@groundfloorcloud/cli 0.1.8 → 0.1.10

package/README.md

@@ -63,8 +63,10 @@ Do not create an App just to run a function, job, schedule, or service
 (Deployment). Use `gf deploy`. Bind `--app-id` only when the coderunner should
 be a helper of an existing product App.
 
-**Before the first create:** enable workspace Authentication (Administer →
-Authentication, mode `groundfloor` or `external`) until the realm is active.
+**App authentication is optional.** Team **write** can create Coderunners
+when mode is None. For Vault and Files from the workload, attach an M2M
+client (Administer → M2M tokens) and use `gf m2m token` — not a Dataplane
+key. `gf coderunner vault-token` is deprecated.
 
 ### Workload types
 
@@ -104,11 +106,16 @@ port 8080). Add `"scripts": { "start": "node index.js" }` and bind
 eval "$(gf env)"
 export PORT=8080
 npm start
+# files/secrets / operator Vault (builder token):
 curl -sS -H "Authorization: Bearer $(gf token)" \
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/files"
+# M2M (Coderunner / CI — not gf token):
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \
   "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
 ```
 
-Then `gf deploy` the same tree. Do not zip `.env` files.
+Then `gf deploy` the same tree. Do not zip `.env` files. `gf token` is the
+wrong identity for testing Coderunner Vault/Files as the workload.
 
 ### `groundfloor.json`
 
@@ -132,7 +139,7 @@ Then `gf deploy` the same tree. Do not zip `.env` files.
 | `-p, --path <dir>` | Directory to package (default: cwd). |
 | `--git <url>` / `--ref <ref>` | Clone and deploy a remote repo. |
 | `--subdir <dir>` | Package a subdirectory of the source. |
-| `--runtime <r>` | `python` \| `node` \| `dotnet-script`. |
+| `--runtime <r>` | Language slug from `GET …/coderunners/languages` (`node`, `python`, `go`, `dotnet`, `dotnet-script`, …). |
 | `--workload-type <t>` | `function` \| `service` (Deployment) \| `job` \| `schedule`. Service requires a Dockerfile. |
 | `--schedule <cron>` | Cron for `schedule` workloads (or `groundfloor.json` `schedule`). |
 | `--cpu` / `--memory` | Resource requests, e.g. `250m` / `256Mi`. |
@@ -140,6 +147,25 @@ Then `gf deploy` the same tree. Do not zip `.env` files.
 | `-m, --message <text>` | Version description. |
 | `--skip-deploy` | Upload a new version but do not deploy it. |
 
+### What is never uploaded
+
+`gf deploy` drops credential files from the package on **both** paths — the
+plain-directory walk and the git file list (which includes untracked files that
+no `.gitignore` rule covers). Excluded by name: `.env*`, `.npmrc`, `.yarnrc*`,
+`.netrc`/`_netrc`, `.pypirc`, `.git-credentials`, `.htpasswd`, `.pgpass`,
+`.s3cfg`, `id_rsa`/`id_dsa`/`id_ecdsa`/`id_ed25519` (but not their `.pub`
+halves), `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.jks`, `*.keystore`, `*.ppk`,
+`*.kdbx`, `*.gpg`, `*.tfstate*`, and anything under `.ssh/`, `.aws/`, `.azure/`,
+`.gcloud/`, `.gnupg/`, `.docker/`, `.kube/`, `.terraform/` or `.chef/`.
+
+Every exclusion is printed, and so is every dot-file that survived the filter.
+There is no flag to turn it off: pass values with `gf secrets` or
+`-e KEY=VALUE` instead.
+
+This is a **denylist**, so it only knows names. A secret in a file called
+`config.json`, `settings.py` or `serviceAccount.json` is still uploaded —
+check what the packaged file list says before deploying.
+
 ## Publish a Shell app
 
 Product **Apps** are packaging (Shell Module Federation remotes, or a
@@ -163,10 +189,11 @@ gf apps publish --path release.zip
 `APP_ID` / `groundfloor.manifest.json` `appId` to the slug.
 
 `gf apps publish` uploads **only** `release.zip` from `npm run release`.
-It flattens a Vite `dist/assets/` layout when needed, then **rejects** a zip
-that is only `remoteEntry.js` (missing `__federation_*.js` / CSS) or whose
-federation `name` does not match `federationRemoteName(slug)`. A lone
-`.js` file is also rejected. Pass an app id/slug, or set `appId` in
+It flattens a Vite `dist/assets/` layout when needed, rewrites `./assets/`
+imports in `remoteEntry.js`, then **rejects** a zip that is only
+`remoteEntry.js` (missing `__federation_*.js` / CSS) or whose federation
+`name` does not match `federationRemoteName(slug)`. A lone `.js` file is
+also rejected. Pass an app id/slug, or set `appId` in
 `groundfloor.manifest.json` next to the zip.
 
 Wrap an existing **service** coderunner as a product:
@@ -215,6 +242,8 @@ gf apps get <id|slug>
 | `gf coderunner logs -c <id\|slug>` | Process Log (stdout/stderr). Also printed automatically on `gf deploy` failure. |
 | `gf coderunner cancel-deployment -c <id\|slug>` | Delete the current (or `--deployment-id`) deployment. |
 | `gf coderunner run -c <id\|slug> [--payload '{}']` | Invoke a deployed function or job. |
+| `gf m2m token` | Print a short Control Plane JWT from M2M client_id + secret. Not `gf token`. |
+| `gf coderunner vault-token` | **Deprecated.** Use `gf m2m token`. |
 | `gf deploy` | Package code and deploy as a coderunner. |
 | `gf domains ls\|add\|rm\|verify -c <id\|slug>` | Custom domains for a service. |
 | `gf secrets ls\|get\|set\|rm` | Workspace secrets. |

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
-import path9 from "path";
+import path10 from "path";
 
 // src/auth/store.ts
 import { promises as fs } from "fs";
@@ -526,18 +526,38 @@ var CpError = class extends Error {
   }
   status;
 };
+function formatCpErrorDetail(detail, fallback) {
+  if (typeof detail === "string" && detail.trim()) return detail.trim();
+  if (detail && typeof detail === "object") {
+    const obj = detail;
+    if (typeof obj.message === "string" && obj.message.trim()) {
+      return obj.message.trim();
+    }
+    if (typeof obj.detail === "string" && obj.detail.trim()) {
+      return obj.detail.trim();
+    }
+    try {
+      return JSON.stringify(detail);
+    } catch {
+      return fallback;
+    }
+  }
+  return fallback;
+}
 async function parseError(res) {
   let detail = res.statusText;
   try {
     const body = await res.json();
-    if (body?.detail) detail = String(body.detail);
+    if (body?.detail !== void 0) {
+      detail = formatCpErrorDetail(body.detail, res.statusText);
+    }
   } catch {
   }
   return `${res.status} ${detail}`;
 }
-async function cpGet(apiUrl, path10) {
+async function cpGet(apiUrl, path11) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/json"
@@ -548,9 +568,9 @@ async function cpGet(apiUrl, path10) {
   }
   return await res.json();
 }
-async function cpPostJson(apiUrl, path10, body) {
+async function cpPostJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -564,9 +584,9 @@ async function cpPostJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpDelete(apiUrl, path10) {
+async function cpDelete(apiUrl, path11) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "DELETE",
     headers: { Authorization: `Bearer ${token}`, Accept: "application/json" }
   });
@@ -574,9 +594,9 @@ async function cpDelete(apiUrl, path10) {
     throw new CpError(res.status, await parseError(res));
   }
 }
-async function cpPutJson(apiUrl, path10, body) {
+async function cpPutJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -590,9 +610,9 @@ async function cpPutJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpPatchJson(apiUrl, path10, body) {
+async function cpPatchJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PATCH",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -606,9 +626,9 @@ async function cpPatchJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpPutBytes(apiUrl, path10, body, contentType) {
+async function cpPutBytes(apiUrl, path11, body, contentType) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -640,6 +660,13 @@ async function listCoderunners(apiUrl, workspaceId) {
   if (Array.isArray(data)) return data;
   return data.coderunners ?? [];
 }
+async function listCoderunnerLanguages(apiUrl, workspaceId) {
+  const data = await cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/coderunners/languages`
+  );
+  return data.languages ?? [];
+}
 function createCoderunner(apiUrl, workspaceId, payload) {
   return cpPostJson(
     apiUrl,
@@ -733,13 +760,13 @@ function getCoderunnerStatus(apiUrl, workspaceId, coderunnerId) {
     )}/coderunners/${encodeURIComponent(coderunnerId)}/status`
   );
 }
-function runCoderunner(apiUrl, workspaceId, coderunnerId, payload) {
+function runCoderunner(apiUrl, workspaceId, coderunnerId, event = {}) {
   return cpPostJson(
     apiUrl,
     `/v1/workspaces/${encodeURIComponent(
       workspaceId
     )}/coderunners/${encodeURIComponent(coderunnerId)}/run`,
-    payload
+    event
   );
 }
 function getProcessLogs(apiUrl, workspaceId, query = {}) {
@@ -915,6 +942,69 @@ function provisionDataplane(apiUrl, workspaceId) {
     {}
   );
 }
+async function mintM2mToken(apiUrl, workspaceId, clientId, clientSecret) {
+  const res = await fetch(
+    `${apiUrl}${wsPath(workspaceId, "/m2m/token")}`,
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: clientId,
+        client_secret: clientSecret
+      })
+    }
+  );
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+function mintCoderunnerVaultToken(apiUrl, workspaceId, coderunnerId, body = {}) {
+  return cpPostJson(
+    apiUrl,
+    `${wsPath(workspaceId, `/coderunners/${encodeURIComponent(coderunnerId)}/vault-token`)}`,
+    body
+  );
+}
+async function listWorkloadIdentities(apiUrl, workspaceId) {
+  const data = await cpGet(
+    apiUrl,
+    wsPath(workspaceId, "/workload-identities")
+  );
+  return data.identities ?? [];
+}
+function mintWorkloadIdentityVaultToken(apiUrl, workspaceId, identityId, body = {}) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(
+      workspaceId,
+      `/workload-identities/${encodeURIComponent(identityId)}/vault-token`
+    ),
+    body
+  );
+}
+async function controlPlaneRequest(apiUrl, method, path11, body) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path11}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    body: body !== void 0 ? JSON.stringify(body) : void 0
+  });
+  if (res.status === 204) return void 0;
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  const text = await res.text();
+  if (!text) return void 0;
+  return JSON.parse(text);
+}
 
 // src/commands/whoami.ts
 async function whoamiCommand() {
@@ -1028,7 +1118,8 @@ async function coderunnerListCommand(opts) {
   for (const cr of coderunners) {
     const name = cr.name ?? cr.slug ?? "";
     const status = cr.status ?? "";
-    process.stdout.write(`${cr.id}  ${name}  [${status}]
+    const type = cr.workload_type ?? "function";
+    process.stdout.write(`${cr.id}  ${name}  [${type}]  [${status}]
 `);
   }
 }
@@ -1043,6 +1134,81 @@ async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
   return match.id;
 }
 
+// src/commands/vault-token.ts
+async function vaultTokenCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const coderunnerId = await resolveCoderunnerId(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.coderunner
+  );
+  const data = await mintCoderunnerVaultToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    coderunnerId
+  );
+  process.stderr.write(
+    "gf coderunner vault-token is deprecated. Attach an M2M client and use gf m2m token.\n"
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.refresh_secret) {
+    process.stderr.write(
+      "Save refresh_secret now; it is not shown again unless you rotate.\n"
+    );
+    process.stderr.write(`refresh_secret=${data.refresh_secret}
+`);
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s identity=${data.workload_identity_id}
+`
+  );
+  process.stdout.write(`${data.token}
+`);
+}
+
+// src/commands/m2m-token.ts
+async function m2mTokenCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const clientId = opts.clientId ?? process.env.GROUNDFLOOR_M2M_CLIENT_ID ?? "";
+  const clientSecret = opts.clientSecret ?? process.env.GROUNDFLOOR_M2M_CLIENT_SECRET ?? "";
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      "Set GROUNDFLOOR_M2M_CLIENT_ID and GROUNDFLOOR_M2M_CLIENT_SECRET, or pass --client-id and --client-secret."
+    );
+  }
+  const data = await mintM2mToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    clientId,
+    clientSecret
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s client=${data.m2m_client_id}
+`
+  );
+  process.stdout.write(`${data.access_token}
+`);
+}
+
 // src/commands/cancel-deployment.ts
 async function cancelDeploymentCommand(opts) {
   const cfg = await resolveConfig({ workspaceId: opts.workspace });
@@ -1277,13 +1443,13 @@ portal: ${processLogPortalUrl(
 
 // src/commands/deploy.ts
 import { promises as fs4 } from "fs";
-import path4 from "path";
+import path5 from "path";
 
 // src/deploy/package.ts
 import { execFile } from "child_process";
 import { promises as fs2 } from "fs";
 import os2 from "os";
-import path2 from "path";
+import path3 from "path";
 import { promisify } from "util";
 import AdmZip from "adm-zip";
 
@@ -1292,6 +1458,109 @@ function isGitCommitSha(ref) {
   return /^[0-9a-f]{7,40}$/i.test(ref);
 }
 
+// src/deploy/secret-files.ts
+import path2 from "path";
+var DENIED_NAMES = /* @__PURE__ */ new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  ".pypirc",
+  ".git-credentials",
+  ".htpasswd",
+  ".htdigest",
+  ".pgpass",
+  ".dockercfg",
+  ".s3cfg",
+  ".pdbrc",
+  ".envrc",
+  ".my.cnf",
+  "my.cnf",
+  ".boto",
+  ".databrickscfg",
+  "kubeconfig",
+  "kube.config",
+  "deploy_key",
+  "deploykey",
+  "credentials",
+  "credentials.json",
+  "credentials.yaml",
+  "credentials.yml",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml"
+]);
+var DENIED_SEGMENTS = /* @__PURE__ */ new Set([
+  ".ssh",
+  ".aws",
+  ".azure",
+  ".gcloud",
+  ".gnupg",
+  ".docker",
+  ".kube",
+  ".terraform",
+  ".chef",
+  ".pki"
+]);
+var DENIED_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".keystore",
+  ".ppk",
+  ".kdbx",
+  ".gpg",
+  ".tfstate",
+  ".tfvars"
+]);
+var SSH_PRIVATE_KEY_RE = /^id_(rsa|dsa|ecdsa|ed25519)(_[\w.-]+)?$/;
+var BACKUP_SUFFIX_RE = /(~|\.(bak|old|orig|save|backup|swp|swo|tmp|copy))$/;
+function normaliseName(name) {
+  let out = name.toLowerCase();
+  for (let i = 0; i < 8; i++) {
+    const next = out.replace(BACKUP_SUFFIX_RE, "");
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+function isCredentialFile(relPath) {
+  const parts = relPath.split("/").filter(Boolean);
+  const rawName = parts[parts.length - 1] ?? "";
+  const name = normaliseName(rawName);
+  for (const segment of parts.slice(0, -1)) {
+    if (DENIED_SEGMENTS.has(segment.toLowerCase())) return true;
+  }
+  if (DENIED_SEGMENTS.has(name)) return true;
+  if (name === ".env" || name.startsWith(".env.")) return true;
+  if (DENIED_NAMES.has(name)) return true;
+  if (SSH_PRIVATE_KEY_RE.test(name)) return true;
+  if (name.endsWith(".tfvars.json") || name.endsWith(".tfstate.json")) {
+    return true;
+  }
+  if (DENIED_EXTENSIONS.has(path2.extname(name))) return true;
+  return false;
+}
+function isDotPath(relPath) {
+  return relPath.split("/").some((part) => part.startsWith("."));
+}
+function filterCredentialFiles(files2) {
+  const kept = [];
+  const excluded = [];
+  for (const rel of files2) {
+    if (isCredentialFile(rel)) excluded.push(rel);
+    else kept.push(rel);
+  }
+  return {
+    kept,
+    excluded: excluded.sort(),
+    dotfilesIncluded: kept.filter(isDotPath).sort()
+  };
+}
+
 // src/deploy/package.ts
 var exec = promisify(execFile);
 var DEFAULT_IGNORES = /* @__PURE__ */ new Set([
@@ -1331,7 +1600,7 @@ async function walkFileList(dir) {
     const entries = await fs2.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
       if (DEFAULT_IGNORES.has(entry.name)) continue;
-      const abs = path2.join(current, entry.name);
+      const abs = path3.join(current, entry.name);
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         await walk(abs, relPath);
@@ -1346,17 +1615,17 @@ async function walkFileList(dir) {
 async function buildZip(sourceDir, files2) {
   const zip = new AdmZip();
   for (const rel of files2) {
-    const abs = path2.join(sourceDir, rel);
+    const abs = path3.join(sourceDir, rel);
     try {
       const data = await fs2.readFile(abs);
-      zip.addFile(rel.split(path2.sep).join("/"), data);
+      zip.addFile(rel.split(path3.sep).join("/"), data);
     } catch {
     }
   }
   return zip.toBuffer();
 }
 async function cloneRepo(url, ref) {
-  const tmp = await fs2.mkdtemp(path2.join(os2.tmpdir(), "gf-deploy-"));
+  const tmp = await fs2.mkdtemp(path3.join(os2.tmpdir(), "gf-deploy-"));
   try {
     if (ref && isGitCommitSha(ref)) {
       await exec("git", ["init"], { cwd: tmp });
@@ -1387,16 +1656,27 @@ async function packageSource(opts) {
     baseDir = await cloneRepo(opts.git, opts.ref);
     cleanup = baseDir;
   } else {
-    baseDir = path2.resolve(opts.path ?? process.cwd());
+    baseDir = path3.resolve(opts.path ?? process.cwd());
+  }
+  const sourceDir = opts.subdir ? path3.resolve(baseDir, opts.subdir) : baseDir;
+  if (sourceDir !== baseDir && !sourceDir.startsWith(baseDir + path3.sep)) {
+    if (cleanup) {
+      await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
+      });
+    }
+    throw new Error(
+      `--subdir "${opts.subdir}" resolves to ${sourceDir}, outside ${baseDir}.`
+    );
   }
-  const sourceDir = opts.subdir ? path2.join(baseDir, opts.subdir) : baseDir;
   try {
     const stat = await fs2.stat(sourceDir);
     if (!stat.isDirectory()) {
       throw new Error(`Not a directory: ${sourceDir}`);
     }
     const useGit = await isGitRepo(sourceDir);
-    const files2 = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    const listed = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    const filtered = filterCredentialFiles(listed);
+    const files2 = filtered.kept;
     if (files2.length === 0) {
       throw new Error(
         `No files to package in ${sourceDir} (everything ignored or empty).`
@@ -1413,7 +1693,14 @@ async function packageSource(opts) {
         gitSha = null;
       }
     }
-    return { zip, fileCount: files2.length, sourceDir, cleanup, gitSha };
+    return {
+      zip,
+      fileCount: files2.length,
+      sourceDir,
+      cleanup,
+      gitSha,
+      filtered
+    };
   } catch (err) {
     if (cleanup) {
       await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
@@ -1424,7 +1711,7 @@ async function packageSource(opts) {
 }
 async function readProjectManifest(dir) {
   try {
-    const raw = await fs2.readFile(path2.join(dir, "groundfloor.json"), "utf8");
+    const raw = await fs2.readFile(path3.join(dir, "groundfloor.json"), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1433,7 +1720,7 @@ async function readProjectManifest(dir) {
 async function detectRuntime(dir) {
   const has = async (name) => {
     try {
-      await fs2.access(path2.join(dir, name));
+      await fs2.access(path3.join(dir, name));
       return true;
     } catch {
       return false;
@@ -1447,7 +1734,7 @@ async function detectRuntime(dir) {
 
 // src/deploy/preflight.ts
 import { promises as fs3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 var NODE_BOOTSTRAP_MISSING_START = 'Node packages without a Dockerfile use the platform bootstrap image (CMD ["npm","start"], EXPOSE 8080). Add package.json "scripts": { "start": "node <entrypoint>" }. The process must listen on process.env.PORT || 8080 and bind 0.0.0.0 (not 127.0.0.1).';
 var NODE_BOOTSTRAP_MISSING_PACKAGE = 'Node packages without a Dockerfile need package.json with "scripts.start" (bootstrap image runs `npm start` and probes 0.0.0.0:8080).';
 var NODE_DOCKERFILE_NPM_START_MISSING = 'Dockerfile runs `npm start` but package.json has no "scripts.start". Add "scripts": { "start": "node <entrypoint>" }.';
@@ -1462,10 +1749,10 @@ async function readOptional(filePath) {
   }
 }
 async function preflightNodePackage(sourceDir) {
-  const dockerfile = await readOptional(path3.join(sourceDir, "Dockerfile"));
+  const dockerfile = await readOptional(path4.join(sourceDir, "Dockerfile"));
   const needsStartScript = dockerfile == null || dockerfileRunsNpmStart(dockerfile);
   if (!needsStartScript) return;
-  const raw = await readOptional(path3.join(sourceDir, "package.json"));
+  const raw = await readOptional(path4.join(sourceDir, "package.json"));
   if (raw == null) {
     throw new Error(
       dockerfile == null ? NODE_BOOTSTRAP_MISSING_PACKAGE : NODE_DOCKERFILE_NPM_START_MISSING
@@ -1508,8 +1795,53 @@ function formatDeployTarget(input) {
   return `Deploy target: workspace=${label} cell=${cell} api=${input.apiUrl}`;
 }
 
+// src/credential-env.ts
+var CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DATABASE_URI",
+  "DATABASE_PASSWORD",
+  "DATABASE_USER",
+  "DATABASE_USERNAME",
+  "DB_URL",
+  "DB_URI",
+  "POSTGRES_URL",
+  "POSTGRES_URI",
+  "POSTGRES_PASSWORD",
+  "POSTGRES_USER",
+  "MYSQL_URL",
+  "MYSQL_PASSWORD",
+  "MONGO_URI",
+  "MONGODB_URI",
+  "MONGODB_URL"
+]);
+var CREDENTIAL_SUFFIXES = [
+  "_PASSWORD",
+  "_SECRET",
+  "_PRIVATE_KEY",
+  "_API_KEY",
+  "_ACCESS_KEY",
+  "_SECRET_KEY"
+];
+function isCredentialEnvKey(key) {
+  const cleaned = key.trim();
+  if (!cleaned) return false;
+  const upper = cleaned.toUpperCase();
+  if (CREDENTIAL_KEYS.has(upper)) return true;
+  if (upper.startsWith("MANAGED_DB_")) return true;
+  return CREDENTIAL_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+function credentialEnvKeys(env) {
+  return Object.keys(env).filter((key) => isCredentialEnvKey(key)).sort();
+}
+
 // src/commands/deploy.ts
-var RUNTIMES = /* @__PURE__ */ new Set(["python", "node", "dotnet-script"]);
+var FALLBACK_RUNTIMES = /* @__PURE__ */ new Set([
+  "python",
+  "node",
+  "go",
+  "dotnet",
+  "dotnet-script"
+]);
 var WORKLOAD_TYPES = /* @__PURE__ */ new Set(["function", "service", "job", "schedule"]);
 var VERSION_POLL_INTERVAL_MS = 2e3;
 var VERSION_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
@@ -1537,6 +1869,22 @@ function parseEnvPairs(pairs) {
 }
 var log = (msg) => process.stderr.write(`${msg}
 `);
+function names(list, max = 10) {
+  return list.length > max ? `${list.slice(0, max).join(", ")} \u2026 and ${list.length - max} more` : list.join(", ");
+}
+function reportFiltering(filtered) {
+  if (filtered.excluded.length) {
+    log(
+      `Excluded ${filtered.excluded.length} credential file(s): ${names(filtered.excluded)}`
+    );
+    log("  (use `gf secrets` or `--env KEY=VALUE` to pass values to the app)");
+  }
+  if (filtered.dotfilesIncluded.length) {
+    log(
+      `Including ${filtered.dotfilesIncluded.length} dot-file(s): ${names(filtered.dotfilesIncluded)}`
+    );
+  }
+}
 async function failDeploy(opts) {
   throw new Error(await diagnoseDeployFailure(opts));
 }
@@ -1566,7 +1914,7 @@ async function deployCommand(opts) {
     })
   );
   log(
-    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path4.resolve(opts.path ?? process.cwd())}...`
+    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path5.resolve(opts.path ?? process.cwd())}...`
   );
   const pkg = await packageSource({
     path: opts.path,
@@ -1578,11 +1926,20 @@ async function deployCommand(opts) {
     const manifest = await readProjectManifest(pkg.sourceDir) ?? {};
     const sizeKb = (pkg.zip.byteLength / 1024).toFixed(1);
     log(`Packaged ${pkg.fileCount} file(s), ${sizeKb} KB`);
+    reportFiltering(pkg.filtered);
     const detected = await detectRuntime(pkg.sourceDir);
     const runtime = opts.runtime ?? manifest.runtime ?? detected ?? "python";
-    if (!RUNTIMES.has(runtime)) {
+    let allowedRuntimes = FALLBACK_RUNTIMES;
+    try {
+      const catalog = await listCoderunnerLanguages(cfg.apiUrl, ws);
+      if (catalog.length > 0) {
+        allowedRuntimes = new Set(catalog.map((item) => item.runtime));
+      }
+    } catch {
+    }
+    if (!allowedRuntimes.has(runtime)) {
       throw new Error(
-        `Invalid runtime "${runtime}" (expected: ${[...RUNTIMES].join(", ")}).`
+        `Invalid runtime "${runtime}" (expected: ${[...allowedRuntimes].join(", ")}).`
       );
     }
     const workloadType = opts.workloadType ?? manifest.workloadType ?? manifest.workload_type ?? "function";
@@ -1593,7 +1950,7 @@ async function deployCommand(opts) {
     }
     if (workloadType === "service") {
       try {
-        await fs4.access(path4.join(pkg.sourceDir, "Dockerfile"));
+        await fs4.access(path5.join(pkg.sourceDir, "Dockerfile"));
       } catch {
         throw new Error(
           'workload type "service" (also called Deployment) requires a Dockerfile at the project root.'
@@ -1610,7 +1967,7 @@ async function deployCommand(opts) {
     });
     let coderunnerId = opts.coderunner;
     if (!coderunnerId) {
-      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path4.basename(path4.resolve(opts.path ?? process.cwd())));
+      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path5.basename(path5.resolve(opts.path ?? process.cwd())));
       const slug = manifest.slug ?? slugify(name);
       const existing = await listCoderunners(cfg.apiUrl, ws);
       const match = existing.find((c) => c.slug === slug || c.name === name);
@@ -1624,7 +1981,8 @@ async function deployCommand(opts) {
           slug,
           runtime,
           workload_type: workloadType,
-          ...opts.appId ? { app_id: opts.appId } : {}
+          ...opts.appId ? { app_id: opts.appId } : {},
+          ...schedule ? { schedule } : {}
         });
         coderunnerId = created.id;
         log(`Created coderunner ${created.id}`);
@@ -1704,13 +2062,21 @@ async function deployCommand(opts) {
       ...manifest.env ?? {},
       ...parseEnvPairs(opts.env)
     };
+    const plaintextSecrets = credentialEnvKeys(envVariable);
+    if (plaintextSecrets.length) {
+      throw new Error(
+        `Do not pass secrets as --env: ${plaintextSecrets.join(", ")}. Store them with \`gf secrets set KEY\` and deploy with \`--secret KEY\`.`
+      );
+    }
+    const injectSecretKeys = (opts.secret ?? []).map((key) => key.trim()).filter(Boolean);
     log("Deploying...");
     const result = await deployCoderunner(cfg.apiUrl, ws, coderunnerId, {
       version_id: uploaded.version_id,
       cpu: opts.cpu ?? manifest.cpu,
       memory: opts.memory ?? manifest.memory,
       envVariable: Object.keys(envVariable).length ? envVariable : void 0,
-      schedule
+      schedule,
+      inject_secret_keys: injectSecretKeys.length ? injectSecretKeys : void 0
     });
     log("Waiting for deployment...");
     const deployDeadline = Date.now() + DEPLOY_POLL_TIMEOUT_MS;
@@ -1802,9 +2168,12 @@ async function runCommand(opts) {
     cfg.workspaceId,
     opts.coderunner
   );
-  const result = await runCoderunner(cfg.apiUrl, cfg.workspaceId, coderunnerId, {
+  const result = await runCoderunner(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    coderunnerId,
     payload
-  });
+  );
   if (opts.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
@@ -1832,7 +2201,29 @@ async function statusCommand(opts) {
     getDeployment(cfg.apiUrl, cfg.workspaceId, coderunnerId)
   ]);
   const out = { coderunner_id: coderunnerId, status, deployment };
-  process.stdout.write(`${JSON.stringify(out, null, 2)}
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(out, null, 2)}
+`);
+    return;
+  }
+  const state = status && typeof status === "object" ? status.state : void 0;
+  const type = String(state?.workload_type ?? "function");
+  const schedule = state?.schedule ? String(state.schedule) : "\u2014";
+  const lastJob = state?.last_job_name ? `${state.last_job_name} (${state.last_job_status ?? "?"})` : "\u2014";
+  process.stdout.write(`coderunner:  ${coderunnerId}
+`);
+  process.stdout.write(`type:        ${type}
+`);
+  process.stdout.write(`schedule:    ${schedule}
+`);
+  process.stdout.write(`last_job:    ${lastJob}
+`);
+  if (deployment?.status != null) {
+    process.stdout.write(`deployment:  ${deployment.id ?? "\u2014"} [${deployment.status}]
+`);
+  }
+  process.stdout.write(`
+${JSON.stringify(out, null, 2)}
 `);
 }
 
@@ -2006,9 +2397,9 @@ async function secretsRmCommand(key, opts) {
 
 // src/commands/files.ts
 import { promises as fs5 } from "fs";
-import path5 from "path";
+import path6 from "path";
 function guessContentType(filename) {
-  const ext = path5.extname(filename).toLowerCase();
+  const ext = path6.extname(filename).toLowerCase();
   const types = {
     ".json": "application/json",
     ".txt": "text/plain",
@@ -2043,9 +2434,9 @@ async function filesListCommand(opts) {
 }
 async function filesUploadCommand(filePath, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const resolved = path5.resolve(filePath);
+  const resolved = path6.resolve(filePath);
   const buf = await fs5.readFile(resolved);
-  const name = opts.name ?? path5.basename(resolved);
+  const name = opts.name ?? path6.basename(resolved);
   const contentType = guessContentType(name);
   const init = await initFileUpload(cfg.apiUrl, cfg.workspaceId, {
     name,
@@ -2082,7 +2473,7 @@ async function filesDownloadCommand(fileId, opts) {
     throw new Error(`Download failed: ${res.status} ${res.statusText}`);
   }
   const buf = Buffer.from(await res.arrayBuffer());
-  const dest = path5.resolve(opts.out ?? fileId);
+  const dest = path6.resolve(opts.out ?? fileId);
   await fs5.writeFile(dest, buf);
   process.stdout.write(`Wrote ${dest}
 `);
@@ -2096,12 +2487,16 @@ async function filesRmCommand(fileId, opts) {
 
 // src/commands/apps.ts
 import { promises as fs6 } from "fs";
-import path6 from "path";
+import path7 from "path";
 
 // src/release-zip.ts
 import AdmZip2 from "adm-zip";
 var REMOTE_ENTRY = "remoteEntry.js";
 var FLATTEN_SUFFIXES = [".js", ".mjs", ".cjs", ".css", ".map", ".wasm"];
+var IMPORT_ASSETS = /(__federation_import|import)\((['"])\.\/assets\//g;
+function rewriteRemoteEntryAssetPrefix(source) {
+  return source.replace(IMPORT_ASSETS, "$1($2./");
+}
 function normalizeZipEntryName(filename) {
   return filename.replace(/\\/g, "/").replace(/^\/+/, "");
 }
@@ -2136,8 +2531,8 @@ function flattenFederatedBundlePlan(relpaths) {
   const promoteDirs = /* @__PURE__ */ new Set();
   const entryDir = parentDir(entry);
   if (entryDir) promoteDirs.add(entryDir);
-  for (const path10 of pathset) {
-    const parent = parentDir(path10);
+  for (const path11 of pathset) {
+    const parent = parentDir(path11);
     if (parent === "assets" || parent.endsWith("/assets") && parent.split("/").length - 1 < 2) {
       promoteDirs.add(parent);
     }
@@ -2172,15 +2567,31 @@ function flattenFederatedReleaseZip(bytes) {
   }
   const plan = flattenFederatedBundlePlan(rels);
   const keys = Object.keys(plan);
-  if (keys.length === 0) return bytes;
-  for (const dest of keys) {
-    const src = plan[dest];
-    const source = byNorm.get(src);
-    if (!source) continue;
-    zip.addFile(dest, source.getData());
+  if (keys.length > 0) {
+    for (const dest of keys) {
+      const src = plan[dest];
+      const source = byNorm.get(src);
+      if (!source) continue;
+      zip.addFile(dest, source.getData());
+    }
   }
+  rewriteRemoteEntryInZip(zip);
   return zip.toBuffer();
 }
+function rewriteRemoteEntryInZip(zip) {
+  const names2 = zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+  const entryRel = chooseRemoteEntry(names2);
+  if (!entryRel) return;
+  const zipEntry = zip.getEntries().find((item) => {
+    if (item.isDirectory) return false;
+    return normalizeZipEntryName(item.entryName) === entryRel;
+  });
+  if (!zipEntry) return;
+  const before = zipEntry.getData().toString("utf8");
+  const after = rewriteRemoteEntryAssetPrefix(before);
+  if (after === before) return;
+  zip.updateFile(zipEntry.entryName, Buffer.from(after, "utf8"));
+}
 function federatedReleaseZipHint(slug) {
   return `Run \`npm run release\` in a kit from \`gf apps init\`, then publish that zip (do not zip Vite dist/ or upload only remoteEntry.js). ${initThenPublishHint(slug)}`;
 }
@@ -2193,18 +2604,18 @@ function initThenPublishHint(slug) {
   return `gf apps init --slug ${s} && cd ${s} && npm install && npm run release && gf apps publish --path release.zip`;
 }
 function extractReferencedSiblings(remoteEntrySource) {
-  const names = /* @__PURE__ */ new Set();
+  const names2 = /* @__PURE__ */ new Set();
   for (const match of remoteEntrySource.matchAll(
-    /["']\.\/([^"'/]+\.(?:js|mjs|cjs|css))["']/g
+    /["']\.\/(?:assets\/)?([^"'/]+\.(?:js|mjs|cjs|css))["']/g
   )) {
-    if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
+    if (match[1] !== REMOTE_ENTRY) names2.add(match[1]);
   }
   for (const match of remoteEntrySource.matchAll(
     /["']([A-Za-z0-9._-]+\.css)["']/g
   )) {
-    names.add(match[1]);
+    names2.add(match[1]);
   }
-  return [...names];
+  return [...names2];
 }
 function extractFederationScope(remoteEntrySource) {
   return remoteEntrySource.match(/css__([A-Za-z0-9_-]+)__/)?.[1];
@@ -2223,9 +2634,9 @@ function readZipFile(bytes, rel) {
 }
 function assertFederatedReleaseZip(bytes, slug) {
   const hint = initThenPublishHint(slug);
-  const names = zipRootNames(bytes);
-  const present = new Set(names.map((name) => basename(name)));
-  const entryRel = chooseRemoteEntry(names);
+  const names2 = zipRootNames(bytes);
+  const present = new Set(names2.map((name) => basename(name)));
+  const entryRel = chooseRemoteEntry(names2);
   if (!entryRel) {
     throw new Error(`Zip has no remoteEntry.js. ${hint}`);
   }
@@ -2235,7 +2646,7 @@ function assertFederatedReleaseZip(bytes, slug) {
   }
   const siblings = extractReferencedSiblings(source);
   const missing = siblings.filter((name) => !present.has(name));
-  const jsOrCssAtRoot = names.filter((name) => {
+  const jsOrCssAtRoot = names2.filter((name) => {
     if (name.includes("/")) return false;
     const lower = name.toLowerCase();
     return lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".css");
@@ -2277,11 +2688,11 @@ async function readJsonObject(filePath) {
 }
 async function maybeReadManifest(filePath) {
   if (!filePath) return void 0;
-  return readJsonObject(path6.resolve(filePath));
+  return readJsonObject(path7.resolve(filePath));
 }
 async function findSiblingManifest(bundlePath) {
-  const dir = await isDirectory(bundlePath) ? bundlePath : path6.dirname(bundlePath);
-  const candidate = path6.join(dir, "groundfloor.manifest.json");
+  const dir = await isDirectory(bundlePath) ? bundlePath : path7.dirname(bundlePath);
+  const candidate = path7.join(dir, "groundfloor.manifest.json");
   try {
     await fs6.access(candidate);
   } catch {
@@ -2439,8 +2850,8 @@ Do not scaffold src/App.tsx from scratch \u2014 BrowserRouter in App.tsx crashes
 }
 async function appsPublishCommand(appRef, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const inputPath = path6.resolve(opts.path ?? "release.zip");
-  const bundlePath = await isDirectory(inputPath) ? path6.join(inputPath, "release.zip") : inputPath;
+  const inputPath = path7.resolve(opts.path ?? "release.zip");
+  const bundlePath = await isDirectory(inputPath) ? path7.join(inputPath, "release.zip") : inputPath;
   let bytes;
   try {
     bytes = await fs6.readFile(bundlePath);
@@ -2470,11 +2881,11 @@ async function appsPublishCommand(appRef, opts) {
       `Releases are only for shell_federated apps (this app is ${app.app_kind}). Use \`gf deploy\` for coderunner workloads.`
     );
   }
-  const ext = path6.extname(bundlePath).toLowerCase();
+  const ext = path7.extname(bundlePath).toLowerCase();
   const isZip = ext === ".zip";
   if (!isZip) {
     throw new Error(
-      `Publish release.zip from \`npm run release\`, not a lone ${path6.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
+      `Publish release.zip from \`npm run release\`, not a lone ${path7.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
     );
   }
   bytes = prepareReleaseZip(bytes, app.slug);
@@ -2487,7 +2898,10 @@ async function appsPublishCommand(appRef, opts) {
   }
   const init = await initAppReleaseUpload(cfg.apiUrl, cfg.workspaceId, app.id, {
     bundle,
-    label: opts.label
+    label: opts.label,
+    // Required since wave 5: the server pins this into the presigned PUT and
+    // checks it against the quota before minting a URL. Omitting it is a 422.
+    size_bytes: bytes.byteLength
   });
   await uploadAppReleaseContent(
     cfg.apiUrl,
@@ -2516,11 +2930,20 @@ async function appsPublishCommand(appRef, opts) {
 // src/commands/apps-init.ts
 import { promises as fs7 } from "fs";
 import os3 from "os";
-import path7 from "path";
+import path8 from "path";
 import AdmZip4 from "adm-zip";
 
 // src/version.ts
-var GF_VERSION = "0.1.8";
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var moduleDir = dirname(fileURLToPath(import.meta.url));
+function readPackageVersion() {
+  const pkgPath = join(moduleDir, "..", "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  return pkg.version;
+}
+var GF_VERSION = readPackageVersion();
 var GF_NPM_PACKAGE = "@groundfloorcloud/cli";
 
 // src/commands/apps-init.ts
@@ -2551,17 +2974,17 @@ async function isEmptyDir(dir) {
 }
 async function findKitRoot(extracted) {
   const candidates = [
-    path7.join(extracted, "shell-starter-kit"),
+    path8.join(extracted, "shell-starter-kit"),
     extracted
   ];
   const entries = await fs7.readdir(extracted, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      candidates.push(path7.join(extracted, entry.name));
+      candidates.push(path8.join(extracted, entry.name));
     }
   }
   for (const candidate of candidates) {
-    if (await pathExists(path7.join(candidate, "groundfloor.manifest.json"))) {
+    if (await pathExists(path8.join(candidate, "groundfloor.manifest.json"))) {
       return candidate;
     }
   }
@@ -2643,7 +3066,7 @@ async function appsInitCommand(opts) {
 `);
   }
   const name = opts.name?.trim() || titleFromSlug(slug);
-  const dest = path7.resolve(opts.dir?.trim() || path7.join(process.cwd(), slug));
+  const dest = path8.resolve(opts.dir?.trim() || path8.join(process.cwd(), slug));
   const cfg = await resolveConfig();
   const cell = cfg.environment ?? "production";
   const kitUrl = opts.kitUrl?.trim() || starterKitZipUrl(cell);
@@ -2658,7 +3081,7 @@ async function appsInitCommand(opts) {
   const bytes = await downloadKit(kitUrl);
   const zip = new AdmZip4(bytes);
   assertSafeZipEntries(zip);
-  const tmp = await fs7.mkdtemp(path7.join(os3.tmpdir(), "gf-starter-kit-"));
+  const tmp = await fs7.mkdtemp(path8.join(os3.tmpdir(), "gf-starter-kit-"));
   try {
     zip.extractAllTo(tmp, true);
     const kitRoot = await findKitRoot(tmp);
@@ -2667,8 +3090,8 @@ async function appsInitCommand(opts) {
   } finally {
     await fs7.rm(tmp, { recursive: true, force: true });
   }
-  const identityPath = path7.join(dest, "src", "appIdentity.ts");
-  const manifestPath = path7.join(dest, "groundfloor.manifest.json");
+  const identityPath = path8.join(dest, "src", "appIdentity.ts");
+  const manifestPath = path8.join(dest, "groundfloor.manifest.json");
   const identity = await fs7.readFile(identityPath, "utf8");
   await fs7.writeFile(identityPath, stampAppIdentity(identity, slug), "utf8");
   const manifest = await fs7.readFile(manifestPath, "utf8");
@@ -2745,7 +3168,7 @@ async function dataplaneProvisionCommand(opts) {
 
 // src/update-check.ts
 import { promises as fs8 } from "fs";
-import path8 from "path";
+import path9 from "path";
 var UPDATE_TTL_MS = 24 * 60 * 60 * 1e3;
 function isNewer(latest, current) {
   const a = latest.split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -2798,7 +3221,7 @@ async function readUpdateCache(file) {
   }
 }
 async function writeUpdateCache(file, cache) {
-  await fs8.mkdir(path8.dirname(file), { recursive: true, mode: 448 });
+  await fs8.mkdir(path9.dirname(file), { recursive: true, mode: 448 });
   await fs8.writeFile(file, `${JSON.stringify(cache)}
 `, { mode: 384 });
 }
@@ -2836,6 +3259,90 @@ function commanderExitCode(err) {
   return 0;
 }
 
+// src/commands/api.ts
+var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+async function apiCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  const method = (opts.method ?? "GET").toUpperCase();
+  if (!METHODS.has(method)) {
+    throw new Error(`Unsupported method ${method}`);
+  }
+  let path11 = opts.path.trim();
+  if (!path11.startsWith("/")) path11 = `/${path11}`;
+  path11 = path11.replaceAll("{workspace_id}", cfg.workspaceId ?? "");
+  path11 = path11.replaceAll("{workspaceId}", cfg.workspaceId ?? "");
+  let body;
+  if (opts.body !== void 0) {
+    body = JSON.parse(opts.body);
+  }
+  const data = await controlPlaneRequest(cfg.apiUrl, method, path11, body);
+  if (data === void 0) {
+    process.stdout.write("\n");
+    return;
+  }
+  process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+}
+
+// src/commands/identities.ts
+async function identitiesListCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const identities2 = await listWorkloadIdentities(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(identities2, null, 2)}
+`);
+    return;
+  }
+  if (identities2.length === 0) {
+    process.stdout.write("No workload identities in this workspace.\n");
+    return;
+  }
+  for (const identity of identities2) {
+    const refresh = identity.has_refresh_secret ? "refresh" : "no-refresh";
+    process.stdout.write(
+      `${identity.id}  ${identity.slug ?? identity.name}  [${refresh}]
+`
+    );
+  }
+}
+async function identitiesMintCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const data = await mintWorkloadIdentityVaultToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.identity,
+    { rotate_refresh: Boolean(opts.rotateRefresh) }
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.refresh_secret) {
+    process.stderr.write(
+      "Save refresh_secret now; it is not shown again unless you --rotate-refresh.\n"
+    );
+    process.stderr.write(`refresh_secret=${data.refresh_secret}
+`);
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s identity=${data.workload_identity_id}
+`
+  );
+  process.stdout.write(`${data.token}
+`);
+}
+
 // src/index.ts
 function collect(value, previous) {
   return previous.concat([value]);
@@ -2867,6 +3374,22 @@ program.command("login").description(
 program.command("logout").description("Clear the cached session").action(() => run(() => logoutCommand()));
 program.command("whoami").description("Show the current identity and verify the Control Plane session").action(() => run(() => whoamiCommand()));
 program.command("token").description("Print a valid (auto-refreshed) access token to stdout").action(() => run(() => tokenCommand()));
+var m2m = program.command("m2m").description("Machine tokens (client_id + secret \u2192 short Control Plane JWT)");
+m2m.command("token").description(
+  "Exchange GROUNDFLOOR_M2M_CLIENT_ID + SECRET for a short CP JWT (not gf token)"
+).option("-w, --workspace <id>", "Workspace id override").option("--client-id <id>", "M2M client_id (else GROUNDFLOOR_M2M_CLIENT_ID)").option(
+  "--client-secret <secret>",
+  "M2M secret (else GROUNDFLOOR_M2M_CLIENT_SECRET)"
+).option("--json", "Output the full token response as JSON").action(
+  (opts) => run(
+    () => m2mTokenCommand({
+      workspace: opts.workspace,
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      json: opts.json
+    })
+  )
+);
 program.command("env").description('Print shell exports for `eval "$(gf env)"`').action(() => run(() => envCommand()));
 var environments = program.command("environments").alias("envs").description("List workspace environments");
 environments.command("list", { isDefault: true }).alias("ls").description("List environments in the default (or --workspace) workspace").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => environmentsListCommand(opts)));
@@ -2899,7 +3422,7 @@ coderunner.command("logs").description("Show Process Log lines for a coderunner
     })
   )
 );
-coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "JSON payload object", "{}").option("--json", "Output raw JSON").action(
+coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "Event JSON object posted as the /run body", "{}").option("--json", "Output raw JSON").action(
   (opts) => run(
     () => runCommand({
       workspace: opts.workspace,
@@ -2909,6 +3432,17 @@ coderunner.command("run").description("Invoke a deployed function/job (smoke run
     })
   )
 );
+coderunner.command("vault-token").description(
+  "Deprecated: use gf m2m token. D-067 Data Vault JWT for a bound Coderunner"
+).requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output the full token response as JSON").action(
+  (opts) => run(
+    () => vaultTokenCommand({
+      workspace: opts.workspace,
+      coderunner: opts.coderunner,
+      json: opts.json
+    })
+  )
+);
 var domains = program.command("domains").description("Manage custom domains (CNAME) for a coderunner service");
 domains.command("add <domain>").description("Add a custom domain and print the DNS records to create").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((domain, opts) => run(() => domainsAddCommand(domain, opts)));
 domains.command("ls").alias("list").description("List custom domains for a coderunner service").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => domainsListCommand(opts)));
@@ -2990,7 +3524,7 @@ program.command("deploy").description(
 ).option("-w, --workspace <id>", "Workspace id override").option("--api-url <url>", "Control Plane base URL").option(
   "-c, --coderunner <id>",
   "Deploy into an existing coderunner id (skip find/create)"
-).option("-n, --name <name>", "Coderunner name (default: folder or repo name)").option("-p, --path <dir>", "Local directory to package (default: cwd)").option("--git <url>", "Clone and deploy a remote git/bitbucket repo").option("--ref <ref>", "Branch/tag/commit for --git").option("--subdir <dir>", "Subdirectory within the source to package").option("--runtime <runtime>", "python | node | dotnet-script").option(
+).option("-n, --name <name>", "Coderunner name (default: folder or repo name)").option("-p, --path <dir>", "Local directory to package (default: cwd)").option("--git <url>", "Clone and deploy a remote git/bitbucket repo").option("--ref <ref>", "Branch/tag/commit for --git").option("--subdir <dir>", "Subdirectory within the source to package").option("--runtime <runtime>", "Language slug from Code Runner (node, python, go, \u2026)").option(
   "--workload-type <type>",
   "function | service | job | schedule"
 ).option(
@@ -2999,7 +3533,34 @@ program.command("deploy").description(
 ).option(
   "--app-id <id>",
   "Bind newly created coderunner as a helper of this App (optional)"
-).option("--cpu <cpu>", "CPU request, e.g. 250m").option("--memory <memory>", "Memory request, e.g. 256Mi").option("-e, --env <KEY=VALUE>", "Environment variable (repeatable)", collect, []).option("-m, --message <text>", "Version description").option("--skip-deploy", "Upload a new version but do not deploy it").action((opts) => run(() => deployCommand(opts)));
+).option("--cpu <cpu>", "CPU request, e.g. 250m").option("--memory <memory>", "Memory request, e.g. 256Mi").option("-e, --env <KEY=VALUE>", "Environment variable (repeatable)", collect, []).option(
+  "--secret <KEY>",
+  "Inject this workspace secret by reference (repeatable). Use for *_SECRET keys.",
+  collect,
+  []
+).option("-m, --message <text>", "Version description").option("--skip-deploy", "Upload a new version but do not deploy it").action((opts) => run(() => deployCommand(opts)));
+program.command("api").description("Call a Control Plane path (passthrough for gaps in gf commands)").argument("<path>", "Path beginning with /v1/\u2026  Use {workspace_id} for the current workspace").option("-X, --method <method>", "HTTP method", "GET").option("--body <json>", "JSON body for POST/PUT/PATCH").option("-w, --workspace <id>", "Workspace id override").action(
+  (path11, opts) => run(
+    () => apiCommand({
+      path: path11,
+      method: opts.method,
+      body: opts.body,
+      workspace: opts.workspace
+    })
+  )
+);
+var identities = program.command("identities").description("Workload identities (Vault principals)");
+identities.command("ls").alias("list").description("List workload identities").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => identitiesListCommand(opts)));
+identities.command("mint").description("Mint a Vault JWT; first mint returns refresh_secret once").requiredOption("--identity <id>", "Workload identity id").option("-w, --workspace <id>", "Workspace id override").option("--rotate-refresh", "Rotate and return a new refresh_secret").option("--json", "Output raw JSON").action(
+  (opts) => run(
+    () => identitiesMintCommand({
+      workspace: opts.workspace,
+      identity: opts.identity,
+      rotateRefresh: opts.rotateRefresh,
+      json: opts.json
+    })
+  )
+);
 function wireUnknownCommands(root, current, latest) {
   const walk = (cmd) => {
     if (cmd.commands.length === 0) return;
@@ -3023,7 +3584,7 @@ function wireUnknownCommands(root, current, latest) {
 async function notifyUpgrade() {
   if (process.env.GF_SKIP_UPDATE_CHECK === "1") return null;
   const latest = await resolveLatest({
-    cacheFile: path9.join(paths.CONFIG_DIR, "update-check.json")
+    cacheFile: path10.join(paths.CONFIG_DIR, "update-check.json")
   });
   if (latest && isNewer(latest, GF_VERSION)) {
     process.stderr.write(`${upgradeNotice(GF_VERSION, latest)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {
@@ -28,17 +28,20 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "clean": "rm -rf dist *.tsbuildinfo .turbo",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.6.0",
     "commander": "^12.1.0",
     "open": "^10.1.0"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.5.7",
     "@types/node": "^20",
+    "esbuild": "^0.27.7",
     "tsup": "^8.3.0",
     "typescript": "^5"
   },