@anvil-works/anvil-cli 0.8.0-canary.9 → 0.8.0-dev.1

package/dist/cli.js

@@ -12875,12 +12875,25 @@ var __webpack_exports__ = {};
         if (!urlInput || "string" != typeof urlInput) return urlInput;
         let url = urlInput.trim();
         url = url.replace(/\/+$/, "");
-        if ("localhost" === url || url.startsWith("localhost:")) return "http://localhost:3000";
-        if ("http://localhost" === url || url.startsWith("http://localhost:")) return "http://localhost:3000";
-        if ("https://localhost" === url || url.startsWith("https://localhost:")) return "http://localhost:3000";
-        if (/^https?:\/\//.test(url)) return url;
+        if ("localhost" === url) return "http://localhost:3000";
+        if (url.startsWith("localhost:")) return `http://${url}`;
+        if (/^https?:\/\//i.test(url)) return url;
         return `https://${url}`;
     }
+    function normalizeAnvilOrigin(input) {
+        try {
+            const raw = input.trim();
+            const normalized = normalizeAnvilUrl(raw);
+            const url = new URL(raw.includes("://") ? raw : normalized);
+            if (![
+                "http:",
+                "https:"
+            ].includes(url.protocol) || url.username || url.password || "/" !== url.pathname || url.search || url.hash) throw new Error("Invalid origin");
+            return normalized;
+        } catch  {
+            throw new Error("Server URL must be an HTTP(S) origin without credentials, a path, query, or fragment.");
+        }
+    }
     function resolveAnvilUrl() {
         const fromConfig = getConfig("anvilUrl");
         if ("string" == typeof fromConfig && fromConfig.trim()) return fromConfig.trim();
@@ -12904,6 +12917,9 @@ var __webpack_exports__ = {};
     function getGlobalOutputConfig() {
         return globalOutputConfig;
     }
+    function canPrompt() {
+        return !globalOutputConfig.jsonMode && !!(process.stdin.isTTY && process.stdout.isTTY);
+    }
     function assertCanPrompt(action = "This command", explicitAlternative = "Pass explicit flags instead.") {
         if (globalOutputConfig.jsonMode) throw new Error(`${action} requires interactive input, but --json disables prompts. ${explicitAlternative}`);
         if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error(`${action} requires interactive input, but stdin/stdout is not a TTY. ${explicitAlternative}`);
@@ -13214,8 +13230,6 @@ var __webpack_exports__ = {};
             return answer.value;
         }
     }
-    const external_readline_namespaceObject = require("readline");
-    var external_readline_default = /*#__PURE__*/ __webpack_require__.n(external_readline_namespaceObject);
     const external_js_yaml_namespaceObject = require("js-yaml");
     var external_js_yaml_default = /*#__PURE__*/ __webpack_require__.n(external_js_yaml_namespaceObject);
     class EditorYamlManager {
@@ -13384,9 +13398,10 @@ var __webpack_exports__ = {};
                 type: "auth_invalid",
                 message
             }),
-        refreshFailed: (message)=>({
+        refreshFailed: (message, status)=>({
                 type: "token_refresh_failed",
-                message
+                message,
+                status
             })
     };
     const createAppError = {
@@ -13600,6 +13615,19 @@ var __webpack_exports__ = {};
                 return "An unknown error occurred";
         }
     }
+    function getErrorCauseMessage(error) {
+        if ("object" != typeof error || null === error || !("cause" in error)) return null;
+        const cause = error.cause;
+        if (null == cause) return null;
+        const message = errors_getErrorMessage(cause);
+        const code = "object" == typeof cause && null !== cause && "code" in cause && "string" == typeof cause.code ? cause.code : null;
+        if (code && !message.includes(code)) return `${message} (${code})`;
+        return message;
+    }
+    function logErrorCause(error, ui) {
+        const causeMessage = getErrorCauseMessage(error);
+        if (causeMessage) ui.verbose(`Cause: ${causeMessage}`);
+    }
     const external_module_namespaceObject = require("module");
     const requireFromHere = (0, external_module_namespaceObject.createRequire)(__filename);
     const GIT_CREDENTIAL_HELPER_FILENAME = "anvil-credential-helper.cjs";
@@ -13820,6 +13848,76 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getAuthFilePath(gitDir) {
         return external_path_default().join(gitDir, "anvil-auth.json");
     }
+    const AUTH_FILE_LOCK_DEFAULTS = {
+        staleMs: 30000,
+        timeoutMs: 60000,
+        retryDelayMs: 100,
+        heartbeatMs: 5000
+    };
+    function git_auth_delay(ms) {
+        return new Promise((resolve)=>setTimeout(resolve, ms));
+    }
+    async function acquireAuthFileLock(lockPath, options) {
+        const deadline = Date.now() + options.timeoutMs;
+        while(true){
+            try {
+                const handle = await external_fs_.promises.open(lockPath, "wx", 384);
+                try {
+                    await handle.writeFile(JSON.stringify({
+                        pid: process.pid,
+                        acquiredAt: new Date().toISOString()
+                    }));
+                } finally{
+                    await handle.close();
+                }
+                return;
+            } catch (e) {
+                if ("EEXIST" !== e.code) throw e;
+            }
+            try {
+                const lockStat = await external_fs_.promises.stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs > options.staleMs) {
+                    await external_fs_.promises.rm(lockPath, {
+                        force: true
+                    });
+                    continue;
+                }
+            } catch  {
+                continue;
+            }
+            if (Date.now() >= deadline) throw new Error(`Timed out waiting for the Anvil auth file lock at ${lockPath}`);
+            await git_auth_delay(options.retryDelayMs);
+        }
+    }
+    async function withRepoAuthFileLock(repoPath, fn, options) {
+        const gitDir = await getRepositoryGitDir(repoPath);
+        const lockPath = `${getAuthFilePath(gitDir)}.lock`;
+        const lockOptions = {
+            ...AUTH_FILE_LOCK_DEFAULTS,
+            ...options
+        };
+        await external_fs_.promises.mkdir(external_path_default().dirname(lockPath), {
+            recursive: true
+        });
+        await acquireAuthFileLock(lockPath, lockOptions);
+        const heartbeat = startAuthFileLockHeartbeat(lockPath, lockOptions.heartbeatMs);
+        try {
+            return await fn();
+        } finally{
+            clearInterval(heartbeat);
+            await external_fs_.promises.rm(lockPath, {
+                force: true
+            });
+        }
+    }
+    function startAuthFileLockHeartbeat(lockPath, heartbeatMs) {
+        const heartbeat = setInterval(()=>{
+            const now = new Date();
+            external_fs_.promises.utimes(lockPath, now, now).catch(()=>{});
+        }, heartbeatMs);
+        heartbeat.unref();
+        return heartbeat;
+    }
     function decodeKey(b64key) {
         const key = Buffer.from(b64key, "base64");
         if (32 !== key.length) throw new Error("Encryption key must be a base64-encoded 32-byte key");
@@ -13864,10 +13962,19 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             recursive: true
         });
         const authJson = JSON.stringify(auth, null, 2);
-        await external_fs_.promises.writeFile(authFilePath, encrypt(authJson, encryptionKey), {
-            mode: 384
-        });
-        await external_fs_.promises.chmod(authFilePath, 448);
+        const tempFilePath = `${authFilePath}.tmp-${external_node_crypto_default().randomBytes(6).toString("hex")}`;
+        try {
+            await external_fs_.promises.writeFile(tempFilePath, encrypt(authJson, encryptionKey), {
+                mode: 384
+            });
+            await external_fs_.promises.chmod(tempFilePath, 448);
+            await external_fs_.promises.rename(tempFilePath, authFilePath);
+        } catch (e) {
+            await external_fs_.promises.rm(tempFilePath, {
+                force: true
+            });
+            throw e;
+        }
         await git.raw([
             "config",
             "--local",
@@ -13876,8 +13983,9 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         ]);
         return authFilePath;
     }
-    const readAuthFromRepo = async (repoPath)=>{
+    const git_auth_readAuthFromRepo = async (repoPath)=>{
         const git = esm_default(repoPath);
+        if (!await git.checkIsRepo()) return;
         const gitDir = await getRepositoryGitDir(repoPath, git);
         const authFilePath = getAuthFilePath(gitDir);
         if (!external_fs_default().existsSync(authFilePath)) return;
@@ -13889,14 +13997,20 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         return resolveAnvilUrl();
     }
     const ANVIL_SYNC_CLIENT_ID = "anvil-sync";
+    const REFRESH_REQUEST_TIMEOUT_MS = 12000;
     let inMemoryAuth = null;
     function authMatches(auth, anvilUrl, username) {
         return auth.anvilUrl === normalizeAnvilUrl(anvilUrl) && (!username || auth.username === username);
     }
     let repoContext = null;
-    function setRepoContext(repoPath) {
+    function auth_setRepoContext(repoPath) {
         repoContext = repoPath;
     }
+    async function resolveAuthAnvilUrl() {
+        if (inMemoryAuth) return inMemoryAuth.anvilUrl;
+        const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
+        return repoAuth?.anvilUrl ?? resolveAnvilUrl();
+    }
     const inFlightRefreshes = new Map();
     async function verifyAuth(authToken, anvilUrl = getDefaultAnvilUrl()) {
         try {
@@ -13917,7 +14031,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             throw errors_createAuthError.invalid(`Network error: ${e.message}`);
         }
     }
-    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID) {
+    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID, options) {
         try {
             const tokenResponse = await fetch(`${anvilUrl}/oauth/token`, {
                 method: "POST",
@@ -13928,11 +14042,12 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                     grant_type: "refresh_token",
                     refresh_token: refreshToken,
                     client_id: clientId
-                })
+                }),
+                signal: AbortSignal.timeout(options?.timeoutMs ?? REFRESH_REQUEST_TIMEOUT_MS)
             });
             if (!tokenResponse.ok) {
                 const errorText = await tokenResponse.text();
-                throw errors_createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`);
+                throw errors_createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`, tokenResponse.status);
             }
             const tokenData = await tokenResponse.json();
             return tokenData;
@@ -13944,22 +14059,21 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     async function hasTokensForUrl(anvilUrl, username) {
         if (inMemoryAuth) return authMatches(inMemoryAuth, anvilUrl, username);
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth && authMatches(repoAuth, anvilUrl, username)) return true;
             return hasTokens(anvilUrl, username);
         }
     }
-    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username) {
+    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username, options) {
         const normalized = normalizeAnvilUrl(anvilUrl);
         const source = await resolveTokenSource(normalized, username);
         const tokens = getSourceTokens(source);
         if (!tokens.authToken && !tokens.refreshToken) throw errors_createAuthError.required("Not logged in. Please log in first.");
-        const isExpired = null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
-        if (tokens.refreshToken && isExpired) {
+        if (tokens.refreshToken && isAccessTokenExpired(tokens)) {
             const refreshKey = getRefreshKey(normalized, username, source, tokens.refreshToken);
             const existingRefresh = inFlightRefreshes.get(refreshKey);
             if (existingRefresh) return existingRefresh;
-            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken).finally(()=>{
+            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken, options).finally(()=>{
                 inFlightRefreshes.delete(refreshKey);
             });
             inFlightRefreshes.set(refreshKey, refreshPromise);
@@ -13973,7 +14087,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             type: "memory",
             auth: inMemoryAuth
         };
-        const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+        const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
         if (repoAuth && authMatches(repoAuth, normalizedUrl, username)) return {
             type: "repo",
             auth: repoAuth,
@@ -13989,6 +14103,9 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getSourceTokens(source) {
         return "store" === source.type ? source.tokens : source.auth.tokens;
     }
+    function isAccessTokenExpired(tokens) {
+        return null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
+    }
     function getStoreAccountUsername(normalizedUrl, username, refreshToken) {
         if (username) return username;
         const urlTokens = getUrlTokens(normalizedUrl);
@@ -14007,11 +14124,43 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                 return `store:${normalizedUrl}:${source.accountUsername ?? username ?? refreshToken}`;
         }
     }
-    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken) {
+    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken, options) {
+        if ("repo" === source.type) return refreshRepoAuthTokens(source.repoPath, {
+            anvilUrl: normalizedUrl,
+            username,
+            auth: source.auth,
+            refreshToken,
+            lock: options?.lock,
+            requestTimeoutMs: options?.requestTimeoutMs
+        });
+        return performTokenRefresh(normalizedUrl, username, source, refreshToken, options?.requestTimeoutMs);
+    }
+    async function refreshRepoAuthTokens(repoPath, options) {
+        const normalizedUrl = normalizeAnvilUrl(options.anvilUrl);
+        return withRepoAuthFileLock(repoPath, async ()=>{
+            let auth = options.auth;
+            let refreshToken = options.refreshToken;
+            const current = await git_auth_readAuthFromRepo(repoPath);
+            if (current && authMatches(current, normalizedUrl, options.username)) {
+                if (current.tokens.authToken && !isAccessTokenExpired(current.tokens)) return current.tokens.authToken;
+                auth = current;
+                refreshToken = current.tokens.refreshToken ?? refreshToken;
+            }
+            if (!auth || !refreshToken) throw errors_createAuthError.required("No repo auth tokens available to refresh.");
+            return performTokenRefresh(normalizedUrl, options.username, {
+                type: "repo",
+                auth,
+                repoPath
+            }, refreshToken, options.requestTimeoutMs);
+        }, options.lock);
+    }
+    async function performTokenRefresh(normalizedUrl, username, source, refreshToken, requestTimeoutMs) {
         try {
             const tokens = getSourceTokens(source);
             const clientId = tokens.clientId ?? ANVIL_SYNC_CLIENT_ID;
-            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId);
+            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId, {
+                timeoutMs: requestTimeoutMs
+            });
             const newTokens = {
                 authToken: tokenData.access_token,
                 refreshToken: tokenData.refresh_token,
@@ -14033,12 +14182,28 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             }
             return tokenData.access_token;
         } catch (e) {
+            if ("repo" === source.type && isRefreshTokenRejection(e)) await clearRepoAuthTokens(source.repoPath, source.auth).catch(()=>{});
             await clearTokensForAccount(normalizedUrl, username, refreshToken);
             throw e;
         }
     }
+    function isRefreshTokenRejection(e) {
+        const error = e;
+        return error?.type === "token_refresh_failed" && (400 === error.status || 401 === error.status);
+    }
+    async function clearRepoAuthTokens(repoPath, auth) {
+        const encryptionKey = process.env["ANVIL_AUTH_FILE_ENCRYPTION_KEY"];
+        if (!encryptionKey) return;
+        auth.tokens = {
+            authToken: null,
+            refreshToken: null,
+            authTokenExpiresAt: null,
+            clientId: auth.tokens.clientId
+        };
+        await writeAuthToFile(repoPath, auth, encryptionKey);
+    }
     async function clearTokensForAccount(url, username, refreshToken) {
-        if (inMemoryAuth || repoContext && await readAuthFromRepo(repoContext)) return;
+        if (inMemoryAuth || repoContext && await git_auth_readAuthFromRepo(repoContext)) return;
         {
             const normalized = normalizeAnvilUrl(url);
             if (username) deleteAccountTokens(normalized, username);
@@ -14068,7 +14233,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             loggedOut: false,
             message: "Cannot log out when using in-memory auth tokens"
         };
-        if (repoContext && await readAuthFromRepo(repoContext)) return {
+        if (repoContext && await git_auth_readAuthFromRepo(repoContext)) return {
             loggedOut: false,
             message: "Cannot log out when using auth tokens stored in the local git config."
         };
@@ -14099,7 +14264,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             inMemoryAuth.username
         ] : [];
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth && authMatches(repoAuth, url)) return [
                 repoAuth.username
             ];
@@ -14111,634 +14276,61 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             inMemoryAuth.anvilUrl
         ];
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth) return [
                 repoAuth.anvilUrl
             ];
             return getAvailableUrls();
         }
     }
-    function anvil_api_getDefaultAnvilUrl() {
-        return resolveAnvilUrl();
+    const promises_namespaceObject = require("timers/promises");
+    const WANT_NOT_VALID_RE = /\bwant\s+[0-9a-f]{7,40}\s+not valid\b/i;
+    const FETCH_RETRY_DELAY_MS = 200;
+    function isWantNotValidError(error) {
+        return WANT_NOT_VALID_RE.test(error.message || "");
     }
-    async function validateAppId(appId, anvilUrl = anvil_api_getDefaultAnvilUrl(), username) {
-        const authToken = await auth_getValidAuthToken(anvilUrl, username);
-        try {
-            const resp = await fetch(`${anvilUrl}/ide/api/_/apps/validate-app-id`, {
-                method: "POST",
-                headers: {
-                    Authorization: `Bearer ${authToken}`,
-                    "Content-Type": "application/json"
-                },
-                body: JSON.stringify({
-                    app_id: appId
-                })
-            });
-            const data = await resp.json();
-            if (resp.ok) return {
-                valid: data.valid ?? false,
-                app_name: data.app_name
-            };
-            if (401 === resp.status) throw errors_createAuthError.invalid("Authentication failed");
-            if (403 === resp.status) throw createAppError.accessDenied(appId);
-            if (404 === resp.status) throw createAppError.notFound(appId);
-            logger_logger.debug(`validate-app-id failed: ${resp.status} ${resp.statusText}`);
-            return {
-                valid: false,
-                error: data.error || `Server error: ${resp.status}`
-            };
-        } catch (error) {
-            if (error.type) throw error;
-            throw errors_createNetworkError.network(error.message);
+    class GitService extends Emitter {
+        git;
+        repoPath;
+        static INDEX_LOCK_RETRY_DELAYS_MS = [
+            25,
+            50,
+            100,
+            200
+        ];
+        constructor(repoPath){
+            super();
+            this.repoPath = external_path_default().resolve(repoPath);
+            this.git = esm_default(this.repoPath);
         }
-    }
-    async function listAppsForCheckout(options = {}) {
-        const anvilUrl = options.anvilUrl ?? anvil_api_getDefaultAnvilUrl();
-        const authToken = await auth_getValidAuthToken(anvilUrl, options.username);
-        const params = new URLSearchParams();
-        if ("number" == typeof options.limit) params.set("limit", String(options.limit));
-        if (options.cursor) params.set("cursor", options.cursor);
-        if (options.q && options.q.trim()) params.set("q", options.q.trim());
-        const query = params.toString();
-        const url = `${anvilUrl}/ide/api/_/apps${query ? `?${query}` : ""}`;
-        try {
-            const resp = await fetch(url, {
-                method: "GET",
-                headers: {
-                    Authorization: `Bearer ${authToken}`
-                },
-                signal: options.signal
-            });
-            if (!resp.ok) {
-                if (401 === resp.status) throw errors_createAuthError.invalid("Authentication failed");
-                throw errors_createNetworkError.server(resp.status, resp.statusText);
-            }
-            const data = await resp.json();
-            return {
-                apps: Array.isArray(data.apps) ? data.apps : [],
-                next_cursor: "string" == typeof data.next_cursor ? data.next_cursor : null
-            };
-        } catch (error) {
-            if (error.type) throw error;
-            throw errors_createNetworkError.network(error.message);
+        getGit() {
+            return this.git;
         }
-    }
-    function getGitFetchUrl(appId, authToken, gitUrl = anvil_api_getDefaultAnvilUrl()) {
-        const url = new URL(gitUrl);
-        const encodedToken = encodeURIComponent(authToken);
-        return `${url.protocol}//git:${encodedToken}@${url.hostname}${url.port ? ":" + url.port : ""}/git/${appId}.git?no_freeze=true&q=`;
-    }
-    function getGitPushUrl(appId, authToken, anvilUrl = anvil_api_getDefaultAnvilUrl()) {
-        const url = new URL(anvilUrl);
-        const encodedToken = encodeURIComponent(authToken);
-        return `${url.protocol}//git:${encodedToken}@${url.hostname}${url.port ? ":" + url.port : ""}/git/${appId}.git`;
-    }
-    function getWebSocketUrl(appId, authToken, anvilUrl = anvil_api_getDefaultAnvilUrl()) {
-        return anvilUrl.replace(/^http/, "ws") + `/ide/api/_/apps/${appId}/ws?access_token=${authToken}`;
-    }
-    async function getLatestVersion() {
-        try {
-            const response = await fetch("https://registry.npmjs.org/@anvil-works/anvil-cli/latest");
-            if (!response.ok) return null;
-            const data = await response.json();
-            return data.version;
-        } catch (e) {
-            return null;
+        getRepoPath() {
+            return this.repoPath;
         }
-    }
-    function filterCandidates(candidates, explicitUrl, explicitUsername) {
-        let filtered = candidates;
-        if (explicitUrl) {
-            const normalizedExplicit = normalizeAnvilUrl(explicitUrl);
-            filtered = filtered.filter((c)=>c.detectedUrl && normalizeAnvilUrl(c.detectedUrl) === normalizedExplicit);
+        async getGitDir() {
+            try {
+                const gitDir = (await this.git.revparse([
+                    "--git-dir"
+                ])).trim();
+                if (!external_path_default().isAbsolute(gitDir)) return external_path_default().resolve(this.repoPath, gitDir);
+                return gitDir;
+            } catch (e) {
+                throw errors_createGitError.commandFailed("rev-parse --git-dir", e.message);
+            }
         }
-        if (explicitUsername) filtered = filtered.filter((c)=>!c.detectedUsername || c.detectedUsername === explicitUsername);
-        return filtered;
-    }
-    function formatCandidateLabel(candidate) {
-        const parts = [
-            candidate.appId
-        ];
-        if (candidate.detectedUrl) if (candidate.detectedUsername) parts.push(`(${candidate.detectedUsername} on ${candidate.detectedUrl})`);
-        else parts.push(`(${candidate.detectedUrl})`);
-        parts.push(`- ${candidate.description}`);
-        return parts.join(" ");
-    }
-    function lookupRemoteInfoForAppId(appId, detectedRemotes) {
-        const matches = detectedRemotes.filter((c)=>c.appId === appId);
-        if (0 === matches.length) return {};
-        const withUsername = matches.find((c)=>c.detectedUsername);
-        if (withUsername) return {
-            detectedUrl: withUsername.detectedUrl,
-            detectedUsername: withUsername.detectedUsername
-        };
-        return {
-            detectedUrl: matches[0].detectedUrl,
-            detectedUsername: matches[0].detectedUsername
-        };
-    }
-    async function detectAppIdsFromAllRemotes(repoPath) {
-        const git = esm_default(repoPath);
-        const out = [];
-        try {
-            const remotes = await git.getRemotes(true);
-            for (const remote of remotes){
-                const httpMatch = remote.refs.fetch?.match(/(?:http|https):\/\/(?:[^@]+@)?([^:\/]+)(?::\d+)?\/git\/([A-Z0-9]+)\.git/);
-                if (httpMatch) {
-                    const [, host, detectedAppId] = httpMatch;
-                    out.push({
-                        appId: detectedAppId,
-                        source: "remote",
-                        description: `Git remote '${remote.name}'`,
-                        detectedUrl: normalizeAnvilUrl(host)
-                    });
-                    continue;
-                }
-                const sshMatch = remote.refs.fetch?.match(/ssh:\/\/([^@]+)@([^:]+):(\d+)\/(?:git\/)?([A-Z0-9]+)\.git/);
-                if (sshMatch) {
-                    const [, usernamePart, host, , detectedAppId] = sshMatch;
-                    const detectedUsername = usernamePart.includes("%") ? decodeURIComponent(usernamePart) : usernamePart;
-                    const finalUsername = "git" !== detectedUsername ? detectedUsername : void 0;
-                    out.push({
-                        appId: detectedAppId,
-                        source: "remote",
-                        description: `Git remote '${remote.name}' (SSH)`,
-                        detectedUrl: normalizeAnvilUrl(host),
-                        detectedUsername: finalUsername
-                    });
-                }
-            }
-        } catch (_e) {}
-        return out;
-    }
-    async function detectAppIdsByCommitLookup(repoPath, options) {
-        const anvilUrl = options.anvilUrl || resolveAnvilUrl();
-        const username = options.username;
-        const git = esm_default(repoPath);
-        const out = [];
-        try {
-            const authToken = await auth_getValidAuthToken(anvilUrl, username);
-            const branchRef = await git.revparse([
-                "--abbrev-ref",
-                "HEAD"
-            ]);
-            const currentBranch = "HEAD" === branchRef ? "master" : branchRef;
-            const commitId = (await git.revparse([
-                "HEAD"
-            ]))?.trim();
-            if (!commitId) return out;
-            const resp = await fetch(`${anvilUrl}/ide/api/_/apps/lookup-by-commit`, {
-                method: "POST",
-                headers: {
-                    Authorization: `Bearer ${authToken}`,
-                    "Content-Type": "application/json"
-                },
-                body: JSON.stringify({
-                    commit_id: commitId,
-                    branch_name: currentBranch
-                })
-            });
-            logger_logger.debug(`Reverse lookup by commit ${commitId} on branch ${currentBranch} returned ${resp.status}`);
-            if (!resp.ok) {
-                const errorBody = await resp.text();
-                logger_logger.debug(`lookup-by-commit error: ${errorBody}`);
-            }
-            if (resp.ok) {
-                const data = await resp.json();
-                logger_logger.debug(`data ${JSON.stringify(data)}`);
-                const apps = data?.apps ?? [];
-                for (const app of apps)if (app?.app_id) out.push({
-                    appId: app.app_id,
-                    source: "remote",
-                    description: `Reverse lookup by commit${app.branch ? ` on branch '${app.branch}'` : ""}`
-                });
-            }
-        } catch (_e) {}
-        return out;
-    }
-    const promises_namespaceObject = require("fs/promises");
-    var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObject);
-    function normalizeLineEndings(content) {
-        return content.replace(/\r\n/g, "\n");
-    }
-    function pythonifyName(name) {
-        return name.replace(/[^A-z0-9]/g, "_").replace(/^[0-9]/, "_$&");
-    }
-    function extractPythonName(relativePath, skipParts = 1) {
-        const parts = relativePath.slice(0, -3).split("/");
-        const isPackage = relativePath.endsWith("__init__.py");
-        const relevantParts = isPackage ? parts.slice(skipParts, -1) : parts.slice(skipParts);
-        return relevantParts.map(pythonifyName).join(".");
-    }
-    function deepEqual(a, b) {
-        if (a === b) return true;
-        if (null == a || null == b) return false;
-        if (typeof a !== typeof b) return false;
-        if ("object" != typeof a) return a === b;
-        if (Array.isArray(a) !== Array.isArray(b)) return false;
-        if (Array.isArray(a)) {
-            if (a.length !== b.length) return false;
-            return a.every((item, index)=>deepEqual(item, b[index]));
-        }
-        const keysA = Object.keys(a);
-        const keysB = Object.keys(b);
-        if (keysA.length !== keysB.length) return false;
-        return keysA.every((key)=>deepEqual(a[key], b[key]));
-    }
-    function parseHtmlWithFrontmatter(htmlContent) {
-        const frontmatterPattern = /^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/;
-        const match = htmlContent.match(frontmatterPattern);
-        if (match) {
-            const yamlStr = match[1];
-            const html = match[2];
-            const frontmatter = yamlStr ? external_js_yaml_default().load(yamlStr) ?? {} : {};
-            return {
-                frontmatter,
-                html
-            };
-        }
-        return {
-            frontmatter: {},
-            html: htmlContent
-        };
-    }
-    const ANVIL_GITIGNORE_ENTRY = "/.anvil/";
-    async function ensureProjectGitignoreIgnoresAnvilDir(projectRoot) {
-        const rootGitignorePath = external_path_default().join(projectRoot, ".gitignore");
-        try {
-            const existing = await external_fs_.promises.readFile(rootGitignorePath, "utf8");
-            if (existing.includes(ANVIL_GITIGNORE_ENTRY)) return false;
-            const prefix = existing.endsWith("\n") || 0 === existing.length ? "" : "\n";
-            await external_fs_.promises.writeFile(rootGitignorePath, `${existing}${prefix}${ANVIL_GITIGNORE_ENTRY}\n`, "utf8");
-            return true;
-        } catch (error) {
-            if ("ENOENT" !== error.code) throw error;
-            await external_fs_.promises.writeFile(rootGitignorePath, `${ANVIL_GITIGNORE_ENTRY}\n`, "utf8");
-            return true;
-        }
-    }
-    const ANVIL_DEPS_DIR = ".anvil/deps";
-    const ANVIL_DEPS_MANIFEST = "manifest.json";
-    const DEPS_MANIFEST_VERSION = 2;
-    const DEPENDENCY_CACHE_WARNING = "Dependency cache is missing or stale. Run `anvil deps fetch` before validation.";
-    function formatFetchError(prefix, status, errorBody) {
-        if (!errorBody) return `${prefix}: ${status}`;
-        try {
-            const parsed = JSON.parse(errorBody);
-            if ("string" == typeof parsed.error && parsed.error.trim()) return `${prefix}: ${parsed.error} (${status})`;
-        } catch  {}
-        return `${prefix}: ${status} ${errorBody}`;
-    }
-    async function fetchAllDependencies(appId, anvilUrl = resolveAnvilUrl(), options = {}) {
-        const { commit, includeDocs = true, knownDependencies = [] } = options;
-        const token = await auth_getValidAuthToken(anvilUrl);
-        const body = {
-            include_docs: includeDocs,
-            known_dependencies: knownDependencies
-        };
-        if (commit) body.commit = commit;
-        const resp = await fetch(`${anvilUrl}/ide/api/_/apps/${appId}/resolved-dependencies`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json"
-            },
-            body: JSON.stringify(body)
-        });
-        if (!resp.ok) {
-            const errorBody = await resp.text();
-            throw new Error(formatFetchError("Failed to fetch dependencies", resp.status, errorBody));
-        }
-        return await resp.json();
-    }
-    async function refreshDependencyCache(projectRoot, appId, anvilUrl = resolveAnvilUrl(), options = {}) {
-        const includeDocs = options.includeDocs ?? true;
-        const knownDependencies = await getKnownDependenciesForCache(projectRoot, includeDocs);
-        const response = await fetchAllDependencies(appId, anvilUrl, {
-            commit: options.commit,
-            includeDocs,
-            knownDependencies
-        });
-        if (!response.resolved_dependencies.length) {
-            await clearDepsCache(projectRoot);
-            return {
-                response,
-                addedGitignoreEntry: false
-            };
-        }
-        const addedGitignoreEntry = await ensureProjectGitignoreIgnoresAnvilDir(projectRoot);
-        await writeAllDepsToCache(projectRoot, response, {
-            includeDocs
-        });
-        return {
-            response,
-            addedGitignoreEntry
-        };
-    }
-    function depsDir(projectRoot) {
-        return external_path_default().join(projectRoot, ANVIL_DEPS_DIR);
-    }
-    function depsManifestPath(projectRoot) {
-        return external_path_default().join(depsDir(projectRoot), ANVIL_DEPS_MANIFEST);
-    }
-    function isResolvedDependencyManifestEntry(value) {
-        if (!value || "object" != typeof value) return false;
-        const entry = value;
-        return "string" == typeof entry.app_id && entry.app_id.length > 0 && "string" == typeof entry.commit_id && entry.commit_id.length > 0 && (void 0 === entry.branch || "string" == typeof entry.branch);
-    }
-    function isCachedDependencyManifestEntry(value) {
-        if (!isResolvedDependencyManifestEntry(value)) return false;
-        const entry = value;
-        return "string" == typeof entry.package_name && entry.package_name.length > 0;
-    }
-    function isDepsCacheManifest(value) {
-        if (!value || "object" != typeof value) return false;
-        const manifest = value;
-        return manifest.version === DEPS_MANIFEST_VERSION && "boolean" == typeof manifest.includeDocs && Array.isArray(manifest.source_dependencies) && Array.isArray(manifest.resolved_dependencies) && manifest.resolved_dependencies.every(isResolvedDependencyManifestEntry) && Array.isArray(manifest.cached_dependencies) && manifest.cached_dependencies.every(isCachedDependencyManifestEntry);
-    }
-    async function readDepsCacheManifest(projectRoot) {
-        try {
-            const raw = await promises_default().readFile(depsManifestPath(projectRoot), "utf-8");
-            const parsed = JSON.parse(raw);
-            return isDepsCacheManifest(parsed) ? parsed : void 0;
-        } catch  {
-            return;
-        }
-    }
-    async function getKnownDependenciesForCache(projectRoot, includeDocs) {
-        const manifest = await readDepsCacheManifest(projectRoot);
-        if (!manifest || manifest.includeDocs !== includeDocs) return [];
-        return manifest.resolved_dependencies.map(({ app_id, commit_id })=>({
-                app_id,
-                commit_id
-            }));
-    }
-    function getDependencyWatchSubscriptionsFromManifest(manifest) {
-        if (!manifest) return [];
-        const cachedByAppId = new Map(manifest.cached_dependencies.map((dep)=>[
-                dep.app_id,
-                dep
-            ]));
-        return manifest.resolved_dependencies.flatMap((dep)=>{
-            if (!dep.branch) return [];
-            return [
-                {
-                    appId: dep.app_id,
-                    branch: dep.branch,
-                    packageName: cachedByAppId.get(dep.app_id)?.package_name
-                }
-            ];
-        });
-    }
-    function normalizeAnvilYamlDependenciesFromContent(content) {
-        const parsed = external_js_yaml_default().load(content);
-        if (!parsed || "object" != typeof parsed || !Array.isArray(parsed.dependencies)) return [];
-        return normalizeAnvilYamlDependenciesValue(parsed.dependencies);
-    }
-    function normalizeAnvilYamlDependenciesValue(value) {
-        if (!Array.isArray(value)) return [];
-        return value.map(normalizeForComparison);
-    }
-    async function readAnvilYamlDependencies(projectRoot) {
-        try {
-            const content = await promises_default().readFile(external_path_default().join(projectRoot, "anvil.yaml"), "utf-8");
-            return normalizeAnvilYamlDependenciesFromContent(content);
-        } catch  {
-            return [];
-        }
-    }
-    async function getDependencyCacheWarning(projectRoot) {
-        const sourceDependencies = await readAnvilYamlDependencies(projectRoot);
-        if (!Array.isArray(sourceDependencies) || 0 === sourceDependencies.length) return;
-        const manifest = await readDepsCacheManifest(projectRoot);
-        if (!manifest || !anvilYamlDependenciesEqual(sourceDependencies, manifest.source_dependencies)) return DEPENDENCY_CACHE_WARNING;
-        if (0 === manifest.resolved_dependencies.length) return DEPENDENCY_CACHE_WARNING;
-        const cachedByAppId = new Map(manifest.cached_dependencies.map((dependency)=>[
-                dependency.app_id,
-                dependency
-            ]));
-        for (const dependency of manifest.resolved_dependencies){
-            const cached = cachedByAppId.get(dependency.app_id);
-            if (!cached || cached.commit_id !== dependency.commit_id) return DEPENDENCY_CACHE_WARNING;
-            try {
-                await promises_default().access(external_path_default().join(depsDir(projectRoot), cached.package_name, "anvil.yaml"));
-            } catch  {
-                return DEPENDENCY_CACHE_WARNING;
-            }
-        }
-    }
-    function anvilYamlDependenciesEqual(left, right) {
-        return deepEqual(left, right);
-    }
-    function normalizeForComparison(value) {
-        if (Array.isArray(value)) return value.map(normalizeForComparison);
-        if (value && "object" == typeof value) return Object.fromEntries(Object.entries(value).sort(([left], [right])=>left.localeCompare(right)).map(([key, entryValue])=>[
-                key,
-                normalizeForComparison(entryValue)
-            ]));
-        return value;
-    }
-    function cachedManifestEntry(dep, packageName) {
-        return {
-            app_id: dep.app_id,
-            commit_id: dep.commit_id,
-            ...dep.branch ? {
-                branch: dep.branch
-            } : {},
-            package_name: packageName
-        };
-    }
-    function safeDependencyPath(filePath, kind) {
-        const normalizedPath = external_path_default().normalize(filePath);
-        if (external_path_default().isAbsolute(normalizedPath) || normalizedPath.startsWith("..")) throw new Error(`Invalid dependency ${kind} path: ${filePath}`);
-        return normalizedPath;
-    }
-    function dependencyPythonPath(name, kind) {
-        const parts = name.split(".");
-        if (0 === parts.length || parts.some((part)=>!part || "." === part || ".." === part || part.includes("/") || part.includes("\\"))) throw new Error(`Invalid dependency ${kind} name: ${name}`);
-        return external_path_default().join(...parts);
-    }
-    async function writeDepToCache(projectRoot, dep) {
-        const depDir = external_path_default().join(projectRoot, ANVIL_DEPS_DIR, dep.package_name);
-        await promises_default().rm(depDir, {
-            recursive: true,
-            force: true
-        });
-        await promises_default().mkdir(external_path_default().join(depDir, "client_code"), {
-            recursive: true
-        });
-        await promises_default().mkdir(external_path_default().join(depDir, "server_code"), {
-            recursive: true
-        });
-        await promises_default().writeFile(external_path_default().join(depDir, "anvil.yaml"), external_js_yaml_default().dump({
-            package_name: dep.package_name
-        }));
-        for (const mod of dep.modules ?? []){
-            const modulePath = external_path_default().join(depDir, "client_code", dependencyPythonPath(mod.name, "module"));
-            if (mod.is_package) {
-                await promises_default().mkdir(modulePath, {
-                    recursive: true
-                });
-                await promises_default().writeFile(external_path_default().join(modulePath, "__init__.py"), mod.code);
-            } else {
-                const moduleFile = `${modulePath}.py`;
-                await promises_default().mkdir(external_path_default().dirname(moduleFile), {
-                    recursive: true
-                });
-                await promises_default().writeFile(moduleFile, mod.code);
-            }
-        }
-        for (const form of dep.forms ?? []){
-            const { code, class_name, is_package, ...formTemplate } = form;
-            const formPath = external_path_default().join(depDir, "client_code", dependencyPythonPath(class_name, "form"));
-            if (is_package) {
-                await promises_default().mkdir(formPath, {
-                    recursive: true
-                });
-                await promises_default().writeFile(external_path_default().join(formPath, "__init__.py"), code);
-                await promises_default().writeFile(external_path_default().join(formPath, "form_template.yaml"), external_js_yaml_default().dump(formTemplate));
-            } else {
-                const formCodeFile = `${formPath}.py`;
-                await promises_default().mkdir(external_path_default().dirname(formCodeFile), {
-                    recursive: true
-                });
-                await promises_default().writeFile(formCodeFile, code);
-                await promises_default().writeFile(`${formPath}.yaml`, external_js_yaml_default().dump(formTemplate));
-            }
-        }
-        for (const mod of dep.server_modules ?? []){
-            const modulePath = external_path_default().join(depDir, "server_code", dependencyPythonPath(mod.name, "server module"));
-            if (mod.is_package) {
-                await promises_default().mkdir(modulePath, {
-                    recursive: true
-                });
-                await promises_default().writeFile(external_path_default().join(modulePath, "__init__.py"), mod.code);
-            } else {
-                const moduleFile = `${modulePath}.py`;
-                await promises_default().mkdir(external_path_default().dirname(moduleFile), {
-                    recursive: true
-                });
-                await promises_default().writeFile(moduleFile, mod.code);
-            }
-        }
-        for (const asset of dep.assets ?? []){
-            const targetPath = external_path_default().join(depDir, "theme", "assets", safeDependencyPath(asset.name, "asset"));
-            await promises_default().mkdir(external_path_default().dirname(targetPath), {
-                recursive: true
-            });
-            await promises_default().writeFile(targetPath, Buffer.from(asset.content, "base64"));
-        }
-        for (const doc of dep.docs ?? []){
-            const targetPath = external_path_default().join(depDir, safeDependencyPath(doc.path, "doc"));
-            await promises_default().mkdir(external_path_default().dirname(targetPath), {
-                recursive: true
-            });
-            await promises_default().writeFile(targetPath, doc.content);
-        }
-    }
-    async function writeAllDepsToCache(projectRoot, response, options = {}) {
-        const includeDocs = options.includeDocs ?? true;
-        const manifest = await readDepsCacheManifest(projectRoot);
-        const canReuseExistingCache = manifest?.includeDocs === includeDocs;
-        if (!canReuseExistingCache) await clearDepsCache(projectRoot);
-        const previousCached = canReuseExistingCache ? manifest.cached_dependencies : [];
-        const resolvedAppIds = new Set(response.resolved_dependencies.map((dep)=>dep.app_id));
-        for (const dep of previousCached)if (!resolvedAppIds.has(dep.app_id)) await promises_default().rm(external_path_default().join(projectRoot, ANVIL_DEPS_DIR, dep.package_name), {
-            recursive: true,
-            force: true
-        });
-        for (const dep of response.dependencies)await writeDepToCache(projectRoot, dep);
-        const returnedByAppId = new Map(response.dependencies.map((dep)=>[
-                dep.app_id,
-                dep
-            ]));
-        const previousByAppId = new Map(previousCached.map((dep)=>[
-                dep.app_id,
-                dep
-            ]));
-        const cachedDependencies = response.resolved_dependencies.map((dep)=>{
-            const returned = returnedByAppId.get(dep.app_id);
-            if (returned) return cachedManifestEntry(returned, returned.package_name);
-            const previous = previousByAppId.get(dep.app_id);
-            if (!previous) return;
-            return cachedManifestEntry(dep, previous.package_name);
-        }).filter((dep)=>void 0 !== dep);
-        const newManifest = {
-            version: DEPS_MANIFEST_VERSION,
-            includeDocs,
-            source_dependencies: await readAnvilYamlDependencies(projectRoot),
-            resolved_dependencies: response.resolved_dependencies,
-            cached_dependencies: cachedDependencies
-        };
-        await promises_default().mkdir(depsDir(projectRoot), {
-            recursive: true
-        });
-        await promises_default().writeFile(depsManifestPath(projectRoot), `${JSON.stringify(newManifest, null, 2)}\n`);
-    }
-    async function clearDepsCache(projectRoot) {
-        await promises_default().rm(depsDir(projectRoot), {
-            recursive: true,
-            force: true
-        });
-    }
-    async function getCachedPackages(projectRoot) {
-        try {
-            const entries = await promises_default().readdir(depsDir(projectRoot), {
-                withFileTypes: true
-            });
-            return entries.filter((entry)=>entry.isDirectory()).map((entry)=>entry.name);
-        } catch  {
-            return [];
-        }
-    }
-    const external_timers_promises_namespaceObject = require("timers/promises");
-    const WANT_NOT_VALID_RE = /\bwant\s+[0-9a-f]{7,40}\s+not valid\b/i;
-    const FETCH_RETRY_DELAY_MS = 200;
-    function isWantNotValidError(error) {
-        return WANT_NOT_VALID_RE.test(error.message || "");
-    }
-    class GitService extends Emitter {
-        git;
-        repoPath;
-        static INDEX_LOCK_RETRY_DELAYS_MS = [
-            25,
-            50,
-            100,
-            200
-        ];
-        constructor(repoPath){
-            super();
-            this.repoPath = external_path_default().resolve(repoPath);
-            this.git = esm_default(this.repoPath);
-        }
-        getGit() {
-            return this.git;
-        }
-        getRepoPath() {
-            return this.repoPath;
-        }
-        async getGitDir() {
-            try {
-                const gitDir = (await this.git.revparse([
-                    "--git-dir"
-                ])).trim();
-                if (!external_path_default().isAbsolute(gitDir)) return external_path_default().resolve(this.repoPath, gitDir);
-                return gitDir;
-            } catch (e) {
-                throw errors_createGitError.commandFailed("rev-parse --git-dir", e.message);
-            }
-        }
-        async getCurrentBranch() {
-            try {
-                const branchRef = await this.git.revparse([
-                    "--abbrev-ref",
-                    "HEAD"
-                ]);
-                if ("HEAD" === branchRef) throw createSyncError.detachedHead();
-                return branchRef;
-            } catch (e) {
-                if ("detached_head" === e.type) throw e;
-                throw createSyncError.detachedHead();
+        async getCurrentBranch() {
+            try {
+                const branchRef = await this.git.revparse([
+                    "--abbrev-ref",
+                    "HEAD"
+                ]);
+                if ("HEAD" === branchRef) throw createSyncError.detachedHead();
+                return branchRef;
+            } catch (e) {
+                if ("detached_head" === e.type) throw e;
+                throw createSyncError.detachedHead();
             }
         }
         async getCommitId() {
@@ -14818,323 +14410,982 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                     "--",
                     relativePath
                 ]);
-                await this.restoreExecutableBit(relativePath, "100755" === headMode);
-                discarded.push(relativePath);
+                await this.restoreExecutableBit(relativePath, "100755" === headMode);
+                discarded.push(relativePath);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("discard staged mode-only changes", e.message);
+            }
+            return discarded;
+        }
+        async getHeadFileMode(relativePath) {
+            const output = await this.git.raw([
+                "ls-tree",
+                "HEAD",
+                "--",
+                relativePath
+            ]);
+            const match = output.match(/^(\d{6})\s/);
+            return match?.[1] ?? null;
+        }
+        async hasSameContentAsHead(relativePath) {
+            const headHash = (await this.git.revparse([
+                `HEAD:${relativePath}`
+            ])).trim();
+            const worktreeHash = (await this.git.raw([
+                "hash-object",
+                "--",
+                relativePath
+            ])).trim();
+            return headHash === worktreeHash;
+        }
+        async hasSameIndexContentAsHead(relativePath) {
+            const headHash = (await this.git.revparse([
+                `HEAD:${relativePath}`
+            ])).trim();
+            const indexHash = (await this.git.revparse([
+                `:${relativePath}`
+            ])).trim();
+            return headHash === indexHash;
+        }
+        async restoreExecutableBit(relativePath, executable) {
+            const filePath = external_path_default().join(this.repoPath, relativePath);
+            const stat = await external_fs_.promises.stat(filePath);
+            const mode = executable ? 73 | stat.mode : -74 & stat.mode;
+            if ((511 & stat.mode) !== (511 & mode)) await external_fs_.promises.chmod(filePath, mode);
+        }
+        async hasUncommittedChanges() {
+            const status = await this.getStatus();
+            return !status.isClean;
+        }
+        async fetch(url, refSpec) {
+            let attempt = 0;
+            while(true)try {
+                await this.git.fetch([
+                    url,
+                    refSpec
+                ]);
+                if (attempt > 0) this.emit("fetch-retry-resolved", {
+                    attempts: attempt,
+                    outcome: "succeeded"
+                });
+                return;
+            } catch (e) {
+                const err = e;
+                if (!isWantNotValidError(err)) {
+                    if (attempt > 0) this.emit("fetch-retry-resolved", {
+                        attempts: attempt,
+                        outcome: "failed"
+                    });
+                    throw errors_createGitError.fetchFailed(err.message);
+                }
+                attempt++;
+                this.emit("fetch-retry", {
+                    attempt,
+                    delayMs: FETCH_RETRY_DELAY_MS,
+                    error: err.message
+                });
+                logger_logger.verbose(`git fetch race (attempt ${attempt}, sleeping ${FETCH_RETRY_DELAY_MS}ms): ${err.message}`);
+                await (0, promises_namespaceObject.setTimeout)(FETCH_RETRY_DELAY_MS);
+            }
+        }
+        async reset(ref, mode = "mixed") {
+            await this.runGitCommandWithIndexLockRetry("reset", ()=>this.git.reset([
+                    `--${mode}`,
+                    ref
+                ]));
+        }
+        async checkout(paths) {
+            await this.runGitCommandWithIndexLockRetry("checkout", ()=>this.git.checkout(paths));
+        }
+        async runGitCommandWithIndexLockRetry(command, operation) {
+            let lastError;
+            for(let attempt = 0; attempt <= GitService.INDEX_LOCK_RETRY_DELAYS_MS.length; attempt += 1)try {
+                await operation();
+                return;
+            } catch (e) {
+                lastError = e;
+                if (!this.isIndexLockError(e) || attempt === GitService.INDEX_LOCK_RETRY_DELAYS_MS.length) throw errors_createGitError.commandFailed(command, e.message);
+                await (0, promises_namespaceObject.setTimeout)(GitService.INDEX_LOCK_RETRY_DELAYS_MS[attempt]);
+            }
+            throw errors_createGitError.commandFailed(command, lastError.message);
+        }
+        isIndexLockError(error) {
+            const message = error.message ?? "";
+            return message.includes("Unable to create") && message.includes("index.lock") && message.includes("File exists");
+        }
+        async stash(message) {
+            try {
+                const args = [
+                    "stash",
+                    "push",
+                    "--include-untracked"
+                ];
+                if (message) args.push("-m", message);
+                const result = await this.git.raw(args);
+                return !result.includes("No local changes to save");
+            } catch (e) {
+                throw errors_createGitError.commandFailed("stash", e.message);
+            }
+        }
+        async stashPop() {
+            try {
+                await this.git.raw([
+                    "stash",
+                    "pop"
+                ]);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("stash pop", e.message);
+            }
+        }
+        async clean(files) {
+            try {
+                await this.git.clean(CleanOptions.FORCE, files);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("clean", e.message);
+            }
+        }
+        async diffNames(fromCommit, toCommit) {
+            try {
+                const diffResult = await this.git.diff([
+                    fromCommit,
+                    toCommit,
+                    "--name-only"
+                ]);
+                const files = diffResult.split("\n").filter((f)=>f.trim());
+                return files;
+            } catch (e) {
+                throw errors_createGitError.commandFailed("diff", e.message);
+            }
+        }
+        async getAheadBehind(localRef, remoteRef) {
+            try {
+                const result = await this.git.raw([
+                    "rev-list",
+                    "--left-right",
+                    "--count",
+                    `${remoteRef}...${localRef}`
+                ]);
+                const [behind, ahead] = result.trim().split("\t").map(Number);
+                return {
+                    ahead,
+                    behind
+                };
+            } catch (e) {
+                throw errors_createGitError.commandFailed("rev-list", e.message);
+            }
+        }
+        async show(refPath) {
+            try {
+                const content = await this.git.show([
+                    refPath
+                ]);
+                return content;
+            } catch (e) {
+                throw errors_createGitError.commandFailed("show", e.message);
+            }
+        }
+        async push(url, refSpec, force = false) {
+            try {
+                const args = force ? [
+                    "push",
+                    "--force",
+                    url,
+                    refSpec
+                ] : [
+                    "push",
+                    url,
+                    refSpec
+                ];
+                await this.git.raw(args);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("push", e.message);
+            }
+        }
+        async rebase(onto) {
+            try {
+                await this.git.raw([
+                    "rebase",
+                    onto
+                ]);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("rebase", e.message);
+            }
+        }
+        async rebaseAbort() {
+            try {
+                await this.git.raw([
+                    "rebase",
+                    "--abort"
+                ]);
+            } catch (e) {
+                throw errors_createGitError.commandFailed("rebase --abort", e.message);
+            }
+        }
+        async isAncestor(ancestorRef, descendantRef) {
+            try {
+                const mergeBase = (await this.git.raw([
+                    "merge-base",
+                    ancestorRef,
+                    descendantRef
+                ])).trim();
+                const ancestorCommit = (await this.git.revparse([
+                    ancestorRef
+                ])).trim();
+                return mergeBase === ancestorCommit;
+            } catch  {
+                return false;
+            }
+        }
+        async mergeFastForward(ref) {
+            await this.runGitCommandWithIndexLockRetry("merge --ff-only", ()=>this.git.raw([
+                    "merge",
+                    "--ff-only",
+                    ref
+                ]));
+        }
+        async deleteRef(ref) {
+            try {
+                await this.git.raw([
+                    "update-ref",
+                    "-d",
+                    ref
+                ]);
+            } catch (e) {}
+        }
+        async getRemotes() {
+            try {
+                const remotes = await this.git.getRemotes(true);
+                return remotes.map((r)=>({
+                        name: r.name,
+                        fetchUrl: r.refs.fetch
+                    }));
             } catch (e) {
-                throw errors_createGitError.commandFailed("discard staged mode-only changes", e.message);
+                throw errors_createGitError.commandFailed("remote", e.message);
             }
-            return discarded;
-        }
-        async getHeadFileMode(relativePath) {
-            const output = await this.git.raw([
-                "ls-tree",
-                "HEAD",
-                "--",
-                relativePath
-            ]);
-            const match = output.match(/^(\d{6})\s/);
-            return match?.[1] ?? null;
-        }
-        async hasSameContentAsHead(relativePath) {
-            const headHash = (await this.git.revparse([
-                `HEAD:${relativePath}`
-            ])).trim();
-            const worktreeHash = (await this.git.raw([
-                "hash-object",
-                "--",
-                relativePath
-            ])).trim();
-            return headHash === worktreeHash;
-        }
-        async hasSameIndexContentAsHead(relativePath) {
-            const headHash = (await this.git.revparse([
-                `HEAD:${relativePath}`
-            ])).trim();
-            const indexHash = (await this.git.revparse([
-                `:${relativePath}`
-            ])).trim();
-            return headHash === indexHash;
         }
-        async restoreExecutableBit(relativePath, executable) {
-            const filePath = external_path_default().join(this.repoPath, relativePath);
-            const stat = await external_fs_.promises.stat(filePath);
-            const mode = executable ? 73 | stat.mode : -74 & stat.mode;
-            if ((511 & stat.mode) !== (511 & mode)) await external_fs_.promises.chmod(filePath, mode);
+        async isGitInitialized() {
+            const gitPath = external_path_default().join(this.repoPath, ".git");
+            return external_fs_.existsSync(gitPath);
         }
-        async hasUncommittedChanges() {
-            const status = await this.getStatus();
-            return !status.isClean;
+        async removeEmptyDirectories(removedFiles) {
+            const directoriesToCheck = new Set();
+            for (const file of removedFiles){
+                let dir = external_path_default().dirname(file);
+                while(dir && "." !== dir){
+                    directoriesToCheck.add(dir);
+                    const parentDir = external_path_default().dirname(dir);
+                    if (parentDir === dir) break;
+                    dir = parentDir;
+                }
+            }
+            const sortedDirs = Array.from(directoriesToCheck).sort((a, b)=>b.split("/").length - a.split("/").length);
+            for (const dir of sortedDirs)try {
+                const dirPath = external_path_default().join(this.repoPath, dir);
+                if (!external_fs_.existsSync(dirPath)) continue;
+                const entries = await external_fs_.promises.readdir(dirPath);
+                if (0 === entries.length) await external_fs_.promises.rmdir(dirPath);
+            } catch (error) {}
         }
-        async fetch(url, refSpec) {
-            let attempt = 0;
-            while(true)try {
-                await this.git.fetch([
-                    url,
-                    refSpec
-                ]);
-                if (attempt > 0) this.emit("fetch-retry-resolved", {
-                    attempts: attempt,
-                    outcome: "succeeded"
+    }
+    async function getStagedFileChanges(git, gitService) {
+        try {
+            const status = await git.status();
+            const renames = status.renamed || [];
+            const stagedFiles = status.files.filter((f)=>" " !== f.index && "?" !== f.index);
+            const stagedModeOnlyPaths = new Set(gitService ? await gitService.discardStagedModeOnlyChanges(stagedFiles.filter((f)=>"R" !== f.index && "D" !== f.index).map((f)=>f.path)) : []);
+            const stagedRenames = [];
+            for (const f of stagedFiles)if ("R" === f.index) {
+                const rename = renames.find((r)=>r.to === f.path);
+                if (rename) stagedRenames.push({
+                    path: rename.to,
+                    type: "rename",
+                    from: rename.from
                 });
-                return;
-            } catch (e) {
-                const err = e;
-                if (!isWantNotValidError(err)) {
-                    if (attempt > 0) this.emit("fetch-retry-resolved", {
-                        attempts: attempt,
-                        outcome: "failed"
-                    });
-                    throw errors_createGitError.fetchFailed(err.message);
+            }
+            const stagedRenamedFromPaths = new Set(stagedRenames.map((r)=>r.from));
+            const stagedRenamedToPaths = new Set(stagedRenames.map((r)=>r.path));
+            const changes = [];
+            for (const f of stagedFiles){
+                if ("R" !== f.index) {
+                    if (!stagedModeOnlyPaths.has(f.path)) {
+                        if (!(stagedRenamedFromPaths.has(f.path) || stagedRenamedToPaths.has(f.path))) if ("D" === f.index) changes.push({
+                            path: f.path,
+                            type: "unlink"
+                        });
+                        else if ("A" === f.index || "?" === f.index) changes.push({
+                            path: f.path,
+                            type: "add"
+                        });
+                        else changes.push({
+                            path: f.path,
+                            type: "change"
+                        });
+                    }
                 }
-                attempt++;
-                this.emit("fetch-retry", {
-                    attempt,
-                    delayMs: FETCH_RETRY_DELAY_MS,
-                    error: err.message
-                });
-                logger_logger.verbose(`git fetch race (attempt ${attempt}, sleeping ${FETCH_RETRY_DELAY_MS}ms): ${err.message}`);
-                await (0, external_timers_promises_namespaceObject.setTimeout)(FETCH_RETRY_DELAY_MS);
             }
+            changes.push(...stagedRenames);
+            return changes;
+        } catch (e) {
+            throw errors_createGitError.commandFailed("status", e.message);
         }
-        async reset(ref, mode = "mixed") {
-            await this.runGitCommandWithIndexLockRetry("reset", ()=>this.git.reset([
-                    `--${mode}`,
-                    ref
-                ]));
+    }
+    async function getCurrentOrFallbackBranchName(git) {
+        const branchRef = (await git.revparse([
+            "--abbrev-ref",
+            "HEAD"
+        ])).trim();
+        if ("HEAD" !== branchRef) return branchRef;
+        const [localBranches, remoteBranches] = await Promise.all([
+            git.raw([
+                "branch",
+                "--format=%(refname:short)",
+                "--contains",
+                "HEAD"
+            ]),
+            git.raw([
+                "branch",
+                "-r",
+                "--format=%(refname:short)",
+                "--contains",
+                "HEAD"
+            ])
+        ]);
+        const branchNames = [
+            ...parseBranchList(localBranches),
+            ...parseBranchList(remoteBranches).filter((branchName)=>!branchName.endsWith("/HEAD")).map((branchName)=>branchName.replace(/^[^/]+\//, ""))
+        ];
+        const branchSet = new Set(branchNames);
+        if (branchSet.has("master")) return "master";
+        if (branchSet.has("main")) return "main";
+        return "master";
+    }
+    function parseBranchList(output) {
+        return output.split(/\r?\n/).map((line)=>line.trim()).filter(Boolean);
+    }
+    function formatHttpError(prefix, status, body) {
+        if (!body) return `${prefix}: ${status}`;
+        try {
+            const parsed = JSON.parse(body);
+            if ("string" == typeof parsed.error && parsed.error.trim()) return `${prefix}: ${parsed.error} (${status})`;
+        } catch  {}
+        return `${prefix}: ${status} ${body}`;
+    }
+    function anvil_api_getDefaultAnvilUrl() {
+        return resolveAnvilUrl();
+    }
+    async function createAnvilApp(options) {
+        let response;
+        try {
+            response = await fetch(`${options.anvilUrl}/ide/api/_/apps`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${options.authToken}`,
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    name: options.name,
+                    tags: options.tags
+                })
+            });
+        } catch (error) {
+            throw errors_createNetworkError.network(error.message);
         }
-        async checkout(paths) {
-            await this.runGitCommandWithIndexLockRetry("checkout", ()=>this.git.checkout(paths));
+        const data = await response.json().catch(()=>({}));
+        if (!response.ok) {
+            if (401 === response.status || 403 === response.status) throw errors_createAuthError.invalid(data.error || "Not authorized to create an app");
+            throw new Error(data.error || `Failed to create app: ${response.status} ${response.statusText}`);
+        }
+        if ("string" != typeof data.id || !data.id) throw new Error("App creation response did not contain an app ID.");
+        return {
+            id: data.id,
+            ..."string" == typeof data.name ? {
+                name: data.name
+            } : {},
+            ...data.tags ? {
+                tags: data.tags
+            } : {}
+        };
+    }
+    async function validateAppId(appId, anvilUrl = anvil_api_getDefaultAnvilUrl(), username) {
+        const authToken = await auth_getValidAuthToken(anvilUrl, username);
+        try {
+            const resp = await fetch(`${anvilUrl}/ide/api/_/apps/validate-app-id`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${authToken}`,
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    app_id: appId
+                })
+            });
+            const data = await resp.json();
+            if (resp.ok) return {
+                valid: data.valid ?? false,
+                app_name: data.app_name
+            };
+            if (401 === resp.status) throw errors_createAuthError.invalid("Authentication failed");
+            if (403 === resp.status) throw createAppError.accessDenied(appId);
+            if (404 === resp.status) throw createAppError.notFound(appId);
+            logger_logger.debug(`validate-app-id failed: ${resp.status} ${resp.statusText}`);
+            return {
+                valid: false,
+                error: data.error || `Server error: ${resp.status}`
+            };
+        } catch (error) {
+            if (error.type) throw error;
+            throw errors_createNetworkError.network(error.message);
+        }
+    }
+    async function listAppsForCheckout(options = {}) {
+        const anvilUrl = options.anvilUrl ?? anvil_api_getDefaultAnvilUrl();
+        const authToken = await auth_getValidAuthToken(anvilUrl, options.username);
+        const params = new URLSearchParams();
+        if ("number" == typeof options.limit) params.set("limit", String(options.limit));
+        if (options.cursor) params.set("cursor", options.cursor);
+        if (options.q && options.q.trim()) params.set("q", options.q.trim());
+        const query = params.toString();
+        const url = `${anvilUrl}/ide/api/_/apps${query ? `?${query}` : ""}`;
+        try {
+            const resp = await fetch(url, {
+                method: "GET",
+                headers: {
+                    Authorization: `Bearer ${authToken}`
+                },
+                signal: options.signal
+            });
+            if (!resp.ok) {
+                if (401 === resp.status) throw errors_createAuthError.invalid("Authentication failed");
+                throw errors_createNetworkError.server(resp.status, resp.statusText);
+            }
+            const data = await resp.json();
+            return {
+                apps: Array.isArray(data.apps) ? data.apps : [],
+                next_cursor: "string" == typeof data.next_cursor ? data.next_cursor : null
+            };
+        } catch (error) {
+            if (error.type) throw error;
+            throw errors_createNetworkError.network(error.message);
+        }
+    }
+    function getGitFetchUrl(appId, authToken, gitUrl = anvil_api_getDefaultAnvilUrl()) {
+        const url = new URL(gitUrl);
+        const encodedToken = encodeURIComponent(authToken);
+        return `${url.protocol}//git:${encodedToken}@${url.hostname}${url.port ? ":" + url.port : ""}/git/${appId}.git?no_freeze=true&q=`;
+    }
+    function getGitPushUrl(appId, authToken, anvilUrl = anvil_api_getDefaultAnvilUrl()) {
+        const url = new URL(anvilUrl);
+        const encodedToken = encodeURIComponent(authToken);
+        return `${url.protocol}//git:${encodedToken}@${url.hostname}${url.port ? ":" + url.port : ""}/git/${appId}.git`;
+    }
+    function getWebSocketUrl(appId, authToken, anvilUrl = anvil_api_getDefaultAnvilUrl()) {
+        return anvilUrl.replace(/^http/, "ws") + `/ide/api/_/apps/${appId}/ws?access_token=${authToken}`;
+    }
+    async function getLatestVersion() {
+        try {
+            const response = await fetch("https://registry.npmjs.org/@anvil-works/anvil-cli/latest");
+            if (!response.ok) return null;
+            const data = await response.json();
+            return data.version;
+        } catch (e) {
+            return null;
         }
-        async runGitCommandWithIndexLockRetry(command, operation) {
-            let lastError;
-            for(let attempt = 0; attempt <= GitService.INDEX_LOCK_RETRY_DELAYS_MS.length; attempt += 1)try {
-                await operation();
-                return;
-            } catch (e) {
-                lastError = e;
-                if (!this.isIndexLockError(e) || attempt === GitService.INDEX_LOCK_RETRY_DELAYS_MS.length) throw errors_createGitError.commandFailed(command, e.message);
-                await (0, external_timers_promises_namespaceObject.setTimeout)(GitService.INDEX_LOCK_RETRY_DELAYS_MS[attempt]);
+    }
+    async function getTestRunSnapshot(appId, runId, options = {}) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${encodeURIComponent(appId)}/test-runs/${encodeURIComponent(runId)}`, {
+            headers: {
+                Authorization: `Bearer ${token}`
             }
-            throw errors_createGitError.commandFailed(command, lastError.message);
-        }
-        isIndexLockError(error) {
-            const message = error.message ?? "";
-            return message.includes("Unable to create") && message.includes("index.lock") && message.includes("File exists");
+        });
+        if (!response.ok) throw new Error(formatHttpError("Failed to get the test run's results", response.status, await response.text()));
+        return response.json();
+    }
+    function filterCandidates(candidates, explicitUrl, explicitUsername) {
+        let filtered = candidates;
+        if (explicitUrl) {
+            const normalizedExplicit = normalizeAnvilUrl(explicitUrl);
+            filtered = filtered.filter((c)=>c.detectedUrl && normalizeAnvilUrl(c.detectedUrl) === normalizedExplicit);
         }
-        async stash(message) {
-            try {
-                const args = [
-                    "stash",
-                    "push",
-                    "--include-untracked"
-                ];
-                if (message) args.push("-m", message);
-                const result = await this.git.raw(args);
-                return !result.includes("No local changes to save");
-            } catch (e) {
-                throw errors_createGitError.commandFailed("stash", e.message);
+        if (explicitUsername) filtered = filtered.filter((c)=>!c.detectedUsername || c.detectedUsername === explicitUsername);
+        return filtered;
+    }
+    function formatCandidateLabel(candidate) {
+        const parts = [
+            candidate.appId
+        ];
+        if (candidate.detectedUrl) if (candidate.detectedUsername) parts.push(`(${candidate.detectedUsername} on ${candidate.detectedUrl})`);
+        else parts.push(`(${candidate.detectedUrl})`);
+        parts.push(`- ${candidate.description}`);
+        return parts.join(" ");
+    }
+    function lookupRemoteInfoForAppId(appId, detectedRemotes) {
+        const matches = detectedRemotes.filter((c)=>c.appId === appId);
+        if (0 === matches.length) return {};
+        const withUsername = matches.find((c)=>c.detectedUsername);
+        if (withUsername) return {
+            detectedUrl: withUsername.detectedUrl,
+            detectedUsername: withUsername.detectedUsername
+        };
+        return {
+            detectedUrl: matches[0].detectedUrl,
+            detectedUsername: matches[0].detectedUsername
+        };
+    }
+    async function detectAppIdsFromAllRemotes(repoPath) {
+        const git = esm_default(repoPath);
+        const out = [];
+        try {
+            const remotes = await git.getRemotes(true);
+            for (const remote of remotes){
+                const httpMatch = remote.refs.fetch?.match(/(https?):\/\/(?:[^@\/]+@)?([^\/]+)\/git\/([A-Z0-9]+)\.git/);
+                if (httpMatch) {
+                    const [, scheme, host, detectedAppId] = httpMatch;
+                    const origin = new URL(`${scheme}://${host}`).origin;
+                    out.push({
+                        appId: detectedAppId,
+                        source: "remote",
+                        description: `Git remote '${remote.name}'`,
+                        detectedUrl: normalizeAnvilUrl(origin)
+                    });
+                    continue;
+                }
+                const sshMatch = remote.refs.fetch?.match(/ssh:\/\/([^@]+)@([^:]+):(\d+)\/(?:git\/)?([A-Z0-9]+)\.git/);
+                if (sshMatch) {
+                    const [, usernamePart, host, , detectedAppId] = sshMatch;
+                    const detectedUsername = usernamePart.includes("%") ? decodeURIComponent(usernamePart) : usernamePart;
+                    const finalUsername = "git" !== detectedUsername ? detectedUsername : void 0;
+                    out.push({
+                        appId: detectedAppId,
+                        source: "remote",
+                        description: `Git remote '${remote.name}' (SSH)`,
+                        detectedUrl: normalizeAnvilUrl(host),
+                        detectedUsername: finalUsername
+                    });
+                }
             }
-        }
-        async stashPop() {
-            try {
-                await this.git.raw([
-                    "stash",
-                    "pop"
-                ]);
-            } catch (e) {
-                throw errors_createGitError.commandFailed("stash pop", e.message);
+        } catch (_e) {}
+        return out;
+    }
+    async function detectAppIdsByCommitLookup(repoPath, options) {
+        const anvilUrl = options.anvilUrl || resolveAnvilUrl();
+        const username = options.username;
+        const git = esm_default(repoPath);
+        const out = [];
+        try {
+            const authToken = await auth_getValidAuthToken(anvilUrl, username);
+            const commitId = (await git.revparse([
+                "HEAD"
+            ]))?.trim();
+            if (!commitId) return out;
+            const branchName = await getCurrentOrFallbackBranchName(git);
+            const resp = await fetch(`${anvilUrl}/ide/api/_/apps/lookup-by-commit`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${authToken}`,
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    commit_id: commitId,
+                    branch_name: branchName
+                })
+            });
+            logger_logger.debug(`Reverse lookup by commit ${commitId} on branch ${branchName} returned ${resp.status}`);
+            if (!resp.ok) {
+                const errorBody = await resp.text();
+                logger_logger.debug(`lookup-by-commit error: ${errorBody}`);
             }
-        }
-        async clean(files) {
-            try {
-                await this.git.clean(CleanOptions.FORCE, files);
-            } catch (e) {
-                throw errors_createGitError.commandFailed("clean", e.message);
+            if (resp.ok) {
+                const data = await resp.json();
+                logger_logger.debug(`data ${JSON.stringify(data)}`);
+                const apps = data?.apps ?? [];
+                for (const app of apps)if (app?.app_id) out.push({
+                    appId: app.app_id,
+                    source: "remote",
+                    description: `Reverse lookup by commit${app.branch ? ` on branch '${app.branch}'` : ""}`
+                });
             }
+        } catch (_e) {}
+        return out;
+    }
+    const external_fs_promises_namespaceObject = require("fs/promises");
+    var external_fs_promises_default = /*#__PURE__*/ __webpack_require__.n(external_fs_promises_namespaceObject);
+    function normalizeLineEndings(content) {
+        return content.replace(/\r\n/g, "\n");
+    }
+    function pythonifyName(name) {
+        return name.replace(/[^A-z0-9]/g, "_").replace(/^[0-9]/, "_$&");
+    }
+    function extractPythonName(relativePath, skipParts = 1) {
+        const parts = relativePath.slice(0, -3).split("/");
+        const isPackage = relativePath.endsWith("__init__.py");
+        const relevantParts = isPackage ? parts.slice(skipParts, -1) : parts.slice(skipParts);
+        return relevantParts.map(pythonifyName).join(".");
+    }
+    function deepEqual(a, b) {
+        if (a === b) return true;
+        if (null == a || null == b) return false;
+        if (typeof a !== typeof b) return false;
+        if ("object" != typeof a) return a === b;
+        if (Array.isArray(a) !== Array.isArray(b)) return false;
+        if (Array.isArray(a)) {
+            if (a.length !== b.length) return false;
+            return a.every((item, index)=>deepEqual(item, b[index]));
         }
-        async diffNames(fromCommit, toCommit) {
-            try {
-                const diffResult = await this.git.diff([
-                    fromCommit,
-                    toCommit,
-                    "--name-only"
-                ]);
-                const files = diffResult.split("\n").filter((f)=>f.trim());
-                return files;
-            } catch (e) {
-                throw errors_createGitError.commandFailed("diff", e.message);
-            }
+        const keysA = Object.keys(a);
+        const keysB = Object.keys(b);
+        if (keysA.length !== keysB.length) return false;
+        return keysA.every((key)=>deepEqual(a[key], b[key]));
+    }
+    function parseHtmlWithFrontmatter(htmlContent) {
+        const frontmatterPattern = /^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/;
+        const match = htmlContent.match(frontmatterPattern);
+        if (match) {
+            const yamlStr = match[1];
+            const html = match[2];
+            const frontmatter = yamlStr ? external_js_yaml_default().load(yamlStr) ?? {} : {};
+            return {
+                frontmatter,
+                html
+            };
         }
-        async getAheadBehind(localRef, remoteRef) {
-            try {
-                const result = await this.git.raw([
-                    "rev-list",
-                    "--left-right",
-                    "--count",
-                    `${remoteRef}...${localRef}`
-                ]);
-                const [behind, ahead] = result.trim().split("\t").map(Number);
-                return {
-                    ahead,
-                    behind
-                };
-            } catch (e) {
-                throw errors_createGitError.commandFailed("rev-list", e.message);
-            }
+        return {
+            frontmatter: {},
+            html: htmlContent
+        };
+    }
+    const ANVIL_GITIGNORE_ENTRY = "/.anvil/";
+    async function ensureProjectGitignoreIgnoresAnvilDir(projectRoot) {
+        const rootGitignorePath = external_path_default().join(projectRoot, ".gitignore");
+        try {
+            const existing = await external_fs_.promises.readFile(rootGitignorePath, "utf8");
+            if (existing.includes(ANVIL_GITIGNORE_ENTRY)) return false;
+            const prefix = existing.endsWith("\n") || 0 === existing.length ? "" : "\n";
+            await external_fs_.promises.writeFile(rootGitignorePath, `${existing}${prefix}${ANVIL_GITIGNORE_ENTRY}\n`, "utf8");
+            return true;
+        } catch (error) {
+            if ("ENOENT" !== error.code) throw error;
+            await external_fs_.promises.writeFile(rootGitignorePath, `${ANVIL_GITIGNORE_ENTRY}\n`, "utf8");
+            return true;
         }
-        async show(refPath) {
-            try {
-                const content = await this.git.show([
-                    refPath
-                ]);
-                return content;
-            } catch (e) {
-                throw errors_createGitError.commandFailed("show", e.message);
-            }
+    }
+    const ANVIL_DEPS_DIR = ".anvil/deps";
+    const ANVIL_DEPS_MANIFEST = "manifest.json";
+    const DEPS_MANIFEST_VERSION = 3;
+    const DEPENDENCY_CACHE_WARNING = "Dependency cache is missing or stale. Run `anvil deps fetch` before validation.";
+    async function fetchAllDependencies(appId, anvilUrl, options = {}) {
+        const { commit, includeDocs = true, knownDependencies = [] } = options;
+        anvilUrl ??= await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const body = {
+            include_docs: includeDocs,
+            known_dependencies: knownDependencies
+        };
+        if (commit) body.commit = commit;
+        const resp = await fetch(`${anvilUrl}/ide/api/_/apps/${appId}/resolved-dependencies`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+        if (!resp.ok) {
+            const errorBody = await resp.text();
+            throw new Error(formatHttpError("Failed to fetch dependencies", resp.status, errorBody));
         }
-        async push(url, refSpec, force = false) {
-            try {
-                const args = force ? [
-                    "push",
-                    "--force",
-                    url,
-                    refSpec
-                ] : [
-                    "push",
-                    url,
-                    refSpec
-                ];
-                await this.git.raw(args);
-            } catch (e) {
-                throw errors_createGitError.commandFailed("push", e.message);
-            }
+        return await resp.json();
+    }
+    async function refreshDependencyCache(projectRoot, appId, anvilUrl, options = {}) {
+        auth_setRepoContext(projectRoot);
+        anvilUrl ??= await resolveAuthAnvilUrl();
+        const includeDocs = options.includeDocs ?? true;
+        const git = new GitService(projectRoot);
+        const commit = options.commit ?? await git.getCommitId();
+        const sourceYaml = await git.show(`${commit}:anvil.yaml`).catch((error)=>{
+            if (options.commit) return null;
+            throw error;
+        });
+        const sourceDependencies = null === sourceYaml ? null : normalizeAnvilYamlDependenciesFromContent(sourceYaml);
+        const knownDependencies = await getKnownDependenciesForCache(projectRoot, includeDocs);
+        const response = await fetchAllDependencies(appId, anvilUrl, {
+            username: options.username,
+            commit,
+            includeDocs,
+            knownDependencies
+        });
+        if (!response.resolved_dependencies.length) {
+            await clearDepsCache(projectRoot);
+            return {
+                response,
+                addedGitignoreEntry: false
+            };
         }
-        async rebase(onto) {
-            try {
-                await this.git.raw([
-                    "rebase",
-                    onto
-                ]);
-            } catch (e) {
-                throw errors_createGitError.commandFailed("rebase", e.message);
-            }
+        const addedGitignoreEntry = await ensureProjectGitignoreIgnoresAnvilDir(projectRoot);
+        await writeAllDepsToCache(projectRoot, response, {
+            includeDocs,
+            sourceDependencies
+        });
+        return {
+            response,
+            addedGitignoreEntry
+        };
+    }
+    function depsDir(projectRoot) {
+        return external_path_default().join(projectRoot, ANVIL_DEPS_DIR);
+    }
+    function depsManifestPath(projectRoot) {
+        return external_path_default().join(depsDir(projectRoot), ANVIL_DEPS_MANIFEST);
+    }
+    function isResolvedDependencyManifestEntry(value) {
+        if (!value || "object" != typeof value) return false;
+        const entry = value;
+        return "string" == typeof entry.app_id && entry.app_id.length > 0 && "string" == typeof entry.commit_id && entry.commit_id.length > 0 && (void 0 === entry.branch || "string" == typeof entry.branch);
+    }
+    function isCachedDependencyManifestEntry(value) {
+        if (!isResolvedDependencyManifestEntry(value)) return false;
+        const entry = value;
+        return "string" == typeof entry.package_name && entry.package_name.length > 0;
+    }
+    function isDepsCacheManifest(value) {
+        if (!value || "object" != typeof value) return false;
+        const manifest = value;
+        return manifest.version === DEPS_MANIFEST_VERSION && "boolean" == typeof manifest.includeDocs && (null === manifest.source_dependencies || Array.isArray(manifest.source_dependencies)) && Array.isArray(manifest.resolved_dependencies) && manifest.resolved_dependencies.every(isResolvedDependencyManifestEntry) && Array.isArray(manifest.cached_dependencies) && manifest.cached_dependencies.every(isCachedDependencyManifestEntry);
+    }
+    async function readDepsCacheManifest(projectRoot) {
+        try {
+            const raw = await external_fs_promises_default().readFile(depsManifestPath(projectRoot), "utf-8");
+            const parsed = JSON.parse(raw);
+            return isDepsCacheManifest(parsed) ? parsed : void 0;
+        } catch  {
+            return;
         }
-        async rebaseAbort() {
-            try {
-                await this.git.raw([
-                    "rebase",
-                    "--abort"
-                ]);
-            } catch (e) {
-                throw errors_createGitError.commandFailed("rebase --abort", e.message);
-            }
+    }
+    async function getKnownDependenciesForCache(projectRoot, includeDocs) {
+        const manifest = await readDepsCacheManifest(projectRoot);
+        if (!manifest || manifest.includeDocs !== includeDocs) return [];
+        return manifest.resolved_dependencies.map(({ app_id, commit_id })=>({
+                app_id,
+                commit_id
+            }));
+    }
+    function getDependencyWatchSubscriptionsFromManifest(manifest) {
+        if (!manifest) return [];
+        const cachedByAppId = new Map(manifest.cached_dependencies.map((dep)=>[
+                dep.app_id,
+                dep
+            ]));
+        return manifest.resolved_dependencies.flatMap((dep)=>{
+            if (!dep.branch) return [];
+            return [
+                {
+                    appId: dep.app_id,
+                    branch: dep.branch,
+                    packageName: cachedByAppId.get(dep.app_id)?.package_name
+                }
+            ];
+        });
+    }
+    function normalizeAnvilYamlDependenciesFromContent(content) {
+        const parsed = external_js_yaml_default().load(content);
+        if (!parsed || "object" != typeof parsed || !Array.isArray(parsed.dependencies)) return [];
+        return normalizeAnvilYamlDependenciesValue(parsed.dependencies);
+    }
+    function normalizeAnvilYamlDependenciesValue(value) {
+        if (!Array.isArray(value)) return [];
+        return value.map(normalizeForComparison);
+    }
+    async function readAnvilYamlDependencies(projectRoot) {
+        try {
+            const content = await external_fs_promises_default().readFile(external_path_default().join(projectRoot, "anvil.yaml"), "utf-8");
+            return normalizeAnvilYamlDependenciesFromContent(content);
+        } catch  {
+            return [];
         }
-        async isAncestor(ancestorRef, descendantRef) {
+    }
+    async function getDependencyCacheWarning(projectRoot) {
+        const sourceDependencies = await readAnvilYamlDependencies(projectRoot);
+        if (!Array.isArray(sourceDependencies) || 0 === sourceDependencies.length) return;
+        const manifest = await readDepsCacheManifest(projectRoot);
+        if (!manifest || !anvilYamlDependenciesEqual(sourceDependencies, manifest.source_dependencies)) return DEPENDENCY_CACHE_WARNING;
+        if (0 === manifest.resolved_dependencies.length) return DEPENDENCY_CACHE_WARNING;
+        const cachedByAppId = new Map(manifest.cached_dependencies.map((dependency)=>[
+                dependency.app_id,
+                dependency
+            ]));
+        for (const dependency of manifest.resolved_dependencies){
+            const cached = cachedByAppId.get(dependency.app_id);
+            if (!cached || cached.commit_id !== dependency.commit_id) return DEPENDENCY_CACHE_WARNING;
             try {
-                const mergeBase = (await this.git.raw([
-                    "merge-base",
-                    ancestorRef,
-                    descendantRef
-                ])).trim();
-                const ancestorCommit = (await this.git.revparse([
-                    ancestorRef
-                ])).trim();
-                return mergeBase === ancestorCommit;
+                await external_fs_promises_default().access(external_path_default().join(depsDir(projectRoot), cached.package_name, "anvil.yaml"));
             } catch  {
-                return false;
+                return DEPENDENCY_CACHE_WARNING;
             }
         }
-        async mergeFastForward(ref) {
-            await this.runGitCommandWithIndexLockRetry("merge --ff-only", ()=>this.git.raw([
-                    "merge",
-                    "--ff-only",
-                    ref
-                ]));
-        }
-        async deleteRef(ref) {
-            try {
-                await this.git.raw([
-                    "update-ref",
-                    "-d",
-                    ref
-                ]);
-            } catch (e) {}
-        }
-        async getRemotes() {
-            try {
-                const remotes = await this.git.getRemotes(true);
-                return remotes.map((r)=>({
-                        name: r.name,
-                        fetchUrl: r.refs.fetch
-                    }));
-            } catch (e) {
-                throw errors_createGitError.commandFailed("remote", e.message);
+    }
+    function anvilYamlDependenciesEqual(left, right) {
+        return deepEqual(left, right);
+    }
+    function normalizeForComparison(value) {
+        if (Array.isArray(value)) return value.map(normalizeForComparison);
+        if (value && "object" == typeof value) return Object.fromEntries(Object.entries(value).sort(([left], [right])=>left.localeCompare(right)).map(([key, entryValue])=>[
+                key,
+                normalizeForComparison(entryValue)
+            ]));
+        return value;
+    }
+    function cachedManifestEntry(dep, packageName) {
+        return {
+            app_id: dep.app_id,
+            commit_id: dep.commit_id,
+            ...dep.branch ? {
+                branch: dep.branch
+            } : {},
+            package_name: packageName
+        };
+    }
+    function safeDependencyPath(filePath, kind) {
+        const normalizedPath = external_path_default().normalize(filePath);
+        if (external_path_default().isAbsolute(normalizedPath) || normalizedPath.startsWith("..")) throw new Error(`Invalid dependency ${kind} path: ${filePath}`);
+        return normalizedPath;
+    }
+    function dependencyPythonPath(name, kind) {
+        const parts = name.split(".");
+        if (0 === parts.length || parts.some((part)=>!part || "." === part || ".." === part || part.includes("/") || part.includes("\\"))) throw new Error(`Invalid dependency ${kind} name: ${name}`);
+        return external_path_default().join(...parts);
+    }
+    async function writeDepToCache(projectRoot, dep) {
+        const depDir = external_path_default().join(projectRoot, ANVIL_DEPS_DIR, dep.package_name);
+        await external_fs_promises_default().rm(depDir, {
+            recursive: true,
+            force: true
+        });
+        await external_fs_promises_default().mkdir(external_path_default().join(depDir, "client_code"), {
+            recursive: true
+        });
+        await external_fs_promises_default().mkdir(external_path_default().join(depDir, "server_code"), {
+            recursive: true
+        });
+        await external_fs_promises_default().writeFile(external_path_default().join(depDir, "anvil.yaml"), external_js_yaml_default().dump({
+            package_name: dep.package_name
+        }));
+        for (const mod of dep.modules ?? []){
+            const modulePath = external_path_default().join(depDir, "client_code", dependencyPythonPath(mod.name, "module"));
+            if (mod.is_package) {
+                await external_fs_promises_default().mkdir(modulePath, {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(external_path_default().join(modulePath, "__init__.py"), mod.code);
+            } else {
+                const moduleFile = `${modulePath}.py`;
+                await external_fs_promises_default().mkdir(external_path_default().dirname(moduleFile), {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(moduleFile, mod.code);
             }
         }
-        async isGitInitialized() {
-            const gitPath = external_path_default().join(this.repoPath, ".git");
-            return external_fs_.existsSync(gitPath);
-        }
-        async removeEmptyDirectories(removedFiles) {
-            const directoriesToCheck = new Set();
-            for (const file of removedFiles){
-                let dir = external_path_default().dirname(file);
-                while(dir && "." !== dir){
-                    directoriesToCheck.add(dir);
-                    const parentDir = external_path_default().dirname(dir);
-                    if (parentDir === dir) break;
-                    dir = parentDir;
-                }
+        for (const form of dep.forms ?? []){
+            const { code, class_name, is_package, ...formTemplate } = form;
+            const formPath = external_path_default().join(depDir, "client_code", dependencyPythonPath(class_name, "form"));
+            if (is_package) {
+                await external_fs_promises_default().mkdir(formPath, {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(external_path_default().join(formPath, "__init__.py"), code);
+                await external_fs_promises_default().writeFile(external_path_default().join(formPath, "form_template.yaml"), external_js_yaml_default().dump(formTemplate));
+            } else {
+                const formCodeFile = `${formPath}.py`;
+                await external_fs_promises_default().mkdir(external_path_default().dirname(formCodeFile), {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(formCodeFile, code);
+                await external_fs_promises_default().writeFile(`${formPath}.yaml`, external_js_yaml_default().dump(formTemplate));
+            }
+        }
+        for (const mod of dep.server_modules ?? []){
+            const modulePath = external_path_default().join(depDir, "server_code", dependencyPythonPath(mod.name, "server module"));
+            if (mod.is_package) {
+                await external_fs_promises_default().mkdir(modulePath, {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(external_path_default().join(modulePath, "__init__.py"), mod.code);
+            } else {
+                const moduleFile = `${modulePath}.py`;
+                await external_fs_promises_default().mkdir(external_path_default().dirname(moduleFile), {
+                    recursive: true
+                });
+                await external_fs_promises_default().writeFile(moduleFile, mod.code);
             }
-            const sortedDirs = Array.from(directoriesToCheck).sort((a, b)=>b.split("/").length - a.split("/").length);
-            for (const dir of sortedDirs)try {
-                const dirPath = external_path_default().join(this.repoPath, dir);
-                if (!external_fs_.existsSync(dirPath)) continue;
-                const entries = await external_fs_.promises.readdir(dirPath);
-                if (0 === entries.length) await external_fs_.promises.rmdir(dirPath);
-            } catch (error) {}
+        }
+        for (const asset of dep.assets ?? []){
+            const targetPath = external_path_default().join(depDir, "theme", "assets", safeDependencyPath(asset.name, "asset"));
+            await external_fs_promises_default().mkdir(external_path_default().dirname(targetPath), {
+                recursive: true
+            });
+            await external_fs_promises_default().writeFile(targetPath, Buffer.from(asset.content, "base64"));
+        }
+        for (const doc of dep.docs ?? []){
+            const targetPath = external_path_default().join(depDir, safeDependencyPath(doc.path, "doc"));
+            await external_fs_promises_default().mkdir(external_path_default().dirname(targetPath), {
+                recursive: true
+            });
+            await external_fs_promises_default().writeFile(targetPath, doc.content);
         }
     }
-    async function getStagedFileChanges(git, gitService) {
+    async function writeAllDepsToCache(projectRoot, response, options = {}) {
+        const includeDocs = options.includeDocs ?? true;
+        const manifest = await readDepsCacheManifest(projectRoot);
+        const canReuseExistingCache = manifest?.includeDocs === includeDocs;
+        if (!canReuseExistingCache) await clearDepsCache(projectRoot);
+        const previousCached = canReuseExistingCache ? manifest.cached_dependencies : [];
+        const resolvedAppIds = new Set(response.resolved_dependencies.map((dep)=>dep.app_id));
+        for (const dep of previousCached)if (!resolvedAppIds.has(dep.app_id)) await external_fs_promises_default().rm(external_path_default().join(projectRoot, ANVIL_DEPS_DIR, dep.package_name), {
+            recursive: true,
+            force: true
+        });
+        for (const dep of response.dependencies)await writeDepToCache(projectRoot, dep);
+        const returnedByAppId = new Map(response.dependencies.map((dep)=>[
+                dep.app_id,
+                dep
+            ]));
+        const previousByAppId = new Map(previousCached.map((dep)=>[
+                dep.app_id,
+                dep
+            ]));
+        const cachedDependencies = response.resolved_dependencies.map((dep)=>{
+            const returned = returnedByAppId.get(dep.app_id);
+            if (returned) return cachedManifestEntry(returned, returned.package_name);
+            const previous = previousByAppId.get(dep.app_id);
+            if (!previous) return;
+            return cachedManifestEntry(dep, previous.package_name);
+        }).filter((dep)=>void 0 !== dep);
+        const newManifest = {
+            version: DEPS_MANIFEST_VERSION,
+            includeDocs,
+            source_dependencies: void 0 === options.sourceDependencies ? await readAnvilYamlDependencies(projectRoot) : options.sourceDependencies,
+            resolved_dependencies: response.resolved_dependencies,
+            cached_dependencies: cachedDependencies
+        };
+        await external_fs_promises_default().mkdir(depsDir(projectRoot), {
+            recursive: true
+        });
+        await external_fs_promises_default().writeFile(depsManifestPath(projectRoot), `${JSON.stringify(newManifest, null, 2)}\n`);
+    }
+    async function clearDepsCache(projectRoot) {
+        await external_fs_promises_default().rm(depsDir(projectRoot), {
+            recursive: true,
+            force: true
+        });
+    }
+    async function getCachedPackages(projectRoot) {
         try {
-            const status = await git.status();
-            const renames = status.renamed || [];
-            const stagedFiles = status.files.filter((f)=>" " !== f.index && "?" !== f.index);
-            const stagedModeOnlyPaths = new Set(gitService ? await gitService.discardStagedModeOnlyChanges(stagedFiles.filter((f)=>"R" !== f.index && "D" !== f.index).map((f)=>f.path)) : []);
-            const stagedRenames = [];
-            for (const f of stagedFiles)if ("R" === f.index) {
-                const rename = renames.find((r)=>r.to === f.path);
-                if (rename) stagedRenames.push({
-                    path: rename.to,
-                    type: "rename",
-                    from: rename.from
-                });
-            }
-            const stagedRenamedFromPaths = new Set(stagedRenames.map((r)=>r.from));
-            const stagedRenamedToPaths = new Set(stagedRenames.map((r)=>r.path));
-            const changes = [];
-            for (const f of stagedFiles){
-                if ("R" !== f.index) {
-                    if (!stagedModeOnlyPaths.has(f.path)) {
-                        if (!(stagedRenamedFromPaths.has(f.path) || stagedRenamedToPaths.has(f.path))) if ("D" === f.index) changes.push({
-                            path: f.path,
-                            type: "unlink"
-                        });
-                        else if ("A" === f.index || "?" === f.index) changes.push({
-                            path: f.path,
-                            type: "add"
-                        });
-                        else changes.push({
-                            path: f.path,
-                            type: "change"
-                        });
-                    }
-                }
-            }
-            changes.push(...stagedRenames);
-            return changes;
-        } catch (e) {
-            throw errors_createGitError.commandFailed("status", e.message);
+            const entries = await external_fs_promises_default().readdir(depsDir(projectRoot), {
+                withFileTypes: true
+            });
+            return entries.filter((entry)=>entry.isDirectory()).map((entry)=>entry.name);
+        } catch  {
+            return [];
         }
     }
     const external_chokidar_namespaceObject = require("chokidar");
@@ -16199,8 +16450,10 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         }
         if (void 0 !== value.toolbox_item && !isPlainObject(value.toolbox_item)) formTemplateValidation_pushIssue(issues, path("toolbox_item"), "must be an object");
         if (void 0 !== value.layout_metadata && !isPlainObject(value.layout_metadata)) formTemplateValidation_pushIssue(issues, path("layout_metadata"), "must be an object");
+        if (void 0 !== value.help_text && "string" != typeof value.help_text) formTemplateValidation_pushIssue(issues, path("help_text"), "must be a string");
         if (void 0 !== value.item_type) if (isPlainObject(value.item_type)) {
-            if ("number" != typeof value.item_type.table_id) formTemplateValidation_pushIssue(issues, path("item_type.table_id"), "must be a number");
+            if (void 0 !== value.item_type.table_name) validateNonEmptyString(value.item_type.table_name, path("item_type.table_name"), issues);
+            else if ("number" != typeof value.item_type.table_id) formTemplateValidation_pushIssue(issues, path("item_type.table_id"), "must be a number");
         } else formTemplateValidation_pushIssue(issues, path("item_type"), "must be an object");
         return issues;
     }
@@ -16273,7 +16526,8 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         "toolbox_item",
         "layout_metadata",
         "item_type",
-        "slots"
+        "slots",
+        "help_text"
     ]);
     const FRONTMATTER_DISALLOWED_KEYS = new Set([
         "container",
@@ -16440,6 +16694,45 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         };
     }
     const validatePython_requireFromHere = (0, external_module_namespaceObject.createRequire)(__filename);
+    const DEFAULT_PYRIGHT_MAX_OLD_SPACE_MB = 768;
+    const DEFAULT_PYRIGHT_TIMEOUT_MS = 300000;
+    function parsePositiveIntegerEnv(env, name, defaultValue) {
+        const rawValue = env[name];
+        if (void 0 === rawValue || "" === rawValue) return {
+            value: defaultValue
+        };
+        if (!/^\d+$/.test(rawValue) || Number(rawValue) <= 0 || !Number.isSafeInteger(Number(rawValue))) return {
+            error: `${name} must be a positive integer`
+        };
+        return {
+            value: Number(rawValue)
+        };
+    }
+    function pyrightChildNodeOptions(nodeOptions, maxOldSpaceMb) {
+        const maxOldSpaceFlag = "--max[-_]old[-_]space[-_]size";
+        const withoutEqualsForm = (nodeOptions ?? "").replace(new RegExp(`(^|\\s)${maxOldSpaceFlag}=\\S+`, "g"), "$1");
+        const withoutSeparateForm = withoutEqualsForm.replace(new RegExp(`(^|\\s)${maxOldSpaceFlag}\\s+\\S+`, "g"), "$1");
+        return [
+            withoutSeparateForm.trim(),
+            `--max-old-space-size=${maxOldSpaceMb}`
+        ].filter(Boolean).join(" ");
+    }
+    function semanticProcessFailure(message) {
+        return {
+            ok: false,
+            message: "Python semantic validation could not be run",
+            issues: [
+                {
+                    path: "root",
+                    message,
+                    severity: "error"
+                }
+            ]
+        };
+    }
+    function isV8HeapOutOfMemory(stderr) {
+        return /(?:JavaScript heap out of memory|Reached heap limit|Ineffective mark-compacts near heap limit)/i.test(stderr);
+    }
     function resolveBundledAnvilPyright() {
         try {
             return {
@@ -16707,8 +17000,13 @@ print(json.dumps({"issues": issues}))
         };
     }
     function validatePythonWithPyright(appRoot, options = {}) {
+        const env = options.env ?? process.env;
+        const maxOldSpace = parsePositiveIntegerEnv(env, "ANVIL_PYRIGHT_MAX_OLD_SPACE_MB", DEFAULT_PYRIGHT_MAX_OLD_SPACE_MB);
+        if ("error" in maxOldSpace) return semanticProcessFailure(maxOldSpace.error);
+        const timeout = parsePositiveIntegerEnv(env, "ANVIL_PYRIGHT_TIMEOUT_MS", DEFAULT_PYRIGHT_TIMEOUT_MS);
+        if ("error" in timeout) return semanticProcessFailure(timeout.error);
         const pyright = void 0 === options.pyright ? findAnvilPyright({
-            env: options.env
+            env
         }) : options.pyright;
         if (!pyright) return {
             ok: false,
@@ -16731,30 +17029,19 @@ print(json.dumps({"issues": issues}))
             ...options.files ?? []
         ], {
             encoding: "utf8",
-            maxBuffer: 10485760
+            env: {
+                ...env,
+                NODE_OPTIONS: pyrightChildNodeOptions(env.NODE_OPTIONS, maxOldSpace.value)
+            },
+            maxBuffer: 10485760,
+            timeout: timeout.value
         });
-        if (result.error) return {
-            ok: false,
-            message: "Python semantic validation could not be run",
-            issues: [
-                {
-                    path: "root",
-                    message: result.error.message,
-                    severity: "error"
-                }
-            ]
-        };
-        if (0 !== result.status && 1 !== result.status) return {
-            ok: false,
-            message: "Python semantic validation could not be run",
-            issues: [
-                {
-                    path: "root",
-                    message: result.stderr.trim() || `anvil-pyright exited with status ${result.status}`,
-                    severity: "error"
-                }
-            ]
-        };
+        if (result.error) {
+            if ("ETIMEDOUT" === result.error.code) return semanticProcessFailure(`anvil-pyright exceeded the ${timeout.value} ms timeout. Increase ANVIL_PYRIGHT_TIMEOUT_MS or validate a smaller target.`);
+            return semanticProcessFailure(result.error.message);
+        }
+        if (isV8HeapOutOfMemory(result.stderr)) return semanticProcessFailure(`anvil-pyright ran out of memory with a ${maxOldSpace.value} MB heap. Increase ANVIL_PYRIGHT_MAX_OLD_SPACE_MB or validate a smaller target.`);
+        if (0 !== result.status && 1 !== result.status) return semanticProcessFailure(result.stderr.trim() || `anvil-pyright exited with status ${result.status}`);
         let parsed;
         try {
             parsed = JSON.parse(result.stdout.trim());
@@ -17071,7 +17358,7 @@ print(json.dumps({"issues": issues}))
     }
     function validateScheduledTasks(value, path) {
         const issues = [];
-        if (void 0 === value) return issues;
+        if (null == value) return issues;
         if (!Array.isArray(value)) {
             validators_pushIssue(issues, path, "must be an array");
             return issues;
@@ -18570,6 +18857,15 @@ print(json.dumps({"issues": issues}))
             this.hasPendingChanges = true;
             await this.processSaveBatchWithEvents();
         }
+        async flush() {
+            const requireReady = ()=>{
+                if (this.config.isPaused() || this.config.isCleanedUp() || !this.config.isSettlePeriodOver()) throw new Error("Cannot flush saves while watching is paused, closed, or changing branch");
+            };
+            requireReady();
+            await this.forceSave();
+            requireReady();
+            if (this.hasPendingChanges) throw new Error("Saves remain pending");
+        }
         cleanup() {
             if (this.hasPendingChanges) {
                 logger_logger.progressEnd("sync");
@@ -18666,10 +18962,7 @@ print(json.dumps({"issues": issues}))
                 status = await this.config.gitService.getStatus();
             } catch (e) {
                 logger_logger.error(external_chalk_default().red(`Error reading git status: ${errors_getErrorMessage(e)}`));
-                return {
-                    skipped: true,
-                    reason: "Git status error"
-                };
+                throw e;
             }
             let allChanges;
             if (this.config.stagedOnly) {
@@ -19515,6 +19808,7 @@ print(json.dumps({"issues": issues}))
             try {
                 const previousSubscriptions = this.wsClient?.getDependencySubscriptions() ?? [];
                 const { response, addedGitignoreEntry } = await refreshDependencyCache(this.repoPath, this.appId, this.anvilUrl, {
+                    username: this.username,
                     includeDocs: true
                 });
                 if (addedGitignoreEntry) logger_logger.info("Added /.anvil/ to .gitignore");
@@ -19826,6 +20120,12 @@ print(json.dumps({"issues": issues}))
             if (!this.saveProcessor) return;
             return this.saveProcessor.forceSave();
         }
+        async flushSaves() {
+            if (!this.saveProcessor || this.isSwitchingForEnvironment) throw new Error("App synchronization is not ready");
+            const branch = this.currentBranch;
+            await this.saveProcessor.flush();
+            if (this.isSwitchingForEnvironment || this.currentBranch !== branch || await this.gitService.getCurrentBranch() !== branch) throw new Error("App branch changed while flushing saves");
+        }
         async getSuccessMessage() {
             try {
                 const info = await this.gitService.getCommitInfo();
@@ -20017,6 +20317,8 @@ print(json.dumps({"issues": issues}))
         }
     }
     const external_http_namespaceObject = require("http");
+    const external_readline_namespaceObject = require("readline");
+    var external_readline_default = /*#__PURE__*/ __webpack_require__.n(external_readline_namespaceObject);
     const external_open_namespaceObject = require("open");
     var external_open_default = /*#__PURE__*/ __webpack_require__.n(external_open_namespaceObject);
     const successPage = `<!DOCTYPE html>
@@ -21048,7 +21350,7 @@ print(json.dumps({"issues": issues}))
             value: null
         });
         return logger_logger.select("Multiple logged-in Anvil URLs found. Which one would you like to use?", choices, decision.urls[0], {
-            action: "`anvil checkout` URL selection",
+            action: "Anvil server selection",
             nonInteractiveHint: `Use --url <ANVIL_URL>. Available URLs: ${decision.urls.join(", ")}.`
         });
     }
@@ -21127,8 +21429,8 @@ print(json.dumps({"issues": issues}))
             name: "Cancel",
             value: null
         });
-        return logger_logger.select(`Multiple accounts found for ${anvilUrl}. Which account should be used for checkout?`, choices, accounts[0], {
-            action: "`anvil checkout` account selection",
+        return logger_logger.select(`Multiple accounts found for ${anvilUrl}. Which account should be used?`, choices, accounts[0], {
+            action: "Anvil account selection",
             nonInteractiveHint: `Use --user <USERNAME>. Available accounts: ${accounts.join(", ")}.`
         });
     }
@@ -21147,7 +21449,7 @@ print(json.dumps({"issues": issues}))
         logger_logger.verbose(external_chalk_default().cyan("Resolved app ID: ") + external_chalk_default().bold(parsed.appId));
         const anvilUrl = await resolveCheckoutUrlForApi(options.anvilUrl, parsed.detectedUrl);
         if (!anvilUrl) throw new Error("Anvil URL is required. Use --url <ANVIL_URL> or pass an input URL containing the host.");
-        const gitUrl = options.gitUrl ?? anvilUrl;
+        const gitUrl = void 0 === options.gitUrl ? anvilUrl : normalizeAnvilOrigin(options.gitUrl);
         const resolvedUsername = await resolveCheckoutUsernameForApi(anvilUrl, options.user);
         if (resolvedUsername) logger_logger.verbose(external_chalk_default().cyan("Using account: ") + external_chalk_default().bold(resolvedUsername));
         else logger_logger.verbose(external_chalk_default().cyan("No account preselected; resolving after auth token lookup."));
@@ -21258,7 +21560,7 @@ print(json.dumps({"issues": issues}))
         await openPathInEditorOrDefault(destinationPath, preferredEditorCommand, deps);
     }
     function registerCheckoutCommand(program) {
-        const checkoutCommand = program.command("checkout [input] [directory]").description("Check out an Anvil app locally from editor URL, git URL, app ID, or interactive selection").alias("co").option("-O, --open", "Open destination after checkout").option("-b, --branch <BRANCH>", "Checkout a specific branch").option("--depth <N>", "Create a shallow clone with history truncated to N commits", (value)=>parseInt(value, 10)).option("--single-branch", "Clone only one branch").option("--origin <NAME>", "Use a custom remote name instead of origin").option("--quiet", "Suppress git clone progress output").option("--verbose", "Enable verbose git clone output").option("-u, --url <ANVIL_URL>", "Specify Anvil server URL").option("-U, --user <USERNAME>", "Specify which user account to use").option("-f, --force", "Override safety checks for destination path").option("-Q, --query <QUERY>", "Initial search query for interactive checkout picker").action(async (input, directory, options, command)=>{
+        const checkoutCommand = program.command("checkout [input] [directory]").description("Check out an Anvil app locally from editor URL, git URL, app ID, or interactive selection").alias("co").option("-O, --open", "Open destination after checkout").option("-b, --branch <BRANCH>", "Checkout a specific branch").option("--depth <N>", "Create a shallow clone with history truncated to N commits", (value)=>parseInt(value, 10)).option("--single-branch", "Clone only one branch").option("--origin <NAME>", "Use a custom remote name instead of origin").option("--quiet", "Suppress git clone progress output").option("--verbose", "Enable verbose git clone output").option("-u, --url <ANVIL_URL>", "Specify Anvil server URL").option("--git-url <GIT_URL>", "Git server URL, if separate from the Anvil server").option("-U, --user <USERNAME>", "Specify which user account to use").option("-f, --force", "Override safety checks for destination path").option("-Q, --query <QUERY>", "Initial search query for interactive checkout picker").action(async (input, directory, options, command)=>{
             try {
                 const globalOptions = command?.optsWithGlobals() || options || {};
                 if ("number" == typeof options?.depth && (!Number.isFinite(options.depth) || options.depth <= 0)) throw new Error("--depth must be a positive integer");
@@ -21273,6 +21575,7 @@ print(json.dumps({"issues": issues}))
                     quiet: options?.quiet,
                     verbose: globalOptions.verbose,
                     anvilUrl: options?.url,
+                    gitUrl: options?.gitUrl,
                     user: options?.user,
                     force: options?.force,
                     query: options?.query
@@ -21284,6 +21587,232 @@ print(json.dumps({"issues": issues}))
         });
         checkoutCommand.addHelpText("after", "\n" + external_chalk_default().bold("Examples:") + '\n  anvil checkout http://localhost:3000/build/apps/APPID/code/assets/theme.css\n  anvil checkout https://anvil.works/git/APPID.git\n  anvil checkout APPID --url anvil.works\n  anvil checkout APPID --branch master --depth 1 --single-branch\n  anvil checkout APPID -O  # open editor/file browser after checkout\n  anvil checkout APPID my-local-folder --force\n  anvil checkout  # interactive search/select app list\n  anvil checkout -Q "dashboard"  # preseed picker search\n');
     }
+    class CreateCheckoutError extends Error {
+        created;
+        constructor(message, created, options){
+            super(message, options), this.created = created;
+            this.name = "CreateCheckoutError";
+        }
+    }
+    const create_defaultDeps = {
+        getAccountsForUrl: auth_getAccountsForUrl,
+        getValidAuthToken: auth_getValidAuthToken,
+        createApp: createAnvilApp,
+        checkout: executeCheckout
+    };
+    function validateCheckoutOptions(options) {
+        if (false === options.checkout && (void 0 !== options.directory || void 0 !== options.gitUrl || options.open)) throw new Error("--no-checkout cannot be combined with a destination argument, --directory, --git-url, or --open.");
+    }
+    async function validateCreateInput(options) {
+        validateCheckoutOptions(options);
+        const name = options.name.trim();
+        if (!name) throw new Error("App name is required.");
+        const tags = void 0 === options.tags ? void 0 : [
+            ...new Set(options.tags.map((tag)=>tag.trim().toLowerCase()))
+        ];
+        if (tags && (tags.length > 20 || tags.some((tag)=>tag.length > 50 || !/^[a-z0-9_-]+$/.test(tag)))) throw new Error("Use at most 20 unique tags, each 1–50 characters: letters, numbers, hyphens, or underscores.");
+        if (false === options.checkout) return {
+            name,
+            tags,
+            destinationPath: void 0
+        };
+        const directory = options.directory ?? sanitizeDirectoryName(name);
+        if (!directory) throw new Error("App name cannot be used as a directory. Pass --directory <PATH>.");
+        const destinationPath = external_path_default().resolve(directory);
+        await validateCheckoutDestination(destinationPath);
+        return {
+            name,
+            tags,
+            destinationPath
+        };
+    }
+    async function executeCreate(options, deps = create_defaultDeps) {
+        const { name, tags, destinationPath } = await validateCreateInput(options);
+        const anvilUrl = normalizeAnvilOrigin(options.anvilUrl ?? await resolveCheckoutUrlForApi() ?? "");
+        const gitUrl = void 0 === options.gitUrl ? void 0 : normalizeAnvilOrigin(options.gitUrl);
+        const accounts = options.user ? [] : await deps.getAccountsForUrl(anvilUrl);
+        const username = options.user ?? accounts[0];
+        if (!username) throw new Error(`Not logged in to ${anvilUrl}. Run 'anvil login ${anvilUrl}' and retry.`);
+        if (!options.user && accounts.length > 1) throw new Error(`Multiple accounts found for ${anvilUrl}: ${accounts.join(", ")}. Use --user <USERNAME>.`);
+        const authToken = await deps.getValidAuthToken(anvilUrl, username);
+        const created = await deps.createApp({
+            name,
+            anvilUrl,
+            authToken,
+            ...tags ? {
+                tags
+            } : {}
+        });
+        if (void 0 === destinationPath) return {
+            appId: created.id,
+            appName: created.name,
+            anvilUrl,
+            username,
+            tags: created.tags ?? tags ?? [],
+            editorUrl: `${anvilUrl}/build/apps/${encodeURIComponent(created.id)}`
+        };
+        try {
+            const checkout = await deps.checkout({
+                input: created.id,
+                directory: destinationPath,
+                anvilUrl,
+                ...gitUrl ? {
+                    gitUrl
+                } : {},
+                user: username
+            });
+            return {
+                ...checkout,
+                tags: created.tags ?? tags ?? []
+            };
+        } catch (error) {
+            const details = {
+                appId: created.id,
+                appName: created.name,
+                anvilUrl,
+                gitUrl,
+                destinationPath,
+                username,
+                tags: created.tags ?? tags ?? []
+            };
+            const retry = buildShellCommandLine([
+                "anvil",
+                "checkout",
+                created.id,
+                destinationPath,
+                "--url",
+                anvilUrl,
+                "--user",
+                username,
+                ...gitUrl ? [
+                    "--git-url",
+                    gitUrl
+                ] : []
+            ]);
+            const remainingFiles = await isDirectoryNonEmpty(destinationPath).catch(()=>true);
+            const recovery = remainingFiles ? `Inspect the existing checkout at ${destinationPath} before retrying. For Git authentication problems, run ${buildShellCommandLine([
+                "anvil",
+                "git-auth",
+                "doctor",
+                "--repo",
+                destinationPath
+            ])}.` : `Retry checkout with: ${retry}`;
+            const message = errors_getErrorMessage(error).replaceAll(authToken, "[REDACTED]").replaceAll(encodeURIComponent(authToken), "[REDACTED]");
+            throw new CreateCheckoutError(`Created app ${created.id} at ${anvilUrl}, but checkout failed: ${message}. Do not rerun create. ${recovery}`, details, {
+                cause: error
+            });
+        }
+    }
+    async function resolveCreateAccountInteractive(anvilUrl, options) {
+        const user = await resolveCheckoutUsername(anvilUrl, options.user);
+        if (null === user) return null;
+        try {
+            await auth_getValidAuthToken(anvilUrl, user);
+            return user;
+        } catch (error) {
+            const loginNeeded = isAnvilError(error) && ([
+                "auth_required",
+                "auth_expired",
+                "auth_invalid"
+            ].includes(error.type) || "token_refresh_failed" === error.type && [
+                400,
+                401,
+                403
+            ].includes(error.status ?? 0));
+            if (!loginNeeded) throw error;
+            if (!canPrompt()) throw new Error(`${errors_getErrorMessage(error)} Run 'anvil login ${anvilUrl}' and retry.`, {
+                cause: error
+            });
+            if (!await logger_logger.confirm(`${errors_getErrorMessage(error)} Log in to ${anvilUrl} now?`, true)) return null;
+            const login = await (options.login ?? runInteractiveLoginFlow)(anvilUrl);
+            if (user && login.email !== user) throw new Error(`Logged in as ${login.email}, but the selected account is ${user}. No app was created.`);
+            return login.email;
+        }
+    }
+    function registerCreateCommand(program, deps = {
+        executeCreate
+    }) {
+        program.command("create [name] [directory]").description("Create a new Anvil app and check it out locally").option("--no-checkout", "Create the app without a local checkout").option("-d, --directory <PATH>", "Local directory for the new app").option("--tag <TAG...>", "App tags (space-separated or repeated; place after name and directory)", (tag, tags)=>[
+                ...tags,
+                tag
+            ], []).option("-u, --url <ANVIL_URL>", "Anvil server URL").option("-U, --user <USERNAME>", "Logged-in account to create the app").option("--git-url <GIT_URL>", "Git server URL, if separate from the Anvil server").option("-O, --open", "Open the new app directory after checkout").action(async (name, directory, options)=>{
+            try {
+                if (void 0 !== directory && void 0 !== options.directory) throw new Error("Pass the directory once, either as an argument or with --directory.");
+                validateCheckoutOptions({
+                    ...options,
+                    directory: directory ?? options.directory
+                });
+                if (void 0 === name) {
+                    assertCanPrompt("`anvil create` without a name", "Pass a name: anvil create <NAME>.");
+                    const answer = await logger_logger.prompt([
+                        {
+                            type: "input",
+                            name: "name",
+                            message: "App name",
+                            validate: (value)=>value.trim() ? true : "App name is required."
+                        }
+                    ]);
+                    name = answer.name;
+                }
+                const input = await validateCreateInput({
+                    name,
+                    directory: directory ?? options.directory,
+                    tags: options.tag,
+                    checkout: options.checkout
+                });
+                const explicitUrl = void 0 === options.url ? void 0 : normalizeAnvilOrigin(options.url);
+                const gitUrl = void 0 === options.gitUrl ? void 0 : normalizeAnvilOrigin(options.gitUrl);
+                const selectedUrl = await resolveCheckoutUrl(explicitUrl);
+                if (!selectedUrl) return void logger_logger.info("Create cancelled.");
+                const anvilUrl = normalizeAnvilOrigin(selectedUrl);
+                const user = await resolveCreateAccountInteractive(anvilUrl, {
+                    user: options.user,
+                    login: deps.login
+                });
+                if (null === user) return void logger_logger.info("Create cancelled.");
+                const result = await deps.executeCreate({
+                    name: input.name,
+                    directory: input.destinationPath,
+                    tags: input.tags,
+                    anvilUrl,
+                    ...false === options.checkout ? {
+                        checkout: false
+                    } : {},
+                    ...gitUrl ? {
+                        gitUrl
+                    } : {},
+                    user
+                });
+                if (options.open && "destinationPath" in result) {
+                    const preferredEditor = String(getConfig("preferredEditor") || "").trim();
+                    try {
+                        await (deps.openPath ?? checkout_openPathInEditorOrDefault)(result.destinationPath, preferredEditor ? getPreferredEditorCommand(preferredEditor) : void 0);
+                    } catch (error) {
+                        logger_logger.warn(`App created and checked out at ${result.destinationPath}, but opening it failed: ${errors_getErrorMessage(error)}`);
+                    }
+                }
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: result
+                });
+                else {
+                    logger_logger.success("destinationDisplay" in result ? `Created ${result.appName ?? result.appId} (${result.appId}) in ${result.destinationDisplay}` : `Created ${result.appName ?? result.appId} (${result.appId}) at ${result.editorUrl}`);
+                    if ("destinationDisplay" in result) logger_logger.info(`${result.anvilUrl}/build/apps/${encodeURIComponent(result.appId)}`);
+                }
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message,
+                    ...error instanceof CreateCheckoutError ? {
+                        data: {
+                            created: error.created
+                        }
+                    } : {}
+                });
+                else logger_logger.error(`Error: ${message}`);
+                process.exitCode = 1;
+            }
+        });
+    }
     const defaultGitAuthDoctorDeps = {
         getAppAuthBinding: getAppAuthBinding,
         getAccountsForUrl: auth_getAccountsForUrl,
@@ -21577,7 +22106,7 @@ print(json.dumps({"issues": issues}))
         ])).trim();
         const resolvedGitCommonDir = external_path_default().isAbsolute(rawGitCommonDir) ? rawGitCommonDir : external_path_default().resolve(inputPath, rawGitCommonDir);
         const gitCommonDir = external_fs_default().realpathSync(resolvedGitCommonDir);
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         const remotes = (await git.getRemotes(true)).map(detectAnvilRemote);
         const anvilRemotes = remotes.filter((remote)=>remote.appId && remote.anvilUrl && "https" === remote.transport);
         const findings = [];
@@ -21703,7 +22232,7 @@ print(json.dumps({"issues": issues}))
         const repoPath = options.repoPath ?? deps.cwd();
         if ("get" !== operation) return null;
         if (!request.protocol || !request.host) return null;
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         const appId = parseAppIdFromGitPath(request.path);
         if (!appId) return null;
         const requestUrl = normalizeAnvilUrl(`${request.protocol}://${request.host}`);
@@ -21754,7 +22283,6 @@ print(json.dumps({"issues": issues}))
             }
         });
     }
-    const DEFAULT_ANVIL_URL = resolveAnvilUrl();
     async function syncToLatest(repoPath, appId, options) {
         const { anvilUrl, gitUrl = anvilUrl, authToken, currentBranch, username } = options;
         try {
@@ -21783,9 +22311,10 @@ print(json.dumps({"issues": issues}))
         }
     }
     async function watch(repoPath, appId, options = {}) {
-        const { anvilUrl = DEFAULT_ANVIL_URL, gitUrl = anvilUrl, stagedOnly = false, username } = options;
         repoPath = external_path_default().resolve(repoPath);
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const { gitUrl = anvilUrl, stagedOnly = false, username } = options;
         const storedEnvPid = options.environment?.envPid ? void 0 : await readEnvironmentPid(repoPath);
         const environment = options.environment ?? (storedEnvPid ? {
             envPid: storedEnvPid
@@ -21973,40 +22502,10 @@ print(json.dumps({"issues": issues}))
             }));
         choices.push({
             name: "Cancel",
-            value: null
-        });
-        const selectedUrl = await logger_logger.select("Multiple logged-in Anvil URLs found. Which one would you like to use?", choices, decision.urls[0]);
-        return selectedUrl;
-    }
-    const defaultConfigureWatchGitAuthDeps = {
-        configureCredentialHelperForUrl: configureCredentialHelperForUrl,
-        setAppAuthBinding: setAppAuthBinding
-    };
-    const defaultSyncStartDeps = {
-        pushToAnvil,
-        recreateSessionAndValidate,
-        recheckSyncStatus,
-        startWatchingWithEventHandlers
-    };
-    function resolveWatchOpenPath(repoPath) {
-        return external_path_default().resolve(repoPath);
-    }
-    async function openWatchPath(targetPath, deps) {
-        const preferredEditor = String(getConfig("preferredEditor") || "").trim();
-        const preferredEditorCommand = preferredEditor ? getPreferredEditorCommand(preferredEditor) : "";
-        await openPathInEditorOrDefault(targetPath, preferredEditorCommand, deps);
-        logger_logger.info(external_chalk_default().gray(`Opened ${targetPath}`));
-    }
-    async function configureWatchGitAuth(options, deps = defaultConfigureWatchGitAuthDeps) {
-        await deps.configureCredentialHelperForUrl(options.repoPath, options.anvilUrl);
-        await deps.setAppAuthBinding(options.repoPath, options.appId, {
-            url: options.anvilUrl,
-            username: options.username
+            value: null
         });
-    }
-    function isStaleRemotePushError(message) {
-        const normalized = message.toLowerCase();
-        return normalized.includes("fetch first") || normalized.includes("non-fast-forward") || normalized.includes("failed to push some refs") || normalized.includes("remote contains work that you do") || normalized.includes("[rejected]");
+        const selectedUrl = await logger_logger.select("Multiple logged-in Anvil URLs found. Which one would you like to use?", choices, decision.urls[0]);
+        return selectedUrl;
     }
     async function selectAppId(candidates) {
         if (0 === candidates.length) {
@@ -22085,6 +22584,169 @@ print(json.dumps({"issues": issues}))
             return null;
         }
     }
+    class AppAccountCancelledError extends Error {
+        constructor(){
+            super("Operation cancelled.");
+        }
+    }
+    class NoAppIdError extends Error {
+        constructor(){
+            super("No app ID provided. Cannot continue without an app ID.");
+        }
+    }
+    async function resolveAppAccount(repoPath, options = {}) {
+        const { appId: explicitAppId, url: explicitUrl, user: explicitUsername, useFirst = false } = options;
+        auth_setRepoContext(repoPath);
+        const detectedFromAllRemotes = await detectAppIdsFromAllRemotes(repoPath);
+        let filteredCandidates = filterCandidates(detectedFromAllRemotes, explicitUrl, explicitUsername);
+        logger_logger.verbose(external_chalk_default().cyan(`Detected ${detectedFromAllRemotes.length} app ID(s) from git remotes`));
+        if (filteredCandidates.length !== detectedFromAllRemotes.length) logger_logger.verbose(external_chalk_default().cyan(`After filtering: ${filteredCandidates.length} candidate(s)`));
+        let finalAppId;
+        let anvilUrl;
+        let username = explicitUsername;
+        let fallbackUrl;
+        let shouldPersistUsernameBinding = false;
+        if (explicitAppId) {
+            finalAppId = explicitAppId;
+            const binding = await getAppAuthBinding(repoPath, explicitAppId);
+            if (binding.url && !explicitUrl) {
+                anvilUrl = normalizeAnvilUrl(binding.url);
+                logger_logger.verbose(external_chalk_default().cyan("Resolved URL from binding for app ID: ") + external_chalk_default().bold(anvilUrl));
+            }
+            if (binding.username && !explicitUsername) {
+                username = binding.username;
+                logger_logger.verbose(external_chalk_default().cyan("Resolved username from binding for app ID: ") + external_chalk_default().bold(username));
+            }
+            const remoteInfo = lookupRemoteInfoForAppId(explicitAppId, detectedFromAllRemotes);
+            if (remoteInfo.detectedUrl && !explicitUrl && !anvilUrl) {
+                anvilUrl = normalizeAnvilUrl(remoteInfo.detectedUrl);
+                logger_logger.verbose(external_chalk_default().cyan("Resolved URL from remote for app ID: ") + external_chalk_default().bold(anvilUrl));
+            }
+            if (remoteInfo.detectedUsername && !explicitUsername && !username) {
+                username = remoteInfo.detectedUsername;
+                logger_logger.verbose(external_chalk_default().cyan("Resolved username from remote for app ID: ") + external_chalk_default().bold(username));
+            }
+        } else {
+            logger_logger.verbose(external_chalk_default().cyan("No app ID provided, attempting auto-detection..."));
+            if (0 === filteredCandidates.length) {
+                logger_logger.verbose(external_chalk_default().gray("No app IDs found in git remotes."));
+                const resolvedFallbackUrl = await resolveUrlForFallback(explicitUrl);
+                if (null === resolvedFallbackUrl) throw new AppAccountCancelledError();
+                fallbackUrl = normalizeAnvilUrl(resolvedFallbackUrl);
+                const lookupDecision = await confirmReverseLookupWithResolvedUser(fallbackUrl, username);
+                if (null === lookupDecision) throw new AppAccountCancelledError();
+                username = lookupDecision.username;
+                if (lookupDecision.shouldContinue) {
+                    logger_logger.progress("detect", `Searching ${fallbackUrl} ${username ? `for ${username}` : ""} for matching app IDs...`);
+                    const reverseLookupCandidates = await detectAppIdsByCommitLookup(repoPath, {
+                        anvilUrl: fallbackUrl,
+                        username,
+                        includeRemotes: false
+                    });
+                    logger_logger.progressEnd("detect");
+                    for (const c of reverseLookupCandidates)filteredCandidates.push({
+                        ...c,
+                        detectedUrl: fallbackUrl
+                    });
+                }
+            }
+            if (filteredCandidates.length > 0) {
+                for (const c of filteredCandidates)logger_logger.verbose(external_chalk_default().gray(`   Found: ${formatCandidateLabel(c)}`));
+                if (filteredCandidates.length > 1) logger_logger.verbose(external_chalk_default().yellow(`Found ${filteredCandidates.length} potential app IDs`));
+            }
+            if (useFirst && filteredCandidates.length > 0) {
+                const selected = filteredCandidates[0];
+                finalAppId = selected.appId;
+                if (selected.detectedUrl) anvilUrl = normalizeAnvilUrl(selected.detectedUrl);
+                if (selected.detectedUsername && !username) username = selected.detectedUsername;
+                logger_logger.success("Auto-selected first app ID: " + external_chalk_default().bold(finalAppId));
+            } else {
+                const selected = await selectAppId(filteredCandidates);
+                if (!selected) throw new NoAppIdError();
+                finalAppId = selected.appId;
+                if (selected.detectedUrl) anvilUrl = normalizeAnvilUrl(selected.detectedUrl);
+                if (selected.detectedUsername && !username) username = selected.detectedUsername;
+            }
+        }
+        const binding = await getAppAuthBinding(repoPath, finalAppId);
+        if (binding.url && !explicitUrl) {
+            anvilUrl = normalizeAnvilUrl(binding.url);
+            logger_logger.verbose(external_chalk_default().cyan("Using app binding URL: ") + external_chalk_default().bold(anvilUrl));
+        }
+        if (binding.username && !explicitUsername) {
+            username = binding.username;
+            logger_logger.verbose(external_chalk_default().cyan("Using app binding username: ") + external_chalk_default().bold(username));
+        }
+        shouldPersistUsernameBinding = !binding.username && !explicitUsername;
+        if (explicitUrl) anvilUrl = normalizeAnvilUrl(explicitUrl);
+        else if (!anvilUrl) if (fallbackUrl) anvilUrl = fallbackUrl;
+        else {
+            const resolvedFallbackUrl = await resolveUrlForFallback();
+            if (null === resolvedFallbackUrl) throw new AppAccountCancelledError();
+            anvilUrl = normalizeAnvilUrl(resolvedFallbackUrl);
+        }
+        anvilUrl = normalizeAnvilUrl(anvilUrl);
+        logger_logger.verbose(external_chalk_default().green("Using app ID: ") + external_chalk_default().bold(finalAppId));
+        logger_logger.verbose(external_chalk_default().cyan("Using Anvil URL: ") + external_chalk_default().bold(anvilUrl));
+        const resolvedUsername = await resolveUsernameForUrl(anvilUrl, username);
+        if (null === resolvedUsername) throw new AppAccountCancelledError();
+        username = resolvedUsername;
+        if (shouldPersistUsernameBinding && username && (await auth_getAccountsForUrl(anvilUrl)).length > 1) {
+            await setAppAuthBinding(repoPath, finalAppId, {
+                url: anvilUrl,
+                username
+            });
+            logger_logger.verbose(external_chalk_default().cyan("Saved app account binding for future non-interactive use."));
+        }
+        if (username) logger_logger.verbose(external_chalk_default().cyan("Using account: ") + external_chalk_default().bold(username));
+        return {
+            appId: finalAppId,
+            anvilUrl,
+            ...username ? {
+                username
+            } : {}
+        };
+    }
+    function addAppAccountOptions(command) {
+        return command.option("-A, --appid <APP_ID>", "Specify app ID directly").option("-u, --url <ANVIL_URL>", "Specify Anvil server URL (e.g., anvil.works, localhost)").option("-U, --user <USERNAME>", "Specify which user account to use");
+    }
+    function appAccountOptions(options) {
+        return {
+            appId: options.appid,
+            url: options.url,
+            user: options.user
+        };
+    }
+    const defaultConfigureWatchGitAuthDeps = {
+        configureCredentialHelperForUrl: configureCredentialHelperForUrl,
+        setAppAuthBinding: setAppAuthBinding
+    };
+    const defaultSyncStartDeps = {
+        pushToAnvil,
+        recreateSessionAndValidate,
+        recheckSyncStatus,
+        startWatchingWithEventHandlers
+    };
+    function resolveWatchOpenPath(repoPath) {
+        return external_path_default().resolve(repoPath);
+    }
+    async function openWatchPath(targetPath, deps) {
+        const preferredEditor = String(getConfig("preferredEditor") || "").trim();
+        const preferredEditorCommand = preferredEditor ? getPreferredEditorCommand(preferredEditor) : "";
+        await openPathInEditorOrDefault(targetPath, preferredEditorCommand, deps);
+        logger_logger.info(external_chalk_default().gray(`Opened ${targetPath}`));
+    }
+    async function configureWatchGitAuth(options, deps = defaultConfigureWatchGitAuthDeps) {
+        await deps.configureCredentialHelperForUrl(options.repoPath, options.anvilUrl);
+        await deps.setAppAuthBinding(options.repoPath, options.appId, {
+            url: options.anvilUrl,
+            username: options.username
+        });
+    }
+    function isStaleRemotePushError(message) {
+        const normalized = message.toLowerCase();
+        return normalized.includes("fetch first") || normalized.includes("non-fast-forward") || normalized.includes("failed to push some refs") || normalized.includes("remote contains work that you do") || normalized.includes("[rejected]");
+    }
     async function pushToAnvil(options) {
         try {
             const authToken = await auth_getValidAuthToken(options.anvilUrl, options.username);
@@ -22213,7 +22875,7 @@ print(json.dumps({"issues": issues}))
             });
             logger_logger.progressEnd("verify");
             const currentCategory = getSyncStateCategory(freshSession.syncStatus);
-            const currentBranch = freshSession.getBranchName() || "master";
+            const currentBranch = freshSession.getBranchName() || await getFallbackBranchName(options.repoPath);
             if (currentCategory !== previousCategory || currentBranch !== previousBranch) {
                 logger_logger.warn("Repository status has changed. Re-evaluating...");
                 return freshSession;
@@ -22246,7 +22908,7 @@ print(json.dumps({"issues": issues}))
     }
     async function checkSyncStatusAndStart(session, options, deps = defaultSyncStartDeps) {
         const syncStatus = session.syncStatus;
-        const branchName = session.getBranchName() || "master";
+        const branchName = session.getBranchName() || await getFallbackBranchName(options.repoPath);
         const hasUncommitted = session.hasUncommittedChanges;
         const stateCategory = getSyncStateCategory(syncStatus);
         if (syncStatus?.branchMissing) {
@@ -22566,6 +23228,9 @@ print(json.dumps({"issues": issues}))
         const suggestedAction = error.suggestedAction;
         if ("string" == typeof suggestedAction && suggestedAction.length > 0) logger_logger.warn(suggestedAction);
     }
+    async function getFallbackBranchName(repoPath) {
+        return getCurrentOrFallbackBranchName(esm_default(repoPath));
+    }
     async function handleWatchCommand(options) {
         const invoked = process.argv[2];
         if ("sync" === invoked) {
@@ -22573,127 +23238,30 @@ print(json.dumps({"issues": issues}))
             process.exit(1);
         }
         const { path: repoPath = process.cwd(), appid: explicitAppId, useFirst = false, stagedOnly = false, dependencyWatch = true, autoMode = false, url: explicitUrl, user: explicitUsername, open: openAfterValidation = false } = options;
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         try {
             const validationResult = await validateAnvilApp(repoPath);
             if (validationResult.appName) logger_logger.info(external_chalk_default().green("Anvil app: ") + external_chalk_default().bold(validationResult.appName));
-            const detectedFromAllRemotes = await detectAppIdsFromAllRemotes(repoPath);
-            let filteredCandidates = filterCandidates(detectedFromAllRemotes, explicitUrl, explicitUsername);
-            logger_logger.verbose(external_chalk_default().cyan(`Detected ${detectedFromAllRemotes.length} app ID(s) from git remotes`));
-            if (filteredCandidates.length !== detectedFromAllRemotes.length) logger_logger.verbose(external_chalk_default().cyan(`After filtering: ${filteredCandidates.length} candidate(s)`));
-            let finalAppId;
-            let anvilUrl;
-            let username = explicitUsername;
-            let fallbackUrl;
-            let shouldPersistUsernameBinding = false;
-            if (explicitAppId) {
-                finalAppId = explicitAppId;
-                const binding = await getAppAuthBinding(repoPath, explicitAppId);
-                if (binding.url && !explicitUrl) {
-                    anvilUrl = normalizeAnvilUrl(binding.url);
-                    logger_logger.verbose(external_chalk_default().cyan("Resolved URL from binding for app ID: ") + external_chalk_default().bold(anvilUrl));
-                }
-                if (binding.username && !explicitUsername) {
-                    username = binding.username;
-                    logger_logger.verbose(external_chalk_default().cyan("Resolved username from binding for app ID: ") + external_chalk_default().bold(username));
-                }
-                const remoteInfo = lookupRemoteInfoForAppId(explicitAppId, detectedFromAllRemotes);
-                if (remoteInfo.detectedUrl && !explicitUrl && !anvilUrl) {
-                    anvilUrl = normalizeAnvilUrl(remoteInfo.detectedUrl);
-                    logger_logger.verbose(external_chalk_default().cyan("Resolved URL from remote for app ID: ") + external_chalk_default().bold(anvilUrl));
-                }
-                if (remoteInfo.detectedUsername && !explicitUsername && !username) {
-                    username = remoteInfo.detectedUsername;
-                    logger_logger.verbose(external_chalk_default().cyan("Resolved username from remote for app ID: ") + external_chalk_default().bold(username));
-                }
-            } else {
-                logger_logger.verbose(external_chalk_default().cyan("No app ID provided, attempting auto-detection..."));
-                if (0 === filteredCandidates.length) {
-                    logger_logger.verbose(external_chalk_default().gray("No app IDs found in git remotes."));
-                    const resolvedFallbackUrl = await resolveUrlForFallback(explicitUrl);
-                    if (null === resolvedFallbackUrl) {
-                        logger_logger.warn("Operation cancelled.");
-                        process.exit(0);
-                    }
-                    fallbackUrl = normalizeAnvilUrl(resolvedFallbackUrl);
-                    const lookupDecision = await confirmReverseLookupWithResolvedUser(fallbackUrl, username);
-                    if (null === lookupDecision) {
-                        logger_logger.warn("Operation cancelled.");
-                        process.exit(0);
-                    }
-                    username = lookupDecision.username;
-                    if (lookupDecision.shouldContinue) {
-                        logger_logger.progress("detect", `Searching ${fallbackUrl} ${username ? `for ${username}` : ""} for matching app IDs...`);
-                        const reverseLookupCandidates = await detectAppIdsByCommitLookup(repoPath, {
-                            anvilUrl: fallbackUrl,
-                            username,
-                            includeRemotes: false
-                        });
-                        logger_logger.progressEnd("detect");
-                        for (const c of reverseLookupCandidates)filteredCandidates.push({
-                            ...c,
-                            detectedUrl: fallbackUrl
-                        });
-                    }
-                }
-                if (filteredCandidates.length > 0) {
-                    for (const c of filteredCandidates)logger_logger.verbose(external_chalk_default().gray(`   Found: ${formatCandidateLabel(c)}`));
-                    if (filteredCandidates.length > 1) logger_logger.verbose(external_chalk_default().yellow(`Found ${filteredCandidates.length} potential app IDs`));
-                }
-                if (useFirst && filteredCandidates.length > 0) {
-                    const selected = filteredCandidates[0];
-                    finalAppId = selected.appId;
-                    if (selected.detectedUrl) anvilUrl = normalizeAnvilUrl(selected.detectedUrl);
-                    if (selected.detectedUsername && !username) username = selected.detectedUsername;
-                    logger_logger.success("Auto-selected first app ID: " + external_chalk_default().bold(finalAppId));
-                } else {
-                    const selected = await selectAppId(filteredCandidates);
-                    if (!selected) {
-                        logger_logger.error("No app ID provided. Cannot continue without an app ID.");
-                        process.exit(1);
-                    }
-                    finalAppId = selected.appId;
-                    if (selected.detectedUrl) anvilUrl = normalizeAnvilUrl(selected.detectedUrl);
-                    if (selected.detectedUsername && !username) username = selected.detectedUsername;
-                }
-            }
-            const binding = await getAppAuthBinding(repoPath, finalAppId);
-            if (binding.url && !explicitUrl) {
-                anvilUrl = normalizeAnvilUrl(binding.url);
-                logger_logger.verbose(external_chalk_default().cyan("Using app binding URL: ") + external_chalk_default().bold(anvilUrl));
-            }
-            if (binding.username && !explicitUsername) {
-                username = binding.username;
-                logger_logger.verbose(external_chalk_default().cyan("Using app binding username: ") + external_chalk_default().bold(username));
-            }
-            shouldPersistUsernameBinding = !binding.username && !explicitUsername;
-            if (explicitUrl) anvilUrl = normalizeAnvilUrl(explicitUrl);
-            else if (!anvilUrl) if (fallbackUrl) anvilUrl = fallbackUrl;
-            else {
-                const resolvedFallbackUrl = await resolveUrlForFallback();
-                if (null === resolvedFallbackUrl) {
+            let account;
+            try {
+                account = await resolveAppAccount(repoPath, {
+                    appId: explicitAppId,
+                    url: explicitUrl,
+                    user: explicitUsername,
+                    useFirst
+                });
+            } catch (e) {
+                if (e instanceof AppAccountCancelledError) {
                     logger_logger.warn("Operation cancelled.");
                     process.exit(0);
                 }
-                anvilUrl = normalizeAnvilUrl(resolvedFallbackUrl);
-            }
-            anvilUrl = normalizeAnvilUrl(anvilUrl);
-            logger_logger.verbose(external_chalk_default().green("Using app ID: ") + external_chalk_default().bold(finalAppId));
-            logger_logger.verbose(external_chalk_default().cyan("Using Anvil URL: ") + external_chalk_default().bold(anvilUrl));
-            const resolvedUsername = await resolveUsernameForUrl(anvilUrl, username);
-            if (null === resolvedUsername) {
-                logger_logger.warn("Operation cancelled.");
-                process.exit(0);
-            }
-            username = resolvedUsername;
-            if (shouldPersistUsernameBinding && username && (await auth_getAccountsForUrl(anvilUrl)).length > 1) {
-                await setAppAuthBinding(repoPath, finalAppId, {
-                    url: anvilUrl,
-                    username
-                });
-                logger_logger.verbose(external_chalk_default().cyan("Saved app account binding for future non-interactive use."));
+                if (e instanceof NoAppIdError) {
+                    logger_logger.error(e.message);
+                    process.exit(1);
+                }
+                throw e;
             }
-            if (username) logger_logger.verbose(external_chalk_default().cyan("Using account: ") + external_chalk_default().bold(username));
+            const { appId: finalAppId, anvilUrl, username } = account;
             if (!await hasTokensForUrl(anvilUrl, username)) {
                 if (username) logger_logger.error(`Not logged in to ${anvilUrl} as ${username}`);
                 else logger_logger.error(`Not logged in to ${anvilUrl}`);
@@ -22750,7 +23318,7 @@ print(json.dumps({"issues": issues}))
         }
     }
     function registerWatchCommand(program) {
-        const watchCommand = program.command("watch [path]").description("Watch for file changes and sync to Anvil").alias("sync").alias("w").option("-A, --appid <APP_ID>", "Specify app ID directly").option("-f, --first", "Auto-select first detected app ID without confirmation").option("-s, --staged-only", "Only sync staged changes (use git add to stage files)").option("--no-dependency-watch", "Do not watch and refresh .anvil/deps dependencies").option("-a, --auto", "Auto mode: restart on branch changes and sync when behind").option("-O, --open", "Open watched path in preferred editor (or default app)").option("-u, --url <ANVIL_URL>", "Specify Anvil server URL (e.g., anvil.works, localhost)").option("-U, --user <USERNAME>", "Specify which user account to use").action(async (path, options, command)=>{
+        const watchCommand = addAppAccountOptions(program.command("watch [path]")).description("Watch for file changes and sync to Anvil").alias("sync").alias("w").option("-f, --first", "Auto-select first detected app ID without confirmation").option("-s, --staged-only", "Only sync staged changes (use git add to stage files)").option("--no-dependency-watch", "Do not watch and refresh .anvil/deps dependencies").option("-a, --auto", "Auto mode: restart on branch changes and sync when behind").option("-O, --open", "Open watched path in preferred editor (or default app)").action(async (path, options, command)=>{
             const globalOptions = command.optsWithGlobals();
             if (void 0 !== globalOptions.verbose && logger_logger instanceof CLILogger) logger_logger.setVerbose(globalOptions.verbose);
             await handleWatchCommand({
@@ -22780,6 +23348,7 @@ print(json.dumps({"issues": issues}))
                 logger_logger.success("Logged in as " + external_chalk_default().bold(result.email));
             } catch (e) {
                 logger_logger.error("Error: " + e.message);
+                logErrorCause(e, logger_logger);
                 process.exit(1);
             }
         });
@@ -23355,165 +23924,1141 @@ print(json.dumps({"issues": issues}))
     function registerConfigureCommand(program, version) {
         program.command("configure").description("Guided setup for configuration and login").action(async ()=>{
             try {
-                await runConfigureFlow(version, configure_defaultDeps);
-            } catch (e) {
-                logger_logger.error("Error: " + errors_getErrorMessage(e));
-                process.exit(1);
+                await runConfigureFlow(version, configure_defaultDeps);
+            } catch (e) {
+                logger_logger.error("Error: " + errors_getErrorMessage(e));
+                logErrorCause(e, logger_logger);
+                process.exit(1);
+            }
+        });
+    }
+    function registerDepsCommand(program) {
+        const deps = program.command("deps").description("Manage app dependencies");
+        addAppAccountOptions(deps.command("fetch")).description("Fetch dependencies for checkout HEAD into .anvil/deps/").option("--commit <commit>", "Fetch deps at a specific app commit instead of checkout HEAD").option("--exclude-docs", "Exclude dependency docs from .anvil/deps/").action(async (options)=>{
+            try {
+                const projectRoot = process.cwd();
+                const { appId: mainAppId, anvilUrl, username } = await resolveAppAccount(projectRoot, appAccountOptions(options));
+                logger_logger.info(`Fetching dependencies for app ${mainAppId}...`);
+                const { response, addedGitignoreEntry } = await refreshDependencyCache(projectRoot, mainAppId, anvilUrl, {
+                    username,
+                    commit: options.commit,
+                    includeDocs: !options.excludeDocs
+                });
+                if (await getDependencyCacheWarning(projectRoot)) logger_logger.warn("Dependency cache does not match local anvil.yaml. Fetch uses committed dependency declarations; sync dependency changes to Anvil before fetching again.");
+                if (!response.resolved_dependencies.length) return void logger_logger.info("No dependencies to fetch");
+                if (addedGitignoreEntry) logger_logger.info("Added /.anvil/ to .gitignore");
+                if (!response.dependencies.length) return void logger_logger.success(`Dependencies already up to date (${response.resolved_dependencies.length} cached)`);
+                logger_logger.success(`Fetched ${response.dependencies.length} dependencies:`);
+                for (const dep of response.dependencies)logger_logger.info(`  - ${dep.package_name}`);
+            } catch (e) {
+                logger_logger.error(e.message);
+                process.exit(1);
+            }
+        });
+        deps.command("status").description("Show cached dependencies").action(async ()=>{
+            try {
+                const cached = await getCachedPackages(process.cwd());
+                if (!cached.length) return void logger_logger.info("No cached dependencies (run 'anvil deps fetch')");
+                logger_logger.info("Cached dependencies:");
+                for (const pkg of cached)logger_logger.info(`  - ${pkg}`);
+            } catch (e) {
+                logger_logger.error(e.message);
+                process.exit(1);
+            }
+        });
+        deps.command("clear").description("Clear cached dependencies").action(async ()=>{
+            try {
+                await clearDepsCache(process.cwd());
+                logger_logger.success("Cleared .anvil/deps/");
+            } catch (e) {
+                logger_logger.error(e.message);
+                process.exit(1);
+            }
+        });
+    }
+    async function applyDatabaseSchema(appId, options = {}) {
+        const projectRoot = options.projectRoot ?? process.cwd();
+        auth_setRepoContext(projectRoot);
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const appYaml = external_js_yaml_default().load(await external_fs_.promises.readFile(external_path_default().join(projectRoot, "anvil.yaml"), "utf8"));
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${appId}/db/infer-from-env/apply-schema`, {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                schema: appYaml?.db_schema ?? {},
+                table_id_hints: appYaml?.table_id_hints
+            })
+        });
+        if (!response.ok) throw new Error(formatHttpError("Failed to apply database schema", response.status, await response.text()));
+        return await response.json();
+    }
+    async function confirmSchemaApplication(force = false) {
+        if (force) return true;
+        assertCanPrompt("Applying database schema", "Pass --force to apply without prompting.");
+        return logger_logger.confirm("Apply the app environment's schema to its database? This may delete tables, columns, or data.", true);
+    }
+    function registerDbCommand(program) {
+        if ("1" !== process.env.ANVIL_AGENT_HOST) return;
+        const db = program.command("db").description("Manage app databases");
+        addAppAccountOptions(db.command("apply-schema")).description("Apply the app schema to the database for the current environment").option("-f, --force", "Apply the schema without asking for confirmation").action(async (options)=>{
+            try {
+                const projectRoot = process.cwd();
+                const { appId, anvilUrl, username } = await resolveAppAccount(projectRoot, appAccountOptions(options));
+                if (!await confirmSchemaApplication(options.force)) return void logger_logger.info("Schema application cancelled.");
+                const response = await applyDatabaseSchema(appId, {
+                    anvilUrl,
+                    username,
+                    projectRoot
+                });
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: response
+                });
+                else logger_logger.success("Database schema applied.");
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
+                process.exit(1);
+            }
+        });
+    }
+    async function ensureEnvironmentUrl(appId, envPid, options = {}) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${encodeURIComponent(appId)}/environments/${encodeURIComponent(envPid)}/temporary-url`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        if (!response.ok) throw new Error(formatHttpError("Failed to get environment URL", response.status, await response.text()));
+        const { url, expires_at } = await response.json();
+        return {
+            url,
+            expires_at
+        };
+    }
+    async function getTemporaryUplinkKey(appId, envPid, options = {}) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${encodeURIComponent(appId)}/environments/${encodeURIComponent(envPid)}/temporary-uplink-key`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        if (!response.ok) throw new Error(formatHttpError("Failed to get temporary uplink key", response.status, await response.text()));
+        const { key, url, expires_at } = await response.json();
+        return {
+            key,
+            url,
+            expires_at
+        };
+    }
+    async function resolveEnvironmentContext(options = {}) {
+        const projectRoot = process.cwd();
+        const envPid = await readEnvironmentPid(projectRoot);
+        if (!envPid) throw new Error("No app environment associated with the current directory.");
+        const { appId, anvilUrl, username } = await resolveAppAccount(projectRoot, options);
+        return {
+            envPid,
+            anvilUrl,
+            appId,
+            ...username ? {
+                username
+            } : {}
+        };
+    }
+    function registerEnvCommand(program) {
+        if ("1" !== process.env.ANVIL_AGENT_HOST) return;
+        const env = program.command("env").description("Manage app environments");
+        addAppAccountOptions(env.command("url")).description("Get a temporary private app URL for the current environment").action(async (options)=>{
+            try {
+                const { appId, envPid, anvilUrl, username } = await resolveEnvironmentContext(appAccountOptions(options));
+                const { url, expires_at } = await ensureEnvironmentUrl(appId, envPid, {
+                    anvilUrl,
+                    username
+                });
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: {
+                        url,
+                        expires_at
+                    }
+                });
+                else logger_logger.info(`URL: ${url}\nExpires at: ${expires_at}`);
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
+                process.exit(1);
+            }
+        });
+        addAppAccountOptions(env.command("uplink")).description("Get a temporary uplink key for the current environment").action(async (options)=>{
+            try {
+                const { appId, envPid, anvilUrl, username } = await resolveEnvironmentContext(appAccountOptions(options));
+                const { key, url, expires_at } = await getTemporaryUplinkKey(appId, envPid, {
+                    anvilUrl,
+                    username
+                });
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: {
+                        key,
+                        url,
+                        expires_at
+                    }
+                });
+                else logger_logger.info(`Key: ${key}\nURL: ${url}\nExpires at: ${expires_at}`);
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
+                process.exit(1);
+            }
+        });
+    }
+    const external_events_namespaceObject = require("events");
+    function replError(error) {
+        if ("string" == typeof error) return {
+            message: error
+        };
+        if (error && "object" == typeof error) {
+            const value = error;
+            return {
+                message: String(value.message ?? value["anvil/server-error"] ?? JSON.stringify(value)),
+                ..."string" == typeof value.type ? {
+                    type: value.type
+                } : {},
+                ...Array.isArray(value.trace) ? {
+                    trace: value.trace.filter((frame)=>Array.isArray(frame) && "string" == typeof frame[0] && "number" == typeof frame[1])
+                } : {}
+            };
+        }
+        return {
+            message: String(error)
+        };
+    }
+    class ReplServerError extends Error {
+        detail;
+        constructor(detail){
+            super(detail.message), this.detail = detail;
+        }
+    }
+    async function runRepl(appId, envPid, options) {
+        const interrupted = ()=>new Error("REPL interrupted.");
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const url = new URL(`${anvilUrl.replace(/\/$/, "")}/ide/api/_/apps/${encodeURIComponent(appId)}/environments/${encodeURIComponent(envPid)}/ws`);
+        url.protocol = "https:" === url.protocol ? "wss:" : "ws:";
+        if (options.signal?.aborted) throw interrupted();
+        const ws = new (external_ws_default())(url, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            },
+            handshakeTimeout: 30000
+        });
+        const controller = new AbortController();
+        let repl;
+        let nextId = 1;
+        let output = "";
+        let keepalive;
+        let pongTimeout;
+        let closeTimeout;
+        const startupTimeout = setTimeout(()=>{
+            controller.abort(new Error("Timed out waiting for the REPL to start."));
+        }, 30000);
+        const onAbort = ()=>controller.abort(interrupted());
+        const markResponsive = ()=>{
+            clearTimeout(pongTimeout);
+            pongTimeout = void 0;
+        };
+        options.signal?.addEventListener("abort", onAbort, {
+            once: true
+        });
+        ws.on("pong", markResponsive);
+        ws.on("unexpected-response", (request, response)=>{
+            response.resume();
+            controller.abort(new Error(`REPL websocket handshake failed (${response.statusCode} ${response.statusMessage}).`));
+            request.destroy();
+        });
+        ws.on("error", (error)=>controller.abort(new Error(`REPL websocket connection failed: ${error.message}`)));
+        ws.on("close", (code, reason)=>{
+            clearTimeout(closeTimeout);
+            controller.abort(new Error(`REPL websocket disconnected unexpectedly (code ${code}${reason.length ? `: ${reason}` : ""}).`));
+        });
+        const messages = (0, external_events_namespaceObject.on)(ws, "message", {
+            signal: controller.signal
+        });
+        function send(message) {
+            const id = nextId++;
+            ws.send(JSON.stringify({
+                ...message,
+                id
+            }), (error)=>{
+                if (error) controller.abort(new Error(`REPL websocket send failed: ${error.message}`));
+            });
+            return id;
+        }
+        async function readUntil(matches) {
+            while(true){
+                const { value, done } = await messages.next();
+                options.signal?.throwIfAborted();
+                if (done) throw new Error("REPL websocket message stream ended unexpectedly.");
+                markResponsive();
+                let message;
+                try {
+                    message = JSON.parse(value[0].toString());
+                    if (!message || "object" != typeof message || Array.isArray(message)) throw new Error("Expected an object");
+                } catch  {
+                    throw new Error("Invalid REPL websocket message.");
+                }
+                if ("REPL_UPDATE" === message.event) {
+                    if (!repl || message.repl !== repl) continue;
+                    if ("string" == typeof message.output) {
+                        output += message.output;
+                        options.onOutput?.(message.output);
+                        options.signal?.throwIfAborted();
+                    }
+                }
+                if (message.error) throw new ReplServerError(replError(message.error));
+                if ("REPL_UPDATE" === message.event && message.terminated) throw new Error("REPL terminated unexpectedly.");
+                if (matches(message)) return message;
+            }
+        }
+        try {
+            await (0, external_events_namespaceObject.once)(ws, "open", {
+                signal: controller.signal
+            });
+            const launchId = send({
+                cmd: "LAUNCH_REPL"
+            });
+            const launched = await readUntil((message)=>message.id === launchId);
+            if ("string" != typeof launched.repl || !launched.repl) throw new Error("Invalid REPL launch response: missing REPL ID.");
+            repl = launched.repl;
+            keepalive = setInterval(()=>{
+                try {
+                    send({
+                        cmd: "REPL_KEEPALIVE",
+                        repl
+                    });
+                    pongTimeout = setTimeout(()=>controller.abort(new Error("REPL websocket heartbeat timed out.")), 10000);
+                    ws.ping();
+                } catch (error) {
+                    controller.abort(error);
+                }
+            }, 20000);
+            const isReady = (message)=>"REPL_UPDATE" === message.event && true === message.ready;
+            await readUntil(isReady);
+            clearTimeout(startupTimeout);
+            send({
+                cmd: "REPL_COMMAND",
+                repl,
+                command: options.code
+            });
+            await readUntil(isReady);
+            return {
+                output
+            };
+        } catch (error) {
+            if (error instanceof ReplServerError) return {
+                output,
+                error: error.detail
+            };
+            const failure = controller.signal.aborted ? controller.signal.reason : error;
+            throw failure instanceof Error ? failure : new Error(String(failure));
+        } finally{
+            clearTimeout(startupTimeout);
+            clearInterval(keepalive);
+            clearTimeout(pongTimeout);
+            options.signal?.removeEventListener("abort", onAbort);
+            controller.abort();
+            await messages.return?.();
+            if (ws.readyState === external_ws_default().OPEN) {
+                if (repl) ws.send(JSON.stringify({
+                    id: nextId++,
+                    cmd: "TERMINATE_REPL",
+                    repl
+                }), ()=>{});
+                ws.close();
+            } else if (ws.readyState === external_ws_default().CONNECTING) ws.terminate();
+            if (ws.readyState !== external_ws_default().CLOSED) {
+                closeTimeout = setTimeout(()=>ws.terminate(), 1000);
+                closeTimeout.unref();
+            }
+        }
+    }
+    function writeJsonReplOutput(output) {
+        process.stdout.write(JSON.stringify({
+            type: "repl_output",
+            output,
+            timestamp: new Date().toISOString()
+        }) + "\n");
+    }
+    function registerReplCommand(program) {
+        if ("1" !== process.env.ANVIL_AGENT_HOST) return;
+        addAppAccountOptions(program.command("repl <code>")).description("Run Python in a fresh server REPL for the current environment; use - to read stdin").addHelpText("after", `
+Examples:
+  anvil repl '1 + 2'
+  anvil --json repl '1 + 2'
+  anvil repl - < script.py
+`).action(async (code, options)=>{
+            const controller = new AbortController();
+            const onInterrupt = ()=>controller.abort();
+            try {
+                const { appId, envPid, anvilUrl, username } = await resolveEnvironmentContext(appAccountOptions(options));
+                if ("-" === code) {
+                    const chunks = [];
+                    for await (const chunk of process.stdin)chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                    code = Buffer.concat(chunks).toString("utf8");
+                }
+                process.on("SIGINT", onInterrupt);
+                const response = await runRepl(appId, envPid, {
+                    code,
+                    anvilUrl,
+                    username,
+                    signal: controller.signal,
+                    onOutput: getGlobalOutputConfig().jsonMode ? writeJsonReplOutput : (output)=>{
+                        process.stdout.write(output);
+                    }
+                });
+                const error = response.error;
+                const message = error ? `${error.type ? `${error.type}: ` : ""}${error.message}` : void 0;
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(!error, {
+                    data: response,
+                    error: message
+                });
+                else if (error) {
+                    process.stderr.write(`${message}\n`);
+                    for (const [file, line] of error.trace ?? [])process.stderr.write(`  at ${file}:${line}\n`);
+                }
+                if (error) process.exitCode = 1;
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
+                process.exitCode = controller.signal.aborted ? 130 : 1;
+            } finally{
+                process.removeListener("SIGINT", onInterrupt);
             }
         });
     }
-    async function resolvePrimaryAppId(projectRoot, anvilUrl) {
-        const remoteCandidates = await detectAppIdsFromAllRemotes(projectRoot);
-        if (remoteCandidates.length > 0) return remoteCandidates[0].appId;
-        const lookupCandidates = await detectAppIdsByCommitLookup(projectRoot, {
-            anvilUrl,
-            includeRemotes: false
+    const external_yaml_namespaceObject = require("yaml");
+    async function encryptSecret(appId, secretName, options = {}) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${encodeURIComponent(appId)}/secrets/encrypt`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                name: secretName,
+                ...void 0 === options.secret ? {} : {
+                    secret: options.secret
+                }
+            })
         });
-        return lookupCandidates[0]?.appId ?? null;
+        if (!response.ok) throw new Error(formatHttpError("Failed to set secret", response.status, await response.text()));
+        return await response.json();
     }
-    function registerDepsCommand(program) {
-        const deps = program.command("deps").description("Manage app dependencies");
-        deps.command("fetch").description("Fetch dependencies into .anvil/deps/").option("--commit <commit>", "Fetch deps at specific commit").option("--exclude-docs", "Exclude dependency docs from .anvil/deps/").action(async (options)=>{
+    async function generateSecretKey(appId, keyName, options = {}) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const response = await fetch(`${anvilUrl}/ide/api/_/apps/${encodeURIComponent(appId)}/secrets/generate-key`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                name: keyName
+            })
+        });
+        if (!response.ok) throw new Error(formatHttpError("Failed to generate key", response.status, await response.text()));
+        return await response.json();
+    }
+    function secret_anvilYamlPath(projectRoot) {
+        return external_path_default().join(projectRoot, "anvil.yaml");
+    }
+    function checkSecretTypeInDoc(doc, secretName, type) {
+        const existingType = doc.getIn([
+            "secrets",
+            secretName,
+            "type"
+        ]);
+        if (void 0 !== existingType && existingType !== type) throw new Error(`'${secretName}' is a ${existingType} in anvil.yaml, not a ${type}`);
+    }
+    function secretExistsInDoc(doc, secretName, appId) {
+        return doc.hasIn([
+            "secrets",
+            secretName,
+            "value",
+            appId
+        ]);
+    }
+    async function findSecretInAnvilYaml(projectRoot, secretName, appId) {
+        const doc = (0, external_yaml_namespaceObject.parseDocument)(await external_fs_.promises.readFile(secret_anvilYamlPath(projectRoot), "utf8"));
+        if (!doc.hasIn([
+            "secrets",
+            secretName
+        ])) return;
+        return {
+            type: doc.getIn([
+                "secrets",
+                secretName,
+                "type"
+            ]),
+            existsForApp: secretExistsInDoc(doc, secretName, appId)
+        };
+    }
+    async function writeSecretToAnvilYaml(projectRoot, secretName, options) {
+        const { appId, encrypted, overwrite, type } = options;
+        const filePath = secret_anvilYamlPath(projectRoot);
+        const doc = (0, external_yaml_namespaceObject.parseDocument)(await external_fs_.promises.readFile(filePath, "utf8"));
+        checkSecretTypeInDoc(doc, secretName, type);
+        if (secretExistsInDoc(doc, secretName, appId)) {
+            if (!overwrite) throw new Error(`'${secretName}' already exists for app ${appId} in anvil.yaml`);
+            if (!doc.hasIn([
+                "secrets",
+                secretName,
+                "value",
+                appId,
+                "all"
+            ])) throw new Error(`'${secretName}' for app ${appId} in anvil.yaml cannot be overridden`);
+        }
+        if (doc.hasIn([
+            "secrets",
+            secretName
+        ])) {
+            if (!(0, external_yaml_namespaceObject.isMap)(doc.getIn([
+                "secrets",
+                secretName,
+                "value"
+            ]))) doc.setIn([
+                "secrets",
+                secretName,
+                "value"
+            ], doc.createNode({}));
+        } else doc.setIn([
+            "secrets",
+            secretName
+        ], doc.createNode({
+            type,
+            value: {}
+        }));
+        const value = new external_yaml_namespaceObject.Scalar(encrypted);
+        value.type = external_yaml_namespaceObject.Scalar.QUOTE_DOUBLE;
+        if ((0, external_yaml_namespaceObject.isMap)(doc.getIn([
+            "secrets",
+            secretName,
+            "value",
+            appId
+        ]))) doc.setIn([
+            "secrets",
+            secretName,
+            "value",
+            appId,
+            "all"
+        ], value);
+        else doc.setIn([
+            "secrets",
+            secretName,
+            "value",
+            appId
+        ], doc.createNode({
+            all: value
+        }, {
+            flow: true
+        }));
+        await external_fs_.promises.writeFile(filePath, doc.toString(), "utf8");
+    }
+    function registerSecretCommand(program) {
+        if ("1" !== process.env.ANVIL_AGENT_HOST) return;
+        const secret = program.command("secret").description("Manage app secrets");
+        addAppAccountOptions(secret.command("set")).description("Set an app secret. The value is read from stdin, or prompted for if stdin is a terminal.").argument("<name>", "Name of the secret").option("--generate", "Have the server autogenerate the secret value instead of reading it").option("-f, --force", "Overwrite the secret if it is already set for this app").action(async (name, options)=>{
             try {
                 const projectRoot = process.cwd();
-                const anvilUrl = resolveAnvilUrl();
-                const mainAppId = await resolvePrimaryAppId(projectRoot, anvilUrl);
-                if (!mainAppId) {
-                    logger_logger.error("No Anvil app found in current directory");
-                    logger_logger.info("Make sure you're in a directory with an Anvil app git remote.");
-                    process.exit(1);
-                }
-                logger_logger.info(`Fetching dependencies for app ${mainAppId}...`);
-                const { response, addedGitignoreEntry } = await refreshDependencyCache(projectRoot, mainAppId, anvilUrl, {
-                    commit: options.commit,
-                    includeDocs: !options.excludeDocs
+                const { appId, anvilUrl, username } = await resolveAppAccount(projectRoot, appAccountOptions(options));
+                const overwrite = await confirmOverwriteIfExists(projectRoot, name, {
+                    appId,
+                    type: "secret",
+                    force: options.force
                 });
-                if (!response.resolved_dependencies.length) return void logger_logger.info("No dependencies to fetch");
-                if (addedGitignoreEntry) logger_logger.info("Added /.anvil/ to .gitignore");
-                if (!response.dependencies.length) return void logger_logger.success(`Dependencies already up to date (${response.resolved_dependencies.length} cached)`);
-                logger_logger.success(`Fetched ${response.dependencies.length} dependencies:`);
-                for (const dep of response.dependencies)logger_logger.info(`  - ${dep.package_name}`);
-            } catch (e) {
-                logger_logger.error(e.message);
-                process.exit(1);
-            }
-        });
-        deps.command("status").description("Show cached dependencies").action(async ()=>{
-            try {
-                const cached = await getCachedPackages(process.cwd());
-                if (!cached.length) return void logger_logger.info("No cached dependencies (run 'anvil deps fetch')");
-                logger_logger.info("Cached dependencies:");
-                for (const pkg of cached)logger_logger.info(`  - ${pkg}`);
-            } catch (e) {
-                logger_logger.error(e.message);
+                const value = options.generate ? void 0 : await readSecretValue(name);
+                const response = await encryptSecret(appId, name, {
+                    anvilUrl,
+                    username,
+                    secret: value
+                });
+                await writeSecretToAnvilYaml(projectRoot, name, {
+                    appId,
+                    encrypted: response.encrypted,
+                    overwrite,
+                    type: "secret"
+                });
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: {
+                        encrypted: response.encrypted
+                    }
+                });
+                else logger_logger.info(`Secret '${name}' written to anvil.yaml`);
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
                 process.exit(1);
             }
         });
-        deps.command("clear").description("Clear cached dependencies").action(async ()=>{
+        addAppAccountOptions(secret.command("generate-key")).description("Generate an app encryption key. The key is always generated by the server, and its value is never shown.").argument("<name>", "Name of the key").option("-f, --force", "Replace the key if it is already set for this app").action(async (name, options)=>{
             try {
-                await clearDepsCache(process.cwd());
-                logger_logger.success("Cleared .anvil/deps/");
-            } catch (e) {
-                logger_logger.error(e.message);
+                const projectRoot = process.cwd();
+                const { appId, anvilUrl, username } = await resolveAppAccount(projectRoot, appAccountOptions(options));
+                const overwrite = await confirmOverwriteIfExists(projectRoot, name, {
+                    appId,
+                    type: "key",
+                    force: options.force
+                });
+                const response = await generateSecretKey(appId, name, {
+                    anvilUrl,
+                    username
+                });
+                await writeSecretToAnvilYaml(projectRoot, name, {
+                    appId,
+                    encrypted: response.encrypted,
+                    overwrite,
+                    type: "key"
+                });
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(true, {
+                    data: {
+                        encrypted: response.encrypted
+                    }
+                });
+                else logger_logger.info(`Key '${name}' written to anvil.yaml`);
+            } catch (error) {
+                const message = errors_getErrorMessage(error);
+                if (getGlobalOutputConfig().jsonMode) logJsonResult(false, {
+                    error: message
+                });
+                else logger_logger.error(message);
                 process.exit(1);
             }
         });
     }
-    const TABLE_MAPPINGS_PATH = ".anvil/table-mappings.json";
-    function tables_formatFetchError(prefix, status, errorBody) {
-        if (!errorBody) return `${prefix}: ${status}`;
-        try {
-            const parsed = JSON.parse(errorBody);
-            if ("string" == typeof parsed.error && parsed.error.trim()) return `${prefix}: ${parsed.error} (${status})`;
-        } catch  {}
-        return `${prefix}: ${status} ${errorBody}`;
+    async function confirmOverwriteIfExists(projectRoot, name, options) {
+        const { appId, type, force = false } = options;
+        const existing = await findSecretInAnvilYaml(projectRoot, name, appId);
+        if (existing?.type && existing.type !== type) throw new Error(`'${name}' is a ${existing.type} in anvil.yaml, not a ${type}`);
+        if (!existing?.existsForApp) return false;
+        if (force) return true;
+        const message = `'${name}' already exists for app ${appId} in anvil.yaml`;
+        if (!process.stdin.isTTY) throw new Error(`${message}. Use --force to overwrite it.`);
+        if (!await logger_logger.confirm(`${message}. Overwrite it?`, false)) throw new Error(`Not overwriting '${name}'`);
+        return true;
     }
-    async function fetchTableMappings(appId, anvilUrl = resolveAnvilUrl()) {
-        const token = await auth_getValidAuthToken(anvilUrl);
-        const resp = await fetch(`${anvilUrl}/ide/api/_/apps/${appId}/db`, {
+    async function readSecretValue(name) {
+        if (process.stdin.isTTY) {
+            const { secret } = await logger_logger.prompt([
+                {
+                    type: "password",
+                    name: "secret",
+                    message: `Value for secret '${name}':`
+                }
+            ]);
+            if (!secret) throw new Error("No secret value entered");
+            return secret;
+        }
+        {
+            const chunks = [];
+            for await (const chunk of process.stdin)chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            const secret = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+            if (!secret) throw new Error("No secret value received on stdin");
+            return secret;
+        }
+    }
+    const REORDER_WAIT_MS = 200;
+    const LATE_OUTPUT_QUIET_MS = 500;
+    const LATE_OUTPUT_MAX_MS = 3000;
+    const CANCEL_WAIT_MS = 5000;
+    class ServerTestsError extends Error {
+    }
+    class InterruptedError extends Error {
+    }
+    function serverErrorMessage(error) {
+        if (error && "object" == typeof error) {
+            const value = error;
+            return String(value.message ?? value["anvil/server-error"] ?? JSON.stringify(value));
+        }
+        return String(error);
+    }
+    class OrderedLog {
+        write;
+        nextSeq = 1;
+        held = new Map();
+        timer;
+        constructor(write){
+            this.write = write;
+        }
+        add(seq, text) {
+            if ("number" != typeof seq || seq < this.nextSeq) return void this.write(text);
+            this.held.set(seq, text);
+            while(this.held.has(this.nextSeq)){
+                const next = this.held.get(this.nextSeq);
+                this.held.delete(this.nextSeq);
+                this.nextSeq++;
+                this.write(next);
+            }
+            if (0 === this.held.size) {
+                clearTimeout(this.timer);
+                this.timer = void 0;
+            } else this.timer ??= setTimeout(()=>{
+                this.timer = void 0;
+                this.flush();
+            }, REORDER_WAIT_MS);
+        }
+        flush() {
+            clearTimeout(this.timer);
+            this.timer = void 0;
+            for (const seq of [
+                ...this.held.keys()
+            ].sort((a, b)=>a - b)){
+                this.write(this.held.get(seq));
+                this.nextSeq = seq + 1;
+            }
+            this.held.clear();
+        }
+    }
+    async function runServerTests(appId, options) {
+        const anvilUrl = options.anvilUrl ?? await resolveAuthAnvilUrl();
+        const token = await auth_getValidAuthToken(anvilUrl, options.username);
+        const url = new URL(`${anvilUrl.replace(/\/$/, "")}/ide/api/_/apps/${encodeURIComponent(appId)}/ws`);
+        url.protocol = "https:" === url.protocol ? "wss:" : "ws:";
+        if (options.signal?.aborted) throw new InterruptedError("Interrupted.");
+        const ws = new (external_ws_default())(url, {
             headers: {
                 Authorization: `Bearer ${token}`
-            }
+            },
+            handshakeTimeout: 30000
         });
-        if (!resp.ok) {
-            const errorBody = await resp.text();
-            throw new Error(tables_formatFetchError("Failed to fetch table mappings", resp.status, errorBody));
+        const controller = new AbortController();
+        const replies = new Map();
+        let nextId = 1;
+        let runId;
+        let sessionId;
+        let launchMessage = "";
+        let cancelId;
+        let keepalive;
+        let pongTimeout;
+        let closeTimeout;
+        const unmatchedLogs = new Map();
+        const runLog = new OrderedLog((text)=>{
+            if (text) options.onOutput?.(text);
+        });
+        let onRunLogEvent;
+        const fail = (error)=>controller.abort(error);
+        const connectionLost = (detail)=>runId ? new Error(`Lost connection to Anvil. The test run (${runId}) may still be running.`) : new Error(`Lost connection to Anvil (${detail}).`);
+        const markResponsive = ()=>{
+            clearTimeout(pongTimeout);
+            pongTimeout = void 0;
+        };
+        function addRunLog(message) {
+            runLog.add(message.seq, "print" === message.type && "string" == typeof message.log_text ? message.log_text : void 0);
+        }
+        function setSession(id) {
+            if (sessionId || "string" != typeof id || !id) return;
+            sessionId = id;
+            for (const message of unmatchedLogs.get(id) ?? [])addRunLog(message);
+            unmatchedLogs.clear();
+        }
+        function handleMessage(raw) {
+            markResponsive();
+            let message;
+            try {
+                message = JSON.parse(raw.toString());
+                if (!message || "object" != typeof message || Array.isArray(message)) throw new Error("Expected an object");
+            } catch  {
+                fail(new Error("Invalid message from Anvil."));
+                return;
+            }
+            if ("number" == typeof message.id) {
+                if (message.error && message.id !== cancelId) return void fail(new ServerTestsError(serverErrorMessage(message.error)));
+                const resolve = replies.get(message.id);
+                replies.delete(message.id);
+                resolve?.(message);
+                return;
+            }
+            switch(message.event){
+                case "LOG_EVENT":
+                    if ("string" != typeof message.session_id) return;
+                    if (sessionId) {
+                        if (message.session_id !== sessionId) return;
+                        addRunLog(message);
+                        onRunLogEvent?.();
+                    } else {
+                        const logs = unmatchedLogs.get(message.session_id) ?? [];
+                        logs.push(message);
+                        unmatchedLogs.set(message.session_id, logs);
+                    }
+                    return;
+                case "TEST_EVENT":
+                    {
+                        if (!runId || message.run_id !== runId) return;
+                        setSession(message.session_id);
+                        const testEvent = message.test_event;
+                        if (testEvent?.type === "test_run_update" && "string" == typeof testEvent.launch_message) {
+                            const text = testEvent.launch_message;
+                            const added = text.startsWith(launchMessage) ? text.slice(launchMessage.length) : text;
+                            launchMessage = text;
+                            if (added) options.onLaunchMessage?.(added);
+                        }
+                        return;
+                    }
+            }
+        }
+        function send(message) {
+            const id = nextId++;
+            ws.send(JSON.stringify({
+                id,
+                ...message
+            }), (error)=>{
+                if (error) fail(connectionLost(`send failed: ${error.message}`));
+            });
+            return id;
+        }
+        function reply(id) {
+            const signal = controller.signal;
+            return new Promise((resolve, reject)=>{
+                if (signal.aborted) return void reject(signal.reason);
+                const onAbort = ()=>{
+                    replies.delete(id);
+                    reject(signal.reason);
+                };
+                signal.addEventListener("abort", onAbort, {
+                    once: true
+                });
+                replies.set(id, (message)=>{
+                    signal.removeEventListener("abort", onAbort);
+                    resolve(message);
+                });
+            });
         }
-        const databases = await resp.json();
-        const allTables = [];
-        for (const db of databases)for (const table of db.tables || [])allTables.push({
-            table_id: table.id,
-            python_name: table.python_name,
-            name: table.name
+        const request = (message)=>reply(send(message));
+        async function cancel(waited) {
+            let cancelTimeout;
+            let confirmed = false;
+            try {
+                cancelId = send({
+                    cmd: "CANCEL_SERVER_TEST_RUN",
+                    run_id: runId
+                });
+                const answer = await Promise.race([
+                    reply(cancelId),
+                    waited,
+                    new Promise((_, reject)=>{
+                        cancelTimeout = setTimeout(()=>reject(new Error("Timed out")), CANCEL_WAIT_MS);
+                    })
+                ]);
+                confirmed = !answer.error;
+            } catch  {} finally{
+                clearTimeout(cancelTimeout);
+            }
+            runLog.flush();
+            throw new InterruptedError(confirmed ? `Cancelled the test run (${runId}).` : `Couldn't confirm that the test run (${runId}) was cancelled. It may still be running.`);
+        }
+        async function readLateOutput() {
+            await new Promise((resolve)=>{
+                let quietTimeout;
+                const done = ()=>{
+                    clearTimeout(quietTimeout);
+                    clearTimeout(maxTimeout);
+                    onRunLogEvent = void 0;
+                    controller.signal.removeEventListener("abort", done);
+                    options.signal?.removeEventListener("abort", done);
+                    resolve();
+                };
+                const resetQuiet = ()=>{
+                    clearTimeout(quietTimeout);
+                    quietTimeout = setTimeout(done, LATE_OUTPUT_QUIET_MS);
+                };
+                const maxTimeout = setTimeout(done, LATE_OUTPUT_MAX_MS);
+                onRunLogEvent = resetQuiet;
+                resetQuiet();
+                controller.signal.addEventListener("abort", done, {
+                    once: true
+                });
+                options.signal?.addEventListener("abort", done, {
+                    once: true
+                });
+            });
+            runLog.flush();
+        }
+        const onAbort = ()=>fail(new InterruptedError("Interrupted."));
+        ws.on("pong", markResponsive);
+        ws.on("unexpected-response", (request, response)=>{
+            response.resume();
+            fail(new Error(`Couldn't connect to Anvil (${response.statusCode} ${response.statusMessage}).`));
+            request.destroy();
         });
-        return {
-            tables: allTables
-        };
-    }
-    async function writeTableMappings(projectRoot, mappings) {
-        const filePath = external_path_default().join(projectRoot, TABLE_MAPPINGS_PATH);
-        await promises_default().mkdir(external_path_default().dirname(filePath), {
-            recursive: true
+        ws.on("error", (error)=>fail(connectionLost(error.message)));
+        ws.on("close", (code, reason)=>{
+            clearTimeout(closeTimeout);
+            fail(connectionLost(`code ${code}${reason.length ? `: ${reason}` : ""}`));
         });
-        await promises_default().writeFile(filePath, JSON.stringify(mappings, null, 2));
+        ws.on("message", handleMessage);
+        try {
+            options.signal?.addEventListener("abort", onAbort, {
+                once: true
+            });
+            await new Promise((resolve, reject)=>{
+                ws.once("open", ()=>resolve());
+                controller.signal.addEventListener("abort", ()=>reject(controller.signal.reason), {
+                    once: true
+                });
+            });
+            keepalive = setInterval(()=>{
+                pongTimeout ??= setTimeout(()=>fail(connectionLost("heartbeat timed out")), 10000);
+                ws.ping();
+            }, 20000);
+            await request({
+                cmd: "WATCH_APP",
+                app: appId,
+                only_branch: options.branch
+            });
+            const launched = await request({
+                cmd: "RUN_SERVER_TESTS",
+                commit_id: options.commitId,
+                ...options.selection ? {
+                    selection: options.selection
+                } : {},
+                ...options.collectOnly ? {
+                    collect_only: true
+                } : {}
+            });
+            if ("string" != typeof launched.run_id || !launched.run_id) throw new Error("Invalid response from Anvil: missing test run ID.");
+            runId = launched.run_id;
+            options.onRunCreated?.(runId);
+            options.signal?.removeEventListener("abort", onAbort);
+            const interrupted = new Promise((resolve)=>{
+                if (options.signal?.aborted) resolve();
+                options.signal?.addEventListener("abort", ()=>resolve(), {
+                    once: true
+                });
+            });
+            const watchId = send({
+                cmd: "WATCH_APP",
+                app: appId,
+                only_branch: options.branch,
+                test_run_ids: [
+                    runId
+                ]
+            });
+            const waitId = send({
+                cmd: "WAIT_FOR_SERVER_TEST_RUN",
+                run_id: runId
+            });
+            reply(watchId).catch(()=>{});
+            const waited = reply(waitId);
+            const done = await Promise.race([
+                waited,
+                interrupted.then(()=>void 0)
+            ]);
+            if (!done) return await cancel(waited);
+            setSession(done.session_id);
+            if (!sessionId) unmatchedLogs.clear();
+            await readLateOutput();
+            return {
+                runId,
+                ...sessionId ? {
+                    sessionId
+                } : {},
+                state: done.state ?? {}
+            };
+        } catch (error) {
+            if (error instanceof InterruptedError) throw error;
+            const failure = controller.signal.aborted ? controller.signal.reason : error;
+            throw failure instanceof Error ? failure : new Error(String(failure));
+        } finally{
+            clearInterval(keepalive);
+            clearTimeout(pongTimeout);
+            runLog.flush();
+            options.signal?.removeEventListener("abort", onAbort);
+            controller.abort();
+            if (ws.readyState === external_ws_default().OPEN) ws.close();
+            else if (ws.readyState === external_ws_default().CONNECTING) ws.terminate();
+            if (ws.readyState !== external_ws_default().CLOSED) {
+                closeTimeout = setTimeout(()=>ws.terminate(), 1000);
+                closeTimeout.unref();
+            }
+        }
+    }
+    const PYTEST_EXIT_CODES = {
+        OK: 0,
+        TESTS_FAILED: 1,
+        INTERRUPTED: 2,
+        INTERNAL_ERROR: 3,
+        USAGE_ERROR: 4,
+        NO_TESTS_COLLECTED: 5
+    };
+    class UsageError extends Error {
+    }
+    function toServerTestTarget(target, options) {
+        const separator = target.indexOf("::");
+        const targetPath = -1 === separator ? target : target.slice(0, separator);
+        const suffix = -1 === separator ? "" : target.slice(separator);
+        const absolutePath = external_path_default().resolve(options.cwd, targetPath);
+        const serverTestsPath = external_path_default().relative(external_path_default().join(options.appRoot, "tests", "server_tests"), absolutePath);
+        if (external_path_default().isAbsolute(serverTestsPath) || ".." === serverTestsPath || serverTestsPath.startsWith(`..${external_path_default().sep}`)) throw new UsageError(`${target} isn't in tests/server_tests.`);
+        return external_path_default().relative(external_path_default().join(options.appRoot, "tests"), absolutePath).split(external_path_default().sep).join("/") + suffix;
+    }
+    async function checkCommitOnAnvil(git, options) {
+        const notOnAnvil = ()=>new Error(`Commit ${options.commitId.slice(0, 7)} isn't on Anvil. Push ${options.branch} first.`);
+        try {
+            await git.fetch(options.fetchUrl, `refs/heads/${options.branch}`);
+        } catch (error) {
+            const message = errors_getErrorMessage(error);
+            if (/couldn't find remote ref/i.test(message)) throw notOnAnvil();
+            throw new Error(message.replace(/\/\/git:[^@\s]*@/g, "//git:***@"));
+        }
+        if (!await git.isAncestor(options.commitId, "FETCH_HEAD")) throw notOnAnvil();
     }
-    async function readTableMappings(projectRoot) {
-        const filePath = external_path_default().join(projectRoot, TABLE_MAPPINGS_PATH);
+    async function getBranch(git) {
         try {
-            const content = await promises_default().readFile(filePath, "utf-8");
-            return JSON.parse(content);
+            return await git.getCurrentBranch();
         } catch  {
-            return null;
+            throw new Error("HEAD isn't on a branch. Check out the branch you've pushed to Anvil.");
         }
     }
-    async function clearTableMappings(projectRoot) {
-        const filePath = external_path_default().join(projectRoot, TABLE_MAPPINGS_PATH);
-        await promises_default().rm(filePath, {
-            force: true
-        });
-    }
-    function registerTablesCommand(program) {
-        const tables = program.command("tables").description("Manage table mappings");
-        tables.command("fetch").description("Fetch table mappings into .anvil/table-mappings.json").action(async ()=>{
-            try {
-                const projectRoot = process.cwd();
-                const anvilUrl = resolveAnvilUrl();
-                const mainAppId = await resolvePrimaryAppId(projectRoot, anvilUrl);
-                if (!mainAppId) {
-                    logger_logger.error("No Anvil app found in current directory");
-                    logger_logger.info("Make sure you're in a directory with an Anvil app git remote.");
-                    process.exit(1);
-                }
-                logger_logger.info("Fetching table mappings...");
-                const response = await fetchTableMappings(mainAppId, anvilUrl);
-                if (!response.tables.length) return void logger_logger.info("No tables found");
-                if (await ensureProjectGitignoreIgnoresAnvilDir(projectRoot)) logger_logger.info("Added /.anvil/ to .gitignore");
-                await writeTableMappings(projectRoot, response);
-                logger_logger.success(`Fetched ${response.tables.length} table mappings`);
-            } catch (e) {
-                logger_logger.error(e.message);
-                process.exit(1);
-            }
-        });
-        tables.command("status").description("Show cached table mappings").action(async ()=>{
+    async function runTestCommand(targets, options) {
+        const jsonMode = getGlobalOutputConfig().jsonMode;
+        const controller = new AbortController();
+        let runId;
+        let interrupted = false;
+        let outputEndsLine = true;
+        const writeOutput = (text)=>{
+            process.stdout.write(text);
+            outputEndsLine = text.endsWith("\n");
+        };
+        const writeJsonResult = (...args)=>{
+            if (!outputEndsLine) writeOutput("\n");
+            logJsonResult(...args);
+        };
+        const onInterrupt = ()=>{
+            if (interrupted) process.exit(130);
+            interrupted = true;
+            if (runId) process.stderr.write("\nCancelling test run...\n");
+            controller.abort();
+        };
+        try {
+            const projectRoot = process.cwd();
+            const git = new GitService(projectRoot);
+            let appRoot;
             try {
-                const mappings = await readTableMappings(process.cwd());
-                if (!mappings || !mappings.tables.length) return void logger_logger.info("No cached table mappings (run 'anvil tables fetch')");
-                logger_logger.info("Cached table mappings:");
-                for (const t of mappings.tables)logger_logger.info(`  ${t.python_name} (${t.name}) - ID: ${t.table_id}`);
-            } catch (e) {
-                logger_logger.error(e.message);
-                process.exit(1);
+                appRoot = external_path_default().resolve(projectRoot, (await git.getGit().revparse([
+                    "--show-cdup"
+                ])).trim());
+            } catch  {
+                throw new Error("No Anvil app found in current directory. Make sure you're in a directory with an Anvil app git remote.");
             }
-        });
-        tables.command("clear").description("Clear cached table mappings").action(async ()=>{
-            try {
-                await clearTableMappings(process.cwd());
-                logger_logger.success("Cleared .anvil/table-mappings.json");
-            } catch (e) {
-                logger_logger.error(e.message);
-                process.exit(1);
+            const testTargets = targets.map((target)=>toServerTestTarget(target, {
+                    appRoot,
+                    cwd: projectRoot
+                }));
+            const selection = {
+                ...testTargets.length > 0 ? {
+                    test_targets: testTargets
+                } : {},
+                ...void 0 !== options.k ? {
+                    keyword_expression: options.k
+                } : {}
+            };
+            const { appId, anvilUrl, username } = await resolveAppAccount(projectRoot, appAccountOptions(options));
+            const branch = await getBranch(git);
+            const commitId = await git.getCommitId();
+            const authToken = await auth_getValidAuthToken(anvilUrl, username);
+            await checkCommitOnAnvil(git, {
+                fetchUrl: getGitFetchUrl(appId, authToken, anvilUrl),
+                branch,
+                commitId
+            });
+            if (await git.hasUncommittedChanges()) process.stderr.write(`You have uncommitted changes, which won't be included in the test run.\n`);
+            process.on("SIGINT", onInterrupt);
+            const { runId: completedRunId, state } = await runServerTests(appId, {
+                commitId,
+                branch,
+                ...Object.keys(selection).length > 0 ? {
+                    selection
+                } : {},
+                collectOnly: options.collectOnly,
+                anvilUrl,
+                username,
+                signal: controller.signal,
+                onOutput: writeOutput,
+                onLaunchMessage: (text)=>{
+                    process.stderr.write(text);
+                },
+                onRunCreated: (id)=>{
+                    runId = id;
+                }
+            });
+            const exitCode = state.exit_code ? PYTEST_EXIT_CODES[state.exit_code] ?? 1 : 1;
+            if (state.error?.message) process.stderr.write(`${state.error.message}\n`);
+            else if (!state.exit_code) process.stderr.write("The test run ended without a result.\n");
+            if (jsonMode) {
+                let snapshot;
+                try {
+                    snapshot = await getTestRunSnapshot(appId, completedRunId, {
+                        anvilUrl,
+                        username
+                    });
+                } catch (error) {
+                    writeJsonResult(false, {
+                        error: errors_getErrorMessage(error)
+                    });
+                    process.exitCode = 1;
+                    return;
+                }
+                const success = "OK" === state.exit_code || !!options.collectOnly && "NO_TESTS_COLLECTED" === state.exit_code;
+                writeJsonResult(success, {
+                    data: snapshot
+                });
             }
+            process.exitCode = exitCode;
+        } catch (error) {
+            const message = errors_getErrorMessage(error);
+            if (jsonMode) writeJsonResult(false, {
+                error: message
+            });
+            else process.stderr.write(`${message}\n`);
+            process.exitCode = controller.signal.aborted ? 130 : error instanceof UsageError ? PYTEST_EXIT_CODES.USAGE_ERROR : 1;
+        } finally{
+            process.removeListener("SIGINT", onInterrupt);
+        }
+    }
+    function registerTestCommand(program) {
+        addAppAccountOptions(program.command("test")).description("Run the app's tests on Anvil, against the commit you have checked out").argument("[targets...]", "Test paths or pytest node IDs, relative to your current directory").option("-k <expression>", "Only run tests that match the pytest keyword expression").option("--collect-only", "List the tests without running them").addHelpText("after", `
+The commit you have checked out must already be pushed to Anvil.
+The exit code is the same as pytest: 0 if every test passed, 1 if any failed.
+
+Examples:
+  anvil test
+  anvil test tests/server_tests/test_orders.py::test_refund
+  anvil test -k "login and not slow"
+  anvil --json test
+`).action(async (targets, options)=>{
+            await runTestCommand(targets, options);
         });
     }
     const program_packageJson = JSON.parse((0, external_fs_.readFileSync)((0, external_path_namespaceObject.join)(__dirname, "../package.json"), "utf-8"));
@@ -23927,6 +25472,7 @@ print(json.dumps({"issues": issues}))
         });
         const watchCommand = registerWatchCommand(program);
         registerCheckoutCommand(program);
+        registerCreateCommand(program);
         registerGitAuthCommand(program);
         registerGitCredentialCommand(program);
         registerLoginCommand(program);
@@ -23936,7 +25482,11 @@ print(json.dumps({"issues": issues}))
         registerVersionCommand(program, VERSION);
         registerConfigureCommand(program, VERSION);
         registerDepsCommand(program);
-        registerTablesCommand(program);
+        registerDbCommand(program);
+        registerEnvCommand(program);
+        registerReplCommand(program);
+        registerSecretCommand(program);
+        registerTestCommand(program);
         program.command("update").description("Update anvil to the latest version").alias("u").action(async ()=>{
             await handleUpdateCommand();
         });