ninepm 0.0.1 → 0.26.0

package/dist/index.js

@@ -0,0 +1,2530 @@
+#!/usr/bin/env node
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./deploy-description.js";
+import { assetFileTooLargeMessage, oversizedAssets } from "./deploy-limits.js";
+import { buildFileManifest, readManifestFile } from "./manifest.js";
+import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
+export const CLI_VERSION = "0.26.0";
+const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
+const TOKEN_SERVICE = "9pm";
+const TOKEN_ACCOUNT = "default";
+const CREDENTIAL_METADATA_FILE = "credentials.json";
+const WINDOWS_CREDENTIAL_FILE = "credential.dpapi";
+const PLAINTEXT_CREDENTIAL_FILE = "credential.plaintext.json";
+const ALLOW_FILE_CREDENTIAL_STORE_ENV = "NINEPM_ALLOW_FILE_CREDENTIAL_STORE";
+const DISABLE_NATIVE_CREDENTIAL_STORE_ENV = "NINEPM_DISABLE_NATIVE_CREDENTIAL_STORE";
+const WORKER_ENTRY_LIMIT_BYTES = 1_000_000;
+const WORKER_ENTRY_WARN_BYTES = Math.floor(WORKER_ENTRY_LIMIT_BYTES * 0.8);
+const DEFAULT_CONTAINER_POLL_TIMEOUT_MS = 15 * 60 * 1000;
+export function detectFramework(directory) {
+    let dependencies = {};
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8"));
+        dependencies = { ...pkg.dependencies, ...pkg.devDependencies };
+    }
+    catch {
+        // No package.json: plain static directory.
+    }
+    const hasConfig = (base) => ["js", "mjs", "cjs", "ts", "mts"].some((ext) => existsSync(path.join(directory, `${base}.${ext}`)));
+    if (hasConfig("next.config") || dependencies.next) {
+        return "nextjs";
+    }
+    if (hasConfig("astro.config") || dependencies.astro) {
+        return "astro";
+    }
+    if (dependencies["@sveltejs/kit"]) {
+        return "sveltekit";
+    }
+    if (hasConfig("vite.config") || dependencies.vite) {
+        return "vite";
+    }
+    return null;
+}
+export const DEFAULT_OPEN_NEXT_CONFIG = `import { defineCloudflareConfig } from "@opennextjs/cloudflare";
+export default defineCloudflareConfig();
+`;
+export function defaultNextWranglerConfig(appName) {
+    return `${JSON.stringify({
+        name: appName,
+        main: ".open-next/worker.js",
+        compatibility_date: "2026-05-01",
+        compatibility_flags: ["nodejs_compat"],
+        assets: { directory: ".open-next/assets", binding: "ASSETS" },
+    }, null, 2)}\n`;
+}
+// Build-step runner: the framework's own output streams straight through —
+// when a deploying agent reads it, the error IS the fix instruction.
+function runBuildStep(label, command, args, cwd) {
+    console.log(`[9pm] ${label}: ${command} ${args.join(" ")}`);
+    const result = spawnSync(command, args, { cwd, stdio: "inherit", shell: process.platform === "win32" });
+    if (result.status !== 0) {
+        throw new Error(`${label} failed (exit ${result.status ?? "signal"}). The output above is the build tool's own error — fix the app and re-run 9pm deploy, or skip builds with --no-build.`);
+    }
+}
+function ensureProjectDependencies(directory) {
+    if (!existsSync(path.join(directory, "node_modules"))) {
+        runBuildStep("Installing dependencies", "npm", ["install"], directory);
+    }
+}
+// Exported for tests: the install-vs-skip decision is pure filesystem state.
+// Walk up node_modules the way Node resolves modules, so a package hoisted to an
+// ancestor node_modules (npm/yarn/pnpm workspaces) is detected and we don't
+// force a redundant install that, in a workspace, often fails on workspace:*
+// deps. Check the package's package.json rather than just the directory, so a
+// stale/empty dir left by a failed install is still treated as not installed.
+export function isOpenNextInstalled(directory) {
+    let dir = path.resolve(directory);
+    for (;;) {
+        if (existsSync(path.join(dir, "node_modules", "@opennextjs", "cloudflare", "package.json"))) {
+            return true;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return false;
+        dir = parent;
+    }
+}
+// The OpenNext build and the generated open-next.config.ts both import from
+// `@opennextjs/cloudflare`, so it must resolve inside the project - not just be
+// runnable via npx. ensureProjectDependencies won't add it when node_modules
+// already exists but the package isn't a dependency, so install it explicitly.
+function ensureOpenNextInstalled(directory) {
+    if (!isOpenNextInstalled(directory)) {
+        console.log("[9pm] Installing the framework's Worker-runtime adapter (added to your devDependencies).");
+        runBuildStep("Installing the Worker-runtime adapter", "npm", ["install", "--save-dev", "--include=dev", "@opennextjs/cloudflare@1"], directory);
+    }
+}
+function prepareNextDeploy(directory) {
+    console.log("[9pm] Detected Next.js — building for the Worker runtime.");
+    ensureProjectDependencies(directory);
+    ensureOpenNextInstalled(directory);
+    const openNextConfig = path.join(directory, "open-next.config.ts");
+    if (!existsSync(openNextConfig)) {
+        writeFileSync(openNextConfig, DEFAULT_OPEN_NEXT_CONFIG, "utf8");
+        console.log("[9pm] Created open-next.config.ts (default Worker-runtime adapter config) — consider committing it.");
+    }
+    const hasWranglerConfig = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"].some((file) => existsSync(path.join(directory, file)));
+    if (!hasWranglerConfig) {
+        writeFileSync(path.join(directory, "wrangler.jsonc"), defaultNextWranglerConfig(path.basename(path.resolve(directory))), "utf8");
+        console.log("[9pm] Created wrangler.jsonc (drives the local bundling step) — consider committing it.");
+    }
+    runBuildStep("OpenNext build", "npx", ["--yes", "@opennextjs/cloudflare@1", "build"], directory);
+    const distDir = path.join(directory, ".9pm", "dist");
+    rmSync(distDir, { recursive: true, force: true });
+    runBuildStep("Bundling worker", "npx", ["--yes", "wrangler@4", "deploy", "--dry-run", "--outdir", path.join(".9pm", "dist")], directory);
+    const workerModule = path.join(distDir, "worker.js");
+    if (!existsSync(workerModule)) {
+        throw new Error(`Bundling produced no ${workerModule}. Check the wrangler output above; its config must point main at .open-next/worker.js.`);
+    }
+    const bundleDir = path.join(directory, ".9pm", "bundle");
+    rmSync(bundleDir, { recursive: true, force: true });
+    mkdirSync(path.join(bundleDir), { recursive: true });
+    cpSync(workerModule, path.join(bundleDir, "worker.js"));
+    const assetsDir = path.join(directory, ".open-next", "assets");
+    if (existsSync(assetsDir)) {
+        cpSync(assetsDir, path.join(bundleDir, "assets"), { recursive: true });
+    }
+    return path.join(".9pm", "bundle");
+}
+function prepareViteDeploy(directory) {
+    console.log("[9pm] Detected Vite — building the static app.");
+    ensureProjectDependencies(directory);
+    runBuildStep("Vite build", "npm", ["run", "build"], directory);
+    const dist = path.join(directory, "dist");
+    if (!existsSync(path.join(dist))) {
+        throw new Error("Vite build finished but no dist/ directory exists. If the project uses a custom outDir, deploy that directory directly: 9pm deploy <outDir> --no-build.");
+    }
+    return dist;
+}
+// Zero-flag framework deploys: detect, run the framework's own Cloudflare
+// pipeline locally, then continue as a bundle (Next) or static (Vite) deploy.
+function prepareFrameworkDeploy(options) {
+    if (options.noBuild || options.runtime || options.bundleDir || options.entry) {
+        return options;
+    }
+    const framework = detectFramework(options.directory);
+    if (!framework) {
+        return options;
+    }
+    const appName = options.name ?? path.basename(path.resolve(options.directory));
+    if (framework === "nextjs") {
+        const bundleDir = prepareNextDeploy(options.directory);
+        return { ...options, name: appName, runtime: "worker", bundleDir };
+    }
+    if (framework === "vite") {
+        const dist = prepareViteDeploy(options.directory);
+        return { ...options, name: appName, directory: dist, runtime: "static" };
+    }
+    throw new Error(`${framework === "astro" ? "Astro" : "SvelteKit"} projects are not auto-built yet. Run the framework's Worker-runtime adapter build yourself (${framework === "astro" ? "@astrojs/cloudflare" : "@sveltejs/adapter-cloudflare"}), then deploy the output with: 9pm deploy . --bundle <adapter output dir> (Worker bundles) or 9pm deploy <static output dir> --no-build (static output).`);
+}
+function hasDockerfile(directory) {
+    return existsSync(path.join(path.resolve(directory), "Dockerfile"));
+}
+// A directory whose only meaningful artifact is a Dockerfile would otherwise be
+// uploaded as static assets (server never runs, every route 404s). Refuse the
+// silent misdeploy unless the runtime was chosen explicitly.
+const DOCKERFILE_STATIC_HINT = "Found a Dockerfile but no runtime was selected, so this would deploy as a static site and the server would not run. Re-run with `--runtime container --port <n>` for a container app, or pass `--runtime static` to deploy the directory as static assets.";
+// Raised when a deploy fails, carrying the *server-resolved* project slug (when
+// the project was already created) so the failure hint can suggest
+// `9pm support --site <slug>` — the slug /v1/me/support needs to attach the
+// failed deploy's id/status/error. The display name (e.g. "My App") is not the
+// slug (server-normalized to "my-app"), so the raw name would not resolve.
+export class DeployError extends Error {
+    slug;
+    constructor(message, slug) {
+        super(message);
+        this.name = "DeployError";
+        this.slug = slug;
+    }
+}
+// Shell-quote a value for a copy-pasteable command. Clean slugs pass through
+// unquoted; anything with shell-significant characters is single-quoted.
+function quoteSiteArg(value) {
+    return /^[A-Za-z0-9._-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+export async function deployDirectory(initialOptions) {
+    const slugHolder = initialOptions.slug ? { slug: initialOptions.slug } : {};
+    try {
+        return await runDeploy(initialOptions, slugHolder);
+    }
+    catch (error) {
+        // If this invocation created the project (vs. redeploying an existing app)
+        // and the deploy then failed, roll the project back so a rejected first
+        // deploy leaves no orphaned app holding the slug and a Sites quota slot
+        // (#195). Best-effort: a cleanup failure must not mask the deploy error.
+        if (slugHolder.created && slugHolder.slug) {
+            try {
+                await deleteSite({
+                    apiUrl: initialOptions.apiUrl,
+                    token: initialOptions.token,
+                    ...(initialOptions.fetchFn ? { fetchFn: initialOptions.fetchFn } : {}),
+                    site: slugHolder.slug,
+                    confirmSlug: slugHolder.slug,
+                });
+            }
+            catch {
+                // Swallow: surface the original deploy failure, not the cleanup failure.
+            }
+        }
+        if (error instanceof DeployError)
+            throw error;
+        throw new DeployError(error instanceof Error ? error.message : String(error), slugHolder.slug);
+    }
+}
+async function runDeploy(initialOptions, slugHolder) {
+    const options = prepareFrameworkDeploy(initialOptions);
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const runtime = options.runtime ?? (options.entry ? "worker" : "static");
+    if (!options.runtime && runtime === "static" && hasDockerfile(options.directory)) {
+        throw new Error(DOCKERFILE_STATIC_HINT);
+    }
+    if (runtime === "container") {
+        if (!options.port) {
+            throw new Error("Container deploys require --port.");
+        }
+        const image = buildContainerImage(options.directory);
+        try {
+            const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)) };
+            const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, options.slug ? { ...projectInput, slug: options.slug } : projectInput);
+            slugHolder.slug = project.slug;
+            slugHolder.created = projectCreated;
+            const database = options.withDatabase
+                ? await createDatabase(fetchFn, apiUrl, options.token, project.id, {
+                    name: options.databaseName ?? `${project.slug}-db`,
+                    binding: options.bindingName ?? "DB",
+                })
+                : null;
+            if (options.withAuth) {
+                await enableEndUserAuth(fetchFn, apiUrl, options.token, project.id);
+            }
+            const created = await createDeployment(fetchFn, apiUrl, options.token, project.id, {
+                files: [],
+                environment: options.environment ?? "production",
+                ...(options.description ? { description: options.description } : {}),
+                runtime,
+                container: {
+                    imageSize: image.size,
+                    imageSha256: image.sha256,
+                    port: options.port,
+                    healthPath: options.healthPath ?? null,
+                    region: options.region ?? "auto",
+                    alwaysOn: options.alwaysOn ?? false,
+                    // Only send volumeGb when the user specified a disk (--volume) or
+                    // explicitly none (--no-volume). Omitting it lets the server carry the
+                    // prior deployment's disk forward instead of dropping it.
+                    ...(options.volumeGb !== undefined ? { volumeGb: options.volumeGb } : {}),
+                    ...(options.allowVolumeDestroy ? { allowVolumeDestroy: true } : {}),
+                    ...(options.allowNamespaceReset ? { allowNamespaceReset: true } : {}),
+                    ...(options.cpus !== undefined ? { cpus: options.cpus } : {}),
+                    ...(options.memoryMb !== undefined ? { memoryMb: options.memoryMb } : {}),
+                },
+                metadata: {
+                    cli: CLI_CLIENT_ID,
+                    inspiredBy: "here.now",
+                    databaseBinding: database?.bindingName ?? null,
+                    runtime,
+                    port: options.port,
+                    healthPath: options.healthPath ?? null,
+                    region: options.region ?? "auto",
+                },
+            });
+            if (!created.containerImageUpload) {
+                throw new Error("Container deployment did not return an image upload session.");
+            }
+            await uploadContainerImage(fetchFn, image.path, created.containerImageUpload);
+            const queued = await finalizeDeployment(fetchFn, apiUrl, options.token, created.deployment.id);
+            const finalized = await pollDeployment(fetchFn, apiUrl, options.token, queued.id, options.pollTimeoutMs ?? DEFAULT_CONTAINER_POLL_TIMEOUT_MS, queued);
+            if (finalized.status === "failed") {
+                throw new Error(deploymentFailureMessage(finalized));
+            }
+            return {
+                project,
+                deployment: finalized,
+                database,
+                uploaded: 1,
+                url: finalized.url,
+                containerImageBytes: image.size,
+            };
+        }
+        finally {
+            cleanupContainerImage(image);
+        }
+    }
+    const contentRoot = options.bundleDir ? path.resolve(options.directory, options.bundleDir) : options.directory;
+    let manifest = await buildFileManifest(contentRoot);
+    if (options.bundleDir) {
+        // Source maps are debugging aids, not runtime files; keep uploads lean.
+        manifest = manifest.filter((file) => !file.path.endsWith(".map"));
+    }
+    if (manifest.length === 0) {
+        throw new Error(options.bundleDir ? `Bundle directory contains no files: ${contentRoot}` : "Directory contains no deployable files.");
+    }
+    const bundle = options.bundleDir ? bundleMetadataFromManifest(manifest, contentRoot) : null;
+    const serverEntry = runtime === "worker" && !bundle ? normalizeServerEntry(options.entry ?? "src/index.js") : undefined;
+    if (serverEntry && !manifest.some((file) => file.path === serverEntry)) {
+        throw new Error(`Worker runtime entry file was not found in the deploy directory: ${serverEntry}`);
+    }
+    // Reject oversized assets before creating the project (#195): the server's size
+    // guard only fires on the later create-deployment call, which would otherwise
+    // leave an orphaned no-deploy app holding the slug and a Sites quota slot.
+    const [oversized] = oversizedAssets(manifest);
+    if (oversized) {
+        throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+    }
+    const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)) };
+    const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, options.slug ? { ...projectInput, slug: options.slug } : projectInput);
+    slugHolder.slug = project.slug;
+    slugHolder.created = projectCreated;
+    const database = options.withDatabase
+        ? await createDatabase(fetchFn, apiUrl, options.token, project.id, {
+            name: options.databaseName ?? `${project.slug}-db`,
+            binding: options.bindingName ?? "DB",
+        })
+        : null;
+    if (options.withAuth) {
+        await enableEndUserAuth(fetchFn, apiUrl, options.token, project.id);
+    }
+    const created = await createDeployment(fetchFn, apiUrl, options.token, project.id, {
+        files: manifest,
+        environment: options.environment ?? "production",
+        ...(options.description ? { description: options.description } : {}),
+        runtime,
+        ...(serverEntry ? { serverEntry } : {}),
+        metadata: {
+            cli: CLI_CLIENT_ID,
+            inspiredBy: "here.now",
+            databaseBinding: database?.bindingName ?? null,
+            runtime,
+            serverEntry: serverEntry ?? null,
+            ...(bundle ? { bundle } : {}),
+        },
+    });
+    let uploaded = 0;
+    for (const upload of created.uploads) {
+        const file = manifest.find((candidate) => candidate.path === upload.path.split("/").slice(4).map(decodeURIComponent).join("/"));
+        const manifestPath = file?.path ?? pathFromUpload(upload, created.deployment.id);
+        const body = await readManifestFile(contentRoot, manifestPath);
+        const response = await fetchFn(upload.uploadUrl, {
+            method: upload.method,
+            headers: {
+                authorization: `Bearer ${options.token}`,
+                ...upload.headers,
+            },
+            body: arrayBufferFromBytes(body),
+        });
+        await expectOk(response, `upload ${manifestPath}`);
+        uploaded += 1;
+    }
+    const finalized = await finalizeDeployment(fetchFn, apiUrl, options.token, created.deployment.id);
+    return {
+        project,
+        deployment: finalized,
+        database,
+        uploaded,
+        url: finalized.url,
+    };
+}
+export async function checkDeployDirectory(options) {
+    const runtime = options.runtime ?? (options.entry ? "worker" : "static");
+    if (runtime === "container") {
+        const warnings = [];
+        const errors = [];
+        if (!options.port) {
+            errors.push("Container deploys require --port.");
+        }
+        if (!existsSync(path.join(path.resolve(options.directory), "Dockerfile"))) {
+            errors.push("Container deploys require a Dockerfile in the deployment directory.");
+        }
+        const docker = spawnSync("docker", ["--version"], { encoding: "utf8" });
+        if (docker.status !== 0) {
+            errors.push("Docker is required for local container builds.");
+        }
+        return { ok: errors.length === 0, warnings, errors, files: 0, bytes: 0 };
+    }
+    const manifest = await buildFileManifest(options.directory);
+    const serverEntry = runtime === "worker" ? normalizeServerEntry(options.entry ?? "src/index.js") : undefined;
+    const totalBytes = manifest.reduce((sum, file) => sum + file.size, 0);
+    const warnings = [];
+    const errors = [];
+    if (manifest.length === 0) {
+        errors.push("Directory contains no deployable files.");
+    }
+    if (runtime === "static" && !options.runtime && hasDockerfile(options.directory)) {
+        errors.push(DOCKERFILE_STATIC_HINT);
+    }
+    if (runtime === "static" && !manifest.some((file) => file.path === "index.html")) {
+        warnings.push("Static deploy does not contain index.html.");
+    }
+    // Per-file size limit, matching the server's create-time guard (#194), so an
+    // oversized asset is caught locally instead of failing with a 413 mid-deploy.
+    for (const file of oversizedAssets(manifest)) {
+        errors.push(assetFileTooLargeMessage(file.path, file.size));
+    }
+    if (serverEntry) {
+        const entry = manifest.find((file) => file.path === serverEntry);
+        if (!entry) {
+            errors.push(`Worker runtime entry file was not found: ${serverEntry}`);
+        }
+        else {
+            if (entry.size > WORKER_ENTRY_LIMIT_BYTES) {
+                errors.push(`Worker runtime entry is ${entry.size} bytes; limit is ${WORKER_ENTRY_LIMIT_BYTES} bytes.`);
+            }
+            else if (entry.size >= WORKER_ENTRY_WARN_BYTES) {
+                warnings.push(`Worker runtime entry is over 80% of the ${WORKER_ENTRY_LIMIT_BYTES} byte limit.`);
+            }
+            const source = new TextDecoder().decode(await readManifestFile(options.directory, serverEntry));
+            const bundle = await validateWorkerEntrySource(source, serverEntry);
+            warnings.push(...bundle.warnings);
+            errors.push(...bundle.errors);
+        }
+    }
+    return { ok: errors.length === 0, warnings, errors, files: manifest.length, bytes: totalBytes };
+}
+export async function whoami(options) {
+    return apiRequest(options, "/v1/me", { method: "GET" });
+}
+export function publicWhoamiResult(result) {
+    return {
+        user: result.user,
+        account: {
+            ...(result.account?.org ? { org: result.account.org } : {}),
+            ...(result.account?.plan ? { plan: result.account.plan } : {}),
+            ...(typeof result.account?.sitesUsed === "number" ? { sitesUsed: result.account.sitesUsed } : {}),
+            ...(typeof result.account?.sitesQuota === "number" ? { sitesQuota: result.account.sitesQuota } : {}),
+            ...(typeof result.account?.storageUsedBytes === "number" ? { storageUsedBytes: result.account.storageUsedBytes } : {}),
+            ...(typeof result.account?.storageQuotaBytes === "number" ? { storageQuotaBytes: result.account.storageQuotaBytes } : {}),
+            ...(typeof result.account?.fileStorageUsedBytes === "number" ? { fileStorageUsedBytes: result.account.fileStorageUsedBytes } : {}),
+            ...(typeof result.account?.fileStorageQuotaBytes === "number" ? { fileStorageQuotaBytes: result.account.fileStorageQuotaBytes } : {}),
+            credentialExpiresAt: result.account?.tokenExpiresAt ?? result.apiKey.expiresAt ?? null,
+        },
+    };
+}
+async function doctor(options) {
+    const credentials = credentialDiagnostics();
+    const token = process.env.NINEPM_API_KEY ?? readStoredCredential();
+    let account = null;
+    let accountError = null;
+    let versionCheck = null;
+    let versionError = null;
+    if (token) {
+        try {
+            account = publicWhoamiResult(await whoami({ apiUrl: options.apiUrl, token }));
+        }
+        catch (error) {
+            accountError = error instanceof Error ? error.message : String(error);
+        }
+    }
+    try {
+        versionCheck = await checkCliVersion({ apiUrl: options.apiUrl });
+    }
+    catch (error) {
+        versionError = error instanceof Error ? error.message : String(error);
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ apiUrl: normalizeApiUrl(options.apiUrl), credentials, account, accountError, version: versionCheck, versionError }, null, 2));
+        return;
+    }
+    console.log("9pm.ai doctor");
+    console.log(`API URL: ${normalizeApiUrl(options.apiUrl)}`);
+    console.log(`Credential backend: ${credentials.preferredBackend}${credentials.secure ? " (secure)" : ""}`);
+    console.log(`Stored credential: ${credentials.stored ? credentials.storedBackend : "none"}`);
+    console.log(`Metadata path: ${credentials.metadataPath}`);
+    if (credentials.secretPath) {
+        console.log(`Protected secret path: ${credentials.secretPath}`);
+    }
+    if (credentials.storedBackend === "file-plaintext") {
+        console.log(`Plaintext credential path: ${credentials.plaintextPath}`);
+    }
+    for (const warning of credentials.warnings) {
+        console.log(`Warning: ${warning}`);
+    }
+    if (account) {
+        console.log(`Account: ${account.user.email}`);
+        console.log(`Plan: ${account.account?.plan ?? "unknown"}`);
+    }
+    else if (accountError) {
+        console.log(`Account: unavailable (${accountError})`);
+    }
+    else {
+        console.log("Account: not logged in");
+    }
+    if (versionCheck) {
+        const status = versionCheck.comparison === "behind"
+            ? "update available"
+            : versionCheck.comparison === "ahead"
+                ? "ahead of published"
+                : "up to date";
+        console.log(`CLI: ${versionCheck.current} (latest ${versionCheck.latest.version}, ${status})`);
+        if (versionCheck.comparison === "behind") {
+            console.log("Update: npm i -g ninepm@latest");
+        }
+    }
+    else if (versionError) {
+        console.log(`CLI: ${CLI_VERSION} (latest unavailable: ${versionError})`);
+    }
+}
+export async function getSiteAccess(options) {
+    return apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access`, {
+        method: "GET",
+    });
+}
+export async function setSiteAccessPublic(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access`, {
+        method: "PUT",
+        body: JSON.stringify({ mode: "public" }),
+    });
+    return payload.access;
+}
+export async function setSiteAccessOtp(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access`, {
+        method: "PUT",
+        body: JSON.stringify({ mode: "private_otp" }),
+    });
+    return payload.access;
+}
+export async function setSiteAccessIdp(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access`, {
+        method: "PUT",
+        body: JSON.stringify({ mode: "private_idp", ...(options.providers?.length ? { providers: options.providers } : {}) }),
+    });
+    return payload.access;
+}
+export async function createAccessServiceToken(options) {
+    const body = {};
+    if (options.name) {
+        body.name = options.name;
+    }
+    if (options.duration) {
+        body.duration = options.duration;
+    }
+    return apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/service-tokens`, {
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+}
+export async function revokeAccessServiceToken(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/service-tokens/${encodeURIComponent(options.tokenId)}/revoke`, {
+        method: "POST",
+        body: "{}",
+    });
+    return payload.serviceToken;
+}
+export async function addAccessGrant(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/grants`, {
+        method: "POST",
+        body: JSON.stringify({ type: options.type, value: options.value }),
+    });
+    return payload.grant;
+}
+export async function revokeAccessGrant(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/grants/revoke`, {
+        method: "POST",
+        body: JSON.stringify({ type: options.type, value: options.value }),
+    });
+    return payload.grant;
+}
+export async function createRuntimeAccessToken(options) {
+    const body = {};
+    if (options.name) {
+        body.name = options.name;
+    }
+    if (options.expiresAt) {
+        body.expiresAt = options.expiresAt;
+    }
+    return apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/tokens`, {
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+}
+export async function revokeRuntimeAccessToken(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}/access/tokens/${encodeURIComponent(options.tokenId)}/revoke`, {
+        method: "POST",
+        body: "{}",
+    });
+    return payload.appAccessToken;
+}
+export async function fetchLatestCliVersion(options) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 5000);
+    try {
+        void apiUrl; // updater now sources the public npm registry, not the platform host
+        const response = await fetchFn("https://registry.npmjs.org/ninepm/latest", { signal: controller.signal });
+        if (!response.ok) {
+            throw new Error(`npm registry returned ${response.status} for ninepm.`);
+        }
+        const payload = (await response.json());
+        if (typeof payload.version !== "string" || !payload.version.trim()) {
+            throw new Error("npm registry response is missing a version.");
+        }
+        return { version: payload.version.trim() };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function compareCliVersions(current, latest) {
+    const parse = (value) => value
+        .split(".")
+        .map((part) => Number.parseInt(part, 10))
+        .map((part) => (Number.isFinite(part) ? part : 0));
+    const a = parse(current);
+    const b = parse(latest);
+    const length = Math.max(a.length, b.length);
+    for (let i = 0; i < length; i += 1) {
+        const diff = (a[i] ?? 0) - (b[i] ?? 0);
+        if (diff < 0)
+            return "behind";
+        if (diff > 0)
+            return "ahead";
+    }
+    return "current";
+}
+export async function checkCliVersion(options) {
+    const latest = await fetchLatestCliVersion(options);
+    return { current: CLI_VERSION, latest, comparison: compareCliVersions(CLI_VERSION, latest.version) };
+}
+export async function listSites(options) {
+    const payload = await apiRequest(options, "/v1/sites", { method: "GET" });
+    return { projects: payload.projects };
+}
+export async function deleteSite(options) {
+    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}`, {
+        method: "DELETE",
+        body: JSON.stringify({ confirmSlug: options.confirmSlug }),
+    });
+    return payload.deleted;
+}
+export async function loginDevice(options) {
+    return deviceAuthFlow({ ...options, purpose: "login" });
+}
+export async function signupDevice(options) {
+    return deviceAuthFlow({ ...options, purpose: "signup" });
+}
+async function deviceAuthFlow(options) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const startResponse = await fetchFn(`${apiUrl}/v1/oauth/device/start`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ machineName: options.machineName ?? os.hostname(), purpose: options.purpose }),
+    });
+    const start = await expectJson(startResponse, `start device ${options.purpose}`);
+    const userCode = start.user_code ?? start.code;
+    const deviceCode = start.device_code;
+    if (!userCode || !deviceCode) {
+        throw new Error(`Device ${options.purpose} response did not include a device code.`);
+    }
+    console.log(`Open ${start.verification_uri}`);
+    console.log(`Device code: ${userCode}`);
+    openBrowser(start.verification_uri);
+    const deadline = Date.now() + start.expires_in * 1000;
+    const intervalMs = Math.max(1, start.interval ?? 2) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const pollResponse = await fetchFn(`${apiUrl}/v1/oauth/device/poll`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ code: deviceCode }),
+        });
+        if (pollResponse.status === 400) {
+            continue;
+        }
+        if (pollResponse.status === 410) {
+            const body = await pollResponse.text();
+            throw new Error(`Device ${options.purpose} expired or was denied: ${body}`);
+        }
+        const poll = await expectJson(pollResponse, `poll device ${options.purpose}`);
+        const storage = storeCredential(poll.token, { allowFileFallback: options.allowFileCredentialStore });
+        const me = await whoami({ apiUrl, token: poll.token, fetchFn });
+        return { email: me.user.email, storage };
+    }
+    throw new Error(`Device ${options.purpose} expired before approval.`);
+}
+async function createProject(fetchFn, apiUrl, token, body) {
+    const response = await fetchFn(`${apiUrl}/v1/sites`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body),
+    });
+    const payload = await expectJson(response, "create site");
+    return { project: payload.project, created: payload.created ?? false };
+}
+async function apiRequest(options, route, init) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${options.token}`);
+    headers.set("x-9pm-cli-version", CLI_VERSION);
+    if (init.body && !headers.has("content-type")) {
+        headers.set("content-type", "application/json");
+    }
+    const response = await fetchFn(`${apiUrl}${route}`, {
+        ...init,
+        headers,
+    });
+    return expectJson(response, `${init.method ?? "GET"} ${route}`);
+}
+export async function listManagedFiles(options) {
+    return apiRequest(options, filesRoute(options), { method: "GET" });
+}
+export async function putManagedFile(options) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const bytes = readFileSync(options.localPath);
+    const remotePath = normalizeRemoteFilePath(options.remotePath ?? path.basename(options.localPath));
+    const response = await fetchFn(`${apiUrl}${filesRoute(options)}?path=${encodeURIComponent(remotePath)}`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${options.token}`,
+            "content-type": "application/octet-stream",
+        },
+        body: bytes,
+    });
+    return expectJson(response, "upload file");
+}
+export async function getManagedFile(options) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const response = await fetchFn(`${apiUrl}${filesRoute(options)}/${encodeURIComponent(options.fileId)}`, {
+        method: "GET",
+        headers: { authorization: `Bearer ${options.token}` },
+    });
+    await expectOk(response, "download file");
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (options.outputPath) {
+        writeFileSync(options.outputPath, bytes);
+    }
+    return { fileId: options.fileId, bytes, contentType: response.headers.get("content-type") ?? "application/octet-stream" };
+}
+export async function deleteManagedFile(options) {
+    return apiRequest(options, `${filesRoute(options)}/${encodeURIComponent(options.fileId)}`, { method: "DELETE" });
+}
+export async function shareManagedFile(options) {
+    return apiRequest(options, `${filesRoute(options)}/${encodeURIComponent(options.fileId)}/share`, {
+        method: "POST",
+        body: JSON.stringify({ mode: options.mode, expiresInSeconds: options.expiresInSeconds }),
+    });
+}
+function filesRoute(options) {
+    return options.project ? `/v1/sites/${encodeURIComponent(options.project)}/files` : "/v1/files";
+}
+function normalizeRemoteFilePath(value) {
+    const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
+    if (!normalized || normalized.startsWith("/") || normalized.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error("File path must be relative.");
+    }
+    return normalized;
+}
+async function createDatabase(fetchFn, apiUrl, token, projectId, body) {
+    const response = await fetchFn(`${apiUrl}/v1/sites/${encodeURIComponent(projectId)}/databases`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body),
+    });
+    const payload = await expectJson(response, "create database");
+    return payload.database;
+}
+async function enableEndUserAuth(fetchFn, apiUrl, token, projectId) {
+    const response = await fetchFn(`${apiUrl}/v1/sites/${encodeURIComponent(projectId)}/auth/enable`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: "{}",
+    });
+    await expectJson(response, "enable end-user auth");
+}
+async function createDeployment(fetchFn, apiUrl, token, projectId, body) {
+    const response = await fetchFn(`${apiUrl}/v1/sites/${encodeURIComponent(projectId)}/deployments`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body),
+    });
+    return expectJson(response, "create deployment");
+}
+async function finalizeDeployment(fetchFn, apiUrl, token, deploymentId) {
+    const response = await fetchFn(`${apiUrl}/v1/deployments/${encodeURIComponent(deploymentId)}/finalize`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: "{}",
+    });
+    const payload = await expectJson(response, "finalize deployment");
+    return payload.deployment;
+}
+async function getDeployment(fetchFn, apiUrl, token, deploymentId) {
+    const response = await fetchFn(`${apiUrl}/v1/deployments/${encodeURIComponent(deploymentId)}`, {
+        method: "GET",
+        headers: { authorization: `Bearer ${token}` },
+    });
+    const payload = await expectJson(response, "get deployment");
+    return payload.deployment;
+}
+async function pollDeployment(fetchFn, apiUrl, token, deploymentId, timeoutMs, initial) {
+    const deadline = Date.now() + Math.max(0, timeoutMs);
+    let current = initial;
+    while (Date.now() < deadline) {
+        if (current.status === "active" || current.status === "failed") {
+            return current;
+        }
+        await sleep(2000);
+        current = await getDeployment(fetchFn, apiUrl, token, deploymentId);
+    }
+    return current;
+}
+function deploymentFailureMessage(deployment) {
+    const error = deployment.metadata["error"];
+    return typeof error === "string" && error.trim() ? error.trim() : "Deployment failed.";
+}
+async function uploadContainerImage(fetchFn, imagePath, upload) {
+    const bytes = readFileSync(imagePath);
+    if (bytes.byteLength > upload.maxBytes) {
+        throw new Error(`Container image is ${bytes.byteLength} bytes; upload session allows ${upload.maxBytes} bytes.`);
+    }
+    const partBytes = upload.partBytes && upload.partBytes > 0 ? upload.partBytes : 0;
+    if (!partBytes || !upload.completeUrl || bytes.byteLength <= partBytes) {
+        const response = await fetchFn(upload.uploadUrl, {
+            method: upload.method,
+            headers: upload.headers,
+            body: arrayBufferFromBytes(bytes),
+        });
+        await expectOk(response, "upload container image");
+        return;
+    }
+    // Large images go up in parts so no single request exceeds the platform's
+    // request-body limits.
+    const totalParts = Math.ceil(bytes.byteLength / partBytes);
+    let uploadId = "";
+    const parts = [];
+    for (let part = 1; part <= totalParts; part += 1) {
+        const chunk = bytes.subarray((part - 1) * partBytes, Math.min(part * partBytes, bytes.byteLength));
+        const query = uploadId ? `?part=${part}&uploadId=${encodeURIComponent(uploadId)}` : `?part=${part}`;
+        const response = await fetchFn(`${upload.uploadUrl}${query}`, {
+            method: upload.method,
+            headers: upload.headers,
+            body: arrayBufferFromBytes(chunk),
+        });
+        await expectOk(response, `upload container image part ${part}/${totalParts}`);
+        const payload = (await response.json());
+        if (!payload.uploadId || !payload.etag) {
+            throw new Error(`Container image part ${part} did not return an upload receipt.`);
+        }
+        uploadId = payload.uploadId;
+        parts.push({ part, etag: payload.etag });
+    }
+    const completed = await fetchFn(upload.completeUrl, {
+        method: "POST",
+        headers: { ...upload.headers, "content-type": "application/json" },
+        body: JSON.stringify({ uploadId, parts }),
+    });
+    await expectOk(completed, "complete container image upload");
+}
+function buildContainerImage(directory) {
+    const root = path.resolve(directory);
+    if (!existsSync(path.join(root, "Dockerfile"))) {
+        throw new Error("Container deploys require a Dockerfile in the deployment directory.");
+    }
+    const docker = spawnSync("docker", ["--version"], { encoding: "utf8" });
+    if (docker.status !== 0) {
+        throw new Error("Docker is required for local container builds.");
+    }
+    const tempDir = mkdtempSync(path.join(os.tmpdir(), "9pm-container-"));
+    const tag = `9pm-local-${Date.now()}-${process.pid}`;
+    const imagePath = path.join(tempDir, "image.tar");
+    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image");
+    const inspected = spawnSync("docker", ["image", "inspect", tag, "--format", "{{.Os}}/{{.Architecture}}"], { encoding: "utf8" });
+    if (inspected.status !== 0) {
+        throw new Error(`Failed to inspect container image: ${inspected.stderr || inspected.stdout}`.trim());
+    }
+    if (inspected.stdout.trim() !== "linux/amd64") {
+        throw new Error(`Container image must be linux/amd64, got ${inspected.stdout.trim() || "unknown"}.`);
+    }
+    runDocker(["save", "-o", imagePath, tag], "export container image");
+    const size = statSync(imagePath).size;
+    const sha256 = createHash("sha256").update(readFileSync(imagePath)).digest("hex");
+    return { tag, path: imagePath, size, sha256 };
+}
+function runDocker(args, action) {
+    const result = spawnSync("docker", args, { stdio: "inherit" });
+    if (result.status !== 0) {
+        throw new Error(`Failed to ${action}.`);
+    }
+}
+function cleanupContainerImage(image) {
+    spawnSync("docker", ["image", "rm", "-f", image.tag], { stdio: "ignore" });
+    rmSync(path.dirname(image.path), { recursive: true, force: true });
+}
+function jsonHeaders(token) {
+    return {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+        "x-9pm-cli-version": CLI_VERSION,
+    };
+}
+async function expectJson(response, action) {
+    await expectOk(response, action);
+    return (await response.json());
+}
+async function expectOk(response, action) {
+    if (response.ok) {
+        return;
+    }
+    const text = await response.text();
+    throw new Error(`Failed to ${action}: ${response.status} ${text}`);
+}
+function normalizeApiUrl(value) {
+    return value.replace(/\/+$/g, "");
+}
+function pathFromUpload(upload, deploymentId) {
+    const marker = `/v1/uploads/${encodeURIComponent(deploymentId)}/`;
+    const index = upload.path.indexOf(marker);
+    const encoded = index >= 0 ? upload.path.slice(index + marker.length) : upload.path.split("/").slice(4).join("/");
+    return encoded.split("/").map(decodeURIComponent).join("/");
+}
+// Every flag the deploy branch below reads (via flags.has / read*Flag, plus
+// `token`→readApiToken and `api-url`→readApiUrl). An arg not in this set is a
+// typo, not a deploy option — reject it instead of silently deploying `.`.
+// MAINTENANCE: this is a manual contract with no compile-time guard. Any new
+// deploy flag must be added here, or `9pm deploy --<new-flag>` throws "Unknown
+// deploy flag". This file is the single source of truth; the shipped ninepm
+// tarball is generated from it by scripts/generate-cli-package.mjs.
+const VALID_DEPLOY_FLAGS = new Set([
+    "check",
+    "token",
+    "api-url",
+    "with-db",
+    "db",
+    "with-auth",
+    "auth",
+    "name",
+    "slug",
+    "description",
+    "environment",
+    "database-name",
+    "binding",
+    "runtime",
+    "entry",
+    "port",
+    "health-path",
+    "region",
+    "always-on",
+    "volume",
+    "no-volume",
+    "allow-data-wipe",
+    "allow-namespace-reset",
+    "cpus",
+    "memory",
+    "no-build",
+    "bundle",
+]);
+export function parseArgs(argv) {
+    const command = argv[0];
+    if (!command || command === "help" || command === "--help" || command === "-h") {
+        throw new UsageError();
+    }
+    if (command === "version" || command === "--version" || command === "-v") {
+        return { kind: "version" };
+    }
+    if (command === "access") {
+        return parseAccessArgs(argv.slice(1));
+    }
+    if (command === "env") {
+        return parseEnvArgs(argv.slice(1));
+    }
+    if (command === "deployments") {
+        return parseDeploymentsArgs(argv.slice(1));
+    }
+    if (command === "logs") {
+        return parseLogsArgs(argv.slice(1));
+    }
+    if (command === "files") {
+        return parseFilesArgs(argv.slice(1));
+    }
+    if (command === "login") {
+        const flags = parseFlags(argv);
+        return { kind: "login", apiUrl: readApiUrl(flags, DEFAULT_API_URL), allowFileCredentialStore: flags.has("allow-file-credential-store") };
+    }
+    if (command === "signup") {
+        const flags = parseFlags(argv);
+        return { kind: "signup", apiUrl: readApiUrl(flags, DEFAULT_API_URL), allowFileCredentialStore: flags.has("allow-file-credential-store") };
+    }
+    if (command === "logout") {
+        return { kind: "logout" };
+    }
+    if (command === "whoami") {
+        const flags = parseFlags(argv);
+        return { kind: "whoami", ...readBaseApiOptions(flags), json: flags.has("json") };
+    }
+    if (command === "doctor") {
+        const flags = parseFlags(argv);
+        return { kind: "doctor", apiUrl: readApiUrl(flags, DEFAULT_API_URL), json: flags.has("json") };
+    }
+    if (command === "delete") {
+        return parseDeleteArgs(argv.slice(1));
+    }
+    if (command === "apps" || command === "list" || command === "ls" || command === "sites" || command === "projects") {
+        const flags = parseFlags(argv);
+        return { kind: "apps", ...readBaseApiOptions(flags), json: flags.has("json") };
+    }
+    if (command === "latest" || command === "upgrade" || command === "update") {
+        const flags = parseFlags(argv);
+        return { kind: "latest", apiUrl: readApiUrl(flags, DEFAULT_API_URL), json: flags.has("json") };
+    }
+    if (command === "support") {
+        return parseSupportArgs(argv.slice(1));
+    }
+    if (command !== "deploy") {
+        throw new Error(`Unknown command: ${command}`);
+    }
+    // `deploy` has no help handling of its own, so without this a bare `--help`
+    // falls through to deploying `.` (issue #146). Mirror the other subcommands:
+    // a help token in the first position is a usage request, never a deploy.
+    // (Help tokens elsewhere, e.g. `deploy ./dir --help`, are caught as unknown
+    // flags below — non-destructive — rather than matching a `--name help` value.)
+    const firstDeployArg = argv[1];
+    if (firstDeployArg === "--help" || firstDeployArg === "-h" || firstDeployArg === "help") {
+        throw new UsageError();
+    }
+    const directory = argv[1] && !argv[1].startsWith("-") ? argv[1] : ".";
+    const flags = new Map();
+    for (let index = directory === "." ? 1 : 2; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (!arg?.startsWith("--")) {
+            continue;
+        }
+        const name = arg.slice(2);
+        const next = argv[index + 1];
+        if (!next || next.startsWith("--")) {
+            flags.set(name, true);
+            continue;
+        }
+        flags.set(name, next);
+        index += 1;
+    }
+    for (const flagName of flags.keys()) {
+        if (!VALID_DEPLOY_FLAGS.has(flagName)) {
+            throw new Error(`Unknown deploy flag: --${flagName}. Run \`9pm deploy --help\` for usage.`);
+        }
+    }
+    const check = flags.has("check");
+    const token = readApiToken(flags);
+    if (!check && !token) {
+        throw new Error("Missing API token. Set NINEPM_API_KEY or pass --token.");
+    }
+    const options = {
+        directory,
+        apiUrl: readApiUrl(flags, DEFAULT_API_URL),
+        token: token ?? "",
+        // --with-auth implies a managed database (somewhere to store per-user data).
+        withDatabase: flags.has("with-db") || flags.has("db") || flags.has("with-auth") || flags.has("auth"),
+        withAuth: flags.has("with-auth") || flags.has("auth"),
+        check,
+    };
+    const name = readStringFlag(flags, "name");
+    const slug = readStringFlag(flags, "slug");
+    const description = readStringFlag(flags, "description");
+    const environment = readStringFlag(flags, "environment");
+    const databaseName = readStringFlag(flags, "database-name");
+    const bindingName = readStringFlag(flags, "binding");
+    const runtime = readRuntimeFlag(flags);
+    const entry = readStringFlag(flags, "entry");
+    const port = readIntegerFlag(flags, "port");
+    const healthPath = readStringFlag(flags, "health-path");
+    const region = readContainerRegionFlag(flags);
+    if (name) {
+        options.name = name;
+    }
+    if (slug) {
+        options.slug = slug;
+    }
+    let normalizedDescription;
+    try {
+        normalizedDescription = normalizeDeployDescription(description);
+    }
+    catch {
+        throw new Error(`--description must be at most ${MAX_DEPLOY_DESCRIPTION_LENGTH} characters.`);
+    }
+    if (normalizedDescription !== null) {
+        options.description = normalizedDescription;
+    }
+    if (environment) {
+        options.environment = environment;
+    }
+    if (databaseName) {
+        options.databaseName = databaseName;
+    }
+    if (bindingName) {
+        options.bindingName = bindingName;
+    }
+    if (runtime) {
+        options.runtime = runtime;
+    }
+    if (entry) {
+        options.entry = entry;
+    }
+    if (port !== undefined) {
+        if (port < 1 || port > 65535) {
+            throw new Error("--port must be between 1 and 65535.");
+        }
+        options.port = port;
+    }
+    if (healthPath) {
+        options.healthPath = healthPath;
+    }
+    if (region) {
+        options.region = region;
+    }
+    if (flags.has("always-on")) {
+        options.alwaysOn = true;
+    }
+    if (flags.has("allow-data-wipe")) {
+        options.allowVolumeDestroy = true;
+    }
+    if (flags.has("allow-namespace-reset")) {
+        options.allowNamespaceReset = true;
+    }
+    const volumeGb = readIntegerFlag(flags, "volume");
+    if (volumeGb !== undefined) {
+        if (volumeGb < 1 || volumeGb > 500) {
+            throw new Error("--volume must be between 1 and 500 (GB).");
+        }
+        options.volumeGb = volumeGb;
+    }
+    // --no-volume is the explicit "this app has no persistent disk" intent. Omitting
+    // both --volume and --no-volume leaves volumeGb unset, so a redeploy keeps the
+    // app's existing disk; --no-volume sends an explicit 0 to drop it (which the
+    // server refuses without --allow-data-wipe when a disk already exists).
+    if (flags.has("no-volume")) {
+        if (volumeGb !== undefined) {
+            throw new Error("--volume and --no-volume cannot be combined.");
+        }
+        options.volumeGb = 0;
+    }
+    const cpus = readIntegerFlag(flags, "cpus");
+    if (cpus !== undefined) {
+        if (cpus < 1 || cpus > 64) {
+            throw new Error("--cpus must be between 1 and 64.");
+        }
+        options.cpus = cpus;
+    }
+    const memory = readStringFlag(flags, "memory");
+    if (memory !== undefined && memory !== "") {
+        options.memoryMb = parseMemorySize(memory);
+    }
+    if (flags.has("no-build")) {
+        options.noBuild = true;
+    }
+    const bundleDir = readStringFlag(flags, "bundle");
+    if (bundleDir !== undefined && bundleDir !== "") {
+        if (options.runtime !== undefined && options.runtime !== "worker") {
+            throw new Error("--bundle deploys a pre-built Worker bundle; it cannot combine with --runtime " + options.runtime + ".");
+        }
+        options.runtime = "worker";
+        options.bundleDir = bundleDir;
+    }
+    if (options.runtime === "container" && !options.port) {
+        throw new Error("Container deploys require --port <port>.");
+    }
+    if ((options.alwaysOn ||
+        options.volumeGb !== undefined ||
+        options.allowVolumeDestroy ||
+        options.allowNamespaceReset ||
+        options.cpus !== undefined ||
+        options.memoryMb !== undefined) &&
+        options.runtime !== "container") {
+        throw new Error("--always-on, --volume, --allow-data-wipe, --allow-namespace-reset, --cpus, and --memory require --runtime container.");
+    }
+    return { kind: "deploy", options };
+}
+function parseDeleteArgs(argv) {
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const site = argv[0];
+    if (!site || site.startsWith("--")) {
+        throw new Error("Missing site id or slug.");
+    }
+    const confirmSlug = readStringFlag(flags, "confirm");
+    if (!confirmSlug) {
+        throw new Error("Missing delete confirmation. Pass --confirm <slug> matching the app slug.");
+    }
+    return { kind: "delete", ...base, site, confirmSlug };
+}
+function parseFilesArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand) {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const project = readStringFlag(flags, "project") ?? readStringFlag(flags, "site");
+    const withProject = project ? { project } : {};
+    if (subcommand === "list") {
+        return { kind: "files", ...base, action: { kind: "list", ...withProject } };
+    }
+    if (subcommand === "put") {
+        const localPath = argv[1];
+        if (!localPath || localPath.startsWith("--")) {
+            throw new Error("Missing local file path.");
+        }
+        const remotePath = readStringFlag(flags, "path") ?? readStringFlag(flags, "as");
+        return { kind: "files", ...base, action: { kind: "put", localPath, ...(remotePath ? { remotePath } : {}), ...withProject } };
+    }
+    if (subcommand === "get") {
+        const fileId = argv[1];
+        if (!fileId || fileId.startsWith("--")) {
+            throw new Error("Missing file id.");
+        }
+        const outputPath = readStringFlag(flags, "output") ?? readStringFlag(flags, "out");
+        return { kind: "files", ...base, action: { kind: "get", fileId, ...(outputPath ? { outputPath } : {}), ...withProject } };
+    }
+    if (subcommand === "delete") {
+        const fileId = argv[1];
+        if (!fileId || fileId.startsWith("--")) {
+            throw new Error("Missing file id.");
+        }
+        return { kind: "files", ...base, action: { kind: "delete", fileId, ...withProject } };
+    }
+    if (subcommand === "share") {
+        const fileId = argv[1];
+        if (!fileId || fileId.startsWith("--")) {
+            throw new Error("Missing file id.");
+        }
+        const expires = readStringFlag(flags, "expires") ?? "24h";
+        const mode = flags.has("login-required") ? "login_required" : "public";
+        return { kind: "files", ...base, action: { kind: "share", fileId, mode, expiresInSeconds: parseDurationSeconds(expires), ...withProject } };
+    }
+    throw new Error(`Unknown files command: ${subcommand}`);
+}
+function parseEnvArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand || subcommand === "help" || subcommand === "--help") {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const site = argv[1];
+    if (!site || site.startsWith("--")) {
+        throw new Error("Missing app id or slug. Usage: 9pm env <set|ls|rm|request> <app> ...");
+    }
+    if (subcommand === "set") {
+        const entries = [];
+        const kind = flags.has("var") ? "var" : "secret";
+        const useStdin = flags.has("stdin");
+        const bareNames = [];
+        const stdinFlag = flags.get("stdin");
+        if (typeof stdinFlag === "string") {
+            // `--stdin NAME` — parseFlags consumed NAME as the flag's value.
+            bareNames.push(stdinFlag);
+        }
+        const rest = argv.slice(2);
+        for (let index = 0; index < rest.length; index += 1) {
+            const arg = rest[index] ?? "";
+            if (arg.startsWith("--")) {
+                // Skip the flag and, mirroring parseFlags, its value when present.
+                const next = rest[index + 1];
+                if (next && !next.startsWith("--") && !next.includes("=")) {
+                    index += 1;
+                }
+                continue;
+            }
+            const eq = arg.indexOf("=");
+            if (eq < 1) {
+                if (useStdin) {
+                    bareNames.push(arg);
+                    continue;
+                }
+                throw new Error(`Environment entries must be KEY=value (got "${arg}").`);
+            }
+            entries.push({ name: arg.slice(0, eq), value: arg.slice(eq + 1), kind });
+        }
+        if (flags.has("from-file")) {
+            const fromFile = readStringFlag(flags, "from-file");
+            if (!fromFile) {
+                throw new Error("--from-file needs a path to a KEY=value file.");
+            }
+            entries.push(...parseEnvFileEntries(readFileSync(fromFile, "utf8"), kind));
+        }
+        if (useStdin) {
+            if (bareNames.length !== 1 || !bareNames[0]) {
+                throw new Error("--stdin reads one value: 9pm env set <app> <NAME> --stdin");
+            }
+            // Trim only the trailing newline most shells/files append.
+            const value = readFileSync(0, "utf8").replace(/\r?\n$/, "");
+            entries.push({ name: bareNames[0], value, kind });
+        }
+        if (entries.length === 0) {
+            throw new Error("Provide at least one KEY=value entry.");
+        }
+        return { kind: "env", ...base, action: { kind: "set", site, entries } };
+    }
+    if (subcommand === "ls") {
+        return { kind: "env", ...base, action: { kind: "ls", site } };
+    }
+    if (subcommand === "rm") {
+        const name = argv[2];
+        if (!name || name.startsWith("--")) {
+            throw new Error("Usage: 9pm env rm <app> <NAME>");
+        }
+        return { kind: "env", ...base, action: { kind: "rm", site, name } };
+    }
+    if (subcommand === "request") {
+        const name = argv[2];
+        if (!name || name.startsWith("--")) {
+            throw new Error("Usage: 9pm env request <app> <NAME> [--var]");
+        }
+        const varKind = flags.has("var") ? "var" : "secret";
+        return { kind: "env", ...base, action: { kind: "request", site, name, varKind } };
+    }
+    throw new Error(`Unknown env subcommand: ${subcommand}`);
+}
+async function runEnvCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const action = command.action;
+    if (action.kind === "set") {
+        const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/env`, {
+            method: "PUT",
+            body: JSON.stringify({ entries: action.entries }),
+        });
+        console.log(`Saved ${result.saved.length} entr${result.saved.length === 1 ? "y" : "ies"} for ${action.site}: ${result.saved.join(", ")}`);
+        if (result.hint) {
+            console.log(result.hint);
+        }
+        return;
+    }
+    if (action.kind === "ls") {
+        const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/env`, { method: "GET" });
+        if (result.env.length === 0) {
+            console.log("No environment entries.");
+            return;
+        }
+        for (const entry of result.env) {
+            console.log(`${entry.name}\t${entry.kind}\t${entry.kind === "var" ? (entry.value ?? "") : "<write-only>"}\t${entry.updatedAt}`);
+        }
+        return;
+    }
+    if (action.kind === "request") {
+        const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/env/${encodeURIComponent(action.name)}/request`, { method: "POST", body: JSON.stringify({ kind: action.varKind }) });
+        console.log(`Open this link in your browser and sign in as the app owner to set ${result.name} for ${action.site}:`);
+        console.log(`  ${result.url}`);
+        console.log(`The link works once and expires in ${result.expiresInMinutes} minutes. You enter the value in the browser; it is never shown to your agent.`);
+        return;
+    }
+    const removed = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/env/${encodeURIComponent(action.name)}`, {
+        method: "DELETE",
+    });
+    console.log(`Removed ${removed.removed} from ${action.site}.`);
+}
+export function parseEnvFileEntries(content, kind) {
+    const entries = [];
+    for (const rawLine of content.split("\n")) {
+        const line = rawLine.replace(/\r$/, "");
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) {
+            continue;
+        }
+        const assignment = trimmed.startsWith("export ") ? trimmed.slice("export ".length).trimStart() : trimmed;
+        const eq = assignment.indexOf("=");
+        if (eq < 1) {
+            throw new Error(`Env file lines must be KEY=value (got "${trimmed}").`);
+        }
+        const name = assignment.slice(0, eq).trim();
+        let value = assignment.slice(eq + 1);
+        // Strip one pair of matching surrounding quotes, dotenv-style.
+        if (value.length >= 2 &&
+            ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))) {
+            value = value.slice(1, -1);
+        }
+        entries.push({ name, value, kind });
+    }
+    if (entries.length === 0) {
+        throw new Error("The env file has no KEY=value entries.");
+    }
+    return entries;
+}
+function parseDeploymentsArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand || subcommand === "help" || subcommand === "--help") {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    if (subcommand === "ls" || subcommand === "list") {
+        const site = argv[1];
+        if (!site || site.startsWith("--")) {
+            throw new Error("Usage: 9pm deployments ls <app> [--json]");
+        }
+        return { kind: "deployments", ...base, action: { kind: "ls", site, json: flags.has("json") } };
+    }
+    if (subcommand === "rm" || subcommand === "delete") {
+        const deploymentId = argv[1];
+        if (!deploymentId || deploymentId.startsWith("--")) {
+            throw new Error("Usage: 9pm deployments rm <deployment-id>");
+        }
+        return { kind: "deployments", ...base, action: { kind: "rm", deploymentId } };
+    }
+    throw new Error(`Unknown deployments subcommand: ${subcommand}`);
+}
+async function runDeploymentsCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const action = command.action;
+    if (action.kind === "ls") {
+        const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/deployments`, { method: "GET" });
+        if (action.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (result.deployments.length === 0) {
+            console.log("No deployments.");
+            return;
+        }
+        for (const deployment of result.deployments) {
+            console.log(`${deployment.active ? "*" : " "} ${deployment.id}\tv${deployment.version}\t${deployment.status}\t${deployment.createdAt}`);
+        }
+        return;
+    }
+    const result = await apiRequest(base, `/v1/deployments/${encodeURIComponent(action.deploymentId)}`, {
+        method: "DELETE",
+    });
+    console.log(`Deleted deployment ${result.deleted}.`);
+}
+async function runLogsCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(command.site)}/logs`, { method: "GET" });
+    if (command.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (!result.deployment) {
+        console.log("No container deployment found for this app. `9pm logs` reports container runtime diagnostics; static and worker apps have none.");
+        return;
+    }
+    const deployment = result.deployment;
+    console.log(`Deployment ${deployment.id}\t${deployment.status}\thealth: ${deployment.healthStatus}\t${deployment.finishedAt ?? deployment.createdAt}`);
+    if (result.reason) {
+        console.log(`Reason: ${result.reason}`);
+    }
+    if (result.logs) {
+        let lines = result.logs.split("\n");
+        if (command.lines !== undefined) {
+            lines = lines.slice(-command.lines);
+        }
+        console.log("");
+        for (const line of lines) {
+            console.log(line);
+        }
+        return;
+    }
+    console.log(deployment.status === "failed"
+        ? "No detailed logs were captured for this failure."
+        : "No logs recorded. Logs are captured when a deployment fails to come up; a runtime failure on a deployment reported active is not yet captured here.");
+}
+function parseLogsArgs(argv) {
+    const site = argv[0];
+    if (!site || site.startsWith("--")) {
+        throw new Error("Usage: 9pm logs <app> [--lines <n>] [--json]");
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const linesRaw = readStringFlag(flags, "lines");
+    let lines;
+    if (linesRaw !== undefined) {
+        lines = Number.parseInt(linesRaw, 10);
+        if (!Number.isFinite(lines) || lines <= 0) {
+            throw new Error("--lines must be a positive integer.");
+        }
+    }
+    return { kind: "logs", site, ...base, json: flags.has("json"), ...(lines !== undefined ? { lines } : {}) };
+}
+function parseAccessArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand) {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const siteFrom = (index) => {
+        const site = argv[index];
+        if (!site || site.startsWith("--")) {
+            throw new Error("Missing site id or slug.");
+        }
+        return site;
+    };
+    if (subcommand === "show") {
+        return { kind: "access", ...base, action: { kind: "show", site: siteFrom(1) } };
+    }
+    if (subcommand === "public") {
+        return { kind: "access", ...base, action: { kind: "public", site: siteFrom(1) } };
+    }
+    if (subcommand === "otp") {
+        return { kind: "access", ...base, action: { kind: "otp", site: siteFrom(1) } };
+    }
+    if (subcommand === "idp") {
+        const site = siteFrom(1);
+        const providers = readRepeatedStringFlag(argv, "provider").map(parseProviderKey);
+        return { kind: "access", ...base, action: { kind: "idp", site, ...(providers.length ? { providers } : {}) } };
+    }
+    if (subcommand === "service") {
+        const verb = argv[1];
+        const site = siteFrom(2);
+        if (verb === "create") {
+            const name = readStringFlag(flags, "name");
+            const duration = readStringFlag(flags, "duration");
+            return { kind: "access", ...base, action: { kind: "service-create", site, ...(name ? { name } : {}), ...(duration ? { duration } : {}) } };
+        }
+        if (verb === "revoke") {
+            const tokenId = argv[3];
+            if (!tokenId || tokenId.startsWith("--")) {
+                throw new Error("Missing service token id.");
+            }
+            return { kind: "access", ...base, action: { kind: "service-revoke", site, tokenId } };
+        }
+        throw new Error("Usage: 9pm access service create|revoke <site>");
+    }
+    if (subcommand === "allow" || subcommand === "revoke") {
+        const grantType = parseGrantType(argv[1]);
+        const site = siteFrom(2);
+        const value = argv[3];
+        if (!value || value.startsWith("--")) {
+            throw new Error(`Missing ${grantType} value.`);
+        }
+        return { kind: "access", ...base, action: { kind: subcommand, site, grantType, value } };
+    }
+    if (subcommand === "token") {
+        const verb = argv[1];
+        const site = siteFrom(2);
+        if (verb === "create") {
+            const name = readStringFlag(flags, "name");
+            const expiresAt = readStringFlag(flags, "expires-at");
+            return { kind: "access", ...base, action: { kind: "token-create", site, ...(name ? { name } : {}), ...(expiresAt ? { expiresAt } : {}) } };
+        }
+        if (verb === "revoke") {
+            const tokenId = argv[3];
+            if (!tokenId || tokenId.startsWith("--")) {
+                throw new Error("Missing app access token id.");
+            }
+            return { kind: "access", ...base, action: { kind: "token-revoke", site, tokenId } };
+        }
+        throw new Error("Usage: 9pm access token create|revoke <site>");
+    }
+    throw new Error(`Unknown access command: ${subcommand}`);
+}
+function parseFlags(argv) {
+    const flags = new Map();
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (!arg?.startsWith("--")) {
+            continue;
+        }
+        const name = arg.slice(2);
+        const next = argv[index + 1];
+        if (!next || next.startsWith("--")) {
+            flags.set(name, true);
+            continue;
+        }
+        flags.set(name, next);
+        index += 1;
+    }
+    return flags;
+}
+function readBaseApiOptions(flags) {
+    const token = readApiToken(flags);
+    if (!token) {
+        throw new Error("Missing API token. Set NINEPM_API_KEY or pass --token.");
+    }
+    return {
+        apiUrl: readApiUrl(flags, DEFAULT_API_URL),
+        token,
+    };
+}
+function readApiToken(flags) {
+    return readStringFlag(flags, "token") ?? process.env.NINEPM_API_KEY ?? readStoredCredential();
+}
+function parseSupportArgs(argv) {
+    // Normalize the -m short flag so parseFlags (which only handles --flags) sees it.
+    const normalized = argv.map((arg) => (arg === "-m" ? "--message" : arg));
+    const flags = parseFlags(normalized);
+    const message = readStringFlag(flags, "message");
+    if (!message) {
+        throw new Error('Missing support message. Pass -m "<what happened>".');
+    }
+    const subject = readStringFlag(flags, "subject");
+    const site = readStringFlag(flags, "site");
+    return {
+        kind: "support",
+        message,
+        ...(subject ? { subject } : {}),
+        ...(site ? { site } : {}),
+        ...readBaseApiOptions(flags),
+    };
+}
+function readApiUrl(flags, fallback) {
+    return validateApiUrl(readStringFlag(flags, "api-url") ?? process.env.NINEPM_API_URL ?? fallback);
+}
+// The stored credential is auto-attached to every request, so the endpoint must
+// be trusted transport. Require https for any non-loopback host: this preserves
+// self-hosting over TLS while refusing to send the bearer token in cleartext
+// (or to a host set by a poisoned shell profile / repo env file over http).
+function validateApiUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`Invalid API URL: ${value}`);
+    }
+    // WHATWG URL always returns IPv6 hosts bracketed, so `[::1]` is the only
+    // form that appears here (`new URL("http://[::1]/").hostname === "[::1]"`).
+    // Accept the whole 127.0.0.0/8 loopback block, not just 127.0.0.1, so a dev
+    // pointing at another loopback address isn't needlessly rejected.
+    const isLoopback = url.hostname === "localhost" ||
+        /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(url.hostname) ||
+        url.hostname === "[::1]";
+    if (url.protocol === "https:") {
+        return value;
+    }
+    if (url.protocol === "http:" && isLoopback) {
+        return value;
+    }
+    throw new Error(`API URL must use https (got ${url.protocol}//${url.hostname}). ` +
+        `Only http on a loopback host (localhost, 127.0.0.0/8, or [::1]) is allowed for local development. ` +
+        `The stored credential is sent with every request and must not travel over cleartext.`);
+}
+function parseGrantType(value) {
+    if (value === "email" || value === "domain") {
+        return value;
+    }
+    throw new Error("Grant type must be email or domain.");
+}
+function parseProviderKey(value) {
+    if (value === "google" || value === "github" || value === "entra") {
+        return value;
+    }
+    throw new Error("Provider must be google, github, or entra.");
+}
+function readStringFlag(flags, name) {
+    const value = flags.get(name);
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function readIntegerFlag(flags, name) {
+    const value = readStringFlag(flags, name);
+    if (!value) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed)) {
+        throw new Error(`--${name} must be an integer.`);
+    }
+    return parsed;
+}
+const BUNDLE_MODULE_EXTENSIONS = [".js", ".mjs", ".wasm", ".cjs", ".json", ".txt", ".html", ".bin"];
+// Shape a pre-built framework bundle (OpenNext-style: entry worker.js +
+// assets/ directory) into the deployment's bundle metadata. Errors name the
+// expectation precisely so a deploying agent can correct the layout.
+function bundleMetadataFromManifest(manifest, contentRoot) {
+    const modules = manifest
+        .map((file) => file.path)
+        .filter((filePath) => !filePath.startsWith("assets/") && BUNDLE_MODULE_EXTENSIONS.some((extension) => filePath.endsWith(extension)));
+    const entry = modules.includes("worker.js") ? "worker.js" : modules.includes("index.js") ? "index.js" : null;
+    if (!entry) {
+        throw new Error(`Bundle directory ${contentRoot} has no worker.js (or index.js) entry module. ` +
+            `Expected a Worker-runtime adapter build output (for Next.js: npx @opennextjs/cloudflare build, then deploy with --bundle .open-next).`);
+    }
+    return {
+        entry,
+        modules,
+        assetsPrefix: "assets/",
+        compatibilityFlags: ["nodejs_compat"],
+    };
+}
+function parseMemorySize(value) {
+    const match = value.trim().toLowerCase().match(/^(\d+)\s*(g|gb|m|mb)?$/);
+    if (!match) {
+        throw new Error("--memory must look like 512m, 2048, or 4g.");
+    }
+    const amount = Number(match[1]);
+    const unit = match[2] ?? "mb";
+    const memoryMb = unit.startsWith("g") ? amount * 1024 : amount;
+    if (memoryMb < 256) {
+        throw new Error("--memory must be at least 256m.");
+    }
+    return memoryMb;
+}
+function readRuntimeFlag(flags) {
+    const value = readStringFlag(flags, "runtime");
+    if (!value) {
+        return undefined;
+    }
+    if (value === "static" || value === "worker" || value === "container") {
+        return value;
+    }
+    throw new Error("--runtime must be static, worker, or container.");
+}
+function readContainerRegionFlag(flags) {
+    const value = readStringFlag(flags, "region");
+    if (!value) {
+        return undefined;
+    }
+    if (value === "auto" ||
+        value === "us-east" ||
+        value === "us-west" ||
+        value === "europe" ||
+        value === "asia" ||
+        value === "south-america" ||
+        value === "middle-east" ||
+        value === "oceania" ||
+        value === "africa") {
+        return value;
+    }
+    throw new Error("--region must be auto, us-east, us-west, europe, asia, south-america, middle-east, oceania, or africa.");
+}
+function parseDurationSeconds(value) {
+    const match = value.trim().match(/^(\d+)([smhd])?$/);
+    if (!match) {
+        throw new Error("Duration must look like 30m, 24h, or 7d.");
+    }
+    const amount = Number(match[1]);
+    const unit = match[2] ?? "s";
+    const seconds = unit === "d" ? amount * 24 * 60 * 60 : unit === "h" ? amount * 60 * 60 : unit === "m" ? amount * 60 : amount;
+    return Math.min(seconds, 7 * 24 * 60 * 60);
+}
+function normalizeServerEntry(value) {
+    const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
+    if (!normalized || normalized.startsWith("/") || normalized.split("/").includes("..")) {
+        throw new Error(`Invalid worker runtime entry path: ${value}`);
+    }
+    return normalized;
+}
+async function validateWorkerEntrySource(source, filePath) {
+    const warnings = [];
+    const errors = [];
+    if (/\bfrom\s+["'][^"']+["']/.test(source) || /\bimport\s*\(/.test(source) || /(^|\n)\s*import\s+["'][^"']+["']/.test(source)) {
+        errors.push("Worker runtime entry must be bundled into one module with no external imports.");
+    }
+    const hasLiteralDefault = /\bexport\s+default\b/.test(source);
+    const hasDefaultReexport = /export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/.test(source);
+    if (!hasLiteralDefault && !hasDefaultReexport) {
+        errors.push(`Worker runtime entry ${filePath} must export a default fetch handler.`);
+    }
+    if (errors.length === 0) {
+        const transformed = hasLiteralDefault
+            ? source
+            : `${source.replace(/export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/, "export default $1;")}`;
+        try {
+            const module = await import(`data:text/javascript;base64,${Buffer.from(transformed).toString("base64")}`);
+            if (typeof module.default?.fetch !== "function" && typeof module.default !== "function") {
+                errors.push("Default export must be a function or an object with fetch(request, env, ctx).");
+            }
+        }
+        catch {
+            errors.push("Worker module could not be loaded locally. Bundle unsupported imports and syntax before deploying.");
+        }
+    }
+    return { warnings, errors };
+}
+function credentialConfigDir() {
+    if (process.platform === "win32") {
+        return path.join(process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"), "9pm");
+    }
+    return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "9pm");
+}
+function legacyCredentialPath() {
+    return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "9pm", CREDENTIAL_METADATA_FILE);
+}
+function credentialMetadataPath() {
+    return path.join(credentialConfigDir(), CREDENTIAL_METADATA_FILE);
+}
+function windowsCredentialPath() {
+    return path.join(credentialConfigDir(), WINDOWS_CREDENTIAL_FILE);
+}
+function plaintextCredentialPath() {
+    return path.join(credentialConfigDir(), PLAINTEXT_CREDENTIAL_FILE);
+}
+function readStoredCredential() {
+    const secure = readSecureCredential();
+    if (secure) {
+        return secure;
+    }
+    const plaintext = readPlaintextCredential();
+    if (!plaintext) {
+        return undefined;
+    }
+    if (plaintext.legacy) {
+        migrateLegacyPlaintextCredential(plaintext);
+    }
+    return plaintext.token;
+}
+function storeCredential(token, options = {}) {
+    const secure = storeSecureCredential(token);
+    if (secure) {
+        return secure;
+    }
+    if (!isFileCredentialStoreAllowed(options.allowFileFallback)) {
+        throw new Error(`Secure credential storage is unavailable. Re-run with --allow-file-credential-store or set ${ALLOW_FILE_CREDENTIAL_STORE_ENV}=1 to store a plaintext fallback file.`);
+    }
+    return storePlaintextCredential(token);
+}
+function deleteStoredCredential() {
+    const removed = [
+        deleteMacKeychainCredential(),
+        deleteWindowsDpapiCredential(),
+        deleteLinuxSecretServiceCredential(),
+        removeFileIfExists(credentialMetadataPath()),
+        removeFileIfExists(windowsCredentialPath()),
+        removeFileIfExists(plaintextCredentialPath()),
+        removeFileIfExists(legacyCredentialPath()),
+    ];
+    return removed.some(Boolean);
+}
+export function credentialDiagnostics() {
+    const secure = readSecureCredential();
+    const plaintext = readPlaintextCredential();
+    const preferredBackend = preferredCredentialBackend();
+    const storedBackend = secure ? preferredBackend : plaintext ? "file-plaintext" : "none";
+    const warnings = [];
+    const fileFallbackAllowed = isFileCredentialStoreAllowed();
+    const nativeStoreDisabled = isNativeCredentialStoreDisabled();
+    if (nativeStoreDisabled) {
+        warnings.push(`${DISABLE_NATIVE_CREDENTIAL_STORE_ENV} is set; native credential storage is disabled for this process.`);
+    }
+    if (preferredBackend === "none" && !fileFallbackAllowed) {
+        warnings.push(`Secure credential storage is unavailable. Login and signup require --allow-file-credential-store or ${ALLOW_FILE_CREDENTIAL_STORE_ENV}=1.`);
+    }
+    if (fileFallbackAllowed) {
+        warnings.push("Plaintext file credential fallback is enabled for this process.");
+    }
+    if (plaintext) {
+        warnings.push(plaintext.legacy
+            ? "A legacy plaintext credential file exists and will migrate when secure storage is available."
+            : "Credential is stored in a plaintext fallback file.");
+    }
+    return {
+        platform: process.platform,
+        preferredBackend,
+        storedBackend,
+        secure: storedBackend !== "file-plaintext" && storedBackend !== "none",
+        stored: storedBackend !== "none",
+        metadataPath: credentialMetadataPath(),
+        ...(preferredBackend === "windows-dpapi" || existsSync(windowsCredentialPath()) ? { secretPath: windowsCredentialPath() } : {}),
+        plaintextPath: plaintextCredentialPath(),
+        legacyPlaintextPath: legacyCredentialPath(),
+        fileFallbackAllowed,
+        nativeStoreDisabled,
+        warnings,
+    };
+}
+function readSecureCredential() {
+    if (isNativeCredentialStoreDisabled()) {
+        return undefined;
+    }
+    if (process.platform === "darwin") {
+        return readMacKeychainCredential();
+    }
+    if (process.platform === "win32") {
+        return readWindowsDpapiCredential();
+    }
+    if (process.platform === "linux") {
+        return readLinuxSecretServiceCredential();
+    }
+    return undefined;
+}
+function storeSecureCredential(token) {
+    if (isNativeCredentialStoreDisabled()) {
+        return undefined;
+    }
+    if (process.platform === "darwin" && storeMacKeychainCredential(token)) {
+        writeCredentialMetadata("macos-keychain");
+        return "macOS Keychain";
+    }
+    if (process.platform === "win32" && storeWindowsDpapiCredential(token)) {
+        writeCredentialMetadata("windows-dpapi", { secretPath: windowsCredentialPath() });
+        return "Windows DPAPI";
+    }
+    if (process.platform === "linux" && storeLinuxSecretServiceCredential(token)) {
+        writeCredentialMetadata("linux-secret-service");
+        return "Linux Secret Service";
+    }
+    return undefined;
+}
+function preferredCredentialBackend() {
+    if (isNativeCredentialStoreDisabled()) {
+        return "none";
+    }
+    if (process.platform === "darwin") {
+        return "macos-keychain";
+    }
+    if (process.platform === "win32") {
+        return "windows-dpapi";
+    }
+    if (process.platform === "linux" && hasLinuxSecretTool()) {
+        return "linux-secret-service";
+    }
+    return "none";
+}
+function writeCredentialMetadata(backend, extra = {}) {
+    const filePath = credentialMetadataPath();
+    mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, `${JSON.stringify({
+        backend,
+        service: TOKEN_SERVICE,
+        account: TOKEN_ACCOUNT,
+        updatedAt: new Date().toISOString(),
+        ...extra,
+    }, null, 2)}\n`, { mode: 0o600 });
+    chmodIfSupported(filePath, 0o600);
+}
+function storePlaintextCredential(token) {
+    const filePath = plaintextCredentialPath();
+    mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, `${JSON.stringify({
+        token,
+        warning: "Plaintext fallback credential. Prefer OS-protected credential storage.",
+    }, null, 2)}\n`, { mode: 0o600 });
+    chmodIfSupported(filePath, 0o600);
+    writeCredentialMetadata("file-plaintext", { plaintextPath: filePath });
+    console.warn(`Warning: stored credential in plaintext fallback file ${filePath} with mode 0600 where supported.`);
+    return filePath;
+}
+function readPlaintextCredential() {
+    const candidates = [plaintextCredentialPath(), legacyCredentialPath()].filter((candidate, index, list) => list.indexOf(candidate) === index);
+    for (const filePath of candidates) {
+        try {
+            const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+            if (typeof parsed.token === "string" && parsed.token) {
+                return { token: parsed.token, path: filePath, legacy: filePath === legacyCredentialPath() };
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+function migrateLegacyPlaintextCredential(credential) {
+    const secure = storeSecureCredential(credential.token);
+    if (!secure) {
+        return;
+    }
+    removeFileIfExists(credential.path);
+    console.warn(`Migrated stored credential to ${secure}. Removed legacy plaintext credential file.`);
+}
+function isFileCredentialStoreAllowed(override = false) {
+    return override || isTruthyEnv(process.env[ALLOW_FILE_CREDENTIAL_STORE_ENV]);
+}
+function isNativeCredentialStoreDisabled() {
+    return isTruthyEnv(process.env[DISABLE_NATIVE_CREDENTIAL_STORE_ENV]);
+}
+function isTruthyEnv(value) {
+    return value === "1" || value === "true" || value === "yes";
+}
+function chmodIfSupported(filePath, mode) {
+    try {
+        chmodSync(filePath, mode);
+    }
+    catch {
+        // Windows ACLs do not map cleanly to POSIX modes.
+    }
+}
+function removeFileIfExists(filePath) {
+    if (!existsSync(filePath)) {
+        return false;
+    }
+    rmSync(filePath, { force: true });
+    return true;
+}
+function readMacKeychainCredential() {
+    if (process.platform !== "darwin") {
+        return undefined;
+    }
+    const result = spawnSync("security", ["find-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE, "-w"], { encoding: "utf8" });
+    return result.status === 0 ? result.stdout.trim() || undefined : undefined;
+}
+function storeMacKeychainCredential(token) {
+    if (process.platform !== "darwin") {
+        return false;
+    }
+    const result = spawnSync("security", ["add-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE, "-w", token, "-U"], { encoding: "utf8" });
+    return result.status === 0;
+}
+function deleteMacKeychainCredential() {
+    if (process.platform !== "darwin") {
+        return false;
+    }
+    const result = spawnSync("security", ["delete-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE], { encoding: "utf8" });
+    return result.status === 0;
+}
+function readWindowsDpapiCredential() {
+    if (process.platform !== "win32") {
+        return undefined;
+    }
+    try {
+        const encrypted = readFileSync(windowsCredentialPath(), "utf8").trim();
+        if (!encrypted) {
+            return undefined;
+        }
+        const result = runPowerShell(`
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Security
+$blob = [Console]::In.ReadToEnd().Trim()
+$bytes = [Convert]::FromBase64String($blob)
+$plain = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+[Console]::Out.Write([Text.Encoding]::UTF8.GetString($plain))
+`, encrypted);
+        return result.status === 0 ? result.stdout.trim() || undefined : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function storeWindowsDpapiCredential(token) {
+    if (process.platform !== "win32") {
+        return false;
+    }
+    const result = runPowerShell(`
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Security
+$plain = [Console]::In.ReadToEnd()
+$bytes = [Text.Encoding]::UTF8.GetBytes($plain)
+$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+[Console]::Out.Write([Convert]::ToBase64String($protected))
+`, token);
+    if (result.status !== 0 || !result.stdout.trim()) {
+        return false;
+    }
+    const filePath = windowsCredentialPath();
+    mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, `${result.stdout.trim()}\n`, { mode: 0o600 });
+    chmodIfSupported(filePath, 0o600);
+    return true;
+}
+function deleteWindowsDpapiCredential() {
+    if (process.platform !== "win32") {
+        return false;
+    }
+    return removeFileIfExists(windowsCredentialPath());
+}
+function runPowerShell(script, input) {
+    const encoded = Buffer.from(script, "utf16le").toString("base64");
+    for (const command of ["powershell.exe", "pwsh.exe", "powershell", "pwsh"]) {
+        const result = spawnSync(command, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], {
+            input,
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        if (result.error && result.error.code === "ENOENT") {
+            continue;
+        }
+        return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+    }
+    return { status: 127, stdout: "", stderr: "PowerShell was not found." };
+}
+function hasLinuxSecretTool() {
+    if (process.platform !== "linux") {
+        return false;
+    }
+    const result = spawnSync("secret-tool", ["--version"], { encoding: "utf8" });
+    return !result.error && result.status === 0;
+}
+function readLinuxSecretServiceCredential() {
+    if (process.platform !== "linux" || !hasLinuxSecretTool()) {
+        return undefined;
+    }
+    const result = spawnSync("secret-tool", ["lookup", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], { encoding: "utf8" });
+    return result.status === 0 ? result.stdout.trim() || undefined : undefined;
+}
+function storeLinuxSecretServiceCredential(token) {
+    if (process.platform !== "linux" || !hasLinuxSecretTool()) {
+        return false;
+    }
+    const result = spawnSync("secret-tool", ["store", "--label", "9pm.ai API token", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], {
+        input: token,
+        encoding: "utf8",
+    });
+    return result.status === 0;
+}
+function deleteLinuxSecretServiceCredential() {
+    if (process.platform !== "linux" || !hasLinuxSecretTool()) {
+        return false;
+    }
+    const result = spawnSync("secret-tool", ["clear", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], { encoding: "utf8" });
+    return result.status === 0;
+}
+function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    spawnSync(command, args, { stdio: "ignore" });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function readRepeatedStringFlag(argv, name) {
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        if (argv[index] !== `--${name}`) {
+            continue;
+        }
+        const next = argv[index + 1];
+        if (next && !next.startsWith("--")) {
+            values.push(next);
+            index += 1;
+        }
+    }
+    return values;
+}
+function arrayBufferFromBytes(bytes) {
+    if (bytes.buffer instanceof ArrayBuffer) {
+        return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    }
+    return new Uint8Array(bytes).buffer;
+}
+function formatBytesForCli(value) {
+    const bytes = Math.max(0, Math.floor(value));
+    if (bytes < 1024 * 1024) {
+        return `${Math.round(bytes / 1024)}KB`;
+    }
+    if (bytes < 1024 * 1024 * 1024) {
+        return `${Math.round(bytes / 1024 / 1024)}MB`;
+    }
+    return `${(bytes / 1024 / 1024 / 1024).toFixed(1)}GB`;
+}
+export class UsageError extends Error {
+}
+async function main() {
+    try {
+        const command = parseArgs(process.argv.slice(2));
+        if (command.kind === "version") {
+            console.log(CLI_VERSION);
+            return;
+        }
+        if (command.kind === "deploy") {
+            if (command.options.check) {
+                const check = await checkDeployDirectory(command.options);
+                for (const warning of check.warnings) {
+                    console.warn(`Warning: ${warning}`);
+                }
+                if (!check.ok) {
+                    for (const error of check.errors) {
+                        console.error(`Error: ${error}`);
+                    }
+                    process.exitCode = 1;
+                    return;
+                }
+                if (command.options.runtime === "container") {
+                    console.log("Deploy check passed: Dockerfile found and Docker is available.");
+                }
+                else {
+                    console.log(`Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`);
+                }
+                return;
+            }
+            let result;
+            try {
+                result = await deployDirectory(command.options);
+            }
+            catch (error) {
+                // Use the server-resolved slug (DeployError carries it once the project
+                // exists) so `9pm support --site <slug>` resolves and /v1/me/support can
+                // attach the failed deploy's id/status/error. Bare form when no slug is
+                // known yet (failure before the project was created).
+                const slug = error instanceof DeployError ? error.slug : command.options.slug;
+                const siteFlag = slug ? ` --site ${quoteSiteArg(slug)}` : "";
+                const base = error instanceof Error ? error.message : String(error);
+                throw new Error(`${base}\n\nStuck? Report it with context: 9pm support${siteFlag} -m "<what happened>"`);
+            }
+            const databaseLine = result.database ? `database ${result.database.bindingName}:${result.database.name}` : "no database";
+            const queued = result.deployment.status === "queued" || result.deployment.status === "publishing";
+            console.log(`${queued ? "Queued" : "Deployed"} ${result.project.slug} -> ${result.url}`);
+            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}, ${databaseLine}.`);
+            if (queued) {
+                console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
+            }
+            console.log(`Manage: ${PUBLIC_DASHBOARD_URL}`);
+            return;
+        }
+        if (command.kind === "login") {
+            const result = await loginDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
+            console.log(`Logged in${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            return;
+        }
+        if (command.kind === "signup") {
+            const result = await signupDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
+            console.log(`Signed up${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            return;
+        }
+        if (command.kind === "logout") {
+            const removed = deleteStoredCredential();
+            console.log(removed ? "Logged out." : "No stored credential found.");
+            return;
+        }
+        if (command.kind === "doctor") {
+            await doctor({ apiUrl: command.apiUrl, json: command.json });
+            return;
+        }
+        if (command.kind === "whoami") {
+            const me = await whoami({ apiUrl: command.apiUrl, token: command.token });
+            const publicMe = publicWhoamiResult(me);
+            if (command.json) {
+                console.log(JSON.stringify(publicMe, null, 2));
+            }
+            else {
+                console.log(`User: ${publicMe.user.email}`);
+                console.log(`Plan: ${publicMe.account?.plan ?? "unknown"}`);
+                console.log(`Sites: ${publicMe.account?.sitesUsed ?? "unknown"} / ${publicMe.account?.sitesQuota ?? "unknown"}`);
+                console.log(`Storage: ${formatBytesForCli(publicMe.account?.storageUsedBytes ?? publicMe.account?.fileStorageUsedBytes ?? 0)} / ${formatBytesForCli(publicMe.account?.storageQuotaBytes ?? publicMe.account?.fileStorageQuotaBytes ?? 0)}`);
+                console.log(`Credential: ${publicMe.account?.credentialExpiresAt ? `expires ${publicMe.account.credentialExpiresAt}` : "active"}`);
+            }
+            return;
+        }
+        if (command.kind === "delete") {
+            const deleted = await deleteSite({
+                apiUrl: command.apiUrl,
+                token: command.token,
+                site: command.site,
+                confirmSlug: command.confirmSlug,
+            });
+            console.log(`Deleted ${deleted.slug}.`);
+            console.log(`Removed ${deleted.workers} Worker(s), ${deleted.databases} database(s), ${deleted.files} file(s), ${deleted.customDomains} custom domain(s), ${deleted.containerApplications ?? 0} container app(s), ${deleted.containerImages ?? 0} container image(s), ${deleted.accessApps} access app(s), and ${deleted.serviceTokens} service token(s).`);
+            return;
+        }
+        if (command.kind === "latest") {
+            await runLatestCommand(command);
+            return;
+        }
+        if (command.kind === "apps") {
+            const result = await listSites({ apiUrl: command.apiUrl, token: command.token });
+            if (command.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.projects.length === 0) {
+                console.log("No apps. Run `9pm deploy` to create one.");
+                return;
+            }
+            for (const project of result.projects) {
+                const status = project.activeDeploymentId ? "active" : "no-deploy";
+                console.log(`${project.slug}\t${project.name}\t${status}\t${project.createdAt}\t${project.id}`);
+            }
+            return;
+        }
+        if (command.kind === "files") {
+            await runFilesCommand(command);
+            return;
+        }
+        if (command.kind === "env") {
+            await runEnvCommand(command);
+            return;
+        }
+        if (command.kind === "deployments") {
+            await runDeploymentsCommand(command);
+            return;
+        }
+        if (command.kind === "logs") {
+            await runLogsCommand(command);
+            return;
+        }
+        if (command.kind === "support") {
+            await runSupportCommand(command);
+            return;
+        }
+        await runAccessCommand(command);
+    }
+    catch (error) {
+        if (error instanceof UsageError) {
+            printUsage();
+            process.exitCode = 0;
+            return;
+        }
+        reportCliError(error);
+        process.exitCode = 1;
+    }
+}
+async function runSupportCommand(command) {
+    const subject = command.subject ?? (command.message.split("\n")[0] ?? command.message).slice(0, 200);
+    const body = {
+        subject,
+        message: command.message,
+        kind: "help",
+        ...(command.site ? { site: command.site } : {}),
+        client: { os: process.platform, node: process.version },
+    };
+    await apiRequest({ apiUrl: command.apiUrl, token: command.token }, "/v1/me/support", {
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+    console.log("Support request sent. A human will reply to your account email.");
+}
+async function runAccessCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const action = command.action;
+    if (action.kind === "show") {
+        console.log(JSON.stringify(await getSiteAccess({ ...base, site: action.site }), null, 2));
+        return;
+    }
+    if (action.kind === "public") {
+        const access = await setSiteAccessPublic({ ...base, site: action.site });
+        console.log(`Access for ${action.site} set to ${access.mode}.`);
+        return;
+    }
+    if (action.kind === "otp") {
+        const access = await setSiteAccessOtp({ ...base, site: action.site });
+        console.log(`Access for ${action.site} set to ${access.mode}.`);
+        return;
+    }
+    if (action.kind === "idp") {
+        const access = await setSiteAccessIdp({ ...base, site: action.site, ...(action.providers ? { providers: action.providers } : {}) });
+        console.log(`Access for ${action.site} set to ${access.mode}.`);
+        return;
+    }
+    if (action.kind === "allow") {
+        const grant = await addAccessGrant({ ...base, site: action.site, type: action.grantType, value: action.value });
+        console.log(`Allowed ${grant.type} ${grant.value} for ${action.site}.`);
+        return;
+    }
+    if (action.kind === "revoke") {
+        const grant = await revokeAccessGrant({ ...base, site: action.site, type: action.grantType, value: action.value });
+        console.log(`Revoked ${grant.type} ${grant.value} for ${action.site}.`);
+        return;
+    }
+    if (action.kind === "service-create") {
+        const created = await createAccessServiceToken({
+            ...base,
+            site: action.site,
+            ...(action.name ? { name: action.name } : {}),
+            ...(action.duration ? { duration: action.duration } : {}),
+        });
+        console.log(`Created service token ${created.serviceToken.id} for ${action.site}.`);
+        console.log(`CF-Access-Client-Id: ${created.serviceToken.clientId}`);
+        console.log(`CF-Access-Client-Secret: ${created.clientSecret}`);
+        return;
+    }
+    if (action.kind === "service-revoke") {
+        const token = await revokeAccessServiceToken({ ...base, site: action.site, tokenId: action.tokenId });
+        console.log(`Revoked service token ${token.id} for ${action.site}.`);
+        return;
+    }
+    if (action.kind === "token-create") {
+        const created = await createRuntimeAccessToken({
+            ...base,
+            site: action.site,
+            ...(action.name ? { name: action.name } : {}),
+            ...(action.expiresAt ? { expiresAt: action.expiresAt } : {}),
+        });
+        console.log(`Created app access token ${created.appAccessToken.id} for ${action.site}.`);
+        console.log(created.token);
+        return;
+    }
+    if (action.kind === "token-revoke") {
+        const token = await revokeRuntimeAccessToken({ ...base, site: action.site, tokenId: action.tokenId });
+        console.log(`Revoked app access token ${token.id} for ${action.site}.`);
+    }
+}
+async function runLatestCommand(command) {
+    let check;
+    try {
+        check = await checkCliVersion({ apiUrl: command.apiUrl });
+    }
+    catch (error) {
+        if (command.json) {
+            console.log(JSON.stringify({ current: CLI_VERSION, error: error instanceof Error ? error.message : String(error) }, null, 2));
+            return;
+        }
+        throw error;
+    }
+    if (command.json) {
+        console.log(JSON.stringify(check, null, 2));
+        return;
+    }
+    console.log(`Installed: ${check.current}`);
+    console.log(`Latest:    ${check.latest.version}`);
+    if (check.comparison === "behind") {
+        console.log("");
+        console.log("A newer 9pm CLI is available. Update with:");
+        console.log("  npm i -g ninepm@latest   (or run ad-hoc via: npx ninepm <args>)");
+    }
+    else if (check.comparison === "ahead") {
+        console.log("Installed version is ahead of the published latest.");
+    }
+    else {
+        console.log("Up to date.");
+    }
+}
+async function runFilesCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const project = "project" in command.action && command.action.project ? { project: command.action.project } : {};
+    if (command.action.kind === "list") {
+        const listed = await listManagedFiles({ ...base, ...project });
+        for (const file of listed.files) {
+            console.log(`${file.id}\t${file.path}\t${formatBytesForCli(file.size)}\t${file.scope}`);
+        }
+        console.log(`Usage: ${formatBytesForCli(listed.usage.usedBytes)} / ${formatBytesForCli(listed.usage.quotaBytes)}`);
+        return;
+    }
+    if (command.action.kind === "put") {
+        const result = await putManagedFile({ ...base, ...project, localPath: command.action.localPath, ...(command.action.remotePath ? { remotePath: command.action.remotePath } : {}) });
+        console.log(`Stored ${result.file.path} (${formatBytesForCli(result.file.size)}).`);
+        console.log(`File ID: ${result.file.id}`);
+        console.log(`Usage: ${formatBytesForCli(result.usage.usedBytes)} / ${formatBytesForCli(result.usage.quotaBytes)}`);
+        return;
+    }
+    if (command.action.kind === "get") {
+        const result = await getManagedFile({ ...base, ...project, fileId: command.action.fileId, ...(command.action.outputPath ? { outputPath: command.action.outputPath } : {}) });
+        if (command.action.outputPath) {
+            console.log(`Saved ${result.fileId} to ${command.action.outputPath}.`);
+        }
+        else {
+            process.stdout.write(result.bytes);
+        }
+        return;
+    }
+    if (command.action.kind === "delete") {
+        const result = await deleteManagedFile({ ...base, ...project, fileId: command.action.fileId });
+        console.log(`Deleted ${result.file.path}.`);
+        console.log(`Usage: ${formatBytesForCli(result.usage.usedBytes)} / ${formatBytesForCli(result.usage.quotaBytes)}`);
+        return;
+    }
+    if (command.action.kind === "share") {
+        const result = await shareManagedFile({
+            ...base,
+            ...project,
+            fileId: command.action.fileId,
+            mode: command.action.mode,
+            expiresInSeconds: command.action.expiresInSeconds,
+        });
+        console.log(result.url);
+        console.log(`Share mode: ${result.share.mode === "login_required" ? "owner-only" : "public"}, expires ${result.share.expiresAt}.`);
+    }
+}
+function printUsage() {
+    console.log(`Usage:
+  9pm --version
+  9pm deploy [directory] --name <site-name> [--slug <slug>] [--description "<note>"] [--with-db] [--with-auth]
+  9pm deploy [directory] --runtime worker --entry src/index.js [--with-db]
+  9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb> | --no-volume] [--cpus <n>] [--memory <size>]
+  9pm deploy [directory]                   framework projects (Next.js, Vite) are detected and built automatically; --no-build skips
+  9pm deploy [directory] --bundle <dir>    deploy a pre-built Cloudflare framework bundle (e.g. .open-next)
+  9pm deploy [directory] --description "<note>"   optional short note shown next to the version in the dashboard
+  9pm deploy [directory] --check
+  9pm signup
+  9pm login
+  9pm logout
+  9pm doctor [--json]
+  9pm whoami [--json]
+  9pm apps [--json]
+  9pm latest [--json]
+  9pm support -m "<what happened>" [--subject <subject>] [--site <app>]
+  9pm files list [--project <site>]
+  9pm files put <local-path> [--path <remote-path>] [--project <site>]
+  9pm files get <file-id> [--output <path>] [--project <site>]
+  9pm files share <file-id> [--expires 24h] [--login-required] [--project <site>]
+  9pm files delete <file-id> [--project <site>]
+  9pm deployments ls <app> [--json]
+  9pm deployments rm <deployment-id>
+  9pm logs <app> [--lines <n>] [--json]
+  9pm delete <site> --confirm <slug>
+  9pm access show <site>
+  9pm access public <site>
+  9pm access otp <site>
+  9pm access idp <site> [--provider google|github|entra]
+  9pm access allow email <site> <email>
+  9pm access allow domain <site> <domain>
+  9pm access revoke email <site> <email>
+  9pm access revoke domain <site> <domain>
+  9pm access service create <site> [--name <name>] [--duration 8760h]
+  9pm access service revoke <site> <service-token-id>
+  9pm access token create <site> [--name <name>]
+  9pm access token revoke <site> <token-id>
+
+Environment:
+  NINEPM_API_URL   ${API_URL_HELP}
+  NINEPM_API_KEY   ${API_KEY_HELP}
+  ${ALLOW_FILE_CREDENTIAL_STORE_ENV}
+                     Allow plaintext credential file fallback when native storage is unavailable
+
+Container deploys:
+  Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.
+  The app must listen on 0.0.0.0:$PORT or the selected --port. Use --health-path for a cheap readiness endpoint.
+  With --with-db, containers receive NINEPM_SQL_URL and NINEPM_DB_BINDINGS for the managed SQL bridge.
+  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way (enable-only).
+  9pm env set <app> KEY=value [KEY2=value2 ...] [--var]   (secret by default; --var = readable config)
+  9pm env set <app> --from-file <path> [--var]            (KEY=value lines; # comments, export prefix, quotes ok)
+  9pm env set <app> <NAME> --stdin [--var]                (value read verbatim from stdin)
+  9pm env request <app> <NAME> [--var]                    (prints a one-time browser link to enter the value; never shown to the agent)
+  9pm env ls <app>
+  9pm env rm <app> <NAME>
+  Environment changes apply on the next deploy.
+
+  With --always-on, the container never sleeps between requests. With --volume <gb>, a persistent
+  disk is mounted and its path is provided via NINEPM_DATA_DIR. Declare what the app needs with
+  --cpus <n> and --memory <size> (512m, 2048, 4g); the platform picks a placement that fits.
+  All of these may require platform enablement.
+  A redeploy KEEPS the app's existing disk automatically: omit --volume and the current disk is
+  carried forward. To remove the disk on purpose pass --no-volume (and --allow-data-wipe, since it
+  destroys the data). If a disk was previously detached by an old CLI, redeploy with --volume <same
+  gb> --region <same region> to reattach the existing disk (it is reused, not recreated empty).
+  --allow-data-wipe acknowledges that dropping a disk, or switching to a placement that can't keep
+  it, destroys the app's existing persistent state; without it such a deploy is refused.
+  --allow-namespace-reset acknowledges that a redeploy may start the app from a fresh, empty
+  persistent store when its recorded one can no longer be found; without it such a deploy is refused.
+  Regions are provider-neutral: auto, us-east, us-west, europe, asia, south-america, middle-east, oceania, africa.
+`);
+}
+if (isDirectRun()) {
+    void main();
+}
+function isDirectRun() {
+    if (!process.argv[1]) {
+        return false;
+    }
+    try {
+        return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+    }
+    catch {
+        return false;
+    }
+}