@cursor/bdk 0.2.9 → 0.2.11

package/dist/internal/cli-deploy.js

@@ -9,15 +9,6 @@
  * v2 agentsdk management API through `deploy-client.ts`, poll status, and
  * render.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { basename, resolve } from "node:path";
 import { catchAuthDeclaration, isPublicEndpointPolicy } from "../channels.js";
 import { isCursorAccountTransport, } from "../types.js";
@@ -26,6 +17,7 @@ import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT } from "./cursor/cred
 import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { readDeployTemplate } from "./cursor-agent-template.js";
 import { AgentServeDeployClient, DeployApiError, deploymentServiceAccountId, slugFromDirectoryName, TERMINAL_AGENTKIT_DEPLOY_STATUSES, TERMINAL_DEPLOY_STATUSES, validateDeploymentSlug, } from "./deploy-client.js";
+import { channelCatchSecretNames, channelCredentialSecretNames } from "./deploy-manifest.js";
 import { inferDeployGitSource } from "./deploy-source.js";
 import { describeError } from "./describe-error.js";
 import { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, } from "./discovery.js";
@@ -35,7 +27,7 @@ import { deploymentArchitecture, rejectV2ForLegacyCommand } from "./legacy-comma
 import { deployProgressLabel, sanitizeCustomerError } from "./logs-client.js";
 import { sleep } from "./sleep.js";
 import { stderrPalette } from "./terminal-style.js";
-const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_POLL_INTERVAL_MS = 3_000;
 const DEFAULT_DEPLOY_TIMEOUT_MS = 10 * 60 * 1000;
 /** `--multi-tenant` HTTP deploy is Anysphere-only (team id 1). */
 const MULTI_TENANT_HTTP_DEPLOY_TEAM_ID = 1;
@@ -44,328 +36,316 @@ const MULTI_TENANT_HTTP_DEPLOY_TEAM_ID = 1;
  * `--prod` AX routing. Returns an exit code (error already rendered) on
  * failure.
  */
-export function resolveDeployAuth(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const err = (_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text));
-        const resolved = yield resolveApiKey(options.apiKey === undefined ? undefined : { apiKey: options.apiKey });
-        if (resolved === undefined) {
-            err(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
+export async function resolveDeployAuth(options) {
+    const err = options.err ?? ((text) => void process.stderr.write(text));
+    const resolved = await resolveApiKey(options.apiKey === undefined ? undefined : { apiKey: options.apiKey });
+    if (resolved === undefined) {
+        err(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
+        return 1;
+    }
+    // The deployment management routes live on the external API host
+    // (api.cursor.com), not the default backend (api2.cursor.sh) — see
+    // cursorExternalApiUrl. GetMe below stays on the resolved backend.
+    const client = new AgentServeDeployClient({
+        backendUrl: cursorExternalApiUrl(),
+        apiKey: resolved.apiKey,
+        fetchImpl: options.fetchImpl,
+    });
+    let teamId;
+    if (options.team !== undefined) {
+        teamId = Number.parseInt(options.team, 10);
+        if (Number.isNaN(teamId) || teamId <= 0) {
+            err(`Invalid --team: ${options.team} (expected a positive team id)\n`);
             return 1;
         }
-        // The deployment management routes live on the external API host
-        // (api.cursor.com), not the default backend (api2.cursor.sh) — see
-        // cursorExternalApiUrl. GetMe below stays on the resolved backend.
-        const client = new AgentServeDeployClient({
-            backendUrl: cursorExternalApiUrl(),
+    }
+    else {
+        const account = new CursorBackendClient({
+            backendUrl: resolved.backendUrl,
             apiKey: resolved.apiKey,
             fetchImpl: options.fetchImpl,
         });
-        let teamId;
-        if (options.team !== undefined) {
-            teamId = Number.parseInt(options.team, 10);
-            if (Number.isNaN(teamId) || teamId <= 0) {
-                err(`Invalid --team: ${options.team} (expected a positive team id)\n`);
-                return 1;
-            }
+        let identity;
+        try {
+            identity = await account.getMe();
         }
-        else {
-            const account = new CursorBackendClient({
-                backendUrl: resolved.backendUrl,
-                apiKey: resolved.apiKey,
-                fetchImpl: options.fetchImpl,
-            });
-            let identity;
-            try {
-                identity = yield account.getMe();
-            }
-            catch (error) {
-                err(`Could not resolve your team from the Cursor account: ${describeError(error)}\nPass --team <id> explicitly.\n`);
-                return 1;
-            }
-            if (identity.teamId === undefined || identity.teamId <= 0) {
-                err("This Cursor account has no default team; pass --team <id> (find it in the Cursor dashboard URL).\n");
-                return 1;
-            }
-            teamId = identity.teamId;
-            const dim = stderrPalette().dim;
-            err(`${dim(`Using team ${teamId}${identity.teamName === undefined ? "" : ` (${identity.teamName})`}`)}\n${dim("  the account's team — pass --team to override.")}\n`);
+        catch (error) {
+            err(`Could not resolve your team from the Cursor account: ${describeError(error)}\nPass --team <id> explicitly.\n`);
+            return 1;
         }
-        return {
-            client,
-            teamId,
-            apiKey: resolved.apiKey,
-            backendUrl: resolved.backendUrl,
-        };
-    });
+        if (identity.teamId === undefined || identity.teamId <= 0) {
+            err("This Cursor account has no default team; pass --team <id> (find it in the Cursor dashboard URL).\n");
+            return 1;
+        }
+        teamId = identity.teamId;
+        const dim = stderrPalette().dim;
+        err(`${dim(`Using team ${teamId}${identity.teamName === undefined ? "" : ` (${identity.teamName})`}`)}\n${dim("  the account's team — pass --team to override.")}\n`);
+    }
+    return {
+        client,
+        teamId,
+        apiKey: resolved.apiKey,
+        backendUrl: resolved.backendUrl,
+    };
 }
 /**
  * Shared preamble: credentials → client → team id. Returns an exit code
  * (with the error already rendered) when resolution fails.
  */
-export function prepare(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
-        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((text) => void process.stdout.write(text));
-        const err = (_b = options.err) !== null && _b !== void 0 ? _b : ((text) => void process.stderr.write(text));
-        const auth = yield resolveDeployAuth({
-            team: options.team,
-            apiKey: options.apiKey,
-            fetchImpl: options.fetchImpl,
-            err,
-        });
-        if (typeof auth === "number") {
-            return auth;
-        }
-        return {
-            client: auth.client,
-            teamId: auth.teamId,
-            apiKey: auth.apiKey,
-            backendUrl: auth.backendUrl,
-            json: options.json === true,
-            noWait: options.noWait === true,
-            pollIntervalMs: (_c = options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS,
-            timeoutMs: (_d = options.timeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_DEPLOY_TIMEOUT_MS,
-            out,
-            err,
-        };
+export async function prepare(options) {
+    const out = options.out ?? ((text) => void process.stdout.write(text));
+    const err = options.err ?? ((text) => void process.stderr.write(text));
+    const auth = await resolveDeployAuth({
+        team: options.team,
+        apiKey: options.apiKey,
+        fetchImpl: options.fetchImpl,
+        err,
     });
+    if (typeof auth === "number") {
+        return auth;
+    }
+    return {
+        client: auth.client,
+        teamId: auth.teamId,
+        apiKey: auth.apiKey,
+        backendUrl: auth.backendUrl,
+        json: options.json === true,
+        noWait: options.noWait === true,
+        pollIntervalMs: options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS,
+        timeoutMs: options.timeoutMs ?? DEFAULT_DEPLOY_TIMEOUT_MS,
+        out,
+        err,
+    };
 }
 // ============================================================================
 // deploy
 // ============================================================================
-export function cmdDeploy(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        if (options.multiTenant === true && ctx.teamId !== MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
-            ctx.err("--multi-tenant is not available for this team.\n");
-            return 1;
-        }
-        const targets = yield resolveDeployTargets(options, ctx);
-        if (typeof targets === "number") {
-            return targets;
-        }
-        if (targets.length === 1) {
-            return deployOne(ctx, options, targets[0]);
-        }
-        // Multi-agent parent: when every child declares `architecture: "v2"`,
-        // the v2 control plane models sibling agents as release components of
-        // ONE application, so deploy them together (one app, one component per
-        // child) instead of minting a separate application per child. Mixed and
-        // v1 parents keep the per-child sequential deploys.
-        const manifests = [];
-        for (const target of targets) {
-            manifests.push(yield readDeployManifest(target.dir));
-        }
-        if (manifests.every(manifest => manifest.architecture === "v2")) {
-            return deployAgentsdkApplication(ctx, options, targets, {
-                // `persistent` is per child agent, like `agentPath`: each release
-                // component carries its own.
-                componentPersistent: Object.fromEntries(targets.map((target, index) => { var _a; return [target.slug, ((_a = manifests[index]) === null || _a === void 0 ? void 0 : _a.persistent) === true]; })),
-                componentImage: Object.fromEntries(targets.flatMap((target, index) => { var _a; return ((_a = manifests[index]) === null || _a === void 0 ? void 0 : _a.image) === undefined ? [] : [[target.slug, manifests[index].image]]; })),
-                hasScmChannels: manifests.some(manifest => manifest.hasScmChannels),
-                declaredSecretNames: [
-                    ...new Set(manifests.flatMap(manifest => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
-                ],
-                hasDeploymentsChannels: manifests.some(manifest => manifest.hasDeploymentsChannels),
-            });
-        }
-        if (!ctx.json && manifests.some(manifest => manifest.architecture === "v2")) {
-            ctx.err(`warning: agents under this parent mix architectures; deploying each separately (v2 children become standalone single-component applications).\n`);
+export async function cmdDeploy(options) {
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    if (options.multiTenant === true && ctx.teamId !== MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+        ctx.err("--multi-tenant is not available for this team.\n");
+        return 1;
+    }
+    const targets = await resolveDeployTargets(options, ctx);
+    if (typeof targets === "number") {
+        return targets;
+    }
+    if (targets.length === 1) {
+        return deployOne(ctx, options, targets[0]);
+    }
+    // Multi-agent parent: when every child declares `architecture: "v2"`,
+    // the v2 control plane models sibling agents as release components of
+    // ONE application, so deploy them together (one app, one component per
+    // child) instead of minting a separate application per child. Mixed and
+    // v1 parents keep the per-child sequential deploys.
+    const manifests = [];
+    for (const target of targets) {
+        manifests.push(await readDeployManifest(target.dir));
+    }
+    if (manifests.every(manifest => manifest.architecture === "v2")) {
+        return deployAgentsdkApplication(ctx, options, targets, {
+            // `persistent` is per child agent, like `agentPath`: each release
+            // component carries its own.
+            componentPersistent: Object.fromEntries(targets.map((target, index) => [target.slug, manifests[index]?.persistent === true])),
+            componentImage: Object.fromEntries(targets.flatMap((target, index) => manifests[index]?.image === undefined ? [] : [[target.slug, manifests[index].image]])),
+            hasScmChannels: manifests.some(manifest => manifest.hasScmChannels),
+            declaredSecretNames: declaredSecretNames(manifests),
+            hasDeploymentsChannels: manifests.some(manifest => manifest.hasDeploymentsChannels),
+        });
+    }
+    if (!ctx.json && manifests.some(manifest => manifest.architecture === "v2")) {
+        ctx.err(`warning: agents under this parent mix architectures; deploying each separately (v2 children become standalone single-component applications).\n`);
+    }
+    // --path is per-agent (relative to the repo root). When deploying several
+    // agents, ignore a shared --path so each target can infer its own path.
+    let deployOptions = options;
+    if (options.path !== undefined) {
+        if (!ctx.json) {
+            ctx.err(`warning: ignoring --path ${JSON.stringify(options.path)} for a multi-agent deploy; each agent infers its own path from git.\n`);
         }
-        // --path is per-agent (relative to the repo root). When deploying several
-        // agents, ignore a shared --path so each target can infer its own path.
-        let deployOptions = options;
-        if (options.path !== undefined) {
-            if (!ctx.json) {
-                ctx.err(`warning: ignoring --path ${JSON.stringify(options.path)} for a multi-agent deploy; each agent infers its own path from git.\n`);
-            }
-            deployOptions = Object.assign(Object.assign({}, options), { path: undefined });
+        deployOptions = { ...options, path: undefined };
+    }
+    // Multi-agent batch: deploy sequentially; --json emits an array.
+    const jsonResults = [];
+    let failures = 0;
+    for (const [index, target] of targets.entries()) {
+        if (!ctx.json) {
+            ctx.err(`\n=== [${index + 1}/${targets.length}] Deploying ${target.slug} ===\n`);
         }
-        // Multi-agent batch: deploy sequentially; --json emits an array.
-        const jsonResults = [];
-        let failures = 0;
-        for (const [index, target] of targets.entries()) {
-            if (!ctx.json) {
-                ctx.err(`\n=== [${index + 1}/${targets.length}] Deploying ${target.slug} ===\n`);
-            }
-            const before = jsonResults.length;
-            const code = yield deployOne(ctx, deployOptions, target, {
-                jsonCollect: ctx.json ? jsonResults : undefined,
-            });
-            if (code !== 0) {
-                failures += 1;
-                if (ctx.json && jsonResults.length === before) {
-                    jsonResults.push({ slug: target.slug, error: "deploy failed" });
-                }
+        const before = jsonResults.length;
+        const code = await deployOne(ctx, deployOptions, target, {
+            jsonCollect: ctx.json ? jsonResults : undefined,
+        });
+        if (code !== 0) {
+            failures += 1;
+            if (ctx.json && jsonResults.length === before) {
+                jsonResults.push({ slug: target.slug, error: "deploy failed" });
             }
         }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify(jsonResults, null, 2)}\n`);
-        }
-        else if (failures > 0) {
-            ctx.err(`\n${failures} of ${targets.length} deploy(s) failed.\n`);
-        }
-        else {
-            ctx.err(`\nDeployed ${targets.length} agents.\n`);
-        }
-        return failures === 0 ? 0 : 1;
-    });
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(jsonResults, null, 2)}\n`);
+    }
+    else if (failures > 0) {
+        ctx.err(`\n${failures} of ${targets.length} deploy(s) failed.\n`);
+    }
+    else {
+        ctx.err(`\nDeployed ${targets.length} agents.\n`);
+    }
+    return failures === 0 ? 0 : 1;
 }
 /**
  * Resolve which agent directory(ies) to deploy from `--dir` / `--slug` /
  * `--all`, with an interactive picker when a multi-agent parent is on a TTY.
  */
-function resolveDeployTargets(options, ctx) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        let dir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
-        // A repo-root deploy commonly names the local agent through --path. Use
-        // that project for manifest discovery unless --dir or --all chose a scope.
-        if (options.dir === undefined && options.path !== undefined && options.all !== true) {
-            const localSourceDir = resolve(options.path);
-            if (yield isAgentProjectDir(localSourceDir)) {
-                dir = localSourceDir;
-            }
+async function resolveDeployTargets(options, ctx) {
+    let dir = resolve(options.dir ?? ".");
+    // A repo-root deploy commonly names the local agent through --path. Use
+    // that project for manifest discovery unless --dir or --all chose a scope.
+    if (options.dir === undefined && options.path !== undefined && options.all !== true) {
+        const localSourceDir = resolve(options.path);
+        if (await isAgentProjectDir(localSourceDir)) {
+            dir = localSourceDir;
         }
-        if (options.slug !== undefined) {
-            const slugError = validateDeploymentSlug(options.slug);
-            if (slugError !== undefined) {
-                ctx.err(`${slugError}\n`);
-                return 1;
-            }
+    }
+    if (options.slug !== undefined) {
+        const slugError = validateDeploymentSlug(options.slug);
+        if (slugError !== undefined) {
+            ctx.err(`${slugError}\n`);
+            return 1;
         }
-        if (options.all === true && options.slug !== undefined) {
-            ctx.err("Pass either --slug or --all, not both.\n");
+    }
+    if (options.all === true && options.slug !== undefined) {
+        ctx.err("Pass either --slug or --all, not both.\n");
+        return 1;
+    }
+    if (await isAgentProjectDir(dir)) {
+        if (options.all === true) {
+            ctx.err(`--all requires a multi-agent parent directory (several child agents under --dir); ${dir} is a single agent project.\n`);
             return 1;
         }
-        if (yield isAgentProjectDir(dir)) {
-            if (options.all === true) {
-                ctx.err(`--all requires a multi-agent parent directory (several child agents under --dir); ${dir} is a single agent project.\n`);
+        let slug;
+        if (options.slug !== undefined) {
+            slug = options.slug;
+        }
+        else {
+            const derived = slugFromDirectoryName(basename(dir));
+            if (derived === undefined) {
+                ctx.err(`Could not derive a deployment slug from the directory name ${JSON.stringify(basename(dir))}; pass --slug.\n`);
                 return 1;
             }
-            let slug;
-            if (options.slug !== undefined) {
-                slug = options.slug;
-            }
-            else {
-                const derived = slugFromDirectoryName(basename(dir));
-                if (derived === undefined) {
-                    ctx.err(`Could not derive a deployment slug from the directory name ${JSON.stringify(basename(dir))}; pass --slug.\n`);
-                    return 1;
-                }
-                slug = derived;
-                if (!ctx.json) {
-                    ctx.err(`Deploying as "${slug}" (from the directory name).\n`);
-                }
+            slug = derived;
+            if (!ctx.json) {
+                ctx.err(`Deploying as "${slug}" (from the directory name).\n`);
             }
-            return [{ slug, dir }];
         }
-        let children;
-        try {
-            children = yield listChildAgentDirs(dir);
+        return [{ slug, dir }];
+    }
+    let children;
+    try {
+        children = await listChildAgentDirs(dir);
+    }
+    catch (error) {
+        ctx.err(`${describeError(error)}\n`);
+        return 1;
+    }
+    // Deploy slugs are lowercase-only; normalize directory names the same way
+    // single-agent deploy does so MixedCase child dirs still deploy.
+    children = children.flatMap(child => {
+        const slug = slugFromDirectoryName(basename(child.dir));
+        if (slug === undefined) {
+            return [];
         }
-        catch (error) {
-            ctx.err(`${describeError(error)}\n`);
+        return [{ slug, dir: child.dir }];
+    });
+    if (children.length === 0) {
+        if (options.all === true) {
+            ctx.err(`--all requires child agent projects under --dir; none found in ${dir}.\n`);
             return 1;
         }
-        // Deploy slugs are lowercase-only; normalize directory names the same way
-        // single-agent deploy does so MixedCase child dirs still deploy.
-        children = children.flatMap(child => {
-            const slug = slugFromDirectoryName(basename(child.dir));
-            if (slug === undefined) {
-                return [];
-            }
-            return [{ slug, dir: child.dir }];
-        });
-        if (children.length === 0) {
-            if (options.all === true) {
-                ctx.err(`--all requires child agent projects under --dir; none found in ${dir}.\n`);
-                return 1;
-            }
-            // Bare-slug deploy against a non-agent directory (still requires --repo).
-            let slug;
-            if (options.slug !== undefined) {
-                slug = options.slug;
-            }
-            else {
-                const derived = slugFromDirectoryName(basename(dir));
-                if (derived === undefined) {
-                    ctx.err(`No agent projects under ${dir}, and could not derive a slug from ${JSON.stringify(basename(dir))}; pass --slug or --dir <agent>.\n`);
-                    return 1;
-                }
-                slug = derived;
-                if (!ctx.json) {
-                    ctx.err(`Deploying as "${slug}" (no agent project at ${dir}).\n`);
-                }
-            }
-            return [{ slug, dir }];
+        // Bare-slug deploy against a non-agent directory (still requires --repo).
+        let slug;
+        if (options.slug !== undefined) {
+            slug = options.slug;
         }
-        if (children.length === 1) {
-            const only = children[0];
-            if (options.all === true) {
-                // One child is fine for --all (degenerate multi-agent parent).
-            }
-            else if (options.slug !== undefined && options.slug.toLowerCase() !== only.slug) {
-                ctx.err(`No agent "${options.slug}" under ${dir}; found "${only.slug}".\n`);
+        else {
+            const derived = slugFromDirectoryName(basename(dir));
+            if (derived === undefined) {
+                ctx.err(`No agent projects under ${dir}, and could not derive a slug from ${JSON.stringify(basename(dir))}; pass --slug or --dir <agent>.\n`);
                 return 1;
             }
+            slug = derived;
             if (!ctx.json) {
-                ctx.err(`Deploying "${only.slug}" (only agent under ${basename(dir)}).\n`);
+                ctx.err(`Deploying as "${slug}" (no agent project at ${dir}).\n`);
             }
-            return [only];
         }
-        // Multiple children.
+        return [{ slug, dir }];
+    }
+    if (children.length === 1) {
+        const only = children[0];
         if (options.all === true) {
-            if (!ctx.json) {
-                ctx.err(`Deploying all ${children.length} agents under ${basename(dir)}: ${children.map(c => c.slug).join(", ")}.\n`);
-            }
-            return [...children];
+            // One child is fine for --all (degenerate multi-agent parent).
         }
-        if (options.slug !== undefined) {
-            const wanted = options.slug.toLowerCase();
-            const match = children.find(child => child.slug === wanted);
-            if (match === undefined) {
-                ctx.err(`No agent "${options.slug}" under ${dir}.\n` +
-                    formatAgentList(children) +
-                    `Pass --slug <name> or --all.\n`);
-                return 1;
-            }
-            return [match];
+        else if (options.slug !== undefined && options.slug.toLowerCase() !== only.slug) {
+            ctx.err(`No agent "${options.slug}" under ${dir}; found "${only.slug}".\n`);
+            return 1;
         }
-        // An all-v2 parent deploys as ONE application (siblings are components
-        // of a single app on the v2 control plane), so "deploy the parent" is
-        // unambiguous and needs no picker or --all. A child that is v1 — or
-        // fails to load — keeps the interactive picker below.
-        if (yield allChildrenAreV2(children)) {
-            if (!ctx.json) {
-                ctx.err(`Deploying all ${children.length} v2 agents under ${basename(dir)} as one application (pass --slug <name> to deploy a single agent standalone).\n`);
-            }
-            return [...children];
+        if (!ctx.json) {
+            ctx.err(`Deploying "${only.slug}" (only agent under ${basename(dir)}).\n`);
         }
-        const chooser = (_b = options.chooseTargets) !== null && _b !== void 0 ? _b : (agents => { var _a, _b; return promptChooseDeployTargets(agents, {
-            err: ctx.err,
-            stdin: (_a = options.stdin) !== null && _a !== void 0 ? _a : process.stdin,
-            interactive: ctx.json !== true &&
-                ((_b = options.stdin) !== null && _b !== void 0 ? _b : process.stdin).isTTY === true &&
-                process.stderr.isTTY === true,
-        }); });
-        const chosen = yield chooser(children);
-        if (chosen === null) {
-            ctx.err("Deploy cancelled.\n");
-            return 1;
+        return [only];
+    }
+    // Multiple children.
+    if (options.all === true) {
+        if (!ctx.json) {
+            ctx.err(`Deploying all ${children.length} agents under ${basename(dir)}: ${children.map(c => c.slug).join(", ")}.\n`);
         }
-        if (chosen.length === 0) {
-            ctx.err(`Multiple agents under ${dir}:\n` +
+        return [...children];
+    }
+    if (options.slug !== undefined) {
+        const wanted = options.slug.toLowerCase();
+        const match = children.find(child => child.slug === wanted);
+        if (match === undefined) {
+            ctx.err(`No agent "${options.slug}" under ${dir}.\n` +
                 formatAgentList(children) +
-                `Pass --slug <name> or --all (or re-run on a TTY to pick interactively).\n`);
+                `Pass --slug <name> or --all.\n`);
             return 1;
         }
-        return chosen;
-    });
+        return [match];
+    }
+    // An all-v2 parent deploys as ONE application (siblings are components
+    // of a single app on the v2 control plane), so "deploy the parent" is
+    // unambiguous and needs no picker or --all. A child that is v1 — or
+    // fails to load — keeps the interactive picker below.
+    if (await allChildrenAreV2(children)) {
+        if (!ctx.json) {
+            ctx.err(`Deploying all ${children.length} v2 agents under ${basename(dir)} as one application (pass --slug <name> to deploy a single agent standalone).\n`);
+        }
+        return [...children];
+    }
+    const chooser = options.chooseTargets ??
+        (agents => promptChooseDeployTargets(agents, {
+            err: ctx.err,
+            stdin: options.stdin ?? process.stdin,
+            interactive: ctx.json !== true &&
+                (options.stdin ?? process.stdin).isTTY === true &&
+                process.stderr.isTTY === true,
+        }));
+    const chosen = await chooser(children);
+    if (chosen === null) {
+        ctx.err("Deploy cancelled.\n");
+        return 1;
+    }
+    if (chosen.length === 0) {
+        ctx.err(`Multiple agents under ${dir}:\n` +
+            formatAgentList(children) +
+            `Pass --slug <name> or --all (or re-run on a TTY to pick interactively).\n`);
+        return 1;
+    }
+    return chosen;
 }
 function formatAgentList(agents) {
     return agents.map((agent, i) => `  ${i + 1}) ${agent.slug}\n`).join("");
@@ -376,240 +356,246 @@ function formatAgentList(agents) {
  * resolution falls back to the picker instead of failing the whole deploy
  * on a child the user might not even select.
  */
-function allChildrenAreV2(children) {
-    return __awaiter(this, void 0, void 0, function* () {
-        for (const child of children) {
-            try {
-                if ((yield readDeployManifest(child.dir)).architecture !== "v2") {
-                    return false;
-                }
-            }
-            catch (_a) {
+async function allChildrenAreV2(children) {
+    for (const child of children) {
+        try {
+            if ((await readDeployManifest(child.dir)).architecture !== "v2") {
                 return false;
             }
         }
-        return true;
-    });
+        catch {
+            return false;
+        }
+    }
+    return true;
 }
 /**
  * TTY picker for multi-agent parents. Non-interactive callers get `[]`
  * so {@link resolveDeployTargets} can print the --slug/--all hint.
  */
-export function promptChooseDeployTargets(agents, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        options.err(`Multiple agents (${agents.length}):\n` + formatAgentList(agents) + `  a) all\n`);
-        if (!options.interactive) {
-            return [];
-        }
-        options.err('Deploy which? Enter a number, slug, "all", or "q" to cancel: ');
-        const readLine = createLineReader(options.stdin);
-        // createLineReader pauses until data; ensure stdin is flowing on a TTY.
-        (_b = (_a = options.stdin).resume) === null || _b === void 0 ? void 0 : _b.call(_a);
-        const answer = (_c = (yield readLine())) === null || _c === void 0 ? void 0 : _c.trim().toLowerCase();
-        if (answer === undefined || answer === "q" || answer === "quit") {
-            return null;
-        }
-        if (answer === "a" || answer === "all" || answer === "*") {
-            return [...agents];
-        }
-        const asIndex = Number.parseInt(answer, 10);
-        if (!Number.isNaN(asIndex) &&
-            String(asIndex) === answer &&
-            asIndex >= 1 &&
-            asIndex <= agents.length) {
-            return [agents[asIndex - 1]];
-        }
-        const bySlug = agents.find(agent => agent.slug.toLowerCase() === answer);
-        if (bySlug !== undefined) {
-            return [bySlug];
-        }
-        options.err(`Unrecognized choice ${JSON.stringify(answer)} — expected 1–${agents.length}, a slug, "all", or "q". Aborting.\n`);
+export async function promptChooseDeployTargets(agents, options) {
+    options.err(`Multiple agents (${agents.length}):\n` + formatAgentList(agents) + `  a) all\n`);
+    if (!options.interactive) {
+        return [];
+    }
+    options.err('Deploy which? Enter a number, slug, "all", or "q" to cancel: ');
+    const readLine = createLineReader(options.stdin);
+    // createLineReader pauses until data; ensure stdin is flowing on a TTY.
+    options.stdin.resume?.();
+    const answer = (await readLine())?.trim().toLowerCase();
+    if (answer === undefined || answer === "q" || answer === "quit") {
         return null;
-    });
+    }
+    if (answer === "a" || answer === "all" || answer === "*") {
+        return [...agents];
+    }
+    const asIndex = Number.parseInt(answer, 10);
+    if (!Number.isNaN(asIndex) &&
+        String(asIndex) === answer &&
+        asIndex >= 1 &&
+        asIndex <= agents.length) {
+        return [agents[asIndex - 1]];
+    }
+    const bySlug = agents.find(agent => agent.slug.toLowerCase() === answer);
+    if (bySlug !== undefined) {
+        return [bySlug];
+    }
+    options.err(`Unrecognized choice ${JSON.stringify(answer)} — expected 1–${agents.length}, a slug, "all", or "q". Aborting.\n`);
+    return null;
 }
-function deployOne(ctx, options, target, extras) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
-        const { dir, slug } = target;
-        // Fill --repo/--ref/--path from the local git checkout when omitted so
-        // `agent-sdk deploy` inside an agent directory is enough. Only probe git
-        // for real agent projects (avoids ambient monorepo remotes when someone
-        // deploys a bare --slug). Explicit flags always win.
-        const isAgent = yield isAgentProjectDir(dir);
-        const needsGitInference = isAgent &&
-            (options.repo === undefined || options.ref === undefined || options.path === undefined);
-        const inferred = needsGitInference
-            ? yield inferDeployGitSource(dir, Object.assign({}, (options.git === undefined ? {} : { git: options.git })))
-            : {};
-        const gitRepoUrl = (_a = options.repo) !== null && _a !== void 0 ? _a : inferred.gitRepoUrl;
-        const gitRef = (_b = options.ref) !== null && _b !== void 0 ? _b : inferred.gitRef;
-        const agentPath = (_c = options.path) !== null && _c !== void 0 ? _c : inferred.agentPath;
-        if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
-            ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
+async function deployOne(ctx, options, target, extras) {
+    const { dir, slug } = target;
+    // Fill --repo/--ref/--path from the local git checkout when omitted so
+    // `agent-sdk deploy` inside an agent directory is enough. Only probe git
+    // for real agent projects (avoids ambient monorepo remotes when someone
+    // deploys a bare --slug). Explicit flags always win.
+    const isAgent = await isAgentProjectDir(dir);
+    const needsGitInference = isAgent &&
+        (options.repo === undefined || options.ref === undefined || options.path === undefined);
+    const inferred = needsGitInference
+        ? await inferDeployGitSource(dir, {
+            ...(options.git === undefined ? {} : { git: options.git }),
+        })
+        : {};
+    const gitRepoUrl = options.repo ?? inferred.gitRepoUrl;
+    const gitRef = options.ref ?? inferred.gitRef;
+    const agentPath = options.path ?? inferred.agentPath;
+    if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
+        ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
+        return 1;
+    }
+    if (gitRepoUrl === undefined) {
+        ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
+            `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
+        return 1;
+    }
+    for (const repo of options.cursorEventsRepos ?? []) {
+        if (!isValidCursorEventRepo(repo)) {
+            ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
             return 1;
         }
-        if (gitRepoUrl === undefined) {
-            ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
-                `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
-            return 1;
+    }
+    if (!ctx.json && gitRepoUrl !== undefined) {
+        const inferredBits = [];
+        if (options.repo === undefined && inferred.gitRepoUrl !== undefined) {
+            inferredBits.push("repo");
         }
-        for (const repo of (_d = options.cursorEventsRepos) !== null && _d !== void 0 ? _d : []) {
-            if (!isValidCursorEventRepo(repo)) {
-                ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
-                return 1;
-            }
+        if (options.ref === undefined && inferred.gitRef !== undefined) {
+            inferredBits.push("ref");
         }
-        if (!ctx.json && gitRepoUrl !== undefined) {
-            const inferredBits = [];
-            if (options.repo === undefined && inferred.gitRepoUrl !== undefined) {
-                inferredBits.push("repo");
-            }
-            if (options.ref === undefined && inferred.gitRef !== undefined) {
-                inferredBits.push("ref");
-            }
-            if (options.path === undefined && inferred.agentPath !== undefined) {
-                inferredBits.push("path");
-            }
-            ctx.err(`  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
-                (agentPath === undefined ? "" : `  path:   ${agentPath}\n`) +
-                (inferredBits.length === 0
-                    ? ""
-                    : `  (inferred ${inferredBits.join(", ")} from git; pass --repo/--ref/--path to override)\n`));
-        }
-        // The package manifest (`defineAgent({ hosting })`) is the source of
-        // truth for egress domains and expected secret names; flags override or
-        // augment it. Directories without an agent project have no manifest. The same load supplies the
-        // cursorAccount connection refs for the post-deploy connector auth and
-        // the channels declared public via `publicEndpoint()`.
-        const manifest = isAgent ? yield readDeployManifest(dir) : undefined;
-        const hosting = manifest === null || manifest === void 0 ? void 0 : manifest.hosting;
-        const egressAllowedDomains = [
-            ...new Set([...((_e = hosting === null || hosting === void 0 ? void 0 : hosting.egressDomains) !== null && _e !== void 0 ? _e : []), ...((_f = options.allowDomains) !== null && _f !== void 0 ? _f : [])]),
-        ];
-        const publicRoutePaths = ((_g = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIds) !== null && _g !== void 0 ? _g : []).map(channelId => `/v1/channels/${channelId}`);
-        if (!ctx.json && (manifest === null || manifest === void 0 ? void 0 : manifest.httpChannelPublicEndpoint) === true) {
-            ctx.err(`warning: publicEndpoint() on the built-in HTTP channel has no effect on hosting — only custom channels (/v1/channels/…) can be public; the session API always requires the alias token.\n`);
-        }
-        if (!ctx.json && publicRoutePaths.length > 0 && (manifest === null || manifest === void 0 ? void 0 : manifest.architecture) !== "v2") {
-            // Security-relevant surface change: say exactly what will be reachable
-            // without the alias token before the deploy is accepted. v2 registers
-            // these routes only after bake, so a relative path here would not be a
-            // live webhook URL — the running status prints the absolute one.
-            ctx.err(`  public: ${publicRoutePaths.join(", ")} (served WITHOUT the alias token — these channels authenticate requests themselves)\n`);
-        }
-        const extensionEgress = (_h = manifest === null || manifest === void 0 ? void 0 : manifest.extensionEgress) !== null && _h !== void 0 ? _h : [];
-        if (!ctx.json && extensionEgress.length > 0) {
-            // Mounted packages widen the pod's egress without an agent.ts edit; name
-            // each one before the deploy is accepted.
-            ctx.err(`  egress from extensions: ${extensionEgress
-                .map(entry => `${entry.extension} (${entry.egressDomains.join(", ")})`)
-                .join("; ")}\n`);
-        }
-        const deadSecretChannels = (_j = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIdsWithDeadSecretPolicies) !== null && _j !== void 0 ? _j : [];
-        if (!ctx.json && deadSecretChannels.length > 0) {
-            ctx.err(`warning: ${deadSecretChannels
-                .map(channelId => `/v1/channels/${channelId}`)
-                .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
-        }
-        if ((manifest === null || manifest === void 0 ? void 0 : manifest.architecture) === "v2") {
-            if (!ctx.json) {
-                ctx.err(`  architecture: v2${manifest.persistent ? " (persistent)" : ""}${manifest.image === undefined ? "" : `\n  image: ${manifest.image}`}\n`);
-            }
-            return deployOneAgentsdk(ctx, extras, {
-                persistent: manifest.persistent,
-                image: manifest.image,
-                slug,
-                gitRepoUrl,
-                gitRef,
-                agentPath,
-                repositories: options.cursorEventsRepos,
-                hasScmChannels: manifest.hasScmChannels,
-                declaredSecretNames: hosting === null || hosting === void 0 ? void 0 : hosting.secretNames,
-                hasDeploymentsChannels: manifest.hasDeploymentsChannels,
-                multiTenant: options.multiTenant === true,
-            });
+        if (options.path === undefined && inferred.agentPath !== undefined) {
+            inferredBits.push("path");
         }
-        if (options.multiTenant === true) {
-            ctx.err("--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n");
-            return 1;
+        ctx.err(`  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
+            (agentPath === undefined ? "" : `  path:   ${agentPath}\n`) +
+            (inferredBits.length === 0
+                ? ""
+                : `  (inferred ${inferredBits.join(", ")} from git; pass --repo/--ref/--path to override)\n`));
+    }
+    // The package manifest (`defineAgent({ hosting })`) is the source of
+    // truth for egress domains and expected secret names; flags override or
+    // augment it. Directories without an agent project have no manifest. The same load supplies the
+    // cursorAccount connection refs for the post-deploy connector auth and
+    // the channels declared public via `publicEndpoint()`.
+    const manifest = isAgent ? await readDeployManifest(dir) : undefined;
+    const hosting = manifest?.hosting;
+    const egressAllowedDomains = [
+        ...new Set([...(hosting?.egressDomains ?? []), ...(options.allowDomains ?? [])]),
+    ];
+    const publicRoutePaths = (manifest?.publicChannelIds ?? []).map(channelId => `/v1/channels/${channelId}`);
+    if (!ctx.json && manifest?.httpChannelPublicEndpoint === true) {
+        ctx.err(`warning: publicEndpoint() on the built-in HTTP channel has no effect on hosting — only custom channels (/v1/channels/…) can be public; the session API always requires the alias token.\n`);
+    }
+    if (!ctx.json && publicRoutePaths.length > 0 && manifest?.architecture !== "v2") {
+        // Security-relevant surface change: say exactly what will be reachable
+        // without the alias token before the deploy is accepted. v2 registers
+        // these routes only after bake, so a relative path here would not be a
+        // live webhook URL — the running status prints the absolute one.
+        ctx.err(`  public: ${publicRoutePaths.join(", ")} (served WITHOUT the alias token — these channels authenticate requests themselves)\n`);
+    }
+    const extensionEgress = manifest?.extensionEgress ?? [];
+    if (!ctx.json && extensionEgress.length > 0) {
+        // Mounted packages widen the pod's egress without an agent.ts edit; name
+        // each one before the deploy is accepted.
+        ctx.err(`  egress from extensions: ${extensionEgress
+            .map(entry => `${entry.extension} (${entry.egressDomains.join(", ")})`)
+            .join("; ")}\n`);
+    }
+    const deadSecretChannels = manifest?.publicChannelIdsWithDeadSecretPolicies ?? [];
+    if (!ctx.json && deadSecretChannels.length > 0) {
+        ctx.err(`warning: ${deadSecretChannels
+            .map(channelId => `/v1/channels/${channelId}`)
+            .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
+    }
+    if (manifest?.architecture === "v2") {
+        if (!ctx.json) {
+            ctx.err(`  architecture: v2${manifest.persistent ? " (persistent)" : ""}${manifest.image === undefined ? "" : `\n  image: ${manifest.image}`}\n`);
         }
-        // Today's only source shape: the control plane builds from a git ref.
-        // See DeploySource for the artifact seam.
-        const source = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ kind: "git-ref", gitRepoUrl }, (gitRef === undefined ? {} : { gitRef })), (agentPath === undefined ? {} : { agentPath })), (options.cursorEventsRepos === undefined || options.cursorEventsRepos.length === 0
+        return deployOneAgentsdk(ctx, extras, {
+            persistent: manifest.persistent,
+            image: manifest.image,
+            slug,
+            gitRepoUrl,
+            gitRef,
+            agentPath,
+            repositories: options.cursorEventsRepos,
+            hasScmChannels: manifest.hasScmChannels,
+            declaredSecretNames: declaredSecretNames([manifest]),
+            hasDeploymentsChannels: manifest.hasDeploymentsChannels,
+            multiTenant: options.multiTenant === true,
+        });
+    }
+    if (options.multiTenant === true) {
+        ctx.err("--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n");
+        return 1;
+    }
+    // Today's only source shape: the control plane builds from a git ref.
+    // See DeploySource for the artifact seam.
+    const source = {
+        kind: "git-ref",
+        gitRepoUrl,
+        ...(gitRef === undefined ? {} : { gitRef }),
+        ...(agentPath === undefined ? {} : { agentPath }),
+        ...(options.cursorEventsRepos === undefined || options.cursorEventsRepos.length === 0
             ? {}
-            : { cursorEventRepos: options.cursorEventsRepos })), (egressAllowedDomains.length === 0 ? {} : { egressAllowedDomains })), { publicRoutePaths: publicRoutePaths.length === 0 ? undefined : publicRoutePaths });
-        let accepted;
-        try {
-            accepted = yield ctx.client.deploy({
-                teamId: ctx.teamId,
-                slug,
-                source,
-                template: readDeployTemplate(dir),
-            });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        const aliasUrl = ctx.client.aliasUrl(accepted.engineAlias);
-        if (!ctx.json && accepted.aliasToken !== undefined) {
-            ctx.out(aliasTokenBlock(accepted.aliasToken));
-        }
-        if (ctx.noWait) {
-            if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
-                extras.jsonCollect.push(accepted);
-            }
-            else if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, generation ${accepted.generation}, ${accepted.deploymentKind})\n` +
-                    `  alias: ${aliasUrl}\n` +
-                    `Check progress with \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.\n`);
-            }
-            return 0;
-        }
-        let detail;
-        try {
-            detail = yield pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES, () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        warnMissingSecrets(ctx, slug, hosting === null || hosting === void 0 ? void 0 : hosting.secretNames, detail.secretNames);
-        const payload = accepted.aliasToken === undefined ? detail : Object.assign(Object.assign({}, detail), { aliasToken: accepted.aliasToken });
-        if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
-            extras.jsonCollect.push(payload);
-            return detail.status === "running" ? 0 : 1;
+            : { cursorEventRepos: options.cursorEventsRepos }),
+        ...(egressAllowedDomains.length === 0 ? {} : { egressAllowedDomains }),
+        publicRoutePaths: publicRoutePaths.length === 0 ? undefined : publicRoutePaths,
+        // Deliberately NO manifest here: the control plane captures it from the
+        // provisioned engine (`GET /v1/manifest` after the health probe), which
+        // is the single write path for deploy manifests. `july manifest` remains
+        // available for local visibility only.
+    };
+    let accepted;
+    try {
+        accepted = await ctx.client.deploy({
+            teamId: ctx.teamId,
+            slug,
+            source,
+            template: readDeployTemplate(dir),
+        });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    const aliasUrl = ctx.client.aliasUrl(accepted.engineAlias);
+    if (!ctx.json && accepted.aliasToken !== undefined) {
+        ctx.out(aliasTokenBlock(accepted.aliasToken));
+    }
+    if (ctx.noWait) {
+        if (extras?.jsonCollect !== undefined) {
+            extras.jsonCollect.push(accepted);
         }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify(payload, null, 2)}\n`);
-            return detail.status === "running" ? 0 : 1;
+        else if (ctx.json) {
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
         }
-        if (detail.status !== "running") {
-            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
-            return 1;
+        else {
+            ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, generation ${accepted.generation}, ${accepted.deploymentKind})\n` +
+                `  alias: ${aliasUrl}\n` +
+                `Check progress with \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.\n`);
         }
-        const deployedPublicRoutes = (_k = detail.publicRoutePaths) !== null && _k !== void 0 ? _k : [];
-        ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
-            `  status:      running\n` +
-            `  generation:  ${detail.generation}\n` +
-            `  kind:        ${detail.deploymentKind}\n` +
-            `  alias:       ${aliasUrl}\n` +
-            `  playground:  ${aliasUrl}/playground (sign in with the alias token)\n` +
-            `               open: ${CLI} playground --prod --slug ${slug} --team ${ctx.teamId}\n` +
-            // Paste-ready webhook URLs: these subtrees skip the alias token, so
-            // the channel handler must verify deliveries (webhook signatures).
-            deployedPublicRoutes
-                .map(path => `  public:      ${aliasUrl}${path} (no alias token)\n`)
-                .join(""));
-        yield runPostDeployConnectorAuth(ctx, options, {
-            slug,
-            connections: (_l = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _l !== void 0 ? _l : [],
-            serviceAccountId: deploymentServiceAccountId(detail),
-        });
         return 0;
+    }
+    let detail;
+    try {
+        detail = await pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES, () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    warnMissingSecrets(ctx, slug, declaredSecretNames([manifest]), detail.secretNames);
+    const payload = accepted.aliasToken === undefined ? detail : { ...detail, aliasToken: accepted.aliasToken };
+    if (extras?.jsonCollect !== undefined) {
+        extras.jsonCollect.push(payload);
+        return detail.status === "running" ? 0 : 1;
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(payload, null, 2)}\n`);
+        return detail.status === "running" ? 0 : 1;
+    }
+    if (detail.status !== "running") {
+        ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
+        return 1;
+    }
+    const deployedPublicRoutes = detail.publicRoutePaths ?? [];
+    ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
+        `  status:      running\n` +
+        `  generation:  ${detail.generation}\n` +
+        `  kind:        ${detail.deploymentKind}\n` +
+        `  alias:       ${aliasUrl}\n` +
+        `  playground:  ${aliasUrl}/playground (sign in with the alias token)\n` +
+        `               open: ${CLI} playground --prod --slug ${slug} --team ${ctx.teamId}\n` +
+        // Paste-ready webhook URLs: these subtrees skip the alias token, so
+        // the channel handler must verify deliveries (webhook signatures).
+        deployedPublicRoutes
+            .map(path => `  public:      ${aliasUrl}${path} (no alias token)\n`)
+            .join(""));
+    await runPostDeployConnectorAuth(ctx, options, {
+        slug,
+        connections: manifest?.cursorAccountConnections ?? [],
+        serviceAccountId: deploymentServiceAccountId(detail),
     });
+    return 0;
 }
 /**
  * Multi-agent parent whose children all declare `architecture: "v2"`:
@@ -618,158 +604,165 @@ function deployOne(ctx, options, target, extras) {
  * key is the child's slug and its path is the child directory relative to
  * the repo root (a shared --path names the parent's directory in the repo).
  */
-function deployAgentsdkApplication(ctx, options, targets, declarations) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e;
-        const parentDir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
-        const slug = slugFromDirectoryName(basename(parentDir));
-        if (slug === undefined) {
-            ctx.err(`Could not derive an application slug from the parent directory name ${JSON.stringify(basename(parentDir))} — rename it (deploy slugs use lowercase letters, digits, '-' or '_').\n`);
-            return 1;
-        }
-        const needsGitInference = options.repo === undefined || options.ref === undefined || options.path === undefined;
-        const inferred = needsGitInference
-            ? yield inferDeployGitSource(parentDir, Object.assign({}, (options.git === undefined ? {} : { git: options.git })))
-            : {};
-        const gitRepoUrl = (_b = options.repo) !== null && _b !== void 0 ? _b : inferred.gitRepoUrl;
-        const gitRef = (_c = options.ref) !== null && _c !== void 0 ? _c : inferred.gitRef;
-        const parentPath = (_d = options.path) !== null && _d !== void 0 ? _d : inferred.agentPath;
-        if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
-            ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
-            return 1;
-        }
-        if (gitRepoUrl === undefined) {
-            ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
-                `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
+async function deployAgentsdkApplication(ctx, options, targets, declarations) {
+    const parentDir = resolve(options.dir ?? ".");
+    const slug = slugFromDirectoryName(basename(parentDir));
+    if (slug === undefined) {
+        ctx.err(`Could not derive an application slug from the parent directory name ${JSON.stringify(basename(parentDir))} — rename it (deploy slugs use lowercase letters, digits, '-' or '_').\n`);
+        return 1;
+    }
+    const needsGitInference = options.repo === undefined || options.ref === undefined || options.path === undefined;
+    const inferred = needsGitInference
+        ? await inferDeployGitSource(parentDir, {
+            ...(options.git === undefined ? {} : { git: options.git }),
+        })
+        : {};
+    const gitRepoUrl = options.repo ?? inferred.gitRepoUrl;
+    const gitRef = options.ref ?? inferred.gitRef;
+    const parentPath = options.path ?? inferred.agentPath;
+    if (gitRepoUrl !== undefined && !gitRepoUrl.startsWith("https://")) {
+        ctx.err(`Invalid --repo: ${gitRepoUrl} (expected an https:// git repository URL)\n`);
+        return 1;
+    }
+    if (gitRepoUrl === undefined) {
+        ctx.err(`Could not resolve an https:// git repository URL for this deploy.\n` +
+            `  Pass --repo https://github.com/<owner>/<repo> (inferred from origin when possible).\n`);
+        return 1;
+    }
+    for (const repo of options.cursorEventsRepos ?? []) {
+        if (!isValidCursorEventRepo(repo)) {
+            ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
             return 1;
         }
-        for (const repo of (_e = options.cursorEventsRepos) !== null && _e !== void 0 ? _e : []) {
-            if (!isValidCursorEventRepo(repo)) {
-                ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
-                return 1;
-            }
-        }
-        const components = targets.map(target => ({
-            componentKey: target.slug,
-            agentPath: [parentPath, basename(target.dir)]
-                .filter((part) => part !== undefined && part !== "")
-                .join("/"),
-            persistent: declarations.componentPersistent[target.slug] === true,
-            image: declarations.componentImage[target.slug],
-        }));
-        if (!ctx.json) {
-            ctx.err(`Deploying "${slug}" as one v2 application with ${targets.length} components (slug from the parent directory name).\n` +
-                `  architecture: v2\n` +
-                `  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
-                components
-                    .map(component => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})${component.persistent ? " persistent" : ""}${component.image === undefined ? "" : ` image ${component.image}`}\n`; })
-                    .join(""));
-        }
-        return deployOneAgentsdk(ctx, undefined, {
-            // Multi-component: the flag travels on each component instead.
-            persistent: false,
-            slug,
-            gitRepoUrl,
-            gitRef,
-            agentPath: undefined,
-            components,
-            repositories: options.cursorEventsRepos,
-            hasScmChannels: declarations.hasScmChannels,
-            declaredSecretNames: declarations.declaredSecretNames,
-            hasDeploymentsChannels: declarations.hasDeploymentsChannels,
-            multiTenant: options.multiTenant === true,
-        });
+    }
+    const components = targets.map(target => ({
+        componentKey: target.slug,
+        agentPath: [parentPath, basename(target.dir)]
+            .filter((part) => part !== undefined && part !== "")
+            .join("/"),
+        persistent: declarations.componentPersistent[target.slug] === true,
+        image: declarations.componentImage[target.slug],
+    }));
+    if (!ctx.json) {
+        ctx.err(`Deploying "${slug}" as one v2 application with ${targets.length} components (slug from the parent directory name).\n` +
+            `  architecture: v2\n` +
+            `  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
+            components
+                .map(component => `  component: ${component.componentKey} (${component.agentPath ?? "."})${component.persistent ? " persistent" : ""}${component.image === undefined ? "" : ` image ${component.image}`}\n`)
+                .join(""));
+    }
+    return deployOneAgentsdk(ctx, undefined, {
+        // Multi-component: the flag travels on each component instead.
+        persistent: false,
+        slug,
+        gitRepoUrl,
+        gitRef,
+        agentPath: undefined,
+        components,
+        repositories: options.cursorEventsRepos,
+        hasScmChannels: declarations.hasScmChannels,
+        declaredSecretNames: declarations.declaredSecretNames,
+        hasDeploymentsChannels: declarations.hasDeploymentsChannels,
+        multiTenant: options.multiTenant === true,
     });
 }
 /**
  * `architecture: "v2"` deploy: POST `/internal/agentsdk/deployments` and
  * poll the matching GET.
  */
-function deployOneAgentsdk(ctx, extras, args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { slug } = args;
-        const componentsLine = args.components === undefined
-            ? ""
-            : `  components:  ${args.components.map(component => component.componentKey).join(", ")}\n`;
-        if (args.multiTenant && !ctx.json) {
-            ctx.err("  multi-tenant: existing product\n");
-        }
-        let accepted;
-        try {
-            accepted = yield ctx.client.deployAgentkit(Object.assign(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})), { persistent: args.persistent, image: args.image }));
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err, {
-                multiTenant: args.multiTenant,
-                teamId: ctx.teamId,
-            });
-        }
-        if (!ctx.json && accepted.aliasToken !== undefined) {
-            ctx.out(aliasTokenBlock(accepted.aliasToken));
-        }
-        if (ctx.noWait) {
-            if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
-                extras.jsonCollect.push(accepted);
-            }
-            else if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, v2)\n` +
-                    `  application: ${accepted.applicationId}\n` +
-                    `  release:     ${accepted.releaseId}\n` +
-                    `  alias:       ${ctx.client.aliasUrl(accepted.engineAlias)}\n` +
-                    componentsLine);
-            }
-            return 0;
-        }
-        let detail;
-        try {
-            detail = yield pollUntil(ctx, slug, TERMINAL_AGENTKIT_DEPLOY_STATUSES, () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }));
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        const payload = Object.assign(Object.assign({}, detail), { aliasToken: accepted.aliasToken });
-        if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
-            extras.jsonCollect.push(payload);
-            return detail.status === "running" ? 0 : 1;
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify(payload, null, 2)}\n`);
-            return detail.status === "running" ? 0 : 1;
+async function deployOneAgentsdk(ctx, extras, args) {
+    const { slug } = args;
+    const componentsLine = args.components === undefined
+        ? ""
+        : `  components:  ${args.components.map(component => component.componentKey).join(", ")}\n`;
+    if (args.multiTenant && !ctx.json) {
+        ctx.err("  multi-tenant: existing product\n");
+    }
+    let accepted;
+    try {
+        accepted = await ctx.client.deployAgentkit({
+            teamId: ctx.teamId,
+            slug,
+            gitRepoUrl: args.gitRepoUrl,
+            gitRef: args.gitRef,
+            agentPath: args.agentPath,
+            components: args.components,
+            repositories: args.repositories,
+            ...(args.multiTenant ? { multiTenant: true } : {}),
+            persistent: args.persistent,
+            image: args.image,
+        });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err, {
+            multiTenant: args.multiTenant,
+            teamId: ctx.teamId,
+        });
+    }
+    if (!ctx.json && accepted.aliasToken !== undefined) {
+        ctx.out(aliasTokenBlock(accepted.aliasToken));
+    }
+    if (ctx.noWait) {
+        if (extras?.jsonCollect !== undefined) {
+            extras.jsonCollect.push(accepted);
         }
-        if (detail.status !== "running") {
-            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
-            return 1;
+        else if (ctx.json) {
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
         }
-        warnMissingSecrets(ctx, slug, args.declaredSecretNames, detail.secretNames);
-        const watchesRepositories = args.hasScmChannels || args.hasDeploymentsChannels === true;
-        ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
-            `  status:       running\n` +
-            `  architecture: v2\n` +
-            `  application:  ${detail.applicationId}\n` +
-            `  release:      ${detail.releaseId}\n` +
-            `  alias:        ${ctx.client.aliasUrl(accepted.engineAlias)}\n` +
-            (args.components === undefined
-                ? ""
-                : `  components:   ${args.components
-                    .map(component => component.componentKey)
-                    .join(", ")}\n`) +
-            (detail.repositories === undefined || !watchesRepositories
-                ? ""
-                : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`) +
-            livePublicWebhookLines(ctx, detail));
-        // An agent with GitHub/Origin/deployments channels bound to no repository
-        // scope gets no deliveries at all (deployments channels receive the
-        // watched repos' deployment events), which is otherwise invisible here.
-        if (watchesRepositories && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
-            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin/deployments channels receive no events.\n` +
-                `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
+        else {
+            ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, v2)\n` +
+                `  application: ${accepted.applicationId}\n` +
+                `  release:     ${accepted.releaseId}\n` +
+                `  alias:       ${ctx.client.aliasUrl(accepted.engineAlias)}\n` +
+                componentsLine);
         }
         return 0;
-    });
+    }
+    let detail;
+    try {
+        detail = await pollUntil(ctx, slug, TERMINAL_AGENTKIT_DEPLOY_STATUSES, () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }));
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    const payload = { ...detail, aliasToken: accepted.aliasToken };
+    if (extras?.jsonCollect !== undefined) {
+        extras.jsonCollect.push(payload);
+        return detail.status === "running" ? 0 : 1;
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(payload, null, 2)}\n`);
+        return detail.status === "running" ? 0 : 1;
+    }
+    if (detail.status !== "running") {
+        ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
+        return 1;
+    }
+    warnMissingSecrets(ctx, slug, args.declaredSecretNames, detail.secretNames);
+    const watchesRepositories = args.hasScmChannels || args.hasDeploymentsChannels === true;
+    ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
+        `  status:       running\n` +
+        `  architecture: v2\n` +
+        `  application:  ${detail.applicationId}\n` +
+        `  release:      ${detail.releaseId}\n` +
+        `  alias:        ${ctx.client.aliasUrl(accepted.engineAlias)}\n` +
+        (args.components === undefined
+            ? ""
+            : `  components:   ${args.components
+                .map(component => component.componentKey)
+                .join(", ")}\n`) +
+        (detail.repositories === undefined || !watchesRepositories
+            ? ""
+            : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`) +
+        livePublicWebhookLines(ctx, detail));
+    // An agent with GitHub/Origin/deployments channels bound to no repository
+    // scope gets no deliveries at all (deployments channels receive the
+    // watched repos' deployment events), which is otherwise invisible here.
+    if (watchesRepositories && detail.repositories?.length === 0) {
+        ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin/deployments channels receive no events.\n` +
+            `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
+    }
+    return 0;
 }
 /**
  * Post-deploy connector authorization for `cursorAccount` connections: the
@@ -779,113 +772,124 @@ function deployOneAgentsdk(ctx, extras, args) {
  * ones skipped); otherwise it reports status only. Never affects the deploy
  * outcome — anything left unauthorized just gets a playground-page pointer.
  */
-function runPostDeployConnectorAuth(ctx, options, args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (args.connections.length === 0) {
-            return;
-        }
-        const { serviceAccountId } = args;
-        if (serviceAccountId === undefined) {
-            ctx.err(`warning: this agent uses Cursor account connectors, but the deployment has no service account; redeploy to mint one.\n`);
-            return;
-        }
-        const backendClient = new CursorBackendClient({
-            backendUrl: ctx.backendUrl,
-            apiKey: ctx.apiKey,
-            fetchImpl: options.fetchImpl,
-        });
-        const interactive = options.openBrowserImpl !== undefined ||
-            (process.stdout.isTTY === true && process.stdin.isTTY === true);
-        let anyUnauthorized = false;
-        for (const ref of args.connections) {
-            ctx.out(`\nThis agent uses Cursor account connectors (connection "${ref.name}"${ref.servers === undefined || ref.servers.length === 0 ? "" : `: ${ref.servers.join(", ")}`}).\n`);
-            try {
-                const result = yield authorizeCursorAccountConnectors({
-                    backendClient,
-                    teamId: ctx.teamId,
-                    slug: args.slug,
-                    serviceAccountId,
-                    connectionName: ref.name,
-                    servers: ref.servers,
-                    interactive,
-                    out: ctx.out,
-                    err: ctx.err,
-                    openBrowserImpl: options.openBrowserImpl,
-                    sleep: options.sleepImpl,
-                    pollIntervalMs: options.connectorPollIntervalMs,
-                    pollTimeoutMs: options.connectorPollTimeoutMs,
-                });
-                if (result.pending.length > 0 || result.errored.length > 0) {
-                    anyUnauthorized = true;
-                    if (result.pending.length > 0) {
-                        ctx.out(`Connectors not authorized yet: ${result.pending.join(", ")}.\n`);
-                    }
-                }
-            }
-            catch (error) {
+async function runPostDeployConnectorAuth(ctx, options, args) {
+    if (args.connections.length === 0) {
+        return;
+    }
+    const { serviceAccountId } = args;
+    if (serviceAccountId === undefined) {
+        ctx.err(`warning: this agent uses Cursor account connectors, but the deployment has no service account; redeploy to mint one.\n`);
+        return;
+    }
+    const backendClient = new CursorBackendClient({
+        backendUrl: ctx.backendUrl,
+        apiKey: ctx.apiKey,
+        fetchImpl: options.fetchImpl,
+    });
+    const interactive = options.openBrowserImpl !== undefined ||
+        (process.stdout.isTTY === true && process.stdin.isTTY === true);
+    let anyUnauthorized = false;
+    for (const ref of args.connections) {
+        ctx.out(`\nThis agent uses Cursor account connectors (connection "${ref.name}"${ref.servers === undefined || ref.servers.length === 0 ? "" : `: ${ref.servers.join(", ")}`}).\n`);
+        try {
+            const result = await authorizeCursorAccountConnectors({
+                backendClient,
+                teamId: ctx.teamId,
+                slug: args.slug,
+                serviceAccountId,
+                connectionName: ref.name,
+                servers: ref.servers,
+                interactive,
+                out: ctx.out,
+                err: ctx.err,
+                openBrowserImpl: options.openBrowserImpl,
+                sleep: options.sleepImpl,
+                pollIntervalMs: options.connectorPollIntervalMs,
+                pollTimeoutMs: options.connectorPollTimeoutMs,
+            });
+            if (result.pending.length > 0 || result.errored.length > 0) {
                 anyUnauthorized = true;
-                ctx.err(`warning: could not check connector authorization for "${ref.name}": ${describeError(error)}\n`);
+                if (result.pending.length > 0) {
+                    ctx.out(`Connectors not authorized yet: ${result.pending.join(", ")}.\n`);
+                }
             }
         }
-        if (anyUnauthorized) {
-            ctx.out(`You can authorize connectors at the playground page (cursor.com dashboard → Deployed Agents → ${args.slug}) or with \`${CLI} mcp oauth <connection>\`.\n`);
+        catch (error) {
+            anyUnauthorized = true;
+            ctx.err(`warning: could not check connector authorization for "${ref.name}": ${describeError(error)}\n`);
         }
-    });
+    }
+    if (anyUnauthorized) {
+        ctx.out(`You can authorize connectors at the playground page (cursor.com dashboard → Deployed Agents → ${args.slug}) or with \`${CLI} mcp oauth <connection>\`.\n`);
+    }
 }
 /**
  * Read the deploy-relevant bits of the project manifest at `dir` in one
  * load: the `hosting` block, the agent's cursorAccount connections, and the
  * channels declared public via `publicEndpoint()`.
  */
-function readDeployManifest(dir) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        var _b, _c;
-        const project = yield loadAgentProject(dir);
-        // Fail here, before anything is dispatched: a project with error
-        // diagnostics (e.g. agent/storage.ts on architecture v2) would only be
-        // refused later by `serve` inside the hosted build, wasting a bake.
-        if (hasErrorDiagnostics(project)) {
-            throw new Error(`Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(project.diagnostics.filter(d => d.severity === "error"))}`);
-        }
-        return {
-            hosting: project.agent.hosting,
-            architecture: project.agent.architecture,
-            persistent: project.agent.persistent === true,
-            image: (_a = project.agent.hosting) === null || _a === void 0 ? void 0 : _a.image,
-            cursorAccountConnections: project.agent.connections.flatMap(connection => isCursorAccountTransport(connection.transport)
-                ? [{ name: connection.name, servers: connection.transport.servers }]
-                : []),
-            publicChannelIds: project.channels
-                .filter(channel => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
-                .map(channel => channel.id),
-            publicChannelIdsWithDeadSecretPolicies: project.channels
-                .filter(channel => {
-                var _a;
-                const auth = (_a = channel.definition.auth) !== null && _a !== void 0 ? _a : [];
-                return (auth.some(isPublicEndpointPolicy) &&
-                    auth.some(policy => {
-                        var _a;
-                        const kind = (_a = catchAuthDeclaration(policy)) === null || _a === void 0 ? void 0 : _a.kind;
-                        return kind !== undefined && kind !== "public";
-                    }));
-            })
-                .map(channel => channel.id),
-            httpChannelPublicEndpoint: ((_b = project.httpChannel.auth) !== null && _b !== void 0 ? _b : []).some(isPublicEndpointPolicy),
-            hasScmChannels: project.channels.some(channel => {
-                var _a;
-                const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
-                return kind === "github" || kind === "origin";
-            }),
-            hasDeploymentsChannels: project.channels.some(channel => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
-            extensionEgress: ((_c = project.agent.extensions) !== null && _c !== void 0 ? _c : []).flatMap(extension => {
-                var _a;
-                var _b;
-                const egressDomains = (_b = (_a = extension.hosting) === null || _a === void 0 ? void 0 : _a.egressDomains) !== null && _b !== void 0 ? _b : [];
-                return egressDomains.length === 0 ? [] : [{ extension: extension.name, egressDomains }];
-            }),
-        };
-    });
+async function readDeployManifest(dir) {
+    const project = await loadAgentProject(dir);
+    // Fail here, before anything is dispatched: a project with error
+    // diagnostics (e.g. agent/storage.ts on architecture v2) would only be
+    // refused later by `serve` inside the hosted build, wasting a bake.
+    if (hasErrorDiagnostics(project)) {
+        throw new Error(`Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(project.diagnostics.filter(d => d.severity === "error"))}`);
+    }
+    return {
+        hosting: project.agent.hosting,
+        architecture: project.agent.architecture,
+        persistent: project.agent.persistent === true,
+        image: project.agent.hosting?.image,
+        cursorAccountConnections: project.agent.connections.flatMap(connection => isCursorAccountTransport(connection.transport)
+            ? [{ name: connection.name, servers: connection.transport.servers }]
+            : []),
+        publicChannelIds: project.channels
+            .filter(channel => (channel.definition.auth ?? []).some(isPublicEndpointPolicy))
+            .map(channel => channel.id),
+        publicChannelIdsWithDeadSecretPolicies: project.channels
+            .filter(channel => {
+            const auth = channel.definition.auth ?? [];
+            return (auth.some(isPublicEndpointPolicy) &&
+                auth.some(policy => {
+                    const kind = catchAuthDeclaration(policy)?.kind;
+                    return kind !== undefined && kind !== "public";
+                }));
+        })
+            .map(channel => channel.id),
+        httpChannelPublicEndpoint: (project.httpChannel.auth ?? []).some(isPublicEndpointPolicy),
+        catchSecretNames: [
+            ...new Set(project.channels.flatMap(channel => channelCatchSecretNames(channel.definition))),
+        ],
+        credentialSecretNames: [
+            ...new Set(project.channels.flatMap(channel => channelCredentialSecretNames(channel.definition))),
+        ],
+        hasScmChannels: project.channels.some(channel => {
+            const kind = channel.definition.meta?.kind;
+            return kind === "github" || kind === "origin";
+        }),
+        hasDeploymentsChannels: project.channels.some(channel => channel.definition.meta?.kind === "deployments"),
+        extensionEgress: (project.agent.extensions ?? []).flatMap(extension => {
+            const egressDomains = extension.hosting?.egressDomains ?? [];
+            return egressDomains.length === 0 ? [] : [{ extension: extension.name, egressDomains }];
+        }),
+    };
+}
+/**
+ * Every secret name the deployment is expected to carry: the authored
+ * `hosting.secretNames` plus the names the control plane verifies caught
+ * requests with. Empty when the manifests declare none.
+ */
+function declaredSecretNames(manifests) {
+    return [
+        ...new Set(manifests.flatMap(manifest => manifest === undefined
+            ? []
+            : [
+                ...(manifest.hosting?.secretNames ?? []),
+                ...manifest.catchSecretNames,
+                ...manifest.credentialSecretNames,
+            ])),
+    ];
 }
 /**
  * Friendly post-deploy nudge: the manifest declares secrets the agent
@@ -895,7 +899,7 @@ function warnMissingSecrets(ctx, slug, declared, set) {
     if (declared === undefined || declared.length === 0) {
         return;
     }
-    const setNames = new Set(set !== null && set !== void 0 ? set : []);
+    const setNames = new Set(set ?? []);
     // Platform-managed names (CURSOR_*, hosted storage) are injected by the
     // control plane and never appear in secrets list — do not warn on them.
     const missing = declared.filter(name => !setNames.has(name) && !isReservedSecretName(name));
@@ -908,160 +912,155 @@ function warnMissingSecrets(ctx, slug, declared, set) {
 // ============================================================================
 // deployments (list)
 // ============================================================================
-export function cmdDeployments(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let deployments;
-        try {
-            deployments = yield ctx.client.listDeployments({ teamId: ctx.teamId });
-        }
-        catch (error) {
+export async function cmdDeployments(options) {
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let deployments;
+    try {
+        deployments = await ctx.client.listDeployments({ teamId: ctx.teamId });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    let applications = [];
+    try {
+        applications = await ctx.client.listAgentkitDeployments({
+            teamId: ctx.teamId,
+        });
+    }
+    catch (error) {
+        // Older control planes 404 this route; keep listing v1.
+        if (!(error instanceof DeployApiError && error.status === 404)) {
             return renderApiError(error, ctx.err);
         }
-        let applications = [];
-        try {
-            applications = yield ctx.client.listAgentkitDeployments({
-                teamId: ctx.teamId,
-            });
-        }
-        catch (error) {
-            // Older control planes 404 this route; keep listing v1.
-            if (!(error instanceof DeployApiError && error.status === 404)) {
-                return renderApiError(error, ctx.err);
-            }
-        }
-        if (ctx.json) {
-            // Empty v2 list keeps `{ deployments }` for v1-only parsers.
-            ctx.out(`${JSON.stringify(applications.length === 0 ? { deployments } : { deployments, applications }, null, 2)}\n`);
-            return 0;
-        }
-        if (deployments.length === 0 && applications.length === 0) {
-            ctx.out(`No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`);
-            return 0;
-        }
-        ctx.out(`${renderTable(["SLUG", "ARCH", "STATUS", "GEN", "KIND", "UPDATED"], [
-            ...deployments.map(d => { var _a; return [
-                d.slug,
-                "v1",
-                d.status,
-                String(d.generation),
-                d.deploymentKind,
-                (_a = d.desiredUpdatedAt) !== null && _a !== void 0 ? _a : "",
-            ]; }),
-            ...applications.map(application => { var _a; return [
-                application.slug,
-                "v2",
-                application.status,
-                "-",
-                "application",
-                (_a = application.deployments
-                    .map(row => row.desiredUpdatedAt)
-                    .sort()
-                    .at(-1)) !== null && _a !== void 0 ? _a : "",
-            ]; }),
-        ])}\n`);
+    }
+    if (ctx.json) {
+        // Empty v2 list keeps `{ deployments }` for v1-only parsers.
+        ctx.out(`${JSON.stringify(applications.length === 0 ? { deployments } : { deployments, applications }, null, 2)}\n`);
         return 0;
-    });
+    }
+    if (deployments.length === 0 && applications.length === 0) {
+        ctx.out(`No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`);
+        return 0;
+    }
+    ctx.out(`${renderTable(["SLUG", "ARCH", "STATUS", "GEN", "KIND", "UPDATED"], [
+        ...deployments.map(d => [
+            d.slug,
+            "v1",
+            d.status,
+            String(d.generation),
+            d.deploymentKind,
+            d.desiredUpdatedAt ?? "",
+        ]),
+        ...applications.map(application => [
+            application.slug,
+            "v2",
+            application.status,
+            "-",
+            "application",
+            application.deployments
+                .map(row => row.desiredUpdatedAt)
+                .sort()
+                .at(-1) ?? "",
+        ]),
+    ])}\n`);
+    return 0;
 }
 // ============================================================================
 // deployment <slug> (detail)
 // ============================================================================
-export function cmdDeploymentStatus(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} deployment <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
-        // GET goes first. A v2 404 (missing slug, or an older backend) falls
-        // through to the v1 agent-serve detail.
-        try {
-            const detail = yield ctx.client.getAgentkitDeploy({
-                teamId: ctx.teamId,
-                slug,
-            });
-            renderAgentkitDeploymentStatus(ctx, detail);
-            return 0;
-        }
-        catch (error) {
-            if (!(error instanceof DeployApiError) || error.status !== 404) {
-                return renderApiError(error, ctx.err);
-            }
-        }
-        let detail;
-        try {
-            detail = yield ctx.client.getDeployment({ teamId: ctx.teamId, slug });
-        }
-        catch (error) {
+export async function cmdDeploymentStatus(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} deployment <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+    // GET goes first. A v2 404 (missing slug, or an older backend) falls
+    // through to the v1 agent-serve detail.
+    try {
+        const detail = await ctx.client.getAgentkitDeploy({
+            teamId: ctx.teamId,
+            slug,
+        });
+        renderAgentkitDeploymentStatus(ctx, detail);
+        return 0;
+    }
+    catch (error) {
+        if (!(error instanceof DeployApiError) || error.status !== 404) {
             return renderApiError(error, ctx.err);
         }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
-            return 0;
-        }
-        const aliasUrl = ctx.client.aliasUrl(detail.engineAlias);
-        const lines = [`${detail.slug} (team ${detail.teamId})`, `  status:      ${detail.status}`];
-        if (detail.progress !== undefined) {
-            lines.push(`  progress:    ${detail.progress}`);
-        }
-        if (detail.statusMessage !== null &&
-            detail.statusMessage !== undefined &&
-            detail.statusMessage.trim() !== "") {
-            lines.push(`  step:        ${detail.statusMessage}`);
-        }
-        lines.push(`  generation:  ${detail.generation}`, `  kind:        ${detail.deploymentKind}`, `  alias:       ${aliasUrl}`, `  playground:  ${aliasUrl}/playground`);
-        if (detail.gitRepoUrl !== null && detail.gitRepoUrl !== undefined) {
-            lines.push(`  repo:        ${detail.gitRepoUrl} @ ${(_b = detail.gitRef) !== null && _b !== void 0 ? _b : ""}`);
-        }
-        if (detail.serviceAccountId !== undefined && detail.serviceAccountId !== null) {
-            lines.push(`  service account: ${detail.serviceAccountId}`);
-        }
-        if (detail.agentStoreSourceId !== undefined) {
-            // The durable file store's address: GET /v0/agent-serve-files/<id> lists
-            // it, and the pod sees it as AGENT_SERVE_STORE_SOURCE_ID.
-            lines.push(`  file store:  ${detail.agentStoreSourceId}`);
-        }
-        if (detail.egressAllowedDomains !== undefined && detail.egressAllowedDomains.length > 0) {
-            lines.push(`  egress:      ${detail.egressAllowedDomains.join(", ")}`);
-        }
-        if (detail.publicRoutePaths !== undefined && detail.publicRoutePaths.length > 0) {
-            // Served through the alias WITHOUT X-Agent-Alias-Token (the channel
-            // authenticates deliveries itself).
-            for (const path of detail.publicRoutePaths) {
-                lines.push(`  public:      ${aliasUrl}${path} (no alias token)`);
-            }
-        }
-        if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
-            lines.push(`  secrets:     ${detail.secretNames.join(", ")}`);
-        }
-        if (detail.podCredentialMaskedKey !== undefined && detail.podCredentialMaskedKey !== null) {
-            lines.push(`  pod credential: ${detail.podCredentialMaskedKey}`);
-        }
-        if (detail.engineUrl !== null && detail.engineUrl !== undefined) {
-            lines.push(`  engine:      ${detail.engineUrl}`);
-        }
-        if (detail.engineAccess !== null &&
-            detail.engineAccess !== undefined &&
-            typeof detail.engineAccess === "object") {
-            lines.push(`  engine access: ${detail.engineAccess.url} (expires ${detail.engineAccess.expiresAt})`);
-        }
-        if (detail.lastError !== null && detail.lastError !== undefined) {
-            lines.push(`  last error:  ${sanitizeCustomerError(detail.lastError)}`);
-        }
-        if (detail.desiredUpdatedAt !== undefined) {
-            lines.push(`  updated:     ${detail.desiredUpdatedAt}`);
-        }
-        ctx.out(`${lines.join("\n")}\n`);
+    }
+    let detail;
+    try {
+        detail = await ctx.client.getDeployment({ teamId: ctx.teamId, slug });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
         return 0;
-    });
+    }
+    const aliasUrl = ctx.client.aliasUrl(detail.engineAlias);
+    const lines = [`${detail.slug} (team ${detail.teamId})`, `  status:      ${detail.status}`];
+    if (detail.progress !== undefined) {
+        lines.push(`  progress:    ${detail.progress}`);
+    }
+    if (detail.statusMessage !== null &&
+        detail.statusMessage !== undefined &&
+        detail.statusMessage.trim() !== "") {
+        lines.push(`  step:        ${detail.statusMessage}`);
+    }
+    lines.push(`  generation:  ${detail.generation}`, `  kind:        ${detail.deploymentKind}`, `  alias:       ${aliasUrl}`, `  playground:  ${aliasUrl}/playground`);
+    if (detail.gitRepoUrl !== null && detail.gitRepoUrl !== undefined) {
+        lines.push(`  repo:        ${detail.gitRepoUrl} @ ${detail.gitRef ?? ""}`);
+    }
+    if (detail.serviceAccountId !== undefined && detail.serviceAccountId !== null) {
+        lines.push(`  service account: ${detail.serviceAccountId}`);
+    }
+    if (detail.agentStoreSourceId !== undefined) {
+        // The durable file store's address: GET /v0/agent-serve-files/<id> lists
+        // it, and the pod sees it as AGENT_SERVE_STORE_SOURCE_ID.
+        lines.push(`  file store:  ${detail.agentStoreSourceId}`);
+    }
+    if (detail.egressAllowedDomains !== undefined && detail.egressAllowedDomains.length > 0) {
+        lines.push(`  egress:      ${detail.egressAllowedDomains.join(", ")}`);
+    }
+    if (detail.publicRoutePaths !== undefined && detail.publicRoutePaths.length > 0) {
+        // Served through the alias WITHOUT X-Agent-Alias-Token (the channel
+        // authenticates deliveries itself).
+        for (const path of detail.publicRoutePaths) {
+            lines.push(`  public:      ${aliasUrl}${path} (no alias token)`);
+        }
+    }
+    if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+        lines.push(`  secrets:     ${detail.secretNames.join(", ")}`);
+    }
+    if (detail.podCredentialMaskedKey !== undefined && detail.podCredentialMaskedKey !== null) {
+        lines.push(`  pod credential: ${detail.podCredentialMaskedKey}`);
+    }
+    if (detail.engineUrl !== null && detail.engineUrl !== undefined) {
+        lines.push(`  engine:      ${detail.engineUrl}`);
+    }
+    if (detail.engineAccess !== null &&
+        detail.engineAccess !== undefined &&
+        typeof detail.engineAccess === "object") {
+        lines.push(`  engine access: ${detail.engineAccess.url} (expires ${detail.engineAccess.expiresAt})`);
+    }
+    if (detail.lastError !== null && detail.lastError !== undefined) {
+        lines.push(`  last error:  ${sanitizeCustomerError(detail.lastError)}`);
+    }
+    if (detail.desiredUpdatedAt !== undefined) {
+        lines.push(`  updated:     ${detail.desiredUpdatedAt}`);
+    }
+    ctx.out(`${lines.join("\n")}\n`);
+    return 0;
 }
 /**
  * Absolute webhook URLs for channels the running release actually admits
@@ -1071,12 +1070,11 @@ export function cmdDeploymentStatus(slug, options) {
  * the deployment URL is not this application's alias.
  */
 function livePublicWebhookLines(ctx, detail) {
-    var _a;
     const engineAlias = detail.engineAlias;
     if (detail.status !== "running" || engineAlias === undefined) {
         return "";
     }
-    return ((_a = detail.publicRoutePaths) !== null && _a !== void 0 ? _a : [])
+    return (detail.publicRoutePaths ?? [])
         .map(path => `  public:       ${ctx.client.aliasUrl(engineAlias)}${path} (no alias token)\n`)
         .join("");
 }
@@ -1114,84 +1112,81 @@ function renderAgentkitDeploymentStatus(ctx, detail) {
 // ============================================================================
 // stop <slug>
 // ============================================================================
-export function cmdStop(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        // Stop takes only a slug, so there is no manifest to dispatch on (unlike
-        // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
-        // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
-        // could not fall through. A v2 404 (including an older backend without
-        // the `/internal/agentsdk` mount) falls back to the v1 stop.
-        let architecture = "v2";
-        let accepted;
-        try {
-            accepted = yield ctx.client.stopAgentkit({
-                teamId: ctx.teamId,
-                slug,
-                cancelRuns: options.cancelRuns,
-            });
-        }
-        catch (error) {
-            if (!(error instanceof DeployApiError) || error.status !== 404) {
-                return renderApiError(error, ctx.err);
-            }
-            if (options.cancelRuns === true) {
-                ctx.err(`Canceling active runs while stopping is supported only for Agent SDK v2 deployments.\n`);
-                return 1;
-            }
-            try {
-                accepted = yield ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
-                architecture = "v1";
-            }
-            catch (v1Error) {
-                return renderApiError(v1Error, ctx.err);
-            }
+export async function cmdStop(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    // Stop takes only a slug, so there is no manifest to dispatch on (unlike
+    // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
+    // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
+    // could not fall through. A v2 404 (including an older backend without
+    // the `/internal/agentsdk` mount) falls back to the v1 stop.
+    let architecture = "v2";
+    let accepted;
+    try {
+        accepted = await ctx.client.stopAgentkit({
+            teamId: ctx.teamId,
+            slug,
+            cancelRuns: options.cancelRuns,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof DeployApiError) || error.status !== 404) {
+            return renderApiError(error, ctx.err);
         }
-        const cancellation = "cancellation" in accepted ? accepted.cancellation : undefined;
-        const stoppedGlobally = "scope" in accepted && accepted.scope === "global";
-        if (ctx.noWait) {
-            if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(stoppedGlobally
-                    ? `Stop accepted for ${slug} across all tenants (status: ${accepted.status}).\n`
-                    : `Stop accepted for ${slug} (status: ${accepted.status}).\n`);
-            }
-            return (cancellation === null || cancellation === void 0 ? void 0 : cancellation.failed) === 0 || cancellation === undefined ? 0 : 1;
+        if (options.cancelRuns === true) {
+            ctx.err(`Canceling active runs while stopping is supported only for Agent SDK v2 deployments.\n`);
+            return 1;
         }
-        let detail;
         try {
-            detail =
-                architecture === "v2"
-                    ? yield pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }))
-                    : yield pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+            accepted = await ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
+            architecture = "v1";
         }
-        catch (error) {
-            return renderApiError(error, ctx.err);
+        catch (v1Error) {
+            return renderApiError(v1Error, ctx.err);
         }
+    }
+    const cancellation = "cancellation" in accepted ? accepted.cancellation : undefined;
+    const stoppedGlobally = "scope" in accepted && accepted.scope === "global";
+    if (ctx.noWait) {
         if (ctx.json) {
-            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
-        }
-        else if (stoppedGlobally) {
-            ctx.out(`Stopped ${slug} across all tenants (team ${ctx.teamId}); resume with \`${CLI} start ${slug}\`.\n`);
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
         }
         else {
-            ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
+            ctx.out(stoppedGlobally
+                ? `Stop accepted for ${slug} across all tenants (status: ${accepted.status}).\n`
+                : `Stop accepted for ${slug} (status: ${accepted.status}).\n`);
         }
-        if (cancellation !== undefined) {
-            return writeCancellationStarted(ctx, cancellation, slug);
-        }
-        return 0;
-    });
+        return cancellation?.failed === 0 || cancellation === undefined ? 0 : 1;
+    }
+    let detail;
+    try {
+        detail =
+            architecture === "v2"
+                ? await pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug }))
+                : await pollUntil(ctx, slug, new Set(["stopped"]), () => ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+    }
+    else if (stoppedGlobally) {
+        ctx.out(`Stopped ${slug} across all tenants (team ${ctx.teamId}); resume with \`${CLI} start ${slug}\`.\n`);
+    }
+    else {
+        ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
+    }
+    if (cancellation !== undefined) {
+        return writeCancellationStarted(ctx, cancellation, slug);
+    }
+    return 0;
 }
 function writeCancellationStarted(ctx, cancellation, slug) {
     ctx.out(`Started cancellation across ${cancellation.batchesStarted} deployment batch(es).\n`);
@@ -1204,510 +1199,475 @@ function writeCancellationStarted(ctx, cancellation, slug) {
     }
     return 0;
 }
-export function cmdStart(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} start <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        try {
-            const accepted = yield ctx.client.startAgentkit({
-                teamId: ctx.teamId,
-                slug,
-            });
-            if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(`Started ${slug} (team ${ctx.teamId}).\n`);
-            }
-            return 0;
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-    });
-}
-export function cmdKill(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} kill <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let accepted;
-        try {
-            accepted = yield ctx.client.killAgentkit({ teamId: ctx.teamId, slug });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
+export async function cmdStart(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} start <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    try {
+        const accepted = await ctx.client.startAgentkit({
+            teamId: ctx.teamId,
+            slug,
+        });
         if (ctx.json) {
             ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
         }
         else {
-            ctx.out(accepted.scope === "global"
-                ? `Killed ${slug} across all tenants (team ${ctx.teamId}): deploys locked, admission stopped.\n`
-                : `Killed ${slug} (team ${ctx.teamId}): deploys locked, admission stopped.\n`);
-            ctx.out(`Resume traffic with \`${CLI} unlock-deploys ${slug}\` then \`${CLI} start ${slug}\`.\n`);
-            ctx.out(`Unlock deploys with \`${CLI} unlock-deploys ${slug}\`.\n`);
-        }
-        if (accepted.cancellation !== undefined) {
-            return writeCancellationStarted(ctx, accepted.cancellation, slug);
+            ctx.out(`Started ${slug} (team ${ctx.teamId}).\n`);
         }
         return 0;
-    });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
 }
-export function cmdUnlockDeploys(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} unlock-deploys <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        try {
-            const accepted = yield ctx.client.unlockAgentkitDeploys({
-                teamId: ctx.teamId,
-                slug,
-            });
-            if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(`Unlocked deploys for ${slug} (team ${ctx.teamId}).\n`);
-            }
-            return 0;
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-    });
+export async function cmdKill(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} kill <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let accepted;
+    try {
+        accepted = await ctx.client.killAgentkit({ teamId: ctx.teamId, slug });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+    }
+    else {
+        ctx.out(accepted.scope === "global"
+            ? `Killed ${slug} across all tenants (team ${ctx.teamId}): deploys locked, admission stopped.\n`
+            : `Killed ${slug} (team ${ctx.teamId}): deploys locked, admission stopped.\n`);
+        ctx.out(`Resume traffic with \`${CLI} unlock-deploys ${slug}\` then \`${CLI} start ${slug}\`.\n`);
+        ctx.out(`Unlock deploys with \`${CLI} unlock-deploys ${slug}\`.\n`);
+    }
+    if (accepted.cancellation !== undefined) {
+        return writeCancellationStarted(ctx, accepted.cancellation, slug);
+    }
+    return 0;
 }
-export function cmdCancelRuns(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} cancel-runs <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let result;
-        try {
-            result = yield ctx.client.cancelAgentkitRuns({
-                teamId: ctx.teamId,
-                slug,
-            });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
+export async function cmdUnlockDeploys(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} unlock-deploys <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    try {
+        const accepted = await ctx.client.unlockAgentkitDeploys({
+            teamId: ctx.teamId,
+            slug,
+        });
         if (ctx.json) {
-            ctx.out(`${JSON.stringify(result, null, 2)}\n`);
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
         }
         else {
-            ctx.out(`Started cancellation across ${result.batchesStarted} deployment batch(es).\n`);
-            if (result.sessionsMarkedFailed !== undefined) {
-                ctx.out(`Marked ${result.sessionsMarkedFailed} factory session(s) failed.\n`);
-            }
-        }
-        if (result.failed > 0) {
-            ctx.err(`Failed to start ${result.failed} cancellation batch(es).\n`);
-            return 1;
+            ctx.out(`Unlocked deploys for ${slug} (team ${ctx.teamId}).\n`);
         }
         return 0;
-    });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+}
+export async function cmdCancelRuns(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((text) => void process.stderr.write(text)))(`Usage: ${CLI} cancel-runs <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let result;
+    try {
+        result = await ctx.client.cancelAgentkitRuns({
+            teamId: ctx.teamId,
+            slug,
+        });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    else {
+        ctx.out(`Started cancellation across ${result.batchesStarted} deployment batch(es).\n`);
+        if (result.sessionsMarkedFailed !== undefined) {
+            ctx.out(`Marked ${result.sessionsMarkedFailed} factory session(s) failed.\n`);
+        }
+    }
+    if (result.failed > 0) {
+        ctx.err(`Failed to start ${result.failed} cancellation batch(es).\n`);
+        return 1;
+    }
+    return 0;
 }
 // ============================================================================
 // event-repos <slug> --repo <owner/name>...
 // ============================================================================
-export function cmdEventRepos(slug, repositories, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} event-repos <slug> --repo <owner/name>... [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let configured;
-        try {
-            configured = yield ctx.client.setAgentkitEventRepositories({
-                teamId: ctx.teamId,
-                slug,
-                repositories,
-            });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ repositories: configured }, null, 2)}\n`);
-        }
-        else if (configured.length === 0) {
-            ctx.out(`${slug} now watches no repositories.\n`);
-        }
-        else {
-            ctx.out(`${slug} now watches ${configured.join(", ")}.\n`);
-        }
-        return 0;
-    });
+export async function cmdEventRepos(slug, repositories, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((text) => void process.stderr.write(text)))(`Usage: ${CLI} event-repos <slug> --repo <owner/name>... [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let configured;
+    try {
+        configured = await ctx.client.setAgentkitEventRepositories({
+            teamId: ctx.teamId,
+            slug,
+            repositories,
+        });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ repositories: configured }, null, 2)}\n`);
+    }
+    else if (configured.length === 0) {
+        ctx.out(`${slug} now watches no repositories.\n`);
+    }
+    else {
+        ctx.out(`${slug} now watches ${configured.join(", ")}.\n`);
+    }
+    return 0;
 }
 // ============================================================================
 // upgrade <slug>
 // ============================================================================
 /** Release ids are uuids; anything else the user typed is a version. */
 const RELEASE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-export function cmdUpgrade(args, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return cmdPinRelease(args, options, {
-            usage: `Usage: ${CLI} upgrade <slug> [--release <id|version>] [--team <id>] [--json]\n`,
-            pin: (client, request) => client.upgradeAgentkitInstall(request),
-            success: (slug, releaseId) => `${slug} now runs release ${releaseId}.\n`,
-        });
+export async function cmdUpgrade(args, options) {
+    return cmdPinRelease(args, options, {
+        usage: `Usage: ${CLI} upgrade <slug> [--release <id|version>] [--team <id>] [--json]\n`,
+        pin: (client, request) => client.upgradeAgentkitInstall(request),
+        success: (slug, releaseId) => `${slug} now runs release ${releaseId}.\n`,
     });
 }
-export function cmdRollback(args, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return cmdPinRelease(args, options, {
-            usage: `Usage: ${CLI} rollback <slug> [--release <id|version>] [--team <id>] [--json]\n`,
-            pin: (client, request) => client.rollbackAgentkitInstall(request),
-            success: (slug, releaseId) => `${slug} rolled back to release ${releaseId}.\n`,
-        });
+export async function cmdRollback(args, options) {
+    return cmdPinRelease(args, options, {
+        usage: `Usage: ${CLI} rollback <slug> [--release <id|version>] [--team <id>] [--json]\n`,
+        pin: (client, request) => client.rollbackAgentkitInstall(request),
+        success: (slug, releaseId) => `${slug} rolled back to release ${releaseId}.\n`,
     });
 }
-function cmdPinRelease(args, options, pin) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        const { slug, release } = args;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(pin.usage);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        const selector = (_b = release === null || release === void 0 ? void 0 : release.trim()) !== null && _b !== void 0 ? _b : "";
-        let releaseId;
-        try {
-            releaseId = yield pin.pin(ctx.client, Object.assign({ teamId: ctx.teamId, slug }, (selector === ""
+async function cmdPinRelease(args, options, pin) {
+    const { slug, release } = args;
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((text) => void process.stderr.write(text)))(pin.usage);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    const selector = release?.trim() ?? "";
+    let releaseId;
+    try {
+        releaseId = await pin.pin(ctx.client, {
+            teamId: ctx.teamId,
+            slug,
+            ...(selector === ""
                 ? {}
                 : RELEASE_ID_RE.test(selector)
                     ? { releaseId: selector }
-                    : { version: selector })));
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ releaseId }, null, 2)}\n`);
-        }
-        else {
-            ctx.out(pin.success(slug, releaseId));
-        }
-        return 0;
-    });
+                    : { version: selector }),
+        });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ releaseId }, null, 2)}\n`);
+    }
+    else {
+        ctx.out(pin.success(slug, releaseId));
+    }
+    return 0;
 }
 // ============================================================================
 // delete <slug>
 // ============================================================================
-export function cmdDelete(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} delete <slug> [--team <id>] [--json] [--no-wait]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
-        // DELETE goes first. A v2 404 (missing slug, or an older backend)
-        // falls through to the v1 agent-serve delete.
-        let architecture = "v2";
-        let accepted;
-        try {
-            accepted = yield ctx.client.deleteAgentkit({ teamId: ctx.teamId, slug });
-        }
-        catch (error) {
-            if (!(error instanceof DeployApiError) || error.status !== 404) {
-                return renderApiError(error, ctx.err);
-            }
-            try {
-                accepted = yield ctx.client.deleteDeployment({
-                    teamId: ctx.teamId,
-                    slug,
-                });
-                architecture = "v1";
-            }
-            catch (v1Error) {
-                return renderApiError(v1Error, ctx.err);
-            }
-        }
-        if (ctx.noWait) {
-            if (ctx.json) {
-                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
-            }
-            else {
-                ctx.out(`Delete accepted for ${slug} (status: ${accepted.status}).\n`);
-            }
-            return 0;
-        }
-        try {
-            yield pollUntilGone(ctx, slug, () => architecture === "v2"
-                ? ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug })
-                : ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
-        }
-        catch (error) {
+export async function cmdDelete(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} delete <slug> [--team <id>] [--json] [--no-wait]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+    // DELETE goes first. A v2 404 (missing slug, or an older backend)
+    // falls through to the v1 agent-serve delete.
+    let architecture = "v2";
+    let accepted;
+    try {
+        accepted = await ctx.client.deleteAgentkit({ teamId: ctx.teamId, slug });
+    }
+    catch (error) {
+        if (!(error instanceof DeployApiError) || error.status !== 404) {
             return renderApiError(error, ctx.err);
         }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ slug, status: "deleted" }, null, 2)}\n`);
-        }
-        else {
-            ctx.out(`Deleted ${slug} (team ${ctx.teamId}).\n`);
-        }
-        return 0;
-    });
-}
-// ============================================================================
-// rotate-token <slug>
-// ============================================================================
-export function cmdRotateToken(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-token <slug> [--team <id>]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let aliasToken;
         try {
-            const architecture = yield deploymentArchitecture({
-                client: ctx.client,
+            accepted = await ctx.client.deleteDeployment({
                 teamId: ctx.teamId,
                 slug,
             });
-            aliasToken =
-                architecture === "v2"
-                    ? yield ctx.client.rotateAgentsdkAliasToken({
-                        teamId: ctx.teamId,
-                        slug,
-                    })
-                    : yield ctx.client.rotateAliasToken({
-                        teamId: ctx.teamId,
-                        slug,
-                    });
+            architecture = "v1";
         }
-        catch (error) {
-            return renderApiError(error, ctx.err);
+        catch (v1Error) {
+            return renderApiError(v1Error, ctx.err);
         }
+    }
+    if (ctx.noWait) {
         if (ctx.json) {
-            ctx.out(`${JSON.stringify({ aliasToken }, null, 2)}\n`);
-            return 0;
+            ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Delete accepted for ${slug} (status: ${accepted.status}).\n`);
         }
-        ctx.out(`Rotated the alias token for ${slug}. The old token stopped working immediately.\n${aliasTokenBlock(aliasToken)}`);
         return 0;
-    });
+    }
+    try {
+        await pollUntilGone(ctx, slug, () => architecture === "v2"
+            ? ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug })
+            : ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ slug, status: "deleted" }, null, 2)}\n`);
+    }
+    else {
+        ctx.out(`Deleted ${slug} (team ${ctx.teamId}).\n`);
+    }
+    return 0;
 }
 // ============================================================================
-// secrets set|list|unset
+// rotate-token <slug>
 // ============================================================================
-function secretDeploymentArchitecture(ctx, slug) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return deploymentArchitecture({
+export async function cmdRotateToken(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-token <slug> [--team <id>]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let aliasToken;
+    try {
+        const architecture = await deploymentArchitecture({
             client: ctx.client,
             teamId: ctx.teamId,
             slug,
         });
+        aliasToken =
+            architecture === "v2"
+                ? await ctx.client.rotateAgentsdkAliasToken({
+                    teamId: ctx.teamId,
+                    slug,
+                })
+                : await ctx.client.rotateAliasToken({
+                    teamId: ctx.teamId,
+                    slug,
+                });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ aliasToken }, null, 2)}\n`);
+        return 0;
+    }
+    ctx.out(`Rotated the alias token for ${slug}. The old token stopped working immediately.\n${aliasTokenBlock(aliasToken)}`);
+    return 0;
+}
+// ============================================================================
+// secrets set|list|unset
+// ============================================================================
+async function secretDeploymentArchitecture(ctx, slug) {
+    return deploymentArchitecture({
+        client: ctx.client,
+        teamId: ctx.teamId,
+        slug,
     });
 }
-export function cmdSecretsSet(slug, specs, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        const usageErr = (_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t));
-        if (slug === undefined || slug === "" || specs.length === 0) {
-            usageErr(`Usage: ${CLI} secrets set <slug> NAME [NAME2 ...] [--team <id>] [--json]\n` +
-                `  Hidden prompt on a TTY. One NAME reads all of stdin (redirect a PEM).\n` +
-                `  Several NAMEs: one stdin line each.\n` +
-                `  Opt-in (leaks into argv / agent terminals): NAME=VALUE … --from-argv\n`);
-            return 1;
-        }
-        // Parse and validate every name before prompting for any value, so a
-        // typo in the last name cannot waste typed-in secrets.
-        const parsed = [];
-        for (const spec of specs) {
-            const eq = spec.indexOf("=");
-            const name = eq === -1 ? spec : spec.slice(0, eq);
-            const nameError = validateSettableSecretName(name);
-            if (nameError !== undefined) {
-                usageErr(`${nameError}\n`);
-                return 1;
-            }
-            parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
-        }
-        const hasArgvValues = parsed.some(entry => entry.value !== undefined);
-        if (hasArgvValues && options.fromArgv !== true) {
-            usageErr(`Refusing NAME=VALUE on argv (shows up in shell history and agent-captured terminals).\n` +
-                `Pass names only:\n` +
-                `  ${CLI} secrets set ${slug} NAME\n` +
-                `Hidden prompt on a TTY. One NAME reads all of stdin, including newlines:\n` +
-                `  ${CLI} secrets set ${slug} NAME < ./secret.pem\n` +
-                `Several NAMEs take one stdin line each.\n`);
+export async function cmdSecretsSet(slug, specs, options) {
+    const usageErr = options.err ?? ((t) => void process.stderr.write(t));
+    if (slug === undefined || slug === "" || specs.length === 0) {
+        usageErr(`Usage: ${CLI} secrets set <slug> NAME [NAME2 ...] [--team <id>] [--json]\n` +
+            `  Hidden prompt on a TTY. One NAME reads all of stdin (redirect a PEM).\n` +
+            `  Several NAMEs: one stdin line each.\n` +
+            `  Opt-in (leaks into argv / agent terminals): NAME=VALUE … --from-argv\n`);
+        return 1;
+    }
+    // Parse and validate every name before prompting for any value, so a
+    // typo in the last name cannot waste typed-in secrets.
+    const parsed = [];
+    for (const spec of specs) {
+        const eq = spec.indexOf("=");
+        const name = eq === -1 ? spec : spec.slice(0, eq);
+        const nameError = validateSettableSecretName(name);
+        if (nameError !== undefined) {
+            usageErr(`${nameError}\n`);
             return 1;
         }
-        if (hasArgvValues) {
-            usageErr(`warning: --from-argv puts secret values in argv (shell history and agent-captured terminals).\n`);
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
+        parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
+    }
+    const hasArgvValues = parsed.some(entry => entry.value !== undefined);
+    if (hasArgvValues && options.fromArgv !== true) {
+        usageErr(`Refusing NAME=VALUE on argv (shows up in shell history and agent-captured terminals).\n` +
+            `Pass names only:\n` +
+            `  ${CLI} secrets set ${slug} NAME\n` +
+            `Hidden prompt on a TTY. One NAME reads all of stdin, including newlines:\n` +
+            `  ${CLI} secrets set ${slug} NAME < ./secret.pem\n` +
+            `Several NAMEs take one stdin line each.\n`);
+        return 1;
+    }
+    if (hasArgvValues) {
+        usageErr(`warning: --from-argv puts secret values in argv (shell history and agent-captured terminals).\n`);
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    const stdin = options.stdin ?? process.stdin;
+    const secrets = [];
+    let secretNames;
+    let architecture;
+    try {
+        const only = parsed.length === 1 ? parsed[0] : undefined;
+        if (only !== undefined && only.value === undefined && stdin.isTTY !== true) {
+            secrets.push({
+                name: only.name,
+                value: await readWholeStdinValue(stdin, only.name),
+            });
         }
-        const stdin = (_b = options.stdin) !== null && _b !== void 0 ? _b : process.stdin;
-        const secrets = [];
-        let secretNames;
-        let architecture;
-        try {
-            const only = parsed.length === 1 ? parsed[0] : undefined;
-            if (only !== undefined && only.value === undefined && stdin.isTTY !== true) {
+        else {
+            const readValue = createSecretValueReader(stdin, ctx.err);
+            for (const entry of parsed) {
                 secrets.push({
-                    name: only.name,
-                    value: yield readWholeStdinValue(stdin, only.name),
+                    name: entry.name,
+                    value: entry.value ?? (await readValue(entry.name)),
                 });
             }
-            else {
-                const readValue = createSecretValueReader(stdin, ctx.err);
-                for (const entry of parsed) {
-                    secrets.push({
-                        name: entry.name,
-                        value: (_c = entry.value) !== null && _c !== void 0 ? _c : (yield readValue(entry.name)),
-                    });
-                }
-            }
-            architecture = yield secretDeploymentArchitecture(ctx, slug);
-            secretNames =
-                architecture === "v2"
-                    ? yield ctx.client.setAgentkitSecrets({
-                        teamId: ctx.teamId,
-                        slug,
-                        secrets,
-                    })
-                    : yield ctx.client.setSecrets({
-                        teamId: ctx.teamId,
-                        slug,
-                        secrets,
-                    });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
         }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ secretNames }, null, 2)}\n`);
-            return 0;
-        }
-        ctx.out(`Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
-            `Secrets now set: ${secretNames.join(", ")}\n` +
-            (architecture === "v2"
-                ? `The next task picks them up; no redeploy is required.\n`
-                : `The engine picks them up on its next deploy.\n`));
+        architecture = await secretDeploymentArchitecture(ctx, slug);
+        secretNames =
+            architecture === "v2"
+                ? await ctx.client.setAgentkitSecrets({
+                    teamId: ctx.teamId,
+                    slug,
+                    secrets,
+                })
+                : await ctx.client.setSecrets({
+                    teamId: ctx.teamId,
+                    slug,
+                    secrets,
+                });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ secretNames }, null, 2)}\n`);
         return 0;
-    });
+    }
+    ctx.out(`Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
+        `Secrets now set: ${secretNames.join(", ")}\n` +
+        (architecture === "v2"
+            ? `The next task picks them up; no redeploy is required.\n`
+            : `The engine picks them up on its next deploy.\n`));
+    return 0;
 }
-export function cmdSecretsList(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets list <slug> [--team <id>] [--json]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let secrets;
-        try {
-            const architecture = yield secretDeploymentArchitecture(ctx, slug);
-            secrets =
-                architecture === "v2"
-                    ? yield ctx.client.listAgentkitSecrets({ teamId: ctx.teamId, slug })
-                    : yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ secrets }, null, 2)}\n`);
-            return 0;
-        }
-        if (secrets.length === 0) {
-            ctx.out(`No secrets set on ${slug}. Add one with \`${CLI} secrets set ${slug} NAME\`.\n`);
-            return 0;
-        }
-        ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map(secret => [secret.name, secret.createdAt]))}\n`);
+export async function cmdSecretsList(slug, options) {
+    if (slug === undefined || slug === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets list <slug> [--team <id>] [--json]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    let secrets;
+    try {
+        const architecture = await secretDeploymentArchitecture(ctx, slug);
+        secrets =
+            architecture === "v2"
+                ? await ctx.client.listAgentkitSecrets({ teamId: ctx.teamId, slug })
+                : await ctx.client.listSecrets({ teamId: ctx.teamId, slug });
+    }
+    catch (error) {
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ secrets }, null, 2)}\n`);
         return 0;
-    });
+    }
+    if (secrets.length === 0) {
+        ctx.out(`No secrets set on ${slug}. Add one with \`${CLI} secrets set ${slug} NAME\`.\n`);
+        return 0;
+    }
+    ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map(secret => [secret.name, secret.createdAt]))}\n`);
+    return 0;
 }
-export function cmdSecretsUnset(slug, name, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "" || name === undefined || name === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets unset <slug> NAME [--team <id>]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        try {
-            const architecture = yield secretDeploymentArchitecture(ctx, slug);
-            if (architecture === "v2") {
-                yield ctx.client.deleteAgentkitSecret({
-                    teamId: ctx.teamId,
-                    slug,
-                    name,
-                });
-            }
-            else {
-                yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
-            }
-        }
-        catch (error) {
-            if (error instanceof DeployApiError && error.status === 404) {
-                ctx.err(`No secret named ${name} on deployment ${slug} — check \`${CLI} secrets list ${slug}\` (and the slug / --team).\n`);
-                return 1;
-            }
-            return renderApiError(error, ctx.err);
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ removed: name }, null, 2)}\n`);
+export async function cmdSecretsUnset(slug, name, options) {
+    if (slug === undefined || slug === "" || name === undefined || name === "") {
+        (options.err ?? ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets unset <slug> NAME [--team <id>]\n`);
+        return 1;
+    }
+    const ctx = await prepare(options);
+    if (typeof ctx === "number") {
+        return ctx;
+    }
+    try {
+        const architecture = await secretDeploymentArchitecture(ctx, slug);
+        if (architecture === "v2") {
+            await ctx.client.deleteAgentkitSecret({
+                teamId: ctx.teamId,
+                slug,
+                name,
+            });
         }
         else {
-            ctx.out(`Removed secret ${name} from ${slug}.\n`);
+            await ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
         }
-        return 0;
-    });
+    }
+    catch (error) {
+        if (error instanceof DeployApiError && error.status === 404) {
+            ctx.err(`No secret named ${name} on deployment ${slug} — check \`${CLI} secrets list ${slug}\` (and the slug / --team).\n`);
+            return 1;
+        }
+        return renderApiError(error, ctx.err);
+    }
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify({ removed: name }, null, 2)}\n`);
+    }
+    else {
+        ctx.out(`Removed secret ${name} from ${slug}.\n`);
+    }
+    return 0;
 }
 /**
  * Returns a reader for interactive secret values: hidden (no-echo) prompt
@@ -1721,13 +1681,13 @@ function createSecretValueReader(stdin, err) {
         return name => promptHidden(stdin, err, `Value for ${name}: `);
     }
     const readLine = createLineReader(stdin);
-    return (name) => __awaiter(this, void 0, void 0, function* () {
-        const line = yield readLine();
+    return async (name) => {
+        const line = await readLine();
         if (line === undefined) {
             throw new DeployApiError(`stdin ended before a value for ${name} was provided (pipe one line per secret).`, 0);
         }
         return line;
-    });
+    };
 }
 /** Longest mask run drawn while typing a secret; the count carries the rest. */
 const SECRET_MASK_MAX_WIDTH = 24;
@@ -1738,9 +1698,8 @@ const SECRET_MASK_MAX_WIDTH = 24;
  * mask is clamped to the terminal width so the redraw stays on one line.
  */
 function renderSecretPromptLine(prompt, length, dim) {
-    var _a;
     const count = `${length} char${length === 1 ? "" : "s"}`;
-    const room = ((_a = process.stderr.columns) !== null && _a !== void 0 ? _a : 80) - prompt.length - count.length - 2;
+    const room = (process.stderr.columns ?? 80) - prompt.length - count.length - 2;
     const maskWidth = Math.max(0, Math.min(length, SECRET_MASK_MAX_WIDTH, room));
     // `·` over `•`: the rest of the CLI's progress output already uses it, and
     // fonts that ship no bullet glyph draw a tofu box in its place.
@@ -1754,19 +1713,17 @@ function renderSecretPromptLine(prompt, length, dim) {
  */
 function promptHidden(stdin, err, prompt) {
     return new Promise((resolvePromise, reject) => {
-        var _a;
         const { dim } = stderrPalette();
         let value = "";
         const draw = () => {
             err(renderSecretPromptLine(prompt, value.length, dim));
         };
         draw();
-        (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, true);
+        stdin.setRawMode?.(true);
         stdin.resume();
         const cleanup = () => {
-            var _a;
             stdin.off("data", onData);
-            (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, false);
+            stdin.setRawMode?.(false);
             stdin.pause();
             draw();
             err("\n");
@@ -1801,14 +1758,12 @@ function promptHidden(stdin, err, prompt) {
  * `echo value | secrets set slug NAME` still stores `value`. Internal
  * newlines stay, which is what a redirected PEM needs.
  */
-function readWholeStdinValue(stdin, name) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const raw = yield readStreamText(stdin);
-        if (raw === "") {
-            throw new DeployApiError(`stdin ended before a value for ${name} was provided.`, 0);
-        }
-        return stripOneTrailingNewline(raw);
-    });
+async function readWholeStdinValue(stdin, name) {
+    const raw = await readStreamText(stdin);
+    if (raw === "") {
+        throw new DeployApiError(`stdin ended before a value for ${name} was provided.`, 0);
+    }
+    return stripOneTrailingNewline(raw);
 }
 function stripOneTrailingNewline(value) {
     if (value.endsWith("\r\n")) {
@@ -1850,13 +1805,12 @@ export function createLineReader(stream) {
     let ended = false;
     const waiters = [];
     const drain = () => {
-        var _a, _b;
         while (waiters.length > 0) {
             const newline = buffer.indexOf("\n");
             if (newline !== -1) {
                 const line = buffer.slice(0, newline).replace(/\r$/, "");
                 buffer = buffer.slice(newline + 1);
-                (_a = waiters.shift()) === null || _a === void 0 ? void 0 : _a(line);
+                waiters.shift()?.(line);
                 continue;
             }
             if (!ended) {
@@ -1865,7 +1819,7 @@ export function createLineReader(stream) {
             // Stream ended: a trailing unterminated line still counts once.
             const rest = buffer;
             buffer = "";
-            (_b = waiters.shift()) === null || _b === void 0 ? void 0 : _b(rest === "" ? undefined : rest.replace(/\r$/, ""));
+            waiters.shift()?.(rest === "" ? undefined : rest.replace(/\r$/, ""));
         }
     };
     stream.on("data", (chunk) => {
@@ -1892,74 +1846,72 @@ export function createLineReader(stream) {
  * status so create → checkout → start is visible. Throws DeployApiError
  * on request failures or timeout.
  */
-function pollUntil(ctx, slug, terminal, fetchDetail) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const startedAt = Date.now();
-        const tty = process.stderr.isTTY === true;
-        let lastLabel;
-        let sawProgress = false;
-        const report = (detail) => {
-            if (ctx.json) {
-                return;
-            }
-            const label = deployProgressLabel(detail);
-            const elapsed = Math.round((Date.now() - startedAt) / 1000);
-            if (tty) {
-                ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
-                sawProgress = true;
-            }
-            else if (label !== lastLabel) {
-                ctx.err(`${slug}: ${label}\n`);
-            }
-            lastLabel = label;
-        };
-        const finishProgressLine = () => {
-            if (tty && sawProgress) {
-                ctx.err("\n");
-            }
-        };
-        for (;;) {
-            let detail;
-            try {
-                detail = yield fetchDetail();
-            }
-            catch (error) {
-                // Capacity / rate-limit on GET is not a bake failure. The v2 accept
-                // already started freeze; keep polling until the wait budget expires.
-                if (isTransientDeployStatusError(error) && Date.now() - startedAt < ctx.timeoutMs) {
-                    if (!ctx.json) {
-                        const elapsed = Math.round((Date.now() - startedAt) / 1000);
-                        const label = "Waiting for status (server busy)";
-                        if (tty) {
-                            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
-                            sawProgress = true;
-                        }
-                        else if (label !== lastLabel) {
-                            ctx.err(`${slug}: ${label}\n`);
-                        }
-                        lastLabel = label;
+async function pollUntil(ctx, slug, terminal, fetchDetail) {
+    const startedAt = Date.now();
+    const tty = process.stderr.isTTY === true;
+    let lastLabel;
+    let sawProgress = false;
+    const report = (detail) => {
+        if (ctx.json) {
+            return;
+        }
+        const label = deployProgressLabel(detail);
+        const elapsed = Math.round((Date.now() - startedAt) / 1000);
+        if (tty) {
+            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+            sawProgress = true;
+        }
+        else if (label !== lastLabel) {
+            ctx.err(`${slug}: ${label}\n`);
+        }
+        lastLabel = label;
+    };
+    const finishProgressLine = () => {
+        if (tty && sawProgress) {
+            ctx.err("\n");
+        }
+    };
+    for (;;) {
+        let detail;
+        try {
+            detail = await fetchDetail();
+        }
+        catch (error) {
+            // Capacity / rate-limit on GET is not a bake failure. The v2 accept
+            // already started freeze; keep polling until the wait budget expires.
+            if (isTransientDeployStatusError(error) && Date.now() - startedAt < ctx.timeoutMs) {
+                if (!ctx.json) {
+                    const elapsed = Math.round((Date.now() - startedAt) / 1000);
+                    const label = "Waiting for status (server busy)";
+                    if (tty) {
+                        ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+                        sawProgress = true;
                     }
-                    const waitMs = transientDeployStatusWaitMs(error, ctx.pollIntervalMs);
-                    const remaining = ctx.timeoutMs - (Date.now() - startedAt);
-                    yield sleep(Math.max(0, Math.min(waitMs, remaining)));
-                    continue;
+                    else if (label !== lastLabel) {
+                        ctx.err(`${slug}: ${label}\n`);
+                    }
+                    lastLabel = label;
                 }
-                finishProgressLine();
-                throw error;
-            }
-            report(detail);
-            if (terminal.has(detail.status)) {
-                finishProgressLine();
-                return detail;
-            }
-            if (Date.now() - startedAt >= ctx.timeoutMs) {
-                finishProgressLine();
-                const last = deployProgressLabel(detail);
-                throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} (last: ${last}). It may still converge — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+                const waitMs = transientDeployStatusWaitMs(error, ctx.pollIntervalMs);
+                const remaining = ctx.timeoutMs - (Date.now() - startedAt);
+                await sleep(Math.max(0, Math.min(waitMs, remaining)));
+                continue;
             }
-            yield sleep(ctx.pollIntervalMs);
+            finishProgressLine();
+            throw error;
         }
-    });
+        report(detail);
+        if (terminal.has(detail.status)) {
+            finishProgressLine();
+            return detail;
+        }
+        if (Date.now() - startedAt >= ctx.timeoutMs) {
+            finishProgressLine();
+            const last = deployProgressLabel(detail);
+            throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} (last: ${last}). It may still converge — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+        }
+        await sleep(ctx.pollIntervalMs);
+    }
 }
 /** Load-shed / rate-limit on status GET — the deploy itself may still be baking. */
 function isTransientDeployStatusError(error) {
@@ -1977,46 +1929,44 @@ function transientDeployStatusWaitMs(error, pollIntervalMs) {
  * Wait until GET 404s (the delete reconciler purged the record). Treats
  * other errors as failures. Throws DeployApiError on timeout.
  */
-function pollUntilGone(ctx, slug, getDetail) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const startedAt = Date.now();
-        const tty = process.stderr.isTTY === true;
-        let sawProgress = false;
-        const report = (label) => {
-            if (ctx.json) {
-                return;
-            }
-            const elapsed = Math.round((Date.now() - startedAt) / 1000);
-            if (tty) {
-                ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
-                sawProgress = true;
-            }
-        };
-        const finishProgressLine = () => {
-            if (tty && sawProgress) {
-                ctx.err("\n");
-            }
-        };
-        for (;;) {
-            try {
-                const detail = yield getDetail();
-                report(deployProgressLabel(detail));
-            }
-            catch (error) {
-                if (error instanceof DeployApiError && error.status === 404) {
-                    finishProgressLine();
-                    return;
-                }
-                finishProgressLine();
-                throw error;
-            }
-            if (Date.now() - startedAt >= ctx.timeoutMs) {
+async function pollUntilGone(ctx, slug, getDetail) {
+    const startedAt = Date.now();
+    const tty = process.stderr.isTTY === true;
+    let sawProgress = false;
+    const report = (label) => {
+        if (ctx.json) {
+            return;
+        }
+        const elapsed = Math.round((Date.now() - startedAt) / 1000);
+        if (tty) {
+            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+            sawProgress = true;
+        }
+    };
+    const finishProgressLine = () => {
+        if (tty && sawProgress) {
+            ctx.err("\n");
+        }
+    };
+    for (;;) {
+        try {
+            const detail = await getDetail();
+            report(deployProgressLabel(detail));
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
                 finishProgressLine();
-                throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} to disappear. It may still be deleting — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+                return;
             }
-            yield sleep(ctx.pollIntervalMs);
+            finishProgressLine();
+            throw error;
         }
-    });
+        if (Date.now() - startedAt >= ctx.timeoutMs) {
+            finishProgressLine();
+            throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} to disappear. It may still be deleting — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+        }
+        await sleep(ctx.pollIntervalMs);
+    }
 }
 function aliasTokenBlock(aliasToken) {
     return (`\n  Alias token (shown ONCE — save it now, it cannot be retrieved again):\n\n` +
@@ -2038,10 +1988,10 @@ export function renderApiError(error, err, context) {
     if (error instanceof DeployApiError) {
         err(`${error.message}\n`);
         if (error.status === 409 && error.message.includes("application multiTenant does not match")) {
-            if ((context === null || context === void 0 ? void 0 : context.multiTenant) === true) {
+            if (context?.multiTenant === true) {
                 err("This slug is a single-tenant application. Redeploy it without --multi-tenant.\n");
             }
-            else if ((context === null || context === void 0 ? void 0 : context.teamId) === MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+            else if (context?.teamId === MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
                 err("This slug is a Cursor-managed (multi-tenant) product. Redeploy it with --multi-tenant.\n");
             }
         }
@@ -2050,9 +2000,9 @@ export function renderApiError(error, err, context) {
     throw error;
 }
 export function renderTable(header, rows) {
-    const widths = header.map((h, i) => Math.max(h.length, ...rows.map(row => { var _a; return ((_a = row[i]) !== null && _a !== void 0 ? _a : "").length; })));
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map(row => (row[i] ?? "").length)));
     const renderRow = (row) => row
-        .map((cell, i) => { var _a; return cell.padEnd((_a = widths[i]) !== null && _a !== void 0 ? _a : 0); })
+        .map((cell, i) => cell.padEnd(widths[i] ?? 0))
         .join("  ")
         .trimEnd();
     return [renderRow(header), ...rows.map(renderRow)].join("\n");