instavm 0.15.0 → 0.16.0

package/dist/cli.js

@@ -35,8 +35,9 @@ __export(cli_exports, {
   runCli: () => runCli
 });
 module.exports = __toCommonJS(cli_exports);
-var import_fs3 = __toESM(require("fs"));
-var import_path12 = __toESM(require("path"));
+var import_fs5 = __toESM(require("fs"));
+var import_crypto2 = __toESM(require("crypto"));
+var import_path14 = __toESM(require("path"));
 var import_child_process = require("child_process");
 var import_commander = require("commander");
 
@@ -179,7 +180,7 @@ var HTTPClient = class {
       timeout: config.timeout,
       headers: {
         "Content-Type": "application/json",
-        "User-Agent": "instavm-js-sdk/0.15.0"
+        "User-Agent": "instavm-js-sdk/0.16.0"
       }
     });
     this.setupInterceptors();
@@ -958,8 +959,8 @@ function encodePathSegment(value) {
   }
   return encodeURIComponent(segment);
 }
-function encodePathSegments(path4) {
-  const segments = path4.replace(/^\/+/, "").split("/").filter((segment) => segment.length > 0 && segment !== ".");
+function encodePathSegments(path6) {
+  const segments = path6.replace(/^\/+/, "").split("/").filter((segment) => segment.length > 0 && segment !== ".");
   if (segments.some((segment) => segment === "..")) {
     throw new Error("Path traversal not allowed in proxy path");
   }
@@ -1262,10 +1263,10 @@ var ComputerUseManager = class {
       { "X-API-Key": this.httpClient.apiKey }
     );
   }
-  async proxy(sessionId, path4, method = "GET", options = {}) {
+  async proxy(sessionId, path6, method = "GET", options = {}) {
     this.ensureCloud("Computer-use proxy");
     const safeSessionId = encodePathSegment(sessionId);
-    const cleanPath = encodePathSegments(path4);
+    const cleanPath = encodePathSegments(path6);
     return this.httpClient.request({
       method,
       url: `/v1/computeruse/${safeSessionId}/${cleanPath}`,
@@ -1274,26 +1275,26 @@ var ComputerUseManager = class {
       headers: { "X-API-Key": this.httpClient.apiKey }
     });
   }
-  async get(sessionId, path4, params) {
-    return this.proxy(sessionId, path4, "GET", { params });
+  async get(sessionId, path6, params) {
+    return this.proxy(sessionId, path6, "GET", { params });
   }
-  async post(sessionId, path4, body) {
-    return this.proxy(sessionId, path4, "POST", { body });
+  async post(sessionId, path6, body) {
+    return this.proxy(sessionId, path6, "POST", { body });
   }
-  async put(sessionId, path4, body) {
-    return this.proxy(sessionId, path4, "PUT", { body });
+  async put(sessionId, path6, body) {
+    return this.proxy(sessionId, path6, "PUT", { body });
   }
-  async patch(sessionId, path4, body) {
-    return this.proxy(sessionId, path4, "PATCH", { body });
+  async patch(sessionId, path6, body) {
+    return this.proxy(sessionId, path6, "PATCH", { body });
   }
-  async delete(sessionId, path4, params) {
-    return this.proxy(sessionId, path4, "DELETE", { params });
+  async delete(sessionId, path6, params) {
+    return this.proxy(sessionId, path6, "DELETE", { params });
   }
-  async options(sessionId, path4, params) {
-    return this.proxy(sessionId, path4, "OPTIONS", { params });
+  async options(sessionId, path6, params) {
+    return this.proxy(sessionId, path6, "OPTIONS", { params });
   }
-  async head(sessionId, path4, params) {
-    return this.proxy(sessionId, path4, "HEAD", { params });
+  async head(sessionId, path6, params) {
+    return this.proxy(sessionId, path6, "HEAD", { params });
   }
   /**
    * Get the VNC WebSocket URL for a computer-use session.
@@ -1624,12 +1625,12 @@ var VolumesManager = class {
       formData
     );
   }
-  async downloadFile(volumeId, path4) {
+  async downloadFile(volumeId, path6) {
     this.ensureCloud("Volume file download");
     const safeVolumeId = encodePathSegment(volumeId);
     const response = await this.httpClient.post(
       `/v1/volumes/${safeVolumeId}/files/download`,
-      { path: path4 },
+      { path: path6 },
       { "X-API-Key": this.httpClient.apiKey }
     );
     return {
@@ -2050,7 +2051,7 @@ var InstaVM = class {
   async getCurrentUser() {
     this.ensureNotLocal("User profile lookup");
     return this.httpClient.get(
-      "/v1/me",
+      "/v1/users/me",
       void 0,
       { "X-API-Key": this.httpClient.apiKey }
     );
@@ -2291,6 +2292,14 @@ var InstaVM = class {
   }
 };
 
+// src/cli/cookbook.ts
+var import_fs3 = __toESM(require("fs"));
+var import_os2 = __toESM(require("os"));
+var import_path12 = __toESM(require("path"));
+var import_crypto = __toESM(require("crypto"));
+var import_readline = __toESM(require("readline"));
+var import_yaml = require("yaml");
+
 // src/cli/config.ts
 var import_fs2 = __toESM(require("fs"));
 var import_os = __toESM(require("os"));
@@ -2527,225 +2536,2295 @@ function updateProfileSettings(options) {
   return saveConfig(config, configPath);
 }
 
-// src/cli.ts
-var defaultDeps = {
-  stdout: process.stdout,
-  stderr: process.stderr,
-  spawnSync: import_child_process.spawnSync,
-  resolveRuntimeConfig,
-  updateProfileSettings,
-  clientFactory: (apiKey, options) => new InstaVM(apiKey, options),
-  promptSecret,
-  readStdin,
-  writeFile: (outputPath, content) => {
-    import_fs3.default.writeFileSync(outputPath, content);
+// src/cli/cookbook.ts
+var CookbookError = class extends Error {
+};
+var CookbookDeployError = class extends CookbookError {
+  constructor(message, payload) {
+    super(message);
+    this.payload = payload;
   }
 };
-function printJson(deps, payload) {
-  deps.stdout.write(`${JSON.stringify(payload)}
-`);
+var DEFAULT_COOKBOOK_REPO_URL = "https://github.com/instavm/cookbooks.git";
+var DEFAULT_COOKBOOK_REF = "main";
+var DEFAULT_REMOTE_ROOT = ".instavm-cookbooks";
+var DEFAULT_SOURCE_EXCLUDES = [
+  ".git",
+  "__pycache__",
+  ".pytest_cache",
+  ".venv",
+  "venv",
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  ".DS_Store"
+];
+function getCookbookCacheDir(homeDir = import_os2.default.homedir()) {
+  return import_path12.default.join(getConfigDir(homeDir), "cookbooks");
 }
-function printLines(deps, lines) {
-  for (const line of lines) {
-    deps.stdout.write(`${line}
-`);
-  }
+function getCookbookRepoDir(homeDir = import_os2.default.homedir()) {
+  return import_path12.default.join(getCookbookCacheDir(homeDir), "repo");
 }
-function emitOutput(deps, options, payload, textLines) {
-  if (options.json) {
-    printJson(deps, payload);
-  } else {
-    printLines(deps, textLines);
+function resolveCookbookRoot(deps, progress, homeDir = import_os2.default.homedir()) {
+  const override = process.env.INSTAVM_COOKBOOKS_DIR;
+  if (override) {
+    const resolved = import_path12.default.resolve(override);
+    if (!import_fs3.default.existsSync(resolved)) {
+      throw new CookbookError(`Cookbook directory override does not exist: ${resolved}`);
+    }
+    return resolved;
   }
-  return 0;
+  return syncCookbookRepo(deps, progress, homeDir);
 }
-function addRuntimeOptions(command, options = {}) {
-  command.option("--api-key <apiKey>", "Override the InstaVM API key for this command");
-  command.option("--base-url <baseUrl>", "Override the InstaVM API base URL for this command");
-  if (options.includeSshHost) {
-    command.option("--ssh-host <sshHost>", "Override the SSH gateway host for this command");
+function syncCookbookRepo(deps, progress, homeDir = import_os2.default.homedir()) {
+  const repoUrl = process.env.INSTAVM_COOKBOOKS_REPO || DEFAULT_COOKBOOK_REPO_URL;
+  const repoRef = process.env.INSTAVM_COOKBOOKS_REF || DEFAULT_COOKBOOK_REF;
+  const repoDir = getCookbookRepoDir(homeDir);
+  import_fs3.default.mkdirSync(import_path12.default.dirname(repoDir), { recursive: true });
+  if (progress) {
+    progress(`Syncing cookbook catalog from ${repoUrl}`);
+  }
+  if (!import_fs3.default.existsSync(import_path12.default.join(repoDir, ".git"))) {
+    runCommand(
+      deps,
+      "git",
+      ["clone", "--depth", "1", "--branch", repoRef, repoUrl, repoDir],
+      "Failed to clone the cookbook catalog."
+    );
+    return repoDir;
   }
-  if (options.includeJson !== false) {
-    command.option("-j, --json", "Emit JSON output");
+  runCommand(deps, "git", ["-C", repoDir, "fetch", "--depth", "1", "origin", repoRef], "Failed to update the cookbook catalog.");
+  runCommand(deps, "git", ["-C", repoDir, "checkout", repoRef], "Failed to check out the cookbook catalog branch.");
+  runCommand(deps, "git", ["-C", repoDir, "reset", "--hard", "FETCH_HEAD"], "Failed to reset the cookbook catalog to the latest remote state.");
+  return repoDir;
+}
+function discoverCookbooks(root) {
+  if (!import_fs3.default.existsSync(root)) {
+    return [];
   }
-  return command;
+  return import_fs3.default.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && import_fs3.default.existsSync(import_path12.default.join(root, entry.name, "instavm.yaml"))).sort((a, b) => a.name.localeCompare(b.name)).map((entry) => loadManifest(import_path12.default.join(root, entry.name, "instavm.yaml")));
 }
-function parseSize(value) {
-  const raw = value.trim().toLowerCase();
-  if (!raw) {
-    throw new Error("size is required");
+function loadManifest(manifestPath) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(import_fs3.default.readFileSync(manifestPath, "utf8"));
+  } catch (error) {
+    throw new CookbookError(`Invalid cookbook manifest: ${manifestPath}`);
   }
-  const units = [
-    ["tb", 1024 ** 4],
-    ["gb", 1024 ** 3],
-    ["mb", 1024 ** 2],
-    ["kb", 1024],
-    ["b", 1]
-  ];
-  for (const [suffix, multiplier] of units) {
-    if (raw.endsWith(suffix) && raw !== suffix) {
-      const number = raw.slice(0, -suffix.length).trim();
-      return Math.floor(Number.parseFloat(number) * multiplier);
-    }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new CookbookError(`Manifest root must be an object: ${manifestPath}`);
   }
-  return Number.parseInt(raw, 10);
-}
-function humanBytes(value) {
-  let amount = Number(value || 0);
-  for (const unit of ["B", "KB", "MB", "GB", "TB"]) {
-    if (amount < 1024 || unit === "TB") {
-      if (unit === "B") {
-        return `${Math.trunc(amount)}${unit}`;
-      }
-      return `${amount.toFixed(1)}${unit}`;
+  const requireObject = (value, field) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new CookbookError(`Manifest field \`${field}\` must be an object.`);
     }
-    amount /= 1024;
-  }
-  return `${Math.trunc(Number(value || 0))}B`;
-}
-function parseEnvPairs(values) {
-  const pairs = {};
-  for (const entry of values || []) {
-    const separatorIndex = entry.indexOf("=");
-    if (separatorIndex < 1) {
-      throw new Error(`Expected KEY=VALUE, got: ${entry}`);
+    return value;
+  };
+  const requireString = (value, field) => {
+    if (typeof value !== "string" || !value.trim()) {
+      throw new CookbookError(`Manifest field \`${field}\` must be a non-empty string.`);
     }
-    const key = entry.slice(0, separatorIndex).trim();
-    const value = entry.slice(separatorIndex + 1);
-    if (!key) {
-      throw new Error(`Invalid env key: ${entry}`);
+    return value.trim();
+  };
+  const requireInt = (value, field) => {
+    if (!Number.isInteger(value)) {
+      throw new CookbookError(`Manifest field \`${field}\` must be an integer.`);
     }
-    pairs[key] = value;
+    return Number(value);
+  };
+  const requiredFields = [
+    "schema_version",
+    "slug",
+    "title",
+    "version",
+    "summary",
+    "category",
+    "runtime",
+    "deploy",
+    "vm",
+    "app",
+    "run",
+    "secrets",
+    "post_deploy_notes"
+  ];
+  const missing = requiredFields.filter((field) => !(field in raw));
+  if (missing.length > 0) {
+    throw new CookbookError(`Manifest is missing required fields: ${missing.join(", ")}`);
+  }
+  const deploy = requireObject(raw.deploy, "deploy");
+  const vm = requireObject(raw.vm, "vm");
+  const app = requireObject(raw.app, "app");
+  const run = requireObject(raw.run, "run");
+  const secrets = Array.isArray(raw.secrets) ? raw.secrets : [];
+  const manifest = {
+    path: import_path12.default.dirname(manifestPath),
+    schema_version: requireInt(raw.schema_version, "schema_version"),
+    slug: requireString(raw.slug, "slug"),
+    title: requireString(raw.title, "title"),
+    version: requireString(raw.version, "version"),
+    summary: requireString(raw.summary, "summary"),
+    category: requireString(raw.category, "category"),
+    runtime: requireString(raw.runtime, "runtime"),
+    deploy: {
+      kind: requireString(deploy.kind, "deploy.kind")
+    },
+    vm: {
+      memory_mb: requireInt(vm.memory_mb, "vm.memory_mb"),
+      vcpu_count: requireInt(vm.vcpu_count, "vm.vcpu_count"),
+      timeout_seconds: Number.isInteger(vm.timeout_seconds) ? Number(vm.timeout_seconds) : void 0,
+      image_variant: typeof vm.image_variant === "string" ? vm.image_variant.trim() || void 0 : void 0
+    },
+    app: {
+      port: requireInt(app.port, "app.port"),
+      healthcheck_path: requireString(app.healthcheck_path, "app.healthcheck_path"),
+      share_public_default: Boolean(app.share_public_default),
+      readiness_timeout_seconds: requireInt(app.readiness_timeout_seconds, "app.readiness_timeout_seconds")
+    },
+    run: {
+      workdir: requireString(run.workdir, "run.workdir"),
+      start_command: requireString(run.start_command, "run.start_command"),
+      logs_hint: typeof run.logs_hint === "string" ? run.logs_hint.trim() || void 0 : void 0
+    },
+    secrets: secrets.map((secret, index) => {
+      const obj = requireObject(secret, `secrets[${index}]`);
+      return {
+        name: requireString(obj.name, `secrets[${index}].name`),
+        required: obj.required !== false,
+        prompt: requireString(obj.prompt, `secrets[${index}].prompt`),
+        env_name: requireString(obj.env_name, `secrets[${index}].env_name`)
+      };
+    }),
+    post_deploy_notes: typeof raw.post_deploy_notes === "string" ? [raw.post_deploy_notes.trim()].filter(Boolean) : Array.isArray(raw.post_deploy_notes) ? raw.post_deploy_notes.map((entry) => requireString(entry, "post_deploy_notes[]")) : [],
+    artifact: raw.artifact ? {
+      oci_image: requireString(raw.artifact.oci_image, "artifact.oci_image"),
+      snapshot_name: requireString(raw.artifact.snapshot_name, "artifact.snapshot_name"),
+      snapshot_visibility: requireString(raw.artifact.snapshot_visibility, "artifact.snapshot_visibility")
+    } : void 0,
+    build: raw.build ? {
+      context: requireString(raw.build.context, "build.context"),
+      dockerfile: requireString(raw.build.dockerfile, "build.dockerfile"),
+      target: typeof raw.build.target === "string" ? raw.build.target.trim() || void 0 : void 0
+    } : void 0,
+    source: raw.source ? {
+      include: Array.isArray(raw.source.include) ? raw.source.include.map((entry) => requireString(entry, "source.include[]")) : [],
+      exclude: Array.isArray(raw.source.exclude) ? raw.source.exclude.map((entry) => requireString(entry, "source.exclude[]")) : [],
+      setup_command: requireString(raw.source.setup_command, "source.setup_command")
+    } : void 0
+  };
+  if (!["published_snapshot", "upload_and_run"].includes(manifest.deploy.kind)) {
+    throw new CookbookError("Manifest field `deploy.kind` must be `published_snapshot` or `upload_and_run`.");
   }
-  return pairs;
-}
-function parseVolumeSpec(spec) {
-  const parts = spec.split(":");
-  if (parts.length < 2) {
-    throw new Error("volume mounts must use <volume_id>:<mount_path>[:rw|ro[:checkpoint_id]]");
+  if (manifest.schema_version !== 1) {
+    throw new CookbookError("Unsupported cookbook schema version. Expected `schema_version: 1`.");
   }
-  const volumeId = parts[0].trim();
-  const mountPath = parts[1].trim();
-  let mode = "rw";
-  let checkpointId = null;
-  if (parts[2]?.trim()) {
-    mode = parts[2].trim().toLowerCase();
+  if (!manifest.app.healthcheck_path.startsWith("/")) {
+    throw new CookbookError("Manifest field `app.healthcheck_path` must start with `/`.");
   }
-  if (parts[3]?.trim()) {
-    checkpointId = parts[3].trim();
+  if (manifest.deploy.kind === "published_snapshot" && !manifest.artifact) {
+    throw new CookbookError("Published snapshot cookbooks require `artifact` config.");
   }
-  if (parts.length > 4) {
-    throw new Error("volume mounts must use <volume_id>:<mount_path>[:rw|ro[:checkpoint_id]]");
+  if (manifest.deploy.kind === "published_snapshot" && manifest.artifact?.snapshot_visibility !== "public_system") {
+    throw new CookbookError("Manifest field `artifact.snapshot_visibility` must be `public_system`.");
   }
-  if (!["rw", "ro"].includes(mode)) {
-    throw new Error("volume mount mode must be rw or ro");
+  if (manifest.deploy.kind === "published_snapshot" && manifest.build) {
+    if (!import_fs3.default.existsSync(import_path12.default.join(import_path12.default.dirname(manifestPath), manifest.build.context))) {
+      throw new CookbookError(`Build context does not exist: ${import_path12.default.join(import_path12.default.dirname(manifestPath), manifest.build.context)}`);
+    }
+    if (!import_fs3.default.existsSync(import_path12.default.join(import_path12.default.dirname(manifestPath), manifest.build.dockerfile))) {
+      throw new CookbookError(`Dockerfile does not exist: ${import_path12.default.join(import_path12.default.dirname(manifestPath), manifest.build.dockerfile)}`);
+    }
   }
-  if (mode === "rw" && checkpointId) {
-    throw new Error("checkpoint_id is only allowed for ro mounts");
+  if (manifest.deploy.kind === "upload_and_run" && !manifest.source) {
+    throw new CookbookError("Upload-and-run cookbooks require `source` config.");
   }
-  if (mode === "ro" && !checkpointId) {
-    checkpointId = "latest";
+  if (manifest.deploy.kind === "upload_and_run" && manifest.source && manifest.source.include.length === 0) {
+    throw new CookbookError("Manifest field `source.include` must contain at least one path or glob.");
   }
+  return manifest;
+}
+function manifestDisplayRecord(manifest) {
   return {
-    volume_id: volumeId,
-    mount_path: mountPath,
-    mode,
-    checkpoint_id: checkpointId
+    slug: manifest.slug,
+    title: manifest.title,
+    summary: manifest.summary,
+    runtime: manifest.runtime,
+    category: manifest.category,
+    deploy_kind: manifest.deploy.kind,
+    port: manifest.app.port,
+    requires_secrets: manifest.secrets.length > 0,
+    version: manifest.version
   };
 }
-function looksLikeUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
-}
-function statusPayload(deps, options) {
-  const settings = deps.resolveRuntimeConfig({
-    apiKey: options.apiKey,
-    baseURL: options.baseUrl,
-    sshHost: options.sshHost
-  });
-  const profile = getActiveProfile(settings.config);
-  const storedKey = profile.auth?.api_key ? String(profile.auth.api_key) : void 0;
-  return {
-    config_path: settings.configPath,
-    active_profile: settings.config.active_profile,
-    api_key: {
-      configured: Boolean(settings.apiKey),
-      redacted: redactSecret(settings.apiKey),
-      source: settings.apiKeySource,
-      stored: Boolean(storedKey)
-    },
-    base_url: {
-      value: settings.baseURL,
-      source: settings.baseURLSource
-    },
-    ssh_host: {
-      value: settings.sshHost,
-      source: settings.sshHostSource
+function preflightTools(deps) {
+  const found = {};
+  const missing = [];
+  for (const binary of ["git", "ssh", "scp", "tar"]) {
+    const resolved = findExecutable(deps, binary);
+    if (resolved) {
+      found[binary] = resolved;
+    } else {
+      missing.push(binary);
     }
-  };
+  }
+  if (missing.length > 0) {
+    throw new CookbookError(`Missing required local tools: ${missing.join(", ")}`);
+  }
+  return found;
 }
-function statusText(payload) {
-  const lines = [
-    `Config path: ${payload.config_path}`,
-    `Active profile: ${payload.active_profile}`,
-    `API key: ${payload.api_key.redacted || "not configured"} (${payload.api_key.source})`,
-    `Base URL: ${payload.base_url.value} (${payload.base_url.source})`,
-    `SSH host: ${payload.ssh_host.value} (${payload.ssh_host.source})`
-  ];
-  if (payload.api_key.stored) {
-    lines.push("Stored key: present");
+function scanPublicKeys(homeDir = import_os2.default.homedir()) {
+  const sshDir = import_path12.default.join(homeDir, ".ssh");
+  if (!import_fs3.default.existsSync(sshDir)) {
+    return [];
   }
-  return lines;
+  return import_fs3.default.readdirSync(sshDir).filter((entry) => entry.endsWith(".pub")).map((entry) => import_path12.default.join(sshDir, entry)).filter((entry) => import_fs3.default.statSync(entry).isFile()).sort();
 }
-function resolveSettings(deps, options) {
-  return deps.resolveRuntimeConfig({
-    apiKey: options.apiKey,
-    baseURL: options.baseUrl,
-    sshHost: options.sshHost
+function publicKeyFingerprint(publicKeyPath) {
+  let content = "";
+  try {
+    content = import_fs3.default.readFileSync(publicKeyPath, "utf8").trim();
+  } catch (error) {
+    return void 0;
+  }
+  const parts = content.split(/\s+/);
+  if (parts.length < 2) {
+    return void 0;
+  }
+  try {
+    const keyBlob = Buffer.from(parts[1], "base64");
+    const digest = import_crypto.default.createHash("sha256").update(keyBlob).digest("base64").replace(/=+$/g, "");
+    return `SHA256:${digest}`;
+  } catch (error) {
+    return void 0;
+  }
+}
+function matchingLocalPublicKey(keys, candidates) {
+  const fingerprints = new Set(
+    keys.map((key) => String(key.fingerprint || "").trim()).filter(Boolean)
+  );
+  if (fingerprints.size === 0) {
+    return void 0;
+  }
+  return candidates.find((candidate) => {
+    const fingerprint = publicKeyFingerprint(candidate);
+    return fingerprint ? fingerprints.has(fingerprint) : false;
   });
 }
-function requireClient(deps, options) {
-  const settings = resolveSettings(deps, options);
-  if (!settings.apiKey) {
-    throw new Error("No InstaVM API key configured. Run `instavm auth set-key` or export INSTAVM_API_KEY.");
+async function ensureAccountSshKey(client, deps, progress, homeDir = import_os2.default.homedir()) {
+  const keys = await client.listSshKeys();
+  const candidates = scanPublicKeys(homeDir);
+  if (keys.length > 0) {
+    const selectedPath = matchingLocalPublicKey(keys, candidates);
+    if (progress && selectedPath) {
+      progress(`Using local SSH identity from ${selectedPath}`);
+    }
+    return { configured: true, auto_added: false, keys, selected_path: selectedPath };
   }
-  return {
-    client: deps.clientFactory(settings.apiKey, { baseURL: settings.baseURL }),
-    settings
-  };
+  if (candidates.length === 0) {
+    throw new CookbookError(
+      "No SSH key is registered on your account, and no local public key was found in ~/.ssh. Generate one with `ssh-keygen -t ed25519` and rerun the command."
+    );
+  }
+  if (progress) {
+    progress("No account SSH key found. Selecting a local public key to register.");
+  }
+  let selected = candidates[0];
+  if (candidates.length > 1 && process.stdin.isTTY) {
+    deps.stdout.write("Select a public key to add:\n");
+    candidates.forEach((candidate, index) => {
+      deps.stdout.write(`  ${index + 1}. ${candidate}
+`);
+    });
+    const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      const choice = (await question(rl, "Choose a key [1]: ")).trim();
+      if (choice) {
+        const index = Number.parseInt(choice, 10) - 1;
+        if (!Number.isInteger(index) || index < 0 || index >= candidates.length) {
+          throw new CookbookError("Invalid SSH key selection.");
+        }
+        selected = candidates[index];
+      }
+    } finally {
+      rl.close();
+    }
+  }
+  const orderedCandidates = [selected, ...candidates.filter((candidate) => candidate !== selected)];
+  const failures = [];
+  for (const candidate of orderedCandidates) {
+    const publicKey = import_fs3.default.readFileSync(candidate, "utf8").trim();
+    if (!publicKey) {
+      failures.push(`${candidate}: empty file`);
+      continue;
+    }
+    try {
+      const result = await client.addSshKey(publicKey);
+      if (progress) {
+        progress(`Registered SSH key from ${candidate}`);
+      }
+      return { configured: true, auto_added: true, selected_path: candidate, result };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      failures.push(`${candidate}: ${message}`);
+    }
+  }
+  throw new CookbookError(`Unable to register any local public SSH key. Tried: ${failures.join("; ")}`);
 }
-async function resolveDesktopTarget(client, target) {
-  if (looksLikeUuid(target)) {
-    const status = await client.getSessionStatus(target);
-    return { ...status, session_id: target };
+async function resolveSecretValues(manifest, deps) {
+  const values = {};
+  const configuredNames = [];
+  for (const secret of manifest.secrets) {
+    let value = (process.env[secret.env_name] || "").trim();
+    if (!value && secret.required) {
+      if (!process.stdin.isTTY) {
+        throw new CookbookError(
+          `Secret \`${secret.env_name}\` is required for \`${manifest.slug}\`. Set it in the environment or rerun interactively.`
+        );
+      }
+      value = (await deps.promptSecret(`${secret.prompt}: `)).trim();
+    }
+    if (value) {
+      values[secret.env_name] = value;
+      configuredNames.push(secret.env_name);
+    } else if (secret.required) {
+      throw new CookbookError(`Secret \`${secret.env_name}\` is required for \`${manifest.slug}\`.`);
+    }
   }
-  const vm = await client.vms.get(target);
-  const sessionId = vm.session_id ? String(vm.session_id) : null;
-  if (sessionId) {
-    const status = await client.getSessionStatus(sessionId);
-    return {
-      ...status,
-      session_id: sessionId,
-      vm_id: status.vm_id || vm.vm_id
-    };
+  return { values, configuredNames };
+}
+async function resolveSnapshotId(client, manifest) {
+  if (!manifest.artifact) {
+    throw new CookbookError("Published snapshot deploys require `artifact` config.");
   }
-  return {
-    session_id: null,
-    vm_id: vm.vm_id,
-    vm_status: vm.status,
-    vm_alive: vm.status === "active"
+  const snapshots = await client.snapshots.list({ type: "system" });
+  const found = snapshots.find(
+    (snapshot) => snapshot.name === manifest.artifact?.snapshot_name && snapshot.status === "ready" && snapshot.is_public
+  );
+  if (!found?.id) {
+    throw new CookbookError(`Public system snapshot \`${manifest.artifact.snapshot_name}\` was not found or is not ready.`);
+  }
+  return String(found.id);
+}
+function buildVmPayload(manifest, snapshotId) {
+  const payload = {
+    memory_mb: manifest.vm.memory_mb,
+    vcpu_count: manifest.vm.vcpu_count,
+    vm_lifetime_seconds: manifest.vm.timeout_seconds
   };
+  if (manifest.vm.image_variant) {
+    payload.image_variant = manifest.vm.image_variant;
+  }
+  if (snapshotId) {
+    payload.snapshot_id = snapshotId;
+  }
+  return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== void 0 && value !== null));
 }
-async function desktopPayload(client, target) {
-  const payload = await resolveDesktopTarget(client, target);
-  if (payload.vm_alive && payload.session_id) {
+function isResourceTierError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const normalized = message.toLowerCase();
+  return normalized.includes("free tier") && (normalized.includes("configurable cpu") || normalized.includes("configurable memory"));
+}
+function planLifetimeLimitSeconds(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const match = message.match(/vm lifetime cannot exceed\s+(\d+)s/i);
+  if (!match) {
+    return void 0;
+  }
+  return Number.parseInt(match[1], 10);
+}
+async function createVm(client, manifest, snapshotId, progress) {
+  let payload = buildVmPayload(manifest, snapshotId);
+  let adjustedForTier = false;
+  let adjustedForLifetime = false;
+  while (true) {
     try {
-      Object.assign(payload, await client.computerUse.viewerUrl(String(payload.session_id)));
+      return await client.vms.create(payload, true);
     } catch (error) {
+      let nextPayload = { ...payload };
+      if (isResourceTierError(error) && ("memory_mb" in nextPayload || "vcpu_count" in nextPayload)) {
+        nextPayload = Object.fromEntries(
+          Object.entries(nextPayload).filter(([key]) => key !== "memory_mb" && key !== "vcpu_count")
+        );
+        if (progress && !adjustedForTier) {
+          progress("Requested CPU or memory exceeds the current account tier.");
+          progress("Retrying VM creation with platform defaults");
+        }
+        adjustedForTier = true;
+      }
+      const lifetimeLimit = planLifetimeLimitSeconds(error);
+      const currentLifetime = typeof nextPayload.vm_lifetime_seconds === "number" ? nextPayload.vm_lifetime_seconds : void 0;
+      if (lifetimeLimit && currentLifetime && currentLifetime > lifetimeLimit) {
+        nextPayload.vm_lifetime_seconds = lifetimeLimit;
+        if (progress && !adjustedForLifetime) {
+          progress("Requested VM lifetime exceeds the current account tier.");
+          progress(`Retrying VM creation with a ${lifetimeLimit}s lifetime`);
+        }
+        adjustedForLifetime = true;
+      }
+      if (JSON.stringify(nextPayload) === JSON.stringify(payload)) {
+        throw error;
+      }
+      payload = nextPayload;
     }
   }
-  return payload;
 }
-function createProgram(deps = defaultDeps) {
+async function runDeploy(manifest, client, settings, deps, progress, snapshotIdOverride) {
+  preflightTools(deps);
+  const sshKeyInfo = await ensureAccountSshKey(client, deps, progress);
+  const { values: secretValues, configuredNames } = await resolveSecretValues(manifest, deps);
+  let snapshotId = snapshotIdOverride;
+  if (!snapshotId && manifest.deploy.kind === "published_snapshot") {
+    if (progress) {
+      progress(`Resolving public snapshot ${manifest.artifact?.snapshot_name}`);
+    }
+    snapshotId = await resolveSnapshotId(client, manifest);
+  }
+  if (progress) {
+    progress("Creating VM");
+  }
+  const vm = await createVm(client, manifest, snapshotId, progress);
+  const vmId = String(vm.vm_id || "");
+  const sessionId = String(vm.session_id || "");
+  if (!vmId) {
+    throw new CookbookError("VM creation did not return a VM ID.");
+  }
+  const sshTarget = `${vmId}@${settings.sshHost}`;
+  const identityFile = resolveIdentityFile(sshKeyInfo.selected_path);
+  let remoteBase = `/home/appuser/${DEFAULT_REMOTE_ROOT}`;
+  let remoteRoot = `${remoteBase}/${manifest.slug}`;
+  let workdir = remoteWorkdir(manifest, remoteRoot);
+  const connectCommand = buildConnectCommand(vmId, settings.sshHost, identityFile);
+  let serviceMode = "unknown";
+  let serviceName = `instavm-cookbook-${manifest.slug}`;
+  try {
+    if (progress) {
+      progress("Waiting for SSH access");
+    }
+    waitForSshReady(deps, sshTarget, identityFile);
+    remoteBase = resolveRemoteBase(deps, sshTarget, identityFile);
+    remoteRoot = `${remoteBase}/${manifest.slug}`;
+    workdir = remoteWorkdir(manifest, remoteRoot);
+    if (manifest.deploy.kind === "upload_and_run") {
+      const archivePath = packageSource(manifest, deps);
+      try {
+        const remoteTarball = `/tmp/${manifest.slug}-${Date.now()}.tar.gz`;
+        if (progress) {
+          progress("Uploading cookbook source");
+        }
+        runScp(deps, archivePath, `${sshTarget}:${remoteTarball}`, "Failed to upload the cookbook bundle to the VM.", identityFile);
+        runSsh(
+          deps,
+          sshTarget,
+          `mkdir -p ${shellEscape(remoteRoot)} && tar -xzf ${shellEscape(remoteTarball)} -C ${shellEscape(remoteRoot)} && rm -f ${shellEscape(remoteTarball)}`,
+          "Failed to extract the cookbook bundle.",
+          false,
+          identityFile
+        );
+        if (progress) {
+          progress("Running cookbook setup");
+        }
+        runSsh(deps, sshTarget, `cd ${shellEscape(workdir)} && ${manifest.source?.setup_command}`, "Cookbook setup command failed.", false, identityFile);
+      } finally {
+        import_fs3.default.rmSync(archivePath, { force: true });
+      }
+    }
+    if (progress) {
+      progress("Starting application service");
+    }
+    const started = startRemoteService(deps, sshTarget, manifest, remoteRoot, workdir, secretValues, identityFile);
+    serviceName = started.serviceName;
+    serviceMode = started.serviceMode;
+    if (progress) {
+      progress("Waiting for application healthcheck");
+    }
+    waitForInternalHealth(deps, sshTarget, manifest.app.port, manifest.app.healthcheck_path, manifest.app.readiness_timeout_seconds, identityFile);
+    if (progress) {
+      progress("Creating public share");
+    }
+    const share = await client.shares.create({
+      vm_id: vmId,
+      port: manifest.app.port,
+      is_public: manifest.app.share_public_default
+    });
+    const shareUrl = String(share.url || "");
+    if (!shareUrl) {
+      throw new CookbookError("Share creation did not return a URL.");
+    }
+    if (progress) {
+      progress("Verifying public share URL");
+    }
+    const healthcheckUrl = new URL(manifest.app.healthcheck_path.replace(/^\//, ""), shareUrl.endsWith("/") ? shareUrl : `${shareUrl}/`).toString();
+    await verifyPublicShare(healthcheckUrl, manifest.app.readiness_timeout_seconds);
+    return {
+      slug: manifest.slug,
+      version: manifest.version,
+      deploy_kind: manifest.deploy.kind,
+      vm_id: vmId,
+      session_id: sessionId,
+      service_name: serviceName,
+      service_mode: serviceMode,
+      port: manifest.app.port,
+      share_url: shareUrl,
+      healthcheck_url: healthcheckUrl,
+      connect_command: connectCommand,
+      logs_command: logsCommand(vmId, settings.sshHost, manifest.slug, serviceName, serviceMode, remoteBase, manifest.run.logs_hint, identityFile),
+      destroy_command: `instavm rm ${vmId}`,
+      configured_secrets: configuredNames,
+      notes: manifest.post_deploy_notes
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CookbookDeployError(message, {
+      slug: manifest.slug,
+      version: manifest.version,
+      deploy_kind: manifest.deploy.kind,
+      vm_id: vmId,
+      session_id: sessionId,
+      service_name: serviceName,
+      service_mode: serviceMode,
+      port: manifest.app.port,
+      connect_command: connectCommand,
+      logs_command: logsCommand(vmId, settings.sshHost, manifest.slug, serviceName, serviceMode, remoteBase, manifest.run.logs_hint, identityFile),
+      destroy_command: `instavm rm ${vmId}`,
+      configured_secrets: configuredNames
+    });
+  }
+}
+async function deployCookbook(manifest, client, settings, deps, progress) {
+  return runDeploy(manifest, client, settings, deps, progress);
+}
+function packageSource(manifest, deps) {
+  if (!manifest.source) {
+    throw new CookbookError("Upload-and-run cookbooks require `source` config.");
+  }
+  const stagingRoot = import_fs3.default.mkdtempSync(import_path12.default.join(import_os2.default.tmpdir(), `${manifest.slug}-src-`));
+  const archivePath = import_path12.default.join(import_os2.default.tmpdir(), `${manifest.slug}-${Date.now()}.tar.gz`);
+  try {
+    const excludes = /* @__PURE__ */ new Set([...DEFAULT_SOURCE_EXCLUDES, ...manifest.source.exclude]);
+    copySelectedTree(manifest.path, stagingRoot, manifest.source.include, excludes);
+    runCommand(deps, "tar", ["-czf", archivePath, "-C", stagingRoot, "."], "Failed to package the cookbook source.");
+  } finally {
+    import_fs3.default.rmSync(stagingRoot, { recursive: true, force: true });
+  }
+  return archivePath;
+}
+function copySelectedTree(sourceRoot, targetRoot, include, exclude) {
+  const visit = (currentSource, currentRelative) => {
+    const entries = import_fs3.default.readdirSync(currentSource, { withFileTypes: true });
+    for (const entry of entries) {
+      const relative = currentRelative ? `${currentRelative}/${entry.name}` : entry.name;
+      if (!shouldInclude(relative, include, exclude)) {
+        continue;
+      }
+      const sourcePath = import_path12.default.join(currentSource, entry.name);
+      const targetPath = import_path12.default.join(targetRoot, relative);
+      if (entry.isDirectory()) {
+        import_fs3.default.mkdirSync(targetPath, { recursive: true });
+        visit(sourcePath, relative);
+      } else {
+        import_fs3.default.mkdirSync(import_path12.default.dirname(targetPath), { recursive: true });
+        import_fs3.default.copyFileSync(sourcePath, targetPath);
+      }
+    }
+  };
+  visit(sourceRoot, "");
+}
+function shouldInclude(relative, include, exclude) {
+  const normalized = relative.replace(/\\/g, "/");
+  for (const pattern of exclude) {
+    if (matchesPattern(normalized, pattern)) {
+      return false;
+    }
+  }
+  if (include.length === 0) {
+    return true;
+  }
+  return include.some((pattern) => matchesPattern(normalized, pattern) || normalized.startsWith(`${pattern.replace(/\/$/, "")}/`));
+}
+function matchesPattern(value, pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+function startRemoteService(deps, sshTarget, manifest, remoteRoot, workdir, secretValues, identityFile) {
+  const serviceName = `instavm-cookbook-${manifest.slug}`;
+  const remoteBase = remoteRoot.slice(0, remoteRoot.lastIndexOf("/"));
+  const logFile = `${remoteBase}/logs/${manifest.slug}.log`;
+  const environment = Object.entries(secretValues).sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${key}=${shellEscape(value)}`).join(" ");
+  const launchBody = `cd ${shellEscape(workdir)} && ${environment} ${manifest.run.start_command}`.trim();
+  const remoteScript = `
+set -e
+mkdir -p ${shellEscape(`${remoteBase}/logs`)}
+mkdir -p ${shellEscape(remoteRoot)}
+if command -v systemd-run >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
+  if systemd-run --unit ${shellEscape(serviceName)} --collect --quiet --property=WorkingDirectory=${shellEscape(workdir)} /bin/bash -lc ${shellEscape(launchBody)} >/dev/null 2>&1; then
+    printf '%s' 'systemd'
+    exit 0
+  fi
+fi
+nohup /bin/bash -lc ${shellEscape(launchBody)} > ${shellEscape(logFile)} 2>&1 < /dev/null &
+echo $! > ${shellEscape(`${remoteBase}/logs/${manifest.slug}.pid`)}
+printf '%s' 'nohup'
+`.trim();
+  const result = runSsh(deps, sshTarget, remoteScript, "Failed to start the cookbook service.", true, identityFile);
+  const stdout = typeof result.stdout === "string" ? result.stdout : result.stdout?.toString("utf8") || "";
+  return {
+    serviceName,
+    serviceMode: stdout.trim() || "nohup"
+  };
+}
+function waitForInternalHealth(deps, sshTarget, port, healthcheckPath, timeoutSeconds, identityFile) {
+  const url = `http://127.0.0.1:${port}${healthcheckPath}`;
+  const attempts = Math.max(Math.floor(timeoutSeconds / 2), 1);
+  const remoteScript = `
+set -e
+URL=${shellEscape(url)}
+for _ in $(seq 1 ${attempts}); do
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsS "$URL" >/dev/null && exit 0
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q -O /dev/null "$URL" && exit 0
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 - <<'PY' && exit 0
+from urllib.request import urlopen
+with urlopen(${JSON.stringify(url)}, timeout=3) as response:
+    if response.status >= 400:
+        raise SystemExit(1)
+PY
+  fi
+  sleep 2
+done
+exit 1
+`.trim();
+  runSsh(deps, sshTarget, remoteScript, "Timed out waiting for the app healthcheck.", false, identityFile);
+}
+async function verifyPublicShare(url, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url, { redirect: "follow" });
+      if (response.ok) {
+        return;
+      }
+    } catch (error) {
+    }
+    await new Promise((resolve) => setTimeout(resolve, 2e3));
+  }
+  throw new CookbookError(`Timed out verifying the public share URL: ${url}`);
+}
+function runSsh(deps, sshTarget, remoteCommand, errorMessage, captureOutput = false, identityFile) {
+  const args = ["-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new"];
+  if (identityFile) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", identityFile);
+  }
+  args.push(sshTarget, remoteCommand);
+  return runCommand(
+    deps,
+    "ssh",
+    args,
+    errorMessage,
+    captureOutput
+  );
+}
+function runScp(deps, localPath, remotePath, errorMessage, identityFile) {
+  const args = ["-q"];
+  if (identityFile) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", identityFile);
+  }
+  args.push(localPath, remotePath);
+  return runCommand(deps, "scp", args, errorMessage);
+}
+function waitForSshReady(deps, sshTarget, identityFile, timeoutSeconds = 90) {
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      runSsh(deps, sshTarget, "true", "Timed out waiting for SSH access to the VM.", true, identityFile);
+      return;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    sleepMs(2e3);
+  }
+  if (lastError) {
+    throw new CookbookError(`Timed out waiting for SSH access to the VM: ${sshTarget}. Last SSH error: ${lastError}`);
+  }
+  throw new CookbookError(`Timed out waiting for SSH access to the VM: ${sshTarget}`);
+}
+function emitCookbookDeployError(deps, options, payload) {
+  if (options.json) {
+    deps.stdout.write(`${JSON.stringify(payload)}
+`);
+    return;
+  }
+  deps.stderr.write(`Deploy failed: ${payload.error}
+`);
+  for (const [label, value] of [
+    ["VM", payload.vm_id],
+    ["Connect", payload.connect_command],
+    ["Logs", payload.logs_command],
+    ["Destroy", payload.destroy_command]
+  ]) {
+    deps.stderr.write(`${label}: ${value || "-"}
+`);
+  }
+}
+function runCommand(deps, command, args, errorMessage, captureOutput = false) {
+  const result = deps.spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: captureOutput ? ["ignore", "pipe", "pipe"] : ["ignore", "ignore", "pipe"]
+  });
+  if (result.error) {
+    throw new CookbookError(errorMessage);
+  }
+  if ((result.status ?? 0) !== 0) {
+    const stderr = typeof result.stderr === "string" ? result.stderr : String(result.stderr || "");
+    const detail = stderr.trim() ? ` ${stderr.trim()}` : "";
+    throw new CookbookError(`${errorMessage}${detail}`);
+  }
+  return result;
+}
+function logsCommand(vmId, sshHost, slug, serviceName, serviceMode, remoteBase, logsHint, identityFile) {
+  if (logsHint) {
+    return logsHint;
+  }
+  const sshPrefix = buildSshPrefix(vmId, sshHost, identityFile);
+  if (serviceMode === "systemd") {
+    return `${sshPrefix} journalctl --no-pager -u ${serviceName} -n 200`;
+  }
+  return `${sshPrefix} tail -n 200 ${shellEscape(`${remoteBase}/logs/${slug}.log`)}`;
+}
+function remoteWorkdir(manifest, remoteRoot) {
+  if (manifest.run.workdir.startsWith("/")) {
+    return manifest.run.workdir;
+  }
+  if (manifest.run.workdir === "." || manifest.run.workdir === "./") {
+    return remoteRoot;
+  }
+  return `${remoteRoot}/${manifest.run.workdir.replace(/^\.\//, "").replace(/\/$/, "")}`;
+}
+function resolveRemoteBase(deps, sshTarget, identityFile) {
+  const result = runSsh(
+    deps,
+    sshTarget,
+    'printf %s "$HOME"',
+    "Failed to determine the remote home directory.",
+    true,
+    identityFile
+  );
+  const stdout = typeof result.stdout === "string" ? result.stdout : result.stdout?.toString("utf8") || "";
+  const remoteHome = stdout.trim() || "/tmp";
+  return `${remoteHome}/${DEFAULT_REMOTE_ROOT}`;
+}
+function findExecutable(deps, binary) {
+  const result = deps.spawnSync(process.platform === "win32" ? "where" : "which", [binary], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  if ((result.status ?? 1) !== 0) {
+    return null;
+  }
+  const stdout = typeof result.stdout === "string" ? result.stdout : String(result.stdout || "");
+  const output = stdout.split(/\r?\n/).find(Boolean);
+  return output || null;
+}
+function shellEscape(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function resolveIdentityFile(selectedPath) {
+  if (!selectedPath) {
+    return void 0;
+  }
+  const candidate = selectedPath.endsWith(".pub") ? selectedPath.slice(0, -4) : selectedPath;
+  return import_fs3.default.existsSync(candidate) ? candidate : void 0;
+}
+function buildSshPrefix(vmId, sshHost, identityFile) {
+  if (identityFile) {
+    return `ssh -o IdentitiesOnly=yes -i ${shellEscape(identityFile)} ${vmId}@${sshHost}`;
+  }
+  return `ssh ${vmId}@${sshHost}`;
+}
+function buildConnectCommand(vmId, sshHost, identityFile) {
+  if (identityFile) {
+    return buildSshPrefix(vmId, sshHost, identityFile);
+  }
+  return `instavm connect ${vmId}`;
+}
+function sleepMs(durationMs) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, durationMs);
+}
+function question(rl, prompt) {
+  return new Promise((resolve) => {
+    rl.question(prompt, resolve);
+  });
+}
+
+// src/cli/detect.ts
+var import_fs4 = __toESM(require("fs"));
+var import_path13 = __toESM(require("path"));
+var NON_SECRET_VARS = /* @__PURE__ */ new Set([
+  "PORT",
+  "HOST",
+  "NODE_ENV",
+  "DEBUG",
+  "PYTHONPATH",
+  "PATH",
+  "HOME",
+  "HOSTNAME",
+  "LANG",
+  "TZ",
+  "TERM",
+  "CI",
+  "VIRTUAL_ENV",
+  "PWD",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "PYTHONDONTWRITEBYTECODE",
+  "PYTHONUNBUFFERED",
+  "NPM_CONFIG_LOGLEVEL",
+  "NEXT_TELEMETRY_DISABLED",
+  // Model/config env vars that typically have defaults in source
+  "OPENAI_MODEL",
+  "GOOGLE_MODEL",
+  "ANTHROPIC_MODEL",
+  "OPENAI_COMPAT_API_BASE",
+  "OPENAI_COMPAT_MODEL"
+]);
+var DEP_SECRET_HINTS = {
+  // Python
+  "anthropic": ["ANTHROPIC_API_KEY", "Anthropic API key"],
+  "openai-agents": ["OPENAI_API_KEY", "OpenAI API key"],
+  "openai": ["OPENAI_API_KEY", "OpenAI API key"],
+  "google-adk": ["GOOGLE_API_KEY", "Google API key"],
+  "google-generativeai": ["GOOGLE_API_KEY", "Google API key"],
+  "replicate": ["REPLICATE_API_TOKEN", "Replicate API token"],
+  // Node
+  "@anthropic-ai/claude-agent-sdk": ["ANTHROPIC_API_KEY", "Anthropic API key"],
+  "@anthropic-ai/sdk": ["ANTHROPIC_API_KEY", "Anthropic API key"],
+  "@openai/agents": ["OPENAI_API_KEY", "OpenAI API key"],
+  "@ai-sdk/anthropic": ["ANTHROPIC_API_KEY", "Anthropic API key"],
+  "@ai-sdk/openai": ["OPENAI_API_KEY", "OpenAI API key"],
+  "@ai-sdk/google": ["GOOGLE_API_KEY", "Google API key"]
+};
+var PYTHON_APP_CANDIDATES = ["app.py", "main.py", "server.py", "bot.py", "start.py", "src/app.py", "src/main.py"];
+var NODE_SOURCE_CANDIDATES = [
+  "server.mjs",
+  "server.js",
+  "server.ts",
+  "index.js",
+  "index.ts",
+  "src/index.ts",
+  "src/index.js",
+  "src/server.ts",
+  "src/server.js",
+  "server/server.ts",
+  "server/server.js"
+];
+var GO_SOURCE_CANDIDATES = ["main.go", "server.go", "app.go", "cmd/server/main.go", "cmd/main.go"];
+var DENO_MAIN_CANDIDATES = ["main.ts", "main.js", "main.mjs", "main.mts", "server.ts", "server.js", "app.ts", "app.js"];
+var STATIC_ROOT_CANDIDATES = ["public", "dist", "build"];
+var HEALTH_ROUTE_RE = /(?:@app\.(?:get|route)|app\.get|router\.get)\s*\(\s*['"](\/(health|healthz|api\/health))['"]\s*/;
+var GO_HEALTH_RE = /(?:HandleFunc|Handle)\s*\(\s*['"](\/(health|healthz|api\/health))['"]/;
+var GO_PORT_RE = /ListenAndServe\s*\(\s*["']:(\d{2,5})["']/;
+var PORT_PATTERN_RE = /PORT\s*(?:\|\||===?\s*undefined\s*\?\s*|\?\?)\s*['"]?(\d{2,5})['"]?/;
+var PYTHON_PORT_PATTERNS = [
+  /os\.(?:getenv|environ\.get)\s*\(\s*['"]PORT['"]\s*,\s*['"]?(\d{2,5})['"]?\s*\)/,
+  /runserver\s+0\.0\.0\.0:(\d{2,5})/,
+  /--server\.port\s+(\d{2,5})/,
+  /--port\s+(\d{2,5})/
+];
+var PYTHON_ENV_RE = /os\.(?:environ\s*(?:\.get\s*\(|(?:\[)))\s*['"]([\w]+)['"]|os\.getenv\s*\(\s*['"]([\w]+)['"]/g;
+var NODE_ENV_RE = /process\.env\.([\w]+)/g;
+var GO_ENV_RE = /os\.(?:Getenv|LookupEnv)\s*\(\s*["'](\w+)["']\)/g;
+var DENO_ENV_RE = /Deno\.env\.get\s*\(\s*["'](\w+)["']\)/g;
+var DJANGO_WSGI_RE = /WSGI_APPLICATION\s*=\s*["']([A-Za-z_][\w.]*)\.application["']/;
+var NVM_SETUP_PREFIX = 'export NVM_DIR="$HOME/.nvm" && if [ ! -s "$NVM_DIR/nvm.sh" ]; then curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash; fi && . "$NVM_DIR/nvm.sh" && nvm install {NODE_VERSION} && nvm use {NODE_VERSION} && ';
+var NVM_RUN_PREFIX = 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && nvm use {NODE_VERSION} >/dev/null && ';
+var COREPACK_ENABLE_PREFIX = "corepack enable >/dev/null 2>&1 && ";
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function detectProject(projectPath) {
+  const resolved = import_path13.default.resolve(projectPath);
+  if (!import_fs4.default.existsSync(resolved) || !import_fs4.default.statSync(resolved).isDirectory()) {
+    throw new Error(`Not a directory: ${resolved}`);
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(resolved, "package.json"))) {
+    return detectNode(resolved);
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(resolved, "requirements.txt")) || import_fs4.default.existsSync(import_path13.default.join(resolved, "pyproject.toml")) || import_fs4.default.existsSync(import_path13.default.join(resolved, "Pipfile"))) {
+    return detectPython(resolved);
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(resolved, "go.mod")) || import_fs4.default.existsSync(import_path13.default.join(resolved, "main.go"))) {
+    return detectGo(resolved);
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(resolved, "deno.json")) || import_fs4.default.existsSync(import_path13.default.join(resolved, "deno.jsonc"))) {
+    return detectDeno(resolved);
+  }
+  if (hasStaticSignals(resolved)) {
+    return detectStatic(resolved);
+  }
+  throw new Error(
+    "Could not detect project type. Expected package.json, requirements.txt, pyproject.toml, Pipfile, go.mod, deno.json, or index.html."
+  );
+}
+function planToManifest(plan, projectPath) {
+  let setupCommand = plan.installCommand;
+  if (plan.buildCommand) {
+    setupCommand += ` && ${plan.buildCommand}`;
+  }
+  let startCommand = plan.startCommand;
+  if (plan.runtime === "node") {
+    const nodeVersion = detectNodeVersion(projectPath);
+    setupCommand = NVM_SETUP_PREFIX.replace(/\{NODE_VERSION\}/g, nodeVersion) + setupCommand;
+    startCommand = NVM_RUN_PREFIX.replace(/\{NODE_VERSION\}/g, nodeVersion) + startCommand;
+  }
+  return {
+    path: import_path13.default.resolve(projectPath),
+    schema_version: 1,
+    slug: plan.slug,
+    title: plan.slug,
+    version: "0.0.0",
+    summary: "",
+    category: "deploy",
+    runtime: plan.runtime,
+    deploy: { kind: "upload_and_run" },
+    vm: {
+      memory_mb: 2048,
+      vcpu_count: 2,
+      timeout_seconds: 3600
+    },
+    app: {
+      port: plan.port,
+      healthcheck_path: plan.healthPath,
+      share_public_default: true,
+      readiness_timeout_seconds: 120
+    },
+    run: {
+      workdir: ".",
+      start_command: startCommand
+    },
+    secrets: plan.secrets,
+    post_deploy_notes: [],
+    source: {
+      include: ["*"],
+      exclude: plan.runtime === "static" ? [] : ["dist", "dist/*", "build", "build/*"],
+      setup_command: setupCommand
+    }
+  };
+}
+function detectNode(projectPath) {
+  const pkgPath = import_path13.default.join(projectPath, "package.json");
+  let pkg;
+  try {
+    pkg = JSON.parse(import_fs4.default.readFileSync(pkgPath, "utf-8"));
+  } catch (err) {
+    throw new Error(`Cannot read package.json: ${err}`);
+  }
+  const pm = detectNodePm(projectPath, pkg);
+  const scripts = pkg.scripts || {};
+  const deps = readNodeDeps(pkg);
+  let installCommand;
+  if (pm === "npm" && import_fs4.default.existsSync(import_path13.default.join(projectPath, "package-lock.json"))) {
+    installCommand = "npm ci";
+  } else if (pm === "yarn") {
+    installCommand = wrapNodePmCommand(pm, isYarnBerry(projectPath, pkg) ? "yarn install --check-cache" : "yarn install --frozen-lockfile");
+  } else if (pm === "pnpm") {
+    installCommand = wrapNodePmCommand(pm, "pnpm install");
+  } else {
+    installCommand = `${pm} install`;
+  }
+  let buildCommand = null;
+  if (scripts.build) {
+    buildCommand = wrapNodePmCommand(pm, `${pm} run build`);
+  }
+  let startCommand = null;
+  if (scripts.start) {
+    startCommand = wrapNodePmCommand(pm, `${pm} start`);
+  } else if (scripts.serve) {
+    startCommand = wrapNodePmCommand(pm, `${pm} run serve`);
+  } else if (pkg.main) {
+    startCommand = `node ${shellQuote(String(pkg.main))}`;
+  }
+  if (!startCommand) {
+    throw new Error(
+      "Could not detect start command. Add a 'start' script to package.json or use --start-command."
+    );
+  }
+  let port = detectPortFromStartScript(scripts.start || "");
+  if (port == null) {
+    port = detectPortFromSource(projectPath, NODE_SOURCE_CANDIDATES);
+  }
+  if (port == null) {
+    port = 3e3;
+  }
+  return {
+    slug: slugify(pkg.name || import_path13.default.basename(projectPath)),
+    runtime: "node",
+    packageManager: pm,
+    installCommand,
+    buildCommand,
+    startCommand,
+    port,
+    healthPath: detectHealthPath(projectPath),
+    secrets: collectSecrets(projectPath, deps, "node")
+  };
+}
+function detectNodePm(projectPath, pkg) {
+  const pmField = String(pkg?.packageManager || "").trim();
+  if (pmField) {
+    const pmName = pmField.split("@")[0].trim().toLowerCase();
+    if (["pnpm", "yarn", "bun", "npm"].includes(pmName)) return pmName;
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "pnpm-lock.yaml"))) return "pnpm";
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "yarn.lock"))) return "yarn";
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "bun.lockb")) || import_fs4.default.existsSync(import_path13.default.join(projectPath, "bun.lock"))) return "bun";
+  return "npm";
+}
+function isYarnBerry(projectPath, pkg) {
+  const pmField = String(pkg?.packageManager || "").trim();
+  if (pmField.toLowerCase().startsWith("yarn@")) {
+    const versionPart = pmField.split("@")[1].split("+")[0];
+    const major = versionPart.split(".")[0];
+    if (/^\d+$/.test(major) && parseInt(major, 10) >= 2) return true;
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, ".yarnrc.yml")) || import_fs4.default.existsSync(import_path13.default.join(projectPath, ".yarnrc.yaml"))) return true;
+  return false;
+}
+function wrapNodePmCommand(pm, command) {
+  if (pm === "yarn" || pm === "pnpm") {
+    return `${COREPACK_ENABLE_PREFIX}${command}`;
+  }
+  return command;
+}
+function readNodeDeps(pkg) {
+  const deps = [];
+  for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+    if (pkg[section]) {
+      deps.push(...Object.keys(pkg[section]));
+    }
+  }
+  return deps;
+}
+function detectNodeVersion(projectPath) {
+  const pkgPath = import_path13.default.join(projectPath, "package.json");
+  try {
+    const pkg = JSON.parse(import_fs4.default.readFileSync(pkgPath, "utf-8"));
+    const nodeConstraint = pkg?.engines?.node || "";
+    const m = nodeConstraint.match(/(\d+)/);
+    if (m) return m[1];
+  } catch {
+  }
+  return "22";
+}
+function detectPython(projectPath) {
+  const deps = readPythonDeps(projectPath);
+  const pm = detectPythonPm(projectPath);
+  let installCommand;
+  if (pm === "poetry") {
+    installCommand = "poetry install";
+  } else if (pm === "uv") {
+    installCommand = "uv sync";
+  } else if (pm === "pdm") {
+    installCommand = "pdm install";
+  } else if (pm === "pipenv") {
+    installCommand = import_fs4.default.existsSync(import_path13.default.join(projectPath, "Pipfile.lock")) ? "pipenv install --deploy" : "pipenv install";
+  } else if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "requirements.txt"))) {
+    installCommand = "pip install -r requirements.txt";
+  } else {
+    installCommand = "pip install .";
+  }
+  const depNamesLower = new Set(
+    deps.map((d) => d.toLowerCase().split("==")[0].split(">=")[0].split("[")[0].trim())
+  );
+  const appModule = findPythonAppModule(projectPath);
+  let startCommand = null;
+  const port = detectPythonPort(projectPath);
+  if (depNamesLower.has("django") && import_fs4.default.existsSync(import_path13.default.join(projectPath, "manage.py"))) {
+    const wsgiModule = findDjangoWsgi(projectPath);
+    if (depNamesLower.has("gunicorn")) {
+      startCommand = `python manage.py migrate && gunicorn ${wsgiModule}:application -b 0.0.0.0:${port}`;
+    } else {
+      startCommand = `python manage.py migrate && python manage.py runserver 0.0.0.0:${port}`;
+    }
+  } else if (depNamesLower.has("uvicorn") || depNamesLower.has("python-fasthtml") || depNamesLower.has("fasthtml")) {
+    startCommand = `python -m uvicorn ${appModule}:app --host 0.0.0.0 --port ${port}`;
+  } else if (depNamesLower.has("gunicorn")) {
+    startCommand = `gunicorn ${appModule}:app -b 0.0.0.0:${port}`;
+  } else if (depNamesLower.has("flask")) {
+    startCommand = `python -m flask run --host 0.0.0.0 --port ${port}`;
+  } else if (depNamesLower.has("streamlit")) {
+    const entry = findStreamlitEntry(projectPath);
+    startCommand = `python -m streamlit run ${entry} --server.port ${port} --server.address 0.0.0.0`;
+  }
+  if (!startCommand) {
+    throw new Error(
+      "Could not detect start command. No django, uvicorn, gunicorn, flask, fasthtml, or streamlit found in dependencies. Use --start-command to specify how to start the app."
+    );
+  }
+  return {
+    slug: slugify(import_path13.default.basename(projectPath)),
+    runtime: "python",
+    packageManager: pm,
+    installCommand,
+    buildCommand: null,
+    startCommand,
+    port,
+    healthPath: detectHealthPath(projectPath),
+    secrets: collectSecrets(projectPath, [...depNamesLower], "python")
+  };
+}
+function detectPythonPm(projectPath) {
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "uv.lock"))) return "uv";
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "pdm.lock"))) return "pdm";
+  const pyprojectPath = import_path13.default.join(projectPath, "pyproject.toml");
+  if (import_fs4.default.existsSync(pyprojectPath)) {
+    try {
+      const text = import_fs4.default.readFileSync(pyprojectPath, "utf-8");
+      if (text.includes("[tool.uv]")) return "uv";
+      if (text.includes("[tool.poetry]")) return "poetry";
+    } catch {
+    }
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "Pipfile")) || import_fs4.default.existsSync(import_path13.default.join(projectPath, "Pipfile.lock"))) return "pipenv";
+  return "pip";
+}
+function readPythonDeps(projectPath) {
+  const reqPath = import_path13.default.join(projectPath, "requirements.txt");
+  if (import_fs4.default.existsSync(reqPath)) {
+    try {
+      const lines = import_fs4.default.readFileSync(reqPath, "utf-8").split("\n");
+      const deps = lines.map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+      if (deps.length > 0) return deps;
+    } catch {
+    }
+  }
+  const pyprojectPath = import_path13.default.join(projectPath, "pyproject.toml");
+  if (import_fs4.default.existsSync(pyprojectPath)) {
+    try {
+      const text = import_fs4.default.readFileSync(pyprojectPath, "utf-8");
+      return parsePyprojectDeps(text);
+    } catch {
+    }
+  }
+  const pipfilePath = import_path13.default.join(projectPath, "Pipfile");
+  if (import_fs4.default.existsSync(pipfilePath)) {
+    return parsePipfileDeps(pipfilePath);
+  }
+  return [];
+}
+function parsePyprojectDeps(text) {
+  const deps = [];
+  const inlineMatch = text.match(/(?<![a-z-])dependencies\s*=\s*\[([^\]]*)\]/);
+  if (inlineMatch) {
+    for (const item of inlineMatch[1].split(",")) {
+      const cleaned = item.trim().replace(/^["']|["']$/g, "").trim();
+      if (cleaned) deps.push(cleaned);
+    }
+  }
+  const lines = text.split("\n");
+  let inPoetryDeps = false;
+  for (const line of lines) {
+    const stripped = line.trim();
+    if (stripped === "[tool.poetry.dependencies]") {
+      inPoetryDeps = true;
+      continue;
+    }
+    if (inPoetryDeps) {
+      if (stripped.startsWith("[")) break;
+      if (stripped.includes("=") && !stripped.startsWith("#")) {
+        const key = stripped.split("=")[0].trim();
+        if (key && key !== "python") deps.push(key);
+      }
+    }
+  }
+  return deps;
+}
+function parsePipfileDeps(pipfilePath) {
+  const deps = [];
+  let inPackages = false;
+  try {
+    const text = import_fs4.default.readFileSync(pipfilePath, "utf-8");
+    for (const line of text.split("\n")) {
+      const stripped = line.trim();
+      if (stripped === "[packages]") {
+        inPackages = true;
+        continue;
+      }
+      if (inPackages) {
+        if (stripped.startsWith("[")) break;
+        if (stripped.includes("=") && !stripped.startsWith("#")) {
+          const key = stripped.split("=")[0].trim();
+          if (key) deps.push(key);
+        }
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
+function findPythonAppModule(projectPath) {
+  for (const candidate of PYTHON_APP_CANDIDATES) {
+    if (import_fs4.default.existsSync(import_path13.default.join(projectPath, candidate))) {
+      return candidate.replace(/\//g, ".").replace(/\.py$/, "");
+    }
+  }
+  return "app";
+}
+function findStreamlitEntry(projectPath) {
+  for (const name of ["app.py", "main.py", "streamlit_app.py"]) {
+    if (import_fs4.default.existsSync(import_path13.default.join(projectPath, name))) return name;
+  }
+  return "app.py";
+}
+function findDjangoWsgi(projectPath) {
+  const entries = import_fs4.default.readdirSync(projectPath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      const settingsPath = import_path13.default.join(projectPath, entry.name, "settings.py");
+      if (import_fs4.default.existsSync(settingsPath)) {
+        try {
+          const text = import_fs4.default.readFileSync(settingsPath, "utf-8");
+          const m = text.match(DJANGO_WSGI_RE);
+          if (m) return m[1];
+        } catch {
+          continue;
+        }
+      }
+    }
+  }
+  return `${import_path13.default.basename(projectPath)}.wsgi`;
+}
+function detectGo(projectPath) {
+  let buildTarget = ".";
+  const rootGoFiles = import_fs4.default.readdirSync(projectPath).filter((f) => f.endsWith(".go"));
+  if (rootGoFiles.length > 0) {
+    buildTarget = ".";
+  } else {
+    const cmdDir = import_path13.default.join(projectPath, "cmd");
+    if (import_fs4.default.existsSync(cmdDir) && import_fs4.default.statSync(cmdDir).isDirectory()) {
+      const subdirs = import_fs4.default.readdirSync(cmdDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+      if (subdirs.length > 0) {
+        buildTarget = `./cmd/${subdirs[0]}`;
+      }
+    }
+  }
+  const goVersion = detectGoVersion(projectPath);
+  const buildCommand = `export GOROOT="$HOME/.local/go" && export PATH="$GOROOT/bin:$PATH" && CGO_ENABLED=0 go build -ldflags='-w -s' -o app ${buildTarget}`;
+  const installCommand = `GO_VERSION="${goVersion}" && case "$GO_VERSION" in *.*.*) ;; *) GO_VERSION="$GO_VERSION.0" ;; esac && export GOROOT="$HOME/.local/go" && export PATH="$GOROOT/bin:$PATH" && if [ ! -x "$GOROOT/bin/go" ] || ! "$GOROOT/bin/go" version | grep -q "go$GO_VERSION"; then rm -rf "$GOROOT" && mkdir -p "$HOME/.local" && curl -fsSL "https://dl.google.com/go/go$GO_VERSION.linux-amd64.tar.gz" -o /tmp/instavm-go.tgz && tar -C "$HOME/.local" -xzf /tmp/instavm-go.tgz; fi && go mod download`;
+  const port = detectGoPort(projectPath);
+  const healthPath = detectGoHealthPath(projectPath);
+  const secrets = collectSecrets(projectPath, [], "go");
+  return {
+    slug: slugify(import_path13.default.basename(projectPath)),
+    runtime: "go",
+    packageManager: "go",
+    installCommand,
+    buildCommand,
+    startCommand: "./app",
+    port,
+    healthPath,
+    secrets
+  };
+}
+function detectGoPort(projectPath) {
+  for (const candidate of GO_SOURCE_CANDIDATES) {
+    const full = import_path13.default.join(projectPath, candidate);
+    if (!import_fs4.default.existsSync(full)) continue;
+    try {
+      const text = import_fs4.default.readFileSync(full, "utf-8");
+      const m = text.match(GO_PORT_RE);
+      if (m) return parseInt(m[1], 10);
+      const m2 = text.match(PORT_PATTERN_RE);
+      if (m2) return parseInt(m2[1], 10);
+    } catch {
+      continue;
+    }
+  }
+  try {
+    for (const f of import_fs4.default.readdirSync(projectPath)) {
+      if (!f.endsWith(".go")) continue;
+      const text = import_fs4.default.readFileSync(import_path13.default.join(projectPath, f), "utf-8");
+      const m = text.match(GO_PORT_RE);
+      if (m) return parseInt(m[1], 10);
+    }
+  } catch {
+  }
+  return 8080;
+}
+function detectGoVersion(projectPath) {
+  const goModPath = import_path13.default.join(projectPath, "go.mod");
+  if (!import_fs4.default.existsSync(goModPath)) return "1.23.0";
+  try {
+    const text = import_fs4.default.readFileSync(goModPath, "utf-8");
+    const match = text.match(/^go\s+([0-9]+(?:\.[0-9]+){1,2})\s*$/m);
+    return match?.[1] || "1.23.0";
+  } catch {
+    return "1.23.0";
+  }
+}
+function detectGoHealthPath(projectPath) {
+  for (const candidate of GO_SOURCE_CANDIDATES) {
+    const full = import_path13.default.join(projectPath, candidate);
+    if (!import_fs4.default.existsSync(full)) continue;
+    try {
+      const text = import_fs4.default.readFileSync(full, "utf-8");
+      const m = text.match(GO_HEALTH_RE);
+      if (m) return m[1];
+    } catch {
+      continue;
+    }
+  }
+  try {
+    for (const f of import_fs4.default.readdirSync(projectPath)) {
+      if (!f.endsWith(".go")) continue;
+      const text = import_fs4.default.readFileSync(import_path13.default.join(projectPath, f), "utf-8");
+      const m = text.match(GO_HEALTH_RE);
+      if (m) return m[1];
+    }
+  } catch {
+  }
+  return "/";
+}
+function detectDeno(projectPath) {
+  const mainFile = findDenoMain(projectPath);
+  if (!mainFile) {
+    throw new Error(
+      "Could not detect start command. No main.ts, main.js, server.ts, server.js, app.ts, or app.js found. Use --start-command to specify how to start the app."
+    );
+  }
+  let port = 8e3;
+  const full = import_path13.default.join(projectPath, mainFile);
+  if (import_fs4.default.existsSync(full)) {
+    try {
+      const text = import_fs4.default.readFileSync(full, "utf-8");
+      const m = text.match(/port:\s*(\d{2,5})/);
+      if (m) {
+        port = parseInt(m[1], 10);
+      } else {
+        const m2 = text.match(PORT_PATTERN_RE);
+        if (m2) port = parseInt(m2[1], 10);
+      }
+    } catch {
+    }
+  }
+  const secrets = collectSecrets(projectPath, [], "deno");
+  return {
+    slug: slugify(import_path13.default.basename(projectPath)),
+    runtime: "deno",
+    packageManager: "deno",
+    installCommand: "curl -fsSL https://deno.land/install.sh | sh",
+    buildCommand: null,
+    startCommand: `$HOME/.deno/bin/deno run --allow-all ${mainFile}`,
+    port,
+    healthPath: "/",
+    secrets
+  };
+}
+function findDenoMain(projectPath) {
+  for (const candidate of DENO_MAIN_CANDIDATES) {
+    if (import_fs4.default.existsSync(import_path13.default.join(projectPath, candidate))) return candidate;
+  }
+  return null;
+}
+function hasStaticSignals(projectPath) {
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "index.html"))) return true;
+  return STATIC_ROOT_CANDIDATES.some(
+    (d) => import_fs4.default.existsSync(import_path13.default.join(projectPath, d, "index.html"))
+  );
+}
+function findStaticRoot(projectPath) {
+  for (const candidate of STATIC_ROOT_CANDIDATES) {
+    if (import_fs4.default.existsSync(import_path13.default.join(projectPath, candidate, "index.html"))) return candidate;
+  }
+  if (import_fs4.default.existsSync(import_path13.default.join(projectPath, "index.html"))) return ".";
+  throw new Error(
+    "Could not detect project type. Expected package.json, requirements.txt, pyproject.toml, Pipfile, go.mod, deno.json, or index.html."
+  );
+}
+function detectStatic(projectPath) {
+  const rootDir = findStaticRoot(projectPath);
+  const port = 3e3;
+  return {
+    slug: slugify(import_path13.default.basename(projectPath)),
+    runtime: "static",
+    packageManager: "none",
+    installCommand: "echo 'No dependencies'",
+    buildCommand: null,
+    startCommand: `python3 -m http.server ${port} --directory ${rootDir} --bind 0.0.0.0`,
+    port,
+    healthPath: "/",
+    secrets: []
+  };
+}
+function detectPortFromStartScript(script) {
+  const m1 = script.match(/--port\s+(\d+)/);
+  if (m1) return parseInt(m1[1], 10);
+  const m2 = script.match(/-p\s+(\d+)/);
+  if (m2) return parseInt(m2[1], 10);
+  return null;
+}
+function detectPortFromSource(projectPath, candidates) {
+  for (const candidate of candidates) {
+    const full = import_path13.default.join(projectPath, candidate);
+    if (!import_fs4.default.existsSync(full)) continue;
+    try {
+      const text = import_fs4.default.readFileSync(full, "utf-8");
+      const m = text.match(PORT_PATTERN_RE);
+      if (m) return parseInt(m[1], 10);
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function detectPythonPort(projectPath) {
+  const visit = (dir) => {
+    let entries;
+    try {
+      entries = import_fs4.default.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return null;
+    }
+    for (const entry of entries) {
+      const full = import_path13.default.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (shouldSkipFile(full, projectPath)) continue;
+        const nested = visit(full);
+        if (nested != null) return nested;
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.endsWith(".py")) continue;
+      if (shouldSkipFile(full, projectPath)) continue;
+      try {
+        const text = import_fs4.default.readFileSync(full, "utf-8");
+        for (const pattern of PYTHON_PORT_PATTERNS) {
+          const match = text.match(pattern);
+          if (match) return parseInt(match[1], 10);
+        }
+      } catch {
+        continue;
+      }
+    }
+    return null;
+  };
+  return visit(projectPath) ?? 8e3;
+}
+function detectHealthPath(projectPath) {
+  const allCandidates = [...PYTHON_APP_CANDIDATES, ...NODE_SOURCE_CANDIDATES];
+  for (const candidate of allCandidates) {
+    const full = import_path13.default.join(projectPath, candidate);
+    if (!import_fs4.default.existsSync(full)) continue;
+    try {
+      const text = import_fs4.default.readFileSync(full, "utf-8");
+      const m = text.match(HEALTH_ROUTE_RE);
+      if (m) return m[1];
+    } catch {
+      continue;
+    }
+  }
+  return "/health";
+}
+function collectSecrets(projectPath, deps, runtime) {
+  const seen = /* @__PURE__ */ new Set();
+  const secrets = [];
+  for (const dep of deps) {
+    const depKey = dep.toLowerCase().split("==")[0].split(">=")[0].split("[")[0].trim();
+    const hint = DEP_SECRET_HINTS[depKey];
+    if (hint && !seen.has(hint[0])) {
+      seen.add(hint[0]);
+      secrets.push({ name: hint[0], prompt: hint[1], env_name: hint[0], required: true });
+    }
+  }
+  const scanned = scanEnvVars(projectPath, runtime);
+  for (const varName of [...scanned].sort()) {
+    if (!seen.has(varName) && !NON_SECRET_VARS.has(varName)) {
+      seen.add(varName);
+      secrets.push({ name: varName, prompt: varName, env_name: varName, required: false });
+    }
+  }
+  return secrets;
+}
+function scanEnvVars(projectPath, runtime) {
+  const found = /* @__PURE__ */ new Set();
+  let extensions;
+  let pattern;
+  if (runtime === "python") {
+    extensions = [".py"];
+    pattern = PYTHON_ENV_RE;
+  } else if (runtime === "go") {
+    extensions = [".go"];
+    pattern = GO_ENV_RE;
+  } else if (runtime === "deno") {
+    extensions = [".ts", ".js", ".mjs", ".mts"];
+    pattern = DENO_ENV_RE;
+  } else {
+    extensions = [".js", ".ts", ".mjs", ".tsx", ".jsx"];
+    pattern = NODE_ENV_RE;
+  }
+  const scanDir = (dir) => {
+    let entries;
+    try {
+      entries = import_fs4.default.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = import_path13.default.join(dir, entry.name);
+      if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
+        if (shouldSkipFile(full, projectPath)) continue;
+        try {
+          const text = import_fs4.default.readFileSync(full, "utf-8");
+          let m;
+          const re = new RegExp(pattern.source, pattern.flags);
+          while ((m = re.exec(text)) !== null) {
+            const varName = m[1] || m[2];
+            if (varName) found.add(varName);
+          }
+        } catch {
+          continue;
+        }
+      }
+    }
+  };
+  scanDir(projectPath);
+  for (const subdir of ["src", "server", "api", "lib", "cmd"]) {
+    const sub = import_path13.default.join(projectPath, subdir);
+    if (import_fs4.default.existsSync(sub) && import_fs4.default.statSync(sub).isDirectory()) {
+      scanDir(sub);
+    }
+  }
+  return found;
+}
+function shouldSkipFile(filePath, projectRoot) {
+  const rel = import_path13.default.relative(projectRoot, filePath);
+  const parts = rel.split(import_path13.default.sep);
+  const skipDirs = /* @__PURE__ */ new Set(["node_modules", ".venv", "venv", "__pycache__", ".git", "dist", "build", ".next"]);
+  return parts.some((p) => skipDirs.has(p));
+}
+function slugify(name) {
+  const slug = name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  return slug || "app";
+}
+
+// src/cli.ts
+var defaultDeps = {
+  stdout: process.stdout,
+  stderr: process.stderr,
+  spawnSync: import_child_process.spawnSync,
+  resolveRuntimeConfig,
+  updateProfileSettings,
+  clientFactory: (apiKey, options) => new InstaVM(apiKey, options),
+  promptSecret,
+  readStdin,
+  writeFile: (outputPath, content) => {
+    import_fs5.default.writeFileSync(outputPath, content);
+  }
+};
+var ACTIVE_VM_STATUSES = /* @__PURE__ */ new Set(["active", "running", "creating"]);
+var INTERACTIVE_PROGRESS_PREFIXES = ["Resolving public snapshot ", "Reusing saved snapshot ", "Retrying VM creation "];
+var INTERACTIVE_PROGRESS_STEPS = /* @__PURE__ */ new Set([
+  "Creating VM",
+  "Waiting for SSH access",
+  "Uploading cookbook source",
+  "Uploading source",
+  "Running cookbook setup",
+  "Running setup",
+  "Starting application service",
+  "Starting service",
+  "Waiting for application healthcheck",
+  "Waiting for healthcheck",
+  "Creating public share",
+  "Verifying public share URL",
+  "Detecting project",
+  "Creating snapshot"
+]);
+function printJson(deps, payload) {
+  deps.stdout.write(`${JSON.stringify(payload)}
+`);
+}
+function printLines(deps, lines) {
+  for (const line of lines) {
+    deps.stdout.write(`${line}
+`);
+  }
+}
+function printErrorLines(deps, lines) {
+  for (const line of lines) {
+    deps.stderr.write(`${line}
+`);
+  }
+}
+function supportsAnsi(stream) {
+  return Boolean(stream.isTTY) && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+}
+function styleText(text, codes, enabled) {
+  if (!enabled || codes.length === 0) {
+    return text;
+  }
+  return `\x1B[${codes.join(";")}m${text}\x1B[0m`;
+}
+function titleCaseLabel(value) {
+  return value.split(/[-_\s]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function displayValue(value, fallback = "-") {
+  if (value === null || value === void 0) {
+    return fallback;
+  }
+  const text = String(value).trim();
+  return text || fallback;
+}
+function formatTable(headers, rows) {
+  const widths = headers.map((header) => header.length);
+  const normalizedRows = rows.map((row) => row.map((cell) => displayValue(cell)));
+  for (const row of normalizedRows) {
+    row.forEach((cell, index) => {
+      widths[index] = Math.max(widths[index], cell.length);
+    });
+  }
+  const formatRow = (row) => `  ${row.map((cell, index) => cell.padEnd(widths[index], " ")).join("  ")}`;
+  const separator = `  ${widths.map((width) => "-".repeat(width)).join("  ")}`;
+  return [formatRow(headers), separator, ...normalizedRows.map((row) => formatRow(row))];
+}
+function formatCookbookList(cookbooks) {
+  if (cookbooks.length === 0) {
+    return ["No cookbooks found."];
+  }
+  const categoryOrder = /* @__PURE__ */ new Map([
+    ["web", 0],
+    ["graphics", 1],
+    ["agents", 2]
+  ]);
+  const sorted = [...cookbooks].sort((left, right) => {
+    const leftCategory = String(left.category || "other");
+    const rightCategory = String(right.category || "other");
+    const categoryRankCompare = (categoryOrder.get(leftCategory) ?? 99) - (categoryOrder.get(rightCategory) ?? 99);
+    if (categoryRankCompare !== 0) {
+      return categoryRankCompare;
+    }
+    const categoryCompare = leftCategory.localeCompare(rightCategory);
+    if (categoryCompare !== 0) {
+      return categoryCompare;
+    }
+    const secretCompare = Number(Boolean(left.requires_secrets)) - Number(Boolean(right.requires_secrets));
+    if (secretCompare !== 0) {
+      return secretCompare;
+    }
+    return String(left.title || left.slug || "").localeCompare(String(right.title || right.slug || ""));
+  });
+  const featured = sorted.filter((entry) => !entry.requires_secrets);
+  const titleWidth = Math.min(
+    20,
+    Math.max(...sorted.map((entry) => String(entry.title || "").length), "Title".length)
+  );
+  const slugWidth = Math.max(...sorted.map((entry) => String(entry.slug || "").length), "Slug".length);
+  const renderEntry = (entry) => {
+    const title = String(entry.title || "").padEnd(titleWidth, " ");
+    const slug = String(entry.slug || "").padEnd(slugWidth, " ");
+    const secretState = entry.requires_secrets ? "key" : "no key";
+    return `  ${title}  ${slug}  :${entry.port}  ${secretState}`;
+  };
+  const lines = [`Cookbooks (${cookbooks.length})`];
+  if (featured.length > 0) {
+    lines.push("", "Try first");
+    for (const entry of featured) {
+      lines.push(renderEntry(entry));
+    }
+  }
+  let currentCategory = null;
+  for (const entry of sorted) {
+    if (!entry.requires_secrets) {
+      continue;
+    }
+    const category = String(entry.category || "other");
+    if (category !== currentCategory) {
+      lines.push("", titleCaseLabel(category));
+      currentCategory = category;
+    }
+    lines.push(renderEntry(entry));
+  }
+  lines.push("", "Use `instavm cookbook info <slug>` for details.", "Use `instavm cookbook deploy <slug>` to launch one.");
+  return lines;
+}
+function formatWhoamiOutput(payload) {
+  const sshKeys = Array.isArray(payload.ssh_keys) ? payload.ssh_keys : [];
+  const lines = [
+    "Account",
+    `  Email: ${displayValue(payload.email)}`,
+    `  User ID: ${displayValue(payload.id)}`,
+    `  Name: ${displayValue(payload.name)}`,
+    `  Verified: ${payload.is_verified ? "yes" : "no"}`,
+    "",
+    `SSH Keys (${sshKeys.length})`
+  ];
+  if (sshKeys.length > 0) {
+    lines.push(...formatTable(
+      ["ID", "Fingerprint", "Comment"],
+      sshKeys.map((key) => [
+        displayValue(key.id),
+        displayValue(key.fingerprint),
+        displayValue(key.comment)
+      ])
+    ));
+  } else {
+    lines.push("  none");
+  }
+  return lines;
+}
+function formatVmList(vms, includeAll) {
+  return [
+    includeAll ? `VMs (${vms.length})` : `Active VMs (${vms.length})`,
+    ...includeAll ? [] : ["Use `instavm ls --all` to include terminated VMs."],
+    "",
+    ...formatTable(
+      ["ID", "Status", "Created", "SSH"],
+      vms.map((vm) => [
+        displayValue(vm.vm_id),
+        displayValue(vm.status),
+        displayValue(vm.created_at),
+        displayValue(vm.ssh_host)
+      ])
+    )
+  ];
+}
+function formatSnapshotList(snapshots) {
+  return [
+    `Snapshots (${snapshots.length})`,
+    "",
+    ...formatTable(
+      ["ID", "Name", "Status", "Type"],
+      snapshots.map((snapshot) => [
+        displayValue(snapshot.id),
+        displayValue(snapshot.name),
+        displayValue(snapshot.status),
+        displayValue(snapshot.type)
+      ])
+    )
+  ];
+}
+function formatSshKeyList(keys) {
+  return [
+    `SSH Keys (${keys.length})`,
+    "",
+    ...formatTable(
+      ["ID", "Fingerprint", "Comment"],
+      keys.map((key) => [
+        displayValue(key.id),
+        displayValue(key.fingerprint),
+        displayValue(key.comment)
+      ])
+    )
+  ];
+}
+function formatVolumeList(volumes) {
+  return [
+    `Volumes (${volumes.length})`,
+    "",
+    ...formatTable(
+      ["ID", "Name", "Usage", "Status"],
+      volumes.map((entry) => [
+        displayValue(entry.id),
+        displayValue(entry.name),
+        `${humanBytes(entry.used_bytes)} / ${humanBytes(entry.quota_bytes)}`,
+        displayValue(entry.status)
+      ])
+    )
+  ];
+}
+function formatCheckpointList(checkpoints) {
+  return [
+    `Checkpoints (${checkpoints.length})`,
+    "",
+    ...formatTable(
+      ["ID", "Name", "Status"],
+      checkpoints.map((entry) => [
+        displayValue(entry.id),
+        displayValue(entry.name),
+        displayValue(entry.status)
+      ])
+    )
+  ];
+}
+function formatFileList(files) {
+  return [
+    `Files (${files.length})`,
+    "",
+    ...formatTable(
+      ["Path", "Size"],
+      files.map((entry) => [
+        displayValue(entry.path),
+        humanBytes(entry.size)
+      ])
+    )
+  ];
+}
+var ProgressRenderer = class {
+  constructor(deps, options) {
+    this.deps = deps;
+    this.options = options;
+    this.currentMessage = null;
+    this.startedAt = 0;
+    this.timer = null;
+    this.frame = 0;
+    this.enabled = !options.json && supportsAnsi(deps.stderr);
+  }
+  step(message) {
+    if (this.options.json) {
+      return;
+    }
+    if (!this.enabled) {
+      this.note(`${message}...`);
+      return;
+    }
+    if (message !== this.currentMessage) {
+      this.startedAt = Date.now();
+      this.frame = 0;
+    }
+    this.currentMessage = message;
+    if (!this.timer) {
+      this.timer = setInterval(() => this.render(), 180);
+      this.render();
+    }
+  }
+  note(message) {
+    if (this.options.json) {
+      return;
+    }
+    if (!this.enabled) {
+      this.deps.stderr.write(`${message}
+`);
+      return;
+    }
+    this.currentMessage = null;
+    this.startedAt = 0;
+    this.clearLine();
+    this.deps.stderr.write(`${message}
+`);
+  }
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (this.enabled) {
+      this.currentMessage = null;
+      this.clearLine();
+    }
+  }
+  render() {
+    if (!this.currentMessage) {
+      return;
+    }
+    const suffixes = ["", ".", "..", "..."];
+    const elapsed = this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0;
+    this.deps.stderr.write(`\r\x1B[2K${this.currentMessage}${suffixes[this.frame % suffixes.length]} ${elapsed}s`);
+    this.frame += 1;
+  }
+  clearLine() {
+    this.deps.stderr.write("\r\x1B[2K");
+  }
+};
+function filterActiveVms(vms) {
+  return vms.filter((vm) => ACTIVE_VM_STATUSES.has(String(vm.status || "").toLowerCase()));
+}
+function normalizeArgv(argv) {
+  return argv.map((token) => token === "-all" ? "--all" : token);
+}
+function emitOutput(deps, options, payload, textLines) {
+  if (options.json) {
+    printJson(deps, payload);
+  } else {
+    printLines(deps, textLines);
+  }
+  return 0;
+}
+function shouldSpin(message) {
+  return INTERACTIVE_PROGRESS_STEPS.has(message) || INTERACTIVE_PROGRESS_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+function cookbookProgress(renderer, message) {
+  if (shouldSpin(message)) {
+    renderer.step(message);
+  } else {
+    renderer.note(message);
+  }
+}
+function formatCookbookDeploySuccess(options, deps, payload) {
+  const colorEnabled = !options.json && supportsAnsi(deps.stdout);
+  const vmId = String(payload.vm_id || "");
+  const slug = String(payload.slug || "");
+  const displayUrl = String(payload.share_url || "").replace(/\/$/, "");
+  const connectHint = vmId ? `instavm connect ${vmId}` : "-";
+  const logsHint = slug ? `After connecting: tail -n 200 ~/.instavm-cookbooks/logs/${slug}.log` : "-";
+  return [
+    styleText("Cookbook ready", ["1", "32"], colorEnabled),
+    "",
+    `  Cookbook  ${slug}`,
+    `  VM        ${vmId}`,
+    `  URL       ${styleText(displayUrl, ["32", "4"], colorEnabled)}`,
+    `  Connect   ${connectHint}`,
+    `  Logs      ${logsHint}`,
+    `  Destroy   ${payload.destroy_command}`,
+    ...payload.notes?.length ? ["", "  Notes", ...payload.notes.map((note) => `    - ${note}`)] : []
+  ];
+}
+function formatCookbookDeployFailure(options, deps, message, payload) {
+  const colorEnabled = !options.json && supportsAnsi(deps.stderr);
+  const vmId = String(payload.vm_id || "");
+  const slug = String(payload.slug || "");
+  const connectHint = vmId ? `instavm connect ${vmId}` : "-";
+  const logsHint = vmId && slug ? `After connecting: tail -n 200 ~/.instavm-cookbooks/logs/${slug}.log` : "-";
+  return [
+    styleText("Deploy failed", ["1", "31"], colorEnabled),
+    `  Error     ${message}`,
+    `  VM        ${vmId || "-"}`,
+    `  Connect   ${connectHint}`,
+    `  Logs      ${logsHint}`,
+    `  Destroy   ${payload.destroy_command || "-"}`
+  ];
+}
+function emitCookbookStyleFailure(deps, options, error, commanderCode, fallbackPayload = {}) {
+  if (!(error instanceof CookbookError)) {
+    throw error;
+  }
+  const payload = {
+    status: "failed",
+    error: error.message,
+    ...fallbackPayload,
+    ...error instanceof CookbookDeployError ? error.payload : {}
+  };
+  if (options.json) {
+    emitCookbookDeployError(deps, options, payload);
+  } else {
+    printErrorLines(deps, formatCookbookDeployFailure(options, deps, error.message, payload));
+  }
+  throw new import_commander.CommanderError(1, commanderCode, "");
+}
+function printDeployPlan(deps, plan) {
+  const runtimeLabel = { node: "Node.js", python: "Python", static: "Static Site", go: "Go", deno: "Deno" };
+  const label = runtimeLabel[plan.runtime] || plan.runtime;
+  const lines = [
+    "",
+    `  Detected: ${label} (${plan.packageManager})`,
+    "",
+    `  Install:  ${plan.installCommand}`
+  ];
+  if (plan.buildCommand) lines.push(`  Build:    ${plan.buildCommand}`);
+  lines.push(
+    `  Start:    ${plan.startCommand}`,
+    `  Port:     ${plan.port}`,
+    `  Health:   ${plan.healthPath}`
+  );
+  if (plan.secrets.length > 0) {
+    lines.push("", "  Secrets:");
+    for (const s of plan.secrets) {
+      const envVal = process.env[s.env_name] || "";
+      if (envVal) {
+        lines.push(`    ${s.env_name}: set  (from environment)`);
+      } else {
+        lines.push(`    ${s.env_name}: (not set \u2014 will prompt)`);
+      }
+    }
+  }
+  lines.push("");
+  printLines(deps, lines);
+}
+function getDeployCacheDir() {
+  const cacheDir = import_path14.default.join(getConfigDir(), "deploys");
+  import_fs5.default.mkdirSync(cacheDir, { recursive: true, mode: 448 });
+  try {
+    import_fs5.default.chmodSync(cacheDir, 448);
+  } catch {
+  }
+  return cacheDir;
+}
+function getDeployCachePath(projectPath) {
+  const digest = import_crypto2.default.createHash("sha256").update(import_path14.default.resolve(projectPath)).digest("hex");
+  return import_path14.default.join(getDeployCacheDir(), `${digest}.json`);
+}
+function deployFingerprint(plan) {
+  return import_crypto2.default.createHash("sha256").update(JSON.stringify({
+    slug: plan.slug,
+    runtime: plan.runtime,
+    package_manager: plan.packageManager,
+    install_command: plan.installCommand,
+    build_command: plan.buildCommand,
+    start_command: plan.startCommand,
+    port: plan.port,
+    health_path: plan.healthPath
+  })).digest("hex");
+}
+function loadDeployRecord(projectPath) {
+  const recordPath = getDeployCachePath(projectPath);
+  if (!import_fs5.default.existsSync(recordPath)) return null;
+  try {
+    return JSON.parse(import_fs5.default.readFileSync(recordPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveDeployRecord(projectPath, record) {
+  const recordPath = getDeployCachePath(projectPath);
+  import_fs5.default.writeFileSync(recordPath, `${JSON.stringify(record, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  try {
+    import_fs5.default.chmodSync(recordPath, 384);
+  } catch {
+  }
+}
+async function resolveSavedSnapshot(client, projectPath, plan, progress) {
+  const record = loadDeployRecord(projectPath);
+  if (!record) return void 0;
+  const snapshotId = String(record.snapshot_id || "").trim();
+  if (!snapshotId || record.fingerprint !== deployFingerprint(plan)) return void 0;
+  try {
+    const snapshot = await client.snapshots.get(snapshotId);
+    const status = String(snapshot.status || "").toLowerCase();
+    if (status && status !== "ready") return void 0;
+  } catch {
+    return void 0;
+  }
+  progress?.(`Reusing saved snapshot ${snapshotId}`);
+  return snapshotId;
+}
+async function createDeploySnapshot(client, projectPath, plan, payload, progress) {
+  const vmId = String(payload.vm_id || "").trim();
+  if (!vmId) return void 0;
+  progress?.("Creating snapshot");
+  let result;
+  try {
+    result = await client.vms.snapshot(vmId, { name: `deploy/${plan.slug}` }, true);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CookbookError(`Failed to create deploy snapshot: ${message}`);
+  }
+  const snapshotId = String(result.snapshot_id || result.id || "").trim();
+  if (!snapshotId) return void 0;
+  saveDeployRecord(projectPath, {
+    slug: plan.slug,
+    project_path: import_path14.default.resolve(projectPath),
+    snapshot_id: snapshotId,
+    vm_id: vmId,
+    share_url: payload.share_url || null,
+    last_deployed: (/* @__PURE__ */ new Date()).toISOString(),
+    fingerprint: deployFingerprint(plan),
+    plan: {
+      runtime: plan.runtime,
+      package_manager: plan.packageManager,
+      install_command: plan.installCommand,
+      build_command: plan.buildCommand,
+      start_command: plan.startCommand,
+      port: plan.port,
+      health_path: plan.healthPath
+    }
+  });
+  return snapshotId;
+}
+function formatDeploySuccess(options, deps, payload) {
+  const colorEnabled = !options.json && supportsAnsi(deps.stdout);
+  const vmId = String(payload.vm_id || "");
+  const slug = String(payload.slug || "");
+  const displayUrl = String(payload.share_url || "").replace(/\/$/, "");
+  const connectHint = vmId ? `instavm connect ${vmId}` : "-";
+  return [
+    styleText("Deployed", ["1", "32"], colorEnabled),
+    "",
+    `  App       ${slug}`,
+    `  VM        ${vmId}`,
+    `  URL       ${styleText(displayUrl, ["32", "4"], colorEnabled)}`,
+    `  Connect   ${connectHint}`,
+    `  Destroy   ${payload.destroy_command || ""}`,
+    ...payload.reused_snapshot_id ? [`  Snapshot  reused ${payload.reused_snapshot_id}`] : [],
+    ...payload.saved_snapshot_id ? [`  Snapshot  saved ${payload.saved_snapshot_id}`] : []
+  ];
+}
+function addRuntimeOptions(command, options = {}) {
+  command.option("--api-key <apiKey>", "Override the InstaVM API key for this command");
+  command.option("--base-url <baseUrl>", "Override the InstaVM API base URL for this command");
+  if (options.includeSshHost) {
+    command.option("--ssh-host <sshHost>", "Override the SSH gateway host for this command");
+  }
+  if (options.includeJson !== false) {
+    command.option("-j, --json", "Emit JSON output");
+  }
+  return command;
+}
+function parseSize(value) {
+  const raw = value.trim().toLowerCase();
+  if (!raw) {
+    throw new Error("size is required");
+  }
+  const units = [
+    ["tb", 1024 ** 4],
+    ["gb", 1024 ** 3],
+    ["mb", 1024 ** 2],
+    ["kb", 1024],
+    ["b", 1]
+  ];
+  for (const [suffix, multiplier] of units) {
+    if (raw.endsWith(suffix) && raw !== suffix) {
+      const number = raw.slice(0, -suffix.length).trim();
+      return Math.floor(Number.parseFloat(number) * multiplier);
+    }
+  }
+  return Number.parseInt(raw, 10);
+}
+function humanBytes(value) {
+  let amount = Number(value || 0);
+  for (const unit of ["B", "KB", "MB", "GB", "TB"]) {
+    if (amount < 1024 || unit === "TB") {
+      if (unit === "B") {
+        return `${Math.trunc(amount)}${unit}`;
+      }
+      return `${amount.toFixed(1)}${unit}`;
+    }
+    amount /= 1024;
+  }
+  return `${Math.trunc(Number(value || 0))}B`;
+}
+function parseEnvPairs(values) {
+  const pairs = {};
+  for (const entry of values || []) {
+    const separatorIndex = entry.indexOf("=");
+    if (separatorIndex < 1) {
+      throw new Error(`Expected KEY=VALUE, got: ${entry}`);
+    }
+    const key = entry.slice(0, separatorIndex).trim();
+    const value = entry.slice(separatorIndex + 1);
+    if (!key) {
+      throw new Error(`Invalid env key: ${entry}`);
+    }
+    pairs[key] = value;
+  }
+  return pairs;
+}
+function parseVolumeSpec(spec) {
+  const parts = spec.split(":");
+  if (parts.length < 2) {
+    throw new Error("volume mounts must use <volume_id>:<mount_path>[:rw|ro[:checkpoint_id]]");
+  }
+  const volumeId = parts[0].trim();
+  const mountPath = parts[1].trim();
+  let mode = "rw";
+  let checkpointId = null;
+  if (parts[2]?.trim()) {
+    mode = parts[2].trim().toLowerCase();
+  }
+  if (parts[3]?.trim()) {
+    checkpointId = parts[3].trim();
+  }
+  if (parts.length > 4) {
+    throw new Error("volume mounts must use <volume_id>:<mount_path>[:rw|ro[:checkpoint_id]]");
+  }
+  if (!["rw", "ro"].includes(mode)) {
+    throw new Error("volume mount mode must be rw or ro");
+  }
+  if (mode === "rw" && checkpointId) {
+    throw new Error("checkpoint_id is only allowed for ro mounts");
+  }
+  if (mode === "ro" && !checkpointId) {
+    checkpointId = "latest";
+  }
+  return {
+    volume_id: volumeId,
+    mount_path: mountPath,
+    mode,
+    checkpoint_id: checkpointId
+  };
+}
+function looksLikeUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function statusPayload(deps, options) {
+  const settings = deps.resolveRuntimeConfig({
+    apiKey: options.apiKey,
+    baseURL: options.baseUrl,
+    sshHost: options.sshHost
+  });
+  const profile = getActiveProfile(settings.config);
+  const storedKey = profile.auth?.api_key ? String(profile.auth.api_key) : void 0;
+  return {
+    config_path: settings.configPath,
+    active_profile: settings.config.active_profile,
+    api_key: {
+      configured: Boolean(settings.apiKey),
+      redacted: redactSecret(settings.apiKey),
+      source: settings.apiKeySource,
+      stored: Boolean(storedKey)
+    },
+    base_url: {
+      value: settings.baseURL,
+      source: settings.baseURLSource
+    },
+    ssh_host: {
+      value: settings.sshHost,
+      source: settings.sshHostSource
+    }
+  };
+}
+function statusText(payload) {
+  const lines = [
+    `Config path: ${payload.config_path}`,
+    `Active profile: ${payload.active_profile}`,
+    `API key: ${payload.api_key.redacted || "not configured"} (${payload.api_key.source})`,
+    `Base URL: ${payload.base_url.value} (${payload.base_url.source})`,
+    `SSH host: ${payload.ssh_host.value} (${payload.ssh_host.source})`
+  ];
+  if (payload.api_key.stored) {
+    lines.push("Stored key: present");
+  }
+  return lines;
+}
+function resolveSettings(deps, options) {
+  return deps.resolveRuntimeConfig({
+    apiKey: options.apiKey,
+    baseURL: options.baseUrl,
+    sshHost: options.sshHost
+  });
+}
+function requireClient(deps, options) {
+  const settings = resolveSettings(deps, options);
+  if (!settings.apiKey) {
+    throw new Error("No InstaVM API key configured. Run `instavm auth set-key` or export INSTAVM_API_KEY.");
+  }
+  return {
+    client: deps.clientFactory(settings.apiKey, { baseURL: settings.baseURL }),
+    settings
+  };
+}
+async function resolveDesktopTarget(client, target) {
+  if (looksLikeUuid(target)) {
+    const status = await client.getSessionStatus(target);
+    return { ...status, session_id: target };
+  }
+  const vm = await client.vms.get(target);
+  const sessionId = vm.session_id ? String(vm.session_id) : null;
+  if (sessionId) {
+    const status = await client.getSessionStatus(sessionId);
+    return {
+      ...status,
+      session_id: sessionId,
+      vm_id: status.vm_id || vm.vm_id
+    };
+  }
+  return {
+    session_id: null,
+    vm_id: vm.vm_id,
+    vm_status: vm.status,
+    vm_alive: vm.status === "active"
+  };
+}
+async function desktopPayload(client, target) {
+  const payload = await resolveDesktopTarget(client, target);
+  if (payload.vm_alive && payload.session_id) {
+    try {
+      Object.assign(payload, await client.computerUse.viewerUrl(String(payload.session_id)));
+    } catch (error) {
+    }
+  }
+  return payload;
+}
+function createProgram(deps = defaultDeps) {
   const program = new import_commander.Command();
   program.name("instavm").description("InstaVM CLI for VM, snapshot, volume, desktop, identity, and sharing workflows.").showHelpAfterError().showSuggestionAfterError().configureOutput({
     writeOut: (str) => deps.stdout.write(str),
@@ -2823,19 +4902,7 @@ function createProgram(deps = defaultDeps) {
         is_verified: user.is_verified,
         ssh_keys: sshKeys
       };
-      emitOutput(
-        deps,
-        options,
-        payload,
-        [
-          `Email: ${payload.email || "-"}`,
-          `User ID: ${payload.id}`,
-          `Name: ${payload.name || "-"}`,
-          `Verified: ${payload.is_verified ? "yes" : "no"}`,
-          "SSH Keys:",
-          ...sshKeys.length ? sshKeys.map((key) => `  ${key.id}	${key.fingerprint}	${key.comment || ""}`.trimEnd()) : ["  none"]
-        ]
-      );
+      emitOutput(deps, options, payload, formatWhoamiOutput(payload));
     })
   );
   addRuntimeOptions(
@@ -2881,14 +4948,15 @@ function createProgram(deps = defaultDeps) {
     })
   );
   addRuntimeOptions(
-    program.command("ls").alias("list").description("List your VMs").option("--all", "Include all VM records, not just active VMs").action(async (options) => {
+    program.command("ls").alias("list").description("List active VMs by default").option("-a, --all", "Include all VM records, including terminated VMs").action(async (options) => {
       const { client } = requireClient(deps, options);
-      const vms = options.all ? await client.vms.listAllRecords() : await client.vms.list();
+      const listedVms = options.all ? await client.vms.listAllRecords() : await client.vms.list();
+      const vms = options.all ? listedVms : filterActiveVms(listedVms);
       emitOutput(
         deps,
         options,
         { vms },
-        vms.length > 0 ? vms.map((vm) => `${vm.vm_id}	${vm.status || "-"}	${vm.created_at || "-"}	${vm.ssh_host || "-"}`) : ["No VMs."]
+        vms.length > 0 ? formatVmList(vms, Boolean(options.all)) : [options.all ? "No VMs." : "No active VMs. Use `instavm ls -a` or `instavm ls --all` to include terminated VMs."]
       );
     })
   );
@@ -2927,7 +4995,7 @@ function createProgram(deps = defaultDeps) {
   addRuntimeOptions(
     program.command("connect").description("SSH into a VM with the local ssh client").argument("<vmId>").argument("[sshArgs...]").action(async (vmId, sshArgs, options) => {
       const settings = resolveSettings(deps, options);
-      const sshBinary = process.platform === "win32" ? findExecutable(deps, "ssh.exe") || findExecutable(deps, "ssh") : findExecutable(deps, "ssh") || findExecutable(deps, "ssh.exe");
+      const sshBinary = process.platform === "win32" ? findExecutable2(deps, "ssh.exe") || findExecutable2(deps, "ssh") : findExecutable2(deps, "ssh") || findExecutable2(deps, "ssh.exe");
       if (!sshBinary) {
         throw new Error("ssh client not found on PATH");
       }
@@ -2959,7 +5027,7 @@ function createProgram(deps = defaultDeps) {
         deps,
         options,
         { snapshots },
-        snapshots.length > 0 ? snapshots.map((snap) => `${snap.id}	${snap.name || "-"}	${snap.status || "-"}	${snap.type || "-"}`) : ["No snapshots."]
+        snapshots.length > 0 ? formatSnapshotList(snapshots) : ["No snapshots."]
       );
     })
   );
@@ -3081,7 +5149,7 @@ function createProgram(deps = defaultDeps) {
         deps,
         options,
         { keys },
-        keys.length > 0 ? keys.map((key) => `${key.id}	${key.fingerprint}	${key.comment || ""}`.trimEnd()) : ["No SSH keys."]
+        keys.length > 0 ? formatSshKeyList(keys) : ["No SSH keys."]
       );
     })
   );
@@ -3198,7 +5266,7 @@ function createProgram(deps = defaultDeps) {
         deps,
         options,
         { volumes },
-        volumes.length > 0 ? volumes.map((entry) => `${entry.id}	${entry.name}	${humanBytes(entry.used_bytes)}/${humanBytes(entry.quota_bytes)}	${entry.status}`) : ["No volumes."]
+        volumes.length > 0 ? formatVolumeList(volumes) : ["No volumes."]
       );
     })
   );
@@ -3261,7 +5329,7 @@ function createProgram(deps = defaultDeps) {
         deps,
         options,
         { checkpoints },
-        checkpoints.length > 0 ? checkpoints.map((entry) => `${entry.id}	${entry.name || "-"}	${entry.status || "-"}`) : ["No checkpoints."]
+        checkpoints.length > 0 ? formatCheckpointList(checkpoints) : ["No checkpoints."]
       );
     })
   );
@@ -3292,14 +5360,14 @@ function createProgram(deps = defaultDeps) {
         deps,
         options,
         { files: result },
-        result.length > 0 ? result.map((entry) => `${entry.path}	${humanBytes(entry.size)}`) : ["No files."]
+        result.length > 0 ? formatFileList(result) : ["No files."]
       );
     })
   );
   addRuntimeOptions(
     files.command("upload").description("Upload a file into a volume").argument("<volumeId>").argument("<localPath>").option("--path <remotePath>", "Remote path inside the volume").option("--overwrite", "Overwrite if the path already exists").action(async (volumeId, localPath, options) => {
       const { client } = requireClient(deps, options);
-      const remotePath = options.path || import_path12.default.basename(localPath);
+      const remotePath = options.path || import_path14.default.basename(localPath);
       const result = await client.volumes.uploadFile(volumeId, {
         filePath: localPath,
         path: remotePath,
@@ -3312,7 +5380,7 @@ function createProgram(deps = defaultDeps) {
     files.command("download").description("Download a file from a volume").argument("<volumeId>").argument("<remotePath>").option("--out <outputPath>", "Local output path").action(async (volumeId, remotePath, options) => {
       const { client } = requireClient(deps, options);
       const result = await client.volumes.downloadFile(volumeId, remotePath);
-      const outputPath = options.out || import_path12.default.basename(remotePath);
+      const outputPath = options.out || import_path14.default.basename(remotePath);
       deps.writeFile(outputPath, result.content);
       emitOutput(
         deps,
@@ -3340,20 +5408,173 @@ function createProgram(deps = defaultDeps) {
   program.command("billing").description("Show the billing portal URL").option("-j, --json", "Emit JSON output").action((options) => {
     emitOutput(deps, options, { url: DEFAULT_BILLING_URL }, [DEFAULT_BILLING_URL]);
   });
+  addRuntimeOptions(
+    program.command("deploy").description("Detect and deploy an app from a local directory").argument("[path]", "Project directory", ".").option("-y, --yes", "Skip confirmation prompt").option("--env <key=value...>", "Set environment variable (repeatable)", (val, prev) => [...prev, val], []).option("--port <port>", "Override detected port", parseInt).option("--health-path <path>", "Override detected health check path").option("--start-command <cmd>", "Override detected start command").option("--install-command <cmd>", "Override detected install command").option("--build-command <cmd>", "Override detected build command").option("--plan", "Show detected plan and exit (dry-run)").option("--private", "Don't create public share").option("--save-snapshot", "Create VM snapshot after successful deploy").action(async (projectPath, options) => {
+      const resolved = import_path14.default.resolve(projectPath);
+      let plan;
+      try {
+        plan = detectProject(resolved);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        deps.stderr.write(`Error: ${msg}
+`);
+        throw new import_commander.CommanderError(1, "deploy.detect.failed", "");
+      }
+      if (options.port) plan.port = options.port;
+      if (options.healthPath) plan.healthPath = options.healthPath;
+      if (options.startCommand) plan.startCommand = options.startCommand;
+      if (options.installCommand) plan.installCommand = options.installCommand;
+      if (options.buildCommand !== void 0) plan.buildCommand = options.buildCommand;
+      for (const kv of options.env || []) {
+        const eqIdx = kv.indexOf("=");
+        if (eqIdx > 0) process.env[kv.slice(0, eqIdx)] = kv.slice(eqIdx + 1);
+      }
+      if (options.plan) {
+        if (options.json) {
+          printJson(deps, {
+            slug: plan.slug,
+            runtime: plan.runtime,
+            package_manager: plan.packageManager,
+            install_command: plan.installCommand,
+            build_command: plan.buildCommand,
+            start_command: plan.startCommand,
+            port: plan.port,
+            health_path: plan.healthPath,
+            secrets: plan.secrets.map((s) => s.env_name)
+          });
+        } else {
+          printDeployPlan(deps, plan);
+        }
+        return;
+      }
+      if (!options.yes && deps.stdout.isTTY) {
+        printDeployPlan(deps, plan);
+        const rl = (await import("readline")).createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise((resolve) => rl.question("  Deploy? [Y/n] ", resolve));
+        rl.close();
+        if (answer.trim().toLowerCase() === "n") return;
+      }
+      const manifest = planToManifest(plan, resolved);
+      if (options.private) manifest.app.share_public_default = false;
+      const { client, settings } = requireClient(deps, options);
+      const progressRenderer = new ProgressRenderer(deps, options);
+      const reusedSnapshotId = await resolveSavedSnapshot(
+        client,
+        resolved,
+        plan,
+        (message) => cookbookProgress(progressRenderer, message)
+      );
+      try {
+        const payload = await runDeploy(
+          manifest,
+          client,
+          settings,
+          deps,
+          (message) => cookbookProgress(progressRenderer, message),
+          reusedSnapshotId
+        );
+        if (reusedSnapshotId) {
+          payload.reused_snapshot_id = reusedSnapshotId;
+        }
+        if (options.saveSnapshot) {
+          const savedSnapshotId = await createDeploySnapshot(
+            client,
+            resolved,
+            plan,
+            payload,
+            (message) => cookbookProgress(progressRenderer, message)
+          );
+          if (savedSnapshotId) {
+            payload.saved_snapshot_id = savedSnapshotId;
+          }
+        }
+        progressRenderer.stop();
+        emitOutput(deps, options, payload, formatDeploySuccess(options, deps, payload));
+      } catch (error) {
+        progressRenderer.stop();
+        emitCookbookStyleFailure(deps, options, error, "deploy.failed");
+      }
+    }),
+    { includeSshHost: true }
+  );
+  const cookbook = program.command("cookbook").description("Discover and deploy curated cookbook applications");
+  cookbook.command("list").description("List available cookbooks").option("-j, --json", "Emit JSON output").action(async (options) => {
+    const root = resolveCookbookRoot(deps);
+    const cookbooks = discoverCookbooks(root).map(manifestDisplayRecord);
+    emitOutput(
+      deps,
+      options,
+      { cookbooks },
+      formatCookbookList(cookbooks)
+    );
+  });
+  cookbook.command("info").description("Show cookbook details and required secrets").argument("<slug>").option("-j, --json", "Emit JSON output").action(async (slug, options) => {
+    const root = resolveCookbookRoot(deps);
+    const manifest = loadManifest(import_path14.default.join(root, slug, "instavm.yaml"));
+    emitOutput(
+      deps,
+      options,
+      {
+        ...manifestDisplayRecord(manifest),
+        vm: manifest.vm,
+        app: manifest.app,
+        run: manifest.run,
+        secrets: manifest.secrets,
+        notes: manifest.post_deploy_notes
+      },
+      [
+        `Slug: ${manifest.slug}`,
+        `Title: ${manifest.title}`,
+        `Summary: ${manifest.summary}`,
+        `Runtime: ${manifest.runtime}`,
+        `Deploy: ${manifest.deploy.kind}`,
+        `VM: ${manifest.vm.vcpu_count} vCPU, ${manifest.vm.memory_mb}MB`,
+        `Port: ${manifest.app.port}`,
+        `Healthcheck: ${manifest.app.healthcheck_path}`,
+        `Secrets: ${manifest.secrets.map((secret) => secret.env_name).join(", ") || "none"}`,
+        ...manifest.post_deploy_notes.length > 0 ? ["Notes:", ...manifest.post_deploy_notes.map((note) => `  - ${note}`)] : []
+      ]
+    );
+  });
+  addRuntimeOptions(
+    cookbook.command("deploy").description("Create a VM, start the cookbook app, and return the public share URL").argument("<slug>").action(async (slug, options) => {
+      const progressRenderer = new ProgressRenderer(deps, options);
+      try {
+        const root = resolveCookbookRoot(deps, (message) => cookbookProgress(progressRenderer, message));
+        const manifest = loadManifest(import_path14.default.join(root, slug, "instavm.yaml"));
+        const { client, settings } = requireClient(deps, options);
+        const payload = await deployCookbook(
+          manifest,
+          client,
+          settings,
+          deps,
+          (message) => cookbookProgress(progressRenderer, message)
+        );
+        progressRenderer.stop();
+        emitOutput(deps, options, payload, formatCookbookDeploySuccess(options, deps, payload));
+      } catch (error) {
+        progressRenderer.stop();
+        emitCookbookStyleFailure(deps, options, error, "cookbook.deploy.failed", { slug });
+      }
+    }),
+    { includeSshHost: true }
+  );
   return program;
 }
 async function runCli(argv, deps = defaultDeps) {
   const program = createProgram(deps);
   try {
-    await program.parseAsync(["node", "instavm", ...argv]);
+    await program.parseAsync(["node", "instavm", ...normalizeArgv(argv)]);
     return 0;
   } catch (error) {
     if (error instanceof import_commander.CommanderError) {
       if (error.code === "commander.helpDisplayed") {
         return error.exitCode;
       }
-      deps.stderr.write(`${error.message}
+      if (error.message) {
+        deps.stderr.write(`${error.message}
 `);
+      }
       return error.exitCode || 1;
     }
     const message = error instanceof Error ? error.message : String(error);
@@ -3362,7 +5583,7 @@ async function runCli(argv, deps = defaultDeps) {
     return 1;
   }
 }
-function findExecutable(deps, binary) {
+function findExecutable2(deps, binary) {
   const result = deps.spawnSync(process.platform === "win32" ? "where" : "which", [binary], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"]