paratix 0.12.8 → 0.13.0

package/dist/cli.js

@@ -307,83 +307,82 @@ function describeHostValidationFailure(failure) {
   }
 }
 
-// src/output.ts
-import pc from "picocolors";
+// src/dryRunDispatch.ts
+function shouldExecuteApplyDuringDryRun(module, diffEnabled) {
+  if (module._dryRunBlocker === true || module._dryRunMetaProducer === true) return true;
+  if (diffEnabled && module._dryRunDiffProducer === true && module._applyDryRun != null) return true;
+  return module._applyDryRun != null && module._dryRunDiffProducer !== true;
+}
 
-// src/outputFormatting.ts
-import { stripVTControlCharacters } from "util";
-var PACKAGE_MODULE_SUFFIX_LENGTH = 2;
-var PACKAGE_COLUMN_GAP_WIDTH = 2;
-var DEFAULT_TERMINAL_COLUMNS = 100;
-var MIN_PACKAGE_COLUMNS_WIDTH = 24;
-var MIN_PACKAGE_COLUMN_WIDTH = 18;
-var MIN_ANIMATED_LINE_COLUMNS = 8;
-function splitPackageModuleName(name) {
-  for (const prefix of ["package.installed: ", "package.absent: "]) {
-    if (!name.startsWith(prefix)) continue;
-    const packages = name.slice(prefix.length).split(",").map((entry) => entry.trim()).filter(Boolean);
-    if (packages.length === 0) return null;
-    return {
-      packages,
-      summaryName: prefix.slice(0, -PACKAGE_MODULE_SUFFIX_LENGTH)
-    };
+// src/knownHosts.ts
+import { createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { appendFile, mkdir, readFile as readFile2, stat as stat2 } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/knownHostPatterns.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var HASHED_HOST_PARTS = 4;
+function matchesKnownHostPatternList(patterns, needle) {
+  let matchedPositivePattern = false;
+  for (const rawPattern of patterns) {
+    const negated = rawPattern.startsWith("!");
+    const pattern = negated ? rawPattern.slice(1) : rawPattern;
+    if (pattern.length === 0) continue;
+    const matched = matchesHashedHost(pattern, needle) || matchesPlainHostPattern(pattern, needle);
+    if (!matched) continue;
+    if (negated) return false;
+    matchedPositivePattern = true;
   }
-  return null;
+  return matchedPositivePattern;
 }
-function getPackageColumns(parameters) {
-  if (parameters.packages.length <= 1) return parameters.packages;
-  const availableWidth = Math.max(
-    (parameters.terminalColumns ?? DEFAULT_TERMINAL_COLUMNS) - parameters.continuationIndentWidth,
-    MIN_PACKAGE_COLUMNS_WIDTH
-  );
-  const widestPackage = Math.max(...parameters.packages.map((entry) => entry.length));
-  const columnWidth = Math.max(widestPackage + PACKAGE_COLUMN_GAP_WIDTH, MIN_PACKAGE_COLUMN_WIDTH);
-  const columnCount = Math.max(Math.floor(availableWidth / columnWidth), 1);
-  const rowCount = Math.ceil(parameters.packages.length / columnCount);
-  return Array.from(
-    { length: rowCount },
-    (_row, rowIndex) => Array.from({ length: columnCount }, (_column, columnIndex) => {
-      const packageIndex = rowIndex + columnIndex * rowCount;
-      const packageName = parameters.packages.at(packageIndex);
-      if (packageName == null) return "";
-      const isLastVisibleColumn = columnIndex === columnCount - 1 || packageIndex + rowCount >= parameters.packages.length;
-      return isLastVisibleColumn ? packageName : packageName.padEnd(columnWidth);
-    }).filter(Boolean).join("")
-  );
+function matchesPlainHostPattern(pattern, needle) {
+  if (pattern.startsWith("|1|")) return false;
+  return matchesHostPattern(pattern.toLowerCase(), needle.toLowerCase());
 }
-function getPackageSummaryDetail(packageCount, detail) {
-  const packageLabel = packageCount === 1 ? "1 package" : `${packageCount} packages`;
-  return detail == null ? packageLabel : `${packageLabel} \xB7 ${detail}`;
+function matchesHashedHost(pattern, needle) {
+  if (!pattern.startsWith("|1|")) return false;
+  const parts = pattern.split("|");
+  if (parts.length !== HASHED_HOST_PARTS || parts[1] !== "1") return false;
+  const salt = Buffer.from(parts[2] ?? "", "base64");
+  const expectedHash = Buffer.from(parts[3] ?? "", "base64");
+  if (salt.length === 0 || expectedHash.length === 0) return false;
+  const actualHash = createHmac("sha1", salt).update(needle).digest();
+  return actualHash.length === expectedHash.length && timingSafeEqual(actualHash, expectedHash);
 }
-function fitAnimatedModuleLine(line, columns) {
-  if (columns === void 0 || columns < MIN_ANIMATED_LINE_COLUMNS) return line;
-  const plainLine = stripVTControlCharacters(line);
-  if (plainLine.length < columns) return line;
-  return `${plainLine.slice(0, columns - 1)}\u2026`;
+function matchesHostPattern(pattern, needle) {
+  let state = { needleIndex: 0, patternIndex: 0, starIndex: -1, starNeedleIndex: 0 };
+  while (state.needleIndex < needle.length) {
+    const nextState = advanceHostPatternMatch(pattern, needle, state);
+    if (nextState === null) return false;
+    state = nextState;
+  }
+  while (pattern[state.patternIndex] === "*") state.patternIndex += 1;
+  return state.patternIndex === pattern.length;
 }
-function formatDisplayModule(parameters) {
-  const packageModule = splitPackageModuleName(parameters.name);
-  if (packageModule == null) {
+function advanceHostPatternMatch(pattern, needle, state) {
+  const patternCharacter = pattern[state.patternIndex];
+  if (patternCharacter === "?" || patternCharacter === needle[state.needleIndex]) {
+    return { ...state, needleIndex: state.needleIndex + 1, patternIndex: state.patternIndex + 1 };
+  }
+  if (patternCharacter === "*") {
     return {
-      detail: parameters.detail,
-      detailLines: [],
-      name: parameters.name
+      ...state,
+      patternIndex: state.patternIndex + 1,
+      starIndex: state.patternIndex,
+      starNeedleIndex: state.needleIndex
     };
   }
+  if (state.starIndex === -1) return null;
+  const starNeedleIndex = state.starNeedleIndex + 1;
   return {
-    detail: getPackageSummaryDetail(packageModule.packages.length, parameters.detail),
-    detailLines: parameters.status === "waiting" ? [] : getPackageColumns({
-      continuationIndentWidth: parameters.continuationIndentWidth,
-      packages: packageModule.packages,
-      terminalColumns: parameters.terminalColumns
-    }),
-    name: packageModule.summaryName
+    ...state,
+    needleIndex: starNeedleIndex,
+    patternIndex: state.starIndex + 1,
+    starNeedleIndex
   };
 }
 
-// src/secretSink.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-
 // src/sshHelpers.ts
 import { StringDecoder } from "string_decoder";
 
@@ -911,1320 +910,1330 @@ async function tryConnectOnPort(parameters) {
   });
 }
 
-// src/secretSink.ts
-var secretCounts = /* @__PURE__ */ new Map();
-var runScopedSecretCounts = new AsyncLocalStorage2();
-var REDACTED_PLACEHOLDER = REDACTED_SECRET_FIELD_PLACEHOLDER;
-var CIRCULAR_PLACEHOLDER = "[Circular]";
-function assertRegistrableSecret(secret) {
-  if (secret.includes(REDACTED_PLACEHOLDER)) {
-    throw new Error("Secret registrations must not contain the redaction placeholder");
-  }
-}
-var MINIMUM_SECRET_LENGTH = 8;
-function registerSecret(secret) {
-  if (secret.length < MINIMUM_SECRET_LENGTH) return;
-  assertRegistrableSecret(secret);
-  secretCounts.set(secret, (secretCounts.get(secret) ?? 0) + 1);
-}
-function unregisterSecret(secret) {
-  if (secret.length < MINIMUM_SECRET_LENGTH) return;
-  const current = secretCounts.get(secret);
-  if (current == null) return;
-  if (current <= 1) {
-    secretCounts.delete(secret);
-    return;
-  }
-  secretCounts.set(secret, current - 1);
+// src/knownHosts.ts
+var knownHostsLock = Promise.resolve();
+async function withKnownHostsLock(operation) {
+  const previous = knownHostsLock;
+  const next = previous.then(async () => operation());
+  knownHostsLock = next.catch(() => null);
+  return next;
 }
-async function withRegisteredSecrets(secrets, body) {
-  const registered = [];
-  const registerableSecrets = secrets.filter((secret) => secret.length >= MINIMUM_SECRET_LENGTH);
-  for (const secret of secrets) {
-    assertRegistrableSecret(secret);
+var HostKeyVerificationError = class _HostKeyVerificationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HostKeyVerificationError";
+    Error.captureStackTrace(this, _HostKeyVerificationError);
   }
-  try {
-    for (const secret of registerableSecrets) {
-      registerSecret(secret);
-      registered.push(secret);
-    }
-    const result = await body();
-    return maskScopedResult(result, secrets);
-  } catch (error) {
-    throw maskScopedError(error, secrets);
-  } finally {
-    for (const secret of registered) {
-      unregisterSecret(secret);
-    }
+};
+var KnownHostsValidationError = class _KnownHostsValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "KnownHostsValidationError";
+    Error.captureStackTrace(this, _KnownHostsValidationError);
   }
+};
+var MIN_KNOWN_HOSTS_FIELDS = 3;
+var DEFAULT_SSH_PORT = 22;
+var UINT32_SIZE = 4;
+var STRICT_BASE64_PATTERN = new RegExp("^[A-Za-z0-9+\\/]+=*$", "v");
+var CERT_AUTHORITY_MESSAGE = "HOST KEY VERIFICATION FAILED \u2014 known_hosts contains a @cert-authority entry, but paratix does not validate certificate-authority host keys. Remove the @cert-authority marker or pin the host with ssh.expectedHostFingerprint / ssh.expectedHostPublicKey instead.";
+var defaultHostKeyCache = /* @__PURE__ */ new Map();
+function createHostKeyCache() {
+  return /* @__PURE__ */ new Map();
 }
-async function withRunScopedSecrets(body) {
-  if (runScopedSecretCounts.getStore() != null) {
-    return body();
-  }
-  const scopedSecrets = /* @__PURE__ */ new Map();
-  try {
-    return await runScopedSecretCounts.run(scopedSecrets, body);
-  } finally {
-    for (const [secret, count] of scopedSecrets) {
-      for (let index = 0; index < count; index += 1) {
-        unregisterSecret(secret);
-      }
-    }
-  }
+function parseKnownHostsLine(line) {
+  const parts = line.split(new RegExp("\\s+", "v"));
+  const offset = parts[0]?.startsWith("@") ? 1 : 0;
+  if (parts.length < MIN_KNOWN_HOSTS_FIELDS + offset) return [];
+  const marker = offset === 1 ? parts[0] : void 0;
+  const hostsPart = parts[offset];
+  const algo = parts[offset + 1];
+  const base64Key = parts[offset + 2];
+  if (!STRICT_BASE64_PATTERN.test(base64Key)) return [];
+  const key = Buffer.from(base64Key, "base64");
+  const hostPatterns = hostsPart.split(",");
+  return hostPatterns.map((host) => ({ algo, host, hostPatterns, key, marker }));
 }
-function maskScopedResult(result, secrets) {
-  if (secrets.length === 0 || !isModuleResult(result)) return result;
-  const secretList = [...secrets];
-  let next = result;
-  if (result.detail != null) {
-    const maskedDetail = maskSecrets(result.detail, secretList);
-    if (maskedDetail !== result.detail) {
-      next = { ...result, detail: maskedDetail };
-    }
-  }
-  if (isModuleResult(next) && next.status === "failed" && next.error != null) {
-    next = { ...next, error: maskScopedError(next.error, secrets) };
+function parseKnownHosts(content) {
+  const entries = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    entries.push(...parseKnownHostsLine(line));
   }
-  return next;
-}
-function isModuleResult(value) {
-  return typeof value === "object" && value !== null && "status" in value && typeof value.status === "string";
+  return entries;
 }
-function maskCauseValue(cause, secrets, secretList) {
-  if (cause === void 0) return void 0;
-  if (cause instanceof Error) return maskScopedError(cause, secrets);
-  return maskSecrets(stringifyCause(cause, secretList), secretList);
+function formatHostNeedle(host, port) {
+  return port === DEFAULT_SSH_PORT ? host : `[${host}]:${port}`;
 }
-function buildMaskedErrorClone(error, maskedMessage, secretList) {
-  if (error instanceof CommandError) {
-    return new CommandError(
-      maskedMessage,
-      maskSecrets(error.fullStdout, secretList),
-      maskSecrets(error.fullStderr, secretList)
+function assertSafeHostForKnownHosts(host) {
+  const hostValidationFailure = validateHostLabel(host);
+  if (hostValidationFailure == null) return;
+  throw new KnownHostsValidationError(
+    `Refusing to persist known_hosts entry: host label ${describeHostValidationFailure(hostValidationFailure)}`
+  );
+}
+function matchesKnownHostEntry(entry, needle) {
+  return matchesKnownHostPatternList(entry.hostPatterns ?? [entry.host], needle);
+}
+function findMatchingEntries(entries, host, port) {
+  const needle = formatHostNeedle(host, port);
+  return entries.filter((entry) => matchesKnownHostEntry(entry, needle));
+}
+function findRevokedEntry(entries, key) {
+  return entries.find(
+    (entry) => entry.marker === "@revoked" && entry.key.length === key.length && timingSafeEqual2(entry.key, key)
+  );
+}
+function throwHostKeyMismatch(host, presentedKey, existingKey) {
+  const presentedAlgo = describeAlgoForDiagnostics(presentedKey);
+  const knownHostsDetails = existingKey == null ? "remote host key does not match the key in known_hosts. " : `remote host key (${presentedAlgo}) does not match the key in known_hosts (${describeAlgoForDiagnostics(existingKey)}). `;
+  throw new HostKeyVerificationError(
+    `HOST KEY VERIFICATION FAILED for ${host}: ${knownHostsDetails}This could indicate a man-in-the-middle attack.`
+  );
+}
+function verifyHostKeyAgainstKnownEntries(parameters) {
+  const { cachedKey, fileEntries, host, key } = parameters;
+  const revokedKey = findRevokedEntry(fileEntries, key);
+  if (revokedKey != null) {
+    throw new HostKeyVerificationError(
+      `HOST KEY VERIFICATION FAILED for ${host}: remote host key (${describeAlgoForDiagnostics(revokedKey.key)}) is marked as revoked in known_hosts.`
     );
   }
-  const clone = Object.create(Object.getPrototypeOf(error));
-  Object.defineProperty(clone, "message", {
-    configurable: true,
-    value: maskedMessage,
-    writable: true
-  });
-  return clone;
+  if (fileEntries.some((entry) => entry.marker === "@cert-authority"))
+    throw new HostKeyVerificationError(`${host}: ${CERT_AUTHORITY_MESSAGE}`);
+  const rawHostKeyEntries = fileEntries.filter((entry) => entry.marker == null);
+  const matchingEntry = rawHostKeyEntries.find(
+    (entry) => entry.key.length === key.length && timingSafeEqual2(entry.key, key)
+  );
+  if (matchingEntry != null) return true;
+  if (cachedKey?.length === key.length && timingSafeEqual2(cachedKey, key)) {
+    return true;
+  }
+  const firstRawHostKey = rawHostKeyEntries.at(0)?.key;
+  if (firstRawHostKey != null) throwHostKeyMismatch(host, key, firstRawHostKey);
+  if (cachedKey != null) throwHostKeyMismatch(host, key, cachedKey);
+  return false;
 }
-function maskScopedError(error, secrets) {
-  if (!(error instanceof Error) || secrets.length === 0) {
-    return error instanceof Error ? error : new Error(maskSecrets(String(error), [...secrets]));
+function extractAlgoFromKey(keyBuffer) {
+  if (keyBuffer.length < UINT32_SIZE) {
+    throw new Error("Invalid SSH key buffer: too short to contain algorithm length");
   }
-  const secretList = [...secrets];
-  const maskedMessage = maskSecrets(error.message, secretList);
-  const maskedStack = error.stack == null ? void 0 : maskSecrets(error.stack, secretList);
-  const maskedCause = maskCauseValue(error.cause, secrets, secretList);
-  const clone = buildMaskedErrorClone(error, maskedMessage, secretList);
-  clone.name = error.name;
-  if (maskedStack != null) {
-    Object.defineProperty(clone, "stack", {
-      configurable: true,
-      value: maskedStack,
-      writable: true
-    });
+  const algoLength = keyBuffer.readUInt32BE(0);
+  if (algoLength === 0 || UINT32_SIZE + algoLength > keyBuffer.length) {
+    throw new Error("Invalid SSH key buffer: algorithm length exceeds buffer size");
   }
-  if (maskedCause !== void 0) {
-    Object.defineProperty(clone, "cause", {
-      configurable: true,
-      value: maskedCause,
-      writable: true
-    });
+  const algo = keyBuffer.subarray(UINT32_SIZE, UINT32_SIZE + algoLength).toString("ascii");
+  if (!PINNED_HOST_KEY_ALGORITHM_PATTERN.test(algo)) {
+    throw new KnownHostsValidationError(`Invalid SSH key buffer: unsupported algorithm '${algo}'`);
   }
-  return clone;
-}
-function stringifyCause(cause, secretList) {
-  if (typeof cause === "string") return cause;
-  if (typeof cause === "function")
-    return cause.name.length > 0 ? `[Function: ${cause.name}]` : "[Function]";
-  if (typeof cause === "number") return String(cause);
-  if (typeof cause === "boolean") return String(cause);
-  if (typeof cause === "bigint") return String(cause);
-  if (typeof cause === "symbol") return String(cause);
-  if (cause === void 0) return String(cause);
-  if (cause === null) return "null";
-  return stringifyObjectCause(cause, secretList);
+  return algo;
 }
-function stringifyObjectCause(cause, secretList) {
+function describeAlgoForDiagnostics(keyBuffer) {
   try {
-    const serialized = JSON.stringify(normalizeObjectCause(cause, secretList, /* @__PURE__ */ new WeakSet()));
-    return serialized ?? Object.prototype.toString.call(cause);
+    return extractAlgoFromKey(keyBuffer);
   } catch {
-    return Object.prototype.toString.call(cause);
+    return "<unknown>";
   }
 }
-function normalizeObjectCause(cause, secretList, seen) {
-  if (isBinaryCauseValue(cause)) return REDACTED_PLACEHOLDER;
-  if (cause instanceof Date) return cause.toJSON();
-  if (seen.has(cause)) return CIRCULAR_PLACEHOLDER;
-  seen.add(cause);
+function computeFingerprint(key) {
+  const hash = createHash("sha256").update(key).digest("base64");
+  return `SHA256:${hash.replaceAll("=", "")}`;
+}
+async function appendHostKey(host, port, keyBuffer) {
+  assertSafeHostForKnownHosts(host);
+  const hostLabel = formatHostNeedle(host, port);
+  const algo = extractAlgoFromKey(keyBuffer);
+  const base64Key = keyBuffer.toString("base64");
+  if (new RegExp("\\s", "v").test(hostLabel)) {
+    throw new KnownHostsValidationError(
+      `Refusing to persist known_hosts entry: host label contains whitespace`
+    );
+  }
+  if (new RegExp("\\s", "v").test(algo)) {
+    throw new KnownHostsValidationError(
+      `Refusing to persist known_hosts entry: algorithm contains whitespace`
+    );
+  }
+  if (new RegExp("\\s", "v").test(base64Key)) {
+    throw new KnownHostsValidationError(
+      `Refusing to persist known_hosts entry: base64 key contains whitespace`
+    );
+  }
+  const line = `${hostLabel} ${algo} ${base64Key}
+`;
+  const sshDirectory = join(homedir(), ".ssh");
+  const filePath = join(sshDirectory, "known_hosts");
+  await withKnownHostsLock(async () => {
+    await mkdir(sshDirectory, { mode: 448, recursive: true });
+    const existingEntries = await loadKnownHostEntries();
+    const matchingRawHostEntries = existingEntries.filter(
+      (entry) => entry.marker == null && matchesKnownHostEntry(entry, hostLabel)
+    );
+    const alreadyTrusted = matchingRawHostEntries.some(
+      (entry) => entry.algo === algo && entry.key.length === keyBuffer.length && timingSafeEqual2(entry.key, keyBuffer)
+    );
+    if (alreadyTrusted) return;
+    const conflictingEntry = matchingRawHostEntries.find(
+      (entry) => entry.key.length !== keyBuffer.length || !timingSafeEqual2(entry.key, keyBuffer)
+    );
+    if (conflictingEntry != null) throwHostKeyMismatch(host, keyBuffer, conflictingEntry.key);
+    await appendFile(filePath, line, { mode: 384 });
+  });
+}
+function getFileSystemErrorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+}
+var KIBIBYTE_BYTES = 1024;
+var MEBIBYTE_BYTES = KIBIBYTE_BYTES * KIBIBYTE_BYTES;
+var KNOWN_HOSTS_FILE_LIMIT_MIB = 16;
+var KNOWN_HOSTS_FILE_BYTE_LIMIT = KNOWN_HOSTS_FILE_LIMIT_MIB * MEBIBYTE_BYTES;
+async function loadKnownHostEntries() {
+  const filePath = join(homedir(), ".ssh", "known_hosts");
   try {
-    if (Array.isArray(cause)) {
-      return cause.map((value) => normalizeCausePropertyValue(value, secretList, seen));
+    const stats = await stat2(filePath);
+    if (stats.size > KNOWN_HOSTS_FILE_BYTE_LIMIT) {
+      throw new HostKeyVerificationError(
+        `Refusing to read known_hosts at ${filePath}: size ${stats.size} bytes exceeds the ${KNOWN_HOSTS_FILE_BYTE_LIMIT}-byte cap`
+      );
     }
-    const normalized = {};
-    for (const [key, value] of Object.entries(cause)) {
-      if (isSecretDiagnosticField(key)) {
-        normalized[key] = REDACTED_PLACEHOLDER;
-        continue;
-      }
-      normalized[key] = normalizeCausePropertyValue(value, secretList, seen);
+    return parseKnownHosts(await readFile2(filePath, "utf8"));
+  } catch (error) {
+    if (error instanceof HostKeyVerificationError) throw error;
+    if (getFileSystemErrorCode(error) === "ENOENT") {
+      return [];
     }
-    return normalized;
-  } finally {
-    seen.delete(cause);
+    throw new HostKeyVerificationError(
+      `Could not read known_hosts at ${filePath}: ${String(error)}`
+    );
   }
 }
-function normalizeCausePropertyValue(value, secretList, seen) {
-  if (value === null) return null;
-  if (typeof value === "bigint") return String(value);
-  if (typeof value !== "object") return value;
-  return normalizeObjectCause(value, secretList, seen);
-}
-function isBinaryCauseValue(value) {
-  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
+function formatAcceptedHostKeyWarning(host, key) {
+  try {
+    const algo = extractAlgoFromKey(key);
+    const fingerprint = computeFingerprint(key);
+    return `WARNING: Permanently added '${host}' (${algo}) to the list of known hosts. Fingerprint: ${fingerprint}
+`;
+  } catch {
+    return `WARNING: Permanently added '${host}' to the list of known hosts.
+`;
+  }
 }
-function getRegisteredSecrets() {
-  return [...secretCounts.keys()];
+function writeHostKeyPersistFallbackWarning(host, port, error) {
+  const keyscanArguments = port === DEFAULT_SSH_PORT ? shellQuote(host) : `-p ${port} ${shellQuote(host)}`;
+  process.stderr.write(
+    `WARNING: Could not persist host key for ${host} \u2014 the key is cached in memory for this session. To persist it, ensure ~/.ssh/ is writable or run: ssh-keyscan ${keyscanArguments} >> ~/.ssh/known_hosts. ${String(error)}
+`
+  );
 }
-function clearRegisteredSecrets() {
-  secretCounts.clear();
+async function acceptAndPersistHostKey(location, key, cache) {
+  const { host, port } = location;
+  const acceptedWarning = formatAcceptedHostKeyWarning(host, key);
+  try {
+    await appendHostKey(host, port, key);
+  } catch (error) {
+    if (error instanceof HostKeyVerificationError || error instanceof KnownHostsValidationError) {
+      throw error;
+    }
+    cache.set(formatHostNeedle(host, port), key);
+    process.stderr.write(acceptedWarning);
+    writeHostKeyPersistFallbackWarning(host, port, error);
+    return;
+  }
+  cache.set(formatHostNeedle(host, port), key);
+  process.stderr.write(acceptedWarning);
 }
-function maskRegisteredSecrets(text) {
-  if (secretCounts.size === 0) return text;
-  return maskSecrets(text, getRegisteredSecrets());
+var PINNED_HOST_KEY_ALGORITHM_PATTERN = new RegExp("^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-(?:nistp256|nistp384|nistp521))$", "v");
+function normalizePinnedPublicKey(publicKey) {
+  const parts = publicKey.trim().split(new RegExp("\\s+", "v"));
+  if (parts.length < 2) {
+    throw new Error("Expected host public key must use the format '<algorithm> <base64>'");
+  }
+  const [algorithm, key] = parts;
+  if (!PINNED_HOST_KEY_ALGORITHM_PATTERN.test(algorithm)) {
+    throw new Error(
+      `Expected host public key uses unsupported algorithm '${algorithm}'. Supported algorithms: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521.`
+    );
+  }
+  if (!STRICT_BASE64_PATTERN.test(key)) {
+    throw new Error(
+      "Expected host public key contains invalid base64 in the key field. Use the exact value from `ssh-keygen -y` or the second field of an OpenSSH known_hosts line."
+    );
+  }
+  return `${algorithm} ${key}`;
 }
-
-// src/output.ts
-var CAUSE_INSPECT_DEPTH = 2;
-var CAUSE_INSPECT_MAX_STRING_LENGTH = 1024;
-var CAUSE_REDACT_BINARY_MAX_DEPTH = CAUSE_INSPECT_DEPTH + 1;
-var MODULE_NAME_WIDTH = 56;
-var MIN_MODULE_NAME_WIDTH = 12;
-var OUTPUT_INDENT_UNIT = "  ";
-var SPINNER_FRAME_INTERVAL_MS = 80;
-var ASCII_ESC = 27;
-var ANSI_HIDE_CURSOR = `${String.fromCharCode(ASCII_ESC)}[?25l`;
-var ANSI_SHOW_CURSOR = `${String.fromCharCode(ASCII_ESC)}[?25h`;
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var STATUS_ICONS = {
-  changed: pc.yellow("\u21BA"),
-  failed: pc.red("\u2717"),
-  ok: pc.green("\u2713"),
-  skipped: pc.dim("\u2298"),
-  waiting: pc.cyan("\u23F8")
-};
-var CLI_HEADER_LINES = [
-  "                        _   _      ",
-  "                       | | (_)     ",
-  "  _ __   __ _ _ __ __ _| |_ ___  __",
-  " | '_ \\ / _` | '__/ _` | __| \\ \\/ /",
-  " | |_) | (_| | | | (_| | |_| |>  < ",
-  " | .__/ \\__,_|_|  \\__,_|\\__|_/_/\\_\\",
-  " | |                               ",
-  " |_|  "
-];
-var LIVE_OUTPUT_STATE_KEY = /* @__PURE__ */ Symbol.for("paratix.output.liveState");
-function getSharedLiveOutputState() {
-  const registry = globalThis;
-  const existing = registry[LIVE_OUTPUT_STATE_KEY];
-  if (existing != null) return existing;
-  const created = {
-    activeRecipeGuideDepths: [],
-    activeSpinner: null,
-    cursorHidden: false,
-    pendingRecipeClosureGuideDepths: [],
-    recipeOutputDepth: -1
-  };
-  registry[LIVE_OUTPUT_STATE_KEY] = created;
-  return created;
-}
-var liveOutputState = getSharedLiveOutputState();
-function renderCliHeader(version) {
-  const versionText = pc.dim(`v${version}`);
-  return `${pc.cyan(CLI_HEADER_LINES.join("\n"))}${versionText}
-`;
+function validateExpectedHostPublicKey(publicKey) {
+  try {
+    normalizePinnedPublicKey(publicKey);
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
 }
-function printCliHeader(version) {
-  console.log(renderCliHeader(version));
+function formatPresentedPublicKey(key) {
+  try {
+    return `${extractAlgoFromKey(key)} ${key.toString("base64")}`;
+  } catch {
+    return null;
+  }
 }
-function supportsAnimatedModuleOutput() {
-  return process.stdout.isTTY && typeof process.stdout.clearLine === "function" && typeof process.stdout.cursorTo === "function";
+function hasPinnedHostTrustAnchor(options) {
+  return options?.expectedHostFingerprint != null || options?.expectedHostPublicKey != null;
 }
-function getModuleIcon(status, waitingFrame) {
-  return status === "waiting" ? pc.cyan(waitingFrame ?? "|") : STATUS_ICONS[status];
+function verifyPinnedHostKey(host, key, options) {
+  const normalizedExpectedPublicKey = options.expectedHostPublicKey == null ? null : normalizePinnedPublicKey(options.expectedHostPublicKey);
+  const expectedFingerprint = options.expectedHostFingerprint ?? null;
+  const presentedPublicKey = formatPresentedPublicKey(key);
+  const presentedFingerprint = computeFingerprint(key);
+  const publicKeyMatches = normalizedExpectedPublicKey == null || presentedPublicKey != null && normalizedExpectedPublicKey === presentedPublicKey;
+  const fingerprintMatches = expectedFingerprint == null || expectedFingerprint === presentedFingerprint;
+  if (publicKeyMatches && fingerprintMatches) {
+    return;
+  }
+  throw new HostKeyVerificationError(
+    `HOST KEY VERIFICATION FAILED for ${host}: the remote host key does not match the configured trust anchor.`
+  );
 }
-function getModuleStatusText(status) {
-  switch (status) {
-    case "changed": {
-      return pc.yellow(status);
-    }
-    case "failed": {
-      return pc.red(status);
-    }
-    case "ok": {
-      return pc.green(status);
-    }
-    case "skipped": {
-      return pc.dim(status);
-    }
-    case "waiting": {
-      return pc.cyan("running");
+async function buildHostVerifier(mode, location, options = {}) {
+  const cache = options.cache ?? defaultHostKeyCache;
+  const { host, port } = location;
+  if (mode === "no" && !hasPinnedHostTrustAnchor(options)) return {};
+  const entries = await withKnownHostsLock(loadKnownHostEntries);
+  const fileEntries = findMatchingEntries(entries, host, port);
+  const cachedKey = cache.get(formatHostNeedle(host, port)) ?? null;
+  let acceptedHostKey = null;
+  const result = {
+    async commitAcceptedHostKey() {
+      if (acceptedHostKey != null) await acceptAndPersistHostKey(location, acceptedHostKey, cache);
+    },
+    hostVerifier(key) {
+      if (mode !== "no" && verifyHostKeyAgainstKnownEntries({ cachedKey, fileEntries, host, key })) {
+        if (hasPinnedHostTrustAnchor(options)) verifyPinnedHostKey(host, key, options);
+        return true;
+      }
+      if (hasPinnedHostTrustAnchor(options)) {
+        verifyPinnedHostKey(host, key, options);
+        return true;
+      }
+      if (mode === "yes") {
+        throw new HostKeyVerificationError(
+          `Host key for ${host} not found in known_hosts. Set strictHostKeyChecking to "accept-new" for explicit TOFU or configure ssh.expectedHostFingerprint / ssh.expectedHostPublicKey.`
+        );
+      }
+      if (mode === "no") return true;
+      acceptedHostKey = Buffer.from(key);
+      return true;
     }
-  }
+  };
+  return result;
 }
-function getCurrentOutputDepth() {
-  return Math.max(liveOutputState.recipeOutputDepth, 0);
+
+// src/serverDefinitionValidation.ts
+var STRICT_HOST_KEY_ERROR = `Invalid property 'ssh.strictHostKeyChecking' (expected "accept-new", "no", or "yes")`;
+var MAX_TCP_PORT = 65535;
+function describeType(value) {
+  return value === null ? "null" : typeof value;
 }
-function getGuideDot(depth) {
-  return depth % 2 === 0 ? pc.gray("\xB7") : pc.cyan("\xB7");
+function isHostKeyMode(value) {
+  return value === "accept-new" || value === "no" || value === "yes";
 }
-function buildGuideIndent(baseIndent, options) {
-  const indentCharacters = Array.from(baseIndent);
-  const guideDepths = [
-    ...options?.activeGuideDepths ?? liveOutputState.activeRecipeGuideDepths,
-    ...options?.extraGuideDepths ?? []
-  ];
-  for (const guideDepth of guideDepths) {
-    const guideCharacterIndex = OUTPUT_INDENT_UNIT.length * (guideDepth + 1);
-    if (guideCharacterIndex >= indentCharacters.length) continue;
-    indentCharacters[guideCharacterIndex] = options?.colorize === false ? "\xB7" : getGuideDot(guideDepth);
-  }
-  return indentCharacters.join("");
+function isRecord(value) {
+  return Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;
 }
-function clearPendingRecipeClosureGuides() {
-  liveOutputState.pendingRecipeClosureGuideDepths = [];
+function collectOptionalBooleanErrors(object, key, errors) {
+  if (!(key in object) || object[key] == null) return;
+  if (typeof object[key] !== "boolean") {
+    errors.push(
+      `Invalid property 'ssh.${key}' (expected boolean, got ${describeType(object[key])})`
+    );
+  }
 }
-function getModuleIndent() {
-  if (liveOutputState.recipeOutputDepth < 0) {
-    return OUTPUT_INDENT_UNIT;
+function collectOptionalNumberErrors(parameters) {
+  const { errors, key, object, options } = parameters;
+  if (!(key in object) || object[key] == null) return;
+  const value = object[key];
+  const validatedNumber = validateNumberValue(value);
+  if (validatedNumber == null) {
+    errors.push(`Invalid property 'ssh.${key}' (expected number, got ${describeType(value)})`);
+    return;
+  }
+  if (options?.integer === true && !Number.isInteger(validatedNumber)) {
+    errors.push(`Property 'ssh.${key}' must be an integer`);
+    return;
+  }
+  if (options?.positive === true && validatedNumber <= 0) {
+    errors.push(`Property 'ssh.${key}' must be greater than 0`);
   }
-  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 2);
 }
-function getRecipeHeaderIndent() {
-  if (liveOutputState.recipeOutputDepth < 0) return "";
-  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 1);
+function validateNumberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
-function getErrorIndent() {
-  return `${getModuleIndent()}\u2502 `;
+function isValidTcpPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= MAX_TCP_PORT;
 }
-function getContinuationIndent() {
-  return `${getModuleIndent()}   `;
+function collectOptionalStringErrors(object, key, errors) {
+  if (!(key in object) || object[key] == null) return;
+  if (typeof object[key] !== "string") {
+    errors.push(`Invalid property 'ssh.${key}' (expected string, got ${describeType(object[key])})`);
+    return;
+  }
+  if (object[key].length === 0) {
+    errors.push(`Property 'ssh.${key}' must not be an empty string`);
+  }
 }
-async function withRecipeOutputScope(scopedOperation) {
-  liveOutputState.recipeOutputDepth += 1;
-  try {
-    return await scopedOperation();
-  } finally {
-    liveOutputState.activeRecipeGuideDepths = liveOutputState.activeRecipeGuideDepths.filter((depth) => depth !== liveOutputState.recipeOutputDepth);
-    liveOutputState.pendingRecipeClosureGuideDepths = [liveOutputState.recipeOutputDepth];
-    liveOutputState.recipeOutputDepth -= 1;
+function collectPortsErrors(ssh, errors) {
+  if (!("ports" in ssh)) {
+    errors.push("Missing property 'ssh.ports' (expected array)");
+    return;
+  }
+  if (!Array.isArray(ssh.ports)) {
+    errors.push(`Invalid property 'ssh.ports' (expected array, got ${describeType(ssh.ports)})`);
+    return;
+  }
+  if (ssh.ports.length === 0) {
+    errors.push("Property 'ssh.ports' must not be empty");
+    return;
+  }
+  for (const [index, port] of ssh.ports.entries()) {
+    if (!isValidTcpPort(port)) {
+      errors.push(`Property 'ssh.ports[${index}]' must be an integer between 1 and 65535`);
+    }
   }
 }
-function renderModuleLine(parameters) {
-  const { detail, extraGuideDepths = [], name, status, waitingFrame } = parameters;
-  const baseIndent = getModuleIndent();
-  const indent = buildGuideIndent(baseIndent, { extraGuideDepths });
-  const icon = getModuleIcon(status, waitingFrame);
-  const statusText = getModuleStatusText(status);
-  const detailSuffix = detail == null ? "" : `  ${pc.dim(detail)}`;
-  const alignedNameWidth = Math.max(MODULE_NAME_WIDTH - baseIndent.length, MIN_MODULE_NAME_WIDTH);
-  return `${indent}${icon}  ${name.padEnd(alignedNameWidth)}  ${statusText}${detailSuffix}`;
+function collectRequiredUserErrors(ssh, errors) {
+  if (!("user" in ssh)) {
+    errors.push("Missing property 'ssh.user' (expected string)");
+    return;
+  }
+  if (typeof ssh.user !== "string") {
+    errors.push(`Invalid property 'ssh.user' (expected string, got ${describeType(ssh.user)})`);
+    return;
+  }
+  if (ssh.user.length === 0) {
+    errors.push("Property 'ssh.user' must not be an empty string");
+  }
 }
-function hideCursor() {
-  if (liveOutputState.cursorHidden) return;
-  if (!supportsAnimatedModuleOutput()) return;
-  process.stdout.write(ANSI_HIDE_CURSOR);
-  liveOutputState.cursorHidden = true;
-}
-function showCursor() {
-  if (!liveOutputState.cursorHidden) return;
-  process.stdout.write(ANSI_SHOW_CURSOR);
-  liveOutputState.cursorHidden = false;
-}
-function writeAnimatedModuleLine(line) {
-  hideCursor();
-  process.stdout.clearLine(0);
-  process.stdout.cursorTo(0);
-  process.stdout.write(fitAnimatedModuleLine(line, process.stdout.columns));
-}
-function stopAnimatedModuleLine(clearCurrentLine = false) {
-  showCursor();
-  if (liveOutputState.activeSpinner == null) return;
-  clearInterval(liveOutputState.activeSpinner.interval);
-  liveOutputState.activeSpinner = null;
-  if (clearCurrentLine && supportsAnimatedModuleOutput()) {
-    process.stdout.clearLine(0);
-    process.stdout.cursorTo(0);
+function collectStrictHostKeyCheckingErrors(ssh, errors) {
+  if (!("strictHostKeyChecking" in ssh) || ssh.strictHostKeyChecking == null) return;
+  if (typeof ssh.strictHostKeyChecking !== "string" || !isHostKeyMode(ssh.strictHostKeyChecking)) {
+    errors.push(STRICT_HOST_KEY_ERROR);
   }
 }
-function stopLiveModuleOutput(clearCurrentLine = false) {
-  stopAnimatedModuleLine(clearCurrentLine);
+function collectExpectedHostPublicKeyErrors(ssh, errors) {
+  if (typeof ssh.expectedHostPublicKey !== "string") return;
+  const error = validateExpectedHostPublicKey(ssh.expectedHostPublicKey);
+  if (error != null) errors.push(`Invalid property 'ssh.expectedHostPublicKey': ${error}`);
 }
-function startModuleSpinner(name, detail) {
-  if (!supportsAnimatedModuleOutput()) return;
-  clearPendingRecipeClosureGuides();
-  stopAnimatedModuleLine();
-  const maskedName = maskRegisteredSecrets(name);
-  const maskedDetail = detail == null ? void 0 : maskRegisteredSecrets(detail);
-  const displayModule = formatDisplayModule({
-    continuationIndentWidth: getContinuationIndent().length,
-    detail: maskedDetail,
-    name: maskedName,
-    status: "waiting",
-    terminalColumns: process.stdout.columns
+function collectOptionalSshFieldErrors(ssh, errors) {
+  collectOptionalStringErrors(ssh, "privateKey", errors);
+  collectOptionalStringErrors(ssh, "sudoPassword", errors);
+  collectOptionalStringErrors(ssh, "expectedHostFingerprint", errors);
+  collectOptionalStringErrors(ssh, "expectedHostPublicKey", errors);
+  collectExpectedHostPublicKeyErrors(ssh, errors);
+  collectOptionalBooleanErrors(ssh, "agentForward", errors);
+  collectOptionalBooleanErrors(ssh, "passwordFallback", errors);
+  collectOptionalNumberErrors({
+    errors,
+    key: "reconnectTimeout",
+    object: ssh,
+    options: { positive: true }
   });
-  const spinner = {
-    detail: displayModule.detail,
-    frameIndex: 0,
-    interval: setInterval(() => {
-      spinner.frameIndex = (spinner.frameIndex + 1) % SPINNER_FRAMES.length;
-      writeAnimatedModuleLine(
-        renderModuleLine({
-          detail: spinner.detail,
-          name: displayModule.name,
-          status: "waiting",
-          waitingFrame: SPINNER_FRAMES[spinner.frameIndex]
-        })
-      );
-    }, SPINNER_FRAME_INTERVAL_MS)
-  };
-  if (typeof spinner.interval.unref === "function") spinner.interval.unref();
-  liveOutputState.activeSpinner = spinner;
-  writeAnimatedModuleLine(
-    renderModuleLine({
-      detail: displayModule.detail,
-      name: displayModule.name,
-      status: "waiting",
-      waitingFrame: SPINNER_FRAMES[0]
-    })
-  );
+  collectOptionalNumberErrors({
+    errors,
+    key: "maxReconnectAttempts",
+    object: ssh,
+    options: { integer: true, positive: true }
+  });
+  collectStrictHostKeyCheckingErrors(ssh, errors);
 }
-function printRecipeHeader(name) {
-  stopAnimatedModuleLine(true);
-  clearPendingRecipeClosureGuides();
-  const header = pc.bold(pc.blue(`[${name}]`));
-  console.log(`${buildGuideIndent(getRecipeHeaderIndent())}${header}`);
-  if (liveOutputState.recipeOutputDepth >= 0) {
-    liveOutputState.activeRecipeGuideDepths = [...liveOutputState.activeRecipeGuideDepths, liveOutputState.recipeOutputDepth];
+function collectSshConfigErrors(value) {
+  const errors = [];
+  if (value === null) {
+    errors.push("Invalid property 'ssh' (expected object, got null)");
+    return errors;
+  }
+  if (typeof value !== "object") {
+    errors.push(`Invalid property 'ssh' (expected object, got ${describeType(value)})`);
+    return errors;
+  }
+  if (!isRecord(value)) {
+    errors.push("Invalid property 'ssh' (expected object, got object)");
+    return errors;
   }
+  const ssh = value;
+  collectPortsErrors(ssh, errors);
+  collectRequiredUserErrors(ssh, errors);
+  collectOptionalSshFieldErrors(ssh, errors);
+  return errors;
 }
-function printRunContext(parameters) {
-  const mode = parameters.dryRun ? pc.yellow("dry-run") : pc.green("apply");
-  const ports = parameters.ports.join(", ");
-  console.log(
-    pc.dim(`Run ${parameters.name} \xB7 host ${parameters.host} \xB7 ports ${ports} \xB7 mode ${mode}`)
-  );
+function normalizeServerDefinitionSshError(error) {
+  const mappedErrors = {
+    "Missing property 'ssh.user' (expected string)": "ssh.user is required",
+    "Property 'ssh.expectedHostFingerprint' must not be an empty string": "ssh.expectedHostFingerprint must not be an empty string",
+    "Property 'ssh.expectedHostPublicKey' must not be an empty string": "ssh.expectedHostPublicKey must not be an empty string",
+    "Property 'ssh.ports' must not be empty": "ssh.ports must not be empty",
+    "Property 'ssh.privateKey' must not be an empty string": "ssh.privateKey must not be an empty string",
+    "Property 'ssh.user' must not be an empty string": "ssh.user is required",
+    [STRICT_HOST_KEY_ERROR]: "ssh.strictHostKeyChecking must be one of accept-new, no, yes"
+  };
+  return mappedErrors[error] ?? error;
 }
-function colorizeDiffLine(line) {
-  if (line.startsWith("---") || line.startsWith("+++") || line.startsWith("@@")) {
-    return pc.dim(line);
-  }
-  if (line.startsWith("-")) return pc.red(line);
-  if (line.startsWith("+")) return pc.green(line);
-  return pc.dim(line);
+function validateSshConfig(ssh) {
+  const errors = collectSshConfigErrors(ssh);
+  if (errors.length === 0) return;
+  const message = errors.map((error) => normalizeServerDefinitionSshError(error)).join("; ");
+  throw new Error(`ServerDefinition: ${message}`);
 }
-function renderDiffLines(diff) {
-  if (diff.trim() === "") return [];
-  const sanitized = sanitizeTerminalText(maskRegisteredSecrets(diff));
-  return sanitized.split("\n").map((line) => `\u2502 ${colorizeDiffLine(line)}`);
+
+// src/meta.ts
+var SYSTEM_HOST_KIND = "system.host";
+var SYSTEM_REBOOT_KIND = "system.reboot";
+function hasValidMetaName(name) {
+  return typeof name === "string" && name.length > 0;
 }
-function writeContinuationLine(line, extraGuideDepths, via) {
-  const composed = `${buildGuideIndent(getContinuationIndent(), { extraGuideDepths })}${line}`;
-  if (via === "stdout") {
-    process.stdout.write(`${composed}
-`);
-  } else {
-    console.log(composed);
-  }
+function isMetaValueType(value) {
+  return value === "boolean" || value === "number" || value === "string";
 }
-function writeContinuationBlock(parameters) {
-  for (const detailLine of parameters.detailLines) {
-    writeContinuationLine(pc.dim(detailLine), parameters.extraGuideDepths, parameters.via);
-  }
-  for (const diffLine of parameters.diffLines) {
-    writeContinuationLine(diffLine, parameters.extraGuideDepths, parameters.via);
+function validateResolvedMetaValue(parameters) {
+  const { actualType, declaredValueType, enforceDeclaredValueType, entryKey } = parameters;
+  if (!isMetaValueType(actualType)) {
+    throw new TypeError(
+      `Env meta entry ${JSON.stringify(entryKey)} resolved to typeof ${actualType}, expected boolean, number, or string`
+    );
   }
-}
-function printRenderedModuleResult(parameters) {
-  const extraGuideDepths = parameters.extraGuideDepths ?? [];
-  const maskedName = maskRegisteredSecrets(parameters.name);
-  const maskedDetail = parameters.detail == null ? void 0 : maskRegisteredSecrets(parameters.detail);
-  const displayModule = formatDisplayModule({
-    continuationIndentWidth: `${buildGuideIndent(
-      OUTPUT_INDENT_UNIT.repeat(Math.max(getCurrentOutputDepth() + 2, 1)),
-      { extraGuideDepths }
-    )}   `.length,
-    detail: maskedDetail,
-    name: maskedName,
-    status: parameters.status,
-    terminalColumns: process.stdout.columns
-  });
-  const line = renderModuleLine({
-    detail: displayModule.detail,
-    extraGuideDepths,
-    name: displayModule.name,
-    status: parameters.status
-  });
-  const diffLines = parameters.diff == null ? [] : renderDiffLines(parameters.diff);
-  const usesSpinner = supportsAnimatedModuleOutput() && liveOutputState.activeSpinner != null;
-  if (usesSpinner) {
-    stopAnimatedModuleLine();
-    writeAnimatedModuleLine(line);
-    process.stdout.write("\n");
-  } else {
-    console.log(line);
+  if (enforceDeclaredValueType && actualType !== declaredValueType) {
+    throw new TypeError(
+      `Env meta entry ${JSON.stringify(entryKey)} resolved to typeof ${actualType}, expected ${declaredValueType}`
+    );
   }
-  writeContinuationBlock({
-    detailLines: displayModule.detailLines,
-    diffLines,
-    extraGuideDepths,
-    via: usesSpinner ? "stdout" : "console"
-  });
 }
-function printModuleResult(name, status, detail, diff) {
-  clearPendingRecipeClosureGuides();
-  printRenderedModuleResult({ detail, diff, name, status });
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
 }
-function printCommandError(stdout, stderr) {
-  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
-  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
-  const lines = [];
-  if (maskedStderr.trim()) {
-    lines.push(...maskedStderr.trim().split("\n"));
+function assertValidEnvironmentMetaEntry(candidate) {
+  if (!hasValidMetaName(candidate.name)) {
+    throw new TypeError("Invalid env meta entry: name must be a non-empty string");
   }
-  if (maskedStdout.trim()) {
-    lines.push(...maskedStdout.trim().split("\n"));
+  if (typeof candidate.resolve !== "function") {
+    throw new TypeError("Invalid env meta entry: resolve must be a function returning a Promise");
   }
-  if (lines.length > 0) {
-    console.error(pc.red(`${getErrorIndent()}Error output:`));
-    for (const line of lines) {
-      console.error(pc.red(`${getErrorIndent()}${line}`));
-    }
+  if (candidate.valueType !== "boolean" && candidate.valueType !== "number" && candidate.valueType !== "string") {
+    throw new TypeError("Invalid env meta entry: valueType must be boolean, number, or string");
   }
 }
-function printVerboseCommandError(stdout, stderr) {
-  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
-  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
-  if (maskedStderr.trim()) {
-    console.error(pc.red(`${getErrorIndent()}Full stderr:`));
-    for (const line of maskedStderr.trim().split("\n")) {
-      console.error(pc.red(`${getErrorIndent()}${line}`));
-    }
-  }
-  if (maskedStdout.trim()) {
-    console.error(pc.red(`${getErrorIndent()}Full stdout:`));
-    for (const line of maskedStdout.trim().split("\n")) {
-      console.error(pc.red(`${getErrorIndent()}${line}`));
-    }
+function assertValidSshdPortMetaEntry(candidate) {
+  if (!isValidTcpPort(candidate.port)) {
+    throw new TypeError("Invalid sshd.port meta entry: port must be an integer between 1 and 65535");
   }
 }
-function printVerboseErrorBlock(label, content) {
-  if (!content.trim()) {
-    return;
-  }
-  console.error(pc.red(`${getErrorIndent()}${label}`));
-  for (const line of content.trim().split("\n")) {
-    console.error(pc.red(`${getErrorIndent()}${line}`));
+function assertValidSystemHostMetaEntry(candidate) {
+  const hostValidationFailure = validateHostLabel(candidate.host);
+  if (hostValidationFailure != null) {
+    throw new TypeError(
+      `Invalid system.host meta entry: host ${describeHostValidationFailure(hostValidationFailure)}`
+    );
   }
 }
-function getErrorCause(error) {
-  return error.cause;
+function isEnvironmentMetaEntry(entry) {
+  return entry.kind === "env";
 }
-function printVerboseErrorCause(cause, depth, visitedCauses) {
-  const label = `Cause ${depth}:`;
-  if (cause instanceof Error) {
-    if (visitedCauses.has(cause)) {
-      printVerboseErrorBlock(label, "<cycle detected>");
+function isSshdPortMetaEntry(entry) {
+  return entry.kind === "sshd.port";
+}
+function isSystemHostMetaEntry(entry) {
+  return entry.kind === SYSTEM_HOST_KIND;
+}
+function isSystemRebootMetaEntry(entry) {
+  return entry.kind === SYSTEM_REBOOT_KIND;
+}
+function assertValidModuleMetaEntry(entry) {
+  if (!isRecord2(entry)) {
+    throw new TypeError(`Invalid meta entry: expected object, got ${typeof entry}`);
+  }
+  switch (entry.kind) {
+    case "env": {
+      assertValidEnvironmentMetaEntry(entry);
       return;
     }
-    visitedCauses.add(cause);
-    const stack = cause.stack?.trim() ?? "";
-    const stackOrMessage = stack.length > 0 ? stack : String(cause);
-    printVerboseErrorBlock(label, maskRegisteredSecrets(stackOrMessage));
-    const nestedCause = getErrorCause(cause);
-    if (nestedCause !== void 0) {
-      printVerboseErrorCause(nestedCause, depth + 1, visitedCauses);
+    case "sshd.port": {
+      assertValidSshdPortMetaEntry(entry);
+      return;
+    }
+    case SYSTEM_HOST_KIND: {
+      assertValidSystemHostMetaEntry(entry);
+      return;
+    }
+    case SYSTEM_REBOOT_KIND: {
+      return;
+    }
+    default: {
+      throw new TypeError(`Invalid meta entry kind: ${String(entry.kind)}`);
     }
-    return;
   }
-  printVerboseErrorBlock(label, maskRegisteredSecrets(formatCauseValue(cause)));
 }
-function printVerboseGenericError(error) {
-  const stack = error.stack?.trim() ?? "";
-  const stackOrMessage = stack.length > 0 ? stack : String(error);
-  printVerboseErrorBlock("Full stack:", maskRegisteredSecrets(stackOrMessage));
-  const cause = getErrorCause(error);
-  if (cause !== void 0) {
-    const visitedCauses = /* @__PURE__ */ new WeakSet();
-    visitedCauses.add(error);
-    printVerboseErrorCause(cause, 1, visitedCauses);
+function assertValidModuleMetaEntries(entries) {
+  if (entries == null) return;
+  for (const entry of entries) {
+    assertValidModuleMetaEntry(entry);
   }
 }
-function formatCauseValue(cause) {
-  if (cause instanceof Error) return cause.message;
-  return inspectRedactedDiagnosticValue(cause, {
-    depth: CAUSE_INSPECT_DEPTH,
-    maxStringLength: CAUSE_INSPECT_MAX_STRING_LENGTH,
-    redactMaxDepth: CAUSE_REDACT_BINARY_MAX_DEPTH
-  });
-}
-function printCauseChain(error) {
-  const visited = /* @__PURE__ */ new WeakSet();
-  visited.add(error);
-  let cause = getErrorCause(error);
-  while (cause !== void 0) {
-    if (cause instanceof Error) {
-      if (visited.has(cause)) return;
-      visited.add(cause);
-    }
-    console.error(pc.red(`${getErrorIndent()}Cause: ${maskRegisteredSecrets(formatCauseValue(cause))}`));
-    if (cause instanceof CommandError) {
-      printVerboseCommandError(
-        maskRegisteredSecrets(cause.fullStdout),
-        maskRegisteredSecrets(cause.fullStderr)
-      );
-    }
-    cause = cause instanceof Error ? getErrorCause(cause) : void 0;
+var META_ENV_SEGMENT_PATTERN = new RegExp("^[A-Za-z_]\\w*$", "v");
+function isAllowedMetaEnvironmentName(name) {
+  if (name.length === 0) return false;
+  const segments = name.split(".");
+  for (const segment of segments) {
+    if (!META_ENV_SEGMENT_PATTERN.test(segment)) return false;
   }
+  return true;
 }
-function printCommandFailure(error, verbose) {
-  if (verbose && error instanceof CommandError) {
-    const summaryLine = error.message.split("\n")[0];
-    printCommandError("", maskRegisteredSecrets(summaryLine));
-    printVerboseCommandError(
-      maskRegisteredSecrets(error.fullStdout),
-      maskRegisteredSecrets(error.fullStderr)
+function assertAllowedEnvironmentMetaName(name) {
+  if (!isAllowedMetaEnvironmentName(name)) {
+    throw new Error(
+      `Invalid env meta name ${JSON.stringify(name)}: expected [A-Za-z_]\\w*(\\.[A-Za-z_]\\w*)*`
     );
-    return;
   }
-  printCommandError("", maskRegisteredSecrets(String(error)));
-  if (error instanceof Error) {
-    if (!(error instanceof CommandError)) {
-      printCauseChain(error);
-    }
-    if (verbose) {
-      printVerboseGenericError(error);
-    }
+  if (ENVIRONMENT_FORBIDDEN_KEYS.has(name)) {
+    throw new Error(
+      `Forbidden env meta entry name: ${JSON.stringify(name)} (reserved JavaScript identifier)`
+    );
   }
 }
-function printSummary(stats) {
-  stopAnimatedModuleLine(true);
-  const parts = [
-    pc.yellow(`${stats.changed} changed`),
-    pc.green(`${stats.ok} ok`),
-    pc.dim(`${stats.skipped} skipped`),
-    stats.failed > 0 ? pc.red(`${stats.failed} failed`) : `${stats.failed} failed`,
-    pc.cyan(`${stats.signals} signals triggered`)
-  ];
-  console.log(`
-${parts.join(pc.dim(" \xB7 "))}`);
+function createMemoizedEnvironmentResolver(entry) {
+  let cachedResolution = null;
+  const declaredValueType = entry.valueType;
+  const enforceDeclaredValueType = entry.valueTypeExplicit !== false;
+  const entryKey = entry.name;
+  return async () => {
+    if (cachedResolution != null) return cachedResolution;
+    const pending = entry.resolve().then((resolved) => {
+      validateResolvedMetaValue({
+        actualType: typeof resolved,
+        declaredValueType,
+        enforceDeclaredValueType,
+        entryKey
+      });
+      return resolved;
+    }).catch((error) => {
+      cachedResolution = null;
+      throw error;
+    });
+    cachedResolution = pending;
+    return pending;
+  };
 }
-
-// src/dryRunDispatch.ts
-function shouldExecuteApplyDuringDryRun(module, diffEnabled) {
-  if (module._dryRunBlocker === true || module._dryRunMetaProducer === true) return true;
-  if (diffEnabled && module._dryRunDiffProducer === true && module._applyDryRun != null) return true;
-  return module._applyDryRun != null && module._dryRunDiffProducer !== true;
+async function mergeEnvironmentFromMeta(environment, entries) {
+  if (entries == null || entries.length === 0) {
+    await Promise.resolve();
+    return environment;
+  }
+  const nextEnvironment = Object.assign(createNullPrototypeEnvironment(), environment);
+  for (const entry of entries) {
+    if (!isEnvironmentMetaEntry(entry)) continue;
+    assertAllowedEnvironmentMetaName(entry.name);
+    nextEnvironment[entry.name] = createMemoizedEnvironmentResolver(entry);
+  }
+  await Promise.resolve();
+  return nextEnvironment;
 }
 
-// src/knownHosts.ts
-import { createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { appendFile, mkdir, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
+// src/output.ts
+import pc from "picocolors";
 
-// src/knownHostPatterns.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var HASHED_HOST_PARTS = 4;
-function matchesKnownHostPatternList(patterns, needle) {
-  let matchedPositivePattern = false;
-  for (const rawPattern of patterns) {
-    const negated = rawPattern.startsWith("!");
-    const pattern = negated ? rawPattern.slice(1) : rawPattern;
-    if (pattern.length === 0) continue;
-    const matched = matchesHashedHost(pattern, needle) || matchesPlainHostPattern(pattern, needle);
-    if (!matched) continue;
-    if (negated) return false;
-    matchedPositivePattern = true;
+// src/outputFormatting.ts
+import { stripVTControlCharacters } from "util";
+var PACKAGE_MODULE_SUFFIX_LENGTH = 2;
+var PACKAGE_COLUMN_GAP_WIDTH = 2;
+var DEFAULT_TERMINAL_COLUMNS = 100;
+var MIN_PACKAGE_COLUMNS_WIDTH = 24;
+var MIN_PACKAGE_COLUMN_WIDTH = 18;
+var MIN_ANIMATED_LINE_COLUMNS = 8;
+function splitPackageModuleName(name) {
+  for (const prefix of ["package.installed: ", "package.absent: "]) {
+    if (!name.startsWith(prefix)) continue;
+    const packages = name.slice(prefix.length).split(",").map((entry) => entry.trim()).filter(Boolean);
+    if (packages.length === 0) return null;
+    return {
+      packages,
+      summaryName: prefix.slice(0, -PACKAGE_MODULE_SUFFIX_LENGTH)
+    };
   }
-  return matchedPositivePattern;
+  return null;
 }
-function matchesPlainHostPattern(pattern, needle) {
-  if (pattern.startsWith("|1|")) return false;
-  return matchesHostPattern(pattern.toLowerCase(), needle.toLowerCase());
+function getPackageColumns(parameters) {
+  if (parameters.packages.length <= 1) return parameters.packages;
+  const availableWidth = Math.max(
+    (parameters.terminalColumns ?? DEFAULT_TERMINAL_COLUMNS) - parameters.continuationIndentWidth,
+    MIN_PACKAGE_COLUMNS_WIDTH
+  );
+  const widestPackage = Math.max(...parameters.packages.map((entry) => entry.length));
+  const columnWidth = Math.max(widestPackage + PACKAGE_COLUMN_GAP_WIDTH, MIN_PACKAGE_COLUMN_WIDTH);
+  const columnCount = Math.max(Math.floor(availableWidth / columnWidth), 1);
+  const rowCount = Math.ceil(parameters.packages.length / columnCount);
+  return Array.from(
+    { length: rowCount },
+    (_row, rowIndex) => Array.from({ length: columnCount }, (_column, columnIndex) => {
+      const packageIndex = rowIndex + columnIndex * rowCount;
+      const packageName = parameters.packages.at(packageIndex);
+      if (packageName == null) return "";
+      const isLastVisibleColumn = columnIndex === columnCount - 1 || packageIndex + rowCount >= parameters.packages.length;
+      return isLastVisibleColumn ? packageName : packageName.padEnd(columnWidth);
+    }).filter(Boolean).join("")
+  );
 }
-function matchesHashedHost(pattern, needle) {
-  if (!pattern.startsWith("|1|")) return false;
-  const parts = pattern.split("|");
-  if (parts.length !== HASHED_HOST_PARTS || parts[1] !== "1") return false;
-  const salt = Buffer.from(parts[2] ?? "", "base64");
-  const expectedHash = Buffer.from(parts[3] ?? "", "base64");
-  if (salt.length === 0 || expectedHash.length === 0) return false;
-  const actualHash = createHmac("sha1", salt).update(needle).digest();
-  return actualHash.length === expectedHash.length && timingSafeEqual(actualHash, expectedHash);
+function getPackageSummaryDetail(packageCount, detail) {
+  const packageLabel = packageCount === 1 ? "1 package" : `${packageCount} packages`;
+  return detail == null ? packageLabel : `${packageLabel} \xB7 ${detail}`;
 }
-function matchesHostPattern(pattern, needle) {
-  let state = { needleIndex: 0, patternIndex: 0, starIndex: -1, starNeedleIndex: 0 };
-  while (state.needleIndex < needle.length) {
-    const nextState = advanceHostPatternMatch(pattern, needle, state);
-    if (nextState === null) return false;
-    state = nextState;
-  }
-  while (pattern[state.patternIndex] === "*") state.patternIndex += 1;
-  return state.patternIndex === pattern.length;
+function fitAnimatedModuleLine(line, columns) {
+  if (columns === void 0 || columns < MIN_ANIMATED_LINE_COLUMNS) return line;
+  const plainLine = stripVTControlCharacters(line);
+  if (plainLine.length < columns) return line;
+  return `${plainLine.slice(0, columns - 1)}\u2026`;
 }
-function advanceHostPatternMatch(pattern, needle, state) {
-  const patternCharacter = pattern[state.patternIndex];
-  if (patternCharacter === "?" || patternCharacter === needle[state.needleIndex]) {
-    return { ...state, needleIndex: state.needleIndex + 1, patternIndex: state.patternIndex + 1 };
-  }
-  if (patternCharacter === "*") {
+function formatDisplayModule(parameters) {
+  const packageModule = splitPackageModuleName(parameters.name);
+  if (packageModule == null) {
     return {
-      ...state,
-      patternIndex: state.patternIndex + 1,
-      starIndex: state.patternIndex,
-      starNeedleIndex: state.needleIndex
+      detail: parameters.detail,
+      detailLines: [],
+      name: parameters.name
     };
   }
-  if (state.starIndex === -1) return null;
-  const starNeedleIndex = state.starNeedleIndex + 1;
   return {
-    ...state,
-    needleIndex: starNeedleIndex,
-    patternIndex: state.starIndex + 1,
-    starNeedleIndex
+    detail: getPackageSummaryDetail(packageModule.packages.length, parameters.detail),
+    detailLines: parameters.status === "waiting" ? [] : getPackageColumns({
+      continuationIndentWidth: parameters.continuationIndentWidth,
+      packages: packageModule.packages,
+      terminalColumns: parameters.terminalColumns
+    }),
+    name: packageModule.summaryName
   };
 }
 
-// src/knownHosts.ts
-var knownHostsLock = Promise.resolve();
-async function withKnownHostsLock(operation) {
-  const previous = knownHostsLock;
-  const next = previous.then(async () => operation());
-  knownHostsLock = next.catch(() => null);
-  return next;
-}
-var HostKeyVerificationError = class _HostKeyVerificationError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "HostKeyVerificationError";
-    Error.captureStackTrace(this, _HostKeyVerificationError);
-  }
-};
-var KnownHostsValidationError = class _KnownHostsValidationError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "KnownHostsValidationError";
-    Error.captureStackTrace(this, _KnownHostsValidationError);
+// src/secretSink.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var secretCounts = /* @__PURE__ */ new Map();
+var runScopedSecretCounts = new AsyncLocalStorage2();
+var REDACTED_PLACEHOLDER = REDACTED_SECRET_FIELD_PLACEHOLDER;
+var CIRCULAR_PLACEHOLDER = "[Circular]";
+function assertRegistrableSecret(secret) {
+  if (secret.includes(REDACTED_PLACEHOLDER)) {
+    throw new Error("Secret registrations must not contain the redaction placeholder");
   }
-};
-var MIN_KNOWN_HOSTS_FIELDS = 3;
-var DEFAULT_SSH_PORT = 22;
-var UINT32_SIZE = 4;
-var STRICT_BASE64_PATTERN = new RegExp("^[A-Za-z0-9+\\/]+=*$", "v");
-var CERT_AUTHORITY_MESSAGE = "HOST KEY VERIFICATION FAILED \u2014 known_hosts contains a @cert-authority entry, but paratix does not validate certificate-authority host keys. Remove the @cert-authority marker or pin the host with ssh.expectedHostFingerprint / ssh.expectedHostPublicKey instead.";
-var defaultHostKeyCache = /* @__PURE__ */ new Map();
-function createHostKeyCache() {
-  return /* @__PURE__ */ new Map();
 }
-function parseKnownHostsLine(line) {
-  const parts = line.split(new RegExp("\\s+", "v"));
-  const offset = parts[0]?.startsWith("@") ? 1 : 0;
-  if (parts.length < MIN_KNOWN_HOSTS_FIELDS + offset) return [];
-  const marker = offset === 1 ? parts[0] : void 0;
-  const hostsPart = parts[offset];
-  const algo = parts[offset + 1];
-  const base64Key = parts[offset + 2];
-  if (!STRICT_BASE64_PATTERN.test(base64Key)) return [];
-  const key = Buffer.from(base64Key, "base64");
-  const hostPatterns = hostsPart.split(",");
-  return hostPatterns.map((host) => ({ algo, host, hostPatterns, key, marker }));
+var MINIMUM_SECRET_LENGTH = 8;
+function registerSecret(secret) {
+  if (secret.length < MINIMUM_SECRET_LENGTH) return;
+  assertRegistrableSecret(secret);
+  secretCounts.set(secret, (secretCounts.get(secret) ?? 0) + 1);
 }
-function parseKnownHosts(content) {
-  const entries = [];
-  for (const raw of content.split("\n")) {
-    const line = raw.trim();
-    if (line.length === 0 || line.startsWith("#")) continue;
-    entries.push(...parseKnownHostsLine(line));
+function unregisterSecret(secret) {
+  if (secret.length < MINIMUM_SECRET_LENGTH) return;
+  const current = secretCounts.get(secret);
+  if (current == null) return;
+  if (current <= 1) {
+    secretCounts.delete(secret);
+    return;
   }
-  return entries;
-}
-function formatHostNeedle(host, port) {
-  return port === DEFAULT_SSH_PORT ? host : `[${host}]:${port}`;
-}
-function assertSafeHostForKnownHosts(host) {
-  const hostValidationFailure = validateHostLabel(host);
-  if (hostValidationFailure == null) return;
-  throw new KnownHostsValidationError(
-    `Refusing to persist known_hosts entry: host label ${describeHostValidationFailure(hostValidationFailure)}`
-  );
-}
-function matchesKnownHostEntry(entry, needle) {
-  return matchesKnownHostPatternList(entry.hostPatterns ?? [entry.host], needle);
-}
-function findMatchingEntries(entries, host, port) {
-  const needle = formatHostNeedle(host, port);
-  return entries.filter((entry) => matchesKnownHostEntry(entry, needle));
-}
-function findRevokedEntry(entries, key) {
-  return entries.find(
-    (entry) => entry.marker === "@revoked" && entry.key.length === key.length && timingSafeEqual2(entry.key, key)
-  );
-}
-function throwHostKeyMismatch(host, presentedKey, existingKey) {
-  const presentedAlgo = describeAlgoForDiagnostics(presentedKey);
-  const knownHostsDetails = existingKey == null ? "remote host key does not match the key in known_hosts. " : `remote host key (${presentedAlgo}) does not match the key in known_hosts (${describeAlgoForDiagnostics(existingKey)}). `;
-  throw new HostKeyVerificationError(
-    `HOST KEY VERIFICATION FAILED for ${host}: ${knownHostsDetails}This could indicate a man-in-the-middle attack.`
-  );
+  secretCounts.set(secret, current - 1);
 }
-function verifyHostKeyAgainstKnownEntries(parameters) {
-  const { cachedKey, fileEntries, host, key } = parameters;
-  const revokedKey = findRevokedEntry(fileEntries, key);
-  if (revokedKey != null) {
-    throw new HostKeyVerificationError(
-      `HOST KEY VERIFICATION FAILED for ${host}: remote host key (${describeAlgoForDiagnostics(revokedKey.key)}) is marked as revoked in known_hosts.`
-    );
+async function withRegisteredSecrets(secrets, body) {
+  const registered = [];
+  const registerableSecrets = secrets.filter((secret) => secret.length >= MINIMUM_SECRET_LENGTH);
+  for (const secret of secrets) {
+    assertRegistrableSecret(secret);
   }
-  if (fileEntries.some((entry) => entry.marker === "@cert-authority"))
-    throw new HostKeyVerificationError(`${host}: ${CERT_AUTHORITY_MESSAGE}`);
-  const rawHostKeyEntries = fileEntries.filter((entry) => entry.marker == null);
-  const matchingEntry = rawHostKeyEntries.find(
-    (entry) => entry.key.length === key.length && timingSafeEqual2(entry.key, key)
-  );
-  if (matchingEntry != null) return true;
-  if (cachedKey?.length === key.length && timingSafeEqual2(cachedKey, key)) {
-    return true;
+  try {
+    for (const secret of registerableSecrets) {
+      registerSecret(secret);
+      registered.push(secret);
+    }
+    const result = await body();
+    return maskScopedResult(result, secrets);
+  } catch (error) {
+    throw maskScopedError(error, secrets);
+  } finally {
+    for (const secret of registered) {
+      unregisterSecret(secret);
+    }
   }
-  const firstRawHostKey = rawHostKeyEntries.at(0)?.key;
-  if (firstRawHostKey != null) throwHostKeyMismatch(host, key, firstRawHostKey);
-  if (cachedKey != null) throwHostKeyMismatch(host, key, cachedKey);
-  return false;
 }
-function extractAlgoFromKey(keyBuffer) {
-  if (keyBuffer.length < UINT32_SIZE) {
-    throw new Error("Invalid SSH key buffer: too short to contain algorithm length");
-  }
-  const algoLength = keyBuffer.readUInt32BE(0);
-  if (algoLength === 0 || UINT32_SIZE + algoLength > keyBuffer.length) {
-    throw new Error("Invalid SSH key buffer: algorithm length exceeds buffer size");
+async function withRunScopedSecrets(body) {
+  if (runScopedSecretCounts.getStore() != null) {
+    return body();
   }
-  const algo = keyBuffer.subarray(UINT32_SIZE, UINT32_SIZE + algoLength).toString("ascii");
-  if (!PINNED_HOST_KEY_ALGORITHM_PATTERN.test(algo)) {
-    throw new KnownHostsValidationError(`Invalid SSH key buffer: unsupported algorithm '${algo}'`);
+  const scopedSecrets = /* @__PURE__ */ new Map();
+  try {
+    return await runScopedSecretCounts.run(scopedSecrets, body);
+  } finally {
+    for (const [secret, count] of scopedSecrets) {
+      for (let index = 0; index < count; index += 1) {
+        unregisterSecret(secret);
+      }
+    }
   }
-  return algo;
 }
-function describeAlgoForDiagnostics(keyBuffer) {
-  try {
-    return extractAlgoFromKey(keyBuffer);
-  } catch {
-    return "<unknown>";
+function maskScopedResult(result, secrets) {
+  if (secrets.length === 0 || !isModuleResult(result)) return result;
+  const secretList = [...secrets];
+  let next = result;
+  if (result.detail != null) {
+    const maskedDetail = maskSecrets(result.detail, secretList);
+    if (maskedDetail !== result.detail) {
+      next = { ...result, detail: maskedDetail };
+    }
   }
+  if (isModuleResult(next) && next.status === "failed" && next.error != null) {
+    next = { ...next, error: maskScopedError(next.error, secrets) };
+  }
+  return next;
 }
-function computeFingerprint(key) {
-  const hash = createHash("sha256").update(key).digest("base64");
-  return `SHA256:${hash.replaceAll("=", "")}`;
+function isModuleResult(value) {
+  return typeof value === "object" && value !== null && "status" in value && typeof value.status === "string";
 }
-async function appendHostKey(host, port, keyBuffer) {
-  assertSafeHostForKnownHosts(host);
-  const hostLabel = formatHostNeedle(host, port);
-  const algo = extractAlgoFromKey(keyBuffer);
-  const base64Key = keyBuffer.toString("base64");
-  if (new RegExp("\\s", "v").test(hostLabel)) {
-    throw new KnownHostsValidationError(
-      `Refusing to persist known_hosts entry: host label contains whitespace`
+function maskCauseValue(cause, secrets, secretList) {
+  if (cause === void 0) return void 0;
+  if (cause instanceof Error) return maskScopedError(cause, secrets);
+  return maskSecrets(stringifyCause(cause, secretList), secretList);
+}
+function buildMaskedErrorClone(error, maskedMessage, secretList) {
+  if (error instanceof CommandError) {
+    return new CommandError(
+      maskedMessage,
+      maskSecrets(error.fullStdout, secretList),
+      maskSecrets(error.fullStderr, secretList)
     );
   }
-  if (new RegExp("\\s", "v").test(algo)) {
-    throw new KnownHostsValidationError(
-      `Refusing to persist known_hosts entry: algorithm contains whitespace`
-    );
+  const clone = Object.create(Object.getPrototypeOf(error));
+  Object.defineProperty(clone, "message", {
+    configurable: true,
+    value: maskedMessage,
+    writable: true
+  });
+  return clone;
+}
+function maskScopedError(error, secrets) {
+  if (!(error instanceof Error) || secrets.length === 0) {
+    return error instanceof Error ? error : new Error(maskSecrets(String(error), [...secrets]));
   }
-  if (new RegExp("\\s", "v").test(base64Key)) {
-    throw new KnownHostsValidationError(
-      `Refusing to persist known_hosts entry: base64 key contains whitespace`
-    );
+  const secretList = [...secrets];
+  const maskedMessage = maskSecrets(error.message, secretList);
+  const maskedStack = error.stack == null ? void 0 : maskSecrets(error.stack, secretList);
+  const maskedCause = maskCauseValue(error.cause, secrets, secretList);
+  const clone = buildMaskedErrorClone(error, maskedMessage, secretList);
+  clone.name = error.name;
+  if (maskedStack != null) {
+    Object.defineProperty(clone, "stack", {
+      configurable: true,
+      value: maskedStack,
+      writable: true
+    });
   }
-  const line = `${hostLabel} ${algo} ${base64Key}
-`;
-  const sshDirectory = join(homedir(), ".ssh");
-  const filePath = join(sshDirectory, "known_hosts");
-  await withKnownHostsLock(async () => {
-    await mkdir(sshDirectory, { mode: 448, recursive: true });
-    const existingEntries = await loadKnownHostEntries();
-    const matchingRawHostEntries = existingEntries.filter(
-      (entry) => entry.marker == null && matchesKnownHostEntry(entry, hostLabel)
-    );
-    const alreadyTrusted = matchingRawHostEntries.some(
-      (entry) => entry.algo === algo && entry.key.length === keyBuffer.length && timingSafeEqual2(entry.key, keyBuffer)
-    );
-    if (alreadyTrusted) return;
-    const conflictingEntry = matchingRawHostEntries.find(
-      (entry) => entry.key.length !== keyBuffer.length || !timingSafeEqual2(entry.key, keyBuffer)
-    );
-    if (conflictingEntry != null) throwHostKeyMismatch(host, keyBuffer, conflictingEntry.key);
-    await appendFile(filePath, line, { mode: 384 });
-  });
-}
-function getFileSystemErrorCode(error) {
-  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
-}
-var KIBIBYTE_BYTES = 1024;
-var MEBIBYTE_BYTES = KIBIBYTE_BYTES * KIBIBYTE_BYTES;
-var KNOWN_HOSTS_FILE_LIMIT_MIB = 16;
-var KNOWN_HOSTS_FILE_BYTE_LIMIT = KNOWN_HOSTS_FILE_LIMIT_MIB * MEBIBYTE_BYTES;
-async function loadKnownHostEntries() {
-  const filePath = join(homedir(), ".ssh", "known_hosts");
-  try {
-    const stats = await stat2(filePath);
-    if (stats.size > KNOWN_HOSTS_FILE_BYTE_LIMIT) {
-      throw new HostKeyVerificationError(
-        `Refusing to read known_hosts at ${filePath}: size ${stats.size} bytes exceeds the ${KNOWN_HOSTS_FILE_BYTE_LIMIT}-byte cap`
-      );
-    }
-    return parseKnownHosts(await readFile2(filePath, "utf8"));
-  } catch (error) {
-    if (error instanceof HostKeyVerificationError) throw error;
-    if (getFileSystemErrorCode(error) === "ENOENT") {
-      return [];
-    }
-    throw new HostKeyVerificationError(
-      `Could not read known_hosts at ${filePath}: ${String(error)}`
-    );
+  if (maskedCause !== void 0) {
+    Object.defineProperty(clone, "cause", {
+      configurable: true,
+      value: maskedCause,
+      writable: true
+    });
   }
+  return clone;
 }
-function formatAcceptedHostKeyWarning(host, key) {
+function stringifyCause(cause, secretList) {
+  if (typeof cause === "string") return cause;
+  if (typeof cause === "function")
+    return cause.name.length > 0 ? `[Function: ${cause.name}]` : "[Function]";
+  if (typeof cause === "number") return String(cause);
+  if (typeof cause === "boolean") return String(cause);
+  if (typeof cause === "bigint") return String(cause);
+  if (typeof cause === "symbol") return String(cause);
+  if (cause === void 0) return String(cause);
+  if (cause === null) return "null";
+  return stringifyObjectCause(cause, secretList);
+}
+function stringifyObjectCause(cause, secretList) {
   try {
-    const algo = extractAlgoFromKey(key);
-    const fingerprint = computeFingerprint(key);
-    return `WARNING: Permanently added '${host}' (${algo}) to the list of known hosts. Fingerprint: ${fingerprint}
-`;
+    const serialized = JSON.stringify(normalizeObjectCause(cause, secretList, /* @__PURE__ */ new WeakSet()));
+    return serialized ?? Object.prototype.toString.call(cause);
   } catch {
-    return `WARNING: Permanently added '${host}' to the list of known hosts.
-`;
+    return Object.prototype.toString.call(cause);
   }
 }
-function writeHostKeyPersistFallbackWarning(host, port, error) {
-  const keyscanArguments = port === DEFAULT_SSH_PORT ? shellQuote(host) : `-p ${port} ${shellQuote(host)}`;
-  process.stderr.write(
-    `WARNING: Could not persist host key for ${host} \u2014 the key is cached in memory for this session. To persist it, ensure ~/.ssh/ is writable or run: ssh-keyscan ${keyscanArguments} >> ~/.ssh/known_hosts. ${String(error)}
-`
-  );
-}
-async function acceptAndPersistHostKey(location, key, cache) {
-  const { host, port } = location;
-  const acceptedWarning = formatAcceptedHostKeyWarning(host, key);
+function normalizeObjectCause(cause, secretList, seen) {
+  if (isBinaryCauseValue(cause)) return REDACTED_PLACEHOLDER;
+  if (cause instanceof Date) return cause.toJSON();
+  if (seen.has(cause)) return CIRCULAR_PLACEHOLDER;
+  seen.add(cause);
   try {
-    await appendHostKey(host, port, key);
-  } catch (error) {
-    if (error instanceof HostKeyVerificationError || error instanceof KnownHostsValidationError) {
-      throw error;
+    if (Array.isArray(cause)) {
+      return cause.map((value) => normalizeCausePropertyValue(value, secretList, seen));
     }
-    cache.set(formatHostNeedle(host, port), key);
-    process.stderr.write(acceptedWarning);
-    writeHostKeyPersistFallbackWarning(host, port, error);
-    return;
+    const normalized = {};
+    for (const [key, value] of Object.entries(cause)) {
+      if (isSecretDiagnosticField(key)) {
+        normalized[key] = REDACTED_PLACEHOLDER;
+        continue;
+      }
+      normalized[key] = normalizeCausePropertyValue(value, secretList, seen);
+    }
+    return normalized;
+  } finally {
+    seen.delete(cause);
   }
-  cache.set(formatHostNeedle(host, port), key);
-  process.stderr.write(acceptedWarning);
 }
-var PINNED_HOST_KEY_ALGORITHM_PATTERN = new RegExp("^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-(?:nistp256|nistp384|nistp521))$", "v");
-function normalizePinnedPublicKey(publicKey) {
-  const parts = publicKey.trim().split(new RegExp("\\s+", "v"));
-  if (parts.length < 2) {
-    throw new Error("Expected host public key must use the format '<algorithm> <base64>'");
-  }
-  const [algorithm, key] = parts;
-  if (!PINNED_HOST_KEY_ALGORITHM_PATTERN.test(algorithm)) {
-    throw new Error(
-      `Expected host public key uses unsupported algorithm '${algorithm}'. Supported algorithms: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521.`
-    );
-  }
-  if (!STRICT_BASE64_PATTERN.test(key)) {
-    throw new Error(
-      "Expected host public key contains invalid base64 in the key field. Use the exact value from `ssh-keygen -y` or the second field of an OpenSSH known_hosts line."
-    );
-  }
-  return `${algorithm} ${key}`;
+function normalizeCausePropertyValue(value, secretList, seen) {
+  if (value === null) return null;
+  if (typeof value === "bigint") return String(value);
+  if (typeof value !== "object") return value;
+  return normalizeObjectCause(value, secretList, seen);
 }
-function validateExpectedHostPublicKey(publicKey) {
-  try {
-    normalizePinnedPublicKey(publicKey);
-    return null;
-  } catch (error) {
-    return error instanceof Error ? error.message : String(error);
-  }
+function isBinaryCauseValue(value) {
+  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
 }
-function formatPresentedPublicKey(key) {
-  try {
-    return `${extractAlgoFromKey(key)} ${key.toString("base64")}`;
-  } catch {
-    return null;
-  }
+function getRegisteredSecrets() {
+  return [...secretCounts.keys()];
 }
-function hasPinnedHostTrustAnchor(options) {
-  return options?.expectedHostFingerprint != null || options?.expectedHostPublicKey != null;
+function clearRegisteredSecrets() {
+  secretCounts.clear();
 }
-function verifyPinnedHostKey(host, key, options) {
-  const normalizedExpectedPublicKey = options.expectedHostPublicKey == null ? null : normalizePinnedPublicKey(options.expectedHostPublicKey);
-  const expectedFingerprint = options.expectedHostFingerprint ?? null;
-  const presentedPublicKey = formatPresentedPublicKey(key);
-  const presentedFingerprint = computeFingerprint(key);
-  const publicKeyMatches = normalizedExpectedPublicKey == null || presentedPublicKey != null && normalizedExpectedPublicKey === presentedPublicKey;
-  const fingerprintMatches = expectedFingerprint == null || expectedFingerprint === presentedFingerprint;
-  if (publicKeyMatches && fingerprintMatches) {
-    return;
-  }
-  throw new HostKeyVerificationError(
-    `HOST KEY VERIFICATION FAILED for ${host}: the remote host key does not match the configured trust anchor.`
-  );
+function maskRegisteredSecrets(text) {
+  if (secretCounts.size === 0) return text;
+  return maskSecrets(text, getRegisteredSecrets());
 }
-async function buildHostVerifier(mode, location, options = {}) {
-  const cache = options.cache ?? defaultHostKeyCache;
-  const { host, port } = location;
-  if (mode === "no" && !hasPinnedHostTrustAnchor(options)) return {};
-  const entries = await withKnownHostsLock(loadKnownHostEntries);
-  const fileEntries = findMatchingEntries(entries, host, port);
-  const cachedKey = cache.get(formatHostNeedle(host, port)) ?? null;
-  let acceptedHostKey = null;
-  const result = {
-    async commitAcceptedHostKey() {
-      if (acceptedHostKey != null) await acceptAndPersistHostKey(location, acceptedHostKey, cache);
-    },
-    hostVerifier(key) {
-      if (mode !== "no" && verifyHostKeyAgainstKnownEntries({ cachedKey, fileEntries, host, key })) {
-        if (hasPinnedHostTrustAnchor(options)) verifyPinnedHostKey(host, key, options);
-        return true;
-      }
-      if (hasPinnedHostTrustAnchor(options)) {
-        verifyPinnedHostKey(host, key, options);
-        return true;
-      }
-      if (mode === "yes") {
-        throw new HostKeyVerificationError(
-          `Host key for ${host} not found in known_hosts. Set strictHostKeyChecking to "accept-new" for explicit TOFU or configure ssh.expectedHostFingerprint / ssh.expectedHostPublicKey.`
-        );
-      }
-      if (mode === "no") return true;
-      acceptedHostKey = Buffer.from(key);
-      return true;
-    }
+
+// src/output.ts
+var CAUSE_INSPECT_DEPTH = 2;
+var CAUSE_INSPECT_MAX_STRING_LENGTH = 1024;
+var CAUSE_REDACT_BINARY_MAX_DEPTH = CAUSE_INSPECT_DEPTH + 1;
+var MODULE_NAME_WIDTH = 56;
+var MIN_MODULE_NAME_WIDTH = 12;
+var OUTPUT_INDENT_UNIT = "  ";
+var SPINNER_FRAME_INTERVAL_MS = 80;
+var ASCII_ESC = 27;
+var ANSI_HIDE_CURSOR = `${String.fromCharCode(ASCII_ESC)}[?25l`;
+var ANSI_SHOW_CURSOR = `${String.fromCharCode(ASCII_ESC)}[?25h`;
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var STATUS_ICONS = {
+  changed: pc.yellow("\u21BA"),
+  failed: pc.red("\u2717"),
+  ok: pc.green("\u2713"),
+  skipped: pc.dim("\u2298"),
+  waiting: pc.cyan("\u23F8")
+};
+var CLI_HEADER_LINES = [
+  "                        _   _      ",
+  "                       | | (_)     ",
+  "  _ __   __ _ _ __ __ _| |_ ___  __",
+  " | '_ \\ / _` | '__/ _` | __| \\ \\/ /",
+  " | |_) | (_| | | | (_| | |_| |>  < ",
+  " | .__/ \\__,_|_|  \\__,_|\\__|_/_/\\_\\",
+  " | |                               ",
+  " |_|  "
+];
+var LIVE_OUTPUT_STATE_KEY = /* @__PURE__ */ Symbol.for("paratix.output.liveState");
+function getSharedLiveOutputState() {
+  const registry = globalThis;
+  const existing = registry[LIVE_OUTPUT_STATE_KEY];
+  if (existing != null) return existing;
+  const created = {
+    activeRecipeGuideDepths: [],
+    activeSpinner: null,
+    cursorHidden: false,
+    pendingRecipeClosureGuideDepths: [],
+    recipeOutputDepth: -1
   };
-  return result;
+  registry[LIVE_OUTPUT_STATE_KEY] = created;
+  return created;
 }
-
-// src/serverDefinitionValidation.ts
-var STRICT_HOST_KEY_ERROR = `Invalid property 'ssh.strictHostKeyChecking' (expected "accept-new", "no", or "yes")`;
-var MAX_TCP_PORT = 65535;
-function describeType(value) {
-  return value === null ? "null" : typeof value;
+var liveOutputState = getSharedLiveOutputState();
+function renderCliHeader(version) {
+  const versionText = pc.dim(`v${version}`);
+  return `${pc.cyan(CLI_HEADER_LINES.join("\n"))}${versionText}
+`;
+}
+function printCliHeader(version) {
+  console.log(renderCliHeader(version));
+}
+function supportsAnimatedModuleOutput() {
+  return process.stdout.isTTY && typeof process.stdout.clearLine === "function" && typeof process.stdout.cursorTo === "function";
+}
+function getModuleIcon(status, waitingFrame) {
+  return status === "waiting" ? pc.cyan(waitingFrame ?? "|") : STATUS_ICONS[status];
+}
+function getModuleStatusText(status) {
+  switch (status) {
+    case "changed": {
+      return pc.yellow(status);
+    }
+    case "failed": {
+      return pc.red(status);
+    }
+    case "ok": {
+      return pc.green(status);
+    }
+    case "skipped": {
+      return pc.dim(status);
+    }
+    case "waiting": {
+      return pc.cyan("running");
+    }
+  }
 }
-function isHostKeyMode(value) {
-  return value === "accept-new" || value === "no" || value === "yes";
+function getCurrentOutputDepth() {
+  return Math.max(liveOutputState.recipeOutputDepth, 0);
 }
-function isRecord(value) {
-  return Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;
+function getGuideDot(depth) {
+  return depth % 2 === 0 ? pc.gray("\xB7") : pc.cyan("\xB7");
 }
-function collectOptionalBooleanErrors(object, key, errors) {
-  if (!(key in object) || object[key] == null) return;
-  if (typeof object[key] !== "boolean") {
-    errors.push(
-      `Invalid property 'ssh.${key}' (expected boolean, got ${describeType(object[key])})`
-    );
+function buildGuideIndent(baseIndent, options) {
+  const indentCharacters = Array.from(baseIndent);
+  const guideDepths = [
+    ...options?.activeGuideDepths ?? liveOutputState.activeRecipeGuideDepths,
+    ...options?.extraGuideDepths ?? []
+  ];
+  for (const guideDepth of guideDepths) {
+    const guideCharacterIndex = OUTPUT_INDENT_UNIT.length * (guideDepth + 1);
+    if (guideCharacterIndex >= indentCharacters.length) continue;
+    indentCharacters[guideCharacterIndex] = options?.colorize === false ? "\xB7" : getGuideDot(guideDepth);
   }
+  return indentCharacters.join("");
 }
-function collectOptionalNumberErrors(parameters) {
-  const { errors, key, object, options } = parameters;
-  if (!(key in object) || object[key] == null) return;
-  const value = object[key];
-  const validatedNumber = validateNumberValue(value);
-  if (validatedNumber == null) {
-    errors.push(`Invalid property 'ssh.${key}' (expected number, got ${describeType(value)})`);
-    return;
-  }
-  if (options?.integer === true && !Number.isInteger(validatedNumber)) {
-    errors.push(`Property 'ssh.${key}' must be an integer`);
-    return;
-  }
-  if (options?.positive === true && validatedNumber <= 0) {
-    errors.push(`Property 'ssh.${key}' must be greater than 0`);
+function clearPendingRecipeClosureGuides() {
+  liveOutputState.pendingRecipeClosureGuideDepths = [];
+}
+function getModuleIndent() {
+  if (liveOutputState.recipeOutputDepth < 0) {
+    return OUTPUT_INDENT_UNIT;
   }
+  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 2);
 }
-function validateNumberValue(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+function getRecipeHeaderIndent() {
+  if (liveOutputState.recipeOutputDepth < 0) return "";
+  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 1);
 }
-function isValidTcpPort(value) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= MAX_TCP_PORT;
+function getErrorIndent() {
+  return `${getModuleIndent()}\u2502 `;
 }
-function collectOptionalStringErrors(object, key, errors) {
-  if (!(key in object) || object[key] == null) return;
-  if (typeof object[key] !== "string") {
-    errors.push(`Invalid property 'ssh.${key}' (expected string, got ${describeType(object[key])})`);
-    return;
-  }
-  if (object[key].length === 0) {
-    errors.push(`Property 'ssh.${key}' must not be an empty string`);
-  }
+function getContinuationIndent() {
+  return `${getModuleIndent()}   `;
 }
-function collectPortsErrors(ssh, errors) {
-  if (!("ports" in ssh)) {
-    errors.push("Missing property 'ssh.ports' (expected array)");
-    return;
-  }
-  if (!Array.isArray(ssh.ports)) {
-    errors.push(`Invalid property 'ssh.ports' (expected array, got ${describeType(ssh.ports)})`);
-    return;
-  }
-  if (ssh.ports.length === 0) {
-    errors.push("Property 'ssh.ports' must not be empty");
-    return;
-  }
-  for (const [index, port] of ssh.ports.entries()) {
-    if (!isValidTcpPort(port)) {
-      errors.push(`Property 'ssh.ports[${index}]' must be an integer between 1 and 65535`);
-    }
+async function withRecipeOutputScope(scopedOperation) {
+  liveOutputState.recipeOutputDepth += 1;
+  try {
+    return await scopedOperation();
+  } finally {
+    liveOutputState.activeRecipeGuideDepths = liveOutputState.activeRecipeGuideDepths.filter((depth) => depth !== liveOutputState.recipeOutputDepth);
+    liveOutputState.pendingRecipeClosureGuideDepths = [liveOutputState.recipeOutputDepth];
+    liveOutputState.recipeOutputDepth -= 1;
   }
 }
-function collectRequiredUserErrors(ssh, errors) {
-  if (!("user" in ssh)) {
-    errors.push("Missing property 'ssh.user' (expected string)");
-    return;
-  }
-  if (typeof ssh.user !== "string") {
-    errors.push(`Invalid property 'ssh.user' (expected string, got ${describeType(ssh.user)})`);
-    return;
-  }
-  if (ssh.user.length === 0) {
-    errors.push("Property 'ssh.user' must not be an empty string");
-  }
+function renderModuleLine(parameters) {
+  const { detail, extraGuideDepths = [], name, status, waitingFrame } = parameters;
+  const baseIndent = getModuleIndent();
+  const indent = buildGuideIndent(baseIndent, { extraGuideDepths });
+  const icon = getModuleIcon(status, waitingFrame);
+  const statusText = getModuleStatusText(status);
+  const detailSuffix = detail == null ? "" : `  ${pc.dim(detail)}`;
+  const alignedNameWidth = Math.max(MODULE_NAME_WIDTH - baseIndent.length, MIN_MODULE_NAME_WIDTH);
+  return `${indent}${icon}  ${name.padEnd(alignedNameWidth)}  ${statusText}${detailSuffix}`;
 }
-function collectStrictHostKeyCheckingErrors(ssh, errors) {
-  if (!("strictHostKeyChecking" in ssh) || ssh.strictHostKeyChecking == null) return;
-  if (typeof ssh.strictHostKeyChecking !== "string" || !isHostKeyMode(ssh.strictHostKeyChecking)) {
-    errors.push(STRICT_HOST_KEY_ERROR);
-  }
+function hideCursor() {
+  if (liveOutputState.cursorHidden) return;
+  if (!supportsAnimatedModuleOutput()) return;
+  process.stdout.write(ANSI_HIDE_CURSOR);
+  liveOutputState.cursorHidden = true;
 }
-function collectExpectedHostPublicKeyErrors(ssh, errors) {
-  if (typeof ssh.expectedHostPublicKey !== "string") return;
-  const error = validateExpectedHostPublicKey(ssh.expectedHostPublicKey);
-  if (error != null) errors.push(`Invalid property 'ssh.expectedHostPublicKey': ${error}`);
+function showCursor() {
+  if (!liveOutputState.cursorHidden) return;
+  process.stdout.write(ANSI_SHOW_CURSOR);
+  liveOutputState.cursorHidden = false;
 }
-function collectOptionalSshFieldErrors(ssh, errors) {
-  collectOptionalStringErrors(ssh, "privateKey", errors);
-  collectOptionalStringErrors(ssh, "sudoPassword", errors);
-  collectOptionalStringErrors(ssh, "expectedHostFingerprint", errors);
-  collectOptionalStringErrors(ssh, "expectedHostPublicKey", errors);
-  collectExpectedHostPublicKeyErrors(ssh, errors);
-  collectOptionalBooleanErrors(ssh, "agentForward", errors);
-  collectOptionalBooleanErrors(ssh, "passwordFallback", errors);
-  collectOptionalNumberErrors({
-    errors,
-    key: "reconnectTimeout",
-    object: ssh,
-    options: { positive: true }
-  });
-  collectOptionalNumberErrors({
-    errors,
-    key: "maxReconnectAttempts",
-    object: ssh,
-    options: { integer: true, positive: true }
-  });
-  collectStrictHostKeyCheckingErrors(ssh, errors);
+function writeAnimatedModuleLine(line) {
+  hideCursor();
+  process.stdout.clearLine(0);
+  process.stdout.cursorTo(0);
+  process.stdout.write(fitAnimatedModuleLine(line, process.stdout.columns));
 }
-function collectSshConfigErrors(value) {
-  const errors = [];
-  if (value === null) {
-    errors.push("Invalid property 'ssh' (expected object, got null)");
-    return errors;
-  }
-  if (typeof value !== "object") {
-    errors.push(`Invalid property 'ssh' (expected object, got ${describeType(value)})`);
-    return errors;
-  }
-  if (!isRecord(value)) {
-    errors.push("Invalid property 'ssh' (expected object, got object)");
-    return errors;
+function stopAnimatedModuleLine(clearCurrentLine = false) {
+  showCursor();
+  if (liveOutputState.activeSpinner == null) return;
+  clearInterval(liveOutputState.activeSpinner.interval);
+  liveOutputState.activeSpinner = null;
+  if (clearCurrentLine && supportsAnimatedModuleOutput()) {
+    process.stdout.clearLine(0);
+    process.stdout.cursorTo(0);
   }
-  const ssh = value;
-  collectPortsErrors(ssh, errors);
-  collectRequiredUserErrors(ssh, errors);
-  collectOptionalSshFieldErrors(ssh, errors);
-  return errors;
 }
-function normalizeServerDefinitionSshError(error) {
-  const mappedErrors = {
-    "Missing property 'ssh.user' (expected string)": "ssh.user is required",
-    "Property 'ssh.expectedHostFingerprint' must not be an empty string": "ssh.expectedHostFingerprint must not be an empty string",
-    "Property 'ssh.expectedHostPublicKey' must not be an empty string": "ssh.expectedHostPublicKey must not be an empty string",
-    "Property 'ssh.ports' must not be empty": "ssh.ports must not be empty",
-    "Property 'ssh.privateKey' must not be an empty string": "ssh.privateKey must not be an empty string",
-    "Property 'ssh.user' must not be an empty string": "ssh.user is required",
-    [STRICT_HOST_KEY_ERROR]: "ssh.strictHostKeyChecking must be one of accept-new, no, yes"
-  };
-  return mappedErrors[error] ?? error;
-}
-function validateSshConfig(ssh) {
-  const errors = collectSshConfigErrors(ssh);
-  if (errors.length === 0) return;
-  throw new Error(`ServerDefinition: ${normalizeServerDefinitionSshError(errors[0])}`);
-}
-
-// src/meta.ts
-var SYSTEM_HOST_KIND = "system.host";
-var SYSTEM_REBOOT_KIND = "system.reboot";
-function hasValidMetaName(name) {
-  return typeof name === "string" && name.length > 0;
+function stopLiveModuleOutput(clearCurrentLine = false) {
+  stopAnimatedModuleLine(clearCurrentLine);
 }
-function isMetaValueType(value) {
-  return value === "boolean" || value === "number" || value === "string";
+function startModuleSpinner(name, detail) {
+  if (!supportsAnimatedModuleOutput()) return;
+  clearPendingRecipeClosureGuides();
+  stopAnimatedModuleLine();
+  const maskedName = maskRegisteredSecrets(name);
+  const maskedDetail = detail == null ? void 0 : maskRegisteredSecrets(detail);
+  const displayModule = formatDisplayModule({
+    continuationIndentWidth: getContinuationIndent().length,
+    detail: maskedDetail,
+    name: maskedName,
+    status: "waiting",
+    terminalColumns: process.stdout.columns
+  });
+  const spinner = {
+    detail: displayModule.detail,
+    frameIndex: 0,
+    interval: setInterval(() => {
+      spinner.frameIndex = (spinner.frameIndex + 1) % SPINNER_FRAMES.length;
+      writeAnimatedModuleLine(
+        renderModuleLine({
+          detail: spinner.detail,
+          name: displayModule.name,
+          status: "waiting",
+          waitingFrame: SPINNER_FRAMES[spinner.frameIndex]
+        })
+      );
+    }, SPINNER_FRAME_INTERVAL_MS)
+  };
+  if (typeof spinner.interval.unref === "function") spinner.interval.unref();
+  liveOutputState.activeSpinner = spinner;
+  writeAnimatedModuleLine(
+    renderModuleLine({
+      detail: displayModule.detail,
+      name: displayModule.name,
+      status: "waiting",
+      waitingFrame: SPINNER_FRAMES[0]
+    })
+  );
 }
-function validateResolvedMetaValue(parameters) {
-  const { actualType, declaredValueType, enforceDeclaredValueType, entryKey } = parameters;
-  if (!isMetaValueType(actualType)) {
-    throw new TypeError(
-      `Env meta entry ${JSON.stringify(entryKey)} resolved to typeof ${actualType}, expected boolean, number, or string`
-    );
-  }
-  if (enforceDeclaredValueType && actualType !== declaredValueType) {
-    throw new TypeError(
-      `Env meta entry ${JSON.stringify(entryKey)} resolved to typeof ${actualType}, expected ${declaredValueType}`
-    );
+function printRecipeHeader(name) {
+  stopAnimatedModuleLine(true);
+  clearPendingRecipeClosureGuides();
+  const header = pc.bold(pc.blue(`[${name}]`));
+  console.log(`${buildGuideIndent(getRecipeHeaderIndent())}${header}`);
+  if (liveOutputState.recipeOutputDepth >= 0) {
+    liveOutputState.activeRecipeGuideDepths = [...liveOutputState.activeRecipeGuideDepths, liveOutputState.recipeOutputDepth];
   }
 }
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
+function printRunContext(parameters) {
+  const mode = parameters.dryRun ? pc.yellow("dry-run") : pc.green("apply");
+  const ports = parameters.ports.join(", ");
+  console.log(
+    pc.dim(`Run ${parameters.name} \xB7 host ${parameters.host} \xB7 ports ${ports} \xB7 mode ${mode}`)
+  );
 }
-function assertValidEnvironmentMetaEntry(candidate) {
-  if (!hasValidMetaName(candidate.name)) {
-    throw new TypeError("Invalid env meta entry: name must be a non-empty string");
-  }
-  if (typeof candidate.resolve !== "function") {
-    throw new TypeError("Invalid env meta entry: resolve must be a function returning a Promise");
-  }
-  if (candidate.valueType !== "boolean" && candidate.valueType !== "number" && candidate.valueType !== "string") {
-    throw new TypeError("Invalid env meta entry: valueType must be boolean, number, or string");
+function colorizeDiffLine(line) {
+  if (line.startsWith("---") || line.startsWith("+++") || line.startsWith("@@")) {
+    return pc.dim(line);
   }
+  if (line.startsWith("-")) return pc.red(line);
+  if (line.startsWith("+")) return pc.green(line);
+  return pc.dim(line);
 }
-function assertValidSshdPortMetaEntry(candidate) {
-  if (!isValidTcpPort(candidate.port)) {
-    throw new TypeError("Invalid sshd.port meta entry: port must be an integer between 1 and 65535");
-  }
+function renderDiffLines(diff) {
+  if (diff.trim() === "") return [];
+  const sanitized = sanitizeTerminalText(maskRegisteredSecrets(diff));
+  return sanitized.split("\n").map((line) => `\u2502 ${colorizeDiffLine(line)}`);
 }
-function assertValidSystemHostMetaEntry(candidate) {
-  const hostValidationFailure = validateHostLabel(candidate.host);
-  if (hostValidationFailure != null) {
-    throw new TypeError(
-      `Invalid system.host meta entry: host ${describeHostValidationFailure(hostValidationFailure)}`
-    );
+function writeContinuationLine(line, extraGuideDepths, via) {
+  const composed = `${buildGuideIndent(getContinuationIndent(), { extraGuideDepths })}${line}`;
+  if (via === "stdout") {
+    process.stdout.write(`${composed}
+`);
+  } else {
+    console.log(composed);
   }
 }
-function isEnvironmentMetaEntry(entry) {
-  return entry.kind === "env";
+function writeContinuationBlock(parameters) {
+  for (const detailLine of parameters.detailLines) {
+    writeContinuationLine(pc.dim(detailLine), parameters.extraGuideDepths, parameters.via);
+  }
+  for (const diffLine of parameters.diffLines) {
+    writeContinuationLine(diffLine, parameters.extraGuideDepths, parameters.via);
+  }
 }
-function isSshdPortMetaEntry(entry) {
-  return entry.kind === "sshd.port";
+function printRenderedModuleResult(parameters) {
+  const extraGuideDepths = parameters.extraGuideDepths ?? [];
+  const maskedName = maskRegisteredSecrets(parameters.name);
+  const maskedDetail = parameters.detail == null ? void 0 : maskRegisteredSecrets(parameters.detail);
+  const displayModule = formatDisplayModule({
+    continuationIndentWidth: `${buildGuideIndent(
+      OUTPUT_INDENT_UNIT.repeat(Math.max(getCurrentOutputDepth() + 2, 1)),
+      { extraGuideDepths }
+    )}   `.length,
+    detail: maskedDetail,
+    name: maskedName,
+    status: parameters.status,
+    terminalColumns: process.stdout.columns
+  });
+  const line = renderModuleLine({
+    detail: displayModule.detail,
+    extraGuideDepths,
+    name: displayModule.name,
+    status: parameters.status
+  });
+  const diffLines = parameters.diff == null ? [] : renderDiffLines(parameters.diff);
+  const usesSpinner = supportsAnimatedModuleOutput() && liveOutputState.activeSpinner != null;
+  if (usesSpinner) {
+    stopAnimatedModuleLine();
+    writeAnimatedModuleLine(line);
+    process.stdout.write("\n");
+  } else {
+    console.log(line);
+  }
+  writeContinuationBlock({
+    detailLines: displayModule.detailLines,
+    diffLines,
+    extraGuideDepths,
+    via: usesSpinner ? "stdout" : "console"
+  });
 }
-function isSystemHostMetaEntry(entry) {
-  return entry.kind === SYSTEM_HOST_KIND;
+function printModuleResult(name, status, detail, diff) {
+  clearPendingRecipeClosureGuides();
+  printRenderedModuleResult({ detail, diff, name, status });
 }
-function isSystemRebootMetaEntry(entry) {
-  return entry.kind === SYSTEM_REBOOT_KIND;
+function printRecipeModuleResult(name, status, detail, diff) {
+  printRenderedModuleResult({
+    detail,
+    diff,
+    extraGuideDepths: liveOutputState.pendingRecipeClosureGuideDepths,
+    name,
+    status
+  });
+  clearPendingRecipeClosureGuides();
 }
-function assertValidModuleMetaEntry(entry) {
-  if (!isRecord2(entry)) {
-    throw new TypeError(`Invalid meta entry: expected object, got ${typeof entry}`);
+function printCommandError(stdout, stderr) {
+  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
+  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
+  const lines = [];
+  if (maskedStderr.trim()) {
+    lines.push(...maskedStderr.trim().split("\n"));
   }
-  switch (entry.kind) {
-    case "env": {
-      assertValidEnvironmentMetaEntry(entry);
-      return;
-    }
-    case "sshd.port": {
-      assertValidSshdPortMetaEntry(entry);
-      return;
-    }
-    case SYSTEM_HOST_KIND: {
-      assertValidSystemHostMetaEntry(entry);
-      return;
+  if (maskedStdout.trim()) {
+    lines.push(...maskedStdout.trim().split("\n"));
+  }
+  if (lines.length > 0) {
+    console.error(pc.red(`${getErrorIndent()}Error output:`));
+    for (const line of lines) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
     }
-    case SYSTEM_REBOOT_KIND: {
-      return;
+  }
+}
+function printVerboseCommandError(stdout, stderr) {
+  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
+  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
+  if (maskedStderr.trim()) {
+    console.error(pc.red(`${getErrorIndent()}Full stderr:`));
+    for (const line of maskedStderr.trim().split("\n")) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
     }
-    default: {
-      throw new TypeError(`Invalid meta entry kind: ${String(entry.kind)}`);
+  }
+  if (maskedStdout.trim()) {
+    console.error(pc.red(`${getErrorIndent()}Full stdout:`));
+    for (const line of maskedStdout.trim().split("\n")) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
     }
   }
 }
-function assertValidModuleMetaEntries(entries) {
-  if (entries == null) return;
-  for (const entry of entries) {
-    assertValidModuleMetaEntry(entry);
+function printVerboseErrorBlock(label, content) {
+  if (!content.trim()) {
+    return;
   }
-}
-var META_ENV_SEGMENT_PATTERN = new RegExp("^[A-Za-z_]\\w*$", "v");
-function isAllowedMetaEnvironmentName(name) {
-  if (name.length === 0) return false;
-  const segments = name.split(".");
-  for (const segment of segments) {
-    if (!META_ENV_SEGMENT_PATTERN.test(segment)) return false;
+  console.error(pc.red(`${getErrorIndent()}${label}`));
+  for (const line of content.trim().split("\n")) {
+    console.error(pc.red(`${getErrorIndent()}${line}`));
   }
-  return true;
 }
-function assertAllowedEnvironmentMetaName(name) {
-  if (!isAllowedMetaEnvironmentName(name)) {
-    throw new Error(
-      `Invalid env meta name ${JSON.stringify(name)}: expected [A-Za-z_]\\w*(\\.[A-Za-z_]\\w*)*`
-    );
+function getErrorCause(error) {
+  return error.cause;
+}
+function printVerboseErrorCause(cause, depth, visitedCauses) {
+  const label = `Cause ${depth}:`;
+  if (cause instanceof Error) {
+    if (visitedCauses.has(cause)) {
+      printVerboseErrorBlock(label, "<cycle detected>");
+      return;
+    }
+    visitedCauses.add(cause);
+    const stack = cause.stack?.trim() ?? "";
+    const stackOrMessage = stack.length > 0 ? stack : String(cause);
+    printVerboseErrorBlock(label, maskRegisteredSecrets(stackOrMessage));
+    const nestedCause = getErrorCause(cause);
+    if (nestedCause !== void 0) {
+      printVerboseErrorCause(nestedCause, depth + 1, visitedCauses);
+    }
+    return;
   }
-  if (ENVIRONMENT_FORBIDDEN_KEYS.has(name)) {
-    throw new Error(
-      `Forbidden env meta entry name: ${JSON.stringify(name)} (reserved JavaScript identifier)`
-    );
+  printVerboseErrorBlock(label, maskRegisteredSecrets(formatCauseValue(cause)));
+}
+function printVerboseGenericError(error) {
+  const stack = error.stack?.trim() ?? "";
+  const stackOrMessage = stack.length > 0 ? stack : String(error);
+  printVerboseErrorBlock("Full stack:", maskRegisteredSecrets(stackOrMessage));
+  const cause = getErrorCause(error);
+  if (cause !== void 0) {
+    const visitedCauses = /* @__PURE__ */ new WeakSet();
+    visitedCauses.add(error);
+    printVerboseErrorCause(cause, 1, visitedCauses);
   }
 }
-function createMemoizedEnvironmentResolver(entry) {
-  let cachedResolution = null;
-  const declaredValueType = entry.valueType;
-  const enforceDeclaredValueType = entry.valueTypeExplicit !== false;
-  const entryKey = entry.name;
-  return async () => {
-    if (cachedResolution != null) return cachedResolution;
-    const pending = entry.resolve().then((resolved) => {
-      validateResolvedMetaValue({
-        actualType: typeof resolved,
-        declaredValueType,
-        enforceDeclaredValueType,
-        entryKey
-      });
-      return resolved;
-    }).catch((error) => {
-      cachedResolution = null;
-      throw error;
-    });
-    cachedResolution = pending;
-    return pending;
-  };
+function formatCauseValue(cause) {
+  if (cause instanceof Error) return cause.message;
+  return inspectRedactedDiagnosticValue(cause, {
+    depth: CAUSE_INSPECT_DEPTH,
+    maxStringLength: CAUSE_INSPECT_MAX_STRING_LENGTH,
+    redactMaxDepth: CAUSE_REDACT_BINARY_MAX_DEPTH
+  });
+}
+function printCauseChain(error) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  visited.add(error);
+  let cause = getErrorCause(error);
+  while (cause !== void 0) {
+    if (cause instanceof Error) {
+      if (visited.has(cause)) return;
+      visited.add(cause);
+    }
+    console.error(pc.red(`${getErrorIndent()}Cause: ${maskRegisteredSecrets(formatCauseValue(cause))}`));
+    if (cause instanceof CommandError) {
+      printVerboseCommandError(
+        maskRegisteredSecrets(cause.fullStdout),
+        maskRegisteredSecrets(cause.fullStderr)
+      );
+    }
+    cause = cause instanceof Error ? getErrorCause(cause) : void 0;
+  }
 }
-async function mergeEnvironmentFromMeta(environment, entries) {
-  if (entries == null || entries.length === 0) {
-    await Promise.resolve();
-    return environment;
+function printCommandFailure(error, verbose) {
+  if (verbose && error instanceof CommandError) {
+    const summaryLine = error.message.split("\n")[0];
+    printCommandError("", maskRegisteredSecrets(summaryLine));
+    printVerboseCommandError(
+      maskRegisteredSecrets(error.fullStdout),
+      maskRegisteredSecrets(error.fullStderr)
+    );
+    return;
   }
-  const nextEnvironment = Object.assign(createNullPrototypeEnvironment(), environment);
-  for (const entry of entries) {
-    if (!isEnvironmentMetaEntry(entry)) continue;
-    assertAllowedEnvironmentMetaName(entry.name);
-    nextEnvironment[entry.name] = createMemoizedEnvironmentResolver(entry);
+  printCommandError("", maskRegisteredSecrets(String(error)));
+  if (error instanceof Error) {
+    if (!(error instanceof CommandError)) {
+      printCauseChain(error);
+    }
+    if (verbose) {
+      printVerboseGenericError(error);
+    }
   }
-  await Promise.resolve();
-  return nextEnvironment;
+}
+function printSummary(stats) {
+  stopAnimatedModuleLine(true);
+  const parts = [
+    pc.yellow(`${stats.changed} changed`),
+    pc.green(`${stats.ok} ok`),
+    pc.dim(`${stats.skipped} skipped`),
+    stats.failed > 0 ? pc.red(`${stats.failed} failed`) : `${stats.failed} failed`,
+    pc.cyan(`${stats.signals} signals triggered`)
+  ];
+  console.log(`
+${parts.join(pc.dim(" \xB7 "))}`);
 }
 
 // src/dryRunRecipe.ts
@@ -2243,109 +2252,601 @@ async function executeDryRunBlockingModule(parameters) {
   const result = childModule._applyDryRun == null ? await childModule.apply(connection, environment) : await childModule._applyDryRun(connection, environment, {
     shutdownSignal: parameters.shutdownSignal
   });
-  const nextEnvironment = result.meta == null ? environment : await mergeEnvironmentFromMeta(environment, result.meta);
-  const diffOutput = diff ? result.diff : void 0;
-  printModuleResult(
-    childModule.name,
-    result.status,
-    result._dryRunDetail ?? "(dry-run)",
-    diffOutput
-  );
+  const nextEnvironment = result.meta == null ? environment : await mergeEnvironmentFromMeta(environment, result.meta);
+  const diffOutput = diff ? result.diff : void 0;
+  printModuleResult(
+    childModule.name,
+    result.status,
+    result._dryRunDetail ?? "(dry-run)",
+    diffOutput
+  );
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  return {
+    env: nextEnvironment,
+    meta: result.meta,
+    shouldBreak: result.status === "failed" || result._stopRun === true,
+    status: result.status,
+    stopRun: result._stopRun
+  };
+}
+async function executeDryRunChildModule(parameters) {
+  const { childModule, diff, environment, ssh, verbose } = parameters;
+  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
+  const connection = childModule.local === true ? null : ssh;
+  startModuleSpinner(childModule.name);
+  const checkResult = await childModule.check(connection, environment);
+  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
+  if (checkResult !== "ok" && shouldExecuteApplyDuringDryRun(childModule, diff)) {
+    return executeDryRunBlockingModule({
+      childModule,
+      connection,
+      diff,
+      environment,
+      shutdownSignal: parameters.shutdownSignal,
+      verbose
+    });
+  }
+  const status = checkResult === "ok" ? "ok" : "changed";
+  const suffix = checkResult === "ok" ? void 0 : "(dry-run)";
+  printModuleResult(childModule.name, status, suffix);
+  return { env: environment, shouldBreak: false, status };
+}
+function applyDryRunChildResult(accumulator, result) {
+  return {
+    aggregatedMeta: result.meta == null ? accumulator.aggregatedMeta : [...accumulator.aggregatedMeta, ...result.meta],
+    aggregatedStatus: result.status === "changed" ? "changed" : accumulator.aggregatedStatus,
+    currentEnvironment: result.env
+  };
+}
+async function runDryRunChildLoop(parameters) {
+  let accumulator = parameters.accumulator;
+  for (const childModule of parameters.recipeModule._modules) {
+    if (parameters.shutdownSignal() != null) {
+      return interruptedDryRunResult({
+        aggregatedMeta: accumulator.aggregatedMeta,
+        aggregatedStatus: accumulator.aggregatedStatus,
+        currentEnvironment: accumulator.currentEnvironment
+      });
+    }
+    const result = await executeDryRunChildModule({
+      childModule,
+      diff: parameters.diff,
+      environment: accumulator.currentEnvironment,
+      shutdownSignal: parameters.shutdownSignal,
+      ssh: parameters.ssh,
+      verbose: parameters.verbose
+    });
+    if (result.shouldBreak) return result;
+    accumulator = applyDryRunChildResult(accumulator, result);
+  }
+  return accumulator;
+}
+async function dryRunRecipeModule(parameters) {
+  return withRecipeOutputScope(async () => {
+    const { environment, recipeModule, ssh } = parameters;
+    printRecipeHeader(recipeModule.name);
+    const shutdownSignal = parameters.shutdownSignal ?? (() => null);
+    const loopResult = await runDryRunChildLoop({
+      accumulator: {
+        aggregatedMeta: [],
+        aggregatedStatus: "ok",
+        currentEnvironment: environment
+      },
+      diff: parameters.options?.diff ?? false,
+      recipeModule,
+      shutdownSignal,
+      ssh,
+      verbose: parameters.options?.verbose ?? false
+    });
+    if ("shouldBreak" in loopResult) return loopResult;
+    return {
+      env: loopResult.currentEnvironment,
+      meta: loopResult.aggregatedMeta.length === 0 ? void 0 : loopResult.aggregatedMeta,
+      shouldBreak: false,
+      status: loopResult.aggregatedStatus
+    };
+  });
+}
+
+// src/runnerAbortSignal.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var runnerAbortSignalStorage = new AsyncLocalStorage3();
+async function withRunnerAbortSignal(signal, body) {
+  return runnerAbortSignalStorage.run(signal, body);
+}
+function getRunnerAbortSignal() {
+  return runnerAbortSignalStorage.getStore();
+}
+
+// src/signalOrchestration.ts
+function handleSignalResult(parameters) {
+  const { hooks, result, signalName, verbose } = parameters;
+  printModuleResult(`signal: ${signalName}`, result.status);
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  hooks?.onSignalFinished?.(result.status);
+  return result.status === "failed" ? "failed" : "changed";
+}
+function handleSignalFailure(parameters) {
+  const { error, hooks, signalName, verbose } = parameters;
+  printModuleResult(`signal: ${signalName}`, "failed");
+  printCommandFailure(error, verbose);
+  hooks?.onSignalFinished?.("failed");
+  return "failed";
+}
+async function applySignalMeta(parameters) {
+  assertValidModuleMetaEntries(parameters.result.meta);
+  const nextEnvironment = parameters.result.status === "failed" ? parameters.currentEnvironment : await mergeEnvironmentFromMeta(parameters.currentEnvironment, parameters.result.meta);
+  await parameters.onSignalStep?.({
+    env: nextEnvironment,
+    meta: parameters.result.meta,
+    status: parameters.result.status
+  });
+  return nextEnvironment;
+}
+async function runOneSignal(parameters) {
+  const connection = parameters.signal.local === true ? null : parameters.ssh;
+  startModuleSpinner(`signal: ${parameters.signal.name}`);
+  const result = parameters.shutdownSignal == null ? await parameters.signal.apply(connection, parameters.currentEnvironment) : await parameters.signal.apply(connection, parameters.currentEnvironment, {
+    shutdownSignal: parameters.shutdownSignal
+  });
+  const nextEnvironment = await applySignalMeta({
+    currentEnvironment: parameters.currentEnvironment,
+    onSignalStep: parameters.onSignalStep,
+    result
+  });
+  return {
+    nextEnvironment,
+    status: handleSignalResult({
+      hooks: parameters.hooks,
+      result,
+      signalName: parameters.signal.name,
+      verbose: parameters.verbose
+    })
+  };
+}
+async function runSignalModules(parameters) {
+  const getShutdownSignal = parameters.shutdownSignal ?? (() => null);
+  const verbose = parameters.verbose ?? false;
+  let currentEnvironment = parameters.environment;
+  let status = "changed";
+  for (const signal of parameters.signals) {
+    if (getShutdownSignal() != null) break;
+    parameters.hooks?.onSignalStarted?.();
+    try {
+      const signalStep = await runOneSignal({
+        currentEnvironment,
+        hooks: parameters.hooks,
+        onSignalStep: parameters.onSignalStep,
+        shutdownSignal: parameters.shutdownSignal,
+        signal,
+        ssh: parameters.ssh,
+        verbose
+      });
+      currentEnvironment = signalStep.nextEnvironment;
+      if (signalStep.status === "failed") status = "failed";
+    } catch (error) {
+      status = handleSignalFailure({
+        error,
+        hooks: parameters.hooks,
+        signalName: signal.name,
+        verbose
+      });
+    }
+  }
+  return status;
+}
+
+// src/types.ts
+var NEEDS_APPLY = "needs-apply";
+
+// src/recipe.ts
+var INTERRUPTED_BEFORE_APPLY = /* @__PURE__ */ Symbol("recipe-interrupted-before-apply");
+function isRecipe(module) {
+  return module.kind === "recipe";
+}
+function printRecipeChildResult(module, result) {
+  if (isRecipe(module)) {
+    printRecipeModuleResult(module.name, result.status, result.detail);
+    return;
+  }
+  printModuleResult(module.name, result.status, result.detail);
+}
+function applyRecipeStepToState(state, step, preserveControlPlaneMeta) {
+  let stepMeta;
+  if (step.meta == null) {
+    stepMeta = void 0;
+  } else if (preserveControlPlaneMeta) {
+    stepMeta = step.meta;
+  } else {
+    stepMeta = step.meta.filter(isEnvironmentMetaEntry);
+  }
+  const nextMeta = stepMeta == null ? state.meta ?? [] : [...state.meta ?? [], ...stepMeta];
+  let nextStatus = state.status;
+  if (step.status === "failed") nextStatus = "failed";
+  else if (step.status === "changed") nextStatus = "changed";
+  return {
+    env: step.env,
+    meta: nextMeta,
+    signalsPending: step.status === "changed" ? true : state.signalsPending,
+    status: nextStatus,
+    stopRun: step._stopRun === true ? true : state.stopRun
+  };
+}
+async function executeOneModule(parameters) {
+  const { currentEnvironment, ssh, targetModule } = parameters;
+  const verbose = parameters.verbose ?? false;
+  const connection = targetModule.local === true ? null : ssh;
+  const checkResult = await checkRecipeChild(targetModule, connection, currentEnvironment);
+  if (checkResult === "ok") {
+    printModuleResult(targetModule.name, "ok");
+    return null;
+  }
+  if ((parameters.shutdownSignal?.() ?? null) != null) {
+    return INTERRUPTED_BEFORE_APPLY;
+  }
+  const result = await applyRecipeChild({
+    connection,
+    currentEnvironment,
+    onChildStep: parameters.onChildStep,
+    onSignalStep: parameters.onSignalStep,
+    shutdownSignal: parameters.shutdownSignal,
+    signalHooks: parameters.signalHooks,
+    targetModule,
+    verbose
+  });
+  printRecipeChildResult(targetModule, result);
   if (result.status === "failed" && result.error != null) {
     printCommandFailure(result.error, verbose);
   }
+  const environment = result.status === "failed" ? currentEnvironment : await mergeEnvironmentFromMeta(currentEnvironment, result.meta);
   return {
-    env: nextEnvironment,
+    _flushSignals: result._flushSignals,
+    _stopRun: result._stopRun,
+    env: environment,
     meta: result.meta,
-    shouldBreak: result.status === "failed" || result._stopRun === true,
-    status: result.status,
-    stopRun: result._stopRun
+    status: result.status
   };
 }
-async function executeDryRunChildModule(parameters) {
-  const { childModule, diff, environment, ssh, verbose } = parameters;
-  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
-  const connection = childModule.local === true ? null : ssh;
-  startModuleSpinner(childModule.name);
-  const checkResult = await childModule.check(connection, environment);
-  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
-  if (checkResult !== "ok" && shouldExecuteApplyDuringDryRun(childModule, diff)) {
-    return executeDryRunBlockingModule({
-      childModule,
-      connection,
-      diff,
-      environment,
+async function checkRecipeChild(targetModule, connection, currentEnvironment) {
+  startModuleSpinner(targetModule.name);
+  return targetModule.check(connection, currentEnvironment);
+}
+async function applyRecipeChild(parameters) {
+  if (isRecipe(parameters.targetModule)) {
+    return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment, {
+      onChildStep: parameters.onChildStep,
+      onSignalStep: parameters.onSignalStep,
       shutdownSignal: parameters.shutdownSignal,
-      verbose
+      signalHooks: parameters.signalHooks,
+      verbose: parameters.verbose
     });
   }
-  const status = checkResult === "ok" ? "ok" : "changed";
-  const suffix = checkResult === "ok" ? void 0 : "(dry-run)";
-  printModuleResult(childModule.name, status, suffix);
-  return { env: environment, shouldBreak: false, status };
+  if (parameters.targetModule._supportsChildStepHook === true && (parameters.onChildStep != null || parameters.shutdownSignal != null)) {
+    return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment, {
+      onChildStep: parameters.onChildStep,
+      shutdownSignal: parameters.shutdownSignal
+    });
+  }
+  return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment);
 }
-function applyDryRunChildResult(accumulator, result) {
+async function applyExecutedRecipeStep(parameters) {
+  if (parameters.step == null) return parameters.state;
+  if (parameters.step === INTERRUPTED_BEFORE_APPLY) return null;
+  if (parameters.onChildStep != null) {
+    await parameters.onChildStep(parameters.step);
+  }
+  return applyRecipeStepToState(
+    parameters.state,
+    parameters.step,
+    parameters.preserveControlPlaneMeta
+  );
+}
+function failedRecipeState(environment) {
   return {
-    aggregatedMeta: result.meta == null ? accumulator.aggregatedMeta : [...accumulator.aggregatedMeta, ...result.meta],
-    aggregatedStatus: result.status === "changed" ? "changed" : accumulator.aggregatedStatus,
-    currentEnvironment: result.env
+    env: environment,
+    meta: void 0,
+    signalsPending: false,
+    status: "failed"
   };
 }
-async function runDryRunChildLoop(parameters) {
-  let accumulator = parameters.accumulator;
-  for (const childModule of parameters.recipeModule._modules) {
+function annotateRecipeChildError(moduleName, error) {
+  const prefix = `[${moduleName}] `;
+  if (error instanceof CommandError) {
+    return new CommandError(`${prefix}${error.message}`, error.fullStdout, error.fullStderr);
+  }
+  if (error instanceof Error) {
+    return new Error(`${prefix}${error.message}`);
+  }
+  return new Error(`${prefix}${String(error)}`);
+}
+async function executeRecipeChildStep(parameters) {
+  try {
+    return { kind: "step", step: await executeOneModule(parameters) };
+  } catch (error) {
     if (parameters.shutdownSignal() != null) {
-      return interruptedDryRunResult({
-        aggregatedMeta: accumulator.aggregatedMeta,
-        aggregatedStatus: accumulator.aggregatedStatus,
-        currentEnvironment: accumulator.currentEnvironment
-      });
+      return { kind: "step", step: INTERRUPTED_BEFORE_APPLY };
     }
-    const result = await executeDryRunChildModule({
-      childModule,
-      diff: parameters.diff,
-      environment: accumulator.currentEnvironment,
+    printModuleResult(parameters.targetModule.name, "failed");
+    printCommandFailure(error, parameters.verbose);
+    return { kind: "failed", state: failedRecipeState(parameters.currentEnvironment) };
+  }
+}
+async function processRecipeStep(parameters) {
+  if (parameters.step.kind === "failed") {
+    return { kind: "break", state: parameters.step.state };
+  }
+  const nextState = await applyExecutedRecipeStep({
+    onChildStep: parameters.onChildStep,
+    preserveControlPlaneMeta: parameters.preserveControlPlaneMeta,
+    state: parameters.state,
+    step: parameters.step.step
+  });
+  if (nextState == null) {
+    return { kind: "break", state: parameters.state };
+  }
+  let state = nextState;
+  if (shouldFlushRecipeSignals(parameters.step.step, state, parameters.signals)) {
+    const signalStatus = await flushPendingRecipeSignals({
+      environment: state.env,
+      onSignalStep: parameters.onSignalStep,
       shutdownSignal: parameters.shutdownSignal,
+      signalHooks: parameters.signalHooks,
+      signals: parameters.signals,
       ssh: parameters.ssh,
       verbose: parameters.verbose
     });
-    if (result.shouldBreak) return result;
-    accumulator = applyDryRunChildResult(accumulator, result);
+    state = applyRecipeSignalStatus(state, signalStatus);
   }
-  return accumulator;
+  if (state.status === "failed" || state.stopRun === true) {
+    return { kind: "break", state };
+  }
+  return { kind: "continue", state };
 }
-async function dryRunRecipeModule(parameters) {
-  return withRecipeOutputScope(async () => {
-    const { environment, recipeModule, ssh } = parameters;
-    printRecipeHeader(recipeModule.name);
-    const shutdownSignal = parameters.shutdownSignal ?? (() => null);
-    const loopResult = await runDryRunChildLoop({
-      accumulator: {
-        aggregatedMeta: [],
-        aggregatedStatus: "ok",
-        currentEnvironment: environment
-      },
-      diff: parameters.options?.diff ?? false,
-      recipeModule,
+async function executeModules(modules, ssh, parameters) {
+  const onChildStep = parameters.onChildStep;
+  const preserveControlPlaneMeta = onChildStep == null;
+  const shutdownSignal = parameters.shutdownSignal ?? (() => null);
+  const verbose = parameters.verbose ?? false;
+  let state = {
+    // R-0000079: preserve the null-prototype guarantee that
+    // R-0000069/R-0000070/R-0000074 establish for the runner-level
+    // environment. Plain object spread (`{ ...environment }`) would create a
+    // map with `Object.prototype`, exposing the first child module of every
+    // recipe to a polluted-fähige environment. Mirror the meta.ts:214
+    // approach.
+    env: Object.assign(createNullPrototypeEnvironment(), parameters.environment),
+    meta: void 0,
+    signalsPending: false,
+    status: "ok"
+  };
+  for (const currentModule of modules) {
+    if (shutdownSignal() != null) break;
+    const step = await executeRecipeChildStep({
+      currentEnvironment: state.env,
+      onChildStep,
+      onSignalStep: parameters.onSignalStep,
       shutdownSignal,
+      signalHooks: parameters.signalHooks,
       ssh,
-      verbose: parameters.options?.verbose ?? false
+      targetModule: currentModule,
+      verbose
     });
-    if ("shouldBreak" in loopResult) return loopResult;
+    const processedStep = await processRecipeStep({
+      onChildStep,
+      onSignalStep: parameters.onSignalStep,
+      preserveControlPlaneMeta,
+      shutdownSignal,
+      signalHooks: parameters.signalHooks,
+      signals: parameters.signals,
+      ssh,
+      state,
+      step,
+      verbose
+    });
+    state = processedStep.state;
+    if (processedStep.kind === "break") return state;
+  }
+  return state;
+}
+async function triggerSignals(parameters) {
+  return runSignalModules({
+    environment: parameters.environment,
+    hooks: parameters.signalHooks,
+    onSignalStep: parameters.onSignalStep,
+    shutdownSignal: parameters.shutdownSignal,
+    signals: parameters.signals,
+    ssh: parameters.ssh,
+    verbose: parameters.verbose
+  });
+}
+function shouldFlushRecipeSignals(step, state, signals) {
+  return step != null && step !== INTERRUPTED_BEFORE_APPLY && step._flushSignals === true && state.signalsPending && signals != null;
+}
+function applyRecipeSignalStatus(state, signalStatus) {
+  return {
+    ...state,
+    signalsPending: false,
+    status: signalStatus === "failed" ? "failed" : state.status
+  };
+}
+async function flushPendingRecipeSignals(parameters) {
+  return triggerSignals(parameters);
+}
+async function applyRecipe(parameters) {
+  return withRecipeOutputScope(async () => {
+    const shutdownSignal = parameters.options?.shutdownSignal;
+    const verbose = parameters.options?.verbose ?? false;
+    printRecipeHeader(parameters.name);
+    const state = await executeModules(parameters.modules, parameters.ssh, {
+      environment: parameters.environment,
+      onChildStep: parameters.options?.onChildStep,
+      onSignalStep: parameters.options?.onSignalStep,
+      shutdownSignal,
+      signalHooks: parameters.options?.signalHooks,
+      signals: parameters.signals,
+      verbose
+    });
+    if (shouldRunRecipeSignalsAtEnd(state, parameters.signals)) {
+      state.status = await triggerSignals({
+        environment: state.env,
+        onSignalStep: parameters.options?.onSignalStep,
+        shutdownSignal,
+        signalHooks: parameters.options?.signalHooks,
+        signals: parameters.signals,
+        ssh: parameters.ssh,
+        verbose
+      });
+    }
     return {
-      env: loopResult.currentEnvironment,
-      meta: loopResult.aggregatedMeta.length === 0 ? void 0 : loopResult.aggregatedMeta,
-      shouldBreak: false,
-      status: loopResult.aggregatedStatus
+      _stopRun: state.stopRun,
+      meta: state.meta,
+      status: state.status
     };
   });
 }
+function shouldRunRecipeSignalsAtEnd(state, signals) {
+  return state.signalsPending && state.status === "changed" && signals != null;
+}
+function shouldExecuteRecipeDryRun(module) {
+  return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
+}
+function recipeNeedsDryRunApply(modules) {
+  return modules.some((module) => shouldExecuteRecipeDryRun(module));
+}
+function createRecipeDryRunApply(name, modules, needsDryRunApply) {
+  if (!needsDryRunApply) return void 0;
+  return async (ssh, environment, parameters) => {
+    const result = await dryRunRecipeModule({
+      environment,
+      recipeModule: {
+        _modules: modules,
+        async apply() {
+          await Promise.resolve();
+          return { status: "ok" };
+        },
+        async check() {
+          await Promise.resolve();
+          return "ok";
+        },
+        kind: "recipe",
+        name
+      },
+      shutdownSignal: parameters?.shutdownSignal,
+      ssh
+    });
+    return {
+      _stopRun: result.stopRun,
+      meta: result.meta,
+      status: result.status ?? "ok"
+    };
+  };
+}
+function recipe(name, modules, options) {
+  const needsDryRunApply = recipeNeedsDryRunApply(modules);
+  const applyDryRun = createRecipeDryRunApply(name, modules, needsDryRunApply);
+  return {
+    ...modules.some((module) => module._dryRunBlocker === true) ? { _dryRunBlocker: true } : {},
+    ...modules.some((module) => module._dryRunMetaProducer === true) ? { _dryRunMetaProducer: true } : {},
+    ...applyDryRun == null ? {} : { _applyDryRun: applyDryRun },
+    _modules: modules,
+    _signals: options?.signals,
+    _supportsChildStepHook: true,
+    async apply(ssh, environment, parameters) {
+      return applyRecipe({
+        environment,
+        modules,
+        name,
+        options: parameters,
+        signals: options?.signals,
+        ssh
+      });
+    },
+    async check(ssh, environment) {
+      for (const childModule of modules) {
+        if (getRunnerAbortSignal()?.aborted === true) return NEEDS_APPLY;
+        const connection = childModule.local === true ? null : ssh;
+        let result;
+        try {
+          result = await childModule.check(connection, environment);
+        } catch (error) {
+          throw annotateRecipeChildError(childModule.name, error);
+        }
+        if (result === NEEDS_APPLY) return NEEDS_APPLY;
+      }
+      return "ok";
+    },
+    kind: "recipe",
+    name
+  };
+}
 
-// src/runnerAbortSignal.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var runnerAbortSignalStorage = new AsyncLocalStorage3();
-async function withRunnerAbortSignal(signal, body) {
-  return runnerAbortSignalStorage.run(signal, body);
+// src/moduleFilter.ts
+var SKIP_DRY_RUN_DETAIL = "filtered out";
+function parseFilterNames(rawValues) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawValue of rawValues) {
+    for (const part of rawValue.split(",")) {
+      const name = part.trim();
+      if (name === "" || seen.has(name)) continue;
+      seen.add(name);
+      names.push(name);
+    }
+  }
+  return names;
+}
+function collectModuleNames(modules) {
+  const names = /* @__PURE__ */ new Set();
+  const visit = (module) => {
+    names.add(module.name);
+    if (isRecipe(module)) {
+      for (const child of module._modules) visit(child);
+    }
+  };
+  for (const module of modules) visit(module);
+  return names;
+}
+function subtreeHasFilterMatch(module, filter) {
+  if (filter.has(module.name)) return true;
+  if (isRecipe(module)) {
+    return module._modules.some((child) => subtreeHasFilterMatch(child, filter));
+  }
+  return false;
+}
+function createSkipModule(name) {
+  return {
+    async _applyDryRun() {
+      await Promise.resolve();
+      return { _dryRunDetail: SKIP_DRY_RUN_DETAIL, status: "skipped" };
+    },
+    _dryRunBlocker: true,
+    async apply() {
+      await Promise.resolve();
+      return { status: "skipped" };
+    },
+    async check() {
+      await Promise.resolve();
+      return NEEDS_APPLY;
+    },
+    local: true,
+    name
+  };
+}
+function filterNode(module, filter, ancestorSelected) {
+  const selfSelected = ancestorSelected || filter.has(module.name);
+  if (selfSelected) return module;
+  if (isRecipe(module) && subtreeHasFilterMatch(module, filter)) {
+    const filteredChildren = module._modules.map((child) => filterNode(child, filter, false));
+    return recipe(module.name, filteredChildren, { signals: module._signals });
+  }
+  return createSkipModule(module.name);
+}
+function applyModuleFilter(modules, filter) {
+  return modules.map((module) => filterNode(module, filter, false));
 }
 
 // src/runnerHelpers.ts
@@ -2421,88 +2922,8 @@ function readActiveBus() {
   const value = Reflect.get(globalThis, ACTIVE_BUS_KEY);
   return isSignalBus(value) ? value : void 0;
 }
-function getSignalBus() {
-  return readActiveBus() ?? defaultProcessSignalBus;
-}
-
-// src/signalOrchestration.ts
-function handleSignalResult(parameters) {
-  const { hooks, result, signalName, verbose } = parameters;
-  printModuleResult(`signal: ${signalName}`, result.status);
-  if (result.status === "failed" && result.error != null) {
-    printCommandFailure(result.error, verbose);
-  }
-  hooks?.onSignalFinished?.(result.status);
-  return result.status === "failed" ? "failed" : "changed";
-}
-function handleSignalFailure(parameters) {
-  const { error, hooks, signalName, verbose } = parameters;
-  printModuleResult(`signal: ${signalName}`, "failed");
-  printCommandFailure(error, verbose);
-  hooks?.onSignalFinished?.("failed");
-  return "failed";
-}
-async function applySignalMeta(parameters) {
-  assertValidModuleMetaEntries(parameters.result.meta);
-  const nextEnvironment = parameters.result.status === "failed" ? parameters.currentEnvironment : await mergeEnvironmentFromMeta(parameters.currentEnvironment, parameters.result.meta);
-  await parameters.onSignalStep?.({
-    env: nextEnvironment,
-    meta: parameters.result.meta,
-    status: parameters.result.status
-  });
-  return nextEnvironment;
-}
-async function runOneSignal(parameters) {
-  const connection = parameters.signal.local === true ? null : parameters.ssh;
-  startModuleSpinner(`signal: ${parameters.signal.name}`);
-  const result = parameters.shutdownSignal == null ? await parameters.signal.apply(connection, parameters.currentEnvironment) : await parameters.signal.apply(connection, parameters.currentEnvironment, {
-    shutdownSignal: parameters.shutdownSignal
-  });
-  const nextEnvironment = await applySignalMeta({
-    currentEnvironment: parameters.currentEnvironment,
-    onSignalStep: parameters.onSignalStep,
-    result
-  });
-  return {
-    nextEnvironment,
-    status: handleSignalResult({
-      hooks: parameters.hooks,
-      result,
-      signalName: parameters.signal.name,
-      verbose: parameters.verbose
-    })
-  };
-}
-async function runSignalModules(parameters) {
-  const getShutdownSignal = parameters.shutdownSignal ?? (() => null);
-  const verbose = parameters.verbose ?? false;
-  let currentEnvironment = parameters.environment;
-  let status = "changed";
-  for (const signal of parameters.signals) {
-    if (getShutdownSignal() != null) break;
-    parameters.hooks?.onSignalStarted?.();
-    try {
-      const signalStep = await runOneSignal({
-        currentEnvironment,
-        hooks: parameters.hooks,
-        onSignalStep: parameters.onSignalStep,
-        shutdownSignal: parameters.shutdownSignal,
-        signal,
-        ssh: parameters.ssh,
-        verbose
-      });
-      currentEnvironment = signalStep.nextEnvironment;
-      if (signalStep.status === "failed") status = "failed";
-    } catch (error) {
-      status = handleSignalFailure({
-        error,
-        hooks: parameters.hooks,
-        signalName: signal.name,
-        verbose
-      });
-    }
-  }
-  return status;
+function getSignalBus() {
+  return readActiveBus() ?? defaultProcessSignalBus;
 }
 
 // src/ssh.ts
@@ -3044,48 +3465,36 @@ function expandHomePath(path) {
   if (path.startsWith("~/")) return join3(homedir2(), path.slice(2));
   return path;
 }
-function resolveWriteFileMode(remotePath, options) {
-  if (options?.mode == null) {
-    throw new Error(
-      `[ssh.writeFile: ${remotePath}] missing options.mode; pass { mode: "0644" } or another explicit file mode`
-    );
-  }
+var DEFAULT_FILE_MODE = "0600";
+function resolveFileMode(operation, remotePath, options) {
+  const mode = options?.mode ?? DEFAULT_FILE_MODE;
   try {
-    validateMode(options.mode);
+    validateMode(mode);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(
-      `[ssh.writeFile: ${remotePath}] invalid options.mode "${options.mode}": ${reason}`,
-      { cause: error }
-    );
+    throw new Error(`[ssh.${operation}: ${remotePath}] invalid options.mode "${mode}": ${reason}`, {
+      cause: error
+    });
   }
-  return options.mode;
+  return mode;
 }
 var COMMAND_TIMEOUT = 12e4;
-var DEFAULT_MAX_RECONNECT_ATTEMPTS = 10;
 var DEFAULT_RECONNECT_TIMEOUT = 12e4;
+function resolveReconnectBudget(config, defaultTimeout) {
+  return {
+    maxAttempts: config.maxReconnectAttempts ?? Number.POSITIVE_INFINITY,
+    timeout: config.reconnectTimeout ?? defaultTimeout ?? DEFAULT_RECONNECT_TIMEOUT
+  };
+}
 var EMPTY_FILE_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
 var DISCONNECT_DESTROY_FALLBACK_MS = 5e3;
 var JITTER_BASE = 0.75;
 var JITTER_RANGE = 0.5;
 var RECONNECT_BASE_DELAY = 1e3;
 var RECONNECT_MAX_DELAY = 3e4;
-var RAW_OUTPUT_ERROR_SNIPPET_LENGTH = 500;
 function getAbortReason(signal) {
   return signal.reason instanceof Error ? signal.reason : new Error("SSH operation aborted");
 }
-function truncateRawOutputErrorSnippet(text) {
-  let count = 0;
-  let sliceEnd = 0;
-  for (const char of text) {
-    if (count >= RAW_OUTPUT_ERROR_SNIPPET_LENGTH) {
-      return `${text.slice(0, sliceEnd)}\u2026(truncated)`;
-    }
-    sliceEnd += char.length;
-    count++;
-  }
-  return text;
-}
 function toError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
@@ -3363,9 +3772,8 @@ var SshConnectionImpl = class {
     }
     return result.stdout;
   }
-  async reconnect() {
-    const timeout = this.config.reconnectTimeout ?? DEFAULT_RECONNECT_TIMEOUT;
-    const maxAttempts = this.config.maxReconnectAttempts ?? DEFAULT_MAX_RECONNECT_ATTEMPTS;
+  async reconnect(options) {
+    const { maxAttempts, timeout } = resolveReconnectBudget(this.config, options?.defaultTimeout);
     const deadline = Date.now() + timeout;
     let attempt = 0;
     while (Date.now() < deadline && attempt < maxAttempts) {
@@ -3407,13 +3815,25 @@ var SshConnectionImpl = class {
   updateHost(host) {
     this.runtime.host = host;
   }
+  /**
+   * Upload a local file to the remote host via SFTP, staged to a temp file and
+   * finalized atomically with `mv`.
+   *
+   * @param localPath - Path to the local upload source.
+   * @param remotePath - Destination path on the remote host.
+   * @param options - Optional settings for the remote upload.
+   * @param options.mode - File mode to set via `chmod` on the temp file before
+   *   moving (e.g. `"0644"`). Optional; defaults to `"0600"` when omitted, matching
+   *   {@link writeFile}.
+   */
   async uploadFile(localPath, remotePath, options) {
     const client = this.ensureClient();
     const localFileStats = await statLocalFile(localPath);
     const localFileSize = localFileStats.size;
     const expectedHash = await computeLocalFileSha256(localPath);
     const temporaryPath = await this.createRemoteWritableTempPath(remotePath, "paratix-upload");
-    const temporaryMode = options?.mode ?? "0600";
+    const temporaryMode = resolveFileMode("uploadFile", remotePath, options);
+    let finalized = false;
     try {
       await sftpUpload(
         client,
@@ -3425,23 +3845,26 @@ var SshConnectionImpl = class {
         // remote temp path before they reach an operator-visible error.
         prepareSecrets(this.buildSecrets())
       );
-      await this.setRemoteTempMode(temporaryPath, temporaryMode);
-      await this.assertRemoteFileSize(temporaryPath, localFileSize);
-      await this.finalizeRemoteTempFile(temporaryPath, remotePath, temporaryMode);
+      await this.stageRemoteTempFile({
+        expectedSize: localFileSize,
+        mode: temporaryMode,
+        operation: "uploadFile",
+        temporaryPath
+      });
+      const remoteHash = await this.finalizeAndHashRemoteFile(
+        temporaryPath,
+        remotePath,
+        temporaryMode
+      );
+      finalized = true;
       await this.ensureRemoteUploadFile({
         expectedHash,
         expectedSize: localFileSize,
+        remoteHash,
         remotePath
       });
     } finally {
-      try {
-        await this.cleanupRemoteTempFile(temporaryPath);
-      } catch (cleanupError) {
-        process.stderr.write(
-          `Warning: failed to remove temp file ${temporaryPath}: ${maskSecrets(String(cleanupError), this.buildSecrets())}
-`
-        );
-      }
+      if (!finalized) await this.cleanupUploadTemporaryPath(temporaryPath);
     }
   }
   /**
@@ -3453,15 +3876,18 @@ var SshConnectionImpl = class {
    *
    * @param remotePath - Destination path on the remote host.
    * @param content - The string content to write.
-   * @param options - Settings for the remote write.
-   * @param options.mode - File mode to set via `chmod` on the temp file before moving (e.g. `"0644"`).
+   * @param options - Optional settings for the remote write.
+   * @param options.mode - File mode to set via `chmod` on the temp file before
+   *   moving (e.g. `"0644"`). Optional; defaults to `"0600"` when omitted, matching
+   *   {@link uploadFile}.
    */
   async writeFile(remotePath, content, options) {
     const client = this.ensureClient();
     const remoteTemporary = await this.createRemoteWritableTempPath(remotePath, "paratix-write");
-    const temporaryMode = resolveWriteFileMode(remotePath, options);
+    const temporaryMode = resolveFileMode("writeFile", remotePath, options);
     const expectedSize = Buffer.byteLength(content, "utf8");
     const expectedHash = createHash2("sha256").update(content, "utf8").digest("hex");
+    let finalized = false;
     try {
       await sftpUploadContent(
         client,
@@ -3474,18 +3900,28 @@ var SshConnectionImpl = class {
         // with values registered in the secret sink.
         prepareSecrets(this.buildSecrets())
       );
-      await this.setRemoteTempMode(remoteTemporary, temporaryMode);
-      await this.assertRemoteFileSize(remoteTemporary, expectedSize, "writeFile");
-      await this.finalizeRemoteTempFile(remoteTemporary, remotePath, temporaryMode);
+      await this.stageRemoteTempFile({
+        expectedSize,
+        mode: temporaryMode,
+        operation: "writeFile",
+        temporaryPath: remoteTemporary
+      });
+      const remoteHash = await this.finalizeAndHashRemoteFile(
+        remoteTemporary,
+        remotePath,
+        temporaryMode
+      );
+      finalized = true;
       await this.ensureRemoteWriteFile({
         content,
         expectedHash,
         expectedSize,
         mode: temporaryMode,
+        remoteHash,
         remotePath
       });
     } finally {
-      await this.cleanupWriteFileTemporaryPath(remoteTemporary);
+      if (!finalized) await this.cleanupWriteFileTemporaryPath(remoteTemporary);
     }
   }
   async agentSocketExists(agent) {
@@ -3516,29 +3952,6 @@ var SshConnectionImpl = class {
       );
     }
   }
-  async assertRemoteFileSize(remotePath, expectedSize, operation = "uploadFile") {
-    const statCommand = `stat -c '%s' ${shellQuote(remotePath)}`;
-    const rawSize = this.config.user === "root" ? await this.output(statCommand) : await this.outputWithoutSudo(statCommand);
-    const actualSize = Number(rawSize.trim());
-    if (!Number.isFinite(actualSize)) {
-      throw new TypeError(
-        `[ssh.${operation}: ${remotePath}] could not determine remote file size after upload`
-      );
-    }
-    if (actualSize === 0 && expectedSize > 0) {
-      const diskInfo = await this.checkRemoteDiskSpace(remotePath);
-      if (diskInfo != null && diskInfo.availableBytes < expectedSize) {
-        throw new Error(
-          `[ssh.${operation}: ${remotePath}] disk full \u2013 ${diskInfo.availableBytes} bytes available on ${diskInfo.mountpoint}; the file was written as 0 bytes because there is no space left on the device`
-        );
-      }
-    }
-    if (actualSize !== expectedSize) {
-      throw new Error(
-        `[ssh.${operation}: ${remotePath}] remote file size mismatch after upload; expected ${expectedSize} bytes, got ${actualSize}`
-      );
-    }
-  }
   /**
    * R-0000669: build the abort signal that {@link tryConnectOnPort} subscribes
    * to. Combines the prompt-level abort signal (which fires from the SIGINT
@@ -3557,6 +3970,32 @@ var SshConnectionImpl = class {
     if (this.promptAbortSignal != null) signals.push(this.promptAbortSignal);
     return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
   }
+  /**
+   * R-0000141 / R-0000693: build the shell lines that reject a destination
+   * directory whose resolved path differs from the literal one — i.e. at least
+   * one path component is a symbolic link. Resolving via `command -p realpath
+   * -m` runs the lookup against the POSIX default PATH so a wrapper earlier in
+   * the connected shell's PATH cannot short-circuit the check, and `-m`
+   * tolerates trailing components that do not yet exist.
+   *
+   * The lines are meant to be embedded at the top of a `set -eu` script so the
+   * guard fails the whole round-trip (via the `paratix-symlink-component`
+   * marker + exit 20) before any `mktemp`/`mv` runs. An empty string is
+   * returned for `""`/`"/"`, mirroring the early return in
+   * {@link assertDirnameHasNoSymlinkComponent}.
+   *
+   * @param directory - The destination directory derived from `posix.dirname`.
+   * @returns Shell lines (newline-terminated) or an empty string when no check is needed.
+   */
+  buildDirSymlinkCheckScript(directory) {
+    if (directory === "" || directory === "/") return "";
+    return `dir_resolved=$(command -p realpath -m -- ${shellQuote(directory)})
+if [ "$dir_resolved" != ${shellQuote(directory)} ]; then
+  printf 'paratix-symlink-component %s\\n' "$dir_resolved" >&2
+  exit 20
+fi
+`;
+  }
   buildEnvPrefix(environment) {
     if (environment == null) return "";
     for (const key of Object.keys(environment)) {
@@ -3567,6 +4006,62 @@ var SshConnectionImpl = class {
     const pairs = Object.entries(environment).map(([k, v]) => `${k}=${shellQuote(v)}`);
     return `${pairs.join(" ")} `;
   }
+  /**
+   * Build the non-root finalize+hash script. Mirrors the privileged finalize
+   * in {@link finalizeRemoteTempFile} (guard, intermediate in-destination
+   * `mktemp`, `mv`/`chmod`/`chown`/`mv`) and additionally folds in the
+   * dirname-symlink guard and a trailing `sha256sum` of the destination.
+   *
+   * @param temporaryPath - The staged temp path to move into place.
+   * @param remotePath - The destination path on the remote host.
+   * @param mode - The validated file mode to apply to the finalized file.
+   * @returns The `set -eu` finalize+hash script.
+   */
+  buildNonRootFinalizeAndHashScript(temporaryPath, remotePath, mode) {
+    const directory = posix.dirname(remotePath);
+    const basename = posix.basename(remotePath);
+    const targetGuard = `[ ! -d ${shellQuote(remotePath)} ] && [ ! -L ${shellQuote(remotePath)} ]`;
+    const finalTemplate = `.${basename}.paratix.XXXXXX`;
+    return `set -eu
+${this.buildDirSymlinkCheckScript(directory)}if ! ${targetGuard}; then
+  printf '%s
+' 'target path must not be a directory or symlink' >&2
+  exit 1
+fi
+target_owner=$(stat -c '%u:%g' ${shellQuote(remotePath)} 2>/dev/null || stat -c '%u:%g' ${shellQuote(directory)} 2>/dev/null || printf '0:0')
+target_temp=''
+cleanup() {
+  if [ -n "$target_temp" ]; then
+    rm -f -- "$target_temp"
+  fi
+}
+trap cleanup EXIT
+target_temp=$(mktemp -p ${shellQuote(directory)} -- ${shellQuote(finalTemplate)})
+[ -n "$target_temp" ] || exit 1
+mv -T -- ${shellQuote(temporaryPath)} "$target_temp"
+chmod ${shellQuote(mode)} "$target_temp"
+chown "$target_owner" "$target_temp"
+mv -T -- "$target_temp" ${shellQuote(remotePath)}
+trap - EXIT
+sha256sum -- ${shellQuote(remotePath)} 2>/dev/null || printf 'paratix-hash-failed
+'
+`;
+  }
+  /**
+   * Build the root finalize+hash command. The destination is moved into place
+   * only when it is neither a directory nor a symlink, and hashed only after a
+   * successful `mv`; a `mv` failure short-circuits before the hash so the
+   * caller sees a finalize `CommandError` rather than a stale-destination hash.
+   *
+   * @param temporaryPath - The staged temp path to move into place.
+   * @param remotePath - The destination path on the remote host.
+   * @returns The finalize+hash command string.
+   */
+  buildRootFinalizeAndHashScript(temporaryPath, remotePath) {
+    const targetGuard = `[ ! -d ${shellQuote(remotePath)} ] && [ ! -L ${shellQuote(remotePath)} ]`;
+    return `${targetGuard} && mv -T -- ${shellQuote(temporaryPath)} ${shellQuote(remotePath)} && { sha256sum -- ${shellQuote(remotePath)} 2>/dev/null || printf 'paratix-hash-failed
+'; }`;
+  }
   buildSecrets(extra) {
     const cachedPasswordSecret = this.cachedSudoPassword == null ? [] : [() => this.cachedSudoPassword?.toString("utf8") ?? ""];
     const registeredSecrets = getRegisteredSecrets();
@@ -3603,7 +4098,7 @@ var SshConnectionImpl = class {
     const KB_TO_BYTES = 1024;
     try {
       const directory = remotePath.includes("/") ? remotePath.slice(0, remotePath.lastIndexOf("/")) || "/" : ".";
-      const dfOutput = await this.output(`df -P ${shellQuote(directory)}`);
+      const dfOutput = await this.output(`df -Pk ${shellQuote(directory)}`);
       const lines = dfOutput.trim().split("\n");
       if (lines.length < 2) return null;
       const columns = lines[1].split(new RegExp("\\s+", "v"));
@@ -3615,6 +4110,39 @@ var SshConnectionImpl = class {
       return null;
     }
   }
+  /**
+   * Classify a raw `sha256sum` reply for the finalized remote file against the
+   * expected digest. Shared by the combined finalize+hash round-trip and the
+   * shell-fallback re-verification.
+   *
+   * @param remotePath - The finalized destination path (for diagnostics).
+   * @param expectedHash - Lowercase hex SHA-256 digest of the intended content.
+   * @param rawHash - Raw stdout of the finalize+hash or verify command.
+   * @returns `"matches"`, `"empty"` (disk-full indicator) or `"hash-mismatch"`.
+   * @throws {RemoteStatTransientError} When the reply cannot be evaluated into a verdict.
+   */
+  classifyRemoteHash(remotePath, expectedHash, rawHash) {
+    if (rawHash.includes("paratix-hash-failed")) {
+      throw new RemoteStatTransientError(
+        `[ssh.writeFile: ${remotePath}] could not hash remote file after upload/finalize`
+      );
+    }
+    if (rawHash.endsWith(CAPTURE_TRUNCATION_MARKER)) {
+      throw new RemoteStatTransientError(
+        `[ssh.writeFile: ${remotePath}] sha256sum output exceeds the captured-output cap of ${DEFAULT_MAX_OUTPUT_BYTES} bytes; refusing to derive a verdict from truncated output`
+      );
+    }
+    const actualHash = rawHash.trim().split(new RegExp("\\s+", "v"))[0]?.toLowerCase() ?? "";
+    if (!new RegExp("^[0-9a-f]{64}$", "v").test(actualHash)) {
+      throw new RemoteStatTransientError(
+        `[ssh.writeFile: ${remotePath}] could not determine remote file hash after upload/finalize`
+      );
+    }
+    const expected = expectedHash.toLowerCase();
+    if (actualHash === expected) return "matches";
+    if (actualHash === EMPTY_FILE_SHA256 && expected !== EMPTY_FILE_SHA256) return "empty";
+    return "hash-mismatch";
+  }
   async cleanupPrivilegedRemoteTempFile(remotePath) {
     await this.exec(`rm -f -- ${shellQuote(remotePath)}`, {
       ignoreExitCode: true,
@@ -3633,6 +4161,23 @@ var SshConnectionImpl = class {
     } catch (cleanupError) {
       process.stderr.write(
         `Warning: failed to remove temp file ${remotePath}: ${maskSecrets(String(cleanupError), this.buildSecrets())}
+`
+      );
+    }
+  }
+  /**
+   * Best-effort cleanup of the staged upload temp file. Extracted from
+   * {@link uploadFile}'s `finally` so the primary method stays within the
+   * statement budget; mirrors {@link cleanupWriteFileTemporaryPath}.
+   *
+   * @param temporaryPath - The staged temp path to remove.
+   */
+  async cleanupUploadTemporaryPath(temporaryPath) {
+    try {
+      await this.cleanupRemoteTempFile(temporaryPath);
+    } catch (cleanupError) {
+      process.stderr.write(
+        `Warning: failed to remove temp file ${temporaryPath}: ${maskSecrets(String(cleanupError), this.buildSecrets())}
 `
       );
     }
@@ -3776,10 +4321,17 @@ var SshConnectionImpl = class {
   }
   async createRemoteTempPathInDestination(remotePath, prefix) {
     const directory = posix.dirname(remotePath);
-    await this.assertDirnameHasNoSymlinkComponent(directory, remotePath);
     const template = `${prefix}.XXXXXX`;
-    const command = `mktemp -p ${shellQuote(directory)} -- ${shellQuote(template)}`;
-    const path = this.config.user === "root" ? await this.output(command) : await this.outputWithoutSudo(command);
+    const script = `set -eu
+${this.buildDirSymlinkCheckScript(directory)}mktemp -p ${shellQuote(directory)} -- ${shellQuote(template)}
+`;
+    let path;
+    try {
+      path = this.config.user === "root" ? await this.output(script) : await this.outputWithoutSudo(script);
+    } catch (error) {
+      this.throwIfDirSymlinkMarker(error, directory, remotePath);
+      throw error;
+    }
     return validateMktempPath(directory, path, prefix);
   }
   async createRemoteWritableTempPath(remotePath, prefix) {
@@ -3868,14 +4420,24 @@ var SshConnectionImpl = class {
    * propagates as {@link RemoteStatTransientError} so the caller can retry
    * instead of acting on a non-verdict result.
    *
+   * #82: the finalized-destination hash is now produced by the combined
+   * finalize+hash round-trip ({@link finalizeAndHashRemoteFile}) and passed in
+   * via `options.remoteHash`, so this method only classifies the verdict — it
+   * no longer issues a separate `sha256sum` exec.
+   *
    * @param options - Verification inputs.
    * @param options.expectedHash - Lowercase hex SHA-256 digest of the local file.
    * @param options.expectedSize - Byte length of the local file (used for disk-full diagnostics).
+   * @param options.remoteHash - Raw stdout of the finalize+hash round-trip.
    * @param options.remotePath - The finalized destination path on the remote host.
    * @throws {Error} When the remote file is empty (disk-full) or its hash does not match.
    */
   async ensureRemoteUploadFile(options) {
-    const verification = await this.verifyRemoteWriteFile(options.remotePath, options.expectedHash);
+    const verification = this.classifyRemoteHash(
+      options.remotePath,
+      options.expectedHash,
+      options.remoteHash
+    );
     if (verification === "matches") return;
     if (verification === "empty") {
       const diskInfo = await this.checkRemoteDiskSpace(options.remotePath);
@@ -3893,7 +4455,11 @@ var SshConnectionImpl = class {
     );
   }
   async ensureRemoteWriteFile(options) {
-    const verification = await this.verifyRemoteWriteFile(options.remotePath, options.expectedHash);
+    const verification = this.classifyRemoteHash(
+      options.remotePath,
+      options.expectedHash,
+      options.remoteHash
+    );
     if (verification === "matches") return;
     await this.rewriteRemoteFileViaShell(options.remotePath, options.content, options.mode);
     const fallbackVerification = await this.verifyRemoteWriteFile(
@@ -3946,6 +4512,41 @@ var SshConnectionImpl = class {
       throw error;
     }
   }
+  /**
+   * Apply the pre-finalize size smoke-test to the `stat`-reported byte count of
+   * the staged temp file. Kept in TypeScript (rather than folded into the
+   * combined shell command) so the disk-full diagnosis and the size-mismatch
+   * error stay identical to the previous `assertRemoteFileSize` behavior.
+   *
+   * @param options - Size-evaluation inputs.
+   * @param options.remotePath - The staged temp path (used for diagnostics).
+   * @param options.expectedSize - The expected byte length of the staged content.
+   * @param options.rawSize - The raw `stat -c '%s'` output captured from the remote.
+   * @param options.operation - Which public method drives this write (for diagnostics).
+   * @throws {Error} When the size is unreadable, indicates disk-full, or mismatches.
+   */
+  async evaluateStagedFileSize(options) {
+    const { expectedSize, operation, rawSize, remotePath } = options;
+    const actualSize = Number(rawSize.trim());
+    if (!Number.isFinite(actualSize)) {
+      throw new TypeError(
+        `[ssh.${operation}: ${remotePath}] could not determine remote file size after upload`
+      );
+    }
+    if (actualSize === 0 && expectedSize > 0) {
+      const diskInfo = await this.checkRemoteDiskSpace(remotePath);
+      if (diskInfo != null && diskInfo.availableBytes < expectedSize) {
+        throw new Error(
+          `[ssh.${operation}: ${remotePath}] disk full \u2013 ${diskInfo.availableBytes} bytes available on ${diskInfo.mountpoint}; the file was written as 0 bytes because there is no space left on the device`
+        );
+      }
+    }
+    if (actualSize !== expectedSize) {
+      throw new Error(
+        `[ssh.${operation}: ${remotePath}] remote file size mismatch after upload; expected ${expectedSize} bytes, got ${actualSize}`
+      );
+    }
+  }
   async execPrepared(command, options = {}) {
     const client = this.ensureClient();
     const environmentPrefix = this.buildEnvPrefix(options.env);
@@ -4002,19 +4603,34 @@ var SshConnectionImpl = class {
   }
   /**
    * Execute a command directly over the SSH transport without sudo wrapping.
-   * Used only by {@link probeSudo} to check whether `sudo` is installed.
+   * Used by the sudo probes ({@link ensureSudoInstalled},
+   * {@link hasPasswordlessSudo}) and the non-root finalize/verify paths
+   * ({@link execWithoutSudo}, {@link outputWithoutSudo}).
+   *
+   * Stream capture, the output byte-cap, secret masking and the signal /
+   * exit-code handling are delegated to {@link collectStreamOutput} — the same
+   * helper {@link execPrepared} uses — so the raw path shares one capping and
+   * one truncation implementation with the sudo path. `ignoreExitCode: true`
+   * preserves the historical contract of returning a non-zero exit code to the
+   * caller instead of throwing; a delivered signal still rejects. `silent: true`
+   * keeps the probe/verify output off the live terminal, matching the previous
+   * discard-stderr / buffer-stdout behavior. Only stdout and the exit code are
+   * surfaced to callers; stderr is captured for masking but not returned.
    *
    * @param command - The raw shell command to run.
    * @returns The exit code and captured stdout.
    */
   async execRaw(command) {
     const client = this.ensureClient();
-    return new Promise((resolve2, reject) => {
-      const { isSettled, wrappedReject, wrappedResolve } = this.createSettledCallbacks(resolve2, reject);
+    const secrets = prepareSecrets(this.buildSecrets());
+    const result = await new Promise((resolve2, reject) => {
+      const { isSettled, wrappedReject, wrappedResolve } = this.createSettledCallbacks(
+        resolve2,
+        reject
+      );
       let activeStream = null;
       const timer = setTimeout(() => {
         activeStream?.close();
-        const secrets = prepareSecrets(this.buildSecrets());
         wrappedReject(
           new Error(
             `Command timed out after ${COMMAND_TIMEOUT}ms: ${maskPreparedSecrets(command, secrets)}`
@@ -4033,62 +4649,14 @@ var SshConnectionImpl = class {
             return;
           }
           activeStream = stream;
-          const chunks = [];
-          let stdoutBytes = 0;
-          stream.on("data", (chunk) => {
-            if (stdoutBytes > DEFAULT_MAX_OUTPUT_BYTES) return;
-            stdoutBytes += chunk.length;
-            if (stdoutBytes > DEFAULT_MAX_OUTPUT_BYTES) {
-              const remainingBytes = Math.max(
-                0,
-                DEFAULT_MAX_OUTPUT_BYTES - (stdoutBytes - chunk.length)
-              );
-              if (remainingBytes > 0) {
-                chunks.push(chunk.subarray(0, remainingBytes));
-              }
-              const capturedStdout = Buffer.concat(chunks).toString("utf8");
-              const secrets = prepareSecrets(this.buildSecrets());
-              activeStream?.close();
-              wrappedReject(
-                new Error(
-                  `Command stdout exceeded ${DEFAULT_MAX_OUTPUT_BYTES} bytes: ${maskPreparedSecrets(
-                    command,
-                    secrets
-                  )}
-stdout: ${truncateRawOutputErrorSnippet(
-                    maskPreparedSecrets(capturedStdout, secrets)
-                  )}`
-                )
-              );
-              return;
-            }
-            chunks.push(chunk);
-          });
-          stream.on("close", (code, signal) => {
-            clearTimeout(timer);
-            if (signal != null && signal !== "") {
-              const secrets = prepareSecrets(this.buildSecrets());
-              wrappedReject(
-                new Error(
-                  `Command failed with signal ${signal}: ${maskPreparedSecrets(command, secrets)}`
-                )
-              );
-              return;
-            }
-            wrappedResolve({
-              exitCode: normalizeSshCloseCode(code),
-              stdout: Buffer.concat(chunks).toString("utf8")
-            });
-          });
-          stream.on("error", (error2) => {
-            clearTimeout(timer);
-            wrappedReject(error2);
-          });
-          stream.stderr.on("data", () => {
-          });
-          stream.stderr.on("error", (error2) => {
-            clearTimeout(timer);
-            wrappedReject(error2);
+          collectStreamOutput({
+            command,
+            options: { ignoreExitCode: true, silent: true },
+            reject: wrappedReject,
+            resolve: wrappedResolve,
+            secrets,
+            stream,
+            timer
           });
         });
       } catch (error) {
@@ -4097,14 +4665,46 @@ stdout: ${truncateRawOutputErrorSnippet(
         wrappedReject(toError(error));
       }
     });
+    return { exitCode: result.code, stdout: result.stdout };
   }
   async execWithoutSudo(command) {
     const result = await this.execRaw(command);
     if (result.exitCode !== 0) {
-      const secrets = prepareSecrets(this.buildSecrets());
-      throw new Error(
-        `Command failed (exit code ${result.exitCode}): ${maskPreparedSecrets(command, secrets)}`
-      );
+      throw new Error(`Command failed (exit code ${result.exitCode}): ${this.maskCommand(command)}`);
+    }
+  }
+  /**
+   * #82: finalize the staged temp file (`mv -T`) AND hash the finalized
+   * destination in a single privileged exec round-trip, returning the raw
+   * `sha256sum` output for the caller to classify.
+   *
+   * R-0000522 / R-0000599: hashing the finalized destination catches a
+   * same-length TOCTOU swap between the staged temp and the privileged move;
+   * computing the digest inside the same script that performs the move keeps
+   * the window to a single remote command instead of a separate network
+   * round-trip. R-0000141: for non-root users the destination dirname-symlink
+   * guard is folded into the same script (the staged temp lives in `/tmp`, so
+   * unlike the root path there was no earlier in-destination `mktemp` to guard).
+   *
+   * A `sha256sum` failure that occurs *after* a successful move emits the
+   * `paratix-hash-failed` marker and still exits 0, so
+   * {@link classifyRemoteHash} reports a transient verification failure rather
+   * than misclassifying a correctly finalized file as a content mismatch.
+   *
+   * @param temporaryPath - The staged temp path to move into place.
+   * @param remotePath - The destination path on the remote host.
+   * @param mode - The validated file mode applied during the non-root finalize.
+   * @returns The raw stdout of the finalize+hash script (a `sha256sum` line or marker).
+   */
+  async finalizeAndHashRemoteFile(temporaryPath, remotePath, mode) {
+    validateMode(mode);
+    const script = this.config.user === "root" ? this.buildRootFinalizeAndHashScript(temporaryPath, remotePath) : this.buildNonRootFinalizeAndHashScript(temporaryPath, remotePath, mode);
+    try {
+      const result = await this.exec(script, { silent: true });
+      return result.stdout;
+    } catch (error) {
+      this.throwIfDirSymlinkMarker(error, posix.dirname(remotePath), remotePath);
+      throw error;
     }
   }
   async finalizeRemoteTempFile(temporaryPath, remotePath, mode) {
@@ -4211,13 +4811,24 @@ trap - EXIT
   isSudoReadyWithoutProbe() {
     return this.config.user === "root" || this.cachedSudoPassword != null;
   }
+  /**
+   * Single entry point for masking a command string before it is interpolated
+   * into an operator-visible error message. Wraps the repeated
+   * `maskPreparedSecrets(command, prepareSecrets(this.buildSecrets()))` pattern
+   * (R-0000667) so every raw-exec error path redacts the same registered-secret
+   * material — sudo password, op tokens, signed download URLs, … — identically.
+   *
+   * @param command - The command whose secret material must be redacted.
+   * @returns The command with every registered secret variant replaced by the
+   *   redaction placeholder.
+   */
+  maskCommand(command) {
+    return maskPreparedSecrets(command, prepareSecrets(this.buildSecrets()));
+  }
   async outputWithoutSudo(command) {
     const result = await this.execRaw(command);
     if (result.exitCode !== 0) {
-      const secrets = prepareSecrets(this.buildSecrets());
-      throw new Error(
-        `Command failed (exit code ${result.exitCode}): ${maskPreparedSecrets(command, secrets)}`
-      );
+      throw new Error(`Command failed (exit code ${result.exitCode}): ${this.maskCommand(command)}`);
     }
     return result.stdout.trim();
   }
@@ -4385,14 +4996,39 @@ trap - EXIT
     } catch {
     }
   }
-  async setRemoteTempMode(remotePath, mode) {
+  /**
+   * #82: set the staged temp file's mode and read its size back in a single
+   * exec round-trip, then run the pre-finalize size smoke-test. `chmod` and
+   * `stat` are chained with `&&` so a failed `chmod` short-circuits before the
+   * `stat` and surfaces as a `CommandError`, exactly as the previous separate
+   * `setRemoteTempMode` call did.
+   *
+   * R-0000266: the staged temp path is owned by the connecting user (mktemp
+   * staged it under /tmp without sudo). Reading the size through `output` would
+   * funnel the call through `ensureSudoReady` and could fail with a sudo-auth
+   * error after the cached credentials expired. The combined command therefore
+   * runs through the raw (non-sudo) exec path for non-root users so the size
+   * check stays a pure stat call and surfaces a real size mismatch instead of
+   * a sudo prompt failure.
+   *
+   * @param options - Staging inputs.
+   * @param options.temporaryPath - The staged temp path created by `mktemp`.
+   * @param options.mode - The validated file mode to apply before the finalize.
+   * @param options.expectedSize - The expected byte length of the staged content.
+   * @param options.operation - Which public method drives this write (for diagnostics).
+   * @throws {Error} When the staged size does not match `expectedSize`.
+   */
+  async stageRemoteTempFile(options) {
+    const { expectedSize, mode, operation, temporaryPath } = options;
     validateMode(mode);
-    const command = `chmod ${shellQuote(mode)} ${shellQuote(remotePath)}`;
-    if (this.config.user === "root") {
-      await this.exec(command, { silent: true });
-      return;
-    }
-    await this.execWithoutSudo(command);
+    const command = `chmod ${shellQuote(mode)} ${shellQuote(temporaryPath)} && stat -c '%s' ${shellQuote(temporaryPath)}`;
+    const rawSize = this.config.user === "root" ? await this.output(command) : await this.outputWithoutSudo(command);
+    await this.evaluateStagedFileSize({
+      expectedSize,
+      operation,
+      rawSize,
+      remotePath: temporaryPath
+    });
   }
   /**
    * Build the sudo-wrapped command string for execution.
@@ -4442,6 +5078,26 @@ trap - EXIT
       clearTimeout(fallback);
     });
   }
+  /**
+   * Re-throw the folded dirname-symlink guard's failure as the dedicated
+   * R-0000141 diagnostic when the `paratix-symlink-component` marker is present
+   * in a failed command's stderr; otherwise return so the caller re-throws the
+   * original error unchanged.
+   *
+   * @param error - The error raised by a combined mktemp/finalize round-trip.
+   * @param directory - The destination directory that was guarded.
+   * @param remotePath - The original remote path (for the diagnostic message).
+   * @throws {Error} The mapped symlink diagnostic when the marker is present.
+   */
+  throwIfDirSymlinkMarker(error, directory, remotePath) {
+    if (!(error instanceof CommandError)) return;
+    const match = new RegExp("paratix-symlink-component (?<resolved>.*)", "v").exec(error.fullStderr);
+    if (match?.groups?.resolved == null) return;
+    throw new Error(
+      `[ssh.mktemp: ${remotePath}] destination directory ${directory} resolves to ${match.groups.resolved}; refusing to mktemp because at least one path component is a symbolic link`,
+      { cause: error }
+    );
+  }
   /**
    * Iterate over `config.ports` and attempt a connection on each one.
    *
@@ -4525,21 +5181,7 @@ trap - EXIT
         { cause: error }
       );
     }
-    if (rawHash.endsWith(CAPTURE_TRUNCATION_MARKER)) {
-      throw new RemoteStatTransientError(
-        `[ssh.writeFile: ${remotePath}] sha256sum output exceeds the captured-output cap of ${DEFAULT_MAX_OUTPUT_BYTES} bytes; refusing to derive a verdict from truncated output`
-      );
-    }
-    const actualHash = rawHash.trim().split(new RegExp("\\s+", "v"))[0]?.toLowerCase() ?? "";
-    if (!new RegExp("^[0-9a-f]{64}$", "v").test(actualHash)) {
-      throw new RemoteStatTransientError(
-        `[ssh.writeFile: ${remotePath}] could not determine remote file hash after upload/finalize`
-      );
-    }
-    const expected = expectedHash.toLowerCase();
-    if (actualHash === expected) return "matches";
-    if (actualHash === EMPTY_FILE_SHA256 && expected !== EMPTY_FILE_SHA256) return "empty";
-    return "hash-mismatch";
+    return this.classifyRemoteHash(remotePath, expectedHash, rawHash);
   }
   /**
    * Forward sudo password / `options.input` to a stream while tolerating
@@ -4586,6 +5228,13 @@ trap - EXIT
 // src/runner.ts
 var ASCII_ESC3 = 27;
 var ANSI_SHOW_CURSOR3 = `${String.fromCharCode(ASCII_ESC3)}[?25h`;
+var activeSshConnections = /* @__PURE__ */ new Set();
+function registerActiveSsh(connection) {
+  activeSshConnections.add(connection);
+}
+function unregisterActiveSsh(connection) {
+  activeSshConnections.delete(connection);
+}
 function performShutdownBestEffortCleanup() {
   try {
     stopLiveModuleOutput(true);
@@ -4606,6 +5255,16 @@ function performShutdownBestEffortCleanup() {
   } catch {
   }
 }
+function performLastResortCleanup() {
+  performShutdownBestEffortCleanup();
+  for (const connection of activeSshConnections) {
+    try {
+      connection.forceDestroy();
+    } catch {
+    }
+  }
+  activeSshConnections.clear();
+}
 function setupShutdownHandlers() {
   let receivedSignal = null;
   let ssh = null;
@@ -4635,12 +5294,14 @@ Received ${signal}, shutting down\u2026`);
     promptAbortSignal: promptAbortController.signal,
     setSsh(connection) {
       ssh = connection;
+      registerActiveSsh(connection);
     },
     shutdownAbortSignal: shutdownAbortController.signal,
     shutdownSignal: () => receivedSignal
   };
 }
 var DEFAULT_REBOOT_GRACE_SECONDS = 15;
+var DEFAULT_REBOOT_RECONNECT_TIMEOUT = 3e5;
 var REBOOT_GRACE_SECONDS_TO_MS = 1e3;
 function createRebootGraceContext(options, shutdownSignal, abortSignal) {
   const seconds = options.rebootGraceSeconds ?? DEFAULT_REBOOT_GRACE_SECONDS;
@@ -4737,9 +5398,6 @@ function handleCaughtStepError(parameters) {
   printCommandFailure(parameters.error, parameters.verbose);
   return { env: parameters.environment, shouldBreak: true, status: "failed" };
 }
-function isRecipe(target) {
-  return "_isRecipe" in target && target._isRecipe;
-}
 function addSshdPorts(ssh, metaEntries) {
   const portEntries = metaEntries?.filter((entry) => isSshdPortMetaEntry(entry)) ?? [];
   const addedPorts = [];
@@ -4796,7 +5454,7 @@ async function handleReboot(ssh, metaEntries, rebootGrace) {
     keepAlive: true
   });
   try {
-    await ssh.reconnect();
+    await ssh.reconnect({ defaultTimeout: DEFAULT_REBOOT_RECONNECT_TIMEOUT });
   } catch (error) {
     console.error(`Failed to reconnect after reboot: ${String(error)}`);
     throw error;
@@ -5232,6 +5890,7 @@ function teardownPlaybookResources(parameters) {
   stopLiveModuleOutput(true);
   for (const signal of ["SIGINT", "SIGTERM"])
     getSignalBus().off(signal, parameters.handleShutdownSignal);
+  if (parameters.ssh != null) unregisterActiveSsh(parameters.ssh);
   parameters.ssh?.disconnect();
 }
 function initializeRunPlaybookContext(options) {
@@ -5550,17 +6209,35 @@ var CliUsageError = class extends Error {
     this.exitCode = exitCode;
   }
 };
+function resolveFilteredRun(definition, rawFilter) {
+  if (rawFilter.length === 0) return definition.run;
+  const names = parseFilterNames(rawFilter);
+  if (names.length === 0) {
+    throw new CliUsageError("--filter requires at least one non-empty module name");
+  }
+  const available = collectModuleNames(definition.run);
+  const unknown = names.filter((name) => !available.has(name));
+  if (unknown.length > 0) {
+    const quoted = unknown.map((name) => `"${name}"`).join(", ");
+    throw new CliUsageError(
+      `--filter matched no module: ${quoted}. Available names: ${[...available].join(", ")}`
+    );
+  }
+  return applyModuleFilter(definition.run, new Set(names));
+}
 async function runApplyCommand(file, options, run = runPlaybook) {
   if (options.diff && !options.dryRun) {
     throw new CliUsageError("--diff requires --dry-run");
   }
-  printCliHeader("0.12.8-a236f80");
+  printCliHeader("0.13.0-33ef8ce");
   const environmentOverrides = applyCliEnvironmentOverrides(options.env, {
     firstRun: options.firstRun
   });
   const definition = await loadServerDefinitionFromFile(file, {
     firstRun: options.firstRun
   });
+  const runModules = resolveFilteredRun(definition, options.filter);
+  const targetDefinition = runModules === definition.run ? definition : { ...definition, run: runModules };
   const runOptions = {
     diff: options.diff,
     dryRun: options.dryRun,
@@ -5571,7 +6248,7 @@ async function runApplyCommand(file, options, run = runPlaybook) {
   if (options.reconnectTimeout !== void 0) {
     runOptions.reconnectTimeout = options.reconnectTimeout * SECONDS_TO_MS;
   }
-  await run(definition, runOptions);
+  await run(targetDefinition, runOptions);
 }
 function exitAfterApplyError(error, verbose) {
   if (error instanceof CliUsageError) {
@@ -5583,7 +6260,7 @@ function exitAfterApplyError(error, verbose) {
   process.exit(exitCode);
 }
 var program = new Command();
-program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.12.8-a236f80");
+program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.13.0-33ef8ce");
 program.command("apply <file>").description("Apply a server definition").option(
   "--diff",
   "When combined with --dry-run, show a unified diff per module that would change.",
@@ -5592,9 +6269,14 @@ program.command("apply <file>").description("Apply a server definition").option(
   "--dry-run",
   "Only check, do not apply. Some modules validate prospective config but cannot verify runtime restarts.",
   false
-).option("--env <key=value...>", "Set env values", collectEnvironment, {}).option("--env-file <path>", "Load dotenv file").option("--first-run", "Set PARATIX_FIRST_RUN=true before loading the playbook", false).option(
+).option("--env <key=value...>", "Set env values", collectEnvironment, {}).option("--env-file <path>", "Load dotenv file").option(
+  "--filter <names>",
+  "Run only the named recipes/modules (comma-separated, repeatable). Every other node is shown as skipped.",
+  collectFilter,
+  []
+).option("--first-run", "Set PARATIX_FIRST_RUN=true before loading the playbook", false).option(
   "--reconnect-timeout <seconds>",
-  "SSH reconnect timeout (seconds, max 86400)",
+  "SSH reconnect timeout override for reboots and port changes (seconds, max 86400; reboot default 300)",
   parseReconnectTimeoutSeconds
 ).option("--verbose", "Show full stack traces on error", false).action(async (file, options) => {
   try {
@@ -5608,6 +6290,8 @@ program.command("apply <file>").description("Apply a server definition").option(
       // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
       envFile: options.envFile,
       // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      filter: options.filter,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
       firstRun: options.firstRun,
       // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
       reconnectTimeout: options.reconnectTimeout,
@@ -5637,6 +6321,9 @@ function parsePositiveNumber(value, options = {}) {
 function parseReconnectTimeoutSeconds(value) {
   return parsePositiveNumber(value, { max: RECONNECT_TIMEOUT_MAX_SECONDS });
 }
+function collectFilter(value, previous) {
+  return [...previous, value];
+}
 function collectEnvironment(value, previous) {
   const eqIndex = value.indexOf("=");
   if (eqIndex === -1) {
@@ -5658,8 +6345,38 @@ function collectEnvironment(value, previous) {
   const accumulator = /* @__PURE__ */ Object.create(null);
   return Object.assign(accumulator, previous, { [key]: value_ });
 }
+var lastResortHandled = false;
+var LAST_RESORT_EXIT_CODE = 1;
+function handleLastResortError(error) {
+  if (lastResortHandled) return;
+  lastResortHandled = true;
+  printExceptionError(error, false);
+  performLastResortCleanup();
+  if (process.exitCode === void 0 || process.exitCode === 0) {
+    process.exitCode = LAST_RESORT_EXIT_CODE;
+  }
+}
+function resetLastResortHandlerForTests() {
+  lastResortHandled = false;
+}
+function forceExitAfterHandling() {
+  setImmediate(() => {
+    process.exit(process.exitCode ?? LAST_RESORT_EXIT_CODE);
+  });
+}
+function installLastResortErrorHandlers() {
+  process.on("unhandledRejection", (reason) => {
+    handleLastResortError(reason);
+    forceExitAfterHandling();
+  });
+  process.on("uncaughtException", (error) => {
+    handleLastResortError(error);
+    forceExitAfterHandling();
+  });
+}
 var entryScript = process.argv[1];
 if (isDirectCliExecution(import.meta.url, entryScript)) {
+  installLastResortErrorHandlers();
   await program.parseAsync();
 }
 export {
@@ -5667,8 +6384,11 @@ export {
   applyCliEnvironmentOverrides,
   collectDefinitionErrors,
   collectEnvironment,
+  collectFilter,
   exitAfterApplyError,
+  handleLastResortError,
   handleTsxLoadFailure,
+  installLastResortErrorHandlers,
   isDirectCliExecution,
   isFirstRun,
   isServerDefinitionLike,
@@ -5676,9 +6396,10 @@ export {
   parsePositiveNumber,
   parseReconnectTimeoutSeconds,
   printExceptionError,
+  resetLastResortHandlerForTests,
   resetTsxRegistrationForTests,
+  resolveFilteredRun,
   runApplyCommand,
   withCliProcessEnvironment,
   withSerializedPlaybookImport
 };
-//# sourceMappingURL=cli.js.map