@bigcommerce/catalyst 1.4.0 → 1.4.2

package/dist/cli.js

@@ -25,7 +25,7 @@ import { randomBytes, randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@bigcommerce/catalyst",
-  version: "1.4.0",
+  version: "1.4.2",
   type: "module",
   repository: {
     type: "git",
@@ -215,7 +215,7 @@ import { Command as Command15 } from "commander";
 import { colorize as colorize13 } from "consola/utils";
 
 // src/cli/commands/auth.ts
-import { Command } from "commander";
+import { Command, Option as Option2 } from "commander";
 import { z as z5 } from "zod";
 
 // src/cli/lib/auth-errors.ts
@@ -619,6 +619,14 @@ function getProjectConfig(cwd = process.cwd()) {
         type: "object",
         additionalProperties: { type: "string" },
         default: {}
+      },
+      declinedSiteUrlChannels: {
+        type: "array",
+        items: { type: "number" }
+      },
+      declinedCheckoutUrlChannels: {
+        type: "array",
+        items: { type: "number" }
       }
     }
   });
@@ -685,6 +693,19 @@ async function fetchStoreProfile2(storeHash, accessToken, apiHost) {
   }
   return result.data.data;
 }
+async function checkCredentials(storeHash, accessToken, apiHost) {
+  try {
+    const { store_name: storeName } = await fetchStoreProfile2(storeHash, accessToken, apiHost);
+    return { valid: true, storeName };
+  } catch (error) {
+    if (error instanceof UnauthorizedError) return { valid: false, reason: "unauthorized" };
+    return {
+      valid: false,
+      reason: "unverifiable",
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
 var whoami = new Command("whoami").configureHelp({ showGlobalOptions: true }).description("Verify stored credentials and display store/project info.").addHelpText(
   "after",
   `
@@ -739,7 +760,7 @@ Example:
   }
 });
 var login2 = new Command("login").configureHelp({ showGlobalOptions: true }).description(
-  "Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. If already logged in, displays current credentials and suggests running `catalyst auth logout` to re-authenticate."
+  "Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. Passing --store-hash and --access-token verifies and stores those credentials instead. If already logged in with credentials that still work, displays them and suggests `catalyst auth logout`; if the stored token has expired or been revoked, re-authenticates in place."
 ).addHelpText(
   "after",
   `
@@ -748,19 +769,67 @@ Examples:
   $ catalyst auth login
 
   # Login with existing credentials (skips interactive flow)
-  $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>`
-).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).action(async (options) => {
+  $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>
+
+  # Re-authenticate without checking the stored credentials first
+  $ catalyst auth login --force`
+).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).addOption(
+  new Option2(
+    "--force",
+    "Skip the check on any credentials already stored and re-authenticate regardless."
+  )
+).action(async (options, command) => {
   try {
     const config2 = getProjectConfig();
     const apiHost = resolveApiHost(options, config2);
     const storeHash = options.storeHash ?? config2.get("storeHash");
     const accessToken = options.accessToken ?? config2.get("accessToken");
-    if (storeHash && accessToken) {
-      consola.info(`Already logged in to store ${storeHash}.`);
-      consola.info("Run `catalyst auth logout` first to re-authenticate.");
+    const suppliedOnCli = command.getOptionValueSource("storeHash") === "cli" && command.getOptionValueSource("accessToken") === "cli";
+    if (suppliedOnCli && storeHash && accessToken) {
+      if (!options.force) {
+        const status = await checkCredentials(storeHash, accessToken, apiHost);
+        if (!status.valid && status.reason === "unauthorized") {
+          consola.error(`The credentials provided for store ${storeHash} were rejected.`);
+          consola.info(
+            "Check the store hash and access token, or run `catalyst auth login` without them to authenticate in the browser."
+          );
+          process.exit(1);
+          return;
+        }
+        if (!status.valid) {
+          consola.warn(`Couldn't verify the credentials provided: ${status.message}`);
+        }
+      }
+      config2.set("storeHash", storeHash);
+      config2.set("accessToken", accessToken);
+      consola.success(`Logged in to store ${storeHash}.`);
       process.exit(0);
       return;
     }
+    if (storeHash && accessToken && !options.force) {
+      const status = await checkCredentials(storeHash, accessToken, apiHost);
+      if (status.valid) {
+        consola.info(`Already logged in to ${status.storeName} (${storeHash}).`);
+        consola.info(
+          "Run `catalyst auth logout` first to re-authenticate, or `catalyst auth login --force` to skip this check."
+        );
+        process.exit(0);
+        return;
+      }
+      if (status.reason === "unverifiable") {
+        consola.warn(
+          `Found credentials for store ${storeHash} but couldn't verify them: ${status.message}`
+        );
+        consola.info(
+          "Keeping them. Re-run once the API is reachable, or `catalyst auth login --force` to re-authenticate regardless."
+        );
+        process.exit(0);
+        return;
+      }
+      consola.warn(
+        `Stored credentials for store ${storeHash} are no longer valid \u2014 re-authenticating.`
+      );
+    }
     const credentials = await login(options.loginUrl, apiHost);
     config2.set("storeHash", credentials.storeHash);
     config2.set("accessToken", credentials.accessToken);
@@ -807,7 +876,7 @@ Example:
 var auth = new Command("auth").configureHelp({ showGlobalOptions: true }).description("Manage authentication for the BigCommerce CLI.").addCommand(whoami).addCommand(login2).addCommand(logout);
 
 // src/cli/commands/build.ts
-import { Command as Command2, InvalidArgumentError, Option as Option2 } from "commander";
+import { Command as Command2, InvalidArgumentError, Option as Option3 } from "commander";
 import { execa as execa2 } from "execa";
 import { copyFile, cp, rm, writeFile } from "fs/promises";
 import { join as join6 } from "path";
@@ -918,7 +987,7 @@ var cleanupCloudflareIncompatibilities = async (projectDir) => {
     return;
   }
   const shouldRemove = await confirm2({
-    message: 'Catalyst found instrumentation.ts, which is incompatible with the Cloudflare Workers bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start). Remove it and drop @vercel/otel from package.json?',
+    message: 'Catalyst found instrumentation.ts, which is incompatible with the Cloudflare Workers bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start).\nRemove it and drop @vercel/otel from package.json? (required for native hosting)',
     default: true
   });
   if (!shouldRemove) {
@@ -1489,6 +1558,8 @@ async function buildCatalystProject(projectUuid, wranglerVersion = WRANGLER_VERS
     "pnpm",
     [
       "dlx",
+      "--allow-build=esbuild",
+      "--allow-build=workerd",
       `wrangler@${wranglerVersion}`,
       "deploy",
       "--config",
@@ -1523,12 +1594,12 @@ Examples:
   # Build with a specific Wrangler version
   $ catalyst build --wrangler-version 4.24.3`
 ).addOption(
-  new Option2(
+  new Option3(
     "--project-uuid <uuid>",
     "Project UUID to be included in the deployment configuration."
   ).env("CATALYST_PROJECT_UUID")
 ).addOption(
-  new Option2(
+  new Option3(
     "--wrangler-version <version>",
     `Wrangler version or dist-tag to build with. Defaults to ${WRANGLER_VERSION}.`
   ).argParser(parseWranglerVersion)
@@ -1556,12 +1627,17 @@ Examples:
 });
 
 // src/cli/commands/channels.ts
-import { confirm as confirm3, select as select4 } from "@inquirer/prompts";
-import { Command as Command3, InvalidArgumentError as InvalidArgumentError2, Option as Option3 } from "commander";
+import { confirm as confirm4, select as select4 } from "@inquirer/prompts";
+import { Command as Command3, InvalidArgumentError as InvalidArgumentError2, Option as Option4 } from "commander";
 import { colorize as colorize5 } from "consola/utils";
 
+// src/cli/lib/can-prompt.ts
+function canPrompt() {
+  return Boolean(process.stdin.isTTY) && !process.env.CI;
+}
+
 // src/cli/lib/channel-checkout-url-flow.ts
-import { input as input3 } from "@inquirer/prompts";
+import { confirm as confirm3, input as input3 } from "@inquirer/prompts";
 
 // src/cli/lib/channel-site-flow.ts
 import { select as select2 } from "@inquirer/prompts";
@@ -1776,7 +1852,6 @@ async function deleteChannelCheckoutUrl(channelId, storeHash, accessToken, apiHo
 // src/cli/lib/checkout-url.ts
 import { getDomain } from "tldts";
 var normalizeHostname = (hostname) => hostname.toLowerCase().replace(/\.$/, "");
-var parentDomain = (hostname) => hostname.split(".").slice(1).join(".");
 var isSubdomainOf = (hostname, parent) => hostname.endsWith(`.${parent}`);
 function hostnameOf(url) {
   try {
@@ -1789,11 +1864,45 @@ function sharesMainDomain(a, b) {
   const first = getDomain(normalizeHostname(a));
   return first !== null && first === getDomain(normalizeHostname(b));
 }
-function suggestCheckoutUrl(storefrontUrl) {
+var MANAGED_ZONE_CHECKOUT_PREFIX = "c.";
+var MAX_HOSTNAME_LENGTH = 64;
+var CHECKOUT_HOSTNAME_READY_TIMEOUT_MS = 6 * 60 * 1e3;
+var CHECKOUT_HOSTNAME_POLL_INTERVAL_MS = 10 * 1e3;
+function managedCheckoutHostname(storefrontHostname) {
+  const hostname = MANAGED_ZONE_CHECKOUT_PREFIX + normalizeHostname(storefrontHostname);
+  return hostname.length <= MAX_HOSTNAME_LENGTH ? hostname : void 0;
+}
+async function checkoutHostnameIsServing(hostname) {
+  try {
+    await fetch(`https://${hostname}/`, {
+      method: "HEAD",
+      redirect: "manual",
+      signal: AbortSignal.timeout(1e4)
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function waitForCheckoutHostname(hostname, { timeoutMs = CHECKOUT_HOSTNAME_READY_TIMEOUT_MS, onWait } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let waited = false;
+  for (; ; ) {
+    if (await checkoutHostnameIsServing(hostname)) return true;
+    if (Date.now() + CHECKOUT_HOSTNAME_POLL_INTERVAL_MS >= deadline) return false;
+    if (!waited) {
+      waited = true;
+      onWait?.();
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, CHECKOUT_HOSTNAME_POLL_INTERVAL_MS));
+  }
+}
+function suggestCheckoutUrl(storefrontUrl, { managedZone = false } = {}) {
   const host = hostnameOf(storefrontUrl);
   if (!host) return void 0;
-  const base = normalizeHostname(host).replace(/^www\./, "");
-  return `https://checkout.${base}`;
+  const normalized = normalizeHostname(host);
+  if (managedZone) return `https://${MANAGED_ZONE_CHECKOUT_PREFIX}${normalized}`;
+  return `https://checkout.${normalized.replace(/^www\./, "")}`;
 }
 function normalizeCheckoutUrl(value) {
   const withScheme = /^[a-z][a-z\d+.-]*:\/\//i.test(value) ? value : `https://${value}`;
@@ -1812,18 +1921,24 @@ function normalizeCheckoutUrl(value) {
   }
   return parsed.origin;
 }
-async function isManagedHostingHostname(hostname, context) {
-  try {
-    const projects2 = await fetchProjects(context.storeHash, context.accessToken, context.apiHost);
-    const zones = projects2.flatMap((project) => project.deployment_hostnames).map((deploymentHostname) => parentDomain(normalizeHostname(deploymentHostname))).filter((zone) => zone.includes("."));
-    if (zones.length === 0) return void 0;
-    const host = normalizeHostname(hostname);
-    return zones.some((zone) => host === zone || isSubdomainOf(host, zone));
-  } catch {
-    return void 0;
-  }
+var NATIVE_HOSTING_ZONES = [
+  "catalyst-sandbox.store",
+  "catalyst-sandbox-dev.store",
+  "catalyst-sandbox-staging.store",
+  "catalyst-sandbox-integration.store",
+  "ignition-demo.store"
+];
+function isManagedHostingHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  return NATIVE_HOSTING_ZONES.some((zone) => isSubdomainOf(host, zone));
+}
+function isCrossDomainCheckout(site) {
+  const storefrontHost = hostnameOf(findChannelSiteUrl(site, "primary") ?? site.url);
+  const checkoutUrl = findChannelSiteUrl(site, "checkout");
+  const checkoutHost = checkoutUrl ? hostnameOf(checkoutUrl) : void 0;
+  return Boolean(storefrontHost && checkoutHost && !sharesMainDomain(storefrontHost, checkoutHost));
 }
-async function warnOnCrossDomainCheckout(site, context) {
+function warnOnCrossDomainCheckout(site) {
   const storefrontUrl = findChannelSiteUrl(site, "primary") ?? site.url;
   const storefrontHost = hostnameOf(storefrontUrl);
   const checkoutUrl = findChannelSiteUrl(site, "checkout");
@@ -1845,22 +1960,23 @@ async function warnOnCrossDomainCheckout(site, context) {
   consola.info(
     "Shopper sessions and carts may not carry into checkout in browsers that restrict cross-domain cookies."
   );
-  const storefrontOnManagedZone = await isManagedHostingHostname(storefrontHost, context);
-  const report = { crossDomain: true, storefrontOnManagedZone, suggestion };
-  if (storefrontOnManagedZone === false) {
+  const storefrontOnManagedZone = isManagedHostingHostname(storefrontHost);
+  const report = {
+    crossDomain: true,
+    storefrontOnManagedZone,
+    suggestion: storefrontOnManagedZone ? suggestCheckoutUrl(storefrontUrl, { managedZone: true }) : suggestion
+  };
+  if (storefrontOnManagedZone) {
     consola.info(
-      `To put checkout on this channel's own domain, point ${suggestion?.replace("https://", "") ?? "your checkout subdomain"} at BigCommerce and provision a certificate for it there.`
+      `${storefrontHost} is an auto-generated deployment hostname, so its checkout hostname is ${MANAGED_ZONE_CHECKOUT_PREFIX}${storefrontHost}. BigCommerce provisions it when it's set as the checkout URL, and its certificate takes a few minutes to issue. Set it with:`
     );
-    return report;
-  }
-  if (storefrontOnManagedZone === true) {
-    consola.info(
-      `${storefrontHost} is an auto-generated deployment hostname, and a checkout subdomain of one cannot be issued a certificate \u2014 so no checkout URL can be set for this channel until its storefront is on a custom domain. Add one with \`catalyst domains add\`.`
+    consola.log(
+      `  catalyst channels update --channel-id ${site.channelId} --checkout-url ${report.suggestion ?? "<domain>"}`
     );
     return report;
   }
   consola.info(
-    "BigCommerce requires the checkout URL to share a main domain with the storefront. Set one with `catalyst channels update --checkout-url <domain>` once it points at BigCommerce."
+    `To put checkout on this channel's own domain, point ${suggestion?.replace("https://", "") ?? "your checkout subdomain"} at BigCommerce and provision a certificate for it there.`
   );
   return report;
 }
@@ -1900,7 +2016,7 @@ async function resolveChannel(options) {
     );
   }
   const id = await select2({
-    message: "Select the channel to update.",
+    message: options.message ?? "Select the channel to update.",
     choices: catalystChannels.map((c) => ({
       name: c.name,
       value: c.id,
@@ -1934,15 +2050,26 @@ async function runChannelSiteUrlFlow(options) {
   const channel = await resolveChannel(options);
   const hostname = await resolveHostname(project, options);
   const siteUrl = hostname.startsWith("https://") ? hostname : `https://${hostname}`;
-  await updateChannelSiteUrl(
+  const channelLabel = channel.name ? `"${channel.name}" (${channel.id})` : String(channel.id);
+  const current = await getChannelSite(
     channel.id,
-    siteUrl,
     options.storeHash,
     options.accessToken,
     options.apiHost
-  );
-  const channelLabel = channel.name ? `"${channel.name}" (${channel.id})` : String(channel.id);
-  consola.success(`Updated channel ${channelLabel} site URL to ${siteUrl}.`);
+  ).catch(() => void 0);
+  if (current && (findChannelSiteUrl(current, "primary") ?? current.url).replace(/\/$/, "") === siteUrl) {
+    consola.info(`Channel ${channelLabel} site URL is already ${siteUrl}.`);
+  } else {
+    await updateChannelSiteUrl(
+      channel.id,
+      siteUrl,
+      options.storeHash,
+      options.accessToken,
+      options.apiHost
+    );
+    consola.success(`Updated channel ${channelLabel} site URL to ${siteUrl}.`);
+  }
+  if (options.diagnoseCheckout === false) return { channelId: channel.id, hostname };
   try {
     const site = await getChannelSite(
       channel.id,
@@ -1950,11 +2077,7 @@ async function runChannelSiteUrlFlow(options) {
       options.accessToken,
       options.apiHost
     );
-    const report = await warnOnCrossDomainCheckout(site, {
-      storeHash: options.storeHash,
-      accessToken: options.accessToken,
-      apiHost: options.apiHost
-    });
+    const report = warnOnCrossDomainCheckout(site);
     if (report.crossDomain && report.storefrontOnManagedZone !== true) {
       consola.info("Set a checkout URL for this channel with:");
       consola.log(
@@ -1963,13 +2086,22 @@ async function runChannelSiteUrlFlow(options) {
     }
   } catch {
   }
-  return { channelId: channel.id };
+  return { channelId: channel.id, hostname };
 }
 
 // src/cli/lib/channel-checkout-url-flow.ts
 async function runChannelCheckoutUrlFlow(options) {
   const channel = options.channelId !== void 0 ? { id: options.channelId, name: options.channelName } : await resolveChannel(options);
   const label = channel.name ? `"${channel.name}" (${channel.id})` : String(channel.id);
+  if (options.storefrontHostname !== void 0 && await setManagedCheckoutUrl({
+    ...options,
+    channelId: channel.id,
+    label,
+    storefrontHostname: options.storefrontHostname,
+    timeoutMs: options.certificateTimeoutMs
+  })) {
+    return;
+  }
   let storefrontUrl = options.storefrontUrl;
   if (!storefrontUrl) {
     const site = await getChannelSite(
@@ -1987,6 +2119,16 @@ async function runChannelCheckoutUrlFlow(options) {
       );
     }
   }
+  const storefrontHostname = hostnameOf(storefrontUrl);
+  if (options.url === void 0 && options.storefrontHostname === void 0 && storefrontHostname !== void 0 && await setManagedCheckoutUrl({
+    ...options,
+    channelId: channel.id,
+    label,
+    storefrontHostname,
+    timeoutMs: options.certificateTimeoutMs
+  })) {
+    return;
+  }
   const answer = options.url ?? await input3({
     message: "Checkout URL for this channel (must share a main domain with the storefront)",
     default: suggestCheckoutUrl(storefrontUrl)
@@ -2001,6 +2143,78 @@ async function runChannelCheckoutUrlFlow(options) {
   );
   consola.success(`Updated channel ${label} checkout URL to ${checkoutUrl}.`);
 }
+async function setManagedCheckoutUrl(options) {
+  const { storeHash, accessToken, apiHost, channelId, label, storefrontHostname } = options;
+  if (!isManagedHostingHostname(storefrontHostname)) return false;
+  const hostname = managedCheckoutHostname(storefrontHostname);
+  if (!hostname) {
+    consola.warn(
+      `${storefrontHostname} is too long to take a checkout prefix, so it has no checkout hostname. Checkout keeps its current URL.`
+    );
+    return true;
+  }
+  const checkoutUrl = `https://${hostname}`;
+  const site = await getChannelSite(channelId, storeHash, accessToken, apiHost);
+  if (site.isCheckoutUrlCustomized) {
+    const alreadySet = site.urls.some(
+      (entry) => entry.type === "checkout" && entry.url.replace(/\/$/, "") === checkoutUrl
+    );
+    if (!alreadySet) {
+      consola.info(
+        `Channel ${label} already has a custom checkout URL, so it was left alone. To replace it, run \`catalyst channels update --channel-id ${channelId} --checkout-url ${checkoutUrl}\`.`
+      );
+      return true;
+    }
+  } else {
+    await updateChannelCheckoutUrl(channelId, checkoutUrl, storeHash, accessToken, apiHost);
+    consola.success(`Updated channel ${label} checkout URL to ${checkoutUrl}.`);
+  }
+  const ready = await waitForCheckoutHostname(hostname, {
+    timeoutMs: options.timeoutMs,
+    onWait: () => consola.info(
+      `Waiting for ${hostname} to be issued a certificate. This usually takes a minute or two...`
+    )
+  });
+  if (ready) {
+    consola.success(`${hostname} is serving checkout.`);
+    return true;
+  }
+  await deleteChannelCheckoutUrl(channelId, storeHash, accessToken, apiHost);
+  consola.warn(
+    `${hostname} wasn't issued a certificate in time, so the checkout URL was removed and checkout falls back to the default channel's. Re-run with \`--update-checkout-url\` to try again.`
+  );
+  return true;
+}
+async function offerManagedCheckoutUrl(options) {
+  const { storeHash, accessToken, apiHost, channelId, storefrontHostname, config: config2 } = options;
+  const declined = config2.get("declinedCheckoutUrlChannels") ?? [];
+  if (!isManagedHostingHostname(storefrontHostname)) return false;
+  if (options.respectOptOut && declined.includes(channelId)) return false;
+  const site = await getChannelSite(channelId, storeHash, accessToken, apiHost);
+  if (site.isCheckoutUrlCustomized || !isCrossDomainCheckout(site)) return false;
+  const shouldMove = await confirm3({
+    message: `Checkout is on ${findChannelSiteUrl(site, "checkout") ?? "another domain"}. Move it to https://${MANAGED_ZONE_CHECKOUT_PREFIX}${storefrontHostname} so shoppers stay on this domain through payment?`,
+    default: options.defaultAnswer
+  });
+  if (!shouldMove) {
+    if (!declined.includes(channelId)) {
+      config2.set("declinedCheckoutUrlChannels", [...declined, channelId]);
+    }
+    warnOnCrossDomainCheckout(site);
+    consola.info(
+      `Won't ask again after deploys for channel ${channelId}. To set it later, run \`catalyst channels update --channel-id ${channelId} --checkout-url https://${MANAGED_ZONE_CHECKOUT_PREFIX}${storefrontHostname}\`.`
+    );
+    return true;
+  }
+  await runChannelCheckoutUrlFlow({
+    storeHash,
+    accessToken,
+    apiHost,
+    channelId,
+    storefrontHostname
+  });
+  return true;
+}
 
 // src/cli/lib/create-channel-flow.ts
 import { checkbox, input as input4, select as select3 } from "@inquirer/prompts";
@@ -2317,22 +2531,22 @@ Examples:
   # Fall back to the shared checkout domain
   $ catalyst channels update --channel-id 123 --remove-checkout-url`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option3(
+  new Option4(
     "--channel-id <id>",
     "Skip the channel prompt and target this channel directly."
   ).argParser((value) => Number(value))
 ).addOption(
-  new Option3(
+  new Option4(
     "--hostname <hostname>",
     "Skip the hostname prompt and use this hostname directly. Must be one of the project's deployment_hostnames."
   )
 ).addOption(
-  new Option3(
+  new Option4(
     "--checkout-url <url>",
     "Set the channel's checkout URL. Must share a main domain with the storefront URL."
   ).argParser(parseCheckoutUrl)
 ).addOption(
-  new Option3(
+  new Option4(
     "--remove-checkout-url",
     "Remove the channel's custom checkout URL so checkout falls back to the shared checkout domain."
   ).conflicts("checkoutUrl")
@@ -2343,16 +2557,19 @@ Examples:
   await getTelemetry().identify(storeHash);
   const touchesCheckout = options.checkoutUrl !== void 0 || options.removeCheckoutUrl === true;
   const updatesSiteUrl = options.hostname !== void 0 || !touchesCheckout;
+  const offersCheckout = updatesSiteUrl && !touchesCheckout && canPrompt();
   let channelId = options.channelId;
+  let siteHostname;
   if (updatesSiteUrl) {
     try {
-      ({ channelId } = await runChannelSiteUrlFlow({
+      ({ channelId, hostname: siteHostname } = await runChannelSiteUrlFlow({
         storeHash,
         accessToken,
         apiHost,
         projectUuid: options.projectUuid ?? config2.get("projectUuid"),
         channelId: options.channelId,
-        hostname: options.hostname
+        hostname: options.hostname,
+        diagnoseCheckout: !offersCheckout
       }));
     } catch (error) {
       if (error instanceof NoLinkedProjectError) {
@@ -2365,6 +2582,22 @@ Examples:
       throw error;
     }
   }
+  if (offersCheckout && channelId !== void 0 && siteHostname !== void 0) {
+    const offered = await offerManagedCheckoutUrl({
+      storeHash,
+      accessToken,
+      apiHost,
+      channelId,
+      storefrontHostname: siteHostname,
+      config: config2,
+      // Explicit command, so an earlier decline doesn't silence it.
+      respectOptOut: false,
+      defaultAnswer: true
+    });
+    if (!offered) {
+      warnOnCrossDomainCheckout(await getChannelSite(channelId, storeHash, accessToken, apiHost));
+    }
+  }
   if (touchesCheckout) {
     const channel = channelId === void 0 ? await resolveChannel({ storeHash, accessToken, apiHost }) : { id: channelId, name: void 0 };
     const label = channel.name ? `"${channel.name}" (${channel.id})` : String(channel.id);
@@ -2378,7 +2611,7 @@ Examples:
       );
       consola.success(`Updated channel ${label} checkout URL to ${options.checkoutUrl}.`);
       reportChannelSite(updated);
-      await warnOnCrossDomainCheckout(updated, { storeHash, accessToken, apiHost });
+      warnOnCrossDomainCheckout(updated);
     } else {
       await deleteChannelCheckoutUrl(channel.id, storeHash, accessToken, apiHost);
       consola.success(
@@ -2386,7 +2619,7 @@ Examples:
       );
       const reverted = await getChannelSite(channel.id, storeHash, accessToken, apiHost);
       reportChannelSite(reverted);
-      await warnOnCrossDomainCheckout(reverted, { storeHash, accessToken, apiHost });
+      warnOnCrossDomainCheckout(reverted);
     }
   }
   process.exit(0);
@@ -2406,14 +2639,14 @@ Examples:
   # Append extra environment variables to .env.local
   $ catalyst channels link --channel-id 123 --env MY_FLAG=1`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).addOption(
-  new Option3("--channel-id <id>", "Link this channel directly, skipping the picker.").argParser(
+  new Option4("--channel-id <id>", "Link this channel directly, skipping the picker.").argParser(
     parseChannelId
   )
 ).option(
   "--env <vars...>",
   "Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable)."
 ).addOption(
-  new Option3("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   const config2 = getProjectConfig();
   const apiHost = resolveApiHost(options, config2);
@@ -2484,11 +2717,11 @@ Examples:
 ).option(
   "--additional-locales <locales...>",
   "Additional storefront locales, max 4 (e.g. --additional-locales es fr). Skips the additional-languages prompt."
-).addOption(new Option3("--sample-data", "Install sample data on the new channel.")).addOption(new Option3("--no-sample-data", "Create the channel without sample data.")).option(
+).addOption(new Option4("--sample-data", "Install sample data on the new channel.")).addOption(new Option4("--no-sample-data", "Create the channel without sample data.")).option(
   "--link",
   "Link the new channel to this project \u2014 write its credentials to .env.local without prompting."
 ).addOption(
-  new Option3("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   if (options.additionalLocales && options.additionalLocales.length > 4) {
     consola.error("You can only set up to 4 additional locales.");
@@ -2570,7 +2803,10 @@ async function resolveChannelTarget(options) {
     storeHash,
     accessToken,
     apiHost,
-    channelId: options.channelId
+    channelId: options.channelId,
+    // Read-only: these commands report on a channel, so the picker must not
+    // say "to update" — the shared default is written for `channels update`.
+    message: "Select a channel."
   });
   return {
     config: config2,
@@ -2592,7 +2828,7 @@ Examples:
   # Target a channel directly
   $ catalyst channels info --channel-id 123`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(
-  new Option3(
+  new Option4(
     "--channel-id <id>",
     "Skip the channel prompt and target this channel directly."
   ).argParser(parseChannelId)
@@ -2602,7 +2838,7 @@ Examples:
   const site = await getChannelSite(channel.id, storeHash, accessToken, apiHost);
   consola.success(`Channel ${label}:`);
   reportChannelSite(site);
-  const report = await warnOnCrossDomainCheckout(site, { storeHash, accessToken, apiHost });
+  const report = warnOnCrossDomainCheckout(site);
   if (report.crossDomain && report.storefrontOnManagedZone !== true) {
     const suggested = report.suggestion ?? "<domain>";
     if (!process.stdin.isTTY) {
@@ -2612,7 +2848,7 @@ Examples:
       process.exit(0);
       return;
     }
-    const shouldSet = await confirm3({
+    const shouldSet = await confirm4({
       message: "Set a checkout URL for this channel now?",
       default: true
     });
@@ -2638,7 +2874,7 @@ Examples:
 var channels = new Command3("channels").alias("channel").configureHelp({ showGlobalOptions: true }).description("Manage BigCommerce channels.").addCommand(info, { isDefault: true }).addCommand(create).addCommand(link).addCommand(update);
 
 // src/cli/commands/create.ts
-import { Command as Command4, InvalidArgumentError as InvalidArgumentError3, Option as Option4 } from "@commander-js/extra-typings";
+import { Command as Command4, InvalidArgumentError as InvalidArgumentError3, Option as Option5 } from "@commander-js/extra-typings";
 import { input as input5, select as select5 } from "@inquirer/prompts";
 import { execSync as execSync2 } from "child_process";
 import { colorize as colorize6 } from "consola/utils";
@@ -2915,7 +3151,7 @@ Examples:
   "Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable).",
   parseEnvFlag
 ).addOption(
-  new Option4(
+  new Option5(
     "--hosting <mode>",
     'Hosting mode: "self-hosted" (default) or "commerce" to set up Commerce Hosting at create time. When omitted, scaffolding is hosting-agnostic; run `catalyst deploy` later to opt in.'
   ).choices(["self-hosted", "commerce"])
@@ -2923,11 +3159,11 @@ Examples:
   "--use-existing",
   "Only used with --hosting commerce and --project-name. When the named project already exists on the store, reuse it instead of prompting. Has no effect without --hosting commerce."
 ).addOption(
-  new Option4("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
+  new Option5("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
 ).addOption(
-  new Option4("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
+  new Option5("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
 ).addOption(
-  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option5("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   const { ghRef, repository } = options;
   if (options.useExisting && options.hosting !== "commerce") {
@@ -3083,7 +3319,7 @@ ${steps.map((step) => `  ${colorize6("yellow", step)}`).join("\n")}`
 });
 
 // src/cli/commands/debug.ts
-import { Command as Command5, Option as Option5 } from "commander";
+import { Command as Command5, Option as Option6 } from "commander";
 
 // src/cli/lib/collect-diagnostics.ts
 import { parse } from "dotenv";
@@ -3334,7 +3570,7 @@ Examples:
 
   # Print machine-readable JSON (useful for copy/paste or piping)
   $ catalyst debug --json`
-).addOption(new Option5("--json", "Output the report as JSON.")).action((options) => {
+).addOption(new Option6("--json", "Output the report as JSON.")).action((options) => {
   const diagnostics = collectDiagnostics();
   if (options.json) {
     consola.log(JSON.stringify(diagnostics, null, 2));
@@ -3344,15 +3580,77 @@ Examples:
 });
 
 // src/cli/commands/deploy.ts
-import { confirm as confirm4 } from "@inquirer/prompts";
+import { confirm as confirm6 } from "@inquirer/prompts";
 import AdmZip from "adm-zip";
-import { Command as Command6, Option as Option6 } from "commander";
+import { Command as Command6, Option as Option7 } from "commander";
 import { colorize as colorize7 } from "consola/utils";
 import { access as access2, readdir, readFile } from "fs/promises";
 import { join as join13 } from "path";
 import yoctoSpinner3 from "yocto-spinner";
 import { z as z13 } from "zod";
 
+// src/cli/lib/deploy-channel-urls.ts
+import { confirm as confirm5 } from "@inquirer/prompts";
+function deployedChannelId(secrets) {
+  const raw = secrets.find((secret) => secret.key === "BIGCOMMERCE_CHANNEL_ID")?.value ?? process.env.BIGCOMMERCE_CHANNEL_ID;
+  const id = Number(raw);
+  return Number.isInteger(id) && id > 0 ? id : void 0;
+}
+async function offerChannelUrlUpdates(options) {
+  const { storeHash, accessToken, apiHost, projectUuid, config: config2, channelId } = options;
+  if (!canPrompt() || channelId === void 0) return;
+  const [site, projects2] = await Promise.all([
+    getChannelSite(channelId, storeHash, accessToken, apiHost),
+    fetchProjects(storeHash, accessToken, apiHost)
+  ]);
+  const deploymentHostnames = projects2.find((project) => project.uuid === projectUuid)?.deployment_hostnames ?? [];
+  const storefrontUrl = (findChannelSiteUrl(site, "primary") ?? site.url).replace(/\/$/, "");
+  let storefrontHostname = deploymentHostnames.find(
+    (deployed) => storefrontUrl === `https://${deployed}`
+  );
+  storefrontHostname ?? (storefrontHostname = await offerSiteUrl({ ...options, channelId }, storefrontUrl));
+  if (storefrontHostname === void 0) return;
+  await offerManagedCheckoutUrl({
+    storeHash,
+    accessToken,
+    apiHost,
+    channelId,
+    storefrontHostname,
+    config: config2,
+    respectOptOut: true,
+    defaultAnswer: false
+  });
+}
+async function offerSiteUrl(options, storefrontUrl) {
+  const { storeHash, accessToken, apiHost, projectUuid, config: config2, channelId } = options;
+  const declined = config2.get("declinedSiteUrlChannels") ?? [];
+  if (declined.includes(channelId)) return void 0;
+  const shouldUpdate = await confirm5({
+    message: `Channel ${channelId}'s site URL is ${storefrontUrl}. Point it at this deployment?`,
+    // Unasked-for after a deploy, so Enter mustn't change a live channel.
+    default: false
+  });
+  if (!shouldUpdate) {
+    config2.set("declinedSiteUrlChannels", [...declined, channelId]);
+    consola.info(
+      `Won't ask again for channel ${channelId}. To change it later, run \`catalyst channels update --channel-id ${channelId}\`.`
+    );
+    return void 0;
+  }
+  const { hostname } = await runChannelSiteUrlFlow({
+    storeHash,
+    accessToken,
+    apiHost,
+    projectUuid,
+    // The deploy knows both; the hostname picker only shows if it reported none.
+    channelId,
+    hostname: options.deploymentHostname,
+    // On the managed zone the checkout offer follows; elsewhere, warn instead.
+    diagnoseCheckout: !isManagedHostingHostname(options.deploymentHostname ?? "")
+  });
+  return hostname;
+}
+
 // src/cli/lib/deployment-errors.ts
 var ERROR_MESSAGES = {
   10: "Something went wrong on our end. Please try again. If the issue persists, contact support.",
@@ -3479,6 +3777,11 @@ var uploadBundleZip = async (uploadUrl) => {
   consola.success("Bundle uploaded successfully.");
   return true;
 };
+var NATIVE_HOSTING_ENV = {
+  type: "plain_text",
+  key: "CATALYST_HOSTING",
+  value: "native"
+};
 var parseEnvironmentVariables = (secretOption) => {
   return secretOption?.map((envVar) => {
     const { key, value } = parseEnvAssignment(envVar);
@@ -3607,6 +3910,10 @@ var deploy = new Command6("deploy").configureHelp({ showGlobalOptions: true }).d
 Environment variables saved with \`catalyst env add\` are sent automatically on every deploy.
 Use \`--secret\` to set or override a variable for a single run.
 
+Without \`--update-site-url\` or \`--update-checkout-url\`, an interactive deploy offers to
+point the channel's site URL at the deployment and to move its checkout onto the same domain.
+Each is checked on every deploy; declining either is saved in .bigcommerce/project.json.
+
 Example:
   $ catalyst deploy --secret BIGCOMMERCE_STORE_HASH=<YOUR_STORE_HASH> --secret BIGCOMMERCE_STOREFRONT_TOKEN=<YOUR_STOREFRONT_TOKEN>`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).option(
@@ -3616,7 +3923,7 @@ Example:
   "--update-checkout-url",
   "After a successful deploy, prompt to update a channel's checkout URL."
 ).addOption(
-  new Option6(
+  new Option7(
     "--secret <value>",
     "Secret to set for this deployment (repeatable). Overrides a stored value for the same key. Format: --secret KEY=VALUE"
   ).argParser((value, previous = []) => {
@@ -3626,7 +3933,7 @@ Example:
   "--prebuilt",
   "Skip the build step. Requires .bigcommerce/dist/ to already contain build output."
 ).addOption(
-  new Option6(
+  new Option7(
     "--wrangler-version <version>",
     `Wrangler version or dist-tag to build with. Ignored with --prebuilt. Defaults to ${WRANGLER_VERSION}.`
   ).argParser(parseWranglerVersion)
@@ -3676,7 +3983,7 @@ Example:
     consola.success(`Linked project "${selected.name}".`);
   }
   if (!getProjectState().isTransformed) {
-    const shouldSetup = await confirm4({
+    const shouldSetup = await confirm6({
       message: "Your project is not yet set up for Commerce Hosting deployments. Would you like to run the Commerce Hosting setup now?",
       default: true
     });
@@ -3732,7 +4039,7 @@ Example:
   const flagSecrets = parseEnvironmentVariables(options.secret) ?? [];
   const persistedSecrets = toDeploymentSecrets(getStoredEnv(config2));
   const mergedSecrets = mergeDeploymentSecrets(persistedSecrets, flagSecrets);
-  const environmentVariables = mergedSecrets.length > 0 ? mergedSecrets : void 0;
+  const environmentVariables = [...mergedSecrets, NATIVE_HOSTING_ENV];
   const { deployment_uuid: deploymentUuid } = await createDeployment(
     projectUuid,
     uploadSignature.upload_uuid,
@@ -3756,9 +4063,10 @@ Example:
     );
   };
   let resolvedChannelId;
+  let siteHostname;
   if (options.updateSiteUrl) {
     try {
-      ({ channelId: resolvedChannelId } = await runChannelSiteUrlFlow({
+      ({ channelId: resolvedChannelId, hostname: siteHostname } = await runChannelSiteUrlFlow({
         storeHash,
         accessToken,
         apiHost,
@@ -3775,17 +4083,33 @@ Example:
         storeHash,
         accessToken,
         apiHost,
-        channelId: resolvedChannelId
+        channelId: resolvedChannelId,
+        storefrontHostname: siteHostname
       });
     } catch (error) {
       warnChannelFlowFailed("checkout URL", error);
     }
   }
+  if (!options.updateSiteUrl && !options.updateCheckoutUrl) {
+    try {
+      await offerChannelUrlUpdates({
+        storeHash,
+        accessToken,
+        apiHost,
+        projectUuid,
+        config: config2,
+        deploymentHostname,
+        channelId: deployedChannelId(mergedSecrets)
+      });
+    } catch (error) {
+      warnChannelFlowFailed("URLs", error);
+    }
+  }
 });
 
 // src/cli/commands/domains.ts
-import { confirm as confirm5, select as select6 } from "@inquirer/prompts";
-import { Command as Command7, Option as Option7 } from "commander";
+import { confirm as confirm7, select as select6 } from "@inquirer/prompts";
+import { Command as Command7, Option as Option8 } from "commander";
 import { colorize as colorize9 } from "consola/utils";
 
 // src/cli/lib/domains.ts
@@ -4357,7 +4681,7 @@ Examples:
   # Show pending domains only
   $ catalyst domains list --status pending`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).option("--domain <domain>", "Only show a specific domain.").addOption(
-  new Option7("--status <status>", "Filter by verification status.").choices(
+  new Option8("--status <status>", "Filter by verification status.").choices(
     DOMAIN_STATUS_FILTERS
   )
 ).action(async (options) => {
@@ -4566,7 +4890,7 @@ Examples:
     context.apiHost
   );
   if (current.verification_status === "verified" && !options.force) {
-    const confirmed = await confirm5({
+    const confirmed = await confirm7({
       message: `Remove active domain ${current.domain}? Traffic may stop routing to this project.`,
       default: false
     });
@@ -4662,7 +4986,7 @@ var env = new Command8("env").configureHelp({ showGlobalOptions: true }).descrip
 ).addCommand(add2).addCommand(remove2).addCommand(list2);
 
 // src/cli/commands/logs.ts
-import { Command as Command9, InvalidArgumentError as InvalidArgumentError4, Option as Option8 } from "commander";
+import { Command as Command9, InvalidArgumentError as InvalidArgumentError4, Option as Option9 } from "commander";
 import { colorize as colorize10 } from "consola/utils";
 import { z as z16 } from "zod";
 var DEFAULT_CONNECTION_TTL_MS = 1 * 60 * 1e3;
@@ -4879,7 +5203,7 @@ Examples:
   # Tail logs as raw JSON (useful for piping to other tools)
   $ catalyst logs tail --format json`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option8("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
+  new Option9("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -4980,7 +5304,7 @@ Examples:
   # Raw JSON (NDJSON) for piping to other tools
   $ catalyst logs query --since 2d --format json`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option8(
+  new Option9(
     "--since <duration>",
     "Relative window ending at --end (default: now), e.g. 30m, 6h, 2d (units: s, m, h, d)."
   ).conflicts("start")
@@ -4988,28 +5312,28 @@ Examples:
   "--end <time>",
   "Window end: ISO-8601 timestamp or Unix epoch (seconds). Defaults to now. The window must not exceed 7 days."
 ).option("--method <method>", "Filter by request HTTP method (case-insensitive).").addOption(
-  new Option8("--status-code <code>", "Filter by response status code (100-599).").argParser(
+  new Option9("--status-code <code>", "Filter by response status code (100-599).").argParser(
     parseIntInRange("--status-code", 100, 599)
   )
 ).option("--url-like <substring>", "Filter by URL substring (case-sensitive).").addOption(
-  new Option8("--level-min <level>", "Minimum log level.").choices(Array.from(LOG_LEVELS))
+  new Option9("--level-min <level>", "Minimum log level.").choices(Array.from(LOG_LEVELS))
 ).addOption(
-  new Option8(
+  new Option9(
     "--limit <count>",
     "Maximum entries per page (1-500). Defaults to the API default (100)."
   ).argParser(parseIntInRange("--limit", 1, 500))
 ).addOption(
-  new Option8(
+  new Option9(
     "--after <cursor>",
     "Return the page after (older than) this cursor, from a previous page's end_cursor."
   ).conflicts("before")
 ).addOption(
-  new Option8(
+  new Option9(
     "--before <cursor>",
     "Return the page before (newer than) this cursor, from a previous page's start_cursor."
   )
 ).addOption(
-  new Option8("--format <format>", "Output format for log entries.").choices(["json", "pretty", "default", "short", "request"]).default("default")
+  new Option9("--format <format>", "Output format for log entries.").choices(["json", "pretty", "default", "short", "request"]).default("default")
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -5070,7 +5394,7 @@ Examples:
 var logs = new Command9("logs").alias("log").configureHelp({ showGlobalOptions: true }).description("View logs from your deployed application.").addCommand(tail, { isDefault: true }).addCommand(query);
 
 // src/cli/commands/projects.ts
-import { confirm as confirm6, input as input6, select as select7 } from "@inquirer/prompts";
+import { confirm as confirm8, input as input6, select as select7 } from "@inquirer/prompts";
 import { Command as Command10 } from "commander";
 import { colorize as colorize11 } from "consola/utils";
 async function offerCommerceHostingSetup(projectUuid, credentials) {
@@ -5079,7 +5403,7 @@ async function offerCommerceHostingSetup(projectUuid, credentials) {
     await cleanupCloudflareIncompatibilities(projectDir);
     return;
   }
-  const shouldSetup = await confirm6({
+  const shouldSetup = await confirm8({
     message: "Your project has been linked, but is not fully set up for Commerce Hosting deployments yet. Would you like to run the setup now?",
     default: true
   });
@@ -5275,7 +5599,7 @@ Examples:
   }
   if (!options.force) {
     const label = targetName ? `"${targetName}" (${targetUuid})` : targetUuid;
-    const confirmed = await confirm6({
+    const confirmed = await confirm8({
       message: `Are you sure you want to delete project ${label}? This action is irreversible and will permanently destroy the project and all of its data.`,
       default: false
     });
@@ -5352,7 +5676,7 @@ Example:
 });
 
 // src/cli/commands/telemetry.ts
-import { Argument, Command as Command12, Option as Option9 } from "commander";
+import { Argument, Command as Command12, Option as Option10 } from "commander";
 import { colorize as colorize12 } from "consola/utils";
 var telemetryService = getTelemetry();
 var isEnabled = telemetryService.isEnabled();
@@ -5370,7 +5694,7 @@ Examples:
 
   # Disable telemetry collection
   $ catalyst telemetry --disable`
-).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option9("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
+).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option10("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
   if (options.enable || arg === "enable") {
     telemetryService.setEnabled(true);
     isEnabled = true;
@@ -5397,8 +5721,8 @@ Examples:
 });
 
 // src/cli/commands/upgrade.ts
-import { Command as Command13, Option as Option10 } from "@commander-js/extra-typings";
-import { confirm as confirm7 } from "@inquirer/prompts";
+import { Command as Command13, Option as Option11 } from "@commander-js/extra-typings";
+import { confirm as confirm9 } from "@inquirer/prompts";
 import { execa as execa4 } from "execa";
 import {
   access as access3,
@@ -5559,6 +5883,72 @@ async function findStaleCli(pkgRaw) {
   const current = minVersion2(range)?.version;
   return current !== void 0 && semverLt2(current, latest) ? { current, latest } : null;
 }
+var CLI_MANAGED_SCRIPTS = ["build", "start", "deploy"];
+var ScriptsPackageJson = z17.looseObject({
+  scripts: z17.record(z17.string(), z17.string()).optional()
+});
+var readScripts = (raw) => {
+  try {
+    return ScriptsPackageJson.parse(JSON.parse(raw)).scripts ?? {};
+  } catch {
+    return {};
+  }
+};
+var SCRIPTS_BLOCK = /"scripts"\s*:\s*\{(?:[^{}"]|"(?:[^"\\]|\\.)*")*\}/;
+var rewriteScriptCommand = (raw, name, command) => {
+  const block = SCRIPTS_BLOCK.exec(raw);
+  if (!block) return raw;
+  const splice = (replacement) => raw.slice(0, block.index) + replacement + raw.slice(block.index + block[0].length);
+  const updated = block[0].replace(
+    new RegExp(`("${escapeRegExp(name)}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`),
+    (_match, key) => `${key}${JSON.stringify(command)}`
+  );
+  if (updated !== block[0]) return splice(updated);
+  const closeIdx = block[0].length - 1;
+  const head = block[0].slice(0, closeIdx).replace(/\s+$/, "");
+  const closeIndent = /\n([ \t]*)$/.exec(block[0].slice(0, closeIdx))?.[1] ?? "";
+  const entryIndent = /\n([ \t]*)"/.exec(block[0])?.[1] ?? `${closeIndent}  `;
+  const separator = head.endsWith("{") ? "" : ",";
+  return splice(
+    `${head}${separator}
+${entryIndent}${JSON.stringify(name)}: ${JSON.stringify(command)}
+${closeIndent}}`
+  );
+};
+async function normalizeManagedScripts(ourPkgRaw, baseDir, theirsDir) {
+  const basePath = join15(baseDir, "package.json");
+  const theirsPath = join15(theirsDir, "package.json");
+  const [originalBase, originalTheirs] = await Promise.all([
+    readFile2(basePath, "utf-8").catch(() => null),
+    readFile2(theirsPath, "utf-8").catch(() => null)
+  ]);
+  if (originalBase === null || originalTheirs === null) return { pinned: [], upstreamChanged: [] };
+  const ourScripts = readScripts(ourPkgRaw);
+  const baseScripts = readScripts(originalBase);
+  const theirsScripts = readScripts(originalTheirs);
+  const decisions = CLI_MANAGED_SCRIPTS.flatMap((name) => {
+    const ours = ourScripts[name];
+    return ours !== void 0 && ours !== baseScripts[name] ? [{ name, ours }] : [];
+  });
+  const upstreamChanged = decisions.flatMap(({ name }) => {
+    const base = baseScripts[name] ?? null;
+    const theirs = theirsScripts[name] ?? null;
+    return base !== theirs ? [{ name, base, theirs }] : [];
+  });
+  const baseRaw = decisions.reduce(
+    (acc, { name, ours }) => rewriteScriptCommand(acc, name, ours),
+    originalBase
+  );
+  const theirsRaw = decisions.reduce(
+    (acc, { name, ours }) => rewriteScriptCommand(acc, name, ours),
+    originalTheirs
+  );
+  await Promise.all([
+    baseRaw === originalBase ? null : writeFile2(basePath, baseRaw),
+    theirsRaw === originalTheirs ? null : writeFile2(theirsPath, theirsRaw)
+  ]);
+  return { pinned: decisions.map(({ name }) => name), upstreamChanged };
+}
 async function mergeFile(oursPath, basePath, theirsPath) {
   const merged = await execa4(
     "git",
@@ -5912,7 +6302,7 @@ async function resolveBaseRef(project, fromOption, assumeYes) {
   const guess = `${family}@${project.pkg.version}`;
   consola.warn(`No \`catalyst.ref\` found in package.json. Inferred base: ${guess}`);
   if (assumeYes) return guess;
-  const ok = await confirm7({ message: `Upgrade from ${guess}?`, default: true }).catch(() => false);
+  const ok = await confirm9({ message: `Upgrade from ${guess}?`, default: true }).catch(() => false);
   if (!ok) {
     consola.info("Re-run with `--from <ref>` to set the base version explicitly.");
     return null;
@@ -5930,6 +6320,20 @@ ${rows}
 They resolve to your local packages/ copies, which \`catalyst upgrade\` does not update \u2014 so they never receive upgrades.`
   );
 }
+function printManagedScriptFindings(findings) {
+  if (findings.length === 0) return;
+  const pad = Math.max(...findings.map((finding) => finding.name.length));
+  const show = (command) => command ?? "(absent)";
+  const rows = findings.map(
+    (finding) => `  ${finding.name.padEnd(pad)}  ${show(finding.base)} \u2192 ${show(finding.theirs)}`
+  ).join("\n");
+  consola.warn(
+    `Core's own version of ${findings.length} npm script${findings.length === 1 ? "" : "s"} the CLI manages for you changed:
+${rows}
+
+Your project keeps its \`catalyst\`-backed command, which is almost always what you want \u2014 \`catalyst build\`/\`start\`/\`deploy\` wrap the equivalent \`next\` command. Apply the change by hand only if you have opted out of the CLI scripts.`
+  );
+}
 function printSummary({
   result,
   relDir,
@@ -5973,23 +6377,42 @@ Resolve them, then: git add ${relDir} && git commit${install}`
     );
   }
 }
+async function reconcileNativeHosting(catalystRoot, result) {
+  const state = getProjectState(catalystRoot);
+  if (!state.isLinked && !state.isTransformed) return;
+  const instrumentationRel = "instrumentation.ts";
+  const instrumentationPath = join15(catalystRoot, instrumentationRel);
+  const hadInstrumentation = await pathExists(instrumentationPath);
+  try {
+    await cleanupCloudflareIncompatibilities(catalystRoot);
+  } catch (err) {
+    consola.warn(
+      `Couldn't fully reconcile native-hosting files (${err instanceof Error ? err.message : String(err)}). Remove @vercel/otel from package.json by hand if the merge brought it back.`
+    );
+  }
+  if (hadInstrumentation && !await pathExists(instrumentationPath)) {
+    result.conflicted = result.conflicted.filter((rel) => rel !== instrumentationRel);
+    result.applied = result.applied.filter((rel) => rel !== instrumentationRel);
+    result.added = result.added.filter((rel) => rel !== instrumentationRel);
+  }
+}
 var upgrade = new Command13("upgrade").configureHelp({ showGlobalOptions: true }).aliases([
   "up",
   // These are hidden aliases
   "upgrayedd",
   "ugrad"
 ]).description("Upgrade your Catalyst project to a newer version by applying a 3-way merge.").argument("[version]", "Target version to upgrade to (default: latest)").addOption(
-  new Option10(
+  new Option11(
     "--ref <ref>",
     "Full git tag to upgrade to, e.g. an integration family like @bigcommerce/catalyst-makeswift@1.7.0. Overrides [version]."
   )
-).addOption(new Option10("--from <ref>", "Base ref to upgrade from (when catalyst.ref is missing)")).option("--dry-run", "Generate and display the diff without applying it").option("--yes", "Skip confirmation prompts (e.g. inferred base ref)").addOption(
-  new Option10(
+).addOption(new Option11("--from <ref>", "Base ref to upgrade from (when catalyst.ref is missing)")).option("--dry-run", "Generate and display the diff without applying it").option("--yes", "Skip confirmation prompts (e.g. inferred base ref)").addOption(
+  new Option11(
     "--strategy <strategy>",
     "Merge engine: tree (git merge-tree, full fidelity), per-file (git merge-file, no-history fallback), or auto (tree when git >= 2.38, else per-file)"
   ).choices(["auto", "tree", "per-file"]).default("auto").hideHelp()
 ).addOption(
-  new Option10("--repository <owner/repo>", "GitHub repository to pull versions from").default(
+  new Option11("--repository <owner/repo>", "GitHub repository to pull versions from").default(
     DEFAULT_REPOSITORY
   )
 ).addHelpText(
@@ -6104,6 +6527,11 @@ to raise the GitHub API rate limit.`
       baseVersions,
       targetVersions
     );
+    const { upstreamChanged: managedScripts } = await normalizeManagedScripts(
+      project.rawContent,
+      baseDir,
+      theirsDir
+    );
     if (options.dryRun) {
       const diffSpinner = yoctoSpinner4().start("Generating diff...");
       const diff = await execa4(
@@ -6124,6 +6552,7 @@ to raise the GitHub API rate limit.`
       consola.log("\nDiff preview (--dry-run, not applied):\n");
       consola.log(diff.stdout);
       printWorkspaceFindings(workspaceDeps);
+      printManagedScriptFindings(managedScripts);
       return;
     }
     const strategy = await resolveStrategy(options.strategy);
@@ -6171,10 +6600,11 @@ to raise the GitHub API rate limit.`
         );
       }
     }
+    printManagedScriptFindings(managedScripts);
     printWorkspaceFindings(workspaceDeps);
     let migratedDeps = 0;
     if (workspaceDeps.length) {
-      const accepted = stampedText !== null && (options.yes === true || Boolean(process.stdin.isTTY) && await confirm7({
+      const accepted = stampedText !== null && (options.yes === true || Boolean(process.stdin.isTTY) && await confirm9({
         message: "Replace them with the published versions?",
         default: true
       }).catch(() => false));
@@ -6190,6 +6620,7 @@ to raise the GitHub API rate limit.`
         );
       }
     }
+    await reconcileNativeHosting(catalystRoot, result);
     try {
       await applyIndexState(gitRoot, relDir, baseDir, theirsDir, result, stampedText !== null);
     } catch (err) {