letthemquibble 1.0.0 → 1.1.0

package/dist/quibble.js

@@ -1156,18 +1156,18 @@ var require_suggestSimilar = __commonJS({
       }
       return d[a.length][b.length];
     }
-    function suggestSimilar(word, candidates) {
-      if (!candidates || candidates.length === 0) return "";
-      candidates = Array.from(new Set(candidates));
+    function suggestSimilar(word, candidates2) {
+      if (!candidates2 || candidates2.length === 0) return "";
+      candidates2 = Array.from(new Set(candidates2));
       const searchingOptions = word.startsWith("--");
       if (searchingOptions) {
         word = word.slice(2);
-        candidates = candidates.map((candidate) => candidate.slice(2));
+        candidates2 = candidates2.map((candidate) => candidate.slice(2));
       }
       let similar = [];
       let bestDistance = maxDistance;
       const minSimilarity = 0.4;
-      candidates.forEach((candidate) => {
+      candidates2.forEach((candidate) => {
         if (candidate.length <= 1) return;
         const distance = editDistance(word, candidate);
         const length = Math.max(word.length, candidate.length);
@@ -3490,110 +3490,6 @@ var {
   Help
 } = import_index.default;
 
-// src/config.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
-
-// ../core/dist/types.js
-var SEVERITIES = ["low", "medium", "high"];
-var STATUSES = ["open", "resolved", "dismissed", "deleted"];
-var DELETED_STATUS = "deleted";
-var MESSAGE_MAX = 4e3;
-var RESOLUTION_MAX = 500;
-var TAGS_MAX = 10;
-var TAG_MAX = 32;
-var ALLOWED_TAGS_MAX = 50;
-var OTHER_TAG = "other";
-var OTHER_TAG_PREFIX = `${OTHER_TAG}:`;
-var OTHER_TAG_HINT = `${OTHER_TAG_PREFIX}<suggestion>`;
-var ALLOWED_TAG_RE = /^[a-z0-9][a-z0-9._-]*$/;
-var AGENT_MAX = 64;
-var REPORTER_MAX = 128;
-var EMAIL_MAX = REPORTER_MAX;
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var TOKEN_NAME_MAX = 64;
-var CWD_MAX = 1024;
-var UNTAGGED_TAG = "-";
-var STATS_MAX_WINDOW_DAYS = 90;
-var ROLES = ["filer", "viewer", "maintainer"];
-var ORG_ROLES = ["member", "admin", "owner"];
-var ORG_COLOURS = [
-  "slate",
-  "moss",
-  "ember",
-  "rust",
-  "teal",
-  "plum",
-  "snowcat",
-  "bone"
-];
-var DEFAULT_ORG_COLOUR = "slate";
-var ORG_SLUG_RE = /^[a-z0-9][a-z0-9-]{1,37}[a-z0-9]$/;
-var RESERVED_SLUGS = [
-  "api",
-  "admin",
-  "login",
-  "logout",
-  "o",
-  "orgs",
-  "new",
-  "platform",
-  "local",
-  "www",
-  "app",
-  "settings",
-  "signup"
-];
-var LOCAL_ORG = "local";
-var DISPLAY_NAME_MAX = 64;
-var PROJECT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-var DEFAULT_LIMIT = 50;
-var MAX_LIMIT = 200;
-var DEFAULT_SEVERITY = "medium";
-var DEFAULT_STATUS = "open";
-var DEFAULT_AGENT = "unknown";
-var DEFAULT_REPORTER = "unknown";
-var ACT_AS_HEADER = "x-quibble-act-as";
-
-// ../core/dist/errors.js
-var QuibbleError = class extends Error {
-  /** Stable machine-readable code, also used by the API error body. */
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = new.target.name;
-  }
-};
-var ValidationError = class extends QuibbleError {
-  /** One readable line per problem, such as `message: must be 1-4000 characters`. */
-  issues;
-  constructor(issues, options) {
-    const list = issues.length > 0 ? issues : ["invalid input"];
-    super("validation_error", list.join("; "), options);
-    this.issues = [...list];
-  }
-};
-var StorageError = class extends QuibbleError {
-  constructor(message, options) {
-    super("storage_error", message, options);
-  }
-};
-var ConfigError = class extends QuibbleError {
-  /** The file that holds the bad configuration, when one exists. */
-  path;
-  constructor(message, path, options) {
-    super("config_error", message, options);
-    this.path = path;
-  }
-};
-function isNotFound(error62) {
-  return typeof error62 === "object" && error62 !== null && error62.code === "ENOENT";
-}
-function describeError(error62) {
-  return error62 instanceof Error ? error62.message : String(error62);
-}
-
 // ../../node_modules/.pnpm/zod@4.6.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -6407,9 +6303,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname3) {
-  hostname3.lastIndex = 0;
-  return hostname3.test(url2.hostname);
+function urlHostnameOk(url2, hostname4) {
+  hostname4.lastIndex = 0;
+  return hostname4.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -8620,7 +8516,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -8630,7 +8526,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer2 = isRecursive(child, stack, resolve3);
+      const answer2 = isRecursive(child, stack, resolve4);
       if (answer2 > result)
         result = answer2;
     }
@@ -8641,7 +8537,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer2)
         answer2 = child;
     }
@@ -8705,7 +8601,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -23262,66 +23158,292 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../core/dist/jitless.js
+external_exports.config({ jitless: true });
+
+// ../core/dist/types.js
+var SEVERITIES = ["low", "medium", "high"];
+var STATUSES = ["open", "resolved", "dismissed", "deleted"];
+var DELETED_STATUS = "deleted";
+var REASONS = ["fixed", "duplicate", "wontfix", "noise"];
+var DUPLICATE_REASON = "duplicate";
+var MESSAGE_MAX = 4e3;
+var RESOLUTION_MAX = 500;
+var TAGS_MAX = 10;
+var TAG_MAX = 32;
+var ALLOWED_TAGS_MAX = 50;
+var OTHER_TAG = "other";
+var OTHER_TAG_PREFIX = `${OTHER_TAG}:`;
+var OTHER_TAG_HINT = `${OTHER_TAG_PREFIX}<suggestion>`;
+var ALLOWED_TAG_RE = /^[a-z0-9][a-z0-9._-]*$/;
+var AGENT_MAX = 64;
+var REPORTER_MAX = 128;
+var EMAIL_MAX = REPORTER_MAX;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var TOKEN_NAME_MAX = 64;
+var CWD_MAX = 1024;
+var CMD_MAX = 1e3;
+var FINGERPRINT_MAX = 200;
+var EMPTY_FINGERPRINT = "<empty>";
+var RECURRENCE_WINDOW_DAYS = 90;
+var SEARCH_MAX = 200;
+var BULK_MAX = 100;
+var ID_MAX = 64;
+var UNTAGGED_TAG = "-";
+var STATS_MAX_WINDOW_DAYS = 90;
+var ROLES = ["filer", "viewer", "maintainer"];
+var ORG_ROLES = ["member", "admin", "owner"];
+var ORG_COLOURS = [
+  "slate",
+  "moss",
+  "ember",
+  "rust",
+  "teal",
+  "plum",
+  "snowcat",
+  "bone"
+];
+var DEFAULT_ORG_COLOUR = "slate";
+var ORG_SLUG_RE = /^[a-z0-9][a-z0-9-]{1,37}[a-z0-9]$/;
+var RESERVED_SLUGS = [
+  "api",
+  "admin",
+  "login",
+  "logout",
+  "o",
+  "orgs",
+  "new",
+  "platform",
+  "local",
+  "www",
+  "app",
+  "settings",
+  "signup"
+];
+var LOCAL_ORG = "local";
+var DISPLAY_NAME_MAX = 64;
+var PROJECT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var DEFAULT_LIMIT = 50;
+var MAX_LIMIT = 200;
+var DEFAULT_SEVERITY = "medium";
+var DEFAULT_STATUS = "open";
+var DEFAULT_AGENT = "unknown";
+var DEFAULT_REPORTER = "unknown";
+var ACT_AS_HEADER = "x-quibble-act-as";
+var TRUNCATED_HEADER = "x-quibble-truncated";
+var IDEMPOTENCY_HEADER = "idempotency-key";
+var IDEMPOTENCY_KEY_MAX = 128;
+
+// ../core/dist/errors.js
+var QuibbleError = class extends Error {
+  /** Stable machine-readable code, also used by the API error body. */
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+  }
+};
+var ValidationError = class extends QuibbleError {
+  /** One readable line per problem, such as `message: must be 1-4000 characters`. */
+  issues;
+  constructor(issues, options) {
+    const list = issues.length > 0 ? issues : ["invalid input"];
+    super("validation_error", list.join("; "), options);
+    this.issues = [...list];
+  }
+};
+var StorageError = class extends QuibbleError {
+  constructor(message, options) {
+    super("storage_error", message, options);
+  }
+};
+var DuplicateIdError = class extends StorageError {
+  /** The id that a record already holds. */
+  id;
+  /**
+   * The record that won, when the store read it back, so the caller answers
+   * it without a read of its own that an index may not see yet.
+   */
+  existing;
+  constructor(id, existing, options) {
+    super(`complaint ${id} already exists`, options);
+    this.id = id;
+    this.existing = existing;
+  }
+};
+var ConfigError = class extends QuibbleError {
+  /** The file that holds the bad configuration, when one exists. */
+  path;
+  constructor(message, path, options) {
+    super("config_error", message, options);
+    this.path = path;
+  }
+};
+function isNotFound(error62) {
+  return typeof error62 === "object" && error62 !== null && error62.code === "ENOENT";
+}
+function describeError(error62) {
+  return error62 instanceof Error ? error62.message : String(error62);
+}
+
+// ../core/dist/fingerprint.js
+function headlineOf(message) {
+  for (const line of message.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed !== "")
+      return trimmed;
+  }
+  return "";
+}
+var WORD_CHAR = "[\\p{L}\\p{N}]";
+var QUOTED_RE = new RegExp(`"[^"]*"|\`[^\`]*\`|(?<!${WORD_CHAR})'.*?'(?!${WORD_CHAR})`, "gu");
+var PATH_RE = /[^\s]*[/\\][^\s]*/gu;
+var UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gu;
+var HEX_LITERAL_RE = /0x[0-9a-f]+/gu;
+var HEX_RUN_RE = new RegExp(`(?<!${WORD_CHAR})[0-9a-f]{7,}(?!${WORD_CHAR})`, "gu");
+var NUMBER_RE = new RegExp("\\p{N}+(?:\\.\\p{N}+)*", "gu");
+var PUNCTUATION_RE = /[^\p{L}\p{N}\s<>]/gu;
+function isHexId(run2) {
+  return /[a-f]/.test(run2) && /[0-9]/.test(run2);
+}
+function cut(text, max) {
+  if (text.length <= max)
+    return text;
+  const head = text.slice(0, max);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+function fingerprintOf(message) {
+  let text = headlineOf(message).toLowerCase();
+  text = text.replace(/[<>]/gu, " ");
+  text = text.replace(QUOTED_RE, " <str> ");
+  text = text.replace(PATH_RE, "<path>");
+  text = text.replace(UUID_RE, "<hex>");
+  text = text.replace(HEX_LITERAL_RE, "<hex>");
+  text = text.replace(HEX_RUN_RE, (run2) => isHexId(run2) ? "<hex>" : run2);
+  text = text.replace(NUMBER_RE, "<n>");
+  text = text.replace(PUNCTUATION_RE, " ");
+  text = text.replace(/\s+/gu, " ").trim();
+  text = cut(text, FINGERPRINT_MAX).trim();
+  return text === "" ? EMPTY_FINGERPRINT : text;
+}
+function groupComplaints(complaints) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const complaint of complaints) {
+    const key = `${complaint.org}/${complaint.project}
+${complaint.fingerprint}`;
+    const group = groups.get(key);
+    const recurred = complaint.status === "open" && complaint.recurred === true;
+    if (group === void 0) {
+      groups.set(key, {
+        project: complaint.project,
+        fingerprint: complaint.fingerprint,
+        head: complaint,
+        members: [complaint],
+        count: 1,
+        recurred
+      });
+      continue;
+    }
+    group.members.push(complaint);
+    group.count = group.members.length;
+    group.recurred ||= recurred;
+  }
+  return [...groups.values()];
+}
+
 // ../core/dist/validate.js
-var NULLABLE_KEYS = [
+var NEW_NULLABLE_KEYS = [
   "severity",
   "tags",
   "agent",
   "reporter",
   "reporterName",
   "cwd",
-  "status",
-  "resolution",
-  "updatedAt"
+  "cmd"
 ];
-var BLANKABLE_KEYS = [
+var NEW_BLANKABLE_KEYS = [
   "severity",
   "agent",
   "reporter",
   "reporterName",
+  "cmd"
+];
+var STORED_STATUS_KEYS = [
   "status",
   "resolution",
+  "reason",
+  "duplicateOf",
+  "statusChangedAt",
+  "statusChangedBy",
+  "statusChangedByName",
   "updatedAt"
 ];
+var STORED_NULLABLE_KEYS = [
+  ...NEW_NULLABLE_KEYS,
+  ...STORED_STATUS_KEYS,
+  "fingerprint",
+  "recurred"
+];
+var STORED_BLANKABLE_KEYS = [
+  ...NEW_BLANKABLE_KEYS,
+  ...STORED_STATUS_KEYS,
+  "fingerprint"
+];
 var FILTER_KEYS = [
   "project",
   "severity",
   "status",
-  "tag",
+  "tags",
   "reporter",
+  "q",
   "since",
   "until",
   "limit"
 ];
-var STATUS_CHANGE_KEYS = ["status", "resolution"];
+var FILTER_NULLABLE_KEYS = ["fingerprint"];
+var STATUS_CHANGE_KEYS = ["status", "resolution", "reason", "duplicateOf"];
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isBlank(value) {
   return typeof value === "string" && value.trim() === "";
 }
-function normalizeComplaintInput(value) {
+function complaintInput(nullable2, blankable) {
+  return (value) => {
+    if (!isPlainObject2(value))
+      return value;
+    const out = { ...value };
+    for (const key of nullable2) {
+      if (out[key] === null)
+        delete out[key];
+    }
+    for (const key of blankable) {
+      if (isBlank(out[key]))
+        delete out[key];
+    }
+    if (isBlank(out["cwd"]))
+      out["cwd"] = ".";
+    return out;
+  };
+}
+function normalizeKeys(value, keys) {
   if (!isPlainObject2(value))
     return value;
   const out = { ...value };
-  for (const key of NULLABLE_KEYS) {
-    if (out[key] === null)
-      delete out[key];
-  }
-  for (const key of BLANKABLE_KEYS) {
-    if (isBlank(out[key]))
+  for (const key of keys) {
+    if (out[key] === null || isBlank(out[key]))
       delete out[key];
   }
-  if (isBlank(out["cwd"]))
-    out["cwd"] = ".";
   return out;
 }
-function normalizeKeys(value, keys) {
+function dropNulls(value, keys) {
   if (!isPlainObject2(value))
     return value;
   const out = { ...value };
   for (const key of keys) {
-    if (out[key] === null || isBlank(out[key]))
+    if (out[key] === null)
       delete out[key];
   }
   return out;
@@ -23333,6 +23455,12 @@ function boundedString(max, typeMessage) {
   const message = lengthMessage(1, max);
   return external_exports.string({ message: typeMessage ?? message }).trim().min(1, { message }).max(max, { message });
 }
+var CONTROL_RE = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/;
+var CONTROL_MESSAGE = "must not contain control characters";
+function freeText(max, typeMessage) {
+  const message = lengthMessage(1, max);
+  return external_exports.string({ message: typeMessage ?? message }).overwrite((value) => value.replace(/\r\n?/g, "\n")).trim().min(1, { message }).max(max, { message }).refine((value) => !CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
+}
 var SEVERITY_MESSAGE = `must be one of ${SEVERITIES.join(", ")}`;
 var STATUS_MESSAGE = `must be one of ${STATUSES.join(", ")}`;
 var LIMIT_MESSAGE = `must be an integer between 1 and ${MAX_LIMIT}`;
@@ -23354,7 +23482,11 @@ var orgSlugSchema = external_exports.string({ message: SLUG_MESSAGE }).refine((v
 });
 var severitySchema = external_exports.enum(SEVERITIES, { message: SEVERITY_MESSAGE });
 var statusSchema = external_exports.enum(STATUSES, { message: STATUS_MESSAGE });
-var resolutionSchema = boundedString(RESOLUTION_MAX);
+var REASON_MESSAGE = `must be one of ${REASONS.join(", ")}`;
+var reasonSchema = external_exports.enum(REASONS, { message: REASON_MESSAGE });
+var idSchema = boundedString(ID_MAX, ID_MESSAGE);
+var resolutionSchema = freeText(RESOLUTION_MAX);
+var storedResolutionSchema = boundedString(RESOLUTION_MAX);
 var TAG_LENGTH_MESSAGE = lengthMessage(1, TAG_MAX);
 var SUGGESTION_LENGTH_MESSAGE = `must be at most ${TAG_MAX} characters after "${OTHER_TAG_PREFIX}"`;
 var tagSchema = external_exports.string({ message: "must be a string" }).trim().min(1, { message: TAG_LENGTH_MESSAGE }).superRefine((tag, ctx) => {
@@ -23370,8 +23502,8 @@ var tagSchema = external_exports.string({ message: "must be a string" }).trim().
   }
 });
 var TAGS_TYPE_MESSAGE = "must be an array of strings";
-var UNTAGGED_TAG_MESSAGE = `must not be "${UNTAGGED_TAG}", which selects the complaints with no tag`;
-var RESERVED_TAG_MESSAGE = `must not be "${OTHER_TAG}" or start with "${OTHER_TAG_PREFIX}", which are reserved`;
+var UNTAGGED_TAG_MESSAGE = `must not be "${UNTAGGED_TAG}" (reserved for untagged)`;
+var RESERVED_TAG_MESSAGE = `must not be "${OTHER_TAG}" or start with "${OTHER_TAG_PREFIX}" (reserved)`;
 var ALLOWED_TAG_MESSAGE = 'must use only letters, digits, ".", "_" and "-", and start with a letter or digit';
 function normalizeTag(tag) {
   const lower = tag.toLowerCase();
@@ -23386,7 +23518,7 @@ var complaintTagSchema = tagSchema.refine((tag) => tag !== UNTAGGED_TAG, {
 var tagsSchema = external_exports.array(complaintTagSchema, { message: TAGS_TYPE_MESSAGE }).transform(normalizeTags).refine((tags) => tags.length <= TAGS_MAX, {
   message: `must have at most ${TAGS_MAX} tags`
 });
-var tagsChangeObject = external_exports.object({
+var tagsChangeObject = external_exports.strictObject({
   tags: tagsSchema.refine((tags) => tags.length > 0, {
     message: "must list at least 1 tag"
   })
@@ -23474,17 +23606,21 @@ var limitSchema = external_exports.preprocess((value) => {
   const parsed = Number(trimmed);
   return Number.isNaN(parsed) ? value : parsed;
 }, external_exports.number({ message: LIMIT_MESSAGE }).int({ message: LIMIT_MESSAGE }).min(1, { message: LIMIT_MESSAGE }).max(MAX_LIMIT, { message: LIMIT_MESSAGE }));
-var newComplaintObject = external_exports.object({
+var agentSchema = freeText(AGENT_MAX);
+var newComplaintShape = {
   org: orgSlugSchema,
   project: projectNameSchema,
-  message: boundedString(MESSAGE_MAX),
+  message: freeText(MESSAGE_MAX),
   severity: severitySchema.optional(),
   tags: tagsSchema.optional(),
-  agent: boundedString(AGENT_MAX).optional(),
-  reporter: boundedString(REPORTER_MAX).optional(),
-  reporterName: boundedString(REPORTER_MAX).optional(),
-  cwd: cwdSchema.optional()
-});
+  agent: agentSchema.optional(),
+  reporter: freeText(REPORTER_MAX).optional(),
+  reporterName: freeText(REPORTER_MAX).optional(),
+  cwd: cwdSchema.optional(),
+  // Free text: it is trimmed and may hold newlines, and nothing parses it.
+  cmd: freeText(CMD_MAX).optional()
+};
+var newComplaintObject = external_exports.strictObject(newComplaintShape);
 function withDefaults(input2) {
   return {
     org: input2.org,
@@ -23496,74 +23632,207 @@ function withDefaults(input2) {
     reporter: input2.reporter ?? DEFAULT_REPORTER,
     // The server sets the display name, so it stays absent when nobody did.
     ...input2.reporterName === void 0 ? {} : { reporterName: input2.reporterName },
-    ...input2.cwd === void 0 ? {} : { cwd: input2.cwd }
+    ...input2.cwd === void 0 ? {} : { cwd: input2.cwd },
+    ...input2.cmd === void 0 ? {} : { cmd: input2.cmd }
   };
 }
-var newComplaintSchema = external_exports.preprocess(normalizeComplaintInput, newComplaintObject).transform(withDefaults);
-var storedComplaintObject = newComplaintObject.extend({
+var newComplaintSchema = external_exports.preprocess(complaintInput(NEW_NULLABLE_KEYS, NEW_BLANKABLE_KEYS), newComplaintObject).transform(withDefaults);
+var actorSchema = boundedString(REPORTER_MAX);
+var storedComplaintObject = external_exports.object({
+  ...newComplaintShape,
+  // The free text of a stored record is read without the control rule, so a
+  // record written before it stays readable.
+  message: boundedString(MESSAGE_MAX),
+  agent: boundedString(AGENT_MAX).optional(),
+  reporter: boundedString(REPORTER_MAX).optional(),
+  reporterName: boundedString(REPORTER_MAX).optional(),
+  cmd: boundedString(CMD_MAX).optional(),
   id: external_exports.string({ message: ID_MESSAGE }).trim().min(1, { message: ID_MESSAGE }),
+  fingerprint: external_exports.string({ message: ID_MESSAGE }).min(1, { message: ID_MESSAGE }).optional(),
+  recurred: external_exports.boolean({ message: "must be a boolean" }).optional(),
   createdAt: timestampSchema,
   status: statusSchema.optional(),
-  resolution: resolutionSchema.optional(),
+  resolution: storedResolutionSchema.optional(),
+  reason: reasonSchema.optional(),
+  duplicateOf: idSchema.optional(),
+  statusChangedAt: timestampSchema.optional(),
+  statusChangedBy: actorSchema.optional(),
+  statusChangedByName: actorSchema.optional(),
   updatedAt: timestampSchema.optional()
 });
-var complaintSchema = external_exports.preprocess(normalizeComplaintInput, storedComplaintObject).transform((input2) => ({
+var complaintSchema = external_exports.preprocess(complaintInput(STORED_NULLABLE_KEYS, STORED_BLANKABLE_KEYS), storedComplaintObject).transform((input2) => ({
   id: input2.id,
   ...withDefaults(input2),
+  fingerprint: input2.fingerprint ?? fingerprintOf(input2.message),
+  // The store writes the flag only when it is true.
+  ...input2.recurred === true ? { recurred: true } : {},
   // Millisecond precision, so a record written without a fraction still
   // compares by time against a `since` and an `until`.
   createdAt: toMilliseconds(input2.createdAt),
   status: input2.status ?? DEFAULT_STATUS,
   ...input2.resolution === void 0 ? {} : { resolution: input2.resolution },
+  ...input2.reason === void 0 ? {} : { reason: input2.reason },
+  ...input2.duplicateOf === void 0 ? {} : { duplicateOf: input2.duplicateOf },
+  ...input2.statusChangedAt === void 0 ? {} : { statusChangedAt: toMilliseconds(input2.statusChangedAt) },
+  ...input2.statusChangedBy === void 0 ? {} : { statusChangedBy: input2.statusChangedBy },
+  ...input2.statusChangedByName === void 0 ? {} : { statusChangedByName: input2.statusChangedByName },
   ...input2.updatedAt === void 0 ? {} : { updatedAt: toMilliseconds(input2.updatedAt) }
 }));
-var statusChangeObject = external_exports.object({
+var REASON_STATUS_MESSAGE = "only a resolve or a dismiss takes a reason";
+var DUPLICATE_OF_MESSAGE = `needs reason ${DUPLICATE_REASON}`;
+var statusChangeShape = {
   status: statusSchema,
-  resolution: resolutionSchema.optional()
-});
-var statusChangeSchema = external_exports.preprocess((value) => normalizeKeys(value, STATUS_CHANGE_KEYS), statusChangeObject).transform((input2) => ({
-  status: input2.status,
-  ...input2.resolution === void 0 ? {} : { resolution: input2.resolution }
-}));
-var BEFORE_UNTIL_MESSAGE = "must be before until";
-function checkWindow(window, ctx) {
-  const { since, until } = window;
+  resolution: resolutionSchema.optional(),
+  reason: reasonSchema.optional(),
+  duplicateOf: idSchema.optional()
+};
+function checkReason(change, ctx) {
+  if (change.reason !== void 0 && change.status !== "resolved" && change.status !== "dismissed") {
+    ctx.addIssue({ code: "custom", path: ["reason"], message: REASON_STATUS_MESSAGE });
+  }
+  if (change.duplicateOf !== void 0 && change.reason !== DUPLICATE_REASON) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["duplicateOf"],
+      message: DUPLICATE_OF_MESSAGE
+    });
+  }
+}
+function toStatusChange(input2) {
+  return {
+    status: input2.status,
+    ...input2.resolution === void 0 ? {} : { resolution: input2.resolution },
+    ...input2.reason === void 0 ? {} : { reason: input2.reason },
+    ...input2.duplicateOf === void 0 ? {} : { duplicateOf: input2.duplicateOf }
+  };
+}
+var statusChangeSchema = external_exports.preprocess((value) => normalizeKeys(value, STATUS_CHANGE_KEYS), external_exports.strictObject(statusChangeShape).superRefine(checkReason)).transform(toStatusChange);
+var BULK_IDS_MESSAGE = `must list 1 to ${BULK_MAX} ids`;
+var BULK_BOTH_MESSAGE = "must change the status or the tags, not both";
+var BULK_NEITHER_MESSAGE = "must carry a status, addTags or removeTags";
+var BULK_NO_TAG_MESSAGE = "must carry at least 1 tag in addTags or removeTags";
+var BULK_TAG_KEYS = ["addTags", "removeTags"];
+var bulkIdsSchema = external_exports.array(idSchema, { message: BULK_IDS_MESSAGE }).min(1, { message: BULK_IDS_MESSAGE }).max(BULK_MAX, { message: BULK_IDS_MESSAGE }).transform((ids) => [...new Set(ids)]);
+var bulkChangeSchema = external_exports.preprocess((value) => dropNulls(normalizeKeys(value, STATUS_CHANGE_KEYS), BULK_TAG_KEYS), external_exports.strictObject({
+  ids: bulkIdsSchema,
+  status: statusChangeShape.status.optional(),
+  resolution: statusChangeShape.resolution,
+  reason: statusChangeShape.reason,
+  duplicateOf: statusChangeShape.duplicateOf,
+  addTags: tagsSchema.optional(),
+  removeTags: tagsSchema.optional()
+}).superRefine((input2, ctx) => {
+  const status = STATUS_CHANGE_KEYS.some((key) => input2[key] !== void 0);
+  const tags = BULK_TAG_KEYS.some((key) => input2[key] !== void 0);
+  if (status && tags) {
+    ctx.addIssue({ code: "custom", message: BULK_BOTH_MESSAGE });
+    return;
+  }
+  if (!status && !tags) {
+    ctx.addIssue({ code: "custom", message: BULK_NEITHER_MESSAGE });
+    return;
+  }
+  if (status) {
+    if (input2.status === void 0) {
+      ctx.addIssue({ code: "custom", path: ["status"], message: STATUS_MESSAGE });
+      return;
+    }
+    checkReason({ ...input2, status: input2.status }, ctx);
+    return;
+  }
+  const addTags = input2.addTags ?? [];
+  const removeTags = input2.removeTags ?? [];
+  if (addTags.length + removeTags.length === 0) {
+    ctx.addIssue({ code: "custom", message: BULK_NO_TAG_MESSAGE });
+    return;
+  }
+  for (const tag of removeTags) {
+    if (!addTags.includes(tag))
+      continue;
+    ctx.addIssue({
+      code: "custom",
+      path: ["removeTags"],
+      message: `${tag} is also in addTags`
+    });
+  }
+})).transform((input2) => {
+  if (input2.status !== void 0) {
+    return {
+      ids: input2.ids,
+      kind: "status",
+      change: toStatusChange({ ...input2, status: input2.status })
+    };
+  }
+  return {
+    ids: input2.ids,
+    kind: "tags",
+    addTags: input2.addTags ?? [],
+    removeTags: input2.removeTags ?? []
+  };
+});
+var BEFORE_UNTIL_MESSAGE = "must be before until";
+function checkWindow(window, ctx) {
+  const { since, until } = window;
   if (since === void 0 || until === void 0)
     return;
   if (Date.parse(since) < Date.parse(until))
     return;
   ctx.addIssue({ code: "custom", path: ["since"], message: BEFORE_UNTIL_MESSAGE });
 }
-var listFilterObject = external_exports.object({
+var filterTagsSchema = external_exports.array(tagSchema, { message: TAGS_TYPE_MESSAGE }).transform(normalizeTags).refine((tags) => tags.length > 0, { message: "must list at least 1 tag" }).refine((tags) => tags.length <= TAGS_MAX, {
+  message: `must have at most ${TAGS_MAX} tags`
+});
+var FINGERPRINT_MESSAGE = lengthMessage(1, FINGERPRINT_MAX);
+var listFilterShape = {
   org: orgSlugSchema,
   project: projectNameSchema.optional(),
   severity: severitySchema.optional(),
   status: statusSchema.optional(),
-  // The filter spends `UNTAGGED_TAG` on the complaints with no tag.
-  tag: tagSchema.optional(),
+  tags: filterTagsSchema.optional(),
   reporter: boundedString(REPORTER_MAX).optional(),
+  // Exact, so it is never trimmed, and never empty, because no fingerprint is.
+  fingerprint: external_exports.string({ message: FINGERPRINT_MESSAGE }).min(1, { message: FINGERPRINT_MESSAGE }).max(FINGERPRINT_MAX, { message: FINGERPRINT_MESSAGE }).optional(),
+  // The search is case-insensitive in every store.
+  q: boundedString(SEARCH_MAX).transform((value) => value.toLowerCase()).optional(),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
   limit: limitSchema.optional()
-}).superRefine(checkWindow);
-var listFilterSchema = external_exports.preprocess((value) => normalizeKeys(value ?? {}, FILTER_KEYS), listFilterObject).transform((input2) => ({
+};
+var LIST_FILTER_KEYS = Object.keys(listFilterShape);
+var listFilterObject = external_exports.strictObject(listFilterShape).superRefine(checkWindow);
+var listFilterSchema = external_exports.preprocess((value) => dropNulls(normalizeKeys(value ?? {}, FILTER_KEYS), FILTER_NULLABLE_KEYS), listFilterObject).transform((input2) => ({
   org: input2.org,
   ...input2.project === void 0 ? {} : { project: input2.project },
   ...input2.severity === void 0 ? {} : { severity: input2.severity },
   ...input2.status === void 0 ? {} : { status: input2.status },
-  // The tag is normalized like a stored one, so `other: network` matches.
-  ...input2.tag === void 0 ? {} : { tag: normalizeTag(input2.tag) },
+  ...input2.tags === void 0 ? {} : { tags: input2.tags },
   ...input2.reporter === void 0 ? {} : { reporter: input2.reporter },
+  ...input2.fingerprint === void 0 ? {} : { fingerprint: input2.fingerprint },
+  ...input2.q === void 0 ? {} : { q: input2.q },
   ...input2.since === void 0 ? {} : { since: toMilliseconds(input2.since) },
   ...input2.until === void 0 ? {} : { until: toMilliseconds(input2.until) },
   limit: input2.limit ?? DEFAULT_LIMIT
 }));
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var WINDOW_MESSAGE = `the window must not exceed ${STATS_MAX_WINDOW_DAYS} days`;
-var statsQueryObject = external_exports.object({
+var ALL_WINDOW = "all";
+var ALL_WINDOW_MESSAGE = `must be ${ALL_WINDOW}`;
+var ALL_WINDOW_BOUNDS_MESSAGE = `${ALL_WINDOW} takes no since or until`;
+var statsQueryObject = external_exports.strictObject({
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  status: statusSchema.optional()
+  status: statusSchema.optional(),
+  window: external_exports.literal(ALL_WINDOW, { message: ALL_WINDOW_MESSAGE }).optional()
+}).superRefine((input2, ctx) => {
+  if (input2.window === void 0)
+    return;
+  if (input2.since === void 0 && input2.until === void 0)
+    return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["window"],
+    message: ALL_WINDOW_BOUNDS_MESSAGE
+  });
 });
 var ROLE_MESSAGE = `must be one of ${ROLES.join(", ")}`;
 var ORG_ROLE_MESSAGE = `must be one of ${ORG_ROLES.join(", ")}`;
@@ -23576,8 +23845,8 @@ var orgRoleSchema = external_exports.enum(ORG_ROLES, { message: ORG_ROLE_MESSAGE
 var colourSchema = external_exports.enum(ORG_COLOURS, { message: COLOUR_MESSAGE });
 var emailSchema = boundedString(EMAIL_MAX, EMAIL_MESSAGE).refine((value) => EMAIL_RE.test(value), { message: EMAIL_MESSAGE });
 var inviteEmailSchema = emailSchema.transform((value) => value.toLowerCase());
-var displayNameSchema = boundedString(DISPLAY_NAME_MAX);
-var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, ["colour"]), external_exports.object({
+var displayNameSchema = freeText(DISPLAY_NAME_MAX);
+var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, ["colour"]), external_exports.strictObject({
   slug: orgSlugSchema.refine((value) => !RESERVED_SLUGS.some((reserved) => reserved === value), { message: RESERVED_SLUG_MESSAGE }),
   name: displayNameSchema,
   colour: colourSchema.optional()
@@ -23586,18 +23855,21 @@ var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, [
   name: input2.name,
   colour: input2.colour ?? DEFAULT_ORG_COLOUR
 }));
-var orgPatchSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "colour"]), external_exports.object({ name: displayNameSchema.optional(), colour: colourSchema.optional() })).transform((input2) => ({
+var orgPatchSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "colour"]), external_exports.strictObject({
+  name: displayNameSchema.optional(),
+  colour: colourSchema.optional()
+})).transform((input2) => ({
   ...input2.name === void 0 ? {} : { name: input2.name },
   ...input2.colour === void 0 ? {} : { colour: input2.colour }
 })).refine((patch) => Object.keys(patch).length > 0, { message: ORG_PATCH_MESSAGE });
 var PLATFORM_PATCH_MESSAGE = "must set disabled, caps, or both";
 var CAP_MESSAGE = "must be a positive whole number";
-var orgCapsSchema = external_exports.object({
+var orgCapsSchema = external_exports.strictObject({
   projectsPerOrg: external_exports.number({ message: CAP_MESSAGE }).int({ message: CAP_MESSAGE }).min(1, { message: CAP_MESSAGE }).optional()
 }).transform((input2) => ({
   ...input2.projectsPerOrg === void 0 ? {} : { projectsPerOrg: input2.projectsPerOrg }
 }));
-var platformOrgPatchSchema = external_exports.object({
+var platformOrgPatchSchema = external_exports.strictObject({
   disabled: external_exports.boolean({ message: "must be a boolean" }).optional(),
   caps: orgCapsSchema.nullable().optional()
 }).transform((input2) => ({
@@ -23606,30 +23878,41 @@ var platformOrgPatchSchema = external_exports.object({
 })).refine((patch) => Object.keys(patch).length > 0, {
   message: PLATFORM_PATCH_MESSAGE
 });
-var orgInviteSchema = external_exports.object({ email: inviteEmailSchema, role: orgRoleSchema }).transform((input2) => ({ email: input2.email, role: input2.role }));
-var orgRoleChangeSchema = external_exports.object({ role: orgRoleSchema }).transform((input2) => ({ role: input2.role }));
-var profileSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name"]), external_exports.object({ name: displayNameSchema })).transform((input2) => ({ name: input2.name }));
-var newProjectSchema = external_exports.preprocess((value) => normalizeKeys(value, ["tags"]), external_exports.object({
+var orgInviteSchema = external_exports.strictObject({ email: inviteEmailSchema, role: orgRoleSchema }).transform((input2) => ({ email: input2.email, role: input2.role }));
+var orgRoleChangeSchema = external_exports.strictObject({ role: orgRoleSchema }).transform((input2) => ({ role: input2.role }));
+var profileSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name"]), external_exports.strictObject({ name: displayNameSchema })).transform((input2) => ({ name: input2.name }));
+var newProjectSchema = external_exports.preprocess((value) => normalizeKeys(value, ["tags"]), external_exports.strictObject({
   project: projectNameSchema,
   tags: allowedTagsSchema.optional()
 })).transform((input2) => ({
   project: input2.project,
   ...input2.tags === void 0 ? {} : { tags: input2.tags }
 }));
-var projectUpdateSchema = external_exports.object({ tags: allowedTagsSchema.nullable() }).transform((input2) => ({ tags: input2.tags }));
-var tagPromotionSchema = external_exports.object({ tag: allowedTagSchema }).transform((input2) => ({ tag: normalizeTag(input2.tag) }));
-var roleChangeSchema = external_exports.object({ role: roleSchema }).transform((input2) => ({ role: input2.role }));
-var newTokenSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "expiresAt"]), external_exports.object({
-  name: boundedString(TOKEN_NAME_MAX),
-  expiresAt: timestampSchema.optional()
-})).transform((input2) => ({
-  name: input2.name,
-  ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
-}));
+var projectUpdateSchema = external_exports.strictObject({ tags: allowedTagsSchema.nullable() }).transform((input2) => ({ tags: input2.tags }));
+var tagPromotionSchema = external_exports.strictObject({ tag: allowedTagSchema }).transform((input2) => ({ tag: normalizeTag(input2.tag) }));
+var roleChangeSchema = external_exports.strictObject({ role: roleSchema }).transform((input2) => ({ role: input2.role }));
+var FUTURE_MESSAGE = "must be in the future";
+function newTokenSchema(now) {
+  return external_exports.preprocess((value) => normalizeKeys(value, ["name", "expiresAt"]), external_exports.strictObject({
+    name: freeText(TOKEN_NAME_MAX),
+    expiresAt: timestampSchema.refine((value) => Date.parse(value) > now.getTime(), {
+      message: FUTURE_MESSAGE
+    }).optional()
+  })).transform((input2) => ({
+    name: input2.name,
+    ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
+  }));
+}
+var UNKNOWN_KEY_MESSAGE = "unknown key";
+var emptyBodySchema = external_exports.strictObject({});
 function formatIssues(error62) {
-  return error62.issues.map((issue2) => {
-    const path = issue2.path.map((part) => String(part)).join(".");
-    return path === "" ? issue2.message : `${path}: ${issue2.message}`;
+  return error62.issues.flatMap((issue2) => {
+    const path = issue2.path.map((part) => String(part));
+    if (issue2.code === "unrecognized_keys") {
+      return issue2.keys.map((key) => `${[...path, key].join(".")}: ${UNKNOWN_KEY_MESSAGE}`);
+    }
+    const name = path.join(".");
+    return [name === "" ? issue2.message : `${name}: ${issue2.message}`];
   });
 }
 function run(schema, input2) {
@@ -23648,6 +23931,13 @@ function parseComplaint(input2) {
 function parseStatusChange(input2) {
   return run(statusChangeSchema, input2);
 }
+var statusActorSchema = external_exports.strictObject({ by: actorSchema, byName: actorSchema.optional() }).transform((input2) => ({
+  by: input2.by,
+  ...input2.byName === void 0 ? {} : { byName: input2.byName }
+}));
+function parseStatusActor(input2) {
+  return run(statusActorSchema, input2);
+}
 function parseTagsChange(input2) {
   return run(tagsChangeSchema, input2);
 }
@@ -23663,6 +23953,14 @@ function parseProjectName(input2) {
 function parseTagPromotion(input2) {
   return run(tagPromotionSchema, input2);
 }
+function parseNewToken(input2, now = /* @__PURE__ */ new Date()) {
+  return run(newTokenSchema(now), input2);
+}
+function parseAgentName(input2) {
+  return run(external_exports.object({ agent: agentSchema }), { agent: input2 }).agent;
+}
+var IDEMPOTENCY_KEY_RE = new RegExp(`^[A-Za-z0-9_-]{1,${IDEMPOTENCY_KEY_MAX}}$`);
+var IDEMPOTENCY_KEY_MESSAGE = `Idempotency-Key: must be 1-${IDEMPOTENCY_KEY_MAX} letters, digits, "-" or "_"`;
 function parseOrgSlug(input2) {
   return run(orgSlugSchema, input2);
 }
@@ -23718,8 +24016,8 @@ function summarizeComplaints(complaints) {
 var SUMMARY_WORDS = 20;
 var ELLIPSIS = "\u2026";
 function summarize(message) {
-  const line = message.split("\n").map((each) => each.trim()).find((each) => each !== "");
-  if (line === void 0)
+  const line = headlineOf(message);
+  if (line === "")
     return "";
   const words = line.split(/\s+/);
   if (words.length <= SUMMARY_WORDS)
@@ -23727,8 +24025,29 @@ function summarize(message) {
   return `${words.slice(0, SUMMARY_WORDS).join(" ")}${ELLIPSIS}`;
 }
 
+// ../core/dist/query.js
+var TAG_KEY = "tag";
+var SINGLE_KEYS = new Set(LIST_FILTER_KEYS.filter((key) => key !== "org" && key !== "tags"));
+function listQueryOf(filter) {
+  const pairs = [];
+  for (const key of LIST_FILTER_KEYS) {
+    if (key === "org")
+      continue;
+    const value = filter[key];
+    if (value === void 0)
+      continue;
+    if (key === "tags") {
+      for (const tag of filter.tags ?? [])
+        pairs.push([TAG_KEY, tag]);
+      continue;
+    }
+    pairs.push([key, String(value)]);
+  }
+  return pairs;
+}
+
 // ../core/dist/service.js
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 function applyTagRules(tags, allowedTags) {
   if (allowedTags === void 0)
     return [...tags];
@@ -23744,23 +24063,57 @@ async function createComplaint(store, input2, options = {}) {
     id: options.id === void 0 ? randomUUID() : options.id(),
     ...normalized,
     tags,
+    fingerprint: fingerprintOf(normalized.message),
     createdAt: stamp(options),
     status: DEFAULT_STATUS
   };
-  await store.create(complaint);
-  return complaint;
+  if (options.reserve !== void 0)
+    await options.reserve(complaint);
+  const match = options.keyed === true ? await store.create(complaint, { keyed: true }) : await store.create(complaint);
+  return {
+    ...complaint,
+    openMatches: match.open,
+    recurred: match.resolved
+  };
 }
 async function listComplaints(store, filter) {
   const parsed = parseListFilter(filter);
   return store.list(parsed);
 }
+async function listComplaintPage(store, filter) {
+  const parsed = parseListFilter(filter);
+  if (store.listPage !== void 0)
+    return store.listPage(parsed);
+  return { complaints: await store.list(parsed), truncated: false };
+}
+function scanComplaints(store, filter) {
+  return store.scan(parseListFilter(filter));
+}
 async function getComplaint(store, id) {
   return store.get(id);
 }
-async function updateComplaintStatus(store, id, change, options = {}) {
+async function updateComplaintStatus(store, id, change, options) {
   const parsed = parseStatusChange(change);
-  const update = { ...parsed, updatedAt: stamp(options) };
-  return store.update(id, update);
+  const actor = parseStatusActor(options.actor);
+  if (parsed.duplicateOf !== void 0) {
+    const target = options.current ?? await store.get(id);
+    if (target === void 0)
+      return void 0;
+    if (parsed.duplicateOf === id) {
+      throw new ValidationError(["duplicateOf: must name another complaint"]);
+    }
+    const original = await store.get(parsed.duplicateOf);
+    if (original === void 0 || original.org !== target.org) {
+      throw new ValidationError([`duplicateOf: no complaint ${parsed.duplicateOf}`]);
+    }
+  }
+  const update = {
+    ...parsed,
+    updatedAt: stamp(options),
+    changedBy: actor.by,
+    ...actor.byName === void 0 ? {} : { changedByName: actor.byName }
+  };
+  return store.update(id, update, options.current);
 }
 async function updateComplaintTags(store, id, change, options = {}) {
   const parsed = parseTagsChange(change);
@@ -23768,7 +24121,7 @@ async function updateComplaintTags(store, id, change, options = {}) {
     tags: applyTagRules(parsed.tags, options.allowedTags),
     updatedAt: stamp(options)
   };
-  return store.updateTags(id, update);
+  return store.updateTags(id, update, options.current);
 }
 
 // ../core/dist/file-store.js
@@ -23776,15 +24129,36 @@ import { appendFile, mkdir, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 var STATUS_OP = "status";
 var TAGS_OP = "tags";
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
 var FileStore = class {
   /** Path of the JSONL file. */
   path;
+  /** The creates of this process, one after the other. */
+  #creating = Promise.resolve();
   constructor(path) {
     this.path = path;
   }
-  /** Appends one line. Creates the parent directory on the first write. */
-  async create(complaint) {
-    await this.#append(complaint);
+  /**
+   * Counts what the complaint's project holds under its fingerprint, from the
+   * folded records, then appends the one complaint line, with `recurred: true`
+   * when a resolved match created in the last `RECURRENCE_WINDOW_DAYS` exists.
+   * Creates the parent directory on the first write. A keyed complaint whose
+   * id a record already holds is a `DuplicateIdError` carrying that record,
+   * and nothing is written. The creates of one process run one at a time.
+   */
+  create(complaint, options = {}) {
+    const write = this.#creating.then(async () => {
+      const records = await this.#readAll();
+      const existing = records.find((record2) => record2.id === complaint.id);
+      if (options.keyed === true && existing !== void 0) {
+        throw new DuplicateIdError(complaint.id, existing);
+      }
+      const match = matchOf(records, complaint);
+      await this.#append(match.resolved ? { ...complaint, recurred: true } : complaint);
+      return match;
+    });
+    this.#creating = write.catch(() => void 0);
+    return write;
   }
   /** Returns the matching complaints, newest first. */
   async list(filter) {
@@ -23796,6 +24170,11 @@ var FileStore = class {
     for (const complaint of await this.#matches(filter))
       yield complaint;
   }
+  /** Returns how many complaints match, whatever the limit says. */
+  async count(filter) {
+    const complaints = await this.#readAll();
+    return complaints.filter((complaint) => matchesFilter(complaint, filter)).length;
+  }
   /** Returns the complaint with that id, or `undefined`. */
   async get(id) {
     const complaints = await this.#readAll();
@@ -23804,26 +24183,32 @@ var FileStore = class {
   /**
    * Appends one status line and returns the updated complaint. Returns
    * `undefined`, and writes nothing, when no complaint has that id. A deleted
-   * complaint is reached like any other, so a reopen restores it.
+   * complaint is reached like any other, so a reopen restores it. `current` is
+   * ignored, because a fold reads every record anyway.
    */
-  async update(id, change) {
+  async update(id, change, _current) {
     const complaint = await this.get(id);
     if (complaint === void 0)
       return void 0;
-    await this.#append({
+    const line = {
       op: STATUS_OP,
       id,
       status: change.status,
       ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+      ...change.reason === void 0 ? {} : { reason: change.reason },
+      ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf },
+      changedBy: change.changedBy,
+      ...change.changedByName === void 0 ? {} : { changedByName: change.changedByName },
       updatedAt: change.updatedAt
-    });
-    return applyStatus(complaint, change);
+    };
+    await this.#append(line);
+    return applyStatus(complaint, line);
   }
   /**
    * Appends one tags line and returns the updated complaint. Returns
    * `undefined`, and writes nothing, when no complaint has that id.
    */
-  async updateTags(id, change) {
+  async updateTags(id, change, _current) {
     const complaint = await this.get(id);
     if (complaint === void 0)
       return void 0;
@@ -23946,31 +24331,70 @@ var FileStore = class {
       }
       const change = parseStatusChange({
         status: parsed["status"],
-        resolution: parsed["resolution"]
+        resolution: parsed["resolution"],
+        reason: parsed["reason"],
+        duplicateOf: parsed["duplicateOf"]
       });
-      return { op, id, ...change, updatedAt };
+      const changedBy = this.#actor(parsed, "changedBy", bad);
+      const changedByName = this.#actor(parsed, "changedByName", bad);
+      return {
+        op,
+        id,
+        ...change,
+        ...changedBy === void 0 ? {} : { changedBy },
+        ...changedByName === void 0 ? {} : { changedByName },
+        updatedAt
+      };
     } catch (error62) {
       if (!(error62 instanceof ValidationError))
         throw error62;
       throw bad(error62.message, error62);
     }
   }
+  /** Reads the optional actor key of a status line. */
+  #actor(parsed, key, bad) {
+    const value = parsed[key];
+    if (value === void 0)
+      return void 0;
+    if (typeof value !== "string" || value.trim() === "" || value.length > REPORTER_MAX) {
+      throw bad(`${key}: must be 1-${REPORTER_MAX} characters`);
+    }
+    return value;
+  }
   /** The prefix that every malformed complaint line shares. */
   #malformed(lineNumber) {
     return `malformed complaint on line ${lineNumber} of ${this.path}`;
   }
 };
 function applyStatus(complaint, change) {
-  const updated = {
-    ...complaint,
+  const { resolution: _resolution, reason: _reason, duplicateOf: _duplicateOf, statusChangedBy: _statusChangedBy, statusChangedByName: _statusChangedByName, ...rest } = complaint;
+  return {
+    ...rest,
     status: change.status,
+    ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+    ...change.reason === void 0 ? {} : { reason: change.reason },
+    ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf },
+    statusChangedAt: change.updatedAt,
+    ...change.changedBy === void 0 ? {} : { statusChangedBy: change.changedBy },
+    ...change.changedByName === void 0 ? {} : { statusChangedByName: change.changedByName },
     updatedAt: change.updatedAt
   };
-  if (change.resolution === void 0)
-    delete updated.resolution;
-  else
-    updated.resolution = change.resolution;
-  return updated;
+}
+function matchOf(complaints, complaint) {
+  const since = new Date(Date.parse(complaint.createdAt) - RECURRENCE_WINDOW_DAYS * DAY_MS2).toISOString();
+  let open2 = 0;
+  let resolved = false;
+  for (const each of complaints) {
+    if (each.project !== complaint.project)
+      continue;
+    if (each.fingerprint !== complaint.fingerprint)
+      continue;
+    if (each.status === "open")
+      open2 += 1;
+    if (each.status === "resolved" && each.createdAt >= since)
+      resolved = true;
+  }
+  return { open: open2, resolved };
 }
 function applyTags(complaint, change) {
   return { ...complaint, tags: [...change.tags], updatedAt: change.updatedAt };
@@ -23990,11 +24414,17 @@ function matchesFilter(complaint, filter) {
   if (filter.reporter !== void 0 && complaint.reporter !== filter.reporter) {
     return false;
   }
-  if (filter.tag !== void 0) {
-    const kept = filter.tag === UNTAGGED_TAG ? complaint.tags.length === 0 : complaint.tags.includes(filter.tag);
+  if (filter.tags !== void 0) {
+    const kept = filter.tags.some((tag) => tag === UNTAGGED_TAG ? complaint.tags.length === 0 : complaint.tags.includes(tag));
     if (!kept)
       return false;
   }
+  if (filter.fingerprint !== void 0 && complaint.fingerprint !== filter.fingerprint) {
+    return false;
+  }
+  if (filter.q !== void 0 && !complaint.message.toLowerCase().includes(filter.q)) {
+    return false;
+  }
   if (filter.since !== void 0 && complaint.createdAt < filter.since)
     return false;
   if (filter.until !== void 0 && complaint.createdAt >= filter.until)
@@ -24028,6 +24458,10 @@ function defaultConfigPath(env = process.env) {
   return join(defaultQuibbleHome(env), CONFIG_FILENAME);
 }
 
+// src/config.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
+
 // src/credentials.ts
 import { randomBytes } from "node:crypto";
 import {
@@ -24041,9 +24475,10 @@ import {
 import { dirname as dirname2, join as join2 } from "node:path";
 
 // src/errors.ts
+var AMBIGUOUS_ID = "ambiguous_id";
 var UsageError = class extends QuibbleError {
   constructor(message, options) {
-    super("usage_error", message, options);
+    super(options?.code ?? "usage_error", message, options);
   }
 };
 var NotFoundError = class extends QuibbleError {
@@ -24058,9 +24493,18 @@ var RemoteError = class extends QuibbleError {
    * other one stays exit 2.
    */
   status;
+  /** The `error.code` of the answer, when it carried one. */
+  serverCode;
+  /** The server's own message, when the answer carried one. */
+  serverMessage;
+  /** True when no server answered, which the offline queue of 5.13 reads. */
+  unanswered;
   constructor(message, options) {
     super("network_error", message, options);
     this.status = options?.status;
+    this.serverCode = options?.serverCode;
+    this.serverMessage = options?.serverMessage;
+    this.unanswered = options?.unanswered === true;
   }
 };
 function exitCodeFor(error62) {
@@ -24117,12 +24561,12 @@ async function send(url2, request) {
     if (isTimeout(error62)) {
       throw new RemoteError(
         `request to ${originOf(url2)} timed out after ${timeoutMs / 1e3}s${detail(site)}`,
-        { cause: error62 }
+        { cause: error62, unanswered: true }
       );
     }
     throw new RemoteError(
       `cannot reach ${originOf(url2)}: ${describeError(error62)}${detail(site)}`,
-      { cause: error62 }
+      { cause: error62, unanswered: true }
     );
   }
 }
@@ -24132,7 +24576,7 @@ async function readText(response, site) {
   } catch (error62) {
     throw new RemoteError(
       `cannot read the response from ${originOf(site.url)}: ${describeError(error62)}${detail(site, response.status)}`,
-      { cause: error62 }
+      { cause: error62, unanswered: true }
     );
   }
 }
@@ -24140,7 +24584,7 @@ function parseJson(text, site, status) {
   try {
     return JSON.parse(text);
   } catch (error62) {
-    throw new RemoteError(`the API returned a malformed body${detail(site, status)}`, {
+    throw new RemoteError(`the API returned invalid JSON${detail(site, status)}`, {
       cause: error62
     });
   }
@@ -24176,9 +24620,12 @@ function serverCode(text) {
   return stringOf(asRecord(record2?.["error"]), "code");
 }
 function remoteFailure(site, response, text) {
-  const message = serverMessage(text, response) ?? `the API answered ${response.status}`;
+  const own2 = serverMessage(text, response);
+  const message = own2 ?? `the API returned HTTP ${response.status}`;
   return new RemoteError(`${message}${detail(site, response.status)}`, {
-    status: response.status
+    status: response.status,
+    serverCode: serverCode(text),
+    serverMessage: own2
   });
 }
 
@@ -24283,12 +24730,12 @@ function removeCredential(env, endpoint) {
 var TARGET_PREFIX = "AWSCognitoIdentityProviderService.";
 var CONTENT_TYPE = "application/x-amz-json-1.1";
 var DEFAULT_EXPIRES_IN = 3600;
-var UNREACHABLE_LINE = "The sign-in service could not be reached.";
+var UNREACHABLE_LINE = "Couldn't reach the sign-in service.";
 var WRONG_CREDENTIALS_LINE = "Wrong email or password.";
-var TOO_MANY_LINE = "Too many attempts, try again later.";
+var TOO_MANY_LINE = "Too many attempts. Try again later.";
 var WRONG_CODE_LINE = "Wrong code.";
-var EXPIRED_CODE_LINE = "That code has expired, request a new one.";
-var PASSWORD_POLICY_LINE = "A password needs 12 characters with a lowercase letter, an uppercase letter, a digit and a symbol.";
+var EXPIRED_CODE_LINE = "That code has expired. Request a new one.";
+var PASSWORD_POLICY_LINE = "Use at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.";
 var UNREACHABLE_TYPE = "Unreachable";
 var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
 var CognitoError = class extends RemoteError {
@@ -24297,7 +24744,7 @@ var CognitoError = class extends RemoteError {
   /** Cognito's own `message`, or `undefined` when the answer carried none. */
   detail;
   constructor(type, detail2, line, suffix = "") {
-    super(`${line}${suffix}`);
+    super(`${line}${suffix}`, { unanswered: type === UNREACHABLE_TYPE });
     this.type = type;
     this.detail = detail2;
   }
@@ -24394,7 +24841,7 @@ function authAnswerOf(body) {
     const shape = result;
     const accessToken = shape["AccessToken"];
     if (typeof accessToken !== "string" || accessToken === "") {
-      throw new RemoteError("the sign-in returned no access token");
+      throw new RemoteError("sign-in didn't return an access token");
     }
     const refreshToken = shape["RefreshToken"];
     const expiresIn = shape["ExpiresIn"];
@@ -24409,7 +24856,7 @@ function authAnswerOf(body) {
   }
   const challengeName = body["ChallengeName"];
   if (typeof challengeName !== "string" || challengeName === "") {
-    throw new RemoteError("the sign-in returned neither tokens nor a challenge");
+    throw new RemoteError("sign-in returned an unexpected response");
   }
   const session = body["Session"];
   const parameters = body["ChallengeParameters"];
@@ -24496,7 +24943,7 @@ async function fetchAuthConfig(endpoint, options = {}) {
   const webUrl = stringOf(body, "webUrl");
   if (region === void 0 || cliClientId === void 0 || webUrl === void 0) {
     throw new RemoteError(
-      `the API returned an auth config without a region${detail(site, response.status)}`
+      `unexpected response from the API: auth config has no region${detail(site, response.status)}`
     );
   }
   return { mode: "cognito", region, cliClientId, webUrl };
@@ -24601,7 +25048,9 @@ var SessionAuthorizer = class {
       throw error62;
     }
     if (answer2.kind === "challenge") {
-      throw new RemoteError(`the refresh asked for ${answer2.challenge.challengeName}`);
+      throw new RemoteError(
+        `unexpected sign-in step during refresh (${answer2.challenge.challengeName})`
+      );
     }
     const now = clockOf(this.#options)();
     return saveCredential(this.#options.env, {
@@ -24764,6 +25213,7 @@ function resolveContext(options) {
   return {
     project: name,
     org: mode === "local" ? LOCAL_ORG : slug,
+    slug,
     projectRoot: project?.root,
     configPath: project?.path,
     cwd: project === void 0 ? void 0 : relativeCwd(project.root, options.cwd),
@@ -24786,6 +25236,79 @@ function resolveContext(options) {
   };
 }
 
+// src/ids.ts
+var FULL_ID_LENGTH = 36;
+var SHORT_ID_MIN = 6;
+var CANDIDATES_SHOWN = 5;
+var SHORT_ID_RE = /^[0-9a-f-]+$/;
+function readIdValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === FULL_ID_LENGTH) return { id: trimmed, prefix: false };
+  const lower = trimmed.toLowerCase();
+  if (!SHORT_ID_RE.test(lower)) throw new UsageError(`${value} is not an id`);
+  if (lower.length < SHORT_ID_MIN) {
+    throw new UsageError(
+      `${value} is too short: pass at least ${SHORT_ID_MIN} characters of the id`
+    );
+  }
+  return { id: lower, prefix: true };
+}
+function ambiguousError(prefix, ids, noun) {
+  const shown = ids.slice(0, CANDIDATES_SHOWN).join(", ");
+  const more = ids.length > CANDIDATES_SHOWN ? ` and ${ids.length - CANDIDATES_SHOWN} more` : "";
+  return new UsageError(`${prefix} matches ${ids.length} ${noun}: ${shown}${more}`, {
+    code: AMBIGUOUS_ID
+  });
+}
+async function candidates(source) {
+  const org = requireOrg(source.context);
+  const ids = [];
+  if (source.local !== void 0) {
+    for (const status of [void 0, "deleted"]) {
+      const filter = { org, ...status === void 0 ? {} : { status } };
+      for await (const complaint of scanComplaints(source.local, filter)) {
+        ids.push(complaint.id);
+      }
+    }
+    return ids;
+  }
+  const project = source.context.projectConfig?.project;
+  for (const status of [void 0, "deleted"]) {
+    const filter = {
+      org,
+      limit: MAX_LIMIT,
+      ...project === void 0 ? {} : { project },
+      ...status === void 0 ? {} : { status }
+    };
+    for (const complaint of await listComplaints(source.store, filter)) {
+      ids.push(complaint.id);
+    }
+  }
+  return ids;
+}
+async function resolveIds(values, source) {
+  const read = values.map((value) => readIdValue(value));
+  let pool;
+  const resolved = [];
+  for (const value of read) {
+    if (!value.prefix) {
+      resolved.push(value.id);
+      continue;
+    }
+    pool ??= candidates(source);
+    const matches = [...new Set((await pool).filter((id) => id.startsWith(value.id)))];
+    if (matches.length === 1) {
+      resolved.push(matches[0]);
+      continue;
+    }
+    if (matches.length > 1) throw ambiguousError(value.id, matches, "complaints");
+    throw new NotFoundError(
+      source.local === void 0 ? `no complaint among the newest ${MAX_LIMIT} starts with ${value.id}: pass the full id` : `no complaint starts with ${value.id}`
+    );
+  }
+  return resolved;
+}
+
 // src/io.ts
 async function readStdin(stream) {
   const chunks = [];
@@ -24803,9 +25326,10 @@ function writeJson(stream, value) {
 }
 
 // src/client.ts
-var NOT_A_COMPLAINT = "the API returned a body that is not a complaint";
+import { randomUUID as randomUUID2 } from "node:crypto";
+var NOT_A_COMPLAINT = "unexpected response from the API: expected a complaint";
 var ORG_NOT_FOUND = "org_not_found";
-var NOT_A_PROMOTION = "the API returned a body that is not a tag promotion";
+var NOT_A_PROMOTION = "unexpected response from the API: expected a tag promotion";
 function readRoles(value) {
   if (!Array.isArray(value)) return [];
   const roles = [];
@@ -24838,7 +25362,7 @@ function parseMe(body) {
   const record2 = asRecord(body);
   const reporter = stringOf(record2, "reporter");
   if (record2 === void 0 || reporter === void 0) {
-    throw new RemoteError("the API returned an identity without a reporter");
+    throw new RemoteError("unexpected response from the API: identity has no reporter");
   }
   return {
     kind: stringOf(record2, "kind") ?? "user",
@@ -24857,7 +25381,7 @@ function parseMe(body) {
 function parseOrgAnswer(body, slug) {
   const record2 = asRecord(body);
   if (record2 === void 0) {
-    throw new RemoteError("the API returned a body that is not an organization");
+    throw new RemoteError("unexpected response from the API: expected an organization");
   }
   return {
     org: stringOf(record2, "org") ?? slug,
@@ -24867,6 +25391,35 @@ function parseOrgAnswer(body, slug) {
     body: record2
   };
 }
+function readToken(value) {
+  const record2 = asRecord(value);
+  const id = stringOf(record2, "id");
+  const name = stringOf(record2, "name");
+  const createdAt = stringOf(record2, "createdAt");
+  if (id === void 0 || name === void 0 || createdAt === void 0) {
+    throw new RemoteError("unexpected response from the API: expected a token");
+  }
+  return {
+    id,
+    name,
+    createdAt,
+    expiresAt: stringOf(record2, "expiresAt"),
+    lastUsedAt: stringOf(record2, "lastUsedAt"),
+    revokedAt: stringOf(record2, "revokedAt")
+  };
+}
+function readProject(body, name) {
+  const record2 = asRecord(body);
+  if (record2 === void 0) {
+    throw new RemoteError("unexpected response from the API: expected a project");
+  }
+  const tags = record2["tags"];
+  return {
+    project: stringOf(record2, "project") ?? name,
+    tags: Array.isArray(tags) ? tags.map((tag) => String(tag)) : void 0,
+    body: record2
+  };
+}
 function readComplaint(body) {
   try {
     return parseComplaint(body);
@@ -24881,24 +25434,37 @@ var ApiClient = class {
   #base;
   #auth;
   #http;
+  #beforeFirst;
   constructor(options) {
     this.endpoint = options.endpoint;
     this.org = options.org;
     this.#base = trimSlash(options.endpoint);
     this.#auth = options.authorizer;
+    this.#beforeFirst = options.beforeFirst;
     this.#http = {
       fetch: options.fetch,
       timeoutMs: options.timeoutMs,
       debug: options.debug
     };
   }
-  /** Sends one request and returns its body. A non-2xx answer is an error. */
-  async request(method, path, body) {
-    return this.#call(method, path, body, false);
+  /**
+   * Sends one request and returns its body. A non-2xx answer is an error.
+   * `headers` are sent beside the auth headers, such as the idempotency key
+   * of a filing.
+   */
+  async request(method, path, body, headers) {
+    return (await this.#call(method, path, body, false, headers)).body;
+  }
+  /**
+   * The same, and the headers of the answer, which carry what the body does
+   * not, such as the truncation mark of a list.
+   */
+  async requestWithHeaders(method, path) {
+    return this.#call(method, path, void 0, false);
   }
   /** The same, except that a `404` answers `undefined` instead of failing. */
   async requestOptional(method, path, body) {
-    return this.#call(method, path, body, true);
+    return (await this.#call(method, path, body, true)).body;
   }
   /**
    * The prefix of every org-scoped path. Every command that reaches one
@@ -24917,7 +25483,9 @@ var ApiClient = class {
   async orgs() {
     const body = asRecord(await this.request("GET", "/v1/orgs"));
     if (body === void 0) {
-      throw new RemoteError("the API returned a body that is not an organization list");
+      throw new RemoteError(
+        "unexpected response from the API: expected an organization list"
+      );
     }
     return { orgs: readOrgs(body["orgs"]), body };
   }
@@ -24926,16 +25494,55 @@ var ApiClient = class {
     const slug = this.org ?? "";
     return parseOrgAnswer(await this.request("GET", this.orgPath()), slug);
   }
+  /** The path of one project of the organization. */
+  projectPath(name) {
+    return `${this.orgPath()}/projects/${encodeURIComponent(name)}`;
+  }
   /** Reads the project record, which owns the allowed tag list in remote mode. */
   async project(name) {
-    const body = asRecord(
-      await this.request("GET", `${this.orgPath()}/projects/${encodeURIComponent(name)}`)
+    return readProject(await this.request("GET", this.projectPath(name)), name);
+  }
+  /**
+   * Replaces the allowed tag list of a project, or clears it with `null`. The
+   * route retags the stored complaints and answers how many it rewrote.
+   */
+  async setProjectTags(name, tags) {
+    const body = await this.request(
+      "PATCH",
+      this.projectPath(name),
+      JSON.stringify({ tags })
+    );
+    const answer2 = readProject(body, name);
+    const retagged = answer2.body["retagged"];
+    return { ...answer2, retagged: typeof retagged === "number" ? retagged : 0 };
+  }
+  /** Lists the tokens of a project, newest first, as the route sorts them. */
+  async tokens(project) {
+    const body = await this.request("GET", `${this.projectPath(project)}/tokens`);
+    if (!Array.isArray(body)) {
+      throw new RemoteError("unexpected response from the API: expected a token list");
+    }
+    return { tokens: body.map((entry) => readToken(entry)), body };
+  }
+  /** Mints a token. The answer carries the plaintext, once. */
+  async createToken(project, input2) {
+    const body = await this.request(
+      "POST",
+      `${this.projectPath(project)}/tokens`,
+      JSON.stringify(input2)
+    );
+    const plaintext = stringOf(asRecord(body), "plaintext");
+    if (plaintext === void 0) {
+      throw new RemoteError("unexpected response from the API: token has no plaintext");
+    }
+    return { token: readToken(body), plaintext, body };
+  }
+  /** Revokes one token. A repeat answers `204` again. */
+  async revokeToken(project, id) {
+    await this.request(
+      "DELETE",
+      `${this.projectPath(project)}/tokens/${encodeURIComponent(id)}`
     );
-    const tags = body?.["tags"];
-    return {
-      project: stringOf(body, "project") ?? name,
-      tags: Array.isArray(tags) ? tags.map((tag) => String(tag)) : void 0
-    };
   }
   /**
    * Promotes one suggestion to a real tag. The route needs `maintainer`, so a
@@ -24956,15 +25563,36 @@ var ApiClient = class {
     }
     return { tags: tags.map((entry) => String(entry)), retagged };
   }
-  async #call(method, path, body, notFoundIsUndefined) {
+  /**
+   * Sends one request with the auth rules of section 5.7 and returns the
+   * answer whatever its status. It never runs `beforeFirst`, so the offline
+   * queue sends through it. A request that gets no answer still throws.
+   */
+  async exchange(method, path, body, headers) {
+    const { response, text } = await this.#exchange(method, path, body, headers);
+    return { status: response.status, text };
+  }
+  async #call(method, path, body, notFoundIsUndefined, headers) {
+    const first = this.#beforeFirst;
+    this.#beforeFirst = void 0;
+    if (first !== void 0) await first(this);
+    const { response, text, site } = await this.#exchange(method, path, body, headers);
+    if (response.status === 404 && notFoundIsUndefined && serverCode(text) !== ORG_NOT_FOUND) {
+      return { body: void 0, headers: response.headers };
+    }
+    if (!response.ok) throw remoteFailure(site, response, text);
+    if (response.status === 204) return { body: void 0, headers: response.headers };
+    return { body: parseJson(text, site, response.status), headers: response.headers };
+  }
+  async #exchange(method, path, body, extra) {
     const url2 = `${this.#base}${path}`;
     const site = { method, url: url2, debug: this.#http.debug };
-    let response = await this.#send(url2, method, await this.#auth.token(), body);
+    let response = await this.#send(url2, method, await this.#auth.token(), body, extra);
     if (response.status === 401) {
       const fresh = await this.#auth.retry();
       if (fresh !== void 0) {
         await readText(response, site);
-        response = await this.#send(url2, method, fresh, body);
+        response = await this.#send(url2, method, fresh, body, extra);
         if (response.status === 401) throw sessionExpired(this.endpoint);
       } else if (this.#auth.actAs !== void 0) {
         await readText(response, site);
@@ -24972,14 +25600,13 @@ var ApiClient = class {
       }
     }
     const text = await readText(response, site);
-    if (response.status === 404 && notFoundIsUndefined && serverCode(text) !== ORG_NOT_FOUND) {
-      return void 0;
-    }
-    if (!response.ok) throw remoteFailure(site, response, text);
-    return parseJson(text, site, response.status);
+    return { response, text, site };
   }
-  #send(url2, method, bearer, body) {
-    const headers = { authorization: `Bearer ${bearer}` };
+  #send(url2, method, bearer, body, extra = {}) {
+    const headers = {
+      ...extra,
+      authorization: `Bearer ${bearer}`
+    };
     const actAs = this.#auth.actAs;
     if (actAs !== void 0) headers[ACT_AS_HEADER] = actAs;
     if (body !== void 0) headers["content-type"] = "application/json";
@@ -24991,6 +25618,67 @@ var ApiClient = class {
     });
   }
 };
+var UndeliveredError = class extends RemoteError {
+  body;
+  reason;
+  /**
+   * The idempotency key the request carried, which the queued entry keeps,
+   * so a request that did reach the server files nothing new when it is sent
+   * again.
+   */
+  key;
+  constructor(body, reason, key, cause) {
+    super(cause.message, { cause, status: cause.status, unanswered: cause.unanswered });
+    this.body = body;
+    this.reason = reason;
+    this.key = key;
+  }
+};
+function retryableReason(error62) {
+  if (!(error62 instanceof RemoteError)) return void 0;
+  if (error62.unanswered) return "the API is unreachable";
+  const status = error62.status;
+  if (status === void 0) return void 0;
+  if (status === 429) return error62.serverMessage ?? `the API answered ${status}`;
+  if (status >= 500) return `the API answered ${status}`;
+  return void 0;
+}
+function complaintBody(complaint) {
+  return {
+    project: complaint.project,
+    message: complaint.message,
+    severity: complaint.severity,
+    tags: complaint.tags,
+    agent: complaint.agent,
+    ...complaint.cwd === void 0 ? {} : { cwd: complaint.cwd },
+    ...complaint.cmd === void 0 ? {} : { cmd: complaint.cmd }
+  };
+}
+function readBulkResults(body) {
+  const results = asRecord(body)?.["results"];
+  if (!Array.isArray(results)) {
+    throw new RemoteError("unexpected response from the API: expected bulk results");
+  }
+  return results.map((entry) => {
+    const record2 = asRecord(entry);
+    const id = stringOf(record2, "id");
+    if (record2 === void 0 || id === void 0) {
+      throw new RemoteError("unexpected response from the API: expected a bulk result");
+    }
+    if (record2["ok"] === true) {
+      return { id, ok: true, complaint: readComplaint(record2["complaint"]) };
+    }
+    const error62 = asRecord(record2["error"]);
+    return {
+      id,
+      ok: false,
+      error: {
+        code: stringOf(error62, "code") ?? "error",
+        message: stringOf(error62, "message") ?? "the change failed"
+      }
+    };
+  });
+}
 function adopt(target, source) {
   for (const key of Object.keys(target)) {
     delete target[key];
@@ -25007,39 +25695,55 @@ var RemoteStore = class {
     return `${this.#client.orgPath()}/complaints${suffix}`;
   }
   /**
-   * Posts the complaint. The API assigns the stored `id` and `createdAt`, so
-   * the validated record of the response replaces the record passed in.
+   * Posts the complaint. The API assigns the stored `id`, `createdAt`,
+   * `fingerprint` and `recurred`, so the validated record of the response
+   * replaces the record passed in, and the answer's match is returned.
    */
   async create(complaint) {
-    const {
-      id: _id,
-      createdAt: _createdAt,
-      org: _org,
-      reporter: _reporter,
-      reporterName: _reporterName,
-      ...input2
-    } = complaint;
-    const body = await this.#client.request("POST", this.#path(), JSON.stringify(input2));
+    const input2 = complaintBody(complaint);
+    const key = randomUUID2();
+    let body;
+    try {
+      body = await this.#client.request("POST", this.#path(), JSON.stringify(input2), {
+        [IDEMPOTENCY_HEADER]: key
+      });
+    } catch (error62) {
+      const reason = retryableReason(error62);
+      if (reason !== void 0 && error62 instanceof RemoteError) {
+        throw new UndeliveredError(input2, reason, key, error62);
+      }
+      throw error62;
+    }
     adopt(complaint, readComplaint(body));
+    const answer2 = asRecord(body);
+    const openMatches = answer2?.["openMatches"];
+    return {
+      open: typeof openMatches === "number" ? openMatches : 0,
+      resolved: answer2?.["recurred"] === true
+    };
   }
   /** Returns the matching complaints, newest first. */
   async list(filter) {
-    const query = new URLSearchParams();
-    if (filter.project !== void 0) query.set("project", filter.project);
-    if (filter.severity !== void 0) query.set("severity", filter.severity);
-    if (filter.status !== void 0) query.set("status", filter.status);
-    if (filter.tag !== void 0) query.set("tag", filter.tag);
-    if (filter.reporter !== void 0) query.set("reporter", filter.reporter);
-    if (filter.since !== void 0) query.set("since", filter.since);
-    if (filter.until !== void 0) query.set("until", filter.until);
-    if (filter.limit !== void 0) query.set("limit", String(filter.limit));
-    const search = query.toString();
+    return (await this.listPage(filter)).complaints;
+  }
+  /**
+   * Returns the matching complaints, newest first, and whether the server
+   * stopped at its read budget, which the answer marks with a header.
+   */
+  async listPage(filter) {
+    const search = new URLSearchParams(listQueryOf(filter)).toString();
     const suffix = search === "" ? "" : `?${search}`;
-    const body = await this.#client.request("GET", this.#path(suffix));
+    const { body, headers } = await this.#client.requestWithHeaders(
+      "GET",
+      this.#path(suffix)
+    );
     if (!Array.isArray(body)) {
-      throw new RemoteError("the API returned a body that is not an array");
+      throw new RemoteError("unexpected response from the API: expected a list");
     }
-    return body.map((item) => readComplaint(item));
+    return {
+      complaints: body.map((item) => readComplaint(item)),
+      truncated: headers.get(TRUNCATED_HEADER) === "1"
+    };
   }
   /** Returns the complaint with that id, or `undefined` when the API says 404. */
   async get(id) {
@@ -25059,11 +25763,26 @@ var RemoteStore = class {
       this.#path(`/${encodeURIComponent(id)}`),
       JSON.stringify({
         status: change.status,
-        ...change.resolution === void 0 ? {} : { resolution: change.resolution }
+        ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+        ...change.reason === void 0 ? {} : { reason: change.reason },
+        ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf }
       })
     );
     return body === void 0 ? void 0 : readComplaint(body);
   }
+  /**
+   * Applies one status change to many complaints with the bulk route, in one
+   * request. A per-id `not_found` reads as an absent record, exactly like the
+   * `404` of one id, so its result carries no complaint and the code.
+   */
+  async bulkStatus(ids, change) {
+    const body = await this.#client.request(
+      "POST",
+      this.#path("/bulk"),
+      JSON.stringify({ ids, ...change })
+    );
+    return readBulkResults(body);
+  }
   /**
    * Replaces the tags. The API stamps the change with its own time, so the
    * request carries the list only.
@@ -25078,40 +25797,411 @@ var RemoteStore = class {
   }
 };
 
-// src/store.ts
-function actAsProblem(context) {
-  if (context.actAs === void 0) return void 0;
-  const endpoint = context.endpoint;
-  if (context.mode === "local" || endpoint === void 0) {
-    return "local mode is in use";
-  }
-  if (context.token !== void 0) return "QUIBBLE_TOKEN is set";
-  if (context.credential !== void 0) {
-    return `a stored session for ${endpoint} is used`;
+// src/queue.ts
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
+import {
+  appendFileSync,
+  closeSync,
+  fstatSync,
+  linkSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync3,
+  readSync,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeSync
+} from "node:fs";
+import { hostname as hostname3 } from "node:os";
+import { dirname as dirname4, join as join4 } from "node:path";
+
+// src/text.ts
+var CONTROL_RE2 = /[\u0000-\u001F\u007F-\u009F]/g;
+function escape(char) {
+  return `\\x${(char.codePointAt(0) ?? 0).toString(16).padStart(2, "0")}`;
+}
+function printable(text) {
+  return text.replace(/\s+/g, " ").replace(CONTROL_RE2, escape);
+}
+function printableLines(text) {
+  return text.replace(/\r\n?/g, "\n").replace(
+    CONTROL_RE2,
+    (char) => char === "\n" || char === "	" ? char : escape(char)
+  );
+}
+
+// src/queue.ts
+var QUEUE_FILENAME = "unsent.jsonl";
+var LOCK_FILENAME = "unsent.lock";
+var LOCK_STALE_MS = 5 * 6e4;
+var QUEUE_MODE = CREDENTIALS_MODE;
+function queuePath(env) {
+  return join4(defaultQuibbleHome(env), QUEUE_FILENAME);
+}
+function lockPathOf(queue) {
+  return join4(dirname4(queue), LOCK_FILENAME);
+}
+function authLabel(context) {
+  if (context.token !== void 0) {
+    const hash2 = createHash2("sha256").update(context.token).digest("hex");
+    return `token:${hash2.slice(0, 16)}`;
+  }
+  if (context.credential !== void 0) return `session:${context.credential.sub}`;
+  return `dev:${context.actAs ?? ""}`;
+}
+function readOptional(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return "";
+    throw new StorageError(`cannot read ${path}`, { cause: error62 });
   }
-  if (!isLoopback(endpoint)) return `${endpoint} is not a loopback endpoint`;
-  return void 0;
 }
-function checkActAs(context) {
-  const problem = actAsProblem(context);
-  if (problem !== void 0) throw actAsNotApplicable(problem);
+function endsInsideLine(path) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch (error62) {
+    if (isNotFound(error62)) return false;
+    throw error62;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0) return false;
+    const last = Buffer.alloc(1);
+    readSync(fd, last, 0, 1, size - 1);
+    return last[0] !== 10;
+  } finally {
+    closeSync(fd);
+  }
 }
-function openClient(context, io) {
-  checkActAs(context);
-  const endpoint = requireEndpoint(context);
-  const http = { debug: context.debug, fetch: io.fetch };
-  const org = context.org === void 0 ? {} : { org: context.org };
-  if (context.token === void 0 && context.credential === void 0) {
-    if (!isLoopback(endpoint)) throw notLoggedIn(endpoint);
-    return new ApiClient({
-      endpoint,
-      authorizer: devAuthorizer(endpoint, context.actAs, http),
-      ...org,
-      ...http
+function appendLine(path, value) {
+  try {
+    mkdirSync2(dirname4(path), { recursive: true, mode: HOME_MODE });
+    const lead = endsInsideLine(path) ? "\n" : "";
+    appendFileSync(path, `${lead}${JSON.stringify(value)}
+`, {
+      encoding: "utf8",
+      mode: QUEUE_MODE
     });
+  } catch (error62) {
+    throw new StorageError(`cannot write ${path}`, { cause: error62 });
   }
-  return new ApiClient({
-    endpoint,
+}
+function badLine(path, line, why) {
+  return new StorageError(`${path}: line ${line}: ${why}`);
+}
+function readQueuedLine(record2, path, line) {
+  const body = asRecord(record2["body"]);
+  const fields = ["key", "endpoint", "org", "auth", "queuedAt"];
+  for (const field of fields) {
+    if (typeof record2[field] !== "string") {
+      throw badLine(path, line, `${field} must be a string`);
+    }
+  }
+  if (body === void 0) throw badLine(path, line, "body must be an object");
+  return {
+    key: record2["key"],
+    endpoint: record2["endpoint"],
+    org: record2["org"],
+    auth: record2["auth"],
+    body,
+    queuedAt: record2["queuedAt"]
+  };
+}
+function readQueue(path) {
+  const pending = /* @__PURE__ */ new Map();
+  const known = /* @__PURE__ */ new Set();
+  const lines = readOptional(path).split("\n");
+  for (const [index, text] of lines.entries()) {
+    const line = index + 1;
+    if (text.trim() === "") continue;
+    let record2;
+    try {
+      record2 = asRecord(JSON.parse(text));
+    } catch {
+      throw badLine(path, line, "not JSON");
+    }
+    if (record2 === void 0) throw badLine(path, line, "not a JSON object");
+    const op = record2["op"];
+    if (op === "queued") {
+      const entry = readQueuedLine(record2, path, line);
+      known.add(entry.key);
+      pending.set(entry.key, entry);
+      continue;
+    }
+    if (op === "sent" || op === "dropped") {
+      const key = record2["key"];
+      if (typeof key !== "string" || !known.has(key)) {
+        throw badLine(path, line, `${op} names no queued complaint`);
+      }
+      pending.delete(key);
+      continue;
+    }
+    throw badLine(path, line, `unknown op ${JSON.stringify(op)}`);
+  }
+  return [...pending.values()];
+}
+function pendingFor(path, endpoint) {
+  const key = normalizeEndpoint(endpoint);
+  return readQueue(path).filter((entry) => entry.endpoint === key);
+}
+function enqueue(path, input2, now = /* @__PURE__ */ new Date()) {
+  const entry = {
+    key: input2.key ?? randomUUID3(),
+    endpoint: normalizeEndpoint(input2.endpoint),
+    org: input2.org,
+    auth: input2.auth,
+    body: input2.body,
+    queuedAt: now.toISOString()
+  };
+  appendLine(path, { op: "queued", ...entry });
+  return entry;
+}
+function processRuns(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error62) {
+    return error62.code === "EPERM";
+  }
+}
+function judgeLock(lock, now = /* @__PURE__ */ new Date()) {
+  let text;
+  try {
+    text = readFileSync3(lock, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw new StorageError(`cannot read ${lock}`, { cause: error62 });
+  }
+  const record2 = asRecord(parseQuietly(text));
+  const pid = record2?.["pid"];
+  const host = stringOf(record2, "host");
+  const at = Date.parse(stringOf(record2, "at") ?? "");
+  if (typeof pid !== "number" || host === void 0 || Number.isNaN(at)) {
+    let written;
+    try {
+      written = statSync(lock).mtimeMs;
+    } catch (error62) {
+      if (isNotFound(error62)) return void 0;
+      throw new StorageError(`cannot read ${lock}`, { cause: error62 });
+    }
+    return { text, stale: now.getTime() - written > LOCK_STALE_MS };
+  }
+  const dead = host === hostname3() && !processRuns(pid);
+  return { text, stale: dead || now.getTime() - at > LOCK_STALE_MS };
+}
+function createLock(lock, owner = { pid: process.pid, host: hostname3(), at: (/* @__PURE__ */ new Date()).toISOString() }) {
+  const text = JSON.stringify(owner);
+  let fd;
+  try {
+    mkdirSync2(dirname4(lock), { recursive: true, mode: HOME_MODE });
+    fd = openSync(lock, "wx", QUEUE_MODE);
+  } catch (error62) {
+    if (error62.code === "EEXIST") return void 0;
+    throw new StorageError(`cannot create ${lock}`, { cause: error62 });
+  }
+  try {
+    writeSync(fd, text);
+  } finally {
+    closeSync(fd);
+  }
+  return text;
+}
+function takeOverLock(lock, judged, owner) {
+  const moved = `${lock}.${process.pid}.${randomBytes2(6).toString("hex")}`;
+  try {
+    renameSync2(lock, moved);
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw new StorageError(`cannot move ${lock}`, { cause: error62 });
+  }
+  const text = readOptional(moved);
+  if (text === judged.text) {
+    rmSync2(moved, { force: true });
+    return createLock(lock, owner);
+  }
+  try {
+    linkSync(moved, lock);
+  } catch (error62) {
+    if (error62.code !== "EEXIST") {
+      throw new StorageError(`cannot restore ${lock}`, { cause: error62 });
+    }
+  } finally {
+    rmSync2(moved, { force: true });
+  }
+  return void 0;
+}
+function acquireLock(lock) {
+  const created = createLock(lock);
+  if (created !== void 0) return created;
+  const judged = judgeLock(lock);
+  if (judged === void 0) return createLock(lock);
+  if (!judged.stale) return void 0;
+  return takeOverLock(lock, judged);
+}
+function releaseLock(lock, text) {
+  if (readOptional(lock) === text) rmSync2(lock, { force: true });
+}
+function stopReason(status, text) {
+  if (status >= 500) return `the API answered ${status}`;
+  const code = serverCode(text);
+  const stops = status === 429 || status === 401 || status === 403 || status === 404 && code === ORG_NOT_FOUND;
+  if (!stops) return void 0;
+  const message = stringOf(asRecord(asRecord(parseQuietly(text))?.["error"]), "message");
+  return message ?? `the API answered ${status}`;
+}
+function projectOf(entry) {
+  const project = entry.body["project"];
+  return typeof project === "string" ? project : "?";
+}
+function headlineOfEntry(entry) {
+  const message = entry.body["message"];
+  return typeof message === "string" ? printable(summarize(message)) : "?";
+}
+function queuedCount(n) {
+  return `${n} queued ${n === 1 ? "complaint" : "complaints"}`;
+}
+async function flushQueue(options) {
+  const endpoint = normalizeEndpoint(options.endpoint);
+  const mine = () => readQueue(options.path).filter(
+    (entry) => entry.endpoint === endpoint && entry.auth === options.auth
+  );
+  const result = {
+    sent: [],
+    dropped: 0,
+    left: 0,
+    locked: false,
+    stopped: void 0
+  };
+  if (mine().length === 0) return result;
+  const lock = lockPathOf(options.path);
+  const held = acquireLock(lock);
+  if (held === void 0) {
+    return { ...result, locked: true, left: mine().length };
+  }
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  try {
+    const entries = mine();
+    for (const [index, entry] of entries.entries()) {
+      let status;
+      let text;
+      try {
+        ({ status, text } = await options.client.exchange(
+          "POST",
+          `/v1/orgs/${encodeURIComponent(entry.org)}/complaints`,
+          JSON.stringify(entry.body),
+          { [IDEMPOTENCY_HEADER]: entry.key }
+        ));
+      } catch (error62) {
+        result.stopped = errorMessage(error62);
+        result.left = entries.length - index;
+        return result;
+      }
+      if (status >= 200 && status < 300) {
+        const id = stringOf(asRecord(parseQuietly(text)), "id") ?? "";
+        appendLine(options.path, {
+          op: "sent",
+          key: entry.key,
+          id,
+          sentAt: now().toISOString()
+        });
+        result.sent.push(id);
+        continue;
+      }
+      const reason = stopReason(status, text);
+      if (reason !== void 0) {
+        result.stopped = reason;
+        result.left = entries.length - index;
+        return result;
+      }
+      const record2 = asRecord(asRecord(parseQuietly(text))?.["error"]);
+      const code = stringOf(record2, "code") ?? `http_${status}`;
+      const message = stringOf(record2, "message") ?? `the API answered ${status}`;
+      appendLine(options.path, {
+        op: "dropped",
+        key: entry.key,
+        code,
+        message,
+        droppedAt: now().toISOString()
+      });
+      result.dropped += 1;
+      writeLine(
+        options.stderr,
+        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, "${headlineOfEntry(entry)}": ${printable(message)}`
+      );
+    }
+    return result;
+  } finally {
+    releaseLock(lock, held);
+  }
+}
+
+// src/store.ts
+function queueSender(context, endpoint, io) {
+  return async (client) => {
+    let result;
+    try {
+      result = await flushQueue({
+        path: queuePath(io.env),
+        endpoint,
+        auth: authLabel(context),
+        client,
+        stderr: io.stderr
+      });
+    } catch (error62) {
+      if (!(error62 instanceof StorageError)) throw error62;
+      writeLine(
+        io.stderr,
+        `quibble: warning: cannot send the queue: ${errorMessage(error62)}`
+      );
+      return;
+    }
+    if (result.stopped !== void 0) {
+      writeLine(
+        io.stderr,
+        `quibble: ${queuedCount(result.left)} still unsent: ${result.stopped}`
+      );
+    }
+  };
+}
+function actAsProblem(context) {
+  if (context.actAs === void 0) return void 0;
+  const endpoint = context.endpoint;
+  if (context.mode === "local" || endpoint === void 0) {
+    return "local mode is in use";
+  }
+  if (context.token !== void 0) return "QUIBBLE_TOKEN is set";
+  if (context.credential !== void 0) {
+    return `you are logged in to ${endpoint}`;
+  }
+  if (!isLoopback(endpoint)) return `${endpoint} is not a loopback endpoint`;
+  return void 0;
+}
+function checkActAs(context) {
+  const problem = actAsProblem(context);
+  if (problem !== void 0) throw actAsNotApplicable(problem);
+}
+function openClient(context, io, options = {}) {
+  checkActAs(context);
+  const endpoint = requireEndpoint(context);
+  const http = { debug: context.debug, fetch: io.fetch };
+  const org = {
+    ...context.org === void 0 ? {} : { org: context.org },
+    ...options.queue === false ? {} : { beforeFirst: queueSender(context, endpoint, io) }
+  };
+  if (context.token === void 0 && context.credential === void 0) {
+    if (!isLoopback(endpoint)) throw notLoggedIn(endpoint);
+    return new ApiClient({
+      endpoint,
+      authorizer: devAuthorizer(endpoint, context.actAs, http),
+      ...org,
+      ...http
+    });
+  }
+  return new ApiClient({
+    endpoint,
     authorizer: createAuthorizer(endpoint, { env: io.env, ...http }),
     ...org,
     ...http
@@ -25125,17 +26215,26 @@ function openOrgClient(context, io) {
 function openBackend(context, io) {
   if (context.mode === "local") {
     checkActAs(context);
-    return { store: new FileStore(context.storePath), client: void 0 };
+    const local = new FileStore(context.storePath);
+    return { store: local, client: void 0, local };
   }
   const client = openOrgClient(context, io);
-  return { store: new RemoteStore(client), client };
+  return { store: new RemoteStore(client), client, local: void 0 };
 }
 function openStore(context, io) {
   return openBackend(context, io).store;
 }
+function needsServer(command, context) {
+  return new ConfigError(
+    context.endpoint === void 0 ? `${command} needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc` : `${command} needs a server: drop --local`
+  );
+}
+function requireServer(command, context) {
+  if (context.mode !== "remote") throw needsServer(command, context);
+}
 
 // src/commands/complain.ts
-var REMOTE_REPORTER_MESSAGE = "--reporter is not allowed in remote mode: the server records the signed-in user";
+var REMOTE_REPORTER_MESSAGE = "--reporter only works in local mode: the server sets the reporter";
 async function runComplain(message, options, context, io) {
   const project = requireProject(context);
   const org = requireOrg(context);
@@ -25153,11 +26252,18 @@ async function runComplain(message, options, context, io) {
     ...options.tag === void 0 || options.tag.length === 0 ? {} : { tags: options.tag },
     agent: context.agent,
     reporter: context.reporter,
-    ...context.cwd === void 0 ? {} : { cwd: context.cwd }
+    ...context.cwd === void 0 ? {} : { cwd: context.cwd },
+    ...options.cmd === void 0 ? {} : { cmd: options.cmd }
   };
-  const complaint = await createComplaint(store, input2, {
-    allowedTags: context.allowedTags
-  });
+  let complaint;
+  try {
+    complaint = await createComplaint(store, input2, {
+      allowedTags: context.allowedTags
+    });
+  } catch (error62) {
+    if (!(error62 instanceof UndeliveredError)) throw error62;
+    return queueComplaint(error62, org, project, context, io, options.json === true);
+  }
   if (options.json === true) {
     writeJson(io.stdout, complaint);
     return 0;
@@ -25167,6 +26273,35 @@ async function runComplain(message, options, context, io) {
     io.stdout,
     `Filed complaint ${complaint.id} for ${scope} (${complaint.severity})`
   );
+  for (const line of matchLines(complaint)) writeLine(io.stdout, line);
+  return 0;
+}
+function matchLines(complaint) {
+  const lines = [];
+  if (complaint.openMatches === 1) {
+    lines.push("1 open complaint already shares this headline.");
+  } else if (complaint.openMatches > 1) {
+    lines.push(`${complaint.openMatches} open complaints already share this headline.`);
+  }
+  if (complaint.recurred) {
+    lines.push("A resolved complaint shares this headline: this one is marked recurred.");
+  }
+  return lines;
+}
+function queueComplaint(error62, org, project, context, io, json2) {
+  const path = queuePath(io.env);
+  enqueue(path, {
+    endpoint: requireEndpoint(context),
+    org,
+    auth: authLabel(context),
+    body: error62.body,
+    key: error62.key
+  });
+  writeLine(
+    io.stderr,
+    `quibble: queued the complaint for ${org}/${project} in ${path}: ${error62.reason}. It is sent with the next remote command under the same credential, or run \`quibble retry\`.`
+  );
+  if (json2) writeJson(io.stdout, { queued: true, org, project, reason: error62.reason });
   return 0;
 }
 async function readMessage(message, io) {
@@ -25208,7 +26343,9 @@ function runConfig(options, context, io) {
     agent: context.agent,
     reporter: context.reporter,
     actAs: context.actAs ?? null,
-    auth: describeAuth(context)
+    auth: describeAuth(context),
+    // Every credential counts, and nothing is sent.
+    unsent: context.mode === "remote" && context.endpoint !== void 0 ? pendingFor(queuePath(io.env), context.endpoint).length : 0
   };
   if (options.json === true) {
     writeJson(io.stdout, report);
@@ -25222,31 +26359,50 @@ function runConfig(options, context, io) {
 }
 
 // src/commands/init.ts
-import { existsSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename, join as join4, resolve as resolve2 } from "node:path";
-var SNIPPET_INTRO = `## Filing complaints
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename2, join as join6, resolve as resolve3 } from "node:path";
 
-This project uses Quibble. When the build, the tests, the documentation or the
-tooling waste your time, file a complaint instead of working around the problem
-in silence.`;
-var SNIPPET_USAGE = `Use \`-s low|medium|high\` for severity and repeat \`-t <tag>\` for tags. The first
-line of the message is the headline every surface shows, so put the summary on
-the first line and the detail below it. Pipe a long message on stdin with
-\`quibble complain -\`. File one complaint per problem, and file it when you hit
-the problem rather than at the end of the task.`;
-function exampleCommand(tag) {
-  return `    quibble complain "what went wrong, and what you expected" -s medium -t ${tag}`;
-}
-var AGENT_SNIPPET = [SNIPPET_INTRO, exampleCommand("build"), SNIPPET_USAGE].join(
-  "\n\n"
-);
+// src/snippet.ts
+import { basename } from "node:path";
+var SNIPPET_HEADING = "## Filing complaints";
+var SKILL_HEADING = "# Filing complaints";
+var SKILL_PATH = ".claude/skills/quibble/SKILL.md";
+var DEFAULT_SNIPPET_AGENT = "claude";
+var AGENTS_FILE_AGENT = "codex";
+var SNIPPET_INTRO = `This project uses Quibble. When the build, tests, docs or tooling waste your
+time, file a complaint instead of quietly working around the problem.`;
+var SNIPPET_USAGE = `- Set severity with \`-s low|medium|high\`. Add tags with \`-t <tag>\` (repeatable).
+- Put a one-line summary first; it is the headline everywhere. Add details below.
+- Name the command that failed with \`--cmd "<command>"\`.
+- Pipe a long message on stdin with \`quibble complain -\`.
+- File one complaint per problem, as soon as you hit it, not at the end of the task.`;
+var SKILL_FRONT_MATTER = `---
+name: quibble
+description: File a Quibble complaint when the build, tests, docs or tooling of this project waste your time. Use it as soon as you hit the problem, not at the end of the task.
+---`;
 var SNIPPET_LOGIN = "Run `quibble login` once before the first complaint.";
 function orgSentence(org) {
   return `Complaints go to the \`${org}\` organization.`;
 }
+function exampleCommand(tag, agent) {
+  return `    quibble complain "what went wrong, and what you expected" -s medium -t ${tag} --agent ${agent}`;
+}
+function tagRules(tags) {
+  const list = tags.map((tag) => `\`${tag}\``).join(", ");
+  return `Every complaint needs at least one of these tags: ${list}.
+If none fits, pass \`-t ${OTHER_TAG_PREFIX}<name>\` naming the tag you wanted, such as
+\`-t ${OTHER_TAG_PREFIX}network\`. Run \`quibble tags\` to see the list.`;
+}
 function agentSnippet(tags, scope = {}) {
   const first = tags?.[0];
-  const blocks = tags === void 0 || first === void 0 ? [SNIPPET_INTRO, exampleCommand("build"), SNIPPET_USAGE] : [SNIPPET_INTRO, exampleCommand(first), tagRules(tags), SNIPPET_USAGE];
+  const agent = scope.agent ?? DEFAULT_SNIPPET_AGENT;
+  const blocks = [
+    SNIPPET_HEADING,
+    SNIPPET_INTRO,
+    exampleCommand(first ?? "build", agent)
+  ];
+  if (tags !== void 0 && first !== void 0) blocks.push(tagRules(tags));
+  blocks.push(SNIPPET_USAGE);
   const sentences = [];
   const { endpoint, org } = scope;
   if (endpoint !== void 0 && endpoint !== "") sentences.push(SNIPPET_LOGIN);
@@ -25254,54 +26410,207 @@ function agentSnippet(tags, scope = {}) {
   if (sentences.length > 0) blocks.push(sentences.join(" "));
   return blocks.join("\n\n");
 }
-function tagRules(tags) {
-  const list = tags.map((tag) => `\`${tag}\``).join(", ");
-  return `Every complaint needs at least one tag. The allowed tags are ${list}.
-When no tag fits, pass \`-t ${OTHER_TAG_HINT}\` and name the tag you wanted, such
-as \`-t ${OTHER_TAG_PREFIX}network\`. Run \`quibble tags\` to print the list.`;
-}
-function runInit(options, io) {
-  const directory = resolve2(io.cwd);
-  const path = join4(directory, PROJECT_CONFIG_FILENAME);
-  if (existsSync(path) && options.force !== true) {
+function skillFile(snippet) {
+  const body = snippet.startsWith(SNIPPET_HEADING) ? `${SKILL_HEADING}${snippet.slice(SNIPPET_HEADING.length)}` : snippet;
+  return `${SKILL_FRONT_MATTER}
+
+${body}
+`;
+}
+function agentForFile(path) {
+  return basename(path).toLowerCase() === "agents.md" ? AGENTS_FILE_AGENT : DEFAULT_SNIPPET_AGENT;
+}
+function hasSnippet(text) {
+  return text.split(/\r?\n/).some((line) => line.trimEnd() === SNIPPET_HEADING);
+}
+
+// src/commands/snippet.ts
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join5, resolve as resolve2 } from "node:path";
+function existsError(path) {
+  return new UsageError(`${path} already exists: pass --force to overwrite it`);
+}
+function readOptional2(path) {
+  try {
+    return readFileSync4(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return "";
+    throw error62;
+  }
+}
+function writeSkill(path, snippet) {
+  mkdirSync3(dirname5(path), { recursive: true });
+  writeFileSync2(path, skillFile(snippet), "utf8");
+}
+async function runSnippet(options, context, io) {
+  const project = requireProject(context);
+  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
+  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
+  const skillPath = options.skill === true ? join5(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
+  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
+  if (options.append !== void 0 && hasSnippet(existing)) {
+    throw new UsageError(
+      `${options.append} already has a "${SNIPPET_HEADING}" section: edit it by hand`
+    );
+  }
+  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
+  let tags;
+  if (context.mode === "remote") {
+    tags = (await openOrgClient(context, io).project(project)).tags;
+  } else {
+    checkActAs(context);
+    tags = context.allowedTags;
+  }
+  const scope = {
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...context.slug === void 0 ? {} : { org: context.slug }
+  };
+  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
+  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
+  if (appendPath !== void 0) {
+    const agent = override ?? agentForFile(appendPath);
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    const kept = existing.replace(/\s+$/, "");
+    writeFileSync2(appendPath, kept === "" ? `${snippet}
+` : `${kept}
+
+${snippet}
+`);
+    shown = { agent, snippet };
+  }
+  if (skillPath !== void 0) {
+    const agent = override ?? DEFAULT_SNIPPET_AGENT;
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    writeSkill(skillPath, snippet);
+    if (appendPath === void 0) shown = { agent, snippet };
+  }
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      snippet: shown.snippet,
+      agent: shown.agent,
+      appended: appendPath ?? null,
+      skill: skillPath ?? null
+    });
+    return 0;
+  }
+  if (appendPath === void 0 && skillPath === void 0) {
+    writeLine(io.stdout, shown.snippet);
+    return 0;
+  }
+  if (appendPath !== void 0) {
+    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
+  }
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  return 0;
+}
+
+// src/commands/init.ts
+var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
+function agentLead(agent) {
+  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
+}
+async function runInit(options, io) {
+  const directory = resolve3(io.cwd);
+  const path = join6(directory, PROJECT_CONFIG_FILENAME);
+  if (existsSync2(path) && options.force !== true) {
     throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
   }
+  const skillPath = options.skill === true ? join6(directory, SKILL_PATH) : void 0;
+  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
   const project = resolveProjectName(options.project, directory);
   const org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
   const endpoint = options.endpoint?.trim();
   const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
+  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
   const config2 = {
     project,
     ...org === void 0 ? {} : { org },
     ...endpoint === void 0 || endpoint === "" ? {} : { endpoint },
     ...tags === void 0 ? {} : { tags }
   };
-  writeFileSync2(path, `${JSON.stringify(config2, null, 2)}
+  writeFileSync3(path, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
+  const snippet = agentSnippet(tags, {
+    agent,
+    ...endpoint === void 0 ? {} : { endpoint },
+    ...org === void 0 ? {} : { org }
+  });
+  if (skillPath !== void 0) writeSkill(skillPath, snippet);
+  const check2 = await checkServer(options, project, io);
   if (options.json === true) {
-    writeJson(io.stdout, { path, project, org: org ?? null, tags: tags ?? null });
+    writeJson(io.stdout, {
+      path,
+      project,
+      org: org ?? null,
+      tags: tags ?? null,
+      skill: skillPath ?? null,
+      server: check2.server
+    });
     return 0;
   }
   writeLine(io.stdout, `Wrote ${path}`);
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
   writeLine(io.stdout, `Project: ${project}`);
   if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
   if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
   writeLine(io.stdout);
-  writeLine(io.stdout, "Add this to your CLAUDE.md or AGENTS.md:");
+  writeLine(io.stdout, agentLead(agent));
   writeLine(io.stdout);
-  writeLine(
-    io.stdout,
-    agentSnippet(tags, {
-      ...endpoint === void 0 ? {} : { endpoint },
-      ...org === void 0 ? {} : { org }
-    })
-  );
+  writeLine(io.stdout, snippet);
+  if (agent === DEFAULT_SNIPPET_AGENT) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, CODEX_LINE);
+  }
+  if (check2.line !== void 0) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, check2.line);
+  }
   return 0;
 }
+async function checkServer(options, project, io) {
+  const context = {
+    ...resolveContext({
+      cwd: io.cwd,
+      env: io.env,
+      endpoint: options.endpoint,
+      org: options.org,
+      local: options.local
+    }),
+    actAs: void 0
+  };
+  const { endpoint, org } = context;
+  if (context.mode !== "remote" || endpoint === void 0 || org === void 0 || context.token === void 0 && context.credential === void 0 && !isLoopback(endpoint)) {
+    return { server: "unchecked" };
+  }
+  const warn = (text) => {
+    writeLine(io.stderr, `quibble: warning: ${text}`);
+  };
+  try {
+    await openClient(context, io, { queue: false }).project(project);
+    return { server: "found", line: `Project ${org}/${project} exists on ${endpoint}.` };
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.status === 404) {
+      if (error62.serverCode === ORG_NOT_FOUND) {
+        warn(`no organization ${org} on ${endpoint} for this account`);
+        return { server: "no_org" };
+      }
+      warn(
+        `${org} has no project ${project} on ${endpoint}: an admin creates it in the organization settings`
+      );
+      return { server: "no_project" };
+    }
+    warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
+    return { server: "unreachable" };
+  }
+}
 function resolveProjectName(given, directory) {
   const candidate = given?.trim();
   if (candidate !== void 0 && candidate !== "") return parseProjectName(candidate);
-  const name = basename(directory);
+  const name = basename2(directory);
   try {
     return parseProjectName(name);
   } catch (error62) {
@@ -25332,25 +26641,30 @@ var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
 var MINUTE_MS = 6e4;
 var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS2 = 24 * HOUR_MS;
+var DAY_MS3 = 24 * HOUR_MS;
 var UNIT_MS = {
   m: MINUTE_MS,
   h: HOUR_MS,
-  d: DAY_MS2,
-  w: 7 * DAY_MS2
+  d: DAY_MS3,
+  w: 7 * DAY_MS3
 };
-function reject() {
-  throw new UsageError(SINCE_MESSAGE);
+var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
+function reject(message = SINCE_MESSAGE) {
+  throw new UsageError(message);
 }
 function iso(at) {
   if (Number.isNaN(at.getTime())) reject();
   return at.toISOString();
 }
-function fromDuration(digits, unit, now) {
-  if (digits.startsWith("0")) reject();
+function durationMs(digits, unit) {
+  if (digits.startsWith("0")) return void 0;
   const step = UNIT_MS[unit];
-  if (step === void 0) reject();
-  return iso(new Date(now.getTime() - Number(digits) * step));
+  return step === void 0 ? void 0 : Number(digits) * step;
+}
+function fromDuration(digits, unit, now) {
+  const span = durationMs(digits, unit);
+  if (span === void 0) reject();
+  return iso(new Date(now.getTime() - span));
 }
 function fromDate(value) {
   const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
@@ -25368,6 +26682,27 @@ function parseSince(text, now) {
   if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
   return reject();
 }
+function parseExpires(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  let stamp2;
+  try {
+    if (duration3 !== null) {
+      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
+      if (span === void 0) reject(EXPIRES_MESSAGE);
+      stamp2 = iso(new Date(now.getTime() + span));
+    } else if (DATE_RE.test(value)) {
+      stamp2 = fromDate(value);
+    } else if (TIMESTAMP_RE.test(value)) {
+      stamp2 = iso(new Date(value));
+    } else {
+      return reject(EXPIRES_MESSAGE);
+    }
+  } catch {
+    return reject(EXPIRES_MESSAGE);
+  }
+  return stamp2;
+}
 
 // src/scope.ts
 function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
@@ -25387,6 +26722,9 @@ function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
     ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
   };
 }
+function tagFilter(tags) {
+  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
+}
 
 // src/commands/list.ts
 var COLUMNS = [
@@ -25396,57 +26734,104 @@ var COLUMNS = [
   "status",
   "project",
   "reporter",
+  "tags",
+  "group",
   "summary"
 ];
 var REPORTER_WIDTH = 20;
+var TAGS_WIDTH = 24;
 var SUMMARY_MAX = 60;
+var RECURRED_MARK = "\u21BB";
+function cut2(text, width) {
+  if (text.length <= width) return text;
+  return `${text.slice(0, width - 3)}...`;
+}
 function summaryOf(complaint) {
-  const summary = summarize(complaint.message);
-  if (summary.length <= SUMMARY_MAX) return summary;
-  return `${summary.slice(0, SUMMARY_MAX - 3)}...`;
+  return cut2(printable(summarize(complaint.message)), SUMMARY_MAX);
 }
+function limitNote(count, limit, more) {
+  if (limit >= MAX_LIMIT) {
+    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
+  }
+  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
+}
+var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
 async function runList(options, context, io) {
+  if (options.ids === true && options.json === true) {
+    throw new UsageError("--ids and --json cannot be used together");
+  }
   const { store, client } = openBackend(context, io);
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
     ...options.severity === void 0 ? {} : { severity: options.severity },
-    ...options.tag === void 0 ? {} : { tag: options.tag },
+    ...tagFilter(options.tag),
+    ...options.search === void 0 ? {} : { q: options.search },
     ...reporter === void 0 ? {} : { reporter },
     ...options.limit === void 0 ? {} : { limit: options.limit }
   });
-  const complaints = await listComplaints(store, filter);
+  const limit = filter.limit ?? DEFAULT_LIMIT;
+  const page = await listComplaintPage(store, {
+    ...filter,
+    limit: Math.min(limit + 1, MAX_LIMIT)
+  });
+  const complaints = page.complaints.slice(0, limit);
   if (options.json === true) {
     writeJson(io.stdout, complaints);
     return 0;
   }
+  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
+  if (note !== void 0) writeLine(io.stderr, note);
+  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
+  if (options.ids === true) {
+    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
+    return 0;
+  }
   if (complaints.length === 0) {
     writeLine(io.stdout, "No complaints found.");
     return 0;
   }
-  for (const line of formatTable(complaints)) writeLine(io.stdout, line);
+  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
+    groupComplaints(complaints).map((group) => ({
+      complaint: group.head,
+      group
+    }))
+  );
+  for (const line of lines) writeLine(io.stdout, line);
   return 0;
 }
 function reporterOf(complaint) {
-  const name = complaint.reporterName ?? complaint.reporter;
-  if (name.length <= REPORTER_WIDTH) return name;
-  return `${name.slice(0, REPORTER_WIDTH - 3)}...`;
-}
-function formatTable(complaints) {
-  const rows2 = complaints.map((complaint) => [
-    complaint.id.slice(0, 8),
-    complaint.createdAt.slice(0, 16),
-    complaint.severity,
-    complaint.status,
-    complaint.project,
-    reporterOf(complaint),
-    summaryOf(complaint)
-  ]);
-  const widths = COLUMNS.map(
-    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  return cut2(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+}
+function groupCell(group) {
+  const count = group.count > 1 ? `\xD7${group.count}` : "";
+  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
+}
+function formatTable(rows2) {
+  const grouped = rows2.some((row) => row.group !== void 0);
+  const columns = COLUMNS.filter((name) => grouped || name !== "group");
+  const cells = rows2.map(({ complaint, group }) => {
+    const values = {
+      id: complaint.id.slice(0, 8),
+      created: complaint.createdAt.slice(0, 16),
+      severity: complaint.severity,
+      status: complaint.status,
+      project: complaint.project,
+      reporter: reporterOf(complaint),
+      tags: cut2(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      group: group === void 0 ? "" : groupCell(group),
+      summary: summaryOf(complaint)
+    };
+    return columns.map((name) => values[name]);
+  });
+  const widths = columns.map(
+    (name, column) => cells.reduce(
+      (width, row) => Math.max(width, (row[column] ?? "").length),
+      name.length
+    )
   );
-  const format = (cells) => cells.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [format(COLUMNS), ...rows2.map(format)];
+  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(columns), ...cells.map(format)];
 }
 
 // src/commands/orgs.ts
@@ -25571,8 +26956,8 @@ var NodeTerminal = class {
     const queued = this.#lines.shift();
     if (queued !== void 0) return Promise.resolve(queued);
     if (this.#closed) return Promise.resolve("");
-    return new Promise((resolve3) => {
-      this.#waiting = resolve3;
+    return new Promise((resolve4) => {
+      this.#waiting = resolve4;
     });
   }
   async #read(label, hidden) {
@@ -25610,7 +26995,7 @@ function nodeTerminal(input2, output2) {
 
 // src/commands/login.ts
 var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: a CI job sets QUIBBLE_TOKEN instead";
+var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: in CI, set QUIBBLE_TOKEN instead";
 var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
 var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
 var LOGIN_PAGE = "/login";
@@ -25654,7 +27039,7 @@ async function signIn(terminal, identity, config2) {
         );
       }
       throw new RemoteError(
-        `the sign-in asked for ${name}, which quibble does not support`
+        `this account needs a sign-in step that quibble doesn't support (${name})`
       );
     }
     return result.tokens;
@@ -25678,7 +27063,7 @@ async function runLogin(options, context, io) {
   const http = { debug: context.debug, fetch: io.fetch };
   const config2 = await fetchAuthConfig(endpoint, http);
   if (config2.mode === "local") {
-    writeLine(io.stdout, `${endpoint} needs no login.`);
+    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
     return 0;
   }
   let tokens;
@@ -25688,7 +27073,7 @@ async function runLogin(options, context, io) {
     terminal.close();
   }
   if (tokens.refreshToken === void 0) {
-    throw new RemoteError("the sign-in returned no refresh token");
+    throw new RemoteError("sign-in didn't return a refresh token");
   }
   const now = /* @__PURE__ */ new Date();
   const me = await readProfile(
@@ -25700,7 +27085,9 @@ async function runLogin(options, context, io) {
     config2.webUrl
   );
   if (me.sub === void 0 || me.email === void 0) {
-    throw new RemoteError("the API returned an identity without a sub or an email");
+    throw new RemoteError(
+      "unexpected response from the API: identity has no sub or email"
+    );
   }
   saveCredential(io.env, {
     endpoint,
@@ -25824,7 +27211,7 @@ function whoamiLines(endpoint, me, org) {
 
 // src/commands/promote.ts
 var PROMOTE_NEEDS_SERVER = "promote needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
-var PROMOTE_NEEDS_SERVER_LOCAL = "promote needs a server: drop --local, because the project record of the server owns the allowed tag list";
+var PROMOTE_NEEDS_SERVER_LOCAL = "promote needs a server: drop --local";
 async function runPromote(tag, options, context, io) {
   if (context.mode !== "remote") {
     throw new ConfigError(
@@ -25855,10 +27242,12 @@ async function runPromote(tag, options, context, io) {
 
 // src/commands/retag.ts
 var NO_TAG_MESSAGE = "retag needs at least one --tag";
-async function runRetag(id, options, context, io) {
+async function runRetag(value, options, context, io) {
   const tags = options.tag ?? [];
   if (tags.length === 0) throw new UsageError(NO_TAG_MESSAGE);
-  const { store, client } = openBackend(context, io);
+  const { store, client, local } = openBackend(context, io);
+  const [id] = await resolveIds([value], { store, local, context });
+  if (id === void 0) throw new NotFoundError(`no complaint with id ${value}`);
   const allowedTags = client === void 0 ? await localAllowedTags(store, id, context) : void 0;
   const complaint = await updateComplaintTags(
     store,
@@ -25882,35 +27271,228 @@ async function localAllowedTags(store, id, context) {
   return complaint.project === config2.project ? config2.tags : void 0;
 }
 
+// src/commands/retry.ts
+async function runRetry(options, context, io) {
+  requireServer("retry", context);
+  const endpoint = requireEndpoint(context);
+  const path = queuePath(io.env);
+  const client = openClient(context, io, { queue: false });
+  const result = await flushQueue({
+    path,
+    endpoint,
+    auth: authLabel(context),
+    client,
+    stderr: io.stderr
+  });
+  if (result.stopped !== void 0) {
+    throw new RemoteError(`${queuedCount(result.left)} still unsent: ${result.stopped}`);
+  }
+  const auth = authLabel(context);
+  const left = pendingFor(path, endpoint).filter((entry) => entry.auth === auth).length;
+  if (options.json === true) {
+    writeJson(io.stdout, { sent: result.sent, dropped: result.dropped, left });
+    return 0;
+  }
+  if (result.locked) {
+    writeLine(io.stdout, "Another quibble process is sending the queue.");
+    return 0;
+  }
+  if (result.sent.length === 0 && result.dropped === 0) {
+    writeLine(io.stdout, "No queued complaints.");
+    return 0;
+  }
+  const sent = result.sent.length;
+  writeLine(
+    io.stdout,
+    `Sent ${sent} queued ${sent === 1 ? "complaint" : "complaints"}; ${left} left.`
+  );
+  return 0;
+}
+
+// src/commands/show.ts
+var LABEL_WIDTH = "duplicate".length;
+function groupLine(count) {
+  if (count >= MAX_LIMIT) return `${MAX_LIMIT}+ complaints share this headline`;
+  return count === 1 ? "1 complaint shares this headline" : `${count} complaints share this headline`;
+}
+function groupCountOf(complaint, members2) {
+  const others = members2.filter((member) => member.id !== complaint.id).length;
+  return Math.min(others + 1, MAX_LIMIT);
+}
+function statusLine(complaint) {
+  const reason = complaint.reason === void 0 ? "" : ` (${complaint.reason})`;
+  const by = complaint.statusChangedByName ?? complaint.statusChangedBy;
+  const when = by === void 0 || complaint.statusChangedAt === void 0 ? "" : ` by ${by} at ${complaint.statusChangedAt}`;
+  return `${complaint.status}${reason}${when}`;
+}
+function showLines(complaint, groupCount, remote) {
+  const reporter = complaint.reporterName === void 0 ? complaint.reporter : `${complaint.reporterName} (${complaint.reporter})`;
+  const rows2 = [
+    ["id", complaint.id],
+    ["project", remote ? `${complaint.org}/${complaint.project}` : complaint.project],
+    ["status", statusLine(complaint)],
+    ["note", complaint.resolution],
+    ["duplicate", complaint.duplicateOf],
+    ["severity", complaint.severity],
+    ["tags", complaint.tags.length === 0 ? void 0 : complaint.tags.join(", ")],
+    ["agent", complaint.agent],
+    ["reporter", reporter],
+    ["created", complaint.createdAt],
+    ["updated", complaint.updatedAt],
+    ["cwd", complaint.cwd],
+    ["cmd", complaint.cmd],
+    ["group", groupLine(groupCount)],
+    ["recurred", complaint.recurred === true ? "yes" : void 0]
+  ];
+  const lines = rows2.filter((row) => row[1] !== void 0).map(([label, value]) => `${label.padEnd(LABEL_WIDTH)}  ${printable(value)}`);
+  return [...lines, "", printableLines(complaint.message)];
+}
+async function runShow(value, options, context, io) {
+  const { store, local } = openBackend(context, io);
+  const [id] = await resolveIds([value], { store, local, context });
+  const complaint = id === void 0 ? void 0 : await getComplaint(store, id);
+  if (id === void 0 || complaint === void 0) {
+    throw new NotFoundError(`no complaint with id ${id ?? value}`);
+  }
+  const group = await listComplaints(store, {
+    org: complaint.org,
+    project: complaint.project,
+    fingerprint: complaint.fingerprint,
+    limit: MAX_LIMIT
+  });
+  const groupCount = groupCountOf(complaint, group);
+  if (options.json === true) {
+    writeJson(io.stdout, { ...complaint, groupCount });
+    return 0;
+  }
+  for (const line of showLines(complaint, groupCount, context.mode === "remote")) {
+    writeLine(io.stdout, line);
+  }
+  return 0;
+}
+
 // src/commands/status.ts
+var REMOTE_ACTOR = "server";
 var VERBS = {
   open: "Reopened",
   resolved: "Resolved",
   dismissed: "Dismissed",
   deleted: "Deleted"
 };
-async function runStatusChange(status, id, options, context, io) {
-  const store = openStore(context, io);
-  const complaint = await updateComplaintStatus(store, id, {
+var NOT_FOUND = "not_found";
+function noComplaint(id) {
+  return `no complaint with id ${id}`;
+}
+async function readIdArguments(values, io) {
+  if (!values.includes("-")) return [...values];
+  if (values.length > 1) {
+    throw new UsageError("- reads the ids from stdin, so it takes no other id");
+  }
+  if (io.stdin.isTTY === true) throw new UsageError("no ids: pipe them on stdin");
+  const ids = (await readStdin(io.stdin)).split(/\s+/).filter((id) => id !== "");
+  if (ids.length === 0) throw new UsageError("no ids on stdin");
+  return ids;
+}
+async function runStatusChange(status, values, options, context, io) {
+  const reason = options.reason ?? (options.duplicateOf === void 0 ? void 0 : DUPLICATE_REASON);
+  const draft = {
     status,
-    ...options.note === void 0 ? {} : { resolution: options.note }
+    ...options.note === void 0 ? {} : { resolution: options.note },
+    ...reason === void 0 ? {} : { reason },
+    ...options.duplicateOf === void 0 ? {} : { duplicateOf: options.duplicateOf }
+  };
+  parseStatusChange(draft);
+  const given = await readIdArguments(values, io);
+  const backend = openBackend(context, io);
+  const extra = options.duplicateOf === void 0 ? [] : [options.duplicateOf];
+  const resolved = await resolveIds([...given, ...extra], {
+    store: backend.store,
+    local: backend.local,
+    context
   });
-  if (complaint === void 0) throw new NotFoundError(`no complaint with id ${id}`);
-  if (options.json === true) {
-    writeJson(io.stdout, complaint);
+  const ids = [...new Set(resolved.slice(0, given.length))];
+  const duplicateOf = options.duplicateOf === void 0 ? void 0 : resolved.at(-1);
+  const change = parseStatusChange({
+    ...draft,
+    ...duplicateOf === void 0 ? {} : { duplicateOf }
+  });
+  const actor = { by: context.mode === "remote" ? REMOTE_ACTOR : context.reporter };
+  if (ids.length === 1) {
+    const id = ids[0];
+    const complaint = await updateComplaintStatus(backend.store, id, change, { actor });
+    if (complaint === void 0) throw new NotFoundError(noComplaint(id));
+    if (options.json === true) {
+      writeJson(io.stdout, complaint);
+      return 0;
+    }
+    writeLine(io.stdout, successLine(status, complaint));
     return 0;
   }
-  writeLine(
-    io.stdout,
-    `${VERBS[status]} complaint ${complaint.id} for ${complaint.project}`
-  );
-  return 0;
+  const { results, error: error62 } = backend.store instanceof RemoteStore ? await remoteResults(backend.store, ids, change) : {
+    results: await localResults(
+      ids,
+      async (id) => updateComplaintStatus(backend.store, id, change, { actor })
+    ),
+    error: void 0
+  };
+  const failures = [];
+  for (const result of results) {
+    if (result.ok && result.complaint !== void 0) {
+      if (options.json !== true)
+        writeLine(io.stdout, successLine(status, result.complaint));
+      continue;
+    }
+    const code = result.error?.code ?? NOT_FOUND;
+    const message = code === NOT_FOUND ? noComplaint(result.id) : result.error?.message;
+    writeLine(io.stderr, `quibble: ${result.id}: ${message ?? "the change failed"}`);
+    failures.push({ remote: backend.store instanceof RemoteStore && code !== NOT_FOUND });
+  }
+  if (options.json === true) writeJson(io.stdout, results);
+  if (error62 !== void 0) throw error62;
+  if (failures.length === 0) return 0;
+  return failures.some((failure2) => failure2.remote) ? 2 : 1;
+}
+function successLine(status, complaint) {
+  return `${VERBS[status]} complaint ${complaint.id} for ${complaint.project}`;
+}
+async function localResults(ids, apply) {
+  const results = [];
+  for (const id of ids) {
+    try {
+      const complaint = await apply(id);
+      results.push(
+        complaint === void 0 ? { id, ok: false, error: { code: NOT_FOUND, message: noComplaint(id) } } : { id, ok: true, complaint }
+      );
+    } catch (error62) {
+      if (!(error62 instanceof ValidationError)) throw error62;
+      results.push({
+        id,
+        ok: false,
+        error: { code: error62.code, message: errorMessage(error62) }
+      });
+    }
+  }
+  return results;
+}
+async function remoteResults(store, ids, change) {
+  const results = [];
+  for (let start = 0; start < ids.length; start += BULK_MAX) {
+    try {
+      results.push(
+        ...await store.bulkStatus(ids.slice(start, start + BULK_MAX), change)
+      );
+    } catch (error62) {
+      return { results, error: error62 };
+    }
+  }
+  return { results, error: void 0 };
 }
 
 // src/commands/summary.ts
 var FORMATS = ["text", "markdown"];
 var SEVERITY_ORDER = [...SEVERITIES].reverse();
 var TRUNCATED_MESSAGE = `Counting the newest ${MAX_LIMIT} complaints only.`;
+var BUDGET_MESSAGE = "The server stopped searching early, so the counts are a floor: narrow the filters or pass --since.";
 var EMPTY_MESSAGE = "No complaints found.";
 async function runSummary(options, context, io) {
   if (options.format !== void 0 && options.json === true) {
@@ -25921,17 +27503,23 @@ async function runSummary(options, context, io) {
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
+    ...options.severity === void 0 ? {} : { severity: options.severity },
+    ...tagFilter(options.tag),
     ...reporter === void 0 ? {} : { reporter },
     limit: MAX_LIMIT
   });
-  const complaints = await listComplaints(store, filter);
-  const truncated = complaints.length === MAX_LIMIT;
+  const page = await listComplaintPage(store, filter);
+  const complaints = page.complaints;
+  const capped = complaints.length === MAX_LIMIT;
+  const truncated = capped || page.truncated;
   const summary = summarizeComplaints(complaints);
   if (options.json === true) {
     writeJson(io.stdout, {
       scope: {
         project: filter.project ?? null,
         status: filter.status ?? null,
+        severity: filter.severity ?? null,
+        tags: filter.tags ?? null,
         since: filter.since ?? null
       },
       truncated,
@@ -25943,7 +27531,8 @@ async function runSummary(options, context, io) {
     writeLine(io.stdout, EMPTY_MESSAGE);
     return 0;
   }
-  const lines = format === "markdown" ? markdownLines(filter, summary, truncated) : textLines(filter, summary, truncated);
+  const note = capped ? TRUNCATED_MESSAGE : page.truncated ? BUDGET_MESSAGE : void 0;
+  const lines = format === "markdown" ? markdownLines(filter, summary, note) : textLines(filter, summary, note);
   for (const line of lines) writeLine(io.stdout, line);
   return 0;
 }
@@ -25958,7 +27547,9 @@ function scopeLabel(filter) {
   const name = filter.project ?? "all projects";
   const since = filter.since === void 0 ? "" : ` since ${filter.since}`;
   const status = filter.status === void 0 ? "" : ` with status ${filter.status}`;
-  return `Complaints for ${name}${since}${status}`;
+  const severity = filter.severity === void 0 ? "" : ` with severity ${filter.severity}`;
+  const tags = filter.tags === void 0 ? "" : ` tagged ${filter.tags.map((tag) => tag === UNTAGGED_TAG ? "untagged" : oneLine(tag)).join(" or ")}`;
+  return `Complaints for ${name}${since}${status}${severity}${tags}`;
 }
 function blocksOf(filter, summary) {
   const severity = SEVERITY_ORDER.filter((name) => summary.bySeverity[name] > 0).map(
@@ -25982,13 +27573,11 @@ function statusCounts(summary) {
   const { open: open2, resolved, dismissed, deleted } = summary.byStatus;
   return `open ${open2}, resolved ${resolved}, dismissed ${dismissed}, deleted ${deleted}`;
 }
-function oneLine(name) {
-  return name.replace(/\s+/g, " ");
-}
+var oneLine = printable;
 function cell(name) {
   return oneLine(name).replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
 }
-function textLines(filter, summary, truncated) {
+function textLines(filter, summary, note) {
   const lines = [`${scopeLabel(filter)}: ${summary.total} (${statusCounts(summary)})`];
   for (const block2 of blocksOf(filter, summary)) {
     const names = block2.rows.map((row) => oneLine(row.name));
@@ -25998,10 +27587,10 @@ function textLines(filter, summary, truncated) {
       lines.push(`  ${(names[index] ?? "").padEnd(width)}  ${row.count}`);
     }
   }
-  if (truncated) lines.push("", TRUNCATED_MESSAGE);
+  if (note !== void 0) lines.push("", note);
   return lines;
 }
-function markdownLines(filter, summary, truncated) {
+function markdownLines(filter, summary, note) {
   const { open: open2, resolved, dismissed, deleted } = summary.byStatus;
   const noun = summary.total === 1 ? "complaint" : "complaints";
   const counts = `${open2} open, ${resolved} resolved, ${dismissed} dismissed, ${deleted} deleted`;
@@ -26016,7 +27605,7 @@ function markdownLines(filter, summary, truncated) {
     );
     for (const row of block2.rows) lines.push(`| ${cell(row.name)} | ${row.count} |`);
   }
-  if (truncated) lines.push("", TRUNCATED_MESSAGE);
+  if (note !== void 0) lines.push("", note);
   return lines;
 }
 
@@ -26029,12 +27618,146 @@ async function runTags(options, context, io) {
     writeJson(io.stdout, { project, tags: tags ?? null });
     return 0;
   }
-  if (tags === void 0) {
+  printList(project, tags, io);
+  return 0;
+}
+function printList(project, tags, io) {
+  if (tags === void 0 || tags.length === 0) {
     writeLine(io.stdout, `No tags configured for ${project}: any tag is allowed.`);
-    return 0;
+    return;
   }
   for (const tag of tags) writeLine(io.stdout, tag);
   writeLine(io.stdout, OTHER_TAG_HINT);
+}
+async function runTagsEdit(edit, given, options, context, io) {
+  requireServer("tags", context);
+  const project = requireProject(context);
+  if (given.length === 0) throw new UsageError(`tags ${edit} needs at least one tag`);
+  const named = parseAllowedTags(given);
+  const client = openOrgClient(context, io);
+  let next;
+  if (edit === "set") {
+    next = named;
+  } else {
+    const current = (await client.project(project)).tags ?? [];
+    const combined = edit === "add" ? [...current, ...named.filter((tag) => !current.includes(tag))] : current.filter((tag) => !named.includes(tag));
+    next = combined.length === 0 ? null : parseAllowedTags(combined);
+  }
+  const answer2 = await client.setProjectTags(project, next);
+  if (options.json === true) {
+    writeJson(io.stdout, answer2.body);
+    return 0;
+  }
+  const noun = answer2.retagged === 1 ? "complaint" : "complaints";
+  writeLine(
+    io.stdout,
+    `Updated the tags of ${project}: ${answer2.retagged} ${noun} retagged`
+  );
+  printList(project, answer2.tags, io);
+  return 0;
+}
+
+// src/commands/token.ts
+var COLUMNS3 = ["ID", "NAME", "CREATED", "LAST USED", "EXPIRES", "STATE"];
+function minute(stamp2) {
+  return stamp2.slice(0, 16).replace("T", " ");
+}
+function stateOf(token, now) {
+  if (token.revokedAt !== void 0) return "revoked";
+  if (token.expiresAt !== void 0 && Date.parse(token.expiresAt) <= now.getTime()) {
+    return "expired";
+  }
+  return "active";
+}
+function formatTokens(tokens, now) {
+  const rows2 = tokens.map((token) => [
+    token.id.slice(0, 8),
+    token.name,
+    minute(token.createdAt),
+    token.lastUsedAt === void 0 ? "\u2014" : minute(token.lastUsedAt),
+    token.expiresAt === void 0 ? "never" : minute(token.expiresAt),
+    stateOf(token, now)
+  ]);
+  const widths = COLUMNS3.map(
+    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  );
+  const format = (cells) => cells.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(COLUMNS3), ...rows2.map(format)];
+}
+function scopeOf(context) {
+  requireServer("token", context);
+  return { project: requireProject(context), org: requireOrg(context) };
+}
+async function runTokenCreate(name, options, context, io, now = /* @__PURE__ */ new Date()) {
+  const { project, org } = scopeOf(context);
+  const expiresAt = options.expires === void 0 ? void 0 : parseExpires(options.expires, now);
+  const body = parseNewToken(
+    { name, ...expiresAt === void 0 ? {} : { expiresAt } },
+    now
+  );
+  const client = openOrgClient(context, io);
+  const minted = await client.createToken(project, body);
+  if (options.json === true) {
+    writeJson(io.stdout, minted.body);
+    return 0;
+  }
+  writeLine(
+    io.stdout,
+    `Created token ${minted.token.name} for ${org}/${project}. It is shown once:`
+  );
+  writeLine(io.stdout, `QUIBBLE_ENDPOINT=${trimSlash(client.endpoint)}`);
+  writeLine(io.stdout, `QUIBBLE_TOKEN=${minted.plaintext}`);
+  return 0;
+}
+async function runTokenList(options, context, io, now = /* @__PURE__ */ new Date()) {
+  const { project } = scopeOf(context);
+  const answer2 = await openOrgClient(context, io).tokens(project);
+  if (options.json === true) {
+    writeJson(io.stdout, answer2.body);
+    return 0;
+  }
+  if (answer2.tokens.length === 0) {
+    writeLine(io.stdout, `No tokens for ${project}.`);
+    return 0;
+  }
+  for (const line of formatTokens(answer2.tokens, now)) writeLine(io.stdout, line);
+  return 0;
+}
+function findToken(tokens, value) {
+  const named = tokens.find((token) => token.name === value.trim());
+  if (named !== void 0) return named;
+  let read;
+  try {
+    read = readIdValue(value);
+  } catch (error62) {
+    if (error62 instanceof UsageError)
+      throw new NotFoundError(`no token is named ${value}`);
+    throw error62;
+  }
+  const { id, prefix } = read;
+  const matches = tokens.filter(
+    (token) => prefix ? token.id.startsWith(id) : token.id === id
+  );
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) {
+    throw ambiguousError(
+      id,
+      matches.map((token) => token.id),
+      "tokens"
+    );
+  }
+  throw new NotFoundError(`no token is named or starts with ${id}`);
+}
+async function runTokenRevoke(value, options, context, io) {
+  const { project, org } = scopeOf(context);
+  const client = openOrgClient(context, io);
+  const token = findToken((await client.tokens(project)).tokens, value);
+  await client.revokeToken(project, token.id);
+  if (options.json === true) {
+    writeJson(io.stdout, { id: token.id, name: token.name, revoked: true });
+    return 0;
+  }
+  writeLine(io.stdout, `Revoked token ${token.name} of ${org}/${project}.`);
   return 0;
 }
 
@@ -26049,11 +27772,18 @@ var NON_EMPTY_OPTIONS = [
   "note"
 ];
 var STATUS_COMMANDS = [
-  ["resolve", "resolved", "mark a complaint resolved"],
-  ["dismiss", "dismissed", "dismiss a complaint as a duplicate or as noise"],
-  ["delete", "deleted", "hide a complaint from every default view"],
-  ["reopen", "open", "reopen a complaint, restore a deleted one and remove its note"]
+  ["resolve", "resolved", "mark complaints resolved"],
+  ["dismiss", "dismissed", "dismiss duplicates, won't-fixes or noise"],
+  ["delete", "deleted", "hide complaints from the default views"],
+  ["reopen", "open", "reopen complaints and clear their notes"]
+];
+var TAGS_EDITS = [
+  ["set", "replace the project's allowed tag list"],
+  ["add", "add tags to the allowed tag list"],
+  ["remove", "remove tags from the allowed tag list"]
 ];
+var ID_HELP = `complaint id, or a unique prefix of at least ${SHORT_ID_MIN} characters`;
+var REASON_HELP = `${REASONS.slice(0, -1).join(", ")} or ${REASONS.at(-1) ?? ""}`;
 function packageVersion() {
   const require2 = createRequire(import.meta.url);
   const manifest = require2("../package.json");
@@ -26068,7 +27798,7 @@ function rejectEmptyOptions(options) {
   }
 }
 function withGlobalOptions(command) {
-  return command.option("--local", "use the local store, even when an endpoint is configured").option("--endpoint <url>", "base URL of the Quibble API").option("--org <slug>", "organization of every remote request").option("--json", "print JSON instead of text");
+  return command.option("--local", "use the local store even if an endpoint is set").option("--endpoint <url>", "base URL of the Quibble API").option("--org <slug>", "organization to use in remote mode").option("--json", "print JSON instead of text");
 }
 function globals(program2, command) {
   const outer = program2.opts();
@@ -26106,88 +27836,151 @@ function buildProgram(io, setCode) {
   }).exitOverride();
   withGlobalOptions(program2);
   withGlobalOptions(
-    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name, defaults to the directory name").option("-t, --tag <tag>", "allowed tag of the project, repeatable", collect).option("--force", "overwrite an existing .quibblerc")
-  ).action(function() {
+    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--force", "overwrite an existing .quibblerc or skill file")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runInit(options, io));
+  });
+  withGlobalOptions(
+    program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")
+  ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(runInit(options, io));
+    setCode(await runSnippet(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("complain").description("file a complaint, reading the message from stdin when omitted").argument("[message]", "the complaint, or `-` to read stdin").option("-s, --severity <level>", "low, medium or high").option("-t, --tag <tag>", "tag, repeatable", collect).option("--agent <name>", "agent that files the complaint").option("--reporter <name>", "person on whose behalf it is filed").option("--project <name>", "project name, overrides the .quibblerc")
+    program2.command("complain").description("file a complaint").argument("[message]", "what went wrong; omit it or pass `-` to read stdin").option("-s, --severity <level>", "low, medium or high").option("-t, --tag <tag>", "tag (repeatable)", collect).option("--agent <name>", "name of the agent filing it").option("--reporter <name>", "person you are filing for (local mode only)").option("--project <name>", "project name (overrides .quibblerc)").option("--cmd <command>", "the command that failed")
   ).action(async function(message) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runComplain(message, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("list").description("list complaints, newest first").option("--project <name>", "list one project").option("--all", "list every project").option("-s, --severity <level>", "low, medium or high").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "only open complaints, short for --status open").option("-t, --tag <tag>", "only complaints with this tag, or `-` for none").option("--mine", "only the complaints of the calling reporter").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--limit <n>", "how many complaints to return")
+    program2.command("list").description("list complaints, newest first").option("--project <name>", "list one project").option("--all", "list all projects").option("-s, --severity <level>", "low, medium or high").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "same as --status open").option(
+      "-t, --tag <tag>",
+      "complaints with any of these tags (repeatable, `-` for untagged)",
+      collect
+    ).option("--mine", "only your own complaints").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--search <text>", "complaints whose message contains the text").option("--limit <n>", "maximum number of complaints").option("--ungroup", "one row per complaint instead of one per group").option("--ids", "print the full id of every complaint, one per line")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runList(options, contextFor(options, io), io));
   });
+  withGlobalOptions(
+    program2.command("show").description("print one whole complaint").argument("<id>", ID_HELP)
+  ).action(async function(id) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runShow(id, options, contextFor(options, io), io));
+  });
   for (const [name, status, description] of STATUS_COMMANDS) {
-    const command = program2.command(name).description(description).argument("<id>", "full id of the complaint");
+    const command = program2.command(name).description(description).argument("<id...>", `${ID_HELP}; \`-\` reads the ids from stdin`);
     if (status !== "open") {
-      command.option("--note <text>", "note that explains the change");
+      command.option("--note <text>", "note explaining the change");
     }
-    withGlobalOptions(command).action(async function(id) {
+    if (status === "resolved" || status === "dismissed") {
+      command.option("--reason <reason>", REASON_HELP).option("--duplicate-of <id>", "the complaint these repeat (implies duplicate)");
+    }
+    withGlobalOptions(command).action(async function(ids) {
       const options = { ...this.opts(), ...globals(program2, this) };
       rejectEmptyOptions(options);
-      setCode(await runStatusChange(status, id, options, contextFor(options, io), io));
+      setCode(await runStatusChange(status, ids, options, contextFor(options, io), io));
     });
   }
   withGlobalOptions(
-    program2.command("retag").description("replace the tags of a complaint").argument("<id>", "full id of the complaint").option("-t, --tag <tag>", "tag, repeatable and needed at least once", collect)
+    program2.command("retag").description("replace a complaint's tags").argument("<id>", ID_HELP).option("-t, --tag <tag>", "tag (repeatable, at least one)", collect)
   ).action(async function(id) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runRetag(id, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("summary").description("count the matching complaints by severity, project and tag").option("--project <name>", "summarize one project").option("--all", "summarize every project").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "only open complaints, short for --status open").option("--mine", "only the complaints of the calling reporter").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--format <format>", "text or markdown")
+    program2.command("summary").description("count complaints by status, severity, project and tag").option("--project <name>", "summarize one project").option("--all", "summarize all projects").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "same as --status open").option("-s, --severity <level>", "low, medium or high").option(
+      "-t, --tag <tag>",
+      "complaints with any of these tags (repeatable, `-` for untagged)",
+      collect
+    ).option("--mine", "only your own complaints").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--format <format>", "text or markdown")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runSummary(options, contextFor(options, io), io));
   });
-  withGlobalOptions(
-    program2.command("tags").description("print the allowed tags of the project").option("--project <name>", "project name, overrides the .quibblerc")
+  const tags = withGlobalOptions(
+    program2.command("tags").description("print or edit the project's allowed tags").option("--project <name>", "project name (overrides .quibblerc)")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runTags(options, contextFor(options, io), io));
   });
+  for (const [edit, description] of TAGS_EDITS) {
+    withGlobalOptions(
+      tags.command(edit).description(`${description} (remote only)`).argument("[tag...]", "tags").option("--project <name>", "project name (overrides .quibblerc)")
+    ).action(async function(given) {
+      const options = { ...tags.opts(), ...this.opts(), ...globals(program2, this) };
+      rejectEmptyOptions(options);
+      setCode(await runTagsEdit(edit, given, options, contextFor(options, io), io));
+    });
+  }
+  const token = program2.command("token").description("manage the project's tokens (remote only)");
+  withGlobalOptions(
+    token.command("create").description("mint a project token and print it once").argument("<name>", "token name, unique in the project").option("--expires <when>", "a duration like 30d, a date or a UTC timestamp").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function(name) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenCreate(name, options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    token.command("list").description("list the project's tokens").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenList(options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    token.command("revoke").description("revoke a token").argument("<token>", "token name, or an id prefix of at least 6 characters").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function(value) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenRevoke(value, options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    program2.command("retry").description("send the complaints queued while offline")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runRetry(options, contextFor(options, io), io));
+  });
   withGlobalOptions(
-    program2.command("promote").description("add a suggestion to the allowed tags and retag the complaints").argument("<tag>", "the tag to promote, without the `other:` prefix").option("--project <name>", "project name, overrides the .quibblerc")
+    program2.command("promote").description("turn an `other:` suggestion into an allowed tag and retag complaints").argument("<tag>", "tag to promote, without `other:`").option("--project <name>", "project name (overrides .quibblerc)")
   ).action(async function(tag) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runPromote(tag, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("orgs").description("list the organizations the caller belongs to")
+    program2.command("orgs").description("list your organizations")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runOrgs(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("login").description("sign in to the endpoint on the terminal and store the session")
+    program2.command("login").description("log in to the endpoint")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runLogin(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("logout").description("revoke the refresh token and remove the stored session")
+    program2.command("logout").description("log out of the endpoint")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runLogout(contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("whoami").description("print the identity that the API resolves")
+    program2.command("whoami").description("show the current identity")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);