wirl 0.2.0 → 0.2.2

package/bin.js

@@ -15,10 +15,14 @@ var __export = (target, all) => {
 };
 
 // packages/core/src/types.ts
-var AppKind;
+var AppRole, AppKind;
 var init_types = __esm({
   "packages/core/src/types.ts"() {
     "use strict";
+    AppRole = {
+      VIEWER: "viewer",
+      EDITOR: "editor"
+    };
     AppKind = {
       STATIC: "static",
       SERVICE: "service",
@@ -189,9 +193,33 @@ function validateSlug(input) {
 function isWellFormedSlug(input) {
   return typeof input === "string" && input.length >= SLUG_MIN && input.length <= SLUG_MAX && SLUG_RE.test(input) && !input.includes(HOST_SEPARATOR);
 }
-function slugify(input) {
-  const base = input.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, SLUG_MAX).replace(/-$/, "");
-  return isValidSlug(base) ? base : null;
+function slugBase(input) {
+  return input.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, SLUG_MAX).replace(/-$/, "");
+}
+function previewSlugFor(raw) {
+  const base = slugBase(raw);
+  switch (validateSlug(base).problem) {
+    case void 0:
+      return { ok: true, slug: base };
+    case "reserved":
+      return {
+        ok: false,
+        problem: "reserved",
+        message: `The preview name "${base}" is reserved. The reserved preview names are: ${[...RESERVED_SLUGS].sort().join(", ")}. Pick another name.`
+      };
+    case "too_short":
+      return {
+        ok: false,
+        problem: "too_short",
+        message: `That name is too short: it makes a preview name of one character, and a preview name needs at least ${String(SLUG_MIN)}.`
+      };
+    default:
+      return {
+        ok: false,
+        problem: "no_characters",
+        message: "That name has no usable characters: a preview name is made of the letters a to z and the digits 0 to 9 in what you give it, and none are left."
+      };
+  }
 }
 function appLabel(orgSlug, appSlug) {
   return `${orgSlug}${HOST_SEPARATOR}${appSlug}`;
@@ -384,13 +412,14 @@ async function readSigned(key, token) {
   }
   return { ok: true, claims };
 }
-var encoder, decoder2, PREFIX, SKEW_SECONDS;
+var encoder, decoder2, PREFIX, GRANT_TTL_DEFAULT_SECONDS, SKEW_SECONDS;
 var init_token = __esm({
   "packages/core/src/token.ts"() {
     "use strict";
     encoder = new TextEncoder();
     decoder2 = new TextDecoder();
     PREFIX = "w1";
+    GRANT_TTL_DEFAULT_SECONDS = 12 * 60;
     SKEW_SECONDS = 60;
   }
 });
@@ -569,10 +598,19 @@ var init_egress = __esm({
     PinnedFetchError = class extends Error {
       reason;
       host;
-      constructor(reason, host, message) {
+      /**
+       * Set only on a timeout that ended an answer already under way, whose body
+       * the fetch bounds itself (the broker's streams): which bound it was, the
+       * time since the headers or the time with nothing moving, and its length in
+       * milliseconds. The broker reads it to say what it cut a stream for.
+       * Undefined on every other failure.
+       */
+      streamBound;
+      constructor(reason, host, message, streamBound) {
         super(message);
         this.reason = reason;
         this.host = host;
+        this.streamBound = streamBound;
       }
     };
     PRIVATE_V4 = /^(0\.|10\.|127\.|169\.254\.|192\.0\.0\.|192\.168\.|198\.1[89]\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|(22[4-9]|23[0-9]|24[0-9]|25[0-5])\.)/;
@@ -2301,6 +2339,9 @@ var init_migrations = __esm({
       leaseMs: 6e5,
       orgApplies: 2,
       // per org: the limit one tenant's applies meet
+      // Per app, its live database and its previews' together, inside the org's
+      // two, so one app's deployers can never take both (OIM-927).
+      appApplies: 1,
       // Per control-plane process. The lease holds no pooled connection, so this
       // bounds the process's work, not its pool; at `orgApplies` two each,
       // filling it takes eight orgs (T5b-6).
@@ -3299,12 +3340,50 @@ var init_runtime = __esm({
 });
 
 // packages/core/src/broker-stream.ts
+function mediaTypeOf(headers) {
+  const declared = headers.get("content-type");
+  if (declared === null) return null;
+  return (declared.split(";")[0] ?? "").trim().toLowerCase();
+}
 function isStreamedAnswer(status, headers) {
   if (status < 200 || status > 299) return false;
-  const declared = headers.get("content-type");
-  if (declared === null) return false;
-  const media = (declared.split(";")[0] ?? "").trim().toLowerCase();
-  return STREAMED_MEDIA_TYPES.includes(media);
+  const media = mediaTypeOf(headers);
+  return media !== null && STREAMED_MEDIA_TYPES.includes(media);
+}
+function isEventStream(headers) {
+  return mediaTypeOf(headers) === "text/event-stream";
+}
+function closesWithEvent(headers) {
+  if (!isEventStream(headers)) return false;
+  const encoding = headers.get("content-encoding");
+  return encoding === null || encoding.trim().toLowerCase() === "identity";
+}
+function lengthOf(ms) {
+  const unit = (count, name) => `${count} ${name}${count === 1 ? "" : "s"}`;
+  if (ms % 6e4 === 0) return unit(ms / 6e4, "minute");
+  if (ms % 1e3 === 0) return unit(ms / 1e3, "second");
+  return `${ms} ms`;
+}
+function sayCut(cut2) {
+  switch (cut2.cause) {
+    case "size":
+      return `it reached wirl's limit of ${cut2.bytes % MIB === 0 ? `${cut2.bytes / MIB} MiB` : `${cut2.bytes} bytes`} for one answer.`;
+    case "time":
+      return `it was still open ${lengthOf(cut2.ms)} after the vendor began answering, the longest wirl allows.`;
+    case "idle":
+      return `nothing moved on it for ${lengthOf(cut2.ms)}, the longest wirl allows.`;
+    case "held":
+      return `it was still open ${lengthOf(cut2.ms)} after wirl began passing it on, the longest wirl allows.`;
+  }
+}
+function streamCutEvent(cut2) {
+  const data = JSON.stringify({ type: "error", error: { type: "api_error", message: `wirl cut this stream: ${sayCut(cut2)}` } });
+  return new TextEncoder().encode(`
+
+event: error
+data: ${data}
+
+`);
 }
 function createStreamSlots(perApp = BROKER_LIMITS.openStreamsPerApp) {
   const held = /* @__PURE__ */ new Map();
@@ -3329,7 +3408,7 @@ function createStreamSlots(perApp = BROKER_LIMITS.openStreamsPerApp) {
     }
   };
 }
-var BROKER_LIMITS, STREAMED_MEDIA_TYPES;
+var BROKER_LIMITS, STREAMED_MEDIA_TYPES, CUT_EVENT_RESERVE_BYTES, MIB;
 var init_broker_stream = __esm({
   "packages/core/src/broker-stream.ts"() {
     "use strict";
@@ -3346,20 +3425,369 @@ var init_broker_stream = __esm({
       streamIdleMs: 4 * 6e4,
       /** Bytes in any one answer, streamed or read whole. */
       answerBytes: 25 * 1024 * 1024,
+      /**
+       * Bytes in the body of any one call an app makes. The body is read whole
+       * before the call is sent, and before its grant is looked up, so a body
+       * past this never opens a key and never reaches a vendor (OIM-931).
+       * 100 MiB: Cloudflare publishes 100 MB as the request body its Free and
+       * Pro plans take, and a deployed app's call is first held whole by the
+       * egress Worker, in an isolate Cloudflare gives 128 MB of memory. Nothing
+       * else bounds a caller that holds a broker token and reaches the control
+       * plane itself: Railway sets no size on a body, only five minutes to send it.
+       */
+      requestBytes: 100 * 1024 * 1024,
+      /**
+       * Bytes of call bodies one app's calls hold at once, its previews' with
+       * them (OIM-951): counted as each chunk arrives, from a call's first byte
+       * until the broker has answered it (broker-bodies.ts). At least
+       * `requestBytes`, so one call at the cap always fits an app that holds
+       * nothing else; a quarter of `heldBodyBytes`, so four apps of four owners
+       * at their share fill the whole (one owner's apps cannot: `ownerHeldBodyBytes`).
+       */
+      appHeldBodyBytes: 128 * 1024 * 1024,
+      /**
+       * Bytes of call bodies the calls of every app one owner has hold at once,
+       * their previews' with them (OIM-967): the person `apps.owner_user_id`
+       * names, whichever organisations their apps are in. Apps and
+       * organisations cost nothing to create (no cap on either), so a share per
+       * app let one person with four apps fill the whole, and one per
+       * organisation would let them do it with four organisations; a person
+       * costs a sign-in. Two apps at their share, so one app that runs
+       * away still leaves its owner's other apps room, and half of
+       * `heldBodyBytes`, so one owner can never take more than half, and a
+       * second sign-in is what it takes to fill it. At least `requestBytes`, so
+       * one call at the cap always fits an owner whose apps hold nothing else.
+       */
+      ownerHeldBodyBytes: 256 * 1024 * 1024,
+      /**
+       * Bytes of call bodies every app's calls hold at once, in this process.
+       * A call's reader starts at 16 KiB and doubles its buffer as the body
+       * arrives, so the buffers behind this hold at most twice it, 1 GiB, and
+       * 16 KiB a call beside (the ruling in OIM-951).
+       */
+      heldBodyBytes: 512 * 1024 * 1024,
+      /** The `Retry-After` of a call refused for either. */
+      heldBodyRetryAfterSeconds: 10,
+      /**
+       * How long a call's body may send nothing before its read is stopped:
+       * an upload's (OIM-935). A deployed app's body comes from the egress
+       * Worker, which holds it whole before it sends it, and `wirl dev` reads it
+       * whole first, so no ordinary sender ever pauses (fix round 1, R1-F2).
+       */
+      heldBodyStallMs: 3e4,
+      /**
+       * How long a call's body may take to arrive whole: 100 MiB in 120 seconds
+       * is about 7 Mbit/s, which a body between Cloudflare and the control plane
+       * passes many times over, and well under Node's 300 seconds a request,
+       * after which the body would be cut anyway (fix round 1, R1-F2).
+       */
+      heldBodyArrivalMs: 12e4,
+      /**
+       * Bytes of answers read whole that one app's calls hold at once, its
+       * previews' with them (OIM-966): counted as each chunk arrives from the
+       * vendor, from an answer's first byte until wirl's server has taken the
+       * last of it, or the app has gone (broker-bodies.ts). A vendor's event
+       * stream is not counted: it is passed on as the app reads it, and holds
+       * about 285 to 441 KiB at a time, measured end to end through the control
+       * plane's server (`passOn` in broker.ts; OIM-966 fix round 1, R1-F3,
+       * R2-F2). More than two `answerBytes`, so two answers at the cap fit an
+       * app that holds nothing else; a quarter of `heldAnswerBytes`, so four apps
+       * of four owners at their share fill the whole (one owner's apps cannot:
+       * `ownerHeldAnswerBytes`).
+       */
+      appHeldAnswerBytes: 64 * 1024 * 1024,
+      /**
+       * Bytes of answers read whole that the calls of every app one owner has
+       * hold at once, their previews' with them (OIM-967), for the reasons
+       * `ownerHeldBodyBytes` gives: two apps at their share, half of
+       * `heldAnswerBytes`, and more than two `answerBytes` and than the room a
+       * call needs, so an owner whose apps hold nothing else can always send.
+       */
+      ownerHeldAnswerBytes: 128 * 1024 * 1024,
+      /**
+       * Bytes of answers read whole that every app's calls hold at once, in this
+       * process. An answer's reader doubles its buffer as it fills, as a body's
+       * does, and never past `answerBytes`, so while answers arrive the buffers
+       * behind this hold at most twice it, 512 MiB, and 16 KiB an answer beside;
+       * an answer read whole is copied to exactly its size before it is handed
+       * on, so from then its count is its memory (the ruling in OIM-966, and its
+       * fix round 1, R1-F2).
+       */
+      heldAnswerBytes: 256 * 1024 * 1024,
+      /**
+       * The room an app's share of answers, and the whole, must each have left
+       * for a call to be sent at all: one answer at the cap. With less, the call
+       * is refused with a 503 before it leaves wirl, rather than run at its
+       * vendor and its answer cut (OIM-966 fix round 1, R1-F1).
+       */
+      heldAnswerRoomBytes: 25 * 1024 * 1024,
+      /** The `Retry-After` of a call refused for that room, before it was sent. */
+      heldAnswerRetryAfterSeconds: 10,
+      /**
+       * How long an answer read whole may wait for wirl's server to take the
+       * last of it once it is handed back: past this it is cut, and its count
+       * goes back, so no app holds its share, or the whole, by not reading.
+       * Under Cloudflare's measured 125 seconds with nothing moving, which ends
+       * a deployed app's unread answer anyway (OIM-966 fix round 1, R1-F1).
+       */
+      heldAnswerHandOutMs: 12e4,
       /**
        * Streamed answers one app may have open at once. Each holds a vendor
        * socket and an inbound connection on one control-plane instance for up
        * to fourteen minutes, so one app cannot be allowed an unbounded number.
        * Counted in memory, per instance, like the control plane's other limits.
        */
-      openStreamsPerApp: 20
+      openStreamsPerApp: 20,
+      /**
+       * How long an event stream wirl cut waits for its closing event to leave
+       * the server before it ends the stream with its error anyway (OIM-837 fix
+       * round 1). The event is on its way when the server's queue of what it has
+       * to write has emptied; a reader that is slow but reading empties a full
+       * kernel buffer, a few hundred kilobytes, well inside this. Past it the
+       * reader is not reading, and the stream ends as it always did; the write
+       * stall that holds a connection longer than this is OIM-968's.
+       */
+      cutEventSentMs: 5e3
     };
     STREAMED_MEDIA_TYPES = Object.freeze(["text/event-stream", "application/x-ndjson"]);
+    CUT_EVENT_RESERVE_BYTES = 512;
+    MIB = 1024 * 1024;
+  }
+});
+
+// packages/core/src/refusals.ts
+function sayAtMostEvery(log, now, everyMs = SAY_EVERY_MS) {
+  let since = 0;
+  let saidAt = Number.NEGATIVE_INFINITY;
+  return (line) => {
+    since += 1;
+    const at2 = now();
+    if (at2 - saidAt < everyMs) return;
+    const text = line(since, at2);
+    since = 0;
+    saidAt = at2;
+    try {
+      log(text);
+    } catch {
+    }
+  };
+}
+var SAY_EVERY_MS, MiB, sizeOf;
+var init_refusals = __esm({
+  "packages/core/src/refusals.ts"() {
+    "use strict";
+    SAY_EVERY_MS = 3e4;
+    MiB = 1024 * 1024;
+    sizeOf = (bytes) => bytes >= MiB ? `${String(Math.floor(bytes / MiB))} MiB` : `${String(Math.ceil(bytes / 1024))} KiB`;
+  }
+});
+
+// packages/core/src/wait-clock.ts
+var systemWaitClock;
+var init_wait_clock = __esm({
+  "packages/core/src/wait-clock.ts"() {
+    "use strict";
+    systemWaitClock = {
+      wait(ms) {
+        let timer;
+        const done = new Promise((resolve7) => {
+          timer = setTimeout(resolve7, ms);
+          timer.unref?.();
+        });
+        return { done, cancel: () => clearTimeout(timer) };
+      }
+    };
+  }
+});
+
+// packages/core/src/broker-bodies.ts
+function heldBodyRefusal(limits, why) {
+  const again = `Send it again in ${String(limits.heldBodyRetryAfterSeconds)} seconds.`;
+  if (why === "app") {
+    return {
+      error: "app_bodies_full",
+      message: `This call's body would take the bodies this app's calls hold at once past ${sizeOf(limits.appHeldBodyBytes)}, the most one app's calls may hold, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_bodies_full",
+      message: `This call's body would take the bodies held at once for the calls of all the apps this app's owner has past ${sizeOf(limits.ownerHeldBodyBytes)}, the most one owner's apps may hold together, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+    };
+  }
+  return {
+    error: "bodies_full",
+    message: `This call's body would take the bodies wirl holds for all apps' calls at once past ${sizeOf(limits.heldBodyBytes)}, the most it holds, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+  };
+}
+function heldBodyCut(limits, why) {
+  if (why === "stalled") {
+    return {
+      error: "body_stalled",
+      message: `Nothing of this call's body arrived for ${String(limits.heldBodyStallMs / 1e3)} seconds, so wirl stopped the call there and sent nothing to the vendor. Send it again.`
+    };
+  }
+  return {
+    error: "body_too_slow",
+    message: `This call's body had not all arrived after ${String(limits.heldBodyArrivalMs / 1e3)} seconds, the longest wirl waits for one, so wirl stopped the call there and sent nothing to the vendor. Send it again.`
+  };
+}
+function heldAnswerRefusal(limits, why) {
+  const acted = "The vendor may have acted on the call: send it again only if repeating it is safe.";
+  if (why === "app") {
+    return {
+      error: "app_answers_full",
+      message: `The vendor received this call and answered it, but its answer would take the answers this app's calls hold at once past ${sizeOf(limits.appHeldAnswerBytes)}, the most one app's calls may hold, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_answers_full",
+      message: `The vendor received this call and answered it, but its answer would take the answers held at once for the calls of all the apps this app's owner has past ${sizeOf(limits.ownerHeldAnswerBytes)}, the most one owner's apps may hold together, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+    };
+  }
+  return {
+    error: "answers_full",
+    message: `The vendor received this call and answered it, but its answer would take the answers wirl holds for all apps' calls at once past ${sizeOf(limits.heldAnswerBytes)}, the most it holds, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+  };
+}
+function heldAnswerNoRoom(limits, why) {
+  const again = `Send it again in ${String(limits.heldAnswerRetryAfterSeconds)} seconds.`;
+  if (why === "app") {
+    return {
+      error: "app_no_answer_room",
+      message: `The answers this app's calls hold at once leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.appHeldAnswerBytes)} one app's calls may hold, the room wirl keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_no_answer_room",
+      message: `The answers held at once for the calls of all the apps this app's owner has leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.ownerHeldAnswerBytes)} one owner's apps may hold together, the room wirl keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+    };
+  }
+  return {
+    error: "no_answer_room",
+    message: `The answers wirl holds for all apps' calls at once leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.heldAnswerBytes)} it holds, the room it keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+  };
+}
+function createHeldBodies(options = {}) {
+  const limits = options.limits ?? {
+    appHeldBodyBytes: BROKER_LIMITS.appHeldBodyBytes,
+    ownerHeldBodyBytes: BROKER_LIMITS.ownerHeldBodyBytes,
+    heldBodyBytes: BROKER_LIMITS.heldBodyBytes,
+    heldBodyRetryAfterSeconds: BROKER_LIMITS.heldBodyRetryAfterSeconds,
+    heldBodyStallMs: BROKER_LIMITS.heldBodyStallMs,
+    heldBodyArrivalMs: BROKER_LIMITS.heldBodyArrivalMs
+  };
+  return {
+    limits,
+    clock: options.clock ?? systemWaitClock,
+    ...countHeld("bodies", limits.appHeldBodyBytes, limits.ownerHeldBodyBytes, limits.heldBodyBytes, options)
+  };
+}
+function createHeldAnswers(options = {}) {
+  const limits = options.limits ?? {
+    appHeldAnswerBytes: BROKER_LIMITS.appHeldAnswerBytes,
+    ownerHeldAnswerBytes: BROKER_LIMITS.ownerHeldAnswerBytes,
+    heldAnswerBytes: BROKER_LIMITS.heldAnswerBytes,
+    heldAnswerRoomBytes: BROKER_LIMITS.heldAnswerRoomBytes,
+    heldAnswerRetryAfterSeconds: BROKER_LIMITS.heldAnswerRetryAfterSeconds,
+    heldAnswerHandOutMs: BROKER_LIMITS.heldAnswerHandOutMs
+  };
+  const { short, ...count } = countHeld("answers", limits.appHeldAnswerBytes, limits.ownerHeldAnswerBytes, limits.heldAnswerBytes, options);
+  return {
+    limits,
+    clock: options.clock ?? systemWaitClock,
+    ...count,
+    roomFor: (appId, ownerId) => short(appId, ownerId, limits.heldAnswerRoomBytes)
+  };
+}
+function countHeld(what, appBytes, ownerBytes, allBytes, options) {
+  const say = options.log === void 0 ? null : sayAtMostEvery(options.log, options.now ?? Date.now);
+  const byApp = /* @__PURE__ */ new Map();
+  const byOwner = /* @__PURE__ */ new Map();
+  let total = 0;
+  const named = (owner) => typeof owner === "string" && owner.length > 0 ? owner : null;
+  const bump = (table, key, bytes) => {
+    const next = (table.get(key) ?? 0) + bytes;
+    if (next === 0) table.delete(key);
+    else table.set(key, next);
+  };
+  const add = (appId, ownerId, bytes) => {
+    bump(byApp, appId, bytes);
+    if (ownerId !== null) bump(byOwner, ownerId, bytes);
+    total += bytes;
+  };
+  const passes = (appId, ownerId, bytes) => (byApp.get(appId) ?? 0) + bytes > appBytes ? "app" : ownerId !== null && (byOwner.get(ownerId) ?? 0) + bytes > ownerBytes ? "owner" : total + bytes > allBytes ? "all" : null;
+  const refused2 = (why, appId, ownerId) => {
+    say?.((since) => {
+      let most = ["nobody", 0];
+      for (const entry of byApp) if (entry[1] > most[1]) most = entry;
+      const who = why === "owner" && ownerId !== null ? `, owned by ${ownerId} (whose apps hold ${String(byOwner.get(ownerId) ?? 0)} bytes; ${String(byOwner.size)} ${byOwner.size === 1 ? "owner holds" : "owners hold"} any)` : "";
+      return `wirl: refused ${String(since)} ${since === 1 ? "broker call" : "broker calls"} for the ${what} held at once since this line was last written (at most once every 30 seconds), the latest for ${why === "app" ? "its app's share" : why === "owner" ? "its owner's share" : "the whole"}, from ${appId}${who}; ${String(total)} of ${String(allBytes)} bytes held, by ${String(byApp.size)} ${byApp.size === 1 ? "app" : "apps"}, the most by ${most[0]} (${String(most[1])} bytes)`;
+    });
+  };
+  return {
+    open(appId, owner) {
+      const ownerId = named(owner);
+      let counted = 0;
+      let refusal = null;
+      let done = false;
+      return {
+        arrive(bytes) {
+          if (done || !isSize(bytes)) return false;
+          const why = passes(appId, ownerId, bytes);
+          if (why !== null) {
+            refusal = why;
+            refused2(why, appId, ownerId);
+            return false;
+          }
+          if (bytes > 0) add(appId, ownerId, bytes);
+          counted += bytes;
+          return true;
+        },
+        refusal: () => refusal,
+        release() {
+          if (done) return;
+          done = true;
+          if (counted > 0) add(appId, ownerId, -counted);
+          counted = 0;
+        }
+      };
+    },
+    held: () => total,
+    heldBy: (appId) => byApp.get(appId) ?? 0,
+    heldByOwner: (ownerId) => byOwner.get(ownerId) ?? 0,
+    short(appId, owner, bytes) {
+      const ownerId = named(owner);
+      const why = passes(appId, ownerId, bytes);
+      if (why !== null) refused2(why, appId, ownerId);
+      return why;
+    }
+  };
+}
+var isSize;
+var init_broker_bodies = __esm({
+  "packages/core/src/broker-bodies.ts"() {
+    "use strict";
+    init_broker_stream();
+    init_refusals();
+    init_wait_clock();
+    isSize = (bytes) => Number.isSafeInteger(bytes) && bytes >= 0;
   }
 });
 
 // packages/core/src/broker.ts
 async function handleBrokerRequest(request, deps) {
+  const holding = { body: null, answer: null };
+  try {
+    return await brokerCall(request, deps, holding);
+  } finally {
+    holding.body?.release();
+    holding.answer?.release();
+  }
+}
+async function brokerCall(request, deps, holding) {
   const url = new URL(request.url);
   const clock = deps.now ? { now: deps.now() } : {};
   const bearer = readBearer(request);
@@ -3404,6 +3832,55 @@ async function handleBrokerRequest(request, deps) {
       origin
     });
   };
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const bodyLimit = deps.maxRequestBytes ?? BROKER_LIMITS.requestBytes;
+  const bodyDeclared = hasBody ? declaredLength(request.headers) : null;
+  const declaredTooLarge = bodyDeclared !== null && bodyDeclared > bodyLimit;
+  const ownerId = request.method === "HEAD" || declaredTooLarge ? null : await ownerOfApp(deps, appId);
+  let requestBody = null;
+  if (hasBody) {
+    const budget = deps.heldBodies;
+    const held = budget?.open(appId, ownerId) ?? null;
+    holding.body = held;
+    const bodyRead = declaredTooLarge ? { outcome: "too_large" } : await readWithin(
+      request.body,
+      bodyLimit,
+      budget === void 0 || held === null ? void 0 : {
+        arrive: (bytes) => held.arrive(bytes),
+        time: { clock: budget.clock, stallMs: budget.limits.heldBodyStallMs, arrivalMs: budget.limits.heldBodyArrivalMs }
+      }
+    );
+    if (bodyRead.outcome !== "ok") {
+      const named = route.slug === RESOLVE_BY_HOST ? request.headers.get("x-wirl-target") : null;
+      if (route.slug === RESOLVE_BY_HOST) slug = "";
+      if (named) path = egressAuditPath(named);
+      const host2 = named ? safeHost(named) : "";
+      held?.release();
+      if (bodyRead.outcome === "too_large") {
+        await record("body_too_large", 413, host2);
+        return refuse2(
+          413,
+          "body_too_large",
+          `This call's body is more than ${bodyLimit} bytes, the most a call may send, so wirl sent nothing.`
+        );
+      }
+      if (bodyRead.outcome === "full") {
+        const limits = budget?.limits ?? BROKER_LIMITS;
+        const refusal = heldBodyRefusal(limits, held?.refusal() ?? "all");
+        await record(refusal.error, 503, host2);
+        return refuse2(503, refusal.error, refusal.message, { "retry-after": String(limits.heldBodyRetryAfterSeconds) });
+      }
+      if (bodyRead.outcome === "stalled" || bodyRead.outcome === "slow") {
+        const cut2 = heldBodyCut(budget?.limits ?? BROKER_LIMITS, bodyRead.outcome);
+        await record(cut2.error, 408, host2);
+        return refuse2(408, cut2.error, cut2.message);
+      }
+      if (request.signal.aborted) return callerLeft(record, host2);
+      await record("upstream_error", 502, host2);
+      return refuse2(502, "upstream_error", bodyRead.error instanceof Error ? bodyRead.error.message : String(bodyRead.error));
+    }
+    requestBody = bodyRead.bytes;
+  }
   const connections = await deps.connectionsFor(appId, deploymentId);
   let connection;
   if (route.slug === RESOLVE_BY_HOST) {
@@ -3492,11 +3969,18 @@ async function handleBrokerRequest(request, deps) {
     headers.set(name, value);
   });
   attachCredential(headers, connection);
+  const answers = deps.heldAnswers;
+  if (answers !== void 0 && request.method !== "HEAD") {
+    const short = answers.roomFor(appId, ownerId);
+    if (short !== null) {
+      const noRoom = heldAnswerNoRoom(answers.limits, short);
+      await record(noRoom.error, 503, host);
+      return refuse2(503, noRoom.error, noRoom.message, { "retry-after": String(answers.limits.heldAnswerRetryAfterSeconds) });
+    }
+  }
   const doFetch = deps.fetchImpl ?? fetch;
-  const hasBody = request.method !== "GET" && request.method !== "HEAD";
   let upstream;
   try {
-    const requestBody = hasBody ? await request.arrayBuffer() : null;
     if (pastFlowDeadline(origin, deps)) return deadlinePassed();
     upstream = await doFetch(decision.ok ? decision.url : target, {
       method: request.method,
@@ -3536,16 +4020,30 @@ async function handleBrokerRequest(request, deps) {
     return refuse2(502, "too_large", `The upstream announced ${declared} bytes, more than the ${limit} a call may return.`);
   }
   if (upstreamBody !== null && isStreamedAnswer(upstream.status, upstream.headers)) {
+    const body2 = holding.body;
+    holding.body = null;
     return streamAnswer(upstream, upstreamBody, {
       appId,
       limit,
       slots: deps.streamSlots ?? null,
       safetyMs: deps.streamSafetyMs ?? BROKER_LIMITS.headersMs + BROKER_LIMITS.streamBodyMs,
+      closing: closesWithEvent(upstream.headers),
+      sent: deps.streamSent ?? null,
+      sentMs: deps.streamSentMs ?? BROKER_LIMITS.cutEventSentMs,
       signal: request.signal,
-      record: (outcome, status) => record(outcome, status, safeHost(target))
+      record: (outcome, status) => record(outcome, status, safeHost(target)),
+      held: body2
     });
   }
-  const read = await readWithin(upstreamBody, limit);
+  const heldAnswer = answers?.open(appId, ownerId) ?? null;
+  holding.answer = heldAnswer;
+  const read = heldAnswer === null ? await readWithin(upstreamBody, limit) : await readWithin(upstreamBody, limit, { arrive: (bytes) => heldAnswer.arrive(bytes) });
+  if (read.outcome !== "ok") heldAnswer?.release();
+  if (read.outcome === "full") {
+    const refusal = heldAnswerRefusal(answers?.limits ?? BROKER_LIMITS, heldAnswer?.refusal() ?? "all");
+    await record(refusal.error, 502, safeHost(target));
+    return refuse2(502, refusal.error, refusal.message);
+  }
   if (read.outcome === "error") {
     if (request.signal.aborted) return callerLeft(record, safeHost(target));
     await record("upstream_error", 502, safeHost(target));
@@ -3560,7 +4058,76 @@ async function handleBrokerRequest(request, deps) {
   const out2 = answerHeaders(upstream.headers);
   const empty = upstream.status === 204 || upstream.status === 304;
   if (!empty) out2.set("content-length", String(body.byteLength));
-  return new Response(empty ? null : body, { status: upstream.status, headers: out2 });
+  if (answers === void 0 || heldAnswer === null || empty || body.byteLength === 0) {
+    return new Response(empty ? null : body, { status: upstream.status, headers: out2 });
+  }
+  const exact = body.byteLength < body.buffer.byteLength ? body.slice() : body;
+  const handed = handOut(exact, heldAnswer, request.signal, answers.clock, answers.limits.heldAnswerHandOutMs);
+  let answer;
+  try {
+    answer = new Response(handed, { status: upstream.status, headers: out2 });
+  } catch (error) {
+    await handed.cancel().catch(() => {
+    });
+    throw error;
+  }
+  holding.answer = null;
+  return answer;
+}
+async function ownerOfApp(deps, appId) {
+  if (deps.ownerOf === void 0 || deps.heldBodies === void 0 && deps.heldAnswers === void 0) return null;
+  const owner = await deps.ownerOf(appId);
+  return typeof owner === "string" && owner.length > 0 ? owner : null;
+}
+function handOut(bytes, held, signal, clock, handOutMs) {
+  let left = bytes;
+  let stopWait = () => {
+  };
+  let appLeft = () => {
+  };
+  const finish = () => {
+    if (left === null) return false;
+    left = null;
+    stopWait();
+    signal.removeEventListener("abort", appLeft);
+    held.release();
+    return true;
+  };
+  return new ReadableStream(
+    {
+      start(controller) {
+        const wait = clock.wait(handOutMs);
+        stopWait = () => wait.cancel();
+        void wait.done.then(() => {
+          if (!finish()) return;
+          const cut2 = new Error(
+            `The answer was not all taken within ${String(handOutMs / 1e3)} seconds of being handed back, the longest wirl holds one, and was cut there.`
+          );
+          cut2.stack = `Error: ${cut2.message}`;
+          controller.error(cut2);
+        });
+        appLeft = () => {
+          if (finish()) controller.close();
+        };
+        if (signal.aborted) appLeft();
+        else signal.addEventListener("abort", appLeft, { once: true });
+      },
+      pull(controller) {
+        if (left === null) return;
+        const slice = left.slice(0, HAND_OUT_BYTES);
+        left = left.subarray(slice.byteLength);
+        controller.enqueue(slice);
+        if (left.byteLength > 0) return;
+        finish();
+        controller.close();
+      },
+      cancel() {
+        finish();
+      }
+    },
+    // Nothing is cut ahead of the app: the server's pace is the app's.
+    { highWaterMark: 0 }
+  );
 }
 function egressAuditPath(target) {
   let pathname;
@@ -3614,13 +4181,14 @@ function declaredLength(headers) {
   return Number(raw.trim());
 }
 async function streamAnswer(upstream, body, context) {
-  let release = () => {
-  };
+  const giveBack = () => context.held?.release();
+  let release = giveBack;
   if (context.slots !== null) {
     const slot = context.slots.acquire(context.appId);
     if (slot === null) {
       await body.cancel().catch(() => {
       });
+      giveBack();
       await context.record("busy", 429);
       return refuse2(
         429,
@@ -3628,25 +4196,60 @@ async function streamAnswer(upstream, body, context) {
         `This app already has ${context.slots.perApp} streamed answers open, the most it may hold at once; try again when one of them has finished.`
       );
     }
-    release = slot;
+    release = () => {
+      slot();
+      giveBack();
+    };
   }
   try {
     await context.record("allowed", upstream.status);
   } catch (error) {
+    await body.cancel().catch(() => {
+    });
     release();
+    throw error;
+  }
+  try {
+    return new Response(passOn(body, context.limit, release, context.safetyMs, context.signal, context.closing, context.sent, context.sentMs), {
+      status: upstream.status,
+      headers: answerHeaders(upstream.headers)
+    });
+  } catch (error) {
     await body.cancel().catch(() => {
     });
+    release();
     throw error;
   }
-  return new Response(passOn(body, context.limit, release, context.safetyMs, context.signal), {
-    status: upstream.status,
-    headers: answerHeaders(upstream.headers)
-  });
 }
-function passOn(body, limit, release, safetyMs, signal) {
+async function eventSent(sent, ms) {
+  if (sent === null) {
+    await new Promise((resolve7) => setTimeout(resolve7, 0));
+    return;
+  }
+  const stop = new AbortController();
+  let bound;
+  try {
+    await Promise.race([
+      sent(stop.signal),
+      new Promise((resolve7) => {
+        bound = setTimeout(resolve7, ms);
+        bound.unref?.();
+      })
+    ]);
+  } catch {
+  } finally {
+    clearTimeout(bound);
+    stop.abort();
+  }
+}
+function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
   const reader = body.getReader();
+  const says = closing && limit > CUT_EVENT_RESERVE_BYTES;
+  const room = says ? limit - CUT_EVENT_RESERVE_BYTES : limit;
   let total = 0;
   let over = false;
+  let parting = null;
+  let unread;
   let safety;
   let appLeft = () => {
   };
@@ -3658,17 +4261,40 @@ function passOn(body, limit, release, safetyMs, signal) {
     release();
     return true;
   };
-  const cut2 = (controller, error) => {
+  const cut2 = (controller, error, why) => {
     if (!finish()) return;
-    controller.error(error);
     reader.cancel(error).catch(() => {
     });
+    if (!says) {
+      controller.error(error);
+      return;
+    }
+    try {
+      controller.enqueue(streamCutEvent(why));
+    } catch {
+      controller.error(error);
+      return;
+    }
+    parting = error;
+    unread = setTimeout(() => {
+      if (parting === null) return;
+      parting = null;
+      try {
+        controller.error(error);
+      } catch {
+      }
+    }, sentMs);
+    unread.unref?.();
   };
   return new ReadableStream(
     {
       start(controller) {
         const timer = setTimeout(() => {
-          cut2(controller, new Error(`The upstream's answer was still open after ${safetyMs} ms, the longest the broker holds one, and was cut there.`));
+          cut2(
+            controller,
+            new Error(`The upstream's answer was still open after ${safetyMs} ms, the longest the broker holds one, and was cut there.`),
+            { cause: "held", ms: safetyMs }
+          );
         }, safetyMs);
         timer.unref?.();
         safety = timer;
@@ -3682,11 +4308,21 @@ function passOn(body, limit, release, safetyMs, signal) {
         else signal.addEventListener("abort", appLeft, { once: true });
       },
       async pull(controller) {
+        if (parting !== null) {
+          const error = parting;
+          parting = null;
+          clearTimeout(unread);
+          await eventSent(sent, sentMs);
+          controller.error(error);
+          return;
+        }
         let next;
         try {
           next = await reader.read();
         } catch (error) {
-          if (finish()) controller.error(error);
+          const bound = error instanceof PinnedFetchError ? error.streamBound : void 0;
+          if (bound !== void 0) cut2(controller, error, { cause: bound.kind, ms: bound.ms });
+          else if (finish()) controller.error(error);
           return;
         }
         if (over) return;
@@ -3696,14 +4332,21 @@ function passOn(body, limit, release, safetyMs, signal) {
           return;
         }
         total += next.value.byteLength;
-        if (total > limit) {
-          cut2(controller, new Error(`The upstream's answer passed ${limit} bytes, the most a call may return, and was cut there.`));
+        if (total > room) {
+          cut2(
+            controller,
+            new Error(
+              says ? `The upstream's answer reached the ${limit} bytes a call may return, counting the event that closes it, and was cut there.` : `The upstream's answer passed ${limit} bytes, the most a call may return, and was cut there.`
+            ),
+            { cause: "size", bytes: limit }
+          );
           return;
         }
         controller.enqueue(next.value);
       },
       cancel(reason) {
         finish();
+        clearTimeout(unread);
         return reader.cancel(reason).catch(() => {
         });
       }
@@ -3712,37 +4355,62 @@ function passOn(body, limit, release, safetyMs, signal) {
     { highWaterMark: 0 }
   );
 }
-async function readWithin(body, limit) {
-  if (body === null) return { outcome: "ok", bytes: new ArrayBuffer(0) };
-  const reader = body.getReader();
-  const chunks = [];
+async function readWithin(body, limit, bounds) {
+  if (body === null) return { outcome: "ok", bytes: new Uint8Array(0) };
+  let reader;
+  let held = new Uint8Array(0);
   let total = 0;
+  const time = bounds?.time;
+  const arrival = time?.clock.wait(time.arrivalMs);
+  const slow = arrival?.done.then(() => SLOW);
   try {
+    reader = body.getReader();
     for (; ; ) {
-      const next = await reader.read();
+      const next = await nextWithin(reader, time, slow);
+      if (next === STALLED || next === SLOW) {
+        await reader.cancel().catch(() => {
+        });
+        return { outcome: next === STALLED ? "stalled" : "slow" };
+      }
       if (next.done) break;
       const chunk = next.value;
       if (chunk === void 0) continue;
-      total += chunk.byteLength;
-      if (total > limit) {
+      const needed = total + chunk.byteLength;
+      if (needed > limit) {
         await reader.cancel().catch(() => {
         });
         return { outcome: "too_large" };
       }
-      chunks.push(chunk);
+      if (bounds !== void 0 && !bounds.arrive(chunk.byteLength)) {
+        await reader.cancel().catch(() => {
+        });
+        return { outcome: "full" };
+      }
+      if (needed > held.byteLength) {
+        const grown = new Uint8Array(Math.min(limit, Math.max(needed, held.byteLength * 2, FIRST_HOLD_BYTES)));
+        grown.set(held.subarray(0, total));
+        held = grown;
+      }
+      held.set(chunk, total);
+      total = needed;
     }
   } catch (error) {
-    await reader.cancel().catch(() => {
+    await reader?.cancel().catch(() => {
     });
     return { outcome: "error", error };
+  } finally {
+    arrival?.cancel();
   }
-  const joined2 = new Uint8Array(new ArrayBuffer(total));
-  let at2 = 0;
-  for (const chunk of chunks) {
-    joined2.set(chunk, at2);
-    at2 += chunk.byteLength;
+  return { outcome: "ok", bytes: held.subarray(0, total) };
+}
+async function nextWithin(reader, time, slow) {
+  if (time === void 0 || slow === void 0) return reader.read();
+  const stall = time.clock.wait(time.stallMs);
+  try {
+    return await Promise.race([reader.read(), stall.done.then(() => STALLED), slow]);
+  } finally {
+    stall.cancel();
   }
-  return { outcome: "ok", bytes: joined2.buffer };
 }
 function credentialShape(kind) {
   return Object.hasOwn(CREDENTIAL_SHAPES, kind) ? CREDENTIAL_SHAPES[kind] : null;
@@ -3792,19 +4460,21 @@ function readBearer(request) {
   const value = header.slice(7).trim();
   return value.length > 0 ? value : null;
 }
-function refuse2(status, reason, message) {
+function refuse2(status, reason, message, extra = {}) {
   return new Response(JSON.stringify({ error: reason, message }, null, 2), {
     status,
     headers: new Headers({
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...extra
     })
   });
 }
-var RESOLVE_BY_HOST, STRIPPED_PREFIXES, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, AUDIT_PATH_CHARS, CREDENTIAL_SHAPES, isHttpKind, safeHost;
+var RESOLVE_BY_HOST, STRIPPED_PREFIXES, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, HAND_OUT_BYTES, AUDIT_PATH_CHARS, STALLED, SLOW, FIRST_HOLD_BYTES, CREDENTIAL_SHAPES, isHttpKind, safeHost;
 var init_broker = __esm({
   "packages/core/src/broker.ts"() {
     "use strict";
+    init_broker_bodies();
     init_broker_stream();
     init_broker_token();
     init_egress();
@@ -3856,7 +4526,11 @@ var init_broker = __esm({
       "malicious-uploads-detection"
     ]);
     isHopHeader = (lower) => HOP_HEADERS.has(lower) || HOP_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    HAND_OUT_BYTES = 64 * 1024;
     AUDIT_PATH_CHARS = 200;
+    STALLED = /* @__PURE__ */ Symbol("stalled");
+    SLOW = /* @__PURE__ */ Symbol("slow");
+    FIRST_HOLD_BYTES = 16 * 1024;
     CREDENTIAL_SHAPES = Object.freeze({
       http_bearer: Object.freeze({ sends: "bearer", fields: Object.freeze(["token"]) }),
       http_header: Object.freeze({ sends: "headers", fields: Object.freeze([]) }),
@@ -3972,20 +4646,21 @@ arrives: pass \`response.body\` straight on. There are no WebSockets. A front en
 \`"static": "dist"\` serves that folder's files at their own paths (\`/\` is its \`index.html\`) and the module
 answers everything else; add \`"spa": true\` for a client-side router. Nothing outside that folder is served.
 
-Preview before you deploy: \`wirl preview\` puts the folder up at its own address with
-its own database (empty at first), and \`wirl fetch <path> --preview <name>\` (or the
-\`wirl_preview_fetch\` tool) shows you what it serves.
+Preview before you deploy: \`wirl preview\` gives a folder its own address and database (at first only what
+\`migrations/\` makes). \`wirl fetch <path> --preview <name>\` or \`wirl_preview_fetch\` shows what it answers. Every request a preview's module gets names the preview in \`x-wirl-preview\`, and wirl marks its pages as previews.
 
 npm packages work: install them in the project and the deploy bundles them in. Nothing is installed on the
 server: native code will not run. Node built-ins work (\`node:crypto\`, \`node:path\`, ...; \`Buffer\` and
 \`process\` are global), but what \`node:fs\` writes is gone by the next request: use \`env.DB\`.
 
 \`env\` holds \`DB\` and nothing else. \`env.DB\` is Cloudflare D1: prepared statements with \`.bind()\`, at most
-100 bound parameters a statement. \`exec()\` runs one statement per line. Declare a host under \`connections\`
-in \`wirl.json\`, then \`fetch\` the vendor's real URL: wirl attaches the key. An undeclared host is refused; a
-public API needing no key uses \`"kind": "none"\`. Declaring one deploys before anyone approves it;
-the deploy says per connection whether it is usable now or waiting on an admin. A vendor has 60
-seconds to answer, whole, unless it streams: ask a model for a stream.
+100 bound parameters a statement. \`exec()\` runs one statement per line, as does each file in \`migrations/\`,
+which wirl applies in order to a preview and before going live; a failing one fails the deploy. Never edit
+an applied file. Dropping or renaming a table or column needs \`"migrations": { "destructive": [...] }\`, its
+own live deploy and a person's yes. Declare a host under \`connections\`, then \`fetch\` the vendor's real URL:
+wirl attaches the key. An undeclared host is refused; a public API needing no key uses \`"kind": "none"\`.
+Declaring one deploys before anyone approves it; the deploy says per connection whether it is usable now or
+waiting on an admin. A vendor has 60 seconds to answer, whole, unless it streams: ask a model for a stream.
 
 Six headers say who is asking: \`x-wirl-user-id\`, \`x-wirl-user-email\`, \`x-wirl-user-name\`,
 \`x-wirl-role\`, \`x-wirl-app-id\`, \`x-wirl-org\`. Read the name with
@@ -3995,10 +4670,9 @@ Schedules POST to \`/__wirl/schedule/<name>\`; a run gets 5 minutes unless that
 says otherwise, and at most 15. A \`public_paths\` path takes requests with no sign-in.
 Work that outlives one request (waiting for a person, trying tomorrow, a long loop) is a flow: see Flows.
 
-A new app defaults to org-wide visibility when its org has a company email domain,
-and to private otherwise, including one made with \`wirl orgs create\`.
-Sharing by email adds one named person; \`wirl visibility private|org\` (or the tool)
-sets the level. Public is only ever a person's click on the app's Access page.
+A new app defaults to org-wide visibility when its org has a company email domain, and to private
+otherwise, including one made with \`wirl orgs create\`; \`wirl visibility private|org\` sets the level.
+Sharing by email adds one named person. Public is only ever a person's click on the app's Access page.
 
 Porting an existing project: route it through the \`fetch\` handler, replace ORM calls with
 \`env.DB.prepare(...).bind(...)\`, turn timers into \`schedules\`, and move keys into \`connections\`. Keep the
@@ -4030,18 +4704,66 @@ early, repeated or late one gets 409, or 404 once the run ends; check \`x-wirl-u
   }
 });
 
+// packages/core/src/version.ts
+function wirlVersion() {
+  return BUILT_VERSION ?? WORKSPACE_VERSION;
+}
+var WORKSPACE_VERSION, BUILT_VERSION;
+var init_version = __esm({
+  "packages/core/src/version.ts"() {
+    "use strict";
+    WORKSPACE_VERSION = "0.0.0";
+    BUILT_VERSION = true ? "0.2.2" : null;
+  }
+});
+
 // packages/core/src/install.ts
+function fallbackWhen(controlPlane = "this control plane") {
+  return `If your npm registry does not carry wirl, or to run exactly the build ${controlPlane} serves,`;
+}
+function namedControlPlane(controlOrigin) {
+  return `the wirl control plane (${controlOrigin.replace(/^https?:\/\//, "").replace(/\/+$/, "")})`;
+}
 function installFor(controlOrigin) {
-  if (NPM_PUBLISHED) return { cli: "wirl", mcp: "@wirl/mcp" };
   const origin = controlOrigin.replace(/\/+$/, "");
-  return { cli: `${origin}/cli/wirl.tgz`, mcp: `${origin}/cli/wirl-mcp.tgz` };
+  const tarball = { cli: `${origin}/cli/wirl.tgz`, mcp: `${origin}/cli/wirl-mcp.tgz` };
+  if (NPM_PUBLISHED) return { cli: "wirl", mcp: "@wirl/mcp", tarball };
+  return { ...tarball, tarball };
 }
-var NPM_PUBLISHED, WIRL_BIN;
+var NPM_PUBLISHED, WIRL_BIN, FALLBACK_WHEN, hasFallback;
 var init_install = __esm({
   "packages/core/src/install.ts"() {
     "use strict";
-    NPM_PUBLISHED = false;
+    NPM_PUBLISHED = true;
     WIRL_BIN = NPM_PUBLISHED ? "npx wirl" : "wirl";
+    FALLBACK_WHEN = fallbackWhen();
+    hasFallback = (install) => install.cli !== install.tarball.cli;
+  }
+});
+
+// packages/core/src/share-role.ts
+function readShareRole(value) {
+  if (value === void 0 || value === null) return { ok: true, role: void 0 };
+  if (value === AppRole.VIEWER || value === AppRole.EDITOR) return { ok: true, role: value };
+  return { ok: false, message: SHARE_ROLE_REFUSAL };
+}
+var SHARE_ROLE_REFUSAL;
+var init_share_role = __esm({
+  "packages/core/src/share-role.ts"() {
+    "use strict";
+    init_types();
+    SHARE_ROLE_REFUSAL = "role must be viewer or editor.";
+  }
+});
+
+// packages/core/src/connect.ts
+var CLAUDE_CODE_SIGN_IN, CLAUDE_CODE_LOCAL_SIGN_IN;
+var init_connect = __esm({
+  "packages/core/src/connect.ts"() {
+    "use strict";
+    init_install();
+    CLAUDE_CODE_SIGN_IN = "`claude mcp add` only saves the server's configuration. Then sign in: run `/mcp` inside Claude Code and follow the steps in the browser, or run `claude mcp login wirl` in a terminal.";
+    CLAUDE_CODE_LOCAL_SIGN_IN = `The local server signs in the first time a wirl tool needs it: the agent calls \`wirl_login\`, which returns a link and a code, and the agent shows both to the person. The person approves the code in the browser, and the agent's next wirl tool call works. A machine already signed in with \`${WIRL_BIN} login\` skips this.`;
   }
 });
 
@@ -4265,6 +4987,66 @@ var init_porting = __esm({
   }
 });
 
+// packages/core/src/throttle-report.ts
+var THROTTLE_REPORT, EDGE_REFUSALS_NOTE;
+var init_throttle_report = __esm({
+  "packages/core/src/throttle-report.ts"() {
+    "use strict";
+    init_public_path();
+    THROTTLE_REPORT = {
+      /**
+       * One report per app a minute at most from each gate isolate, and what
+       * one report counts spans a minute at most.
+       */
+      windowMs: 6e4,
+      /**
+       * How long the refusal that opens a window waits for more before the
+       * report goes, so a burst is one report with its count rather than a
+       * report of its first refusal.
+       */
+      gatherMs: 15e3,
+      /**
+       * The longest a refused request is asked to stay open, after its 429 has
+       * gone, for the report to be sent. Cloudflare keeps a request's
+       * `waitUntil` work for 30 seconds after the response, shared by all of
+       * it, and the send itself has `sendTimeoutMs` of what is left.
+       */
+      maxWaitMs: 2e4,
+      sendTimeoutMs: 5e3,
+      /**
+       * Reports one request carries for windows no refusal could wait for
+       * (`flushDue`). A request that was never refused must not queue its own
+       * reads behind posts that are not its own: Cloudflare runs six of a
+       * request's connections at once and queues the rest.
+       */
+      flushPerRequest: 2,
+      /** Apps one gate isolate counts for at once; a refusal for another app past this is not counted. */
+      maxApps: 1e3,
+      /** Lines in one report: each of an app's public paths, by each ceiling. */
+      maxEntries: 2 * PUBLIC_PATH_LIMITS.perApp,
+      /** A path is cut to this many characters, as `public.refused`'s is. */
+      maxPathChars: 256,
+      /**
+       * The most of a report's body the control plane reads. A full report is
+       * under 8 KiB: a path a request matched is ASCII, as a URL's path is.
+       */
+      bodyBytes: 16384,
+      /**
+       * Reports the control plane reads for one app a minute, from every isolate
+       * and location together. Of those, the first writes the app's one
+       * `public.throttled` row for that minute and the rest write nothing.
+       */
+      perAppPerMinute: 10,
+      /** The org's Activity page summarises this many apps' latest `public.throttled` lines, a line an app, from the last `logsPageDays` days. */
+      activityLines: 5,
+      /** The app's Logs page shows its latest this many `public.throttled` lines, from the last `logsPageDays` days. */
+      logsPageLines: 20,
+      logsPageDays: 7
+    };
+    EDGE_REFUSALS_NOTE = "Requests wirl refuses before your app is called, such as a public path's 429 over its ceiling, are not invocations and never show here; anyone who can deploy the app sees those 429s counted as public.throttled on its Logs page in the dashboard.";
+  }
+});
+
 // packages/core/src/supplied-bundle.ts
 var SUPPLIED_BUNDLE_PATH, MAX_SUPPLIED_BUNDLE_BYTES;
 var init_supplied_bundle = __esm({
@@ -4288,11 +5070,22 @@ var init_manifest_transport = __esm({
   }
 });
 
+// packages/core/src/preview.ts
+function versionNumbersSentence(listing) {
+  return `A preview takes a version number from the same count as a deploy, and ${listing} never lists a preview, so a deploy's number can skip: if the newest version listed is v1 and this deploy is v4, v2 and v3 were previews.`;
+}
+var init_preview = __esm({
+  "packages/core/src/preview.ts"() {
+    "use strict";
+  }
+});
+
 // packages/core/src/visit-token.ts
-var VISIT_QUERY_PARAM, VISIT_HEADER;
+var VISIT_TOKEN_TTL_SECONDS, VISIT_QUERY_PARAM, VISIT_HEADER;
 var init_visit_token = __esm({
   "packages/core/src/visit-token.ts"() {
     "use strict";
+    VISIT_TOKEN_TTL_SECONDS = 900;
     VISIT_QUERY_PARAM = "__wirl_visit";
     VISIT_HEADER = "x-wirl-visit";
   }
@@ -4322,10 +5115,15 @@ var init_src = __esm({
     init_retention();
     init_identity();
     init_contract();
+    init_version();
     init_install();
+    init_share_role();
+    init_connect();
     init_porting();
+    init_throttle_report();
     init_supplied_bundle();
     init_manifest_transport();
+    init_preview();
     init_visit_token();
   }
 });
@@ -5972,7 +6770,7 @@ import { constants as fsConstants, createReadStream } from "node:fs";
 import { access, link, lstat as lstat2, mkdir as mkdir3, open, readFile as readFile3, readdir, rename as rename2, rm as rm3, stat as stat3, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename as basename2, dirname as dirname3, isAbsolute, join as join5, relative, resolve as resolve4, sep } from "node:path";
-import { create as tarCreate, extract as tarExtract } from "tar";
+import { create as tarCreate, extract as tarExtract, Parser as TarParser } from "tar";
 import { gzipSync } from "node:zlib";
 
 // packages/core/src/node/pinned-fetch.ts
@@ -6067,7 +6865,7 @@ function createPinnedFetch(options = {}) {
       if (streamsBody !== void 0 && !streamsBody(status, answered)) return null;
       clearTimeout(timer);
       timer = setTimeout(() => {
-        fail(new PinnedFetchError("timeout", url.hostname, `${url.hostname} did not finish its answer within ${bodyTimeoutMs} ms.`));
+        fail(new PinnedFetchError("timeout", url.hostname, `${url.hostname} did not finish its answer within ${bodyTimeoutMs} ms.`, { kind: "time", ms: bodyTimeoutMs }));
       }, bodyTimeoutMs);
       return bodyIdleMs;
     };
@@ -6204,13 +7002,17 @@ function sendTo(wire, address, attempt, attemptMs) {
         budget = idle ?? Math.max(MIN_ATTEMPT_MS, wire.remainingMs());
         request.setTimeout(budget);
         const bodyless = NO_BODY.has(status) || method.toUpperCase() === "HEAD";
+        const answerOver = () => {
+          wire.done();
+          if (!request.writableFinished) request.destroy();
+        };
         if (bodyless) {
           incoming.resume();
           incoming.on("error", () => {
           });
-          wire.done();
+          answerOver();
         } else {
-          incoming.once("close", wire.done);
+          incoming.once("close", answerOver);
         }
         resolve7(new Response(bodyless ? null : Readable.toWeb(incoming), { status, headers: out2 }));
       } catch (error) {
@@ -6228,7 +7030,10 @@ function sendTo(wire, address, attempt, attemptMs) {
       const error = new PinnedFetchError(
         "timeout",
         url.hostname,
-        streaming ? `${url.hostname}'s answer stalled: nothing moved on it for ${budget} ms on ${address}, because the host sent nothing or nothing was read from it.` : `${url.hostname} did not answer within ${budget} ms on ${address}.`
+        streaming ? `${url.hostname}'s answer stalled: nothing moved on it for ${budget} ms on ${address}, because the host sent nothing or nothing was read from it.` : `${url.hostname} did not answer within ${budget} ms on ${address}.`,
+        // Which bound it was, for the broker to say what it cut a stream
+        // for (OIM-837): only on a body on bounds of its own.
+        streaming ? { kind: "idle", ms: budget } : void 0
       );
       if (delivered !== null) delivered.destroy(error);
       else request.destroy(error);
@@ -6248,6 +7053,7 @@ function sendTo(wire, address, attempt, attemptMs) {
 }
 
 // packages/core/src/node/broker-fetch.ts
+init_broker_bodies();
 init_broker_stream();
 var BROKER_FETCH_OPTIONS = Object.freeze({
   timeoutMs: BROKER_LIMITS.headersMs,
@@ -6258,8 +7064,36 @@ var BROKER_FETCH_OPTIONS = Object.freeze({
 function createBrokerTransport(options = {}) {
   return {
     fetchImpl: options.fetchImpl ?? createPinnedFetch({ ...BROKER_FETCH_OPTIONS, ...options.pinning }),
-    streamSlots: createStreamSlots()
+    streamSlots: createStreamSlots(),
+    heldBodies: createHeldBodies({ limits: options.heldBodyLimits, log: options.log }),
+    heldAnswers: createHeldAnswers({ limits: options.heldAnswerLimits, log: options.log })
+  };
+}
+
+// packages/core/src/node/sent-on.ts
+var LOOK_EVERY_MS = 2;
+function sentOn(response) {
+  if (response === void 0) return void 0;
+  const nothingLeft = () => {
+    const socket = response.socket;
+    if (response.destroyed === true || socket === null || socket?.destroyed === true) return true;
+    return (response.writableLength ?? socket?.writableLength ?? 0) === 0;
   };
+  return (stop) => new Promise((resolve7) => {
+    let timer;
+    const settle2 = () => {
+      clearTimeout(timer);
+      stop.removeEventListener("abort", settle2);
+      resolve7();
+    };
+    const look = () => {
+      if (stop.aborted || nothingLeft()) return settle2();
+      timer = setTimeout(look, LOOK_EVERY_MS);
+      timer.unref?.();
+    };
+    stop.addEventListener("abort", settle2, { once: true });
+    look();
+  });
 }
 
 // packages/core/src/node/dev-identity.ts
@@ -6277,10 +7111,9 @@ init_slug();
 import { createHash as createHash2 } from "node:crypto";
 var HASH_SUFFIX_LENGTH = 5;
 function previewNameFor(raw, orgSlug, appSlug) {
-  const slug = slugify(raw);
-  if (!slug) {
-    return { ok: false, message: "That name has no usable characters, or is reserved." };
-  }
+  const made = previewSlugFor(raw);
+  if (!made.ok) return { ok: false, message: made.message };
+  const slug = made.slug;
   const budget = MAX_HOST_LABEL - (appLabel(orgSlug, appSlug).length + HOST_SEPARATOR.length);
   if (budget < 2) {
     return {
@@ -6400,6 +7233,64 @@ function shellPath(value) {
   return shellQuote(value);
 }
 
+// packages/cli/src/skill.ts
+init_src();
+var SKILL_INTRO = `A new app is visible to everyone in the org when the org came from a
+company email domain; in any other org, including a personal one or one
+made with \`wirl orgs create\`, it starts private. Deploys are one
+command; sharing is by email; a third-party API is declared, never pasted.`;
+var SKILL_DOCS_LINE = "Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.";
+var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
+2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
+3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
+4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
+5. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
+var SKILL_MANIFEST_EXAMPLE = `\`\`\`json
+{ "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
+\`\`\``;
+var SKILL_FILES_PARAGRAPH = "No blob storage: files go in `env.DB`, at most 2,000,000 bytes a value or row (the limit Cloudflare publishes for D1), so store a larger file in chunks, one row each, a few MB to a batch. `wirl dev` refuses a single bound value over 2,000,000 bytes, but a row's total, a value grown in SQL, or a batch bigger than one call to D1 carries can still pass locally and fail deployed.";
+var SKILL_STATIC_PARAGRAPH = 'A static folder maps a path to one file exactly: a path ending in `/` serves the `index.html` in that folder, `/about` never finds `about.html`, and a path that names no file goes to the module (with `"spa": true`, a page navigation gets `index.html` instead; in an app with no module, the top `index.html`, or a 404 for a missing file with an extension). Next.js runs only as a static export: `output: "export"` and `trailingSlash: true` in `next.config` make `next build` write `out/`, which goes under `"static"`; `next start` cannot run, and API routes move into the module.';
+function composeSkill(parts) {
+  if (parts.description.trim() === "" || /[\r\n]/.test(parts.description)) {
+    throw new Error("a skill description is one non-empty line");
+  }
+  return `---
+name: wirl
+description: ${parts.description}
+---
+
+# wirl
+
+${SKILL_INTRO}
+
+${SKILL_DOCS_LINE}
+
+## Commands
+
+${parts.commands.trimEnd()}
+
+## Rules
+
+${SKILL_RULES}
+
+## wirl.json
+
+${SKILL_MANIFEST_EXAMPLE}
+
+## What runs on wirl
+
+${BUILD_CONTRACT}
+
+${SKILL_FILES_PARAGRAPH}
+
+${SKILL_STATIC_PARAGRAPH}
+
+## Flows
+
+${FLOWS_CONTRACT}
+`;
+}
+
 // packages/cli/src/core.ts
 function credentialsPath(env = process.env) {
   return env["WIRL_CREDENTIALS_PATH"] || join5(homedir(), ".config", "wirl", "credentials.json");
@@ -6460,7 +7351,7 @@ async function loadCredentials(env = process.env) {
     }
   } catch {
   }
-  throw new CliError("Not signed in.", "Run `wirl login` first, or set WIRL_TOKEN.", { code: "not_signed_in" });
+  throw new CliError("Not signed in.", `Run \`${WIRL_BIN} login\` first, or set WIRL_TOKEN.`, { code: "not_signed_in" });
 }
 async function saveCredentials(creds, env = process.env) {
   const path = credentialsPath(env);
@@ -6521,11 +7412,11 @@ async function pollDeviceLogin(apiOrigin, login, options = {}) {
         continue;
       }
       case "expired_token":
-        throw new CliError("The sign-in code expired before it was approved.", "Run `wirl login` again.");
+        throw new CliError("The sign-in code expired before it was approved.", `Run \`${WIRL_BIN} login\` again.`);
       default:
         throw new CliError(
           typeof body["error"] === "string" ? `Sign-in failed: ${body["error"]}.` : `Sign-in failed (${response.status}).`,
-          "Run `wirl login` again."
+          `Run \`${WIRL_BIN} login\` again.`
         );
     }
   }
@@ -6636,6 +7527,10 @@ var SERVER_TEMPLATE = [
   " *",
   " * Everything real happens here. The page is HTML this module returns. The",
   " * data lives in env.DB, a SQLite database that belongs to this app alone.",
+  " * Its tables are in migrations/0001_init.sql: wirl applies each new file in",
+  " * migrations/ before a version goes live, to a preview's database when the",
+  " * preview is put up, and to the local one when wirl dev starts. Put the",
+  " * next change in migrations/0002_<what>.sql rather than editing that one.",
   " * The person making the request is in headers wirl sets after verifying",
   " * them, which the browser cannot forge. Any rule that matters, such as",
   ' * "you only see your own notes", is a line of code in this file: a check',
@@ -6647,18 +7542,8 @@ var SERVER_TEMPLATE = [
   " * live in .wirl/keys.json beside this file, which git ignores.",
   " */",
   "",
-  "// One line: exec runs one statement per line, as D1 does.",
-  "const SCHEMA =",
-  '  "create table if not exists notes (" +',
-  '  "  id integer primary key," +',
-  '  "  user_id text not null," +',
-  '  "  body text not null," +',
-  `  "  created_at text not null default (datetime('now'))" +`,
-  '  ")";',
-  "",
   "export default {",
   "  async fetch(request, env) {",
-  "    await env.DB.exec(SCHEMA);",
   "    const url = new URL(request.url);",
   "",
   `    // One line per request. Read it with ${WIRL_BIN} logs.`,
@@ -6741,56 +7626,54 @@ var SERVER_TEMPLATE = [
   "}",
   ""
 ].join("\n");
+var INIT_MIGRATION = [
+  "-- This app's tables. wirl applies each new file here, in order, before a version goes live.",
+  "-- Make the next change in 0002_<what>.sql; never edit a file that has been deployed.",
+  "create table notes (id integer primary key, user_id text not null, body text not null, created_at text not null default (datetime('now')))",
+  ""
+].join("\n");
+var INIT_MIGRATION_PATH = `${MIGRATIONS_DIR}/${ADOPTED_FILE}`;
+async function refuseInitMigrations(dir) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (entry.name.toLowerCase() !== MIGRATIONS_DIR) continue;
+    if (entry.isSymbolicLink()) {
+      throw new CliError(`${entry.name}/ is a symbolic link, and wirl writes into no links: make migrations/ a real folder, then run wirl init --server again.`);
+    }
+    if (entry.name !== MIGRATIONS_DIR) {
+      throw new CliError(`${entry.name}/ is spelled differently from migrations/: wirl reads migrations/ in lowercase only. Rename it, then run wirl init --server again.`);
+    }
+    if (!entry.isDirectory()) {
+      throw new CliError(
+        `migrations is a file, and wirl init --server writes ${INIT_MIGRATION_PATH} into a folder of that name. Move it aside, then run wirl init --server again.`
+      );
+    }
+    const names = await readdir(join5(dir, entry.name));
+    if (names.some((name) => name.toLowerCase().endsWith(".sql"))) {
+      throw new CliError(`migrations/ already holds .sql files; wirl init --server writes ${INIT_MIGRATION_PATH} into a folder with none.`);
+    }
+  }
+}
 var SKILL_PATH = join5(".claude", "skills", "wirl", "SKILL.md");
-var SKILL_MARKDOWN = `---
-name: wirl
-description: Deploy and share the internal app in this project with wirl (${WIRL_BIN}). Use when the user wants a tool, dashboard or prototype put somewhere colleagues can open it, shared with a named person, run locally the way it will run deployed, or connected to a third-party API; or wants work that outlives one request, such as waiting for a person to approve something or trying again tomorrow.
----
+var SKILL_ORIGIN = "https://app.wirl.dev";
+var SKILL_INSTALL = installFor(SKILL_ORIGIN);
+var SKILL_RUN = NPM_PUBLISHED ? `Run the CLI as \`${WIRL_BIN} <command>\`, which needs no install beyond Node 22.13 or later (in a terminal npm asks "Ok to proceed?" the first time: answer y); this file writes a command as \`wirl <command>\` for short anywhere but the list below.
 
-# wirl
-
-A new app is visible to everyone in the org when the org came from a
-company email domain; in any other org, including a personal one or one
-made with \`wirl orgs create\`, it starts private. Deploys are one
-command; sharing is by email; a third-party API is declared, never pasted.
-
-Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.
-
-## Commands
-
-- Connect first, if the agent supports MCP: \`claude mcp add --transport http wirl https://app.wirl.dev/mcp\` opens the browser once to sign in. No HTTP MCP support? \`claude mcp add wirl -- npx -y ${installFor("https://app.wirl.dev").mcp}\` does the same, running locally. Neither available: \`${WIRL_BIN} login\` prints a link and a code; the person approves in the browser. Do this once, when any command says you are not signed in.
+` : "";
+var SKILL_FALLBACK = hasFallback(SKILL_INSTALL) ? `- ${fallbackWhen(namedControlPlane(SKILL_ORIGIN))} install the CLI from the control plane instead with \`npm install -g ${SKILL_INSTALL.tarball.cli}\`, run plain \`wirl\` where this file says \`${WIRL_BIN}\`, and name \`${SKILL_INSTALL.tarball.mcp}\` in place of \`${SKILL_INSTALL.mcp}\`.
+` : "";
+var SKILL_MARKDOWN = composeSkill({
+  description: `Deploy and share the internal app in this project with wirl (${WIRL_BIN}). Use when the user wants a tool, dashboard or prototype put somewhere colleagues can open it, shared with a named person, run locally the way it will run deployed, or connected to a third-party API; or wants work that outlives one request, such as waiting for a person to approve something or trying again tomorrow.`,
+  commands: `${SKILL_RUN}- Connect first, if the agent supports MCP: \`claude mcp add --transport http wirl https://app.wirl.dev/mcp\` needs no install. ${CLAUDE_CODE_SIGN_IN} No HTTP MCP support? \`claude mcp add wirl -- npx -y ${SKILL_INSTALL.mcp}\` runs the same tools locally. ${CLAUDE_CODE_LOCAL_SIGN_IN} Neither available: \`${WIRL_BIN} login\` prints a link and a code; the person approves in the browser. Do this once, when any command says you are not signed in.
 - \`${WIRL_BIN} deploy\` \u2014 deploys this directory. Prints the URL and who can open it.
 - \`${WIRL_BIN} share someone@company.com\` \u2014 that person can open it. Add \`--role editor\` so they can deploy too.
 - \`${WIRL_BIN} dev\` \u2014 runs the app here as it will run deployed, signed in as a stub user.
 - \`${WIRL_BIN} pull <app>\` \u2014 fetches a deployed app's source to keep building.
 - \`${WIRL_BIN} logs\` \u2014 what the deployed app printed, per request, newest first; \`--errors\` for failures only, \`--follow\` to keep watching, \`--cursor <n>\` for the page before a "More before this" line. Read this before changing code when something misbehaves.
+- \`${WIRL_BIN} migrations\` \u2014 what this app's database has applied, read only.
+- \`${WIRL_BIN} migrations adopt\` \u2014 once, for an app whose tables were made in code: writes \`migrations/0001_init.sql\` from the live database's shape.
 - \`${WIRL_BIN} --help\` \u2014 everything else: orgs, members, connections, move, transfer, rollback, flows and runs.
-
-## Rules
-
-1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
-2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
-3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
-4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
-
-## wirl.json
-
-\`\`\`json
-{ "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
-\`\`\`
-
-## What runs on wirl
-
-${BUILD_CONTRACT}
-
-No blob storage: files go in \`env.DB\`, at most 2,000,000 bytes a value or row (the limit Cloudflare publishes for D1), so store a larger file in chunks, one row each, a few MB to a batch. \`wirl dev\` refuses a single bound value over 2,000,000 bytes, but a row's total, a value grown in SQL, or a batch bigger than one call to D1 carries can still pass locally and fail deployed.
-
-A static folder maps a path to one file exactly: a path ending in \`/\` serves the \`index.html\` in that folder, \`/about\` never finds \`about.html\`, and a path that names no file goes to the module (with \`"spa": true\`, a page navigation gets \`index.html\` instead; in an app with no module, the top \`index.html\`, or a 404 for a missing file with an extension). Next.js runs only as a static export: \`output: "export"\` and \`trailingSlash: true\` in \`next.config\` make \`next build\` write \`out/\`, which goes under \`"static"\`; \`next start\` cannot run, and API routes move into the module.
-
-## Flows
-
-${FLOWS_CONTRACT}
-`;
+${SKILL_FALLBACK}`
+});
 async function writeSkill(dir) {
   const path = join5(dir, SKILL_PATH);
   const existing = await readFile3(path, "utf8").catch(() => null);
@@ -6822,8 +7705,12 @@ async function scaffold(dir, options) {
     } catch (error) {
       if (error instanceof CliError) throw error;
     }
+    await refuseInitMigrations(dir);
     await writeFile2(target, SERVER_TEMPLATE, "utf8");
     written.push("server.mjs");
+    await mkdir3(join5(dir, MIGRATIONS_DIR), { recursive: true });
+    await writeFile2(join5(dir, MIGRATIONS_DIR, ADOPTED_FILE), INIT_MIGRATION, { encoding: "utf8", flag: "wx" });
+    written.push(INIT_MIGRATION_PATH);
     const pkg = join5(dir, "package.json");
     if (await readFile3(pkg, "utf8").catch(() => null) === null) {
       await writeFile2(pkg, `${JSON.stringify({ name: options.app, private: true, type: "module" }, null, 2)}
@@ -7113,7 +8000,7 @@ async function callApi(creds, path, options = {}) {
       throw new CliError(body.message, void 0, refusal);
     }
     if (response.status === 401 || response.status === 403) {
-      throw new CliError("Not signed in, or this token cannot do that.", "Try `wirl login`.", refusal);
+      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`, refusal);
     }
     if (response.status === 404) {
       if (body.error !== void 0 && body.error !== "not_found" && body.message) throw new CliError(body.message, void 0, refusal);
@@ -7151,30 +8038,58 @@ async function callApiBytes(creds, path, options = {}) {
       body = {};
     }
     if (response.status === 401 || response.status === 403) {
-      throw new CliError("Not signed in, or this token cannot do that.", "Try `wirl login`.");
+      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`);
     }
     if (response.status === 404) throw new CliError("Not found, or you do not have access to it.");
     throw new CliError(body.message ?? body.error ?? `Request failed (${response.status}).`);
   }
   const declared = Number(response.headers.get("content-length") ?? 0);
   if (declared > MAX_PULL_BYTES) throw new CliError(`That is ${Math.round(declared / 1048576)} MB, more than wirl will pull.`);
-  const bytes = new Uint8Array(await response.arrayBuffer());
+  let bytes;
+  try {
+    bytes = new Uint8Array(await response.arrayBuffer());
+  } catch {
+    throw new CliError(PULL_CUT, void 0, { code: "pull_cut" });
+  }
   if (bytes.byteLength > MAX_PULL_BYTES) throw new CliError("The download was larger than wirl will pull.");
   return bytes;
 }
+var PULL_CUT = "The pull was cut before it finished, so nothing was written. Run it again.";
+var pullShort = (dir) => `The pull's archive is cut short or damaged, so nothing was written to ${dir}. Run it again.`;
 var MAX_PULL_BYTES = 256 * 1048576;
 var pullApp = (creds, org, app, options = {}) => callApiBytes(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/pull`, options.fetchImpl ? { fetchImpl: options.fetchImpl } : {});
+function isWholeArchive(archive) {
+  return new Promise((resolve7, reject) => {
+    let sound = true;
+    let ended2 = false;
+    const parser = new TarParser({ onReadEntry: (entry) => void entry.resume() });
+    parser.on("warn", (code) => {
+      if (code === "TAR_BAD_ARCHIVE" || code === "TAR_ENTRY_INVALID") sound = false;
+    });
+    parser.on("eof", () => {
+      ended2 = true;
+    });
+    parser.on("error", (error) => typeof error.code === "string" && error.code.startsWith("Z_") ? resolve7(false) : reject(error));
+    parser.on("end", () => resolve7(sound && ended2));
+    parser.end(archive);
+  });
+}
 async function unpackPull(bytes, dir, options = {}) {
-  await mkdir3(dir, { recursive: true });
-  const existing = await readdir(dir);
+  const existing = await readdir(dir).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
   if (existing.length > 0 && !options.force) {
     throw new CliError(`${dir} is not empty.`, "Pull into a new directory, or pass --force to overwrite.");
   }
+  const archive = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (!await isWholeArchive(archive)) throw new CliError(pullShort(dir), void 0, { code: "pull_cut" });
+  await mkdir3(dir, { recursive: true });
   await new Promise((resolve7, reject) => {
     const extractor = tarExtract({ cwd: dir });
     extractor.on("error", reject);
     extractor.on("finish", resolve7);
-    extractor.end(Buffer.from(bytes));
+    extractor.end(archive);
   });
   const written = [];
   await collect(dir, dir, written);
@@ -7551,7 +8466,7 @@ function deletedAppMessage(org, app, done) {
   return `Deleted ${org}/${app}. Its address has stopped answering${runs}. Its data is kept until ${done.dataKeptUntil.slice(0, 10)}; until then wirl apps restore ${app} --org ${org} brings it back (one that was public comes back only from the Recently deleted list on the dashboard). Its name stays taken.`;
 }
 function deleteNeedsFullScopeMessage(apiOrigin, org, app) {
-  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with wirl login (with WIRL_TOKEN unset), or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
+  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with ${WIRL_BIN} login (with WIRL_TOKEN unset), or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
 }
 var VISIBILITY_LEVELS = ["private", "org", "public"];
 function describeVisibility(level, org) {
@@ -7567,10 +8482,13 @@ function describeVisibility(level, org) {
   }
 }
 var readVisibility = (creds, org, app) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}`).then((r) => r.app.visibility ?? "unknown");
-async function changeVisibility(creds, options) {
-  if (!VISIBILITY_LEVELS.includes(options.level)) {
-    throw new CliError(`Visibility is private, org or public, not "${String(options.level)}".`);
+function refuseVisibilityLevel(level) {
+  if (!VISIBILITY_LEVELS.includes(level)) {
+    throw new CliError(`Visibility is private, org or public, not "${String(level)}".`);
   }
+}
+async function changeVisibility(creds, options) {
+  refuseVisibilityLevel(options.level);
   if (options.level === "public") {
     throw new CliError(
       "Public means anyone on the internet with the link can open it, without signing in, so a person decides that with their own click.",
@@ -7615,11 +8533,59 @@ var transferApp = (creds, org, app, email, options = {}) => callApi(creds, `/api
   ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
 });
 var unmailedNote = (result) => result.mailed === false && result.message ? ` ${result.message}` : "";
+function refuseShareRole(value) {
+  const read = readShareRole(value);
+  if (read.ok) return read.role;
+  const shown2 = typeof value === "string" ? terminalSafe(value.slice(0, 40)) : typeof value;
+  throw new CliError(`Role is viewer or editor, not "${shown2}".`);
+}
 var shareApp = (creds, org, app, email, role) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/share`, {
   method: "POST",
-  body: JSON.stringify({ email, role }),
+  // No role is no `role`: the control plane then keeps the one a person has.
+  body: JSON.stringify(role === void 0 ? { email } : { email, role }),
   contentType: "application/json"
 });
+function shareSentence(result, email, asked, voice) {
+  const roleOf = (value) => value === "viewer" || value === "editor" ? value : void 0;
+  const outcome = ["added", "kept", "unchanged", "changed"].includes(String(result.outcome)) ? result.outcome : void 0;
+  const role = roleOf(result.role);
+  const old = outcome === void 0 || role === void 0;
+  const now = role ?? asked ?? "viewer";
+  const was = roleOf(result.previousRole);
+  const article = (name) => name === "editor" ? "an editor" : "a viewer";
+  const mail = unmailedNote(result);
+  const signIn = voice === "cli" ? "the moment they first sign in" : "when they first sign in";
+  if (result.pending) {
+    const wait = `They will have access ${signIn}.`;
+    if (!old && outcome === "kept") return `${email} was already invited as ${now}, and no role was given, so it stays ${now}. ${wait}${mail}`;
+    const lead2 = `Invited ${email} as ${now}. ${wait}`;
+    if (old || outcome === "added") return `${lead2}${mail}`;
+    if (outcome === "unchanged") return `${lead2} The invitation already said that.${mail}`;
+    if (was === void 0) return `${lead2} The invitation's role was changed.${mail}`;
+    return `${lead2} The invitation said ${was} before.${mail}`;
+  }
+  if (!old && outcome === "kept") {
+    const change = voice === "cli" ? "Pass --role viewer or --role editor" : 'Pass role "viewer" or "editor"';
+    return `${email} already had access as ${now}, and no role was given, so it stays ${now}. ${change} to change it.`;
+  }
+  const lead = voice === "cli" ? `Shared with ${email} as ${now}.` : `${email} can now open the app as ${now}.`;
+  if (old || outcome === "added") return lead;
+  if (outcome === "unchanged") return `${lead} They already had that role.`;
+  if (was === void 0) return `${lead} Their role was changed.`;
+  return `${lead} They were ${article(was)} before.`;
+}
+var unshareApp = (creds, org, app, email) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/share`, {
+  method: "DELETE",
+  body: JSON.stringify({ email }),
+  contentType: "application/json"
+});
+function unshareSentence(result, email) {
+  const share = result.shareRevoked ?? result.revoked;
+  const invitation = result.invitationWithdrawn ?? false;
+  const found = share ? invitation ? `Revoked ${email}'s share and withdrew the invitation still waiting for them.` : `Revoked ${email}'s share.` : invitation ? `Withdrew ${email}'s invitation.` : `${email} held no share on the app and had no invitation to it, so there was nothing to take back.`;
+  const wasDeleted = result.appDeleted === true && (share || invitation) ? " The app was deleted when this was asked, so a restore will not bring it back." : "";
+  return `${found}${wasDeleted} That takes back only what was shared by name: the app's level (wirl_visibility) and the rights of its owner and the organisation's owners and admins are unchanged.`;
+}
 var listDeployments = (creds, org, app) => callApi(
   creds,
   `/api/v1/apps/${seg(org)}/${seg(app)}/deployments`
@@ -7763,7 +8729,7 @@ var fetchLogs = (creds, org, app, filters) => callApi(
 );
 var LINE_INDENT = "         ";
 function terminalSafe(text) {
-  return escapeInvisible(text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`));
+  return escapeInvisible(text.replace(/\r\n/g, "\n").replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`));
 }
 function utcSecond(at2) {
   const ms = Date.parse(at2);
@@ -7799,7 +8765,8 @@ function formatLogPage(page, since) {
     // queryable. Without this an empty answer right after a request
     // reads as "nothing happened".
     " A request made in the last minute may not have arrived yet: ask again shortly."
-  )}` : page.invocations.map((entry) => formatInvocation(entry)).join("\n\n");
+  )}
+${EDGE_REFUSALS_NOTE}` : page.invocations.map((entry) => formatInvocation(entry)).join("\n\n");
   return page.cursor === null ? body : `${body}
 
 More before this: pass cursor=${page.cursor}.`;
@@ -8345,20 +9312,22 @@ async function previewFetch(creds, org, app, name, path, options) {
   const headers = callerHeaders(options.headers);
   headers.set(VISIT_HEADER, mint.token);
   const networkFetch = options.networkFetchImpl ?? fetch;
-  const sentAt = Date.now();
+  const clock = options.now ?? (() => performance.now());
+  const sentAt = clock();
+  const elapsed = () => Math.round(clock() - sentAt);
   const response = await networkFetch(target.toString(), {
     method: options.method ?? (options.body !== void 0 ? "POST" : "GET"),
     headers,
     redirect: "manual",
     ...options.body === void 0 ? {} : { body: options.body }
   });
-  const headersMs = Date.now() - sentAt;
+  const headersMs = elapsed();
   const contentType = response.headers.get("content-type") ?? "";
   const location = response.headers.get("location");
   const text = isTextBody(contentType);
   const streamWaitMs = Math.min(options.streamWaitMs ?? FETCH_STREAM_WAIT_MS, FETCH_WAIT_MAX_SECONDS * 1e3);
   const keep = options.keepBodyBytes === void 0 ? null : Math.min(options.keepBodyBytes, FETCH_FILE_MAX_BYTES);
-  const read = await readBounded(response, streamWaitMs, sentAt, keep ?? FETCH_READ_CEILING_BYTES);
+  const read = await readBounded(response, streamWaitMs, elapsed, keep ?? FETCH_READ_CEILING_BYTES);
   const bytes = read.bytes;
   const truncated = text && (read.cut || bytes.byteLength > FETCH_BODY_CAP_BYTES);
   const media = (contentType.split(";")[0] ?? "").trim().toLowerCase();
@@ -8446,7 +9415,7 @@ function parseWaitFlag(raw) {
 }
 var FETCH_READ_CEILING_BYTES = 8 * FETCH_BODY_CAP_BYTES;
 var FETCH_FILE_MAX_BYTES = 1e8;
-async function readBounded(response, waitMs, sentAt, ceilingBytes) {
+async function readBounded(response, waitMs, elapsed, ceilingBytes) {
   if (response.body === null) return { bytes: new Uint8Array(0), chunks: [], stillStreaming: false, cut: false };
   const reader = response.body.getReader();
   const chunks = [];
@@ -8465,7 +9434,7 @@ async function readBounded(response, waitMs, sentAt, ceilingBytes) {
         break;
       }
       if (next.done) break;
-      chunks.push({ atMs: Date.now() - sentAt, bytes: next.value });
+      chunks.push({ atMs: elapsed(), bytes: next.value });
       total += next.value.byteLength;
       if (total > ceilingBytes) {
         cut2 = true;
@@ -8510,9 +9479,9 @@ function formatFetchResult(result, saved) {
       0,
       `answered after ${seconds(result.headersMs)} s; ${said} line${said === 1 ? "" : "s"} in ${pieces} piece${pieces === 1 ? "" : "s"} over ${seconds(last)} s (each line shown at the time it was complete)`
     );
+    const unfinished = lastLineUnfinished(result);
     timed.forEach((line, i) => {
-      const unfinished = i === timed.length - 1 && !result.timed.lastComplete && (!result.bodyComplete || result.truncated);
-      lines.push(line.text === "" ? "" : `+${seconds(line.atMs)}s  ${line.text}${unfinished ? "  (the line had not ended)" : ""}`);
+      lines.push(line.text === "" ? "" : `+${seconds(line.atMs)}s  ${line.text}${unfinished && i === timed.length - 1 ? "  (the line had not ended)" : ""}`);
     });
   } else {
     lines.push(result.bodyText);
@@ -8525,6 +9494,10 @@ function formatFetchResult(result, saved) {
   }
   return lines.join("\n");
 }
+function lastLineUnfinished(result) {
+  return result.timed !== null && !result.timed.lastComplete && (!result.bodyComplete || result.truncated);
+}
+var STREAMED_DATA_MAX_TEXT_BYTES = 16 * 1024;
 async function readDataFile(file, maxBytes = FETCH_FILE_MAX_BYTES) {
   if (file.length === 0) throw new CliError("--data @ needs a file name after the @.", void 0, { code: "bad_flag" });
   const tooBig = () => new CliError(
@@ -8642,7 +9615,7 @@ var ADOPT_SENTENCES2 = {
    */
   cannotTell: (what) => `wirl did not get the adopt route's answer (${what}), so it cannot tell whether the live database recorded migrations/${ADOPTED_FILE}, and nothing was written here. Run wirl migrations adopt again: while an adopted ${ADOPTED_FILE} is all the live database records, adopting again replaces that record and writes the file.`,
   /** After the call, so the live database records the file; a CLI that reads files otherwise than the control plane says this every time. */
-  notAsRecorded: (install) => `The live database now records migrations/${ADOPTED_FILE} as adopted, but the file wirl sent does not match its own record of it, so nothing was written here. Run wirl migrations adopt again: while an adopted ${ADOPTED_FILE} is all the live database records, adopting again replaces that record and writes the file. If it says this again, this copy of wirl reads migration files differently from the control plane: update it (npm install -g ${install}).`,
+  notAsRecorded: (install) => `The live database now records migrations/${ADOPTED_FILE} as adopted, but the file wirl sent does not match its own record of it, so nothing was written here. Run wirl migrations adopt again: while an adopted ${ADOPTED_FILE} is all the live database records, adopting again replaces that record and writes the file. If it says this again, this copy of wirl reads migration files differently from the control plane: update it (npm install -g ${install.cli}${hasFallback(install) ? `, or, to match this control plane exactly, npm install -g ${install.tarball.cli}` : ""}).`,
   unwritten: (code) => `The live database now records migrations/${ADOPTED_FILE} as adopted, but wirl could not write that file here (${code}). Make migrations/ a folder you can write that holds no .sql file, then run wirl migrations adopt again: while an adopted ${ADOPTED_FILE} is all the live database records, adopting again replaces that record and writes the file.`,
   nothingWritten: "Nothing was written to migrations/.",
   /**
@@ -8833,7 +9806,7 @@ async function adoptIntoProject(creds, options) {
   const read = await readMigrations([{ name: ADOPTED_FILE, text: answer.file.text }], []);
   const [file, ...others] = read.ok ? read.files : [];
   if (file === void 0 || others.length > 0 || file.sha256 !== answer.file.sha256 || file.statements.length !== answer.file.statements) {
-    throw new CliError(ADOPT_SENTENCES2.notAsRecorded(installFor(creds.apiOrigin).cli));
+    throw new CliError(ADOPT_SENTENCES2.notAsRecorded(installFor(creds.apiOrigin)));
   }
   const path = await writeAdopted(projectDir, answer.file.text);
   const { recordLocalAdoption: recordLocalAdoption2 } = await Promise.resolve().then(() => (init_migrations_local(), migrations_local_exports));
@@ -8991,6 +9964,137 @@ function formatMigrationsListing(listing, app) {
   return lines;
 }
 
+// packages/cli/src/args.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "json",
+  "help",
+  "create",
+  "no-create",
+  "no-skill",
+  "print",
+  "server",
+  "force",
+  "errors",
+  "follow",
+  "fast",
+  "verbose",
+  "yes"
+]);
+var EVERYWHERE = {
+  values: ["org", "app"],
+  // `create` was the flag a deploy needed before an app was made by default, and is still read as the boolean it was, to no effect.
+  booleans: ["json", "no-create", "create", "help"]
+};
+function commandFlags(listed2, everywhere = true) {
+  return {
+    values: /* @__PURE__ */ new Set([...everywhere ? EVERYWHERE.values : [], ...listed2.values ?? []]),
+    booleans: /* @__PURE__ */ new Set([...everywhere ? EVERYWHERE.booleans : [], ...listed2.booleans ?? []]),
+    own: new Set(listed2.refusedByCommand ?? [])
+  };
+}
+var COMMAND_FLAGS = /* @__PURE__ */ new Map([
+  ["login", commandFlags({ values: ["token", "api"] })],
+  ["init", commandFlags({ booleans: ["server", "no-skill"] })],
+  ["skill", commandFlags({ booleans: ["print"] })],
+  // Only what it lists, as DEV_FLAGS in bin.ts does (OIM-887): `--json` and `--app` were always refused here.
+  ["dev", commandFlags({ values: ["user", "name", "role", "org", "port"], booleans: ["verbose"] }, false)],
+  ["apps", commandFlags({})],
+  // `--yes` changes nothing on a deploy: no flag answers for the person who approves a destructive file, and the
+  // help says so ("--yes included"). It is read, as the boolean it is, and ignored; an agent that passes it still deploys.
+  ["deploy", commandFlags({ booleans: ["yes"] })],
+  ["preview", commandFlags({ values: ["name", "delete"], refusedByCommand: ["delete"] })],
+  ["previews", commandFlags({})],
+  ["fetch", commandFlags({ values: ["preview", "method", "data", "header", "wait", "output"], refusedByCommand: ["preview"] })],
+  ["pull", commandFlags({ booleans: ["force"] })],
+  // Only what DELETE_FLAGS in bin.ts lists (OIM-918), and `--preview`, which that file refuses in a sentence about previews.
+  ["delete", commandFlags({ values: ["org", "app", "preview"], booleans: ["yes", "json"], refusedByCommand: ["preview"] }, false)],
+  ["share", commandFlags({ values: ["role"] })],
+  ["unshare", commandFlags({})],
+  ["visibility", commandFlags({})],
+  ["transfer", commandFlags({})],
+  ["move", commandFlags({ values: ["to"] })],
+  ["orgs", commandFlags({ values: ["name"] })],
+  ["members", commandFlags({ values: ["role"] })],
+  ["versions", commandFlags({})],
+  ["rollback", commandFlags({})],
+  ["migrations", commandFlags({ values: ["preview"] })],
+  ["schedules", commandFlags({})],
+  ["run", commandFlags({ values: ["preview"] })],
+  ["flows", commandFlags({ values: ["preview", "input", "input-file", "key"], booleans: ["fast"] })],
+  ["runs", commandFlags({ values: ["flow", "status", "limit", "preview", "data", "from"] })],
+  ["logs", commandFlags({ values: ["since", "kind", "limit", "cursor", "run", "ray", "search", "preview"], booleans: ["errors", "follow"] })],
+  ["egress", commandFlags({ values: ["since", "run", "limit", "cursor"] })],
+  ["connections", commandFlags({ values: ["secret-file", "bearer", "hosts", "kind", "name"] })],
+  ["whoami", commandFlags({})]
+]);
+function takesValue(command, name) {
+  const table = command === void 0 ? void 0 : COMMAND_FLAGS.get(command);
+  return table === void 0 ? !BOOLEAN_FLAGS.has(name) : table.values.has(name);
+}
+function parseArgs(argv) {
+  const positional = [];
+  const flags = /* @__PURE__ */ new Map();
+  const valueless = /* @__PURE__ */ new Set();
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i] ?? "";
+    if (!token.startsWith("--")) {
+      positional.push(token);
+      continue;
+    }
+    const name = token.slice(2);
+    if (!takesValue(positional[0], name)) {
+      flags.set(name, true);
+      continue;
+    }
+    const next = argv[i + 1];
+    if (next !== void 0 && !next.startsWith("--")) {
+      flags.set(name, next);
+      i += 1;
+    } else {
+      flags.set(name, true);
+      valueless.add(name);
+    }
+  }
+  return { command: positional.shift() ?? "help", positional, flags, valueless };
+}
+function textFlag(args2, name) {
+  const value = args2.flags.get(name);
+  if (value === true) throw needsValue(args2, name);
+  return value;
+}
+function needsValue(args2, name) {
+  return new CliError(`--${name} needs a value.`, `wirl ${args2.command} --help lists what each flag takes.`, { code: "bad_flag" });
+}
+var NAMED_FLAGS = 6;
+function refuseUnknownFlags(args2, allowed) {
+  const unknown = [...args2.flags.keys()].filter((name) => !allowed.has(name));
+  if (unknown.length === 0) return;
+  const shown2 = unknown.map((name) => {
+    const equals = name.indexOf("=");
+    return equals === -1 ? `--${name}` : `--${name.slice(0, equals)}=\u2026`;
+  });
+  const named = unknown.length > NAMED_FLAGS ? `${shown2.slice(0, NAMED_FLAGS).join(", ")} or ${String(unknown.length - NAMED_FLAGS)} more flags` : `${unknown.length === 1 ? shown2[0] : `${shown2.slice(0, -1).join(", ")} or ${shown2.at(-1)}`} flag`;
+  const withValue = unknown.find((name) => name.includes("="));
+  const where = withValue === void 0 ? "" : withValue.slice(0, withValue.indexOf("="));
+  throw new CliError(
+    `wirl ${args2.command} has no ${named}.`,
+    `wirl ${args2.command} --help lists the flags it takes.${withValue === void 0 ? "" : ` A flag's value is the next word, as in --${where} <value>, not --${where}=<value>.`}`,
+    { code: "bad_flag" }
+  );
+}
+var EMPTY_IS_NONE = /* @__PURE__ */ new Set(["token", "api", "preview", "org", "app"]);
+function refuseBadFlags(args2) {
+  const table = COMMAND_FLAGS.get(args2.command);
+  if (table === void 0) return;
+  refuseUnknownFlags(args2, /* @__PURE__ */ new Set([...table.values, ...table.booleans]));
+  for (const name of args2.valueless) {
+    if (table.values.has(name) && !table.own.has(name)) throw needsValue(args2, name);
+  }
+  for (const [name, value] of args2.flags) {
+    if (value === "" && EMPTY_IS_NONE.has(name) && table.values.has(name) && !table.own.has(name)) throw needsValue(args2, name);
+  }
+}
+
 // packages/cli/src/dev.ts
 init_src();
 import { readdirSync as readdirSync2, realpathSync, statSync, watch as watchFolder } from "node:fs";
@@ -9298,7 +10402,12 @@ async function startLocalBroker(options) {
   const keysPath = join6(options.dir, KEYS_FILE);
   const log = options.log ?? (() => {
   });
-  const transport = createBrokerTransport({ fetchImpl: options.fetchImpl, pinning: options.pinning });
+  const transport = createBrokerTransport({
+    fetchImpl: options.fetchImpl,
+    pinning: options.pinning,
+    heldBodyLimits: options.heldBodyLimits,
+    heldAnswerLimits: options.heldAnswerLimits
+  });
   const mocks = options.mocks ?? /* @__PURE__ */ new Map();
   const fetchImpl = mocks.size === 0 ? transport.fetchImpl : routeToMocks(
     options.manifest,
@@ -9316,6 +10425,11 @@ async function startLocalBroker(options) {
         connectionsFor: async () => localConnections(options.manifest, await readLocalKeys(options.dir), keysPath, mocks),
         fetchImpl,
         streamSlots: transport.streamSlots,
+        // This response, so that an event stream wirl cut waits for its
+        // closing event to leave before the connection is cut (OIM-837).
+        streamSent: sentOn(outgoing),
+        heldBodies: transport.heldBodies,
+        heldAnswers: transport.heldAnswers,
         audit: (entry) => {
           log(
             `wirl dev \xB7 ${entry.connection || "(no connection)"} ${entry.method} ${entry.host || ""} \u2192 ${entry.outcome}${entry.status ? ` ${entry.status}` : ""}`
@@ -9867,7 +10981,9 @@ var DEV_RELOAD_NOTE = `The server module, and every file it imports, is rebuilt
 var DEV_KEYS_NOTE = `Keys come from .wirl/keys.json, in the shape this prints for each connection that has none. To try a connection without its key, map it to a server of your own in .wirl/mocks.json, like { "anthropic": "http://127.0.0.1:4010" }. A call to one of that connection's declared hosts then goes to that URL instead, its path added to the URL's own and its query kept. It carries the key from .wirl/keys.json, or, when that has none, the placeholder "wirl-dev-mock" in the shape of the connection's kind. With no key there, an http_header connection sends no key header, since only .wirl/keys.json names the header, and a none connection never sends one. A host the connection does not declare is refused as before. .wirl/mocks.json is read once, at start, and never uploaded.`;
 var DEV_FLAGS_NOTE = "A flag not listed below, other than --help, is refused, not ignored.";
 var DEV_TWO_PEOPLE_NOTE = "To try two people on one app, run wirl dev a second time in the same folder with another --user: the two share .wirl/local.sqlite, so each sees what the other writes.";
-var PREVIEW_LINK_WARNING = "Whoever opens this link in the next 15 minutes is signed in as you: open it in your browser, and do not share it, save it or put it in a file. To check a page or a stream from a script, use wirl fetch.";
+var PREVIEW_LINK_MINUTES = String(VISIT_TOKEN_TTL_SECONDS / 60);
+var PREVIEW_PASS_MINUTES = String(GRANT_TTL_DEFAULT_SECONDS / 60);
+var PREVIEW_LINK_WARNING = `Whoever holds this link is signed in as you when they open it, like a password: it works for ${PREVIEW_LINK_MINUTES} minutes, and the sign-in it gives a browser lasts ${PREVIEW_PASS_MINUTES} minutes. Open it in your browser, and do not share it, save it or put it in a file. To check a page or a stream from a script, use wirl fetch.`;
 var USAGE = `wirl \u2014 deploy an app somewhere real, behind a sign-in
 
   wirl login                    Sign in from this terminal (or --token wirl_...)
@@ -9884,6 +11000,7 @@ var USAGE = `wirl \u2014 deploy an app somewhere real, behind a sign-in
   wirl apps restore <name>      Bring a deleted app back, inside its ${GRACE_DAYS} days (its owner while a member, or an organisation owner or admin)
   wirl delete [app] [--yes]     Delete an app: restorable for ${GRACE_DAYS} days, and its name stays taken
   wirl share <email> [--role viewer|editor]
+  wirl unshare <email>          Take a person's share back (an invitation waiting for them too)
   wirl visibility [private|org] See or change who can open the app (public is a person's click on its Access page)
   wirl transfer <email>         Hand the app to a new owner (you keep editor access)
   wirl move --to <org>          Move the app to another organisation you belong to
@@ -9917,6 +11034,7 @@ Options
   --app <slug>    App. Defaults to wirl.json or the directory name.
   --no-create     Fail instead of creating an app that does not exist yet.
   --json          Machine-readable output.
+  --version       Print the version of wirl you are running, as the first word: wirl --version.
 
 wirl <command> --help for a command's flags and an example.
 `;
@@ -9968,7 +11086,7 @@ ${DEV_FLAGS_NOTE}`,
   },
   deploy: {
     usage: ["wirl deploy [dir] [--org <slug>] [--app <slug>] [--no-create] [--json]"],
-    note: `[dir] defaults to wirl.json's "dir", else the current folder. A [dir] with a wirl.json of its own is a project: that wirl.json is the one used (app, org, server, static) and its "dir" is relative to it. A [dir] without one is build output: the wirl.json here is used and that folder goes up. A .wirlignore at its root keeps extra files out of the upload. New files in migrations/ are applied to the app's database before the version goes live; one that fails fails the deploy, and the version already live, if any, keeps serving. A destructive file (one wirl.json's "destructive" list must name) waits for a person before it applies to the live database: the deploy is refused with the address of a page where a person approves it. Run at a terminal, signed in as yourself (not with a deploy token) and without --json, wirl deploy shows the file's destructive lines and asks the person to type its name instead. No flag skips the person, --yes included. A preview never asks.`,
+    note: `[dir] defaults to wirl.json's "dir", else the current folder. A [dir] with a wirl.json of its own is a project: that wirl.json is the one used (app, org, server, static) and its "dir" is relative to it. A [dir] without one is build output: the wirl.json here is used and that folder goes up. A .wirlignore at its root keeps extra files out of the upload. New files in migrations/ are applied to the app's database before the version goes live; one that fails fails the deploy, and the version already live, if any, keeps serving. A destructive file (one wirl.json's "destructive" list must name) waits for a person before it applies to the live database: the deploy is refused with the address of a page where a person approves it. Run at a terminal, signed in as yourself (not with a deploy token) and without --json, wirl deploy shows the file's destructive lines and asks the person to type its name instead. No flag skips the person, --yes included. A preview never asks. ` + versionNumbersSentence("wirl versions"),
     flags: [
       ORG_FLAG,
       APP_FLAG,
@@ -10047,13 +11165,19 @@ ${DEV_FLAGS_NOTE}`,
   share: {
     usage: ["wirl share <email> [--role viewer|editor] [--org <slug>] [--app <slug>] [--json]"],
     flags: [
-      { flag: "--role viewer|editor", desc: "Access level. Defaults to viewer." },
+      { flag: "--role viewer|editor", desc: "Access level. A new person is a viewer; someone who already has access keeps their role unless you name one." },
       ORG_FLAG,
       APP_FLAG,
       JSON_FLAG
     ],
     example: "wirl share sam@acme.test --role editor"
   },
+  unshare: {
+    usage: ["wirl unshare <email> [--org <slug>] [--app <slug>] [--json]"],
+    note: "With --json, shareRevoked and invitationWithdrawn say what was taken and appDeleted whether the app was deleted; revoked is always true (the request was carried out).",
+    flags: [ORG_FLAG, APP_FLAG, JSON_FLAG],
+    example: "wirl unshare sam@acme.test"
+  },
   transfer: {
     usage: ["wirl transfer <email> [--org <slug>] [--app <slug>] [--json]"],
     flags: [ORG_FLAG, APP_FLAG, JSON_FLAG],
@@ -10192,6 +11316,7 @@ wirl migrations adopt runs once, for an app whose own code made its tables: the
       "wirl logs [--since 1h] [--errors] [--follow] [--limit n] [--cursor n]",
       "          [--kind <kind>] [--run <id>] [--ray <id>] [--search <text>] [--preview <name>] [--org <slug>] [--app <slug>] [--json]"
     ],
+    note: EDGE_REFUSALS_NOTE,
     flags: [
       { flag: "--since <window>", desc: "How far back to look, e.g. 1h, 30m. Defaults to 1h." },
       { flag: "--errors", desc: "Only failed requests." },
@@ -10316,11 +11441,10 @@ function personAt(input, output) {
 }
 
 // packages/cli/src/bin.ts
-var out = (line = "") => process.stdout.write(`${escapeInvisible(line)}
+var out = (line = "") => process.stdout.write(`${terminalSafe(line)}
 `);
-var err = (line = "") => process.stderr.write(`${escapeInvisible(line)}
+var err = (line = "") => process.stderr.write(`${terminalSafe(line)}
 `);
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "help", "create", "no-create", "no-skill", "print", "server", "force", "errors", "follow", "fast", "verbose", "yes"]);
 function readTypedLine(question) {
   return new Promise((done) => {
     const typed = createInterface2({ input: process.stdin, output: process.stderr, terminal: false });
@@ -10328,7 +11452,7 @@ function readTypedLine(question) {
     typed.on("close", () => {
       if (!answered) done(null);
     });
-    process.stderr.write(escapeInvisible(question));
+    process.stderr.write(terminalSafe(question));
     typed.once("line", (line) => {
       answered = true;
       typed.close();
@@ -10336,39 +11460,6 @@ function readTypedLine(question) {
     });
   });
 }
-function parseArgs(argv) {
-  const positional = [];
-  const flags = /* @__PURE__ */ new Map();
-  for (let i = 0; i < argv.length; i += 1) {
-    const token = argv[i] ?? "";
-    if (token.startsWith("--")) {
-      const name = token.slice(2);
-      const next = argv[i + 1];
-      if (!BOOLEAN_FLAGS.has(name) && next !== void 0 && !next.startsWith("--")) {
-        flags.set(name, next);
-        i += 1;
-      } else {
-        flags.set(name, true);
-      }
-    } else {
-      positional.push(token);
-    }
-  }
-  return { command: positional.shift() ?? "help", positional, flags };
-}
-function textFlag(args2, name) {
-  const value = args2.flags.get(name);
-  if (value === true) {
-    throw new CliError(`--${name} needs a value.`, `wirl ${args2.command} --help lists what each flag takes.`, { code: "bad_flag" });
-  }
-  return value;
-}
-function refuseUnknownFlags(args2, allowed) {
-  const unknown = [...args2.flags.keys()].filter((name) => !allowed.has(name)).map((name) => `--${name}`);
-  if (unknown.length === 0) return;
-  const named = unknown.length === 1 ? unknown[0] : `${unknown.slice(0, -1).join(", ")} or ${unknown.at(-1)}`;
-  throw new CliError(`wirl ${args2.command} has no ${named} flag.`, `wirl ${args2.command} --help lists the flags it takes.`, { code: "bad_flag" });
-}
 var NAMED_WORDS = 6;
 function nameWords(words) {
   const shown2 = words.map((word) => word === "" ? '""' : word);
@@ -10395,6 +11486,8 @@ function parsePortFlag(raw) {
   }
   return port;
 }
+var unknownMembersCommand = (sub) => new CliError(`Unknown members command: ${sub}`, "wirl members list | add <email> --role | role <email> --role | remove <email>");
+var unknownConnectionsCommand = (sub) => new CliError(`Unknown: wirl connections ${sub}`, "list, create, rotate, delete, show, grants, pending, approve, revoke, request");
 var RUNS_SUBCOMMANDS = /* @__PURE__ */ new Set(["show", "send", "cancel", "retry"]);
 var REFUSES_AS_JSON = /* @__PURE__ */ new Set(["flows", "runs"]);
 var refusesAsJson = (args2) => args2.flags.has("json") && REFUSES_AS_JSON.has(args2.command);
@@ -10411,6 +11504,10 @@ async function resolveTarget(creds, args2, dir) {
 var args = parseArgs(process.argv.slice(2).map((token) => token === "-h" ? "--help" : token));
 async function main() {
   const json2 = args.flags.has("json");
+  if (process.argv[2] === "--version" || process.argv[2] === "-v") {
+    out(wirlVersion());
+    return 0;
+  }
   if (args.command === "help") {
     if (!args.flags.has("help")) {
       refuseExtraPositionals("help", args.positional, 1, "one command", { hint: "A command's help lists its subcommands: wirl help <command>." });
@@ -10424,9 +11521,12 @@ async function main() {
     return 0;
   }
   if (args.command === "login") {
+    refuseBadFlags(args);
     refuseExtraPositionals("login", args.positional, 0, "no argument", { secret: true, hint: "A token goes after --token: wirl login --token <token>." });
-    const token = String(args.flags.get("token") ?? "").trim();
-    const apiOrigin = String(args.flags.get("api") ?? apiOriginFromEnv()).replace(/\/+$/, "");
+    const given = textFlag(args, "token");
+    const token = (given ?? "").trim();
+    if (given !== void 0 && token === "") throw needsValue(args, "token");
+    const apiOrigin = String(textFlag(args, "api") ?? apiOriginFromEnv()).replace(/\/+$/, "");
     if (token) {
       out(`Saved to ${await saveCredentials({ apiOrigin, token })}`);
       return 0;
@@ -10447,6 +11547,7 @@ async function main() {
     return 0;
   }
   if (args.command === "init") {
+    refuseBadFlags(args);
     refuseExtraPositionals("init", args.positional, 1, "one folder", { hint: folderHint("The app's name goes after --app <name>.") });
     const dir = resolve6(args.positional[0] ?? ".");
     const app = String(args.flags.get("app") ?? basename4(dir));
@@ -10461,6 +11562,7 @@ async function main() {
     return 0;
   }
   if (args.command === "skill") {
+    refuseBadFlags(args);
     refuseExtraPositionals("skill", args.positional, 1, "one folder", { hint: folderHint() });
     if (args.flags.has("print")) {
       out(SKILL_MARKDOWN);
@@ -10472,6 +11574,7 @@ async function main() {
     return 0;
   }
   if (args.command === "dev") {
+    refuseBadFlags(args);
     refuseUnknownFlags(args, DEV_FLAGS);
     refuseExtraPositionals("dev", args.positional, 1, "one folder", { hint: folderHint() });
     const portFlag = textFlag(args, "port");
@@ -10509,6 +11612,7 @@ async function main() {
     return 0;
   }
   const creds = await loadCredentials();
+  refuseBadFlags(args);
   switch (args.command) {
     case "whoami": {
       refuseExtraPositionals("whoami", args.positional, 0, "no argument");
@@ -10727,6 +11831,8 @@ async function main() {
         });
       } else if (sub === "remove") {
         refuseExtraPositionals("members remove", args.positional.slice(1), 1, "one email", { hint: "Run it once for each person." });
+      } else {
+        throw unknownMembersCommand(sub);
       }
       const org = String(args.flags.get("org") ?? (await loadManifest("."))?.org ?? "") || (await resolveTarget(creds, args, ".")).org;
       if (sub === "list") {
@@ -10772,7 +11878,7 @@ async function main() {
         }
         return 0;
       }
-      throw new CliError(`Unknown members command: ${sub}`, "wirl members list | add <email> --role | role <email> --role | remove <email>");
+      throw unknownMembersCommand(sub);
     }
     case "connections": {
       const sub = args.positional[0] ?? "list";
@@ -10795,6 +11901,8 @@ async function main() {
         refuseExtraPositionals("connections show", words, 1, "one app", { hint: "wirl connections grants lists every app and what it uses (admins)." });
       } else if (sub === "approve" || sub === "revoke" || sub === "request") {
         refuseExtraPositionals(`connections ${sub}`, words, 2, "an app and a connection", { hint: "Run it once for each connection." });
+      } else {
+        throw unknownConnectionsCommand(sub);
       }
       const orgSlug = String(args.flags.get("org") ?? (await loadManifest("."))?.org ?? "");
       const org = orgSlug || (await resolveTarget(creds, args, ".")).org;
@@ -10912,7 +12020,7 @@ async function main() {
         out(`${sub === "approve" ? "Approved" : "Revoked"} ${slug} for ${app}.`);
         return 0;
       }
-      throw new CliError(`Unknown: wirl connections ${sub}`, "list, create, rotate, delete, show, grants, pending, approve, revoke, request");
+      throw unknownConnectionsCommand(sub);
     }
     case "delete": {
       const preview = args.flags.get("preview");
@@ -10994,6 +12102,7 @@ async function main() {
     case "visibility": {
       refuseExtraPositionals("visibility", args.positional, 1, "one level");
       const level = args.positional[0];
+      if (level) refuseVisibilityLevel(level);
       const target = await resolveTarget(creds, args, ".");
       const now = level ? await changeVisibility(creds, { org: target.org, app: target.app, level }) : await readVisibility(creds, target.org, target.app);
       out(json2 ? JSON.stringify({ visibility: now }) : describeVisibility(now, target.org));
@@ -11005,12 +12114,23 @@ async function main() {
       });
       const email = args.positional[0];
       if (!email) throw new CliError("Who should it be shared with?", "wirl share someone@company.com");
-      const role = args.flags.get("role") === "editor" ? "editor" : "viewer";
+      const role = refuseShareRole(args.flags.get("role"));
       const target = await resolveTarget(creds, args, ".");
       const result = await shareApp(creds, target.org, target.app, email, role);
-      out(
-        json2 ? JSON.stringify(result) : result.pending ? `Invited ${email} as ${role}. They will have access the moment they first sign in.${unmailedNote(result)}` : `Shared with ${email} as ${role}.`
-      );
+      out(json2 ? JSON.stringify(result) : shareSentence(result, email, role, "cli"));
+      return 0;
+    }
+    case "unshare": {
+      refuseExtraPositionals("unshare", args.positional, 1, "one email", {
+        hint: "Take back one person's whole share at a time. To change a role instead, use wirl share --role."
+      });
+      const email = args.positional[0];
+      if (!email) throw new CliError("Whose access?", "wirl unshare someone@company.com");
+      const target = await resolveTarget(creds, args, ".");
+      if (!isWellFormedSlug(target.app)) throw new CliError(`"${target.app}" is not an app's name, so nothing was changed.`, void 0, { code: "bad_name" });
+      if (!isWellFormedSlug(target.org)) throw new CliError(`"${target.org}" is not an organisation's name, so nothing was changed.`, void 0, { code: "bad_name" });
+      const result = await unshareApp(creds, target.org, target.app, email);
+      out(json2 ? JSON.stringify(result) : unshareSentence(result, email));
       return 0;
     }
     case "versions": {