gigadrive 2.6.2 → 2.7.0

package/dist/index.cjs

@@ -24,15 +24,15 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/index.ts
-var import_cli15 = require("@effect/cli");
+var import_cli16 = require("@effect/cli");
 var import_platform_node = require("@effect/platform-node");
 var import_network_config2 = require("@gigadrive/network-config");
-var import_effect29 = require("effect");
+var import_effect30 = require("effect");
 
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.6.2",
+  version: "2.7.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -149,7 +149,9 @@ var UserInfoFetchError = class extends import_effect.Schema.TaggedError()("UserI
 var ApiRequestError = class extends import_effect.Schema.TaggedError()("ApiRequestError", {
   message: import_effect.Schema.String,
   statusCode: import_effect.Schema.optional(import_effect.Schema.Number),
-  code: import_effect.Schema.optional(import_effect.Schema.String)
+  code: import_effect.Schema.optional(import_effect.Schema.String),
+  /** Finer-grained reason next to `code`, for example `daily_add_limit`. */
+  reason: import_effect.Schema.optional(import_effect.Schema.String)
 }) {
 };
 var InvalidEnvVarFormatError = class extends import_effect.Schema.TaggedError()(
@@ -163,6 +165,30 @@ var EnvVarNotFoundError = class extends import_effect.Schema.TaggedError()("EnvV
   message: import_effect.Schema.String
 }) {
 };
+var DomainNotFoundError = class extends import_effect.Schema.TaggedError()("DomainNotFoundError", {
+  message: import_effect.Schema.String
+}) {
+};
+var DomainWaitError = class extends import_effect.Schema.TaggedError()("DomainWaitError", {
+  message: import_effect.Schema.String,
+  state: import_effect.Schema.String
+}) {
+};
+var InvalidDomainOptionsError = class extends import_effect.Schema.TaggedError()(
+  "InvalidDomainOptionsError",
+  { message: import_effect.Schema.String }
+) {
+};
+var ConfirmationRequiredError = class extends import_effect.Schema.TaggedError()(
+  "ConfirmationRequiredError",
+  { message: import_effect.Schema.String }
+) {
+};
+var OrganizationRequiredError = class extends import_effect.Schema.TaggedError()(
+  "OrganizationRequiredError",
+  { message: import_effect.Schema.String }
+) {
+};
 var NoApplicationsFoundError = class extends import_effect.Schema.TaggedError()(
   "NoApplicationsFoundError",
   {
@@ -964,7 +990,12 @@ var ServiceCredentials = import_effect6.Config.all({
 });
 var toApiRequestError = (error) => {
   if (error instanceof import_sdk.ApiError) {
-    return new ApiRequestError({ message: error.message, statusCode: error.status, code: error.code });
+    return new ApiRequestError({
+      message: error.message,
+      statusCode: error.status,
+      code: error.code,
+      reason: error.reason
+    });
   }
   return new ApiRequestError({ message: error instanceof Error ? error.message : String(error) });
 };
@@ -1607,7 +1638,8 @@ var wrapParseErrors = (effect) => effect.pipe(
     ConfigModuleLoadError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.cause ?? e.filePath })),
     ConfigVersionError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.filePath })),
     ConfigSchemaValidationError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.validationErrors.join(", ") })),
-    FunctionConfigError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.functionPath }))
+    FunctionConfigError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.functionPath })),
+    ContainerConfigError: (e) => import_effect12.Effect.fail(new ConfigParseError({ message: e.message, cause: e.filePath ?? e.containerName }))
   })
 );
 var ProjectConfigService = class extends import_effect12.Effect.Service()("ProjectConfigService", {
@@ -1654,12 +1686,18 @@ var ProjectConfigService = class extends import_effect12.Effect.Service()("Proje
         config = yield* wrapParseErrors((0, import_network_config.postProcessConfig)(detection.config, cwd));
         framework = { name: detection.framework.name, slug: detection.framework.slug };
       } else {
-        return yield* import_effect12.Effect.fail(
-          new ConfigNotFoundError({
-            message: "No config file found and no framework detected.",
-            directory: cwd
-          })
+        const containerProject = yield* wrapParseErrors(
+          (0, import_network_config.detectContainerProject)(cwd).pipe(import_effect12.Effect.map((result) => result?.config ?? null))
         );
+        if (containerProject === null) {
+          return yield* import_effect12.Effect.fail(
+            new ConfigNotFoundError({
+              message: "No config file, framework, Compose file or Dockerfile found.",
+              directory: cwd
+            })
+          );
+        }
+        config = yield* wrapParseErrors((0, import_network_config.postProcessConfig)(containerProject, cwd));
       }
       for (const warning of config.warnings) {
         yield* import_effect12.Effect.logWarning(warning);
@@ -1799,13 +1837,553 @@ var deploymentsCommand = deploymentsBase.pipe(
   import_cli6.Command.withSubcommands([deploymentsListCommand, deploymentsInspectCommand])
 );
 
-// src/commands/env/index.ts
+// src/commands/domains/index.ts
 var import_cli7 = require("@effect/cli");
-var import_effect19 = require("effect");
+var import_effect16 = require("effect");
+
+// src/lib/domain-output.ts
+var DOMAIN_STATE_LABELS = {
+  pending_ownership: "verifying ownership",
+  pending_dns: "waiting for DNS",
+  issuing_certificate: "issuing certificate",
+  active: "active",
+  degraded: "needs attention",
+  failed: "failed",
+  suspended: "suspended",
+  removing: "removing"
+};
+var RECORD_STATUS_LABELS = {
+  ok: "found",
+  pending: "waiting",
+  mismatch: "different value"
+};
+var IN_PROGRESS_STATES = /* @__PURE__ */ new Set([
+  "pending_ownership",
+  "pending_dns",
+  "issuing_certificate"
+]);
+var formatDnsRecords = (records) => {
+  if (records.length === 0) return [];
+  const rows = [
+    ["Type", "Name", "Value", "Status"],
+    ...records.map((record) => [record.type, record.host, record.value, RECORD_STATUS_LABELS[record.status]])
+  ];
+  const widths = [0, 1, 2].map((column) => Math.max(...rows.map((row) => row[column].length)));
+  return rows.map(
+    (row) => row.map((cell, column) => column < widths.length ? cell.padEnd(widths[column]) : cell).join("  ").trimEnd()
+  );
+};
+var describeDomain = (domain) => {
+  const lines = [
+    `${domain.unicodeHostname}  ${DOMAIN_STATE_LABELS[domain.state]}${domain.primary ? "  (primary)" : ""}`
+  ];
+  if (domain.target.type === "redirect" && domain.target.redirectTo !== null) {
+    lines.push(`Redirects to ${domain.target.redirectTo} (${domain.target.redirectStatusCode ?? 308})`);
+  } else if (domain.target.type === "branch") {
+    lines.push(`Serves branch ${domain.target.branchId ?? "unknown"}`);
+  }
+  if (domain.error !== null) lines.push(`Problem (${domain.error.code}): ${domain.error.message}`);
+  if (domain.certificate.expiresAt !== null) lines.push(`Certificate expires ${domain.certificate.expiresAt}`);
+  return lines;
+};
+
+// src/commands/domains/index.ts
+var REDIRECT_STATUS_CODES = ["301", "302", "307", "308"];
+var CONSOLE_URL = "https://console.gigadrive.de";
+var POLL_INTERVAL = import_effect16.Duration.seconds(5);
+var appOption3 = import_cli7.Options.text("app").pipe(
+  import_cli7.Options.withAlias("a"),
+  import_cli7.Options.withDescription("Operate on this application (overrides the linked application)"),
+  import_cli7.Options.optional
+);
+var orgOption3 = import_cli7.Options.text("org").pipe(
+  import_cli7.Options.withAlias("o"),
+  import_cli7.Options.withDescription("Operate on this organization (defaults to the linked project\u2019s organization)"),
+  import_cli7.Options.optional
+);
+var jsonOption = import_cli7.Options.boolean("json").pipe(
+  import_cli7.Options.withDescription("Print only the result as JSON on stdout; progress goes to stderr")
+);
+var waitOption = import_cli7.Options.boolean("wait").pipe(
+  import_cli7.Options.withAlias("w"),
+  import_cli7.Options.withDescription("Wait until the domain serves traffic, printing each state change")
+);
+var timeoutOption = import_cli7.Options.integer("timeout").pipe(
+  import_cli7.Options.withDescription("Minutes to wait with --wait, at least 1 (default: 10)"),
+  import_cli7.Options.withDefault(10)
+);
+var branchOption = import_cli7.Options.text("branch").pipe(
+  import_cli7.Options.withDescription("Serve the latest deployment of this branch ID instead of production"),
+  import_cli7.Options.optional
+);
+var productionOption = import_cli7.Options.boolean("production").pipe(
+  import_cli7.Options.withDescription("Serve the production deployment (the default for new domains)")
+);
+var redirectToOption = import_cli7.Options.text("redirect-to").pipe(
+  import_cli7.Options.withDescription("Redirect every request to this hostname instead of serving the application"),
+  import_cli7.Options.optional
+);
+var statusOption2 = import_cli7.Options.choice("status", REDIRECT_STATUS_CODES).pipe(
+  import_cli7.Options.withDescription("Redirect status code with --redirect-to (default: 308)"),
+  import_cli7.Options.optional
+);
+var dropPathOption = import_cli7.Options.boolean("drop-path").pipe(
+  import_cli7.Options.withDescription("With --redirect-to, redirect to the root instead of keeping the path and query")
+);
+var primaryOption = import_cli7.Options.boolean("primary").pipe(
+  import_cli7.Options.withDescription("Make this domain the application\u2019s primary URL")
+);
+var yesOption = import_cli7.Options.boolean("yes").pipe(
+  import_cli7.Options.withAlias("y"),
+  import_cli7.Options.withDescription("Skip the confirmation prompt (required when not running in a terminal)")
+);
+var hostnameArg = import_cli7.Args.text({ name: "hostname" }).pipe(
+  import_cli7.Args.withDescription("Hostname to attach, e.g. shop.example.com or example.com")
+);
+var domainArg = import_cli7.Args.text({ name: "hostname-or-id" }).pipe(import_cli7.Args.withDescription("Domain hostname or ID"));
+var targetFromFlags = (flags) => import_effect16.Effect.gen(function* () {
+  const chosen = [flags.production, import_effect16.Option.isSome(flags.branch), import_effect16.Option.isSome(flags.redirectTo)].filter(Boolean);
+  if (chosen.length > 1) {
+    return yield* new InvalidDomainOptionsError({
+      message: "Choose one target: --production, --branch or --redirect-to."
+    });
+  }
+  if (import_effect16.Option.isNone(flags.redirectTo) && (import_effect16.Option.isSome(flags.status) || flags.dropPath)) {
+    return yield* new InvalidDomainOptionsError({
+      message: "--status and --drop-path only apply together with --redirect-to."
+    });
+  }
+  if (import_effect16.Option.isSome(flags.redirectTo)) {
+    const target = {
+      type: "redirect",
+      to: flags.redirectTo.value,
+      statusCode: import_effect16.Option.match(flags.status, {
+        onNone: () => void 0,
+        onSome: (code) => code === "301" ? 301 : code === "302" ? 302 : code === "307" ? 307 : 308
+      }),
+      preservePath: !flags.dropPath
+    };
+    return target;
+  }
+  if (import_effect16.Option.isSome(flags.branch)) {
+    const target = { type: "branch", branchId: flags.branch.value };
+    return target;
+  }
+  if (flags.production) {
+    const target = { type: "production" };
+    return target;
+  }
+  return void 0;
+});
+var requirePositiveTimeout = (minutes) => minutes >= 1 ? import_effect16.Effect.succeed(minutes) : new InvalidDomainOptionsError({ message: "--timeout must be at least 1 minute." });
+var confirm = (message, yes) => import_effect16.Effect.gen(function* () {
+  if (yes) return true;
+  if (process.stdin.isTTY !== true) {
+    return yield* new ConfirmationRequiredError({
+      message: "Not running in a terminal, so there is no way to confirm. Pass --yes to proceed."
+    });
+  }
+  return yield* import_cli7.Prompt.run(import_cli7.Prompt.confirm({ message, initial: false }));
+});
+var resolveApplication = (app) => import_effect16.Option.match(app, {
+  onSome: (value) => import_effect16.Effect.succeed(value),
+  onNone: () => import_effect16.Effect.gen(function* () {
+    const projectLink = yield* ProjectLinkService;
+    const link = yield* projectLink.resolve(process.cwd());
+    return link.applicationId;
+  })
+});
+var resolveOrganization = (org) => import_effect16.Option.match(org, {
+  onSome: (value) => import_effect16.Effect.succeed(value),
+  onNone: () => import_effect16.Effect.gen(function* () {
+    const projectLink = yield* ProjectLinkService;
+    const link = yield* projectLink.load(process.cwd());
+    const organizationId = import_effect16.Option.flatMap(link, (value) => import_effect16.Option.fromNullable(value.organizationId));
+    if (import_effect16.Option.isNone(organizationId)) {
+      return yield* new OrganizationRequiredError({
+        message: "Pass --org, or run the command in a linked project."
+      });
+    }
+    return organizationId.value;
+  })
+});
+var normalizeHostname = (value) => value.trim().toLowerCase().replace(/\.$/, "");
+var findDomain = (applicationId, hostnameOrId) => import_effect16.Effect.gen(function* () {
+  const apiClient = yield* ApiClientService;
+  const { items } = yield* apiClient.request((client) => client.applications.domains.list(applicationId));
+  const wanted = normalizeHostname(hostnameOrId);
+  const domain = items.find(
+    (item) => item.id === hostnameOrId || item.hostname === wanted || item.unicodeHostname === wanted
+  );
+  if (!domain) {
+    return yield* new DomainNotFoundError({ message: `No custom domain ${hostnameOrId} on this application.` });
+  }
+  return domain;
+});
+var printDomain = (domain) => import_effect16.Effect.gen(function* () {
+  for (const line of describeDomain(domain)) yield* import_effect16.Console.log(line);
+  const pending = domain.requiredRecords.filter((record) => record.status !== "ok");
+  const records = formatDnsRecords(pending);
+  if (records.length > 0 && domain.state !== "removing") {
+    yield* import_effect16.Console.log("\nAdd these records at your DNS provider:");
+    for (const line of records) yield* import_effect16.Console.log(`  ${line}`);
+    if (pending.some((record) => record.type === "ALIAS")) {
+      yield* import_effect16.Console.log(
+        "\nApex domains need an ALIAS, ANAME or flattened CNAME record. Without one, attach www instead and redirect the apex to it."
+      );
+    }
+  }
+});
+var isTransient = (error) => error._tag === "ApiRequestError" && (error.statusCode === void 0 || error.statusCode === 429 || error.statusCode >= 500);
+var waitUntilServing = (applicationId, initial, timeoutMinutes, json) => import_effect16.Effect.gen(function* () {
+  const apiClient = yield* ApiClientService;
+  const progress = (line) => json ? import_effect16.Console.error(line) : import_effect16.Console.log(line);
+  const fail = (domain2, message) => import_effect16.Effect.gen(function* () {
+    if (json) yield* import_effect16.Console.log(JSON.stringify(domain2, null, 2));
+    return yield* new DomainWaitError({ message, state: domain2.state });
+  });
+  const deadline = (yield* import_effect16.Clock.currentTimeMillis) + import_effect16.Duration.toMillis(import_effect16.Duration.minutes(timeoutMinutes));
+  let domain = initial;
+  yield* progress(`Waiting for ${domain.unicodeHostname} (${DOMAIN_STATE_LABELS[domain.state]})...`);
+  while (IN_PROGRESS_STATES.has(domain.state)) {
+    const remaining = deadline - (yield* import_effect16.Clock.currentTimeMillis);
+    if (remaining <= 0) {
+      return yield* fail(
+        domain,
+        `${domain.unicodeHostname} is not serving yet (${DOMAIN_STATE_LABELS[domain.state]}). Check again later with "gigadrive domains inspect ${domain.hostname}".`
+      );
+    }
+    yield* import_effect16.Effect.sleep(import_effect16.Duration.min(POLL_INTERVAL, import_effect16.Duration.millis(remaining)));
+    const polled = yield* import_effect16.Effect.either(
+      apiClient.request((client) => client.applications.domains.get(applicationId, domain.id))
+    );
+    if (import_effect16.Either.isLeft(polled)) {
+      if (isTransient(polled.left)) continue;
+      return yield* polled.left;
+    }
+    if (polled.right.state !== domain.state) {
+      yield* progress(`  ${DOMAIN_STATE_LABELS[polled.right.state]}`);
+    }
+    domain = polled.right;
+  }
+  if (domain.state !== "active" && domain.state !== "degraded") {
+    return yield* fail(
+      domain,
+      `${domain.unicodeHostname} is ${DOMAIN_STATE_LABELS[domain.state]}${domain.error ? `: ${domain.error.message}` : ""}`
+    );
+  }
+  yield* progress(`
+${domain.unicodeHostname} is live: https://${domain.hostname}`);
+  if (json) yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+  return domain;
+});
+var errorMessage = (action, error) => {
+  switch (error._tag) {
+    case "NotAuthenticatedError":
+      return 'You are not logged in. Run "gigadrive login" to authenticate.';
+    case "ApiRequestError":
+      if (error.code === "quota_exceeded" && error.reason === "daily_add_limit") {
+        return `${error.message}
+The daily limit resets within 24 hours; upgrading your plan raises it.`;
+      }
+      if (error.code === "quota_exceeded") {
+        return `${error.message}
+See your plan's limits and upgrade at ${CONSOLE_URL} (organization settings > Limits).`;
+      }
+      if (error.code === "invalid_target" && error.reason === "redirects_not_available") {
+        return `${error.message}
+Redirect domains are available on paid plans. Upgrade at ${CONSOLE_URL}.`;
+      }
+      if (error.code === "domain_in_use" && error.reason === "other_organization") {
+        return `${error.message}
+If you control the domain, verify it with "gigadrive domains owners add <domain>", then move it with "gigadrive domains claim <hostname>".`;
+      }
+      if (error.reason === "ownership_not_live") {
+        return `${error.message}
+Publish the TXT record shown by "gigadrive domains owners list" again, wait for DNS to update, then retry the claim.`;
+      }
+      return `Failed to ${action}: ${error.message}`;
+    default:
+      return error.message;
+  }
+};
+var reportErrors = (action) => (self) => import_effect16.Effect.tapError(self, (error) => import_effect16.Console.error(errorMessage(action, error)));
+var listCommand = import_cli7.Command.make(
+  "list",
+  { app: appOption3, json: jsonOption },
+  ({ app, json }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const applicationId = yield* resolveApplication(app);
+    const { items } = yield* apiClient.request((client) => client.applications.domains.list(applicationId));
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(items, null, 2));
+    if (items.length === 0) {
+      return yield* import_effect16.Console.log('No custom domains. Add one with "gigadrive domains add <hostname>".');
+    }
+    const width = Math.max(...items.map((item) => item.unicodeHostname.length));
+    for (const item of items) {
+      const problem = item.error ? `  ${item.error.code}` : "";
+      yield* import_effect16.Console.log(
+        `${item.unicodeHostname.padEnd(width)}  ${DOMAIN_STATE_LABELS[item.state]}${item.primary ? " (primary)" : ""}${problem}`
+      );
+    }
+  }).pipe(reportErrors("list custom domains"))
+);
+var addDomain = (input) => import_effect16.Effect.gen(function* () {
+  const apiClient = yield* ApiClientService;
+  const target = yield* targetFromFlags(input);
+  const timeout = yield* requirePositiveTimeout(input.timeout);
+  const domain = yield* apiClient.request(
+    (client) => client.applications.domains.add(input.applicationId, { hostname: input.hostname, target })
+  );
+  if (input.wait) return yield* waitUntilServing(input.applicationId, domain, timeout, input.json);
+  if (input.json) {
+    yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+    return domain;
+  }
+  yield* printDomain(domain);
+  if (IN_PROGRESS_STATES.has(domain.state)) {
+    yield* import_effect16.Console.log(
+      `
+Gigadrive checks the records automatically. Follow progress with "gigadrive domains inspect ${domain.hostname}".`
+    );
+  }
+  return domain;
+});
+var addCommand = import_cli7.Command.make(
+  "add",
+  {
+    hostname: hostnameArg,
+    app: appOption3,
+    production: productionOption,
+    branch: branchOption,
+    redirectTo: redirectToOption,
+    status: statusOption2,
+    dropPath: dropPathOption,
+    wait: waitOption,
+    timeout: timeoutOption,
+    json: jsonOption
+  },
+  ({ app, ...options }) => import_effect16.Effect.gen(function* () {
+    const applicationId = yield* resolveApplication(app);
+    yield* addDomain({ ...options, applicationId });
+  }).pipe(reportErrors("add the domain"))
+);
+var updateCommand = import_cli7.Command.make(
+  "update",
+  {
+    domain: domainArg,
+    app: appOption3,
+    production: productionOption,
+    branch: branchOption,
+    redirectTo: redirectToOption,
+    status: statusOption2,
+    dropPath: dropPathOption,
+    primary: primaryOption,
+    json: jsonOption
+  },
+  ({ domain: hostnameOrId, app, primary, json, ...flags }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const target = yield* targetFromFlags(flags);
+    if (target === void 0 && !primary) {
+      return yield* new InvalidDomainOptionsError({
+        message: "Nothing to change. Pass --production, --branch, --redirect-to or --primary."
+      });
+    }
+    const applicationId = yield* resolveApplication(app);
+    const found = yield* findDomain(applicationId, hostnameOrId);
+    const domain = yield* apiClient.request(
+      (client) => client.applications.domains.update(applicationId, found.id, {
+        ...target === void 0 ? {} : { target },
+        ...primary ? { primary: true } : {}
+      })
+    );
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+    yield* printDomain(domain);
+  }).pipe(reportErrors("update the domain"))
+);
+var claimCommand = import_cli7.Command.make(
+  "claim",
+  {
+    hostname: hostnameArg.pipe(import_cli7.Args.withDescription("Hostname another organization attached")),
+    app: appOption3,
+    json: jsonOption
+  },
+  ({ hostname: hostname2, app, json }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const applicationId = yield* resolveApplication(app);
+    const domain = yield* apiClient.request((client) => client.applications.domains.claim(applicationId, hostname2));
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+    yield* import_effect16.Console.log(`Moved ${domain.unicodeHostname} to this application.`);
+    yield* printDomain(domain);
+  }).pipe(reportErrors("claim the domain"))
+);
+var inspectCommand = import_cli7.Command.make(
+  "inspect",
+  { domain: domainArg, app: appOption3, json: jsonOption },
+  ({ domain: hostnameOrId, app, json }) => import_effect16.Effect.gen(function* () {
+    const applicationId = yield* resolveApplication(app);
+    const domain = yield* findDomain(applicationId, hostnameOrId);
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+    yield* printDomain(domain);
+    if (domain.nextCheckAt !== null) yield* import_effect16.Console.log(`
+Next automatic check: ${domain.nextCheckAt}`);
+  }).pipe(reportErrors("inspect the domain"))
+);
+var checkCommand = import_cli7.Command.make(
+  "check",
+  { domain: domainArg, app: appOption3, wait: waitOption, timeout: timeoutOption, json: jsonOption },
+  ({ domain: hostnameOrId, app, wait, timeout, json }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const minutes = yield* requirePositiveTimeout(timeout);
+    const applicationId = yield* resolveApplication(app);
+    const found = yield* findDomain(applicationId, hostnameOrId);
+    const domain = yield* apiClient.request((client) => client.applications.domains.refresh(applicationId, found.id));
+    if (wait) return yield* waitUntilServing(applicationId, domain, minutes, json);
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(domain, null, 2));
+    yield* import_effect16.Console.log(`Checking ${domain.unicodeHostname}.`);
+    yield* printDomain(domain);
+  }).pipe(reportErrors("check the domain"))
+);
+var removeDomain = (applicationId, hostnameOrId, yes) => import_effect16.Effect.gen(function* () {
+  const apiClient = yield* ApiClientService;
+  const domain = yield* findDomain(applicationId, hostnameOrId);
+  const confirmed = yield* confirm(
+    `Remove ${domain.unicodeHostname}? It stops serving this application immediately.`,
+    yes
+  );
+  if (!confirmed) return yield* import_effect16.Console.log("Cancelled.");
+  yield* apiClient.request((client) => client.applications.domains.remove(applicationId, domain.id));
+  yield* import_effect16.Console.log(`Removed ${domain.unicodeHostname}.`);
+});
+var removeCommand = import_cli7.Command.make(
+  "rm",
+  { domain: domainArg, app: appOption3, yes: yesOption },
+  ({ domain: hostnameOrId, app, yes }) => import_effect16.Effect.gen(function* () {
+    const applicationId = yield* resolveApplication(app);
+    yield* removeDomain(applicationId, hostnameOrId, yes);
+  }).pipe(
+    // Ctrl+C at the confirmation is a deliberate cancel, not a failure.
+    import_effect16.Effect.catchTag("QuitException", () => import_effect16.Console.log("Cancelled.")),
+    reportErrors("remove the domain")
+  )
+);
+var findOwnership = (organizationId, name) => import_effect16.Effect.gen(function* () {
+  const apiClient = yield* ApiClientService;
+  const { items } = yield* apiClient.request((client) => client.organizations.domains.list(organizationId));
+  const wanted = normalizeHostname(name);
+  const claim = items.find((item) => item.id === name || item.name === wanted || item.unicodeName === wanted);
+  if (!claim) {
+    return yield* new DomainNotFoundError({
+      message: `${name} is not claimed. Add it with "gigadrive domains owners add".`
+    });
+  }
+  return claim;
+});
+var ownersListCommand = import_cli7.Command.make(
+  "list",
+  { org: orgOption3, json: jsonOption },
+  ({ org, json }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const organizationId = yield* resolveOrganization(org);
+    const { items } = yield* apiClient.request((client) => client.organizations.domains.list(organizationId));
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(items, null, 2));
+    if (items.length === 0) return yield* import_effect16.Console.log("No verified domains.");
+    const width = Math.max(...items.map((item) => item.unicodeName.length));
+    for (const item of items) {
+      yield* import_effect16.Console.log(`${item.unicodeName.padEnd(width)}  ${item.status}`);
+    }
+  }).pipe(reportErrors("list verified domains"))
+);
+var ownersAddCommand = import_cli7.Command.make(
+  "add",
+  {
+    name: import_cli7.Args.text({ name: "domain" }).pipe(import_cli7.Args.withDescription("Domain to verify, e.g. example.com")),
+    org: orgOption3,
+    json: jsonOption
+  },
+  ({ name, org, json }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const organizationId = yield* resolveOrganization(org);
+    const claim = yield* apiClient.request((client) => client.organizations.domains.add(organizationId, name));
+    if (json) return yield* import_effect16.Console.log(JSON.stringify(claim, null, 2));
+    if (claim.status === "verified") {
+      return yield* import_effect16.Console.log(`${claim.unicodeName} is verified.`);
+    }
+    yield* import_effect16.Console.log(`Publish this TXT record for ${claim.unicodeName}:`);
+    yield* import_effect16.Console.log(`  Name:  ${claim.record.host}`);
+    yield* import_effect16.Console.log(`  Value: ${claim.record.value}`);
+    yield* import_effect16.Console.log(`
+Then run "gigadrive domains owners verify ${claim.name}".`);
+  }).pipe(reportErrors("add the domain"))
+);
+var ownersVerifyCommand = import_cli7.Command.make(
+  "verify",
+  { name: import_cli7.Args.text({ name: "domain" }).pipe(import_cli7.Args.withDescription("Domain to verify")), org: orgOption3 },
+  ({ name, org }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const organizationId = yield* resolveOrganization(org);
+    const claim = yield* findOwnership(organizationId, name);
+    const checked = yield* apiClient.request(
+      (client) => client.organizations.domains.verify(organizationId, claim.id)
+    );
+    if (checked.status === "verified") {
+      return yield* import_effect16.Console.log(`${checked.unicodeName} is verified.`);
+    }
+    yield* import_effect16.Console.log(
+      `${checked.unicodeName} is not verified yet${checked.error ? `: ${checked.error.message}` : "."} Gigadrive keeps checking automatically.`
+    );
+  }).pipe(reportErrors("verify the domain"))
+);
+var ownersRemoveCommand = import_cli7.Command.make(
+  "rm",
+  {
+    name: import_cli7.Args.text({ name: "domain" }).pipe(import_cli7.Args.withDescription("Domain to remove")),
+    org: orgOption3,
+    yes: yesOption
+  },
+  ({ name, org, yes }) => import_effect16.Effect.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const organizationId = yield* resolveOrganization(org);
+    const claim = yield* findOwnership(organizationId, name);
+    const confirmed = yield* confirm(
+      `Remove ${claim.unicodeName} from your organization's domains? Custom domains that rely on it must be removed first.`,
+      yes
+    );
+    if (!confirmed) return yield* import_effect16.Console.log("Cancelled.");
+    yield* apiClient.request((client) => client.organizations.domains.remove(organizationId, claim.id));
+    yield* import_effect16.Console.log(`Removed ${claim.unicodeName}.`);
+  }).pipe(
+    import_effect16.Effect.catchTag("QuitException", () => import_effect16.Console.log("Cancelled.")),
+    reportErrors("remove the domain")
+  )
+);
+var ownersCommand = import_cli7.Command.make("owners", {}, () => import_effect16.Effect.void).pipe(
+  import_cli7.Command.withDescription("Domains your organization verified with a TXT record"),
+  import_cli7.Command.withSubcommands([ownersListCommand, ownersAddCommand, ownersVerifyCommand, ownersRemoveCommand])
+);
+var domainsBase = import_cli7.Command.make("domains", {}, () => import_effect16.Effect.void).pipe(
+  import_cli7.Command.withDescription("Custom domains of the linked application")
+);
+var domainsCommand = domainsBase.pipe(
+  import_cli7.Command.withSubcommands([
+    listCommand,
+    addCommand,
+    updateCommand,
+    claimCommand,
+    inspectCommand,
+    checkCommand,
+    removeCommand,
+    ownersCommand
+  ])
+);
+
+// src/commands/env/index.ts
+var import_cli8 = require("@effect/cli");
+var import_effect20 = require("effect");
 
 // src/services/env-file.ts
 var import_platform6 = require("@effect/platform");
-var import_effect16 = require("effect");
+var import_effect17 = require("effect");
 
 // src/lib/dotenv.ts
 var DEFAULT_ENV_HEADER = "# Generated by `gigadrive env pull` \u2014 do not edit by hand.";
@@ -1863,42 +2441,42 @@ var parseEnv = (content) => {
 };
 
 // src/services/env-file.ts
-var EnvFileService = class extends import_effect16.Effect.Service()("EnvFileService", {
+var EnvFileService = class extends import_effect17.Effect.Service()("EnvFileService", {
   accessors: true,
-  effect: import_effect16.Effect.gen(function* () {
+  effect: import_effect17.Effect.gen(function* () {
     const fs = yield* import_platform6.FileSystem.FileSystem;
     const pathService = yield* import_platform6.Path.Path;
-    const exists = import_effect16.Effect.fn("EnvFileService.exists")(function* (filePath) {
-      return yield* fs.exists(filePath).pipe(import_effect16.Effect.mapError(() => new EnvFileReadError({ message: `Failed to check whether ${filePath} exists` })));
+    const exists = import_effect17.Effect.fn("EnvFileService.exists")(function* (filePath) {
+      return yield* fs.exists(filePath).pipe(import_effect17.Effect.mapError(() => new EnvFileReadError({ message: `Failed to check whether ${filePath} exists` })));
     });
-    const read = import_effect16.Effect.fn("EnvFileService.read")(function* (filePath) {
+    const read = import_effect17.Effect.fn("EnvFileService.read")(function* (filePath) {
       const present = yield* exists(filePath);
-      if (!present) return import_effect16.Option.none();
-      const contents = yield* fs.readFileString(filePath, "utf8").pipe(import_effect16.Effect.mapError(() => new EnvFileReadError({ message: `Failed to read ${filePath}` })));
-      return import_effect16.Option.some(contents);
+      if (!present) return import_effect17.Option.none();
+      const contents = yield* fs.readFileString(filePath, "utf8").pipe(import_effect17.Effect.mapError(() => new EnvFileReadError({ message: `Failed to read ${filePath}` })));
+      return import_effect17.Option.some(contents);
     });
-    const write = import_effect16.Effect.fn("EnvFileService.write")(function* (filePath, entries, opts) {
+    const write = import_effect17.Effect.fn("EnvFileService.write")(function* (filePath, entries, opts) {
       const dir = pathService.dirname(filePath);
       yield* fs.makeDirectory(dir, { recursive: true }).pipe(
-        import_effect16.Effect.mapError(
+        import_effect17.Effect.mapError(
           (error) => new EnvFileWriteError({ message: `Failed to create directory for ${filePath}`, cause: String(error) })
         )
       );
       yield* fs.writeFileString(filePath, serializeEnv(entries, opts), { mode: 384 }).pipe(
-        import_effect16.Effect.mapError(
+        import_effect17.Effect.mapError(
           (error) => new EnvFileWriteError({ message: `Failed to write ${filePath}`, cause: String(error) })
         )
       );
       yield* fs.chmod(filePath, 384).pipe(
-        import_effect16.Effect.mapError(
+        import_effect17.Effect.mapError(
           (error) => new EnvFileWriteError({ message: `Failed to secure ${filePath}`, cause: String(error) })
         )
       );
     });
-    const ensureGitignored = import_effect16.Effect.fn("EnvFileService.ensureGitignored")(function* (dir, entry) {
+    const ensureGitignored = import_effect17.Effect.fn("EnvFileService.ensureGitignored")(function* (dir, entry) {
       const gitignorePath = pathService.join(dir, ".gitignore");
       const existing = yield* read(gitignorePath);
-      const current = import_effect16.Option.getOrElse(existing, () => "");
+      const current = import_effect17.Option.getOrElse(existing, () => "");
       const alreadyIgnored = current.split("\n").some((line) => line.trim() === entry);
       if (alreadyIgnored) {
         return false;
@@ -1906,7 +2484,7 @@ var EnvFileService = class extends import_effect16.Effect.Service()("EnvFileServ
       const separator = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
       yield* fs.writeFileString(gitignorePath, `${current}${separator}${entry}
 `).pipe(
-        import_effect16.Effect.mapError(
+        import_effect17.Effect.mapError(
           (error) => new EnvFileWriteError({ message: "Failed to update .gitignore", cause: String(error) })
         )
       );
@@ -1918,29 +2496,29 @@ var EnvFileService = class extends import_effect16.Effect.Service()("EnvFileServ
 };
 
 // src/services/local-credentials.ts
-var import_effect18 = require("effect");
+var import_effect19 = require("effect");
 var os3 = __toESM(require("os"), 1);
 
 // src/services/dev-credentials-store.ts
 var import_platform7 = require("@effect/platform");
-var import_effect17 = require("effect");
+var import_effect18 = require("effect");
 var os2 = __toESM(require("os"), 1);
-var DevCredentialsStore = class extends import_effect17.Effect.Service()("DevCredentialsStore", {
+var DevCredentialsStore = class extends import_effect18.Effect.Service()("DevCredentialsStore", {
   accessors: true,
-  effect: import_effect17.Effect.gen(function* () {
+  effect: import_effect18.Effect.gen(function* () {
     const fs = yield* import_platform7.FileSystem.FileSystem;
     const pathService = yield* import_platform7.Path.Path;
     const homeDir = os2.homedir();
     const storeDir = pathService.join(homeDir, ".gigadrive");
     const storeFile = pathService.join(storeDir, "dev-keys.json");
-    const ensureDirectory = import_effect17.Effect.gen(function* () {
+    const ensureDirectory = import_effect18.Effect.gen(function* () {
       yield* fs.makeDirectory(storeDir, { recursive: true }).pipe(
-        import_effect17.Effect.mapError(
+        import_effect18.Effect.mapError(
           (error) => new DevCredentialsStoreWriteError({ message: "Failed to create ~/.gigadrive", cause: String(error) })
         )
       );
       yield* fs.chmod(storeDir, 448).pipe(
-        import_effect17.Effect.mapError(
+        import_effect18.Effect.mapError(
           (error) => new DevCredentialsStoreWriteError({
             message: "Failed to set ~/.gigadrive permissions",
             cause: String(error)
@@ -1948,30 +2526,30 @@ var DevCredentialsStore = class extends import_effect17.Effect.Service()("DevCre
         )
       );
     });
-    const load = import_effect17.Effect.gen(function* () {
-      const present = yield* fs.exists(storeFile).pipe(import_effect17.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to check dev-keys.json" })));
+    const load = import_effect18.Effect.gen(function* () {
+      const present = yield* fs.exists(storeFile).pipe(import_effect18.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to check dev-keys.json" })));
       if (!present) return {};
-      const data = yield* fs.readFileString(storeFile, "utf8").pipe(import_effect17.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to read dev-keys.json" })));
-      const json = yield* import_effect17.Effect.try({
+      const data = yield* fs.readFileString(storeFile, "utf8").pipe(import_effect18.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to read dev-keys.json" })));
+      const json = yield* import_effect18.Effect.try({
         try: () => JSON.parse(data),
         catch: () => new DevCredentialsStoreReadError({ message: "dev-keys.json contains invalid JSON" })
       });
-      return yield* import_effect17.Schema.decodeUnknown(DevKeyStore)(json).pipe(
-        import_effect17.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "dev-keys.json has an invalid schema" }))
+      return yield* import_effect18.Schema.decodeUnknown(DevKeyStore)(json).pipe(
+        import_effect18.Effect.mapError(() => new DevCredentialsStoreReadError({ message: "dev-keys.json has an invalid schema" }))
       );
     });
-    const get = import_effect17.Effect.fn("DevCredentialsStore.get")(function* (applicationId) {
+    const get = import_effect18.Effect.fn("DevCredentialsStore.get")(function* (applicationId) {
       const store = yield* load;
       const entry = store[applicationId];
-      return entry ? import_effect17.Option.some(entry) : import_effect17.Option.none();
+      return entry ? import_effect18.Option.some(entry) : import_effect18.Option.none();
     });
-    const set = import_effect17.Effect.fn("DevCredentialsStore.set")(function* (applicationId, entry) {
+    const set = import_effect18.Effect.fn("DevCredentialsStore.set")(function* (applicationId, entry) {
       const store = yield* load;
       const next = { ...store, [applicationId]: entry };
       yield* ensureDirectory;
       yield* fs.writeFileString(storeFile, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 }).pipe(
-        import_effect17.Effect.mapError(
+        import_effect18.Effect.mapError(
           (error) => new DevCredentialsStoreWriteError({ message: "Failed to write dev-keys.json", cause: String(error) })
         )
       );
@@ -1983,31 +2561,31 @@ var DevCredentialsStore = class extends import_effect17.Effect.Service()("DevCre
 
 // src/services/local-credentials.ts
 var DEV_KEY_SCOPES = ["network:env_vars:read"];
-var ApiBaseUrl2 = import_effect18.Config.string("GIGADRIVE_API_BASE_URL").pipe(import_effect18.Config.withDefault("https://api.gigadrive.network"));
+var ApiBaseUrl2 = import_effect19.Config.string("GIGADRIVE_API_BASE_URL").pipe(import_effect19.Config.withDefault("https://api.gigadrive.network"));
 var credentialEntries = (clientId, clientSecret, baseUrl) => [
   { key: "GIGADRIVE_CLIENT_ID", value: clientId },
   { key: "GIGADRIVE_CLIENT_SECRET", value: clientSecret },
   { key: "GIGADRIVE_API_BASE_URL", value: baseUrl }
 ];
-var LocalCredentialsService = class extends import_effect18.Effect.Service()("LocalCredentialsService", {
+var LocalCredentialsService = class extends import_effect19.Effect.Service()("LocalCredentialsService", {
   accessors: true,
   dependencies: [ApiClientService.Default, DevCredentialsStore.Default],
-  effect: import_effect18.Effect.gen(function* () {
+  effect: import_effect19.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const store = yield* DevCredentialsStore;
     const baseUrl = yield* ApiBaseUrl2;
     const keyName = (applicationId) => `cli-dev:${os3.hostname()}:${applicationId}`;
-    const provision = import_effect18.Effect.fn("LocalCredentialsService.provision")(function* (input) {
+    const provision = import_effect19.Effect.fn("LocalCredentialsService.provision")(function* (input) {
       const stored = yield* store.get(input.applicationId);
       const existing = input.existingContent ? parseEnv(input.existingContent) : {};
       const existingClientId = existing["GIGADRIVE_CLIENT_ID"];
       const existingClientSecret = existing["GIGADRIVE_CLIENT_SECRET"];
-      const canReuse = !input.rotate && existingClientId !== void 0 && existingClientSecret !== void 0 && import_effect18.Option.isSome(stored) && stored.value.apiKeyId === existingClientId;
+      const canReuse = !input.rotate && existingClientId !== void 0 && existingClientSecret !== void 0 && import_effect19.Option.isSome(stored) && stored.value.apiKeyId === existingClientId;
       if (canReuse) {
         return credentialEntries(existingClientId, existingClientSecret, baseUrl);
       }
-      if (import_effect18.Option.isSome(stored)) {
-        yield* apiClient.request((client) => client.apiKeys.delete(stored.value.apiKeyId)).pipe(import_effect18.Effect.catchTag("ApiRequestError", () => import_effect18.Effect.void));
+      if (import_effect19.Option.isSome(stored)) {
+        yield* apiClient.request((client) => client.apiKeys.delete(stored.value.apiKeyId)).pipe(import_effect19.Effect.catchTag("ApiRequestError", () => import_effect19.Effect.void));
       }
       const created = yield* apiClient.request(
         (client) => client.apiKeys.create({
@@ -2025,92 +2603,92 @@ var LocalCredentialsService = class extends import_effect18.Effect.Service()("Lo
 };
 
 // src/commands/env/index.ts
-var appOption3 = import_cli7.Options.text("app").pipe(
-  import_cli7.Options.withAlias("a"),
-  import_cli7.Options.withDescription("Operate on this application (overrides the linked application)"),
-  import_cli7.Options.optional
+var appOption4 = import_cli8.Options.text("app").pipe(
+  import_cli8.Options.withAlias("a"),
+  import_cli8.Options.withDescription("Operate on this application (overrides the linked application)"),
+  import_cli8.Options.optional
 );
-var orgOption3 = import_cli7.Options.text("org").pipe(
-  import_cli7.Options.withAlias("o"),
-  import_cli7.Options.withDescription("Operate on this organization instead of an application"),
-  import_cli7.Options.optional
+var orgOption4 = import_cli8.Options.text("org").pipe(
+  import_cli8.Options.withAlias("o"),
+  import_cli8.Options.withDescription("Operate on this organization instead of an application"),
+  import_cli8.Options.optional
 );
-var sensitiveOption = import_cli7.Options.boolean("sensitive").pipe(
-  import_cli7.Options.withDescription("Store the value as sensitive (hidden in API responses)")
+var sensitiveOption = import_cli8.Options.boolean("sensitive").pipe(
+  import_cli8.Options.withDescription("Store the value as sensitive (hidden in API responses)")
 );
-var envIdOption = import_cli7.Options.text("env").pipe(
-  import_cli7.Options.withAlias("e"),
-  import_cli7.Options.withDescription("Environment ID for an environment-scoped variable (application scope only)"),
-  import_cli7.Options.optional
+var envIdOption = import_cli8.Options.text("env").pipe(
+  import_cli8.Options.withAlias("e"),
+  import_cli8.Options.withDescription("Environment ID for an environment-scoped variable (application scope only)"),
+  import_cli8.Options.optional
 );
-var keyValueArg = import_cli7.Args.text({ name: "key=value" }).pipe(
-  import_cli7.Args.withDescription("Variable assignment, e.g. DATABASE_URL=postgres://user:pass@host/db")
+var keyValueArg = import_cli8.Args.text({ name: "key=value" }).pipe(
+  import_cli8.Args.withDescription("Variable assignment, e.g. DATABASE_URL=postgres://user:pass@host/db")
 );
-var keyOrIdArg = import_cli7.Args.text({ name: "key-or-id" }).pipe(import_cli7.Args.withDescription("Variable key or ID to remove"));
-var fileArg = import_cli7.Args.text({ name: "file" }).pipe(
-  import_cli7.Args.withDescription("Output file to write (default: .env.local)"),
-  import_cli7.Args.optional
+var keyOrIdArg = import_cli8.Args.text({ name: "key-or-id" }).pipe(import_cli8.Args.withDescription("Variable key or ID to remove"));
+var fileArg = import_cli8.Args.text({ name: "file" }).pipe(
+  import_cli8.Args.withDescription("Output file to write (default: .env.local)"),
+  import_cli8.Args.optional
 );
-var environmentOption = import_cli7.Options.text("environment").pipe(
-  import_cli7.Options.withAlias("e"),
-  import_cli7.Options.withDescription("Environment slug to resolve overrides for (e.g. preview). Omit for the local baseline"),
-  import_cli7.Options.optional
+var environmentOption = import_cli8.Options.text("environment").pipe(
+  import_cli8.Options.withAlias("e"),
+  import_cli8.Options.withDescription("Environment slug to resolve overrides for (e.g. preview). Omit for the local baseline"),
+  import_cli8.Options.optional
 );
-var yesOption = import_cli7.Options.boolean("yes").pipe(
-  import_cli7.Options.withAlias("y"),
-  import_cli7.Options.withDescription("Overwrite an existing file without confirmation")
+var yesOption2 = import_cli8.Options.boolean("yes").pipe(
+  import_cli8.Options.withAlias("y"),
+  import_cli8.Options.withDescription("Overwrite an existing file without confirmation")
 );
-var withCredentialsOption = import_cli7.Options.boolean("with-credentials").pipe(
-  import_cli7.Options.withDescription("Also provision API-key credentials so the local app can call the API as this application")
+var withCredentialsOption = import_cli8.Options.boolean("with-credentials").pipe(
+  import_cli8.Options.withDescription("Also provision API-key credentials so the local app can call the API as this application")
 );
-var rotateOption = import_cli7.Options.boolean("rotate").pipe(
-  import_cli7.Options.withDescription("Force a fresh API key when provisioning credentials, revoking the previous one")
+var rotateOption = import_cli8.Options.boolean("rotate").pipe(
+  import_cli8.Options.withDescription("Force a fresh API key when provisioning credentials, revoking the previous one")
 );
-var resolveScope = (app, org) => import_effect19.Effect.gen(function* () {
-  if (import_effect19.Option.isSome(org)) {
+var resolveScope = (app, org) => import_effect20.Effect.gen(function* () {
+  if (import_effect20.Option.isSome(org)) {
     return { kind: "organization", id: org.value };
   }
   const projectLink = yield* ProjectLinkService;
-  const id = yield* import_effect19.Option.match(app, {
-    onSome: (value) => import_effect19.Effect.succeed(value),
-    onNone: () => projectLink.resolve(process.cwd()).pipe(import_effect19.Effect.map((link) => link.applicationId))
+  const id = yield* import_effect20.Option.match(app, {
+    onSome: (value) => import_effect20.Effect.succeed(value),
+    onNone: () => projectLink.resolve(process.cwd()).pipe(import_effect20.Effect.map((link) => link.applicationId))
   });
   return { kind: "application", id };
 });
-var envListCommand = import_cli7.Command.make(
+var envListCommand = import_cli8.Command.make(
   "list",
-  { app: appOption3, org: orgOption3 },
-  ({ app, org }) => import_effect19.Effect.gen(function* () {
+  { app: appOption4, org: orgOption4 },
+  ({ app, org }) => import_effect20.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
     const { items } = yield* apiClient.request(
       (client) => scope.kind === "organization" ? client.organizations.envVars.list(scope.id) : client.applications.envVars.list(scope.id)
     );
     if (items.length === 0) {
-      yield* import_effect19.Console.log("No environment variables set.");
+      yield* import_effect20.Console.log("No environment variables set.");
       return;
     }
     for (const v of items) {
-      yield* import_effect19.Console.log(`${v.key}=${v.sensitive ? "***" : v.value ?? ""}`);
+      yield* import_effect20.Console.log(`${v.key}=${v.sensitive ? "***" : v.value ?? ""}`);
     }
   }).pipe(
-    import_effect19.Effect.catchTags({
-      NotAuthenticatedError: (err) => import_effect19.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect19.Effect.andThen(import_effect19.Effect.fail(err))
+    import_effect20.Effect.catchTags({
+      NotAuthenticatedError: (err) => import_effect20.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect20.Effect.andThen(import_effect20.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect19.Console.error(`Failed to list environment variables: ${err.message}`).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectNotLinkedError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect20.Console.error(`Failed to list environment variables: ${err.message}`).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectNotLinkedError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
     })
   )
 );
-var envSetCommand = import_cli7.Command.make(
+var envSetCommand = import_cli8.Command.make(
   "set",
-  { keyValue: keyValueArg, app: appOption3, org: orgOption3, sensitive: sensitiveOption, env: envIdOption },
-  ({ keyValue, app, org, sensitive, env }) => import_effect19.Effect.gen(function* () {
+  { keyValue: keyValueArg, app: appOption4, org: orgOption4, sensitive: sensitiveOption, env: envIdOption },
+  ({ keyValue, app, org, sensitive, env }) => import_effect20.Effect.gen(function* () {
     const separator = keyValue.indexOf("=");
     if (separator <= 0) {
-      return yield* import_effect19.Effect.fail(
+      return yield* import_effect20.Effect.fail(
         new InvalidEnvVarFormatError({
           message: 'Invalid format. Use KEY=VALUE, e.g. "gigadrive env set DATABASE_URL=postgres://...".'
         })
@@ -2120,27 +2698,27 @@ var envSetCommand = import_cli7.Command.make(
     const value = keyValue.slice(separator + 1);
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
-    const environmentId = import_effect19.Option.getOrUndefined(env);
+    const environmentId = import_effect20.Option.getOrUndefined(env);
     const created = yield* apiClient.request(
       (client) => scope.kind === "organization" ? client.organizations.envVars.create(scope.id, { key, value, sensitive }) : client.applications.envVars.create(scope.id, { key, value, sensitive, environmentId })
     );
-    yield* import_effect19.Console.log(`Set ${created.key}.`);
+    yield* import_effect20.Console.log(`Set ${created.key}.`);
   }).pipe(
-    import_effect19.Effect.catchTags({
-      InvalidEnvVarFormatError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      NotAuthenticatedError: (err) => import_effect19.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect19.Effect.andThen(import_effect19.Effect.fail(err))
+    import_effect20.Effect.catchTags({
+      InvalidEnvVarFormatError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      NotAuthenticatedError: (err) => import_effect20.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect20.Effect.andThen(import_effect20.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect19.Console.error(`Failed to set environment variable: ${err.message}`).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectNotLinkedError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect20.Console.error(`Failed to set environment variable: ${err.message}`).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectNotLinkedError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
     })
   )
 );
-var envRmCommand = import_cli7.Command.make(
+var envRmCommand = import_cli8.Command.make(
   "rm",
-  { keyOrId: keyOrIdArg, app: appOption3, org: orgOption3 },
-  ({ keyOrId, app, org }) => import_effect19.Effect.gen(function* () {
+  { keyOrId: keyOrIdArg, app: appOption4, org: orgOption4 },
+  ({ keyOrId, app, org }) => import_effect20.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
     const { items } = yield* apiClient.request(
@@ -2148,56 +2726,56 @@ var envRmCommand = import_cli7.Command.make(
     );
     const target = items.find((v) => v.id === keyOrId || v.key === keyOrId);
     if (target === void 0) {
-      return yield* import_effect19.Effect.fail(
+      return yield* import_effect20.Effect.fail(
         new EnvVarNotFoundError({ message: `No environment variable matching "${keyOrId}".` })
       );
     }
     yield* apiClient.request(
       (client) => scope.kind === "organization" ? client.organizations.envVars.delete(scope.id, target.id) : client.applications.envVars.delete(scope.id, target.id)
     );
-    yield* import_effect19.Console.log(`Removed ${target.key}.`);
+    yield* import_effect20.Console.log(`Removed ${target.key}.`);
   }).pipe(
-    import_effect19.Effect.catchTags({
-      EnvVarNotFoundError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      NotAuthenticatedError: (err) => import_effect19.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect19.Effect.andThen(import_effect19.Effect.fail(err))
+    import_effect20.Effect.catchTags({
+      EnvVarNotFoundError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      NotAuthenticatedError: (err) => import_effect20.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect20.Effect.andThen(import_effect20.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect19.Console.error(`Failed to remove environment variable: ${err.message}`).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectNotLinkedError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect20.Console.error(`Failed to remove environment variable: ${err.message}`).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectNotLinkedError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
     })
   )
 );
-var envPullCommand = import_cli7.Command.make(
+var envPullCommand = import_cli8.Command.make(
   "pull",
   {
     file: fileArg,
-    app: appOption3,
+    app: appOption4,
     environment: environmentOption,
-    yes: yesOption,
+    yes: yesOption2,
     withCredentials: withCredentialsOption,
     rotate: rotateOption
   },
-  ({ file, app, environment, yes, withCredentials, rotate }) => import_effect19.Effect.gen(function* () {
+  ({ file, app, environment, yes, withCredentials, rotate }) => import_effect20.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const projectLink = yield* ProjectLinkService;
     const envFile = yield* EnvFileService;
-    const applicationId = yield* import_effect19.Option.match(app, {
-      onSome: (value) => import_effect19.Effect.succeed(value),
-      onNone: () => projectLink.resolve(process.cwd()).pipe(import_effect19.Effect.map((link) => link.applicationId))
+    const applicationId = yield* import_effect20.Option.match(app, {
+      onSome: (value) => import_effect20.Effect.succeed(value),
+      onNone: () => projectLink.resolve(process.cwd()).pipe(import_effect20.Effect.map((link) => link.applicationId))
     });
-    const target = import_effect19.Option.getOrElse(file, () => ".env.local");
-    const environmentSlug = import_effect19.Option.getOrUndefined(environment);
+    const target = import_effect20.Option.getOrElse(file, () => ".env.local");
+    const environmentSlug = import_effect20.Option.getOrUndefined(environment);
     const { items, omittedSensitive } = yield* apiClient.request(
       (client) => client.applications.envVars.pull(applicationId, environmentSlug ? { environment: environmentSlug } : void 0)
     );
     const existing = yield* envFile.read(target);
-    if (import_effect19.Option.isSome(existing) && !yes) {
-      const overwrite = yield* import_cli7.Prompt.run(
-        import_cli7.Prompt.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
+    if (import_effect20.Option.isSome(existing) && !yes) {
+      const overwrite = yield* import_cli8.Prompt.run(
+        import_cli8.Prompt.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
       );
       if (!overwrite) {
-        return yield* import_effect19.Console.log("Cancelled.");
+        return yield* import_effect20.Console.log("Cancelled.");
       }
     }
     let credentialEntries2 = [];
@@ -2206,81 +2784,81 @@ var envPullCommand = import_cli7.Command.make(
       credentialEntries2 = yield* localCredentials.provision({
         applicationId,
         rotate,
-        existingContent: import_effect19.Option.getOrUndefined(existing)
+        existingContent: import_effect20.Option.getOrUndefined(existing)
       });
     }
     const entries = [...items.map((v) => ({ key: v.key, value: v.value })), ...credentialEntries2];
     yield* envFile.write(target, entries);
     const gitignored = yield* envFile.ensureGitignored(process.cwd(), target);
-    yield* import_effect19.Console.log(
+    yield* import_effect20.Console.log(
       `Pulled ${items.length} environment variable(s)${withCredentials ? " and API credentials" : ""} to ${target}.`
     );
     if (omittedSensitive > 0) {
-      yield* import_effect19.Console.log(
+      yield* import_effect20.Console.log(
         `Skipped ${omittedSensitive} sensitive variable(s); secrets live only in production/preview environments.`
       );
     }
     if (gitignored) {
-      yield* import_effect19.Console.log(`Added ${target} to .gitignore.`);
+      yield* import_effect20.Console.log(`Added ${target} to .gitignore.`);
     }
   }).pipe(
-    import_effect19.Effect.catchTags({
+    import_effect20.Effect.catchTags({
       // Ctrl+C during the overwrite prompt is a deliberate cancel — exit 0.
-      QuitException: () => import_effect19.Console.log("Cancelled."),
-      NotAuthenticatedError: (err) => import_effect19.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect19.Effect.andThen(import_effect19.Effect.fail(err))
+      QuitException: () => import_effect20.Console.log("Cancelled."),
+      NotAuthenticatedError: (err) => import_effect20.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect20.Effect.andThen(import_effect20.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect19.Console.error(`Failed to pull environment variables: ${err.message}`).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectNotLinkedError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      EnvFileReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      EnvFileWriteError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      DevCredentialsStoreReadError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err))),
-      DevCredentialsStoreWriteError: (err) => import_effect19.Console.error(err.message).pipe(import_effect19.Effect.andThen(import_effect19.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect20.Console.error(`Failed to pull environment variables: ${err.message}`).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectNotLinkedError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      EnvFileReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      EnvFileWriteError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      DevCredentialsStoreReadError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
+      DevCredentialsStoreWriteError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
     })
   )
 );
-var envBase = import_cli7.Command.make("env", {}, () => import_effect19.Effect.void);
+var envBase = import_cli8.Command.make("env", {}, () => import_effect20.Effect.void);
 var envCommand = envBase.pipe(
-  import_cli7.Command.withSubcommands([envListCommand, envSetCommand, envRmCommand, envPullCommand])
+  import_cli8.Command.withSubcommands([envListCommand, envSetCommand, envRmCommand, envPullCommand])
 );
 
 // src/commands/link/index.ts
-var import_cli8 = require("@effect/cli");
-var import_effect20 = require("effect");
-var appOption4 = import_cli8.Options.text("app").pipe(
-  import_cli8.Options.withAlias("a"),
-  import_cli8.Options.withDescription("Application ID to link (skips the interactive picker)"),
-  import_cli8.Options.optional
+var import_cli9 = require("@effect/cli");
+var import_effect21 = require("effect");
+var appOption5 = import_cli9.Options.text("app").pipe(
+  import_cli9.Options.withAlias("a"),
+  import_cli9.Options.withDescription("Application ID to link (skips the interactive picker)"),
+  import_cli9.Options.optional
 );
-var orgOption4 = import_cli8.Options.text("org").pipe(
-  import_cli8.Options.withAlias("o"),
-  import_cli8.Options.withDescription("Only list applications belonging to this organization ID"),
-  import_cli8.Options.optional
+var orgOption5 = import_cli9.Options.text("org").pipe(
+  import_cli9.Options.withAlias("o"),
+  import_cli9.Options.withDescription("Only list applications belonging to this organization ID"),
+  import_cli9.Options.optional
 );
-var linkCommand = import_cli8.Command.make(
+var linkCommand = import_cli9.Command.make(
   "link",
-  { app: appOption4, org: orgOption4 },
-  ({ app, org }) => import_effect20.Effect.gen(function* () {
+  { app: appOption5, org: orgOption5 },
+  ({ app, org }) => import_effect21.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const projectLink = yield* ProjectLinkService;
     const cwd = process.cwd();
-    const organizationId = import_effect20.Option.getOrUndefined(org);
+    const organizationId = import_effect21.Option.getOrUndefined(org);
     const { items: apps } = yield* apiClient.request((client) => client.applications.list({ organizationId }));
     if (apps.length === 0) {
-      return yield* import_effect20.Effect.fail(
+      return yield* import_effect21.Effect.fail(
         new NoApplicationsFoundError({
           message: 'No applications found. Create one in the Gigadrive console, then run "gigadrive link" again.'
         })
       );
     }
-    const explicitAppId = import_effect20.Option.getOrUndefined(app);
+    const explicitAppId = import_effect21.Option.getOrUndefined(app);
     let applicationId;
     let linkedOrganizationId;
     if (explicitAppId !== void 0) {
       const match = apps.find((a) => a.id === explicitAppId);
       if (match === void 0) {
-        return yield* import_effect20.Effect.fail(
+        return yield* import_effect21.Effect.fail(
           new ApplicationNotFoundError({
             message: `Application "${explicitAppId}" was not found among your applications.`
           })
@@ -2292,8 +2870,8 @@ var linkCommand = import_cli8.Command.make(
       applicationId = apps[0].id;
       linkedOrganizationId = apps[0].organization.id;
     } else {
-      const chosen = yield* import_cli8.Prompt.run(
-        import_cli8.Prompt.select({
+      const chosen = yield* import_cli9.Prompt.run(
+        import_cli9.Prompt.select({
           message: "Select an application to link",
           choices: apps.map((a) => ({ title: `${a.name} (${a.organization.name})`, value: a }))
         })
@@ -2302,88 +2880,88 @@ var linkCommand = import_cli8.Command.make(
       linkedOrganizationId = chosen.organization.id;
     }
     yield* projectLink.save(cwd, { applicationId, organizationId: linkedOrganizationId });
-    yield* import_effect20.Console.log(`Linked this directory to application ${applicationId}.`);
-    yield* import_effect20.Console.log('Tip: add ".gigadrive/" to your .gitignore.');
+    yield* import_effect21.Console.log(`Linked this directory to application ${applicationId}.`);
+    yield* import_effect21.Console.log('Tip: add ".gigadrive/" to your .gitignore.');
   }).pipe(
-    import_effect20.Effect.catchTags({
+    import_effect21.Effect.catchTags({
       // Ctrl+C during the picker is a deliberate cancel — exit 0.
-      QuitException: () => import_effect20.Console.log("Cancelled."),
-      NotAuthenticatedError: (err) => import_effect20.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect20.Effect.andThen(import_effect20.Effect.fail(err))
+      QuitException: () => import_effect21.Console.log("Cancelled."),
+      NotAuthenticatedError: (err) => import_effect21.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect21.Effect.andThen(import_effect21.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect20.Console.error(`Failed to list applications: ${err.message}`).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
-      NoApplicationsFoundError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
-      ApplicationNotFoundError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err))),
-      ProjectLinkWriteError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect21.Console.error(`Failed to list applications: ${err.message}`).pipe(import_effect21.Effect.andThen(import_effect21.Effect.fail(err))),
+      NoApplicationsFoundError: (err) => import_effect21.Console.error(err.message).pipe(import_effect21.Effect.andThen(import_effect21.Effect.fail(err))),
+      ApplicationNotFoundError: (err) => import_effect21.Console.error(err.message).pipe(import_effect21.Effect.andThen(import_effect21.Effect.fail(err))),
+      ProjectLinkWriteError: (err) => import_effect21.Console.error(err.message).pipe(import_effect21.Effect.andThen(import_effect21.Effect.fail(err)))
     })
   )
 );
-var unlinkCommand = import_cli8.Command.make(
+var unlinkCommand = import_cli9.Command.make(
   "unlink",
   {},
-  () => import_effect20.Effect.gen(function* () {
+  () => import_effect21.Effect.gen(function* () {
     const projectLink = yield* ProjectLinkService;
     yield* projectLink.remove(process.cwd());
-    yield* import_effect20.Console.log("Unlinked this directory.");
+    yield* import_effect21.Console.log("Unlinked this directory.");
   }).pipe(
-    import_effect20.Effect.catchTags({
-      ProjectLinkWriteError: (err) => import_effect20.Console.error(err.message).pipe(import_effect20.Effect.andThen(import_effect20.Effect.fail(err)))
+    import_effect21.Effect.catchTags({
+      ProjectLinkWriteError: (err) => import_effect21.Console.error(err.message).pipe(import_effect21.Effect.andThen(import_effect21.Effect.fail(err)))
     })
   )
 );
 
 // src/commands/login/index.ts
-var import_cli9 = require("@effect/cli");
-var import_effect21 = require("effect");
-var loginCommand = import_cli9.Command.make(
+var import_cli10 = require("@effect/cli");
+var import_effect22 = require("effect");
+var loginCommand = import_cli10.Command.make(
   "login",
   {},
-  () => import_effect21.Effect.gen(function* () {
-    yield* import_effect21.Console.log("Initiating login...");
+  () => import_effect22.Effect.gen(function* () {
+    yield* import_effect22.Console.log("Initiating login...");
     const auth = yield* AuthService;
     yield* auth.login;
-    const info = yield* auth.getUserInfo.pipe(import_effect21.Effect.catchAll(() => import_effect21.Effect.succeed({})));
+    const info = yield* auth.getUserInfo.pipe(import_effect22.Effect.catchAll(() => import_effect22.Effect.succeed({})));
     const name = auth.inferUserName(info);
-    yield* import_effect21.Console.log(`You are now logged in as ${name}.`);
+    yield* import_effect22.Console.log(`You are now logged in as ${name}.`);
   }).pipe(
-    import_effect21.Effect.catchTags({
-      LoginFlowError: (err) => import_effect21.Console.error(err.message),
-      DeviceAuthorizationError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
-      AuthorizationDeniedError: (err) => import_effect21.Console.error(err.message),
-      DeviceCodeExpiredError: (err) => import_effect21.Console.error(err.message),
-      TokenExchangeError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
-      OAuthDiscoveryError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
-      AuthStorageWriteError: (err) => import_effect21.Console.error(`Failed to save credentials: ${err.message}`)
+    import_effect22.Effect.catchTags({
+      LoginFlowError: (err) => import_effect22.Console.error(err.message),
+      DeviceAuthorizationError: (err) => import_effect22.Console.error(`Login failed: ${err.message}`),
+      AuthorizationDeniedError: (err) => import_effect22.Console.error(err.message),
+      DeviceCodeExpiredError: (err) => import_effect22.Console.error(err.message),
+      TokenExchangeError: (err) => import_effect22.Console.error(`Login failed: ${err.message}`),
+      OAuthDiscoveryError: (err) => import_effect22.Console.error(`Login failed: ${err.message}`),
+      AuthStorageWriteError: (err) => import_effect22.Console.error(`Failed to save credentials: ${err.message}`)
     })
   )
 );
 
 // src/commands/logout/index.ts
-var import_cli10 = require("@effect/cli");
-var import_effect22 = require("effect");
-var logoutCommand = import_cli10.Command.make(
+var import_cli11 = require("@effect/cli");
+var import_effect23 = require("effect");
+var logoutCommand = import_cli11.Command.make(
   "logout",
   {},
-  () => import_effect22.Effect.gen(function* () {
+  () => import_effect23.Effect.gen(function* () {
     const auth = yield* AuthService;
     yield* auth.logout;
-    yield* import_effect22.Console.log("Logged out.");
+    yield* import_effect23.Console.log("Logged out.");
   }).pipe(
-    import_effect22.Effect.catchTags({
-      AuthStorageWriteError: (err) => import_effect22.Console.error(`Failed to log out: ${err.message}`).pipe(import_effect22.Effect.andThen(import_effect22.Effect.fail(err)))
+    import_effect23.Effect.catchTags({
+      AuthStorageWriteError: (err) => import_effect23.Console.error(`Failed to log out: ${err.message}`).pipe(import_effect23.Effect.andThen(import_effect23.Effect.fail(err)))
     })
   )
 );
 
 // src/commands/platform/index.ts
-var import_cli12 = require("@effect/cli");
-var import_effect26 = require("effect");
+var import_cli13 = require("@effect/cli");
+var import_effect27 = require("effect");
 
 // src/commands/platform/deploy/index.ts
-var import_cli11 = require("@effect/cli");
+var import_cli12 = require("@effect/cli");
 var import_platform9 = require("@effect/platform");
 var import_commons = require("@gigadrive/commons");
-var import_effect25 = require("effect");
+var import_effect26 = require("effect");
 var os4 = __toESM(require("os"), 1);
 var path = __toESM(require("path"), 1);
 
@@ -2391,7 +2969,7 @@ var path = __toESM(require("path"), 1);
 var import_platform8 = require("@effect/platform");
 var import_build_utils3 = require("@gigadrive/build-utils");
 var import_archiver = __toESM(require("archiver"), 1);
-var import_effect23 = require("effect");
+var import_effect24 = require("effect");
 var import_ignore = __toESM(require("ignore"), 1);
 var nodeFs = __toESM(require("fs"), 1);
 var nodeFsPromises = __toESM(require("fs/promises"), 1);
@@ -2404,22 +2982,33 @@ var MANAGED_IGNORE_PATTERNS = [
   "**/.DS_Store",
   "**/Thumbs.db"
 ];
+var CONTAINER_BUILD_FILE_PATTERNS = [
+  "!Dockerfile",
+  "!**/Dockerfile",
+  "!**/*.Dockerfile",
+  "!**/Dockerfile.*",
+  "!compose.yaml",
+  "!compose.yml",
+  "!docker-compose.yaml",
+  "!docker-compose.yml"
+];
+var DOCKER_BUILD_IGNORE_FILE = ".dockerignore";
 var readIgnoreFile = (fs, ignorePath) => fs.readFileString(ignorePath, "utf8").pipe(
-  import_effect23.Effect.map((content) => content.split("\n").filter((line) => line.trim() !== "")),
-  import_effect23.Effect.catchAll(() => import_effect23.Effect.succeed([]))
+  import_effect24.Effect.map((content) => content.split("\n").filter((line) => line.trim() !== "")),
+  import_effect24.Effect.catchAll(() => import_effect24.Effect.succeed([]))
 );
-var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules) => import_effect23.Effect.gen(function* () {
-  const items = yield* fs.readDirectory(dir).pipe(import_effect23.Effect.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${dir}` })));
+var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules, ignoreFileNames) => import_effect24.Effect.gen(function* () {
+  const items = yield* fs.readDirectory(dir).pipe(import_effect24.Effect.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${dir}` })));
   for (const item of items) {
     const fullPath = pathService.join(dir, item);
     const relativePath = pathService.relative(baseDir, fullPath);
-    const stat = yield* import_effect23.Effect.tryPromise({
+    const stat = yield* import_effect24.Effect.tryPromise({
       try: () => nodeFsPromises.lstat(fullPath),
       catch: () => new ArchiveCreateError({ message: `Failed to stat: ${fullPath}` })
     });
     if (stat.isDirectory()) {
       if (ignoreRules.ignores(`${relativePath}/`)) continue;
-      for (const ignoreFileName of IGNORE_FILE_NAMES) {
+      for (const ignoreFileName of ignoreFileNames) {
         const ignoreFilePath = pathService.join(fullPath, ignoreFileName);
         const patterns = yield* readIgnoreFile(fs, ignoreFilePath);
         if (patterns.length > 0) {
@@ -2430,17 +3019,18 @@ var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules) => impo
           );
         }
       }
-      yield* collectIgnorePatterns(fs, pathService, fullPath, baseDir, ignoreRules);
+      yield* collectIgnorePatterns(fs, pathService, fullPath, baseDir, ignoreRules, ignoreFileNames);
     }
   }
-}).pipe(import_effect23.Effect.catchAll(() => import_effect23.Effect.void));
-var initializeIgnoreRules = (fs, pathService, baseDir, useIgnoreFiles, useManagedIgnore) => import_effect23.Effect.gen(function* () {
+}).pipe(import_effect24.Effect.catchAll(() => import_effect24.Effect.void));
+var initializeIgnoreRules = (fs, pathService, baseDir, useIgnoreFiles, useManagedIgnore, buildsContainerImages) => import_effect24.Effect.gen(function* () {
   const ignoreRules = (0, import_ignore.default)();
+  const ignoreFileNames = buildsContainerImages ? IGNORE_FILE_NAMES.filter((name) => name !== DOCKER_BUILD_IGNORE_FILE) : IGNORE_FILE_NAMES;
   if (useManagedIgnore) {
     ignoreRules.add(MANAGED_IGNORE_PATTERNS);
   }
   if (useIgnoreFiles) {
-    for (const ignoreFileName of IGNORE_FILE_NAMES) {
+    for (const ignoreFileName of ignoreFileNames) {
       const ignoreFilePath = pathService.join(baseDir, ignoreFileName);
       const patterns = yield* readIgnoreFile(fs, ignoreFilePath);
       if (patterns.length > 0) {
@@ -2449,18 +3039,19 @@ var initializeIgnoreRules = (fs, pathService, baseDir, useIgnoreFiles, useManage
         );
       }
     }
-    yield* collectIgnorePatterns(fs, pathService, baseDir, baseDir, ignoreRules);
+    yield* collectIgnorePatterns(fs, pathService, baseDir, baseDir, ignoreRules, ignoreFileNames);
+    ignoreRules.add(CONTAINER_BUILD_FILE_PATTERNS);
   }
   return ignoreRules;
 });
-var getFilesToInclude = (fs, pathService, dir, ignoreRules) => import_effect23.Effect.gen(function* () {
+var getFilesToInclude = (fs, pathService, dir, ignoreRules) => import_effect24.Effect.gen(function* () {
   const filesToInclude = [];
-  const walkDir = (currentDir) => import_effect23.Effect.gen(function* () {
-    const items = yield* fs.readDirectory(currentDir).pipe(import_effect23.Effect.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${currentDir}` })));
+  const walkDir = (currentDir) => import_effect24.Effect.gen(function* () {
+    const items = yield* fs.readDirectory(currentDir).pipe(import_effect24.Effect.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${currentDir}` })));
     for (const item of items) {
       const fullPath = pathService.join(currentDir, item);
       const relativePath = pathService.relative(dir, fullPath);
-      const stat = yield* import_effect23.Effect.tryPromise({
+      const stat = yield* import_effect24.Effect.tryPromise({
         try: () => nodeFsPromises.lstat(fullPath),
         catch: () => new ArchiveCreateError({ message: `Failed to stat: ${fullPath}` })
       });
@@ -2474,27 +3065,28 @@ var getFilesToInclude = (fs, pathService, dir, ignoreRules) => import_effect23.E
         }
       }
     }
-  }).pipe(import_effect23.Effect.catchAll(() => import_effect23.Effect.void));
+  }).pipe(import_effect24.Effect.catchAll(() => import_effect24.Effect.void));
   yield* walkDir(dir);
   return filesToInclude;
 });
-var ArchiveService = class extends import_effect23.Effect.Service()("ArchiveService", {
+var ArchiveService = class extends import_effect24.Effect.Service()("ArchiveService", {
   accessors: true,
-  effect: import_effect23.Effect.gen(function* () {
+  effect: import_effect24.Effect.gen(function* () {
     const fs = yield* import_platform8.FileSystem.FileSystem;
     const pathService = yield* import_platform8.Path.Path;
-    const createZipArchive = import_effect23.Effect.fn("ArchiveService.createZipArchive")(function* (inputDir, outputFile, options = {}) {
-      yield* import_effect23.Effect.annotateCurrentSpan("inputDir", inputDir);
-      yield* import_effect23.Effect.annotateCurrentSpan("outputFile", outputFile);
-      yield* import_effect23.Effect.log("Creating zip archive", { inputDir, outputFile });
+    const createZipArchive = import_effect24.Effect.fn("ArchiveService.createZipArchive")(function* (inputDir, outputFile, options = {}) {
+      yield* import_effect24.Effect.annotateCurrentSpan("inputDir", inputDir);
+      yield* import_effect24.Effect.annotateCurrentSpan("outputFile", outputFile);
+      yield* import_effect24.Effect.log("Creating zip archive", { inputDir, outputFile });
       const ignoreRules = yield* initializeIgnoreRules(
         fs,
         pathService,
         inputDir,
         options.useIgnoreFiles !== false,
-        options.useManagedIgnore !== false
+        options.useManagedIgnore !== false,
+        options.buildsContainerImages === true
       );
-      const filesToInclude = options.whitelist ? yield* import_effect23.Effect.tryPromise({
+      const filesToInclude = options.whitelist ? yield* import_effect24.Effect.tryPromise({
         try: () => Promise.all(
           options.whitelist.map((file) => (0, import_build_utils3.getFilesForPattern)(file, inputDir, options.excludeFiles ?? []))
         ),
@@ -2502,25 +3094,25 @@ var ArchiveService = class extends import_effect23.Effect.Service()("ArchiveServ
           message: "Failed to resolve whitelist patterns",
           cause: error instanceof Error ? error.message : String(error)
         })
-      }) : yield* import_effect23.Effect.gen(function* () {
+      }) : yield* import_effect24.Effect.gen(function* () {
         if (options.excludeFiles && options.excludeFiles.length > 0) {
           ignoreRules.add(options.excludeFiles);
         }
         return yield* getFilesToInclude(fs, pathService, inputDir, ignoreRules).pipe(
-          import_effect23.Effect.map((files) => [files])
+          import_effect24.Effect.map((files) => [files])
         );
       });
-      const archiveExists = yield* fs.exists(outputFile).pipe(import_effect23.Effect.catchAll(() => import_effect23.Effect.succeed(false)));
+      const archiveExists = yield* fs.exists(outputFile).pipe(import_effect24.Effect.catchAll(() => import_effect24.Effect.succeed(false)));
       if (archiveExists) {
         yield* fs.remove(outputFile).pipe(
-          import_effect23.Effect.mapError(
+          import_effect24.Effect.mapError(
             (error) => new ArchiveCreateError({
               message: `Failed to remove existing archive: ${String(error)}`
             })
           )
         );
       }
-      yield* import_effect23.Effect.tryPromise({
+      yield* import_effect24.Effect.tryPromise({
         try: () => new Promise((resolve, reject) => {
           const output = nodeFs.createWriteStream(outputFile);
           const archive = (0, import_archiver.default)("zip", { zlib: { level: 9 } });
@@ -2539,14 +3131,14 @@ var ArchiveService = class extends import_effect23.Effect.Service()("ArchiveServ
         })
       });
       const fileInfo = yield* fs.stat(outputFile).pipe(
-        import_effect23.Effect.mapError(
+        import_effect24.Effect.mapError(
           (error) => new ArchiveCreateError({
             message: `Failed to stat archive: ${String(error)}`
           })
         )
       );
       const size = Number(fileInfo.size);
-      yield* import_effect23.Effect.log("Archive created", { size });
+      yield* import_effect24.Effect.log("Archive created", { size });
       return { path: outputFile, size };
     });
     return { createZipArchive };
@@ -2555,32 +3147,32 @@ var ArchiveService = class extends import_effect23.Effect.Service()("ArchiveServ
 };
 
 // src/services/deployment-api.ts
-var import_effect24 = require("effect");
-var DeploymentApiService = class extends import_effect24.Effect.Service()("DeploymentApiService", {
+var import_effect25 = require("effect");
+var DeploymentApiService = class extends import_effect25.Effect.Service()("DeploymentApiService", {
   accessors: true,
   dependencies: [ApiClientService.Default],
-  effect: import_effect24.Effect.gen(function* () {
+  effect: import_effect25.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const getClient = apiClient.getClient.pipe(
-      import_effect24.Effect.mapError((err) => new DeploymentAuthError({ message: `Authentication failed: ${err.message}` }))
+      import_effect25.Effect.mapError((err) => new DeploymentAuthError({ message: `Authentication failed: ${err.message}` }))
     );
-    const createDeployment = import_effect24.Effect.fn("DeploymentApiService.createDeployment")(function* (applicationId) {
-      yield* import_effect24.Effect.annotateCurrentSpan("applicationId", applicationId);
-      yield* import_effect24.Effect.log("Creating deployment", { applicationId });
+    const createDeployment = import_effect25.Effect.fn("DeploymentApiService.createDeployment")(function* (applicationId) {
+      yield* import_effect25.Effect.annotateCurrentSpan("applicationId", applicationId);
+      yield* import_effect25.Effect.log("Creating deployment", { applicationId });
       const client = yield* getClient;
-      const deployment = yield* import_effect24.Effect.tryPromise({
+      const deployment = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.create({ applicationId }),
         catch: (error) => new DeploymentCreateError({
           message: `Failed to create deployment: ${error instanceof Error ? error.message : String(error)}`
         })
       });
-      yield* import_effect24.Effect.log("Deployment created", { deploymentId: deployment.id });
+      yield* import_effect25.Effect.log("Deployment created", { deploymentId: deployment.id });
       return deployment.id;
     });
-    const startMultipartUpload = import_effect24.Effect.fn("DeploymentApiService.startMultipartUpload")(function* (deploymentId) {
-      yield* import_effect24.Effect.annotateCurrentSpan("deploymentId", deploymentId);
+    const startMultipartUpload = import_effect25.Effect.fn("DeploymentApiService.startMultipartUpload")(function* (deploymentId) {
+      yield* import_effect25.Effect.annotateCurrentSpan("deploymentId", deploymentId);
       const client = yield* getClient;
-      const result = yield* import_effect24.Effect.tryPromise({
+      const result = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.startUpload(deploymentId),
         catch: (error) => new UploadStartError({
           message: `Failed to start multipart upload: ${error instanceof Error ? error.message : String(error)}`
@@ -2588,9 +3180,9 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
       });
       return result.uploadId;
     });
-    const getPresignedUrl = import_effect24.Effect.fn("DeploymentApiService.getPresignedUrl")(function* (deploymentId, uploadId, partNumber) {
+    const getPresignedUrl = import_effect25.Effect.fn("DeploymentApiService.getPresignedUrl")(function* (deploymentId, uploadId, partNumber) {
       const client = yield* getClient;
-      const result = yield* import_effect24.Effect.tryPromise({
+      const result = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.getPresignedUrl(deploymentId, uploadId, partNumber),
         catch: (error) => new PresignedUrlError({
           message: `Failed to get presigned URL: ${error instanceof Error ? error.message : String(error)}`,
@@ -2599,11 +3191,11 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
       });
       return result.url;
     });
-    const uploadPart = import_effect24.Effect.fn("DeploymentApiService.uploadPart")(function* (presignedUrl, data, partNumber) {
-      yield* import_effect24.Effect.annotateCurrentSpan("partNumber", partNumber);
-      yield* import_effect24.Effect.annotateCurrentSpan("size", data.length);
+    const uploadPart = import_effect25.Effect.fn("DeploymentApiService.uploadPart")(function* (presignedUrl, data, partNumber) {
+      yield* import_effect25.Effect.annotateCurrentSpan("partNumber", partNumber);
+      yield* import_effect25.Effect.annotateCurrentSpan("size", data.length);
       const client = yield* getClient;
-      const result = yield* import_effect24.Effect.tryPromise({
+      const result = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.uploadPart(presignedUrl, data, partNumber),
         catch: (error) => new UploadPartError({
           message: `Failed to upload part ${partNumber}: ${error instanceof Error ? error.message : String(error)}`,
@@ -2612,21 +3204,21 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
       });
       return result;
     });
-    const completeUpload = import_effect24.Effect.fn("DeploymentApiService.completeUpload")(function* (deploymentId, uploadId, parts) {
-      yield* import_effect24.Effect.annotateCurrentSpan("deploymentId", deploymentId);
-      yield* import_effect24.Effect.annotateCurrentSpan("partsCount", parts.length);
+    const completeUpload = import_effect25.Effect.fn("DeploymentApiService.completeUpload")(function* (deploymentId, uploadId, parts) {
+      yield* import_effect25.Effect.annotateCurrentSpan("deploymentId", deploymentId);
+      yield* import_effect25.Effect.annotateCurrentSpan("partsCount", parts.length);
       const client = yield* getClient;
-      yield* import_effect24.Effect.tryPromise({
+      yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.completeUpload(deploymentId, uploadId, parts),
         catch: (error) => new UploadCompleteError({
           message: `Failed to complete upload: ${error instanceof Error ? error.message : String(error)}`
         })
       });
-      yield* import_effect24.Effect.log("Upload completed successfully");
+      yield* import_effect25.Effect.log("Upload completed successfully");
     });
-    const getDeploymentStatus = import_effect24.Effect.fn("DeploymentApiService.getDeploymentStatus")(function* (deploymentId) {
+    const getDeploymentStatus = import_effect25.Effect.fn("DeploymentApiService.getDeploymentStatus")(function* (deploymentId) {
       const client = yield* getClient;
-      const deployment = yield* import_effect24.Effect.tryPromise({
+      const deployment = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.get(deploymentId),
         catch: (error) => new DeploymentStatusError({
           message: `Failed to get deployment status: ${error instanceof Error ? error.message : String(error)}`
@@ -2634,9 +3226,9 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
       });
       return deployment.status;
     });
-    const getLogs = import_effect24.Effect.fn("DeploymentApiService.getLogs")(function* (deploymentId, options) {
+    const getLogs = import_effect25.Effect.fn("DeploymentApiService.getLogs")(function* (deploymentId, options) {
       const client = yield* getClient;
-      const result = yield* import_effect24.Effect.tryPromise({
+      const result = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.getLogs(deploymentId, options),
         catch: (error) => new DeploymentLogsFetchError({
           message: `Failed to get logs: ${error instanceof Error ? error.message : String(error)}`
@@ -2644,9 +3236,9 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
       });
       return result;
     });
-    const getHostnames = import_effect24.Effect.fn("DeploymentApiService.getHostnames")(function* (deploymentId) {
+    const getHostnames = import_effect25.Effect.fn("DeploymentApiService.getHostnames")(function* (deploymentId) {
       const client = yield* getClient;
-      const result = yield* import_effect24.Effect.tryPromise({
+      const result = yield* import_effect25.Effect.tryPromise({
         try: () => client.deployments.getHostnames(deploymentId),
         catch: (error) => new DeploymentHostnamesFetchError({
           message: `Failed to get hostnames: ${error instanceof Error ? error.message : String(error)}`
@@ -2669,39 +3261,39 @@ var DeploymentApiService = class extends import_effect24.Effect.Service()("Deplo
 };
 
 // src/commands/platform/deploy/index.ts
-var appOption5 = import_cli11.Options.text("app").pipe(
-  import_cli11.Options.withAlias("a"),
-  import_cli11.Options.withDescription("Application ID to deploy to (overrides the linked application)"),
-  import_cli11.Options.optional
-);
-var orgOption5 = import_cli11.Options.text("org").pipe(
-  import_cli11.Options.withAlias("o"),
-  import_cli11.Options.withDescription("Organization ID to use when automatically creating an application"),
-  import_cli11.Options.optional
-);
-var nameOption2 = import_cli11.Options.text("name").pipe(
-  import_cli11.Options.withAlias("n"),
-  import_cli11.Options.withDescription("Application name to use when automatically creating an application"),
-  import_cli11.Options.optional
-);
-var createAndLinkDeploymentApplication = (input) => import_effect25.Effect.gen(function* () {
+var appOption6 = import_cli12.Options.text("app").pipe(
+  import_cli12.Options.withAlias("a"),
+  import_cli12.Options.withDescription("Application ID to deploy to (overrides the linked application)"),
+  import_cli12.Options.optional
+);
+var orgOption6 = import_cli12.Options.text("org").pipe(
+  import_cli12.Options.withAlias("o"),
+  import_cli12.Options.withDescription("Organization ID to use when automatically creating an application"),
+  import_cli12.Options.optional
+);
+var nameOption2 = import_cli12.Options.text("name").pipe(
+  import_cli12.Options.withAlias("n"),
+  import_cli12.Options.withDescription("Application name to use when automatically creating an application"),
+  import_cli12.Options.optional
+);
+var createAndLinkDeploymentApplication = (input) => import_effect26.Effect.gen(function* () {
   const projectLink = yield* ProjectLinkService;
   const apiClient = yield* ApiClientService;
   const { items: organizations } = yield* apiClient.request((client) => client.organizations.list());
-  const availableOrganizations = import_effect25.Option.match(input.org, {
+  const availableOrganizations = import_effect26.Option.match(input.org, {
     onNone: () => organizations,
     onSome: (organizationId) => organizations.filter((organization2) => organization2.id === organizationId)
   });
   if (availableOrganizations.length === 0) {
     return yield* new NoOrganizationsFoundError({
-      message: import_effect25.Option.match(input.org, {
+      message: import_effect26.Option.match(input.org, {
         onNone: () => 'No organization is available for this deployment. Create an organization, then run "gigadrive deploy" again.',
         onSome: (organizationId) => `Organization "${organizationId}" was not found among your organizations.`
       })
     });
   }
-  const organization = availableOrganizations.length === 1 ? availableOrganizations[0] : yield* import_cli11.Prompt.run(
-    import_cli11.Prompt.select({
+  const organization = availableOrganizations.length === 1 ? availableOrganizations[0] : yield* import_cli12.Prompt.run(
+    import_cli12.Prompt.select({
       message: "Select an organization for this application",
       choices: availableOrganizations.map((candidate) => ({
         title: candidate.name,
@@ -2710,7 +3302,7 @@ var createAndLinkDeploymentApplication = (input) => import_effect25.Effect.gen(f
     })
   );
   const inferredName = path.basename(input.cwd) || "Application";
-  const applicationName = import_effect25.Option.match(input.name, {
+  const applicationName = import_effect26.Option.match(input.name, {
     onNone: () => inferredName,
     onSome: (name) => name
   }).trim();
@@ -2724,104 +3316,108 @@ var createAndLinkDeploymentApplication = (input) => import_effect25.Effect.gen(f
     applicationId: application.id,
     organizationId: organization.id
   });
-  yield* import_effect25.Console.log(`Created and linked application ${application.name} (${application.id}).`);
+  yield* import_effect26.Console.log(`Created and linked application ${application.name} (${application.id}).`);
   return application.id;
 });
-var resolveLinkedDeploymentApplication = (input) => import_effect25.Effect.gen(function* () {
+var resolveLinkedDeploymentApplication = (input) => import_effect26.Effect.gen(function* () {
   const projectLink = yield* ProjectLinkService;
   const existingLink = yield* projectLink.load(input.cwd);
-  return yield* import_effect25.Option.match(existingLink, {
+  return yield* import_effect26.Option.match(existingLink, {
     onNone: () => createAndLinkDeploymentApplication(input),
-    onSome: (link) => import_effect25.Effect.succeed(link.applicationId)
+    onSome: (link) => import_effect26.Effect.succeed(link.applicationId)
   });
 });
-var resolveDeploymentApplication = (input) => import_effect25.Option.match(input.app, {
+var resolveDeploymentApplication = (input) => import_effect26.Option.match(input.app, {
   onNone: () => resolveLinkedDeploymentApplication(input),
-  onSome: import_effect25.Effect.succeed
+  onSome: import_effect26.Effect.succeed
 });
-var deployCommand = import_cli11.Command.make(
+var deployCommand = import_cli12.Command.make(
   "deploy",
-  { app: appOption5, org: orgOption5, name: nameOption2 },
-  ({ app, org, name }) => import_effect25.Effect.gen(function* () {
+  { app: appOption6, org: orgOption6, name: nameOption2 },
+  ({ app, org, name }) => import_effect26.Effect.gen(function* () {
     const projectConfig = yield* ProjectConfigService;
     const deploymentApi = yield* DeploymentApiService;
     const archiveService = yield* ArchiveService;
     const pathService = yield* import_platform9.Path.Path;
     const cwd = process.cwd();
-    yield* import_effect25.Effect.log("Starting deploy command");
+    yield* import_effect26.Effect.log("Starting deploy command");
     const { config } = yield* projectConfig.resolve(cwd);
     const applicationId = yield* resolveDeploymentApplication({ app, org, name, cwd });
-    yield* import_effect25.Console.log("Creating deployment...");
+    yield* import_effect26.Console.log("Creating deployment...");
     const deploymentId = yield* deploymentApi.createDeployment(applicationId);
-    yield* import_effect25.Console.log(`Deployment ID: ${deploymentId}`);
-    yield* import_effect25.Console.log("Creating archive...");
+    yield* import_effect26.Console.log(`Deployment ID: ${deploymentId}`);
+    yield* import_effect26.Console.log("Creating archive...");
     const archivePath = pathService.join(os4.tmpdir(), `project-${Date.now()}.zip`);
     const archive = yield* archiveService.createZipArchive(config.userArchive?.rootOverwrite || cwd, archivePath, {
       whitelist: config.userArchive?.fileWhitelist,
-      excludeFiles: config.excludeFiles
+      excludeFiles: config.excludeFiles,
+      buildsContainerImages: [
+        ...config.entrypoints.flatMap((entrypoint) => entrypoint.container ? [entrypoint.container] : []),
+        ...config.sidecars ?? []
+      ].some((container) => container.source.type === "dockerfile")
     });
-    yield* import_effect25.Console.log(`Archive created (${(0, import_commons.formatFileSize)(archive.size)})`);
-    yield* import_effect25.Console.log("Uploading archive...");
+    yield* import_effect26.Console.log(`Archive created (${(0, import_commons.formatFileSize)(archive.size)})`);
+    yield* import_effect26.Console.log("Uploading archive...");
     yield* uploadArchive(deploymentId, archivePath, archive.size);
-    yield* import_effect25.Console.log("Upload complete.");
-    yield* import_effect25.Console.log("The deployment pipeline is now being provisioned. This may take a few seconds.");
+    yield* import_effect26.Console.log("Upload complete.");
+    yield* import_effect26.Console.log("The deployment pipeline is now being provisioned. This may take a few seconds.");
     yield* pollDeployment(deploymentId);
   }).pipe(
-    import_effect25.Effect.catchTags({
-      QuitException: () => import_effect25.Console.log("Cancelled."),
-      NotAuthenticatedError: (err) => import_effect25.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect25.Effect.andThen(import_effect25.Effect.fail(err))
+    import_effect26.Effect.catchTags({
+      QuitException: () => import_effect26.Console.log("Cancelled."),
+      NotAuthenticatedError: (err) => import_effect26.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect26.Effect.andThen(import_effect26.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect25.Console.error(`Application setup failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      NoOrganizationsFoundError: (err) => import_effect25.Console.error(err.message).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect25.Console.error(err.message).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ProjectLinkWriteError: (err) => import_effect25.Console.error(err.message).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ConfigNotFoundError: (err) => import_effect25.Console.error(err.message).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ConfigParseError: (err) => import_effect25.Console.error(`Config parse error: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ConfigValidationError: (err) => import_effect25.Effect.gen(function* () {
+      ApiRequestError: (err) => import_effect26.Console.error(`Application setup failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      NoOrganizationsFoundError: (err) => import_effect26.Console.error(err.message).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect26.Console.error(err.message).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ProjectLinkWriteError: (err) => import_effect26.Console.error(err.message).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ConfigNotFoundError: (err) => import_effect26.Console.error(err.message).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ConfigParseError: (err) => import_effect26.Console.error(`Config parse error: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ConfigValidationError: (err) => import_effect26.Effect.gen(function* () {
         for (const e of err.errors) {
-          yield* import_effect25.Console.error(e);
+          yield* import_effect26.Console.error(e);
         }
-        yield* import_effect25.Console.error(err.message);
-      }).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      DeploymentCreateError: (err) => import_effect25.Console.error(`Deployment creation failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      ArchiveCreateError: (err) => import_effect25.Console.error(`Archive creation failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      UploadStartError: (err) => import_effect25.Console.error(`Upload failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      UploadPartError: (err) => import_effect25.Console.error(`Upload failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      UploadCompleteError: (err) => import_effect25.Console.error(`Upload failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      PresignedUrlError: (err) => import_effect25.Console.error(`Upload failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      DeploymentAuthError: (err) => import_effect25.Console.error(`Authentication failed: ${err.message}`).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err))),
-      DeploymentFailedError: (err) => import_effect25.Console.error(err.message).pipe(import_effect25.Effect.andThen(import_effect25.Effect.fail(err)))
+        yield* import_effect26.Console.error(err.message);
+      }).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      DeploymentCreateError: (err) => import_effect26.Console.error(`Deployment creation failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      ArchiveCreateError: (err) => import_effect26.Console.error(`Archive creation failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      UploadStartError: (err) => import_effect26.Console.error(`Upload failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      UploadPartError: (err) => import_effect26.Console.error(`Upload failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      UploadCompleteError: (err) => import_effect26.Console.error(`Upload failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      PresignedUrlError: (err) => import_effect26.Console.error(`Upload failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      DeploymentAuthError: (err) => import_effect26.Console.error(`Authentication failed: ${err.message}`).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err))),
+      DeploymentFailedError: (err) => import_effect26.Console.error(err.message).pipe(import_effect26.Effect.andThen(import_effect26.Effect.fail(err)))
     })
   )
 );
-var uploadArchive = (deploymentId, archivePath, fileSize) => import_effect25.Effect.gen(function* () {
+var uploadArchive = (deploymentId, archivePath, fileSize) => import_effect26.Effect.gen(function* () {
   const deploymentApi = yield* DeploymentApiService;
   const fs = yield* import_platform9.FileSystem.FileSystem;
   const uploadId = yield* deploymentApi.startMultipartUpload(deploymentId);
   const FILE_CHUNK_SIZE = 10 * 1024 * 1024;
   const numChunks = Math.ceil(fileSize / FILE_CHUNK_SIZE);
-  yield* import_effect25.Effect.log("Starting multipart upload", { uploadId, numChunks, fileSize });
-  const parts = yield* import_effect25.Effect.all(
+  yield* import_effect26.Effect.log("Starting multipart upload", { uploadId, numChunks, fileSize });
+  const parts = yield* import_effect26.Effect.all(
     Array.from({ length: numChunks }, (_, i) => {
       const partNumber = i + 1;
       const start = i * FILE_CHUNK_SIZE;
       const bytesToRead = partNumber < numChunks ? FILE_CHUNK_SIZE : fileSize - start;
-      return import_effect25.Effect.gen(function* () {
+      return import_effect26.Effect.gen(function* () {
         const presignedUrl = yield* deploymentApi.getPresignedUrl(deploymentId, uploadId, partNumber);
-        const chunkData = yield* import_effect25.Stream.runCollect(fs.stream(archivePath, { offset: start, bytesToRead })).pipe(
-          import_effect25.Effect.map((chunks) => {
+        const chunkData = yield* import_effect26.Stream.runCollect(fs.stream(archivePath, { offset: start, bytesToRead })).pipe(
+          import_effect26.Effect.map((chunks) => {
             const arrays = Array.from(chunks);
             return Buffer.concat(arrays);
           }),
-          import_effect25.Effect.mapError(
+          import_effect26.Effect.mapError(
             (error) => new UploadPartError({
               message: `Failed to read chunk ${partNumber}: ${String(error)}`,
               partNumber
             })
           )
         );
-        yield* import_effect25.Effect.log(`Uploading part ${partNumber}/${numChunks}`, { size: chunkData.length });
+        yield* import_effect26.Effect.log(`Uploading part ${partNumber}/${numChunks}`, { size: chunkData.length });
         return yield* deploymentApi.uploadPart(presignedUrl, chunkData, partNumber);
       });
     }),
@@ -2829,20 +3425,20 @@ var uploadArchive = (deploymentId, archivePath, fileSize) => import_effect25.Eff
   );
   yield* deploymentApi.completeUpload(deploymentId, uploadId, parts);
 });
-var pollDeployment = (deploymentId) => import_effect25.Effect.gen(function* () {
+var pollDeployment = (deploymentId) => import_effect26.Effect.gen(function* () {
   const deploymentApi = yield* DeploymentApiService;
   let lastStatus = "PENDING";
   let logOffset = 0;
-  yield* import_effect25.Console.log("Status: Pending");
-  yield* import_effect25.Effect.repeat(
-    import_effect25.Effect.gen(function* () {
-      const newStatus = yield* deploymentApi.getDeploymentStatus(deploymentId).pipe(import_effect25.Effect.catchTag("DeploymentStatusError", () => import_effect25.Effect.succeed(lastStatus)));
+  yield* import_effect26.Console.log("Status: Pending");
+  yield* import_effect26.Effect.repeat(
+    import_effect26.Effect.gen(function* () {
+      const newStatus = yield* deploymentApi.getDeploymentStatus(deploymentId).pipe(import_effect26.Effect.catchTag("DeploymentStatusError", () => import_effect26.Effect.succeed(lastStatus)));
       if (newStatus !== lastStatus) {
         lastStatus = newStatus;
         const label = newStatus.charAt(0) + newStatus.slice(1).toLowerCase();
-        yield* import_effect25.Console.log(`Status: ${label}`);
+        yield* import_effect26.Console.log(`Status: ${label}`);
       }
-      const logsPage = yield* deploymentApi.getLogs(deploymentId, { offset: logOffset, limit: 100 }).pipe(import_effect25.Effect.catchTag("DeploymentLogsFetchError", () => import_effect25.Effect.succeed(null)));
+      const logsPage = yield* deploymentApi.getLogs(deploymentId, { offset: logOffset, limit: 100 }).pipe(import_effect26.Effect.catchTag("DeploymentLogsFetchError", () => import_effect26.Effect.succeed(null)));
       if (logsPage) {
         for (const logEntry of logsPage.items) {
           logOffset++;
@@ -2850,86 +3446,86 @@ var pollDeployment = (deploymentId) => import_effect25.Effect.gen(function* () {
         }
       }
       if (newStatus === "ACTIVE") {
-        const hostnames = yield* deploymentApi.getHostnames(deploymentId).pipe(import_effect25.Effect.catchTag("DeploymentHostnamesFetchError", () => import_effect25.Effect.succeed([])));
+        const hostnames = yield* deploymentApi.getHostnames(deploymentId).pipe(import_effect26.Effect.catchTag("DeploymentHostnamesFetchError", () => import_effect26.Effect.succeed([])));
         const active = hostnames.find((h) => h.active) ?? hostnames.at(0);
         if (active) {
-          yield* import_effect25.Console.log(`Deployed to https://${active.hostname}`);
+          yield* import_effect26.Console.log(`Deployed to https://${active.hostname}`);
         } else {
-          yield* import_effect25.Console.log("Deployment is live.");
+          yield* import_effect26.Console.log("Deployment is live.");
         }
-        return yield* import_effect25.Effect.fail("done");
+        return yield* import_effect26.Effect.fail("done");
       }
       if (newStatus === "FAILED") {
-        return yield* import_effect25.Effect.fail(
+        return yield* import_effect26.Effect.fail(
           new DeploymentFailedError({
             message: "The deployment failed. Please check the logs for more information."
           })
         );
       }
     }),
-    import_effect25.Schedule.addDelay(import_effect25.Schedule.forever, () => import_effect25.Duration.seconds(1))
+    import_effect26.Schedule.addDelay(import_effect26.Schedule.forever, () => import_effect26.Duration.seconds(1))
   ).pipe(
-    import_effect25.Effect.catchAll((err) => {
-      if (err === "done") return import_effect25.Effect.void;
-      return import_effect25.Effect.fail(err);
+    import_effect26.Effect.catchAll((err) => {
+      if (err === "done") return import_effect26.Effect.void;
+      return import_effect26.Effect.fail(err);
     })
   );
 });
 var printLog = (logEntry) => {
   switch (logEntry.type) {
     case "ERROR":
-      return import_effect25.Console.error(logEntry.message);
+      return import_effect26.Console.error(logEntry.message);
     case "WARN":
-      return import_effect25.Console.warn(logEntry.message);
+      return import_effect26.Console.warn(logEntry.message);
     default:
-      return import_effect25.Console.log(logEntry.message);
+      return import_effect26.Console.log(logEntry.message);
   }
 };
 
 // src/commands/platform/index.ts
-var platformBase = import_cli12.Command.make("platform", {}, () => import_effect26.Effect.void);
-var platformCommand = platformBase.pipe(import_cli12.Command.withSubcommands([deployCommand]));
+var platformBase = import_cli13.Command.make("platform", {}, () => import_effect27.Effect.void);
+var platformCommand = platformBase.pipe(import_cli13.Command.withSubcommands([deployCommand]));
 
 // src/commands/setup/index.ts
-var import_cli13 = require("@effect/cli");
-var import_effect27 = require("effect");
-var fileArg2 = import_cli13.Args.text({ name: "file" }).pipe(
-  import_cli13.Args.withDescription("Output file to write (default: .env.local)"),
-  import_cli13.Args.optional
+var import_cli14 = require("@effect/cli");
+var import_effect28 = require("effect");
+var fileArg2 = import_cli14.Args.text({ name: "file" }).pipe(
+  import_cli14.Args.withDescription("Output file to write (default: .env.local)"),
+  import_cli14.Args.optional
 );
-var appOption6 = import_cli13.Options.text("app").pipe(
-  import_cli13.Options.withAlias("a"),
-  import_cli13.Options.withDescription("Application ID to set up (skips the interactive picker)"),
-  import_cli13.Options.optional
+var appOption7 = import_cli14.Options.text("app").pipe(
+  import_cli14.Options.withAlias("a"),
+  import_cli14.Options.withDescription("Application ID to set up (skips the interactive picker)"),
+  import_cli14.Options.optional
 );
-var orgOption6 = import_cli13.Options.text("org").pipe(
-  import_cli13.Options.withAlias("o"),
-  import_cli13.Options.withDescription("Only list applications belonging to this organization ID when picking"),
-  import_cli13.Options.optional
+var orgOption7 = import_cli14.Options.text("org").pipe(
+  import_cli14.Options.withAlias("o"),
+  import_cli14.Options.withDescription("Only list applications belonging to this organization ID when picking"),
+  import_cli14.Options.optional
 );
-var environmentOption2 = import_cli13.Options.text("environment").pipe(
-  import_cli13.Options.withAlias("e"),
-  import_cli13.Options.withDescription("Environment slug to resolve overrides for (e.g. preview)"),
-  import_cli13.Options.optional
+var environmentOption2 = import_cli14.Options.text("environment").pipe(
+  import_cli14.Options.withAlias("e"),
+  import_cli14.Options.withDescription("Environment slug to resolve overrides for (e.g. preview)"),
+  import_cli14.Options.optional
 );
-var yesOption2 = import_cli13.Options.boolean("yes").pipe(
-  import_cli13.Options.withAlias("y"),
-  import_cli13.Options.withDescription("Overwrite an existing file without confirmation")
+var yesOption3 = import_cli14.Options.boolean("yes").pipe(
+  import_cli14.Options.withAlias("y"),
+  import_cli14.Options.withDescription("Overwrite an existing file without confirmation")
 );
-var rotateOption2 = import_cli13.Options.boolean("rotate").pipe(
-  import_cli13.Options.withDescription("Force a fresh API key, revoking the previous one")
+var rotateOption2 = import_cli14.Options.boolean("rotate").pipe(
+  import_cli14.Options.withDescription("Force a fresh API key, revoking the previous one")
 );
-var setupCommand = import_cli13.Command.make(
+var setupCommand = import_cli14.Command.make(
   "setup",
   {
     file: fileArg2,
-    app: appOption6,
-    org: orgOption6,
+    app: appOption7,
+    org: orgOption7,
     environment: environmentOption2,
-    yes: yesOption2,
+    yes: yesOption3,
     rotate: rotateOption2
   },
-  ({ file, app, org, environment, yes, rotate }) => import_effect27.Effect.gen(function* () {
+  ({ file, app, org, environment, yes, rotate }) => import_effect28.Effect.gen(function* () {
     const apiClient = yield* ApiClientService;
     const projectLink = yield* ProjectLinkService;
     const envFile = yield* EnvFileService;
@@ -2937,29 +3533,29 @@ var setupCommand = import_cli13.Command.make(
     const cwd = process.cwd();
     const existingLink = yield* projectLink.load(cwd);
     let applicationId;
-    if (import_effect27.Option.isSome(existingLink)) {
+    if (import_effect28.Option.isSome(existingLink)) {
       applicationId = existingLink.value.applicationId;
-      if (import_effect27.Option.isSome(app) || import_effect27.Option.isSome(org)) {
-        yield* import_effect27.Console.log(
+      if (import_effect28.Option.isSome(app) || import_effect28.Option.isSome(org)) {
+        yield* import_effect28.Console.log(
           `Note: this directory is already linked to ${applicationId}; ignoring --app/--org. Run "gigadrive unlink" first to target a different application.`
         );
       }
     } else {
-      const organizationId = import_effect27.Option.getOrUndefined(org);
+      const organizationId = import_effect28.Option.getOrUndefined(org);
       const { items: apps } = yield* apiClient.request((client) => client.applications.list({ organizationId }));
       if (apps.length === 0) {
-        return yield* import_effect27.Effect.fail(
+        return yield* import_effect28.Effect.fail(
           new NoApplicationsFoundError({
             message: 'No applications found. Create one in the Gigadrive console, then run "gigadrive setup" again.'
           })
         );
       }
-      const explicitAppId = import_effect27.Option.getOrUndefined(app);
+      const explicitAppId = import_effect28.Option.getOrUndefined(app);
       let chosen;
       if (explicitAppId !== void 0) {
         const match = apps.find((a) => a.id === explicitAppId);
         if (match === void 0) {
-          return yield* import_effect27.Effect.fail(
+          return yield* import_effect28.Effect.fail(
             new ApplicationNotFoundError({
               message: `Application "${explicitAppId}" was not found among your applications.`
             })
@@ -2969,8 +3565,8 @@ var setupCommand = import_cli13.Command.make(
       } else if (apps.length === 1) {
         chosen = apps[0];
       } else {
-        chosen = yield* import_cli13.Prompt.run(
-          import_cli13.Prompt.select({
+        chosen = yield* import_cli14.Prompt.run(
+          import_cli14.Prompt.select({
             message: "Select an application to set up",
             choices: apps.map((a) => ({ title: `${a.name} (${a.organization.name})`, value: a }))
           })
@@ -2978,83 +3574,83 @@ var setupCommand = import_cli13.Command.make(
       }
       applicationId = chosen.id;
       yield* projectLink.save(cwd, { applicationId, organizationId: chosen.organization.id });
-      yield* import_effect27.Console.log(`Linked this directory to application ${applicationId}.`);
+      yield* import_effect28.Console.log(`Linked this directory to application ${applicationId}.`);
     }
-    const target = import_effect27.Option.getOrElse(file, () => ".env.local");
-    const environmentSlug = import_effect27.Option.getOrUndefined(environment);
+    const target = import_effect28.Option.getOrElse(file, () => ".env.local");
+    const environmentSlug = import_effect28.Option.getOrUndefined(environment);
     const { items, omittedSensitive } = yield* apiClient.request(
       (client) => client.applications.envVars.pull(applicationId, environmentSlug ? { environment: environmentSlug } : void 0)
     );
     const existing = yield* envFile.read(target);
-    if (import_effect27.Option.isSome(existing) && !yes) {
-      const overwrite = yield* import_cli13.Prompt.run(
-        import_cli13.Prompt.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
+    if (import_effect28.Option.isSome(existing) && !yes) {
+      const overwrite = yield* import_cli14.Prompt.run(
+        import_cli14.Prompt.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
       );
       if (!overwrite) {
-        return yield* import_effect27.Console.log("Cancelled.");
+        return yield* import_effect28.Console.log("Cancelled.");
       }
     }
     const credentialEntries2 = yield* localCredentials.provision({
       applicationId,
       rotate,
-      existingContent: import_effect27.Option.getOrUndefined(existing)
+      existingContent: import_effect28.Option.getOrUndefined(existing)
     });
     const entries = [...items.map((v) => ({ key: v.key, value: v.value })), ...credentialEntries2];
     yield* envFile.write(target, entries);
     const gitignored = yield* envFile.ensureGitignored(cwd, target);
-    yield* import_effect27.Console.log("\nLocal dev environment ready.");
-    yield* import_effect27.Console.log(`  \u2022 Wrote ${items.length} variable(s) and API credentials to ${target}.`);
+    yield* import_effect28.Console.log("\nLocal dev environment ready.");
+    yield* import_effect28.Console.log(`  \u2022 Wrote ${items.length} variable(s) and API credentials to ${target}.`);
     if (omittedSensitive > 0) {
-      yield* import_effect27.Console.log(
+      yield* import_effect28.Console.log(
         `  \u2022 Skipped ${omittedSensitive} sensitive variable(s) (only production/preview hold secrets).`
       );
     }
     if (gitignored) {
-      yield* import_effect27.Console.log(`  \u2022 Added ${target} to .gitignore.`);
+      yield* import_effect28.Console.log(`  \u2022 Added ${target} to .gitignore.`);
     }
-    yield* import_effect27.Console.log("  \u2022 Your app can now call the Gigadrive API via the SDK (GIGADRIVE_CLIENT_ID/SECRET).");
+    yield* import_effect28.Console.log("  \u2022 Your app can now call the Gigadrive API via the SDK (GIGADRIVE_CLIENT_ID/SECRET).");
   }).pipe(
-    import_effect27.Effect.catchTags({
+    import_effect28.Effect.catchTags({
       // Ctrl+C during a prompt is a deliberate cancel — exit 0.
-      QuitException: () => import_effect27.Console.log("Cancelled."),
-      NotAuthenticatedError: (err) => import_effect27.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        import_effect27.Effect.andThen(import_effect27.Effect.fail(err))
+      QuitException: () => import_effect28.Console.log("Cancelled."),
+      NotAuthenticatedError: (err) => import_effect28.Console.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        import_effect28.Effect.andThen(import_effect28.Effect.fail(err))
       ),
-      ApiRequestError: (err) => import_effect27.Console.error(`Setup failed: ${err.message}`).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      NoApplicationsFoundError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      ApplicationNotFoundError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      ProjectLinkReadError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      ProjectLinkWriteError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      EnvFileReadError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      EnvFileWriteError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      DevCredentialsStoreReadError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err))),
-      DevCredentialsStoreWriteError: (err) => import_effect27.Console.error(err.message).pipe(import_effect27.Effect.andThen(import_effect27.Effect.fail(err)))
+      ApiRequestError: (err) => import_effect28.Console.error(`Setup failed: ${err.message}`).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      NoApplicationsFoundError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      ApplicationNotFoundError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      ProjectLinkReadError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      ProjectLinkWriteError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      EnvFileReadError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      EnvFileWriteError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      DevCredentialsStoreReadError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err))),
+      DevCredentialsStoreWriteError: (err) => import_effect28.Console.error(err.message).pipe(import_effect28.Effect.andThen(import_effect28.Effect.fail(err)))
     })
   )
 );
 
 // src/commands/whoami/index.ts
-var import_cli14 = require("@effect/cli");
-var import_effect28 = require("effect");
-var whoamiCommand = import_cli14.Command.make(
+var import_cli15 = require("@effect/cli");
+var import_effect29 = require("effect");
+var whoamiCommand = import_cli15.Command.make(
   "whoami",
   {},
-  () => import_effect28.Effect.gen(function* () {
+  () => import_effect29.Effect.gen(function* () {
     const auth = yield* AuthService;
     const info = yield* auth.getUserInfo;
-    yield* import_effect28.Console.log(JSON.stringify(info, null, 2));
+    yield* import_effect29.Console.log(JSON.stringify(info, null, 2));
   }).pipe(
-    import_effect28.Effect.catchTags({
-      NotAuthenticatedError: () => import_effect28.Console.log('You are not logged in. Run "gigadrive login" to authenticate.'),
-      UserInfoFetchError: (err) => import_effect28.Console.error(`Failed to retrieve user info: ${err.message}`),
-      OAuthDiscoveryError: (err) => import_effect28.Console.error(`Failed to retrieve user info: ${err.message}`)
+    import_effect29.Effect.catchTags({
+      NotAuthenticatedError: () => import_effect29.Console.log('You are not logged in. Run "gigadrive login" to authenticate.'),
+      UserInfoFetchError: (err) => import_effect29.Console.error(`Failed to retrieve user info: ${err.message}`),
+      OAuthDiscoveryError: (err) => import_effect29.Console.error(`Failed to retrieve user info: ${err.message}`)
     })
   )
 );
 
 // src/index.ts
-var gigadrive = import_cli15.Command.make("gigadrive", {}, () => import_effect29.Effect.void).pipe(
-  import_cli15.Command.withSubcommands([
+var gigadrive = import_cli16.Command.make("gigadrive", {}, () => import_effect30.Effect.void).pipe(
+  import_cli16.Command.withSubcommands([
     loginCommand,
     logoutCommand,
     whoamiCommand,
@@ -3063,6 +3659,7 @@ var gigadrive = import_cli15.Command.make("gigadrive", {}, () => import_effect29
     appsCommand,
     envCommand,
     deploymentsCommand,
+    domainsCommand,
     aiCommand,
     buildCommand,
     debugCommand,
@@ -3071,11 +3668,11 @@ var gigadrive = import_cli15.Command.make("gigadrive", {}, () => import_effect29
     setupCommand
   ])
 );
-var cli = import_cli15.Command.run(gigadrive, {
+var cli = import_cli16.Command.run(gigadrive, {
   name: "Gigadrive CLI",
   version: package_default.version
 });
-var BaseServices = import_effect29.Layer.mergeAll(
+var BaseServices = import_effect30.Layer.mergeAll(
   OAuthConfigService.Default,
   AuthStorageService.Default,
   PackageManagerService.Default,
@@ -3085,13 +3682,13 @@ var BaseServices = import_effect29.Layer.mergeAll(
   ProjectLinkService.Default,
   EnvFileService.Default,
   DevCredentialsStore.Default
-).pipe(import_effect29.Layer.provideMerge(AuthService.Default));
-var ApiClientLive = import_effect29.Layer.provide(ApiClientService.Default, BaseServices);
-var DeploymentApiLive = import_effect29.Layer.provide(DeploymentApiService.Default, BaseServices);
-var LocalCredentialsLive = import_effect29.Layer.provide(LocalCredentialsService.Default, BaseServices);
-var ServicesLive = import_effect29.Layer.mergeAll(BaseServices, ApiClientLive, DeploymentApiLive, LocalCredentialsLive);
-var AppLive = import_effect29.Layer.mergeAll(ServicesLive, import_effect29.Logger.minimumLogLevel(import_effect29.LogLevel.Info)).pipe(
-  import_effect29.Layer.provideMerge(import_platform_node.NodeContext.layer)
-);
-import_platform_node.NodeRuntime.runMain(import_effect29.Effect.provide(cli(process.argv), AppLive));
+).pipe(import_effect30.Layer.provideMerge(AuthService.Default));
+var ApiClientLive = import_effect30.Layer.provide(ApiClientService.Default, BaseServices);
+var DeploymentApiLive = import_effect30.Layer.provide(DeploymentApiService.Default, BaseServices);
+var LocalCredentialsLive = import_effect30.Layer.provide(LocalCredentialsService.Default, BaseServices);
+var ServicesLive = import_effect30.Layer.mergeAll(BaseServices, ApiClientLive, DeploymentApiLive, LocalCredentialsLive);
+var AppLive = import_effect30.Layer.mergeAll(ServicesLive, import_effect30.Logger.minimumLogLevel(import_effect30.LogLevel.Info)).pipe(
+  import_effect30.Layer.provideMerge(import_platform_node.NodeContext.layer)
+);
+import_platform_node.NodeRuntime.runMain(import_effect30.Effect.provide(cli(process.argv), AppLive));
 //# sourceMappingURL=index.cjs.map