@cursor/bdk 0.2.1

package/dist/internal/cli-deploy.js

@@ -0,0 +1,1930 @@
+/**
+ * `agent-sdk deploy | deployments | deployment | stop | delete | rotate-token |
+ * secrets set|list|unset` — Heroku-style deploys
+ * onto Cursor's managed agent-serve hosting.
+ *
+ * All intelligence is server-side (backend/server/src/agentServe/); these
+ * handlers resolve parameters (credentials, team, slug, the project's
+ * `hosting` / `architecture` manifest block), call the v1 agent-serve or
+ * v2 agentsdk management API through `deploy-client.ts`, poll status, and
+ * render.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { basename, resolve } from "node:path";
+import { catchAuthDeclaration, isPublicEndpointPolicy } from "../channels.js";
+import { isCursorAccountTransport, } from "../types.js";
+import { CursorBackendClient } from "./cursor/backend-client.js";
+import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT } from "./cursor/credentials.js";
+import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
+import { readDeployTemplate } from "./cursor-agent-template.js";
+import { AgentServeDeployClient, DeployApiError, deploymentServiceAccountId, slugFromDirectoryName, TERMINAL_AGENTKIT_DEPLOY_STATUSES, TERMINAL_DEPLOY_STATUSES, validateDeploymentSlug, } from "./deploy-client.js";
+import { inferDeployGitSource } from "./deploy-source.js";
+import { describeError } from "./describe-error.js";
+import { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, } from "./discovery.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { isReservedSecretName, isValidCursorEventRepo, validateSettableSecretName, } from "./hosting.js";
+import { deploymentArchitecture, rejectV2ForLegacyCommand } from "./legacy-command-guard.js";
+import { deployProgressLabel, sanitizeCustomerError } from "./logs-client.js";
+import { sleep } from "./sleep.js";
+import { stderrPalette } from "./terminal-style.js";
+const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_DEPLOY_TIMEOUT_MS = 10 * 60 * 1000;
+/** `--multi-tenant` HTTP deploy is Anysphere-only (team id 1). */
+const MULTI_TENANT_HTTP_DEPLOY_TEAM_ID = 1;
+/**
+ * Credentials → deploy client → team id. Shared by deploy commands and
+ * `--prod` AX routing. Returns an exit code (error already rendered) on
+ * failure.
+ */
+export function resolveDeployAuth(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const err = (_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text));
+        const resolved = yield resolveApiKey(options.apiKey === undefined ? undefined : { apiKey: options.apiKey });
+        if (resolved === undefined) {
+            err(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
+            return 1;
+        }
+        // The deployment management routes live on the external API host
+        // (api.cursor.com), not the default backend (api2.cursor.sh) — see
+        // cursorExternalApiUrl. GetMe below stays on the resolved backend.
+        const client = new AgentServeDeployClient({
+            backendUrl: cursorExternalApiUrl(),
+            apiKey: resolved.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        let teamId;
+        if (options.team !== undefined) {
+            teamId = Number.parseInt(options.team, 10);
+            if (Number.isNaN(teamId) || teamId <= 0) {
+                err(`Invalid --team: ${options.team} (expected a positive team id)\n`);
+                return 1;
+            }
+        }
+        else {
+            const account = new CursorBackendClient({
+                backendUrl: resolved.backendUrl,
+                apiKey: resolved.apiKey,
+                fetchImpl: options.fetchImpl,
+            });
+            let identity;
+            try {
+                identity = yield account.getMe();
+            }
+            catch (error) {
+                err(`Could not resolve your team from the Cursor account: ${describeError(error)}\nPass --team <id> explicitly.\n`);
+                return 1;
+            }
+            if (identity.teamId === undefined || identity.teamId <= 0) {
+                err("This Cursor account has no default team; pass --team <id> (find it in the Cursor dashboard URL).\n");
+                return 1;
+            }
+            teamId = identity.teamId;
+            const dim = stderrPalette().dim;
+            err(`${dim(`Using team ${teamId}${identity.teamName === undefined ? "" : ` (${identity.teamName})`}`)}\n${dim("  the account's team — pass --team to override.")}\n`);
+        }
+        return {
+            client,
+            teamId,
+            apiKey: resolved.apiKey,
+            backendUrl: resolved.backendUrl,
+        };
+    });
+}
+/**
+ * Shared preamble: credentials → client → team id. Returns an exit code
+ * (with the error already rendered) when resolution fails.
+ */
+export function prepare(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((text) => void process.stdout.write(text));
+        const err = (_b = options.err) !== null && _b !== void 0 ? _b : ((text) => void process.stderr.write(text));
+        const auth = yield resolveDeployAuth({
+            team: options.team,
+            apiKey: options.apiKey,
+            fetchImpl: options.fetchImpl,
+            err,
+        });
+        if (typeof auth === "number") {
+            return auth;
+        }
+        return {
+            client: auth.client,
+            teamId: auth.teamId,
+            apiKey: auth.apiKey,
+            backendUrl: auth.backendUrl,
+            json: options.json === true,
+            noWait: options.noWait === true,
+            pollIntervalMs: (_c = options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS,
+            timeoutMs: (_d = options.timeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_DEPLOY_TIMEOUT_MS,
+            out,
+            err,
+        };
+    });
+}
+// ============================================================================
+// deploy
+// ============================================================================
+export function cmdDeploy(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        if (options.multiTenant === true && ctx.teamId !== MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+            ctx.err("--multi-tenant is not available for this team.\n");
+            return 1;
+        }
+        const targets = yield resolveDeployTargets(options, ctx);
+        if (typeof targets === "number") {
+            return targets;
+        }
+        if (targets.length === 1) {
+            return deployOne(ctx, options, targets[0]);
+        }
+        // Multi-agent parent: when every child declares `architecture: "v2"`,
+        // the v2 control plane models sibling agents as release components of
+        // ONE application, so deploy them together (one app, one component per
+        // child) instead of minting a separate application per child. Mixed and
+        // v1 parents keep the per-child sequential deploys.
+        const manifests = [];
+        for (const target of targets) {
+            manifests.push(yield readDeployManifest(target.dir));
+        }
+        if (manifests.every(manifest => manifest.architecture === "v2")) {
+            return deployAgentsdkApplication(ctx, options, targets, {
+                // `persistent` is per child agent, like `agentPath`: each release
+                // component carries its own.
+                componentPersistent: Object.fromEntries(targets.map((target, index) => { var _a; return [target.slug, ((_a = manifests[index]) === null || _a === void 0 ? void 0 : _a.persistent) === true]; })),
+                componentImage: Object.fromEntries(targets.flatMap((target, index) => { var _a; return ((_a = manifests[index]) === null || _a === void 0 ? void 0 : _a.image) === undefined ? [] : [[target.slug, manifests[index].image]]; })),
+                hasScmChannels: manifests.some(manifest => manifest.hasScmChannels),
+                declaredSecretNames: [
+                    ...new Set(manifests.flatMap(manifest => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
+                ],
+                hasDeploymentsChannels: manifests.some(manifest => manifest.hasDeploymentsChannels),
+            });
+        }
+        if (!ctx.json && manifests.some(manifest => manifest.architecture === "v2")) {
+            ctx.err(`warning: agents under this parent mix architectures; deploying each separately (v2 children become standalone single-component applications).\n`);
+        }
+        // --path is per-agent (relative to the repo root). When deploying several
+        // agents, ignore a shared --path so each target can infer its own path.
+        let deployOptions = options;
+        if (options.path !== undefined) {
+            if (!ctx.json) {
+                ctx.err(`warning: ignoring --path ${JSON.stringify(options.path)} for a multi-agent deploy; each agent infers its own path from git.\n`);
+            }
+            deployOptions = Object.assign(Object.assign({}, options), { path: undefined });
+        }
+        // Multi-agent batch: deploy sequentially; --json emits an array.
+        const jsonResults = [];
+        let failures = 0;
+        for (const [index, target] of targets.entries()) {
+            if (!ctx.json) {
+                ctx.err(`\n=== [${index + 1}/${targets.length}] Deploying ${target.slug} ===\n`);
+            }
+            const before = jsonResults.length;
+            const code = yield deployOne(ctx, deployOptions, target, {
+                jsonCollect: ctx.json ? jsonResults : undefined,
+            });
+            if (code !== 0) {
+                failures += 1;
+                if (ctx.json && jsonResults.length === before) {
+                    jsonResults.push({ slug: target.slug, error: "deploy failed" });
+                }
+            }
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(jsonResults, null, 2)}\n`);
+        }
+        else if (failures > 0) {
+            ctx.err(`\n${failures} of ${targets.length} deploy(s) failed.\n`);
+        }
+        else {
+            ctx.err(`\nDeployed ${targets.length} agents.\n`);
+        }
+        return failures === 0 ? 0 : 1;
+    });
+}
+/**
+ * Resolve which agent directory(ies) to deploy from `--dir` / `--slug` /
+ * `--all`, with an interactive picker when a multi-agent parent is on a TTY.
+ */
+function resolveDeployTargets(options, ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const dir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
+        if (options.slug !== undefined) {
+            const slugError = validateDeploymentSlug(options.slug);
+            if (slugError !== undefined) {
+                ctx.err(`${slugError}\n`);
+                return 1;
+            }
+        }
+        if (options.all === true && options.slug !== undefined) {
+            ctx.err("Pass either --slug or --all, not both.\n");
+            return 1;
+        }
+        if (yield isAgentProjectDir(dir)) {
+            if (options.all === true) {
+                ctx.err(`--all requires a multi-agent parent directory (several child agents under --dir); ${dir} is a single agent project.\n`);
+                return 1;
+            }
+            let slug;
+            if (options.slug !== undefined) {
+                slug = options.slug;
+            }
+            else {
+                const derived = slugFromDirectoryName(basename(dir));
+                if (derived === undefined) {
+                    ctx.err(`Could not derive a deployment slug from the directory name ${JSON.stringify(basename(dir))}; pass --slug.\n`);
+                    return 1;
+                }
+                slug = derived;
+                if (!ctx.json) {
+                    ctx.err(`Deploying as "${slug}" (from the directory name).\n`);
+                }
+            }
+            return [{ slug, dir }];
+        }
+        let children;
+        try {
+            children = yield listChildAgentDirs(dir);
+        }
+        catch (error) {
+            ctx.err(`${describeError(error)}\n`);
+            return 1;
+        }
+        // Deploy slugs are lowercase-only; normalize directory names the same way
+        // single-agent deploy does so MixedCase child dirs still deploy.
+        children = children.flatMap(child => {
+            const slug = slugFromDirectoryName(basename(child.dir));
+            if (slug === undefined) {
+                return [];
+            }
+            return [{ slug, dir: child.dir }];
+        });
+        if (children.length === 0) {
+            if (options.all === true) {
+                ctx.err(`--all requires child agent projects under --dir; none found in ${dir}.\n`);
+                return 1;
+            }
+            // Bare-slug deploy against a non-agent directory (still requires --repo).
+            let slug;
+            if (options.slug !== undefined) {
+                slug = options.slug;
+            }
+            else {
+                const derived = slugFromDirectoryName(basename(dir));
+                if (derived === undefined) {
+                    ctx.err(`No agent projects under ${dir}, and could not derive a slug from ${JSON.stringify(basename(dir))}; pass --slug or --dir <agent>.\n`);
+                    return 1;
+                }
+                slug = derived;
+                if (!ctx.json) {
+                    ctx.err(`Deploying as "${slug}" (no agent project at ${dir}).\n`);
+                }
+            }
+            return [{ slug, dir }];
+        }
+        if (children.length === 1) {
+            const only = children[0];
+            if (options.all === true) {
+                // One child is fine for --all (degenerate multi-agent parent).
+            }
+            else if (options.slug !== undefined && options.slug.toLowerCase() !== only.slug) {
+                ctx.err(`No agent "${options.slug}" under ${dir}; found "${only.slug}".\n`);
+                return 1;
+            }
+            if (!ctx.json) {
+                ctx.err(`Deploying "${only.slug}" (only agent under ${basename(dir)}).\n`);
+            }
+            return [only];
+        }
+        // Multiple children.
+        if (options.all === true) {
+            if (!ctx.json) {
+                ctx.err(`Deploying all ${children.length} agents under ${basename(dir)}: ${children.map(c => c.slug).join(", ")}.\n`);
+            }
+            return [...children];
+        }
+        if (options.slug !== undefined) {
+            const wanted = options.slug.toLowerCase();
+            const match = children.find(child => child.slug === wanted);
+            if (match === undefined) {
+                ctx.err(`No agent "${options.slug}" under ${dir}.\n` +
+                    formatAgentList(children) +
+                    `Pass --slug <name> or --all.\n`);
+                return 1;
+            }
+            return [match];
+        }
+        // An all-v2 parent deploys as ONE application (siblings are components
+        // of a single app on the v2 control plane), so "deploy the parent" is
+        // unambiguous and needs no picker or --all. A child that is v1 — or
+        // fails to load — keeps the interactive picker below.
+        if (yield allChildrenAreV2(children)) {
+            if (!ctx.json) {
+                ctx.err(`Deploying all ${children.length} v2 agents under ${basename(dir)} as one application (pass --slug <name> to deploy a single agent standalone).\n`);
+            }
+            return [...children];
+        }
+        const chooser = (_b = options.chooseTargets) !== null && _b !== void 0 ? _b : (agents => { var _a, _b; return promptChooseDeployTargets(agents, {
+            err: ctx.err,
+            stdin: (_a = options.stdin) !== null && _a !== void 0 ? _a : process.stdin,
+            interactive: ctx.json !== true &&
+                ((_b = options.stdin) !== null && _b !== void 0 ? _b : process.stdin).isTTY === true &&
+                process.stderr.isTTY === true,
+        }); });
+        const chosen = yield chooser(children);
+        if (chosen === null) {
+            ctx.err("Deploy cancelled.\n");
+            return 1;
+        }
+        if (chosen.length === 0) {
+            ctx.err(`Multiple agents under ${dir}:\n` +
+                formatAgentList(children) +
+                `Pass --slug <name> or --all (or re-run on a TTY to pick interactively).\n`);
+            return 1;
+        }
+        return chosen;
+    });
+}
+function formatAgentList(agents) {
+    return agents.map((agent, i) => `  ${i + 1}) ${agent.slug}\n`).join("");
+}
+/**
+ * True when every child agent project loads and declares
+ * `architecture: "v2"`. Broken projects count as not-v2 so target
+ * resolution falls back to the picker instead of failing the whole deploy
+ * on a child the user might not even select.
+ */
+function allChildrenAreV2(children) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (const child of children) {
+            try {
+                if ((yield readDeployManifest(child.dir)).architecture !== "v2") {
+                    return false;
+                }
+            }
+            catch (_a) {
+                return false;
+            }
+        }
+        return true;
+    });
+}
+/**
+ * TTY picker for multi-agent parents. Non-interactive callers get `[]`
+ * so {@link resolveDeployTargets} can print the --slug/--all hint.
+ */
+export function promptChooseDeployTargets(agents, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        options.err(`Multiple agents (${agents.length}):\n` + formatAgentList(agents) + `  a) all\n`);
+        if (!options.interactive) {
+            return [];
+        }
+        options.err('Deploy which? Enter a number, slug, "all", or "q" to cancel: ');
+        const readLine = createLineReader(options.stdin);
+        // createLineReader pauses until data; ensure stdin is flowing on a TTY.
+        (_b = (_a = options.stdin).resume) === null || _b === void 0 ? void 0 : _b.call(_a);
+        const answer = (_c = (yield readLine())) === null || _c === void 0 ? void 0 : _c.trim().toLowerCase();
+        if (answer === undefined || answer === "q" || answer === "quit") {
+            return null;
+        }
+        if (answer === "a" || answer === "all" || answer === "*") {
+            return [...agents];
+        }
+        const asIndex = Number.parseInt(answer, 10);
+        if (!Number.isNaN(asIndex) &&
+            String(asIndex) === answer &&
+            asIndex >= 1 &&
+            asIndex <= agents.length) {
+            return [agents[asIndex - 1]];
+        }
+        const bySlug = agents.find(agent => agent.slug.toLowerCase() === answer);
+        if (bySlug !== undefined) {
+            return [bySlug];
+        }
+        options.err(`Unrecognized choice ${JSON.stringify(answer)} — expected 1–${agents.length}, a slug, "all", or "q". Aborting.\n`);
+        return null;
+    });
+}
+function deployOne(ctx, options, target, extras) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+        const { dir, slug } = target;
+        // Fill --repo/--ref/--path from the local git checkout when omitted so
+        // `agent-sdk deploy` inside an agent directory is enough. Only probe git
+        // for real agent projects (avoids ambient monorepo remotes when someone
+        // deploys a bare --slug). Explicit flags always win.
+        const isAgent = yield isAgentProjectDir(dir);
+        const needsGitInference = isAgent &&
+            (options.repo === undefined || options.ref === undefined || options.path === undefined);
+        const inferred = needsGitInference
+            ? yield inferDeployGitSource(dir, Object.assign({}, (options.git === undefined ? {} : { git: options.git })))
+            : {};
+        const gitRepoUrl = (_a = options.repo) !== null && _a !== void 0 ? _a : inferred.gitRepoUrl;
+        const gitRef = (_b = options.ref) !== null && _b !== void 0 ? _b : inferred.gitRef;
+        const agentPath = (_c = options.path) !== null && _c !== void 0 ? _c : inferred.agentPath;
+        if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
+            ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
+            return 1;
+        }
+        if (gitRepoUrl === undefined) {
+            ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
+                `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
+            return 1;
+        }
+        for (const repo of (_d = options.cursorEventsRepos) !== null && _d !== void 0 ? _d : []) {
+            if (!isValidCursorEventRepo(repo)) {
+                ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
+                return 1;
+            }
+        }
+        if (!ctx.json && gitRepoUrl !== undefined) {
+            const inferredBits = [];
+            if (options.repo === undefined && inferred.gitRepoUrl !== undefined) {
+                inferredBits.push("repo");
+            }
+            if (options.ref === undefined && inferred.gitRef !== undefined) {
+                inferredBits.push("ref");
+            }
+            if (options.path === undefined && inferred.agentPath !== undefined) {
+                inferredBits.push("path");
+            }
+            ctx.err(`  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
+                (agentPath === undefined ? "" : `  path:   ${agentPath}\n`) +
+                (inferredBits.length === 0
+                    ? ""
+                    : `  (inferred ${inferredBits.join(", ")} from git; pass --repo/--ref/--path to override)\n`));
+        }
+        // The package manifest (`defineAgent({ hosting })`) is the source of
+        // truth for egress domains and expected secret names; flags override or
+        // augment it. Directories without an agent project have no manifest. The same load supplies the
+        // cursorAccount connection refs for the post-deploy connector auth and
+        // the channels declared public via `publicEndpoint()`.
+        const manifest = isAgent ? yield readDeployManifest(dir) : undefined;
+        const hosting = manifest === null || manifest === void 0 ? void 0 : manifest.hosting;
+        const egressAllowedDomains = [
+            ...new Set([...((_e = hosting === null || hosting === void 0 ? void 0 : hosting.egressDomains) !== null && _e !== void 0 ? _e : []), ...((_f = options.allowDomains) !== null && _f !== void 0 ? _f : [])]),
+        ];
+        const publicRoutePaths = ((_g = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIds) !== null && _g !== void 0 ? _g : []).map(channelId => `/v1/channels/${channelId}`);
+        if (!ctx.json && (manifest === null || manifest === void 0 ? void 0 : manifest.httpChannelPublicEndpoint) === true) {
+            ctx.err(`warning: publicEndpoint() on the built-in HTTP channel has no effect on hosting — only custom channels (/v1/channels/…) can be public; the session API always requires the alias token.\n`);
+        }
+        if (!ctx.json && publicRoutePaths.length > 0) {
+            // Security-relevant surface change: say exactly what will be reachable
+            // without the alias token before the deploy is accepted.
+            ctx.err(`  public: ${publicRoutePaths.join(", ")} (served WITHOUT the alias token — these channels authenticate requests themselves)\n`);
+        }
+        const deadSecretChannels = (_h = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIdsWithDeadSecretPolicies) !== null && _h !== void 0 ? _h : [];
+        if (!ctx.json && deadSecretChannels.length > 0) {
+            ctx.err(`warning: ${deadSecretChannels
+                .map(channelId => `/v1/channels/${channelId}`)
+                .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
+        }
+        if ((manifest === null || manifest === void 0 ? void 0 : manifest.architecture) === "v2") {
+            if (!ctx.json) {
+                ctx.err(`  architecture: v2${manifest.persistent ? " (persistent)" : ""}${manifest.image === undefined ? "" : `\n  image: ${manifest.image}`}\n`);
+            }
+            return deployOneAgentsdk(ctx, extras, {
+                persistent: manifest.persistent,
+                image: manifest.image,
+                slug,
+                gitRepoUrl,
+                gitRef,
+                agentPath,
+                repositories: options.cursorEventsRepos,
+                hasScmChannels: manifest.hasScmChannels,
+                declaredSecretNames: hosting === null || hosting === void 0 ? void 0 : hosting.secretNames,
+                hasDeploymentsChannels: manifest.hasDeploymentsChannels,
+                multiTenant: options.multiTenant === true,
+            });
+        }
+        if (options.multiTenant === true) {
+            ctx.err("--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n");
+            return 1;
+        }
+        // Today's only source shape: the control plane builds from a git ref.
+        // See DeploySource for the artifact seam.
+        const source = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ kind: "git-ref", gitRepoUrl }, (gitRef === undefined ? {} : { gitRef })), (agentPath === undefined ? {} : { agentPath })), (options.cursorEventsRepos === undefined || options.cursorEventsRepos.length === 0
+            ? {}
+            : { cursorEventRepos: options.cursorEventsRepos })), (egressAllowedDomains.length === 0 ? {} : { egressAllowedDomains })), { publicRoutePaths: publicRoutePaths.length === 0 ? undefined : publicRoutePaths });
+        let accepted;
+        try {
+            accepted = yield ctx.client.deploy({
+                teamId: ctx.teamId,
+                slug,
+                source,
+                template: readDeployTemplate(dir),
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        const aliasUrl = ctx.client.aliasUrl(accepted.engineAlias);
+        if (!ctx.json && accepted.aliasToken !== undefined) {
+            ctx.out(aliasTokenBlock(accepted.aliasToken));
+        }
+        if (ctx.noWait) {
+            if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
+                extras.jsonCollect.push(accepted);
+            }
+            else if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, generation ${accepted.generation}, ${accepted.deploymentKind})\n` +
+                    `  alias: ${aliasUrl}\n` +
+                    `Check progress with \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.\n`);
+            }
+            return 0;
+        }
+        let detail;
+        try {
+            detail = yield pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES, () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        warnMissingSecrets(ctx, slug, hosting === null || hosting === void 0 ? void 0 : hosting.secretNames, detail.secretNames);
+        const payload = accepted.aliasToken === undefined ? detail : Object.assign(Object.assign({}, detail), { aliasToken: accepted.aliasToken });
+        if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
+            extras.jsonCollect.push(payload);
+            return detail.status === "running" ? 0 : 1;
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(payload, null, 2)}\n`);
+            return detail.status === "running" ? 0 : 1;
+        }
+        if (detail.status !== "running") {
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
+            return 1;
+        }
+        const deployedPublicRoutes = (_j = detail.publicRoutePaths) !== null && _j !== void 0 ? _j : [];
+        ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
+            `  status:      running\n` +
+            `  generation:  ${detail.generation}\n` +
+            `  kind:        ${detail.deploymentKind}\n` +
+            `  alias:       ${aliasUrl}\n` +
+            `  playground:  ${aliasUrl}/playground (sign in with the alias token)\n` +
+            `               open: ${CLI} playground --prod --slug ${slug} --team ${ctx.teamId}\n` +
+            // Paste-ready webhook URLs: these subtrees skip the alias token, so
+            // the channel handler must verify deliveries (webhook signatures).
+            deployedPublicRoutes
+                .map(path => `  public:      ${aliasUrl}${path} (no alias token)\n`)
+                .join(""));
+        yield runPostDeployConnectorAuth(ctx, options, {
+            slug,
+            connections: (_k = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _k !== void 0 ? _k : [],
+            serviceAccountId: deploymentServiceAccountId(detail),
+        });
+        return 0;
+    });
+}
+/**
+ * Multi-agent parent whose children all declare `architecture: "v2"`:
+ * deploy ONE application whose release carries a component per child. The
+ * application slug derives from the parent directory name; each component
+ * key is the child's slug and its path is the child directory relative to
+ * the repo root (a shared --path names the parent's directory in the repo).
+ */
+function deployAgentsdkApplication(ctx, options, targets, declarations) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e;
+        const parentDir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
+        const slug = slugFromDirectoryName(basename(parentDir));
+        if (slug === undefined) {
+            ctx.err(`Could not derive an application slug from the parent directory name ${JSON.stringify(basename(parentDir))} — rename it (deploy slugs use lowercase letters, digits, '-' or '_').\n`);
+            return 1;
+        }
+        const needsGitInference = options.repo === undefined || options.ref === undefined || options.path === undefined;
+        const inferred = needsGitInference
+            ? yield inferDeployGitSource(parentDir, Object.assign({}, (options.git === undefined ? {} : { git: options.git })))
+            : {};
+        const gitRepoUrl = (_b = options.repo) !== null && _b !== void 0 ? _b : inferred.gitRepoUrl;
+        const gitRef = (_c = options.ref) !== null && _c !== void 0 ? _c : inferred.gitRef;
+        const parentPath = (_d = options.path) !== null && _d !== void 0 ? _d : inferred.agentPath;
+        if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
+            ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
+            return 1;
+        }
+        if (gitRepoUrl === undefined) {
+            ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
+                `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
+            return 1;
+        }
+        for (const repo of (_e = options.cursorEventsRepos) !== null && _e !== void 0 ? _e : []) {
+            if (!isValidCursorEventRepo(repo)) {
+                ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
+                return 1;
+            }
+        }
+        const components = targets.map(target => ({
+            componentKey: target.slug,
+            agentPath: [parentPath, basename(target.dir)]
+                .filter((part) => part !== undefined && part !== "")
+                .join("/"),
+            persistent: declarations.componentPersistent[target.slug] === true,
+            image: declarations.componentImage[target.slug],
+        }));
+        if (!ctx.json) {
+            ctx.err(`Deploying "${slug}" as one v2 application with ${targets.length} components (slug from the parent directory name).\n` +
+                `  architecture: v2\n` +
+                `  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
+                components
+                    .map(component => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})${component.persistent ? " persistent" : ""}${component.image === undefined ? "" : ` image ${component.image}`}\n`; })
+                    .join(""));
+        }
+        return deployOneAgentsdk(ctx, undefined, {
+            // Multi-component: the flag travels on each component instead.
+            persistent: false,
+            slug,
+            gitRepoUrl,
+            gitRef,
+            agentPath: undefined,
+            components,
+            repositories: options.cursorEventsRepos,
+            hasScmChannels: declarations.hasScmChannels,
+            declaredSecretNames: declarations.declaredSecretNames,
+            hasDeploymentsChannels: declarations.hasDeploymentsChannels,
+            multiTenant: options.multiTenant === true,
+        });
+    });
+}
+/**
+ * `architecture: "v2"` deploy: POST `/internal/agentsdk/deployments` and
+ * poll the matching GET. The v2 accept path starts freeze bake; it does
+ * not mint an engine alias or alias token.
+ */
+function deployOneAgentsdk(ctx, extras, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const { slug } = args;
+        const componentsLine = args.components === undefined
+            ? ""
+            : `  components:  ${args.components.map(component => component.componentKey).join(", ")}\n`;
+        if (args.multiTenant && !ctx.json) {
+            ctx.err("  multi-tenant: existing product\n");
+        }
+        let accepted;
+        try {
+            accepted = yield ctx.client.deployAgentkit(Object.assign(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})), { persistent: args.persistent, image: args.image }));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err, {
+                multiTenant: args.multiTenant,
+                teamId: ctx.teamId,
+            });
+        }
+        if (ctx.noWait) {
+            if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
+                extras.jsonCollect.push(accepted);
+            }
+            else if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, v2)\n` +
+                    `  application: ${accepted.applicationId}\n` +
+                    `  release:     ${accepted.releaseId}\n` +
+                    componentsLine);
+            }
+            return 0;
+        }
+        let detail;
+        try {
+            detail = yield pollUntil(ctx, slug, TERMINAL_AGENTKIT_DEPLOY_STATUSES, () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
+            extras.jsonCollect.push(detail);
+            return detail.status === "running" ? 0 : 1;
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+            return detail.status === "running" ? 0 : 1;
+        }
+        if (detail.status !== "running") {
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
+            return 1;
+        }
+        warnMissingSecrets(ctx, slug, args.declaredSecretNames, detail.secretNames);
+        const watchesRepositories = args.hasScmChannels || args.hasDeploymentsChannels === true;
+        ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
+            `  status:       running\n` +
+            `  architecture: v2\n` +
+            `  application:  ${detail.applicationId}\n` +
+            `  release:      ${detail.releaseId}\n` +
+            (args.components === undefined
+                ? ""
+                : `  components:   ${args.components
+                    .map(component => component.componentKey)
+                    .join(", ")}\n`) +
+            (detail.repositories === undefined || !watchesRepositories
+                ? ""
+                : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`));
+        // An agent with GitHub/Origin/deployments channels bound to no repository
+        // scope gets no deliveries at all (deployments channels receive the
+        // watched repos' deployment events), which is otherwise invisible here.
+        if (watchesRepositories && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin/deployments channels receive no events.\n` +
+                `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
+        }
+        return 0;
+    });
+}
+/**
+ * Post-deploy connector authorization for `cursorAccount` connections: the
+ * agent's connectors execute with tokens owned by the deployment's service
+ * account, which start out unauthorized. On a TTY this runs the dashboard's
+ * Authenticate flow inline (browser OAuth per connector, already-authorized
+ * ones skipped); otherwise it reports status only. Never affects the deploy
+ * outcome — anything left unauthorized just gets a playground-page pointer.
+ */
+function runPostDeployConnectorAuth(ctx, options, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (args.connections.length === 0) {
+            return;
+        }
+        const { serviceAccountId } = args;
+        if (serviceAccountId === undefined) {
+            ctx.err(`warning: this agent uses Cursor account connectors, but the deployment has no service account; redeploy to mint one.\n`);
+            return;
+        }
+        const backendClient = new CursorBackendClient({
+            backendUrl: ctx.backendUrl,
+            apiKey: ctx.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        const interactive = options.openBrowserImpl !== undefined ||
+            (process.stdout.isTTY === true && process.stdin.isTTY === true);
+        let anyUnauthorized = false;
+        for (const ref of args.connections) {
+            ctx.out(`\nThis agent uses Cursor account connectors (connection "${ref.name}"${ref.servers === undefined || ref.servers.length === 0 ? "" : `: ${ref.servers.join(", ")}`}).\n`);
+            try {
+                const result = yield authorizeCursorAccountConnectors({
+                    backendClient,
+                    teamId: ctx.teamId,
+                    slug: args.slug,
+                    serviceAccountId,
+                    connectionName: ref.name,
+                    servers: ref.servers,
+                    interactive,
+                    out: ctx.out,
+                    err: ctx.err,
+                    openBrowserImpl: options.openBrowserImpl,
+                    sleep: options.sleepImpl,
+                    pollIntervalMs: options.connectorPollIntervalMs,
+                    pollTimeoutMs: options.connectorPollTimeoutMs,
+                });
+                if (result.pending.length > 0 || result.errored.length > 0) {
+                    anyUnauthorized = true;
+                    if (result.pending.length > 0) {
+                        ctx.out(`Connectors not authorized yet: ${result.pending.join(", ")}.\n`);
+                    }
+                }
+            }
+            catch (error) {
+                anyUnauthorized = true;
+                ctx.err(`warning: could not check connector authorization for "${ref.name}": ${describeError(error)}\n`);
+            }
+        }
+        if (anyUnauthorized) {
+            ctx.out(`You can authorize connectors at the playground page (cursor.com dashboard → Deployed Agents → ${args.slug}) or with \`${CLI} mcp oauth <connection>\`.\n`);
+        }
+    });
+}
+/**
+ * Read the deploy-relevant bits of the project manifest at `dir` in one
+ * load: the `hosting` block, the agent's cursorAccount connections, and the
+ * channels declared public via `publicEndpoint()`.
+ */
+function readDeployManifest(dir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b;
+        const project = yield loadAgentProject(dir);
+        // Fail here, before anything is dispatched: a project with error
+        // diagnostics (e.g. agent/storage.ts on architecture v2) would only be
+        // refused later by `serve` inside the hosted build, wasting a bake.
+        if (hasErrorDiagnostics(project)) {
+            throw new Error(`Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(project.diagnostics.filter(d => d.severity === "error"))}`);
+        }
+        return {
+            hosting: project.agent.hosting,
+            architecture: project.agent.architecture,
+            persistent: project.agent.persistent === true,
+            image: (_a = project.agent.hosting) === null || _a === void 0 ? void 0 : _a.image,
+            cursorAccountConnections: project.agent.connections.flatMap(connection => isCursorAccountTransport(connection.transport)
+                ? [{ name: connection.name, servers: connection.transport.servers }]
+                : []),
+            publicChannelIds: project.channels
+                .filter(channel => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
+                .map(channel => channel.id),
+            publicChannelIdsWithDeadSecretPolicies: project.channels
+                .filter(channel => {
+                var _a;
+                const auth = (_a = channel.definition.auth) !== null && _a !== void 0 ? _a : [];
+                return (auth.some(isPublicEndpointPolicy) &&
+                    auth.some(policy => {
+                        var _a;
+                        const kind = (_a = catchAuthDeclaration(policy)) === null || _a === void 0 ? void 0 : _a.kind;
+                        return kind !== undefined && kind !== "public";
+                    }));
+            })
+                .map(channel => channel.id),
+            httpChannelPublicEndpoint: ((_b = project.httpChannel.auth) !== null && _b !== void 0 ? _b : []).some(isPublicEndpointPolicy),
+            hasScmChannels: project.channels.some(channel => {
+                var _a;
+                const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
+                return kind === "github" || kind === "origin";
+            }),
+            hasDeploymentsChannels: project.channels.some(channel => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
+        };
+    });
+}
+/**
+ * Friendly post-deploy nudge: the manifest declares secrets the agent
+ * expects, but the deployment does not have them all set yet.
+ */
+function warnMissingSecrets(ctx, slug, declared, set) {
+    if (declared === undefined || declared.length === 0) {
+        return;
+    }
+    const setNames = new Set(set !== null && set !== void 0 ? set : []);
+    // Platform-managed names (CURSOR_*, hosted storage) are injected by the
+    // control plane and never appear in secrets list — do not warn on them.
+    const missing = declared.filter(name => !setNames.has(name) && !isReservedSecretName(name));
+    if (missing.length === 0) {
+        return;
+    }
+    ctx.err(`warning: secrets declared in the agent manifest but not set on ${slug}: ${missing.join(", ")}\n` +
+        `  set them with \`${CLI} secrets set ${slug} ${missing.join(" ")}\`\n`);
+}
+// ============================================================================
+// deployments (list)
+// ============================================================================
+export function cmdDeployments(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let deployments;
+        try {
+            deployments = yield ctx.client.listDeployments({ teamId: ctx.teamId });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        let applications = [];
+        try {
+            applications = yield ctx.client.listAgentkitDeployments({
+                teamId: ctx.teamId,
+            });
+        }
+        catch (error) {
+            // Older control planes 404 this route; keep listing v1.
+            if (!(error instanceof DeployApiError && error.status === 404)) {
+                return renderApiError(error, ctx.err);
+            }
+        }
+        if (ctx.json) {
+            // Empty v2 list keeps `{ deployments }` for v1-only parsers.
+            ctx.out(`${JSON.stringify(applications.length === 0 ? { deployments } : { deployments, applications }, null, 2)}\n`);
+            return 0;
+        }
+        if (deployments.length === 0 && applications.length === 0) {
+            ctx.out(`No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`);
+            return 0;
+        }
+        ctx.out(`${renderTable(["SLUG", "ARCH", "STATUS", "GEN", "KIND", "UPDATED"], [
+            ...deployments.map(d => { var _a; return [
+                d.slug,
+                "v1",
+                d.status,
+                String(d.generation),
+                d.deploymentKind,
+                (_a = d.desiredUpdatedAt) !== null && _a !== void 0 ? _a : "",
+            ]; }),
+            ...applications.map(application => { var _a; return [
+                application.slug,
+                "v2",
+                application.status,
+                "-",
+                "application",
+                (_a = application.deployments
+                    .map(row => row.desiredUpdatedAt)
+                    .sort()
+                    .at(-1)) !== null && _a !== void 0 ? _a : "",
+            ]; }),
+        ])}\n`);
+        return 0;
+    });
+}
+// ============================================================================
+// deployment <slug> (detail)
+// ============================================================================
+export function cmdDeploymentStatus(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} deployment <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+        // GET goes first. A v2 404 (missing slug, or an older backend) falls
+        // through to the v1 agent-serve detail.
+        try {
+            const detail = yield ctx.client.getAgentkitDeploy({
+                teamId: ctx.teamId,
+                slug,
+            });
+            renderAgentkitDeploymentStatus(ctx, detail);
+            return 0;
+        }
+        catch (error) {
+            if (!(error instanceof DeployApiError) || error.status !== 404) {
+                return renderApiError(error, ctx.err);
+            }
+        }
+        let detail;
+        try {
+            detail = yield ctx.client.getDeployment({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+            return 0;
+        }
+        const aliasUrl = ctx.client.aliasUrl(detail.engineAlias);
+        const lines = [`${detail.slug} (team ${detail.teamId})`, `  status:      ${detail.status}`];
+        if (detail.progress !== undefined) {
+            lines.push(`  progress:    ${detail.progress}`);
+        }
+        if (detail.statusMessage !== null &&
+            detail.statusMessage !== undefined &&
+            detail.statusMessage.trim() !== "") {
+            lines.push(`  step:        ${detail.statusMessage}`);
+        }
+        lines.push(`  generation:  ${detail.generation}`, `  kind:        ${detail.deploymentKind}`, `  alias:       ${aliasUrl}`, `  playground:  ${aliasUrl}/playground`);
+        if (detail.gitRepoUrl !== null && detail.gitRepoUrl !== undefined) {
+            lines.push(`  repo:        ${detail.gitRepoUrl} @ ${(_b = detail.gitRef) !== null && _b !== void 0 ? _b : ""}`);
+        }
+        if (detail.serviceAccountId !== undefined && detail.serviceAccountId !== null) {
+            lines.push(`  service account: ${detail.serviceAccountId}`);
+        }
+        if (detail.agentStoreSourceId !== undefined) {
+            // The durable file store's address: GET /v0/agent-serve-files/<id> lists
+            // it, and the pod sees it as AGENT_SERVE_STORE_SOURCE_ID.
+            lines.push(`  file store:  ${detail.agentStoreSourceId}`);
+        }
+        if (detail.egressAllowedDomains !== undefined && detail.egressAllowedDomains.length > 0) {
+            lines.push(`  egress:      ${detail.egressAllowedDomains.join(", ")}`);
+        }
+        if (detail.publicRoutePaths !== undefined && detail.publicRoutePaths.length > 0) {
+            // Served through the alias WITHOUT X-Agent-Alias-Token (the channel
+            // authenticates deliveries itself).
+            for (const path of detail.publicRoutePaths) {
+                lines.push(`  public:      ${aliasUrl}${path} (no alias token)`);
+            }
+        }
+        if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+            lines.push(`  secrets:     ${detail.secretNames.join(", ")}`);
+        }
+        if (detail.podCredentialMaskedKey !== undefined && detail.podCredentialMaskedKey !== null) {
+            lines.push(`  pod credential: ${detail.podCredentialMaskedKey}`);
+        }
+        if (detail.engineUrl !== null && detail.engineUrl !== undefined) {
+            lines.push(`  engine:      ${detail.engineUrl}`);
+        }
+        if (detail.engineAccess !== null &&
+            detail.engineAccess !== undefined &&
+            typeof detail.engineAccess === "object") {
+            lines.push(`  engine access: ${detail.engineAccess.url} (expires ${detail.engineAccess.expiresAt})`);
+        }
+        if (detail.lastError !== null && detail.lastError !== undefined) {
+            lines.push(`  last error:  ${sanitizeCustomerError(detail.lastError)}`);
+        }
+        if (detail.desiredUpdatedAt !== undefined) {
+            lines.push(`  updated:     ${detail.desiredUpdatedAt}`);
+        }
+        ctx.out(`${lines.join("\n")}\n`);
+        return 0;
+    });
+}
+function renderAgentkitDeploymentStatus(ctx, detail) {
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+        return;
+    }
+    const lines = [
+        `${detail.slug} (team ${detail.teamId})`,
+        `  status:       ${detail.status}`,
+        `  architecture: v2`,
+        `  application:  ${detail.applicationId}`,
+        `  release:      ${detail.releaseId}`,
+        `  progress:     ${detail.progress}`,
+    ];
+    if (detail.statusMessage !== null && detail.statusMessage.trim() !== "") {
+        lines.push(`  step:         ${detail.statusMessage}`);
+    }
+    if (detail.repositories !== undefined) {
+        lines.push(`  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}`);
+    }
+    if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+        lines.push(`  secrets:      ${detail.secretNames.join(", ")}`);
+    }
+    if (detail.lastError !== null && detail.lastError !== undefined) {
+        lines.push(`  last error:   ${sanitizeCustomerError(detail.lastError)}`);
+    }
+    ctx.out(`${lines.join("\n")}\n`);
+}
+// ============================================================================
+// stop <slug>
+// ============================================================================
+export function cmdStop(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        // Stop takes only a slug, so there is no manifest to dispatch on (unlike
+        // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
+        // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
+        // could not fall through. A v2 404 (including an older backend without
+        // the `/internal/agentsdk` mount) falls back to the v1 stop.
+        let architecture = "v2";
+        let accepted;
+        try {
+            accepted = yield ctx.client.stopAgentkit({
+                teamId: ctx.teamId,
+                slug,
+                cancelRuns: options.cancelRuns,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof DeployApiError) || error.status !== 404) {
+                return renderApiError(error, ctx.err);
+            }
+            if (options.cancelRuns === true) {
+                ctx.err(`Canceling active runs while stopping is supported only for Agent SDK v2 deployments.\n`);
+                return 1;
+            }
+            try {
+                accepted = yield ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
+                architecture = "v1";
+            }
+            catch (v1Error) {
+                return renderApiError(v1Error, ctx.err);
+            }
+        }
+        const cancellation = "cancellation" in accepted ? accepted.cancellation : undefined;
+        const stoppedGlobally = "scope" in accepted && accepted.scope === "global";
+        if (ctx.noWait) {
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(stoppedGlobally
+                    ? `Stop accepted for ${slug} across all tenants (status: ${accepted.status}).\n`
+                    : `Stop accepted for ${slug} (status: ${accepted.status}).\n`);
+            }
+            return (cancellation === null || cancellation === void 0 ? void 0 : cancellation.failed) === 0 || cancellation === undefined ? 0 : 1;
+        }
+        let detail;
+        try {
+            detail =
+                architecture === "v2"
+                    ? yield pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }))
+                    : yield pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+        }
+        else if (stoppedGlobally) {
+            ctx.out(`Stopped ${slug} across all tenants (team ${ctx.teamId}); resume with \`${CLI} start ${slug}\`.\n`);
+        }
+        else {
+            ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
+        }
+        if (cancellation !== undefined) {
+            return writeCancellationStarted(ctx, cancellation, slug);
+        }
+        return 0;
+    });
+}
+function writeCancellationStarted(ctx, cancellation, slug) {
+    ctx.out(`Started cancellation across ${cancellation.batchesStarted} deployment batch(es).\n`);
+    if (cancellation.sessionsMarkedFailed !== undefined) {
+        ctx.out(`Marked ${cancellation.sessionsMarkedFailed} factory session(s) failed.\n`);
+    }
+    if (cancellation.failed > 0) {
+        ctx.err(`Failed to start ${cancellation.failed} cancellation batch(es); retry with \`${CLI} cancel-runs ${slug}\`.\n`);
+        return 1;
+    }
+    return 0;
+}
+export function cmdStart(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} start <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            const accepted = yield ctx.client.startAgentkit({
+                teamId: ctx.teamId,
+                slug,
+            });
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Started ${slug} (team ${ctx.teamId}).\n`);
+            }
+            return 0;
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+    });
+}
+export function cmdKill(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} kill <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let accepted;
+        try {
+            accepted = yield ctx.client.killAgentkit({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+        }
+        else {
+            ctx.out(accepted.scope === "global"
+                ? `Killed ${slug} across all tenants (team ${ctx.teamId}): deploys locked, admission stopped.\n`
+                : `Killed ${slug} (team ${ctx.teamId}): deploys locked, admission stopped.\n`);
+            ctx.out(`Resume traffic with \`${CLI} unlock-deploys ${slug}\` then \`${CLI} start ${slug}\`.\n`);
+            ctx.out(`Unlock deploys with \`${CLI} unlock-deploys ${slug}\`.\n`);
+        }
+        if (accepted.cancellation !== undefined) {
+            return writeCancellationStarted(ctx, accepted.cancellation, slug);
+        }
+        return 0;
+    });
+}
+export function cmdUnlockDeploys(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} unlock-deploys <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            const accepted = yield ctx.client.unlockAgentkitDeploys({
+                teamId: ctx.teamId,
+                slug,
+            });
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Unlocked deploys for ${slug} (team ${ctx.teamId}).\n`);
+            }
+            return 0;
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+    });
+}
+export function cmdCancelRuns(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} cancel-runs <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let result;
+        try {
+            result = yield ctx.client.cancelAgentkitRuns({
+                teamId: ctx.teamId,
+                slug,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Started cancellation across ${result.batchesStarted} deployment batch(es).\n`);
+            if (result.sessionsMarkedFailed !== undefined) {
+                ctx.out(`Marked ${result.sessionsMarkedFailed} factory session(s) failed.\n`);
+            }
+        }
+        if (result.failed > 0) {
+            ctx.err(`Failed to start ${result.failed} cancellation batch(es).\n`);
+            return 1;
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// event-repos <slug> --repo <owner/name>...
+// ============================================================================
+export function cmdEventRepos(slug, repositories, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} event-repos <slug> --repo <owner/name>... [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let configured;
+        try {
+            configured = yield ctx.client.setAgentkitEventRepositories({
+                teamId: ctx.teamId,
+                slug,
+                repositories,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ repositories: configured }, null, 2)}\n`);
+        }
+        else if (configured.length === 0) {
+            ctx.out(`${slug} now watches no repositories.\n`);
+        }
+        else {
+            ctx.out(`${slug} now watches ${configured.join(", ")}.\n`);
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// upgrade <slug>
+// ============================================================================
+/** Release ids are uuids; anything else the user typed is a version. */
+const RELEASE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function cmdUpgrade(args, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const { slug, release } = args;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} upgrade <slug> [--release <id|version>] [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const selector = (_b = release === null || release === void 0 ? void 0 : release.trim()) !== null && _b !== void 0 ? _b : "";
+        let releaseId;
+        try {
+            releaseId = yield ctx.client.upgradeAgentkitInstall(Object.assign({ teamId: ctx.teamId, slug }, (selector === ""
+                ? {}
+                : RELEASE_ID_RE.test(selector)
+                    ? { releaseId: selector }
+                    : { version: selector })));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ releaseId }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`${slug} now runs release ${releaseId}.\n`);
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// delete <slug>
+// ============================================================================
+export function cmdDelete(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} delete <slug> [--team <id>] [--json] [--no-wait]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+        // DELETE goes first. A v2 404 (missing slug, or an older backend)
+        // falls through to the v1 agent-serve delete.
+        let architecture = "v2";
+        let accepted;
+        try {
+            accepted = yield ctx.client.deleteAgentkit({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            if (!(error instanceof DeployApiError) || error.status !== 404) {
+                return renderApiError(error, ctx.err);
+            }
+            try {
+                accepted = yield ctx.client.deleteDeployment({
+                    teamId: ctx.teamId,
+                    slug,
+                });
+                architecture = "v1";
+            }
+            catch (v1Error) {
+                return renderApiError(v1Error, ctx.err);
+            }
+        }
+        if (ctx.noWait) {
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Delete accepted for ${slug} (status: ${accepted.status}).\n`);
+            }
+            return 0;
+        }
+        try {
+            yield pollUntilGone(ctx, slug, () => architecture === "v2"
+                ? ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug })
+                : ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ slug, status: "deleted" }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Deleted ${slug} (team ${ctx.teamId}).\n`);
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// rotate-token <slug>
+// ============================================================================
+export function cmdRotateToken(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-token <slug> [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let aliasToken;
+        try {
+            const architecture = yield deploymentArchitecture({
+                client: ctx.client,
+                teamId: ctx.teamId,
+                slug,
+            });
+            aliasToken =
+                architecture === "v2"
+                    ? yield ctx.client.rotateAgentsdkAliasToken({
+                        teamId: ctx.teamId,
+                        slug,
+                    })
+                    : yield ctx.client.rotateAliasToken({
+                        teamId: ctx.teamId,
+                        slug,
+                    });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ aliasToken }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Rotated the alias token for ${slug}. The old token stopped working immediately.\n${aliasTokenBlock(aliasToken)}`);
+        return 0;
+    });
+}
+// ============================================================================
+// secrets set|list|unset
+// ============================================================================
+function secretDeploymentArchitecture(ctx, slug) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return deploymentArchitecture({
+            client: ctx.client,
+            teamId: ctx.teamId,
+            slug,
+        });
+    });
+}
+export function cmdSecretsSet(slug, specs, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const usageErr = (_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t));
+        if (slug === undefined || slug === "" || specs.length === 0) {
+            usageErr(`Usage: ${CLI} secrets set <slug> NAME [NAME2 ...] [--team <id>] [--json]\n` +
+                `  Enter values at the hidden prompt, or pipe one line per NAME.\n` +
+                `  Opt-in (leaks into argv / agent terminals): NAME=VALUE … --from-argv\n`);
+            return 1;
+        }
+        // Parse and validate every name before prompting for any value, so a
+        // typo in the last name cannot waste typed-in secrets.
+        const parsed = [];
+        for (const spec of specs) {
+            const eq = spec.indexOf("=");
+            const name = eq === -1 ? spec : spec.slice(0, eq);
+            const nameError = validateSettableSecretName(name);
+            if (nameError !== undefined) {
+                usageErr(`${nameError}\n`);
+                return 1;
+            }
+            parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
+        }
+        const hasArgvValues = parsed.some(entry => entry.value !== undefined);
+        if (hasArgvValues && options.fromArgv !== true) {
+            usageErr(`Refusing NAME=VALUE on argv (shows up in shell history and agent-captured terminals).\n` +
+                `Pass names only:\n` +
+                `  ${CLI} secrets set ${slug} NAME\n` +
+                `Hidden prompt on a TTY; one stdin line per NAME when piped.\n` +
+                `Or redirect a file: ${CLI} secrets set ${slug} NAME < ./secret.txt\n`);
+            return 1;
+        }
+        if (hasArgvValues) {
+            usageErr(`warning: --from-argv puts secret values in argv (shell history and agent-captured terminals).\n`);
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const stdin = (_b = options.stdin) !== null && _b !== void 0 ? _b : process.stdin;
+        const readValue = createSecretValueReader(stdin, ctx.err);
+        const secrets = [];
+        for (const entry of parsed) {
+            secrets.push({
+                name: entry.name,
+                value: (_c = entry.value) !== null && _c !== void 0 ? _c : (yield readValue(entry.name)),
+            });
+        }
+        let secretNames;
+        let architecture;
+        try {
+            architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secretNames =
+                architecture === "v2"
+                    ? yield ctx.client.setAgentkitSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    })
+                    : yield ctx.client.setSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ secretNames }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
+            `Secrets now set: ${secretNames.join(", ")}\n` +
+            (architecture === "v2"
+                ? `The next task picks them up; no redeploy is required.\n`
+                : `The engine picks them up on its next deploy.\n`));
+        return 0;
+    });
+}
+export function cmdSecretsList(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets list <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let secrets;
+        try {
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secrets =
+                architecture === "v2"
+                    ? yield ctx.client.listAgentkitSecrets({ teamId: ctx.teamId, slug })
+                    : yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ secrets }, null, 2)}\n`);
+            return 0;
+        }
+        if (secrets.length === 0) {
+            ctx.out(`No secrets set on ${slug}. Add one with \`${CLI} secrets set ${slug} NAME\`.\n`);
+            return 0;
+        }
+        ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map(secret => [secret.name, secret.createdAt]))}\n`);
+        return 0;
+    });
+}
+export function cmdSecretsUnset(slug, name, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "" || name === undefined || name === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets unset <slug> NAME [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            if (architecture === "v2") {
+                yield ctx.client.deleteAgentkitSecret({
+                    teamId: ctx.teamId,
+                    slug,
+                    name,
+                });
+            }
+            else {
+                yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+            }
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                ctx.err(`No secret named ${name} on deployment ${slug} — check \`${CLI} secrets list ${slug}\` (and the slug / --team).\n`);
+                return 1;
+            }
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ removed: name }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Removed secret ${name} from ${slug}.\n`);
+        }
+        return 0;
+    });
+}
+/**
+ * Returns a reader for interactive secret values: hidden (no-echo) prompt
+ * when `stdin` is a TTY, otherwise one line per secret from the piped
+ * stream. One reader per command so piped lines are consumed in order.
+ */
+function createSecretValueReader(stdin, err) {
+    if (stdin.isTTY === true) {
+        return name => promptHidden(stdin, err, `Value for ${name}: `);
+    }
+    const readLine = createLineReader(stdin);
+    return (name) => __awaiter(this, void 0, void 0, function* () {
+        const line = yield readLine();
+        if (line === undefined) {
+            throw new DeployApiError(`stdin ended before a value for ${name} was provided (pipe one line per secret).`, 0);
+        }
+        return line;
+    });
+}
+/** Longest mask run drawn while typing a secret; the count carries the rest. */
+const SECRET_MASK_MAX_WIDTH = 24;
+/**
+ * One line of typing feedback for the hidden prompt. Echoing the value would
+ * leak it, so the line carries a bounded mask plus the exact character count —
+ * enough to see that keystrokes, backspaces, and pasted values landed. The
+ * mask is clamped to the terminal width so the redraw stays on one line.
+ */
+function renderSecretPromptLine(prompt, length, dim) {
+    var _a;
+    const count = `${length} char${length === 1 ? "" : "s"}`;
+    const room = ((_a = process.stderr.columns) !== null && _a !== void 0 ? _a : 80) - prompt.length - count.length - 2;
+    const maskWidth = Math.max(0, Math.min(length, SECRET_MASK_MAX_WIDTH, room));
+    // `·` over `•`: the rest of the CLI's progress output already uses it, and
+    // fonts that ship no bullet glyph draw a tofu box in its place.
+    const mask = "·".repeat(maskWidth);
+    const body = mask === "" ? count : `${mask} ${count}`;
+    return `\r\u001b[2K${prompt}${dim(body)}`;
+}
+/**
+ * Raw-mode hidden prompt: never echoes the value, redraws a mask + character
+ * count as it is typed, supports backspace and Ctrl-C.
+ */
+function promptHidden(stdin, err, prompt) {
+    return new Promise((resolvePromise, reject) => {
+        var _a;
+        const { dim } = stderrPalette();
+        let value = "";
+        const draw = () => {
+            err(renderSecretPromptLine(prompt, value.length, dim));
+        };
+        draw();
+        (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, true);
+        stdin.resume();
+        const cleanup = () => {
+            var _a;
+            stdin.off("data", onData);
+            (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, false);
+            stdin.pause();
+            draw();
+            err("\n");
+        };
+        const onData = (chunk) => {
+            const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+            for (const ch of text) {
+                if (ch === "\r" || ch === "\n") {
+                    cleanup();
+                    resolvePromise(value);
+                    return;
+                }
+                if (ch === "\u0003") {
+                    cleanup();
+                    reject(new DeployApiError("Aborted.", 0));
+                    return;
+                }
+                if (ch === "\u007f" || ch === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += ch;
+            }
+            // One redraw per chunk keeps a pasted value from flooding the terminal.
+            draw();
+        };
+        stdin.on("data", onData);
+    });
+}
+/** Buffered line reader over a piped stream; undefined once it ends. */
+export function createLineReader(stream) {
+    let buffer = "";
+    let ended = false;
+    const waiters = [];
+    const drain = () => {
+        var _a, _b;
+        while (waiters.length > 0) {
+            const newline = buffer.indexOf("\n");
+            if (newline !== -1) {
+                const line = buffer.slice(0, newline).replace(/\r$/, "");
+                buffer = buffer.slice(newline + 1);
+                (_a = waiters.shift()) === null || _a === void 0 ? void 0 : _a(line);
+                continue;
+            }
+            if (!ended) {
+                return;
+            }
+            // Stream ended: a trailing unterminated line still counts once.
+            const rest = buffer;
+            buffer = "";
+            (_b = waiters.shift()) === null || _b === void 0 ? void 0 : _b(rest === "" ? undefined : rest.replace(/\r$/, ""));
+        }
+    };
+    stream.on("data", (chunk) => {
+        buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        drain();
+    });
+    stream.on("end", () => {
+        ended = true;
+        drain();
+    });
+    stream.resume();
+    return () => new Promise(resolvePromise => {
+        waiters.push(resolvePromise);
+        drain();
+    });
+}
+// ============================================================================
+// Polling + rendering helpers
+// ============================================================================
+/**
+ * Poll deployment status every `pollIntervalMs` until it lands in
+ * `terminal` (single-line progress on a TTY, one line per transition
+ * otherwise). Prefers customer `statusMessage` / `progress` over raw
+ * status so create → checkout → start is visible. Throws DeployApiError
+ * on request failures or timeout.
+ */
+function pollUntil(ctx, slug, terminal, fetchDetail) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const startedAt = Date.now();
+        const tty = process.stderr.isTTY === true;
+        let lastLabel;
+        let sawProgress = false;
+        const report = (detail) => {
+            if (ctx.json) {
+                return;
+            }
+            const label = deployProgressLabel(detail);
+            const elapsed = Math.round((Date.now() - startedAt) / 1000);
+            if (tty) {
+                ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+                sawProgress = true;
+            }
+            else if (label !== lastLabel) {
+                ctx.err(`${slug}: ${label}\n`);
+            }
+            lastLabel = label;
+        };
+        const finishProgressLine = () => {
+            if (tty && sawProgress) {
+                ctx.err("\n");
+            }
+        };
+        for (;;) {
+            let detail;
+            try {
+                detail = yield fetchDetail();
+            }
+            catch (error) {
+                // Capacity / rate-limit on GET is not a bake failure. The v2 accept
+                // already started freeze; keep polling until the wait budget expires.
+                if (isTransientDeployStatusError(error) && Date.now() - startedAt < ctx.timeoutMs) {
+                    if (!ctx.json) {
+                        const elapsed = Math.round((Date.now() - startedAt) / 1000);
+                        const label = "Waiting for status (server busy)";
+                        if (tty) {
+                            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+                            sawProgress = true;
+                        }
+                        else if (label !== lastLabel) {
+                            ctx.err(`${slug}: ${label}\n`);
+                        }
+                        lastLabel = label;
+                    }
+                    const waitMs = transientDeployStatusWaitMs(error, ctx.pollIntervalMs);
+                    const remaining = ctx.timeoutMs - (Date.now() - startedAt);
+                    yield sleep(Math.max(0, Math.min(waitMs, remaining)));
+                    continue;
+                }
+                finishProgressLine();
+                throw error;
+            }
+            report(detail);
+            if (terminal.has(detail.status)) {
+                finishProgressLine();
+                return detail;
+            }
+            if (Date.now() - startedAt >= ctx.timeoutMs) {
+                finishProgressLine();
+                const last = deployProgressLabel(detail);
+                throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} (last: ${last}). It may still converge — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+            }
+            yield sleep(ctx.pollIntervalMs);
+        }
+    });
+}
+/** Load-shed / rate-limit on status GET — the deploy itself may still be baking. */
+function isTransientDeployStatusError(error) {
+    return error instanceof DeployApiError && (error.status === 503 || error.status === 429);
+}
+function transientDeployStatusWaitMs(error, pollIntervalMs) {
+    if (error.status === 429 &&
+        error.retryAfterSeconds !== undefined &&
+        error.retryAfterSeconds > 0) {
+        return Math.max(pollIntervalMs, error.retryAfterSeconds * 1000);
+    }
+    return pollIntervalMs;
+}
+/**
+ * Wait until GET 404s (the delete reconciler purged the record). Treats
+ * other errors as failures. Throws DeployApiError on timeout.
+ */
+function pollUntilGone(ctx, slug, getDetail) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const startedAt = Date.now();
+        const tty = process.stderr.isTTY === true;
+        let sawProgress = false;
+        const report = (label) => {
+            if (ctx.json) {
+                return;
+            }
+            const elapsed = Math.round((Date.now() - startedAt) / 1000);
+            if (tty) {
+                ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+                sawProgress = true;
+            }
+        };
+        const finishProgressLine = () => {
+            if (tty && sawProgress) {
+                ctx.err("\n");
+            }
+        };
+        for (;;) {
+            try {
+                const detail = yield getDetail();
+                report(deployProgressLabel(detail));
+            }
+            catch (error) {
+                if (error instanceof DeployApiError && error.status === 404) {
+                    finishProgressLine();
+                    return;
+                }
+                finishProgressLine();
+                throw error;
+            }
+            if (Date.now() - startedAt >= ctx.timeoutMs) {
+                finishProgressLine();
+                throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} to disappear. It may still be deleting — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+            }
+            yield sleep(ctx.pollIntervalMs);
+        }
+    });
+}
+function aliasTokenBlock(aliasToken) {
+    return (`\n  Alias token (shown ONCE — save it now, it cannot be retrieved again):\n\n` +
+        `    ${aliasToken}\n\n` +
+        `  Send it as the X-Agent-Alias-Token header on requests to the alias URL,\n` +
+        `  or paste it into the hosted playground (<alias>/playground) sign-in gate.\n` +
+        `  Lost tokens: \`${CLI} rotate-token <slug>\` mints a replacement.\n\n`);
+}
+/**
+ * `: <reason>` suffix for a deploy that ended in a non-running state, or
+ * empty when the control plane recorded no reason.
+ */
+function deployFailureDetail(lastError) {
+    if (lastError === null || lastError === undefined || lastError.trim() === "") {
+        return "";
+    }
+    return `: ${sanitizeCustomerError(lastError.trim())}`;
+}
+export function renderApiError(error, err, context) {
+    if (error instanceof DeployApiError) {
+        err(`${error.message}\n`);
+        if (error.status === 409 && error.message.includes("application multiTenant does not match")) {
+            if ((context === null || context === void 0 ? void 0 : context.multiTenant) === true) {
+                err("This slug is a single-tenant application. Redeploy it without --multi-tenant.\n");
+            }
+            else if ((context === null || context === void 0 ? void 0 : context.teamId) === MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+                err("This slug is a Cursor-managed (multi-tenant) product. Redeploy it with --multi-tenant.\n");
+            }
+        }
+        return 1;
+    }
+    throw error;
+}
+export function renderTable(header, rows) {
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map(row => { var _a; return ((_a = row[i]) !== null && _a !== void 0 ? _a : "").length; })));
+    const renderRow = (row) => row
+        .map((cell, i) => { var _a; return cell.padEnd((_a = widths[i]) !== null && _a !== void 0 ? _a : 0); })
+        .join("  ")
+        .trimEnd();
+    return [renderRow(header), ...rows.map(renderRow)].join("\n");
+}