ignitify 1.2.2 → 2.0.0

package/ignitify.cjs

@@ -1136,14 +1136,18 @@ function fill(pattern, ...params) {
   if (i !== params.length) throw new Error(`route ${pattern}: takes ${i} parameter(s), given ${params.length}`);
   return out2;
 }
+function isValidIdempotencyKey(key) {
+  return IDEMPOTENCY_KEY_PATTERN.test(key);
+}
 function isTerminalRunStatus(status) {
   return TERMINAL_RUN_STATUSES.includes(status);
 }
-var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, CLI_VERSION_HEADER, TERMINAL_RUN_STATUSES, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
+var DOT_SEGMENTS, TENANT_ROUTES, KEY_EXPIRED_ERROR, TENANT_PATHS, API_VERSION, API_VERSION_HEADER, CLIENT_FLOOR_HEADER, RETRY_AFTER_HEADER, CLI_VERSION_HEADER, IDEMPOTENCY_KEY_HEADER, IDEMPOTENT_REPLAYED_HEADER, IDEMPOTENCY_KEY_PATTERN, TERMINAL_RUN_STATUSES, init_api_routes = __esm({ "../../packages/contract/api-routes.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   DOT_SEGMENTS = /* @__PURE__ */ new Set([".", ".."]);
-  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", RUN_LOGS: "/runs/:id/logs", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", CLI_VERSION_HEADER = "X-Ignitify-Cli", TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "CANCELLED"];
+  TENANT_ROUTES = { TASKS: "/tasks", TASK_BY_ID: "/tasks/:id", TASK_DELETION_PREVIEW: "/tasks/:id/deletion-preview", DEPLOYMENTS: "/deployments", DEPLOYMENT_BY_ID: "/deployments/:id", RUNS: "/runs", RUN_BY_ID: "/runs/:id", RUN_CANCEL: "/runs/:id/cancel", WHOAMI: "/whoami", PACKAGE_ADVICE: "/packages/advice", VMS: "/vms", VM_BY_ID: "/vms/:id", HOOKS: "/hooks", TRIGGER: "/hooks/trigger", TRIGGER_HOOK: "/hooks/trigger/:hookId", SECRETS: "/secrets", SECRET_BY_NAME: "/secrets/:name", SCHEDULES: "/schedules", SCHEDULE_BY_ID: "/schedules/:id", USAGE: "/usage", USAGE_SERIES: "/usage/series", RUN_LOGS: "/runs/:id/logs", RUN_TIMELINE: "/runs/:id/timeline", RUN_FAILURES: "/runs/failures", DEPLOYMENT_LOGS: "/deployments/:id/logs", DEPLOYMENT_HOOKS: "/deployments/:id/hooks", DEPLOYMENT_NOTIFY: "/deployments/:id/notify", HOOK_BY_ID: "/hooks/:id", READYZ: "/readyz", LIVEZ: "/livez", AUTH_DEVICE: "/auth/device", AUTH_DEVICE_TOKEN: "/auth/device/token", AUTH_KEY: "/auth/key", NOTIFICATIONS: "/notifications", USERS: "/users", USER_BY_ID: "/users/:id", GROUPS: "/groups", GROUP_BY_ID: "/groups/:id", GROUP_PERMISSION: "/groups/:id/permissions/:permission", GROUP_USER: "/groups/:id/users/:user", KEYS: "/keys", KEY_BY_ID: "/keys/:id" }, KEY_EXPIRED_ERROR = "API key has expired", TENANT_PATHS = { TASKS: TENANT_ROUTES.TASKS, TASK_BY_ID: (id) => fill(TENANT_ROUTES.TASK_BY_ID, id), TASK_DELETION_PREVIEW: (id) => fill(TENANT_ROUTES.TASK_DELETION_PREVIEW, id), DEPLOYMENTS: TENANT_ROUTES.DEPLOYMENTS, DEPLOYMENT_BY_ID: (id) => fill(TENANT_ROUTES.DEPLOYMENT_BY_ID, id), DEPLOYMENT_LOGS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_LOGS, id), RUNS: TENANT_ROUTES.RUNS, RUN_BY_ID: (id) => fill(TENANT_ROUTES.RUN_BY_ID, id), RUN_CANCEL: (id) => fill(TENANT_ROUTES.RUN_CANCEL, id), RUN_LOGS: (id) => fill(TENANT_ROUTES.RUN_LOGS, id), RUN_TIMELINE: (id) => fill(TENANT_ROUTES.RUN_TIMELINE, id), RUN_FAILURES: TENANT_ROUTES.RUN_FAILURES, WHOAMI: TENANT_ROUTES.WHOAMI, PACKAGE_ADVICE: TENANT_ROUTES.PACKAGE_ADVICE, VMS: TENANT_ROUTES.VMS, VM_BY_ID: (id) => fill(TENANT_ROUTES.VM_BY_ID, id), HOOKS: TENANT_ROUTES.HOOKS, TRIGGER: TENANT_ROUTES.TRIGGER, TRIGGER_HOOK: (hookId) => fill(TENANT_ROUTES.TRIGGER_HOOK, hookId), SECRETS: TENANT_ROUTES.SECRETS, SECRET_BY_NAME: (name) => fill(TENANT_ROUTES.SECRET_BY_NAME, name), SCHEDULES: TENANT_ROUTES.SCHEDULES, SCHEDULE_BY_ID: (id) => fill(TENANT_ROUTES.SCHEDULE_BY_ID, id), USAGE: TENANT_ROUTES.USAGE, USAGE_SERIES: TENANT_ROUTES.USAGE_SERIES, DEPLOYMENT_HOOKS: (id) => fill(TENANT_ROUTES.DEPLOYMENT_HOOKS, id), DEPLOYMENT_NOTIFY: (id) => fill(TENANT_ROUTES.DEPLOYMENT_NOTIFY, id), HOOK_BY_ID: (id) => fill(TENANT_ROUTES.HOOK_BY_ID, id), READYZ: TENANT_ROUTES.READYZ, LIVEZ: TENANT_ROUTES.LIVEZ, AUTH_DEVICE: TENANT_ROUTES.AUTH_DEVICE, AUTH_DEVICE_TOKEN: TENANT_ROUTES.AUTH_DEVICE_TOKEN, AUTH_KEY: TENANT_ROUTES.AUTH_KEY, NOTIFICATIONS: TENANT_ROUTES.NOTIFICATIONS, USERS: TENANT_ROUTES.USERS, USER_BY_ID: (name) => fill(TENANT_ROUTES.USER_BY_ID, name), GROUPS: TENANT_ROUTES.GROUPS, GROUP_BY_ID: (name) => fill(TENANT_ROUTES.GROUP_BY_ID, name), GROUP_PERMISSION: (name, permission) => fill(TENANT_ROUTES.GROUP_PERMISSION, name, permission), GROUP_USER: (name, user) => fill(TENANT_ROUTES.GROUP_USER, name, user), KEYS: TENANT_ROUTES.KEYS, KEY_BY_ID: (id) => fill(TENANT_ROUTES.KEY_BY_ID, id) }, API_VERSION = "1", API_VERSION_HEADER = "X-Api-Version", CLIENT_FLOOR_HEADER = "X-Client-Floor", RETRY_AFTER_HEADER = "Retry-After", CLI_VERSION_HEADER = "X-Ignitify-Cli", IDEMPOTENCY_KEY_HEADER = "Idempotency-Key", IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed", IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9._:-]{8,255}$/;
+  TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "CANCELLED"];
 } });
 var CALLBACK_PATH_PREFIX, init_callback_path = __esm({ "../../packages/contract/callback-path.ts"() {
   "use strict";
@@ -1158,6 +1162,10 @@ var init_limits = __esm({ "../../packages/contract/limits.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
+var init_currencies = __esm({ "../../packages/contract/currencies.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
 var TASK_CONFIG_FILENAMES, RUNTIME_REGISTRY, RUNTIME_IDS, LIVE_RUNTIME_IDS, isRuntimeId, TASK_CONFIG_AJV_OPTIONS, TASK_CONFIG_SCHEMA, BUILD_REFUSAL_STAGES, BUILD_STAGES, init_task_config = __esm({ "../../packages/contract/task-config.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -1302,10 +1310,10 @@ var init_package_advice = __esm({ "../../packages/contract/package-advice.ts"()
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
-var USAGE_AXES, USAGE_DETAIL_COMMAND, RESETS_AT_NEXT_RENEWAL, init_usage = __esm({ "../../packages/contract/usage.ts"() {
+var USAGE_AXES, AXIS_UNIT, USAGE_DETAIL_COMMAND, RESETS_AT_NEXT_RENEWAL, init_usage = __esm({ "../../packages/contract/usage.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  USAGE_AXES = ["compute", "network", "network_in", "disk", "scratch", "runs", "pin", "build"], USAGE_DETAIL_COMMAND = "ignitify quota", RESETS_AT_NEXT_RENEWAL = "your next paid renewal";
+  USAGE_AXES = ["compute", "network", "network_in", "disk", "scratch", "runs", "pin", "build"], AXIS_UNIT = { compute: "ms", network: "bytes", network_in: "bytes", disk: "byte-hours", scratch: "byte-hours", runs: "runs", pin: "ms", build: "ms" }, USAGE_DETAIL_COMMAND = "ignitify quota", RESETS_AT_NEXT_RENEWAL = "your next paid renewal";
 } });
 function formatUserCode(code) {
   if (code.length !== 8) return code;
@@ -1324,12 +1332,65 @@ var init_backoff = __esm({ "../../packages/contract/backoff.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
 } });
+var init_tenant_account = __esm({ "../../packages/contract/tenant-account.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function retryAfterMs(value, nowMs) {
+  if (value === null || value.trim() === "") return null;
+  let text = value.trim(), ms = /^\d+$/.test(text) ? Number(text) * 1e3 : /[a-z]/i.test(text) ? Date.parse(text) - nowMs : Number.NaN;
+  return Number.isNaN(ms) ? null : Math.min(Math.max(2e3, ms), WEB_POLL.BACKOFF_CEILING_MS);
+}
+var WEB_POLL, NO_TASK_NAME_TEXT, OBS_QUERY, FAILURE_CLASSES, FAILURE_CLASS_TEXT, OBS_REFUSAL, init_tenant_telemetry = __esm({ "../../packages/contract/tenant-telemetry.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  WEB_POLL = { LIVE_MS: 5e3, SUMMARY_MS: 6e4, JITTER: 0.1, BACKOFF_CEILING_MS: 6e4 };
+  NO_TASK_NAME_TEXT = "(no task name)", OBS_QUERY = { CURSOR: "cursor", WAIT_SEC: "wait_sec", FROM_OFFSET: "from_offset", STATUS: "status", DAYS: "days" }, FAILURE_CLASSES = ["task", "limit", "cancelled", "platform"], FAILURE_CLASS_TEXT = { task: { label: "Your task", hint: "The code or the deployment failed: an exit code, a crash, a timeout." }, limit: { label: "A limit", hint: "A limit of your plan stopped the run. You can change it." }, cancelled: { label: "Cancelled", hint: "Someone asked the run to stop." }, platform: { label: "The platform", hint: "Something on our side failed. We see these too." } }, OBS_REFUSAL = { NEVER_RAN: { error: "run-never-ran", detail: "this run was not dispatched to a VM" }, INVALID_CURSOR: { error: "invalid-cursor", detail: "from_offset must be 0 or a next_offset that this run's output returned" }, AGENT_OUTDATED_CURSOR: { error: "agent-outdated-cursor", detail: "the host that ran this run cannot read output from an offset; read it without from_offset" }, HOST_GONE: { error: "host-gone", detail: "the host that ran this VM is no longer in the fleet" }, OUTPUT_GONE: { error: "no-file", detail: "the host no longer holds this run's output" }, INVALID_TIMELINE_CURSOR: { error: "invalid-timeline-cursor", detail: "cursor must be a cursor that this run's timeline returned" }, INVALID_DAYS: { error: "invalid-days", detail: "days must be a whole number of days, 1 or more" }, INVALID_WAIT: { error: "invalid-wait", detail: "wait_sec must be whole seconds from 0 to 20" }, WAIT_REFUSED: { error: "wait-refused", detail: "too many open waits; retry after the Retry-After seconds" }, UNAVAILABLE: { error: "obs-unavailable", detail: "the read cannot be served now; retry after the Retry-After seconds" } };
+} });
+function isPermission(value) {
+  return typeof value == "string" && PERMISSIONS.has(value);
+}
+var PERMISSION, PERMISSIONS, PERMISSION_DESCRIPTION, ACCESS_MARKER, ACCESS_REFUSAL, ACCESS_NAME_PATTERN, ACCESS_NAME_RULE, KEY_LIST_QUERY, init_tenant_access = __esm({ "../../packages/contract/tenant-access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  PERMISSION = { TASKS_READ: "tasks.read", TASKS_WRITE: "tasks.write", DEPLOYMENTS_READ: "deployments.read", DEPLOYMENTS_WRITE: "deployments.write", RUNS_READ: "runs.read", RUNS_WRITE: "runs.write", SECRETS_READ: "secrets.read", SECRETS_WRITE: "secrets.write", HOOKS_READ: "hooks.read", HOOKS_WRITE: "hooks.write", USAGE_READ: "usage.read" }, PERMISSIONS = new Set(Object.values(PERMISSION));
+  PERMISSION_DESCRIPTION = { [PERMISSION.TASKS_READ]: "Read tasks", [PERMISSION.TASKS_WRITE]: "Create and delete tasks", [PERMISSION.DEPLOYMENTS_READ]: "Read deployments and build logs", [PERMISSION.DEPLOYMENTS_WRITE]: "Deploy, delete a deployment, ask for package advice", [PERMISSION.RUNS_READ]: "Read runs, logs, timeline, failures, schedules, VMs", [PERMISSION.RUNS_WRITE]: "Start, cancel, delete runs; cancel schedules; stop VMs", [PERMISSION.SECRETS_READ]: "List secret names (values are never readable)", [PERMISSION.SECRETS_WRITE]: "Set and delete secrets", [PERMISSION.HOOKS_READ]: "List hooks", [PERMISSION.HOOKS_WRITE]: "Create and delete hooks; set notify", [PERMISSION.USAGE_READ]: "Usage, series, notifications" }, ACCESS_MARKER = { ANY_KEY: "any-key", OWNER: "owner" }, ACCESS_REFUSAL = { PERMISSION_DENIED: "permission-denied", OWNER_REQUIRED: "owner-required", USER_NOT_FOUND: "user-not-found", GROUP_NOT_FOUND: "group-not-found", NAME_TAKEN: "name-taken", UNKNOWN_PERMISSION: "unknown-permission" }, ACCESS_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/, ACCESS_NAME_RULE = "1 to 63 lower case letters, digits and '-', starting with a letter or digit", KEY_LIST_QUERY = { USER: "user" };
+} });
+var NOTIFICATION_KINDS, NOTIFICATION_KIND_INFO, ALERT_KINDS, CRITICAL_ALERT_KINDS, NOTIFICATION_FILTERS, NOTIFICATION_RETENTION_DAYS, NOTIFICATION_PAGE_MAX, NOTIFICATION_PAGE_DEFAULT, NOTIFICATION_QUERY, NOTIFICATION_REFUSAL, init_tenant_notifications = __esm({ "../../packages/contract/tenant-notifications.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api_routes();
+  init_tenant_telemetry();
+  NOTIFICATION_KINDS = ["limit.reached", "limit.near", "runs.failing", "callback.failing", "schedule.missed", "pin.lost", "plan.changed"], NOTIFICATION_KIND_INFO = { "limit.reached": { class: "alert", severity: "critical", label: "Monthly limit reached" }, "limit.near": { class: "notification", severity: "warning", label: "Monthly limit near" }, "runs.failing": { class: "alert", severity: "warning", label: "Runs failing" }, "callback.failing": { class: "alert", severity: "warning", label: "Run callbacks failing" }, "schedule.missed": { class: "notification", severity: "warning", label: "Schedule did not run" }, "pin.lost": { class: "notification", severity: "warning", label: "Pinned VM lost" }, "plan.changed": { class: "notification", severity: "info", label: "Plan changed" } }, ALERT_KINDS = NOTIFICATION_KINDS.filter((k) => NOTIFICATION_KIND_INFO[k].class === "alert"), CRITICAL_ALERT_KINDS = ALERT_KINDS.filter((k) => NOTIFICATION_KIND_INFO[k].severity === "critical"), NOTIFICATION_FILTERS = ["all", "unread", "open"], NOTIFICATION_RETENTION_DAYS = 30, NOTIFICATION_PAGE_MAX = 100, NOTIFICATION_PAGE_DEFAULT = 25, NOTIFICATION_QUERY = { FILTER: "filter", KIND: "kind", CURSOR: OBS_QUERY.CURSOR, LIMIT: "limit" }, NOTIFICATION_REFUSAL = { INVALID_FILTER: { error: "invalid-filter", detail: `filter must be one of: ${NOTIFICATION_FILTERS.join(", ")}` }, INVALID_KIND: { error: "invalid-kind", detail: `kind must be one of: ${NOTIFICATION_KINDS.join(", ")}` }, INVALID_LIMIT: { error: "invalid-limit", detail: "limit must be a whole number, 1 or more" }, INVALID_CURSOR: { error: "invalid-cursor", detail: "cursor must be a cursor that this list returned" } };
+} });
+var SITE_LINKS, init_web_nav = __esm({ "../../packages/contract/web-nav.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  SITE_LINKS = { DOCS: "https://ignitify.dev/docs", CLI_REFERENCE: "https://ignitify.dev/docs/cli/all", PRICING: "https://ignitify.dev/pricing" };
+} });
+var init_web_frame = __esm({ "../../packages/contract/web-frame.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api_routes();
+  init_tenant_account();
+  init_web_nav();
+} });
+function stripControl(text, keep = KEEP_NONE) {
+  return text.replace(CONTROL_UNIT, (unit) => keep(unit) ? unit : unit.startsWith("\r") ? `
+` : "");
+}
+var CONTROL_UNIT, KEEP_NONE, init_control_text = __esm({ "../../packages/contract/control-text.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  CONTROL_UNIT = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[PX^_][^\x1b]*(?:\x1b\\)?|[ -/]*[0-~])?|\r\n?|[\u0000-\u0008\u000b\u000c\u000e-\u001a\u001c-\u001f\u007f-\u009f]/g, KEEP_NONE = () => false;
+} });
 var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_api_routes();
   init_callback_path();
   init_limits();
+  init_currencies();
   init_task_config();
   init_source_manifest();
   init_system_packages();
@@ -1340,21 +1401,28 @@ var init_tenant = __esm({ "../../packages/contract/tenant/index.ts"() {
   init_digest();
   init_device_code();
   init_backoff();
+  init_tenant_account();
+  init_tenant_telemetry();
+  init_tenant_access();
+  init_tenant_notifications();
+  init_web_nav();
+  init_web_frame();
+  init_control_text();
 } });
 function valueFlags(map2) {
   return Object.fromEntries(Object.keys(map2).map((flag) => [flag, "value"]));
 }
-var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SERVER_FLAGS, HIDDEN_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, USAGE_FLAG_PARAMS, USAGE_FILTERS, COMMAND_META, VERSION_META, MESSAGES, RUN_STATUS, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, init_constants = __esm({ "src/constants/index.ts"() {
+var COMMANDS, IGNORE_FILE, STATE, CREDENTIALS, LOGIN, LOGIN_VIEW, NETWORK, ENV, DEFAULT_TASKS_DIR, RELEASE_BUILD, DEFAULTS, UPGRADE_COMMAND, PAYLOAD_LIMIT_FALLBACK_BYTES, RESULT_LIMIT_FALLBACK_BYTES, RUN_LIST_FLAG_PARAMS, VM_LIST_FLAG_PARAMS, GLOBAL_FLAGS, SHORT_FLAGS, VERSION_TOKENS, VALIDATE, ADVICE, INTEGRATION, NO_FLAGS, DIR, PAGE, YES, RAW, FOLLOW_FLAG, DAYS_FLAG, USAGE_FLAG_PARAMS, USAGE_FILTERS, NOTIFICATION_LIST_FLAG_PARAMS, COMMAND_META, VERSION_META, KEY_REVOKE_COMMAND, MESSAGES, ACCESS, RUN_STATUS, ACTIVE_RUN_STATUSES, DEPLOYMENT_STATUS, POLL, WAIT, FOLLOW, MS_PER_SECOND, BUSY_READ, FOLLOW_MESSAGES, init_constants = __esm({ "src/constants/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
   init_tenant();
   init_tenant();
   init_tenant();
-  COMMANDS = { HELP: "help", LOGIN: "login", LOGOUT: "logout", WHOAMI: "whoami", QUOTA: "quota", TASK_CREATE: "task:create", TASK_LIST: "task:list", TASK_GET: "task:get", TASK_DELETE: "task:delete", TASK_VALIDATE: "task:validate", TASK_PACK: "task:pack", TASK_DEPLOY: "task:deploy", TASK_RUN: "task:run", DEPLOYMENT_LIST: "deployment:list", DEPLOYMENT_GET: "deployment:get", DEPLOYMENT_LOGS: "deployment:logs", DEPLOYMENT_DELETE: "deployment:delete", RUN_LIST: "run:list", RUN_GET: "run:get", RUN_LOGS: "run:logs", RUN_DELETE: "run:delete", RUN_CANCEL: "run:cancel", VM_LIST: "vm:list", VM_GET: "vm:get", VM_DELETE: "vm:delete", SECRET_SET: "secret:set", SECRET_LIST: "secret:list", SECRET_DELETE: "secret:delete", SCHEDULE_LIST: "schedule:list", SCHEDULE_CANCEL: "schedule:cancel", HOOK_CREATE: "hook:create", HOOK_LIST: "hook:list", HOOK_DELETE: "hook:delete", NOTIFY_SET: "notify:set", INTEGRATION_ADD: "integration:add", USAGE: "usage", USAGE_EXPORT: "usage:export" }, IGNORE_FILE = ".ignitifyignore", STATE = { DIR: ".ignitify", FILE: "state.json", GITIGNORE_FILE: ".gitignore", GITIGNORE_TEXT: `# written by ignitify: local state, never commit
+  COMMANDS = { HELP: "help", LOGIN: "login", LOGOUT: "logout", WHOAMI: "whoami", QUOTA: "quota", TASK_CREATE: "task:create", TASK_LIST: "task:list", TASK_GET: "task:get", TASK_DELETE: "task:delete", TASK_VALIDATE: "task:validate", TASK_PACK: "task:pack", TASK_DEPLOY: "task:deploy", TASK_RUN: "task:run", DEPLOYMENT_LIST: "deployment:list", DEPLOYMENT_GET: "deployment:get", DEPLOYMENT_LOGS: "deployment:logs", DEPLOYMENT_DELETE: "deployment:delete", RUN_LIST: "run:list", RUN_GET: "run:get", RUN_LOGS: "run:logs", RUN_TIMELINE: "run:timeline", RUN_FAILURES: "run:failures", RUN_DELETE: "run:delete", RUN_CANCEL: "run:cancel", VM_LIST: "vm:list", VM_GET: "vm:get", VM_DELETE: "vm:delete", SECRET_SET: "secret:set", SECRET_LIST: "secret:list", SECRET_DELETE: "secret:delete", SCHEDULE_LIST: "schedule:list", SCHEDULE_CANCEL: "schedule:cancel", HOOK_CREATE: "hook:create", HOOK_LIST: "hook:list", HOOK_DELETE: "hook:delete", NOTIFY_SET: "notify:set", INTEGRATION_ADD: "integration:add", USAGE: "usage", USAGE_EXPORT: "usage:export", USAGE_SERIES: "usage:series", NOTIFICATION_LIST: "notification:list", PERMISSION_LIST: "permission:list", USER_CREATE: "user:create", USER_LIST: "user:list", USER_GET: "user:get", USER_REMOVE: "user:remove", GROUP_CREATE: "group:create", GROUP_LIST: "group:list", GROUP_GET: "group:get", GROUP_GRANT: "group:grant", GROUP_REVOKE: "group:revoke", GROUP_ADD_USER: "group:add-user", GROUP_REMOVE_USER: "group:remove-user", GROUP_DELETE: "group:delete", KEY_CREATE: "key:create", KEY_LIST: "key:list", KEY_REVOKE: "key:revoke" }, IGNORE_FILE = ".ignitifyignore", STATE = { DIR: ".ignitify", FILE: "state.json", GITIGNORE_FILE: ".gitignore", GITIGNORE_TEXT: `# written by ignitify: local state, never commit
 *
-` }, CREDENTIALS = { DIR_NAME: "ignitify", FILE_NAME: "credentials.json", DIR_MODE: 448, FILE_MODE: 384 }, LOGIN = { MAX_RETRIES: 3, KEY_TTL_DAYS: 90, MIN_POLL_INTERVAL_SEC: 5, BROWSER_SCHEMES: ["https:", "http:"] }, LOGIN_VIEW = { TITLE: "Sign in to Ignitify", OPEN_PAGE: "Open this page:", ASK_OPERATOR: "Give this code to your operator, who approves it:", CHECK_CODE: "Check this code", SAME_CODE: "The page must show the same code.", WAITING_STATIC: (minutes) => `Waiting for approval. The code expires in ${minutes} minutes.`, WAITING_LIVE: (left) => `Waiting for approval... code expires in ${left}`, CANCELLED: "Sign-in cancelled. Nothing was saved.", SIGNED_IN: "Signed in", SIGNED_OUT: "Signed out", KEY_EXPIRES: (days) => `${days} days after last use; each use renews it`, YES: "yes", ROWS: { ACCOUNT: "Account", ACCOUNT_ID: "Account id", KEY_LABEL: "Key label", KEY_EXPIRES: "Key expires", SAVED_TO: "Saved to", REVOKED: "Revoked", DELETED: "Deleted" } }, NETWORK = { REASONS: { ECONNREFUSED: "nothing accepts connections there", ENOTFOUND: "the host name is unknown", EAI_AGAIN: "the host name lookup failed", ETIMEDOUT: "the connection timed out", UND_ERR_CONNECT_TIMEOUT: "the connection timed out", ECONNRESET: "the connection was reset" }, TLS_WORDS: "the TLS certificate was not accepted", TLS_CODES: ["CERT_HAS_EXPIRED", "CERT_NOT_YET_VALID", "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN", "UNABLE_TO_VERIFY_LEAF_SIGNATURE", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"], TLS_CODE_PREFIXES: ["ERR_TLS_", "ERR_SSL_"], CODE_PATTERN: /^[A-Z][A-Z0-9_]*$/, DETAIL_MAX_CHARS: 80 }, ENV = { TASKS_DIR: "IGNITIFY_TASKS_DIR", KEY: "IGNITIFY_API_KEY" }, DEFAULT_TASKS_DIR = "tasks", DEFAULTS = { API_URL: "https://api.ignitify.dev" }, UPGRADE_COMMAND = "npm install --global ignitify@latest", PAYLOAD_LIMIT_FALLBACK_BYTES = 10240, RESULT_LIMIT_FALLBACK_BYTES = 10240, RUN_LIST_FLAG_PARAMS = { status: "status", "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "correlation-id": "correlation_id", "vm-id": "vm_id", ...PAGE_FLAG_PARAMS }, VM_LIST_FLAG_PARAMS = { "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "older-than": "older_than", ...PAGE_FLAG_PARAMS }, GLOBAL_FLAGS = { json: "bool", help: "bool" }, SERVER_FLAGS = { api: "value" }, HIDDEN_FLAGS = ["api"], SHORT_FLAGS = { h: "help", y: "yes" }, VERSION_TOKENS = ["--version", "-v"];
-  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, USAGE_FLAG_PARAMS = { period: "period", axis: "axis", vm: "vm", run: "run" }, USAGE_FILTERS = valueFlags(USAGE_FLAG_PARAMS), COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { ...SERVER_FLAGS, "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...SERVER_FLAGS, ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: { ...SERVER_FLAGS, ...DIR }, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...SERVER_FLAGS, ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...SERVER_FLAGS, ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...SERVER_FLAGS, ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", wait: "bool", ...DIR, ...SERVER_FLAGS }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(RUN_LIST_FLAG_PARAMS) }, positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { ...SERVER_FLAGS, full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...SERVER_FLAGS, ...RAW }, positionals: 1, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...SERVER_FLAGS, ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: SERVER_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...SERVER_FLAGS, ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { ...SERVER_FLAGS, stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: SERVER_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { ...SERVER_FLAGS, "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: { ...SERVER_FLAGS, ...PAGE }, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: { ...SERVER_FLAGS, ...YES }, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { ...SERVER_FLAGS, url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...SERVER_FLAGS, ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false } }, VERSION_META = { flags: SERVER_FLAGS, positionals: 0, confirms: false }, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login --api ${url}'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes, limit) => `payload is ${bytes} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes, limit) => `${source}: run.payload is ${bytes} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
+` }, CREDENTIALS = { DIR_NAME: "ignitify", FILE_NAME: "credentials.json", DIR_MODE: 448, FILE_MODE: 384 }, LOGIN = { MAX_RETRIES: 3, KEY_TTL_DAYS: 90, MIN_POLL_INTERVAL_SEC: 5, BROWSER_SCHEMES: ["https:", "http:"] }, LOGIN_VIEW = { TITLE: "Sign in to Ignitify", OPEN_PAGE: "Open this page:", ASK_OPERATOR: "Give this code to your operator, who approves it:", CHECK_CODE: "Check this code", SAME_CODE: "The page must show the same code.", WAITING_STATIC: (minutes) => `Waiting for approval. The code expires in ${minutes} minutes.`, WAITING_LIVE: (left) => `Waiting for approval... code expires in ${left}`, CANCELLED: "Sign-in cancelled. Nothing was saved.", SIGNED_IN: "Signed in", SIGNED_OUT: "Signed out", KEY_EXPIRES: (days) => `${days} days after last use; each use renews it`, YES: "yes", ROWS: { ACCOUNT: "Account", ACCOUNT_ID: "Account id", KEY_LABEL: "Key label", KEY_EXPIRES: "Key expires", SAVED_TO: "Saved to", REVOKED: "Revoked", DELETED: "Deleted" } }, NETWORK = { REASONS: { ECONNREFUSED: "nothing accepts connections there", ENOTFOUND: "the host name is unknown", EAI_AGAIN: "the host name lookup failed", ETIMEDOUT: "the connection timed out", UND_ERR_CONNECT_TIMEOUT: "the connection timed out", ECONNRESET: "the connection was reset" }, TLS_WORDS: "the TLS certificate was not accepted", TLS_CODES: ["CERT_HAS_EXPIRED", "CERT_NOT_YET_VALID", "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN", "UNABLE_TO_VERIFY_LEAF_SIGNATURE", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"], TLS_CODE_PREFIXES: ["ERR_TLS_", "ERR_SSL_"], CODE_PATTERN: /^[A-Z][A-Z0-9_]*$/, DETAIL_MAX_CHARS: 80 }, ENV = { TASKS_DIR: "IGNITIFY_TASKS_DIR", KEY: "IGNITIFY_API_KEY", DEV_API_URL: "IGNITIFY_DEV_API_URL" }, DEFAULT_TASKS_DIR = "tasks", RELEASE_BUILD = true, DEFAULTS = { API_URL: "https://api.ignitify.dev" }, UPGRADE_COMMAND = "npm install --global ignitify@latest", PAYLOAD_LIMIT_FALLBACK_BYTES = 10240, RESULT_LIMIT_FALLBACK_BYTES = 10240, RUN_LIST_FLAG_PARAMS = { status: "status", "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "correlation-id": "correlation_id", "vm-id": "vm_id", ...PAGE_FLAG_PARAMS }, VM_LIST_FLAG_PARAMS = { "deployment-id": "deployment_id", "task-name": "task_name", preset: "preset", "older-than": "older_than", ...PAGE_FLAG_PARAMS }, GLOBAL_FLAGS = { json: "bool", help: "bool" }, SHORT_FLAGS = { h: "help", y: "yes" }, VERSION_TOKENS = ["--version", "-v"];
+  VALIDATE = { VALID: "task config valid" }, ADVICE = { FLAG: "review-packages", TIMEOUT_MS: 6e4, FAULT_STATUSES: [400, 401, 403], SECONDS_ONLY_BELOW: 60, SECONDS_PER_MINUTE: 60, NO_PACKAGES: "this task lists no build.system_packages", SKIPPED: (reason) => `AI check skipped: ${reason}`, RATE_LIMITED: (retryAfterS) => `rate limited, try again in ${retryAfterS} s`, UNAVAILABLE: (reason) => `the review is unavailable (${reason})`, NO_ANSWER: (status, message) => status === null ? message : `server answered ${status}`, FAULT: (status, body) => `AI check failed (HTTP ${status}): ${body}`, BAD_NAMES: (bad) => `not valid package names: ${bad.join(", ")}`, TOO_MANY: (count, max) => `${count} packages listed, the most is ${max}`, BASIS: { measured: "measured", model: "model estimate" }, NO_FIT: (driveMib, capMib) => `does not fit: ${driveMib} MiB of packages against the ${capMib} MiB image store of your tier`, TITLE: "Package review", NOTE: "AI advice only. A suggestion is not checked against Debian.", COLUMNS: { PACKAGE: "Package", VERDICT: "Verdict", SIZE: "Size", NOTE: "Note", SUGGEST: "Suggest" }, NOT_DOUBLE_CHECKED: "not double-checked by the second model", RESULT_CLEAN: (total) => `No concerns found in ${total} package${total === 1 ? "" : "s"}.`, RESULT_FLAGGED: (total, flagged) => `${total} package${total === 1 ? "" : "s"} checked, ${flagged} to look at.`, NOT_ANSWERED: (names) => `No AI answer for: ${names.join(", ")}. The review could not judge ${names.length === 1 ? "it" : "them"}.`, BUILD_TITLE: "Build time", BUILD_LABELS: { ADDED: "Added", APPLIES: "Applies to", SIZE: "Packages size", LEFT_OUT: "Left out" }, BUILD_NONE: "nothing: your tenant already holds the drive for this list", BUILD_ADDED: (range, basis) => `about ${range} (${basis})`, BUILD_APPLIES: "the first deploy of this list. A later code-only redeploy reuses the drive.", BUILD_SIZE: (mib, capMib) => capMib === null ? `${mib} MiB` : `${mib} MiB of ${capMib} MiB (the image store of your tier)`, BUILD_LEFT_OUT: (names) => `${names.join(", ")} (unusable, or size unknown)` }, INTEGRATION = { PACKAGE_JSON: "package.json", NODE_MODULES: "node_modules", RUNTIME: "node", NPM: "npm", TARBALL_EXT: ".tgz", PACKED_ROOT: "package", PACK_TMP_PREFIX: "ignitify-integration-pack-", PACK_ARGS: (pkg, destDir, taskDir) => ["pack", pkg, "--pack-destination", destDir, "--prefix", taskDir], INSTALL_ARGS: (spec, taskDir) => ["install", spec, "--save-prod", "--ignore-scripts", "--prefix", taskDir], PACKED_MAX_BYTES: 8 * 1024 * 1024, ZLIB_TOO_BIG: "ERR_BUFFER_TOO_LARGE", VERSION_PATTERN: /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, QUESTION: "Apply?", REGISTRY_URL: "https://registry.npmjs.org", REGISTRY_ACCEPT: "application/vnd.npm.install-v1+json", REGISTRY_TIMEOUT_MS: 5e3, NOTED_FIELDS: ["execution.network.type", "run.preset"], USAGE: "usage: ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]", TASK_REQUIRED: "--task <slug> is required: the task folder to add the integration to", YES_WITH_DRY_RUN: "--yes and --dry-run cannot be used together", BAD_NAME: (name, pattern) => `integration name ${JSON.stringify(name)} must match ${pattern}`, NOT_NODE: (runtime) => `integrations work with Node tasks only; this task has runtime "${runtime}"`, NO_PACKAGE_JSON: (taskDir) => `${taskDir} has no package.json: run npm init in the task folder first; nothing was changed`, NOT_INTERACTIVE: "Refusing to proceed: not a TTY. Re-run with --yes to apply the plan, or with --dry-run to see it.", PACK_FAILED: (pkg, code) => `npm pack ${pkg} failed${code === null ? "" : ` (exit ${code})`}; nothing in the task was changed`, INSTALL_FAILED: (spec, code) => `npm install ${spec} failed${code === null ? "" : ` (exit ${code})`}; task.yaml was not changed`, INSTALLED: (spec) => `${spec} installed`, BAD_VERSION: (pkg, version2) => `${pkg}: its package.json version ${JSON.stringify(version2)} is not a plain x.y.z version; nothing in the task was changed`, PACKED_TOO_BIG: (file, max) => `${file} unpacks to more than ${max} bytes: refused, nothing in the task was changed`, INSTALL_ONLY: (spec) => `installs ${spec}; task.yaml unchanged`, NOT_AN_INTEGRATION: (pkg, file) => `${pkg} has no ${file}: it is not an integration package`, BAD_MANIFEST: (pkg, issue) => `${pkg} integration.yaml: ${issue}`, UNREADABLE: (file, reason) => `cannot read ${file}: ${reason}`, WRITE_MISMATCH: (file) => `the edited ${file} does not read back as the plan; nothing was written`, YOU_ADD: "you add:", NO_CHANGES: "task.yaml already has every setting this integration needs; nothing to write", DRY_RUN: "dry run: task.yaml was not changed", WRITTEN: (file) => `${file} updated`, NOT_INSTALLED: (pkgs) => `${pkgs.join(", ")} ${pkgs.length === 1 ? "is" : "are"} in package.json but not in node_modules: run npm install, then task:validate again`, OBSOLETE: (pkg, version2, latest) => `${pkg}@${version2} is obsolete: use ${latest}`, OBSOLETE_SKIPPED: (reason) => `obsolete-version check skipped: ${reason}`, REGISTRY_UNREACHABLE: "the npm registry did not answer (offline?)", REGISTRY_NOT_FOUND: (pkg) => `${pkg} is not on the npm registry` }, NO_FLAGS = {}, DIR = { dir: "value" }, PAGE = valueFlags(PAGE_FLAG_PARAMS), YES = { yes: "bool" }, RAW = { raw: "bool" }, FOLLOW_FLAG = { follow: "bool" }, DAYS_FLAG = { days: "value" }, USAGE_FLAG_PARAMS = { period: "period", axis: "axis", vm: "vm", run: "run" }, USAGE_FILTERS = valueFlags(USAGE_FLAG_PARAMS), NOTIFICATION_LIST_FLAG_PARAMS = { kind: NOTIFICATION_QUERY.KIND, limit: NOTIFICATION_QUERY.LIMIT }, COMMAND_META = { [COMMANDS.HELP]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.LOGIN]: { flags: { "no-browser": "bool", name: "value" }, positionals: 0, confirms: false }, [COMMANDS.LOGOUT]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.WHOAMI]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.QUOTA]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.TASK_CREATE]: { flags: { ...DIR, lang: "value", local: "bool", "no-init": "bool", "no-scaffold": "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_LIST]: { flags: PAGE, positionals: 0, confirms: false }, [COMMANDS.TASK_GET]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DELETE]: { flags: { ...DIR, ...YES }, positionals: 1, confirms: true }, [COMMANDS.TASK_VALIDATE]: { flags: { ...DIR, [ADVICE.FLAG]: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_PACK]: { flags: DIR, positionals: 1, confirms: false }, [COMMANDS.TASK_DEPLOY]: { flags: { ...DIR, check: "bool" }, positionals: 1, confirms: false }, [COMMANDS.TASK_RUN]: { flags: { deployment: "value", payload: "value", "timeout-sec": "value", "on-busy": "value", at: "value", "idempotency-key": "value", wait: "bool", ...DIR }, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LIST]: { flags: PAGE, positionals: 0, confirms: false }, [COMMANDS.DEPLOYMENT_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_LOGS]: { flags: RAW, positionals: 1, confirms: false }, [COMMANDS.DEPLOYMENT_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.RUN_LIST]: { flags: valueFlags(RUN_LIST_FLAG_PARAMS), positionals: 0, confirms: false }, [COMMANDS.RUN_GET]: { flags: { full: "bool" }, positionals: 1, confirms: false }, [COMMANDS.RUN_LOGS]: { flags: { ...RAW, ...FOLLOW_FLAG, tail: "value" }, positionals: 1, confirms: false }, [COMMANDS.RUN_TIMELINE]: { flags: FOLLOW_FLAG, positionals: 1, confirms: false }, [COMMANDS.RUN_FAILURES]: { flags: DAYS_FLAG, positionals: 0, confirms: false }, [COMMANDS.RUN_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.RUN_CANCEL]: { flags: { ...YES, force: "bool", grace: "value" }, positionals: 1, confirms: true }, [COMMANDS.VM_LIST]: { flags: { ...valueFlags(VM_LIST_FLAG_PARAMS), pinned: "bool" }, positionals: 0, confirms: false }, [COMMANDS.VM_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.VM_DELETE]: { flags: { ...YES, force: "bool" }, positionals: 1, confirms: true }, [COMMANDS.SECRET_SET]: { flags: { stdin: "bool", value: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.SECRET_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SECRET_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.SCHEDULE_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.SCHEDULE_CANCEL]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.HOOK_CREATE]: { flags: { "task-name": "value" }, positionals: 1, confirms: false }, [COMMANDS.HOOK_LIST]: { flags: PAGE, positionals: 1, confirms: false }, [COMMANDS.HOOK_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.NOTIFY_SET]: { flags: { url: "value", clear: "bool", "secret-stdin": "bool", secret: "value" }, positionals: 1, confirms: false, secretArgv: true }, [COMMANDS.INTEGRATION_ADD]: { flags: { ...DIR, ...YES, task: "value", "dry-run": "bool" }, positionals: 1, confirms: true }, [COMMANDS.USAGE]: { flags: { ...USAGE_FILTERS, runs: "bool", vms: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_EXPORT]: { flags: { ...USAGE_FILTERS, csv: "bool" }, positionals: 0, confirms: false }, [COMMANDS.USAGE_SERIES]: { flags: DAYS_FLAG, positionals: 0, confirms: false }, [COMMANDS.NOTIFICATION_LIST]: { flags: { ...valueFlags(NOTIFICATION_LIST_FLAG_PARAMS), unread: "bool", open: "bool" }, positionals: 0, confirms: false }, [COMMANDS.PERMISSION_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.USER_CREATE]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.USER_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.USER_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.USER_REMOVE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.GROUP_CREATE]: { flags: { permissions: "value" }, positionals: 1, confirms: false }, [COMMANDS.GROUP_LIST]: { flags: NO_FLAGS, positionals: 0, confirms: false }, [COMMANDS.GROUP_GET]: { flags: NO_FLAGS, positionals: 1, confirms: false }, [COMMANDS.GROUP_GRANT]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_REVOKE]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_ADD_USER]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_REMOVE_USER]: { flags: NO_FLAGS, positionals: 2, confirms: false }, [COMMANDS.GROUP_DELETE]: { flags: YES, positionals: 1, confirms: true }, [COMMANDS.KEY_CREATE]: { flags: { user: "value", label: "value", out: "value" }, positionals: 0, confirms: false }, [COMMANDS.KEY_LIST]: { flags: { user: "value" }, positionals: 0, confirms: false }, [COMMANDS.KEY_REVOKE]: { flags: YES, positionals: 1, confirms: true } }, VERSION_META = { flags: NO_FLAGS, positionals: 0, confirms: false }, KEY_REVOKE_COMMAND = (id) => `ignitify ${COMMANDS.KEY_REVOKE} ${id}`, MESSAGES = { NOT_SIGNED_IN: "Not signed in. Run 'ignitify login', or set the IGNITIFY_API_KEY environment variable.", CREDENTIALS_SYMLINK: (file) => `${file} is a symbolic link. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_FILE: (file) => `${file} is not a regular file. Remove it and run 'ignitify login' again.`, CREDENTIALS_NOT_OWNED: (file) => `${file} belongs to another user. Remove it and run 'ignitify login' again.`, CREDENTIALS_TOO_OPEN: (file, mode) => `${file} can be read by other users (mode 0${mode}). Run: chmod 600 ${file}`, CREDENTIALS_UNREADABLE: (file) => `${file} is not a valid credentials file. Remove it and run 'ignitify login' again.`, CREDENTIALS_OTHER_URL: (fileUrl, url) => `The saved key is for ${fileUrl}, not ${url}. Run 'ignitify login'.`, CREDENTIALS_DIR_NOT_DIR: (dir) => `${dir} is not a folder. Remove it and run 'ignitify login' again.`, API_URL_NOT_URL: (url) => `The API address "${url}" is not a URL.`, API_URL_NOT_HTTPS: (url) => `The API address ${url} is not https. The CLI sends your key only over https, or over plain http to this machine (localhost, 127.0.0.1, ::1).`, LOGIN_REPLACED: (label) => `Note: replaced the key "${label}" of another machine. Use 'ignitify login --name <other-label>' to keep both.`, LOGIN_EXPIRED: (code) => `The code ${code} expired before it was approved. Run 'ignitify login' again.`, LOGIN_REFUSED: (reason) => `The sign-in was refused: ${reason}.`, LOGIN_UNKNOWN: "The sign-in code is unknown or was already used. Run 'ignitify login' again.", LOGIN_BAD_ANSWER: "The server sent a sign-in answer with no usable key. Nothing was saved.", LOGIN_BAD_START: "The server sent a sign-in start that the CLI cannot use (no code, or no wait times). Nothing was started.", ENV_KEY_OVERRIDES_LOGIN: "Note: the IGNITIFY_API_KEY environment variable is set, so it is used instead of your saved login.", KEY_EXPIRED_HINT: "Run 'ignitify login' to sign in again.", LOGIN_TOO_MANY: "Too many sign-in attempts from this network. Try again later.", LOGIN_CAP: (limit) => `This account already has the most API keys its plan allows${limit === null ? "" : ` (${limit})`}. Remove one, or approve with "replace", then run 'ignitify login' again.`, CANNOT_REACH: (url, detail) => `Cannot reach ${url}${detail === null ? "" : ` (${detail})`}. Check your network and run 'ignitify login' again.`, UNREACHABLE: (origin, detail) => `Cannot reach ${origin}${detail === null ? "" : ` (${detail})`}.`, LOGOUT_NOTHING: "Not signed in. There are no saved credentials.", LOGOUT_ENV_NOTE: "Note: the IGNITIFY_API_KEY environment variable is still set. Logout does not change it.", LOGOUT_NOT_REVOKED: (label) => `Warning: the server did not revoke the key, so it may still work. The saved credentials were deleted. Ask your operator to revoke the key "${label}".`, SLUG_MISSING: (source) => `'slug' is required in ${source}`, SLUG_INVALID: (source, reason) => `${source}: 'slug' ${reason}`, PRESET_INVALID: "run.preset must be a non-empty string", PRESET_UNKNOWN: (source, name, valid) => `${source}: unknown run.preset "${name}" (valid: ${valid.join(", ")}). An unrecognised preset would silently fall back to the platform default, giving you a different instance class than you declared.`, TIMEOUT_INVALID: "run.timeout_sec must be a positive number", TASK_ID_REQUIRED: "a <task-id> is required", TASK_ID_INVALID: (id, reason) => `task id ${JSON.stringify(id)} ${reason}`, TASK_NOT_REGISTERED: (taskId, dirFlag) => `this folder is not registered yet (no task_id in .ignitify/state.json). Run: ignitify task:create ${taskId} --no-scaffold${dirFlag === void 0 ? "" : ` --dir ${dirFlag}`}, then deploy again.`, ERROR: (message) => `Error: ${message}`, ERROR_PREFIX: "Error:", SERVER_TRACE_ID: (id) => `server trace id: ${id}`, ARG_REQUIRED: (label) => `${label} is required`, UNKNOWN_COMMAND: "unknown command", SEE_HELP: "Run 'ignitify help' to see every command.", UNKNOWN_SHORT_FLAG: (short, long, command) => `unknown flag ${short} (--${long}) for ${command}`, GRACE_INVALID: (got) => `--grace must be a whole number of milliseconds, 0 or more (got ${JSON.stringify(got)})`, GRACE_WITH_FORCE: "--grace has no effect with --force (force stops the run now)", TASK_LIMITS: (payload, result) => `payload max ${payload}, result max ${result}; over the limit the run fails`, PAYLOAD_OVER_LIMIT: (bytes, limit) => `payload is ${bytes} bytes; the limit is ${limit} bytes`, PAYLOAD_REFUSED_BY_SERVER: (limit) => `the server refused the payload as too large; the limit is ${limit} bytes`, DEFAULT_PAYLOAD_OVER_LIMIT: (source, bytes, limit) => `${source}: run.payload is ${bytes} bytes; the offline limit is ${limit} bytes (the server may allow more)`, IGNORED_BY_FILE: `ignored by ${IGNORE_FILE}`, IGNORED_COUNT: (n) => `${n} path(s) left out by ${IGNORE_FILE}`, TASK_DELETED: "task deleted", TASK_LINK_REMOVED: "Removed local link", TASK_LINK_NOT_REMOVED: (link, reason) => `Warning: the task is deleted, but its local link was not removed (${reason}). Remove ${link} by hand.`, DEPLOY_DELETED: "deployment deleted", RUN_DELETED: "run deleted", ABORTED: "Aborted.", CONFIRM_PROCEED: "Proceed?", SECRET_SET_USAGE: "usage: ignitify secret:set <NAME> --stdin   (the value is read from stdin)", SECRET_VALUE_EMPTY: "secret:set read an empty value from stdin \u2014 nothing was stored (pipe the value in: `--stdin < value-file`)", SECRET_VALUE_ON_ARGV: `secret:set takes no value on argv: it is visible in \`ps\` and is written to your shell history. Pipe it on stdin, e.g.
   ignitify secret:set <NAME> --stdin < value-file
   printf %s "$VALUE" | ignitify secret:set <NAME> --stdin
 \u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.`, NOTIFY_SECRET_ON_ARGV: '--secret is not accepted: a value on argv is visible in `ps` and is written to your shell history. Use --secret-stdin, e.g.\n  printf %s "$SECRET" | ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin\n\u26A0\uFE0F  The value you just typed is already in your history \u2014 rotate it.', HOOK_CREATE_USAGE: "usage: ignitify hook:create <deployment-id> --task-name <name>", HOOK_TASK_NAME_REQUIRED: `--task-name <name> is required: a hook starts a run of ONE task in the deployment, and a run without a task name fails.
@@ -1362,14 +1430,15 @@ usage: ignitify hook:create <deployment-id> --task-name <name>`, HOOK_LIST_USAGE
        ignitify notify:set <deployment-id> --clear
   --secret-stdin reads the signing secret (at least ${32} characters) from stdin; it is
   required with --url. There is no --secret flag: a value on argv is visible in \`ps\`
-  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed` }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
+  and lands in your shell history.`, NOTIFY_URL_NEEDS_SECRET: "--url needs --secret-stdin: the server refuses a notify target with no signing secret.", NOTIFY_SECRET_EMPTY: "--secret-stdin read an empty value from stdin.", NOTIFY_URL_WITH_CLEAR: "--url and --clear cannot be used together.", NOTIFY_SECRET_STDIN_VALUE: "--secret-stdin takes no value: pipe the secret on stdin.", HOOK_SECRET_SHOWN_ONCE: "\u26A0\uFE0F  The secret below is shown ONCE and cannot be read back \u2014 hook:list never returns it. Store it now; if it is lost, delete the hook and create a new one.", HOOK_SECRET_REDACTED: (id) => `the server answered without the secret (a replay of an earlier request), and it is not shown again. Delete ${id} with 'ignitify hook:delete ${id}' and create another to get a new secret.`, HOOK_PAYLOAD_LIMIT: (limit) => `A webhook body over ${limit} is refused with 413 before the signature is checked.`, SECRET_DELETE_USAGE: "usage: ignitify secret:delete <NAME>", USAGE_EXPORT_USAGE: "usage: ignitify usage:export [--period YYYY-MM] (--json|--csv)   (name exactly one format)", DAYS_INVALID: (raw) => `--days must be a whole number of days, 1 or more (got ${JSON.stringify(raw)})`, NOTIFICATION_ONE_VIEW: "Choose --unread or --open, not both.", NOTIFICATION_MORE: (max) => `Older notifications exist. Raise --limit (at most ${max}), or open Notifications in the app.`, NOTIFICATION_MORE_IN_APP: "Older notifications exist. Open Notifications in the app to see them.", LATEST_DEPLOY_BUILDING: (task, deploymentId) => `the latest deploy of ${task} is still building (${deploymentId}). Wait for it ('ignitify deployment:get ${deploymentId}'), or pass --deployment <id> to run an older one.`, LATEST_DEPLOY_FAILED: (task, reason) => `the latest deploy of ${task} failed: ${reason ?? "no reason recorded"}. Fix the task and run 'ignitify task:deploy ${task}' again, or pass --deployment <id> to run an older one.`, RUN_AT_WITH_WAIT: "--wait cannot be used with --at: a scheduled run has no run id until it fires. Drop --wait; follow it later with 'ignitify schedule:list' and 'ignitify run:list'.", IDEMPOTENCY_KEY_INVALID: (key) => `--idempotency-key must be 8 to 255 characters of A-Z a-z 0-9 . _ : -, got: ${key}`, RUN_REPLAYED: "this is the answer to an earlier request with the same --idempotency-key; no new run was started.", IDEMPOTENCY_KEY_REUSED_HINT: "Use a new --idempotency-key for a different run. Reuse a key only to retry the same run.", IDEMPOTENCY_IN_PROGRESS_HINT: "If an earlier request with this key is still running, retry with the same key shortly.", SECRET_STORED: (name) => `secret ${name} stored`, SECRET_REMOVED: (name) => `secret ${name} removed`, ACCESS_NAME_INVALID: (kind, name) => `${kind} name ${JSON.stringify(name)} is not valid: use ${ACCESS_NAME_RULE}`, PERMISSION_UNKNOWN: (permission) => `unknown permission ${JSON.stringify(permission)}. Run 'ignitify permission:list' to see the permissions.`, PERMISSION_NOT_GRANTABLE: (marker) => `${JSON.stringify(marker)} is not a permission and cannot be granted: only owner keys manage access.`, PERMISSIONS_REQUIRED: "--permissions <p1,p2,\u2026> is required: name at least one permission, comma-separated.", KEY_USER_REQUIRED: "--user <name> is required: a key belongs to one user. Owner keys come from ignitify login.", KEY_LABEL_REQUIRED: "--label <text> is required: it tells you later where the key is used.", KEY_SHOWN_ONCE: "\u26A0\uFE0F  The key below is shown ONCE and cannot be read back. Hand it over now; if it is lost, revoke it and create another.", KEY_OUT_EXISTS: (file) => `${file} already exists. key:create --out writes a new file only and never follows a link. Choose another name; no key was created.`, KEY_OUT_FAILED: (file, reason) => `cannot create ${file} (${reason}); no key was created.`, KEY_OUT_WRITE_FAILED: (file, reason, id) => `cannot write ${file} (${reason}). Key ${id} was created but its value is lost: revoke it with '${KEY_REVOKE_COMMAND(id)}' and create another.`, KEY_WRITTEN: (id, file) => `key ${id} written to ${file} (mode 0600). Hand the file over, then delete your copy.`, KEY_REDACTED: (id) => `the server answered without the key (a replay of an earlier request). Revoke ${id} with '${KEY_REVOKE_COMMAND(id)}' and create another.`, USER_CREATED: (name) => `user ${name} created`, USER_REMOVED: (name, keys) => `user ${name} removed; ${keys} key(s) revoked`, GROUP_CREATED: (name) => `group ${name} created`, GROUP_GRANTED: (name, permission) => `group ${name} now has ${permission}`, GROUP_REVOKED: (name, permission) => `group ${name} no longer has ${permission}`, GROUP_USER_ADDED: (group, user) => `user ${user} added to group ${group}`, GROUP_USER_REMOVED: (group, user) => `user ${user} removed from group ${group}`, GROUP_DELETED: (name) => `group ${name} deleted`, KEY_REVOKED: (id) => `key ${id} revoked`, ACCESS_PERMISSION_DENIED: (needed) => needed === null ? "permission denied: this key lacks the permission this command needs. Ask the owner to grant it to one of your groups." : `permission denied: this key needs the ${needed} permission. Ask the owner to grant it to one of your groups.`, ACCESS_OWNER_REQUIRED: "owner key required: only owner keys manage users, groups and keys. This is a user key.", ACCESS_REFUSED: (error, reason) => `${error} (${reason})` }, ACCESS = { OWNER: "owner", SEPARATOR: ",", USER: "user", GROUP: "group", TASKS_WRITE_NOTE: "tasks.write can delete deployments and runs too: deleting a task deletes its deployments, cancels and deletes their runs and stops their VMs. Grant it only where deployments.write and runs.write are acceptable too.", SECRETS_READ_NOTE: "deployments.write plus runs.write can read secret values in practice: deploy code that prints its environment, then run it.", HOOKS_WRITE_NOTE: "hooks.write can start runs (a hook trigger starts a run) and can send run results to any URL. Grant it only where runs.write is acceptable too." }, RUN_STATUS = { PENDING: "PENDING", PROVISIONING: "PROVISIONING", RUNNING: "RUNNING", RETRYING: "RETRYING", COMPLETED: "COMPLETED", FAILED: "FAILED", CANCELLED: "CANCELLED" }, ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([RUN_STATUS.PENDING, RUN_STATUS.PROVISIONING, RUN_STATUS.RUNNING, RUN_STATUS.RETRYING]), DEPLOYMENT_STATUS = { BUILDING: "BUILDING", READY: "READY", FAILED: "FAILED", ARCHIVED: "ARCHIVED" }, POLL = { DEPLOY: { BASE_MS: 500, MAX_MS: 1e3, TIMEOUT_MS: 900 * 1e3 }, RUN: { BASE_MS: 500, MAX_MS: 3e3, TIMEOUT_MS: 1800 * 1e3 }, ERROR: { MIN_TRIES: 3, GRACE_MS: 6e4 } }, WAIT = { UPLOADING: (slug2, size) => `Uploading ${slug2}${size ? ` (${size})` : ""}`, UPLOAD_FAILED: "Upload failed", BUILDING: (deploymentId) => `Building image ${deploymentId}`, BUILT: "Image built", REUSED: "Image already built \u2014 reused", BUILD_FAILED: "Build failed", BUILD_FAILED_DETAIL: (deploymentId, reason) => `deployment ${deploymentId} failed to build \u2014 ${reason}`, BUILD_TIMEOUT: "Still building after 15 minutes \u2014 stopped waiting", BUILD_TIMEOUT_DETAIL: (deploymentId) => `deployment ${deploymentId} is still building after 15 minutes. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, RUN: (runId, status) => `Run ${runId} ${status}`, RUN_SUBMITTED: (runId) => `Run ${runId} submitted`, RUN_ENDED: (status) => `Run ${status}`, RUN_TIMEOUT: (status) => `Run is still ${status} after 30 minutes \u2014 stopped waiting`, RUN_TIMEOUT_DETAIL: (runId) => `The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_RETRYING: "lost contact with the server \u2014 retrying", LOST: "Lost contact with the server \u2014 stopped waiting", LOST_BUILD_DETAIL: (deploymentId, cause) => `stopped waiting for deployment ${deploymentId}: ${cause}. The build has NOT been cancelled \u2014 check it with 'ignitify deployment:get ${deploymentId}'.`, LOST_RUN_DETAIL: (runId, cause) => `stopped waiting for run ${runId}: ${cause}. The run has NOT been cancelled \u2014 check it with 'ignitify run:get ${runId}'.`, HINT_BUILD: "Ctrl+C stops waiting, not the build", HINT_RUN: "Ctrl+C stops waiting, not the run", INTERRUPTED_BUILD: (deploymentId, started) => `Stopped waiting. The build ${started ? "keeps running" : "is queued"} on the server \u2014 nothing was cancelled.
 Check it with: ignitify deployment:get ${deploymentId}`, INTERRUPTED_RUN: (runId) => `Stopped waiting. The run keeps going on the server \u2014 nothing was cancelled.
-Check it with: ignitify run:get ${runId}` };
+Check it with: ignitify run:get ${runId}` }, FOLLOW = { WAIT_SEC: 20, IDLE_MS: 2e3, RETRY_FALLBACK_MS: 2e3 }, MS_PER_SECOND = 1e3, BUSY_READ = { MAX_RETRIES: 3, NOTE: (seconds) => `server busy, retrying in ${seconds}s` }, FOLLOW_MESSAGES = { AGENT_OUTDATED: "the host is running an older agent; try again after the update, or read it without --follow or --tail", API_NO_CURSOR: "this API cannot follow output yet; run the command without --follow or --tail", TAIL_INVALID: (raw) => `--tail must be a whole number of lines, 1 or more (got ${JSON.stringify(raw)})`, INTERRUPTED: (runId) => `Stopped following. The run keeps going on the server \u2014 nothing was cancelled.
+Check it with: ignitify run:get ${runId}`, STILL_LIVE: (status) => `Run ${status} \u2014 still live; add --follow to watch it` };
 } });
 var ANSI, GLYPHS, LAYOUT, LABELS, EMPTY_LISTS, DISPLAY_CAPS, TITLES, PER_BRAIN_MARKER, PER_BRAIN_FOOTNOTE, POLICY_UNIT_NOTES, HIDDEN_FIELDS, RESULT_MESSAGES, RUN_CANCEL_OUTCOME, init_constants2 = __esm({ "src/output/constants.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, SCHEDULE_CANCEL_PREVIEW: (id) => `Will cancel schedule ${id} \u2014 it will never fire.`, SCHEDULE_NOT_CANCELLED: (id) => `Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`, HOOK_DELETE_PREVIEW: (id) => `Will delete webhook ${id}. A sender that posts to it is refused from then on.`, SECRET_DELETE_PREVIEW: (name) => `Will delete secret ${name}. Its value cannot be read back.`, DEPLOYMENT_DELETE_PREVIEW: (id) => `Will soft-delete deployment ${id} and all its runs (cascade).`, RUN_DELETE_PREVIEW: (id) => `Will soft-delete run ${id}.`, RUN_ALREADY_OVER: (id, status) => `Run ${id} is already ${status} \u2014 nothing to cancel.`, RUN_CANCEL_PREVIEW: (id, force) => force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`, RUN_STOPPING: (id, grace, was) => `Run ${id} is stopping${grace}${was} \u2014 still RUNNING until it finishes or the grace expires.`, RUN_CANCELLED: (id, was) => `Run cancelled: ${id}${was}`, LOG_TRUNCATED: (lines) => `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`, NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
+  ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", underline: "\x1B[4m", red: "\x1B[31m", green: "\x1B[32m", yellow: "\x1B[33m", cyan: "\x1B[36m", clearLine: "\r\x1B[2K", hideCursor: "\x1B[?25l", showCursor: "\x1B[?25h" }, GLYPHS = { unicode: { ok: "\u2713", err: "\u2717", warn: "\u26A0", bullet: "\u2022", ellipsis: "\u2026", dash: "\u2014", rule: "\u2500", box: { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" }, frames: ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] }, ascii: { ok: "OK", err: "x", warn: "!", bullet: "*", ellipsis: "...", dash: "-", rule: "-", box: { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" }, frames: ["-", "\\", "|", "/"] } }, LAYOUT = { MAX_WIDTH: 80, INDENT: "  ", GAP: "  ", MIN_COLUMN: 8, SPINNER_MS: 100, NO_UNICODE_TERMS: ["dumb", "linux"] }, LABELS = { NEXT_STEP: "Next Step:", SYSTEM_RESOURCES: "System Resources:", RESULT: "Result:", MORE_LINES: (n) => `\u2026 ${n} more lines (run:get --full shows all)`, BUILD_LOG: "Build log:", PLATFORM_BUILT_IMAGE: "Image: built and stored by the platform; there is nothing for you to download.", EARLIER_LINES: (n) => `\u2026 ${n} earlier lines (deployment:get <id> shows all)`, NO_RESULTS: "(No results)", EMPTY: "(empty)" }, EMPTY_LISTS = { ANY: { message: "(No results)" }, TASKS: { message: "No tasks yet.", next: "Create one with: ignitify task:create <task-id>" }, DEPLOYMENTS: { message: "No deployments yet.", next: "Build one with: ignitify task:deploy <task-id>" }, RUNS: { message: "No runs yet.", next: "Start one with: ignitify task:run <task-id>" }, VMS: { message: "No live VMs." }, SCHEDULES: { message: "No scheduled runs.", next: "Schedule one with: ignitify task:run <task-id> --at <iso>" }, HOOKS: { message: "No webhooks yet.", next: "Create one with: ignitify hook:create <deployment-id> --task-name <name>" }, USERS: { message: "No users yet.", next: "Create one with: ignitify user:create <name>" }, GROUPS: { message: "No groups yet.", next: "Create one with: ignitify group:create <name> --permissions <p1,p2>" }, KEYS: { message: "No live keys." } }, DISPLAY_CAPS = { RESULT_MAX_LINES: 40, BUILD_LOG_TAIL_LINES: 30, ERROR_MAX_CHARS: 2e3 }, TITLES = { TENANT_PROFILE: "Tenant Profile", KEY_ACCESS: "This Key", TASK_REGISTERED: "Task Registered", SOURCE_PACK: "Source Upload (nothing built, nothing sent)", DEPLOYMENT_CREATED: "Deployment Created", RUN_SUBMITTED: "Run Submitted", RUN_DETAILS: "Run Details", DEPLOYMENT_DETAILS: "Deployment Details", VM_DETAILS: "VM Details", USAGE: "Usage & Limits", UNIT_WEIGHTS: "Units per run (by preset)", ENTITLEMENTS: "Entitlements (tier policy)", ENFORCED: "Enforced Limits (what this server applies)" }, PER_BRAIN_MARKER = "(per server)", PER_BRAIN_FOOTNOTE = "  (per server) \u2014 each server applies this limit on its own, so the limit across all servers is at least this.", POLICY_UNIT_NOTES = { max_compute_seconds_month: "(run seconds, not the VM time `usage` shows as compute)" }, HIDDEN_FIELDS = { SCALAR: ["payload", "result", "slug"], LIST: ["payload", "result", "execution"] }, RESULT_MESSAGES = { TASK_GET_OFFLINE: (reason) => `Note: ${reason.replace(/\.$/, "")}. The server sections show UNKNOWN.`, TASK_CREATED_LOCAL: (lang, taskId, dir) => `Created ${lang} task ${taskId} at ${dir} (local only \u2014 not registered)`, HOOK_CREATED_TITLE: "Webhook Created", HOOK_SECRET_KEY: "secret (shown ONCE)", HOOK_DELETED: (id) => `Webhook deleted: ${id}`, NOTIFY_SET: (deploymentId, url) => `Notify URL for ${deploymentId} set to ${url}`, NOTIFY_CLEARED: (deploymentId) => `Notify URL for ${deploymentId} cleared`, SCHEDULE_CANCELLED: (id) => `Schedule cancelled: ${id}`, SCHEDULE_CANCEL_PREVIEW: (id) => `Will cancel schedule ${id} \u2014 it will never fire.`, SCHEDULE_NOT_CANCELLED: (id) => `Schedule ${id} was NOT cancelled: not found, already fired, or currently firing.`, HOOK_DELETE_PREVIEW: (id) => `Will delete webhook ${id}. A sender that posts to it is refused from then on.`, SECRET_DELETE_PREVIEW: (name) => `Will delete secret ${name}. Its value cannot be read back.`, DEPLOYMENT_DELETE_PREVIEW: (id) => `Will soft-delete deployment ${id} and all its runs (cascade).`, RUN_DELETE_PREVIEW: (id) => `Will soft-delete run ${id}.`, RUN_ALREADY_OVER: (id, status) => `Run ${id} is already ${status} \u2014 nothing to cancel.`, RUN_CANCEL_PREVIEW: (id, force) => force ? `Will cancel run ${id} immediately (force: destroys the VM even if it is pinned).` : `Will ask run ${id} to stop gracefully; it is killed if it does not finish in time.`, RUN_STOPPING: (id, grace, was) => `Run ${id} is stopping${grace}${was} \u2014 still RUNNING until it finishes or the grace expires.`, RUN_CANCELLED: (id, was) => `Run cancelled: ${id}${was}`, LOG_TRUNCATED: (lines) => `truncated \u2014 ${lines} line(s) shown; the log was cut at the size cap.`, USER_REMOVE_PREVIEW: (name) => `Will remove user ${name} and revoke every key of the user. The keys stop working at once.`, GROUP_DELETE_PREVIEW: (name) => `Will delete group ${name}. Its users lose the permissions it grants; users and keys stay.`, KEY_REVOKE_PREVIEW: (id) => `Will revoke key ${id}. A program that uses it is refused from then on.`, KEY_CREATED_TITLE: "Key Created", KEY_RAW_KEY: "key (shown ONCE)", USER_KEYS_TITLE: "Keys", NONE: "-", NO_SECRETS: "(no secrets)", NO_SECRETS_NEXT: "Store one with: ignitify secret:set <NAME> --stdin" }, RUN_CANCEL_OUTCOME = { ALREADY_TERMINAL: "already-terminal", DRAINING: "draining", CANCELLED: "cancelled" };
 } });
 function makeStyle(o) {
   let p = (...codes) => paint(o.colour, ...codes), columns = Math.max(o.width, 1);
@@ -1399,15 +1468,15 @@ function paintStatus(st, status) {
   let s = String(status).toUpperCase(), tone = STATUS_TONE[s];
   return tone === "ok" ? st.green(s) : tone === "busy" ? st.yellow(s) : tone === "bad" ? st.red(s) : st.dim(s);
 }
-var paint, PLAIN, resolveStyle, plain, plainLines, TERMINAL_CONTROL, SGR, terminalSafe, stripAnsi, visibleLength, padVisible, cut, STATUS_TONE, init_style = __esm({ "src/output/style.ts"() {
+var paint, PLAIN, resolveStyle, plain, plainLines, SGR, isColour, terminalSafe, stripAnsi, visibleLength, padVisible, cut, STATUS_TONE, init_style = __esm({ "src/output/style.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
   init_constants2();
   paint = (on, ...codes) => (s) => on && s !== "" ? `${codes.join("")}${s}${ANSI.reset}` : s;
   PLAIN = makeStyle({ colour: false, unicode: true, width: LAYOUT.MAX_WIDTH });
   resolveStyle = (f) => makeStyle({ colour: wantsColour(f), unicode: wantsUnicode(f), width: f.columns !== void 0 && f.columns > 0 ? f.columns : LAYOUT.MAX_WIDTH });
-  plain = (s) => s.replace(/[\u0000-\u001f\u007f-\u009f]/g, ""), plainLines = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, ""), TERMINAL_CONTROL = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[PX^_][^\x1b]*(?:\x1b\\)?|[ -/]*[0-~])?|\r\n?|[\u0000-\u0008\u000b\u000c\u000e-\u001a\u001c-\u001f\u007f-\u009f]/g, SGR = /^\x1b\[[0-9;:]*m$/, terminalSafe = (s, keepColour) => s.replace(TERMINAL_CONTROL, (m) => keepColour && SGR.test(m) ? m : m.startsWith("\r") ? `
-` : ""), stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, ""), visibleLength = (s) => stripAnsi(s).length, padVisible = (s, width) => s + " ".repeat(Math.max(0, width - visibleLength(s))), cut = (s, max, ellipsis) => s.length <= max || max <= ellipsis.length ? s : `${s.slice(0, max - ellipsis.length)}${ellipsis}`;
+  plain = (s) => s.replace(/[\u0000-\u001f\u007f-\u009f]/g, ""), plainLines = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, ""), SGR = /^\x1b\[[0-9;:]*m$/, isColour = (unit) => SGR.test(unit), terminalSafe = (s, keepColour) => keepColour ? stripControl(s, isColour) : stripControl(s), stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, ""), visibleLength = (s) => stripAnsi(s).length, padVisible = (s, width) => s + " ".repeat(Math.max(0, width - visibleLength(s))), cut = (s, max, ellipsis) => s.length <= max || max <= ellipsis.length ? s : `${s.slice(0, max - ellipsis.length)}${ellipsis}`;
   STATUS_TONE = { COMPLETED: "ok", READY: "ok", ACTIVE: "ok", DONE: "ok", OK: "ok", PENDING: "busy", PROVISIONING: "busy", RUNNING: "busy", RETRYING: "busy", BUILDING: "busy", FAILED: "bad" };
 } });
 function cellText(v) {
@@ -1501,6 +1570,94 @@ var heading, successLine, errorMark, warnMark, noteLine, emptyState, init_blocks
   heading = (st, title, ok2 = false) => ok2 ? st.bold(st.green(`${st.glyphs.ok} ${title}`)) : st.bold(title), successLine = (st, text) => `${st.green(st.glyphs.ok)} ${text}`, errorMark = (st, text) => `${st.red(st.glyphs.err)} ${text}`, warnMark = (st, text) => `${st.yellow(st.glyphs.warn)} ${text}`, noteLine = (st, text) => st.yellow(text), emptyState = (st, message, next) => next === void 0 ? st.dim(message) : `${st.dim(message)}
 ${st.dim(next)}`;
 } });
+function checkAccessName(kind, name) {
+  return ACCESS_NAME_PATTERN.test(name) ? { ok: true, value: name } : { ok: false, message: MESSAGES.ACCESS_NAME_INVALID(kind, name) };
+}
+function checkPermission(permission) {
+  return isPermission(permission) ? { ok: true, value: permission } : { ok: false, message: MARKERS.includes(permission) ? MESSAGES.PERMISSION_NOT_GRANTABLE(permission) : MESSAGES.PERMISSION_UNKNOWN(permission) };
+}
+function parsePermissions(raw) {
+  let names = (raw ?? "").split(ACCESS.SEPARATOR).map((p) => p.trim()).filter((p) => p !== "");
+  if (names.length === 0) return { ok: false, message: MESSAGES.PERMISSIONS_REQUIRED };
+  let out2 = [];
+  for (let name of names) {
+    let checked = checkPermission(name);
+    if (!checked.ok) return checked;
+    out2.includes(checked.value) || out2.push(checked.value);
+  }
+  return { ok: true, value: out2 };
+}
+function permissionNote(permission) {
+  if (permission === PERMISSION.TASKS_WRITE) return ACCESS.TASKS_WRITE_NOTE;
+  if (permission === PERMISSION.SECRETS_READ) return ACCESS.SECRETS_READ_NOTE;
+  if (permission === PERMISSION.HOOKS_WRITE) return ACCESS.HOOKS_WRITE_NOTE;
+}
+function permissionRows() {
+  return CATALOGUE.map((permission) => {
+    let note = permissionNote(permission);
+    return { permission, description: PERMISSION_DESCRIPTION[permission], ...note === void 0 ? {} : { note } };
+  });
+}
+function accessRefusalText(e) {
+  let body = httpErrorJson(e)?.body, reason = body?.reason;
+  if (typeof reason != "string" || !REFUSALS.includes(reason)) return null;
+  if (reason === ACCESS_REFUSAL.PERMISSION_DENIED) {
+    let needed = body?.needed;
+    return MESSAGES.ACCESS_PERMISSION_DENIED(typeof needed == "string" && needed !== "" ? needed : null);
+  }
+  if (reason === ACCESS_REFUSAL.OWNER_REQUIRED) return MESSAGES.ACCESS_OWNER_REQUIRED;
+  let error = body?.error;
+  return MESSAGES.ACCESS_REFUSED(typeof error == "string" && error !== "" ? error : reason, reason);
+}
+var CATALOGUE, MARKERS, REFUSALS, keyUser, init_access = __esm({ "src/core/access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_tenant();
+  init_constants();
+  CATALOGUE = Object.values(PERMISSION), MARKERS = Object.values(ACCESS_MARKER), REFUSALS = Object.values(ACCESS_REFUSAL);
+  keyUser = (user) => user ?? ACCESS.OWNER;
+} });
+function renderPermissions(st, rows) {
+  return renderTable(st, [{ header: "permission", keep: true }, { header: "allows", wrap: true }], rows.map((r) => [r.permission, r.note === void 0 ? r.description : `${r.description}. Note: ${r.note}`]));
+}
+function renderUsers(st, users) {
+  return users.length === 0 ? emptyState(st, EMPTY_LISTS.USERS.message, EMPTY_LISTS.USERS.next) : renderTable(st, [{ header: "name", keep: true }, { header: "resource_id", keep: true }, { header: "created_at", keep: true }], users.map((u) => [u.name, u.resource_id, u.created_at]));
+}
+function renderKeys(st, keys) {
+  return keys.length === 0 ? emptyState(st, EMPTY_LISTS.KEYS.message) : renderTable(st, [{ header: "resource_id", keep: true }, { header: "user", keep: true }, { header: "label" }, { header: "created_at", keep: true }, { header: "last_used_at", keep: true }], keys.map((k) => [k.resource_id, keyUser(k.user), k.label, k.created_at, k.last_used_at]));
+}
+function renderUser(st, user) {
+  return `${renderFields(st, { name: user.name, resource_id: user.resource_id, created_at: user.created_at, groups: joined(user.groups), permissions: joined(user.permissions) })}
+
+${heading(st, RESULT_MESSAGES.USER_KEYS_TITLE)}
+${renderKeys(st, user.keys)}`;
+}
+function renderGroups(st, groups) {
+  return groups.length === 0 ? emptyState(st, EMPTY_LISTS.GROUPS.message, EMPTY_LISTS.GROUPS.next) : renderTable(st, [{ header: "name", keep: true }, { header: "permissions", wrap: true }, { header: "created_at", keep: true }], groups.map((g) => [g.name, joined(g.permissions), g.created_at]));
+}
+function renderGroup(st, group) {
+  return renderFields(st, { name: group.name, resource_id: group.resource_id, created_at: group.created_at, permissions: joined(group.permissions), users: joined(group.users) });
+}
+function renderKeyAccess(st, access) {
+  return renderFields(st, { key: access.key, user: keyUser(access.user), groups: joined(access.groups), permissions: joined(access.permissions) });
+}
+function renderKeyCreated(st, created) {
+  let { raw_key, secret_redacted: _redacted, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.KEY_RAW_KEY]: raw_key }, paint2 = { [RESULT_MESSAGES.KEY_RAW_KEY]: (s) => st.bold(st.yellow(s)) };
+  return `
+${heading(st, RESULT_MESSAGES.KEY_CREATED_TITLE, true)}
+${renderFields(st, rows, void 0, paint2)}
+`;
+}
+var joined, init_access2 = __esm({ "src/output/access.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_access();
+  init_blocks();
+  init_constants2();
+  init_table();
+  joined = (items) => items.length === 0 ? RESULT_MESSAGES.NONE : items.join(", ");
+} });
 function isStorageMib(value) {
   return typeof value == "number" && Number.isInteger(value) && value > 0;
 }
@@ -1636,6 +1793,7 @@ var sectionHeader, layout, filterScalars, filterDisplayKeys, BYTE_UNITS2, format
   init_table();
   init_blocks();
   init_style();
+  init_access2();
   init_constants2();
   init_tenant();
   init_execution();
@@ -1652,10 +1810,10 @@ ${heading(st, title, success)}
     return `${exp === 0 ? value : value.toFixed(1)} ${BYTE_UNITS2[exp]}`;
   }, quotaLine = (used, max) => `${used} / ${max ?? "unlimited"}`, storeLine = (used, max) => max === void 0 ? formatBytes(used) : `${formatBytes(used)} / ${max === null ? "unlimited" : formatBytes(max)}`, renderWhoami = (data, st = PLAIN) => {
     if (!data) return "";
-    let { limits, usage, tier, policy, bound_by, status_reason, policy_scope, enforced, unit_weights, capacity, ...identity } = data, identityRows = { ...identity };
+    let { limits, usage, tier, policy, bound_by, status_reason, policy_scope, enforced, unit_weights, capacity, access, ...identity } = data, identityRows = { ...identity };
     typeof status_reason == "string" && status_reason !== "" && (identityRows.status_reason = status_reason), tier && (identityRows.tier = `${tier.name} v${tier.version}`), bound_by && (identityRows.bound_by = bound_by);
     let out2 = layout(sectionHeader(st, TITLES.TENANT_PROFILE), renderFields(st, filterDisplayKeys(identityRows)));
-    return (limits || usage) && (out2 += renderUsageBlocks(st, limits, usage)), out2 += capacityBlock(st, capacity), hasUnits(limits) && unit_weights && (out2 += renderUnitWeights(st, unit_weights)), policy && (out2 += renderPolicyBlock(st, policy, policy_scope?.per_brain ?? [])), enforced && enforced.length > 0 && (out2 += renderEnforcedBlock(st, enforced)), out2;
+    return access && (out2 += layout(sectionHeader(st, TITLES.KEY_ACCESS), renderKeyAccess(st, access))), (limits || usage) && (out2 += renderUsageBlocks(st, limits, usage)), out2 += capacityBlock(st, capacity), hasUnits(limits) && unit_weights && (out2 += renderUnitWeights(st, unit_weights)), policy && (out2 += renderPolicyBlock(st, policy, policy_scope?.per_brain ?? [])), enforced && enforced.length > 0 && (out2 += renderEnforcedBlock(st, enforced)), out2;
   }, hasUnits = (limits) => typeof limits?.max_units == "number", renderUnitWeights = (st, weights) => layout(sectionHeader(st, TITLES.UNIT_WEIGHTS), renderFields(st, Object.fromEntries(Object.entries(weights).map(([p, w]) => [p, String(w)])))), showEnforced = (v) => v === null ? "\u2014" : String(v), renderEnforcedBlock = (st, rows) => {
     let enforcedText = (r) => {
       let value = showEnforced(r.enforced);
@@ -1879,7 +2037,7 @@ ${notice()}
     process.removeListener("SIGINT", handler);
   }
 }
-var spinnerGlyph, realEvery, NOOP, init_progress = __esm({ "src/output/progress.ts"() {
+var spinnerGlyph, realEvery, NOOP, NO_PROGRESS, init_progress = __esm({ "src/output/progress.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants2();
@@ -1895,13 +2053,15 @@ var spinnerGlyph, realEvery, NOOP, init_progress = __esm({ "src/output/progress.
   }, fail() {
   }, stop() {
   } };
+  NO_PROGRESS = { stop: () => {
+  } };
 } });
-var AXES, DIR2, YES2, RAW2, PAGE2, VERSION_HELP, COMMAND_HELP, HELP_PAGE, init_help = __esm({ "src/constants/help.ts"() {
+var OWNER_ONLY, PERMISSION_NOTES, AXES, DIR2, YES2, RAW2, SERIES_DAYS, FAILURES_DAYS, PAGE2, VERSION_HELP, COMMAND_HELP, HELP_PAGE, init_help = __esm({ "src/constants/help.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_tenant();
   init_constants();
-  AXES = USAGE_AXES.join("|"), DIR2 = { dir: { text: "Folder that holds your task folders.", default: `$${ENV.TASKS_DIR}, else ${DEFAULT_TASKS_DIR}` } }, YES2 = { yes: { text: "Skip the question (needed when not interactive)." } }, RAW2 = { raw: { text: "Print the bytes exactly as received. Without it, the colours are kept on a colour terminal and every other control code is removed." } }, PAGE2 = { limit: { text: "Rows on the page. The server sets the default and the largest value." }, "after-id": { text: "Page cursor: the id of the last row of the page before." }, after: { text: "Only rows after this ISO 8601 time." } }, VERSION_HELP = { summary: "Print the client version, and the API version if the server answers.", usage: ["ignitify --version"], notes: ["Needs no key. Warns when this client is older than the API supports."] }, COMMAND_HELP = { [COMMANDS.HELP]: { summary: "Print the usage of every command, or of one command.", usage: ["ignitify help [<command>]"], args: { command: "A command name. Leave it out to print every command." }, notes: ["`ignitify <command> --help` prints the same page."], examples: ["ignitify help task:run"] }, [COMMANDS.LOGIN]: { summary: "Sign this machine in and save its API key.", usage: ["ignitify login [--name <label>] [--no-browser]"], flags: { name: { text: "A label for this machine's key; keeps two machines with one hostname apart.", default: "the hostname" }, "no-browser": { text: "Print the sign-in page, but do not open it." } }, notes: ["The key is saved in ~/.config/ignitify/credentials.json (mode 0600)."], examples: ["ignitify login", "ignitify login --name build-server --no-browser"] }, [COMMANDS.LOGOUT]: { summary: "Revoke this machine's key and delete the saved file.", usage: ["ignitify logout"] }, [COMMANDS.WHOAMI]: { summary: "Show who your key belongs to, your limits and usage.", usage: ["ignitify whoami"] }, [COMMANDS.QUOTA]: { summary: "Show what you hold now against your limits.", usage: ["ignitify quota"] }, [COMMANDS.TASK_CREATE]: { summary: "Register a task name and write its starter files.", usage: ["ignitify task:create <task-id> [--lang node|python|go|rust] [--local] [--no-init] [--no-scaffold] [--dir <base-dir>]"], args: { "task-id": "The task name: also the folder name and the slug in task.yaml." }, flags: { lang: { text: "Language of the starter files.", default: "node" }, local: { text: "Write the files only. Calls no server and needs no key." }, "no-init": { text: "Write the short starter that has only run(), without init code." }, "no-scaffold": { text: "Register the task name but write no files." }, ...DIR2 }, examples: ["ignitify task:create image-resize", "ignitify task:create image-resize --lang python --local"] }, [COMMANDS.TASK_LIST]: { summary: "List your tasks, one page at a time.", usage: ["ignitify task:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.TASK_GET]: { summary: "Report a task's deploys, runs and next-step verdicts.", usage: ["ignitify task:get <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2, notes: ["Shows whether the next deploy builds a new image and the next run boots a new VM, with the reasons."] }, [COMMANDS.TASK_VALIDATE]: { summary: "Check task.yaml on your machine; builds nothing.", usage: ["ignitify task:validate <task-id> [--dir <base-dir>] [--review-packages]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, "review-packages": { text: "Then ask the server for an AI review of build.system_packages." } }, notes: ["The review is advice only: the exit code never changes.", "Only package names and the runtime id leave this machine; never code, slug or secrets.", "It also checks that task.yaml still covers each @ignitify-integrations/* package in package.json. A listed package that is not in node_modules stops the check: run npm install first.", "With integrations installed, it sends their package names to the public npm registry (registry.npmjs.org) to find obsolete versions: a warning only. With no network, that warning is skipped with a note."] }, [COMMANDS.TASK_PACK]: { summary: "List the files task:deploy would upload; builds nothing.", usage: ["ignitify task:pack <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2 }, [COMMANDS.TASK_DEPLOY]: { summary: "Upload the task source and wait until the image is built.", usage: ["ignitify task:deploy <task-id> [--dir <base-dir>] [--check]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, check: { text: "Run every local check, then stop. Nothing is uploaded." } }, notes: ["Ctrl+C stops waiting, not the build."], examples: ["ignitify task:deploy image-resize", "ignitify task:deploy image-resize --check"] }, [COMMANDS.TASK_RUN]: { summary: "Start one run of a task from its latest deployment.", usage: ["ignitify task:run <task-id> [--dir <base-dir>] [--deployment <id>] [--payload <json>] [--timeout-sec <n>] [--on-busy queue|reject] [--at <iso>] [--wait]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, deployment: { text: "Run this deployment instead of the task's latest deploy.", default: "the task's latest deploy" }, payload: { text: "JSON input for this run only.", default: "run.payload from task.yaml" }, "timeout-sec": { text: "Time limit in seconds for this run only.", default: "run.timeout_sec from task.yaml" }, "on-busy": { text: "When the run cannot start at once: queue waits for room (a limited time), reject fails at once.", default: "queue" }, at: { text: "Schedule the run for this ISO 8601 time. No run exists until it fires." }, wait: { text: "Follow the run to its end, then print it with its result." } }, notes: ["With --wait the exit code is 0 only when the run is COMPLETED. Ctrl+C stops waiting, not the run.", "--payload and --timeout-sec apply to this run only; task.yaml is never written.", "A bidirectional task runs one VM at a time; --on-busy covers that case too."], examples: ["ignitify task:run image-resize --wait", `ignitify task:run image-resize --payload '{"width":320}'`, "ignitify task:run image-resize --at 2027-01-15T03:00:00Z"] }, [COMMANDS.TASK_DELETE]: { summary: "Delete a task with all its deployments and runs.", usage: ["ignitify task:delete <task-id> [--dir <base-dir>] [--yes] [--json]"], args: { "task-id": "The task folder name, or the task id." }, flags: { ...DIR2, ...YES2, json: { text: "Print the plan and the result as one JSON document." } }, notes: ["Also removes the .ignitify/ link of every local folder linked to it; your files are kept."] }, [COMMANDS.DEPLOYMENT_LIST]: { summary: "List your deployments with the size of each image.", usage: ["ignitify deployment:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.DEPLOYMENT_GET]: { summary: "Show one deployment: status, size, integrity.", usage: ["ignitify deployment:get <deployment-id>"], args: { "deployment-id": "The deployment id, from task:deploy or deployment:list." } }, [COMMANDS.DEPLOYMENT_LOGS]: { summary: "Print the build log of a deployment, as the build wrote it.", usage: ["ignitify deployment:logs <deployment-id> [--raw]"], args: { "deployment-id": "The deployment id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.DEPLOYMENT_DELETE]: { summary: "Delete a deployment together with its runs.", usage: ["ignitify deployment:delete <deployment-id> [--yes]"], args: { "deployment-id": "The deployment id." }, flags: YES2 }, [COMMANDS.RUN_LIST]: { summary: "List your runs, with filters.", usage: ["ignitify run:list [--status S] [--deployment-id D] [--task-name N] [--preset P] [--correlation-id C] [--vm-id V] [--limit N] [--after-id <id>] [--after <iso>]"], flags: { status: { text: "Only runs in this status, for example FAILED." }, "deployment-id": { text: "Only runs of this deployment." }, "task-name": { text: "Only runs of this task." }, preset: { text: "Only runs on this instance class." }, "correlation-id": { text: "Only runs with this correlation id." }, "vm-id": { text: "Only runs that used this VM." }, ...PAGE2 } }, [COMMANDS.RUN_GET]: { summary: "Show one run: status, timing and the result of the task.", usage: ["ignitify run:get <run-id> [--full]"], args: { "run-id": "The run id, from task:run or run:list." }, flags: { full: { text: "Print the whole run as JSON, every field the API returns." } } }, [COMMANDS.RUN_LOGS]: { summary: "Print the console output of a run, as the task wrote it.", usage: ["ignitify run:logs <run-id> [--raw]"], args: { "run-id": "The run id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.RUN_DELETE]: { summary: "Delete the record of a run; does not stop a live run.", usage: ["ignitify run:delete <run-id> [--yes]"], args: { "run-id": "The run id." }, flags: YES2 }, [COMMANDS.RUN_CANCEL]: { summary: "Stop a live run, gracefully by default.", usage: ["ignitify run:cancel <run-id> [--yes] [--force] [--grace <ms>]"], args: { "run-id": "The run id." }, flags: { ...YES2, force: { text: "Kill the run now. Also needed when the run is on a pinned VM." }, grace: { text: "Ask for a longer wind-down, in milliseconds. The server limits it." } } }, [COMMANDS.VM_LIST]: { summary: "List your live VMs with their state, age and idle time.", usage: ["ignitify vm:list [--pinned] [--deployment-id D] [--task-name N] [--preset P] [--older-than 24h] [--limit N] [--after-id <vm-id>] [--after <iso>]"], flags: { pinned: { text: "Only pinned VMs: they stay up until you delete them." }, "deployment-id": { text: "Only VMs of this deployment." }, "task-name": { text: "Only VMs of this task." }, preset: { text: "Only VMs of this instance class." }, "older-than": { text: "Only VMs older than this age, for example 24h." }, limit: PAGE2.limit, "after-id": { text: "Page cursor: the VM id of the last row of the page before." }, after: { text: "Only VMs booted after this ISO 8601 time." } } }, [COMMANDS.VM_GET]: { summary: "Show one VM: residency, state, age and its task nature.", usage: ["ignitify vm:get <vm-id>"], args: { "vm-id": "The VM id, from vm:list." } }, [COMMANDS.VM_DELETE]: { summary: "Tear down a VM by hand.", usage: ["ignitify vm:delete <vm-id> [--yes] [--force]"], args: { "vm-id": "The VM id." }, flags: { ...YES2, force: { text: "Allow the delete of a pinned VM. It does not skip the question." } } }, [COMMANDS.SECRET_SET]: { summary: "Store a secret value under a name, read from stdin.", usage: ["ignitify secret:set <NAME> --stdin"], args: { NAME: "The secret name. List it in `secrets` in task.yaml to use it." }, flags: { stdin: { text: "Read the value from stdin. A value on the command line is refused." } }, examples: ['printf %s "$VALUE" | ignitify secret:set DB_PASSWORD --stdin'] }, [COMMANDS.SECRET_LIST]: { summary: "List the names of your secrets.", usage: ["ignitify secret:list"] }, [COMMANDS.SECRET_DELETE]: { summary: "Delete a secret.", usage: ["ignitify secret:delete <NAME> [--yes]"], args: { NAME: "The secret name." }, flags: YES2 }, [COMMANDS.INTEGRATION_ADD]: { summary: "Add an integration package to a Node task and write its settings into task.yaml.", usage: ["ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]"], args: { name: "The integration name. The npm package is @ignitify-integrations/<name>." }, flags: { task: { text: "The task folder name to add the integration to." }, yes: { text: "Apply the plan without the question (needed when not interactive)." }, "dry-run": { text: "Show the plan, then stop. Nothing in the task is changed." }, ...DIR2 }, notes: ["It downloads the latest @ignitify-integrations/<name> with npm pack into a temporary folder and reads the plan from that file. Nothing in the task changes before you answer y.", "The plan shows every task.yaml change, then what you add yourself: secret values and hosts that differ per task.", "After y (or with --yes), it runs npm install @ignitify-integrations/<name>@<that version> in the task folder (a normal dependency, with --ignore-scripts as the build uses), then writes task.yaml. If the install fails, task.yaml is not written.", "An N, --dry-run or a refusal changes nothing: no package.json, lockfile, node_modules or task.yaml change.", "A setting that conflicts with task.yaml, or more egress hosts than the platform allows, is refused and nothing is written.", "Adding the same integration again changes nothing. To upgrade, add it again. To remove it, run npm uninstall; the settings it added stay yours to delete."], examples: ["ignitify integration:add s3-storage --task launch-event", "ignitify integration:add stream --task launch-event --dry-run"] }, [COMMANDS.SCHEDULE_LIST]: { summary: "List runs that wait for a time, soonest first.", usage: ["ignitify schedule:list"] }, [COMMANDS.SCHEDULE_CANCEL]: { summary: "Cancel one scheduled run so that it never fires.", usage: ["ignitify schedule:cancel <sch-id> [--yes]"], args: { "sch-id": "The schedule id, from task:run --at or schedule:list." }, flags: YES2, notes: ['"0 rows" means it is already firing or fired.'] }, [COMMANDS.HOOK_CREATE]: { summary: "Create a webhook that starts a run of one task.", usage: ["ignitify hook:create <deployment-id> --task-name <name>"], args: { "deployment-id": "The deployment the webhook belongs to." }, flags: { "task-name": { text: "The task that each run starts. Required." } }, notes: ["The reply carries a `secret` shown ONCE: hook:list never returns it."] }, [COMMANDS.HOOK_LIST]: { summary: "List the webhooks of a deployment.", usage: ["ignitify hook:list <deployment-id> [--limit N] [--after-id <id>] [--after <iso>]"], args: { "deployment-id": "The deployment id." }, flags: PAGE2 }, [COMMANDS.HOOK_DELETE]: { summary: "Delete a webhook.", usage: ["ignitify hook:delete <hook-resource-id> [--yes]"], args: { "hook-resource-id": "The HOOK's id (hok_\u2026), not the deployment's." }, flags: YES2 }, [COMMANDS.NOTIFY_SET]: { summary: "Set or clear the callback URL of a deployment.", usage: ["ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin", "ignitify notify:set <deployment-id> --clear"], args: { "deployment-id": "The deployment id." }, flags: { url: { text: "The HTTPS address to call. Needs --secret-stdin." }, "secret-stdin": { text: "Read the signing secret from stdin. Needed with --url." }, clear: { text: "Remove the callback URL. Cannot be used with --url." } }, notes: ["There is no --secret flag: a value on argv is in `ps` and in your shell history."] }, [COMMANDS.USAGE]: { summary: "Show what you used in one month, by axis.", usage: [`ignitify usage [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] [--runs|--vms] [--json]`], flags: { period: { text: "The month to show, as YYYY-MM.", default: "this month" }, axis: { text: "Show one axis only." }, vm: { text: "Only the usage of this VM." }, run: { text: "Only the usage of this run." }, runs: { text: "Add the lines behind the totals, one per run." }, vms: { text: "Add the lines behind the totals, one per VM." }, json: { text: "Print the report as JSON." } } }, [COMMANDS.USAGE_EXPORT]: { summary: "Export the usage lines of a month as JSON or CSV.", usage: [`ignitify usage:export [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] (--json|--csv)`], flags: { period: { text: "The month to export, as YYYY-MM.", default: "this month" }, axis: { text: "Export one axis only." }, vm: { text: "Only the lines of this VM." }, run: { text: "Only the lines of this run." }, json: { text: "Print the lines as a JSON array." }, csv: { text: "Print the lines as CSV." } }, notes: ["Name exactly one format: --json or --csv."] } }, HELP_PAGE = { TITLE: "ignitify", TAGLINE: "create, deploy and run tasks", USAGE: "ignitify <command> [arguments] [flags]", USAGE_NOTE: "Every command is <resource>:<verb>.", QUICK_START: [{ command: "ignitify login", text: "Sign this machine in." }, { command: "ignitify task:create my-task", text: "Register a task and write its files." }, { command: "ignitify task:deploy my-task", text: "Build it on the platform." }, { command: "ignitify task:run my-task --wait", text: "Run it and print the result." }], GROUPS: [{ title: "Tasks", resources: ["task"] }, { title: "Deployments", resources: ["deployment"] }, { title: "Runs", resources: ["run"] }, { title: "VMs", resources: ["vm"] }, { title: "Secrets", resources: ["secret"] }, { title: "Integrations", resources: ["integration"] }, { title: "Schedules", resources: ["schedule"] }, { title: "Webhooks", resources: ["hook", "notify"] }, { title: "Account and usage", resources: ["login", "logout", "whoami", "quota", "usage", "help"] }], GLOBAL_FLAGS: [{ flag: "--json", text: "Print the result as one JSON document on stdout." }, { flag: "-h, --help", text: "Print help for the command." }, { flag: "-y, --yes", text: "Answer yes to a delete's question (for scripts)." }, { flag: "-v, --version", text: "Print the client and API version (first word only)." }], ENV: [{ name: ENV.KEY, text: "Your API key, for CI. Wins over the saved login." }, { name: ENV.TASKS_DIR, text: `Folder that holds your task folders (default: ${DEFAULT_TASKS_DIR}).` }, { name: "NO_COLOR", text: "Set to any value to turn colour off." }], NOTES: ["Delete commands always ask first; --force unlocks a refusal, it does not skip the question.", "A flag or argument a command does not take is refused, not ignored.", "On error the CLI prints a clean message and exits non-zero."], DOCS: "https://ignitify.dev/docs", MORE: "Run 'ignitify <command> --help' for the flags of one command.", H: { USAGE: "Usage", QUICK_START: "Quick start", GLOBAL_FLAGS: "Global flags", ENV: "Environment", NOTES: "Good to know", DOCS: "Docs", DESCRIPTION: "Description", ARGUMENTS: "Arguments", FLAGS: "Flags", EXAMPLES: "Examples" }, COLUMNS: { COMMAND: "COMMAND", WHAT: "WHAT IT DOES", FLAG: "FLAG", VALUE: "VALUE", DEFAULT: "DEFAULT", DESCRIPTION: "DESCRIPTION", NAME: "NAME", ARG: "ARGUMENT" }, SWITCH: "switch", DEFAULT: (value) => `Default: ${value}.`, REQUIRED: "required" };
+  OWNER_ONLY = "Needs an owner key (from ignitify login). A user key is refused with owner-required.", PERMISSION_NOTES = [ACCESS.TASKS_WRITE_NOTE, ACCESS.SECRETS_READ_NOTE, ACCESS.HOOKS_WRITE_NOTE], AXES = USAGE_AXES.join("|"), DIR2 = { dir: { text: "Folder that holds your task folders.", default: `$${ENV.TASKS_DIR}, else ${DEFAULT_TASKS_DIR}` } }, YES2 = { yes: { text: "Skip the question (needed when not interactive)." } }, RAW2 = { raw: { text: "Print the bytes exactly as received. Without it, the colours are kept on a colour terminal and every other control code is removed." } }, SERIES_DAYS = { days: { text: `How many UTC days to show, today included. More than ${92} is read as ${92}.`, default: `${30}` } }, FAILURES_DAYS = { days: { text: `How many UTC days to show, today included. More than ${31} is read as ${31}.`, default: `${30}` } }, PAGE2 = { limit: { text: "Rows on the page. The server sets the default and the largest value." }, "after-id": { text: "Page cursor: the id of the last row of the page before." }, after: { text: "Only rows after this ISO 8601 time." } }, VERSION_HELP = { summary: "Print the client version, and the API version if the server answers.", usage: ["ignitify --version"], notes: ["Needs no key. Warns when this client is older than the API supports."] }, COMMAND_HELP = { [COMMANDS.HELP]: { summary: "Print the usage of every command, or of one command.", usage: ["ignitify help [<command>]"], args: { command: "A command name. Leave it out to print every command." }, notes: ["`ignitify <command> --help` prints the same page."], examples: ["ignitify help task:run"] }, [COMMANDS.LOGIN]: { summary: "Sign this machine in and save its API key.", usage: ["ignitify login [--name <label>] [--no-browser]"], flags: { name: { text: "A label for this machine's key; keeps two machines with one hostname apart.", default: "the hostname" }, "no-browser": { text: "Print the sign-in page, but do not open it." } }, notes: ["The key is saved in ~/.config/ignitify/credentials.json (mode 0600)."], examples: ["ignitify login", "ignitify login --name build-server --no-browser"] }, [COMMANDS.LOGOUT]: { summary: "Revoke this machine's key and delete the saved file.", usage: ["ignitify logout"] }, [COMMANDS.WHOAMI]: { summary: "Show who your key belongs to, your limits and usage.", usage: ["ignitify whoami"] }, [COMMANDS.QUOTA]: { summary: "Show what you hold now against your limits.", usage: ["ignitify quota"] }, [COMMANDS.TASK_CREATE]: { summary: "Register a task name and write its starter files.", usage: ["ignitify task:create <task-id> [--lang node|python|go|rust] [--local] [--no-init] [--no-scaffold] [--dir <base-dir>]"], args: { "task-id": "The task name: also the folder name and the slug in task.yaml." }, flags: { lang: { text: "Language of the starter files.", default: "node" }, local: { text: "Write the files only. Calls no server and needs no key." }, "no-init": { text: "Write the short starter that has only run(), without init code." }, "no-scaffold": { text: "Register the task name but write no files." }, ...DIR2 }, examples: ["ignitify task:create image-resize", "ignitify task:create image-resize --lang python --local"] }, [COMMANDS.TASK_LIST]: { summary: "List your tasks, one page at a time.", usage: ["ignitify task:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.TASK_GET]: { summary: "Report a task's deploys, runs and next-step verdicts.", usage: ["ignitify task:get <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2, notes: ["Shows whether the next deploy builds a new image and the next run boots a new VM, with the reasons."] }, [COMMANDS.TASK_VALIDATE]: { summary: "Check task.yaml on your machine; builds nothing.", usage: ["ignitify task:validate <task-id> [--dir <base-dir>] [--review-packages]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, "review-packages": { text: "Then ask the server for an AI review of build.system_packages." } }, notes: ["The review is advice only: the exit code never changes.", "Only package names and the runtime id leave this machine; never code, slug or secrets.", "It also checks that task.yaml still covers each @ignitify-integrations/* package in package.json. A listed package that is not in node_modules stops the check: run npm install first.", "With integrations installed, it sends their package names to the public npm registry (registry.npmjs.org) to find obsolete versions: a warning only. With no network, that warning is skipped with a note."] }, [COMMANDS.TASK_PACK]: { summary: "List the files task:deploy would upload; builds nothing.", usage: ["ignitify task:pack <task-id> [--dir <base-dir>]"], args: { "task-id": "The task folder name." }, flags: DIR2 }, [COMMANDS.TASK_DEPLOY]: { summary: "Upload the task source and wait until the image is built.", usage: ["ignitify task:deploy <task-id> [--dir <base-dir>] [--check]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, check: { text: "Run every local check, then stop. Nothing is uploaded." } }, notes: ["Ctrl+C stops waiting, not the build."], examples: ["ignitify task:deploy image-resize", "ignitify task:deploy image-resize --check"] }, [COMMANDS.TASK_RUN]: { summary: "Start one run of a task from its latest deployment.", usage: ["ignitify task:run <task-id> [--dir <base-dir>] [--deployment <id>] [--payload <json>] [--timeout-sec <n>] [--on-busy queue|reject] [--at <iso>] [--idempotency-key <key>] [--wait]"], args: { "task-id": "The task folder name." }, flags: { ...DIR2, deployment: { text: "Run this deployment instead of the task's latest deploy.", default: "the task's latest deploy" }, payload: { text: "JSON input for this run only.", default: "run.payload from task.yaml" }, "timeout-sec": { text: "Time limit in seconds for this run only.", default: "run.timeout_sec from task.yaml" }, "on-busy": { text: "When the run cannot start at once: queue waits for room (a limited time), reject fails at once.", default: "queue" }, at: { text: "Schedule the run for this ISO 8601 time. No run exists until it fires." }, "idempotency-key": { text: "Start at most one run for this key (8 to 255 characters of A-Z a-z 0-9 . _ : -). A retry with the same key gets the first answer again." }, wait: { text: "Follow the run to its end, then print it with its result." } }, notes: ["With --wait the exit code is 0 only when the run is COMPLETED. Ctrl+C stops waiting, not the run.", "--payload and --timeout-sec apply to this run only; task.yaml is never written.", "A bidirectional task runs one VM at a time; --on-busy covers that case too.", "Use --idempotency-key when a script retries after a network error. Use a new key for each new run; the same key with a different run is refused. Pin --deployment in such a script: a new deploy between two tries changes the request."], examples: ["ignitify task:run image-resize --wait", `ignitify task:run image-resize --payload '{"width":320}'`, "ignitify task:run image-resize --at 2027-01-15T03:00:00Z"] }, [COMMANDS.TASK_DELETE]: { summary: "Delete a task with all its deployments and runs.", usage: ["ignitify task:delete <task-id> [--dir <base-dir>] [--yes] [--json]"], args: { "task-id": "The task folder name, or the task id." }, flags: { ...DIR2, ...YES2, json: { text: "Print the plan and the result as one JSON document." } }, notes: ["Also removes the .ignitify/ link of every local folder linked to it; your files are kept."] }, [COMMANDS.DEPLOYMENT_LIST]: { summary: "List your deployments with the size of each image.", usage: ["ignitify deployment:list [--limit N] [--after-id <id>] [--after <iso>]"], flags: PAGE2 }, [COMMANDS.DEPLOYMENT_GET]: { summary: "Show one deployment: status, size, integrity.", usage: ["ignitify deployment:get <deployment-id>"], args: { "deployment-id": "The deployment id, from task:deploy or deployment:list." } }, [COMMANDS.DEPLOYMENT_LOGS]: { summary: "Print the build log of a deployment, as the build wrote it.", usage: ["ignitify deployment:logs <deployment-id> [--raw]"], args: { "deployment-id": "The deployment id." }, flags: RAW2, notes: ["The output goes to stdout; a truncated answer says so on stderr."] }, [COMMANDS.DEPLOYMENT_DELETE]: { summary: "Delete a deployment together with its runs.", usage: ["ignitify deployment:delete <deployment-id> [--yes]"], args: { "deployment-id": "The deployment id." }, flags: YES2 }, [COMMANDS.RUN_LIST]: { summary: "List your runs, with filters.", usage: ["ignitify run:list [--status S] [--deployment-id D] [--task-name N] [--preset P] [--correlation-id C] [--vm-id V] [--limit N] [--after-id <id>] [--after <iso>]"], flags: { status: { text: "Only runs in this status, for example FAILED." }, "deployment-id": { text: "Only runs of this deployment." }, "task-name": { text: "Only runs of this task." }, preset: { text: "Only runs on this instance class." }, "correlation-id": { text: "Only runs with this correlation id." }, "vm-id": { text: "Only runs that used this VM." }, ...PAGE2 } }, [COMMANDS.RUN_GET]: { summary: "Show one run: status, timing and the result of the task.", usage: ["ignitify run:get <run-id> [--full]"], args: { "run-id": "The run id, from task:run or run:list." }, flags: { full: { text: "Print the whole run as JSON, every field the API returns." } } }, [COMMANDS.RUN_LOGS]: { summary: "Print the console output of a run, as the task wrote it.", usage: ["ignitify run:logs <run-id> [--follow] [--tail N] [--raw]"], args: { "run-id": "The run id." }, flags: { ...RAW2, follow: { text: "Keep printing new output until the run has ended." }, tail: { text: "Print only the last N lines of the output so far. With --follow, go on from there." } }, notes: ["Output is best-effort. The host keeps it for 30 days at most. A read that is cut at the size cap says so on stderr. Use --follow to watch a live run.", "The output goes to stdout. With --json and --follow or --tail, each chunk is one JSON line with the offset to read from next.", "Ctrl+C stops following, not the run."], examples: ["ignitify run:logs <run-id> --follow", "ignitify run:logs <run-id> --tail 50"] }, [COMMANDS.RUN_TIMELINE]: { summary: "Show what happened to a run: one line per event, then how it ended.", usage: ["ignitify run:timeline <run-id> [--follow]"], args: { "run-id": "The run id." }, flags: { follow: { text: "Keep printing new events until the run has ended." } }, notes: ["When the run has ended, the exit code is 0 only when it is COMPLETED. A live run read without --follow exits 0.", "With --json --follow, each page of events is one JSON line. Ctrl+C stops following, not the run."], examples: ["ignitify run:timeline <run-id> --follow"] }, [COMMANDS.RUN_FAILURES]: { summary: "Show how your runs failed: by class, then the tasks that fail most.", usage: ["ignitify run:failures [--days N] [--json]"], flags: { ...FAILURES_DAYS, json: { text: "Print the report as JSON." } }, notes: ["A failure is a run that ended FAILED or CANCELLED. The task list leaves out cancelled runs.", "Classes: task (your code or deployment), limit (a plan limit), cancelled, platform (our side)."], examples: ["ignitify run:failures", "ignitify run:failures --days 7"] }, [COMMANDS.NOTIFICATION_LIST]: { summary: "List your notifications and alerts, newest first.", usage: ["ignitify notification:list [--unread | --open] [--kind <kind>] [--limit N] [--json]"], flags: { unread: { text: "Only the notifications you have not read." }, open: { text: "Only the alerts that are still open." }, kind: { text: `Only this kind: ${NOTIFICATION_KINDS.join(", ")}.` }, limit: { text: `How many to show. More than ${NOTIFICATION_PAGE_MAX} is read as ${NOTIFICATION_PAGE_MAX}.`, default: `${NOTIFICATION_PAGE_DEFAULT}` }, json: { text: "Print the page as JSON." } }, notes: [`We keep notifications for ${NOTIFICATION_RETENTION_DAYS} days. Mark them read in the app; this command does not change them.`], examples: ["ignitify notification:list --unread", "ignitify notification:list --open --json"] }, [COMMANDS.RUN_DELETE]: { summary: "Delete the record of a run; does not stop a live run.", usage: ["ignitify run:delete <run-id> [--yes]"], args: { "run-id": "The run id." }, flags: YES2 }, [COMMANDS.RUN_CANCEL]: { summary: "Stop a live run, gracefully by default.", usage: ["ignitify run:cancel <run-id> [--yes] [--force] [--grace <ms>]"], args: { "run-id": "The run id." }, flags: { ...YES2, force: { text: "Kill the run now. Also needed when the run is on a pinned VM." }, grace: { text: "Ask for a longer wind-down, in milliseconds. The server limits it." } } }, [COMMANDS.VM_LIST]: { summary: "List your live VMs with their state, age and idle time.", usage: ["ignitify vm:list [--pinned] [--deployment-id D] [--task-name N] [--preset P] [--older-than 24h] [--limit N] [--after-id <vm-id>] [--after <iso>]"], flags: { pinned: { text: "Only pinned VMs: they stay up until you delete them." }, "deployment-id": { text: "Only VMs of this deployment." }, "task-name": { text: "Only VMs of this task." }, preset: { text: "Only VMs of this instance class." }, "older-than": { text: "Only VMs older than this age, for example 24h." }, limit: PAGE2.limit, "after-id": { text: "Page cursor: the VM id of the last row of the page before." }, after: { text: "Only VMs booted after this ISO 8601 time." } } }, [COMMANDS.VM_GET]: { summary: "Show one VM: residency, state, age and its task nature.", usage: ["ignitify vm:get <vm-id>"], args: { "vm-id": "The VM id, from vm:list." } }, [COMMANDS.VM_DELETE]: { summary: "Tear down a VM by hand.", usage: ["ignitify vm:delete <vm-id> [--yes] [--force]"], args: { "vm-id": "The VM id." }, flags: { ...YES2, force: { text: "Allow the delete of a pinned VM. It does not skip the question." } } }, [COMMANDS.SECRET_SET]: { summary: "Store a secret value under a name, read from stdin.", usage: ["ignitify secret:set <NAME> --stdin"], args: { NAME: "The secret name. List it in `secrets` in task.yaml to use it." }, flags: { stdin: { text: "Read the value from stdin. A value on the command line is refused." } }, examples: ['printf %s "$VALUE" | ignitify secret:set DB_PASSWORD --stdin'] }, [COMMANDS.SECRET_LIST]: { summary: "List the names of your secrets.", usage: ["ignitify secret:list"] }, [COMMANDS.SECRET_DELETE]: { summary: "Delete a secret.", usage: ["ignitify secret:delete <NAME> [--yes]"], args: { NAME: "The secret name." }, flags: YES2 }, [COMMANDS.INTEGRATION_ADD]: { summary: "Add an integration package to a Node task and write its settings into task.yaml.", usage: ["ignitify integration:add <name> --task <slug> [--yes | --dry-run] [--dir <base-dir>]"], args: { name: "The integration name. The npm package is @ignitify-integrations/<name>." }, flags: { task: { text: "The task folder name to add the integration to." }, yes: { text: "Apply the plan without the question (needed when not interactive)." }, "dry-run": { text: "Show the plan, then stop. Nothing in the task is changed." }, ...DIR2 }, notes: ["It downloads the latest @ignitify-integrations/<name> with npm pack into a temporary folder and reads the plan from that file. Nothing in the task changes before you answer y.", "The plan shows every task.yaml change, then what you add yourself: secret values and hosts that differ per task.", "After y (or with --yes), it runs npm install @ignitify-integrations/<name>@<that version> in the task folder (a normal dependency, with --ignore-scripts as the build uses), then writes task.yaml. If the install fails, task.yaml is not written.", "An N, --dry-run or a refusal changes nothing: no package.json, lockfile, node_modules or task.yaml change.", "A setting that conflicts with task.yaml, or more egress hosts than the platform allows, is refused and nothing is written.", "Adding the same integration again changes nothing. To upgrade, add it again. To remove it, run npm uninstall; the settings it added stay yours to delete."], examples: ["ignitify integration:add s3-storage --task launch-event", "ignitify integration:add stream --task launch-event --dry-run"] }, [COMMANDS.SCHEDULE_LIST]: { summary: "List runs that wait for a time, soonest first.", usage: ["ignitify schedule:list"] }, [COMMANDS.SCHEDULE_CANCEL]: { summary: "Cancel one scheduled run so that it never fires.", usage: ["ignitify schedule:cancel <sch-id> [--yes]"], args: { "sch-id": "The schedule id, from task:run --at or schedule:list." }, flags: YES2, notes: ['"0 rows" means it is already firing or fired.'] }, [COMMANDS.HOOK_CREATE]: { summary: "Create a webhook that starts a run of one task.", usage: ["ignitify hook:create <deployment-id> --task-name <name>"], args: { "deployment-id": "The deployment the webhook belongs to." }, flags: { "task-name": { text: "The task that each run starts. Required." } }, notes: ["The reply carries a `secret` shown ONCE: hook:list never returns it."] }, [COMMANDS.HOOK_LIST]: { summary: "List the webhooks of a deployment.", usage: ["ignitify hook:list <deployment-id> [--limit N] [--after-id <id>] [--after <iso>]"], args: { "deployment-id": "The deployment id." }, flags: PAGE2 }, [COMMANDS.HOOK_DELETE]: { summary: "Delete a webhook.", usage: ["ignitify hook:delete <hook-resource-id> [--yes]"], args: { "hook-resource-id": "The HOOK's id (hok_\u2026), not the deployment's." }, flags: YES2 }, [COMMANDS.NOTIFY_SET]: { summary: "Set or clear the callback URL of a deployment.", usage: ["ignitify notify:set <deployment-id> --url <https://\u2026> --secret-stdin", "ignitify notify:set <deployment-id> --clear"], args: { "deployment-id": "The deployment id." }, flags: { url: { text: "The HTTPS address to call. Needs --secret-stdin." }, "secret-stdin": { text: "Read the signing secret from stdin. Needed with --url." }, clear: { text: "Remove the callback URL. Cannot be used with --url." } }, notes: ["There is no --secret flag: a value on argv is in `ps` and in your shell history."] }, [COMMANDS.USAGE]: { summary: "Show what you used in one month, by axis.", usage: [`ignitify usage [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] [--runs|--vms] [--json]`], flags: { period: { text: "The month to show, as YYYY-MM.", default: "this month" }, axis: { text: "Show one axis only." }, vm: { text: "Only the usage of this VM." }, run: { text: "Only the usage of this run." }, runs: { text: "Add the lines behind the totals, one per run." }, vms: { text: "Add the lines behind the totals, one per VM." }, json: { text: "Print the report as JSON." } } }, [COMMANDS.USAGE_EXPORT]: { summary: "Export the usage lines of a month as JSON or CSV.", usage: [`ignitify usage:export [--period YYYY-MM] [--axis ${AXES}] [--vm <vm-id>] [--run <run-id>] (--json|--csv)`], flags: { period: { text: "The month to export, as YYYY-MM.", default: "this month" }, axis: { text: "Export one axis only." }, vm: { text: "Only the lines of this VM." }, run: { text: "Only the lines of this run." }, json: { text: "Print the lines as a JSON array." }, csv: { text: "Print the lines as CSV." } }, notes: ["Name exactly one format: --json or --csv."] }, [COMMANDS.USAGE_SERIES]: { summary: "Show your usage per day: runs, run durations, compute and egress.", usage: ["ignitify usage:series [--days N] [--json]"], flags: { ...SERIES_DAYS, json: { text: "Print the series as JSON." } }, notes: ["Days are UTC. A run counts on the day it ended. Compute counts when the VM closes, so a running VM shows none yet."], examples: ["ignitify usage:series", "ignitify usage:series --days 7 --json"] }, [COMMANDS.PERMISSION_LIST]: { summary: "List every permission a group can grant, and what it allows.", usage: ["ignitify permission:list [--json]"], notes: ["Needs no key and no server: the list is built into the CLI.", ...PERMISSION_NOTES] }, [COMMANDS.USER_CREATE]: { summary: "Create a user: a name that holds keys and is in groups.", usage: ["ignitify user:create <name> [--json]"], args: { name: "1 to 63 lower case letters, digits and -, unique in your account." }, notes: ["A user has no password and cannot sign in. Add it to a group to give it permissions.", OWNER_ONLY], examples: ["ignitify user:create github-ci"] }, [COMMANDS.USER_LIST]: { summary: "List your users.", usage: ["ignitify user:list [--json]"], notes: [OWNER_ONLY] }, [COMMANDS.USER_GET]: { summary: "Show one user: its groups, permissions and live keys.", usage: ["ignitify user:get <name> [--json]"], args: { name: "The user name." }, notes: [OWNER_ONLY] }, [COMMANDS.USER_REMOVE]: { summary: "Remove a user and revoke all of its keys.", usage: ["ignitify user:remove <name> [--yes]"], args: { name: "The user name." }, flags: YES2, notes: ["Every key of the user stops working at once. The name can be used again.", OWNER_ONLY] }, [COMMANDS.GROUP_CREATE]: { summary: "Create a group with a set of permissions.", usage: ["ignitify group:create <name> --permissions <p1,p2,\u2026> [--json]"], args: { name: "1 to 63 lower case letters, digits and -, unique in your account." }, flags: { permissions: { text: "The permissions the group grants, comma-separated. Required. See permission:list." } }, notes: [...PERMISSION_NOTES, OWNER_ONLY], examples: ["ignitify group:create readers --permissions tasks.read,deployments.read,runs.read,usage.read", "ignitify group:create ci --permissions tasks.read,deployments.read,deployments.write,runs.read,runs.write"] }, [COMMANDS.GROUP_LIST]: { summary: "List your groups and their permissions.", usage: ["ignitify group:list [--json]"], notes: [OWNER_ONLY] }, [COMMANDS.GROUP_GET]: { summary: "Show one group: its permissions and users.", usage: ["ignitify group:get <name> [--json]"], args: { name: "The group name." }, notes: [OWNER_ONLY] }, [COMMANDS.GROUP_GRANT]: { summary: "Add one permission to a group.", usage: ["ignitify group:grant <name> <permission>"], args: { name: "The group name.", permission: "One permission from permission:list." }, notes: [...PERMISSION_NOTES, OWNER_ONLY], examples: ["ignitify group:grant readers secrets.read"] }, [COMMANDS.GROUP_REVOKE]: { summary: "Remove one permission from a group.", usage: ["ignitify group:revoke <name> <permission>"], args: { name: "The group name.", permission: "The permission to remove." }, notes: ["The users of the group lose it at their next request.", OWNER_ONLY] }, [COMMANDS.GROUP_ADD_USER]: { summary: "Put a user in a group.", usage: ["ignitify group:add-user <group> <user>"], args: { group: "The group name.", user: "The user name." }, notes: [OWNER_ONLY], examples: ["ignitify group:add-user ci github-ci"] }, [COMMANDS.GROUP_REMOVE_USER]: { summary: "Take a user out of a group.", usage: ["ignitify group:remove-user <group> <user>"], args: { group: "The group name.", user: "The user name." }, notes: ["The user and its keys stay; they lose what the group granted.", OWNER_ONLY] }, [COMMANDS.GROUP_DELETE]: { summary: "Delete a group. Its users and keys stay.", usage: ["ignitify group:delete <name> [--yes]"], args: { name: "The group name." }, flags: YES2, notes: ["The users of the group lose the permissions it granted.", OWNER_ONLY] }, [COMMANDS.KEY_CREATE]: { summary: "Create an API key for a user.", usage: ["ignitify key:create --user <name> --label <text> [--out <file>] [--json]"], flags: { user: { text: "The user the key belongs to. Required." }, label: { text: "A name for the key, such as where it is used. Required." }, out: { text: "Write the key to this new file (mode 0600) and print only its id. Fails when the file exists." } }, notes: ["The key is shown once. Without --out it is printed; hand it over by hand and do not keep a copy.", "Owner keys come from ignitify login. This command makes user keys only.", OWNER_ONLY], examples: ["ignitify key:create --user github-ci --label github --out ./github-ci.key"] }, [COMMANDS.KEY_LIST]: { summary: "List the live keys of your account. Never a raw key.", usage: ["ignitify key:list [--user <name>] [--json]"], flags: { user: { text: "Only the keys of this user." } }, notes: ["The user column says owner for an owner key.", OWNER_ONLY] }, [COMMANDS.KEY_REVOKE]: { summary: "Revoke a key. It stops working at once.", usage: ["ignitify key:revoke <key-resource-id> [--yes]"], args: { "key-resource-id": "The key id, from key:list." }, flags: YES2, notes: [OWNER_ONLY] } }, HELP_PAGE = { TITLE: "ignitify", TAGLINE: "create, deploy and run tasks", USAGE: "ignitify <command> [arguments] [flags]", USAGE_NOTE: "Every command is <resource>:<verb>.", QUICK_START: [{ command: "ignitify login", text: "Sign this machine in." }, { command: "ignitify task:create my-task", text: "Register a task and write its files." }, { command: "ignitify task:deploy my-task", text: "Build it on the platform." }, { command: "ignitify task:run my-task --wait", text: "Run it and print the result." }], GROUPS: [{ title: "Tasks", resources: ["task"] }, { title: "Deployments", resources: ["deployment"] }, { title: "Runs", resources: ["run"] }, { title: "VMs", resources: ["vm"] }, { title: "Secrets", resources: ["secret"] }, { title: "Integrations", resources: ["integration"] }, { title: "Schedules", resources: ["schedule"] }, { title: "Webhooks", resources: ["hook", "notify"] }, { title: "Access", resources: ["permission", "user", "group", "key"] }, { title: "Account and usage", resources: ["login", "logout", "whoami", "quota", "usage", "notification", "help"] }], GLOBAL_FLAGS: [{ flag: "--json", text: "Print the result as one JSON document on stdout." }, { flag: "-h, --help", text: "Print help for the command." }, { flag: "-y, --yes", text: "Answer yes to a delete's question (for scripts)." }, { flag: "-v, --version", text: "Print the client and API version (first word only)." }], ENV: [{ name: ENV.KEY, text: "Your API key, for CI. Wins over the saved login." }, { name: ENV.TASKS_DIR, text: `Folder that holds your task folders (default: ${DEFAULT_TASKS_DIR}).` }, { name: "NO_COLOR", text: "Set to any value to turn colour off." }], NOTES: ["Delete commands always ask first; --force unlocks a refusal, it does not skip the question.", "A flag or argument a command does not take is refused, not ignored.", "On error the CLI prints a clean message and exits non-zero."], DOCS: SITE_LINKS.DOCS, MORE: "Run 'ignitify <command> --help' for the flags of one command.", H: { USAGE: "Usage", QUICK_START: "Quick start", GLOBAL_FLAGS: "Global flags", ENV: "Environment", NOTES: "Good to know", DOCS: "Docs", DESCRIPTION: "Description", ARGUMENTS: "Arguments", FLAGS: "Flags", EXAMPLES: "Examples" }, COLUMNS: { COMMAND: "COMMAND", WHAT: "WHAT IT DOES", FLAG: "FLAG", VALUE: "VALUE", DEFAULT: "DEFAULT", DESCRIPTION: "DESCRIPTION", NAME: "NAME", ARG: "ARGUMENT" }, SWITCH: "switch", DEFAULT: (value) => `Default: ${value}.`, REQUIRED: "required" };
 } });
 function entryOf(name) {
   if (name === VERSION_NAME) return { help: VERSION_HELP, meta: VERSION_META };
@@ -1942,7 +2102,7 @@ function placeholderOf(forms, flag) {
 }
 function flagRows(help, meta) {
   let words = help.flags ?? {}, known = { ...meta.flags, ...GLOBAL_FLAGS }, shortOf = Object.fromEntries(Object.entries(SHORT_FLAGS).map(([s, l]) => [l, s]));
-  return Object.entries(words).filter(([flag]) => Object.hasOwn(known, flag) && !HIDDEN_FLAGS.includes(flag)).map(([flag, w]) => {
+  return Object.entries(words).filter(([flag]) => Object.hasOwn(known, flag)).map(([flag, w]) => {
     let short = shortOf[flag], value = known[flag] === "value" ? placeholderOf(help.usage, flag) : HELP_PAGE.SWITCH, text = w.default === void 0 ? w.text : `${w.text} ${HELP_PAGE.DEFAULT(w.default)}`;
     return [short === void 0 ? `--${flag}` : `-${short}, --${flag}`, value, text];
   });
@@ -2068,11 +2228,17 @@ function explainLimitRefusal(e) {
   return typeof summary != "string" || summary === "" ? null : [`\u2717 Run refused \u2014 a monthly limit is reached (${typeof reason == "string" ? reason : "429"}).`, `  ${summary}`].join(`
 `);
 }
-var isPayloadTooLarge, init_run_refusal = __esm({ "src/output/run-refusal.ts"() {
+function idempotencyRefusal(e) {
+  let refused2 = httpErrorJson(e), hint = refused2 ? IDEMPOTENCY_REFUSAL_HINTS[refused2.status] : void 0, error = refused2?.body.error;
+  return !refused2 || hint === void 0 || typeof error != "string" || error === "" ? null : { error, hint };
+}
+var IDEMPOTENCY_REFUSAL_HINTS, isPayloadTooLarge, init_run_refusal = __esm({ "src/output/run-refusal.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
+  init_constants();
   init_tenant();
+  IDEMPOTENCY_REFUSAL_HINTS = { 409: MESSAGES.IDEMPOTENCY_IN_PROGRESS_HINT, 422: MESSAGES.IDEMPOTENCY_KEY_REUSED_HINT };
   isPayloadTooLarge = (e) => e instanceof HttpError && e.status === 413;
 } });
 function renderUsageReport(st, r, opts = { lines: false }) {
@@ -2096,6 +2262,77 @@ var init_usage2 = __esm({ "src/output/usage.ts"() {
   init_constants2();
   init_table();
 } });
+function attrText(value) {
+  return value === null || typeof value != "object" ? typeof value == "string" && !/^[\w.:/@+-]+$/.test(value) ? JSON.stringify(value) : String(value) : JSON.stringify(value.text);
+}
+function timelineLine(event) {
+  let attrs = Object.entries(event.attrs).filter(([key, value]) => key !== CAUSE_ATTR && value !== null).map(([key, value]) => `${key}=${attrText(value)}`), line = [event.at, event.label, ...attrs.length > 0 ? [attrs.join(" ")] : []].join("  ");
+  return terminalSafe(line, false).replace(/[\n\t]/g, " ");
+}
+var CAUSE_ATTR, init_timeline = __esm({ "src/output/timeline.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_style();
+  CAUSE_ATTR = "cause";
+} });
+function renderUsageSeries(st, r) {
+  let I2 = LAYOUT.INDENT, statusColumns = TERMINAL_RUN_STATUSES.map((s) => ({ header: s, keep: true })), table = renderTable(st, [{ header: "DAY", keep: true }, ...statusColumns, { header: "P50", keep: true }, { header: "P95", keep: true }, { header: "COMPUTE", keep: true }, { header: "EGRESS", keep: true }], r.series.map((d) => [d.day, ...TERMINAL_RUN_STATUSES.map((s) => runsIn(d, s)), durationText(st, d.duration_ms_p50), durationText(st, d.duration_ms_p95), formatUsageQuantity(d.compute_ms, AXIS_UNIT.compute), formatUsageQuantity(d.egress_bytes, AXIS_UNIT.network)]), { indent: I2 });
+  return [heading(st, `usage per day, ${windowText(r.days)}`), "", table, "", st.dim(`${I2}note: runs count on the day they ended; P50 and P95 are the run durations of that day.`), st.dim(`${I2}      \`compute\` = VM time, counted when the VM closes. The egress of a past day can still grow.`)].join(`
+`);
+}
+function renderFailures(st, r) {
+  let I2 = LAYOUT.INDENT, out2 = [heading(st, `failed and cancelled runs, ${windowText(r.days)}`), ""];
+  return out2.push(renderTable(st, [{ header: "CLASS", keep: true }, { header: "RUNS", keep: true }, { header: "MEANING" }], FAILURE_CLASSES.map((c) => [c, r.by_class[c], FAILURE_CLASS_TEXT[c].hint]), { indent: I2 }), ""), r.top_tasks.length === 0 ? (out2.push(st.dim(`${I2}No task failed in this window.`)), out2.join(`
+`)) : (out2.push(renderTable(st, [{ header: "TASK" }, { header: "FAILURES", keep: true }], r.top_tasks.map((t) => [t.task_name === null ? NO_TASK_NAME_TEXT : terminalSafe(t.task_name, false), t.failures]), { indent: I2 }), "", st.dim(`${I2}note: the task list leaves out cancelled runs.`)), out2.join(`
+`));
+}
+var windowText, runsIn, durationText, init_reports = __esm({ "src/output/reports.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_http_client();
+  init_blocks();
+  init_constants2();
+  init_style();
+  init_table();
+  windowText = (days) => `last ${days} ${days === 1 ? "day" : "days"} (UTC)`, runsIn = (day, status) => day.runs[status] ?? 0, durationText = (st, ms) => ms === null ? st.glyphs.dash : formatUsageQuantity(ms, AXIS_UNIT.compute);
+} });
+function severityWord(st, s) {
+  let word = s.toUpperCase();
+  return s === "critical" ? st.red(word) : s === "warning" ? st.yellow(word) : st.dim(word);
+}
+function factsOf(n) {
+  let facts = [];
+  return n.read || facts.push("unread"), n.state === "open" && facts.push("open"), n.state === "resolved" && n.resolved_at !== null && facts.push(`resolved ${terminalSafe(n.resolved_at, false)}`), n.occurrences > 1 && facts.push(`${n.occurrences} times`), facts;
+}
+function commandOf(a) {
+  return a.type === "open-run" ? `ignitify ${COMMANDS.RUN_GET} ${terminalSafe(a.run_id, false)}` : a.type === "usage" ? `ignitify ${COMMANDS.QUOTA}` : null;
+}
+function card(st, n) {
+  let I2 = LAYOUT.INDENT, title = terminalSafe(n.title, false), facts = factsOf(n), head = `${I2}${severityWord(st, n.severity)}  ${n.read ? title : st.bold(title)}${facts.length > 0 ? st.dim(`  (${facts.join(", ")})`) : ""}`, text = wrapText(terminalSafe(n.text, false), st.width - 2 * I2.length).map((l) => `${I2}${I2}${l}`), ids = [n.id, n.last_at, ...n.subject === null ? [] : [`${n.subject.type} ${n.subject.id}`]].map((s) => terminalSafe(s, false)), next = (n.actions ?? []).flatMap((a) => {
+    let cmd = commandOf(a);
+    return cmd === null ? [] : [`${I2}${I2}next: ${cmd}`];
+  });
+  return [head, ...text, st.dim(`${I2}${I2}${ids.join("  ")}`), ...next].join(`
+`);
+}
+function renderNotifications(st, r) {
+  let I2 = LAYOUT.INDENT;
+  return r.items.length === 0 ? `${heading(st, "notifications")}
+
+${st.dim(`${I2}No notifications.`)}` : [heading(st, "notifications, newest first"), "", r.items.map((n) => card(st, n)).join(`
+
+`)].join(`
+`);
+}
+var init_notifications = __esm({ "src/output/notifications.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_blocks();
+  init_constants2();
+  init_style();
+} });
 var init_output = __esm({ "src/output/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -2113,6 +2350,10 @@ var init_output = __esm({ "src/output/index.ts"() {
   init_deletion_plan();
   init_run_refusal();
   init_usage2();
+  init_timeline();
+  init_reports();
+  init_notifications();
+  init_access2();
 } });
 function planAdvice(config) {
   let declared = config.build?.system_packages ?? [];
@@ -2132,127 +2373,31 @@ var init_package_advice3 = __esm({ "src/core/package-advice.ts"() {
   init_constants();
 } });
 var version, init_package = __esm({ "package.json"() {
-  version = "1.2.2";
-} });
-var byCreatedAtDesc, init_sort = __esm({ "src/utils/sort.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  byCreatedAtDesc = (rows) => [...rows].sort((a, b) => (b.created_at ?? "").localeCompare(a.created_at ?? ""));
+  version = "2.0.0";
 } });
-function apiUrlOf(args) {
-  return strOpt(args, "api") ?? DEFAULTS.API_URL;
-}
-function boolFlag(args, key) {
-  return args.options[key] === true;
-}
-function requiredArg(args) {
-  return args.positionals[0];
-}
-function requireArg(args, label) {
-  let id = requiredArg(args);
-  return id || (fail(MESSAGES.ARG_REQUIRED(label)), null);
-}
-var init_args2 = __esm({ "src/utils/args.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_constants();
-  init_output();
-  init_http_client();
-  init_http_client();
-} });
-function traceLine(e) {
-  return e instanceof HttpError && e.traceId ? MESSAGES.SERVER_TRACE_ID(e.traceId) : null;
-}
-function keyExpiredHint(e) {
-  let refused2 = httpErrorJson(e);
-  return refused2?.status === 401 && refused2.body.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
+function apiUrlFor(env, release = RELEASE_BUILD) {
+  return release ? DEFAULTS.API_URL : env[ENV.DEV_API_URL] || DEFAULTS.API_URL;
 }
-function printError(e) {
-  fail(errText(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
-}
-async function guard(body) {
-  return await guardValue(body) ?? 1;
-}
-async function guardValue(body) {
-  try {
-    return await body();
-  } catch (e) {
-    printError(e);
-    return;
+function apiUrlRefusal(url) {
+  switch (keyUrlRefusal(url)) {
+    case "not-url":
+      return MESSAGES.API_URL_NOT_URL(url);
+    case "insecure":
+      return MESSAGES.API_URL_NOT_HTTPS(url);
+    case null:
+      return null;
   }
 }
-var init_guard = __esm({ "src/utils/guard.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
-  init_tenant();
-  init_constants();
-  init_output();
-} });
-var import_node_readline, ttyPrompter, init_prompt = __esm({ "src/io/prompt.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  import_node_readline = __toESM(require("node:readline"), 1);
-  init_output();
-  ttyPrompter = { async confirm(question) {
-    if (!process.stdin.isTTY) return fail("Refusing to proceed: not a TTY. Re-run with --yes to confirm non-interactively."), false;
-    let rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stderr });
-    try {
-      let answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
-      return /^y(es)?$/i.test(answer.trim());
-    } finally {
-      rl.close();
-    }
-  } };
-} });
-async function confirmOrAbort(args, prompter = ttyPrompter, question = MESSAGES.CONFIRM_PROCEED) {
-  return boolFlag(args, "yes") || await prompter.confirm(question) ? true : (say(MESSAGES.ABORTED), false);
-}
-var init_prompt_flow = __esm({ "src/utils/prompt-flow.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_prompt();
-  init_constants();
-  init_args2();
-  init_manager();
-} });
-var REAL_CLOCK, init_clock = __esm({ "src/utils/clock.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  REAL_CLOCK = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
-} });
-function snakeCaseKeys(value) {
-  return Array.isArray(value) ? value.map(snakeCaseKeys) : typeof value != "object" || value === null ? value : Object.fromEntries(Object.entries(value).map(([k, v]) => [k.replace(/([a-z0-9])([A-Z])/g, (_, a, b) => `${a}_${b.toLowerCase()}`), snakeCaseKeys(v)]));
-}
-var init_snake_case = __esm({ "src/utils/snake-case.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-} });
-function nextPageNoteFor2(args, list2, rows) {
-  return nextPageNoteFor(PROGRAM, args, { ...list2, flags: [...Object.keys(list2.flags), ...REPEATED_GLOBAL_FLAGS] }, rows, effectivePageLimit(strOpt(args, "limit")));
-}
-function limitRefusal(args) {
-  let raw = args.options.limit;
-  return typeof raw == "string" ? pageLimitRefusal(raw) : null;
+function assertApiUrl(url) {
+  let refusal = apiUrlRefusal(url);
+  if (refusal !== null) throw new Error(refusal);
+  return url;
 }
-var PROGRAM, REPEATED_GLOBAL_FLAGS, init_page2 = __esm({ "src/utils/page.ts"() {
+var init_api_url = __esm({ "src/core/api-url.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
-  init_tenant();
   init_http_client();
-  init_args2();
-  PROGRAM = "ignitify", REPEATED_GLOBAL_FLAGS = ["api"];
-} });
-var init_utils = __esm({ "src/utils/index.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_sort();
-  init_args2();
-  init_guard();
-  init_prompt_flow();
-  init_clock();
-  init_snake_case();
-  init_page2();
+  init_constants();
 } });
 function floorWarning(client, floor) {
   if (!floor) return null;
@@ -2280,8 +2425,8 @@ async function describeServer(baseUrl, fetchImpl = fetch, check = noteServerVers
   let floor = res.headers.get(CLIENT_FLOOR_HEADER);
   return `API: ${api} at ${baseUrl}${floor ? ` (minimum client ${floor})` : ""}`;
 }
-async function runVersion(args, fetchImpl = fetch) {
-  let baseUrl = apiUrlOf(args), st = outStyle();
+async function runVersion(fetchImpl = fetch, env = process.env) {
+  let baseUrl = apiUrlFor(env), st = outStyle();
   return out(`${st.bold(`ignitify ${CLIENT_VERSION}`)} ${st.dim(`(built for API ${API_VERSION})`)}`), out(st.dim(await describeServer(baseUrl, fetchImpl))), 0;
 }
 var CLIENT_VERSION, PROBE_TIMEOUT_MS, noteServerVersion, init_version = __esm({ "src/io/version.ts"() {
@@ -2291,7 +2436,7 @@ var CLIENT_VERSION, PROBE_TIMEOUT_MS, noteServerVersion, init_version = __esm({
   init_tenant();
   init_constants();
   init_semver();
-  init_utils();
+  init_api_url();
   init_output();
   CLIENT_VERSION = version, PROBE_TIMEOUT_MS = 3e3;
   noteServerVersion = createStalenessCheck(CLIENT_VERSION, (msg) => warn(msg));
@@ -2360,16 +2505,25 @@ function readCredentials(file = credentialsPath(), fsx = import_node_fs2.default
     fsx.closeSync(fd);
   }
 }
-function writeCredentialsAtomic(creds, file = credentialsPath(), fsx = import_node_fs2.default) {
-  secureCredentialsDir(import_node_path.default.dirname(file), fsx);
-  let temp = `${file}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`, fd = fsx.openSync(temp, "wx", CREDENTIALS.FILE_MODE);
+function createPrivateFile(file, fsx = import_node_fs2.default) {
+  return fsx.openSync(file, "wx", CREDENTIALS.FILE_MODE);
+}
+function discardPrivateFile(fd, file, fsx = import_node_fs2.default) {
+  fsx.closeSync(fd), fsx.unlinkSync(file);
+}
+function fillPrivateFile(fd, file, text, fsx = import_node_fs2.default) {
   try {
-    fsx.writeSync(fd, `${JSON.stringify(creds, null, 2)}
-`), fsx.fsyncSync(fd);
+    fsx.writeSync(fd, text), fsx.fsyncSync(fd);
   } catch (e) {
-    throw fsx.closeSync(fd), fsx.unlinkSync(temp), e;
+    throw discardPrivateFile(fd, file, fsx), e;
   }
   fsx.closeSync(fd);
+}
+function writeCredentialsAtomic(creds, file = credentialsPath(), fsx = import_node_fs2.default) {
+  secureCredentialsDir(import_node_path.default.dirname(file), fsx);
+  let temp = `${file}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
+  fillPrivateFile(createPrivateFile(temp, fsx), temp, `${JSON.stringify(creds, null, 2)}
+`, fsx);
   try {
     fsx.renameSync(temp, file);
   } catch (e) {
@@ -2440,29 +2594,8 @@ var UnreachableError, init_unreachable = __esm({ "src/core/unreachable.ts"() {
     }
   };
 } });
-function apiUrlRefusal(url) {
-  switch (keyUrlRefusal(url)) {
-    case "not-url":
-      return MESSAGES.API_URL_NOT_URL(url);
-    case "insecure":
-      return MESSAGES.API_URL_NOT_HTTPS(url);
-    case null:
-      return null;
-  }
-}
-function assertApiUrl(url) {
-  let refusal = apiUrlRefusal(url);
-  if (refusal !== null) throw new Error(refusal);
-  return url;
-}
-var init_api_url = __esm({ "src/core/api-url.ts"() {
-  "use strict";
-  init_define_IGNITIFY_CLIENT_FILES();
-  init_http_client();
-  init_constants();
-} });
-function resolveApiConfig(apiOverride, env = process.env, read = () => readCredentials(), note = noteEnvOverride) {
-  let baseUrl = assertApiUrl(apiOverride ?? DEFAULTS.API_URL), envKey = env[ENV.KEY];
+function resolveApiConfig(env = process.env, read = () => readCredentials(), note = noteEnvOverride) {
+  let baseUrl = assertApiUrl(apiUrlFor(env)), envKey = env[ENV.KEY];
   if (envKey) return envOverridesLogin(baseUrl, readOrNone(read)) && note(MESSAGES.ENV_KEY_OVERRIDES_LOGIN), { baseUrl, token: envKey };
   let saved = read();
   if (saved.kind === "none") throw new Error(MESSAGES.NOT_SIGNED_IN);
@@ -2536,9 +2669,11 @@ async function postDeployment(cfg, taskId, manifest, tar, fetchImpl) {
   let form = new FormData();
   return form.set("task_id", taskId), form.set("manifest", JSON.stringify(manifest)), form.set("bundle", new Blob([new Uint8Array(tar)], { type: "application/x-tar" }), "bundle.tar"), await request(`${cfg.baseUrl}${TENANT_PATHS.DEPLOYMENTS}`, { method: "POST", headers: authHeaders(cfg), body: form, fetchImpl: viaApi(fetchImpl), timeoutMs: 3e5, ...readHeaders });
 }
-function postRun(cfg, run2, fetchImpl) {
-  let body = { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at };
-  return apiPost(cfg, TENANT_PATHS.RUNS, body, fetchImpl);
+async function postRun(cfg, run2, fetchImpl) {
+  let body = { deployment_id: run2.deploymentId, task_name: run2.taskName, payload: run2.payload, preset: run2.preset, timeout_sec: run2.timeoutSec, execution: run2.execution, at: run2.at }, replayed = false;
+  return { answer: await apiPost(cfg, TENANT_PATHS.RUNS, body, fetchImpl, void 0, { headers: idempotencyHeaders(run2.idempotencyKey), onHeaders: (headers) => {
+    replayed = isReplayedAnswer(headers);
+  } }), replayed };
 }
 async function listSchedules(cfg, fetchImpl) {
   return apiGet(cfg, TENANT_PATHS.SCHEDULES, fetchImpl);
@@ -2549,8 +2684,10 @@ function deleteSchedule(cfg, scheduleId, fetchImpl) {
 function apiGet(cfg, path12, fetchImpl) {
   return request(`${cfg.baseUrl}${path12}`, { headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), ...readHeaders });
 }
-function apiPost(cfg, path12, body, fetchImpl, timeoutMs) {
-  return request(`${cfg.baseUrl}${path12}`, { method: "POST", headers: { ...authHeaders(cfg), "content-type": "application/json" }, body, fetchImpl: viaApi(fetchImpl), timeoutMs, ...readHeaders });
+function apiPost(cfg, path12, body, fetchImpl, timeoutMs, extras = {}) {
+  return request(`${cfg.baseUrl}${path12}`, { method: "POST", headers: { ...authHeaders(cfg), "content-type": "application/json", ...extras.headers }, body, fetchImpl: viaApi(fetchImpl), timeoutMs, onHeaders: (headers) => {
+    readHeaders.onHeaders(headers), extras.onHeaders?.(headers);
+  } });
 }
 function apiDelete(cfg, path12, fetchImpl) {
   return request(`${cfg.baseUrl}${path12}`, { method: "DELETE", headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), ...readHeaders });
@@ -2564,6 +2701,15 @@ function getWhoami(cfg, fetchImpl) {
 function getUsage(cfg, filters2 = {}, fetchImpl) {
   return apiGet(cfg, `${TENANT_PATHS.USAGE}${buildQuery(filters2)}`, fetchImpl);
 }
+function getUsageSeries(cfg, days, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.USAGE_SERIES}${daysQuery(days)}`, fetchImpl);
+}
+function getRunFailures(cfg, days, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.RUN_FAILURES}${daysQuery(days)}`, fetchImpl);
+}
+function listNotifications(cfg, params, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.NOTIFICATIONS}${buildQuery(params)}`, fetchImpl);
+}
 function setSecret(cfg, name, value, fetchImpl) {
   return apiPost(cfg, TENANT_PATHS.SECRETS, { name, value }, fetchImpl);
 }
@@ -2585,6 +2731,52 @@ function deleteHook(cfg, hookId, fetchImpl) {
 function setNotify(cfg, deploymentId, body, fetchImpl) {
   return apiPut(cfg, TENANT_PATHS.DEPLOYMENT_NOTIFY(deploymentId), body, fetchImpl);
 }
+function createUser(cfg, name, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.USERS, { name }, fetchImpl);
+}
+function listUsers(cfg, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.USERS, fetchImpl);
+}
+function getUser(cfg, name, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.USER_BY_ID(name), fetchImpl);
+}
+function deleteUser(cfg, name, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.USER_BY_ID(name), fetchImpl);
+}
+function createGroup(cfg, name, permissions, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.GROUPS, { name, permissions }, fetchImpl);
+}
+function listGroups(cfg, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.GROUPS, fetchImpl);
+}
+function getGroup(cfg, name, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.GROUP_BY_ID(name), fetchImpl);
+}
+function deleteGroup(cfg, name, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_BY_ID(name), fetchImpl);
+}
+function grantGroupPermission(cfg, name, permission, fetchImpl) {
+  return apiPut(cfg, TENANT_PATHS.GROUP_PERMISSION(name, permission), void 0, fetchImpl);
+}
+function revokeGroupPermission(cfg, name, permission, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_PERMISSION(name, permission), fetchImpl);
+}
+function addGroupUser(cfg, name, user, fetchImpl) {
+  return apiPut(cfg, TENANT_PATHS.GROUP_USER(name, user), void 0, fetchImpl);
+}
+function removeGroupUser(cfg, name, user, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.GROUP_USER(name, user), fetchImpl);
+}
+function createKey(cfg, body, fetchImpl) {
+  return apiPost(cfg, TENANT_PATHS.KEYS, body, fetchImpl);
+}
+function listKeys(cfg, user, fetchImpl) {
+  let q = buildQuery({ [KEY_LIST_QUERY.USER]: user });
+  return apiGet(cfg, `${TENANT_PATHS.KEYS}${q}`, fetchImpl);
+}
+function deleteKey(cfg, keyId, fetchImpl) {
+  return apiDelete(cfg, TENANT_PATHS.KEY_BY_ID(keyId), fetchImpl);
+}
 async function postPackageAdvice(cfg, body, fetchImpl) {
   try {
     return { kind: "ok", response: await apiPost(cfg, TENANT_PATHS.PACKAGE_ADVICE, body, fetchImpl, ADVICE.TIMEOUT_MS) };
@@ -2632,46 +2824,192 @@ function getApiRun(cfg, runId, fetchImpl) {
 function getApiRunLogs(cfg, runId, fetchImpl) {
   return apiGet(cfg, TENANT_PATHS.RUN_LOGS(runId), fetchImpl);
 }
+async function apiFollowGet(cfg, path12, fetchImpl) {
+  let retryAfter = null;
+  try {
+    return { ok: true, data: await request(`${cfg.baseUrl}${path12}`, { headers: authHeaders(cfg), fetchImpl: viaApi(fetchImpl), onHeaders: (headers) => {
+      readHeaders.onHeaders(headers), retryAfter = headers.get(RETRY_AFTER_HEADER);
+    } }) };
+  } catch (error) {
+    return { ok: false, error, retryAfterMs: retryAfterMs(retryAfter, Date.now()) };
+  }
+}
+function readRunTimeline(cfg, runId, query, fetchImpl) {
+  let q = buildQuery({ [OBS_QUERY.CURSOR]: query.cursor ?? void 0, [OBS_QUERY.WAIT_SEC]: query.waitSec === void 0 ? void 0 : String(query.waitSec) });
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUN_TIMELINE(runId)}${q}`, fetchImpl);
+}
+function readRunOutput(cfg, runId, fromOffset, fetchImpl) {
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUN_LOGS(runId)}${buildQuery({ [OBS_QUERY.FROM_OFFSET]: String(fromOffset) })}`, fetchImpl);
+}
+function readRunList(cfg, params = {}, fetchImpl) {
+  return apiFollowGet(cfg, `${TENANT_PATHS.RUNS}${buildQuery(params)}`, fetchImpl);
+}
+function readRunForFollow(cfg, runId, fetchImpl) {
+  return apiFollowGet(cfg, TENANT_PATHS.RUN_BY_ID(runId), fetchImpl);
+}
 function deleteRun(cfg, runId, fetchImpl) {
   return apiDelete(cfg, TENANT_PATHS.RUN_BY_ID(runId), fetchImpl);
 }
-function cancelApiRun(cfg, runId, force = false, graceMs, fetchImpl) {
-  let params = new URLSearchParams();
-  force && params.set("force", "true"), graceMs !== void 0 && params.set("grace_ms", String(graceMs));
-  let query = params.size > 0 ? `?${params}` : "";
-  return apiPost(cfg, `${TENANT_PATHS.RUN_CANCEL(runId)}${query}`, void 0, fetchImpl);
+function cancelApiRun(cfg, runId, force = false, graceMs, fetchImpl) {
+  let params = new URLSearchParams();
+  force && params.set("force", "true"), graceMs !== void 0 && params.set("grace_ms", String(graceMs));
+  let query = params.size > 0 ? `?${params}` : "";
+  return apiPost(cfg, `${TENANT_PATHS.RUN_CANCEL(runId)}${query}`, void 0, fetchImpl);
+}
+async function listApiVms(cfg, params = {}, fetchImpl) {
+  return apiGet(cfg, `${TENANT_PATHS.VMS}${buildQuery(params)}`, fetchImpl);
+}
+async function getApiVm(cfg, vmId, fetchImpl) {
+  return apiGet(cfg, TENANT_PATHS.VM_BY_ID(vmId), fetchImpl);
+}
+function deleteVm(cfg, vmId, force = false, fetchImpl) {
+  return apiDelete(cfg, `${TENANT_PATHS.VM_BY_ID(vmId)}${forceQuery(force)}`, fetchImpl);
+}
+var readHeaders, idempotencyHeaders, isReplayedAnswer, noteEnvOverride, versionHeader, BadAnswerError, daysQuery, init_api = __esm({ "src/io/api.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_output();
+  init_constants();
+  init_package_advice3();
+  init_version();
+  init_credentials();
+  init_unreachable();
+  init_api_url();
+  init_tenant();
+  readHeaders = { onHeaders: noteServerVersion }, idempotencyHeaders = (key) => key === void 0 ? {} : { [IDEMPOTENCY_KEY_HEADER]: key }, isReplayedAnswer = (headers) => headers.get(IDEMPOTENT_REPLAYED_HEADER) === "true";
+  noteEnvOverride = /* @__PURE__ */ (() => {
+    let noted = false;
+    return (msg) => {
+      noted || (noted = true, warn(msg));
+    };
+  })();
+  versionHeader = { [CLI_VERSION_HEADER]: CLIENT_VERSION };
+  BadAnswerError = class extends Error {
+  };
+  daysQuery = (days) => buildQuery({ [OBS_QUERY.DAYS]: days === null ? void 0 : String(days) });
+} });
+var byCreatedAtDesc, init_sort = __esm({ "src/utils/sort.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  byCreatedAtDesc = (rows) => [...rows].sort((a, b) => (b.created_at ?? "").localeCompare(a.created_at ?? ""));
+} });
+function parseWholeCount(raw) {
+  if (!/^[1-9][0-9]*$/.test(raw)) return null;
+  let n = Number(raw);
+  return Number.isSafeInteger(n) ? n : null;
+}
+function boolFlag(args, key) {
+  return args.options[key] === true;
+}
+function requiredArg(args) {
+  return args.positionals[0];
+}
+function requireArg(args, label) {
+  let id = requiredArg(args);
+  return id || (fail(MESSAGES.ARG_REQUIRED(label)), null);
+}
+var init_args2 = __esm({ "src/utils/args.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_output();
+  init_http_client();
+} });
+function traceLine(e) {
+  return e instanceof HttpError && e.traceId ? MESSAGES.SERVER_TRACE_ID(e.traceId) : null;
+}
+function keyExpiredHint(e) {
+  let refused2 = httpErrorJson(e);
+  return refused2?.status === 401 && refused2.body.error === KEY_EXPIRED_ERROR ? MESSAGES.KEY_EXPIRED_HINT : null;
 }
-async function listApiVms(cfg, params = {}, fetchImpl) {
-  return apiGet(cfg, `${TENANT_PATHS.VMS}${buildQuery(params)}`, fetchImpl);
+function printError(e) {
+  fail(accessRefusalText(e) ?? errText(e), { hint: keyExpiredHint(e), trace: traceLine(e) });
 }
-async function getApiVm(cfg, vmId, fetchImpl) {
-  return apiGet(cfg, TENANT_PATHS.VM_BY_ID(vmId), fetchImpl);
+async function guard(body) {
+  return await guardValue(body) ?? 1;
 }
-function deleteVm(cfg, vmId, force = false, fetchImpl) {
-  return apiDelete(cfg, `${TENANT_PATHS.VM_BY_ID(vmId)}${forceQuery(force)}`, fetchImpl);
+async function guardValue(body) {
+  try {
+    return await body();
+  } catch (e) {
+    printError(e);
+    return;
+  }
 }
-var readHeaders, noteEnvOverride, versionHeader, BadAnswerError, init_api = __esm({ "src/io/api.ts"() {
+var init_guard = __esm({ "src/utils/guard.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
+  init_tenant();
+  init_constants();
+  init_output();
+  init_access();
+} });
+var import_node_readline, ttyPrompter, init_prompt = __esm({ "src/io/prompt.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  import_node_readline = __toESM(require("node:readline"), 1);
   init_output();
+  ttyPrompter = { async confirm(question) {
+    if (!process.stdin.isTTY) return fail("Refusing to proceed: not a TTY. Re-run with --yes to confirm non-interactively."), false;
+    let rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+      let answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
+      return /^y(es)?$/i.test(answer.trim());
+    } finally {
+      rl.close();
+    }
+  } };
+} });
+async function confirmOrAbort(args, prompter = ttyPrompter, question = MESSAGES.CONFIRM_PROCEED) {
+  return boolFlag(args, "yes") || await prompter.confirm(question) ? true : (say(MESSAGES.ABORTED), false);
+}
+var init_prompt_flow = __esm({ "src/utils/prompt-flow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_prompt();
   init_constants();
-  init_package_advice3();
-  init_version();
-  init_credentials();
-  init_unreachable();
-  init_api_url();
+  init_args2();
+  init_manager();
+} });
+var REAL_CLOCK, init_clock = __esm({ "src/utils/clock.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  REAL_CLOCK = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
+} });
+function snakeCaseKeys(value) {
+  return Array.isArray(value) ? value.map(snakeCaseKeys) : typeof value != "object" || value === null ? value : Object.fromEntries(Object.entries(value).map(([k, v]) => [k.replace(/([a-z0-9])([A-Z])/g, (_, a, b) => `${a}_${b.toLowerCase()}`), snakeCaseKeys(v)]));
+}
+var init_snake_case = __esm({ "src/utils/snake-case.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+} });
+function nextPageNoteFor2(args, list2, rows) {
+  return nextPageNoteFor(PROGRAM, args, { ...list2, flags: Object.keys(list2.flags) }, rows, effectivePageLimit(strOpt(args, "limit")));
+}
+function limitRefusal(args) {
+  let raw = args.options.limit;
+  return typeof raw == "string" ? pageLimitRefusal(raw) : null;
+}
+var PROGRAM, init_page2 = __esm({ "src/utils/page.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
   init_tenant();
-  readHeaders = { onHeaders: noteServerVersion };
-  noteEnvOverride = /* @__PURE__ */ (() => {
-    let noted = false;
-    return (msg) => {
-      noted || (noted = true, warn(msg));
-    };
-  })();
-  versionHeader = { [CLI_VERSION_HEADER]: CLIENT_VERSION };
-  BadAnswerError = class extends Error {
-  };
+  init_http_client();
+  init_args2();
+  PROGRAM = "ignitify";
+} });
+var init_utils = __esm({ "src/utils/index.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_sort();
+  init_args2();
+  init_guard();
+  init_prompt_flow();
+  init_clock();
+  init_snake_case();
+  init_page2();
 } });
 function payloadRefusal(payload, limit) {
   let bytes = payloadBytes(payload);
@@ -2685,8 +3023,19 @@ var payloadBytes, limitOrFallback, formatLimit, limitsNote, init_payload_limit =
   payloadBytes = (payload) => Buffer.byteLength(JSON.stringify(payload) ?? "", "utf8"), limitOrFallback = (limit, fallback) => typeof limit == "number" && Number.isFinite(limit) && limit > 0 ? limit : fallback;
   formatLimit = (bytes) => formatBytes(bytes).replace(/\.0 /, " "), limitsNote = () => MESSAGES.TASK_LIMITS(formatLimit(PAYLOAD_LIMIT_FALLBACK_BYTES), formatLimit(RESULT_LIMIT_FALLBACK_BYTES));
 } });
-function apiConfig(args) {
-  return resolveApiConfig(strOpt(args, "api"));
+function apiConfig() {
+  return resolveApiConfig();
+}
+function accessNameArg(raw, kind, label) {
+  if (raw === void 0 || raw === "") return fail(MESSAGES.ARG_REQUIRED(label)), null;
+  let checked = checkAccessName(kind, raw);
+  return checked.ok ? checked.value : (fail(checked.message), null);
+}
+function daysOption(args) {
+  let raw = strOpt(args, "days");
+  if (raw === void 0) return { ok: true, days: null };
+  let days = parseWholeCount(raw);
+  return days === null ? (fail(MESSAGES.DAYS_INVALID(raw)), { ok: false }) : { ok: true, days };
 }
 async function payloadLimit(cfg) {
   let whoami = await getWhoami(cfg).catch(() => null);
@@ -2696,6 +3045,10 @@ function consoleLogText(bytes, out2) {
   return out2.raw ? bytes : terminalSafe(bytes, out2.colour);
 }
 function printConsoleLog(data, raw, colour = outStyle().colour) {
+  if (isJsonOutput()) {
+    emit(data);
+    return;
+  }
   if (writeRaw(consoleLogText(typeof data?.bytes == "string" ? data.bytes : "", { raw, colour })), data?.truncated === true) {
     let lines = typeof data.lines == "number" ? data.lines : 0;
     tell(`
@@ -2709,7 +3062,7 @@ function noteNextPage(args, list2, rows) {
 async function runPagedList(args, verb) {
   let badLimit = limitRefusal(args);
   return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let data = await verb.fetchPage(apiConfig(args), { ...flagParams(args, verb.list.flags), ...verb.extra });
+    let data = await verb.fetchPage(apiConfig(), { ...flagParams(args, verb.list.flags), ...verb.extra });
     return verb.show(data), noteNextPage(args, verb.list, verb.rowsOf(data)), 0;
   });
 }
@@ -2718,19 +3071,20 @@ var init_shared = __esm({ "src/commands/shared.ts"() {
   init_define_IGNITIFY_CLIENT_FILES();
   init_api();
   init_payload_limit();
+  init_access();
   init_constants();
   init_utils();
   init_output();
 } });
 async function runWhoami(args) {
   return guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("whoami", await getWhoami(cfg)), 0;
   });
 }
 async function runUsage(args) {
   return guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("quota", await getWhoami(cfg)), 0;
   });
 }
@@ -2752,14 +3106,16 @@ function decidePollError(e, failuresInARow, failingForMs) {
   return isTransientError(e) ? failuresInARow >= POLL.ERROR.MIN_TRIES && failingForMs >= POLL.ERROR.GRACE_MS ? "give-up" : "retry" : "give-up";
 }
 async function pollUntil(loop) {
-  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), failures = 0, firstFailureAt = 0;
+  let sleep = loop.clock?.sleep ?? REAL_CLOCK.sleep, now = loop.clock?.now ?? REAL_CLOCK.now, startedAt = now(), decideError = loop.decideError === void 0 ? fixedRetry(loop.retryDelayMs) : loop.decideError, failures = 0, firstFailureAt = 0;
   for (let attempt = 0; ; ) {
     let view;
     try {
       view = await loop.fetch();
     } catch (error) {
-      if (failures === 0 && (firstFailureAt = now()), failures += 1, decidePollError(error, failures, now() - firstFailureAt) === "give-up") return { kind: "lost", error };
-      loop.onRetry?.(error), await sleep(loop.retryDelayMs);
+      failures === 0 && (firstFailureAt = now()), failures += 1;
+      let next = decideError(error, failures, now() - firstFailureAt);
+      if (next.kind === "give-up") return { kind: "lost", error };
+      next.counted || (failures = 0), loop.onRetry?.(error, next.delayMs), await sleep(next.delayMs);
       continue;
     }
     failures = 0, loop.onView?.(view);
@@ -2768,7 +3124,7 @@ async function pollUntil(loop) {
     loop.onWait?.(view, attempt), await sleep(action.delayMs), attempt += 1;
   }
 }
-var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
+var isWait, isLost, fixedRetry, init_poll = __esm({ "src/core/poll.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_http_client();
@@ -2776,6 +3132,7 @@ var isWait, isLost, init_poll = __esm({ "src/core/poll.ts"() {
   init_constants();
   init_utils();
   isWait = (action) => action.kind === "wait", isLost = (end) => "kind" in end && end.kind === "lost";
+  fixedRetry = (delayMs) => (error, failuresInARow, failingForMs) => decidePollError(error, failuresInARow, failingForMs) === "give-up" ? { kind: "give-up" } : { kind: "retry", delayMs, counted: true };
 } });
 function shortenHome(file, home) {
   if (home === "" || !file.startsWith(home)) return file;
@@ -2867,7 +3224,7 @@ async function pollForKey(baseUrl, started, deadline, deps) {
 }
 async function runLogin(args, deps = {}) {
   return guard(async () => {
-    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(apiUrlOf(args)), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
+    let clock = deps.clock ?? REAL_CLOCK, baseUrl = assertApiUrl(apiUrlFor(deps.env ?? process.env)), label = strOpt(args, "name") ?? (deps.hostname ?? import_node_os2.default.hostname)(), file = deps.file ?? credentialsPath(deps.env), started = await withRetries(baseUrl, clock, START_RETRY_MS, () => startDeviceLogin({ baseUrl }, { label, cli_version: CLIENT_VERSION }, deps.fetchImpl)).catch((e) => {
       throw e instanceof HttpError && e.status === 429 ? new Error(MESSAGES.LOGIN_TOO_MANY, { cause: e }) : e;
     }), env = deps.env ?? process.env, st = screenStyle(deps.screen, env), url = started.verification_uri_complete;
     if (say(renderLoginStart(st, { code: formatUserCode(started.user_code), url })), say(""), url !== null) {
@@ -2935,7 +3292,7 @@ function selectLines(lines, runs, vms) {
 }
 async function runUsageShow(args) {
   return guard(async () => {
-    let report = await getUsage(apiConfig(args), filters(args));
+    let report = await getUsage(apiConfig(), filters(args));
     if (boolFlag(args, "json")) return emit(report), 0;
     let runs = boolFlag(args, "runs"), vms = boolFlag(args, "vms"), shown = { ...report, lines: selectLines(report.lines, runs, vms) };
     return out(renderUsageReport(outStyle(), shown, { lines: runs || vms })), 0;
@@ -2945,10 +3302,18 @@ async function runUsageExport(args) {
   return guard(async () => {
     let json2 = boolFlag(args, "json"), csv = boolFlag(args, "csv");
     if (json2 === csv) return tell(MESSAGES.USAGE_EXPORT_USAGE), 1;
-    let report = await getUsage(apiConfig(args), filters(args));
+    let report = await getUsage(apiConfig(), filters(args));
     return out(json2 ? JSON.stringify(report.lines, null, 2) : toCsv(report)), 0;
   });
 }
+async function runUsageSeries(args) {
+  return guard(async () => {
+    let days = daysOption(args);
+    if (!days.ok) return 1;
+    let series = await getUsageSeries(apiConfig(), days.days);
+    return emit(series, (st) => renderUsageSeries(st, series)), 0;
+  });
+}
 var filters, init_usage_report = __esm({ "src/commands/usage-report.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -3001,8 +3366,10 @@ function parseRunOptions(args, config) {
   if (onBusy !== void 0 && onBusy !== "queue" && onBusy !== "reject") return { ok: false, error: `--on-busy must be 'queue' or 'reject', got: ${onBusy}` };
   let at = strOpt(args, "at");
   if (at !== void 0 && Number.isNaN(new Date(at).getTime())) return { ok: false, error: `--at is not a valid ISO-8601 timestamp: ${at}` };
+  let idempotencyKey = strOpt(args, "idempotency-key");
+  if (idempotencyKey !== void 0 && !isValidIdempotencyKey(idempotencyKey)) return { ok: false, error: MESSAGES.IDEMPOTENCY_KEY_INVALID(idempotencyKey) };
   let wait = boolFlag(args, "wait");
-  return at !== void 0 && wait ? { ok: false, error: MESSAGES.RUN_AT_WITH_WAIT } : { ok: true, deploymentFlag: strOpt(args, "deployment"), wait, run: { payload: payload.value, preset: config.run?.preset, timeoutSec: timeoutOverride ?? config.run?.timeout_sec, execution: onBusy === void 0 ? config.execution : { ...config.execution ?? {}, on_busy: onBusy }, at } };
+  return at !== void 0 && wait ? { ok: false, error: MESSAGES.RUN_AT_WITH_WAIT } : { ok: true, deploymentFlag: strOpt(args, "deployment"), wait, run: { payload: payload.value, preset: config.run?.preset, timeoutSec: timeoutOverride ?? config.run?.timeout_sec, execution: onBusy === void 0 ? config.execution : { ...config.execution ?? {}, on_busy: onBusy }, at, idempotencyKey } };
 }
 var VALUE_FLAGS, init_run_options = __esm({ "src/core/run-options.ts"() {
   "use strict";
@@ -9015,6 +9382,71 @@ var import_fs3, import_path3, init_scaffold = __esm({ "src/scaffold/index.ts"()
   init_templates();
   init_vendor();
 } });
+function replyOrThrow(reply) {
+  if (!reply.ok) throw new FollowReadError(reply.error, reply.retryAfterMs);
+  return reply.data;
+}
+function followStopOf(e) {
+  let code = refusalCode(e);
+  return code === OBS_REFUSAL.AGENT_OUTDATED_CURSOR.error ? "agent-outdated" : code === OBS_REFUSAL.NEVER_RAN.error ? "not-started" : "error";
+}
+function decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, fallbackMs) {
+  return decidePollError(e, failuresInARow, failingForMs) === "give-up" ? { kind: "give-up" } : { kind: "retry", delayMs: isBusyAnswer(e) ? retryAfterMs2 ?? fallbackMs : fallbackMs, counted: true };
+}
+function decideBusyReadError(e, retryAfterMs2, failuresInARow, failingForMs) {
+  return !isBusyAnswer(e) || failuresInARow > BUSY_READ.MAX_RETRIES ? { kind: "give-up" } : decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, FOLLOW.RETRY_FALLBACK_MS);
+}
+function decideFollowError(e, retryAfterMs2, failuresInARow, failingForMs) {
+  return followStopOf(e) !== "error" ? { kind: "give-up" } : isWaitRefused(e) ? { kind: "retry", delayMs: retryAfterMs2 ?? FOLLOW.RETRY_FALLBACK_MS, counted: false } : decidePacedRetry(e, retryAfterMs2, failuresInARow, failingForMs, FOLLOW.RETRY_FALLBACK_MS);
+}
+function placeOutputPage(fromOffset, reply) {
+  let next = reply.next_offset, bytes = typeof reply.bytes == "string" ? reply.bytes : "";
+  return !isOffset(next) || next < fromOffset || bytes !== "" && next === fromOffset ? { kind: "no-cursor" } : { kind: "page", bytes, nextOffset: next, full: reply.truncated === true && next > fromOffset };
+}
+function decideOutputStep(page, endedAt, readAt) {
+  return page.full ? "read-now" : page.bytes === "" && endedAt !== null && readAt - endedAt >= FOLLOW.IDLE_MS ? "stop" : "wait";
+}
+function timelineDone(reply, follow, held) {
+  return reply.complete ? true : !follow && nextCursor(held, reply) === held;
+}
+function eventsToPrint(page, printedTail) {
+  let fresh = (e) => !printedTail.has(e.id), tail = page.tail.filter(fresh), settledIds = new Set(page.events.map((e) => e.id));
+  return { print: [...page.events.filter(fresh), ...tail], printedTail: new Set([...printedTail, ...tail.map((e) => e.id)].filter((id) => !settledIds.has(id))) };
+}
+function lastLines(text, n) {
+  if (n <= 0) return "";
+  let at = text.endsWith(`
+`) ? text.length - 1 : text.length;
+  for (let seen = 0; seen < n; seen += 1) {
+    let nl = at > 0 ? text.lastIndexOf(`
+`, at - 1) : -1;
+    if (nl < 0) return text;
+    at = nl;
+  }
+  return text.slice(at + 1);
+}
+var FollowReadError, isOffset, refusalCode, isWaitRefused, isBusyAnswer, nextCursor, idleRestMs, init_follow = __esm({ "src/core/follow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_http_client();
+  init_tenant();
+  init_constants();
+  init_poll();
+  FollowReadError = class extends Error {
+    error;
+    retryAfterMs;
+    constructor(error, retryAfterMs2) {
+      super(error instanceof Error ? error.message : String(error)), this.name = "FollowReadError", this.error = error, this.retryAfterMs = retryAfterMs2;
+    }
+  };
+  isOffset = (v) => typeof v == "number" && Number.isSafeInteger(v) && v >= 0, refusalCode = (e) => {
+    let code = httpErrorJson(e)?.body.error;
+    return typeof code == "string" ? code : null;
+  }, isWaitRefused = (e) => refusalCode(e) === OBS_REFUSAL.WAIT_REFUSED.error;
+  isBusyAnswer = (e) => e instanceof HttpError && (e.status === 429 || e.status === 503);
+  nextCursor = (held, reply) => reply.cursor ?? held;
+  idleRestMs = (startedAt, now) => Math.max(0, FOLLOW.IDLE_MS - (now - startedAt));
+} });
 function decidePoll(status, elapsedMs, attempt, failureReason) {
   return status === READY ? { kind: "ready" } : status === FAILED ? { kind: "failed", reason: failureReason ?? "the build failed without recording a reason" } : status !== BUILDING ? { kind: "failed", reason: `deployment entered an unexpected status: ${status}` } : elapsedMs >= POLL.DEPLOY.TIMEOUT_MS ? { kind: "timeout" } : { kind: "wait", delayMs: nextDelayMs(attempt) };
 }
@@ -9041,14 +9473,19 @@ var BUILDING, READY, FAILED, init_deploy_poll = __esm({ "src/core/deploy-poll.ts
 function decideRunPoll(status, elapsedMs, attempt) {
   return isTerminalRunStatus(status) ? { kind: "settled", status } : elapsedMs >= POLL.RUN.TIMEOUT_MS ? { kind: "timeout", status } : { kind: "wait", delayMs: backoffDelayMs(attempt, POLL.RUN) };
 }
+function decideRunPollError(e, failuresInARow, failingForMs) {
+  let [error, retryAfterMs2] = e instanceof FollowReadError ? [e.error, e.retryAfterMs] : [e, null];
+  return decidePacedRetry(error, retryAfterMs2, failuresInARow, failingForMs, POLL.RUN.MAX_MS);
+}
 async function pollUntilSettled(deps) {
-  let statusOf = (run2) => run2.status ?? "UNKNOWN", end = await pollUntil({ fetch: deps.fetchRun, retryDelayMs: POLL.RUN.MAX_MS, onRetry: deps.onRetry, decide: (run2, elapsedMs, attempt) => decideRunPoll(statusOf(run2), elapsedMs, attempt), onView: (run2) => deps.onStatus?.(statusOf(run2)), clock: deps });
-  return isLost(end) ? end : { action: end.action, run: end.view };
+  let statusOf = (run2) => run2.status ?? "UNKNOWN", end = await pollUntil({ fetch: deps.fetchRun, decideError: decideRunPollError, onRetry: deps.onRetry, decide: (run2, elapsedMs, attempt) => decideRunPoll(statusOf(run2), elapsedMs, attempt), onView: (run2) => deps.onStatus?.(statusOf(run2)), clock: deps });
+  return isLost(end) ? end.error instanceof FollowReadError ? { kind: "lost", error: end.error.error } : end : { action: end.action, run: end.view };
 }
 var init_run_poll = __esm({ "src/core/run-poll.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_constants();
+  init_follow();
   init_poll();
 } });
 async function waitForBuild(cfg, deploymentId, progress, reused = false) {
@@ -9076,7 +9513,7 @@ ${st.bold(LABELS.BUILD_LOG)}
   return built.kind === "timeout" ? (progress.fail(WAIT.BUILD_TIMEOUT), fail(WAIT.BUILD_TIMEOUT_DETAIL(deploymentId)), 1) : (progress.succeed(reused && !building ? WAIT.REUSED : WAIT.BUILT), 0);
 }
 async function waitForRun(cfg, runId) {
-  let progress = startProgress(WAIT.RUN_SUBMITTED(runId)), lastStatus, settled = await withInterruptNotice(progress, () => WAIT.INTERRUPTED_RUN(runId), () => pollUntilSettled({ fetchRun: () => getApiRun(cfg, runId), onStatus: (status) => {
+  let progress = startProgress(WAIT.RUN_SUBMITTED(runId)), lastStatus, settled = await withInterruptNotice(progress, () => WAIT.INTERRUPTED_RUN(runId), () => pollUntilSettled({ fetchRun: async () => replyOrThrow(await readRunForFollow(cfg, runId)), onStatus: (status) => {
     lastStatus = status, progress.update(WAIT.RUN(runId, status), WAIT.HINT_RUN);
   }, onRetry: () => progress.update(lastStatus === void 0 ? WAIT.RUN_SUBMITTED(runId) : WAIT.RUN(runId, lastStatus), WAIT.HINT_RETRYING) }));
   if (isLost(settled)) return progress.fail(WAIT.LOST), fail(WAIT.LOST_RUN_DETAIL(runId, errText(settled.error))), 1;
@@ -9089,6 +9526,7 @@ var init_wait = __esm({ "src/commands/wait.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_api();
+  init_follow();
   init_deploy_poll();
   init_run_poll();
   init_poll();
@@ -13318,7 +13756,7 @@ async function runIntegrationAdd(args, cwd = process.cwd(), deps = REAL_INTEGRAT
   if (!task) return 1;
   if (printWarnings([...task.warnings]), task.config.runtime !== INTEGRATION.RUNTIME) return fail(INTEGRATION.NOT_NODE(task.config.runtime)), 1;
   let taskDir = import_node_fs9.default.realpathSync(task.taskDir);
-  if (readTaskPackageJson(taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(taskDir)), 1;
+  if (readTaskPackageJson(taskDir) === null) return fail(INTEGRATION.NO_PACKAGE_JSON(task.taskDir)), 1;
   let pkg = packageName(name);
   return guard(() => withPackDir((packDir) => addIntegration(args, taskDir, task.config, pkg, packDir, dryRun, deps)));
 }
@@ -13400,7 +13838,7 @@ async function printPackageAdvice(args, config, fetchImpl) {
   let plan = planAdvice(config);
   if (plan.kind === "skip") return say(ADVICE.SKIPPED(plan.reason));
   try {
-    let outcome = await postPackageAdvice(apiConfig(args), plan.request, fetchImpl), { lines, fault } = renderAdvice(outcome, screenStyle());
+    let outcome = await postPackageAdvice(apiConfig(), plan.request, fetchImpl), { lines, fault } = renderAdvice(outcome, screenStyle());
     for (let line of lines) (fault ? tell : say)(line);
   } catch (e) {
     fail(errText(e));
@@ -13413,12 +13851,12 @@ async function runTaskValidate(args, cwd = process.cwd(), fetchImpl) {
 async function runTaskGet(args, cwd = process.cwd()) {
   let task = await prepareTask(args, cwd);
   if (!task) return 1;
-  let { slug: slug2 } = task, state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(args), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
+  let { slug: slug2 } = task, state = readState(task.taskDir), check = checkSourceUpload(task.taskDir), localContentHash = check.ok ? check.source.contentHash : null, cfg = offlineTolerantConfig(), orNull = (p) => p.catch(() => null), [whoami, deploymentsRes, runsRes] = cfg ? await Promise.all([orNull(getWhoami(cfg)), orNull(listApiDeploymentsForTask(cfg, slug2, void 0, { limit: TASK_REPORT_PAGE })), orNull(listApiRuns(cfg, { task_name: slug2, limit: String(TASK_REPORT_PAGE) }))]) : [null, null, null], report = buildTaskReport({ slug: slug2, declared: task.config.execution, declaredPreset: task.config.run?.preset, stateDeploymentId: state.deployment_id ?? null, localContentHash, deployments: deploymentsRes?.deployments ?? null, runs: runsRes?.runs ?? null, pageLimit: TASK_REPORT_PAGE, usage: whoami?.usage ?? null });
   return emit(snakeCaseKeys(report), () => formatTaskReport(report)), 0;
 }
-function offlineTolerantConfig(args) {
+function offlineTolerantConfig() {
   try {
-    return apiConfig(args);
+    return apiConfig();
   } catch (e) {
     return warn(RESULT_MESSAGES.TASK_GET_OFFLINE(errText(e))), null;
   }
@@ -13436,8 +13874,8 @@ async function runTaskPack(args, cwd = process.cwd()) {
   return CliOutputManager.render("task:pack", { task_id: config.slug, files: entries.map((e) => ({ path: e.path, size: e.size })), total_bytes: totalBytes, ignored, content_hash: contentHash }), 0;
 }
 async function runTaskDeploy(args, cwd = process.cwd()) {
-  let taskDir = getTaskDir(args, cwd);
-  if (!taskDir) return 1;
+  let taskDir = getTaskDir(args, cwd), { taskId, dirFlag } = getTaskPath(args, cwd);
+  if (!taskDir || !taskId) return 1;
   let prep = args.options.check ? checkSourceUpload(taskDir) : prepareSourceUpload(taskDir);
   if (printWarnings([...prep.warnings]), !prep.ok) return printErrors([...prep.errors]), 1;
   let left = "upload" in prep ? prep.upload.ignored : prep.source.ignored;
@@ -13446,9 +13884,9 @@ async function runTaskDeploy(args, cwd = process.cwd()) {
     return emit({ task_id: config.slug, valid: true, total_bytes: totalBytes, content_hash: contentHash }, (st) => successLine(st, VALIDATE.VALID)), 0;
   }
   let state = readState(taskDir);
-  if (!state.task_id) return fail("task_id not found in .ignitify/state.json \u2014 run `ignitify task:create <task-id>` first"), 1;
+  if (!state.task_id) return fail(MESSAGES.TASK_NOT_REGISTERED(taskId, dirFlag)), 1;
   let { upload } = prep;
-  return uploadAndWait(apiConfig(args), taskDir, state.task_id, upload.manifest, upload.tar, upload.slug);
+  return uploadAndWait(apiConfig(), taskDir, state.task_id, upload.manifest, upload.tar, upload.slug);
 }
 async function uploadAndWait(cfg, taskDir, taskId, manifest, tar, slug2) {
   let progress = startProgress(WAIT.UPLOADING(slug2, formatBytes(tar.length))), res, whoami;
@@ -13467,7 +13905,7 @@ async function runTaskRun(args, cwd = process.cwd()) {
   printWarnings([...task.warnings]);
   let opts = parseRunOptions(args, task.config);
   if (!opts.ok) return fail(opts.error), 1;
-  let { run: run2 } = opts, taskName = task.slug, cfg = apiConfig(args);
+  let { run: run2 } = opts, taskName = task.slug, cfg = apiConfig();
   if (payloadBytes(run2.payload) > PAYLOAD_LIMIT_FALLBACK_BYTES) {
     let refusal = payloadRefusal(run2.payload, await payloadLimit(cfg));
     if (refusal !== null) return fail(refusal), 1;
@@ -13480,17 +13918,21 @@ async function runTaskRun(args, cwd = process.cwd()) {
     if (refusal !== null) return fail(refusal), 1;
   }
   return resolved.source === "server" && say(`Using deployment ${deploymentId} (resolved from the server \u2014 no local state).`), await guard(async () => {
-    let res;
+    let posted;
     try {
-      res = await postRun(cfg, { deploymentId, taskName, ...run2 });
+      posted = await postRun(cfg, { deploymentId, taskName, ...run2 });
     } catch (e) {
       if (isJsonOutput()) throw e;
       let trace = traceLine(e);
       if (isPayloadTooLarge(e)) return fail(MESSAGES.PAYLOAD_REFUSED_BY_SERVER(await payloadLimit(cfg)), { trace }), 1;
+      let keyed = run2.idempotencyKey === void 0 ? null : idempotencyRefusal(e);
+      if (keyed) return fail(keyed.error, { hint: keyed.hint, trace }), 1;
       let explained = explainRunRefusal(e) ?? explainLimitRefusal(e);
       if (!explained) throw e;
       return tell(explained), trace !== null && tell(errStyle().dim(trace)), 1;
     }
+    let res = posted.answer;
+    posted.replayed && warn(MESSAGES.RUN_REPLAYED);
     let answer = classifyRunAnswer(res, run2.at, opts.wait);
     switch (answer.kind) {
       case "skew-ran-now":
@@ -13532,7 +13974,7 @@ async function runTaskCreate(args, cwd = process.cwd()) {
     return err2 ? (fail(err2), 1) : (emit({ slug: taskId, runtime: lang, local_dir: taskDir, registered: false }, (st) => successLine(st, RESULT_MESSAGES.TASK_CREATED_LOCAL(lang, taskId, taskDir))), say(screenStyle().dim(limitsNote())), 0);
   }
   return guard(async () => {
-    let cfg = apiConfig(args), res = await createTask(cfg, taskId);
+    let cfg = apiConfig(), res = await createTask(cfg, taskId);
     writeState(taskDir, { task_id: res.task_id, task_resource_id: res.resource_id });
     let local_dir;
     if (!args.options["no-scaffold"]) {
@@ -13549,11 +13991,11 @@ async function runTaskDelete(args, cwd = process.cwd(), prompter = ttyPrompter)
   let id = requiredArg(args);
   if (!id) return fail(MESSAGES.TASK_ID_REQUIRED), 1;
   let plan = await guardValue(async () => {
-    let baseDir = tasksBaseDir(args, cwd), cfg = apiConfig(args), { taskId, runs, deploymentCount, runCount } = await surveyTaskContents(cfg, id), folders = readTaskFolders(baseDir);
+    let baseDir = tasksBaseDir(args, cwd), cfg = apiConfig(), { taskId, runs, deploymentCount, runCount } = await surveyTaskContents(cfg, id), folders = readTaskFolders(baseDir);
     return planTaskDeletion({ taskSlug: id, taskId, runs, deploymentCount, runCount, folders });
   });
   return plan === void 0 || (printDeletionPlan(plan), !await confirmOrAbort(args, prompter)) ? 1 : guard(async () => {
-    let cfg = apiConfig(args), d = (await deleteTask(cfg, id)).deleted;
+    let cfg = apiConfig(), d = (await deleteTask(cfg, id)).deleted;
     d ? sayOk(`${MESSAGES.TASK_DELETED}: ${d.task_id} (${deletedCounts([["deployments", d.deployments], ["runs", d.runs], ["vms", d.vms], ["forfeited pins", d.forfeited_pins]])})`) : sayOk(MESSAGES.TASK_DELETED);
     for (let dir of plan.unlinkDirs) {
       let link = taskLinkPath(dir);
@@ -13599,18 +14041,18 @@ function runDeploymentList(args) {
 async function runDeploymentGet(args) {
   let id = requireArg(args, "deployment-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return CliOutputManager.render("deployment:get", await getApiDeployment(cfg, id)), 0;
   }) : 1;
 }
 async function runDeploymentLogs(args) {
   let id = requireArg(args, "deployment-id");
-  return id ? guard(async () => (printConsoleLog(await getApiDeploymentLogs(apiConfig(args), id), boolFlag(args, "raw")), 0)) : 1;
+  return id ? guard(async () => (printConsoleLog(await getApiDeploymentLogs(apiConfig(), id), boolFlag(args, "raw")), 0)) : 1;
 }
 async function runDeploymentDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "deployment-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (say(RESULT_MESSAGES.DEPLOYMENT_DELETE_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await deleteDeployment(cfg, id);
     emit(res);
@@ -13639,27 +14081,122 @@ var WHOLE_MS, init_grace = __esm({ "src/core/grace.ts"() {
   init_constants();
   WHOLE_MS = /^\d+$/;
 } });
+async function readWithRetry(read, clock) {
+  let wait = true, end = await pollUntil({ fetch: async () => replyOrThrow(await read(wait)), decideError: (e, failures, failingForMs) => e instanceof FollowReadError ? decideFollowError(e.error, e.retryAfterMs, failures, failingForMs) : { kind: "give-up" }, onRetry: (e) => {
+    e instanceof FollowReadError && isWaitRefused(e.error) && (wait = false);
+  }, decide: () => ({ kind: "read" }), clock });
+  if (!isLost(end)) return { ok: true, data: end.view };
+  let error = end.error instanceof FollowReadError ? end.error.error : end.error, stop = followStopOf(error);
+  return { ok: false, failure: stop === "agent-outdated" ? { kind: stop } : { kind: stop, error } };
+}
+async function readBusyRetried(read, clock, onRetry = () => {
+}) {
+  let end = await pollUntil({ fetch: async () => replyOrThrow(await read()), decideError: (e, failures, failingForMs) => e instanceof FollowReadError ? decideBusyReadError(e.error, e.retryAfterMs, failures, failingForMs) : { kind: "give-up" }, onRetry: (_e, delayMs) => onRetry(delayMs), decide: () => ({ kind: "read" }), clock });
+  if (!isLost(end)) return end.view;
+  throw end.error instanceof FollowReadError ? end.error.error : end.error;
+}
+async function readTimeline(loop) {
+  let cursor = null;
+  for (; ; ) {
+    let held = cursor, startedAt = loop.clock.now(), read = await readWithRetry((wait) => loop.read(held, loop.follow && wait), loop.clock);
+    if (!read.ok) return { ok: false, failure: read.failure };
+    if (loop.onPage(read.data), cursor = nextCursor(held, read.data), timelineDone(read.data, loop.follow, held)) return { ok: true, last: read.data };
+    if (loop.follow && read.data.events.length === 0) {
+      let rest = idleRestMs(startedAt, loop.clock.now());
+      rest > 0 && await loop.clock.sleep(rest);
+    }
+  }
+}
+async function readOutput(loop) {
+  let offset = 0, held = loop.tail === null ? null : "", runId = "", checkRun = loop.follow, endedAt = null;
+  for (; ; ) {
+    if (checkRun && endedAt === null) {
+      let run2 = await readWithRetry(loop.readRun, loop.clock);
+      if (!run2.ok) return { ok: false, failure: run2.failure };
+      isTerminalRunStatus(run2.data.status) && (endedAt = loop.clock.now());
+    }
+    let from = offset, readAt = loop.clock.now(), read = await readWithRetry(() => loop.readPage(from), loop.clock);
+    if (!read.ok && !(loop.follow && read.failure.kind === "not-started")) return { ok: false, failure: read.failure };
+    let placed = read.ok ? placeOutputPage(from, read.data) : { kind: "page", bytes: "", nextOffset: from, full: false };
+    if (placed.kind === "no-cursor") return { ok: false, failure: { kind: "no-cursor" } };
+    if (read.ok && (runId = read.data.run_id), offset = placed.nextOffset, held !== null && loop.tail !== null ? (held = lastLines(held + placed.bytes, loop.tail), placed.full || (held !== "" && loop.onChunk({ runId, bytes: held, nextOffset: offset }), held = null)) : placed.bytes !== "" && loop.onChunk({ runId, bytes: placed.bytes, nextOffset: offset }), !loop.follow) {
+      if (placed.full) continue;
+      return { ok: true };
+    }
+    let step = decideOutputStep(placed, endedAt, readAt);
+    if (step === "stop") return { ok: true };
+    checkRun = step === "wait", step === "wait" && await loop.clock.sleep(FOLLOW.IDLE_MS);
+  }
+}
+var init_run_follow = __esm({ "src/commands/run-follow.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_constants();
+  init_follow();
+  init_poll();
+} });
 function runRunList(args) {
-  return runPagedList(args, { list: { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, fetchPage: listApiRuns, rowsOf: (data) => data.runs, show: (data) => CliOutputManager.render("run:list", data.runs) });
+  return runPagedList(args, { list: { command: COMMANDS.RUN_LIST, flags: RUN_LIST_FLAG_PARAMS }, fetchPage: (cfg, params) => readBusyRetried(() => readRunList(cfg, params), REAL_CLOCK, noteBusyRetry), rowsOf: (data) => data.runs, show: (data) => CliOutputManager.render("run:list", data.runs) });
 }
 async function runRunGet(args) {
   let id = requireArg(args, "run-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args), data = await getApiRun(cfg, id);
+    let cfg = apiConfig(), data = await readBusyRetried(() => readRunForFollow(cfg, id), REAL_CLOCK, noteBusyRetry);
     return boolFlag(args, "full") ? out(JSON.stringify(data, null, 2)) : CliOutputManager.render("run:get", data), 0;
   }) : 1;
 }
 async function runRunLogs(args) {
   let id = requireArg(args, "run-id");
-  return id ? guard(async () => {
-    let cfg = apiConfig(args);
-    return printConsoleLog(await getApiRunLogs(cfg, id), boolFlag(args, "raw")), 0;
-  }) : 1;
+  if (!id) return 1;
+  let follow = boolFlag(args, "follow"), raw = boolFlag(args, "raw");
+  return guard(async () => {
+    let tailRaw = strOpt(args, "tail"), tail = tailRaw === void 0 ? null : parseWholeCount(tailRaw);
+    if (tailRaw !== void 0 && tail === null) return fail(FOLLOW_MESSAGES.TAIL_INVALID(tailRaw)), 1;
+    let cfg = apiConfig(), json2 = isJsonOutput();
+    if (!follow && tail === null) return printConsoleLog(await getApiRunLogs(cfg, id), raw), 0;
+    let colour = outStyle().colour, read = () => readOutput({ readPage: (fromOffset) => readRunOutput(cfg, id, fromOffset), readRun: () => readRunForFollow(cfg, id), onChunk: (chunk) => json2 ? out(JSON.stringify(outputDocument(chunk))) : writeRaw(consoleLogText(chunk.bytes, { raw, colour })), follow, tail, clock: REAL_CLOCK }), end = follow ? await withInterruptNotice(NO_PROGRESS, () => FOLLOW_MESSAGES.INTERRUPTED(id), read) : await read();
+    return end.ok ? 0 : failFollow(end.failure);
+  });
+}
+function failFollow(failure) {
+  if (failure.kind === "agent-outdated") fail(FOLLOW_MESSAGES.AGENT_OUTDATED);
+  else if (failure.kind === "no-cursor") fail(FOLLOW_MESSAGES.API_NO_CURSOR);
+  else throw failure.error;
+  return 1;
+}
+async function runRunTimeline(args) {
+  let id = requireArg(args, "run-id");
+  if (!id) return 1;
+  let follow = boolFlag(args, "follow");
+  return guard(async () => {
+    let cfg = apiConfig(), json2 = isJsonOutput(), events = [], printedTail = /* @__PURE__ */ new Set(), onPage = (page) => {
+      if (json2 && follow) (page.events.length > 0 || page.complete) && out(JSON.stringify(page));
+      else if (json2) events.push(...page.events);
+      else {
+        let next = eventsToPrint(page, printedTail);
+        printedTail = next.printedTail;
+        for (let event of next.print) out(timelineLine(event));
+      }
+    }, read = () => readTimeline({ read: (cursor, wait) => readRunTimeline(cfg, id, { cursor, waitSec: wait ? FOLLOW.WAIT_SEC : void 0 }), onPage, follow, clock: REAL_CLOCK }), end = follow ? await withInterruptNotice(NO_PROGRESS, () => FOLLOW_MESSAGES.INTERRUPTED(id), read) : await read();
+    if (!end.ok) return failFollow(end.failure);
+    let { run: run2 } = end.last;
+    json2 && !follow && emit({ ...end.last, events });
+    let ended = isTerminalRunStatus(run2.status), status = terminalSafe(run2.status, false);
+    return json2 || out(ended ? WAIT.RUN_ENDED(status) : FOLLOW_MESSAGES.STILL_LIVE(status)), !ended || run2.status === RUN_STATUS.COMPLETED ? 0 : 1;
+  });
+}
+async function runRunFailures(args) {
+  return guard(async () => {
+    let days = daysOption(args);
+    if (!days.ok) return 1;
+    let report = await getRunFailures(apiConfig(), days.days);
+    return emit(report, (st) => renderFailures(st, report)), 0;
+  });
 }
 async function runRunDelete(args, prompter = ttyPrompter) {
   let id = requireArg(args, "run-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return say(RESULT_MESSAGES.RUN_DELETE_PREVIEW(id)), await confirmOrAbort(args, prompter) ? (emit(await deleteRun(cfg, id)), sayOk(`${MESSAGES.RUN_DELETED}: ${id}`), 0) : 1;
   }) : 1;
 }
@@ -13670,7 +14207,10 @@ async function runRunCancel(args, prompter = ttyPrompter) {
   return guard(async () => {
     let grace = parseGraceMs(strOpt(args, "grace"), force);
     if (!grace.ok) return fail(grace.error), 1;
-    let graceMs = grace.graceMs, cfg = apiConfig(args), run2 = await getApiRun(cfg, id);
+    let graceMs = grace.graceMs, cfg = apiConfig(), run2 = await getApiRun(cfg, id).catch((e) => {
+      if (isTransientError(e)) return null;
+      throw e;
+    });
     if (run2?.status && isTerminalRunStatus(run2.status)) return emit({ run_id: id, outcome: RUN_CANCEL_OUTCOME.ALREADY_TERMINAL, status: run2.status }), say(RESULT_MESSAGES.RUN_ALREADY_OVER(id, run2.status)), 0;
     if (say(RESULT_MESSAGES.RUN_CANCEL_PREVIEW(id, force)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await cancelApiRun(cfg, id, force, graceMs);
@@ -13683,7 +14223,7 @@ async function runRunCancel(args, prompter = ttyPrompter) {
     return sayOk(RESULT_MESSAGES.RUN_CANCELLED(id, was)), 0;
   });
 }
-var init_run = __esm({ "src/commands/run.ts"() {
+var noteBusyRetry, outputDocument, init_run = __esm({ "src/commands/run.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
   init_prompt();
@@ -13692,7 +14232,15 @@ var init_run = __esm({ "src/commands/run.ts"() {
   init_utils();
   init_output();
   init_grace();
+  init_follow();
+  init_poll();
   init_shared();
+  init_run_follow();
+  noteBusyRetry = (delayMs) => {
+    tell(BUSY_READ.NOTE(Math.ceil(delayMs / MS_PER_SECOND)));
+  };
+  outputDocument = (chunk) => ({ run_id: chunk.runId, bytes: chunk.bytes, lines: chunk.bytes.split(`
+`).length - 1, truncated: false, next_offset: chunk.nextOffset });
 } });
 function decideVmDelete(vm, force, vmId) {
   if (vm.residency === "pinned" && !force) {
@@ -13714,7 +14262,7 @@ function runVmList(args) {
 async function runVmGet(args) {
   let id = requireArg(args, "vm-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args), data = await getApiVm(cfg, id);
+    let cfg = apiConfig(), data = await getApiVm(cfg, id);
     return CliOutputManager.render("vm:get", { ...data }), 0;
   }) : 1;
 }
@@ -13723,7 +14271,7 @@ async function runVmDelete(args, prompter = ttyPrompter) {
   if (!id) return 1;
   let force = boolFlag(args, "force");
   return guard(async () => {
-    let cfg = apiConfig(args), vm = await getApiVm(cfg, id), decision = decideVmDelete(vm, force, id);
+    let cfg = apiConfig(), vm = await getApiVm(cfg, id), decision = decideVmDelete(vm, force, id);
     if (decision.refuse) return fail(decision.message), 1;
     if (say(decision.notice), !await confirmOrAbort(args, prompter)) return 1;
     let res = await deleteVm(cfg, id, force);
@@ -13751,20 +14299,20 @@ async function runSecretSet(args) {
   if (args.options.stdin !== true) return tell(MESSAGES.SECRET_SET_USAGE), 1;
   let value = import_fs5.default.readFileSync(0, "utf8").replace(/\n$/, "");
   return value === "" ? (fail(MESSAGES.SECRET_VALUE_EMPTY), 1) : guard(async () => {
-    let cfg = apiConfig(args), res = await setSecret(cfg, name, value);
+    let cfg = apiConfig(), res = await setSecret(cfg, name, value);
     return emit(res), sayOk(MESSAGES.SECRET_STORED(name)), 0;
   });
 }
 async function runSecretList(args) {
   return guard(async () => {
-    let cfg = apiConfig(args), data = await listSecrets(cfg);
+    let cfg = apiConfig(), data = await listSecrets(cfg);
     return emit(data, (st) => data.secrets.length === 0 ? emptyState(st, RESULT_MESSAGES.NO_SECRETS, RESULT_MESSAGES.NO_SECRETS_NEXT) : renderTable(st, [{ header: "name", keep: true }, { header: "updated_at", keep: true }], data.secrets.map((x) => [x.name, x.updated_at]))), 0;
   });
 }
 async function runSecretDelete(args, prompter = ttyPrompter) {
   let name = args.positionals[0];
   return name ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (tell(RESULT_MESSAGES.SECRET_DELETE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
     let res = await rmSecret(cfg, name);
     return emit(res), sayOk(MESSAGES.SECRET_REMOVED(name)), 0;
@@ -13784,14 +14332,14 @@ var import_fs5, secretValueOnArgv, init_secret = __esm({ "src/commands/secret.ts
 } });
 async function runScheduleList(args) {
   return guard(async () => {
-    let cfg = apiConfig(args), res = await listSchedules(cfg);
+    let cfg = apiConfig(), res = await listSchedules(cfg);
     return CliOutputManager.render("schedule:list", res.schedules.map((row) => ({ ...row }))), 0;
   });
 }
 async function runScheduleCancel(args, prompter = ttyPrompter) {
   let id = requireArg(args, "schedule-id");
   return id ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     if (say(RESULT_MESSAGES.SCHEDULE_CANCEL_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
     try {
       await deleteSchedule(cfg, id);
@@ -13812,12 +14360,37 @@ var init_schedule = __esm({ "src/commands/schedule.ts"() {
   init_output();
   init_shared();
 } });
+function notificationView(unread, open) {
+  return unread && open ? null : unread ? "unread" : open ? "open" : "all";
+}
+function notificationMoreNote(rawLimit) {
+  return (rawLimit === void 0 ? NOTIFICATION_PAGE_DEFAULT : Number(rawLimit)) < NOTIFICATION_PAGE_MAX ? MESSAGES.NOTIFICATION_MORE(NOTIFICATION_PAGE_MAX) : MESSAGES.NOTIFICATION_MORE_IN_APP;
+}
+async function runNotificationList(args) {
+  let view = notificationView(boolFlag(args, "unread"), boolFlag(args, "open"));
+  if (view === null) return fail(MESSAGES.NOTIFICATION_ONE_VIEW), 1;
+  let badLimit = limitRefusal(args);
+  return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
+    let page = await listNotifications(apiConfig(), { ...flagParams(args, NOTIFICATION_LIST_FLAG_PARAMS), [NOTIFICATION_QUERY.FILTER]: view });
+    return emit(page, (st) => renderNotifications(st, page)), page.next_cursor !== null && warn(notificationMoreNote(strOpt(args, "limit"))), 0;
+  });
+}
+var init_notification = __esm({ "src/commands/notification.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_api();
+  init_utils();
+  init_output();
+  init_constants();
+  init_shared();
+} });
 function withAbsoluteUrl(created, baseUrl) {
   let { url } = created;
   return typeof url != "string" || !url.startsWith("/") ? created : { ...created, url: `${baseUrl.replace(/\/+$/, "")}${url}` };
 }
 function renderHookCreated(st, created) {
-  let { secret, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
+  let { secret, secret_redacted: _redacted, ...rest } = created, rows = { ...rest, [RESULT_MESSAGES.HOOK_SECRET_KEY]: secret }, paint2 = { [RESULT_MESSAGES.HOOK_SECRET_KEY]: (s) => st.bold(st.yellow(s)) };
   return `
 ${heading(st, RESULT_MESSAGES.HOOK_CREATED_TITLE, true)}
 ${renderFields(st, rows, void 0, paint2)}
@@ -13828,8 +14401,8 @@ async function runHookCreate(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_CREATE_USAGE), 1;
   let taskName = args.options["task-name"];
   return typeof taskName != "string" || taskName.trim() === "" ? (fail(MESSAGES.HOOK_TASK_NAME_REQUIRED), 1) : guard(async () => {
-    let cfg = apiConfig(args), created = withAbsoluteUrl(await createHook(cfg, deploymentId, { task_name: taskName }), cfg.baseUrl);
-    return warn(MESSAGES.HOOK_SECRET_SHOWN_ONCE), tell(MESSAGES.HOOK_PAYLOAD_LIMIT(formatLimit(await payloadLimit(cfg)))), emit(created, (st) => renderHookCreated(st, created)), 0;
+    let cfg = apiConfig(), created = withAbsoluteUrl(await createHook(cfg, deploymentId, { task_name: taskName }), cfg.baseUrl);
+    return created.secret === null ? (fail(MESSAGES.HOOK_SECRET_REDACTED(created.resource_id)), emit(created), 1) : (warn(MESSAGES.HOOK_SECRET_SHOWN_ONCE), tell(MESSAGES.HOOK_PAYLOAD_LIMIT(formatLimit(await payloadLimit(cfg)))), emit(created, (st) => renderHookCreated(st, created)), 0);
   });
 }
 async function runHookList(args) {
@@ -13837,14 +14410,14 @@ async function runHookList(args) {
   if (!deploymentId) return tell(MESSAGES.HOOK_LIST_USAGE), 1;
   let badLimit = limitRefusal(args);
   return badLimit !== null ? (fail(badLimit), 1) : guard(async () => {
-    let cfg = apiConfig(args), res = await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS)), hooks = Array.isArray(res.hooks) ? res.hooks : [];
+    let cfg = apiConfig(), res = await listHooks(cfg, deploymentId, flagParams(args, PAGE_FLAG_PARAMS)), hooks = Array.isArray(res.hooks) ? res.hooks : [];
     return emit(res, (st) => renderList(hooks.map((h) => ({ ...h })), st, EMPTY_LISTS.HOOKS)), noteNextPage(args, { command: COMMANDS.HOOK_LIST, flags: PAGE_FLAG_PARAMS }, hooks), 0;
   });
 }
 async function runHookDelete(args, prompter = ttyPrompter) {
   let hookId = args.positionals[0];
   return hookId ? guard(async () => {
-    let cfg = apiConfig(args);
+    let cfg = apiConfig();
     return tell(RESULT_MESSAGES.HOOK_DELETE_PREVIEW(hookId)), await confirmOrAbort(args, prompter) ? (emit(await deleteHook(cfg, hookId)), sayOk(RESULT_MESSAGES.HOOK_DELETED(hookId)), 0) : 1;
   }) : (tell(MESSAGES.HOOK_DELETE_USAGE), 1);
 }
@@ -13856,7 +14429,7 @@ async function runNotifySet(args) {
   if (refusal !== null) return refuseNotifySet(refusal);
   let secret = args.options["secret-stdin"] === true ? import_fs6.default.readFileSync(0, "utf8").replace(/\n$/, "") : void 0;
   return secret === "" ? refuseNotifySet(MESSAGES.NOTIFY_SECRET_EMPTY) : guard(async () => {
-    let cfg = apiConfig(args), target = clear || typeof url != "string" ? null : url;
+    let cfg = apiConfig(), target = clear || typeof url != "string" ? null : url;
     return emit(await setNotify(cfg, deploymentId, { url: target, ...secret !== void 0 ? { secret } : {} })), sayOk(target === null ? RESULT_MESSAGES.NOTIFY_CLEARED(deploymentId) : RESULT_MESSAGES.NOTIFY_SET(deploymentId, target)), 0;
   });
 }
@@ -13879,6 +14452,198 @@ var import_fs6, init_hook = __esm({ "src/commands/hook.ts"() {
   init_shared();
   init_output();
 } });
+async function runPermissionList(_args) {
+  let permissions = permissionRows();
+  return emit({ permissions }, (st) => renderPermissions(st, permissions)), 0;
+}
+var init_permission = __esm({ "src/commands/permission.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_access();
+  init_output();
+} });
+async function runUserCreate(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let created = await createUser(apiConfig(), name);
+    return emit(created, (st) => renderFields(st, { ...created })), sayOk(MESSAGES.USER_CREATED(created.name)), 0;
+  });
+}
+async function runUserList(_args) {
+  return guard(async () => {
+    let data = await listUsers(apiConfig());
+    return emit(data, (st) => renderUsers(st, data.users)), 0;
+  });
+}
+async function runUserGet(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let user = await getUser(apiConfig(), name);
+    return emit(user, (st) => renderUser(st, user)), 0;
+  });
+}
+async function runUserRemove(args, prompter = ttyPrompter) {
+  let name = accessNameArg(args.positionals[0], ACCESS.USER, "name");
+  return name === null ? 1 : guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.USER_REMOVE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteUser(cfg, name);
+    return emit(res), sayOk(MESSAGES.USER_REMOVED(res.removed, res.revoked_keys.length)), 0;
+  });
+}
+var init_user = __esm({ "src/commands/user.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api();
+  init_prompt();
+  init_constants();
+  init_utils();
+  init_output();
+  init_shared();
+} });
+async function groupWrite(write, done) {
+  return guard(async () => {
+    let group = await write(apiConfig());
+    return emit(group, (st) => renderGroup(st, group)), sayOk(done), 0;
+  });
+}
+function permissionArg(raw) {
+  if (raw === void 0 || raw === "") return fail(MESSAGES.ARG_REQUIRED("permission")), null;
+  let checked = checkPermission(raw);
+  return checked.ok ? checked.value : (fail(checked.message), null);
+}
+async function runGroupCreate(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permissions = parsePermissions(strOpt(args, "permissions"));
+  return permissions.ok ? groupWrite((cfg) => createGroup(cfg, name, permissions.value), MESSAGES.GROUP_CREATED(name)) : (fail(permissions.message), 1);
+}
+async function runGroupList(_args) {
+  return guard(async () => {
+    let data = await listGroups(apiConfig());
+    return emit(data, (st) => renderGroups(st, data.groups)), 0;
+  });
+}
+async function runGroupGet(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  return name === null ? 1 : guard(async () => {
+    let group = await getGroup(apiConfig(), name);
+    return emit(group, (st) => renderGroup(st, group)), 0;
+  });
+}
+async function runGroupGrant(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permission = permissionArg(args.positionals[1]);
+  return permission === null ? 1 : groupWrite((cfg) => grantGroupPermission(cfg, name, permission), MESSAGES.GROUP_GRANTED(name, permission));
+}
+async function runGroupRevoke(args) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  if (name === null) return 1;
+  let permission = permissionArg(args.positionals[1]);
+  return permission === null ? 1 : groupWrite((cfg) => revokeGroupPermission(cfg, name, permission), MESSAGES.GROUP_REVOKED(name, permission));
+}
+async function runGroupAddUser(args) {
+  let group = accessNameArg(args.positionals[0], ACCESS.GROUP, "group");
+  if (group === null) return 1;
+  let user = accessNameArg(args.positionals[1], ACCESS.USER, "user");
+  return user === null ? 1 : groupWrite((cfg) => addGroupUser(cfg, group, user), MESSAGES.GROUP_USER_ADDED(group, user));
+}
+async function runGroupRemoveUser(args) {
+  let group = accessNameArg(args.positionals[0], ACCESS.GROUP, "group");
+  if (group === null) return 1;
+  let user = accessNameArg(args.positionals[1], ACCESS.USER, "user");
+  return user === null ? 1 : groupWrite((cfg) => removeGroupUser(cfg, group, user), MESSAGES.GROUP_USER_REMOVED(group, user));
+}
+async function runGroupDelete(args, prompter = ttyPrompter) {
+  let name = accessNameArg(args.positionals[0], ACCESS.GROUP, "name");
+  return name === null ? 1 : guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.GROUP_DELETE_PREVIEW(name)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteGroup(cfg, name);
+    return emit(res), sayOk(MESSAGES.GROUP_DELETED(res.deleted)), 0;
+  });
+}
+var init_group = __esm({ "src/commands/group.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_api();
+  init_prompt();
+  init_constants();
+  init_access();
+  init_utils();
+  init_output();
+  init_shared();
+} });
+function keyFileDocument(created, out2) {
+  let { raw_key: _raw, ...rest } = created;
+  return { ...rest, out: out2 };
+}
+function openOutFile(out2) {
+  try {
+    return { fd: createPrivateFile(out2), path: out2 };
+  } catch (e) {
+    return fail(errCode(e) === "EEXIST" ? MESSAGES.KEY_OUT_EXISTS(out2) : MESSAGES.KEY_OUT_FAILED(out2, errText(e))), null;
+  }
+}
+async function runKeyCreate(args) {
+  let rawUser = strOpt(args, "user");
+  if (rawUser === void 0 || rawUser === "") return fail(MESSAGES.KEY_USER_REQUIRED), 1;
+  let user = accessNameArg(rawUser, ACCESS.USER, "--user");
+  if (user === null) return 1;
+  let label = strOpt(args, "label")?.trim() ?? "";
+  if (label === "") return fail(MESSAGES.KEY_LABEL_REQUIRED), 1;
+  let out2 = strOpt(args, "out");
+  return guard(async () => {
+    let cfg = apiConfig(), file = null;
+    if (out2 !== void 0 && (file = openOutFile(out2), file === null)) return 1;
+    let created;
+    try {
+      created = await createKey(cfg, { user, label });
+    } catch (e) {
+      throw file !== null && discardPrivateFile(file.fd, file.path), e;
+    }
+    if (created.raw_key === null) return file !== null && discardPrivateFile(file.fd, file.path), fail(MESSAGES.KEY_REDACTED(created.resource_id)), 1;
+    if (file !== null) {
+      try {
+        fillPrivateFile(file.fd, file.path, `${created.raw_key}
+`);
+      } catch (e) {
+        return fail(MESSAGES.KEY_OUT_WRITE_FAILED(file.path, errText(e), created.resource_id)), 1;
+      }
+      return emit(keyFileDocument(created, file.path)), sayOk(MESSAGES.KEY_WRITTEN(created.resource_id, file.path)), 0;
+    }
+    return warn(MESSAGES.KEY_SHOWN_ONCE), emit(created, (st) => renderKeyCreated(st, created)), 0;
+  });
+}
+async function runKeyList(args) {
+  let rawUser = strOpt(args, "user"), user = rawUser === void 0 ? void 0 : accessNameArg(rawUser, ACCESS.USER, "--user");
+  return user === null ? 1 : guard(async () => {
+    let data = await listKeys(apiConfig(), user);
+    return emit(data, (st) => renderKeys(st, data.keys)), 0;
+  });
+}
+async function runKeyRevoke(args, prompter = ttyPrompter) {
+  let id = requireArg(args, "key-resource-id");
+  return id ? guard(async () => {
+    let cfg = apiConfig();
+    if (tell(RESULT_MESSAGES.KEY_REVOKE_PREVIEW(id)), !await confirmOrAbort(args, prompter)) return 1;
+    let res = await deleteKey(cfg, id);
+    return emit(res), sayOk(MESSAGES.KEY_REVOKED(res.revoked)), 0;
+  }) : 1;
+}
+var init_key = __esm({ "src/commands/key.ts"() {
+  "use strict";
+  init_define_IGNITIFY_CLIENT_FILES();
+  init_tenant();
+  init_api();
+  init_credentials();
+  init_prompt();
+  init_constants();
+  init_utils();
+  init_output();
+  init_shared();
+} });
 var init_commands = __esm({ "src/commands/index.ts"() {
   "use strict";
   init_define_IGNITIFY_CLIENT_FILES();
@@ -13892,7 +14657,12 @@ var init_commands = __esm({ "src/commands/index.ts"() {
   init_secret();
   init_schedule();
   init_integration();
+  init_notification();
   init_hook();
+  init_permission();
+  init_user();
+  init_group();
+  init_key();
   init_decide_vm_delete();
 } });
 function metaFor(command) {
@@ -13924,7 +14694,7 @@ function checkInvocation(command, meta, pass) {
   for (let key of Object.keys(args.options)) {
     if (Object.hasOwn(flags, key)) continue;
     let short = typed[key];
-    return short !== void 0 ? MESSAGES.UNKNOWN_SHORT_FLAG(short, key, command) : unknownFlagRefusal(key, command, Object.keys(meta.flags), Object.keys(GLOBAL_FLAGS), HIDDEN_FLAGS);
+    return short !== void 0 ? MESSAGES.UNKNOWN_SHORT_FLAG(short, key, command) : unknownFlagRefusal(key, command, Object.keys(meta.flags), Object.keys(GLOBAL_FLAGS));
   }
   let badShort = pass.unknown[0];
   return badShort !== void 0 ? unknownFlagText(badShort, command) : meta.secretArgv === true ? null : shapeRefusal(command, args, flags, meta.positionals);
@@ -13962,7 +14732,7 @@ async function dispatch(plan) {
     case "unknown":
       return fail(`${MESSAGES.UNKNOWN_COMMAND}: ${plan.command}`, { hint: MESSAGES.SEE_HELP }), 1;
     case "version":
-      return runVersion(plan.args);
+      return runVersion();
     case "run":
       return route(plan.command, plan.args);
   }
@@ -13993,6 +14763,8 @@ function route(command, args) {
       return runUsageShow(args);
     case COMMANDS.USAGE_EXPORT:
       return runUsageExport(args);
+    case COMMANDS.USAGE_SERIES:
+      return runUsageSeries(args);
     case COMMANDS.TASK_CREATE:
       return runTaskCreate(args);
     case COMMANDS.TASK_LIST:
@@ -14013,6 +14785,10 @@ function route(command, args) {
       return runRunGet(args);
     case COMMANDS.RUN_LOGS:
       return runRunLogs(args);
+    case COMMANDS.RUN_TIMELINE:
+      return runRunTimeline(args);
+    case COMMANDS.RUN_FAILURES:
+      return runRunFailures(args);
     case COMMANDS.RUN_DELETE:
       return runRunDelete(args);
     case COMMANDS.RUN_CANCEL:
@@ -14043,6 +14819,40 @@ function route(command, args) {
       return runNotifySet(args);
     case COMMANDS.INTEGRATION_ADD:
       return runIntegrationAdd(args);
+    case COMMANDS.NOTIFICATION_LIST:
+      return runNotificationList(args);
+    case COMMANDS.PERMISSION_LIST:
+      return runPermissionList(args);
+    case COMMANDS.USER_CREATE:
+      return runUserCreate(args);
+    case COMMANDS.USER_LIST:
+      return runUserList(args);
+    case COMMANDS.USER_GET:
+      return runUserGet(args);
+    case COMMANDS.USER_REMOVE:
+      return runUserRemove(args);
+    case COMMANDS.GROUP_CREATE:
+      return runGroupCreate(args);
+    case COMMANDS.GROUP_LIST:
+      return runGroupList(args);
+    case COMMANDS.GROUP_GET:
+      return runGroupGet(args);
+    case COMMANDS.GROUP_GRANT:
+      return runGroupGrant(args);
+    case COMMANDS.GROUP_REVOKE:
+      return runGroupRevoke(args);
+    case COMMANDS.GROUP_ADD_USER:
+      return runGroupAddUser(args);
+    case COMMANDS.GROUP_REMOVE_USER:
+      return runGroupRemoveUser(args);
+    case COMMANDS.GROUP_DELETE:
+      return runGroupDelete(args);
+    case COMMANDS.KEY_CREATE:
+      return runKeyCreate(args);
+    case COMMANDS.KEY_LIST:
+      return runKeyList(args);
+    case COMMANDS.KEY_REVOKE:
+      return runKeyRevoke(args);
   }
 }
 async function main(argv) {