@deepraxis/cli 0.1.1-dev.f0ef747 → 0.2.0-dev.3c36146

package/dist/praxis.js

@@ -1973,7 +1973,7 @@ clears to null; an empty string is stored as an empty string.`
     resource: "agent.sessions",
     method: "create",
     summary: "Create session",
-    description: `Create a session: one conversation with an agent. Pass agent as an agent id or {type:"agent", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:"agent_with_overrides", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:"limit", max_list_cost:{amount, currency:"USD"}} where amount is a positive integer string of US cents ("2000" is USD 20.00); omitted budget defaults to "2000" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
+    description: `Create a session: one conversation with an agent. Pass agent as an agent id or {type:"agent", id, version?}; an id alone, or an object without version, pins the agent's active_version (the version chosen with agents.versions.apply, not necessarily the newest saved one). Unlike Anthropic Managed Agents, omit environment_id to use the default environment saved in the agent version (light for a new agent), unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Unlike Anthropic Managed Agents, the only inline agent override is system ({type:"agent_with_overrides", id, system}); to change the model, tools, MCP servers or skills, save a version instead. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. budget is {type:"limit", max_list_cost:{amount, currency:"USD"}} where amount is a positive decimal string of US dollars with at most 2 decimal places ("20.00" is USD 20.00); omitted budget defaults to "20.00" and null removes the limit. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
     http: "POST",
     path: "/agent/v1/sessions",
     streaming: "no",
@@ -2549,9 +2549,9 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
     query: [
       {
         name: "limit",
-        type: "number",
+        type: "integer",
         required: false,
-        description: "Number of items per page."
+        description: "Number of resources per page, from 1 to 100; defaults to 100."
       },
       {
         name: "page",
@@ -9610,7 +9610,8 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
         {
           name: "file_id",
           type: "string",
-          required: true
+          required: true,
+          description: "File ID to copy into this library; passed as the upload source instead of file bytes."
         },
         {
           name: "public_id",
@@ -25061,7 +25062,7 @@ async function publish(client2, input) {
   const timeout = input.timeout_ms ?? 120000;
   if (!Number.isFinite(timeout) || timeout < 0)
     throw new RangeError("timeout_ms must be non-negative and finite");
-  const contentType = [
+  const moduleTypes = [
     "application/javascript+module",
     "text/javascript",
     "application/javascript",
@@ -25070,9 +25071,30 @@ async function publish(client2, input) {
     "application/wasm",
     "application/octet-stream",
     "application/x-python"
-  ].find((type) => type === (input.main?.content_type ?? "application/javascript+module"));
-  if (!contentType)
-    throw new PraxisError({ code: "INVALID_PARAMS", message: `Unsupported module content_type: ${input.main?.content_type}` });
+  ];
+  const moduleType = (type) => {
+    const found = moduleTypes.find((candidate) => candidate === (type ?? "application/javascript+module"));
+    if (!found)
+      throw new PraxisError({ code: "INVALID_PARAMS", message: `Unsupported module content_type: ${type}` });
+    return found;
+  };
+  if (input.main && input.modules)
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "Pass either main or modules, not both" });
+  if (input.main_module !== undefined && !input.modules)
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "main_module requires modules; with main the entry is main.name" });
+  if (input.modules && input.modules.length === 0)
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "modules must not be empty" });
+  const entryModules = input.main ? [{ name: input.main.name, content_type: moduleType(input.main.content_type), content_base64: base64(new TextEncoder().encode(input.main.content)) }] : input.modules?.map((module) => ({
+    name: module.name,
+    content_type: moduleType(module.content_type),
+    content_base64: base64(typeof module.content === "string" ? new TextEncoder().encode(module.content) : module.content)
+  }));
+  if (new Set(entryModules?.map((module) => module.name)).size !== (entryModules?.length ?? 0))
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "Duplicate module name" });
+  const mainModule = input.main ? input.main.name : input.modules ? input.main_module ?? input.modules[0].name : undefined;
+  if (input.modules && !input.modules.some((module) => module.name === mainModule)) {
+    throw new PraxisError({ code: "INVALID_PARAMS", message: `main_module ${mainModule} is not among modules` });
+  }
   const files = Object.entries(input.files);
   if (files.length > 1e5)
     throw new PraxisError({ code: "LIMIT_EXCEEDED", message: "At most 100000 asset paths can be published" });
@@ -25125,7 +25147,7 @@ async function publish(client2, input) {
   const removed = Object.keys(previous).filter((key) => !Object.hasOwn(manifest, key));
   const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(manifest))));
   const manifestHash = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
-  const staticOnly = !["main", "bindings", "compatibility_date", "compatibility_flags", "assets_config"].some((key) => Object.hasOwn(input, key));
+  const staticOnly = !["main", "modules", "main_module", "bindings", "compatibility_date", "compatibility_flags", "assets_config"].some((key) => Object.hasOwn(input, key));
   const unchanged = staticOnly && !!currentVersion && manifestHash === currentVersion.praxis.assets_manifest?.manifest_hash;
   const hashes = new Set(Object.values(manifest).map((entry) => entry.hash));
   const currentResult = {
@@ -25181,11 +25203,7 @@ async function publish(client2, input) {
     assets: versionAssets,
     ...input.compatibility_flags ? { compatibility_flags: input.compatibility_flags } : {},
     ...input.bindings ? { bindings: input.bindings } : {},
-    ...input.main ? { main_module: input.main.name, modules: [{
-      name: input.main.name,
-      content_type: contentType,
-      content_base64: base64(new TextEncoder().encode(input.main.content))
-    }] } : {}
+    ...entryModules ? { main_module: mainModule, modules: entryModules } : {}
   } });
   let deployment = result.deployment;
   if (!deployment)
@@ -25316,7 +25334,7 @@ function decideTabReuse(targetUrl, tabs) {
     if (best === undefined || rank < best.rank || rank === best.rank && (tab.active || !best.tab.active))
       best = { tab, rank };
   }
-  return best?.tab;
+  return best?.tab ?? tabs.find((tab) => isBlankTab(tab.url));
 }
 function buildConnectUrl(parts) {
   const url = new URL("/browser/v1/connect", parts.api);
@@ -25334,6 +25352,16 @@ function pickAgentContext(contexts, agentId) {
   return [...own].sort((x, y) => (x.createdAt ?? "").localeCompare(y.createdAt ?? "") || x.id.localeCompare(y.id))[0];
 }
 var agentContextName = (agentId) => `agent-${agentId}`.replace(/[^A-Za-z0-9._:-]/g, "-").slice(0, 128);
+function isBlankTab(value) {
+  if (value === "" || value === "about:blank")
+    return true;
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || url.protocol === "http:") && url.pathname === "/start" && (url.hostname.startsWith("console-") || url.hostname === "console.deepraxis.com");
+  } catch {
+    return false;
+  }
+}
 
 // ../../packages/sdk/typescript/src/helpers/browser-connect.ts
 var PLAYWRIGHT_CORE_VERSION = "1.63.0";
@@ -25532,6 +25560,116 @@ class Praxis {
     }
   }
 }
+// ../../packages/sdk/typescript/src/helpers/application-build.ts
+var UNSUPPORTED_BINDING_KEYS = [
+  "services",
+  "queues",
+  "durable_objects",
+  "ai",
+  "analytics_engine_datasets",
+  "vectorize",
+  "hyperdrive",
+  "browser",
+  "send_email",
+  "mtls_certificates",
+  "dispatch_namespaces",
+  "unsafe",
+  "version_metadata",
+  "images",
+  "workflows",
+  "pipelines",
+  "secrets_store_secrets",
+  "ratelimits",
+  "vpc_services",
+  "media",
+  "tail_consumers",
+  "worker_loaders"
+];
+var isPresent = (value) => {
+  if (value === undefined || value === null)
+    return false;
+  if (Array.isArray(value))
+    return value.some(isPresent);
+  if (typeof value === "object")
+    return Object.values(value).some(isPresent);
+  return true;
+};
+function ignoreMatcher(line) {
+  let pattern = line.trim();
+  if (!pattern || pattern.startsWith("#") || pattern.startsWith("!"))
+    return null;
+  const anchored = pattern.startsWith("/") || pattern.slice(0, -1).includes("/");
+  pattern = pattern.replace(/^\//, "").replace(/\/$/, "");
+  const source = pattern.split("**").map((part) => part.split("*").map((piece) => piece.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")).join(".*");
+  const regex = new RegExp(`^${source}$`);
+  return (path) => {
+    const segments = path.split("/");
+    for (let end = 1;end <= segments.length; end++) {
+      if (anchored ? regex.test(segments.slice(0, end).join("/")) : regex.test(segments[end - 1]))
+        return true;
+    }
+    return false;
+  };
+}
+function bindingsFrom(wrangler) {
+  const bindings = [];
+  const fromList = (key, type) => {
+    const list = wrangler[key];
+    if (!isPresent(list))
+      return;
+    if (!Array.isArray(list))
+      throw new PraxisError({ code: "INVALID_PARAMS", message: `wrangler.json ${key} must be an array` });
+    for (const entry of list) {
+      if (typeof entry?.binding !== "string")
+        throw new PraxisError({ code: "INVALID_PARAMS", message: `wrangler.json ${key} entry has no binding name` });
+      bindings.push({ type, name: entry.binding });
+    }
+  };
+  fromList("d1_databases", "d1");
+  fromList("kv_namespaces", "kv_namespace");
+  fromList("r2_buckets", "r2_bucket");
+  for (const [name, value] of Object.entries(wrangler.vars ?? {})) {
+    bindings.push(typeof value === "string" ? { type: "plain_text", name, text: value } : { type: "json", name, json: value });
+  }
+  if (typeof wrangler.assets?.binding === "string")
+    bindings.push({ type: "assets", name: wrangler.assets.binding });
+  return bindings;
+}
+function publishInputFromBuild(build, name) {
+  const wrangler = build.wranglerJson;
+  if (!wrangler || typeof wrangler !== "object" || Array.isArray(wrangler)) {
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "wranglerJson must be the parsed dist/server/wrangler.json object" });
+  }
+  const offending = UNSUPPORTED_BINDING_KEYS.filter((key) => isPresent(wrangler[key]));
+  if (offending.length) {
+    throw new PraxisError({ code: "UNSUPPORTED", message: `wrangler.json declares bindings the platform does not support: ${offending.join(", ")}` });
+  }
+  const modules = Object.entries(build.serverFiles).filter(([path]) => path.endsWith(".js")).map(([path, content]) => ({ name: path, content, content_type: "application/javascript+module" }));
+  if (typeof wrangler.main !== "string")
+    throw new PraxisError({ code: "INVALID_PARAMS", message: "wrangler.json has no main entry" });
+  if (!modules.some((module) => module.name === wrangler.main)) {
+    throw new PraxisError({ code: "INVALID_PARAMS", message: `wrangler.json main ${wrangler.main} is not a .js file under dist/server` });
+  }
+  const ignored = new TextDecoder().decode(build.clientFiles[".assetsignore"] ?? new Uint8Array).split(/\r?\n/).map(ignoreMatcher).filter((matcher) => matcher !== null);
+  const files = {};
+  for (const [path, content] of Object.entries(build.clientFiles)) {
+    if (path === ".assetsignore" || ignored.some((matches) => matches(path)))
+      continue;
+    files[`/${path}`] = content;
+  }
+  const { binding: _binding, directory: _directory, ...assetsConfig } = wrangler.assets ?? {};
+  const bindings = bindingsFrom(wrangler);
+  return {
+    name,
+    files,
+    modules,
+    main_module: wrangler.main,
+    ...typeof wrangler.compatibility_date === "string" ? { compatibility_date: wrangler.compatibility_date } : {},
+    ...Array.isArray(wrangler.compatibility_flags) ? { compatibility_flags: wrangler.compatibility_flags } : {},
+    ...bindings.length ? { bindings } : {},
+    ...Object.keys(assetsConfig).length ? { assets_config: assetsConfig } : {}
+  };
+}
 // src/core/command-overrides.ts
 var commandOverrides = {
   "agent.deployments.run.create": { words: ["agent", "deployment", "run"], reason: "The terminal path is an action; expose its verb without a redundant create." },
@@ -25592,6 +25730,15 @@ function commandWords(resource, method) {
   const verb = kebab(method.replace(/^retrieve(?=[A-Z]|$)/, "get"));
   return [domain, ...resources, verb];
 }
+var API_WORD = "api";
+var HTTP_METHOD = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/;
+var domainOf = (command) => command.words[1];
+function movedTo(commands, words) {
+  if (!words.length || words[0] === API_WORD)
+    return;
+  const moved = [API_WORD, ...words];
+  return commands.some((c) => moved.every((w, i) => c.words[i] === w)) ? `praxis ${moved.join(" ")}` : undefined;
+}
 function commandTree(operations2) {
   const commands = [];
   const seen = new Set;
@@ -25607,7 +25754,7 @@ function commandTree(operations2) {
       if (["login", "logout", "whoami", "org", "api", "skill"].includes(words[0]))
         throw new Error(`Reserved command: ${key}`);
       seen.add(key);
-      commands.push({ words, op, ...method !== op.method ? { alias: method } : {} });
+      commands.push({ words: [API_WORD, ...words], op, ...method !== op.method ? { alias: method } : {} });
     }
   }
   for (const key of Object.keys(commandOverrides))
@@ -25903,29 +26050,112 @@ function help(commands, prefix, command) {
 `);
   }
   const matching = commands.filter((c) => prefix.every((w, i) => c.words[i] === w));
+  const global = [
+    "Global options:",
+    ...globalOptions.map((s) => `  ${describeOption(s)}`),
+    "  -h is an alias of --help",
+    "PRAXIS_ENV=develop|production (default: develop); no --env option.",
+    ""
+  ];
+  const sample = matching.find((c) => c.words.at(-1) === "list") ?? matching[0];
+  if (!prefix.length) {
+    const nouns = [...new Set(workflows.map((w) => w.words[0]))];
+    const summaries = new Map(workflows.map((w) => [w.words[0], w.words.length === 1 ? w.summary : undefined]));
+    const width = Math.max(...nouns.map((n) => n.length));
+    return [
+      "praxis <command> [options]",
+      "",
+      "Workflows:",
+      ...nouns.map((n) => `  ${n.padEnd(width)}  ${summaries.get(n) ?? workflows.filter((w) => w.words[0] === n).map((w) => w.words[1]).join(", ")}`),
+      "",
+      "API:",
+      `  praxis ${API_WORD} <domain> <resource> <action> [options]   one command per API operation`,
+      `  praxis ${API_WORD} <METHOD> <path> [--data JSON|@file|-]   raw request`,
+      `  Domains: ${domains(commands).join(", ")}`,
+      "",
+      ...global,
+      "Examples:",
+      `  ${sample ? example(sample) : "praxis --help"}`
+    ].join(`
+`);
+  }
   const children = [...new Set(matching.map((c) => c.words[prefix.length]).filter(Boolean))].sort();
-  if (!prefix.length)
-    children.unshift("login", "logout", "whoami", "org", "api", "skill");
+  const raw = prefix.length === 1 && prefix[0] === API_WORD;
   return [
     `praxis${prefix.length ? " " + prefix.join(" ") : ""} <command> [options]`,
     "",
+    ...raw ? ["Domains:"] : [],
     ...children.map((s) => `  ${s}`),
     "",
-    "Global options:",
-    ...globalOptions.map((s) => `  ${describeOption(s)}`),
+    ...raw ? ["Raw request:", `  praxis ${API_WORD} <METHOD> <path> [--data JSON|@file|-]`, ""] : [],
+    ...global,
+    "Examples:",
+    ...raw ? [`  praxis ${API_WORD} GET /model/v1/models`] : [],
+    `  ${sample ? example(sample) : "praxis --help"}`
+  ].join(`
+`);
+}
+function domains(commands) {
+  return [...new Set(commands.map((c) => c.words[1]))].sort();
+}
+var workflows = [
+  { words: ["login"], usage: "login", summary: "Sign in with a browser device code." },
+  { words: ["logout"], usage: "logout", summary: "Remove the saved login from the keychain and fallback file." },
+  { words: ["whoami"], usage: "whoami", summary: "Show the signed-in identity and credential storage location." },
+  { words: ["org", "list"], usage: "org list", summary: "List organizations available to the login." },
+  { words: ["org", "switch"], usage: "org switch <organization_id>", summary: "Switch the login organization." },
+  { words: ["app", "create"], usage: "app create <name> [--dir <path>] [--template <dir>] [--no-install]", summary: "Create an application project from the standard template and install its dependencies.", example: "praxis app create my-app" },
+  { words: ["app", "deploy"], usage: "app deploy [--dir <path>] [--no-build]", summary: "Build the project, publish it, create declared secrets, run the health check and print the URL.", example: "praxis app deploy --dir ./my-app" },
+  { words: ["app", "rollback"], usage: "app rollback [--dir <path>] [--to <version_id>]", summary: "Deploy the previous version again (or --to a given version) and wait until it is active.", example: "praxis app rollback --to <version_id>" },
+  { words: ["skill"], usage: "skill [--install <dir>]", summary: "Print the AI skill, or write <dir>/praxis-cli/SKILL.md." }
+];
+var workflowNouns = [...new Set(workflows.filter((w) => w.words.length > 1).map((w) => w.words[0]))];
+function nounHelp(noun) {
+  const mine = workflows.filter((w) => w.words[0] === noun);
+  const width = Math.max(...mine.map((w) => w.usage.length));
+  return [...mine.map((w) => `  praxis ${w.usage.padEnd(width)}  ${w.summary}`), "", `Run \`praxis ${noun} <command> --help\` for a command's options.`, "", "Examples:", ...mine.map((w) => `  ${w.example ?? `praxis ${w.usage}`}`)].join(`
+`);
+}
+function workflowHelp(workflow, options) {
+  return [
+    `praxis ${workflow.usage}`,
+    workflow.summary,
+    "",
+    "Options:",
+    ...[...options, ...globalOptions].map((s) => `  ${describeOption(s)}`),
     "  -h is an alias of --help",
     "PRAXIS_ENV=develop|production (default: develop); no --env option.",
     "",
     "Examples:",
-    `  ${matching[0] ? example(matching.find((c) => c.words.at(-1) === "list") ?? matching[0]) : "praxis --help"}`
+    `  ${workflow.example ?? `praxis ${workflow.usage}`}`
   ].join(`
 `);
 }
 
 // src/config/env.ts
 var DEFAULT_ENV = "develop";
+function validateApiUrl(value) {
+  const fail = () => {
+    throw new UsageError("PRAXIS_API_URL must be an https URL on deepraxis.com", "Use https://api.deepraxis.com or https://api-develop.deepraxis.com; credentials are never sent to other hosts.");
+  };
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    return fail();
+  }
+  if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash)
+    fail();
+  if (!(u.hostname === "api.deepraxis.com" || u.hostname.endsWith(".deepraxis.com")))
+    fail();
+  return value.replace(/\/+$/, "");
+}
+function inferEnvFromApiUrl(value) {
+  return new URL(value).hostname.includes("-develop.") ? "develop" : "production";
+}
 function environment(vars = process.env) {
-  const env = vars.PRAXIS_ENV ?? DEFAULT_ENV;
+  const apiOverride = vars.PRAXIS_API_URL ? validateApiUrl(vars.PRAXIS_API_URL) : undefined;
+  const env = vars.PRAXIS_ENV ?? (apiOverride ? inferEnvFromApiUrl(apiOverride) : DEFAULT_ENV);
   if (env !== "develop" && env !== "production")
     throw new UsageError("PRAXIS_ENV must be develop or production", "Set PRAXIS_ENV=develop or PRAXIS_ENV=production.");
   const suffix = env === "develop" ? "-develop" : "";
@@ -25936,10 +26166,10 @@ function environment(vars = process.env) {
         throw new Error;
       return value.replace(/\/+$/, "");
     } catch {
-      throw new UsageError("Invalid PRAXIS endpoint URL", "Set PRAXIS_API_URL / PRAXIS_ACCOUNT_URL / PRAXIS_GATEWAY_URL to HTTP(S) host URLs.");
+      throw new UsageError("Invalid PRAXIS endpoint URL", "Set PRAXIS_ACCOUNT_URL / PRAXIS_GATEWAY_URL to HTTP(S) host URLs.");
     }
   };
-  return { env, apiUrl: url(vars.PRAXIS_API_URL ?? `https://api${suffix}.deepraxis.com`), accountUrl: url(vars.PRAXIS_ACCOUNT_URL ?? `https://account${suffix}.deepraxis.com`), gatewayUrl: url(vars.PRAXIS_GATEWAY_URL ?? `https://gateway${suffix}.deepraxis.com`) };
+  return { env, apiUrl: apiOverride ?? `https://api${suffix}.deepraxis.com`, accountUrl: url(vars.PRAXIS_ACCOUNT_URL ?? `https://account${suffix}.deepraxis.com`), gatewayUrl: url(vars.PRAXIS_GATEWAY_URL ?? `https://gateway${suffix}.deepraxis.com`) };
 }
 
 // src/auth/token-store.ts
@@ -26169,6 +26399,9 @@ async function withLock(lockPath, run) {
 }
 
 // src/auth/credentials.ts
+function credentialSource(vars) {
+  return vars.PRAXIS_API_KEY ? "api-key" : vars.PRAXIS_API_TOKEN ? "machine-token" : "login";
+}
 async function identityRpc(config, fetchImpl, method, params, token) {
   const response = await fetchImpl(`${config.gatewayUrl}/rpc/practice-identity`, {
     method: "POST",
@@ -26198,15 +26431,20 @@ function credentials(config, vars, ports) {
   const path = ports.path ?? tokenPath(config.env);
   const store = ports.store ?? createTokenStore(config.env, path, ports.secretStore);
   const apiKey = vars.PRAXIS_API_KEY;
+  const machineToken = credentialSource(vars) === "machine-token" ? vars.PRAXIS_API_TOKEN : undefined;
   const remember = ports.remember ?? (() => {});
   if (apiKey)
     remember(apiKey);
+  if (machineToken)
+    remember(machineToken);
   let cached;
   let cachedOrg;
   let pending;
   const requireLogin = () => {
     if (apiKey)
       throw new UsageError("The API Key determines the organization; listing or switching login organizations is unavailable.", "Unset PRAXIS_API_KEY and run `praxis login`, then retry the org command.");
+    if (machineToken)
+      throw new UsageError("The machine token determines the organization; listing or switching login organizations is unavailable.", "Unset PRAXIS_API_TOKEN and run `praxis login`, then retry the org command.");
   };
   async function exchange(organizationId) {
     const stored = await store.load();
@@ -26231,6 +26469,11 @@ function credentials(config, vars, ports) {
         throw new UsageError("--org cannot override an API Key organization", "Remove --org or unset PRAXIS_API_KEY and run `praxis login`.");
       return { source: "api-key", token: apiKey };
     }
+    if (machineToken) {
+      if (org)
+        throw new UsageError("--org cannot override a machine token organization", "Remove --org or unset PRAXIS_API_TOKEN and run `praxis login`.");
+      return { source: "machine-token", token: machineToken };
+    }
     const stored = await store.load();
     const selected = org ?? stored?.organization_id;
     const opaqueFresh = stored !== null && stored.expires_at - 30000 > ports.now();
@@ -26254,7 +26497,7 @@ function credentials(config, vars, ports) {
     requireLogin,
     async client(org) {
       const c = await get(org);
-      return new Praxis({ apiKey: c.token, baseUrl: config.apiUrl, fetch: c.source === "login" ? jwtFetch(ports.fetch, c.token) : ports.fetch });
+      return new Praxis({ apiKey: c.token, baseUrl: config.apiUrl, fetch: c.source === "api-key" ? ports.fetch : jwtFetch(ports.fetch, c.token) });
     },
     async rpc(method, params = {}, org) {
       const c = await get(org);
@@ -26287,7 +26530,7 @@ function commandSummary(command) {
     const chars = [...description];
     return chars.length > 120 ? chars.slice(0, 119).join("") + "…" : description;
   }
-  const words = [...command.words];
+  const words = command.words.slice(1);
   const verb = (words.pop() ?? "use").replace(/-/g, " ");
   if (verb === "list" && words.length && !words.at(-1).endsWith("s"))
     words[words.length - 1] += "s";
@@ -26305,7 +26548,7 @@ function skillDocument(commands) {
     "## General rules",
     "",
     "- Select the environment only with `PRAXIS_ENV`; there is no `--env` option. The dev package defaults to develop.",
-    "- Authenticate with `PRAXIS_API_KEY` or `praxis login`. API keys determine the organization; login sessions can use `--org <organization_id>`.",
+    "- Authenticate with `PRAXIS_API_KEY`, `PRAXIS_API_TOKEN` (a machine token, sent in the Authorization header; computers have it set) or `praxis login`, in that order. API keys and machine tokens determine the organization; login sessions can use `--org <organization_id>`. `PRAXIS_API_URL` overrides the API base and must be an https deepraxis.com URL.",
     "- AI mode is enabled automatically in supported agent environments. Use `--format agent` to select it explicitly.",
     "- Use `--json` for the complete JSON response without presentation truncation. Successful JSON output goes to stdout; errors go to stderr.",
     "- Supply bodies with `--data JSON`, `--data @file.json`, or `--data -` for stdin. Scalar field options override matching JSON fields. Structured fields require `--data`.",
@@ -26313,21 +26556,17 @@ function skillDocument(commands) {
     "- Use `--limit N` to limit a server page for SDK-paginated commands. Other lists apply it only to displayed rows; `--param-limit` still sends the API parameter when available. `--all` follows supported pagination and cannot be combined with `--limit`.",
     "- Error JSON has an `error` object: `code` identifies the failure, `message` describes it, `hint` suggests recovery, `env` identifies the environment, `command` identifies the command, `status` is the HTTP status, and `request_id` correlates diagnostics. Unavailable fields are null. Exit codes: 0 success, 1 runtime/API error, 2 usage error.",
     "- Append `--help` to a command for its optional parameters. Required scalar body options below can also be supplied as fields in `--data`.",
+    "- Two layers: top-level commands (`login`, `org`, `skill`, …) are workflows and session commands; every API operation is under `praxis api <domain> …`. `praxis api <METHOD> <path>` sends a raw request (the method is uppercase).",
     "",
     "## Account and CLI",
     "",
-    "praxis login — Sign in with a browser device code.",
-    "praxis logout — Remove the saved login from the keychain and fallback file.",
-    "praxis whoami — Show the signed-in identity and credential storage location.",
-    "praxis org list — List organizations available to the login.",
-    "praxis org switch <organization_id> — Switch the login organization.",
-    "praxis api <METHOD> <path> — Call an API path directly. (--data for a request body)",
-    "praxis skill — Print this skill; use --install <dir> to write <dir>/praxis-cli/SKILL.md."
+    ...workflows.map((w) => `praxis ${w.usage} — ${w.summary.replace("Print the AI skill, or write", "Print this skill; use --install <dir> to write")}`),
+    "praxis api <METHOD> <path> — Call an API path directly. (--data for a request body)"
   ];
   let domain;
   for (const command of commands) {
-    if (command.words[0] !== domain) {
-      domain = command.words[0];
+    if (domainOf(command) !== domain) {
+      domain = domainOf(command);
       lines.push("", `## ${domain}`, "");
     }
     const target = targetParam(command.op);
@@ -26458,7 +26697,7 @@ async function whoami(auth, env, org) {
     source: credential.source,
     ...credential.storedIn ? { "stored in": credential.storedIn } : {},
     expires_at: credential.expiresAt ? new Date(credential.expiresAt).toISOString() : null,
-    ...credential.source === "api-key" ? { note: "The API key determines the organization." } : {}
+    ...credential.source === "api-key" ? { note: "The API key determines the organization." } : credential.source === "machine-token" ? { note: "The machine token determines the organization." } : {}
   };
 }
 
@@ -26507,6 +26746,365 @@ async function api(config, auth, method, path, body, fetchImpl, emit, org) {
   emit({ kind: "object", data: result });
 }
 
+// src/commands/app.ts
+import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync, readdirSync, readFileSync as readFileSync2, renameSync, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join as join3, resolve } from "node:path";
+
+// src/app/pure.ts
+import { createHash } from "node:crypto";
+var WORKER_NAME = /^(?!(?:www|api|admin|app|canary|canary-probe|status|docs|console)$)(?!.*--)[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/;
+function validateAppName(name) {
+  if (!WORKER_NAME.test(name))
+    throw new UsageError(`Invalid app name: ${name}`, "Use 3-40 lowercase letters, digits and single hyphens, starting and ending with a letter or digit; www, api, admin, app, canary, canary-probe, status, docs and console are reserved.");
+  return name;
+}
+function stringEnd(text, i) {
+  let j = i + 1;
+  while (j < text.length && text[j] !== '"')
+    j += text[j] === "\\" ? 2 : 1;
+  return j;
+}
+function parseJsonc(text) {
+  let out = "";
+  for (let i = 0;i < text.length; i++) {
+    const c = text[i];
+    if (c === '"') {
+      const j = stringEnd(text, i);
+      out += text.slice(i, j + 1);
+      i = j;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== `
+`)
+        i++;
+      out += `
+`;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      if (end < 0)
+        throw new SyntaxError("Unterminated block comment");
+      i = end + 1;
+      out += " ";
+      continue;
+    }
+    out += c;
+  }
+  let result = "";
+  for (let i = 0;i < out.length; i++) {
+    const c = out[i];
+    if (c === '"') {
+      const j = stringEnd(out, i);
+      result += out.slice(i, j + 1);
+      i = j;
+      continue;
+    }
+    if (c === "," && /^\s*[}\]]/.test(out.slice(i + 1)))
+      continue;
+    result += c;
+  }
+  return JSON.parse(result);
+}
+function parseProject(value) {
+  const fail = (m) => {
+    throw new UsageError(m, 'praxis.jsonc needs {"kind":"application","name":"<app-name>"}; `praxis app create` writes it.');
+  };
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return fail("praxis.jsonc must be an object");
+  const v = value;
+  if (v.kind !== "application")
+    fail('praxis.jsonc kind must be "application"');
+  if (typeof v.name !== "string" || !v.name)
+    fail("praxis.jsonc has no name");
+  const name = validateAppName(v.name);
+  const secrets = {};
+  if (v.secrets !== undefined) {
+    if (!v.secrets || typeof v.secrets !== "object" || Array.isArray(v.secrets))
+      fail("praxis.jsonc secrets must be an object");
+    for (const [key, how] of Object.entries(v.secrets)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(key))
+        fail(`Invalid secret name: ${key}`);
+      if (how !== "generate")
+        fail(`Secret ${key}: only "generate" is supported`);
+      secrets[key] = "generate";
+    }
+  }
+  if (v.healthcheck !== undefined && (typeof v.healthcheck !== "string" || !v.healthcheck.startsWith("/") || v.healthcheck.startsWith("//")))
+    fail("praxis.jsonc healthcheck must be a path starting with /");
+  return { name, secrets, ...typeof v.healthcheck === "string" ? { healthcheck: v.healthcheck } : {} };
+}
+function planSecrets(existing, declared, generate) {
+  const have = new Set(existing);
+  const bindings = [...have].map((name) => ({ type: "secret_text", name }));
+  const created = [];
+  for (const name of Object.keys(declared))
+    if (!have.has(name)) {
+      bindings.push({ type: "secret_text", name, text: generate() });
+      created.push(name);
+    }
+  return { bindings, created };
+}
+function chooseRollbackTarget(deployments, currentVersionId) {
+  for (const d of deployments) {
+    const id = d.versions[0]?.version_id;
+    if (id && id !== currentVersionId)
+      return id;
+  }
+  return;
+}
+function verifyIntegrity(bytes, dist) {
+  if (dist.integrity) {
+    return dist.integrity.split(/\s+/).some((entry) => {
+      const at = entry.indexOf("-");
+      return entry.slice(0, at) === "sha512" && createHash("sha512").update(bytes).digest("base64") === entry.slice(at + 1);
+    });
+  }
+  if (dist.shasum)
+    return createHash("sha1").update(bytes).digest("hex") === dist.shasum;
+  return false;
+}
+var templateTag = (env) => env === "develop" ? "dev" : "latest";
+function randomSecret(bytes = 32) {
+  return Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString("base64url");
+}
+function decideBuildOutput(mode) {
+  return mode === "human" ? "stream" : "capture";
+}
+function tailLines(text, count3) {
+  return text.replace(/\s+$/, "").split(`
+`).slice(-count3).join(`
+`);
+}
+function nextSteps(dir, bunAvailable) {
+  return [`cd ${dir}`, bunAvailable ? "bun run dev" : "npm run dev", "praxis app deploy"];
+}
+
+// src/commands/app.ts
+var REGISTRY = "https://registry.npmjs.org/@deepraxis%2fapp-template";
+async function downloadTemplate(env, into, ports) {
+  const meta = await ports.fetch(REGISTRY, { headers: { accept: "application/vnd.npm.install-v1+json" }, signal: AbortSignal.timeout(30000) });
+  if (!meta.ok)
+    throw new PraxisError({ code: "TEMPLATE_UNAVAILABLE", message: `Could not read the template package from the npm registry (${meta.status})` });
+  const doc = await meta.json();
+  const tag = templateTag(env), version = doc["dist-tags"]?.[tag];
+  const dist = version ? doc.versions?.[version]?.dist : undefined;
+  if (!version || !dist?.tarball)
+    throw new PraxisError({ code: "TEMPLATE_UNAVAILABLE", message: `@deepraxis/app-template has no "${tag}" release` });
+  const tarball = new URL(dist.tarball);
+  if (tarball.protocol !== "https:")
+    throw new PraxisError({ code: "TEMPLATE_UNAVAILABLE", message: "Template tarball is not served over https" });
+  const res = await ports.fetch(tarball, { signal: AbortSignal.timeout(60000) });
+  if (!res.ok)
+    throw new PraxisError({ code: "TEMPLATE_UNAVAILABLE", message: `Template download failed (${res.status})` });
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  if (!verifyIntegrity(bytes, dist))
+    throw new PraxisError({ code: "TEMPLATE_INTEGRITY", message: `Template ${version} failed its integrity check; nothing was extracted` });
+  const work = mkdtempSync(join3(tmpdir(), "praxis-template-"));
+  try {
+    writeFileSync2(join3(work, "template.tgz"), bytes);
+    const code = await ports.spawn("tar", ["-xzf", "template.tgz", "package/template"], { cwd: work });
+    if (code !== 0 || !existsSync2(join3(work, "package", "template")))
+      throw new PraxisError({ code: "TEMPLATE_UNAVAILABLE", message: "Could not extract package/template from the template tarball" });
+    cpSync(join3(work, "package", "template"), into, { recursive: true });
+  } finally {
+    rmSync2(work, { recursive: true, force: true });
+  }
+  return { version };
+}
+async function appCreate(args, env, ports) {
+  const name = validateAppName(args.name);
+  const dir = resolve(ports.cwd, args.dir ?? name);
+  if (existsSync2(dir) && (!statSync2(dir).isDirectory() || readdirSync(dir).length))
+    throw new UsageError(`${dir} already exists and is not empty`, "Pick another name or --dir.");
+  mkdirSync2(dir, { recursive: true });
+  let version = "local";
+  try {
+    if (args.template) {
+      const source = resolve(ports.cwd, args.template);
+      if (!existsSync2(source) || !statSync2(source).isDirectory())
+        throw new UsageError(`--template ${source} is not a directory`);
+      cpSync(source, dir, { recursive: true });
+    } else
+      version = (await downloadTemplate(env, dir, ports)).version;
+    if (existsSync2(join3(dir, "_gitignore")))
+      renameSync(join3(dir, "_gitignore"), join3(dir, ".gitignore"));
+    const jsonc = join3(dir, "praxis.jsonc");
+    if (existsSync2(jsonc))
+      writeFileSync2(jsonc, readFileSync2(jsonc, "utf8").replaceAll("<app-name>", name));
+    const pkg = join3(dir, "package.json");
+    if (existsSync2(pkg))
+      writeFileSync2(pkg, JSON.stringify({ ...JSON.parse(readFileSync2(pkg, "utf8")), name }, null, 2) + `
+`);
+  } catch (error) {
+    rmSync2(dir, { recursive: true, force: true });
+    throw error;
+  }
+  if (args.install) {
+    const pm = ports.has("bun") ? "bun" : "npm";
+    const code = await ports.spawn(pm, ["install"], { cwd: dir });
+    if (code !== 0)
+      throw new PraxisError({ code: "INSTALL_FAILED", message: `${pm} install failed (exit ${code}); the project was created in ${dir}. Run it again there.` });
+  }
+  const next_steps = nextSteps(dir, ports.has("bun"));
+  ports.human(`Created ${dir}
+
+Next steps:
+${next_steps.map((step) => `  ${step}`).join(`
+`)}`);
+  ports.emit({ kind: "object", data: { dir, name, template_version: version, next_steps } });
+}
+function findProjectDir(dir, cwd) {
+  if (dir) {
+    const d = resolve(cwd, dir);
+    if (!existsSync2(join3(d, "praxis.jsonc")))
+      throw new UsageError(`No praxis.jsonc in ${d}`, "Run inside a project made by `praxis app create`, or pass --dir.");
+    return d;
+  }
+  for (let d = resolve(cwd);; d = dirname(d)) {
+    if (existsSync2(join3(d, "praxis.jsonc")))
+      return d;
+    if (dirname(d) === d)
+      throw new UsageError("No praxis.jsonc found in this directory or its parents", "Run inside a project made by `praxis app create`, or pass --dir.");
+  }
+}
+function loadProject(dir) {
+  let value;
+  try {
+    value = parseJsonc(readFileSync2(join3(dir, "praxis.jsonc"), "utf8"));
+  } catch (error) {
+    throw new UsageError(`praxis.jsonc is not valid JSONC: ${error.message}`);
+  }
+  return parseProject(value);
+}
+function readTree(root) {
+  const files = {};
+  const walk = (rel) => {
+    for (const entry of readdirSync(join3(root, rel), { withFileTypes: true })) {
+      const path = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory())
+        walk(path);
+      else if (entry.isFile())
+        files[path] = new Uint8Array(readFileSync2(join3(root, path)));
+    }
+  };
+  walk("");
+  return files;
+}
+async function findWorker(client2, name) {
+  for await (const w of await client2.application.workers.list())
+    if (w.name === name)
+      return w;
+  return;
+}
+async function waitActive(client2, workerId, deployment, ports, timeoutMs = 120000) {
+  const deadline = ports.now() + timeoutMs;
+  let current = deployment;
+  while (current.praxis.status !== "active") {
+    if (current.praxis.status === "failed" || current.praxis.status === "cancelled")
+      throw new PraxisError({ code: current.praxis.error?.code ?? "DEPLOYMENT_FAILED", message: current.praxis.error?.message ?? `Deployment ${current.id} ${current.praxis.status}` });
+    if (ports.now() >= deadline)
+      throw new PraxisError({ code: "DEPLOY_TIMEOUT", message: `Deployment ${current.id} did not become active within ${timeoutMs} ms; it may still be running` });
+    await ports.wait(1000);
+    current = await client2.application.workers.deployments.retrieve({ path: { worker_id: workerId, deployment_id: current.id } });
+  }
+  return current;
+}
+async function healthCheck2(url, path, ports, timeoutMs = 60000) {
+  const target = url.replace(/\/+$/, "") + path;
+  const deadline = ports.now() + timeoutMs;
+  let last = "no response";
+  for (;; ) {
+    try {
+      const res = await ports.fetch(target, { redirect: "manual", signal: AbortSignal.timeout(1e4) });
+      if (res.status >= 200 && res.status < 300)
+        return { path, status: res.status };
+      last = String(res.status);
+    } catch (error) {
+      last = error.message;
+    }
+    if (ports.now() >= deadline)
+      throw new PraxisError({ code: "HEALTHCHECK_FAILED", message: `Health check failed: GET ${target} answered ${last} for ${Math.round(timeoutMs / 1000)}s` });
+    await ports.wait(2000);
+  }
+}
+async function runBuild(pm, dir, ports) {
+  if (decideBuildOutput(ports.mode) === "stream")
+    return ports.spawn(pm, ["run", "build"], { cwd: dir });
+  const started = ports.now();
+  const { code, output } = await ports.spawnCapture(pm, ["run", "build"], { cwd: dir });
+  const text = code === 0 ? `build ok in ${Math.round((ports.now() - started) / 100) / 10}s` : tailLines(output, 60);
+  ports.emit({ kind: "message", channel: "stderr", text });
+  return code;
+}
+async function appDeploy(args, client2, ports) {
+  const dir = findProjectDir(args.dir, ports.cwd);
+  const project = loadProject(dir);
+  if (args.build) {
+    const pm = ports.has("bun") ? "bun" : "npm";
+    const code = await runBuild(pm, dir, ports);
+    if (code !== 0)
+      throw new PraxisError({ code: "BUILD_FAILED", message: `${pm} run build failed (exit ${code})` });
+  }
+  const server = join3(dir, "dist", "server"), clientDir = join3(dir, "dist", "client");
+  if (!existsSync2(join3(server, "wrangler.json")) || !existsSync2(clientDir))
+    throw new UsageError("No build output in dist/server and dist/client", "Run without --no-build, or build the project first.");
+  const serverFiles = readTree(server);
+  let input;
+  try {
+    input = publishInputFromBuild({ serverFiles, clientFiles: readTree(clientDir), wranglerJson: parseJsonc(new TextDecoder().decode(serverFiles["wrangler.json"])) }, project.name);
+  } catch (error) {
+    if (error instanceof PraxisError && error.code === "UNSUPPORTED")
+      throw new PraxisError({ code: "UNSUPPORTED", message: `${error.message}. Remove those bindings from wrangler.jsonc and rebuild.` });
+    throw error;
+  }
+  const worker = await findWorker(client2, project.name);
+  const existing = worker ? (await client2.application.workers.secrets.list({ path: { worker_id: worker.id } })).map((s) => s.name) : [];
+  const { bindings, created } = planSecrets(existing, project.secrets, ports.random);
+  const named = new Set(bindings.map((b) => b.name));
+  input = { ...input, bindings: [...(input.bindings ?? []).filter((b) => !(b.type === "secret_text" && named.has(b.name))), ...bindings], wait: true };
+  const result = await client2.application.publish(input);
+  let health = null;
+  if (project.healthcheck)
+    health = await healthCheck2(result.url, project.healthcheck, ports);
+  ports.emit({ kind: "object", data: {
+    url: result.url,
+    worker_id: result.worker_id,
+    version_id: result.version_id,
+    deployment_id: result.deployment_id,
+    uploaded: result.uploaded,
+    reused: result.reused,
+    secrets_created: created,
+    health: health ? `${health.status} ${health.path}` : "not configured"
+  } });
+}
+async function appRollback(args, client2, ports) {
+  const project = loadProject(findProjectDir(args.dir, ports.cwd));
+  const worker = await findWorker(client2, project.name);
+  if (!worker)
+    throw new PraxisError({ code: "NOT_FOUND", message: `No application named ${project.name}; deploy it first with \`praxis app deploy\`` });
+  const deployments = [];
+  for await (const d of await client2.application.workers.deployments.list({ path: { worker_id: worker.id } }))
+    deployments.push(d);
+  const active = deployments.find((d) => d.id === worker.praxis?.current_deployment_id) ?? deployments.find((d) => d.praxis.status === "active");
+  const from = active?.versions[0]?.version_id;
+  if (!from)
+    throw new PraxisError({ code: "NOT_FOUND", message: `${project.name} has no active deployment` });
+  const to = args.to ?? chooseRollbackTarget(deployments, from);
+  if (!to)
+    throw new UsageError(`${project.name} has no earlier version to roll back to`, "Deploy a second version first, or pass --to <version_id>.");
+  if (to === from)
+    throw new UsageError(`Version ${to} is already active`);
+  const created = await client2.application.workers.deployments.create({ path: { worker_id: worker.id }, body: { strategy: "percentage", versions: [{ version_id: to, percentage: 100 }] } });
+  const done = await waitActive(client2, worker.id, created, ports);
+  ports.emit({ kind: "object", data: { url: worker.subdomain?.url ?? null, worker_id: worker.id, from_version: from, to_version: to, deployment_id: done.id } });
+}
+
+// src/main.ts
+import { spawnSync } from "node:child_process";
+
 // src/core/confirm.ts
 function destructive(method) {
   return /^(delete|purge|remove)(?:[A-Z-]|$)/.test(method);
@@ -26662,6 +27260,21 @@ function plain(value) {
 ` || c === "\r" || c === "\t" ? " " : "");
 }
 
+// src/output/list-columns.ts
+function workerStatus(item) {
+  const row = record(item), status = record(row.praxis).status;
+  if (typeof status !== "string")
+    return item;
+  return { ...row, status };
+}
+var listProjections = {
+  "application.workers.list": workerStatus
+};
+function projectList(items, op) {
+  const project = op ? listProjections[op] : undefined;
+  return project ? items.map(project) : items;
+}
+
 // src/output/human.ts
 var count3 = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
 function identity(result, ctx) {
@@ -26730,7 +27343,7 @@ function table(items, ctx, paint) {
     const text = truncate(v, sizes[i]);
     let styled = header ? paint.dim(text) : text;
     if (!header && ["status", "state"].includes(columns[i])) {
-      const color = /^(running|active|ready|succeeded|completed|enabled)$/i.test(v) ? paint.green : /^(pending|queued|starting|creating|paused)$/i.test(v) ? paint.yellow : /^(failed|error|cancelled|expired|disabled)$/i.test(v) ? paint.red : (s) => s;
+      const color = /^(running|active|ready|succeeded|completed|enabled)$/i.test(v) ? paint.green : /^(pending|queued|starting|creating|paused)$/i.test(v) ? paint.yellow : /^(failed|error|cancelled|expired|disabled|deleted|purging|purged|suspended)$/i.test(v) ? paint.red : (s) => s;
       styled = color(text);
     }
     return styled + (i === row.length - 1 ? "" : " ".repeat(Math.max(0, sizes[i] - width(text))));
@@ -26790,7 +27403,7 @@ function renderHuman(result, ctx) {
 ` : "") };
     case "list":
       return {
-        stdout: result.items.length ? table(result.items, ctx, out) : out.dim(`No ${plain(resource)}${/(s|x|ch|sh)$/.test(resource) ? "es" : "s"}.`) + `
+        stdout: result.items.length ? table(projectList(result.items, result.op), ctx, out) : out.dim(`No ${plain(resource)}${/(s|x|ch|sh)$/.test(resource) ? "es" : "s"}.`) + `
 `,
         stderr: err.dim(`${result.total !== undefined ? `${result.items.length} of ${result.total} items` : count3(result.items.length, "item")}${result.nextCursor ? ` · next: ${ctx.nextCommand ?? "praxis --help"}` : ""}`) + `
 `
@@ -26862,8 +27475,8 @@ ${usage ? `usage: ${JSON.stringify(usage)}
       return { stdout, stderr };
     }
     case "list": {
-      const columns = columnsFor(result.items);
-      const lines = columns.length ? ["|" + columns.map(cell).join("|") + "|", "|" + columns.map(() => "---").join("|") + "|", ...result.items.map((item) => "|" + columns.map((key) => cell(timestamp(key, record(item)[key]) ?? scalar(record(item)[key]))).join("|") + "|")] : [];
+      const items = projectList(result.items, result.op), columns = columnsFor(items);
+      const lines = columns.length ? ["|" + columns.map(cell).join("|") + "|", "|" + columns.map(() => "---").join("|") + "|", ...items.map((item) => "|" + columns.map((key) => cell(timestamp(key, record(item)[key]) ?? scalar(record(item)[key]))).join("|") + "|")] : [];
       lines.push(result.total !== undefined ? `${result.items.length} of ${result.total} rows; more: \`${ctx.moreCommand ?? "praxis --help"}\`` : `${result.items.length} rows; ${result.nextCursor ? `more: \`${ctx.nextCommand ?? "praxis --help"}\`` : "end"}`);
       return { stdout: lines.join(`
 `) + `
@@ -27072,9 +27685,9 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.1-dev.f0ef747";
+var version = "0.2.0-dev.3c36146";
 var commands = commandTree(operations);
-var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
+var manual = [...workflows.map((w) => w.words), [API_WORD]];
 function route(argv) {
   const words = [], args = [];
   for (let i = 0;i < argv.length; i++) {
@@ -27090,7 +27703,11 @@ function route(argv) {
       continue;
     }
     words.push(arg);
+    if (words.length === 1 && words[0] === API_WORD && HTTP_METHOD.test(argv[i + 1] ?? ""))
+      return { words, args: [...args, ...argv.slice(i + 1)] };
     const command = commands.find((c) => c.words.length === words.length && c.words.every((w, n) => w === words[n]));
+    if (words.length === 1 && words[0] === API_WORD && argv[i + 1] !== undefined && !argv[i + 1].startsWith("-"))
+      continue;
     if (command || manual.some((c) => c.length === words.length && c.every((w, n) => w === words[n])))
       return { words, args: [...args, ...argv.slice(i + 1)], command };
   }
@@ -27111,13 +27728,13 @@ var defaults = {
       chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     return Buffer.concat(chunks).toString("utf8");
   },
-  ask: () => new Promise((resolve) => {
+  ask: () => new Promise((resolve2) => {
     const input = createInterface({ input: process.stdin, terminal: false });
     input.once("line", (line) => {
-      resolve(/^(y|yes)$/i.test(line.trim()));
+      resolve2(/^(y|yes)$/i.test(line.trim()));
       input.close();
     });
-    input.once("close", () => resolve(false));
+    input.once("close", () => resolve2(false));
   }),
   async openBrowser(url) {
     try {
@@ -27125,15 +27742,35 @@ var defaults = {
       if (!["https:", "http:"].includes(parsed.protocol))
         return;
       const cmd = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["rundll32", "url.dll,FileProtocolHandler", url] : ["xdg-open", url];
-      await new Promise((resolve, reject) => {
+      await new Promise((resolve2, reject) => {
         const child = spawn2(cmd[0], cmd.slice(1), { stdio: "ignore" });
         child.once("error", reject);
-        child.once("close", () => resolve());
+        child.once("close", () => resolve2());
       });
     } catch {}
   },
-  wait: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-  render
+  wait: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
+  render,
+  spawn: (cmd, args, options) => new Promise((resolve2, reject) => {
+    const child = spawn2(cmd, args, { cwd: options.cwd, stdio: ["ignore", 2, 2] });
+    child.once("error", reject);
+    child.once("close", (code) => resolve2(code ?? 1));
+  }),
+  spawnCapture: (cmd, args, options) => new Promise((resolve2, reject) => {
+    const child = spawn2(cmd, args, { cwd: options.cwd, stdio: ["ignore", "pipe", "pipe"] });
+    const chunks = [];
+    child.stdout.on("data", (c) => chunks.push(c));
+    child.stderr.on("data", (c) => chunks.push(c));
+    child.once("error", reject);
+    child.once("close", (code) => resolve2({ code: code ?? 1, output: Buffer.concat(chunks).toString("utf8") }));
+  }),
+  has: (bin) => spawnSync(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" }).status === 0,
+  cwd: process.cwd()
+};
+var appOptions = {
+  "app create": [{ name: "dir", type: "string", description: "Directory to create the project in (default: ./<name>)." }, { name: "template", type: "string", description: "Copy a local template directory instead of downloading the standard template." }, { name: "no-install", type: "boolean", description: "Skip installing dependencies." }],
+  "app deploy": [{ name: "dir", type: "string", description: "Project directory (default: the nearest parent containing praxis.jsonc)." }, { name: "no-build", type: "boolean", description: "Publish the existing dist/ output without building." }],
+  "app rollback": [{ name: "dir", type: "string", description: "Project directory (default: the nearest parent containing praxis.jsonc)." }, { name: "to", type: "string", description: "Version id to deploy (default: the previous version)." }]
 };
 async function main(argv, injected = {}) {
   const ports = { ...defaults, ...injected };
@@ -27141,6 +27778,8 @@ async function main(argv, injected = {}) {
   const write = outputSession((result, context) => ports.render(redact(result, secrets), context));
   if (ports.env.PRAXIS_API_KEY)
     secrets.push(ports.env.PRAXIS_API_KEY);
+  if (ports.env.PRAXIS_API_TOKEN)
+    secrets.push(ports.env.PRAXIS_API_TOKEN);
   let ctx = {
     json: false,
     ...decideOutputMode({ json: false, stdoutIsTTY: ports.stdoutIsTTY, env: ports.env }),
@@ -27163,7 +27802,7 @@ async function main(argv, injected = {}) {
     const selected = route(argv);
     ctx.command = commandLine(selected.words);
     ctx.resource = selected.words.at(-2) ?? selected.words[0];
-    const specs = [...globalOptions, ...selected.command ? [...operationOptions(selected.command.op), ...selected.command.op.body ? [dataOption] : []] : selected.words[0] === "api" ? [dataOption] : selected.words[0] === "skill" ? [{ name: "install", type: "string" }] : []];
+    const specs = [...globalOptions, ...selected.command ? [...operationOptions(selected.command.op), ...selected.command.op.body ? [dataOption] : []] : selected.words.join(" ") === API_WORD ? [dataOption] : selected.words[0] === "skill" ? [{ name: "install", type: "string" }] : appOptions[selected.words.join(" ")] ?? []];
     const outputFlags = globalsOf(parseArgs(outputModeArgs(selected.args, specs), globalOptions));
     ctx.json = Boolean(outputFlags.json);
     Object.assign(ctx, decideOutputMode({ format: outputFlags.format, json: ctx.json, stdoutIsTTY: ports.stdoutIsTTY, env: ports.env }));
@@ -27177,15 +27816,22 @@ async function main(argv, injected = {}) {
       return 0;
     }
     if (!selected.words.length || !selected.command && !manual.some((c) => c.join(" ") === selected.words.join(" "))) {
-      if (selected.words.length && !commands.some((c) => selected.words.every((w, i) => c.words[i] === w)) && selected.words.join(" ") !== "org")
-        throw new UsageError(`Unknown command: ${selected.words.join(" ")}`);
+      if (selected.words.length && !commands.some((c) => selected.words.every((w, i) => c.words[i] === w)) && !workflowNouns.includes(selected.words.join(" "))) {
+        const moved = movedTo(commands, selected.words);
+        throw new UsageError(`Unknown command: ${selected.words.join(" ")}`, moved ? `Generated commands moved under \`praxis api\`. Did you mean: ${moved}?` : selected.words[0] === API_WORD ? "Run `praxis api --help` to list API domains." : "Run `praxis --help`.");
+      }
       if (parsed.positional.length)
         throw new UsageError("Unexpected arguments");
-      emit({ kind: "message", channel: "stdout", text: selected.words.join(" ") === "org" ? `praxis org list
-praxis org switch <organization_id>
-
-Examples:
-  praxis org list` : help(commands, selected.words) });
+      const noun = selected.words.join(" ");
+      emit({ kind: "message", channel: "stdout", text: workflowNouns.includes(noun) ? nounHelp(noun) : help(commands, selected.words) });
+      return 0;
+    }
+    if (selected.words.join(" ") === API_WORD && !parsed.positional.length && !flags.help) {
+      emit({ kind: "message", channel: "stdout", text: help(commands, [API_WORD]) });
+      return 0;
+    }
+    if (flags.help && selected.words.join(" ") === API_WORD && !parsed.positional.length) {
+      emit({ kind: "message", channel: "stdout", text: help(commands, [API_WORD]) });
       return 0;
     }
     if (flags.help && selected.words[0] === "skill") {
@@ -27193,6 +27839,11 @@ Examples:
 Print the AI skill or write <dir>/praxis-cli/SKILL.md.` });
       return 0;
     }
+    const workflow = workflows.find((w) => w.example && w.words.join(" ") === selected.words.join(" "));
+    if (flags.help && workflow) {
+      emit({ kind: "message", channel: "stdout", text: workflowHelp(workflow, appOptions[workflow.words.join(" ")] ?? []) });
+      return 0;
+    }
     if (flags.help) {
       emit({ kind: "message", channel: "stdout", text: selected.command ? help(commands, selected.words, selected.command) : `praxis ${selected.words.join(" ")}${selected.words[0] === "api" ? " <METHOD> <path> [--data JSON|@file|-]" : selected.words[1] === "switch" ? " <organization_id>" : ""}
 ${globalOptions.map((s) => "--" + s.name).join(" ")}
@@ -27286,7 +27937,7 @@ Examples:
       return 0;
     }
     const name = selected.words.join(" ");
-    const arity = name === "api" ? 2 : name === "org switch" ? 1 : 0;
+    const arity = name === "api" ? 2 : name === "org switch" || name === "app create" ? 1 : 0;
     if (parsed.positional.length !== arity)
       throw new UsageError(`${name} expects ${arity} positional argument(s)`);
     if (!quiet)
@@ -27318,8 +27969,29 @@ Examples:
       case "org switch":
         emit({ kind: "object", data: await auth.switchOrganization(parsed.positional[0]) });
         break;
+      case "app create": {
+        const appPorts = { ...ports, mode: ctx.mode, emit, human: (text) => {
+          if (ctx.mode === "human")
+            emit({ kind: "message", channel: "stdout", text });
+        }, random: randomSecret };
+        await appCreate({ name: parsed.positional[0], dir: parsed.flags.dir?.[0], template: parsed.flags.template?.[0], install: !parsed.flags["no-install"] }, config.env, appPorts);
+        break;
+      }
+      case "app deploy":
+      case "app rollback": {
+        const appPorts = { ...ports, mode: ctx.mode, emit, human: () => {}, random: randomSecret };
+        const client2 = await auth.client(org);
+        const dir = parsed.flags.dir?.[0];
+        if (name === "app deploy")
+          await appDeploy({ dir, build: !parsed.flags["no-build"] }, client2, appPorts);
+        else
+          await appRollback({ dir, to: parsed.flags.to?.[0] }, client2, appPorts);
+        break;
+      }
       case "api": {
-        const method = parsed.positional[0].toUpperCase();
+        const method = parsed.positional[0];
+        if (!HTTP_METHOD.test(method))
+          throw new UsageError(`Unknown command: api ${method}`, "Run `praxis api --help` to list API domains; raw requests use an uppercase method, such as `praxis api GET /model/v1/models`.");
         await confirm(method.toLowerCase());
         if (!quiet) {
           stopProgress();