tileflow 0.1.0-alpha.22 → 0.1.0-alpha.23

package/dist/{cli-main-HRFGWUWR.js → cli-main-K3PKVCIP.js}

@@ -4,24 +4,32 @@ import {
   isRootCliVersionRequest
 } from "./chunk-GPPOECR5.js";
 import {
+  apiOriginOption,
   apiProfileCanTargetMap,
   assertHostedStyleBudget,
   authorizedTeamRequest,
+  configureJsonErrors,
   createCliProgram,
   createManagedMapSetup,
+  deploymentRestoreSteps,
   emitFailure,
+  emitGuidedFailure,
   emitJson,
+  emitRestoreFailure,
   fetchHostedMapStatus,
   hostedApiKeyOption,
   hostedApiUrlOption,
   installAccountSession,
   isHostedApiKey,
+  isRestoreJsonCommand,
   listMapSetupTeams,
   loadAuthConfig,
   normalizeApiOrigin,
   parseProjectReference,
+  parseRestoreJson,
   pollDeviceToken,
   prepareAccountLogin,
+  printNextSteps,
   publishHostedStyle,
   registerTilesetCommands,
   registerTilesetInspectCommand,
@@ -40,7 +48,7 @@ import {
   validateAccountSession,
   validateApiKey,
   writeAuthFileAtomic
-} from "./chunk-5QK6JCLT.js";
+} from "./chunk-EXDH7EHK.js";
 
 // src/cli-main.ts
 import { serve } from "@hono/node-server";
@@ -48,9 +56,9 @@ import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 import { existsSync, realpathSync } from "fs";
 import { readFile as readFile6, writeFile as writeFile2 } from "fs/promises";
 import { hostname } from "os";
-import { dirname as dirname12, isAbsolute as isAbsolute5, relative as relative6, resolve as resolve11, sep as sep5 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute5, relative as relative6, resolve as resolve12, sep as sep5 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
-import pc7 from "picocolors";
+import pc8 from "picocolors";
 import { createLocalCoordinates, setupCoordinates } from "@tileflow/coordinates-runtime";
 import {
   auditTileflowMapThemeValues as auditTileflowMapThemeValues2,
@@ -1002,13 +1010,13 @@ async function saveCaptureRecord(capture, cwd) {
     throw new Error(
       "Capture has no normalized scene definition. Rebuild @tileflow/capture before using this CLI."
     );
-  const record = {
+  const record2 = {
     schemaVersion: 1,
     definition: capture.definition,
     receipt: capture.receipt,
     warnings: capture.warnings
   };
-  const source = serializeCanonicalJson(record);
+  const source = serializeCanonicalJson(record2);
   if (Buffer.byteLength(source) > maximumRecordBytes)
     throw new Error("Capture record exceeds its byte limit.");
   const id = await sha256Hex(source);
@@ -1033,11 +1041,11 @@ async function readCaptureRecord(id, directory) {
   const source = await readBoundedFile(resolve2(root, `${id}.json`), maximumRecordBytes);
   if (await sha256Hex(source) !== id)
     throw new Error("Saved capture record does not match its ID.");
-  const record = JSON.parse(source.toString("utf8"));
-  if (record.schemaVersion !== 1) throw new Error("Unsupported capture record version.");
-  const receipt = parseTileflowCaptureReceipt(JSON.stringify(record.receipt));
+  const record2 = JSON.parse(source.toString("utf8"));
+  if (record2.schemaVersion !== 1) throw new Error("Unsupported capture record version.");
+  const receipt = parseTileflowCaptureReceipt(JSON.stringify(record2.receipt));
   const definition = normalizeTileflowCaptureScene(
-    tileflowCaptureSceneSchema.parse(record.definition)
+    tileflowCaptureSceneSchema.parse(record2.definition)
   );
   if (!definition.theme) throw new Error("Saved capture requires a concrete theme.");
   if (await sha256Hex(serializeCanonicalJson(definition)) !== receipt.scene.sha256)
@@ -1048,7 +1056,7 @@ async function readCaptureRecord(id, directory) {
   );
   if (await sha256Hex(png) !== receipt.image.sha256)
     throw new Error("Saved capture PNG does not match its receipt.");
-  if (!Array.isArray(record.warnings) || record.warnings.some((warning) => typeof warning !== "string"))
+  if (!Array.isArray(record2.warnings) || record2.warnings.some((warning) => typeof warning !== "string"))
     throw new Error("Invalid capture warnings.");
   return {
     definition: { ...definition, theme: definition.theme },
@@ -1067,7 +1075,7 @@ async function readCaptureRecord(id, directory) {
       dpr: receipt.image.dpr,
       renderer: receipt.renderer,
       networkDependent: receipt.networkDependent,
-      warnings: record.warnings
+      warnings: record2.warnings
     }
   };
 }
@@ -2929,11 +2937,11 @@ function validateVisualCompareInventory(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
     throw new Error("Visual compare inventory has an invalid shape.");
   }
-  const record = input;
-  if (!hasExactKeys(record, ["assets", "kind", "schemaVersion"]) || record.schemaVersion !== tileflowVisualCompareInventorySchemaVersion || record.kind !== "tileflow-visual-compare-assets" || !Array.isArray(record.assets) || record.assets.length > tileflowVisualCompareLimits.maximumRows * 5) {
+  const record2 = input;
+  if (!hasExactKeys(record2, ["assets", "kind", "schemaVersion"]) || record2.schemaVersion !== tileflowVisualCompareInventorySchemaVersion || record2.kind !== "tileflow-visual-compare-assets" || !Array.isArray(record2.assets) || record2.assets.length > tileflowVisualCompareLimits.maximumRows * 5) {
     throw new Error("Visual compare inventory has an invalid shape.");
   }
-  const assets = record.assets.map((entry) => {
+  const assets = record2.assets.map((entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
       throw new Error("Visual compare inventory has an invalid asset entry.");
     }
@@ -2963,8 +2971,8 @@ function isVisualCompareOwnedAssetName(value) {
   const row = Number(match[1]);
   return Number.isInteger(row) && row >= 1 && row <= tileflowVisualCompareLimits.maximumRows;
 }
-function hasExactKeys(record, keys) {
-  const actual = Object.keys(record).sort(compareCodeUnits3);
+function hasExactKeys(record2, keys) {
+  const actual = Object.keys(record2).sort(compareCodeUnits3);
   const expected = [...keys].sort(compareCodeUnits3);
   return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
 }
@@ -3323,7 +3331,7 @@ function registerOperation(coordinates, name, dependencies, parse3) {
     const controller = (dependencies.createSignalController ?? installSignalAbortController)();
     let local;
     try {
-      const request = await resolveRequest(
+      const request2 = await resolveRequest(
         name,
         options,
         parse3,
@@ -3336,7 +3344,7 @@ function registerOperation(coordinates, name, dependencies, parse3) {
         allowDevelopment: options.development,
         signal: controller.signal
       });
-      const response = await local[name](request, { signal: controller.signal });
+      const response = await local[name](request2, { signal: controller.signal });
       await local.close();
       local = void 0;
       printDocument(response);
@@ -3428,7 +3436,7 @@ async function readCoordinatesInput(input, signal) {
 async function readStandardInput(signal) {
   const chunks = [];
   let length = 0;
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const finish = (result) => {
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
@@ -3450,7 +3458,7 @@ async function readStandardInput(signal) {
       }
       chunks.push(bytes);
     };
-    const onEnd = () => finish(() => resolve12(decodeInput(Buffer.concat(chunks))));
+    const onEnd = () => finish(() => resolve13(decodeInput(Buffer.concat(chunks))));
     const onError = () => finish(() => reject(new CoordinatesInputError("INVALID_VALUE")));
     if (signal.aborted) {
       onAbort();
@@ -3692,6 +3700,186 @@ function isSafeDeploySourceText(value) {
   return true;
 }
 
+// src/deployment-command.ts
+import pc from "picocolors";
+import { z } from "zod";
+var deploymentSchema = z.object({
+  active: z.boolean(),
+  createdAt: z.string().min(1).max(64),
+  deploymentId: z.string().min(1).max(128),
+  restoredFromVersion: z.number().int().positive().nullable(),
+  source: z.object({ kind: z.string().min(1).max(32), revision: z.string().max(128).optional() }).strict().nullable(),
+  version: z.number().int().positive()
+}).strict();
+var deploymentListResponseSchema = z.object({
+  deployments: z.array(deploymentSchema).max(100),
+  mapId: z.string().regex(/^map_[A-Za-z0-9_-]{16}$/u),
+  schemaVersion: z.literal(1)
+}).strict();
+var deploymentRestoreResponseSchema = z.object({
+  changed: z.boolean(),
+  deploymentId: z.string().min(1).max(128),
+  familyUrl: z.string().url().max(2048).optional(),
+  mapId: z.string().regex(/^map_[A-Za-z0-9_-]{16}$/u),
+  restoredFromVersion: z.number().int().positive(),
+  schemaVersion: z.literal(1),
+  version: z.number().int().positive()
+}).strict();
+var failureSchema = z.object({ code: z.string().max(80), error: z.string().max(400) }).partial();
+function registerDeploymentCommands(program2, dependencies) {
+  const deployments = program2.command("deployments").description("List a Map\u2019s retained deployments and restore an earlier one");
+  const withOptions = (command2) => command2.requiredOption("--map-id <id>", "managed Map destination").addOption(hostedApiUrlOption()).addOption(hostedApiKeyOption("Tileflow API key")).option("--json", "print deterministic schema-version-1 JSON");
+  const readHistory = async (api, json2) => {
+    const response = await request(api, "/v1/styles/deployments", "GET");
+    if (!response.ok) {
+      emitHttpFailure(json2, response.status, response.body, api);
+      return null;
+    }
+    const parsed = deploymentListResponseSchema.safeParse(response.body);
+    if (!parsed.success || parsed.data.mapId !== api.mapId) {
+      emitGuidedFailure(
+        json2,
+        "deployment_list_invalid",
+        "The deployment history was not understood.",
+        [{ description: "Update to a CLI version that supports deployments, then try again." }]
+      );
+      return null;
+    }
+    return parsed.data.deployments;
+  };
+  withOptions(
+    deployments.command("list").description("List the retained deployments, newest first")
+  ).action(async (options) => {
+    const api = await dependencies.resolveApi(options, {
+      capabilityScopes: ["status:read"],
+      onFailure: options.json ? (code, message) => emitRestoreFailure(true, code, message) : void 0
+    });
+    if (!api) return;
+    const history = await readHistory(api, options.json);
+    if (!history) return;
+    const earlier = history.find((item) => !item.active);
+    const nextSteps = earlier ? [
+      {
+        description: `Publish an earlier version again, for example version ${earlier.version}. It becomes a new version and nothing is lost.`,
+        command: `tileflow deployments restore ${earlier.version} --map-id ${api.mapId}${apiOriginOption(api.apiUrl)}`
+      }
+    ] : [];
+    if (options.json) {
+      return emitJson({
+        command: "deployments list",
+        deployments: history,
+        nextSteps,
+        schemaVersion: 1
+      });
+    }
+    if (history.length === 0) return console.log(pc.gray("Nothing is published on this Map."));
+    for (const item of history) {
+      const origin = item.restoredFromVersion ? `restored from v${item.restoredFromVersion}` : "";
+      console.log(
+        `  v${item.version}  ${item.active ? pc.green("live") : pc.gray("superseded")}  ${item.createdAt}  ${[item.source?.kind ?? "unknown", origin].filter(Boolean).join(", ")}`
+      );
+    }
+    printNextSteps(nextSteps);
+  });
+  withOptions(
+    deployments.command("restore").description("Publish an earlier deployment again, as a new version of the Map").argument("<version>", "the version to restore")
+  ).action(async (value, options) => {
+    if (!/^[1-9][0-9]{0,9}$/u.test(value)) {
+      return emitRestoreFailure(
+        options.json,
+        "invalid_version",
+        "Version must be a positive integer."
+      );
+    }
+    const version = Number(value);
+    const api = await dependencies.resolveApi(options, {
+      capabilityScopes: ["status:read", "styles:write"],
+      onFailure: options.json ? (code, message) => emitRestoreFailure(true, code, message) : void 0
+    });
+    if (!api) return;
+    const history = await readHistory(api, options.json);
+    if (!history) return;
+    const live = history.find((item) => item.active);
+    if (!live) {
+      return emitGuidedFailure(
+        options.json,
+        "nothing_published",
+        "Nothing is published on this Map.",
+        deploymentRestoreSteps({ code: "nothing_published", mapId: api.mapId, apiUrl: api.apiUrl })
+      );
+    }
+    if (!history.some((item) => item.version === version)) {
+      return emitGuidedFailure(
+        options.json,
+        "deployment_not_found",
+        `Version ${version} is not in this Map's retained history.`,
+        deploymentRestoreSteps({
+          code: "deployment_not_found",
+          mapId: api.mapId,
+          apiUrl: api.apiUrl
+        })
+      );
+    }
+    const response = await request(api, `/v1/styles/deployments/${version}/restore`, "POST", {
+      expectedCurrentVersion: live.version,
+      source: resolveDeploySource(process.env)
+    });
+    if (!response.ok) return emitHttpFailure(options.json, response.status, response.body, api);
+    const parsed = deploymentRestoreResponseSchema.safeParse(response.body);
+    if (!parsed.success || parsed.data.mapId !== api.mapId) {
+      return emitGuidedFailure(
+        options.json,
+        "deployment_restore_unconfirmed",
+        `The restore of version ${version} was not confirmed.`,
+        deploymentRestoreSteps({
+          code: "deployment_restore_unconfirmed",
+          mapId: api.mapId,
+          apiUrl: api.apiUrl
+        })
+      );
+    }
+    const nextSteps = parsed.data.changed ? [
+      {
+        description: `Your repository still holds what version ${live.version} published, so the next deploy publishes it again. Revert the repository to keep this restore.`
+      },
+      {
+        description: `To undo this restore, publish version ${live.version} again.`,
+        command: `tileflow deployments restore ${live.version} --map-id ${api.mapId}${apiOriginOption(api.apiUrl)}`
+      }
+    ] : [];
+    if (options.json) {
+      return emitJson({ command: "deployments restore", nextSteps, ok: true, ...parsed.data });
+    }
+    console.log(
+      parsed.data.changed ? `${pc.green("\u2713")} Version ${version} is live again as version ${parsed.data.version}. Version ${live.version} stays in the history.` : `${pc.green("\u2713")} The content of version ${version} is already live, as version ${parsed.data.version}.`
+    );
+    if (parsed.data.changed) console.log(pc.gray("  New sessions pick it up within minutes."));
+    printNextSteps(nextSteps);
+  });
+}
+function request(api, path, method, body) {
+  return requestHostedJson(api.apiUrl, path, {
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    headers: {
+      Authorization: `Bearer ${api.apiKey}`,
+      "X-Tileflow-Map-Id": api.mapId,
+      ...body === void 0 ? {} : { "Content-Type": "application/json" }
+    },
+    method
+  });
+}
+function emitHttpFailure(json2, status, body, api) {
+  const failure2 = failureSchema.safeParse(body);
+  const message = failure2.success ? failure2.data.error : void 0;
+  const code = (failure2.success ? failure2.data.code : void 0) ?? `http_${status}`;
+  return emitGuidedFailure(
+    json2,
+    code,
+    message ? `${message.replace(/\.$/u, "")}.` : `The request failed with ${status}.`,
+    deploymentRestoreSteps({ code, mapId: api.mapId, apiUrl: api.apiUrl })
+  );
+}
+
 // src/describe-command.ts
 import { tileflowAuthoringManifest as tileflowAuthoringManifest2 } from "@tileflow/core";
 import {
@@ -3849,9 +4037,9 @@ function tileflowDevOrigin(host, port) {
   return `http://${isIP(host) === 6 ? `[${host}]` : host}:${port}`;
 }
 var loopbackHosts = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
-function redirectTileflowDevNavigation(request, origin) {
-  if (request.method !== "GET" && request.method !== "HEAD") return;
-  const url = new URL(request.url);
+function redirectTileflowDevNavigation(request2, origin) {
+  if (request2.method !== "GET" && request2.method !== "HEAD") return;
+  const url = new URL(request2.url);
   const canonical = new URL(origin);
   if (url.pathname !== "/" || url.origin === canonical.origin || !loopbackHosts.has(url.hostname) || !loopbackHosts.has(canonical.hostname) || url.protocol !== canonical.protocol || url.port !== canonical.port)
     return;
@@ -4021,7 +4209,9 @@ function prepareTileflowHostedThemeFamily(mapName, map, styles) {
     Object.entries(styles).sort(([left], [right]) => compareCodeUnits4(left, right)).map(([themeName, style]) => [themeName, cloneStyle(style)])
   );
   const teamSources = Object.fromEntries(
-    Object.entries(map.sources ?? {}).sort(([left], [right]) => compareCodeUnits4(left, right)).map(([sourceId, source]) => {
+    Object.entries(map.sources ?? {}).flatMap(
+      ([sourceId, source]) => source.kind === "hosted-tileset" ? [[sourceId, source]] : []
+    ).sort(([left], [right]) => compareCodeUnits4(left, right)).map(([sourceId, source]) => {
       for (const [themeName, style] of Object.entries(prepared)) {
         const definition = style.sources[sourceId];
         if (!definition) {
@@ -4415,7 +4605,7 @@ async function runHostedNativeDeploy(options, ports) {
 
 // src/icon-diff-command.ts
 import { dirname as dirname7, resolve as resolve6 } from "path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 import {
   diffTileflowIconPackageManifests,
   hashTileflowIconPackageManifest,
@@ -4812,7 +5002,7 @@ function technicalDetails(document, beforeIconCount, afterIconCount) {
     ["Icon count", String(beforeIconCount), String(afterIconCount)]
   ];
   return `<details class="technical-details"><summary>Details</summary><div class="details-content"><p class="details-context">${escapeHtml2(context)}</p><table class="details-table"><thead><tr><th>Metric</th><th>Before</th><th>Next</th></tr></thead><tbody>${rows.map(
-    ([metric, previous, proposed]) => `<tr><td>${escapeHtml2(metric ?? "")}</td><td><code>${escapeHtml2(previous ?? "")}</code></td><td><code>${escapeHtml2(proposed ?? "")}</code></td></tr>`
+    ([metric2, previous, proposed]) => `<tr><td>${escapeHtml2(metric2 ?? "")}</td><td><code>${escapeHtml2(previous ?? "")}</code></td><td><code>${escapeHtml2(proposed ?? "")}</code></td></tr>`
   ).join("")}</tbody></table></div></details>`;
 }
 function imageDefinitions(before, after) {
@@ -4934,56 +5124,56 @@ function isMissingFile3(error) {
 
 // src/icon-diff-command.ts
 var environmentSchema = tileflowMapIdSchema;
-var publicHttpUrlSchema = z.url().max(2048).refine((value) => {
+var publicHttpUrlSchema = z2.url().max(2048).refine((value) => {
   const url = new URL(value);
   return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
 });
-var iconPackageBaselineResponseSchema = z.object({
-  baseline: z.object({
-    deployedAt: z.iso.datetime({ offset: true }),
-    deploymentId: z.string().min(1).max(128),
-    package: z.object({
+var iconPackageBaselineResponseSchema = z2.object({
+  baseline: z2.object({
+    deployedAt: z2.iso.datetime({ offset: true }),
+    deploymentId: z2.string().min(1).max(128),
+    package: z2.object({
       contentHash: tileflowIconPackageContentHashSchema,
       label: tileflowIconPackageLabelSchema,
       manifest: tileflowIconPackageManifestSchema,
       spriteUrl: publicHttpUrlSchema,
-      totalBytes: z.number().int().positive().max(tileflowIconPackageLimits.maxGeneratedPackageBytes)
+      totalBytes: z2.number().int().positive().max(tileflowIconPackageLimits.maxGeneratedPackageBytes)
     }).strict().nullable(),
-    version: z.number().int().positive()
+    version: z2.number().int().positive()
   }).strict().nullable(),
   environment: environmentSchema,
-  schemaVersion: z.literal(1)
+  schemaVersion: z2.literal(1)
 }).strict();
-var packageSummarySchema = z.object({
+var packageSummarySchema = z2.object({
   contentHash: tileflowIconPackageContentHashSchema,
-  iconCount: z.number().int().nonnegative().max(tileflowIconPackageLimits.maxIconCount),
+  iconCount: z2.number().int().nonnegative().max(tileflowIconPackageLimits.maxIconCount),
   label: tileflowIconPackageLabelSchema,
-  totalBytes: z.number().int().nonnegative().max(tileflowIconPackageLimits.maxGeneratedPackageBytes)
+  totalBytes: z2.number().int().nonnegative().max(tileflowIconPackageLimits.maxGeneratedPackageBytes)
 }).strict();
-var tileflowIconDiffDocumentSchema = z.object({
-  schemaVersion: z.literal(1),
+var tileflowIconDiffDocumentSchema = z2.object({
+  schemaVersion: z2.literal(1),
   environment: environmentSchema,
-  baseline: z.object({
-    deploymentId: z.string(),
+  baseline: z2.object({
+    deploymentId: z2.string(),
     package: packageSummarySchema.nullable(),
-    version: z.number().int().positive()
+    version: z2.number().int().positive()
   }).strict().nullable(),
-  proposed: z.object({
+  proposed: z2.object({
     package: packageSummarySchema.nullable()
   }).strict(),
-  icons: z.object({
-    added: z.array(z.string()),
-    removed: z.array(z.string()),
-    modified: z.array(z.string()),
-    unchangedCount: z.number().int().nonnegative()
+  icons: z2.object({
+    added: z2.array(z2.string()),
+    removed: z2.array(z2.string()),
+    modified: z2.array(z2.string()),
+    unchangedCount: z2.number().int().nonnegative()
   }).strict(),
-  generatedBytes: z.object({
-    before: z.number().int().nonnegative(),
-    after: z.number().int().nonnegative(),
-    delta: z.number().int()
+  generatedBytes: z2.object({
+    before: z2.number().int().nonnegative(),
+    after: z2.number().int().nonnegative(),
+    delta: z2.number().int()
   }).strict(),
-  artifacts: z.object({ report: z.string().nullable() }).strict(),
-  hasChanges: z.boolean()
+  artifacts: z2.object({ report: z2.string().nullable() }).strict(),
+  hasChanges: z2.boolean()
 }).strict();
 function registerIconDiffCommand(icons, dependencies) {
   icons.command("diff").description("Preview a local icon package against an active hosted revision").requiredOption("--against <environment>", "named map environment to compare").option("-c, --config <path>", "config path", dependencies.defaultConfigPath).addOption(hostedApiUrlOption()).addOption(hostedApiKeyOption("Tileflow API key")).requiredOption("--map-id <id>", "managed Map destination").option("--json", "print deterministic schema-version-1 JSON").option("--cache-dir <path>", "verified Icon Set artifact cache root").option("--offline", "fail a locked Icon Set cache miss instead of hydrating it").option("--report <path>", "write a self-contained HTML visual report").option("--open", "open an explicitly requested report").option("--force", "replace a different explicitly requested report").action(async (options) => {
@@ -5316,7 +5506,7 @@ function sameContributors(left, right) {
 
 // src/icon-lock-command.ts
 import { dirname as dirname9 } from "path";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 import {
   collectTileflowIconSetReferences,
   compareCodeUnits as compareCodeUnits7,
@@ -5334,8 +5524,8 @@ import { readTileflowIconsLockfileText, writeTileflowIconsLockfile } from "@tile
 
 // src/icon-set-command.ts
 import { isAbsolute as isAbsolute3 } from "path";
-import pc from "picocolors";
-import { z as z2 } from "zod";
+import pc2 from "picocolors";
+import { z as z3 } from "zod";
 import {
   tileflowIconPackageLimits as tileflowIconPackageLimits2,
   tileflowIconSetPackageIdSchema,
@@ -5399,7 +5589,7 @@ function registerIconSetCommands(program2, dependencies) {
           "PUT",
           { body, headers: { "Idempotency-Key": options.idempotencyKey } }
         );
-        if (!response.ok) return emitHttpFailure(options.json, response.status, "publish");
+        if (!response.ok) return emitHttpFailure2(options.json, response.status, "publish");
         const parsed = publishResponseSchema.parse(response.body);
         if (parsed.revision.pin && parsed.revision.pin.contentHash !== iconPackage.contentHash) {
           return emitFailure(
@@ -5460,7 +5650,7 @@ function registerIconSetCommands(program2, dependencies) {
         };
         if (options.json) return emitJson(document);
         console.log(
-          `${pc.green("\u2713")} ${parsed.changed ? "Published" : "Unchanged"} ${pc.bold(parsed.revision.reference)} revision ${parsed.revision.version}.`
+          `${pc2.green("\u2713")} ${parsed.changed ? "Published" : "Unchanged"} ${pc2.bold(parsed.revision.reference)} revision ${parsed.revision.version}.`
         );
       } catch (error) {
         emitFailure(options.json, "icon_set_publish_failed", boundedMessage(error, "publish"));
@@ -5488,10 +5678,10 @@ function registerIconSetCommands(program2, dependencies) {
         team: describeTeam(authority)
       };
       if (options.json) return emitJson(document);
-      if (sets.length === 0) return console.log(pc.gray("No Team Icon Sets."));
+      if (sets.length === 0) return console.log(pc2.gray("No Team Icon Sets."));
       for (const set of sets) {
         console.log(
-          `  ${pc.bold(set.reference)} ${pc.gray(set.archivedAt ? "archived" : `v${String(set.latestVersion ?? 0)}`)}`
+          `  ${pc2.bold(set.reference)} ${pc2.gray(set.archivedAt ? "archived" : `v${String(set.latestVersion ?? 0)}`)}`
         );
       }
     } catch (error) {
@@ -5573,7 +5763,7 @@ function registerIconSetCommands(program2, dependencies) {
             headers: { "Content-Type": "application/json" }
           }
         );
-        if (!response.ok) return emitHttpFailure(options.json, response.status, name);
+        if (!response.ok) return emitHttpFailure2(options.json, response.status, name);
         const parsed = catalogDetailResponseSchema.parse(response.body);
         const document = {
           command: `icon-set ${name}`,
@@ -5583,7 +5773,7 @@ function registerIconSetCommands(program2, dependencies) {
         };
         if (options.json) return emitJson(document);
         console.log(
-          `${pc.green("\u2713")} ${archived ? "Archived" : "Restored"} ${pc.bold(parsed.set.reference)}.`
+          `${pc2.green("\u2713")} ${archived ? "Archived" : "Restored"} ${pc2.bold(parsed.set.reference)}.`
         );
       } catch (error) {
         emitFailure(options.json, `icon_set_${name}_failed`, boundedMessage(error, name));
@@ -5654,7 +5844,7 @@ function registerIconSetCommands(program2, dependencies) {
             }
           }
         );
-        if (!response.ok) return emitHttpFailure(options.json, response.status, "purge");
+        if (!response.ok) return emitHttpFailure2(options.json, response.status, "purge");
         const parsed = purgeResponseSchema.parse(response.body);
         const document = {
           command: "icon-set purge",
@@ -5663,8 +5853,8 @@ function registerIconSetCommands(program2, dependencies) {
           team: describeTeam(authority)
         };
         if (options.json) return emitJson(document);
-        console.log(`${pc.green("\u2713")} Purged ${pc.bold(options.confirm)}.`);
-        console.log(pc.yellow(`! ${parsed.result.warning}`));
+        console.log(`${pc2.green("\u2713")} Purged ${pc2.bold(options.confirm)}.`);
+        console.log(pc2.yellow(`! ${parsed.result.warning}`));
       } catch (error) {
         emitFailure(options.json, "icon_set_purge_failed", boundedMessage(error, "purge"));
       }
@@ -5678,7 +5868,7 @@ function registerIconSetCommands(program2, dependencies) {
       const authority = await resolveTeamAuthority(options, ["icons:read"], dependencies);
       if (!authority) return;
       const result = await run(authority);
-      if ("status" in result) return emitHttpFailure(options.json, result.status, command2);
+      if ("status" in result) return emitHttpFailure2(options.json, result.status, command2);
       const document = {
         command: command2,
         schemaVersion: 1,
@@ -5736,7 +5926,7 @@ var IconSetTransportError = class extends Error {
   }
   status;
 };
-function emitHttpFailure(json2, status, command2) {
+function emitHttpFailure2(json2, status, command2) {
   emitFailure(json2, `http_${status}`, `Icon Set ${command2} failed (${status}).`);
 }
 function boundedMessage(error, command2) {
@@ -5781,27 +5971,27 @@ function isIconSetSlug(value) {
 function isIdempotencyKey(value) {
   return value.length >= 8 && value.length <= 128 && /^[A-Za-z0-9._:-]+$/u.test(value);
 }
-var cursorSchema = z2.string().min(1).max(2048).nullable();
-var isoDateSchema = z2.iso.datetime({ offset: true });
-var setSchema = z2.object({
-  id: z2.string().regex(/^ics_[A-Za-z0-9_-]{16}$/u),
+var cursorSchema = z3.string().min(1).max(2048).nullable();
+var isoDateSchema = z3.iso.datetime({ offset: true });
+var setSchema = z3.object({
+  id: z3.string().regex(/^ics_[A-Za-z0-9_-]{16}$/u),
   reference: tileflowIconSetReferenceSchema,
-  name: z2.string().max(200),
-  description: z2.string().max(2e3),
+  name: z3.string().max(200),
+  description: z3.string().max(2e3),
   archivedAt: isoDateSchema.nullable(),
-  latestVersion: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+  latestVersion: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
   createdAt: isoDateSchema,
   updatedAt: isoDateSchema
 }).strict();
-var revisionBaseSchema = z2.object({
-  id: z2.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
+var revisionBaseSchema = z3.object({
+  id: z3.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
   reference: tileflowIconSetReferenceSchema,
-  version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  version: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
   publishedAt: isoDateSchema,
   purgedAt: isoDateSchema.nullable(),
-  iconCount: z2.number().int().min(0).max(tileflowIconPackageLimits2.maxIconCount),
-  totalBytes: z2.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  publisher: z2.object({ kind: z2.enum(["credential", "membership"]), id: z2.string().max(200).nullable() }).strict()
+  iconCount: z3.number().int().min(0).max(tileflowIconPackageLimits2.maxIconCount),
+  totalBytes: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  publisher: z3.object({ kind: z3.enum(["credential", "membership"]), id: z3.string().max(200).nullable() }).strict()
 }).strict();
 var revisionSchema = revisionBaseSchema.extend({ pin: tileflowIconSetPinSchema.nullable() }).transform(({ id, reference, version, publishedAt, purgedAt, iconCount, totalBytes, pin }) => ({
   iconCount,
@@ -5825,53 +6015,53 @@ var revisionSummarySchema = revisionBaseSchema.extend({ packageId: tileflowIconS
     version
   })
 );
-var catalogListResponseSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  sets: z2.array(setSchema).max(pageSize),
+var catalogListResponseSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  sets: z3.array(setSchema).max(pageSize),
   nextCursor: cursorSchema.optional()
 }).strict();
-var catalogDetailResponseSchema = z2.object({ schemaVersion: z2.literal(1), set: setSchema }).strict();
-var versionsResponseSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  versions: z2.array(revisionSummarySchema).max(pageSize),
+var catalogDetailResponseSchema = z3.object({ schemaVersion: z3.literal(1), set: setSchema }).strict();
+var versionsResponseSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  versions: z3.array(revisionSummarySchema).max(pageSize),
   nextCursor: cursorSchema.optional()
 }).strict();
-var revisionResponseSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  archived: z2.boolean(),
+var revisionResponseSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  archived: z3.boolean(),
   revision: revisionSchema
 }).strict();
-var publishResponseSchema = z2.object({ schemaVersion: z2.literal(1), changed: z2.boolean(), revision: revisionSchema }).strict();
-var usesResponseSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  uses: z2.array(
-    z2.object({
-      deploymentId: z2.string().min(1).max(160),
-      deploymentVersion: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-      mapId: z2.string().min(1).max(160),
-      mapName: z2.string().max(200).nullable(),
-      mapState: z2.string().max(64),
-      versionId: z2.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
-      version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-      ordinal: z2.number().int().min(0).max(31),
-      relationship: z2.enum(["active", "retained"])
+var publishResponseSchema = z3.object({ schemaVersion: z3.literal(1), changed: z3.boolean(), revision: revisionSchema }).strict();
+var usesResponseSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  uses: z3.array(
+    z3.object({
+      deploymentId: z3.string().min(1).max(160),
+      deploymentVersion: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+      mapId: z3.string().min(1).max(160),
+      mapName: z3.string().max(200).nullable(),
+      mapState: z3.string().max(64),
+      versionId: z3.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
+      version: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+      ordinal: z3.number().int().min(0).max(31),
+      relationship: z3.enum(["active", "retained"])
     }).strict()
   ).max(pageSize),
   nextCursor: cursorSchema.optional(),
-  coverage: z2.literal("known-hosted-deployments"),
-  includesUndeployedRepositoryLocks: z2.literal(false)
+  coverage: z3.literal("known-hosted-deployments"),
+  includesUndeployedRepositoryLocks: z3.literal(false)
 }).strict();
-var purgeResponseSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  result: z2.object({
-    schemaVersion: z2.literal(1),
-    versionId: z2.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
-    version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-    purged: z2.boolean(),
-    knownRetainedDeployments: z2.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-    physicalBytesReleased: z2.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-    unknownRepositoryLocks: z2.boolean(),
-    warning: z2.string().max(400)
+var purgeResponseSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  result: z3.object({
+    schemaVersion: z3.literal(1),
+    versionId: z3.string().regex(/^icv_[A-Za-z0-9_-]{16}$/u),
+    version: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    purged: z3.boolean(),
+    knownRetainedDeployments: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    physicalBytesReleased: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    unknownRepositoryLocks: z3.boolean(),
+    warning: z3.string().max(400)
   }).strict()
 }).strict();
 
@@ -5986,14 +6176,14 @@ function registerIconLockCommands(program2, dependencies) {
       }))
     };
     if (options.json) return emitJson(document);
-    if (document.sets.length === 0) return console.log(pc2.gray("No Icon Set references declared."));
+    if (document.sets.length === 0) return console.log(pc3.gray("No Icon Set references declared."));
     for (const entry of document.sets) {
       console.log(
-        `  ${pc2.bold(entry.reference)} ${pc2.gray(`v${String(entry.version)}`)}${entry.changed ? "" : pc2.gray(" (unchanged)")}`
+        `  ${pc3.bold(entry.reference)} ${pc3.gray(`v${String(entry.version)}`)}${entry.changed ? "" : pc3.gray(" (unchanged)")}`
       );
     }
     for (const reference of missing) {
-      console.log(pc2.yellow(`! ${reference} is declared but not locked.`));
+      console.log(pc3.yellow(`! ${reference} is declared but not locked.`));
     }
   }
   async function resolvePin(authority, reference, version) {
@@ -6109,12 +6299,12 @@ async function readCurrentPins(contents) {
 }
 
 // src/map-commands.ts
-import pc4 from "picocolors";
+import pc5 from "picocolors";
 
 // src/map-setup.ts
 import { randomBytes } from "crypto";
 import { createInterface } from "readline/promises";
-import pc3 from "picocolors";
+import pc4 from "picocolors";
 var maximumOrigins = 20;
 var exactHost = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/u;
 var teamReference = /^@([A-Za-z0-9][A-Za-z0-9._-]{0,127})$/u;
@@ -6252,9 +6442,9 @@ function createTerminalPrompts(json2 = false) {
   if (json2 || !process.stdin.isTTY || !process.stdout.isTTY) return null;
   return {
     async chooseTeam(teams) {
-      console.log(`${pc3.cyan("?")} Which Team should own the new Map?`);
+      console.log(`${pc4.cyan("?")} Which Team should own the new Map?`);
       teams.forEach(
-        (team, index) => console.log(`  ${index + 1}) ${team.name} ${pc3.gray(`@${team.slug}`)}`)
+        (team, index) => console.log(`  ${index + 1}) ${team.name} ${pc4.gray(`@${team.slug}`)}`)
       );
       const answer = await ask("Team number", (value) => {
         const index = Number(value);
@@ -6263,7 +6453,7 @@ function createTerminalPrompts(json2 = false) {
       return answer;
     },
     async chooseAccess() {
-      console.log(`${pc3.cyan("?")} Which websites may load this Map in a browser?`);
+      console.log(`${pc4.cyan("?")} Which websites may load this Map in a browser?`);
       console.log("  1) Only selected websites (recommended)");
       console.log("  2) Any website");
       const mode = await ask(
@@ -6274,7 +6464,7 @@ function createTerminalPrompts(json2 = false) {
       if (mode === "any") return { kind: "any" };
       return ask("Website origins, separated by spaces (https://example.com)", (value) => {
         const parsed = parseOriginList(value.split(/[\s,]+/u).filter(Boolean));
-        if (!parsed.ok) console.log(`  ${pc3.yellow(parsed.error)}`);
+        if (!parsed.ok) console.log(`  ${pc4.yellow(parsed.error)}`);
         return parsed.ok ? parsed.value : null;
       });
     }
@@ -6329,8 +6519,8 @@ function registerMapCommands(program2, dependencies) {
     }
     printCreatedMap(result.value);
     console.log(`
-${pc4.bold("Next step")}`);
-    console.log(`  ${pc4.cyan("\u2022")} Publish the repository map with ${pc4.cyan(next)}.`);
+${pc5.bold("Next step")}`);
+    console.log(`  ${pc5.cyan("\u2022")} Publish the repository map with ${pc5.cyan(next)}.`);
   });
 }
 function addMapSetupOptions(command2) {
@@ -6346,7 +6536,7 @@ function hasMapSetupOptions(options) {
 async function createMapForDeploy(options, dependencies) {
   const session = await loadSession(options, dependencies);
   if (!session) return null;
-  console.log(`${pc4.cyan("i")} No --map-id given; creating a managed Map for this deploy.`);
+  console.log(`${pc5.cyan("i")} No --map-id given; creating a managed Map for this deploy.`);
   const result = await setUpManagedMap(session, options, {
     prompts: dependencies.prompts === void 0 ? createTerminalPrompts() : dependencies.prompts
   });
@@ -6356,7 +6546,7 @@ async function createMapForDeploy(options, dependencies) {
   }
   printCreatedMap(result.value);
   console.log(
-    pc4.gray(
+    pc5.gray(
       `If this deploy is interrupted, rerun it with --setup-key ${result.setupKey} to reuse the same Map.`
     )
   );
@@ -6364,10 +6554,10 @@ async function createMapForDeploy(options, dependencies) {
 }
 function printCreatedMap(created) {
   console.log(
-    `${pc4.green("\u2713")} Created ${pc4.bold(created.map.id)} in ${created.team.name} ${pc4.gray(`@${created.team.slug}`)}.`
+    `${pc5.green("\u2713")} Created ${pc5.bold(created.map.id)} in ${created.team.name} ${pc5.gray(`@${created.team.slug}`)}.`
   );
   console.log(
-    `${pc4.gray("Websites:".padEnd(13))} ${describeBrowserAccess(created.allowedOrigins)}`
+    `${pc5.gray("Websites:".padEnd(13))} ${describeBrowserAccess(created.allowedOrigins)}`
   );
 }
 async function loadSession(options, dependencies) {
@@ -6400,8 +6590,8 @@ async function loadSession(options, dependencies) {
 // src/model-command.ts
 import { lstat as lstat5 } from "fs/promises";
 import { basename as basename4, dirname as dirname10, relative as relative4, resolve as resolve7 } from "path";
-import pc5 from "picocolors";
-import { z as z3 } from "zod";
+import pc6 from "picocolors";
+import { z as z4 } from "zod";
 import { tileflowModelContentType } from "@tileflow/core";
 import {
   assertValidTileflowConfig as assertValidTileflowConfig3,
@@ -6464,7 +6654,7 @@ function registerModelCommands(program2, dependencies) {
         "PUT",
         { body }
       );
-      if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+      if (!response.ok) return emitHttpFailure3(options.json, response.status, response.body, name);
       const parsed = publishResponseSchema2.safeParse(response.body);
       if (!parsed.success || parsed.data.model.current?.contentHash !== model.sha256) {
         return emitFailure(
@@ -6478,7 +6668,7 @@ function registerModelCommands(program2, dependencies) {
         const current = parsed.data.model.current;
         const action = parsed.data.changed ? "Published" : "Unchanged";
         console.log(
-          `${pc5.green("\u2713")} ${action} 3D model ${pc5.bold(name)} version ${current.version} (${formatBytes3(current.byteLength)}, ${formatCount(current.summary.levels[0]?.triangles ?? 0)} triangles).`
+          `${pc6.green("\u2713")} ${action} 3D model ${pc6.bold(name)} version ${current.version} (${formatBytes3(current.byteLength)}, ${formatCount(current.summary.levels[0]?.triangles ?? 0)} triangles).`
         );
       }
     }
@@ -6510,7 +6700,7 @@ function registerModelCommands(program2, dependencies) {
           `/v1/models${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`,
           "GET"
         );
-        if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body);
+        if (!response.ok) return emitHttpFailure3(options.json, response.status, response.body);
         const parsed = listResponseSchema.safeParse(response.body);
         if (!parsed.success)
           return emitFailure(options.json, "invalid_response", "The model list was not readable.");
@@ -6527,7 +6717,7 @@ function registerModelCommands(program2, dependencies) {
       for (const model of listed) {
         const current = model.current;
         console.log(
-          `${pc5.bold(model.name)}  ${current ? `version ${current.version}, ${formatBytes3(current.byteLength)}` : "no current version"}  ${model.usedByMaps === 1 ? "1 map" : `${model.usedByMaps} maps`}${model.state === "purging" ? pc5.yellow("  purging") : ""}`
+          `${pc6.bold(model.name)}  ${current ? `version ${current.version}, ${formatBytes3(current.byteLength)}` : "no current version"}  ${model.usedByMaps === 1 ? "1 map" : `${model.usedByMaps} maps`}${model.state === "purging" ? pc6.yellow("  purging") : ""}`
         );
       }
     }
@@ -6544,7 +6734,7 @@ function registerModelCommands(program2, dependencies) {
     if (options.json) return emitJson({ ...detail, command: "models status", ok: true });
     const { model, versions, uses } = detail;
     console.log(
-      `${pc5.bold(model.name)}${model.state === "purging" ? pc5.yellow(" (purging)") : ""}`
+      `${pc6.bold(model.name)}${model.state === "purging" ? pc6.yellow(" (purging)") : ""}`
     );
     for (const version of versions) {
       const role = version.state === "current" ? "current" : version.state === "previous" ? "previous" : version.state;
@@ -6582,7 +6772,7 @@ function registerModelCommands(program2, dependencies) {
         headers: { "Content-Type": "application/json" }
       }
     );
-    if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+    if (!response.ok) return emitHttpFailure3(options.json, response.status, response.body, name);
     const parsed = restoreResponseSchema.safeParse(response.body);
     if (!parsed.success || parsed.data.model.current?.version !== previous.version) {
       return emitFailure(
@@ -6599,7 +6789,7 @@ function registerModelCommands(program2, dependencies) {
         model: parsed.data.model
       });
     console.log(
-      `${pc5.green("\u2713")} ${pc5.bold(name)} is at version ${previous.version} again; version ${current.version} is its previous one. Maps draw it on their next load.`
+      `${pc6.green("\u2713")} ${pc6.bold(name)} is at version ${previous.version} again; version ${current.version} is its previous one. Maps draw it on their next load.`
     );
   });
   withTeamOptions2(
@@ -6624,7 +6814,7 @@ function registerModelCommands(program2, dependencies) {
         headers: { "X-Tileflow-Confirm-Model-Purge": name }
       }
     );
-    if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+    if (!response.ok) return emitHttpFailure3(options.json, response.status, response.body, name);
     const parsed = purgeResponseSchema2.safeParse(response.body);
     if (!parsed.success)
       return emitFailure(options.json, "invalid_response", "The purge was not confirmed.");
@@ -6636,7 +6826,7 @@ function registerModelCommands(program2, dependencies) {
         purge: parsed.data.purge
       });
     console.log(
-      `${pc5.green("\u2713")} ${pc5.bold(name)} is being purged; its name is free once its files are deleted.`
+      `${pc6.green("\u2713")} ${pc6.bold(name)} is being purged; its name is free once its files are deleted.`
     );
   });
 }
@@ -6650,7 +6840,7 @@ async function readDetail(authority, name, json2) {
     "GET"
   );
   if (!response.ok) {
-    emitHttpFailure2(json2, response.status, response.body, name);
+    emitHttpFailure3(json2, response.status, response.body, name);
     return void 0;
   }
   const parsed = detailResponseSchema.safeParse(response.body);
@@ -6728,8 +6918,8 @@ function addModel(models, name, model) {
     throw new Error(`Two different models are named ${name}; a Team has one model of each name.`);
   models.set(name, model);
 }
-function emitHttpFailure2(json2, status, body, name) {
-  const error = z3.object({ error: z3.object({ code: z3.string().max(80), message: z3.string().max(400) }).partial() }).partial().safeParse(body);
+function emitHttpFailure3(json2, status, body, name) {
+  const error = z4.object({ error: z4.object({ code: z4.string().max(80), message: z4.string().max(400) }).partial() }).partial().safeParse(body);
   const message = error.success ? error.data.error?.message : void 0;
   const code = error.success ? error.data.error?.code : void 0;
   if (status === 404)
@@ -6752,64 +6942,64 @@ function formatBytes3(bytes) {
 function formatCount(count) {
   return new Intl.NumberFormat("en-US").format(count);
 }
-var summarySchema = z3.object({
-  levels: z3.array(
-    z3.object({
-      level: z3.enum(["near", "mid", "far"]),
-      vertices: z3.number().int().nonnegative(),
-      triangles: z3.number().int().nonnegative()
+var summarySchema = z4.object({
+  levels: z4.array(
+    z4.object({
+      level: z4.enum(["near", "mid", "far"]),
+      vertices: z4.number().int().nonnegative(),
+      triangles: z4.number().int().nonnegative()
     }).strict()
   ).min(1).max(3),
-  width: z3.number().nonnegative(),
-  depth: z3.number().nonnegative(),
-  height: z3.number().nonnegative(),
-  footprint: z3.object({
-    rings: z3.number().int().nonnegative(),
-    points: z3.number().int().nonnegative(),
-    area: z3.number().nonnegative()
+  width: z4.number().nonnegative(),
+  depth: z4.number().nonnegative(),
+  height: z4.number().nonnegative(),
+  footprint: z4.object({
+    rings: z4.number().int().nonnegative(),
+    points: z4.number().int().nonnegative(),
+    area: z4.number().nonnegative()
   }).strict()
 }).strict();
-var versionSchema = z3.object({
-  id: z3.string().regex(/^tmv_[A-Za-z0-9_-]{16,64}$/u),
-  version: z3.number().int().positive(),
-  state: z3.enum(["current", "previous", "gc_pending", "deleting", "deleted"]),
-  contentHash: z3.string().regex(sha256),
-  byteLength: z3.number().int().positive(),
-  publishedAt: z3.iso.datetime({ offset: true }),
+var versionSchema = z4.object({
+  id: z4.string().regex(/^tmv_[A-Za-z0-9_-]{16,64}$/u),
+  version: z4.number().int().positive(),
+  state: z4.enum(["current", "previous", "gc_pending", "deleting", "deleted"]),
+  contentHash: z4.string().regex(sha256),
+  byteLength: z4.number().int().positive(),
+  publishedAt: z4.iso.datetime({ offset: true }),
   summary: summarySchema
 }).strict();
-var modelSchema = z3.object({
-  id: z3.string().regex(/^tmd_[A-Za-z0-9_-]{16,64}$/u),
-  name: z3.string().regex(modelName).max(64),
-  state: z3.enum(["active", "purging"]),
+var modelSchema = z4.object({
+  id: z4.string().regex(/^tmd_[A-Za-z0-9_-]{16,64}$/u),
+  name: z4.string().regex(modelName).max(64),
+  state: z4.enum(["active", "purging"]),
   current: versionSchema.nullable(),
   previous: versionSchema.nullable(),
-  url: z3.url(),
-  usedByMaps: z3.number().int().nonnegative(),
-  updatedAt: z3.iso.datetime({ offset: true })
+  url: z4.url(),
+  usedByMaps: z4.number().int().nonnegative(),
+  updatedAt: z4.iso.datetime({ offset: true })
 }).strict();
-var listResponseSchema = z3.object({
-  schemaVersion: z3.literal(1),
-  models: z3.array(modelSchema).max(100),
-  nextCursor: z3.string().min(1).max(512).optional()
+var listResponseSchema = z4.object({
+  schemaVersion: z4.literal(1),
+  models: z4.array(modelSchema).max(100),
+  nextCursor: z4.string().min(1).max(512).optional()
 }).strict();
-var detailResponseSchema = z3.object({
-  schemaVersion: z3.literal(1),
+var detailResponseSchema = z4.object({
+  schemaVersion: z4.literal(1),
   model: modelSchema,
-  versions: z3.array(versionSchema).max(100),
-  uses: z3.array(
-    z3.object({
-      mapId: z3.string().min(1).max(160),
-      mapName: z3.string().max(200).nullable(),
-      relationship: z3.enum(["active", "retained"])
+  versions: z4.array(versionSchema).max(100),
+  uses: z4.array(
+    z4.object({
+      mapId: z4.string().min(1).max(160),
+      mapName: z4.string().max(200).nullable(),
+      relationship: z4.enum(["active", "retained"])
     }).strict()
   ).max(100)
 }).strict();
-var publishResponseSchema2 = z3.object({ schemaVersion: z3.literal(1), changed: z3.boolean(), model: modelSchema }).strict();
-var restoreResponseSchema = z3.object({ schemaVersion: z3.literal(1), model: modelSchema }).strict();
-var purgeResponseSchema2 = z3.object({
-  schemaVersion: z3.literal(1),
-  purge: z3.object({ name: z3.string().regex(modelName), state: z3.enum(["purging", "purged"]) }).strict()
+var publishResponseSchema2 = z4.object({ schemaVersion: z4.literal(1), changed: z4.boolean(), model: modelSchema }).strict();
+var restoreResponseSchema = z4.object({ schemaVersion: z4.literal(1), model: modelSchema }).strict();
+var purgeResponseSchema2 = z4.object({
+  schemaVersion: z4.literal(1),
+  purge: z4.object({ name: z4.string().regex(modelName), state: z4.enum(["purging", "purged"]) }).strict()
 }).strict();
 
 // src/native-preview-command.ts
@@ -6850,17 +7040,17 @@ function createTileflowNativePreviewRequestHandler(options) {
     headers: { "Content-Type": "application/json; charset=utf-8" },
     status: 404
   });
-  const handler = async (request) => {
+  const handler = async (request2) => {
     let pathname;
     try {
-      pathname = new URL(request.url).pathname;
+      pathname = new URL(request2.url).pathname;
     } catch {
       return notFound();
     }
     if (pathname === tileflowNativePreviewBasePath || pathname === `${tileflowNativePreviewBasePath}/` || nativePreviewUnavailablePaths.has(pathname) || pathname.startsWith(`${tileflowNativePreviewBasePath}/__runtime/`) || pathname.startsWith(`${tileflowNativePreviewBasePath}/__inspection/`)) {
       return notFound();
     }
-    return delegate(request);
+    return delegate(request2);
   };
   return Object.assign(handler, {
     close: delegate.close,
@@ -6900,7 +7090,7 @@ function resolveTileflowExternalOpenInvocation(target, platform) {
 }
 
 // src/project-commands.ts
-import pc6 from "picocolors";
+import pc7 from "picocolors";
 function registerProjectCommands(program2, dependencies) {
   const projects = program2.command("projects", { hidden: true }).description("Manage internal application destinations");
   projects.command("list").description("List application destinations accessible to the authenticated Tileflow account").option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--include-archived", "include archived application destinations").option("--json", "print deterministic schema-version-1 JSON").action(async (options) => {
@@ -6916,12 +7106,12 @@ function registerProjectCommands(program2, dependencies) {
     };
     if (options.json) return emitJson2(document);
     if (!result.items.length) {
-      console.log(pc6.gray("No managed destinations found."));
+      console.log(pc7.gray("No managed destinations found."));
       return;
     }
     for (const target of result.items) {
       console.log(
-        `  ${target.project.archivedAt ? pc6.yellow("\u25CB") : pc6.green("\u25CF")} ${pc6.bold(target.project.name)} ${pc6.gray(target.reference)}${target.project.archivedAt ? pc6.gray(" (archived)") : ""}`
+        `  ${target.project.archivedAt ? pc7.yellow("\u25CB") : pc7.green("\u25CF")} ${pc7.bold(target.project.name)} ${pc7.gray(target.reference)}${target.project.archivedAt ? pc7.gray(" (archived)") : ""}`
       );
     }
   });
@@ -6974,8 +7164,8 @@ function registerProjectCommands(program2, dependencies) {
         ...asRecord(result.body)
       };
       if (options.json) return emitJson2(document);
-      console.log(`${pc6.green("\u2713")} Application ${pc6.bold(options.name.trim())} is ready.`);
-      console.log(pc6.gray(`Its technical selector is --project @${organization.slug}/${slug}.`));
+      console.log(`${pc7.green("\u2713")} Application ${pc7.bold(options.name.trim())} is ready.`);
+      console.log(pc7.gray(`Its technical selector is --project @${organization.slug}/${slug}.`));
     }
   );
   projects.command("show <target>").description("Show one application destination").option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--json", "print deterministic schema-version-1 JSON").action(async (target, options) => {
@@ -6997,8 +7187,8 @@ function registerProjectCommands(program2, dependencies) {
     if (!isProjectItem(project)) {
       return emitLocalFailure(false, "invalid_response", "Destination response was invalid.");
     }
-    console.log(`${pc6.bold(project.name)} ${pc6.gray(target)}`);
-    console.log(project.archivedAt ? pc6.yellow("Archived") : pc6.green("Active"));
+    console.log(`${pc7.bold(project.name)} ${pc7.gray(target)}`);
+    console.log(project.archivedAt ? pc7.yellow("Archived") : pc7.green("Active"));
   });
   for (const archived of [true, false]) {
     const verb = archived ? "archive" : "unarchive";
@@ -7025,7 +7215,7 @@ function registerProjectCommands(program2, dependencies) {
         ...asRecord(result.body)
       };
       if (options.json) return emitJson2(document);
-      console.log(`${pc6.green("\u2713")} Application ${archived ? "archived" : "unarchived"}.`);
+      console.log(`${pc7.green("\u2713")} Application ${archived ? "archived" : "unarchived"}.`);
     });
   }
 }
@@ -7136,7 +7326,7 @@ function emitLocalFailure(json2, code, message, details = {}) {
     console.error(message);
     emitJson2({ schemaVersion: 1, ok: false, error: { code, ...details } });
   } else {
-    console.error(`${pc6.red("\u2715")} ${message}`);
+    console.error(`${pc7.red("\u2715")} ${message}`);
   }
   process.exitCode = 1;
 }
@@ -7281,7 +7471,7 @@ async function runRendererArtifactCommand(command2, options) {
 
 // src/visual-command.ts
 import { lstat as lstat6, readFile as readFile5 } from "fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute4, parse as parse2, relative as relative5, resolve as resolve9, sep as sep4 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute4, parse as parse2, relative as relative5, resolve as resolve10, sep as sep4 } from "path";
 import {
   analyzeTileflowCaptureReference,
   compareTileflowCaptureToBaseline,
@@ -7296,6 +7486,565 @@ import {
   validateTileflowVisualReferencePng
 } from "@tileflow/capture";
 import { compareCodeUnits as compareCodeUnits8 } from "@tileflow/core";
+
+// src/visual-approval-command.ts
+import { execFile } from "child_process";
+import { resolve as resolve9 } from "path";
+import { setTimeout as delay } from "timers/promises";
+import { TileflowVisualReviewError as TileflowVisualReviewError2 } from "@tileflow/capture";
+var statusName = "Tileflow visual review";
+var approveJobName = "tileflow-visual-review-approve";
+var defaultEvidenceBranch = "tileflow-visual-review";
+var defaultOutputDirectory = ".tileflow/diffs/review";
+var defaultTimeoutSeconds = 300;
+var pollIntervalMs = 5e3;
+var maximumReportBytes = 1024 * 1024;
+var maximumImageBytes = 5 * 1024 * 1024;
+var maximumHostOutputBytes = 16 * 1024 * 1024;
+var maximumText = 500;
+var scenePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var fullShaPattern = /^[0-9a-f]{40}$/u;
+var commitPattern = /^[0-9a-f]{7,40}$/u;
+var branchPattern = /^[A-Za-z0-9._/-]+$/u;
+var sceneStatuses = /* @__PURE__ */ new Set([
+  "changed",
+  "missing-baseline",
+  "runtime-mismatch",
+  "scene-mismatch",
+  "unchanged"
+]);
+var pngSignature = [137, 80, 78, 71, 13, 10, 26, 10];
+var imageKinds = ["before", "after", "diff"];
+function registerVisualApprovalCommands(visual) {
+  const hostOptions = (command2) => command2.argument("[change]", "pull or merge request number; defaults to the current branch").option("--provider <provider>", "github or gitlab; detected from the origin remote").option(
+    "--evidence-branch <branch>",
+    "branch configured for the review evidence",
+    defaultEvidenceBranch
+  ).option("--json", "print deterministic schema-version-1 JSON");
+  hostOptions(
+    visual.command("report").description("Show the visual review of a pull or merge request and download its images")
+  ).option("--output-dir <path>", "directory for downloaded images", defaultOutputDirectory).action(async (change, options) => {
+    try {
+      await runVisualReport(change, options);
+    } catch (error) {
+      printCaptureError(error, { command: "visual.report", json: options.json });
+      process.exitCode = 1;
+    }
+  });
+  hostOptions(
+    visual.command("approve").description("Approve the reviewed renders of one exact commit after a person accepts them")
+  ).requiredOption("--commit <sha>", "the commit whose report was reviewed").option(
+    "--timeout <seconds>",
+    "seconds to wait for the result; 0 returns once requested",
+    String(defaultTimeoutSeconds)
+  ).action(async (change, options) => {
+    try {
+      await runVisualApprove(change, options);
+    } catch (error) {
+      printCaptureError(error, { command: "visual.approve", json: options.json });
+      process.exitCode = 1;
+    }
+  });
+}
+async function runVisualReport(change, options) {
+  const branch = evidenceBranch(options.evidenceBranch);
+  const cwd = process.cwd();
+  const host = await createHost(options.provider, cwd);
+  const pull = await host.findChange(changeNumber(change));
+  const review = await loadReview(host, pull, branch);
+  const paths = await downloadImages(host, pull, review, branch, cwd, options.outputDir);
+  const document = createReportJson(host, pull, review, paths);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(document, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(formatReport(host, document));
+}
+async function runVisualApprove(change, options) {
+  const branch = evidenceBranch(options.evidenceBranch);
+  const timeoutSeconds = timeout(options.timeout);
+  if (!commitPattern.test(options.commit)) {
+    throw reviewError(
+      "--commit expects a commit hash of 7 to 40 lowercase hexadecimal characters."
+    );
+  }
+  const host = await createHost(options.provider, process.cwd());
+  const pull = await host.findChange(changeNumber(change));
+  if (!pull.headSha.startsWith(options.commit)) {
+    throw reviewError(
+      `The current commit is ${pull.headSha.slice(0, 12)}, not ${options.commit}. Review the latest report before approving.`
+    );
+  }
+  const review = await loadReview(host, pull, branch);
+  const finish = (state, approvedBy) => {
+    const document = {
+      schemaVersion: 1,
+      command: "visual.approve",
+      provider: host.provider,
+      number: pull.number,
+      commit: pull.headSha,
+      state,
+      approvedBy
+    };
+    process.stdout.write(
+      options.json ? `${JSON.stringify(document, null, 2)}
+` : state === "approved" ? `Approved ${pull.headSha.slice(0, 12)}${approvedBy ? ` as ${clean(approvedBy)}` : ""}.
+` : `Approval requested for ${pull.headSha.slice(0, 12)}.
+`
+    );
+  };
+  if (review.state === "approved") {
+    finish("approved", review.approvedBy);
+    return;
+  }
+  if (review.state !== "needs-approval") throw notApprovable(host, review);
+  const poll = await host.requestApproval(pull);
+  if (timeoutSeconds === 0) {
+    finish("requested", null);
+    return;
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  for (; ; ) {
+    const outcome = await poll();
+    if (outcome.state === "approved") {
+      finish("approved", outcome.by);
+      return;
+    }
+    if (outcome.state === "refused") {
+      throw reviewError(`Approval not recorded: ${outcome.reason}`);
+    }
+    if (Date.now() >= deadline) {
+      throw reviewError(
+        "The approval is still running. Check its result with tileflow visual report."
+      );
+    }
+    await delay(pollIntervalMs);
+  }
+}
+function notApprovable(host, review) {
+  if (review.state === "closed") return reviewError(`This ${host.noun} is closed.`);
+  if (review.state === "pending") return reviewError("This commit has no report yet.");
+  if (review.state === "passed") return reviewError("This report has nothing to approve.");
+  return reviewError("This report cannot be approved. Read its failure and warnings.");
+}
+async function loadReview(host, pull, branch) {
+  const status = await host.readStatus(pull.headSha);
+  if (!pull.open) return { approvedBy: null, report: null, state: "closed", status };
+  const raw = await host.readEvidence(
+    branch,
+    `pr-${pull.number}/${pull.headSha}/report.json`,
+    maximumReportBytes
+  );
+  if (!raw) return { approvedBy: null, report: null, state: "pending", status };
+  const report = parseEvidenceReport(parseJson(raw, "evidence report"), pull);
+  const approvedBy = await readApprover(host, pull, branch);
+  return { approvedBy, report, state: reviewState(report, approvedBy), status };
+}
+function reviewState(report, approvedBy) {
+  if (approvedBy) return "approved";
+  if (report.failure || !report.approvable) return "blocked";
+  return report.scenes.some(({ needsApproval }) => needsApproval) ? "needs-approval" : "passed";
+}
+async function readApprover(host, pull, branch) {
+  const raw = await host.readEvidence(
+    branch,
+    `approvals/pr-${pull.number}.json`,
+    maximumReportBytes
+  );
+  if (!raw) return null;
+  const approval = record(parseJson(raw, "approval"), "approval");
+  return approval.headSha === pull.headSha ? text(approval.approvedBy) : null;
+}
+function parseEvidenceReport(value, pull) {
+  const document = record(value, "report");
+  if (document.schemaVersion !== 1) throw reviewError("Unsupported evidence report version.");
+  if (document.headSha !== pull.headSha || !fullShaPattern.test(pull.headSha)) {
+    throw reviewError("The evidence report describes another commit.");
+  }
+  return {
+    approvable: document.approvable === true,
+    cliVersion: text(document.cliVersion),
+    failure: document.failure == null ? null : text(document.failure),
+    scenes: list(document.scenes, "scenes").map(parseScene),
+    semantic: list(document.semantic, "semantic diff"),
+    warnings: list(document.warnings, "warnings").map(text)
+  };
+}
+function parseScene(value) {
+  const scene = record(value, "scene");
+  if (typeof scene.scene !== "string" || !scenePattern.test(scene.scene)) {
+    throw reviewError("The evidence report has an unsupported scene name.");
+  }
+  if (typeof scene.status !== "string" || !sceneStatuses.has(scene.status)) {
+    throw reviewError("The evidence report has an unknown scene status.");
+  }
+  const images = record(scene.images, "scene images");
+  const noise = scene.noise === true;
+  return {
+    exactPixels: metric(scene.exactPixels),
+    images: {
+      before: images.before === true,
+      after: images.after === true,
+      diff: images.diff === true
+    },
+    map: text(scene.map),
+    needsApproval: scene.status !== "unchanged" && !noise,
+    noise,
+    perceptualPixels: metric(scene.perceptualPixels),
+    scene: scene.scene,
+    status: scene.status,
+    totalPixels: metric(scene.totalPixels)
+  };
+}
+async function downloadImages(host, pull, review, branch, cwd, outputDirectory) {
+  const paths = /* @__PURE__ */ new Map();
+  const scenes = review.report?.scenes.filter(({ needsApproval }) => needsApproval) ?? [];
+  if (scenes.length === 0) return paths;
+  const boundaryPath = resolve9(cwd, outputDirectory);
+  const directory = resolve9(boundaryPath, `${pull.number}-${pull.headSha.slice(0, 12)}`);
+  const files = [];
+  for (const scene of scenes) {
+    for (const kind of imageKinds) {
+      if (!scene.images[kind]) continue;
+      const name = `${scene.scene}.${kind}.png`;
+      const bytes = await host.readEvidence(
+        branch,
+        `pr-${pull.number}/${pull.headSha}/${name}`,
+        maximumImageBytes
+      );
+      if (!bytes) throw reviewError(`The evidence is missing ${name}.`);
+      if (!isPng(bytes)) throw reviewError(`The evidence file ${name} is not a PNG.`);
+      const path = resolve9(directory, name);
+      files.push({ path, source: bytes });
+      paths.set(`${scene.scene}.${kind}`, relativePath(cwd, path));
+    }
+  }
+  if (files.length > 0) {
+    await writeAtomicFileSet({
+      boundaryPath,
+      files,
+      force: true,
+      label: "Visual review images",
+      managed: false
+    });
+  }
+  return paths;
+}
+function createReportJson(host, pull, review, paths) {
+  const report = review.report;
+  return {
+    schemaVersion: 1,
+    command: "visual.report",
+    provider: host.provider,
+    number: pull.number,
+    url: pull.url,
+    commit: pull.headSha,
+    state: review.state,
+    status: review.status,
+    approvedBy: review.approvedBy,
+    cliVersion: report?.cliVersion ?? null,
+    failure: report?.failure ?? null,
+    scenes: (report?.scenes ?? []).map(({ images: _images, ...scene }) => ({
+      ...scene,
+      beforePath: paths.get(`${scene.scene}.before`) ?? null,
+      afterPath: paths.get(`${scene.scene}.after`) ?? null,
+      diffPath: paths.get(`${scene.scene}.diff`) ?? null
+    })),
+    semantic: report?.semantic ?? [],
+    warnings: report?.warnings ?? [],
+    nextStep: nextStep(pull, review),
+    untrustedFields: ["failure", "scenes[].map", "semantic", "warnings"]
+  };
+}
+function nextStep(pull, review) {
+  if (review.state === "pending")
+    return "Wait for the capture to finish, then read the report again.";
+  if (review.state !== "needs-approval") return null;
+  return `Show the before and after images to the person responsible for this map. Only after they accept them, run: tileflow visual approve ${pull.number} --commit ${pull.headSha}`;
+}
+function formatReport(host, document) {
+  const lines = [
+    `${host.noun} ${document.number} at ${document.commit.slice(0, 12)}: ${document.state}`,
+    ...document.approvedBy ? [`Approved by ${clean(document.approvedBy)}`] : [],
+    ...document.failure ? [`Failure: ${clean(document.failure)}`] : []
+  ];
+  for (const scene of document.scenes) {
+    lines.push(`  ${scene.scene}: ${scene.noise ? "renderer noise" : scene.status}`);
+    for (const path of [scene.beforePath, scene.afterPath, scene.diffPath]) {
+      if (path) lines.push(`    ${path}`);
+    }
+  }
+  for (const warning of document.warnings) lines.push(`Warning: ${clean(warning)}`);
+  if (document.nextStep) lines.push("", document.nextStep);
+  return `${lines.join("\n")}
+`;
+}
+async function createHost(requested, cwd) {
+  const provider = requested ?? await detectProvider(cwd);
+  if (provider === "github") return createGitHubHost(cwd);
+  if (provider === "gitlab") return createGitLabHost(cwd);
+  throw reviewError("--provider expects github or gitlab.");
+}
+async function detectProvider(cwd) {
+  const remote = await runProcess("git", ["remote", "get-url", "origin"], cwd).catch(() => null);
+  const url = remote ? Buffer.from(remote).toString("utf8") : "";
+  if (/github/iu.test(url)) return "github";
+  if (/gitlab/iu.test(url)) return "gitlab";
+  throw reviewError("Could not tell the Git host from the origin remote. Pass --provider.");
+}
+function createGitHubHost(cwd) {
+  const repository = "repos/{owner}/{repo}";
+  const gh = (args) => runProcess("gh", args, cwd);
+  const api = async (path, ...args) => parseJson(await gh(["api", ...args, path]), "GitHub response");
+  const readStatus = async (sha) => {
+    const combined = record(
+      await api(`${repository}/commits/${sha}/status?per_page=100`),
+      "GitHub status"
+    );
+    const status = list(combined.statuses, "GitHub statuses").map((item) => record(item, "GitHub status")).find(({ context }) => context === statusName);
+    return status ? { description: text(status.description), state: text(status.state) } : null;
+  };
+  return {
+    provider: "github",
+    noun: "pull request",
+    async findChange(number) {
+      const pull = record(
+        parseJson(
+          await gh([
+            "pr",
+            "view",
+            ...number === void 0 ? [] : [String(number)],
+            "--json",
+            "number,url,headRefOid,state"
+          ]),
+          "GitHub pull request"
+        ),
+        "GitHub pull request"
+      );
+      return {
+        headSha: text(pull.headRefOid),
+        number: Number(pull.number),
+        open: pull.state === "OPEN",
+        url: text(pull.url)
+      };
+    },
+    async readEvidence(branch, path, maximumBytes) {
+      return readOptional2(
+        () => gh([
+          "api",
+          "-H",
+          "Accept: application/vnd.github.raw+json",
+          `${repository}/contents/${encodeURI(path)}?ref=${encodeURIComponent(branch)}`
+        ]),
+        maximumBytes
+      );
+    },
+    readStatus,
+    async requestApproval(change) {
+      const comment = record(
+        await api(
+          `${repository}/issues/${change.number}/comments`,
+          "-X",
+          "POST",
+          "-f",
+          `body=/tileflow approve ${change.headSha}`
+        ),
+        "GitHub comment"
+      );
+      const query = `since=${encodeURIComponent(text(comment.created_at))}&per_page=100`;
+      return async () => {
+        const status = await readStatus(change.headSha);
+        const approved = /^Approved by (.+)$/u.exec(status?.description ?? "");
+        if (approved) return { state: "approved", by: approved[1] ?? null };
+        const replies = list(
+          await api(`${repository}/issues/${change.number}/comments?${query}`),
+          "GitHub comments"
+        ).map((item) => record(item, "GitHub comment"));
+        const refusal = replies.find(
+          ({ body, id }) => Number(id) > Number(comment.id) && isRefusal(body)
+        );
+        return refusal ? { state: "refused", reason: refusalReason(refusal.body) } : { state: "pending" };
+      };
+    }
+  };
+}
+function createGitLabHost(cwd) {
+  const project = "projects/:id";
+  const glab = (args) => runProcess("glab", args, cwd);
+  const api = async (path, ...args) => parseJson(await glab(["api", ...args, path]), "GitLab response");
+  const change = (value) => {
+    const mergeRequest = record(value, "GitLab merge request");
+    return {
+      headSha: text(mergeRequest.sha),
+      number: Number(mergeRequest.iid),
+      open: mergeRequest.state === "opened",
+      url: text(mergeRequest.web_url)
+    };
+  };
+  const refusalNote = async (number) => {
+    const notes = list(
+      await api(
+        `${project}/merge_requests/${number}/notes?sort=desc&order_by=created_at&per_page=20`
+      ),
+      "GitLab notes"
+    ).map((item) => record(item, "GitLab note"));
+    const note = notes.find(({ body }) => isRefusal(body));
+    return note ? refusalReason(note.body) : "the approve job failed. Read its log.";
+  };
+  return {
+    provider: "gitlab",
+    noun: "merge request",
+    async findChange(number) {
+      if (number !== void 0) return change(await api(`${project}/merge_requests/${number}`));
+      const branch = Buffer.from(await runProcess("git", ["branch", "--show-current"], cwd)).toString("utf8").trim();
+      const open4 = list(
+        await api(
+          `${project}/merge_requests?state=opened&source_branch=${encodeURIComponent(branch)}`
+        ),
+        "GitLab merge requests"
+      );
+      if (open4.length === 0) throw reviewError(`No open merge request for branch ${branch}.`);
+      return change(open4[0]);
+    },
+    async readEvidence(branch, path, maximumBytes) {
+      return readOptional2(
+        () => glab([
+          "api",
+          `${project}/repository/files/${encodeURIComponent(path)}/raw?ref=${encodeURIComponent(branch)}`
+        ]),
+        maximumBytes
+      );
+    },
+    async readStatus(sha) {
+      const statuses = list(
+        await api(`${project}/repository/commits/${sha}/statuses?all=true&per_page=100`),
+        "GitLab statuses"
+      ).map((item) => record(item, "GitLab status")).filter(({ name }) => name === statusName).sort((left, right) => Number(right.id) - Number(left.id));
+      const latest = statuses[0];
+      return latest ? { description: text(latest.description), state: text(latest.status) } : null;
+    },
+    async requestApproval(pull) {
+      const pipelines = list(
+        await api(`${project}/merge_requests/${pull.number}/pipelines`),
+        "GitLab pipelines"
+      ).map((item) => record(item, "GitLab pipeline"));
+      const pipeline = pipelines.find(({ sha }) => sha === pull.headSha);
+      if (!pipeline) throw reviewError("No pipeline exists for this commit.");
+      const jobs = list(
+        await api(`${project}/pipelines/${Number(pipeline.id)}/jobs?per_page=100`),
+        "GitLab jobs"
+      ).map((item) => record(item, "GitLab job")).filter(({ name }) => name === approveJobName).sort((left, right) => Number(right.id) - Number(left.id));
+      const job = jobs[0];
+      if (!job) throw reviewError(`Pipeline ${Number(pipeline.id)} has no ${approveJobName} job.`);
+      const action = job.status === "manual" ? "play" : "retry";
+      const started = record(
+        await api(`${project}/jobs/${Number(job.id)}/${action}`, "-X", "POST"),
+        "GitLab job"
+      );
+      return async () => {
+        const current = record(await api(`${project}/jobs/${Number(started.id)}`), "GitLab job");
+        if (current.status === "success") {
+          const user = current.user ? record(current.user, "GitLab user") : null;
+          return { state: "approved", by: user ? text(user.username) : null };
+        }
+        if (current.status === "failed" || current.status === "canceled") {
+          return { state: "refused", reason: await refusalNote(pull.number) };
+        }
+        return { state: "pending" };
+      };
+    }
+  };
+}
+var refusalPrefix = "Approval not recorded: ";
+var isRefusal = (body) => typeof body === "string" && body.startsWith(refusalPrefix);
+var refusalReason = (body) => text(body).slice(refusalPrefix.length);
+async function readOptional2(read, maximumBytes) {
+  try {
+    const bytes = await read();
+    if (bytes.length > maximumBytes) throw reviewError("An evidence file is too large.");
+    return bytes;
+  } catch (error) {
+    if (error instanceof HostNotFoundError) return null;
+    throw error;
+  }
+}
+var HostNotFoundError = class extends Error {
+};
+function runProcess(command2, args, cwd) {
+  return new Promise((resolvePromise, reject) => {
+    execFile(
+      command2,
+      args,
+      { cwd, encoding: "buffer", maxBuffer: maximumHostOutputBytes },
+      (error, stdout, stderr) => {
+        if (!error) {
+          resolvePromise(stdout);
+          return;
+        }
+        if (error.code === "ENOENT") {
+          reject(reviewError(`${command2} is not installed. Install it and sign in with it first.`));
+          return;
+        }
+        const detail = Buffer.from(stderr).toString("utf8").replace(/\s+/gu, " ").trim();
+        reject(
+          /HTTP 404|404 Not Found/u.test(detail) ? new HostNotFoundError(detail) : reviewError(`${command2} failed: ${detail.slice(0, maximumText) || error.message}`)
+        );
+      }
+    );
+  });
+}
+function changeNumber(value) {
+  if (value === void 0) return void 0;
+  if (!/^[1-9][0-9]{0,9}$/u.test(value)) {
+    throw reviewError("The pull or merge request must be a positive number.");
+  }
+  return Number(value);
+}
+function evidenceBranch(value) {
+  if (!branchPattern.test(value) || value.includes("..")) {
+    throw reviewError("--evidence-branch is not a valid branch name.");
+  }
+  return value;
+}
+function timeout(value) {
+  if (!/^[0-9]{1,5}$/u.test(value)) throw reviewError("--timeout expects whole seconds.");
+  return Number(value);
+}
+function isPng(bytes) {
+  return pngSignature.every((byte, index) => bytes[index] === byte);
+}
+function parseJson(bytes, label) {
+  try {
+    return JSON.parse(Buffer.from(bytes).toString("utf8"));
+  } catch {
+    throw reviewError(`The ${label} is not valid JSON.`);
+  }
+}
+function record(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw reviewError(`The ${label} is invalid.`);
+  }
+  return value;
+}
+function list(value, label) {
+  if (!Array.isArray(value)) throw reviewError(`The ${label} list is invalid.`);
+  return value;
+}
+function text(value) {
+  return String(value ?? "").slice(0, maximumText);
+}
+function metric(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function clean(value) {
+  return value.replace(/\p{Cc}/gu, " ");
+}
+function reviewError(message) {
+  return new TileflowVisualReviewError2(message);
+}
+
+// src/visual-command.ts
 function registerVisualCommands(program2, dependencies, canonical = false) {
   const visual = program2.command(canonical ? "compare" : "visual").description("Review deliberate variants, external references or approved baselines");
   registerVisualCompareCommand(visual, dependencies, canonical ? "styles" : "compare");
@@ -7332,6 +8081,7 @@ function registerVisualCommands(program2, dependencies, canonical = false) {
       process.exitCode = 1;
     }
   });
+  registerVisualApprovalCommands(visual);
   return visual;
 }
 function createTileflowVisualDiffJson(comparisons, cwd) {
@@ -7366,14 +8116,14 @@ async function runVisualAnalyze(scene, options) {
   validateVisualSelection([scene]);
   const region = options.region === void 0 ? void 0 : parseTileflowVisualRegion(options.region);
   const cwd = process.cwd();
-  const referencePath = resolve9(cwd, options.reference);
+  const referencePath = resolve10(cwd, options.reference);
   const referencePng = await readVisualReference(referencePath);
   const referenceDimensions = validateTileflowVisualReferencePng(referencePng);
   if (region) assertTileflowVisualRegionFits(region, referenceDimensions, "reference PNG");
   const outputDirectory = await resolveVisualDirectory(cwd, options.outputDir, "output");
-  const actualPath = resolve9(outputDirectory.path, `${scene}.actual.png`);
-  const managedDiffPath = resolve9(outputDirectory.path, `${scene}.diff.png`);
-  const reportPath = resolve9(outputDirectory.path, `${scene}.analysis.json`);
+  const actualPath = resolve10(outputDirectory.path, `${scene}.actual.png`);
+  const managedDiffPath = resolve10(outputDirectory.path, `${scene}.diff.png`);
+  const reportPath = resolve10(outputDirectory.path, `${scene}.analysis.json`);
   assertReferenceIsReadOnly(referencePath, [actualPath, managedDiffPath, reportPath]);
   const controller = installSignalAbortController();
   const session = createTileflowCaptureSession3({
@@ -7462,15 +8212,15 @@ async function runVisualDiff(scenes, options) {
         capture,
         files.kind === "complete" ? files.baseline : void 0
       );
-      const actualPath = resolve9(outputDirectory.path, `${capture.scene}.actual.png`);
-      const diffPath = comparison.diffPng ? resolve9(outputDirectory.path, `${capture.scene}.diff.png`) : void 0;
+      const actualPath = resolve10(outputDirectory.path, `${capture.scene}.actual.png`);
+      const diffPath = comparison.diffPng ? resolve10(outputDirectory.path, `${capture.scene}.diff.png`) : void 0;
       prepared.push({
         capture,
         comparison,
         baselinePath: files.pngPath,
         actualPath,
         diffPath,
-        reportPath: resolve9(outputDirectory.path, `${capture.scene}.visual.json`)
+        reportPath: resolve10(outputDirectory.path, `${capture.scene}.visual.json`)
       });
     }
     const document = createTileflowVisualDiffJson(prepared, cwd);
@@ -7490,7 +8240,7 @@ async function runVisualDiff(scenes, options) {
         }
       ]),
       removePaths: prepared.flatMap(
-        (item) => item.diffPath ? [] : [resolve9(outputDirectory.path, `${item.capture.scene}.diff.png`)]
+        (item) => item.diffPath ? [] : [resolve10(outputDirectory.path, `${item.capture.scene}.diff.png`)]
       )
     });
     if (options.json) {
@@ -7611,7 +8361,7 @@ async function resolvePreviousBaseline(capture, files) {
   }
 }
 async function readBaselineFiles(directory, scene) {
-  const pngPath = resolve9(directory.path, `${scene}.png`);
+  const pngPath = resolve10(directory.path, `${scene}.png`);
   const receiptPath = captureReceiptPath(pngPath);
   const [png, receipt] = await Promise.all([
     readOptionalArtifact(pngPath, directory.boundary, tileflowVisualArtifactLimits2.maximumPngBytes),
@@ -7671,12 +8421,12 @@ async function readVisualReference(path) {
   return new Uint8Array(await readFile5(path));
 }
 async function resolveVisualDirectory(cwd, value, kind) {
-  const path = resolve9(cwd, value);
+  const path = resolve10(cwd, value);
   if (path === cwd || path === parse2(path).root) {
     throw new Error(`Visual ${kind} directory must be a dedicated subdirectory.`);
   }
   if (kind === "baseline") {
-    for (const managed of [resolve9(cwd, ".tileflow/captures"), resolve9(cwd, ".tileflow/diffs")]) {
+    for (const managed of [resolve10(cwd, ".tileflow/captures"), resolve10(cwd, ".tileflow/diffs")]) {
       if (pathsOverlap2(path, managed)) {
         throw new Error("Visual baselines must not overlap Tileflow-managed capture/diff outputs.");
       }
@@ -7712,7 +8462,7 @@ function assertReferenceIsReadOnly(referencePath, outputPaths) {
   }
 }
 function portablePathIdentity2(path) {
-  return resolve9(path).normalize("NFC").toLowerCase();
+  return resolve10(path).normalize("NFC").toLowerCase();
 }
 function isInside2(parent, child) {
   const path = relative5(parent, child);
@@ -7724,8 +8474,8 @@ function isMissingFile4(error) {
 
 // src/workbench-service.ts
 import { opendir, stat } from "fs/promises";
-import { resolve as resolve10 } from "path";
-import { z as z4 } from "zod";
+import { resolve as resolve11 } from "path";
+import { z as z5 } from "zod";
 import {
   compareTileflowCapturesForReview as compareTileflowCapturesForReview3,
   createTileflowCaptureSession as createTileflowCaptureSession4,
@@ -7738,22 +8488,22 @@ import {
 } from "@tileflow/core";
 import { resolveTileflowPreview } from "@tileflow/dev/preview";
 var prefix = "/__workbench";
-var captureInput = z4.object({
-  side: z4.enum(["left", "right"]).default("left"),
-  generation: z4.number().int().nonnegative(),
+var captureInput = z5.object({
+  side: z5.enum(["left", "right"]).default("left"),
+  generation: z5.number().int().nonnegative(),
   name: tileflowCaptureSceneNameSchema2,
   definition: tileflowCaptureSceneSchema3
 }).strict();
-var compareInput = z4.object({ before: z4.string().regex(/^[a-f0-9]{64}$/u), after: z4.string().regex(/^[a-f0-9]{64}$/u) }).strict();
-var deleteInput = z4.object({ id: z4.string().regex(/^[a-f0-9]{64}$/u) }).strict();
-var contextInput = z4.object({
-  client: z4.string().regex(/^[a-zA-Z0-9-]{1,80}$/u),
-  side: z4.enum(["left", "right"]),
-  generation: z4.number().int(),
-  context: z4.record(z4.string(), z4.unknown())
+var compareInput = z5.object({ before: z5.string().regex(/^[a-f0-9]{64}$/u), after: z5.string().regex(/^[a-f0-9]{64}$/u) }).strict();
+var deleteInput = z5.object({ id: z5.string().regex(/^[a-f0-9]{64}$/u) }).strict();
+var contextInput = z5.object({
+  client: z5.string().regex(/^[a-zA-Z0-9-]{1,80}$/u),
+  side: z5.enum(["left", "right"]),
+  generation: z5.number().int(),
+  context: z5.record(z5.string(), z5.unknown())
 }).strict();
 function createWorkbenchService(options) {
-  const directory = resolve10(options.cwd, captureRecordDirectory);
+  const directory = resolve11(options.cwd, captureRecordDirectory);
   const contexts = /* @__PURE__ */ new Map();
   let captureSession = options.captureSession;
   let pending;
@@ -7825,7 +8575,7 @@ function createWorkbenchService(options) {
           break;
         }
         if (!entry.isFile() || !/^[a-f0-9]{64}\.json$/u.test(entry.name)) continue;
-        const info = await stat(resolve10(directory, entry.name));
+        const info = await stat(resolve11(directory, entry.name));
         entries.push({ id: entry.name.slice(0, -5), modified: info.mtimeMs });
       }
     } catch (error) {
@@ -7836,15 +8586,15 @@ function createWorkbenchService(options) {
     const warnings = [];
     for (const entry of entries.slice(offset, offset + 20)) {
       try {
-        const record = await readCaptureRecord(entry.id, directory);
+        const record2 = await readCaptureRecord(entry.id, directory);
         records.push({
           id: entry.id,
-          scene: record.capture.scene,
-          map: record.capture.map,
-          theme: record.capture.theme,
-          definition: record.definition,
-          styleSha256: record.capture.styleSha256,
-          warnings: record.capture.warnings,
+          scene: record2.capture.scene,
+          map: record2.capture.map,
+          theme: record2.capture.theme,
+          definition: record2.definition,
+          styleSha256: record2.capture.styleSha256,
+          warnings: record2.capture.warnings,
           savedAt: new Date(entry.modified).toISOString(),
           imageUrl: `${prefix}/captures/${entry.id}.png`
         });
@@ -7918,9 +8668,9 @@ function createWorkbenchService(options) {
   }
   return {
     url: prefix,
-    async handle(request) {
-      const url = new URL(request.url);
-      if (url.origin !== options.origin || request.headers.has("origin") && request.headers.get("origin") !== options.origin || request.headers.get("sec-fetch-site") === "cross-site")
+    async handle(request2) {
+      const url = new URL(request2.url);
+      if (url.origin !== options.origin || request2.headers.has("origin") && request2.headers.get("origin") !== options.origin || request2.headers.get("sec-fetch-site") === "cross-site")
         return json(
           { code: "ORIGIN_MISMATCH", message: "Use Inspector from its local origin." },
           403
@@ -7928,7 +8678,7 @@ function createWorkbenchService(options) {
       if (closed) return json({ code: "SESSION_CLOSED", message: "Inspector has stopped." }, 503);
       const path = url.pathname.slice(prefix.length);
       try {
-        if (request.method === "GET") {
+        if (request2.method === "GET") {
           if (path === "" || path === "/")
             return json({
               capabilities: [
@@ -7964,13 +8714,13 @@ function createWorkbenchService(options) {
             });
           }
           if (path === "/captures") {
-            const offset = z4.coerce.number().int().min(0).max(5e3).parse(url.searchParams.get("offset") ?? 0);
+            const offset = z5.coerce.number().int().min(0).max(5e3).parse(url.searchParams.get("offset") ?? 0);
             return json(await history(offset));
           }
           const image = /^\/captures\/([a-f0-9]{64})\.png$/u.exec(path);
           if (image) {
-            const record = await readCaptureRecord(image[1], directory);
-            return new Response(Buffer.from(record.capture.png), {
+            const record2 = await readCaptureRecord(image[1], directory);
+            return new Response(Buffer.from(record2.capture.png), {
               headers: {
                 "Content-Type": "image/png",
                 "Cache-Control": "no-store",
@@ -7980,14 +8730,14 @@ function createWorkbenchService(options) {
           }
           return json({ code: "NOT_FOUND", message: "Unknown Inspector endpoint." }, 404);
         }
-        if (request.method !== "POST")
+        if (request2.method !== "POST")
           return json({ code: "METHOD_NOT_ALLOWED", message: "Use GET or POST." }, 405);
-        if (request.headers.get("x-tileflow-workbench") !== "1" || request.headers.get("content-type")?.split(";")[0] !== "application/json")
+        if (request2.headers.get("x-tileflow-workbench") !== "1" || request2.headers.get("content-type")?.split(";")[0] !== "application/json")
           return json(
             { code: "INVALID_REQUEST", message: "Send JSON with X-Tileflow-Workbench: 1." },
             400
           );
-        const body = await readBody(request);
+        const body = await readBody(request2);
         if (path === "/context") {
           const { client, ...value } = contextInput.parse(body);
           if (!options.sides[value.side]) throw new Error("Unknown Inspector side.");
@@ -8025,8 +8775,8 @@ function createWorkbenchService(options) {
     }
   };
 }
-async function readBody(request) {
-  const reader = request.body?.getReader();
+async function readBody(request2) {
+  const reader = request2.body?.getReader();
   if (!reader) throw new Error("Missing JSON body.");
   const chunks = [];
   let bytes = 0;
@@ -8100,11 +8850,11 @@ registerTilesetCommands(program, { defaultApiUrl, loadAuthConfig });
 registerIconSetCommands(program, { defaultApiUrl, loadAuthConfig });
 registerModelCommands(program, { defaultApiUrl, loadAuthConfig });
 program.command("init").description("Create a starter tileflow.config.ts").option("-f, --force", "overwrite an existing config").action(async (options) => {
-  const configPath = resolve11(process.cwd(), defaultConfigPath);
-  const ignorePath = resolve11(process.cwd(), ".gitignore");
+  const configPath = resolve12(process.cwd(), defaultConfigPath);
+  const ignorePath = resolve12(process.cwd(), ".gitignore");
   if (existsSync(configPath) && !options.force) {
     logWarning(`${pathLabel(defaultConfigPath)} already exists.`);
-    printNextSteps([`Run ${command("tileflow init --force")} to replace it.`]);
+    printNextSteps2([`Run ${command("tileflow init --force")} to replace it.`]);
     return;
   }
   await writeFile2(configPath, starterConfig(), "utf8");
@@ -8117,9 +8867,9 @@ program.command("init").description("Create a starter tileflow.config.ts").optio
   }
   logSuccess(`Created ${pathLabel(defaultConfigPath)}.`);
   printKeyValue("Path", pathLabel(configPath));
-  printKeyValue("Map", pc7.bold("madrid"));
-  printNextSteps([
-    `Install ${pc7.cyan("@tileflow/core")} and ${pc7.cyan("@tileflow/maps")} in this project if needed.`,
+  printKeyValue("Map", pc8.bold("madrid"));
+  printNextSteps2([
+    `Install ${pc8.cyan("@tileflow/core")} and ${pc8.cyan("@tileflow/maps")} in this project if needed.`,
     `Preview locally with ${command("tileflow preview")}.`,
     `Validate the config with ${command("tileflow validate")}.`
   ]);
@@ -8185,7 +8935,7 @@ program.command("whoami").description("Show the authenticated Tileflow account")
       return;
     }
     logError(message);
-    printNextSteps([`Run ${command("tileflow login")} to authorize this machine.`]);
+    printNextSteps2([`Run ${command("tileflow login")} to authorize this machine.`]);
     process.exitCode = 1;
     return;
   }
@@ -8245,7 +8995,7 @@ program.command("validate").description("Validate a Tileflow config").option("-c
         return;
       }
       logError(`Invalid validation target: ${options.target}`);
-      printNextSteps([
+      printNextSteps2([
         `Use ${command("tileflow validate --target local")} or ${command("tileflow validate --target hosted")}.`
       ]);
       process.exitCode = 1;
@@ -8398,7 +9148,7 @@ program.command("build").description("Generate static Tileflow styles").option("
       })
     );
     logSuccess("Built Tileflow artifacts.");
-    printKeyValue("Output", pathLabel(resolve11(process.cwd(), options.out)));
+    printKeyValue("Output", pathLabel(resolve12(process.cwd(), options.out)));
   }
 );
 program.command("preview").description("Open Inspector with inspection and optional comparison").option("-c, --config <path>", "config path", defaultConfigPath).option("--against-config <path>", "second config for live comparison in Inspector").option("--against-map <name>", "map on the right; defaults to --map").option("--against-scene <name>", "committed standalone scene on the right").option("--against-theme <name>", "concrete theme on the right; defaults to --theme").option("--host <host>", "bind host: an explicit IP address or localhost", defaultTileflowDevHost).option("--map <name>", "preview one configured map").option("--theme <name>", "preview one concrete theme; defaults to the map default").option("--renderer <renderer>", "artifact renderer: web or native", "web").option("-p, --port <port>", "preview port", "3333").option("--no-open", "start Inspector without opening the browser").option("--scene <name>", "preview one committed standalone map scene").option(
@@ -8631,7 +9381,7 @@ program.command("preview").description("Open Inspector with inspection and optio
         await new Promise((resolveListening, rejectListening) => {
           const createdServer = serve(
             {
-              fetch: (request) => (renderer === "web" ? redirectTileflowDevNavigation(request, origin) : void 0) ?? fetch2(request),
+              fetch: (request2) => (renderer === "web" ? redirectTileflowDevNavigation(request2, origin) : void 0) ?? fetch2(request2),
               hostname: host,
               port
             },
@@ -8716,7 +9466,7 @@ addMapSetupOptions(
       );
       if (result) {
         logSuccess(
-          `${result.changed ? "Published" : "Unchanged"} ${pc7.bold(result.mapName)} web + native-v1 (v${result.version}).`
+          `${result.changed ? "Published" : "Unchanged"} ${pc8.bold(result.mapName)} web + native-v1 (v${result.version}).`
         );
         printKeyValue("Manifest", pathLabel(result.manifestPath));
         printKeyValue("Native", link(result.nativeManifestUrl));
@@ -8791,7 +9541,7 @@ addMapSetupOptions(
     if (mapsWithHostedFontBundles.length > 0) {
       logError("Hosted deploy does not yet support package-owned web fonts.");
       printKeyValue("Maps", mapsWithHostedFontBundles.join(", "));
-      printNextSteps(["Use self-hosted delivery or an explicit public glyph provider."]);
+      printNextSteps2(["Use self-hosted delivery or an explicit public glyph provider."]);
       process.exitCode = 1;
       return;
     }
@@ -8866,8 +9616,8 @@ addMapSetupOptions(
     if (!options.mapId) {
       const deployedMapId2 = existingManifest?.maps[mapNames[0]]?.mapId;
       if (deployedMapId2) {
-        logError(`${pc7.bold(mapNames[0])} is already deployed to ${deployedMapId2}.`);
-        printNextSteps([
+        logError(`${pc8.bold(mapNames[0])} is already deployed to ${deployedMapId2}.`);
+        printNextSteps2([
           `Deploy it again with ${command(`tileflow deploy --map-id ${deployedMapId2}`)}.`
         ]);
         process.exitCode = 1;
@@ -8896,7 +9646,7 @@ addMapSetupOptions(
       );
       const action = uploaded.value.changed === false ? "Reused" : "Uploaded";
       logSuccess(
-        `${action} icon package ${pc7.bold(binding?.label ?? "Icons")} (${plural(iconPackage.manifest.iconNames.length, "icon")}, ${formatBytes4(totalBytes)}, ${iconPackage.contentHash.slice(0, 12)}).`
+        `${action} icon package ${pc8.bold(binding?.label ?? "Icons")} (${plural(iconPackage.manifest.iconNames.length, "icon")}, ${formatBytes4(totalBytes)}, ${iconPackage.contentHash.slice(0, 12)}).`
       );
       hostedSpriteByPackageHash.set(iconPackage.contentHash, uploaded.value.spriteUrl);
     }
@@ -9059,7 +9809,7 @@ addMapSetupOptions(
       }
       const themeNames = Object.keys(themeStyles).sort();
       logInfo(
-        `Deploying compiled map ${pc7.bold(mapName)} (${plural(themeNames.length, "theme")}).`
+        `Deploying compiled map ${pc8.bold(mapName)} (${plural(themeNames.length, "theme")}).`
       );
       const response = await publishHostedStyle(
         api,
@@ -9142,14 +9892,14 @@ addMapSetupOptions(
       };
       const versionLabel = Number.isInteger(body.version) ? ` (v${body.version})` : "";
       if (body.changed === false) {
-        logSuccess(`Unchanged ${pc7.bold(mapName)}${versionLabel}.`);
+        logSuccess(`Unchanged ${pc8.bold(mapName)}${versionLabel}.`);
       } else {
-        logSuccess(`Published ${pc7.bold(mapName)}${versionLabel}.`);
+        logSuccess(`Published ${pc8.bold(mapName)}${versionLabel}.`);
       }
       for (const teamModel of body.teamModels ?? []) {
         if (teamModel.sources !== "differ") continue;
         logWarning(
-          `3D model ${pc7.bold(teamModel.model)} draws its published version ${teamModel.version}, which was not prepared from this project's files. Run \`tileflow models publish\` to publish them.`
+          `3D model ${pc8.bold(teamModel.model)} draws its published version ${teamModel.version}, which was not prepared from this project's files. Run \`tileflow models publish\` to publish them.`
         );
       }
     }
@@ -9165,7 +9915,7 @@ addMapSetupOptions(
     printDeployedMaps(deployedMaps);
     const deployedMapId = Object.values(deployedMaps)[0]?.mapId;
     if (deployedMapId) {
-      printNextSteps([
+      printNextSteps2([
         ...createdMapId ? [`Deploy later changes with ${command(`tileflow deploy --map-id ${createdMapId}`)}.`] : [],
         `Check hosted state with ${command(`tileflow status --map-id ${deployedMapId}`)}.`
       ]);
@@ -9219,6 +9969,16 @@ program.command("status").description("Show deployed compiled styles").addOption
   }
   printMapStatus(status, api.apiUrl);
 });
+registerDeploymentCommands(program, {
+  resolveApi: (options, behavior) => {
+    const source = resolveDeploySource(process.env);
+    return requireApiOptions(options, {
+      ...behavior,
+      allowStoredCredential: allowsStoredDeployCredential(source),
+      assertExplicitKeyMap: true
+    });
+  }
+});
 var iconsCommand = program.command("icons").description("Inspect managed Tileflow icons");
 registerIconLockCommands(program, { defaultApiUrl, defaultConfigPath, loadAuthConfig });
 registerIconListCommand(iconsCommand, { defaultConfigPath });
@@ -9271,6 +10031,8 @@ registerMapCommands(program, { defaultApiUrl, loadAuthConfig });
 if (isRootCliVersionRequest(process.argv.slice(2))) {
   process.stdout.write(`${getCliVersion()}
 `);
+} else if (isRestoreJsonCommand(process.argv.slice(2))) {
+  await parseRestoreJson(program);
 } else {
   const structuredCommand = process.argv[2] ?? "tileflow";
   const structuredErrors = process.argv.includes("--json") && [
@@ -9284,14 +10046,7 @@ if (isRootCliVersionRequest(process.argv.slice(2))) {
     "semantic-diff",
     "language"
   ].includes(structuredCommand);
-  if (structuredErrors) {
-    const configureStructuredErrors = (command2) => {
-      command2.exitOverride().configureOutput({ writeErr: () => {
-      } });
-      for (const child of command2.commands) configureStructuredErrors(child);
-    };
-    configureStructuredErrors(program);
-  }
+  if (structuredErrors) configureJsonErrors(program);
   program.parseAsync().catch((error) => {
     if (structuredErrors) {
       if (typeof error === "object" && error !== null && "exitCode" in error && error.exitCode === 0)
@@ -9469,7 +10224,7 @@ async function runTileflowComparisonPreview(options, address) {
       await new Promise((resolveListening, rejectListening) => {
         const createdServer = serve(
           {
-            fetch: (request) => redirectTileflowDevNavigation(request, origin) ?? fetch2(request),
+            fetch: (request2) => redirectTileflowDevNavigation(request2, origin) ?? fetch2(request2),
             hostname: address.host,
             port: address.port
           },
@@ -9514,8 +10269,8 @@ async function runTileflowComparisonPreview(options, address) {
 }
 function comparisonCaptureConfigArgument(configPath) {
   const cwd = realpathSync(process.cwd());
-  const requestedConfigPath = resolve11(process.cwd(), configPath);
-  const defaultRequestedPath = resolve11(process.cwd(), defaultConfigPath);
+  const requestedConfigPath = resolve12(process.cwd(), configPath);
+  const defaultRequestedPath = resolve12(process.cwd(), defaultConfigPath);
   const absoluteConfigPath = existsSync(requestedConfigPath) ? realpathSync(requestedConfigPath) : requestedConfigPath;
   const absoluteDefaultPath = existsSync(defaultRequestedPath) ? realpathSync(defaultRequestedPath) : defaultRequestedPath;
   if (absoluteConfigPath === absoluteDefaultPath) return void 0;
@@ -9569,7 +10324,7 @@ async function loginWithDeviceFlow(options) {
     throw new Error("The dashboard returned an unexpected Tileflow API origin.");
   }
   const previousSession = authState.kind === "sessions" ? authState.config.sessions[apiUrl] : void 0;
-  printKeyValue("Code", pc7.bold(authorization.userCode));
+  printKeyValue("Code", pc8.bold(authorization.userCode));
   printKeyValue("URL", link(authorization.verificationUriComplete));
   if (options.noBrowser) {
     logMuted("Open the URL above to continue.");
@@ -9579,7 +10334,7 @@ async function loginWithDeviceFlow(options) {
       output: process.stdout
     });
     try {
-      await readline.question(`${pc7.cyan("?")} Press Enter to open Tileflow Dashboard...`);
+      await readline.question(`${pc8.cyan("?")} Press Enter to open Tileflow Dashboard...`);
       openBrowser(authorization.verificationUriComplete);
     } finally {
       readline.close();
@@ -9644,7 +10399,7 @@ function openBrowser(url, errorsToStderr = false) {
   });
 }
 async function writeDeployManifest(manifestPath, manifest) {
-  const outputPath = resolve11(process.cwd(), manifestPath);
+  const outputPath = resolve12(process.cwd(), manifestPath);
   await writeAtomicFile({
     boundaryPath: dirname12(outputPath),
     force: true,
@@ -9696,7 +10451,7 @@ function selectManagedDeployMaps(mapNames, options) {
     "This managed target requires an explicit map because the config contains multiple maps."
   );
   printKeyValue("Maps", mapNames.join(", "));
-  printNextSteps([
+  printNextSteps2([
     `Retry with ${command(`tileflow deploy ${options.mapId ? `--map-id ${options.mapId} ` : ""}--map ${mapNames[0]}`)}.`
   ]);
   process.exitCode = 1;
@@ -9705,7 +10460,7 @@ function selectManagedDeployMaps(mapNames, options) {
 function validateMapSetupTarget(options, source) {
   const fail = (message, steps = []) => {
     logError(message);
-    printNextSteps(steps);
+    printNextSteps2(steps);
     process.exitCode = 1;
     return false;
   };
@@ -9745,7 +10500,7 @@ function validateDeployManifestMapNames(mapNames) {
 async function loadExistingDeployManifest(manifestPath, options) {
   let source;
   try {
-    source = await readFile6(resolve11(process.cwd(), manifestPath), "utf8");
+    source = await readFile6(resolve12(process.cwd(), manifestPath), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw new Error("Existing Tileflow manifest could not be read.");
@@ -9777,64 +10532,59 @@ async function loadExistingDeployManifest(manifestPath, options) {
   return manifest;
 }
 async function requireApiOptions(options, behavior = {}) {
+  const refuse = (code, message, steps = []) => {
+    if (behavior.onFailure) behavior.onFailure(code, message);
+    else if (!behavior.silent) {
+      logError(message);
+      if (steps.length) printNextSteps2(steps);
+    }
+    process.exitCode = 1;
+    return null;
+  };
   const apiUrl = normalizeApiOrigin(options.apiUrl ?? defaultApiUrl);
   const requestedMapId = options.mapId;
   if (!requestedMapId || !/^map_[A-Za-z0-9_-]{16}$/u.test(requestedMapId)) {
-    if (!behavior.silent) logError("Managed Map ID is invalid.");
-    process.exitCode = 1;
-    return null;
+    return refuse("invalid_map_id", "Managed Map ID is invalid.");
   }
   if (options.apiKey !== void 0) {
     if (!isHostedApiKey(options.apiKey)) {
-      if (!behavior.silent) logError("Tileflow API key is invalid.");
-      process.exitCode = 1;
-      return null;
+      return refuse("invalid_api_key", "Tileflow API key is invalid.");
     }
     if (behavior.assertExplicitKeyMap) {
       const profile = await validateApiKey(apiUrl, options.apiKey);
       if (!profile.ok) {
-        if (!behavior.silent) logError(profile.error);
-        process.exitCode = 1;
-        return null;
+        return refuse("api_key_validation_failed", profile.error);
       }
       if (!apiProfileCanTargetMap(profile.value, requestedMapId)) {
-        if (!behavior.silent) logError("This API key belongs to another Map.");
-        process.exitCode = 1;
-        return null;
+        return refuse("api_key_map_mismatch", "This API key belongs to another Map.");
       }
     }
     return { apiKey: options.apiKey, apiUrl, mapId: requestedMapId };
   }
   const allowStoredCredential = behavior.allowStoredCredential !== false && allowsStoredDeployCredential(resolveDeploySource(process.env));
   if (!allowStoredCredential) {
-    if (!behavior.silent) {
-      logError("CI requires an explicit Tileflow credential with access to the target Map.");
-      printNextSteps([
-        `Set ${pc7.cyan("TILEFLOW_API_KEY")} from the CI secret store.`,
+    return refuse(
+      "api_key_required",
+      "CI requires an explicit Tileflow credential with access to the target Map.",
+      [
+        `Set ${pc8.cyan("TILEFLOW_API_KEY")} from the CI secret store.`,
         "The saved personal account session is never used in CI."
-      ]);
-    }
-    process.exitCode = 1;
-    return null;
+      ]
+    );
   }
   let config;
   try {
     config = await loadAuthConfig();
   } catch (error) {
-    if (!behavior.silent) logError(safeAuthError(error));
-    process.exitCode = 1;
-    return null;
+    return refuse("auth_state_unavailable", safeAuthError(error));
   }
   const resolvedSession = resolveAccountSession(config, apiUrl);
   if (resolvedSession.kind !== "selected") {
-    if (!behavior.silent) {
-      logError(
-        resolvedSession.kind === "expired" ? "The Tileflow account session has expired." : "No Tileflow account session is saved."
-      );
-      printNextSteps([`Run ${command("tileflow login")} to authorize this machine.`]);
-    }
-    process.exitCode = 1;
-    return null;
+    return refuse(
+      `account_session_${resolvedSession.kind}`,
+      resolvedSession.kind === "expired" ? "The Tileflow account session has expired." : "No Tileflow account session is saved.",
+      [`Run ${command("tileflow login")} to authorize this machine.`]
+    );
   }
   const capability = await requestMapCapability(
     resolvedSession.session,
@@ -9842,9 +10592,7 @@ async function requireApiOptions(options, behavior = {}) {
     behavior.capabilityScopes ?? ["status:read"]
   );
   if (!capability.ok) {
-    if (!behavior.silent) logError(capability.error);
-    process.exitCode = 1;
-    return null;
+    return refuse("map_capability_failed", capability.error);
   }
   return { apiKey: capability.capability, apiUrl, mapId: capability.mapId };
 }
@@ -9879,72 +10627,72 @@ function printCliError(error) {
   }
   const message = error instanceof Error ? error.message : "Command failed.";
   if (message.includes("Cannot find module '@tileflow/core'")) {
-    logError(`Cannot load ${pc7.cyan("@tileflow/core")} from this project.`);
-    printNextSteps([
-      `Install ${pc7.cyan("@tileflow/core")} in this project.`,
+    logError(`Cannot load ${pc8.cyan("@tileflow/core")} from this project.`);
+    printNextSteps2([
+      `Install ${pc8.cyan("@tileflow/core")} in this project.`,
       `Run the command again from the project root.`
     ]);
     return;
   }
   if (message.includes("Cannot find module '@tileflow/maps'")) {
-    logError(`Cannot load ${pc7.cyan("@tileflow/maps")} from this project.`);
-    printNextSteps([
-      `Install ${pc7.cyan("@tileflow/maps")} in this project.`,
+    logError(`Cannot load ${pc8.cyan("@tileflow/maps")} from this project.`);
+    printNextSteps2([
+      `Install ${pc8.cyan("@tileflow/maps")} in this project.`,
       `Run the command again from the project root.`
     ]);
     return;
   }
   logError(message.split("\n")[0] ?? message);
   if (message.includes(defaultConfigPath) || message.includes("config")) {
-    printNextSteps([`Run ${command("tileflow validate")} to check the config.`]);
+    printNextSteps2([`Run ${command("tileflow validate")} to check the config.`]);
   }
 }
 function logSuccess(message) {
-  console.log(`${pc7.green("\u2713")} ${message}`);
+  console.log(`${pc8.green("\u2713")} ${message}`);
 }
 function logError(message) {
-  console.log(`${pc7.red("\u2715")} ${message}`);
+  console.log(`${pc8.red("\u2715")} ${message}`);
 }
 function logWarning(message) {
-  console.log(`${pc7.yellow("!")} ${message}`);
+  console.log(`${pc8.yellow("!")} ${message}`);
 }
 function logInfo(message) {
-  console.log(`${pc7.cyan("i")} ${message}`);
+  console.log(`${pc8.cyan("i")} ${message}`);
 }
 function logMuted(message) {
-  console.log(pc7.gray(message));
+  console.log(pc8.gray(message));
 }
 function printTitle(title, subtitle) {
-  console.log(pc7.bold(title));
+  console.log(pc8.bold(title));
   if (subtitle) {
-    console.log(pc7.gray(subtitle));
+    console.log(pc8.gray(subtitle));
   }
 }
 function printKeyValue(label, value) {
-  console.log(`${pc7.gray(`${label}:`.padEnd(13))} ${value}`);
+  console.log(`${pc8.gray(`${label}:`.padEnd(13))} ${value}`);
 }
 function printChecks(items) {
   for (const item of items) {
-    console.log(`  ${pc7.green("\u2713")} ${item}`);
+    console.log(`  ${pc8.green("\u2713")} ${item}`);
   }
 }
-function printNextSteps(steps) {
+function printNextSteps2(steps) {
   if (steps.length === 0) return;
   console.log(`
-${pc7.bold("Next steps")}`);
+${pc8.bold("Next steps")}`);
   for (const step of steps) {
-    console.log(`  ${pc7.cyan("\u2022")} ${step}`);
+    console.log(`  ${pc8.cyan("\u2022")} ${step}`);
   }
 }
 function printValidationErrors(messages) {
   logError("Tileflow config has errors.");
   for (const message of messages) {
-    const path = message.path ? pc7.cyan(message.path) : pc7.cyan("(root)");
-    console.log(`  ${pc7.red("\u2715")} ${path} ${pc7.gray("-")} ${message.message}`);
+    const path = message.path ? pc8.cyan(message.path) : pc8.cyan("(root)");
+    console.log(`  ${pc8.red("\u2715")} ${path} ${pc8.gray("-")} ${message.message}`);
   }
 }
 function printAccountDetails(session) {
-  printKeyValue("Account", pc7.bold(session.account.name));
+  printKeyValue("Account", pc8.bold(session.account.name));
   printKeyValue("Email", session.account.email);
   printKeyValue("API", link(session.apiOrigin));
   printKeyValue("Expires", formatDate(session.expiresAt));
@@ -9973,11 +10721,11 @@ function printDeployedMaps(maps) {
   const entries = Object.entries(maps);
   if (entries.length === 0) return;
   console.log(`
-${pc7.bold("Maps")}`);
+${pc8.bold("Maps")}`);
   for (const [name, map] of entries) {
     for (const [themeName, theme] of Object.entries(map.themes)) {
       const label = `${name}/${themeName}`;
-      console.log(`  ${pc7.green("\u2713")} ${label.padEnd(24)} ${link(theme.styleUrl)}`);
+      console.log(`  ${pc8.green("\u2713")} ${label.padEnd(24)} ${link(theme.styleUrl)}`);
     }
   }
 }
@@ -9995,13 +10743,13 @@ function plural(count, singular, pluralForm = `${singular}s`) {
   return `${count} ${count === 1 ? singular : pluralForm}`;
 }
 function command(value) {
-  return pc7.cyan(value);
+  return pc8.cyan(value);
 }
 function link(value) {
-  return pc7.cyan(value);
+  return pc8.cyan(value);
 }
 function pathLabel(value) {
-  return pc7.cyan(value);
+  return pc8.cyan(value);
 }
 function starterConfig() {
   return `import { defineMap, defineTheme, labels, poi } from "@tileflow/core";
@@ -10047,15 +10795,15 @@ function printHostedCompatibilityIssues(issues) {
 }
 function printMapStatus(status, apiUrl) {
   printTitle("Tileflow status");
-  printKeyValue("Map", pc7.bold(status.mapId));
+  printKeyValue("Map", pc8.bold(status.mapId));
   console.log(`
-${pc7.bold("Styles")}`);
+${pc8.bold("Styles")}`);
   if (status.styles.length === 0) {
     logMuted("  No styles deployed.");
   }
   for (const style of status.styles) {
     console.log(
-      `  ${pc7.green("\u2713")} ${style.environment.padEnd(16)} ${link(`${apiUrl}/maps/${style.mapId}/style.json`).padEnd(36)} ${formatBytes4(style.size).padStart(10)}  ${pc7.gray(formatDate(style.uploaded))}`
+      `  ${pc8.green("\u2713")} ${style.environment.padEnd(16)} ${link(`${apiUrl}/maps/${style.mapId}/style.json`).padEnd(36)} ${formatBytes4(style.size).padStart(10)}  ${pc8.gray(formatDate(style.uploaded))}`
     );
   }
 }