letthemquibble 1.0.1 → 1.2.0

package/dist/quibble.js

@@ -51,11 +51,11 @@ var require_error = __commonJS({
        * @param {string} code an id string representing the error
        * @param {string} message human-readable description of the error
        */
-      constructor(exitCode, code, message) {
+      constructor(exitCode, code2, message) {
         super(message);
         Error.captureStackTrace(this, this.constructor);
         this.name = this.constructor.name;
-        this.code = code;
+        this.code = code2;
         this.exitCode = exitCode;
         this.nestedError = void 0;
       }
@@ -1156,18 +1156,18 @@ var require_suggestSimilar = __commonJS({
       }
       return d[a.length][b.length];
     }
-    function suggestSimilar(word, candidates) {
-      if (!candidates || candidates.length === 0) return "";
-      candidates = Array.from(new Set(candidates));
+    function suggestSimilar(word, candidates2) {
+      if (!candidates2 || candidates2.length === 0) return "";
+      candidates2 = Array.from(new Set(candidates2));
       const searchingOptions = word.startsWith("--");
       if (searchingOptions) {
         word = word.slice(2);
-        candidates = candidates.map((candidate) => candidate.slice(2));
+        candidates2 = candidates2.map((candidate) => candidate.slice(2));
       }
       let similar = [];
       let bestDistance = maxDistance;
       const minSimilarity = 0.4;
-      candidates.forEach((candidate) => {
+      candidates2.forEach((candidate) => {
         if (candidate.length <= 1) return;
         const distance = editDistance(word, candidate);
         const length = Math.max(word.length, candidate.length);
@@ -1649,9 +1649,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return never
        * @private
        */
-      _exit(exitCode, code, message) {
+      _exit(exitCode, code2, message) {
         if (this._exitCallback) {
-          this._exitCallback(new CommanderError2(exitCode, code, message));
+          this._exitCallback(new CommanderError2(exitCode, code2, message));
         }
         process3.exit(exitCode);
       }
@@ -2289,14 +2289,14 @@ Expecting one of '${allowedValues.join("', '")}'`);
           });
         }
         const exitCallback = this._exitCallback;
-        proc.on("close", (code) => {
-          code = code ?? 1;
+        proc.on("close", (code2) => {
+          code2 = code2 ?? 1;
           if (!exitCallback) {
-            process3.exit(code);
+            process3.exit(code2);
           } else {
             exitCallback(
               new CommanderError2(
-                code,
+                code2,
                 "commander.executeSubCommandAsync",
                 "(close)"
               )
@@ -2803,8 +2803,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
         }
         const config2 = errorOptions || {};
         const exitCode = config2.exitCode || 1;
-        const code = config2.code || "commander.error";
-        this._exit(exitCode, code, message);
+        const code2 = config2.code || "commander.error";
+        this._exit(exitCode, code2, message);
       }
       /**
        * Apply any option related environment variables, if option does
@@ -3490,110 +3490,6 @@ var {
   Help
 } = import_index.default;
 
-// src/config.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
-
-// ../core/dist/types.js
-var SEVERITIES = ["low", "medium", "high"];
-var STATUSES = ["open", "resolved", "dismissed", "deleted"];
-var DELETED_STATUS = "deleted";
-var MESSAGE_MAX = 4e3;
-var RESOLUTION_MAX = 500;
-var TAGS_MAX = 10;
-var TAG_MAX = 32;
-var ALLOWED_TAGS_MAX = 50;
-var OTHER_TAG = "other";
-var OTHER_TAG_PREFIX = `${OTHER_TAG}:`;
-var OTHER_TAG_HINT = `${OTHER_TAG_PREFIX}<suggestion>`;
-var ALLOWED_TAG_RE = /^[a-z0-9][a-z0-9._-]*$/;
-var AGENT_MAX = 64;
-var REPORTER_MAX = 128;
-var EMAIL_MAX = REPORTER_MAX;
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var TOKEN_NAME_MAX = 64;
-var CWD_MAX = 1024;
-var UNTAGGED_TAG = "-";
-var STATS_MAX_WINDOW_DAYS = 90;
-var ROLES = ["filer", "viewer", "maintainer"];
-var ORG_ROLES = ["member", "admin", "owner"];
-var ORG_COLOURS = [
-  "slate",
-  "moss",
-  "ember",
-  "rust",
-  "teal",
-  "plum",
-  "snowcat",
-  "bone"
-];
-var DEFAULT_ORG_COLOUR = "slate";
-var ORG_SLUG_RE = /^[a-z0-9][a-z0-9-]{1,37}[a-z0-9]$/;
-var RESERVED_SLUGS = [
-  "api",
-  "admin",
-  "login",
-  "logout",
-  "o",
-  "orgs",
-  "new",
-  "platform",
-  "local",
-  "www",
-  "app",
-  "settings",
-  "signup"
-];
-var LOCAL_ORG = "local";
-var DISPLAY_NAME_MAX = 64;
-var PROJECT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-var DEFAULT_LIMIT = 50;
-var MAX_LIMIT = 200;
-var DEFAULT_SEVERITY = "medium";
-var DEFAULT_STATUS = "open";
-var DEFAULT_AGENT = "unknown";
-var DEFAULT_REPORTER = "unknown";
-var ACT_AS_HEADER = "x-quibble-act-as";
-
-// ../core/dist/errors.js
-var QuibbleError = class extends Error {
-  /** Stable machine-readable code, also used by the API error body. */
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = new.target.name;
-  }
-};
-var ValidationError = class extends QuibbleError {
-  /** One readable line per problem, such as `message: must be 1-4000 characters`. */
-  issues;
-  constructor(issues, options) {
-    const list = issues.length > 0 ? issues : ["invalid input"];
-    super("validation_error", list.join("; "), options);
-    this.issues = [...list];
-  }
-};
-var StorageError = class extends QuibbleError {
-  constructor(message, options) {
-    super("storage_error", message, options);
-  }
-};
-var ConfigError = class extends QuibbleError {
-  /** The file that holds the bad configuration, when one exists. */
-  path;
-  constructor(message, path, options) {
-    super("config_error", message, options);
-    this.path = path;
-  }
-};
-function isNotFound(error62) {
-  return typeof error62 === "object" && error62 !== null && error62.code === "ENOENT";
-}
-function describeError(error62) {
-  return error62 instanceof Error ? error62.message : String(error62);
-}
-
 // ../../node_modules/.pnpm/zod@4.6.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -6407,9 +6303,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname3) {
-  hostname3.lastIndex = 0;
-  return hostname3.test(url2.hostname);
+function urlHostnameOk(url2, hostname4) {
+  hostname4.lastIndex = 0;
+  return hostname4.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -6682,12 +6578,12 @@ function isIso7064Mod97(iban3) {
   let remainder = 0;
   const len = iban3.length;
   for (let i = 4; i < len; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   for (let i = 0; i < 4; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   return remainder === 1;
 }
@@ -7117,7 +7013,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const catchall = def.catchall;
   let value;
   const memo2 = globalConfig.memoizer;
@@ -7125,7 +7021,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -7261,7 +7157,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return doc.compile();
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -7270,7 +7166,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -8620,7 +8516,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -8630,7 +8526,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer2 = isRecursive(child, stack, resolve3);
+      const answer2 = isRecursive(child, stack, resolve4);
       if (answer2 > result)
         result = answer2;
     }
@@ -8641,7 +8537,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer2)
         answer2 = child;
     }
@@ -8705,7 +8601,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -16605,12 +16501,12 @@ function compileFn(schema, options) {
   doc.write(outputAccessor === null ? `return true;` : `return ${outputAccessor};`);
   const constantNames = ["INVALID", ...ctx.constants.keys()];
   const constantValues = [INVALID, ...ctx.constants.values()];
-  const code = doc.content.join("\n");
+  const code2 = doc.content.join("\n");
   const fullCode = options?.debug ? constantNames.length > 0 ? `// Constants: ${constantNames.join(", ")}
-${code}` : code : "";
+${code2}` : code2 : "";
   const F = Function;
   const factoryCode = `return (input) => {
-${code}
+${code2}
 }`;
   let fn;
   try {
@@ -19536,8 +19432,8 @@ function finalize(ctx, schema) {
         compactTypeUnion(entry[1].def ?? entry[1].schema);
       }
     }
-    for (const rewrite of ctx.deferred)
-      rewrite();
+    for (const rewrite2 of ctx.deferred)
+      rewrite2();
     if (ctx.intersections.length) {
       const carriers = /* @__PURE__ */ new Map();
       for (const seen of ctx.seen.values()) {
@@ -23262,66 +23158,292 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../core/dist/jitless.js
+external_exports.config({ jitless: true });
+
+// ../core/dist/types.js
+var SEVERITIES = ["low", "medium", "high"];
+var STATUSES = ["open", "resolved", "dismissed", "deleted"];
+var DELETED_STATUS = "deleted";
+var REASONS = ["fixed", "duplicate", "wontfix", "noise"];
+var DUPLICATE_REASON = "duplicate";
+var MESSAGE_MAX = 4e3;
+var RESOLUTION_MAX = 500;
+var TAGS_MAX = 10;
+var TAG_MAX = 32;
+var ALLOWED_TAGS_MAX = 50;
+var OTHER_TAG = "other";
+var OTHER_TAG_PREFIX = `${OTHER_TAG}:`;
+var OTHER_TAG_HINT = `${OTHER_TAG_PREFIX}<suggestion>`;
+var ALLOWED_TAG_RE = /^[a-z0-9][a-z0-9._-]*$/;
+var AGENT_MAX = 64;
+var REPORTER_MAX = 128;
+var EMAIL_MAX = REPORTER_MAX;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var TOKEN_NAME_MAX = 64;
+var CWD_MAX = 1024;
+var CMD_MAX = 1e3;
+var FINGERPRINT_MAX = 200;
+var EMPTY_FINGERPRINT = "<empty>";
+var RECURRENCE_WINDOW_DAYS = 90;
+var SEARCH_MAX = 200;
+var BULK_MAX = 100;
+var ID_MAX = 64;
+var UNTAGGED_TAG = "-";
+var STATS_MAX_WINDOW_DAYS = 90;
+var ROLES = ["filer", "viewer", "maintainer"];
+var ORG_ROLES = ["member", "admin", "owner"];
+var ORG_COLOURS = [
+  "slate",
+  "moss",
+  "ember",
+  "rust",
+  "teal",
+  "plum",
+  "snowcat",
+  "bone"
+];
+var DEFAULT_ORG_COLOUR = "slate";
+var ORG_SLUG_RE = /^[a-z0-9][a-z0-9-]{1,37}[a-z0-9]$/;
+var RESERVED_SLUGS = [
+  "api",
+  "admin",
+  "login",
+  "logout",
+  "o",
+  "orgs",
+  "new",
+  "platform",
+  "local",
+  "www",
+  "app",
+  "settings",
+  "signup"
+];
+var LOCAL_ORG = "local";
+var DISPLAY_NAME_MAX = 64;
+var PROJECT_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+var DEFAULT_LIMIT = 50;
+var MAX_LIMIT = 200;
+var DEFAULT_SEVERITY = "medium";
+var DEFAULT_STATUS = "open";
+var DEFAULT_AGENT = "unknown";
+var DEFAULT_REPORTER = "unknown";
+var ACT_AS_HEADER = "x-quibble-act-as";
+var TRUNCATED_HEADER = "x-quibble-truncated";
+var IDEMPOTENCY_HEADER = "idempotency-key";
+var IDEMPOTENCY_KEY_MAX = 128;
+
+// ../core/dist/errors.js
+var QuibbleError = class extends Error {
+  /** Stable machine-readable code, also used by the API error body. */
+  code;
+  constructor(code2, message, options) {
+    super(message, options);
+    this.code = code2;
+    this.name = new.target.name;
+  }
+};
+var ValidationError = class extends QuibbleError {
+  /** One readable line per problem, such as `message: must be 1-4000 characters`. */
+  issues;
+  constructor(issues, options) {
+    const list = issues.length > 0 ? issues : ["invalid input"];
+    super("validation_error", list.join("; "), options);
+    this.issues = [...list];
+  }
+};
+var StorageError = class extends QuibbleError {
+  constructor(message, options) {
+    super("storage_error", message, options);
+  }
+};
+var DuplicateIdError = class extends StorageError {
+  /** The id that a record already holds. */
+  id;
+  /**
+   * The record that won, when the store read it back, so the caller answers
+   * it without a read of its own that an index may not see yet.
+   */
+  existing;
+  constructor(id, existing, options) {
+    super(`complaint ${id} already exists`, options);
+    this.id = id;
+    this.existing = existing;
+  }
+};
+var ConfigError = class extends QuibbleError {
+  /** The file that holds the bad configuration, when one exists. */
+  path;
+  constructor(message, path, options) {
+    super("config_error", message, options);
+    this.path = path;
+  }
+};
+function isNotFound(error62) {
+  return typeof error62 === "object" && error62 !== null && error62.code === "ENOENT";
+}
+function describeError(error62) {
+  return error62 instanceof Error ? error62.message : String(error62);
+}
+
+// ../core/dist/fingerprint.js
+function headlineOf(message) {
+  for (const line of message.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed !== "")
+      return trimmed;
+  }
+  return "";
+}
+var WORD_CHAR = "[\\p{L}\\p{N}]";
+var QUOTED_RE = new RegExp(`"[^"]*"|\`[^\`]*\`|(?<!${WORD_CHAR})'.*?'(?!${WORD_CHAR})`, "gu");
+var PATH_RE = /[^\s]*[/\\][^\s]*/gu;
+var UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gu;
+var HEX_LITERAL_RE = /0x[0-9a-f]+/gu;
+var HEX_RUN_RE = new RegExp(`(?<!${WORD_CHAR})[0-9a-f]{7,}(?!${WORD_CHAR})`, "gu");
+var NUMBER_RE = new RegExp("\\p{N}+(?:\\.\\p{N}+)*", "gu");
+var PUNCTUATION_RE = /[^\p{L}\p{N}\s<>]/gu;
+function isHexId(run2) {
+  return /[a-f]/.test(run2) && /[0-9]/.test(run2);
+}
+function cut(text, max) {
+  if (text.length <= max)
+    return text;
+  const head = text.slice(0, max);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+function fingerprintOf(message) {
+  let text = headlineOf(message).toLowerCase();
+  text = text.replace(/[<>]/gu, " ");
+  text = text.replace(QUOTED_RE, " <str> ");
+  text = text.replace(PATH_RE, "<path>");
+  text = text.replace(UUID_RE, "<hex>");
+  text = text.replace(HEX_LITERAL_RE, "<hex>");
+  text = text.replace(HEX_RUN_RE, (run2) => isHexId(run2) ? "<hex>" : run2);
+  text = text.replace(NUMBER_RE, "<n>");
+  text = text.replace(PUNCTUATION_RE, " ");
+  text = text.replace(/\s+/gu, " ").trim();
+  text = cut(text, FINGERPRINT_MAX).trim();
+  return text === "" ? EMPTY_FINGERPRINT : text;
+}
+function groupComplaints(complaints) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const complaint of complaints) {
+    const key = `${complaint.org}/${complaint.project}
+${complaint.fingerprint}`;
+    const group = groups.get(key);
+    const recurred = complaint.status === "open" && complaint.recurred === true;
+    if (group === void 0) {
+      groups.set(key, {
+        project: complaint.project,
+        fingerprint: complaint.fingerprint,
+        head: complaint,
+        members: [complaint],
+        count: 1,
+        recurred
+      });
+      continue;
+    }
+    group.members.push(complaint);
+    group.count = group.members.length;
+    group.recurred ||= recurred;
+  }
+  return [...groups.values()];
+}
+
 // ../core/dist/validate.js
-var NULLABLE_KEYS = [
+var NEW_NULLABLE_KEYS = [
   "severity",
   "tags",
   "agent",
   "reporter",
   "reporterName",
   "cwd",
-  "status",
-  "resolution",
-  "updatedAt"
+  "cmd"
 ];
-var BLANKABLE_KEYS = [
+var NEW_BLANKABLE_KEYS = [
   "severity",
   "agent",
   "reporter",
   "reporterName",
+  "cmd"
+];
+var STORED_STATUS_KEYS = [
   "status",
   "resolution",
+  "reason",
+  "duplicateOf",
+  "statusChangedAt",
+  "statusChangedBy",
+  "statusChangedByName",
   "updatedAt"
 ];
+var STORED_NULLABLE_KEYS = [
+  ...NEW_NULLABLE_KEYS,
+  ...STORED_STATUS_KEYS,
+  "fingerprint",
+  "recurred"
+];
+var STORED_BLANKABLE_KEYS = [
+  ...NEW_BLANKABLE_KEYS,
+  ...STORED_STATUS_KEYS,
+  "fingerprint"
+];
 var FILTER_KEYS = [
   "project",
   "severity",
   "status",
-  "tag",
+  "tags",
   "reporter",
+  "q",
   "since",
   "until",
   "limit"
 ];
-var STATUS_CHANGE_KEYS = ["status", "resolution"];
+var FILTER_NULLABLE_KEYS = ["fingerprint"];
+var STATUS_CHANGE_KEYS = ["status", "resolution", "reason", "duplicateOf"];
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isBlank(value) {
   return typeof value === "string" && value.trim() === "";
 }
-function normalizeComplaintInput(value) {
+function complaintInput(nullable2, blankable) {
+  return (value) => {
+    if (!isPlainObject2(value))
+      return value;
+    const out = { ...value };
+    for (const key of nullable2) {
+      if (out[key] === null)
+        delete out[key];
+    }
+    for (const key of blankable) {
+      if (isBlank(out[key]))
+        delete out[key];
+    }
+    if (isBlank(out["cwd"]))
+      out["cwd"] = ".";
+    return out;
+  };
+}
+function normalizeKeys(value, keys) {
   if (!isPlainObject2(value))
     return value;
   const out = { ...value };
-  for (const key of NULLABLE_KEYS) {
-    if (out[key] === null)
-      delete out[key];
-  }
-  for (const key of BLANKABLE_KEYS) {
-    if (isBlank(out[key]))
+  for (const key of keys) {
+    if (out[key] === null || isBlank(out[key]))
       delete out[key];
   }
-  if (isBlank(out["cwd"]))
-    out["cwd"] = ".";
   return out;
 }
-function normalizeKeys(value, keys) {
+function dropNulls(value, keys) {
   if (!isPlainObject2(value))
     return value;
   const out = { ...value };
   for (const key of keys) {
-    if (out[key] === null || isBlank(out[key]))
+    if (out[key] === null)
       delete out[key];
   }
   return out;
@@ -23333,6 +23455,12 @@ function boundedString(max, typeMessage) {
   const message = lengthMessage(1, max);
   return external_exports.string({ message: typeMessage ?? message }).trim().min(1, { message }).max(max, { message });
 }
+var CONTROL_RE = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/;
+var CONTROL_MESSAGE = "must not contain control characters";
+function freeText(max, typeMessage) {
+  const message = lengthMessage(1, max);
+  return external_exports.string({ message: typeMessage ?? message }).overwrite((value) => value.replace(/\r\n?/g, "\n")).trim().min(1, { message }).max(max, { message }).refine((value) => !CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
+}
 var SEVERITY_MESSAGE = `must be one of ${SEVERITIES.join(", ")}`;
 var STATUS_MESSAGE = `must be one of ${STATUSES.join(", ")}`;
 var LIMIT_MESSAGE = `must be an integer between 1 and ${MAX_LIMIT}`;
@@ -23348,13 +23476,20 @@ var timestampSchema = external_exports.string({ message: TIMESTAMP_MESSAGE }).re
 function toMilliseconds(timestamp) {
   return new Date(timestamp).toISOString();
 }
-var projectNameSchema = external_exports.string({ message: PROJECT_MESSAGE }).regex(PROJECT_NAME_RE, { message: PROJECT_MESSAGE });
+function foldProjectName(name) {
+  return name.replace(/[A-Z]+/g, (letters) => letters.toLowerCase());
+}
+var projectNameSchema = external_exports.string({ message: PROJECT_MESSAGE }).overwrite(foldProjectName).regex(PROJECT_NAME_RE, { message: PROJECT_MESSAGE });
 var orgSlugSchema = external_exports.string({ message: SLUG_MESSAGE }).refine((value) => ORG_SLUG_RE.test(value) && !value.includes("--"), {
   message: SLUG_MESSAGE
 });
 var severitySchema = external_exports.enum(SEVERITIES, { message: SEVERITY_MESSAGE });
 var statusSchema = external_exports.enum(STATUSES, { message: STATUS_MESSAGE });
-var resolutionSchema = boundedString(RESOLUTION_MAX);
+var REASON_MESSAGE = `must be one of ${REASONS.join(", ")}`;
+var reasonSchema = external_exports.enum(REASONS, { message: REASON_MESSAGE });
+var idSchema = boundedString(ID_MAX, ID_MESSAGE);
+var resolutionSchema = freeText(RESOLUTION_MAX);
+var storedResolutionSchema = boundedString(RESOLUTION_MAX);
 var TAG_LENGTH_MESSAGE = lengthMessage(1, TAG_MAX);
 var SUGGESTION_LENGTH_MESSAGE = `must be at most ${TAG_MAX} characters after "${OTHER_TAG_PREFIX}"`;
 var tagSchema = external_exports.string({ message: "must be a string" }).trim().min(1, { message: TAG_LENGTH_MESSAGE }).superRefine((tag, ctx) => {
@@ -23370,8 +23505,8 @@ var tagSchema = external_exports.string({ message: "must be a string" }).trim().
   }
 });
 var TAGS_TYPE_MESSAGE = "must be an array of strings";
-var UNTAGGED_TAG_MESSAGE = `must not be "${UNTAGGED_TAG}", which selects the complaints with no tag`;
-var RESERVED_TAG_MESSAGE = `must not be "${OTHER_TAG}" or start with "${OTHER_TAG_PREFIX}", which are reserved`;
+var UNTAGGED_TAG_MESSAGE = `must not be "${UNTAGGED_TAG}" (reserved for untagged)`;
+var RESERVED_TAG_MESSAGE = `must not be "${OTHER_TAG}" or start with "${OTHER_TAG_PREFIX}" (reserved)`;
 var ALLOWED_TAG_MESSAGE = 'must use only letters, digits, ".", "_" and "-", and start with a letter or digit';
 function normalizeTag(tag) {
   const lower = tag.toLowerCase();
@@ -23386,7 +23521,7 @@ var complaintTagSchema = tagSchema.refine((tag) => tag !== UNTAGGED_TAG, {
 var tagsSchema = external_exports.array(complaintTagSchema, { message: TAGS_TYPE_MESSAGE }).transform(normalizeTags).refine((tags) => tags.length <= TAGS_MAX, {
   message: `must have at most ${TAGS_MAX} tags`
 });
-var tagsChangeObject = external_exports.object({
+var tagsChangeObject = external_exports.strictObject({
   tags: tagsSchema.refine((tags) => tags.length > 0, {
     message: "must list at least 1 tag"
   })
@@ -23474,17 +23609,21 @@ var limitSchema = external_exports.preprocess((value) => {
   const parsed = Number(trimmed);
   return Number.isNaN(parsed) ? value : parsed;
 }, external_exports.number({ message: LIMIT_MESSAGE }).int({ message: LIMIT_MESSAGE }).min(1, { message: LIMIT_MESSAGE }).max(MAX_LIMIT, { message: LIMIT_MESSAGE }));
-var newComplaintObject = external_exports.object({
+var agentSchema = freeText(AGENT_MAX);
+var newComplaintShape = {
   org: orgSlugSchema,
   project: projectNameSchema,
-  message: boundedString(MESSAGE_MAX),
+  message: freeText(MESSAGE_MAX),
   severity: severitySchema.optional(),
   tags: tagsSchema.optional(),
-  agent: boundedString(AGENT_MAX).optional(),
-  reporter: boundedString(REPORTER_MAX).optional(),
-  reporterName: boundedString(REPORTER_MAX).optional(),
-  cwd: cwdSchema.optional()
-});
+  agent: agentSchema.optional(),
+  reporter: freeText(REPORTER_MAX).optional(),
+  reporterName: freeText(REPORTER_MAX).optional(),
+  cwd: cwdSchema.optional(),
+  // Free text: it is trimmed and may hold newlines, and nothing parses it.
+  cmd: freeText(CMD_MAX).optional()
+};
+var newComplaintObject = external_exports.strictObject(newComplaintShape);
 function withDefaults(input2) {
   return {
     org: input2.org,
@@ -23496,74 +23635,207 @@ function withDefaults(input2) {
     reporter: input2.reporter ?? DEFAULT_REPORTER,
     // The server sets the display name, so it stays absent when nobody did.
     ...input2.reporterName === void 0 ? {} : { reporterName: input2.reporterName },
-    ...input2.cwd === void 0 ? {} : { cwd: input2.cwd }
+    ...input2.cwd === void 0 ? {} : { cwd: input2.cwd },
+    ...input2.cmd === void 0 ? {} : { cmd: input2.cmd }
   };
 }
-var newComplaintSchema = external_exports.preprocess(normalizeComplaintInput, newComplaintObject).transform(withDefaults);
-var storedComplaintObject = newComplaintObject.extend({
+var newComplaintSchema = external_exports.preprocess(complaintInput(NEW_NULLABLE_KEYS, NEW_BLANKABLE_KEYS), newComplaintObject).transform(withDefaults);
+var actorSchema = boundedString(REPORTER_MAX);
+var storedComplaintObject = external_exports.object({
+  ...newComplaintShape,
+  // The free text of a stored record is read without the control rule, so a
+  // record written before it stays readable.
+  message: boundedString(MESSAGE_MAX),
+  agent: boundedString(AGENT_MAX).optional(),
+  reporter: boundedString(REPORTER_MAX).optional(),
+  reporterName: boundedString(REPORTER_MAX).optional(),
+  cmd: boundedString(CMD_MAX).optional(),
   id: external_exports.string({ message: ID_MESSAGE }).trim().min(1, { message: ID_MESSAGE }),
+  fingerprint: external_exports.string({ message: ID_MESSAGE }).min(1, { message: ID_MESSAGE }).optional(),
+  recurred: external_exports.boolean({ message: "must be a boolean" }).optional(),
   createdAt: timestampSchema,
   status: statusSchema.optional(),
-  resolution: resolutionSchema.optional(),
+  resolution: storedResolutionSchema.optional(),
+  reason: reasonSchema.optional(),
+  duplicateOf: idSchema.optional(),
+  statusChangedAt: timestampSchema.optional(),
+  statusChangedBy: actorSchema.optional(),
+  statusChangedByName: actorSchema.optional(),
   updatedAt: timestampSchema.optional()
 });
-var complaintSchema = external_exports.preprocess(normalizeComplaintInput, storedComplaintObject).transform((input2) => ({
+var complaintSchema = external_exports.preprocess(complaintInput(STORED_NULLABLE_KEYS, STORED_BLANKABLE_KEYS), storedComplaintObject).transform((input2) => ({
   id: input2.id,
   ...withDefaults(input2),
+  fingerprint: input2.fingerprint ?? fingerprintOf(input2.message),
+  // The store writes the flag only when it is true.
+  ...input2.recurred === true ? { recurred: true } : {},
   // Millisecond precision, so a record written without a fraction still
   // compares by time against a `since` and an `until`.
   createdAt: toMilliseconds(input2.createdAt),
   status: input2.status ?? DEFAULT_STATUS,
   ...input2.resolution === void 0 ? {} : { resolution: input2.resolution },
+  ...input2.reason === void 0 ? {} : { reason: input2.reason },
+  ...input2.duplicateOf === void 0 ? {} : { duplicateOf: input2.duplicateOf },
+  ...input2.statusChangedAt === void 0 ? {} : { statusChangedAt: toMilliseconds(input2.statusChangedAt) },
+  ...input2.statusChangedBy === void 0 ? {} : { statusChangedBy: input2.statusChangedBy },
+  ...input2.statusChangedByName === void 0 ? {} : { statusChangedByName: input2.statusChangedByName },
   ...input2.updatedAt === void 0 ? {} : { updatedAt: toMilliseconds(input2.updatedAt) }
 }));
-var statusChangeObject = external_exports.object({
+var REASON_STATUS_MESSAGE = "only a resolve or a dismiss takes a reason";
+var DUPLICATE_OF_MESSAGE = `needs reason ${DUPLICATE_REASON}`;
+var statusChangeShape = {
   status: statusSchema,
-  resolution: resolutionSchema.optional()
-});
-var statusChangeSchema = external_exports.preprocess((value) => normalizeKeys(value, STATUS_CHANGE_KEYS), statusChangeObject).transform((input2) => ({
-  status: input2.status,
-  ...input2.resolution === void 0 ? {} : { resolution: input2.resolution }
-}));
-var BEFORE_UNTIL_MESSAGE = "must be before until";
-function checkWindow(window, ctx) {
-  const { since, until } = window;
-  if (since === void 0 || until === void 0)
-    return;
-  if (Date.parse(since) < Date.parse(until))
-    return;
-  ctx.addIssue({ code: "custom", path: ["since"], message: BEFORE_UNTIL_MESSAGE });
-}
-var listFilterObject = external_exports.object({
+  resolution: resolutionSchema.optional(),
+  reason: reasonSchema.optional(),
+  duplicateOf: idSchema.optional()
+};
+function checkReason(change, ctx) {
+  if (change.reason !== void 0 && change.status !== "resolved" && change.status !== "dismissed") {
+    ctx.addIssue({ code: "custom", path: ["reason"], message: REASON_STATUS_MESSAGE });
+  }
+  if (change.duplicateOf !== void 0 && change.reason !== DUPLICATE_REASON) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["duplicateOf"],
+      message: DUPLICATE_OF_MESSAGE
+    });
+  }
+}
+function toStatusChange(input2) {
+  return {
+    status: input2.status,
+    ...input2.resolution === void 0 ? {} : { resolution: input2.resolution },
+    ...input2.reason === void 0 ? {} : { reason: input2.reason },
+    ...input2.duplicateOf === void 0 ? {} : { duplicateOf: input2.duplicateOf }
+  };
+}
+var statusChangeSchema = external_exports.preprocess((value) => normalizeKeys(value, STATUS_CHANGE_KEYS), external_exports.strictObject(statusChangeShape).superRefine(checkReason)).transform(toStatusChange);
+var BULK_IDS_MESSAGE = `must list 1 to ${BULK_MAX} ids`;
+var BULK_BOTH_MESSAGE = "must change the status or the tags, not both";
+var BULK_NEITHER_MESSAGE = "must carry a status, addTags or removeTags";
+var BULK_NO_TAG_MESSAGE = "must carry at least 1 tag in addTags or removeTags";
+var BULK_TAG_KEYS = ["addTags", "removeTags"];
+var bulkIdsSchema = external_exports.array(idSchema, { message: BULK_IDS_MESSAGE }).min(1, { message: BULK_IDS_MESSAGE }).max(BULK_MAX, { message: BULK_IDS_MESSAGE }).transform((ids) => [...new Set(ids)]);
+var bulkChangeSchema = external_exports.preprocess((value) => dropNulls(normalizeKeys(value, STATUS_CHANGE_KEYS), BULK_TAG_KEYS), external_exports.strictObject({
+  ids: bulkIdsSchema,
+  status: statusChangeShape.status.optional(),
+  resolution: statusChangeShape.resolution,
+  reason: statusChangeShape.reason,
+  duplicateOf: statusChangeShape.duplicateOf,
+  addTags: tagsSchema.optional(),
+  removeTags: tagsSchema.optional()
+}).superRefine((input2, ctx) => {
+  const status = STATUS_CHANGE_KEYS.some((key) => input2[key] !== void 0);
+  const tags = BULK_TAG_KEYS.some((key) => input2[key] !== void 0);
+  if (status && tags) {
+    ctx.addIssue({ code: "custom", message: BULK_BOTH_MESSAGE });
+    return;
+  }
+  if (!status && !tags) {
+    ctx.addIssue({ code: "custom", message: BULK_NEITHER_MESSAGE });
+    return;
+  }
+  if (status) {
+    if (input2.status === void 0) {
+      ctx.addIssue({ code: "custom", path: ["status"], message: STATUS_MESSAGE });
+      return;
+    }
+    checkReason({ ...input2, status: input2.status }, ctx);
+    return;
+  }
+  const addTags = input2.addTags ?? [];
+  const removeTags = input2.removeTags ?? [];
+  if (addTags.length + removeTags.length === 0) {
+    ctx.addIssue({ code: "custom", message: BULK_NO_TAG_MESSAGE });
+    return;
+  }
+  for (const tag of removeTags) {
+    if (!addTags.includes(tag))
+      continue;
+    ctx.addIssue({
+      code: "custom",
+      path: ["removeTags"],
+      message: `${tag} is also in addTags`
+    });
+  }
+})).transform((input2) => {
+  if (input2.status !== void 0) {
+    return {
+      ids: input2.ids,
+      kind: "status",
+      change: toStatusChange({ ...input2, status: input2.status })
+    };
+  }
+  return {
+    ids: input2.ids,
+    kind: "tags",
+    addTags: input2.addTags ?? [],
+    removeTags: input2.removeTags ?? []
+  };
+});
+var BEFORE_UNTIL_MESSAGE = "must be before until";
+function checkWindow(window, ctx) {
+  const { since, until } = window;
+  if (since === void 0 || until === void 0)
+    return;
+  if (Date.parse(since) < Date.parse(until))
+    return;
+  ctx.addIssue({ code: "custom", path: ["since"], message: BEFORE_UNTIL_MESSAGE });
+}
+var filterTagsSchema = external_exports.array(tagSchema, { message: TAGS_TYPE_MESSAGE }).transform(normalizeTags).refine((tags) => tags.length > 0, { message: "must list at least 1 tag" }).refine((tags) => tags.length <= TAGS_MAX, {
+  message: `must have at most ${TAGS_MAX} tags`
+});
+var FINGERPRINT_MESSAGE = lengthMessage(1, FINGERPRINT_MAX);
+var listFilterShape = {
   org: orgSlugSchema,
   project: projectNameSchema.optional(),
   severity: severitySchema.optional(),
   status: statusSchema.optional(),
-  // The filter spends `UNTAGGED_TAG` on the complaints with no tag.
-  tag: tagSchema.optional(),
+  tags: filterTagsSchema.optional(),
   reporter: boundedString(REPORTER_MAX).optional(),
+  // Exact, so it is never trimmed, and never empty, because no fingerprint is.
+  fingerprint: external_exports.string({ message: FINGERPRINT_MESSAGE }).min(1, { message: FINGERPRINT_MESSAGE }).max(FINGERPRINT_MAX, { message: FINGERPRINT_MESSAGE }).optional(),
+  // The search is case-insensitive in every store.
+  q: boundedString(SEARCH_MAX).transform((value) => value.toLowerCase()).optional(),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
   limit: limitSchema.optional()
-}).superRefine(checkWindow);
-var listFilterSchema = external_exports.preprocess((value) => normalizeKeys(value ?? {}, FILTER_KEYS), listFilterObject).transform((input2) => ({
+};
+var LIST_FILTER_KEYS = Object.keys(listFilterShape);
+var listFilterObject = external_exports.strictObject(listFilterShape).superRefine(checkWindow);
+var listFilterSchema = external_exports.preprocess((value) => dropNulls(normalizeKeys(value ?? {}, FILTER_KEYS), FILTER_NULLABLE_KEYS), listFilterObject).transform((input2) => ({
   org: input2.org,
   ...input2.project === void 0 ? {} : { project: input2.project },
   ...input2.severity === void 0 ? {} : { severity: input2.severity },
   ...input2.status === void 0 ? {} : { status: input2.status },
-  // The tag is normalized like a stored one, so `other: network` matches.
-  ...input2.tag === void 0 ? {} : { tag: normalizeTag(input2.tag) },
+  ...input2.tags === void 0 ? {} : { tags: input2.tags },
   ...input2.reporter === void 0 ? {} : { reporter: input2.reporter },
+  ...input2.fingerprint === void 0 ? {} : { fingerprint: input2.fingerprint },
+  ...input2.q === void 0 ? {} : { q: input2.q },
   ...input2.since === void 0 ? {} : { since: toMilliseconds(input2.since) },
   ...input2.until === void 0 ? {} : { until: toMilliseconds(input2.until) },
   limit: input2.limit ?? DEFAULT_LIMIT
 }));
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var WINDOW_MESSAGE = `the window must not exceed ${STATS_MAX_WINDOW_DAYS} days`;
-var statsQueryObject = external_exports.object({
+var ALL_WINDOW = "all";
+var ALL_WINDOW_MESSAGE = `must be ${ALL_WINDOW}`;
+var ALL_WINDOW_BOUNDS_MESSAGE = `${ALL_WINDOW} takes no since or until`;
+var statsQueryObject = external_exports.strictObject({
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  status: statusSchema.optional()
+  status: statusSchema.optional(),
+  window: external_exports.literal(ALL_WINDOW, { message: ALL_WINDOW_MESSAGE }).optional()
+}).superRefine((input2, ctx) => {
+  if (input2.window === void 0)
+    return;
+  if (input2.since === void 0 && input2.until === void 0)
+    return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["window"],
+    message: ALL_WINDOW_BOUNDS_MESSAGE
+  });
 });
 var ROLE_MESSAGE = `must be one of ${ROLES.join(", ")}`;
 var ORG_ROLE_MESSAGE = `must be one of ${ORG_ROLES.join(", ")}`;
@@ -23576,8 +23848,8 @@ var orgRoleSchema = external_exports.enum(ORG_ROLES, { message: ORG_ROLE_MESSAGE
 var colourSchema = external_exports.enum(ORG_COLOURS, { message: COLOUR_MESSAGE });
 var emailSchema = boundedString(EMAIL_MAX, EMAIL_MESSAGE).refine((value) => EMAIL_RE.test(value), { message: EMAIL_MESSAGE });
 var inviteEmailSchema = emailSchema.transform((value) => value.toLowerCase());
-var displayNameSchema = boundedString(DISPLAY_NAME_MAX);
-var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, ["colour"]), external_exports.object({
+var displayNameSchema = freeText(DISPLAY_NAME_MAX);
+var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, ["colour"]), external_exports.strictObject({
   slug: orgSlugSchema.refine((value) => !RESERVED_SLUGS.some((reserved) => reserved === value), { message: RESERVED_SLUG_MESSAGE }),
   name: displayNameSchema,
   colour: colourSchema.optional()
@@ -23586,18 +23858,21 @@ var newOrgSchema = external_exports.preprocess((value) => normalizeKeys(value, [
   name: input2.name,
   colour: input2.colour ?? DEFAULT_ORG_COLOUR
 }));
-var orgPatchSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "colour"]), external_exports.object({ name: displayNameSchema.optional(), colour: colourSchema.optional() })).transform((input2) => ({
+var orgPatchSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "colour"]), external_exports.strictObject({
+  name: displayNameSchema.optional(),
+  colour: colourSchema.optional()
+})).transform((input2) => ({
   ...input2.name === void 0 ? {} : { name: input2.name },
   ...input2.colour === void 0 ? {} : { colour: input2.colour }
 })).refine((patch) => Object.keys(patch).length > 0, { message: ORG_PATCH_MESSAGE });
 var PLATFORM_PATCH_MESSAGE = "must set disabled, caps, or both";
 var CAP_MESSAGE = "must be a positive whole number";
-var orgCapsSchema = external_exports.object({
+var orgCapsSchema = external_exports.strictObject({
   projectsPerOrg: external_exports.number({ message: CAP_MESSAGE }).int({ message: CAP_MESSAGE }).min(1, { message: CAP_MESSAGE }).optional()
 }).transform((input2) => ({
   ...input2.projectsPerOrg === void 0 ? {} : { projectsPerOrg: input2.projectsPerOrg }
 }));
-var platformOrgPatchSchema = external_exports.object({
+var platformOrgPatchSchema = external_exports.strictObject({
   disabled: external_exports.boolean({ message: "must be a boolean" }).optional(),
   caps: orgCapsSchema.nullable().optional()
 }).transform((input2) => ({
@@ -23606,30 +23881,41 @@ var platformOrgPatchSchema = external_exports.object({
 })).refine((patch) => Object.keys(patch).length > 0, {
   message: PLATFORM_PATCH_MESSAGE
 });
-var orgInviteSchema = external_exports.object({ email: inviteEmailSchema, role: orgRoleSchema }).transform((input2) => ({ email: input2.email, role: input2.role }));
-var orgRoleChangeSchema = external_exports.object({ role: orgRoleSchema }).transform((input2) => ({ role: input2.role }));
-var profileSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name"]), external_exports.object({ name: displayNameSchema })).transform((input2) => ({ name: input2.name }));
-var newProjectSchema = external_exports.preprocess((value) => normalizeKeys(value, ["tags"]), external_exports.object({
+var orgInviteSchema = external_exports.strictObject({ email: inviteEmailSchema, role: orgRoleSchema }).transform((input2) => ({ email: input2.email, role: input2.role }));
+var orgRoleChangeSchema = external_exports.strictObject({ role: orgRoleSchema }).transform((input2) => ({ role: input2.role }));
+var profileSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name"]), external_exports.strictObject({ name: displayNameSchema })).transform((input2) => ({ name: input2.name }));
+var newProjectSchema = external_exports.preprocess((value) => normalizeKeys(value, ["tags"]), external_exports.strictObject({
   project: projectNameSchema,
   tags: allowedTagsSchema.optional()
 })).transform((input2) => ({
   project: input2.project,
   ...input2.tags === void 0 ? {} : { tags: input2.tags }
 }));
-var projectUpdateSchema = external_exports.object({ tags: allowedTagsSchema.nullable() }).transform((input2) => ({ tags: input2.tags }));
-var tagPromotionSchema = external_exports.object({ tag: allowedTagSchema }).transform((input2) => ({ tag: normalizeTag(input2.tag) }));
-var roleChangeSchema = external_exports.object({ role: roleSchema }).transform((input2) => ({ role: input2.role }));
-var newTokenSchema = external_exports.preprocess((value) => normalizeKeys(value, ["name", "expiresAt"]), external_exports.object({
-  name: boundedString(TOKEN_NAME_MAX),
-  expiresAt: timestampSchema.optional()
-})).transform((input2) => ({
-  name: input2.name,
-  ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
-}));
+var projectUpdateSchema = external_exports.strictObject({ tags: allowedTagsSchema.nullable() }).transform((input2) => ({ tags: input2.tags }));
+var tagPromotionSchema = external_exports.strictObject({ tag: allowedTagSchema }).transform((input2) => ({ tag: normalizeTag(input2.tag) }));
+var roleChangeSchema = external_exports.strictObject({ role: roleSchema }).transform((input2) => ({ role: input2.role }));
+var FUTURE_MESSAGE = "must be in the future";
+function newTokenSchema(now) {
+  return external_exports.preprocess((value) => normalizeKeys(value, ["name", "expiresAt"]), external_exports.strictObject({
+    name: freeText(TOKEN_NAME_MAX),
+    expiresAt: timestampSchema.refine((value) => Date.parse(value) > now.getTime(), {
+      message: FUTURE_MESSAGE
+    }).optional()
+  })).transform((input2) => ({
+    name: input2.name,
+    ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
+  }));
+}
+var UNKNOWN_KEY_MESSAGE = "unknown key";
+var emptyBodySchema = external_exports.strictObject({});
 function formatIssues(error62) {
-  return error62.issues.map((issue2) => {
-    const path = issue2.path.map((part) => String(part)).join(".");
-    return path === "" ? issue2.message : `${path}: ${issue2.message}`;
+  return error62.issues.flatMap((issue2) => {
+    const path = issue2.path.map((part) => String(part));
+    if (issue2.code === "unrecognized_keys") {
+      return issue2.keys.map((key) => `${[...path, key].join(".")}: ${UNKNOWN_KEY_MESSAGE}`);
+    }
+    const name = path.join(".");
+    return [name === "" ? issue2.message : `${name}: ${issue2.message}`];
   });
 }
 function run(schema, input2) {
@@ -23648,6 +23934,13 @@ function parseComplaint(input2) {
 function parseStatusChange(input2) {
   return run(statusChangeSchema, input2);
 }
+var statusActorSchema = external_exports.strictObject({ by: actorSchema, byName: actorSchema.optional() }).transform((input2) => ({
+  by: input2.by,
+  ...input2.byName === void 0 ? {} : { byName: input2.byName }
+}));
+function parseStatusActor(input2) {
+  return run(statusActorSchema, input2);
+}
 function parseTagsChange(input2) {
   return run(tagsChangeSchema, input2);
 }
@@ -23663,6 +23956,14 @@ function parseProjectName(input2) {
 function parseTagPromotion(input2) {
   return run(tagPromotionSchema, input2);
 }
+function parseNewToken(input2, now = /* @__PURE__ */ new Date()) {
+  return run(newTokenSchema(now), input2);
+}
+function parseAgentName(input2) {
+  return run(external_exports.object({ agent: agentSchema }), { agent: input2 }).agent;
+}
+var IDEMPOTENCY_KEY_RE = new RegExp(`^[A-Za-z0-9_-]{1,${IDEMPOTENCY_KEY_MAX}}$`);
+var IDEMPOTENCY_KEY_MESSAGE = `Idempotency-Key: must be 1-${IDEMPOTENCY_KEY_MAX} letters, digits, "-" or "_"`;
 function parseOrgSlug(input2) {
   return run(orgSlugSchema, input2);
 }
@@ -23718,8 +24019,8 @@ function summarizeComplaints(complaints) {
 var SUMMARY_WORDS = 20;
 var ELLIPSIS = "\u2026";
 function summarize(message) {
-  const line = message.split("\n").map((each) => each.trim()).find((each) => each !== "");
-  if (line === void 0)
+  const line = headlineOf(message);
+  if (line === "")
     return "";
   const words = line.split(/\s+/);
   if (words.length <= SUMMARY_WORDS)
@@ -23727,8 +24028,57 @@ function summarize(message) {
   return `${words.slice(0, SUMMARY_WORDS).join(" ")}${ELLIPSIS}`;
 }
 
+// ../core/dist/query.js
+var TAG_KEY = "tag";
+var SINGLE_KEYS = new Set(LIST_FILTER_KEYS.filter((key) => key !== "org" && key !== "tags"));
+function listQueryOf(filter) {
+  const pairs = [];
+  for (const key of LIST_FILTER_KEYS) {
+    if (key === "org")
+      continue;
+    const value = filter[key];
+    if (value === void 0)
+      continue;
+    if (key === "tags") {
+      for (const tag of filter.tags ?? [])
+        pairs.push([TAG_KEY, tag]);
+      continue;
+    }
+    pairs.push([key, String(value)]);
+  }
+  return pairs;
+}
+
+// ../core/dist/endpoint.js
+var DEFAULT_ENDPOINT = "https://api.letthemquibble.com";
+var DISCOVERY_PATH = "/.well-known/quibble.json";
+var LOCAL_ENDPOINT = "local";
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1"];
+function trimSlash(url2) {
+  return url2.replace(/\/+$/, "");
+}
+function normalizeEndpoint(url2) {
+  const text = trimSlash(url2.trim());
+  try {
+    const parsed = new URL(text);
+    return `${parsed.protocol}//${parsed.host}${trimSlash(parsed.pathname)}`;
+  } catch {
+    return text;
+  }
+}
+function isDefaultEndpoint(url2) {
+  return normalizeEndpoint(url2) === DEFAULT_ENDPOINT;
+}
+function isLoopbackUrl(url2) {
+  try {
+    return LOOPBACK_HOSTS.includes(new URL(url2).hostname);
+  } catch {
+    return false;
+  }
+}
+
 // ../core/dist/service.js
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 function applyTagRules(tags, allowedTags) {
   if (allowedTags === void 0)
     return [...tags];
@@ -23744,23 +24094,57 @@ async function createComplaint(store, input2, options = {}) {
     id: options.id === void 0 ? randomUUID() : options.id(),
     ...normalized,
     tags,
+    fingerprint: fingerprintOf(normalized.message),
     createdAt: stamp(options),
     status: DEFAULT_STATUS
   };
-  await store.create(complaint);
-  return complaint;
+  if (options.reserve !== void 0)
+    await options.reserve(complaint);
+  const match = options.keyed === true ? await store.create(complaint, { keyed: true }) : await store.create(complaint);
+  return {
+    ...complaint,
+    openMatches: match.open,
+    recurred: match.resolved
+  };
 }
 async function listComplaints(store, filter) {
   const parsed = parseListFilter(filter);
   return store.list(parsed);
 }
+async function listComplaintPage(store, filter) {
+  const parsed = parseListFilter(filter);
+  if (store.listPage !== void 0)
+    return store.listPage(parsed);
+  return { complaints: await store.list(parsed), truncated: false };
+}
+function scanComplaints(store, filter) {
+  return store.scan(parseListFilter(filter));
+}
 async function getComplaint(store, id) {
   return store.get(id);
 }
-async function updateComplaintStatus(store, id, change, options = {}) {
+async function updateComplaintStatus(store, id, change, options) {
   const parsed = parseStatusChange(change);
-  const update = { ...parsed, updatedAt: stamp(options) };
-  return store.update(id, update);
+  const actor = parseStatusActor(options.actor);
+  if (parsed.duplicateOf !== void 0) {
+    const target = options.current ?? await store.get(id);
+    if (target === void 0)
+      return void 0;
+    if (parsed.duplicateOf === id) {
+      throw new ValidationError(["duplicateOf: must name another complaint"]);
+    }
+    const original = await store.get(parsed.duplicateOf);
+    if (original === void 0 || original.org !== target.org) {
+      throw new ValidationError([`duplicateOf: no complaint ${parsed.duplicateOf}`]);
+    }
+  }
+  const update = {
+    ...parsed,
+    updatedAt: stamp(options),
+    changedBy: actor.by,
+    ...actor.byName === void 0 ? {} : { changedByName: actor.byName }
+  };
+  return store.update(id, update, options.current);
 }
 async function updateComplaintTags(store, id, change, options = {}) {
   const parsed = parseTagsChange(change);
@@ -23768,7 +24152,7 @@ async function updateComplaintTags(store, id, change, options = {}) {
     tags: applyTagRules(parsed.tags, options.allowedTags),
     updatedAt: stamp(options)
   };
-  return store.updateTags(id, update);
+  return store.updateTags(id, update, options.current);
 }
 
 // ../core/dist/file-store.js
@@ -23776,15 +24160,36 @@ import { appendFile, mkdir, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 var STATUS_OP = "status";
 var TAGS_OP = "tags";
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
 var FileStore = class {
   /** Path of the JSONL file. */
   path;
+  /** The creates of this process, one after the other. */
+  #creating = Promise.resolve();
   constructor(path) {
     this.path = path;
   }
-  /** Appends one line. Creates the parent directory on the first write. */
-  async create(complaint) {
-    await this.#append(complaint);
+  /**
+   * Counts what the complaint's project holds under its fingerprint, from the
+   * folded records, then appends the one complaint line, with `recurred: true`
+   * when a resolved match created in the last `RECURRENCE_WINDOW_DAYS` exists.
+   * Creates the parent directory on the first write. A keyed complaint whose
+   * id a record already holds is a `DuplicateIdError` carrying that record,
+   * and nothing is written. The creates of one process run one at a time.
+   */
+  create(complaint, options = {}) {
+    const write = this.#creating.then(async () => {
+      const records = await this.#readAll();
+      const existing = records.find((record2) => record2.id === complaint.id);
+      if (options.keyed === true && existing !== void 0) {
+        throw new DuplicateIdError(complaint.id, existing);
+      }
+      const match = matchOf(records, complaint);
+      await this.#append(match.resolved ? { ...complaint, recurred: true } : complaint);
+      return match;
+    });
+    this.#creating = write.catch(() => void 0);
+    return write;
   }
   /** Returns the matching complaints, newest first. */
   async list(filter) {
@@ -23796,6 +24201,11 @@ var FileStore = class {
     for (const complaint of await this.#matches(filter))
       yield complaint;
   }
+  /** Returns how many complaints match, whatever the limit says. */
+  async count(filter) {
+    const complaints = await this.#readAll();
+    return complaints.filter((complaint) => matchesFilter(complaint, filter)).length;
+  }
   /** Returns the complaint with that id, or `undefined`. */
   async get(id) {
     const complaints = await this.#readAll();
@@ -23804,26 +24214,32 @@ var FileStore = class {
   /**
    * Appends one status line and returns the updated complaint. Returns
    * `undefined`, and writes nothing, when no complaint has that id. A deleted
-   * complaint is reached like any other, so a reopen restores it.
+   * complaint is reached like any other, so a reopen restores it. `current` is
+   * ignored, because a fold reads every record anyway.
    */
-  async update(id, change) {
+  async update(id, change, _current) {
     const complaint = await this.get(id);
     if (complaint === void 0)
       return void 0;
-    await this.#append({
+    const line = {
       op: STATUS_OP,
       id,
       status: change.status,
       ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+      ...change.reason === void 0 ? {} : { reason: change.reason },
+      ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf },
+      changedBy: change.changedBy,
+      ...change.changedByName === void 0 ? {} : { changedByName: change.changedByName },
       updatedAt: change.updatedAt
-    });
-    return applyStatus(complaint, change);
+    };
+    await this.#append(line);
+    return applyStatus(complaint, line);
   }
   /**
    * Appends one tags line and returns the updated complaint. Returns
    * `undefined`, and writes nothing, when no complaint has that id.
    */
-  async updateTags(id, change) {
+  async updateTags(id, change, _current) {
     const complaint = await this.get(id);
     if (complaint === void 0)
       return void 0;
@@ -23946,31 +24362,70 @@ var FileStore = class {
       }
       const change = parseStatusChange({
         status: parsed["status"],
-        resolution: parsed["resolution"]
+        resolution: parsed["resolution"],
+        reason: parsed["reason"],
+        duplicateOf: parsed["duplicateOf"]
       });
-      return { op, id, ...change, updatedAt };
+      const changedBy = this.#actor(parsed, "changedBy", bad);
+      const changedByName = this.#actor(parsed, "changedByName", bad);
+      return {
+        op,
+        id,
+        ...change,
+        ...changedBy === void 0 ? {} : { changedBy },
+        ...changedByName === void 0 ? {} : { changedByName },
+        updatedAt
+      };
     } catch (error62) {
       if (!(error62 instanceof ValidationError))
         throw error62;
       throw bad(error62.message, error62);
     }
   }
+  /** Reads the optional actor key of a status line. */
+  #actor(parsed, key, bad) {
+    const value = parsed[key];
+    if (value === void 0)
+      return void 0;
+    if (typeof value !== "string" || value.trim() === "" || value.length > REPORTER_MAX) {
+      throw bad(`${key}: must be 1-${REPORTER_MAX} characters`);
+    }
+    return value;
+  }
   /** The prefix that every malformed complaint line shares. */
   #malformed(lineNumber) {
     return `malformed complaint on line ${lineNumber} of ${this.path}`;
   }
 };
 function applyStatus(complaint, change) {
-  const updated = {
-    ...complaint,
+  const { resolution: _resolution, reason: _reason, duplicateOf: _duplicateOf, statusChangedBy: _statusChangedBy, statusChangedByName: _statusChangedByName, ...rest } = complaint;
+  return {
+    ...rest,
     status: change.status,
+    ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+    ...change.reason === void 0 ? {} : { reason: change.reason },
+    ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf },
+    statusChangedAt: change.updatedAt,
+    ...change.changedBy === void 0 ? {} : { statusChangedBy: change.changedBy },
+    ...change.changedByName === void 0 ? {} : { statusChangedByName: change.changedByName },
     updatedAt: change.updatedAt
   };
-  if (change.resolution === void 0)
-    delete updated.resolution;
-  else
-    updated.resolution = change.resolution;
-  return updated;
+}
+function matchOf(complaints, complaint) {
+  const since = new Date(Date.parse(complaint.createdAt) - RECURRENCE_WINDOW_DAYS * DAY_MS2).toISOString();
+  let open2 = 0;
+  let resolved = false;
+  for (const each of complaints) {
+    if (each.project !== complaint.project)
+      continue;
+    if (each.fingerprint !== complaint.fingerprint)
+      continue;
+    if (each.status === "open")
+      open2 += 1;
+    if (each.status === "resolved" && each.createdAt >= since)
+      resolved = true;
+  }
+  return { open: open2, resolved };
 }
 function applyTags(complaint, change) {
   return { ...complaint, tags: [...change.tags], updatedAt: change.updatedAt };
@@ -23990,11 +24445,17 @@ function matchesFilter(complaint, filter) {
   if (filter.reporter !== void 0 && complaint.reporter !== filter.reporter) {
     return false;
   }
-  if (filter.tag !== void 0) {
-    const kept = filter.tag === UNTAGGED_TAG ? complaint.tags.length === 0 : complaint.tags.includes(filter.tag);
+  if (filter.tags !== void 0) {
+    const kept = filter.tags.some((tag) => tag === UNTAGGED_TAG ? complaint.tags.length === 0 : complaint.tags.includes(tag));
     if (!kept)
       return false;
   }
+  if (filter.fingerprint !== void 0 && complaint.fingerprint !== filter.fingerprint) {
+    return false;
+  }
+  if (filter.q !== void 0 && !complaint.message.toLowerCase().includes(filter.q)) {
+    return false;
+  }
   if (filter.since !== void 0 && complaint.createdAt < filter.since)
     return false;
   if (filter.until !== void 0 && complaint.createdAt >= filter.until)
@@ -24028,6 +24489,10 @@ function defaultConfigPath(env = process.env) {
   return join(defaultQuibbleHome(env), CONFIG_FILENAME);
 }
 
+// src/config.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
+
 // src/credentials.ts
 import { randomBytes } from "node:crypto";
 import {
@@ -24039,11 +24504,98 @@ import {
   writeFileSync
 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
+var CREDENTIALS_FILENAME = "credentials.json";
+var CREDENTIALS_MODE = 384;
+var HOME_MODE = 448;
+function defaultCredentialsPath(env) {
+  return join2(defaultQuibbleHome(env), CREDENTIALS_FILENAME);
+}
+function readEntry(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return void 0;
+  }
+  const raw = value;
+  const keys = ["endpoint", "refreshToken", "accessToken", "expiresAt", "sub", "email"];
+  for (const key of keys) {
+    if (typeof raw[key] !== "string" || raw[key] === "") return void 0;
+  }
+  return {
+    endpoint: raw["endpoint"],
+    refreshToken: raw["refreshToken"],
+    accessToken: raw["accessToken"],
+    expiresAt: raw["expiresAt"],
+    sub: raw["sub"],
+    email: raw["email"]
+  };
+}
+function readCredentials(env) {
+  const path = defaultCredentialsPath(env);
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return {};
+    throw new ConfigError(`cannot read ${path}`, path, { cause: error62 });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error62) {
+    throw new ConfigError(`invalid JSON in ${path}`, path, { cause: error62 });
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ConfigError(`invalid credentials in ${path}: must be a JSON object`, path);
+  }
+  const entries = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    const entry = readEntry(value);
+    if (entry !== void 0) entries[key] = entry;
+  }
+  return entries;
+}
+function findCredential(env, endpoint) {
+  return readCredentials(env)[normalizeEndpoint(endpoint)];
+}
+function writeCredentials(env, entries) {
+  const path = defaultCredentialsPath(env);
+  mkdirSync(dirname2(path), { recursive: true, mode: HOME_MODE });
+  const temp = join2(
+    dirname2(path),
+    `.${CREDENTIALS_FILENAME}.${randomBytes(6).toString("hex")}`
+  );
+  try {
+    writeFileSync(temp, `${JSON.stringify(entries, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: CREDENTIALS_MODE
+    });
+    chmodSync(temp, CREDENTIALS_MODE);
+    renameSync(temp, path);
+  } catch (error62) {
+    rmSync(temp, { force: true });
+    throw error62;
+  }
+}
+function saveCredential(env, credential) {
+  const key = normalizeEndpoint(credential.endpoint);
+  const stored = { ...credential, endpoint: key };
+  writeCredentials(env, { ...readCredentials(env), [key]: stored });
+  return stored;
+}
+function removeCredential(env, endpoint) {
+  const entries = readCredentials(env);
+  const key = normalizeEndpoint(endpoint);
+  if (entries[key] === void 0) return false;
+  delete entries[key];
+  writeCredentials(env, entries);
+  return true;
+}
 
 // src/errors.ts
+var AMBIGUOUS_ID = "ambiguous_id";
 var UsageError = class extends QuibbleError {
   constructor(message, options) {
-    super("usage_error", message, options);
+    super(options?.code ?? "usage_error", message, options);
   }
 };
 var NotFoundError = class extends QuibbleError {
@@ -24058,9 +24610,18 @@ var RemoteError = class extends QuibbleError {
    * other one stays exit 2.
    */
   status;
+  /** The `error.code` of the answer, when it carried one. */
+  serverCode;
+  /** The server's own message, when the answer carried one. */
+  serverMessage;
+  /** True when no server answered, which the offline queue of 5.13 reads. */
+  unanswered;
   constructor(message, options) {
     super("network_error", message, options);
     this.status = options?.status;
+    this.serverCode = options?.serverCode;
+    this.serverMessage = options?.serverMessage;
+    this.unanswered = options?.unanswered === true;
   }
 };
 function exitCodeFor(error62) {
@@ -24081,7 +24642,7 @@ var DEBUG_ENV = "QUIBBLE_DEBUG";
 function debugEnabled(env) {
   return env[DEBUG_ENV] === "1";
 }
-function trimSlash(url2) {
+function trimSlash2(url2) {
   return url2.replace(/\/+$/, "");
 }
 function originOf(url2) {
@@ -24117,12 +24678,12 @@ async function send(url2, request) {
     if (isTimeout(error62)) {
       throw new RemoteError(
         `request to ${originOf(url2)} timed out after ${timeoutMs / 1e3}s${detail(site)}`,
-        { cause: error62 }
+        { cause: error62, unanswered: true }
       );
     }
     throw new RemoteError(
       `cannot reach ${originOf(url2)}: ${describeError(error62)}${detail(site)}`,
-      { cause: error62 }
+      { cause: error62, unanswered: true }
     );
   }
 }
@@ -24132,7 +24693,7 @@ async function readText(response, site) {
   } catch (error62) {
     throw new RemoteError(
       `cannot read the response from ${originOf(site.url)}: ${describeError(error62)}${detail(site, response.status)}`,
-      { cause: error62 }
+      { cause: error62, unanswered: true }
     );
   }
 }
@@ -24140,7 +24701,7 @@ function parseJson(text, site, status) {
   try {
     return JSON.parse(text);
   } catch (error62) {
-    throw new RemoteError(`the API returned a malformed body${detail(site, status)}`, {
+    throw new RemoteError(`the API returned invalid JSON${detail(site, status)}`, {
       cause: error62
     });
   }
@@ -24176,134 +24737,40 @@ function serverCode(text) {
   return stringOf(asRecord(record2?.["error"]), "code");
 }
 function remoteFailure(site, response, text) {
-  const message = serverMessage(text, response) ?? `the API answered ${response.status}`;
+  const own2 = serverMessage(text, response);
+  const message = own2 ?? `the API returned HTTP ${response.status}`;
   return new RemoteError(`${message}${detail(site, response.status)}`, {
-    status: response.status
+    status: response.status,
+    serverCode: serverCode(text),
+    serverMessage: own2
   });
 }
 
-// src/credentials.ts
-var CREDENTIALS_FILENAME = "credentials.json";
-var CREDENTIALS_MODE = 384;
-var HOME_MODE = 448;
-function defaultCredentialsPath(env) {
-  return join2(defaultQuibbleHome(env), CREDENTIALS_FILENAME);
-}
-function normalizeEndpoint(endpoint) {
-  const text = trimSlash(endpoint.trim());
-  try {
-    const url2 = new URL(text);
-    return `${url2.protocol}//${url2.host}${trimSlash(url2.pathname)}`;
-  } catch {
-    return text;
-  }
-}
-function readEntry(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return void 0;
-  }
-  const raw = value;
-  const keys = ["endpoint", "refreshToken", "accessToken", "expiresAt", "sub", "email"];
-  for (const key of keys) {
-    if (typeof raw[key] !== "string" || raw[key] === "") return void 0;
+// src/cognito.ts
+var TARGET_PREFIX = "AWSCognitoIdentityProviderService.";
+var CONTENT_TYPE = "application/x-amz-json-1.1";
+var DEFAULT_EXPIRES_IN = 3600;
+var UNREACHABLE_LINE = "Couldn't reach the sign-in service.";
+var WRONG_CREDENTIALS_LINE = "Wrong email or password.";
+var TOO_MANY_LINE = "Too many attempts. Try again later.";
+var WRONG_CODE_LINE = "Wrong code.";
+var EXPIRED_CODE_LINE = "That code has expired. Request a new one.";
+var PASSWORD_POLICY_LINE = "Use at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.";
+var UNREACHABLE_TYPE = "Unreachable";
+var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
+var CognitoError = class extends RemoteError {
+  /** The `__type`, with any prefix up to a `#` dropped, or `Unreachable`. */
+  type;
+  /** Cognito's own `message`, or `undefined` when the answer carried none. */
+  detail;
+  constructor(type, detail2, line, suffix = "") {
+    super(`${line}${suffix}`, { unanswered: type === UNREACHABLE_TYPE });
+    this.type = type;
+    this.detail = detail2;
   }
-  return {
-    endpoint: raw["endpoint"],
-    refreshToken: raw["refreshToken"],
-    accessToken: raw["accessToken"],
-    expiresAt: raw["expiresAt"],
-    sub: raw["sub"],
-    email: raw["email"]
-  };
-}
-function readCredentials(env) {
-  const path = defaultCredentialsPath(env);
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch (error62) {
-    if (isNotFound(error62)) return {};
-    throw new ConfigError(`cannot read ${path}`, path, { cause: error62 });
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (error62) {
-    throw new ConfigError(`invalid JSON in ${path}`, path, { cause: error62 });
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new ConfigError(`invalid credentials in ${path}: must be a JSON object`, path);
-  }
-  const entries = {};
-  for (const [key, value] of Object.entries(parsed)) {
-    const entry = readEntry(value);
-    if (entry !== void 0) entries[key] = entry;
-  }
-  return entries;
-}
-function findCredential(env, endpoint) {
-  return readCredentials(env)[normalizeEndpoint(endpoint)];
-}
-function writeCredentials(env, entries) {
-  const path = defaultCredentialsPath(env);
-  mkdirSync(dirname2(path), { recursive: true, mode: HOME_MODE });
-  const temp = join2(
-    dirname2(path),
-    `.${CREDENTIALS_FILENAME}.${randomBytes(6).toString("hex")}`
-  );
-  try {
-    writeFileSync(temp, `${JSON.stringify(entries, null, 2)}
-`, {
-      encoding: "utf8",
-      mode: CREDENTIALS_MODE
-    });
-    chmodSync(temp, CREDENTIALS_MODE);
-    renameSync(temp, path);
-  } catch (error62) {
-    rmSync(temp, { force: true });
-    throw error62;
-  }
-}
-function saveCredential(env, credential) {
-  const key = normalizeEndpoint(credential.endpoint);
-  const stored = { ...credential, endpoint: key };
-  writeCredentials(env, { ...readCredentials(env), [key]: stored });
-  return stored;
-}
-function removeCredential(env, endpoint) {
-  const entries = readCredentials(env);
-  const key = normalizeEndpoint(endpoint);
-  if (entries[key] === void 0) return false;
-  delete entries[key];
-  writeCredentials(env, entries);
-  return true;
-}
-
-// src/cognito.ts
-var TARGET_PREFIX = "AWSCognitoIdentityProviderService.";
-var CONTENT_TYPE = "application/x-amz-json-1.1";
-var DEFAULT_EXPIRES_IN = 3600;
-var UNREACHABLE_LINE = "The sign-in service could not be reached.";
-var WRONG_CREDENTIALS_LINE = "Wrong email or password.";
-var TOO_MANY_LINE = "Too many attempts, try again later.";
-var WRONG_CODE_LINE = "Wrong code.";
-var EXPIRED_CODE_LINE = "That code has expired, request a new one.";
-var PASSWORD_POLICY_LINE = "A password needs 12 characters with a lowercase letter, an uppercase letter, a digit and a symbol.";
-var UNREACHABLE_TYPE = "Unreachable";
-var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
-var CognitoError = class extends RemoteError {
-  /** The `__type`, with any prefix up to a `#` dropped, or `Unreachable`. */
-  type;
-  /** Cognito's own `message`, or `undefined` when the answer carried none. */
-  detail;
-  constructor(type, detail2, line, suffix = "") {
-    super(`${line}${suffix}`);
-    this.type = type;
-    this.detail = detail2;
-  }
-};
-function endpointUrl(region) {
-  return `https://cognito-idp.${region}.amazonaws.com/`;
+};
+function endpointUrl(region) {
+  return `https://cognito-idp.${region}.amazonaws.com/`;
 }
 function errorLineOf(type, detail2, signIn2) {
   switch (type) {
@@ -24394,7 +24861,7 @@ function authAnswerOf(body) {
     const shape = result;
     const accessToken = shape["AccessToken"];
     if (typeof accessToken !== "string" || accessToken === "") {
-      throw new RemoteError("the sign-in returned no access token");
+      throw new RemoteError("sign-in didn't return an access token");
     }
     const refreshToken = shape["RefreshToken"];
     const expiresIn = shape["ExpiresIn"];
@@ -24409,7 +24876,7 @@ function authAnswerOf(body) {
   }
   const challengeName = body["ChallengeName"];
   if (typeof challengeName !== "string" || challengeName === "") {
-    throw new RemoteError("the sign-in returned neither tokens nor a challenge");
+    throw new RemoteError("sign-in returned an unexpected response");
   }
   const session = body["Session"];
   const parameters = body["ChallengeParameters"];
@@ -24478,9 +24945,8 @@ function actAsRefused(sub, endpoint) {
 function clockOf(options) {
   return options.now ?? (() => /* @__PURE__ */ new Date());
 }
-var LOCAL_HOSTS = ["localhost", "127.0.0.1"];
 async function fetchAuthConfig(endpoint, options = {}) {
-  const url2 = `${trimSlash(endpoint)}${AUTH_CONFIG_PATH}`;
+  const url2 = `${trimSlash2(endpoint)}${AUTH_CONFIG_PATH}`;
   const site = { method: "GET", url: url2, debug: options.debug };
   const response = await send(url2, { method: "GET", ...options });
   const text = await readText(response, site);
@@ -24496,7 +24962,7 @@ async function fetchAuthConfig(endpoint, options = {}) {
   const webUrl = stringOf(body, "webUrl");
   if (region === void 0 || cliClientId === void 0 || webUrl === void 0) {
     throw new RemoteError(
-      `the API returned an auth config without a region${detail(site, response.status)}`
+      `unexpected response from the API: auth config has no region${detail(site, response.status)}`
     );
   }
   return { mode: "cognito", region, cliClientId, webUrl };
@@ -24509,13 +24975,6 @@ function bearerAuthorizer(token) {
   };
 }
 var DEV_TOKEN = "dev";
-function isLoopback(endpoint) {
-  try {
-    return LOCAL_HOSTS.includes(new URL(endpoint).hostname);
-  } catch {
-    return false;
-  }
-}
 var DevAuthorizer = class {
   actAs;
   #endpoint;
@@ -24601,7 +25060,9 @@ var SessionAuthorizer = class {
       throw error62;
     }
     if (answer2.kind === "challenge") {
-      throw new RemoteError(`the refresh asked for ${answer2.challenge.challengeName}`);
+      throw new RemoteError(
+        `unexpected sign-in step during refresh (${answer2.challenge.challengeName})`
+      );
     }
     const now = clockOf(this.#options)();
     return saveCredential(this.#options.env, {
@@ -24618,12 +25079,97 @@ function createAuthorizer(endpoint, options) {
   return new SessionAuthorizer(endpoint, options);
 }
 
+// src/endpoint.ts
+var DISCOVERY_TIMEOUT_MS = 5e3;
+var SCHEMES = ["http:", "https:"];
+function parseEndpoint(value, from) {
+  const text = value.trim();
+  if (text.toLowerCase() === LOCAL_ENDPOINT) return { kind: "local" };
+  const invalid = new ConfigError(
+    `invalid endpoint "${text}" from ${from}: pass an https URL, a host, or local`
+  );
+  let url2 = text;
+  if (!text.includes("://")) {
+    url2 = isLoopbackUrl(`http://${text}`) ? `http://${text}` : `https://${text}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    throw invalid;
+  }
+  if (!SCHEMES.includes(parsed.protocol) || parsed.hostname === "") throw invalid;
+  return { kind: "url", url: normalizeEndpoint(url2) };
+}
+var discoveries = /* @__PURE__ */ new Map();
+function resetDiscovery() {
+  discoveries.clear();
+}
+function discoverApiUrl(url2, options = {}) {
+  const key = normalizeEndpoint(url2);
+  if (isDefaultEndpoint(key)) return Promise.resolve(DEFAULT_ENDPOINT);
+  const known = discoveries.get(key);
+  if (known !== void 0) return known;
+  const found = lookup(key, options).then((api) => {
+    if (!discoveries.has(api)) discoveries.set(api, Promise.resolve(api));
+    return api;
+  });
+  discoveries.set(key, found);
+  return found;
+}
+async function lookup(url2, options) {
+  const target = `${url2}${DISCOVERY_PATH}`;
+  try {
+    const response = await send(target, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      fetch: options.fetch,
+      debug: options.debug,
+      timeoutMs: options.timeoutMs ?? DISCOVERY_TIMEOUT_MS
+    });
+    const text = await readText(response, { method: "GET", url: target });
+    if (!response.ok) return url2;
+    const api = stringOf(asRecord(parseQuietly(text)), "api");
+    if (api === void 0) return url2;
+    const parsed = new URL(api.trim());
+    if (!SCHEMES.includes(parsed.protocol)) return url2;
+    return normalizeEndpoint(api);
+  } catch {
+    return url2;
+  }
+}
+
 // src/config.ts
-var NO_ENDPOINT_MESSAGE = "no endpoint: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
 function requireEndpoint(context) {
-  if (context.endpoint === void 0) throw new ConfigError(NO_ENDPOINT_MESSAGE);
+  if (context.endpoint === void 0) {
+    throw new ConfigError(`local mode has no endpoint: ${context.localFix ?? ""}`);
+  }
   return context.endpoint;
 }
+async function resolveEndpoint(context, io) {
+  const endpoint = requireEndpoint(context);
+  if (context.discovered) return endpoint;
+  const api = await discoverApiUrl(endpoint, {
+    fetch: io.fetch,
+    debug: context.debug,
+    timeoutMs: context.timeoutMs
+  });
+  context.endpoint = api;
+  context.credential = findCredential(io.env, api);
+  context.discovered = true;
+  return api;
+}
+function foreignOrgMessage(context) {
+  const slug = context.slug;
+  if (context.mode !== "local" || slug === void 0 || slug === LOCAL_ORG) {
+    return void 0;
+  }
+  return `local mode holds the organization ${LOCAL_ORG} only, not ${slug}: ${context.localFix ?? ""} to file to ${slug} on a server, or pass --org ${LOCAL_ORG}`;
+}
+function refuseForeignOrg(context) {
+  const message = foreignOrgMessage(context);
+  if (message !== void 0) throw new ConfigError(message);
+}
 var NO_ORG_MESSAGE = "no organization: pass --org <slug> or run `quibble init --org <slug>`";
 function requireOrg(context) {
   if (context.org === void 0) throw new ConfigError(NO_ORG_MESSAGE);
@@ -24747,32 +25293,91 @@ function firstValue(...values) {
   }
   return void 0;
 }
+function localFixOf(candidate) {
+  switch (candidate.source) {
+    case "--endpoint":
+      return "drop --endpoint local";
+    case "QUIBBLE_ENDPOINT":
+      return "unset QUIBBLE_ENDPOINT";
+    default:
+      return `remove "endpoint": "local" from ${candidate.path ?? ""}`;
+  }
+}
+function resolveEndpointSource(options, project, user) {
+  if (options.local === true) {
+    return {
+      mode: "local",
+      endpoint: void 0,
+      endpointSource: "--local",
+      localFix: "drop --local"
+    };
+  }
+  const candidates2 = [
+    { source: "--endpoint", value: options.endpoint },
+    { source: "QUIBBLE_ENDPOINT", value: options.env["QUIBBLE_ENDPOINT"] },
+    { source: ".quibblerc", value: project?.endpoint, path: project?.path },
+    {
+      source: "config.json",
+      value: user.endpoint,
+      path: defaultConfigPath(options.env)
+    }
+  ];
+  const chosen = candidates2.find(
+    (candidate) => candidate.value !== void 0 && candidate.value.trim() !== ""
+  );
+  if (chosen === void 0) {
+    return {
+      mode: "remote",
+      endpoint: DEFAULT_ENDPOINT,
+      endpointSource: "default",
+      localFix: void 0
+    };
+  }
+  const value = parseEndpoint(chosen.value ?? "", chosen.path ?? chosen.source);
+  if (value.kind === "local") {
+    return {
+      mode: "local",
+      endpoint: void 0,
+      endpointSource: chosen.source,
+      localFix: localFixOf(chosen)
+    };
+  }
+  return {
+    mode: "remote",
+    endpoint: value.url,
+    endpointSource: chosen.source,
+    localFix: void 0
+  };
+}
 function resolveContext(options) {
   const project = findProjectConfig(options.cwd);
   const user = loadUserConfig(options.env);
-  const endpoint = firstValue(
-    options.endpoint,
-    options.env["QUIBBLE_ENDPOINT"],
-    project?.endpoint,
-    user.endpoint
+  const { mode, endpoint, endpointSource, localFix } = resolveEndpointSource(
+    options,
+    project,
+    user
   );
-  const name = firstValue(options.project, project?.project);
-  const given = firstValue(options.org, project?.org);
-  const slug = given === void 0 ? void 0 : parseOrgSlug(given);
+  const given = firstValue(options.project, project?.project);
+  const name = given === void 0 ? void 0 : foldProjectName(given);
+  const org = firstValue(options.org, project?.org);
+  const slug = org === void 0 ? void 0 : parseOrgSlug(org);
   const token = firstValue(options.env[TOKEN_ENV]);
-  const mode = options.local === true || endpoint === void 0 ? "local" : "remote";
+  const discovered = endpoint !== void 0 && isDefaultEndpoint(endpoint);
   return {
     project: name,
     org: mode === "local" ? LOCAL_ORG : slug,
+    slug,
     projectRoot: project?.root,
     configPath: project?.path,
     cwd: project === void 0 ? void 0 : relativeCwd(project.root, options.cwd),
     mode,
     endpoint,
+    endpointSource,
+    localFix,
+    discovered,
+    timeoutMs: void 0,
     token,
-    // `quibble config` diagnoses a missing session, so the entry is read here
-    // and no command has to read the file to describe the session.
-    credential: endpoint === void 0 ? void 0 : findCredential(options.env, endpoint),
+    credential: discovered && endpoint !== void 0 ? findCredential(options.env, endpoint) : void 0,
     actAs: firstValue(options.env[ACT_AS_ENV]),
     debug: debugEnabled(options.env),
     agent: firstValue(options.agent, user.agent) ?? DEFAULT_AGENT,
@@ -24785,6 +25390,88 @@ function resolveContext(options) {
     projectConfig: project
   };
 }
+function rememberEndpoint(env, endpoint) {
+  const path = defaultConfigPath(env);
+  const raw = readJsonFile(path) ?? {};
+  if (stringField(raw, "endpoint", path) !== void 0) return void 0;
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({ ...raw, endpoint }, null, 2)}
+`, "utf8");
+  return path;
+}
+
+// src/ids.ts
+var FULL_ID_LENGTH = 36;
+var SHORT_ID_MIN = 6;
+var CANDIDATES_SHOWN = 5;
+var SHORT_ID_RE = /^[0-9a-f-]+$/;
+function readIdValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === FULL_ID_LENGTH) return { id: trimmed, prefix: false };
+  const lower = trimmed.toLowerCase();
+  if (!SHORT_ID_RE.test(lower)) throw new UsageError(`${value} is not an id`);
+  if (lower.length < SHORT_ID_MIN) {
+    throw new UsageError(
+      `${value} is too short: pass at least ${SHORT_ID_MIN} characters of the id`
+    );
+  }
+  return { id: lower, prefix: true };
+}
+function ambiguousError(prefix, ids, noun) {
+  const shown = ids.slice(0, CANDIDATES_SHOWN).join(", ");
+  const more = ids.length > CANDIDATES_SHOWN ? ` and ${ids.length - CANDIDATES_SHOWN} more` : "";
+  return new UsageError(`${prefix} matches ${ids.length} ${noun}: ${shown}${more}`, {
+    code: AMBIGUOUS_ID
+  });
+}
+async function candidates(source) {
+  const org = requireOrg(source.context);
+  const ids = [];
+  if (source.local !== void 0) {
+    for (const status of [void 0, "deleted"]) {
+      const filter = { org, ...status === void 0 ? {} : { status } };
+      for await (const complaint of scanComplaints(source.local, filter)) {
+        ids.push(complaint.id);
+      }
+    }
+    return ids;
+  }
+  const project = source.context.projectConfig?.project;
+  for (const status of [void 0, "deleted"]) {
+    const filter = {
+      org,
+      limit: MAX_LIMIT,
+      ...project === void 0 ? {} : { project },
+      ...status === void 0 ? {} : { status }
+    };
+    for (const complaint of await listComplaints(source.store, filter)) {
+      ids.push(complaint.id);
+    }
+  }
+  return ids;
+}
+async function resolveIds(values, source) {
+  const read = values.map((value) => readIdValue(value));
+  let pool;
+  const resolved = [];
+  for (const value of read) {
+    if (!value.prefix) {
+      resolved.push(value.id);
+      continue;
+    }
+    pool ??= candidates(source);
+    const matches = [...new Set((await pool).filter((id) => id.startsWith(value.id)))];
+    if (matches.length === 1) {
+      resolved.push(matches[0]);
+      continue;
+    }
+    if (matches.length > 1) throw ambiguousError(value.id, matches, "complaints");
+    throw new NotFoundError(
+      source.local === void 0 ? `no complaint among the newest ${MAX_LIMIT} starts with ${value.id}: pass the full id` : `no complaint starts with ${value.id}`
+    );
+  }
+  return resolved;
+}
 
 // src/io.ts
 async function readStdin(stream) {
@@ -24803,9 +25490,10 @@ function writeJson(stream, value) {
 }
 
 // src/client.ts
-var NOT_A_COMPLAINT = "the API returned a body that is not a complaint";
+import { randomUUID as randomUUID2 } from "node:crypto";
+var NOT_A_COMPLAINT = "unexpected response from the API: expected a complaint";
 var ORG_NOT_FOUND = "org_not_found";
-var NOT_A_PROMOTION = "the API returned a body that is not a tag promotion";
+var NOT_A_PROMOTION = "unexpected response from the API: expected a tag promotion";
 function readRoles(value) {
   if (!Array.isArray(value)) return [];
   const roles = [];
@@ -24838,7 +25526,7 @@ function parseMe(body) {
   const record2 = asRecord(body);
   const reporter = stringOf(record2, "reporter");
   if (record2 === void 0 || reporter === void 0) {
-    throw new RemoteError("the API returned an identity without a reporter");
+    throw new RemoteError("unexpected response from the API: identity has no reporter");
   }
   return {
     kind: stringOf(record2, "kind") ?? "user",
@@ -24857,7 +25545,7 @@ function parseMe(body) {
 function parseOrgAnswer(body, slug) {
   const record2 = asRecord(body);
   if (record2 === void 0) {
-    throw new RemoteError("the API returned a body that is not an organization");
+    throw new RemoteError("unexpected response from the API: expected an organization");
   }
   return {
     org: stringOf(record2, "org") ?? slug,
@@ -24867,6 +25555,35 @@ function parseOrgAnswer(body, slug) {
     body: record2
   };
 }
+function readToken(value) {
+  const record2 = asRecord(value);
+  const id = stringOf(record2, "id");
+  const name = stringOf(record2, "name");
+  const createdAt = stringOf(record2, "createdAt");
+  if (id === void 0 || name === void 0 || createdAt === void 0) {
+    throw new RemoteError("unexpected response from the API: expected a token");
+  }
+  return {
+    id,
+    name,
+    createdAt,
+    expiresAt: stringOf(record2, "expiresAt"),
+    lastUsedAt: stringOf(record2, "lastUsedAt"),
+    revokedAt: stringOf(record2, "revokedAt")
+  };
+}
+function readProject(body, name) {
+  const record2 = asRecord(body);
+  if (record2 === void 0) {
+    throw new RemoteError("unexpected response from the API: expected a project");
+  }
+  const tags = record2["tags"];
+  return {
+    project: stringOf(record2, "project") ?? name,
+    tags: Array.isArray(tags) ? tags.map((tag) => String(tag)) : void 0,
+    body: record2
+  };
+}
 function readComplaint(body) {
   try {
     return parseComplaint(body);
@@ -24881,24 +25598,37 @@ var ApiClient = class {
   #base;
   #auth;
   #http;
+  #beforeFirst;
   constructor(options) {
     this.endpoint = options.endpoint;
     this.org = options.org;
-    this.#base = trimSlash(options.endpoint);
+    this.#base = trimSlash2(options.endpoint);
     this.#auth = options.authorizer;
+    this.#beforeFirst = options.beforeFirst;
     this.#http = {
       fetch: options.fetch,
       timeoutMs: options.timeoutMs,
       debug: options.debug
     };
   }
-  /** Sends one request and returns its body. A non-2xx answer is an error. */
-  async request(method, path, body) {
-    return this.#call(method, path, body, false);
+  /**
+   * Sends one request and returns its body. A non-2xx answer is an error.
+   * `headers` are sent beside the auth headers, such as the idempotency key
+   * of a filing.
+   */
+  async request(method, path, body, headers) {
+    return (await this.#call(method, path, body, false, headers)).body;
+  }
+  /**
+   * The same, and the headers of the answer, which carry what the body does
+   * not, such as the truncation mark of a list.
+   */
+  async requestWithHeaders(method, path) {
+    return this.#call(method, path, void 0, false);
   }
   /** The same, except that a `404` answers `undefined` instead of failing. */
   async requestOptional(method, path, body) {
-    return this.#call(method, path, body, true);
+    return (await this.#call(method, path, body, true)).body;
   }
   /**
    * The prefix of every org-scoped path. Every command that reaches one
@@ -24917,7 +25647,9 @@ var ApiClient = class {
   async orgs() {
     const body = asRecord(await this.request("GET", "/v1/orgs"));
     if (body === void 0) {
-      throw new RemoteError("the API returned a body that is not an organization list");
+      throw new RemoteError(
+        "unexpected response from the API: expected an organization list"
+      );
     }
     return { orgs: readOrgs(body["orgs"]), body };
   }
@@ -24926,16 +25658,62 @@ var ApiClient = class {
     const slug = this.org ?? "";
     return parseOrgAnswer(await this.request("GET", this.orgPath()), slug);
   }
+  /** The path of one project of the organization. */
+  projectPath(name) {
+    return `${this.orgPath()}/projects/${encodeURIComponent(name)}`;
+  }
   /** Reads the project record, which owns the allowed tag list in remote mode. */
   async project(name) {
-    const body = asRecord(
-      await this.request("GET", `${this.orgPath()}/projects/${encodeURIComponent(name)}`)
+    return readProject(await this.request("GET", this.projectPath(name)), name);
+  }
+  /**
+   * Replaces the allowed tag list of a project, or clears it with `null`. The
+   * route retags the stored complaints and answers how many it rewrote.
+   */
+  async setProjectTags(name, tags) {
+    const body = await this.request(
+      "PATCH",
+      this.projectPath(name),
+      JSON.stringify({ tags })
+    );
+    const answer2 = readProject(body, name);
+    const retagged = answer2.body["retagged"];
+    return { ...answer2, retagged: typeof retagged === "number" ? retagged : 0 };
+  }
+  /**
+   * Soft-deletes a project (section 7.5). The route hides it and its
+   * complaints everywhere and revokes its tokens, and answers `204`.
+   */
+  async deleteProject(name) {
+    await this.request("DELETE", this.projectPath(name));
+  }
+  /** Lists the tokens of a project, newest first, as the route sorts them. */
+  async tokens(project) {
+    const body = await this.request("GET", `${this.projectPath(project)}/tokens`);
+    if (!Array.isArray(body)) {
+      throw new RemoteError("unexpected response from the API: expected a token list");
+    }
+    return { tokens: body.map((entry) => readToken(entry)), body };
+  }
+  /** Mints a token. The answer carries the plaintext, once. */
+  async createToken(project, input2) {
+    const body = await this.request(
+      "POST",
+      `${this.projectPath(project)}/tokens`,
+      JSON.stringify(input2)
+    );
+    const plaintext = stringOf(asRecord(body), "plaintext");
+    if (plaintext === void 0) {
+      throw new RemoteError("unexpected response from the API: token has no plaintext");
+    }
+    return { token: readToken(body), plaintext, body };
+  }
+  /** Revokes one token. A repeat answers `204` again. */
+  async revokeToken(project, id) {
+    await this.request(
+      "DELETE",
+      `${this.projectPath(project)}/tokens/${encodeURIComponent(id)}`
     );
-    const tags = body?.["tags"];
-    return {
-      project: stringOf(body, "project") ?? name,
-      tags: Array.isArray(tags) ? tags.map((tag) => String(tag)) : void 0
-    };
   }
   /**
    * Promotes one suggestion to a real tag. The route needs `maintainer`, so a
@@ -24956,15 +25734,36 @@ var ApiClient = class {
     }
     return { tags: tags.map((entry) => String(entry)), retagged };
   }
-  async #call(method, path, body, notFoundIsUndefined) {
+  /**
+   * Sends one request with the auth rules of section 5.7 and returns the
+   * answer whatever its status. It never runs `beforeFirst`, so the offline
+   * queue sends through it. A request that gets no answer still throws.
+   */
+  async exchange(method, path, body, headers) {
+    const { response, text } = await this.#exchange(method, path, body, headers);
+    return { status: response.status, text };
+  }
+  async #call(method, path, body, notFoundIsUndefined, headers) {
+    const first = this.#beforeFirst;
+    this.#beforeFirst = void 0;
+    if (first !== void 0) await first(this);
+    const { response, text, site } = await this.#exchange(method, path, body, headers);
+    if (response.status === 404 && notFoundIsUndefined && serverCode(text) !== ORG_NOT_FOUND) {
+      return { body: void 0, headers: response.headers };
+    }
+    if (!response.ok) throw remoteFailure(site, response, text);
+    if (response.status === 204) return { body: void 0, headers: response.headers };
+    return { body: parseJson(text, site, response.status), headers: response.headers };
+  }
+  async #exchange(method, path, body, extra) {
     const url2 = `${this.#base}${path}`;
     const site = { method, url: url2, debug: this.#http.debug };
-    let response = await this.#send(url2, method, await this.#auth.token(), body);
+    let response = await this.#send(url2, method, await this.#auth.token(), body, extra);
     if (response.status === 401) {
       const fresh = await this.#auth.retry();
       if (fresh !== void 0) {
         await readText(response, site);
-        response = await this.#send(url2, method, fresh, body);
+        response = await this.#send(url2, method, fresh, body, extra);
         if (response.status === 401) throw sessionExpired(this.endpoint);
       } else if (this.#auth.actAs !== void 0) {
         await readText(response, site);
@@ -24972,14 +25771,13 @@ var ApiClient = class {
       }
     }
     const text = await readText(response, site);
-    if (response.status === 404 && notFoundIsUndefined && serverCode(text) !== ORG_NOT_FOUND) {
-      return void 0;
-    }
-    if (!response.ok) throw remoteFailure(site, response, text);
-    return parseJson(text, site, response.status);
+    return { response, text, site };
   }
-  #send(url2, method, bearer, body) {
-    const headers = { authorization: `Bearer ${bearer}` };
+  #send(url2, method, bearer, body, extra = {}) {
+    const headers = {
+      ...extra,
+      authorization: `Bearer ${bearer}`
+    };
     const actAs = this.#auth.actAs;
     if (actAs !== void 0) headers[ACT_AS_HEADER] = actAs;
     if (body !== void 0) headers["content-type"] = "application/json";
@@ -24991,6 +25789,67 @@ var ApiClient = class {
     });
   }
 };
+var UndeliveredError = class extends RemoteError {
+  body;
+  reason;
+  /**
+   * The idempotency key the request carried, which the queued entry keeps,
+   * so a request that did reach the server files nothing new when it is sent
+   * again.
+   */
+  key;
+  constructor(body, reason, key, cause) {
+    super(cause.message, { cause, status: cause.status, unanswered: cause.unanswered });
+    this.body = body;
+    this.reason = reason;
+    this.key = key;
+  }
+};
+function retryableReason(error62) {
+  if (!(error62 instanceof RemoteError)) return void 0;
+  if (error62.unanswered) return "the API is unreachable";
+  const status = error62.status;
+  if (status === void 0) return void 0;
+  if (status === 429) return error62.serverMessage ?? `the API answered ${status}`;
+  if (status >= 500) return `the API answered ${status}`;
+  return void 0;
+}
+function complaintBody(complaint) {
+  return {
+    project: complaint.project,
+    message: complaint.message,
+    severity: complaint.severity,
+    tags: complaint.tags,
+    agent: complaint.agent,
+    ...complaint.cwd === void 0 ? {} : { cwd: complaint.cwd },
+    ...complaint.cmd === void 0 ? {} : { cmd: complaint.cmd }
+  };
+}
+function readBulkResults(body) {
+  const results = asRecord(body)?.["results"];
+  if (!Array.isArray(results)) {
+    throw new RemoteError("unexpected response from the API: expected bulk results");
+  }
+  return results.map((entry) => {
+    const record2 = asRecord(entry);
+    const id = stringOf(record2, "id");
+    if (record2 === void 0 || id === void 0) {
+      throw new RemoteError("unexpected response from the API: expected a bulk result");
+    }
+    if (record2["ok"] === true) {
+      return { id, ok: true, complaint: readComplaint(record2["complaint"]) };
+    }
+    const error62 = asRecord(record2["error"]);
+    return {
+      id,
+      ok: false,
+      error: {
+        code: stringOf(error62, "code") ?? "error",
+        message: stringOf(error62, "message") ?? "the change failed"
+      }
+    };
+  });
+}
 function adopt(target, source) {
   for (const key of Object.keys(target)) {
     delete target[key];
@@ -25007,39 +25866,55 @@ var RemoteStore = class {
     return `${this.#client.orgPath()}/complaints${suffix}`;
   }
   /**
-   * Posts the complaint. The API assigns the stored `id` and `createdAt`, so
-   * the validated record of the response replaces the record passed in.
+   * Posts the complaint. The API assigns the stored `id`, `createdAt`,
+   * `fingerprint` and `recurred`, so the validated record of the response
+   * replaces the record passed in, and the answer's match is returned.
    */
   async create(complaint) {
-    const {
-      id: _id,
-      createdAt: _createdAt,
-      org: _org,
-      reporter: _reporter,
-      reporterName: _reporterName,
-      ...input2
-    } = complaint;
-    const body = await this.#client.request("POST", this.#path(), JSON.stringify(input2));
+    const input2 = complaintBody(complaint);
+    const key = randomUUID2();
+    let body;
+    try {
+      body = await this.#client.request("POST", this.#path(), JSON.stringify(input2), {
+        [IDEMPOTENCY_HEADER]: key
+      });
+    } catch (error62) {
+      const reason = retryableReason(error62);
+      if (reason !== void 0 && error62 instanceof RemoteError) {
+        throw new UndeliveredError(input2, reason, key, error62);
+      }
+      throw error62;
+    }
     adopt(complaint, readComplaint(body));
+    const answer2 = asRecord(body);
+    const openMatches = answer2?.["openMatches"];
+    return {
+      open: typeof openMatches === "number" ? openMatches : 0,
+      resolved: answer2?.["recurred"] === true
+    };
   }
   /** Returns the matching complaints, newest first. */
   async list(filter) {
-    const query = new URLSearchParams();
-    if (filter.project !== void 0) query.set("project", filter.project);
-    if (filter.severity !== void 0) query.set("severity", filter.severity);
-    if (filter.status !== void 0) query.set("status", filter.status);
-    if (filter.tag !== void 0) query.set("tag", filter.tag);
-    if (filter.reporter !== void 0) query.set("reporter", filter.reporter);
-    if (filter.since !== void 0) query.set("since", filter.since);
-    if (filter.until !== void 0) query.set("until", filter.until);
-    if (filter.limit !== void 0) query.set("limit", String(filter.limit));
-    const search = query.toString();
+    return (await this.listPage(filter)).complaints;
+  }
+  /**
+   * Returns the matching complaints, newest first, and whether the server
+   * stopped at its read budget, which the answer marks with a header.
+   */
+  async listPage(filter) {
+    const search = new URLSearchParams(listQueryOf(filter)).toString();
     const suffix = search === "" ? "" : `?${search}`;
-    const body = await this.#client.request("GET", this.#path(suffix));
+    const { body, headers } = await this.#client.requestWithHeaders(
+      "GET",
+      this.#path(suffix)
+    );
     if (!Array.isArray(body)) {
-      throw new RemoteError("the API returned a body that is not an array");
+      throw new RemoteError("unexpected response from the API: expected a list");
     }
-    return body.map((item) => readComplaint(item));
+    return {
+      complaints: body.map((item) => readComplaint(item)),
+      truncated: headers.get(TRUNCATED_HEADER) === "1"
+    };
   }
   /** Returns the complaint with that id, or `undefined` when the API says 404. */
   async get(id) {
@@ -25059,11 +25934,26 @@ var RemoteStore = class {
       this.#path(`/${encodeURIComponent(id)}`),
       JSON.stringify({
         status: change.status,
-        ...change.resolution === void 0 ? {} : { resolution: change.resolution }
+        ...change.resolution === void 0 ? {} : { resolution: change.resolution },
+        ...change.reason === void 0 ? {} : { reason: change.reason },
+        ...change.duplicateOf === void 0 ? {} : { duplicateOf: change.duplicateOf }
       })
     );
     return body === void 0 ? void 0 : readComplaint(body);
   }
+  /**
+   * Applies one status change to many complaints with the bulk route, in one
+   * request. A per-id `not_found` reads as an absent record, exactly like the
+   * `404` of one id, so its result carries no complaint and the code.
+   */
+  async bulkStatus(ids, change) {
+    const body = await this.#client.request(
+      "POST",
+      this.#path("/bulk"),
+      JSON.stringify({ ids, ...change })
+    );
+    return readBulkResults(body);
+  }
   /**
    * Replaces the tags. The API stamps the change with its own time, so the
    * request carries the list only.
@@ -25078,7 +25968,375 @@ var RemoteStore = class {
   }
 };
 
+// src/queue.ts
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
+import {
+  appendFileSync,
+  closeSync,
+  fstatSync,
+  linkSync,
+  mkdirSync as mkdirSync3,
+  openSync,
+  readFileSync as readFileSync3,
+  readSync,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeSync
+} from "node:fs";
+import { hostname as hostname3 } from "node:os";
+import { dirname as dirname4, join as join4 } from "node:path";
+
+// src/text.ts
+var CONTROL_RE2 = /[\u0000-\u001F\u007F-\u009F]/g;
+function escape(char) {
+  return `\\x${(char.codePointAt(0) ?? 0).toString(16).padStart(2, "0")}`;
+}
+function printable(text) {
+  return text.replace(/\s+/g, " ").replace(CONTROL_RE2, escape);
+}
+function printableLines(text) {
+  return text.replace(/\r\n?/g, "\n").replace(
+    CONTROL_RE2,
+    (char) => char === "\n" || char === "	" ? char : escape(char)
+  );
+}
+
+// src/queue.ts
+var QUEUE_FILENAME = "unsent.jsonl";
+var LOCK_FILENAME = "unsent.lock";
+var LOCK_STALE_MS = 5 * 6e4;
+var QUEUE_MODE = CREDENTIALS_MODE;
+function queuePath(env) {
+  return join4(defaultQuibbleHome(env), QUEUE_FILENAME);
+}
+function lockPathOf(queue) {
+  return join4(dirname4(queue), LOCK_FILENAME);
+}
+function authLabel(context) {
+  if (context.token !== void 0) {
+    const hash2 = createHash2("sha256").update(context.token).digest("hex");
+    return `token:${hash2.slice(0, 16)}`;
+  }
+  if (context.credential !== void 0) return `session:${context.credential.sub}`;
+  return `dev:${context.actAs ?? ""}`;
+}
+function readOptional(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return "";
+    throw new StorageError(`cannot read ${path}`, { cause: error62 });
+  }
+}
+function endsInsideLine(path) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch (error62) {
+    if (isNotFound(error62)) return false;
+    throw error62;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0) return false;
+    const last = Buffer.alloc(1);
+    readSync(fd, last, 0, 1, size - 1);
+    return last[0] !== 10;
+  } finally {
+    closeSync(fd);
+  }
+}
+function appendLine(path, value) {
+  try {
+    mkdirSync3(dirname4(path), { recursive: true, mode: HOME_MODE });
+    const lead = endsInsideLine(path) ? "\n" : "";
+    appendFileSync(path, `${lead}${JSON.stringify(value)}
+`, {
+      encoding: "utf8",
+      mode: QUEUE_MODE
+    });
+  } catch (error62) {
+    throw new StorageError(`cannot write ${path}`, { cause: error62 });
+  }
+}
+function badLine(path, line, why) {
+  return new StorageError(`${path}: line ${line}: ${why}`);
+}
+function readQueuedLine(record2, path, line) {
+  const body = asRecord(record2["body"]);
+  const fields = ["key", "endpoint", "org", "auth", "queuedAt"];
+  for (const field of fields) {
+    if (typeof record2[field] !== "string") {
+      throw badLine(path, line, `${field} must be a string`);
+    }
+  }
+  if (body === void 0) throw badLine(path, line, "body must be an object");
+  return {
+    key: record2["key"],
+    endpoint: record2["endpoint"],
+    org: record2["org"],
+    auth: record2["auth"],
+    body,
+    queuedAt: record2["queuedAt"]
+  };
+}
+function readQueue(path) {
+  const pending = /* @__PURE__ */ new Map();
+  const known = /* @__PURE__ */ new Set();
+  const lines = readOptional(path).split("\n");
+  for (const [index, text] of lines.entries()) {
+    const line = index + 1;
+    if (text.trim() === "") continue;
+    let record2;
+    try {
+      record2 = asRecord(JSON.parse(text));
+    } catch {
+      throw badLine(path, line, "not JSON");
+    }
+    if (record2 === void 0) throw badLine(path, line, "not a JSON object");
+    const op = record2["op"];
+    if (op === "queued") {
+      const entry = readQueuedLine(record2, path, line);
+      known.add(entry.key);
+      pending.set(entry.key, entry);
+      continue;
+    }
+    if (op === "sent" || op === "dropped") {
+      const key = record2["key"];
+      if (typeof key !== "string" || !known.has(key)) {
+        throw badLine(path, line, `${op} names no queued complaint`);
+      }
+      pending.delete(key);
+      continue;
+    }
+    throw badLine(path, line, `unknown op ${JSON.stringify(op)}`);
+  }
+  return [...pending.values()];
+}
+function pendingFor(path, endpoint) {
+  const key = normalizeEndpoint(endpoint);
+  return readQueue(path).filter((entry) => entry.endpoint === key);
+}
+function enqueue(path, input2, now = /* @__PURE__ */ new Date()) {
+  const entry = {
+    key: input2.key ?? randomUUID3(),
+    endpoint: normalizeEndpoint(input2.endpoint),
+    org: input2.org,
+    auth: input2.auth,
+    body: input2.body,
+    queuedAt: now.toISOString()
+  };
+  appendLine(path, { op: "queued", ...entry });
+  return entry;
+}
+function processRuns(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error62) {
+    return error62.code === "EPERM";
+  }
+}
+function judgeLock(lock, now = /* @__PURE__ */ new Date()) {
+  let text;
+  try {
+    text = readFileSync3(lock, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw new StorageError(`cannot read ${lock}`, { cause: error62 });
+  }
+  const record2 = asRecord(parseQuietly(text));
+  const pid = record2?.["pid"];
+  const host = stringOf(record2, "host");
+  const at = Date.parse(stringOf(record2, "at") ?? "");
+  if (typeof pid !== "number" || host === void 0 || Number.isNaN(at)) {
+    let written;
+    try {
+      written = statSync(lock).mtimeMs;
+    } catch (error62) {
+      if (isNotFound(error62)) return void 0;
+      throw new StorageError(`cannot read ${lock}`, { cause: error62 });
+    }
+    return { text, stale: now.getTime() - written > LOCK_STALE_MS };
+  }
+  const dead = host === hostname3() && !processRuns(pid);
+  return { text, stale: dead || now.getTime() - at > LOCK_STALE_MS };
+}
+function createLock(lock, owner = { pid: process.pid, host: hostname3(), at: (/* @__PURE__ */ new Date()).toISOString() }) {
+  const text = JSON.stringify(owner);
+  let fd;
+  try {
+    mkdirSync3(dirname4(lock), { recursive: true, mode: HOME_MODE });
+    fd = openSync(lock, "wx", QUEUE_MODE);
+  } catch (error62) {
+    if (error62.code === "EEXIST") return void 0;
+    throw new StorageError(`cannot create ${lock}`, { cause: error62 });
+  }
+  try {
+    writeSync(fd, text);
+  } finally {
+    closeSync(fd);
+  }
+  return text;
+}
+function takeOverLock(lock, judged, owner) {
+  const moved = `${lock}.${process.pid}.${randomBytes2(6).toString("hex")}`;
+  try {
+    renameSync2(lock, moved);
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw new StorageError(`cannot move ${lock}`, { cause: error62 });
+  }
+  const text = readOptional(moved);
+  if (text === judged.text) {
+    rmSync2(moved, { force: true });
+    return createLock(lock, owner);
+  }
+  try {
+    linkSync(moved, lock);
+  } catch (error62) {
+    if (error62.code !== "EEXIST") {
+      throw new StorageError(`cannot restore ${lock}`, { cause: error62 });
+    }
+  } finally {
+    rmSync2(moved, { force: true });
+  }
+  return void 0;
+}
+function acquireLock(lock) {
+  const created = createLock(lock);
+  if (created !== void 0) return created;
+  const judged = judgeLock(lock);
+  if (judged === void 0) return createLock(lock);
+  if (!judged.stale) return void 0;
+  return takeOverLock(lock, judged);
+}
+function releaseLock(lock, text) {
+  if (readOptional(lock) === text) rmSync2(lock, { force: true });
+}
+function stopReason(status, text) {
+  if (status >= 500) return `the API answered ${status}`;
+  const code2 = serverCode(text);
+  const stops = status === 429 || status === 401 || status === 403 || status === 404 && code2 === ORG_NOT_FOUND;
+  if (!stops) return void 0;
+  const message = stringOf(asRecord(asRecord(parseQuietly(text))?.["error"]), "message");
+  return message ?? `the API answered ${status}`;
+}
+function projectOf(entry) {
+  const project = entry.body["project"];
+  return typeof project === "string" ? project : "?";
+}
+function headlineOfEntry(entry) {
+  const message = entry.body["message"];
+  return typeof message === "string" ? printable(summarize(message)) : "?";
+}
+function queuedCount(n) {
+  return `${n} queued ${n === 1 ? "complaint" : "complaints"}`;
+}
+async function flushQueue(options) {
+  const endpoint = normalizeEndpoint(options.endpoint);
+  const mine = () => readQueue(options.path).filter(
+    (entry) => entry.endpoint === endpoint && entry.auth === options.auth
+  );
+  const result = {
+    sent: [],
+    dropped: 0,
+    left: 0,
+    locked: false,
+    stopped: void 0
+  };
+  if (mine().length === 0) return result;
+  const lock = lockPathOf(options.path);
+  const held = acquireLock(lock);
+  if (held === void 0) {
+    return { ...result, locked: true, left: mine().length };
+  }
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  try {
+    const entries = mine();
+    for (const [index, entry] of entries.entries()) {
+      let status;
+      let text;
+      try {
+        ({ status, text } = await options.client.exchange(
+          "POST",
+          `/v1/orgs/${encodeURIComponent(entry.org)}/complaints`,
+          JSON.stringify(entry.body),
+          { [IDEMPOTENCY_HEADER]: entry.key }
+        ));
+      } catch (error62) {
+        result.stopped = errorMessage(error62);
+        result.left = entries.length - index;
+        return result;
+      }
+      if (status >= 200 && status < 300) {
+        const id = stringOf(asRecord(parseQuietly(text)), "id") ?? "";
+        appendLine(options.path, {
+          op: "sent",
+          key: entry.key,
+          id,
+          sentAt: now().toISOString()
+        });
+        result.sent.push(id);
+        continue;
+      }
+      const reason = stopReason(status, text);
+      if (reason !== void 0) {
+        result.stopped = reason;
+        result.left = entries.length - index;
+        return result;
+      }
+      const record2 = asRecord(asRecord(parseQuietly(text))?.["error"]);
+      const code2 = stringOf(record2, "code") ?? `http_${status}`;
+      const message = stringOf(record2, "message") ?? `the API answered ${status}`;
+      appendLine(options.path, {
+        op: "dropped",
+        key: entry.key,
+        code: code2,
+        message,
+        droppedAt: now().toISOString()
+      });
+      result.dropped += 1;
+      writeLine(
+        options.stderr,
+        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, "${headlineOfEntry(entry)}": ${printable(message)}`
+      );
+    }
+    return result;
+  } finally {
+    releaseLock(lock, held);
+  }
+}
+
 // src/store.ts
+function queueSender(context, endpoint, io) {
+  return async (client) => {
+    let result;
+    try {
+      result = await flushQueue({
+        path: queuePath(io.env),
+        endpoint,
+        auth: authLabel(context),
+        client,
+        stderr: io.stderr
+      });
+    } catch (error62) {
+      if (!(error62 instanceof StorageError)) throw error62;
+      writeLine(
+        io.stderr,
+        `quibble: warning: cannot send the queue: ${errorMessage(error62)}`
+      );
+      return;
+    }
+    if (result.stopped !== void 0) {
+      writeLine(
+        io.stderr,
+        `quibble: ${queuedCount(result.left)} still unsent: ${result.stopped}`
+      );
+    }
+  };
+}
 function actAsProblem(context) {
   if (context.actAs === void 0) return void 0;
   const endpoint = context.endpoint;
@@ -25087,22 +26345,25 @@ function actAsProblem(context) {
   }
   if (context.token !== void 0) return "QUIBBLE_TOKEN is set";
   if (context.credential !== void 0) {
-    return `a stored session for ${endpoint} is used`;
+    return `you are logged in to ${endpoint}`;
   }
-  if (!isLoopback(endpoint)) return `${endpoint} is not a loopback endpoint`;
+  if (!isLoopbackUrl(endpoint)) return `${endpoint} is not a loopback endpoint`;
   return void 0;
 }
 function checkActAs(context) {
   const problem = actAsProblem(context);
   if (problem !== void 0) throw actAsNotApplicable(problem);
 }
-function openClient(context, io) {
+async function openClient(context, io, options = {}) {
+  const endpoint = await resolveEndpoint(context, io);
   checkActAs(context);
-  const endpoint = requireEndpoint(context);
-  const http = { debug: context.debug, fetch: io.fetch };
-  const org = context.org === void 0 ? {} : { org: context.org };
+  const http = { debug: context.debug, fetch: io.fetch, timeoutMs: context.timeoutMs };
+  const org = {
+    ...context.org === void 0 ? {} : { org: context.org },
+    ...options.queue === false ? {} : { beforeFirst: queueSender(context, endpoint, io) }
+  };
   if (context.token === void 0 && context.credential === void 0) {
-    if (!isLoopback(endpoint)) throw notLoggedIn(endpoint);
+    if (!isLoopbackUrl(endpoint)) throw notLoggedIn(endpoint);
     return new ApiClient({
       endpoint,
       authorizer: devAuthorizer(endpoint, context.actAs, http),
@@ -25117,25 +26378,35 @@ function openClient(context, io) {
     ...http
   });
 }
-function openOrgClient(context, io) {
-  checkActAs(context);
+async function openOrgClient(context, io, options = {}) {
+  if (context.mode === "local") checkActAs(context);
   requireOrg(context);
-  return openClient(context, io);
+  return openClient(context, io, options);
 }
-function openBackend(context, io) {
+async function openBackend(context, io) {
   if (context.mode === "local") {
     checkActAs(context);
-    return { store: new FileStore(context.storePath), client: void 0 };
+    refuseForeignOrg(context);
+    const local = new FileStore(context.storePath);
+    return { store: local, client: void 0, local };
   }
-  const client = openOrgClient(context, io);
-  return { store: new RemoteStore(client), client };
+  const client = await openOrgClient(context, io);
+  return { store: new RemoteStore(client), client, local: void 0 };
 }
-function openStore(context, io) {
-  return openBackend(context, io).store;
+async function openStore(context, io) {
+  return (await openBackend(context, io)).store;
+}
+function needsServer(command, context) {
+  return new ConfigError(
+    `${command} needs a server: ${context.localFix ?? "drop --local"}`
+  );
+}
+function requireServer(command, context) {
+  if (context.mode !== "remote") throw needsServer(command, context);
 }
 
 // src/commands/complain.ts
-var REMOTE_REPORTER_MESSAGE = "--reporter is not allowed in remote mode: the server records the signed-in user";
+var REMOTE_REPORTER_MESSAGE = "--reporter only works in local mode: the server sets the reporter";
 async function runComplain(message, options, context, io) {
   const project = requireProject(context);
   const org = requireOrg(context);
@@ -25143,7 +26414,7 @@ async function runComplain(message, options, context, io) {
     throw new UsageError(REMOTE_REPORTER_MESSAGE);
   }
   const body = await readMessage(message, io);
-  const store = openStore(context, io);
+  const store = await openStore(context, io);
   const input2 = {
     org,
     project,
@@ -25153,13 +26424,21 @@ async function runComplain(message, options, context, io) {
     ...options.tag === void 0 || options.tag.length === 0 ? {} : { tags: options.tag },
     agent: context.agent,
     reporter: context.reporter,
-    ...context.cwd === void 0 ? {} : { cwd: context.cwd }
+    ...context.cwd === void 0 ? {} : { cwd: context.cwd },
+    ...options.cmd === void 0 ? {} : { cmd: options.cmd }
   };
-  const complaint = await createComplaint(store, input2, {
-    allowedTags: context.allowedTags
-  });
+  let complaint;
+  try {
+    complaint = await createComplaint(store, input2, {
+      allowedTags: context.allowedTags
+    });
+  } catch (error62) {
+    if (!(error62 instanceof UndeliveredError)) throw error62;
+    return queueComplaint(error62, org, project, context, io, options.json === true);
+  }
   if (options.json === true) {
     writeJson(io.stdout, complaint);
+    localNotice(context, io);
     return 0;
   }
   const scope = context.mode === "remote" ? `${complaint.org}/${complaint.project}` : complaint.project;
@@ -25167,6 +26446,43 @@ async function runComplain(message, options, context, io) {
     io.stdout,
     `Filed complaint ${complaint.id} for ${scope} (${complaint.severity})`
   );
+  for (const line of matchLines(complaint)) writeLine(io.stdout, line);
+  localNotice(context, io);
+  return 0;
+}
+function localNotice(context, io) {
+  if (context.mode !== "local") return;
+  writeLine(
+    io.stderr,
+    `quibble: local mode: nothing was sent; the complaint is in ${context.storePath}`
+  );
+}
+function matchLines(complaint) {
+  const lines = [];
+  if (complaint.openMatches === 1) {
+    lines.push("1 open complaint already shares this headline.");
+  } else if (complaint.openMatches > 1) {
+    lines.push(`${complaint.openMatches} open complaints already share this headline.`);
+  }
+  if (complaint.recurred) {
+    lines.push("A resolved complaint shares this headline: this one is marked recurred.");
+  }
+  return lines;
+}
+function queueComplaint(error62, org, project, context, io, json2) {
+  const path = queuePath(io.env);
+  enqueue(path, {
+    endpoint: requireEndpoint(context),
+    org,
+    auth: authLabel(context),
+    body: error62.body,
+    key: error62.key
+  });
+  writeLine(
+    io.stderr,
+    `quibble: queued the complaint for ${org}/${project} in ${path}: ${error62.reason}. It is sent with the next remote command under the same credential, or run \`quibble retry\`.`
+  );
+  if (json2) writeJson(io.stdout, { queued: true, org, project, reason: error62.reason });
   return 0;
 }
 async function readMessage(message, io) {
@@ -25184,7 +26500,7 @@ function describeCredential(context) {
   if (context.credential !== void 0) {
     return `logged in as ${context.credential.email}`;
   }
-  if (context.endpoint !== void 0 && isLoopback(context.endpoint)) {
+  if (context.endpoint !== void 0 && isLoopbackUrl(context.endpoint)) {
     return "loopback dev token";
   }
   return "not logged in";
@@ -25196,57 +26512,150 @@ function describeAuth(context) {
   if (problem === void 0) return `${credential}, acting as ${context.actAs}`;
   return `${credential}; ${ACT_AS_ENV} does not apply: ${problem}`;
 }
-function runConfig(options, context, io) {
+async function runConfig(options, context, io) {
+  if (context.mode === "remote") await resolveEndpoint(context, io);
+  const ignored = foreignOrgMessage(context) === void 0 ? void 0 : context.slug;
   const report = {
     project: context.project ?? "none",
     org: context.org ?? null,
+    orgIgnored: ignored ?? null,
     projectRoot: context.projectRoot ?? null,
     configPath: context.configPath ?? null,
     mode: context.mode,
-    endpoint: context.endpoint ?? null,
+    endpoint: context.endpoint ?? "local",
+    endpointSource: context.endpointSource,
     storePath: context.storePath,
     agent: context.agent,
     reporter: context.reporter,
     actAs: context.actAs ?? null,
-    auth: describeAuth(context)
+    auth: describeAuth(context),
+    // Every credential counts, and nothing is sent.
+    unsent: context.mode === "remote" && context.endpoint !== void 0 ? pendingFor(queuePath(io.env), context.endpoint).length : 0
   };
   if (options.json === true) {
     writeJson(io.stdout, report);
     return 0;
   }
-  const width = Math.max(...Object.keys(report).map((key) => key.length));
-  for (const [key, value] of Object.entries(report)) {
-    writeLine(io.stdout, `${key.padEnd(width)}  ${value ?? "none"}`);
+  const { orgIgnored, ...lines } = report;
+  const text = { ...lines };
+  if (orgIgnored !== null) {
+    text["org"] = `${report.org ?? ""}; ${orgIgnored} does not apply: ${context.localFix ?? ""}`;
+  }
+  const width = Math.max(...Object.keys(text).map((key) => key.length));
+  for (const [key, value] of Object.entries(text)) {
+    writeLine(io.stdout, `${key.padEnd(width)}  ${String(value ?? "none")}`);
   }
   return 0;
 }
 
 // src/commands/init.ts
-import { existsSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename, join as join4, resolve as resolve2 } from "node:path";
-var SNIPPET_INTRO = `## Filing complaints
+import { existsSync as existsSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename as basename2, join as join7, resolve as resolve3 } from "node:path";
 
-This project uses Quibble. When the build, the tests, the documentation or the
-tooling waste your time, file a complaint instead of working around the problem
-in silence.`;
-var SNIPPET_USAGE = `Use \`-s low|medium|high\` for severity and repeat \`-t <tag>\` for tags. The first
-line of the message is the headline every surface shows, so put the summary on
-the first line and the detail below it. Pipe a long message on stdin with
-\`quibble complain -\`. File one complaint per problem, and file it when you hit
-the problem rather than at the end of the task.`;
-function exampleCommand(tag) {
-  return `    quibble complain "what went wrong, and what you expected" -s medium -t ${tag}`;
-}
-var AGENT_SNIPPET = [SNIPPET_INTRO, exampleCommand("build"), SNIPPET_USAGE].join(
-  "\n\n"
-);
+// src/hook.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join5 } from "node:path";
+var SETTINGS_PATH = ".claude/settings.json";
+var HOOK_COMMAND = "command -v quibble >/dev/null 2>&1 && quibble sync --quiet || true";
+var HOOK_MARK = "quibble sync --quiet";
+function hookEntry() {
+  return {
+    matcher: "startup",
+    hooks: [{ type: "command", command: HOOK_COMMAND }]
+  };
+}
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function runsSync(entry) {
+  if (!isObject2(entry) || !Array.isArray(entry["hooks"])) return false;
+  return entry["hooks"].some(
+    (hook) => isObject2(hook) && typeof hook["command"] === "string" && hook["command"].includes(HOOK_MARK)
+  );
+}
+function planHook(root) {
+  const path = join5(root, SETTINGS_PATH);
+  let text;
+  try {
+    text = readFileSync4(path, "utf8");
+  } catch (error62) {
+    if (!isNotFound(error62)) throw error62;
+    const created = { hooks: { SessionStart: [hookEntry()] } };
+    return { path, text: `${JSON.stringify(created, null, 2)}
+` };
+  }
+  const invalid = new UsageError(
+    `${path} is not valid JSON: fix it, then run the command again`
+  );
+  let settings;
+  try {
+    settings = JSON.parse(text);
+  } catch {
+    throw invalid;
+  }
+  if (!isObject2(settings)) throw invalid;
+  const hooks = settings["hooks"] === void 0 ? {} : settings["hooks"];
+  if (!isObject2(hooks)) throw new UsageError(`${path}: hooks must be an object`);
+  const start = hooks["SessionStart"] === void 0 ? [] : hooks["SessionStart"];
+  if (!Array.isArray(start)) {
+    throw new UsageError(`${path}: hooks.SessionStart must be an array`);
+  }
+  if (start.some(runsSync)) return { path, text: void 0 };
+  const merged = {
+    ...settings,
+    hooks: { ...hooks, SessionStart: [...start, hookEntry()] }
+  };
+  return { path, text: `${JSON.stringify(merged, null, 2)}
+` };
+}
+function applyHook(plan) {
+  if (plan.text === void 0) return `${plan.path} already runs quibble sync`;
+  mkdirSync4(dirname5(plan.path), { recursive: true });
+  writeFileSync3(plan.path, plan.text, "utf8");
+  return `Added the quibble sync hook to ${plan.path}`;
+}
+
+// src/snippet.ts
+import { basename } from "node:path";
+var SNIPPET_HEADING = "## Filing complaints";
+var SKILL_HEADING = "# Filing complaints";
+var SKILL_PATH = ".claude/skills/quibble/SKILL.md";
+var DEFAULT_SNIPPET_AGENT = "claude";
+var AGENTS_FILE_AGENT = "codex";
+var SNIPPET_INTRO = `This project uses Quibble. When the build, tests, docs or tooling waste your
+time, file a complaint instead of quietly working around the problem.`;
+var SNIPPET_USAGE = `- Set severity with \`-s low|medium|high\`. Add tags with \`-t <tag>\` (repeatable).
+- Put a one-line summary first; it is the headline everywhere. Add details below.
+- Name the command that failed with \`--cmd "<command>"\`.
+- Pipe a long message on stdin with \`quibble complain -\`.
+- File one complaint per problem, as soon as you hit it, not at the end of the task.`;
+var SKILL_FRONT_MATTER = `---
+name: quibble
+description: File a Quibble complaint when the build, tests, docs or tooling of this project waste your time. Use it as soon as you hit the problem, not at the end of the task.
+---`;
 var SNIPPET_LOGIN = "Run `quibble login` once before the first complaint.";
 function orgSentence(org) {
   return `Complaints go to the \`${org}\` organization.`;
 }
+function exampleCommand(tag, agent) {
+  return `    quibble complain "what went wrong, and what you expected" -s medium -t ${tag} --agent ${agent}`;
+}
+function tagRules(tags) {
+  const list = tags.map((tag) => `\`${tag}\``).join(", ");
+  return `Every complaint needs at least one of these tags: ${list}.
+If none fits, pass \`-t ${OTHER_TAG_PREFIX}<name>\` naming the tag you wanted, such as
+\`-t ${OTHER_TAG_PREFIX}network\`. Run \`quibble tags\` to see the list.`;
+}
 function agentSnippet(tags, scope = {}) {
   const first = tags?.[0];
-  const blocks = tags === void 0 || first === void 0 ? [SNIPPET_INTRO, exampleCommand("build"), SNIPPET_USAGE] : [SNIPPET_INTRO, exampleCommand(first), tagRules(tags), SNIPPET_USAGE];
+  const agent = scope.agent ?? DEFAULT_SNIPPET_AGENT;
+  const blocks = [
+    SNIPPET_HEADING,
+    SNIPPET_INTRO,
+    exampleCommand(first ?? "build", agent)
+  ];
+  if (tags !== void 0 && first !== void 0) blocks.push(tagRules(tags));
+  blocks.push(SNIPPET_USAGE);
   const sentences = [];
   const { endpoint, org } = scope;
   if (endpoint !== void 0 && endpoint !== "") sentences.push(SNIPPET_LOGIN);
@@ -25254,54 +26663,300 @@ function agentSnippet(tags, scope = {}) {
   if (sentences.length > 0) blocks.push(sentences.join(" "));
   return blocks.join("\n\n");
 }
-function tagRules(tags) {
-  const list = tags.map((tag) => `\`${tag}\``).join(", ");
-  return `Every complaint needs at least one tag. The allowed tags are ${list}.
-When no tag fits, pass \`-t ${OTHER_TAG_HINT}\` and name the tag you wanted, such
-as \`-t ${OTHER_TAG_PREFIX}network\`. Run \`quibble tags\` to print the list.`;
-}
-function runInit(options, io) {
-  const directory = resolve2(io.cwd);
-  const path = join4(directory, PROJECT_CONFIG_FILENAME);
-  if (existsSync(path) && options.force !== true) {
+function skillFile(snippet) {
+  const body = snippet.startsWith(SNIPPET_HEADING) ? `${SKILL_HEADING}${snippet.slice(SNIPPET_HEADING.length)}` : snippet;
+  return `${SKILL_FRONT_MATTER}
+
+${body}
+`;
+}
+function agentForFile(path) {
+  return basename(path).toLowerCase() === "agents.md" ? AGENTS_FILE_AGENT : DEFAULT_SNIPPET_AGENT;
+}
+function hasSnippet(text) {
+  return text.split(/\r?\n/).some((line) => line.trimEnd() === SNIPPET_HEADING);
+}
+function splitLines(text) {
+  const lines = [];
+  const pattern = /([^\r\n]*)(\r\n|\n|\r)?/g;
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    const [whole, content = "", eol = ""] = match;
+    if (whole === "") break;
+    lines.push({ text: content, eol });
+  }
+  return lines;
+}
+function fenceOf(text) {
+  if (text.startsWith("```")) return "```";
+  if (text.startsWith("~~~")) return "~~~";
+  return void 0;
+}
+function endsSection(text) {
+  return text.startsWith("# ") || text.startsWith("## ");
+}
+function agentOfText(lines) {
+  const line = lines.find(
+    (text) => text.includes("quibble complain") && text.includes("--agent")
+  );
+  if (line === void 0) return void 0;
+  return /--agent\s+(\S+)/.exec(line)?.[1];
+}
+function findSection(text) {
+  const lines = splitLines(text);
+  const start = lines.findIndex((line) => line.text.trimEnd() === SNIPPET_HEADING);
+  if (start < 0) return void 0;
+  let next = lines.length;
+  let fence;
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const content = lines[index]?.text ?? "";
+    if (fence !== void 0) {
+      if (content.startsWith(fence)) fence = void 0;
+      continue;
+    }
+    fence = fenceOf(content);
+    if (fence === void 0 && endsSection(content)) {
+      next = index;
+      break;
+    }
+  }
+  let end = next;
+  while (end > start + 1 && (lines[end - 1]?.text.trim() ?? "") === "") end -= 1;
+  const eol = lines[start]?.eol || "\n";
+  return { lines, start, end, eol: eol === "\r\n" ? "\r\n" : "\n" };
+}
+function sectionText(section) {
+  return section.lines.slice(section.start, section.end).map((line) => line.text);
+}
+function replaceSection(section, snippet) {
+  const join9 = (lines) => lines.map((line) => `${line.text}${line.eol}`).join("");
+  const body = snippet.split("\n").map((line) => `${line}${section.eol}`).join("");
+  return `${join9(section.lines.slice(0, section.start))}${body}${join9(section.lines.slice(section.end))}`;
+}
+function withLineBreak(text, old) {
+  return old.includes("\r\n") ? text.replace(/\r?\n/g, "\r\n") : text;
+}
+function orList(items) {
+  if (items.length <= 1) return items.join("");
+  return `${items.slice(0, -1).join(", ")} or ${items.at(-1) ?? ""}`;
+}
+function refreshedLine(project, tags) {
+  const lead = `Quibble refreshed its instructions for ${project}:`;
+  if (tags === void 0 || tags.length === 0) return `${lead} any tag is allowed.`;
+  return `${lead} tag each complaint with ${orList(tags)}, or ${OTHER_TAG_PREFIX}<name> when none fits.`;
+}
+
+// src/commands/snippet.ts
+import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
+function existsError(path) {
+  return new UsageError(`${path} already exists: pass --force to overwrite it`);
+}
+function readOptional2(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return "";
+    throw error62;
+  }
+}
+function writeSkill(path, snippet) {
+  mkdirSync5(dirname6(path), { recursive: true });
+  writeFileSync4(path, skillFile(snippet), "utf8");
+}
+async function snippetSource(project, context, io, options = {}) {
+  let tags;
+  if (context.mode === "remote") {
+    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
+  } else {
+    checkActAs(context);
+    tags = context.allowedTags;
+  }
+  const scope = {
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...context.slug === void 0 ? {} : { org: context.slug }
+  };
+  return { tags, scope };
+}
+async function runSnippet(options, context, io) {
+  const project = requireProject(context);
+  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
+  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
+  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
+  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
+  if (options.append !== void 0 && hasSnippet(existing)) {
+    throw new UsageError(
+      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
+    );
+  }
+  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
+  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
+  const { tags, scope } = await snippetSource(project, context, io);
+  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
+  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
+  if (appendPath !== void 0) {
+    const agent = override ?? agentForFile(appendPath);
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    const kept = existing.replace(/\s+$/, "");
+    writeFileSync4(appendPath, kept === "" ? `${snippet}
+` : `${kept}
+
+${snippet}
+`);
+    shown = { agent, snippet };
+  }
+  if (skillPath !== void 0) {
+    const agent = override ?? DEFAULT_SNIPPET_AGENT;
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    writeSkill(skillPath, snippet);
+    if (appendPath === void 0) shown = { agent, snippet };
+  }
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      snippet: shown.snippet,
+      agent: shown.agent,
+      appended: appendPath ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null
+    });
+    return 0;
+  }
+  if (appendPath === void 0 && skillPath === void 0) {
+    writeLine(io.stdout, shown.snippet);
+  }
+  if (appendPath !== void 0) {
+    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
+  }
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
+  return 0;
+}
+
+// src/commands/init.ts
+var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
+function agentLead(agent) {
+  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
+}
+async function runInit(options, io) {
+  const directory = resolve3(io.cwd);
+  const path = join7(directory, PROJECT_CONFIG_FILENAME);
+  if (existsSync2(path) && options.force !== true) {
     throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
   }
+  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
+  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
   const project = resolveProjectName(options.project, directory);
   const org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
-  const endpoint = options.endpoint?.trim();
   const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
+  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
+  const hook = options.hook === true ? planHook(directory) : void 0;
+  const endpoint = await endpointToWrite(options.endpoint, io);
   const config2 = {
     project,
     ...org === void 0 ? {} : { org },
-    ...endpoint === void 0 || endpoint === "" ? {} : { endpoint },
+    ...endpoint === void 0 ? {} : { endpoint },
     ...tags === void 0 ? {} : { tags }
   };
-  writeFileSync2(path, `${JSON.stringify(config2, null, 2)}
+  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
+  const context = {
+    ...resolveContext({
+      cwd: io.cwd,
+      env: io.env,
+      endpoint: options.endpoint,
+      org: options.org,
+      local: options.local
+    }),
+    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
+    actAs: void 0
+  };
+  const snippet = agentSnippet(tags, {
+    agent,
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...org === void 0 ? {} : { org }
+  });
+  if (skillPath !== void 0) writeSkill(skillPath, snippet);
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  const check2 = await checkServer(context, project, io);
   if (options.json === true) {
-    writeJson(io.stdout, { path, project, org: org ?? null, tags: tags ?? null });
+    writeJson(io.stdout, {
+      path,
+      project,
+      org: org ?? null,
+      tags: tags ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null,
+      server: check2.server
+    });
     return 0;
   }
   writeLine(io.stdout, `Wrote ${path}`);
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
   writeLine(io.stdout, `Project: ${project}`);
   if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
   if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
   writeLine(io.stdout);
-  writeLine(io.stdout, "Add this to your CLAUDE.md or AGENTS.md:");
+  writeLine(io.stdout, agentLead(agent));
   writeLine(io.stdout);
-  writeLine(
-    io.stdout,
-    agentSnippet(tags, {
-      ...endpoint === void 0 ? {} : { endpoint },
-      ...org === void 0 ? {} : { org }
-    })
-  );
+  writeLine(io.stdout, snippet);
+  if (agent === DEFAULT_SNIPPET_AGENT) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, CODEX_LINE);
+  }
+  if (check2.line !== void 0) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, check2.line);
+  }
   return 0;
 }
+async function endpointToWrite(given, io) {
+  if (given === void 0 || given.trim() === "") return void 0;
+  const value = parseEndpoint(given, "--endpoint");
+  if (value.kind === "local") return LOCAL_ENDPOINT;
+  const api = await discoverApiUrl(value.url, {
+    fetch: io.fetch,
+    debug: debugEnabled(io.env)
+  });
+  return isDefaultEndpoint(api) ? void 0 : api;
+}
+async function checkServer(context, project, io) {
+  const org = context.org;
+  if (context.mode !== "remote" || org === void 0) return { server: "unchecked" };
+  const endpoint = await resolveEndpoint(context, io);
+  if (context.token === void 0 && context.credential === void 0 && !isLoopbackUrl(endpoint)) {
+    return { server: "unchecked" };
+  }
+  const warn = (text) => {
+    writeLine(io.stderr, `quibble: warning: ${text}`);
+  };
+  try {
+    await (await openClient(context, io, { queue: false })).project(project);
+    return { server: "found", line: `Project ${org}/${project} exists on ${endpoint}.` };
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.status === 404) {
+      if (error62.serverCode === ORG_NOT_FOUND) {
+        warn(`no organization ${org} on ${endpoint} for this account`);
+        return { server: "no_org" };
+      }
+      warn(
+        `${org} has no project ${project} on ${endpoint}: an admin creates it in the organization settings`
+      );
+      return { server: "no_project" };
+    }
+    warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
+    return { server: "unreachable" };
+  }
+}
 function resolveProjectName(given, directory) {
   const candidate = given?.trim();
   if (candidate !== void 0 && candidate !== "") return parseProjectName(candidate);
-  const name = basename(directory);
+  const name = basename2(directory);
   try {
     return parseProjectName(name);
   } catch (error62) {
@@ -25332,25 +26987,30 @@ var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
 var MINUTE_MS = 6e4;
 var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS2 = 24 * HOUR_MS;
+var DAY_MS3 = 24 * HOUR_MS;
 var UNIT_MS = {
   m: MINUTE_MS,
   h: HOUR_MS,
-  d: DAY_MS2,
-  w: 7 * DAY_MS2
+  d: DAY_MS3,
+  w: 7 * DAY_MS3
 };
-function reject() {
-  throw new UsageError(SINCE_MESSAGE);
+var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
+function reject(message = SINCE_MESSAGE) {
+  throw new UsageError(message);
 }
 function iso(at) {
   if (Number.isNaN(at.getTime())) reject();
   return at.toISOString();
 }
-function fromDuration(digits, unit, now) {
-  if (digits.startsWith("0")) reject();
+function durationMs(digits, unit) {
+  if (digits.startsWith("0")) return void 0;
   const step = UNIT_MS[unit];
-  if (step === void 0) reject();
-  return iso(new Date(now.getTime() - Number(digits) * step));
+  return step === void 0 ? void 0 : Number(digits) * step;
+}
+function fromDuration(digits, unit, now) {
+  const span = durationMs(digits, unit);
+  if (span === void 0) reject();
+  return iso(new Date(now.getTime() - span));
 }
 function fromDate(value) {
   const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
@@ -25368,6 +27028,27 @@ function parseSince(text, now) {
   if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
   return reject();
 }
+function parseExpires(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  let stamp2;
+  try {
+    if (duration3 !== null) {
+      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
+      if (span === void 0) reject(EXPIRES_MESSAGE);
+      stamp2 = iso(new Date(now.getTime() + span));
+    } else if (DATE_RE.test(value)) {
+      stamp2 = fromDate(value);
+    } else if (TIMESTAMP_RE.test(value)) {
+      stamp2 = iso(new Date(value));
+    } else {
+      return reject(EXPIRES_MESSAGE);
+    }
+  } catch {
+    return reject(EXPIRES_MESSAGE);
+  }
+  return stamp2;
+}
 
 // src/scope.ts
 function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
@@ -25387,6 +27068,9 @@ function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
     ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
   };
 }
+function tagFilter(tags) {
+  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
+}
 
 // src/commands/list.ts
 var COLUMNS = [
@@ -25396,67 +27080,114 @@ var COLUMNS = [
   "status",
   "project",
   "reporter",
+  "tags",
+  "group",
   "summary"
 ];
 var REPORTER_WIDTH = 20;
+var TAGS_WIDTH = 24;
 var SUMMARY_MAX = 60;
+var RECURRED_MARK = "\u21BB";
+function cut2(text, width) {
+  if (text.length <= width) return text;
+  return `${text.slice(0, width - 3)}...`;
+}
 function summaryOf(complaint) {
-  const summary = summarize(complaint.message);
-  if (summary.length <= SUMMARY_MAX) return summary;
-  return `${summary.slice(0, SUMMARY_MAX - 3)}...`;
+  return cut2(printable(summarize(complaint.message)), SUMMARY_MAX);
 }
+function limitNote(count, limit, more) {
+  if (limit >= MAX_LIMIT) {
+    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
+  }
+  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
+}
+var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
 async function runList(options, context, io) {
-  const { store, client } = openBackend(context, io);
+  if (options.ids === true && options.json === true) {
+    throw new UsageError("--ids and --json cannot be used together");
+  }
+  const { store, client } = await openBackend(context, io);
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
     ...options.severity === void 0 ? {} : { severity: options.severity },
-    ...options.tag === void 0 ? {} : { tag: options.tag },
+    ...tagFilter(options.tag),
+    ...options.search === void 0 ? {} : { q: options.search },
     ...reporter === void 0 ? {} : { reporter },
     ...options.limit === void 0 ? {} : { limit: options.limit }
   });
-  const complaints = await listComplaints(store, filter);
+  const limit = filter.limit ?? DEFAULT_LIMIT;
+  const page = await listComplaintPage(store, {
+    ...filter,
+    limit: Math.min(limit + 1, MAX_LIMIT)
+  });
+  const complaints = page.complaints.slice(0, limit);
   if (options.json === true) {
     writeJson(io.stdout, complaints);
     return 0;
   }
+  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
+  if (note !== void 0) writeLine(io.stderr, note);
+  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
+  if (options.ids === true) {
+    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
+    return 0;
+  }
   if (complaints.length === 0) {
     writeLine(io.stdout, "No complaints found.");
     return 0;
   }
-  for (const line of formatTable(complaints)) writeLine(io.stdout, line);
+  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
+    groupComplaints(complaints).map((group) => ({
+      complaint: group.head,
+      group
+    }))
+  );
+  for (const line of lines) writeLine(io.stdout, line);
   return 0;
 }
 function reporterOf(complaint) {
-  const name = complaint.reporterName ?? complaint.reporter;
-  if (name.length <= REPORTER_WIDTH) return name;
-  return `${name.slice(0, REPORTER_WIDTH - 3)}...`;
-}
-function formatTable(complaints) {
-  const rows2 = complaints.map((complaint) => [
-    complaint.id.slice(0, 8),
-    complaint.createdAt.slice(0, 16),
-    complaint.severity,
-    complaint.status,
-    complaint.project,
-    reporterOf(complaint),
-    summaryOf(complaint)
-  ]);
-  const widths = COLUMNS.map(
-    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  return cut2(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+}
+function groupCell(group) {
+  const count = group.count > 1 ? `\xD7${group.count}` : "";
+  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
+}
+function formatTable(rows2) {
+  const grouped = rows2.some((row) => row.group !== void 0);
+  const columns = COLUMNS.filter((name) => grouped || name !== "group");
+  const cells = rows2.map(({ complaint, group }) => {
+    const values = {
+      id: complaint.id.slice(0, 8),
+      created: complaint.createdAt.slice(0, 16),
+      severity: complaint.severity,
+      status: complaint.status,
+      project: complaint.project,
+      reporter: reporterOf(complaint),
+      tags: cut2(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      group: group === void 0 ? "" : groupCell(group),
+      summary: summaryOf(complaint)
+    };
+    return columns.map((name) => values[name]);
+  });
+  const widths = columns.map(
+    (name, column) => cells.reduce(
+      (width, row) => Math.max(width, (row[column] ?? "").length),
+      name.length
+    )
   );
-  const format = (cells) => cells.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [format(COLUMNS), ...rows2.map(format)];
+  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(columns), ...cells.map(format)];
 }
 
 // src/commands/orgs.ts
-var ORGS_NEEDS_SERVER = "orgs needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
 var ORGS_PAGE = "/orgs";
 var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
 async function runOrgs(options, context, io) {
-  if (context.mode !== "remote") throw new ConfigError(ORGS_NEEDS_SERVER);
+  requireServer("orgs", context);
+  const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const answer2 = await openClient(context, io).orgs();
+  const answer2 = await client.orgs();
   if (options.json === true) {
     writeJson(io.stdout, answer2.body);
     return 0;
@@ -25464,9 +27195,10 @@ async function runOrgs(options, context, io) {
   if (answer2.orgs.length === 0) {
     const config2 = await fetchAuthConfig(endpoint, {
       debug: context.debug,
-      fetch: io.fetch
+      fetch: io.fetch,
+      timeoutMs: context.timeoutMs
     });
-    const webUrl = config2.mode === "cognito" ? trimSlash(config2.webUrl) : endpoint;
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
     writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE}.`);
     return 0;
   }
@@ -25526,19 +27258,19 @@ var NodeTerminal = class {
   #interface() {
     if (this.#rl !== void 0) return this.#rl;
     const output2 = this.#output;
-    const sink = new Writable({
+    const sink2 = new Writable({
       write: (chunk, _encoding, done) => {
         if (!this.#muted) output2.write(chunk);
         done();
       }
     });
-    Object.defineProperties(sink, {
+    Object.defineProperties(sink2, {
       columns: { get: () => output2.columns },
       rows: { get: () => output2.rows }
     });
     const rl = createInterface({
       input: this.#input,
-      output: sink,
+      output: sink2,
       terminal: true,
       // No answer enters the history, so an arrow key recalls no password.
       historySize: 0
@@ -25571,8 +27303,8 @@ var NodeTerminal = class {
     const queued = this.#lines.shift();
     if (queued !== void 0) return Promise.resolve(queued);
     if (this.#closed) return Promise.resolve("");
-    return new Promise((resolve3) => {
-      this.#waiting = resolve3;
+    return new Promise((resolve4) => {
+      this.#waiting = resolve4;
     });
   }
   async #read(label, hidden) {
@@ -25610,7 +27342,7 @@ function nodeTerminal(input2, output2) {
 
 // src/commands/login.ts
 var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: a CI job sets QUIBBLE_TOKEN instead";
+var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: in CI, set QUIBBLE_TOKEN instead";
 var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
 var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
 var LOGIN_PAGE = "/login";
@@ -25638,29 +27370,29 @@ async function signIn(terminal, identity, config2) {
       password
     });
     if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
-      const code = await answer(terminal, "Code:");
+      const code2 = await answer(terminal, "Code:");
       result = await respondToAuthChallenge(identity, {
         clientId,
         challenge: result.challenge,
         email: email3,
-        code
+        code: code2
       });
     }
     if (result.kind === "challenge") {
       const name = result.challenge.challengeName;
       if (name === NEW_PASSWORD_CHALLENGE) {
         throw new ConfigError(
-          `finish your first sign-in at ${trimSlash(config2.webUrl)}${LOGIN_PAGE}`
+          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
         );
       }
       throw new RemoteError(
-        `the sign-in asked for ${name}, which quibble does not support`
+        `this account needs a sign-in step that quibble doesn't support (${name})`
       );
     }
     return result.tokens;
   } catch (error62) {
     if (error62 instanceof CognitoError) {
-      const page = `${trimSlash(config2.webUrl)}${LOGIN_PAGE}`;
+      const page = `${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`;
       if (error62.type === "PasswordResetRequiredException") {
         throw new ConfigError(`reset your password at ${page}`);
       }
@@ -25672,13 +27404,14 @@ async function signIn(terminal, identity, config2) {
   }
 }
 async function runLogin(options, context, io) {
-  const endpoint = requireEndpoint(context);
+  requireServer("login", context);
   const terminal = terminalOf(io);
   if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
   const http = { debug: context.debug, fetch: io.fetch };
   const config2 = await fetchAuthConfig(endpoint, http);
   if (config2.mode === "local") {
-    writeLine(io.stdout, `${endpoint} needs no login.`);
+    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
     return 0;
   }
   let tokens;
@@ -25688,7 +27421,7 @@ async function runLogin(options, context, io) {
     terminal.close();
   }
   if (tokens.refreshToken === void 0) {
-    throw new RemoteError("the sign-in returned no refresh token");
+    throw new RemoteError("sign-in didn't return a refresh token");
   }
   const now = /* @__PURE__ */ new Date();
   const me = await readProfile(
@@ -25700,7 +27433,9 @@ async function runLogin(options, context, io) {
     config2.webUrl
   );
   if (me.sub === void 0 || me.email === void 0) {
-    throw new RemoteError("the API returned an identity without a sub or an email");
+    throw new RemoteError(
+      "unexpected response from the API: identity has no sub or email"
+    );
   }
   saveCredential(io.env, {
     endpoint,
@@ -25710,25 +27445,36 @@ async function runLogin(options, context, io) {
     sub: me.sub,
     email: me.email
   });
+  const saved = saveEndpoint(context, endpoint, io.env);
   if (options.json === true) {
-    writeJson(io.stdout, { ...me.body, endpoint });
+    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
     return 0;
   }
   writeLine(io.stdout, `Logged in to ${endpoint} as ${me.email}.`);
+  if (saved !== void 0) {
+    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+  }
   return 0;
 }
+function saveEndpoint(context, endpoint, env) {
+  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
+    return void 0;
+  }
+  return rememberEndpoint(env, endpoint);
+}
 async function readProfile(client, webUrl) {
   try {
     return await client.me();
   } catch (error62) {
     if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
-      throw new ConfigError(`finish your account at ${trimSlash(webUrl)}${LOGIN_PAGE}`);
+      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
     }
     throw error62;
   }
 }
 async function runLogout(context, io) {
-  const endpoint = requireEndpoint(context);
+  requireServer("logout", context);
+  const endpoint = await resolveEndpoint(context, io);
   const credential = findCredential(io.env, endpoint);
   if (credential === void 0) {
     writeLine(io.stdout, `Not logged in to ${endpoint}.`);
@@ -25764,8 +27510,8 @@ async function runWhoami(options, context, io) {
     writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
     return 0;
   }
+  const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const client = openClient(context, io);
   const me = await client.me();
   const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
   if (options.json === true) {
@@ -25782,7 +27528,7 @@ async function runWhoami(options, context, io) {
       debug: context.debug,
       fetch: io.fetch
     });
-    const webUrl = config2.mode === "cognito" ? trimSlash(config2.webUrl) : endpoint;
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
     lines.push("", `Create one at ${webUrl}${ORGS_PAGE2}.`);
   }
   for (const line of lines) writeLine(io.stdout, line);
@@ -25822,18 +27568,40 @@ function whoamiLines(endpoint, me, org) {
   return lines;
 }
 
+// src/commands/project.ts
+var DELETE_NEEDS_YES = "project delete needs --yes when stdin is not a terminal";
+var DELETE_MISMATCH = "the name did not match: nothing was deleted";
+async function confirm(org, project, io) {
+  const terminal = io.terminal ?? nodeTerminal(io.stdin, io.stderr);
+  if (!terminal.isTTY) throw new UsageError(DELETE_NEEDS_YES);
+  let answer2;
+  try {
+    answer2 = await terminal.prompt(`Type the project name to delete ${org}/${project}:`);
+  } finally {
+    terminal.close();
+  }
+  if (foldProjectName(answer2.trim()) !== project) throw new UsageError(DELETE_MISMATCH);
+}
+async function runProjectDelete(name, options, context, io) {
+  requireServer("project delete", context);
+  const project = parseProjectName(name);
+  const org = requireOrg(context);
+  if (options.yes !== true) await confirm(org, project, io);
+  await (await openOrgClient(context, io)).deleteProject(project);
+  if (options.json === true) {
+    writeJson(io.stdout, { org, project, deleted: true });
+    return 0;
+  }
+  writeLine(io.stdout, `Deleted project ${org}/${project}.`);
+  return 0;
+}
+
 // src/commands/promote.ts
-var PROMOTE_NEEDS_SERVER = "promote needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
-var PROMOTE_NEEDS_SERVER_LOCAL = "promote needs a server: drop --local, because the project record of the server owns the allowed tag list";
 async function runPromote(tag, options, context, io) {
-  if (context.mode !== "remote") {
-    throw new ConfigError(
-      context.endpoint === void 0 ? PROMOTE_NEEDS_SERVER : PROMOTE_NEEDS_SERVER_LOCAL
-    );
-  }
+  requireServer("promote", context);
   const project = requireProject(context);
   const promotion = parseTagPromotion({ tag });
-  const result = await openOrgClient(context, io).promoteTag(project, promotion.tag);
+  const result = await (await openOrgClient(context, io)).promoteTag(project, promotion.tag);
   if (options.json === true) {
     writeJson(io.stdout, {
       project,
@@ -25855,10 +27623,12 @@ async function runPromote(tag, options, context, io) {
 
 // src/commands/retag.ts
 var NO_TAG_MESSAGE = "retag needs at least one --tag";
-async function runRetag(id, options, context, io) {
+async function runRetag(value, options, context, io) {
   const tags = options.tag ?? [];
   if (tags.length === 0) throw new UsageError(NO_TAG_MESSAGE);
-  const { store, client } = openBackend(context, io);
+  const { store, client, local } = await openBackend(context, io);
+  const [id] = await resolveIds([value], { store, local, context });
+  if (id === void 0) throw new NotFoundError(`no complaint with id ${value}`);
   const allowedTags = client === void 0 ? await localAllowedTags(store, id, context) : void 0;
   const complaint = await updateComplaintTags(
     store,
@@ -25882,56 +27652,255 @@ async function localAllowedTags(store, id, context) {
   return complaint.project === config2.project ? config2.tags : void 0;
 }
 
+// src/commands/retry.ts
+async function runRetry(options, context, io) {
+  requireServer("retry", context);
+  const client = await openClient(context, io, { queue: false });
+  const endpoint = requireEndpoint(context);
+  const path = queuePath(io.env);
+  const result = await flushQueue({
+    path,
+    endpoint,
+    auth: authLabel(context),
+    client,
+    stderr: io.stderr
+  });
+  if (result.stopped !== void 0) {
+    throw new RemoteError(`${queuedCount(result.left)} still unsent: ${result.stopped}`);
+  }
+  const auth = authLabel(context);
+  const left = pendingFor(path, endpoint).filter((entry) => entry.auth === auth).length;
+  if (options.json === true) {
+    writeJson(io.stdout, { sent: result.sent, dropped: result.dropped, left });
+    return 0;
+  }
+  if (result.locked) {
+    writeLine(io.stdout, "Another quibble process is sending the queue.");
+    return 0;
+  }
+  if (result.sent.length === 0 && result.dropped === 0) {
+    writeLine(io.stdout, "No queued complaints.");
+    return 0;
+  }
+  const sent = result.sent.length;
+  writeLine(
+    io.stdout,
+    `Sent ${sent} queued ${sent === 1 ? "complaint" : "complaints"}; ${left} left.`
+  );
+  return 0;
+}
+
+// src/commands/show.ts
+var LABEL_WIDTH = "duplicate".length;
+function groupLine(count) {
+  if (count >= MAX_LIMIT) return `${MAX_LIMIT}+ complaints share this headline`;
+  return count === 1 ? "1 complaint shares this headline" : `${count} complaints share this headline`;
+}
+function groupCountOf(complaint, members2) {
+  const others = members2.filter((member) => member.id !== complaint.id).length;
+  return Math.min(others + 1, MAX_LIMIT);
+}
+function statusLine(complaint) {
+  const reason = complaint.reason === void 0 ? "" : ` (${complaint.reason})`;
+  const by = complaint.statusChangedByName ?? complaint.statusChangedBy;
+  const when = by === void 0 || complaint.statusChangedAt === void 0 ? "" : ` by ${by} at ${complaint.statusChangedAt}`;
+  return `${complaint.status}${reason}${when}`;
+}
+function showLines(complaint, groupCount, remote) {
+  const reporter = complaint.reporterName === void 0 ? complaint.reporter : `${complaint.reporterName} (${complaint.reporter})`;
+  const rows2 = [
+    ["id", complaint.id],
+    ["project", remote ? `${complaint.org}/${complaint.project}` : complaint.project],
+    ["status", statusLine(complaint)],
+    ["note", complaint.resolution],
+    ["duplicate", complaint.duplicateOf],
+    ["severity", complaint.severity],
+    ["tags", complaint.tags.length === 0 ? void 0 : complaint.tags.join(", ")],
+    ["agent", complaint.agent],
+    ["reporter", reporter],
+    ["created", complaint.createdAt],
+    ["updated", complaint.updatedAt],
+    ["cwd", complaint.cwd],
+    ["cmd", complaint.cmd],
+    ["group", groupLine(groupCount)],
+    ["recurred", complaint.recurred === true ? "yes" : void 0]
+  ];
+  const lines = rows2.filter((row) => row[1] !== void 0).map(([label, value]) => `${label.padEnd(LABEL_WIDTH)}  ${printable(value)}`);
+  return [...lines, "", printableLines(complaint.message)];
+}
+async function runShow(value, options, context, io) {
+  const { store, local } = await openBackend(context, io);
+  const [id] = await resolveIds([value], { store, local, context });
+  const complaint = id === void 0 ? void 0 : await getComplaint(store, id);
+  if (id === void 0 || complaint === void 0) {
+    throw new NotFoundError(`no complaint with id ${id ?? value}`);
+  }
+  const group = await listComplaints(store, {
+    org: complaint.org,
+    project: complaint.project,
+    fingerprint: complaint.fingerprint,
+    limit: MAX_LIMIT
+  });
+  const groupCount = groupCountOf(complaint, group);
+  if (options.json === true) {
+    writeJson(io.stdout, { ...complaint, groupCount });
+    return 0;
+  }
+  for (const line of showLines(complaint, groupCount, context.mode === "remote")) {
+    writeLine(io.stdout, line);
+  }
+  return 0;
+}
+
 // src/commands/status.ts
+var REMOTE_ACTOR = "server";
 var VERBS = {
   open: "Reopened",
   resolved: "Resolved",
   dismissed: "Dismissed",
   deleted: "Deleted"
 };
-async function runStatusChange(status, id, options, context, io) {
-  const store = openStore(context, io);
-  const complaint = await updateComplaintStatus(store, id, {
+var NOT_FOUND = "not_found";
+function noComplaint(id) {
+  return `no complaint with id ${id}`;
+}
+async function readIdArguments(values, io) {
+  if (!values.includes("-")) return [...values];
+  if (values.length > 1) {
+    throw new UsageError("- reads the ids from stdin, so it takes no other id");
+  }
+  if (io.stdin.isTTY === true) throw new UsageError("no ids: pipe them on stdin");
+  const ids = (await readStdin(io.stdin)).split(/\s+/).filter((id) => id !== "");
+  if (ids.length === 0) throw new UsageError("no ids on stdin");
+  return ids;
+}
+async function runStatusChange(status, values, options, context, io) {
+  const reason = options.reason ?? (options.duplicateOf === void 0 ? void 0 : DUPLICATE_REASON);
+  const draft = {
     status,
-    ...options.note === void 0 ? {} : { resolution: options.note }
+    ...options.note === void 0 ? {} : { resolution: options.note },
+    ...reason === void 0 ? {} : { reason },
+    ...options.duplicateOf === void 0 ? {} : { duplicateOf: options.duplicateOf }
+  };
+  parseStatusChange(draft);
+  const given = await readIdArguments(values, io);
+  const backend = await openBackend(context, io);
+  const extra = options.duplicateOf === void 0 ? [] : [options.duplicateOf];
+  const resolved = await resolveIds([...given, ...extra], {
+    store: backend.store,
+    local: backend.local,
+    context
   });
-  if (complaint === void 0) throw new NotFoundError(`no complaint with id ${id}`);
-  if (options.json === true) {
-    writeJson(io.stdout, complaint);
+  const ids = [...new Set(resolved.slice(0, given.length))];
+  const duplicateOf = options.duplicateOf === void 0 ? void 0 : resolved.at(-1);
+  const change = parseStatusChange({
+    ...draft,
+    ...duplicateOf === void 0 ? {} : { duplicateOf }
+  });
+  const actor = { by: context.mode === "remote" ? REMOTE_ACTOR : context.reporter };
+  if (ids.length === 1) {
+    const id = ids[0];
+    const complaint = await updateComplaintStatus(backend.store, id, change, { actor });
+    if (complaint === void 0) throw new NotFoundError(noComplaint(id));
+    if (options.json === true) {
+      writeJson(io.stdout, complaint);
+      return 0;
+    }
+    writeLine(io.stdout, successLine(status, complaint));
     return 0;
   }
-  writeLine(
-    io.stdout,
-    `${VERBS[status]} complaint ${complaint.id} for ${complaint.project}`
-  );
-  return 0;
+  const { results, error: error62 } = backend.store instanceof RemoteStore ? await remoteResults(backend.store, ids, change) : {
+    results: await localResults(
+      ids,
+      async (id) => updateComplaintStatus(backend.store, id, change, { actor })
+    ),
+    error: void 0
+  };
+  const failures = [];
+  for (const result of results) {
+    if (result.ok && result.complaint !== void 0) {
+      if (options.json !== true)
+        writeLine(io.stdout, successLine(status, result.complaint));
+      continue;
+    }
+    const code2 = result.error?.code ?? NOT_FOUND;
+    const message = code2 === NOT_FOUND ? noComplaint(result.id) : result.error?.message;
+    writeLine(io.stderr, `quibble: ${result.id}: ${message ?? "the change failed"}`);
+    failures.push({ remote: backend.store instanceof RemoteStore && code2 !== NOT_FOUND });
+  }
+  if (options.json === true) writeJson(io.stdout, results);
+  if (error62 !== void 0) throw error62;
+  if (failures.length === 0) return 0;
+  return failures.some((failure2) => failure2.remote) ? 2 : 1;
+}
+function successLine(status, complaint) {
+  return `${VERBS[status]} complaint ${complaint.id} for ${complaint.project}`;
+}
+async function localResults(ids, apply) {
+  const results = [];
+  for (const id of ids) {
+    try {
+      const complaint = await apply(id);
+      results.push(
+        complaint === void 0 ? { id, ok: false, error: { code: NOT_FOUND, message: noComplaint(id) } } : { id, ok: true, complaint }
+      );
+    } catch (error62) {
+      if (!(error62 instanceof ValidationError)) throw error62;
+      results.push({
+        id,
+        ok: false,
+        error: { code: error62.code, message: errorMessage(error62) }
+      });
+    }
+  }
+  return results;
+}
+async function remoteResults(store, ids, change) {
+  const results = [];
+  for (let start = 0; start < ids.length; start += BULK_MAX) {
+    try {
+      results.push(
+        ...await store.bulkStatus(ids.slice(start, start + BULK_MAX), change)
+      );
+    } catch (error62) {
+      return { results, error: error62 };
+    }
+  }
+  return { results, error: void 0 };
 }
 
 // src/commands/summary.ts
 var FORMATS = ["text", "markdown"];
 var SEVERITY_ORDER = [...SEVERITIES].reverse();
 var TRUNCATED_MESSAGE = `Counting the newest ${MAX_LIMIT} complaints only.`;
+var BUDGET_MESSAGE = "The server stopped searching early, so the counts are a floor: narrow the filters or pass --since.";
 var EMPTY_MESSAGE = "No complaints found.";
 async function runSummary(options, context, io) {
   if (options.format !== void 0 && options.json === true) {
     throw new UsageError("--json and --format cannot be used together");
   }
   const format = readFormat(options.format);
-  const { store, client } = openBackend(context, io);
+  const { store, client } = await openBackend(context, io);
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
+    ...options.severity === void 0 ? {} : { severity: options.severity },
+    ...tagFilter(options.tag),
     ...reporter === void 0 ? {} : { reporter },
     limit: MAX_LIMIT
   });
-  const complaints = await listComplaints(store, filter);
-  const truncated = complaints.length === MAX_LIMIT;
+  const page = await listComplaintPage(store, filter);
+  const complaints = page.complaints;
+  const capped = complaints.length === MAX_LIMIT;
+  const truncated = capped || page.truncated;
   const summary = summarizeComplaints(complaints);
   if (options.json === true) {
     writeJson(io.stdout, {
       scope: {
         project: filter.project ?? null,
         status: filter.status ?? null,
+        severity: filter.severity ?? null,
+        tags: filter.tags ?? null,
         since: filter.since ?? null
       },
       truncated,
@@ -25943,7 +27912,8 @@ async function runSummary(options, context, io) {
     writeLine(io.stdout, EMPTY_MESSAGE);
     return 0;
   }
-  const lines = format === "markdown" ? markdownLines(filter, summary, truncated) : textLines(filter, summary, truncated);
+  const note = capped ? TRUNCATED_MESSAGE : page.truncated ? BUDGET_MESSAGE : void 0;
+  const lines = format === "markdown" ? markdownLines(filter, summary, note) : textLines(filter, summary, note);
   for (const line of lines) writeLine(io.stdout, line);
   return 0;
 }
@@ -25958,7 +27928,9 @@ function scopeLabel(filter) {
   const name = filter.project ?? "all projects";
   const since = filter.since === void 0 ? "" : ` since ${filter.since}`;
   const status = filter.status === void 0 ? "" : ` with status ${filter.status}`;
-  return `Complaints for ${name}${since}${status}`;
+  const severity = filter.severity === void 0 ? "" : ` with severity ${filter.severity}`;
+  const tags = filter.tags === void 0 ? "" : ` tagged ${filter.tags.map((tag) => tag === UNTAGGED_TAG ? "untagged" : oneLine(tag)).join(" or ")}`;
+  return `Complaints for ${name}${since}${status}${severity}${tags}`;
 }
 function blocksOf(filter, summary) {
   const severity = SEVERITY_ORDER.filter((name) => summary.bySeverity[name] > 0).map(
@@ -25982,13 +27954,11 @@ function statusCounts(summary) {
   const { open: open2, resolved, dismissed, deleted } = summary.byStatus;
   return `open ${open2}, resolved ${resolved}, dismissed ${dismissed}, deleted ${deleted}`;
 }
-function oneLine(name) {
-  return name.replace(/\s+/g, " ");
-}
+var oneLine = printable;
 function cell(name) {
   return oneLine(name).replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
 }
-function textLines(filter, summary, truncated) {
+function textLines(filter, summary, note) {
   const lines = [`${scopeLabel(filter)}: ${summary.total} (${statusCounts(summary)})`];
   for (const block2 of blocksOf(filter, summary)) {
     const names = block2.rows.map((row) => oneLine(row.name));
@@ -25998,10 +27968,10 @@ function textLines(filter, summary, truncated) {
       lines.push(`  ${(names[index] ?? "").padEnd(width)}  ${row.count}`);
     }
   }
-  if (truncated) lines.push("", TRUNCATED_MESSAGE);
+  if (note !== void 0) lines.push("", note);
   return lines;
 }
-function markdownLines(filter, summary, truncated) {
+function markdownLines(filter, summary, note) {
   const { open: open2, resolved, dismissed, deleted } = summary.byStatus;
   const noun = summary.total === 1 ? "complaint" : "complaints";
   const counts = `${open2} open, ${resolved} resolved, ${dismissed} dismissed, ${deleted} deleted`;
@@ -26016,25 +27986,275 @@ function markdownLines(filter, summary, truncated) {
     );
     for (const row of block2.rows) lines.push(`| ${cell(row.name)} | ${row.count} |`);
   }
-  if (truncated) lines.push("", TRUNCATED_MESSAGE);
+  if (note !== void 0) lines.push("", note);
   return lines;
 }
 
+// src/commands/sync.ts
+import { existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join8 } from "node:path";
+import { Writable as Writable2 } from "node:stream";
+var SYNC_TIMEOUT_MS = 3e3;
+var SECTION_FILES = ["CLAUDE.md", "AGENTS.md"];
+function readOptional3(path) {
+  try {
+    return readFileSync6(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw error62;
+  }
+}
+function holders(root) {
+  const found = [];
+  for (const name of SECTION_FILES) {
+    const path = join8(root, name);
+    const text = readOptional3(path);
+    if (text !== void 0 && findSection(text) !== void 0) {
+      found.push({ path, text, skill: false });
+    }
+  }
+  const skill = join8(root, SKILL_PATH);
+  if (existsSync3(skill)) {
+    found.push({ path: skill, text: readOptional3(skill) ?? "", skill: true });
+  }
+  return found;
+}
+function agentOf(lines, path) {
+  const named = agentOfText(lines);
+  if (named !== void 0) {
+    try {
+      return parseAgentName(named);
+    } catch {
+    }
+  }
+  return agentForFile(path);
+}
+function rewrite(holder, tags, scope) {
+  if (holder.skill) {
+    const agent2 = agentOf(holder.text.split(/\r?\n/), holder.path);
+    return withLineBreak(skillFile(agentSnippet(tags, { ...scope, agent: agent2 })), holder.text);
+  }
+  const section = findSection(holder.text);
+  if (section === void 0) return holder.text;
+  const agent = agentOf(sectionText(section), holder.path);
+  return replaceSection(section, agentSnippet(tags, { ...scope, agent }));
+}
+function sink() {
+  return new Writable2({
+    write(_chunk, _encoding, done) {
+      done();
+    }
+  });
+}
+async function runSync(options, contextOf, io) {
+  if (options.quiet !== true) return sync(options, contextOf(), io);
+  const silent = { ...io, stdout: sink(), stderr: sink() };
+  try {
+    const context = contextOf();
+    context.timeoutMs = SYNC_TIMEOUT_MS;
+    const result = await syncFiles({ hook: options.hook }, context, silent);
+    if (result.files.some((file2) => file2.updated)) {
+      writeLine(io.stdout, refreshedLine(result.project, result.tags));
+    }
+  } catch {
+  }
+  return 0;
+}
+async function sync(options, context, io) {
+  const result = await syncFiles(options, context, io);
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      project: result.project,
+      tags: result.tags ?? null,
+      files: result.files,
+      hook: result.hook ?? null
+    });
+    return 0;
+  }
+  for (const file2 of result.files) {
+    writeLine(
+      io.stdout,
+      file2.updated ? `Updated ${file2.path}` : `${file2.path} is up to date`
+    );
+  }
+  return 0;
+}
+async function syncFiles(options, context, io) {
+  const project = requireProject(context);
+  const root = context.projectRoot ?? io.cwd;
+  let hook;
+  if (options.hook === true) {
+    const plan = planHook(root);
+    const line = applyHook(plan);
+    hook = plan.path;
+    if (options.json !== true) writeLine(io.stdout, line);
+  }
+  const found = holders(root);
+  if (found.length === 0) {
+    throw new UsageError(
+      `no Quibble snippet under ${root}: run quibble snippet --append CLAUDE.md`
+    );
+  }
+  const { tags, scope } = await snippetSource(project, context, io, { queue: false });
+  const files = [];
+  for (const holder of found) {
+    const next = rewrite(holder, tags, scope);
+    const updated = next !== holder.text;
+    if (updated) writeFileSync6(holder.path, next, "utf8");
+    files.push({ path: holder.path, updated });
+  }
+  return { project, tags, files, hook };
+}
+
 // src/commands/tags.ts
 async function runTags(options, context, io) {
   const project = requireProject(context);
   if (context.mode !== "remote") checkActAs(context);
-  const tags = context.mode === "remote" ? (await openOrgClient(context, io).project(project)).tags : context.allowedTags;
+  const tags = context.mode === "remote" ? (await (await openOrgClient(context, io)).project(project)).tags : context.allowedTags;
   if (options.json === true) {
     writeJson(io.stdout, { project, tags: tags ?? null });
     return 0;
   }
-  if (tags === void 0) {
+  printList(project, tags, io);
+  return 0;
+}
+function printList(project, tags, io) {
+  if (tags === void 0 || tags.length === 0) {
     writeLine(io.stdout, `No tags configured for ${project}: any tag is allowed.`);
-    return 0;
+    return;
   }
   for (const tag of tags) writeLine(io.stdout, tag);
   writeLine(io.stdout, OTHER_TAG_HINT);
+}
+async function runTagsEdit(edit, given, options, context, io) {
+  requireServer("tags", context);
+  const project = requireProject(context);
+  if (given.length === 0) throw new UsageError(`tags ${edit} needs at least one tag`);
+  const named = parseAllowedTags(given);
+  const client = await openOrgClient(context, io);
+  let next;
+  if (edit === "set") {
+    next = named;
+  } else {
+    const current = (await client.project(project)).tags ?? [];
+    const combined = edit === "add" ? [...current, ...named.filter((tag) => !current.includes(tag))] : current.filter((tag) => !named.includes(tag));
+    next = combined.length === 0 ? null : parseAllowedTags(combined);
+  }
+  const answer2 = await client.setProjectTags(project, next);
+  if (options.json === true) {
+    writeJson(io.stdout, answer2.body);
+    return 0;
+  }
+  const noun = answer2.retagged === 1 ? "complaint" : "complaints";
+  writeLine(
+    io.stdout,
+    `Updated the tags of ${project}: ${answer2.retagged} ${noun} retagged`
+  );
+  printList(project, answer2.tags, io);
+  return 0;
+}
+
+// src/commands/token.ts
+var COLUMNS3 = ["ID", "NAME", "CREATED", "LAST USED", "EXPIRES", "STATE"];
+function minute(stamp2) {
+  return stamp2.slice(0, 16).replace("T", " ");
+}
+function stateOf(token, now) {
+  if (token.revokedAt !== void 0) return "revoked";
+  if (token.expiresAt !== void 0 && Date.parse(token.expiresAt) <= now.getTime()) {
+    return "expired";
+  }
+  return "active";
+}
+function formatTokens(tokens, now) {
+  const rows2 = tokens.map((token) => [
+    token.id.slice(0, 8),
+    token.name,
+    minute(token.createdAt),
+    token.lastUsedAt === void 0 ? "\u2014" : minute(token.lastUsedAt),
+    token.expiresAt === void 0 ? "never" : minute(token.expiresAt),
+    stateOf(token, now)
+  ]);
+  const widths = COLUMNS3.map(
+    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  );
+  const format = (cells) => cells.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(COLUMNS3), ...rows2.map(format)];
+}
+function scopeOf(context) {
+  requireServer("token", context);
+  return { project: requireProject(context), org: requireOrg(context) };
+}
+async function runTokenCreate(name, options, context, io, now = /* @__PURE__ */ new Date()) {
+  const { project, org } = scopeOf(context);
+  const expiresAt = options.expires === void 0 ? void 0 : parseExpires(options.expires, now);
+  const body = parseNewToken(
+    { name, ...expiresAt === void 0 ? {} : { expiresAt } },
+    now
+  );
+  const client = await openOrgClient(context, io);
+  const minted = await client.createToken(project, body);
+  if (options.json === true) {
+    writeJson(io.stdout, minted.body);
+    return 0;
+  }
+  writeLine(
+    io.stdout,
+    `Created token ${minted.token.name} for ${org}/${project}. It is shown once:`
+  );
+  writeLine(io.stdout, `QUIBBLE_ENDPOINT=${trimSlash2(client.endpoint)}`);
+  writeLine(io.stdout, `QUIBBLE_TOKEN=${minted.plaintext}`);
+  return 0;
+}
+async function runTokenList(options, context, io, now = /* @__PURE__ */ new Date()) {
+  const { project } = scopeOf(context);
+  const answer2 = await (await openOrgClient(context, io)).tokens(project);
+  if (options.json === true) {
+    writeJson(io.stdout, answer2.body);
+    return 0;
+  }
+  if (answer2.tokens.length === 0) {
+    writeLine(io.stdout, `No tokens for ${project}.`);
+    return 0;
+  }
+  for (const line of formatTokens(answer2.tokens, now)) writeLine(io.stdout, line);
+  return 0;
+}
+function findToken(tokens, value) {
+  const named = tokens.find((token) => token.name === value.trim());
+  if (named !== void 0) return named;
+  let read;
+  try {
+    read = readIdValue(value);
+  } catch (error62) {
+    if (error62 instanceof UsageError)
+      throw new NotFoundError(`no token is named ${value}`);
+    throw error62;
+  }
+  const { id, prefix } = read;
+  const matches = tokens.filter(
+    (token) => prefix ? token.id.startsWith(id) : token.id === id
+  );
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) {
+    throw ambiguousError(
+      id,
+      matches.map((token) => token.id),
+      "tokens"
+    );
+  }
+  throw new NotFoundError(`no token is named or starts with ${id}`);
+}
+async function runTokenRevoke(value, options, context, io) {
+  const { project, org } = scopeOf(context);
+  const client = await openOrgClient(context, io);
+  const token = findToken((await client.tokens(project)).tokens, value);
+  await client.revokeToken(project, token.id);
+  if (options.json === true) {
+    writeJson(io.stdout, { id: token.id, name: token.name, revoked: true });
+    return 0;
+  }
+  writeLine(io.stdout, `Revoked token ${token.name} of ${org}/${project}.`);
   return 0;
 }
 
@@ -26049,12 +28269,20 @@ var NON_EMPTY_OPTIONS = [
   "note"
 ];
 var STATUS_COMMANDS = [
-  ["resolve", "resolved", "mark a complaint resolved"],
-  ["dismiss", "dismissed", "dismiss a complaint as a duplicate or as noise"],
-  ["delete", "deleted", "hide a complaint from every default view"],
-  ["reopen", "open", "reopen a complaint, restore a deleted one and remove its note"]
+  ["resolve", "resolved", "mark complaints resolved"],
+  ["dismiss", "dismissed", "dismiss duplicates, won't-fixes or noise"],
+  ["delete", "deleted", "hide complaints from the default views"],
+  ["reopen", "open", "reopen complaints and clear their notes"]
+];
+var TAGS_EDITS = [
+  ["set", "replace the project's allowed tag list"],
+  ["add", "add tags to the allowed tag list"],
+  ["remove", "remove tags from the allowed tag list"]
 ];
+var ID_HELP = `complaint id, or a unique prefix of at least ${SHORT_ID_MIN} characters`;
+var REASON_HELP = `${REASONS.slice(0, -1).join(", ")} or ${REASONS.at(-1) ?? ""}`;
 function packageVersion() {
+  if (typeof QUIBBLE_BUILD_VERSION === "string") return QUIBBLE_BUILD_VERSION;
   const require2 = createRequire(import.meta.url);
   const manifest = require2("../package.json");
   return typeof manifest.version === "string" ? manifest.version : "0.0.0";
@@ -26068,7 +28296,7 @@ function rejectEmptyOptions(options) {
   }
 }
 function withGlobalOptions(command) {
-  return command.option("--local", "use the local store, even when an endpoint is configured").option("--endpoint <url>", "base URL of the Quibble API").option("--org <slug>", "organization of every remote request").option("--json", "print JSON instead of text");
+  return command.option("--local", "use the local store, whatever the endpoint says").option("--endpoint <url>", "API URL, web URL, host, or local").option("--org <slug>", "organization to use in remote mode").option("--json", "print JSON instead of text");
 }
 function globals(program2, command) {
   const outer = program2.opts();
@@ -26106,88 +28334,174 @@ function buildProgram(io, setCode) {
   }).exitOverride();
   withGlobalOptions(program2);
   withGlobalOptions(
-    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name, defaults to the directory name").option("-t, --tag <tag>", "allowed tag of the project, repeatable", collect).option("--force", "overwrite an existing .quibblerc")
-  ).action(function() {
+    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--force", "overwrite an existing .quibblerc or skill file")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runInit(options, io));
+  });
+  withGlobalOptions(
+    program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--hook", "add the quibble sync hook to .claude/settings.json").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")
+  ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(runInit(options, io));
+    setCode(await runSnippet(options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    program2.command("sync").description("rewrite the agent snippet in place with the current tags").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--quiet", "print nothing but a changed tag list, and always exit 0").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    setCode(
+      await runSync(
+        options,
+        () => {
+          rejectEmptyOptions(options);
+          return contextFor(options, io);
+        },
+        io
+      )
+    );
   });
   withGlobalOptions(
-    program2.command("complain").description("file a complaint, reading the message from stdin when omitted").argument("[message]", "the complaint, or `-` to read stdin").option("-s, --severity <level>", "low, medium or high").option("-t, --tag <tag>", "tag, repeatable", collect).option("--agent <name>", "agent that files the complaint").option("--reporter <name>", "person on whose behalf it is filed").option("--project <name>", "project name, overrides the .quibblerc")
+    program2.command("complain").description("file a complaint").argument("[message]", "what went wrong; omit it or pass `-` to read stdin").option("-s, --severity <level>", "low, medium or high").option("-t, --tag <tag>", "tag (repeatable)", collect).option("--agent <name>", "name of the agent filing it").option("--reporter <name>", "person you are filing for (local mode only)").option("--project <name>", "project name (overrides .quibblerc)").option("--cmd <command>", "the command that failed")
   ).action(async function(message) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runComplain(message, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("list").description("list complaints, newest first").option("--project <name>", "list one project").option("--all", "list every project").option("-s, --severity <level>", "low, medium or high").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "only open complaints, short for --status open").option("-t, --tag <tag>", "only complaints with this tag, or `-` for none").option("--mine", "only the complaints of the calling reporter").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--limit <n>", "how many complaints to return")
+    program2.command("list").description("list complaints, newest first").option("--project <name>", "list one project").option("--all", "list all projects").option("-s, --severity <level>", "low, medium or high").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "same as --status open").option(
+      "-t, --tag <tag>",
+      "complaints with any of these tags (repeatable, `-` for untagged)",
+      collect
+    ).option("--mine", "only your own complaints").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--search <text>", "complaints whose message contains the text").option("--limit <n>", "maximum number of complaints").option("--ungroup", "one row per complaint instead of one per group").option("--ids", "print the full id of every complaint, one per line")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runList(options, contextFor(options, io), io));
   });
+  withGlobalOptions(
+    program2.command("show").description("print one whole complaint").argument("<id>", ID_HELP)
+  ).action(async function(id) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runShow(id, options, contextFor(options, io), io));
+  });
   for (const [name, status, description] of STATUS_COMMANDS) {
-    const command = program2.command(name).description(description).argument("<id>", "full id of the complaint");
+    const command = program2.command(name).description(description).argument("<id...>", `${ID_HELP}; \`-\` reads the ids from stdin`);
     if (status !== "open") {
-      command.option("--note <text>", "note that explains the change");
+      command.option("--note <text>", "note explaining the change");
     }
-    withGlobalOptions(command).action(async function(id) {
+    if (status === "resolved" || status === "dismissed") {
+      command.option("--reason <reason>", REASON_HELP).option("--duplicate-of <id>", "the complaint these repeat (implies duplicate)");
+    }
+    withGlobalOptions(command).action(async function(ids) {
       const options = { ...this.opts(), ...globals(program2, this) };
       rejectEmptyOptions(options);
-      setCode(await runStatusChange(status, id, options, contextFor(options, io), io));
+      setCode(await runStatusChange(status, ids, options, contextFor(options, io), io));
     });
   }
   withGlobalOptions(
-    program2.command("retag").description("replace the tags of a complaint").argument("<id>", "full id of the complaint").option("-t, --tag <tag>", "tag, repeatable and needed at least once", collect)
+    program2.command("retag").description("replace a complaint's tags").argument("<id>", ID_HELP).option("-t, --tag <tag>", "tag (repeatable, at least one)", collect)
   ).action(async function(id) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runRetag(id, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("summary").description("count the matching complaints by severity, project and tag").option("--project <name>", "summarize one project").option("--all", "summarize every project").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "only open complaints, short for --status open").option("--mine", "only the complaints of the calling reporter").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--format <format>", "text or markdown")
+    program2.command("summary").description("count complaints by status, severity, project and tag").option("--project <name>", "summarize one project").option("--all", "summarize all projects").option("--status <status>", "open, resolved, dismissed or deleted").option("--open", "same as --status open").option("-s, --severity <level>", "low, medium or high").option(
+      "-t, --tag <tag>",
+      "complaints with any of these tags (repeatable, `-` for untagged)",
+      collect
+    ).option("--mine", "only your own complaints").option("--since <when>", "a duration like 7d, a date or a UTC timestamp").option("--format <format>", "text or markdown")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runSummary(options, contextFor(options, io), io));
   });
-  withGlobalOptions(
-    program2.command("tags").description("print the allowed tags of the project").option("--project <name>", "project name, overrides the .quibblerc")
+  const tags = withGlobalOptions(
+    program2.command("tags").description("print or edit the project's allowed tags").option("--project <name>", "project name (overrides .quibblerc)")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runTags(options, contextFor(options, io), io));
   });
+  for (const [edit, description] of TAGS_EDITS) {
+    withGlobalOptions(
+      tags.command(edit).description(`${description} (remote only)`).argument("[tag...]", "tags").option("--project <name>", "project name (overrides .quibblerc)")
+    ).action(async function(given) {
+      const options = { ...tags.opts(), ...this.opts(), ...globals(program2, this) };
+      rejectEmptyOptions(options);
+      setCode(await runTagsEdit(edit, given, options, contextFor(options, io), io));
+    });
+  }
+  const token = program2.command("token").description("manage the project's tokens (remote only)");
+  withGlobalOptions(
+    token.command("create").description("mint a project token and print it once").argument("<name>", "token name, unique in the project").option("--expires <when>", "a duration like 30d, a date or a UTC timestamp").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function(name) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenCreate(name, options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    token.command("list").description("list the project's tokens").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenList(options, contextFor(options, io), io));
+  });
   withGlobalOptions(
-    program2.command("promote").description("add a suggestion to the allowed tags and retag the complaints").argument("<tag>", "the tag to promote, without the `other:` prefix").option("--project <name>", "project name, overrides the .quibblerc")
+    token.command("revoke").description("revoke a token").argument("<token>", "token name, or an id prefix of at least 6 characters").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function(value) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runTokenRevoke(value, options, contextFor(options, io), io));
+  });
+  const projectCommand = program2.command("project").description("manage the projects of the organization (remote only)");
+  withGlobalOptions(
+    projectCommand.command("delete").description("delete a project and hide its complaints").argument("<name>", "project name").option("--yes", "skip the question")
+  ).action(async function(name) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runProjectDelete(name, options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    program2.command("retry").description("send the complaints queued while offline")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runRetry(options, contextFor(options, io), io));
+  });
+  withGlobalOptions(
+    program2.command("promote").description("turn an `other:` suggestion into an allowed tag and retag complaints").argument("<tag>", "tag to promote, without `other:`").option("--project <name>", "project name (overrides .quibblerc)")
   ).action(async function(tag) {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runPromote(tag, options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("orgs").description("list the organizations the caller belongs to")
+    program2.command("orgs").description("list your organizations")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runOrgs(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("login").description("sign in to the endpoint on the terminal and store the session")
+    program2.command("login").description("log in to the endpoint")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runLogin(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("logout").description("revoke the refresh token and remove the stored session")
+    program2.command("logout").description("log out of the endpoint")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runLogout(contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("whoami").description("print the identity that the API resolves")
+    program2.command("whoami").description("show the current identity")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
@@ -26195,10 +28509,10 @@ function buildProgram(io, setCode) {
   });
   withGlobalOptions(
     program2.command("config").description("print the resolved configuration")
-  ).action(function() {
+  ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(runConfig(options, contextFor(options, io), io));
+    setCode(await runConfig(options, contextFor(options, io), io));
   });
   return program2;
 }
@@ -26206,9 +28520,10 @@ function stripErrorPrefix(message) {
   return message.replace(/^error:\s*/i, "");
 }
 async function main(argv, io) {
-  let code = 0;
+  resetDiscovery();
+  let code2 = 0;
   const program2 = buildProgram(io, (value) => {
-    code = value;
+    code2 = value;
   });
   if (argv.length === 0) {
     io.stdout.write(program2.helpInformation());
@@ -26216,7 +28531,7 @@ async function main(argv, io) {
   }
   try {
     await program2.parseAsync(argv, { from: "user" });
-    return code;
+    return code2;
   } catch (error62) {
     if (error62 instanceof CommanderError) {
       if (error62.code === "commander.help" || error62.code === "commander.helpDisplayed") {
@@ -26238,10 +28553,18 @@ for (const stream of [process2.stdout, process2.stderr]) {
     throw error62;
   });
 }
-process2.exitCode = await main(process2.argv.slice(2), {
+function flushed(stream) {
+  return new Promise((resolve4) => {
+    stream.write("", () => resolve4());
+  });
+}
+var code = await main(process2.argv.slice(2), {
   stdin: process2.stdin,
   stdout: process2.stdout,
   stderr: process2.stderr,
   env: process2.env,
   cwd: process2.cwd()
 });
+process2.exitCode = code;
+await Promise.all([flushed(process2.stdout), flushed(process2.stderr)]);
+process2.exit(code);