@workser/cli 0.1.0 → 0.2.1

package/dist/index.js

@@ -3650,16 +3650,580 @@ function exitCodeFor(e) {
   return 1;
 }
 
-// src/commands/status.ts
+// src/commands/help.ts
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 
+// src/help-content.ts
+var HELP_TOPICS = [
+  {
+    topic: "automation",
+    title: "Workflows & connected apps",
+    summary: "Build automations that outlive the run; use Gmail, Slack, Stripe, Sheets.",
+    commands: ["workflow", "app"],
+    source: "skills/workser/reference/automation.md",
+    body: `# Workflows & connected apps
+
+Wire up **automations** that keep running after you're done, and use third-party
+accounts (Gmail, Slack, Stripe, Google Sheets) the project has connected.
+
+\`\`\`
+workser workflow list | create <name> [--body <json>] | get <id>
+workser workflow activate <id> | deactivate <id> | run <id> [--wait] [--body <json>]
+workser workflow runs <id>          # past executions of a workflow
+workser workflow nodes [query]      # search the node-type catalog
+
+workser app list [--toolkit <slug>] # connectable + connected third-party apps
+workser app connect <toolkit> | disconnect <connectionId>
+workser app tools <toolkit>         # a connected app's callable actions
+workser app run <toolSlug> [--body <json>]  # execute one action
+\`\`\`
+
+## Building a workflow
+
+\`workser workflow create\` builds an event-driven, multi-step automation \u2014 the same
+engine Workser's own web Workflow tab uses. Nodes, connections and triggers go in
+\`--body\` as JSON.
+
+**Browse \`workser workflow nodes\` first.** Inventing a node type that doesn't exist
+produces a workflow that saves and then never runs.
+
+Created workflows start inactive: \`workser workflow activate <id>\` when it's ready.
+
+## Using a connected app
+
+1. \`workser app list\` \u2014 check what's already connected before asking for anything.
+2. If it isn't: \`workser app connect <toolkit>\` returns an OAuth link. The **user**
+   must open it; you cannot complete OAuth on their behalf. Wait, then continue.
+3. \`workser app tools <toolkit>\` \u2014 read the argument schema rather than guessing
+   field names.
+4. \`workser app run <toolSlug> --body '{"\u2026":\u2026}'\` \u2014 e.g. \`GOOGLESHEETS_APPEND_ROW\`,
+   \`GMAIL_SEND_EMAIL\`.
+
+**A \`run\` is a real side effect in someone's real account.** Sending an email or
+charging a card is not a dry run \u2014 say what you're about to do before you do it.
+
+## The half people forget
+
+A workflow-backed feature is two-way. Triggering it is the outbound half; when the
+workflow produces a result the app needs, its final node has to POST back to a
+webhook route in the app. Build only the trigger and the workflow runs perfectly
+while nothing ever appears in the product. The app-side receiver is covered in the
+\`workser-sdk\` skill under workflows.
+`
+  },
+  {
+    topic: "business",
+    title: "Business hub data",
+    summary: "Products, orders, customers, sales, content, marketing, support, analytics.",
+    commands: ["business"],
+    source: "skills/workser/reference/business-data.md",
+    body: `# Business hub data
+
+The project's own commerce and CRM records \u2014 the **same rows** the Orbit desktop
+Business tab and workser-web's Business hub show. One generic CRUD surface across
+every resource rather than a command per domain.
+
+\`\`\`
+workser business resources                        # the known resource names
+workser business list <resource> [subpath]        # list/read  (--query '<json>')
+workser business get <resource> <id>
+workser business create <resource> --body '<json>'
+workser business update <resource> <id> --body '<json>'
+workser business delete <resource> <id>
+workser business action <resource> <id> <verb>    # POST .../<id>/<verb>
+\`\`\`
+
+## Resources
+
+\`business-config\`, \`business-settings\`, \`products\`, \`collections\`, \`navigations\`,
+\`orders\`, \`customers\`, \`sales-pipelines\`, \`sales-deals\`, \`pages\`, \`blog-posts\`,
+\`media\`, \`campaigns\`, \`email-templates\`, \`discounts\`, \`seo-configs\`,
+\`social-accounts\`, \`support-conversations\`, \`automation-rules\`, \`analytics\`.
+
+Run \`workser business resources --json\` rather than trusting this list \u2014 the CLI's
+copy is the current one.
+
+## Notes that matter
+
+- **Sales and Support nest.** \`sales-deals\` maps to \`/sales/deals\`,
+  \`support-conversations\` to \`/support/conversations\`. Use the dashed names above;
+  the flat \`resource/id\` shape then works for \`get\`/\`update\`/\`delete\`/\`action\`.
+- **\`list\` takes a raw subpath** for anything the map doesn't cover:
+  \`workser business list sales-pipelines <id>/stages\`.
+- **\`action\` is for named verbs** \u2014 \`workser business action orders <id> cancel\`,
+  \`workser business action sales-deals <dealId> win\`. Check the resource's routes
+  before inventing a verb.
+- **These are real business records.** Cancelling an order or deleting a customer is
+  not a dry run. Say what you're about to do first.
+
+## This is for you, not for the app
+
+\`workser business\` is how **you** inspect and fix data while building. The app reads
+the same records at runtime through \`workser.business\` in \`@workser/app\` \u2014 see the
+\`workser-sdk\` skill. An app shelling out to this CLI per request is wrong.
+`
+  },
+  {
+    topic: "computer-use",
+    title: "Computer-use tools",
+    summary: "Files, shell, screen, input, clipboard and browser on this machine.",
+    commands: ["tool"],
+    source: "skills/workser/reference/computer-use.md",
+    body: `# Computer-use tools \u2014 your hands on this machine
+
+\`\`\`
+workser tool list                        # what's available to you right now
+workser tool run <name> [--body <json>]  # run one
+\`\`\`
+
+\`workser tool list\` shows what's available \u2014 filesystem (read/write/list/delete/move),
+shell (run a command / Python / Node), screenshots and screen info, mouse and keyboard
+input, clipboard, notifications, and basic browser control (open a URL, read the page,
+click, fill, type, screenshot).
+
+This is the **same engine** Workser's cloud Computer Use agent uses when it controls a
+user's machine remotely \u2014 you're getting it locally, gated by the same safety policy.
+
+## Notes that matter
+
+- **Check \`tool list\` rather than assuming a capability exists.** This is a curated
+  subset, not full desktop automation.
+- **The safety policy applies.** Blocked paths (\`~/.ssh\` and friends), blocked
+  destructive commands, rate limits. Refusals are the policy working, not a bug to
+  route around.
+- **Sensitive actions are approval-gated.** Writing or deleting files, running a shell
+  command, clicking or typing may return \`awaiting_approval\` (exit 5) \u2014 tell the user
+  to approve in Orbit, then retry.
+- **You already have your own tools.** For editing files in this repo, use them. Reach
+  for \`workser tool\` when you need something *outside* the project \u2014 the screen, the
+  clipboard, a browser, another app on the machine.
+`
+  },
+  {
+    topic: "database",
+    title: "Database & end users",
+    summary: "Provision Postgres, browse tables, run SQL, provision auth.",
+    commands: ["db", "auth"],
+    source: "skills/workser/reference/database.md",
+    body: `# Database & end users
+
+The project's Postgres (Neon behind Workser) and its end-user auth. Provisioning is
+idempotent \u2014 running \`create\` twice is safe.
+
+\`\`\`
+workser db create                   # provision the Neon Postgres database (idempotent)
+workser db url                      # connection string (sensitive; least-privilege role)
+workser db list                     # database status
+workser db tables                   # list tables in the database
+workser db schema <table>           # a table's columns
+workser db data <table> [-n N] [--offset N]   # read rows
+workser db query "<sql>"            # run SQL (writes are approval-gated)
+
+workser auth enable                 # provision auth for the project (idempotent)
+workser auth status                 # is auth enabled? + Neon auth mode
+\`\`\`
+
+## Notes that matter
+
+- **\`db url\` is a credential.** Don't print it into the conversation, don't paste it
+  into a file the user will commit. The app gets it from its environment already.
+- **Writes are approval-gated.** A \`db query\` that mutates may return
+  \`awaiting_approval\` (exit 5). Ask the user to approve in Orbit, then retry.
+- **\`DROP\` / \`TRUNCATE\` are refused** by the safety policy. Change schema with a
+  migration in the app's own migration folder, not with a destructive one-off.
+- **The database is the project's, not the app's.** Sibling apps in the same project
+  share it. Don't assume a table is yours because you created it.
+
+## Reading rows vs. reading data at runtime
+
+\`db data\` / \`db query\` are for **you**, inspecting while you build. The app itself
+should read through \`@workser/app\` (\`workser.db\`, \`workser.business\`) \u2014 see the
+\`workser-sdk\` skill. An app that shells out to the CLI at request time is wrong.
+`
+  },
+  {
+    topic: "deliverables",
+    title: "Deliverables & asking the user",
+    summary: "Record finished output on the task, and ask a blocking question.",
+    commands: ["artifact", "ask"],
+    source: "skills/workser/reference/deliverables.md",
+    body: `# Deliverables & asking the user
+
+Two things that reach the user directly: what you produced, and what you need from
+them.
+
+\`\`\`
+workser artifact add <path> [--kind <k>] [-d <text>]  # record a finished deliverable
+workser artifact add --url <url> --kind app           # record a deployed app
+workser artifact run                                  # which task you're attached to
+
+workser ask "<question>" [--type <t>] [--option <o>]  # ask the user, WAIT for the answer
+\`\`\`
+
+## Record what you produced
+
+Workser shows the user a **Deliverables** list on the task. If you don't say what you
+made, it has to guess \u2014 it watches your file edits and treats any path it sees as a
+deliverable, so scratch files and half-finished drafts show up next to the real
+output, and things that aren't files at all (a folder of results, a deployed app)
+can't show up correctly.
+
+\`\`\`
+workser artifact add ./report.pdf -d "Q3 sales summary"
+workser artifact add ./exports --kind folder -d "generated CSVs"
+workser artifact add --url https://acme.workser.app --kind app -t "Storefront"
+\`\`\`
+
+Only register **finished** output the user should get \u2014 not temp files, not
+intermediate steps. \`--kind\` is inferred from the path when you omit it (directories
+are detected automatically); pass it explicitly for \`app\` / \`url\`.
+
+To publish an app: \`workser deploy\` (preview) or \`workser deploy --prod\` (live), then
+register the URL it returns as an \`app\` artifact so the user can open it from the task.
+
+## Ask the user something (and get an answer back)
+
+When you're blocked \u2014 a missing value, an ambiguous requirement, permission for
+something consequential \u2014 don't guess, and don't just write the question into your
+final message where nobody will answer it.
+
+\`\`\`
+workser ask "Which email should order confirmations come from?"
+workser ask "Which plan should I wire up?" --option Free --option Pro --option Team
+workser ask "Delete the 1,240 archived rows?" --type approval
+\`\`\`
+
+This shows the user a real card in the conversation and **blocks until they answer**,
+then prints their answer \u2014 so you ask, read the reply, and keep working in the same
+turn.
+
+Types: \`input\` (default, free text), \`choice\` (with \`--option\`), \`approval\`
+(permission), \`confirmation\` (check an assumption), \`information\` (FYI, no answer
+needed). It times out (default 10 min) rather than hanging forever; if it does, carry
+on and state clearly what you assumed.
+
+**Never ask for a secret value this way** \u2014 the answer is stored and displayed. Ask
+*where* a key should go, then have the user set it (\`workser env set\` writes it
+without you ever seeing it).
+`
+  },
+  {
+    topic: "deploy",
+    title: "Deploy, environment variables & logs",
+    summary: "Ship the app, configure it, and find out why it is down.",
+    commands: ["deploy", "env", "logs", "versions", "domain", "open", "verify"],
+    source: "skills/workser/reference/deploy.md",
+    body: `# Deploy, environment variables & logs
+
+Getting the app online and configured, and finding out why it isn't.
+
+\`\`\`
+workser deploy [--prod] [--watch]   # deploy (git \u2192 Vercel); --watch waits for live URL
+workser deploy status [id]          # status of a deploy (default: latest)
+workser logs [-n 100] [-f]          # recent logs
+workser versions                    # deploy history
+workser domain list                 # custom domains (read)
+workser open                        # open the live app
+workser verify                      # run typecheck/lint/build
+
+workser env set KEY=VALUE [K2=V2\u2026]  # set env vars
+workser env list                    # list keys (values masked)
+workser env get KEY                 # one value (sensitive)
+\`\`\`
+
+## Notes that matter
+
+- **\`verify\` gates "done".** Run \`workser verify --json\` before you say a task is
+  finished. \`"ok": false\` means fix the listed errors and re-run \u2014 a green build is
+  the bar, not your reading of the diff.
+- **\`deploy\` without \`--prod\` is a preview.** Preview first when the change is
+  risky; \`--prod\` puts it in front of real users.
+- **\`--watch\` blocks until there's a live URL.** Without it you get a deploy id and
+  have to poll \`deploy status\`.
+- **\`env set\` writes a value you never see.** That's the point \u2014 when the user has
+  a secret, have them run it (or set it in Orbit) rather than pasting it to you.
+- **\`env get\` returns a secret.** Don't echo it into the conversation.
+- **\`env rm\` and \`domain set\` are owner-only** (exit 6). Tell the user to do it in
+  Orbit; don't look for a workaround.
+
+## After a successful deploy
+
+Register the URL so it shows up on the user's task:
+
+\`\`\`
+workser artifact add --url https://acme.workser.app --kind app -t "Storefront"
+\`\`\`
+
+See \`reference/deliverables.md\`.
+
+## Local vs cloud environment
+
+\`env set\` configures the **cloud** environment (production and preview). The \`.env\`
+files in the app folder configure **this computer** \u2014 the user edits those in Orbit
+under Settings \u2192 "On this computer", and saving there restarts the dev server. Don't
+hand-edit \`.env.local\` to change cloud behaviour; they are different environments.
+`
+  },
+  {
+    topic: "images",
+    title: "Image generation",
+    summary: "Generate images from a prompt, optionally conditioned on existing images.",
+    commands: ["image"],
+    source: "skills/workser/reference/images.md",
+    body: `# Image generation
+
+\`\`\`
+workser image generate "<prompt>"            # alias: workser image gen
+  -r, --reference <url...>                   # condition on existing images (up to 4)
+  -o, --output <path>                        # also download the first image locally
+\`\`\`
+
+Returns the generated image's public URL, so the usual move is to generate, then use
+that URL directly in the app.
+
+\`\`\`bash
+workser image generate "flat illustration of a farm delivery van, brand colors" --json
+workser image gen "same van, from the side" -r https://\u2026 -o ./public/van.png --json
+\`\`\`
+
+## Notes that matter
+
+- **Reference images are image-to-image conditioning**, not attachments. Up to 4;
+  anything beyond that is dropped.
+- **The model sometimes narrates instead of drawing** \u2014 a refusal or a clarifying
+  question comes back as text rather than an image. Check that you actually got an
+  image before wiring the URL into a page; an empty result is not a transport error
+  to retry.
+- **\`--output\` writes only the first image.** If you asked for several, the rest
+  exist only as URLs.
+- **Placeholder art is not a deliverable.** Generating a hero image to unblock a
+  layout is fine; shipping it as the user's brand asset without asking is not.
+`
+  },
+  {
+    topic: "memory",
+    title: "Memory across conversations",
+    summary: "Store and recall durable project knowledge shared with cloud agents.",
+    commands: ["memory"],
+    source: "skills/workser/reference/memory.md",
+    body: `# Memory \u2014 remember across conversations, not just this one
+
+\`\`\`
+workser memory add "<content>" [--metadata <json>]  # remember for future conversations
+workser memory search "<query>" [--limit N]         # recall what was learned before
+workser memory forget <memoryId>                    # soft-delete an outdated memory
+\`\`\`
+
+## Why this exists
+
+Every conversation you run is otherwise a fresh start \u2014 no memory of what you or the
+user decided last time. This stores durable, searchable memory for the **current
+project**, and it is the **same memory space** Workser's cloud agents write to for
+this project. Add something here and a cloud agent \u2014 or your own next conversation \u2014
+can \`memory search\` and find it.
+
+## Using it well
+
+- **Search before assuming you don't know.** Before concluding something about this
+  project is undocumented, run \`workser memory search "<topic>"\`. It may already be
+  recorded.
+- **Store decisions, not chatter.** User preferences, decisions made, constraints,
+  requirements \u2014 things worth knowing next week. Not "the build passed".
+- **\`forget\` is a soft delete.** The content stays retrievable by id but is excluded
+  from future searches. Use it when something is wrong or outdated, rather than
+  adding a contradicting memory on top.
+- **Never store a secret.** Memory is retrievable and displayable.
+`
+  },
+  {
+    topic: "neon",
+    title: "The project's own Neon backend",
+    summary: "Neon-branch object storage and functions. Dedicated tenancy only.",
+    commands: ["neon"],
+    source: "skills/workser/reference/neon-backend.md",
+    body: `# The project's own Neon backend
+
+S3-compatible object storage and Node.js HTTP functions on the project's own Neon
+branch \u2014 they branch with the database. **Additive** infrastructure, not a
+replacement for \`workser storage\`.
+
+\`\`\`
+workser neon status                       # tenancy + toggles + region verdict
+workser neon storage list | create <name> | rm <bucket>
+workser neon storage ls <bucket> [prefix]
+workser neon storage put <bucket> <local> [key]
+workser neon storage get <bucket> <key> [dest]
+workser neon storage url <bucket> <key>   # temporary download URL
+workser neon functions list | deploy <slug> <zip> | rm <slug>
+\`\`\`
+
+## Check \`neon status\` first \u2014 always
+
+Three things must all be true: **dedicated tenancy**, the capability **switched on**,
+and a **supported region**.
+
+Region is fixed when the project is created. \`regionSupportsNeonBackend: false\` is
+**final, not retryable** \u2014 no amount of waiting or retrying changes it. When you see
+it, say so plainly and fall back to \`workser storage\` (the default bucket).
+
+## Notes that matter
+
+- **\`neon storage rm <bucket>\` deletes the bucket and everything in it.** Not
+  reversible. Confirm with the user first.
+- **\`neon storage url\`** issues a short-lived URL \u2014 prefer it to moving large files
+  through Workser.
+- **Functions deploy from a zip.** Build the bundle first, then
+  \`workser neon functions deploy <slug> <zip>\`.
+- **Most apps don't need this.** If the user just wants to store uploads, the default
+  bucket in \`reference/storage.md\` is the answer.
+`
+  },
+  {
+    topic: "roles",
+    title: "Delegate to roles",
+    summary: "Hand a focused subtask to another configured local agent.",
+    commands: ["agent"],
+    source: "skills/workser/reference/roles.md",
+    body: `# Delegate to roles
+
+The user can configure **roles** \u2014 named specialists each backed by a local CLI agent
+(e.g. \`qa\` \u2192 codex, \`designer\` \u2192 claude_code).
+
+\`\`\`
+workser agent list                  # main agent + configured roles (+ which are runnable)
+workser agent run <role> "<task>"   # delegate a focused subtask (runs isolated)
+workser agent main                  # show the configured main agent
+\`\`\`
+
+## How to use it
+
+Run \`workser agent list --json\` first \u2014 it tells you which roles exist **and** which
+are actually runnable on this machine. Delegating to a role that isn't installed just
+fails.
+
+\`workser agent run <role> "<task>" --json\` runs the role as an **isolated local
+subagent** with its own context and returns \`{role, agent, output, exitCode}\`.
+
+- Hand off focused subtasks \u2014 review this diff, design this screen \u2014 to keep your own
+  context lean and get a specialized second perspective.
+- **A non-zero \`exitCode\` means the role's run failed.** Surface that; don't quietly
+  treat empty output as success.
+- The subagent doesn't share your context. Put everything it needs in the task
+  string; it cannot see the conversation you're in.
+`
+  },
+  {
+    topic: "storage",
+    title: "File storage",
+    summary: "The project's default bucket \u2014 upload, list, download.",
+    commands: ["storage"],
+    source: "skills/workser/reference/storage.md",
+    body: `# File storage
+
+The project's default bucket (Cloudflare R2 behind Workser). Every project gets one;
+\`create\` is idempotent.
+
+\`\`\`
+workser storage create [name]       # provision the bucket (idempotent)
+workser storage list                # the project's bucket
+workser storage ls [prefix]         # list objects in the bucket
+workser storage put <local> <key>   # upload a file into the bucket
+workser storage get <key> [dest]    # download an object (or print its URL)
+\`\`\`
+
+## Notes that matter
+
+- **One bucket per project, shared by its apps.** Namespace your keys by app or
+  feature (\`invoices/2026/\u2026\`) rather than assuming the root is yours.
+- **\`storage get\` with no destination prints a URL** instead of writing a file \u2014
+  useful when you just want to hand the user something to click.
+- **This is not where app uploads should go through you.** At runtime the app uses
+  \`workser.storage\` from \`@workser/app\`, and for anything large it should request a
+  presigned upload URL so the bytes never pass through Workser. See the
+  \`workser-sdk\` skill.
+
+## Not the same as \`workser neon storage\`
+
+\`storage\` is the default R2 bucket every project has. \`neon storage\` is additive
+infrastructure on the project's own Neon branch, available only on dedicated tenancy
+in a supported region. They are different stores \u2014 a file put in one is not visible
+in the other. See \`reference/neon-backend.md\`.
+`
+  }
+];
+
+// src/commands/help.ts
+function findTopic(name) {
+  const wanted = name.trim().toLowerCase();
+  return HELP_TOPICS.find((t) => t.topic === wanted) ?? // A command name is what an agent reaches for first — `workser help db`
+  // should not be a dead end just because the topic is called "database".
+  HELP_TOPICS.find((t) => t.commands.includes(wanted));
+}
+function listTopics() {
+  ok(
+    HELP_TOPICS.map((t) => ({
+      topic: t.topic,
+      title: t.title,
+      summary: t.summary,
+      commands: t.commands
+    })),
+    () => {
+      line(import_picocolors2.default.bold("Guides") + import_picocolors2.default.dim("  \u2014  workser help <topic>"));
+      line();
+      const width = Math.max(...HELP_TOPICS.map((t) => t.topic.length));
+      for (const t of HELP_TOPICS) {
+        line(`  ${import_picocolors2.default.cyan(t.topic.padEnd(width))}  ${t.summary}`);
+      }
+      line();
+      line(import_picocolors2.default.dim("  workser <command> --help   exact flags, generated from the code"));
+    }
+  );
+}
+function registerHelp(program3) {
+  const withHelpCommand = program3;
+  withHelpCommand.helpCommand?.(false);
+  program3.command("help [topic]").description("guides for using this CLI (`workser help` lists them)").action((topic) => {
+    if (!topic) {
+      listTopics();
+      return;
+    }
+    const found = findTopic(topic);
+    if (found) {
+      ok({ topic: found.topic, title: found.title, content: found.body }, () => {
+        process.stdout.write(found.body.endsWith("\n") ? found.body : found.body + "\n");
+      });
+      return;
+    }
+    const command = program3.commands.find(
+      (c) => c.name() === topic || c.aliases().includes(topic)
+    );
+    if (command && !isJson()) {
+      command.outputHelp();
+      return;
+    }
+    throw new WorkserError(
+      `No guide for "${topic}". Run \`workser help\` to list them` + (command ? `, or \`workser ${topic} --help\` for its flags` : "") + ".",
+      { code: "not_found" }
+    );
+  });
+}
+
+// src/commands/status.ts
+var import_picocolors3 = __toESM(require_picocolors(), 1);
+
 // src/context.ts
 import { resolve } from "path";
 
 // src/config.ts
 import { homedir } from "os";
 import { join } from "path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 var GLOBAL_DIR = join(homedir(), ".workser");
 var SESSION_FILE = join(GLOBAL_DIR, "session.json");
 function readSession() {
@@ -3672,13 +4236,17 @@ function readSession() {
 }
 function writeSession(patch) {
   const next = { ...readSession(), ...patch };
-  mkdirSync(GLOBAL_DIR, { recursive: true });
-  writeFileSync(SESSION_FILE, JSON.stringify(next, null, 2));
+  mkdirSync(GLOBAL_DIR, { recursive: true, mode: 448 });
+  writeFileSync(SESSION_FILE, JSON.stringify(next, null, 2), { mode: 384 });
+  try {
+    chmodSync(SESSION_FILE, 384);
+  } catch {
+  }
   return next;
 }
 function clearSession() {
   try {
-    writeFileSync(SESSION_FILE, "{}");
+    writeFileSync(SESSION_FILE, "{}", { mode: 384 });
   } catch {
   }
 }
@@ -3695,21 +4263,52 @@ function readProjectLink(cwd) {
   }
 }
 
+// src/env.ts
+var ENV_BASE_URLS = {
+  local: "http://localhost:8000",
+  dev: "https://dev-api.workser.ai",
+  prod: "https://api.workser.ai"
+};
+var ALIASES = {
+  local: "local",
+  localhost: "local",
+  development: "dev",
+  dev: "dev",
+  staging: "dev",
+  prod: "prod",
+  production: "prod"
+};
+function resolveEnv(raw = process.env.WORKSER_ENV) {
+  if (!raw || !raw.trim()) return "prod";
+  const env = ALIASES[raw.trim().toLowerCase()];
+  if (!env) {
+    throw new WorkserError(
+      `Unknown WORKSER_ENV "${raw}". Expected one of: local, dev, prod.`,
+      { code: "bad_env" }
+    );
+  }
+  return env;
+}
+function cloudBaseUrl() {
+  return process.env.WORKSER_API_URL || ENV_BASE_URLS[resolveEnv()];
+}
+
 // src/context.ts
-var CLOUD_DEFAULT = process.env.WORKSER_API_URL || "https://api.workser.ai";
 function buildContext(opts) {
   const session = readSession();
   const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
-  const endpointRaw = opts.endpoint || process.env.WORKSER_DAEMON_URL || session.endpoint || CLOUD_DEFAULT;
-  const endpoint = endpointRaw.replace(/\/+$/, "");
   const token = opts.token || process.env.WORKSER_TOKEN || session.token;
-  const mode2 = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:|\/|$)/i.test(
-    endpoint
-  ) ? "daemon" : "cloud";
+  const overridden = Boolean(
+    opts.endpoint || opts.token || process.env.WORKSER_DAEMON_URL || process.env.WORKSER_TOKEN
+  );
+  const socketPath = overridden ? void 0 : session.socketPath;
+  const endpointRaw = socketPath ? "http://localhost" : opts.endpoint || process.env.WORKSER_DAEMON_URL || session.endpoint || cloudBaseUrl();
+  const endpoint = endpointRaw.replace(/\/+$/, "");
+  const mode2 = socketPath ? "daemon" : /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:|\/|$)/i.test(endpoint) ? "daemon" : "cloud";
   const link = readProjectLink(cwd);
   const projectId = opts.project || process.env.WORKSER_PROJECT_ID || link?.projectId || session.defaultProjectId;
   const runId = process.env.WORKSER_RUN_ID || void 0;
-  return { endpoint, token, mode: mode2, cwd, projectId, runId };
+  return { endpoint, socketPath, token, mode: mode2, cwd, projectId, runId };
 }
 function runTarget(ctx) {
   return ctx.runId || "current";
@@ -3740,6 +4339,31 @@ function action(fn) {
 }
 
 // src/client.ts
+import * as http from "http";
+function requestOverSocket(socketPath, pathWithQuery, init) {
+  return new Promise((resolve4, reject) => {
+    const req = http.request(
+      { socketPath, path: pathWithQuery, method: init.method, headers: init.headers },
+      (res) => {
+        let text = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => text += c);
+        res.on(
+          "end",
+          () => resolve4({
+            ok: (res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300,
+            status: res.statusCode ?? 0,
+            statusText: res.statusMessage ?? "",
+            text
+          })
+        );
+      }
+    );
+    req.on("error", reject);
+    if (init.body !== void 0) req.write(init.body);
+    req.end();
+  });
+}
 async function api(ctx, path, opts = {}) {
   const url = new URL(ctx.endpoint + path);
   if (opts.query) {
@@ -3752,21 +4376,42 @@ async function api(ctx, path, opts = {}) {
     "user-agent": "workser-cli"
   };
   if (ctx.token) headers.authorization = `Bearer ${ctx.token}`;
+  if (ctx.mode === "daemon" && ctx.runId) {
+    headers["x-workser-run-id"] = ctx.runId;
+  }
   if (opts.body !== void 0) headers["content-type"] = "application/json";
+  const method = opts.method ?? (opts.body !== void 0 ? "POST" : "GET");
+  const bodyText = opts.body !== void 0 ? JSON.stringify(opts.body) : void 0;
   let res;
   try {
-    res = await fetch(url, {
-      method: opts.method ?? (opts.body !== void 0 ? "POST" : "GET"),
-      headers,
-      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
-    });
+    if (ctx.socketPath) {
+      if (bodyText !== void 0) {
+        headers["content-length"] = String(Buffer.byteLength(bodyText));
+      }
+      res = await requestOverSocket(ctx.socketPath, url.pathname + url.search, {
+        method,
+        headers,
+        body: bodyText
+      });
+    } else {
+      const r = await fetch(url, { method, headers, body: bodyText });
+      res = {
+        ok: r.ok,
+        status: r.status,
+        statusText: r.statusText,
+        text: await r.text()
+      };
+    }
   } catch (e) {
     throw new WorkserError(
       ctx.mode === "daemon" ? "Can't reach Workser Orbit (local daemon). Is the app running?" : `Can't reach Workser at ${ctx.endpoint}.`,
-      { code: "not_connected", details: e instanceof Error ? e.message : String(e) }
+      {
+        code: "not_connected",
+        details: e instanceof Error ? e.message : String(e)
+      }
     );
   }
-  const text = await res.text();
+  const text = res.text;
   const data = text ? safeJson(text) : void 0;
   if (!res.ok) {
     const nested = data && typeof data === "object" && data.error && typeof data.error === "object" ? data.error : void 0;
@@ -3803,15 +4448,15 @@ function registerStatus(program3) {
     action(async ({ ctx }) => {
       const data = await api(ctx, "/v1/status", { query: { project: ctx.projectId } });
       ok(data, () => {
-        line(import_picocolors2.default.bold("Workser") + import_picocolors2.default.dim(`  (${ctx.mode} \xB7 ${ctx.endpoint})`));
+        line(import_picocolors3.default.bold("Workser") + import_picocolors3.default.dim(`  (${ctx.mode} \xB7 ${ctx.endpoint})`));
         line(`  user:      ${data.user?.email ?? "\u2014"}`);
         line(`  workspace: ${data.workspace?.name ?? "\u2014"}`);
         line(
-          `  project:   ${data.project?.name ?? "\u2014"}` + (data.project?.id ? import_picocolors2.default.dim(`  (${data.project.id})`) : "")
+          `  project:   ${data.project?.name ?? "\u2014"}` + (data.project?.id ? import_picocolors3.default.dim(`  (${data.project.id})`) : "")
         );
         if (data.latestDeploy) {
           line(
-            `  deploy:    ${colorStatus(data.latestDeploy.status)}` + (data.latestDeploy.url ? `  ${import_picocolors2.default.cyan(data.latestDeploy.url)}` : "")
+            `  deploy:    ${colorStatus(data.latestDeploy.status)}` + (data.latestDeploy.url ? `  ${import_picocolors3.default.cyan(data.latestDeploy.url)}` : "")
           );
         }
       });
@@ -3823,15 +4468,15 @@ function colorStatus(s) {
     case "ready":
     case "live":
     case "success":
-      return import_picocolors2.default.green(s);
+      return import_picocolors3.default.green(s);
     case "error":
     case "failed":
     case "canceled":
-      return import_picocolors2.default.red(s);
+      return import_picocolors3.default.red(s);
     case "building":
     case "queued":
     case "deploying":
-      return import_picocolors2.default.yellow(s);
+      return import_picocolors3.default.yellow(s);
     default:
       return s ?? "\u2014";
   }
@@ -3892,7 +4537,7 @@ function registerWhoami(program3) {
 }
 
 // src/commands/project.ts
-var import_picocolors3 = __toESM(require_picocolors(), 1);
+var import_picocolors4 = __toESM(require_picocolors(), 1);
 function registerProject(program3) {
   const project = program3.command("project").description("Inspect the project linked to this directory");
   project.command("show").description("Show the project pinned to this directory").action(
@@ -3900,8 +4545,8 @@ function registerProject(program3) {
       const projectId = requireProject(ctx);
       const p = await api(ctx, `/v1/projects/${encodeURIComponent(projectId)}`);
       ok(p, () => {
-        line(`${import_picocolors3.default.bold(p.name ?? "\u2014")}${p.id ? import_picocolors3.default.dim(`  (${p.id})`) : ""}`);
-        if (p.url) line(import_picocolors3.default.cyan(p.url));
+        line(`${import_picocolors4.default.bold(p.name ?? "\u2014")}${p.id ? import_picocolors4.default.dim(`  (${p.id})`) : ""}`);
+        if (p.url) line(import_picocolors4.default.cyan(p.url));
       });
     })
   );
@@ -3923,22 +4568,79 @@ function registerProject(program3) {
       })
     )
   );
+  project.command("apps").description("List the project's apps (id, type, status, URL, local folder)").action(
+    action(async ({ ctx }) => {
+      const projectId = requireProject(ctx);
+      const [apps, folders] = await Promise.all([
+        api(ctx, `/v1/apps`, { query: { project: projectId } }),
+        api(ctx, `/v1/app-folders`, { query: { project: projectId } }).catch(
+          () => []
+        )
+      ]);
+      const withFolders = (apps ?? []).map((a) => ({
+        ...a,
+        localPath: folderFor(folders, a.id)
+      }));
+      ok(withFolders, () => {
+        if (!withFolders.length) return line(import_picocolors4.default.dim("No apps in this project."));
+        for (const a of withFolders) printApp(a);
+      });
+    })
+  );
+  project.command("app <id>").description("Show one app: type, status, URLs and where its code lives here").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const id = args[0];
+      const [app, folders] = await Promise.all([
+        api(ctx, `/v1/apps/${encodeURIComponent(id)}`),
+        api(ctx, `/v1/app-folders`, { query: { project: projectId } }).catch(
+          () => []
+        )
+      ]);
+      const merged = { ...app, localPath: folderFor(folders, app?.id ?? id) };
+      ok(merged, () => {
+        printApp(merged);
+        if (merged.previewUrl) line(`  preview     ${import_picocolors4.default.cyan(merged.previewUrl)}`);
+        if (merged.productionUrl)
+          line(`  production  ${import_picocolors4.default.cyan(merged.productionUrl)}`);
+        if (!merged.localPath) {
+          line(
+            import_picocolors4.default.dim(
+              "  no folder linked on this computer \u2014 link one in Workser Orbit"
+            )
+          );
+        }
+      });
+    })
+  );
   project.command("list").description("List the workspace's projects").action(
     action(async ({ ctx }) => {
       const items = await api(ctx, `/v1/projects`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors3.default.dim("No projects."));
+        if (!items?.length) return line(import_picocolors4.default.dim("No projects."));
         for (const p of items) {
-          const pinned = ctx.projectId && p.id === ctx.projectId ? import_picocolors3.default.green("\u25CF ") : "  ";
-          line(`${pinned}${p.name ?? "\u2014"}${p.id ? import_picocolors3.default.dim(`  (${p.id})`) : ""}`);
+          const pinned = ctx.projectId && p.id === ctx.projectId ? import_picocolors4.default.green("\u25CF ") : "  ";
+          line(`${pinned}${p.name ?? "\u2014"}${p.id ? import_picocolors4.default.dim(`  (${p.id})`) : ""}`);
         }
       });
     })
   );
 }
+function folderFor(folders, appId) {
+  if (!Array.isArray(folders)) return void 0;
+  const hit = folders.find((f) => f?.web_app_id === appId);
+  return hit?.local_path || void 0;
+}
+function printApp(a) {
+  const bits = [a.type, a.status].filter(Boolean).join(" \xB7 ");
+  line(
+    `${import_picocolors4.default.bold(a.name ?? "\u2014")}${a.id ? import_picocolors4.default.dim(`  (${a.id})`) : ""}${bits ? "  " + import_picocolors4.default.dim(bits) : ""}`
+  );
+  if (a.localPath) line(import_picocolors4.default.dim(`  ${a.localPath}`));
+}
 
 // src/commands/db.ts
-var import_picocolors4 = __toESM(require_picocolors(), 1);
+var import_picocolors5 = __toESM(require_picocolors(), 1);
 function registerDb(program3) {
   const db = program3.command("db").description("Provision and inspect the project's Neon Postgres database");
   db.command("create").description("Provision a Postgres database for the project (idempotent)").action(
@@ -3948,7 +4650,7 @@ function registerDb(program3) {
       ok(
         res,
         () => line(
-          res.created === false ? `Database already provisioned${import_picocolors4.default.dim(`  (${res.name ?? "db"})`)}.` : `Provisioned database ${import_picocolors4.default.bold(res.name ?? "db")}${import_picocolors4.default.dim(`  ${res.region ?? ""} ${res.status ?? ""}`.trimEnd())}.`
+          res.created === false ? `Database already provisioned${import_picocolors5.default.dim(`  (${res.name ?? "db"})`)}.` : `Provisioned database ${import_picocolors5.default.bold(res.name ?? "db")}${import_picocolors5.default.dim(`  ${res.region ?? ""} ${res.status ?? ""}`.trimEnd())}.`
         )
       );
     })
@@ -3958,8 +4660,8 @@ function registerDb(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/databases`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors4.default.dim("No database yet. `workser db create`."));
-        for (const d of items) line(`${d.name}${import_picocolors4.default.dim(`  ${d.region ?? ""} ${d.status ?? ""}`.trimEnd())}`);
+        if (!items?.length) return line(import_picocolors5.default.dim("No database yet. `workser db create`."));
+        for (const d of items) line(`${d.name}${import_picocolors5.default.dim(`  ${d.region ?? ""} ${d.status ?? ""}`.trimEnd())}`);
       });
     })
   );
@@ -3976,12 +4678,12 @@ function registerDb(program3) {
       const projectId = requireProject(ctx);
       const rows = await api(ctx, `/v1/projects/${projectId}/db/tables`);
       ok(rows, () => {
-        if (!rows?.length) return line(import_picocolors4.default.dim("No tables."));
+        if (!rows?.length) return line(import_picocolors5.default.dim("No tables."));
         for (const t of rows) {
-          const schema = t.table_schema && t.table_schema !== "public" ? import_picocolors4.default.dim(`${t.table_schema}.`) : "";
-          const cols = t.column_count != null ? import_picocolors4.default.dim(`  ${t.column_count} cols`) : "";
-          const count = t.row_count != null ? import_picocolors4.default.dim(`  ${t.row_count} rows`) : "";
-          const size = t.table_size != null ? import_picocolors4.default.dim(`  ${fmtBytes(t.table_size)}`) : "";
+          const schema = t.table_schema && t.table_schema !== "public" ? import_picocolors5.default.dim(`${t.table_schema}.`) : "";
+          const cols = t.column_count != null ? import_picocolors5.default.dim(`  ${t.column_count} cols`) : "";
+          const count = t.row_count != null ? import_picocolors5.default.dim(`  ${t.row_count} rows`) : "";
+          const size = t.table_size != null ? import_picocolors5.default.dim(`  ${fmtBytes(t.table_size)}`) : "";
           line(`${schema}${t.table_name}${cols}${count}${size}`);
         }
       });
@@ -3993,11 +4695,11 @@ function registerDb(program3) {
       const table = args[0];
       const cols = await api(ctx, `/v1/projects/${projectId}/db/tables/${encodeURIComponent(table)}/schema`);
       ok(cols, () => {
-        if (!cols?.length) return line(import_picocolors4.default.dim("No columns (does the table exist?)."));
+        if (!cols?.length) return line(import_picocolors5.default.dim("No columns (does the table exist?)."));
         for (const c of cols) {
-          const nn = c.is_nullable === "NO" || c.is_nullable === false ? import_picocolors4.default.dim("  not null") : "";
-          const def = c.column_default ? import_picocolors4.default.dim(`  default ${c.column_default}`) : "";
-          line(`${c.column_name}  ${import_picocolors4.default.cyan(c.data_type)}${nn}${def}`);
+          const nn = c.is_nullable === "NO" || c.is_nullable === false ? import_picocolors5.default.dim("  not null") : "";
+          const def = c.column_default ? import_picocolors5.default.dim(`  default ${c.column_default}`) : "";
+          line(`${c.column_name}  ${import_picocolors5.default.cyan(c.data_type)}${nn}${def}`);
         }
       });
     })
@@ -4023,23 +4725,23 @@ function registerDb(program3) {
 }
 function printRows(rows, total) {
   if (!rows?.length) {
-    line(import_picocolors4.default.dim("(0 rows)"));
+    line(import_picocolors5.default.dim("(0 rows)"));
     return;
   }
   const cols = Object.keys(rows[0]);
-  line(import_picocolors4.default.dim(cols.join("  ")));
+  line(import_picocolors5.default.dim(cols.join("  ")));
   for (const r of rows) {
     line(cols.map((c) => fmtCell(r[c])).join("  "));
   }
   const shown = rows.length;
   line(
-    import_picocolors4.default.dim(
+    import_picocolors5.default.dim(
       total != null && total > shown ? `(${shown} of ${total} rows)` : `(${shown} row${shown === 1 ? "" : "s"})`
     )
   );
 }
 function fmtCell(v) {
-  if (v === null || v === void 0) return import_picocolors4.default.dim("\u2205");
+  if (v === null || v === void 0) return import_picocolors5.default.dim("\u2205");
   if (typeof v === "object") return JSON.stringify(v);
   return String(v);
 }
@@ -4052,7 +4754,7 @@ function fmtBytes(n) {
 }
 
 // src/commands/auth.ts
-var import_picocolors5 = __toESM(require_picocolors(), 1);
+var import_picocolors6 = __toESM(require_picocolors(), 1);
 function registerAuth(program3) {
   const auth = program3.command("auth").description("Provision and inspect the project's auth (Better Auth)");
   auth.command("enable").description("Enable auth for the project (idempotent)").action(
@@ -4062,7 +4764,7 @@ function registerAuth(program3) {
       ok(res, () => {
         const providers = (res.providers ?? []).join(", ") || "email";
         line(
-          res.created === false ? `Auth already enabled${import_picocolors5.default.dim(`  (${providers})`)}.` : `Enabled auth ${import_picocolors5.default.dim(`(${providers})`)}.`
+          res.created === false ? `Auth already enabled${import_picocolors6.default.dim(`  (${providers})`)}.` : `Enabled auth ${import_picocolors6.default.dim(`(${providers})`)}.`
         );
       });
     })
@@ -4074,7 +4776,7 @@ function registerAuth(program3) {
       ok(res, () => {
         if (!res.enabled) return line("disabled");
         const providers = (res.providers ?? []).join(", ") || "email";
-        line(`enabled ${import_picocolors5.default.dim(`(${providers})`)}`);
+        line(`enabled ${import_picocolors6.default.dim(`(${providers})`)}`);
         if (res.authMode) line(`  mode: ${res.authMode}`);
         if (res.authMode === "neon_managed") {
           if (res.neonAuthOwnedBy) line(`  owned by: ${res.neonAuthOwnedBy}`);
@@ -4086,7 +4788,7 @@ function registerAuth(program3) {
 }
 
 // src/commands/storage.ts
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 import { readFile, writeFile } from "fs/promises";
 import { basename, dirname } from "path";
 function registerStorage(program3) {
@@ -4100,7 +4802,7 @@ function registerStorage(program3) {
       ok(
         res,
         () => line(
-          res.created === false ? `Bucket already exists${import_picocolors6.default.dim(`  (${res.bucket})`)}.` : `Provisioned bucket ${import_picocolors6.default.bold(res.bucket || "(pending)")}.`
+          res.created === false ? `Bucket already exists${import_picocolors7.default.dim(`  (${res.bucket})`)}.` : `Provisioned bucket ${import_picocolors7.default.bold(res.bucket || "(pending)")}.`
         )
       );
     })
@@ -4110,7 +4812,7 @@ function registerStorage(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/storage`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors6.default.dim("No bucket yet. `workser storage create`."));
+        if (!items?.length) return line(import_picocolors7.default.dim("No bucket yet. `workser storage create`."));
         for (const b of items) line(b.bucket ?? b.name);
       });
     })
@@ -4120,9 +4822,9 @@ function registerStorage(program3) {
       const projectId = requireProject(ctx);
       const objects = await listFiles(ctx, projectId, args[0]);
       ok(objects, () => {
-        if (!objects.length) return line(import_picocolors6.default.dim("No objects."));
+        if (!objects.length) return line(import_picocolors7.default.dim("No objects."));
         for (const o of objects) {
-          line(`${o.key}${import_picocolors6.default.dim(`  ${fmtSize(o.size)}${o.lastModified ? "  " + o.lastModified : ""}`)}`);
+          line(`${o.key}${import_picocolors7.default.dim(`  ${fmtSize(o.size)}${o.lastModified ? "  " + o.lastModified : ""}`)}`);
         }
       });
     })
@@ -4144,7 +4846,7 @@ function registerStorage(program3) {
       });
       ok(
         res,
-        () => success(`Uploaded ${import_picocolors6.default.bold(res.key ?? key)} ${import_picocolors6.default.dim(`(${fmtSize(bytes.length)})`)}.`)
+        () => success(`Uploaded ${import_picocolors7.default.bold(res.key ?? key)} ${import_picocolors7.default.dim(`(${fmtSize(bytes.length)})`)}.`)
       );
     })
   );
@@ -4163,7 +4865,7 @@ function registerStorage(program3) {
       await writeFile(out, bytes);
       ok(
         { key, dest: out, bytes: bytes.length },
-        () => success(`Downloaded ${import_picocolors6.default.bold(key)} \u2192 ${out} ${import_picocolors6.default.dim(`(${fmtSize(bytes.length)})`)}.`)
+        () => success(`Downloaded ${import_picocolors7.default.bold(key)} \u2192 ${out} ${import_picocolors7.default.dim(`(${fmtSize(bytes.length)})`)}.`)
       );
     })
   );
@@ -4194,8 +4896,253 @@ function fmtSize(n) {
   return `${(n / 1024 / 1024).toFixed(1)}MB`;
 }
 
+// src/commands/neon.ts
+var import_picocolors8 = __toESM(require_picocolors(), 1);
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2 } from "path";
+function registerNeon(program3) {
+  const neon = program3.command("neon").description(
+    "The project's own Neon backend: object storage buckets and functions"
+  );
+  neon.command("status").description(
+    "Whether this project can use Neon storage/functions (tenancy, toggles, region)"
+  ).action(
+    action(async ({ ctx }) => {
+      const projectId = requireProject(ctx);
+      const s = await api(ctx, `/v1/projects/${projectId}/neon-backend/status`);
+      ok(s, () => {
+        line(
+          `Dedicated infrastructure: ${s.dedicated ? import_picocolors8.default.green("yes") : import_picocolors8.default.yellow("no")}`
+        );
+        line(
+          `Region: ${s.regionId ? import_picocolors8.default.bold(s.regionId) : import_picocolors8.default.dim("unknown")}` + (s.regionId ? s.regionSupportsNeonBackend ? import_picocolors8.default.green("  (supported)") : import_picocolors8.default.red("  (Neon storage/functions unavailable here)") : "")
+        );
+        line(`Object storage: ${s.neonBackendStorageEnabled ? "on" : "off"}`);
+        line(`Functions:      ${s.neonBackendFunctionsEnabled ? "on" : "off"}`);
+        if (s.regionId && !s.regionSupportsNeonBackend) {
+          line(
+            import_picocolors8.default.dim(
+              `Supported regions: ${(s.supportedRegions ?? []).join(", ")}. A project's region is fixed at creation \u2014 this cannot be changed here.`
+            )
+          );
+        }
+      });
+    })
+  );
+  const storage = neon.command("storage").description("S3-compatible buckets on the project's Neon branch");
+  storage.command("list").description("List the project's Neon buckets").action(
+    action(async ({ ctx }) => {
+      const projectId = requireProject(ctx);
+      const buckets = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-storage/buckets`
+      );
+      ok(buckets, () => {
+        if (!buckets?.length)
+          return line(import_picocolors8.default.dim("No buckets. `workser neon storage create <name>`."));
+        for (const b of buckets)
+          line(`${b.bucket_name}${import_picocolors8.default.dim(`  (${b.access_level})`)}`);
+      });
+    })
+  );
+  storage.command("create <name>").description("Create a bucket on the project's Neon branch").option("--public", "Allow public reads (default: private)").action(
+    action(async ({ ctx, args, opts }) => {
+      const projectId = requireProject(ctx);
+      const res = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-storage/buckets`,
+        {
+          body: {
+            name: args[0],
+            accessLevel: opts.public ? "public_read" : "private"
+          }
+        }
+      );
+      ok(res, () => success(`Created bucket ${import_picocolors8.default.bold(res.bucket_name ?? args[0])}.`));
+    })
+  );
+  storage.command("rm <bucket>").description("Delete a bucket AND everything in it (asks for approval)").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const res = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-storage/buckets/${encodeURIComponent(args[0])}`,
+        { method: "DELETE" }
+      );
+      ok(res, () => success(`Deleted bucket ${args[0]}.`));
+    })
+  );
+  storage.command("ls <bucket> [prefix]").description("List objects in a bucket").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const res = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-storage/buckets/${encodeURIComponent(args[0])}/objects`,
+        { query: { prefix: args[1] } }
+      );
+      const objects = res?.objects ?? res ?? [];
+      ok(res, () => {
+        if (!objects.length) return line(import_picocolors8.default.dim("Empty."));
+        for (const o of objects)
+          line(`${o.key ?? o.name}${o.size ? import_picocolors8.default.dim(`  ${o.size} bytes`) : ""}`);
+      });
+    })
+  );
+  storage.command("put <bucket> <local> [key]").description("Upload a file (key defaults to the file's name)").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const [bucket, local] = args;
+      const key = args[2] || basename2(local);
+      const body = await readFile2(local).catch(() => {
+        throw new WorkserError(`Can't read ${local}.`, { code: "not_found" });
+      });
+      const signed = await presign(ctx, projectId, bucket, key, "upload");
+      const res = await fetch(signed.url, {
+        method: "PUT",
+        body,
+        headers: signed.headers ?? {}
+      });
+      if (!res.ok) {
+        throw new WorkserError(
+          `Upload failed (${res.status} ${res.statusText}).`,
+          { code: "upload_failed", status: res.status }
+        );
+      }
+      ok(
+        { bucket, key, bytes: body.length },
+        () => success(`Uploaded ${key} to ${bucket} ${import_picocolors8.default.dim(`(${body.length} bytes)`)}.`)
+      );
+    })
+  );
+  storage.command("get <bucket> <key> [dest]").description("Download an object (dest defaults to the key's file name)").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const [bucket, key] = args;
+      const dest = args[2] || basename2(key);
+      const signed = await presign(ctx, projectId, bucket, key, "download");
+      const res = await fetch(signed.url);
+      if (!res.ok) {
+        throw new WorkserError(
+          `Download failed (${res.status} ${res.statusText}).`,
+          { code: "download_failed", status: res.status }
+        );
+      }
+      const buf = Buffer.from(await res.arrayBuffer());
+      await writeFile2(dest, buf);
+      ok(
+        { bucket, key, dest, bytes: buf.length },
+        () => success(`Saved ${dest} ${import_picocolors8.default.dim(`(${buf.length} bytes)`)}.`)
+      );
+    })
+  );
+  storage.command("url <bucket> <key>").description("Print a temporary download URL for one object").option("--expires <seconds>", "Lifetime of the URL", "3600").action(
+    action(async ({ ctx, args, opts }) => {
+      const projectId = requireProject(ctx);
+      const signed = await presign(
+        ctx,
+        projectId,
+        args[0],
+        args[1],
+        "download",
+        Number(opts.expires) || 3600
+      );
+      ok(signed, () => line(signed.url));
+    })
+  );
+  storage.command("rm-object <bucket> <key>").description("Delete one object from a bucket (asks for approval)").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const res = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-storage/buckets/${encodeURIComponent(args[0])}/objects`,
+        { method: "DELETE", query: { key: args[1] } }
+      );
+      ok(res, () => success(`Deleted ${args[1]} from ${args[0]}.`));
+    })
+  );
+  const functions = neon.command("functions").description("Node.js HTTP functions on the project's Neon branch");
+  functions.command("list").description("List the project's Neon functions").action(
+    action(async ({ ctx }) => {
+      const projectId = requireProject(ctx);
+      const fns = await api(ctx, `/v1/projects/${projectId}/neon-functions`);
+      ok(fns, () => {
+        if (!fns?.length)
+          return line(import_picocolors8.default.dim("No functions. `workser neon functions deploy`."));
+        for (const f of fns)
+          line(`${f.slug ?? f.name}${f.url ? import_picocolors8.default.dim(`  ${f.url}`) : ""}`);
+      });
+    })
+  );
+  functions.command("deploy <slug> <zip>").description("Deploy a function from a zip bundle").option(
+    "--env <pairs...>",
+    "Environment variables for the function (KEY=VALUE)"
+  ).option("--runtime <runtime>", "Runtime override").action(
+    action(async ({ ctx, args, opts }) => {
+      const projectId = requireProject(ctx);
+      const [slug, zipPath] = args;
+      const zip = await readFile2(zipPath).catch(() => {
+        throw new WorkserError(`Can't read ${zipPath}.`, { code: "not_found" });
+      });
+      const environment = {};
+      for (const pair of opts.env ?? []) {
+        const eq = String(pair).indexOf("=");
+        if (eq <= 0) {
+          throw new WorkserError(
+            `--env expects KEY=VALUE, got "${pair}".`,
+            { code: "bad_request" }
+          );
+        }
+        environment[String(pair).slice(0, eq)] = String(pair).slice(eq + 1);
+      }
+      const res = await api(ctx, `/v1/projects/${projectId}/neon-functions`, {
+        body: {
+          slug,
+          // JSON rather than multipart: the caller is an agent shelling out,
+          // and base64 in a JSON body is the shape it can produce unaided.
+          zipBase64: zip.toString("base64"),
+          zipFilename: basename2(zipPath),
+          runtime: opts.runtime,
+          environment: Object.keys(environment).length ? environment : void 0
+        }
+      });
+      ok(
+        res,
+        () => success(
+          `Deployed ${import_picocolors8.default.bold(slug)}${res?.url ? import_picocolors8.default.dim(`  ${res.url}`) : ""}.`
+        )
+      );
+    })
+  );
+  functions.command("rm <slug>").description("Delete a function (asks for approval)").action(
+    action(async ({ ctx, args }) => {
+      const projectId = requireProject(ctx);
+      const res = await api(
+        ctx,
+        `/v1/projects/${projectId}/neon-functions/${encodeURIComponent(args[0])}`,
+        { method: "DELETE" }
+      );
+      ok(res, () => success(`Deleted function ${args[0]}.`));
+    })
+  );
+}
+async function presign(ctx, projectId, bucket, key, operation, expiresInSeconds) {
+  const res = await api(
+    ctx,
+    `/v1/projects/${projectId}/neon-storage/buckets/${encodeURIComponent(bucket)}/presign`,
+    { body: { key, operation, expiresInSeconds } }
+  );
+  const url = res?.url ?? res?.signedUrl ?? res?.presignedUrl;
+  if (!url) {
+    throw new WorkserError(
+      `The daemon did not return a presigned URL for ${key}.`,
+      { code: "unexpected_response", details: res }
+    );
+  }
+  return { url, headers: res?.headers };
+}
+
 // src/commands/env.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 function appQuery(opts) {
   const app = typeof opts?.app === "string" ? opts.app : "";
   return app ? `?webAppId=${encodeURIComponent(app)}` : "";
@@ -4218,7 +5165,7 @@ function registerEnv(program3) {
       ok(res, () => {
         success(`Set ${count} variable(s): ${pairs.map((p) => p.key).join(", ")}`);
         if (res?.usedDefault && res?.webAppName) {
-          line(import_picocolors7.default.dim(`on ${res.webAppName} (primary app) \u2014 use --app to target another`));
+          line(import_picocolors9.default.dim(`on ${res.webAppName} (primary app) \u2014 use --app to target another`));
         }
       });
     })
@@ -4238,8 +5185,8 @@ function registerEnv(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/env${appQuery(opts)}`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors7.default.dim("No variables set."));
-        for (const v of items) line(`${v.key}${import_picocolors7.default.dim(" = " + (v.masked ?? "\u2022\u2022\u2022\u2022"))}`);
+        if (!items?.length) return line(import_picocolors9.default.dim("No variables set."));
+        for (const v of items) line(`${v.key}${import_picocolors9.default.dim(" = " + (v.masked ?? "\u2022\u2022\u2022\u2022"))}`);
       });
     })
   );
@@ -4255,14 +5202,21 @@ function registerEnv(program3) {
 }
 
 // src/commands/deploy.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 var TERMINAL = /* @__PURE__ */ new Set(["ready", "live", "success", "error", "failed", "canceled"]);
 function registerDeploy(program3) {
-  const deploy = program3.command("deploy").description("Deploy the current project to Workser (git \u2192 Vercel) and return a live URL").option("--prod", "deploy to production", false).option("--watch", "wait for the deploy to finish, streaming status", false).action(
+  const deploy = program3.command("deploy").description("Deploy the current project to Workser (git \u2192 Vercel) and return a live URL").option("--prod", "deploy to production", false).option("--watch", "wait for the deploy to finish, streaming status", false).option(
+    "--app <webAppId>",
+    "which app to publish (default: the app this folder is linked to)"
+  ).action(
     action(async ({ ctx, opts }) => {
       const projectId = requireProject(ctx);
       const dep = await api(ctx, `/v1/projects/${projectId}/deploy`, {
-        body: { prod: Boolean(opts.prod), cwd: ctx.cwd }
+        body: {
+          prod: Boolean(opts.prod),
+          cwd: ctx.cwd,
+          ...opts.app ? { webAppId: opts.app } : {}
+        }
       });
       if (opts.watch && dep?.id) {
         const final = await watchDeploy(ctx, dep.id);
@@ -4284,7 +5238,7 @@ async function watchDeploy(ctx, id) {
   for (; ; ) {
     const dep = await api(ctx, `/v1/deployments/${encodeURIComponent(id)}`);
     if (!isJson() && dep.status !== last) {
-      line(`  ${colorStatus(dep.status)}${dep.url ? "  " + import_picocolors8.default.cyan(dep.url) : ""}`);
+      line(`  ${colorStatus(dep.status)}${dep.url ? "  " + import_picocolors10.default.cyan(dep.url) : ""}`);
       last = dep.status;
     }
     if (TERMINAL.has(String(dep.status).toLowerCase())) return dep;
@@ -4294,19 +5248,19 @@ async function watchDeploy(ctx, id) {
 function printDeploy(dep) {
   if (!dep) return;
   const ready = ["ready", "live", "success"].includes(String(dep.status).toLowerCase());
-  if (ready && dep.url) success(`Live at ${import_picocolors8.default.cyan(dep.url)}`);
-  else line(`deploy ${colorStatus(dep.status)} ${import_picocolors8.default.dim(`(${dep.id ?? "?"})`)}${dep.url ? "  " + dep.url : ""}`);
+  if (ready && dep.url) success(`Live at ${import_picocolors10.default.cyan(dep.url)}`);
+  else line(`deploy ${colorStatus(dep.status)} ${import_picocolors10.default.dim(`(${dep.id ?? "?"})`)}${dep.url ? "  " + dep.url : ""}`);
 }
 
 // src/commands/versions.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 function registerVersions(program3) {
   program3.command("versions").description("List the Workser-managed versions of the project (deploy history)").action(
     action(async ({ ctx }) => {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/versions`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors9.default.dim("No versions yet. `workser deploy` to create one."));
+        if (!items?.length) return line(import_picocolors11.default.dim("No versions yet. `workser deploy` to create one."));
         for (const v of items) {
           line(formatVersion(v));
         }
@@ -4315,11 +5269,11 @@ function registerVersions(program3) {
   );
 }
 function formatVersion(v) {
-  const ref = import_picocolors9.default.yellow(shortRef(v.ref));
-  const when = import_picocolors9.default.dim(formatTime(v.createdAt));
-  const msg = (v.message ?? "").trim() || import_picocolors9.default.dim("(no message)");
-  const badge = v.deployed ? "  " + import_picocolors9.default.green("deployed") : "";
-  const url = v.url ? "  " + import_picocolors9.default.cyan(v.url) : "";
+  const ref = import_picocolors11.default.yellow(shortRef(v.ref));
+  const when = import_picocolors11.default.dim(formatTime(v.createdAt));
+  const msg = (v.message ?? "").trim() || import_picocolors11.default.dim("(no message)");
+  const badge = v.deployed ? "  " + import_picocolors11.default.green("deployed") : "";
+  const url = v.url ? "  " + import_picocolors11.default.cyan(v.url) : "";
   return `${ref}  ${when}  ${msg}${badge}${url}`;
 }
 function shortRef(ref) {
@@ -4359,7 +5313,7 @@ function formatLog(e) {
 }
 
 // src/commands/domain.ts
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function registerDomain(program3) {
   const domain = program3.command("domain").description("Inspect the project's custom domains");
   domain.command("set <domain>").description("(owner-only) Attach a custom domain \u2014 do this in Workser Orbit").action(
@@ -4376,8 +5330,8 @@ function registerDomain(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/domains`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors10.default.dim("No custom domains."));
-        for (const d of items) line(`${d.domain}${import_picocolors10.default.dim("  " + (d.status ?? ""))}`);
+        if (!items?.length) return line(import_picocolors12.default.dim("No custom domains."));
+        for (const d of items) line(`${d.domain}${import_picocolors12.default.dim("  " + (d.status ?? ""))}`);
       });
     })
   );
@@ -4409,18 +5363,22 @@ function openUrl(url) {
 }
 
 // src/commands/doctor.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 function registerDoctor(program3) {
   program3.command("doctor").description("Print the resolved endpoint, mode, token presence (masked), and current project").action(
     action(({ ctx, opts }) => {
       const session = readSession();
       const link = readProjectLink(ctx.cwd);
+      const env = resolveEnv();
+      const envIgnored = Boolean(process.env.WORKSER_ENV) && ctx.mode === "cloud" && ctx.endpoint !== ENV_BASE_URLS[env];
       const tokenSource = opts.token ? "--token" : process.env.WORKSER_TOKEN ? "$WORKSER_TOKEN" : session.token ? "session" : void 0;
-      const endpointSource = opts.endpoint ? "--endpoint" : process.env.WORKSER_DAEMON_URL ? "$WORKSER_DAEMON_URL" : session.endpoint ? "session" : "cloud-default";
+      const endpointSource = opts.endpoint ? "--endpoint" : process.env.WORKSER_DAEMON_URL ? "$WORKSER_DAEMON_URL" : session.endpoint ? "session" : process.env.WORKSER_API_URL ? "$WORKSER_API_URL" : `cloud-default: ${env}`;
       const projectSource = opts.project ? "--project" : link?.projectId ? ".workser link" : session.defaultProjectId ? "session" : void 0;
       const report = {
         endpoint: ctx.endpoint,
         endpointSource,
+        env,
+        envIgnored,
         mode: ctx.mode,
         token: {
           present: Boolean(ctx.token),
@@ -4436,16 +5394,33 @@ function registerDoctor(program3) {
         workspace: session.workspaceName ?? null
       };
       ok(report, () => {
-        line(import_picocolors11.default.bold("workser doctor"));
-        line(`  endpoint:  ${ctx.endpoint} ${import_picocolors11.default.dim(`(${endpointSource})`)}`);
+        line(import_picocolors13.default.bold("workser doctor"));
+        line(`  endpoint:  ${ctx.endpoint} ${import_picocolors13.default.dim(`(${endpointSource})`)}`);
+        line(
+          `  env:       ${env === "prod" ? import_picocolors13.default.yellow(env) : env}` + import_picocolors13.default.dim(process.env.WORKSER_ENV ? "  ($WORKSER_ENV)" : "  (default)")
+        );
         line(`  mode:      ${ctx.mode}`);
         line(
-          `  token:     ${ctx.token ? `${maskToken(ctx.token)} ${import_picocolors11.default.dim(`(${tokenSource})`)}` : import_picocolors11.default.yellow("none \u2014 run `workser login`")}`
+          `  token:     ${ctx.token ? `${maskToken(ctx.token)} ${import_picocolors13.default.dim(`(${tokenSource})`)}` : import_picocolors13.default.yellow("none \u2014 run `workser login`")}`
         );
         line(
-          `  project:   ${ctx.projectId ?? import_picocolors11.default.dim("none")}` + (link?.name ? `  ${import_picocolors11.default.dim(`(${link.name})`)}` : "") + (projectSource ? import_picocolors11.default.dim(`  [${projectSource}]`) : "")
+          `  project:   ${ctx.projectId ?? import_picocolors13.default.dim("none")}` + (link?.name ? `  ${import_picocolors13.default.dim(`(${link.name})`)}` : "") + (projectSource ? import_picocolors13.default.dim(`  [${projectSource}]`) : "")
         );
         line(`  cwd:       ${ctx.cwd}`);
+        if (envIgnored) {
+          line("");
+          line(
+            import_picocolors13.default.yellow(
+              `  WORKSER_ENV=${env} is not in effect \u2014 ${endpointSource} wins.`
+            )
+          );
+          line(
+            import_picocolors13.default.dim(
+              `  Re-run \`workser login\` to switch (the saved token is tied to ${ctx.endpoint}),`
+            )
+          );
+          line(import_picocolors13.default.dim(`  or pass --endpoint ${ENV_BASE_URLS[env]}.`));
+        }
       });
     })
   );
@@ -4456,25 +5431,25 @@ function maskToken(token) {
 }
 
 // src/commands/agent.ts
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 function registerAgent(program3) {
   const agent = program3.command("agent").description("Delegate focused subtasks to your configured agent roles (each runs isolated)");
   agent.command("list").description("List the main agent (+ backup) and the configured subagents").action(
     action(async ({ ctx }) => {
       const cfg = await api(ctx, "/v1/agents");
       ok(cfg, () => {
-        line(import_picocolors12.default.bold("main agent:") + " " + (cfg?.mainAgent ?? import_picocolors12.default.dim("none")));
-        line(import_picocolors12.default.bold("backup agent:") + " " + (cfg?.backupAgent ?? import_picocolors12.default.dim("none")));
+        line(import_picocolors14.default.bold("main agent:") + " " + (cfg?.mainAgent ?? import_picocolors14.default.dim("none")));
+        line(import_picocolors14.default.bold("backup agent:") + " " + (cfg?.backupAgent ?? import_picocolors14.default.dim("none")));
         if (cfg?.effectiveMainAgent && cfg.effectiveMainAgent !== cfg.mainAgent) {
           line(
-            import_picocolors12.default.yellow(
+            import_picocolors14.default.yellow(
               `  \u2937 failover active: runs use ${cfg.effectiveMainAgent} (main not available)`
             )
           );
         }
         const roles = cfg?.roles ?? [];
-        if (!roles.length) return line(import_picocolors12.default.dim("No subagents configured. Add them in the Workser Orbit Agents screen."));
-        line(import_picocolors12.default.bold("subagents:"));
+        if (!roles.length) return line(import_picocolors14.default.dim("No subagents configured. Add them in the Workser Orbit Agents screen."));
+        line(import_picocolors14.default.bold("subagents:"));
         for (const r of roles) line("  " + formatRole(r));
       });
     })
@@ -4488,8 +5463,8 @@ function registerAgent(program3) {
           backupAgent: cfg?.backupAgent ?? null
         },
         () => {
-          line(import_picocolors12.default.bold("main agent:") + " " + (cfg?.mainAgent ?? import_picocolors12.default.dim("none")));
-          line(import_picocolors12.default.bold("backup agent:") + " " + (cfg?.backupAgent ?? import_picocolors12.default.dim("none")));
+          line(import_picocolors14.default.bold("main agent:") + " " + (cfg?.mainAgent ?? import_picocolors14.default.dim("none")));
+          line(import_picocolors14.default.bold("backup agent:") + " " + (cfg?.backupAgent ?? import_picocolors14.default.dim("none")));
         }
       );
     })
@@ -4511,21 +5486,21 @@ function registerAgent(program3) {
   );
 }
 function formatRole(r) {
-  const label = import_picocolors12.default.yellow(r.role);
-  const agent = import_picocolors12.default.dim("\xB7 " + (r.agent ?? "?"));
-  const enabled = r.enabled === false ? import_picocolors12.default.red("disabled") : import_picocolors12.default.green("enabled");
+  const label = import_picocolors14.default.yellow(r.role);
+  const agent = import_picocolors14.default.dim("\xB7 " + (r.agent ?? "?"));
+  const enabled = r.enabled === false ? import_picocolors14.default.red("disabled") : import_picocolors14.default.green("enabled");
   const runnable = r.installed && r.authed !== false;
-  const ready = runnable ? import_picocolors12.default.green("runnable") : import_picocolors12.default.dim("not runnable");
+  const ready = runnable ? import_picocolors14.default.green("runnable") : import_picocolors14.default.dim("not runnable");
   const extras = [];
   if (r.model) extras.push(`model ${r.model}`);
   if (Array.isArray(r.apps) && r.apps.length) extras.push(`apps: ${r.apps.join(",")}`);
   if (Array.isArray(r.mcp) && r.mcp.length) extras.push(`mcp: ${r.mcp.length}`);
-  const tail = extras.length ? "  " + import_picocolors12.default.dim(extras.join(" \xB7 ")) : "";
+  const tail = extras.length ? "  " + import_picocolors14.default.dim(extras.join(" \xB7 ")) : "";
   return `${label}  ${agent}  ${enabled}  ${ready}${tail}`;
 }
 
 // src/commands/verify.ts
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 function registerVerify(program3) {
   program3.command("verify").description(
     "Run the project's checks (typecheck/lint/build) \u2014 use before declaring a task done"
@@ -4546,23 +5521,23 @@ function registerVerify(program3) {
 function printVerify(res) {
   if (!res) return;
   if (!res.checks?.length) {
-    line(import_picocolors13.default.dim(res.note ?? "No checks detected."));
+    line(import_picocolors15.default.dim(res.note ?? "No checks detected."));
     return;
   }
   for (const c of res.checks) {
     line(
-      `  ${c.ok ? import_picocolors13.default.green("\u2713") : import_picocolors13.default.red("\u2717")} ${c.name}${c.ok ? "" : import_picocolors13.default.dim(` (exit ${c.exitCode})`)}`
+      `  ${c.ok ? import_picocolors15.default.green("\u2713") : import_picocolors15.default.red("\u2717")} ${c.name}${c.ok ? "" : import_picocolors15.default.dim(` (exit ${c.exitCode})`)}`
     );
   }
   if (res.ok) success("All checks passed");
   else
     line(
-      import_picocolors13.default.red("Some checks failed \u2014 fix the errors above and re-run ") + import_picocolors13.default.bold("workser verify") + import_picocolors13.default.red(".")
+      import_picocolors15.default.red("Some checks failed \u2014 fix the errors above and re-run ") + import_picocolors15.default.bold("workser verify") + import_picocolors15.default.red(".")
     );
 }
 
 // src/commands/workflow.ts
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 function registerWorkflow(program3) {
   const wf = program3.command("workflow").description("Create, run, and inspect workflow automations for the project");
   wf.command("list").description("List the project's workflows").action(
@@ -4570,10 +5545,10 @@ function registerWorkflow(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/workflows`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors14.default.dim("No workflows yet. `workser workflow create`."));
+        if (!items?.length) return line(import_picocolors16.default.dim("No workflows yet. `workser workflow create`."));
         for (const w of items) {
-          const status = w.is_active ? import_picocolors14.default.green("active") : import_picocolors14.default.dim("inactive");
-          line(`${w.id}  ${import_picocolors14.default.bold(w.name ?? "Untitled")}  ${status}`);
+          const status = w.is_active ? import_picocolors16.default.green("active") : import_picocolors16.default.dim("inactive");
+          line(`${w.id}  ${import_picocolors16.default.bold(w.name ?? "Untitled")}  ${status}`);
         }
       });
     })
@@ -4585,7 +5560,7 @@ function registerWorkflow(program3) {
       const res = await api(ctx, `/v1/projects/${projectId}/workflows`, {
         body: { name: args[0], ...extra }
       });
-      ok(res, () => line(`Created workflow ${import_picocolors14.default.bold(res.id)}.`));
+      ok(res, () => line(`Created workflow ${import_picocolors16.default.bold(res.id)}.`));
     })
   );
   wf.command("get <id>").description("Show a workflow's full definition").action(
@@ -4620,8 +5595,8 @@ function registerWorkflow(program3) {
     action(async ({ ctx, args }) => {
       const items = await api(ctx, `/v1/workflows/${args[0]}/executions`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors14.default.dim("No runs yet."));
-        for (const e of items) line(`${e.id}  ${e.status ?? ""}  ${import_picocolors14.default.dim(e.started_at ?? "")}`);
+        if (!items?.length) return line(import_picocolors16.default.dim("No runs yet."));
+        for (const e of items) line(`${e.id}  ${e.status ?? ""}  ${import_picocolors16.default.dim(e.started_at ?? "")}`);
       });
     })
   );
@@ -4629,15 +5604,15 @@ function registerWorkflow(program3) {
     action(async ({ ctx, args }) => {
       const items = await api(ctx, `/v1/node-types`, { query: { q: args[0] } });
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors14.default.dim("No matching node types."));
-        for (const n of items) line(`${n.name ?? n.type}  ${import_picocolors14.default.dim(n.category ?? "")}`);
+        if (!items?.length) return line(import_picocolors16.default.dim("No matching node types."));
+        for (const n of items) line(`${n.name ?? n.type}  ${import_picocolors16.default.dim(n.category ?? "")}`);
       });
     })
   );
 }
 
 // src/commands/app.ts
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 function registerApp(program3) {
   const appCmd = program3.command("app").description("Connect and use third-party app integrations (Gmail, Slack, Stripe, ...)");
   appCmd.command("list").description("List connectable toolkits and this project's existing connections").option("--toolkit <slug>", "filter connections to one toolkit").action(
@@ -4650,8 +5625,8 @@ function registerApp(program3) {
       ok({ catalog, connections }, () => {
         const connected = new Set((connections ?? []).map((c) => c.toolkit ?? c.composio_app));
         for (const t of catalog ?? []) {
-          const status = connected.has(t.slug) ? import_picocolors15.default.green("connected") : import_picocolors15.default.dim("not connected");
-          line(`${t.slug}  ${import_picocolors15.default.bold(t.name ?? t.slug)}  ${status}`);
+          const status = connected.has(t.slug) ? import_picocolors17.default.green("connected") : import_picocolors17.default.dim("not connected");
+          line(`${t.slug}  ${import_picocolors17.default.bold(t.name ?? t.slug)}  ${status}`);
         }
       });
     })
@@ -4668,7 +5643,7 @@ function registerApp(program3) {
       });
       ok(
         res,
-        () => res.oauth_url ? line(`Open this URL to finish connecting: ${import_picocolors15.default.underline(res.oauth_url)}`) : line(`Connection ${res.connection_id} is ${res.status}.`)
+        () => res.oauth_url ? line(`Open this URL to finish connecting: ${import_picocolors17.default.underline(res.oauth_url)}`) : line(`Connection ${res.connection_id} is ${res.status}.`)
       );
     })
   );
@@ -4686,8 +5661,8 @@ function registerApp(program3) {
       const projectId = requireProject(ctx);
       const items = await api(ctx, `/v1/projects/${projectId}/integrations/${args[0]}/tools`);
       ok(items, () => {
-        if (!items?.length) return line(import_picocolors15.default.dim("No tools found."));
-        for (const t of items) line(`${t.slug}  ${import_picocolors15.default.dim(t.description ?? "")}`);
+        if (!items?.length) return line(import_picocolors17.default.dim("No tools found."));
+        for (const t of items) line(`${t.slug}  ${import_picocolors17.default.dim(t.description ?? "")}`);
       });
     })
   );
@@ -4703,7 +5678,7 @@ function registerApp(program3) {
 }
 
 // src/commands/tool.ts
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 function registerTool(program3) {
   const tool = program3.command("tool").description(
     "Computer-use tools: filesystem, shell, screenshot, input control, clipboard, notifications, basic browser"
@@ -4712,7 +5687,7 @@ function registerTool(program3) {
     action(async ({ ctx }) => {
       const tools = await api(ctx, "/v1/tool/list");
       ok(tools, () => {
-        if (!tools?.length) return line(import_picocolors16.default.dim("No tools available."));
+        if (!tools?.length) return line(import_picocolors18.default.dim("No tools available."));
         const byCategory = /* @__PURE__ */ new Map();
         for (const t of tools) {
           const list = byCategory.get(t.category) ?? [];
@@ -4720,9 +5695,9 @@ function registerTool(program3) {
           byCategory.set(t.category, list);
         }
         for (const [category, items] of byCategory) {
-          line(import_picocolors16.default.bold(category) + ":");
+          line(import_picocolors18.default.bold(category) + ":");
           for (const t of items) {
-            line(`  ${t.name}  ${import_picocolors16.default.dim(t.description ?? "")}`);
+            line(`  ${t.name}  ${import_picocolors18.default.dim(t.description ?? "")}`);
           }
         }
       });
@@ -4740,7 +5715,7 @@ function registerTool(program3) {
 }
 
 // src/commands/memory.ts
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 function registerMemory(program3) {
   const memory = program3.command("memory").description("Durable, cross-conversation project memory (shared with cloud agents on the same project)");
   memory.command("add <content>").description("Store something worth remembering across future conversations").option("--metadata <json>", "extra metadata for filtering, as a JSON string").option("--id <customId>", "custom id for dedup/updates").action(
@@ -4764,9 +5739,9 @@ function registerMemory(program3) {
       });
       ok(res, () => {
         const results = res?.results ?? res ?? [];
-        if (!results?.length) return line(import_picocolors17.default.dim("No matching memories."));
+        if (!results?.length) return line(import_picocolors19.default.dim("No matching memories."));
         for (const r of results) {
-          line(`${import_picocolors17.default.dim(r.id ?? "?")}  ${r.memory ?? r.content ?? ""}`);
+          line(`${import_picocolors19.default.dim(r.id ?? "?")}  ${r.memory ?? r.content ?? ""}`);
         }
       });
     })
@@ -4783,7 +5758,7 @@ function registerMemory(program3) {
 }
 
 // src/commands/business.ts
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 var RESOURCE_PATHS = {
   "business-config": "business-config",
   "business-settings": "business-settings",
@@ -4843,7 +5818,7 @@ function registerBusiness(program3) {
       const projectId = requireProject(ctx);
       const [resource] = args;
       const res = await api(ctx, businessPath(projectId, resource), { body: JSON.parse(opts.body) });
-      ok(res, () => line(`Created ${resource} ${import_picocolors18.default.bold(res?.id ?? "")}.`));
+      ok(res, () => line(`Created ${resource} ${import_picocolors20.default.bold(res?.id ?? "")}.`));
     })
   );
   biz.command("update <resource> <id>").description("Update a record by id (PATCH/PUT \u2014 matches the underlying route)").option("--body <json>", "changed fields as a JSON object string", "{}").action(
@@ -4885,9 +5860,9 @@ function businessPath(projectId, resource, subpath) {
 }
 
 // src/commands/artifact.ts
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 import { existsSync as existsSync2, statSync } from "fs";
-import { resolve as resolve2, basename as basename2 } from "path";
+import { resolve as resolve2, basename as basename3 } from "path";
 var KINDS = [
   "file",
   "folder",
@@ -4944,14 +5919,14 @@ function registerArtifact(program3) {
           path: absPath,
           url,
           kind,
-          title: opts.title || (absPath ? basename2(absPath) : url),
+          title: opts.title || (absPath ? basename3(absPath) : url),
           description: opts.description
         }
       });
       ok(
         res,
         () => success(
-          `Recorded ${import_picocolors19.default.bold(res?.title ?? "artifact")}${res?.kind ? import_picocolors19.default.dim(` (${res.kind})`) : ""}`
+          `Recorded ${import_picocolors21.default.bold(res?.title ?? "artifact")}${res?.kind ? import_picocolors21.default.dim(` (${res.kind})`) : ""}`
         )
       );
     })
@@ -4965,15 +5940,85 @@ function registerArtifact(program3) {
 }
 function printRun(run) {
   if (!run) return;
-  line(`  run      ${import_picocolors19.default.bold(run.runId)}`);
+  line(`  run      ${import_picocolors21.default.bold(run.runId)}`);
   if (run.taskId) line(`  task     ${run.taskId}`);
   if (run.conversationId) line(`  chat     ${run.conversationId}`);
   if (run.projectId) line(`  project  ${run.projectId}`);
-  if (run.cwd) line(`  folder   ${import_picocolors19.default.dim(run.cwd)}`);
+  if (run.cwd) line(`  folder   ${import_picocolors21.default.dim(run.cwd)}`);
+}
+
+// src/commands/image.ts
+import { writeFile as writeFile3, mkdir } from "fs/promises";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+function registerImage(program3) {
+  const image = program3.command("image").description("Generate images from a text prompt");
+  image.command("generate <prompt>").alias("gen").description("Generate an image and return its public URL").option(
+    "-r, --reference <url...>",
+    "condition on existing image URLs (image-to-image); up to 4"
+  ).option(
+    "-o, --output <path>",
+    "also download the first image to this local path"
+  ).action(
+    action(async ({ ctx, opts, args }) => {
+      const projectId = requireProject(ctx);
+      const prompt = String(args[0] ?? "").trim();
+      if (!prompt) {
+        throw new WorkserError("A prompt is required.", {
+          code: "bad_request"
+        });
+      }
+      const references = opts.reference?.filter(
+        Boolean
+      );
+      const res = await api(
+        ctx,
+        `/projects/${projectId}/images/generate`,
+        {
+          method: "POST",
+          body: {
+            prompt,
+            ...references?.length ? { referenceImageUrls: references.slice(0, 4) } : {}
+          }
+        }
+      );
+      const images = res.images ?? [];
+      if (!images.length) {
+        const said = res.texts?.join(" ").trim();
+        throw new WorkserError(
+          said ? `No image was generated. The model said: ${said}` : "No image was generated.",
+          { code: "no_image" }
+        );
+      }
+      let savedTo;
+      if (opts.output) {
+        savedTo = await download(images[0].publicUrl, String(opts.output));
+      }
+      ok({ images, texts: res.texts, savedTo }, () => {
+        for (const img of images) {
+          success(img.publicUrl);
+        }
+        if (savedTo) info(`Saved to ${savedTo}`);
+        for (const text of res.texts ?? []) line(text);
+      });
+    })
+  );
+}
+async function download(url, output) {
+  const target = resolve3(output);
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new WorkserError(
+      `The image was generated but could not be downloaded (${res.status}). It is still available at ${url}`,
+      { code: "download_failed" }
+    );
+  }
+  await mkdir(dirname2(target), { recursive: true });
+  await writeFile3(target, Buffer.from(await res.arrayBuffer()));
+  return target;
 }
 
 // src/commands/ask.ts
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 var TYPES = [
   "input",
   "choice",
@@ -5024,7 +6069,7 @@ function registerAsk(program3) {
           code: "bad_request"
         });
       }
-      info(import_picocolors20.default.dim("Waiting for the user to answer\u2026"));
+      info(import_picocolors22.default.dim("Waiting for the user to answer\u2026"));
       const res = await api(ctx, `/v1/runs/${runTarget(ctx)}/ask`, {
         body: {
           type,
@@ -5050,12 +6095,12 @@ function deriveTitle(message) {
 function printAnswer(res) {
   if (!res) return;
   if (res.status === "answered") {
-    line(`  ${import_picocolors20.default.green("answered")}`);
+    line(`  ${import_picocolors22.default.green("answered")}`);
     const value = extract(res.response);
     if (value) line(`  ${value}`);
     return;
   }
-  line(`  ${import_picocolors20.default.yellow(res.status)}  ${import_picocolors20.default.dim(res.reason ?? "")}`);
+  line(`  ${import_picocolors22.default.yellow(res.status)}  ${import_picocolors22.default.dim(res.reason ?? "")}`);
 }
 function extract(response) {
   if (response == null) return "";
@@ -5075,15 +6120,22 @@ function extract(response) {
 
 // src/index.ts
 var pkg = {
-  version: true ? "0.1.0" : "0.0.0-dev"
+  version: true ? "0.2.1" : "0.0.0-dev"
 };
 var program2 = new Command();
 program2.name("workser").description(
   "Workser CLI \u2014 give your local AI agent native DevOps & infrastructure.\nThe agent runs `workser \u2026` to provision databases, deploy, and manage real apps\non Workser \u2014 on the user's own tokens, through the Orbit cockpit (auth + approvals)."
-).version(pkg.version, "-v, --version", "print the CLI version").option("--json", "machine-readable JSON output (always use this from agents/scripts)").option("-q, --quiet", "suppress non-essential output").option("-p, --project <id>", "target project id (overrides the linked project)").option("-C, --cwd <dir>", "run as if started in <dir>").option("--endpoint <url>", "override the Workser endpoint (daemon or cloud)").option("--token <token>", "override the auth token").hook("preAction", (thisCommand, actionCommand) => {
+).version(pkg.version, "-v, --version", "print the CLI version").option(
+  "--json",
+  "machine-readable JSON output (always use this from agents/scripts)"
+).option("-q, --quiet", "suppress non-essential output").option(
+  "-p, --project <id>",
+  "target project id (overrides the linked project)"
+).option("-C, --cwd <dir>", "run as if started in <dir>").option("--endpoint <url>", "override the Workser endpoint (daemon or cloud)").option("--token <token>", "override the auth token").hook("preAction", (thisCommand, actionCommand) => {
   const o = actionCommand.optsWithGlobals();
   configureOutput({ json: o.json, quiet: o.quiet });
 });
+registerHelp(program2);
 registerStatus(program2);
 registerLogin(program2);
 registerWhoami(program2);
@@ -5091,6 +6143,7 @@ registerProject(program2);
 registerDb(program2);
 registerAuth(program2);
 registerStorage(program2);
+registerNeon(program2);
 registerEnv(program2);
 registerDeploy(program2);
 registerVersions(program2);
@@ -5106,5 +6159,6 @@ registerTool(program2);
 registerMemory(program2);
 registerBusiness(program2);
 registerArtifact(program2);
+registerImage(program2);
 registerAsk(program2);
 program2.parseAsync(process.argv).catch((e) => fail(e));