@marina-cloud/cli 0.0.3 → 0.0.5

package/dist/marina.mjs

@@ -1,8 +1,112 @@
 #!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res, err2) => function __init() {
+  if (err2) throw err2[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err2 = [e], e;
+  }
+};
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 
-// src/index.ts
-import { resolve } from "node:path";
-import { parseArgs } from "node:util";
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@marina-cloud/cli",
+      version: "0.0.5",
+      description: "Command-line client for Marina Cloud",
+      homepage: "https://github.com/marina-hq/marina#readme",
+      bugs: {
+        url: "https://github.com/marina-hq/marina/issues"
+      },
+      license: "Apache-2.0",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/marina-hq/marina.git",
+        directory: "packages/cli"
+      },
+      bin: {
+        marina: "dist/marina.mjs"
+      },
+      files: [
+        "dist"
+      ],
+      type: "module",
+      publishConfig: {
+        access: "public",
+        provenance: true
+      },
+      scripts: {
+        build: 'esbuild src/index.ts --bundle --platform=node --target=node22 --format=esm --loader:.md=text --loader:.yaml=text --loader:.html=text --loader:.css=text --loader:.txt=text --external:@electric-sql/pglite --external:esbuild --outfile=dist/marina.mjs --banner:js="#!/usr/bin/env node" && chmod +x dist/marina.mjs',
+        typecheck: "tsc --noEmit",
+        test: "pnpm build && node --experimental-strip-types --test src/*.test.ts",
+        prepack: "pnpm build"
+      },
+      dependencies: {
+        "@electric-sql/pglite": "^0.3.6",
+        esbuild: "^0.28.2",
+        ignore: "^7.0.6"
+      },
+      devDependencies: {
+        "@types/node": "26.2.0",
+        fflate: "^0.8.3",
+        typescript: "7.0.2"
+      },
+      engines: {
+        node: ">=22"
+      }
+    };
+  }
+});
+
+// src/identity.ts
+var CLI_VERSION, cliRequestHeaders;
+var init_identity = __esm({
+  "src/identity.ts"() {
+    "use strict";
+    init_package();
+    CLI_VERSION = package_default.version;
+    cliRequestHeaders = () => ({
+      "user-agent": `marina-cli/${CLI_VERSION}`,
+      "x-marina-client": "cli",
+      "x-marina-client-version": CLI_VERSION
+    });
+  }
+});
 
 // src/config.ts
 import {
@@ -16,15 +120,81 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-var MARINA_HOME = process.env.MARINA_HOME ?? join(homedir(), ".marina");
-var PROFILE = join(MARINA_HOME, "profile");
-var apiUrl = () => (process.env.MARINA_API ?? "https://v1.marina.cloud").replace(/\/$/, "");
-var dashboardUrl = () => {
-  if (process.env.MARINA_DASHBOARD) return process.env.MARINA_DASHBOARD.replace(/\/$/, "");
-  const api = new URL(apiUrl());
-  return api.hostname === "localhost" || api.hostname === "127.0.0.1" ? "http://localhost:5173" : api.origin;
-};
-var profilePath = () => PROFILE;
+function normalizeApiUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error("the Marina control plane must use http or https");
+  }
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("the Marina control plane must be an origin without a path");
+  }
+  if (url.protocol === "http:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1" && url.hostname !== "[::1]") {
+    throw new Error("the Marina control plane must use https unless it is local");
+  }
+  return url.origin;
+}
+function cachedControlPlane(host = controlPlaneHost()) {
+  const cached = readProfile().control_plane;
+  if (!cached || cached.host !== host) return null;
+  try {
+    normalizeApiUrl(cached.api_url);
+    normalizeApiUrl(cached.dashboard_url);
+    return cached;
+  } catch {
+    return null;
+  }
+}
+async function resolveControlPlane() {
+  const host = controlPlaneHost();
+  const cached = cachedControlPlane(host);
+  const checkedAt = cached ? Date.parse(cached.checked_at) : Number.NaN;
+  if (cached && Number.isFinite(checkedAt) && Date.now() - checkedAt < CONTROL_PLANE_CACHE_MS) {
+    resolvedControlPlane = {
+      api_url: cached.api_url,
+      dashboard_url: cached.dashboard_url,
+      latest_cli_version: cached.latest_cli_version
+    };
+    return;
+  }
+  if (process.env.MARINA_DISABLE_CONTROL_PLANE_DISCOVERY === "1") return;
+  try {
+    const response = await fetch(`${host}/.well-known/marina`, {
+      headers: { ...cliRequestHeaders(), accept: "application/json" },
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (!response.ok)
+      throw new Error(`control-plane discovery failed (${String(response.status)})`);
+    const body = await response.json();
+    if (body.schema_version !== 1 || typeof body.api_url !== "string" || typeof body.dashboard_url !== "string") {
+      throw new Error("control-plane discovery returned an invalid response");
+    }
+    const discovered = {
+      api_url: normalizeApiUrl(body.api_url),
+      dashboard_url: normalizeApiUrl(body.dashboard_url),
+      latest_cli_version: typeof body.clients?.cli?.latest_version === "string" ? body.clients.cli.latest_version : null
+    };
+    resolvedControlPlane = discovered;
+    writeProfile({
+      ...readProfile(),
+      control_plane: {
+        host,
+        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+        ...discovered
+      }
+    });
+  } catch {
+    if (cached) {
+      resolvedControlPlane = {
+        api_url: cached.api_url,
+        dashboard_url: cached.dashboard_url,
+        latest_cli_version: cached.latest_cli_version
+      };
+    }
+  }
+}
+function latestCliVersion() {
+  return resolvedControlPlane?.latest_cli_version ?? cachedControlPlane()?.latest_cli_version ?? null;
+}
 function readProfile() {
   try {
     return JSON.parse(readFileSync(PROFILE, "utf8"));
@@ -60,7 +230,6 @@ function clearToken() {
   }
   writeProfile(rest);
 }
-var LINK = ".marina/project.json";
 function readLink(dir) {
   try {
     return JSON.parse(readFileSync(join(dir, LINK), "utf8"));
@@ -68,135 +237,2295 @@ function readLink(dir) {
     return null;
   }
 }
-function writeLink(dir, link) {
-  mkdirSync(join(dir, ".marina"), { recursive: true });
-  writeFileSync(join(dir, LINK), `${JSON.stringify(link, null, 2)}
-`);
-}
+function writeLink(dir, link) {
+  mkdirSync(join(dir, ".marina"), { recursive: true });
+  writeFileSync(join(dir, LINK), `${JSON.stringify(link, null, 2)}
+`);
+}
+var MARINA_HOME, PROFILE, PRODUCTION_CONTROL_PLANE, CONTROL_PLANE_CACHE_MS, resolvedControlPlane, controlPlaneHost, apiUrl, dashboardUrl, profilePath, LINK;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_identity();
+    MARINA_HOME = process.env.MARINA_HOME ?? join(homedir(), ".marina");
+    PROFILE = join(MARINA_HOME, "profile");
+    PRODUCTION_CONTROL_PLANE = "https://marina.cloud";
+    CONTROL_PLANE_CACHE_MS = 60 * 60 * 1e3;
+    resolvedControlPlane = null;
+    controlPlaneHost = () => normalizeApiUrl(
+      process.env.MARINA_CONTROL_PLANE ?? readProfile().control_plane_host ?? PRODUCTION_CONTROL_PLANE
+    );
+    apiUrl = () => normalizeApiUrl(
+      process.env.MARINA_API ?? resolvedControlPlane?.api_url ?? cachedControlPlane()?.api_url ?? controlPlaneHost()
+    );
+    dashboardUrl = () => {
+      if (process.env.MARINA_DASHBOARD) return normalizeApiUrl(process.env.MARINA_DASHBOARD);
+      return normalizeApiUrl(
+        resolvedControlPlane?.dashboard_url ?? cachedControlPlane()?.dashboard_url ?? controlPlaneHost()
+      );
+    };
+    profilePath = () => PROFILE;
+    LINK = ".marina/project.json";
+  }
+});
+
+// src/api.ts
+async function request(path, init) {
+  const token = getToken();
+  if (!token) throw new ApiError("unauthenticated", "not signed in \u2014 run `marina setup`", 401);
+  const res = await fetch(`${apiUrl()}${path}`, {
+    ...init,
+    headers: { ...cliRequestHeaders(), authorization: `Bearer ${token}`, ...init?.headers }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new ApiError(
+      body.error?.code ?? "error",
+      body.error?.message ?? `request failed (${String(res.status)})`,
+      res.status
+    );
+  }
+  return body;
+}
+async function me() {
+  return request("/v1/me");
+}
+async function exchangeCliLogin(code, codeVerifier) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl()}/cli/auth/exchange`, {
+      method: "POST",
+      headers: { ...cliRequestHeaders(), "content-type": "application/json" },
+      body: JSON.stringify({ code, code_verifier: codeVerifier }),
+      signal: AbortSignal.timeout(LOGIN_EXCHANGE_TIMEOUT_MS)
+    });
+  } catch (error) {
+    if (error.name === "TimeoutError") {
+      throw new ApiError(
+        "login_timeout",
+        "the login confirmation request timed out after 15 seconds \u2014 run `marina setup` to try again",
+        408
+      );
+    }
+    throw error;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.token) {
+    throw new ApiError(
+      body.error?.code ?? "login_failed",
+      body.error?.message ?? `login exchange failed (${String(res.status)})`,
+      res.status
+    );
+  }
+  return body.token;
+}
+async function startDeploy(zip, name, app, baseRevision) {
+  const form = new FormData();
+  form.set(
+    "code",
+    new Blob([new Uint8Array(zip).buffer], { type: "application/zip" }),
+    "upload.zip"
+  );
+  form.set("name", name);
+  form.set("source", "cli");
+  if (app) form.set("app", app);
+  if (baseRevision) form.set("base_revision", baseRevision);
+  const res = await request("/v1/deploys", {
+    method: "POST",
+    body: form
+  });
+  return res.deploy;
+}
+async function pollDeploy(id, onProgress = () => void 0) {
+  for (; ; ) {
+    const deploy2 = await getDeploy(id);
+    onProgress(deploy2);
+    if (deploy2.status !== "queued" && deploy2.status !== "building") return deploy2;
+    await new Promise((resolve4) => setTimeout(resolve4, 500));
+  }
+}
+async function getDeploy(id) {
+  const res = await request(`/v1/deploys/${encodeURIComponent(id)}`);
+  return res.deploy;
+}
+async function listApps() {
+  const res = await request("/v1/apps");
+  return res.apps;
+}
+async function getAppUrl(idOrSlug) {
+  return (await getApp(idOrSlug)).url;
+}
+async function listVersions(app) {
+  const res = await request(
+    `/v1/apps/${encodeURIComponent(app)}/versions`
+  );
+  return res.versions;
+}
+async function listDeploys(app, limit = 10) {
+  const res = await request(
+    `/v1/apps/${encodeURIComponent(app)}/deploys?limit=${String(limit)}`
+  );
+  return res.deploys;
+}
+async function listRuntimeLogs(app, options = {}) {
+  const query = new URLSearchParams();
+  query.set("limit", String(options.limit ?? 100));
+  if (options.cursor) query.set("cursor", options.cursor);
+  if (options.level) query.set("level", options.level);
+  const response = await request(
+    `/v1/apps/${encodeURIComponent(app)}/logs?${query.toString()}`
+  );
+  return { logs: response.logs, nextCursor: response.next_cursor };
+}
+async function restoreVersion(versionId) {
+  const res = await request(`/v1/versions/${versionId}/restore`, {
+    method: "POST"
+  });
+  return res.version;
+}
+var LOGIN_EXCHANGE_TIMEOUT_MS, ApiError, aiModels, getApp;
+var init_api = __esm({
+  "src/api.ts"() {
+    "use strict";
+    init_config();
+    init_identity();
+    LOGIN_EXCHANGE_TIMEOUT_MS = 15e3;
+    ApiError = class extends Error {
+      code;
+      status;
+      constructor(code, message, status2) {
+        super(message);
+        this.code = code;
+        this.status = status2;
+      }
+    };
+    aiModels = () => request("/v1/ai/models");
+    getApp = (idOrSlug) => request(`/v1/apps/${encodeURIComponent(idOrSlug)}`);
+  }
+});
+
+// src/output.ts
+function terminalSafeText(value) {
+  return Array.from(value, (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    if (code >= 32 && (code < 127 || code > 159)) return character;
+    if (code === 9) return "\\t";
+    if (code === 10) return "\\n";
+    if (code === 13) return "\\r";
+    return `\\u{${code.toString(16).padStart(4, "0")}}`;
+  }).join("");
+}
+function terminalSafeJson(payload, space) {
+  return Array.from(JSON.stringify(payload, null, space), (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : character;
+  }).join("");
+}
+function say(line = "") {
+  if (json) console.error(line);
+  else console.log(line);
+}
+function note(line) {
+  console.error(line);
+}
+function createProgress() {
+  let active = false;
+  let lastPhase = null;
+  let frame = 0;
+  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  const interactive = process.stderr.isTTY === true && !json;
+  return {
+    update(phase, line) {
+      if (interactive) {
+        process.stderr.write(`\r\x1B[2K${frames[frame++ % frames.length]} ${line}`);
+        active = true;
+      } else if (phase !== lastPhase) {
+        console.error(json ? terminalSafeJson({ type: "progress", phase, message: line }) : line);
+      }
+      lastPhase = phase;
+    },
+    clear() {
+      if (active) process.stderr.write("\r\x1B[2K");
+      active = false;
+    }
+  };
+}
+function result(payload) {
+  if (json) console.log(terminalSafeJson({ schema_version: 1, ok: true, ...payload }, 2));
+}
+function failure(code, message, extra = {}) {
+  if (json)
+    console.log(
+      terminalSafeJson({ schema_version: 1, ok: false, error: { code, message, ...extra } }, 2)
+    );
+  else {
+    console.error(`${red(terminalSafeText(code))} ${terminalSafeText(message)}`);
+  }
+}
+var json, setJsonMode, isJsonMode, bold, dim, red, green;
+var init_output = __esm({
+  "src/output.ts"() {
+    "use strict";
+    json = false;
+    setJsonMode = (on) => {
+      json = on;
+    };
+    isJsonMode = () => json;
+    bold = (s) => `\x1B[1m${s}\x1B[22m`;
+    dim = (s) => `\x1B[2m${s}\x1B[22m`;
+    red = (s) => `\x1B[31m${s}\x1B[39m`;
+    green = (s) => `\x1B[32m${s}\x1B[39m`;
+  }
+});
+
+// ../../node_modules/.pnpm/ignore@7.0.8/node_modules/ignore/index.js
+var require_ignore = __commonJS({
+  "../../node_modules/.pnpm/ignore@7.0.8/node_modules/ignore/index.js"(exports, module) {
+    function makeArray(subject) {
+      return Array.isArray(subject) ? subject : [subject];
+    }
+    var UNDEFINED = void 0;
+    var EMPTY = "";
+    var SPACE = " ";
+    var ESCAPE = "\\";
+    var REGEX_LITERAL_SPECIAL = /[.*+?()[\]{}^$|\\/]/;
+    var REGEX_TEST_BLANK_LINE = /^ +$/;
+    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+    var REGEX_SPLITALL_CRLF = /\r?\n/g;
+    var DOUBLE_SLASH = "//";
+    var SLASH_CODE = 47;
+    var DOT_CODE = 46;
+    var SLASH = "/";
+    var TMP_KEY_IGNORE = "node-ignore";
+    if (typeof Symbol !== "undefined") {
+      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
+    }
+    var KEY_IGNORE = TMP_KEY_IGNORE;
+    var define = (object, key, value) => {
+      Object.defineProperty(object, key, { value });
+      return value;
+    };
+    var RETURN_FALSE = () => false;
+    var cleanRangeBackSlash = (slashes) => {
+      const { length } = slashes;
+      return slashes.slice(0, length - length % 2);
+    };
+    var POSIX_CLASSES = {
+      alnum: "0-9A-Za-z",
+      alpha: "A-Za-z",
+      blank: " \\t",
+      cntrl: "\\x00-\\x1f\\x7f",
+      digit: "0-9",
+      graph: "!-.0-~",
+      lower: "a-z",
+      print: " -.0-~",
+      punct: "!-.:-@\\[-`{-~",
+      // git's `sane-ctype.h` classifies \v and \f as control, not space,
+      //   unlike C's `isspace`
+      space: " \\t\\n\\r",
+      upper: "A-Z",
+      xdigit: "0-9A-Fa-f"
+    };
+    var CLASS_MEMBERS_TO_ESCAPE = "\\]^-[";
+    var escapeMember = (char) => CLASS_MEMBERS_TO_ESCAPE.indexOf(char) < 0 ? char : ESCAPE + char;
+    var NON_SLASH = "(?!\\/)";
+    var classSource = (negated, body) => {
+      if (negated) {
+        return `[^\\/${body}]`;
+      }
+      const source = `[${body}]`;
+      return new RegExp(source).test("/") ? NON_SLASH + source : source;
+    };
+    var scanBracket = (pattern, start) => {
+      const { length } = pattern;
+      let index = start + 1;
+      let negated = EMPTY;
+      const lead = pattern[index];
+      if (lead === "!" || lead === "^") {
+        negated = "^";
+        index++;
+      }
+      let body = EMPTY;
+      let prev = EMPTY;
+      for (; ; ) {
+        const char = pattern[index];
+        if (char === UNDEFINED) {
+          return null;
+        }
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === UNDEFINED) {
+            return null;
+          }
+          body += escapeMember(escaped);
+          prev = escaped;
+          index++;
+        } else if (char === "-" && prev && index + 1 < length && pattern[index + 1] !== "]") {
+          index++;
+          let to = pattern[index];
+          if (to === ESCAPE) {
+            to = pattern[index += 1];
+          }
+          if (prev <= to) {
+            body += `-${escapeMember(to)}`;
+          }
+          prev = EMPTY;
+        } else if (char === "[" && pattern[index + 1] === ":") {
+          const nameStart = index + 2;
+          let end = nameStart;
+          while (end < length && pattern[end] !== "]") {
+            end++;
+          }
+          if (end === length) {
+            return null;
+          }
+          if (end > nameStart && pattern[end - 1] === ":") {
+            const expanded = POSIX_CLASSES[pattern.slice(nameStart, end - 1)];
+            if (expanded === UNDEFINED) {
+              return null;
+            }
+            body += expanded;
+            prev = EMPTY;
+            index = end;
+          } else {
+            body += escapeMember("[");
+            prev = "[";
+            index = nameStart - 2;
+          }
+        } else {
+          body += escapeMember(char);
+          prev = char;
+        }
+        index++;
+        if (pattern[index] === "]") {
+          return {
+            end: index,
+            source: classSource(negated, body)
+          };
+        }
+      }
+    };
+    var NEVER_MATCH = "[]";
+    var PLACEHOLDER = "\0";
+    var REGEX_RESTORE_PLACEHOLDER = new RegExp(
+      `${PLACEHOLDER}(\\d+)${PLACEHOLDER}`,
+      "g"
+    );
+    var TRAILING_WILDCARD = "\uE000";
+    var extractBrackets = (pattern) => {
+      const sources = [];
+      const hold = (source) => `${PLACEHOLDER}${sources.push(source) - 1}${PLACEHOLDER}`;
+      const { length } = pattern;
+      let out = EMPTY;
+      let index = 0;
+      while (index < length) {
+        const char = pattern[index];
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === "*" || escaped === "[" || escaped === SPACE || escaped === ESCAPE) {
+            out += pattern.slice(index, index + 2);
+          } else {
+            out += hold(
+              REGEX_LITERAL_SPECIAL.test(escaped) ? ESCAPE + escaped : escaped
+            );
+          }
+          index += 2;
+        } else if (char === PLACEHOLDER) {
+          out += hold(`[${PLACEHOLDER}]`);
+          index++;
+        } else if (char === "[") {
+          const scanned = scanBracket(pattern, index);
+          if (scanned === null) {
+            out += hold(NEVER_MATCH);
+            index = length;
+          } else {
+            out += hold(scanned.source);
+            index = scanned.end + 1;
+          }
+        } else {
+          out += char;
+          index++;
+        }
+      }
+      return {
+        source: out,
+        sources
+      };
+    };
+    var DIRECT = null;
+    var REGEX_INNER_SLASH = /\/(?!$)/;
+    var REPLACERS = [
+      [
+        // Remove BOM
+        // TODO:
+        // Other similar zero-width characters?
+        /^\uFEFF/,
+        () => EMPTY,
+        "\uFEFF"
+      ],
+      [
+        // A trailing line terminator, left on when a whole file's contents are
+        //   added as one pattern rather than split into lines. git never sees one
+        //   -- it reads a `.gitignore` line by line -- so it is not part of the
+        //   pattern and is dropped here, apart from the trailing-space trimming,
+        //   which follows git in touching spaces and nothing else.
+        /[\r\n]+$/,
+        () => EMPTY
+      ],
+      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
+      [
+        // Only spaces, never tabs or other whitespace: git trims a trailing run
+        //   of `' '` and nothing else (dir.c, `trim_trailing_spaces`, a single
+        //   `case ' '`), so a pattern ending in a tab keeps it as a literal.
+        // (a\ ) -> (a )
+        // (a  ) -> (a)
+        // (a ) -> (a)
+        // (a \ ) -> (a  )
+        /((?:\\\\)*?)(\\? +)$/,
+        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
+      ],
+      // Replace (\ ) with ' '
+      // Only a space: an escaped tab or other whitespace is already a literal by
+      //   the time it reaches here, and a bare tab must be left as one, not turned
+      //   into a space.
+      // (\ ) -> ' '
+      // (\\ ) -> '\\ '
+      // (\\\ ) -> '\\ '
+      [
+        /(\\+?) /g,
+        (_, m1) => {
+          const { length } = m1;
+          return m1.slice(0, length - length % 2) + SPACE;
+        }
+      ],
+      // Escape metacharacters
+      // which is written down by users but means special for regular expressions.
+      // > There are 12 characters with special meanings:
+      // > - the backslash \,
+      // > - the caret ^,
+      // > - the dollar sign $,
+      // > - the period or dot .,
+      // > - the vertical bar or pipe symbol |,
+      // > - the question mark ?,
+      // > - the asterisk or star *,
+      // > - the plus sign +,
+      // > - the opening parenthesis (,
+      // > - the closing parenthesis ),
+      // > - and the opening square bracket [,
+      // > - the opening curly brace {,
+      // > These special characters are often called "metacharacters".
+      [
+        /[\\$.|*+(){^]/g,
+        (match) => `\\${match}`
+      ],
+      [
+        // > a question mark (?) matches a single character
+        /(?!\\)\?/g,
+        () => "[^/]",
+        "?"
+      ],
+      // leading slash
+      [
+        // > A leading slash matches the beginning of the pathname.
+        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+        // A leading slash matches the beginning of the pathname
+        /^\//,
+        () => "^",
+        SLASH
+      ],
+      // replace special metacharacter slash after the leading slash
+      [
+        /\//g,
+        () => "\\/",
+        SLASH
+      ],
+      [
+        // > A leading "**" followed by a slash means match in all directories.
+        // > For example, "**/foo" matches file or directory "foo" anywhere,
+        // > the same as pattern "foo".
+        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+        // >   under directory "foo".
+        // Notice that the '*'s have been replaced as '\\*'
+        /^\^*(?:\\\*\\\*\\\/)+/,
+        // '**/foo' <-> 'foo'
+        () => "^(?:.*\\/)?",
+        "*"
+      ],
+      // starting
+      [
+        // there will be no leading '/'
+        //   (which has been replaced by section "leading slash")
+        // If starts with '**', adding a '^' to the regular expression also works
+        DIRECT,
+        (source, pattern) => {
+          if (!source || source[0] === "^") {
+            return source;
+          }
+          const anchor = !REGEX_INNER_SLASH.test(pattern) ? "(?:^|\\/)" : "^";
+          return anchor + source;
+        }
+      ],
+      // two globstars
+      [
+        // Use lookahead assertions so that we could match more than one `'/**'`
+        /\\\/\\\*\\\*(?=\\\/|$)/g,
+        // Zero, one or several directories
+        // should not use '*', or it will be replaced by the next replacer
+        // Check if it is not the last `'/**'`
+        (_, index, str) => index + 6 < str.length ? str.slice(index + 6) === "\\/" ? "(?:\\/[^\\/]+)+" : "(?:\\/[^\\/]+)*" : "\\/.+",
+        "*"
+      ],
+      // normal intermediate wildcards
+      [
+        // Never replace escaped '*'
+        // ignore rule '\*' will match the path '*'
+        // 'abc.*/' -> go
+        // 'abc.*'  -> skip this rule,
+        //    coz trailing single wildcard will be handed by [trailing wildcard]
+        /(^|[^\\]+)(\\\*)+(?=.+)/g,
+        // '*.js' matches '.js'
+        // '*.js' doesn't match 'abc'
+        (_, p1, p2) => {
+          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
+          return p1 + unescaped;
+        },
+        "*"
+      ],
+      // trailing wildcard, held apart from a literal star
+      [
+        // The step above leaves a trailing `*` alone, so a single `\*` is all that
+        //   can be left at the end here. Whether it is a wildcard or a literal
+        //   turns on the backslashes the user put in front of it: the escaper has
+        //   since doubled every one, so what stands here is those `2N` doubled
+        //   backslashes and then the star's own escape. An even number of the
+        //   original `N` leaves the star unescaped -- a wildcard -- and an odd
+        //   number escapes it -- a literal. This runs while the two are still
+        //   distinct, before the unescape steps below collapse the literal onto
+        //   the very `\*` a wildcard leaves behind.
+        /(^|[^\\])((?:\\\\)*)\\\*$/,
+        (match, p1, p2) => (
+          // `p2` holds the doubled user backslashes; half of them is `N`.
+          p2.length / 2 % 2 === 0 ? p1 + p2 + TRAILING_WILDCARD : match
+        ),
+        "*"
+      ],
+      [
+        // unescape, revert step 3 except for back slash
+        // For example, if a user escape a '\\*',
+        // after step 3, the result will be '\\\\\\*'
+        /\\\\\\(?=[$.|*+(){^])/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // '\\\\' -> '\\'
+        /\\\\/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // Every real bracket expression -- POSIX classes included -- has already
+        //   been held aside by `extractBrackets`, so the only `[` left in the
+        //   pattern is an escaped, literal one.
+        // `\` is escaped by step 3
+        /\\\[([^\]/]*?)(\\*)($|\])/g,
+        // '\\[bar]' -> '\\\\[bar\\]'
+        (match, range, endEscape, close) => `\\[${range}${cleanRangeBackSlash(endEscape)}${close}`,
+        "["
+      ],
+      // ending
+      [
+        // 'js' will not match 'js.'
+        // 'ab' will not match 'abc'
+        DIRECT,
+        // WTF!
+        // https://git-scm.com/docs/gitignore
+        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
+        // which re-fixes #24, #38
+        // > If there is a separator at the end of the pattern then the pattern
+        // > will only match directories, otherwise the pattern can match both
+        // > files and directories.
+        // 'js*' will not match 'a.js'
+        // 'js/' will not match 'a.js'
+        // 'js' will match 'a.js' and 'a.js/'
+        (source) => {
+          const last = source[source.length - 1];
+          if (!last || last === TRAILING_WILDCARD) {
+            return source;
+          }
+          return last === SLASH ? `${source}$` : `${source}(?=$|\\/$)`;
+        }
+      ]
+    ];
+    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\uE000$/;
+    var MODE_IGNORE = "regex";
+    var MODE_CHECK_IGNORE = "checkRegex";
+    var UNDERSCORE = "_";
+    var TRAILING_WILD_CARD_REPLACERS = {
+      [MODE_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      },
+      [MODE_CHECK_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      }
+    };
+    var WILDCARD = "[^\\/]*";
+    var pinWildcards = (source) => {
+      if (source.indexOf(WILDCARD) < 0) {
+        return source;
+      }
+      const tokens = [];
+      const { length } = source;
+      let index = 0;
+      while (index < length) {
+        const char = source[index];
+        if (source.startsWith(WILDCARD, index)) {
+          tokens.push({ wildcard: true });
+          index += WILDCARD.length;
+        } else if (char === "[") {
+          let end = index + 1;
+          if (source[end] === "^") {
+            end++;
+          }
+          if (source[end] === "]") {
+            end++;
+          }
+          while (end < length && source[end] !== "]") {
+            end += source[end] === ESCAPE ? 2 : 1;
+          }
+          end++;
+          tokens.push({ single: source.slice(index, end) });
+          index = end;
+        } else if (char === ESCAPE) {
+          tokens.push({ single: source.slice(index, index + 2) });
+          index += 2;
+        } else if (char === "(") {
+          let depth = 0;
+          let end = index;
+          do {
+            if (source[end] === ESCAPE) {
+              end++;
+            } else if (source[end] === "(") {
+              depth++;
+            } else if (source[end] === ")") {
+              depth--;
+            }
+            end++;
+          } while (end < length && depth > 0);
+          if ("*+?".indexOf(source[end]) >= 0) {
+            end++;
+          }
+          tokens.push({ boundary: source.slice(index, end) });
+          index = end;
+        } else if (char === "^" || char === "$") {
+          tokens.push({ boundary: char });
+          index++;
+        } else {
+          tokens.push({ single: char });
+          index++;
+        }
+      }
+      let out = EMPTY;
+      let run2 = [];
+      const flush = () => {
+        let lastWildcard;
+        run2.forEach((token, at) => {
+          if (token.wildcard) {
+            lastWildcard = at;
+          }
+        });
+        run2.forEach((token, at) => {
+          if (!token.wildcard) {
+            out += token.single;
+            return;
+          }
+          out += at === lastWildcard ? WILDCARD : `(?:(?!${run2[at + 1].single})[^\\/])*`;
+        });
+        run2 = [];
+      };
+      tokens.forEach((token) => {
+        if (token.boundary === void 0) {
+          run2.push(token);
+          return;
+        }
+        flush();
+        out += token.boundary;
+      });
+      flush();
+      return out;
+    };
+    var makeRegexPrefix = (pattern) => {
+      const { source, sources } = extractBrackets(pattern);
+      const replaced = REPLACERS.reduce(
+        // A pass whose matcher finds nothing hands back the very string it was
+        //   given, so asking first costs a search and saves a rewrite. Ten of the
+        //   fifteen passes never fire for a typical .gitignore line, and between
+        //   them they were 45% of this chain.
+        (prev, [matcher, replacer, required]) => {
+          if (matcher === DIRECT) {
+            return replacer(prev, pattern);
+          }
+          if (required !== UNDEFINED && prev.indexOf(required) < 0) {
+            return prev;
+          }
+          return matcher.test(prev) ? prev.replace(matcher, replacer.bind(pattern)) : prev;
+        },
+        source
+      );
+      return sources.length ? replaced.replace(
+        REGEX_RESTORE_PLACEHOLDER,
+        (match, index) => sources[index]
+      ) : replaced;
+    };
+    var matchesBasename = (body) => {
+      const index = body.indexOf(SLASH);
+      return index < 0 || index === body.length - 1;
+    };
+    var basenameOf = (path) => {
+      const end = path.length - 1;
+      const index = path.lastIndexOf(
+        SLASH,
+        path[end] === SLASH ? end - 1 : end
+      );
+      return index < 0 ? path : path.slice(index + 1);
+    };
+    var parentOf = (path) => {
+      if (path.charCodeAt(0) === SLASH_CODE || path.indexOf(DOUBLE_SLASH) >= 0) {
+        const slices = path.split(SLASH).filter(Boolean);
+        slices.pop();
+        return slices.length ? slices.join(SLASH) + SLASH : EMPTY;
+      }
+      const end = path.length - 1;
+      const cut = path.lastIndexOf(
+        SLASH,
+        path.charCodeAt(end) === SLASH_CODE ? end - 1 : end
+      );
+      return cut < 0 ? EMPTY : path.slice(0, cut + 1);
+    };
+    var isString = (subject) => typeof subject === "string";
+    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
+    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+    var IgnoreRule = class {
+      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+        this.pattern = pattern;
+        this.mark = mark;
+        this.negative = negative;
+        define(this, "body", body);
+        define(this, "ignoreCase", ignoreCase);
+        define(this, "regexPrefix", prefix);
+      }
+      // Worked out on first use and kept behind an own property, the way `regex`
+      //   caches itself in `_regex`. Deciding it in the constructor instead would
+      //   add a fourth `defineProperty` to every rule ever built, which cost 4% of
+      //   every compile -- including the compiles of rules that are never matched
+      //   against anything.
+      get _basenameOnly() {
+        return define(this, "_basenameOnly", matchesBasename(this.body));
+      }
+      get regex() {
+        const key = UNDERSCORE + MODE_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_IGNORE, key);
+      }
+      get checkRegex() {
+        const key = UNDERSCORE + MODE_CHECK_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_CHECK_IGNORE, key);
+      }
+      _make(mode, key) {
+        const str = pinWildcards(this.regexPrefix.replace(
+          REGEX_REPLACE_TRAILING_WILDCARD,
+          // It does not need to bind pattern
+          TRAILING_WILD_CARD_REPLACERS[mode]
+        ));
+        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+        return define(this, key, regex);
+      }
+    };
+    var createRule = ({
+      pattern,
+      mark
+    }, ignoreCase) => {
+      let negative = false;
+      let body = pattern;
+      if (body.indexOf("!") === 0) {
+        negative = true;
+        body = body.substr(1);
+      }
+      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+      const regexPrefix = makeRegexPrefix(body);
+      return new IgnoreRule(
+        pattern,
+        mark,
+        body,
+        ignoreCase,
+        negative,
+        regexPrefix
+      );
+    };
+    var RuleManager = class {
+      constructor(ignoreCase) {
+        this._ignoreCase = ignoreCase;
+        this._rules = [];
+        this._basenameCount = 0;
+      }
+      _add(pattern) {
+        if (pattern && pattern[KEY_IGNORE]) {
+          this._rules = this._rules.concat(pattern._rules._rules);
+          this._basenameCount += pattern._rules._basenameCount;
+          this._added = true;
+          return;
+        }
+        if (isString(pattern)) {
+          pattern = {
+            pattern
+          };
+        }
+        if (checkPattern(pattern.pattern)) {
+          const rule = createRule(pattern, this._ignoreCase);
+          this._added = true;
+          this._rules.push(rule);
+          if (matchesBasename(rule.body)) {
+            this._basenameCount++;
+          }
+        }
+      }
+      // @param {Array<string> | string | Ignore} pattern
+      add(pattern) {
+        this._added = false;
+        makeArray(
+          isString(pattern) ? splitPattern(pattern) : pattern
+        ).forEach(this._add, this);
+        return this._added;
+      }
+      // Test one single path without recursively checking parent directories
+      //
+      // - checkUnignored `boolean` whether should check if the path is unignored,
+      //   setting `checkUnignored` to `false` could reduce additional
+      //   path matching.
+      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
+      // @returns {TestResult} true if a file is ignored
+      test(path, checkUnignored, mode) {
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        const rules = this._rules;
+        const { length } = rules;
+        const shortcut = this._basenameCount * 2 >= length;
+        const basename3 = shortcut ? basenameOf(path) : path;
+        for (let index = 0; index < length; index++) {
+          const rule = rules[index];
+          const { negative } = rule;
+          const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
+          if (!skip && rule[mode].test(
+            shortcut && rule._basenameOnly ? basename3 : path
+          )) {
+            ignored = !negative;
+            unignored = negative;
+            matchedRule = negative ? UNDEFINED : rule;
+          }
+        }
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+    };
+    var throwError = (message, Ctor) => {
+      throw new Ctor(message);
+    };
+    var checkPath = (path, originalPath, doThrow) => {
+      if (!isString(path)) {
+        return doThrow(
+          `path must be a string, but got \`${originalPath}\``,
+          TypeError
+        );
+      }
+      if (!path) {
+        return doThrow(`path must not be empty`, TypeError);
+      }
+      if (checkPath.isNotRelative(path)) {
+        const r = "`path.relative()`d";
+        return doThrow(
+          `path should be a ${r} string, but got "${originalPath}"`,
+          RangeError
+        );
+      }
+      return true;
+    };
+    var isNotRelative = (path) => {
+      const first = path.charCodeAt(0);
+      if (first === SLASH_CODE) {
+        return true;
+      }
+      if (first !== DOT_CODE) {
+        return false;
+      }
+      if (path.length === 1) {
+        return true;
+      }
+      const second = path.charCodeAt(1);
+      if (second === SLASH_CODE) {
+        return true;
+      }
+      if (second !== DOT_CODE) {
+        return false;
+      }
+      return path.length === 2 || path.charCodeAt(2) === SLASH_CODE;
+    };
+    checkPath.isNotRelative = isNotRelative;
+    checkPath.convert = (p) => p;
+    var Ignore = class {
+      constructor({
+        ignorecase = true,
+        ignoreCase = ignorecase,
+        allowRelativePaths = false
+      } = {}) {
+        define(this, KEY_IGNORE, true);
+        this._rules = new RuleManager(ignoreCase);
+        this._strictPathCheck = !allowRelativePaths;
+        this._initCache();
+      }
+      _initCache() {
+        this._ignoreCache = /* @__PURE__ */ Object.create(null);
+        this._testCache = /* @__PURE__ */ Object.create(null);
+      }
+      add(pattern) {
+        if (this._rules.add(pattern)) {
+          this._initCache();
+        }
+        return this;
+      }
+      // legacy
+      addPattern(pattern) {
+        return this.add(pattern);
+      }
+      // @returns {TestResult}
+      _test(originalPath, cache, checkUnignored) {
+        const path = originalPath && checkPath.convert(originalPath);
+        checkPath(
+          path,
+          originalPath,
+          this._strictPathCheck ? throwError : RETURN_FALSE
+        );
+        return this._t(path, cache, checkUnignored);
+      }
+      checkIgnore(path) {
+        if (path.charCodeAt(path.length - 1) !== SLASH_CODE) {
+          return this.test(path);
+        }
+        const parentPath = parentOf(path);
+        if (parentPath) {
+          const parent = this._t(parentPath, this._testCache, true);
+          if (parent.ignored) {
+            return parent;
+          }
+        }
+        return this._rules.test(path, false, MODE_CHECK_IGNORE);
+      }
+      _t(path, cache, checkUnignored) {
+        if (path in cache) {
+          return cache[path];
+        }
+        const parentPath = parentOf(path);
+        const parent = parentPath ? this._t(parentPath, cache, checkUnignored) : UNDEFINED;
+        return cache[path] = parent && parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
+      }
+      ignores(path) {
+        return this._test(path, this._ignoreCache, false).ignored;
+      }
+      createFilter() {
+        return (path) => !this.ignores(path);
+      }
+      filter(paths) {
+        return makeArray(paths).filter(this.createFilter());
+      }
+      // @returns {TestResult}
+      test(path) {
+        return this._test(path, this._testCache, true);
+      }
+    };
+    var factory = (options) => new Ignore(options);
+    var isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
+    var setupWindows = () => {
+      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+      checkPath.convert = makePosix;
+      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+      checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
+    };
+    if (
+      // Detect `process` so that it can run in browsers.
+      typeof process !== "undefined" && process.platform === "win32"
+    ) {
+      setupWindows();
+    }
+    module.exports = factory;
+    factory.default = factory;
+    module.exports.isPathValid = isPathValid;
+    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
+  }
+});
+
+// src/dev/bridge.ts
+function mapErrorCode(code, status2) {
+  if (code === "invalid_input") return "INVALID_INPUT";
+  if (code === "not_found") return "NOT_FOUND";
+  if (code === "conflict") return "CONFLICT";
+  if (code === "forbidden") return "UNDECLARED";
+  if (status2 === 401) return "UNDECLARED";
+  return "UNAVAILABLE";
+}
+function devRuntimeBody(invoke, appId) {
+  if (invoke.service === "ai") {
+    return {
+      service: "ai",
+      args: invoke.input.args ?? {},
+      ...appId ? { app_id: appId } : {}
+    };
+  }
+  if (invoke.service === "capabilities") {
+    return {
+      service: "capabilities",
+      capability: invoke.input.capability,
+      args: invoke.input.args ?? {},
+      ...invoke.input.requestId ? { request_id: invoke.input.requestId } : {}
+    };
+  }
+  return {
+    service: "connections",
+    connector: invoke.input.connector,
+    ...invoke.input.connection ? { connection: invoke.input.connection } : {},
+    operation: invoke.input.operation,
+    args: invoke.input.args ?? {},
+    ...appId ? { app_id: appId } : {}
+  };
+}
+async function bridgeInvoke(dependencies, invoke) {
+  const fetcher = dependencies.fetcher ?? fetch;
+  let response;
+  try {
+    response = await fetcher(`${dependencies.apiUrl}/v1/dev/runtime`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${dependencies.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(devRuntimeBody(invoke, dependencies.appId)),
+      signal: AbortSignal.timeout(6e4)
+    });
+  } catch {
+    throw new BridgeError({
+      code: "UNAVAILABLE",
+      message: "Marina is unreachable \u2014 bridged calls need a network connection",
+      retryable: true
+    });
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new BridgeError({
+      code: "UNAVAILABLE",
+      message: "Marina returned an invalid response",
+      retryable: true
+    });
+  }
+  if (!response.ok) {
+    const error = body.error ?? {};
+    throw new BridgeError({
+      code: mapErrorCode(error.code ?? "", response.status),
+      message: error.message ?? `bridged call failed (${String(response.status)})`,
+      retryable: response.status >= 500
+    });
+  }
+  return body.value;
+}
+var BridgeError;
+var init_bridge = __esm({
+  "src/dev/bridge.ts"() {
+    "use strict";
+    BridgeError = class extends Error {
+      payload;
+      constructor(payload) {
+        super(payload.message);
+        this.payload = payload;
+      }
+    };
+  }
+});
+
+// src/dev/binding.ts
+function undeclared(service, declaration) {
+  return failure2(
+    "UNDECLARED",
+    `this app does not declare ${service} \u2014 add ${declaration} to marina.json`
+  );
+}
+function createDevBinding(context) {
+  return {
+    async invoke(request2) {
+      try {
+        switch (request2.service) {
+          case "storage": {
+            if (!context.storage) return undeclared("storage", 'runtime.storage: "v1"');
+            const input = request2.input;
+            if (request2.operation === "put") return ok(context.storage.put(input));
+            if (request2.operation === "get")
+              return ok(context.storage.get(input.key));
+            if (request2.operation === "delete") {
+              context.storage.delete(input.key);
+              return ok(null);
+            }
+            if (request2.operation === "list") return ok(context.storage.list(input));
+            return failure2("INVALID_INPUT", `unsupported storage operation ${request2.operation}`);
+          }
+          case "db": {
+            if (!context.database) return undeclared("the managed database", 'runtime.db: "v1"');
+            if (request2.operation === "query") {
+              const query = request2.input;
+              return ok(await context.database.query(query.text, query.params));
+            }
+            if (request2.operation === "transaction") {
+              const { queries } = request2.input;
+              return ok(await context.database.transaction(queries));
+            }
+            return failure2("INVALID_INPUT", `unsupported db operation ${request2.operation}`);
+          }
+          case "ai": {
+            if (!context.manifest.runtime.ai) return undeclared("ai", 'runtime.ai: "v1"');
+            if (request2.operation !== "generate")
+              return failure2("INVALID_INPUT", `unsupported ai operation ${request2.operation}`);
+            return ok(
+              await bridgeInvoke(context.bridge, {
+                service: "ai",
+                input: { args: request2.input }
+              })
+            );
+          }
+          case "jobs": {
+            if (!context.jobs) return undeclared("background jobs", 'runtime.jobs: "v1"');
+            if (request2.operation === "enqueue") {
+              const input = request2.input;
+              const status2 = context.jobs.enqueue(input);
+              return ok({ id: status2.id, state: status2.state });
+            }
+            if (request2.operation === "get") {
+              const { runId } = request2.input;
+              const status2 = context.jobs.get(runId);
+              return status2 ? ok(status2) : failure2("NOT_FOUND", "no such job run");
+            }
+            return failure2("INVALID_INPUT", `unsupported jobs operation ${request2.operation}`);
+          }
+          case "capabilities":
+          case "connections":
+            return ok(
+              await bridgeInvoke(context.bridge, {
+                service: request2.service,
+                input: request2.input
+              })
+            );
+          default:
+            return failure2("UNDECLARED", `unsupported runtime service ${request2.service}`);
+        }
+      } catch (error) {
+        if (error instanceof BridgeError) return { ok: false, error: error.payload };
+        return failure2("INVALID_INPUT", error.message);
+      }
+    },
+    async authorizeJob(request2) {
+      return context.jobs ? context.jobs.authorizeJob(request2) : false;
+    }
+  };
+}
+var ok, failure2;
+var init_binding = __esm({
+  "src/dev/binding.ts"() {
+    "use strict";
+    init_bridge();
+    ok = (value) => ({ ok: true, value });
+    failure2 = (code, message, retryable = false) => ({
+      ok: false,
+      error: { code, message, retryable }
+    });
+  }
+});
+
+// src/dev/db.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+function normalizeValue(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  if (typeof value === "bigint") {
+    return value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value.toString();
+  }
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("base64");
+  if (Array.isArray(value)) return value.map(normalizeValue);
+  if (typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        normalizeValue(entry)
+      ])
+    );
+  }
+  return String(value);
+}
+function normalizeRow(row) {
+  if (!row || typeof row !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(row).map(([key, value]) => [
+      key,
+      normalizeValue(value)
+    ])
+  );
+}
+var LocalDatabase;
+var init_db = __esm({
+  "src/dev/db.ts"() {
+    "use strict";
+    LocalDatabase = class _LocalDatabase {
+      db;
+      constructor(db) {
+        this.db = db;
+      }
+      static async open(dataDir) {
+        let module;
+        try {
+          module = await import("@electric-sql/pglite");
+        } catch {
+          throw new Error(
+            "the embedded Postgres could not load \u2014 reinstall the Marina CLI (@electric-sql/pglite is missing)"
+          );
+        }
+        mkdirSync3(dataDir, { recursive: true });
+        return new _LocalDatabase(new module.PGlite(dataDir));
+      }
+      /** Apply the app's marina/migrations in name order, once each — the same
+       * files a deploy applies to the managed database. */
+      async applyMigrations(projectDir) {
+        const directory = join5(projectDir, "marina", "migrations");
+        await this.db.exec(
+          "create table if not exists marina_dev_migrations (name text primary key, applied_at timestamptz not null default now())"
+        );
+        if (!existsSync5(directory)) return [];
+        const files = readdirSync2(directory).filter((file) => file.endsWith(".sql")).toSorted();
+        const applied = [];
+        for (const file of files) {
+          const seen = await this.db.query("select 1 from marina_dev_migrations where name = $1", [
+            file
+          ]);
+          if (seen.rows.length > 0) continue;
+          const source = readFileSync5(join5(directory, file), "utf8");
+          await this.db.transaction(async (tx) => {
+            await tx.exec(source);
+            await tx.query("insert into marina_dev_migrations (name) values ($1)", [file]);
+          });
+          applied.push(file);
+        }
+        return applied;
+      }
+      async query(text, params) {
+        const result2 = await this.db.query(text, params);
+        const rows = result2.rows.map(normalizeRow);
+        return { rows, rowCount: rows.length > 0 ? rows.length : result2.affectedRows ?? 0 };
+      }
+      async transaction(queries) {
+        return this.db.transaction(async (tx) => {
+          const results = [];
+          for (const query of queries) {
+            const result2 = await tx.query(query.text, query.params);
+            const rows = result2.rows.map(normalizeRow);
+            results.push({
+              rows,
+              rowCount: rows.length > 0 ? rows.length : result2.affectedRows ?? 0
+            });
+          }
+          return results;
+        });
+      }
+    };
+  }
+});
+
+// src/dev/chrome.ts
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function devChromeSnippet(input) {
+  return `<div id="__marina-dev-chrome" style="position:fixed;right:12px;bottom:12px;z-index:2147483647;display:flex;align-items:center;gap:8px;background:#121316;color:#e5e7ea;border:1px solid #2a2e34;border-radius:8px;padding:6px 12px;font:500 12px/1.4 ui-sans-serif,system-ui;box-shadow:0 4px 16px rgb(0 0 0 / 0.25)">
+  <span style="width:8px;height:8px;border-radius:99px;background:#e0a24a"></span>
+  <span>${escapeHtml(input.appName)} \xB7 local dev \xB7 ${escapeHtml(input.userLabel)}</span>
+</div>`;
+}
+function injectDevChrome(html, snippet) {
+  const marker = /<\/body\s*>/i.exec(html);
+  if (!marker) return html + snippet;
+  return html.slice(0, marker.index) + snippet + html.slice(marker.index);
+}
+var init_chrome = __esm({
+  "src/dev/chrome.ts"() {
+    "use strict";
+  }
+});
+
+// src/dev/embedded-runtime.ts
+var DEV_RUNTIME_FILES;
+var init_embedded_runtime = __esm({
+  "src/dev/embedded-runtime.ts"() {
+    "use strict";
+    DEV_RUNTIME_FILES = {
+      "ai.ts": 'import type {\n  AIGenerateInput,\n  AIGenerateResult,\n  AIMessage,\n  MarinaRuntimeBinding,\n} from "./contract.js";\nimport {\n  MAX_AI_INPUT_BYTES,\n  MAX_AI_MESSAGE_BYTES,\n  MAX_AI_MESSAGES,\n  MAX_AI_OUTPUT_TOKENS,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst MESSAGE_ROLES = new Set(["system", "user", "assistant"]);\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\n/** Validate the portable chat contract before any provider or substrate sees\n * application content. The broker repeats the same bounded checks. */\nexport function assertAIGenerateInput(value: AIGenerateInput): AIGenerateInput {\n  if (!value || typeof value !== "object" || Array.isArray(value))\n    invalid("AI generation input must be an object");\n  if (typeof value.model !== "string" || value.model.length === 0 || value.model.length > 200)\n    invalid("AI model must be fast, smart, or a model id from Marina\'s model library");\n  if (!Array.isArray(value.messages) || value.messages.length === 0)\n    invalid("AI generation requires at least one message");\n  if (value.messages.length > MAX_AI_MESSAGES)\n    invalid(`AI generation may contain at most ${String(MAX_AI_MESSAGES)} messages`);\n\n  let inputBytes = 0;\n  const messages: AIMessage[] = value.messages.map((message) => {\n    if (!message || typeof message !== "object" || Array.isArray(message))\n      invalid("AI messages must be objects");\n    if (typeof message.role !== "string" || !MESSAGE_ROLES.has(message.role))\n      invalid("AI message role must be system, user, or assistant");\n    if (typeof message.content !== "string" || message.content.length === 0)\n      invalid("AI message content must not be empty");\n    if (/\\p{Cc}/u.test(message.content.replaceAll("\\n", "").replaceAll("\\t", "")))\n      invalid("AI message content contains unsupported control characters");\n    const bytes = encoder.encode(message.content).byteLength;\n    if (bytes > MAX_AI_MESSAGE_BYTES)\n      invalid(`AI messages must not exceed ${String(MAX_AI_MESSAGE_BYTES)} bytes each`);\n    inputBytes += bytes;\n    return { role: message.role, content: message.content };\n  });\n  if (inputBytes > MAX_AI_INPUT_BYTES)\n    invalid(`AI generation input must not exceed ${String(MAX_AI_INPUT_BYTES)} bytes`);\n\n  if (\n    value.maxOutputTokens !== undefined &&\n    (!Number.isSafeInteger(value.maxOutputTokens) ||\n      value.maxOutputTokens < 1 ||\n      value.maxOutputTokens > MAX_AI_OUTPUT_TOKENS)\n  )\n    invalid(`AI output tokens must be between 1 and ${String(MAX_AI_OUTPUT_TOKENS)}`);\n\n  return {\n    model: value.model,\n    messages,\n    ...(value.maxOutputTokens === undefined ? {} : { maxOutputTokens: value.maxOutputTokens }),\n  };\n}\n\nexport interface MarinaAI {\n  /** Generate bounded text using a Marina-managed model class. Provider names,\n   * credentials, routing, and quota state never enter the app contract. */\n  generate(input: AIGenerateInput): Promise<AIGenerateResult>;\n}\n\nexport function createAI(binding: MarinaRuntimeBinding): MarinaAI {\n  return {\n    async generate(input) {\n      return invokeRuntime(binding, "ai", "generate", assertAIGenerateInput(input));\n    },\n  };\n}\n',
+      "capabilities.ts": 'import type { DatabaseValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_CAPABILITY_INPUT_BYTES, MAX_CAPABILITY_SESSION_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst CAPABILITY_NAME = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$/;\nconst REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nfunction capabilityArgs(value: unknown): DatabaseValue {\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("capability arguments must be JSON compatible");\n  }\n  if (serialized === undefined) invalid("capability arguments must be JSON compatible");\n  if (encoder.encode(serialized).byteLength > MAX_CAPABILITY_INPUT_BYTES)\n    invalid(`capability arguments must not exceed ${String(MAX_CAPABILITY_INPUT_BYTES)} bytes`);\n  return value as DatabaseValue;\n}\n\nexport interface CapabilityInvokeOptions {\n  /** Stable idempotency identity for edit-effect Capability retries. */\n  requestId?: string;\n}\n\nexport interface MarinaCapabilities {\n  invoke<Result = unknown>(\n    name: string,\n    args?: DatabaseValue,\n    options?: CapabilityInvokeOptions,\n  ): Promise<Result>;\n}\n\nexport function createCapabilities(\n  binding: MarinaRuntimeBinding,\n  session?: string,\n): MarinaCapabilities {\n  return {\n    invoke<Result>(name: string, args: DatabaseValue = {}, options: CapabilityInvokeOptions = {}) {\n      if (!session) {\n        throw new MarinaRuntimeError({\n          code: "UNAVAILABLE",\n          message: "Capability calls require an authenticated app request",\n          retryable: false,\n        });\n      }\n      if (encoder.encode(session).byteLength > MAX_CAPABILITY_SESSION_BYTES)\n        invalid("invalid Capability session");\n      if (typeof name !== "string" || name.length > 200 || !CAPABILITY_NAME.test(name))\n        invalid("invalid Capability name");\n      if (options.requestId !== undefined && !REQUEST_ID.test(options.requestId))\n        invalid("invalid Capability request id");\n      return invokeRuntime<Result>(binding, "capabilities", "invoke", {\n        session,\n        capability: name,\n        args: capabilityArgs(args),\n        ...(options.requestId ? { requestId: options.requestId } : {}),\n      });\n    },\n  };\n}\n',
+      "connections.ts": 'import type { DatabaseValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_CAPABILITY_INPUT_BYTES, MAX_CAPABILITY_SESSION_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst SEGMENT = /^[a-z][a-z0-9_]{0,39}$/;\nconst OPERATION = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$/;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nexport interface ConnectionInvokeRequest {\n  connector: string;\n  /** Explicit connection id; optional when the app declares exactly one\n   * connection of this connector. */\n  connection?: string;\n  operation: string;\n  args?: DatabaseValue;\n}\n\nexport type MarinaConnectionOperationInput = { connection?: string } & Record<string, unknown>;\nexport type MarinaConnectionCall = (input?: MarinaConnectionOperationInput) => Promise<unknown>;\nexport type MarinaConnectionNamespace = MarinaConnectionCall & {\n  readonly [segment: string]: MarinaConnectionNamespace;\n};\nexport type MarinaConnections = {\n  invoke<Result = unknown>(request: ConnectionInvokeRequest): Promise<Result>;\n} & { readonly [connector: string]: MarinaConnectionNamespace };\n\nfunction boundedArgs(value: unknown): DatabaseValue {\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("connection operation input must be JSON compatible");\n  }\n  if (serialized === undefined) invalid("connection operation input must be JSON compatible");\n  if (encoder.encode(serialized).byteLength > MAX_CAPABILITY_INPUT_BYTES)\n    invalid(\n      `connection operation input must not exceed ${String(MAX_CAPABILITY_INPUT_BYTES)} bytes`,\n    );\n  return value as DatabaseValue;\n}\n\n/**\n * `marina.connections.<connector>.<operation>(input)` \u2014 a dynamic path so the\n * runtime ships no connector catalog; the control plane owns validation and\n * authorization. `input.connection` names one of the app\'s declared\n * connections and is required only when the manifest declares several of the\n * same connector.\n */\nexport function createConnections(\n  binding: MarinaRuntimeBinding,\n  session?: string,\n): MarinaConnections {\n  const invoke = <Result = unknown>(request: ConnectionInvokeRequest): Promise<Result> => {\n    if (!session) {\n      throw new MarinaRuntimeError({\n        code: "UNAVAILABLE",\n        message: "Connection calls require an authenticated app request",\n        retryable: false,\n      });\n    }\n    if (encoder.encode(session).byteLength > MAX_CAPABILITY_SESSION_BYTES)\n      invalid("invalid connection session");\n    if (typeof request.connector !== "string" || !SEGMENT.test(request.connector))\n      invalid("invalid connector name");\n    if (\n      request.connection !== undefined &&\n      (typeof request.connection !== "string" || !SEGMENT.test(request.connection))\n    )\n      invalid("invalid connection id");\n    if (\n      typeof request.operation !== "string" ||\n      request.operation.length > 200 ||\n      !OPERATION.test(request.operation)\n    )\n      invalid("invalid connection operation");\n    return invokeRuntime<Result>(binding, "connections", "invoke", {\n      session,\n      connector: request.connector,\n      ...(request.connection ? { connection: request.connection } : {}),\n      operation: request.operation,\n      args: boundedArgs(request.args ?? {}),\n    });\n  };\n\n  const operationPath = (connector: string, segments: readonly string[]) => {\n    const callable = (input: MarinaConnectionOperationInput = {}): Promise<unknown> => {\n      if (segments.length < 2) invalid("call a connection operation such as orders.list");\n      if (!input || typeof input !== "object" || Array.isArray(input))\n        invalid("connection operation input must be an object");\n      const { connection, ...args } = input;\n      if (connection !== undefined && (typeof connection !== "string" || !SEGMENT.test(connection)))\n        invalid("invalid connection id");\n      return invoke({\n        connector,\n        ...(connection ? { connection } : {}),\n        operation: segments.join("."),\n        args: args as DatabaseValue,\n      });\n    };\n    const path: MarinaConnectionNamespace = new Proxy(callable, {\n      get(_target, property) {\n        if (typeof property !== "string" || property === "then" || !SEGMENT.test(property))\n          return undefined;\n        return operationPath(connector, [...segments, property]);\n      },\n    }) as unknown as MarinaConnectionNamespace;\n    return path;\n  };\n\n  return new Proxy(\n    { invoke },\n    {\n      get(target, property) {\n        if (property === "invoke") return target.invoke;\n        if (typeof property !== "string" || property === "then" || !SEGMENT.test(property))\n          return undefined;\n        return operationPath(property, []);\n      },\n    },\n  ) as MarinaConnections;\n}\n',
+      "contract.ts": `/** The versioned provider-neutral protocol between an app and Marina. */
+export const MARINA_RUNTIME_PROTOCOL_VERSION = 1 as const;
+export const MAX_STORAGE_KEY_BYTES = 900;
+export const MAX_STORAGE_OBJECT_BYTES = 64 * 1024 * 1024;
+export const MAX_CAPABILITY_INPUT_BYTES = 256 * 1024;
+export const MAX_CAPABILITY_SESSION_BYTES = 4096;
+export const MAX_CAPABILITY_RESULT_BYTES = 32 * 1024 * 1024;
+export const MAX_DATABASE_QUERY_BYTES = 100 * 1024;
+export const MAX_DATABASE_PARAMETERS = 100;
+export const MAX_DATABASE_PARAMETER_BYTES = 1024 * 1024;
+export const MAX_DATABASE_TRANSACTION_QUERIES = 25;
+export const MAX_AI_MESSAGES = 64;
+export const MAX_AI_MESSAGE_BYTES = 32 * 1024;
+export const MAX_AI_INPUT_BYTES = 128 * 1024;
+export const MAX_AI_OUTPUT_TOKENS = 4096;
+export const MAX_JOB_INPUT_BYTES = 256 * 1024;
+export const MAX_JOB_VALUE_DEPTH = 32;
+export const MAX_JOB_INVOCATION_BYTES = MAX_JOB_INPUT_BYTES + 128 * 1024;
+export const MARINA_JOB_EXECUTION_PATH = "/.marina/runtime/jobs/execute";
+
+/** Stable service identifiers carried by the broker protocol. */
+export type MarinaRuntimeService =
+  | "storage"
+  | "db"
+  | "ai"
+  | "jobs"
+  | "capabilities"
+  | "connections";
+
+export type StorageOperation = "put" | "get" | "delete" | "list";
+
+export interface MarinaRuntimeRequest {
+  protocolVersion: typeof MARINA_RUNTIME_PROTOCOL_VERSION;
+  /** Unique identity for this individual broker call. */
+  requestId: string;
+  service: MarinaRuntimeService;
+  operation: string;
+  input: unknown;
+}
+
+export type MarinaRuntimeErrorCode =
+  | "UNAVAILABLE"
+  | "UNDECLARED"
+  | "INVALID_INPUT"
+  | "NOT_FOUND"
+  | "QUOTA_EXCEEDED"
+  | "CONFLICT"
+  | "INTERNAL";
+
+export interface MarinaRuntimeErrorPayload {
+  code: MarinaRuntimeErrorCode;
+  message: string;
+  retryable: boolean;
+}
+
+export type MarinaRuntimeResponse =
+  | { ok: true; value: unknown }
+  | { ok: false; error: MarinaRuntimeErrorPayload };
+
+/**
+ * The substrate supplies this object-capability. Applications never receive
+ * the provider resources, credentials, or namespace identifiers behind it.
+ */
+export interface MarinaRuntimeBinding {
+  invoke(request: MarinaRuntimeRequest): Promise<MarinaRuntimeResponse>;
+  /** Internal substrate callback used only by defineApp's job adapter. The
+   * application receives no signing key or provider dispatch primitive. */
+  authorizeJob?(request: MarinaJobAuthorizationRequest): Promise<boolean>;
+}
+
+export type JobValue = DatabaseValue;
+export type JobTrigger = "enqueue" | "schedule";
+export type JobState = "queued" | "running" | "succeeded" | "failed";
+
+export interface JobEnqueueInput {
+  name: string;
+  input: JobValue;
+  dedupeKey?: string;
+}
+
+export interface JobEnqueueResult {
+  id: string;
+  state: JobState;
+}
+
+export interface JobStatus {
+  id: string;
+  name: string;
+  state: JobState;
+  attempts: number;
+  createdAt: string;
+  startedAt?: string;
+  finishedAt?: string;
+}
+
+export interface MarinaJobInvocation {
+  runId: string;
+  workspaceId: string;
+  appId: string;
+  artifactDigest: string;
+  environment: "development" | "preview" | "production";
+  jobName: string;
+  handler: string;
+  input: JobValue;
+  attempt: number;
+  trigger: JobTrigger;
+  scheduledFor?: string;
+  /** Opaque, run-bound delegation consumed by the runtime adapter. It is not
+   * exposed to the application handler or job context. */
+  capabilitySession?: string;
+}
+
+export interface MarinaJobAuthorizationRequest {
+  token: string;
+  body: string;
+}
+
+export interface StoragePutInput {
+  key: string;
+  body: string | Uint8Array | ArrayBuffer;
+  contentType?: string;
+  metadata?: Record<string, string>;
+}
+
+export interface StorageGetInput {
+  key: string;
+}
+
+export interface StorageDeleteInput {
+  key: string;
+}
+
+export interface StorageListInput {
+  prefix?: string;
+  cursor?: string;
+  limit?: number;
+}
+
+export interface StorageObjectMetadata {
+  key: string;
+  size: number;
+  etag: string;
+  uploadedAt: string;
+  contentType?: string;
+  metadata: Record<string, string>;
+}
+
+export interface StorageObject extends StorageObjectMetadata {
+  body: Uint8Array;
+}
+
+export interface StorageListResult {
+  objects: StorageObjectMetadata[];
+  cursor?: string;
+  truncated: boolean;
+}
+
+/** JSON-compatible values cross the provider-neutral broker boundary. Postgres
+ * dates, numerics, JSON, and arrays therefore keep deterministic wire shapes
+ * across Workers, local development, and future substrates. */
+export type DatabaseValue =
+  | null
+  | boolean
+  | number
+  | string
+  | DatabaseValue[]
+  | { [key: string]: DatabaseValue };
+
+export type DatabaseRow = Record<string, DatabaseValue>;
+
+export interface DatabaseQuery {
+  text: string;
+  params: DatabaseValue[];
+}
+
+export interface DatabaseResult<Row extends DatabaseRow = DatabaseRow> {
+  rows: Row[];
+  rowCount: number;
+}
+
+export type AIModelClass = "fast" | "smart";
+/** A stable class alias, or the id of a model from Marina's own model
+ * library. The broker validates explicit ids against the library it offers;
+ * provider model identifiers are never part of the app contract. */
+export type AIModel = AIModelClass | (string & {});
+export type AIMessageRole = "system" | "user" | "assistant";
+
+export interface AIMessage {
+  role: AIMessageRole;
+  content: string;
+}
+
+export interface AIGenerateInput {
+  model: AIModel;
+  messages: AIMessage[];
+  maxOutputTokens?: number;
+}
+
+export interface AIGenerateResult {
+  text: string;
+}
+
+/** Detect top-level Postgres transaction-control statements while ignoring
+ * quoted values, identifiers, dollar bodies, and nested comments. Marina owns
+ * the operation transaction on every substrate. */
+export function containsDatabaseTransactionControl(source: string): boolean {
+  let executable = "";
+  let index = 0;
+  let blockDepth = 0;
+  let state: "normal" | "single" | "double" | "line" | "block" | "dollar" = "normal";
+  let dollar = "";
+  while (index < source.length) {
+    const current = source[index] ?? "";
+    const next = source[index + 1] ?? "";
+    if (state === "normal") {
+      if (current === "-" && next === "-") {
+        state = "line";
+        executable += "  ";
+        index += 2;
+        continue;
+      }
+      if (current === "/" && next === "*") {
+        state = "block";
+        blockDepth = 1;
+        executable += "  ";
+        index += 2;
+        continue;
+      }
+      if (current === "'") state = "single";
+      else if (current === '"') state = "double";
+      else if (current === "$") {
+        const opener = /^\\$[A-Za-z_][A-Za-z0-9_]*\\$|^\\$\\$/.exec(source.slice(index))?.[0];
+        if (opener) {
+          state = "dollar";
+          dollar = opener;
+          executable += " ".repeat(opener.length);
+          index += opener.length;
+          continue;
+        }
+      }
+      executable += state === "normal" ? current : " ";
+      index++;
+      continue;
+    }
+    if (state === "line") {
+      if (current === "\\n") {
+        state = "normal";
+        executable += "\\n";
+      } else executable += " ";
+      index++;
+      continue;
+    }
+    if (state === "block") {
+      if (current === "/" && next === "*") {
+        blockDepth++;
+        executable += "  ";
+        index += 2;
+      } else if (current === "*" && next === "/") {
+        blockDepth--;
+        executable += "  ";
+        index += 2;
+        if (blockDepth === 0) state = "normal";
+      } else {
+        executable += current === "\\n" ? "\\n" : " ";
+        index++;
+      }
+      continue;
+    }
+    if (state === "dollar") {
+      if (source.startsWith(dollar, index)) {
+        executable += " ".repeat(dollar.length);
+        index += dollar.length;
+        state = "normal";
+      } else {
+        executable += current === "\\n" ? "\\n" : " ";
+        index++;
+      }
+      continue;
+    }
+    if (state === "single" && current === "'" && next === "'") {
+      executable += "  ";
+      index += 2;
+      continue;
+    }
+    if (state === "double" && current === '"' && next === '"') {
+      executable += "  ";
+      index += 2;
+      continue;
+    }
+    const closes =
+      (state === "single" && current === "'") || (state === "double" && current === '"');
+    executable += current === "\\n" ? "\\n" : " ";
+    index++;
+    if (closes) state = "normal";
+  }
+  return /(?:^|;)\\s*(?:abort\\b|begin\\b|start\\s+transaction\\b|commit\\b|end\\b|rollback\\b|savepoint\\b|release\\s+savepoint\\b|prepare\\s+transaction\\b|set\\s+transaction\\b|set\\s+session\\s+characteristics\\s+as\\s+transaction\\b)/i.test(
+    executable,
+  );
+}
+
+export function isRuntimeResponse(value: unknown): value is MarinaRuntimeResponse {
+  if (!value || typeof value !== "object") return false;
+  const response = value as Partial<MarinaRuntimeResponse>;
+  if (response.ok === true) return Object.hasOwn(response, "value");
+  if (response.ok !== false || !response.error || typeof response.error !== "object") return false;
+  return (
+    typeof response.error.code === "string" &&
+    typeof response.error.message === "string" &&
+    typeof response.error.retryable === "boolean"
+  );
+}
+`,
+      "database.ts": 'import type {\n  DatabaseQuery,\n  DatabaseResult,\n  DatabaseRow,\n  MarinaRuntimeBinding,\n} from "./contract.js";\nimport {\n  containsDatabaseTransactionControl,\n  MAX_DATABASE_PARAMETER_BYTES,\n  MAX_DATABASE_PARAMETERS,\n  MAX_DATABASE_QUERY_BYTES,\n  MAX_DATABASE_TRANSACTION_QUERIES,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst MAX_VALUE_DEPTH = 32;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nfunction assertJsonValue(value: unknown, depth = 0, seen = new Set<object>()): void {\n  if (depth > MAX_VALUE_DEPTH) invalid("database parameters are nested too deeply");\n  if (\n    value === null ||\n    typeof value === "string" ||\n    typeof value === "boolean" ||\n    (typeof value === "number" && Number.isFinite(value))\n  )\n    return;\n  if (!value || typeof value !== "object")\n    invalid("database parameters must contain only JSON-compatible values");\n  if (seen.has(value)) invalid("database parameters must not contain cycles");\n  seen.add(value);\n  if (Array.isArray(value)) {\n    for (const item of value) assertJsonValue(item, depth + 1, seen);\n  } else {\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null)\n      invalid("database parameters must contain only plain JSON objects");\n    for (const item of Object.values(value)) assertJsonValue(item, depth + 1, seen);\n  }\n  seen.delete(value);\n}\n\nfunction jsonBytes(value: unknown): number {\n  assertJsonValue(value);\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("database parameters must be JSON serializable");\n  }\n  if (serialized === undefined) invalid("database parameters must be JSON serializable");\n  return encoder.encode(serialized).byteLength;\n}\n\n/** Validate one provider-neutral parameterized Postgres query. Runtime SQL is\n * app-authored, but values remain separate so callers never need to interpolate\n * request data into SQL text. The broker repeats these checks at its boundary. */\nexport function assertDatabaseQuery(value: DatabaseQuery): DatabaseQuery {\n  if (!value || typeof value !== "object" || Array.isArray(value))\n    invalid("database query must be an object");\n  if (typeof value.text !== "string" || value.text.trim().length === 0)\n    invalid("database query text must not be empty");\n  if (value.text.includes("\\0")) invalid("database query text must not contain null bytes");\n  if (containsDatabaseTransactionControl(value.text))\n    invalid("database transactions are managed by the Marina runtime");\n  if (encoder.encode(value.text).byteLength > MAX_DATABASE_QUERY_BYTES)\n    invalid(`database query text must not exceed ${String(MAX_DATABASE_QUERY_BYTES)} bytes`);\n  if (!Array.isArray(value.params)) invalid("database query parameters must be an array");\n  if (value.params.length > MAX_DATABASE_PARAMETERS)\n    invalid(`database queries may contain at most ${String(MAX_DATABASE_PARAMETERS)} parameters`);\n  if (jsonBytes(value.params) > MAX_DATABASE_PARAMETER_BYTES)\n    invalid(\n      `database query parameters must not exceed ${String(MAX_DATABASE_PARAMETER_BYTES)} bytes`,\n    );\n  return value;\n}\n\nexport interface MarinaDatabase {\n  /** Execute one parameterized statement against this app\'s private schema. */\n  query<Row extends DatabaseRow = DatabaseRow>(\n    text: string,\n    params?: DatabaseQuery["params"],\n  ): Promise<DatabaseResult<Row>>;\n\n  /** Execute a bounded list of statements atomically. Interactive transaction\n   * callbacks are intentionally absent so the contract works across edge and\n   * future non-Cloudflare substrates. */\n  transaction<Row extends DatabaseRow = DatabaseRow>(\n    queries: readonly DatabaseQuery[],\n  ): Promise<DatabaseResult<Row>[]>;\n}\n\nexport function createDatabase(binding: MarinaRuntimeBinding): MarinaDatabase {\n  return {\n    async query(text, params = []) {\n      const query = assertDatabaseQuery({ text, params });\n      return invokeRuntime(binding, "db", "query", query);\n    },\n\n    async transaction(queries) {\n      if (!Array.isArray(queries) || queries.length === 0)\n        invalid("database transaction must contain at least one query");\n      if (queries.length > MAX_DATABASE_TRANSACTION_QUERIES)\n        invalid(\n          `database transactions may contain at most ${String(MAX_DATABASE_TRANSACTION_QUERIES)} queries`,\n        );\n      const validated = queries.map((query) => assertDatabaseQuery(query));\n      return invokeRuntime(binding, "db", "transaction", { queries: validated });\n    },\n  };\n}\n',
+      "error.ts": 'import type { MarinaRuntimeErrorCode, MarinaRuntimeErrorPayload } from "./contract.js";\n\nexport class MarinaRuntimeError extends Error {\n  readonly code: MarinaRuntimeErrorCode;\n  readonly retryable: boolean;\n\n  constructor(payload: MarinaRuntimeErrorPayload) {\n    super(payload.message);\n    this.name = "MarinaRuntimeError";\n    this.code = payload.code;\n    this.retryable = payload.retryable;\n  }\n}\n',
+      "index.ts": 'import {\n  MARINA_JOB_EXECUTION_PATH,\n  MAX_JOB_INVOCATION_BYTES,\n  type MarinaRuntimeBinding,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { createStorage, type MarinaStorage } from "./storage.js";\nimport { createDatabase, type MarinaDatabase } from "./database.js";\nimport { createAI, type MarinaAI } from "./ai.js";\nimport { createJobs, type MarinaJobs } from "./jobs.js";\nimport { createCapabilities, type MarinaCapabilities } from "./capabilities.js";\nimport { createConnections, type MarinaConnections } from "./connections.js";\n\nexport type {\n  MarinaRuntimeBinding,\n  DatabaseQuery,\n  DatabaseResult,\n  DatabaseRow,\n  DatabaseValue,\n  AIGenerateInput,\n  AIGenerateResult,\n  AIMessage,\n  AIMessageRole,\n  AIModel,\n  AIModelClass,\n  JobEnqueueResult,\n  JobState,\n  JobStatus,\n  JobTrigger,\n  JobValue,\n  MarinaJobInvocation,\n  MarinaRuntimeErrorCode,\n  MarinaRuntimeErrorPayload,\n  MarinaRuntimeRequest,\n  MarinaRuntimeResponse,\n  StorageListResult,\n  StorageObject,\n  StorageObjectMetadata,\n} from "./contract.js";\nexport {\n  containsDatabaseTransactionControl,\n  MARINA_RUNTIME_PROTOCOL_VERSION,\n  MAX_STORAGE_KEY_BYTES,\n  MAX_STORAGE_OBJECT_BYTES,\n  MAX_CAPABILITY_INPUT_BYTES,\n  MAX_CAPABILITY_RESULT_BYTES,\n  MAX_CAPABILITY_SESSION_BYTES,\n  MAX_DATABASE_PARAMETER_BYTES,\n  MAX_DATABASE_PARAMETERS,\n  MAX_DATABASE_QUERY_BYTES,\n  MAX_DATABASE_TRANSACTION_QUERIES,\n  MAX_AI_INPUT_BYTES,\n  MAX_AI_MESSAGE_BYTES,\n  MAX_AI_MESSAGES,\n  MAX_AI_OUTPUT_TOKENS,\n  MAX_JOB_INPUT_BYTES,\n  MAX_JOB_INVOCATION_BYTES,\n  MAX_JOB_VALUE_DEPTH,\n  MARINA_JOB_EXECUTION_PATH,\n} from "./contract.js";\nexport { MarinaRuntimeError } from "./error.js";\nexport type { MarinaStorage, StorageListOptions, StoragePutOptions } from "./storage.js";\nexport type { MarinaDatabase } from "./database.js";\nexport { assertAIGenerateInput } from "./ai.js";\nexport type { MarinaAI } from "./ai.js";\nexport { assertJobName, assertJobValue } from "./jobs.js";\nexport type { JobEnqueueOptions, MarinaJobs } from "./jobs.js";\nexport type { CapabilityInvokeOptions, MarinaCapabilities } from "./capabilities.js";\nexport type {\n  ConnectionInvokeRequest,\n  MarinaConnectionNamespace,\n  MarinaConnectionOperationInput,\n  MarinaConnections,\n} from "./connections.js";\n\nexport interface MarinaRuntime {\n  storage: MarinaStorage;\n  db: MarinaDatabase;\n  ai: MarinaAI;\n  jobs: MarinaJobs;\n  capabilities: MarinaCapabilities;\n  connections: MarinaConnections;\n}\n\nexport function createMarinaRuntime(binding: MarinaRuntimeBinding): MarinaRuntime {\n  return createRuntime(binding);\n}\n\nfunction createRuntime(binding: MarinaRuntimeBinding, capabilitySession?: string): MarinaRuntime {\n  return {\n    storage: createStorage(binding),\n    db: createDatabase(binding),\n    ai: createAI(binding),\n    jobs: createJobs(binding),\n    capabilities: createCapabilities(binding, capabilitySession),\n    connections: createConnections(binding, capabilitySession),\n  };\n}\n\nexport interface MarinaAppContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface MarinaApp {\n  fetch(\n    request: Request,\n    marina: MarinaRuntime,\n    context: MarinaAppContext,\n  ): Response | Promise<Response>;\n  jobs?: Record<string, MarinaJobHandler>;\n}\n\nexport interface MarinaPlatformApp {\n  fetch(\n    request: Request,\n    environment: unknown,\n    context: MarinaAppContext,\n  ): Response | Promise<Response>;\n}\n\nconst platformApps = new WeakSet<object>();\n\nexport interface MarinaJobContext extends MarinaAppContext {\n  runId: string;\n  attempt: number;\n  trigger: import("./contract.js").JobTrigger;\n  scheduledFor?: string;\n}\n\nexport type MarinaJobHandler = (\n  input: import("./contract.js").JobValue,\n  marina: MarinaRuntime,\n  context: MarinaJobContext,\n) => void | Promise<void>;\n\nasync function readBoundedJobBody(request: Request): Promise<string | null> {\n  const declared = request.headers.get("content-length");\n  if (declared !== null) {\n    const bytes = Number(declared);\n    if (Number.isFinite(bytes) && bytes > MAX_JOB_INVOCATION_BYTES) return null;\n  }\n  if (!request.body) return "";\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    size += value.byteLength;\n    if (size > MAX_JOB_INVOCATION_BYTES) {\n      await reader.cancel().catch(() => undefined);\n      return null;\n    }\n    chunks.push(value);\n  }\n  const bytes = new Uint8Array(size);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return new TextDecoder().decode(bytes);\n}\n\nasync function executeJobRequest(\n  app: MarinaApp,\n  request: Request,\n  binding: MarinaRuntimeBinding,\n  context: MarinaAppContext,\n): Promise<Response> {\n  const token = request.headers.get("x-marina-job-token") ?? "";\n  if (!binding.authorizeJob || !token) return new Response("Not found", { status: 404 });\n  const body = await readBoundedJobBody(request);\n  if (body === null) return new Response("Payload too large", { status: 413 });\n  if (!(await binding.authorizeJob({ token, body })))\n    return new Response("Not found", { status: 404 });\n  let invocation: import("./contract.js").MarinaJobInvocation;\n  try {\n    invocation = JSON.parse(body) as import("./contract.js").MarinaJobInvocation;\n  } catch {\n    return new Response("Bad request", { status: 400 });\n  }\n  const handler = app.jobs?.[invocation.handler];\n  if (typeof handler !== "function") return new Response("Job handler not found", { status: 404 });\n  await handler(invocation.input, createRuntime(binding, invocation.capabilitySession), {\n    ...context,\n    runId: invocation.runId,\n    attempt: invocation.attempt,\n    trigger: invocation.trigger,\n    ...(invocation.scheduledFor ? { scheduledFor: invocation.scheduledFor } : {}),\n  });\n  return new Response(null, { status: 204 });\n}\n\ninterface SubstrateEnvironment {\n  MARINA?: unknown;\n}\n\nfunction runtimeBinding(environment: unknown): MarinaRuntimeBinding {\n  const binding = (environment as SubstrateEnvironment | null)?.MARINA;\n  if (!binding || typeof binding !== "object" || !("invoke" in binding)) {\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "This app was not started with the Marina runtime binding",\n      retryable: false,\n    });\n  }\n  const invoke = (binding as { invoke?: unknown }).invoke;\n  if (typeof invoke !== "function") {\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "This app has an incompatible Marina runtime binding",\n      retryable: false,\n    });\n  }\n  return binding as MarinaRuntimeBinding;\n}\n\n/**\n * Define a portable Marina application. The returned adapter matches the\n * active substrate, while application code sees only Web APIs and Marina.\n */\nexport function defineApp(app: MarinaApp): MarinaPlatformApp {\n  const adapter: MarinaPlatformApp = {\n    fetch(request: Request, environment: unknown, context: MarinaAppContext) {\n      const binding = runtimeBinding(environment);\n      const url = new URL(request.url);\n      if (request.method === "POST" && url.pathname === MARINA_JOB_EXECUTION_PATH) {\n        return executeJobRequest(app, request, binding, context);\n      }\n      const capabilitySession = request.headers.get("x-platform-capability-session") ?? undefined;\n      if (!capabilitySession) return app.fetch(request, createRuntime(binding), context);\n      const headers = new Headers(request.headers);\n      headers.delete("x-platform-capability-session");\n      return app.fetch(\n        new Request(request, { headers }),\n        createRuntime(binding, capabilitySession),\n        context,\n      );\n    },\n  };\n  platformApps.add(adapter);\n  return adapter;\n}\n\n/** Internal build adapter. Application entrypoints may export the portable\n * app object directly; imports of defineApp remain compatible during the\n * transition without wrapping an already-adapted module twice. */\nexport function adaptApp(app: MarinaApp | MarinaPlatformApp): MarinaPlatformApp {\n  if (!app || typeof app !== "object" || typeof app.fetch !== "function") {\n    throw new TypeError("The Marina app entrypoint must export a fetch handler");\n  }\n  return platformApps.has(app) ? (app as MarinaPlatformApp) : defineApp(app as MarinaApp);\n}\n',
+      "invoke.ts": 'import type {\n  MarinaRuntimeBinding,\n  MarinaRuntimeRequest,\n  MarinaRuntimeService,\n} from "./contract.js";\nimport { MARINA_RUNTIME_PROTOCOL_VERSION, isRuntimeResponse } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\n\n/** Cross-service invocation behavior belongs to the Marina compatibility\n * layer. Individual capability clients supply only their stable service name,\n * operation, and validated provider-neutral input. */\nexport async function invokeRuntime<T>(\n  binding: MarinaRuntimeBinding,\n  service: MarinaRuntimeService,\n  operation: MarinaRuntimeRequest["operation"],\n  input: unknown,\n): Promise<T> {\n  let response: unknown;\n  try {\n    response = await binding.invoke({\n      protocolVersion: MARINA_RUNTIME_PROTOCOL_VERSION,\n      requestId: crypto.randomUUID(),\n      service,\n      operation,\n      input,\n    });\n  } catch (error) {\n    if (error instanceof MarinaRuntimeError) throw error;\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "Marina runtime is unavailable",\n      retryable: true,\n    });\n  }\n  if (!isRuntimeResponse(response)) {\n    throw new MarinaRuntimeError({\n      code: "INTERNAL",\n      message: "Marina runtime returned an invalid response",\n      retryable: false,\n    });\n  }\n  if (!response.ok) throw new MarinaRuntimeError(response.error);\n  return response.value as T;\n}\n',
+      "jobs.ts": 'import type { JobEnqueueResult, JobStatus, JobValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_JOB_INPUT_BYTES, MAX_JOB_VALUE_DEPTH } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst JOB_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;\nconst RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nexport function assertJobName(value: unknown): string {\n  if (typeof value !== "string" || !JOB_NAME.test(value)) invalid("invalid job name");\n  return value as string;\n}\n\nexport function assertJobValue(value: unknown): JobValue {\n  const seen = new Set<object>();\n  const visit = (current: unknown, depth: number): void => {\n    if (depth > MAX_JOB_VALUE_DEPTH) invalid("job input is nested too deeply");\n    if (current === null || typeof current === "string" || typeof current === "boolean") return;\n    if (typeof current === "number") {\n      if (!Number.isFinite(current)) invalid("job input numbers must be finite");\n      return;\n    }\n    if (!current || typeof current !== "object") invalid("job input must be JSON compatible");\n    if (seen.has(current as object)) invalid("job input must not contain cycles");\n    seen.add(current as object);\n    if (Array.isArray(current)) {\n      for (const item of current) visit(item, depth + 1);\n    } else {\n      if (Object.getPrototypeOf(current) !== Object.prototype)\n        invalid("job input must contain plain objects");\n      for (const [key, item] of Object.entries(current)) {\n        if (key === "__proto__" || key === "constructor" || key === "prototype")\n          invalid("job input contains an unsafe key");\n        visit(item, depth + 1);\n      }\n    }\n    seen.delete(current as object);\n  };\n  visit(value, 0);\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("job input must be JSON compatible");\n  }\n  if (serialized === undefined || encoder.encode(serialized).byteLength > MAX_JOB_INPUT_BYTES)\n    invalid(`job input must not exceed ${String(MAX_JOB_INPUT_BYTES)} bytes`);\n  return value as JobValue;\n}\n\nexport interface JobEnqueueOptions {\n  dedupeKey?: string;\n}\n\nexport interface MarinaJobs {\n  enqueue(name: string, input: JobValue, options?: JobEnqueueOptions): Promise<JobEnqueueResult>;\n  get(runId: string): Promise<JobStatus>;\n}\n\nexport function createJobs(binding: MarinaRuntimeBinding): MarinaJobs {\n  return {\n    enqueue(name, input, options = {}) {\n      const dedupeKey = options.dedupeKey;\n      if (\n        dedupeKey !== undefined &&\n        (typeof dedupeKey !== "string" || dedupeKey.length < 1 || dedupeKey.length > 200)\n      )\n        invalid("job dedupe key must be between 1 and 200 characters");\n      return invokeRuntime(binding, "jobs", "enqueue", {\n        name: assertJobName(name),\n        input: assertJobValue(input),\n        ...(dedupeKey === undefined ? {} : { dedupeKey }),\n      });\n    },\n    get(runId) {\n      if (!RUN_ID.test(runId)) invalid("invalid job run id");\n      return invokeRuntime(binding, "jobs", "get", { runId });\n    },\n  };\n}\n',
+      "storage.ts": 'import type {\n  MarinaRuntimeBinding,\n  StorageListInput,\n  StorageListResult,\n  StorageObject,\n  StorageObjectMetadata,\n  StoragePutInput,\n} from "./contract.js";\nimport { MAX_STORAGE_KEY_BYTES, MAX_STORAGE_OBJECT_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst MAX_CONTENT_TYPE_LENGTH = 200;\nconst MAX_METADATA_ENTRIES = 32;\nconst MAX_METADATA_KEY_LENGTH = 128;\nconst MAX_METADATA_VALUE_LENGTH = 1024;\nconst MAX_LIST_LIMIT = 1000;\nconst encoder = new TextEncoder();\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\n/** Validate a logical app key. The broker adds the organization/app prefix. */\nexport function assertStorageKey(\n  key: string,\n  options: { allowEmpty?: boolean; allowTrailingSlash?: boolean } = {},\n): string {\n  if (typeof key !== "string") invalid("storage key must be a string");\n  if (key.length === 0) {\n    if (options.allowEmpty) return key;\n    invalid("storage key must not be empty");\n  }\n  if (encoder.encode(key).length > MAX_STORAGE_KEY_BYTES)\n    invalid(`storage key must not exceed ${String(MAX_STORAGE_KEY_BYTES)} bytes`);\n  if (key.startsWith("/")) invalid("storage key must be relative");\n  if (key.endsWith("/") && !options.allowTrailingSlash)\n    invalid("storage key must identify an object, not a directory");\n  if (key.includes("\\\\")) invalid("storage key must use forward slashes");\n  if (/\\p{Cc}/u.test(key)) invalid("storage key must not contain control characters");\n  const segments = key.endsWith("/") ? key.slice(0, -1).split("/") : key.split("/");\n  if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))\n    invalid("storage key contains an invalid path segment");\n  return key;\n}\n\nfunction validateMetadata(metadata: Record<string, string> | undefined): Record<string, string> {\n  if (!metadata) return {};\n  const entries = Object.entries(metadata);\n  if (entries.length > MAX_METADATA_ENTRIES)\n    invalid(`storage metadata may contain at most ${String(MAX_METADATA_ENTRIES)} entries`);\n  const normalized: Record<string, string> = {};\n  for (const [key, value] of entries) {\n    if (!key || key.length > MAX_METADATA_KEY_LENGTH)\n      invalid(`storage metadata keys must be 1-${String(MAX_METADATA_KEY_LENGTH)} characters`);\n    if (typeof value !== "string" || value.length > MAX_METADATA_VALUE_LENGTH)\n      invalid(\n        `storage metadata values must be strings no longer than ${String(MAX_METADATA_VALUE_LENGTH)} characters`,\n      );\n    Object.defineProperty(normalized, key, {\n      value,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n  return normalized;\n}\n\nexport interface StoragePutOptions {\n  contentType?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface StorageListOptions {\n  prefix?: string;\n  cursor?: string;\n  limit?: number;\n}\n\nexport interface MarinaStorage {\n  put(\n    key: string,\n    body: StoragePutInput["body"],\n    options?: StoragePutOptions,\n  ): Promise<StorageObjectMetadata>;\n  get(key: string): Promise<StorageObject | null>;\n  delete(key: string): Promise<void>;\n  list(options?: StorageListOptions): Promise<StorageListResult>;\n}\n\nexport function createStorage(binding: MarinaRuntimeBinding): MarinaStorage {\n  return {\n    async put(key, body, options = {}) {\n      assertStorageKey(key);\n      if (\n        typeof body !== "string" &&\n        !(body instanceof Uint8Array) &&\n        !(body instanceof ArrayBuffer)\n      )\n        invalid("storage body must be a string, Uint8Array, or ArrayBuffer");\n      const bodyBytes =\n        typeof body === "string"\n          ? encoder.encode(body).byteLength\n          : body instanceof Uint8Array\n            ? body.byteLength\n            : body.byteLength;\n      if (bodyBytes > MAX_STORAGE_OBJECT_BYTES) {\n        throw new MarinaRuntimeError({\n          code: "QUOTA_EXCEEDED",\n          message: `storage objects may not exceed ${String(MAX_STORAGE_OBJECT_BYTES)} bytes`,\n          retryable: false,\n        });\n      }\n      if (options.contentType && options.contentType.length > MAX_CONTENT_TYPE_LENGTH)\n        invalid(\n          `storage content type must not exceed ${String(MAX_CONTENT_TYPE_LENGTH)} characters`,\n        );\n      return invokeRuntime<StorageObjectMetadata>(binding, "storage", "put", {\n        key,\n        body,\n        ...(options.contentType ? { contentType: options.contentType } : {}),\n        metadata: validateMetadata(options.metadata),\n      } satisfies StoragePutInput);\n    },\n\n    async get(key) {\n      assertStorageKey(key);\n      return invokeRuntime<StorageObject | null>(binding, "storage", "get", { key });\n    },\n\n    async delete(key) {\n      assertStorageKey(key);\n      await invokeRuntime<null>(binding, "storage", "delete", { key });\n    },\n\n    async list(options = {}) {\n      const input: StorageListInput = {};\n      if (options.prefix !== undefined)\n        input.prefix = assertStorageKey(options.prefix, {\n          allowEmpty: true,\n          allowTrailingSlash: true,\n        });\n      if (options.cursor !== undefined) {\n        if (!options.cursor) invalid("storage cursor must not be empty");\n        input.cursor = options.cursor;\n      }\n      if (options.limit !== undefined) {\n        if (\n          !Number.isSafeInteger(options.limit) ||\n          options.limit < 1 ||\n          options.limit > MAX_LIST_LIMIT\n        )\n          invalid(`storage list limit must be between 1 and ${String(MAX_LIST_LIMIT)}`);\n        input.limit = options.limit;\n      }\n      return invokeRuntime<StorageListResult>(binding, "storage", "list", input);\n    },\n  };\n}\n'
+    };
+  }
+});
+
+// src/dev/host.ts
+import { createServer as createServer2 } from "node:http";
+import { mkdirSync as mkdirSync4, watch, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join6, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { Readable } from "node:stream";
+function entrypointSource(projectDir, entrypoint) {
+  return [
+    `import app from ${JSON.stringify(resolve(projectDir, entrypoint))};`,
+    ["import { adaptApp } ", ["fr", "om"].join(""), ' "./runtime/index.ts";'].join(""),
+    "export default adaptApp(app);",
+    ""
+  ].join("\n");
+}
+async function bundle(options) {
+  for (const [name, source] of Object.entries(DEV_RUNTIME_FILES)) {
+    const path = join6(options.buildDir, "runtime", name);
+    mkdirSync4(dirname2(path), { recursive: true });
+    writeFileSync3(path, source);
+  }
+  const entry = join6(options.buildDir, "entrypoint.ts");
+  writeFileSync3(entry, entrypointSource(options.projectDir, options.manifest.entrypoint));
+  const outfile = join6(options.buildDir, "app.mjs");
+  let esbuild;
+  try {
+    esbuild = await import("esbuild");
+  } catch {
+    throw new Error("esbuild could not load \u2014 reinstall the Marina CLI");
+  }
+  await esbuild.build({
+    entryPoints: [entry],
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    conditions: ["workerd", "worker", "browser"],
+    target: "es2022",
+    external: ["cloudflare:*"],
+    alias: {
+      "@marina/runtime": join6(options.buildDir, "runtime", "index.ts"),
+      "marina:runtime": join6(options.buildDir, "runtime", "index.ts")
+    },
+    absWorkingDir: options.projectDir,
+    outfile,
+    logLevel: "silent"
+  });
+  const module = await import(`${pathToFileURL(outfile).href}?v=${String(Date.now())}`);
+  if (typeof module.default?.fetch !== "function") {
+    throw new Error("the app entrypoint does not export a Marina app (use defineApp)");
+  }
+  return module.default;
+}
+function toRequest(req, port, identity) {
+  const url = new URL(req.url ?? "/", `http://localhost:${String(port)}`);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (typeof value === "string") headers.set(name, value);
+    else if (Array.isArray(value)) headers.set(name, value.join(", "));
+  }
+  headers.set("x-platform-user-id", identity.userId);
+  headers.set("x-platform-workspace-id", identity.workspaceId);
+  headers.set("x-platform-capability-session", "marina-local-dev");
+  const method = req.method ?? "GET";
+  const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(req);
+  return new Request(url, {
+    method,
+    headers,
+    ...body ? { body, duplex: "half" } : {}
+  });
+}
+async function writeResponse(response, res, chrome) {
+  const headers = {};
+  response.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("text/html")) {
+    const html = injectDevChrome(await response.text(), chrome);
+    delete headers["content-length"];
+    res.writeHead(response.status, headers);
+    res.end(html);
+    return;
+  }
+  res.writeHead(response.status, headers);
+  if (!response.body) {
+    res.end();
+    return;
+  }
+  const reader = response.body.getReader();
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) break;
+    res.write(next.value);
+  }
+  res.end();
+}
+async function startDevHost(options) {
+  mkdirSync4(options.buildDir, { recursive: true });
+  let app = await bundle(options);
+  const chrome = devChromeSnippet({
+    appName: options.identity.appName,
+    userLabel: options.identity.userLabel
+  });
+  const fetchApp = (request2) => Promise.resolve(
+    app.fetch(request2, { MARINA: options.binding }, { waitUntil: () => void 0 })
+  );
+  const server = createServer2((req, res) => {
+    fetchApp(toRequest(req, options.port, options.identity)).then((response) => writeResponse(response, res, chrome)).catch((error) => {
+      res.writeHead(500, { "content-type": "text/plain" });
+      res.end(`marina dev: ${error.message}`);
+    });
+  });
+  await new Promise((ready, failed) => {
+    server.once("error", failed);
+    server.listen(options.port, () => {
+      ready();
+    });
+  });
+  let rebuildTimer = null;
+  const watchers = [];
+  const scheduleRebuild = () => {
+    if (rebuildTimer) clearTimeout(rebuildTimer);
+    rebuildTimer = setTimeout(() => {
+      bundle(options).then((next) => {
+        app = next;
+        options.log("reloaded");
+      }).catch((error) => {
+        options.log(`build failed \u2014 still serving the previous build: ${error.message}`);
+      });
+    }, 150);
+  };
+  try {
+    const watcher = watch(options.projectDir, { recursive: true }, (_event, file) => {
+      const name = String(file ?? "");
+      if (name.startsWith(".marina") || name.startsWith("node_modules") || name.startsWith(".git")) {
+        return;
+      }
+      scheduleRebuild();
+    });
+    watchers.push(watcher);
+  } catch {
+    options.log("file watching is unavailable \u2014 restart marina dev to pick up changes");
+  }
+  return {
+    port: options.port,
+    fetchApp,
+    rebuild: async () => {
+      app = await bundle(options);
+    },
+    close: async () => {
+      for (const watcher of watchers) watcher.close();
+      if (rebuildTimer) clearTimeout(rebuildTimer);
+      await new Promise((done) => {
+        server.close(() => {
+          done();
+        });
+      });
+    }
+  };
+}
+var init_host = __esm({
+  "src/dev/host.ts"() {
+    "use strict";
+    init_chrome();
+    init_embedded_runtime();
+  }
+});
+
+// src/dev/cron.ts
+function matchesField(field, value, minimum, maximum) {
+  return field.split(",").some((part) => {
+    const step = /^(.+)\/(\d+)$/.exec(part);
+    if (step?.[1] !== void 0 && step[2] !== void 0) {
+      const size = Number(step[2]);
+      if (!Number.isInteger(size) || size < 1) return false;
+      const base = step[1];
+      const [start, end] = base === "*" ? [minimum, maximum] : /^(\d+)-(\d+)$/.exec(base)?.slice(1).map(Number) ?? [Number(base), maximum];
+      if (start === void 0 || Number.isNaN(start)) return false;
+      return value >= start && value <= (end ?? maximum) && (value - start) % size === 0;
+    }
+    if (part === "*") return true;
+    const range = /^(\d+)-(\d+)$/.exec(part);
+    if (range) return value >= Number(range[1]) && value <= Number(range[2]);
+    return Number(part) === value;
+  });
+}
+function cronMatches(schedule, at) {
+  const fields = schedule.trim().split(/\s+/);
+  if (fields.length !== 5) return false;
+  const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+  return matchesField(minute, at.getUTCMinutes(), 0, 59) && matchesField(hour, at.getUTCHours(), 0, 23) && matchesField(dayOfMonth, at.getUTCDate(), 1, 31) && matchesField(month, at.getUTCMonth() + 1, 1, 12) && matchesField(dayOfWeek, at.getUTCDay(), 0, 6);
+}
+var init_cron = __esm({
+  "src/dev/cron.ts"() {
+    "use strict";
+  }
+});
+
+// src/dev/jobs.ts
+import { randomUUID } from "node:crypto";
+var JOB_EXECUTION_PATH, DevJobRunner;
+var init_jobs = __esm({
+  "src/dev/jobs.ts"() {
+    "use strict";
+    init_cron();
+    JOB_EXECUTION_PATH = "/.marina/runtime/jobs/execute";
+    DevJobRunner = class {
+      runs = /* @__PURE__ */ new Map();
+      deduped = /* @__PURE__ */ new Map();
+      token = randomUUID();
+      fetchApp = null;
+      timer = null;
+      lastScheduledMinute = "";
+      manifest;
+      identity;
+      log;
+      constructor(manifest, identity, log) {
+        this.manifest = manifest;
+        this.identity = identity;
+        this.log = log;
+      }
+      attachApp(fetchApp) {
+        this.fetchApp = fetchApp;
+      }
+      authorizeJob(request2) {
+        void request2.body;
+        return request2.token === this.token;
+      }
+      enqueue(input) {
+        const definition = this.manifest.jobs[input.name];
+        if (!definition) {
+          throw new Error(`job "${input.name}" is not defined in marina.json`);
+        }
+        if (input.dedupeKey) {
+          const existing = this.deduped.get(`${input.name}:${input.dedupeKey}`);
+          const run2 = existing ? this.runs.get(existing) : void 0;
+          if (run2 && (run2.state === "queued" || run2.state === "running")) return run2;
+        }
+        const status2 = {
+          id: randomUUID(),
+          name: input.name,
+          state: "queued",
+          attempts: 0,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        this.runs.set(status2.id, status2);
+        if (input.dedupeKey) this.deduped.set(`${input.name}:${input.dedupeKey}`, status2.id);
+        void this.execute(status2, definition.handler, input.input, "enqueue");
+        return { ...status2 };
+      }
+      get(id) {
+        const run2 = this.runs.get(id);
+        return run2 ? { ...run2 } : null;
+      }
+      async execute(status2, handler, input, trigger, scheduledFor) {
+        const fetchApp = this.fetchApp;
+        if (!fetchApp) {
+          status2.state = "failed";
+          status2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+          return;
+        }
+        status2.state = "running";
+        status2.attempts += 1;
+        status2.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const invocation = {
+          runId: status2.id,
+          workspaceId: this.identity.workspaceId,
+          appId: this.identity.appId,
+          artifactDigest: `sha256:${"0".repeat(64)}`,
+          environment: "development",
+          jobName: status2.name,
+          handler,
+          input,
+          attempt: status2.attempts,
+          trigger,
+          ...scheduledFor ? { scheduledFor } : {},
+          capabilitySession: "marina-local-dev"
+        };
+        try {
+          const response = await fetchApp(
+            new Request(`http://marina.dev.local${JOB_EXECUTION_PATH}`, {
+              method: "POST",
+              headers: { "x-marina-job-token": this.token, "content-type": "application/json" },
+              body: JSON.stringify(invocation)
+            })
+          );
+          status2.state = response.ok ? "succeeded" : "failed";
+          if (!response.ok) {
+            this.log(`job ${status2.name} failed (${String(response.status)})`);
+          }
+        } catch (error) {
+          status2.state = "failed";
+          this.log(`job ${status2.name} threw: ${error.message}`);
+        }
+        status2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      }
+      startSchedules() {
+        if (this.timer) return;
+        this.timer = setInterval(() => {
+          const now = /* @__PURE__ */ new Date();
+          const minute = now.toISOString().slice(0, 16);
+          if (minute === this.lastScheduledMinute) return;
+          this.lastScheduledMinute = minute;
+          for (const [name, definition] of Object.entries(this.manifest.jobs)) {
+            if (definition.schedule && cronMatches(definition.schedule, now)) {
+              this.log(`schedule fired: ${name}`);
+              try {
+                const status2 = this.enqueue({ name, input: {} });
+                const run2 = this.runs.get(status2.id);
+                if (run2) run2.state = run2.state === "queued" ? "queued" : run2.state;
+              } catch (error) {
+                this.log(`schedule ${name} failed to enqueue: ${error.message}`);
+              }
+            }
+          }
+        }, 15e3);
+        this.timer.unref?.();
+      }
+      stop() {
+        if (this.timer) clearInterval(this.timer);
+        this.timer = null;
+      }
+    };
+  }
+});
+
+// src/dev/manifest.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7 } from "node:path";
+function fail(message) {
+  throw new Error(`marina.json: ${message}`);
+}
+function readDevManifest(dir) {
+  const path = join7(dir, "marina.json");
+  if (!existsSync6(path)) {
+    fail("not found \u2014 marina dev runs from a project with a marina.json");
+  }
+  let value;
+  try {
+    value = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    fail("is not valid JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail("must contain an object");
+  const manifest = value;
+  if (typeof manifest.entrypoint !== "string" || manifest.entrypoint.length === 0) {
+    fail('needs an "entrypoint" \u2014 static projects have no server to develop against');
+  }
+  const runtime = manifest.runtime ?? {};
+  const capabilities = Array.isArray(manifest.capabilities) ? manifest.capabilities.filter((name) => typeof name === "string") : [];
+  const connections = {};
+  if (manifest.connections !== void 0) {
+    if (!manifest.connections || typeof manifest.connections !== "object" || Array.isArray(manifest.connections)) {
+      fail('"connections" must map connector names to declarations');
+    }
+    for (const [connector, declared] of Object.entries(manifest.connections)) {
+      if (!CONNECTION_ID.test(connector)) fail(`"${connector}" is not a connector name`);
+      if (!Array.isArray(declared)) fail(`connections.${connector} must be an array`);
+      connections[connector] = declared.map((entry, index) => {
+        const binding = entry;
+        if (typeof binding.connection !== "string" || !CONNECTION_ID.test(binding.connection)) {
+          fail(`connections.${connector}[${String(index)}] needs an explicit "connection" id`);
+        }
+        const operations = Array.isArray(binding.capabilities) ? binding.capabilities : [];
+        if (!operations.every((op) => typeof op === "string" && NAME.test(op))) {
+          fail(`connections.${connector}[${String(index)}] has an invalid operation name`);
+        }
+        return { connection: binding.connection, capabilities: operations };
+      });
+    }
+  }
+  const jobs = {};
+  if (manifest.jobs && typeof manifest.jobs === "object" && !Array.isArray(manifest.jobs)) {
+    for (const [name, definition] of Object.entries(manifest.jobs)) {
+      const job = definition;
+      if (typeof job.handler === "string") {
+        jobs[name] = {
+          handler: job.handler,
+          ...typeof job.schedule === "string" ? { schedule: job.schedule } : {}
+        };
+      }
+    }
+  }
+  return {
+    ...typeof manifest.name === "string" ? { name: manifest.name } : {},
+    entrypoint: manifest.entrypoint,
+    runtime,
+    capabilities,
+    connections,
+    jobs
+  };
+}
+var CONNECTION_ID, NAME;
+var init_manifest = __esm({
+  "src/dev/manifest.ts"() {
+    "use strict";
+    CONNECTION_ID = /^[a-z][a-z0-9_]{0,39}$/;
+    NAME = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+  }
+});
 
-// src/api.ts
-var LOGIN_EXCHANGE_TIMEOUT_MS = 15e3;
-var ApiError = class extends Error {
-  code;
-  status;
-  constructor(code, message, status2) {
-    super(message);
-    this.code = code;
-    this.status = status2;
+// src/dev/storage.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync7, rmSync, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join8, normalize, sep } from "node:path";
+var MAX_LIST_LIMIT, LocalStorage;
+var init_storage = __esm({
+  "src/dev/storage.ts"() {
+    "use strict";
+    MAX_LIST_LIMIT = 1e3;
+    LocalStorage = class {
+      objects;
+      sidecars;
+      constructor(root) {
+        this.objects = join8(root, "objects");
+        this.sidecars = join8(root, "meta");
+        mkdirSync5(this.objects, { recursive: true });
+        mkdirSync5(this.sidecars, { recursive: true });
+      }
+      /** Keys were validated by the runtime client; this guards the filesystem
+       * anyway so a hand-crafted invoke cannot escape the store. */
+      objectPath(base, key) {
+        const path = normalize(join8(base, key));
+        if (path !== base && !path.startsWith(base + sep)) {
+          throw new Error("storage key escapes the local store");
+        }
+        return path;
+      }
+      put(input) {
+        const body = typeof input.body === "string" ? Buffer.from(input.body, "utf8") : input.body instanceof ArrayBuffer ? Buffer.from(input.body) : Buffer.from(input.body);
+        const sidecar = {
+          ...input.contentType ? { contentType: input.contentType } : {},
+          metadata: input.metadata ?? {},
+          etag: createHash2("sha256").update(body).digest("hex").slice(0, 32),
+          uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          size: body.byteLength
+        };
+        const objectPath = this.objectPath(this.objects, input.key);
+        mkdirSync5(dirname3(objectPath), { recursive: true });
+        writeFileSync4(objectPath, body);
+        const sidecarPath = this.objectPath(this.sidecars, `${input.key}.json`);
+        mkdirSync5(dirname3(sidecarPath), { recursive: true });
+        writeFileSync4(sidecarPath, JSON.stringify(sidecar));
+        return { key: input.key, ...sidecar };
+      }
+      get(key) {
+        const metadata = this.head(key);
+        if (!metadata) return null;
+        const body = readFileSync7(this.objectPath(this.objects, key));
+        return { ...metadata, body: new Uint8Array(body) };
+      }
+      head(key) {
+        try {
+          const sidecar = JSON.parse(
+            readFileSync7(this.objectPath(this.sidecars, `${key}.json`), "utf8")
+          );
+          return { key, ...sidecar };
+        } catch {
+          return null;
+        }
+      }
+      delete(key) {
+        rmSync(this.objectPath(this.objects, key), { force: true });
+        rmSync(this.objectPath(this.sidecars, `${key}.json`), { force: true });
+      }
+      list(input = {}) {
+        const limit = Math.min(input.limit ?? MAX_LIST_LIMIT, MAX_LIST_LIMIT);
+        const keys = [];
+        const walk = (dir, prefix) => {
+          let entries;
+          try {
+            entries = readdirSync3(dir);
+          } catch {
+            return;
+          }
+          for (const entry of entries.toSorted()) {
+            const path = join8(dir, entry);
+            if (statSync(path).isDirectory()) walk(path, `${prefix}${entry}/`);
+            else if (entry.endsWith(".json")) keys.push(`${prefix}${entry.slice(0, -5)}`);
+          }
+        };
+        walk(this.sidecars, "");
+        const filtered = keys.filter((key) => input.prefix ? key.startsWith(input.prefix) : true).filter((key) => input.cursor ? key > input.cursor : true);
+        const page2 = filtered.slice(0, limit);
+        const truncated = filtered.length > page2.length;
+        const objects = page2.map((key) => this.head(key)).filter((object) => object !== null);
+        return {
+          objects,
+          ...truncated && page2.length > 0 ? { cursor: page2[page2.length - 1] } : {},
+          truncated
+        };
+      }
+    };
   }
-};
-async function request(path, init) {
+});
+
+// src/dev/index.ts
+var dev_exports = {};
+__export(dev_exports, {
+  runDev: () => runDev
+});
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join9, resolve as resolve2 } from "node:path";
+async function runDev(options) {
   const token = getToken();
-  if (!token) throw new ApiError("unauthenticated", "not signed in \u2014 run `marina setup`", 401);
-  const res = await fetch(`${apiUrl()}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${token}`, ...init?.headers }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new ApiError(
-      body.error?.code ?? "error",
-      body.error?.message ?? `request failed (${String(res.status)})`,
-      res.status
-    );
+  if (!token) {
+    throw new Error("not signed in \u2014 run `marina setup` first");
   }
-  return body;
-}
-async function exchangeCliLogin(code, codeVerifier) {
-  let res;
-  try {
-    res = await fetch(`${apiUrl()}/cli/auth/exchange`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ code, code_verifier: codeVerifier }),
-      signal: AbortSignal.timeout(LOGIN_EXCHANGE_TIMEOUT_MS)
-    });
-  } catch (error) {
-    if (error.name === "TimeoutError") {
-      throw new ApiError(
-        "login_timeout",
-        "the login confirmation request timed out after 15 seconds \u2014 run `marina setup` to try again",
-        408
-      );
-    }
-    throw error;
+  const projectDir = resolve2(options.dir ?? ".");
+  const manifest = readDevManifest(projectDir);
+  const port = options.port ? Number(options.port) : DEFAULT_PORT;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("--port must be a number between 1 and 65535");
   }
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.token) {
-    throw new ApiError(
-      body.error?.code ?? "login_failed",
-      body.error?.message ?? `login exchange failed (${String(res.status)})`,
-      res.status
+  const identity = await me();
+  const appName = manifest.name ?? "Marina app";
+  say(`${bold("marina dev")} \xB7 ${appName}`);
+  const declared = Object.entries(manifest.connections).flatMap(
+    ([connector, bindings]) => bindings.map((binding2) => `${connector}/${binding2.connection}`)
+  );
+  if (declared.length > 0) {
+    say(
+      dim(
+        `connections: ${declared.join(", ")} \u2014 bridged to ${apiUrl()} as ${identity.user.email}; grants are checked per call`
+      )
     );
   }
-  return body.token;
-}
-async function startDeploy(zip, name, app) {
-  const form = new FormData();
-  form.set(
-    "code",
-    new Blob([new Uint8Array(zip).buffer], { type: "application/zip" }),
-    "upload.zip"
-  );
-  form.set("name", name);
-  form.set("source", "cli");
-  if (app) form.set("app", app);
-  const res = await request("/v1/deploys", {
-    method: "POST",
-    body: form
-  });
-  return res.deploy;
-}
-async function pollDeploy(id, onProgress = () => void 0) {
-  for (; ; ) {
-    const { deploy: deploy2 } = await request(`/v1/deploys/${id}`);
-    onProgress(deploy2);
-    if (deploy2.status !== "queued" && deploy2.status !== "building") return deploy2;
-    await new Promise((resolve2) => setTimeout(resolve2, 500));
+  const devDir = join9(projectDir, ".marina", "dev");
+  const storage = manifest.runtime.storage === "v1" ? new LocalStorage(join9(devDir, "storage")) : null;
+  let database = null;
+  if (manifest.runtime.db === "v1") {
+    database = await LocalDatabase.open(join9(devDir, "db"));
+    const applied = await database.applyMigrations(projectDir);
+    const total = existsSync7(join9(projectDir, "marina", "migrations")) ? "" : " (no marina/migrations yet)";
+    say(
+      `${green("ok")} db \u2014 embedded Postgres ready, ${String(applied.length)} migrations applied${total}`
+    );
   }
-}
-async function listApps() {
-  const res = await request("/v1/apps");
-  return res.apps;
-}
-var getApp = (idOrSlug) => request(`/v1/apps/${encodeURIComponent(idOrSlug)}`);
-async function getAppUrl(idOrSlug) {
-  return (await getApp(idOrSlug)).url;
-}
-async function listVersions(app) {
-  const res = await request(
-    `/v1/apps/${encodeURIComponent(app)}/versions`
-  );
-  return res.versions;
-}
-async function listDeploys(app, limit = 10) {
-  const res = await request(
-    `/v1/apps/${encodeURIComponent(app)}/deploys?limit=${String(limit)}`
-  );
-  return res.deploys;
-}
-async function restoreVersion(versionId) {
-  const res = await request(`/v1/versions/${versionId}/restore`, {
-    method: "POST"
+  const jobs = manifest.runtime.jobs === "v1" ? new DevJobRunner(
+    manifest,
+    { workspaceId: identity.workspace.id, appId: "local-dev" },
+    (line) => {
+      say(dim(line));
+    }
+  ) : null;
+  const binding = createDevBinding({
+    manifest,
+    storage,
+    database,
+    jobs,
+    bridge: { apiUrl: apiUrl(), token }
   });
-  return res.version;
-}
-async function listEnv(app) {
-  const res = await request(`/v1/apps/${encodeURIComponent(app)}/env`);
-  return res.env;
-}
-async function setEnv(app, key, value, secret) {
-  await request(`/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`, {
-    method: "PUT",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ value, kind: secret ? "secret" : "plain" })
+  const host = await startDevHost({
+    projectDir,
+    buildDir: join9(devDir, "build"),
+    manifest,
+    binding,
+    port,
+    identity: {
+      userId: identity.user.id,
+      workspaceId: identity.workspace.id,
+      userLabel: identity.user.email,
+      appName
+    },
+    log: (line) => {
+      say(dim(line));
+    }
   });
-}
-async function deleteEnv(app, key) {
-  await request(`/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`, {
-    method: "DELETE"
+  jobs?.attachApp(host.fetchApp);
+  if (jobs && options.schedules) {
+    jobs.startSchedules();
+    say(dim("schedules: on"));
+  } else if (jobs && Object.values(manifest.jobs).some((job) => job.schedule)) {
+    say(dim("schedules: off \u2014 pass --schedules to run them locally"));
+  }
+  if (manifest.runtime.ai === "v1") {
+    say(dim("marina.ai: bridged to Marina; usage is metered"));
+  }
+  say(
+    `${green("\u2192")} http://localhost:${String(port)}  ${dim(`(signed in as ${identity.user.email})`)}`
+  );
+  await new Promise((stop) => {
+    const shutdown = () => {
+      jobs?.stop();
+      void host.close().then(stop);
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
   });
 }
+var DEFAULT_PORT;
+var init_dev = __esm({
+  "src/dev/index.ts"() {
+    "use strict";
+    init_api();
+    init_config();
+    init_output();
+    init_binding();
+    init_db();
+    init_host();
+    init_jobs();
+    init_manifest();
+    init_storage();
+    DEFAULT_PORT = 5990;
+  }
+});
+
+// src/index.ts
+init_api();
+init_api();
+init_config();
+import { resolve as resolve3 } from "node:path";
+import { parseArgs } from "node:util";
 
 // ../../node_modules/.pnpm/fflate@0.8.3/node_modules/fflate/esm/index.mjs
 import { createRequire } from "module";
@@ -285,13 +2614,13 @@ var fdeb = new u8([
 var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
 var freb = function(eb, start) {
   var b = new u16(31);
-  for (var i = 0; i < 31; ++i) {
-    b[i] = start += 1 << eb[i - 1];
+  for (var i2 = 0; i2 < 31; ++i2) {
+    b[i2] = start += 1 << eb[i2 - 1];
   }
   var r = new i32(b[30]);
-  for (var i = 1; i < 30; ++i) {
-    for (var j = b[i]; j < b[i + 1]; ++j) {
-      r[j] = j - b[i] << 5 | i;
+  for (var i2 = 1; i2 < 30; ++i2) {
+    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
+      r[j] = j - b[i2] << 5 | i2;
     }
   }
   return { b, r };
@@ -314,25 +2643,25 @@ var x;
 var i;
 var hMap = (function(cd, mb, r) {
   var s = cd.length;
-  var i = 0;
+  var i2 = 0;
   var l = new u16(mb);
-  for (; i < s; ++i) {
-    if (cd[i])
-      ++l[cd[i] - 1];
+  for (; i2 < s; ++i2) {
+    if (cd[i2])
+      ++l[cd[i2] - 1];
   }
   var le = new u16(mb);
-  for (i = 1; i < mb; ++i) {
-    le[i] = le[i - 1] + l[i - 1] << 1;
+  for (i2 = 1; i2 < mb; ++i2) {
+    le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
   }
   var co;
   if (r) {
     co = new u16(1 << mb);
     var rvb = 15 - mb;
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        var sv = i << 4 | cd[i];
-        var r_1 = mb - cd[i];
-        var v = le[cd[i] - 1]++ << r_1;
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        var sv = i2 << 4 | cd[i2];
+        var r_1 = mb - cd[i2];
+        var v = le[cd[i2] - 1]++ << r_1;
         for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
           co[rev[v] >> rvb] = sv;
         }
@@ -340,9 +2669,9 @@ var hMap = (function(cd, mb, r) {
     }
   } else {
     co = new u16(s);
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        co[i2] = rev[le[cd[i2] - 1]++] >> 15 - cd[i2];
       }
     }
   }
@@ -419,9 +2748,9 @@ var wbits16 = function(d, p, v) {
 };
 var hTree = function(d, mb) {
   var t = [];
-  for (var i = 0; i < d.length; ++i) {
-    if (d[i])
-      t.push({ s: i, f: d[i] });
+  for (var i2 = 0; i2 < d.length; ++i2) {
+    if (d[i2])
+      t.push({ s: i2, f: d[i2] });
   }
   var s = t.length;
   var t2 = t.slice();
@@ -436,28 +2765,28 @@ var hTree = function(d, mb) {
     return a.f - b.f;
   });
   t.push({ s: -1, f: 25001 });
-  var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
+  var l = t[0], r = t[1], i0 = 0, i1 = 1, i22 = 2;
   t[0] = { s: -1, f: l.f + r.f, l, r };
   while (i1 != s - 1) {
-    l = t[t[i0].f < t[i2].f ? i0++ : i2++];
-    r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
+    l = t[t[i0].f < t[i22].f ? i0++ : i22++];
+    r = t[i0 != i1 && t[i0].f < t[i22].f ? i0++ : i22++];
     t[i1++] = { s: -1, f: l.f + r.f, l, r };
   }
   var maxSym = t2[0].s;
-  for (var i = 1; i < s; ++i) {
-    if (t2[i].s > maxSym)
-      maxSym = t2[i].s;
+  for (var i2 = 1; i2 < s; ++i2) {
+    if (t2[i2].s > maxSym)
+      maxSym = t2[i2].s;
   }
   var tr = new u16(maxSym + 1);
   var mbt = ln(t[i1 - 1], tr, 0);
   if (mbt > mb) {
-    var i = 0, dt = 0;
+    var i2 = 0, dt = 0;
     var lft = mbt - mb, cst = 1 << lft;
     t2.sort(function(a, b) {
       return tr[b.s] - tr[a.s] || a.f - b.f;
     });
-    for (; i < s; ++i) {
-      var i2_1 = t2[i].s;
+    for (; i2 < s; ++i2) {
+      var i2_1 = t2[i2].s;
       if (tr[i2_1] > mb) {
         dt += cst - (1 << mbt - tr[i2_1]);
         tr[i2_1] = mb;
@@ -466,14 +2795,14 @@ var hTree = function(d, mb) {
     }
     dt >>= lft;
     while (dt > 0) {
-      var i2_2 = t2[i].s;
+      var i2_2 = t2[i2].s;
       if (tr[i2_2] < mb)
         dt -= 1 << mb - tr[i2_2]++ - 1;
       else
-        ++i;
+        ++i2;
     }
-    for (; i >= 0 && dt; --i) {
-      var i2_3 = t2[i].s;
+    for (; i2 >= 0 && dt; --i2) {
+      var i2_3 = t2[i2].s;
       if (tr[i2_3] == mb) {
         --tr[i2_3];
         ++dt;
@@ -495,8 +2824,8 @@ var lc = function(c) {
   var w = function(v) {
     cl[cli++] = v;
   };
-  for (var i = 1; i <= s; ++i) {
-    if (c[i] == cln && i != s)
+  for (var i2 = 1; i2 <= s; ++i2) {
+    if (c[i2] == cln && i2 != s)
       ++cls;
     else {
       if (!cln && cls > 2) {
@@ -516,15 +2845,15 @@ var lc = function(c) {
       while (cls--)
         w(cln);
       cls = 1;
-      cln = c[i];
+      cln = c[i2];
     }
   }
   return { c: cl.subarray(0, cli), n: s };
 };
 var clen = function(cf, cl) {
   var l = 0;
-  for (var i = 0; i < cl.length; ++i)
-    l += cf[i] * cl[i];
+  for (var i2 = 0; i2 < cl.length; ++i2)
+    l += cf[i2] * cl[i2];
   return l;
 };
 var wfblk = function(out, pos, dat) {
@@ -534,8 +2863,8 @@ var wfblk = function(out, pos, dat) {
   out[o + 1] = s >> 8;
   out[o + 2] = out[o] ^ 255;
   out[o + 3] = out[o + 1] ^ 255;
-  for (var i = 0; i < s; ++i)
-    out[o + i + 4] = dat[i];
+  for (var i2 = 0; i2 < s; ++i2)
+    out[o + i2 + 4] = dat[i2];
   return (o + 4 + s) * 8;
 };
 var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
@@ -546,10 +2875,10 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
   var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
   var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
   var lcfreq = new u16(19);
-  for (var i = 0; i < lclt.length; ++i)
-    ++lcfreq[lclt[i] & 31];
-  for (var i = 0; i < lcdt.length; ++i)
-    ++lcfreq[lcdt[i] & 31];
+  for (var i2 = 0; i2 < lclt.length; ++i2)
+    ++lcfreq[lclt[i2] & 31];
+  for (var i2 = 0; i2 < lcdt.length; ++i2)
+    ++lcfreq[lcdt[i2] & 31];
   var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
   var nlcc = 19;
   for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
@@ -568,24 +2897,24 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
     wbits(out, p + 5, ndc - 1);
     wbits(out, p + 10, nlcc - 4);
     p += 14;
-    for (var i = 0; i < nlcc; ++i)
-      wbits(out, p + 3 * i, lct[clim[i]]);
+    for (var i2 = 0; i2 < nlcc; ++i2)
+      wbits(out, p + 3 * i2, lct[clim[i2]]);
     p += 3 * nlcc;
     var lcts = [lclt, lcdt];
     for (var it = 0; it < 2; ++it) {
       var clct = lcts[it];
-      for (var i = 0; i < clct.length; ++i) {
-        var len = clct[i] & 31;
+      for (var i2 = 0; i2 < clct.length; ++i2) {
+        var len = clct[i2] & 31;
         wbits(out, p, llm[len]), p += lct[len];
         if (len > 15)
-          wbits(out, p, clct[i] >> 5 & 127), p += clct[i] >> 12;
+          wbits(out, p, clct[i2] >> 5 & 127), p += clct[i2] >> 12;
       }
     }
   } else {
     lm = flm, ll = flt, dm = fdm, dl = fdt;
   }
-  for (var i = 0; i < li; ++i) {
-    var sym = syms[i];
+  for (var i2 = 0; i2 < li; ++i2) {
+    var sym = syms[i2];
     if (sym > 255) {
       var len = sym >> 18 & 31;
       wbits16(out, p, lm[len + 257]), p += ll[len + 257];
@@ -618,36 +2947,36 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
     var msk_1 = (1 << plvl) - 1;
     var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
     var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-    var hsh = function(i2) {
-      return (dat[i2] ^ dat[i2 + 1] << bs1_1 ^ dat[i2 + 2] << bs2_1) & msk_1;
+    var hsh = function(i3) {
+      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
     };
     var syms = new i32(25e3);
     var lf = new u16(288), df = new u16(32);
-    var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-    for (; i + 2 < s; ++i) {
-      var hv = hsh(i);
-      var imod = i & 32767, pimod = head[hv];
+    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i2 + 2 < s; ++i2) {
+      var hv = hsh(i2);
+      var imod = i2 & 32767, pimod = head[hv];
       prev[imod] = pimod;
       head[hv] = imod;
-      if (wi <= i) {
-        var rem = s - i;
+      if (wi <= i2) {
+        var rem = s - i2;
         if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
-          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
-          li = lc_1 = eb = 0, bs = i;
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
+          li = lc_1 = eb = 0, bs = i2;
           for (var j = 0; j < 286; ++j)
             lf[j] = 0;
           for (var j = 0; j < 30; ++j)
             df[j] = 0;
         }
         var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-        if (rem > 2 && hv == hsh(i - dif)) {
+        if (rem > 2 && hv == hsh(i2 - dif)) {
           var maxn = Math.min(n, rem) - 1;
-          var maxd = Math.min(32767, i);
+          var maxd = Math.min(32767, i2);
           var ml = Math.min(258, rem);
           while (dif <= maxd && --ch_1 && imod != pimod) {
-            if (dat[i + l] == dat[i + l - dif]) {
+            if (dat[i2 + l] == dat[i2 + l - dif]) {
               var nl = 0;
-              for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl)
+              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
                 ;
               if (nl > l) {
                 l = nl, d = dif;
@@ -656,7 +2985,7 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
                 var mmd = Math.min(dif, nl - 2);
                 var md = 0;
                 for (var j = 0; j < mmd; ++j) {
-                  var ti = i - dif + j & 32767;
+                  var ti = i2 - dif + j & 32767;
                   var pti = prev[ti];
                   var cd = ti - pti & 32767;
                   if (cd > md)
@@ -674,32 +3003,32 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
           eb += fleb[lin] + fdeb[din];
           ++lf[257 + lin];
           ++df[din];
-          wi = i + l;
+          wi = i2 + l;
           ++lc_1;
         } else {
-          syms[li++] = dat[i];
-          ++lf[dat[i]];
+          syms[li++] = dat[i2];
+          ++lf[dat[i2]];
         }
       }
     }
-    for (i = Math.max(i, wi); i < s; ++i) {
-      syms[li++] = dat[i];
-      ++lf[dat[i]];
+    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
+      syms[li++] = dat[i2];
+      ++lf[dat[i2]];
     }
-    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
     if (!lst) {
       st.r = pos & 7 | w[pos / 8 | 0] << 3;
       pos -= 7;
-      st.h = head, st.p = prev, st.i = i, st.w = wi;
+      st.h = head, st.p = prev, st.i = i2, st.w = wi;
     }
   } else {
-    for (var i = st.w || 0; i < s + lst; i += 65535) {
-      var e = i + 65535;
+    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
+      var e = i2 + 65535;
       if (e >= s) {
         w[pos / 8 | 0] = lst;
         e = s;
       }
-      pos = wfblk(w, pos + 1, dat.subarray(i, e));
+      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
     }
     st.i = s;
   }
@@ -707,11 +3036,11 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
 };
 var crct = /* @__PURE__ */ (function() {
   var t = new Int32Array(256);
-  for (var i = 0; i < 256; ++i) {
-    var c = i, k = 9;
+  for (var i2 = 0; i2 < 256; ++i2) {
+    var c = i2, k = 9;
     while (--k)
       c = (c & 1 && -306674912) ^ c >>> 1;
-    t[i] = c;
+    t[i2] = c;
   }
   return t;
 })();
@@ -720,8 +3049,8 @@ var crc = function() {
   return {
     p: function(d) {
       var cr = c;
-      for (var i = 0; i < d.length; ++i)
-        cr = crct[cr & 255 ^ d[i]] ^ cr >>> 8;
+      for (var i2 = 0; i2 < d.length; ++i2)
+        cr = crct[cr & 255 ^ d[i2]] ^ cr >>> 8;
       c = cr;
     },
     d: function() {
@@ -782,8 +3111,8 @@ try {
 function strToU8(str, latin1) {
   if (latin1) {
     var ar_1 = new u8(str.length);
-    for (var i = 0; i < str.length; ++i)
-      ar_1[i] = str.charCodeAt(i);
+    for (var i2 = 0; i2 < str.length; ++i2)
+      ar_1[i2] = str.charCodeAt(i2);
     return ar_1;
   }
   if (te)
@@ -794,19 +3123,19 @@ function strToU8(str, latin1) {
   var w = function(v) {
     ar[ai++] = v;
   };
-  for (var i = 0; i < l; ++i) {
+  for (var i2 = 0; i2 < l; ++i2) {
     if (ai + 5 > ar.length) {
-      var n = new u8(ai + 8 + (l - i << 1));
+      var n = new u8(ai + 8 + (l - i2 << 1));
       n.set(ar);
       ar = n;
     }
-    var c = str.charCodeAt(i);
+    var c = str.charCodeAt(i2);
     if (c < 128 || latin1)
       w(c);
     else if (c < 2048)
       w(192 | c >> 6), w(128 | c & 63);
     else if (c > 55295 && c < 57344)
-      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i2) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
     else
       w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
   }
@@ -903,8 +3232,8 @@ function zipSync(data, opts) {
     tot += 76 + 2 * (s + exl) + (ms || 0) + l;
   }
   var out = new u8(tot + 22), oe = o, cdl = tot - o;
-  for (var i = 0; i < files.length; ++i) {
-    var f = files[i];
+  for (var i2 = 0; i2 < files.length; ++i2) {
+    var f = files[i2];
     wzh(out, f.o, f, f.f, f.u, f.c.length);
     var badd = 30 + f.f.length + exfl(f.extra);
     out.set(f.c, f.o + badd);
@@ -1398,8 +3727,7 @@ header {
 var DEMO_MANIFEST = {
   schema: 1,
   name: "Hello Marina",
-  icon: "\u26F5",
-  type: "static"
+  icon: "\u26F5"
 };
 
 // src/demo.ts
@@ -1424,20 +3752,24 @@ function packDemo() {
 }
 
 // src/login.ts
+init_config();
+init_api();
 import { createHash, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { hostname } from "node:os";
-var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var LOGIN_TIMEOUT_MS = 15 * 6e4;
 var PROGRESS_INTERVAL_MS = 1e3;
 var page = (title, message) => `<!doctype html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><meta name="color-scheme" content="light dark">
 <title>${title}</title><style>
-body{margin:0;display:grid;place-items:center;min-height:100vh;font:15px/1.5 system-ui,sans-serif;color:#142238;background:#faf9f7}
-main{text-align:center;padding:32px}h1{font-size:22px;margin:0 0 6px}p{margin:0;color:#667085}
+:root{color-scheme:light;--text:#142238;--muted:#667085;--background:#faf9f7}
+@media(prefers-color-scheme:dark){:root{color-scheme:dark;--text:#f2f4f7;--muted:#98a2b3;--background:#101828}}
+body{margin:0;display:grid;place-items:center;min-height:100vh;font:15px/1.5 system-ui,sans-serif;color:var(--text);background:var(--background)}
+main{text-align:center;padding:32px}h1{font-size:22px;margin:0 0 6px}p{margin:0;color:var(--muted)}
 </style></head><body><main><h1>${title}</h1><p>${message}</p></main></body></html>`;
-var closeLoginServer = (server) => new Promise((resolve2) => {
-  server.close(() => resolve2());
+var closeLoginServer = (server) => new Promise((resolve4) => {
+  server.close(() => resolve4());
   server.closeAllConnections();
 });
 function openBrowser(url) {
@@ -1455,7 +3787,7 @@ function timeoutLabel(timeoutMs) {
   return `${String(seconds)} second${seconds === 1 ? "" : "s"}`;
 }
 function waitForLoginCallback(server, expectedState, onProgress, timeoutMs = LOGIN_TIMEOUT_MS) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve4, reject) => {
     const startedAt = Date.now();
     const waiting = () => {
       const elapsedMs = Date.now() - startedAt;
@@ -1512,7 +3844,7 @@ function waitForLoginCallback(server, expectedState, onProgress, timeoutMs = LOG
       response.writeHead(200);
       response.end(
         page("Marina CLI is signed in", "You can close this window and return to the terminal."),
-        () => resolve2(code)
+        () => resolve4(code)
       );
     });
   });
@@ -1522,9 +3854,9 @@ async function loginWithBrowser(onOpen, onProgress = () => void 0) {
   const challenge = createHash("sha256").update(verifier).digest("base64url");
   const state = randomBytes(32).toString("base64url");
   const server = createServer();
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve4, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve2);
+    server.listen(0, "127.0.0.1", resolve4);
   });
   try {
     const address = server.address();
@@ -1548,65 +3880,18 @@ async function loginWithBrowser(onOpen, onProgress = () => void 0) {
   }
 }
 
-// src/output.ts
-var json = false;
-var setJsonMode = (on) => {
-  json = on;
-};
-var isJsonMode = () => json;
-var bold = (s) => `\x1B[1m${s}\x1B[22m`;
-var dim = (s) => `\x1B[2m${s}\x1B[22m`;
-var red = (s) => `\x1B[31m${s}\x1B[39m`;
-var green = (s) => `\x1B[32m${s}\x1B[39m`;
-function say(line = "") {
-  if (json) console.error(line);
-  else console.log(line);
-}
-function note(line) {
-  console.error(line);
-}
-function createProgress() {
-  let active = false;
-  let lastPhase = null;
-  let frame = 0;
-  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-  const interactive = process.stderr.isTTY === true && !json;
-  return {
-    update(phase, line) {
-      if (interactive) {
-        process.stderr.write(`\r\x1B[2K${frames[frame++ % frames.length]} ${line}`);
-        active = true;
-      } else if (phase !== lastPhase) {
-        console.error(json ? JSON.stringify({ type: "progress", phase, message: line }) : line);
-      }
-      lastPhase = phase;
-    },
-    clear() {
-      if (active) process.stderr.write("\r\x1B[2K");
-      active = false;
-    }
-  };
-}
-function result(payload) {
-  if (json) console.log(JSON.stringify({ schema_version: 1, ok: true, ...payload }, null, 2));
-}
-function failure(code, message, extra = {}) {
-  if (json)
-    console.log(
-      JSON.stringify({ schema_version: 1, ok: false, error: { code, message, ...extra } }, null, 2)
-    );
-  else {
-    console.error(`${red(code)} ${message}`);
-  }
-}
+// src/index.ts
+init_output();
 
 // src/pack.ts
-import { lstatSync, readFileSync as readFileSync2, readdirSync } from "node:fs";
-import { join as join2, relative } from "node:path";
+import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, readdirSync, realpathSync } from "node:fs";
+import { basename, dirname, join as join2, relative } from "node:path";
+var import_ignore = __toESM(require_ignore(), 1);
 var EXCLUDED_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".hg",
   ".svn",
+  ".marina",
   "node_modules",
   "bower_components",
   ".venv",
@@ -1622,23 +3907,74 @@ var EXCLUDED_DIRS = /* @__PURE__ */ new Set([
   "coverage",
   ".idea",
   ".vscode",
-  ".marina",
   "__MACOSX"
 ]);
 var EXCLUDED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
 var MAX_TOTAL = 100 * 1024 * 1024;
-var SECRET_FILE = /^(\.env(\.[^/]*)?|.*\.pem|.*\.p12|.*\.pfx|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials\.json|service-account\.json)$/i;
+var OUTPUT_DIR_NAMES = /* @__PURE__ */ new Set(["dist", "build", "out", ".output"]);
+function buildOutputParent(dir) {
+  let real;
+  try {
+    real = realpathSync(dir);
+  } catch {
+    return null;
+  }
+  if (!OUTPUT_DIR_NAMES.has(basename(dir)) && !OUTPUT_DIR_NAMES.has(basename(real))) return null;
+  if (!existsSync2(join2(real, "index.html"))) return null;
+  if (existsSync2(join2(real, "package.json")) || existsSync2(join2(real, "marina.json"))) return null;
+  for (const parent of /* @__PURE__ */ new Set([dirname(real), dirname(dir)])) {
+    if (parent === real || parent === dir) continue;
+    if (declaresBuild(parent)) return parent;
+  }
+  return null;
+}
+function declaresBuild(parent) {
+  try {
+    const parsed = JSON.parse(readFileSync2(join2(parent, "package.json"), "utf8"));
+    const build = parsed.scripts?.build;
+    return typeof build === "string" && build.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+var SECRET_FILE = /^(\.env(\.[^/]*)?|\.npmrc|.*\.pem|.*\.p12|.*\.pfx|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials\.json|service-account\.json)$/i;
+function ignoredBy(rules, path, directory) {
+  let ignored = false;
+  for (const rule of rules) {
+    const scopedPath = rule.base === "" ? path : path.startsWith(`${rule.base}/`) ? path.slice(rule.base.length + 1) : void 0;
+    if (!scopedPath) continue;
+    const result2 = rule.matcher.test(directory ? `${scopedPath}/` : scopedPath);
+    if (result2.ignored) ignored = true;
+    if (result2.unignored) ignored = false;
+  }
+  return ignored;
+}
 function pack(dir) {
   const files = {};
   const skippedSecrets = [];
   let totalBytes = 0;
-  const walk = (current) => {
+  const walk = (current, inheritedRules) => {
+    const currentRelative = relative(dir, current).replaceAll("\\", "/");
+    const rules = [...inheritedRules];
+    const gitignorePath = join2(current, ".gitignore");
+    if (existsSync2(gitignorePath)) {
+      const gitignoreStat = lstatSync(gitignorePath);
+      if (gitignoreStat.isFile() && !gitignoreStat.isSymbolicLink()) {
+        rules.push({
+          base: currentRelative,
+          matcher: (0, import_ignore.default)().add(readFileSync2(gitignorePath, "utf8"))
+        });
+      }
+    }
     for (const entry of readdirSync(current)) {
       const full = join2(current, entry);
       const stat = lstatSync(full);
       if (stat.isSymbolicLink()) continue;
+      const relativePath = relative(dir, full).replaceAll("\\", "/");
       if (stat.isDirectory()) {
-        if (!EXCLUDED_DIRS.has(entry)) walk(full);
+        if (!EXCLUDED_DIRS.has(entry) && !ignoredBy(rules, relativePath, true)) {
+          walk(full, rules);
+        }
         continue;
       }
       if (EXCLUDED_FILES.has(entry)) continue;
@@ -1646,27 +3982,28 @@ function pack(dir) {
         skippedSecrets.push(relative(dir, full));
         continue;
       }
+      if (ignoredBy(rules, relativePath, false)) continue;
       totalBytes += stat.size;
       if (totalBytes > MAX_TOTAL) {
         throw new Error(
           `this directory is over ${String(MAX_TOTAL / 1024 / 1024)} MB unpacked \u2014 trim it before deploying`
         );
       }
-      files[relative(dir, full).replaceAll("\\", "/")] = readFileSync2(full);
+      files[relativePath] = readFileSync2(full);
     }
   };
-  walk(dir);
+  walk(dir, []);
   const fileCount = Object.keys(files).length;
   if (fileCount === 0) throw new Error("nothing to deploy \u2014 this directory is empty");
   return { zip: zipSync(files), fileCount, totalBytes, skippedSecrets };
 }
 
 // src/manifest.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { basename, join as join3 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { basename as basename2, join as join3 } from "node:path";
 function readManifest(dir) {
   const path = join3(dir, "marina.json");
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   let value;
   try {
     value = JSON.parse(readFileSync3(path, "utf8"));
@@ -1687,7 +4024,7 @@ function readManifest(dir) {
     throw new Error('marina.json "icon" must be an emoji');
   }
   if (manifest.type !== void 0 && manifest.type !== "static" && manifest.type !== "dynamic") {
-    throw new Error('marina.json "type" must be "static" or "dynamic"');
+    throw new Error('marina.json "type" is obsolete; remove it and use "entrypoint" if needed');
   }
   return manifest;
 }
@@ -1702,16 +4039,16 @@ function resolveAppName(dir, flag, manifest = readManifest(dir), linkedName) {
   } catch {
   }
   if (linkedName?.trim()) return linkedName.trim();
-  return basename(dir);
+  return basename2(dir);
 }
 
 // src/skills.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join4 } from "node:path";
 
 // ../../skills/marina-deploy/SKILL.md
-var SKILL_default = '---\nname: marina-deploy\ndescription: Build, deploy, inspect, and recover applications on Marina Cloud with the Marina CLI. Use when a user asks to publish a project to Marina, create a first Marina demo, check whether a Marina deployment is live, diagnose a failed or refused deploy, inspect versions, or roll an app back.\n---\n\n# Marina Deploy\n\nUse the Marina CLI to deploy the user\'s project. Run commands with `--json` and\nfollow the returned result until the app is live.\n\n## Deploy\n\n1. Inspect the project and run its relevant local checks.\n2. Install the CLI if needed: `npm install -g @marina-cloud/cli`.\n3. If unauthenticated, run `marina setup` and let the user finish browser sign-in.\n4. Run `marina deploy --json` from the project directory.\n5. Return the live URL only when the result has `ok: true`, `state: "published"`,\n   `live: true`, and a non-null `url`.\n\nIf it returns a failure or refusal, use the returned message and build log to\nfix the project, verify it locally, and retry. Never bypass a refusal or\ndescribe an unpublished or failed version as live.\n\n## Create a demo\n\nFor a first demo, run `marina deploy demo --json`. This deploys the bundled\nHello Marina collage app directly. Treat it like any other deploy: return its\nURL only after the result says it is published and live.\n\n## Inspect or recover\n\n```sh\nmarina status --app <slug> --json\nmarina deploys --app <slug> --json\nmarina versions --app <slug> --json\nmarina rollback --app <slug> --to <hash> --json\n```\n\nIdentify the intended published version before rolling back, then confirm the\nresult with `marina status --json`.\n';
+var SKILL_default = "---\nname: marina-deploy\ndescription: Build, deploy, inspect, and recover applications on Marina Cloud with the Marina CLI. Use when a user asks to publish a project to Marina, create a first Marina demo, check whether a Marina deployment is live, diagnose a failed or refused deploy, inspect versions, or roll an app back.\n---\n\n# Marina Deploy\n\nUse the Marina CLI to deploy the user's project. Run commands with `--json` and\nfollow the returned result until the app is live.\n\n## Deploy\n\n1. Inspect the project and run its relevant local checks.\n2. Install the CLI if needed: `npm install -g @marina-cloud/cli`.\n3. If unauthenticated, run `marina setup` and let the user finish browser sign-in.\n4. Run `marina deploy --json` from the project directory.\n5. Return the live URL only when the result has `ok: true`, `state: \"published\"`,\n   `live: true`, and a non-null `url`.\n\nIf it returns a failure or refusal, use the returned message and build log to\nfix the project, verify it locally, and retry. Never bypass a refusal or\ndescribe an unpublished or failed version as live.\n\nMarina may recover an ambiguous or failed static build through its publishing\nagent. Inspect the returned `preparation` report and `build_log`: the agent can\nminimally repair and retry the build. Marina requires a successful build and\nmechanically verified output before publication.\n\nStatic source detection is deterministic: a non-empty `scripts.build` wins\nover root `index.html`; without a build script, root `index.html` is served\nas-is. Deploy the project root and let Marina build it. A finished output\ndirectory (for example, `marina deploy dist`) is refused when it belongs to a\nproject that declares a build; deploy that project's source instead.\n\nEvery accepted upload returns a `deploy_id`, including a first deploy refused\nbefore an app exists. Inspect that durable attempt with:\n\n```sh\nmarina deploys <deploy-id> --json\n```\n\nAn archive or security refusal may have a null `build_log` because no build was\nrun; the refusal and action are still preserved on the deploy attempt.\n\n## Develop locally\n\n`marina dev` runs the app on this machine with the production runtime\ncontract: local storage and an embedded Postgres (the app's\n`marina/migrations` apply on start), while `marina.capabilities` and\n`marina.connections` calls bridge to Marina under the signed-in user's\ndev-scoped grants. A denied bridged call names the missing grant \u2014 an\norganization admin adds it from the connection's Dev access control. Use\n`--port <port>` to change the listen port and `--schedules` to run scheduled\njobs locally. `marina.ai` bridges too; per-developer usage is metered.\n\n## Create a demo\n\nFor a first demo, run `marina deploy demo --json`. This deploys the bundled\nHello Marina collage app directly. Treat it like any other deploy: return its\nURL only after the result says it is published and live.\n\n## Inspect or recover\n\n```sh\nmarina status --app <slug> --json\nmarina deploys --app <slug> --json\nmarina deploys <deploy-id> --json\nmarina logs --app <slug>\nmarina versions --app <slug> --json\nmarina rollback --app <slug> --to <hash> --json\n```\n\n`marina logs` always returns structured JSON. Use it to inspect deployment\nevents, runtime invocations, console output, and exceptions. Follow\n`next_cursor` when older entries are needed.\n\nIdentify the intended published version before rolling back, then confirm the\nresult with `marina status --json`.\n";
 
 // ../../skills/marina-deploy/agents/openai.yaml
 var openai_default = 'interface:\n  display_name: "Marina Deploy"\n  short_description: "Build and deploy apps to Marina Cloud"\n  default_prompt: "Use $marina-deploy to deploy this project to Marina Cloud."\n';
@@ -1733,7 +4070,7 @@ function targets(agent) {
     }));
   }
   if (agent === "codex" || agent === "claude") return [{ agent, home: agentHomes[agent] }];
-  return Object.entries(agentHomes).filter(([, home]) => existsSync3(home)).map(([name, home]) => ({ agent: name, home }));
+  return Object.entries(agentHomes).filter(([, home]) => existsSync4(home)).map(([name, home]) => ({ agent: name, home }));
 }
 function install(target, update) {
   const directory = join4(target.home, "skills", "marina-deploy");
@@ -1769,56 +4106,14 @@ function installSkills(agent) {
   return selected.map((target) => install(target, true));
 }
 
-// package.json
-var package_default = {
-  name: "@marina-cloud/cli",
-  version: "0.0.3",
-  description: "Command-line client for Marina Cloud",
-  homepage: "https://github.com/marina-hq/marina#readme",
-  bugs: {
-    url: "https://github.com/marina-hq/marina/issues"
-  },
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/marina-hq/marina.git",
-    directory: "packages/cli"
-  },
-  bin: {
-    marina: "dist/marina.mjs"
-  },
-  files: [
-    "dist"
-  ],
-  type: "module",
-  publishConfig: {
-    access: "public",
-    provenance: true
-  },
-  scripts: {
-    build: 'esbuild src/index.ts --bundle --platform=node --target=node22 --format=esm --loader:.md=text --loader:.yaml=text --loader:.html=text --loader:.css=text --loader:.txt=text --outfile=dist/marina.mjs --banner:js="#!/usr/bin/env node" && chmod +x dist/marina.mjs',
-    typecheck: "tsc --noEmit",
-    test: "pnpm build && node --experimental-strip-types --test src/*.test.ts",
-    prepack: "pnpm build"
-  },
-  devDependencies: {
-    "@types/node": "^26.2.0",
-    esbuild: "^0.25.0",
-    fflate: "^0.8.2",
-    typescript: "^5.9.0"
-  },
-  engines: {
-    node: ">=22"
-  }
-};
-
 // src/update.ts
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var LATEST_URL = "https://registry.npmjs.org/@marina-cloud%2Fcli/latest";
+init_package();
+init_config();
+var NAG_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var parseVersion = (version) => version.replace(/^v/, "").split("-", 1)[0].split(".").map((part) => Number.parseInt(part, 10));
 function isNewerVersion(candidate, current) {
-  const parse = (version) => version.replace(/^v/, "").split("-", 1)[0].split(".").map((part) => Number.parseInt(part, 10));
-  const left = parse(candidate);
-  const right = parse(current);
+  const left = parseVersion(candidate);
+  const right = parseVersion(current);
   if (left.some(Number.isNaN) || right.some(Number.isNaN)) return false;
   for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
     const difference = (left[index] ?? 0) - (right[index] ?? 0);
@@ -1829,40 +4124,28 @@ function isNewerVersion(candidate, current) {
 async function availableUpdate() {
   if (process.env.MARINA_DISABLE_UPDATE_CHECK) return null;
   const current = package_default.version;
+  const latest = latestCliVersion();
+  if (!latest || !isNewerVersion(latest, current)) return null;
   const profile = readProfile();
-  const checkedAt = profile.update ? Date.parse(profile.update.checked_at) : Number.NaN;
-  let latest = profile.update?.latest;
-  if (!latest || !Number.isFinite(checkedAt) || Date.now() - checkedAt >= CHECK_INTERVAL_MS) {
-    try {
-      const response = await fetch(LATEST_URL, {
-        headers: { accept: "application/json" },
-        signal: AbortSignal.timeout(1500)
-      });
-      if (response.ok) {
-        const body = await response.json();
-        if (body.version) {
-          latest = body.version;
-          writeProfile({
-            ...readProfile(),
-            update: { checked_at: (/* @__PURE__ */ new Date()).toISOString(), latest }
-          });
-        }
-      }
-    } catch {
-    }
-  }
-  return latest && isNewerVersion(latest, current) ? {
+  const notifiedAt = profile.update?.notified_at ? Date.parse(profile.update.notified_at) : Number.NaN;
+  if (Number.isFinite(notifiedAt) && Date.now() - notifiedAt < NAG_INTERVAL_MS) return null;
+  writeProfile({
+    ...profile,
+    update: { latest, notified_at: (/* @__PURE__ */ new Date()).toISOString() }
+  });
+  return {
     current,
     latest,
     command: "npm install -g @marina-cloud/cli@latest"
-  } : null;
+  };
 }
 
 // src/index.ts
 var HELP = `${bold("marina")} \u2014 deploy internal apps
 
-  marina setup                   sign in with Clerk in your browser
-      --token mar_\u2026              save an existing API key (headless fallback)
+  marina setup                   sign in through Marina in your browser
+      --skills                   install the Marina deployment skill
+      --deploy-demo              deploy Hello Marina after signing in
   marina logout                  remove the saved credential
   marina profile                 show where this CLI is signed in
   marina skills install          install or update the Marina deployment skill
@@ -1873,20 +4156,25 @@ var HELP = `${bold("marina")} \u2014 deploy internal apps
       --app <slug>               deploy into an existing app
   marina status [--app <slug>]   what is live, and how the last deploy went
   marina deploys [--app <slug>]  recent deploy attempts, including refusals
+  marina deploys <deploy-id>     inspect one attempt, even before an app exists
+  marina logs [--app <slug>]     structured JSON runtime invocations, console output, and errors
+      --level <level>            debug, info, log, warn, or error
+      --limit <count>            1\u2013200 entries (default: 100)
+      --cursor <cursor>          continue from a prior result
   marina versions [--app <slug>] version history
   marina rollback [--to <hash>]  publish a previous version again
-  marina secrets                 list env vars and secrets for the app
-  marina secrets set K=V         set one (--plain for a non-secret var)
-  marina secrets rm K            remove one
+  marina dev [dir]               run this app locally against Marina
+      --port <port>              listen port (default: 5990)
+      --schedules                run scheduled jobs on their local timers
+  marina ai models               models marina.ai can generate with, and who pays
   marina list                    apps in your workspace
   marina open                    open this project's app
 
-  ${dim("--json  machine-readable result on stdout, progress on stderr")}
-  ${dim(`API: ${apiUrl()} (override with MARINA_API)`)}`;
+  ${dim("--json  machine-readable result on stdout, progress on stderr")}`;
 var ANSI_ESCAPE = new RegExp(`${String.fromCodePoint(27)}\\[[0-9;]*m`, "g");
 var shouldCheckForUpdates = false;
 function targetApp(flag) {
-  const linked = readLink(resolve("."))?.app;
+  const linked = readLink(resolve3("."))?.app;
   const app = flag ?? linked;
   if (!app) {
     failure("no_app", "no app here \u2014 pass --app <slug>, or deploy from a linked project");
@@ -1895,7 +4183,16 @@ function targetApp(flag) {
   return app;
 }
 var shortDigest = (digest) => digest?.slice(7, 14) ?? "\u2014";
-async function deploy(dirArg, flags) {
+function deployAttemptHint(deployId, hasBuildLog) {
+  if (isJsonMode()) return;
+  const command = `marina deploys ${terminalSafeText(deployId)} --json`;
+  note(
+    dim(
+      `${hasBuildLog ? "build log omitted from terminal; " : ""}retrieve structured JSON with: ${command}`
+    )
+  );
+}
+async function deploy(dirArg, flags, emitResult = true) {
   let dir = null;
   let link = null;
   let target;
@@ -1909,20 +4206,32 @@ async function deploy(dirArg, flags) {
     packed = packDemo();
     name = flags.name?.trim() || DEMO_MANIFEST.name;
   } else {
-    dir = resolve(dirArg ?? ".");
+    dir = resolve3(dirArg ?? ".");
     link = readLink(dir);
     target = flags.app ?? link?.app;
     const manifest = readManifest(dir);
     name = resolveAppName(dir, flags.name, manifest, link?.name);
+    const builtFrom = buildOutputParent(dir);
+    if (builtFrom) {
+      const refusal = {
+        code: "prebuilt_output",
+        message: `${dir} looks like the build output of ${builtFrom}, not source.`,
+        action: "Deploy the project root; Marina runs the build itself."
+      };
+      failure("refused", refusal.message, { refusal });
+      if (!isJsonMode()) note(`        ${terminalSafeText(refusal.action)}`);
+      process.exit(3);
+    }
     packed = pack(dir);
   }
-  for (const secret of packed.skippedSecrets) say(dim(`skipped ${secret} \u2014 secrets stay local`));
+  for (const secret of packed.skippedSecrets)
+    say(dim(`skipped ${secret} \u2014 credential files are never deployed`));
   const progress = createProgress();
   const size = `${String(packed.fileCount)} files, ${String(Math.round(packed.totalBytes / 1024))} KB`;
   progress.update("uploading", `Uploading ${name} (${size})`);
   let started;
   try {
-    started = await startDeploy(packed.zip, name, target);
+    started = await startDeploy(packed.zip, name, target, link?.base_revision);
   } catch (error) {
     progress.clear();
     if (error instanceof ApiError && error.code === "not_found" && link) {
@@ -1940,32 +4249,43 @@ async function deploy(dirArg, flags) {
     deployed = await pollDeploy(started.id, (current) => {
       if (current.status !== "queued" && current.status !== "building") return;
       const elapsed = Math.max(1, Math.round((Date.now() - deployedAt) / 1e3));
-      const message = current.status === "queued" ? `Waiting for a deploy worker (${String(elapsed)}s)` : `Building and verifying (${String(elapsed)}s)`;
+      const message = current.build_message ? `${terminalSafeText(current.build_message)} (${String(elapsed)}s)` : current.status === "queued" ? `Waiting for a deploy worker (${String(elapsed)}s)` : `Building and verifying (${String(elapsed)}s)`;
       progress.update(current.status, message);
     });
   } finally {
     progress.clear();
   }
   if (deployed.status === "refused" && deployed.refusal) {
-    say(`${red("refused")} ${deployed.refusal.message}`);
-    if (deployed.refusal.action) say(`        ${deployed.refusal.action}`);
-    if (deployed.build_log) {
-      say(dim("---- build log (tail) ----"));
-      say(dim(deployed.build_log.split("\n").slice(-20).join("\n")));
-    }
     failure("refused", deployed.refusal.message, {
+      deploy_id: deployed.id,
       refusal: deployed.refusal,
-      build_log: deployed.build_log
+      build_log: deployed.build_log,
+      build_phase: deployed.build_phase,
+      build_message: deployed.build_message
     });
+    if (!isJsonMode() && deployed.refusal.action) {
+      note(`        ${terminalSafeText(deployed.refusal.action)}`);
+    }
+    deployAttemptHint(deployed.id, deployed.build_log !== null);
     process.exit(3);
   }
   if (deployed.status === "failed") {
-    failure("failed", deployed.error ?? "unknown error");
+    failure("failed", deployed.error ?? "unknown error", {
+      deploy_id: deployed.id,
+      build_log: deployed.build_log,
+      build_phase: deployed.build_phase,
+      build_message: deployed.build_message
+    });
+    deployAttemptHint(deployed.id, deployed.build_log !== null);
     process.exit(1);
   }
   const slug = deployed.app_slug ?? "";
-  if (dir && (!link || link.app !== slug || link.name !== name)) {
-    writeLink(dir, { app: slug, name });
+  if (dir && (!link || link.app !== slug || link.name !== name || link.base_revision !== (deployed.source_revision ?? void 0))) {
+    writeLink(dir, {
+      app: slug,
+      name,
+      ...deployed.source_revision ? { base_revision: deployed.source_revision } : {}
+    });
   }
   const published = deployed.version_state === "published";
   say(
@@ -1984,30 +4304,35 @@ async function deploy(dirArg, flags) {
     if (deployed.version_url) say(`   try this version: ${deployed.version_url}`);
     say(dim("   a publisher can approve it from the Marina inbox"));
   }
-  result({
+  const payload = {
     command: "deploy",
     status: "succeeded",
+    deploy_id: deployed.id,
     app: slug,
     version: deployed.version_number,
     state: deployed.version_state,
     url: deployed.url,
     version_url: deployed.version_url,
+    build_log: deployed.build_log,
     preparation: deployed.preparation,
     live: published,
     demo: dirArg === "demo"
-  });
+  };
+  if (emitResult) result(payload);
+  return payload;
 }
 async function status(appFlag) {
   const app = targetApp(appFlag);
-  const [detail, deploys2] = await Promise.all([getApp(app), listDeploys(app, 1)]);
-  const last = deploys2[0];
+  const [detail, history] = await Promise.all([getApp(app), listDeploys(app, 1)]);
+  const last = history[0];
   say(`${bold(detail.app.name)} ${dim(`(${detail.app.slug})`)}`);
   say(`  ${detail.app.current_version_id ? green(detail.app.status) : dim("nothing published")}`);
   if (detail.app.current_version_id) say(`  ${detail.url}`);
   if (detail.app.archived_at) say(`  ${red("archived")} \u2014 it isn't serving`);
   if (last) {
     const outcome = last.status === "succeeded" ? green("succeeded") : last.status === "queued" || last.status === "building" ? last.status : red(last.status);
-    say(`  last deploy: ${outcome}${last.refusal ? ` \u2014 ${last.refusal.message}` : ""}`);
+    const version = last.version_number == null ? "" : ` v${String(last.version_number)}`;
+    say(`  last deploy: ${outcome}${version}${last.refusal ? ` \u2014 ${last.refusal.message}` : ""}`);
   }
   result({
     command: "status",
@@ -2020,17 +4345,55 @@ async function status(appFlag) {
     last_deploy: last ?? null
   });
 }
-async function deploys(appFlag) {
+function deployOutcome(attempt) {
+  return attempt.refusal?.message ?? attempt.error ?? attempt.status;
+}
+async function deploys(appFlag, deployId) {
+  if (deployId) {
+    const attempt = await getDeploy(deployId);
+    const mark = attempt.status === "succeeded" ? green("ok") : red(attempt.status);
+    say(`${mark} ${dim(attempt.id)} \u2014 ${terminalSafeText(deployOutcome(attempt))}`);
+    if (attempt.build_log) deployAttemptHint(attempt.id, true);
+    result({ command: "deploys.show", deploy: attempt });
+    return;
+  }
   const app = targetApp(appFlag);
   const rows = await listDeploys(app);
   if (rows.length === 0) say("no deploys yet");
   for (const row of rows) {
     const mark = row.status === "succeeded" ? green("ok") : red(row.status);
-    const why = row.refusal ? ` \u2014 ${row.refusal.message}` : row.error ? ` \u2014 ${row.error}` : "";
-    say(`${mark}  ${dim(row.created_at)} ${dim(`via ${row.source}`)}${why}`);
+    const why = row.refusal ? ` \u2014 ${terminalSafeText(row.refusal.message)}` : row.error ? ` \u2014 ${terminalSafeText(row.error)}` : "";
+    const version = row.version_number == null ? "" : ` v${String(row.version_number)}`;
+    say(`${mark}${version}  ${dim(row.created_at)} ${dim(`via ${row.source}`)}${why}`);
   }
+  const failedWithLog = rows.find((row) => row.status !== "succeeded" && row.build_log);
+  if (failedWithLog) deployAttemptHint(failedWithLog.id, true);
   result({ command: "deploys", app, deploys: rows });
 }
+var LOG_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "log", "warn", "error"]);
+async function logs(appFlag, flags) {
+  const app = targetApp(appFlag);
+  const parsedLimit = flags.limit === void 0 ? 100 : Number(flags.limit);
+  if (!Number.isInteger(parsedLimit) || parsedLimit < 1 || parsedLimit > 200) {
+    failure("invalid_input", "--limit must be an integer from 1 to 200");
+    process.exit(1);
+  }
+  if (flags.level && !LOG_LEVELS.has(flags.level)) {
+    failure("invalid_input", "--level must be debug, info, log, warn, or error");
+    process.exit(1);
+  }
+  const response = await listRuntimeLogs(app, {
+    limit: parsedLimit,
+    cursor: flags.cursor,
+    level: flags.level
+  });
+  result({
+    command: "logs",
+    app,
+    logs: response.logs,
+    next_cursor: response.nextCursor
+  });
+}
 async function versions(appFlag) {
   const app = targetApp(appFlag);
   const [rows, detail] = await Promise.all([listVersions(app), getApp(app)]);
@@ -2072,70 +4435,40 @@ async function rollback(appFlag, to) {
     url: detail.url
   });
 }
-async function secrets(appFlag, argv, plain) {
-  const app = targetApp(appFlag);
-  const [action, argument] = argv;
-  if (action === "set") {
-    const eq = argument?.indexOf("=") ?? -1;
-    if (!argument || eq < 1) {
-      failure("invalid_input", "usage: marina secrets set KEY=value");
-      process.exit(1);
-    }
-    const key = argument.slice(0, eq);
-    await setEnv(app, key, argument.slice(eq + 1), !plain);
-    say(`${green("ok")} set ${bold(key)}${plain ? "" : dim(" (secret)")}`);
-    result({ command: "secrets.set", app, key, kind: plain ? "plain" : "secret" });
-    return;
-  }
-  if (action === "rm") {
-    if (!argument) {
-      failure("invalid_input", "usage: marina secrets rm KEY");
-      process.exit(1);
-    }
-    await deleteEnv(app, argument);
-    say(`${green("ok")} removed ${bold(argument)}`);
-    result({ command: "secrets.rm", app, key: argument, removed: true });
-    return;
-  }
-  const rows = await listEnv(app);
-  if (rows.length === 0) say("nothing set");
-  for (const row of rows) {
-    say(
-      `${bold(row.key)}  ${row.kind === "secret" ? dim("secret \u2014 write-only") : row.value ?? ""}`
-    );
-  }
-  result({ command: "secrets.list", app, env: rows });
-}
 async function main() {
   setJsonMode(process.argv.slice(2).includes("--json"));
   const { positionals, values } = parseArgs({
     allowPositionals: true,
     options: {
-      token: { type: "string" },
       name: { type: "string" },
       app: { type: "string" },
       to: { type: "string" },
-      plain: { type: "boolean" },
+      level: { type: "string" },
+      limit: { type: "string" },
+      cursor: { type: "string" },
       agent: { type: "string" },
+      port: { type: "string" },
+      schedules: { type: "boolean" },
+      dir: { type: "string" },
+      skills: { type: "boolean" },
+      "deploy-demo": { type: "boolean" },
       json: { type: "boolean" },
       help: { type: "boolean", short: "h" }
     }
   });
-  setJsonMode(values.json === true);
   const command = positionals[0];
+  setJsonMode(values.json === true || command === "logs");
   if (values.help || !command) {
     say(HELP);
     result({ command: "help", usage: HELP.replaceAll(ANSI_ESCAPE, "") });
     return;
   }
+  await resolveControlPlane();
   shouldCheckForUpdates = true;
   switch (command) {
     case "setup":
     case "login": {
-      const token = values.token ?? process.env.MARINA_TOKEN;
-      if (token) {
-        saveToken(token);
-      } else {
+      if (!process.env.MARINA_TOKEN) {
         let lastReportedRemaining = -1;
         const signedIn = await loginWithBrowser(
           (url) => {
@@ -2166,11 +4499,18 @@ async function main() {
         saveToken(signedIn.token);
       }
       say(`${green("ok")} signed in ${dim(`(${apiUrl()})`)}`);
+      const installed = values.skills ? installSkills(values.agent) : void 0;
+      for (const skill of installed ?? []) {
+        say(`${green("ok")} ${skill.status} Marina skill for ${skill.agent} ${dim(skill.path)}`);
+      }
+      const demo = values["deploy-demo"] ? await deploy("demo", { name: values.name }, false) : void 0;
       result({
         command: "setup",
         signed_in: true,
         api: apiUrl(),
-        profile: profilePath()
+        profile: profilePath(),
+        ...installed ? { skills: installed } : {},
+        ...demo ? { deploy: demo } : {}
       });
       return;
     }
@@ -2188,6 +4528,20 @@ async function main() {
       });
       return;
     }
+    case "dev": {
+      const { runDev: runDev2 } = await Promise.resolve().then(() => (init_dev(), dev_exports));
+      try {
+        await runDev2({
+          dir: values.dir ?? positionals[1],
+          port: values.port,
+          schedules: values.schedules === true
+        });
+      } catch (error) {
+        failure("dev_failed", error.message);
+        process.exitCode = 1;
+      }
+      return;
+    }
     case "profile": {
       const profile = readProfile();
       const source = process.env.MARINA_TOKEN ? "environment" : profile.token ? "profile" : null;
@@ -2214,6 +4568,23 @@ async function main() {
       result({ command: "skills.install", skills: installed });
       return;
     }
+    case "ai": {
+      if (positionals[1] !== "models") {
+        failure("invalid_input", "usage: marina ai models");
+        process.exit(1);
+      }
+      const view = await aiModels();
+      say(`${bold("fast")}   ${view.aliases.fast ?? dim("(broker unreachable)")}`);
+      say(`${bold("smart")}  ${view.aliases.smart ?? dim("(broker unreachable)")}`);
+      if (view.models.length === 0) {
+        say(dim("no library models offered on this deployment"));
+      }
+      for (const model of view.models) say(`  ${model}`);
+      const billing = view.billing === "workspace" ? "generations bill this workspace's OpenRouter account (BYOK)" : view.billing === "platform" ? "generations bill Marina's platform key \u2014 connect OpenRouter to use your own" : "no AI billing key: connect OpenRouter in Settings \u2192 Connections";
+      say(dim(billing));
+      result({ command: "ai.models", ...view });
+      return;
+    }
     case "deploy":
       await deploy(positionals[1], values);
       return;
@@ -2222,7 +4593,10 @@ async function main() {
       return;
     case "deploys":
     case "deployments":
-      await deploys(values.app);
+      await deploys(values.app, positionals[1]);
+      return;
+    case "logs":
+      await logs(values.app, values);
       return;
     case "versions":
       await versions(values.app);
@@ -2230,9 +4604,6 @@ async function main() {
     case "rollback":
       await rollback(values.app, values.to);
       return;
-    case "secrets":
-      await secrets(values.app, positionals.slice(1), values.plain === true);
-      return;
     case "list": {
       const apps = await listApps();
       if (apps.length === 0) say("no apps yet \u2014 `marina deploy` one");
@@ -2266,8 +4637,8 @@ async function run() {
   if (!shouldCheckForUpdates) return;
   const update = await availableUpdate();
   if (update) {
-    const message = `Marina CLI ${update.latest} is available (current ${update.current}) \u2014 ${update.command}`;
-    note(isJsonMode() ? message : dim(message));
+    const detail = `Marina CLI ${update.latest} is available (current ${update.current}) \u2014 ${update.command}`;
+    note(isJsonMode() ? detail : `${bold("Update available:")} ${detail}`);
   }
 }
 run().catch((error) => {