tileflow 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/index.js

@@ -3,13 +3,13 @@
 // src/index.ts
 import { serve } from "@hono/node-server";
 import { Command } from "commander";
-import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes3 } from "crypto";
 import { existsSync, readFileSync, realpathSync } from "fs";
 import { readFile as readFile7, writeFile as writeFile2 } from "fs/promises";
 import { hostname } from "os";
-import { dirname as dirname12, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve11, sep as sep5 } from "path";
-import { createInterface } from "readline/promises";
-import pc6 from "picocolors";
+import { dirname as dirname13, isAbsolute as isAbsolute5, relative as relative6, resolve as resolve12, sep as sep5 } from "path";
+import { createInterface as createInterface2 } from "readline/promises";
+import pc9 from "picocolors";
 import { createLocalCoordinates, setupCoordinates } from "@tileflow/coordinates-runtime";
 import {
   auditTileflowMapThemeValues as auditTileflowMapThemeValues2,
@@ -33,12 +33,12 @@ import {
   writeTileflowBuildArtifacts
 } from "@tileflow/dev/artifacts";
 import {
-  assertValidTileflowConfig as assertValidTileflowConfig3,
+  assertValidTileflowConfig as assertValidTileflowConfig4,
   defaultTileflowApiUrl,
-  defaultTileflowConfigPath,
+  defaultTileflowConfigPath as defaultTileflowConfigPath2,
   defaultTileflowManifestPath,
   getTileflowMapNames as getTileflowMapNames5,
-  loadTileflowConfigWithInputs as loadTileflowConfigWithInputs4,
+  loadTileflowConfigWithInputs as loadTileflowConfigWithInputs5,
   TileflowValidationError as TileflowValidationError4
 } from "@tileflow/dev/config";
 import {
@@ -3572,7 +3572,7 @@ async function readCoordinatesInput(input, signal) {
 async function readStandardInput(signal) {
   const chunks = [];
   let length = 0;
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const finish = (result) => {
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
@@ -3594,7 +3594,7 @@ async function readStandardInput(signal) {
       }
       chunks.push(bytes);
     };
-    const onEnd = () => finish(() => resolve12(decodeInput(Buffer.concat(chunks))));
+    const onEnd = () => finish(() => resolve13(decodeInput(Buffer.concat(chunks))));
     const onError = () => finish(() => reject(new CoordinatesInputError("INVALID_VALUE")));
     if (signal.aborted) {
       onAbort();
@@ -4128,14 +4128,11 @@ function printFeatureInspectError(error) {
 }
 
 // src/hosted-client.ts
-import {
-  serializeTileflowFontBundleManifest,
-  serializeTileflowModelBundleManifest
-} from "@tileflow/core";
+import { serializeTileflowFontBundleManifest } from "@tileflow/core";
 
 // src/hosted-response.ts
 import { z as z2 } from "zod";
-import { tileflowIconPackageLimits, tileflowModelBundleLimits } from "@tileflow/core";
+import { tileflowIconPackageLimits } from "@tileflow/core";
 var maximumHostedResponseBytes = 1024 * 1024;
 var safeTextSchema = z2.string().min(1).max(300).refine((value) => !/[\p{Cc}]/u.test(value));
 var safeIdentifierSchema = z2.string().min(1).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u);
@@ -4155,7 +4152,18 @@ var hostedStyleDeploymentResponseSchema = z2.object({
       styleUrl: publicHttpUrlSchema
     }).strict()
   ).refine((themes) => Object.keys(themes).length > 0),
-  version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+  version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+  /**
+   * The Team 3D models the map places, each at its published current version, and whether that
+   * version was prepared from the same glTF binaries as the map's own files.
+   */
+  teamModels: z2.array(
+    z2.object({
+      model: z2.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u).max(64),
+      version: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+      sources: z2.enum(["match", "differ", "unknown"])
+    }).strict()
+  ).max(256).optional()
 }).strict();
 var hostedIconPackageResponseSchema = z2.object({
   changed: z2.boolean().optional(),
@@ -4173,14 +4181,6 @@ var hostedFontBundleResponseSchema = z2.object({
   id: z2.string().regex(/^fnb_[A-Za-z0-9_-]{16,64}$/u),
   totalBytes: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER)
 });
-var hostedModelBundleResponseSchema = z2.object({
-  baseUrl: publicHttpUrlSchema,
-  changed: z2.boolean().optional(),
-  contentHash: z2.string().regex(/^[a-f0-9]{64}$/u),
-  id: z2.string().regex(/^mdb_[A-Za-z0-9_-]{16,64}$/u),
-  modelCount: z2.number().int().positive().max(tileflowModelBundleLimits.maxModelCount),
-  totalBytes: z2.number().int().positive().max(tileflowModelBundleLimits.maxPackageBytes)
-});
 var hostedStatusStyleSchema = z2.object({
   environment: safeTextSchema,
   key: safeStorageKeySchema,
@@ -4274,7 +4274,7 @@ async function startDeviceAuthorization(appUrl, body, options = {}) {
 async function pollDeviceToken(appUrl, authorization, input, options = {}) {
   const expiresAt = Date.now() + authorization.expiresIn * 1e3;
   const intervalMs = Math.max(authorization.interval, 1) * 1e3;
-  const wait = input.sleep ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+  const wait = input.sleep ?? ((milliseconds) => new Promise((resolve13) => setTimeout(resolve13, milliseconds)));
   while (Date.now() < expiresAt) {
     await wait(intervalMs);
     const response = await requestHostedJson(
@@ -4447,6 +4447,88 @@ async function listAccountTeams(session, options = {}) {
   }
   return { ok: true, teams };
 }
+async function listMapSetupTeams(session, options = {}) {
+  let response;
+  try {
+    response = await requestHostedJson(
+      session.apiOrigin,
+      "/v1/cli/map-setup/teams",
+      { headers: authorizationHeaders(session.accountSession) },
+      options
+    );
+  } catch (error) {
+    return { error: safeTransportError(error, "Team discovery failed."), ok: false };
+  }
+  if (!response.ok) {
+    return {
+      error: response.status === 401 ? rejectedAccountSessionMessage : `Team discovery failed (${response.status}).`,
+      ok: false
+    };
+  }
+  const body = asRecord(response.body);
+  if (!response.json || body.schemaVersion !== 1 || !Array.isArray(body.teams) || !body.teams.every(isMapSetupTeam)) {
+    return { error: "Team discovery returned an invalid response.", ok: false };
+  }
+  return { ok: true, teams: body.teams };
+}
+async function createManagedMapSetup(session, input, options = {}) {
+  let response;
+  try {
+    response = await requestHostedJson(
+      session.apiOrigin,
+      "/v1/cli/maps",
+      {
+        ...jsonRequest("POST", input),
+        headers: {
+          ...authorizationHeaders(session.accountSession),
+          "Content-Type": "application/json"
+        }
+      },
+      options
+    );
+  } catch (error) {
+    return {
+      code: "setup_failed",
+      error: safeTransportError(error, "Map setup request failed."),
+      ok: false
+    };
+  }
+  const body = asRecord(response.body);
+  if (!response.ok) {
+    if (response.status === 401) {
+      return { code: "account_session_rejected", error: rejectedAccountSessionMessage, ok: false };
+    }
+    const code = mapSetupFailureMessages[body.code] ? body.code : null;
+    return code ? { code, error: mapSetupFailureMessages[code], ok: false } : { code: "setup_failed", error: `Map setup failed (${response.status}).`, ok: false };
+  }
+  const map = asRecord(body.map);
+  const team = asRecord(body.team);
+  const delivery = asRecord(body.delivery);
+  if (!response.json || body.schemaVersion !== 1 || typeof map.id !== "string" || !/^map_[A-Za-z0-9_-]{16}$/u.test(map.id) || map.name !== null && typeof map.name !== "string" || map.state !== "setup_pending" && map.state !== "active" || typeof team.name !== "string" || `@${String(team.slug)}` !== input.team || !Array.isArray(delivery.allowedOrigins) || !delivery.allowedOrigins.every((origin) => typeof origin === "string") || delivery.allowedOrigins.length !== input.allowedOrigins.length) {
+    return { code: "setup_failed", error: "Map setup returned an invalid response.", ok: false };
+  }
+  return {
+    ok: true,
+    value: {
+      allowedOrigins: delivery.allowedOrigins,
+      map: { id: map.id, name: map.name, state: map.state },
+      team: { name: team.name, slug: team.slug }
+    }
+  };
+}
+var mapSetupFailureMessages = {
+  invalid_request: "Tileflow rejected the Map setup request.",
+  map_limit: "This Team has reached its Map limit. Archive or delete a Map, or change the plan, in the Tileflow dashboard.",
+  permission_required: "Only a Team Admin can create Maps.",
+  setup_conflict: "This setup key was already used with another Team or browser access choice. Omit --setup-key to start a new setup.",
+  team_not_found: "No Team you administer matches this Team."
+};
+function isMapSetupTeam(value) {
+  const team = asRecord(value);
+  return typeof team.eligible === "boolean" && typeof team.name === "string" && typeof team.slug === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(team.slug) && (team.unavailableReason === void 0 || team.unavailableReason === "map_limit") && Object.keys(team).every(
+    (key) => ["eligible", "name", "slug", "unavailableReason"].includes(key)
+  );
+}
 async function publishHostedStyle(api, body, responseLabel, options = {}) {
   const response = await requestHostedJson(
     api.apiUrl,
@@ -4533,42 +4615,6 @@ async function uploadHostedFontBundle(api, bundle, options = {}) {
   }
   return { ok: true, value };
 }
-async function uploadHostedModelBundle(api, bundle, options = {}) {
-  const formData = new FormData();
-  formData.append(
-    "manifest",
-    new Blob([serializeTileflowModelBundleManifest(bundle.manifest)], {
-      type: "application/json"
-    }),
-    "manifest.json"
-  );
-  for (const file of bundle.files) {
-    const bytes = new Uint8Array(file.source.byteLength);
-    bytes.set(file.source);
-    formData.append(
-      `file:${encodeURIComponent(file.fileName)}`,
-      new Blob([bytes.buffer], { type: file.contentType }),
-      file.fileName
-    );
-  }
-  const response = await requestHostedJson(
-    api.apiUrl,
-    `/v1/model-bundles/${encodeURIComponent(bundle.contentHash)}`,
-    { body: formData, headers: authorizationHeaders(api.apiKey, api.mapId), method: "PUT" },
-    options
-  );
-  if (!response.ok) return { ok: false, status: response.status };
-  const value = parseResponse(
-    response,
-    hostedModelBundleResponseSchema,
-    "Model bundle upload response"
-  );
-  const publicBaseUrl = new URL(value.baseUrl);
-  if (value.contentHash !== bundle.contentHash || value.modelCount !== bundle.manifest.models.length || value.totalBytes !== bundle.manifest.models.reduce((total, model) => total + model.byteLength, 0) || publicBaseUrl.pathname !== `/model-bundles/${value.id}` || publicBaseUrl.search !== "") {
-    throw new Error("Model bundle upload response did not confirm the submitted bundle.");
-  }
-  return { ok: true, value };
-}
 async function fetchHostedMapStatus(api, options = {}) {
   const response = await requestHostedJson(
     api.apiUrl,
@@ -4610,7 +4656,7 @@ async function withHostedResponse(apiUrl, path, init, options, consume) {
 }
 function raceWithAbort(operation, signal) {
   if (signal.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const cleanup = () => signal.removeEventListener("abort", onAbort);
     const onAbort = () => {
       cleanup();
@@ -4620,7 +4666,7 @@ function raceWithAbort(operation, signal) {
     operation.then(
       (value) => {
         cleanup();
-        resolve12(value);
+        resolve13(value);
       },
       (error) => {
         cleanup();
@@ -4830,12 +4876,12 @@ function cloneStyle(style) {
 }
 
 // src/model-assets.ts
+import { tileflowTeamModelUrl } from "@tileflow/core";
 import {
-  createTileflowModelBundle,
   prepareTileflowMapTreeModels
 } from "@tileflow/dev/icons";
 async function prepareModelAssets(project, options) {
-  const prepared = { assets: {}, bundles: {}, identities: {} };
+  const prepared = { assets: {}, buildings: {}, identities: {} };
   for (const [name, map] of Object.entries(project.maps)) {
     if (!map.models?.length) continue;
     const models = await prepareTileflowMapTreeModels(map.models, {
@@ -4844,25 +4890,36 @@ async function prepareModelAssets(project, options) {
       configPath: `maps.${name}.models`
     });
     prepared.assets[name] = { models: models.models };
-    const bundle = await createTileflowModelBundle(models.buildings);
-    if (bundle) prepared.bundles[name] = bundle;
+    if (Object.keys(models.buildings).length > 0) prepared.buildings[name] = models.buildings;
     if (models.identities.length > 0) prepared.identities[name] = models.identities;
   }
   return prepared;
 }
-function mapAssetsWithBuildingModels(prepared, baseOf) {
+function mapAssetsWithBuildingModels(prepared, target) {
   const assets = { ...prepared.assets };
-  for (const [mapName, bundle] of Object.entries(prepared.bundles)) {
-    const base = baseOf(mapName, bundle).replace(/\/+$/u, "");
+  for (const [mapName, buildings] of Object.entries(prepared.buildings)) {
+    const base = target.hosted ? "" : target.localBase(mapName).replace(/\/+$/u, "");
     assets[mapName] = {
       ...assets[mapName],
       buildingModels: Object.fromEntries(
-        bundle.manifest.models.map((model) => [model.id, `${base}/${model.file}`])
+        Object.entries(buildings).map(([id, model]) => [
+          id,
+          target.hosted ? tileflowTeamModelUrl(id) : `${base}/${model.fileName}`
+        ])
       )
     };
   }
   return assets;
 }
+function hostedModelSourceIdentities(prepared, mapName) {
+  const buildings = prepared.buildings[mapName] ?? {};
+  const identities = (prepared.identities[mapName] ?? []).filter(({ id }) => !(id in buildings));
+  return identities.length > 0 ? identities : void 0;
+}
+function teamModelSources(prepared, mapName) {
+  const buildings = Object.entries(prepared.buildings[mapName] ?? {});
+  return buildings.length > 0 ? Object.fromEntries(buildings.map(([id, model]) => [id, model.sources])) : void 0;
+}
 
 // src/hosted-native-deploy.ts
 function failure(message) {
@@ -4902,7 +4959,7 @@ async function prepareNativeHostedDeploy(options) {
   const iconPackage = binding ? compiledIcons.packages.find((entry) => entry.contentHash === binding.packageHash) : void 0;
   const sprite = binding ? `${apiOrigin}/sprites/preflight/${binding.packageHash}/sprite` : void 0;
   const modelAssets = await prepareModelAssets(project, { baseDirectory, target: "hosted" });
-  if (modelAssets.bundles[mapName])
+  if (modelAssets.buildings[mapName])
     throw failure(
       "A deployment with --with-native does not take a map's own 3D building models yet. Deploy without --with-native, or remove them from the map's models directories."
     );
@@ -6942,6 +6999,710 @@ async function readCurrentPins(contents) {
   return (await parseTileflowIconsLockfile(contents)).sets;
 }
 
+// src/map-commands.ts
+import pc5 from "picocolors";
+
+// src/map-setup.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { createInterface } from "readline/promises";
+import pc4 from "picocolors";
+var maximumOrigins2 = 20;
+var exactHost = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/u;
+var teamReference = /^@([A-Za-z0-9][A-Za-z0-9._-]{0,127})$/u;
+var setupKeyPattern = /^[\x21-\x7e]{8,128}$/u;
+function resolveMapSetupTeam(teams, requestedSlug) {
+  if (requestedSlug !== void 0) {
+    const team = teams.find(({ slug }) => slug === requestedSlug);
+    if (!team) return { kind: "not_found" };
+    return team.eligible ? { kind: "selected", team } : { kind: "map_limit" };
+  }
+  const eligible = teams.filter((team) => team.eligible);
+  if (eligible.length === 1) return { kind: "selected", team: eligible[0] };
+  if (eligible.length > 1) return { kind: "choose", teams: eligible };
+  return teams.some((team) => team.unavailableReason === "map_limit") ? { kind: "map_limit" } : { kind: "none" };
+}
+function normalizeBrowserOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash || !exactHost.test(url.hostname) || value.toLowerCase() !== url.origin.toLowerCase()) {
+    return null;
+  }
+  return url.origin.toLowerCase();
+}
+function parseBrowserAccess(options) {
+  const values = options.origin ?? [];
+  if (options.anyWebsite && values.length > 0) {
+    return { error: "Choose either --any-website or --origin, not both.", ok: false };
+  }
+  if (options.anyWebsite) return { ok: true, value: { kind: "any" } };
+  if (values.length === 0) return { ok: true, value: null };
+  return parseOriginList(values);
+}
+function parseOriginList(values) {
+  const origins = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const origin = normalizeBrowserOrigin(value.trim());
+    if (!origin) {
+      return {
+        error: `${JSON.stringify(value)} is not an exact website origin such as https://example.com (no path or wildcard).`,
+        ok: false
+      };
+    }
+    origins.add(origin);
+  }
+  if (origins.size === 0 || origins.size > maximumOrigins2) {
+    return { error: `Enter between 1 and ${maximumOrigins2} website origins.`, ok: false };
+  }
+  return { ok: true, value: { kind: "selected", origins: [...origins].sort() } };
+}
+function checkMapSetupOptions(options) {
+  if (options.team !== void 0 && !teamReference.test(options.team)) {
+    return { code: "invalid_team", error: "Team must use @team syntax.", ok: false };
+  }
+  if (options.setupKey !== void 0 && !setupKeyPattern.test(options.setupKey)) {
+    return {
+      code: "invalid_setup_key",
+      error: "Setup key must be 8 to 128 visible ASCII characters without spaces.",
+      ok: false
+    };
+  }
+  if (options.name !== void 0 && (options.name.length < 1 || options.name.length > 200 || options.name !== options.name.trim() || /\p{Cc}/u.test(options.name))) {
+    return { code: "invalid_name", error: "Map name must be 1 to 200 characters.", ok: false };
+  }
+  const access = parseBrowserAccess(options);
+  return access.ok ? { access: access.value, ok: true } : { code: "invalid_browser_access", error: access.error, ok: false };
+}
+async function setUpManagedMap(session, options, dependencies) {
+  const checked = checkMapSetupOptions(options);
+  if (!checked.ok) return checked;
+  const discovered = await listMapSetupTeams(session, dependencies.request);
+  if (!discovered.ok) {
+    return { code: "team_discovery_failed", error: discovered.error, ok: false };
+  }
+  const resolution = resolveMapSetupTeam(
+    discovered.teams,
+    options.team ? teamReference.exec(options.team)[1] : void 0
+  );
+  let team = null;
+  if (resolution.kind === "selected") team = resolution.team;
+  else if (resolution.kind === "choose") {
+    team = dependencies.prompts ? await dependencies.prompts.chooseTeam(resolution.teams) : null;
+    if (!team) {
+      const choices = resolution.teams.map(({ slug }) => `@${slug}`);
+      return {
+        code: "team_ambiguous",
+        error: `Several Teams can own this Map. Choose one with --team: ${choices.join(", ")}.`,
+        ok: false,
+        options: choices
+      };
+    }
+  } else if (resolution.kind === "map_limit") {
+    return {
+      code: "map_limit",
+      error: options.team ? `${options.team} has reached its Map limit. Archive or delete a Map, or change the plan, in the Tileflow dashboard.` : "Every Team you administer has reached its Map limit. Archive or delete a Map, or change the plan, in the Tileflow dashboard.",
+      ok: false
+    };
+  } else if (resolution.kind === "not_found") {
+    return { code: "team_not_found", error: `You do not administer ${options.team}.`, ok: false };
+  } else {
+    return {
+      code: "no_eligible_team",
+      error: "This account does not administer a Team. Ask a Team Admin to create the Map.",
+      ok: false
+    };
+  }
+  const access = checked.access ?? (dependencies.prompts ? await dependencies.prompts.chooseAccess() : null);
+  if (!access) {
+    return {
+      code: "browser_access_required",
+      error: "Choose which websites may load this Map: --origin <origin> (repeatable) for exact sites, or --any-website.",
+      ok: false
+    };
+  }
+  const setupKey = options.setupKey ?? `cli-${randomBytes2(16).toString("hex")}`;
+  const created = await createManagedMapSetup(
+    session,
+    {
+      allowedOrigins: access.kind === "any" ? [] : access.origins,
+      idempotencyKey: setupKey,
+      ...options.name ? { name: options.name } : {},
+      team: `@${team.slug}`
+    },
+    dependencies.request
+  );
+  return created.ok ? { ok: true, setupKey, value: created.value } : created;
+}
+function describeBrowserAccess(allowedOrigins) {
+  return allowedOrigins.length === 0 ? "Any website" : allowedOrigins.join(", ");
+}
+function createTerminalPrompts(json2 = false) {
+  if (json2 || !process.stdin.isTTY || !process.stdout.isTTY) return null;
+  return {
+    async chooseTeam(teams) {
+      console.log(`${pc4.cyan("?")} Which Team should own the new Map?`);
+      teams.forEach(
+        (team, index) => console.log(`  ${index + 1}) ${team.name} ${pc4.gray(`@${team.slug}`)}`)
+      );
+      const answer = await ask("Team number", (value) => {
+        const index = Number(value);
+        return Number.isInteger(index) && index >= 1 && index <= teams.length ? teams[index - 1] : null;
+      });
+      return answer;
+    },
+    async chooseAccess() {
+      console.log(`${pc4.cyan("?")} Which websites may load this Map in a browser?`);
+      console.log("  1) Only selected websites (recommended)");
+      console.log("  2) Any website");
+      const mode = await ask(
+        "Choice",
+        (value) => value === "1" ? "selected" : value === "2" ? "any" : null
+      );
+      if (mode === null) return null;
+      if (mode === "any") return { kind: "any" };
+      return ask("Website origins, separated by spaces (https://example.com)", (value) => {
+        const parsed = parseOriginList(value.split(/[\s,]+/u).filter(Boolean));
+        if (!parsed.ok) console.log(`  ${pc4.yellow(parsed.error)}`);
+        return parsed.ok ? parsed.value : null;
+      });
+    }
+  };
+}
+async function ask(question, parse3) {
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      const value = parse3((await readline.question(`  ${question}: `)).trim());
+      if (value !== null) return value;
+    }
+    return null;
+  } finally {
+    readline.close();
+  }
+}
+
+// src/map-commands.ts
+function registerMapCommands(program2, dependencies) {
+  const maps = program2.command("maps").description("Manage Tileflow managed Maps");
+  addMapSetupOptions(
+    maps.command("create").description("Create a managed Map for this account, ready for tileflow deploy --map-id").option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--name <name>", "Map name shown in the dashboard").option("--json", "print deterministic schema-version-1 JSON")
+  ).action(async (options) => {
+    const session = await loadSession(options, dependencies);
+    if (!session) return;
+    const result = await setUpManagedMap(session, options, {
+      prompts: createTerminalPrompts(options.json)
+    });
+    if (!result.ok) {
+      emitFailure(
+        options.json,
+        result.code,
+        result.error,
+        result.options ? { options: result.options } : {}
+      );
+      return;
+    }
+    const next = `tileflow deploy --map-id ${result.value.map.id}`;
+    if (options.json) {
+      emitJson({
+        command: "maps create",
+        delivery: { allowedOrigins: result.value.allowedOrigins },
+        map: result.value.map,
+        next,
+        ok: true,
+        schemaVersion: 1,
+        setupKey: result.setupKey,
+        team: result.value.team
+      });
+      return;
+    }
+    printCreatedMap(result.value);
+    console.log(`
+${pc5.bold("Next step")}`);
+    console.log(`  ${pc5.cyan("\u2022")} Publish the repository map with ${pc5.cyan(next)}.`);
+  });
+}
+function addMapSetupOptions(command2) {
+  return command2.option("--team <team>", "Team that owns a new Map, as @team").option(
+    "--origin <origin>",
+    "exact website origin that may load a new Map (repeatable)",
+    (value, previous = []) => [...previous, value]
+  ).option("--any-website", "let any website load a new Map").option("--setup-key <key>", "repeat an interrupted Map creation with the key it printed");
+}
+function hasMapSetupOptions(options) {
+  return options.team !== void 0 || (options.origin?.length ?? 0) > 0 || options.anyWebsite === true || options.setupKey !== void 0;
+}
+async function createMapForDeploy(options, dependencies) {
+  const session = await loadSession(options, dependencies);
+  if (!session) return null;
+  console.log(`${pc5.cyan("i")} No --map-id given; creating a managed Map for this deploy.`);
+  const result = await setUpManagedMap(session, options, {
+    prompts: dependencies.prompts === void 0 ? createTerminalPrompts() : dependencies.prompts
+  });
+  if (!result.ok) {
+    emitFailure(false, result.code, result.error);
+    return null;
+  }
+  printCreatedMap(result.value);
+  console.log(
+    pc5.gray(
+      `If this deploy is interrupted, rerun it with --setup-key ${result.setupKey} to reuse the same Map.`
+    )
+  );
+  return result.value.map.id;
+}
+function printCreatedMap(created) {
+  console.log(
+    `${pc5.green("\u2713")} Created ${pc5.bold(created.map.id)} in ${created.team.name} ${pc5.gray(`@${created.team.slug}`)}.`
+  );
+  console.log(
+    `${pc5.gray("Websites:".padEnd(13))} ${describeBrowserAccess(created.allowedOrigins)}`
+  );
+}
+async function loadSession(options, dependencies) {
+  let apiUrl;
+  try {
+    apiUrl = normalizeApiOrigin(options.apiUrl ?? dependencies.defaultApiUrl);
+  } catch (error) {
+    emitFailure(options.json, "invalid_api_url", safeMessage(error));
+    return null;
+  }
+  let config;
+  try {
+    config = await dependencies.loadAuthConfig();
+  } catch (error) {
+    emitFailure(options.json, "auth_state_unavailable", safeMessage(error));
+    return null;
+  }
+  const selected = resolveAccountSession(config, apiUrl);
+  if (selected.kind !== "selected") {
+    emitFailure(
+      options.json,
+      `account_session_${selected.kind}`,
+      selected.kind === "expired" ? "The Tileflow account session has expired. Run tileflow login." : "Creating a Map needs a Tileflow account session. Run tileflow login."
+    );
+    return null;
+  }
+  return selected.session;
+}
+
+// src/model-command.ts
+import { lstat as lstat5 } from "fs/promises";
+import { basename as basename4, dirname as dirname11, relative as relative4, resolve as resolve8 } from "path";
+import pc6 from "picocolors";
+import { z as z5 } from "zod";
+import { tileflowModelContentType } from "@tileflow/core";
+import {
+  assertValidTileflowConfig as assertValidTileflowConfig3,
+  defaultTileflowConfigPath,
+  loadTileflowConfigWithInputs as loadTileflowConfigWithInputs4
+} from "@tileflow/dev/config";
+import {
+  prepareTileflowMapTreeModels as prepareTileflowMapTreeModels2
+} from "@tileflow/dev/icons";
+var modelName = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+var sha256 = /^[a-f0-9]{64}$/u;
+var maximumListPages = 20;
+function registerModelCommands(program2, dependencies) {
+  const models = program2.command("models").description("Publish and manage the Team 3D models that maps place");
+  withTeamOptions2(
+    models.command("publish").description(
+      "Prepare building models and publish each as its Team 3D model's current version"
+    ).argument(
+      "[paths...]",
+      "model files (<name>.glb) or directories; defaults to the maps' models directories"
+    ).option(
+      "-c, --config <path>",
+      "config path, read when no path is given",
+      defaultTileflowConfigPath
+    )
+  ).action(async (paths, options) => {
+    let prepared;
+    try {
+      prepared = paths.length > 0 ? await prepareFromPaths(paths) : await prepareFromConfig(options.config);
+    } catch (error) {
+      return emitFailure(options.json, "model_preparation_failed", safeMessage(error));
+    }
+    if (prepared.size === 0) {
+      return emitFailure(
+        options.json,
+        "no_building_models",
+        "No building models were found. A building model is a .glb whose materials name its parts: surface, secondary, glass, accent and roof."
+      );
+    }
+    const authority = await resolveTeamAuthority(options, ["models:write"], dependencies);
+    if (!authority) return;
+    const results = [];
+    for (const [name, model] of [...prepared].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+      const body = new FormData();
+      body.append(
+        "metadata",
+        new Blob([JSON.stringify({ sources: model.sources })], { type: "application/json" }),
+        "metadata.json"
+      );
+      const bytes = new Uint8Array(model.bytes.byteLength);
+      bytes.set(model.bytes);
+      body.append(
+        "file",
+        new Blob([bytes.buffer], { type: tileflowModelContentType }),
+        `${name}.glb`
+      );
+      const response = await authorizedTeamRequest(
+        authority,
+        `/v1/models/${encodeURIComponent(name)}/versions/${model.sha256}`,
+        "PUT",
+        { body }
+      );
+      if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+      const parsed = publishResponseSchema2.safeParse(response.body);
+      if (!parsed.success || parsed.data.model.current?.contentHash !== model.sha256) {
+        return emitFailure(
+          options.json,
+          "model_publish_unconfirmed",
+          `The publication of ${name} did not confirm the submitted model file.`
+        );
+      }
+      results.push(parsed.data);
+      if (!options.json) {
+        const current = parsed.data.model.current;
+        const action = parsed.data.changed ? "Published" : "Unchanged";
+        console.log(
+          `${pc6.green("\u2713")} ${action} 3D model ${pc6.bold(name)} version ${current.version} (${formatBytes3(current.byteLength)}, ${formatCount(current.summary.levels[0]?.triangles ?? 0)} triangles).`
+        );
+      }
+    }
+    if (options.json) {
+      emitJson({
+        command: "models publish",
+        ok: true,
+        schemaVersion: 1,
+        models: results.map(({ changed, model }) => ({
+          changed,
+          contentHash: model.current.contentHash,
+          name: model.name,
+          version: model.current.version
+        }))
+      });
+    } else if (results.some(({ changed }) => changed)) {
+      console.log("Maps that place them draw the new versions on their next load.");
+    }
+  });
+  withTeamOptions2(models.command("list").description("List the Team's 3D models")).action(
+    async (options) => {
+      const authority = await resolveTeamAuthority(options, ["models:read"], dependencies);
+      if (!authority) return;
+      const listed = [];
+      let cursor;
+      for (let page = 0; page < maximumListPages; page += 1) {
+        const response = await authorizedTeamRequest(
+          authority,
+          `/v1/models${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`,
+          "GET"
+        );
+        if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body);
+        const parsed = listResponseSchema.safeParse(response.body);
+        if (!parsed.success)
+          return emitFailure(options.json, "invalid_response", "The model list was not readable.");
+        listed.push(...parsed.data.models);
+        cursor = parsed.data.nextCursor;
+        if (!cursor) break;
+      }
+      if (options.json)
+        return emitJson({ command: "models list", ok: true, schemaVersion: 1, models: listed });
+      if (listed.length === 0) {
+        console.log("The Team has no 3D models. Publish one with tileflow models publish.");
+        return;
+      }
+      for (const model of listed) {
+        const current = model.current;
+        console.log(
+          `${pc6.bold(model.name)}  ${current ? `version ${current.version}, ${formatBytes3(current.byteLength)}` : "no current version"}  ${model.usedByMaps === 1 ? "1 map" : `${model.usedByMaps} maps`}${model.state === "purging" ? pc6.yellow("  purging") : ""}`
+        );
+      }
+    }
+  );
+  withTeamOptions2(
+    models.command("status").description("Show a 3D model's versions and the maps that place it").argument("<name>", "model name")
+  ).action(async (name, options) => {
+    if (!modelName.test(name))
+      return emitFailure(options.json, "invalid_model", "Model name is invalid.");
+    const authority = await resolveTeamAuthority(options, ["models:read"], dependencies);
+    if (!authority) return;
+    const detail = await readDetail(authority, name, options.json);
+    if (!detail) return;
+    if (options.json) return emitJson({ ...detail, command: "models status", ok: true });
+    const { model, versions, uses } = detail;
+    console.log(
+      `${pc6.bold(model.name)}${model.state === "purging" ? pc6.yellow(" (purging)") : ""}`
+    );
+    for (const version of versions) {
+      const role = version.state === "current" ? "current" : version.state === "previous" ? "previous" : version.state;
+      console.log(
+        `  version ${version.version}  ${role}  ${formatBytes3(version.byteLength)}  ${formatCount(version.summary.levels[0]?.triangles ?? 0)} triangles  ${version.publishedAt}`
+      );
+    }
+    console.log(
+      uses.length === 0 ? "  No map places it." : `  Placed by ${uses.map(({ mapName, mapId }) => mapName ?? mapId).join(", ")}.`
+    );
+  });
+  withTeamOptions2(
+    models.command("restore").description("Make a 3D model's previous version current again, in every map that places it").argument("<name>", "model name")
+  ).action(async (name, options) => {
+    if (!modelName.test(name))
+      return emitFailure(options.json, "invalid_model", "Model name is invalid.");
+    const authority = await resolveTeamAuthority(options, ["models:write"], dependencies);
+    if (!authority) return;
+    const detail = await readDetail(authority, name, options.json);
+    if (!detail) return;
+    const { current, previous } = detail.model;
+    if (!current || !previous) {
+      return emitFailure(
+        options.json,
+        "no_previous_version",
+        `${name} has no previous version to restore.`
+      );
+    }
+    const response = await authorizedTeamRequest(
+      authority,
+      `/v1/models/${encodeURIComponent(name)}/restore`,
+      "POST",
+      {
+        body: JSON.stringify({ expectedCurrentVersion: current.version }),
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+    if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+    const parsed = restoreResponseSchema.safeParse(response.body);
+    if (!parsed.success || parsed.data.model.current?.version !== previous.version) {
+      return emitFailure(
+        options.json,
+        "model_restore_unconfirmed",
+        `The restore of ${name} was not confirmed.`
+      );
+    }
+    if (options.json)
+      return emitJson({
+        command: "models restore",
+        ok: true,
+        schemaVersion: 1,
+        model: parsed.data.model
+      });
+    console.log(
+      `${pc6.green("\u2713")} ${pc6.bold(name)} is at version ${previous.version} again; version ${current.version} is its previous one. Maps draw it on their next load.`
+    );
+  });
+  withTeamOptions2(
+    models.command("purge").description("Delete a 3D model and its versions; refused while a map places it").argument("<name>", "model name").option("--confirm <name>", "repeat the model name to confirm")
+  ).action(async (name, options) => {
+    if (!modelName.test(name))
+      return emitFailure(options.json, "invalid_model", "Model name is invalid.");
+    if (options.confirm !== name) {
+      return emitFailure(
+        options.json,
+        "confirmation_required",
+        `Repeat the model name to purge it: --confirm ${name}`
+      );
+    }
+    const authority = await resolveTeamAuthority(options, ["models:write"], dependencies);
+    if (!authority) return;
+    const response = await authorizedTeamRequest(
+      authority,
+      `/v1/models/${encodeURIComponent(name)}`,
+      "DELETE",
+      {
+        headers: { "X-Tileflow-Confirm-Model-Purge": name }
+      }
+    );
+    if (!response.ok) return emitHttpFailure2(options.json, response.status, response.body, name);
+    const parsed = purgeResponseSchema2.safeParse(response.body);
+    if (!parsed.success)
+      return emitFailure(options.json, "invalid_response", "The purge was not confirmed.");
+    if (options.json)
+      return emitJson({
+        command: "models purge",
+        ok: true,
+        schemaVersion: 1,
+        purge: parsed.data.purge
+      });
+    console.log(
+      `${pc6.green("\u2713")} ${pc6.bold(name)} is being purged; its name is free once its files are deleted.`
+    );
+  });
+}
+function withTeamOptions2(command2) {
+  return command2.option("--team <team>", "Team, as @team, when the account has several").option("--api-key <key>", "Team data API key with the 3D models permission").option("--api-url <url>", "Tileflow API origin").option("--json", "machine-readable output");
+}
+async function readDetail(authority, name, json2) {
+  const response = await authorizedTeamRequest(
+    authority,
+    `/v1/models/${encodeURIComponent(name)}`,
+    "GET"
+  );
+  if (!response.ok) {
+    emitHttpFailure2(json2, response.status, response.body, name);
+    return void 0;
+  }
+  const parsed = detailResponseSchema.safeParse(response.body);
+  if (!parsed.success) {
+    emitFailure(json2, "invalid_response", `The details of ${name} were not readable.`);
+    return void 0;
+  }
+  return parsed.data;
+}
+async function prepareFromPaths(paths) {
+  const cwd = process.cwd();
+  const directories = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    const absolute = resolve8(cwd, path);
+    const info = await lstat5(absolute).catch(() => void 0);
+    if (!info) throw new Error(`${path} does not exist.`);
+    const directory = info.isDirectory() ? absolute : dirname11(absolute);
+    if (relative4(cwd, directory).startsWith(".."))
+      throw new Error(`${path} is outside the current directory.`);
+    if (info.isDirectory()) {
+      directories.set(directory, "all");
+      continue;
+    }
+    const file = basename4(absolute);
+    if (!file.toLowerCase().endsWith(".glb"))
+      throw new Error(`${path} is not a glTF binary (.glb).`);
+    const name = file.replace(/(\.mid|\.far)?\.glb$/iu, "");
+    const selected = directories.get(directory);
+    if (selected === "all") continue;
+    directories.set(directory, /* @__PURE__ */ new Set([...selected ?? [], name]));
+  }
+  const models = /* @__PURE__ */ new Map();
+  for (const [directory, selected] of directories) {
+    const parent = dirname11(directory);
+    const local = `./${basename4(directory)}`;
+    const display = relative4(cwd, directory) || ".";
+    const prepared = await prepareTileflowMapTreeModels2([local], {
+      baseDirectory: parent,
+      configPath: display,
+      cwd: parent,
+      target: "hosted"
+    });
+    for (const [name, model] of Object.entries(prepared.buildings)) {
+      if (selected !== "all" && !selected.has(name)) continue;
+      addModel(models, name, model);
+    }
+    if (selected !== "all") {
+      for (const name of selected)
+        if (!prepared.buildings[name])
+          throw new Error(
+            `${display}/${name}.glb is not a building model: its materials must name its parts (surface, secondary, glass, accent, roof).`
+          );
+    }
+  }
+  return models;
+}
+async function prepareFromConfig(configPath) {
+  const loaded = await withTileflowConfigSecretsHidden(
+    () => loadTileflowConfigWithInputs4(configPath)
+  );
+  const project = loaded.project;
+  assertValidTileflowConfig3(project);
+  const prepared = await prepareModelAssets(project, {
+    baseDirectory: dirname11(loaded.configFile),
+    target: "hosted"
+  });
+  const models = /* @__PURE__ */ new Map();
+  for (const buildings of Object.values(prepared.buildings))
+    for (const [name, model] of Object.entries(buildings)) addModel(models, name, model);
+  return models;
+}
+function addModel(models, name, model) {
+  const known = models.get(name);
+  if (known && known.sha256 !== model.sha256)
+    throw new Error(`Two different models are named ${name}; a Team has one model of each name.`);
+  models.set(name, model);
+}
+function emitHttpFailure2(json2, status, body, name) {
+  const error = z5.object({ error: z5.object({ code: z5.string().max(80), message: z5.string().max(400) }).partial() }).partial().safeParse(body);
+  const message = error.success ? error.data.error?.message : void 0;
+  const code = error.success ? error.data.error?.code : void 0;
+  if (status === 404)
+    return emitFailure(
+      json2,
+      "model_not_found",
+      name ? `The Team has no 3D model named ${name}.` : "Not found."
+    );
+  return emitFailure(
+    json2,
+    code ?? `http_${status}`,
+    message ?? `The request failed with ${status}.`
+  );
+}
+function formatBytes3(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
+}
+function formatCount(count) {
+  return new Intl.NumberFormat("en-US").format(count);
+}
+var summarySchema = z5.object({
+  levels: z5.array(
+    z5.object({
+      level: z5.enum(["near", "mid", "far"]),
+      vertices: z5.number().int().nonnegative(),
+      triangles: z5.number().int().nonnegative()
+    }).strict()
+  ).min(1).max(3),
+  width: z5.number().nonnegative(),
+  depth: z5.number().nonnegative(),
+  height: z5.number().nonnegative(),
+  footprint: z5.object({
+    rings: z5.number().int().nonnegative(),
+    points: z5.number().int().nonnegative(),
+    area: z5.number().nonnegative()
+  }).strict()
+}).strict();
+var versionSchema = z5.object({
+  id: z5.string().regex(/^tmv_[A-Za-z0-9_-]{16,64}$/u),
+  version: z5.number().int().positive(),
+  state: z5.enum(["current", "previous", "gc_pending", "deleting", "deleted"]),
+  contentHash: z5.string().regex(sha256),
+  byteLength: z5.number().int().positive(),
+  publishedAt: z5.iso.datetime({ offset: true }),
+  summary: summarySchema
+}).strict();
+var modelSchema = z5.object({
+  id: z5.string().regex(/^tmd_[A-Za-z0-9_-]{16,64}$/u),
+  name: z5.string().regex(modelName).max(64),
+  state: z5.enum(["active", "purging"]),
+  current: versionSchema.nullable(),
+  previous: versionSchema.nullable(),
+  url: z5.url(),
+  usedByMaps: z5.number().int().nonnegative(),
+  updatedAt: z5.iso.datetime({ offset: true })
+}).strict();
+var listResponseSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  models: z5.array(modelSchema).max(100),
+  nextCursor: z5.string().min(1).max(512).optional()
+}).strict();
+var detailResponseSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  model: modelSchema,
+  versions: z5.array(versionSchema).max(100),
+  uses: z5.array(
+    z5.object({
+      mapId: z5.string().min(1).max(160),
+      mapName: z5.string().max(200).nullable(),
+      relationship: z5.enum(["active", "retained"])
+    }).strict()
+  ).max(100)
+}).strict();
+var publishResponseSchema2 = z5.object({ schemaVersion: z5.literal(1), changed: z5.boolean(), model: modelSchema }).strict();
+var restoreResponseSchema = z5.object({ schemaVersion: z5.literal(1), model: modelSchema }).strict();
+var purgeResponseSchema2 = z5.object({
+  schemaVersion: z5.literal(1),
+  purge: z5.object({ name: z5.string().regex(modelName), state: z5.enum(["purging", "purged"]) }).strict()
+}).strict();
+
 // src/native-preview-command.ts
 import { tileflowNativeProfile } from "@tileflow/core/native-profile";
 import {
@@ -7030,7 +7791,7 @@ function resolveTileflowExternalOpenInvocation(target, platform) {
 }
 
 // src/project-commands.ts
-import pc4 from "picocolors";
+import pc7 from "picocolors";
 function registerProjectCommands(program2, dependencies) {
   const projects = program2.command("projects", { hidden: true }).description("Manage internal application destinations");
   projects.command("list").description("List application destinations accessible to the authenticated Tileflow account").option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--include-archived", "include archived application destinations").option("--json", "print deterministic schema-version-1 JSON").action(async (options) => {
@@ -7046,12 +7807,12 @@ function registerProjectCommands(program2, dependencies) {
     };
     if (options.json) return emitJson2(document);
     if (!result.items.length) {
-      console.log(pc4.gray("No managed destinations found."));
+      console.log(pc7.gray("No managed destinations found."));
       return;
     }
     for (const target of result.items) {
       console.log(
-        `  ${target.project.archivedAt ? pc4.yellow("\u25CB") : pc4.green("\u25CF")} ${pc4.bold(target.project.name)} ${pc4.gray(target.reference)}${target.project.archivedAt ? pc4.gray(" (archived)") : ""}`
+        `  ${target.project.archivedAt ? pc7.yellow("\u25CB") : pc7.green("\u25CF")} ${pc7.bold(target.project.name)} ${pc7.gray(target.reference)}${target.project.archivedAt ? pc7.gray(" (archived)") : ""}`
       );
     }
   });
@@ -7104,8 +7865,8 @@ function registerProjectCommands(program2, dependencies) {
         ...asRecord2(result.body)
       };
       if (options.json) return emitJson2(document);
-      console.log(`${pc4.green("\u2713")} Application ${pc4.bold(options.name.trim())} is ready.`);
-      console.log(pc4.gray(`Its technical selector is --project @${organization.slug}/${slug}.`));
+      console.log(`${pc7.green("\u2713")} Application ${pc7.bold(options.name.trim())} is ready.`);
+      console.log(pc7.gray(`Its technical selector is --project @${organization.slug}/${slug}.`));
     }
   );
   projects.command("show <target>").description("Show one application destination").option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--json", "print deterministic schema-version-1 JSON").action(async (target, options) => {
@@ -7127,8 +7888,8 @@ function registerProjectCommands(program2, dependencies) {
     if (!isProjectItem(project)) {
       return emitLocalFailure(false, "invalid_response", "Destination response was invalid.");
     }
-    console.log(`${pc4.bold(project.name)} ${pc4.gray(target)}`);
-    console.log(project.archivedAt ? pc4.yellow("Archived") : pc4.green("Active"));
+    console.log(`${pc7.bold(project.name)} ${pc7.gray(target)}`);
+    console.log(project.archivedAt ? pc7.yellow("Archived") : pc7.green("Active"));
   });
   for (const archived of [true, false]) {
     const verb = archived ? "archive" : "unarchive";
@@ -7155,7 +7916,7 @@ function registerProjectCommands(program2, dependencies) {
         ...asRecord2(result.body)
       };
       if (options.json) return emitJson2(document);
-      console.log(`${pc4.green("\u2713")} Application ${archived ? "archived" : "unarchived"}.`);
+      console.log(`${pc7.green("\u2713")} Application ${archived ? "archived" : "unarchived"}.`);
     });
   }
 }
@@ -7266,7 +8027,7 @@ function emitLocalFailure(json2, code, message, details = {}) {
     console.error(message);
     emitJson2({ schemaVersion: 1, ok: false, error: { code, ...details } });
   } else {
-    console.error(`${pc4.red("\u2715")} ${message}`);
+    console.error(`${pc7.red("\u2715")} ${message}`);
   }
   process.exitCode = 1;
 }
@@ -7301,7 +8062,7 @@ function safeMessage2(error) {
 }
 
 // src/renderer-artifact-command.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 import { auditTileflowMapThemeValues } from "@tileflow/core";
 import {
   createTileflowNativeDiagnostic,
@@ -7389,7 +8150,7 @@ async function runRendererArtifactCommand(command2, options) {
       if (artifacts.nativeBuild)
         console.log("Profile: native-v1 (static artifacts; no device qualification).");
       if (command2 === "build")
-        console.log(`Output: ${resolve8(outDir, ...renderer === "native" ? ["native"] : [])}`);
+        console.log(`Output: ${resolve9(outDir, ...renderer === "native" ? ["native"] : [])}`);
     }
   } catch (error) {
     const document = createTileflowCommandFailureDocument6(command2, error, process.cwd(), {
@@ -7410,15 +8171,15 @@ async function runRendererArtifactCommand(command2, options) {
 }
 
 // src/tileset-command.ts
-import pc5 from "picocolors";
-import { z as z6 } from "zod";
+import pc8 from "picocolors";
+import { z as z7 } from "zod";
 import { serializeCanonicalJson as serializeCanonicalJson6 } from "@tileflow/core";
 import { inspectTileflowPmtiles } from "@tileflow/dev/tilesets";
 
 // src/tileset-upload.ts
 import { createHash as createHash3 } from "crypto";
 import { open as open5, stat } from "fs/promises";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 import { serializeCanonicalJson as serializeCanonicalJson5 } from "@tileflow/core";
 var teamTilesetPartSize = 16777216;
 var maximumTeamTilesetBytes = 4e9;
@@ -7979,36 +8740,36 @@ function asRecord3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function defaultSleep(milliseconds) {
-  return new Promise((resolve12) => setTimeout(resolve12, milliseconds));
-}
-var identifierSchema = z5.string().min(20).max(80).regex(/^[A-Za-z0-9_-]+$/u);
-var uploadPartStatusSchema = z5.object({
-  byteCount: z5.number().int().min(1).max(teamTilesetPartSize),
-  partNumber: z5.number().int().min(1).max(239),
-  uploaded: z5.boolean(),
-  validationState: z5.enum(["mismatch", "pending", "processing", "valid"])
+  return new Promise((resolve13) => setTimeout(resolve13, milliseconds));
+}
+var identifierSchema = z6.string().min(20).max(80).regex(/^[A-Za-z0-9_-]+$/u);
+var uploadPartStatusSchema = z6.object({
+  byteCount: z6.number().int().min(1).max(teamTilesetPartSize),
+  partNumber: z6.number().int().min(1).max(239),
+  uploaded: z6.boolean(),
+  validationState: z6.enum(["mismatch", "pending", "processing", "valid"])
 }).strict();
-var publishedVersionSchema = z5.object({
-  byteCount: z5.number().int().min(1).max(maximumTeamTilesetBytes),
-  contentHash: z5.string().regex(/^[0-9a-f]{64}$/u),
-  contentHashAlgorithm: z5.literal("sha256-fixed-parts-v1"),
-  publishedVersion: z5.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  schemaVersion: z5.literal(1),
-  state: z5.literal("published"),
+var publishedVersionSchema = z6.object({
+  byteCount: z6.number().int().min(1).max(maximumTeamTilesetBytes),
+  contentHash: z6.string().regex(/^[0-9a-f]{64}$/u),
+  contentHashAlgorithm: z6.literal("sha256-fixed-parts-v1"),
+  publishedVersion: z6.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  schemaVersion: z6.literal(1),
+  state: z6.literal("published"),
   versionId: identifierSchema.regex(/^tsv_[A-Za-z0-9_-]+$/u)
 }).strict();
-var uploadControlSchema = z5.object({
-  byteCount: z5.number().int().min(1).max(maximumTeamTilesetBytes),
-  contentHash: z5.string().regex(/^[0-9a-f]{64}$/u),
-  contentHashAlgorithm: z5.literal("sha256-fixed-parts-v1"),
-  expiresAt: z5.iso.datetime({ offset: true }),
-  failure: z5.object({ code: z5.string().regex(/^TF_[A-Z0-9_]{1,96}$/u) }).strict().nullable(),
-  partCount: z5.number().int().min(1).max(239),
-  parts: z5.array(uploadPartStatusSchema).max(239),
-  partSize: z5.literal(teamTilesetPartSize),
-  publishedVersion: z5.null(),
-  schemaVersion: z5.literal(1),
-  state: z5.enum([
+var uploadControlSchema = z6.object({
+  byteCount: z6.number().int().min(1).max(maximumTeamTilesetBytes),
+  contentHash: z6.string().regex(/^[0-9a-f]{64}$/u),
+  contentHashAlgorithm: z6.literal("sha256-fixed-parts-v1"),
+  expiresAt: z6.iso.datetime({ offset: true }),
+  failure: z6.object({ code: z6.string().regex(/^TF_[A-Z0-9_]{1,96}$/u) }).strict().nullable(),
+  partCount: z6.number().int().min(1).max(239),
+  parts: z6.array(uploadPartStatusSchema).max(239),
+  partSize: z6.literal(teamTilesetPartSize),
+  publishedVersion: z6.null(),
+  schemaVersion: z6.literal(1),
+  state: z6.enum([
     "aborted",
     "aborting",
     "expired",
@@ -8021,32 +8782,32 @@ var uploadControlSchema = z5.object({
     "uploading",
     "validating"
   ]),
-  uploadId: z5.string().min(20).max(80).regex(/^tsu_[A-Za-z0-9_-]+$/u),
-  versionId: z5.null()
+  uploadId: z6.string().min(20).max(80).regex(/^tsu_[A-Za-z0-9_-]+$/u),
+  versionId: z6.null()
 }).strict();
-var uploadSessionSchema = z5.union([publishedVersionSchema, uploadControlSchema]);
-var authorizationSchema = z5.object({
-  expiresAt: z5.iso.datetime({ offset: true }),
-  headers: z5.object({
-    "Content-Length": z5.string().regex(/^[1-9][0-9]{0,9}$/u),
-    "Content-MD5": z5.string().regex(/^[A-Za-z0-9+/]{22}==$/u)
+var uploadSessionSchema = z6.union([publishedVersionSchema, uploadControlSchema]);
+var authorizationSchema = z6.object({
+  expiresAt: z6.iso.datetime({ offset: true }),
+  headers: z6.object({
+    "Content-Length": z6.string().regex(/^[1-9][0-9]{0,9}$/u),
+    "Content-MD5": z6.string().regex(/^[A-Za-z0-9+/]{22}==$/u)
   }).strict(),
-  method: z5.literal("PUT"),
-  partNumber: z5.number().int().min(1).max(239),
-  url: z5.url().max(8192).refine((value) => {
+  method: z6.literal("PUT"),
+  partNumber: z6.number().int().min(1).max(239),
+  url: z6.url().max(8192).refine((value) => {
     const url = new URL(value);
     return url.protocol === "https:" && !url.username && !url.password && !url.hash;
   })
 }).strict();
-var authorizationResponseSchema = z5.object({
-  authorizations: z5.array(authorizationSchema).min(1).max(16),
-  schemaVersion: z5.literal(1)
+var authorizationResponseSchema = z6.object({
+  authorizations: z6.array(authorizationSchema).min(1).max(16),
+  schemaVersion: z6.literal(1)
 }).strict();
-var partReceiptResponseSchema = z5.object({
-  changed: z5.boolean(),
-  etag: z5.string().regex(/^[0-9a-f]{32}$/u),
-  partNumber: z5.number().int().min(1).max(239),
-  schemaVersion: z5.literal(1)
+var partReceiptResponseSchema = z6.object({
+  changed: z6.boolean(),
+  etag: z6.string().regex(/^[0-9a-f]{32}$/u),
+  partNumber: z6.number().int().min(1).max(239),
+  schemaVersion: z6.literal(1)
 }).strict();
 
 // src/tileset-command.ts
@@ -8069,7 +8830,7 @@ function registerTilesetInspectCommand(parent, name = "inspect") {
 `);
           return;
         }
-        console.log(`${pc5.green("\u2713")} PMTiles archive is valid.`);
+        console.log(`${pc8.green("\u2713")} PMTiles archive is valid.`);
         console.log(`  Type: ${inspection.contract.tileType}`);
         console.log(`  Zooms: ${inspection.contract.minzoom}-${inspection.contract.maxzoom}`);
         console.log(`  Source layers: ${inspection.contract.sourceLayers.length}`);
@@ -8079,7 +8840,7 @@ function registerTilesetInspectCommand(parent, name = "inspect") {
           );
         }
         for (const warning of inspection.warnings) {
-          console.log(`${pc5.yellow("!")} ${warning.message}`);
+          console.log(`${pc8.yellow("!")} ${warning.message}`);
         }
       } catch (error) {
         const record = asRecord4(error);
@@ -8092,7 +8853,7 @@ function registerTilesetInspectCommand(parent, name = "inspect") {
 `
           );
         } else {
-          console.error(`${pc5.red("Error:")} ${message}`);
+          console.error(`${pc8.red("Error:")} ${message}`);
         }
         process.exitCode = 1;
       }
@@ -8180,7 +8941,7 @@ function registerTilesetCommands(program2, dependencies) {
         };
         if (options.json) return emitJson(document);
         console.log(
-          `${pc5.green("\u2713")} ${publication.changed ? "Published" : "Unchanged"} ${pc5.bold(options.id)} in ${authority.team ? `@${authority.team.slug}` : "the Team bound to the data key"}.`
+          `${pc8.green("\u2713")} ${publication.changed ? "Published" : "Unchanged"} ${pc8.bold(options.id)} in ${authority.team ? `@${authority.team.slug}` : "the Team bound to the data key"}.`
         );
       } catch (error) {
         if (error instanceof TeamTilesetUploadError) {
@@ -8200,9 +8961,9 @@ function registerTilesetCommands(program2, dependencies) {
       const items = await fetchAllTeamTilesets(authority);
       const document = { command: "tileset list", schemaVersion: 1, tilesets: items };
       if (options.json) return emitJson(document);
-      if (items.length === 0) return console.log(pc5.gray("No Team tilesets."));
+      if (items.length === 0) return console.log(pc8.gray("No Team tilesets."));
       for (const item of items) {
-        console.log(`  ${pc5.bold(item.logicalName)} ${pc5.gray(item.status)}`);
+        console.log(`  ${pc8.bold(item.logicalName)} ${pc8.gray(item.status)}`);
       }
     } catch {
       emitFailure(options.json, "tileset_list_failed", "Tileset list failed.");
@@ -8230,7 +8991,7 @@ function registerTilesetCommands(program2, dependencies) {
       const document = { command: "tileset status", schemaVersion: 1, tileset: parsed.tileset };
       if (options.json) return emitJson(document);
       const item = parsed.tileset;
-      console.log(`${pc5.bold(item.name)} ${pc5.gray(item.state)}`);
+      console.log(`${pc8.bold(item.name)} ${pc8.gray(item.state)}`);
       console.log(`  ID: ${item.id}`);
       console.log(`  Current version: ${String(item.currentVersion ?? "unpublished")}`);
     } catch {
@@ -8281,7 +9042,7 @@ function registerTilesetCommands(program2, dependencies) {
       const parsed = tilesetPurgeResponseSchema.parse(response.body);
       const document = { command: "tileset purge", schemaVersion: 1, ...parsed };
       if (options.json) return emitJson(document);
-      console.log(`${pc5.green("\u2713")} Purge ${parsed.reclamation}.`);
+      console.log(`${pc8.green("\u2713")} Purge ${parsed.reclamation}.`);
     } catch {
       emitFailure(options.json, "tileset_purge_failed", "Tileset purge failed.");
     }
@@ -8343,69 +9104,69 @@ function inspectionOptionError(message) {
 function asRecord4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-var safeIdentifierSchema2 = z6.string().min(1).max(160).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
-var physicalTilesetIdSchema = z6.string().min(20).max(80).regex(/^tls_[A-Za-z0-9_-]+$/u);
-var cursorSchema2 = z6.string().min(1).max(2048).nullable();
-var tilesetInventoryItemSchema = z6.object({
-  currentVersion: z6.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
-  hasCurrent: z6.boolean(),
+var safeIdentifierSchema2 = z7.string().min(1).max(160).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
+var physicalTilesetIdSchema = z7.string().min(20).max(80).regex(/^tls_[A-Za-z0-9_-]+$/u);
+var cursorSchema2 = z7.string().min(1).max(2048).nullable();
+var tilesetInventoryItemSchema = z7.object({
+  currentVersion: z7.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+  hasCurrent: z7.boolean(),
   id: physicalTilesetIdSchema,
-  logicalName: z6.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u),
-  name: z6.string().min(1).max(200),
-  retainedBytes: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  retainedDeploymentCount: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  status: z6.enum(["active", "purging", "retired"]),
-  updatedAt: z6.iso.datetime({ offset: true }),
-  usedByMapCount: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+  logicalName: z7.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u),
+  name: z7.string().min(1).max(200),
+  retainedBytes: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  retainedDeploymentCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  status: z7.enum(["active", "purging", "retired"]),
+  updatedAt: z7.iso.datetime({ offset: true }),
+  usedByMapCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
 }).strict();
-var tilesetListResponseSchema = z6.object({
+var tilesetListResponseSchema = z7.object({
   nextCursor: cursorSchema2.optional(),
-  schemaVersion: z6.literal(1),
-  tilesets: z6.array(tilesetInventoryItemSchema).max(100)
+  schemaVersion: z7.literal(1),
+  tilesets: z7.array(tilesetInventoryItemSchema).max(100)
 }).strict();
-var tilesetDependencySchema = z6.object({
-  active: z6.boolean(),
+var tilesetDependencySchema = z7.object({
+  active: z7.boolean(),
   deploymentId: safeIdentifierSchema2,
-  deploymentVersion: z6.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  environment: z6.string().min(1).max(64),
+  deploymentVersion: z7.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  environment: z7.string().min(1).max(64),
   mapId: safeIdentifierSchema2,
   sourceId: safeIdentifierSchema2
 }).strict();
-var tilesetDetailResponseSchema = z6.object({
-  schemaVersion: z6.literal(1),
-  tileset: z6.object({
-    attribution: z6.string().max(4096).nullable(),
-    currentVersion: z6.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
-    dependencies: z6.array(tilesetDependencySchema).max(25),
+var tilesetDetailResponseSchema = z7.object({
+  schemaVersion: z7.literal(1),
+  tileset: z7.object({
+    attribution: z7.string().max(4096).nullable(),
+    currentVersion: z7.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+    dependencies: z7.array(tilesetDependencySchema).max(25),
     dependencyNextCursor: cursorSchema2,
     id: physicalTilesetIdSchema,
-    name: z6.string().min(1).max(200),
-    slug: z6.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u),
-    state: z6.enum(["active", "purging", "purged"])
+    name: z7.string().min(1).max(200),
+    slug: z7.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u),
+    state: z7.enum(["active", "purging", "purged"])
   }).strict()
 }).strict();
-var purgeDependencySchema = z6.object({
+var purgeDependencySchema = z7.object({
   deploymentId: safeIdentifierSchema2,
   mapId: safeIdentifierSchema2,
   sourceId: safeIdentifierSchema2
 }).strict();
-var tilesetInUseResponseSchema = z6.object({
-  code: z6.literal("TF_TILESET_IN_USE"),
-  dependencies: z6.array(purgeDependencySchema).max(32),
-  error: z6.literal("Tileset is used by retained Map deployments"),
+var tilesetInUseResponseSchema = z7.object({
+  code: z7.literal("TF_TILESET_IN_USE"),
+  dependencies: z7.array(purgeDependencySchema).max(32),
+  error: z7.literal("Tileset is used by retained Map deployments"),
   nextCursor: cursorSchema2
 }).strict();
-var tilesetPurgeResponseSchema = z6.object({
-  deliveryFence: z6.enum(["complete", "pending"]),
-  pendingVersions: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  reclamation: z6.enum(["complete", "pending"]),
-  state: z6.enum(["purged", "purging"]),
+var tilesetPurgeResponseSchema = z7.object({
+  deliveryFence: z7.enum(["complete", "pending"]),
+  pendingVersions: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  reclamation: z7.enum(["complete", "pending"]),
+  state: z7.enum(["purged", "purging"]),
   tilesetId: physicalTilesetIdSchema
 }).strict();
 
 // src/visual-command.ts
-import { lstat as lstat5, readFile as readFile6 } from "fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute4, parse as parse2, relative as relative4, resolve as resolve9, sep as sep4 } from "path";
+import { lstat as lstat6, readFile as readFile6 } from "fs/promises";
+import { dirname as dirname12, isAbsolute as isAbsolute4, parse as parse2, relative as relative5, resolve as resolve10, sep as sep4 } from "path";
 import {
   analyzeTileflowCaptureReference,
   compareTileflowCaptureToBaseline,
@@ -8490,14 +9251,14 @@ async function runVisualAnalyze(scene, options) {
   validateVisualSelection([scene]);
   const region = options.region === void 0 ? void 0 : parseTileflowVisualRegion(options.region);
   const cwd = process.cwd();
-  const referencePath = resolve9(cwd, options.reference);
+  const referencePath = resolve10(cwd, options.reference);
   const referencePng = await readVisualReference(referencePath);
   const referenceDimensions = validateTileflowVisualReferencePng(referencePng);
   if (region) assertTileflowVisualRegionFits(region, referenceDimensions, "reference PNG");
   const outputDirectory = await resolveVisualDirectory(cwd, options.outputDir, "output");
-  const actualPath = resolve9(outputDirectory.path, `${scene}.actual.png`);
-  const managedDiffPath = resolve9(outputDirectory.path, `${scene}.diff.png`);
-  const reportPath = resolve9(outputDirectory.path, `${scene}.analysis.json`);
+  const actualPath = resolve10(outputDirectory.path, `${scene}.actual.png`);
+  const managedDiffPath = resolve10(outputDirectory.path, `${scene}.diff.png`);
+  const reportPath = resolve10(outputDirectory.path, `${scene}.analysis.json`);
   assertReferenceIsReadOnly(referencePath, [actualPath, managedDiffPath, reportPath]);
   const controller = installSignalAbortController();
   const session = createTileflowCaptureSession3({
@@ -8586,15 +9347,15 @@ async function runVisualDiff(scenes, options) {
         capture,
         files.kind === "complete" ? files.baseline : void 0
       );
-      const actualPath = resolve9(outputDirectory.path, `${capture.scene}.actual.png`);
-      const diffPath = comparison.diffPng ? resolve9(outputDirectory.path, `${capture.scene}.diff.png`) : void 0;
+      const actualPath = resolve10(outputDirectory.path, `${capture.scene}.actual.png`);
+      const diffPath = comparison.diffPng ? resolve10(outputDirectory.path, `${capture.scene}.diff.png`) : void 0;
       prepared.push({
         capture,
         comparison,
         baselinePath: files.pngPath,
         actualPath,
         diffPath,
-        reportPath: resolve9(outputDirectory.path, `${capture.scene}.visual.json`)
+        reportPath: resolve10(outputDirectory.path, `${capture.scene}.visual.json`)
       });
     }
     const document = createTileflowVisualDiffJson(prepared, cwd);
@@ -8614,7 +9375,7 @@ async function runVisualDiff(scenes, options) {
         }
       ]),
       removePaths: prepared.flatMap(
-        (item) => item.diffPath ? [] : [resolve9(outputDirectory.path, `${item.capture.scene}.diff.png`)]
+        (item) => item.diffPath ? [] : [resolve10(outputDirectory.path, `${item.capture.scene}.diff.png`)]
       )
     });
     if (options.json) {
@@ -8735,7 +9496,7 @@ async function resolvePreviousBaseline(capture, files) {
   }
 }
 async function readBaselineFiles(directory, scene) {
-  const pngPath = resolve9(directory.path, `${scene}.png`);
+  const pngPath = resolve10(directory.path, `${scene}.png`);
   const receiptPath = captureReceiptPath(pngPath);
   const [png, receipt] = await Promise.all([
     readOptionalArtifact(pngPath, directory.boundary, tileflowVisualArtifactLimits2.maximumPngBytes),
@@ -8750,10 +9511,10 @@ async function readBaselineFiles(directory, scene) {
   return { kind: "complete", pngPath, receiptPath, baseline: { png, receipt } };
 }
 async function readOptionalArtifact(path, boundary, maximumBytes) {
-  await assertNoSymlinkComponents(dirname11(path), boundary);
+  await assertNoSymlinkComponents(dirname12(path), boundary);
   let info;
   try {
-    info = await lstat5(path);
+    info = await lstat6(path);
   } catch (error) {
     if (isMissingFile5(error)) return void 0;
     throw error;
@@ -8773,7 +9534,7 @@ async function readOptionalArtifact(path, boundary, maximumBytes) {
 async function readVisualReference(path) {
   let info;
   try {
-    info = await lstat5(path);
+    info = await lstat6(path);
   } catch (error) {
     throw new TileflowCaptureError2("BASELINE_INVALID", "The visual reference PNG cannot be read.", {
       cause: error
@@ -8795,12 +9556,12 @@ async function readVisualReference(path) {
   return new Uint8Array(await readFile6(path));
 }
 async function resolveVisualDirectory(cwd, value, kind) {
-  const path = resolve9(cwd, value);
+  const path = resolve10(cwd, value);
   if (path === cwd || path === parse2(path).root) {
     throw new Error(`Visual ${kind} directory must be a dedicated subdirectory.`);
   }
   if (kind === "baseline") {
-    for (const managed of [resolve9(cwd, ".tileflow/captures"), resolve9(cwd, ".tileflow/diffs")]) {
+    for (const managed of [resolve10(cwd, ".tileflow/captures"), resolve10(cwd, ".tileflow/diffs")]) {
       if (pathsOverlap2(path, managed)) {
         throw new Error("Visual baselines must not overlap Tileflow-managed capture/diff outputs.");
       }
@@ -8809,7 +9570,7 @@ async function resolveVisualDirectory(cwd, value, kind) {
   const boundary = isInside2(cwd, path) ? cwd : path;
   await assertNoSymlinkComponents(path, boundary);
   try {
-    const info = await lstat5(path);
+    const info = await lstat6(path);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new Error(`Visual ${kind} path must be a non-symlink directory.`);
     }
@@ -8836,10 +9597,10 @@ function assertReferenceIsReadOnly(referencePath, outputPaths) {
   }
 }
 function portablePathIdentity2(path) {
-  return resolve9(path).normalize("NFC").toLowerCase();
+  return resolve10(path).normalize("NFC").toLowerCase();
 }
 function isInside2(parent, child) {
-  const path = relative4(parent, child);
+  const path = relative5(parent, child);
   return path === "" || path !== ".." && !path.startsWith(`..${sep4}`) && !isAbsolute4(path);
 }
 function isMissingFile5(error) {
@@ -8848,8 +9609,8 @@ function isMissingFile5(error) {
 
 // src/workbench-service.ts
 import { opendir, stat as stat2 } from "fs/promises";
-import { resolve as resolve10 } from "path";
-import { z as z7 } from "zod";
+import { resolve as resolve11 } from "path";
+import { z as z8 } from "zod";
 import {
   compareTileflowCapturesForReview as compareTileflowCapturesForReview3,
   createTileflowCaptureSession as createTileflowCaptureSession4,
@@ -8862,22 +9623,22 @@ import {
 } from "@tileflow/core";
 import { resolveTileflowPreview } from "@tileflow/dev/preview";
 var prefix = "/__workbench";
-var captureInput = z7.object({
-  side: z7.enum(["left", "right"]).default("left"),
-  generation: z7.number().int().nonnegative(),
+var captureInput = z8.object({
+  side: z8.enum(["left", "right"]).default("left"),
+  generation: z8.number().int().nonnegative(),
   name: tileflowCaptureSceneNameSchema2,
   definition: tileflowCaptureSceneSchema3
 }).strict();
-var compareInput = z7.object({ before: z7.string().regex(/^[a-f0-9]{64}$/u), after: z7.string().regex(/^[a-f0-9]{64}$/u) }).strict();
-var deleteInput = z7.object({ id: z7.string().regex(/^[a-f0-9]{64}$/u) }).strict();
-var contextInput = z7.object({
-  client: z7.string().regex(/^[a-zA-Z0-9-]{1,80}$/u),
-  side: z7.enum(["left", "right"]),
-  generation: z7.number().int(),
-  context: z7.record(z7.string(), z7.unknown())
+var compareInput = z8.object({ before: z8.string().regex(/^[a-f0-9]{64}$/u), after: z8.string().regex(/^[a-f0-9]{64}$/u) }).strict();
+var deleteInput = z8.object({ id: z8.string().regex(/^[a-f0-9]{64}$/u) }).strict();
+var contextInput = z8.object({
+  client: z8.string().regex(/^[a-zA-Z0-9-]{1,80}$/u),
+  side: z8.enum(["left", "right"]),
+  generation: z8.number().int(),
+  context: z8.record(z8.string(), z8.unknown())
 }).strict();
 function createWorkbenchService(options) {
-  const directory = resolve10(options.cwd, captureRecordDirectory);
+  const directory = resolve11(options.cwd, captureRecordDirectory);
   const contexts = /* @__PURE__ */ new Map();
   let captureSession = options.captureSession;
   let pending;
@@ -8949,7 +9710,7 @@ function createWorkbenchService(options) {
           break;
         }
         if (!entry.isFile() || !/^[a-f0-9]{64}\.json$/u.test(entry.name)) continue;
-        const info = await stat2(resolve10(directory, entry.name));
+        const info = await stat2(resolve11(directory, entry.name));
         entries.push({ id: entry.name.slice(0, -5), modified: info.mtimeMs });
       }
     } catch (error) {
@@ -9088,7 +9849,7 @@ function createWorkbenchService(options) {
             });
           }
           if (path === "/captures") {
-            const offset = z7.coerce.number().int().min(0).max(5e3).parse(url.searchParams.get("offset") ?? 0);
+            const offset = z8.coerce.number().int().min(0).max(5e3).parse(url.searchParams.get("offset") ?? 0);
             return json(await history(offset));
           }
           const image = /^\/captures\/([a-f0-9]{64})\.png$/u.exec(path);
@@ -9219,17 +9980,18 @@ var packageJson = JSON.parse(
 var program = new Command();
 var defaultApiUrl = defaultTileflowApiUrl;
 var defaultAppUrl = "https://tileflow.dev";
-var defaultConfigPath = defaultTileflowConfigPath;
+var defaultConfigPath = defaultTileflowConfigPath2;
 var defaultManifestPath = defaultTileflowManifestPath;
-program.name("tileflow").description("Beautiful maps from config.").enablePositionalOptions().showHelpAfterError(pc6.gray("\nRun tileflow <command> --help for usage.")).showSuggestionAfterError();
+program.name("tileflow").description("Beautiful maps from config.").enablePositionalOptions().showHelpAfterError(pc9.gray("\nRun tileflow <command> --help for usage.")).showSuggestionAfterError();
 program.addHelpText("after", "\n  -V, --version  output the version number\n");
 registerDescribeCommand(program);
 registerLanguageCommand(program);
 registerTilesetCommands(program, { defaultApiUrl, loadAuthConfig });
 registerIconSetCommands(program, { defaultApiUrl, loadAuthConfig });
+registerModelCommands(program, { defaultApiUrl, loadAuthConfig });
 program.command("init").description("Create a starter tileflow.config.ts").option("-f, --force", "overwrite an existing config").action(async (options) => {
-  const configPath = resolve11(process.cwd(), defaultConfigPath);
-  const ignorePath = resolve11(process.cwd(), ".gitignore");
+  const configPath = resolve12(process.cwd(), defaultConfigPath);
+  const ignorePath = resolve12(process.cwd(), ".gitignore");
   if (existsSync(configPath) && !options.force) {
     logWarning(`${pathLabel(defaultConfigPath)} already exists.`);
     printNextSteps([`Run ${command("tileflow init --force")} to replace it.`]);
@@ -9245,9 +10007,9 @@ program.command("init").description("Create a starter tileflow.config.ts").optio
   }
   logSuccess(`Created ${pathLabel(defaultConfigPath)}.`);
   printKeyValue("Path", pathLabel(configPath));
-  printKeyValue("Map", pc6.bold("madrid"));
+  printKeyValue("Map", pc9.bold("madrid"));
   printNextSteps([
-    `Install ${pc6.cyan("@tileflow/core")} and ${pc6.cyan("@tileflow/maps")} in this project if needed.`,
+    `Install ${pc9.cyan("@tileflow/core")} and ${pc9.cyan("@tileflow/maps")} in this project if needed.`,
     `Preview locally with ${command("tileflow preview")}.`,
     `Validate the config with ${command("tileflow validate")}.`
   ]);
@@ -9383,12 +10145,12 @@ program.command("validate").description("Validate a Tileflow config").option("-c
     try {
       if (!options.json) logInfo(`Validating ${pathLabel(options.config)}.`);
       const loaded = await withTileflowConfigSecretsHidden(
-        () => loadTileflowConfigWithInputs4(options.config)
+        () => loadTileflowConfigWithInputs5(options.config)
       );
       const project = loaded.project;
-      const baseDirectory = dirname12(loaded.configFile);
+      const baseDirectory = dirname13(loaded.configFile);
       failureDefaults = { code: "CONFIG_INVALID", phase: "config-validation" };
-      assertValidTileflowConfig3(project);
+      assertValidTileflowConfig4(project);
       const mapNames = getTileflowMapNames5(project).sort();
       failureDefaults = { code: "ICON_COMPILATION_FAILED", phase: "icon-compilation" };
       const compiledIcons = await compileTileflowIconPackages3(project, {
@@ -9406,7 +10168,7 @@ program.command("validate").description("Validate a Tileflow config").option("-c
         (binding) => options.target === "hosted" ? `${normalizeUrl(options.apiBaseUrl)}/sprites/preflight/${binding.packageHash}/sprite` : `/tileflow/icons/${binding.mapName}/sprite`,
         mapAssetsWithBuildingModels(
           modelAssets,
-          (mapName) => options.target === "hosted" ? `${normalizeUrl(options.apiBaseUrl)}/model-bundles/preflight` : `/tileflow/models/${mapName}`
+          options.target === "hosted" ? { hosted: true } : { localBase: (mapName) => `/tileflow/models/${mapName}` }
         )
       );
       failureDefaults = { code: "STYLE_INVALID", phase: "style-validation" };
@@ -9526,7 +10288,7 @@ program.command("build").description("Generate static Tileflow styles").option("
       })
     );
     logSuccess("Built Tileflow artifacts.");
-    printKeyValue("Output", pathLabel(resolve11(process.cwd(), options.out)));
+    printKeyValue("Output", pathLabel(resolve12(process.cwd(), options.out)));
   }
 );
 program.command("preview").description("Open Map DevTools with inspection and optional comparison").option("-c, --config <path>", "config path", defaultConfigPath).option("--against-config <path>", "second config for live comparison in Map DevTools").option("--against-map <name>", "map on the right; defaults to --map").option("--against-scene <name>", "committed standalone scene on the right").option("--against-theme <name>", "concrete theme on the right; defaults to --theme").option("--host <host>", "bind host: an explicit IP address or localhost", defaultTileflowDevHost).option("--map <name>", "preview one configured map").option("--theme <name>", "preview one concrete theme; defaults to the map default").option("--renderer <renderer>", "artifact renderer: web or native", "web").option("-p, --port <port>", "preview port", "3333").option("--no-open", "start Map DevTools without opening the browser").option("--scene <name>", "preview one committed standalone map scene").option(
@@ -9814,12 +10576,17 @@ program.command("preview").description("Open Map DevTools with inspection and op
     });
   }
 );
-program.command("deploy").description("Deploy maps to Tileflow and write the frontend manifest").option("-c, --config <path>", "config path", defaultConfigPath).option("--manifest <path>", "manifest path written for frontend bundlers", defaultManifestPath).option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--api-key <key>", "Tileflow API key", process.env.TILEFLOW_API_KEY).option("--map-id <id>", "managed Map destination").option("--with-native", "publish web and native-v1 together for the selected managed Map").option("--map <name>", "configured map to connect when the repository contains multiple maps").option(
+addMapSetupOptions(
+  program.command("deploy").description(
+    "Deploy maps to Tileflow and write the frontend manifest; without --map-id, create the Map first"
+  )
+).option("-c, --config <path>", "config path", defaultConfigPath).option("--manifest <path>", "manifest path written for frontend bundlers", defaultManifestPath).option("--api-url <url>", "Tileflow API URL", process.env.TILEFLOW_API_URL).option("--api-key <key>", "Tileflow API key", process.env.TILEFLOW_API_KEY).option("--map-id <id>", "managed Map destination; omit it to create a new Map").option("--with-native", "publish web and native-v1 together for the selected managed Map").option("--map <name>", "configured map to connect when the repository contains multiple maps").option(
   "--overwrite-self-hosted-manifest",
   "explicitly replace an existing self-hosted manifest at --manifest"
 ).option("--cache-dir <path>", "verified Icon Set artifact cache root").option("--offline", "fail a locked Icon Set cache miss instead of hydrating it").action(
   async (options) => {
     const source = resolveDeploySource(process.env);
+    if (!validateMapSetupTarget(options, source)) return;
     const resolveApi = () => requireApiOptions(options, {
       allowStoredCredential: allowsStoredDeployCredential(source),
       assertExplicitKeyMap: true,
@@ -9839,7 +10606,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       );
       if (result) {
         logSuccess(
-          `${result.changed ? "Published" : "Unchanged"} ${pc6.bold(result.mapName)} web + native-v1 (v${result.version}).`
+          `${result.changed ? "Published" : "Unchanged"} ${pc9.bold(result.mapName)} web + native-v1 (v${result.version}).`
         );
         printKeyValue("Manifest", pathLabel(result.manifestPath));
         printKeyValue("Native", link(result.nativeManifestUrl));
@@ -9848,11 +10615,11 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
     }
     logInfo(`Deploying ${pathLabel(options.config)}.`);
     const loaded = await withTileflowConfigSecretsHidden(
-      () => loadTileflowConfigWithInputs4(options.config)
+      () => loadTileflowConfigWithInputs5(options.config)
     );
     const project = loaded.project;
-    const baseDirectory = dirname12(loaded.configFile);
-    assertValidTileflowConfig3(project);
+    const baseDirectory = dirname13(loaded.configFile);
+    assertValidTileflowConfig4(project);
     const configuredMapNames = getTileflowMapNames5(project);
     const mapNames = selectManagedDeployMaps(configuredMapNames, options);
     if (!mapNames) return;
@@ -9883,7 +10650,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
     const preflightMapAssets = createCompiledMapAssets(
       compiledIcons,
       (binding) => `${apiUrl}/sprites/preflight/${binding.packageHash}/sprite`,
-      mapAssetsWithBuildingModels(modelAssets, () => `${apiUrl}/model-bundles/preflight`)
+      mapAssetsWithBuildingModels(modelAssets, { hosted: true })
     );
     const compiledPreflightStyles = createTileflowStyles2(deploymentProject, {
       apiBaseUrl: apiUrl,
@@ -9934,6 +10701,21 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       return;
     }
     const existingManifest = outputManifest;
+    let createdMapId = null;
+    if (!options.mapId) {
+      const deployedMapId2 = existingManifest?.maps[mapNames[0]]?.mapId;
+      if (deployedMapId2) {
+        logError(`${pc9.bold(mapNames[0])} is already deployed to ${deployedMapId2}.`);
+        printNextSteps([
+          `Deploy it again with ${command(`tileflow deploy --map-id ${deployedMapId2}`)}.`
+        ]);
+        process.exitCode = 1;
+        return;
+      }
+      createdMapId = await createMapForDeploy(options, { defaultApiUrl, loadAuthConfig });
+      if (!createdMapId) return;
+      options.mapId = createdMapId;
+    }
     const api = await resolveApi();
     if (!api) return;
     const hostedSpriteByPackageHash = /* @__PURE__ */ new Map();
@@ -9953,29 +10735,10 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       );
       const action = uploaded.value.changed === false ? "Reused" : "Uploaded";
       logSuccess(
-        `${action} icon package ${pc6.bold(binding?.label ?? "Icons")} (${plural(iconPackage.manifest.iconNames.length, "icon")}, ${formatBytes3(totalBytes)}, ${iconPackage.contentHash.slice(0, 12)}).`
+        `${action} icon package ${pc9.bold(binding?.label ?? "Icons")} (${plural(iconPackage.manifest.iconNames.length, "icon")}, ${formatBytes4(totalBytes)}, ${iconPackage.contentHash.slice(0, 12)}).`
       );
       hostedSpriteByPackageHash.set(iconPackage.contentHash, uploaded.value.spriteUrl);
     }
-    const hostedModelBaseByHash = /* @__PURE__ */ new Map();
-    const uniqueModelBundles = [
-      ...new Map(
-        Object.values(modelAssets.bundles).map((bundle) => [bundle.contentHash, bundle])
-      ).values()
-    ].sort((left, right) => left.contentHash.localeCompare(right.contentHash));
-    for (const bundle of uniqueModelBundles) {
-      const uploaded = await uploadHostedModelBundle(api, bundle);
-      if (!uploaded.ok) {
-        logError(`Model bundle upload failed: ${uploaded.status}.`);
-        process.exitCode = 1;
-        return;
-      }
-      const action = uploaded.value.changed === false ? "Reused" : "Uploaded";
-      logSuccess(
-        `${action} 3D model bundle (${plural(bundle.manifest.models.length, "model")}, ${formatBytes3(uploaded.value.totalBytes)}, ${bundle.contentHash.slice(0, 12)}).`
-      );
-      hostedModelBaseByHash.set(bundle.contentHash, uploaded.value.baseUrl);
-    }
     const hostedMapAssets = createCompiledMapAssets(
       compiledIcons,
       (binding) => {
@@ -9983,11 +10746,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
         if (!sprite) throw new Error(`Missing hosted sprite URL for map ${binding.mapName}`);
         return sprite;
       },
-      mapAssetsWithBuildingModels(modelAssets, (mapName, bundle) => {
-        const base = hostedModelBaseByHash.get(bundle.contentHash);
-        if (!base) throw new Error(`Missing hosted model bundle URL for map ${mapName}.`);
-        return base;
-      })
+      mapAssetsWithBuildingModels(modelAssets, { hosted: true })
     );
     const compiledHostedStyles = createTileflowStyles2(deploymentProject, {
       apiBaseUrl: api.apiUrl,
@@ -10028,7 +10787,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       }
       const action = uploaded.value.changed === false ? "Reused" : "Uploaded";
       logSuccess(
-        `${action} font bundle (${plural(bundle.manifest.fontFaces.length, "face")}, ${formatBytes3(uploaded.value.totalBytes)}, ${bundle.contentHash.slice(0, 12)}).`
+        `${action} font bundle (${plural(bundle.manifest.fontFaces.length, "face")}, ${formatBytes4(uploaded.value.totalBytes)}, ${bundle.contentHash.slice(0, 12)}).`
       );
       hostedFontBaseByHash.set(bundle.contentHash, uploaded.value.baseUrl);
     }
@@ -10078,12 +10837,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
                   fileName: `icons/${mapName}/${file.fileName}`,
                   source: file.source
                 })),
-                ...hostedFonts.bundles[mapName]?.files ?? [],
-                ...(modelAssets.bundles[mapName]?.files ?? []).map((file) => ({
-                  contentType: file.contentType,
-                  fileName: `models/${mapName}/${file.fileName}`,
-                  source: file.source
-                }))
+                ...hostedFonts.bundles[mapName]?.files ?? []
               ],
               lineage: deploymentProject.mapMetadata?.[mapName]?.lineage ?? [
                 { id: map.id, mapVersion: map.version }
@@ -10093,7 +10847,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
                 fonts: hostedFonts.sourceIdentities[mapName] ?? [],
                 icons: compiledIcons.sourceIdentities[mapName] ?? [],
                 ...compiledIcons.compositions[mapName] ? { iconComposition: compiledIcons.compositions[mapName] } : {},
-                ...modelAssets.identities[mapName] ? { models: modelAssets.identities[mapName] } : {}
+                ...hostedModelSourceIdentities(modelAssets, mapName) ? { models: hostedModelSourceIdentities(modelAssets, mapName) } : {}
               },
               styles: styles[mapName]
             }
@@ -10106,13 +10860,13 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       const iconBinding = bindingsByMap.get(mapName);
       const iconPackage = iconBinding ? packagesByHash.get(iconBinding.packageHash) : void 0;
       const fontBundle = hostedFonts.bundles[mapName];
-      const modelBundle = modelAssets.bundles[mapName];
+      const modelSources = teamModelSources(modelAssets, mapName);
       return {
         iconBinding,
         iconComposition: compiledIcons.compositions[mapName],
         iconPackage,
         fontBundle,
-        modelBundle,
+        modelSources,
         mapName,
         teamSources: hostedThemeFamilies[mapName].teamSources,
         buildManifest: {
@@ -10132,7 +10886,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
         iconComposition,
         iconPackage,
         mapName,
-        modelBundle,
+        modelSources,
         teamSources,
         styles: themeStyles
       } = deployment;
@@ -10143,7 +10897,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       }
       const themeNames = Object.keys(themeStyles).sort();
       logInfo(
-        `Deploying compiled map ${pc6.bold(mapName)} (${plural(themeNames.length, "theme")}).`
+        `Deploying compiled map ${pc9.bold(mapName)} (${plural(themeNames.length, "theme")}).`
       );
       const response = await publishHostedStyle(
         api,
@@ -10167,7 +10921,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
           } : {},
           ...iconComposition ? { iconComposition } : {},
           ...fontBundle ? { fontBundle: { contentHash: fontBundle.contentHash } } : {},
-          ...modelBundle ? { modelBundle: { contentHash: modelBundle.contentHash } } : {},
+          ...modelSources ? { teamModelSources: modelSources } : {},
           source
         },
         `Deploy response for ${mapName}`
@@ -10225,9 +10979,15 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
       };
       const versionLabel = Number.isInteger(body.version) ? ` (v${body.version})` : "";
       if (body.changed === false) {
-        logSuccess(`Unchanged ${pc6.bold(mapName)}${versionLabel}.`);
+        logSuccess(`Unchanged ${pc9.bold(mapName)}${versionLabel}.`);
       } else {
-        logSuccess(`Published ${pc6.bold(mapName)}${versionLabel}.`);
+        logSuccess(`Published ${pc9.bold(mapName)}${versionLabel}.`);
+      }
+      for (const teamModel of body.teamModels ?? []) {
+        if (teamModel.sources !== "differ") continue;
+        logWarning(
+          `3D model ${pc9.bold(teamModel.model)} draws its published version ${teamModel.version}, which was not prepared from this project's files. Run \`tileflow models publish\` to publish them.`
+        );
       }
     }
     const manifestPath = await writeDeployManifest(options.manifest, {
@@ -10243,6 +11003,7 @@ program.command("deploy").description("Deploy maps to Tileflow and write the fro
     const deployedMapId = Object.values(deployedMaps)[0]?.mapId;
     if (deployedMapId) {
       printNextSteps([
+        ...createdMapId ? [`Deploy later changes with ${command(`tileflow deploy --map-id ${createdMapId}`)}.`] : [],
         `Check hosted state with ${command(`tileflow status --map-id ${deployedMapId}`)}.`
       ]);
     }
@@ -10343,6 +11104,7 @@ registerProjectCommands(program, {
   defaultApiUrl,
   loadAuthConfig
 });
+registerMapCommands(program, { defaultApiUrl, loadAuthConfig });
 if (isRootCliVersionRequest(process.argv.slice(2))) {
   process.stdout.write(`${packageJson.version}
 `);
@@ -10589,12 +11351,12 @@ async function runTileflowComparisonPreview(options, address) {
 }
 function comparisonCaptureConfigArgument(configPath) {
   const cwd = realpathSync(process.cwd());
-  const requestedConfigPath = resolve11(process.cwd(), configPath);
-  const defaultRequestedPath = resolve11(process.cwd(), defaultConfigPath);
+  const requestedConfigPath = resolve12(process.cwd(), configPath);
+  const defaultRequestedPath = resolve12(process.cwd(), defaultConfigPath);
   const absoluteConfigPath = existsSync(requestedConfigPath) ? realpathSync(requestedConfigPath) : requestedConfigPath;
   const absoluteDefaultPath = existsSync(defaultRequestedPath) ? realpathSync(defaultRequestedPath) : defaultRequestedPath;
   if (absoluteConfigPath === absoluteDefaultPath) return void 0;
-  const relativeConfigPath = relative5(cwd, absoluteConfigPath);
+  const relativeConfigPath = relative6(cwd, absoluteConfigPath);
   if (relativeConfigPath === "" || relativeConfigPath === ".." || relativeConfigPath.startsWith(`..${sep5}`) || isAbsolute5(relativeConfigPath)) {
     throw new Error(
       "Comparison configs must be inside the current working directory so Copy command can remain reproducible."
@@ -10634,17 +11396,17 @@ async function loginWithDeviceFlow(options) {
     codeChallenge,
     deviceName: hostname()
   });
-  printKeyValue("Code", pc6.bold(authorization.userCode));
+  printKeyValue("Code", pc9.bold(authorization.userCode));
   printKeyValue("URL", link(authorization.verificationUriComplete));
   if (options.noBrowser) {
     logMuted("Open the URL above to continue.");
   } else if (process.stdin.isTTY) {
-    const readline = createInterface({
+    const readline = createInterface2({
       input: process.stdin,
       output: process.stdout
     });
     try {
-      await readline.question(`${pc6.cyan("?")} Press Enter to open Tileflow Dashboard...`);
+      await readline.question(`${pc9.cyan("?")} Press Enter to open Tileflow Dashboard...`);
       openBrowser(authorization.verificationUriComplete);
     } finally {
       readline.close();
@@ -10681,7 +11443,7 @@ function createPkceChallenge(verifier) {
   return createHash4("sha256").update(verifier).digest("base64url");
 }
 function randomBase64Url(byteLength) {
-  return randomBytes2(byteLength).toString("base64url");
+  return randomBytes3(byteLength).toString("base64url");
 }
 function openBrowser(url, errorsToStderr = false) {
   openTileflowExternal(url, {
@@ -10695,9 +11457,9 @@ function openBrowser(url, errorsToStderr = false) {
   });
 }
 async function writeDeployManifest(manifestPath, manifest) {
-  const outputPath = resolve11(process.cwd(), manifestPath);
+  const outputPath = resolve12(process.cwd(), manifestPath);
   await writeAtomicFile({
-    boundaryPath: dirname12(outputPath),
+    boundaryPath: dirname13(outputPath),
     force: true,
     label: "Deploy manifest",
     managed: true,
@@ -10733,11 +11495,6 @@ function createCompiledMapAssets(compiled, resolveSprite, modelAssets) {
   };
 }
 function selectManagedDeployMaps(mapNames, options) {
-  if (options.map && !options.mapId) {
-    logError("--map requires --map-id.");
-    process.exitCode = 1;
-    return null;
-  }
   if (options.map) {
     if (!mapNames.includes(options.map)) {
       logError(`Unknown Tileflow map: ${options.map}.`);
@@ -10747,24 +11504,40 @@ function selectManagedDeployMaps(mapNames, options) {
     }
     return [options.map];
   }
-  if (!options.mapId) return mapNames;
   if (mapNames.length === 1) return [mapNames[0]];
   logError(
     "This managed target requires an explicit map because the config contains multiple maps."
   );
   printKeyValue("Maps", mapNames.join(", "));
   printNextSteps([
-    `Retry with ${command(`tileflow deploy --map-id ${options.mapId} --map ${mapNames[0]}`)}.`
+    `Retry with ${command(`tileflow deploy ${options.mapId ? `--map-id ${options.mapId} ` : ""}--map ${mapNames[0]}`)}.`
   ]);
   process.exitCode = 1;
   return null;
 }
-function validateDeployTarget(options) {
-  if (!options.mapId) {
-    logError("Managed deploy requires --map-id.");
+function validateMapSetupTarget(options, source) {
+  const fail = (message, steps = []) => {
+    logError(message);
+    printNextSteps(steps);
     process.exitCode = 1;
     return false;
+  };
+  if (options.mapId) {
+    return hasMapSetupOptions(options) ? fail(
+      "--team, --origin, --any-website and --setup-key apply only when deploy creates a Map."
+    ) : true;
+  }
+  const createFirst = `Create the Map with ${command("tileflow maps create")} after ${command("tileflow login")}, then pass --map-id.`;
+  if (options.withNative) return fail("--with-native requires one valid --map-id.", [createFirst]);
+  if (options.apiKey || !allowsStoredDeployCredential(source)) {
+    return fail("Managed deploy with a Tileflow credential or in CI requires --map-id.", [
+      createFirst
+    ]);
   }
+  const checked = checkMapSetupOptions(options);
+  return checked.ok ? true : fail(checked.error);
+}
+function validateDeployTarget(options) {
   if (options.mapId && !/^map_[A-Za-z0-9_-]{16}$/u.test(options.mapId)) {
     logError("Managed Map ID is invalid.");
     process.exitCode = 1;
@@ -10785,7 +11558,7 @@ function validateDeployManifestMapNames(mapNames) {
 async function loadExistingDeployManifest(manifestPath, options) {
   let source;
   try {
-    source = await readFile7(resolve11(process.cwd(), manifestPath), "utf8");
+    source = await readFile7(resolve12(process.cwd(), manifestPath), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw new Error("Existing Tileflow manifest could not be read.");
@@ -10845,7 +11618,7 @@ async function requireApiOptions(options, behavior = {}) {
     if (!behavior.silent) {
       logError("CI requires an explicit Tileflow credential with access to the target Map.");
       printNextSteps([
-        `Set ${pc6.cyan("TILEFLOW_API_KEY")} from the CI secret store.`,
+        `Set ${pc9.cyan("TILEFLOW_API_KEY")} from the CI secret store.`,
         "The saved personal account session is never used in CI."
       ]);
     }
@@ -10914,17 +11687,17 @@ function printCliError(error) {
   }
   const message = error instanceof Error ? error.message : "Command failed.";
   if (message.includes("Cannot find module '@tileflow/core'")) {
-    logError(`Cannot load ${pc6.cyan("@tileflow/core")} from this project.`);
+    logError(`Cannot load ${pc9.cyan("@tileflow/core")} from this project.`);
     printNextSteps([
-      `Install ${pc6.cyan("@tileflow/core")} in this project.`,
+      `Install ${pc9.cyan("@tileflow/core")} in this project.`,
       `Run the command again from the project root.`
     ]);
     return;
   }
   if (message.includes("Cannot find module '@tileflow/maps'")) {
-    logError(`Cannot load ${pc6.cyan("@tileflow/maps")} from this project.`);
+    logError(`Cannot load ${pc9.cyan("@tileflow/maps")} from this project.`);
     printNextSteps([
-      `Install ${pc6.cyan("@tileflow/maps")} in this project.`,
+      `Install ${pc9.cyan("@tileflow/maps")} in this project.`,
       `Run the command again from the project root.`
     ]);
     return;
@@ -10935,51 +11708,51 @@ function printCliError(error) {
   }
 }
 function logSuccess(message) {
-  console.log(`${pc6.green("\u2713")} ${message}`);
+  console.log(`${pc9.green("\u2713")} ${message}`);
 }
 function logError(message) {
-  console.log(`${pc6.red("\u2715")} ${message}`);
+  console.log(`${pc9.red("\u2715")} ${message}`);
 }
 function logWarning(message) {
-  console.log(`${pc6.yellow("!")} ${message}`);
+  console.log(`${pc9.yellow("!")} ${message}`);
 }
 function logInfo(message) {
-  console.log(`${pc6.cyan("i")} ${message}`);
+  console.log(`${pc9.cyan("i")} ${message}`);
 }
 function logMuted(message) {
-  console.log(pc6.gray(message));
+  console.log(pc9.gray(message));
 }
 function printTitle(title, subtitle) {
-  console.log(pc6.bold(title));
+  console.log(pc9.bold(title));
   if (subtitle) {
-    console.log(pc6.gray(subtitle));
+    console.log(pc9.gray(subtitle));
   }
 }
 function printKeyValue(label, value) {
-  console.log(`${pc6.gray(`${label}:`.padEnd(13))} ${value}`);
+  console.log(`${pc9.gray(`${label}:`.padEnd(13))} ${value}`);
 }
 function printChecks(items) {
   for (const item of items) {
-    console.log(`  ${pc6.green("\u2713")} ${item}`);
+    console.log(`  ${pc9.green("\u2713")} ${item}`);
   }
 }
 function printNextSteps(steps) {
   if (steps.length === 0) return;
   console.log(`
-${pc6.bold("Next steps")}`);
+${pc9.bold("Next steps")}`);
   for (const step of steps) {
-    console.log(`  ${pc6.cyan("\u2022")} ${step}`);
+    console.log(`  ${pc9.cyan("\u2022")} ${step}`);
   }
 }
 function printValidationErrors(messages) {
   logError("Tileflow config has errors.");
   for (const message of messages) {
-    const path = message.path ? pc6.cyan(message.path) : pc6.cyan("(root)");
-    console.log(`  ${pc6.red("\u2715")} ${path} ${pc6.gray("-")} ${message.message}`);
+    const path = message.path ? pc9.cyan(message.path) : pc9.cyan("(root)");
+    console.log(`  ${pc9.red("\u2715")} ${path} ${pc9.gray("-")} ${message.message}`);
   }
 }
 function printAccountDetails(session) {
-  printKeyValue("Account", pc6.bold(session.account.name));
+  printKeyValue("Account", pc9.bold(session.account.name));
   printKeyValue("Email", session.account.email);
   printKeyValue("API", link(session.apiOrigin));
   printKeyValue("Expires", formatDate(session.expiresAt));
@@ -11008,11 +11781,11 @@ function printDeployedMaps(maps) {
   const entries = Object.entries(maps);
   if (entries.length === 0) return;
   console.log(`
-${pc6.bold("Maps")}`);
+${pc9.bold("Maps")}`);
   for (const [name, map] of entries) {
     for (const [themeName, theme] of Object.entries(map.themes)) {
       const label = `${name}/${themeName}`;
-      console.log(`  ${pc6.green("\u2713")} ${label.padEnd(24)} ${link(theme.styleUrl)}`);
+      console.log(`  ${pc9.green("\u2713")} ${label.padEnd(24)} ${link(theme.styleUrl)}`);
     }
   }
 }
@@ -11030,13 +11803,13 @@ function plural(count, singular, pluralForm = `${singular}s`) {
   return `${count} ${count === 1 ? singular : pluralForm}`;
 }
 function command(value) {
-  return pc6.cyan(value);
+  return pc9.cyan(value);
 }
 function link(value) {
-  return pc6.cyan(value);
+  return pc9.cyan(value);
 }
 function pathLabel(value) {
-  return pc6.cyan(value);
+  return pc9.cyan(value);
 }
 function starterConfig() {
   return `import { defineMap, defineTheme, labels, poi } from "@tileflow/core";
@@ -11082,19 +11855,19 @@ function printHostedCompatibilityIssues(issues) {
 }
 function printMapStatus(status, apiUrl) {
   printTitle("Tileflow status");
-  printKeyValue("Map", pc6.bold(status.mapId));
+  printKeyValue("Map", pc9.bold(status.mapId));
   console.log(`
-${pc6.bold("Styles")}`);
+${pc9.bold("Styles")}`);
   if (status.styles.length === 0) {
     logMuted("  No styles deployed.");
   }
   for (const style of status.styles) {
     console.log(
-      `  ${pc6.green("\u2713")} ${style.environment.padEnd(16)} ${link(`${apiUrl}/maps/${style.mapId}/style.json`).padEnd(36)} ${formatBytes3(style.size).padStart(10)}  ${pc6.gray(formatDate(style.uploaded))}`
+      `  ${pc9.green("\u2713")} ${style.environment.padEnd(16)} ${link(`${apiUrl}/maps/${style.mapId}/style.json`).padEnd(36)} ${formatBytes4(style.size).padStart(10)}  ${pc9.gray(formatDate(style.uploaded))}`
     );
   }
 }
-function formatBytes3(bytes) {
+function formatBytes4(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   const units = ["KB", "MB", "GB", "TB"];
   let value = bytes;