@marina-cloud/cli 0.0.4 → 0.0.5

package/dist/marina.mjs

@@ -1,8 +1,112 @@
 #!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res, err2) => function __init() {
+  if (err2) throw err2[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err2 = [e], e;
+  }
+};
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 
-// src/index.ts
-import { resolve } from "node:path";
-import { parseArgs } from "node:util";
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@marina-cloud/cli",
+      version: "0.0.5",
+      description: "Command-line client for Marina Cloud",
+      homepage: "https://github.com/marina-hq/marina#readme",
+      bugs: {
+        url: "https://github.com/marina-hq/marina/issues"
+      },
+      license: "Apache-2.0",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/marina-hq/marina.git",
+        directory: "packages/cli"
+      },
+      bin: {
+        marina: "dist/marina.mjs"
+      },
+      files: [
+        "dist"
+      ],
+      type: "module",
+      publishConfig: {
+        access: "public",
+        provenance: true
+      },
+      scripts: {
+        build: 'esbuild src/index.ts --bundle --platform=node --target=node22 --format=esm --loader:.md=text --loader:.yaml=text --loader:.html=text --loader:.css=text --loader:.txt=text --external:@electric-sql/pglite --external:esbuild --outfile=dist/marina.mjs --banner:js="#!/usr/bin/env node" && chmod +x dist/marina.mjs',
+        typecheck: "tsc --noEmit",
+        test: "pnpm build && node --experimental-strip-types --test src/*.test.ts",
+        prepack: "pnpm build"
+      },
+      dependencies: {
+        "@electric-sql/pglite": "^0.3.6",
+        esbuild: "^0.28.2",
+        ignore: "^7.0.6"
+      },
+      devDependencies: {
+        "@types/node": "26.2.0",
+        fflate: "^0.8.3",
+        typescript: "7.0.2"
+      },
+      engines: {
+        node: ">=22"
+      }
+    };
+  }
+});
+
+// src/identity.ts
+var CLI_VERSION, cliRequestHeaders;
+var init_identity = __esm({
+  "src/identity.ts"() {
+    "use strict";
+    init_package();
+    CLI_VERSION = package_default.version;
+    cliRequestHeaders = () => ({
+      "user-agent": `marina-cli/${CLI_VERSION}`,
+      "x-marina-client": "cli",
+      "x-marina-client-version": CLI_VERSION
+    });
+  }
+});
 
 // src/config.ts
 import {
@@ -16,64 +120,6 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-
-// package.json
-var package_default = {
-  name: "@marina-cloud/cli",
-  version: "0.0.4",
-  description: "Command-line client for Marina Cloud",
-  homepage: "https://github.com/marina-hq/marina#readme",
-  bugs: {
-    url: "https://github.com/marina-hq/marina/issues"
-  },
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/marina-hq/marina.git",
-    directory: "packages/cli"
-  },
-  bin: {
-    marina: "dist/marina.mjs"
-  },
-  files: [
-    "dist"
-  ],
-  type: "module",
-  publishConfig: {
-    access: "public",
-    provenance: true
-  },
-  scripts: {
-    build: 'esbuild src/index.ts --bundle --platform=node --target=node22 --format=esm --loader:.md=text --loader:.yaml=text --loader:.html=text --loader:.css=text --loader:.txt=text --outfile=dist/marina.mjs --banner:js="#!/usr/bin/env node" && chmod +x dist/marina.mjs',
-    typecheck: "tsc --noEmit",
-    test: "pnpm build && node --experimental-strip-types --test src/*.test.ts",
-    prepack: "pnpm build"
-  },
-  devDependencies: {
-    "@types/node": "^26.2.0",
-    esbuild: "^0.25.0",
-    fflate: "^0.8.2",
-    typescript: "^5.9.0"
-  },
-  engines: {
-    node: ">=22"
-  }
-};
-
-// src/identity.ts
-var CLI_VERSION = package_default.version;
-var cliRequestHeaders = () => ({
-  "user-agent": `marina-cli/${CLI_VERSION}`,
-  "x-marina-client": "cli",
-  "x-marina-client-version": CLI_VERSION
-});
-
-// src/config.ts
-var MARINA_HOME = process.env.MARINA_HOME ?? join(homedir(), ".marina");
-var PROFILE = join(MARINA_HOME, "profile");
-var PRODUCTION_CONTROL_PLANE = "https://marina.cloud";
-var CONTROL_PLANE_CACHE_MS = 60 * 60 * 1e3;
-var resolvedControlPlane = null;
 function normalizeApiUrl(value) {
   const url = new URL(value);
   if (url.protocol !== "https:" && url.protocol !== "http:") {
@@ -87,9 +133,6 @@ function normalizeApiUrl(value) {
   }
   return url.origin;
 }
-var controlPlaneHost = () => normalizeApiUrl(
-  process.env.MARINA_CONTROL_PLANE ?? readProfile().control_plane_host ?? PRODUCTION_CONTROL_PLANE
-);
 function cachedControlPlane(host = controlPlaneHost()) {
   const cached = readProfile().control_plane;
   if (!cached || cached.host !== host) return null;
@@ -101,15 +144,6 @@ function cachedControlPlane(host = controlPlaneHost()) {
     return null;
   }
 }
-var apiUrl = () => normalizeApiUrl(
-  process.env.MARINA_API ?? resolvedControlPlane?.api_url ?? cachedControlPlane()?.api_url ?? controlPlaneHost()
-);
-var dashboardUrl = () => {
-  if (process.env.MARINA_DASHBOARD) return normalizeApiUrl(process.env.MARINA_DASHBOARD);
-  return normalizeApiUrl(
-    resolvedControlPlane?.dashboard_url ?? cachedControlPlane()?.dashboard_url ?? controlPlaneHost()
-  );
-};
 async function resolveControlPlane() {
   const host = controlPlaneHost();
   const cached = cachedControlPlane(host);
@@ -161,7 +195,6 @@ async function resolveControlPlane() {
 function latestCliVersion() {
   return resolvedControlPlane?.latest_cli_version ?? cachedControlPlane()?.latest_cli_version ?? null;
 }
-var profilePath = () => PROFILE;
 function readProfile() {
   try {
     return JSON.parse(readFileSync(PROFILE, "utf8"));
@@ -195,145 +228,2304 @@ function clearToken() {
     }
     return;
   }
-  writeProfile(rest);
+  writeProfile(rest);
+}
+function readLink(dir) {
+  try {
+    return JSON.parse(readFileSync(join(dir, LINK), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeLink(dir, link) {
+  mkdirSync(join(dir, ".marina"), { recursive: true });
+  writeFileSync(join(dir, LINK), `${JSON.stringify(link, null, 2)}
+`);
+}
+var MARINA_HOME, PROFILE, PRODUCTION_CONTROL_PLANE, CONTROL_PLANE_CACHE_MS, resolvedControlPlane, controlPlaneHost, apiUrl, dashboardUrl, profilePath, LINK;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_identity();
+    MARINA_HOME = process.env.MARINA_HOME ?? join(homedir(), ".marina");
+    PROFILE = join(MARINA_HOME, "profile");
+    PRODUCTION_CONTROL_PLANE = "https://marina.cloud";
+    CONTROL_PLANE_CACHE_MS = 60 * 60 * 1e3;
+    resolvedControlPlane = null;
+    controlPlaneHost = () => normalizeApiUrl(
+      process.env.MARINA_CONTROL_PLANE ?? readProfile().control_plane_host ?? PRODUCTION_CONTROL_PLANE
+    );
+    apiUrl = () => normalizeApiUrl(
+      process.env.MARINA_API ?? resolvedControlPlane?.api_url ?? cachedControlPlane()?.api_url ?? controlPlaneHost()
+    );
+    dashboardUrl = () => {
+      if (process.env.MARINA_DASHBOARD) return normalizeApiUrl(process.env.MARINA_DASHBOARD);
+      return normalizeApiUrl(
+        resolvedControlPlane?.dashboard_url ?? cachedControlPlane()?.dashboard_url ?? controlPlaneHost()
+      );
+    };
+    profilePath = () => PROFILE;
+    LINK = ".marina/project.json";
+  }
+});
+
+// src/api.ts
+async function request(path, init) {
+  const token = getToken();
+  if (!token) throw new ApiError("unauthenticated", "not signed in \u2014 run `marina setup`", 401);
+  const res = await fetch(`${apiUrl()}${path}`, {
+    ...init,
+    headers: { ...cliRequestHeaders(), authorization: `Bearer ${token}`, ...init?.headers }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new ApiError(
+      body.error?.code ?? "error",
+      body.error?.message ?? `request failed (${String(res.status)})`,
+      res.status
+    );
+  }
+  return body;
+}
+async function me() {
+  return request("/v1/me");
+}
+async function exchangeCliLogin(code, codeVerifier) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl()}/cli/auth/exchange`, {
+      method: "POST",
+      headers: { ...cliRequestHeaders(), "content-type": "application/json" },
+      body: JSON.stringify({ code, code_verifier: codeVerifier }),
+      signal: AbortSignal.timeout(LOGIN_EXCHANGE_TIMEOUT_MS)
+    });
+  } catch (error) {
+    if (error.name === "TimeoutError") {
+      throw new ApiError(
+        "login_timeout",
+        "the login confirmation request timed out after 15 seconds \u2014 run `marina setup` to try again",
+        408
+      );
+    }
+    throw error;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.token) {
+    throw new ApiError(
+      body.error?.code ?? "login_failed",
+      body.error?.message ?? `login exchange failed (${String(res.status)})`,
+      res.status
+    );
+  }
+  return body.token;
+}
+async function startDeploy(zip, name, app, baseRevision) {
+  const form = new FormData();
+  form.set(
+    "code",
+    new Blob([new Uint8Array(zip).buffer], { type: "application/zip" }),
+    "upload.zip"
+  );
+  form.set("name", name);
+  form.set("source", "cli");
+  if (app) form.set("app", app);
+  if (baseRevision) form.set("base_revision", baseRevision);
+  const res = await request("/v1/deploys", {
+    method: "POST",
+    body: form
+  });
+  return res.deploy;
+}
+async function pollDeploy(id, onProgress = () => void 0) {
+  for (; ; ) {
+    const deploy2 = await getDeploy(id);
+    onProgress(deploy2);
+    if (deploy2.status !== "queued" && deploy2.status !== "building") return deploy2;
+    await new Promise((resolve4) => setTimeout(resolve4, 500));
+  }
+}
+async function getDeploy(id) {
+  const res = await request(`/v1/deploys/${encodeURIComponent(id)}`);
+  return res.deploy;
+}
+async function listApps() {
+  const res = await request("/v1/apps");
+  return res.apps;
+}
+async function getAppUrl(idOrSlug) {
+  return (await getApp(idOrSlug)).url;
+}
+async function listVersions(app) {
+  const res = await request(
+    `/v1/apps/${encodeURIComponent(app)}/versions`
+  );
+  return res.versions;
+}
+async function listDeploys(app, limit = 10) {
+  const res = await request(
+    `/v1/apps/${encodeURIComponent(app)}/deploys?limit=${String(limit)}`
+  );
+  return res.deploys;
+}
+async function listRuntimeLogs(app, options = {}) {
+  const query = new URLSearchParams();
+  query.set("limit", String(options.limit ?? 100));
+  if (options.cursor) query.set("cursor", options.cursor);
+  if (options.level) query.set("level", options.level);
+  const response = await request(
+    `/v1/apps/${encodeURIComponent(app)}/logs?${query.toString()}`
+  );
+  return { logs: response.logs, nextCursor: response.next_cursor };
+}
+async function restoreVersion(versionId) {
+  const res = await request(`/v1/versions/${versionId}/restore`, {
+    method: "POST"
+  });
+  return res.version;
+}
+var LOGIN_EXCHANGE_TIMEOUT_MS, ApiError, aiModels, getApp;
+var init_api = __esm({
+  "src/api.ts"() {
+    "use strict";
+    init_config();
+    init_identity();
+    LOGIN_EXCHANGE_TIMEOUT_MS = 15e3;
+    ApiError = class extends Error {
+      code;
+      status;
+      constructor(code, message, status2) {
+        super(message);
+        this.code = code;
+        this.status = status2;
+      }
+    };
+    aiModels = () => request("/v1/ai/models");
+    getApp = (idOrSlug) => request(`/v1/apps/${encodeURIComponent(idOrSlug)}`);
+  }
+});
+
+// src/output.ts
+function terminalSafeText(value) {
+  return Array.from(value, (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    if (code >= 32 && (code < 127 || code > 159)) return character;
+    if (code === 9) return "\\t";
+    if (code === 10) return "\\n";
+    if (code === 13) return "\\r";
+    return `\\u{${code.toString(16).padStart(4, "0")}}`;
+  }).join("");
+}
+function terminalSafeJson(payload, space) {
+  return Array.from(JSON.stringify(payload, null, space), (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : character;
+  }).join("");
+}
+function say(line = "") {
+  if (json) console.error(line);
+  else console.log(line);
+}
+function note(line) {
+  console.error(line);
+}
+function createProgress() {
+  let active = false;
+  let lastPhase = null;
+  let frame = 0;
+  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  const interactive = process.stderr.isTTY === true && !json;
+  return {
+    update(phase, line) {
+      if (interactive) {
+        process.stderr.write(`\r\x1B[2K${frames[frame++ % frames.length]} ${line}`);
+        active = true;
+      } else if (phase !== lastPhase) {
+        console.error(json ? terminalSafeJson({ type: "progress", phase, message: line }) : line);
+      }
+      lastPhase = phase;
+    },
+    clear() {
+      if (active) process.stderr.write("\r\x1B[2K");
+      active = false;
+    }
+  };
+}
+function result(payload) {
+  if (json) console.log(terminalSafeJson({ schema_version: 1, ok: true, ...payload }, 2));
+}
+function failure(code, message, extra = {}) {
+  if (json)
+    console.log(
+      terminalSafeJson({ schema_version: 1, ok: false, error: { code, message, ...extra } }, 2)
+    );
+  else {
+    console.error(`${red(terminalSafeText(code))} ${terminalSafeText(message)}`);
+  }
+}
+var json, setJsonMode, isJsonMode, bold, dim, red, green;
+var init_output = __esm({
+  "src/output.ts"() {
+    "use strict";
+    json = false;
+    setJsonMode = (on) => {
+      json = on;
+    };
+    isJsonMode = () => json;
+    bold = (s) => `\x1B[1m${s}\x1B[22m`;
+    dim = (s) => `\x1B[2m${s}\x1B[22m`;
+    red = (s) => `\x1B[31m${s}\x1B[39m`;
+    green = (s) => `\x1B[32m${s}\x1B[39m`;
+  }
+});
+
+// ../../node_modules/.pnpm/ignore@7.0.8/node_modules/ignore/index.js
+var require_ignore = __commonJS({
+  "../../node_modules/.pnpm/ignore@7.0.8/node_modules/ignore/index.js"(exports, module) {
+    function makeArray(subject) {
+      return Array.isArray(subject) ? subject : [subject];
+    }
+    var UNDEFINED = void 0;
+    var EMPTY = "";
+    var SPACE = " ";
+    var ESCAPE = "\\";
+    var REGEX_LITERAL_SPECIAL = /[.*+?()[\]{}^$|\\/]/;
+    var REGEX_TEST_BLANK_LINE = /^ +$/;
+    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+    var REGEX_SPLITALL_CRLF = /\r?\n/g;
+    var DOUBLE_SLASH = "//";
+    var SLASH_CODE = 47;
+    var DOT_CODE = 46;
+    var SLASH = "/";
+    var TMP_KEY_IGNORE = "node-ignore";
+    if (typeof Symbol !== "undefined") {
+      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
+    }
+    var KEY_IGNORE = TMP_KEY_IGNORE;
+    var define = (object, key, value) => {
+      Object.defineProperty(object, key, { value });
+      return value;
+    };
+    var RETURN_FALSE = () => false;
+    var cleanRangeBackSlash = (slashes) => {
+      const { length } = slashes;
+      return slashes.slice(0, length - length % 2);
+    };
+    var POSIX_CLASSES = {
+      alnum: "0-9A-Za-z",
+      alpha: "A-Za-z",
+      blank: " \\t",
+      cntrl: "\\x00-\\x1f\\x7f",
+      digit: "0-9",
+      graph: "!-.0-~",
+      lower: "a-z",
+      print: " -.0-~",
+      punct: "!-.:-@\\[-`{-~",
+      // git's `sane-ctype.h` classifies \v and \f as control, not space,
+      //   unlike C's `isspace`
+      space: " \\t\\n\\r",
+      upper: "A-Z",
+      xdigit: "0-9A-Fa-f"
+    };
+    var CLASS_MEMBERS_TO_ESCAPE = "\\]^-[";
+    var escapeMember = (char) => CLASS_MEMBERS_TO_ESCAPE.indexOf(char) < 0 ? char : ESCAPE + char;
+    var NON_SLASH = "(?!\\/)";
+    var classSource = (negated, body) => {
+      if (negated) {
+        return `[^\\/${body}]`;
+      }
+      const source = `[${body}]`;
+      return new RegExp(source).test("/") ? NON_SLASH + source : source;
+    };
+    var scanBracket = (pattern, start) => {
+      const { length } = pattern;
+      let index = start + 1;
+      let negated = EMPTY;
+      const lead = pattern[index];
+      if (lead === "!" || lead === "^") {
+        negated = "^";
+        index++;
+      }
+      let body = EMPTY;
+      let prev = EMPTY;
+      for (; ; ) {
+        const char = pattern[index];
+        if (char === UNDEFINED) {
+          return null;
+        }
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === UNDEFINED) {
+            return null;
+          }
+          body += escapeMember(escaped);
+          prev = escaped;
+          index++;
+        } else if (char === "-" && prev && index + 1 < length && pattern[index + 1] !== "]") {
+          index++;
+          let to = pattern[index];
+          if (to === ESCAPE) {
+            to = pattern[index += 1];
+          }
+          if (prev <= to) {
+            body += `-${escapeMember(to)}`;
+          }
+          prev = EMPTY;
+        } else if (char === "[" && pattern[index + 1] === ":") {
+          const nameStart = index + 2;
+          let end = nameStart;
+          while (end < length && pattern[end] !== "]") {
+            end++;
+          }
+          if (end === length) {
+            return null;
+          }
+          if (end > nameStart && pattern[end - 1] === ":") {
+            const expanded = POSIX_CLASSES[pattern.slice(nameStart, end - 1)];
+            if (expanded === UNDEFINED) {
+              return null;
+            }
+            body += expanded;
+            prev = EMPTY;
+            index = end;
+          } else {
+            body += escapeMember("[");
+            prev = "[";
+            index = nameStart - 2;
+          }
+        } else {
+          body += escapeMember(char);
+          prev = char;
+        }
+        index++;
+        if (pattern[index] === "]") {
+          return {
+            end: index,
+            source: classSource(negated, body)
+          };
+        }
+      }
+    };
+    var NEVER_MATCH = "[]";
+    var PLACEHOLDER = "\0";
+    var REGEX_RESTORE_PLACEHOLDER = new RegExp(
+      `${PLACEHOLDER}(\\d+)${PLACEHOLDER}`,
+      "g"
+    );
+    var TRAILING_WILDCARD = "\uE000";
+    var extractBrackets = (pattern) => {
+      const sources = [];
+      const hold = (source) => `${PLACEHOLDER}${sources.push(source) - 1}${PLACEHOLDER}`;
+      const { length } = pattern;
+      let out = EMPTY;
+      let index = 0;
+      while (index < length) {
+        const char = pattern[index];
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === "*" || escaped === "[" || escaped === SPACE || escaped === ESCAPE) {
+            out += pattern.slice(index, index + 2);
+          } else {
+            out += hold(
+              REGEX_LITERAL_SPECIAL.test(escaped) ? ESCAPE + escaped : escaped
+            );
+          }
+          index += 2;
+        } else if (char === PLACEHOLDER) {
+          out += hold(`[${PLACEHOLDER}]`);
+          index++;
+        } else if (char === "[") {
+          const scanned = scanBracket(pattern, index);
+          if (scanned === null) {
+            out += hold(NEVER_MATCH);
+            index = length;
+          } else {
+            out += hold(scanned.source);
+            index = scanned.end + 1;
+          }
+        } else {
+          out += char;
+          index++;
+        }
+      }
+      return {
+        source: out,
+        sources
+      };
+    };
+    var DIRECT = null;
+    var REGEX_INNER_SLASH = /\/(?!$)/;
+    var REPLACERS = [
+      [
+        // Remove BOM
+        // TODO:
+        // Other similar zero-width characters?
+        /^\uFEFF/,
+        () => EMPTY,
+        "\uFEFF"
+      ],
+      [
+        // A trailing line terminator, left on when a whole file's contents are
+        //   added as one pattern rather than split into lines. git never sees one
+        //   -- it reads a `.gitignore` line by line -- so it is not part of the
+        //   pattern and is dropped here, apart from the trailing-space trimming,
+        //   which follows git in touching spaces and nothing else.
+        /[\r\n]+$/,
+        () => EMPTY
+      ],
+      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
+      [
+        // Only spaces, never tabs or other whitespace: git trims a trailing run
+        //   of `' '` and nothing else (dir.c, `trim_trailing_spaces`, a single
+        //   `case ' '`), so a pattern ending in a tab keeps it as a literal.
+        // (a\ ) -> (a )
+        // (a  ) -> (a)
+        // (a ) -> (a)
+        // (a \ ) -> (a  )
+        /((?:\\\\)*?)(\\? +)$/,
+        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
+      ],
+      // Replace (\ ) with ' '
+      // Only a space: an escaped tab or other whitespace is already a literal by
+      //   the time it reaches here, and a bare tab must be left as one, not turned
+      //   into a space.
+      // (\ ) -> ' '
+      // (\\ ) -> '\\ '
+      // (\\\ ) -> '\\ '
+      [
+        /(\\+?) /g,
+        (_, m1) => {
+          const { length } = m1;
+          return m1.slice(0, length - length % 2) + SPACE;
+        }
+      ],
+      // Escape metacharacters
+      // which is written down by users but means special for regular expressions.
+      // > There are 12 characters with special meanings:
+      // > - the backslash \,
+      // > - the caret ^,
+      // > - the dollar sign $,
+      // > - the period or dot .,
+      // > - the vertical bar or pipe symbol |,
+      // > - the question mark ?,
+      // > - the asterisk or star *,
+      // > - the plus sign +,
+      // > - the opening parenthesis (,
+      // > - the closing parenthesis ),
+      // > - and the opening square bracket [,
+      // > - the opening curly brace {,
+      // > These special characters are often called "metacharacters".
+      [
+        /[\\$.|*+(){^]/g,
+        (match) => `\\${match}`
+      ],
+      [
+        // > a question mark (?) matches a single character
+        /(?!\\)\?/g,
+        () => "[^/]",
+        "?"
+      ],
+      // leading slash
+      [
+        // > A leading slash matches the beginning of the pathname.
+        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+        // A leading slash matches the beginning of the pathname
+        /^\//,
+        () => "^",
+        SLASH
+      ],
+      // replace special metacharacter slash after the leading slash
+      [
+        /\//g,
+        () => "\\/",
+        SLASH
+      ],
+      [
+        // > A leading "**" followed by a slash means match in all directories.
+        // > For example, "**/foo" matches file or directory "foo" anywhere,
+        // > the same as pattern "foo".
+        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+        // >   under directory "foo".
+        // Notice that the '*'s have been replaced as '\\*'
+        /^\^*(?:\\\*\\\*\\\/)+/,
+        // '**/foo' <-> 'foo'
+        () => "^(?:.*\\/)?",
+        "*"
+      ],
+      // starting
+      [
+        // there will be no leading '/'
+        //   (which has been replaced by section "leading slash")
+        // If starts with '**', adding a '^' to the regular expression also works
+        DIRECT,
+        (source, pattern) => {
+          if (!source || source[0] === "^") {
+            return source;
+          }
+          const anchor = !REGEX_INNER_SLASH.test(pattern) ? "(?:^|\\/)" : "^";
+          return anchor + source;
+        }
+      ],
+      // two globstars
+      [
+        // Use lookahead assertions so that we could match more than one `'/**'`
+        /\\\/\\\*\\\*(?=\\\/|$)/g,
+        // Zero, one or several directories
+        // should not use '*', or it will be replaced by the next replacer
+        // Check if it is not the last `'/**'`
+        (_, index, str) => index + 6 < str.length ? str.slice(index + 6) === "\\/" ? "(?:\\/[^\\/]+)+" : "(?:\\/[^\\/]+)*" : "\\/.+",
+        "*"
+      ],
+      // normal intermediate wildcards
+      [
+        // Never replace escaped '*'
+        // ignore rule '\*' will match the path '*'
+        // 'abc.*/' -> go
+        // 'abc.*'  -> skip this rule,
+        //    coz trailing single wildcard will be handed by [trailing wildcard]
+        /(^|[^\\]+)(\\\*)+(?=.+)/g,
+        // '*.js' matches '.js'
+        // '*.js' doesn't match 'abc'
+        (_, p1, p2) => {
+          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
+          return p1 + unescaped;
+        },
+        "*"
+      ],
+      // trailing wildcard, held apart from a literal star
+      [
+        // The step above leaves a trailing `*` alone, so a single `\*` is all that
+        //   can be left at the end here. Whether it is a wildcard or a literal
+        //   turns on the backslashes the user put in front of it: the escaper has
+        //   since doubled every one, so what stands here is those `2N` doubled
+        //   backslashes and then the star's own escape. An even number of the
+        //   original `N` leaves the star unescaped -- a wildcard -- and an odd
+        //   number escapes it -- a literal. This runs while the two are still
+        //   distinct, before the unescape steps below collapse the literal onto
+        //   the very `\*` a wildcard leaves behind.
+        /(^|[^\\])((?:\\\\)*)\\\*$/,
+        (match, p1, p2) => (
+          // `p2` holds the doubled user backslashes; half of them is `N`.
+          p2.length / 2 % 2 === 0 ? p1 + p2 + TRAILING_WILDCARD : match
+        ),
+        "*"
+      ],
+      [
+        // unescape, revert step 3 except for back slash
+        // For example, if a user escape a '\\*',
+        // after step 3, the result will be '\\\\\\*'
+        /\\\\\\(?=[$.|*+(){^])/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // '\\\\' -> '\\'
+        /\\\\/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // Every real bracket expression -- POSIX classes included -- has already
+        //   been held aside by `extractBrackets`, so the only `[` left in the
+        //   pattern is an escaped, literal one.
+        // `\` is escaped by step 3
+        /\\\[([^\]/]*?)(\\*)($|\])/g,
+        // '\\[bar]' -> '\\\\[bar\\]'
+        (match, range, endEscape, close) => `\\[${range}${cleanRangeBackSlash(endEscape)}${close}`,
+        "["
+      ],
+      // ending
+      [
+        // 'js' will not match 'js.'
+        // 'ab' will not match 'abc'
+        DIRECT,
+        // WTF!
+        // https://git-scm.com/docs/gitignore
+        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
+        // which re-fixes #24, #38
+        // > If there is a separator at the end of the pattern then the pattern
+        // > will only match directories, otherwise the pattern can match both
+        // > files and directories.
+        // 'js*' will not match 'a.js'
+        // 'js/' will not match 'a.js'
+        // 'js' will match 'a.js' and 'a.js/'
+        (source) => {
+          const last = source[source.length - 1];
+          if (!last || last === TRAILING_WILDCARD) {
+            return source;
+          }
+          return last === SLASH ? `${source}$` : `${source}(?=$|\\/$)`;
+        }
+      ]
+    ];
+    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\uE000$/;
+    var MODE_IGNORE = "regex";
+    var MODE_CHECK_IGNORE = "checkRegex";
+    var UNDERSCORE = "_";
+    var TRAILING_WILD_CARD_REPLACERS = {
+      [MODE_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      },
+      [MODE_CHECK_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      }
+    };
+    var WILDCARD = "[^\\/]*";
+    var pinWildcards = (source) => {
+      if (source.indexOf(WILDCARD) < 0) {
+        return source;
+      }
+      const tokens = [];
+      const { length } = source;
+      let index = 0;
+      while (index < length) {
+        const char = source[index];
+        if (source.startsWith(WILDCARD, index)) {
+          tokens.push({ wildcard: true });
+          index += WILDCARD.length;
+        } else if (char === "[") {
+          let end = index + 1;
+          if (source[end] === "^") {
+            end++;
+          }
+          if (source[end] === "]") {
+            end++;
+          }
+          while (end < length && source[end] !== "]") {
+            end += source[end] === ESCAPE ? 2 : 1;
+          }
+          end++;
+          tokens.push({ single: source.slice(index, end) });
+          index = end;
+        } else if (char === ESCAPE) {
+          tokens.push({ single: source.slice(index, index + 2) });
+          index += 2;
+        } else if (char === "(") {
+          let depth = 0;
+          let end = index;
+          do {
+            if (source[end] === ESCAPE) {
+              end++;
+            } else if (source[end] === "(") {
+              depth++;
+            } else if (source[end] === ")") {
+              depth--;
+            }
+            end++;
+          } while (end < length && depth > 0);
+          if ("*+?".indexOf(source[end]) >= 0) {
+            end++;
+          }
+          tokens.push({ boundary: source.slice(index, end) });
+          index = end;
+        } else if (char === "^" || char === "$") {
+          tokens.push({ boundary: char });
+          index++;
+        } else {
+          tokens.push({ single: char });
+          index++;
+        }
+      }
+      let out = EMPTY;
+      let run2 = [];
+      const flush = () => {
+        let lastWildcard;
+        run2.forEach((token, at) => {
+          if (token.wildcard) {
+            lastWildcard = at;
+          }
+        });
+        run2.forEach((token, at) => {
+          if (!token.wildcard) {
+            out += token.single;
+            return;
+          }
+          out += at === lastWildcard ? WILDCARD : `(?:(?!${run2[at + 1].single})[^\\/])*`;
+        });
+        run2 = [];
+      };
+      tokens.forEach((token) => {
+        if (token.boundary === void 0) {
+          run2.push(token);
+          return;
+        }
+        flush();
+        out += token.boundary;
+      });
+      flush();
+      return out;
+    };
+    var makeRegexPrefix = (pattern) => {
+      const { source, sources } = extractBrackets(pattern);
+      const replaced = REPLACERS.reduce(
+        // A pass whose matcher finds nothing hands back the very string it was
+        //   given, so asking first costs a search and saves a rewrite. Ten of the
+        //   fifteen passes never fire for a typical .gitignore line, and between
+        //   them they were 45% of this chain.
+        (prev, [matcher, replacer, required]) => {
+          if (matcher === DIRECT) {
+            return replacer(prev, pattern);
+          }
+          if (required !== UNDEFINED && prev.indexOf(required) < 0) {
+            return prev;
+          }
+          return matcher.test(prev) ? prev.replace(matcher, replacer.bind(pattern)) : prev;
+        },
+        source
+      );
+      return sources.length ? replaced.replace(
+        REGEX_RESTORE_PLACEHOLDER,
+        (match, index) => sources[index]
+      ) : replaced;
+    };
+    var matchesBasename = (body) => {
+      const index = body.indexOf(SLASH);
+      return index < 0 || index === body.length - 1;
+    };
+    var basenameOf = (path) => {
+      const end = path.length - 1;
+      const index = path.lastIndexOf(
+        SLASH,
+        path[end] === SLASH ? end - 1 : end
+      );
+      return index < 0 ? path : path.slice(index + 1);
+    };
+    var parentOf = (path) => {
+      if (path.charCodeAt(0) === SLASH_CODE || path.indexOf(DOUBLE_SLASH) >= 0) {
+        const slices = path.split(SLASH).filter(Boolean);
+        slices.pop();
+        return slices.length ? slices.join(SLASH) + SLASH : EMPTY;
+      }
+      const end = path.length - 1;
+      const cut = path.lastIndexOf(
+        SLASH,
+        path.charCodeAt(end) === SLASH_CODE ? end - 1 : end
+      );
+      return cut < 0 ? EMPTY : path.slice(0, cut + 1);
+    };
+    var isString = (subject) => typeof subject === "string";
+    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
+    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+    var IgnoreRule = class {
+      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+        this.pattern = pattern;
+        this.mark = mark;
+        this.negative = negative;
+        define(this, "body", body);
+        define(this, "ignoreCase", ignoreCase);
+        define(this, "regexPrefix", prefix);
+      }
+      // Worked out on first use and kept behind an own property, the way `regex`
+      //   caches itself in `_regex`. Deciding it in the constructor instead would
+      //   add a fourth `defineProperty` to every rule ever built, which cost 4% of
+      //   every compile -- including the compiles of rules that are never matched
+      //   against anything.
+      get _basenameOnly() {
+        return define(this, "_basenameOnly", matchesBasename(this.body));
+      }
+      get regex() {
+        const key = UNDERSCORE + MODE_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_IGNORE, key);
+      }
+      get checkRegex() {
+        const key = UNDERSCORE + MODE_CHECK_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_CHECK_IGNORE, key);
+      }
+      _make(mode, key) {
+        const str = pinWildcards(this.regexPrefix.replace(
+          REGEX_REPLACE_TRAILING_WILDCARD,
+          // It does not need to bind pattern
+          TRAILING_WILD_CARD_REPLACERS[mode]
+        ));
+        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+        return define(this, key, regex);
+      }
+    };
+    var createRule = ({
+      pattern,
+      mark
+    }, ignoreCase) => {
+      let negative = false;
+      let body = pattern;
+      if (body.indexOf("!") === 0) {
+        negative = true;
+        body = body.substr(1);
+      }
+      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+      const regexPrefix = makeRegexPrefix(body);
+      return new IgnoreRule(
+        pattern,
+        mark,
+        body,
+        ignoreCase,
+        negative,
+        regexPrefix
+      );
+    };
+    var RuleManager = class {
+      constructor(ignoreCase) {
+        this._ignoreCase = ignoreCase;
+        this._rules = [];
+        this._basenameCount = 0;
+      }
+      _add(pattern) {
+        if (pattern && pattern[KEY_IGNORE]) {
+          this._rules = this._rules.concat(pattern._rules._rules);
+          this._basenameCount += pattern._rules._basenameCount;
+          this._added = true;
+          return;
+        }
+        if (isString(pattern)) {
+          pattern = {
+            pattern
+          };
+        }
+        if (checkPattern(pattern.pattern)) {
+          const rule = createRule(pattern, this._ignoreCase);
+          this._added = true;
+          this._rules.push(rule);
+          if (matchesBasename(rule.body)) {
+            this._basenameCount++;
+          }
+        }
+      }
+      // @param {Array<string> | string | Ignore} pattern
+      add(pattern) {
+        this._added = false;
+        makeArray(
+          isString(pattern) ? splitPattern(pattern) : pattern
+        ).forEach(this._add, this);
+        return this._added;
+      }
+      // Test one single path without recursively checking parent directories
+      //
+      // - checkUnignored `boolean` whether should check if the path is unignored,
+      //   setting `checkUnignored` to `false` could reduce additional
+      //   path matching.
+      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
+      // @returns {TestResult} true if a file is ignored
+      test(path, checkUnignored, mode) {
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        const rules = this._rules;
+        const { length } = rules;
+        const shortcut = this._basenameCount * 2 >= length;
+        const basename3 = shortcut ? basenameOf(path) : path;
+        for (let index = 0; index < length; index++) {
+          const rule = rules[index];
+          const { negative } = rule;
+          const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
+          if (!skip && rule[mode].test(
+            shortcut && rule._basenameOnly ? basename3 : path
+          )) {
+            ignored = !negative;
+            unignored = negative;
+            matchedRule = negative ? UNDEFINED : rule;
+          }
+        }
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+    };
+    var throwError = (message, Ctor) => {
+      throw new Ctor(message);
+    };
+    var checkPath = (path, originalPath, doThrow) => {
+      if (!isString(path)) {
+        return doThrow(
+          `path must be a string, but got \`${originalPath}\``,
+          TypeError
+        );
+      }
+      if (!path) {
+        return doThrow(`path must not be empty`, TypeError);
+      }
+      if (checkPath.isNotRelative(path)) {
+        const r = "`path.relative()`d";
+        return doThrow(
+          `path should be a ${r} string, but got "${originalPath}"`,
+          RangeError
+        );
+      }
+      return true;
+    };
+    var isNotRelative = (path) => {
+      const first = path.charCodeAt(0);
+      if (first === SLASH_CODE) {
+        return true;
+      }
+      if (first !== DOT_CODE) {
+        return false;
+      }
+      if (path.length === 1) {
+        return true;
+      }
+      const second = path.charCodeAt(1);
+      if (second === SLASH_CODE) {
+        return true;
+      }
+      if (second !== DOT_CODE) {
+        return false;
+      }
+      return path.length === 2 || path.charCodeAt(2) === SLASH_CODE;
+    };
+    checkPath.isNotRelative = isNotRelative;
+    checkPath.convert = (p) => p;
+    var Ignore = class {
+      constructor({
+        ignorecase = true,
+        ignoreCase = ignorecase,
+        allowRelativePaths = false
+      } = {}) {
+        define(this, KEY_IGNORE, true);
+        this._rules = new RuleManager(ignoreCase);
+        this._strictPathCheck = !allowRelativePaths;
+        this._initCache();
+      }
+      _initCache() {
+        this._ignoreCache = /* @__PURE__ */ Object.create(null);
+        this._testCache = /* @__PURE__ */ Object.create(null);
+      }
+      add(pattern) {
+        if (this._rules.add(pattern)) {
+          this._initCache();
+        }
+        return this;
+      }
+      // legacy
+      addPattern(pattern) {
+        return this.add(pattern);
+      }
+      // @returns {TestResult}
+      _test(originalPath, cache, checkUnignored) {
+        const path = originalPath && checkPath.convert(originalPath);
+        checkPath(
+          path,
+          originalPath,
+          this._strictPathCheck ? throwError : RETURN_FALSE
+        );
+        return this._t(path, cache, checkUnignored);
+      }
+      checkIgnore(path) {
+        if (path.charCodeAt(path.length - 1) !== SLASH_CODE) {
+          return this.test(path);
+        }
+        const parentPath = parentOf(path);
+        if (parentPath) {
+          const parent = this._t(parentPath, this._testCache, true);
+          if (parent.ignored) {
+            return parent;
+          }
+        }
+        return this._rules.test(path, false, MODE_CHECK_IGNORE);
+      }
+      _t(path, cache, checkUnignored) {
+        if (path in cache) {
+          return cache[path];
+        }
+        const parentPath = parentOf(path);
+        const parent = parentPath ? this._t(parentPath, cache, checkUnignored) : UNDEFINED;
+        return cache[path] = parent && parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
+      }
+      ignores(path) {
+        return this._test(path, this._ignoreCache, false).ignored;
+      }
+      createFilter() {
+        return (path) => !this.ignores(path);
+      }
+      filter(paths) {
+        return makeArray(paths).filter(this.createFilter());
+      }
+      // @returns {TestResult}
+      test(path) {
+        return this._test(path, this._testCache, true);
+      }
+    };
+    var factory = (options) => new Ignore(options);
+    var isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
+    var setupWindows = () => {
+      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+      checkPath.convert = makePosix;
+      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+      checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
+    };
+    if (
+      // Detect `process` so that it can run in browsers.
+      typeof process !== "undefined" && process.platform === "win32"
+    ) {
+      setupWindows();
+    }
+    module.exports = factory;
+    factory.default = factory;
+    module.exports.isPathValid = isPathValid;
+    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
+  }
+});
+
+// src/dev/bridge.ts
+function mapErrorCode(code, status2) {
+  if (code === "invalid_input") return "INVALID_INPUT";
+  if (code === "not_found") return "NOT_FOUND";
+  if (code === "conflict") return "CONFLICT";
+  if (code === "forbidden") return "UNDECLARED";
+  if (status2 === 401) return "UNDECLARED";
+  return "UNAVAILABLE";
+}
+function devRuntimeBody(invoke, appId) {
+  if (invoke.service === "ai") {
+    return {
+      service: "ai",
+      args: invoke.input.args ?? {},
+      ...appId ? { app_id: appId } : {}
+    };
+  }
+  if (invoke.service === "capabilities") {
+    return {
+      service: "capabilities",
+      capability: invoke.input.capability,
+      args: invoke.input.args ?? {},
+      ...invoke.input.requestId ? { request_id: invoke.input.requestId } : {}
+    };
+  }
+  return {
+    service: "connections",
+    connector: invoke.input.connector,
+    ...invoke.input.connection ? { connection: invoke.input.connection } : {},
+    operation: invoke.input.operation,
+    args: invoke.input.args ?? {},
+    ...appId ? { app_id: appId } : {}
+  };
+}
+async function bridgeInvoke(dependencies, invoke) {
+  const fetcher = dependencies.fetcher ?? fetch;
+  let response;
+  try {
+    response = await fetcher(`${dependencies.apiUrl}/v1/dev/runtime`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${dependencies.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(devRuntimeBody(invoke, dependencies.appId)),
+      signal: AbortSignal.timeout(6e4)
+    });
+  } catch {
+    throw new BridgeError({
+      code: "UNAVAILABLE",
+      message: "Marina is unreachable \u2014 bridged calls need a network connection",
+      retryable: true
+    });
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new BridgeError({
+      code: "UNAVAILABLE",
+      message: "Marina returned an invalid response",
+      retryable: true
+    });
+  }
+  if (!response.ok) {
+    const error = body.error ?? {};
+    throw new BridgeError({
+      code: mapErrorCode(error.code ?? "", response.status),
+      message: error.message ?? `bridged call failed (${String(response.status)})`,
+      retryable: response.status >= 500
+    });
+  }
+  return body.value;
+}
+var BridgeError;
+var init_bridge = __esm({
+  "src/dev/bridge.ts"() {
+    "use strict";
+    BridgeError = class extends Error {
+      payload;
+      constructor(payload) {
+        super(payload.message);
+        this.payload = payload;
+      }
+    };
+  }
+});
+
+// src/dev/binding.ts
+function undeclared(service, declaration) {
+  return failure2(
+    "UNDECLARED",
+    `this app does not declare ${service} \u2014 add ${declaration} to marina.json`
+  );
+}
+function createDevBinding(context) {
+  return {
+    async invoke(request2) {
+      try {
+        switch (request2.service) {
+          case "storage": {
+            if (!context.storage) return undeclared("storage", 'runtime.storage: "v1"');
+            const input = request2.input;
+            if (request2.operation === "put") return ok(context.storage.put(input));
+            if (request2.operation === "get")
+              return ok(context.storage.get(input.key));
+            if (request2.operation === "delete") {
+              context.storage.delete(input.key);
+              return ok(null);
+            }
+            if (request2.operation === "list") return ok(context.storage.list(input));
+            return failure2("INVALID_INPUT", `unsupported storage operation ${request2.operation}`);
+          }
+          case "db": {
+            if (!context.database) return undeclared("the managed database", 'runtime.db: "v1"');
+            if (request2.operation === "query") {
+              const query = request2.input;
+              return ok(await context.database.query(query.text, query.params));
+            }
+            if (request2.operation === "transaction") {
+              const { queries } = request2.input;
+              return ok(await context.database.transaction(queries));
+            }
+            return failure2("INVALID_INPUT", `unsupported db operation ${request2.operation}`);
+          }
+          case "ai": {
+            if (!context.manifest.runtime.ai) return undeclared("ai", 'runtime.ai: "v1"');
+            if (request2.operation !== "generate")
+              return failure2("INVALID_INPUT", `unsupported ai operation ${request2.operation}`);
+            return ok(
+              await bridgeInvoke(context.bridge, {
+                service: "ai",
+                input: { args: request2.input }
+              })
+            );
+          }
+          case "jobs": {
+            if (!context.jobs) return undeclared("background jobs", 'runtime.jobs: "v1"');
+            if (request2.operation === "enqueue") {
+              const input = request2.input;
+              const status2 = context.jobs.enqueue(input);
+              return ok({ id: status2.id, state: status2.state });
+            }
+            if (request2.operation === "get") {
+              const { runId } = request2.input;
+              const status2 = context.jobs.get(runId);
+              return status2 ? ok(status2) : failure2("NOT_FOUND", "no such job run");
+            }
+            return failure2("INVALID_INPUT", `unsupported jobs operation ${request2.operation}`);
+          }
+          case "capabilities":
+          case "connections":
+            return ok(
+              await bridgeInvoke(context.bridge, {
+                service: request2.service,
+                input: request2.input
+              })
+            );
+          default:
+            return failure2("UNDECLARED", `unsupported runtime service ${request2.service}`);
+        }
+      } catch (error) {
+        if (error instanceof BridgeError) return { ok: false, error: error.payload };
+        return failure2("INVALID_INPUT", error.message);
+      }
+    },
+    async authorizeJob(request2) {
+      return context.jobs ? context.jobs.authorizeJob(request2) : false;
+    }
+  };
+}
+var ok, failure2;
+var init_binding = __esm({
+  "src/dev/binding.ts"() {
+    "use strict";
+    init_bridge();
+    ok = (value) => ({ ok: true, value });
+    failure2 = (code, message, retryable = false) => ({
+      ok: false,
+      error: { code, message, retryable }
+    });
+  }
+});
+
+// src/dev/db.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+function normalizeValue(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  if (typeof value === "bigint") {
+    return value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value.toString();
+  }
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("base64");
+  if (Array.isArray(value)) return value.map(normalizeValue);
+  if (typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        normalizeValue(entry)
+      ])
+    );
+  }
+  return String(value);
+}
+function normalizeRow(row) {
+  if (!row || typeof row !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(row).map(([key, value]) => [
+      key,
+      normalizeValue(value)
+    ])
+  );
+}
+var LocalDatabase;
+var init_db = __esm({
+  "src/dev/db.ts"() {
+    "use strict";
+    LocalDatabase = class _LocalDatabase {
+      db;
+      constructor(db) {
+        this.db = db;
+      }
+      static async open(dataDir) {
+        let module;
+        try {
+          module = await import("@electric-sql/pglite");
+        } catch {
+          throw new Error(
+            "the embedded Postgres could not load \u2014 reinstall the Marina CLI (@electric-sql/pglite is missing)"
+          );
+        }
+        mkdirSync3(dataDir, { recursive: true });
+        return new _LocalDatabase(new module.PGlite(dataDir));
+      }
+      /** Apply the app's marina/migrations in name order, once each — the same
+       * files a deploy applies to the managed database. */
+      async applyMigrations(projectDir) {
+        const directory = join5(projectDir, "marina", "migrations");
+        await this.db.exec(
+          "create table if not exists marina_dev_migrations (name text primary key, applied_at timestamptz not null default now())"
+        );
+        if (!existsSync5(directory)) return [];
+        const files = readdirSync2(directory).filter((file) => file.endsWith(".sql")).toSorted();
+        const applied = [];
+        for (const file of files) {
+          const seen = await this.db.query("select 1 from marina_dev_migrations where name = $1", [
+            file
+          ]);
+          if (seen.rows.length > 0) continue;
+          const source = readFileSync5(join5(directory, file), "utf8");
+          await this.db.transaction(async (tx) => {
+            await tx.exec(source);
+            await tx.query("insert into marina_dev_migrations (name) values ($1)", [file]);
+          });
+          applied.push(file);
+        }
+        return applied;
+      }
+      async query(text, params) {
+        const result2 = await this.db.query(text, params);
+        const rows = result2.rows.map(normalizeRow);
+        return { rows, rowCount: rows.length > 0 ? rows.length : result2.affectedRows ?? 0 };
+      }
+      async transaction(queries) {
+        return this.db.transaction(async (tx) => {
+          const results = [];
+          for (const query of queries) {
+            const result2 = await tx.query(query.text, query.params);
+            const rows = result2.rows.map(normalizeRow);
+            results.push({
+              rows,
+              rowCount: rows.length > 0 ? rows.length : result2.affectedRows ?? 0
+            });
+          }
+          return results;
+        });
+      }
+    };
+  }
+});
+
+// src/dev/chrome.ts
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function devChromeSnippet(input) {
+  return `<div id="__marina-dev-chrome" style="position:fixed;right:12px;bottom:12px;z-index:2147483647;display:flex;align-items:center;gap:8px;background:#121316;color:#e5e7ea;border:1px solid #2a2e34;border-radius:8px;padding:6px 12px;font:500 12px/1.4 ui-sans-serif,system-ui;box-shadow:0 4px 16px rgb(0 0 0 / 0.25)">
+  <span style="width:8px;height:8px;border-radius:99px;background:#e0a24a"></span>
+  <span>${escapeHtml(input.appName)} \xB7 local dev \xB7 ${escapeHtml(input.userLabel)}</span>
+</div>`;
+}
+function injectDevChrome(html, snippet) {
+  const marker = /<\/body\s*>/i.exec(html);
+  if (!marker) return html + snippet;
+  return html.slice(0, marker.index) + snippet + html.slice(marker.index);
+}
+var init_chrome = __esm({
+  "src/dev/chrome.ts"() {
+    "use strict";
+  }
+});
+
+// src/dev/embedded-runtime.ts
+var DEV_RUNTIME_FILES;
+var init_embedded_runtime = __esm({
+  "src/dev/embedded-runtime.ts"() {
+    "use strict";
+    DEV_RUNTIME_FILES = {
+      "ai.ts": 'import type {\n  AIGenerateInput,\n  AIGenerateResult,\n  AIMessage,\n  MarinaRuntimeBinding,\n} from "./contract.js";\nimport {\n  MAX_AI_INPUT_BYTES,\n  MAX_AI_MESSAGE_BYTES,\n  MAX_AI_MESSAGES,\n  MAX_AI_OUTPUT_TOKENS,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst MESSAGE_ROLES = new Set(["system", "user", "assistant"]);\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\n/** Validate the portable chat contract before any provider or substrate sees\n * application content. The broker repeats the same bounded checks. */\nexport function assertAIGenerateInput(value: AIGenerateInput): AIGenerateInput {\n  if (!value || typeof value !== "object" || Array.isArray(value))\n    invalid("AI generation input must be an object");\n  if (typeof value.model !== "string" || value.model.length === 0 || value.model.length > 200)\n    invalid("AI model must be fast, smart, or a model id from Marina\'s model library");\n  if (!Array.isArray(value.messages) || value.messages.length === 0)\n    invalid("AI generation requires at least one message");\n  if (value.messages.length > MAX_AI_MESSAGES)\n    invalid(`AI generation may contain at most ${String(MAX_AI_MESSAGES)} messages`);\n\n  let inputBytes = 0;\n  const messages: AIMessage[] = value.messages.map((message) => {\n    if (!message || typeof message !== "object" || Array.isArray(message))\n      invalid("AI messages must be objects");\n    if (typeof message.role !== "string" || !MESSAGE_ROLES.has(message.role))\n      invalid("AI message role must be system, user, or assistant");\n    if (typeof message.content !== "string" || message.content.length === 0)\n      invalid("AI message content must not be empty");\n    if (/\\p{Cc}/u.test(message.content.replaceAll("\\n", "").replaceAll("\\t", "")))\n      invalid("AI message content contains unsupported control characters");\n    const bytes = encoder.encode(message.content).byteLength;\n    if (bytes > MAX_AI_MESSAGE_BYTES)\n      invalid(`AI messages must not exceed ${String(MAX_AI_MESSAGE_BYTES)} bytes each`);\n    inputBytes += bytes;\n    return { role: message.role, content: message.content };\n  });\n  if (inputBytes > MAX_AI_INPUT_BYTES)\n    invalid(`AI generation input must not exceed ${String(MAX_AI_INPUT_BYTES)} bytes`);\n\n  if (\n    value.maxOutputTokens !== undefined &&\n    (!Number.isSafeInteger(value.maxOutputTokens) ||\n      value.maxOutputTokens < 1 ||\n      value.maxOutputTokens > MAX_AI_OUTPUT_TOKENS)\n  )\n    invalid(`AI output tokens must be between 1 and ${String(MAX_AI_OUTPUT_TOKENS)}`);\n\n  return {\n    model: value.model,\n    messages,\n    ...(value.maxOutputTokens === undefined ? {} : { maxOutputTokens: value.maxOutputTokens }),\n  };\n}\n\nexport interface MarinaAI {\n  /** Generate bounded text using a Marina-managed model class. Provider names,\n   * credentials, routing, and quota state never enter the app contract. */\n  generate(input: AIGenerateInput): Promise<AIGenerateResult>;\n}\n\nexport function createAI(binding: MarinaRuntimeBinding): MarinaAI {\n  return {\n    async generate(input) {\n      return invokeRuntime(binding, "ai", "generate", assertAIGenerateInput(input));\n    },\n  };\n}\n',
+      "capabilities.ts": 'import type { DatabaseValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_CAPABILITY_INPUT_BYTES, MAX_CAPABILITY_SESSION_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst CAPABILITY_NAME = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$/;\nconst REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nfunction capabilityArgs(value: unknown): DatabaseValue {\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("capability arguments must be JSON compatible");\n  }\n  if (serialized === undefined) invalid("capability arguments must be JSON compatible");\n  if (encoder.encode(serialized).byteLength > MAX_CAPABILITY_INPUT_BYTES)\n    invalid(`capability arguments must not exceed ${String(MAX_CAPABILITY_INPUT_BYTES)} bytes`);\n  return value as DatabaseValue;\n}\n\nexport interface CapabilityInvokeOptions {\n  /** Stable idempotency identity for edit-effect Capability retries. */\n  requestId?: string;\n}\n\nexport interface MarinaCapabilities {\n  invoke<Result = unknown>(\n    name: string,\n    args?: DatabaseValue,\n    options?: CapabilityInvokeOptions,\n  ): Promise<Result>;\n}\n\nexport function createCapabilities(\n  binding: MarinaRuntimeBinding,\n  session?: string,\n): MarinaCapabilities {\n  return {\n    invoke<Result>(name: string, args: DatabaseValue = {}, options: CapabilityInvokeOptions = {}) {\n      if (!session) {\n        throw new MarinaRuntimeError({\n          code: "UNAVAILABLE",\n          message: "Capability calls require an authenticated app request",\n          retryable: false,\n        });\n      }\n      if (encoder.encode(session).byteLength > MAX_CAPABILITY_SESSION_BYTES)\n        invalid("invalid Capability session");\n      if (typeof name !== "string" || name.length > 200 || !CAPABILITY_NAME.test(name))\n        invalid("invalid Capability name");\n      if (options.requestId !== undefined && !REQUEST_ID.test(options.requestId))\n        invalid("invalid Capability request id");\n      return invokeRuntime<Result>(binding, "capabilities", "invoke", {\n        session,\n        capability: name,\n        args: capabilityArgs(args),\n        ...(options.requestId ? { requestId: options.requestId } : {}),\n      });\n    },\n  };\n}\n',
+      "connections.ts": 'import type { DatabaseValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_CAPABILITY_INPUT_BYTES, MAX_CAPABILITY_SESSION_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst SEGMENT = /^[a-z][a-z0-9_]{0,39}$/;\nconst OPERATION = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$/;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nexport interface ConnectionInvokeRequest {\n  connector: string;\n  /** Explicit connection id; optional when the app declares exactly one\n   * connection of this connector. */\n  connection?: string;\n  operation: string;\n  args?: DatabaseValue;\n}\n\nexport type MarinaConnectionOperationInput = { connection?: string } & Record<string, unknown>;\nexport type MarinaConnectionCall = (input?: MarinaConnectionOperationInput) => Promise<unknown>;\nexport type MarinaConnectionNamespace = MarinaConnectionCall & {\n  readonly [segment: string]: MarinaConnectionNamespace;\n};\nexport type MarinaConnections = {\n  invoke<Result = unknown>(request: ConnectionInvokeRequest): Promise<Result>;\n} & { readonly [connector: string]: MarinaConnectionNamespace };\n\nfunction boundedArgs(value: unknown): DatabaseValue {\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("connection operation input must be JSON compatible");\n  }\n  if (serialized === undefined) invalid("connection operation input must be JSON compatible");\n  if (encoder.encode(serialized).byteLength > MAX_CAPABILITY_INPUT_BYTES)\n    invalid(\n      `connection operation input must not exceed ${String(MAX_CAPABILITY_INPUT_BYTES)} bytes`,\n    );\n  return value as DatabaseValue;\n}\n\n/**\n * `marina.connections.<connector>.<operation>(input)` \u2014 a dynamic path so the\n * runtime ships no connector catalog; the control plane owns validation and\n * authorization. `input.connection` names one of the app\'s declared\n * connections and is required only when the manifest declares several of the\n * same connector.\n */\nexport function createConnections(\n  binding: MarinaRuntimeBinding,\n  session?: string,\n): MarinaConnections {\n  const invoke = <Result = unknown>(request: ConnectionInvokeRequest): Promise<Result> => {\n    if (!session) {\n      throw new MarinaRuntimeError({\n        code: "UNAVAILABLE",\n        message: "Connection calls require an authenticated app request",\n        retryable: false,\n      });\n    }\n    if (encoder.encode(session).byteLength > MAX_CAPABILITY_SESSION_BYTES)\n      invalid("invalid connection session");\n    if (typeof request.connector !== "string" || !SEGMENT.test(request.connector))\n      invalid("invalid connector name");\n    if (\n      request.connection !== undefined &&\n      (typeof request.connection !== "string" || !SEGMENT.test(request.connection))\n    )\n      invalid("invalid connection id");\n    if (\n      typeof request.operation !== "string" ||\n      request.operation.length > 200 ||\n      !OPERATION.test(request.operation)\n    )\n      invalid("invalid connection operation");\n    return invokeRuntime<Result>(binding, "connections", "invoke", {\n      session,\n      connector: request.connector,\n      ...(request.connection ? { connection: request.connection } : {}),\n      operation: request.operation,\n      args: boundedArgs(request.args ?? {}),\n    });\n  };\n\n  const operationPath = (connector: string, segments: readonly string[]) => {\n    const callable = (input: MarinaConnectionOperationInput = {}): Promise<unknown> => {\n      if (segments.length < 2) invalid("call a connection operation such as orders.list");\n      if (!input || typeof input !== "object" || Array.isArray(input))\n        invalid("connection operation input must be an object");\n      const { connection, ...args } = input;\n      if (connection !== undefined && (typeof connection !== "string" || !SEGMENT.test(connection)))\n        invalid("invalid connection id");\n      return invoke({\n        connector,\n        ...(connection ? { connection } : {}),\n        operation: segments.join("."),\n        args: args as DatabaseValue,\n      });\n    };\n    const path: MarinaConnectionNamespace = new Proxy(callable, {\n      get(_target, property) {\n        if (typeof property !== "string" || property === "then" || !SEGMENT.test(property))\n          return undefined;\n        return operationPath(connector, [...segments, property]);\n      },\n    }) as unknown as MarinaConnectionNamespace;\n    return path;\n  };\n\n  return new Proxy(\n    { invoke },\n    {\n      get(target, property) {\n        if (property === "invoke") return target.invoke;\n        if (typeof property !== "string" || property === "then" || !SEGMENT.test(property))\n          return undefined;\n        return operationPath(property, []);\n      },\n    },\n  ) as MarinaConnections;\n}\n',
+      "contract.ts": `/** The versioned provider-neutral protocol between an app and Marina. */
+export const MARINA_RUNTIME_PROTOCOL_VERSION = 1 as const;
+export const MAX_STORAGE_KEY_BYTES = 900;
+export const MAX_STORAGE_OBJECT_BYTES = 64 * 1024 * 1024;
+export const MAX_CAPABILITY_INPUT_BYTES = 256 * 1024;
+export const MAX_CAPABILITY_SESSION_BYTES = 4096;
+export const MAX_CAPABILITY_RESULT_BYTES = 32 * 1024 * 1024;
+export const MAX_DATABASE_QUERY_BYTES = 100 * 1024;
+export const MAX_DATABASE_PARAMETERS = 100;
+export const MAX_DATABASE_PARAMETER_BYTES = 1024 * 1024;
+export const MAX_DATABASE_TRANSACTION_QUERIES = 25;
+export const MAX_AI_MESSAGES = 64;
+export const MAX_AI_MESSAGE_BYTES = 32 * 1024;
+export const MAX_AI_INPUT_BYTES = 128 * 1024;
+export const MAX_AI_OUTPUT_TOKENS = 4096;
+export const MAX_JOB_INPUT_BYTES = 256 * 1024;
+export const MAX_JOB_VALUE_DEPTH = 32;
+export const MAX_JOB_INVOCATION_BYTES = MAX_JOB_INPUT_BYTES + 128 * 1024;
+export const MARINA_JOB_EXECUTION_PATH = "/.marina/runtime/jobs/execute";
+
+/** Stable service identifiers carried by the broker protocol. */
+export type MarinaRuntimeService =
+  | "storage"
+  | "db"
+  | "ai"
+  | "jobs"
+  | "capabilities"
+  | "connections";
+
+export type StorageOperation = "put" | "get" | "delete" | "list";
+
+export interface MarinaRuntimeRequest {
+  protocolVersion: typeof MARINA_RUNTIME_PROTOCOL_VERSION;
+  /** Unique identity for this individual broker call. */
+  requestId: string;
+  service: MarinaRuntimeService;
+  operation: string;
+  input: unknown;
+}
+
+export type MarinaRuntimeErrorCode =
+  | "UNAVAILABLE"
+  | "UNDECLARED"
+  | "INVALID_INPUT"
+  | "NOT_FOUND"
+  | "QUOTA_EXCEEDED"
+  | "CONFLICT"
+  | "INTERNAL";
+
+export interface MarinaRuntimeErrorPayload {
+  code: MarinaRuntimeErrorCode;
+  message: string;
+  retryable: boolean;
+}
+
+export type MarinaRuntimeResponse =
+  | { ok: true; value: unknown }
+  | { ok: false; error: MarinaRuntimeErrorPayload };
+
+/**
+ * The substrate supplies this object-capability. Applications never receive
+ * the provider resources, credentials, or namespace identifiers behind it.
+ */
+export interface MarinaRuntimeBinding {
+  invoke(request: MarinaRuntimeRequest): Promise<MarinaRuntimeResponse>;
+  /** Internal substrate callback used only by defineApp's job adapter. The
+   * application receives no signing key or provider dispatch primitive. */
+  authorizeJob?(request: MarinaJobAuthorizationRequest): Promise<boolean>;
+}
+
+export type JobValue = DatabaseValue;
+export type JobTrigger = "enqueue" | "schedule";
+export type JobState = "queued" | "running" | "succeeded" | "failed";
+
+export interface JobEnqueueInput {
+  name: string;
+  input: JobValue;
+  dedupeKey?: string;
+}
+
+export interface JobEnqueueResult {
+  id: string;
+  state: JobState;
+}
+
+export interface JobStatus {
+  id: string;
+  name: string;
+  state: JobState;
+  attempts: number;
+  createdAt: string;
+  startedAt?: string;
+  finishedAt?: string;
+}
+
+export interface MarinaJobInvocation {
+  runId: string;
+  workspaceId: string;
+  appId: string;
+  artifactDigest: string;
+  environment: "development" | "preview" | "production";
+  jobName: string;
+  handler: string;
+  input: JobValue;
+  attempt: number;
+  trigger: JobTrigger;
+  scheduledFor?: string;
+  /** Opaque, run-bound delegation consumed by the runtime adapter. It is not
+   * exposed to the application handler or job context. */
+  capabilitySession?: string;
+}
+
+export interface MarinaJobAuthorizationRequest {
+  token: string;
+  body: string;
+}
+
+export interface StoragePutInput {
+  key: string;
+  body: string | Uint8Array | ArrayBuffer;
+  contentType?: string;
+  metadata?: Record<string, string>;
+}
+
+export interface StorageGetInput {
+  key: string;
+}
+
+export interface StorageDeleteInput {
+  key: string;
+}
+
+export interface StorageListInput {
+  prefix?: string;
+  cursor?: string;
+  limit?: number;
+}
+
+export interface StorageObjectMetadata {
+  key: string;
+  size: number;
+  etag: string;
+  uploadedAt: string;
+  contentType?: string;
+  metadata: Record<string, string>;
+}
+
+export interface StorageObject extends StorageObjectMetadata {
+  body: Uint8Array;
+}
+
+export interface StorageListResult {
+  objects: StorageObjectMetadata[];
+  cursor?: string;
+  truncated: boolean;
+}
+
+/** JSON-compatible values cross the provider-neutral broker boundary. Postgres
+ * dates, numerics, JSON, and arrays therefore keep deterministic wire shapes
+ * across Workers, local development, and future substrates. */
+export type DatabaseValue =
+  | null
+  | boolean
+  | number
+  | string
+  | DatabaseValue[]
+  | { [key: string]: DatabaseValue };
+
+export type DatabaseRow = Record<string, DatabaseValue>;
+
+export interface DatabaseQuery {
+  text: string;
+  params: DatabaseValue[];
+}
+
+export interface DatabaseResult<Row extends DatabaseRow = DatabaseRow> {
+  rows: Row[];
+  rowCount: number;
+}
+
+export type AIModelClass = "fast" | "smart";
+/** A stable class alias, or the id of a model from Marina's own model
+ * library. The broker validates explicit ids against the library it offers;
+ * provider model identifiers are never part of the app contract. */
+export type AIModel = AIModelClass | (string & {});
+export type AIMessageRole = "system" | "user" | "assistant";
+
+export interface AIMessage {
+  role: AIMessageRole;
+  content: string;
+}
+
+export interface AIGenerateInput {
+  model: AIModel;
+  messages: AIMessage[];
+  maxOutputTokens?: number;
+}
+
+export interface AIGenerateResult {
+  text: string;
+}
+
+/** Detect top-level Postgres transaction-control statements while ignoring
+ * quoted values, identifiers, dollar bodies, and nested comments. Marina owns
+ * the operation transaction on every substrate. */
+export function containsDatabaseTransactionControl(source: string): boolean {
+  let executable = "";
+  let index = 0;
+  let blockDepth = 0;
+  let state: "normal" | "single" | "double" | "line" | "block" | "dollar" = "normal";
+  let dollar = "";
+  while (index < source.length) {
+    const current = source[index] ?? "";
+    const next = source[index + 1] ?? "";
+    if (state === "normal") {
+      if (current === "-" && next === "-") {
+        state = "line";
+        executable += "  ";
+        index += 2;
+        continue;
+      }
+      if (current === "/" && next === "*") {
+        state = "block";
+        blockDepth = 1;
+        executable += "  ";
+        index += 2;
+        continue;
+      }
+      if (current === "'") state = "single";
+      else if (current === '"') state = "double";
+      else if (current === "$") {
+        const opener = /^\\$[A-Za-z_][A-Za-z0-9_]*\\$|^\\$\\$/.exec(source.slice(index))?.[0];
+        if (opener) {
+          state = "dollar";
+          dollar = opener;
+          executable += " ".repeat(opener.length);
+          index += opener.length;
+          continue;
+        }
+      }
+      executable += state === "normal" ? current : " ";
+      index++;
+      continue;
+    }
+    if (state === "line") {
+      if (current === "\\n") {
+        state = "normal";
+        executable += "\\n";
+      } else executable += " ";
+      index++;
+      continue;
+    }
+    if (state === "block") {
+      if (current === "/" && next === "*") {
+        blockDepth++;
+        executable += "  ";
+        index += 2;
+      } else if (current === "*" && next === "/") {
+        blockDepth--;
+        executable += "  ";
+        index += 2;
+        if (blockDepth === 0) state = "normal";
+      } else {
+        executable += current === "\\n" ? "\\n" : " ";
+        index++;
+      }
+      continue;
+    }
+    if (state === "dollar") {
+      if (source.startsWith(dollar, index)) {
+        executable += " ".repeat(dollar.length);
+        index += dollar.length;
+        state = "normal";
+      } else {
+        executable += current === "\\n" ? "\\n" : " ";
+        index++;
+      }
+      continue;
+    }
+    if (state === "single" && current === "'" && next === "'") {
+      executable += "  ";
+      index += 2;
+      continue;
+    }
+    if (state === "double" && current === '"' && next === '"') {
+      executable += "  ";
+      index += 2;
+      continue;
+    }
+    const closes =
+      (state === "single" && current === "'") || (state === "double" && current === '"');
+    executable += current === "\\n" ? "\\n" : " ";
+    index++;
+    if (closes) state = "normal";
+  }
+  return /(?:^|;)\\s*(?:abort\\b|begin\\b|start\\s+transaction\\b|commit\\b|end\\b|rollback\\b|savepoint\\b|release\\s+savepoint\\b|prepare\\s+transaction\\b|set\\s+transaction\\b|set\\s+session\\s+characteristics\\s+as\\s+transaction\\b)/i.test(
+    executable,
+  );
+}
+
+export function isRuntimeResponse(value: unknown): value is MarinaRuntimeResponse {
+  if (!value || typeof value !== "object") return false;
+  const response = value as Partial<MarinaRuntimeResponse>;
+  if (response.ok === true) return Object.hasOwn(response, "value");
+  if (response.ok !== false || !response.error || typeof response.error !== "object") return false;
+  return (
+    typeof response.error.code === "string" &&
+    typeof response.error.message === "string" &&
+    typeof response.error.retryable === "boolean"
+  );
+}
+`,
+      "database.ts": 'import type {\n  DatabaseQuery,\n  DatabaseResult,\n  DatabaseRow,\n  MarinaRuntimeBinding,\n} from "./contract.js";\nimport {\n  containsDatabaseTransactionControl,\n  MAX_DATABASE_PARAMETER_BYTES,\n  MAX_DATABASE_PARAMETERS,\n  MAX_DATABASE_QUERY_BYTES,\n  MAX_DATABASE_TRANSACTION_QUERIES,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst MAX_VALUE_DEPTH = 32;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nfunction assertJsonValue(value: unknown, depth = 0, seen = new Set<object>()): void {\n  if (depth > MAX_VALUE_DEPTH) invalid("database parameters are nested too deeply");\n  if (\n    value === null ||\n    typeof value === "string" ||\n    typeof value === "boolean" ||\n    (typeof value === "number" && Number.isFinite(value))\n  )\n    return;\n  if (!value || typeof value !== "object")\n    invalid("database parameters must contain only JSON-compatible values");\n  if (seen.has(value)) invalid("database parameters must not contain cycles");\n  seen.add(value);\n  if (Array.isArray(value)) {\n    for (const item of value) assertJsonValue(item, depth + 1, seen);\n  } else {\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null)\n      invalid("database parameters must contain only plain JSON objects");\n    for (const item of Object.values(value)) assertJsonValue(item, depth + 1, seen);\n  }\n  seen.delete(value);\n}\n\nfunction jsonBytes(value: unknown): number {\n  assertJsonValue(value);\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("database parameters must be JSON serializable");\n  }\n  if (serialized === undefined) invalid("database parameters must be JSON serializable");\n  return encoder.encode(serialized).byteLength;\n}\n\n/** Validate one provider-neutral parameterized Postgres query. Runtime SQL is\n * app-authored, but values remain separate so callers never need to interpolate\n * request data into SQL text. The broker repeats these checks at its boundary. */\nexport function assertDatabaseQuery(value: DatabaseQuery): DatabaseQuery {\n  if (!value || typeof value !== "object" || Array.isArray(value))\n    invalid("database query must be an object");\n  if (typeof value.text !== "string" || value.text.trim().length === 0)\n    invalid("database query text must not be empty");\n  if (value.text.includes("\\0")) invalid("database query text must not contain null bytes");\n  if (containsDatabaseTransactionControl(value.text))\n    invalid("database transactions are managed by the Marina runtime");\n  if (encoder.encode(value.text).byteLength > MAX_DATABASE_QUERY_BYTES)\n    invalid(`database query text must not exceed ${String(MAX_DATABASE_QUERY_BYTES)} bytes`);\n  if (!Array.isArray(value.params)) invalid("database query parameters must be an array");\n  if (value.params.length > MAX_DATABASE_PARAMETERS)\n    invalid(`database queries may contain at most ${String(MAX_DATABASE_PARAMETERS)} parameters`);\n  if (jsonBytes(value.params) > MAX_DATABASE_PARAMETER_BYTES)\n    invalid(\n      `database query parameters must not exceed ${String(MAX_DATABASE_PARAMETER_BYTES)} bytes`,\n    );\n  return value;\n}\n\nexport interface MarinaDatabase {\n  /** Execute one parameterized statement against this app\'s private schema. */\n  query<Row extends DatabaseRow = DatabaseRow>(\n    text: string,\n    params?: DatabaseQuery["params"],\n  ): Promise<DatabaseResult<Row>>;\n\n  /** Execute a bounded list of statements atomically. Interactive transaction\n   * callbacks are intentionally absent so the contract works across edge and\n   * future non-Cloudflare substrates. */\n  transaction<Row extends DatabaseRow = DatabaseRow>(\n    queries: readonly DatabaseQuery[],\n  ): Promise<DatabaseResult<Row>[]>;\n}\n\nexport function createDatabase(binding: MarinaRuntimeBinding): MarinaDatabase {\n  return {\n    async query(text, params = []) {\n      const query = assertDatabaseQuery({ text, params });\n      return invokeRuntime(binding, "db", "query", query);\n    },\n\n    async transaction(queries) {\n      if (!Array.isArray(queries) || queries.length === 0)\n        invalid("database transaction must contain at least one query");\n      if (queries.length > MAX_DATABASE_TRANSACTION_QUERIES)\n        invalid(\n          `database transactions may contain at most ${String(MAX_DATABASE_TRANSACTION_QUERIES)} queries`,\n        );\n      const validated = queries.map((query) => assertDatabaseQuery(query));\n      return invokeRuntime(binding, "db", "transaction", { queries: validated });\n    },\n  };\n}\n',
+      "error.ts": 'import type { MarinaRuntimeErrorCode, MarinaRuntimeErrorPayload } from "./contract.js";\n\nexport class MarinaRuntimeError extends Error {\n  readonly code: MarinaRuntimeErrorCode;\n  readonly retryable: boolean;\n\n  constructor(payload: MarinaRuntimeErrorPayload) {\n    super(payload.message);\n    this.name = "MarinaRuntimeError";\n    this.code = payload.code;\n    this.retryable = payload.retryable;\n  }\n}\n',
+      "index.ts": 'import {\n  MARINA_JOB_EXECUTION_PATH,\n  MAX_JOB_INVOCATION_BYTES,\n  type MarinaRuntimeBinding,\n} from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { createStorage, type MarinaStorage } from "./storage.js";\nimport { createDatabase, type MarinaDatabase } from "./database.js";\nimport { createAI, type MarinaAI } from "./ai.js";\nimport { createJobs, type MarinaJobs } from "./jobs.js";\nimport { createCapabilities, type MarinaCapabilities } from "./capabilities.js";\nimport { createConnections, type MarinaConnections } from "./connections.js";\n\nexport type {\n  MarinaRuntimeBinding,\n  DatabaseQuery,\n  DatabaseResult,\n  DatabaseRow,\n  DatabaseValue,\n  AIGenerateInput,\n  AIGenerateResult,\n  AIMessage,\n  AIMessageRole,\n  AIModel,\n  AIModelClass,\n  JobEnqueueResult,\n  JobState,\n  JobStatus,\n  JobTrigger,\n  JobValue,\n  MarinaJobInvocation,\n  MarinaRuntimeErrorCode,\n  MarinaRuntimeErrorPayload,\n  MarinaRuntimeRequest,\n  MarinaRuntimeResponse,\n  StorageListResult,\n  StorageObject,\n  StorageObjectMetadata,\n} from "./contract.js";\nexport {\n  containsDatabaseTransactionControl,\n  MARINA_RUNTIME_PROTOCOL_VERSION,\n  MAX_STORAGE_KEY_BYTES,\n  MAX_STORAGE_OBJECT_BYTES,\n  MAX_CAPABILITY_INPUT_BYTES,\n  MAX_CAPABILITY_RESULT_BYTES,\n  MAX_CAPABILITY_SESSION_BYTES,\n  MAX_DATABASE_PARAMETER_BYTES,\n  MAX_DATABASE_PARAMETERS,\n  MAX_DATABASE_QUERY_BYTES,\n  MAX_DATABASE_TRANSACTION_QUERIES,\n  MAX_AI_INPUT_BYTES,\n  MAX_AI_MESSAGE_BYTES,\n  MAX_AI_MESSAGES,\n  MAX_AI_OUTPUT_TOKENS,\n  MAX_JOB_INPUT_BYTES,\n  MAX_JOB_INVOCATION_BYTES,\n  MAX_JOB_VALUE_DEPTH,\n  MARINA_JOB_EXECUTION_PATH,\n} from "./contract.js";\nexport { MarinaRuntimeError } from "./error.js";\nexport type { MarinaStorage, StorageListOptions, StoragePutOptions } from "./storage.js";\nexport type { MarinaDatabase } from "./database.js";\nexport { assertAIGenerateInput } from "./ai.js";\nexport type { MarinaAI } from "./ai.js";\nexport { assertJobName, assertJobValue } from "./jobs.js";\nexport type { JobEnqueueOptions, MarinaJobs } from "./jobs.js";\nexport type { CapabilityInvokeOptions, MarinaCapabilities } from "./capabilities.js";\nexport type {\n  ConnectionInvokeRequest,\n  MarinaConnectionNamespace,\n  MarinaConnectionOperationInput,\n  MarinaConnections,\n} from "./connections.js";\n\nexport interface MarinaRuntime {\n  storage: MarinaStorage;\n  db: MarinaDatabase;\n  ai: MarinaAI;\n  jobs: MarinaJobs;\n  capabilities: MarinaCapabilities;\n  connections: MarinaConnections;\n}\n\nexport function createMarinaRuntime(binding: MarinaRuntimeBinding): MarinaRuntime {\n  return createRuntime(binding);\n}\n\nfunction createRuntime(binding: MarinaRuntimeBinding, capabilitySession?: string): MarinaRuntime {\n  return {\n    storage: createStorage(binding),\n    db: createDatabase(binding),\n    ai: createAI(binding),\n    jobs: createJobs(binding),\n    capabilities: createCapabilities(binding, capabilitySession),\n    connections: createConnections(binding, capabilitySession),\n  };\n}\n\nexport interface MarinaAppContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface MarinaApp {\n  fetch(\n    request: Request,\n    marina: MarinaRuntime,\n    context: MarinaAppContext,\n  ): Response | Promise<Response>;\n  jobs?: Record<string, MarinaJobHandler>;\n}\n\nexport interface MarinaPlatformApp {\n  fetch(\n    request: Request,\n    environment: unknown,\n    context: MarinaAppContext,\n  ): Response | Promise<Response>;\n}\n\nconst platformApps = new WeakSet<object>();\n\nexport interface MarinaJobContext extends MarinaAppContext {\n  runId: string;\n  attempt: number;\n  trigger: import("./contract.js").JobTrigger;\n  scheduledFor?: string;\n}\n\nexport type MarinaJobHandler = (\n  input: import("./contract.js").JobValue,\n  marina: MarinaRuntime,\n  context: MarinaJobContext,\n) => void | Promise<void>;\n\nasync function readBoundedJobBody(request: Request): Promise<string | null> {\n  const declared = request.headers.get("content-length");\n  if (declared !== null) {\n    const bytes = Number(declared);\n    if (Number.isFinite(bytes) && bytes > MAX_JOB_INVOCATION_BYTES) return null;\n  }\n  if (!request.body) return "";\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    size += value.byteLength;\n    if (size > MAX_JOB_INVOCATION_BYTES) {\n      await reader.cancel().catch(() => undefined);\n      return null;\n    }\n    chunks.push(value);\n  }\n  const bytes = new Uint8Array(size);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return new TextDecoder().decode(bytes);\n}\n\nasync function executeJobRequest(\n  app: MarinaApp,\n  request: Request,\n  binding: MarinaRuntimeBinding,\n  context: MarinaAppContext,\n): Promise<Response> {\n  const token = request.headers.get("x-marina-job-token") ?? "";\n  if (!binding.authorizeJob || !token) return new Response("Not found", { status: 404 });\n  const body = await readBoundedJobBody(request);\n  if (body === null) return new Response("Payload too large", { status: 413 });\n  if (!(await binding.authorizeJob({ token, body })))\n    return new Response("Not found", { status: 404 });\n  let invocation: import("./contract.js").MarinaJobInvocation;\n  try {\n    invocation = JSON.parse(body) as import("./contract.js").MarinaJobInvocation;\n  } catch {\n    return new Response("Bad request", { status: 400 });\n  }\n  const handler = app.jobs?.[invocation.handler];\n  if (typeof handler !== "function") return new Response("Job handler not found", { status: 404 });\n  await handler(invocation.input, createRuntime(binding, invocation.capabilitySession), {\n    ...context,\n    runId: invocation.runId,\n    attempt: invocation.attempt,\n    trigger: invocation.trigger,\n    ...(invocation.scheduledFor ? { scheduledFor: invocation.scheduledFor } : {}),\n  });\n  return new Response(null, { status: 204 });\n}\n\ninterface SubstrateEnvironment {\n  MARINA?: unknown;\n}\n\nfunction runtimeBinding(environment: unknown): MarinaRuntimeBinding {\n  const binding = (environment as SubstrateEnvironment | null)?.MARINA;\n  if (!binding || typeof binding !== "object" || !("invoke" in binding)) {\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "This app was not started with the Marina runtime binding",\n      retryable: false,\n    });\n  }\n  const invoke = (binding as { invoke?: unknown }).invoke;\n  if (typeof invoke !== "function") {\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "This app has an incompatible Marina runtime binding",\n      retryable: false,\n    });\n  }\n  return binding as MarinaRuntimeBinding;\n}\n\n/**\n * Define a portable Marina application. The returned adapter matches the\n * active substrate, while application code sees only Web APIs and Marina.\n */\nexport function defineApp(app: MarinaApp): MarinaPlatformApp {\n  const adapter: MarinaPlatformApp = {\n    fetch(request: Request, environment: unknown, context: MarinaAppContext) {\n      const binding = runtimeBinding(environment);\n      const url = new URL(request.url);\n      if (request.method === "POST" && url.pathname === MARINA_JOB_EXECUTION_PATH) {\n        return executeJobRequest(app, request, binding, context);\n      }\n      const capabilitySession = request.headers.get("x-platform-capability-session") ?? undefined;\n      if (!capabilitySession) return app.fetch(request, createRuntime(binding), context);\n      const headers = new Headers(request.headers);\n      headers.delete("x-platform-capability-session");\n      return app.fetch(\n        new Request(request, { headers }),\n        createRuntime(binding, capabilitySession),\n        context,\n      );\n    },\n  };\n  platformApps.add(adapter);\n  return adapter;\n}\n\n/** Internal build adapter. Application entrypoints may export the portable\n * app object directly; imports of defineApp remain compatible during the\n * transition without wrapping an already-adapted module twice. */\nexport function adaptApp(app: MarinaApp | MarinaPlatformApp): MarinaPlatformApp {\n  if (!app || typeof app !== "object" || typeof app.fetch !== "function") {\n    throw new TypeError("The Marina app entrypoint must export a fetch handler");\n  }\n  return platformApps.has(app) ? (app as MarinaPlatformApp) : defineApp(app as MarinaApp);\n}\n',
+      "invoke.ts": 'import type {\n  MarinaRuntimeBinding,\n  MarinaRuntimeRequest,\n  MarinaRuntimeService,\n} from "./contract.js";\nimport { MARINA_RUNTIME_PROTOCOL_VERSION, isRuntimeResponse } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\n\n/** Cross-service invocation behavior belongs to the Marina compatibility\n * layer. Individual capability clients supply only their stable service name,\n * operation, and validated provider-neutral input. */\nexport async function invokeRuntime<T>(\n  binding: MarinaRuntimeBinding,\n  service: MarinaRuntimeService,\n  operation: MarinaRuntimeRequest["operation"],\n  input: unknown,\n): Promise<T> {\n  let response: unknown;\n  try {\n    response = await binding.invoke({\n      protocolVersion: MARINA_RUNTIME_PROTOCOL_VERSION,\n      requestId: crypto.randomUUID(),\n      service,\n      operation,\n      input,\n    });\n  } catch (error) {\n    if (error instanceof MarinaRuntimeError) throw error;\n    throw new MarinaRuntimeError({\n      code: "UNAVAILABLE",\n      message: "Marina runtime is unavailable",\n      retryable: true,\n    });\n  }\n  if (!isRuntimeResponse(response)) {\n    throw new MarinaRuntimeError({\n      code: "INTERNAL",\n      message: "Marina runtime returned an invalid response",\n      retryable: false,\n    });\n  }\n  if (!response.ok) throw new MarinaRuntimeError(response.error);\n  return response.value as T;\n}\n',
+      "jobs.ts": 'import type { JobEnqueueResult, JobStatus, JobValue, MarinaRuntimeBinding } from "./contract.js";\nimport { MAX_JOB_INPUT_BYTES, MAX_JOB_VALUE_DEPTH } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst encoder = new TextEncoder();\nconst JOB_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;\nconst RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\nexport function assertJobName(value: unknown): string {\n  if (typeof value !== "string" || !JOB_NAME.test(value)) invalid("invalid job name");\n  return value as string;\n}\n\nexport function assertJobValue(value: unknown): JobValue {\n  const seen = new Set<object>();\n  const visit = (current: unknown, depth: number): void => {\n    if (depth > MAX_JOB_VALUE_DEPTH) invalid("job input is nested too deeply");\n    if (current === null || typeof current === "string" || typeof current === "boolean") return;\n    if (typeof current === "number") {\n      if (!Number.isFinite(current)) invalid("job input numbers must be finite");\n      return;\n    }\n    if (!current || typeof current !== "object") invalid("job input must be JSON compatible");\n    if (seen.has(current as object)) invalid("job input must not contain cycles");\n    seen.add(current as object);\n    if (Array.isArray(current)) {\n      for (const item of current) visit(item, depth + 1);\n    } else {\n      if (Object.getPrototypeOf(current) !== Object.prototype)\n        invalid("job input must contain plain objects");\n      for (const [key, item] of Object.entries(current)) {\n        if (key === "__proto__" || key === "constructor" || key === "prototype")\n          invalid("job input contains an unsafe key");\n        visit(item, depth + 1);\n      }\n    }\n    seen.delete(current as object);\n  };\n  visit(value, 0);\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    invalid("job input must be JSON compatible");\n  }\n  if (serialized === undefined || encoder.encode(serialized).byteLength > MAX_JOB_INPUT_BYTES)\n    invalid(`job input must not exceed ${String(MAX_JOB_INPUT_BYTES)} bytes`);\n  return value as JobValue;\n}\n\nexport interface JobEnqueueOptions {\n  dedupeKey?: string;\n}\n\nexport interface MarinaJobs {\n  enqueue(name: string, input: JobValue, options?: JobEnqueueOptions): Promise<JobEnqueueResult>;\n  get(runId: string): Promise<JobStatus>;\n}\n\nexport function createJobs(binding: MarinaRuntimeBinding): MarinaJobs {\n  return {\n    enqueue(name, input, options = {}) {\n      const dedupeKey = options.dedupeKey;\n      if (\n        dedupeKey !== undefined &&\n        (typeof dedupeKey !== "string" || dedupeKey.length < 1 || dedupeKey.length > 200)\n      )\n        invalid("job dedupe key must be between 1 and 200 characters");\n      return invokeRuntime(binding, "jobs", "enqueue", {\n        name: assertJobName(name),\n        input: assertJobValue(input),\n        ...(dedupeKey === undefined ? {} : { dedupeKey }),\n      });\n    },\n    get(runId) {\n      if (!RUN_ID.test(runId)) invalid("invalid job run id");\n      return invokeRuntime(binding, "jobs", "get", { runId });\n    },\n  };\n}\n',
+      "storage.ts": 'import type {\n  MarinaRuntimeBinding,\n  StorageListInput,\n  StorageListResult,\n  StorageObject,\n  StorageObjectMetadata,\n  StoragePutInput,\n} from "./contract.js";\nimport { MAX_STORAGE_KEY_BYTES, MAX_STORAGE_OBJECT_BYTES } from "./contract.js";\nimport { MarinaRuntimeError } from "./error.js";\nimport { invokeRuntime } from "./invoke.js";\n\nconst MAX_CONTENT_TYPE_LENGTH = 200;\nconst MAX_METADATA_ENTRIES = 32;\nconst MAX_METADATA_KEY_LENGTH = 128;\nconst MAX_METADATA_VALUE_LENGTH = 1024;\nconst MAX_LIST_LIMIT = 1000;\nconst encoder = new TextEncoder();\n\nfunction invalid(message: string): never {\n  throw new MarinaRuntimeError({ code: "INVALID_INPUT", message, retryable: false });\n}\n\n/** Validate a logical app key. The broker adds the organization/app prefix. */\nexport function assertStorageKey(\n  key: string,\n  options: { allowEmpty?: boolean; allowTrailingSlash?: boolean } = {},\n): string {\n  if (typeof key !== "string") invalid("storage key must be a string");\n  if (key.length === 0) {\n    if (options.allowEmpty) return key;\n    invalid("storage key must not be empty");\n  }\n  if (encoder.encode(key).length > MAX_STORAGE_KEY_BYTES)\n    invalid(`storage key must not exceed ${String(MAX_STORAGE_KEY_BYTES)} bytes`);\n  if (key.startsWith("/")) invalid("storage key must be relative");\n  if (key.endsWith("/") && !options.allowTrailingSlash)\n    invalid("storage key must identify an object, not a directory");\n  if (key.includes("\\\\")) invalid("storage key must use forward slashes");\n  if (/\\p{Cc}/u.test(key)) invalid("storage key must not contain control characters");\n  const segments = key.endsWith("/") ? key.slice(0, -1).split("/") : key.split("/");\n  if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))\n    invalid("storage key contains an invalid path segment");\n  return key;\n}\n\nfunction validateMetadata(metadata: Record<string, string> | undefined): Record<string, string> {\n  if (!metadata) return {};\n  const entries = Object.entries(metadata);\n  if (entries.length > MAX_METADATA_ENTRIES)\n    invalid(`storage metadata may contain at most ${String(MAX_METADATA_ENTRIES)} entries`);\n  const normalized: Record<string, string> = {};\n  for (const [key, value] of entries) {\n    if (!key || key.length > MAX_METADATA_KEY_LENGTH)\n      invalid(`storage metadata keys must be 1-${String(MAX_METADATA_KEY_LENGTH)} characters`);\n    if (typeof value !== "string" || value.length > MAX_METADATA_VALUE_LENGTH)\n      invalid(\n        `storage metadata values must be strings no longer than ${String(MAX_METADATA_VALUE_LENGTH)} characters`,\n      );\n    Object.defineProperty(normalized, key, {\n      value,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n  return normalized;\n}\n\nexport interface StoragePutOptions {\n  contentType?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface StorageListOptions {\n  prefix?: string;\n  cursor?: string;\n  limit?: number;\n}\n\nexport interface MarinaStorage {\n  put(\n    key: string,\n    body: StoragePutInput["body"],\n    options?: StoragePutOptions,\n  ): Promise<StorageObjectMetadata>;\n  get(key: string): Promise<StorageObject | null>;\n  delete(key: string): Promise<void>;\n  list(options?: StorageListOptions): Promise<StorageListResult>;\n}\n\nexport function createStorage(binding: MarinaRuntimeBinding): MarinaStorage {\n  return {\n    async put(key, body, options = {}) {\n      assertStorageKey(key);\n      if (\n        typeof body !== "string" &&\n        !(body instanceof Uint8Array) &&\n        !(body instanceof ArrayBuffer)\n      )\n        invalid("storage body must be a string, Uint8Array, or ArrayBuffer");\n      const bodyBytes =\n        typeof body === "string"\n          ? encoder.encode(body).byteLength\n          : body instanceof Uint8Array\n            ? body.byteLength\n            : body.byteLength;\n      if (bodyBytes > MAX_STORAGE_OBJECT_BYTES) {\n        throw new MarinaRuntimeError({\n          code: "QUOTA_EXCEEDED",\n          message: `storage objects may not exceed ${String(MAX_STORAGE_OBJECT_BYTES)} bytes`,\n          retryable: false,\n        });\n      }\n      if (options.contentType && options.contentType.length > MAX_CONTENT_TYPE_LENGTH)\n        invalid(\n          `storage content type must not exceed ${String(MAX_CONTENT_TYPE_LENGTH)} characters`,\n        );\n      return invokeRuntime<StorageObjectMetadata>(binding, "storage", "put", {\n        key,\n        body,\n        ...(options.contentType ? { contentType: options.contentType } : {}),\n        metadata: validateMetadata(options.metadata),\n      } satisfies StoragePutInput);\n    },\n\n    async get(key) {\n      assertStorageKey(key);\n      return invokeRuntime<StorageObject | null>(binding, "storage", "get", { key });\n    },\n\n    async delete(key) {\n      assertStorageKey(key);\n      await invokeRuntime<null>(binding, "storage", "delete", { key });\n    },\n\n    async list(options = {}) {\n      const input: StorageListInput = {};\n      if (options.prefix !== undefined)\n        input.prefix = assertStorageKey(options.prefix, {\n          allowEmpty: true,\n          allowTrailingSlash: true,\n        });\n      if (options.cursor !== undefined) {\n        if (!options.cursor) invalid("storage cursor must not be empty");\n        input.cursor = options.cursor;\n      }\n      if (options.limit !== undefined) {\n        if (\n          !Number.isSafeInteger(options.limit) ||\n          options.limit < 1 ||\n          options.limit > MAX_LIST_LIMIT\n        )\n          invalid(`storage list limit must be between 1 and ${String(MAX_LIST_LIMIT)}`);\n        input.limit = options.limit;\n      }\n      return invokeRuntime<StorageListResult>(binding, "storage", "list", input);\n    },\n  };\n}\n'
+    };
+  }
+});
+
+// src/dev/host.ts
+import { createServer as createServer2 } from "node:http";
+import { mkdirSync as mkdirSync4, watch, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join6, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { Readable } from "node:stream";
+function entrypointSource(projectDir, entrypoint) {
+  return [
+    `import app from ${JSON.stringify(resolve(projectDir, entrypoint))};`,
+    ["import { adaptApp } ", ["fr", "om"].join(""), ' "./runtime/index.ts";'].join(""),
+    "export default adaptApp(app);",
+    ""
+  ].join("\n");
+}
+async function bundle(options) {
+  for (const [name, source] of Object.entries(DEV_RUNTIME_FILES)) {
+    const path = join6(options.buildDir, "runtime", name);
+    mkdirSync4(dirname2(path), { recursive: true });
+    writeFileSync3(path, source);
+  }
+  const entry = join6(options.buildDir, "entrypoint.ts");
+  writeFileSync3(entry, entrypointSource(options.projectDir, options.manifest.entrypoint));
+  const outfile = join6(options.buildDir, "app.mjs");
+  let esbuild;
+  try {
+    esbuild = await import("esbuild");
+  } catch {
+    throw new Error("esbuild could not load \u2014 reinstall the Marina CLI");
+  }
+  await esbuild.build({
+    entryPoints: [entry],
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    conditions: ["workerd", "worker", "browser"],
+    target: "es2022",
+    external: ["cloudflare:*"],
+    alias: {
+      "@marina/runtime": join6(options.buildDir, "runtime", "index.ts"),
+      "marina:runtime": join6(options.buildDir, "runtime", "index.ts")
+    },
+    absWorkingDir: options.projectDir,
+    outfile,
+    logLevel: "silent"
+  });
+  const module = await import(`${pathToFileURL(outfile).href}?v=${String(Date.now())}`);
+  if (typeof module.default?.fetch !== "function") {
+    throw new Error("the app entrypoint does not export a Marina app (use defineApp)");
+  }
+  return module.default;
+}
+function toRequest(req, port, identity) {
+  const url = new URL(req.url ?? "/", `http://localhost:${String(port)}`);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (typeof value === "string") headers.set(name, value);
+    else if (Array.isArray(value)) headers.set(name, value.join(", "));
+  }
+  headers.set("x-platform-user-id", identity.userId);
+  headers.set("x-platform-workspace-id", identity.workspaceId);
+  headers.set("x-platform-capability-session", "marina-local-dev");
+  const method = req.method ?? "GET";
+  const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(req);
+  return new Request(url, {
+    method,
+    headers,
+    ...body ? { body, duplex: "half" } : {}
+  });
+}
+async function writeResponse(response, res, chrome) {
+  const headers = {};
+  response.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("text/html")) {
+    const html = injectDevChrome(await response.text(), chrome);
+    delete headers["content-length"];
+    res.writeHead(response.status, headers);
+    res.end(html);
+    return;
+  }
+  res.writeHead(response.status, headers);
+  if (!response.body) {
+    res.end();
+    return;
+  }
+  const reader = response.body.getReader();
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) break;
+    res.write(next.value);
+  }
+  res.end();
+}
+async function startDevHost(options) {
+  mkdirSync4(options.buildDir, { recursive: true });
+  let app = await bundle(options);
+  const chrome = devChromeSnippet({
+    appName: options.identity.appName,
+    userLabel: options.identity.userLabel
+  });
+  const fetchApp = (request2) => Promise.resolve(
+    app.fetch(request2, { MARINA: options.binding }, { waitUntil: () => void 0 })
+  );
+  const server = createServer2((req, res) => {
+    fetchApp(toRequest(req, options.port, options.identity)).then((response) => writeResponse(response, res, chrome)).catch((error) => {
+      res.writeHead(500, { "content-type": "text/plain" });
+      res.end(`marina dev: ${error.message}`);
+    });
+  });
+  await new Promise((ready, failed) => {
+    server.once("error", failed);
+    server.listen(options.port, () => {
+      ready();
+    });
+  });
+  let rebuildTimer = null;
+  const watchers = [];
+  const scheduleRebuild = () => {
+    if (rebuildTimer) clearTimeout(rebuildTimer);
+    rebuildTimer = setTimeout(() => {
+      bundle(options).then((next) => {
+        app = next;
+        options.log("reloaded");
+      }).catch((error) => {
+        options.log(`build failed \u2014 still serving the previous build: ${error.message}`);
+      });
+    }, 150);
+  };
+  try {
+    const watcher = watch(options.projectDir, { recursive: true }, (_event, file) => {
+      const name = String(file ?? "");
+      if (name.startsWith(".marina") || name.startsWith("node_modules") || name.startsWith(".git")) {
+        return;
+      }
+      scheduleRebuild();
+    });
+    watchers.push(watcher);
+  } catch {
+    options.log("file watching is unavailable \u2014 restart marina dev to pick up changes");
+  }
+  return {
+    port: options.port,
+    fetchApp,
+    rebuild: async () => {
+      app = await bundle(options);
+    },
+    close: async () => {
+      for (const watcher of watchers) watcher.close();
+      if (rebuildTimer) clearTimeout(rebuildTimer);
+      await new Promise((done) => {
+        server.close(() => {
+          done();
+        });
+      });
+    }
+  };
+}
+var init_host = __esm({
+  "src/dev/host.ts"() {
+    "use strict";
+    init_chrome();
+    init_embedded_runtime();
+  }
+});
+
+// src/dev/cron.ts
+function matchesField(field, value, minimum, maximum) {
+  return field.split(",").some((part) => {
+    const step = /^(.+)\/(\d+)$/.exec(part);
+    if (step?.[1] !== void 0 && step[2] !== void 0) {
+      const size = Number(step[2]);
+      if (!Number.isInteger(size) || size < 1) return false;
+      const base = step[1];
+      const [start, end] = base === "*" ? [minimum, maximum] : /^(\d+)-(\d+)$/.exec(base)?.slice(1).map(Number) ?? [Number(base), maximum];
+      if (start === void 0 || Number.isNaN(start)) return false;
+      return value >= start && value <= (end ?? maximum) && (value - start) % size === 0;
+    }
+    if (part === "*") return true;
+    const range = /^(\d+)-(\d+)$/.exec(part);
+    if (range) return value >= Number(range[1]) && value <= Number(range[2]);
+    return Number(part) === value;
+  });
+}
+function cronMatches(schedule, at) {
+  const fields = schedule.trim().split(/\s+/);
+  if (fields.length !== 5) return false;
+  const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+  return matchesField(minute, at.getUTCMinutes(), 0, 59) && matchesField(hour, at.getUTCHours(), 0, 23) && matchesField(dayOfMonth, at.getUTCDate(), 1, 31) && matchesField(month, at.getUTCMonth() + 1, 1, 12) && matchesField(dayOfWeek, at.getUTCDay(), 0, 6);
+}
+var init_cron = __esm({
+  "src/dev/cron.ts"() {
+    "use strict";
+  }
+});
+
+// src/dev/jobs.ts
+import { randomUUID } from "node:crypto";
+var JOB_EXECUTION_PATH, DevJobRunner;
+var init_jobs = __esm({
+  "src/dev/jobs.ts"() {
+    "use strict";
+    init_cron();
+    JOB_EXECUTION_PATH = "/.marina/runtime/jobs/execute";
+    DevJobRunner = class {
+      runs = /* @__PURE__ */ new Map();
+      deduped = /* @__PURE__ */ new Map();
+      token = randomUUID();
+      fetchApp = null;
+      timer = null;
+      lastScheduledMinute = "";
+      manifest;
+      identity;
+      log;
+      constructor(manifest, identity, log) {
+        this.manifest = manifest;
+        this.identity = identity;
+        this.log = log;
+      }
+      attachApp(fetchApp) {
+        this.fetchApp = fetchApp;
+      }
+      authorizeJob(request2) {
+        void request2.body;
+        return request2.token === this.token;
+      }
+      enqueue(input) {
+        const definition = this.manifest.jobs[input.name];
+        if (!definition) {
+          throw new Error(`job "${input.name}" is not defined in marina.json`);
+        }
+        if (input.dedupeKey) {
+          const existing = this.deduped.get(`${input.name}:${input.dedupeKey}`);
+          const run2 = existing ? this.runs.get(existing) : void 0;
+          if (run2 && (run2.state === "queued" || run2.state === "running")) return run2;
+        }
+        const status2 = {
+          id: randomUUID(),
+          name: input.name,
+          state: "queued",
+          attempts: 0,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        this.runs.set(status2.id, status2);
+        if (input.dedupeKey) this.deduped.set(`${input.name}:${input.dedupeKey}`, status2.id);
+        void this.execute(status2, definition.handler, input.input, "enqueue");
+        return { ...status2 };
+      }
+      get(id) {
+        const run2 = this.runs.get(id);
+        return run2 ? { ...run2 } : null;
+      }
+      async execute(status2, handler, input, trigger, scheduledFor) {
+        const fetchApp = this.fetchApp;
+        if (!fetchApp) {
+          status2.state = "failed";
+          status2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+          return;
+        }
+        status2.state = "running";
+        status2.attempts += 1;
+        status2.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const invocation = {
+          runId: status2.id,
+          workspaceId: this.identity.workspaceId,
+          appId: this.identity.appId,
+          artifactDigest: `sha256:${"0".repeat(64)}`,
+          environment: "development",
+          jobName: status2.name,
+          handler,
+          input,
+          attempt: status2.attempts,
+          trigger,
+          ...scheduledFor ? { scheduledFor } : {},
+          capabilitySession: "marina-local-dev"
+        };
+        try {
+          const response = await fetchApp(
+            new Request(`http://marina.dev.local${JOB_EXECUTION_PATH}`, {
+              method: "POST",
+              headers: { "x-marina-job-token": this.token, "content-type": "application/json" },
+              body: JSON.stringify(invocation)
+            })
+          );
+          status2.state = response.ok ? "succeeded" : "failed";
+          if (!response.ok) {
+            this.log(`job ${status2.name} failed (${String(response.status)})`);
+          }
+        } catch (error) {
+          status2.state = "failed";
+          this.log(`job ${status2.name} threw: ${error.message}`);
+        }
+        status2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      }
+      startSchedules() {
+        if (this.timer) return;
+        this.timer = setInterval(() => {
+          const now = /* @__PURE__ */ new Date();
+          const minute = now.toISOString().slice(0, 16);
+          if (minute === this.lastScheduledMinute) return;
+          this.lastScheduledMinute = minute;
+          for (const [name, definition] of Object.entries(this.manifest.jobs)) {
+            if (definition.schedule && cronMatches(definition.schedule, now)) {
+              this.log(`schedule fired: ${name}`);
+              try {
+                const status2 = this.enqueue({ name, input: {} });
+                const run2 = this.runs.get(status2.id);
+                if (run2) run2.state = run2.state === "queued" ? "queued" : run2.state;
+              } catch (error) {
+                this.log(`schedule ${name} failed to enqueue: ${error.message}`);
+              }
+            }
+          }
+        }, 15e3);
+        this.timer.unref?.();
+      }
+      stop() {
+        if (this.timer) clearInterval(this.timer);
+        this.timer = null;
+      }
+    };
+  }
+});
+
+// src/dev/manifest.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7 } from "node:path";
+function fail(message) {
+  throw new Error(`marina.json: ${message}`);
 }
-var LINK = ".marina/project.json";
-function readLink(dir) {
+function readDevManifest(dir) {
+  const path = join7(dir, "marina.json");
+  if (!existsSync6(path)) {
+    fail("not found \u2014 marina dev runs from a project with a marina.json");
+  }
+  let value;
   try {
-    return JSON.parse(readFileSync(join(dir, LINK), "utf8"));
+    value = JSON.parse(readFileSync6(path, "utf8"));
   } catch {
-    return null;
+    fail("is not valid JSON");
   }
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail("must contain an object");
+  const manifest = value;
+  if (typeof manifest.entrypoint !== "string" || manifest.entrypoint.length === 0) {
+    fail('needs an "entrypoint" \u2014 static projects have no server to develop against');
+  }
+  const runtime = manifest.runtime ?? {};
+  const capabilities = Array.isArray(manifest.capabilities) ? manifest.capabilities.filter((name) => typeof name === "string") : [];
+  const connections = {};
+  if (manifest.connections !== void 0) {
+    if (!manifest.connections || typeof manifest.connections !== "object" || Array.isArray(manifest.connections)) {
+      fail('"connections" must map connector names to declarations');
+    }
+    for (const [connector, declared] of Object.entries(manifest.connections)) {
+      if (!CONNECTION_ID.test(connector)) fail(`"${connector}" is not a connector name`);
+      if (!Array.isArray(declared)) fail(`connections.${connector} must be an array`);
+      connections[connector] = declared.map((entry, index) => {
+        const binding = entry;
+        if (typeof binding.connection !== "string" || !CONNECTION_ID.test(binding.connection)) {
+          fail(`connections.${connector}[${String(index)}] needs an explicit "connection" id`);
+        }
+        const operations = Array.isArray(binding.capabilities) ? binding.capabilities : [];
+        if (!operations.every((op) => typeof op === "string" && NAME.test(op))) {
+          fail(`connections.${connector}[${String(index)}] has an invalid operation name`);
+        }
+        return { connection: binding.connection, capabilities: operations };
+      });
+    }
+  }
+  const jobs = {};
+  if (manifest.jobs && typeof manifest.jobs === "object" && !Array.isArray(manifest.jobs)) {
+    for (const [name, definition] of Object.entries(manifest.jobs)) {
+      const job = definition;
+      if (typeof job.handler === "string") {
+        jobs[name] = {
+          handler: job.handler,
+          ...typeof job.schedule === "string" ? { schedule: job.schedule } : {}
+        };
+      }
+    }
+  }
+  return {
+    ...typeof manifest.name === "string" ? { name: manifest.name } : {},
+    entrypoint: manifest.entrypoint,
+    runtime,
+    capabilities,
+    connections,
+    jobs
+  };
 }
-function writeLink(dir, link) {
-  mkdirSync(join(dir, ".marina"), { recursive: true });
-  writeFileSync(join(dir, LINK), `${JSON.stringify(link, null, 2)}
-`);
-}
+var CONNECTION_ID, NAME;
+var init_manifest = __esm({
+  "src/dev/manifest.ts"() {
+    "use strict";
+    CONNECTION_ID = /^[a-z][a-z0-9_]{0,39}$/;
+    NAME = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+  }
+});
 
-// src/api.ts
-var LOGIN_EXCHANGE_TIMEOUT_MS = 15e3;
-var ApiError = class extends Error {
-  code;
-  status;
-  constructor(code, message, status2) {
-    super(message);
-    this.code = code;
-    this.status = status2;
+// src/dev/storage.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync7, rmSync, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join8, normalize, sep } from "node:path";
+var MAX_LIST_LIMIT, LocalStorage;
+var init_storage = __esm({
+  "src/dev/storage.ts"() {
+    "use strict";
+    MAX_LIST_LIMIT = 1e3;
+    LocalStorage = class {
+      objects;
+      sidecars;
+      constructor(root) {
+        this.objects = join8(root, "objects");
+        this.sidecars = join8(root, "meta");
+        mkdirSync5(this.objects, { recursive: true });
+        mkdirSync5(this.sidecars, { recursive: true });
+      }
+      /** Keys were validated by the runtime client; this guards the filesystem
+       * anyway so a hand-crafted invoke cannot escape the store. */
+      objectPath(base, key) {
+        const path = normalize(join8(base, key));
+        if (path !== base && !path.startsWith(base + sep)) {
+          throw new Error("storage key escapes the local store");
+        }
+        return path;
+      }
+      put(input) {
+        const body = typeof input.body === "string" ? Buffer.from(input.body, "utf8") : input.body instanceof ArrayBuffer ? Buffer.from(input.body) : Buffer.from(input.body);
+        const sidecar = {
+          ...input.contentType ? { contentType: input.contentType } : {},
+          metadata: input.metadata ?? {},
+          etag: createHash2("sha256").update(body).digest("hex").slice(0, 32),
+          uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          size: body.byteLength
+        };
+        const objectPath = this.objectPath(this.objects, input.key);
+        mkdirSync5(dirname3(objectPath), { recursive: true });
+        writeFileSync4(objectPath, body);
+        const sidecarPath = this.objectPath(this.sidecars, `${input.key}.json`);
+        mkdirSync5(dirname3(sidecarPath), { recursive: true });
+        writeFileSync4(sidecarPath, JSON.stringify(sidecar));
+        return { key: input.key, ...sidecar };
+      }
+      get(key) {
+        const metadata = this.head(key);
+        if (!metadata) return null;
+        const body = readFileSync7(this.objectPath(this.objects, key));
+        return { ...metadata, body: new Uint8Array(body) };
+      }
+      head(key) {
+        try {
+          const sidecar = JSON.parse(
+            readFileSync7(this.objectPath(this.sidecars, `${key}.json`), "utf8")
+          );
+          return { key, ...sidecar };
+        } catch {
+          return null;
+        }
+      }
+      delete(key) {
+        rmSync(this.objectPath(this.objects, key), { force: true });
+        rmSync(this.objectPath(this.sidecars, `${key}.json`), { force: true });
+      }
+      list(input = {}) {
+        const limit = Math.min(input.limit ?? MAX_LIST_LIMIT, MAX_LIST_LIMIT);
+        const keys = [];
+        const walk = (dir, prefix) => {
+          let entries;
+          try {
+            entries = readdirSync3(dir);
+          } catch {
+            return;
+          }
+          for (const entry of entries.toSorted()) {
+            const path = join8(dir, entry);
+            if (statSync(path).isDirectory()) walk(path, `${prefix}${entry}/`);
+            else if (entry.endsWith(".json")) keys.push(`${prefix}${entry.slice(0, -5)}`);
+          }
+        };
+        walk(this.sidecars, "");
+        const filtered = keys.filter((key) => input.prefix ? key.startsWith(input.prefix) : true).filter((key) => input.cursor ? key > input.cursor : true);
+        const page2 = filtered.slice(0, limit);
+        const truncated = filtered.length > page2.length;
+        const objects = page2.map((key) => this.head(key)).filter((object) => object !== null);
+        return {
+          objects,
+          ...truncated && page2.length > 0 ? { cursor: page2[page2.length - 1] } : {},
+          truncated
+        };
+      }
+    };
   }
-};
-async function request(path, init) {
+});
+
+// src/dev/index.ts
+var dev_exports = {};
+__export(dev_exports, {
+  runDev: () => runDev
+});
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join9, resolve as resolve2 } from "node:path";
+async function runDev(options) {
   const token = getToken();
-  if (!token) throw new ApiError("unauthenticated", "not signed in \u2014 run `marina setup`", 401);
-  const res = await fetch(`${apiUrl()}${path}`, {
-    ...init,
-    headers: { ...cliRequestHeaders(), authorization: `Bearer ${token}`, ...init?.headers }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new ApiError(
-      body.error?.code ?? "error",
-      body.error?.message ?? `request failed (${String(res.status)})`,
-      res.status
-    );
+  if (!token) {
+    throw new Error("not signed in \u2014 run `marina setup` first");
   }
-  return body;
-}
-async function exchangeCliLogin(code, codeVerifier) {
-  let res;
-  try {
-    res = await fetch(`${apiUrl()}/cli/auth/exchange`, {
-      method: "POST",
-      headers: { ...cliRequestHeaders(), "content-type": "application/json" },
-      body: JSON.stringify({ code, code_verifier: codeVerifier }),
-      signal: AbortSignal.timeout(LOGIN_EXCHANGE_TIMEOUT_MS)
-    });
-  } catch (error) {
-    if (error.name === "TimeoutError") {
-      throw new ApiError(
-        "login_timeout",
-        "the login confirmation request timed out after 15 seconds \u2014 run `marina setup` to try again",
-        408
-      );
-    }
-    throw error;
+  const projectDir = resolve2(options.dir ?? ".");
+  const manifest = readDevManifest(projectDir);
+  const port = options.port ? Number(options.port) : DEFAULT_PORT;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("--port must be a number between 1 and 65535");
   }
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.token) {
-    throw new ApiError(
-      body.error?.code ?? "login_failed",
-      body.error?.message ?? `login exchange failed (${String(res.status)})`,
-      res.status
+  const identity = await me();
+  const appName = manifest.name ?? "Marina app";
+  say(`${bold("marina dev")} \xB7 ${appName}`);
+  const declared = Object.entries(manifest.connections).flatMap(
+    ([connector, bindings]) => bindings.map((binding2) => `${connector}/${binding2.connection}`)
+  );
+  if (declared.length > 0) {
+    say(
+      dim(
+        `connections: ${declared.join(", ")} \u2014 bridged to ${apiUrl()} as ${identity.user.email}; grants are checked per call`
+      )
     );
   }
-  return body.token;
-}
-async function startDeploy(zip, name, app) {
-  const form = new FormData();
-  form.set(
-    "code",
-    new Blob([new Uint8Array(zip).buffer], { type: "application/zip" }),
-    "upload.zip"
-  );
-  form.set("name", name);
-  form.set("source", "cli");
-  if (app) form.set("app", app);
-  const res = await request("/v1/deploys", {
-    method: "POST",
-    body: form
-  });
-  return res.deploy;
-}
-async function pollDeploy(id, onProgress = () => void 0) {
-  for (; ; ) {
-    const { deploy: deploy2 } = await request(`/v1/deploys/${id}`);
-    onProgress(deploy2);
-    if (deploy2.status !== "queued" && deploy2.status !== "building") return deploy2;
-    await new Promise((resolve2) => setTimeout(resolve2, 500));
+  const devDir = join9(projectDir, ".marina", "dev");
+  const storage = manifest.runtime.storage === "v1" ? new LocalStorage(join9(devDir, "storage")) : null;
+  let database = null;
+  if (manifest.runtime.db === "v1") {
+    database = await LocalDatabase.open(join9(devDir, "db"));
+    const applied = await database.applyMigrations(projectDir);
+    const total = existsSync7(join9(projectDir, "marina", "migrations")) ? "" : " (no marina/migrations yet)";
+    say(
+      `${green("ok")} db \u2014 embedded Postgres ready, ${String(applied.length)} migrations applied${total}`
+    );
   }
-}
-async function listApps() {
-  const res = await request("/v1/apps");
-  return res.apps;
-}
-var getApp = (idOrSlug) => request(`/v1/apps/${encodeURIComponent(idOrSlug)}`);
-async function getAppUrl(idOrSlug) {
-  return (await getApp(idOrSlug)).url;
-}
-async function listVersions(app) {
-  const res = await request(
-    `/v1/apps/${encodeURIComponent(app)}/versions`
-  );
-  return res.versions;
-}
-async function listDeploys(app, limit = 10) {
-  const res = await request(
-    `/v1/apps/${encodeURIComponent(app)}/deploys?limit=${String(limit)}`
-  );
-  return res.deploys;
-}
-async function restoreVersion(versionId) {
-  const res = await request(`/v1/versions/${versionId}/restore`, {
-    method: "POST"
+  const jobs = manifest.runtime.jobs === "v1" ? new DevJobRunner(
+    manifest,
+    { workspaceId: identity.workspace.id, appId: "local-dev" },
+    (line) => {
+      say(dim(line));
+    }
+  ) : null;
+  const binding = createDevBinding({
+    manifest,
+    storage,
+    database,
+    jobs,
+    bridge: { apiUrl: apiUrl(), token }
   });
-  return res.version;
-}
-async function listEnv(app) {
-  const res = await request(`/v1/apps/${encodeURIComponent(app)}/env`);
-  return res.env;
-}
-async function setEnv(app, key, value, secret) {
-  await request(`/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`, {
-    method: "PUT",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ value, kind: secret ? "secret" : "plain" })
+  const host = await startDevHost({
+    projectDir,
+    buildDir: join9(devDir, "build"),
+    manifest,
+    binding,
+    port,
+    identity: {
+      userId: identity.user.id,
+      workspaceId: identity.workspace.id,
+      userLabel: identity.user.email,
+      appName
+    },
+    log: (line) => {
+      say(dim(line));
+    }
   });
-}
-async function deleteEnv(app, key) {
-  await request(`/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`, {
-    method: "DELETE"
+  jobs?.attachApp(host.fetchApp);
+  if (jobs && options.schedules) {
+    jobs.startSchedules();
+    say(dim("schedules: on"));
+  } else if (jobs && Object.values(manifest.jobs).some((job) => job.schedule)) {
+    say(dim("schedules: off \u2014 pass --schedules to run them locally"));
+  }
+  if (manifest.runtime.ai === "v1") {
+    say(dim("marina.ai: bridged to Marina; usage is metered"));
+  }
+  say(
+    `${green("\u2192")} http://localhost:${String(port)}  ${dim(`(signed in as ${identity.user.email})`)}`
+  );
+  await new Promise((stop) => {
+    const shutdown = () => {
+      jobs?.stop();
+      void host.close().then(stop);
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
   });
 }
+var DEFAULT_PORT;
+var init_dev = __esm({
+  "src/dev/index.ts"() {
+    "use strict";
+    init_api();
+    init_config();
+    init_output();
+    init_binding();
+    init_db();
+    init_host();
+    init_jobs();
+    init_manifest();
+    init_storage();
+    DEFAULT_PORT = 5990;
+  }
+});
+
+// src/index.ts
+init_api();
+init_api();
+init_config();
+import { resolve as resolve3 } from "node:path";
+import { parseArgs } from "node:util";
 
 // ../../node_modules/.pnpm/fflate@0.8.3/node_modules/fflate/esm/index.mjs
 import { createRequire } from "module";
@@ -422,13 +2614,13 @@ var fdeb = new u8([
 var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
 var freb = function(eb, start) {
   var b = new u16(31);
-  for (var i = 0; i < 31; ++i) {
-    b[i] = start += 1 << eb[i - 1];
+  for (var i2 = 0; i2 < 31; ++i2) {
+    b[i2] = start += 1 << eb[i2 - 1];
   }
   var r = new i32(b[30]);
-  for (var i = 1; i < 30; ++i) {
-    for (var j = b[i]; j < b[i + 1]; ++j) {
-      r[j] = j - b[i] << 5 | i;
+  for (var i2 = 1; i2 < 30; ++i2) {
+    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
+      r[j] = j - b[i2] << 5 | i2;
     }
   }
   return { b, r };
@@ -451,25 +2643,25 @@ var x;
 var i;
 var hMap = (function(cd, mb, r) {
   var s = cd.length;
-  var i = 0;
+  var i2 = 0;
   var l = new u16(mb);
-  for (; i < s; ++i) {
-    if (cd[i])
-      ++l[cd[i] - 1];
+  for (; i2 < s; ++i2) {
+    if (cd[i2])
+      ++l[cd[i2] - 1];
   }
   var le = new u16(mb);
-  for (i = 1; i < mb; ++i) {
-    le[i] = le[i - 1] + l[i - 1] << 1;
+  for (i2 = 1; i2 < mb; ++i2) {
+    le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
   }
   var co;
   if (r) {
     co = new u16(1 << mb);
     var rvb = 15 - mb;
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        var sv = i << 4 | cd[i];
-        var r_1 = mb - cd[i];
-        var v = le[cd[i] - 1]++ << r_1;
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        var sv = i2 << 4 | cd[i2];
+        var r_1 = mb - cd[i2];
+        var v = le[cd[i2] - 1]++ << r_1;
         for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
           co[rev[v] >> rvb] = sv;
         }
@@ -477,9 +2669,9 @@ var hMap = (function(cd, mb, r) {
     }
   } else {
     co = new u16(s);
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        co[i2] = rev[le[cd[i2] - 1]++] >> 15 - cd[i2];
       }
     }
   }
@@ -556,9 +2748,9 @@ var wbits16 = function(d, p, v) {
 };
 var hTree = function(d, mb) {
   var t = [];
-  for (var i = 0; i < d.length; ++i) {
-    if (d[i])
-      t.push({ s: i, f: d[i] });
+  for (var i2 = 0; i2 < d.length; ++i2) {
+    if (d[i2])
+      t.push({ s: i2, f: d[i2] });
   }
   var s = t.length;
   var t2 = t.slice();
@@ -573,28 +2765,28 @@ var hTree = function(d, mb) {
     return a.f - b.f;
   });
   t.push({ s: -1, f: 25001 });
-  var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
+  var l = t[0], r = t[1], i0 = 0, i1 = 1, i22 = 2;
   t[0] = { s: -1, f: l.f + r.f, l, r };
   while (i1 != s - 1) {
-    l = t[t[i0].f < t[i2].f ? i0++ : i2++];
-    r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
+    l = t[t[i0].f < t[i22].f ? i0++ : i22++];
+    r = t[i0 != i1 && t[i0].f < t[i22].f ? i0++ : i22++];
     t[i1++] = { s: -1, f: l.f + r.f, l, r };
   }
   var maxSym = t2[0].s;
-  for (var i = 1; i < s; ++i) {
-    if (t2[i].s > maxSym)
-      maxSym = t2[i].s;
+  for (var i2 = 1; i2 < s; ++i2) {
+    if (t2[i2].s > maxSym)
+      maxSym = t2[i2].s;
   }
   var tr = new u16(maxSym + 1);
   var mbt = ln(t[i1 - 1], tr, 0);
   if (mbt > mb) {
-    var i = 0, dt = 0;
+    var i2 = 0, dt = 0;
     var lft = mbt - mb, cst = 1 << lft;
     t2.sort(function(a, b) {
       return tr[b.s] - tr[a.s] || a.f - b.f;
     });
-    for (; i < s; ++i) {
-      var i2_1 = t2[i].s;
+    for (; i2 < s; ++i2) {
+      var i2_1 = t2[i2].s;
       if (tr[i2_1] > mb) {
         dt += cst - (1 << mbt - tr[i2_1]);
         tr[i2_1] = mb;
@@ -603,14 +2795,14 @@ var hTree = function(d, mb) {
     }
     dt >>= lft;
     while (dt > 0) {
-      var i2_2 = t2[i].s;
+      var i2_2 = t2[i2].s;
       if (tr[i2_2] < mb)
         dt -= 1 << mb - tr[i2_2]++ - 1;
       else
-        ++i;
+        ++i2;
     }
-    for (; i >= 0 && dt; --i) {
-      var i2_3 = t2[i].s;
+    for (; i2 >= 0 && dt; --i2) {
+      var i2_3 = t2[i2].s;
       if (tr[i2_3] == mb) {
         --tr[i2_3];
         ++dt;
@@ -632,8 +2824,8 @@ var lc = function(c) {
   var w = function(v) {
     cl[cli++] = v;
   };
-  for (var i = 1; i <= s; ++i) {
-    if (c[i] == cln && i != s)
+  for (var i2 = 1; i2 <= s; ++i2) {
+    if (c[i2] == cln && i2 != s)
       ++cls;
     else {
       if (!cln && cls > 2) {
@@ -653,15 +2845,15 @@ var lc = function(c) {
       while (cls--)
         w(cln);
       cls = 1;
-      cln = c[i];
+      cln = c[i2];
     }
   }
   return { c: cl.subarray(0, cli), n: s };
 };
 var clen = function(cf, cl) {
   var l = 0;
-  for (var i = 0; i < cl.length; ++i)
-    l += cf[i] * cl[i];
+  for (var i2 = 0; i2 < cl.length; ++i2)
+    l += cf[i2] * cl[i2];
   return l;
 };
 var wfblk = function(out, pos, dat) {
@@ -671,8 +2863,8 @@ var wfblk = function(out, pos, dat) {
   out[o + 1] = s >> 8;
   out[o + 2] = out[o] ^ 255;
   out[o + 3] = out[o + 1] ^ 255;
-  for (var i = 0; i < s; ++i)
-    out[o + i + 4] = dat[i];
+  for (var i2 = 0; i2 < s; ++i2)
+    out[o + i2 + 4] = dat[i2];
   return (o + 4 + s) * 8;
 };
 var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
@@ -683,10 +2875,10 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
   var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
   var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
   var lcfreq = new u16(19);
-  for (var i = 0; i < lclt.length; ++i)
-    ++lcfreq[lclt[i] & 31];
-  for (var i = 0; i < lcdt.length; ++i)
-    ++lcfreq[lcdt[i] & 31];
+  for (var i2 = 0; i2 < lclt.length; ++i2)
+    ++lcfreq[lclt[i2] & 31];
+  for (var i2 = 0; i2 < lcdt.length; ++i2)
+    ++lcfreq[lcdt[i2] & 31];
   var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
   var nlcc = 19;
   for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
@@ -705,24 +2897,24 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
     wbits(out, p + 5, ndc - 1);
     wbits(out, p + 10, nlcc - 4);
     p += 14;
-    for (var i = 0; i < nlcc; ++i)
-      wbits(out, p + 3 * i, lct[clim[i]]);
+    for (var i2 = 0; i2 < nlcc; ++i2)
+      wbits(out, p + 3 * i2, lct[clim[i2]]);
     p += 3 * nlcc;
     var lcts = [lclt, lcdt];
     for (var it = 0; it < 2; ++it) {
       var clct = lcts[it];
-      for (var i = 0; i < clct.length; ++i) {
-        var len = clct[i] & 31;
+      for (var i2 = 0; i2 < clct.length; ++i2) {
+        var len = clct[i2] & 31;
         wbits(out, p, llm[len]), p += lct[len];
         if (len > 15)
-          wbits(out, p, clct[i] >> 5 & 127), p += clct[i] >> 12;
+          wbits(out, p, clct[i2] >> 5 & 127), p += clct[i2] >> 12;
       }
     }
   } else {
     lm = flm, ll = flt, dm = fdm, dl = fdt;
   }
-  for (var i = 0; i < li; ++i) {
-    var sym = syms[i];
+  for (var i2 = 0; i2 < li; ++i2) {
+    var sym = syms[i2];
     if (sym > 255) {
       var len = sym >> 18 & 31;
       wbits16(out, p, lm[len + 257]), p += ll[len + 257];
@@ -755,36 +2947,36 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
     var msk_1 = (1 << plvl) - 1;
     var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
     var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-    var hsh = function(i2) {
-      return (dat[i2] ^ dat[i2 + 1] << bs1_1 ^ dat[i2 + 2] << bs2_1) & msk_1;
+    var hsh = function(i3) {
+      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
     };
     var syms = new i32(25e3);
     var lf = new u16(288), df = new u16(32);
-    var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-    for (; i + 2 < s; ++i) {
-      var hv = hsh(i);
-      var imod = i & 32767, pimod = head[hv];
+    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i2 + 2 < s; ++i2) {
+      var hv = hsh(i2);
+      var imod = i2 & 32767, pimod = head[hv];
       prev[imod] = pimod;
       head[hv] = imod;
-      if (wi <= i) {
-        var rem = s - i;
+      if (wi <= i2) {
+        var rem = s - i2;
         if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
-          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
-          li = lc_1 = eb = 0, bs = i;
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
+          li = lc_1 = eb = 0, bs = i2;
           for (var j = 0; j < 286; ++j)
             lf[j] = 0;
           for (var j = 0; j < 30; ++j)
             df[j] = 0;
         }
         var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-        if (rem > 2 && hv == hsh(i - dif)) {
+        if (rem > 2 && hv == hsh(i2 - dif)) {
           var maxn = Math.min(n, rem) - 1;
-          var maxd = Math.min(32767, i);
+          var maxd = Math.min(32767, i2);
           var ml = Math.min(258, rem);
           while (dif <= maxd && --ch_1 && imod != pimod) {
-            if (dat[i + l] == dat[i + l - dif]) {
+            if (dat[i2 + l] == dat[i2 + l - dif]) {
               var nl = 0;
-              for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl)
+              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
                 ;
               if (nl > l) {
                 l = nl, d = dif;
@@ -793,7 +2985,7 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
                 var mmd = Math.min(dif, nl - 2);
                 var md = 0;
                 for (var j = 0; j < mmd; ++j) {
-                  var ti = i - dif + j & 32767;
+                  var ti = i2 - dif + j & 32767;
                   var pti = prev[ti];
                   var cd = ti - pti & 32767;
                   if (cd > md)
@@ -811,32 +3003,32 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
           eb += fleb[lin] + fdeb[din];
           ++lf[257 + lin];
           ++df[din];
-          wi = i + l;
+          wi = i2 + l;
           ++lc_1;
         } else {
-          syms[li++] = dat[i];
-          ++lf[dat[i]];
+          syms[li++] = dat[i2];
+          ++lf[dat[i2]];
         }
       }
     }
-    for (i = Math.max(i, wi); i < s; ++i) {
-      syms[li++] = dat[i];
-      ++lf[dat[i]];
+    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
+      syms[li++] = dat[i2];
+      ++lf[dat[i2]];
     }
-    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
     if (!lst) {
       st.r = pos & 7 | w[pos / 8 | 0] << 3;
       pos -= 7;
-      st.h = head, st.p = prev, st.i = i, st.w = wi;
+      st.h = head, st.p = prev, st.i = i2, st.w = wi;
     }
   } else {
-    for (var i = st.w || 0; i < s + lst; i += 65535) {
-      var e = i + 65535;
+    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
+      var e = i2 + 65535;
       if (e >= s) {
         w[pos / 8 | 0] = lst;
         e = s;
       }
-      pos = wfblk(w, pos + 1, dat.subarray(i, e));
+      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
     }
     st.i = s;
   }
@@ -844,11 +3036,11 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
 };
 var crct = /* @__PURE__ */ (function() {
   var t = new Int32Array(256);
-  for (var i = 0; i < 256; ++i) {
-    var c = i, k = 9;
+  for (var i2 = 0; i2 < 256; ++i2) {
+    var c = i2, k = 9;
     while (--k)
       c = (c & 1 && -306674912) ^ c >>> 1;
-    t[i] = c;
+    t[i2] = c;
   }
   return t;
 })();
@@ -857,8 +3049,8 @@ var crc = function() {
   return {
     p: function(d) {
       var cr = c;
-      for (var i = 0; i < d.length; ++i)
-        cr = crct[cr & 255 ^ d[i]] ^ cr >>> 8;
+      for (var i2 = 0; i2 < d.length; ++i2)
+        cr = crct[cr & 255 ^ d[i2]] ^ cr >>> 8;
       c = cr;
     },
     d: function() {
@@ -919,8 +3111,8 @@ try {
 function strToU8(str, latin1) {
   if (latin1) {
     var ar_1 = new u8(str.length);
-    for (var i = 0; i < str.length; ++i)
-      ar_1[i] = str.charCodeAt(i);
+    for (var i2 = 0; i2 < str.length; ++i2)
+      ar_1[i2] = str.charCodeAt(i2);
     return ar_1;
   }
   if (te)
@@ -931,19 +3123,19 @@ function strToU8(str, latin1) {
   var w = function(v) {
     ar[ai++] = v;
   };
-  for (var i = 0; i < l; ++i) {
+  for (var i2 = 0; i2 < l; ++i2) {
     if (ai + 5 > ar.length) {
-      var n = new u8(ai + 8 + (l - i << 1));
+      var n = new u8(ai + 8 + (l - i2 << 1));
       n.set(ar);
       ar = n;
     }
-    var c = str.charCodeAt(i);
+    var c = str.charCodeAt(i2);
     if (c < 128 || latin1)
       w(c);
     else if (c < 2048)
       w(192 | c >> 6), w(128 | c & 63);
     else if (c > 55295 && c < 57344)
-      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i2) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
     else
       w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
   }
@@ -1040,8 +3232,8 @@ function zipSync(data, opts) {
     tot += 76 + 2 * (s + exl) + (ms || 0) + l;
   }
   var out = new u8(tot + 22), oe = o, cdl = tot - o;
-  for (var i = 0; i < files.length; ++i) {
-    var f = files[i];
+  for (var i2 = 0; i2 < files.length; ++i2) {
+    var f = files[i2];
     wzh(out, f.o, f, f.f, f.u, f.c.length);
     var badd = 30 + f.f.length + exfl(f.extra);
     out.set(f.c, f.o + badd);
@@ -1535,8 +3727,7 @@ header {
 var DEMO_MANIFEST = {
   schema: 1,
   name: "Hello Marina",
-  icon: "\u26F5",
-  type: "static"
+  icon: "\u26F5"
 };
 
 // src/demo.ts
@@ -1561,20 +3752,24 @@ function packDemo() {
 }
 
 // src/login.ts
+init_config();
+init_api();
 import { createHash, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { hostname } from "node:os";
-var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var LOGIN_TIMEOUT_MS = 15 * 6e4;
 var PROGRESS_INTERVAL_MS = 1e3;
 var page = (title, message) => `<!doctype html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><meta name="color-scheme" content="light dark">
 <title>${title}</title><style>
-body{margin:0;display:grid;place-items:center;min-height:100vh;font:15px/1.5 system-ui,sans-serif;color:#142238;background:#faf9f7}
-main{text-align:center;padding:32px}h1{font-size:22px;margin:0 0 6px}p{margin:0;color:#667085}
+:root{color-scheme:light;--text:#142238;--muted:#667085;--background:#faf9f7}
+@media(prefers-color-scheme:dark){:root{color-scheme:dark;--text:#f2f4f7;--muted:#98a2b3;--background:#101828}}
+body{margin:0;display:grid;place-items:center;min-height:100vh;font:15px/1.5 system-ui,sans-serif;color:var(--text);background:var(--background)}
+main{text-align:center;padding:32px}h1{font-size:22px;margin:0 0 6px}p{margin:0;color:var(--muted)}
 </style></head><body><main><h1>${title}</h1><p>${message}</p></main></body></html>`;
-var closeLoginServer = (server) => new Promise((resolve2) => {
-  server.close(() => resolve2());
+var closeLoginServer = (server) => new Promise((resolve4) => {
+  server.close(() => resolve4());
   server.closeAllConnections();
 });
 function openBrowser(url) {
@@ -1592,7 +3787,7 @@ function timeoutLabel(timeoutMs) {
   return `${String(seconds)} second${seconds === 1 ? "" : "s"}`;
 }
 function waitForLoginCallback(server, expectedState, onProgress, timeoutMs = LOGIN_TIMEOUT_MS) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve4, reject) => {
     const startedAt = Date.now();
     const waiting = () => {
       const elapsedMs = Date.now() - startedAt;
@@ -1649,7 +3844,7 @@ function waitForLoginCallback(server, expectedState, onProgress, timeoutMs = LOG
       response.writeHead(200);
       response.end(
         page("Marina CLI is signed in", "You can close this window and return to the terminal."),
-        () => resolve2(code)
+        () => resolve4(code)
       );
     });
   });
@@ -1659,9 +3854,9 @@ async function loginWithBrowser(onOpen, onProgress = () => void 0) {
   const challenge = createHash("sha256").update(verifier).digest("base64url");
   const state = randomBytes(32).toString("base64url");
   const server = createServer();
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve4, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve2);
+    server.listen(0, "127.0.0.1", resolve4);
   });
   try {
     const address = server.address();
@@ -1685,65 +3880,18 @@ async function loginWithBrowser(onOpen, onProgress = () => void 0) {
   }
 }
 
-// src/output.ts
-var json = false;
-var setJsonMode = (on) => {
-  json = on;
-};
-var isJsonMode = () => json;
-var bold = (s) => `\x1B[1m${s}\x1B[22m`;
-var dim = (s) => `\x1B[2m${s}\x1B[22m`;
-var red = (s) => `\x1B[31m${s}\x1B[39m`;
-var green = (s) => `\x1B[32m${s}\x1B[39m`;
-function say(line = "") {
-  if (json) console.error(line);
-  else console.log(line);
-}
-function note(line) {
-  console.error(line);
-}
-function createProgress() {
-  let active = false;
-  let lastPhase = null;
-  let frame = 0;
-  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-  const interactive = process.stderr.isTTY === true && !json;
-  return {
-    update(phase, line) {
-      if (interactive) {
-        process.stderr.write(`\r\x1B[2K${frames[frame++ % frames.length]} ${line}`);
-        active = true;
-      } else if (phase !== lastPhase) {
-        console.error(json ? JSON.stringify({ type: "progress", phase, message: line }) : line);
-      }
-      lastPhase = phase;
-    },
-    clear() {
-      if (active) process.stderr.write("\r\x1B[2K");
-      active = false;
-    }
-  };
-}
-function result(payload) {
-  if (json) console.log(JSON.stringify({ schema_version: 1, ok: true, ...payload }, null, 2));
-}
-function failure(code, message, extra = {}) {
-  if (json)
-    console.log(
-      JSON.stringify({ schema_version: 1, ok: false, error: { code, message, ...extra } }, null, 2)
-    );
-  else {
-    console.error(`${red(code)} ${message}`);
-  }
-}
+// src/index.ts
+init_output();
 
 // src/pack.ts
-import { lstatSync, readFileSync as readFileSync2, readdirSync } from "node:fs";
-import { join as join2, relative } from "node:path";
+import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, readdirSync, realpathSync } from "node:fs";
+import { basename, dirname, join as join2, relative } from "node:path";
+var import_ignore = __toESM(require_ignore(), 1);
 var EXCLUDED_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".hg",
   ".svn",
+  ".marina",
   "node_modules",
   "bower_components",
   ".venv",
@@ -1759,23 +3907,74 @@ var EXCLUDED_DIRS = /* @__PURE__ */ new Set([
   "coverage",
   ".idea",
   ".vscode",
-  ".marina",
   "__MACOSX"
 ]);
 var EXCLUDED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
 var MAX_TOTAL = 100 * 1024 * 1024;
-var SECRET_FILE = /^(\.env(\.[^/]*)?|.*\.pem|.*\.p12|.*\.pfx|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials\.json|service-account\.json)$/i;
+var OUTPUT_DIR_NAMES = /* @__PURE__ */ new Set(["dist", "build", "out", ".output"]);
+function buildOutputParent(dir) {
+  let real;
+  try {
+    real = realpathSync(dir);
+  } catch {
+    return null;
+  }
+  if (!OUTPUT_DIR_NAMES.has(basename(dir)) && !OUTPUT_DIR_NAMES.has(basename(real))) return null;
+  if (!existsSync2(join2(real, "index.html"))) return null;
+  if (existsSync2(join2(real, "package.json")) || existsSync2(join2(real, "marina.json"))) return null;
+  for (const parent of /* @__PURE__ */ new Set([dirname(real), dirname(dir)])) {
+    if (parent === real || parent === dir) continue;
+    if (declaresBuild(parent)) return parent;
+  }
+  return null;
+}
+function declaresBuild(parent) {
+  try {
+    const parsed = JSON.parse(readFileSync2(join2(parent, "package.json"), "utf8"));
+    const build = parsed.scripts?.build;
+    return typeof build === "string" && build.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+var SECRET_FILE = /^(\.env(\.[^/]*)?|\.npmrc|.*\.pem|.*\.p12|.*\.pfx|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials\.json|service-account\.json)$/i;
+function ignoredBy(rules, path, directory) {
+  let ignored = false;
+  for (const rule of rules) {
+    const scopedPath = rule.base === "" ? path : path.startsWith(`${rule.base}/`) ? path.slice(rule.base.length + 1) : void 0;
+    if (!scopedPath) continue;
+    const result2 = rule.matcher.test(directory ? `${scopedPath}/` : scopedPath);
+    if (result2.ignored) ignored = true;
+    if (result2.unignored) ignored = false;
+  }
+  return ignored;
+}
 function pack(dir) {
   const files = {};
   const skippedSecrets = [];
   let totalBytes = 0;
-  const walk = (current) => {
+  const walk = (current, inheritedRules) => {
+    const currentRelative = relative(dir, current).replaceAll("\\", "/");
+    const rules = [...inheritedRules];
+    const gitignorePath = join2(current, ".gitignore");
+    if (existsSync2(gitignorePath)) {
+      const gitignoreStat = lstatSync(gitignorePath);
+      if (gitignoreStat.isFile() && !gitignoreStat.isSymbolicLink()) {
+        rules.push({
+          base: currentRelative,
+          matcher: (0, import_ignore.default)().add(readFileSync2(gitignorePath, "utf8"))
+        });
+      }
+    }
     for (const entry of readdirSync(current)) {
       const full = join2(current, entry);
       const stat = lstatSync(full);
       if (stat.isSymbolicLink()) continue;
+      const relativePath = relative(dir, full).replaceAll("\\", "/");
       if (stat.isDirectory()) {
-        if (!EXCLUDED_DIRS.has(entry)) walk(full);
+        if (!EXCLUDED_DIRS.has(entry) && !ignoredBy(rules, relativePath, true)) {
+          walk(full, rules);
+        }
         continue;
       }
       if (EXCLUDED_FILES.has(entry)) continue;
@@ -1783,27 +3982,28 @@ function pack(dir) {
         skippedSecrets.push(relative(dir, full));
         continue;
       }
+      if (ignoredBy(rules, relativePath, false)) continue;
       totalBytes += stat.size;
       if (totalBytes > MAX_TOTAL) {
         throw new Error(
           `this directory is over ${String(MAX_TOTAL / 1024 / 1024)} MB unpacked \u2014 trim it before deploying`
         );
       }
-      files[relative(dir, full).replaceAll("\\", "/")] = readFileSync2(full);
+      files[relativePath] = readFileSync2(full);
     }
   };
-  walk(dir);
+  walk(dir, []);
   const fileCount = Object.keys(files).length;
   if (fileCount === 0) throw new Error("nothing to deploy \u2014 this directory is empty");
   return { zip: zipSync(files), fileCount, totalBytes, skippedSecrets };
 }
 
 // src/manifest.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { basename, join as join3 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { basename as basename2, join as join3 } from "node:path";
 function readManifest(dir) {
   const path = join3(dir, "marina.json");
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   let value;
   try {
     value = JSON.parse(readFileSync3(path, "utf8"));
@@ -1824,7 +4024,7 @@ function readManifest(dir) {
     throw new Error('marina.json "icon" must be an emoji');
   }
   if (manifest.type !== void 0 && manifest.type !== "static" && manifest.type !== "dynamic") {
-    throw new Error('marina.json "type" must be "static" or "dynamic"');
+    throw new Error('marina.json "type" is obsolete; remove it and use "entrypoint" if needed');
   }
   return manifest;
 }
@@ -1839,16 +4039,16 @@ function resolveAppName(dir, flag, manifest = readManifest(dir), linkedName) {
   } catch {
   }
   if (linkedName?.trim()) return linkedName.trim();
-  return basename(dir);
+  return basename2(dir);
 }
 
 // src/skills.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join4 } from "node:path";
 
 // ../../skills/marina-deploy/SKILL.md
-var SKILL_default = '---\nname: marina-deploy\ndescription: Build, deploy, inspect, and recover applications on Marina Cloud with the Marina CLI. Use when a user asks to publish a project to Marina, create a first Marina demo, check whether a Marina deployment is live, diagnose a failed or refused deploy, inspect versions, or roll an app back.\n---\n\n# Marina Deploy\n\nUse the Marina CLI to deploy the user\'s project. Run commands with `--json` and\nfollow the returned result until the app is live.\n\n## Deploy\n\n1. Inspect the project and run its relevant local checks.\n2. Install the CLI if needed: `npm install -g @marina-cloud/cli`.\n3. If unauthenticated, run `marina setup` and let the user finish browser sign-in.\n4. Run `marina deploy --json` from the project directory.\n5. Return the live URL only when the result has `ok: true`, `state: "published"`,\n   `live: true`, and a non-null `url`.\n\nIf it returns a failure or refusal, use the returned message and build log to\nfix the project, verify it locally, and retry. Never bypass a refusal or\ndescribe an unpublished or failed version as live.\n\n## Create a demo\n\nFor a first demo, run `marina deploy demo --json`. This deploys the bundled\nHello Marina collage app directly. Treat it like any other deploy: return its\nURL only after the result says it is published and live.\n\n## Inspect or recover\n\n```sh\nmarina status --app <slug> --json\nmarina deploys --app <slug> --json\nmarina versions --app <slug> --json\nmarina rollback --app <slug> --to <hash> --json\n```\n\nIdentify the intended published version before rolling back, then confirm the\nresult with `marina status --json`.\n';
+var SKILL_default = "---\nname: marina-deploy\ndescription: Build, deploy, inspect, and recover applications on Marina Cloud with the Marina CLI. Use when a user asks to publish a project to Marina, create a first Marina demo, check whether a Marina deployment is live, diagnose a failed or refused deploy, inspect versions, or roll an app back.\n---\n\n# Marina Deploy\n\nUse the Marina CLI to deploy the user's project. Run commands with `--json` and\nfollow the returned result until the app is live.\n\n## Deploy\n\n1. Inspect the project and run its relevant local checks.\n2. Install the CLI if needed: `npm install -g @marina-cloud/cli`.\n3. If unauthenticated, run `marina setup` and let the user finish browser sign-in.\n4. Run `marina deploy --json` from the project directory.\n5. Return the live URL only when the result has `ok: true`, `state: \"published\"`,\n   `live: true`, and a non-null `url`.\n\nIf it returns a failure or refusal, use the returned message and build log to\nfix the project, verify it locally, and retry. Never bypass a refusal or\ndescribe an unpublished or failed version as live.\n\nMarina may recover an ambiguous or failed static build through its publishing\nagent. Inspect the returned `preparation` report and `build_log`: the agent can\nminimally repair and retry the build. Marina requires a successful build and\nmechanically verified output before publication.\n\nStatic source detection is deterministic: a non-empty `scripts.build` wins\nover root `index.html`; without a build script, root `index.html` is served\nas-is. Deploy the project root and let Marina build it. A finished output\ndirectory (for example, `marina deploy dist`) is refused when it belongs to a\nproject that declares a build; deploy that project's source instead.\n\nEvery accepted upload returns a `deploy_id`, including a first deploy refused\nbefore an app exists. Inspect that durable attempt with:\n\n```sh\nmarina deploys <deploy-id> --json\n```\n\nAn archive or security refusal may have a null `build_log` because no build was\nrun; the refusal and action are still preserved on the deploy attempt.\n\n## Develop locally\n\n`marina dev` runs the app on this machine with the production runtime\ncontract: local storage and an embedded Postgres (the app's\n`marina/migrations` apply on start), while `marina.capabilities` and\n`marina.connections` calls bridge to Marina under the signed-in user's\ndev-scoped grants. A denied bridged call names the missing grant \u2014 an\norganization admin adds it from the connection's Dev access control. Use\n`--port <port>` to change the listen port and `--schedules` to run scheduled\njobs locally. `marina.ai` bridges too; per-developer usage is metered.\n\n## Create a demo\n\nFor a first demo, run `marina deploy demo --json`. This deploys the bundled\nHello Marina collage app directly. Treat it like any other deploy: return its\nURL only after the result says it is published and live.\n\n## Inspect or recover\n\n```sh\nmarina status --app <slug> --json\nmarina deploys --app <slug> --json\nmarina deploys <deploy-id> --json\nmarina logs --app <slug>\nmarina versions --app <slug> --json\nmarina rollback --app <slug> --to <hash> --json\n```\n\n`marina logs` always returns structured JSON. Use it to inspect deployment\nevents, runtime invocations, console output, and exceptions. Follow\n`next_cursor` when older entries are needed.\n\nIdentify the intended published version before rolling back, then confirm the\nresult with `marina status --json`.\n";
 
 // ../../skills/marina-deploy/agents/openai.yaml
 var openai_default = 'interface:\n  display_name: "Marina Deploy"\n  short_description: "Build and deploy apps to Marina Cloud"\n  default_prompt: "Use $marina-deploy to deploy this project to Marina Cloud."\n';
@@ -1870,7 +4070,7 @@ function targets(agent) {
     }));
   }
   if (agent === "codex" || agent === "claude") return [{ agent, home: agentHomes[agent] }];
-  return Object.entries(agentHomes).filter(([, home]) => existsSync3(home)).map(([name, home]) => ({ agent: name, home }));
+  return Object.entries(agentHomes).filter(([, home]) => existsSync4(home)).map(([name, home]) => ({ agent: name, home }));
 }
 function install(target, update) {
   const directory = join4(target.home, "skills", "marina-deploy");
@@ -1907,11 +4107,13 @@ function installSkills(agent) {
 }
 
 // src/update.ts
+init_package();
+init_config();
 var NAG_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var parseVersion = (version) => version.replace(/^v/, "").split("-", 1)[0].split(".").map((part) => Number.parseInt(part, 10));
 function isNewerVersion(candidate, current) {
-  const parse = (version) => version.replace(/^v/, "").split("-", 1)[0].split(".").map((part) => Number.parseInt(part, 10));
-  const left = parse(candidate);
-  const right = parse(current);
+  const left = parseVersion(candidate);
+  const right = parseVersion(current);
   if (left.some(Number.isNaN) || right.some(Number.isNaN)) return false;
   for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
     const difference = (left[index] ?? 0) - (right[index] ?? 0);
@@ -1941,7 +4143,7 @@ async function availableUpdate() {
 // src/index.ts
 var HELP = `${bold("marina")} \u2014 deploy internal apps
 
-  marina setup                   sign in with Clerk in your browser
+  marina setup                   sign in through Marina in your browser
       --skills                   install the Marina deployment skill
       --deploy-demo              deploy Hello Marina after signing in
   marina logout                  remove the saved credential
@@ -1954,11 +4156,17 @@ var HELP = `${bold("marina")} \u2014 deploy internal apps
       --app <slug>               deploy into an existing app
   marina status [--app <slug>]   what is live, and how the last deploy went
   marina deploys [--app <slug>]  recent deploy attempts, including refusals
+  marina deploys <deploy-id>     inspect one attempt, even before an app exists
+  marina logs [--app <slug>]     structured JSON runtime invocations, console output, and errors
+      --level <level>            debug, info, log, warn, or error
+      --limit <count>            1\u2013200 entries (default: 100)
+      --cursor <cursor>          continue from a prior result
   marina versions [--app <slug>] version history
   marina rollback [--to <hash>]  publish a previous version again
-  marina secrets                 list env vars and secrets for the app
-  marina secrets set K=V         set one (--plain for a non-secret var)
-  marina secrets rm K            remove one
+  marina dev [dir]               run this app locally against Marina
+      --port <port>              listen port (default: 5990)
+      --schedules                run scheduled jobs on their local timers
+  marina ai models               models marina.ai can generate with, and who pays
   marina list                    apps in your workspace
   marina open                    open this project's app
 
@@ -1966,7 +4174,7 @@ var HELP = `${bold("marina")} \u2014 deploy internal apps
 var ANSI_ESCAPE = new RegExp(`${String.fromCodePoint(27)}\\[[0-9;]*m`, "g");
 var shouldCheckForUpdates = false;
 function targetApp(flag) {
-  const linked = readLink(resolve("."))?.app;
+  const linked = readLink(resolve3("."))?.app;
   const app = flag ?? linked;
   if (!app) {
     failure("no_app", "no app here \u2014 pass --app <slug>, or deploy from a linked project");
@@ -1975,6 +4183,15 @@ function targetApp(flag) {
   return app;
 }
 var shortDigest = (digest) => digest?.slice(7, 14) ?? "\u2014";
+function deployAttemptHint(deployId, hasBuildLog) {
+  if (isJsonMode()) return;
+  const command = `marina deploys ${terminalSafeText(deployId)} --json`;
+  note(
+    dim(
+      `${hasBuildLog ? "build log omitted from terminal; " : ""}retrieve structured JSON with: ${command}`
+    )
+  );
+}
 async function deploy(dirArg, flags, emitResult = true) {
   let dir = null;
   let link = null;
@@ -1989,20 +4206,32 @@ async function deploy(dirArg, flags, emitResult = true) {
     packed = packDemo();
     name = flags.name?.trim() || DEMO_MANIFEST.name;
   } else {
-    dir = resolve(dirArg ?? ".");
+    dir = resolve3(dirArg ?? ".");
     link = readLink(dir);
     target = flags.app ?? link?.app;
     const manifest = readManifest(dir);
     name = resolveAppName(dir, flags.name, manifest, link?.name);
+    const builtFrom = buildOutputParent(dir);
+    if (builtFrom) {
+      const refusal = {
+        code: "prebuilt_output",
+        message: `${dir} looks like the build output of ${builtFrom}, not source.`,
+        action: "Deploy the project root; Marina runs the build itself."
+      };
+      failure("refused", refusal.message, { refusal });
+      if (!isJsonMode()) note(`        ${terminalSafeText(refusal.action)}`);
+      process.exit(3);
+    }
     packed = pack(dir);
   }
-  for (const secret of packed.skippedSecrets) say(dim(`skipped ${secret} \u2014 secrets stay local`));
+  for (const secret of packed.skippedSecrets)
+    say(dim(`skipped ${secret} \u2014 credential files are never deployed`));
   const progress = createProgress();
   const size = `${String(packed.fileCount)} files, ${String(Math.round(packed.totalBytes / 1024))} KB`;
   progress.update("uploading", `Uploading ${name} (${size})`);
   let started;
   try {
-    started = await startDeploy(packed.zip, name, target);
+    started = await startDeploy(packed.zip, name, target, link?.base_revision);
   } catch (error) {
     progress.clear();
     if (error instanceof ApiError && error.code === "not_found" && link) {
@@ -2020,32 +4249,43 @@ async function deploy(dirArg, flags, emitResult = true) {
     deployed = await pollDeploy(started.id, (current) => {
       if (current.status !== "queued" && current.status !== "building") return;
       const elapsed = Math.max(1, Math.round((Date.now() - deployedAt) / 1e3));
-      const message = current.status === "queued" ? `Waiting for a deploy worker (${String(elapsed)}s)` : `Building and verifying (${String(elapsed)}s)`;
+      const message = current.build_message ? `${terminalSafeText(current.build_message)} (${String(elapsed)}s)` : current.status === "queued" ? `Waiting for a deploy worker (${String(elapsed)}s)` : `Building and verifying (${String(elapsed)}s)`;
       progress.update(current.status, message);
     });
   } finally {
     progress.clear();
   }
   if (deployed.status === "refused" && deployed.refusal) {
-    say(`${red("refused")} ${deployed.refusal.message}`);
-    if (deployed.refusal.action) say(`        ${deployed.refusal.action}`);
-    if (deployed.build_log) {
-      say(dim("---- build log (tail) ----"));
-      say(dim(deployed.build_log.split("\n").slice(-20).join("\n")));
-    }
     failure("refused", deployed.refusal.message, {
+      deploy_id: deployed.id,
       refusal: deployed.refusal,
-      build_log: deployed.build_log
+      build_log: deployed.build_log,
+      build_phase: deployed.build_phase,
+      build_message: deployed.build_message
     });
+    if (!isJsonMode() && deployed.refusal.action) {
+      note(`        ${terminalSafeText(deployed.refusal.action)}`);
+    }
+    deployAttemptHint(deployed.id, deployed.build_log !== null);
     process.exit(3);
   }
   if (deployed.status === "failed") {
-    failure("failed", deployed.error ?? "unknown error");
+    failure("failed", deployed.error ?? "unknown error", {
+      deploy_id: deployed.id,
+      build_log: deployed.build_log,
+      build_phase: deployed.build_phase,
+      build_message: deployed.build_message
+    });
+    deployAttemptHint(deployed.id, deployed.build_log !== null);
     process.exit(1);
   }
   const slug = deployed.app_slug ?? "";
-  if (dir && (!link || link.app !== slug || link.name !== name)) {
-    writeLink(dir, { app: slug, name });
+  if (dir && (!link || link.app !== slug || link.name !== name || link.base_revision !== (deployed.source_revision ?? void 0))) {
+    writeLink(dir, {
+      app: slug,
+      name,
+      ...deployed.source_revision ? { base_revision: deployed.source_revision } : {}
+    });
   }
   const published = deployed.version_state === "published";
   say(
@@ -2067,11 +4307,13 @@ async function deploy(dirArg, flags, emitResult = true) {
   const payload = {
     command: "deploy",
     status: "succeeded",
+    deploy_id: deployed.id,
     app: slug,
     version: deployed.version_number,
     state: deployed.version_state,
     url: deployed.url,
     version_url: deployed.version_url,
+    build_log: deployed.build_log,
     preparation: deployed.preparation,
     live: published,
     demo: dirArg === "demo"
@@ -2081,15 +4323,16 @@ async function deploy(dirArg, flags, emitResult = true) {
 }
 async function status(appFlag) {
   const app = targetApp(appFlag);
-  const [detail, deploys2] = await Promise.all([getApp(app), listDeploys(app, 1)]);
-  const last = deploys2[0];
+  const [detail, history] = await Promise.all([getApp(app), listDeploys(app, 1)]);
+  const last = history[0];
   say(`${bold(detail.app.name)} ${dim(`(${detail.app.slug})`)}`);
   say(`  ${detail.app.current_version_id ? green(detail.app.status) : dim("nothing published")}`);
   if (detail.app.current_version_id) say(`  ${detail.url}`);
   if (detail.app.archived_at) say(`  ${red("archived")} \u2014 it isn't serving`);
   if (last) {
     const outcome = last.status === "succeeded" ? green("succeeded") : last.status === "queued" || last.status === "building" ? last.status : red(last.status);
-    say(`  last deploy: ${outcome}${last.refusal ? ` \u2014 ${last.refusal.message}` : ""}`);
+    const version = last.version_number == null ? "" : ` v${String(last.version_number)}`;
+    say(`  last deploy: ${outcome}${version}${last.refusal ? ` \u2014 ${last.refusal.message}` : ""}`);
   }
   result({
     command: "status",
@@ -2102,17 +4345,55 @@ async function status(appFlag) {
     last_deploy: last ?? null
   });
 }
-async function deploys(appFlag) {
+function deployOutcome(attempt) {
+  return attempt.refusal?.message ?? attempt.error ?? attempt.status;
+}
+async function deploys(appFlag, deployId) {
+  if (deployId) {
+    const attempt = await getDeploy(deployId);
+    const mark = attempt.status === "succeeded" ? green("ok") : red(attempt.status);
+    say(`${mark} ${dim(attempt.id)} \u2014 ${terminalSafeText(deployOutcome(attempt))}`);
+    if (attempt.build_log) deployAttemptHint(attempt.id, true);
+    result({ command: "deploys.show", deploy: attempt });
+    return;
+  }
   const app = targetApp(appFlag);
   const rows = await listDeploys(app);
   if (rows.length === 0) say("no deploys yet");
   for (const row of rows) {
     const mark = row.status === "succeeded" ? green("ok") : red(row.status);
-    const why = row.refusal ? ` \u2014 ${row.refusal.message}` : row.error ? ` \u2014 ${row.error}` : "";
-    say(`${mark}  ${dim(row.created_at)} ${dim(`via ${row.source}`)}${why}`);
+    const why = row.refusal ? ` \u2014 ${terminalSafeText(row.refusal.message)}` : row.error ? ` \u2014 ${terminalSafeText(row.error)}` : "";
+    const version = row.version_number == null ? "" : ` v${String(row.version_number)}`;
+    say(`${mark}${version}  ${dim(row.created_at)} ${dim(`via ${row.source}`)}${why}`);
   }
+  const failedWithLog = rows.find((row) => row.status !== "succeeded" && row.build_log);
+  if (failedWithLog) deployAttemptHint(failedWithLog.id, true);
   result({ command: "deploys", app, deploys: rows });
 }
+var LOG_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "log", "warn", "error"]);
+async function logs(appFlag, flags) {
+  const app = targetApp(appFlag);
+  const parsedLimit = flags.limit === void 0 ? 100 : Number(flags.limit);
+  if (!Number.isInteger(parsedLimit) || parsedLimit < 1 || parsedLimit > 200) {
+    failure("invalid_input", "--limit must be an integer from 1 to 200");
+    process.exit(1);
+  }
+  if (flags.level && !LOG_LEVELS.has(flags.level)) {
+    failure("invalid_input", "--level must be debug, info, log, warn, or error");
+    process.exit(1);
+  }
+  const response = await listRuntimeLogs(app, {
+    limit: parsedLimit,
+    cursor: flags.cursor,
+    level: flags.level
+  });
+  result({
+    command: "logs",
+    app,
+    logs: response.logs,
+    next_cursor: response.nextCursor
+  });
+}
 async function versions(appFlag) {
   const app = targetApp(appFlag);
   const [rows, detail] = await Promise.all([listVersions(app), getApp(app)]);
@@ -2154,40 +4435,6 @@ async function rollback(appFlag, to) {
     url: detail.url
   });
 }
-async function secrets(appFlag, argv, plain) {
-  const app = targetApp(appFlag);
-  const [action, argument] = argv;
-  if (action === "set") {
-    const eq = argument?.indexOf("=") ?? -1;
-    if (!argument || eq < 1) {
-      failure("invalid_input", "usage: marina secrets set KEY=value");
-      process.exit(1);
-    }
-    const key = argument.slice(0, eq);
-    await setEnv(app, key, argument.slice(eq + 1), !plain);
-    say(`${green("ok")} set ${bold(key)}${plain ? "" : dim(" (secret)")}`);
-    result({ command: "secrets.set", app, key, kind: plain ? "plain" : "secret" });
-    return;
-  }
-  if (action === "rm") {
-    if (!argument) {
-      failure("invalid_input", "usage: marina secrets rm KEY");
-      process.exit(1);
-    }
-    await deleteEnv(app, argument);
-    say(`${green("ok")} removed ${bold(argument)}`);
-    result({ command: "secrets.rm", app, key: argument, removed: true });
-    return;
-  }
-  const rows = await listEnv(app);
-  if (rows.length === 0) say("nothing set");
-  for (const row of rows) {
-    say(
-      `${bold(row.key)}  ${row.kind === "secret" ? dim("secret \u2014 write-only") : row.value ?? ""}`
-    );
-  }
-  result({ command: "secrets.list", app, env: rows });
-}
 async function main() {
   setJsonMode(process.argv.slice(2).includes("--json"));
   const { positionals, values } = parseArgs({
@@ -2196,16 +4443,21 @@ async function main() {
       name: { type: "string" },
       app: { type: "string" },
       to: { type: "string" },
-      plain: { type: "boolean" },
+      level: { type: "string" },
+      limit: { type: "string" },
+      cursor: { type: "string" },
       agent: { type: "string" },
+      port: { type: "string" },
+      schedules: { type: "boolean" },
+      dir: { type: "string" },
       skills: { type: "boolean" },
       "deploy-demo": { type: "boolean" },
       json: { type: "boolean" },
       help: { type: "boolean", short: "h" }
     }
   });
-  setJsonMode(values.json === true);
   const command = positionals[0];
+  setJsonMode(values.json === true || command === "logs");
   if (values.help || !command) {
     say(HELP);
     result({ command: "help", usage: HELP.replaceAll(ANSI_ESCAPE, "") });
@@ -2276,6 +4528,20 @@ async function main() {
       });
       return;
     }
+    case "dev": {
+      const { runDev: runDev2 } = await Promise.resolve().then(() => (init_dev(), dev_exports));
+      try {
+        await runDev2({
+          dir: values.dir ?? positionals[1],
+          port: values.port,
+          schedules: values.schedules === true
+        });
+      } catch (error) {
+        failure("dev_failed", error.message);
+        process.exitCode = 1;
+      }
+      return;
+    }
     case "profile": {
       const profile = readProfile();
       const source = process.env.MARINA_TOKEN ? "environment" : profile.token ? "profile" : null;
@@ -2302,6 +4568,23 @@ async function main() {
       result({ command: "skills.install", skills: installed });
       return;
     }
+    case "ai": {
+      if (positionals[1] !== "models") {
+        failure("invalid_input", "usage: marina ai models");
+        process.exit(1);
+      }
+      const view = await aiModels();
+      say(`${bold("fast")}   ${view.aliases.fast ?? dim("(broker unreachable)")}`);
+      say(`${bold("smart")}  ${view.aliases.smart ?? dim("(broker unreachable)")}`);
+      if (view.models.length === 0) {
+        say(dim("no library models offered on this deployment"));
+      }
+      for (const model of view.models) say(`  ${model}`);
+      const billing = view.billing === "workspace" ? "generations bill this workspace's OpenRouter account (BYOK)" : view.billing === "platform" ? "generations bill Marina's platform key \u2014 connect OpenRouter to use your own" : "no AI billing key: connect OpenRouter in Settings \u2192 Connections";
+      say(dim(billing));
+      result({ command: "ai.models", ...view });
+      return;
+    }
     case "deploy":
       await deploy(positionals[1], values);
       return;
@@ -2310,7 +4593,10 @@ async function main() {
       return;
     case "deploys":
     case "deployments":
-      await deploys(values.app);
+      await deploys(values.app, positionals[1]);
+      return;
+    case "logs":
+      await logs(values.app, values);
       return;
     case "versions":
       await versions(values.app);
@@ -2318,9 +4604,6 @@ async function main() {
     case "rollback":
       await rollback(values.app, values.to);
       return;
-    case "secrets":
-      await secrets(values.app, positionals.slice(1), values.plain === true);
-      return;
     case "list": {
       const apps = await listApps();
       if (apps.length === 0) say("no apps yet \u2014 `marina deploy` one");