@vendoai/vendo 0.4.0 → 0.4.2

package/dist/cli/cloud/device-login.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { join } from "node:path";
-import { option, positionals } from "./args.js";
+import { option } from "./args.js";
 import { isVendoKey, resolveCloudBaseUrl } from "./client.js";
 import { errorMessage, printJson } from "./output.js";
 import { deletePendingClaim, readPendingClaim, writePendingClaim } from "./pending-claim.js";
@@ -91,13 +91,16 @@ export async function runDeviceLogin(args, options = {}) {
     const waitSeconds = waitRaw !== undefined && /^\d+$/.test(waitRaw) ? Number(waitRaw) : undefined;
     const waitMs = waitSeconds === undefined ? undefined : waitSeconds * 1000;
     const pendingHome = options.home === undefined ? {} : { home: options.home };
+    const claimCwd = options.root ?? process.cwd();
     try {
         // A still-open claim from a dead process (#479): resume polling it so the
         // human's late approval — against the code they were already shown —
-        // still lands the key. An expired or unreadable file is discarded (a
-        // fresh ceremony overwrites it below).
-        const pending = await readPendingClaim(pendingHome);
-        const resume = pending !== null && pending.api_url === base && pending.expires_at > now()
+        // still lands the key. Claims are scoped per project directory (0.4.2):
+        // only THIS cwd's ceremony is ever resumed, so concurrent logins in other
+        // repos neither clobber this one nor get resumed by it. An expired or
+        // unreadable file is discarded (a fresh ceremony overwrites it below).
+        const pending = await readPendingClaim(claimCwd, pendingHome);
+        const resume = pending !== null && pending.api_url === base && pending.cwd === claimCwd && pending.expires_at > now()
             ? pending
             : null;
         let claimToken;
@@ -118,9 +121,11 @@ export async function runDeviceLogin(args, options = {}) {
             verificationUriComplete = resume.verification_uri_complete;
         }
         else {
-            // Optional email hint — shown to the human on the approval page.
-            const email = option(args, "--email") ?? positionals(args, ["--api-url", "--email", "--wait"])[0];
-            const claim = await postJson(fetchImpl, `${base}${CLAIM_PATH}`, "application/json", JSON.stringify(email === undefined ? {} : { login_hint: email }));
+            // No identity hint by design: the human signs in as whoever they choose
+            // on the approval page. A guessed login_hint (git email, positional arg)
+            // is an assumption that mis-attributes the claim, so the ceremony never
+            // sends one.
+            const claim = await postJson(fetchImpl, `${base}${CLAIM_PATH}`, "application/json", "{}");
             if (claim.status !== 200) {
                 const envelope = claim.body;
                 throw new Error(typeof envelope?.error?.message === "string"
@@ -172,7 +177,7 @@ export async function runDeviceLogin(args, options = {}) {
                     throw new Error("Vendo Cloud returned an invalid credential");
                 }
                 await upsertEnvLocal(root, "VENDO_API_KEY", key);
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 // Never print the key itself — .env.local is the hand-off, last4 the
                 // receipt. A resumed run names the full path: it may differ from cwd.
                 output.log(`Approved — wrote VENDO_API_KEY (…${key.slice(-4)}) to ${resume !== null ? join(root, ".env.local") : ".env.local"}.`);
@@ -188,11 +193,11 @@ export async function runDeviceLogin(args, options = {}) {
             if (error === "slow_down")
                 return "slow_down"; // RFC 8628 §3.5
             if (error === "expired_token") {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("The code expired before it was approved; run `vendo login` again.");
             }
             if (error === "access_denied") {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("Your human denied the request — no key was minted.");
             }
             // Any other token error is terminal for THIS claim (invalid_grant =
@@ -200,7 +205,7 @@ export async function runDeviceLogin(args, options = {}) {
             // again). Delete the pending file so the next `vendo login` opens a
             // fresh claim instead of resuming into the same error forever — the
             // exact trap a live install hit.
-            await deletePendingClaim(pendingHome);
+            await deletePendingClaim(claimCwd, pendingHome);
             const description = poll.body?.error_description;
             throw new Error(typeof description === "string"
                 ? description
@@ -228,7 +233,7 @@ export async function runDeviceLogin(args, options = {}) {
                 if (result === "slow_down")
                     intervalMs += 5000;
             }
-            await deletePendingClaim(pendingHome);
+            await deletePendingClaim(claimCwd, pendingHome);
             throw new Error("The code expired before it was approved; run `vendo login` again.");
         }
         // Bounded budget: poll immediately, then pace by interval, stopping at
@@ -241,7 +246,7 @@ export async function runDeviceLogin(args, options = {}) {
             if (result === "slow_down")
                 intervalMs += 5000;
             if (now() >= deadline) {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("The code expired before it was approved; run `vendo login` again.");
             }
             if (now() >= pollDeadline)

package/dist/cli/cloud/pending-claim.d.ts

@@ -23,7 +23,10 @@ export interface PendingClaimOptions {
     home?: string;
 }
 /** An unreadable or malformed file reads as "no pending claim" — the caller
-    discards it by opening (and persisting) a fresh ceremony. */
-export declare function readPendingClaim(options?: PendingClaimOptions): Promise<PendingClaim | null>;
+    discards it by opening (and persisting) a fresh ceremony. Only a claim
+    opened for THIS cwd is ever returned. A pre-0.4.2 machine-global file is
+    honored (and migrated) only when its recorded cwd matches; someone else's
+    ceremony is never resumed. */
+export declare function readPendingClaim(cwd: string, options?: PendingClaimOptions): Promise<PendingClaim | null>;
 export declare function writePendingClaim(claim: PendingClaim, options?: PendingClaimOptions): Promise<void>;
-export declare function deletePendingClaim(options?: PendingClaimOptions): Promise<void>;
+export declare function deletePendingClaim(cwd: string, options?: PendingClaimOptions): Promise<void>;

package/dist/cli/cloud/pending-claim.js

@@ -1,7 +1,17 @@
+import { createHash } from "node:crypto";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-function pendingClaimPath(options = {}) {
+/** Claims are keyed by the project directory they were opened for. A single
+    machine-global file let two concurrent `vendo login` runs clobber each
+    other, and let project A resume (and receive the key for) project B's
+    ceremony — found by the 0.4.1 E2E certification campaign. */
+function pendingClaimPath(cwd, options = {}) {
+    const name = `${createHash("sha256").update(cwd).digest("hex").slice(0, 16)}.json`;
+    return join(options.home ?? homedir(), ".vendo", "pending-claims", name);
+}
+/** The pre-0.4.2 machine-global location — read once for migration. */
+function legacyPendingClaimPath(options = {}) {
     return join(options.home ?? homedir(), ".vendo", "pending-claim.json");
 }
 function isPendingClaim(value) {
@@ -16,23 +26,37 @@ function isPendingClaim(value) {
         && typeof claim.api_url === "string"
         && typeof claim.cwd === "string";
 }
-/** An unreadable or malformed file reads as "no pending claim" — the caller
-    discards it by opening (and persisting) a fresh ceremony. */
-export async function readPendingClaim(options = {}) {
+async function readClaimFile(path) {
     try {
-        const value = JSON.parse(await readFile(pendingClaimPath(options), "utf8"));
+        const value = JSON.parse(await readFile(path, "utf8"));
         return isPendingClaim(value) ? value : null;
     }
     catch {
         return null;
     }
 }
+/** An unreadable or malformed file reads as "no pending claim" — the caller
+    discards it by opening (and persisting) a fresh ceremony. Only a claim
+    opened for THIS cwd is ever returned. A pre-0.4.2 machine-global file is
+    honored (and migrated) only when its recorded cwd matches; someone else's
+    ceremony is never resumed. */
+export async function readPendingClaim(cwd, options = {}) {
+    const scoped = await readClaimFile(pendingClaimPath(cwd, options));
+    if (scoped !== null)
+        return scoped.cwd === cwd ? scoped : null;
+    const legacy = await readClaimFile(legacyPendingClaimPath(options));
+    if (legacy === null || legacy.cwd !== cwd)
+        return null;
+    await writePendingClaim(legacy, options);
+    await rm(legacyPendingClaimPath(options), { force: true });
+    return legacy;
+}
 export async function writePendingClaim(claim, options = {}) {
-    const path = pendingClaimPath(options);
+    const path = pendingClaimPath(claim.cwd, options);
     await mkdir(join(path, ".."), { recursive: true, mode: 0o700 });
     await writeFile(path, `${JSON.stringify(claim, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
     await chmod(path, 0o600);
 }
-export async function deletePendingClaim(options = {}) {
-    await rm(pendingClaimPath(options), { force: true });
+export async function deletePendingClaim(cwd, options = {}) {
+    await rm(pendingClaimPath(cwd, options), { force: true });
 }

package/dist/cli/init.d.ts

@@ -4,6 +4,7 @@ import { type AiExtractionOptions } from "./extract/extraction.js";
 import { type DevCredential } from "../dev-creds/resolve.js";
 import { type HostFramework } from "./framework.js";
 import { type AuthPresetName } from "./init-auth.js";
+import { type InstallRunner } from "./provider-deps.js";
 import { type SelectOption } from "./pretty.js";
 import { type ThemeSummary } from "./theme/extract-theme.js";
 import { type Output } from "./shared.js";
@@ -76,6 +77,8 @@ export interface InitOptions {
     resolveCredential?: (options: {
         env: Record<string, string | undefined>;
     }) => Promise<DevCredential>;
+    /** Test seam: the provider-dependency install subprocess (provider-deps.ts). */
+    installProvider?: InstallRunner;
     /** Test seam (ENG-339): cloud-in-init step overrides. */
     cloud?: Partial<Omit<CloudStepOptions, "root" | "output" | "yes" | "credential">>;
     /** Test seam: AI extraction step overrides (harnesses, consent). */

package/dist/cli/init.js

@@ -14,6 +14,7 @@ import { BRIEF_TEMPLATE } from "./extract/stages.js";
 import { ENV_KEY_VARS, resolveDevCredential, describeDevCredential } from "../dev-creds/resolve.js";
 import { detectFramework, detectVendoWiring } from "./framework.js";
 import { resolveScaffoldAuth } from "./init-auth.js";
+import { ensureProviderDeps } from "./provider-deps.js";
 import { expressServerSource, registrySource, routeSource, serverActionsModuleSource, VENDO_ENV_EXAMPLE, wiringServerActions, } from "./init-scaffolds.js";
 import { createPrettyOutput, plainSelect, usePrettyOutput } from "./pretty.js";
 import { contrastingText } from "./theme/color.js";
@@ -927,6 +928,16 @@ export async function runInit(options) {
             wiringMs,
             ...(await cloudProjectProps(root)),
         });
+        // The credential's runtime provider must be resolvable from the host or
+        // the FIRST turn 500s (dev-creds/model.ts loads it host-side; nothing
+        // declares @ai-sdk/* — 0.4.1 E2E cert finding). Install exactly what the
+        // resolved credential needs; a failure degrades to the manual command.
+        await ensureProviderDeps({
+            root,
+            credential,
+            output,
+            ...(options.installProvider === undefined ? {} : { run: options.installProvider }),
+        });
         // The one short Cloud reminder in the end-of-run summary — ONLY while no
         // key exists (the full emphasized block already ran up top; no repeat).
         if (credential.rung === "none") {

package/dist/cli/provider-deps.d.ts

@@ -0,0 +1,26 @@
+import type { DevCredential } from "../dev-creds/resolve.js";
+import type { Output } from "./shared.js";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export declare function providerModuleFor(credential: DevCredential): {
+    module: string;
+    spec: string;
+} | null;
+/** Lockfile-sniffed installer; npm is the fallback. */
+export declare function installCommandFor(root: string): Promise<{
+    command: string;
+    args: string[];
+}>;
+/** Test seam: resolves to the child's exit code (null on spawn error). */
+export type InstallRunner = (command: string, args: string[], cwd: string) => Promise<number | null>;
+export interface EnsureProviderDepsOptions {
+    root: string;
+    credential: DevCredential;
+    output: Output;
+    run?: InstallRunner;
+}
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export declare function ensureProviderDeps(options: EnsureProviderDepsOptions): Promise<void>;

package/dist/cli/provider-deps.js

@@ -0,0 +1,100 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * The starter model ladder resolves its provider from the HOST's
+ * node_modules at runtime (dev-creds/model.ts) — nothing declares
+ * `@ai-sdk/*` as a dependency, so a fresh install 500s on the first turn
+ * until the user reads the dev-server error and installs it by hand (0.4.1
+ * E2E certification finding). Init knows the resolved credential, so it can
+ * install exactly the provider that credential needs, up front.
+ */
+const PROVIDER_SPECS = {
+    anthropic: { module: "@ai-sdk/anthropic", spec: "@ai-sdk/anthropic@^3" },
+    openai: { module: "@ai-sdk/openai", spec: "@ai-sdk/openai@^3" },
+    google: { module: "@ai-sdk/google", spec: "@ai-sdk/google@^3" },
+};
+const AI_SPEC = "ai@^6";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export function providerModuleFor(credential) {
+    if (credential.rung === "env-key")
+        return PROVIDER_SPECS[credential.provider];
+    if (credential.rung === "vendo-cloud")
+        return PROVIDER_SPECS.anthropic;
+    return null;
+}
+/** Resolvability is what the runtime ladder checks, so node_modules is the
+    evidence — not package.json (a hoisting monorepo satisfies the import
+    without a local entry). */
+async function isInstalled(root, moduleName) {
+    try {
+        await readFile(join(root, "node_modules", ...moduleName.split("/"), "package.json"), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function fileExists(root, name) {
+    try {
+        await readFile(join(root, name));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Lockfile-sniffed installer; npm is the fallback. */
+export async function installCommandFor(root) {
+    if (await fileExists(root, "pnpm-lock.yaml"))
+        return { command: "pnpm", args: ["add"] };
+    if (await fileExists(root, "yarn.lock"))
+        return { command: "yarn", args: ["add"] };
+    if ((await fileExists(root, "bun.lockb")) || (await fileExists(root, "bun.lock"))) {
+        return { command: "bun", args: ["add"] };
+    }
+    return { command: "npm", args: ["install"] };
+}
+const INSTALL_TIMEOUT_MS = 240_000;
+const defaultRunner = (command, args, cwd) => new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, stdio: "ignore" });
+    const timer = setTimeout(() => {
+        child.kill();
+        resolve(null);
+    }, INSTALL_TIMEOUT_MS);
+    child.on("error", () => {
+        clearTimeout(timer);
+        resolve(null);
+    });
+    child.on("exit", (code) => {
+        clearTimeout(timer);
+        resolve(code);
+    });
+});
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export async function ensureProviderDeps(options) {
+    const provider = providerModuleFor(options.credential);
+    if (provider === null)
+        return;
+    const specs = [];
+    if (!(await isInstalled(options.root, "ai")))
+        specs.push(AI_SPEC);
+    if (!(await isInstalled(options.root, provider.module)))
+        specs.push(provider.spec);
+    if (specs.length === 0)
+        return;
+    const { command, args } = await installCommandFor(options.root);
+    const invocation = `${command} ${[...args, ...specs].join(" ")}`;
+    options.output.log(`Installing the model provider this credential uses: ${specs.join(" ")} (${command})…`);
+    const code = await (options.run ?? defaultRunner)(command, [...args, ...specs], options.root);
+    if (code === 0) {
+        options.output.log(`Installed ${specs.join(" ")}.`);
+    }
+    else {
+        options.output.error(`warning: could not install ${specs.join(" ")} — run \`${invocation}\` yourself before the first turn, or it fails at runtime (E-DEP-001).`);
+    }
+}

package/dist/cli/shared.d.ts

@@ -1,5 +1,5 @@
 import { type Telemetry } from "@vendoai/telemetry";
-export declare const CLI_VERSION = "0.4.0";
+export declare const CLI_VERSION = "0.4.2";
 export interface Output {
     log(message: string): void;
     error(message: string): void;

package/dist/cli/shared.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { initTelemetry, repoHost } from "@vendoai/telemetry";
-export const CLI_VERSION = "0.4.0";
+export const CLI_VERSION = "0.4.2";
 export const consoleOutput = {
     log: (message) => console.log(message),
     error: (message) => console.error(message),

package/dist/cli.js

@@ -18,7 +18,7 @@ Usage: vendo <command> [dir] [options]
 
 Commands:
   init [dir]      Set up Vendo: wire the handler, extract tools + theme, resolve a model key
-  login [email]   Claim a Vendo Cloud key: approve in the browser; the key lands in .env.local
+  login           Claim a Vendo Cloud key: approve in the browser; the key lands in .env.local
   doctor [dir]    Verify the install: wiring, live probes, and one real model turn (--json for agents)
 
 Advanced:
@@ -38,7 +38,6 @@ Options:
   --auth <preset>            Init only: wire this auth preset without asking (authJs, clerk, supabase, auth0, jwt, none)
   --framework <name>         Init only: override framework detection (next, express) — required non-interactively when detection fails
   --cloud-key <key>          Init only: write this Vendo Cloud key to .env.local instead of the login offer
-  --email <address>          Login only: pre-fill the approval page (login hint)
   --wait <seconds>           Login only: bound this call's polling to N seconds (agents loop re-runs; each resumes the same request), then exit resumably
   --byo                      Init only: decline the Vendo Cloud offer (bring your own model key)
   --ai-polish                Init only: consent to the AI extraction pass without a prompt (works non-interactively)
@@ -88,7 +87,7 @@ const REFINE_FLAGS = new Set(["--yes"]);
 const REFINE_VALUE_OPTIONS = ["--url", "--model-import", "--ask"];
 const SYNC_FLAGS = new Set(["--strict", "--json", "--report"]);
 const SYNC_VALUE_OPTIONS = ["--url", "--key", "--api-url"];
-const LOGIN_VALUE_OPTIONS = ["--email", "--api-url", "--wait"];
+const LOGIN_VALUE_OPTIONS = ["--api-url", "--wait"];
 /** ENG-335: options the CLI does not recognize — or value options missing
     their value — must fail loudly before anything runs. Silently dropping a
     flag is how the "--agent writes nothing" promise broke in the field: an

package/dist/wire/shared.d.ts

@@ -14,7 +14,7 @@ import type { RuntimeCaptureHandler } from "../runtime-capture.js";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.4.2";
 export declare const BASE_PATH = "/api/vendo";
 export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 /** How inference is served: "custom" (a host-passed model) or "ladder" (the

package/dist/wire/shared.js

@@ -4,7 +4,7 @@ import { VendoError, } from "@vendoai/core";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export const VERSION = "0.4.0";
+export const VERSION = "0.4.2";
 export const BASE_PATH = "/api/vendo";
 const STATUS_BY_CODE = {
     validation: 400,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vendoai/vendo",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "The Vendo umbrella: default composition, public wire routes, React provider, and the vendo CLI.",
   "keywords": [
     "ai",
@@ -86,16 +86,16 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^3.25.0",
-    "@vendoai/actions": "0.4.0",
-    "@vendoai/core": "0.4.0",
-    "@vendoai/apps": "0.4.0",
-    "@vendoai/guard": "0.4.0",
-    "@vendoai/mcp": "0.4.0",
-    "@vendoai/agent": "0.4.0",
-    "@vendoai/automations": "0.4.0",
-    "@vendoai/ui": "0.4.0",
-    "@vendoai/telemetry": "0.3.0",
-    "@vendoai/store": "0.4.0"
+    "@vendoai/actions": "0.4.2",
+    "@vendoai/apps": "0.4.2",
+    "@vendoai/automations": "0.4.2",
+    "@vendoai/agent": "0.4.2",
+    "@vendoai/core": "0.4.2",
+    "@vendoai/guard": "0.4.2",
+    "@vendoai/mcp": "0.4.2",
+    "@vendoai/store": "0.4.2",
+    "@vendoai/telemetry": "0.3.1",
+    "@vendoai/ui": "0.4.2"
   },
   "peerDependencies": {
     "@auth/core": "^0.34.3",

package/dist/cli/cloud/deploy.d.ts

@@ -1,26 +0,0 @@
-import type { AppDocument, PermissionGrant } from "@vendoai/core";
-import { type VendoStore } from "@vendoai/store";
-import { type CloudCommandOptions } from "./command.js";
-export interface LocalDeployApp {
-    doc: AppDocument;
-    enabled: boolean;
-}
-export interface LocalDeployProject {
-    subject: string;
-    apps: LocalDeployApp[];
-    grants: PermissionGrant[];
-}
-export interface LocalProjectReadOptions {
-    subject?: string;
-    cwd?: string;
-}
-export interface ReadLocalProjectOptions extends LocalProjectReadOptions {
-    storeFactory?: () => VendoStore;
-}
-export type LocalProjectReader = (options: LocalProjectReadOptions) => Promise<LocalDeployProject>;
-export interface CloudDeployOptions extends CloudCommandOptions {
-    cwd?: string;
-    localProjectReader?: LocalProjectReader;
-}
-export declare function readLocalProject(options?: ReadLocalProjectOptions): Promise<LocalDeployProject>;
-export declare function runDeploy(args: string[], options?: CloudDeployOptions): Promise<number>;

package/dist/cli/cloud/deploy.js

@@ -1,187 +0,0 @@
-import { appStore, createStore, grantStore, } from "@vendoai/store";
-import { join } from "node:path";
-import { option, options as repeatedOptions } from "./args.js";
-import { CloudError, resolveCloudBaseUrl } from "./client.js";
-import { commandContext, } from "./command.js";
-import { errorMessage, formatTable, printJson } from "./output.js";
-export async function readLocalProject(options = {}) {
-    const store = options.storeFactory?.() ?? createStore({
-        dataDir: join(options.cwd ?? process.cwd(), ".vendo/data"),
-    });
-    try {
-        await store.ensureSchema();
-        const driver = store.raw();
-        const subjectRows = await driver.query("SELECT DISTINCT subject FROM vendo_apps ORDER BY subject ASC");
-        const subjects = subjectRows.rows.map((row) => row.subject);
-        if (subjects.length === 0)
-            throw new Error("No local Vendo apps found in .vendo/data");
-        let subject = options.subject;
-        if (subject === undefined) {
-            if (subjects.length > 1) {
-                throw new Error(`Multiple local Vendo subjects found: ${subjects.join(", ")}. Pass --subject <subject>.`);
-            }
-            subject = subjects[0];
-        }
-        else if (!subjects.includes(subject)) {
-            throw new Error(`Subject ${subject} was not found in the local Vendo store`);
-        }
-        const appIds = await driver.query("SELECT id FROM vendo_apps WHERE subject = $1 ORDER BY created_at ASC, id ASC", [subject]);
-        const apps = (await Promise.all(appIds.rows.map(async ({ id }) => {
-            const row = await appStore(store).get(id);
-            if (row === null || row.subject !== subject)
-                return null;
-            return { doc: row.doc, enabled: row.enabled };
-        }))).filter((row) => row !== null);
-        const grantIds = await driver.query(`SELECT id FROM vendo_grants
-       WHERE subject = $1 AND source = 'automation'
-         AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())
-       ORDER BY granted_at ASC, id ASC`, [subject]);
-        const grants = (await Promise.all(grantIds.rows.map(({ id }) => grantStore(store).get(id))))
-            .filter((grant) => grant !== null);
-        return { subject, apps, grants };
-    }
-    finally {
-        await store.close();
-    }
-}
-function machineOptions(args, context) {
-    return {
-        auth: "key",
-        apiKey: option(args, "--key"),
-        apiUrl: option(args, "--api-url"),
-        env: context.env,
-    };
-}
-function secretValues(args) {
-    const values = new Map();
-    for (const pair of repeatedOptions(args, "--secret")) {
-        const separator = pair.indexOf("=");
-        if (separator <= 0)
-            throw new Error("--secret must use NAME=VALUE");
-        values.set(pair.slice(0, separator), pair.slice(separator + 1));
-    }
-    return values;
-}
-function selectedApps(project, args) {
-    const requested = [...new Set(repeatedOptions(args, "--app"))];
-    if (requested.length === 0) {
-        const selected = project.apps.filter((app) => app.enabled && app.doc.trigger !== undefined);
-        if (selected.length === 0)
-            throw new Error("No enabled local automations found");
-        return selected;
-    }
-    const requestedIds = new Set(requested);
-    for (const appId of requested) {
-        const app = project.apps.find((candidate) => candidate.doc.id === appId);
-        if (app === undefined)
-            throw new Error(`App ${appId} was not found for subject ${project.subject}`);
-        if (app.doc.trigger === undefined)
-            throw new Error(`App ${appId} is not an automation`);
-    }
-    return project.apps.filter((app) => requestedIds.has(app.doc.id));
-}
-function warnUnsupportedFnSteps(context, apps) {
-    for (const app of apps) {
-        const run = app.doc.trigger?.run;
-        if (run?.kind === "steps" && run.steps.some((step) => step.tool.startsWith("fn:"))) {
-            context.output.error(`WARNING: Automation ${app.doc.id} has fn: steps that target the app's machine, which is unreachable from hosted sandboxes in v1; those steps will fail/park when fired hosted.`);
-        }
-    }
-}
-function deployResponse(value) {
-    if (typeof value !== "object" || value === null)
-        throw new Error("Vendo Cloud returned an invalid deploy response");
-    const result = value;
-    if (typeof result.org?.id !== "string"
-        || typeof result.org.slug !== "string"
-        || typeof result.instance?.status !== "string"
-        || typeof result.applied?.apps !== "number"
-        || typeof result.applied.grants !== "number"
-        || typeof result.applied.secrets !== "number"
-        || !Array.isArray(result.webhooks)
-        || result.webhooks.some((webhook) => typeof webhook.app_id !== "string"
-            || typeof webhook.source !== "string"
-            || typeof webhook.url !== "string")) {
-        throw new Error("Vendo Cloud returned an invalid deploy response");
-    }
-    return result;
-}
-function printDeploySummary(context, response) {
-    const lines = [
-        `Vendo Cloud deploy: ${response.org.slug} (${response.instance.status})`,
-        "",
-        formatTable(["APPLIED", "COUNT"], [
-            ["apps", String(response.applied.apps)],
-            ["grants", String(response.applied.grants)],
-            ["secrets", String(response.applied.secrets)],
-        ]),
-        "",
-    ];
-    if (response.webhooks.length === 0) {
-        lines.push("Webhooks: none");
-    }
-    else {
-        lines.push(formatTable(["AUTOMATION", "SOURCE", "WEBHOOK URL"], response.webhooks.map((webhook) => [
-            webhook.app_id,
-            webhook.source,
-            webhook.url,
-        ])));
-    }
-    context.output.log(lines.join("\n"));
-}
-export async function runDeploy(args, options = {}) {
-    const context = commandContext(options);
-    try {
-        const project = await (options.localProjectReader ?? readLocalProject)({
-            subject: option(args, "--subject"),
-            cwd: options.cwd ?? process.cwd(),
-        });
-        const apps = selectedApps(project, args);
-        warnUnsupportedFnSteps(context, apps);
-        const appIds = new Set(apps.map((app) => app.doc.id));
-        const grants = project.grants.filter((grant) => grant.subject === project.subject
-            && grant.source === "automation"
-            && grant.appId !== undefined
-            && appIds.has(grant.appId));
-        const provided = secretValues(args);
-        const referenced = new Set();
-        for (const app of apps) {
-            for (const name of app.doc.secrets ?? []) {
-                referenced.add(name);
-                if (!provided.has(name)) {
-                    context.output.error(`Automation ${app.doc.id} references missing secret ${name}; pass --secret ${name}=VALUE`);
-                }
-            }
-        }
-        const secrets = [...referenced]
-            .filter((name) => provided.has(name))
-            .map((name) => ({ name, value: provided.get(name) }));
-        const requestOptions = machineOptions(args, context);
-        if (secrets.length > 0 && new URL(resolveCloudBaseUrl(requestOptions)).protocol !== "https:") {
-            throw new Error("Deploying secret values requires an HTTPS Vendo Cloud URL");
-        }
-        const response = deployResponse(await context.fetcher("/api/v1/hosted/deploy", {
-            ...requestOptions,
-            method: "POST",
-            body: {
-                apps: apps.map((app) => ({ doc: app.doc, enabled: app.enabled })),
-                grants,
-                secrets,
-            },
-        }));
-        if (args.includes("--json"))
-            printJson(context.output, response);
-        else
-            printDeploySummary(context, response);
-        return 0;
-    }
-    catch (error) {
-        if (error instanceof CloudError && error.code === "cloud-required") {
-            context.output.error("This key's org needs a Cloud plan (cloud-required).");
-        }
-        else {
-            context.output.error(errorMessage(error));
-        }
-        return 1;
-    }
-}