wirl 0.2.1 → 0.2.3

package/bin.js

@@ -15,10 +15,14 @@ var __export = (target, all) => {
 };
 
 // packages/core/src/types.ts
-var AppKind;
+var AppRole, AppKind;
 var init_types = __esm({
   "packages/core/src/types.ts"() {
     "use strict";
+    AppRole = {
+      VIEWER: "viewer",
+      EDITOR: "editor"
+    };
     AppKind = {
       STATIC: "static",
       SERVICE: "service",
@@ -189,9 +193,33 @@ function validateSlug(input) {
 function isWellFormedSlug(input) {
   return typeof input === "string" && input.length >= SLUG_MIN && input.length <= SLUG_MAX && SLUG_RE.test(input) && !input.includes(HOST_SEPARATOR);
 }
-function slugify(input) {
-  const base = input.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, SLUG_MAX).replace(/-$/, "");
-  return isValidSlug(base) ? base : null;
+function slugBase(input) {
+  return input.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, SLUG_MAX).replace(/-$/, "");
+}
+function previewSlugFor(raw) {
+  const base = slugBase(raw);
+  switch (validateSlug(base).problem) {
+    case void 0:
+      return { ok: true, slug: base };
+    case "reserved":
+      return {
+        ok: false,
+        problem: "reserved",
+        message: `The preview name "${base}" is reserved. The reserved preview names are: ${[...RESERVED_SLUGS].sort().join(", ")}. Pick another name.`
+      };
+    case "too_short":
+      return {
+        ok: false,
+        problem: "too_short",
+        message: `That name is too short: it makes a preview name of one character, and a preview name needs at least ${String(SLUG_MIN)}.`
+      };
+    default:
+      return {
+        ok: false,
+        problem: "no_characters",
+        message: "That name has no usable characters: a preview name is made of the letters a to z and the digits 0 to 9 in what you give it, and none are left."
+      };
+  }
 }
 function appLabel(orgSlug, appSlug) {
   return `${orgSlug}${HOST_SEPARATOR}${appSlug}`;
@@ -384,13 +412,14 @@ async function readSigned(key, token) {
   }
   return { ok: true, claims };
 }
-var encoder, decoder2, PREFIX, SKEW_SECONDS;
+var encoder, decoder2, PREFIX, GRANT_TTL_DEFAULT_SECONDS, SKEW_SECONDS;
 var init_token = __esm({
   "packages/core/src/token.ts"() {
     "use strict";
     encoder = new TextEncoder();
     decoder2 = new TextDecoder();
     PREFIX = "w1";
+    GRANT_TTL_DEFAULT_SECONDS = 12 * 60;
     SKEW_SECONDS = 60;
   }
 });
@@ -569,10 +598,19 @@ var init_egress = __esm({
     PinnedFetchError = class extends Error {
       reason;
       host;
-      constructor(reason, host, message) {
+      /**
+       * Set only on a timeout that ended an answer already under way, whose body
+       * the fetch bounds itself (the broker's streams): which bound it was, the
+       * time since the headers or the time with nothing moving, and its length in
+       * milliseconds. The broker reads it to say what it cut a stream for.
+       * Undefined on every other failure.
+       */
+      streamBound;
+      constructor(reason, host, message, streamBound) {
         super(message);
         this.reason = reason;
         this.host = host;
+        this.streamBound = streamBound;
       }
     };
     PRIVATE_V4 = /^(0\.|10\.|127\.|169\.254\.|192\.0\.0\.|192\.168\.|198\.1[89]\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|(22[4-9]|23[0-9]|24[0-9]|25[0-5])\.)/;
@@ -2301,6 +2339,9 @@ var init_migrations = __esm({
       leaseMs: 6e5,
       orgApplies: 2,
       // per org: the limit one tenant's applies meet
+      // Per app, its live database and its previews' together, inside the org's
+      // two, so one app's deployers can never take both (OIM-927).
+      appApplies: 1,
       // Per control-plane process. The lease holds no pooled connection, so this
       // bounds the process's work, not its pool; at `orgApplies` two each,
       // filling it takes eight orgs (T5b-6).
@@ -2936,6 +2977,9 @@ function parseManifest(input) {
     }
     accent = rawAccent;
   }
+  const rawVisibility = raw["visibility"];
+  if (rawVisibility !== void 0 && rawVisibility !== "private") return refuse(VISIBILITY_REFUSED);
+  const visibility = rawVisibility === "private" ? { visibility: "private" } : {};
   const flowResult = parseFlows(raw);
   if (!flowResult.ok) return refuse(flowResult.message);
   const flows = flowResult.flows;
@@ -2954,7 +2998,7 @@ function parseManifest(input) {
     if (!publicPathsResult2.ok) return refuse(publicPathsResult2.message);
     return {
       ok: true,
-      manifest: { runtime, connections: [], description, accent, schedules, flows, publicPaths: publicPathsResult2.publicPaths, static: staticFiles, migrations },
+      manifest: { runtime, connections: [], description, accent, schedules, flows, publicPaths: publicPathsResult2.publicPaths, static: staticFiles, migrations, ...visibility },
       warnings
     };
   }
@@ -3013,11 +3057,11 @@ function parseManifest(input) {
   if (!publicPathsResult.ok) return refuse(publicPathsResult.message);
   return {
     ok: true,
-    manifest: { runtime, connections, description, accent, schedules, flows, publicPaths: publicPathsResult.publicPaths, static: staticFiles, migrations },
+    manifest: { runtime, connections, description, accent, schedules, flows, publicPaths: publicPathsResult.publicPaths, static: staticFiles, migrations, ...visibility },
     warnings
   };
 }
-var CONNECTION_KINDS, UNDELIVERED_KINDS, CREATABLE_CONNECTION_KINDS, needsNoKey, ACCENTS, SCHEDULE_LIMITS, MANIFEST_KEYS, QUIET_KEYS, UNKNOWN_KEYS_NAMED, KEY_SHOWN, squash, ONE_EDIT_MIN_LETTERS, pluralOf, SLUG, LABEL, HOST_PATTERN, refuse, asHint, SCHEDULE_NAME, TIMEOUT_PATTERN, TIMEOUT_MESSAGE, FLOW_KEYS, MIGRATIONS_KEYS;
+var CONNECTION_KINDS, UNDELIVERED_KINDS, CREATABLE_CONNECTION_KINDS, needsNoKey, ACCENTS, SCHEDULE_LIMITS, MANIFEST_KEYS, QUIET_KEYS, UNKNOWN_KEYS_NAMED, KEY_SHOWN, squash, ONE_EDIT_MIN_LETTERS, pluralOf, SLUG, LABEL, HOST_PATTERN, refuse, asHint, SCHEDULE_NAME, TIMEOUT_PATTERN, TIMEOUT_MESSAGE, FLOW_KEYS, MIGRATIONS_KEYS, VISIBILITY_REFUSED;
 var init_manifest = __esm({
   "packages/core/src/manifest.ts"() {
     "use strict";
@@ -3057,7 +3101,8 @@ var init_manifest = __esm({
       "server",
       "spa",
       "start",
-      "static"
+      "static",
+      "visibility"
     ]);
     QUIET_KEYS = Object.freeze(["$schema"]);
     UNKNOWN_KEYS_NAMED = 10;
@@ -3079,6 +3124,7 @@ var init_manifest = __esm({
     TIMEOUT_MESSAGE = (name) => `timeout for ${name} must be between 30s and 15m; a run longer than that should be split into resumable chunks.`;
     FLOW_KEYS = ["name", "step_timeout", "retries"];
     MIGRATIONS_KEYS = ["destructive"];
+    VISIBILITY_REFUSED = `visibility can only be "private": it sets who can open a new app when a deploy creates it. Change an existing app's visibility with wirl visibility.`;
   }
 });
 
@@ -3299,12 +3345,50 @@ var init_runtime = __esm({
 });
 
 // packages/core/src/broker-stream.ts
+function mediaTypeOf(headers) {
+  const declared = headers.get("content-type");
+  if (declared === null) return null;
+  return (declared.split(";")[0] ?? "").trim().toLowerCase();
+}
 function isStreamedAnswer(status, headers) {
   if (status < 200 || status > 299) return false;
-  const declared = headers.get("content-type");
-  if (declared === null) return false;
-  const media = (declared.split(";")[0] ?? "").trim().toLowerCase();
-  return STREAMED_MEDIA_TYPES.includes(media);
+  const media = mediaTypeOf(headers);
+  return media !== null && STREAMED_MEDIA_TYPES.includes(media);
+}
+function isEventStream(headers) {
+  return mediaTypeOf(headers) === "text/event-stream";
+}
+function closesWithEvent(headers) {
+  if (!isEventStream(headers)) return false;
+  const encoding = headers.get("content-encoding");
+  return encoding === null || encoding.trim().toLowerCase() === "identity";
+}
+function lengthOf(ms) {
+  const unit = (count, name) => `${count} ${name}${count === 1 ? "" : "s"}`;
+  if (ms % 6e4 === 0) return unit(ms / 6e4, "minute");
+  if (ms % 1e3 === 0) return unit(ms / 1e3, "second");
+  return `${ms} ms`;
+}
+function sayCut(cut2) {
+  switch (cut2.cause) {
+    case "size":
+      return `it reached wirl's limit of ${cut2.bytes % MIB === 0 ? `${cut2.bytes / MIB} MiB` : `${cut2.bytes} bytes`} for one answer.`;
+    case "time":
+      return `it was still open ${lengthOf(cut2.ms)} after the vendor began answering, the longest wirl allows.`;
+    case "idle":
+      return `nothing moved on it for ${lengthOf(cut2.ms)}, the longest wirl allows.`;
+    case "held":
+      return `it was still open ${lengthOf(cut2.ms)} after wirl began passing it on, the longest wirl allows.`;
+  }
+}
+function streamCutEvent(cut2) {
+  const data = JSON.stringify({ type: "error", error: { type: "api_error", message: `wirl cut this stream: ${sayCut(cut2)}` } });
+  return new TextEncoder().encode(`
+
+event: error
+data: ${data}
+
+`);
 }
 function createStreamSlots(perApp = BROKER_LIMITS.openStreamsPerApp) {
   const held = /* @__PURE__ */ new Map();
@@ -3329,7 +3413,7 @@ function createStreamSlots(perApp = BROKER_LIMITS.openStreamsPerApp) {
     }
   };
 }
-var BROKER_LIMITS, STREAMED_MEDIA_TYPES;
+var BROKER_LIMITS, STREAMED_MEDIA_TYPES, CUT_EVENT_RESERVE_BYTES, MIB;
 var init_broker_stream = __esm({
   "packages/core/src/broker-stream.ts"() {
     "use strict";
@@ -3346,20 +3430,369 @@ var init_broker_stream = __esm({
       streamIdleMs: 4 * 6e4,
       /** Bytes in any one answer, streamed or read whole. */
       answerBytes: 25 * 1024 * 1024,
+      /**
+       * Bytes in the body of any one call an app makes. The body is read whole
+       * before the call is sent, and before its grant is looked up, so a body
+       * past this never opens a key and never reaches a vendor (OIM-931).
+       * 100 MiB: Cloudflare publishes 100 MB as the request body its Free and
+       * Pro plans take, and a deployed app's call is first held whole by the
+       * egress Worker, in an isolate Cloudflare gives 128 MB of memory. Nothing
+       * else bounds a caller that holds a broker token and reaches the control
+       * plane itself: Railway sets no size on a body, only five minutes to send it.
+       */
+      requestBytes: 100 * 1024 * 1024,
+      /**
+       * Bytes of call bodies one app's calls hold at once, its previews' with
+       * them (OIM-951): counted as each chunk arrives, from a call's first byte
+       * until the broker has answered it (broker-bodies.ts). At least
+       * `requestBytes`, so one call at the cap always fits an app that holds
+       * nothing else; a quarter of `heldBodyBytes`, so four apps of four owners
+       * at their share fill the whole (one owner's apps cannot: `ownerHeldBodyBytes`).
+       */
+      appHeldBodyBytes: 128 * 1024 * 1024,
+      /**
+       * Bytes of call bodies the calls of every app one owner has hold at once,
+       * their previews' with them (OIM-967): the person `apps.owner_user_id`
+       * names, whichever organisations their apps are in. Apps and
+       * organisations cost nothing to create (no cap on either), so a share per
+       * app let one person with four apps fill the whole, and one per
+       * organisation would let them do it with four organisations; a person
+       * costs a sign-in. Two apps at their share, so one app that runs
+       * away still leaves its owner's other apps room, and half of
+       * `heldBodyBytes`, so one owner can never take more than half, and a
+       * second sign-in is what it takes to fill it. At least `requestBytes`, so
+       * one call at the cap always fits an owner whose apps hold nothing else.
+       */
+      ownerHeldBodyBytes: 256 * 1024 * 1024,
+      /**
+       * Bytes of call bodies every app's calls hold at once, in this process.
+       * A call's reader starts at 16 KiB and doubles its buffer as the body
+       * arrives, so the buffers behind this hold at most twice it, 1 GiB, and
+       * 16 KiB a call beside (the ruling in OIM-951).
+       */
+      heldBodyBytes: 512 * 1024 * 1024,
+      /** The `Retry-After` of a call refused for either. */
+      heldBodyRetryAfterSeconds: 10,
+      /**
+       * How long a call's body may send nothing before its read is stopped:
+       * an upload's (OIM-935). A deployed app's body comes from the egress
+       * Worker, which holds it whole before it sends it, and `wirl dev` reads it
+       * whole first, so no ordinary sender ever pauses (fix round 1, R1-F2).
+       */
+      heldBodyStallMs: 3e4,
+      /**
+       * How long a call's body may take to arrive whole: 100 MiB in 120 seconds
+       * is about 7 Mbit/s, which a body between Cloudflare and the control plane
+       * passes many times over, and well under Node's 300 seconds a request,
+       * after which the body would be cut anyway (fix round 1, R1-F2).
+       */
+      heldBodyArrivalMs: 12e4,
+      /**
+       * Bytes of answers read whole that one app's calls hold at once, its
+       * previews' with them (OIM-966): counted as each chunk arrives from the
+       * vendor, from an answer's first byte until wirl's server has taken the
+       * last of it, or the app has gone (broker-bodies.ts). A vendor's event
+       * stream is not counted: it is passed on as the app reads it, and holds
+       * about 285 to 441 KiB at a time, measured end to end through the control
+       * plane's server (`passOn` in broker.ts; OIM-966 fix round 1, R1-F3,
+       * R2-F2). More than two `answerBytes`, so two answers at the cap fit an
+       * app that holds nothing else; a quarter of `heldAnswerBytes`, so four apps
+       * of four owners at their share fill the whole (one owner's apps cannot:
+       * `ownerHeldAnswerBytes`).
+       */
+      appHeldAnswerBytes: 64 * 1024 * 1024,
+      /**
+       * Bytes of answers read whole that the calls of every app one owner has
+       * hold at once, their previews' with them (OIM-967), for the reasons
+       * `ownerHeldBodyBytes` gives: two apps at their share, half of
+       * `heldAnswerBytes`, and more than two `answerBytes` and than the room a
+       * call needs, so an owner whose apps hold nothing else can always send.
+       */
+      ownerHeldAnswerBytes: 128 * 1024 * 1024,
+      /**
+       * Bytes of answers read whole that every app's calls hold at once, in this
+       * process. An answer's reader doubles its buffer as it fills, as a body's
+       * does, and never past `answerBytes`, so while answers arrive the buffers
+       * behind this hold at most twice it, 512 MiB, and 16 KiB an answer beside;
+       * an answer read whole is copied to exactly its size before it is handed
+       * on, so from then its count is its memory (the ruling in OIM-966, and its
+       * fix round 1, R1-F2).
+       */
+      heldAnswerBytes: 256 * 1024 * 1024,
+      /**
+       * The room an app's share of answers, and the whole, must each have left
+       * for a call to be sent at all: one answer at the cap. With less, the call
+       * is refused with a 503 before it leaves wirl, rather than run at its
+       * vendor and its answer cut (OIM-966 fix round 1, R1-F1).
+       */
+      heldAnswerRoomBytes: 25 * 1024 * 1024,
+      /** The `Retry-After` of a call refused for that room, before it was sent. */
+      heldAnswerRetryAfterSeconds: 10,
+      /**
+       * How long an answer read whole may wait for wirl's server to take the
+       * last of it once it is handed back: past this it is cut, and its count
+       * goes back, so no app holds its share, or the whole, by not reading.
+       * Under Cloudflare's measured 125 seconds with nothing moving, which ends
+       * a deployed app's unread answer anyway (OIM-966 fix round 1, R1-F1).
+       */
+      heldAnswerHandOutMs: 12e4,
       /**
        * Streamed answers one app may have open at once. Each holds a vendor
        * socket and an inbound connection on one control-plane instance for up
        * to fourteen minutes, so one app cannot be allowed an unbounded number.
        * Counted in memory, per instance, like the control plane's other limits.
        */
-      openStreamsPerApp: 20
+      openStreamsPerApp: 20,
+      /**
+       * How long an event stream wirl cut waits for its closing event to leave
+       * the server before it ends the stream with its error anyway (OIM-837 fix
+       * round 1). The event is on its way when the server's queue of what it has
+       * to write has emptied; a reader that is slow but reading empties a full
+       * kernel buffer, a few hundred kilobytes, well inside this. Past it the
+       * reader is not reading, and the stream ends as it always did; the write
+       * stall that holds a connection longer than this is OIM-968's.
+       */
+      cutEventSentMs: 5e3
     };
     STREAMED_MEDIA_TYPES = Object.freeze(["text/event-stream", "application/x-ndjson"]);
+    CUT_EVENT_RESERVE_BYTES = 512;
+    MIB = 1024 * 1024;
+  }
+});
+
+// packages/core/src/refusals.ts
+function sayAtMostEvery(log, now, everyMs = SAY_EVERY_MS) {
+  let since = 0;
+  let saidAt = Number.NEGATIVE_INFINITY;
+  return (line) => {
+    since += 1;
+    const at2 = now();
+    if (at2 - saidAt < everyMs) return;
+    const text = line(since, at2);
+    since = 0;
+    saidAt = at2;
+    try {
+      log(text);
+    } catch {
+    }
+  };
+}
+var SAY_EVERY_MS, MiB, sizeOf;
+var init_refusals = __esm({
+  "packages/core/src/refusals.ts"() {
+    "use strict";
+    SAY_EVERY_MS = 3e4;
+    MiB = 1024 * 1024;
+    sizeOf = (bytes) => bytes >= MiB ? `${String(Math.floor(bytes / MiB))} MiB` : `${String(Math.ceil(bytes / 1024))} KiB`;
+  }
+});
+
+// packages/core/src/wait-clock.ts
+var systemWaitClock;
+var init_wait_clock = __esm({
+  "packages/core/src/wait-clock.ts"() {
+    "use strict";
+    systemWaitClock = {
+      wait(ms) {
+        let timer;
+        const done = new Promise((resolve7) => {
+          timer = setTimeout(resolve7, ms);
+          timer.unref?.();
+        });
+        return { done, cancel: () => clearTimeout(timer) };
+      }
+    };
+  }
+});
+
+// packages/core/src/broker-bodies.ts
+function heldBodyRefusal(limits, why) {
+  const again = `Send it again in ${String(limits.heldBodyRetryAfterSeconds)} seconds.`;
+  if (why === "app") {
+    return {
+      error: "app_bodies_full",
+      message: `This call's body would take the bodies this app's calls hold at once past ${sizeOf(limits.appHeldBodyBytes)}, the most one app's calls may hold, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_bodies_full",
+      message: `This call's body would take the bodies held at once for the calls of all the apps this app's owner has past ${sizeOf(limits.ownerHeldBodyBytes)}, the most one owner's apps may hold together, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+    };
+  }
+  return {
+    error: "bodies_full",
+    message: `This call's body would take the bodies wirl holds for all apps' calls at once past ${sizeOf(limits.heldBodyBytes)}, the most it holds, so wirl stopped the call there and sent nothing to the vendor. ${again}`
+  };
+}
+function heldBodyCut(limits, why) {
+  if (why === "stalled") {
+    return {
+      error: "body_stalled",
+      message: `Nothing of this call's body arrived for ${String(limits.heldBodyStallMs / 1e3)} seconds, so wirl stopped the call there and sent nothing to the vendor. Send it again.`
+    };
+  }
+  return {
+    error: "body_too_slow",
+    message: `This call's body had not all arrived after ${String(limits.heldBodyArrivalMs / 1e3)} seconds, the longest wirl waits for one, so wirl stopped the call there and sent nothing to the vendor. Send it again.`
+  };
+}
+function heldAnswerRefusal(limits, why) {
+  const acted = "The vendor may have acted on the call: send it again only if repeating it is safe.";
+  if (why === "app") {
+    return {
+      error: "app_answers_full",
+      message: `The vendor received this call and answered it, but its answer would take the answers this app's calls hold at once past ${sizeOf(limits.appHeldAnswerBytes)}, the most one app's calls may hold, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_answers_full",
+      message: `The vendor received this call and answered it, but its answer would take the answers held at once for the calls of all the apps this app's owner has past ${sizeOf(limits.ownerHeldAnswerBytes)}, the most one owner's apps may hold together, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+    };
+  }
+  return {
+    error: "answers_full",
+    message: `The vendor received this call and answered it, but its answer would take the answers wirl holds for all apps' calls at once past ${sizeOf(limits.heldAnswerBytes)}, the most it holds, so wirl stopped reading the answer there and passed none of it on. ${acted}`
+  };
+}
+function heldAnswerNoRoom(limits, why) {
+  const again = `Send it again in ${String(limits.heldAnswerRetryAfterSeconds)} seconds.`;
+  if (why === "app") {
+    return {
+      error: "app_no_answer_room",
+      message: `The answers this app's calls hold at once leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.appHeldAnswerBytes)} one app's calls may hold, the room wirl keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+    };
+  }
+  if (why === "owner") {
+    return {
+      error: "owner_no_answer_room",
+      message: `The answers held at once for the calls of all the apps this app's owner has leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.ownerHeldAnswerBytes)} one owner's apps may hold together, the room wirl keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+    };
+  }
+  return {
+    error: "no_answer_room",
+    message: `The answers wirl holds for all apps' calls at once leave less than ${sizeOf(limits.heldAnswerRoomBytes)} of the ${sizeOf(limits.heldAnswerBytes)} it holds, the room it keeps for one more answer, so wirl did not send this call, and nothing of it reached the vendor. ${again}`
+  };
+}
+function createHeldBodies(options = {}) {
+  const limits = options.limits ?? {
+    appHeldBodyBytes: BROKER_LIMITS.appHeldBodyBytes,
+    ownerHeldBodyBytes: BROKER_LIMITS.ownerHeldBodyBytes,
+    heldBodyBytes: BROKER_LIMITS.heldBodyBytes,
+    heldBodyRetryAfterSeconds: BROKER_LIMITS.heldBodyRetryAfterSeconds,
+    heldBodyStallMs: BROKER_LIMITS.heldBodyStallMs,
+    heldBodyArrivalMs: BROKER_LIMITS.heldBodyArrivalMs
+  };
+  return {
+    limits,
+    clock: options.clock ?? systemWaitClock,
+    ...countHeld("bodies", limits.appHeldBodyBytes, limits.ownerHeldBodyBytes, limits.heldBodyBytes, options)
+  };
+}
+function createHeldAnswers(options = {}) {
+  const limits = options.limits ?? {
+    appHeldAnswerBytes: BROKER_LIMITS.appHeldAnswerBytes,
+    ownerHeldAnswerBytes: BROKER_LIMITS.ownerHeldAnswerBytes,
+    heldAnswerBytes: BROKER_LIMITS.heldAnswerBytes,
+    heldAnswerRoomBytes: BROKER_LIMITS.heldAnswerRoomBytes,
+    heldAnswerRetryAfterSeconds: BROKER_LIMITS.heldAnswerRetryAfterSeconds,
+    heldAnswerHandOutMs: BROKER_LIMITS.heldAnswerHandOutMs
+  };
+  const { short, ...count } = countHeld("answers", limits.appHeldAnswerBytes, limits.ownerHeldAnswerBytes, limits.heldAnswerBytes, options);
+  return {
+    limits,
+    clock: options.clock ?? systemWaitClock,
+    ...count,
+    roomFor: (appId, ownerId) => short(appId, ownerId, limits.heldAnswerRoomBytes)
+  };
+}
+function countHeld(what, appBytes, ownerBytes, allBytes, options) {
+  const say = options.log === void 0 ? null : sayAtMostEvery(options.log, options.now ?? Date.now);
+  const byApp = /* @__PURE__ */ new Map();
+  const byOwner = /* @__PURE__ */ new Map();
+  let total = 0;
+  const named = (owner) => typeof owner === "string" && owner.length > 0 ? owner : null;
+  const bump = (table, key, bytes) => {
+    const next = (table.get(key) ?? 0) + bytes;
+    if (next === 0) table.delete(key);
+    else table.set(key, next);
+  };
+  const add = (appId, ownerId, bytes) => {
+    bump(byApp, appId, bytes);
+    if (ownerId !== null) bump(byOwner, ownerId, bytes);
+    total += bytes;
+  };
+  const passes = (appId, ownerId, bytes) => (byApp.get(appId) ?? 0) + bytes > appBytes ? "app" : ownerId !== null && (byOwner.get(ownerId) ?? 0) + bytes > ownerBytes ? "owner" : total + bytes > allBytes ? "all" : null;
+  const refused2 = (why, appId, ownerId) => {
+    say?.((since) => {
+      let most = ["nobody", 0];
+      for (const entry of byApp) if (entry[1] > most[1]) most = entry;
+      const who = why === "owner" && ownerId !== null ? `, owned by ${ownerId} (whose apps hold ${String(byOwner.get(ownerId) ?? 0)} bytes; ${String(byOwner.size)} ${byOwner.size === 1 ? "owner holds" : "owners hold"} any)` : "";
+      return `wirl: refused ${String(since)} ${since === 1 ? "broker call" : "broker calls"} for the ${what} held at once since this line was last written (at most once every 30 seconds), the latest for ${why === "app" ? "its app's share" : why === "owner" ? "its owner's share" : "the whole"}, from ${appId}${who}; ${String(total)} of ${String(allBytes)} bytes held, by ${String(byApp.size)} ${byApp.size === 1 ? "app" : "apps"}, the most by ${most[0]} (${String(most[1])} bytes)`;
+    });
+  };
+  return {
+    open(appId, owner) {
+      const ownerId = named(owner);
+      let counted = 0;
+      let refusal = null;
+      let done = false;
+      return {
+        arrive(bytes) {
+          if (done || !isSize(bytes)) return false;
+          const why = passes(appId, ownerId, bytes);
+          if (why !== null) {
+            refusal = why;
+            refused2(why, appId, ownerId);
+            return false;
+          }
+          if (bytes > 0) add(appId, ownerId, bytes);
+          counted += bytes;
+          return true;
+        },
+        refusal: () => refusal,
+        release() {
+          if (done) return;
+          done = true;
+          if (counted > 0) add(appId, ownerId, -counted);
+          counted = 0;
+        }
+      };
+    },
+    held: () => total,
+    heldBy: (appId) => byApp.get(appId) ?? 0,
+    heldByOwner: (ownerId) => byOwner.get(ownerId) ?? 0,
+    short(appId, owner, bytes) {
+      const ownerId = named(owner);
+      const why = passes(appId, ownerId, bytes);
+      if (why !== null) refused2(why, appId, ownerId);
+      return why;
+    }
+  };
+}
+var isSize;
+var init_broker_bodies = __esm({
+  "packages/core/src/broker-bodies.ts"() {
+    "use strict";
+    init_broker_stream();
+    init_refusals();
+    init_wait_clock();
+    isSize = (bytes) => Number.isSafeInteger(bytes) && bytes >= 0;
   }
 });
 
 // packages/core/src/broker.ts
 async function handleBrokerRequest(request, deps) {
+  const holding = { body: null, answer: null };
+  try {
+    return await brokerCall(request, deps, holding);
+  } finally {
+    holding.body?.release();
+    holding.answer?.release();
+  }
+}
+async function brokerCall(request, deps, holding) {
   const url = new URL(request.url);
   const clock = deps.now ? { now: deps.now() } : {};
   const bearer = readBearer(request);
@@ -3404,6 +3837,55 @@ async function handleBrokerRequest(request, deps) {
       origin
     });
   };
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const bodyLimit = deps.maxRequestBytes ?? BROKER_LIMITS.requestBytes;
+  const bodyDeclared = hasBody ? declaredLength(request.headers) : null;
+  const declaredTooLarge = bodyDeclared !== null && bodyDeclared > bodyLimit;
+  const ownerId = request.method === "HEAD" || declaredTooLarge ? null : await ownerOfApp(deps, appId);
+  let requestBody = null;
+  if (hasBody) {
+    const budget = deps.heldBodies;
+    const held = budget?.open(appId, ownerId) ?? null;
+    holding.body = held;
+    const bodyRead = declaredTooLarge ? { outcome: "too_large" } : await readWithin(
+      request.body,
+      bodyLimit,
+      budget === void 0 || held === null ? void 0 : {
+        arrive: (bytes) => held.arrive(bytes),
+        time: { clock: budget.clock, stallMs: budget.limits.heldBodyStallMs, arrivalMs: budget.limits.heldBodyArrivalMs }
+      }
+    );
+    if (bodyRead.outcome !== "ok") {
+      const named = route.slug === RESOLVE_BY_HOST ? request.headers.get("x-wirl-target") : null;
+      if (route.slug === RESOLVE_BY_HOST) slug = "";
+      if (named) path = egressAuditPath(named);
+      const host2 = named ? safeHost(named) : "";
+      held?.release();
+      if (bodyRead.outcome === "too_large") {
+        await record("body_too_large", 413, host2);
+        return refuse2(
+          413,
+          "body_too_large",
+          `This call's body is more than ${bodyLimit} bytes, the most a call may send, so wirl sent nothing.`
+        );
+      }
+      if (bodyRead.outcome === "full") {
+        const limits = budget?.limits ?? BROKER_LIMITS;
+        const refusal = heldBodyRefusal(limits, held?.refusal() ?? "all");
+        await record(refusal.error, 503, host2);
+        return refuse2(503, refusal.error, refusal.message, { "retry-after": String(limits.heldBodyRetryAfterSeconds) });
+      }
+      if (bodyRead.outcome === "stalled" || bodyRead.outcome === "slow") {
+        const cut2 = heldBodyCut(budget?.limits ?? BROKER_LIMITS, bodyRead.outcome);
+        await record(cut2.error, 408, host2);
+        return refuse2(408, cut2.error, cut2.message);
+      }
+      if (request.signal.aborted) return callerLeft(record, host2);
+      await record("upstream_error", 502, host2);
+      return refuse2(502, "upstream_error", bodyRead.error instanceof Error ? bodyRead.error.message : String(bodyRead.error));
+    }
+    requestBody = bodyRead.bytes;
+  }
   const connections = await deps.connectionsFor(appId, deploymentId);
   let connection;
   if (route.slug === RESOLVE_BY_HOST) {
@@ -3492,11 +3974,18 @@ async function handleBrokerRequest(request, deps) {
     headers.set(name, value);
   });
   attachCredential(headers, connection);
+  const answers = deps.heldAnswers;
+  if (answers !== void 0 && request.method !== "HEAD") {
+    const short = answers.roomFor(appId, ownerId);
+    if (short !== null) {
+      const noRoom = heldAnswerNoRoom(answers.limits, short);
+      await record(noRoom.error, 503, host);
+      return refuse2(503, noRoom.error, noRoom.message, { "retry-after": String(answers.limits.heldAnswerRetryAfterSeconds) });
+    }
+  }
   const doFetch = deps.fetchImpl ?? fetch;
-  const hasBody = request.method !== "GET" && request.method !== "HEAD";
   let upstream;
   try {
-    const requestBody = hasBody ? await request.arrayBuffer() : null;
     if (pastFlowDeadline(origin, deps)) return deadlinePassed();
     upstream = await doFetch(decision.ok ? decision.url : target, {
       method: request.method,
@@ -3536,16 +4025,30 @@ async function handleBrokerRequest(request, deps) {
     return refuse2(502, "too_large", `The upstream announced ${declared} bytes, more than the ${limit} a call may return.`);
   }
   if (upstreamBody !== null && isStreamedAnswer(upstream.status, upstream.headers)) {
+    const body2 = holding.body;
+    holding.body = null;
     return streamAnswer(upstream, upstreamBody, {
       appId,
       limit,
       slots: deps.streamSlots ?? null,
       safetyMs: deps.streamSafetyMs ?? BROKER_LIMITS.headersMs + BROKER_LIMITS.streamBodyMs,
+      closing: closesWithEvent(upstream.headers),
+      sent: deps.streamSent ?? null,
+      sentMs: deps.streamSentMs ?? BROKER_LIMITS.cutEventSentMs,
       signal: request.signal,
-      record: (outcome, status) => record(outcome, status, safeHost(target))
+      record: (outcome, status) => record(outcome, status, safeHost(target)),
+      held: body2
     });
   }
-  const read = await readWithin(upstreamBody, limit);
+  const heldAnswer = answers?.open(appId, ownerId) ?? null;
+  holding.answer = heldAnswer;
+  const read = heldAnswer === null ? await readWithin(upstreamBody, limit) : await readWithin(upstreamBody, limit, { arrive: (bytes) => heldAnswer.arrive(bytes) });
+  if (read.outcome !== "ok") heldAnswer?.release();
+  if (read.outcome === "full") {
+    const refusal = heldAnswerRefusal(answers?.limits ?? BROKER_LIMITS, heldAnswer?.refusal() ?? "all");
+    await record(refusal.error, 502, safeHost(target));
+    return refuse2(502, refusal.error, refusal.message);
+  }
   if (read.outcome === "error") {
     if (request.signal.aborted) return callerLeft(record, safeHost(target));
     await record("upstream_error", 502, safeHost(target));
@@ -3560,7 +4063,76 @@ async function handleBrokerRequest(request, deps) {
   const out2 = answerHeaders(upstream.headers);
   const empty = upstream.status === 204 || upstream.status === 304;
   if (!empty) out2.set("content-length", String(body.byteLength));
-  return new Response(empty ? null : body, { status: upstream.status, headers: out2 });
+  if (answers === void 0 || heldAnswer === null || empty || body.byteLength === 0) {
+    return new Response(empty ? null : body, { status: upstream.status, headers: out2 });
+  }
+  const exact = body.byteLength < body.buffer.byteLength ? body.slice() : body;
+  const handed = handOut(exact, heldAnswer, request.signal, answers.clock, answers.limits.heldAnswerHandOutMs);
+  let answer;
+  try {
+    answer = new Response(handed, { status: upstream.status, headers: out2 });
+  } catch (error) {
+    await handed.cancel().catch(() => {
+    });
+    throw error;
+  }
+  holding.answer = null;
+  return answer;
+}
+async function ownerOfApp(deps, appId) {
+  if (deps.ownerOf === void 0 || deps.heldBodies === void 0 && deps.heldAnswers === void 0) return null;
+  const owner = await deps.ownerOf(appId);
+  return typeof owner === "string" && owner.length > 0 ? owner : null;
+}
+function handOut(bytes, held, signal, clock, handOutMs) {
+  let left = bytes;
+  let stopWait = () => {
+  };
+  let appLeft = () => {
+  };
+  const finish = () => {
+    if (left === null) return false;
+    left = null;
+    stopWait();
+    signal.removeEventListener("abort", appLeft);
+    held.release();
+    return true;
+  };
+  return new ReadableStream(
+    {
+      start(controller) {
+        const wait = clock.wait(handOutMs);
+        stopWait = () => wait.cancel();
+        void wait.done.then(() => {
+          if (!finish()) return;
+          const cut2 = new Error(
+            `The answer was not all taken within ${String(handOutMs / 1e3)} seconds of being handed back, the longest wirl holds one, and was cut there.`
+          );
+          cut2.stack = `Error: ${cut2.message}`;
+          controller.error(cut2);
+        });
+        appLeft = () => {
+          if (finish()) controller.close();
+        };
+        if (signal.aborted) appLeft();
+        else signal.addEventListener("abort", appLeft, { once: true });
+      },
+      pull(controller) {
+        if (left === null) return;
+        const slice = left.slice(0, HAND_OUT_BYTES);
+        left = left.subarray(slice.byteLength);
+        controller.enqueue(slice);
+        if (left.byteLength > 0) return;
+        finish();
+        controller.close();
+      },
+      cancel() {
+        finish();
+      }
+    },
+    // Nothing is cut ahead of the app: the server's pace is the app's.
+    { highWaterMark: 0 }
+  );
 }
 function egressAuditPath(target) {
   let pathname;
@@ -3614,13 +4186,14 @@ function declaredLength(headers) {
   return Number(raw.trim());
 }
 async function streamAnswer(upstream, body, context) {
-  let release = () => {
-  };
+  const giveBack = () => context.held?.release();
+  let release = giveBack;
   if (context.slots !== null) {
     const slot = context.slots.acquire(context.appId);
     if (slot === null) {
       await body.cancel().catch(() => {
       });
+      giveBack();
       await context.record("busy", 429);
       return refuse2(
         429,
@@ -3628,25 +4201,60 @@ async function streamAnswer(upstream, body, context) {
         `This app already has ${context.slots.perApp} streamed answers open, the most it may hold at once; try again when one of them has finished.`
       );
     }
-    release = slot;
+    release = () => {
+      slot();
+      giveBack();
+    };
   }
   try {
     await context.record("allowed", upstream.status);
   } catch (error) {
+    await body.cancel().catch(() => {
+    });
     release();
+    throw error;
+  }
+  try {
+    return new Response(passOn(body, context.limit, release, context.safetyMs, context.signal, context.closing, context.sent, context.sentMs), {
+      status: upstream.status,
+      headers: answerHeaders(upstream.headers)
+    });
+  } catch (error) {
     await body.cancel().catch(() => {
     });
+    release();
     throw error;
   }
-  return new Response(passOn(body, context.limit, release, context.safetyMs, context.signal), {
-    status: upstream.status,
-    headers: answerHeaders(upstream.headers)
-  });
 }
-function passOn(body, limit, release, safetyMs, signal) {
+async function eventSent(sent, ms) {
+  if (sent === null) {
+    await new Promise((resolve7) => setTimeout(resolve7, 0));
+    return;
+  }
+  const stop = new AbortController();
+  let bound;
+  try {
+    await Promise.race([
+      sent(stop.signal),
+      new Promise((resolve7) => {
+        bound = setTimeout(resolve7, ms);
+        bound.unref?.();
+      })
+    ]);
+  } catch {
+  } finally {
+    clearTimeout(bound);
+    stop.abort();
+  }
+}
+function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
   const reader = body.getReader();
+  const says = closing && limit > CUT_EVENT_RESERVE_BYTES;
+  const room = says ? limit - CUT_EVENT_RESERVE_BYTES : limit;
   let total = 0;
   let over = false;
+  let parting = null;
+  let unread;
   let safety;
   let appLeft = () => {
   };
@@ -3658,17 +4266,40 @@ function passOn(body, limit, release, safetyMs, signal) {
     release();
     return true;
   };
-  const cut2 = (controller, error) => {
+  const cut2 = (controller, error, why) => {
     if (!finish()) return;
-    controller.error(error);
     reader.cancel(error).catch(() => {
     });
+    if (!says) {
+      controller.error(error);
+      return;
+    }
+    try {
+      controller.enqueue(streamCutEvent(why));
+    } catch {
+      controller.error(error);
+      return;
+    }
+    parting = error;
+    unread = setTimeout(() => {
+      if (parting === null) return;
+      parting = null;
+      try {
+        controller.error(error);
+      } catch {
+      }
+    }, sentMs);
+    unread.unref?.();
   };
   return new ReadableStream(
     {
       start(controller) {
         const timer = setTimeout(() => {
-          cut2(controller, new Error(`The upstream's answer was still open after ${safetyMs} ms, the longest the broker holds one, and was cut there.`));
+          cut2(
+            controller,
+            new Error(`The upstream's answer was still open after ${safetyMs} ms, the longest the broker holds one, and was cut there.`),
+            { cause: "held", ms: safetyMs }
+          );
         }, safetyMs);
         timer.unref?.();
         safety = timer;
@@ -3682,11 +4313,21 @@ function passOn(body, limit, release, safetyMs, signal) {
         else signal.addEventListener("abort", appLeft, { once: true });
       },
       async pull(controller) {
+        if (parting !== null) {
+          const error = parting;
+          parting = null;
+          clearTimeout(unread);
+          await eventSent(sent, sentMs);
+          controller.error(error);
+          return;
+        }
         let next;
         try {
           next = await reader.read();
         } catch (error) {
-          if (finish()) controller.error(error);
+          const bound = error instanceof PinnedFetchError ? error.streamBound : void 0;
+          if (bound !== void 0) cut2(controller, error, { cause: bound.kind, ms: bound.ms });
+          else if (finish()) controller.error(error);
           return;
         }
         if (over) return;
@@ -3696,14 +4337,21 @@ function passOn(body, limit, release, safetyMs, signal) {
           return;
         }
         total += next.value.byteLength;
-        if (total > limit) {
-          cut2(controller, new Error(`The upstream's answer passed ${limit} bytes, the most a call may return, and was cut there.`));
+        if (total > room) {
+          cut2(
+            controller,
+            new Error(
+              says ? `The upstream's answer reached the ${limit} bytes a call may return, counting the event that closes it, and was cut there.` : `The upstream's answer passed ${limit} bytes, the most a call may return, and was cut there.`
+            ),
+            { cause: "size", bytes: limit }
+          );
           return;
         }
         controller.enqueue(next.value);
       },
       cancel(reason) {
         finish();
+        clearTimeout(unread);
         return reader.cancel(reason).catch(() => {
         });
       }
@@ -3712,37 +4360,62 @@ function passOn(body, limit, release, safetyMs, signal) {
     { highWaterMark: 0 }
   );
 }
-async function readWithin(body, limit) {
-  if (body === null) return { outcome: "ok", bytes: new ArrayBuffer(0) };
-  const reader = body.getReader();
-  const chunks = [];
+async function readWithin(body, limit, bounds) {
+  if (body === null) return { outcome: "ok", bytes: new Uint8Array(0) };
+  let reader;
+  let held = new Uint8Array(0);
   let total = 0;
+  const time = bounds?.time;
+  const arrival = time?.clock.wait(time.arrivalMs);
+  const slow = arrival?.done.then(() => SLOW);
   try {
+    reader = body.getReader();
     for (; ; ) {
-      const next = await reader.read();
+      const next = await nextWithin(reader, time, slow);
+      if (next === STALLED || next === SLOW) {
+        await reader.cancel().catch(() => {
+        });
+        return { outcome: next === STALLED ? "stalled" : "slow" };
+      }
       if (next.done) break;
       const chunk = next.value;
       if (chunk === void 0) continue;
-      total += chunk.byteLength;
-      if (total > limit) {
+      const needed = total + chunk.byteLength;
+      if (needed > limit) {
         await reader.cancel().catch(() => {
         });
         return { outcome: "too_large" };
       }
-      chunks.push(chunk);
+      if (bounds !== void 0 && !bounds.arrive(chunk.byteLength)) {
+        await reader.cancel().catch(() => {
+        });
+        return { outcome: "full" };
+      }
+      if (needed > held.byteLength) {
+        const grown = new Uint8Array(Math.min(limit, Math.max(needed, held.byteLength * 2, FIRST_HOLD_BYTES)));
+        grown.set(held.subarray(0, total));
+        held = grown;
+      }
+      held.set(chunk, total);
+      total = needed;
     }
   } catch (error) {
-    await reader.cancel().catch(() => {
+    await reader?.cancel().catch(() => {
     });
     return { outcome: "error", error };
+  } finally {
+    arrival?.cancel();
   }
-  const joined2 = new Uint8Array(new ArrayBuffer(total));
-  let at2 = 0;
-  for (const chunk of chunks) {
-    joined2.set(chunk, at2);
-    at2 += chunk.byteLength;
+  return { outcome: "ok", bytes: held.subarray(0, total) };
+}
+async function nextWithin(reader, time, slow) {
+  if (time === void 0 || slow === void 0) return reader.read();
+  const stall = time.clock.wait(time.stallMs);
+  try {
+    return await Promise.race([reader.read(), stall.done.then(() => STALLED), slow]);
+  } finally {
+    stall.cancel();
   }
-  return { outcome: "ok", bytes: joined2.buffer };
 }
 function credentialShape(kind) {
   return Object.hasOwn(CREDENTIAL_SHAPES, kind) ? CREDENTIAL_SHAPES[kind] : null;
@@ -3792,19 +4465,21 @@ function readBearer(request) {
   const value = header.slice(7).trim();
   return value.length > 0 ? value : null;
 }
-function refuse2(status, reason, message) {
+function refuse2(status, reason, message, extra = {}) {
   return new Response(JSON.stringify({ error: reason, message }, null, 2), {
     status,
     headers: new Headers({
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...extra
     })
   });
 }
-var RESOLVE_BY_HOST, STRIPPED_PREFIXES, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, AUDIT_PATH_CHARS, CREDENTIAL_SHAPES, isHttpKind, safeHost;
+var RESOLVE_BY_HOST, STRIPPED_PREFIXES, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, HAND_OUT_BYTES, AUDIT_PATH_CHARS, STALLED, SLOW, FIRST_HOLD_BYTES, CREDENTIAL_SHAPES, isHttpKind, safeHost;
 var init_broker = __esm({
   "packages/core/src/broker.ts"() {
     "use strict";
+    init_broker_bodies();
     init_broker_stream();
     init_broker_token();
     init_egress();
@@ -3856,7 +4531,11 @@ var init_broker = __esm({
       "malicious-uploads-detection"
     ]);
     isHopHeader = (lower) => HOP_HEADERS.has(lower) || HOP_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    HAND_OUT_BYTES = 64 * 1024;
     AUDIT_PATH_CHARS = 200;
+    STALLED = /* @__PURE__ */ Symbol("stalled");
+    SLOW = /* @__PURE__ */ Symbol("slow");
+    FIRST_HOLD_BYTES = 16 * 1024;
     CREDENTIAL_SHAPES = Object.freeze({
       http_bearer: Object.freeze({ sends: "bearer", fields: Object.freeze(["token"]) }),
       http_header: Object.freeze({ sends: "headers", fields: Object.freeze([]) }),
@@ -3973,7 +4652,7 @@ arrives: pass \`response.body\` straight on. There are no WebSockets. A front en
 answers everything else; add \`"spa": true\` for a client-side router. Nothing outside that folder is served.
 
 Preview before you deploy: \`wirl preview\` gives a folder its own address and database (at first only what
-\`migrations/\` makes). \`wirl fetch <path> --preview <name>\` or \`wirl_preview_fetch\` shows what it answers.
+\`migrations/\` makes). \`wirl fetch <path> --preview <name>\` or \`wirl_preview_fetch\` shows what it answers. Every request a preview's module gets names the preview in \`x-wirl-preview\`, and wirl marks its pages as previews.
 
 npm packages work: install them in the project and the deploy bundles them in. Nothing is installed on the
 server: native code will not run. Node built-ins work (\`node:crypto\`, \`node:path\`, ...; \`Buffer\` and
@@ -4039,7 +4718,7 @@ var init_version = __esm({
   "packages/core/src/version.ts"() {
     "use strict";
     WORKSPACE_VERSION = "0.0.0";
-    BUILT_VERSION = true ? "0.2.1" : null;
+    BUILT_VERSION = true ? "0.2.3" : null;
   }
 });
 
@@ -4067,6 +4746,48 @@ var init_install = __esm({
   }
 });
 
+// packages/core/src/share-role.ts
+function readShareRole(value) {
+  if (value === void 0 || value === null) return { ok: true, role: void 0 };
+  if (value === AppRole.VIEWER || value === AppRole.EDITOR) return { ok: true, role: value };
+  return { ok: false, message: SHARE_ROLE_REFUSAL };
+}
+var SHARE_ROLE_REFUSAL;
+var init_share_role = __esm({
+  "packages/core/src/share-role.ts"() {
+    "use strict";
+    init_types();
+    SHARE_ROLE_REFUSAL = "role must be viewer or editor.";
+  }
+});
+
+// packages/core/src/connect.ts
+var CLAUDE_CODE_SIGN_IN, CLAUDE_CODE_LOCAL_SIGN_IN;
+var init_connect = __esm({
+  "packages/core/src/connect.ts"() {
+    "use strict";
+    init_install();
+    CLAUDE_CODE_SIGN_IN = "`claude mcp add` only saves the server's configuration. Then sign in: run `/mcp` inside Claude Code and follow the steps in the browser, or run `claude mcp login wirl` in a terminal.";
+    CLAUDE_CODE_LOCAL_SIGN_IN = `The local server signs in the first time a wirl tool needs it: the agent calls \`wirl_login\`, which returns a link and a code, and the agent shows both to the person. The person approves the code in the browser, and the agent's next wirl tool call works. A machine already signed in with \`${WIRL_BIN} login\` skips this.`;
+  }
+});
+
+// packages/core/src/setup-prompt.ts
+function starterName(email) {
+  const handle = (email ?? "").split("@")[0] ?? "";
+  const slug = handle.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const cut2 = slug.slice(0, SLUG_MAX - STARTER_SUFFIX.length).replace(/-+$/, "");
+  return cut2 === "" ? "starter" : `${cut2}${STARTER_SUFFIX}`;
+}
+var STARTER_SUFFIX;
+var init_setup_prompt = __esm({
+  "packages/core/src/setup-prompt.ts"() {
+    "use strict";
+    init_slug();
+    STARTER_SUFFIX = "-starter";
+  }
+});
+
 // packages/core/src/porting.ts
 function dependencyNames(packageJson) {
   if (packageJson === void 0) return [];
@@ -4287,6 +5008,66 @@ var init_porting = __esm({
   }
 });
 
+// packages/core/src/throttle-report.ts
+var THROTTLE_REPORT, EDGE_REFUSALS_NOTE;
+var init_throttle_report = __esm({
+  "packages/core/src/throttle-report.ts"() {
+    "use strict";
+    init_public_path();
+    THROTTLE_REPORT = {
+      /**
+       * One report per app a minute at most from each gate isolate, and what
+       * one report counts spans a minute at most.
+       */
+      windowMs: 6e4,
+      /**
+       * How long the refusal that opens a window waits for more before the
+       * report goes, so a burst is one report with its count rather than a
+       * report of its first refusal.
+       */
+      gatherMs: 15e3,
+      /**
+       * The longest a refused request is asked to stay open, after its 429 has
+       * gone, for the report to be sent. Cloudflare keeps a request's
+       * `waitUntil` work for 30 seconds after the response, shared by all of
+       * it, and the send itself has `sendTimeoutMs` of what is left.
+       */
+      maxWaitMs: 2e4,
+      sendTimeoutMs: 5e3,
+      /**
+       * Reports one request carries for windows no refusal could wait for
+       * (`flushDue`). A request that was never refused must not queue its own
+       * reads behind posts that are not its own: Cloudflare runs six of a
+       * request's connections at once and queues the rest.
+       */
+      flushPerRequest: 2,
+      /** Apps one gate isolate counts for at once; a refusal for another app past this is not counted. */
+      maxApps: 1e3,
+      /** Lines in one report: each of an app's public paths, by each ceiling. */
+      maxEntries: 2 * PUBLIC_PATH_LIMITS.perApp,
+      /** A path is cut to this many characters, as `public.refused`'s is. */
+      maxPathChars: 256,
+      /**
+       * The most of a report's body the control plane reads. A full report is
+       * under 8 KiB: a path a request matched is ASCII, as a URL's path is.
+       */
+      bodyBytes: 16384,
+      /**
+       * Reports the control plane reads for one app a minute, from every isolate
+       * and location together. Of those, the first writes the app's one
+       * `public.throttled` row for that minute and the rest write nothing.
+       */
+      perAppPerMinute: 10,
+      /** The org's Activity page summarises this many apps' latest `public.throttled` lines, a line an app, from the last `logsPageDays` days. */
+      activityLines: 5,
+      /** The app's Logs page shows its latest this many `public.throttled` lines, from the last `logsPageDays` days. */
+      logsPageLines: 20,
+      logsPageDays: 7
+    };
+    EDGE_REFUSALS_NOTE = "Requests wirl refuses before your app is called, such as a public path's 429 over its ceiling, are not invocations and never show here; anyone who can deploy the app sees those 429s counted as public.throttled on its Logs page in the dashboard.";
+  }
+});
+
 // packages/core/src/supplied-bundle.ts
 var SUPPLIED_BUNDLE_PATH, MAX_SUPPLIED_BUNDLE_BYTES;
 var init_supplied_bundle = __esm({
@@ -4310,11 +5091,22 @@ var init_manifest_transport = __esm({
   }
 });
 
+// packages/core/src/preview.ts
+function versionNumbersSentence(listing) {
+  return `A preview takes a version number from the same count as a deploy, and ${listing} never lists a preview, so a deploy's number can skip: if the newest version listed is v1 and this deploy is v4, v2 and v3 were previews.`;
+}
+var init_preview = __esm({
+  "packages/core/src/preview.ts"() {
+    "use strict";
+  }
+});
+
 // packages/core/src/visit-token.ts
-var VISIT_QUERY_PARAM, VISIT_HEADER;
+var VISIT_TOKEN_TTL_SECONDS, VISIT_QUERY_PARAM, VISIT_HEADER;
 var init_visit_token = __esm({
   "packages/core/src/visit-token.ts"() {
     "use strict";
+    VISIT_TOKEN_TTL_SECONDS = 900;
     VISIT_QUERY_PARAM = "__wirl_visit";
     VISIT_HEADER = "x-wirl-visit";
   }
@@ -4346,9 +5138,14 @@ var init_src = __esm({
     init_contract();
     init_version();
     init_install();
+    init_share_role();
+    init_connect();
+    init_setup_prompt();
     init_porting();
+    init_throttle_report();
     init_supplied_bundle();
     init_manifest_transport();
+    init_preview();
     init_visit_token();
   }
 });
@@ -5995,7 +6792,7 @@ import { constants as fsConstants, createReadStream } from "node:fs";
 import { access, link, lstat as lstat2, mkdir as mkdir3, open, readFile as readFile3, readdir, rename as rename2, rm as rm3, stat as stat3, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename as basename2, dirname as dirname3, isAbsolute, join as join5, relative, resolve as resolve4, sep } from "node:path";
-import { create as tarCreate, extract as tarExtract } from "tar";
+import { create as tarCreate, extract as tarExtract, Parser as TarParser } from "tar";
 import { gzipSync } from "node:zlib";
 
 // packages/core/src/node/pinned-fetch.ts
@@ -6090,7 +6887,7 @@ function createPinnedFetch(options = {}) {
       if (streamsBody !== void 0 && !streamsBody(status, answered)) return null;
       clearTimeout(timer);
       timer = setTimeout(() => {
-        fail(new PinnedFetchError("timeout", url.hostname, `${url.hostname} did not finish its answer within ${bodyTimeoutMs} ms.`));
+        fail(new PinnedFetchError("timeout", url.hostname, `${url.hostname} did not finish its answer within ${bodyTimeoutMs} ms.`, { kind: "time", ms: bodyTimeoutMs }));
       }, bodyTimeoutMs);
       return bodyIdleMs;
     };
@@ -6227,13 +7024,17 @@ function sendTo(wire, address, attempt, attemptMs) {
         budget = idle ?? Math.max(MIN_ATTEMPT_MS, wire.remainingMs());
         request.setTimeout(budget);
         const bodyless = NO_BODY.has(status) || method.toUpperCase() === "HEAD";
+        const answerOver = () => {
+          wire.done();
+          if (!request.writableFinished) request.destroy();
+        };
         if (bodyless) {
           incoming.resume();
           incoming.on("error", () => {
           });
-          wire.done();
+          answerOver();
         } else {
-          incoming.once("close", wire.done);
+          incoming.once("close", answerOver);
         }
         resolve7(new Response(bodyless ? null : Readable.toWeb(incoming), { status, headers: out2 }));
       } catch (error) {
@@ -6251,7 +7052,10 @@ function sendTo(wire, address, attempt, attemptMs) {
       const error = new PinnedFetchError(
         "timeout",
         url.hostname,
-        streaming ? `${url.hostname}'s answer stalled: nothing moved on it for ${budget} ms on ${address}, because the host sent nothing or nothing was read from it.` : `${url.hostname} did not answer within ${budget} ms on ${address}.`
+        streaming ? `${url.hostname}'s answer stalled: nothing moved on it for ${budget} ms on ${address}, because the host sent nothing or nothing was read from it.` : `${url.hostname} did not answer within ${budget} ms on ${address}.`,
+        // Which bound it was, for the broker to say what it cut a stream
+        // for (OIM-837): only on a body on bounds of its own.
+        streaming ? { kind: "idle", ms: budget } : void 0
       );
       if (delivered !== null) delivered.destroy(error);
       else request.destroy(error);
@@ -6271,6 +7075,7 @@ function sendTo(wire, address, attempt, attemptMs) {
 }
 
 // packages/core/src/node/broker-fetch.ts
+init_broker_bodies();
 init_broker_stream();
 var BROKER_FETCH_OPTIONS = Object.freeze({
   timeoutMs: BROKER_LIMITS.headersMs,
@@ -6281,10 +7086,38 @@ var BROKER_FETCH_OPTIONS = Object.freeze({
 function createBrokerTransport(options = {}) {
   return {
     fetchImpl: options.fetchImpl ?? createPinnedFetch({ ...BROKER_FETCH_OPTIONS, ...options.pinning }),
-    streamSlots: createStreamSlots()
+    streamSlots: createStreamSlots(),
+    heldBodies: createHeldBodies({ limits: options.heldBodyLimits, log: options.log }),
+    heldAnswers: createHeldAnswers({ limits: options.heldAnswerLimits, log: options.log })
   };
 }
 
+// packages/core/src/node/sent-on.ts
+var LOOK_EVERY_MS = 2;
+function sentOn(response) {
+  if (response === void 0) return void 0;
+  const nothingLeft = () => {
+    const socket = response.socket;
+    if (response.destroyed === true || socket === null || socket?.destroyed === true) return true;
+    return (response.writableLength ?? socket?.writableLength ?? 0) === 0;
+  };
+  return (stop) => new Promise((resolve7) => {
+    let timer;
+    const settle2 = () => {
+      clearTimeout(timer);
+      stop.removeEventListener("abort", settle2);
+      resolve7();
+    };
+    const look = () => {
+      if (stop.aborted || nothingLeft()) return settle2();
+      timer = setTimeout(look, LOOK_EVERY_MS);
+      timer.unref?.();
+    };
+    stop.addEventListener("abort", settle2, { once: true });
+    look();
+  });
+}
+
 // packages/core/src/node/dev-identity.ts
 import { createHash } from "node:crypto";
 function devUserId(email) {
@@ -6300,10 +7133,9 @@ init_slug();
 import { createHash as createHash2 } from "node:crypto";
 var HASH_SUFFIX_LENGTH = 5;
 function previewNameFor(raw, orgSlug, appSlug) {
-  const slug = slugify(raw);
-  if (!slug) {
-    return { ok: false, message: "That name has no usable characters, or is reserved." };
-  }
+  const made = previewSlugFor(raw);
+  if (!made.ok) return { ok: false, message: made.message };
+  const slug = made.slug;
   const budget = MAX_HOST_LABEL - (appLabel(orgSlug, appSlug).length + HOST_SEPARATOR.length);
   if (budget < 2) {
     return {
@@ -6402,26 +7234,507 @@ function parseIgnore(text) {
         "A .wirlignore can only exclude more, never re-include a file. Remove this line."
       );
     }
-    rules.push(compileRule(line, i + 1));
-  }
-  return {
-    ignores(path, isDirectory) {
-      return rules.some((rule) => (!rule.directoryOnly || isDirectory) && rule.regex.test(path));
+    rules.push(compileRule(line, i + 1));
+  }
+  return {
+    ignores(path, isDirectory) {
+      return rules.some((rule) => (!rule.directoryOnly || isDirectory) && rule.regex.test(path));
+    }
+  };
+}
+
+// packages/cli/src/shell.ts
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_\-./:@%+,]+$/.test(value)) return value;
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function shellPath(value) {
+  if (value.startsWith("-")) return shellQuote(`./${value}`);
+  if (value === "~" || value === "~/") return value;
+  if (value.startsWith("~/")) return `~/${shellQuote(value.slice(2))}`;
+  return shellQuote(value);
+}
+
+// packages/cli/src/skill.ts
+init_src();
+var SKILL_INTRO = `A new app is visible to everyone in the org when the org came from a
+company email domain; in any other org, including a personal one or one
+made with \`wirl orgs create\`, it starts private. Deploys are one
+command; sharing is by email; a third-party API is declared, never pasted.`;
+var SKILL_DOCS_LINE = "Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.";
+var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
+2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
+3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
+4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
+5. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
+var SKILL_MANIFEST_EXAMPLE = `\`\`\`json
+{ "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
+\`\`\``;
+var SKILL_FILES_PARAGRAPH = "No blob storage: files go in `env.DB`, at most 2,000,000 bytes a value or row (the limit Cloudflare publishes for D1), so store a larger file in chunks, one row each, a few MB to a batch. `wirl dev` refuses a single bound value over 2,000,000 bytes, but a row's total, a value grown in SQL, or a batch bigger than one call to D1 carries can still pass locally and fail deployed.";
+var SKILL_STATIC_PARAGRAPH = 'A static folder maps a path to one file exactly: a path ending in `/` serves the `index.html` in that folder, `/about` never finds `about.html`, and a path that names no file goes to the module (with `"spa": true`, a page navigation gets `index.html` instead; in an app with no module, the top `index.html`, or a 404 for a missing file with an extension). Next.js runs only as a static export: `output: "export"` and `trailingSlash: true` in `next.config` make `next build` write `out/`, which goes under `"static"`; `next start` cannot run, and API routes move into the module.';
+function composeSkill(parts) {
+  if (parts.description.trim() === "" || /[\r\n]/.test(parts.description)) {
+    throw new Error("a skill description is one non-empty line");
+  }
+  return `---
+name: wirl
+description: ${parts.description}
+---
+
+# wirl
+
+${SKILL_INTRO}
+
+${SKILL_DOCS_LINE}
+
+## Commands
+
+${parts.commands.trimEnd()}
+
+## Rules
+
+${SKILL_RULES}
+
+## wirl.json
+
+${SKILL_MANIFEST_EXAMPLE}
+
+## What runs on wirl
+
+${BUILD_CONTRACT}
+
+${SKILL_FILES_PARAGRAPH}
+
+${SKILL_STATIC_PARAGRAPH}
+
+## Flows
+
+${FLOWS_CONTRACT}
+`;
+}
+
+// packages/cli/src/starter.ts
+init_src();
+var STARTER_CONFLICT = "Choose one: --server or --starter.";
+var SUGGESTIONS = [
+  {
+    title: "Rename it to something we'd actually use",
+    prompt: `Rename this noticeboard to something my team would actually use. Ask me what we would use it for, suggest three names, and when I pick one, change the page's title and heading and the description in wirl.json to match. Keep "app" in wirl.json as it is: a new name there would make a second app at a new address. Then deploy it with wirl deploy.`
+  },
+  {
+    title: "Try a new look in a preview first",
+    prompt: "Give the noticeboard a warmer look: pinned notes as coloured cards, and tags as small coloured labels. Put it up with wirl preview first and give me the preview's address to check. Deploy it with wirl deploy only after I say it looks right."
+  },
+  {
+    title: "Add a due date to notes",
+    prompt: "Add an optional due date to notes on the noticeboard. Add the column in a new file, migrations/0002_due_date.sql, and never edit 0001. Let people set the date when they post or edit a note, show it on each note, and put notes due soonest at the top. Try it with wirl dev, then deploy it with wirl deploy."
+  },
+  {
+    title: "Show the weather from a public API",
+    prompt: `Show today's weather for our office at the top of the noticeboard, from Open-Meteo, a public weather API that needs no key. Ask me which city our office is in. Add this entry to "connections" in wirl.json: {"slug": "open-meteo", "kind": "none", "hosts": ["api.open-meteo.com"]}. Fetch Open-Meteo's own URL from server.mjs, and deploy it with wirl deploy. If the deploy says open-meteo is waiting, the connection needs approving, which your sign-in cannot do: tell me to approve it on the app's Connections page on app.wirl.dev, or to ask an admin of our organisation to. The weather shows once it is approved.`
+  },
+  {
+    title: "Change when the tidy-up runs",
+    prompt: "Change the noticeboard's nightly tidy-up: archive notes after 14 days instead of 30, and run it at 6pm on weekdays in my time zone (ask me which). Change the schedule in wirl.json and the number in server.mjs, deploy it with wirl deploy, then run it once with wirl run tidy and tell me what it said."
+  },
+  {
+    title: "Find out what happened from the logs",
+    prompt: "Read this app's logs with wirl logs and tell me, in a few lines, what people did on the noticeboard today and whether anything failed."
+  },
+  {
+    title: "Share it with a colleague",
+    prompt: `Help me share this noticeboard with a colleague. Sharing is done by me, not by a deploy: tell me to share it from the app's Access page on app.wirl.dev (the "Who can open it" row on the noticeboard links to it), where I add their email address. Then tell me what they will see when they open the address.`
+  }
+];
+var SUGGESTIONS_SOURCE = [
+  "const SUGGESTIONS = [",
+  ...SUGGESTIONS.map(({ title, prompt }) => `  { title: ${JSON.stringify(title)}, prompt: ${JSON.stringify(prompt)} },`),
+  "];"
+].join("\n");
+var SERVER_HEAD = String.raw`/**
+ * Team noticeboard: your first app on wirl.
+ *
+ * Your team posts short notes here, tags them, pins the ones everyone should
+ * see, and edits or removes their own. Every night a schedule archives old
+ * notes nobody pinned. The page also explains itself: a "How this works on
+ * wirl" panel, one row per feature, each linking to that page of the app on
+ * app.wirl.dev, and a few changes to ask your coding agent for next.
+ *
+ * The whole app is this one file:
+ * - The page is HTML this module returns: plain forms, no script.
+ * - Notes live in env.DB, a SQLite database that belongs to this app alone.
+ *   Its tables are in migrations/0001_init.sql, and wirl applies each new
+ *   file in migrations/ before a version goes live. Put the next change in
+ *   migrations/0002_<what>.sql rather than editing that one.
+ * - Who is asking arrives in headers wirl sets after signing them in, which
+ *   the browser cannot forge. Who may change a note is a line of code here:
+ *   a check in the page is only a suggestion to whoever holds the browser.
+ * - The nightly schedule is declared in wirl.json. wirl sends it here as a
+ *   POST to /__wirl/schedule/tidy, and what it answers becomes the run's note.
+ * - console.log lines appear on the app's Logs page, and in wirl logs.
+ */
+
+const TITLE = "Team noticeboard";
+const DASHBOARD = "https://app.wirl.dev";
+const ARCHIVE_AFTER_DAYS = 30;
+const LONGEST_NOTE = 2000;
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    // One line per request, on the Logs page.
+    console.log(request.method, url.pathname);
+
+    // The nightly tidy-up, sent by wirl at the time wirl.json gives. wirl
+    // names the schedule in x-wirl-schedule as well as in the path, and a
+    // request without that header is not one wirl sent.
+    if (url.pathname.startsWith("/__wirl/schedule/")) {
+      const name = url.pathname.slice("/__wirl/schedule/".length);
+      const fromWirl = request.headers.get("x-wirl-schedule") === name;
+      if (name === "tidy" && request.method === "POST" && fromWirl) return tidy(env);
+      return text("No such schedule", 404);
+    }
+
+    const me = visitor(request);
+
+    if (request.method === "POST") {
+      // A form posted from another site is never one of yours.
+      if (request.headers.get("sec-fetch-site") === "cross-site") return text("Refused: this form came from another site.", 403);
+      if (me.id === "") return text("Sign in to change the board.", 403);
+      let form;
+      try {
+        form = await request.formData();
+      } catch {
+        return text("Send this as a form.", 400);
+      }
+      return change(url.pathname, form, me, env);
     }
+
+    if (url.pathname === "/" && (request.method === "GET" || request.method === "HEAD")) {
+      return html(await page(request, url, me, env));
+    }
+    return text("Not found", 404);
+  },
+};
+
+// Set by wirl after it signed this person in. Never take identity from a form
+// or the query string: those say whatever the browser wants them to say. A
+// header carries only Latin-1 and a name can be anything, so wirl
+// percent-encodes the name; it is decoded here.
+function visitor(request) {
+  const header = (name) => decode(request.headers.get(name) || "");
+  return {
+    id: header("x-wirl-user-id"),
+    name: header("x-wirl-user-name") || header("x-wirl-user-email") || "someone",
+    role: header("x-wirl-role"),
   };
 }
 
-// packages/cli/src/shell.ts
-function shellQuote(value) {
-  if (/^[A-Za-z0-9_\-./:@%+,]+$/.test(value)) return value;
-  return `'${value.replaceAll("'", "'\\''")}'`;
+// POST /notes, and POST /notes/<id>/<edit|pin|remove|restore>.
+async function change(path, form, me, env) {
+  const [, first, id, action] = path.split("/");
+  if (first !== "notes") return text("Not found", 404);
+
+  if (id === undefined) {
+    const body = clean(form.get("body"), LONGEST_NOTE);
+    if (body === "") return text("A note needs some words.", 400);
+    const { meta } = await env.DB.prepare("insert into notes (body, tags, author_id, author_name) values (?, ?, ?, ?)")
+      .bind(body, tags(form.get("tags")), me.id, me.name)
+      .run();
+    console.log("note", meta.last_row_id, "posted by", me.id);
+    return home();
+  }
+
+  const number = Number.parseInt(id, 10);
+  if (String(number) !== id) return text("Not found", 404);
+  const note = await env.DB.prepare("select id, author_id from notes where id = ?").bind(number).first();
+  if (!note) return text("No such note", 404);
+
+  // The rule that matters, in code: authors change their own notes, and the
+  // app's owner can change any. Anyone on the board can pin.
+  const mine = note.author_id === me.id || me.role === "owner";
+
+  if (action === "pin") {
+    await env.DB.prepare("update notes set pinned = 1 - pinned where id = ?").bind(number).run();
+    console.log("note", number, "pin changed by", me.id);
+    return home();
+  }
+  if (!mine) return text("Only the person who posted this note, or the app's owner, can change it.", 403);
+
+  if (action === "edit") {
+    const body = clean(form.get("body"), LONGEST_NOTE);
+    if (body === "") return text("A note needs some words.", 400);
+    await env.DB.prepare("update notes set body = ?, tags = ? where id = ?").bind(body, tags(form.get("tags")), number).run();
+    console.log("note", number, "edited by", me.id);
+    return home();
+  }
+  if (action === "remove") {
+    await env.DB.prepare("delete from notes where id = ?").bind(number).run();
+    console.log("note", number, "removed by", me.id);
+    return home();
+  }
+  if (action === "restore") {
+    // Back on the board as if posted today, so tonight's tidy-up leaves it be.
+    await env.DB.prepare("update notes set archived_at = null, created_at = datetime('now') where id = ?").bind(number).run();
+    console.log("note", number, "put back by", me.id);
+    return home("/?view=archived");
+  }
+  return text("Not found", 404);
 }
-function shellPath(value) {
-  if (value.startsWith("-")) return shellQuote(`./${value}`);
-  if (value === "~" || value === "~/") return value;
-  if (value.startsWith("~/")) return `~/${shellQuote(value.slice(2))}`;
-  return shellQuote(value);
+
+// The schedule: archive notes older than ARCHIVE_AFTER_DAYS that nobody
+// pinned, and keep a line saying so, which the page shows as the last run.
+async function tidy(env) {
+  const { meta } = await env.DB.prepare(
+    "update notes set archived_at = datetime('now') where archived_at is null and pinned = 0 and created_at < datetime('now', ?)",
+  )
+    .bind("-" + ARCHIVE_AFTER_DAYS + " days")
+    .run();
+  const note = "Archived " + meta.changes + (meta.changes === 1 ? " note" : " notes") + " older than " + ARCHIVE_AFTER_DAYS + " days.";
+  await env.DB.prepare("insert into runs (schedule, note) values (?, ?)").bind("tidy", note).run();
+  console.log("tidy:", note);
+  return text(note);
+}
+
+async function page(request, url, me, env) {
+  const tag = tags(url.searchParams.get("tag")).split(",")[0];
+  const archived = url.searchParams.get("view") === "archived";
+  let sql = "select id, body, tags, pinned, author_id, author_name, created_at from notes where archived_at is " + (archived ? "not null" : "null");
+  const binds = [];
+  if (tag !== "") {
+    sql += " and (',' || tags || ',') like ?";
+    binds.push("%," + tag + ",%");
+  }
+  sql += " order by pinned desc, id desc limit 200";
+  const notes = (await env.DB.prepare(sql).bind(...binds).all()).results;
+  const archivedCount = await env.DB.prepare("select count(*) as n from notes where archived_at is not null").first("n");
+  const lastRun = await env.DB.prepare("select note, ran_at from runs where schedule = 'tidy' order by id desc limit 1").first();
+
+  const shown = archived
+    ? "<p class='dim'>Notes the nightly tidy-up moved off the board. <a href='/'>Back to the board</a></p>"
+    : form() +
+      "<p class='dim filters'>" +
+      (tag === "" ? "All notes" : "Tagged <b>" + escape(tag) + "</b> · <a href='/'>show all</a>") +
+      " · <a href='/?view=archived'>Archived (" + archivedCount + ")</a></p>";
+
+  return [
+    "<!doctype html>",
+    "<html lang='en'>",
+    "<meta charset='utf-8'>",
+    "<meta name='viewport' content='width=device-width, initial-scale=1'>",
+    "<title>" + TITLE + "</title>",
+    "<style>" + STYLE + "</style>",
+    "<main>",
+    "<header><h1>" + TITLE + "</h1>",
+    "<p class='dim'>Your first app on wirl. Signed in as <b>" + escape(me.name) + "</b>" + (me.role ? " (" + escape(me.role) + ")" : "") + ".</p></header>",
+    shown,
+    "<ul class='notes'>" + (notes.length === 0 ? "<li class='dim'>Nothing here yet.</li>" : notes.map((note) => card(note, me, archived)).join("")) + "</ul>",
+    panel(request, me, lastRun),
+    suggestions(),
+    "</main>",
+    "</html>",
+  ].join("\n");
+}
+
+function form() {
+  return [
+    "<form class='add' method='post' action='/notes'>",
+    "<textarea name='body' rows='3' maxlength='" + LONGEST_NOTE + "' required placeholder='Post a note for the team'></textarea>",
+    "<input name='tags' placeholder='Tags, separated by commas'>",
+    "<button class='primary'>Post</button>",
+    "</form>",
+  ].join("");
+}
+
+function card(note, me, archived) {
+  const mine = note.author_id === me.id || me.role === "owner";
+  const action = (what, label) =>
+    "<form method='post' action='/notes/" + note.id + "/" + what + "'><button>" + label + "</button></form>";
+  const tagLinks = note.tags
+    .split(",")
+    .filter((tag) => tag !== "")
+    .map((tag) => "<a class='tag' href='/?tag=" + encodeURIComponent(tag) + "'>#" + escape(tag) + "</a>")
+    .join(" ");
+  const controls = archived
+    ? (mine ? action("restore", "Put back") : "")
+    : action("pin", note.pinned ? "Unpin" : "Pin") +
+      (mine
+        ? "<details><summary>Edit</summary><form class='edit' method='post' action='/notes/" + note.id + "/edit'>" +
+          "<textarea name='body' rows='3' maxlength='" + LONGEST_NOTE + "' required>" + escape(note.body) + "</textarea>" +
+          "<input name='tags' value='" + escape(note.tags.split(",").join(", ")) + "'>" +
+          "<button class='primary'>Save</button></form></details>" +
+          action("remove", "Remove")
+        : "");
+  return (
+    "<li class='note" + (note.pinned && !archived ? " pinned" : "") + "'>" +
+    "<p>" + escape(note.body) + "</p>" +
+    "<div class='meta dim'>" + (note.pinned && !archived ? "<b>Pinned</b> · " : "") +
+    escape(note.author_name || "someone") + " · " + escape(note.created_at.slice(0, 10)) + (tagLinks ? " · " + tagLinks : "") + "</div>" +
+    "<div class='actions'>" + controls + "</div>" +
+    "</li>"
+  );
+}
+
+// The app's page on the dashboard, from the address it was opened at:
+// <org>--<app>.wirl.run, or <org>--<app>--<preview>.wirl.run for a preview.
+// Under wirl dev the address is 127.0.0.1, which names no app: null.
+function dashboard(request) {
+  const label = new URL(request.url).hostname.split(".")[0];
+  const parts = label.split("--");
+  if (parts.length < 2) return null;
+  const org = request.headers.get("x-wirl-org") || parts[0];
+  return DASHBOARD + "/apps/" + encodeURIComponent(org) + "/" + encodeURIComponent(parts[1]);
+}
+
+function panel(request, me, lastRun) {
+  const base = dashboard(request);
+  const last = lastRun ? "Last run " + lastRun.ran_at.slice(0, 16) + " UTC: " + lastRun.note : "Not run yet.";
+  // One row per feature: what it is, what it does in this app, and its page.
+  const rows = [
+    ["Who can open it", "wirl signed you in before this page loaded and tells the app who you are, in headers: here you are " + me.name + (me.role ? ", " + me.role : "") + ". The app has no sign-in code of its own. It started private to you; choose who else can open it on Access.", "/access", "Access"],
+    ["Your data", "Notes are rows in this app's own SQLite database. Its tables are in migrations/0001_init.sql, and a deploy applies each new file in migrations/ before it goes live.", "/deployments", "Deployments"],
+    ["A schedule", "tidy runs every night at 02:00 UTC and archives notes older than " + ARCHIVE_AFTER_DAYS + " days that nobody pinned. " + last + " Run it now from Overview.", "", "Overview"],
+    ["Logs", "Each request writes a line with console.log, and so does each change to a note. Read them on Logs, or ask your agent to run wirl logs.", "/logs", "Logs"],
+    ["Versions", "Each wirl deploy is a new version, and the earlier ones stay: going back to one takes a click.", "/deployments", "Deployments"],
+    ["Previews", "wirl preview puts a change up at an address of its own, with its own database, and nothing goes live until you deploy. Open previews are listed on Overview.", "", "Overview"],
+    ["Outside APIs", "Declare a connection in wirl.json and fetch the service's own URL: wirl adds the key on the way out, so it never reaches this code or a chat.", "/connections", "Connections"],
+    ["Settings", "Describe the app for your team's list of tools, hand it to someone else, or delete it.", "/settings", "Settings"],
+  ];
+  return [
+    "<section><h2>How this works on wirl</h2>",
+    "<table>",
+    ...rows.map(([feature, what, path, label]) =>
+      "<tr><td>" + feature + "</td><td>" + escape(what) + "</td><td>" +
+      (base === null ? "<span class='dim'>" + label + "</span>" : "<a href='" + escape(base + path) + "'>" + label + "</a>") +
+      "</td></tr>",
+    ),
+    "</table>",
+    base === null ? "<p class='dim'>Running under wirl dev, so these pages are not linked here: they open on app.wirl.dev once it is deployed.</p>" : "",
+    "</section>",
+  ].join("\n");
+}
+
+function suggestions() {
+  return [
+    "<section><h2>Ask your agent for a first change</h2>",
+    "<p class='dim'>Each of these is a whole prompt. Open one, copy it, and paste it to the coding agent that made this app.</p>",
+    ...SUGGESTIONS.map((each) => "<details><summary>" + escape(each.title) + "</summary><pre>" + escape(each.prompt) + "</pre></details>"),
+    "</section>",
+  ].join("\n");
+}
+
+`;
+var SERVER_TAIL = String.raw`
+
+const STYLE = [
+  ":root { color-scheme: light dark; --ink: #1d1d1b; --dim: #66655f; --line: #e2e0d9; --card: #ffffff; --bg: #f7f6f2; --pin: #fff3bf; --accent: #2b6b5a; }",
+  "@media (prefers-color-scheme: dark) { :root { --ink: #ecebe6; --dim: #a6a59f; --line: #36352f; --card: #1f1f1c; --bg: #161614; --pin: #3b3420; --accent: #8fd1bd; } }",
+  "body { margin: 0; background: var(--bg); color: var(--ink); font: 15px/1.5 system-ui, sans-serif; }",
+  "main { max-width: 760px; margin: 0 auto; padding: 24px 16px 48px; }",
+  "h1 { font-size: 24px; margin: 0 0 4px; } h2 { font-size: 17px; margin: 36px 0 8px; }",
+  "a { color: var(--accent); } .dim { color: var(--dim); }",
+  "form.add, form.edit { display: grid; gap: 8px; margin: 16px 0 8px; }",
+  "textarea, input, button { font: inherit; color: inherit; padding: 7px 10px; border: 1px solid var(--line); border-radius: 6px; background: var(--card); }",
+  "button { cursor: pointer; } button.primary { justify-self: start; background: var(--accent); border-color: var(--accent); color: var(--bg); }",
+  "ul.notes { list-style: none; padding: 0; display: grid; gap: 10px; }",
+  ".note { background: var(--card); border: 1px solid var(--line); border-radius: 8px; padding: 12px 14px; }",
+  ".note.pinned { background: var(--pin); }",
+  ".note p { margin: 0 0 6px; white-space: pre-wrap; overflow-wrap: anywhere; }",
+  ".meta, .actions { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; font-size: 13px; }",
+  ".actions { margin-top: 8px; } .actions form { margin: 0; } .actions details { flex-basis: 100%; order: 3; }",
+  ".tag { text-decoration: none; }",
+  "table { width: 100%; border-collapse: collapse; font-size: 14px; }",
+  "td { border-top: 1px solid var(--line); padding: 8px 6px; vertical-align: top; }",
+  "td:first-child { font-weight: 600; }",
+  "pre { white-space: pre-wrap; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 10px; font-size: 13px; }",
+  "details { margin: 6px 0; } summary { cursor: pointer; }",
+].join("\n");
+
+const home = (to = "/") => new Response(null, { status: 303, headers: { location: to } });
+
+const text = (body, status = 200) => new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
+
+const html = (markup) => new Response(markup, { headers: { "content-type": "text/html; charset=utf-8" } });
+
+// Escapes text for HTML, in content and in quoted attribute values alike.
+const escape = (value) =>
+  String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+const decode = (value) => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+// A form field as trimmed text, at most max characters.
+const clean = (value, max) => (typeof value === "string" ? value.trim().slice(0, max) : "");
+
+// "Team, Stand-up" becomes "team,stand-up": lowercase words, letters, digits
+// and hyphens only, so a tag is safe in a link and in the LIKE above.
+const tags = (value) =>
+  clean(value, 200)
+    .split(",")
+    .map((tag) => tag.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((word) => word !== "").join("-"))
+    .filter((tag, i, all) => tag !== "" && all.indexOf(tag) === i)
+    .slice(0, 8)
+    .join(",");
+`;
+var SERVER_MODULE = `${SERVER_HEAD}${SUGGESTIONS_SOURCE}${SERVER_TAIL}`;
+var STARTER_MIGRATION = [
+  "-- The noticeboard's tables. wirl applies each new file here, in order, before a version goes live.",
+  "-- Make the next change in 0002_<what>.sql; never edit a file that has been deployed.",
+  "create table notes (id integer primary key, body text not null, tags text not null default '', pinned integer not null default 0, author_id text not null, author_name text not null default '', created_at text not null default (datetime('now')), archived_at text)",
+  "create table runs (id integer primary key, schedule text not null, note text not null, ran_at text not null default (datetime('now')))",
+  "insert into notes (body, tags, pinned, author_id, author_name) values ('Welcome to the noticeboard. Post a note below, tag it, and pin the ones everyone should see.', 'welcome', 1, '', 'wirl')",
+  ""
+].join("\n");
+function starterManifest(app, org) {
+  const manifest = {
+    app,
+    ...org ? { org } : {},
+    dir: ".",
+    server: "server.mjs",
+    description: "A team noticeboard: your first app on wirl",
+    visibility: "private",
+    schedules: [{ name: "tidy", cron: "0 2 * * *", timezone: "UTC" }]
+  };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
 }
+var README = [
+  "# Team noticeboard",
+  "",
+  "Your first app on wirl: a board where your team posts short notes, tags them, pins the ones everyone should see, and edits or removes their own. Every night a schedule archives old notes nobody pinned.",
+  "",
+  'Open it at the address `wirl deploy` prints. It starts private to you. Its page has a "How this works on wirl" panel: one row per thing wirl does for this app, each linking to that page of the app on app.wirl.dev.',
+  "",
+  "## What is where",
+  "",
+  "- `server.mjs`: the whole app, one module with one `fetch`. The page, the forms, who may change a note, and the nightly tidy-up.",
+  "- `migrations/0001_init.sql`: the tables, one statement a line. Put the next change in `migrations/0002_<what>.sql`.",
+  "- `wirl.json`: the app's name, its module, its nightly schedule, and that it is created private.",
+  "- `.claude/skills/wirl/SKILL.md`: how a coding agent works with wirl.",
+  "",
+  "## Run it on this computer",
+  "",
+  `    ${WIRL_BIN} dev`,
+  "",
+  "It prints the address to open, and a `curl` line that runs the nightly tidy-up now.",
+  "",
+  "## Changes to ask your agent for",
+  "",
+  "Each is a whole prompt: paste it to your coding agent as it is.",
+  "",
+  ...SUGGESTIONS.flatMap(({ title, prompt }) => [`### ${title}`, "", `> ${prompt}`, ""])
+].join("\n");
+var STARTER_FILES = {
+  "server.mjs": SERVER_MODULE,
+  "migrations/0001_init.sql": STARTER_MIGRATION,
+  "README.md": README,
+  "wirl.json": starterManifest("starter")
+};
 
 // packages/cli/src/core.ts
 function credentialsPath(env = process.env) {
@@ -6765,23 +8078,23 @@ var INIT_MIGRATION = [
   ""
 ].join("\n");
 var INIT_MIGRATION_PATH = `${MIGRATIONS_DIR}/${ADOPTED_FILE}`;
-async function refuseInitMigrations(dir) {
+async function refuseInitMigrations(dir, flag) {
   for (const entry of await readdir(dir, { withFileTypes: true })) {
     if (entry.name.toLowerCase() !== MIGRATIONS_DIR) continue;
     if (entry.isSymbolicLink()) {
-      throw new CliError(`${entry.name}/ is a symbolic link, and wirl writes into no links: make migrations/ a real folder, then run wirl init --server again.`);
+      throw new CliError(`${entry.name}/ is a symbolic link, and wirl writes into no links: make migrations/ a real folder, then run wirl init ${flag} again.`);
     }
     if (entry.name !== MIGRATIONS_DIR) {
-      throw new CliError(`${entry.name}/ is spelled differently from migrations/: wirl reads migrations/ in lowercase only. Rename it, then run wirl init --server again.`);
+      throw new CliError(`${entry.name}/ is spelled differently from migrations/: wirl reads migrations/ in lowercase only. Rename it, then run wirl init ${flag} again.`);
     }
     if (!entry.isDirectory()) {
       throw new CliError(
-        `migrations is a file, and wirl init --server writes ${INIT_MIGRATION_PATH} into a folder of that name. Move it aside, then run wirl init --server again.`
+        `migrations is a file, and wirl init ${flag} writes ${INIT_MIGRATION_PATH} into a folder of that name. Move it aside, then run wirl init ${flag} again.`
       );
     }
     const names = await readdir(join5(dir, entry.name));
     if (names.some((name) => name.toLowerCase().endsWith(".sql"))) {
-      throw new CliError(`migrations/ already holds .sql files; wirl init --server writes ${INIT_MIGRATION_PATH} into a folder with none.`);
+      throw new CliError(`migrations/ already holds .sql files; wirl init ${flag} writes ${INIT_MIGRATION_PATH} into a folder with none.`);
     }
   }
 }
@@ -6793,23 +8106,9 @@ var SKILL_RUN = NPM_PUBLISHED ? `Run the CLI as \`${WIRL_BIN} <command>\`, which
 ` : "";
 var SKILL_FALLBACK = hasFallback(SKILL_INSTALL) ? `- ${fallbackWhen(namedControlPlane(SKILL_ORIGIN))} install the CLI from the control plane instead with \`npm install -g ${SKILL_INSTALL.tarball.cli}\`, run plain \`wirl\` where this file says \`${WIRL_BIN}\`, and name \`${SKILL_INSTALL.tarball.mcp}\` in place of \`${SKILL_INSTALL.mcp}\`.
 ` : "";
-var SKILL_MARKDOWN = `---
-name: wirl
-description: Deploy and share the internal app in this project with wirl (${WIRL_BIN}). Use when the user wants a tool, dashboard or prototype put somewhere colleagues can open it, shared with a named person, run locally the way it will run deployed, or connected to a third-party API; or wants work that outlives one request, such as waiting for a person to approve something or trying again tomorrow.
----
-
-# wirl
-
-A new app is visible to everyone in the org when the org came from a
-company email domain; in any other org, including a personal one or one
-made with \`wirl orgs create\`, it starts private. Deploys are one
-command; sharing is by email; a third-party API is declared, never pasted.
-
-Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.
-
-## Commands
-
-${SKILL_RUN}- Connect first, if the agent supports MCP: \`claude mcp add --transport http wirl https://app.wirl.dev/mcp\` opens the browser once to sign in, and needs no install. No HTTP MCP support? \`claude mcp add wirl -- npx -y ${SKILL_INSTALL.mcp}\` does the same, running locally. Neither available: \`${WIRL_BIN} login\` prints a link and a code; the person approves in the browser. Do this once, when any command says you are not signed in.
+var SKILL_MARKDOWN = composeSkill({
+  description: `Deploy and share the internal app in this project with wirl (${WIRL_BIN}). Use when the user wants a tool, dashboard or prototype put somewhere colleagues can open it, shared with a named person, run locally the way it will run deployed, or connected to a third-party API; or wants work that outlives one request, such as waiting for a person to approve something or trying again tomorrow.`,
+  commands: `${SKILL_RUN}- Connect first, if the agent supports MCP: \`claude mcp add --transport http wirl https://app.wirl.dev/mcp\` needs no install. ${CLAUDE_CODE_SIGN_IN} No HTTP MCP support? \`claude mcp add wirl -- npx -y ${SKILL_INSTALL.mcp}\` runs the same tools locally. ${CLAUDE_CODE_LOCAL_SIGN_IN} Neither available: \`${WIRL_BIN} login\` prints a link and a code; the person approves in the browser. Do this once, when any command says you are not signed in.
 - \`${WIRL_BIN} deploy\` \u2014 deploys this directory. Prints the URL and who can open it.
 - \`${WIRL_BIN} share someone@company.com\` \u2014 that person can open it. Add \`--role editor\` so they can deploy too.
 - \`${WIRL_BIN} dev\` \u2014 runs the app here as it will run deployed, signed in as a stub user.
@@ -6818,33 +8117,8 @@ ${SKILL_RUN}- Connect first, if the agent supports MCP: \`claude mcp add --trans
 - \`${WIRL_BIN} migrations\` \u2014 what this app's database has applied, read only.
 - \`${WIRL_BIN} migrations adopt\` \u2014 once, for an app whose tables were made in code: writes \`migrations/0001_init.sql\` from the live database's shape.
 - \`${WIRL_BIN} --help\` \u2014 everything else: orgs, members, connections, move, transfer, rollback, flows and runs.
-${SKILL_FALLBACK}
-## Rules
-
-1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
-2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
-3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
-4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
-5. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.
-
-## wirl.json
-
-\`\`\`json
-{ "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
-\`\`\`
-
-## What runs on wirl
-
-${BUILD_CONTRACT}
-
-No blob storage: files go in \`env.DB\`, at most 2,000,000 bytes a value or row (the limit Cloudflare publishes for D1), so store a larger file in chunks, one row each, a few MB to a batch. \`wirl dev\` refuses a single bound value over 2,000,000 bytes, but a row's total, a value grown in SQL, or a batch bigger than one call to D1 carries can still pass locally and fail deployed.
-
-A static folder maps a path to one file exactly: a path ending in \`/\` serves the \`index.html\` in that folder, \`/about\` never finds \`about.html\`, and a path that names no file goes to the module (with \`"spa": true\`, a page navigation gets \`index.html\` instead; in an app with no module, the top \`index.html\`, or a 404 for a missing file with an extension). Next.js runs only as a static export: \`output: "export"\` and \`trailingSlash: true\` in \`next.config\` make \`next build\` write \`out/\`, which goes under \`"static"\`; \`next start\` cannot run, and API routes move into the module.
-
-## Flows
-
-${FLOWS_CONTRACT}
-`;
+${SKILL_FALLBACK}`
+});
 async function writeSkill(dir) {
   const path = join5(dir, SKILL_PATH);
   const existing = await readFile3(path, "utf8").catch(() => null);
@@ -6865,23 +8139,52 @@ async function pulledDevCommand(dir) {
   }
   return `${needsInstall ? "npm install && " : ""}${WIRL_BIN} dev`;
 }
+function starterFile(path) {
+  const text = STARTER_FILES[path];
+  if (text === void 0) throw new Error(`starter.ts has no ${path}`);
+  return text;
+}
+function moduleKit(options) {
+  if (options.starter) {
+    return {
+      flag: "--starter",
+      files: ["server.mjs", INIT_MIGRATION_PATH, "README.md"].map((path) => [path, starterFile(path)]),
+      hint: "Run wirl init --starter in a new folder, or move the existing file."
+    };
+  }
+  if (options.server) {
+    return {
+      flag: "--server",
+      files: [
+        ["server.mjs", SERVER_TEMPLATE],
+        [INIT_MIGRATION_PATH, INIT_MIGRATION]
+      ],
+      hint: "Remove --server, or move the existing file."
+    };
+  }
+  return null;
+}
 async function scaffold(dir, options) {
+  if (options.server && options.starter) throw new CliError(STARTER_CONFLICT);
+  const kit = moduleKit(options);
   const written = [];
   await mkdir3(dir, { recursive: true });
-  if (options.server) {
-    const target = join5(dir, "server.mjs");
-    try {
-      await readFile3(target);
-      throw new CliError(`server.mjs already exists in ${dir}.`, "Remove --server, or move the existing file.");
-    } catch (error) {
-      if (error instanceof CliError) throw error;
-    }
-    await refuseInitMigrations(dir);
-    await writeFile2(target, SERVER_TEMPLATE, "utf8");
-    written.push("server.mjs");
-    await mkdir3(join5(dir, MIGRATIONS_DIR), { recursive: true });
-    await writeFile2(join5(dir, MIGRATIONS_DIR, ADOPTED_FILE), INIT_MIGRATION, { encoding: "utf8", flag: "wx" });
-    written.push(INIT_MIGRATION_PATH);
+  if (kit !== null) {
+    for (const [name] of kit.files) {
+      if (name === INIT_MIGRATION_PATH) continue;
+      try {
+        await readFile3(join5(dir, name));
+        throw new CliError(`${name} already exists in ${dir}.`, kit.hint);
+      } catch (error) {
+        if (error instanceof CliError) throw error;
+      }
+    }
+    await refuseInitMigrations(dir, kit.flag);
+    for (const [name, text] of kit.files) {
+      await mkdir3(dirname3(join5(dir, name)), { recursive: true });
+      await writeFile2(join5(dir, name), text, { encoding: "utf8", flag: "wx" });
+      written.push(name);
+    }
     const pkg = join5(dir, "package.json");
     if (await readFile3(pkg, "utf8").catch(() => null) === null) {
       await writeFile2(pkg, `${JSON.stringify({ name: options.app, private: true, type: "module" }, null, 2)}
@@ -6895,8 +8198,9 @@ async function scaffold(dir, options) {
     dir: ".",
     ...options.server ? { server: "server.mjs" } : {}
   };
-  await writeFile2(join5(dir, MANIFEST_NAME), `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
+  const manifestText = kit?.flag === "--starter" ? starterManifest(options.app, options.org) : `${JSON.stringify(manifest, null, 2)}
+`;
+  await writeFile2(join5(dir, MANIFEST_NAME), manifestText, "utf8");
   const gitignore = join5(dir, ".gitignore");
   const existing = await readFile3(gitignore, "utf8").catch(() => "");
   const wanted = [".wirl/", ".env"].filter((line) => !existing.split("\n").includes(line));
@@ -7165,7 +8469,7 @@ async function callApi(creds, path, options = {}) {
     const body = parsed ?? {};
     const refusal = apiRefusal(parsed, response);
     if (response.status === 403 && body.error === "insufficient_scope" && body.message) {
-      throw new CliError(body.message, "Ask the person to do it in the dashboard, or reconnect with full access.", refusal);
+      throw new CliError(body.message, `Ask the person to do it in the dashboard, or run ${WIRL_BIN} login and tick full access on the approval page.`, refusal);
     }
     if (response.status === 403 && (body.error === "person_only" || body.error === "bad_confirmation") && body.message) {
       throw new CliError(body.message, void 0, refusal);
@@ -7216,23 +8520,51 @@ async function callApiBytes(creds, path, options = {}) {
   }
   const declared = Number(response.headers.get("content-length") ?? 0);
   if (declared > MAX_PULL_BYTES) throw new CliError(`That is ${Math.round(declared / 1048576)} MB, more than wirl will pull.`);
-  const bytes = new Uint8Array(await response.arrayBuffer());
+  let bytes;
+  try {
+    bytes = new Uint8Array(await response.arrayBuffer());
+  } catch {
+    throw new CliError(PULL_CUT, void 0, { code: "pull_cut" });
+  }
   if (bytes.byteLength > MAX_PULL_BYTES) throw new CliError("The download was larger than wirl will pull.");
   return bytes;
 }
+var PULL_CUT = "The pull was cut before it finished, so nothing was written. Run it again.";
+var pullShort = (dir) => `The pull's archive is cut short or damaged, so nothing was written to ${dir}. Run it again.`;
 var MAX_PULL_BYTES = 256 * 1048576;
 var pullApp = (creds, org, app, options = {}) => callApiBytes(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/pull`, options.fetchImpl ? { fetchImpl: options.fetchImpl } : {});
+function isWholeArchive(archive) {
+  return new Promise((resolve7, reject) => {
+    let sound = true;
+    let ended2 = false;
+    const parser = new TarParser({ onReadEntry: (entry) => void entry.resume() });
+    parser.on("warn", (code) => {
+      if (code === "TAR_BAD_ARCHIVE" || code === "TAR_ENTRY_INVALID") sound = false;
+    });
+    parser.on("eof", () => {
+      ended2 = true;
+    });
+    parser.on("error", (error) => typeof error.code === "string" && error.code.startsWith("Z_") ? resolve7(false) : reject(error));
+    parser.on("end", () => resolve7(sound && ended2));
+    parser.end(archive);
+  });
+}
 async function unpackPull(bytes, dir, options = {}) {
-  await mkdir3(dir, { recursive: true });
-  const existing = await readdir(dir);
+  const existing = await readdir(dir).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
   if (existing.length > 0 && !options.force) {
     throw new CliError(`${dir} is not empty.`, "Pull into a new directory, or pass --force to overwrite.");
   }
+  const archive = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (!await isWholeArchive(archive)) throw new CliError(pullShort(dir), void 0, { code: "pull_cut" });
+  await mkdir3(dir, { recursive: true });
   await new Promise((resolve7, reject) => {
     const extractor = tarExtract({ cwd: dir });
     extractor.on("error", reject);
     extractor.on("finish", resolve7);
-    extractor.end(Buffer.from(bytes));
+    extractor.end(archive);
   });
   const written = [];
   await collect(dir, dir, written);
@@ -7338,6 +8670,11 @@ function manifestWarningLines(manifest) {
   const parsed = parseManifest(manifest);
   return parsed.ok ? parsed.warnings.map((warning) => `Warning: ${warning}`) : [];
 }
+function manifestVisibility(manifest) {
+  if (manifest === null || manifest === void 0) return void 0;
+  const parsed = parseManifest(manifest);
+  return parsed.ok ? parsed.manifest.visibility : void 0;
+}
 async function prepareDeployBundle(dir, manifest, door, projectDir) {
   let server;
   let rules = NO_MANIFEST;
@@ -7544,6 +8881,10 @@ function formatOrgLine(org) {
   return org.domain ? `${head}  ${org.domain}: new apps start visible to everyone in it` : `${head}  no company domain: new apps start private`;
 }
 var whoami = (creds) => callApi(creds, "/api/v1/me");
+function signedInSentence(me) {
+  const gave = (me.scope ?? "full") === "full" ? "full access" : "build-and-update";
+  return `Signed in (${gave}). Organisations: ${me.orgs.map((o) => o.slug).join(", ") || "none yet"}.`;
+}
 function chooseOrg(orgs, given, hint = 'Pass --org <slug>, or add "org" to wirl.json.') {
   const named = (given ?? "").trim();
   if (named) return named;
@@ -7557,13 +8898,25 @@ async function resolveAppsOrg(creds, orgFlag, manifestOrg) {
   return chooseOrg((await whoami(creds)).orgs, null);
 }
 var listApps = (creds, org) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`);
-var createRemoteApp = (creds, org, slug, name) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`, {
+var createRemoteApp = (creds, org, slug, name, visibility) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`, {
   method: "POST",
-  body: JSON.stringify({ slug, name: name ?? slug }),
+  // `visibility` rides along only when wirl.json said it: absent, the
+  // org's default holds. It applies to the app this create makes and to
+  // no other: an app that exists answers 409 and is left as it is.
+  body: JSON.stringify({ slug, name: name ?? slug, ...visibility === void 0 ? {} : { visibility } }),
   contentType: "application/json"
 });
-async function ensureRemoteApp(creds, org, app) {
-  return createRemoteApp(creds, org, app).then(() => true, (error) => {
+async function ensureRemoteApp(creds, org, app, visibility) {
+  return createRemoteApp(creds, org, app, void 0, visibility).then((created) => {
+    const made = created.app?.visibility;
+    if (visibility === "private" && typeof made === "string" && made !== "private") {
+      process.stderr.write(
+        `${terminalSafe(`wirl: asked for a private app, but ${org}/${app} was created visible to everyone in the organisation (an older control plane, or someone created it first). Change it with: wirl visibility private --org ${org} --app ${app}`)}
+`
+      );
+    }
+    return true;
+  }, (error) => {
     if (!(error instanceof CliError)) throw error;
     if (error.fields["code"] === "app_deleted") throw deletedNameError(error, app);
     if (error.fields["code"] === "app_exists" || error.fields["code"] === "app_moved") throw takenNameError(error, app);
@@ -7609,7 +8962,7 @@ function deletedAppMessage(org, app, done) {
   return `Deleted ${org}/${app}. Its address has stopped answering${runs}. Its data is kept until ${done.dataKeptUntil.slice(0, 10)}; until then wirl apps restore ${app} --org ${org} brings it back (one that was public comes back only from the Recently deleted list on the dashboard). Its name stays taken.`;
 }
 function deleteNeedsFullScopeMessage(apiOrigin, org, app) {
-  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with ${WIRL_BIN} login (with WIRL_TOKEN unset), or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
+  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with ${WIRL_BIN} login (with WIRL_TOKEN unset) and tick full access on the approval page, or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
 }
 var VISIBILITY_LEVELS = ["private", "org", "public"];
 function describeVisibility(level, org) {
@@ -7625,10 +8978,13 @@ function describeVisibility(level, org) {
   }
 }
 var readVisibility = (creds, org, app) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}`).then((r) => r.app.visibility ?? "unknown");
-async function changeVisibility(creds, options) {
-  if (!VISIBILITY_LEVELS.includes(options.level)) {
-    throw new CliError(`Visibility is private, org or public, not "${String(options.level)}".`);
+function refuseVisibilityLevel(level) {
+  if (!VISIBILITY_LEVELS.includes(level)) {
+    throw new CliError(`Visibility is private, org or public, not "${String(level)}".`);
   }
+}
+async function changeVisibility(creds, options) {
+  refuseVisibilityLevel(options.level);
   if (options.level === "public") {
     throw new CliError(
       "Public means anyone on the internet with the link can open it, without signing in, so a person decides that with their own click.",
@@ -7673,11 +9029,59 @@ var transferApp = (creds, org, app, email, options = {}) => callApi(creds, `/api
   ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
 });
 var unmailedNote = (result) => result.mailed === false && result.message ? ` ${result.message}` : "";
+function refuseShareRole(value) {
+  const read = readShareRole(value);
+  if (read.ok) return read.role;
+  const shown2 = typeof value === "string" ? terminalSafe(value.slice(0, 40)) : typeof value;
+  throw new CliError(`Role is viewer or editor, not "${shown2}".`);
+}
 var shareApp = (creds, org, app, email, role) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/share`, {
   method: "POST",
-  body: JSON.stringify({ email, role }),
+  // No role is no `role`: the control plane then keeps the one a person has.
+  body: JSON.stringify(role === void 0 ? { email } : { email, role }),
+  contentType: "application/json"
+});
+function shareSentence(result, email, asked, voice) {
+  const roleOf = (value) => value === "viewer" || value === "editor" ? value : void 0;
+  const outcome = ["added", "kept", "unchanged", "changed"].includes(String(result.outcome)) ? result.outcome : void 0;
+  const role = roleOf(result.role);
+  const old = outcome === void 0 || role === void 0;
+  const now = role ?? asked ?? "viewer";
+  const was = roleOf(result.previousRole);
+  const article = (name) => name === "editor" ? "an editor" : "a viewer";
+  const mail = unmailedNote(result);
+  const signIn = voice === "cli" ? "the moment they first sign in" : "when they first sign in";
+  if (result.pending) {
+    const wait = `They will have access ${signIn}.`;
+    if (!old && outcome === "kept") return `${email} was already invited as ${now}, and no role was given, so it stays ${now}. ${wait}${mail}`;
+    const lead2 = `Invited ${email} as ${now}. ${wait}`;
+    if (old || outcome === "added") return `${lead2}${mail}`;
+    if (outcome === "unchanged") return `${lead2} The invitation already said that.${mail}`;
+    if (was === void 0) return `${lead2} The invitation's role was changed.${mail}`;
+    return `${lead2} The invitation said ${was} before.${mail}`;
+  }
+  if (!old && outcome === "kept") {
+    const change = voice === "cli" ? "Pass --role viewer or --role editor" : 'Pass role "viewer" or "editor"';
+    return `${email} already had access as ${now}, and no role was given, so it stays ${now}. ${change} to change it.`;
+  }
+  const lead = voice === "cli" ? `Shared with ${email} as ${now}.` : `${email} can now open the app as ${now}.`;
+  if (old || outcome === "added") return lead;
+  if (outcome === "unchanged") return `${lead} They already had that role.`;
+  if (was === void 0) return `${lead} Their role was changed.`;
+  return `${lead} They were ${article(was)} before.`;
+}
+var unshareApp = (creds, org, app, email) => callApi(creds, `/api/v1/apps/${seg(org)}/${seg(app)}/share`, {
+  method: "DELETE",
+  body: JSON.stringify({ email }),
   contentType: "application/json"
 });
+function unshareSentence(result, email) {
+  const share = result.shareRevoked ?? result.revoked;
+  const invitation = result.invitationWithdrawn ?? false;
+  const found = share ? invitation ? `Revoked ${email}'s share and withdrew the invitation still waiting for them.` : `Revoked ${email}'s share.` : invitation ? `Withdrew ${email}'s invitation.` : `${email} held no share on the app and had no invitation to it, so there was nothing to take back.`;
+  const wasDeleted = result.appDeleted === true && (share || invitation) ? " The app was deleted when this was asked, so a restore will not bring it back." : "";
+  return `${found}${wasDeleted} That takes back only what was shared by name: the app's level (wirl_visibility) and the rights of its owner and the organisation's owners and admins are unchanged.`;
+}
 var listDeployments = (creds, org, app) => callApi(
   creds,
   `/api/v1/apps/${seg(org)}/${seg(app)}/deployments`
@@ -7821,7 +9225,7 @@ var fetchLogs = (creds, org, app, filters) => callApi(
 );
 var LINE_INDENT = "         ";
 function terminalSafe(text) {
-  return escapeInvisible(text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`));
+  return escapeInvisible(text.replace(/\r\n/g, "\n").replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`));
 }
 function utcSecond(at2) {
   const ms = Date.parse(at2);
@@ -7857,7 +9261,8 @@ function formatLogPage(page, since) {
     // queryable. Without this an empty answer right after a request
     // reads as "nothing happened".
     " A request made in the last minute may not have arrived yet: ask again shortly."
-  )}` : page.invocations.map((entry) => formatInvocation(entry)).join("\n\n");
+  )}
+${EDGE_REFUSALS_NOTE}` : page.invocations.map((entry) => formatInvocation(entry)).join("\n\n");
   return page.cursor === null ? body : `${body}
 
 More before this: pass cursor=${page.cursor}.`;
@@ -8403,20 +9808,22 @@ async function previewFetch(creds, org, app, name, path, options) {
   const headers = callerHeaders(options.headers);
   headers.set(VISIT_HEADER, mint.token);
   const networkFetch = options.networkFetchImpl ?? fetch;
-  const sentAt = Date.now();
+  const clock = options.now ?? (() => performance.now());
+  const sentAt = clock();
+  const elapsed = () => Math.round(clock() - sentAt);
   const response = await networkFetch(target.toString(), {
     method: options.method ?? (options.body !== void 0 ? "POST" : "GET"),
     headers,
     redirect: "manual",
     ...options.body === void 0 ? {} : { body: options.body }
   });
-  const headersMs = Date.now() - sentAt;
+  const headersMs = elapsed();
   const contentType = response.headers.get("content-type") ?? "";
   const location = response.headers.get("location");
   const text = isTextBody(contentType);
   const streamWaitMs = Math.min(options.streamWaitMs ?? FETCH_STREAM_WAIT_MS, FETCH_WAIT_MAX_SECONDS * 1e3);
   const keep = options.keepBodyBytes === void 0 ? null : Math.min(options.keepBodyBytes, FETCH_FILE_MAX_BYTES);
-  const read = await readBounded(response, streamWaitMs, sentAt, keep ?? FETCH_READ_CEILING_BYTES);
+  const read = await readBounded(response, streamWaitMs, elapsed, keep ?? FETCH_READ_CEILING_BYTES);
   const bytes = read.bytes;
   const truncated = text && (read.cut || bytes.byteLength > FETCH_BODY_CAP_BYTES);
   const media = (contentType.split(";")[0] ?? "").trim().toLowerCase();
@@ -8504,7 +9911,7 @@ function parseWaitFlag(raw) {
 }
 var FETCH_READ_CEILING_BYTES = 8 * FETCH_BODY_CAP_BYTES;
 var FETCH_FILE_MAX_BYTES = 1e8;
-async function readBounded(response, waitMs, sentAt, ceilingBytes) {
+async function readBounded(response, waitMs, elapsed, ceilingBytes) {
   if (response.body === null) return { bytes: new Uint8Array(0), chunks: [], stillStreaming: false, cut: false };
   const reader = response.body.getReader();
   const chunks = [];
@@ -8523,7 +9930,7 @@ async function readBounded(response, waitMs, sentAt, ceilingBytes) {
         break;
       }
       if (next.done) break;
-      chunks.push({ atMs: Date.now() - sentAt, bytes: next.value });
+      chunks.push({ atMs: elapsed(), bytes: next.value });
       total += next.value.byteLength;
       if (total > ceilingBytes) {
         cut2 = true;
@@ -8568,9 +9975,9 @@ function formatFetchResult(result, saved) {
       0,
       `answered after ${seconds(result.headersMs)} s; ${said} line${said === 1 ? "" : "s"} in ${pieces} piece${pieces === 1 ? "" : "s"} over ${seconds(last)} s (each line shown at the time it was complete)`
     );
+    const unfinished = lastLineUnfinished(result);
     timed.forEach((line, i) => {
-      const unfinished = i === timed.length - 1 && !result.timed.lastComplete && (!result.bodyComplete || result.truncated);
-      lines.push(line.text === "" ? "" : `+${seconds(line.atMs)}s  ${line.text}${unfinished ? "  (the line had not ended)" : ""}`);
+      lines.push(line.text === "" ? "" : `+${seconds(line.atMs)}s  ${line.text}${unfinished && i === timed.length - 1 ? "  (the line had not ended)" : ""}`);
     });
   } else {
     lines.push(result.bodyText);
@@ -8583,6 +9990,10 @@ function formatFetchResult(result, saved) {
   }
   return lines.join("\n");
 }
+function lastLineUnfinished(result) {
+  return result.timed !== null && !result.timed.lastComplete && (!result.bodyComplete || result.truncated);
+}
+var STREAMED_DATA_MAX_TEXT_BYTES = 16 * 1024;
 async function readDataFile(file, maxBytes = FETCH_FILE_MAX_BYTES) {
   if (file.length === 0) throw new CliError("--data @ needs a file name after the @.", void 0, { code: "bad_flag" });
   const tooBig = () => new CliError(
@@ -9049,6 +10460,138 @@ function formatMigrationsListing(listing, app) {
   return lines;
 }
 
+// packages/cli/src/args.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "json",
+  "help",
+  "create",
+  "no-create",
+  "no-skill",
+  "print",
+  "server",
+  "starter",
+  "force",
+  "errors",
+  "follow",
+  "fast",
+  "verbose",
+  "yes"
+]);
+var EVERYWHERE = {
+  values: ["org", "app"],
+  // `create` was the flag a deploy needed before an app was made by default, and is still read as the boolean it was, to no effect.
+  booleans: ["json", "no-create", "create", "help"]
+};
+function commandFlags(listed2, everywhere = true) {
+  return {
+    values: /* @__PURE__ */ new Set([...everywhere ? EVERYWHERE.values : [], ...listed2.values ?? []]),
+    booleans: /* @__PURE__ */ new Set([...everywhere ? EVERYWHERE.booleans : [], ...listed2.booleans ?? []]),
+    own: new Set(listed2.refusedByCommand ?? [])
+  };
+}
+var COMMAND_FLAGS = /* @__PURE__ */ new Map([
+  ["login", commandFlags({ values: ["token", "api"] })],
+  ["init", commandFlags({ booleans: ["server", "starter", "no-skill"] })],
+  ["skill", commandFlags({ booleans: ["print"] })],
+  // Only what it lists, as DEV_FLAGS in bin.ts does (OIM-887): `--json` and `--app` were always refused here.
+  ["dev", commandFlags({ values: ["user", "name", "role", "org", "port"], booleans: ["verbose"] }, false)],
+  ["apps", commandFlags({})],
+  // `--yes` changes nothing on a deploy: no flag answers for the person who approves a destructive file, and the
+  // help says so ("--yes included"). It is read, as the boolean it is, and ignored; an agent that passes it still deploys.
+  ["deploy", commandFlags({ booleans: ["yes"] })],
+  ["preview", commandFlags({ values: ["name", "delete"], refusedByCommand: ["delete"] })],
+  ["previews", commandFlags({})],
+  ["fetch", commandFlags({ values: ["preview", "method", "data", "header", "wait", "output"], refusedByCommand: ["preview"] })],
+  ["pull", commandFlags({ booleans: ["force"] })],
+  // Only what DELETE_FLAGS in bin.ts lists (OIM-918), and `--preview`, which that file refuses in a sentence about previews.
+  ["delete", commandFlags({ values: ["org", "app", "preview"], booleans: ["yes", "json"], refusedByCommand: ["preview"] }, false)],
+  ["share", commandFlags({ values: ["role"] })],
+  ["unshare", commandFlags({})],
+  ["visibility", commandFlags({})],
+  ["transfer", commandFlags({})],
+  ["move", commandFlags({ values: ["to"] })],
+  ["orgs", commandFlags({ values: ["name"] })],
+  ["members", commandFlags({ values: ["role"] })],
+  ["versions", commandFlags({})],
+  ["rollback", commandFlags({})],
+  ["migrations", commandFlags({ values: ["preview"] })],
+  ["schedules", commandFlags({})],
+  ["run", commandFlags({ values: ["preview"] })],
+  ["flows", commandFlags({ values: ["preview", "input", "input-file", "key"], booleans: ["fast"] })],
+  ["runs", commandFlags({ values: ["flow", "status", "limit", "preview", "data", "from"] })],
+  ["logs", commandFlags({ values: ["since", "kind", "limit", "cursor", "run", "ray", "search", "preview"], booleans: ["errors", "follow"] })],
+  ["egress", commandFlags({ values: ["since", "run", "limit", "cursor"] })],
+  ["connections", commandFlags({ values: ["secret-file", "bearer", "hosts", "kind", "name"] })],
+  ["whoami", commandFlags({})]
+]);
+function takesValue(command, name) {
+  const table = command === void 0 ? void 0 : COMMAND_FLAGS.get(command);
+  return table === void 0 ? !BOOLEAN_FLAGS.has(name) : table.values.has(name);
+}
+function parseArgs(argv) {
+  const positional = [];
+  const flags = /* @__PURE__ */ new Map();
+  const valueless = /* @__PURE__ */ new Set();
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i] ?? "";
+    if (!token.startsWith("--")) {
+      positional.push(token);
+      continue;
+    }
+    const name = token.slice(2);
+    if (!takesValue(positional[0], name)) {
+      flags.set(name, true);
+      continue;
+    }
+    const next = argv[i + 1];
+    if (next !== void 0 && !next.startsWith("--")) {
+      flags.set(name, next);
+      i += 1;
+    } else {
+      flags.set(name, true);
+      valueless.add(name);
+    }
+  }
+  return { command: positional.shift() ?? "help", positional, flags, valueless };
+}
+function textFlag(args2, name) {
+  const value = args2.flags.get(name);
+  if (value === true) throw needsValue(args2, name);
+  return value;
+}
+function needsValue(args2, name) {
+  return new CliError(`--${name} needs a value.`, `wirl ${args2.command} --help lists what each flag takes.`, { code: "bad_flag" });
+}
+var NAMED_FLAGS = 6;
+function refuseUnknownFlags(args2, allowed) {
+  const unknown = [...args2.flags.keys()].filter((name) => !allowed.has(name));
+  if (unknown.length === 0) return;
+  const shown2 = unknown.map((name) => {
+    const equals = name.indexOf("=");
+    return equals === -1 ? `--${name}` : `--${name.slice(0, equals)}=\u2026`;
+  });
+  const named = unknown.length > NAMED_FLAGS ? `${shown2.slice(0, NAMED_FLAGS).join(", ")} or ${String(unknown.length - NAMED_FLAGS)} more flags` : `${unknown.length === 1 ? shown2[0] : `${shown2.slice(0, -1).join(", ")} or ${shown2.at(-1)}`} flag`;
+  const withValue = unknown.find((name) => name.includes("="));
+  const where = withValue === void 0 ? "" : withValue.slice(0, withValue.indexOf("="));
+  throw new CliError(
+    `wirl ${args2.command} has no ${named}.`,
+    `wirl ${args2.command} --help lists the flags it takes.${withValue === void 0 ? "" : ` A flag's value is the next word, as in --${where} <value>, not --${where}=<value>.`}`,
+    { code: "bad_flag" }
+  );
+}
+var EMPTY_IS_NONE = /* @__PURE__ */ new Set(["token", "api", "preview", "org", "app"]);
+function refuseBadFlags(args2) {
+  const table = COMMAND_FLAGS.get(args2.command);
+  if (table === void 0) return;
+  refuseUnknownFlags(args2, /* @__PURE__ */ new Set([...table.values, ...table.booleans]));
+  for (const name of args2.valueless) {
+    if (table.values.has(name) && !table.own.has(name)) throw needsValue(args2, name);
+  }
+  for (const [name, value] of args2.flags) {
+    if (value === "" && EMPTY_IS_NONE.has(name) && table.values.has(name) && !table.own.has(name)) throw needsValue(args2, name);
+  }
+}
+
 // packages/cli/src/dev.ts
 init_src();
 import { readdirSync as readdirSync2, realpathSync, statSync, watch as watchFolder } from "node:fs";
@@ -9356,7 +10899,12 @@ async function startLocalBroker(options) {
   const keysPath = join6(options.dir, KEYS_FILE);
   const log = options.log ?? (() => {
   });
-  const transport = createBrokerTransport({ fetchImpl: options.fetchImpl, pinning: options.pinning });
+  const transport = createBrokerTransport({
+    fetchImpl: options.fetchImpl,
+    pinning: options.pinning,
+    heldBodyLimits: options.heldBodyLimits,
+    heldAnswerLimits: options.heldAnswerLimits
+  });
   const mocks = options.mocks ?? /* @__PURE__ */ new Map();
   const fetchImpl = mocks.size === 0 ? transport.fetchImpl : routeToMocks(
     options.manifest,
@@ -9374,6 +10922,11 @@ async function startLocalBroker(options) {
         connectionsFor: async () => localConnections(options.manifest, await readLocalKeys(options.dir), keysPath, mocks),
         fetchImpl,
         streamSlots: transport.streamSlots,
+        // This response, so that an event stream wirl cut waits for its
+        // closing event to leave before the connection is cut (OIM-837).
+        streamSent: sentOn(outgoing),
+        heldBodies: transport.heldBodies,
+        heldAnswers: transport.heldAnswers,
         audit: (entry) => {
           log(
             `wirl dev \xB7 ${entry.connection || "(no connection)"} ${entry.method} ${entry.host || ""} \u2192 ${entry.outcome}${entry.status ? ` ${entry.status}` : ""}`
@@ -9925,11 +11478,14 @@ var DEV_RELOAD_NOTE = `The server module, and every file it imports, is rebuilt
 var DEV_KEYS_NOTE = `Keys come from .wirl/keys.json, in the shape this prints for each connection that has none. To try a connection without its key, map it to a server of your own in .wirl/mocks.json, like { "anthropic": "http://127.0.0.1:4010" }. A call to one of that connection's declared hosts then goes to that URL instead, its path added to the URL's own and its query kept. It carries the key from .wirl/keys.json, or, when that has none, the placeholder "wirl-dev-mock" in the shape of the connection's kind. With no key there, an http_header connection sends no key header, since only .wirl/keys.json names the header, and a none connection never sends one. A host the connection does not declare is refused as before. .wirl/mocks.json is read once, at start, and never uploaded.`;
 var DEV_FLAGS_NOTE = "A flag not listed below, other than --help, is refused, not ignored.";
 var DEV_TWO_PEOPLE_NOTE = "To try two people on one app, run wirl dev a second time in the same folder with another --user: the two share .wirl/local.sqlite, so each sees what the other writes.";
-var PREVIEW_LINK_WARNING = "Whoever opens this link in the next 15 minutes is signed in as you: open it in your browser, and do not share it, save it or put it in a file. To check a page or a stream from a script, use wirl fetch.";
+var PREVIEW_LINK_MINUTES = String(VISIT_TOKEN_TTL_SECONDS / 60);
+var PREVIEW_PASS_MINUTES = String(GRANT_TTL_DEFAULT_SECONDS / 60);
+var PREVIEW_LINK_WARNING = `Whoever holds this link is signed in as you when they open it, like a password: it works for ${PREVIEW_LINK_MINUTES} minutes, and the sign-in it gives a browser lasts ${PREVIEW_PASS_MINUTES} minutes. Open it in your browser, and do not share it, save it or put it in a file. To check a page or a stream from a script, use wirl fetch.`;
 var USAGE = `wirl \u2014 deploy an app somewhere real, behind a sign-in
 
   wirl login                    Sign in from this terminal (or --token wirl_...)
   wirl init [dir] [--server]    Create wirl.json, and a working server module with --server
+  wirl init [dir] --starter     Write your first app: a small team noticeboard, ready to deploy
   wirl skill [dir] [--print]    Write the skill file a coding agent reads (init does this too; --no-skill to skip)
   wirl dev [dir]                Run the app here, signed in as a stub user
   wirl deploy [dir]             Build, scan and deploy (creates the app if new)
@@ -9942,6 +11498,7 @@ var USAGE = `wirl \u2014 deploy an app somewhere real, behind a sign-in
   wirl apps restore <name>      Bring a deleted app back, inside its ${GRACE_DAYS} days (its owner while a member, or an organisation owner or admin)
   wirl delete [app] [--yes]     Delete an app: restorable for ${GRACE_DAYS} days, and its name stays taken
   wirl share <email> [--role viewer|editor]
+  wirl unshare <email>          Take a person's share back (an invitation waiting for them too)
   wirl visibility [private|org] See or change who can open the app (public is a person's click on its Access page)
   wirl transfer <email>         Hand the app to a new owner (you keep editor access)
   wirl move --to <org>          Move the app to another organisation you belong to
@@ -9992,14 +11549,18 @@ var HELP = {
     example: "wirl login"
   },
   init: {
-    usage: ["wirl init [dir] [--server] [--app <name>] [--org <slug>] [--no-skill]"],
+    usage: ["wirl init [dir] [--server|--starter] [--app <name>] [--org <slug>] [--no-skill]"],
     flags: [
       { flag: "--app <name>", desc: "App slug. Defaults to the directory name." },
       { flag: "--org <slug>", desc: "Organisation to put in wirl.json." },
       { flag: "--server", desc: "Also write server.mjs, a working backend to build on." },
+      {
+        flag: "--starter",
+        desc: "Write your first app instead: a team noticeboard that shows what wirl does, private to you when deployed. Without [dir], the folder is <your-name>-starter."
+      },
       { flag: "--no-skill", desc: "Skip writing the skill file a coding agent reads." }
     ],
-    example: "wirl init my-app --server"
+    example: "wirl init --starter\n  wirl init my-app --server"
   },
   skill: {
     usage: ["wirl skill [dir] [--print]"],
@@ -10027,7 +11588,7 @@ ${DEV_FLAGS_NOTE}`,
   },
   deploy: {
     usage: ["wirl deploy [dir] [--org <slug>] [--app <slug>] [--no-create] [--json]"],
-    note: `[dir] defaults to wirl.json's "dir", else the current folder. A [dir] with a wirl.json of its own is a project: that wirl.json is the one used (app, org, server, static) and its "dir" is relative to it. A [dir] without one is build output: the wirl.json here is used and that folder goes up. A .wirlignore at its root keeps extra files out of the upload. New files in migrations/ are applied to the app's database before the version goes live; one that fails fails the deploy, and the version already live, if any, keeps serving. A destructive file (one wirl.json's "destructive" list must name) waits for a person before it applies to the live database: the deploy is refused with the address of a page where a person approves it. Run at a terminal, signed in as yourself (not with a deploy token) and without --json, wirl deploy shows the file's destructive lines and asks the person to type its name instead. No flag skips the person, --yes included. A preview never asks.`,
+    note: `[dir] defaults to wirl.json's "dir", else the current folder. A [dir] with a wirl.json of its own is a project: that wirl.json is the one used (app, org, server, static) and its "dir" is relative to it. A [dir] without one is build output: the wirl.json here is used and that folder goes up. A .wirlignore at its root keeps extra files out of the upload. New files in migrations/ are applied to the app's database before the version goes live; one that fails fails the deploy, and the version already live, if any, keeps serving. A destructive file (one wirl.json's "destructive" list must name) waits for a person before it applies to the live database: the deploy is refused with the address of a page where a person approves it. Run at a terminal, signed in as yourself (not with a deploy token) and without --json, wirl deploy shows the file's destructive lines and asks the person to type its name instead. No flag skips the person, --yes included. A preview never asks. ` + versionNumbersSentence("wirl versions"),
     flags: [
       ORG_FLAG,
       APP_FLAG,
@@ -10106,13 +11667,19 @@ ${DEV_FLAGS_NOTE}`,
   share: {
     usage: ["wirl share <email> [--role viewer|editor] [--org <slug>] [--app <slug>] [--json]"],
     flags: [
-      { flag: "--role viewer|editor", desc: "Access level. Defaults to viewer." },
+      { flag: "--role viewer|editor", desc: "Access level. A new person is a viewer; someone who already has access keeps their role unless you name one." },
       ORG_FLAG,
       APP_FLAG,
       JSON_FLAG
     ],
     example: "wirl share sam@acme.test --role editor"
   },
+  unshare: {
+    usage: ["wirl unshare <email> [--org <slug>] [--app <slug>] [--json]"],
+    note: "With --json, shareRevoked and invitationWithdrawn say what was taken and appDeleted whether the app was deleted; revoked is always true (the request was carried out).",
+    flags: [ORG_FLAG, APP_FLAG, JSON_FLAG],
+    example: "wirl unshare sam@acme.test"
+  },
   transfer: {
     usage: ["wirl transfer <email> [--org <slug>] [--app <slug>] [--json]"],
     flags: [ORG_FLAG, APP_FLAG, JSON_FLAG],
@@ -10251,6 +11818,7 @@ wirl migrations adopt runs once, for an app whose own code made its tables: the
       "wirl logs [--since 1h] [--errors] [--follow] [--limit n] [--cursor n]",
       "          [--kind <kind>] [--run <id>] [--ray <id>] [--search <text>] [--preview <name>] [--org <slug>] [--app <slug>] [--json]"
     ],
+    note: EDGE_REFUSALS_NOTE,
     flags: [
       { flag: "--since <window>", desc: "How far back to look, e.g. 1h, 30m. Defaults to 1h." },
       { flag: "--errors", desc: "Only failed requests." },
@@ -10375,11 +11943,10 @@ function personAt(input, output) {
 }
 
 // packages/cli/src/bin.ts
-var out = (line = "") => process.stdout.write(`${escapeInvisible(line)}
+var out = (line = "") => process.stdout.write(`${terminalSafe(line)}
 `);
-var err = (line = "") => process.stderr.write(`${escapeInvisible(line)}
+var err = (line = "") => process.stderr.write(`${terminalSafe(line)}
 `);
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "help", "create", "no-create", "no-skill", "print", "server", "force", "errors", "follow", "fast", "verbose", "yes"]);
 function readTypedLine(question) {
   return new Promise((done) => {
     const typed = createInterface2({ input: process.stdin, output: process.stderr, terminal: false });
@@ -10387,7 +11954,7 @@ function readTypedLine(question) {
     typed.on("close", () => {
       if (!answered) done(null);
     });
-    process.stderr.write(escapeInvisible(question));
+    process.stderr.write(terminalSafe(question));
     typed.once("line", (line) => {
       answered = true;
       typed.close();
@@ -10395,39 +11962,6 @@ function readTypedLine(question) {
     });
   });
 }
-function parseArgs(argv) {
-  const positional = [];
-  const flags = /* @__PURE__ */ new Map();
-  for (let i = 0; i < argv.length; i += 1) {
-    const token = argv[i] ?? "";
-    if (token.startsWith("--")) {
-      const name = token.slice(2);
-      const next = argv[i + 1];
-      if (!BOOLEAN_FLAGS.has(name) && next !== void 0 && !next.startsWith("--")) {
-        flags.set(name, next);
-        i += 1;
-      } else {
-        flags.set(name, true);
-      }
-    } else {
-      positional.push(token);
-    }
-  }
-  return { command: positional.shift() ?? "help", positional, flags };
-}
-function textFlag(args2, name) {
-  const value = args2.flags.get(name);
-  if (value === true) {
-    throw new CliError(`--${name} needs a value.`, `wirl ${args2.command} --help lists what each flag takes.`, { code: "bad_flag" });
-  }
-  return value;
-}
-function refuseUnknownFlags(args2, allowed) {
-  const unknown = [...args2.flags.keys()].filter((name) => !allowed.has(name)).map((name) => `--${name}`);
-  if (unknown.length === 0) return;
-  const named = unknown.length === 1 ? unknown[0] : `${unknown.slice(0, -1).join(", ")} or ${unknown.at(-1)}`;
-  throw new CliError(`wirl ${args2.command} has no ${named} flag.`, `wirl ${args2.command} --help lists the flags it takes.`, { code: "bad_flag" });
-}
 var NAMED_WORDS = 6;
 function nameWords(words) {
   const shown2 = words.map((word) => word === "" ? '""' : word);
@@ -10454,6 +11988,8 @@ function parsePortFlag(raw) {
   }
   return port;
 }
+var unknownMembersCommand = (sub) => new CliError(`Unknown members command: ${sub}`, "wirl members list | add <email> --role | role <email> --role | remove <email>");
+var unknownConnectionsCommand = (sub) => new CliError(`Unknown: wirl connections ${sub}`, "list, create, rotate, delete, show, grants, pending, approve, revoke, request");
 var RUNS_SUBCOMMANDS = /* @__PURE__ */ new Set(["show", "send", "cancel", "retry"]);
 var REFUSES_AS_JSON = /* @__PURE__ */ new Set(["flows", "runs"]);
 var refusesAsJson = (args2) => args2.flags.has("json") && REFUSES_AS_JSON.has(args2.command);
@@ -10468,6 +12004,13 @@ async function resolveTarget(creds, args2, dir) {
   return { org: String(org), app };
 }
 var args = parseArgs(process.argv.slice(2).map((token) => token === "-h" ? "--help" : token));
+async function starterFolder() {
+  const creds = await loadCredentials().catch(() => null);
+  if (creds === null) return starterName(null);
+  const me = await whoami(creds).catch(() => null);
+  if (me === null) err("Could not read your account, so the starter is named starter.");
+  return starterName(me?.email ?? null);
+}
 async function main() {
   const json2 = args.flags.has("json");
   if (process.argv[2] === "--version" || process.argv[2] === "-v") {
@@ -10487,9 +12030,12 @@ async function main() {
     return 0;
   }
   if (args.command === "login") {
+    refuseBadFlags(args);
     refuseExtraPositionals("login", args.positional, 0, "no argument", { secret: true, hint: "A token goes after --token: wirl login --token <token>." });
-    const token = String(args.flags.get("token") ?? "").trim();
-    const apiOrigin = String(args.flags.get("api") ?? apiOriginFromEnv()).replace(/\/+$/, "");
+    const given = textFlag(args, "token");
+    const token = (given ?? "").trim();
+    if (given !== void 0 && token === "") throw needsValue(args, "token");
+    const apiOrigin = String(textFlag(args, "api") ?? apiOriginFromEnv()).replace(/\/+$/, "");
     if (token) {
       out(`Saved to ${await saveCredentials({ apiOrigin, token })}`);
       return 0;
@@ -10505,25 +12051,32 @@ async function main() {
     const creds2 = await pollDeviceLogin(apiOrigin, login);
     const path = await saveCredentials(creds2);
     const me = await whoami(creds2);
-    out(`Signed in. Organisations: ${me.orgs.map((o) => o.slug).join(", ") || "none yet"}.`);
+    out(signedInSentence(me));
     out(`Saved to ${path}`);
     return 0;
   }
   if (args.command === "init") {
+    refuseBadFlags(args);
     refuseExtraPositionals("init", args.positional, 1, "one folder", { hint: folderHint("The app's name goes after --app <name>.") });
-    const dir = resolve6(args.positional[0] ?? ".");
+    const starter = args.flags.has("starter");
+    if (starter && args.flags.has("server")) throw new CliError(STARTER_CONFLICT);
+    const dir = resolve6(args.positional[0] ?? (starter ? await starterFolder() : "."));
     const app = String(args.flags.get("app") ?? basename4(dir));
     const written = await scaffold(dir, {
       app,
       ...args.flags.has("org") ? { org: String(args.flags.get("org")) } : {},
       server: args.flags.has("server"),
+      starter,
       skill: !args.flags.has("no-skill")
     });
     for (const file of written) out(`Wrote ${file}`);
     if (args.flags.has("server")) out("Deploy it with: wirl deploy");
+    const folder = relative3(process.cwd(), dir);
+    if (starter) out(`Deploy it with: ${folder === "" ? "" : `cd ${shellPath(folder)} && `}wirl deploy`);
     return 0;
   }
   if (args.command === "skill") {
+    refuseBadFlags(args);
     refuseExtraPositionals("skill", args.positional, 1, "one folder", { hint: folderHint() });
     if (args.flags.has("print")) {
       out(SKILL_MARKDOWN);
@@ -10535,6 +12088,7 @@ async function main() {
     return 0;
   }
   if (args.command === "dev") {
+    refuseBadFlags(args);
     refuseUnknownFlags(args, DEV_FLAGS);
     refuseExtraPositionals("dev", args.positional, 1, "one folder", { hint: folderHint() });
     const portFlag = textFlag(args, "port");
@@ -10572,6 +12126,7 @@ async function main() {
     return 0;
   }
   const creds = await loadCredentials();
+  refuseBadFlags(args);
   switch (args.command) {
     case "whoami": {
       refuseExtraPositionals("whoami", args.positional, 0, "no argument");
@@ -10623,7 +12178,7 @@ async function main() {
       const upload = { dir, projectDir: project.manifestDir, org: target.org, app: target.app, ...manifest === null ? {} : { manifest } };
       const prepared = await prepareUpload(dir, upload.manifest, "wirl deploy", upload.projectDir);
       for (const line of prepared.notices) err(line);
-      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app);
+      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app, manifestVisibility(manifest));
       const terminal = terminalMayConfirm({ stdinIsTTY: process.stdin.isTTY, stdoutIsTTY: process.stdout.isTTY, stderrIsTTY: process.stderr.isTTY, json: json2 }) ? personAt(process.stdin, process.stderr) : void 0;
       const result = await deploy(creds, { ...upload, prepared, ...terminal === void 0 ? {} : { terminal } }).catch((error) => {
         throw withMadeApp(error, made, "wirl deploy", target.app);
@@ -10684,7 +12239,7 @@ async function main() {
       const upload = { dir, projectDir: project.manifestDir, org: target.org, app: target.app, name: resolved, ...manifest === null ? {} : { manifest } };
       const prepared = await prepareUpload(dir, upload.manifest, "wirl preview", upload.projectDir);
       for (const line of prepared.notices) err(line);
-      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app);
+      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app, manifestVisibility(manifest));
       const result = await deployPreview(creds, { ...upload, prepared }).catch((error) => {
         throw withMadeApp(error, made, "wirl preview", target.app);
       });
@@ -10790,6 +12345,8 @@ async function main() {
         });
       } else if (sub === "remove") {
         refuseExtraPositionals("members remove", args.positional.slice(1), 1, "one email", { hint: "Run it once for each person." });
+      } else {
+        throw unknownMembersCommand(sub);
       }
       const org = String(args.flags.get("org") ?? (await loadManifest("."))?.org ?? "") || (await resolveTarget(creds, args, ".")).org;
       if (sub === "list") {
@@ -10835,7 +12392,7 @@ async function main() {
         }
         return 0;
       }
-      throw new CliError(`Unknown members command: ${sub}`, "wirl members list | add <email> --role | role <email> --role | remove <email>");
+      throw unknownMembersCommand(sub);
     }
     case "connections": {
       const sub = args.positional[0] ?? "list";
@@ -10858,6 +12415,8 @@ async function main() {
         refuseExtraPositionals("connections show", words, 1, "one app", { hint: "wirl connections grants lists every app and what it uses (admins)." });
       } else if (sub === "approve" || sub === "revoke" || sub === "request") {
         refuseExtraPositionals(`connections ${sub}`, words, 2, "an app and a connection", { hint: "Run it once for each connection." });
+      } else {
+        throw unknownConnectionsCommand(sub);
       }
       const orgSlug = String(args.flags.get("org") ?? (await loadManifest("."))?.org ?? "");
       const org = orgSlug || (await resolveTarget(creds, args, ".")).org;
@@ -10975,7 +12534,7 @@ async function main() {
         out(`${sub === "approve" ? "Approved" : "Revoked"} ${slug} for ${app}.`);
         return 0;
       }
-      throw new CliError(`Unknown: wirl connections ${sub}`, "list, create, rotate, delete, show, grants, pending, approve, revoke, request");
+      throw unknownConnectionsCommand(sub);
     }
     case "delete": {
       const preview = args.flags.get("preview");
@@ -11057,6 +12616,7 @@ async function main() {
     case "visibility": {
       refuseExtraPositionals("visibility", args.positional, 1, "one level");
       const level = args.positional[0];
+      if (level) refuseVisibilityLevel(level);
       const target = await resolveTarget(creds, args, ".");
       const now = level ? await changeVisibility(creds, { org: target.org, app: target.app, level }) : await readVisibility(creds, target.org, target.app);
       out(json2 ? JSON.stringify({ visibility: now }) : describeVisibility(now, target.org));
@@ -11068,12 +12628,23 @@ async function main() {
       });
       const email = args.positional[0];
       if (!email) throw new CliError("Who should it be shared with?", "wirl share someone@company.com");
-      const role = args.flags.get("role") === "editor" ? "editor" : "viewer";
+      const role = refuseShareRole(args.flags.get("role"));
       const target = await resolveTarget(creds, args, ".");
       const result = await shareApp(creds, target.org, target.app, email, role);
-      out(
-        json2 ? JSON.stringify(result) : result.pending ? `Invited ${email} as ${role}. They will have access the moment they first sign in.${unmailedNote(result)}` : `Shared with ${email} as ${role}.`
-      );
+      out(json2 ? JSON.stringify(result) : shareSentence(result, email, role, "cli"));
+      return 0;
+    }
+    case "unshare": {
+      refuseExtraPositionals("unshare", args.positional, 1, "one email", {
+        hint: "Take back one person's whole share at a time. To change a role instead, use wirl share --role."
+      });
+      const email = args.positional[0];
+      if (!email) throw new CliError("Whose access?", "wirl unshare someone@company.com");
+      const target = await resolveTarget(creds, args, ".");
+      if (!isWellFormedSlug(target.app)) throw new CliError(`"${target.app}" is not an app's name, so nothing was changed.`, void 0, { code: "bad_name" });
+      if (!isWellFormedSlug(target.org)) throw new CliError(`"${target.org}" is not an organisation's name, so nothing was changed.`, void 0, { code: "bad_name" });
+      const result = await unshareApp(creds, target.org, target.app, email);
+      out(json2 ? JSON.stringify(result) : unshareSentence(result, email));
       return 0;
     }
     case "versions": {