [COMMANDS.RUN_LOGS]: { summary: "Print the console output of a run, as the task wrote it.", usage: ["ignitify run:logs <run-id> [--follow] [--tail N] [--raw]"], args: { "run-id": "The run id." }, flags: { ...RAW2, follow: { text: "Keep printing new output until the run has ended." }, tail: { text: "Print only the last N lines of the output so far. With --follow, go on from there." } }, notes: ["Output is best-effort. The host keeps it for 30 days at most. A read that is cut at the size cap says so on stderr. Use --follow to watch a live run.", "The output goes to stdout. With --json and --follow or --tail, each chunk is one JSON line with the offset to read from next.", "Ctrl+C stops following, not the run."], examples: ["ignitify run:logs <run-id> --follow", "ignitify run:logs <run-id> --tail 50"] }, [COMMANDS.RUN_TIMELINE]: { summary: "Show what happened to a run: one line per event, then how it ended.", usage: ["ignitify run:timeline <run-id> [--follow]"], args: { "run-id": "The run id." }, flags: { follow: { text: "Keep printing new events until the run has ended." } }, notes: ["When the run has ended, the exit code is 0 only when it is COMPLETED. A live run read without --follow exits 0.", "With --json --follow, each page of events is one JSON line. Ctrl+C stops following, not the run."], examples: ["ignitify run:timeline <run-id> --follow"] }, [COMMANDS.RUN_FAILURES]: { summary: "Show how your runs failed: by class, then the tasks that fail most.", usage: ["ignitify run:failures [--days N] [--json]"], flags: { ...FAILURES_DAYS, json: { text: "Print the report as JSON." } }, notes: ["A failure is a run that ended FAILED or CANCELLED. The task list leaves out cancelled runs.", "Classes: task (your code or deployment), limit (a plan limit), cancelled, platform (our side)."], examples: ["ignitify run:failures", "ignitify run:failures --days 7"] }, [COMMANDS.NOTIFICATION_LIST]: { summary: "List your notifications and alerts, newest first.", usage: ["ignitify notification:list [--unread | --open] [--kind <kind>] [--limit N] [--json]"], flags: { unread: { text: "Only the notifications you have not read." }, open: { text: "Only the alerts that are still open." }, kind: { text: `Only this kind: ${NOTIFICATION_KINDS.join(", ")}.` }, limit: { text: `How many to show. More than ${NOTIFICATION_PAGE_MAX} is read as ${NOTIFICATION_PAGE_MAX}.`, default: `${NOTIFICATION_PAGE_DEFAULT}` }, json: { text: "Print the page as JSON." } }, notes: [`We keep notifications for ${NOTIFICATION_RETENTION_DAYS} days. Mark them read in the app; this command does not change them.`], examples: ["ignitify notification:list --unread", "ignitify notification:list --open --json"] }, [COMMANDS.RUN_DELETE]: { summary: "Delete the record of a run; does not stop a live run.", usage: ["ignitify run:delete <run-id> [--yes]"], args: { "run-id": "The run id." }, flags: YES2 }, [COMMANDS.RUN_CANCEL]: { summary: "Stop a live run, gracefully by default.", usage: ["ignitify run:cancel <run-id> [--yes] [--force] [--grace <ms>]"], args: { "run-id": "The run id." }, flags: { ...YES2, force: { text: "Kill the run now. Also needed when the run is on a pinned VM." }, grace: { text: "Ask for a longer wind-down, in milliseconds. The server limits it." } } }, [COMMANDS.VM_LIST]: { summary: "List your live VMs with their state, age and idle time.", usage: ["ignitify vm:list [--pinned] [--deployment-id D] [--task-name N] [--preset P] [--older-than 24h] [--limit N] [--after-id <vm-id>] [--after <iso>]"], flags: { pinned: { text: "Only pinned VMs: they stay up until you delete them." }, "deployment-id": { text: "Only VMs of this deployment." }, "task-name": { text: "Only VMs of this task." }, preset: { text: "Only VMs of this instance class." }, "older-than": { text: "Only VMs older than this age, for example 24h." }, limit: PAGE2.limit, "after-id": { text: "Page cursor: the VM id of the last row of the page before." }, after: { text: "Only VMs booted after this ISO 8601 time." } } }, [COMMANDS.VM_GET]: { summary: "Show one VM: residency, state, age and its task nature.", usage: ["ignitify vm:get <vm-id>"], args: { "vm-id": "The VM id, from vm:list." } }, [COMMANDS.VM_DELETE]: { summary: "Tear down a VM by hand.", usage: ["ignitify vm:delete <vm-id> [--yes] [--force]"], args: { "vm-id": "The VM id." }, flags: { ...YES2, force: { text: "Allow the delete of a pinned VM. It does not skip the question." } } }, [COMMANDS.SECRET_SET]: { summary: "Store a secret value under a name, read from stdin.", usage: ["ignitify secret:set <NAME> --stdin"], args: { NAME: "The secret name. List it in `secrets` in task.yaml to use it." }, flags: { stdin: { text: "Read the value from stdin. A value on the command line is refused." } }, examples: ['printf %s "$VALUE" | ignitify secret:set DB_PASSWORD --stdin'] }, [COMMANDS.SECRET_LIST]: { summary: "List the names of your secrets.", usage: ["ignitify secret:list"] }, [COMMANDS.SECRET_DELETE]: { summary: "Delete a secret.", usage: ["ignitify secret:delete <NAME> [--yes]"], args: { NAME: "The secret name." }, flags: YES2 }, [COMMANDS.INTEGRATION_ADD]: { summary: "Add an integration package to a Node task and write its settings into task.yaml.", usage: ["ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]"], args: { name: "The integration name. The npm package is @ignitify-integrations/<name>." }, flags: { task: { text: "The task folder name to add the integration to." }, yes: { text: "Apply the plan without the question (needed when not interactive)." }, "dry-run": { text: "Show the plan, then stop. Nothing in the task is changed." }, ...DIR2 }, notes: ["It downloads the latest @ignitify-integrations/<name> with npm pack into a temporary folder and reads the plan from that file. Nothing in the task changes before you answer y.", "The plan shows every task.yaml change, then what you add yourself: secret values and hosts that differ per task.", "After y (or with --yes), it runs npm install @ignitify-integrations/<name>@<that version> in the task folder (a normal dependency, with --ignore-scripts as the build uses), then writes task.yaml. If the install fails, task.yaml is not written.", "An N, --dry-run or a refusal changes nothing: no package.json, lockfile, node_modules or task.yaml change.", "A setting that conflicts with task.yaml, or more egress hosts than the platform allows, is refused and nothing is written.", "Adding the same integration again changes nothing. To upgrade, add it again. To remove it, run npm uninstall; the settings it added stay yours to delete."], examples: ["ignitify integration:add s3-storage --task launch-event", "ignitify integration:add stream --task launch-event --dry-run"] }, [COMMANDS.SCHEDULE_LIST]: { summary: "List runs that wait for a time, soonest first.", usage: ["ignitify schedule:list"] }, [COMMANDS.SCHEDULE_CANCEL]: { summary: "Cancel one scheduled run so that it never fires.", usage: ["ignitify schedule:cancel <sch-id> [--yes]"], args: { "sch-id": "The schedule id, from task:run --at or schedule:list." }, flags: YES2, notes: ['"0 rows" means it is already firing or fired.'] }, [COMMANDS.HOOK_CREATE]: { summary: "Create a webhook that starts a run of one task.", usage: ["ignitify hook:create <deployment-id> --task-name <name>"], args: { "deployment-id": "The deployment the webhook belongs to." }, flags: { "task-name": { text: "The task that each run starts. Required." } }, notes: ["The reply carries a `secret` shown ONCE: hook:list never returns it."] }, [COMMANDS.HOOK_LIST]: { summary: "List the webhooks of a deployment.", usage: ["ignitify hook:list <deployment-id> [--limit N] [--after-id <id>] [--after <iso>]"], args: { "deployment-id": "The deployment id." }, flags: PAGE2 }, [COMMANDS.HOOK_DELETE]: { summary: "Delete a webhook.", usage: ["ignitify hook:delete <hook-resource-id> [--yes]"], args: { "hook-resource-id": "The HOOK's id (hok_\u2026), not the deployment's." }, flags: YES2 }, [COMMANDS.NOTIFY_SET]: { summary: "Set or clear the callback URL of a deployment.", usage: ["ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin", "ignitify notify:set <deployment-id> --clear"], args: { "deployment-id": "The deployment id." }, flags: { url: { text: "The HTTPS address to call. Needs --secret-stdin." }, "secret-stdin": { text: "Read the signing secret from stdin. Needed with --url." }, clear: { text: "Remove the callback URL. Cannot be used with --url." } }, notes: ["There is no --secret flag: a value on argv is in `ps` and in your shell history."] }, [COMMANDS.USAGE]: { summary: "Show what you used in one month, by axis.", usage: [`ignitify usage [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] [--runs|--vms] [--json]`], flags: { period: { text: "The month to show, as YYYY-MM.", default: "this month" }, axis: { text: "Show one axis only." }, vm: { text: "Only the usage of this VM." }, run: { text: "Only the usage of this run." }, runs: { text: "Add the lines behind the totals, one per run." }, vms: { text: "Add the lines behind the totals, one per VM." }, json: { text: "Print the report as JSON." } } }, [COMMANDS.USAGE_EXPORT]: { summary: "Export the usage lines of a month as JSON or CSV.", usage: [`ignitify usage:export [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] (--json|--csv)`], flags: { period: { text: "The month to export, as YYYY-MM.", default: "this month" }, axis: { text: "Export one axis only." }, vm: { text: "Only the lines of this VM." }, run: { text: "Only the lines of this run." }, json: { text: "Print the lines as a JSON array." }, csv: { text: "Print the lines as CSV." } }, notes: ["Name exactly one format: --json or --csv."] }, [COMMANDS.USAGE_SERIES]: { summary: "Show your usage per day: runs, run durations, compute and egress.", usage: ["ignitify usage:series [--days N] [--json]"], flags: { ...SERIES_DAYS, json: { text: "Print the series as JSON." } }, notes: ["Days are UTC. A run counts on the day it ended. Compute counts when the VM closes, so a running VM shows none yet."], examples: ["ignitify usage:series", "ignitify usage:series --days 7 --json"] }, [COMMANDS.PERMISSION_LIST]: { summary: "List every permission a group can grant, and what it allows.", usage: ["ignitify permission:list [--json]"], notes: ["Needs no key and no server: the list is built into the CLI.", ...PERMISSION_NOTES] }, [COMMANDS.USER_CREATE]: { summary: "Create a user: a name that holds keys and is in groups.", usage: ["ignitify user:create <name> [--json]"], args: { name: "1 to 63 lower case letters, digits and -, unique in your account." }, notes: ["A user has no password and cannot sign in. Add it to a group to give it permissions.", OWNER_ONLY], examples: ["ignitify user:create github-ci"] }, [COMMANDS.USER_LIST]: { summary: "List your users.", usage: ["ignitify user:list [--json]"], notes: [OWNER_ONLY] }, [COMMANDS.USER_GET]: { summary: "Show one user: its groups, permissions and live keys.", usage: ["ignitify user:get <name> [--json]"], args: { name: "The user name." }, notes: [OWNER_ONLY] }, [COMMANDS.USER_REMOVE]: { summary: "Remove a user and revoke all of its keys.", usage: ["ignitify user:remove <name> [--yes]"], args: { name: "The user name." }, flags: YES2, notes: ["Every key of the user stops working at once. The name can be used again.", OWNER_ONLY] }, [COMMANDS.GROUP_CREATE]: { summary: "Create a group with a set of permissions.", usage: ["ignitify group:create <name> --permissions <p1,p2,\u2026> [--json]"], args: { name: "1 to 63 lower case letters, digits and -, unique in your account." }, flags: { permissions: { text: "The permissions the group grants, comma-separated. Required. See permission:list." } }, notes: [...PERMISSION_NOTES, OWNER_ONLY], examples: ["ignitify group:create readers --permissions tasks.read,deployments.read,runs.read,usage.read", "ignitify group:create ci --permissions tasks.read,deployments.read,deployments.write,runs.read,runs.write"] }, [COMMANDS.GROUP_LIST]: { summary: "List your groups and their permissions.", usage: ["ignitify group:list [--json]"], notes: [OWNER_ONLY] }, [COMMANDS.GROUP_GET]: { summary: "Show one group: its permissions and users.", usage: ["ignitify group:get <name> [--json]"], args: { name: "The group name." }, notes: [OWNER_ONLY] }, [COMMANDS.GROUP_GRANT]: { summary: "Add one permission to a group.", usage: ["ignitify group:grant <name> <permission>"], args: { name: "The group name.", permission: "One permission from permission:list." }, notes: [...PERMISSION_NOTES, OWNER_ONLY], examples: ["ignitify group:grant readers secrets.read"] }, [COMMANDS.GROUP_REVOKE]: { summary: "Remove one permission from a group.", usage: ["ignitify group:revoke <name> <permission>"], args: { name: "The group name.", permission: "The permission to remove." }, notes: ["The users of the group lose it at their next request.", OWNER_ONLY] }, [COMMANDS.GROUP_ADD_USER]: { summary: "Put a user in a group.", usage: ["ignitify group:add-user <group> <user>"], args: { group: "The group name.", user: "The user name." }, notes: [OWNER_ONLY], examples: ["ignitify group:add-user ci github-ci"] }, [COMMANDS.GROUP_REMOVE_USER]: { summary: "Take a user out of a group.", usage: ["ignitify group:remove-user <group> <user>"], args: { group: "The group name.", user: "The user name." }, notes: ["The user and its keys stay; they lose what the group granted.", OWNER_ONLY] }, [COMMANDS.GROUP_DELETE]: { summary: "Delete a group. Its users and keys stay.", usage: ["ignitify group:delete <name> [--yes]"], args: { name: "The group name." }, flags: YES2, notes: ["The users of the group lose the permissions it granted.", OWNER_ONLY] }, [COMMANDS.KEY_CREATE]: { summary: "Create an API key for a user.", usage: ["ignitify key:create --user <name> --label <text> [--out <file>] [--json]"], flags: { user: { text: "The user the key belongs to. Required." }, label: { text: "A name for the key, such as where it is used. Required." }, out: { text: "Write the key to this new file (mode 0600) and print only its id. Fails when the file exists." } }, notes: ["The key is shown once. Without --out it is printed; hand it over by hand and do not keep a copy.", "Owner keys come from ignitify login. This command makes user keys only.", OWNER_ONLY], examples: ["ignitify key:create --user github-ci --label github --out ./github-ci.key"] }, [COMMANDS.KEY_LIST]: { summary: "List the live keys of your account. Never a raw key.", usage: ["ignitify key:list [--user <name>] [--json]"], flags: { user: { text: "Only the keys of this user." } }, notes: ["The user column says owner for an owner key.", OWNER_ONLY] }, [COMMANDS.KEY_REVOKE]: { summary: "Revoke a key. It stops working at once.", usage: ["ignitify key:revoke <key-resource-id> [--yes]"], args: { "key-resource-id": "The key id, from key:list." }, flags: YES2, notes: [OWNER_ONLY] } }, HELP_PAGE = { TITLE: "ignitify", TAGLINE: "create, deploy and run tasks", USAGE: "ignitify <command> [arguments] [flags]", USAGE_NOTE: "Every command is <resource>:<verb>.", QUICK_START: [{ command: "ignitify login", text: "Sign this machine in." }, { command: "ignitify task:create my-task", text: "Register a task and write its files." }, { command: "ignitify task:deploy my-task", text: "Build it on the platform." }, { command: "ignitify task:run my-task --wait", text: "Run it and print the result." }], GROUPS: [{ title: "Tasks", resources: ["task"] }, { title: "Deployments", resources: ["deployment"] }, { title: "Runs", resources: ["run"] }, { title: "VMs", resources: ["vm"] }, { title: "Secrets", resources: ["secret"] }, { title: "Integrations", resources: ["integration"] }, { title: "Schedules", resources: ["schedule"] }, { title: "Webhooks", resources: ["hook", "notify"] }, { title: "Access", resources: ["permission", "user", "group", "key"] }, { title: "Account and usage", resources: ["login", "logout", "whoami", "quota", "usage", "notification", "help"] }], GLOBAL_FLAGS: [{ flag: "--json", text: "Print the result as one JSON document on stdout." }, { flag: "-h, --help", text: "Print help for the command." }, { flag: "-y, --yes", text: "Answer yes to a delete's question (for scripts)." }, { flag: "-v, --version", text: "Print the client and API version (first word only)." }], ENV: [{ name: ENV.KEY, text: "Your API key, for CI. Wins over the saved login." }, { name: ENV.TASKS_DIR, text: `Folder that holds your task folders (default: ${DEFAULT_TASKS_DIR}).` }, { name: "NO_COLOR", text: "Set to any value to turn colour off." }], NOTES: ["Delete commands always ask first; --force unlocks a refusal, it does not skip the question.", "A flag or argument a command does not take is refused, not ignored.", "On error the CLI prints a clean message and exits non-zero."], DOCS: SITE_LINKS.DOCS, MORE: "Run 'ignitify <command> --help' for the flags of one command.", H: { USAGE: "Usage", QUICK_START: "Quick start", GLOBAL_FLAGS: "Global flags", ENV: "Environment", NOTES: "Good to know", DOCS: "Docs", DESCRIPTION: "Description", ARGUMENTS: "Arguments", FLAGS: "Flags", EXAMPLES: "Examples" }, COLUMNS: { COMMAND: "COMMAND", WHAT: "WHAT IT DOES", FLAG: "FLAG", VALUE: "VALUE", DEFAULT: "DEFAULT", DESCRIPTION: "DESCRIPTION", NAME: "NAME", ARG: "ARGUMENT" }, SWITCH: "switch", DEFAULT: (value) => `Default: ${value}.`, REQUIRED: "required" };
 } });
 function entryOf(name) {
   if (name === VERSION_NAME) return { help: VERSION_HELP, meta: VERSION_META };
@@ -1937,7 +2102,7 @@ function placeholderOf(forms, flag) {
 }
 function flagRows(help, meta) {
   let words = help.flags ?? {}, known = { ...meta.flags, ...GLOBAL_FLAGS }, shortOf = Object.fromEntries(Object.entries(SHORT_FLAGS).map(([s, l]) => [l, s]));
-  return Object.entries(words).filter(([flag]) => Object.hasOwn(known, flag) && !HIDDEN_FLAGS.includes(flag)).map(([flag, w]) => {
+  return Object.entries(words).filter(([flag]) => Object.hasOwn(known, flag)).map(([flag, w]) => {
     let short = shortOf[flag], value = known[flag] === "value" ? placeholderOf(help.usage, flag) : HELP_PAGE.SWITCH, text = w.default === void 0 ? w.text : `${w.text} ${HELP_PAGE.DEFAULT(w.default)}`;
     return [short === void 0 ? `--${flag}` : `-${short}, --${flag}`, value, text];
   });
@@ -2057,17 +2222,23 @@ function explainRunRefusal(e) {
 `);
 }
 function explainLimitRefusal(e) {
-  let refused = httpErrorJson(e);
-  if (!refused || refused.status !== 429) return null;
-  let { summary, reason } = refused.body;
+  let refused2 = httpErrorJson(e);
+  if (!refused2 || refused2.status !== 429) return null;
+  let { summary, reason } = refused2.body;
   return typeof summary != "string" || summary === "" ? null : [`\u2717 Run refused \u2014 a monthly limit is reached (${typeof reason == "string" ? reason : "429"}).`, `  ${summary}`].join(`
 `);
 }
-var isPayloadTooLarge, init_run_refusal = __esm({ "src/output/run-refusal.ts"() {
+function idempotencyRefusal(e) {
+  let refused2 = httpErrorJson(e), hint = refused2 ? IDEMPOTENCY_REFUSAL_HINTS[refused2.status] : void 0, error = refused2?.body.error;
+  return !refused2 || hint === void 0 || typeof error != "string" || error === "" ? null : { error, hint };
+}
+var IDEMPOTENCY_REFUSAL_HINTS, isPayloadTooLarge, init_run_refusal = __esm({ "src/output/run-refusal.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
+  init_constants();
   init_tenant();
+  IDEMPOTENCY_REFUSAL_HINTS = { 409: MESSAGES.IDEMPOTENCY_IN_PROGRESS_HINT, 422: MESSAGES.IDEMPOTENCY_KEY_REUSED_HINT };
   isPayloadTooLarge = (e) => e instanceof HttpError && e.status === 413;
 } });
 function renderUsageReport(st, r, opts = { lines: false }) {
@@ -2091,6 +2262,77 @@ var init_usage2 = __esm({ "src/output/usage.ts"() {
   init_constants2();
   init_table();
 } });
+function attrText(value) {
+  return value === null || typeof value != "object" ? typeof value == "string" && !/^[\w.:/@+-]+$/.test(value) ? JSON.stringify(value) : String(value) : JSON.stringify(value.text);
+}
+function timelineLine(event) {
+  let attrs = Object.entries(event.attrs).filter(([key, value]) => key !== CAUSE_ATTR && value !== null).map(([key, value]) => `${key}=${attrText(value)}`), line = [event.at, event.label, ...attrs.length > 0 ? [attrs.join(" ")] : []].join("  ");
+  return terminalSafe(line, false).replace(/[\n\t]/g, " ");
+}
+var CAUSE_ATTR, init_timeline = __esm({ "src/output/timeline.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_style();
+  CAUSE_ATTR = "cause";
+} });
+function renderUsageSeries(st, r) {
+  let I2 = LAYOUT.INDENT, statusColumns = TERMINAL_RUN_STATUSES.map((s) => ({ header: s, keep: true })), table = renderTable(st, [{ header: "DAY", keep: true }, ...statusColumns, { header: "P50", keep: true }, { header: "P95", keep: true }, { header: "COMPUTE", keep: true }, { header: "EGRESS", keep: true }], r.series.map((d) => [d.day, ...TERMINAL_RUN_STATUSES.map((s) => runsIn(d, s)), durationText(st, d.duration_ms_p50), durationText(st, d.duration_ms_p95), formatUsageQuantity(d.compute_ms, AXIS_UNIT.compute), formatUsageQuantity(d.egress_bytes, AXIS_UNIT.network)]), { indent: I2 });
+  return [heading(st, `usage per day, ${windowText(r.days)}`), "", table, "", st.dim(`${I2}note: runs count on the day they ended; P50 and P95 are the run durations of that day.`), st.dim(`${I2}      \`compute\` = VM time, counted when the VM closes. The egress of a past day can still grow.`)].join(`
+`);
+}
+function renderFailures(st, r) {
+  let I2 = LAYOUT.INDENT, out2 = [heading(st, `failed and cancelled runs, ${windowText(r.days)}`), ""];
+  return out2.push(renderTable(st, [{ header: "CLASS", keep: true }, { header: "RUNS", keep: true }, { header: "MEANING" }], FAILURE_CLASSES.map((c) => [c, r.by_class[c], FAILURE_CLASS_TEXT[c].hint]), { indent: I2 }), ""), r.top_tasks.length === 0 ? (out2.push(st.dim(`${I2}No task failed in this window.`)), out2.join(`
+`)) : (out2.push(renderTable(st, [{ header: "TASK" }, { header: "FAILURES", keep: true }], r.top_tasks.map((t) => [t.task_name === null ? NO_TASK_NAME_TEXT : terminalSafe(t.task_name, false), t.failures]), { indent: I2 }), "", st.dim(`${I2}note: the task list leaves out cancelled runs.`)), out2.join(`
+`));
+}
+var windowText, runsIn, durationText, init_reports = __esm({ "src/output/reports.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_http_client();
+  init_blocks();
+  init_constants2();
+  init_style();
+  init_table();
+  windowText = (days) => `last ${days} ${days === 1 ? "day" : "days"} (UTC)`, runsIn = (day, status) => day.runs[status] ?? 0, durationText = (st, ms) => ms === null ? st.glyphs.dash : formatUsageQuantity(ms, AXIS_UNIT.compute);
+} });
+function severityWord(st, s) {
+  let word = s.toUpperCase();
+  return s === "critical" ? st.red(word) : s === "warning" ? st.yellow(word) : st.dim(word);
+}
+function factsOf(n) {
+  let facts = [];
+  return n.read || facts.push("unread"), n.state === "open" && facts.push("open"), n.state === "resolved" && n.resolved_at !== null && facts.push(`resolved ${terminalSafe(n.resolved_at, false)}`), n.occurrences > 1 && facts.push(`${n.occurrences} times`), facts;
+}
+function commandOf(a) {
+  return a.type === "open-run" ? `ignitify ${COMMANDS.RUN_GET} ${terminalSafe(a.run_id, false)}` : a.type === "usage" ? `ignitify ${COMMANDS.QUOTA}` : null;
+}
+function card(st, n) {
+  let I2 = LAYOUT.INDENT, title = terminalSafe(n.title, false), facts = factsOf(n), head = `${I2}${severityWord(st, n.severity)}  ${n.read ? title : st.bold(title)}${facts.length > 0 ? st.dim(`  (${facts.join(", ")})`) : ""}`, text = wrapText(terminalSafe(n.text, false), st.width - 2 * I2.length).map((l) => `${I2}${I2}${l}`), ids = [n.id, n.last_at, ...n.subject === null ? [] : [`${n.subject.type} ${n.subject.id}`]].map((s) => terminalSafe(s, false)), next = (n.actions ?? []).flatMap((a) => {
+    let cmd = commandOf(a);
+    return cmd === null ? [] : [`${I2}${I2}next: ${cmd}`];
+  });
+  return [head, ...text, st.dim(`${I2}${I2}${ids.join("  ")}`), ...next].join(`
+`);
+}
+function renderNotifications(st, r) {
+  let I2 = LAYOUT.INDENT;
+  return r.items.length === 0 ? `${heading(st, "notifications")}
+
+${st.dim(`${I2}No notifications.`)}` : [heading(st, "notifications, newest first"), "", r.items.map((n) => card(st, n)).join(`
+
+`)].join(`
+`);
+}
+var init_notifications = __esm({ "src/output/notifications.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_blocks();
+  init_constants2();
+  init_style();
+} });
 var init_output = __esm({ "src/output/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -2108,6 +2350,10 @@ var init_output = __esm({ "src/output/index.ts"() {
   init_deletion_plan();
   init_run_refusal();
   init_usage2();
+  init_timeline();
+  init_reports();
+  init_notifications();
+  init_access2();
 } });
 function planAdvice(config) {
   let declared = config.build?.system_packages ?? [];
@@ -2127,127 +2373,31 @@ var init_package_advice3 = __esm({ "src/core/package-advice.ts"() {
   init_constants();
 } });
 var version, init_package = __esm({ "package.json"() {
-  version = "1.2.1";
+  version = "2.0.0";
 } });
-var byCreatedAtDesc, init_sort = __esm({ "src/utils/sort.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  byCreatedAtDesc = (rows) => [...rows].sort((a, b) => (b.created_at ?? "").localeCompare(a.created_at ?? ""));
-} });
-function apiUrlOf(args) {
-  return strOpt(args, "api") ?? DEFAULTS.API_URL;
+function apiUrlFor(env, release = RELEASE_BUILD) {
+  return release ? DEFAULTS.API_URL : env[ENV.DEV_API_URL] || DEFAULTS.API_URL;
 }
-function boolFlag(args, key) {
-  return args.options[key] === true;
-}
-function requiredArg(args) {
-  return args.positionals[0];
-}
-function requireArg(args, label) {
-  let id = requiredArg(args);
-  return id || (fail(MESSAGES.ARG_REQUIRED(label)), null);
-}
-var init_args2 = __esm({ "src/utils/args.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_constants();
-  init_output();
-  init_http_client();
-  init_http_client();
-} });
-function traceLine(e) {
-  return e instanceof HttpError && e.traceId ? MESSAGES.SERVER_TRACE_ID(e.traceId) : null;
-}
-function keyExpiredHint(e) {
-  let refused = httpErrorJson(e);
-  return refused?.status === 401 && refused.body.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
-}
-function printError(e) {
-  fail(errText(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
-}
-async function guard(body) {
-  return await guardValue(body) ?? 1;
-}
-async function guardValue(body) {
-  try {
-    return await body();
-  } catch (e) {
-    printError(e);
-    return;
+function apiUrlRefusal(url) {
+  switch (keyUrlRefusal(url)) {
+    case "not-url":
+      return MESSAGES.API_URL_NOT_URL(url);
+    case "insecure":
+      return MESSAGES.API_URL_NOT_HTTPS(url);
+    case null:
+      return null;
   }
 }
-var init_guard = __esm({ "src/utils/guard.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
-  init_tenant();
-  init_constants();
-  init_output();
-} });
-var import_node_readline, ttyPrompter, init_prompt = __esm({ "src/io/prompt.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  import_node_readline = __toESM(require("node:readline"), 1);
-  init_output();
-  ttyPrompter = { async confirm(question) {
-    if (!process.stdin.isTTY) return fail("Refusing to proceed: not a TTY. Re-run with --yes to confirm non-interactively."), false;
-    let rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stderr });
-    try {
-      let answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
-      return /^y(es)?$/i.test(answer.trim());
-    } finally {
-      rl.close();
-    }
-  } };
-} });
-async function confirmOrAbort(args, prompter = ttyPrompter, question = MESSAGES.CONFIRM_PROCEED) {
-  return boolFlag(args, "yes") || await prompter.confirm(question) ? true : (say(MESSAGES.ABORTED), false);
-}
-var init_prompt_flow = __esm({ "src/utils/prompt-flow.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_prompt();
-  init_constants();
-  init_args2();
-  init_manager();
-} });
-var REAL_CLOCK, init_clock = __esm({ "src/utils/clock.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  REAL_CLOCK = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
-} });
-function snakeCaseKeys(value) {
-  return Array.isArray(value) ? value.map(snakeCaseKeys) : typeof value != "object" || value === null ? value : Object.fromEntries(Object.entries(value).map(([k, v]) => [k.replace(/([a-z0-9])([A-Z])/g, (_, a, b) => `${a}_${b.toLowerCase()}`), snakeCaseKeys(v)]));
-}
-var init_snake_case = __esm({ "src/utils/snake-case.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-} });
-function nextPageNoteFor2(args, list2, rows) {
-  return nextPageNoteFor(PROGRAM, args, { ...list2, flags: [...Object.keys(list2.flags), ...REPEATED_GLOBAL_FLAGS] }, rows, effectivePageLimit(strOpt(args, "limit")));
-}
-function limitRefusal(args) {
-  let raw = args.options.limit;
-  return typeof raw == "string" ? pageLimitRefusal(raw) : null;
+function assertApiUrl(url) {
+  let refusal = apiUrlRefusal(url);
+  if (refusal !== null) throw new Error(refusal);
+  return url;
 }
-var PROGRAM, REPEATED_GLOBAL_FLAGS, init_page2 = __esm({ "src/utils/page.ts"() {
+var init_api_url = __esm({ "src/core/api-url.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  init_tenant();
   init_http_client();
-  init_args2();
-  PROGRAM = "ignitify", REPEATED_GLOBAL_FLAGS = ["api"];
-} });
-var init_utils = __esm({ "src/utils/index.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_sort();
-  init_args2();
-  init_guard();
-  init_prompt_flow();
-  init_clock();
-  init_snake_case();
-  init_page2();
+  init_constants();
 } });
 function floorWarning(client, floor) {
   if (!floor) return null;
@@ -2275,8 +2425,8 @@ async function describeServer(baseUrl, fetchImpl = fetch, check = noteServerVers
   let floor = res.headers.get(CLIENT_FLOOR_HEADER);
   return `API: ${api} at ${baseUrl}${floor ? ` (minimum client ${floor})` : ""}`;
 }
-async function runVersion(args, fetchImpl = fetch) {
-  let baseUrl = apiUrlOf(args), st = outStyle();
+async function runVersion(fetchImpl = fetch, env = process.env) {
+  let baseUrl = apiUrlFor(env), st = outStyle();
   return out(`${st.bold(`ignitify ${CLIENT_VERSION}`)} ${st.dim(`(built for API ${API_VERSION})`)}`), out(st.dim(await describeServer(baseUrl, fetchImpl))), 0;
 }
 var CLIENT_VERSION, PROBE_TIMEOUT_MS, noteServerVersion, init_version = __esm({ "src/io/version.ts"() {
@@ -2286,7 +2436,7 @@ var CLIENT_VERSION, PROBE_TIMEOUT_MS, noteServerVersion, init_version = __esm({
   init_tenant();
   init_constants();
   init_semver();
-  init_utils();
+  init_api_url();
   init_output();
   CLIENT_VERSION = version, PROBE_TIMEOUT_MS = 3e3;
   noteServerVersion = createStalenessCheck(CLIENT_VERSION, (msg) => warn(msg));
@@ -2355,16 +2505,25 @@ function readCredentials(file = credentialsPath(), fsx = import_node_fs2.default
     fsx.closeSync(fd);
   }
 }
-function writeCredentialsAtomic(creds, file = credentialsPath(), fsx = import_node_fs2.default) {
-  secureCredentialsDir(import_node_path.default.dirname(file), fsx);
-  let temp = `${file}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`, fd = fsx.openSync(temp, "wx", CREDENTIALS.FILE_MODE);
+function createPrivateFile(file, fsx = import_node_fs2.default) {
+  return fsx.openSync(file, "wx", CREDENTIALS.FILE_MODE);
+}
+function discardPrivateFile(fd, file, fsx = import_node_fs2.default) {
+  fsx.closeSync(fd), fsx.unlinkSync(file);
+}
+function fillPrivateFile(fd, file, text, fsx = import_node_fs2.default) {
   try {
-    fsx.writeSync(fd, `${JSON.stringify(creds, null, 2)}
-`), fsx.fsyncSync(fd);
+    fsx.writeSync(fd, text), fsx.fsyncSync(fd);
   } catch (e) {
-    throw fsx.closeSync(fd), fsx.unlinkSync(temp), e;
+    throw discardPrivateFile(fd, file, fsx), e;
   }
   fsx.closeSync(fd);
+}
+function writeCredentialsAtomic(creds, file = credentialsPath(), fsx = import_node_fs2.default) {
+  secureCredentialsDir(import_node_path.default.dirname(file), fsx);
+  let temp = `${file}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
+  fillPrivateFile(createPrivateFile(temp, fsx), temp, `${JSON.stringify(creds, null, 2)}
+`, fsx);
   try {
     fsx.renameSync(temp, file);
   } catch (e) {
@@ -2435,29 +2594,8 @@ var UnreachableError, init_unreachable = __esm({ "src/core/unreachable.ts"() {
     }
   };
 } });
-function apiUrlRefusal(url) {
-  switch (keyUrlRefusal(url)) {
-    case "not-url":
-      return MESSAGES.API_URL_NOT_URL(url);
-    case "insecure":
-      return MESSAGES.API_URL_NOT_HTTPS(url);
-    case null:
-      return null;
-  }
-}
-function assertApiUrl(url) {
-  let refusal = apiUrlRefusal(url);
-  if (refusal !== null) throw new Error(refusal);
-  return url;
-}
-var init_api_url = __esm({ "src/core/api-url.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
-  init_constants();
-} });
-function resolveApiConfig(apiOverride, env = process.env, read = () => readCredentials(), note = noteEnvOverride) {
-  let baseUrl = assertApiUrl(apiOverride ?? DEFAULTS.API_URL), envKey = env[ENV.KEY];
+function resolveApiConfig(env = process.env, read = () => readCredentials(), note = noteEnvOverride) {
+  let baseUrl = assertApiUrl(apiUrlFor(env)), envKey = env[ENV.KEY];
   if (envKey) return envOverridesLogin(baseUrl, readOrNone(read)) && note(MESSAGES.ENV_KEY_OVERRIDES_LOGIN), { baseUrl, token: envKey };
   let saved = read();
   if (saved.kind === "none") throw new Error(MESSAGES.NOT_SIGNED_IN);
@@ -2516,9 +2654,9 @@ async function pollDeviceLogin(cfg, deviceCode, fetchImpl) {
   return { kind: "key", key };
 }
 function slowDownOf(e) {
-  let refused = httpErrorJson(e);
-  if (refused?.status !== 429 || refused.body.status !== "slow_down") return null;
-  let interval = refused.body.interval;
+  let refused2 = httpErrorJson(e);
+  if (refused2?.status !== 429 || refused2.body.status !== "slow_down") return null;
+  let interval = refused2.body.interval;
   return typeof interval == "number" ? interval : null;
 }
 function revokeOwnKey(cfg, fetchImpl) {
@@ -2531,9 +2669,11 @@ async function postDeployment(cfg, taskId, manifest, tar, fetchImpl) {
   let form = new FormData();
   return form.set("task_id", taskId), form.set("manifest", JSON.stringify(manifest)), form.set("bundle", new Blob([new Uint8Array(tar)], { type: "application/x-tar" }), "bundle.tar"), await request(`${cfg.baseUrl}${TENANT_PATHS.DEPLOYMENTS}`, { method: "POST", headers: authHeaders(cfg), body: form, fetchImpl: viaApi(fetchImpl), timeoutMs: 3e5, ...readHeaders });
 }
-function postRun(cfg, run2, fetchImpl) {
-  let body = { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at };
-  return apiPost(cfg, TENANT_PATHS.RUNS, body, fetchImpl);
+async function postRun(cfg, run2, fetchImpl) {
+  let body = { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at }, replayed = false;
+  return { answer: await apiPost(cfg, TENANT_PATHS.RUNS, body, fetchImpl, void 0, { headers: idempotencyHeaders(run2.idempotencyKey), onHeaders: (headers) => {
+    replayed = isReplayedAnswer(headers);
+  } }), replayed };
 }
 async function listSchedules(cfg, fetchImpl) {
   return apiGet(cfg, TENANT_PATHS.SCHEDULES, fetchImpl);
@@ -2544,8 +2684,10 @@ function deleteSchedule(cfg, scheduleId, fetchImpl) {
 function apiGet(cfg, path12, fetchImpl) {
   return request(`${cfg.baseUrl}${path12}`, { headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), ...readHeaders });
 }
-function apiPost(cfg, path12, body, fetchImpl, timeoutMs) {
-  return request(`${cfg.baseUrl}${path12}`, { method: "POST", headers: { ...authHeaders(cfg), "content-type": "application/json" }, body, fetchImpl: viaApi(fetchImpl), timeoutMs, ...readHeaders });
+function apiPost(cfg, path12, body, fetchImpl, timeoutMs, extras = {}) {
+  return request(`${cfg.baseUrl}${path12}`, { method: "POST", headers: { ...authHeaders(cfg), "content-type": "application/json", ...extras.headers }, body, fetchImpl: viaApi(fetchImpl), timeoutMs, onHeaders: (headers) => {
+    readHeaders.onHeaders(headers), extras.onHeaders?.(headers);
+  } });
 }
 function apiDelete(cfg, path12, fetchImpl) {
   return request(`${cfg.baseUrl}${path12}`, { method: "DELETE", headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), ...readHeaders });
@@ -2559,6 +2701,15 @@ function getWhoami(cfg, fetchImpl) {
 function getUsage(cfg, filters2 = {}, fetchImpl) {
   return apiGet(cfg, `${TENANT_PATHS.USAGE}${buildQuery(filters2)}`, fetchImpl);
 }
+function getUsageSeries(cfg, days, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.USAGE_SERIES}${daysQuery(days)}`, fetchImpl);
+}
+function getRunFailures(cfg, days, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.RUN_FAILURES}${daysQuery(days)}`, fetchImpl);
+}
+function listNotifications(cfg, params, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.NOTIFICATIONS}${buildQuery(params)}`, fetchImpl);
+}
 function setSecret(cfg, name, value, fetchImpl) {
   return apiPost(cfg, TENANT_PATHS.SECRETS, { name, value }, fetchImpl);
 }
@@ -2580,6 +2731,52 @@ function deleteHook(cfg, hookId, fetchImpl) {
 function setNotify(cfg, deploymentId, body, fetchImpl) {
   return apiPut(cfg, TENANT_PATHS.DEPLOYMENT_NOTIFY(deploymentId), body, fetchImpl);
 }
+function createUser(cfg, name, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.USERS, { name }, fetchImpl);
+}
+function listUsers(cfg, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.USERS, fetchImpl);
+}
+function getUser(cfg, name, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.USER_BY_ID(name), fetchImpl);
+}
+function deleteUser(cfg, name, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.USER_BY_ID(name), fetchImpl);
+}
+function createGroup(cfg, name, permissions, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.GROUPS, { name, permissions }, fetchImpl);
+}
+function listGroups(cfg, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.GROUPS, fetchImpl);
+}
+function getGroup(cfg, name, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.GROUP_BY_ID(name), fetchImpl);
+}
+function deleteGroup(cfg, name, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_BY_ID(name), fetchImpl);
+}
+function grantGroupPermission(cfg, name, permission, fetchImpl) {
+  return apiPut(cfg, TENANT_PATHS.GROUP_PERMISSION(name, permission), void 0, fetchImpl);
+}
+function revokeGroupPermission(cfg, name, permission, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_PERMISSION(name, permission), fetchImpl);
+}
+function addGroupUser(cfg, name, user, fetchImpl) {
+  return apiPut(cfg, TENANT_PATHS.GROUP_USER(name, user), void 0, fetchImpl);
+}
+function removeGroupUser(cfg, name, user, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_USER(name, user), fetchImpl);
+}
+function createKey(cfg, body, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.KEYS, body, fetchImpl);
+}
+function listKeys(cfg, user, fetchImpl) {
+  let q = buildQuery({ [KEY_LIST_QUERY.USER]: user });
+  return apiGet(cfg, `${TENANT_PATHS.KEYS}${q}`, fetchImpl);
+}
+function deleteKey(cfg, keyId, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.KEY_BY_ID(keyId), fetchImpl);
+}
 async function postPackageAdvice(cfg, body, fetchImpl) {
   try {
     return { kind: "ok", response: await apiPost(cfg, TENANT_PATHS.PACKAGE_ADVICE, body, fetchImpl, ADVICE.TIMEOUT_MS) };
@@ -2627,6 +2824,29 @@ function getApiRun(cfg, runId, fetchImpl) {
 function getApiRunLogs(cfg, runId, fetchImpl) {
   return apiGet(cfg, TENANT_PATHS.RUN_LOGS(runId), fetchImpl);
 }
+async function apiFollowGet(cfg, path12, fetchImpl) {
+  let retryAfter = null;
+  try {
+    return { ok: true, data: await request(`${cfg.baseUrl}${path12}`, { headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), onHeaders: (headers) => {
+      readHeaders.onHeaders(headers), retryAfter = headers.get(RETRY_AFTER_HEADER);
+    } }) };
+  } catch (error) {
+    return { ok: false, error, retryAfterMs: retryAfterMs(retryAfter, Date.now()) };
+  }
+}
+function readRunTimeline(cfg, runId, query, fetchImpl) {
+  let q = buildQuery({ [OBS_QUERY.CURSOR]: query.cursor ?? void 0, [OBS_QUERY.WAIT_SEC]: query.waitSec === void 0 ? void 0 : String(query.waitSec) });
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUN_TIMELINE(runId)}${q}`, fetchImpl);
+}
+function readRunOutput(cfg, runId, fromOffset, fetchImpl) {
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUN_LOGS(runId)}${buildQuery({ [OBS_QUERY.FROM_OFFSET]: String(fromOffset) })}`, fetchImpl);
+}
+function readRunList(cfg, params = {}, fetchImpl) {
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUNS}${buildQuery(params)}`, fetchImpl);
+}
+function readRunForFollow(cfg, runId, fetchImpl) {
+  return apiFollowGet(cfg, TENANT_PATHS.RUN_BY_ID(runId), fetchImpl);
+}
 function deleteRun(cfg, runId, fetchImpl) {
   return apiDelete(cfg, TENANT_PATHS.RUN_BY_ID(runId), fetchImpl);
 }
@@ -2645,28 +2865,151 @@ async function getApiVm(cfg, vmId, fetchImpl) {
 function deleteVm(cfg, vmId, force = false, fetchImpl) {
   return apiDelete(cfg, `${TENANT_PATHS.VM_BY_ID(vmId)}${forceQuery(force)}`, fetchImpl);
 }
-var readHeaders, noteEnvOverride, versionHeader, BadAnswerError, init_api = __esm({ "src/io/api.ts"() {
+var readHeaders, idempotencyHeaders, isReplayedAnswer, noteEnvOverride, versionHeader, BadAnswerError, daysQuery, init_api = __esm({ "src/io/api.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_output();
+  init_constants();
+  init_package_advice3();
+  init_version();
+  init_credentials();
+  init_unreachable();
+  init_api_url();
+  init_tenant();
+  readHeaders = { onHeaders: noteServerVersion }, idempotencyHeaders = (key) => key === void 0 ? {} : { [IDEMPOTENCY_KEY_HEADER]: key }, isReplayedAnswer = (headers) => headers.get(IDEMPOTENT_REPLAYED_HEADER) === "true";
+  noteEnvOverride = /* @__PURE__ */ (() => {
+    let noted = false;
+    return (msg) => {
+      noted || (noted = true, warn(msg));
+    };
+  })();
+  versionHeader = { [CLI_VERSION_HEADER]: CLIENT_VERSION };
+  BadAnswerError = class extends Error {
+  };
+  daysQuery = (days) => buildQuery({ [OBS_QUERY.DAYS]: days === null ? void 0 : String(days) });
+} });
+var byCreatedAtDesc, init_sort = __esm({ "src/utils/sort.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  byCreatedAtDesc = (rows) => [...rows].sort((a, b) => (b.created_at ?? "").localeCompare(a.created_at ?? ""));
+} });
+function parseWholeCount(raw) {
+  if (!/^[1-9][0-9]*$/.test(raw)) return null;
+  let n = Number(raw);
+  return Number.isSafeInteger(n) ? n : null;
+}
+function boolFlag(args, key) {
+  return args.options[key] === true;
+}
+function requiredArg(args) {
+  return args.positionals[0];
+}
+function requireArg(args, label) {
+  let id = requiredArg(args);
+  return id || (fail(MESSAGES.ARG_REQUIRED(label)), null);
+}
+var init_args2 = __esm({ "src/utils/args.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_output();
+  init_http_client();
+} });
+function traceLine(e) {
+  return e instanceof HttpError && e.traceId ? MESSAGES.SERVER_TRACE_ID(e.traceId) : null;
+}
+function keyExpiredHint(e) {
+  let refused2 = httpErrorJson(e);
+  return refused2?.status === 401 && refused2.body.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
+}
+function printError(e) {
+  fail(accessRefusalText(e) ?? errText(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
+}
+async function guard(body) {
+  return await guardValue(body) ?? 1;
+}
+async function guardValue(body) {
+  try {
+    return await body();
+  } catch (e) {
+    printError(e);
+    return;
+  }
+}
+var init_guard = __esm({ "src/utils/guard.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
+  init_tenant();
+  init_constants();
   init_output();
+  init_access();
+} });
+var import_node_readline, ttyPrompter, init_prompt = __esm({ "src/io/prompt.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  import_node_readline = __toESM(require("node:readline"), 1);
+  init_output();
+  ttyPrompter = { async confirm(question) {
+    if (!process.stdin.isTTY) return fail("Refusing to proceed: not a TTY. Re-run with --yes to confirm non-interactively."), false;
+    let rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+      let answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
+      return /^y(es)?$/i.test(answer.trim());
+    } finally {
+      rl.close();
+    }
+  } };
+} });
+async function confirmOrAbort(args, prompter = ttyPrompter, question = MESSAGES.CONFIRM_PROCEED) {
+  return boolFlag(args, "yes") || await prompter.confirm(question) ? true : (say(MESSAGES.ABORTED), false);
+}
+var init_prompt_flow = __esm({ "src/utils/prompt-flow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_prompt();
   init_constants();
-  init_package_advice3();
-  init_version();
-  init_credentials();
-  init_unreachable();
-  init_api_url();
+  init_args2();
+  init_manager();
+} });
+var REAL_CLOCK, init_clock = __esm({ "src/utils/clock.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  REAL_CLOCK = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
+} });
+function snakeCaseKeys(value) {
+  return Array.isArray(value) ? value.map(snakeCaseKeys) : typeof value != "object" || value === null ? value : Object.fromEntries(Object.entries(value).map(([k, v]) => [k.replace(/([a-z0-9])([A-Z])/g, (_, a, b) => `${a}_${b.toLowerCase()}`), snakeCaseKeys(v)]));
+}
+var init_snake_case = __esm({ "src/utils/snake-case.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function nextPageNoteFor2(args, list2, rows) {
+  return nextPageNoteFor(PROGRAM, args, { ...list2, flags: Object.keys(list2.flags) }, rows, effectivePageLimit(strOpt(args, "limit")));
+}
+function limitRefusal(args) {
+  let raw = args.options.limit;
+  return typeof raw == "string" ? pageLimitRefusal(raw) : null;
+}
+var PROGRAM, init_page2 = __esm({ "src/utils/page.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
   init_tenant();
-  readHeaders = { onHeaders: noteServerVersion };
-  noteEnvOverride = /* @__PURE__ */ (() => {
-    let noted = false;
-    return (msg) => {
-      noted || (noted = true, warn(msg));
-    };
-  })();
-  versionHeader = { [CLI_VERSION_HEADER]: CLIENT_VERSION };
-  BadAnswerError = class extends Error {
-  };
+  init_http_client();
+  init_args2();
+  PROGRAM = "ignitify";
+} });
+var init_utils = __esm({ "src/utils/index.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_sort();
+  init_args2();
+  init_guard();
+  init_prompt_flow();
+  init_clock();
+  init_snake_case();
+  init_page2();
 } });
 function payloadRefusal(payload, limit) {
   let bytes = payloadBytes(payload);
@@ -2680,8 +3023,19 @@ var payloadBytes, limitOrFallback, formatLimit, limitsNote, init_payload_limit =
   payloadBytes = (payload) => Buffer.byteLength(JSON.stringify(payload) ?? "", "utf8"), limitOrFallback = (limit, fallback) => typeof limit == "number" && Number.isFinite(limit) && limit > 0 ? limit : fallback;
   formatLimit = (bytes) => formatBytes(bytes).replace(/\.0 /, " "), limitsNote = () => MESSAGES.TASK_LIMITS(formatLimit(PAYLOAD_LIMIT_FALLBACK_BYTES), formatLimit(RESULT_LIMIT_FALLBACK_BYTES));
 } });
-function apiConfig(args) {
-  return resolveApiConfig(strOpt(args, "api"));
+function apiConfig() {
+  return resolveApiConfig();
+}
+function accessNameArg(raw, kind, label) {
+  if (raw === void 0 || raw === "") return fail(MESSAGES.ARG_REQUIRED(label)), null;
+  let checked = checkAccessName(kind, raw);
+  return checked.ok ? checked.value : (fail(checked.message), null);
+}
+function daysOption(args) {
+  let raw = strOpt(args, "days");
+  if (raw === void 0) return { ok: true, days: null };
+  let days = parseWholeCount(raw);
+  return days === null ? (fail(MESSAGES.DAYS_INVALID(raw)), { ok: false }) : { ok: true, days };
 }
 async function payloadLimit(cfg) {
   let whoami = await getWhoami(cfg).catch(() => null);
@@ -2691,6 +3045,10 @@ function consoleLogText(bytes, out2) {
   return out2.raw ? bytes : terminalSafe(bytes, out2.colour);
 }
 function printConsoleLog(data, raw, colour = outStyle().colour) {
+  if (isJsonOutput()) {
+    emit(data);
+    return;
+  }
   if (writeRaw(consoleLogText(typeof data?.bytes == "string" ? data.bytes : "", { raw, colour })), data?.truncated === true) {
     let lines = typeof data.lines == "number" ? data.lines : 0;
     tell(`
@@ -2704,7 +3062,7 @@ function noteNextPage(args, list2, rows) {
 async function runPagedList(args, verb) {
   let badLimit = limitRefusal(args);
   return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let data = await verb.fetchPage(apiConfig(args), { ...flagParams(args, verb.list.flags), ...verb.extra });
+    let data = await verb.fetchPage(apiConfig(), { ...flagParams(args, verb.list.flags), ...verb.extra });
     return verb.show(data), noteNextPage(args, verb.list, verb.rowsOf(data)), 0;
   });
 }
@@ -2713,19 +3071,20 @@ var init_shared = __esm({ "src/commands/shared.ts"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_api();
   init_payload_limit();
+  init_access();
   init_constants();
   init_utils();
   init_output();
 } });
 async function runWhoami(args) {
   return guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("whoami", await getWhoami(cfg)), 0;
   });
 }
 async function runUsage(args) {
   return guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("quota", await getWhoami(cfg)), 0;
   });
 }
@@ -2747,14 +3106,16 @@ function decidePollError(e, failuresInARow, failingForMs) {
   return isTransientError(e) ? failuresInARow >= POLL.ERROR.MIN_TRIES && failingForMs >= POLL.ERROR.GRACE_MS ? "give-up" : "retry" : "give-up";
 }
 async function pollUntil(loop) {
-  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), failures = 0, firstFailureAt = 0;
+  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), decideError = loop.decideError === void 0 ? fixedRetry(loop.retryDelayMs) : loop.decideError, failures = 0, firstFailureAt = 0;
   for (let attempt = 0; ; ) {
     let view;
     try {
       view = await loop.fetch();
     } catch (error) {
-      if (failures === 0 && (firstFailureAt = now()), failures += 1, decidePollError(error, failures, now() - firstFailureAt) === "give-up") return { kind: "lost", error };
-      loop.onRetry?.(error), await sleep(loop.retryDelayMs);
+      failures === 0 && (firstFailureAt = now()), failures += 1;
+      let next = decideError(error, failures, now() - firstFailureAt);
+      if (next.kind === "give-up") return { kind: "lost", error };
+      next.counted || (failures = 0), loop.onRetry?.(error, next.delayMs), await sleep(next.delayMs);
       continue;
     }
     failures = 0, loop.onView?.(view);
@@ -2763,7 +3124,7 @@ async function pollUntil(loop) {
     loop.onWait?.(view, attempt), await sleep(action.delayMs), attempt += 1;
   }
 }
-var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
+var isWait, isLost, fixedRetry, init_poll = __esm({ "src/core/poll.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
@@ -2771,6 +3132,7 @@ var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
   init_constants();
   init_utils();
   isWait = (action) => action.kind === "wait", isLost = (end) => "kind" in end && end.kind === "lost";
+  fixedRetry = (delayMs) => (error, failuresInARow, failingForMs) => decidePollError(error, failuresInARow, failingForMs) === "give-up" ? { kind: "give-up" } : { kind: "retry", delayMs, counted: true };
 } });
 function shortenHome(file, home) {
   if (home === "" || !file.startsWith(home)) return file;
@@ -2862,7 +3224,7 @@ async function pollForKey(baseUrl, started, deadline, deps) {
 }
 async function runLogin(args, deps = {}) {
   return guard(async () => {
-    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(apiUrlOf(args)), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
+    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(apiUrlFor(deps.env ?? process.env)), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
       throw e instanceof HttpError && e.status === 429 ? new Error(MESSAGES.LOGIN_TOO_MANY, { cause: e }) : e;
     }), env = deps.env ?? process.env, st = screenStyle(deps.screen, env), url = started.verification_uri_complete;
     if (say(renderLoginStart(st, { code: formatUserCode(started.user_code), url })), say(""), url !== null) {
@@ -2930,7 +3292,7 @@ function selectLines(lines, runs, vms) {
 }
 async function runUsageShow(args) {
   return guard(async () => {
-    let report = await getUsage(apiConfig(args), filters(args));
+    let report = await getUsage(apiConfig(), filters(args));
     if (boolFlag(args, "json")) return emit(report), 0;
     let runs = boolFlag(args, "runs"), vms = boolFlag(args, "vms"), shown = { ...report, lines: selectLines(report.lines, runs, vms) };
     return out(renderUsageReport(outStyle(), shown, { lines: runs || vms })), 0;
@@ -2940,10 +3302,18 @@ async function runUsageExport(args) {
   return guard(async () => {
     let json2 = boolFlag(args, "json"), csv = boolFlag(args, "csv");
     if (json2 === csv) return tell(MESSAGES.USAGE_EXPORT_USAGE), 1;
-    let report = await getUsage(apiConfig(args), filters(args));
+    let report = await getUsage(apiConfig(), filters(args));
     return out(json2 ? JSON.stringify(report.lines, null, 2) : toCsv(report)), 0;
   });
 }
+async function runUsageSeries(args) {
+  return guard(async () => {
+    let days = daysOption(args);
+    if (!days.ok) return 1;
+    let series = await getUsageSeries(apiConfig(), days.days);
+    return emit(series, (st) => renderUsageSeries(st, series)), 0;
+  });
+}
 var filters, init_usage_report = __esm({ "src/commands/usage-report.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -2988,7 +3358,7 @@ var init_resolve_deployment = __esm({ "src/core/resolve-deployment.ts"() {
 function parseRunOptions(args, config) {
   let bare = bareValueFlag(args, VALUE_FLAGS);
   if (bare !== void 0) return { ok: false, error: needsValueMessage(bare) };
-  let payloadArg = strOpt(args, "payload"), payload = payloadArg === void 0 ? { ok: true, value: config.run?.payload ?? {} } : parseJson2(payloadArg);
+  let payloadArg = strOpt(args, "payload"), payload = payloadArg === void 0 ? { ok: true, value: config.run?.payload ?? {} } : parseJsonText(payloadArg);
   if (!payload.ok) return { ok: false, error: `--payload is not valid JSON: ${payloadArg}` };
   let timeoutArg = strOpt(args, "timeout-sec"), timeoutOverride = timeoutArg === void 0 ? void 0 : Number(timeoutArg);
   if (timeoutOverride !== void 0 && !(Number.isFinite(timeoutOverride) && timeoutOverride > 0)) return { ok: false, error: `--timeout-sec must be a positive number, got: ${timeoutArg}` };
@@ -2996,24 +3366,27 @@ function parseRunOptions(args, config) {
   if (onBusy !== void 0 && onBusy !== "queue" && onBusy !== "reject") return { ok: false, error: `--on-busy must be 'queue' or 'reject', got: ${onBusy}` };
   let at = strOpt(args, "at");
   if (at !== void 0 && Number.isNaN(new Date(at).getTime())) return { ok: false, error: `--at is not a valid ISO-8601 timestamp: ${at}` };
+  let idempotencyKey = strOpt(args, "idempotency-key");
+  if (idempotencyKey !== void 0 && !isValidIdempotencyKey(idempotencyKey)) return { ok: false, error: MESSAGES.IDEMPOTENCY_KEY_INVALID(idempotencyKey) };
   let wait = boolFlag(args, "wait");
-  return at !== void 0 && wait ? { ok: false, error: MESSAGES.RUN_AT_WITH_WAIT } : { ok: true, deploymentFlag: strOpt(args, "deployment"), wait, run: { payload: payload.value, preset: config.run?.preset, timeoutSec: timeoutOverride ?? config.run?.timeout_sec, execution: onBusy === void 0 ? config.execution : { ...config.execution ?? {}, on_busy: onBusy }, at } };
-}
-function parseJson2(text) {
-  try {
-    return { ok: true, value: JSON.parse(text) };
-  } catch {
-    return { ok: false };
-  }
+  return at !== void 0 && wait ? { ok: false, error: MESSAGES.RUN_AT_WITH_WAIT } : { ok: true, deploymentFlag: strOpt(args, "deployment"), wait, run: { payload: payload.value, preset: config.run?.preset, timeoutSec: timeoutOverride ?? config.run?.timeout_sec, execution: onBusy === void 0 ? config.execution : { ...config.execution ?? {}, on_busy: onBusy }, at, idempotencyKey } };
 }
 var VALUE_FLAGS, init_run_options = __esm({ "src/core/run-options.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
   init_http_client();
   init_constants();
   init_utils();
   VALUE_FLAGS = Object.entries(COMMAND_META[COMMANDS.TASK_RUN].flags).filter(([, kind]) => kind === "value").map(([flag]) => flag);
 } });
+function classifyRunAnswer(res, at, wait) {
+  return at !== void 0 ? res.schedule_id ? { kind: "scheduled", scheduleId: res.schedule_id, firesAt: res.fires_at ?? at } : res.run_id ? { kind: "skew-ran-now", runId: res.run_id } : { kind: "skew-no-schedule" } : wait && res.run_id ? { kind: "wait", runId: res.run_id } : { kind: "submitted" };
+}
+var init_run_answer = __esm({ "src/core/run-answer.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
 function writeFileAtomic(file, text) {
   let exists = import_node_fs3.default.existsSync(file), target = exists ? import_node_fs3.default.realpathSync(file) : file, mode = exists ? import_node_fs3.default.statSync(target).mode & 511 : NEW_FILE_MODE, name = `.${import_node_path2.default.basename(target)}.${process.pid}.${(0, import_node_crypto2.randomBytes)(6).toString("hex")}.tmp`, tmp = import_node_path2.default.join(import_node_path2.default.dirname(target), name);
   try {
@@ -3073,7 +3446,7 @@ function buildTaskReport(inputs) {
 }
 function formatTaskReport(r) {
   let lines = [];
-  if (lines.push(`Task report: ${r.slug}`), lines.push(""), lines.push(`Deployed: ${r.deployed.yes === "unknown" ? "UNKNOWN" : r.deployed.yes ? "YES" : "NO"} \u2014 ${r.deployed.detail}`), lines.push(""), lines.push("Resources:"), lines.push(`  task images on disk: ${r.resources.taskImageBytes === "unknown" ? "unknown (server unreachable)" : formatBytes(r.resources.taskImageBytes)}`), r.resources.tenant) {
+  if (lines.push(`Task report: ${r.slug}`), lines.push(""), lines.push(`Deployed: ${yesNoUnknown(r.deployed.yes)} \u2014 ${r.deployed.detail}`), lines.push(""), lines.push("Resources:"), lines.push(`  task images on disk: ${r.resources.taskImageBytes === "unknown" ? "unknown (server unreachable)" : formatBytes(r.resources.taskImageBytes)}`), r.resources.tenant) {
     let u = r.resources.tenant;
     lines.push(`  tenant-wide (whoami): tasks ${u.task_count ?? "?"}, active runs ${u.active_runs ?? "?"}, deployments ${u.deployment_count ?? "?"}, images ${formatBytes(u.total_image_bytes ?? 0)}, egress this month ${formatBytes(u.net_egress_bytes ?? 0)}`), lines.push("  more: ignitify quota");
   }
@@ -3096,14 +3469,14 @@ function formatTaskReport(r) {
     }
     lines.push("");
   }
-  lines.push(`New deployment needed: ${verdictLine(r.newDeployment)}`);
+  lines.push(`New deployment needed: ${yesNoUnknown(r.newDeployment.needed)}`);
   for (let reason of r.newDeployment.reasons) lines.push(`  - ${reason}`);
-  lines.push(""), lines.push(`New VM on next run: ${verdictLine(r.newVm)}`);
+  lines.push(""), lines.push(`New VM on next run: ${yesNoUnknown(r.newVm.needed)}`);
   for (let reason of r.newVm.reasons) lines.push(`  - ${reason}`);
   return lines.join(`
 `);
 }
-var FINGERPRINT_AXES, resolveOrNull, DEFAULT_NATURE, runNature, fingerprintDiffs, presetIndeterminate, decideNewDeployment, decideNewVm, decideInbound, verdictLine, init_report = __esm({ "src/core/report.ts"() {
+var FINGERPRINT_AXES, resolveOrNull, DEFAULT_NATURE, runNature, fingerprintDiffs, presetIndeterminate, decideNewDeployment, decideNewVm, decideInbound, yesNoUnknown, init_report = __esm({ "src/core/report.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_execution();
@@ -3147,7 +3520,7 @@ var FINGERPRINT_AXES, resolveOrNull, DEFAULT_NATURE, runNature, fingerprintDiffs
     let serving = (runs ?? []).some((r) => ACTIVE_RUN_STATUSES.has(r.status ?? "")), routes = taskDeployments === null ? "unknown" : taskDeployments.flatMap((d) => d.id ? [{ deploymentId: d.id, routeId: deriveRouteId(d.id) }] : []);
     return { port: nature.inbound_port, serving, routes };
   };
-  verdictLine = (v) => v.needed === "unknown" ? "UNKNOWN" : v.needed ? "YES" : "NO";
+  yesNoUnknown = (answer) => answer === "unknown" ? "UNKNOWN" : answer ? "YES" : "NO";
 } });
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x.default : x;
@@ -4406,13 +4779,13 @@ function requireJsYaml() {
   }
   return jsYaml.Type = requireType(), jsYaml.Schema = requireSchema(), jsYaml.FAILSAFE_SCHEMA = requireFailsafe(), jsYaml.JSON_SCHEMA = requireJson(), jsYaml.CORE_SCHEMA = requireCore(), jsYaml.DEFAULT_SCHEMA = require_default(), jsYaml.load = loader2.load, jsYaml.loadAll = loader2.loadAll, jsYaml.dump = dumper2.dump, jsYaml.YAMLException = requireException(), jsYaml.types = { binary: requireBinary(), float: requireFloat(), map: requireMap(), null: require_null(), pairs: requirePairs(), set: requireSet(), timestamp: requireTimestamp(), bool: requireBool(), int: requireInt(), merge: requireMerge(), omap: requireOmap(), seq: requireSeq(), str: requireStr() }, jsYaml.safeLoad = renamed("safeLoad", "load"), jsYaml.safeLoadAll = renamed("safeLoadAll", "loadAll"), jsYaml.safeDump = renamed("safeDump", "dump"), jsYaml;
 }
-var jsYaml, loader, common, hasRequiredCommon, exception, hasRequiredException, snippet, hasRequiredSnippet, type, hasRequiredType, schema, hasRequiredSchema, str2, hasRequiredStr, seq, hasRequiredSeq, map, hasRequiredMap, failsafe, hasRequiredFailsafe, _null, hasRequired_null, bool, hasRequiredBool, int, hasRequiredInt, float, hasRequiredFloat, json, hasRequiredJson, core, hasRequiredCore, timestamp, hasRequiredTimestamp, merge, hasRequiredMerge, binary, hasRequiredBinary, omap, hasRequiredOmap, pairs2, hasRequiredPairs, set, hasRequiredSet, _default, hasRequired_default, hasRequiredLoader, dumper, hasRequiredDumper, hasRequiredJsYaml, jsYamlExports, yaml, Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load, loadAll, dump, YAMLException, types, safeLoad, safeLoadAll, safeDump, init_js_yaml = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/js-yaml/dist/js-yaml.mjs"() {
+var jsYaml, loader, common, hasRequiredCommon, exception, hasRequiredException, snippet, hasRequiredSnippet, type, hasRequiredType, schema, hasRequiredSchema, str2, hasRequiredStr, seq, hasRequiredSeq, map, hasRequiredMap, failsafe, hasRequiredFailsafe, _null, hasRequired_null, bool, hasRequiredBool, int, hasRequiredInt, float, hasRequiredFloat, json, hasRequiredJson, core, hasRequiredCore, timestamp, hasRequiredTimestamp, merge, hasRequiredMerge, binary, hasRequiredBinary, omap, hasRequiredOmap, pairs2, hasRequiredPairs, set, hasRequiredSet, _default, hasRequired_default, hasRequiredLoader, dumper, hasRequiredDumper, hasRequiredJsYaml, jsYamlExports, yaml, Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load, loadAll, dump, YAMLException, types, safeLoad, safeLoadAll, safeDump, init_js_yaml = __esm({ "../../node_modules/js-yaml/dist/js-yaml.mjs"() {
   init_define_IGNITIFY_CLIENT_FILES();
   jsYaml = {}, loader = {}, common = {};
   dumper = {};
   jsYamlExports = requireJsYaml(), yaml = getDefaultExportFromCjs(jsYamlExports), { Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load, loadAll, dump, YAMLException, types, safeLoad, safeLoadAll, safeDump } = yaml;
 } });
-var require_code = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/codegen/code.js"(exports2) {
+var require_code = __commonJS({ "../../node_modules/ajv/dist/compile/codegen/code.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -4526,7 +4899,7 @@ var require_code = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   }
   exports2.regexpCode = regexpCode;
 } });
-var require_scope = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/codegen/scope.js"(exports2) {
+var require_scope = __commonJS({ "../../node_modules/ajv/dist/compile/codegen/scope.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -4631,7 +5004,7 @@ var require_scope = __commonJS({ "../../../../../../../../../Users/saeed/Project
   };
   exports2.ValueScope = ValueScope;
 } });
-var require_codegen = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/codegen/index.js"(exports2) {
+var require_codegen = __commonJS({ "../../node_modules/ajv/dist/compile/codegen/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5120,7 +5493,7 @@ var require_codegen = __commonJS({ "../../../../../../../../../Users/saeed/Proje
     return x instanceof code_1.Name ? x : (0, code_1._)`(${x})`;
   }
 } });
-var require_util = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/util.js"(exports2) {
+var require_util = __commonJS({ "../../node_modules/ajv/dist/compile/util.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5230,14 +5603,14 @@ var require_util = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   }
   exports2.checkStrictMode = checkStrictMode;
 } });
-var require_names = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/names.js"(exports2) {
+var require_names = __commonJS({ "../../node_modules/ajv/dist/compile/names.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var codegen_1 = require_codegen(), names = { data: new codegen_1.Name("data"), valCxt: new codegen_1.Name("valCxt"), instancePath: new codegen_1.Name("instancePath"), parentData: new codegen_1.Name("parentData"), parentDataProperty: new codegen_1.Name("parentDataProperty"), rootData: new codegen_1.Name("rootData"), dynamicAnchors: new codegen_1.Name("dynamicAnchors"), vErrors: new codegen_1.Name("vErrors"), errors: new codegen_1.Name("errors"), this: new codegen_1.Name("this"), self: new codegen_1.Name("self"), scope: new codegen_1.Name("scope"), json: new codegen_1.Name("json"), jsonPos: new codegen_1.Name("jsonPos"), jsonLen: new codegen_1.Name("jsonLen"), jsonPart: new codegen_1.Name("jsonPart") };
   exports2.default = names;
 } });
-var require_errors = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/errors.js"(exports2) {
+var require_errors = __commonJS({ "../../node_modules/ajv/dist/compile/errors.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5297,7 +5670,7 @@ var require_errors = __commonJS({ "../../../../../../../../../Users/saeed/Projec
     keyValues.push([E.keyword, keyword], [E.params, typeof params == "function" ? params(cxt) : params || (0, codegen_1._)`{}`]), opts.messages && keyValues.push([E.message, typeof message == "function" ? message(cxt) : message]), opts.verbose && keyValues.push([E.schema, schemaValue], [E.parentSchema, (0, codegen_1._)`${topSchemaRef}${schemaPath}`], [names_1.default.data, data]), propertyName && keyValues.push([E.propertyName, propertyName]);
   }
 } });
-var require_boolSchema = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/boolSchema.js"(exports2) {
+var require_boolSchema = __commonJS({ "../../node_modules/ajv/dist/compile/validate/boolSchema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5318,7 +5691,7 @@ var require_boolSchema = __commonJS({ "../../../../../../../../../Users/saeed/Pr
     (0, errors_1.reportError)(cxt, boolError, void 0, overrideAllErrors);
   }
 } });
-var require_rules = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/rules.js"(exports2) {
+var require_rules = __commonJS({ "../../node_modules/ajv/dist/compile/rules.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5334,7 +5707,7 @@ var require_rules = __commonJS({ "../../../../../../../../../Users/saeed/Project
   }
   exports2.getRules = getRules;
 } });
-var require_applicability = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/applicability.js"(exports2) {
+var require_applicability = __commonJS({ "../../node_modules/ajv/dist/compile/validate/applicability.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5354,7 +5727,7 @@ var require_applicability = __commonJS({ "../../../../../../../../../Users/saeed
   }
   exports2.shouldUseRule = shouldUseRule;
 } });
-var require_dataType = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/dataType.js"(exports2) {
+var require_dataType = __commonJS({ "../../node_modules/ajv/dist/compile/validate/dataType.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5479,7 +5852,7 @@ var require_dataType = __commonJS({ "../../../../../../../../../Users/saeed/Proj
     return { gen, keyword: "type", data, schema: schema2.type, schemaCode, schemaValue: schemaCode, parentSchema: schema2, params: {}, it };
   }
 } });
-var require_defaults = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/defaults.js"(exports2) {
+var require_defaults = __commonJS({ "../../node_modules/ajv/dist/compile/validate/defaults.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5503,7 +5876,7 @@ var require_defaults = __commonJS({ "../../../../../../../../../Users/saeed/Proj
     opts.useDefaults === "empty" && (condition = (0, codegen_1._)`${condition} || ${childData} === null || ${childData} === ""`), gen.if(condition, (0, codegen_1._)`${childData} = ${(0, codegen_1.stringify)(defaultValue)}`);
   }
 } });
-var require_code2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/code.js"(exports2) {
+var require_code2 = __commonJS({ "../../node_modules/ajv/dist/vocabularies/code.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5590,7 +5963,7 @@ var require_code2 = __commonJS({ "../../../../../../../../../Users/saeed/Project
   }
   exports2.validateUnion = validateUnion;
 } });
-var require_keyword = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/keyword.js"(exports2) {
+var require_keyword = __commonJS({ "../../node_modules/ajv/dist/compile/validate/keyword.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5667,7 +6040,7 @@ var require_keyword = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   }
   exports2.validateKeywordUsage = validateKeywordUsage;
 } });
-var require_subschema = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/subschema.js"(exports2) {
+var require_subschema = __commonJS({ "../../node_modules/ajv/dist/compile/validate/subschema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5708,7 +6081,7 @@ var require_subschema = __commonJS({ "../../../../../../../../../Users/saeed/Pro
   }
   exports2.extendSubschemaMode = extendSubschemaMode;
 } });
-var require_fast_deep_equal = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/fast-deep-equal/index.js"(exports2, module2) {
+var require_fast_deep_equal = __commonJS({ "../../node_modules/fast-deep-equal/index.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   module2.exports = function equal(a, b) {
@@ -5735,7 +6108,7 @@ var require_fast_deep_equal = __commonJS({ "../../../../../../../../../Users/sae
     return a !== a && b !== b;
   };
 } });
-var require_json_schema_traverse = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/json-schema-traverse/index.js"(exports2, module2) {
+var require_json_schema_traverse = __commonJS({ "../../node_modules/json-schema-traverse/index.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var traverse = module2.exports = function(schema2, opts, cb) {
@@ -5767,7 +6140,7 @@ var require_json_schema_traverse = __commonJS({ "../../../../../../../../../User
     return str3.replace(/~/g, "~0").replace(/\//g, "~1");
   }
 } });
-var require_resolve = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/resolve.js"(exports2) {
+var require_resolve = __commonJS({ "../../node_modules/ajv/dist/compile/resolve.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -5844,7 +6217,7 @@ var require_resolve = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   }
   exports2.getSchemaRefs = getSchemaRefs;
 } });
-var require_validate = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/validate/index.js"(exports2) {
+var require_validate = __commonJS({ "../../node_modules/ajv/dist/compile/validate/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6134,7 +6507,7 @@ var require_validate = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   }
   exports2.getData = getData;
 } });
-var require_validation_error = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/runtime/validation_error.js"(exports2) {
+var require_validation_error = __commonJS({ "../../node_modules/ajv/dist/runtime/validation_error.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6145,7 +6518,7 @@ var require_validation_error = __commonJS({ "../../../../../../../../../Users/sa
   };
   exports2.default = ValidationError;
 } });
-var require_ref_error = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/ref_error.js"(exports2) {
+var require_ref_error = __commonJS({ "../../node_modules/ajv/dist/compile/ref_error.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6156,7 +6529,7 @@ var require_ref_error = __commonJS({ "../../../../../../../../../Users/saeed/Pro
   };
   exports2.default = MissingRefError;
 } });
-var require_compile = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/compile/index.js"(exports2) {
+var require_compile = __commonJS({ "../../node_modules/ajv/dist/compile/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6261,10 +6634,10 @@ var require_compile = __commonJS({ "../../../../../../../../../Users/saeed/Proje
     if (env = env || new SchemaEnv({ schema: schema2, schemaId, root, baseId }), env.schema !== env.root.schema) return env;
   }
 } });
-var require_data = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/data.json"(exports2, module2) {
+var require_data = __commonJS({ "../../node_modules/ajv/dist/refs/data.json"(exports2, module2) {
   module2.exports = { $id: "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#", description: "Meta-schema for $data reference (JSON AnySchema extension proposal)", type: "object", required: ["$data"], properties: { $data: { type: "string", anyOf: [{ format: "relative-json-pointer" }, { format: "json-pointer" }] } }, additionalProperties: false };
 } });
-var require_utils = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
+var require_utils = __commonJS({ "../../node_modules/fast-uri/lib/utils.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu), isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u), isPort = RegExp.prototype.test.bind(/^\d*$/u), isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu), isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu), isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u), isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u), isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u), BYTE_HEX = new Array(256);
@@ -6577,7 +6950,7 @@ var require_utils = __commonJS({ "../../../../../../../../../Users/saeed/Project
   }
   module2.exports = { nonSimpleDomain, recomposeAuthority, reescapeHostDelimiters, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeUserinfo, encodeQuery, encodeFragment, escapePreservingEscapes, removeDotSegments, removeDotSegmentsRelative, isIPv4, isUUID, normalizeIPv6, stringArrayToHexStripped };
 } });
-var require_schemes = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
+var require_schemes = __commonJS({ "../../node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var { isUUID } = require_utils(), URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu, supportedSchemeNames = ["http", "https", "ws", "wss", "urn", "urn:uuid"];
@@ -6637,7 +7010,7 @@ var require_schemes = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   }
   module2.exports = { wsIsSecure, SCHEMES, isValidSchemeName, getSchemeHandler };
 } });
-var require_fast_uri = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/fast-uri/index.js"(exports2, module2) {
+var require_fast_uri = __commonJS({ "../../node_modules/fast-uri/index.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils(), { SCHEMES, getSchemeHandler } = require_schemes(), VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u, MALFORMED_SCHEME_ERROR = "URI scheme is malformed.", MALFORMED_HOST_ERROR = "URI host is malformed.", FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
@@ -6793,7 +7166,7 @@ var require_fast_uri = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   module2.exports.default = fastUri;
   module2.exports.fastUri = fastUri;
 } });
-var require_uri = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/runtime/uri.js"(exports2) {
+var require_uri = __commonJS({ "../../node_modules/ajv/dist/runtime/uri.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6801,7 +7174,7 @@ var require_uri = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   uri.code = 'require("ajv/dist/runtime/uri").default';
   exports2.default = uri;
 } });
-var require_core = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/core.js"(exports2) {
+var require_core = __commonJS({ "../../node_modules/ajv/dist/core.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7126,7 +7499,7 @@ var require_core = __commonJS({ "../../../../../../../../../Users/saeed/Projects
     return { anyOf: [schema2, $dataRef] };
   }
 } });
-var require_id = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/core/id.js"(exports2) {
+var require_id = __commonJS({ "../../node_modules/ajv/dist/vocabularies/core/id.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7135,7 +7508,7 @@ var require_id = __commonJS({ "../../../../../../../../../Users/saeed/Projects/r
   } };
   exports2.default = def;
 } });
-var require_ref = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/core/ref.js"(exports2) {
+var require_ref = __commonJS({ "../../node_modules/ajv/dist/vocabularies/core/ref.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7204,14 +7577,14 @@ var require_ref = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   exports2.callRef = callRef;
   exports2.default = def;
 } });
-var require_core2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/core/index.js"(exports2) {
+var require_core2 = __commonJS({ "../../node_modules/ajv/dist/vocabularies/core/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var id_1 = require_id(), ref_1 = require_ref(), core2 = ["$schema", "$id", "$defs", "$vocabulary", { keyword: "$comment" }, "definitions", id_1.default, ref_1.default];
   exports2.default = core2;
 } });
-var require_limitNumber = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/limitNumber.js"(exports2) {
+var require_limitNumber = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/limitNumber.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7221,7 +7594,7 @@ var require_limitNumber = __commonJS({ "../../../../../../../../../Users/saeed/P
   } };
   exports2.default = def;
 } });
-var require_multipleOf = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/multipleOf.js"(exports2) {
+var require_multipleOf = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/multipleOf.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7231,7 +7604,7 @@ var require_multipleOf = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   } };
   exports2.default = def;
 } });
-var require_ucs2length = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/runtime/ucs2length.js"(exports2) {
+var require_ucs2length = __commonJS({ "../../node_modules/ajv/dist/runtime/ucs2length.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7243,7 +7616,7 @@ var require_ucs2length = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   exports2.default = ucs2length;
   ucs2length.code = 'require("ajv/dist/runtime/ucs2length").default';
 } });
-var require_limitLength = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/limitLength.js"(exports2) {
+var require_limitLength = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/limitLength.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7256,7 +7629,7 @@ var require_limitLength = __commonJS({ "../../../../../../../../../Users/saeed/P
   } };
   exports2.default = def;
 } });
-var require_pattern = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/pattern.js"(exports2) {
+var require_pattern = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/pattern.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7272,7 +7645,7 @@ var require_pattern = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   } };
   exports2.default = def;
 } });
-var require_limitProperties = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/limitProperties.js"(exports2) {
+var require_limitProperties = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/limitProperties.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7285,7 +7658,7 @@ var require_limitProperties = __commonJS({ "../../../../../../../../../Users/sae
   } };
   exports2.default = def;
 } });
-var require_required = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/required.js"(exports2) {
+var require_required = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/required.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7326,7 +7699,7 @@ var require_required = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   } };
   exports2.default = def;
 } });
-var require_limitItems = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/limitItems.js"(exports2) {
+var require_limitItems = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/limitItems.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7339,7 +7712,7 @@ var require_limitItems = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   } };
   exports2.default = def;
 } });
-var require_equal = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/runtime/equal.js"(exports2) {
+var require_equal = __commonJS({ "../../node_modules/ajv/dist/runtime/equal.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7347,7 +7720,7 @@ var require_equal = __commonJS({ "../../../../../../../../../Users/saeed/Project
   equal.code = 'require("ajv/dist/runtime/equal").default';
   exports2.default = equal;
 } });
-var require_uniqueItems = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/uniqueItems.js"(exports2) {
+var require_uniqueItems = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/uniqueItems.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7380,7 +7753,7 @@ var require_uniqueItems = __commonJS({ "../../../../../../../../../Users/saeed/P
   } };
   exports2.default = def;
 } });
-var require_const = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/const.js"(exports2) {
+var require_const = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/const.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7390,7 +7763,7 @@ var require_const = __commonJS({ "../../../../../../../../../Users/saeed/Project
   } };
   exports2.default = def;
 } });
-var require_enum = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/enum.js"(exports2) {
+var require_enum = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/enum.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7415,14 +7788,14 @@ var require_enum = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   } };
   exports2.default = def;
 } });
-var require_validation = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/index.js"(exports2) {
+var require_validation = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var limitNumber_1 = require_limitNumber(), multipleOf_1 = require_multipleOf(), limitLength_1 = require_limitLength(), pattern_1 = require_pattern(), limitProperties_1 = require_limitProperties(), required_1 = require_required(), limitItems_1 = require_limitItems(), uniqueItems_1 = require_uniqueItems(), const_1 = require_const(), enum_1 = require_enum(), validation = [limitNumber_1.default, multipleOf_1.default, limitLength_1.default, pattern_1.default, limitProperties_1.default, required_1.default, limitItems_1.default, uniqueItems_1.default, { keyword: "type", schemaType: ["string", "array"] }, { keyword: "nullable", schemaType: "boolean" }, const_1.default, enum_1.default];
   exports2.default = validation;
 } });
-var require_additionalItems = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/additionalItems.js"(exports2) {
+var require_additionalItems = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/additionalItems.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7453,7 +7826,7 @@ var require_additionalItems = __commonJS({ "../../../../../../../../../Users/sae
   exports2.validateAdditionalItems = validateAdditionalItems;
   exports2.default = def;
 } });
-var require_items = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/items.js"(exports2) {
+var require_items = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/items.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7481,14 +7854,14 @@ var require_items = __commonJS({ "../../../../../../../../../Users/saeed/Project
   exports2.validateTuple = validateTuple;
   exports2.default = def;
 } });
-var require_prefixItems = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/prefixItems.js"(exports2) {
+var require_prefixItems = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/prefixItems.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var items_1 = require_items(), def = { keyword: "prefixItems", type: "array", schemaType: ["array"], before: "uniqueItems", code: (cxt) => (0, items_1.validateTuple)(cxt, "items") };
   exports2.default = def;
 } });
-var require_items2020 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/items2020.js"(exports2) {
+var require_items2020 = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/items2020.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7498,7 +7871,7 @@ var require_items2020 = __commonJS({ "../../../../../../../../../Users/saeed/Pro
   } };
   exports2.default = def;
 } });
-var require_contains = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/contains.js"(exports2) {
+var require_contains = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/contains.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7537,7 +7910,7 @@ var require_contains = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   } };
   exports2.default = def;
 } });
-var require_dependencies = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/dependencies.js"(exports2) {
+var require_dependencies = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/dependencies.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7587,7 +7960,7 @@ var require_dependencies = __commonJS({ "../../../../../../../../../Users/saeed/
   exports2.validateSchemaDeps = validateSchemaDeps;
   exports2.default = def;
 } });
-var require_propertyNames = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/propertyNames.js"(exports2) {
+var require_propertyNames = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/propertyNames.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7603,7 +7976,7 @@ var require_propertyNames = __commonJS({ "../../../../../../../../../Users/saeed
   } };
   exports2.default = def;
 } });
-var require_additionalProperties = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js"(exports2) {
+var require_additionalProperties = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7653,7 +8026,7 @@ var require_additionalProperties = __commonJS({ "../../../../../../../../../User
   } };
   exports2.default = def;
 } });
-var require_properties = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/properties.js"(exports2) {
+var require_properties = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/properties.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7676,7 +8049,7 @@ var require_properties = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   } };
   exports2.default = def;
 } });
-var require_patternProperties = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/patternProperties.js"(exports2) {
+var require_patternProperties = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/patternProperties.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7704,7 +8077,7 @@ var require_patternProperties = __commonJS({ "../../../../../../../../../Users/s
   } };
   exports2.default = def;
 } });
-var require_not = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/not.js"(exports2) {
+var require_not = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/not.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7719,14 +8092,14 @@ var require_not = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   }, error: { message: "must NOT be valid" } };
   exports2.default = def;
 } });
-var require_anyOf = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/anyOf.js"(exports2) {
+var require_anyOf = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/anyOf.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var code_1 = require_code2(), def = { keyword: "anyOf", schemaType: "array", trackErrors: true, code: code_1.validateUnion, error: { message: "must match a schema in anyOf" } };
   exports2.default = def;
 } });
-var require_oneOf = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/oneOf.js"(exports2) {
+var require_oneOf = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/oneOf.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7747,7 +8120,7 @@ var require_oneOf = __commonJS({ "../../../../../../../../../Users/saeed/Project
   } };
   exports2.default = def;
 } });
-var require_allOf = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/allOf.js"(exports2) {
+var require_allOf = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/allOf.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7763,7 +8136,7 @@ var require_allOf = __commonJS({ "../../../../../../../../../Users/saeed/Project
   } };
   exports2.default = def;
 } });
-var require_if = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/if.js"(exports2) {
+var require_if = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/if.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7795,7 +8168,7 @@ var require_if = __commonJS({ "../../../../../../../../../Users/saeed/Projects/r
   }
   exports2.default = def;
 } });
-var require_thenElse = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/thenElse.js"(exports2) {
+var require_thenElse = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/thenElse.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7804,7 +8177,7 @@ var require_thenElse = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   } };
   exports2.default = def;
 } });
-var require_applicator = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/index.js"(exports2) {
+var require_applicator = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7815,7 +8188,7 @@ var require_applicator = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   }
   exports2.default = getApplicator;
 } });
-var require_dynamicAnchor = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/dynamic/dynamicAnchor.js"(exports2) {
+var require_dynamicAnchor = __commonJS({ "../../node_modules/ajv/dist/vocabularies/dynamic/dynamicAnchor.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7834,7 +8207,7 @@ var require_dynamicAnchor = __commonJS({ "../../../../../../../../../Users/saeed
   }
   exports2.default = def;
 } });
-var require_dynamicRef = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/dynamic/dynamicRef.js"(exports2) {
+var require_dynamicRef = __commonJS({ "../../node_modules/ajv/dist/vocabularies/dynamic/dynamicRef.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7864,7 +8237,7 @@ var require_dynamicRef = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   exports2.dynamicRef = dynamicRef;
   exports2.default = def;
 } });
-var require_recursiveAnchor = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.js"(exports2) {
+var require_recursiveAnchor = __commonJS({ "../../node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7873,35 +8246,35 @@ var require_recursiveAnchor = __commonJS({ "../../../../../../../../../Users/sae
   } };
   exports2.default = def;
 } });
-var require_recursiveRef = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/dynamic/recursiveRef.js"(exports2) {
+var require_recursiveRef = __commonJS({ "../../node_modules/ajv/dist/vocabularies/dynamic/recursiveRef.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var dynamicRef_1 = require_dynamicRef(), def = { keyword: "$recursiveRef", schemaType: "string", code: (cxt) => (0, dynamicRef_1.dynamicRef)(cxt, cxt.schema) };
   exports2.default = def;
 } });
-var require_dynamic = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/dynamic/index.js"(exports2) {
+var require_dynamic = __commonJS({ "../../node_modules/ajv/dist/vocabularies/dynamic/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var dynamicAnchor_1 = require_dynamicAnchor(), dynamicRef_1 = require_dynamicRef(), recursiveAnchor_1 = require_recursiveAnchor(), recursiveRef_1 = require_recursiveRef(), dynamic = [dynamicAnchor_1.default, dynamicRef_1.default, recursiveAnchor_1.default, recursiveRef_1.default];
   exports2.default = dynamic;
 } });
-var require_dependentRequired = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/dependentRequired.js"(exports2) {
+var require_dependentRequired = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/dependentRequired.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var dependencies_1 = require_dependencies(), def = { keyword: "dependentRequired", type: "object", schemaType: "object", error: dependencies_1.error, code: (cxt) => (0, dependencies_1.validatePropertyDeps)(cxt) };
   exports2.default = def;
 } });
-var require_dependentSchemas = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/applicator/dependentSchemas.js"(exports2) {
+var require_dependentSchemas = __commonJS({ "../../node_modules/ajv/dist/vocabularies/applicator/dependentSchemas.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var dependencies_1 = require_dependencies(), def = { keyword: "dependentSchemas", type: "object", schemaType: "object", code: (cxt) => (0, dependencies_1.validateSchemaDeps)(cxt) };
   exports2.default = def;
 } });
-var require_limitContains = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/validation/limitContains.js"(exports2) {
+var require_limitContains = __commonJS({ "../../node_modules/ajv/dist/vocabularies/validation/limitContains.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7910,14 +8283,14 @@ var require_limitContains = __commonJS({ "../../../../../../../../../Users/saeed
   } };
   exports2.default = def;
 } });
-var require_next = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/next.js"(exports2) {
+var require_next = __commonJS({ "../../node_modules/ajv/dist/vocabularies/next.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var dependentRequired_1 = require_dependentRequired(), dependentSchemas_1 = require_dependentSchemas(), limitContains_1 = require_limitContains(), next = [dependentRequired_1.default, dependentSchemas_1.default, limitContains_1.default];
   exports2.default = next;
 } });
-var require_unevaluatedProperties = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/unevaluated/unevaluatedProperties.js"(exports2) {
+var require_unevaluatedProperties = __commonJS({ "../../node_modules/ajv/dist/vocabularies/unevaluated/unevaluatedProperties.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7947,7 +8320,7 @@ var require_unevaluatedProperties = __commonJS({ "../../../../../../../../../Use
   } };
   exports2.default = def;
 } });
-var require_unevaluatedItems = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/unevaluated/unevaluatedItems.js"(exports2) {
+var require_unevaluatedItems = __commonJS({ "../../node_modules/ajv/dist/vocabularies/unevaluated/unevaluatedItems.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7969,14 +8342,14 @@ var require_unevaluatedItems = __commonJS({ "../../../../../../../../../Users/sa
   } };
   exports2.default = def;
 } });
-var require_unevaluated = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/unevaluated/index.js"(exports2) {
+var require_unevaluated = __commonJS({ "../../node_modules/ajv/dist/vocabularies/unevaluated/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var unevaluatedProperties_1 = require_unevaluatedProperties(), unevaluatedItems_1 = require_unevaluatedItems(), unevaluated = [unevaluatedProperties_1.default, unevaluatedItems_1.default];
   exports2.default = unevaluated;
 } });
-var require_format = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/format/format.js"(exports2) {
+var require_format = __commonJS({ "../../node_modules/ajv/dist/vocabularies/format/format.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8029,14 +8402,14 @@ var require_format = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   } };
   exports2.default = def;
 } });
-var require_format2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/format/index.js"(exports2) {
+var require_format2 = __commonJS({ "../../node_modules/ajv/dist/vocabularies/format/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var format_1 = require_format(), format = [format_1.default];
   exports2.default = format;
 } });
-var require_metadata = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/metadata.js"(exports2) {
+var require_metadata = __commonJS({ "../../node_modules/ajv/dist/vocabularies/metadata.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8044,14 +8417,14 @@ var require_metadata = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   exports2.metadataVocabulary = ["title", "description", "default", "deprecated", "readOnly", "writeOnly", "examples"];
   exports2.contentVocabulary = ["contentMediaType", "contentEncoding", "contentSchema"];
 } });
-var require_draft2020 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/draft2020.js"(exports2) {
+var require_draft2020 = __commonJS({ "../../node_modules/ajv/dist/vocabularies/draft2020.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
   var core_1 = require_core2(), validation_1 = require_validation(), applicator_1 = require_applicator(), dynamic_1 = require_dynamic(), next_1 = require_next(), unevaluated_1 = require_unevaluated(), format_1 = require_format2(), metadata_1 = require_metadata(), draft2020Vocabularies = [dynamic_1.default, core_1.default, validation_1.default, (0, applicator_1.default)(true), format_1.default, metadata_1.metadataVocabulary, metadata_1.contentVocabulary, next_1.default, unevaluated_1.default];
   exports2.default = draft2020Vocabularies;
 } });
-var require_types = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/discriminator/types.js"(exports2) {
+var require_types = __commonJS({ "../../node_modules/ajv/dist/vocabularies/discriminator/types.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8061,7 +8434,7 @@ var require_types = __commonJS({ "../../../../../../../../../Users/saeed/Project
     DiscrError2.Tag = "tag", DiscrError2.Mapping = "mapping";
   })(DiscrError || (exports2.DiscrError = DiscrError = {}));
 } });
-var require_discriminator = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/vocabularies/discriminator/index.js"(exports2) {
+var require_discriminator = __commonJS({ "../../node_modules/ajv/dist/vocabularies/discriminator/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8115,31 +8488,31 @@ var require_discriminator = __commonJS({ "../../../../../../../../../Users/saeed
   } };
   exports2.default = def;
 } });
-var require_schema = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/schema.json"(exports2, module2) {
+var require_schema = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/schema.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/schema", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/core": true, "https://json-schema.org/draft/2020-12/vocab/applicator": true, "https://json-schema.org/draft/2020-12/vocab/unevaluated": true, "https://json-schema.org/draft/2020-12/vocab/validation": true, "https://json-schema.org/draft/2020-12/vocab/meta-data": true, "https://json-schema.org/draft/2020-12/vocab/format-annotation": true, "https://json-schema.org/draft/2020-12/vocab/content": true }, $dynamicAnchor: "meta", title: "Core and Validation specifications meta-schema", allOf: [{ $ref: "meta/core" }, { $ref: "meta/applicator" }, { $ref: "meta/unevaluated" }, { $ref: "meta/validation" }, { $ref: "meta/meta-data" }, { $ref: "meta/format-annotation" }, { $ref: "meta/content" }], type: ["object", "boolean"], $comment: "This meta-schema also defines keywords that have appeared in previous drafts in order to prevent incompatible extensions as they remain in common use.", properties: { definitions: { $comment: '"definitions" has been replaced by "$defs".', type: "object", additionalProperties: { $dynamicRef: "#meta" }, deprecated: true, default: {} }, dependencies: { $comment: '"dependencies" has been split and replaced by "dependentSchemas" and "dependentRequired" in order to serve their differing semantics.', type: "object", additionalProperties: { anyOf: [{ $dynamicRef: "#meta" }, { $ref: "meta/validation#/$defs/stringArray" }] }, deprecated: true, default: {} }, $recursiveAnchor: { $comment: '"$recursiveAnchor" has been replaced by "$dynamicAnchor".', $ref: "meta/core#/$defs/anchorString", deprecated: true }, $recursiveRef: { $comment: '"$recursiveRef" has been replaced by "$dynamicRef".', $ref: "meta/core#/$defs/uriReferenceString", deprecated: true } } };
 } });
-var require_applicator2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/applicator.json"(exports2, module2) {
+var require_applicator2 = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/applicator.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/applicator", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/applicator": true }, $dynamicAnchor: "meta", title: "Applicator vocabulary meta-schema", type: ["object", "boolean"], properties: { prefixItems: { $ref: "#/$defs/schemaArray" }, items: { $dynamicRef: "#meta" }, contains: { $dynamicRef: "#meta" }, additionalProperties: { $dynamicRef: "#meta" }, properties: { type: "object", additionalProperties: { $dynamicRef: "#meta" }, default: {} }, patternProperties: { type: "object", additionalProperties: { $dynamicRef: "#meta" }, propertyNames: { format: "regex" }, default: {} }, dependentSchemas: { type: "object", additionalProperties: { $dynamicRef: "#meta" }, default: {} }, propertyNames: { $dynamicRef: "#meta" }, if: { $dynamicRef: "#meta" }, then: { $dynamicRef: "#meta" }, else: { $dynamicRef: "#meta" }, allOf: { $ref: "#/$defs/schemaArray" }, anyOf: { $ref: "#/$defs/schemaArray" }, oneOf: { $ref: "#/$defs/schemaArray" }, not: { $dynamicRef: "#meta" } }, $defs: { schemaArray: { type: "array", minItems: 1, items: { $dynamicRef: "#meta" } } } };
 } });
-var require_unevaluated2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/unevaluated.json"(exports2, module2) {
+var require_unevaluated2 = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/unevaluated.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/unevaluated", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/unevaluated": true }, $dynamicAnchor: "meta", title: "Unevaluated applicator vocabulary meta-schema", type: ["object", "boolean"], properties: { unevaluatedItems: { $dynamicRef: "#meta" }, unevaluatedProperties: { $dynamicRef: "#meta" } } };
 } });
-var require_content = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/content.json"(exports2, module2) {
+var require_content = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/content.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/content", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/content": true }, $dynamicAnchor: "meta", title: "Content vocabulary meta-schema", type: ["object", "boolean"], properties: { contentEncoding: { type: "string" }, contentMediaType: { type: "string" }, contentSchema: { $dynamicRef: "#meta" } } };
 } });
-var require_core3 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/core.json"(exports2, module2) {
+var require_core3 = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/core.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/core", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/core": true }, $dynamicAnchor: "meta", title: "Core vocabulary meta-schema", type: ["object", "boolean"], properties: { $id: { $ref: "#/$defs/uriReferenceString", $comment: "Non-empty fragments not allowed.", pattern: "^[^#]*#?$" }, $schema: { $ref: "#/$defs/uriString" }, $ref: { $ref: "#/$defs/uriReferenceString" }, $anchor: { $ref: "#/$defs/anchorString" }, $dynamicRef: { $ref: "#/$defs/uriReferenceString" }, $dynamicAnchor: { $ref: "#/$defs/anchorString" }, $vocabulary: { type: "object", propertyNames: { $ref: "#/$defs/uriString" }, additionalProperties: { type: "boolean" } }, $comment: { type: "string" }, $defs: { type: "object", additionalProperties: { $dynamicRef: "#meta" } } }, $defs: { anchorString: { type: "string", pattern: "^[A-Za-z_][-A-Za-z0-9._]*$" }, uriString: { type: "string", format: "uri" }, uriReferenceString: { type: "string", format: "uri-reference" } } };
 } });
-var require_format_annotation = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/format-annotation.json"(exports2, module2) {
+var require_format_annotation = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/format-annotation.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/format-annotation", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/format-annotation": true }, $dynamicAnchor: "meta", title: "Format vocabulary meta-schema for annotation results", type: ["object", "boolean"], properties: { format: { type: "string" } } };
 } });
-var require_meta_data = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/meta-data.json"(exports2, module2) {
+var require_meta_data = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/meta-data.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/meta-data", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/meta-data": true }, $dynamicAnchor: "meta", title: "Meta-data vocabulary meta-schema", type: ["object", "boolean"], properties: { title: { type: "string" }, description: { type: "string" }, default: true, deprecated: { type: "boolean", default: false }, readOnly: { type: "boolean", default: false }, writeOnly: { type: "boolean", default: false }, examples: { type: "array", items: true } } };
 } });
-var require_validation2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/meta/validation.json"(exports2, module2) {
+var require_validation2 = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/meta/validation.json"(exports2, module2) {
   module2.exports = { $schema: "https://json-schema.org/draft/2020-12/schema", $id: "https://json-schema.org/draft/2020-12/meta/validation", $vocabulary: { "https://json-schema.org/draft/2020-12/vocab/validation": true }, $dynamicAnchor: "meta", title: "Validation vocabulary meta-schema", type: ["object", "boolean"], properties: { type: { anyOf: [{ $ref: "#/$defs/simpleTypes" }, { type: "array", items: { $ref: "#/$defs/simpleTypes" }, minItems: 1, uniqueItems: true }] }, const: true, enum: { type: "array", items: true }, multipleOf: { type: "number", exclusiveMinimum: 0 }, maximum: { type: "number" }, exclusiveMaximum: { type: "number" }, minimum: { type: "number" }, exclusiveMinimum: { type: "number" }, maxLength: { $ref: "#/$defs/nonNegativeInteger" }, minLength: { $ref: "#/$defs/nonNegativeIntegerDefault0" }, pattern: { type: "string", format: "regex" }, maxItems: { $ref: "#/$defs/nonNegativeInteger" }, minItems: { $ref: "#/$defs/nonNegativeIntegerDefault0" }, uniqueItems: { type: "boolean", default: false }, maxContains: { $ref: "#/$defs/nonNegativeInteger" }, minContains: { $ref: "#/$defs/nonNegativeInteger", default: 1 }, maxProperties: { $ref: "#/$defs/nonNegativeInteger" }, minProperties: { $ref: "#/$defs/nonNegativeIntegerDefault0" }, required: { $ref: "#/$defs/stringArray" }, dependentRequired: { type: "object", additionalProperties: { $ref: "#/$defs/stringArray" } } }, $defs: { nonNegativeInteger: { type: "integer", minimum: 0 }, nonNegativeIntegerDefault0: { $ref: "#/$defs/nonNegativeInteger", default: 0 }, simpleTypes: { enum: ["array", "boolean", "integer", "null", "number", "object", "string"] }, stringArray: { type: "array", items: { type: "string" }, uniqueItems: true, default: [] } } };
 } });
-var require_json_schema_2020_12 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/refs/json-schema-2020-12/index.js"(exports2) {
+var require_json_schema_2020_12 = __commonJS({ "../../node_modules/ajv/dist/refs/json-schema-2020-12/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8152,7 +8525,7 @@ var require_json_schema_2020_12 = __commonJS({ "../../../../../../../../../Users
   }
   exports2.default = addMetaSchema2020;
 } });
-var require__ = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/ajv/dist/2020.js"(exports2, module2) {
+var require__ = __commonJS({ "../../node_modules/ajv/dist/2020.js"(exports2, module2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8484,7 +8857,8 @@ function scanSourceTree(root, maxBytes = UPLOAD_MAX_BYTES, ignoreRules = []) {
   return walk(root), { entries, data, errors, warnings, ignored, totalBytes, truncated: over };
 }
 function computeSourceHash(entries, config) {
-  return `sha256:${import_node_crypto3.default.createHash("sha256").update(sourceManifest(entries, config), "utf8").digest("hex")}`;
+  let manifest = checkSourceManifest(entries, config);
+  return manifest.ok ? { ok: true, hash: `sha256:${import_node_crypto3.default.createHash("sha256").update(manifest.text, "utf8").digest("hex")}` } : manifest;
 }
 function checkLockfile(entries, runtime) {
   let required = RUNTIME_REGISTRY[runtime].lockfile;
@@ -8607,13 +8981,8 @@ function checkSourceUpload(taskDir) {
     scan.entries.some((e) => e.path === entry) || errors.push(`the entry file "${entry}" is not in the upload.`);
   }
   if (errors.length > 0) return { ok: false, errors, warnings };
-  let contentHash;
-  try {
-    contentHash = computeSourceHash(scan.entries, { name: import_node_path5.default.basename(read.file ?? ""), value: config });
-  } catch (e) {
-    return { ok: false, errors: [errText(e).replace(/^source manifest: /, "")], warnings };
-  }
-  return { ok: true, source: { config, entries: scan.entries, data: scan.data, totalBytes: scan.totalBytes, ignored: scan.ignored, contentHash }, warnings };
+  let key = computeSourceHash(scan.entries, { name: import_node_path5.default.basename(read.file ?? ""), value: config });
+  return key.ok ? { ok: true, source: { config, entries: scan.entries, data: scan.data, totalBytes: scan.totalBytes, ignored: scan.ignored, contentHash: key.hash }, warnings } : { ok: false, errors: [key.reason], warnings };
 }
 function prepareSourceUpload(taskDir) {
   let check = checkSourceUpload(taskDir);
@@ -9013,6 +9382,71 @@ var import_fs3, import_path3, init_scaffold = __esm({ "src/scaffold/index.ts"()
   init_templates();
   init_vendor();
 } });
+function replyOrThrow(reply) {
+  if (!reply.ok) throw new FollowReadError(reply.error, reply.retryAfterMs);
+  return reply.data;
+}
+function followStopOf(e) {
+  let code = refusalCode(e);
+  return code === OBS_REFUSAL.AGENT_OUTDATED_CURSOR.error ? "agent-outdated" : code === OBS_REFUSAL.NEVER_RAN.error ? "not-started" : "error";
+}
+function decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, fallbackMs) {
+  return decidePollError(e, failuresInARow, failingForMs) === "give-up" ? { kind: "give-up" } : { kind: "retry", delayMs: isBusyAnswer(e) ? retryAfterMs2 ?? fallbackMs : fallbackMs, counted: true };
+}
+function decideBusyReadError(e, retryAfterMs2, failuresInARow, failingForMs) {
+  return !isBusyAnswer(e) || failuresInARow > BUSY_READ.MAX_RETRIES ? { kind: "give-up" } : decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, FOLLOW.RETRY_FALLBACK_MS);
+}
+function decideFollowError(e, retryAfterMs2, failuresInARow, failingForMs) {
+  return followStopOf(e) !== "error" ? { kind: "give-up" } : isWaitRefused(e) ? { kind: "retry", delayMs: retryAfterMs2 ?? FOLLOW.RETRY_FALLBACK_MS, counted: false } : decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, FOLLOW.RETRY_FALLBACK_MS);
+}
+function placeOutputPage(fromOffset, reply) {
+  let next = reply.next_offset, bytes = typeof reply.bytes == "string" ? reply.bytes : "";
+  return !isOffset(next) || next < fromOffset || bytes !== "" && next === fromOffset ? { kind: "no-cursor" } : { kind: "page", bytes, nextOffset: next, full: reply.truncated === true && next > fromOffset };
+}
+function decideOutputStep(page, endedAt, readAt) {
+  return page.full ? "read-now" : page.bytes === "" && endedAt !== null && readAt - endedAt >= FOLLOW.IDLE_MS ? "stop" : "wait";
+}
+function timelineDone(reply, follow, held) {
+  return reply.complete ? true : !follow && nextCursor(held, reply) === held;
+}
+function eventsToPrint(page, printedTail) {
+  let fresh = (e) => !printedTail.has(e.id), tail = page.tail.filter(fresh), settledIds = new Set(page.events.map((e) => e.id));
+  return { print: [...page.events.filter(fresh), ...tail], printedTail: new Set([...printedTail, ...tail.map((e) => e.id)].filter((id) => !settledIds.has(id))) };
+}
+function lastLines(text, n) {
+  if (n <= 0) return "";
+  let at = text.endsWith(`
+`) ? text.length - 1 : text.length;
+  for (let seen = 0; seen < n; seen += 1) {
+    let nl = at > 0 ? text.lastIndexOf(`
+`, at - 1) : -1;
+    if (nl < 0) return text;
+    at = nl;
+  }
+  return text.slice(at + 1);
+}
+var FollowReadError, isOffset, refusalCode, isWaitRefused, isBusyAnswer, nextCursor, idleRestMs, init_follow = __esm({ "src/core/follow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_tenant();
+  init_constants();
+  init_poll();
+  FollowReadError = class extends Error {
+    error;
+    retryAfterMs;
+    constructor(error, retryAfterMs2) {
+      super(error instanceof Error ? error.message : String(error)), this.name = "FollowReadError", this.error = error, this.retryAfterMs = retryAfterMs2;
+    }
+  };
+  isOffset = (v) => typeof v == "number" && Number.isSafeInteger(v) && v >= 0, refusalCode = (e) => {
+    let code = httpErrorJson(e)?.body.error;
+    return typeof code == "string" ? code : null;
+  }, isWaitRefused = (e) => refusalCode(e) === OBS_REFUSAL.WAIT_REFUSED.error;
+  isBusyAnswer = (e) => e instanceof HttpError && (e.status === 429 || e.status === 503);
+  nextCursor = (held, reply) => reply.cursor ?? held;
+  idleRestMs = (startedAt, now) => Math.max(0, FOLLOW.IDLE_MS - (now - startedAt));
+} });
 function decidePoll(status, elapsedMs, attempt, failureReason) {
   return status === READY ? { kind: "ready" } : status === FAILED ? { kind: "failed", reason: failureReason ?? "the build failed without recording a reason" } : status !== BUILDING ? { kind: "failed", reason: `deployment entered an unexpected status: ${status}` } : elapsedMs >= POLL.DEPLOY.TIMEOUT_MS ? { kind: "timeout" } : { kind: "wait", delayMs: nextDelayMs(attempt) };
 }
@@ -9039,14 +9473,19 @@ var BUILDING, READY, FAILED, init_deploy_poll = __esm({ "src/core/deploy-poll.ts
 function decideRunPoll(status, elapsedMs, attempt) {
   return isTerminalRunStatus(status) ? { kind: "settled", status } : elapsedMs >= POLL.RUN.TIMEOUT_MS ? { kind: "timeout", status } : { kind: "wait", delayMs: backoffDelayMs(attempt, POLL.RUN) };
 }
+function decideRunPollError(e, failuresInARow, failingForMs) {
+  let [error, retryAfterMs2] = e instanceof FollowReadError ? [e.error, e.retryAfterMs] : [e, null];
+  return decidePacedRetry(error, retryAfterMs2, failuresInARow, failingForMs, POLL.RUN.MAX_MS);
+}
 async function pollUntilSettled(deps) {
-  let statusOf = (run2) => run2.status ?? "UNKNOWN", end = await pollUntil({ fetch: deps.fetchRun, retryDelayMs: POLL.RUN.MAX_MS, onRetry: deps.onRetry, decide: (run2, elapsedMs, attempt) => decideRunPoll(statusOf(run2), elapsedMs, attempt), onView: (run2) => deps.onStatus?.(statusOf(run2)), clock: deps });
-  return isLost(end) ? end : { action: end.action, run: end.view };
+  let statusOf = (run2) => run2.status ?? "UNKNOWN", end = await pollUntil({ fetch: deps.fetchRun, decideError: decideRunPollError, onRetry: deps.onRetry, decide: (run2, elapsedMs, attempt) => decideRunPoll(statusOf(run2), elapsedMs, attempt), onView: (run2) => deps.onStatus?.(statusOf(run2)), clock: deps });
+  return isLost(end) ? end.error instanceof FollowReadError ? { kind: "lost", error: end.error.error } : end : { action: end.action, run: end.view };
 }
 var init_run_poll = __esm({ "src/core/run-poll.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants();
+  init_follow();
   init_poll();
 } });
 async function waitForBuild(cfg, deploymentId, progress, reused = false) {
@@ -9074,7 +9513,7 @@ ${st.bold(LABELS.BUILD_LOG)}
   return built.kind === "timeout" ? (progress.fail(WAIT.BUILD_TIMEOUT), fail(WAIT.BUILD_TIMEOUT_DETAIL(deploymentId)), 1) : (progress.succeed(reused && !building ? WAIT.REUSED : WAIT.BUILT), 0);
 }
 async function waitForRun(cfg, runId) {
-  let progress = startProgress(WAIT.RUN_SUBMITTED(runId)), lastStatus, settled = await withInterruptNotice(progress, () => WAIT.INTERRUPTED_RUN(runId), () => pollUntilSettled({ fetchRun: () => getApiRun(cfg, runId), onStatus: (status) => {
+  let progress = startProgress(WAIT.RUN_SUBMITTED(runId)), lastStatus, settled = await withInterruptNotice(progress, () => WAIT.INTERRUPTED_RUN(runId), () => pollUntilSettled({ fetchRun: async () => replyOrThrow(await readRunForFollow(cfg, runId)), onStatus: (status) => {
     lastStatus = status, progress.update(WAIT.RUN(runId, status), WAIT.HINT_RUN);
   }, onRetry: () => progress.update(lastStatus === void 0 ? WAIT.RUN_SUBMITTED(runId) : WAIT.RUN(runId, lastStatus), WAIT.HINT_RETRYING) }));
   if (isLost(settled)) return progress.fail(WAIT.LOST), fail(WAIT.LOST_RUN_DETAIL(runId, errText(settled.error))), 1;
@@ -9087,6 +9526,7 @@ var init_wait = __esm({ "src/commands/wait.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_api();
+  init_follow();
   init_deploy_poll();
   init_run_poll();
   init_poll();
@@ -9094,11 +9534,11 @@ var init_wait = __esm({ "src/commands/wait.ts"() {
   init_constants();
   init_tenant();
 } });
-var MANIFEST_FILE, PACKAGE_SCOPE, RUNTIMES, NETWORK_TYPES, PRESETS, DURATIONS, INTERACTIONS, NAME_PATTERN, CALLBACK_ROUTE_PREFIX, EGRESS_HINT_PATTERN, DNS_LABEL, HOST_PATTERN, HOST_MAX_LENGTH, init_constants3 = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/constants.js"() {
+var MANIFEST_FILE, PACKAGE_SCOPE, RUNTIMES, NETWORK_TYPES, PRESETS, DURATIONS, INTERACTIONS, NAME_PATTERN, CALLBACK_ROUTE_PREFIX, EGRESS_HINT_PATTERN, DNS_LABEL, HOST_PATTERN, HOST_MAX_LENGTH, init_constants3 = __esm({ "../../node_modules/@ignitify-integrations/core/dist/constants.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   MANIFEST_FILE = "integration.yaml", PACKAGE_SCOPE = "@ignitify-integrations", RUNTIMES = ["node"], NETWORK_TYPES = ["none", "egress", "bidirectional"], PRESETS = ["std.micro", "std.small", "std.medium", "std.large", "std.xlarge"], DURATIONS = ["short", "long"], INTERACTIONS = ["boundary-only", "continuous"], NAME_PATTERN = "^[a-z][a-z0-9-]*[a-z0-9]$", CALLBACK_ROUTE_PREFIX = "/__callback/", EGRESS_HINT_PATTERN = "^[^\\r\\n]*$", DNS_LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", HOST_PATTERN = new RegExp(`^${DNS_LABEL}(?:\\.${DNS_LABEL})+$`), HOST_MAX_LENGTH = 253;
 } });
-var require_identity = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/identity.js"(exports2) {
+var require_identity = __commonJS({ "../../node_modules/yaml/dist/nodes/identity.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var ALIAS = /* @__PURE__ */ Symbol.for("yaml.alias"), DOC = /* @__PURE__ */ Symbol.for("yaml.document"), MAP = /* @__PURE__ */ Symbol.for("yaml.map"), PAIR = /* @__PURE__ */ Symbol.for("yaml.pair"), SCALAR = /* @__PURE__ */ Symbol.for("yaml.scalar"), SEQ = /* @__PURE__ */ Symbol.for("yaml.seq"), NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type"), isAlias = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === ALIAS, isDocument = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === DOC, isMap2 = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === MAP, isPair = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === PAIR, isScalar2 = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === SCALAR, isSeq2 = (node) => !!node && typeof node == "object" && node[NODE_TYPE] === SEQ;
@@ -9138,7 +9578,7 @@ var require_identity = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   exports2.isScalar = isScalar2;
   exports2.isSeq = isSeq2;
 } });
-var require_visit = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/visit.js"(exports2) {
+var require_visit = __commonJS({ "../../node_modules/yaml/dist/visit.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), BREAK = /* @__PURE__ */ Symbol("break visit"), SKIP = /* @__PURE__ */ Symbol("skip children"), REMOVE = /* @__PURE__ */ Symbol("remove node");
@@ -9232,7 +9672,7 @@ var require_visit = __commonJS({ "../../../../../../../../../Users/saeed/Project
   exports2.visit = visit;
   exports2.visitAsync = visitAsync;
 } });
-var require_directives = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/doc/directives.js"(exports2) {
+var require_directives = __commonJS({ "../../node_modules/yaml/dist/doc/directives.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), visit = require_visit(), escapeChars = { "!": "%21", ",": "%2C", "[": "%5B", "]": "%5D", "{": "%7B", "}": "%7D" }, escapeTagName = (tn) => tn.replace(/[!,[\]{}]/g, (ch) => escapeChars[ch]), Directives = class _Directives {
@@ -9315,7 +9755,7 @@ var require_directives = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   Directives.defaultTags = { "!!": "tag:yaml.org,2002:" };
   exports2.Directives = Directives;
 } });
-var require_anchors = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/doc/anchors.js"(exports2) {
+var require_anchors = __commonJS({ "../../node_modules/yaml/dist/doc/anchors.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), visit = require_visit();
@@ -9360,7 +9800,7 @@ var require_anchors = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   exports2.createNodeAnchors = createNodeAnchors;
   exports2.findNewAnchor = findNewAnchor;
 } });
-var require_applyReviver = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/doc/applyReviver.js"(exports2) {
+var require_applyReviver = __commonJS({ "../../node_modules/yaml/dist/doc/applyReviver.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function applyReviver(reviver, obj, key, val) {
@@ -9384,7 +9824,7 @@ var require_applyReviver = __commonJS({ "../../../../../../../../../Users/saeed/
   }
   exports2.applyReviver = applyReviver;
 } });
-var require_toJS = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/toJS.js"(exports2) {
+var require_toJS = __commonJS({ "../../node_modules/yaml/dist/nodes/toJS.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity();
@@ -9403,7 +9843,7 @@ var require_toJS = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   }
   exports2.toJS = toJS;
 } });
-var require_Node = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/Node.js"(exports2) {
+var require_Node = __commonJS({ "../../node_modules/yaml/dist/nodes/Node.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var applyReviver = require_applyReviver(), identity = require_identity(), toJS = require_toJS(), NodeBase = class {
@@ -9423,7 +9863,7 @@ var require_Node = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   };
   exports2.NodeBase = NodeBase;
 } });
-var require_Alias = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/Alias.js"(exports2) {
+var require_Alias = __commonJS({ "../../node_modules/yaml/dist/nodes/Alias.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var anchors = require_anchors(), visit = require_visit(), identity = require_identity(), Node = require_Node(), toJS = require_toJS(), Alias = class extends Node.NodeBase {
@@ -9496,7 +9936,7 @@ var require_Alias = __commonJS({ "../../../../../../../../../Users/saeed/Project
   }
   exports2.Alias = Alias;
 } });
-var require_Scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/Scalar.js"(exports2) {
+var require_Scalar = __commonJS({ "../../node_modules/yaml/dist/nodes/Scalar.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Node = require_Node(), toJS = require_toJS(), isScalarValue = (value) => !value || typeof value != "function" && typeof value != "object", Scalar = class extends Node.NodeBase {
@@ -9518,7 +9958,7 @@ var require_Scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   exports2.Scalar = Scalar;
   exports2.isScalarValue = isScalarValue;
 } });
-var require_createNode = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/doc/createNode.js"(exports2) {
+var require_createNode = __commonJS({ "../../node_modules/yaml/dist/doc/createNode.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Alias = require_Alias(), identity = require_identity(), Scalar = require_Scalar(), defaultTagPrefix = "tag:yaml.org,2002:";
@@ -9557,7 +9997,7 @@ var require_createNode = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   }
   exports2.createNode = createNode;
 } });
-var require_Collection = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/Collection.js"(exports2) {
+var require_Collection = __commonJS({ "../../node_modules/yaml/dist/nodes/Collection.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var createNode = require_createNode(), identity = require_identity(), Node = require_Node();
@@ -9630,7 +10070,7 @@ var require_Collection = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   exports2.collectionFromPath = collectionFromPath;
   exports2.isEmptyPath = isEmptyPath;
 } });
-var require_stringifyComment = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyComment.js"(exports2) {
+var require_stringifyComment = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyComment.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyComment = (str3) => str3.replace(/^(?!$)(?: $)?/gm, "#");
@@ -9645,7 +10085,7 @@ var require_stringifyComment = __commonJS({ "../../../../../../../../../Users/sa
   exports2.lineComment = lineComment;
   exports2.stringifyComment = stringifyComment;
 } });
-var require_foldFlowLines = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/foldFlowLines.js"(exports2) {
+var require_foldFlowLines = __commonJS({ "../../node_modules/yaml/dist/stringify/foldFlowLines.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var FOLD_FLOW = "flow", FOLD_BLOCK = "block", FOLD_QUOTED = "quoted";
@@ -9722,7 +10162,7 @@ ${indent}${text.slice(fold + 1, end2)}`);
   exports2.FOLD_QUOTED = FOLD_QUOTED;
   exports2.foldFlowLines = foldFlowLines;
 } });
-var require_stringifyString = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyString.js"(exports2) {
+var require_stringifyString = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyString.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), foldFlowLines = require_foldFlowLines(), getFoldOptions = (ctx, isBlock) => ({ indentAtStart: isBlock ? ctx.indent.length : ctx.indentAtStart, lineWidth: ctx.options.lineWidth, minContentWidth: ctx.options.minContentWidth }), containsDocumentMarker = (str3) => /^(%|---|\.\.\.)/m.test(str3);
@@ -9904,7 +10344,7 @@ ${indent}`);
   }
   exports2.stringifyString = stringifyString;
 } });
-var require_stringify = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringify.js"(exports2) {
+var require_stringify = __commonJS({ "../../node_modules/yaml/dist/stringify/stringify.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var anchors = require_anchors(), identity = require_identity(), stringifyComment = require_stringifyComment(), stringifyString = require_stringifyString();
@@ -9968,7 +10408,7 @@ ${ctx.indent}${str3}` : str3;
   exports2.createStringifyContext = createStringifyContext;
   exports2.stringify = stringify;
 } });
-var require_stringifyPair = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyPair.js"(exports2) {
+var require_stringifyPair = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyPair.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Scalar = require_Scalar(), stringify = require_stringify(), stringifyComment = require_stringifyComment();
@@ -10026,7 +10466,7 @@ ${ctx.indent}`);
   }
   exports2.stringifyPair = stringifyPair;
 } });
-var require_log = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/log.js"(exports2) {
+var require_log = __commonJS({ "../../node_modules/yaml/dist/log.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var node_process = require("process");
@@ -10039,7 +10479,7 @@ var require_log = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   exports2.debug = debug;
   exports2.warn = warn2;
 } });
-var require_merge = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/merge.js"(exports2) {
+var require_merge = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/merge.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Scalar = require_Scalar(), MERGE_KEY = "<<", merge2 = { identify: (value) => value === MERGE_KEY || typeof value == "symbol" && value.description === MERGE_KEY, default: "key", tag: "tag:yaml.org,2002:merge", test: /^<<$/, resolve: () => Object.assign(new Scalar.Scalar(Symbol(MERGE_KEY)), { addToJSMap: addMergeToJSMap }), stringify: () => MERGE_KEY }, isMergeKey = (ctx, key) => (merge2.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge2.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge2.tag && tag.default);
@@ -10063,7 +10503,7 @@ var require_merge = __commonJS({ "../../../../../../../../../Users/saeed/Project
   exports2.isMergeKey = isMergeKey;
   exports2.merge = merge2;
 } });
-var require_addPairToJSMap = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
+var require_addPairToJSMap = __commonJS({ "../../node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var log = require_log(), merge2 = require_merge(), stringify = require_stringify(), identity = require_identity(), toJS = require_toJS();
@@ -10100,7 +10540,7 @@ var require_addPairToJSMap = __commonJS({ "../../../../../../../../../Users/saee
   }
   exports2.addPairToJSMap = addPairToJSMap;
 } });
-var require_Pair = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/Pair.js"(exports2) {
+var require_Pair = __commonJS({ "../../node_modules/yaml/dist/nodes/Pair.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var createNode = require_createNode(), stringifyPair = require_stringifyPair(), addPairToJSMap = require_addPairToJSMap(), identity = require_identity();
@@ -10127,7 +10567,7 @@ var require_Pair = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   exports2.Pair = Pair;
   exports2.createPair = createPair;
 } });
-var require_stringifyCollection = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyCollection.js"(exports2) {
+var require_stringifyCollection = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyCollection.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), stringify = require_stringify(), stringifyComment = require_stringifyComment();
@@ -10202,7 +10642,7 @@ ${indent}${end}`;
   }
   exports2.stringifyCollection = stringifyCollection;
 } });
-var require_YAMLMap = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/YAMLMap.js"(exports2) {
+var require_YAMLMap = __commonJS({ "../../node_modules/yaml/dist/nodes/YAMLMap.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyCollection = require_stringifyCollection(), addPairToJSMap = require_addPairToJSMap(), Collection = require_Collection(), identity = require_identity(), Pair = require_Pair(), Scalar = require_Scalar();
@@ -10268,7 +10708,7 @@ var require_YAMLMap = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   exports2.YAMLMap = YAMLMap;
   exports2.findPair = findPair;
 } });
-var require_map = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/common/map.js"(exports2) {
+var require_map = __commonJS({ "../../node_modules/yaml/dist/schema/common/map.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), YAMLMap = require_YAMLMap(), map2 = { collection: "map", default: true, nodeClass: YAMLMap.YAMLMap, tag: "tag:yaml.org,2002:map", resolve(map3, onError) {
@@ -10276,7 +10716,7 @@ var require_map = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   }, createNode: (schema2, obj, ctx) => YAMLMap.YAMLMap.from(schema2, obj, ctx) };
   exports2.map = map2;
 } });
-var require_YAMLSeq = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/nodes/YAMLSeq.js"(exports2) {
+var require_YAMLSeq = __commonJS({ "../../node_modules/yaml/dist/nodes/YAMLSeq.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var createNode = require_createNode(), stringifyCollection = require_stringifyCollection(), Collection = require_Collection(), identity = require_identity(), Scalar = require_Scalar(), toJS = require_toJS(), YAMLSeq = class extends Collection.Collection {
@@ -10340,7 +10780,7 @@ var require_YAMLSeq = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   }
   exports2.YAMLSeq = YAMLSeq;
 } });
-var require_seq = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/common/seq.js"(exports2) {
+var require_seq = __commonJS({ "../../node_modules/yaml/dist/schema/common/seq.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), YAMLSeq = require_YAMLSeq(), seq2 = { collection: "seq", default: true, nodeClass: YAMLSeq.YAMLSeq, tag: "tag:yaml.org,2002:seq", resolve(seq3, onError) {
@@ -10348,7 +10788,7 @@ var require_seq = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   }, createNode: (schema2, obj, ctx) => YAMLSeq.YAMLSeq.from(schema2, obj, ctx) };
   exports2.seq = seq2;
 } });
-var require_string = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/common/string.js"(exports2) {
+var require_string = __commonJS({ "../../node_modules/yaml/dist/schema/common/string.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyString = require_stringifyString(), string = { identify: (value) => typeof value == "string", default: true, tag: "tag:yaml.org,2002:str", resolve: (str3) => str3, stringify(item, ctx, onComment, onChompKeep) {
@@ -10356,13 +10796,13 @@ var require_string = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   } };
   exports2.string = string;
 } });
-var require_null2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/common/null.js"(exports2) {
+var require_null2 = __commonJS({ "../../node_modules/yaml/dist/schema/common/null.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), nullTag = { identify: (value) => value == null, createNode: () => new Scalar.Scalar(null), default: true, tag: "tag:yaml.org,2002:null", test: /^(?:~|[Nn]ull|NULL)?$/, resolve: () => new Scalar.Scalar(null), stringify: ({ source }, ctx) => typeof source == "string" && nullTag.test.test(source) ? source : ctx.options.nullStr };
   exports2.nullTag = nullTag;
 } });
-var require_bool = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/core/bool.js"(exports2) {
+var require_bool = __commonJS({ "../../node_modules/yaml/dist/schema/core/bool.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), boolTag = { identify: (value) => typeof value == "boolean", default: true, tag: "tag:yaml.org,2002:bool", test: /^(?:[Tt]rue|TRUE|[Ff]alse|FALSE)$/, resolve: (str3) => new Scalar.Scalar(str3[0] === "t" || str3[0] === "T"), stringify({ source, value }, ctx) {
@@ -10374,7 +10814,7 @@ var require_bool = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   } };
   exports2.boolTag = boolTag;
 } });
-var require_stringifyNumber = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyNumber.js"(exports2) {
+var require_stringifyNumber = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyNumber.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
@@ -10392,7 +10832,7 @@ var require_stringifyNumber = __commonJS({ "../../../../../../../../../Users/sae
   }
   exports2.stringifyNumber = stringifyNumber;
 } });
-var require_float = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/core/float.js"(exports2) {
+var require_float = __commonJS({ "../../node_modules/yaml/dist/schema/core/float.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), stringifyNumber = require_stringifyNumber(), floatNaN = { identify: (value) => typeof value == "number", default: true, tag: "tag:yaml.org,2002:float", test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/, resolve: (str3) => str3.slice(-3).toLowerCase() === "nan" ? NaN : str3[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY, stringify: stringifyNumber.stringifyNumber }, floatExp = { identify: (value) => typeof value == "number", default: true, tag: "tag:yaml.org,2002:float", format: "EXP", test: /^[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)[eE][-+]?[0-9]+$/, resolve: (str3) => parseFloat(str3), stringify(node) {
@@ -10406,7 +10846,7 @@ var require_float = __commonJS({ "../../../../../../../../../Users/saeed/Project
   exports2.floatExp = floatExp;
   exports2.floatNaN = floatNaN;
 } });
-var require_int = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/core/int.js"(exports2) {
+var require_int = __commonJS({ "../../node_modules/yaml/dist/schema/core/int.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyNumber = require_stringifyNumber(), intIdentify = (value) => typeof value == "bigint" || Number.isInteger(value), intResolve = (str3, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str3) : parseInt(str3.substring(offset), radix);
@@ -10419,13 +10859,13 @@ var require_int = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   exports2.intHex = intHex;
   exports2.intOct = intOct;
 } });
-var require_schema2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/core/schema.js"(exports2) {
+var require_schema2 = __commonJS({ "../../node_modules/yaml/dist/schema/core/schema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var map2 = require_map(), _null2 = require_null2(), seq2 = require_seq(), string = require_string(), bool2 = require_bool(), float2 = require_float(), int2 = require_int(), schema2 = [map2.map, seq2.seq, string.string, _null2.nullTag, bool2.boolTag, int2.intOct, int2.int, int2.intHex, float2.floatNaN, float2.floatExp, float2.float];
   exports2.schema = schema2;
 } });
-var require_schema3 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/json/schema.js"(exports2) {
+var require_schema3 = __commonJS({ "../../node_modules/yaml/dist/schema/json/schema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), map2 = require_map(), seq2 = require_seq();
@@ -10437,7 +10877,7 @@ var require_schema3 = __commonJS({ "../../../../../../../../../Users/saeed/Proje
   } }, schema2 = [map2.map, seq2.seq].concat(jsonScalars, jsonError);
   exports2.schema = schema2;
 } });
-var require_binary = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/binary.js"(exports2) {
+var require_binary = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/binary.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var node_buffer = require("buffer"), Scalar = require_Scalar(), stringifyString = require_stringifyString(), binary2 = { identify: (value) => value instanceof Uint8Array, default: false, tag: "tag:yaml.org,2002:binary", resolve(src, onError) {
@@ -10466,7 +10906,7 @@ var require_binary = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   } };
   exports2.binary = binary2;
 } });
-var require_pairs = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/pairs.js"(exports2) {
+var require_pairs = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/pairs.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Pair = require_Pair(), Scalar = require_Scalar(), YAMLSeq = require_YAMLSeq();
@@ -10514,7 +10954,7 @@ ${cn.comment}` : item.comment;
   exports2.pairs = pairs3;
   exports2.resolvePairs = resolvePairs;
 } });
-var require_omap = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/omap.js"(exports2) {
+var require_omap = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/omap.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), toJS = require_toJS(), YAMLMap = require_YAMLMap(), YAMLSeq = require_YAMLSeq(), pairs3 = require_pairs(), YAMLOMap = class _YAMLOMap extends YAMLSeq.YAMLSeq {
@@ -10546,7 +10986,7 @@ var require_omap = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   exports2.YAMLOMap = YAMLOMap;
   exports2.omap = omap2;
 } });
-var require_bool2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/bool.js"(exports2) {
+var require_bool2 = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/bool.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar();
@@ -10557,7 +10997,7 @@ var require_bool2 = __commonJS({ "../../../../../../../../../Users/saeed/Project
   exports2.falseTag = falseTag;
   exports2.trueTag = trueTag;
 } });
-var require_float2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/float.js"(exports2) {
+var require_float2 = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/float.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), stringifyNumber = require_stringifyNumber(), floatNaN = { identify: (value) => typeof value == "number", default: true, tag: "tag:yaml.org,2002:float", test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/, resolve: (str3) => str3.slice(-3).toLowerCase() === "nan" ? NaN : str3[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY, stringify: stringifyNumber.stringifyNumber }, floatExp = { identify: (value) => typeof value == "number", default: true, tag: "tag:yaml.org,2002:float", format: "EXP", test: /^[-+]?(?:[0-9][0-9_]*)?(?:\.[0-9_]*)?[eE][-+]?[0-9]+$/, resolve: (str3) => parseFloat(str3.replace(/_/g, "")), stringify(node) {
@@ -10575,7 +11015,7 @@ var require_float2 = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   exports2.floatExp = floatExp;
   exports2.floatNaN = floatNaN;
 } });
-var require_int2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/int.js"(exports2) {
+var require_int2 = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/int.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyNumber = require_stringifyNumber(), intIdentify = (value) => typeof value == "bigint" || Number.isInteger(value);
@@ -10613,7 +11053,7 @@ var require_int2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   exports2.intHex = intHex;
   exports2.intOct = intOct;
 } });
-var require_set = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/set.js"(exports2) {
+var require_set = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/set.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Pair = require_Pair(), YAMLMap = require_YAMLMap(), YAMLSet = class _YAMLSet extends YAMLMap.YAMLMap {
@@ -10658,7 +11098,7 @@ var require_set = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   exports2.YAMLSet = YAMLSet;
   exports2.set = set2;
 } });
-var require_timestamp = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js"(exports2) {
+var require_timestamp = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/timestamp.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringifyNumber = require_stringifyNumber();
@@ -10689,13 +11129,13 @@ var require_timestamp = __commonJS({ "../../../../../../../../../Users/saeed/Pro
   exports2.intTime = intTime;
   exports2.timestamp = timestamp2;
 } });
-var require_schema4 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/yaml-1.1/schema.js"(exports2) {
+var require_schema4 = __commonJS({ "../../node_modules/yaml/dist/schema/yaml-1.1/schema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var map2 = require_map(), _null2 = require_null2(), seq2 = require_seq(), string = require_string(), binary2 = require_binary(), bool2 = require_bool2(), float2 = require_float2(), int2 = require_int2(), merge2 = require_merge(), omap2 = require_omap(), pairs3 = require_pairs(), set2 = require_set(), timestamp2 = require_timestamp(), schema2 = [map2.map, seq2.seq, string.string, _null2.nullTag, bool2.trueTag, bool2.falseTag, int2.intBin, int2.intOct, int2.int, int2.intHex, float2.floatNaN, float2.floatExp, float2.float, binary2.binary, merge2.merge, omap2.omap, pairs3.pairs, set2.set, timestamp2.intTime, timestamp2.floatTime, timestamp2.timestamp];
   exports2.schema = schema2;
 } });
-var require_tags = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/tags.js"(exports2) {
+var require_tags = __commonJS({ "../../node_modules/yaml/dist/schema/tags.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var map2 = require_map(), _null2 = require_null2(), seq2 = require_seq(), string = require_string(), bool2 = require_bool(), float2 = require_float(), int2 = require_int(), schema2 = require_schema2(), schema$1 = require_schema3(), binary2 = require_binary(), merge2 = require_merge(), omap2 = require_omap(), pairs3 = require_pairs(), schema$2 = require_schema4(), set2 = require_set(), timestamp2 = require_timestamp(), schemas = /* @__PURE__ */ new Map([["core", schema2.schema], ["failsafe", [map2.map, seq2.seq, string.string]], ["json", schema$1.schema], ["yaml11", schema$2.schema], ["yaml-1.1", schema$2.schema]]), tagsByName = { binary: binary2.binary, bool: bool2.boolTag, float: float2.float, floatExp: float2.floatExp, floatNaN: float2.floatNaN, floatTime: timestamp2.floatTime, int: int2.int, intHex: int2.intHex, intOct: int2.intOct, intTime: timestamp2.intTime, map: map2.map, merge: merge2.merge, null: _null2.nullTag, omap: omap2.omap, pairs: pairs3.pairs, seq: seq2.seq, set: set2.set, timestamp: timestamp2.timestamp }, coreKnownTags = { "tag:yaml.org,2002:binary": binary2.binary, "tag:yaml.org,2002:merge": merge2.merge, "tag:yaml.org,2002:omap": omap2.omap, "tag:yaml.org,2002:pairs": pairs3.pairs, "tag:yaml.org,2002:set": set2.set, "tag:yaml.org,2002:timestamp": timestamp2.timestamp };
@@ -10722,7 +11162,7 @@ var require_tags = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   exports2.coreKnownTags = coreKnownTags;
   exports2.getTags = getTags;
 } });
-var require_Schema = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/schema/Schema.js"(exports2) {
+var require_Schema = __commonJS({ "../../node_modules/yaml/dist/schema/Schema.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), map2 = require_map(), seq2 = require_seq(), string = require_string(), tags = require_tags(), sortMapEntriesByKey = (a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0, Schema2 = class _Schema {
@@ -10736,7 +11176,7 @@ var require_Schema = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   };
   exports2.Schema = Schema2;
 } });
-var require_stringifyDocument = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/stringify/stringifyDocument.js"(exports2) {
+var require_stringifyDocument = __commonJS({ "../../node_modules/yaml/dist/stringify/stringifyDocument.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), stringify = require_stringify(), stringifyComment = require_stringifyComment();
@@ -10780,7 +11220,7 @@ var require_stringifyDocument = __commonJS({ "../../../../../../../../../Users/s
   }
   exports2.stringifyDocument = stringifyDocument;
 } });
-var require_Document = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/doc/Document.js"(exports2) {
+var require_Document = __commonJS({ "../../node_modules/yaml/dist/doc/Document.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Alias = require_Alias(), Collection = require_Collection(), identity = require_identity(), Pair = require_Pair(), toJS = require_toJS(), Schema2 = require_Schema(), stringifyDocument = require_stringifyDocument(), anchors = require_anchors(), applyReviver = require_applyReviver(), createNode = require_createNode(), directives = require_directives(), Document = class _Document {
@@ -10894,7 +11334,7 @@ var require_Document = __commonJS({ "../../../../../../../../../Users/saeed/Proj
   }
   exports2.Document = Document;
 } });
-var require_errors2 = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/errors.js"(exports2) {
+var require_errors2 = __commonJS({ "../../node_modules/yaml/dist/errors.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var YAMLError = class extends Error {
@@ -10940,7 +11380,7 @@ ${pointer}
   exports2.YAMLWarning = YAMLWarning;
   exports2.prettifyError = prettifyError;
 } });
-var require_resolve_props = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-props.js"(exports2) {
+var require_resolve_props = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-props.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
@@ -10981,7 +11421,7 @@ var require_resolve_props = __commonJS({ "../../../../../../../../../Users/saeed
   }
   exports2.resolveProps = resolveProps;
 } });
-var require_util_contains_newline = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/util-contains-newline.js"(exports2) {
+var require_util_contains_newline = __commonJS({ "../../node_modules/yaml/dist/compose/util-contains-newline.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function containsNewline(key) {
@@ -11012,7 +11452,7 @@ var require_util_contains_newline = __commonJS({ "../../../../../../../../../Use
   }
   exports2.containsNewline = containsNewline;
 } });
-var require_util_flow_indent_check = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/util-flow-indent-check.js"(exports2) {
+var require_util_flow_indent_check = __commonJS({ "../../node_modules/yaml/dist/compose/util-flow-indent-check.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var utilContainsNewline = require_util_contains_newline();
@@ -11024,7 +11464,7 @@ var require_util_flow_indent_check = __commonJS({ "../../../../../../../../../Us
   }
   exports2.flowIndentCheck = flowIndentCheck;
 } });
-var require_util_map_includes = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/util-map-includes.js"(exports2) {
+var require_util_map_includes = __commonJS({ "../../node_modules/yaml/dist/compose/util-map-includes.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity();
@@ -11036,7 +11476,7 @@ var require_util_map_includes = __commonJS({ "../../../../../../../../../Users/s
   }
   exports2.mapIncludes = mapIncludes;
 } });
-var require_resolve_block_map = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-block-map.js"(exports2) {
+var require_resolve_block_map = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-block-map.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Pair = require_Pair(), YAMLMap = require_YAMLMap(), resolveProps = require_resolve_props(), utilContainsNewline = require_util_contains_newline(), utilFlowIndentCheck = require_util_flow_indent_check(), utilMapIncludes = require_util_map_includes(), startColMsg = "All mapping items must start at the same column";
@@ -11075,7 +11515,7 @@ var require_resolve_block_map = __commonJS({ "../../../../../../../../../Users/s
   }
   exports2.resolveBlockMap = resolveBlockMap;
 } });
-var require_resolve_block_seq = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-block-seq.js"(exports2) {
+var require_resolve_block_seq = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-block-seq.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var YAMLSeq = require_YAMLSeq(), resolveProps = require_resolve_props(), utilFlowIndentCheck = require_util_flow_indent_check();
@@ -11097,7 +11537,7 @@ var require_resolve_block_seq = __commonJS({ "../../../../../../../../../Users/s
   }
   exports2.resolveBlockSeq = resolveBlockSeq;
 } });
-var require_resolve_end = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-end.js"(exports2) {
+var require_resolve_end = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-end.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function resolveEnd(end, offset, reqSpace, onError) {
@@ -11129,7 +11569,7 @@ var require_resolve_end = __commonJS({ "../../../../../../../../../Users/saeed/P
   }
   exports2.resolveEnd = resolveEnd;
 } });
-var require_resolve_flow_collection = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-flow-collection.js"(exports2) {
+var require_resolve_flow_collection = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-flow-collection.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Pair = require_Pair(), YAMLMap = require_YAMLMap(), YAMLSeq = require_YAMLSeq(), resolveEnd = require_resolve_end(), resolveProps = require_resolve_props(), utilContainsNewline = require_util_contains_newline(), utilMapIncludes = require_util_map_includes(), blockMsg = "Block collections are not allowed within flow collections", isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
@@ -11219,7 +11659,7 @@ var require_resolve_flow_collection = __commonJS({ "../../../../../../../../../U
   }
   exports2.resolveFlowCollection = resolveFlowCollection;
 } });
-var require_compose_collection = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/compose-collection.js"(exports2) {
+var require_compose_collection = __commonJS({ "../../node_modules/yaml/dist/compose/compose-collection.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Scalar = require_Scalar(), YAMLMap = require_YAMLMap(), YAMLSeq = require_YAMLSeq(), resolveBlockMap = require_resolve_block_map(), resolveBlockSeq = require_resolve_block_seq(), resolveFlowCollection = require_resolve_flow_collection();
@@ -11246,7 +11686,7 @@ var require_compose_collection = __commonJS({ "../../../../../../../../../Users/
   }
   exports2.composeCollection = composeCollection;
 } });
-var require_resolve_block_scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-block-scalar.js"(exports2) {
+var require_resolve_block_scalar = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-block-scalar.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar();
@@ -11358,7 +11798,7 @@ var require_resolve_block_scalar = __commonJS({ "../../../../../../../../../User
   }
   exports2.resolveBlockScalar = resolveBlockScalar;
 } });
-var require_resolve_flow_scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/resolve-flow-scalar.js"(exports2) {
+var require_resolve_flow_scalar = __commonJS({ "../../node_modules/yaml/dist/compose/resolve-flow-scalar.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Scalar = require_Scalar(), resolveEnd = require_resolve_end();
@@ -11482,7 +11922,7 @@ var require_resolve_flow_scalar = __commonJS({ "../../../../../../../../../Users
   }
   exports2.resolveFlowScalar = resolveFlowScalar;
 } });
-var require_compose_scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/compose-scalar.js"(exports2) {
+var require_compose_scalar = __commonJS({ "../../node_modules/yaml/dist/compose/compose-scalar.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var identity = require_identity(), Scalar = require_Scalar(), resolveBlockScalar = require_resolve_block_scalar(), resolveFlowScalar = require_resolve_flow_scalar();
@@ -11521,7 +11961,7 @@ var require_compose_scalar = __commonJS({ "../../../../../../../../../Users/saee
   }
   exports2.composeScalar = composeScalar;
 } });
-var require_util_empty_scalar_position = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/util-empty-scalar-position.js"(exports2) {
+var require_util_empty_scalar_position = __commonJS({ "../../node_modules/yaml/dist/compose/util-empty-scalar-position.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   function emptyScalarPosition(offset, before, pos) {
@@ -11544,7 +11984,7 @@ var require_util_empty_scalar_position = __commonJS({ "../../../../../../../../.
   }
   exports2.emptyScalarPosition = emptyScalarPosition;
 } });
-var require_compose_node = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/compose-node.js"(exports2) {
+var require_compose_node = __commonJS({ "../../node_modules/yaml/dist/compose/compose-node.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Alias = require_Alias(), identity = require_identity(), composeCollection = require_compose_collection(), composeScalar = require_compose_scalar(), resolveEnd = require_resolve_end(), utilEmptyScalarPosition = require_util_empty_scalar_position(), CN = { composeNode, composeEmptyNode };
@@ -11590,7 +12030,7 @@ var require_compose_node = __commonJS({ "../../../../../../../../../Users/saeed/
   exports2.composeEmptyNode = composeEmptyNode;
   exports2.composeNode = composeNode;
 } });
-var require_compose_doc = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/compose-doc.js"(exports2) {
+var require_compose_doc = __commonJS({ "../../node_modules/yaml/dist/compose/compose-doc.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var Document = require_Document(), composeNode = require_compose_node(), resolveEnd = require_resolve_end(), resolveProps = require_resolve_props();
@@ -11602,7 +12042,7 @@ var require_compose_doc = __commonJS({ "../../../../../../../../../Users/saeed/P
   }
   exports2.composeDoc = composeDoc;
 } });
-var require_composer = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/compose/composer.js"(exports2) {
+var require_composer = __commonJS({ "../../node_modules/yaml/dist/compose/composer.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var node_process = require("process"), directives = require_directives(), Document = require_Document(), errors = require_errors2(), identity = require_identity(), composeDoc = require_compose_doc(), resolveEnd = require_resolve_end();
@@ -11726,7 +12166,7 @@ ${end.comment}` : end.comment;
   };
   exports2.Composer = Composer;
 } });
-var require_cst_scalar = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/cst-scalar.js"(exports2) {
+var require_cst_scalar = __commonJS({ "../../node_modules/yaml/dist/parse/cst-scalar.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var resolveBlockScalar = require_resolve_block_scalar(), resolveFlowScalar = require_resolve_flow_scalar(), errors = require_errors2(), stringifyString = require_stringifyString();
@@ -11861,7 +12301,7 @@ var require_cst_scalar = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   exports2.resolveAsScalar = resolveAsScalar;
   exports2.setScalarValue = setScalarValue;
 } });
-var require_cst_stringify = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/cst-stringify.js"(exports2) {
+var require_cst_stringify = __commonJS({ "../../node_modules/yaml/dist/parse/cst-stringify.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var stringify = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
@@ -11904,7 +12344,7 @@ var require_cst_stringify = __commonJS({ "../../../../../../../../../Users/saeed
   }
   exports2.stringify = stringify;
 } });
-var require_cst_visit = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/cst-visit.js"(exports2) {
+var require_cst_visit = __commonJS({ "../../node_modules/yaml/dist/parse/cst-visit.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var BREAK = /* @__PURE__ */ Symbol("break visit"), SKIP = /* @__PURE__ */ Symbol("skip children"), REMOVE = /* @__PURE__ */ Symbol("remove item");
@@ -11949,7 +12389,7 @@ var require_cst_visit = __commonJS({ "../../../../../../../../../Users/saeed/Pro
   }
   exports2.visit = visit;
 } });
-var require_cst = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/cst.js"(exports2) {
+var require_cst = __commonJS({ "../../node_modules/yaml/dist/parse/cst.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var cstScalar = require_cst_scalar(), cstStringify = require_cst_stringify(), cstVisit = require_cst_visit(), BOM = "\uFEFF", DOCUMENT = "", FLOW_END = "", SCALAR = "", isCollection = (token) => !!token && "items" in token, isScalar2 = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
@@ -12042,7 +12482,7 @@ var require_cst = __commonJS({ "../../../../../../../../../Users/saeed/Projects/
   exports2.prettyToken = prettyToken;
   exports2.tokenType = tokenType;
 } });
-var require_lexer = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/lexer.js"(exports2) {
+var require_lexer = __commonJS({ "../../node_modules/yaml/dist/parse/lexer.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var cst = require_cst();
@@ -12419,7 +12859,7 @@ var require_lexer = __commonJS({ "../../../../../../../../../Users/saeed/Project
   };
   exports2.Lexer = Lexer;
 } });
-var require_line_counter = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/line-counter.js"(exports2) {
+var require_line_counter = __commonJS({ "../../node_modules/yaml/dist/parse/line-counter.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var LineCounter = class {
@@ -12439,7 +12879,7 @@ var require_line_counter = __commonJS({ "../../../../../../../../../Users/saeed/
   };
   exports2.LineCounter = LineCounter;
 } });
-var require_parser = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/parse/parser.js"(exports2) {
+var require_parser = __commonJS({ "../../node_modules/yaml/dist/parse/parser.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var node_process = require("process"), cst = require_cst(), lexer = require_lexer();
@@ -12943,7 +13383,7 @@ var require_parser = __commonJS({ "../../../../../../../../../Users/saeed/Projec
   };
   exports2.Parser = Parser;
 } });
-var require_public_api = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/public-api.js"(exports2) {
+var require_public_api = __commonJS({ "../../node_modules/yaml/dist/public-api.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var composer = require_composer(), Document = require_Document(), errors = require_errors2(), log = require_log(), identity = require_identity(), lineCounter = require_line_counter(), parser = require_parser();
@@ -12993,7 +13433,7 @@ var require_public_api = __commonJS({ "../../../../../../../../../Users/saeed/Pr
   exports2.parseDocument = parseDocument2;
   exports2.stringify = stringify;
 } });
-var require_dist = __commonJS({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/node_modules/yaml/dist/index.js"(exports2) {
+var require_dist = __commonJS({ "../../node_modules/yaml/dist/index.js"(exports2) {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   var composer = require_composer(), Document = require_Document(), Schema2 = require_Schema(), errors = require_errors2(), Alias = require_Alias(), identity = require_identity(), Pair = require_Pair(), Scalar = require_Scalar(), YAMLMap = require_YAMLMap(), YAMLSeq = require_YAMLSeq(), cst = require_cst(), lexer = require_lexer(), lineCounter = require_line_counter(), parser = require_parser(), publicApi = require_public_api(), visit = require_visit();
@@ -13027,41 +13467,45 @@ var require_dist = __commonJS({ "../../../../../../../../../Users/saeed/Projects
   exports2.visit = visit.visit;
   exports2.visitAsync = visit.visitAsync;
 } });
-var ok, err, init_result2 = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/runtime/dist/result.js"() {
+var ok, err, init_result2 = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/result.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   ok = (value) => ({ ok: true, value }), err = (error) => ({ ok: false, error });
 } });
-var init_ctx = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/runtime/dist/ctx.js"() {
+var init_ctx = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/ctx.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
 } });
-var SECRET_NAME_MAX_LENGTH, SECRET_NAME_PATTERN, init_secrets = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/runtime/dist/secrets.js"() {
+var SECRET_NAME_MAX_LENGTH, SECRET_NAME_PATTERN, init_secrets = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/secrets.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_result2();
   SECRET_NAME_MAX_LENGTH = 64, SECRET_NAME_PATTERN = new RegExp(`^[A-Z][A-Z0-9_]{0,${SECRET_NAME_MAX_LENGTH - 1}}$`);
 } });
-var ROUTE_PREFIX_PATTERN, init_platform = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/runtime/dist/platform.js"() {
+var ROUTE_PREFIX_PATTERN, init_platform = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/platform.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   ROUTE_PREFIX_PATTERN = "^/[a-z0-9._~-]+(/[a-z0-9._~-]+)*/$";
 } });
-var init_dist = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/runtime/dist/index.js"() {
+var init_stop = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/stop.js"() {
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+var init_dist = __esm({ "../../node_modules/@ignitify-integrations/runtime/dist/index.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_result2();
   init_ctx();
   init_secrets();
   init_platform();
+  init_stop();
 } });
-var list, MANIFEST_MESSAGES, PLAN_MESSAGES, COVERAGE_MESSAGES, init_messages = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/messages.js"() {
+var list, MANIFEST_MESSAGES, PLAN_MESSAGES, COVERAGE_MESSAGES, init_messages = __esm({ "../../node_modules/@ignitify-integrations/core/dist/messages.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants3();
   list = (items) => items.join(", "), MANIFEST_MESSAGES = { yaml: (reason) => `not valid YAML: ${reason}`, schema: (path12, message) => `${path12}: ${message}`, badHost: (host) => `network.egress_allow: "${host}" is not a lower-case DNS name with at least two labels and no wildcard (hosts that vary go in network.egress_hint)`, egressNeedsNic: (key) => `network.${key}: needs network.type "egress" or "bidirectional"`, inboundNeedsBidirectional: (key) => `network.${key}: needs network.type "bidirectional"`, shadowsCallback: (prefix) => `network.inbound_routes: "${prefix}" would shadow the platform callback route ${CALLBACK_ROUTE_PREFIX}` }, PLAN_MESSAGES = { settingsOnly: "settings only", settingsAndCode: "settings + code", runs: (packages) => `runs ${list(packages)}`, conflict: (field, current, wanted, label) => `${field} is ${String(current)} but ${label} needs ${String(wanted)}: change it by hand or use another task`, tooManyHosts: (count) => `execution.network.egress_allow would list ${count} hosts; the platform allows at most ${32}`, networkRaised: (from, to) => `execution.network.type: ${from} -> ${to}`, egressAnywhere: (hosts) => `execution.network.egress_allow is absent (any host), so it stays absent; this integration needs: ${list(hosts)}`, presetRaised: (from, to) => `run.preset: ${from ?? "(default)"} -> ${to}`, presetUnknown: (preset, min) => `run.preset ${preset} is not a known preset; left as is (this integration needs at least ${min})`, setSecret: (name, isNew) => `secret ${name}${isNew ? " (new)" : ""}: ignitify secret:set ${name} --stdin`, addHost: (hint) => `egress host: ${hint}` }, COVERAGE_MESSAGES = { secretMissing: (label, name) => `${label}: secret ${name} is missing from secrets`, hostMissing: (label, host) => `${label}: host ${host} is missing from execution.network.egress_allow`, networkTooSmall: (label, have, need) => `${label}: execution.network.type is ${have}, needs ${need}`, fieldMismatch: (label, field, have, need) => `${label}: ${field} is ${have === void 0 ? "(absent)" : String(have)}, needs ${String(need)}`, packageMissing: (label, name) => `${label}: system package ${name} is missing from build.system_packages`, presetTooSmall: (label, have, need) => `${label}: run.preset is ${have ?? "(default)"}, needs at least ${need}`, routeMissing: (label, prefix) => `${label}: route ${prefix} is missing from execution.network.inbound_routes` };
 } });
-var nonEmptyString, uniqueStrings, closed, network, MANIFEST_SCHEMA, init_schema = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/schema.js"() {
+var nonEmptyString, uniqueStrings, closed, network, MANIFEST_SCHEMA, init_schema = __esm({ "../../node_modules/@ignitify-integrations/core/dist/schema.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_dist();
   init_constants3();
   nonEmptyString = { type: "string", minLength: 1 }, uniqueStrings = { type: "array", items: nonEmptyString, uniqueItems: true }, closed = (properties, required = []) => ({ type: "object", additionalProperties: false, properties, required }), network = closed({ type: { enum: NETWORK_TYPES }, egress_allow: { type: "array", items: { type: "string", minLength: 1, maxLength: HOST_MAX_LENGTH }, uniqueItems: true, maxItems: 32 }, egress_hint: { type: "string", minLength: 1, maxLength: 200, pattern: EGRESS_HINT_PATTERN }, inbound_port: { type: "integer", minimum: 1024, maximum: 65535 }, inbound_routes: { type: "array", minItems: 1, maxItems: 32, items: closed({ prefix: { type: "string", maxLength: 256, pattern: ROUTE_PREFIX_PATTERN } }, ["prefix"]) }, inbound_max_concurrent: { type: "integer", minimum: 1 } }, ["type"]), MANIFEST_SCHEMA = { $schema: "https://json-schema.org/draft/2020-12/schema", title: "ignitify integration manifest", ...closed({ schema_version: { const: 1 }, name: { type: "string", pattern: NAME_PATTERN }, runtimes: { type: "array", items: { enum: RUNTIMES }, minItems: 1, uniqueItems: true }, secrets: { type: "array", items: { type: "string", maxLength: SECRET_NAME_MAX_LENGTH, pattern: SECRET_NAME_PATTERN.source }, uniqueItems: true }, network, execution: closed({ duration: { enum: DURATIONS }, interaction: { enum: INTERACTIONS } }), system_packages: uniqueStrings, min_preset: { enum: PRESETS } }, ["schema_version", "name", "runtimes"]) };
 } });
-var import__2, import_yaml, INBOUND_KEYS, EGRESS_KEYS, ROOT_PATH, NUMERIC_LABEL, validate, isHostName, loadYaml, formatError, semanticIssues, parseManifest, init_manifest = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/manifest.js"() {
+var import__2, import_yaml, INBOUND_KEYS, EGRESS_KEYS, ROOT_PATH, NUMERIC_LABEL, validate, isHostName, loadYaml, formatError, semanticIssues, parseManifest, init_manifest = __esm({ "../../node_modules/@ignitify-integrations/core/dist/manifest.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   import__2 = __toESM(require__(), 1), import_yaml = __toESM(require_dist(), 1);
   init_dist();
@@ -13089,12 +13533,12 @@ var import__2, import_yaml, INBOUND_KEYS, EGRESS_KEYS, ROOT_PATH, NUMERIC_LABEL,
     return issues.length > 0 ? err(issues) : ok(data);
   };
 } });
-var packageName, hasCode, rank, maxOf, union, optional, init_utils2 = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/utils.js"() {
+var packageName, hasCode, rank, maxOf, union, optional, init_utils2 = __esm({ "../../node_modules/@ignitify-integrations/core/dist/utils.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants3();
   packageName = (name) => `${PACKAGE_SCOPE}/${name}`, hasCode = (packageJson) => typeof packageJson == "object" && packageJson !== null && "exports" in packageJson, rank = (order, value) => order.indexOf(value), maxOf = (order, a, b) => rank(order, a) >= rank(order, b) ? a : b, union = (a, b) => [.../* @__PURE__ */ new Set([...a, ...b])], optional = (key, value) => value === void 0 ? {} : { [key]: value };
 } });
-var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes, egressFor, networkFor, presetFor, planAdd, coverageIssues, checkCoverage, init_plan = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/plan.js"() {
+var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, prefixOf, unionRoutes, egressFor, networkFor, presetFor, planAdd, coverageIssues, checkCoverage, init_plan = __esm({ "../../node_modules/@ignitify-integrations/core/dist/plan.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_dist();
   init_constants3();
@@ -13103,7 +13547,7 @@ var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes,
   EXECUTION_FIELDS = ["duration", "interaction"], INBOUND_FIELDS = ["inbound_port", "inbound_max_concurrent"], needsOf = (manifest) => ({ hosts: manifest.network?.egress_allow ?? [], secrets: manifest.secrets ?? [], networkType: manifest.network?.type ?? "none", inbound_port: manifest.network?.inbound_port, inbound_max_concurrent: manifest.network?.inbound_max_concurrent, inboundRoutes: manifest.network?.inbound_routes ?? [], execution: manifest.execution ?? {}, systemPackages: manifest.system_packages ?? [], minPreset: manifest.min_preset }), planHeadline = (manifest, version2, hasCode2) => {
     let packages = manifest.system_packages ?? [];
     return [`${packageName(manifest.name)}@${version2}`, hasCode2 ? PLAN_MESSAGES.settingsAndCode : PLAN_MESSAGES.settingsOnly, ...packages.length > 0 ? [PLAN_MESSAGES.runs(packages)] : []].join(" \xB7 ");
-  }, pick = (field, current, wanted, label) => wanted === void 0 || current === wanted ? { value: current } : current === void 0 ? { value: wanted } : { value: current, conflict: PLAN_MESSAGES.conflict(field, current, wanted, label) }, unionRoutes = (current, wanted) => [...current, ...wanted.filter((route2) => !current.some((have) => have.prefix === route2.prefix))], egressFor = (current, needs, notes) => {
+  }, pick = (field, current, wanted, label) => wanted === void 0 || current === wanted ? { value: current } : current === void 0 ? { value: wanted } : { value: current, conflict: PLAN_MESSAGES.conflict(field, current, wanted, label) }, prefixOf = (route2) => "prefix" in route2 ? route2.prefix : void 0, unionRoutes = (current, wanted) => [...current, ...wanted.filter((route2) => !current.some((have) => prefixOf(have) === route2.prefix))], egressFor = (current, needs, notes) => {
     if (current?.egress_allow !== void 0) return union(current.egress_allow, needs.hosts);
     if ((current?.type ?? "none") !== "none") {
       needs.hosts.length > 0 && notes.push(PLAN_MESSAGES.egressAnywhere(needs.hosts));
@@ -13141,10 +13585,10 @@ var EXECUTION_FIELDS, INBOUND_FIELDS, needsOf, planHeadline, pick, unionRoutes,
     }), ...INBOUND_FIELDS.flatMap((field) => {
       let need = needs[field];
       return need === void 0 || network2?.[field] === need ? [] : [COVERAGE_MESSAGES.fieldMismatch(label, `execution.network.${field}`, network2?.[field], need)];
-    }), ...needs.inboundRoutes.filter((route2) => !routes.some((present) => present.prefix === route2.prefix)).map((route2) => COVERAGE_MESSAGES.routeMissing(label, route2.prefix)), ...needs.systemPackages.filter((name) => !packages.includes(name)).map((name) => COVERAGE_MESSAGES.packageMissing(label, name)), ...needs.minPreset !== void 0 && (preset === void 0 || presetRank >= 0 && presetRank < rank(PRESETS, needs.minPreset)) ? [COVERAGE_MESSAGES.presetTooSmall(label, preset, needs.minPreset)] : []];
+    }), ...needs.inboundRoutes.filter((route2) => !routes.some((present) => prefixOf(present) === route2.prefix)).map((route2) => COVERAGE_MESSAGES.routeMissing(label, route2.prefix)), ...needs.systemPackages.filter((name) => !packages.includes(name)).map((name) => COVERAGE_MESSAGES.packageMissing(label, name)), ...needs.minPreset !== void 0 && (preset === void 0 || presetRank >= 0 && presetRank < rank(PRESETS, needs.minPreset)) ? [COVERAGE_MESSAGES.presetTooSmall(label, preset, needs.minPreset)] : []];
   }, checkCoverage = (config, manifests) => manifests.flatMap((manifest) => coverageIssues(config, packageName(manifest.name), needsOf(manifest)));
 } });
-var init_dist2 = __esm({ "../../../../../../../../../Users/saeed/Projects/repos/mitra/apps/cli/node_modules/@ignitify-integrations/core/dist/index.js"() {
+var init_dist2 = __esm({ "../../node_modules/@ignitify-integrations/core/dist/index.js"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants3();
   init_manifest();
@@ -13167,23 +13611,29 @@ function diffLines(before, after, path12 = []) {
   return [...newScalars.length > 0 ? [`+ ${here}: ${newScalars.join(", ")}`] : [], ...nested];
 }
 function planIntegrationAdd(config, manifest, version2, hasCode2) {
-  let before = asCoreConfig(config), headline = planHeadline(manifest, version2, hasCode2), outcome = planAdd(before, manifest);
+  let headline = planHeadline(manifest, version2, hasCode2), outcome = planAdd(config, manifest);
   if (!outcome.ok) return { ok: false, headline, refusals: outcome.error };
   let after = outcome.value.config;
-  return { ok: true, headline, changes: [...outcome.value.notes, ...diffLines(before, after)], youAdd: outcome.value.youAdd, config: after, changed: !(0, import_node_util.isDeepStrictEqual)(before, after) };
+  return { ok: true, headline, changes: [...outcome.value.notes, ...diffLines(config, after)], youAdd: outcome.value.youAdd, config: after, changed: !(0, import_node_util.isDeepStrictEqual)(config, after) };
 }
 function renderAddPlan(plan) {
   return [plan.headline, ...plan.changes.map((line) => `  ${line}`), ...plan.youAdd.length > 0 ? [INTEGRATION.YOU_ADD, ...plan.youAdd.map((line) => `  ${line}`)] : []];
 }
-var import_node_util, asCoreConfig, itemText, init_integration_plan = __esm({ "src/core/integration-plan.ts"() {
+var import_node_util, itemText, init_integration_plan = __esm({ "src/core/integration-plan.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   import_node_util = require("node:util");
   init_dist2();
   init_tenant();
   init_constants();
-  asCoreConfig = (config) => config, itemText = (item) => isRecord(item) && typeof item.prefix == "string" ? item.prefix : typeof item == "string" ? item : JSON.stringify(item);
+  itemText = (item) => isRecord(item) && typeof item.prefix == "string" ? item.prefix : isRecord(item) && typeof item.path == "string" ? item.path : typeof item == "string" ? item : JSON.stringify(item);
 } });
+function assessIntegrations(installed, config) {
+  let missing = installed.filter((entry) => entry.read.kind === "missing").map((entry) => entry.pkg);
+  if (missing.length > 0) return { ok: false, missing };
+  let integrations = installed.flatMap(({ pkg, read }) => read.kind === "installed" ? [{ pkg, version: read.version, manifest: parseManifest(read.manifestText) }] : []), manifests = integrations.flatMap(({ manifest }) => manifest.ok ? [manifest.value] : []);
+  return { ok: true, errors: [...integrations.flatMap(({ pkg, manifest }) => manifest.ok ? [] : manifest.error.map((issue) => INTEGRATION.BAD_MANIFEST(pkg, issue))), ...checkCoverage(config, manifests)], versions: integrations.map(({ pkg, version: version2 }) => ({ pkg, version: version2 })) };
+}
 function integrationDeps(packageJson) {
   let deps = packageJson?.dependencies;
   return typeof deps != "object" || deps === null ? [] : Object.keys(deps).filter((name) => name.startsWith(`${PACKAGE_SCOPE}/`));
@@ -13305,9 +13755,10 @@ async function runIntegrationAdd(args, cwd = process.cwd(), deps = REAL_INTEGRAT
   let task = await prepareTask(args, cwd, slug2);
   if (!task) return 1;
   if (printWarnings([...task.warnings]), task.config.runtime !== INTEGRATION.RUNTIME) return fail(INTEGRATION.NOT_NODE(task.config.runtime)), 1;
-  if (readTaskPackageJson(task.taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(task.taskDir)), 1;
+  let taskDir = import_node_fs9.default.realpathSync(task.taskDir);
+  if (readTaskPackageJson(taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(task.taskDir)), 1;
   let pkg = packageName(name);
-  return guard(() => withPackDir((packDir) => addIntegration(args, task.taskDir, task.config, pkg, packDir, dryRun, deps)));
+  return guard(() => withPackDir((packDir) => addIntegration(args, taskDir, task.config, pkg, packDir, dryRun, deps)));
 }
 async function withPackDir(fn) {
   let packDir = import_node_fs9.default.mkdtempSync(import_node_path8.default.join(import_node_os3.default.tmpdir(), INTEGRATION.PACK_TMP_PREFIX));
@@ -13350,15 +13801,8 @@ function taskConfigEdit(taskDir, config, planned) {
 async function checkIntegrations(taskDir, config, fetchImpl) {
   let pkgs = integrationDeps(readTaskPackageJson(taskDir));
   if (pkgs.length === 0) return true;
-  let installed = pkgs.map((pkg) => ({ pkg, read: readInstalledPackage(taskDir, pkg) })), missing = installed.filter((entry) => entry.read.kind === "missing").map((entry) => entry.pkg);
-  if (missing.length > 0) return fail(INTEGRATION.NOT_INSTALLED(missing)), false;
-  let manifests = [], errors = [], versions = [];
-  for (let { pkg, read } of installed) {
-    if (read.kind !== "installed") continue;
-    let manifest = parseManifest(read.manifestText);
-    manifest.ok ? manifests.push(manifest.value) : errors.push(...manifest.error.map((issue) => INTEGRATION.BAD_MANIFEST(pkg, issue))), versions.push({ pkg, version: read.version });
-  }
-  return await warnObsolete(versions, fetchImpl), errors.push(...checkCoverage(asCoreConfig(config), manifests)), printErrors(errors), errors.length === 0;
+  let installed = pkgs.map((pkg) => ({ pkg, read: readInstalledPackage(taskDir, pkg) })), assessed = assessIntegrations(installed, config);
+  return assessed.ok ? (await warnObsolete(assessed.versions, fetchImpl), printErrors(assessed.errors), assessed.errors.length === 0) : (fail(INTEGRATION.NOT_INSTALLED(assessed.missing)), false);
 }
 async function warnObsolete(versions, fetchImpl) {
   let lookups = await Promise.all(versions.map(async (entry) => ({ ...entry, lookup: await fetchPackument(entry.pkg, fetchImpl) }))), skipped = /* @__PURE__ */ new Set();
@@ -13394,7 +13838,7 @@ async function printPackageAdvice(args, config, fetchImpl) {
   let plan = planAdvice(config);
   if (plan.kind === "skip") return say(ADVICE.SKIPPED(plan.reason));
   try {
-    let outcome = await postPackageAdvice(apiConfig(args), plan.request, fetchImpl), { lines, fault } = renderAdvice(outcome, screenStyle());
+    let outcome = await postPackageAdvice(apiConfig(), plan.request, fetchImpl), { lines, fault } = renderAdvice(outcome, screenStyle());
     for (let line of lines) (fault ? tell : say)(line);
   } catch (e) {
     fail(errText(e));
@@ -13407,12 +13851,12 @@ async function runTaskValidate(args, cwd = process.cwd(), fetchImpl) {
 async function runTaskGet(args, cwd = process.cwd()) {
   let task = await prepareTask(args, cwd);
   if (!task) return 1;
-  let { slug: slug2 } = task, state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(args), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
+  let { slug: slug2 } = task, state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
   return emit(snakeCaseKeys(report), () => formatTaskReport(report)), 0;
 }
-function offlineTolerantConfig(args) {
+function offlineTolerantConfig() {
   try {
-    return apiConfig(args);
+    return apiConfig();
   } catch (e) {
     return warn(RESULT_MESSAGES.TASK_GET_OFFLINE(errText(e))), null;
   }
@@ -13430,8 +13874,8 @@ async function runTaskPack(args, cwd = process.cwd()) {
   return CliOutputManager.render("task:pack", { task_id: config.slug, files: entries.map((e) => ({ path: e.path, size: e.size })), total_bytes: totalBytes, ignored, content_hash: contentHash }), 0;
 }
 async function runTaskDeploy(args, cwd = process.cwd()) {
-  let taskDir = getTaskDir(args, cwd);
-  if (!taskDir) return 1;
+  let taskDir = getTaskDir(args, cwd), { taskId, dirFlag } = getTaskPath(args, cwd);
+  if (!taskDir || !taskId) return 1;
   let prep = args.options.check ? checkSourceUpload(taskDir) : prepareSourceUpload(taskDir);
   if (printWarnings([...prep.warnings]), !prep.ok) return printErrors([...prep.errors]), 1;
   let left = "upload" in prep ? prep.upload.ignored : prep.source.ignored;
@@ -13440,9 +13884,9 @@ async function runTaskDeploy(args, cwd = process.cwd()) {
     return emit({ task_id: config.slug, valid: true, total_bytes: totalBytes, content_hash: contentHash }, (st) => successLine(st, VALIDATE.VALID)), 0;
   }
   let state = readState(taskDir);
-  if (!state.task_id) return fail("task_id not found in .ignitify/state.json \u2014 run `ignitify task:create <task-id>` first"), 1;
+  if (!state.task_id) return fail(MESSAGES.TASK_NOT_REGISTERED(taskId, dirFlag)), 1;
   let { upload } = prep;
-  return uploadAndWait(apiConfig(args), taskDir, state.task_id, upload.manifest, upload.tar, upload.slug);
+  return uploadAndWait(apiConfig(), taskDir, state.task_id, upload.manifest, upload.tar, upload.slug);
 }
 async function uploadAndWait(cfg, taskDir, taskId, manifest, tar, slug2) {
   let progress = startProgress(WAIT.UPLOADING(slug2, formatBytes(tar.length))), res, whoami;
@@ -13461,7 +13905,7 @@ async function runTaskRun(args, cwd = process.cwd()) {
   printWarnings([...task.warnings]);
   let opts = parseRunOptions(args, task.config);
   if (!opts.ok) return fail(opts.error), 1;
-  let { run: run2 } = opts, taskName = task.slug, cfg = apiConfig(args);
+  let { run: run2 } = opts, taskName = task.slug, cfg = apiConfig();
   if (payloadBytes(run2.payload) > PAYLOAD_LIMIT_FALLBACK_BYTES) {
     let refusal = payloadRefusal(run2.payload, await payloadLimit(cfg));
     if (refusal !== null) return fail(refusal), 1;
@@ -13474,32 +13918,47 @@ async function runTaskRun(args, cwd = process.cwd()) {
     if (refusal !== null) return fail(refusal), 1;
   }
   return resolved.source === "server" && say(`Using deployment ${deploymentId} (resolved from the server \u2014 no local state).`), await guard(async () => {
-    let res;
+    let posted;
     try {
-      res = await postRun(cfg, { deploymentId, taskName, ...run2 });
+      posted = await postRun(cfg, { deploymentId, taskName, ...run2 });
     } catch (e) {
       if (isJsonOutput()) throw e;
       let trace = traceLine(e);
       if (isPayloadTooLarge(e)) return fail(MESSAGES.PAYLOAD_REFUSED_BY_SERVER(await payloadLimit(cfg)), { trace }), 1;
+      let keyed = run2.idempotencyKey === void 0 ? null : idempotencyRefusal(e);
+      if (keyed) return fail(keyed.error, { hint: keyed.hint, trace }), 1;
       let explained = explainRunRefusal(e) ?? explainLimitRefusal(e);
       if (!explained) throw e;
       return tell(explained), trace !== null && tell(errStyle().dim(trace)), 1;
     }
-    if (run2.at !== void 0) {
-      if (!res.schedule_id) return fail(res.run_id ? `this server does not support scheduling \u2014 it IGNORED --at and ran the job NOW (run ${res.run_id}). Cancel it with 'ignitify run:cancel ${res.run_id}' if that is not what you wanted.` : "this server does not support scheduling (no schedule_id in the response)."), 1;
-      if (isJsonOutput()) return emit(res), 0;
-      let st = outStyle();
-      out(successLine(st, `Scheduled: ${res.schedule_id} fires at ${res.fires_at ?? run2.at}`)), out(st.dim(`No run exists until it fires. List with 'ignitify schedule:list'; cancel with 'ignitify schedule:cancel ${res.schedule_id}'.`));
-      let scheduledNotices = renderRunNotices(res.notices);
-      scheduledNotices && out(st.yellow(scheduledNotices));
-      let capacity2 = renderCapacity(res.capacity, st);
-      return capacity2 && out(capacity2), 0;
-    }
-    if (!opts.wait || !res.run_id) return CliOutputManager.render("task:run", { ...res }), 0;
-    let notices = isJsonOutput() ? "" : renderRunNotices(res.notices);
-    notices && out(outStyle().yellow(notices));
-    let capacity = isJsonOutput() ? "" : renderCapacity(res.capacity, outStyle());
-    return capacity && out(capacity), waitForRun(cfg, res.run_id);
+    let res = posted.answer;
+    posted.replayed && warn(MESSAGES.RUN_REPLAYED);
+    let answer = classifyRunAnswer(res, run2.at, opts.wait);
+    switch (answer.kind) {
+      case "skew-ran-now":
+        return fail(`this server does not support scheduling \u2014 it IGNORED --at and ran the job NOW (run ${answer.runId}). Cancel it with 'ignitify run:cancel ${answer.runId}' if that is not what you wanted.`), 1;
+      case "skew-no-schedule":
+        return fail("this server does not support scheduling (no schedule_id in the response)."), 1;
+      case "scheduled": {
+        if (isJsonOutput()) return emit(res), 0;
+        let st = outStyle();
+        out(successLine(st, `Scheduled: ${answer.scheduleId} fires at ${answer.firesAt}`)), out(st.dim(`No run exists until it fires. List with 'ignitify schedule:list'; cancel with 'ignitify schedule:cancel ${answer.scheduleId}'.`));
+        let scheduledNotices = renderRunNotices(res.notices);
+        scheduledNotices && out(st.yellow(scheduledNotices));
+        let capacity = renderCapacity(res.capacity, st);
+        return capacity && out(capacity), 0;
+      }
+      case "submitted":
+        return CliOutputManager.render("task:run", { ...res }), 0;
+      case "wait": {
+        let notices = isJsonOutput() ? "" : renderRunNotices(res.notices);
+        notices && out(outStyle().yellow(notices));
+        let capacity = isJsonOutput() ? "" : renderCapacity(res.capacity, outStyle());
+        return capacity && out(capacity), waitForRun(cfg, answer.runId);
+      }
+      default:
+        return answer;
+    }
   });
 }
 async function runTaskCreate(args, cwd = process.cwd()) {
@@ -13515,7 +13974,7 @@ async function runTaskCreate(args, cwd = process.cwd()) {
     return err2 ? (fail(err2), 1) : (emit({ slug: taskId, runtime: lang, local_dir: taskDir, registered: false }, (st) => successLine(st, RESULT_MESSAGES.TASK_CREATED_LOCAL(lang, taskId, taskDir))), say(screenStyle().dim(limitsNote())), 0);
   }
   return guard(async () => {
-    let cfg = apiConfig(args), res = await createTask(cfg, taskId);
+    let cfg = apiConfig(), res = await createTask(cfg, taskId);
     writeState(taskDir, { task_id: res.task_id, task_resource_id: res.resource_id });
     let local_dir;
     if (!args.options["no-scaffold"]) {
@@ -13532,11 +13991,11 @@ async function runTaskDelete(args, cwd = process.cwd(), prompter = ttyPrompter)
   let id = requiredArg(args);
   if (!id) return fail(MESSAGES.TASK_ID_REQUIRED), 1;
   let plan = await guardValue(async () => {
-    let baseDir = tasksBaseDir(args, cwd), cfg = apiConfig(args), { taskId, runs, deploymentCount, runCount } = await surveyTaskContents(cfg, id), folders = readTaskFolders(baseDir);
+    let baseDir = tasksBaseDir(args, cwd), cfg = apiConfig(), { taskId, runs, deploymentCount, runCount } = await surveyTaskContents(cfg, id), folders = readTaskFolders(baseDir);
     return planTaskDeletion({ taskSlug: id, taskId, runs, deploymentCount, runCount, folders });
   });
   return plan === void 0 || (printDeletionPlan(plan), !await confirmOrAbort(args, prompter)) ? 1 : guard(async () => {
-    let cfg = apiConfig(args), d = (await deleteTask(cfg, id)).deleted;
+    let cfg = apiConfig(), d = (await deleteTask(cfg, id)).deleted;
     d ? sayOk(`${MESSAGES.TASK_DELETED}: ${d.task_id} (${deletedCounts([["deployments", d.deployments], ["runs", d.runs], ["vms", d.vms], ["forfeited pins", d.forfeited_pins]])})`) : sayOk(MESSAGES.TASK_DELETED);
     for (let dir of plan.unlinkDirs) {
       let link = taskLinkPath(dir);
@@ -13558,6 +14017,7 @@ var import_fs4, TASK_REPORT_PAGE, init_task = __esm({ "src/commands/task.ts"() {
   init_plan_task_delete();
   init_resolve_deployment();
   init_run_options();
+  init_run_answer();
   init_state();
   init_constants();
   init_payload_limit();
@@ -13581,18 +14041,18 @@ function runDeploymentList(args) {
 async function runDeploymentGet(args) {
   let id = requireArg(args, "deployment-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("deployment:get", await getApiDeployment(cfg, id)), 0;
   }) : 1;
 }
 async function runDeploymentLogs(args) {
   let id = requireArg(args, "deployment-id");
-  return id ? guard(async () => (printConsoleLog(await getApiDeploymentLogs(apiConfig(args), id), boolFlag(args, "raw")), 0)) : 1;
+  return id ? guard(async () => (printConsoleLog(await getApiDeploymentLogs(apiConfig(), id), boolFlag(args, "raw")), 0)) : 1;
 }
 async function runDeploymentDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "deployment-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (say(RESULT_MESSAGES.DEPLOYMENT_DELETE_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await deleteDeployment(cfg, id);
     emit(res);
@@ -13621,27 +14081,122 @@ var WHOLE_MS, init_grace = __esm({ "src/core/grace.ts"() {
   init_constants();
   WHOLE_MS = /^\d+$/;
 } });
+async function readWithRetry(read, clock) {
+  let wait = true, end = await pollUntil({ fetch: async () => replyOrThrow(await read(wait)), decideError: (e, failures, failingForMs) => e instanceof FollowReadError ? decideFollowError(e.error, e.retryAfterMs, failures, failingForMs) : { kind: "give-up" }, onRetry: (e) => {
+    e instanceof FollowReadError && isWaitRefused(e.error) && (wait = false);
+  }, decide: () => ({ kind: "read" }), clock });
+  if (!isLost(end)) return { ok: true, data: end.view };
+  let error = end.error instanceof FollowReadError ? end.error.error : end.error, stop = followStopOf(error);
+  return { ok: false, failure: stop === "agent-outdated" ? { kind: stop } : { kind: stop, error } };
+}
+async function readBusyRetried(read, clock, onRetry = () => {
+}) {
+  let end = await pollUntil({ fetch: async () => replyOrThrow(await read()), decideError: (e, failures, failingForMs) => e instanceof FollowReadError ? decideBusyReadError(e.error, e.retryAfterMs, failures, failingForMs) : { kind: "give-up" }, onRetry: (_e, delayMs) => onRetry(delayMs), decide: () => ({ kind: "read" }), clock });
+  if (!isLost(end)) return end.view;
+  throw end.error instanceof FollowReadError ? end.error.error : end.error;
+}
+async function readTimeline(loop) {
+  let cursor = null;
+  for (; ; ) {
+    let held = cursor, startedAt = loop.clock.now(), read = await readWithRetry((wait) => loop.read(held, loop.follow && wait), loop.clock);
+    if (!read.ok) return { ok: false, failure: read.failure };
+    if (loop.onPage(read.data), cursor = nextCursor(held, read.data), timelineDone(read.data, loop.follow, held)) return { ok: true, last: read.data };
+    if (loop.follow && read.data.events.length === 0) {
+      let rest = idleRestMs(startedAt, loop.clock.now());
+      rest > 0 && await loop.clock.sleep(rest);
+    }
+  }
+}
+async function readOutput(loop) {
+  let offset = 0, held = loop.tail === null ? null : "", runId = "", checkRun = loop.follow, endedAt = null;
+  for (; ; ) {
+    if (checkRun && endedAt === null) {
+      let run2 = await readWithRetry(loop.readRun, loop.clock);
+      if (!run2.ok) return { ok: false, failure: run2.failure };
+      isTerminalRunStatus(run2.data.status) && (endedAt = loop.clock.now());
+    }
+    let from = offset, readAt = loop.clock.now(), read = await readWithRetry(() => loop.readPage(from), loop.clock);
+    if (!read.ok && !(loop.follow && read.failure.kind === "not-started")) return { ok: false, failure: read.failure };
+    let placed = read.ok ? placeOutputPage(from, read.data) : { kind: "page", bytes: "", nextOffset: from, full: false };
+    if (placed.kind === "no-cursor") return { ok: false, failure: { kind: "no-cursor" } };
+    if (read.ok && (runId = read.data.run_id), offset = placed.nextOffset, held !== null && loop.tail !== null ? (held = lastLines(held + placed.bytes, loop.tail), placed.full || (held !== "" && loop.onChunk({ runId, bytes: held, nextOffset: offset }), held = null)) : placed.bytes !== "" && loop.onChunk({ runId, bytes: placed.bytes, nextOffset: offset }), !loop.follow) {
+      if (placed.full) continue;
+      return { ok: true };
+    }
+    let step = decideOutputStep(placed, endedAt, readAt);
+    if (step === "stop") return { ok: true };
+    checkRun = step === "wait", step === "wait" && await loop.clock.sleep(FOLLOW.IDLE_MS);
+  }
+}
+var init_run_follow = __esm({ "src/commands/run-follow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_follow();
+  init_poll();
+} });
 function runRunList(args) {
-  return runPagedList(args, { list: { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, fetchPage: listApiRuns, rowsOf: (data) => data.runs, show: (data) => CliOutputManager.render("run:list", data.runs) });
+  return runPagedList(args, { list: { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, fetchPage: (cfg, params) => readBusyRetried(() => readRunList(cfg, params), REAL_CLOCK, noteBusyRetry), rowsOf: (data) => data.runs, show: (data) => CliOutputManager.render("run:list", data.runs) });
 }
 async function runRunGet(args) {
   let id = requireArg(args, "run-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args), data = await getApiRun(cfg, id);
+    let cfg = apiConfig(), data = await readBusyRetried(() => readRunForFollow(cfg, id), REAL_CLOCK, noteBusyRetry);
     return boolFlag(args, "full") ? out(JSON.stringify(data, null, 2)) : CliOutputManager.render("run:get", data), 0;
   }) : 1;
 }
 async function runRunLogs(args) {
   let id = requireArg(args, "run-id");
-  return id ? guard(async () => {
-    let cfg = apiConfig(args);
-    return printConsoleLog(await getApiRunLogs(cfg, id), boolFlag(args, "raw")), 0;
-  }) : 1;
+  if (!id) return 1;
+  let follow = boolFlag(args, "follow"), raw = boolFlag(args, "raw");
+  return guard(async () => {
+    let tailRaw = strOpt(args, "tail"), tail = tailRaw === void 0 ? null : parseWholeCount(tailRaw);
+    if (tailRaw !== void 0 && tail === null) return fail(FOLLOW_MESSAGES.TAIL_INVALID(tailRaw)), 1;
+    let cfg = apiConfig(), json2 = isJsonOutput();
+    if (!follow && tail === null) return printConsoleLog(await getApiRunLogs(cfg, id), raw), 0;
+    let colour = outStyle().colour, read = () => readOutput({ readPage: (fromOffset) => readRunOutput(cfg, id, fromOffset), readRun: () => readRunForFollow(cfg, id), onChunk: (chunk) => json2 ? out(JSON.stringify(outputDocument(chunk))) : writeRaw(consoleLogText(chunk.bytes, { raw, colour })), follow, tail, clock: REAL_CLOCK }), end = follow ? await withInterruptNotice(NO_PROGRESS, () => FOLLOW_MESSAGES.INTERRUPTED(id), read) : await read();
+    return end.ok ? 0 : failFollow(end.failure);
+  });
+}
+function failFollow(failure) {
+  if (failure.kind === "agent-outdated") fail(FOLLOW_MESSAGES.AGENT_OUTDATED);
+  else if (failure.kind === "no-cursor") fail(FOLLOW_MESSAGES.API_NO_CURSOR);
+  else throw failure.error;
+  return 1;
+}
+async function runRunTimeline(args) {
+  let id = requireArg(args, "run-id");
+  if (!id) return 1;
+  let follow = boolFlag(args, "follow");
+  return guard(async () => {
+    let cfg = apiConfig(), json2 = isJsonOutput(), events = [], printedTail = /* @__PURE__ */ new Set(), onPage = (page) => {
+      if (json2 && follow) (page.events.length > 0 || page.complete) && out(JSON.stringify(page));
+      else if (json2) events.push(...page.events);
+      else {
+        let next = eventsToPrint(page, printedTail);
+        printedTail = next.printedTail;
+        for (let event of next.print) out(timelineLine(event));
+      }
+    }, read = () => readTimeline({ read: (cursor, wait) => readRunTimeline(cfg, id, { cursor, waitSec: wait ? FOLLOW.WAIT_SEC : void 0 }), onPage, follow, clock: REAL_CLOCK }), end = follow ? await withInterruptNotice(NO_PROGRESS, () => FOLLOW_MESSAGES.INTERRUPTED(id), read) : await read();
+    if (!end.ok) return failFollow(end.failure);
+    let { run: run2 } = end.last;
+    json2 && !follow && emit({ ...end.last, events });
+    let ended = isTerminalRunStatus(run2.status), status = terminalSafe(run2.status, false);
+    return json2 || out(ended ? WAIT.RUN_ENDED(status) : FOLLOW_MESSAGES.STILL_LIVE(status)), !ended || run2.status === RUN_STATUS.COMPLETED ? 0 : 1;
+  });
+}
+async function runRunFailures(args) {
+  return guard(async () => {
+    let days = daysOption(args);
+    if (!days.ok) return 1;
+    let report = await getRunFailures(apiConfig(), days.days);
+    return emit(report, (st) => renderFailures(st, report)), 0;
+  });
 }
 async function runRunDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "run-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return say(RESULT_MESSAGES.RUN_DELETE_PREVIEW(id)), await confirmOrAbort(args, prompter) ? (emit(await deleteRun(cfg, id)), sayOk(`${MESSAGES.RUN_DELETED}: ${id}`), 0) : 1;
   }) : 1;
 }
@@ -13652,7 +14207,10 @@ async function runRunCancel(args, prompter = ttyPrompter) {
   return guard(async () => {
     let grace = parseGraceMs(strOpt(args, "grace"), force);
     if (!grace.ok) return fail(grace.error), 1;
-    let graceMs = grace.graceMs, cfg = apiConfig(args), run2 = await getApiRun(cfg, id);
+    let graceMs = grace.graceMs, cfg = apiConfig(), run2 = await getApiRun(cfg, id).catch((e) => {
+      if (isTransientError(e)) return null;
+      throw e;
+    });
     if (run2?.status && isTerminalRunStatus(run2.status)) return emit({ run_id: id, outcome: RUN_CANCEL_OUTCOME.ALREADY_TERMINAL, status: run2.status }), say(RESULT_MESSAGES.RUN_ALREADY_OVER(id, run2.status)), 0;
     if (say(RESULT_MESSAGES.RUN_CANCEL_PREVIEW(id, force)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await cancelApiRun(cfg, id, force, graceMs);
@@ -13665,7 +14223,7 @@ async function runRunCancel(args, prompter = ttyPrompter) {
     return sayOk(RESULT_MESSAGES.RUN_CANCELLED(id, was)), 0;
   });
 }
-var init_run = __esm({ "src/commands/run.ts"() {
+var noteBusyRetry, outputDocument, init_run = __esm({ "src/commands/run.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_prompt();
@@ -13674,7 +14232,15 @@ var init_run = __esm({ "src/commands/run.ts"() {
   init_utils();
   init_output();
   init_grace();
+  init_follow();
+  init_poll();
   init_shared();
+  init_run_follow();
+  noteBusyRetry = (delayMs) => {
+    tell(BUSY_READ.NOTE(Math.ceil(delayMs / MS_PER_SECOND)));
+  };
+  outputDocument = (chunk) => ({ run_id: chunk.runId, bytes: chunk.bytes, lines: chunk.bytes.split(`
+`).length - 1, truncated: false, next_offset: chunk.nextOffset });
 } });
 function decideVmDelete(vm, force, vmId) {
   if (vm.residency === "pinned" && !force) {
@@ -13696,7 +14262,7 @@ function runVmList(args) {
 async function runVmGet(args) {
   let id = requireArg(args, "vm-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args), data = await getApiVm(cfg, id);
+    let cfg = apiConfig(), data = await getApiVm(cfg, id);
     return CliOutputManager.render("vm:get", { ...data }), 0;
   }) : 1;
 }
@@ -13705,7 +14271,7 @@ async function runVmDelete(args, prompter = ttyPrompter) {
   if (!id) return 1;
   let force = boolFlag(args, "force");
   return guard(async () => {
-    let cfg = apiConfig(args), vm = await getApiVm(cfg, id), decision = decideVmDelete(vm, force, id);
+    let cfg = apiConfig(), vm = await getApiVm(cfg, id), decision = decideVmDelete(vm, force, id);
     if (decision.refuse) return fail(decision.message), 1;
     if (say(decision.notice), !await confirmOrAbort(args, prompter)) return 1;
     let res = await deleteVm(cfg, id, force);
@@ -13733,20 +14299,20 @@ async function runSecretSet(args) {
   if (args.options.stdin !== true) return tell(MESSAGES.SECRET_SET_USAGE), 1;
   let value = import_fs5.default.readFileSync(0, "utf8").replace(/\n$/, "");
   return value === "" ? (fail(MESSAGES.SECRET_VALUE_EMPTY), 1) : guard(async () => {
-    let cfg = apiConfig(args), res = await setSecret(cfg, name, value);
+    let cfg = apiConfig(), res = await setSecret(cfg, name, value);
     return emit(res), sayOk(MESSAGES.SECRET_STORED(name)), 0;
   });
 }
 async function runSecretList(args) {
   return guard(async () => {
-    let cfg = apiConfig(args), data = await listSecrets(cfg);
+    let cfg = apiConfig(), data = await listSecrets(cfg);
     return emit(data, (st) => data.secrets.length === 0 ? emptyState(st, RESULT_MESSAGES.NO_SECRETS, RESULT_MESSAGES.NO_SECRETS_NEXT) : renderTable(st, [{ header: "name", keep: true }, { header: "updated_at", keep: true }], data.secrets.map((x) => [x.name, x.updated_at]))), 0;
   });
 }
 async function runSecretDelete(args, prompter = ttyPrompter) {
   let name = args.positionals[0];
   return name ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (tell(RESULT_MESSAGES.SECRET_DELETE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await rmSecret(cfg, name);
     return emit(res), sayOk(MESSAGES.SECRET_REMOVED(name)), 0;
@@ -13766,14 +14332,14 @@ var import_fs5, secretValueOnArgv, init_secret = __esm({ "src/commands/secret.ts
 } });
 async function runScheduleList(args) {
   return guard(async () => {
-    let cfg = apiConfig(args), res = await listSchedules(cfg);
+    let cfg = apiConfig(), res = await listSchedules(cfg);
     return CliOutputManager.render("schedule:list", res.schedules.map((row) => ({ ...row }))), 0;
   });
 }
 async function runScheduleCancel(args, prompter = ttyPrompter) {
   let id = requireArg(args, "schedule-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (say(RESULT_MESSAGES.SCHEDULE_CANCEL_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     try {
       await deleteSchedule(cfg, id);
@@ -13794,12 +14360,37 @@ var init_schedule = __esm({ "src/commands/schedule.ts"() {
   init_output();
   init_shared();
 } });
+function notificationView(unread, open) {
+  return unread && open ? null : unread ? "unread" : open ? "open" : "all";
+}
+function notificationMoreNote(rawLimit) {
+  return (rawLimit === void 0 ? NOTIFICATION_PAGE_DEFAULT : Number(rawLimit)) < NOTIFICATION_PAGE_MAX ? MESSAGES.NOTIFICATION_MORE(NOTIFICATION_PAGE_MAX) : MESSAGES.NOTIFICATION_MORE_IN_APP;
+}
+async function runNotificationList(args) {
+  let view = notificationView(boolFlag(args, "unread"), boolFlag(args, "open"));
+  if (view === null) return fail(MESSAGES.NOTIFICATION_ONE_VIEW), 1;
+  let badLimit = limitRefusal(args);
+  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
+    let page = await listNotifications(apiConfig(), { ...flagParams(args, NOTIFICATION_LIST_FLAG_PARAMS), [NOTIFICATION_QUERY.FILTER]: view });
+    return emit(page, (st) => renderNotifications(st, page)), page.next_cursor !== null && warn(notificationMoreNote(strOpt(args, "limit"))), 0;
+  });
+}
+var init_notification = __esm({ "src/commands/notification.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_api();
+  init_utils();
+  init_output();
+  init_constants();
+  init_shared();
+} });
 function withAbsoluteUrl(created, baseUrl) {
   let { url } = created;
   return typeof url != "string" || !url.startsWith("/") ? created : { ...created, url: `${baseUrl.replace(/\/+$/, "")}${url}` };
 }
 function renderHookCreated(st, created) {
-  let { secret, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
+  let { secret, secret_redacted: _redacted, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
   return `
 ${heading(st, RESULT_MESSAGES.HOOK_CREATED_TITLE, true)}
 ${renderFields(st, rows, void 0, paint2)}
@@ -13810,8 +14401,8 @@ async function runHookCreate(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_CREATE_USAGE), 1;
   let taskName = args.options["task-name"];
   return typeof taskName != "string" || taskName.trim() === "" ? (fail(MESSAGES.HOOK_TASK_NAME_REQUIRED), 1) : guard(async () => {
-    let cfg = apiConfig(args), created = withAbsoluteUrl(await createHook(cfg, deploymentId, { task_name: taskName }), cfg.baseUrl);
-    return warn(MESSAGES.HOOK_SECRET_SHOWN_ONCE), tell(MESSAGES.HOOK_PAYLOAD_LIMIT(formatLimit(await payloadLimit(cfg)))), emit(created, (st) => renderHookCreated(st, created)), 0;
+    let cfg = apiConfig(), created = withAbsoluteUrl(await createHook(cfg, deploymentId, { task_name: taskName }), cfg.baseUrl);
+    return created.secret === null ? (fail(MESSAGES.HOOK_SECRET_REDACTED(created.resource_id)), emit(created), 1) : (warn(MESSAGES.HOOK_SECRET_SHOWN_ONCE), tell(MESSAGES.HOOK_PAYLOAD_LIMIT(formatLimit(await payloadLimit(cfg)))), emit(created, (st) => renderHookCreated(st, created)), 0);
   });
 }
 async function runHookList(args) {
@@ -13819,14 +14410,14 @@ async function runHookList(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_LIST_USAGE), 1;
   let badLimit = limitRefusal(args);
   return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), res = await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS)), hooks = Array.isArray(res.hooks) ? res.hooks : [];
+    let cfg = apiConfig(), res = await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS)), hooks = Array.isArray(res.hooks) ? res.hooks : [];
     return emit(res, (st) => renderList(hooks.map((h) => ({ ...h })), st, EMPTY_LISTS.HOOKS)), noteNextPage(args, { command: COMMANDS.HOOK_LIST, flags: PAGE_FLAG_PARAMS }, hooks), 0;
   });
 }
 async function runHookDelete(args, prompter = ttyPrompter) {
   let hookId = args.positionals[0];
   return hookId ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return tell(RESULT_MESSAGES.HOOK_DELETE_PREVIEW(hookId)), await confirmOrAbort(args, prompter) ? (emit(await deleteHook(cfg, hookId)), sayOk(RESULT_MESSAGES.HOOK_DELETED(hookId)), 0) : 1;
   }) : (tell(MESSAGES.HOOK_DELETE_USAGE), 1);
 }
@@ -13838,7 +14429,7 @@ async function runNotifySet(args) {
   if (refusal !== null) return refuseNotifySet(refusal);
   let secret = args.options["secret-stdin"] === true ? import_fs6.default.readFileSync(0, "utf8").replace(/\n$/, "") : void 0;
   return secret === "" ? refuseNotifySet(MESSAGES.NOTIFY_SECRET_EMPTY) : guard(async () => {
-    let cfg = apiConfig(args), target = clear || typeof url != "string" ? null : url;
+    let cfg = apiConfig(), target = clear || typeof url != "string" ? null : url;
     return emit(await setNotify(cfg, deploymentId, { url: target, ...secret !== void 0 ? { secret } : {} })), sayOk(target === null ? RESULT_MESSAGES.NOTIFY_CLEARED(deploymentId) : RESULT_MESSAGES.NOTIFY_SET(deploymentId, target)), 0;
   });
 }
@@ -13861,6 +14452,198 @@ var import_fs6, init_hook = __esm({ "src/commands/hook.ts"() {
   init_shared();
   init_output();
 } });
+async function runPermissionList(_args) {
+  let permissions = permissionRows();
+  return emit({ permissions }, (st) => renderPermissions(st, permissions)), 0;
+}
+var init_permission = __esm({ "src/commands/permission.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_access();
+  init_output();
+} });
+async function runUserCreate(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let created = await createUser(apiConfig(), name);
+    return emit(created, (st) => renderFields(st, { ...created })), sayOk(MESSAGES.USER_CREATED(created.name)), 0;
+  });
+}
+async function runUserList(_args) {
+  return guard(async () => {
+    let data = await listUsers(apiConfig());
+    return emit(data, (st) => renderUsers(st, data.users)), 0;
+  });
+}
+async function runUserGet(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let user = await getUser(apiConfig(), name);
+    return emit(user, (st) => renderUser(st, user)), 0;
+  });
+}
+async function runUserRemove(args, prompter = ttyPrompter) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.USER_REMOVE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteUser(cfg, name);
+    return emit(res), sayOk(MESSAGES.USER_REMOVED(res.removed, res.revoked_keys.length)), 0;
+  });
+}
+var init_user = __esm({ "src/commands/user.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api();
+  init_prompt();
+  init_constants();
+  init_utils();
+  init_output();
+  init_shared();
+} });
+async function groupWrite(write, done) {
+  return guard(async () => {
+    let group = await write(apiConfig());
+    return emit(group, (st) => renderGroup(st, group)), sayOk(done), 0;
+  });
+}
+function permissionArg(raw) {
+  if (raw === void 0 || raw === "") return fail(MESSAGES.ARG_REQUIRED("permission")), null;
+  let checked = checkPermission(raw);
+  return checked.ok ? checked.value : (fail(checked.message), null);
+}
+async function runGroupCreate(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permissions = parsePermissions(strOpt(args, "permissions"));
+  return permissions.ok ? groupWrite((cfg) => createGroup(cfg, name, permissions.value), MESSAGES.GROUP_CREATED(name)) : (fail(permissions.message), 1);
+}
+async function runGroupList(_args) {
+  return guard(async () => {
+    let data = await listGroups(apiConfig());
+    return emit(data, (st) => renderGroups(st, data.groups)), 0;
+  });
+}
+async function runGroupGet(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  return name === null ? 1 : guard(async () => {
+    let group = await getGroup(apiConfig(), name);
+    return emit(group, (st) => renderGroup(st, group)), 0;
+  });
+}
+async function runGroupGrant(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permission = permissionArg(args.positionals[1]);
+  return permission === null ? 1 : groupWrite((cfg) => grantGroupPermission(cfg, name, permission), MESSAGES.GROUP_GRANTED(name, permission));
+}
+async function runGroupRevoke(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permission = permissionArg(args.positionals[1]);
+  return permission === null ? 1 : groupWrite((cfg) => revokeGroupPermission(cfg, name, permission), MESSAGES.GROUP_REVOKED(name, permission));
+}
+async function runGroupAddUser(args) {
+  let group = accessNameArg(args.positionals[0], ACCESS.GROUP, "group");
+  if (group === null) return 1;
+  let user = accessNameArg(args.positionals[1], ACCESS.USER, "user");
+  return user === null ? 1 : groupWrite((cfg) => addGroupUser(cfg, group, user), MESSAGES.GROUP_USER_ADDED(group, user));
+}
+async function runGroupRemoveUser(args) {
+  let group = accessNameArg(args.positionals[0], ACCESS.GROUP, "group");
+  if (group === null) return 1;
+  let user = accessNameArg(args.positionals[1], ACCESS.USER, "user");
+  return user === null ? 1 : groupWrite((cfg) => removeGroupUser(cfg, group, user), MESSAGES.GROUP_USER_REMOVED(group, user));
+}
+async function runGroupDelete(args, prompter = ttyPrompter) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  return name === null ? 1 : guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.GROUP_DELETE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteGroup(cfg, name);
+    return emit(res), sayOk(MESSAGES.GROUP_DELETED(res.deleted)), 0;
+  });
+}
+var init_group = __esm({ "src/commands/group.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api();
+  init_prompt();
+  init_constants();
+  init_access();
+  init_utils();
+  init_output();
+  init_shared();
+} });
+function keyFileDocument(created, out2) {
+  let { raw_key: _raw, ...rest } = created;
+  return { ...rest, out: out2 };
+}
+function openOutFile(out2) {
+  try {
+    return { fd: createPrivateFile(out2), path: out2 };
+  } catch (e) {
+    return fail(errCode(e) === "EEXIST" ? MESSAGES.KEY_OUT_EXISTS(out2) : MESSAGES.KEY_OUT_FAILED(out2, errText(e))), null;
+  }
+}
+async function runKeyCreate(args) {
+  let rawUser = strOpt(args, "user");
+  if (rawUser === void 0 || rawUser === "") return fail(MESSAGES.KEY_USER_REQUIRED), 1;
+  let user = accessNameArg(rawUser, ACCESS.USER, "--user");
+  if (user === null) return 1;
+  let label = strOpt(args, "label")?.trim() ?? "";
+  if (label === "") return fail(MESSAGES.KEY_LABEL_REQUIRED), 1;
+  let out2 = strOpt(args, "out");
+  return guard(async () => {
+    let cfg = apiConfig(), file = null;
+    if (out2 !== void 0 && (file = openOutFile(out2), file === null)) return 1;
+    let created;
+    try {
+      created = await createKey(cfg, { user, label });
+    } catch (e) {
+      throw file !== null && discardPrivateFile(file.fd, file.path), e;
+    }
+    if (created.raw_key === null) return file !== null && discardPrivateFile(file.fd, file.path), fail(MESSAGES.KEY_REDACTED(created.resource_id)), 1;
+    if (file !== null) {
+      try {
+        fillPrivateFile(file.fd, file.path, `${created.raw_key}
+`);
+      } catch (e) {
+        return fail(MESSAGES.KEY_OUT_WRITE_FAILED(file.path, errText(e), created.resource_id)), 1;
+      }
+      return emit(keyFileDocument(created, file.path)), sayOk(MESSAGES.KEY_WRITTEN(created.resource_id, file.path)), 0;
+    }
+    return warn(MESSAGES.KEY_SHOWN_ONCE), emit(created, (st) => renderKeyCreated(st, created)), 0;
+  });
+}
+async function runKeyList(args) {
+  let rawUser = strOpt(args, "user"), user = rawUser === void 0 ? void 0 : accessNameArg(rawUser, ACCESS.USER, "--user");
+  return user === null ? 1 : guard(async () => {
+    let data = await listKeys(apiConfig(), user);
+    return emit(data, (st) => renderKeys(st, data.keys)), 0;
+  });
+}
+async function runKeyRevoke(args, prompter = ttyPrompter) {
+  let id = requireArg(args, "key-resource-id");
+  return id ? guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.KEY_REVOKE_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteKey(cfg, id);
+    return emit(res), sayOk(MESSAGES.KEY_REVOKED(res.revoked)), 0;
+  }) : 1;
+}
+var init_key = __esm({ "src/commands/key.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_api();
+  init_credentials();
+  init_prompt();
+  init_constants();
+  init_utils();
+  init_output();
+  init_shared();
+} });
 var init_commands = __esm({ "src/commands/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -13874,7 +14657,12 @@ var init_commands = __esm({ "src/commands/index.ts"() {
   init_secret();
   init_schedule();
   init_integration();
+  init_notification();
   init_hook();
+  init_permission();
+  init_user();
+  init_group();
+  init_key();
   init_decide_vm_delete();
 } });
 function metaFor(command) {
@@ -13884,7 +14672,7 @@ function allowedFlags(meta) {
   return { ...meta.flags, ...GLOBAL_FLAGS };
 }
 function parserSpec(meta) {
-  return boolFlagSpec(meta === void 0 || meta.secretArgv === true ? GLOBAL_FLAGS : { ...meta.flags, ...GLOBAL_FLAGS });
+  return boolFlagSpec(meta === void 0 || meta.secretArgv === true ? GLOBAL_FLAGS : allowedFlags(meta));
 }
 function parseInvocation(argv) {
   return parseArgs([...argv], parserSpec(metaFor(argv[0] ?? "")));
@@ -13906,7 +14694,7 @@ function checkInvocation(command, meta, pass) {
   for (let key of Object.keys(args.options)) {
     if (Object.hasOwn(flags, key)) continue;
     let short = typed[key];
-    return short !== void 0 ? MESSAGES.UNKNOWN_SHORT_FLAG(short, key, command) : unknownFlagRefusal(key, command, Object.keys(meta.flags), Object.keys(GLOBAL_FLAGS), HIDDEN_FLAGS);
+    return short !== void 0 ? MESSAGES.UNKNOWN_SHORT_FLAG(short, key, command) : unknownFlagRefusal(key, command, Object.keys(meta.flags), Object.keys(GLOBAL_FLAGS));
   }
   let badShort = pass.unknown[0];
   return badShort !== void 0 ? unknownFlagText(badShort, command) : meta.secretArgv === true ? null : shapeRefusal(command, args, flags, meta.positionals);
@@ -13944,7 +14732,7 @@ async function dispatch(plan) {
     case "unknown":
       return fail(`${MESSAGES.UNKNOWN_COMMAND}: ${plan.command}`, { hint: MESSAGES.SEE_HELP }), 1;
     case "version":
-      return runVersion(plan.args);
+      return runVersion();
     case "run":
       return route(plan.command, plan.args);
   }
@@ -13975,6 +14763,8 @@ function route(command, args) {
       return runUsageShow(args);
     case COMMANDS.USAGE_EXPORT:
       return runUsageExport(args);
+    case COMMANDS.USAGE_SERIES:
+      return runUsageSeries(args);
     case COMMANDS.TASK_CREATE:
       return runTaskCreate(args);
     case COMMANDS.TASK_LIST:
@@ -13995,6 +14785,10 @@ function route(command, args) {
       return runRunGet(args);
     case COMMANDS.RUN_LOGS:
       return runRunLogs(args);
+    case COMMANDS.RUN_TIMELINE:
+      return runRunTimeline(args);
+    case COMMANDS.RUN_FAILURES:
+      return runRunFailures(args);
     case COMMANDS.RUN_DELETE:
       return runRunDelete(args);
     case COMMANDS.RUN_CANCEL:
@@ -14025,6 +14819,40 @@ function route(command, args) {
       return runNotifySet(args);
     case COMMANDS.INTEGRATION_ADD:
       return runIntegrationAdd(args);
+    case COMMANDS.NOTIFICATION_LIST:
+      return runNotificationList(args);
+    case COMMANDS.PERMISSION_LIST:
+      return runPermissionList(args);
+    case COMMANDS.USER_CREATE:
+      return runUserCreate(args);
+    case COMMANDS.USER_LIST:
+      return runUserList(args);
+    case COMMANDS.USER_GET:
+      return runUserGet(args);
+    case COMMANDS.USER_REMOVE:
+      return runUserRemove(args);
+    case COMMANDS.GROUP_CREATE:
+      return runGroupCreate(args);
+    case COMMANDS.GROUP_LIST:
+      return runGroupList(args);
+    case COMMANDS.GROUP_GET:
+      return runGroupGet(args);
+    case COMMANDS.GROUP_GRANT:
+      return runGroupGrant(args);
+    case COMMANDS.GROUP_REVOKE:
+      return runGroupRevoke(args);
+    case COMMANDS.GROUP_ADD_USER:
+      return runGroupAddUser(args);
+    case COMMANDS.GROUP_REMOVE_USER:
+      return runGroupRemoveUser(args);
+    case COMMANDS.GROUP_DELETE:
+      return runGroupDelete(args);
+    case COMMANDS.KEY_CREATE:
+      return runKeyCreate(args);
+    case COMMANDS.KEY_LIST:
+      return runKeyList(args);
+    case COMMANDS.KEY_REVOKE:
+      return runKeyRevoke(args);
   }
 }
 async function main(argv) {