@bigcommerce/catalyst 1.0.0-alpha.4 → 1.0.0-alpha.5

package/dist/cli.js

@@ -1,5 +1,20 @@
 #!/usr/bin/env node
 
+// src/cli/lib/auth-errors.ts
+var UnauthorizedError = class extends Error {
+  constructor() {
+    super(
+      "Your access token is invalid or has expired.\nRun `catalyst auth login` to re-authenticate."
+    );
+    this.name = "UnauthorizedError";
+  }
+};
+function assertAuthorized(response) {
+  if (response.status === 401) {
+    throw new UnauthorizedError();
+  }
+}
+
 // src/cli/lib/logger.ts
 import { createConsola } from "consola";
 var consola = createConsola({
@@ -13,7 +28,7 @@ import { randomBytes, randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@bigcommerce/catalyst",
-  version: "1.0.0-alpha.4",
+  version: "1.0.0-alpha.5",
   type: "module",
   bin: {
     catalyst: "dist/cli.js"
@@ -113,7 +128,7 @@ var Telemetry = class {
     this.correlationId = randomUUID();
     this.startTime = Date.now();
     this.analytics = new Analytics({
-      writeKey: "OCkxLj3KTc1N3ebEbnFBqbhxfE3tVb3Z"
+      writeKey: "not-a-valid-segment-write-key"
     });
   }
   durationMs() {
@@ -180,19 +195,23 @@ function getTelemetry() {
 }
 
 // src/cli/program.ts
-import { Option as Option8 } from "@commander-js/extra-typings";
-import { Command as Command10 } from "commander";
-import { colorize as colorize9 } from "consola/utils";
+import { Option as Option9 } from "@commander-js/extra-typings";
+import { Command as Command12 } from "commander";
+import { colorize as colorize8 } from "consola/utils";
 import { config } from "dotenv";
 import { existsSync as existsSync5 } from "fs";
 import { resolve } from "path";
 
 // src/cli/commands/auth.ts
-import { Command, Option } from "commander";
+import { Command, Option as Option2 } from "commander";
+import { z as z4 } from "zod";
+
+// src/cli/lib/login.ts
+import { password } from "@inquirer/prompts";
 import { colorize } from "consola/utils";
 import open from "open";
 import yoctoSpinner from "yocto-spinner";
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/cli/lib/auth.ts
 import { z } from "zod";
@@ -201,7 +220,8 @@ var DEVICE_OAUTH_SCOPES = [
   "store_v2_information",
   "store_infrastructure_deployments_manage",
   "store_infrastructure_logs_read_only",
-  "store_infrastructure_projects_manage"
+  "store_infrastructure_projects_manage",
+  "store_channel_settings"
 ].join(" ");
 var DEFAULT_LOGIN_URL = "https://login.bigcommerce.com";
 var DeviceCodeResponseSchema = z.object({
@@ -258,19 +278,119 @@ async function waitForDeviceToken(loginUrl, deviceCode, interval) {
   return waitForDeviceToken(loginUrl, deviceCode, interval);
 }
 
+// src/cli/lib/login.ts
+var LoginAbortedError = class extends Error {
+  constructor() {
+    super("Login aborted by user.");
+    this.name = "LoginAbortedError";
+  }
+};
+var StoreProfileSchema = z2.object({
+  data: z2.object({
+    store_name: z2.string()
+  })
+});
+async function fetchStoreProfile(storeHash, accessToken, apiHost) {
+  const response = await fetch(`https://${apiHost}/stores/${storeHash}/v3/settings/store/profile`, {
+    method: "GET",
+    headers: {
+      "X-Auth-Token": accessToken,
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}`);
+  }
+  const res = await response.json();
+  const result = StoreProfileSchema.safeParse(res);
+  if (!result.success) {
+    throw new Error("Unexpected response from store profile API");
+  }
+  return result.data.data;
+}
+async function deviceCodeLogin(loginUrl) {
+  const deviceCode = await requestDeviceCode(loginUrl);
+  consola.info(
+    `${colorize("yellow", "Your one-time code:")} ${colorize("bold", deviceCode.user_code)}`
+  );
+  try {
+    await open(deviceCode.verification_uri);
+    consola.info(`Opened ${deviceCode.verification_uri} in your browser.`);
+  } catch {
+    consola.info(`Open ${deviceCode.verification_uri} in your browser and enter the code above.`);
+  }
+  const spinner = yoctoSpinner().start("Waiting for authentication...");
+  const credentials = await waitForDeviceToken(
+    loginUrl,
+    deviceCode.device_code,
+    deviceCode.interval
+  );
+  spinner.success("Authentication complete.");
+  return {
+    storeHash: credentials.store_hash,
+    accessToken: credentials.access_token
+  };
+}
+async function manualLogin(apiHost) {
+  consola.info(
+    `Create a store-level API account from your BigCommerce Control Panel:
+  Settings \u2192 API \u2192 Store-level API accounts \u2192 Create API account
+Grant these OAuth scopes: ${DEVICE_OAUTH_SCOPES}`
+  );
+  const storeHashInput = await consola.prompt("Store hash:", { type: "text" });
+  const storeHash = String(storeHashInput).trim();
+  if (!storeHash) {
+    throw new Error("Store hash is required.");
+  }
+  const accessTokenInput = await password({ message: "Access token:", mask: true });
+  const accessToken = accessTokenInput.trim();
+  if (!accessToken) {
+    throw new Error("Access token is required.");
+  }
+  const spinner = yoctoSpinner().start("Validating credentials...");
+  try {
+    const profile = await fetchStoreProfile(storeHash, accessToken, apiHost);
+    spinner.success(`Validated credentials for ${profile.store_name} (${storeHash}).`);
+  } catch (error) {
+    spinner.error("Failed to validate credentials.");
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Could not validate credentials (${message}). Double-check your store hash and access token, then try again.`
+    );
+  }
+  return { storeHash, accessToken };
+}
+async function login(loginUrl, apiHost) {
+  try {
+    return await deviceCodeLogin(loginUrl);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    consola.warn(`Browser login didn't work (${message}).`);
+    const shouldFallback = await consola.prompt(
+      "Try logging in manually with a store hash and access token instead?",
+      { type: "confirm", initial: true }
+    );
+    if (!shouldFallback) {
+      throw new LoginAbortedError();
+    }
+    return manualLogin(apiHost);
+  }
+}
+
 // src/cli/lib/project.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var InfrastructureProjectValidationError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "InfrastructureProjectValidationError";
   }
 };
-var fetchProjectsSchema = z2.object({
-  data: z2.array(
-    z2.object({
-      uuid: z2.string(),
-      name: z2.string()
+var fetchProjectsSchema = z3.object({
+  data: z3.array(
+    z3.object({
+      uuid: z3.string(),
+      name: z3.string(),
+      deployment_hostnames: z3.array(z3.string())
     })
   )
 });
@@ -288,6 +408,7 @@ async function hasProjectsAccess(storeHash, accessToken, apiHost) {
     method: "GET",
     headers: authHeaders(accessToken)
   });
+  assertAuthorized(response);
   if (response.status === 200) return true;
   if (response.status === 403) return false;
   throw new Error(
@@ -299,6 +420,7 @@ async function fetchProjects(storeHash, accessToken, apiHost) {
     method: "GET",
     headers: authHeaders(accessToken)
   });
+  assertAuthorized(response);
   if (response.status === 403) {
     throw new Error(
       "Infrastructure Projects API not enabled. If you are part of the alpha, contact support@bigcommerce.com to enable it."
@@ -311,18 +433,18 @@ async function fetchProjects(storeHash, accessToken, apiHost) {
   const { data } = fetchProjectsSchema.parse(res);
   return data;
 }
-var createProjectSchema = z2.object({
-  data: z2.object({
-    uuid: z2.string(),
-    name: z2.string(),
-    date_created: z2.coerce.date(),
-    date_modified: z2.coerce.date()
+var createProjectSchema = z3.object({
+  data: z3.object({
+    uuid: z3.string(),
+    name: z3.string(),
+    date_created: z3.coerce.date(),
+    date_modified: z3.coerce.date()
   })
 });
-var validationErrorBodySchema = z2.object({
-  title: z2.string().optional(),
-  detail: z2.string().optional(),
-  errors: z2.record(z2.string(), z2.string()).optional()
+var validationErrorBodySchema = z3.object({
+  title: z3.string().optional(),
+  detail: z3.string().optional(),
+  errors: z3.record(z3.string(), z3.string()).optional()
 });
 function extractValidationMessage(body) {
   const parsed = validationErrorBodySchema.safeParse(body);
@@ -343,6 +465,7 @@ async function createProject(name, storeHash, accessToken, apiHost) {
     },
     body: JSON.stringify({ name })
   });
+  assertAuthorized(response);
   if (response.status === 400 || response.status === 422) {
     const body = await response.json().catch(() => null);
     const fallback = response.status === 422 ? "The project name you entered doesn't meet the requirements. It must be 3\u201332 characters long and use only letters, numbers, hyphens (-), underscores (_), and periods (.)" : response.statusText;
@@ -369,6 +492,7 @@ async function deleteProject(projectUuid, storeHash, accessToken, apiHost) {
     method: "DELETE",
     headers: authHeaders(accessToken)
   });
+  assertAuthorized(response);
   if (response.status === 403) {
     throw new Error(
       "Infrastructure Projects API not enabled. If you are part of the alpha, contact support@bigcommerce.com to enable it."
@@ -398,18 +522,50 @@ function getProjectConfig() {
         default: "catalyst"
       },
       storeHash: { type: "string" },
-      accessToken: { type: "string" }
+      accessToken: { type: "string" },
+      env: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        default: {}
+      }
     }
   });
 }
 
+// src/cli/lib/shared-options.ts
+import { Option } from "commander";
+var storeHashOption = () => new Option(
+  "--store-hash <hash>",
+  "BigCommerce store hash. Can be found in the URL of your store Control Panel. Read from .bigcommerce/project.json or .env when not provided."
+).env("CATALYST_STORE_HASH");
+var accessTokenOption = () => new Option(
+  "--access-token <token>",
+  "BigCommerce access token. Can be found after creating a store-level API account. Read from .bigcommerce/project.json or .env when not provided."
+).env("CATALYST_ACCESS_TOKEN");
+var apiHostOption = () => new Option("--api-host <host>", "BigCommerce API host. The default is api.bigcommerce.com.").env("BIGCOMMERCE_API_HOST").default("api.bigcommerce.com").hideHelp();
+var loginUrlOption = () => new Option("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp();
+var projectUuidOption = () => new Option(
+  "--project-uuid <uuid>",
+  "BigCommerce infrastructure project UUID. Read from .bigcommerce/project.json or .env when not provided."
+).env("CATALYST_PROJECT_UUID");
+var resolveProjectUuid = (options) => {
+  const config2 = getProjectConfig();
+  const projectUuid = options.projectUuid ?? config2.get("projectUuid");
+  if (!projectUuid) {
+    throw new Error(
+      "Project UUID is required. Please run either `catalyst project link` or `catalyst project create` or this command again with --project-uuid <uuid>."
+    );
+  }
+  return projectUuid;
+};
+
 // src/cli/commands/auth.ts
-var StoreProfileSchema = z3.object({
-  data: z3.object({
-    store_name: z3.string()
+var StoreProfileSchema2 = z4.object({
+  data: z4.object({
+    store_name: z4.string()
   })
 });
-async function fetchStoreProfile(storeHash, accessToken, apiHost) {
+async function fetchStoreProfile2(storeHash, accessToken, apiHost) {
   const response = await fetch(`https://${apiHost}/stores/${storeHash}/v3/settings/store/profile`, {
     method: "GET",
     headers: {
@@ -417,11 +573,12 @@ async function fetchStoreProfile(storeHash, accessToken, apiHost) {
       Accept: "application/json"
     }
   });
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`${response.status} ${response.statusText}`);
   }
   const res = await response.json();
-  const result = StoreProfileSchema.safeParse(res);
+  const result = StoreProfileSchema2.safeParse(res);
   if (!result.success) {
     throw new Error("Unexpected response from store profile API");
   }
@@ -435,17 +592,17 @@ Example:
 
   Logged in to My Store (abc123), connected to project my-project (43eba682-0c48-11f1-9bd5-827a48b0ce1e)`
 ).addOption(
-  new Option(
+  new Option2(
     "--store-hash <hash>",
     "BigCommerce store hash. Can be found in the URL of your store Control Panel."
   ).env("CATALYST_STORE_HASH")
 ).addOption(
-  new Option(
+  new Option2(
     "--access-token <token>",
     "BigCommerce access token. Can be found after creating a store-level API account."
   ).env("CATALYST_ACCESS_TOKEN")
 ).addOption(
-  new Option("--api-host <host>", "BigCommerce API host. The default is api.bigcommerce.com.").env("BIGCOMMERCE_API_HOST").default("api.bigcommerce.com").hideHelp()
+  new Option2("--api-host <host>", "BigCommerce API host. The default is api.bigcommerce.com.").env("BIGCOMMERCE_API_HOST").default("api.bigcommerce.com").hideHelp()
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -459,7 +616,7 @@ Example:
       process.exit(1);
       return;
     }
-    const store = await fetchStoreProfile(storeHash, accessToken, options.apiHost);
+    const store = await fetchStoreProfile2(storeHash, accessToken, options.apiHost);
     const projectUuid = config2.get("projectUuid");
     if (projectUuid) {
       const projects = await fetchProjects(storeHash, accessToken, options.apiHost);
@@ -479,7 +636,11 @@ Example:
     process.exit(0);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("401") || message.includes("403")) {
+    if (error instanceof UnauthorizedError) {
+      consola.error(
+        "Not logged in: your access token is invalid or has expired. Run `catalyst auth login`."
+      );
+    } else if (message.includes("401") || message.includes("403")) {
       consola.error(`Not logged in: invalid credentials (${message})`);
     } else {
       consola.error(`Failed to verify credentials: ${message}`);
@@ -487,30 +648,30 @@ Example:
     process.exit(1);
   }
 });
-var login = new Command("login").configureHelp({ showGlobalOptions: true }).description(
-  "Authenticate via browser using the OAuth device code flow. If already logged in, displays current credentials and suggests running `catalyst auth logout` to re-authenticate."
+var login2 = new Command("login").configureHelp({ showGlobalOptions: true }).description(
+  "Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. If already logged in, displays current credentials and suggests running `catalyst auth logout` to re-authenticate."
 ).addHelpText(
   "after",
   `
 Examples:
-  # Login via browser (recommended)
+  # Login interactively (browser, with manual fallback)
   $ catalyst auth login
 
-  # Login with existing credentials (skips browser flow)
+  # Login with existing credentials (skips interactive flow)
   $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>`
 ).addOption(
-  new Option(
+  new Option2(
     "--store-hash <hash>",
     "BigCommerce store hash. Can be found in the URL of your store Control Panel."
   ).env("CATALYST_STORE_HASH")
 ).addOption(
-  new Option(
+  new Option2(
     "--access-token <token>",
     "BigCommerce access token. Can be found after creating a store-level API account."
   ).env("CATALYST_ACCESS_TOKEN")
 ).addOption(
-  new Option("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
-).action(async (options) => {
+  new Option2("--api-host <host>", "BigCommerce API host. The default is api.bigcommerce.com.").env("BIGCOMMERCE_API_HOST").default("api.bigcommerce.com").hideHelp()
+).addOption(loginUrlOption()).action(async (options) => {
   try {
     const config2 = getProjectConfig();
     const storeHash = options.storeHash ?? config2.get("storeHash");
@@ -521,30 +682,19 @@ Examples:
       process.exit(0);
       return;
     }
-    const deviceCode = await requestDeviceCode(options.loginUrl);
-    consola.info(
-      `${colorize("yellow", "Your one-time code:")} ${colorize("bold", deviceCode.user_code)}`
-    );
-    try {
-      await open(deviceCode.verification_uri);
-      consola.info(`Opened ${deviceCode.verification_uri} in your browser.`);
-    } catch {
+    const credentials = await login(options.loginUrl, options.apiHost);
+    config2.set("storeHash", credentials.storeHash);
+    config2.set("accessToken", credentials.accessToken);
+    consola.success(`Logged in to store ${credentials.storeHash}.`);
+    process.exit(0);
+  } catch (error) {
+    if (error instanceof LoginAbortedError) {
       consola.info(
-        `Open ${deviceCode.verification_uri} in your browser and enter the code above.`
+        "Login aborted. Re-run `catalyst auth login` when you have your credentials ready."
       );
+      process.exit(0);
+      return;
     }
-    const spinner = yoctoSpinner().start("Waiting for authentication...");
-    const credentials = await waitForDeviceToken(
-      options.loginUrl,
-      deviceCode.device_code,
-      deviceCode.interval
-    );
-    spinner.success("Authentication complete.");
-    config2.set("storeHash", credentials.store_hash);
-    config2.set("accessToken", credentials.access_token);
-    consola.success(`Logged in to store ${credentials.store_hash}.`);
-    process.exit(0);
-  } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     consola.error(`Login failed: ${message}`);
     process.exit(1);
@@ -575,12 +725,12 @@ Example:
     process.exit(1);
   }
 });
-var auth = new Command("auth").configureHelp({ showGlobalOptions: true }).description("Manage authentication for the BigCommerce CLI.").addCommand(whoami).addCommand(login).addCommand(logout);
+var auth = new Command("auth").configureHelp({ showGlobalOptions: true }).description("Manage authentication for the BigCommerce CLI.").addCommand(whoami).addCommand(login2).addCommand(logout);
 
 // src/cli/commands/build.ts
-import { Command as Command2, Option as Option2 } from "commander";
+import { Command as Command2, Option as Option3 } from "commander";
 import { execa } from "execa";
-import { copyFile, cp, writeFile } from "fs/promises";
+import { copyFile, cp, rm, writeFile } from "fs/promises";
 import { join as join4 } from "path";
 
 // src/cli/lib/get-module-cli-path.ts
@@ -595,12 +745,12 @@ function getModuleCliPath() {
 // src/cli/lib/project-state.ts
 import { existsSync, readFileSync } from "fs";
 import { join as join3 } from "path";
-import { z as z4 } from "zod";
-var projectJsonSchema = z4.looseObject({
-  projectUuid: z4.string().optional()
+import { z as z5 } from "zod";
+var projectJsonSchema = z5.looseObject({
+  projectUuid: z5.string().optional()
 });
-var packageJsonSchema = z4.looseObject({
-  dependencies: z4.record(z4.string(), z4.string()).optional()
+var packageJsonSchema = z5.looseObject({
+  dependencies: z5.record(z5.string(), z5.string()).optional()
 });
 var safeReadJson = (path) => {
   try {
@@ -697,6 +847,7 @@ async function buildCatalystProject(projectUuid) {
   const openNextOutDir = join4(coreDir, ".open-next");
   const bigcommerceDistDir = join4(coreDir, ".bigcommerce", "dist");
   const wranglerConfig = getWranglerConfig(projectUuid);
+  await rm(bigcommerceDistDir, { recursive: true, force: true });
   consola.start("Copying templates...");
   await copyFile(
     join4(getModuleCliPath(), "templates", "open-next.config.ts"),
@@ -758,7 +909,7 @@ Examples:
   # Include project UUID
   $ catalyst build --project-uuid <UUID>`
 ).addOption(
-  new Option2(
+  new Option3(
     "--project-uuid <uuid>",
     "Project UUID to be included in the deployment configuration."
   ).env("CATALYST_PROJECT_UUID")
@@ -783,42 +934,11 @@ Examples:
   await buildCatalystProject(projectUuid);
 });
 
-// src/cli/commands/create.ts
-import { Command as Command3, InvalidArgumentError, Option as Option4 } from "@commander-js/extra-typings";
-import { input as input2, select as select2 } from "@inquirer/prompts";
-import { execSync as execSync4 } from "child_process";
-import { colorize as colorize4 } from "consola/utils";
-import { pathExistsSync } from "fs-extra/esm";
-import kebabCase from "lodash.kebabcase";
-import { join as join9 } from "path";
-
-// src/cli/lib/build-workspace-packages.ts
-import { execSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
-import { join as join5 } from "path";
-import yoctoSpinner2 from "yocto-spinner";
-var WORKSPACE_PACKAGES = ["packages/catalyst", "packages/client"];
-var buildWorkspacePackages = (projectDir) => {
-  const hasCore = existsSync2(join5(projectDir, "core"));
-  const hasAllWorkspacePackages = WORKSPACE_PACKAGES.every(
-    (pkg) => existsSync2(join5(projectDir, pkg))
-  );
-  if (!hasCore || !hasAllWorkspacePackages) return;
-  WORKSPACE_PACKAGES.forEach((pkg) => {
-    const spinner = yoctoSpinner2().start(`Building ${pkg}...`);
-    try {
-      execSync("pnpm build", { cwd: join5(projectDir, pkg), stdio: "ignore" });
-      spinner.success(`Built ${pkg}.`);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "unknown error";
-      spinner.error(`Failed to build ${pkg}: ${message}`);
-      throw error;
-    }
-  });
-};
+// src/cli/commands/channel.ts
+import { Command as Command3, Option as Option4 } from "commander";
 
 // src/cli/lib/channels.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var cliApiUrl = (origin, storeHash, path) => `${origin}/stores/${storeHash}/cli-api/v3${path}`;
 var channelsUrl = (storeHash, apiHost, query2 = {}) => {
   const params = new URLSearchParams(query2).toString();
@@ -829,32 +949,39 @@ var authHeaders2 = (accessToken) => ({
   "X-Correlation-Id": getTelemetry().correlationId,
   Accept: "application/json"
 });
-var envVarsSchema = z5.record(z5.string(), z5.coerce.string());
-var channelSchema = z5.object({
-  id: z5.number(),
-  name: z5.string(),
-  platform: z5.string()
+var envVarsSchema = z6.record(z6.string(), z6.coerce.string());
+var channelSchema = z6.object({
+  id: z6.number(),
+  name: z6.string(),
+  platform: z6.string()
 });
-var channelsResponseSchema = z5.object({
-  data: z5.array(channelSchema)
+var channelsResponseSchema = z6.object({
+  data: z6.array(channelSchema)
 });
-var initResponseSchema = z5.object({
-  data: z5.object({
-    storefront_api_token: z5.string(),
+var initResponseSchema = z6.object({
+  data: z6.object({
+    storefront_api_token: z6.string(),
     envVars: envVarsSchema
   })
 });
-var createChannelResponseSchema = z5.object({
-  data: z5.object({
-    id: z5.number(),
-    storefront_api_token: z5.string(),
+var createChannelResponseSchema = z6.object({
+  data: z6.object({
+    id: z6.number(),
+    storefront_api_token: z6.string(),
     envVars: envVarsSchema
   })
 });
-var eligibilityResponseSchema = z5.object({
-  data: z5.object({
-    eligible: z5.boolean(),
-    message: z5.string()
+var eligibilityResponseSchema = z6.object({
+  data: z6.object({
+    eligible: z6.boolean(),
+    message: z6.string()
+  })
+});
+var channelSiteSchema = z6.object({
+  data: z6.object({
+    id: z6.number(),
+    url: z6.string(),
+    channel_id: z6.number()
   })
 });
 async function getChannelInit(channelId, storeHash, accessToken, origin) {
@@ -917,118 +1044,44 @@ async function fetchAvailableChannels(storeHash, accessToken, apiHost) {
       }
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`GET /v3/channels failed: ${response.status} ${response.statusText}`);
   }
   return channelsResponseSchema.parse(await response.json()).data;
 }
-
-// src/cli/lib/clone-catalyst.ts
-import { execSync as execSync3 } from "child_process";
-
-// src/cli/lib/checkout-ref.ts
-import { sync as spawnSync } from "cross-spawn";
-
-// src/cli/lib/is-exec-exception.ts
-function isExecException(error) {
-  return typeof error === "object" && error !== null && "stdout" in error && "stderr" in error;
-}
-
-// src/cli/lib/checkout-ref.ts
-function checkoutRef(repoDir, ref) {
-  try {
-    const spawn = spawnSync("git", ["checkout", ref, "--"], {
-      cwd: repoDir,
-      encoding: "utf8",
-      shell: false
-    });
-    const stderr = spawn.stderr.trim();
-    if (spawn.status !== 0 && stderr) {
-      throw new Error(stderr);
-    }
-    consola.success(`Checked out ref ${ref} successfully.`);
-  } catch (error) {
-    if (isExecException(error)) {
-      const stderr = error.stderr ? error.stderr.toString() : "";
-      if (stderr.includes(`fatal: reference is not a tree: ${ref}`) || stderr.includes(`fatal: ambiguous argument '${ref}'`) || stderr.includes(`unknown revision or path not in the working tree`)) {
-        consola.error(`Ref '${ref}' not found in the repository.`);
-      } else {
-        consola.error(`Error checking out ref '${ref}':`, stderr.trim());
-      }
-    } else if (error instanceof Error) {
-      consola.error(`Error checking out ref '${ref}':`, error.message);
-    } else {
-      consola.error(`Unknown error occurred while checking out ref '${ref}'.`);
-    }
-    consola.warn(`Falling back to the default branch.`);
-  }
-}
-
-// src/cli/lib/has-github-ssh.ts
-import { execSync as execSync2 } from "child_process";
-function hasGitHubSSH() {
-  try {
-    const output = execSync2("ssh -T git@github.com", {
-      encoding: "utf8",
-      stdio: "pipe"
-    }).toString();
-    return output.includes("successfully authenticated");
-  } catch (error) {
-    if (isExecException(error)) {
-      const stdout = error.stdout ? error.stdout.toString() : "";
-      const stderr = error.stderr ? error.stderr.toString() : "";
-      const combinedOutput = stdout + stderr;
-      if (combinedOutput.includes("successfully authenticated")) {
-        return true;
-      }
+async function updateChannelSiteUrl(channelId, siteUrl, storeHash, accessToken, apiHost) {
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/channels/${channelId}/site`,
+    {
+      method: "PUT",
+      headers: {
+        "X-Auth-Token": accessToken,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-Correlation-Id": getTelemetry().correlationId
+      },
+      body: JSON.stringify({ url: siteUrl })
     }
-    return false;
+  );
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(
+      `Failed to update channel site (${response.status}). Re-run \`catalyst auth login\` to refresh your access token with the store_channel_settings scope.`
+    );
   }
-}
-
-// src/cli/lib/reset-branch-to-ref.ts
-import { sync as spawnSync2 } from "cross-spawn";
-function resetBranchToRef(projectDir, ghRef) {
-  const spawn = spawnSync2("git", ["reset", "--hard", ghRef, "--"], {
-    cwd: projectDir,
-    encoding: "utf8",
-    shell: false
-  });
-  const stderr = spawn.stderr.trim();
-  if (spawn.status !== 0 && stderr) {
-    throw new Error(stderr);
+  if (!response.ok) {
+    throw new Error(`Failed to update channel site: ${response.status} ${response.statusText}`);
   }
+  const res = await response.json();
+  const { data } = channelSiteSchema.parse(res);
+  return { id: data.id, url: data.url, channelId: data.channel_id };
 }
 
-// src/cli/lib/clone-catalyst.ts
-var cloneCatalyst = ({
-  repository,
-  projectName,
-  projectDir,
-  ghRef,
-  resetMain = false
-}) => {
-  const useSSH = hasGitHubSSH();
-  consola.info(`Cloning ${repository} using ${useSSH ? "SSH" : "HTTPS"}...`);
-  const cloneCommand = `git clone ${useSSH ? `git@github.com:${repository}` : `https://github.com/${repository}`}.git${projectName ? ` ${projectName}` : ""}`;
-  execSync3(cloneCommand, { stdio: "inherit" });
-  execSync3("git remote rename origin upstream", { cwd: projectDir, stdio: "inherit" });
-  if (ghRef) {
-    if (resetMain) {
-      execSync3("git checkout -b main", { cwd: projectDir, stdio: "inherit" });
-      resetBranchToRef(projectDir, ghRef);
-      consola.success(`Reset main to ${ghRef} successfully.`);
-      return;
-    }
-    checkoutRef(projectDir, ghRef);
-  }
-};
-
 // src/cli/lib/commerce-hosting.ts
 import { input, select, Separator } from "@inquirer/prompts";
 import { colorize as colorize2 } from "consola/utils";
 import {
-  existsSync as existsSync3,
+  existsSync as existsSync2,
   lstatSync,
   mkdirSync,
   readFileSync as readFileSync2,
@@ -1036,8 +1089,8 @@ import {
   unlinkSync,
   writeFileSync
 } from "fs";
-import { dirname as dirname2, join as join6 } from "path";
-import { z as z6 } from "zod";
+import { dirname as dirname2, join as join5 } from "path";
+import { z as z7 } from "zod";
 
 // src/cli/lib/sort-package-json.ts
 var FIELD_ORDER = [
@@ -1067,8 +1120,8 @@ function sortPackageJsonFields(pkg) {
 
 // src/cli/lib/commerce-hosting.ts
 var OPENNEXT_CLOUDFLARE_VERSION = "1.17.3";
-var corePackageJsonSchema = z6.looseObject({
-  dependencies: z6.record(z6.string(), z6.string()).optional()
+var corePackageJsonSchema = z7.looseObject({
+  dependencies: z7.record(z7.string(), z7.string()).optional()
 });
 var writeJson = (path, value) => {
   mkdirSync(dirname2(path), { recursive: true });
@@ -1076,7 +1129,7 @@ var writeJson = (path, value) => {
 `);
 };
 var symlinkRootEnvToCore = (projectDir) => {
-  const coreEnvPath = join6(projectDir, "core", ".env.local");
+  const coreEnvPath = join5(projectDir, "core", ".env.local");
   if (lstatSync(coreEnvPath, { throwIfNoEntry: false })) return;
   try {
     symlinkSync("../.env.local", coreEnvPath);
@@ -1090,20 +1143,54 @@ You will need to keep .env.local and core/.env.local in sync manually.`
   }
 };
 var convertProxyToMiddleware = (projectDir) => {
-  const proxyPath = join6(projectDir, "core", "proxy.ts");
-  const middlewarePath = join6(projectDir, "core", "middleware.ts");
-  if (!existsSync3(proxyPath)) return;
+  const proxyPath = join5(projectDir, "core", "proxy.ts");
+  const middlewarePath = join5(projectDir, "core", "middleware.ts");
+  if (!existsSync2(proxyPath)) return;
   const contents = readFileSync2(proxyPath, "utf-8").replace("export const proxy", "export const middleware").replace("export const config = {", "export const config = {\n  runtime: 'experimental-edge',");
   writeFileSync(middlewarePath, contents);
   unlinkSync(proxyPath);
 };
-var setupCommerceHosting = ({
+var cleanupCloudflareIncompatibilities = async (projectDir) => {
+  const instrumentationPath = join5(projectDir, "core", "instrumentation.ts");
+  if (!existsSync2(instrumentationPath)) return;
+  if (!process.stdin.isTTY) {
+    consola.warn(
+      "core/instrumentation.ts is present and may be incompatible with the Cloudflare Workers bundle (the default @vercel/otel scaffolding throws at cold start under workerd). Skipping automatic cleanup in non-interactive mode \u2014 re-run interactively to remove it, or delete/gate it manually."
+    );
+    return;
+  }
+  const shouldRemove = await consola.prompt(
+    'Catalyst found core/instrumentation.ts, which is incompatible with the Cloudflare Workers bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start). Remove it and drop @vercel/otel from core/package.json?',
+    { type: "confirm", initial: true }
+  );
+  consola.log("");
+  if (!shouldRemove) {
+    consola.info(
+      'Leaving core/instrumentation.ts in place. The Cloudflare worker will continue to log "Failed to prepare server" at cold start until this is resolved manually.'
+    );
+    return;
+  }
+  unlinkSync(instrumentationPath);
+  consola.info("Removed core/instrumentation.ts (incompatible with Cloudflare Workers).");
+  const corePackageJsonPath = join5(projectDir, "core", "package.json");
+  if (existsSync2(corePackageJsonPath)) {
+    const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync2(corePackageJsonPath, "utf-8")));
+    if (pkg.dependencies && "@vercel/otel" in pkg.dependencies) {
+      const { "@vercel/otel": _removedVercelOtel, ...preservedDeps } = pkg.dependencies;
+      pkg.dependencies = preservedDeps;
+      writeJson(corePackageJsonPath, sortPackageJsonFields(pkg));
+      consola.info("Dropped @vercel/otel from core/package.json.");
+    }
+  }
+};
+var setupCommerceHosting = async ({
   projectDir,
   projectUuid,
   storeHash,
   accessToken
 }) => {
-  const corePackageJsonPath = join6(projectDir, "core", "package.json");
+  await cleanupCloudflareIncompatibilities(projectDir);
+  const corePackageJsonPath = join5(projectDir, "core", "package.json");
   const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync2(corePackageJsonPath, "utf-8")));
   pkg.dependencies = {
     ...pkg.dependencies,
@@ -1116,7 +1203,7 @@ var setupCommerceHosting = ({
   };
   if (storeHash) projectJson.storeHash = storeHash;
   if (accessToken) projectJson.accessToken = accessToken;
-  writeJson(join6(projectDir, "core", ".bigcommerce", "project.json"), projectJson);
+  writeJson(join5(projectDir, "core", ".bigcommerce", "project.json"), projectJson);
   symlinkRootEnvToCore(projectDir);
   convertProxyToMiddleware(projectDir);
 };
@@ -1137,7 +1224,7 @@ async function promptForNewProjectName(api) {
     api.apiHost
   );
   consola.success(`Project "${data.name}" created successfully.`);
-  return { uuid: data.uuid, name: data.name };
+  return { uuid: data.uuid, name: data.name, deployment_hostnames: [] };
 }
 async function selectOrCreateInfrastructureProject(api, linkedProjectUuid) {
   consola.start("Fetching projects...");
@@ -1267,7 +1354,7 @@ async function promptAndCreateCommerceHostingProject(api, takenNames, defaultNam
       api.apiHost
     );
     consola.success(`Commerce Hosting project "${created.name}" created successfully`);
-    return { uuid: created.uuid, name: created.name };
+    return { uuid: created.uuid, name: created.name, deployment_hostnames: [] };
   } catch (error) {
     if (error instanceof InfrastructureProjectValidationError) {
       consola.error(error.message);
@@ -1303,21 +1390,303 @@ async function autoCreateCommerceHostingProject(api, name, existingProjects, use
     process.exit(1);
   }
   try {
-    const created = await createProject(name, api.storeHash, api.accessToken, api.apiHost);
-    consola.success(`Commerce Hosting project "${created.name}" created successfully`);
-    return { uuid: created.uuid, name: created.name };
+    const created = await createProject(name, api.storeHash, api.accessToken, api.apiHost);
+    consola.success(`Commerce Hosting project "${created.name}" created successfully`);
+    return { uuid: created.uuid, name: created.name, deployment_hostnames: [] };
+  } catch (error) {
+    if (error instanceof InfrastructureProjectValidationError) {
+      consola.error(
+        `Failed to create Commerce Hosting project "${name}": ${error.message}
+Re-run with a different --project-name.`
+      );
+      process.exit(1);
+    }
+    throw error;
+  }
+}
+
+// src/cli/lib/channel-site-flow.ts
+async function resolveProject(options) {
+  const api = {
+    storeHash: options.storeHash,
+    accessToken: options.accessToken,
+    apiHost: options.apiHost
+  };
+  if (options.projectUuid) {
+    const projects = await fetchProjects(api.storeHash, api.accessToken, api.apiHost);
+    const matched = projects.find((p) => p.uuid === options.projectUuid);
+    if (matched) return matched;
+    consola.warn(
+      `Project ${options.projectUuid} not found on this store. Pick another to continue.`
+    );
+  }
+  return selectOrCreateInfrastructureProject(api, options.projectUuid);
+}
+async function resolveChannel(options) {
+  if (options.channelId !== void 0) {
+    return { id: options.channelId };
+  }
+  consola.start("Fetching channels...");
+  const channels = await fetchAvailableChannels(
+    options.storeHash,
+    options.accessToken,
+    options.apiHost
+  );
+  consola.success("Channels fetched.");
+  const catalystChannels = channels.filter((c) => c.platform === "catalyst");
+  if (catalystChannels.length === 0) {
+    throw new Error(
+      "No Catalyst channels found on this store. Create one with `catalyst create` and try again."
+    );
+  }
+  const selectedId = await consola.prompt("Select the channel to update.", {
+    type: "select",
+    options: catalystChannels.map((c) => ({
+      label: c.name,
+      value: String(c.id),
+      hint: `id: ${c.id}`
+    })),
+    cancel: "reject"
+  });
+  const id = Number(selectedId);
+  const matched = catalystChannels.find((c) => c.id === id);
+  return { id, name: matched?.name };
+}
+async function resolveHostname(project2, options) {
+  if (options.hostname) {
+    return options.hostname;
+  }
+  if (project2.deployment_hostnames.length === 0) {
+    throw new Error(
+      `Project "${project2.name}" has no deployment hostnames yet. Run \`catalyst deploy\` first to create one.`
+    );
+  }
+  const ordered = options.preferHostname ? [
+    ...project2.deployment_hostnames.filter((h) => h === options.preferHostname),
+    ...project2.deployment_hostnames.filter((h) => h !== options.preferHostname)
+  ] : project2.deployment_hostnames;
+  const selected = await consola.prompt("Select the hostname to point the channel at.", {
+    type: "select",
+    options: ordered.map((h) => ({ label: h, value: h })),
+    cancel: "reject"
+  });
+  return String(selected);
+}
+async function runChannelSiteUrlFlow(options) {
+  const project2 = await resolveProject(options);
+  const channel2 = await resolveChannel(options);
+  const hostname = await resolveHostname(project2, options);
+  const siteUrl = hostname.startsWith("https://") ? hostname : `https://${hostname}`;
+  await updateChannelSiteUrl(
+    channel2.id,
+    siteUrl,
+    options.storeHash,
+    options.accessToken,
+    options.apiHost
+  );
+  const channelLabel = channel2.name ? `"${channel2.name}" (${channel2.id})` : String(channel2.id);
+  consola.success(`Updated channel ${channelLabel} site URL to ${siteUrl}.`);
+}
+
+// src/cli/lib/resolve-credentials.ts
+function resolveCredentials(options, config2) {
+  const storeHash = options.storeHash ?? config2.get("storeHash");
+  const accessToken = options.accessToken ?? config2.get("accessToken");
+  if (!storeHash || !accessToken) {
+    consola.error("Missing credentials.");
+    consola.info(
+      "Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables)."
+    );
+    process.exit(1);
+    throw new Error("Missing credentials");
+  }
+  return { storeHash, accessToken };
+}
+
+// src/cli/commands/channel.ts
+var update = new Command3("update").configureHelp({ showGlobalOptions: true }).description(
+  "Update a BigCommerce channel's site URL to point at one of your project's deployment hostnames."
+).addHelpText(
+  "after",
+  `
+Examples:
+  # Pick a channel and hostname interactively
+  $ catalyst channel update
+
+  # Skip both prompts
+  $ catalyst channel update --channel-id 123 --hostname my-storefront.example.com`
+).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
+  new Option4(
+    "--channel-id <id>",
+    "Skip the channel prompt and target this channel directly."
+  ).argParser((value) => Number(value))
+).addOption(
+  new Option4(
+    "--hostname <hostname>",
+    "Skip the hostname prompt and use this hostname directly. Must be one of the project's deployment_hostnames."
+  )
+).action(async (options) => {
+  const config2 = getProjectConfig();
+  const { storeHash, accessToken } = resolveCredentials(options, config2);
+  await getTelemetry().identify(storeHash);
+  try {
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost: options.apiHost,
+      projectUuid: options.projectUuid ?? config2.get("projectUuid"),
+      channelId: options.channelId,
+      hostname: options.hostname
+    });
+  } catch (error) {
+    if (error instanceof NoLinkedProjectError) {
+      consola.info(
+        "When you're ready to create a project, run `catalyst project create` or re-run `catalyst channel update`."
+      );
+      process.exit(0);
+      return;
+    }
+    throw error;
+  }
+  process.exit(0);
+});
+var channel = new Command3("channel").configureHelp({ showGlobalOptions: true }).description("Manage BigCommerce channels.").addCommand(update);
+
+// src/cli/commands/create.ts
+import { Command as Command4, InvalidArgumentError, Option as Option5 } from "@commander-js/extra-typings";
+import { input as input2, select as select2 } from "@inquirer/prompts";
+import { execSync as execSync4 } from "child_process";
+import { colorize as colorize3 } from "consola/utils";
+import { pathExistsSync } from "fs-extra/esm";
+import kebabCase from "lodash.kebabcase";
+import { join as join9 } from "path";
+
+// src/cli/lib/build-workspace-packages.ts
+import { execSync } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { join as join6 } from "path";
+import yoctoSpinner2 from "yocto-spinner";
+var WORKSPACE_PACKAGES = ["packages/catalyst", "packages/client"];
+var buildWorkspacePackages = (projectDir) => {
+  const hasCore = existsSync3(join6(projectDir, "core"));
+  const hasAllWorkspacePackages = WORKSPACE_PACKAGES.every(
+    (pkg) => existsSync3(join6(projectDir, pkg))
+  );
+  if (!hasCore || !hasAllWorkspacePackages) return;
+  WORKSPACE_PACKAGES.forEach((pkg) => {
+    const spinner = yoctoSpinner2().start(`Building ${pkg}...`);
+    try {
+      execSync("pnpm build", { cwd: join6(projectDir, pkg), stdio: "ignore" });
+      spinner.success(`Built ${pkg}.`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "unknown error";
+      spinner.error(`Failed to build ${pkg}: ${message}`);
+      throw error;
+    }
+  });
+};
+
+// src/cli/lib/clone-catalyst.ts
+import { execSync as execSync3 } from "child_process";
+
+// src/cli/lib/checkout-ref.ts
+import { sync as spawnSync } from "cross-spawn";
+
+// src/cli/lib/is-exec-exception.ts
+function isExecException(error) {
+  return typeof error === "object" && error !== null && "stdout" in error && "stderr" in error;
+}
+
+// src/cli/lib/checkout-ref.ts
+function checkoutRef(repoDir, ref) {
+  try {
+    const spawn = spawnSync("git", ["checkout", ref, "--"], {
+      cwd: repoDir,
+      encoding: "utf8",
+      shell: false
+    });
+    const stderr = spawn.stderr.trim();
+    if (spawn.status !== 0 && stderr) {
+      throw new Error(stderr);
+    }
+    consola.success(`Checked out ref ${ref} successfully.`);
+  } catch (error) {
+    if (isExecException(error)) {
+      const stderr = error.stderr ? error.stderr.toString() : "";
+      if (stderr.includes(`fatal: reference is not a tree: ${ref}`) || stderr.includes(`fatal: ambiguous argument '${ref}'`) || stderr.includes(`unknown revision or path not in the working tree`)) {
+        consola.error(`Ref '${ref}' not found in the repository.`);
+      } else {
+        consola.error(`Error checking out ref '${ref}':`, stderr.trim());
+      }
+    } else if (error instanceof Error) {
+      consola.error(`Error checking out ref '${ref}':`, error.message);
+    } else {
+      consola.error(`Unknown error occurred while checking out ref '${ref}'.`);
+    }
+    consola.warn(`Falling back to the default branch.`);
+  }
+}
+
+// src/cli/lib/has-github-ssh.ts
+import { execSync as execSync2 } from "child_process";
+function hasGitHubSSH() {
+  try {
+    const output = execSync2("ssh -T git@github.com", {
+      encoding: "utf8",
+      stdio: "pipe"
+    }).toString();
+    return output.includes("successfully authenticated");
   } catch (error) {
-    if (error instanceof InfrastructureProjectValidationError) {
-      consola.error(
-        `Failed to create Commerce Hosting project "${name}": ${error.message}
-Re-run with a different --project-name.`
-      );
-      process.exit(1);
+    if (isExecException(error)) {
+      const stdout = error.stdout ? error.stdout.toString() : "";
+      const stderr = error.stderr ? error.stderr.toString() : "";
+      const combinedOutput = stdout + stderr;
+      if (combinedOutput.includes("successfully authenticated")) {
+        return true;
+      }
     }
-    throw error;
+    return false;
+  }
+}
+
+// src/cli/lib/reset-branch-to-ref.ts
+import { sync as spawnSync2 } from "cross-spawn";
+function resetBranchToRef(projectDir, ghRef) {
+  const spawn = spawnSync2("git", ["reset", "--hard", ghRef, "--"], {
+    cwd: projectDir,
+    encoding: "utf8",
+    shell: false
+  });
+  const stderr = spawn.stderr.trim();
+  if (spawn.status !== 0 && stderr) {
+    throw new Error(stderr);
   }
 }
 
+// src/cli/lib/clone-catalyst.ts
+var cloneCatalyst = ({
+  repository,
+  projectName,
+  projectDir,
+  ghRef,
+  resetMain = false
+}) => {
+  const useSSH = hasGitHubSSH();
+  consola.info(`Cloning ${repository} using ${useSSH ? "SSH" : "HTTPS"}...`);
+  const cloneCommand = `git clone ${useSSH ? `git@github.com:${repository}` : `https://github.com/${repository}`}.git${projectName ? ` ${projectName}` : ""}`;
+  execSync3(cloneCommand, { stdio: "inherit" });
+  execSync3("git remote rename origin upstream", { cwd: projectDir, stdio: "inherit" });
+  if (ghRef) {
+    if (resetMain) {
+      execSync3("git checkout -b main", { cwd: projectDir, stdio: "inherit" });
+      resetBranchToRef(projectDir, ghRef);
+      consola.success(`Reset main to ${ghRef} successfully.`);
+      return;
+    }
+    checkoutRef(projectDir, ghRef);
+  }
+};
+
 // src/cli/lib/install-dependencies.ts
 import { installDependencies as installDeps } from "nypm";
 import yoctoSpinner3 from "yocto-spinner";
@@ -1334,7 +1703,7 @@ var installDependencies = async (projectDir) => {
 };
 
 // src/cli/lib/localization.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var allowedLocales = [
   "en",
   "da",
@@ -1356,13 +1725,13 @@ var allowedLocales = [
   "pt-BR",
   "sv"
 ];
-var AvailableLocalesSuccessSchema = z7.object({
-  data: z7.array(
-    z7.object({
-      id: z7.string(),
-      name: z7.string(),
-      fallback: z7.string().nullable(),
-      is_supported: z7.boolean()
+var AvailableLocalesSuccessSchema = z8.object({
+  data: z8.array(
+    z8.object({
+      id: z8.string(),
+      name: z8.string(),
+      fallback: z8.string().nullable(),
+      is_supported: z8.boolean()
     })
   )
 });
@@ -1378,6 +1747,7 @@ var getAvailableLocales = async (storeHash, accessToken, apiHost) => {
       }
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(
       `GET /v3/settings/store/available-locales failed: ${response.status} ${response.statusText}`
@@ -1386,41 +1756,13 @@ var getAvailableLocales = async (storeHash, accessToken, apiHost) => {
   return AvailableLocalesSuccessSchema.parse(await response.json()).data.filter(({ id }) => allowedLocales.includes(id)).map(({ name, id }) => ({ name: `${name} (${id})`, value: id }));
 };
 
-// src/cli/lib/login.ts
-import { colorize as colorize3 } from "consola/utils";
-import open2 from "open";
-import yoctoSpinner4 from "yocto-spinner";
-async function login2(loginUrl) {
-  const deviceCode = await requestDeviceCode(loginUrl);
-  consola.info(
-    `${colorize3("yellow", "Your one-time code:")} ${colorize3("bold", deviceCode.user_code)}`
-  );
-  try {
-    await open2(deviceCode.verification_uri);
-    consola.info(`Opened ${deviceCode.verification_uri} in your browser.`);
-  } catch {
-    consola.info(`Open ${deviceCode.verification_uri} in your browser and enter the code above.`);
-  }
-  const spinner = yoctoSpinner4().start("Waiting for authentication...");
-  const credentials = await waitForDeviceToken(
-    loginUrl,
-    deviceCode.device_code,
-    deviceCode.interval
-  );
-  spinner.success("Authentication complete.");
-  return {
-    storeHash: credentials.store_hash,
-    accessToken: credentials.access_token
-  };
-}
-
 // src/cli/lib/setup-core-project.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, join as join7 } from "path";
-import { z as z8 } from "zod";
-var corePackageJsonSchema2 = z8.looseObject({
-  scripts: z8.record(z8.string(), z8.string()).optional(),
-  dependencies: z8.record(z8.string(), z8.string()).optional()
+import { z as z9 } from "zod";
+var corePackageJsonSchema2 = z9.looseObject({
+  scripts: z9.record(z9.string(), z9.string()).optional(),
+  dependencies: z9.record(z9.string(), z9.string()).optional()
 });
 var writeJson2 = (path, value) => {
   mkdirSync2(dirname3(path), { recursive: true });
@@ -1443,32 +1785,6 @@ var setupCoreProject = (projectDir) => {
   writeJson2(corePackageJsonPath, sortPackageJsonFields(pkg));
 };
 
-// src/cli/lib/shared-options.ts
-import { Option as Option3 } from "commander";
-var storeHashOption = () => new Option3(
-  "--store-hash <hash>",
-  "BigCommerce store hash. Can be found in the URL of your store Control Panel. Read from .bigcommerce/project.json or .env when not provided."
-).env("CATALYST_STORE_HASH");
-var accessTokenOption = () => new Option3(
-  "--access-token <token>",
-  "BigCommerce access token. Can be found after creating a store-level API account. Read from .bigcommerce/project.json or .env when not provided."
-).env("CATALYST_ACCESS_TOKEN");
-var apiHostOption = () => new Option3("--api-host <host>", "BigCommerce API host. The default is api.bigcommerce.com.").env("BIGCOMMERCE_API_HOST").default("api.bigcommerce.com").hideHelp();
-var projectUuidOption = () => new Option3(
-  "--project-uuid <uuid>",
-  "BigCommerce infrastructure project UUID. Read from .bigcommerce/project.json or .env when not provided."
-).env("CATALYST_PROJECT_UUID");
-var resolveProjectUuid = (options) => {
-  const config2 = getProjectConfig();
-  const projectUuid = options.projectUuid ?? config2.get("projectUuid");
-  if (!projectUuid) {
-    throw new Error(
-      "Project UUID is required. Please run either `catalyst project link` or `catalyst project create` or this command again with --project-uuid <uuid>."
-    );
-  }
-  return projectUuid;
-};
-
 // src/cli/lib/write-env.ts
 import { outputFileSync } from "fs-extra/esm";
 import { join as join8 } from "path";
@@ -1515,7 +1831,7 @@ async function handleChannelCreation(storeHash, accessToken, apiHost, cliApiOrig
     choices: availableLocales,
     theme: {
       style: {
-        help: () => colorize4("dim", "(Select locale from the list or start typing the name)")
+        help: () => colorize3("dim", "(Select locale from the list or start typing the name)")
       }
     }
   });
@@ -1631,7 +1947,7 @@ function checkRequiredTools() {
     process.exit(1);
   }
 }
-var create = new Command3("create").configureHelp({ showGlobalOptions: true }).description("Scaffold and connect a Catalyst storefront to your BigCommerce store.").addHelpText(
+var create = new Command4("create").configureHelp({ showGlobalOptions: true }).description("Scaffold and connect a Catalyst storefront to your BigCommerce store.").addHelpText(
   "after",
   `
 Examples:
@@ -1652,7 +1968,7 @@ Examples:
   "Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable).",
   parseEnvFlag
 ).addOption(
-  new Option4(
+  new Option5(
     "--hosting <mode>",
     'Hosting mode: "self-hosted" (default) or "commerce" to set up Commerce Hosting at create time. When omitted, scaffolding is hosting-agnostic; run `catalyst deploy` later to opt in.'
   ).choices(["self-hosted", "commerce"])
@@ -1660,11 +1976,11 @@ Examples:
   "--use-existing",
   "Only used with --hosting commerce and --project-name. When the named project already exists on the store, reuse it instead of prompting. Has no effect without --hosting commerce."
 ).addOption(
-  new Option4("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
+  new Option5("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
 ).addOption(
-  new Option4("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
+  new Option5("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
 ).addOption(
-  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option5("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   const { ghRef, repository } = options;
   if (options.useExisting && options.hosting !== "commerce") {
@@ -1681,9 +1997,21 @@ Examples:
   let storefrontToken = options.storefrontToken;
   let envVars = {};
   if (!storeHash || !accessToken) {
-    const credentials = await login2(options.loginUrl);
-    storeHash = credentials.storeHash;
-    accessToken = credentials.accessToken;
+    const apiHost = `api.${options.bigcommerceHostname}`;
+    try {
+      const credentials = await login(options.loginUrl, apiHost);
+      storeHash = credentials.storeHash;
+      accessToken = credentials.accessToken;
+    } catch (error) {
+      if (error instanceof LoginAbortedError) {
+        consola.info(
+          "Login aborted. Re-run `catalyst create` when you have your credentials ready."
+        );
+        process.exit(0);
+        return;
+      }
+      throw error;
+    }
   }
   const useCommerceHosting = options.hosting === "commerce";
   await getTelemetry().identify(storeHash);
@@ -1769,7 +2097,7 @@ Examples:
     cloneCatalyst({ repository, projectName, projectDir, ghRef, resetMain: options.resetMain });
     setupCoreProject(projectDir);
     if (useCommerceHosting && commerceHostingProject && storeHash && accessToken) {
-      setupCommerceHosting({
+      await setupCommerceHosting({
         projectDir,
         projectUuid: commerceHostingProject.uuid,
         storeHash,
@@ -1789,10 +2117,10 @@ Examples:
   }
   consola.success(`Created '${projectName}' at '${projectDir}'`);
   consola.info("Next steps:");
-  consola.info(colorize4("yellow", `  cd ${projectName}/core && pnpm run dev`));
+  consola.info(colorize3("yellow", `  cd ${projectName}/core && pnpm run dev`));
   if (useCommerceHosting) {
     consola.info(
-      colorize4(
+      colorize3(
         "yellow",
         `  Run 'cd ${projectName}/core && pnpm run deploy' when ready to deploy to Commerce Hosting.`
       )
@@ -1802,12 +2130,12 @@ Examples:
 
 // src/cli/commands/deploy.ts
 import AdmZip from "adm-zip";
-import { Command as Command4, Option as Option5 } from "commander";
-import { colorize as colorize5 } from "consola/utils";
+import { Command as Command5, Option as Option6 } from "commander";
+import { colorize as colorize4 } from "consola/utils";
 import { access, readdir, readFile } from "fs/promises";
 import { dirname as dirname4, join as join10 } from "path";
-import yoctoSpinner5 from "yocto-spinner";
-import { z as z9 } from "zod";
+import yoctoSpinner4 from "yocto-spinner";
+import { z as z10 } from "zod";
 
 // src/cli/lib/deployment-errors.ts
 var ERROR_MESSAGES = {
@@ -1825,23 +2153,40 @@ function getDeploymentErrorMessage(code) {
   return ERROR_MESSAGES[code] ?? `Deployment failed with an unexpected error (code: ${code}). Please try again. If the issue persists, contact support.`;
 }
 
-// src/cli/lib/resolve-credentials.ts
-function resolveCredentials(options, config2) {
-  const storeHash = options.storeHash ?? config2.get("storeHash");
-  const accessToken = options.accessToken ?? config2.get("accessToken");
-  if (!storeHash || !accessToken) {
-    consola.error("Missing credentials.");
-    consola.info(
-      "Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables)."
+// src/cli/lib/env-config.ts
+var ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var parseEnvAssignment = (input3) => {
+  const separatorIndex = input3.indexOf("=");
+  if (separatorIndex === -1) {
+    throw new Error(`Invalid env var format: ${input3}. Expected format: KEY=VALUE`);
+  }
+  const key = input3.slice(0, separatorIndex).trim();
+  const value = input3.slice(separatorIndex + 1).trim();
+  if (!key || !value) {
+    throw new Error(`Invalid env var format: ${input3}. Expected format: KEY=VALUE`);
+  }
+  if (!ENV_KEY_PATTERN.test(key)) {
+    throw new Error(
+      `Invalid env var name: ${key}. Names must start with a letter or underscore and contain only letters, numbers, and underscores.`
     );
-    process.exit(1);
-    throw new Error("Missing credentials");
   }
-  return { storeHash, accessToken };
-}
+  return { key, value };
+};
+var getStoredEnv = (config2) => {
+  return config2.get("env") ?? {};
+};
+var toDeploymentSecrets = (envVars) => {
+  return Object.entries(envVars).map(([key, value]) => ({ type: "secret", key, value }));
+};
+var mergeDeploymentSecrets = (persisted, flagSecrets) => {
+  const byKey = /* @__PURE__ */ new Map();
+  persisted.forEach((secret) => byKey.set(secret.key, secret));
+  flagSecrets.forEach((secret) => byKey.set(secret.key, secret));
+  return Array.from(byKey.values());
+};
 
 // src/cli/commands/deploy.ts
-var stepsEnum = z9.enum([
+var stepsEnum = z10.enum([
   "initializing",
   "downloading",
   "unzipping",
@@ -1859,35 +2204,35 @@ var STEPS = {
   finalizing: "Finalizing...",
   complete: "Complete"
 };
-var UploadSignatureSchema = z9.object({
-  data: z9.object({
-    upload_url: z9.url(),
-    upload_uuid: z9.string()
+var UploadSignatureSchema = z10.object({
+  data: z10.object({
+    upload_url: z10.url(),
+    upload_uuid: z10.string()
   })
 });
-var CreateDeploymentSchema = z9.object({
-  data: z9.object({
-    deployment_uuid: z9.uuid()
+var CreateDeploymentSchema = z10.object({
+  data: z10.object({
+    deployment_uuid: z10.uuid()
   })
 });
-var ProjectSchema = z9.object({
-  data: z9.array(
-    z9.object({
-      uuid: z9.uuid(),
-      name: z9.string()
+var ProjectSchema = z10.object({
+  data: z10.array(
+    z10.object({
+      uuid: z10.uuid(),
+      name: z10.string()
     })
   )
 });
-var DeploymentStatusSchema = z9.object({
-  deployment_uuid: z9.uuid(),
-  deployment_status: z9.enum(["queued", "in_progress", "failed", "completed"]),
-  event: z9.object({
+var DeploymentStatusSchema = z10.object({
+  deployment_uuid: z10.uuid(),
+  deployment_status: z10.enum(["queued", "in_progress", "failed", "completed"]),
+  event: z10.object({
     step: stepsEnum,
-    progress: z9.number()
+    progress: z10.number()
   }).nullable(),
-  deployment_url: z9.string().nullable(),
-  error: z9.object({
-    code: z9.number()
+  deployment_hostnames: z10.array(z10.string()).optional(),
+  error: z10.object({
+    code: z10.number()
   }).optional()
 });
 var generateBundleZip = async () => {
@@ -1924,6 +2269,7 @@ var generateUploadSignature = async (storeHash, accessToken, apiHost) => {
       body: JSON.stringify({})
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`Failed to fetch upload signature: ${response.status} ${response.statusText}`);
   }
@@ -1951,41 +2297,14 @@ var uploadBundleZip = async (uploadUrl) => {
 };
 var parseEnvironmentVariables = (secretOption) => {
   return secretOption?.map((envVar) => {
-    const [key, value] = envVar.split("=");
-    if (!key || !value) {
-      throw new Error(`Invalid secret format: ${envVar}. Expected format: KEY=VALUE`);
-    }
+    const { key, value } = parseEnvAssignment(envVar);
     return {
       type: "secret",
-      key: key.trim(),
-      value: value.trim()
+      key,
+      value
     };
   });
 };
-var AUTO_DETECT_SECRETS = [
-  { key: "BIGCOMMERCE_STORE_HASH", warnIfMissing: true },
-  { key: "BIGCOMMERCE_CHANNEL_ID", warnIfMissing: true },
-  { key: "BIGCOMMERCE_STOREFRONT_TOKEN", warnIfMissing: true },
-  { key: "BIGCOMMERCE_API_HOST", warnIfMissing: false },
-  { key: "BIGCOMMERCE_GRAPHQL_API_DOMAIN", warnIfMissing: false },
-  { key: "AUTH_SECRET", warnIfMissing: false }
-];
-var autoDetectSecrets = (environmentVariables) => {
-  const secrets = environmentVariables ?? [];
-  const existingKeys = new Set(secrets.map((s) => s.key));
-  AUTO_DETECT_SECRETS.forEach(({ key, warnIfMissing }) => {
-    if (existingKeys.has(key)) {
-      return;
-    }
-    const value = process.env[key];
-    if (value) {
-      secrets.push({ type: "secret", key, value });
-    } else if (warnIfMissing) {
-      consola.warn(`${key} is not set in the environment and was not provided via --secret.`);
-    }
-  });
-  return secrets;
-};
 var createDeployment = async (projectUuid, uploadUuid, storeHash, accessToken, apiHost, environmentVariables) => {
   consola.info("Creating deployment...");
   const response = await fetch(
@@ -2005,6 +2324,7 @@ var createDeployment = async (projectUuid, uploadUuid, storeHash, accessToken, a
       })
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`Failed to create deployment: ${response.status} ${response.statusText}`);
   }
@@ -2015,7 +2335,7 @@ var createDeployment = async (projectUuid, uploadUuid, storeHash, accessToken, a
 };
 var getDeploymentStatus = async (deploymentUuid, storeHash, accessToken, apiHost) => {
   consola.info("Fetching deployment status...");
-  const spinner = yoctoSpinner5().start("Fetching...");
+  const spinner = yoctoSpinner4().start("Fetching...");
   const response = await fetch(
     `https://${apiHost}/stores/${storeHash}/v3/infrastructure/deployments/${deploymentUuid}/events`,
     {
@@ -2028,6 +2348,7 @@ var getDeploymentStatus = async (deploymentUuid, storeHash, accessToken, apiHost
       }
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`Failed to open event stream: ${response.status} ${response.statusText}`);
   }
@@ -2037,7 +2358,7 @@ var getDeploymentStatus = async (deploymentUuid, storeHash, accessToken, apiHost
   }
   const decoder = new TextDecoder();
   let done = false;
-  let deploymentUrl;
+  let deploymentHostname;
   while (!done) {
     const { value, done: streamDone } = await reader.read();
     let json;
@@ -2060,18 +2381,20 @@ var getDeploymentStatus = async (deploymentUuid, storeHash, accessToken, apiHost
         if (data.event && STEPS[data.event.step] !== spinner.text) {
           spinner.text = STEPS[data.event.step];
         }
-        if (data.deployment_url) {
-          deploymentUrl = data.deployment_url;
+        if (data.deployment_hostnames && data.deployment_hostnames.length > 0) {
+          deploymentHostname = data.deployment_hostnames[0];
         }
       });
     }
     done = streamDone;
   }
   spinner.success("Deployment completed successfully.");
-  if (deploymentUrl) {
-    const url = deploymentUrl.startsWith("https://") ? deploymentUrl : `https://${deploymentUrl}`;
-    consola.success(`View your deployment at: ${colorize5("blue", url)}`);
+  if (deploymentHostname) {
+    consola.success(
+      `View your deployment at: ${colorize4("blue", `https://${deploymentHostname}`)}`
+    );
   }
+  return deploymentHostname;
 };
 var fetchProject = async (projectUuid, storeHash, accessToken, apiHost) => {
   const response = await fetch(
@@ -2086,6 +2409,7 @@ var fetchProject = async (projectUuid, storeHash, accessToken, apiHost) => {
       }
     }
   );
+  assertAuthorized(response);
   if (!response.ok) {
     throw new Error(`Failed to fetch projects: ${response.status} ${response.statusText}`);
   }
@@ -2093,15 +2417,21 @@ var fetchProject = async (projectUuid, storeHash, accessToken, apiHost) => {
   const { data } = ProjectSchema.parse(res);
   return data.find((project2) => project2.uuid === projectUuid);
 };
-var deploy = new Command4("deploy").configureHelp({ showGlobalOptions: true }).description("Deploy your application to Cloudflare.").addHelpText(
+var deploy = new Command5("deploy").configureHelp({ showGlobalOptions: true }).description("Deploy your application to Cloudflare.").addHelpText(
   "after",
   `
+Environment variables saved with \`catalyst env add\` are sent automatically on every deploy.
+Use \`--secret\` to set or override a variable for a single run.
+
 Example:
   $ catalyst deploy --secret BIGCOMMERCE_STORE_HASH=<YOUR_STORE_HASH> --secret BIGCOMMERCE_STOREFRONT_TOKEN=<YOUR_STOREFRONT_TOKEN>`
-).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option5(
+).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).option(
+  "--update-site-url",
+  "After a successful deploy, prompt to update a channel's site URL to the new hostname."
+).addOption(
+  new Option6(
     "--secret <value>",
-    "Secret to set for the deployment (repeatable). Format: --secret KEY=VALUE"
+    "Secret to set for this deployment (repeatable). Overrides a stored value for the same key. Format: --secret KEY=VALUE"
   ).argParser((value, previous = []) => {
     return previous.concat([value]);
   })
@@ -2167,9 +2497,11 @@ Example:
       process.exit(0);
     }
     const projectDir = dirname4(process.cwd());
-    setupCommerceHosting({ projectDir, projectUuid, storeHash, accessToken });
+    await setupCommerceHosting({ projectDir, projectUuid, storeHash, accessToken });
     consola.success("Commerce Hosting setup complete.");
     await installDependencies(projectDir);
+  } else {
+    await cleanupCloudflareIncompatibilities(dirname4(process.cwd()));
   }
   if (options.prebuilt) {
     const distDir = join10(process.cwd(), ".bigcommerce", "dist");
@@ -2201,7 +2533,10 @@ Example:
   }
   const uploadSignature = await generateUploadSignature(storeHash, accessToken, options.apiHost);
   await uploadBundleZip(uploadSignature.upload_url);
-  const environmentVariables = autoDetectSecrets(parseEnvironmentVariables(options.secret));
+  const flagSecrets = parseEnvironmentVariables(options.secret) ?? [];
+  const persistedSecrets = toDeploymentSecrets(getStoredEnv(config2));
+  const mergedSecrets = mergeDeploymentSecrets(persistedSecrets, flagSecrets);
+  const environmentVariables = mergedSecrets.length > 0 ? mergedSecrets : void 0;
   const { deployment_uuid: deploymentUuid } = await createDeployment(
     projectUuid,
     uploadSignature.upload_uuid,
@@ -2210,13 +2545,109 @@ Example:
     options.apiHost,
     environmentVariables
   );
-  await getDeploymentStatus(deploymentUuid, storeHash, accessToken, options.apiHost);
+  const deploymentHostname = await getDeploymentStatus(
+    deploymentUuid,
+    storeHash,
+    accessToken,
+    options.apiHost
+  );
+  if (!options.updateSiteUrl) {
+    return;
+  }
+  try {
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost: options.apiHost,
+      projectUuid,
+      preferHostname: deploymentHostname
+    });
+  } catch (error) {
+    consola.warn(
+      `Failed to update channel site URL: ${error instanceof Error ? error.message : String(error)}`
+    );
+    consola.info(
+      "Update it manually in the control panel, or re-run `catalyst auth login` if the token is missing the store_channel_settings scope."
+    );
+  }
+});
+
+// src/cli/commands/env.ts
+import { Command as Command6 } from "commander";
+var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+var add = new Command6("add").configureHelp({ showGlobalOptions: true }).description(
+  "Add or update one or more deployment environment variables. Stored in .bigcommerce/project.json and sent as secrets on every `catalyst deploy`."
+).argument("<vars...>", "One or more environment variables in KEY=VALUE format.").addHelpText(
+  "after",
+  `
+Example:
+  $ catalyst env add BIGCOMMERCE_STORE_HASH=abc123 BIGCOMMERCE_STOREFRONT_TOKEN=ey...`
+).action((vars) => {
+  const config2 = getProjectConfig();
+  const stored = { ...getStoredEnv(config2) };
+  const parsed = vars.map((entry) => parseEnvAssignment(entry));
+  parsed.forEach(({ key, value }) => {
+    stored[key] = value;
+  });
+  config2.set("env", stored);
+  const keys = parsed.map(({ key }) => key);
+  consola.success(
+    `Saved ${keys.length} environment variable${keys.length === 1 ? "" : "s"} to .bigcommerce/project.json:`
+  );
+  keys.forEach((key) => consola.log(`  ${key}=${MASK}`));
+  process.exit(0);
+});
+var remove = new Command6("remove").configureHelp({ showGlobalOptions: true }).description("Remove one or more stored deployment environment variables.").argument("<keys...>", "One or more environment variable names to remove.").addHelpText(
+  "after",
+  `
+Example:
+  $ catalyst env remove BIGCOMMERCE_STORE_HASH BIGCOMMERCE_STOREFRONT_TOKEN`
+).action((keys) => {
+  const config2 = getProjectConfig();
+  const stored = getStoredEnv(config2);
+  const toRemove = /* @__PURE__ */ new Set();
+  keys.forEach((key) => {
+    if (key in stored) {
+      toRemove.add(key);
+    } else {
+      consola.warn(`No stored environment variable named "${key}". Skipping.`);
+    }
+  });
+  const next = Object.fromEntries(Object.entries(stored).filter(([key]) => !toRemove.has(key)));
+  config2.set("env", next);
+  const removed = Array.from(toRemove);
+  if (removed.length > 0) {
+    consola.success(
+      `Removed ${removed.length} environment variable${removed.length === 1 ? "" : "s"}: ${removed.join(", ")}.`
+    );
+  }
+  process.exit(0);
+});
+var list = new Command6("list").configureHelp({ showGlobalOptions: true }).description("List stored deployment environment variables (values are masked).").addHelpText(
+  "after",
+  `
+Example:
+  $ catalyst env list`
+).action(() => {
+  const config2 = getProjectConfig();
+  const stored = getStoredEnv(config2);
+  const keys = Object.keys(stored).sort();
+  if (keys.length === 0) {
+    consola.info("No environment variables stored. Add one with `catalyst env add KEY=VALUE`.");
+    process.exit(0);
+    return;
+  }
+  keys.forEach((key) => consola.log(`${key}=${MASK}`));
+  process.exit(0);
 });
+var env = new Command6("env").configureHelp({ showGlobalOptions: true }).description(
+  "Manage persistent deployment environment variables. These are sent as secrets on every `catalyst deploy`, so you no longer need to pass `--secret` each time."
+).addCommand(add).addCommand(remove).addCommand(list);
 
 // src/cli/commands/logs.ts
-import { Command as Command5, Option as Option6 } from "commander";
-import { colorize as colorize6 } from "consola/utils";
-import { z as z10 } from "zod";
+import { Command as Command7, Option as Option7 } from "commander";
+import { colorize as colorize5 } from "consola/utils";
+import { z as z11 } from "zod";
 var telemetry = new Telemetry();
 var DEFAULT_CONNECTION_TTL_MS = 1 * 60 * 1e3;
 var MAX_RETRIES = 5;
@@ -2227,23 +2658,23 @@ var LEVEL_COLORS = {
   ERROR: "red",
   DEBUG: "gray"
 };
-var LogEventSchema = z10.object({
-  uuid: z10.string(),
-  project_uuid: z10.string(),
-  request: z10.object({
-    method: z10.string(),
-    url: z10.string(),
-    status_code: z10.number()
+var LogEventSchema = z11.object({
+  uuid: z11.string(),
+  project_uuid: z11.string(),
+  request: z11.object({
+    method: z11.string(),
+    url: z11.string(),
+    status_code: z11.number()
   }),
-  logs: z10.array(
-    z10.object({
-      timestamp: z10.string(),
-      level: z10.string(),
-      messages: z10.array(z10.unknown())
+  logs: z11.array(
+    z11.object({
+      timestamp: z11.string(),
+      level: z11.string(),
+      messages: z11.array(z11.unknown())
     })
   ),
-  exceptions: z10.array(z10.unknown()),
-  timestamp: z10.string()
+  exceptions: z11.array(z11.unknown()),
+  timestamp: z11.string()
 }).loose();
 var StreamError = class extends Error {
   constructor(message, fatal) {
@@ -2257,7 +2688,7 @@ var formatLogEvent = (event, format) => {
   logEntries.forEach((entry) => {
     const msg = formatMessages(entry.messages);
     const level = entry.level.toUpperCase();
-    const coloredLevel = colorize6(LEVEL_COLORS[level] ?? "white", level);
+    const coloredLevel = colorize5(LEVEL_COLORS[level] ?? "white", level);
     switch (format) {
       case "short":
         consola.log(msg);
@@ -2298,6 +2729,20 @@ var processLogEvent = (event, format) => {
     consola.warn(`Failed to parse log event: ${event}`);
   }
 };
+var raceWithTimeout = async (promise, timeoutMs) => {
+  let timeoutHandle;
+  const timeoutPromise = new Promise((resolve2) => {
+    timeoutHandle = setTimeout(() => resolve2({ kind: "timeout" }), timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      promise.then((value) => ({ kind: "value", value })),
+      timeoutPromise
+    ]);
+  } finally {
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+  }
+};
 var openLogStream = async (projectUuid, storeHash, accessToken, apiHost) => {
   const response = await fetch(
     `https://${apiHost}/stores/${storeHash}/v3/infrastructure/logs/${projectUuid}/tail`,
@@ -2310,6 +2755,9 @@ var openLogStream = async (projectUuid, storeHash, accessToken, apiHost) => {
       }
     }
   );
+  if (response.status === 401) {
+    throw new StreamError(new UnauthorizedError().message, true);
+  }
   if (!response.ok) {
     throw new StreamError(
       `Failed to open log stream: ${response.status} ${response.statusText}`,
@@ -2322,28 +2770,46 @@ var openLogStream = async (projectUuid, storeHash, accessToken, apiHost) => {
   }
   return reader;
 };
+var pumpUntilRotation = async (reader, format, connectionTtlMs) => {
+  const decoder = new TextDecoder();
+  const connectTime = Date.now();
+  let buffer = "";
+  let receivedData = false;
+  while (true) {
+    const remainingTtlMs = connectionTtlMs - (Date.now() - connectTime);
+    if (remainingTtlMs <= 0) {
+      void reader.cancel();
+      return "ttl";
+    }
+    const readResult = await raceWithTimeout(reader.read(), remainingTtlMs);
+    if (readResult.kind === "timeout") {
+      void reader.cancel();
+      return receivedData ? "ttl" : "idle-timeout";
+    }
+    const { value, done: streamDone } = readResult.value;
+    if (value) {
+      receivedData = true;
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split("\n\n");
+      buffer = parts.pop() ?? "";
+      parts.map((raw) => parseSSEEvent(raw)).filter((event) => event !== null).forEach((event) => processLogEvent(event, format));
+    }
+    if (streamDone) {
+      void reader.cancel();
+      return "stream-done";
+    }
+  }
+};
 var tailLogs = async (projectUuid, storeHash, accessToken, apiHost, format, connectionTtlMs = DEFAULT_CONNECTION_TTL_MS) => {
   consola.info("Tailing logs...");
   let retries = 0;
   while (true) {
     try {
       const reader = await openLogStream(projectUuid, storeHash, accessToken, apiHost);
-      const decoder = new TextDecoder();
-      const connectTime = Date.now();
-      let buffer = "";
       retries = 0;
-      while (true) {
-        const { value, done: streamDone } = await reader.read();
-        if (value) {
-          buffer += decoder.decode(value, { stream: true });
-          const parts = buffer.split("\n\n");
-          buffer = parts.pop() ?? "";
-          parts.map((raw) => parseSSEEvent(raw)).filter((event) => event !== null).forEach((event) => processLogEvent(event, format));
-        }
-        if (streamDone || Date.now() - connectTime >= connectionTtlMs) {
-          void reader.cancel();
-          break;
-        }
+      const rotation = await pumpUntilRotation(reader, format, connectionTtlMs);
+      if (rotation === "idle-timeout") {
+        consola.warn("Log stream idle, reconnecting...");
       }
     } catch (error) {
       if (error instanceof StreamError && error.fatal) {
@@ -2365,7 +2831,7 @@ var tailLogs = async (projectUuid, storeHash, accessToken, apiHost, format, conn
     }
   }
 };
-var tail = new Command5("tail").configureHelp({ showGlobalOptions: true }).description("Tail live logs from your deployed application.").addHelpText(
+var tail = new Command7("tail").configureHelp({ showGlobalOptions: true }).description("Tail live logs from your deployed application.").addHelpText(
   "after",
   `
 Examples:
@@ -2377,7 +2843,7 @@ Examples:
   # Tail logs as raw JSON (useful for piping to other tools)
   $ catalyst logs tail --format json`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option6("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
+  new Option7("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -2390,7 +2856,7 @@ Examples:
     process.exit(1);
   }
 });
-var query = new Command5("query").configureHelp({ showGlobalOptions: true }).description("Query historical logs from your deployed application.").addHelpText(
+var query = new Command7("query").configureHelp({ showGlobalOptions: true }).description("Query historical logs from your deployed application.").addHelpText(
   "after",
   `
 Example:
@@ -2401,21 +2867,24 @@ Example:
   consola.error("The query command is not yet implemented.");
   process.exit(1);
 });
-var logs = new Command5("logs").configureHelp({ showGlobalOptions: true }).description("View logs from your deployed application.").addCommand(tail, { isDefault: true }).addCommand(query);
+var logs = new Command7("logs").configureHelp({ showGlobalOptions: true }).description("View logs from your deployed application.").addCommand(tail, { isDefault: true }).addCommand(query);
 
 // src/cli/commands/project.ts
-import { Command as Command6 } from "commander";
-import { colorize as colorize7 } from "consola/utils";
+import { Command as Command8 } from "commander";
+import { colorize as colorize6 } from "consola/utils";
 import { dirname as dirname5 } from "path";
 async function offerCommerceHostingSetup(projectUuid, credentials) {
-  if (getProjectState().isTransformed) return;
+  const projectDir = dirname5(process.cwd());
+  if (getProjectState().isTransformed) {
+    await cleanupCloudflareIncompatibilities(projectDir);
+    return;
+  }
   const shouldSetup = await consola.prompt(
     "Your project has been linked, but is not fully set up for Commerce Hosting deployments yet. Would you like to run the setup now?",
     { type: "confirm", initial: true }
   );
   if (!shouldSetup) return;
-  const projectDir = dirname5(process.cwd());
-  setupCommerceHosting({
+  await setupCommerceHosting({
     projectDir,
     projectUuid,
     storeHash: credentials?.storeHash,
@@ -2424,7 +2893,7 @@ async function offerCommerceHostingSetup(projectUuid, credentials) {
   consola.success("Commerce Hosting setup complete.");
   await installDependencies(projectDir);
 }
-var list = new Command6("list").configureHelp({ showGlobalOptions: true }).description("List BigCommerce infrastructure projects for your store.").addHelpText(
+var list2 = new Command8("list").configureHelp({ showGlobalOptions: true }).description("List BigCommerce infrastructure projects for your store.").addHelpText(
   "after",
   `
 Example:
@@ -2443,21 +2912,52 @@ Example:
   }
   const linkedProjectUuid = config2.get("projectUuid");
   projects.forEach((p) => {
-    const marker = p.uuid === linkedProjectUuid ? ` ${colorize7("green", "[linked]")}` : "";
+    const marker = p.uuid === linkedProjectUuid ? ` ${colorize6("green", "[linked]")}` : "";
     consola.log(`${p.name} (${p.uuid})${marker}`);
+    if (p.deployment_hostnames.length === 0) {
+      consola.log("  (not deployed)");
+    } else {
+      p.deployment_hostnames.forEach((hostname) => {
+        consola.log(`  ${colorize6("blue", `https://${hostname}`)}`);
+      });
+    }
+    consola.log("");
   });
   process.exit(0);
 });
-var create2 = new Command6("create").configureHelp({ showGlobalOptions: true }).description(
-  "Create a new BigCommerce infrastructure project and link it to your local Catalyst project."
+var create2 = new Command8("create").configureHelp({ showGlobalOptions: true }).description(
+  "Create a new BigCommerce infrastructure project and link it to your local Catalyst project. Walks you through logging in if you are not authenticated yet."
 ).addHelpText(
   "after",
   `
 Example:
   $ catalyst project create`
-).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).action(async (options) => {
+).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).action(async (options) => {
   const config2 = getProjectConfig();
-  const { storeHash, accessToken } = resolveCredentials(options, config2);
+  let storeHash = options.storeHash ?? config2.get("storeHash");
+  let accessToken = options.accessToken ?? config2.get("accessToken");
+  if (!storeHash || !accessToken) {
+    consola.info(
+      "You're not logged in yet. Let's get you authenticated before creating a project."
+    );
+    try {
+      const credentials = await login(options.loginUrl, options.apiHost);
+      storeHash = credentials.storeHash;
+      accessToken = credentials.accessToken;
+      config2.set("storeHash", storeHash);
+      config2.set("accessToken", accessToken);
+      consola.success(`Logged in to store ${storeHash}.`);
+    } catch (error) {
+      if (error instanceof LoginAbortedError) {
+        consola.info(
+          "Login aborted. Re-run `catalyst project create` when you have your credentials ready."
+        );
+        process.exit(0);
+        return;
+      }
+      throw error;
+    }
+  }
   await getTelemetry().identify(storeHash);
   const newProjectName = await consola.prompt("Enter a name for the new project:", {
     type: "text"
@@ -2471,7 +2971,7 @@ Example:
   consola.success("Project UUID written to .bigcommerce/project.json.");
   process.exit(0);
 });
-var link = new Command6("link").configureHelp({ showGlobalOptions: true }).description(
+var link = new Command8("link").configureHelp({ showGlobalOptions: true }).description(
   "Link your local Catalyst project to a BigCommerce infrastructure project. You can provide a project UUID directly, or fetch and select from available projects using your store credentials."
 ).addHelpText(
   "after",
@@ -2521,7 +3021,7 @@ Examples:
   await offerCommerceHostingSetup(selected.uuid, { storeHash, accessToken });
   process.exit(0);
 });
-var del = new Command6("delete").configureHelp({ showGlobalOptions: true }).description(
+var del = new Command8("delete").configureHelp({ showGlobalOptions: true }).description(
   "Permanently delete a BigCommerce infrastructure project. This action is irreversible."
 ).addHelpText(
   "after",
@@ -2557,7 +3057,7 @@ Examples:
         type: "select",
         options: [
           ...projects.map((p) => ({
-            label: p.uuid === linkedProjectUuid ? `${p.name} ${colorize7("green", "[linked]")}` : p.name,
+            label: p.uuid === linkedProjectUuid ? `${p.name} ${colorize6("green", "[linked]")}` : p.name,
             value: p.uuid,
             hint: p.uuid
           })),
@@ -2599,14 +3099,14 @@ Examples:
   }
   process.exit(0);
 });
-var project = new Command6("project").configureHelp({ showGlobalOptions: true }).description("Manage your BigCommerce infrastructure project.").addCommand(create2).addCommand(list).addCommand(link).addCommand(del);
+var project = new Command8("project").configureHelp({ showGlobalOptions: true }).description("Manage your BigCommerce infrastructure project.").addCommand(create2).addCommand(list2).addCommand(link).addCommand(del);
 
 // src/cli/commands/start.ts
-import { Command as Command7 } from "commander";
+import { Command as Command9 } from "commander";
 import { execa as execa2 } from "execa";
 import { existsSync as existsSync4, lstatSync as lstatSync2, symlinkSync as symlinkSync2 } from "fs";
 import { join as join11, relative } from "path";
-var start = new Command7("start").configureHelp({ showGlobalOptions: true }).description(
+var start = new Command9("start").configureHelp({ showGlobalOptions: true }).description(
   "Start a local preview of your Catalyst storefront using the OpenNext Cloudflare adapter."
 ).addHelpText(
   "after",
@@ -2657,11 +3157,11 @@ Example:
 });
 
 // src/cli/commands/telemetry.ts
-import { Argument, Command as Command8, Option as Option7 } from "commander";
-import { colorize as colorize8 } from "consola/utils";
+import { Argument, Command as Command10, Option as Option8 } from "commander";
+import { colorize as colorize7 } from "consola/utils";
 var telemetryService = getTelemetry();
 var isEnabled = telemetryService.isEnabled();
-var telemetry2 = new Command8("telemetry").configureHelp({ showGlobalOptions: true }).description(
+var telemetry2 = new Command10("telemetry").configureHelp({ showGlobalOptions: true }).description(
   "View or change CLI telemetry collection status. Enabling telemetry helps BigCommerce support diagnose and troubleshoot errors you encounter when using the CLI."
 ).addHelpText(
   "after",
@@ -2675,7 +3175,7 @@ Examples:
 
   # Disable telemetry collection
   $ catalyst telemetry --disable`
-).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option7("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
+).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option8("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
   if (options.enable || arg === "enable") {
     telemetryService.setEnabled(true);
     isEnabled = true;
@@ -2692,7 +3192,7 @@ Examples:
     consola.info("Catalyst CLI Telemetry\n");
   }
   consola.info(
-    `Status: ${colorize8("bold", isEnabled ? colorize8("green", "Enabled") : colorize8("red", "Disabled"))}`
+    `Status: ${colorize7("bold", isEnabled ? colorize7("green", "Enabled") : colorize7("red", "Disabled"))}`
   );
   if (!isEnabled) {
     consola.info(
@@ -2702,8 +3202,8 @@ Examples:
 });
 
 // src/cli/commands/version.ts
-import { Command as Command9 } from "commander";
-var version = new Command9("version").configureHelp({ showGlobalOptions: true }).description("Display detailed version information.").addHelpText(
+import { Command as Command11 } from "commander";
+var version = new Command11("version").configureHelp({ showGlobalOptions: true }).description("Display detailed version information.").addHelpText(
   "after",
   `
 Example:
@@ -2771,13 +3271,13 @@ if (existsSync5(defaultEnvPath)) {
 if (!process.env.CATALYST_STORE_HASH && process.env.BIGCOMMERCE_STORE_HASH) {
   process.env.CATALYST_STORE_HASH = process.env.BIGCOMMERCE_STORE_HASH;
 }
-var program = new Command10();
-consola.log(colorize9("cyanBright", `\u25E2 ${package_default.name} v${package_default.version}
+var program = new Command12();
+consola.log(colorize8("cyanBright", `\u25E2 ${package_default.name} v${package_default.version}
 `));
 program.name(package_default.name).version(package_default.version).summary("CLI tool for Catalyst development").description(
   "CLI tool for Catalyst development.\n\nConfiguration priority: flags > env file (--env-path) > process.env > .env.local (auto-loaded from cwd) > .bigcommerce/project.json.\n\nCATALYST_STORE_HASH falls back to BIGCOMMERCE_STORE_HASH if unset.\n\nRun `catalyst <command> --help` for details on a specific command."
 ).configureHelp({ showGlobalOptions: true }).addOption(
-  new Option8(
+  new Option9(
     "--env-path <path>",
     "Path to environment file to load (relative to current working directory)"
     // We are using argParser, because commander loads in environment variables before executing hooks.
@@ -2793,12 +3293,12 @@ program.name(package_default.name).version(package_default.version).summary("CLI
         const message = errCode === "ENOENT" ? `Env file not found: ${envFilePath}` : `Failed to load --env-path ${value}: ${result.error.message}`;
         throw new Error(message);
       }
-      consola.log(colorize9("cyanBright", `Loaded environment variables from ${envFilePath}
+      consola.log(colorize8("cyanBright", `Loaded environment variables from ${envFilePath}
 `));
     }
     return value;
   })
-).addCommand(version).addCommand(create).addCommand(start).addCommand(build).addCommand(deploy).addCommand(logs).addCommand(project).addCommand(auth).addCommand(telemetry2).hook("preAction", telemetryPreHook).hook("postAction", telemetryPostHook);
+).addCommand(version).addCommand(create).addCommand(start).addCommand(build).addCommand(deploy).addCommand(logs).addCommand(project).addCommand(env).addCommand(channel).addCommand(auth).addCommand(telemetry2).hook("preAction", telemetryPreHook).hook("postAction", telemetryPostHook);
 
 // src/cli/index.ts
 var handleFatalError = async (error) => {
@@ -2815,6 +3315,10 @@ var handleFatalError = async (error) => {
     await telemetry3.analytics.closeAndFlush();
   } catch {
   }
+  if (error instanceof UnauthorizedError) {
+    consola.error(errorMessage);
+    process.exit(1);
+  }
   consola.error(errorMessage);
   if (telemetry3.isEnabled()) {
     consola.info(