@groundfloorcloud/cli 0.1.0 → 0.1.2

package/dist/index.js

@@ -64,27 +64,95 @@ async function updateConfig(patch) {
 }
 
 // src/auth/config.ts
-var DEFAULTS = {
-  issuer: "https://auth.dev.groundfloor.cloud/realms/groundfloor_dev",
-  clientId: "groundfloor-cli",
-  apiUrl: "http://localhost:8088"
+var CELLS = {
+  production: {
+    apiUrl: "https://platform.groundfloor.cloud",
+    issuer: "https://auth.groundfloor.cloud/realms/groundfloor",
+    clientId: "groundfloor-cli",
+    consoleUrl: "https://console.groundfloor.cloud"
+  },
+  stage: {
+    apiUrl: "https://platform.stage.groundfloor.cloud",
+    issuer: "https://auth.stage.groundfloor.cloud/realms/groundfloor_pico_stage-realm",
+    clientId: "groundfloor-cli",
+    consoleUrl: "https://console.stage.groundfloor.cloud"
+  },
+  dev: {
+    apiUrl: "https://platform.dev.groundfloor.cloud",
+    issuer: "https://auth.dev.groundfloor.cloud/realms/groundfloor_dev",
+    clientId: "groundfloor-cli",
+    consoleUrl: "https://console.dev.groundfloor.cloud"
+  }
+};
+var STARTER_KIT_ZIP_PATH = "/downloads/shell-starter-kit.zip";
+function starterKitZipUrl(cell = "production") {
+  return `${CELLS[cell].consoleUrl}${STARTER_KIT_ZIP_PATH}`;
+}
+var CELL_ALIASES = {
+  production: "production",
+  prod: "production",
+  stage: "stage",
+  staging: "stage",
+  dev: "dev",
+  development: "dev"
 };
+function parseCell(raw) {
+  const cell = CELL_ALIASES[raw.trim().toLowerCase()];
+  if (!cell) {
+    throw new Error(
+      `Unknown cell "${raw}". Use production, stage, or dev.`
+    );
+  }
+  return cell;
+}
+function cellFromLoginOpts(opts) {
+  const selected = [];
+  if (opts.dev) selected.push("dev");
+  if (opts.stage) selected.push("stage");
+  if (opts.env) selected.push(parseCell(opts.env));
+  const unique = [...new Set(selected)];
+  if (unique.length > 1) {
+    throw new Error("Use only one of --dev, --stage, or --env.");
+  }
+  return unique[0] ?? "production";
+}
+function inferCell(apiUrl, issuer) {
+  const api = apiUrl.replace(/\/+$/, "");
+  const iss = (issuer ?? "").replace(/\/+$/, "");
+  for (const [name, hosts] of Object.entries(CELLS)) {
+    if (api === hosts.apiUrl || iss === hosts.issuer) return name;
+  }
+  return void 0;
+}
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 async function resolveConfig(overrides = {}) {
   const file = await readConfig();
-  const issuer = overrides.issuer ?? process.env.GROUNDFLOOR_ISSUER ?? file.issuer ?? DEFAULTS.issuer;
-  const clientId = overrides.clientId ?? process.env.GROUNDFLOOR_CLIENT_ID ?? file.clientId ?? DEFAULTS.clientId;
-  const apiUrl = overrides.apiUrl ?? process.env.GROUNDFLOOR_API_URL ?? file.apiUrl ?? DEFAULTS.apiUrl;
+  const production = CELLS.production;
+  const issuer = overrides.issuer ?? process.env.GROUNDFLOOR_ISSUER ?? file.issuer ?? production.issuer;
+  const clientId = overrides.clientId ?? process.env.GROUNDFLOOR_CLIENT_ID ?? file.clientId ?? production.clientId;
+  const apiUrl = overrides.apiUrl ?? process.env.GROUNDFLOOR_API_URL ?? file.apiUrl ?? production.apiUrl;
   const workspaceId = overrides.workspaceId ?? process.env.GROUNDFLOOR_WORKSPACE_ID ?? file.workspaceId;
+  const environment = overrides.environment ?? inferCell(apiUrl, issuer) ?? file.environment;
   return {
     issuer: trimTrailingSlash(issuer),
     clientId,
     apiUrl: trimTrailingSlash(apiUrl),
-    workspaceId: workspaceId || void 0
+    workspaceId: workspaceId || void 0,
+    environment
   };
 }
+async function requireWorkspace(workspace) {
+  const cfg = await resolveConfig({ workspaceId: workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  return { ...cfg, workspaceId: cfg.workspaceId };
+}
+var defaults = CELLS.production;
 
 // src/auth/oauth.ts
 import crypto from "crypto";
@@ -323,10 +391,13 @@ async function refreshTokens(opts) {
 var EXPIRY_SKEW_MS = 3e4;
 var NotLoggedInError = class extends Error {
   constructor() {
-    super("Not logged in. Run `gf login` first.");
+    super(
+      "Not logged in. Set GROUNDFLOOR_TOKEN, or run `gf login` first."
+    );
     this.name = "NotLoggedInError";
   }
 };
+var accessTokenProvider = null;
 function decodeJwt(token) {
   const parts = token.split(".");
   if (parts.length < 2) return null;
@@ -353,6 +424,9 @@ function isFresh(session) {
   return Date.now() < session.expiresAt - EXPIRY_SKEW_MS;
 }
 async function getValidAccessToken() {
+  if (accessTokenProvider) {
+    return accessTokenProvider();
+  }
   const session = await readAuth();
   if (!session || !session.accessToken) {
     throw new NotLoggedInError();
@@ -382,13 +456,16 @@ async function getValidAccessToken() {
 
 // src/commands/login.ts
 async function loginCommand(opts) {
+  const cell = cellFromLoginOpts(opts);
+  const hosts = CELLS[cell];
   const cfg = await resolveConfig({
-    issuer: opts.issuer,
-    clientId: opts.clientId,
-    apiUrl: opts.apiUrl
+    issuer: opts.issuer ?? hosts.issuer,
+    clientId: opts.clientId ?? hosts.clientId,
+    apiUrl: opts.apiUrl ?? hosts.apiUrl,
+    environment: cell
   });
   process.stderr.write(
-    `Signing in to ${cfg.issuer}
+    `Signing in to Groundfloor ${cell}
   client: ${cfg.clientId}
   api:    ${cfg.apiUrl}
 `
@@ -416,7 +493,8 @@ async function loginCommand(opts) {
   await updateConfig({
     issuer: cfg.issuer,
     clientId: cfg.clientId,
-    apiUrl: cfg.apiUrl
+    apiUrl: cfg.apiUrl,
+    environment: cell
   });
   const claims = decodeJwt(tokens.access_token);
   const who = claims?.email || claims?.preferred_username || claims?.sub || "unknown user";
@@ -455,9 +533,9 @@ async function parseError(res) {
   }
   return `${res.status} ${detail}`;
 }
-async function cpGet(apiUrl, path4) {
+async function cpGet(apiUrl, path7) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path4}`, {
+  const res = await fetch(`${apiUrl}${path7}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/json"
@@ -468,9 +546,9 @@ async function cpGet(apiUrl, path4) {
   }
   return await res.json();
 }
-async function cpPostJson(apiUrl, path4, body) {
+async function cpPostJson(apiUrl, path7, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path4}`, {
+  const res = await fetch(`${apiUrl}${path7}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -484,9 +562,9 @@ async function cpPostJson(apiUrl, path4, body) {
   }
   return await res.json();
 }
-async function cpDelete(apiUrl, path4) {
+async function cpDelete(apiUrl, path7) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path4}`, {
+  const res = await fetch(`${apiUrl}${path7}`, {
     method: "DELETE",
     headers: { Authorization: `Bearer ${token}`, Accept: "application/json" }
   });
@@ -494,6 +572,61 @@ async function cpDelete(apiUrl, path4) {
     throw new CpError(res.status, await parseError(res));
   }
 }
+async function cpPutJson(apiUrl, path7, body) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path7}`, {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+async function cpPatchJson(apiUrl, path7, body) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path7}`, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+async function cpPutBytes(apiUrl, path7, body, contentType) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path7}`, {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": contentType
+    },
+    body
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+}
+function queryString(params) {
+  const u = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value) u.set(key, value);
+  }
+  const s = u.toString();
+  return s ? `?${s}` : "";
+}
 function listWorkspaces(apiUrl) {
   return cpGet(apiUrl, "/v1/workspaces");
 }
@@ -624,6 +757,134 @@ function verifyDomain(apiUrl, workspaceId, coderunnerId, domain) {
     {}
   );
 }
+function wsPath(workspaceId, suffix) {
+  return `/v1/workspaces/${encodeURIComponent(workspaceId)}${suffix}`;
+}
+function listSecrets(apiUrl, workspaceId, environmentId) {
+  return cpGet(
+    apiUrl,
+    `${wsPath(workspaceId, "/secrets")}${queryString({
+      environment_id: environmentId
+    })}`
+  );
+}
+function getSecret(apiUrl, workspaceId, key, environmentId) {
+  return cpGet(
+    apiUrl,
+    `${wsPath(workspaceId, `/secrets/${encodeURIComponent(key)}`)}${queryString({
+      environment_id: environmentId
+    })}`
+  );
+}
+function putSecret(apiUrl, workspaceId, key, payload, environmentId) {
+  return cpPutJson(
+    apiUrl,
+    `${wsPath(workspaceId, `/secrets/${encodeURIComponent(key)}`)}${queryString({
+      environment_id: environmentId
+    })}`,
+    payload
+  );
+}
+function deleteSecret(apiUrl, workspaceId, key, environmentId) {
+  return cpDelete(
+    apiUrl,
+    `${wsPath(workspaceId, `/secrets/${encodeURIComponent(key)}`)}${queryString({
+      environment_id: environmentId
+    })}`
+  );
+}
+function listFiles(apiUrl, workspaceId) {
+  return cpGet(apiUrl, wsPath(workspaceId, "/files"));
+}
+function initFileUpload(apiUrl, workspaceId, payload) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(workspaceId, "/files/upload-url"),
+    payload
+  );
+}
+function finalizeFileUpload(apiUrl, workspaceId, fileId) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(workspaceId, `/files/${encodeURIComponent(fileId)}/finalize`),
+    {}
+  );
+}
+function getFileDownloadUrl(apiUrl, workspaceId, fileId) {
+  return cpGet(
+    apiUrl,
+    wsPath(workspaceId, `/files/${encodeURIComponent(fileId)}/download-url`)
+  );
+}
+function deleteFile(apiUrl, workspaceId, fileId) {
+  return cpDelete(
+    apiUrl,
+    wsPath(workspaceId, `/files/${encodeURIComponent(fileId)}`)
+  );
+}
+function listApps(apiUrl, workspaceId) {
+  return cpGet(
+    apiUrl,
+    `${wsPath(workspaceId, "/apps")}${queryString({ kind: "product" })}`
+  );
+}
+function getApp(apiUrl, workspaceId, appId) {
+  return cpGet(
+    apiUrl,
+    wsPath(workspaceId, `/apps/${encodeURIComponent(appId)}`)
+  );
+}
+function createApp(apiUrl, workspaceId, body) {
+  return cpPostJson(apiUrl, wsPath(workspaceId, "/apps"), body);
+}
+function patchApp(apiUrl, workspaceId, appId, body) {
+  return cpPatchJson(
+    apiUrl,
+    wsPath(workspaceId, `/apps/${encodeURIComponent(appId)}`),
+    body
+  );
+}
+function initAppReleaseUpload(apiUrl, workspaceId, appId, body) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(workspaceId, `/apps/${encodeURIComponent(appId)}/releases/upload-url`),
+    body
+  );
+}
+function uploadAppReleaseContent(apiUrl, workspaceId, appId, releaseId, bytes, contentType) {
+  return cpPutBytes(
+    apiUrl,
+    wsPath(
+      workspaceId,
+      `/apps/${encodeURIComponent(appId)}/releases/${encodeURIComponent(releaseId)}/content`
+    ),
+    bytes,
+    contentType
+  );
+}
+function finalizeAppRelease(apiUrl, workspaceId, appId, releaseId) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(
+      workspaceId,
+      `/apps/${encodeURIComponent(appId)}/releases/${encodeURIComponent(releaseId)}/finalize`
+    ),
+    {}
+  );
+}
+function getDataplaneStatus(apiUrl, workspaceId) {
+  return cpGet(
+    apiUrl,
+    wsPath(workspaceId, "/dataplane/status")
+  );
+}
+function provisionDataplane(apiUrl, workspaceId) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(workspaceId, "/dataplane/provision"),
+    {}
+  );
+}
 
 // src/commands/whoami.ts
 async function whoamiCommand() {
@@ -636,6 +897,10 @@ async function whoamiCommand() {
 `);
   process.stdout.write(`Subject: ${subject}
 `);
+  if (cfg.environment) {
+    process.stdout.write(`Cell:    ${cfg.environment}
+`);
+  }
   process.stdout.write(`Issuer:  ${cfg.issuer}
 `);
   process.stdout.write(`API:     ${cfg.apiUrl}
@@ -666,6 +931,9 @@ async function envCommand() {
   if (cfg.workspaceId) {
     lines.push(`export GROUNDFLOOR_WORKSPACE_ID=${cfg.workspaceId}`);
   }
+  if (cfg.environment) {
+    lines.push(`export GROUNDFLOOR_ENV=${cfg.environment}`);
+  }
   process.stdout.write(`${lines.join("\n")}
 `);
 }
@@ -803,9 +1071,9 @@ async function walkFileList(dir) {
   await walk(dir, "");
   return out;
 }
-async function buildZip(sourceDir, files) {
+async function buildZip(sourceDir, files2) {
   const zip = new AdmZip();
-  for (const rel of files) {
+  for (const rel of files2) {
     const abs = path2.join(sourceDir, rel);
     try {
       const data = await fs2.readFile(abs);
@@ -856,13 +1124,13 @@ async function packageSource(opts) {
       throw new Error(`Not a directory: ${sourceDir}`);
     }
     const useGit = await isGitRepo(sourceDir);
-    const files = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
-    if (files.length === 0) {
+    const files2 = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    if (files2.length === 0) {
       throw new Error(
         `No files to package in ${sourceDir} (everything ignored or empty).`
       );
     }
-    const zip = await buildZip(sourceDir, files);
+    const zip = await buildZip(sourceDir, files2);
     let gitSha = null;
     const shaRoot = cleanup ?? (useGit ? sourceDir : null);
     if (shaRoot) {
@@ -873,7 +1141,7 @@ async function packageSource(opts) {
         gitSha = null;
       }
     }
-    return { zip, fileCount: files.length, sourceDir, cleanup, gitSha };
+    return { zip, fileCount: files2.length, sourceDir, cleanup, gitSha };
   } catch (err) {
     if (cleanup) {
       await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
@@ -1271,6 +1539,726 @@ async function domainsVerifyCommand(domain, opts) {
   }
 }
 
+// src/commands/secrets.ts
+async function readValue(value) {
+  if (value === void 0) {
+    throw new Error("Pass a value, or `-` to read from stdin.");
+  }
+  if (value === "-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+  }
+  return value;
+}
+async function secretsListCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const data = await listSecrets(cfg.apiUrl, cfg.workspaceId, opts.environment);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.secrets.length === 0) {
+    process.stdout.write("No secrets in this workspace.\n");
+    return;
+  }
+  for (const secret of data.secrets) {
+    process.stdout.write(`${secret.key}
+`);
+  }
+}
+async function secretsGetCommand(key, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const secret = await getSecret(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    key,
+    opts.environment
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(secret, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`${secret.value}
+`);
+}
+async function secretsSetCommand(key, value, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const resolved = await readValue(value);
+  const saved = await putSecret(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    key,
+    { value: resolved, description: opts.description },
+    opts.environment
+  );
+  process.stdout.write(`Saved secret ${saved.key}
+`);
+}
+async function secretsRmCommand(key, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  await deleteSecret(cfg.apiUrl, cfg.workspaceId, key, opts.environment);
+  process.stdout.write(`Deleted secret ${key}
+`);
+}
+
+// src/commands/files.ts
+import { promises as fs4 } from "fs";
+import path4 from "path";
+function guessContentType(filename) {
+  const ext = path4.extname(filename).toLowerCase();
+  const types = {
+    ".json": "application/json",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".zip": "application/zip"
+  };
+  return types[ext] ?? "application/octet-stream";
+}
+async function filesListCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const data = await listFiles(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.files.length === 0) {
+    process.stdout.write("No files in this workspace.\n");
+    return;
+  }
+  for (const file of data.files) {
+    const size = file.size_bytes != null ? `${file.size_bytes}B` : "";
+    process.stdout.write(
+      `${file.id}  ${file.name ?? ""}  ${size}  [${file.status ?? ""}]
+`
+    );
+  }
+}
+async function filesUploadCommand(filePath, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const resolved = path4.resolve(filePath);
+  const buf = await fs4.readFile(resolved);
+  const name = opts.name ?? path4.basename(resolved);
+  const contentType = guessContentType(name);
+  const init = await initFileUpload(cfg.apiUrl, cfg.workspaceId, {
+    name,
+    content_type: contentType,
+    size_bytes: buf.byteLength
+  });
+  const put = await fetch(init.upload_url, {
+    method: "PUT",
+    headers: { "Content-Type": contentType },
+    body: buf
+  });
+  if (!put.ok) {
+    throw new Error(
+      `Upload to object storage failed: ${put.status} ${put.statusText}`
+    );
+  }
+  const file = await finalizeFileUpload(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    init.file.id
+  );
+  process.stdout.write(`Uploaded ${file.id}  ${file.name ?? name}
+`);
+}
+async function filesDownloadCommand(fileId, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const { download_url: url } = await getFileDownloadUrl(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    fileId
+  );
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  const dest = path4.resolve(opts.out ?? fileId);
+  await fs4.writeFile(dest, buf);
+  process.stdout.write(`Wrote ${dest}
+`);
+}
+async function filesRmCommand(fileId, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  await deleteFile(cfg.apiUrl, cfg.workspaceId, fileId);
+  process.stdout.write(`Deleted file ${fileId}
+`);
+}
+
+// src/commands/apps.ts
+import { promises as fs5 } from "fs";
+import path5 from "path";
+
+// src/release-zip.ts
+import AdmZip2 from "adm-zip";
+var REMOTE_ENTRY = "remoteEntry.js";
+var FLATTEN_SUFFIXES = [".js", ".mjs", ".cjs", ".css", ".map", ".wasm"];
+function normalizeZipEntryName(filename) {
+  return filename.replace(/\\/g, "/").replace(/^\/+/, "");
+}
+function parentDir(rel) {
+  const i = rel.lastIndexOf("/");
+  return i === -1 ? "" : rel.slice(0, i);
+}
+function basename(rel) {
+  const i = rel.lastIndexOf("/");
+  return i === -1 ? rel : rel.slice(i + 1);
+}
+function chooseRemoteEntry(relpaths) {
+  const entries = relpaths.filter(
+    (p) => p === REMOTE_ENTRY || p.endsWith(`/${REMOTE_ENTRY}`)
+  );
+  if (entries.length === 0) return void 0;
+  if (entries.includes(REMOTE_ENTRY)) return REMOTE_ENTRY;
+  return [...entries].sort((a, b) => {
+    const score = (p) => {
+      const parts = p.split("/");
+      const inAssets = parts.length >= 2 && parts[parts.length - 2] === "assets";
+      return `${inAssets ? 0 : 1}:${parts.length}:${p}`;
+    };
+    return score(a).localeCompare(score(b));
+  })[0];
+}
+function flattenFederatedBundlePlan(relpaths) {
+  const paths = relpaths.map(normalizeZipEntryName).filter((name) => name && !name.endsWith("/") && !name.split("/").includes(".."));
+  const pathset = new Set(paths);
+  const entry = chooseRemoteEntry([...pathset]);
+  if (!entry) return {};
+  const promoteDirs = /* @__PURE__ */ new Set();
+  const entryDir = parentDir(entry);
+  if (entryDir) promoteDirs.add(entryDir);
+  for (const path7 of pathset) {
+    const parent = parentDir(path7);
+    if (parent === "assets" || parent.endsWith("/assets") && parent.split("/").length - 1 < 2) {
+      promoteDirs.add(parent);
+    }
+  }
+  const destToSrc = {};
+  for (const src of paths) {
+    const parent = parentDir(src);
+    if (!promoteDirs.has(parent)) continue;
+    const dest = basename(src);
+    if (dest === "release.zip") continue;
+    const lower = dest.toLowerCase();
+    if (dest !== REMOTE_ENTRY && !FLATTEN_SUFFIXES.some((ext) => lower.endsWith(ext))) {
+      continue;
+    }
+    if (pathset.has(dest)) continue;
+    const prev = destToSrc[dest];
+    if (prev === void 0 || src.split("/").length < prev.split("/").length) {
+      destToSrc[dest] = src;
+    }
+  }
+  return destToSrc;
+}
+function flattenFederatedReleaseZip(bytes) {
+  const zip = new AdmZip2(bytes);
+  const rels = [];
+  const byNorm = /* @__PURE__ */ new Map();
+  for (const entry of zip.getEntries()) {
+    if (entry.isDirectory) continue;
+    const name = normalizeZipEntryName(entry.entryName);
+    rels.push(name);
+    byNorm.set(name, entry);
+  }
+  const plan = flattenFederatedBundlePlan(rels);
+  const keys = Object.keys(plan);
+  if (keys.length === 0) return bytes;
+  for (const dest of keys) {
+    const src = plan[dest];
+    const source = byNorm.get(src);
+    if (!source) continue;
+    zip.addFile(dest, source.getData());
+  }
+  return zip.toBuffer();
+}
+function federatedReleaseZipHint() {
+  return "Run `npm run release` in a kit from `gf apps init --slug <portal-slug>` (do not zip Vite dist/ or dist/assets/ by hand).";
+}
+
+// src/commands/apps.ts
+import AdmZip3 from "adm-zip";
+var MAX_RELEASE_BYTES = 32 * 1024 * 1024;
+function slugify2(input) {
+  const slug = input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "app";
+}
+function formatApp(app) {
+  return `${app.id}  ${app.name ?? app.slug ?? ""}  ${app.app_kind ?? ""}  [${app.status ?? ""}]`;
+}
+async function readJsonObject(filePath) {
+  const raw = await fs5.readFile(filePath, "utf8");
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${filePath} must contain a JSON object`);
+  }
+  return parsed;
+}
+async function maybeReadManifest(filePath) {
+  if (!filePath) return void 0;
+  return readJsonObject(path5.resolve(filePath));
+}
+async function findSiblingManifest(bundlePath) {
+  const dir = await isDirectory(bundlePath) ? bundlePath : path5.dirname(bundlePath);
+  const candidate = path5.join(dir, "groundfloor.manifest.json");
+  try {
+    await fs5.access(candidate);
+  } catch {
+    return void 0;
+  }
+  return { path: candidate, manifest: await readJsonObject(candidate) };
+}
+function zipHasRemoteEntry(bytes) {
+  const zip = new AdmZip3(bytes);
+  return zip.getEntries().some((entry) => {
+    if (entry.isDirectory) return false;
+    const name = normalizeZipEntryName(entry.entryName);
+    return name === REMOTE_ENTRY || name.endsWith(`/${REMOTE_ENTRY}`);
+  });
+}
+function prepareReleaseZip(bytes) {
+  if (!zipHasRemoteEntry(bytes)) {
+    throw new Error(
+      `Zip has no remoteEntry.js. ${federatedReleaseZipHint()}`
+    );
+  }
+  const flattened = flattenFederatedReleaseZip(bytes);
+  const plan = flattenFederatedBundlePlan(
+    new AdmZip3(bytes).getEntries().filter((e) => !e.isDirectory).map((e) => normalizeZipEntryName(e.entryName))
+  );
+  if (Object.keys(plan).length > 0) {
+    process.stderr.write(
+      `Note: flattened Vite dist/assets layout so chunks sit next to remoteEntry.js.
+Prefer: ${federatedReleaseZipHint()}
+`
+    );
+  }
+  return flattened;
+}
+async function isDirectory(filePath) {
+  try {
+    return (await fs5.stat(filePath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function resolveAppId(apiUrl, workspaceId, idOrSlug) {
+  const listed = await listApps(apiUrl, workspaceId);
+  const match = listed.apps.find(
+    (app) => app.id === idOrSlug || app.slug === idOrSlug
+  );
+  if (match) return match;
+  try {
+    return await getApp(apiUrl, workspaceId, idOrSlug);
+  } catch (err) {
+    if (err instanceof CpError && err.status === 404) {
+      throw new Error(
+        `App not found: ${idOrSlug}. Run \`gf apps ls\` or \`gf apps create\`.`
+      );
+    }
+    throw err;
+  }
+}
+async function appsListCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const data = await listApps(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.apps.length === 0) {
+    process.stdout.write("No apps in this workspace.\n");
+    return;
+  }
+  for (const app of data.apps) {
+    process.stdout.write(`${formatApp(app)}
+`);
+  }
+}
+async function appsGetCommand(appId, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const app = await resolveAppId(cfg.apiUrl, cfg.workspaceId, appId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(app, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`${formatApp(app)}
+`);
+}
+async function appsCreateCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const kindRaw = (opts.kind ?? "shell_federated").trim();
+  if (kindRaw === "coderunner") {
+    throw new Error(
+      "Do not create app_kind=coderunner. Deploy workloads with `gf deploy`. Use --kind shell_federated or --kind standalone."
+    );
+  }
+  if (kindRaw !== "shell_federated" && kindRaw !== "standalone") {
+    throw new Error(
+      `--kind must be shell_federated or standalone (got ${kindRaw})`
+    );
+  }
+  const kind = kindRaw;
+  const localManifest = await maybeReadManifest(opts.manifest);
+  const name = opts.name?.trim() || (typeof localManifest?.name === "string" ? localManifest.name : "");
+  const slug = opts.slug?.trim() || (typeof localManifest?.appId === "string" ? localManifest.appId : name ? slugify2(name) : "");
+  if (!name) {
+    throw new Error("Pass --name, or a manifest with a name field.");
+  }
+  if (!slug) {
+    throw new Error("Pass --slug, or a manifest with appId.");
+  }
+  if (kind === "standalone" && !opts.primaryCoderunner?.trim()) {
+    throw new Error(
+      "Standalone apps require --primary-coderunner <id> (an existing service coderunner)."
+    );
+  }
+  const body = {
+    name,
+    slug,
+    app_kind: kind
+  };
+  if (opts.environment) body.environment_id = opts.environment;
+  if (opts.primaryCoderunner) {
+    body.primary_coderunner_id = opts.primaryCoderunner;
+  }
+  if (localManifest) body.manifest = localManifest;
+  let app;
+  try {
+    app = await createApp(cfg.apiUrl, cfg.workspaceId, body);
+  } catch (err) {
+    if (err instanceof CpError && err.status === 409) {
+      throw new Error(
+        `App slug ${slug} already exists. Use \`gf apps publish ${slug}\` to ship a build.`
+      );
+    }
+    throw err;
+  }
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(app, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`Created ${formatApp(app)}
+`);
+  if (kind === "shell_federated") {
+    process.stdout.write(
+      `Next:
+  gf apps init --slug ${slug}
+  cd ${slug} && npm install && npm run release
+  gf apps publish --path release.zip
+Do not scaffold src/App.tsx from scratch \u2014 BrowserRouter in App.tsx crashes the Shell.
+`
+    );
+  }
+}
+async function appsPublishCommand(appRef, opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const inputPath = path5.resolve(opts.path ?? "release.zip");
+  const bundlePath = await isDirectory(inputPath) ? path5.join(inputPath, "release.zip") : inputPath;
+  let bytes;
+  try {
+    bytes = await fs5.readFile(bundlePath);
+  } catch {
+    throw new Error(
+      `No bundle at ${bundlePath}. Run \`npm run release\` in the starter-kit, then pass --path release.zip.`
+    );
+  }
+  if (bytes.byteLength === 0) {
+    throw new Error(`Bundle is empty: ${bundlePath}`);
+  }
+  if (bytes.byteLength > MAX_RELEASE_BYTES) {
+    throw new Error(
+      `Bundle exceeds ${MAX_RELEASE_BYTES} bytes (${bytes.byteLength}).`
+    );
+  }
+  const sibling = await findSiblingManifest(bundlePath);
+  const ref = appRef?.trim() || opts.app?.trim() || (typeof sibling?.manifest.appId === "string" ? sibling.manifest.appId : "");
+  if (!ref) {
+    throw new Error(
+      "Pass an app id or slug, or set appId in groundfloor.manifest.json next to the bundle."
+    );
+  }
+  const app = await resolveAppId(cfg.apiUrl, cfg.workspaceId, ref);
+  if (app.app_kind && app.app_kind !== "shell_federated") {
+    throw new Error(
+      `Releases are only for shell_federated apps (this app is ${app.app_kind}). Use \`gf deploy\` for coderunner workloads.`
+    );
+  }
+  const ext = path5.extname(bundlePath).toLowerCase();
+  const isZip = ext === ".zip";
+  if (isZip) {
+    bytes = prepareReleaseZip(bytes);
+  }
+  const bundle = isZip ? "zip" : "remote_entry";
+  const contentType = isZip ? "application/zip" : "application/javascript";
+  if (opts.syncManifest !== false && sibling) {
+    await patchApp(cfg.apiUrl, cfg.workspaceId, app.id, {
+      manifest: sibling.manifest
+    });
+  }
+  const init = await initAppReleaseUpload(cfg.apiUrl, cfg.workspaceId, app.id, {
+    bundle,
+    label: opts.label
+  });
+  await uploadAppReleaseContent(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    app.id,
+    init.release.id,
+    bytes,
+    contentType
+  );
+  const release = await finalizeAppRelease(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    app.id,
+    init.release.id
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify({ app, release }, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(
+    `Published ${app.slug ?? app.id}  build ${release.build_number}` + (release.remote_url ? `  ${release.remote_url}` : "") + "\n"
+  );
+}
+
+// src/commands/apps-init.ts
+import { promises as fs6 } from "fs";
+import os3 from "os";
+import path6 from "path";
+import AdmZip4 from "adm-zip";
+var MAX_KIT_BYTES = 8 * 1024 * 1024;
+function slugify3(input) {
+  const slug = input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "app";
+}
+function titleFromSlug(slug) {
+  return slug.split("-").filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ") || slug;
+}
+async function pathExists(filePath) {
+  try {
+    await fs6.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isEmptyDir(dir) {
+  try {
+    const entries = await fs6.readdir(dir);
+    return entries.length === 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return true;
+    throw err;
+  }
+}
+async function findKitRoot(extracted) {
+  const candidates = [
+    path6.join(extracted, "shell-starter-kit"),
+    extracted
+  ];
+  const entries = await fs6.readdir(extracted, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      candidates.push(path6.join(extracted, entry.name));
+    }
+  }
+  for (const candidate of candidates) {
+    if (await pathExists(path6.join(candidate, "groundfloor.manifest.json"))) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    "Starter-kit ZIP did not contain groundfloor.manifest.json. Re-download with `gf apps init`."
+  );
+}
+function stampAppIdentity(source, slug) {
+  if (!/export const APP_ID\s*=/.test(source)) {
+    throw new Error("src/appIdentity.ts does not export APP_ID");
+  }
+  const safe = slug.replace(/['"]/g, "");
+  return source.replace(
+    /export const APP_ID\s*=\s*['"][^'"]*['"]/,
+    `export const APP_ID = '${safe}'`
+  );
+}
+function stampManifest(raw, slug, name) {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("groundfloor.manifest.json must be a JSON object");
+  }
+  const manifest = parsed;
+  manifest.appId = slug;
+  manifest.name = name;
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+async function downloadKit(url) {
+  let res;
+  try {
+    res = await fetch(url, {
+      redirect: "follow",
+      signal: AbortSignal.timeout(6e4),
+      headers: { "User-Agent": "groundfloor-cli/0.1.1" }
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Could not download starter-kit from ${url}: ${message}`);
+  }
+  if (!res.ok) {
+    throw new Error(
+      `Starter-kit download failed (${res.status}) from ${url}`
+    );
+  }
+  const bytes = Buffer.from(await res.arrayBuffer());
+  if (bytes.byteLength === 0) {
+    throw new Error(`Starter-kit ZIP is empty: ${url}`);
+  }
+  if (bytes.byteLength > MAX_KIT_BYTES) {
+    throw new Error(
+      `Starter-kit ZIP is too large (${bytes.byteLength} bytes) from ${url}`
+    );
+  }
+  if (bytes[0] !== 80 || bytes[1] !== 75) {
+    const head = bytes.subarray(0, 80).toString("utf8");
+    throw new Error(
+      `Expected a ZIP from ${url}, got ${res.headers.get("content-type") ?? "unknown"} (${head.trim()}). Do not scaffold a federated App.tsx from memory.`
+    );
+  }
+  return bytes;
+}
+function assertSafeZipEntries(zip) {
+  for (const entry of zip.getEntries()) {
+    const name = entry.entryName.replace(/\\/g, "/");
+    if (name.startsWith("/") || name.includes("..")) {
+      throw new Error(`Refusing starter-kit ZIP with unsafe path: ${name}`);
+    }
+  }
+}
+async function appsInitCommand(opts) {
+  const rawSlug = opts.slug?.trim() ?? "";
+  if (!rawSlug) {
+    throw new Error("Pass --slug <portal-slug>.");
+  }
+  const slug = slugify3(rawSlug);
+  if (slug !== rawSlug) {
+    process.stderr.write(`Note: slug normalized to ${slug}
+`);
+  }
+  const name = opts.name?.trim() || titleFromSlug(slug);
+  const dest = path6.resolve(opts.dir?.trim() || path6.join(process.cwd(), slug));
+  const cfg = await resolveConfig();
+  const cell = cfg.environment ?? "production";
+  const kitUrl = opts.kitUrl?.trim() || starterKitZipUrl(cell);
+  if (!await isEmptyDir(dest) && !opts.force) {
+    throw new Error(
+      `Destination ${dest} is not empty. Pass --force to overwrite, or choose another --dir.`
+    );
+  }
+  if (opts.force && await pathExists(dest)) {
+    await fs6.rm(dest, { recursive: true, force: true });
+  }
+  const bytes = await downloadKit(kitUrl);
+  const zip = new AdmZip4(bytes);
+  assertSafeZipEntries(zip);
+  const tmp = await fs6.mkdtemp(path6.join(os3.tmpdir(), "gf-starter-kit-"));
+  try {
+    zip.extractAllTo(tmp, true);
+    const kitRoot = await findKitRoot(tmp);
+    await fs6.mkdir(dest, { recursive: true });
+    await fs6.cp(kitRoot, dest, { recursive: true, force: true });
+  } finally {
+    await fs6.rm(tmp, { recursive: true, force: true });
+  }
+  const identityPath = path6.join(dest, "src", "appIdentity.ts");
+  const manifestPath = path6.join(dest, "groundfloor.manifest.json");
+  const identity = await fs6.readFile(identityPath, "utf8");
+  await fs6.writeFile(identityPath, stampAppIdentity(identity, slug), "utf8");
+  const manifest = await fs6.readFile(manifestPath, "utf8");
+  await fs6.writeFile(manifestPath, stampManifest(manifest, slug, name), "utf8");
+  const result = {
+    dir: dest,
+    slug,
+    name,
+    kitUrl,
+    next: [
+      `cd ${dest}`,
+      "npm install",
+      `gf apps create --name ${JSON.stringify(name)} --slug ${slug} --kind shell_federated --manifest ./groundfloor.manifest.json`,
+      "npm run release",
+      "gf apps publish --path release.zip"
+    ]
+  };
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`Starter-kit ready in ${dest}
+`);
+  process.stdout.write(`Stamped APP_ID / manifest appId = ${slug}
+`);
+  process.stdout.write(
+    "Do not wrap src/App.tsx in BrowserRouter (DevShell already has one).\n"
+  );
+  process.stdout.write("Next:\n");
+  for (const step of result.next) {
+    process.stdout.write(`  ${step}
+`);
+  }
+}
+
+// src/commands/dataplane.ts
+async function dataplaneStatusCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const status = await getDataplaneStatus(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(status, null, 2)}
+`);
+    return;
+  }
+  const ready = status.service_key_configured ? "configured" : "not configured";
+  process.stdout.write(
+    `Dataplane ${ready}${status.dataplane_tenant_id ? `  tenant ${status.dataplane_tenant_id}` : ""}
+`
+  );
+}
+async function dataplaneProvisionCommand(opts) {
+  const cfg = await requireWorkspace(opts.workspace);
+  const result = await provisionDataplane(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  if (result.created) {
+    process.stdout.write("Dataplane provisioned for this workspace.\n");
+    if (result.api_key) {
+      process.stderr.write(
+        "A service key was minted into workspace secrets. It is not printed again.\n"
+      );
+    }
+  } else {
+    process.stdout.write("Dataplane already configured for this workspace.\n");
+  }
+}
+
 // src/index.ts
 function collect(value, previous) {
   return previous.concat([value]);
@@ -1285,9 +2273,14 @@ function run(fn) {
 }
 var program = new Command();
 program.name("gf").description(
-  "Groundfloor CLI \u2014 log in to the Control Plane and reuse the session during local development."
-).version("0.1.0");
-program.command("login").description("Log in via the browser (or --device) and cache the session").option("--issuer <url>", "Identity provider issuer URL").option("--client-id <id>", "OIDC client id").option("--api-url <url>", "Control Plane base URL").option("--device", "Use the device-code flow (headless / no local browser)").option(
+  "Groundfloor CLI \u2014 sign in, deploy coderunners, publish Shell apps, and manage workspace resources."
+).version("0.1.1");
+program.command("login").description(
+  "Log in via the browser (production by default; --dev / --stage for other cells)"
+).option("--dev", "Sign in to Groundfloor dev").option("--stage", "Sign in to Groundfloor stage").option(
+  "--env <name>",
+  "Cell to sign in to: production (default), stage, or dev"
+).option("--issuer <url>", "Identity provider issuer URL").option("--client-id <id>", "OIDC client id").option("--api-url <url>", "Control Plane base URL").option("--device", "Use the device-code flow (headless / no local browser)").option(
   "--redirect-host <host>",
   "Loopback host for the redirect URI (default 127.0.0.1; try localhost)"
 ).option(
@@ -1325,8 +2318,75 @@ domains.command("rm <domain>").alias("remove").description("Remove a custom doma
 domains.command("verify <domain>").description("Re-check the DNS records for a custom domain").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action(
   (domain, opts) => run(() => domainsVerifyCommand(domain, opts))
 );
+var secrets = program.command("secrets").description("Manage workspace secrets");
+secrets.command("ls").alias("list").description("List secret keys (values are not shown)").option("-w, --workspace <id>", "Workspace id override").option("-e, --environment <id>", "Environment id").option("--json", "Output raw JSON").action((opts) => run(() => secretsListCommand(opts)));
+secrets.command("get <key>").description("Print a secret value").option("-w, --workspace <id>", "Workspace id override").option("-e, --environment <id>", "Environment id").option("--json", "Output raw JSON").action((key, opts) => run(() => secretsGetCommand(key, opts)));
+secrets.command("set <key> [value]").description("Create or update a secret (pass - to read the value from stdin)").option("-w, --workspace <id>", "Workspace id override").option("-e, --environment <id>", "Environment id").option("--description <text>", "Optional description").action(
+  (key, value, opts) => run(() => secretsSetCommand(key, value, opts))
+);
+secrets.command("rm <key>").alias("delete").description("Delete a secret").option("-w, --workspace <id>", "Workspace id override").option("-e, --environment <id>", "Environment id").action((key, opts) => run(() => secretsRmCommand(key, opts)));
+var files = program.command("files").description("Manage workspace files");
+files.command("ls").alias("list").description("List files").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => filesListCommand(opts)));
+files.command("upload <path>").description("Upload a local file").option("-w, --workspace <id>", "Workspace id override").option("-n, --name <name>", "Display name (default: basename)").action(
+  (filePath, opts) => run(() => filesUploadCommand(filePath, opts))
+);
+files.command("download <fileId>").description("Download a file").option("-w, --workspace <id>", "Workspace id override").option("-o, --out <path>", "Output path").action(
+  (fileId, opts) => run(() => filesDownloadCommand(fileId, opts))
+);
+files.command("rm <fileId>").alias("delete").description("Delete a file").option("-w, --workspace <id>", "Workspace id override").action((fileId, opts) => run(() => filesRmCommand(fileId, opts)));
+var apps = program.command("apps").description(
+  "Product apps (Shell federated / standalone) \u2014 init, create, list, publish"
+);
+apps.command("ls").alias("list").description("List apps").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => appsListCommand(opts)));
+apps.command("get <appId>").description("Show one app (id or slug)").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((appId, opts) => run(() => appsGetCommand(appId, opts)));
+apps.command("init").description(
+  "Download the official Shell starter-kit and stamp APP_ID / manifest appId"
+).requiredOption(
+  "--slug <slug>",
+  "Portal app slug (written to APP_ID and groundfloor.manifest.json appId)"
+).option("-n, --name <name>", "Display name (default: title-cased slug)").option(
+  "-d, --dir <path>",
+  "Destination directory (default: ./<slug>)"
+).option("--kit-url <url>", "Override starter-kit ZIP URL").option("--force", "Overwrite an existing destination directory").option("--json", "Output raw JSON").argument("[dir]", "Destination directory (same as --dir)").action(
+  (dir, opts) => run(
+    () => appsInitCommand({
+      slug: opts.slug,
+      name: opts.name,
+      dir: opts.dir || dir,
+      kitUrl: opts.kitUrl,
+      force: opts.force,
+      json: opts.json
+    })
+  )
+);
+apps.command("create").description("Register a Shell federated or standalone product app").option("-w, --workspace <id>", "Workspace id override").option("-n, --name <name>", "Display name").option("--slug <slug>", "URL-safe slug (unique in the workspace)").option(
+  "--kind <kind>",
+  "shell_federated (default) or standalone",
+  "shell_federated"
+).option(
+  "--primary-coderunner <id>",
+  "Required for --kind standalone: existing service coderunner id"
+).option("-e, --environment <id>", "Environment id to bind").option(
+  "--manifest <path>",
+  "Path to groundfloor.manifest.json (Shell apps)"
+).option("--json", "Output raw JSON").action((opts) => run(() => appsCreateCommand(opts)));
+apps.command("publish [appId]").description(
+  "Upload release.zip (or remoteEntry.js) and publish a Shell app"
+).option("-w, --workspace <id>", "Workspace id override").option("--app <id|slug>", "App id or slug (else manifest appId)").option(
+  "-p, --path <file>",
+  "release.zip, remoteEntry.js, or a folder containing release.zip",
+  "release.zip"
+).option("-m, --label <text>", "Optional release label").option(
+  "--no-sync-manifest",
+  "Do not PATCH the Portal manifest from groundfloor.manifest.json"
+).option("--json", "Output raw JSON").action(
+  (appId, opts) => run(() => appsPublishCommand(appId, opts))
+);
+var dataplane = program.command("dataplane").description("Workspace Dataplane setup (required for vault, files, secrets)");
+dataplane.command("status").description("Show Dataplane setup status").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => dataplaneStatusCommand(opts)));
+dataplane.command("provision").description("Provision Dataplane for this workspace (idempotent)").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => dataplaneProvisionCommand(opts)));
 program.command("deploy").description(
-  "Package code (local folder or --git repo) and deploy as a standalone coderunner (D-061; not an App)"
+  "Package code and deploy as a coderunner (not an App)"
 ).option("-w, --workspace <id>", "Workspace id override").option("--api-url <url>", "Control Plane base URL").option(
   "-c, --coderunner <id>",
   "Deploy into an existing coderunner id (skip find/create)"