diff --git a/.changeset/sync-makeswift-1-9-0.md b/.changeset/sync-makeswift-1-9-0.md
new file mode 100644
index 0000000000..480e96c25c
--- /dev/null
+++ b/.changeset/sync-makeswift-1-9-0.md
@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-b2b-makeswift": minor
+---
+
+Pulls in changes from the `@bigcommerce/catalyst-makeswift@1.9.0` release. For more information, see the [changelog entry](https://github.com/bigcommerce/catalyst/blob/da09e6304d1467ac6193f4d5eb07107a8933e0dc/core/CHANGELOG.md#190).
diff --git a/core/.gitignore b/core/.gitignore
index f4086e9252..12fd47d6ed 100644
--- a/core/.gitignore
+++ b/core/.gitignore
@@ -54,3 +54,6 @@ build-config.json
 # OpenNext
 .open-next
 .wrangler
+
+# Catalyst CLI config
+.bigcommerce
diff --git a/core/app/[locale]/(default)/(faceted)/category/[slug]/page-data.ts b/core/app/[locale]/(default)/(faceted)/category/[slug]/page-data.ts
index ac42d67c47..f48f9c83c6 100644
--- a/core/app/[locale]/(default)/(faceted)/category/[slug]/page-data.ts
+++ b/core/app/[locale]/(default)/(faceted)/category/[slug]/page-data.ts
@@ -13,6 +13,7 @@ const CategoryPageQuery = graphql(
           entityId
           name
           path
+          defaultProductSort
           ...BreadcrumbsFragment
           seo {
             pageTitle
diff --git a/core/app/[locale]/(default)/(faceted)/category/[slug]/page.tsx b/core/app/[locale]/(default)/(faceted)/category/[slug]/page.tsx
index 14ec86b128..fc25177749 100644
--- a/core/app/[locale]/(default)/(faceted)/category/[slug]/page.tsx
+++ b/core/app/[locale]/(default)/(faceted)/category/[slug]/page.tsx
@@ -133,6 +133,11 @@ export default async function Category(props: Props) {
 
   const taxDisplay = settings?.tax?.plp;
 
+  const categoryDefaultSort =
+    category.defaultProductSort && category.defaultProductSort !== 'DEFAULT'
+      ? category.defaultProductSort.toLowerCase()
+      : 'featured';
+
   const streamableFacetedSearch = Streamable.from(async () => {
     const searchParams = await props.searchParams;
     const currencyCode = await getPreferredCurrencyCode();
@@ -142,12 +147,14 @@ export default async function Category(props: Props) {
       customerAccessToken,
     );
     const parsedSearchParams = loadSearchParams?.(searchParams) ?? {};
+    const sort = typeof searchParams.sort === 'string' ? searchParams.sort : categoryDefaultSort;
 
     const search = await fetchFacetedSearch(
       {
         ...searchParams,
         ...parsedSearchParams,
         category: categoryId,
+        sort,
       },
       currencyCode,
       customerAccessToken,
@@ -279,7 +286,7 @@ export default async function Category(props: Props) {
         resetFiltersLabel={t('FacetedSearch.resetFilters')}
         showCompare={productComparisonsEnabled}
         showRating={showRating}
-        sortDefaultValue="featured"
+        sortDefaultValue={categoryDefaultSort}
         sortLabel={t('SortBy.sortBy')}
         sortOptions={[
           { value: 'featured', label: t('SortBy.featuredItems') },
diff --git a/core/app/[locale]/(default)/(faceted)/fetch-faceted-search.ts b/core/app/[locale]/(default)/(faceted)/fetch-faceted-search.ts
index 115d639d1c..49de0bc818 100644
--- a/core/app/[locale]/(default)/(faceted)/fetch-faceted-search.ts
+++ b/core/app/[locale]/(default)/(faceted)/fetch-faceted-search.ts
@@ -189,7 +189,11 @@ const getProductSearchResults = cache(
 
     const response = await client.fetch({
       document: GetProductSearchResultsQuery,
-      variables: { ...filterArgs, ...paginationArgs, currencyCode },
+      variables: {
+        ...filterArgs,
+        ...paginationArgs,
+        currencyCode,
+      },
       customerAccessToken,
       fetchOptions: customerAccessToken ? { cache: 'no-store' } : { next: { revalidate: 300 } },
     });
diff --git a/core/app/[locale]/(default)/(faceted)/search/page-data.ts b/core/app/[locale]/(default)/(faceted)/search/page-data.ts
index d81561a54a..60a650b59e 100644
--- a/core/app/[locale]/(default)/(faceted)/search/page-data.ts
+++ b/core/app/[locale]/(default)/(faceted)/search/page-data.ts
@@ -27,6 +27,9 @@ const SearchPageQuery = graphql(`
         tax {
           plp
         }
+        search {
+          defaultSearchProductSort
+        }
       }
     }
   }
diff --git a/core/app/[locale]/(default)/(faceted)/search/page.tsx b/core/app/[locale]/(default)/(faceted)/search/page.tsx
index a6192437d4..41aed16879 100644
--- a/core/app/[locale]/(default)/(faceted)/search/page.tsx
+++ b/core/app/[locale]/(default)/(faceted)/search/page.tsx
@@ -88,6 +88,8 @@ export default async function Search(props: Props) {
 
   const taxDisplay = settings?.tax?.plp;
 
+  const defaultProductSort = settings?.search.defaultSearchProductSort;
+
   const streamableFacetedSearch = Streamable.from(async () => {
     const searchParams = await props.searchParams;
     const customerAccessToken = await getSessionCustomerAccessToken();
@@ -98,11 +100,13 @@ export default async function Search(props: Props) {
       customerAccessToken,
     );
     const parsedSearchParams = loadSearchParams?.(searchParams) ?? {};
+    const sort = typeof searchParams.sort === 'string' ? searchParams.sort : defaultProductSort;
 
     const search = await fetchFacetedSearch(
       {
         ...searchParams,
         ...parsedSearchParams,
+        sort,
       },
       currencyCode,
       customerAccessToken,
@@ -261,7 +265,7 @@ export default async function Search(props: Props) {
       resetFiltersLabel={t('FacetedSearch.resetFilters')}
       showCompare={productComparisonsEnabled}
       showRating={showRating}
-      sortDefaultValue="featured"
+      sortDefaultValue={defaultProductSort?.toLowerCase() ?? 'featured'}
       sortLabel={t('SortBy.sortBy')}
       sortOptions={[
         { value: 'featured', label: t('SortBy.featuredItems') },
diff --git a/core/app/[locale]/(default)/account/settings/_actions/update-customer.ts b/core/app/[locale]/(default)/account/settings/_actions/update-customer.ts
index 90f673bd55..e29148c9ed 100644
--- a/core/app/[locale]/(default)/account/settings/_actions/update-customer.ts
+++ b/core/app/[locale]/(default)/account/settings/_actions/update-customer.ts
@@ -5,11 +5,12 @@ import { parseWithZod } from '@conform-to/zod';
 import { revalidateTag } from 'next/cache';
 import { getTranslations } from 'next-intl/server';
 
+import { Field, FieldGroup } from '@/vibes/soul/form/dynamic-form/schema';
 import { updateAccountSchema } from '@/vibes/soul/sections/account-settings/schema';
-import { UpdateAccountAction } from '@/vibes/soul/sections/account-settings/update-account-form';
+import { State } from '@/vibes/soul/sections/account-settings/update-account-form';
 import { getSessionCustomerAccessToken } from '~/auth';
 import { client } from '~/client';
-import { graphql } from '~/client/graphql';
+import { graphql, VariablesOf } from '~/client/graphql';
 import { TAGS } from '~/client/tags';
 
 const UpdateCustomerMutation = graphql(`
@@ -19,6 +20,8 @@ const UpdateCustomerMutation = graphql(`
         customer {
           firstName
           lastName
+          email
+          company
         }
         errors {
           __typename
@@ -43,11 +46,81 @@ const UpdateCustomerMutation = graphql(`
   }
 `);
 
-export const updateCustomer: UpdateAccountAction = async (prevState, formData) => {
+type FormFieldsInput = NonNullable<
+  VariablesOf<typeof UpdateCustomerMutation>['input']['formFields']
+>;
+
+/*
+ * BigCommerce re-validates every required custom customer field on every updateCustomer call,
+ * even ones already satisfied by a prior save (see issue #3074) - so any required custom field
+ * rendered in the form must always be resent here, not just the ones the user actually changed.
+ */
+function buildFormFieldsInput(
+  fields: Array<Field | FieldGroup<Field>>,
+  value: Record<string, unknown>,
+): FormFieldsInput {
+  const flatFields = fields.flatMap((field) => (Array.isArray(field) ? field : [field]));
+
+  return {
+    checkboxes: flatFields
+      .filter((field) => field.type === 'checkbox-group')
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => {
+        const rawValue = value[field.name];
+        const rawValues = Array.isArray(rawValue) ? rawValue : [rawValue];
+
+        return {
+          fieldEntityId: Number(field.id),
+          fieldValueEntityIds: rawValues.map(Number),
+        };
+      }),
+    multipleChoices: flatFields
+      .filter((field) => ['radio-group', 'button-radio-group', 'select'].includes(field.type))
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => ({
+        fieldEntityId: Number(field.id),
+        fieldValueEntityId: Number(value[field.name]),
+      })),
+    numbers: flatFields
+      .filter((field) => field.type === 'number')
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => ({
+        fieldEntityId: Number(field.id),
+        number: Number(value[field.name]),
+      })),
+    dates: flatFields
+      .filter((field) => field.type === 'date')
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => ({
+        fieldEntityId: Number(field.id),
+        date: new Date(String(value[field.name])).toISOString(),
+      })),
+    multilineTexts: flatFields
+      .filter((field) => field.type === 'textarea')
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => ({
+        fieldEntityId: Number(field.id),
+        multilineText: String(value[field.name]),
+      })),
+    texts: flatFields
+      .filter((field) => field.type === 'text' || field.type === 'email')
+      .filter((field) => Boolean(value[field.name]))
+      .map((field) => ({
+        fieldEntityId: Number(field.id),
+        text: String(value[field.name]),
+      })),
+  };
+}
+
+export async function updateCustomer(
+  { fields }: { fields: Array<Field | FieldGroup<Field>> },
+  prevState: Awaited<State>,
+  formData: FormData,
+): Promise<State> {
   const t = await getTranslations('Account.Settings');
   const customerAccessToken = await getSessionCustomerAccessToken();
 
-  const submission = parseWithZod(formData, { schema: updateAccountSchema });
+  const submission = parseWithZod(formData, { schema: updateAccountSchema(fields) });
 
   if (submission.status !== 'success') {
     return {
@@ -56,12 +129,20 @@ export const updateCustomer: UpdateAccountAction = async (prevState, formData) =
     };
   }
 
+  const { firstName, lastName, email, company, ...customFieldValues } = submission.value;
+
   try {
     const response = await client.fetch({
       document: UpdateCustomerMutation,
       customerAccessToken,
       variables: {
-        input: submission.value,
+        input: {
+          firstName,
+          lastName,
+          email,
+          company,
+          formFields: buildFormFieldsInput(fields, customFieldValues),
+        },
       },
       fetchOptions: { cache: 'no-store' },
     });
@@ -107,4 +188,4 @@ export const updateCustomer: UpdateAccountAction = async (prevState, formData) =
       lastResult: submission.reply({ formErrors: [t('somethingWentWrong')] }),
     };
   }
-};
+}
diff --git a/core/app/[locale]/(default)/account/settings/page-data.tsx b/core/app/[locale]/(default)/account/settings/page-data.tsx
index 136ef5c991..737dfc0d16 100644
--- a/core/app/[locale]/(default)/account/settings/page-data.tsx
+++ b/core/app/[locale]/(default)/account/settings/page-data.tsx
@@ -4,7 +4,10 @@ import { getSessionCustomerAccessToken } from '~/auth';
 import { client } from '~/client';
 import { graphql, VariablesOf } from '~/client/graphql';
 import { TAGS } from '~/client/tags';
-import { FormFieldsFragment } from '~/data-transformers/form-field-transformer/fragment';
+import {
+  FormFieldsFragment,
+  FormFieldValuesFragment,
+} from '~/data-transformers/form-field-transformer/fragment';
 
 const AccountSettingsQuery = graphql(
   `
@@ -21,6 +24,9 @@ const AccountSettingsQuery = graphql(
         lastName
         company
         isSubscribedToNewsletter
+        formFields {
+          ...FormFieldValuesFragment
+        }
       }
       site {
         settings {
@@ -50,7 +56,7 @@ const AccountSettingsQuery = graphql(
       }
     }
   `,
-  [FormFieldsFragment],
+  [FormFieldsFragment, FormFieldValuesFragment],
 );
 
 type Variables = VariablesOf<typeof AccountSettingsQuery>;
@@ -96,6 +102,7 @@ export const getAccountSettingsQuery = cache(async ({ address, customer }: Props
   return {
     addressFields,
     customerFields,
+    customerFormFieldValues: customerInfo.formFields,
     customerInfo,
     newsletterSettings,
     passwordComplexitySettings,
diff --git a/core/app/[locale]/(default)/account/settings/page.tsx b/core/app/[locale]/(default)/account/settings/page.tsx
index cad145dc6f..25c3fefe9e 100644
--- a/core/app/[locale]/(default)/account/settings/page.tsx
+++ b/core/app/[locale]/(default)/account/settings/page.tsx
@@ -3,13 +3,49 @@ import { Metadata } from 'next';
 import { notFound } from 'next/navigation';
 import { getTranslations, setRequestLocale } from 'next-intl/server';
 
+import { Field } from '@/vibes/soul/form/dynamic-form/schema';
 import { AccountSettingsSection } from '@/vibes/soul/sections/account-settings';
+import { formFieldTransformer } from '~/data-transformers/form-field-transformer';
+import {
+  ACCOUNT_SETTINGS_FIELDS_TO_EXCLUDE,
+  mapFormFieldValueToName,
+} from '~/data-transformers/form-field-transformer/utils';
+import { exists } from '~/lib/utils';
 
 import { changePassword } from './_actions/change-password';
 import { updateCustomer } from './_actions/update-customer';
 import { updateNewsletterSubscription } from './_actions/update-newsletter-subscription';
 import { getAccountSettingsQuery } from './page-data';
 
+function withDefaultValue(field: Field, value: unknown): Field {
+  if (field.type === 'checkbox-group') {
+    return { ...field, defaultValue: Array.isArray(value) ? value.map(String) : undefined };
+  }
+
+  if (typeof value !== 'string') {
+    return field;
+  }
+
+  switch (field.type) {
+    case 'radio-group':
+    case 'select':
+    case 'swatch-radio-group':
+    case 'card-radio-group':
+    case 'button-radio-group':
+    case 'checkbox':
+    case 'number':
+    case 'text':
+    case 'textarea':
+    case 'date':
+    case 'email':
+    case 'hidden':
+      return { ...field, defaultValue: value };
+
+    default:
+      return field;
+  }
+}
+
 interface Props {
   params: Promise<{ locale: string }>;
 }
@@ -47,6 +83,21 @@ export default async function Settings({ params }: Props) {
     },
   );
 
+  const customFieldValues = accountSettings.customerFormFieldValues.reduce<Record<string, unknown>>(
+    (acc, field) => ({ ...acc, ...mapFormFieldValueToName(field) }),
+    {},
+  );
+
+  const updateAccountCustomFields = accountSettings.customerFields
+    .filter((field) => !ACCOUNT_SETTINGS_FIELDS_TO_EXCLUDE.includes(field.entityId))
+    .map(formFieldTransformer)
+    .filter(exists)
+    .map((field) => withDefaultValue(field, customFieldValues[field.name]));
+
+  const updateCustomerWithFields = updateCustomer.bind(null, {
+    fields: updateAccountCustomFields,
+  });
+
   return (
     <AccountSettingsSection
       account={accountSettings.customerInfo}
@@ -63,7 +114,8 @@ export default async function Settings({ params }: Props) {
       newsletterSubscriptionTitle={t('NewsletterSubscription.title')}
       passwordComplexitySettings={accountSettings.passwordComplexitySettings}
       title={t('title')}
-      updateAccountAction={updateCustomer}
+      updateAccountAction={updateCustomerWithFields}
+      updateAccountCustomFields={updateAccountCustomFields}
       updateAccountSubmitLabel={t('cta')}
       updateNewsletterSubscriptionAction={updateNewsletterSubscriptionActionWithCustomerInfo}
     />
diff --git a/core/app/[locale]/(default)/cart/_actions/update-line-item.ts b/core/app/[locale]/(default)/cart/_actions/update-line-item.ts
index 2d01a290a8..a2d10c3d88 100644
--- a/core/app/[locale]/(default)/cart/_actions/update-line-item.ts
+++ b/core/app/[locale]/(default)/cart/_actions/update-line-item.ts
@@ -53,161 +53,9 @@ export const updateLineItem = async (
   }
 
   switch (submission.value.intent) {
-    case 'increment': {
-      const parsedSelectedOptions = cartLineItem.selectedOptions.reduce<CartSelectedOptionsInput>(
-        (accum, option) => {
-          let multipleChoicesOptionInput;
-          let checkboxOptionInput;
-          let numberFieldOptionInput;
-          let textFieldOptionInput;
-          let multiLineTextFieldOptionInput;
-          let dateFieldOptionInput;
-
-          switch (option.__typename) {
-            case 'CartSelectedMultipleChoiceOption':
-              multipleChoicesOptionInput = {
-                optionEntityId: option.entityId,
-                optionValueEntityId: option.valueEntityId,
-              };
-
-              if (accum.multipleChoices) {
-                return {
-                  ...accum,
-                  multipleChoices: [...accum.multipleChoices, multipleChoicesOptionInput],
-                };
-              }
-
-              return {
-                ...accum,
-                multipleChoices: [multipleChoicesOptionInput],
-              };
-
-            case 'CartSelectedCheckboxOption':
-              checkboxOptionInput = {
-                optionEntityId: option.entityId,
-                optionValueEntityId: option.valueEntityId,
-              };
-
-              if (accum.checkboxes) {
-                return {
-                  ...accum,
-                  checkboxes: [...accum.checkboxes, checkboxOptionInput],
-                };
-              }
-
-              return { ...accum, checkboxes: [checkboxOptionInput] };
-
-            case 'CartSelectedNumberFieldOption':
-              numberFieldOptionInput = {
-                optionEntityId: option.entityId,
-                number: option.number,
-              };
-
-              if (accum.numberFields) {
-                return {
-                  ...accum,
-                  numberFields: [...accum.numberFields, numberFieldOptionInput],
-                };
-              }
-
-              return { ...accum, numberFields: [numberFieldOptionInput] };
-
-            case 'CartSelectedTextFieldOption':
-              textFieldOptionInput = {
-                optionEntityId: option.entityId,
-                text: option.text,
-              };
-
-              if (accum.textFields) {
-                return {
-                  ...accum,
-                  textFields: [...accum.textFields, textFieldOptionInput],
-                };
-              }
-
-              return { ...accum, textFields: [textFieldOptionInput] };
-
-            case 'CartSelectedMultiLineTextFieldOption':
-              multiLineTextFieldOptionInput = {
-                optionEntityId: option.entityId,
-                text: option.text,
-              };
-
-              if (accum.multiLineTextFields) {
-                return {
-                  ...accum,
-                  multiLineTextFields: [
-                    ...accum.multiLineTextFields,
-                    multiLineTextFieldOptionInput,
-                  ],
-                };
-              }
-
-              return {
-                ...accum,
-                multiLineTextFields: [multiLineTextFieldOptionInput],
-              };
-
-            case 'CartSelectedDateFieldOption':
-              dateFieldOptionInput = {
-                optionEntityId: option.entityId,
-                date: new Date(String(option.date.utc)).toISOString(),
-              };
+    case 'update': {
+      const { quantity } = submission.value;
 
-              if (accum.dateFields) {
-                return {
-                  ...accum,
-                  dateFields: [...accum.dateFields, dateFieldOptionInput],
-                };
-              }
-
-              return { ...accum, dateFields: [dateFieldOptionInput] };
-          }
-
-          return accum;
-        },
-        {},
-      );
-
-      try {
-        await updateQuantity({
-          lineItemEntityId: cartLineItem.id,
-          productEntityId: cartLineItem.productEntityId,
-          variantEntityId: cartLineItem.variantEntityId,
-          selectedOptions: parsedSelectedOptions,
-          quantity: cartLineItem.quantity + 1,
-        });
-      } catch (error) {
-        // eslint-disable-next-line no-console
-        console.error(error);
-
-        if (error instanceof BigCommerceGQLError) {
-          return {
-            ...prevState,
-            lastResult: submission.reply({
-              formErrors: error.errors.map(({ message }) => message),
-            }),
-          };
-        }
-
-        if (error instanceof Error) {
-          return { ...prevState, lastResult: submission.reply({ formErrors: [error.message] }) };
-        }
-
-        return { ...prevState, lastResult: submission.reply({ formErrors: [String(error)] }) };
-      }
-
-      const item = submission.value;
-
-      return {
-        lineItems: prevState.lineItems.map((lineItem) =>
-          lineItem.id === item.id ? { ...lineItem, quantity: lineItem.quantity + 1 } : lineItem,
-        ),
-        lastResult: submission.reply({ resetForm: true }),
-      };
-    }
-
-    case 'decrement': {
       const parsedSelectedOptions = cartLineItem.selectedOptions.reduce<CartSelectedOptionsInput>(
         (accum, option) => {
           let multipleChoicesOptionInput;
@@ -329,7 +177,7 @@ export const updateLineItem = async (
           productEntityId: cartLineItem.productEntityId,
           variantEntityId: cartLineItem.variantEntityId,
           selectedOptions: parsedSelectedOptions,
-          quantity: cartLineItem.quantity - 1,
+          quantity,
         });
       } catch (error) {
         // eslint-disable-next-line no-console
@@ -351,11 +199,9 @@ export const updateLineItem = async (
         return { ...prevState, lastResult: submission.reply({ formErrors: [String(error)] }) };
       }
 
-      const item = submission.value;
-
       return {
         lineItems: prevState.lineItems.map((lineItem) =>
-          lineItem.id === item.id ? { ...lineItem, quantity: lineItem.quantity - 1 } : lineItem,
+          lineItem.id === cartLineItem.id ? { ...lineItem, quantity } : lineItem,
         ),
         lastResult: submission.reply({ resetForm: true }),
       };
diff --git a/core/app/[locale]/(default)/cart/_actions/update-quantity.ts b/core/app/[locale]/(default)/cart/_actions/update-quantity.ts
index ebae4492ed..32eb7de4ad 100644
--- a/core/app/[locale]/(default)/cart/_actions/update-quantity.ts
+++ b/core/app/[locale]/(default)/cart/_actions/update-quantity.ts
@@ -1,11 +1,12 @@
 'use server';
 
-import { revalidatePath } from 'next/cache';
+import { revalidateTag } from 'next/cache';
 import { getTranslations } from 'next-intl/server';
 
 import { getSessionCustomerAccessToken } from '~/auth';
 import { client } from '~/client';
 import { graphql, VariablesOf } from '~/client/graphql';
+import { TAGS } from '~/client/tags';
 import { getCartId } from '~/lib/cart';
 
 import { removeItem } from './remove-item';
@@ -87,7 +88,7 @@ export const updateQuantity = async ({
     throw new Error(t('failedToUpdateQuantity'));
   }
 
-  revalidatePath('/cart');
+  revalidateTag(TAGS.cart, { expire: 0 });
 
   return cart;
 };
diff --git a/core/app/[locale]/(default)/cart/page.tsx b/core/app/[locale]/(default)/cart/page.tsx
index e6ea1232ff..1a4965377a 100644
--- a/core/app/[locale]/(default)/cart/page.tsx
+++ b/core/app/[locale]/(default)/cart/page.tsx
@@ -370,7 +370,9 @@ export default async function Cart({ params }: Props) {
               : undefined
           }
           incrementLineItemLabel={t('increment')}
-          key={`${cart.entityId}-${cart.version}`}
+          // Keyed by entityId only; keying by version too would remount the section on
+          // every mutation (see the pending-intent dispatcher notes in the Cart section).
+          key={cart.entityId}
           lineItemAction={updateLineItem}
           lineItemActionPendingLabel={t('cartUpdateInProgress')}
           shipping={{
diff --git a/core/app/[locale]/(default)/product/[slug]/page-data.ts b/core/app/[locale]/(default)/product/[slug]/page-data.ts
index b81698b2f1..a42eb4a38c 100644
--- a/core/app/[locale]/(default)/product/[slug]/page-data.ts
+++ b/core/app/[locale]/(default)/product/[slug]/page-data.ts
@@ -196,6 +196,14 @@ const ProductQuery = graphql(
             numberOfReviews
           }
           description
+          featuredPromotions {
+            edges {
+              node {
+                entityId
+                text
+              }
+            }
+          }
           ...ProductOptionsFragment
         }
       }
@@ -297,6 +305,18 @@ const StreamableProductQuery = graphql(
             altText
             url: urlTemplate(lossy: true)
           }
+          # Product videos. The Storefront GraphQL API only returns the video
+          # title and url (a YouTube watch URL); the dedicated PDP Videos section
+          # renders them via lite-youtube-embed. 25 covers realistic product
+          # video counts without needing pagination.
+          videos(first: 25) {
+            edges {
+              node {
+                title
+                url
+              }
+            }
+          }
           sku
           weight {
             value
diff --git a/core/app/[locale]/(default)/product/[slug]/page.tsx b/core/app/[locale]/(default)/product/[slug]/page.tsx
index 81457201b2..93fc234233 100644
--- a/core/app/[locale]/(default)/product/[slug]/page.tsx
+++ b/core/app/[locale]/(default)/product/[slug]/page.tsx
@@ -6,6 +6,7 @@ import { SearchParams } from 'nuqs/server';
 
 import { Stream, Streamable } from '@/vibes/soul/lib/streamable';
 import { FeaturedProductCarousel } from '@/vibes/soul/sections/featured-product-carousel';
+import { ProductVideos } from '@/vibes/soul/sections/product-detail/product-videos';
 import { auth, getSessionCustomerAccessToken } from '~/auth';
 import { rewriteWysiwygContentUrls } from '~/data-transformers/html-content-transformer';
 import { pricesTransformer } from '~/data-transformers/prices-transformer';
@@ -202,6 +203,18 @@ export default async function Product({ params, searchParams }: Props) {
     };
   });
 
+  // Product videos render in their own section below the primary content, so
+  // they're streamed independently of the gallery images. The Storefront
+  // GraphQL API returns each video as { title, url } (a YouTube watch URL).
+  const streamableVideos = Streamable.from(async () => {
+    const product = await streamableProduct;
+
+    return removeEdgesAndNodes(product.videos).map((video) => ({
+      url: video.url,
+      title: video.title,
+    }));
+  });
+
   const streameableCtaLabel = Streamable.from(async () => {
     const product = await streamableProductInventory;
 
@@ -532,6 +545,11 @@ export default async function Product({ params, searchParams }: Props) {
     };
   });
 
+  const promotionCallouts = removeEdgesAndNodes(baseProduct.featuredPromotions).map((p) => ({
+    id: p.entityId.toString(),
+    text: p.text,
+  }));
+
   const streamableUser = Streamable.from(async () => {
     const session = await auth();
     const firstName = session?.user?.firstName ?? '';
@@ -593,6 +611,7 @@ export default async function Product({ params, searchParams }: Props) {
             backorderDisplayData: streamableBackorderDisplayData,
           }}
           productId={baseProduct.entityId}
+          promotionCallouts={promotionCallouts}
           quantityLabel={t('ProductDetails.quantity')}
           recaptchaSiteKey={recaptchaSiteKey}
           reviewFormAction={submitReview}
@@ -601,6 +620,10 @@ export default async function Product({ params, searchParams }: Props) {
         />
       </ProductAnalyticsProvider>
 
+      <Stream fallback={null} value={streamableVideos}>
+        {(videos) => videos.length > 0 && <ProductVideos videos={videos} />}
+      </Stream>
+
       <FeaturedProductCarousel
         cta={{ label: t('RelatedProducts.cta'), href: '/shop-all' }}
         emptyStateSubtitle={t('RelatedProducts.browseCatalog')}
diff --git a/core/app/[locale]/(default)/webpages/[id]/layout.tsx b/core/app/[locale]/(default)/webpages/[id]/layout.tsx
index cde3f40ea5..de274fe0a4 100644
--- a/core/app/[locale]/(default)/webpages/[id]/layout.tsx
+++ b/core/app/[locale]/(default)/webpages/[id]/layout.tsx
@@ -4,6 +4,7 @@ import { cache } from 'react';
 
 import { SidebarMenu } from '@/vibes/soul/sections/sidebar-menu';
 import { StickySidebarLayout } from '@/vibes/soul/sections/sticky-sidebar-layout';
+import { getSessionCustomerAccessToken } from '~/auth';
 import { client } from '~/client';
 import { graphql } from '~/client/graphql';
 import { revalidate } from '~/client/revalidate-target';
@@ -45,44 +46,48 @@ interface PageLink {
   href: string;
 }
 
-const getWebPageChildren = cache(async (id: string): Promise<PageLink[]> => {
-  const { data } = await client.fetch({
-    document: WebPageChildrenQuery,
-    variables: { id: decodeURIComponent(id) },
-    fetchOptions: { next: { revalidate } },
-  });
+const getWebPageChildren = cache(
+  async (id: string, customerAccessToken?: string): Promise<PageLink[]> => {
+    const { data } = await client.fetch({
+      document: WebPageChildrenQuery,
+      variables: { id: decodeURIComponent(id) },
+      customerAccessToken,
+      fetchOptions: customerAccessToken ? { cache: 'no-store' } : { next: { revalidate } },
+    });
 
-  if (!data.node) {
-    return [];
-  }
+    if (!data.node) {
+      return [];
+    }
 
-  if (!('children' in data.node)) {
-    return [];
-  }
+    if (!('children' in data.node)) {
+      return [];
+    }
 
-  const { children } = data.node;
+    const { children } = data.node;
 
-  return removeEdgesAndNodes(children).reduce((acc: PageLink[], child) => {
-    if ('path' in child) {
-      return [...acc, { label: child.name, href: child.path }];
-    }
+    return removeEdgesAndNodes(children).reduce((acc: PageLink[], child) => {
+      if ('path' in child) {
+        return [...acc, { label: child.name, href: child.path }];
+      }
 
-    if ('link' in child) {
-      return [...acc, { label: child.name, href: child.link }];
-    }
+      if ('link' in child) {
+        return [...acc, { label: child.name, href: child.link }];
+      }
 
-    return acc;
-  }, []);
-});
+      return acc;
+    }, []);
+  },
+);
 
 export default async function WebPageLayout({ params, children }: Props) {
   const { locale, id } = await params;
+  const customerAccessToken = await getSessionCustomerAccessToken();
 
   setRequestLocale(locale);
 
   return (
     <StickySidebarLayout
-      sidebar={<SidebarMenu links={getWebPageChildren(id)} />}
+      sidebar={<SidebarMenu links={getWebPageChildren(id, customerAccessToken)} />}
       sidebarSize="small"
     >
       {children}
diff --git a/core/components/footer/fragment.ts b/core/components/footer/fragment.ts
index fd7b4fda39..740684114f 100644
--- a/core/components/footer/fragment.ts
+++ b/core/components/footer/fragment.ts
@@ -42,6 +42,7 @@ export const FooterSectionsFragment = graphql(`
           node {
             __typename
             name
+            isVisibleInNavigation
             ... on RawHtmlPage {
               path
             }
diff --git a/core/components/footer/index.tsx b/core/components/footer/index.tsx
index cf9d490541..c9480ed575 100644
--- a/core/components/footer/index.tsx
+++ b/core/components/footer/index.tsx
@@ -124,10 +124,12 @@ export const Footer = async () => {
                 },
               ]
             : []),
-          ...removeEdgesAndNodes(sectionsData.content.pages).map((page) => ({
-            label: page.name,
-            href: page.__typename === 'ExternalLinkPage' ? page.link : page.path,
-          })),
+          ...removeEdgesAndNodes(sectionsData.content.pages)
+            .filter((page) => page.isVisibleInNavigation)
+            .map((page) => ({
+              label: page.name,
+              href: page.__typename === 'ExternalLinkPage' ? page.link : page.path,
+            })),
         ],
       },
     ];
diff --git a/core/components/header/_actions/switch-locale.ts b/core/components/header/_actions/switch-locale.ts
new file mode 100644
index 0000000000..9a766c8ffb
--- /dev/null
+++ b/core/components/header/_actions/switch-locale.ts
@@ -0,0 +1,66 @@
+'use server';
+
+import { revalidateTag } from 'next/cache';
+
+import { client } from '~/client';
+import { graphql } from '~/client/graphql';
+import { TAGS } from '~/client/tags';
+import { getCartId } from '~/lib/cart';
+
+const UpdateCartLocaleMutation = graphql(`
+  mutation UpdateCartLocaleMutation($input: UpdateCartLocaleInput!) {
+    cart {
+      updateCartLocale(input: $input) {
+        cart {
+          entityId
+        }
+        errors {
+          __typename
+          ... on Error {
+            message
+          }
+        }
+      }
+    }
+  }
+`);
+
+// Keeps the cart's locale in sync when the shopper switches their storefront
+// locale. Unlike currency, updating the locale mutates the cart in place, so the
+// cart ID does not change. This is best-effort: a failure here should not block
+// the locale navigation, so errors are logged rather than surfaced to the user.
+export const switchLocale = async (locale: string): Promise<void> => {
+  const cartId = await getCartId();
+
+  if (!cartId) {
+    return;
+  }
+
+  try {
+    const result = await client.fetch({
+      document: UpdateCartLocaleMutation,
+      variables: { input: { cartEntityId: cartId, data: { locale } } },
+    });
+
+    const updateCartLocale = result.data.cart.updateCartLocale;
+
+    // `updateCartLocale` is null when the feature is disabled for this store.
+    if (!updateCartLocale) {
+      return;
+    }
+
+    const { errors } = updateCartLocale;
+
+    if (errors.length > 0) {
+      // eslint-disable-next-line no-console
+      console.error('Error updating cart locale', errors);
+
+      return;
+    }
+
+    revalidateTag(TAGS.cart, { expire: 0 });
+  } catch (error) {
+    // eslint-disable-next-line no-console
+    console.error('Error updating cart locale', error);
+  }
+};
diff --git a/core/components/header/index.tsx b/core/components/header/index.tsx
index 123881a80d..975ac027d9 100644
--- a/core/components/header/index.tsx
+++ b/core/components/header/index.tsx
@@ -16,6 +16,7 @@ import { SiteHeader as HeaderSection } from '~/lib/makeswift/components/site-hea
 
 import { search } from './_actions/search';
 import { switchCurrency } from './_actions/switch-currency';
+import { switchLocale } from './_actions/switch-locale';
 import { CurrencyCode, HeaderFragment, HeaderLinksFragment } from './fragment';
 
 const GetCartCountQuery = graphql(`
@@ -176,6 +177,7 @@ export const Header = async () => {
         cartCount: streamableCartCount,
         activeLocaleId: locale,
         locales,
+        localeAction: switchLocale,
         currencies,
         activeCurrencyId: streamableActiveCurrencyId,
         currencyAction: switchCurrency,
diff --git a/core/components/product-card/fragment.ts b/core/components/product-card/fragment.ts
index 4c5d18e7af..5bda83f945 100644
--- a/core/components/product-card/fragment.ts
+++ b/core/components/product-card/fragment.ts
@@ -46,6 +46,14 @@ export const ProductCardFragment = graphql(
           }
         }
       }
+      featuredPromotions {
+        edges {
+          node {
+            entityId
+            text
+          }
+        }
+      }
       ...PricingFragment
     }
   `,
diff --git a/core/data-transformers/form-field-transformer/utils.ts b/core/data-transformers/form-field-transformer/utils.ts
index 398dc43b01..c37a02dacc 100644
--- a/core/data-transformers/form-field-transformer/utils.ts
+++ b/core/data-transformers/form-field-transformer/utils.ts
@@ -25,6 +25,20 @@ export enum FieldNameToFieldId {
 
 export const CUSTOMER_FIELDS_TO_EXCLUDE = [FieldNameToFieldId.currentPassword];
 
+/* Account Settings only manages the fields below directly; anything else returned by
+ site.settings.formFields.customer is a genuinely merchant-defined custom field. */
+export const ACCOUNT_SETTINGS_FIELDS_TO_EXCLUDE = [
+  FieldNameToFieldId.email,
+  FieldNameToFieldId.password,
+  FieldNameToFieldId.confirmPassword,
+  FieldNameToFieldId.currentPassword,
+  FieldNameToFieldId.firstName,
+  FieldNameToFieldId.lastName,
+  FieldNameToFieldId.company,
+  FieldNameToFieldId.phone,
+  FieldNameToFieldId.exclusiveOffers,
+];
+
 export const REGISTER_CUSTOMER_FORM_LAYOUT = [
   [FieldNameToFieldId.firstName, FieldNameToFieldId.lastName],
   FieldNameToFieldId.email,
diff --git a/core/data-transformers/product-card-transformer.ts b/core/data-transformers/product-card-transformer.ts
index 2b57e100ad..7ae3ba9a87 100644
--- a/core/data-transformers/product-card-transformer.ts
+++ b/core/data-transformers/product-card-transformer.ts
@@ -68,6 +68,13 @@ export const singleProductCardTransformer = (
       'variants' in product
         ? getInventoryMessage(product, outOfStockMessage, showBackorderMessage)
         : undefined,
+    promotions:
+      'featuredPromotions' in product
+        ? removeEdgesAndNodes(product.featuredPromotions).map((p) => ({
+            id: p.entityId.toString(),
+            text: p.text,
+          }))
+        : undefined,
   };
 };
 
diff --git a/core/messages/da.json b/core/messages/da.json
index c068677a1a..3dce0754d3 100644
--- a/core/messages/da.json
+++ b/core/messages/da.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{antal, number} vil være i restordre",
             "loadingMoreImages": "Indlæser flere billeder",
             "imagesLoaded": "{count, plural, =1 {1 yderligere billede indlæst} other {# yderligere billeder indlæst}}",
+            "playVideo": "Afspil video",
+            "viewVideo": "Se video",
+            "videosTitle": "Videoer",
+            "hideVideos": "Skjul videoer",
+            "showVideos": "Vis videoer",
             "Submit": {
                 "addToCart": "Føj til kurv",
                 "outOfStock": "Udsolgt",
diff --git a/core/messages/de.json b/core/messages/de.json
index 60850a8223..9c85785833 100644
--- a/core/messages/de.json
+++ b/core/messages/de.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} wird nachbestellt",
             "loadingMoreImages": "Weitere Bilder werden geladen",
             "imagesLoaded": "{count, plural, =1 {1 weiteres Bild geladen, } other {# weitere Bilder geladen, }}",
+            "playVideo": "Video abspielen",
+            "viewVideo": "Video ansehen",
+            "videosTitle": "Videos",
+            "hideVideos": "Videos ausblenden",
+            "showVideos": "Videos anzeigen",
             "Submit": {
                 "addToCart": "Zum Warenkorb hinzufügen",
                 "outOfStock": "Kein Lagerbestand",
diff --git a/core/messages/en.json b/core/messages/en.json
index 1d4b8908a9..514d1a9396 100644
--- a/core/messages/en.json
+++ b/core/messages/en.json
@@ -529,6 +529,11 @@
       "backorderQuantity": "{quantity, number} will be on backorder",
       "loadingMoreImages": "Loading more images",
       "imagesLoaded": "{count, plural, =1 {1 more image loaded} other {# more images loaded}}",
+      "playVideo": "Play video",
+      "viewVideo": "View video",
+      "videosTitle": "Videos",
+      "hideVideos": "Hide videos",
+      "showVideos": "Show videos",
       "Submit": {
         "addToCart": "Add to cart",
         "outOfStock": "Out of stock",
diff --git a/core/messages/es-419.json b/core/messages/es-419.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-419.json
+++ b/core/messages/es-419.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-AR.json b/core/messages/es-AR.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-AR.json
+++ b/core/messages/es-AR.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-CL.json b/core/messages/es-CL.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-CL.json
+++ b/core/messages/es-CL.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-CO.json b/core/messages/es-CO.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-CO.json
+++ b/core/messages/es-CO.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-LA.json b/core/messages/es-LA.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-LA.json
+++ b/core/messages/es-LA.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-MX.json b/core/messages/es-MX.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-MX.json
+++ b/core/messages/es-MX.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es-PE.json b/core/messages/es-PE.json
index 1c81487dde..12b770b68b 100644
--- a/core/messages/es-PE.json
+++ b/core/messages/es-PE.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} estará en espera",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# más imágenes cargadas}}",
+            "playVideo": "Reproducir video",
+            "viewVideo": "Ver video",
+            "videosTitle": "Videos",
+            "hideVideos": "Ocultar videos",
+            "showVideos": "Mostrar videos",
             "Submit": {
                 "addToCart": "Agregar al carrito",
                 "outOfStock": "Agotado/a",
diff --git a/core/messages/es.json b/core/messages/es.json
index 92c04e3690..cb9453a698 100644
--- a/core/messages/es.json
+++ b/core/messages/es.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{cantidad, número} en pedidos pendientes",
             "loadingMoreImages": "Cargando más imágenes",
             "imagesLoaded": "{count, plural, =1 {1 imagen más cargada} other {# imágenes más cargadas}}",
+            "playVideo": "Ver vídeo",
+            "viewVideo": "Ver vídeo",
+            "videosTitle": "Vídeos",
+            "hideVideos": "Ocultar vídeos",
+            "showVideos": "Mostrar vídeos",
             "Submit": {
                 "addToCart": "Añadir al carrito",
                 "outOfStock": "Sin existencias",
diff --git a/core/messages/fr.json b/core/messages/fr.json
index 6f07af7786..22502a8c61 100644
--- a/core/messages/fr.json
+++ b/core/messages/fr.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantité, nombre} en attente de réapprovisionnement",
             "loadingMoreImages": "Chargement de plus d'images",
             "imagesLoaded": "{count, plural, =1 {1 image supplémentaire chargée} other {# images supplémentaires chargées}}",
+            "playVideo": "Lancer la vidéo",
+            "viewVideo": "Voir la vidéo",
+            "videosTitle": "Vidéos",
+            "hideVideos": "Masquer les vidéos",
+            "showVideos": "Afficher les vidéos",
             "Submit": {
                 "addToCart": "Ajouter au panier",
                 "outOfStock": "En rupture de stock",
diff --git a/core/messages/it.json b/core/messages/it.json
index 4b08bd3029..2d883dc017 100644
--- a/core/messages/it.json
+++ b/core/messages/it.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} sarà in arretrato",
             "loadingMoreImages": "Caricamento di altre immagini",
             "imagesLoaded": "{count, plural, =1 {1 altra immagine caricata} other {# altre immagini caricate}}",
+            "playVideo": "Riproduci video",
+            "viewVideo": "Guarda il video",
+            "videosTitle": "Video",
+            "hideVideos": "Nascondi i video",
+            "showVideos": "Mostra i video",
             "Submit": {
                 "addToCart": "Aggiungi al carrello",
                 "outOfStock": "Esaurito",
diff --git a/core/messages/ja.json b/core/messages/ja.json
index f303527124..b5900488df 100644
--- a/core/messages/ja.json
+++ b/core/messages/ja.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} はバックオーダーになります",
             "loadingMoreImages": "さらに画像を読み込んでいます",
             "imagesLoaded": "{count, plural, =1 {1 枚の画像が読み込まれました} other {#枚の画像が読み込まれました}}",
+            "playVideo": "動画を再生",
+            "viewVideo": "動画を視聴",
+            "videosTitle": "ビデオ",
+            "hideVideos": "動画を非表示",
+            "showVideos": "動画を表示",
             "Submit": {
                 "addToCart": "カートに追加",
                 "outOfStock": "品切れ",
diff --git a/core/messages/nl.json b/core/messages/nl.json
index 5a791406df..edc79e06fd 100644
--- a/core/messages/nl.json
+++ b/core/messages/nl.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{hoeveelheid, aantal} staat in backorder",
             "loadingMoreImages": "Meer afbeeldingen laden",
             "imagesLoaded": "{count, plural, =1 {1 afbeelding geladen} other {# afbeeldingen geladen}}",
+            "playVideo": "Video afspelen",
+            "viewVideo": "Bekijk video",
+            "videosTitle": "Video's",
+            "hideVideos": "Video's verbergen",
+            "showVideos": "Video's weergeven",
             "Submit": {
                 "addToCart": "Toevoegen aan winkelmandje",
                 "outOfStock": "Niet op voorraad",
diff --git a/core/messages/no.json b/core/messages/no.json
index c59e680609..803b26cc29 100644
--- a/core/messages/no.json
+++ b/core/messages/no.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{antall, nummer} vil være restordre",
             "loadingMoreImages": "Laster inn flere bilder",
             "imagesLoaded": "{count, plural, =1 {1 bilde til ble lastet inn} other {# flere bilder ble lastet inn}}",
+            "playVideo": "Spill av video",
+            "viewVideo": "Vis video",
+            "videosTitle": "Videoer",
+            "hideVideos": "Skjul videoer",
+            "showVideos": "Vis videoer",
             "Submit": {
                 "addToCart": "Legg i handlekurv",
                 "outOfStock": "Utsolgt",
diff --git a/core/messages/pl.json b/core/messages/pl.json
index 7eff0388c5..d137a911ce 100644
--- a/core/messages/pl.json
+++ b/core/messages/pl.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} will be on backorder",
             "loadingMoreImages": "Loading more images",
             "imagesLoaded": "{count, plural, =1 {1 more image loaded} other {# more images loaded}}",
+            "playVideo": "Play video",
+            "viewVideo": "View video",
+            "videosTitle": "Wideo",
+            "hideVideos": "Hide videos",
+            "showVideos": "Show videos",
             "Submit": {
                 "addToCart": "Dodaj do koszyka",
                 "outOfStock": "Brak w magazynie",
diff --git a/core/messages/pt-BR.json b/core/messages/pt-BR.json
index 27c3bf66ea..57b9598ad5 100644
--- a/core/messages/pt-BR.json
+++ b/core/messages/pt-BR.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} will be on backorder",
             "loadingMoreImages": "Loading more images",
             "imagesLoaded": "{count, plural, =1 {1 more image loaded} other {# more images loaded}}",
+            "playVideo": "Play video",
+            "viewVideo": "View video",
+            "videosTitle": "Vídeos",
+            "hideVideos": "Hide videos",
+            "showVideos": "Show videos",
             "Submit": {
                 "addToCart": "Adicionar ao carrinho",
                 "outOfStock": "Fora do estoque",
diff --git a/core/messages/pt.json b/core/messages/pt.json
index 27c3bf66ea..57b9598ad5 100644
--- a/core/messages/pt.json
+++ b/core/messages/pt.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} will be on backorder",
             "loadingMoreImages": "Loading more images",
             "imagesLoaded": "{count, plural, =1 {1 more image loaded} other {# more images loaded}}",
+            "playVideo": "Play video",
+            "viewVideo": "View video",
+            "videosTitle": "Vídeos",
+            "hideVideos": "Hide videos",
+            "showVideos": "Show videos",
             "Submit": {
                 "addToCart": "Adicionar ao carrinho",
                 "outOfStock": "Fora do estoque",
diff --git a/core/messages/sv.json b/core/messages/sv.json
index 77237e38fd..95c8642572 100644
--- a/core/messages/sv.json
+++ b/core/messages/sv.json
@@ -526,6 +526,11 @@
             "backorderQuantity": "{quantity, number} kommer att vara restnoterade",
             "loadingMoreImages": "Laddar fler bilder",
             "imagesLoaded": "{count, plural, =1 {1 till bild har laddats} other {# till bilder har laddats}}",
+            "playVideo": "Spela upp video",
+            "viewVideo": "Visa video",
+            "videosTitle": "Videor",
+            "hideVideos": "Dölj videor",
+            "showVideos": "Visa videor",
             "Submit": {
                 "addToCart": "Lägg till i kundvagn",
                 "outOfStock": "Ej i lager",
diff --git a/core/next.config.ts b/core/next.config.ts
index 1cb12064ab..4739b0365b 100644
--- a/core/next.config.ts
+++ b/core/next.config.ts
@@ -79,6 +79,10 @@ export default async (): Promise<NextConfig> => {
     experimental: {
       optimizePackageImports: ['@icons-pack/react-simple-icons'],
     },
+    images: {
+      // Allow product-video poster thumbnails (YouTube) through next/image.
+      remotePatterns: [{ protocol: 'https', hostname: 'i.ytimg.com', pathname: '/vi/**' }],
+    },
     typescript: {
       ignoreBuildErrors: !!process.env.CI,
     },
diff --git a/core/package.json b/core/package.json
index ccd49e68dd..7652327274 100644
--- a/core/package.json
+++ b/core/package.json
@@ -17,6 +17,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@base-ui/react": "^1.6.0",
     "@bigcommerce/catalyst-client": "workspace:^",
     "@c15t/nextjs": "^1.8.2",
     "@conform-to/react": "^1.6.1",
@@ -50,14 +51,15 @@
     "clsx": "^2.1.1",
     "content-security-policy-builder": "^2.3.0",
     "deepmerge": "^4.3.1",
+    "dompurify": "^3.3.1",
     "embla-carousel": "9.0.0-rc01",
     "embla-carousel-autoplay": "9.0.0-rc01",
     "embla-carousel-fade": "9.0.0-rc01",
     "embla-carousel-react": "9.0.0-rc01",
     "gql.tada": "^1.8.10",
     "graphql": "^16.11.0",
-    "dompurify": "^3.3.1",
     "jose": "^5.10.0",
+    "lite-youtube-embed": "^0.3.4",
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
@@ -76,6 +78,7 @@
     "set-cookie-parser": "^2.7.1",
     "sharp": "^0.33.5",
     "sonner": "^1.7.4",
+    "storefront-kit": "^0.24.0",
     "swr": "^2.2.5",
     "tailwindcss-radix": "^3.0.5",
     "uuid": "^11.1.0",
diff --git a/core/proxies/with-routes.ts b/core/proxies/with-routes.ts
index f8a0dcbae7..bdde3cebb5 100644
--- a/core/proxies/with-routes.ts
+++ b/core/proxies/with-routes.ts
@@ -71,7 +71,7 @@ const getRoute = async (path: string, channelId?: string, customerAccessToken?:
     document: GetRouteQuery,
     variables: { path },
     customerAccessToken,
-    fetchOptions: { next: { revalidate } },
+    fetchOptions: customerAccessToken ? { cache: 'no-store' } : { next: { revalidate } },
     channelId,
   });
 
@@ -93,7 +93,7 @@ const getRawWebPageContent = async (id: string, customerAccessToken?: string) =>
   const response = await client.fetch({
     document: getRawWebPageContentQuery,
     variables: { id },
-    fetchOptions: { next: { revalidate } },
+    fetchOptions: customerAccessToken ? { cache: 'no-store' } : { next: { revalidate } },
     customerAccessToken,
   });
 
diff --git a/core/vibes/soul/form/dynamic-form/index.tsx b/core/vibes/soul/form/dynamic-form/index.tsx
index 65321d0e51..feea46e8f5 100644
--- a/core/vibes/soul/form/dynamic-form/index.tsx
+++ b/core/vibes/soul/form/dynamic-form/index.tsx
@@ -241,7 +241,7 @@ function SubmitButton({
   );
 }
 
-function DynamicFormField({
+export function DynamicFormField({
   field,
   formField,
 }: {
diff --git a/core/vibes/soul/form/dynamic-form/schema.ts b/core/vibes/soul/form/dynamic-form/schema.ts
index 4a0048d33f..3675f2e63d 100644
--- a/core/vibes/soul/form/dynamic-form/schema.ts
+++ b/core/vibes/soul/form/dynamic-form/schema.ts
@@ -328,31 +328,36 @@ function getFieldSchema(
   return fieldSchema;
 }
 
-export function schema(
+export function getFieldsShape(
   fields: Array<Field | FieldGroup<Field>>,
   passwordComplexity?: PasswordComplexitySettings | null,
   errorTranslations?: FormErrorTranslationMap,
-) {
+): SchemaRawShape {
   const shape: SchemaRawShape = {};
-  let passwordFieldName: string | undefined;
-  let confirmPasswordFieldName: string | undefined;
 
   fields.forEach((field) => {
     if (Array.isArray(field)) {
       field.forEach((f) => {
         shape[f.name] = getFieldSchema(f, passwordComplexity, errorTranslations);
-
-        if (f.type === 'password') passwordFieldName = f.name;
-        if (f.type === 'confirm-password') confirmPasswordFieldName = f.name;
       });
     } else {
       shape[field.name] = getFieldSchema(field, passwordComplexity, errorTranslations);
-
-      if (field.type === 'password') passwordFieldName = field.name;
-      if (field.type === 'confirm-password') confirmPasswordFieldName = field.name;
     }
   });
 
+  return shape;
+}
+
+export function schema(
+  fields: Array<Field | FieldGroup<Field>>,
+  passwordComplexity?: PasswordComplexitySettings | null,
+  errorTranslations?: FormErrorTranslationMap,
+) {
+  const shape = getFieldsShape(fields, passwordComplexity, errorTranslations);
+  const flatFields = fields.flatMap((field) => (Array.isArray(field) ? field : [field]));
+  const passwordFieldName = flatFields.find((f) => f.type === 'password')?.name;
+  const confirmPasswordFieldName = flatFields.find((f) => f.type === 'confirm-password')?.name;
+
   return z.object(shape).superRefine((data, ctx) => {
     if (
       passwordFieldName != null &&
diff --git a/core/vibes/soul/primitives/navigation/index.tsx b/core/vibes/soul/primitives/navigation/index.tsx
index ab5b28aa43..1b3eee52ad 100644
--- a/core/vibes/soul/primitives/navigation/index.tsx
+++ b/core/vibes/soul/primitives/navigation/index.tsx
@@ -87,6 +87,7 @@ export type SearchResult =
     };
 
 type CurrencyAction = Action<SubmissionResult | null, FormData>;
+type LocaleAction = (locale: string) => Promise<void> | void;
 type SearchAction<S extends SearchResult> = Action<
   {
     searchResults: S[] | null;
@@ -107,6 +108,7 @@ interface Props<S extends SearchResult> {
   linksPosition?: 'center' | 'left' | 'right';
   locales?: Locale[];
   activeLocaleId?: string;
+  localeAction?: LocaleAction;
   currencies?: Currency[];
   activeCurrencyId?: Streamable<string | undefined>;
   currencyAction?: CurrencyAction;
@@ -285,6 +287,7 @@ export const Navigation = forwardRef(function Navigation<S extends SearchResult>
     linksPosition = 'center',
     activeLocaleId,
     locales,
+    localeAction,
     currencies: streamableCurrencies,
     activeCurrencyId: streamableActiveCurrencyId,
     currencyAction,
@@ -410,6 +413,7 @@ export const Navigation = forwardRef(function Navigation<S extends SearchResult>
                       {/* Locale / Language Dropdown */}
                       {locales.length > 1 ? (
                         <LocaleSwitcher
+                          action={localeAction}
                           activeLocaleId={activeLocaleId}
                           // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
                           locales={locales as [Locale, Locale, ...Locale[]]}
@@ -628,6 +632,7 @@ export const Navigation = forwardRef(function Navigation<S extends SearchResult>
           {/* Locale / Language Dropdown */}
           {locales && locales.length > 1 ? (
             <LocaleSwitcher
+              action={localeAction}
               activeLocaleId={activeLocaleId}
               className="hidden @4xl:block"
               // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
@@ -928,9 +933,11 @@ const useSwitchLocale = ({ activeLocale }: { activeLocale: Locale | undefined })
 function LocaleSwitcher({
   locales,
   activeLocaleId,
+  action,
   className,
 }: {
   activeLocaleId?: string;
+  action?: LocaleAction;
   locales: [Locale, ...Locale[]];
   className?: string;
 }) {
@@ -967,7 +974,14 @@ function LocaleSwitcher({
                   },
                 )}
                 key={id}
-                onSelect={() => startTransition(() => switchLocale(id))}
+                onSelect={() =>
+                  startTransition(async () => {
+                    // Sync the cart's locale first so the shopper lands on the
+                    // new locale with an already-updated cart.
+                    await action?.(id);
+                    await switchLocale(id);
+                  })
+                }
               >
                 {label}
               </DropdownMenu.Item>
diff --git a/core/vibes/soul/primitives/product-card/index.tsx b/core/vibes/soul/primitives/product-card/index.tsx
index 4e89c9314f..458ee66c4f 100644
--- a/core/vibes/soul/primitives/product-card/index.tsx
+++ b/core/vibes/soul/primitives/product-card/index.tsx
@@ -1,4 +1,11 @@
 import { clsx } from 'clsx';
+import {
+  Content as CalloutContent,
+  Description as CalloutDescription,
+  Header as CalloutHeader,
+  Root as CalloutRoot,
+  Title as CalloutTitle,
+} from 'storefront-kit/callout';
 
 import { Badge } from '@/vibes/soul/primitives/badge';
 import { Price, PriceLabel } from '@/vibes/soul/primitives/price-label';
@@ -21,6 +28,7 @@ export interface Product {
   rating?: number;
   inventoryMessage?: string;
   numberOfReviews?: number;
+  promotions?: Array<{ id: string; text: string }>;
 }
 
 export interface ProductCardProps {
@@ -32,6 +40,7 @@ export interface ProductCardProps {
   imageSizes?: string;
   compareLabel?: string;
   compareParamName?: string;
+  moreOffersLabel?: string;
   product: Product;
   showRating?: boolean;
 }
@@ -70,6 +79,7 @@ export function ProductCard({
     inventoryMessage,
     rating,
     numberOfReviews,
+    promotions,
   },
   showRating = false,
   colorScheme = 'light',
@@ -78,6 +88,7 @@ export function ProductCard({
   aspectRatio = '5:6',
   compareLabel,
   compareParamName,
+  moreOffersLabel = 'more offers',
   imagePriority = false,
   imageSizes = '(min-width: 80rem) 20vw, (min-width: 64rem) 25vw, (min-width: 42rem) 33vw, (min-width: 24rem) 50vw, 100vw',
 }: ProductCardProps) {
@@ -171,6 +182,28 @@ export function ProductCard({
                 price={price}
               />
             )}
+            {promotions != null && promotions.length > 0 && (
+              <div className="mt-1.5">
+                <CalloutRoot
+                  className="items-start rounded-md border border-yellow-300 bg-yellow-50 px-2.5 py-1.5"
+                  size="small"
+                  variant="warning"
+                >
+                  <CalloutContent>
+                    <CalloutHeader>
+                      <CalloutTitle className="text-xs font-semibold leading-snug text-yellow-900">
+                        {promotions[0]?.text ?? ''}
+                      </CalloutTitle>
+                      {promotions.length > 1 && (
+                        <CalloutDescription className="text-xs text-yellow-900/70">
+                          +{promotions.length - 1} {moreOffersLabel}
+                        </CalloutDescription>
+                      )}
+                    </CalloutHeader>
+                  </CalloutContent>
+                </CalloutRoot>
+              </div>
+            )}
             {showRating && typeof rating === 'number' && rating > 0 && (
               <Rating className="mb-2 mt-1" numberOfReviews={numberOfReviews} rating={rating} />
             )}
diff --git a/core/vibes/soul/sections/account-settings/index.tsx b/core/vibes/soul/sections/account-settings/index.tsx
index d8e52712c4..d01b61de53 100644
--- a/core/vibes/soul/sections/account-settings/index.tsx
+++ b/core/vibes/soul/sections/account-settings/index.tsx
@@ -1,4 +1,8 @@
-import { PasswordComplexitySettings } from '@/vibes/soul/form/dynamic-form/schema';
+import {
+  Field,
+  FieldGroup,
+  PasswordComplexitySettings,
+} from '@/vibes/soul/form/dynamic-form/schema';
 
 import { ChangePasswordAction, ChangePasswordForm } from './change-password-form';
 import {
@@ -11,6 +15,7 @@ export interface AccountSettingsSectionProps {
   title?: string;
   account: Account;
   updateAccountAction: UpdateAccountAction;
+  updateAccountCustomFields?: Array<Field | FieldGroup<Field>>;
   updateAccountSubmitLabel?: string;
   changePasswordTitle?: string;
   changePasswordAction: ChangePasswordAction;
@@ -45,6 +50,7 @@ export function AccountSettingsSection({
   title = 'Account Settings',
   account,
   updateAccountAction,
+  updateAccountCustomFields,
   updateAccountSubmitLabel,
   changePasswordTitle = 'Change Password',
   changePasswordAction,
@@ -73,6 +79,7 @@ export function AccountSettingsSection({
             <UpdateAccountForm
               account={account}
               action={updateAccountAction}
+              customFields={updateAccountCustomFields}
               submitLabel={updateAccountSubmitLabel}
             />
           </div>
diff --git a/core/vibes/soul/sections/account-settings/schema.ts b/core/vibes/soul/sections/account-settings/schema.ts
index 5fe66feea2..4ec5b97392 100644
--- a/core/vibes/soul/sections/account-settings/schema.ts
+++ b/core/vibes/soul/sections/account-settings/schema.ts
@@ -2,18 +2,23 @@ import { getTranslations } from 'next-intl/server';
 import { z } from 'zod';
 
 import {
+  Field,
+  FieldGroup,
   FormErrorTranslationMap,
+  getFieldsShape,
   getPasswordSchema,
   PasswordComplexitySettings,
 } from '@/vibes/soul/form/dynamic-form/schema';
 import { ExistingResultType } from '~/client/util';
 
-export const updateAccountSchema = z.object({
-  firstName: z.string().min(2).trim(),
-  lastName: z.string().min(2).trim(),
-  email: z.string().email().trim(),
-  company: z.string().trim().optional(),
-});
+export const updateAccountSchema = (customFields: Array<Field | FieldGroup<Field>> = []) =>
+  z.object({
+    firstName: z.string().min(2).trim(),
+    lastName: z.string().min(2).trim(),
+    email: z.string().email().trim(),
+    company: z.string().trim().optional(),
+    ...getFieldsShape(customFields),
+  });
 
 export const updateAccountErrorTranslations = (
   t: ExistingResultType<typeof getTranslations<'Account.Settings'>>,
diff --git a/core/vibes/soul/sections/account-settings/update-account-form.tsx b/core/vibes/soul/sections/account-settings/update-account-form.tsx
index 44bfb6bd39..67e77fef86 100644
--- a/core/vibes/soul/sections/account-settings/update-account-form.tsx
+++ b/core/vibes/soul/sections/account-settings/update-account-form.tsx
@@ -1,11 +1,20 @@
 'use client';
 
-import { getFormProps, getInputProps, SubmissionResult, useForm } from '@conform-to/react';
+import {
+  FieldMetadata,
+  FormProvider,
+  getFormProps,
+  getInputProps,
+  SubmissionResult,
+  useForm,
+} from '@conform-to/react';
 import { getZodConstraint } from '@conform-to/zod';
 import { useTranslations } from 'next-intl';
 import { useActionState, useEffect, useOptimistic, useTransition } from 'react';
 import { z } from 'zod';
 
+import { DynamicFormField } from '@/vibes/soul/form/dynamic-form';
+import { Field, FieldGroup } from '@/vibes/soul/form/dynamic-form/schema';
 import { Input } from '@/vibes/soul/form/input';
 import { Button } from '@/vibes/soul/primitives/button';
 import { toast } from '@/vibes/soul/primitives/toaster';
@@ -17,17 +26,31 @@ type Action<S, P> = (state: Awaited<S>, payload: P) => S | Promise<S>;
 
 export type UpdateAccountAction = Action<State, FormData>;
 
-export type Account = z.infer<typeof updateAccountSchema>;
+export type Account = z.infer<ReturnType<typeof updateAccountSchema>>;
 
-interface State {
+export interface State {
   account: Account;
   successMessage?: string;
   lastResult: SubmissionResult | null;
 }
 
+function getDynamicFormField(
+  fields: object,
+  name: string,
+): FieldMetadata<string | string[] | number | boolean | Date | undefined> | undefined {
+  // `fields` is conform's static, schema-derived shape; custom fields are looked up dynamically
+  // by name, which has no static index signature to type against.
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+  return Reflect.get(fields, name);
+}
+
 export interface UpdateAccountFormProps {
   action: UpdateAccountAction;
   account: Account;
+  /* Merchant-defined required/custom customer fields (e.g. a "Terms and Conditions" checkbox
+   added after this account existed). BigCommerce re-validates these on every updateCustomer
+   call, so they must be rendered and submitted in this same form, not a separate one. */
+  customFields?: Array<Field | FieldGroup<Field>>;
   firstNameLabel?: string;
   lastNameLabel?: string;
   emailLabel?: string;
@@ -38,6 +61,7 @@ export interface UpdateAccountFormProps {
 export function UpdateAccountForm({
   action,
   account,
+  customFields = [],
   firstNameLabel = 'First name',
   lastNameLabel = 'Last name',
   emailLabel = 'Email',
@@ -46,6 +70,7 @@ export function UpdateAccountForm({
 }: UpdateAccountFormProps) {
   const t = useTranslations('Account.Settings');
   const errorTranslations = updateAccountErrorTranslations(t);
+  const schema = updateAccountSchema(customFields);
   const [state, formAction] = useActionState(action, { account, lastResult: null });
   const [pending, startTransition] = useTransition();
 
@@ -54,7 +79,7 @@ export function UpdateAccountForm({
     (prevState, formData) => {
       const intent = formData.get('intent');
       const submission = parseWithZodTranslatedErrors(formData, {
-        schema: updateAccountSchema,
+        schema,
         errorTranslations,
       });
 
@@ -74,15 +99,21 @@ export function UpdateAccountForm({
     },
   );
 
+  const customFieldsDefaultValue = customFields
+    .flatMap((f) => (Array.isArray(f) ? f : [f]))
+    .reduce<
+      Record<string, unknown>
+    >((acc, f) => ({ ...acc, [f.name]: 'defaultValue' in f ? f.defaultValue : '' }), {});
+
   const [form, fields] = useForm({
     lastResult: state.lastResult,
-    defaultValue: optimisticState.account,
-    constraint: getZodConstraint(updateAccountSchema),
+    defaultValue: { ...optimisticState.account, ...customFieldsDefaultValue },
+    constraint: getZodConstraint(schema),
     shouldValidate: 'onBlur',
     shouldRevalidate: 'onInput',
     onValidate({ formData }) {
       return parseWithZodTranslatedErrors(formData, {
-        schema: updateAccountSchema,
+        schema,
         errorTranslations,
       });
     },
@@ -95,52 +126,81 @@ export function UpdateAccountForm({
   }, [state]);
 
   return (
-    <form
-      {...getFormProps(form)}
-      action={(formData) => {
-        startTransition(() => {
-          formAction(formData);
-          setOptimisticState(formData);
-        });
-      }}
-      className="space-y-5"
-    >
-      <div className="flex gap-5">
+    <FormProvider context={form.context}>
+      <form
+        {...getFormProps(form)}
+        action={(formData) => {
+          startTransition(() => {
+            formAction(formData);
+            setOptimisticState(formData);
+          });
+        }}
+        className="space-y-5"
+      >
+        <div className="flex gap-5">
+          <Input
+            {...getInputProps(fields.firstName, { type: 'text' })}
+            errors={fields.firstName.errors}
+            key={fields.firstName.id}
+            label={firstNameLabel}
+          />
+          <Input
+            {...getInputProps(fields.lastName, { type: 'text' })}
+            errors={fields.lastName.errors}
+            key={fields.lastName.id}
+            label={lastNameLabel}
+          />
+        </div>
         <Input
-          {...getInputProps(fields.firstName, { type: 'text' })}
-          errors={fields.firstName.errors}
-          key={fields.firstName.id}
-          label={firstNameLabel}
+          {...getInputProps(fields.email, { type: 'text' })}
+          errors={fields.email.errors}
+          key={fields.email.id}
+          label={emailLabel}
         />
         <Input
-          {...getInputProps(fields.lastName, { type: 'text' })}
-          errors={fields.lastName.errors}
-          key={fields.lastName.id}
-          label={lastNameLabel}
+          {...getInputProps(fields.company, { type: 'text' })}
+          errors={fields.company.errors}
+          key={fields.company.id}
+          label={companyLabel}
         />
-      </div>
-      <Input
-        {...getInputProps(fields.email, { type: 'text' })}
-        errors={fields.email.errors}
-        key={fields.email.id}
-        label={emailLabel}
-      />
-      <Input
-        {...getInputProps(fields.company, { type: 'text' })}
-        errors={fields.company.errors}
-        key={fields.company.id}
-        label={companyLabel}
-      />
-      <Button
-        loading={pending}
-        name="intent"
-        size="small"
-        type="submit"
-        value="update"
-        variant="secondary"
-      >
-        {submitLabel}
-      </Button>
-    </form>
+        {customFields.map((field, index) => {
+          if (Array.isArray(field)) {
+            return (
+              <div className="flex gap-5" key={index}>
+                {field.map((f) => {
+                  const groupFormField = getDynamicFormField(fields, f.name);
+
+                  if (!groupFormField) return null;
+
+                  return (
+                    <DynamicFormField
+                      field={f}
+                      formField={groupFormField}
+                      key={groupFormField.id}
+                    />
+                  );
+                })}
+              </div>
+            );
+          }
+
+          const formField = getDynamicFormField(fields, field.name);
+
+          if (!formField) return null;
+
+          return <DynamicFormField field={field} formField={formField} key={formField.id} />;
+        })}
+        <Button
+          loading={pending}
+          name="intent"
+          size="small"
+          type="submit"
+          value="update"
+          variant="secondary"
+        >
+          {submitLabel}
+        </Button>
+      </form>
+    </FormProvider>
   );
 }
diff --git a/core/vibes/soul/sections/cart/client.tsx b/core/vibes/soul/sections/cart/client.tsx
index fc5b8ffb8d..99c07850c6 100644
--- a/core/vibes/soul/sections/cart/client.tsx
+++ b/core/vibes/soul/sections/cart/client.tsx
@@ -1,16 +1,18 @@
 'use client';
 
-import { getFormProps, getInputProps, SubmissionResult, useForm } from '@conform-to/react';
-import { parseWithZod } from '@conform-to/zod';
+import { SubmissionResult, useForm } from '@conform-to/react';
 import { clsx } from 'clsx';
+import debounce from 'lodash.debounce';
 import { ArrowRight, GiftIcon, Minus, Plus, Trash2 } from 'lucide-react';
 import {
   ComponentPropsWithoutRef,
+  FormEvent,
   startTransition,
   useActionState,
   useEffect,
   useMemo,
-  useOptimistic,
+  useRef,
+  useState,
 } from 'react';
 import { useFormStatus } from 'react-dom';
 
@@ -29,7 +31,6 @@ import { Image } from '~/components/image';
 
 import { AddCartToQuoteButton } from './add-cart-to-quote-button';
 import { CouponCodeForm, CouponCodeFormState } from './coupon-code-form';
-import { cartLineItemActionFormDataSchema } from './schema';
 import { ShippingForm, ShippingFormState } from './shipping-form';
 
 import { CartEmptyState } from '.';
@@ -181,6 +182,8 @@ const defaultEmptyState = {
   cta: { label: 'Continue shopping', href: '#' },
 };
 
+type PendingLineItemIntent = { intent: 'update'; quantity: number } | { intent: 'delete' };
+
 // eslint-disable-next-line valid-jsdoc
 /**
  * This component supports various CSS variables for theming. Here's a comprehensive list, along
@@ -232,6 +235,20 @@ export function CartClient<LineItem extends CartLineItem>({
 
   const [form] = useForm({ lastResult: state.lastResult });
 
+  // Server actions run strictly serially, so rapid clicks coalesce into pending intents
+  // (one per line item, newer clicks overwrite) flushed at most one action at a time.
+  // Instance-level on purpose: if a consumer remounts this section mid-flight (e.g. by
+  // keying it on cart version), intents die with the instance and the UI snaps back to
+  // server truth, instead of a longer-lived dispatcher deadlocking on an action React
+  // silently dropped at unmount.
+  const [pendingLineItemIntents] = useState(() => new Map<string, PendingLineItemIntent>());
+  const inFlightIntentRef = useRef<{ id: string; entry: PendingLineItemIntent } | null>(null);
+
+  // Bumped whenever pendingLineItemIntents changes so renders re-read the mutable map.
+  const [, setPendingIntentsRevision] = useState(0);
+
+  const isCartMutationPending = isLineItemActionPending || pendingLineItemIntents.size > 0;
+
   useEffect(() => {
     if (form.errors) {
       form.errors.forEach((error) => {
@@ -240,10 +257,131 @@ export function CartClient<LineItem extends CartLineItem>({
     }
   }, [form.errors]);
 
-  // Prevent page unload when line item action is pending
+  const flushNextIntent = () => {
+    if (inFlightIntentRef.current !== null) return;
+
+    // Resolve each intent against server truth once: an intent is stale if its row is
+    // gone or already matches the confirmed quantity.
+    const resolved = Array.from(pendingLineItemIntents.entries()).map(([intentId, intentEntry]) => {
+      const item = cart.lineItems.find((lineItem) => lineItem.id === intentId);
+
+      return {
+        id: intentId,
+        entry: intentEntry,
+        item,
+        isStale:
+          !item || (intentEntry.intent === 'update' && intentEntry.quantity === item.quantity),
+      };
+    });
+
+    const staleEntries = resolved.filter(({ isStale }) => isStale);
+
+    if (staleEntries.length > 0) {
+      staleEntries.forEach(({ id: staleId }) => pendingLineItemIntents.delete(staleId));
+      setPendingIntentsRevision((revision) => revision + 1);
+    }
+
+    const next = resolved.find(({ isStale }) => !isStale);
+
+    if (!next?.item) return;
+
+    const { id, entry, item: confirmedItem } = next;
+
+    inFlightIntentRef.current = { id, entry };
+
+    const formData = new FormData();
+
+    formData.append('id', id);
+    formData.append('intent', entry.intent);
+
+    if (entry.intent === 'update') {
+      formData.append('quantity', entry.quantity.toString());
+    }
+
+    // Analytics fire once per flush with the net change, not once per click.
+    const analyticsFormData = new FormData();
+
+    analyticsFormData.append('id', id);
+    analyticsFormData.append('intent', entry.intent);
+
+    if (entry.intent === 'update') {
+      const netChange = entry.quantity - confirmedItem.quantity;
+
+      analyticsFormData.append('quantity', Math.abs(netChange).toString());
+
+      if (netChange > 0) events.onAddToCart?.(analyticsFormData);
+      if (netChange < 0) events.onRemoveFromCart?.(analyticsFormData);
+    } else {
+      analyticsFormData.append('quantity', confirmedItem.quantity.toString());
+      events.onRemoveFromCart?.(analyticsFormData);
+    }
+
+    startTransition(() => {
+      formAction(formData);
+    });
+  };
+
+  const flushRef = useRef(flushNextIntent);
+
+  useEffect(() => {
+    flushRef.current = flushNextIntent;
+  });
+
+  // Trailing debounce with no maxWait: a mid-burst flush would spend a request on a
+  // quantity the user is still changing, and the final absolute value supersedes it
+  // anyway. The pagehide and nav-guard flushes cover leaving before the timer fires.
+  const debouncedFlush = useMemo(() => debounce(() => flushRef.current(), 400), []);
+
+  useEffect(() => () => debouncedFlush.cancel(), [debouncedFlush]);
+
+  const queueLineItemIntent = (id: string, entry: PendingLineItemIntent) => {
+    pendingLineItemIntents.set(id, entry);
+    setPendingIntentsRevision((revision) => revision + 1);
+    debouncedFlush();
+
+    // Quantity clicks coalesce inside the debounce window, but removal flushes right away.
+    if (entry.intent === 'delete') {
+      debouncedFlush.flush();
+    }
+  };
+
+  // Settle observer: when a flush completes, clear its intent and flush any backlog
+  // queued while it was in flight (flushNextIntent prunes intents the settled action
+  // already confirmed). The section is keyed stably, so this instance survives the
+  // revalidation and dispatching from here is safe.
+  useEffect(() => {
+    if (isLineItemActionPending) return;
+    if (inFlightIntentRef.current === null) return;
+
+    const { id, entry } = inFlightIntentRef.current;
+
+    inFlightIntentRef.current = null;
+
+    // Clear the intent we just flushed unless newer clicks replaced it mid-flight; if
+    // the action failed this reverts the row to server truth (the error toast explains why).
+    if (pendingLineItemIntents.get(id) === entry) {
+      pendingLineItemIntents.delete(id);
+      setPendingIntentsRevision((revision) => revision + 1);
+    }
+
+    if (pendingLineItemIntents.size > 0) {
+      flushRef.current();
+    }
+  }, [isLineItemActionPending, state, pendingLineItemIntents]);
+
+  // A full page unload can't wait on the debounce timer.
+  useEffect(() => {
+    const flushPendingIntents = () => debouncedFlush.flush();
+
+    window.addEventListener('pagehide', flushPendingIntents);
+
+    return () => window.removeEventListener('pagehide', flushPendingIntents);
+  }, [debouncedFlush]);
+
+  // Prevent page unload when a cart mutation is pending
   useEffect(() => {
     const handleBeforeUnload = (event: BeforeUnloadEvent) => {
-      if (isLineItemActionPending) {
+      if (isCartMutationPending) {
         event.preventDefault();
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         event.returnValue = ''; // Chrome requires returnValue to be set
@@ -252,19 +390,19 @@ export function CartClient<LineItem extends CartLineItem>({
       }
     };
 
-    if (isLineItemActionPending) {
+    if (isCartMutationPending) {
       window.addEventListener('beforeunload', handleBeforeUnload);
     }
 
     return () => {
       window.removeEventListener('beforeunload', handleBeforeUnload);
     };
-  }, [isLineItemActionPending]);
+  }, [isCartMutationPending]);
 
-  // Prevent client-side navigation when line item action is pending
+  // Prevent client-side navigation when a cart mutation is pending
   useEffect(() => {
     const handleClick = (event: MouseEvent) => {
-      if (isLineItemActionPending && event.target instanceof HTMLElement) {
+      if (isCartMutationPending && event.target instanceof HTMLElement) {
         const link = event.target.closest('a[href]');
 
         if (
@@ -276,7 +414,10 @@ export function CartClient<LineItem extends CartLineItem>({
           // eslint-disable-next-line no-alert
           const shouldNavigate = window.confirm(lineItemActionPendingLabel);
 
-          if (!shouldNavigate) {
+          if (shouldNavigate) {
+            // Dispatch any debounced intent now, while this instance can still send it.
+            debouncedFlush.flush();
+          } else {
             event.preventDefault();
             event.stopPropagation();
           }
@@ -286,7 +427,7 @@ export function CartClient<LineItem extends CartLineItem>({
 
     const handleKeyDown = (event: KeyboardEvent) => {
       if (
-        isLineItemActionPending &&
+        isCartMutationPending &&
         (event.key === 'Enter' || event.key === ' ') &&
         event.target instanceof HTMLElement
       ) {
@@ -301,7 +442,10 @@ export function CartClient<LineItem extends CartLineItem>({
           // eslint-disable-next-line no-alert
           const shouldNavigate = window.confirm(lineItemActionPendingLabel);
 
-          if (!shouldNavigate) {
+          if (shouldNavigate) {
+            // Dispatch any debounced intent now, while this instance can still send it.
+            debouncedFlush.flush();
+          } else {
             event.preventDefault();
             event.stopPropagation();
           }
@@ -309,7 +453,7 @@ export function CartClient<LineItem extends CartLineItem>({
       }
     };
 
-    if (isLineItemActionPending) {
+    if (isCartMutationPending) {
       document.addEventListener('click', handleClick, true);
       document.addEventListener('keydown', handleKeyDown, true);
     }
@@ -318,50 +462,21 @@ export function CartClient<LineItem extends CartLineItem>({
       document.removeEventListener('click', handleClick, true);
       document.removeEventListener('keydown', handleKeyDown, true);
     };
-  }, [isLineItemActionPending, lineItemActionPendingLabel]);
-
-  const [optimisticLineItems, setOptimisticLineItems] = useOptimistic<CartLineItem[], FormData>(
-    state.lineItems,
-    (prevState, formData) => {
-      const submission = parseWithZod(formData, { schema: cartLineItemActionFormDataSchema });
+  }, [isCartMutationPending, lineItemActionPendingLabel, debouncedFlush]);
 
-      if (submission.status !== 'success') return prevState;
+  // Server truth (the revalidation-refreshed cart prop, not useActionState's mount-frozen
+  // state) overlaid with pending intents; pendingIntentsRevision invalidates this on change.
+  const displayLineItems: CartLineItem[] = cart.lineItems
+    .filter((item) => pendingLineItemIntents.get(item.id)?.intent !== 'delete')
+    .map((item) => {
+      const pending = pendingLineItemIntents.get(item.id);
 
-      switch (submission.value.intent) {
-        case 'increment': {
-          const { id } = submission.value;
+      return pending?.intent === 'update' ? { ...item, quantity: pending.quantity } : item;
+    });
 
-          return prevState.map((item) =>
-            item.id === id ? { ...item, quantity: item.quantity + 1 } : item,
-          );
-        }
-
-        case 'decrement': {
-          const { id } = submission.value;
-
-          return prevState.map((item) =>
-            item.id === id ? { ...item, quantity: item.quantity - 1 } : item,
-          );
-        }
-
-        case 'delete': {
-          const { id } = submission.value;
-
-          return prevState.filter((item) => item.id !== id);
-        }
-
-        default:
-          return prevState;
-      }
-    },
-  );
-
-  const optimisticQuantity = useMemo(
-    () => optimisticLineItems.reduce((total, item) => total + item.quantity, 0),
-    [optimisticLineItems],
-  );
+  const displayTotalQuantity = displayLineItems.reduce((total, item) => total + item.quantity, 0);
 
-  if (optimisticQuantity === 0) {
+  if (displayTotalQuantity === 0) {
     return <CartEmptyState {...emptyState} />;
   }
 
@@ -378,7 +493,7 @@ export function CartClient<LineItem extends CartLineItem>({
               {cart.summaryItems.map((summaryItem, index) => (
                 <div className="flex justify-between py-4" key={index}>
                   <dt>{summaryItem.label}</dt>
-                  {isLineItemActionPending ? (
+                  {isCartMutationPending ? (
                     <Skeleton.Text characterCount={8} className="animate-pulse rounded-md" />
                   ) : (
                     <dd>{summaryItem.value}</dd>
@@ -413,7 +528,7 @@ export function CartClient<LineItem extends CartLineItem>({
             <div className="border-t border-[var(--cart-border,hsl(var(--contrast-100)))] py-6">
               <div className="flex justify-between text-xl font-bold">
                 <dt>{cart.totalLabel ?? 'Total'}</dt>
-                {isLineItemActionPending ? (
+                {isCartMutationPending ? (
                   <Skeleton.Text characterCount={8} className="animate-pulse rounded-md" />
                 ) : (
                   <dd>{cart.total}</dd>
@@ -430,7 +545,7 @@ export function CartClient<LineItem extends CartLineItem>({
             <CheckoutButton
               action={checkoutAction}
               className="mt-4 w-full"
-              isCartUpdatePending={isLineItemActionPending}
+              isCartUpdatePending={isCartMutationPending}
             >
               {checkoutLabel}
               <ArrowRight size={20} strokeWidth={1} />
@@ -448,12 +563,12 @@ export function CartClient<LineItem extends CartLineItem>({
         <h1 className="mb-10 font-[family-name:var(--cart-title-font-family,var(--font-family-heading))] text-4xl font-medium leading-none @xl:text-5xl">
           {title}
           <span className="ml-4 text-[var(--cart-subtext-text,hsl(var(--contrast-300)))] contrast-more:text-[var(--cart-subtitle-text,hsl(var(--contrast-500)))]">
-            {optimisticQuantity}
+            {displayTotalQuantity}
           </span>
         </h1>
         {/* Cart Items */}
         <ul className="flex flex-col gap-5">
-          {optimisticLineItems.map((lineItem) => (
+          {displayLineItems.map((lineItem) => (
             <li
               className="flex flex-col items-start gap-x-5 gap-y-4 @container @sm:flex-row"
               key={lineItem.id}
@@ -488,32 +603,10 @@ export function CartClient<LineItem extends CartLineItem>({
                   deleteLabel={deleteLineItemLabel}
                   incrementLabel={incrementLineItemLabel}
                   lineItem={lineItem}
-                  onSubmit={(formData) => {
-                    startTransition(() => {
-                      formAction(formData);
-                      setOptimisticLineItems(formData);
-
-                      const intent = formData.get('intent');
-
-                      if (intent === 'increment') {
-                        formData.set('quantity', '1');
-
-                        events.onAddToCart?.(formData);
-                      }
-
-                      if (intent === 'decrement') {
-                        formData.set('quantity', '1');
-
-                        events.onRemoveFromCart?.(formData);
-                      }
-
-                      if (intent === 'delete') {
-                        formData.set('quantity', lineItem.quantity.toString());
-
-                        events.onRemoveFromCart?.(formData);
-                      }
-                    });
-                  }}
+                  onDelete={() => queueLineItemIntent(lineItem.id, { intent: 'delete' })}
+                  onUpdateQuantity={(quantity) =>
+                    queueLineItemIntent(lineItem.id, { intent: 'update', quantity })
+                  }
                 />
               </div>
             </li>
@@ -527,7 +620,8 @@ export function CartClient<LineItem extends CartLineItem>({
 function CounterForm({
   lineItem,
   action,
-  onSubmit,
+  onDelete,
+  onUpdateQuantity,
   incrementLabel = 'Increase count',
   decrementLabel = 'Decrease count',
   deleteLabel = 'Remove item',
@@ -537,26 +631,30 @@ function CounterForm({
   decrementLabel?: string;
   deleteLabel?: string;
   action: (payload: FormData) => void;
-  onSubmit: (formData: FormData) => void;
+  onDelete: () => void;
+  onUpdateQuantity: (quantity: number) => void;
 }) {
-  const [form, fields] = useForm({
-    defaultValue: { id: lineItem.id },
-    shouldValidate: 'onBlur',
-    shouldRevalidate: 'onInput',
-    onValidate({ formData }) {
-      return parseWithZod(formData, { schema: cartLineItemActionFormDataSchema });
-    },
-    onSubmit(event, { formData }) {
-      event.preventDefault();
+  // Every control is its own micro-form (`display: contents`, so layout is unaffected)
+  // rather than one form per line item, because the quantity buttons each need their own
+  // hidden `quantity` field and forms can't nest. Without JS, each posts its pre-computed
+  // absolute quantity (or delete) straight to the server action. With JS, onSubmit
+  // intercepts and routes through the coalescing dispatcher instead, so rapid clicks
+  // debounce into one request rather than one per click.
+  const handleDeleteSubmit = (event: FormEvent) => {
+    event.preventDefault();
+    onDelete();
+  };
 
-      onSubmit(formData);
-    },
-  });
+  const handleUpdateQuantitySubmit = (quantity: number) => (event: FormEvent) => {
+    event.preventDefault();
+    onUpdateQuantity(quantity);
+  };
 
   if (lineItem.typename === 'CartGiftCertificate') {
     return (
-      <form {...getFormProps(form)} action={action}>
-        <input {...getInputProps(fields.id, { type: 'hidden' })} key={fields.id.id} />
+      <form action={action} onSubmit={handleDeleteSubmit}>
+        <input name="id" type="hidden" value={lineItem.id} />
+        <input name="intent" type="hidden" value="delete" />
         <div className="flex w-full flex-wrap items-center gap-x-5 gap-y-2">
           {typeof lineItem.price === 'string' && (
             <span className="font-medium @xl:ml-auto">{lineItem.price}</span>
@@ -569,9 +667,7 @@ function CounterForm({
           <button
             aria-label={deleteLabel}
             className="group -ml-1 flex h-8 w-8 shrink-0 items-center justify-center rounded-full transition-colors duration-300 hover:bg-[var(--cart-button-background,hsl(var(--contrast-100)))] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--cart-focus,hsl(var(--primary)))] focus-visible:ring-offset-4"
-            name="intent"
             type="submit"
-            value="delete"
           >
             <Trash2
               className="text-[var(--cart-icon,hsl(var(--contrast-300)))] group-hover:text-[var(--cart-icon-hover,hsl(var(--foreground)))]"
@@ -585,21 +681,27 @@ function CounterForm({
   }
 
   return (
-    <form {...getFormProps(form)} action={action}>
-      <input {...getInputProps(fields.id, { type: 'hidden' })} key={fields.id.id} />
-      <div className="flex w-full flex-wrap items-center gap-x-5 gap-y-2">
-        <PriceLabel className="mt-3 self-start @xl:ml-auto" price={lineItem.price} />
-        <div className="flex size-min flex-col gap-y-0">
-          <div className="mb-1 mt-1 flex items-center gap-x-5">
-            {/* Counter */}
-            <div
-              className={clsx(
-                'flex items-center rounded-lg border border-[var(--cart-counter-border,hsl(var(--contrast-100)))]',
-                (lineItem.inventoryMessages?.outOfStockMessage != null ||
-                  lineItem.inventoryMessages?.quantityOutOfStockMessage != null) &&
-                  'border-red-500',
-              )}
+    <div className="flex w-full flex-wrap items-center gap-x-5 gap-y-2">
+      <PriceLabel className="mt-3 self-start @xl:ml-auto" price={lineItem.price} />
+      <div className="flex size-min flex-col gap-y-0">
+        <div className="mb-1 mt-1 flex items-center gap-x-5">
+          {/* Counter */}
+          <div
+            className={clsx(
+              'flex items-center rounded-lg border border-[var(--cart-counter-border,hsl(var(--contrast-100)))]',
+              (lineItem.inventoryMessages?.outOfStockMessage != null ||
+                lineItem.inventoryMessages?.quantityOutOfStockMessage != null) &&
+                'border-red-500',
+            )}
+          >
+            <form
+              action={action}
+              className="contents"
+              onSubmit={handleUpdateQuantitySubmit(lineItem.quantity - 1)}
             >
+              <input name="id" type="hidden" value={lineItem.id} />
+              <input name="intent" type="hidden" value="update" />
+              <input name="quantity" type="hidden" value={lineItem.quantity - 1} />
               <button
                 aria-label={decrementLabel}
                 className={clsx(
@@ -609,9 +711,7 @@ function CounterForm({
                     : 'hover:bg-[var(--cart-counter-background-hover,hsl(var(--contrast-100)/50%))]',
                 )}
                 disabled={lineItem.quantity === 1}
-                name="intent"
                 type="submit"
-                value="decrement"
               >
                 <Minus
                   className={clsx(
@@ -623,17 +723,24 @@ function CounterForm({
                   strokeWidth={1.5}
                 />
               </button>
-              <span className="flex w-8 select-none justify-center focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--cart-focus,hsl(var(--primary)))]">
-                {lineItem.quantity}
-              </span>
+            </form>
+            <span className="flex w-8 select-none justify-center focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--cart-focus,hsl(var(--primary)))]">
+              {lineItem.quantity}
+            </span>
+            <form
+              action={action}
+              className="contents"
+              onSubmit={handleUpdateQuantitySubmit(lineItem.quantity + 1)}
+            >
+              <input name="id" type="hidden" value={lineItem.id} />
+              <input name="intent" type="hidden" value="update" />
+              <input name="quantity" type="hidden" value={lineItem.quantity + 1} />
               <button
                 aria-label={incrementLabel}
                 className={clsx(
                   'group rounded-r-lg bg-[var(--cart-counter-background,hsl(var(--background)))] p-3 transition-colors duration-300 hover:bg-[var(--cart-counter-background-hover,hsl(var(--contrast-100)/50%))] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--cart-focus,hsl(var(--primary)))] disabled:cursor-not-allowed',
                 )}
-                name="intent"
                 type="submit"
-                value="increment"
               >
                 <Plus
                   className="text-[var(--cart-counter-icon,hsl(var(--contrast-300)))] transition-colors duration-300 group-hover:text-[var(--cart-counter-icon-hover,hsl(var(--foreground)))]"
@@ -641,13 +748,15 @@ function CounterForm({
                   strokeWidth={1.5}
                 />
               </button>
-            </div>
+            </form>
+          </div>
+          <form action={action} className="contents" onSubmit={handleDeleteSubmit}>
+            <input name="id" type="hidden" value={lineItem.id} />
+            <input name="intent" type="hidden" value="delete" />
             <button
               aria-label={deleteLabel}
               className="group -ml-1 mt-1.5 flex h-8 w-8 shrink-0 items-center justify-center self-start rounded-full transition-colors duration-300 hover:bg-[var(--cart-button-background,hsl(var(--contrast-100)))] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--cart-focus,hsl(var(--primary)))] focus-visible:ring-offset-4"
-              name="intent"
               type="submit"
-              value="delete"
             >
               <Trash2
                 className="text-[var(--cart-icon,hsl(var(--contrast-300)))] group-hover:text-[var(--cart-icon-hover,hsl(var(--foreground)))]"
@@ -655,35 +764,35 @@ function CounterForm({
                 strokeWidth={1}
               />
             </button>
-          </div>
-          {lineItem.inventoryMessages?.outOfStockMessage != null && (
-            <span className="text-xs/5 font-light text-red-500">
-              {lineItem.inventoryMessages.outOfStockMessage}
-            </span>
-          )}
-          {lineItem.inventoryMessages?.quantityOutOfStockMessage != null && (
-            <span className="mb-3 text-xs/5 font-light text-red-500">
-              {lineItem.inventoryMessages.quantityOutOfStockMessage}
-            </span>
-          )}
-          {lineItem.inventoryMessages?.quantityReadyToShipMessage != null && (
-            <span className="text-xs/5 font-light">
-              {lineItem.inventoryMessages.quantityReadyToShipMessage}
-            </span>
-          )}
-          {lineItem.inventoryMessages?.quantityBackorderedMessage != null && (
-            <span className="text-xs/5 font-light">
-              {lineItem.inventoryMessages.quantityBackorderedMessage}
-            </span>
-          )}
-          {lineItem.inventoryMessages?.backorderMessage != null && (
-            <span className="text-xs/5 font-light">
-              {lineItem.inventoryMessages.backorderMessage}
-            </span>
-          )}
+          </form>
         </div>
+        {lineItem.inventoryMessages?.outOfStockMessage != null && (
+          <span className="text-xs/5 font-light text-red-500">
+            {lineItem.inventoryMessages.outOfStockMessage}
+          </span>
+        )}
+        {lineItem.inventoryMessages?.quantityOutOfStockMessage != null && (
+          <span className="mb-3 text-xs/5 font-light text-red-500">
+            {lineItem.inventoryMessages.quantityOutOfStockMessage}
+          </span>
+        )}
+        {lineItem.inventoryMessages?.quantityReadyToShipMessage != null && (
+          <span className="text-xs/5 font-light">
+            {lineItem.inventoryMessages.quantityReadyToShipMessage}
+          </span>
+        )}
+        {lineItem.inventoryMessages?.quantityBackorderedMessage != null && (
+          <span className="text-xs/5 font-light">
+            {lineItem.inventoryMessages.quantityBackorderedMessage}
+          </span>
+        )}
+        {lineItem.inventoryMessages?.backorderMessage != null && (
+          <span className="text-xs/5 font-light">
+            {lineItem.inventoryMessages.backorderMessage}
+          </span>
+        )}
       </div>
-    </form>
+    </div>
   );
 }
 
@@ -698,8 +807,24 @@ function CheckoutButton({
   const [lastResult, formAction] = useActionState(
     async (state: SubmissionResult | null, formData: FormData) => {
       if (typeof action === 'string') {
-        await new Promise<void>(() => {
-          window.location.assign(action);
+        window.location.assign(action);
+
+        // The page normally unloads before this settles. If the navigation is
+        // cancelled instead (Esc, "Stay" on the beforeunload prompt, a stalled
+        // redirect) or the page is restored from bfcache, settle so the button
+        // re-enables as a retry, rather than spinning forever with subsequent
+        // clicks queued behind a never-resolving action.
+        await new Promise<void>((resolve) => {
+          let fallbackTimer: ReturnType<typeof setTimeout>;
+
+          const settle = () => {
+            clearTimeout(fallbackTimer);
+            window.removeEventListener('pageshow', settle);
+            resolve();
+          };
+
+          fallbackTimer = setTimeout(settle, 8000);
+          window.addEventListener('pageshow', settle);
         });
 
         return null;
diff --git a/core/vibes/soul/sections/cart/schema.ts b/core/vibes/soul/sections/cart/schema.ts
index 50d35712e1..cec899a8b8 100644
--- a/core/vibes/soul/sections/cart/schema.ts
+++ b/core/vibes/soul/sections/cart/schema.ts
@@ -2,12 +2,11 @@ import { z } from 'zod';
 
 export const cartLineItemActionFormDataSchema = z.discriminatedUnion('intent', [
   z.object({
-    intent: z.literal('increment'),
-    id: z.string(),
-  }),
-  z.object({
-    intent: z.literal('decrement'),
+    intent: z.literal('update'),
     id: z.string(),
+    // Quantity is absolute so rapid clicks can coalesce into a single request;
+    // 0 is never sent because removal is a separate 'delete' intent.
+    quantity: z.coerce.number().int().min(1),
   }),
   z.object({
     intent: z.literal('delete'),
diff --git a/core/vibes/soul/sections/product-detail/index.tsx b/core/vibes/soul/sections/product-detail/index.tsx
index de0afc1c6d..0f018be749 100644
--- a/core/vibes/soul/sections/product-detail/index.tsx
+++ b/core/vibes/soul/sections/product-detail/index.tsx
@@ -1,4 +1,10 @@
 import { ReactNode } from 'react';
+import {
+  Content as CalloutContent,
+  Header as CalloutHeader,
+  Root as CalloutRoot,
+  Title as CalloutTitle,
+} from 'storefront-kit/callout';
 
 import { Stream, Streamable } from '@/vibes/soul/lib/streamable';
 import { Accordion, AccordionItem } from '@/vibes/soul/primitives/accordion';
@@ -52,6 +58,7 @@ interface ProductDetailProduct {
 
 export interface ProductDetailProps<F extends Field> {
   breadcrumbs?: Streamable<Breadcrumb[]>;
+  promotionCallouts?: Streamable<Array<{ id: string; text: string }>>;
   product: Streamable<ProductDetailProduct | null>;
   action: ProductDetailFormAction<F>;
   fields: Streamable<F[]>;
@@ -98,6 +105,7 @@ export function ProductDetail<F extends Field>({
   action,
   fields: streamableFields,
   breadcrumbs,
+  promotionCallouts,
   quantityLabel,
   incrementLabel,
   decrementLabel,
@@ -201,6 +209,34 @@ export function ProductDetail<F extends Field>({
                       )}
                     </Stream>
                   </div>
+                  {promotionCallouts != null && (
+                    <div className="group/product-promotions mb-4">
+                      <Stream fallback={null} value={promotionCallouts}>
+                        {(callouts) =>
+                          callouts.length > 0 ? (
+                            <div className="flex flex-col gap-2">
+                              {callouts.map((callout) => (
+                                <CalloutRoot
+                                  className="items-start rounded-md border border-yellow-300 bg-yellow-50 px-2.5 py-1.5"
+                                  key={callout.id}
+                                  size="small"
+                                  variant="warning"
+                                >
+                                  <CalloutContent>
+                                    <CalloutHeader>
+                                      <CalloutTitle className="text-xs font-semibold leading-snug text-yellow-900">
+                                        {callout.text}
+                                      </CalloutTitle>
+                                    </CalloutHeader>
+                                  </CalloutContent>
+                                </CalloutRoot>
+                              ))}
+                            </div>
+                          ) : null
+                        }
+                      </Stream>
+                    </div>
+                  )}
                   <div className="group/product-gallery mb-8 @2xl:hidden">
                     <Stream fallback={<ProductGallerySkeleton />} value={product.images}>
                       {(imagesData) => (
diff --git a/core/vibes/soul/sections/product-detail/lite-youtube-embed.d.ts b/core/vibes/soul/sections/product-detail/lite-youtube-embed.d.ts
new file mode 100644
index 0000000000..4fa68430ba
--- /dev/null
+++ b/core/vibes/soul/sections/product-detail/lite-youtube-embed.d.ts
@@ -0,0 +1,5 @@
+// `lite-youtube-embed` ships no TypeScript declarations. It is imported only for
+// its side effect — registering the <lite-youtube> custom element — so an ambient
+// module declaration (implicit `any`) is sufficient and keeps the production
+// `next build` / `tsc` typecheck passing.
+declare module 'lite-youtube-embed';
diff --git a/core/vibes/soul/sections/product-detail/lite-youtube.tsx b/core/vibes/soul/sections/product-detail/lite-youtube.tsx
new file mode 100644
index 0000000000..740751f457
--- /dev/null
+++ b/core/vibes/soul/sections/product-detail/lite-youtube.tsx
@@ -0,0 +1,47 @@
+'use client';
+
+// lite-youtube-embed is a tiny, dependency-free custom element that renders a
+// YouTube facade (poster + play button) and only injects the real iframe on
+// click — the standard "third-party facade" pattern. The CSS styles the element.
+import 'lite-youtube-embed/src/lite-yt-embed.css';
+
+import type { CSSProperties } from 'react';
+
+// Register the <lite-youtube> custom element on the client only: the package
+// subclasses HTMLElement at import time, which isn't defined during SSR. The
+// element still renders as inert markup on the server and upgrades on hydration.
+if (typeof window !== 'undefined') {
+  void import('lite-youtube-embed');
+}
+
+declare module 'react' {
+  namespace JSX {
+    interface IntrinsicElements {
+      'lite-youtube': React.DetailedHTMLProps<React.HTMLAttributes<HTMLElement>, HTMLElement> & {
+        videoid: string;
+        playlabel?: string;
+        params?: string;
+      };
+    }
+  }
+}
+
+export interface LiteYouTubeProps {
+  videoId: string;
+  /** Visually-hidden label for the play button (accessibility). */
+  playLabel: string;
+  className?: string;
+  style?: CSSProperties;
+}
+
+export function LiteYouTube({ videoId, playLabel, className, style }: LiteYouTubeProps) {
+  return (
+    <lite-youtube
+      className={className}
+      params="rel=0"
+      playlabel={playLabel}
+      style={style}
+      videoid={videoId}
+    />
+  );
+}
diff --git a/core/vibes/soul/sections/product-detail/product-videos.tsx b/core/vibes/soul/sections/product-detail/product-videos.tsx
new file mode 100644
index 0000000000..109fdd1069
--- /dev/null
+++ b/core/vibes/soul/sections/product-detail/product-videos.tsx
@@ -0,0 +1,153 @@
+'use client';
+
+import { clsx } from 'clsx';
+import { useTranslations } from 'next-intl';
+import { useId, useState } from 'react';
+
+import { Image } from '~/components/image';
+
+import { LiteYouTube } from './lite-youtube';
+import { getYouTubeId, getYouTubePosterUrl } from './video-embed';
+
+export interface ProductVideo {
+  url: string;
+  title: string;
+}
+
+export interface ProductVideosProps {
+  videos: ProductVideo[];
+  className?: string;
+}
+
+// eslint-disable-next-line valid-jsdoc
+/**
+ * Renders product videos as a dedicated section below the primary product
+ * content (mirroring the Stencil/Cornerstone `product_below_content` layout)
+ * rather than inside the image gallery. A single featured player is shown with
+ * a horizontal strip of thumbnails; clicking a thumbnail swaps the featured
+ * video. Product videos are YouTube-only, matching BigCommerce's supported
+ * provider, so non-YouTube URLs are dropped.
+ *
+ * Theming CSS variables (shared with the gallery):
+ *
+ * ```css
+ * :root {
+ *   --product-gallery-focus: hsl(var(--primary));
+ *   --product-gallery-image-background: hsl(var(--contrast-100));
+ *   --product-gallery-image-border-active: hsl(var(--foreground));
+ *   --product-detail-primary-text: hsl(var(--foreground));
+ *   --product-detail-title-font-family: var(--font-family-heading);
+ * }
+ * ```
+ */
+export function ProductVideos({ videos, className }: ProductVideosProps) {
+  const t = useTranslations('Product.ProductDetails');
+
+  // Resolve to YouTube ids up front; non-YouTube URLs are skipped (YouTube is
+  // the only supported product-video provider).
+  const youtubeVideos = videos
+    .map((video) => ({ id: getYouTubeId(video.url), title: video.title }))
+    .filter((video): video is { id: string; title: string } => video.id !== null);
+
+  const [selectedIndex, setSelectedIndex] = useState(0);
+  const [isOpen, setIsOpen] = useState(true);
+  const panelId = useId();
+
+  const featured = youtubeVideos[Math.min(selectedIndex, youtubeVideos.length - 1)];
+
+  // No renderable (YouTube) videos — render nothing. The `!featured` check also
+  // narrows the indexed access to a defined value for the rest of the render.
+  if (!featured) return null;
+
+  return (
+    <section aria-label={t('videosTitle')} className={clsx('@container', className)}>
+      <div className="mx-auto w-full max-w-screen-2xl px-4 py-10 @xl:px-6 @xl:py-14 @4xl:px-8 @4xl:py-20">
+        <div className="mb-6 flex items-center justify-between">
+          <h2 className="font-[family-name:var(--product-detail-title-font-family,var(--font-family-heading))] text-2xl font-medium text-[var(--product-detail-primary-text,hsl(var(--foreground)))] @xl:text-3xl @4xl:text-4xl">
+            {t('videosTitle')}
+          </h2>
+          <button
+            aria-controls={panelId}
+            aria-expanded={isOpen}
+            className="text-sm font-semibold text-[var(--product-detail-primary-text,hsl(var(--foreground)))] underline-offset-4 transition-opacity hover:opacity-80"
+            onClick={() => setIsOpen((open) => !open)}
+            type="button"
+          >
+            {isOpen ? t('hideVideos') : t('showVideos')}
+          </button>
+        </div>
+
+        {isOpen && (
+          <div className="duration-200 animate-in fade-in" id={panelId}>
+            {/* Featured player */}
+            <div className="relative aspect-video w-full overflow-hidden rounded-lg bg-[var(--product-gallery-image-background,hsl(var(--contrast-100)))]">
+              <LiteYouTube
+                className="h-full w-full max-w-none"
+                // Remount when the featured video changes so the previously
+                // playing player stops (and frees its audio).
+                key={featured.id}
+                playLabel={`${t('playVideo')}: ${featured.title}`}
+                videoId={featured.id}
+              />
+            </div>
+            {Boolean(featured.title) && (
+              <p className="mb-4 mt-3 text-sm font-semibold text-[var(--product-detail-primary-text,hsl(var(--foreground)))]">
+                {featured.title}
+              </p>
+            )}
+
+            {/* Thumbnail strip — only when there's more than one video to choose from. */}
+            {youtubeVideos.length > 1 && (
+              <div className="flex gap-3 overflow-x-auto pb-2">
+                {youtubeVideos.map((video, index) => (
+                  <button
+                    aria-label={`${t('viewVideo')}: ${video.title}`}
+                    aria-pressed={index === selectedIndex}
+                    className={clsx(
+                      'group relative w-40 shrink-0 overflow-hidden rounded-lg border transition-all duration-200 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--product-gallery-focus,hsl(var(--primary)))] focus-visible:ring-offset-2 @md:w-48',
+                      index === selectedIndex
+                        ? 'border-[var(--product-gallery-image-border-active,hsl(var(--foreground)))]'
+                        : 'border-transparent',
+                    )}
+                    key={`${video.id}-${index}`}
+                    onClick={() => setSelectedIndex(index)}
+                    type="button"
+                  >
+                    <div className="relative aspect-video w-full bg-[var(--product-gallery-image-background,hsl(var(--contrast-100)))]">
+                      <Image
+                        alt={video.title}
+                        className={clsx(
+                          'object-cover transition-opacity',
+                          index === selectedIndex
+                            ? 'opacity-100'
+                            : 'opacity-70 group-hover:opacity-100',
+                        )}
+                        fill
+                        sizes="12rem"
+                        src={getYouTubePosterUrl(video.id)}
+                      />
+                      {/* Play badge marks the thumbnail as a video. */}
+                      <span className="absolute inset-0 flex items-center justify-center">
+                        <span className="flex h-8 w-8 items-center justify-center rounded-full bg-black/60 text-white">
+                          <svg
+                            aria-hidden="true"
+                            fill="currentColor"
+                            height="14"
+                            viewBox="0 0 24 24"
+                            width="14"
+                          >
+                            <path d="M8 5v14l11-7z" />
+                          </svg>
+                        </span>
+                      </span>
+                    </div>
+                  </button>
+                ))}
+              </div>
+            )}
+          </div>
+        )}
+      </div>
+    </section>
+  );
+}
diff --git a/core/vibes/soul/sections/product-detail/video-embed.ts b/core/vibes/soul/sections/product-detail/video-embed.ts
new file mode 100644
index 0000000000..c77050f692
--- /dev/null
+++ b/core/vibes/soul/sections/product-detail/video-embed.ts
@@ -0,0 +1,56 @@
+/**
+ * Product videos come from the Storefront GraphQL API as a YouTube watch URL
+ * (e.g. `https://www.youtube.com/watch?v=...`). The `<lite-youtube>` player
+ * (see ./lite-youtube) needs the bare video id, and the Videos section thumbnail
+ * needs a poster image — both are derived here. The embedding itself (iframe, facade,
+ * autoplay) is handled by the lite-youtube-embed library.
+ *
+ * Product videos are YouTube-only; any other URL yields a null id and is skipped.
+ */
+
+// YouTube ids are short alphanumeric tokens; reject anything else so a malformed
+// path tail or encoded query material can't leak through.
+const YOUTUBE_ID = /^[\w-]{6,}$/;
+const YOUTUBE_HOSTS = new Set(['youtube.com', 'm.youtube.com', 'youtu.be']);
+
+// Extract the YouTube video id from a watch/share URL, or null if it isn't a
+// (safe http/https) YouTube URL.
+export function getYouTubeId(rawUrl: string): string | null {
+  let url: URL;
+
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+
+  const host = url.hostname.replace(/^www\./, '');
+
+  if (!YOUTUBE_HOSTS.has(host)) return null;
+
+  // https://www.youtube.com/watch?v=ID
+  const vParam = url.searchParams.get('v');
+
+  if (vParam && YOUTUBE_ID.test(vParam)) return vParam;
+
+  // https://www.youtube.com/embed/ID, /shorts/ID, /v/ID
+  const match = /\/(?:embed|shorts|v)\/([\w-]+)/.exec(url.pathname);
+
+  if (match?.[1] && YOUTUBE_ID.test(match[1])) return match[1];
+
+  // https://youtu.be/ID — first path segment only, ignoring any tail.
+  if (host === 'youtu.be') {
+    const [, first] = url.pathname.split('/');
+
+    if (first && YOUTUBE_ID.test(first)) return first;
+  }
+
+  return null;
+}
+
+// Poster/thumbnail image URL for a YouTube video id (used by the gallery thumbnail).
+export function getYouTubePosterUrl(videoId: string): string {
+  return `https://i.ytimg.com/vi/${videoId}/hqdefault.jpg`;
+}
diff --git a/packages/catalyst/AGENTS.md b/packages/catalyst/AGENTS.md
new file mode 100644
index 0000000000..1b968d9392
--- /dev/null
+++ b/packages/catalyst/AGENTS.md
@@ -0,0 +1,96 @@
+# Catalyst CLI (`@bigcommerce/catalyst`)
+
+CLI tool for Catalyst development and deployment — handles build, dev server, and deployment to Cloudflare Workers.
+
+## Directory Structure
+
+```
+src/cli/
+├── index.ts          # Entry point (#!/usr/bin/env node)
+├── program.ts        # Commander program setup, registers all commands
+├── commands/         # CLI command implementations (auth, build, deploy, logs, project, start, telemetry, version)
+├── hooks/            # Pre/post action hooks (telemetry)
+└── lib/              # Utilities (auth, logger, project config, credentials, wrangler config, telemetry, deployment errors)
+templates/            # OpenNext config and public_headers template
+tests/mocks/          # MSW handlers and test mocks
+dist/cli.js           # Bundled output (single ESM file)
+```
+
+## CLI Commands
+
+| Command | Description |
+|---------|-------------|
+| `auth whoami/login/logout` | Manage authentication (device code OAuth flow, credential storage) |
+| `build` | Build Catalyst project using OpenNext/Cloudflare adapter |
+| `deploy` | Deploy to Cloudflare with bundle upload |
+| `logs` | View logs (`tail` default, `query` planned). Supports `--format` (default/json/pretty/short/request) |
+| `project create/list/link` | Manage BigCommerce infrastructure projects |
+| `start` | Start local preview using OpenNext Cloudflare adapter |
+| `telemetry` | Enable/disable/check telemetry |
+| `version` | Display version and platform info |
+
+## Development
+
+```bash
+pnpm dev          # Watch mode (rebuilds dist/cli.js on changes)
+pnpm build        # Production build via tsup
+pnpm test         # Run tests (vitest)
+pnpm test:watch   # Watch mode tests
+pnpm typecheck    # tsc --noEmit
+pnpm lint         # eslint with 0 warnings threshold
+```
+
+## Testing Changes
+
+To test CLI changes directly without a full publish cycle, build the CLI package first, then run the compiled output from inside the `core/` directory using its absolute path:
+
+```bash
+# From packages/catalyst — rebuild the CLI
+pnpm build
+
+# From core/ — run the CLI using the absolute path to the built output
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js <command>
+```
+
+For example: `pnpm exec <repo-root>/packages/catalyst/dist/cli.js project list`.
+
+## Build
+
+- **Bundler**: tsup (`tsup.config.ts`)
+- **Entry**: `src/cli/index.ts` → `dist/cli.js` (single ESM bundle with source maps)
+- **Environment variables** injected at build time: `CLI_SEGMENT_WRITE_KEY`, `CONSOLA_LEVEL`
+
+## Testing
+
+- **Framework**: Vitest (`vitest.config.ts`)
+- **Coverage threshold**: 100% (strict)
+- **Mocking**: MSW for BigCommerce API calls; telemetry always disabled in tests (`vitest.setup.ts`)
+- **Test files**: co-located as `*.spec.ts` next to source files
+
+## Key Dependencies
+
+- `commander` — CLI framework
+- `execa` — process execution (next, pnpm, wrangler)
+- `consola` — logging
+- `zod` — API response validation
+- `conf` — persistent config (`.bigcommerce/project.json`)
+- `@segment/analytics-node` — telemetry
+- `adm-zip` — bundle zipping for deploy
+
+## After Making Changes
+
+Always run `pnpm typecheck` and `pnpm lint` after making code changes, and fix any errors or warnings before considering the work done. The lint config enforces zero warnings (`--max-warnings 0`). Use `pnpm lint --fix` to auto-fix formatting and fixable lint issues before manually editing.
+
+## Code Style Notes
+
+- **No `let` when avoidable** — prefer `const` with `while (true)` + `break` over mutable flags.
+- **No iterators/generators** — eslint `no-restricted-syntax` disallows `for...of` and generator functions. Use `.forEach()`, `.map()`, etc.
+- **Consola for logging** — use `consola` (from `../lib/logger`) instead of `console`. Use `colorize` from `consola/utils` for colored output.
+- **Shared CLI options** — commands that need `--store-hash`, `--access-token`, `--api-host`, and `--project-uuid` should use the shared option factories from `lib/shared-options.ts`. Chain `.makeOptionMandatory()` inline where needed to preserve commander's extra-typings inference.
+- **SSE stream pattern** — the fetch API's `ReadableStreamDefaultReader` doesn't support async iteration, so `while (true)` + `reader.read()` + `break` is the standard pattern. For long-lived streams, implement a TTL-based reconnect to free connection pool resources, and distinguish server-side disconnects (`TypeError: terminated`) from actual failures for retry logic.
+
+## Integration Points
+
+- **BigCommerce Infrastructure API**: `https://api.bigcommerce.com/stores/{storeHash}/v3/infrastructure/`
+- **Next.js**: dev/build/start
+- **OpenNext + Cloudflare**: serverless build and deploy via Wrangler
diff --git a/packages/catalyst/CHANGELOG.md b/packages/catalyst/CHANGELOG.md
new file mode 100644
index 0000000000..c74b12620c
--- /dev/null
+++ b/packages/catalyst/CHANGELOG.md
@@ -0,0 +1,176 @@
+# @bigcommerce/catalyst
+
+## 1.1.0
+
+### Minor Changes
+
+- [#3111](https://github.com/bigcommerce/catalyst/pull/3111) [`9565d76`](https://github.com/bigcommerce/catalyst/commit/9565d7636de95327651af0a90ced37a352241be7) Thanks [@jorgemoya](https://github.com/jorgemoya)! - `catalyst` now reads the API host from `CATALYST_API_HOST` (renamed from `BIGCOMMERCE_API_HOST`) and resolves it with the same precedence as other credentials: `--api-host` flag > `CATALYST_API_HOST` > `.bigcommerce/project.json` `apiHost` > default `api.bigcommerce.com`. **Breaking:** the `BIGCOMMERCE_API_HOST` environment variable is no longer read — set `CATALYST_API_HOST` instead.
+
+- [#3110](https://github.com/bigcommerce/catalyst/pull/3110) [`5ca4c61`](https://github.com/bigcommerce/catalyst/commit/5ca4c615ead79bc3bf1b7b1bc3ce1743fddeb12b) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Add the `catalyst debug` command, which prints a diagnostic report (CLI version, runtime, the project's package manager, project/config state, telemetry correlation ID, and which key files exist) to include when filing a bug report. Credentials and environment variables are resolved across the same chain a build uses (`process.env` > `.env.local` > `.env` > `.bigcommerce/project.json`) and reported by name and source only — secret values are never printed. Use `--json` for machine-readable output.
+
+- [#3084](https://github.com/bigcommerce/catalyst/pull/3084) [`aadaf27`](https://github.com/bigcommerce/catalyst/commit/aadaf27b72cbbf0889262a26ca44daec54bdbbb4) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Add the `catalyst domains claim` command, which claims ownership of a custom domain that is already in use on another store. When you try to add a domain bound to a different store, `catalyst domains add` now prints the ownership-verification TXT record to publish; after publishing it, run `catalyst domains claim <domain>` to release the domain from the other store and bind it to your project.
+
+- [#3089](https://github.com/bigcommerce/catalyst/pull/3089) [`8d9f9a9`](https://github.com/bigcommerce/catalyst/commit/8d9f9a92da07d65ec8c9cc9a45ec1ffb582d96c7) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Add the `catalyst domains transfer` command, which moves a custom domain from one project to another project in the same store (the same-store counterpart to `domains claim`). Pass `--to-project-uuid <uuid>` to target a specific project, or omit it to pick the destination interactively from your store's projects. When `catalyst domains add` fails because the domain is already bound to another project in the store, it now points you at the exact `domains transfer` command to move it instead of surfacing the raw API error.
+
+- [#3098](https://github.com/bigcommerce/catalyst/pull/3098) [`05f600a`](https://github.com/bigcommerce/catalyst/commit/05f600a5fcee8c17927b2b56343f942a2e6d4b2c) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Env-file loading is now scoped to `catalyst build` and `catalyst deploy` — the only commands that need storefront environment variables (for the build). Previously `.env.local` was auto-loaded globally from the current working directory (but `.env` was not), which was surprising, inconsistent, and affected commands that don't use those variables. Now `build` and `deploy` auto-load `.env.local` and `.env` from the current directory (with `.env.local` taking precedence, and neither overriding your real environment), and you can point at a specific file with `--env-path <path>`. No other command reads env files.
+
+  Migration: if you relied on env vars being auto-loaded for a command other than `build`/`deploy`, set them in your shell environment or pass the relevant flags instead. For a build with an env file outside the project directory, use `catalyst deploy --env-path ../.env.local`.
+
+### Patch Changes
+
+- [#3105](https://github.com/bigcommerce/catalyst/pull/3105) [`552cfb5`](https://github.com/bigcommerce/catalyst/commit/552cfb5c59a1e69b92f7018c2ddc3c9b3c5f0c61) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Add a `--wrangler-version <version>` flag to `catalyst build` and `catalyst deploy` so developers can build against a Wrangler version or dist-tag other than the pinned default. When omitted, the build uses the pinned default as before (and the flag is ignored by `deploy --prebuilt`, which skips the build). The value is validated to look like a version or dist-tag before it's interpolated into the `wrangler@<version>` spec.
+
+- [#3102](https://github.com/bigcommerce/catalyst/pull/3102) [`fea7b30`](https://github.com/bigcommerce/catalyst/commit/fea7b30bab0d1b09dc5bddbe3884317968264760) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Add the `@bigcommerce/catalyst` CLI to a newly created project's `devDependencies` instead of `dependencies`. The CLI is a build-time tool (it only backs the `build`/`start`/`deploy` npm scripts) and is never imported at runtime, so it doesn't belong in runtime dependencies.
+
+- [#3095](https://github.com/bigcommerce/catalyst/pull/3095) [`27373e8`](https://github.com/bigcommerce/catalyst/commit/27373e8a50c9bd0703f474364a7c269947d56179) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Validate channel names before creating a channel. `catalyst create` and `catalyst channel create` now reject names containing unsupported characters (such as an apostrophe in "Bob's Store") with a clear message that names the offending input and lists the allowed characters — letters, numbers, spaces, hyphens, and underscores — instead of surfacing an opaque API error. The interactive prompt validates as you type, and an invalid `--name` flag fails fast.
+
+- [#3099](https://github.com/bigcommerce/catalyst/pull/3099) [`b4e5952`](https://github.com/bigcommerce/catalyst/commit/b4e595210b2a38e24aac98c656581dfbd67a1c8f) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Unify the device-code login UX across `auth login`, `create`, and the channel commands. The CLI now waits for you to press Enter before opening the browser and best-effort copies the one-time code to your clipboard so you can paste it directly (the code is still printed as a fallback). Non-interactive/CI runs skip the prompt and open directly.
+
+- [#3097](https://github.com/bigcommerce/catalyst/pull/3097) [`e3e5ab2`](https://github.com/bigcommerce/catalyst/commit/e3e5ab2e3cae414e6067017b1a8939f472fa1456) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Fail `catalyst build`/`catalyst deploy` fast with a clear, actionable error when required environment variables (`BIGCOMMERCE_STORE_HASH`, `BIGCOMMERCE_STOREFRONT_TOKEN`, `BIGCOMMERCE_CHANNEL_ID`, `AUTH_SECRET`) aren't loaded, instead of surfacing a raw OpenNext/Next.js build stack trace. The check also runs on the plain `next build` fallthrough (non-Commerce-Hosting projects), not just the Commerce Hosting pipeline. The message names the missing variables and explains that the build auto-loads `.env.local` and `.env` from the current directory (or pass `--env-path <path>` to load a file from elsewhere).
+
+- [#3107](https://github.com/bigcommerce/catalyst/pull/3107) [`0d42b12`](https://github.com/bigcommerce/catalyst/commit/0d42b12a59157eceba1397411de504767d7a309d) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Fix the dependency install step hanging indefinitely during `catalyst project link` and the `catalyst deploy` first-run setup. nypm runs the install through tinyexec, which in silent mode drains the child's stdout to completion before it reads stderr; pnpm floods stderr with Node warnings (on Node 26, thousands of `File descriptor N opened in unmanaged mode` lines), filling the stderr pipe buffer while tinyexec is still on stdout, so pnpm blocks writing and the install deadlocks. The install now runs the child with `NODE_NO_WARNINGS` (and pins `COREPACK_ENABLE_DOWNLOAD_PROMPT` off) so stderr never fills. The `link`/`deploy` setup paths also now detect the project's actual package manager from its lockfile instead of always forcing pnpm.
+
+- [#3096](https://github.com/bigcommerce/catalyst/pull/3096) [`c1d0f3d`](https://github.com/bigcommerce/catalyst/commit/c1d0f3df789f304f8ce1aa07225cdcc5a110dfa3) Thanks [@jorgemoya](https://github.com/jorgemoya)! - `project create` now shows the actionable "Infrastructure Projects API not enabled — contact support to join the beta" guidance when the API responds `404`, matching the existing `403` handling, instead of a cryptic `Failed to create project: Not Found`.
+
+- [#3094](https://github.com/bigcommerce/catalyst/pull/3094) [`bf58b13`](https://github.com/bigcommerce/catalyst/commit/bf58b134cd870e04ec585eec465e93ce9481d13b) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Give the CLI readable, actionable errors when a BigCommerce API returns a 4xx or 5xx. A shared HTTP-error helper now turns a failed response into a clear message: it prefers the API's own reason (`detail`/`title`/field errors) and, when the body is empty or unparseable, falls back to curated copy for the status class. Client (4xx) errors are treated as user-actionable and print without the "share this Correlation ID with BigCommerce support" framing, while server (5xx) errors keep it. This replaces the raw `... failed: <status> <statusText>` throws across the `channel`, `project`, `deploy`, `logs`, and `auth` API paths.
+
+- [#3088](https://github.com/bigcommerce/catalyst/pull/3088) [`ce03afb`](https://github.com/bigcommerce/catalyst/commit/ce03afb8e7ef27e4821e99f8fd4e4d94a7654922) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Stop framing clear, user-actionable CLI errors as bugs to report. Validation errors, not-found and not-enabled responses, conflicts, and bad command input now print just the message and exit, instead of appending a Correlation ID and a "share this with BigCommerce support" prompt. That framing is now reserved for genuine server-side (5xx) failures and unexpected errors. Applies across the `domains`, `project`, `channel`, `logs`, and `auth` commands via a shared `UserActionableError` type.
+
+- [#3100](https://github.com/bigcommerce/catalyst/pull/3100) [`07cd41c`](https://github.com/bigcommerce/catalyst/commit/07cd41cd5867fd3fc520a7a3fda752f059bf0c5a) Thanks [@jorgemoya](https://github.com/jorgemoya)! - The CLI now follows `.env.example` as the source of truth when writing `.env.local`. Generated env files preserve the documented ordering and per-key comment blocks, render documented-but-unsupplied keys as blank/default active keys, and append any CLI-only variables in a clearly separated trailing section. Existing `.env.local` values are reconciled rather than clobbered on re-runs (e.g. `channel link`), so user-set values are preserved while newly documented keys are added in their canonical position.
+
+## 1.0.0
+
+### Major Changes
+
+- [#3077](https://github.com/bigcommerce/catalyst/pull/3077) [`a45ab43`](https://github.com/bigcommerce/catalyst/commit/a45ab4346c27e8cc60d6ce64fb597f22dbde2243) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Introducing the Catalyst CLI (`@bigcommerce/catalyst`) — a single command-line tool for scaffolding, building, and deploying your Catalyst storefront to BigCommerce's Native Hosting infrastructure.
+
+  ### Highlights
+  - **Scaffold a storefront** — `catalyst create` downloads a clean, standalone project (flattened from `core/`, `workspace:` dependencies resolved to published versions, fresh git repo) via tarball extraction and connects it to your BigCommerce store. The package manager is auto-detected from `npm_config_user_agent`.
+  - **Browser-based authentication** — Run `catalyst auth login` to authenticate via an OAuth device code flow. Credentials are stored locally in `.bigcommerce/project.json` for use by all subsequent commands. CI/CD environments can use `--store-hash` and `--access-token` flags or environment variables instead.
+  - **Project & channel management** — Create, link, and list BigCommerce infrastructure projects with `catalyst project`, and connect storefront channels with `catalyst channel`.
+  - **Build & deploy** — `catalyst build` runs the OpenNext Cloudflare build pipeline (deriving the Wrangler `compatibility_date` dynamically) and generates deployment artifacts. `catalyst deploy` bundles, uploads, and deploys your storefront with real-time progress streaming. Pass runtime secrets with `--secret KEY=VALUE`; environment variables are auto-detected as deploy secrets.
+  - **Persisted deployment env vars** — Manage deployment environment variables across deploys with `catalyst env` (list and remove; values are masked).
+  - **Custom domains** — Add, list, check the status of, and remove custom domains for a Native Hosting project with `catalyst domains`.
+  - **Local preview** — `catalyst start` launches a local Cloudflare Workers preview of your built storefront via the OpenNext adapter.
+  - **Live & historical logs** — `catalyst logs tail` streams real-time application logs with color-coded levels and auto-reconnect; `catalyst logs query` retrieves historical logs.
+  - **In-place upgrades** — `catalyst upgrade` upgrades a project to a newer version via a resilient 3-way merge (`git merge-tree`, falling back to per-file `git merge-file`), producing resolvable conflict markers instead of ever aborting.
+  - **Smart credential resolution** — Configuration is resolved in priority order: CLI flags → `--env-file` → process environment variables → `.bigcommerce/project.json`.
+  - **Telemetry** — Anonymous usage telemetry with session and correlation IDs for support. Opt out anytime with `catalyst telemetry disable`.
+
+  ### Commands
+
+  | Command              | Description                                                          |
+  | -------------------- | -------------------------------------------------------------------- |
+  | `catalyst create`    | Scaffold and connect a Catalyst storefront to your BigCommerce store |
+  | `catalyst auth`      | Authenticate, sign out, and verify stored credentials                |
+  | `catalyst project`   | Create, link, and list infrastructure projects                       |
+  | `catalyst channel`   | Connect a storefront channel to your project                         |
+  | `catalyst build`     | Build your Catalyst project for deployment                           |
+  | `catalyst deploy`    | Build and deploy to BigCommerce Native Hosting                       |
+  | `catalyst env`       | Manage persisted deployment environment variables                    |
+  | `catalyst domains`   | Manage custom domains for a Native Hosting project                   |
+  | `catalyst start`     | Start a local Cloudflare Workers preview                             |
+  | `catalyst logs`      | Stream live logs and query historical logs                           |
+  | `catalyst upgrade`   | Upgrade a project to a newer version via 3-way merge                 |
+  | `catalyst version`   | Display CLI, Node.js, and platform info                              |
+  | `catalyst telemetry` | View or change telemetry collection status                           |
+
+  ### Getting started
+
+  ```bash
+  cd core
+  pnpm add @bigcommerce/catalyst@latest @opennextjs/cloudflare@1.17.3
+  pnpm catalyst auth login
+  pnpm catalyst project create
+  pnpm catalyst deploy --secret BIGCOMMERCE_STORE_HASH=<hash> --secret BIGCOMMERCE_STOREFRONT_TOKEN=<token>
+  ```
+
+  For full documentation, see the [Native Hosting Overview](https://developer.bigcommerce.com/docs/storefront/catalyst/deployment/native-hosting/overview) and [CLI Reference](https://developer.bigcommerce.com/docs/storefront/catalyst/reference/cli).
+
+## 1.0.0-alpha.6
+
+### Patch Changes
+
+- [#3061](https://github.com/bigcommerce/catalyst/pull/3061) [`eea1355`](https://github.com/bigcommerce/catalyst/commit/eea135543423dc0d50d6bff68d93f1548e54e096) Thanks [@jorgemoya](https://github.com/jorgemoya)! - `catalyst build` now derives the Cloudflare Workers `compatibility_date` dynamically (current date minus one month) instead of using a pinned date, keeping the build-time runtime semantics aligned with what the deployment service applies at deploy time.
+
+## 1.0.0-alpha.5
+
+### Minor Changes
+
+- [#2988](https://github.com/bigcommerce/catalyst/pull/2988) [`24f35a4`](https://github.com/bigcommerce/catalyst/commit/24f35a4cc60d73036c264a896e816b98aa47bfba) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Show every deployed URL for each project in `catalyst project list` output (the canonical hostname plus any vanity hostnames) so users can recover the hosted storefront URLs without having to redeploy.
+
+### Patch Changes
+
+- [#3028](https://github.com/bigcommerce/catalyst/pull/3028) [`bdc6e0b`](https://github.com/bigcommerce/catalyst/commit/bdc6e0bf055262e1440bcc1ebcc55597256b424a) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Remove `core/instrumentation.ts` and the `@vercel/otel` dependency during Commerce Hosting setup. The hook isn't compatible with the OpenNext + Cloudflare Workers bundling path and caused a "Failed to prepare server" error on every cold start in `catalyst logs tail`. Self-hosted (non-Commerce Hosting) deployments are unaffected.
+
+## 1.0.0-alpha.4
+
+### Patch Changes
+
+- [`de04f42`](https://github.com/bigcommerce/catalyst/commit/de04f42696b30b675bec2625eefa1e825b4a97ba) Thanks [@chanceaclark](https://github.com/chanceaclark)! - Add built-in help text to all CLI commands so `catalyst <command> --help` is the canonical reference.
+
+- [`e740158`](https://github.com/bigcommerce/catalyst/commit/e7401583603aae85d4adef23b4b72eeb96e11907) Thanks [@chanceaclark](https://github.com/chanceaclark)! - Show the global `--env-path` option in every subcommand's `--help` output.
+
+- [`e5b4dee`](https://github.com/bigcommerce/catalyst/commit/e5b4dee1fc108d648b6110707b572c1fc9bc2e7c) Thanks [@chanceaclark](https://github.com/chanceaclark)! - Update the CLI with the new client id.
+
+## 1.0.0-alpha.3
+
+### Minor Changes
+
+- [#2972](https://github.com/bigcommerce/catalyst/pull/2972) [`e681933`](https://github.com/bigcommerce/catalyst/commit/e681933ebbe798198e4c1b8f6f20f67dc4ec36ad) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Auto-detect environment variables as deploy secrets.
+
+## 1.0.0-alpha.2
+
+### Patch Changes
+
+- Fix CLI environment variable resolution for `deploy`, `build`, and `project` commands. The published dist was using stale `BIGCOMMERCE_*` env var names instead of the correct `CATALYST_*` names (`CATALYST_STORE_HASH`, `CATALYST_ACCESS_TOKEN`, `CATALYST_PROJECT_UUID`).
+
+## 1.0.0-alpha.1
+
+### Major Changes
+
+- Introducing the Catalyst CLI (`@bigcommerce/catalyst`) — a command-line tool for building and deploying your Catalyst storefront to BigCommerce's Native Hosting infrastructure.
+
+  ### Highlights
+  - **Browser-based authentication** — Run `catalyst auth login` to authenticate via an OAuth device code flow. Credentials are stored locally in `.bigcommerce/project.json` for use by all subsequent commands. CI/CD environments can use `--store-hash` and `--access-token` flags or environment variables instead.
+  - **Project management** — Create, link, and list BigCommerce infrastructure projects with `catalyst project create`, `catalyst project link`, and `catalyst project list`.
+  - **Build & deploy** — `catalyst build` runs the OpenNext Cloudflare build pipeline and generates deployment artifacts. `catalyst deploy` bundles, uploads, and deploys your storefront with real-time progress streaming. Pass runtime secrets with `--secret KEY=VALUE`.
+  - **Local preview** — `catalyst start` launches a local Cloudflare Workers preview of your built storefront via the OpenNext adapter.
+  - **Live log tailing** — `catalyst logs tail` streams real-time application logs from your deployed storefront with color-coded log levels and multiple output formats.
+  - **Smart credential resolution** — Configuration is resolved in priority order: CLI flags → `--env-file` → process environment variables → `.bigcommerce/project.json`.
+  - **Telemetry** — Anonymous usage telemetry with session and correlation IDs for support. Opt out anytime with `catalyst telemetry disable`.
+
+  ### Commands
+
+  | Command                   | Description                                       |
+  | ------------------------- | ------------------------------------------------- |
+  | `catalyst auth login`     | Authenticate via browser OAuth flow               |
+  | `catalyst auth logout`    | Remove stored credentials                         |
+  | `catalyst auth whoami`    | Verify credentials and display store/project info |
+  | `catalyst project create` | Create a new infrastructure project               |
+  | `catalyst project link`   | Link to an existing infrastructure project        |
+  | `catalyst project list`   | List infrastructure projects for your store       |
+  | `catalyst build`          | Build your Catalyst project for deployment        |
+  | `catalyst deploy`         | Build and deploy to BigCommerce Native Hosting    |
+  | `catalyst start`          | Start a local Cloudflare Workers preview          |
+  | `catalyst logs tail`      | Stream live logs from your deployment             |
+  | `catalyst version`        | Display CLI, Node.js, and platform info           |
+  | `catalyst telemetry`      | View or change telemetry collection status        |
+
+  ### Getting started
+
+  ```bash
+  cd core
+  pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.17.3
+  pnpm catalyst auth login
+  pnpm catalyst project create
+  pnpm catalyst deploy --secret BIGCOMMERCE_STORE_HASH=<hash> --secret BIGCOMMERCE_STOREFRONT_TOKEN=<token>
+  ```
+
+  For full documentation, see the [Native Hosting Overview](https://developer.bigcommerce.com/docs/storefront/catalyst/deployment/native-hosting/overview) and [CLI Reference](https://developer.bigcommerce.com/docs/storefront/catalyst/reference/cli).
+
+## 1.0.0-alpha.0
+
+### Major Changes
+
+- [`acee114`](https://github.com/bigcommerce/catalyst/commit/acee114ca0ee7428e33b1db28a5b3b18914cde4b) Thanks [@chanceaclark](https://github.com/chanceaclark)! - Alpha version of the CLI
diff --git a/packages/catalyst/README.md b/packages/catalyst/README.md
index ed8f949d92..5ecfc6f561 100644
--- a/packages/catalyst/README.md
+++ b/packages/catalyst/README.md
@@ -1,3 +1,36 @@
 # @bigcommerce/catalyst
 
-CLI
+CLI tool for Catalyst development and deployment.
+
+## Developing the CLI
+
+You'll need two terminal windows:
+
+### Terminal 1 — Watch mode (rebuilds on changes)
+
+```bash
+cd packages/catalyst
+pnpm dev
+```
+
+This runs `tsup --watch` and rebuilds `dist/cli.js` on every source change.
+
+### Terminal 2 — Run the CLI
+
+From the `core/` directory, run the CLI using the absolute path to the built executable:
+
+```bash
+cd core
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js <command>
+```
+
+For example:
+
+```bash
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js project list
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js logs tail
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js logs query --start 2026-06-01T00:00:00Z --end 2026-06-02T00:00:00Z
+pnpm exec <repo-root>/packages/catalyst/dist/cli.js deploy
+```
+
+Replace `<repo-root>` with the absolute path to your local clone of the `catalyst` repository.
diff --git a/packages/catalyst/package.json b/packages/catalyst/package.json
index 9697588b0e..3d6544f824 100644
--- a/packages/catalyst/package.json
+++ b/packages/catalyst/package.json
@@ -1,7 +1,12 @@
 {
   "name": "@bigcommerce/catalyst",
-  "version": "0.1.0",
+  "version": "1.1.0",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bigcommerce/catalyst",
+    "directory": "packages/catalyst"
+  },
   "bin": {
     "catalyst": "dist/cli.js"
   },
@@ -9,7 +14,6 @@
     "dist",
     "templates"
   ],
-  "private": true,
   "scripts": {
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
@@ -23,22 +27,35 @@
     "node": "^20.0.0 || ^22.0.0 || ^24.0.0"
   },
   "dependencies": {
+    "@commander-js/extra-typings": "^14.0.0",
+    "@inquirer/prompts": "^7.5.3",
     "@segment/analytics-node": "^2.2.1",
     "adm-zip": "^0.5.16",
     "commander": "^14.0.0",
     "conf": "^13.1.0",
     "consola": "^3.4.2",
+    "cross-spawn": "^7.0.6",
     "dotenv": "^16.5.0",
     "execa": "^9.6.0",
+    "fs-extra": "^11.3.0",
+    "lodash.kebabcase": "^4.1.1",
+    "nypm": "^0.5.4",
+    "open": "^10.1.0",
+    "semver": "^7.7.4",
+    "std-env": "^3.9.0",
+    "tar": "^7.5.7",
     "yocto-spinner": "^1.0.0",
     "zod": "^4.0.5"
   },
   "devDependencies": {
     "@bigcommerce/eslint-config": "^2.11.0",
     "@bigcommerce/eslint-config-catalyst": "workspace:^",
-    "@commander-js/extra-typings": "^14.0.0",
     "@types/adm-zip": "^0.5.7",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/fs-extra": "^11.0.4",
+    "@types/lodash.kebabcase": "^4.1.9",
     "@types/node": "^22.15.30",
+    "@types/semver": "^7.7.0",
     "@vitest/coverage-v8": "^3.2.4",
     "@vitest/ui": "^3.2.4",
     "eslint": "^8.57.1",
@@ -49,6 +66,6 @@
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "@opennextjs/cloudflare": "^1.8.0"
+    "@opennextjs/cloudflare": "1.17.3"
   }
 }
diff --git a/packages/catalyst/src/cli/commands/auth.spec.ts b/packages/catalyst/src/cli/commands/auth.spec.ts
new file mode 100644
index 0000000000..314dfc4f27
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/auth.spec.ts
@@ -0,0 +1,313 @@
+import { confirm, input, password } from '@inquirer/prompts';
+import { Command } from 'commander';
+import { http, HttpResponse } from 'msw';
+import { realpath } from 'node:fs/promises';
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  MockInstance,
+  test,
+  vi,
+} from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+import { textHistory } from '../../../tests/mocks/spinner';
+import { consola } from '../lib/logger';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig } from '../lib/project-config';
+import { program } from '../program';
+
+import { auth } from './auth';
+
+// eslint-disable-next-line import/dynamic-import-chunkname
+vi.mock('yocto-spinner', () => import('../../../tests/mocks/spinner'));
+vi.mock('open', () => ({ default: vi.fn().mockResolvedValue(undefined) }));
+vi.mock('@inquirer/prompts', () => ({
+  confirm: vi.fn(),
+  input: vi.fn(),
+  password: vi.fn(),
+}));
+
+const confirmMock = vi.mocked(confirm);
+const inputMock = vi.mocked(input);
+const passwordMock = vi.mocked(password);
+
+let exitMock: MockInstance;
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+  tmpDir = await realpath(tmpDir);
+});
+
+beforeEach(() => {
+  process.chdir(tmpDir);
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  textHistory.length = 0;
+
+  // Clean up config between tests
+  try {
+    const config = getProjectConfig();
+
+    config.delete('storeHash');
+    config.delete('accessToken');
+  } catch {
+    // ignore if config doesn't exist
+  }
+});
+
+afterAll(async () => {
+  await cleanup();
+});
+
+test('auth is a properly configured Command instance', () => {
+  expect(auth).toBeInstanceOf(Command);
+  expect(auth.name()).toBe('auth');
+  expect(auth.description()).toBe('Manage authentication for the BigCommerce CLI.');
+
+  const subcommands = auth.commands.map((cmd) => cmd.name());
+
+  expect(subcommands).toContain('whoami');
+  expect(subcommands).toContain('login');
+  expect(subcommands).toContain('logout');
+});
+
+describe('whoami', () => {
+  test('displays store info when credentials are valid', async () => {
+    const config = getProjectConfig();
+
+    config.set('storeHash', 'test-store');
+    config.set('accessToken', 'test-token');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'whoami']);
+
+    expect(consola.info).toHaveBeenCalledWith('Logged in to Test Store (test-store)');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('reports no credentials found', async () => {
+    await program.parseAsync(['node', 'catalyst', 'auth', 'whoami']);
+
+    expect(consola.info).toHaveBeenCalledWith('Not logged in: no credentials found.');
+    expect(consola.info).toHaveBeenCalledWith(
+      'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('reports an invalid or expired token on 401', async () => {
+    const config = getProjectConfig();
+
+    config.set('storeHash', 'test-store');
+    config.set('accessToken', 'bad-token');
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/settings/store/profile',
+        () => new HttpResponse(null, { status: 401, statusText: 'Unauthorized' }),
+      ),
+    );
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'whoami']);
+
+    expect(consola.error).toHaveBeenCalledWith(
+      'Not logged in: your access token is invalid or has expired. Run `catalyst auth login`.',
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
+
+describe('login', () => {
+  test('completes OAuth device flow and stores credentials', async () => {
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('MOCK-CODE'));
+    expect(consola.success).toHaveBeenCalledWith('Logged in to store mock-store-hash.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+
+    // Verify credentials were stored
+    const config = getProjectConfig();
+
+    expect(config.get('storeHash')).toBe('mock-store-hash');
+    expect(config.get('accessToken')).toBe('mock-access-token');
+  });
+
+  test('exits early when already logged in', async () => {
+    const config = getProjectConfig();
+
+    config.set('storeHash', 'existing-store');
+    config.set('accessToken', 'existing-token');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.info).toHaveBeenCalledWith('Already logged in to store existing-store.');
+    expect(consola.info).toHaveBeenCalledWith(
+      'Run `catalyst auth logout` first to re-authenticate.',
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts to fall back to manual login when device code request fails', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    confirmMock.mockResolvedValueOnce(true);
+    inputMock.mockResolvedValueOnce('manual-store-hash');
+    passwordMock.mockResolvedValueOnce('manual-access-token');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(confirmMock).toHaveBeenCalledOnce();
+    expect(confirmMock.mock.calls[0]?.[0].message).toContain('Try logging in manually');
+    expect(inputMock).toHaveBeenCalledWith(expect.objectContaining({ message: 'Store hash:' }));
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining("Browser login didn't work"));
+    expect(consola.success).toHaveBeenCalledWith('Logged in to store manual-store-hash.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+
+    const config = getProjectConfig();
+
+    expect(config.get('storeHash')).toBe('manual-store-hash');
+    expect(config.get('accessToken')).toBe('manual-access-token');
+  });
+
+  test('exits cleanly when user declines manual login fallback', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    confirmMock.mockResolvedValueOnce(false);
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining("Browser login didn't work"));
+    expect(consola.info).toHaveBeenCalledWith(
+      'Login aborted. Re-run `catalyst auth login` when you have your credentials ready.',
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('fails when manual credentials cannot be validated', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/settings/store/profile',
+        () => new HttpResponse(null, { status: 401, statusText: 'Unauthorized' }),
+      ),
+    );
+
+    confirmMock.mockResolvedValueOnce(true);
+    inputMock.mockResolvedValueOnce('manual-store-hash');
+    passwordMock.mockResolvedValueOnce('bad-token');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.error).toHaveBeenCalledWith(
+      expect.stringContaining('Could not validate credentials'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('rejects empty store hash during manual login', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    confirmMock.mockResolvedValueOnce(true);
+    inputMock.mockResolvedValueOnce('   ');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.error).toHaveBeenCalledWith(expect.stringContaining('Store hash is required'));
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('rejects empty access token during manual login', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    confirmMock.mockResolvedValueOnce(true);
+    inputMock.mockResolvedValueOnce('manual-store-hash');
+    passwordMock.mockResolvedValueOnce('   ');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.error).toHaveBeenCalledWith(expect.stringContaining('Access token is required'));
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('handles browser open failure gracefully', async () => {
+    // eslint-disable-next-line import/dynamic-import-chunkname
+    const openMock = await import('open');
+
+    vi.mocked(openMock.default).mockRejectedValueOnce(new Error('No browser'));
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(consola.info).toHaveBeenCalledWith(
+      expect.stringContaining('Open https://login.bigcommerce.com/device in your browser'),
+    );
+    expect(consola.success).toHaveBeenCalledWith('Logged in to store mock-store-hash.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('shows spinner during authentication polling', async () => {
+    await program.parseAsync(['node', 'catalyst', 'auth', 'login']);
+
+    expect(textHistory).toContain('Waiting for authentication...');
+    expect(textHistory).toContain('Authentication complete.');
+  });
+});
+
+describe('logout', () => {
+  test('clears stored credentials', async () => {
+    const config = getProjectConfig();
+
+    config.set('storeHash', 'test-store');
+    config.set('accessToken', 'test-token');
+
+    await program.parseAsync(['node', 'catalyst', 'auth', 'logout']);
+
+    expect(consola.success).toHaveBeenCalledWith('Logged out from store test-store.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+
+    expect(config.get('storeHash')).toBeUndefined();
+    expect(config.get('accessToken')).toBeUndefined();
+  });
+
+  test('reports not logged in when no credentials exist', async () => {
+    await program.parseAsync(['node', 'catalyst', 'auth', 'logout']);
+
+    expect(consola.info).toHaveBeenCalledWith('Not logged in: no credentials found.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/auth.ts b/packages/catalyst/src/cli/commands/auth.ts
new file mode 100644
index 0000000000..4d259b4b76
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/auth.ts
@@ -0,0 +1,219 @@
+import { Command } from 'commander';
+import { z } from 'zod';
+
+import { assertAuthorized, UnauthorizedError } from '../lib/auth-errors';
+import { consola } from '../lib/logger';
+import { LoginAbortedError, login as runInteractiveLogin } from '../lib/login';
+import { fetchProjects } from '../lib/project';
+import { getProjectConfig } from '../lib/project-config';
+import {
+  accessTokenOption,
+  apiHostOption,
+  loginUrlOption,
+  resolveApiHost,
+  storeHashOption,
+} from '../lib/shared-options';
+
+const StoreProfileSchema = z.object({
+  data: z.object({
+    store_name: z.string(),
+  }),
+});
+
+async function fetchStoreProfile(storeHash: string, accessToken: string, apiHost: string) {
+  const response = await fetch(`https://${apiHost}/stores/${storeHash}/v3/settings/store/profile`, {
+    method: 'GET',
+    headers: {
+      'X-Auth-Token': accessToken,
+      Accept: 'application/json',
+    },
+  });
+
+  assertAuthorized(response);
+
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}`);
+  }
+
+  const res: unknown = await response.json();
+  const result = StoreProfileSchema.safeParse(res);
+
+  if (!result.success) {
+    throw new Error('Unexpected response from store profile API');
+  }
+
+  return result.data.data;
+}
+
+const whoami = new Command('whoami')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Verify stored credentials and display store/project info.')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst auth whoami
+
+  Logged in to My Store (abc123), connected to project my-project (43eba682-0c48-11f1-9bd5-827a48b0ce1e)`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .action(async (options) => {
+    try {
+      const config = getProjectConfig();
+      const apiHost = resolveApiHost(options, config);
+
+      const storeHash = options.storeHash ?? config.get('storeHash');
+      const accessToken = options.accessToken ?? config.get('accessToken');
+
+      if (!storeHash || !accessToken) {
+        consola.info('Not logged in: no credentials found.');
+        consola.info(
+          'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
+        );
+        process.exit(1);
+
+        return;
+      }
+
+      const store = await fetchStoreProfile(storeHash, accessToken, apiHost);
+
+      const projectUuid = config.get('projectUuid');
+
+      if (projectUuid) {
+        const projects = await fetchProjects(storeHash, accessToken, apiHost);
+        const linkedProject = projects.find((p) => p.uuid === projectUuid);
+
+        if (linkedProject) {
+          consola.info(
+            `Logged in to ${store.store_name} (${storeHash}), connected to project ${linkedProject.name} (${projectUuid})`,
+          );
+        } else {
+          consola.info(
+            `Logged in to ${store.store_name} (${storeHash}), project ${projectUuid} not found`,
+          );
+        }
+      } else {
+        consola.info(`Logged in to ${store.store_name} (${storeHash})`);
+      }
+
+      process.exit(0);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+
+      if (error instanceof UnauthorizedError) {
+        consola.error(
+          'Not logged in: your access token is invalid or has expired. Run `catalyst auth login`.',
+        );
+      } else if (message.includes('401') || message.includes('403')) {
+        consola.error(`Not logged in: invalid credentials (${message})`);
+      } else {
+        consola.error(`Failed to verify credentials: ${message}`);
+      }
+
+      process.exit(1);
+    }
+  });
+
+const login = new Command('login')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. If already logged in, displays current credentials and suggests running `catalyst auth logout` to re-authenticate.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Login interactively (browser, with manual fallback)
+  $ catalyst auth login
+
+  # Login with existing credentials (skips interactive flow)
+  $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(loginUrlOption())
+  .action(async (options) => {
+    try {
+      const config = getProjectConfig();
+      const apiHost = resolveApiHost(options, config);
+
+      const storeHash = options.storeHash ?? config.get('storeHash');
+      const accessToken = options.accessToken ?? config.get('accessToken');
+
+      if (storeHash && accessToken) {
+        consola.info(`Already logged in to store ${storeHash}.`);
+        consola.info('Run `catalyst auth logout` first to re-authenticate.');
+        process.exit(0);
+
+        return;
+      }
+
+      const credentials = await runInteractiveLogin(options.loginUrl, apiHost);
+
+      config.set('storeHash', credentials.storeHash);
+      config.set('accessToken', credentials.accessToken);
+
+      consola.success(`Logged in to store ${credentials.storeHash}.`);
+      process.exit(0);
+    } catch (error) {
+      if (error instanceof LoginAbortedError) {
+        consola.info(
+          'Login aborted. Re-run `catalyst auth login` when you have your credentials ready.',
+        );
+        process.exit(0);
+
+        return;
+      }
+
+      const message = error instanceof Error ? error.message : String(error);
+
+      consola.error(`Login failed: ${message}`);
+      process.exit(1);
+    }
+  });
+
+const logout = new Command('logout')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Remove stored credentials for the current project.')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst auth logout`,
+  )
+  .action(() => {
+    try {
+      const config = getProjectConfig();
+
+      const storeHash = config.get('storeHash');
+      const accessToken = config.get('accessToken');
+
+      if (!storeHash && !accessToken) {
+        consola.info('Not logged in: no credentials found.');
+        process.exit(0);
+
+        return;
+      }
+
+      config.delete('storeHash');
+      config.delete('accessToken');
+
+      consola.success(`Logged out from store ${storeHash ?? 'unknown'}.`);
+      process.exit(0);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+
+      consola.error(`Logout failed: ${message}`);
+      process.exit(1);
+    }
+  });
+
+export const auth = new Command('auth')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Manage authentication for the BigCommerce CLI.')
+  .addCommand(whoami)
+  .addCommand(login)
+  .addCommand(logout);
diff --git a/packages/catalyst/src/cli/commands/build.spec.ts b/packages/catalyst/src/cli/commands/build.spec.ts
index 06f5525693..0e6cb0597c 100644
--- a/packages/catalyst/src/cli/commands/build.spec.ts
+++ b/packages/catalyst/src/cli/commands/build.spec.ts
@@ -1,44 +1,148 @@
 import { Command } from 'commander';
 import { execa } from 'execa';
-import { join } from 'node:path';
-import { expect, test, vi } from 'vitest';
+import { afterEach, beforeAll, beforeEach, expect, test, vi } from 'vitest';
 
+import { consola } from '../lib/logger';
+import { getProjectState } from '../lib/project-state';
 import { program } from '../program';
 
 import { build } from './build';
 
-// eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+vi.mock('execa', () => ({
+  execa: vi.fn(() => Promise.resolve({})),
+  __esModule: true,
+}));
 
-vi.mock('node:fs', () => ({
-  existsSync: vi.fn(() => true),
+vi.mock('../lib/project-state', () => ({
+  getProjectState: vi.fn(),
 }));
 
-vi.mock('execa', () => ({
-  execa: vi.fn(() => Promise.resolve({ stdout: '' })),
-  __esModule: true,
+// The transformed build path shells out and touches the filesystem; stub the
+// side effects so the tests can focus on how options are threaded through.
+vi.mock('node:fs/promises', () => ({
+  copyFile: vi.fn(() => Promise.resolve()),
+  cp: vi.fn(() => Promise.resolve()),
+  rm: vi.fn(() => Promise.resolve()),
+  writeFile: vi.fn(() => Promise.resolve()),
+}));
+
+vi.mock('../lib/build-env', () => ({
+  loadBuildEnv: vi.fn(),
+}));
+
+vi.mock('../lib/wrangler-config', () => ({
+  getWranglerConfig: vi.fn(() => ({})),
+}));
+
+vi.mock('../lib/get-module-cli-path', () => ({
+  getModuleCliPath: vi.fn(() => '/module/cli'),
+}));
+
+vi.mock('../lib/project-config', () => ({
+  getProjectConfig: vi.fn(() => ({ get: vi.fn(() => 'mock-uuid') })),
 }));
 
+// The required-env check has its own unit tests; here we only care about
+// command routing, so keep it a no-op regardless of the ambient environment.
+vi.mock('../lib/required-build-env', () => ({
+  assertRequiredBuildEnv: vi.fn(),
+}));
+
+const untransformedState = {
+  projectUuid: undefined,
+  hasMiddleware: false,
+  hasProxy: true,
+  hasOpenNextDep: false,
+  isLinked: false,
+  isTransformed: false,
+  isFullySetUp: false,
+};
+
+const transformedState = {
+  projectUuid: 'mock-uuid',
+  hasMiddleware: true,
+  hasProxy: false,
+  hasOpenNextDep: true,
+  isLinked: true,
+  isTransformed: true,
+  isFullySetUp: true,
+};
+
+const DEFAULT_WRANGLER_VERSION = '4.90.0';
+
+// eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+beforeAll(() => {
+  consola.wrapAll();
+});
+
+beforeEach(() => {
+  consola.mockTypes(() => vi.fn());
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
 test('properly configured Command instance', () => {
   expect(build).toBeInstanceOf(Command);
   expect(build.name()).toBe('build');
   expect(build.options).toEqual(
     expect.arrayContaining([
-      expect.objectContaining({ long: '--framework' }),
       expect.objectContaining({ long: '--project-uuid' }),
+      expect.objectContaining({ long: '--wrangler-version' }),
     ]),
   );
 });
 
-test('calls execa with Next.js build if framework is nextjs', async () => {
-  await program.parseAsync(['node', 'catalyst', 'build', '--framework', 'nextjs', '--debug']);
+test('falls through to `next build` when project is not transformed', async () => {
+  vi.mocked(getProjectState).mockReturnValue(untransformedState);
+
+  await program.parseAsync(['node', 'catalyst', 'build']);
+
+  expect(execa).toHaveBeenCalledWith(
+    'pnpm',
+    ['exec', 'next', 'build'],
+    expect.objectContaining({ stdio: 'inherit', cwd: process.cwd() }),
+  );
+});
+
+test('uses the pinned default Wrangler version when the flag is absent', async () => {
+  vi.mocked(getProjectState).mockReturnValue(transformedState);
+
+  await program.parseAsync(['node', 'catalyst', 'build']);
 
   expect(execa).toHaveBeenCalledWith(
-    join('node_modules', '.bin', 'next'),
-    ['build', '--debug'],
-    expect.objectContaining({
-      stdio: 'inherit',
-      cwd: process.cwd(),
-    }),
+    'pnpm',
+    expect.arrayContaining(['dlx', `wrangler@${DEFAULT_WRANGLER_VERSION}`]),
+    expect.anything(),
   );
 });
+
+test('threads --wrangler-version into the wrangler invocation', async () => {
+  vi.mocked(getProjectState).mockReturnValue(transformedState);
+
+  await program.parseAsync(['node', 'catalyst', 'build', '--wrangler-version', '4.24.3']);
+
+  expect(execa).toHaveBeenCalledWith(
+    'pnpm',
+    expect.arrayContaining(['dlx', 'wrangler@4.24.3']),
+    expect.anything(),
+  );
+  expect(execa).not.toHaveBeenCalledWith(
+    'pnpm',
+    expect.arrayContaining(['dlx', `wrangler@${DEFAULT_WRANGLER_VERSION}`]),
+    expect.anything(),
+  );
+});
+
+test('rejects an invalid --wrangler-version value', async () => {
+  vi.mocked(getProjectState).mockReturnValue(transformedState);
+
+  await expect(
+    program.parseAsync(['node', 'catalyst', 'build', '--wrangler-version', 'foo; rm -rf /']),
+  ).rejects.toThrow(/not a valid Wrangler version/);
+
+  expect(execa).not.toHaveBeenCalled();
+});
diff --git a/packages/catalyst/src/cli/commands/build.ts b/packages/catalyst/src/cli/commands/build.ts
index 94898ba888..57ee68c604 100644
--- a/packages/catalyst/src/cli/commands/build.ts
+++ b/packages/catalyst/src/cli/commands/build.ts
@@ -1,130 +1,180 @@
-import { Command, Option } from 'commander';
+import { Command, InvalidArgumentError, Option } from 'commander';
 import { execa } from 'execa';
-import { existsSync } from 'node:fs';
-import { copyFile, cp, writeFile } from 'node:fs/promises';
+import { copyFile, cp, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { valid as validSemver } from 'semver';
 
+import { loadBuildEnv } from '../lib/build-env';
 import { getModuleCliPath } from '../lib/get-module-cli-path';
 import { consola } from '../lib/logger';
 import { getProjectConfig } from '../lib/project-config';
+import { getProjectState } from '../lib/project-state';
+import { assertRequiredBuildEnv } from '../lib/required-build-env';
+import { envPathOption } from '../lib/shared-options';
 import { getWranglerConfig } from '../lib/wrangler-config';
 
-const WRANGLER_VERSION = '4.24.3';
+export const WRANGLER_VERSION = '4.90.0';
+
+// npm dist-tags (e.g. latest, beta) aren't valid semver, so they're allowed
+// through a narrow character allowlist. This also guards the value before
+// it's interpolated into the `wrangler@<version>` spec passed to `pnpm dlx`,
+// rejecting anything that could smuggle extra args or shell metacharacters in.
+const DIST_TAG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+
+export const parseWranglerVersion = (value: string): string => {
+  if (!validSemver(value) && !DIST_TAG_PATTERN.test(value)) {
+    throw new InvalidArgumentError(
+      `"${value}" is not a valid Wrangler version or dist-tag (e.g. 4.90.0 or latest).`,
+    );
+  }
+
+  return value;
+};
+
+export async function buildCatalystProject(
+  projectUuid: string,
+  wranglerVersion: string = WRANGLER_VERSION,
+): Promise<void> {
+  // Fail fast with an actionable message if the vars the build reads aren't
+  // loaded — otherwise the missing values surface as a raw stack trace deep in
+  // the OpenNext/Next.js prerender.
+  assertRequiredBuildEnv();
+
+  const coreDir = process.cwd();
+  const openNextOutDir = join(coreDir, '.open-next');
+  const bigcommerceDistDir = join(coreDir, '.bigcommerce', 'dist');
+
+  const wranglerConfig = getWranglerConfig(projectUuid);
+
+  // Wrangler's --outdir writes alongside existing files instead of replacing
+  // the directory. Stale artifacts (e.g. wasm modules named by an older
+  // Wrangler version) end up in the bundle and break the Cloudflare upload.
+  await rm(bigcommerceDistDir, { recursive: true, force: true });
+
+  consola.start('Copying templates...');
+
+  await copyFile(
+    join(getModuleCliPath(), 'templates', 'open-next.config.ts'),
+    join(coreDir, '.bigcommerce', 'open-next.config.ts'),
+  );
+  await writeFile(
+    join(coreDir, '.bigcommerce', 'wrangler.jsonc'),
+    JSON.stringify(wranglerConfig, null, 2),
+  );
+
+  consola.success('Templates copied');
+
+  consola.start('Building project...');
+
+  await execa(
+    'pnpm',
+    [
+      'exec',
+      'opennextjs-cloudflare',
+      'build',
+      '--skipWranglerConfigCheck',
+      '--openNextConfigPath',
+      join(coreDir, '.bigcommerce', 'open-next.config.ts'),
+    ],
+    {
+      stdout: ['pipe', 'inherit'],
+      cwd: coreDir,
+    },
+  );
+
+  await execa(
+    'pnpm',
+    [
+      'dlx',
+      `wrangler@${wranglerVersion}`,
+      'deploy',
+      '--config',
+      join(coreDir, '.bigcommerce', 'wrangler.jsonc'),
+      '--keep-vars',
+      '--outdir',
+      bigcommerceDistDir,
+      '--dry-run',
+    ],
+    {
+      stdout: ['pipe', 'inherit'],
+      cwd: coreDir,
+    },
+  );
+
+  consola.success('Project built');
+
+  await cp(join(openNextOutDir, 'assets'), join(bigcommerceDistDir, 'assets'), {
+    recursive: true,
+    force: true,
+  });
+}
 
 export const build = new Command('build')
-  .allowUnknownOption()
-  // The unknown options end up in program.args, not in program.opts(). Commander does not take a guess at how to interpret the unknown options.
-  .argument(
-    '[next-build-options...]',
-    'Next.js `build` options (see: https://nextjs.org/docs/app/api-reference/cli/next#next-build-options)',
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Build your Catalyst project using the OpenNext/Cloudflare build pipeline. Also runs a Wrangler dry-run to generate deployment artifacts.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst build
+
+  # Include project UUID
+  $ catalyst build --project-uuid <UUID>
+
+  # Build with a specific Wrangler version
+  $ catalyst build --wrangler-version 4.24.3`,
   )
   .addOption(
     new Option(
       '--project-uuid <uuid>',
       'Project UUID to be included in the deployment configuration.',
-    ).env('BIGCOMMERCE_PROJECT_UUID'),
+    ).env('CATALYST_PROJECT_UUID'),
   )
   .addOption(
-    new Option('--framework <framework>', 'The framework to use for the build.').choices([
-      'nextjs',
-      'catalyst',
-    ]),
+    new Option(
+      '--wrangler-version <version>',
+      `Wrangler version or dist-tag to build with. Defaults to ${WRANGLER_VERSION}.`,
+    ).argParser(parseWranglerVersion),
   )
-  .action(async (nextBuildOptions, options) => {
-    const coreDir = process.cwd();
-
-    try {
-      const config = getProjectConfig();
-      const framework = options.framework ?? config.get('framework');
-
-      if (framework === 'nextjs') {
-        const nextBin = join('node_modules', '.bin', 'next');
-
-        if (!existsSync(nextBin)) {
-          throw new Error(
-            `Next.js is not installed in ${coreDir}. Are you in a valid Next.js project?`,
-          );
-        }
-
-        await execa(nextBin, ['build', ...nextBuildOptions], {
-          stdio: 'inherit',
-          cwd: coreDir,
-        });
-      }
-
-      if (framework === 'catalyst') {
-        const openNextOutDir = join(coreDir, '.open-next');
-        const bigcommerceDistDir = join(coreDir, '.bigcommerce', 'dist');
-
-        const projectUuid = options.projectUuid ?? config.get('projectUuid');
-
-        if (!projectUuid) {
-          throw new Error(
-            'Project UUID is required. Please run `catalyst project create` or `catalyst project link` or this command again with --project-uuid <uuid>.',
-          );
-        }
-
-        const wranglerConfig = getWranglerConfig(projectUuid, 'PLACEHOLDER_KV_ID');
-
-        consola.start('Copying templates...');
-
-        await copyFile(
-          join(getModuleCliPath(), 'templates', 'open-next.config.ts'),
-          join(coreDir, '.bigcommerce', 'open-next.config.ts'),
-        );
-        await writeFile(
-          join(coreDir, '.bigcommerce', 'wrangler.jsonc'),
-          JSON.stringify(wranglerConfig, null, 2),
-        );
-
-        consola.success('Templates copied');
-
-        consola.start('Building project...');
-
-        await execa(
-          'pnpm',
-          [
-            'exec',
-            'opennextjs-cloudflare',
-            'build',
-            '--skipWranglerConfigCheck',
-            '--openNextConfigPath',
-            join(coreDir, '.bigcommerce', 'open-next.config.ts'),
-          ],
-          {
-            stdout: ['pipe', 'inherit'],
-            cwd: coreDir,
-          },
-        );
-
-        await execa(
-          'pnpm',
-          [
-            'dlx',
-            `wrangler@${WRANGLER_VERSION}`,
-            'deploy',
-            '--config',
-            join(coreDir, '.bigcommerce', 'wrangler.jsonc'),
-            '--keep-vars',
-            '--outdir',
-            bigcommerceDistDir,
-            '--dry-run',
-          ],
-          {
-            stdout: ['pipe', 'inherit'],
-            cwd: coreDir,
-          },
-        );
-
-        consola.success('Project built');
-
-        await cp(join(openNextOutDir, 'assets'), join(bigcommerceDistDir, 'assets'), {
-          recursive: true,
-          force: true,
-        });
-      }
-    } catch (error) {
-      consola.error(error);
-      process.exit(1);
+  .addOption(envPathOption())
+  .action(async (options) => {
+    // The build reads storefront env vars (BIGCOMMERCE_*). Load them from the
+    // env file(s) before building so both the build and any pre-build checks
+    // see them.
+    loadBuildEnv({ envPath: options.envPath });
+
+    // Project must be transformed (middleware swapped in, OpenNext dep installed)
+    // before the OpenNext build pipeline can run. If it isn't, fall through to
+    // `next build` so this command works for self-hosted Catalyst projects too.
+    const state = getProjectState();
+
+    if (!state.isTransformed) {
+      consola.info('Project is not set up for Commerce Hosting — running `next build`.');
+      consola.info('To deploy to Commerce Hosting, run `catalyst deploy`.');
+
+      // `next build` reads the same storefront env vars; fail fast with an
+      // actionable message here too, since this path doesn't go through
+      // buildCatalystProject where the check normally runs.
+      assertRequiredBuildEnv();
+
+      await execa('pnpm', ['exec', 'next', 'build'], {
+        stdio: 'inherit',
+        cwd: process.cwd(),
+      });
+
+      return;
     }
+
+    const config = getProjectConfig();
+    const projectUuid = options.projectUuid ?? config.get('projectUuid');
+
+    if (!projectUuid) {
+      throw new Error(
+        'Project UUID is required. Please run `catalyst project create` or `catalyst project link` or this command again with --project-uuid <uuid>.',
+      );
+    }
+
+    await buildCatalystProject(projectUuid, options.wranglerVersion);
   });
diff --git a/packages/catalyst/src/cli/commands/channel.spec.ts b/packages/catalyst/src/cli/commands/channel.spec.ts
new file mode 100644
index 0000000000..87abde74f2
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/channel.spec.ts
@@ -0,0 +1,631 @@
+import { checkbox, confirm, input, select } from '@inquirer/prompts';
+import { Command } from 'commander';
+import Conf from 'conf';
+import { http, HttpResponse } from 'msw';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { afterAll, afterEach, beforeAll, describe, expect, MockInstance, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+import { consola } from '../lib/logger';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig, ProjectConfigSchema } from '../lib/project-config';
+import { program } from '../program';
+
+import { channel } from './channel';
+
+vi.mock('@inquirer/prompts', () => ({
+  select: vi.fn(),
+  confirm: vi.fn(),
+  input: vi.fn(),
+  checkbox: vi.fn(),
+}));
+// `channel link` can trigger the interactive device-code login (browser +
+// spinner); stub both so the no-credentials path runs headless in tests.
+vi.mock('open', () => ({ default: vi.fn().mockResolvedValue(undefined) }));
+// eslint-disable-next-line import/dynamic-import-chunkname
+vi.mock('yocto-spinner', () => import('../../../tests/mocks/spinner'));
+
+const mockSelect = vi.mocked(select);
+const mockConfirm = vi.mocked(confirm);
+const mockInput = vi.mocked(input);
+const mockCheckbox = vi.mocked(checkbox);
+
+let exitMock: MockInstance;
+
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let config: Conf<ProjectConfigSchema>;
+
+const { mockIdentify } = vi.hoisted(() => ({
+  mockIdentify: vi.fn(),
+}));
+
+const linkedProjectUuid = 'a23f5785-fd99-4a94-9fb3-945551623923';
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+
+  vi.mock('../lib/telemetry', () => {
+    const instance = {
+      identify: mockIdentify,
+      isEnabled: vi.fn(() => true),
+      track: vi.fn(),
+      correlationId: 'test-session-uuid',
+      commandName: 'unknown',
+      durationMs: vi.fn().mockReturnValue(0),
+      analytics: {
+        closeAndFlush: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
+    return {
+      Telemetry: vi.fn().mockImplementation(() => instance),
+      getTelemetry: vi.fn(() => instance),
+      resetTelemetry: vi.fn(),
+    };
+  });
+
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+
+  config = getProjectConfig();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  config.delete('storeHash');
+  config.delete('accessToken');
+  config.delete('projectUuid');
+});
+
+afterAll(async () => {
+  vi.restoreAllMocks();
+  exitMock.mockRestore();
+
+  await cleanup();
+});
+
+describe('channel', () => {
+  test('has the update subcommand', () => {
+    expect(channel).toBeInstanceOf(Command);
+    expect(channel.name()).toBe('channel');
+
+    const update = channel.commands.find((cmd) => cmd.name() === 'update');
+
+    expect(update).toBeDefined();
+    expect(update?.description()).toContain('Update a BigCommerce channel');
+  });
+
+  test('has the link subcommand', () => {
+    const link = channel.commands.find((cmd) => cmd.name() === 'link');
+
+    expect(link).toBeDefined();
+    expect(link?.description()).toContain('Link this Catalyst project to a BigCommerce channel');
+  });
+
+  test('has the create subcommand', () => {
+    const create = channel.commands.find((cmd) => cmd.name() === 'create');
+
+    expect(create).toBeDefined();
+    expect(create?.description()).toContain('Create a new Catalyst storefront channel');
+  });
+});
+
+describe('channel update', () => {
+  test('happy path: prompts for channel and hostname, then PUTs', async () => {
+    let putBody: unknown;
+    let putChannelId: string | undefined;
+
+    server.use(
+      http.put(
+        'https://:apiHost/stores/:storeHash/v3/channels/:channelId/site',
+        async ({ request, params }) => {
+          putBody = await request.json();
+          putChannelId = String(params.channelId);
+
+          return HttpResponse.json({
+            data: {
+              id: 1,
+              url: 'https://project-one.catalyst-sandbox.store',
+              channel_id: 2,
+            },
+          });
+        },
+      ),
+    );
+
+    mockSelect.mockResolvedValueOnce(2).mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'update',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      linkedProjectUuid,
+    ]);
+
+    expect(mockSelect).toHaveBeenCalledTimes(2);
+    expect(putChannelId).toBe('2');
+    expect(putBody).toEqual({ url: 'https://project-one.catalyst-sandbox.store' });
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Updated channel "Catalyst Storefront" (2) site URL'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('reads project UUID from .bigcommerce/project.json when no flag is passed', async () => {
+    config.set('projectUuid', linkedProjectUuid);
+
+    mockSelect.mockResolvedValueOnce(2).mockResolvedValueOnce('vanity.project-one.example.com');
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'update',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(mockSelect).toHaveBeenCalledTimes(2);
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('https://vanity.project-one.example.com'),
+    );
+  });
+
+  test('--channel-id and --hostname skip both prompts', async () => {
+    let putBody: unknown;
+    let putChannelId: string | undefined;
+
+    server.use(
+      http.put(
+        'https://:apiHost/stores/:storeHash/v3/channels/:channelId/site',
+        async ({ request, params }) => {
+          putBody = await request.json();
+          putChannelId = String(params.channelId);
+
+          return HttpResponse.json({
+            data: { id: 1, url: 'https://override.example', channel_id: 5 },
+          });
+        },
+      ),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'update',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      linkedProjectUuid,
+      '--channel-id',
+      '5',
+      '--hostname',
+      'override.example',
+    ]);
+
+    expect(mockSelect).not.toHaveBeenCalled();
+    expect(putChannelId).toBe('5');
+    expect(putBody).toEqual({ url: 'https://override.example' });
+  });
+
+  test('exits gracefully when no projects exist and user declines to create one', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    // First prompt: "Would you like to create one?" — user says no
+    mockConfirm.mockResolvedValueOnce(false);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'update',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('catalyst project create'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('propagates errors from the channel-site PUT', async () => {
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+        HttpResponse.json({}, { status: 401 }),
+      ),
+    );
+
+    mockSelect.mockResolvedValueOnce(2).mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'channel',
+        'update',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--project-uuid',
+        linkedProjectUuid,
+      ]),
+    ).rejects.toThrow('Re-run `catalyst auth login`');
+  });
+});
+
+describe('channel link', () => {
+  const initUrl =
+    'https://cxm-prd.bigcommerceapp.com/stores/:storeHash/cli-api/v3/channels/:channelId/init';
+
+  test('links a channel by id and writes .env.local', async () => {
+    let initChannelId: string | undefined;
+
+    server.use(
+      http.get(initUrl, ({ params }) => {
+        initChannelId = String(params.channelId);
+
+        return HttpResponse.json({
+          data: {
+            storefront_api_token: 'sft-token',
+            envVars: {
+              BIGCOMMERCE_STORE_HASH: storeHash,
+              BIGCOMMERCE_CHANNEL_ID: '2',
+              BIGCOMMERCE_STOREFRONT_TOKEN: 'sft-token',
+            },
+          },
+        });
+      }),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'link',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '2',
+    ]);
+
+    expect(initChannelId).toBe('2');
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+
+    const envLocal = readFileSync(join(tmpDir, '.env.local'), 'utf8');
+
+    expect(envLocal).toContain(`BIGCOMMERCE_STORE_HASH=${storeHash}`);
+    expect(envLocal).toContain('BIGCOMMERCE_STOREFRONT_TOKEN=sft-token');
+    expect(consola.success).toHaveBeenCalledWith(expect.stringContaining('Linked to channel 2'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts for a channel when --channel-id is omitted', async () => {
+    let initChannelId: string | undefined;
+
+    server.use(
+      http.get(initUrl, ({ params }) => {
+        initChannelId = String(params.channelId);
+
+        return HttpResponse.json({
+          data: { storefront_api_token: 'sft-token', envVars: { BIGCOMMERCE_CHANNEL_ID: '2' } },
+        });
+      }),
+    );
+
+    mockSelect.mockResolvedValueOnce(2);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'link',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(mockSelect).toHaveBeenCalledTimes(1);
+    expect(initChannelId).toBe('2');
+    // id 2 in the default channels handler is "Catalyst Storefront".
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Linked to channel "Catalyst Storefront" (2)'),
+    );
+  });
+
+  test('merges --env overrides into .env.local', async () => {
+    server.use(
+      http.get(initUrl, () =>
+        HttpResponse.json({
+          data: {
+            storefront_api_token: 'sft-token',
+            envVars: { BIGCOMMERCE_STORE_HASH: storeHash },
+          },
+        }),
+      ),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'link',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '2',
+      '--env',
+      'EXTRA_FLAG=on',
+      '--env',
+      'BIGCOMMERCE_STORE_HASH=overridden',
+    ]);
+
+    const envLocal = readFileSync(join(tmpDir, '.env.local'), 'utf8');
+
+    expect(envLocal).toContain('EXTRA_FLAG=on');
+    expect(envLocal).toContain('BIGCOMMERCE_STORE_HASH=overridden');
+  });
+
+  test('exits when the store has no storefront channels', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/channels', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'link',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith(
+      expect.stringContaining('No storefront channels found'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('logs in and persists credentials when none are available', async () => {
+    server.use(
+      http.get(initUrl, () =>
+        HttpResponse.json({
+          data: { storefront_api_token: 'sft-token', envVars: { BIGCOMMERCE_CHANNEL_ID: '2' } },
+        }),
+      ),
+    );
+
+    await program.parseAsync(['node', 'catalyst', 'channel', 'link', '--channel-id', '2']);
+
+    expect(config.get('storeHash')).toBe('mock-store-hash');
+    expect(config.get('accessToken')).toBe('mock-access-token');
+    expect(mockIdentify).toHaveBeenCalledWith('mock-store-hash');
+  });
+});
+
+describe('channel create', () => {
+  const eligibilityUrl =
+    'https://cxm-prd.bigcommerceapp.com/stores/:storeHash/cli-api/v3/channels/catalyst/eligibility';
+  const createUrl =
+    'https://cxm-prd.bigcommerceapp.com/stores/:storeHash/cli-api/v3/channels/catalyst';
+
+  test('creates a channel non-interactively and links it with --link', async () => {
+    let createBody: unknown;
+
+    server.use(
+      http.post(createUrl, async ({ request }) => {
+        createBody = await request.json();
+
+        return HttpResponse.json({
+          data: {
+            id: 42,
+            storefront_api_token: 'new-sft-token',
+            envVars: {
+              BIGCOMMERCE_STORE_HASH: storeHash,
+              BIGCOMMERCE_CHANNEL_ID: '42',
+              BIGCOMMERCE_STOREFRONT_TOKEN: 'new-sft-token',
+            },
+          },
+        });
+      }),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'create',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--name',
+      'My Store',
+      '--locale',
+      'en',
+      '--additional-locales',
+      'es',
+      'fr',
+      '--no-sample-data',
+      '--link',
+    ]);
+
+    // No prompts when every input is flag-provided (including --link).
+    expect(mockInput).not.toHaveBeenCalled();
+    expect(mockSelect).not.toHaveBeenCalled();
+    expect(mockCheckbox).not.toHaveBeenCalled();
+
+    expect(createBody).toEqual({
+      name: 'My Store',
+      initialData: { type: 'none' },
+      deployStorefront: true,
+      devOrigin: 'http://localhost:3000',
+      storefrontLanguage: 'en',
+      additionalLocales: ['es', 'fr'],
+    });
+
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+    expect(consola.success).toHaveBeenCalledWith(expect.stringContaining('Created channel 42'));
+
+    const envLocal = readFileSync(join(tmpDir, '.env.local'), 'utf8');
+
+    expect(envLocal).toContain('BIGCOMMERCE_CHANNEL_ID=42');
+    expect(envLocal).toContain('BIGCOMMERCE_STOREFRONT_TOKEN=new-sft-token');
+    expect(consola.success).toHaveBeenCalledWith(expect.stringContaining('Linked to channel 42'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('aborts cleanly when the store is not eligible', async () => {
+    let createCalled = false;
+
+    server.use(
+      http.get(eligibilityUrl, () =>
+        HttpResponse.json({
+          data: { eligible: false, message: 'Your plan does not support new channels.' },
+        }),
+      ),
+      http.post(createUrl, () => {
+        createCalled = true;
+
+        return HttpResponse.json({ data: {} });
+      }),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'create',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--name',
+      'My Store',
+      '--locale',
+      'en',
+      '--additional-locales',
+      'es',
+    ]);
+
+    expect(consola.warn).toHaveBeenCalledWith('Your plan does not support new channels.');
+    expect(createCalled).toBe(false);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts before linking and skips the .env.local write when declined', async () => {
+    const envPath = join(tmpDir, '.env.local');
+
+    rmSync(envPath, { force: true });
+
+    // Only the post-create link prompt should fire (create inputs are all flags).
+    mockSelect.mockResolvedValueOnce(false);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'create',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--name',
+      'My Store',
+      '--locale',
+      'en',
+      '--additional-locales',
+      'es',
+      '--no-sample-data',
+    ]);
+
+    expect(mockSelect).toHaveBeenCalledTimes(1);
+    expect(consola.success).toHaveBeenCalledWith(expect.stringContaining('Created channel 42'));
+    expect(consola.success).not.toHaveBeenCalledWith(expect.stringContaining('Linked to channel'));
+    expect(existsSync(envPath)).toBe(false);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('interactive path prompts for name, locale, languages, and sample data', async () => {
+    let createBody: unknown;
+
+    server.use(
+      http.post(createUrl, async ({ request }) => {
+        createBody = await request.json();
+
+        return HttpResponse.json({
+          data: {
+            id: 42,
+            storefront_api_token: 'new-sft-token',
+            envVars: { BIGCOMMERCE_CHANNEL_ID: '42' },
+          },
+        });
+      }),
+    );
+
+    mockInput.mockResolvedValueOnce('Interactive Channel');
+    // select order: default locale, "add languages?", "sample data?", link prompt
+    mockSelect
+      .mockResolvedValueOnce('en')
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(false);
+    mockCheckbox.mockResolvedValueOnce(['es']);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'channel',
+      'create',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(mockInput).toHaveBeenCalledTimes(1);
+    expect(mockCheckbox).toHaveBeenCalledTimes(1);
+    expect(createBody).toEqual({
+      name: 'Interactive Channel',
+      initialData: { type: 'none' },
+      deployStorefront: true,
+      devOrigin: 'http://localhost:3000',
+      storefrontLanguage: 'en',
+      additionalLocales: ['es'],
+    });
+    expect(consola.success).toHaveBeenCalledWith(expect.stringContaining('Created channel 42'));
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/channel.ts b/packages/catalyst/src/cli/commands/channel.ts
new file mode 100644
index 0000000000..4f9e50a48a
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/channel.ts
@@ -0,0 +1,369 @@
+import { select } from '@inquirer/prompts';
+import { Command, InvalidArgumentError, Option } from 'commander';
+import type Conf from 'conf';
+import { colorize } from 'consola/utils';
+
+import { runChannelSiteUrlFlow } from '../lib/channel-site-flow';
+import {
+  channelPlatformLabel,
+  checkChannelEligibility,
+  fetchAvailableChannels,
+  getChannelInit,
+  sortChannelsByPlatform,
+} from '../lib/channels';
+import { NoLinkedProjectError } from '../lib/commerce-hosting';
+import { runCreateChannelFlow } from '../lib/create-channel-flow';
+import { parseEnvAssignment } from '../lib/env-config';
+import { consola } from '../lib/logger';
+import { LoginAbortedError, login as runInteractiveLogin } from '../lib/login';
+import { getProjectConfig, type ProjectConfigSchema } from '../lib/project-config';
+import { resolveCredentials } from '../lib/resolve-credentials';
+import {
+  accessTokenOption,
+  apiHostOption,
+  loginUrlOption,
+  projectUuidOption,
+  resolveApiHost,
+  storeHashOption,
+} from '../lib/shared-options';
+import { getTelemetry } from '../lib/telemetry';
+import { writeEnv } from '../lib/write-env';
+
+const parseChannelId = (value: string): number => {
+  const parsed = Number.parseInt(value, 10);
+
+  if (Number.isNaN(parsed)) {
+    throw new InvalidArgumentError(`"${value}" is not a valid channel ID (expected a number).`);
+  }
+
+  return parsed;
+};
+
+// Resolve credentials from flags/env → persisted project config → interactive
+// login (persisting on success). Returns null when the user aborts login.
+// `channel link` is an onboarding command — a fresh clone has neither
+// .env.local nor .bigcommerce/project.json — so it logs the user in like
+// `catalyst project create`, rather than erroring like the operational commands.
+async function resolveCredentialsWithLogin(
+  options: { storeHash?: string; accessToken?: string; loginUrl: string },
+  config: Conf<ProjectConfigSchema>,
+  apiHost: string,
+): Promise<{ storeHash: string; accessToken: string } | null> {
+  const storeHash = options.storeHash ?? config.get('storeHash');
+  const accessToken = options.accessToken ?? config.get('accessToken');
+
+  if (storeHash && accessToken) {
+    return { storeHash, accessToken };
+  }
+
+  try {
+    const credentials = await runInteractiveLogin(options.loginUrl, apiHost);
+
+    config.set('storeHash', credentials.storeHash);
+    config.set('accessToken', credentials.accessToken);
+
+    return credentials;
+  } catch (error) {
+    if (error instanceof LoginAbortedError) {
+      return null;
+    }
+
+    throw error;
+  }
+}
+
+const update = new Command('update')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    "Update a BigCommerce channel's site URL to point at one of your project's deployment hostnames.",
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Pick a channel and hostname interactively
+  $ catalyst channel update
+
+  # Skip both prompts
+  $ catalyst channel update --channel-id 123 --hostname my-storefront.example.com`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .addOption(
+    new Option(
+      '--channel-id <id>',
+      'Skip the channel prompt and target this channel directly.',
+    ).argParser((value: string) => Number(value)),
+  )
+  .addOption(
+    new Option(
+      '--hostname <hostname>',
+      "Skip the hostname prompt and use this hostname directly. Must be one of the project's deployment_hostnames.",
+    ),
+  )
+  .action(async (options) => {
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+    const { storeHash, accessToken } = resolveCredentials(options, config);
+
+    await getTelemetry().identify(storeHash);
+
+    try {
+      await runChannelSiteUrlFlow({
+        storeHash,
+        accessToken,
+        apiHost,
+        projectUuid: options.projectUuid ?? config.get('projectUuid'),
+        channelId: options.channelId,
+        hostname: options.hostname,
+      });
+    } catch (error) {
+      if (error instanceof NoLinkedProjectError) {
+        consola.info(
+          "When you're ready to create a project, run `catalyst project create` or re-run `catalyst channel update`.",
+        );
+        process.exit(0);
+
+        // Unreachable in production; prevents continuation when process.exit is mocked in tests.
+        return;
+      }
+
+      throw error;
+    }
+
+    process.exit(0);
+  });
+
+const link = new Command('link')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Link this Catalyst project to a BigCommerce channel and write its credentials to .env.local.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Pick a channel interactively (logs you in if needed)
+  $ catalyst channel link
+
+  # Non-interactive
+  $ catalyst channel link --store-hash <hash> --access-token <token> --channel-id 123
+
+  # Append extra environment variables to .env.local
+  $ catalyst channel link --channel-id 123 --env MY_FLAG=1`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(loginUrlOption())
+  .addOption(
+    new Option('--channel-id <id>', 'Link this channel directly, skipping the picker.').argParser(
+      parseChannelId,
+    ),
+  )
+  .option(
+    '--env <vars...>',
+    'Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable).',
+  )
+  .addOption(
+    new Option('--cli-api-origin <origin>', 'Catalyst CLI API origin')
+      .default('https://cxm-prd.bigcommerceapp.com')
+      .hideHelp(),
+  )
+  .action(async (options) => {
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+
+    const credentials = await resolveCredentialsWithLogin(options, config, apiHost);
+
+    if (!credentials) {
+      consola.info(
+        'Login aborted. Re-run `catalyst channel link` when you have your credentials ready.',
+      );
+      process.exit(0);
+
+      return;
+    }
+
+    const { storeHash, accessToken } = credentials;
+
+    await getTelemetry().identify(storeHash);
+
+    let channelId = options.channelId;
+    let channelName: string | undefined;
+
+    if (channelId === undefined) {
+      const channels = await fetchAvailableChannels(storeHash, accessToken, apiHost);
+
+      if (channels.length === 0) {
+        consola.info(
+          'No storefront channels found on this store. Create one with `catalyst create` and try again.',
+        );
+        process.exit(0);
+
+        return;
+      }
+
+      channelId = await select({
+        message: 'Which channel would you like to link?',
+        choices: sortChannelsByPlatform(channels).map((c) => ({
+          name: c.name,
+          value: c.id,
+          description: channelPlatformLabel(c.platform),
+        })),
+      });
+
+      channelName = channels.find((c) => c.id === channelId)?.name;
+    }
+
+    const initData = await getChannelInit(channelId, storeHash, accessToken, options.cliApiOrigin);
+
+    const envVars: Record<string, string> = { ...initData.envVars };
+
+    // Inline `--env KEY=VALUE` overrides win over the channel-provided values.
+    if (options.env) {
+      options.env.forEach((entry) => {
+        const { key, value } = parseEnvAssignment(entry);
+
+        envVars[key] = value;
+      });
+    }
+
+    // Writes .env.local in the current working directory — `channel link`
+    // runs from inside `core/`, the same place `dev`/`build`/`deploy` run.
+    writeEnv(process.cwd(), envVars);
+
+    const label = channelName ? `"${channelName}" (${channelId})` : `${channelId}`;
+
+    consola.success(
+      `Linked to channel ${label} and wrote ${colorize('cyanBright', '.env.local')}.`,
+    );
+    consola.log(`Next steps:\n\n  ${colorize('yellow', 'pnpm run dev')}`);
+
+    process.exit(0);
+  });
+
+const create = new Command('create')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Create a new Catalyst storefront channel on your BigCommerce store.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Create a channel interactively (logs you in if needed)
+  $ catalyst channel create
+
+  # Non-interactive, and link it to this project afterwards
+  $ catalyst channel create --name "My Store" --locale en --no-sample-data --link
+
+  # Add additional storefront languages (max 4)
+  $ catalyst channel create --name "My Store" --additional-locales es fr`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(loginUrlOption())
+  .option('--name <name>', 'Name for the new channel. Skips the name prompt.')
+  .option(
+    '--locale <locale>',
+    'Default storefront locale (e.g. "en"). Skips the default-language prompt.',
+  )
+  .option(
+    '--additional-locales <locales...>',
+    'Additional storefront locales, max 4 (e.g. --additional-locales es fr). Skips the additional-languages prompt.',
+  )
+  .addOption(new Option('--sample-data', 'Install sample data on the new channel.'))
+  .addOption(new Option('--no-sample-data', 'Create the channel without sample data.'))
+  .option(
+    '--link',
+    'Link the new channel to this project — write its credentials to .env.local without prompting.',
+  )
+  .addOption(
+    new Option('--cli-api-origin <origin>', 'Catalyst CLI API origin')
+      .default('https://cxm-prd.bigcommerceapp.com')
+      .hideHelp(),
+  )
+  .action(async (options) => {
+    if (options.additionalLocales && options.additionalLocales.length > 4) {
+      consola.error('You can only set up to 4 additional locales.');
+      process.exit(1);
+
+      return;
+    }
+
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+
+    const credentials = await resolveCredentialsWithLogin(options, config, apiHost);
+
+    if (!credentials) {
+      consola.info(
+        'Login aborted. Re-run `catalyst channel create` when you have your credentials ready.',
+      );
+      process.exit(0);
+
+      return;
+    }
+
+    const { storeHash, accessToken } = credentials;
+
+    await getTelemetry().identify(storeHash);
+
+    const eligibility = await checkChannelEligibility(storeHash, accessToken, options.cliApiOrigin);
+
+    if (!eligibility.eligible) {
+      consola.warn(eligibility.message);
+      process.exit(0);
+
+      return;
+    }
+
+    const channelData = await runCreateChannelFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      cliApiOrigin: options.cliApiOrigin,
+      name: options.name,
+      locale: options.locale,
+      additionalLocales: options.additionalLocales,
+      sampleData: options.sampleData,
+    });
+
+    consola.success(`Created channel ${channelData.channelId}.`);
+    consola.warn(
+      'A preview storefront has been deployed in your BigCommerce control panel. This preview may look different from your local environment as it may be running different code. Additionally, it may take a few minutes for the channel storefront to be accessible.',
+    );
+
+    // `--link` opts in non-interactively; otherwise ask before touching .env.local.
+    const shouldLink = options.link
+      ? true
+      : await select({
+          message: 'Would you like to link this channel to your project?',
+          choices: [
+            { name: 'Yes', value: true },
+            { name: 'No', value: false },
+          ],
+        });
+
+    if (shouldLink) {
+      // Same write path as `channel link`: write the channel's credentials to
+      // .env.local in the current working directory (where `dev`/`build`/`deploy` run).
+      writeEnv(process.cwd(), channelData.envVars);
+
+      consola.success(
+        `Linked to channel ${channelData.channelId} and wrote ${colorize('cyanBright', '.env.local')}.`,
+      );
+      consola.log(`Next steps:\n\n  ${colorize('yellow', 'pnpm run dev')}`);
+    }
+
+    process.exit(0);
+  });
+
+export const channel = new Command('channel')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Manage BigCommerce channels.')
+  .addCommand(create)
+  .addCommand(link)
+  .addCommand(update);
diff --git a/packages/catalyst/src/cli/commands/create.spec.ts b/packages/catalyst/src/cli/commands/create.spec.ts
new file mode 100644
index 0000000000..596d0df93e
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/create.spec.ts
@@ -0,0 +1,531 @@
+import { Command } from 'commander';
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { afterAll, afterEach, beforeAll, describe, expect, MockInstance, test, vi } from 'vitest';
+
+import { promptForCommerceHostingProject, setupCommerceHosting } from '../lib/commerce-hosting';
+import { detectPackageManager } from '../lib/detect-package-manager';
+import { extractCatalyst } from '../lib/extract-catalyst';
+import { initGitRepo } from '../lib/init-git-repo';
+import { installDependencies } from '../lib/install-dependencies';
+import { consola } from '../lib/logger';
+import { login, LoginAbortedError } from '../lib/login';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { hasProjectsAccess } from '../lib/project';
+import { rewriteCorePackage } from '../lib/rewrite-core-package';
+import { setupCoreProject } from '../lib/setup-core-project';
+import { writeEnv } from '../lib/write-env';
+import { program } from '../program';
+
+import { create } from './create';
+
+// Mock all side-effecting modules so the action runs end-to-end without
+// actually cloning, installing, writing files, or hitting the network.
+vi.mock('child_process', () => ({ execSync: vi.fn() }));
+
+vi.mock('@inquirer/prompts', () => ({
+  checkbox: vi.fn(),
+  input: vi.fn(),
+  select: vi.fn(),
+}));
+
+const { MockLoginAbortedError } = vi.hoisted(() => ({
+  MockLoginAbortedError: class extends Error {
+    constructor() {
+      super('Login aborted by user.');
+      this.name = 'LoginAbortedError';
+    }
+  },
+}));
+
+vi.mock('../lib/login', () => ({
+  login: vi.fn().mockResolvedValue({
+    storeHash: 'login-store-hash',
+    accessToken: 'login-access-token',
+  }),
+  LoginAbortedError: MockLoginAbortedError,
+}));
+
+vi.mock('../lib/extract-catalyst', () => ({
+  extractCatalyst: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../lib/rewrite-core-package', () => ({
+  rewriteCorePackage: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../lib/detect-package-manager', () => ({ detectPackageManager: vi.fn(() => 'pnpm') }));
+vi.mock('../lib/init-git-repo', () => ({ initGitRepo: vi.fn() }));
+vi.mock('../lib/setup-core-project', () => ({ setupCoreProject: vi.fn() }));
+vi.mock('../lib/install-dependencies', () => ({
+  installDependencies: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../lib/write-env', () => ({ writeEnv: vi.fn() }));
+
+vi.mock('../lib/commerce-hosting', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../lib/commerce-hosting')>();
+
+  return {
+    ...actual,
+    setupCommerceHosting: vi.fn(),
+    promptForCommerceHostingProject: vi.fn().mockResolvedValue({
+      uuid: 'commerce-project-uuid',
+      name: 'commerce-project',
+    }),
+  };
+});
+
+vi.mock('../lib/project', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../lib/project')>();
+
+  return {
+    ...actual,
+    hasProjectsAccess: vi.fn().mockResolvedValue(true),
+  };
+});
+
+vi.mock('../lib/localization', () => ({
+  getAvailableLocales: vi.fn().mockResolvedValue([
+    { name: 'English', value: 'en' },
+    { name: 'Spanish', value: 'es' },
+  ]),
+}));
+
+const { mockIdentify } = vi.hoisted(() => ({ mockIdentify: vi.fn() }));
+
+vi.mock('../lib/telemetry', () => {
+  const instance = {
+    identify: mockIdentify,
+    isEnabled: vi.fn(() => true),
+    track: vi.fn(),
+    correlationId: 'test-session-uuid',
+    commandName: 'create',
+    durationMs: vi.fn().mockReturnValue(0),
+    analytics: { closeAndFlush: vi.fn().mockResolvedValue(undefined) },
+  };
+
+  return {
+    Telemetry: vi.fn().mockImplementation(() => instance),
+    getTelemetry: vi.fn(() => instance),
+    resetTelemetry: vi.fn(),
+  };
+});
+
+let exitMock: MockInstance;
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let testCounter = 0;
+
+const storeHash = 'flag-store-hash';
+const accessToken = 'flag-access-token';
+
+// Each test gets a unique --project-name so the computed projectDir
+// (`${tmpDir}/${name}`) doesn't collide with prior tests' directories
+// when extractCatalyst's mock creates them.
+const uniqueProjectName = () => `test-project-${(testCounter += 1)}`;
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+afterAll(async () => {
+  vi.restoreAllMocks();
+  exitMock.mockRestore();
+
+  await cleanup();
+});
+
+test('properly configured Command instance', () => {
+  expect(create).toBeInstanceOf(Command);
+  expect(create.name()).toBe('create');
+  expect(create.description()).toBe(
+    'Scaffold and connect a Catalyst storefront to your BigCommerce store.',
+  );
+});
+
+describe('happy paths', () => {
+  test('scaffolds with full creds + flag-provided channel info (no commerce hosting)', async () => {
+    const projectName = uniqueProjectName();
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      projectName,
+      '--project-dir',
+      tmpDir,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+    ]);
+
+    expect(login).not.toHaveBeenCalled();
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+    expect(extractCatalyst).toHaveBeenCalled();
+    expect(rewriteCorePackage).toHaveBeenCalled();
+    expect(detectPackageManager).toHaveBeenCalled();
+    expect(setupCoreProject).toHaveBeenCalled();
+    expect(setupCommerceHosting).not.toHaveBeenCalled();
+    expect(installDependencies).toHaveBeenCalled();
+    expect(initGitRepo).toHaveBeenCalled();
+    expect(writeEnv).toHaveBeenCalledWith(
+      join(tmpDir, projectName),
+      expect.objectContaining({
+        BIGCOMMERCE_STORE_HASH: storeHash,
+        BIGCOMMERCE_CHANNEL_ID: '42',
+        BIGCOMMERCE_STOREFRONT_TOKEN: 'flag-storefront-token',
+        CATALYST_ACCESS_TOKEN: accessToken,
+      }),
+    );
+  });
+
+  test('--hosting commerce sets up commerce hosting and writes BIGCOMMERCE_ACCESS_TOKEN', async () => {
+    const projectName = uniqueProjectName();
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      projectName,
+      '--project-dir',
+      tmpDir,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+      '--hosting',
+      'commerce',
+    ]);
+
+    expect(hasProjectsAccess).toHaveBeenCalledWith(storeHash, accessToken, 'api.bigcommerce.com');
+    expect(promptForCommerceHostingProject).toHaveBeenCalled();
+    expect(setupCommerceHosting).toHaveBeenCalledWith({
+      projectDir: join(tmpDir, projectName),
+      projectUuid: 'commerce-project-uuid',
+      storeHash,
+      accessToken,
+    });
+    expect(writeEnv).toHaveBeenCalledWith(
+      join(tmpDir, projectName),
+      expect.objectContaining({ BIGCOMMERCE_ACCESS_TOKEN: accessToken }),
+    );
+  });
+
+  test('login is invoked when creds are missing — channel info alone is insufficient', async () => {
+    // Regression test for edge case #1: previously, providing channel info via
+    // flags caused the login gate to be skipped, leaving BIGCOMMERCE_STORE_HASH
+    // unset and the storefront unable to start.
+    const projectName = uniqueProjectName();
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      projectName,
+      '--project-dir',
+      tmpDir,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+    ]);
+
+    expect(login).toHaveBeenCalled();
+    expect(writeEnv).toHaveBeenCalledWith(
+      join(tmpDir, projectName),
+      expect.objectContaining({
+        BIGCOMMERCE_STORE_HASH: 'login-store-hash',
+        BIGCOMMERCE_CHANNEL_ID: '42',
+        BIGCOMMERCE_STOREFRONT_TOKEN: 'flag-storefront-token',
+      }),
+    );
+  });
+
+  test('warns when --use-existing is passed without --hosting commerce', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      uniqueProjectName(),
+      '--project-dir',
+      tmpDir,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+      '--use-existing',
+    ]);
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      '--use-existing has no effect without --hosting commerce. Ignoring.',
+    );
+  });
+});
+
+describe('parser validation', () => {
+  test('--channel-id with non-numeric value throws InvalidArgumentError', async () => {
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        uniqueProjectName(),
+        '--project-dir',
+        tmpDir,
+        '--channel-id',
+        'abc',
+      ]),
+    ).rejects.toThrow(/not a valid channel ID/);
+  });
+
+  test('--env without = throws InvalidArgumentError', async () => {
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        uniqueProjectName(),
+        '--project-dir',
+        tmpDir,
+        '--env',
+        'BAD_VALUE',
+      ]),
+    ).rejects.toThrow(/Expected KEY=VALUE/);
+  });
+
+  test('--env with KEY=VAL=UE preserves the full value past the first =', async () => {
+    const projectName = uniqueProjectName();
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      projectName,
+      '--project-dir',
+      tmpDir,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+      '--env',
+      'CONNECTION_STRING=postgres://user:pass@host/db?ssl=true',
+    ]);
+
+    expect(writeEnv).toHaveBeenCalledWith(
+      join(tmpDir, projectName),
+      expect.objectContaining({
+        CONNECTION_STRING: 'postgres://user:pass@host/db?ssl=true',
+      }),
+    );
+  });
+});
+
+describe('ordering invariants', () => {
+  test('writeEnv runs before install, and git init runs after install', async () => {
+    // Env vars must be written before install (postinstall scripts may read
+    // them), and the git repo is initialized only after the project is complete.
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      uniqueProjectName(),
+      '--project-dir',
+      tmpDir,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--channel-id',
+      '42',
+      '--storefront-token',
+      'flag-storefront-token',
+    ]);
+
+    const [writeEnvOrder] = vi.mocked(writeEnv).mock.invocationCallOrder;
+    const [installOrder] = vi.mocked(installDependencies).mock.invocationCallOrder;
+    const [gitInitOrder] = vi.mocked(initGitRepo).mock.invocationCallOrder;
+
+    expect(writeEnvOrder).toBeLessThan(installOrder);
+    expect(installOrder).toBeLessThan(gitInitOrder);
+  });
+});
+
+describe('failure handling', () => {
+  test('mid-flow failure surfaces cleanup warning when projectDir exists', async () => {
+    // Regression test for edge case #5. extractCatalyst's mock creates the dir
+    // so the cleanup-warning's pathExistsSync check passes; installDependencies
+    // then throws to simulate a mid-flow failure.
+    const projectName = uniqueProjectName();
+    const projectDir = join(tmpDir, projectName);
+
+    vi.mocked(extractCatalyst).mockImplementationOnce(() => {
+      mkdirSync(projectDir, { recursive: true });
+
+      return Promise.resolve();
+    });
+    vi.mocked(installDependencies).mockRejectedValueOnce(new Error('install failed'));
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        projectName,
+        '--project-dir',
+        tmpDir,
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--channel-id',
+        '42',
+        '--storefront-token',
+        'flag-storefront-token',
+      ]),
+    ).rejects.toThrow('install failed');
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining(`'${projectDir}' may be in a partial state`),
+    );
+  });
+
+  test('mid-flow failure does not log cleanup warning if projectDir does not exist', async () => {
+    // extractCatalyst is mocked to reject WITHOUT creating the dir, so
+    // pathExistsSync returns false and the cleanup warning is suppressed.
+    vi.mocked(extractCatalyst).mockRejectedValueOnce(
+      new Error('extract failed before creating directory'),
+    );
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        uniqueProjectName(),
+        '--project-dir',
+        tmpDir,
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--channel-id',
+        '42',
+        '--storefront-token',
+        'flag-storefront-token',
+      ]),
+    ).rejects.toThrow('extract failed before creating directory');
+
+    expect(consola.warn).not.toHaveBeenCalledWith(expect.stringContaining('partial state'));
+  });
+
+  test('exits cleanly when the user aborts the interactive login', async () => {
+    vi.mocked(login).mockRejectedValueOnce(new LoginAbortedError());
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'create',
+      '--project-name',
+      uniqueProjectName(),
+      '--project-dir',
+      tmpDir,
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith(
+      'Login aborted. Re-run `catalyst create` when you have your credentials ready.',
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+    expect(extractCatalyst).not.toHaveBeenCalled();
+  });
+
+  test('propagates non-LoginAbortedError login failures', async () => {
+    vi.mocked(login).mockRejectedValueOnce(new Error('network down'));
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        uniqueProjectName(),
+        '--project-dir',
+        tmpDir,
+      ]),
+    ).rejects.toThrow('network down');
+
+    expect(extractCatalyst).not.toHaveBeenCalled();
+  });
+});
+
+describe('--hosting commerce preconditions', () => {
+  test('exits with error when hasProjectsAccess returns false', async () => {
+    vi.mocked(hasProjectsAccess).mockResolvedValueOnce(false);
+
+    // The promptForCommerceHostingProject mock would normally return a project,
+    // but after process.exit (mocked) the action falls through. Make it throw
+    // so we can verify the precondition fired before reaching the prompt.
+    vi.mocked(promptForCommerceHostingProject).mockRejectedValueOnce(
+      new Error('should not have prompted after access denied'),
+    );
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'create',
+        '--project-name',
+        uniqueProjectName(),
+        '--project-dir',
+        tmpDir,
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--channel-id',
+        '42',
+        '--storefront-token',
+        'flag-storefront-token',
+        '--hosting',
+        'commerce',
+      ]),
+    ).rejects.toThrow(/should not have prompted/);
+
+    expect(consola.error).toHaveBeenCalledWith(
+      expect.stringContaining('does not have access to the Infrastructure Projects API'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/create.ts b/packages/catalyst/src/cli/commands/create.ts
new file mode 100644
index 0000000000..6e335f0397
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/create.ts
@@ -0,0 +1,418 @@
+import { Command, InvalidArgumentError, Option } from '@commander-js/extra-typings';
+import { input, select } from '@inquirer/prompts';
+import { execSync } from 'child_process';
+import { colorize } from 'consola/utils';
+import { pathExistsSync } from 'fs-extra/esm';
+import kebabCase from 'lodash.kebabcase';
+import { join } from 'path';
+
+import { DEFAULT_LOGIN_URL } from '../lib/auth';
+import {
+  channelPlatformLabel,
+  checkChannelEligibility,
+  fetchAvailableChannels,
+  getChannelInit,
+  sortChannelsByPlatform,
+} from '../lib/channels';
+import { promptForCommerceHostingProject, setupCommerceHosting } from '../lib/commerce-hosting';
+import { runCreateChannelFlow } from '../lib/create-channel-flow';
+import { detectPackageManager } from '../lib/detect-package-manager';
+import { extractCatalyst } from '../lib/extract-catalyst';
+import { initGitRepo } from '../lib/init-git-repo';
+import { installDependencies } from '../lib/install-dependencies';
+import { consola } from '../lib/logger';
+import { login, LoginAbortedError } from '../lib/login';
+import { hasProjectsAccess, type ProjectListItem } from '../lib/project';
+import { rewriteCorePackage } from '../lib/rewrite-core-package';
+import { setupCoreProject } from '../lib/setup-core-project';
+import { accessTokenOption, storeHashOption } from '../lib/shared-options';
+import { getTelemetry } from '../lib/telemetry';
+import { writeEnv } from '../lib/write-env';
+
+function getPlatformCheckCommand(command: string): string {
+  const isWindows = process.platform === 'win32';
+
+  return isWindows ? `where.exe ${command}` : `which ${command}`;
+}
+
+function parseChannelId(value: string): number {
+  const parsed = parseInt(value, 10);
+
+  if (Number.isNaN(parsed)) {
+    throw new InvalidArgumentError(`"${value}" is not a valid channel ID (expected a number).`);
+  }
+
+  return parsed;
+}
+
+// Variadic argParser: called once per `--env KEY=VALUE`, accumulating into a
+// merged record. Splits on the first `=` so values containing `=` are preserved.
+function parseEnvFlag(
+  value: string,
+  previous: Record<string, string> = {},
+): Record<string, string> {
+  const eqIdx = value.indexOf('=');
+
+  if (eqIdx <= 0) {
+    throw new InvalidArgumentError(`Expected KEY=VALUE, got "${value}".`);
+  }
+
+  const key = value.substring(0, eqIdx);
+  const val = value.substring(eqIdx + 1);
+
+  if (!val) {
+    throw new InvalidArgumentError(`Expected KEY=VALUE with non-empty value, got "${value}".`);
+  }
+
+  return { ...previous, [key]: val };
+}
+
+async function handleChannelSelection(storeHash: string, accessToken: string, apiHost: string) {
+  const channels = await fetchAvailableChannels(storeHash, accessToken, apiHost);
+
+  const existingChannel = await select({
+    message: 'Which channel would you like to use?',
+    choices: sortChannelsByPlatform(channels).map((ch) => ({
+      name: ch.name,
+      value: ch,
+      description: `Channel Platform: ${channelPlatformLabel(ch.platform)}`,
+    })),
+  });
+
+  return existingChannel.id;
+}
+
+async function setupProject(options: {
+  projectName?: string;
+  projectDir: string;
+}): Promise<{ projectName: string; projectDir: string }> {
+  let { projectName, projectDir } = options;
+
+  if (!pathExistsSync(projectDir)) {
+    consola.error(`--project-dir ${projectDir} is not a valid path`);
+    process.exit(1);
+  }
+
+  if (projectName) {
+    projectName = kebabCase(projectName);
+    projectDir = join(options.projectDir, projectName);
+
+    if (pathExistsSync(projectDir)) {
+      consola.error(`${projectDir} already exists`);
+      process.exit(1);
+    }
+  }
+
+  if (!projectName) {
+    const validateProjectName = (i: string) => {
+      const formatted = kebabCase(i);
+
+      if (!formatted) return 'Project name is required';
+
+      const targetDir = join(options.projectDir, formatted);
+
+      if (pathExistsSync(targetDir)) return `Destination '${targetDir}' already exists`;
+
+      projectName = formatted;
+      projectDir = targetDir;
+
+      return true;
+    };
+
+    await input({
+      message: 'What do you want to name your project directory?',
+      default: 'my-catalyst-app',
+      validate: validateProjectName,
+    });
+  }
+
+  if (!projectName) throw new Error('Something went wrong, projectName is not defined');
+  if (!projectDir) throw new Error('Something went wrong, projectDir is not defined');
+
+  return { projectName, projectDir };
+}
+
+function checkRequiredTools() {
+  try {
+    execSync(getPlatformCheckCommand('git'), { stdio: 'ignore' });
+  } catch {
+    consola.error('git is required to create a Catalyst project');
+    process.exit(1);
+  }
+}
+
+export const create = new Command('create')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Scaffold and connect a Catalyst storefront to your BigCommerce store.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Interactive scaffold (default — self-hosted, no hosting prompt)
+  $ catalyst create
+
+  # Non-interactive: skip the project-name prompt
+  $ catalyst create --project-name my-store
+
+  # Eagerly set up Commerce Hosting at create time
+  $ catalyst create --project-name my-store --hosting commerce`,
+  )
+  .option('--project-name <name>', 'Name of your Catalyst project')
+  .option('--project-dir <dir>', 'Directory in which to create your project', process.cwd())
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .option('--channel-id <id>', 'BigCommerce channel ID', parseChannelId)
+  .option('--storefront-token <token>', 'BigCommerce storefront token')
+  .option(
+    '--gh-ref <ref>',
+    'Extract a specific ref (tag, branch, or commit) from the source repository',
+    '@bigcommerce/catalyst-core@latest',
+  )
+  .option('--repository <repository>', 'GitHub repository to extract from', 'bigcommerce/catalyst')
+  .option(
+    '--env <vars...>',
+    'Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable).',
+    parseEnvFlag,
+  )
+  .addOption(
+    new Option(
+      '--hosting <mode>',
+      'Hosting mode: "self-hosted" (default) or "commerce" to set up Commerce Hosting at create time. When omitted, scaffolding is hosting-agnostic; run `catalyst deploy` later to opt in.',
+    ).choices(['self-hosted', 'commerce'] as const),
+  )
+  .option(
+    '--use-existing',
+    'Only used with --hosting commerce and --project-name. When the named project already exists on the store, reuse it instead of prompting. Has no effect without --hosting commerce.',
+  )
+  .addOption(
+    new Option('--bigcommerce-hostname <hostname>', 'BigCommerce hostname')
+      .default('bigcommerce.com')
+      .hideHelp(),
+  )
+  .addOption(
+    new Option('--login-url <url>', 'BigCommerce login URL.')
+      .env('BIGCOMMERCE_LOGIN_URL')
+      .default(DEFAULT_LOGIN_URL)
+      .hideHelp(),
+  )
+  .addOption(
+    new Option('--cli-api-origin <origin>', 'Catalyst CLI API origin')
+      .default('https://cxm-prd.bigcommerceapp.com')
+      .hideHelp(),
+  )
+  // eslint-disable-next-line complexity
+  .action(async (options) => {
+    const { ghRef, repository } = options;
+
+    if (options.useExisting && options.hosting !== 'commerce') {
+      consola.warn('--use-existing has no effect without --hosting commerce. Ignoring.');
+    }
+
+    checkRequiredTools();
+
+    const { projectName, projectDir } = await setupProject({
+      projectName: options.projectName,
+      projectDir: options.projectDir,
+    });
+
+    let storeHash = options.storeHash;
+    let accessToken = options.accessToken;
+    let channelId = options.channelId;
+    let storefrontToken = options.storefrontToken;
+
+    let envVars: Record<string, string> = {};
+
+    // Always require store creds. `--channel-id` + `--storefront-token` aren't
+    // enough on their own — the storefront also needs BIGCOMMERCE_STORE_HASH at
+    // runtime, and downstream catalyst commands (deploy, project, ...) need an
+    // access token. Device login covers the missing pieces; the user picks the
+    // store during the OAuth flow regardless of any partial flags they passed.
+    if (!storeHash || !accessToken) {
+      const apiHost = `api.${options.bigcommerceHostname}`;
+
+      try {
+        const credentials = await login(options.loginUrl, apiHost);
+
+        storeHash = credentials.storeHash;
+        accessToken = credentials.accessToken;
+      } catch (error) {
+        if (error instanceof LoginAbortedError) {
+          consola.info(
+            'Login aborted. Re-run `catalyst create` when you have your credentials ready.',
+          );
+          process.exit(0);
+
+          return;
+        }
+
+        throw error;
+      }
+    }
+
+    const useCommerceHosting = options.hosting === 'commerce';
+
+    await getTelemetry().identify(storeHash);
+
+    // Seed env vars from local state when all three were flag-provided. Channel
+    // resolution below overwrites this wholesale via `envVars = { ...initData.envVars }`,
+    // which is fine — that path means the user wanted us to fetch fresh values.
+    if (storeHash && channelId && storefrontToken) {
+      envVars.BIGCOMMERCE_STORE_HASH = storeHash;
+      envVars.BIGCOMMERCE_CHANNEL_ID = channelId.toString();
+      envVars.BIGCOMMERCE_STOREFRONT_TOKEN = storefrontToken;
+    }
+
+    // Resolve channel only when we have creds and are missing channel info.
+    if (storeHash && accessToken && (!channelId || !storefrontToken)) {
+      const apiHost = `api.${options.bigcommerceHostname}`;
+      const cliApiOrigin = options.cliApiOrigin;
+
+      if (channelId && !storefrontToken) {
+        const initData = await getChannelInit(channelId, storeHash, accessToken, cliApiOrigin);
+
+        envVars = { ...initData.envVars };
+        storefrontToken = initData.storefrontToken;
+      } else if (!channelId) {
+        const eligibility = await checkChannelEligibility(storeHash, accessToken, cliApiOrigin);
+
+        if (!eligibility.eligible) {
+          consola.warn(eligibility.message);
+        }
+
+        let shouldCreateChannel;
+
+        if (eligibility.eligible) {
+          shouldCreateChannel = await select({
+            message: 'Would you like to create a new channel?',
+            choices: [
+              { name: 'Yes', value: true },
+              { name: 'No', value: false },
+            ],
+          });
+        }
+
+        if (shouldCreateChannel) {
+          const channelData = await runCreateChannelFlow({
+            storeHash,
+            accessToken,
+            apiHost,
+            cliApiOrigin,
+          });
+
+          channelId = channelData.channelId;
+          storefrontToken = channelData.storefrontToken;
+          envVars = { ...channelData.envVars };
+
+          consola.success('Channel created successfully.');
+          consola.warn(
+            'A preview storefront has been deployed in your BigCommerce control panel. This preview may look different from your local environment as it may be running different code. Additionally, it may take a few minutes for the channel storefront to be accessible.',
+          );
+        }
+
+        if (!shouldCreateChannel) {
+          channelId = await handleChannelSelection(storeHash, accessToken, apiHost);
+
+          const initData = await getChannelInit(channelId, storeHash, accessToken, cliApiOrigin);
+
+          envVars = { ...initData.envVars };
+          storefrontToken = initData.storefrontToken;
+        }
+      }
+    }
+
+    if (options.env) {
+      Object.assign(envVars, options.env);
+    }
+
+    if (options.storeHash) envVars.BIGCOMMERCE_STORE_HASH = options.storeHash;
+    if (options.channelId) envVars.BIGCOMMERCE_CHANNEL_ID = options.channelId.toString();
+    if (options.storefrontToken) envVars.BIGCOMMERCE_STOREFRONT_TOKEN = options.storefrontToken;
+
+    if (useCommerceHosting && accessToken) {
+      envVars.BIGCOMMERCE_ACCESS_TOKEN = accessToken;
+    }
+
+    // Pre-populate CATALYST_ACCESS_TOKEN so subsequent catalyst CLI commands
+    // (`catalyst deploy`, `catalyst project ...`, etc.) work without re-auth.
+    // CATALYST_STORE_HASH isn't written — the CLI falls back to BIGCOMMERCE_STORE_HASH
+    // (already in envVars from the channel init response) at startup.
+    if (accessToken) envVars.CATALYST_ACCESS_TOKEN = accessToken;
+
+    // Resolve the Commerce Hosting project before extraction so credential checks
+    // and prompts happen up-front. We defer the file mutations
+    // (`setupCommerceHosting`) until after extraction.
+    let commerceHostingProject: ProjectListItem | undefined;
+
+    if (useCommerceHosting && storeHash && accessToken) {
+      const apiHost = `api.${options.bigcommerceHostname}`;
+      const hasAccess = await hasProjectsAccess(storeHash, accessToken, apiHost);
+
+      if (!hasAccess) {
+        consola.error(
+          'This store does not have access to the Infrastructure Projects API. Contact support@bigcommerce.com to enable it.',
+        );
+        process.exit(1);
+      }
+
+      commerceHostingProject = await promptForCommerceHostingProject(
+        { storeHash, accessToken, apiHost },
+        projectName,
+        !!options.projectName,
+        options.useExisting,
+      );
+    }
+
+    consola.info(`Creating '${projectName}' at '${projectDir}'`);
+
+    const packageManager = detectPackageManager();
+
+    // Anything that mutates `projectDir` runs inside this block. If a step
+    // fails, the directory is likely partially populated — surface that to the
+    // user so they can clean up before retrying. We don't auto-delete because
+    // they may want to inspect the partial state first.
+    try {
+      await extractCatalyst({ repository, ref: ghRef, projectDir });
+      // Turn the extracted core/ into an installable standalone project
+      // (resolve workspace deps, drop `private`, record the catalyst version/ref).
+      await rewriteCorePackage(projectDir, ghRef);
+      setupCoreProject(projectDir);
+
+      if (useCommerceHosting && commerceHostingProject && storeHash && accessToken) {
+        await setupCommerceHosting({
+          projectDir,
+          projectUuid: commerceHostingProject.uuid,
+          storeHash,
+          accessToken,
+        });
+      }
+
+      // Write env before install — matters for postinstall scripts that may
+      // resolve env-driven config.
+      writeEnv(projectDir, envVars);
+
+      await installDependencies(projectDir, packageManager);
+      initGitRepo(projectDir);
+    } catch (error) {
+      if (pathExistsSync(projectDir)) {
+        consola.warn(
+          `Setup failed before completion. '${projectDir}' may be in a partial state — review and delete it before re-running 'catalyst create'.`,
+        );
+      }
+
+      throw error;
+    }
+
+    consola.success(`Created '${projectName}' at '${projectDir}'`);
+
+    const steps = [`cd ${projectName} && ${packageManager} run dev`];
+
+    if (useCommerceHosting) {
+      steps.push(
+        `Run 'cd ${projectName} && ${packageManager} run deploy' when ready to deploy to Commerce Hosting.`,
+      );
+    }
+
+    consola.log(
+      `Next steps:\n\n${steps.map((step) => `  ${colorize('yellow', step)}`).join('\n')}`,
+    );
+  });
diff --git a/packages/catalyst/src/cli/commands/debug.spec.ts b/packages/catalyst/src/cli/commands/debug.spec.ts
new file mode 100644
index 0000000000..c6c266f331
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/debug.spec.ts
@@ -0,0 +1,188 @@
+import { Command } from 'commander';
+import { afterEach, beforeAll, beforeEach, expect, test, vi } from 'vitest';
+
+import { collectDiagnostics, type Diagnostics } from '../lib/collect-diagnostics';
+import { consola } from '../lib/logger';
+import { program } from '../program';
+
+import { debug } from './debug';
+
+vi.mock('../lib/collect-diagnostics', () => ({
+  collectDiagnostics: vi.fn(),
+}));
+
+const fullDiagnostics: Diagnostics = {
+  cli: { name: '@bigcommerce/catalyst', version: '9.9.9' },
+  runtime: {
+    node: 'v20.0.0',
+    platform: 'darwin',
+    arch: 'arm64',
+    osRelease: '25.5.0',
+    packageManager: 'pnpm',
+  },
+  project: {
+    cwd: '/tmp/project',
+    storefrontName: '@bigcommerce/catalyst-core',
+    storefrontVersion: '1.8.0',
+    projectUuid: 'uuid-123',
+    isLinked: true,
+    isTransformed: true,
+    isFullySetUp: true,
+    hasMiddleware: true,
+    hasProxy: false,
+    hasOpenNextDep: true,
+  },
+  config: {
+    storeHash: { present: true, source: 'project.json' },
+    accessToken: { present: true, source: 'process.env' },
+    projectUuid: { present: true, source: 'project.json' },
+    apiHost: { present: true, source: 'project.json' },
+    projectJsonKeys: ['projectUuid', 'storeHash'],
+    storedEnvKeys: ['FOO', 'BAR'],
+    // Both branches of the source formatter (set-with-source and unset).
+    cliEnvVars: { CATALYST_STORE_HASH: 'process.env', CATALYST_PROJECT_UUID: 'unset' },
+    buildEnvVars: { AUTH_SECRET: '.env.local', BIGCOMMERCE_CHANNEL_ID: 'unset' },
+  },
+  telemetry: { enabled: true, correlationId: 'corr-abc' },
+  // Both branches of the presence formatter.
+  files: { '.env.local': true, '.env': false },
+};
+
+const emptyDiagnostics: Diagnostics = {
+  cli: { name: '@bigcommerce/catalyst', version: '9.9.9' },
+  runtime: {
+    node: 'v20.0.0',
+    platform: 'linux',
+    arch: 'x64',
+    osRelease: '6.0.0',
+    packageManager: 'npm',
+  },
+  project: {
+    cwd: '/tmp/empty',
+    storefrontName: null,
+    storefrontVersion: null,
+    projectUuid: null,
+    isLinked: false,
+    isTransformed: false,
+    isFullySetUp: false,
+    hasMiddleware: false,
+    hasProxy: false,
+    hasOpenNextDep: false,
+  },
+  config: {
+    storeHash: { present: false, source: 'unset' },
+    accessToken: { present: false, source: 'unset' },
+    projectUuid: { present: false, source: 'unset' },
+    apiHost: { present: false, source: 'unset' },
+    projectJsonKeys: [],
+    storedEnvKeys: [],
+    cliEnvVars: {},
+    buildEnvVars: {},
+  },
+  telemetry: { enabled: false, correlationId: 'corr-xyz' },
+  files: {},
+};
+
+// The report is the last consola.log call (the program banner also logs, at
+// import time, so we take the most recent call rather than relying on order).
+const lastLogOutput = (): string => {
+  const calls = vi.mocked(consola.log).mock.calls;
+
+  return calls.length > 0 ? String(calls[calls.length - 1][0]) : '';
+};
+
+beforeAll(() => {
+  consola.wrapAll();
+});
+
+beforeEach(() => {
+  consola.mockTypes(() => vi.fn());
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+test('properly configured Command instance', () => {
+  expect(debug).toBeInstanceOf(Command);
+  expect(debug.name()).toBe('debug');
+  expect(debug.description()).toContain('diagnostic report');
+  expect(debug.options).toEqual(
+    expect.arrayContaining([expect.objectContaining({ long: '--json' })]),
+  );
+});
+
+test('prints a human-readable report by default', async () => {
+  vi.mocked(collectDiagnostics).mockReturnValue(fullDiagnostics);
+
+  await program.parseAsync(['node', 'catalyst', 'debug']);
+
+  const output = lastLogOutput();
+
+  expect(output).toContain('Catalyst CLI Diagnostics');
+  expect(output).toContain('@bigcommerce/catalyst');
+  expect(output).toContain('pnpm');
+  expect(output).toContain('Storefront:         @bigcommerce/catalyst-core@1.8.0');
+  expect(output).toContain('Project UUID:       uuid-123');
+  expect(output).toContain('Linked:             yes');
+  expect(output).toContain('middleware.ts:      present');
+  expect(output).toContain('proxy.ts:           absent');
+  expect(output).toContain('OpenNext dep:       installed');
+  expect(output).toContain('Store hash:         present (source: project.json)');
+  expect(output).toContain('Access token:       present (source: process.env)');
+  expect(output).toContain('API host:           present (source: project.json)');
+  expect(output).toContain('project.json keys:  projectUuid, storeHash');
+  expect(output).toContain('Stored env keys:    FOO, BAR');
+  expect(output).toContain('CLI environment variables (used to run the CLI)');
+  expect(output).toContain('CATALYST_STORE_HASH: set (process.env)');
+  expect(output).toContain('CATALYST_PROJECT_UUID: not set');
+  expect(output).toContain('Build environment variables (used to build the Next.js app)');
+  expect(output).toContain('AUTH_SECRET: set (.env.local)');
+  expect(output).toContain('BIGCOMMERCE_CHANNEL_ID: not set');
+  expect(output).toContain('Enabled:            yes');
+  expect(output).toContain('Correlation ID:     corr-abc');
+  expect(output).toContain('.env.local: present');
+  expect(output).toContain('.env: absent');
+});
+
+test('renders the empty-project branches', async () => {
+  vi.mocked(collectDiagnostics).mockReturnValue(emptyDiagnostics);
+
+  await program.parseAsync(['node', 'catalyst', 'debug']);
+
+  const output = lastLogOutput();
+
+  expect(output).toContain('Storefront:         (unknown)');
+  expect(output).toContain('Project UUID:       (not linked)');
+  expect(output).toContain('Linked:             no');
+  expect(output).toContain('OpenNext dep:       not installed');
+  expect(output).toContain('Store hash:         not set');
+  expect(output).toContain('API host:           default (api.bigcommerce.com)');
+  expect(output).toContain('project.json keys:  (none)');
+  expect(output).toContain('Stored env keys:    (none)');
+  expect(output).toContain('Enabled:            no');
+});
+
+test('shows the storefront version alone when the package name is unknown', async () => {
+  vi.mocked(collectDiagnostics).mockReturnValue({
+    ...emptyDiagnostics,
+    project: { ...emptyDiagnostics.project, storefrontName: null, storefrontVersion: '3.2.1' },
+  });
+
+  await program.parseAsync(['node', 'catalyst', 'debug']);
+
+  expect(lastLogOutput()).toContain('Storefront:         3.2.1');
+});
+
+test('--json prints machine-readable output', async () => {
+  vi.mocked(collectDiagnostics).mockReturnValue(fullDiagnostics);
+
+  await program.parseAsync(['node', 'catalyst', 'debug', '--json']);
+
+  const output = lastLogOutput();
+
+  expect(() => {
+    JSON.parse(output);
+  }).not.toThrow();
+  expect(JSON.parse(output)).toEqual(fullDiagnostics);
+});
diff --git a/packages/catalyst/src/cli/commands/debug.ts b/packages/catalyst/src/cli/commands/debug.ts
new file mode 100644
index 0000000000..012d5547b6
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/debug.ts
@@ -0,0 +1,112 @@
+import { Command, Option } from 'commander';
+
+import {
+  collectDiagnostics,
+  type ConfigSource,
+  type Diagnostics,
+  type ResolvedValue,
+} from '../lib/collect-diagnostics';
+import { consola } from '../lib/logger';
+
+const yesNo = (value: boolean): string => (value ? 'yes' : 'no');
+
+const presence = (value: boolean): string => (value ? 'present' : 'absent');
+
+const formatResolved = (value: ResolvedValue): string =>
+  value.present ? `present (source: ${value.source})` : 'not set';
+
+const formatSource = (source: ConfigSource): string =>
+  source === 'unset' ? 'not set' : `set (${source})`;
+
+const formatStorefront = (name: string | null, version: string | null): string => {
+  if (!version) {
+    return '(unknown)';
+  }
+
+  return name ? `${name}@${version}` : version;
+};
+
+const formatList = (values: string[]): string => (values.length > 0 ? values.join(', ') : '(none)');
+
+const envVarLines = (vars: Record<string, ConfigSource>): string[] =>
+  Object.entries(vars).map(([name, source]) => `  ${name}: ${formatSource(source)}`);
+
+// Build a human-readable, copy-pasteable report. Kept to plain text (no colors)
+// so it survives a paste into a GitHub issue or support ticket unchanged.
+const formatReport = (d: Diagnostics): string => {
+  const lines = [
+    'Catalyst CLI Diagnostics',
+    '',
+    'CLI',
+    `  Package:            ${d.cli.name}`,
+    `  Version:            ${d.cli.version}`,
+    '',
+    'Runtime',
+    `  Node:               ${d.runtime.node}`,
+    `  Platform:           ${d.runtime.platform} (${d.runtime.arch})`,
+    `  OS release:         ${d.runtime.osRelease}`,
+    `  Package manager:    ${d.runtime.packageManager}`,
+    '',
+    'Project',
+    `  Directory:          ${d.project.cwd}`,
+    `  Storefront:         ${formatStorefront(d.project.storefrontName, d.project.storefrontVersion)}`,
+    `  Project UUID:       ${d.project.projectUuid ?? '(not linked)'}`,
+    `  Linked:             ${yesNo(d.project.isLinked)}`,
+    `  Transformed:        ${yesNo(d.project.isTransformed)}`,
+    `  Fully set up:       ${yesNo(d.project.isFullySetUp)}`,
+    `  middleware.ts:      ${presence(d.project.hasMiddleware)}`,
+    `  proxy.ts:           ${presence(d.project.hasProxy)}`,
+    `  OpenNext dep:       ${d.project.hasOpenNextDep ? 'installed' : 'not installed'}`,
+    '',
+    'Config (resolved without secrets)',
+    `  Store hash:         ${formatResolved(d.config.storeHash)}`,
+    `  Access token:       ${formatResolved(d.config.accessToken)}`,
+    `  Project UUID:       ${formatResolved(d.config.projectUuid)}`,
+    `  API host:           ${d.config.apiHost.present ? formatResolved(d.config.apiHost) : 'default (api.bigcommerce.com)'}`,
+    `  project.json keys:  ${formatList(d.config.projectJsonKeys)}`,
+    `  Stored env keys:    ${formatList(d.config.storedEnvKeys)}`,
+    '',
+    'CLI environment variables (used to run the CLI)',
+    ...envVarLines(d.config.cliEnvVars),
+    '',
+    'Build environment variables (used to build the Next.js app)',
+    ...envVarLines(d.config.buildEnvVars),
+    '',
+    'Telemetry',
+    `  Enabled:            ${yesNo(d.telemetry.enabled)}`,
+    `  Correlation ID:     ${d.telemetry.correlationId}`,
+    '',
+    'Files',
+    ...Object.entries(d.files).map(([name, exists]) => `  ${name}: ${presence(exists)}`),
+  ];
+
+  return lines.join('\n');
+};
+
+export const debug = new Command('debug')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Print a diagnostic report (CLI, runtime, project, and config state) to include when filing a bug report. Never prints secret values — credentials and env vars are reported by presence only.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Print a human-readable report
+  $ catalyst debug
+
+  # Print machine-readable JSON (useful for copy/paste or piping)
+  $ catalyst debug --json`,
+  )
+  .addOption(new Option('--json', 'Output the report as JSON.'))
+  .action((options: { json?: boolean }) => {
+    const diagnostics = collectDiagnostics();
+
+    if (options.json) {
+      consola.log(JSON.stringify(diagnostics, null, 2));
+
+      return;
+    }
+
+    consola.log(formatReport(diagnostics));
+  });
diff --git a/packages/catalyst/src/cli/commands/deploy.spec.ts b/packages/catalyst/src/cli/commands/deploy.spec.ts
index 22e7c81ddf..939ffc4145 100644
--- a/packages/catalyst/src/cli/commands/deploy.spec.ts
+++ b/packages/catalyst/src/cli/commands/deploy.spec.ts
@@ -1,7 +1,8 @@
+import { confirm, input, select } from '@inquirer/prompts';
 import AdmZip from 'adm-zip';
 import { Command } from 'commander';
 import { http, HttpResponse } from 'msw';
-import { mkdir, realpath, stat, writeFile } from 'node:fs/promises';
+import { mkdir, realpath, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import {
   afterAll,
@@ -17,10 +18,15 @@ import {
 
 import { server } from '../../../tests/mocks/node';
 import { textHistory } from '../../../tests/mocks/spinner';
+import { setupCommerceHosting } from '../lib/commerce-hosting';
+import { installDependencies } from '../lib/install-dependencies';
 import { consola } from '../lib/logger';
 import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig } from '../lib/project-config';
+import { getProjectState } from '../lib/project-state';
 import { program } from '../program';
 
+import { buildCatalystProject } from './build';
 import {
   createDeployment,
   deploy,
@@ -31,8 +37,49 @@ import {
   uploadBundleZip,
 } from './deploy';
 
+vi.mock('@inquirer/prompts', () => ({
+  confirm: vi.fn(),
+  input: vi.fn(),
+  select: vi.fn(),
+}));
+
 // eslint-disable-next-line import/dynamic-import-chunkname
 vi.mock('yocto-spinner', () => import('../../../tests/mocks/spinner'));
+vi.mock('./build', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('./build')>();
+
+  return { ...actual, buildCatalystProject: vi.fn() };
+});
+
+// Default to a transformed project so the deploy flow's transformation guard
+// is a no-op for tests that don't care about it. Tests that exercise the
+// guard override this per-case via `vi.mocked(getProjectState).mockReturnValueOnce(...)`.
+vi.mock('../lib/project-state', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../lib/project-state')>();
+
+  return {
+    ...actual,
+    getProjectState: vi.fn(() => ({
+      projectUuid: 'mock-uuid',
+      hasMiddleware: true,
+      hasProxy: false,
+      hasOpenNextDep: true,
+      isLinked: true,
+      isTransformed: true,
+      isFullySetUp: true,
+    })),
+  };
+});
+
+vi.mock('../lib/commerce-hosting', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../lib/commerce-hosting')>();
+
+  return { ...actual, setupCommerceHosting: vi.fn() };
+});
+
+vi.mock('../lib/install-dependencies', () => ({
+  installDependencies: vi.fn(),
+}));
 
 let exitMock: MockInstance;
 
@@ -71,6 +118,9 @@ beforeAll(async () => {
 
 beforeEach(() => {
   process.chdir(tmpDir);
+  // Default the transformation-guard confirm to "yes" so tests that don't
+  // exercise it proceed past the guard.
+  vi.mocked(confirm).mockResolvedValue(true);
 });
 
 afterEach(() => {
@@ -92,10 +142,11 @@ test('properly configured Command instance', () => {
     expect.arrayContaining([
       expect.objectContaining({ flags: '--store-hash <hash>' }),
       expect.objectContaining({ flags: '--access-token <token>' }),
-      expect.objectContaining({ flags: '--api-host <host>', defaultValue: 'api.bigcommerce.com' }),
+      expect.objectContaining({ flags: '--api-host <host>' }),
       expect.objectContaining({ flags: '--project-uuid <uuid>' }),
-      expect.objectContaining({ flags: '--secret <secrets...>' }),
+      expect.objectContaining({ flags: '--secret <value>' }),
       expect.objectContaining({ flags: '--dry-run' }),
+      expect.objectContaining({ flags: '--prebuilt' }),
     ]),
   );
 });
@@ -268,7 +319,9 @@ describe('deployment and event streaming', () => {
 
     await expect(
       getDeploymentStatus(deploymentUuid, storeHash, accessToken, apiHost),
-    ).rejects.toThrow('Deployment failed with error code: 30');
+    ).rejects.toThrow(
+      'Deployment failed (error code 30): Your bundle could not be extracted. This may mean your build output is too large (max 64 MB compressed / 512 MB uncompressed) or the archive is corrupted. Try reducing your build size or rebuilding your project and deploying again.',
+    );
 
     expect(consola.info).toHaveBeenCalledWith('Fetching deployment status...');
 
@@ -276,6 +329,127 @@ describe('deployment and event streaming', () => {
   });
 });
 
+describe('linked project verification', () => {
+  test('proceeds when the linked project still exists on the server', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--dry-run',
+    ]);
+
+    expect(consola.info).not.toHaveBeenCalledWith('No project is currently linked.');
+    expect(consola.warn).not.toHaveBeenCalledWith(expect.stringContaining('no longer exists'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts for a new project when the linked uuid no longer exists', async () => {
+    const config = getProjectConfig();
+    const staleUuid = '00000000-0000-0000-0000-000000000000';
+
+    config.set('projectUuid', staleUuid);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    // The project picker is a select that returns the chosen project UUID.
+    vi.mocked(select).mockResolvedValue(projectUuid);
+
+    await program.parseAsync(['node', 'catalyst', 'deploy', '--dry-run']);
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining(`The linked project (${staleUuid}) no longer exists`),
+    );
+    expect(consola.success).toHaveBeenCalledWith('Linked project "Project One".');
+    expect(config.get('projectUuid')).toBe(projectUuid);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts for a project when none is linked yet', async () => {
+    const config = getProjectConfig();
+
+    config.delete('projectUuid');
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    // The project picker is a select that returns the chosen project UUID.
+    vi.mocked(select).mockResolvedValue(projectUuid);
+
+    await program.parseAsync(['node', 'catalyst', 'deploy', '--dry-run']);
+
+    expect(consola.info).toHaveBeenCalledWith('No project is currently linked.');
+    expect(consola.success).toHaveBeenCalledWith('Linked project "Project One".');
+    expect(config.get('projectUuid')).toBe(projectUuid);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('offers to create when no projects exist on the store', async () => {
+    const config = getProjectConfig();
+
+    config.delete('projectUuid');
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    // No projects exist → a confirm ("create one?") then an input (project name).
+    // The transformation-guard confirm defaults to true via beforeEach.
+    vi.mocked(input).mockResolvedValue('My New Project');
+
+    await program.parseAsync(['node', 'catalyst', 'deploy', '--dry-run']);
+
+    expect(confirm).toHaveBeenCalledWith(
+      expect.objectContaining({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        message: expect.stringContaining(
+          'There are not any hosting projects that you can link to yet',
+        ),
+      }),
+    );
+    expect(input).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Enter a name for the new project:' }),
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('exits gracefully with guidance when user declines to create', async () => {
+    const config = getProjectConfig();
+
+    config.delete('projectUuid');
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    // Declining the "create one?" confirm throws NoLinkedProjectError.
+    vi.mocked(confirm).mockResolvedValue(false);
+
+    await expect(program.parseAsync(['node', 'catalyst', 'deploy', '--dry-run'])).rejects.toThrow(
+      'No infrastructure project linked',
+    );
+
+    expect(consola.info).toHaveBeenCalledWith(
+      "When you're ready to create a project, run `catalyst project create` or re-run `catalyst deploy`.",
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+});
+
 test('--dry-run skips upload and deployment', async () => {
   await program.parseAsync([
     'node',
@@ -304,6 +478,118 @@ test('--dry-run skips upload and deployment', async () => {
   expect(exitMock).toHaveBeenCalledWith(0);
 });
 
+test('passes --wrangler-version through to the build', async () => {
+  await program.parseAsync([
+    'node',
+    'catalyst',
+    'deploy',
+    '--store-hash',
+    storeHash,
+    '--access-token',
+    accessToken,
+    '--api-host',
+    apiHost,
+    '--project-uuid',
+    projectUuid,
+    '--wrangler-version',
+    '4.24.3',
+    '--dry-run',
+  ]);
+
+  expect(buildCatalystProject).toHaveBeenCalledWith(projectUuid, '4.24.3');
+});
+
+test('builds with the default Wrangler version when --wrangler-version is omitted', async () => {
+  await program.parseAsync([
+    'node',
+    'catalyst',
+    'deploy',
+    '--store-hash',
+    storeHash,
+    '--access-token',
+    accessToken,
+    '--api-host',
+    apiHost,
+    '--project-uuid',
+    projectUuid,
+    '--dry-run',
+  ]);
+
+  expect(buildCatalystProject).toHaveBeenCalledWith(projectUuid, undefined);
+});
+
+test('rejects an invalid --wrangler-version value', async () => {
+  await expect(
+    program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      projectUuid,
+      '--wrangler-version',
+      'foo; rm -rf /',
+    ]),
+  ).rejects.toThrow(/not a valid Wrangler version/);
+
+  expect(buildCatalystProject).not.toHaveBeenCalled();
+});
+
+test('--dry-run uses storeHash and accessToken from .bigcommerce/project.json when not provided', async () => {
+  const config = getProjectConfig();
+
+  config.set('projectUuid', projectUuid);
+  config.set('storeHash', storeHash);
+  config.set('accessToken', accessToken);
+
+  await program.parseAsync(['node', 'catalyst', 'deploy', '--dry-run']);
+
+  expect(consola.info).toHaveBeenCalledWith('Generating bundle...');
+  expect(consola.success).toHaveBeenCalledWith(`Bundle created at: ${outputZip}`);
+  expect(exitMock).toHaveBeenCalledWith(0);
+});
+
+test('errors when store hash is missing and not in .bigcommerce/project.json', async () => {
+  const config = getProjectConfig();
+
+  config.set('projectUuid', projectUuid);
+  config.set('accessToken', accessToken);
+  config.delete('storeHash');
+
+  vi.stubEnv('CATALYST_STORE_HASH', undefined);
+
+  await expect(program.parseAsync(['node', 'catalyst', 'deploy'])).rejects.toThrow(
+    'Missing credentials',
+  );
+
+  expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+  expect(exitMock).toHaveBeenCalledWith(1);
+
+  vi.unstubAllEnvs();
+});
+
+test('errors when access token is missing and not in .bigcommerce/project.json', async () => {
+  const config = getProjectConfig();
+
+  config.set('projectUuid', projectUuid);
+  config.set('storeHash', storeHash);
+  config.delete('accessToken');
+
+  vi.stubEnv('CATALYST_ACCESS_TOKEN', undefined);
+
+  await expect(program.parseAsync(['node', 'catalyst', 'deploy'])).rejects.toThrow(
+    'Missing credentials',
+  );
+
+  expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+  expect(exitMock).toHaveBeenCalledWith(1);
+
+  vi.unstubAllEnvs();
+});
+
 test('reads from env options', () => {
   const envVariables = parseEnvironmentVariables([
     'BIGCOMMERCE_STORE_HASH=123',
@@ -324,6 +610,405 @@ test('reads from env options', () => {
   ]);
 
   expect(() => parseEnvironmentVariables(['foo_bar'])).toThrow(
-    'Invalid secret format: foo_bar. Expected format: KEY=VALUE',
+    'Invalid env var format: foo_bar. Expected format: KEY=VALUE',
   );
 });
+
+test('splits secrets on the first = so values containing = survive', () => {
+  const envVariables = parseEnvironmentVariables(['TOKEN=abc=def==']);
+
+  expect(envVariables).toEqual([{ type: 'secret', key: 'TOKEN', value: 'abc=def==' }]);
+});
+
+describe('persisted env vars', () => {
+  interface DeploymentBody {
+    environment_variables?: Array<{ type: string; key: string; value: string }>;
+  }
+
+  test('sends stored env vars and lets inline --secret override the same key', async () => {
+    const config = getProjectConfig();
+
+    config.set('projectUuid', projectUuid);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+    config.set('env', { PERSISTED_ONLY: 'keep', SHARED: 'stored' });
+
+    let body: DeploymentBody | undefined;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/deployments',
+        async ({ request }) => {
+          // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+          body = (await request.json()) as DeploymentBody;
+
+          return HttpResponse.json({ data: { deployment_uuid: deploymentUuid } });
+        },
+      ),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--api-host',
+      apiHost,
+      '--prebuilt',
+      '--secret',
+      'SHARED=override',
+      '--secret',
+      'FLAG_ONLY=flag',
+    ]);
+
+    expect(body?.environment_variables).toEqual(
+      expect.arrayContaining([
+        { type: 'secret', key: 'PERSISTED_ONLY', value: 'keep' },
+        { type: 'secret', key: 'SHARED', value: 'override' },
+        { type: 'secret', key: 'FLAG_ONLY', value: 'flag' },
+      ]),
+    );
+    // The shared key is sent once, with the inline flag value winning.
+    expect(body?.environment_variables?.filter((e) => e.key === 'SHARED')).toHaveLength(1);
+
+    config.delete('env');
+  });
+
+  test('omits environment_variables when nothing is stored or passed', async () => {
+    const config = getProjectConfig();
+
+    config.set('projectUuid', projectUuid);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+    config.delete('env');
+
+    let body: DeploymentBody | undefined;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/deployments',
+        async ({ request }) => {
+          // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+          body = (await request.json()) as DeploymentBody;
+
+          return HttpResponse.json({ data: { deployment_uuid: deploymentUuid } });
+        },
+      ),
+    );
+
+    await program.parseAsync(['node', 'catalyst', 'deploy', '--api-host', apiHost, '--prebuilt']);
+
+    expect(body?.environment_variables).toBeUndefined();
+  });
+});
+
+describe('--prebuilt flag', () => {
+  test('skips build step when --prebuilt is passed', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--prebuilt',
+      '--dry-run',
+    ]);
+
+    expect(buildCatalystProject).not.toHaveBeenCalled();
+    expect(consola.info).toHaveBeenCalledWith('Using existing build output (--prebuilt).');
+    expect(consola.info).toHaveBeenCalledWith('Generating bundle...');
+  });
+
+  test('fails when dist directory is missing', async () => {
+    const [missingDistDir, missingDistCleanup] = await mkTempDir();
+    const resolvedDir = await realpath(missingDistDir);
+
+    process.chdir(resolvedDir);
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'deploy',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--api-host',
+        apiHost,
+        '--project-uuid',
+        projectUuid,
+        '--prebuilt',
+      ]),
+    ).rejects.toThrow(
+      'No build output found at .bigcommerce/dist/. Run `catalyst build` first or remove `--prebuilt` to build automatically.',
+    );
+
+    process.chdir(tmpDir);
+    await missingDistCleanup();
+  });
+
+  test('fails when dist directory is empty', async () => {
+    const [emptyDistDir, emptyDistCleanup] = await mkTempDir();
+    const resolvedDir = await realpath(emptyDistDir);
+
+    await mkdir(join(resolvedDir, '.bigcommerce', 'dist'), { recursive: true });
+
+    process.chdir(resolvedDir);
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'deploy',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+        '--api-host',
+        apiHost,
+        '--project-uuid',
+        projectUuid,
+        '--prebuilt',
+      ]),
+    ).rejects.toThrow(
+      'No build output found at .bigcommerce/dist/. Run `catalyst build` first or remove `--prebuilt` to build automatically.',
+    );
+
+    process.chdir(tmpDir);
+    await rm(join(resolvedDir, '.bigcommerce'), { recursive: true });
+    await emptyDistCleanup();
+  });
+});
+
+describe('transformation guard', () => {
+  const untransformedState = {
+    projectUuid: undefined,
+    hasMiddleware: false,
+    hasProxy: true,
+    hasOpenNextDep: false,
+    isLinked: false,
+    isTransformed: false,
+    isFullySetUp: false,
+  };
+
+  test('runs setupCommerceHosting + installDependencies when project is not transformed', async () => {
+    vi.mocked(getProjectState).mockReturnValueOnce(untransformedState);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--prebuilt',
+      '--dry-run',
+    ]);
+
+    expect(confirm).toHaveBeenCalledWith(
+      expect.objectContaining({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        message: expect.stringContaining('not yet set up for Commerce Hosting deployments'),
+      }),
+    );
+    expect(setupCommerceHosting).toHaveBeenCalledWith({
+      projectDir: tmpDir,
+      projectUuid,
+      storeHash,
+      accessToken,
+    });
+    expect(installDependencies).toHaveBeenCalledWith(tmpDir, expect.any(String));
+  });
+
+  test('exits gracefully when user declines to run setup', async () => {
+    vi.mocked(getProjectState).mockReturnValueOnce(untransformedState);
+    vi.mocked(confirm).mockResolvedValueOnce(false);
+
+    // In production, process.exit halts. In tests it's mocked, so we can only
+    // verify the user-visible signals: the guidance log and the exit code.
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--prebuilt',
+      '--dry-run',
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith(
+      "When you're ready to deploy, re-run `catalyst deploy` to complete setup.",
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('skips setup when project is already transformed', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--prebuilt',
+      '--dry-run',
+    ]);
+
+    expect(setupCommerceHosting).not.toHaveBeenCalled();
+    expect(installDependencies).not.toHaveBeenCalled();
+  });
+});
+
+describe('--update-site-url', () => {
+  function deployArgs(extra: string[] = []) {
+    return [
+      'node',
+      'catalyst',
+      'deploy',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--api-host',
+      apiHost,
+      '--project-uuid',
+      projectUuid,
+      '--prebuilt',
+      ...extra,
+    ];
+  }
+
+  test('triggers the interactive flow and PUTs the chosen hostname after deploy', async () => {
+    let putBody: unknown;
+    let putChannelId: string | undefined;
+
+    server.use(
+      http.put(
+        'https://:apiHost/stores/:storeHash/v3/channels/:channelId/site',
+        async ({ request, params }) => {
+          putBody = await request.json();
+          putChannelId = String(params.channelId);
+
+          return HttpResponse.json({
+            data: {
+              id: 1,
+              url: 'https://project-one.catalyst-sandbox.store',
+              channel_id: 2,
+            },
+          });
+        },
+      ),
+    );
+
+    // The interactive flow asks two selects in order: the channel (returns the
+    // numeric channel id) then the hostname (returns the hostname string).
+    vi.mocked(select)
+      .mockResolvedValueOnce(2)
+      .mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await program.parseAsync(deployArgs(['--update-site-url']));
+
+    expect(putChannelId).toBe('2');
+    expect(putBody).toEqual({ url: 'https://project-one.catalyst-sandbox.store' });
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Updated channel "Catalyst Storefront" (2) site URL'),
+    );
+  });
+
+  test('places the freshly-deployed hostname first in the hostname prompt', async () => {
+    let hostnameChoices: Array<{ name: string; value: string }> | undefined;
+
+    // Project Two has no hostnames by default; use Project One whose handler
+    // already returns the two seeded hostnames. Inject the freshly-deployed
+    // hostname into Project One's list so preferHostname has something to match.
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({
+          data: [
+            {
+              uuid: projectUuid,
+              name: 'Project One',
+              deployment_hostnames: [
+                'project-one.catalyst-sandbox.store',
+                'example.com', // the just-deployed hostname (per the SSE default)
+              ],
+            },
+          ],
+        }),
+      ),
+    );
+
+    vi.mocked(select)
+      .mockResolvedValueOnce(2) // channel
+      .mockImplementationOnce((config) => {
+        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+        const cfg = config as unknown as { choices: Array<{ name: string; value: string }> };
+
+        hostnameChoices = cfg.choices;
+
+        return Object.assign(Promise.resolve('example.com'), { cancel: () => undefined });
+      });
+
+    await program.parseAsync(deployArgs(['--update-site-url']));
+
+    expect(hostnameChoices?.[0]).toMatchObject({ value: 'example.com' });
+  });
+
+  test('does not call the channel site API when the flag is omitted', async () => {
+    let putCalled = false;
+
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () => {
+        putCalled = true;
+
+        return HttpResponse.json({}, { status: 200 });
+      }),
+    );
+
+    await program.parseAsync(deployArgs());
+
+    expect(putCalled).toBe(false);
+    expect(consola.success).not.toHaveBeenCalledWith(expect.stringContaining('Updated channel'));
+  });
+
+  test('soft-fails with a warning when the update API returns an error', async () => {
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+        HttpResponse.json({}, { status: 401 }),
+      ),
+    );
+
+    vi.mocked(select)
+      .mockResolvedValueOnce(2)
+      .mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await program.parseAsync(deployArgs(['--update-site-url']));
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Failed to update channel site URL'),
+    );
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('catalyst auth login'));
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/deploy.ts b/packages/catalyst/src/cli/commands/deploy.ts
index eee50458f6..cc5f82071a 100644
--- a/packages/catalyst/src/cli/commands/deploy.ts
+++ b/packages/catalyst/src/cli/commands/deploy.ts
@@ -1,15 +1,46 @@
+import { confirm } from '@inquirer/prompts';
 import AdmZip from 'adm-zip';
 import { Command, Option } from 'commander';
+import { colorize } from 'consola/utils';
 import { access, readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import yoctoSpinner from 'yocto-spinner';
 import { z } from 'zod';
 
+import { assertAuthorized } from '../lib/auth-errors';
+import { loadBuildEnv } from '../lib/build-env';
+import { runChannelSiteUrlFlow } from '../lib/channel-site-flow';
+import {
+  cleanupCloudflareIncompatibilities,
+  NoLinkedProjectError,
+  selectOrCreateInfrastructureProject,
+  setupCommerceHosting,
+} from '../lib/commerce-hosting';
+import { getDeploymentErrorMessage } from '../lib/deployment-errors';
+import { detectProjectPackageManager } from '../lib/detect-package-manager';
+import {
+  getStoredEnv,
+  mergeDeploymentSecrets,
+  parseEnvAssignment,
+  toDeploymentSecrets,
+} from '../lib/env-config';
+import { httpError } from '../lib/http-errors';
+import { installDependencies } from '../lib/install-dependencies';
 import { consola } from '../lib/logger';
 import { getProjectConfig } from '../lib/project-config';
-import { Telemetry } from '../lib/telemetry';
-
-const telemetry = new Telemetry();
+import { getProjectState } from '../lib/project-state';
+import { resolveCredentials } from '../lib/resolve-credentials';
+import {
+  accessTokenOption,
+  apiHostOption,
+  envPathOption,
+  projectUuidOption,
+  resolveApiHost,
+  storeHashOption,
+} from '../lib/shared-options';
+import { getTelemetry } from '../lib/telemetry';
+
+import { buildCatalystProject, parseWranglerVersion, WRANGLER_VERSION } from './build';
 
 const stepsEnum = z.enum([
   'initializing',
@@ -44,6 +75,15 @@ const CreateDeploymentSchema = z.object({
   }),
 });
 
+const ProjectSchema = z.object({
+  data: z.array(
+    z.object({
+      uuid: z.uuid(),
+      name: z.string(),
+    }),
+  ),
+});
+
 const DeploymentStatusSchema = z.object({
   deployment_uuid: z.uuid(),
   deployment_status: z.enum(['queued', 'in_progress', 'failed', 'completed']),
@@ -53,6 +93,7 @@ const DeploymentStatusSchema = z.object({
       progress: z.number(),
     })
     .nullable(),
+  deployment_hostnames: z.array(z.string()).optional(),
   error: z
     .object({
       code: z.number(),
@@ -106,13 +147,16 @@ export const generateUploadSignature = async (
         'X-Auth-Token': accessToken,
         'Content-Type': 'application/json',
         Accept: 'application/json',
+        'X-Correlation-Id': getTelemetry().correlationId,
       },
       body: JSON.stringify({}),
     },
   );
 
+  assertAuthorized(response);
+
   if (!response.ok) {
-    throw new Error(`Failed to fetch upload signature: ${response.status} ${response.statusText}`);
+    throw await httpError(response, 'Failed to generate upload signature');
   }
 
   const res: unknown = await response.json();
@@ -140,7 +184,7 @@ export const uploadBundleZip = async (uploadUrl: string) => {
   });
 
   if (!response.ok) {
-    throw new Error(`Failed to upload bundle: ${response.status} ${response.statusText}`);
+    throw await httpError(response, 'Failed to upload bundle');
   }
 
   consola.success('Bundle uploaded successfully.');
@@ -150,16 +194,12 @@ export const uploadBundleZip = async (uploadUrl: string) => {
 
 export const parseEnvironmentVariables = (secretOption?: string[]) => {
   return secretOption?.map((envVar) => {
-    const [key, value] = envVar.split('=');
-
-    if (!key || !value) {
-      throw new Error(`Invalid secret format: ${envVar}. Expected format: KEY=VALUE`);
-    }
+    const { key, value } = parseEnvAssignment(envVar);
 
     return {
       type: 'secret' as const,
-      key: key.trim(),
-      value: value.trim(),
+      key,
+      value,
     };
   });
 };
@@ -182,6 +222,7 @@ export const createDeployment = async (
         'X-Auth-Token': accessToken,
         'Content-Type': 'application/json',
         Accept: 'application/json',
+        'X-Correlation-Id': getTelemetry().correlationId,
       },
       body: JSON.stringify({
         project_uuid: projectUuid,
@@ -191,8 +232,10 @@ export const createDeployment = async (
     },
   );
 
+  assertAuthorized(response);
+
   if (!response.ok) {
-    throw new Error(`Failed to create deployment: ${response.status} ${response.statusText}`);
+    throw await httpError(response, 'Failed to create deployment');
   }
 
   const res: unknown = await response.json();
@@ -208,7 +251,7 @@ export const getDeploymentStatus = async (
   storeHash: string,
   accessToken: string,
   apiHost: string,
-) => {
+): Promise<string | undefined> => {
   consola.info('Fetching deployment status...');
 
   const spinner = yoctoSpinner().start('Fetching...');
@@ -221,12 +264,15 @@ export const getDeploymentStatus = async (
         'X-Auth-Token': accessToken,
         Accept: 'text/event-stream',
         Connection: 'keep-alive',
+        'X-Correlation-Id': getTelemetry().correlationId,
       },
     },
   );
 
+  assertAuthorized(response);
+
   if (!response.ok) {
-    throw new Error(`Failed to open event stream: ${response.status} ${response.statusText}`);
+    throw await httpError(response, 'Failed to open deployment event stream');
   }
 
   const reader = response.body?.getReader();
@@ -237,6 +283,7 @@ export const getDeploymentStatus = async (
 
   const decoder = new TextDecoder();
   let done = false;
+  let deploymentHostname: string | undefined;
 
   while (!done) {
     // eslint-disable-next-line no-await-in-loop
@@ -250,6 +297,7 @@ export const getDeploymentStatus = async (
         .map((s) => s.replace('data:', '').trim())
         .filter(Boolean);
 
+      // eslint-disable-next-line no-loop-func
       split.forEach((event) => {
         try {
           json = JSON.parse(event);
@@ -262,12 +310,18 @@ export const getDeploymentStatus = async (
         const data = DeploymentStatusSchema.parse(json);
 
         if (data.error) {
-          throw new Error(`Deployment failed with error code: ${data.error.code}`);
+          throw new Error(
+            `Deployment failed (error code ${data.error.code}): ${getDeploymentErrorMessage(data.error.code)}`,
+          );
         }
 
         if (data.event && STEPS[data.event.step] !== spinner.text) {
           spinner.text = STEPS[data.event.step];
         }
+
+        if (data.deployment_hostnames && data.deployment_hostnames.length > 0) {
+          deploymentHostname = data.deployment_hostnames[0];
+        }
       });
     }
 
@@ -275,98 +329,271 @@ export const getDeploymentStatus = async (
   }
 
   spinner.success('Deployment completed successfully.');
+
+  if (deploymentHostname) {
+    consola.success(
+      `View your deployment at: ${colorize('blue', `https://${deploymentHostname}`)}`,
+    );
+  }
+
+  return deploymentHostname;
+};
+
+export const fetchProject = async (
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+) => {
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/infrastructure/projects`,
+    {
+      method: 'GET',
+      headers: {
+        'X-Auth-Token': accessToken,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        'X-Correlation-Id': getTelemetry().correlationId,
+      },
+    },
+  );
+
+  assertAuthorized(response);
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to fetch projects');
+  }
+
+  const res: unknown = await response.json();
+  const { data } = ProjectSchema.parse(res);
+
+  return data.find((project) => project.uuid === projectUuid);
 };
 
 export const deploy = new Command('deploy')
+  .configureHelp({ showGlobalOptions: true })
   .description('Deploy your application to Cloudflare.')
-  .addOption(
-    new Option(
-      '--store-hash <hash>',
-      'BigCommerce store hash. Can be found in the URL of your store Control Panel.',
-    )
-      .env('BIGCOMMERCE_STORE_HASH')
-      .makeOptionMandatory(),
+  .addHelpText(
+    'after',
+    `
+Environment variables saved with \`catalyst env add\` are sent automatically on every deploy.
+Use \`--secret\` to set or override a variable for a single run.
+
+Example:
+  $ catalyst deploy --secret BIGCOMMERCE_STORE_HASH=<YOUR_STORE_HASH> --secret BIGCOMMERCE_STOREFRONT_TOKEN=<YOUR_STOREFRONT_TOKEN>`,
   )
-  .addOption(
-    new Option(
-      '--access-token <token>',
-      'BigCommerce access token. Can be found after creating a store-level API account.',
-    )
-      .env('BIGCOMMERCE_ACCESS_TOKEN')
-      .makeOptionMandatory(),
-  )
-  .addOption(
-    new Option('--api-host <host>', 'BigCommerce API host. The default is api.bigcommerce.com.')
-      .env('BIGCOMMERCE_API_HOST')
-      .default('api.bigcommerce.com'),
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option(
+    '--update-site-url',
+    "After a successful deploy, prompt to update a channel's site URL to the new hostname.",
   )
   .addOption(
     new Option(
-      '--project-uuid <uuid>',
-      'BigCommerce intrastructure project UUID. Can be found via the BigCommerce API (GET /v3/infrastructure/projects).',
-    ).env('BIGCOMMERCE_PROJECT_UUID'),
+      '--secret <value>',
+      'Secret to set for this deployment (repeatable). Overrides a stored value for the same key. Format: --secret KEY=VALUE',
+    ).argParser((value: string, previous: string[] = []) => {
+      return previous.concat([value]);
+    }),
+  )
+  .option('--dry-run', 'Run the command to generate the bundle without uploading or deploying.')
+  .option(
+    '--prebuilt',
+    'Skip the build step. Requires .bigcommerce/dist/ to already contain build output.',
   )
   .addOption(
     new Option(
-      '--secret <secrets...>',
-      'Secrets to set for the deployment. Format: SECRET_1=FOO SECRET_2=BAR',
-    ),
+      '--wrangler-version <version>',
+      `Wrangler version or dist-tag to build with. Ignored with --prebuilt. Defaults to ${WRANGLER_VERSION}.`,
+    ).argParser(parseWranglerVersion),
   )
-  .option('--dry-run', 'Run the command to generate the bundle without uploading or deploying.')
-
+  .addOption(envPathOption())
   .action(async (options) => {
-    try {
-      const config = getProjectConfig();
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+    const { storeHash, accessToken } = resolveCredentials(options, config);
+    const telemetry = getTelemetry();
+
+    await telemetry.identify(storeHash);
+
+    // Resolve a *valid* projectUuid before doing any expensive build/upload
+    // work. If the linked UUID no longer exists on the server (e.g. project
+    // deleted out from under us), prompt the user to pick a new one rather
+    // than failing mid-deploy.
+    const linkedProjectUuid = options.projectUuid ?? config.get('projectUuid');
+    let projectUuid: string;
+
+    const promptForProject = async (): Promise<{ uuid: string; name: string }> => {
+      try {
+        return await selectOrCreateInfrastructureProject({
+          storeHash,
+          accessToken,
+          apiHost,
+        });
+      } catch (error) {
+        if (error instanceof NoLinkedProjectError) {
+          consola.info(
+            "When you're ready to create a project, run `catalyst project create` or re-run `catalyst deploy`.",
+          );
+          process.exit(0);
+        }
 
-      await telemetry.identify(options.storeHash);
+        throw error;
+      }
+    };
 
-      const projectUuid = options.projectUuid ?? config.get('projectUuid');
+    if (linkedProjectUuid) {
+      const existing = await fetchProject(linkedProjectUuid, storeHash, accessToken, apiHost);
 
-      if (!projectUuid) {
-        throw new Error(
-          'Project UUID is required. Please run either `catalyst project link` or `catalyst project create` or this command again with --project-uuid <uuid>.',
+      if (existing) {
+        projectUuid = linkedProjectUuid;
+      } else {
+        consola.warn(
+          `The linked project (${linkedProjectUuid}) no longer exists on this store. It may have been deleted.`,
         );
+
+        const selected = await promptForProject();
+
+        projectUuid = selected.uuid;
+        config.set('projectUuid', projectUuid);
+        consola.success(`Linked project "${selected.name}".`);
       }
+    } else {
+      consola.info('No project is currently linked.');
 
-      await generateBundleZip();
+      const selected = await promptForProject();
 
-      if (options.dryRun) {
-        consola.info('Dry run enabled — skipping upload and deployment steps.');
-        consola.info('Next steps (skipped):');
-        consola.info('- Generate upload signature');
-        consola.info('- Upload bundle.zip');
-        consola.info('- Create deployment');
+      projectUuid = selected.uuid;
+      config.set('projectUuid', projectUuid);
+      consola.success(`Linked project "${selected.name}".`);
+    }
 
+    // The OpenNext build pipeline requires the project to be transformed
+    // (proxy.ts → middleware.ts, @opennextjs/cloudflare installed). Run setup
+    // here so first-run `catalyst deploy` works on a fresh self-hosted scaffold
+    // without forcing the user to re-run after a separate setup step.
+    if (!getProjectState().isTransformed) {
+      const shouldSetup = await confirm({
+        message:
+          'Your project is not yet set up for Commerce Hosting deployments. Would you like to run the Commerce Hosting setup now?',
+        default: true,
+      });
+
+      if (!shouldSetup) {
+        consola.info("When you're ready to deploy, re-run `catalyst deploy` to complete setup.");
         process.exit(0);
       }
 
-      const uploadSignature = await generateUploadSignature(
-        options.storeHash,
-        options.accessToken,
-        options.apiHost,
-      );
+      const projectDir = process.cwd();
+
+      await setupCommerceHosting({ projectDir, projectUuid, storeHash, accessToken });
+      consola.success('Commerce Hosting setup complete.');
+
+      // Match the manager the project was scaffolded with (from its lockfile),
+      // rather than forcing pnpm on npm/yarn/bun projects.
+      const packageManager = await detectProjectPackageManager(projectDir);
+
+      await installDependencies(projectDir, packageManager);
+    } else {
+      // Existing Commerce Hosting users may carry artifacts incompatible with
+      // the Cloudflare worker bundle from earlier Catalyst versions
+      // (`core/instrumentation.ts`, `@vercel/otel`). Sweep them on every deploy
+      // so the fix lands without forcing a re-link.
+      await cleanupCloudflareIncompatibilities(process.cwd());
+    }
+
+    if (options.prebuilt) {
+      const distDir = join(process.cwd(), '.bigcommerce', 'dist');
 
-      await uploadBundleZip(uploadSignature.upload_url);
+      try {
+        await access(distDir);
+      } catch {
+        throw new Error(
+          'No build output found at .bigcommerce/dist/. Run `catalyst build` first or remove `--prebuilt` to build automatically.',
+        );
+      }
+
+      const contents = await readdir(distDir);
+
+      if (contents.length === 0) {
+        throw new Error(
+          'No build output found at .bigcommerce/dist/. Run `catalyst build` first or remove `--prebuilt` to build automatically.',
+        );
+      }
+
+      consola.info('Using existing build output (--prebuilt).');
+    } else {
+      // The build reads storefront env vars (BIGCOMMERCE_*). Load them from the
+      // env file(s) before building so both the build and any pre-build checks
+      // see them. Skipped for --prebuilt above, which doesn't run the build.
+      loadBuildEnv({ envPath: options.envPath });
+
+      await buildCatalystProject(projectUuid, options.wranglerVersion);
+    }
 
-      const environmentVariables = parseEnvironmentVariables(options.secret);
+    await generateBundleZip();
 
-      const { deployment_uuid: deploymentUuid } = await createDeployment(
+    if (options.dryRun) {
+      consola.info('Dry run enabled — skipping upload and deployment steps.');
+      consola.info('Next steps (skipped):');
+      consola.info('- Generate upload signature');
+      consola.info('- Upload bundle.zip');
+      consola.info('- Create deployment');
+
+      process.exit(0);
+    }
+
+    const uploadSignature = await generateUploadSignature(storeHash, accessToken, apiHost);
+
+    await uploadBundleZip(uploadSignature.upload_url);
+
+    // Merge persisted env vars (`catalyst env add`) with any inline `--secret`
+    // flags. Inline flags win on conflict, letting users override a stored
+    // value for a single run. Send `undefined` when there's nothing to set so
+    // we preserve the prior payload shape.
+    const flagSecrets = parseEnvironmentVariables(options.secret) ?? [];
+    const persistedSecrets = toDeploymentSecrets(getStoredEnv(config));
+    const mergedSecrets = mergeDeploymentSecrets(persistedSecrets, flagSecrets);
+    const environmentVariables = mergedSecrets.length > 0 ? mergedSecrets : undefined;
+
+    const { deployment_uuid: deploymentUuid } = await createDeployment(
+      projectUuid,
+      uploadSignature.upload_uuid,
+      storeHash,
+      accessToken,
+      apiHost,
+      environmentVariables,
+    );
+
+    const deploymentHostname = await getDeploymentStatus(
+      deploymentUuid,
+      storeHash,
+      accessToken,
+      apiHost,
+    );
+
+    if (!options.updateSiteUrl) {
+      return;
+    }
+
+    try {
+      await runChannelSiteUrlFlow({
+        storeHash,
+        accessToken,
+        apiHost,
         projectUuid,
-        uploadSignature.upload_uuid,
-        options.storeHash,
-        options.accessToken,
-        options.apiHost,
-        environmentVariables,
+        preferHostname: deploymentHostname,
+      });
+    } catch (error) {
+      // Soft-fail: the deploy already succeeded and the bundle is live. A
+      // non-zero exit here would be misleading.
+      consola.warn(
+        `Failed to update channel site URL: ${error instanceof Error ? error.message : String(error)}`,
       );
-
-      await getDeploymentStatus(
-        deploymentUuid,
-        options.storeHash,
-        options.accessToken,
-        options.apiHost,
+      consola.info(
+        'Update it manually in the control panel, or re-run `catalyst auth login` if the token is missing the store_channel_settings scope.',
       );
-    } catch (error) {
-      consola.error(error);
-      process.exit(1);
     }
   });
diff --git a/packages/catalyst/src/cli/commands/dev.spec.ts b/packages/catalyst/src/cli/commands/dev.spec.ts
deleted file mode 100644
index 17ce28951d..0000000000
--- a/packages/catalyst/src/cli/commands/dev.spec.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import { Command } from 'commander';
-import { execa } from 'execa';
-import { join } from 'node:path';
-import { expect, test, vi } from 'vitest';
-
-import { program } from '../program';
-
-import { dev } from './dev';
-
-vi.mock('node:fs', () => ({
-  existsSync: vi.fn(() => true),
-}));
-
-vi.mock('execa', () => ({
-  execa: vi.fn(() => Promise.resolve({ stdout: '' })),
-  __esModule: true,
-}));
-
-test('properly configured Command instance', () => {
-  expect(dev).toBeInstanceOf(Command);
-  expect(dev.name()).toBe('dev');
-  expect(dev.description()).toBe('Start the Catalyst development server.');
-});
-
-test('calls execa with Next.js development server', async () => {
-  await program.parseAsync(['node', 'catalyst', 'dev', '-p', '3001']);
-
-  expect(execa).toHaveBeenCalledWith(
-    join('node_modules', '.bin', 'next'),
-    ['dev', '-p', '3001'],
-    expect.objectContaining({
-      stdio: 'inherit',
-      cwd: process.cwd(),
-    }),
-  );
-});
diff --git a/packages/catalyst/src/cli/commands/dev.ts b/packages/catalyst/src/cli/commands/dev.ts
deleted file mode 100644
index 2d9119a24c..0000000000
--- a/packages/catalyst/src/cli/commands/dev.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import { Command } from 'commander';
-import { execa } from 'execa';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { consola } from '../lib/logger';
-
-export const dev = new Command('dev')
-  .description('Start the Catalyst development server.')
-  // Proxy `--help` to the underlying `next dev` command
-  .helpOption(false)
-  .allowUnknownOption(true)
-  // The unknown options end up in program.args, not in program.opts(). Commander does not take a guess at how to interpret the unknown options.
-  .argument(
-    '[options...]',
-    'Next.js `dev` options (see: https://nextjs.org/docs/app/api-reference/cli/next#next-dev-options)',
-  )
-  .action(async (options) => {
-    try {
-      const nextBin = join('node_modules', '.bin', 'next');
-
-      if (!existsSync(nextBin)) {
-        throw new Error(
-          `Next.js is not installed in ${process.cwd()}. Are you in a valid Next.js project?`,
-        );
-      }
-
-      await execa(nextBin, ['dev', ...options], {
-        stdio: 'inherit',
-        cwd: process.cwd(),
-      });
-    } catch (error) {
-      consola.error(error instanceof Error ? error.message : error);
-      process.exit(1);
-    }
-  });
diff --git a/packages/catalyst/src/cli/commands/domains.spec.ts b/packages/catalyst/src/cli/commands/domains.spec.ts
new file mode 100644
index 0000000000..38a60de7bb
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/domains.spec.ts
@@ -0,0 +1,1159 @@
+import { confirm, select } from '@inquirer/prompts';
+import { Command } from 'commander';
+import Conf from 'conf';
+import { http, HttpResponse } from 'msw';
+import { afterAll, afterEach, beforeAll, describe, expect, MockInstance, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+import {
+  claimDomain,
+  createDomain,
+  deleteDomain,
+  findDomain,
+  getDomain,
+  listDomains,
+  transferDomain,
+} from '../lib/domains';
+import { UserActionableError } from '../lib/errors';
+import { consola } from '../lib/logger';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig, ProjectConfigSchema } from '../lib/project-config';
+
+import { domains, formatDomain, formatDomainStatus, waitForDomainVerification } from './domains';
+
+vi.mock('@inquirer/prompts', () => ({
+  confirm: vi.fn(),
+  select: vi.fn(),
+}));
+
+const confirmMock = vi.mocked(confirm);
+const selectMock = vi.mocked(select);
+
+let exitMock: MockInstance;
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let config: Conf<ProjectConfigSchema>;
+
+const projectUuid = '6b202364-10f3-11f1-8bc7-fe9b9d8b14ab';
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+const apiHost = 'api.bigcommerce.com';
+const domain = 'www.example.com';
+
+function writeCredentials() {
+  config.set('storeHash', storeHash);
+  config.set('accessToken', accessToken);
+  config.set('projectUuid', projectUuid);
+}
+
+beforeAll(async () => {
+  process.env.CATALYST_TELEMETRY_DISABLED = '1';
+
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+
+  config = getProjectConfig();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  config.delete('storeHash');
+  config.delete('accessToken');
+  config.delete('projectUuid');
+});
+
+afterAll(async () => {
+  delete process.env.CATALYST_TELEMETRY_DISABLED;
+
+  vi.restoreAllMocks();
+  exitMock.mockRestore();
+
+  await cleanup();
+});
+
+describe('command configuration', () => {
+  test('domains has add, list, status, claim, transfer, and remove subcommands', () => {
+    expect(domains).toBeInstanceOf(Command);
+    expect(domains.name()).toBe('domains');
+    expect(domains.description()).toBe(
+      'Manage custom domains for the current Native Hosting project.',
+    );
+
+    const add = domains.commands.find((command) => command.name() === 'add');
+    const list = domains.commands.find((command) => command.name() === 'list');
+    const status = domains.commands.find((command) => command.name() === 'status');
+    const claim = domains.commands.find((command) => command.name() === 'claim');
+    const transfer = domains.commands.find((command) => command.name() === 'transfer');
+    const remove = domains.commands.find((command) => command.name() === 'remove');
+
+    expect(add).toBeDefined();
+    expect(add?.description()).toBe('Add a custom domain to the current Native Hosting project.');
+    expect(add?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--wait' }),
+      ]),
+    );
+
+    expect(list).toBeDefined();
+    expect(list?.description()).toBe('List custom domains for the current Native Hosting project.');
+    expect(list?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--domain <domain>' }),
+        expect.objectContaining({ flags: '--status <status>' }),
+      ]),
+    );
+
+    expect(status).toBeDefined();
+    expect(status?.description()).toBe(
+      'Show the status of a custom domain on the current Native Hosting project.',
+    );
+    expect(status?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--wait' }),
+      ]),
+    );
+
+    expect(claim).toBeDefined();
+    expect(claim?.description()).toBe(
+      'Claim a custom domain that is currently in use on another store.',
+    );
+    expect(claim?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--wait' }),
+      ]),
+    );
+
+    expect(transfer).toBeDefined();
+    expect(transfer?.description()).toBe(
+      'Transfer a custom domain to another project in the same store.',
+    );
+    expect(transfer?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--to-project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--wait' }),
+      ]),
+    );
+
+    expect(remove).toBeDefined();
+    expect(remove?.description()).toBe(
+      'Remove a custom domain from the current Native Hosting project.',
+    );
+    expect(remove?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--force' }),
+      ]),
+    );
+  });
+});
+
+describe('formatDomainStatus', () => {
+  test('formats known domain statuses', () => {
+    expect(formatDomainStatus('pending')).toContain('pending');
+    expect(formatDomainStatus('verified')).toContain('active');
+    expect(formatDomainStatus('failed')).toContain('failed');
+    expect(formatDomainStatus('unknown')).toContain('unknown');
+  });
+});
+
+describe('formatDomain', () => {
+  test('formats a domain line with the display status', () => {
+    expect(
+      formatDomain({
+        domain,
+        project_uuid: projectUuid,
+        verification_status: 'verified',
+      }),
+    ).toContain(`${domain} `);
+    expect(
+      formatDomain({
+        domain,
+        project_uuid: projectUuid,
+        verification_status: 'verified',
+      }),
+    ).toContain('active');
+  });
+});
+
+describe('domain API client', () => {
+  test('creates a domain with the expected request body', async () => {
+    let capturedBody: unknown;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        async ({ request }) => {
+          capturedBody = await request.json();
+
+          return HttpResponse.json(
+            {
+              data: {
+                domain,
+                project_uuid: projectUuid,
+                verification_status: 'pending',
+              },
+            },
+            { status: 201 },
+          );
+        },
+      ),
+    );
+
+    await expect(
+      createDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).resolves.toEqual({
+      domain,
+      project_uuid: projectUuid,
+      verification_status: 'pending',
+    });
+    expect(capturedBody).toEqual({ domain });
+  });
+
+  test('surfaces disabled API responses', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () => new HttpResponse(null, { status: 403 }),
+      ),
+    );
+
+    await expect(
+      createDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).rejects.toThrow('Infrastructure Domains API not enabled');
+  });
+
+  test('surfaces V3 validation errors', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () =>
+          HttpResponse.json(
+            {
+              title: 'Domain could not be added.',
+              errors: { domain: 'Enter a valid domain.' },
+            },
+            { status: 422 },
+          ),
+      ),
+    );
+
+    await expect(
+      createDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).rejects.toThrow('Domain could not be added. (domain: Enter a valid domain.)');
+  });
+
+  test('falls back to status text when a client error response is not a V3 body', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => new HttpResponse(null, { status: 400, statusText: 'Bad Request' }),
+      ),
+    );
+
+    await expect(getDomain(domain, projectUuid, storeHash, accessToken, apiHost)).rejects.toThrow(
+      'Failed to fetch domain: Bad Request',
+    );
+  });
+
+  test('adds status and correlation details for server errors', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () =>
+          HttpResponse.json(
+            {
+              status: 502,
+              title: 'Bad Gateway',
+              errors: {},
+            },
+            { status: 502, statusText: 'Bad Gateway' },
+          ),
+      ),
+    );
+
+    const error = await createDomain(domain, projectUuid, storeHash, accessToken, apiHost).catch(
+      (err: unknown) => err,
+    );
+
+    expect(error).toBeInstanceOf(Error);
+    // A 5xx is a server-side failure worth escalating, so it stays a plain Error
+    // and keeps the top-level Correlation ID + support framing.
+    expect(error).not.toBeInstanceOf(UserActionableError);
+    expect(error).toHaveProperty(
+      'message',
+      'Failed to add domain: 502 Bad Gateway. This is a server-side response from the Domains API.',
+    );
+  });
+
+  test('treats a 4xx conflict as user-actionable (no support/correlation framing)', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+        () =>
+          HttpResponse.json(
+            {
+              status: 409,
+              title:
+                'The domain is already bound to another project in this store. Use the transfer endpoint to move it.',
+              errors: {
+                domain: `'${domain}' is already bound to another project in this store.`,
+              },
+            },
+            { status: 409 },
+          ),
+      ),
+    );
+
+    const error = await claimDomain(domain, projectUuid, storeHash, accessToken, apiHost).catch(
+      (err: unknown) => err,
+    );
+
+    expect(error).toBeInstanceOf(UserActionableError);
+    expect(error).toHaveProperty(
+      'message',
+      expect.stringContaining('already bound to another project in this store'),
+    );
+  });
+
+  test('lists domains for a project', async () => {
+    await expect(listDomains(projectUuid, storeHash, accessToken, apiHost)).resolves.toEqual([
+      {
+        domain: 'www.example.com',
+        project_uuid: projectUuid,
+        verification_status: 'pending',
+      },
+      {
+        domain: 'shop.example.com',
+        project_uuid: projectUuid,
+        verification_status: 'verified',
+      },
+    ]);
+  });
+
+  test('passes list filters to the API', async () => {
+    let capturedSearchParams: URLSearchParams | undefined;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        ({ request }) => {
+          capturedSearchParams = new URL(request.url).searchParams;
+
+          return HttpResponse.json({
+            data: [
+              {
+                domain,
+                project_uuid: projectUuid,
+                verification_status: 'pending',
+              },
+            ],
+          });
+        },
+      ),
+    );
+
+    await expect(
+      listDomains(projectUuid, storeHash, accessToken, apiHost, {
+        domains: [domain],
+        verificationStatus: 'pending',
+      }),
+    ).resolves.toEqual([
+      {
+        domain,
+        project_uuid: projectUuid,
+        verification_status: 'pending',
+      },
+    ]);
+    expect(capturedSearchParams?.get('domain:in')).toBe(domain);
+    expect(capturedSearchParams?.get('verification_status')).toBe('pending');
+  });
+
+  test('deletes a domain', async () => {
+    let deletedDomain: string | readonly string[] | undefined;
+
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        ({ params }) => {
+          deletedDomain = params.domain;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    await expect(
+      deleteDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).resolves.toBeUndefined();
+    expect(deletedDomain).toBe(domain);
+  });
+
+  test('claims a domain', async () => {
+    let claimedDomain: string | readonly string[] | undefined;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+        ({ params }) => {
+          claimedDomain = params.domain;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    await expect(
+      claimDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).resolves.toBeUndefined();
+    expect(claimedDomain).toBe(domain);
+  });
+
+  test('transfers a domain with the destination project in the body', async () => {
+    const newProjectUuid = 'a23f5785-fd99-4a94-9fb3-945551623923';
+    let capturedBody: unknown;
+    let capturedSourceProject: string | readonly string[] | undefined;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+        async ({ request, params }) => {
+          capturedBody = await request.json();
+          capturedSourceProject = params.projectUuid;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    await expect(
+      transferDomain(domain, projectUuid, newProjectUuid, storeHash, accessToken, apiHost),
+    ).resolves.toBeUndefined();
+    expect(capturedSourceProject).toBe(projectUuid);
+    expect(capturedBody).toEqual({ new_project_uuid: newProjectUuid });
+  });
+
+  test('findDomain returns the domain when it exists on the project', async () => {
+    await expect(findDomain(domain, projectUuid, storeHash, accessToken, apiHost)).resolves.toEqual(
+      {
+        domain,
+        project_uuid: projectUuid,
+        verification_status: 'verified',
+      },
+    );
+  });
+
+  test('findDomain returns null when the domain is not on the project', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => new HttpResponse(null, { status: 404 }),
+      ),
+    );
+
+    await expect(
+      findDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).resolves.toBeNull();
+  });
+
+  test('findDomain still throws on non-404 errors', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => new HttpResponse(null, { status: 403 }),
+      ),
+    );
+
+    await expect(findDomain(domain, projectUuid, storeHash, accessToken, apiHost)).rejects.toThrow(
+      'Infrastructure Domains API not enabled',
+    );
+  });
+
+  test('surfaces the ownership-verification TXT record when a claim is not yet verified', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+        () =>
+          HttpResponse.json(
+            {
+              title: 'Domain ownership could not be verified.',
+              errors: {
+                domain: `No ownership verification TXT record was found at '_bigcommerce-verification.${domain}'. Add the record, then try again.`,
+              },
+              meta: {
+                ownership_verification: {
+                  type: 'TXT',
+                  name: `_bigcommerce-verification.${domain}`,
+                  value: 'bc-verify=019500e2933d70578e81090dd7240795',
+                },
+              },
+            },
+            { status: 422 },
+          ),
+      ),
+    );
+
+    await expect(
+      claimDomain(domain, projectUuid, storeHash, accessToken, apiHost),
+    ).rejects.toMatchObject({
+      name: 'DomainOwnershipVerificationError',
+      ownershipVerification: {
+        type: 'TXT',
+        name: `_bigcommerce-verification.${domain}`,
+        value: 'bc-verify=019500e2933d70578e81090dd7240795',
+      },
+    });
+  });
+});
+
+describe('waitForDomainVerification', () => {
+  test('returns immediately when the domain is already verified', async () => {
+    await expect(
+      waitForDomainVerification({
+        domain,
+        projectUuid,
+        storeHash,
+        accessToken,
+        apiHost,
+        intervalMs: 0,
+      }),
+    ).resolves.toEqual({
+      domain,
+      project_uuid: projectUuid,
+      verification_status: 'verified',
+    });
+  });
+
+  test('polls pending domains until they leave pending status', async () => {
+    let requests = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => {
+          requests += 1;
+
+          return HttpResponse.json({
+            data: {
+              domain,
+              project_uuid: projectUuid,
+              verification_status: requests === 1 ? 'pending' : 'failed',
+            },
+          });
+        },
+      ),
+    );
+
+    await expect(
+      waitForDomainVerification({
+        domain,
+        projectUuid,
+        storeHash,
+        accessToken,
+        apiHost,
+        intervalMs: 0,
+      }),
+    ).resolves.toEqual({
+      domain,
+      project_uuid: projectUuid,
+      verification_status: 'failed',
+    });
+    expect(requests).toBe(2);
+  });
+
+  test('returns the latest pending status after the timeout expires', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () =>
+          HttpResponse.json({
+            data: {
+              domain,
+              project_uuid: projectUuid,
+              verification_status: 'pending',
+            },
+          }),
+      ),
+    );
+
+    await expect(
+      waitForDomainVerification({
+        domain,
+        projectUuid,
+        storeHash,
+        accessToken,
+        apiHost,
+        timeoutMs: 0,
+      }),
+    ).resolves.toEqual({
+      domain,
+      project_uuid: projectUuid,
+      verification_status: 'pending',
+    });
+  });
+});
+
+describe('add command', () => {
+  test('adds a domain to the linked project', async () => {
+    writeCredentials();
+
+    await domains.parseAsync(['add', domain], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Adding domain ${domain}...`);
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} added.`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining(domain));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('pending'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('can wait for domain verification after adding', async () => {
+    writeCredentials();
+
+    await domains.parseAsync(['add', domain, '--wait'], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Waiting for ${domain} to verify...`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+  });
+
+  test('surfaces the ownership TXT record and claim guidance on a cross-store collision', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () =>
+          HttpResponse.json(
+            {
+              title:
+                'The domain is already bound to a different store. Verify ownership using the claim endpoint, then try again.',
+              errors: {
+                domain: `'${domain}' is already bound to a different store; verify ownership, then try again.`,
+              },
+              meta: {
+                ownership_verification: {
+                  type: 'TXT',
+                  name: `_bigcommerce-verification.${domain}`,
+                  value: 'bc-verify=019500e2933d70578e81090dd7240795',
+                },
+              },
+            },
+            { status: 409 },
+          ),
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['add', domain], { from: 'user' });
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining('already in use on another store'),
+    );
+    expect(consola.log).toHaveBeenCalledWith(
+      expect.stringContaining('bc-verify=019500e2933d70578e81090dd7240795'),
+    );
+    expect(consola.info).toHaveBeenCalledWith('Once the record is live, claim it with:');
+    expect(consola.log).toHaveBeenCalledWith(`  catalyst domains claim ${domain}`);
+    // The raw V3 title/field text isn't echoed — the concise message replaces it.
+    expect(consola.warn).not.toHaveBeenCalledWith(
+      expect.stringContaining('Verify ownership using the claim endpoint'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('suggests the transfer command when the domain is bound to another project in the store', async () => {
+    const boundProjectUuid = 'b23f5785-fd99-4a94-9fb3-945551623924';
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () =>
+          HttpResponse.json(
+            {
+              title:
+                'The domain is already bound to another project in this store. Use the transfer endpoint to move it.',
+              errors: {
+                domain: `'${domain}' is already bound to another project in this store.`,
+              },
+              meta: { project_uuid: boundProjectUuid },
+            },
+            { status: 409 },
+          ),
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['add', domain], { from: 'user' });
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining('already bound to another project in this store'),
+    );
+    expect(consola.info).toHaveBeenCalledWith('To move it to this project, run:');
+    expect(consola.log).toHaveBeenCalledWith(
+      `  catalyst domains transfer ${domain} --project-uuid ${boundProjectUuid} --to-project-uuid ${projectUuid}`,
+    );
+    // The raw V3 title/field text isn't echoed — the concise message + suggestion replace it.
+    expect(consola.warn).not.toHaveBeenCalledWith(
+      expect.stringContaining('Use the transfer endpoint to move it'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
+
+describe('list command', () => {
+  test('lists domains for the linked project', async () => {
+    writeCredentials();
+
+    await domains.parseAsync(['list'], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith('Fetching domains...');
+    expect(consola.success).toHaveBeenCalledWith('Domains fetched.');
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('www.example.com'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('pending'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('shop.example.com'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('passes filters from options', async () => {
+    let capturedSearchParams: URLSearchParams | undefined;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        ({ request }) => {
+          capturedSearchParams = new URL(request.url).searchParams;
+
+          return HttpResponse.json({
+            data: [
+              {
+                domain,
+                project_uuid: projectUuid,
+                verification_status: 'pending',
+              },
+            ],
+          });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['list', '--domain', domain, '--status', 'pending'], { from: 'user' });
+
+    expect(capturedSearchParams?.get('domain:in')).toBe(domain);
+    expect(capturedSearchParams?.get('verification_status')).toBe('pending');
+  });
+
+  test('reports when no domains are configured', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+        () => HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['list'], { from: 'user' });
+
+    expect(consola.info).toHaveBeenCalledWith('No custom domains found.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+});
+
+describe('status command', () => {
+  test('shows a domain status for the linked project', async () => {
+    writeCredentials();
+
+    await domains.parseAsync(['status', domain], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Fetching status for ${domain}...`);
+    expect(consola.success).toHaveBeenCalledWith('Domain status fetched.');
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining(domain));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('can wait for a pending domain to leave pending status', async () => {
+    let requests = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => {
+          requests += 1;
+
+          return HttpResponse.json({
+            data: {
+              domain,
+              project_uuid: projectUuid,
+              verification_status: requests === 1 ? 'pending' : 'verified',
+            },
+          });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['status', domain, '--wait'], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Waiting for ${domain} to verify...`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(requests).toBe(2);
+  });
+});
+
+describe('claim command', () => {
+  test('claims a domain for the linked project', async () => {
+    writeCredentials();
+
+    await domains.parseAsync(['claim', domain], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Claiming domain ${domain}...`);
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} claimed.`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining(domain));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prints the ownership TXT record when verification has not completed', async () => {
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+        () =>
+          HttpResponse.json(
+            {
+              title: 'Domain ownership could not be verified.',
+              errors: {
+                domain: `No ownership verification TXT record was found at '_bigcommerce-verification.${domain}'. Add the record, then try again.`,
+              },
+              meta: {
+                ownership_verification: {
+                  type: 'TXT',
+                  name: `_bigcommerce-verification.${domain}`,
+                  value: 'bc-verify=019500e2933d70578e81090dd7240795',
+                },
+              },
+            },
+            { status: 422 },
+          ),
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['claim', domain], { from: 'user' });
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining('could not be verified'));
+    expect(consola.log).toHaveBeenCalledWith(
+      expect.stringContaining('bc-verify=019500e2933d70578e81090dd7240795'),
+    );
+    expect(consola.success).not.toHaveBeenCalled();
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('can wait for a claimed domain to leave pending status', async () => {
+    let getRequests = 0;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+        () => new HttpResponse(null, { status: 204 }),
+      ),
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => {
+          getRequests += 1;
+
+          return HttpResponse.json({
+            data: {
+              domain,
+              project_uuid: projectUuid,
+              verification_status: getRequests === 1 ? 'pending' : 'verified',
+            },
+          });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['claim', domain, '--wait'], { from: 'user' });
+
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} claimed.`);
+    expect(consola.start).toHaveBeenCalledWith(`Waiting for ${domain} to verify...`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(getRequests).toBe(2);
+  });
+});
+
+describe('transfer command', () => {
+  const destinationProjectUuid = 'a23f5785-fd99-4a94-9fb3-945551623923';
+
+  test('transfers to the project passed via --to-project-uuid without prompting', async () => {
+    let capturedBody: unknown;
+    let capturedSourceProject: string | readonly string[] | undefined;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+        async ({ request, params }) => {
+          capturedBody = await request.json();
+          capturedSourceProject = params.projectUuid;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['transfer', domain, '--to-project-uuid', destinationProjectUuid], {
+      from: 'user',
+    });
+
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(capturedSourceProject).toBe(projectUuid);
+    expect(capturedBody).toEqual({ new_project_uuid: destinationProjectUuid });
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} transferred.`);
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('active'));
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('prompts to pick a destination project, excluding the source', async () => {
+    // Default fetchProjects handler returns Project One + Project Two; the
+    // linked (source) project UUID matches neither, so both are offered.
+    selectMock.mockResolvedValue(destinationProjectUuid);
+
+    let capturedBody: unknown;
+
+    server.use(
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+        async ({ request }) => {
+          capturedBody = await request.json();
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['transfer', domain], { from: 'user' });
+
+    expect(selectMock).toHaveBeenCalledTimes(1);
+
+    const choiceValues = selectMock.mock.calls[0][0].choices.map((choice) =>
+      typeof choice === 'object' && 'value' in choice ? choice.value : undefined,
+    );
+
+    expect(choiceValues).not.toContain(projectUuid);
+    expect(capturedBody).toEqual({ new_project_uuid: destinationProjectUuid });
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} transferred.`);
+  });
+
+  test('points at the owning project when the domain lives on another one', async () => {
+    // Default fetchProjects returns Project One (a23f…) + Project Two (b23f…).
+    // The domain is on Project One; the linked project and Project Two 404.
+    const ownerUuid = destinationProjectUuid;
+    let transferRequests = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        ({ params }) =>
+          params.projectUuid === ownerUuid
+            ? HttpResponse.json({
+                data: { domain, project_uuid: ownerUuid, verification_status: 'verified' },
+              })
+            : new HttpResponse(null, { status: 404 }),
+      ),
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+        () => {
+          transferRequests += 1;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['transfer', domain], { from: 'user' });
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining(`${domain} is on project "Project One" (${ownerUuid})`),
+    );
+    expect(consola.log).toHaveBeenCalledWith(
+      `  catalyst domains transfer ${domain} --project-uuid ${ownerUuid}`,
+    );
+    // The transfer is never attempted, and the user is never prompted.
+    expect(transferRequests).toBe(0);
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('errors when the domain is on no project in the store', async () => {
+    let transferRequests = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => new HttpResponse(null, { status: 404 }),
+      ),
+      http.post(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+        () => {
+          transferRequests += 1;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    writeCredentials();
+
+    await expect(
+      domains.parseAsync(['transfer', domain, '--to-project-uuid', destinationProjectUuid], {
+        from: 'user',
+      }),
+    ).rejects.toThrow(`${domain} isn't on any project in this store`);
+
+    // The transfer is never attempted, and the user is never prompted.
+    expect(transferRequests).toBe(0);
+    expect(selectMock).not.toHaveBeenCalled();
+  });
+
+  test('rejects a destination that matches the source project', async () => {
+    writeCredentials();
+
+    await expect(
+      domains.parseAsync(['transfer', domain, '--to-project-uuid', projectUuid], { from: 'user' }),
+    ).rejects.toThrow('destination project must differ from the source project');
+  });
+
+  test('errors when there are no other projects to transfer to', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({
+          data: [{ uuid: projectUuid, name: 'Only Project', deployment_hostnames: [] }],
+        }),
+      ),
+    );
+
+    writeCredentials();
+
+    await expect(domains.parseAsync(['transfer', domain], { from: 'user' })).rejects.toThrow(
+      'No other projects to transfer to',
+    );
+    expect(selectMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('remove command', () => {
+  test('confirms before removing an active domain', async () => {
+    confirmMock.mockResolvedValue(true);
+
+    writeCredentials();
+
+    await domains.parseAsync(['remove', domain], { from: 'user' });
+
+    expect(consola.start).toHaveBeenCalledWith(`Fetching status for ${domain}...`);
+    expect(confirmMock).toHaveBeenCalledWith({
+      message: `Remove active domain ${domain}? Traffic may stop routing to this project.`,
+      default: false,
+    });
+    expect(consola.start).toHaveBeenCalledWith(`Removing domain ${domain}...`);
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} removed.`);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('does not remove an active domain when confirmation is declined', async () => {
+    let deleteRequests = 0;
+
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () => {
+          deleteRequests += 1;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    confirmMock.mockResolvedValue(false);
+
+    writeCredentials();
+
+    await domains.parseAsync(['remove', domain], { from: 'user' });
+
+    expect(consola.info).toHaveBeenCalledWith('Aborted. No domain was removed.');
+    expect(deleteRequests).toBe(0);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('skips confirmation with --force', async () => {
+    confirmMock.mockResolvedValue(false);
+
+    writeCredentials();
+
+    await domains.parseAsync(['remove', domain, '--force'], { from: 'user' });
+
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} removed.`);
+  });
+
+  test('does not prompt before removing a pending domain', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+        () =>
+          HttpResponse.json({
+            data: {
+              domain,
+              project_uuid: projectUuid,
+              verification_status: 'pending',
+            },
+          }),
+      ),
+    );
+
+    writeCredentials();
+
+    await domains.parseAsync(['remove', domain], { from: 'user' });
+
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(consola.success).toHaveBeenCalledWith(`Domain ${domain} removed.`);
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/domains.ts b/packages/catalyst/src/cli/commands/domains.ts
new file mode 100644
index 0000000000..024497dffb
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/domains.ts
@@ -0,0 +1,606 @@
+import { confirm, select } from '@inquirer/prompts';
+import { Command, Option } from 'commander';
+import { colorize } from 'consola/utils';
+
+import {
+  claimDomain,
+  createDomain,
+  deleteDomain,
+  Domain,
+  DomainBoundToProjectError,
+  DomainOwnershipVerificationError,
+  DomainStatus,
+  DomainStatusFilter,
+  findDomain,
+  getDomain,
+  listDomains,
+  OwnershipVerification,
+  transferDomain,
+} from '../lib/domains';
+import { UserActionableError } from '../lib/errors';
+import { consola } from '../lib/logger';
+import { fetchProjects } from '../lib/project';
+import { getProjectConfig } from '../lib/project-config';
+import { resolveCredentials } from '../lib/resolve-credentials';
+import {
+  accessTokenOption,
+  apiHostOption,
+  projectUuidOption,
+  resolveApiHost,
+  resolveProjectUuid,
+  storeHashOption,
+} from '../lib/shared-options';
+import { getTelemetry } from '../lib/telemetry';
+
+const WAIT_INTERVAL_MS = 5000;
+const WAIT_TIMEOUT_MS = 5 * 60 * 1000;
+const DOMAIN_STATUS_FILTERS: DomainStatusFilter[] = ['pending', 'verified', 'failed'];
+
+const STATUS_COLORS: Record<DomainStatus, Parameters<typeof colorize>[0]> = {
+  pending: 'yellow',
+  verified: 'green',
+  failed: 'red',
+  unknown: 'gray',
+};
+
+const STATUS_LABELS: Record<DomainStatus, string> = {
+  pending: 'pending',
+  verified: 'active',
+  failed: 'failed',
+  unknown: 'unknown',
+};
+
+interface DomainCommandContext {
+  projectUuid: string;
+  storeHash: string;
+  accessToken: string;
+  apiHost: string;
+}
+
+interface DomainCommandOptions {
+  storeHash?: string;
+  accessToken?: string;
+  apiHost?: string;
+  projectUuid?: string;
+}
+
+interface WaitForDomainVerificationOptions extends DomainCommandContext {
+  domain: string;
+  intervalMs?: number;
+  timeoutMs?: number;
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function resolveDomainCommandContext(options: DomainCommandOptions): DomainCommandContext {
+  const config = getProjectConfig();
+  const apiHost = resolveApiHost(options, config);
+  const { storeHash, accessToken } = resolveCredentials(options, config);
+  const projectUuid = resolveProjectUuid(options);
+
+  return {
+    projectUuid,
+    storeHash,
+    accessToken,
+    apiHost,
+  };
+}
+
+// Resolves the destination project for a transfer. Uses `--to-project-uuid`
+// when given; otherwise fetches the store's projects and prompts the user to
+// pick one, excluding the source project (a domain can't be transferred to the
+// project it already belongs to).
+async function resolveDestinationProject(
+  domain: string,
+  context: DomainCommandContext,
+  toProjectUuid?: string,
+): Promise<string> {
+  if (toProjectUuid) {
+    if (toProjectUuid === context.projectUuid) {
+      throw new UserActionableError('The destination project must differ from the source project.');
+    }
+
+    return toProjectUuid;
+  }
+
+  consola.start('Fetching projects...');
+
+  const projects = await fetchProjects(context.storeHash, context.accessToken, context.apiHost);
+
+  consola.success('Projects fetched.');
+
+  const destinations = projects.filter((project) => project.uuid !== context.projectUuid);
+
+  if (destinations.length === 0) {
+    throw new UserActionableError(
+      'No other projects to transfer to. Create another project with `catalyst project create` first.',
+    );
+  }
+
+  return select({
+    message: `Select the project to transfer ${domain} to (Press <enter> to select).`,
+    choices: destinations.map((project) => ({
+      name: project.name,
+      value: project.uuid,
+      description: project.uuid,
+    })),
+  });
+}
+
+export function formatDomainStatus(status: DomainStatus): string {
+  return colorize(STATUS_COLORS[status], STATUS_LABELS[status]);
+}
+
+export function formatDomain(domain: Domain): string {
+  return `${domain.domain} ${formatDomainStatus(domain.verification_status)}`;
+}
+
+export function formatOwnershipVerification(record: OwnershipVerification): string {
+  const lines = [
+    'Add this DNS record to verify ownership:',
+    `  Type:  ${record.type}`,
+    `  Name:  ${record.name}`,
+  ];
+
+  if (record.value) {
+    lines.push(`  Value: ${record.value}`);
+  }
+
+  return lines.join('\n');
+}
+
+export async function waitForDomainVerification({
+  domain,
+  projectUuid,
+  storeHash,
+  accessToken,
+  apiHost,
+  intervalMs = WAIT_INTERVAL_MS,
+  timeoutMs = WAIT_TIMEOUT_MS,
+}: WaitForDomainVerificationOptions): Promise<Domain> {
+  const startedAt = Date.now();
+  let current = await getDomain(domain, projectUuid, storeHash, accessToken, apiHost);
+
+  while (current.verification_status === 'pending' && Date.now() - startedAt < timeoutMs) {
+    // eslint-disable-next-line no-await-in-loop
+    await sleep(intervalMs);
+    // eslint-disable-next-line no-await-in-loop
+    current = await getDomain(domain, projectUuid, storeHash, accessToken, apiHost);
+  }
+
+  return current;
+}
+
+const add = new Command('add')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Add a custom domain to the current Native Hosting project.')
+  .argument('<domain>', 'Custom domain to add.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst domains add www.example.com
+
+  # Wait until the domain leaves pending verification
+  $ catalyst domains add www.example.com --wait`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--wait', 'Poll until domain verification completes or times out.')
+  .action(async (domain, options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    consola.start(`Adding domain ${domain}...`);
+
+    let result: Domain;
+
+    try {
+      result = await createDomain(
+        domain,
+        context.projectUuid,
+        context.storeHash,
+        context.accessToken,
+        context.apiHost,
+      );
+    } catch (error) {
+      if (error instanceof DomainOwnershipVerificationError) {
+        consola.warn(`${domain} is already in use on another store.`);
+        consola.log(formatOwnershipVerification(error.ownershipVerification));
+        consola.info('Once the record is live, claim it with:');
+        consola.log(`  catalyst domains claim ${domain}`);
+        process.exit(1);
+
+        return;
+      }
+
+      if (error instanceof DomainBoundToProjectError) {
+        consola.warn(`${domain} is already bound to another project in this store.`);
+        consola.info('To move it to this project, run:');
+        consola.log(
+          `  catalyst domains transfer ${domain} --project-uuid ${error.projectUuid} --to-project-uuid ${context.projectUuid}`,
+        );
+        process.exit(1);
+
+        return;
+      }
+
+      throw error;
+    }
+
+    consola.success(`Domain ${result.domain} added.`);
+
+    if (options.wait && result.verification_status === 'pending') {
+      consola.start(`Waiting for ${result.domain} to verify...`);
+      result = await waitForDomainVerification({ domain: result.domain, ...context });
+    }
+
+    consola.log(formatDomain(result));
+    process.exit(0);
+  });
+
+const list = new Command('list')
+  .configureHelp({ showGlobalOptions: true })
+  .description('List custom domains for the current Native Hosting project.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst domains list
+
+  # Show pending domains only
+  $ catalyst domains list --status pending`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--domain <domain>', 'Only show a specific domain.')
+  .addOption(
+    new Option('--status <status>', 'Filter by verification status.').choices(
+      DOMAIN_STATUS_FILTERS,
+    ),
+  )
+  .action(async (options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    consola.start('Fetching domains...');
+
+    const result = await listDomains(
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+      {
+        domains: options.domain ? [options.domain] : undefined,
+        verificationStatus: options.status,
+      },
+    );
+
+    consola.success('Domains fetched.');
+
+    if (result.length === 0) {
+      consola.info('No custom domains found.');
+      process.exit(0);
+
+      return;
+    }
+
+    result.forEach((item) => consola.log(formatDomain(item)));
+    process.exit(0);
+  });
+
+const showStatus = new Command('status')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Show the status of a custom domain on the current Native Hosting project.')
+  .argument('<domain>', 'Custom domain to check.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst domains status www.example.com
+
+  # Wait until the domain leaves pending verification
+  $ catalyst domains status www.example.com --wait`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--wait', 'Poll until domain verification completes or times out.')
+  .action(async (domain, options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    consola.start(`Fetching status for ${domain}...`);
+
+    let result = await getDomain(
+      domain,
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    consola.success('Domain status fetched.');
+
+    if (options.wait && result.verification_status === 'pending') {
+      consola.start(`Waiting for ${result.domain} to verify...`);
+      result = await waitForDomainVerification({ domain: result.domain, ...context });
+    }
+
+    consola.log(formatDomain(result));
+    process.exit(0);
+  });
+
+const claim = new Command('claim')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Claim a custom domain that is currently in use on another store.')
+  .argument('<domain>', 'Custom domain to claim.')
+  .addHelpText(
+    'after',
+    `
+Claiming requires publishing the ownership-verification TXT record returned when
+you try to add a domain that is already in use on another store. Publish the
+record with your DNS provider, then run this command to complete the claim.
+
+Examples:
+  $ catalyst domains claim www.example.com
+
+  # Wait until the claimed domain leaves pending verification
+  $ catalyst domains claim www.example.com --wait`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--wait', 'Poll until domain verification completes or times out.')
+  .action(async (domain, options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    consola.start(`Claiming domain ${domain}...`);
+
+    try {
+      await claimDomain(
+        domain,
+        context.projectUuid,
+        context.storeHash,
+        context.accessToken,
+        context.apiHost,
+      );
+    } catch (error) {
+      if (error instanceof DomainOwnershipVerificationError) {
+        consola.warn(`Ownership of ${domain} could not be verified yet.`);
+        consola.log(formatOwnershipVerification(error.ownershipVerification));
+        consola.info('Once the record is live, run the claim again:');
+        consola.log(`  catalyst domains claim ${domain}`);
+        process.exit(1);
+
+        return;
+      }
+
+      throw error;
+    }
+
+    consola.success(`Domain ${domain} claimed.`);
+
+    let result = await getDomain(
+      domain,
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    if (options.wait && result.verification_status === 'pending') {
+      consola.start(`Waiting for ${result.domain} to verify...`);
+      result = await waitForDomainVerification({ domain: result.domain, ...context });
+    }
+
+    consola.log(formatDomain(result));
+    process.exit(0);
+  });
+
+const transfer = new Command('transfer')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Transfer a custom domain to another project in the same store.')
+  .argument('<domain>', 'Custom domain to transfer.')
+  .addHelpText(
+    'after',
+    `
+The domain is transferred from the current project to the destination project.
+Omit --to-project-uuid to pick the destination from a list of your projects.
+
+Examples:
+  # Pick the destination project interactively
+  $ catalyst domains transfer www.example.com
+
+  # Transfer to a specific project
+  $ catalyst domains transfer www.example.com --to-project-uuid <uuid>`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--to-project-uuid <uuid>', 'Destination project UUID. Prompts to choose one if omitted.')
+  .option('--wait', 'Poll until domain verification completes or times out.')
+  .action(async (domain, options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    // Confirm the domain is on the source project before doing anything else.
+    // `transfer` moves a domain *from* the current project, so a domain that
+    // lives elsewhere can't be transferred from here — catch it now instead of
+    // letting the API reject the transfer with an opaque ownership error after
+    // the user has already picked a destination.
+    consola.start(`Checking ${domain} on the current project...`);
+
+    const owned = await findDomain(
+      domain,
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    if (!owned) {
+      // The domain isn't on the linked project. Scan the store's other projects
+      // so we can point the user at the exact owner — `domains list` only shows
+      // the *current* project's domains, so it can't help them find where the
+      // domain actually lives.
+      consola.start(`Locating the project that owns ${domain}...`);
+
+      const projects = await fetchProjects(context.storeHash, context.accessToken, context.apiHost);
+      const candidates = projects.filter((project) => project.uuid !== context.projectUuid);
+      const matches = await Promise.all(
+        candidates.map(async (project) => ({
+          project,
+          found: await findDomain(
+            domain,
+            project.uuid,
+            context.storeHash,
+            context.accessToken,
+            context.apiHost,
+          ),
+        })),
+      );
+      const owner = matches.find((match) => match.found)?.project;
+
+      if (!owner) {
+        throw new UserActionableError(
+          `${domain} isn't on any project in this store. If it's in use on another store, ` +
+            `claim it with \`catalyst domains claim ${domain}\`; otherwise double-check the domain name.`,
+        );
+      }
+
+      const toSuffix = options.toProjectUuid ? ` --to-project-uuid ${options.toProjectUuid}` : '';
+
+      consola.warn(
+        `${domain} is on project "${owner.name}" (${owner.uuid}), not the current project.`,
+      );
+      consola.info('Re-run the transfer from that project:');
+      consola.log(`  catalyst domains transfer ${domain} --project-uuid ${owner.uuid}${toSuffix}`);
+      process.exit(1);
+
+      return;
+    }
+
+    consola.success(`${domain} found on the current project.`);
+
+    const newProjectUuid = await resolveDestinationProject(domain, context, options.toProjectUuid);
+
+    consola.start(`Transferring domain ${domain}...`);
+
+    await transferDomain(
+      domain,
+      context.projectUuid,
+      newProjectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    consola.success(`Domain ${domain} transferred.`);
+
+    let result = await getDomain(
+      domain,
+      newProjectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    if (options.wait && result.verification_status === 'pending') {
+      consola.start(`Waiting for ${result.domain} to verify...`);
+      result = await waitForDomainVerification({
+        domain: result.domain,
+        projectUuid: newProjectUuid,
+        storeHash: context.storeHash,
+        accessToken: context.accessToken,
+        apiHost: context.apiHost,
+      });
+    }
+
+    consola.log(formatDomain(result));
+    process.exit(0);
+  });
+
+const remove = new Command('remove')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Remove a custom domain from the current Native Hosting project.')
+  .argument('<domain>', 'Custom domain to remove.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst domains remove www.example.com
+
+  # Skip confirmation for an active domain
+  $ catalyst domains remove www.example.com --force`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--force', 'Skip the confirmation prompt before removing an active domain.')
+  .action(async (domain, options) => {
+    const context = resolveDomainCommandContext(options);
+
+    await getTelemetry().identify(context.storeHash);
+
+    consola.start(`Fetching status for ${domain}...`);
+
+    const current = await getDomain(
+      domain,
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    if (current.verification_status === 'verified' && !options.force) {
+      const confirmed = await confirm({
+        message: `Remove active domain ${current.domain}? Traffic may stop routing to this project.`,
+        default: false,
+      });
+
+      if (!confirmed) {
+        consola.info('Aborted. No domain was removed.');
+        process.exit(0);
+
+        return;
+      }
+    }
+
+    consola.start(`Removing domain ${current.domain}...`);
+
+    await deleteDomain(
+      current.domain,
+      context.projectUuid,
+      context.storeHash,
+      context.accessToken,
+      context.apiHost,
+    );
+
+    consola.success(`Domain ${current.domain} removed.`);
+    process.exit(0);
+  });
+
+export const domains = new Command('domains')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Manage custom domains for the current Native Hosting project.')
+  .addCommand(add)
+  .addCommand(list)
+  .addCommand(showStatus)
+  .addCommand(claim)
+  .addCommand(transfer)
+  .addCommand(remove);
diff --git a/packages/catalyst/src/cli/commands/env.spec.ts b/packages/catalyst/src/cli/commands/env.spec.ts
new file mode 100644
index 0000000000..75a1c9433f
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/env.spec.ts
@@ -0,0 +1,115 @@
+import { Command } from 'commander';
+import { afterAll, afterEach, beforeAll, beforeEach, expect, MockInstance, test, vi } from 'vitest';
+
+import { consola } from '../lib/logger';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig } from '../lib/project-config';
+import { program } from '../program';
+
+import { env } from './env';
+
+let exitMock: MockInstance;
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+});
+
+beforeEach(() => {
+  process.chdir(tmpDir);
+});
+
+afterEach(() => {
+  getProjectConfig().delete('env');
+  vi.clearAllMocks();
+});
+
+afterAll(async () => {
+  await cleanup();
+});
+
+test('properly configured Command instance', () => {
+  expect(env).toBeInstanceOf(Command);
+  expect(env.name()).toBe('env');
+  expect(env.commands.map((c) => c.name()).sort()).toEqual(['add', 'list', 'remove']);
+});
+
+test('add stores variables in .bigcommerce/project.json', async () => {
+  await program.parseAsync(['node', 'catalyst', 'env', 'add', 'FOO=bar', 'BAZ=qux']);
+
+  expect(getProjectConfig().get('env')).toEqual({ FOO: 'bar', BAZ: 'qux' });
+  expect(exitMock).toHaveBeenCalledWith(0);
+});
+
+test('add merges with and overwrites existing variables', async () => {
+  const config = getProjectConfig();
+
+  config.set('env', { FOO: 'old', KEEP: 'me' });
+
+  await program.parseAsync(['node', 'catalyst', 'env', 'add', 'FOO=new']);
+
+  expect(config.get('env')).toEqual({ FOO: 'new', KEEP: 'me' });
+});
+
+test('add never prints the raw value', async () => {
+  await program.parseAsync(['node', 'catalyst', 'env', 'add', 'SECRET=supersecret']);
+
+  const logged = vi.mocked(consola.log).mock.calls.flat().join('\n');
+
+  expect(logged).toContain('SECRET=');
+  expect(logged).not.toContain('supersecret');
+});
+
+test('add rejects an invalid assignment without partially writing', async () => {
+  const config = getProjectConfig();
+
+  config.set('env', { EXISTING: 'value' });
+
+  await expect(
+    program.parseAsync(['node', 'catalyst', 'env', 'add', 'GOOD=ok', 'bad-entry']),
+  ).rejects.toThrow('Invalid env var format: bad-entry');
+
+  // GOOD must not have been persisted since one entry was invalid.
+  expect(config.get('env')).toEqual({ EXISTING: 'value' });
+});
+
+test('remove deletes stored variables', async () => {
+  const config = getProjectConfig();
+
+  config.set('env', { FOO: 'bar', BAZ: 'qux' });
+
+  await program.parseAsync(['node', 'catalyst', 'env', 'remove', 'FOO']);
+
+  expect(config.get('env')).toEqual({ BAZ: 'qux' });
+  expect(exitMock).toHaveBeenCalledWith(0);
+});
+
+test('remove warns for keys that are not stored', async () => {
+  getProjectConfig().set('env', { FOO: 'bar' });
+
+  await program.parseAsync(['node', 'catalyst', 'env', 'remove', 'MISSING']);
+
+  expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining('MISSING'));
+});
+
+test('list shows stored keys with masked values', async () => {
+  getProjectConfig().set('env', { FOO: 'bar' });
+
+  await program.parseAsync(['node', 'catalyst', 'env', 'list']);
+
+  const logged = vi.mocked(consola.log).mock.calls.flat().join('\n');
+
+  expect(logged).toContain('FOO=');
+  expect(logged).not.toContain('bar');
+});
+
+test('list reports when nothing is stored', async () => {
+  await program.parseAsync(['node', 'catalyst', 'env', 'list']);
+
+  expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('No environment variables'));
+});
diff --git a/packages/catalyst/src/cli/commands/env.ts b/packages/catalyst/src/cli/commands/env.ts
new file mode 100644
index 0000000000..e17c19eea2
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/env.ts
@@ -0,0 +1,118 @@
+import { Command } from 'commander';
+
+import { getStoredEnv, parseEnvAssignment } from '../lib/env-config';
+import { consola } from '../lib/logger';
+import { getProjectConfig } from '../lib/project-config';
+
+// Values are secrets, so we never print them back. A fixed-width mask avoids
+// leaking the length of the stored value.
+const MASK = '••••••';
+
+const add = new Command('add')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Add or update one or more deployment environment variables. Stored in .bigcommerce/project.json and sent as secrets on every `catalyst deploy`.',
+  )
+  .argument('<vars...>', 'One or more environment variables in KEY=VALUE format.')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst env add BIGCOMMERCE_STORE_HASH=abc123 BIGCOMMERCE_STOREFRONT_TOKEN=ey...`,
+  )
+  .action((vars: string[]) => {
+    const config = getProjectConfig();
+    const stored = { ...getStoredEnv(config) };
+
+    // Parse everything before writing so a single invalid entry doesn't leave a
+    // partial update behind.
+    const parsed = vars.map((entry) => parseEnvAssignment(entry));
+
+    parsed.forEach(({ key, value }) => {
+      stored[key] = value;
+    });
+
+    config.set('env', stored);
+
+    const keys = parsed.map(({ key }) => key);
+
+    consola.success(
+      `Saved ${keys.length} environment variable${keys.length === 1 ? '' : 's'} to .bigcommerce/project.json:`,
+    );
+    keys.forEach((key) => consola.log(`  ${key}=${MASK}`));
+
+    process.exit(0);
+  });
+
+const remove = new Command('remove')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Remove one or more stored deployment environment variables.')
+  .argument('<keys...>', 'One or more environment variable names to remove.')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst env remove BIGCOMMERCE_STORE_HASH BIGCOMMERCE_STOREFRONT_TOKEN`,
+  )
+  .action((keys: string[]) => {
+    const config = getProjectConfig();
+    const stored = getStoredEnv(config);
+    const toRemove = new Set<string>();
+
+    keys.forEach((key) => {
+      if (key in stored) {
+        toRemove.add(key);
+      } else {
+        consola.warn(`No stored environment variable named "${key}". Skipping.`);
+      }
+    });
+
+    const next = Object.fromEntries(Object.entries(stored).filter(([key]) => !toRemove.has(key)));
+
+    config.set('env', next);
+
+    const removed = Array.from(toRemove);
+
+    if (removed.length > 0) {
+      consola.success(
+        `Removed ${removed.length} environment variable${removed.length === 1 ? '' : 's'}: ${removed.join(', ')}.`,
+      );
+    }
+
+    process.exit(0);
+  });
+
+const list = new Command('list')
+  .configureHelp({ showGlobalOptions: true })
+  .description('List stored deployment environment variables (values are masked).')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst env list`,
+  )
+  .action(() => {
+    const config = getProjectConfig();
+    const stored = getStoredEnv(config);
+    const keys = Object.keys(stored).sort();
+
+    if (keys.length === 0) {
+      consola.info('No environment variables stored. Add one with `catalyst env add KEY=VALUE`.');
+      process.exit(0);
+
+      return;
+    }
+
+    keys.forEach((key) => consola.log(`${key}=${MASK}`));
+
+    process.exit(0);
+  });
+
+export const env = new Command('env')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Manage persistent deployment environment variables. These are sent as secrets on every `catalyst deploy`, so you no longer need to pass `--secret` each time.',
+  )
+  .addCommand(add)
+  .addCommand(remove)
+  .addCommand(list);
diff --git a/packages/catalyst/src/cli/commands/logs.spec.ts b/packages/catalyst/src/cli/commands/logs.spec.ts
new file mode 100644
index 0000000000..b5c70914ba
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/logs.spec.ts
@@ -0,0 +1,900 @@
+import { Command } from 'commander';
+import Conf from 'conf';
+import { http, HttpResponse } from 'msw';
+import { afterAll, afterEach, beforeAll, describe, expect, MockInstance, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+import { consola } from '../lib/logger';
+import { mkTempDir } from '../lib/mk-temp-dir';
+import { getProjectConfig, ProjectConfigSchema } from '../lib/project-config';
+import { program } from '../program';
+
+import { logs, parseSSEEvent, tailLogs } from './logs';
+
+let exitMock: MockInstance;
+let stdoutWriteMock: MockInstance;
+
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let config: Conf<ProjectConfigSchema>;
+
+const projectUuid = '6b202364-10f3-11f1-8bc7-fe9b9d8b14ab';
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+const apiHost = 'api.bigcommerce.com';
+
+const encoder = new TextEncoder();
+
+const validLogEvent = {
+  uuid: '0f258256-0a83-4704-a456-03e99b4445c2',
+  project_uuid: projectUuid,
+  request: { method: 'GET', url: 'https://example.com/test', status_code: 200 },
+  logs: [{ timestamp: '2026-03-11T22:05:28.870Z', level: 'info', messages: ['hello world'] }],
+  exceptions: [],
+  timestamp: '2026-03-11T22:05:28.870Z',
+};
+
+const createSSEStream = (events: string[], closeDelay = 10) =>
+  new ReadableStream({
+    start(controller) {
+      events.forEach((event) => {
+        controller.enqueue(encoder.encode(event));
+      });
+      setTimeout(() => controller.close(), closeDelay);
+    },
+  });
+
+// Creates a handler that serves SSE events on the first request,
+// then returns 404 on subsequent requests to break the reconnect loop.
+const createOneShotLogHandler = (events: string[], closeDelay = 10) => {
+  let called = false;
+
+  return http.get(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+    () => {
+      if (called) {
+        return new HttpResponse(null, { status: 404, statusText: 'Not Found' });
+      }
+
+      called = true;
+
+      return new HttpResponse(createSSEStream(events, closeDelay), {
+        status: 200,
+        headers: { 'Content-Type': 'text/event-stream' },
+      });
+    },
+  );
+};
+
+const callTailLogs = async (format: Parameters<typeof tailLogs>[4], events?: string[]) => {
+  const sseEvents = events ?? [`data: ${JSON.stringify(validLogEvent)}\n\n`];
+
+  server.use(createOneShotLogHandler(sseEvents));
+
+  await tailLogs(projectUuid, storeHash, accessToken, apiHost, format).catch(() => {
+    // Expected: tailLogs throws when the one-shot handler returns 404 on reconnect
+  });
+};
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+  stdoutWriteMock = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+  [tmpDir, cleanup] = await mkTempDir();
+
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+
+  config = getProjectConfig();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  config.delete('storeHash');
+  config.delete('accessToken');
+  config.delete('projectUuid');
+});
+
+afterAll(async () => {
+  await cleanup();
+});
+
+describe('command configuration', () => {
+  test('logs is a properly configured Command with tail and query subcommands', () => {
+    expect(logs).toBeInstanceOf(Command);
+    expect(logs.name()).toBe('logs');
+    expect(logs.description()).toBe('View logs from your deployed application.');
+
+    const subcommands = logs.commands.map((c) => c.name());
+
+    expect(subcommands).toContain('tail');
+    expect(subcommands).toContain('query');
+  });
+
+  test('tail subcommand has correct options', () => {
+    const tail = logs.commands.find((c) => c.name() === 'tail');
+
+    expect(tail).toBeDefined();
+    expect(tail?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--format <format>', defaultValue: 'default' }),
+      ]),
+    );
+  });
+
+  test('query subcommand has correct options', () => {
+    const query = logs.commands.find((c) => c.name() === 'query');
+
+    expect(query).toBeDefined();
+    expect(query?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--store-hash <hash>' }),
+        expect.objectContaining({ flags: '--access-token <token>' }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--format <format>', defaultValue: 'default' }),
+      ]),
+    );
+  });
+});
+
+describe('parseSSEEvent', () => {
+  test('extracts data from a single data line', () => {
+    expect(parseSSEEvent('data: {"foo":"bar"}')).toBe('{"foo":"bar"}');
+  });
+
+  test('joins multiple data lines with newlines', () => {
+    expect(parseSSEEvent('data: line1\ndata: line2')).toBe('line1\nline2');
+  });
+
+  test('ignores non-data SSE fields', () => {
+    expect(parseSSEEvent('event: message\ndata: {"foo":"bar"}\nid: 123')).toBe('{"foo":"bar"}');
+  });
+
+  test('ignores SSE comments', () => {
+    expect(parseSSEEvent(': this is a comment\ndata: {"foo":"bar"}')).toBe('{"foo":"bar"}');
+  });
+
+  test('returns null for events with no data lines', () => {
+    expect(parseSSEEvent('event: ping')).toBeNull();
+    expect(parseSSEEvent(': comment only')).toBeNull();
+    expect(parseSSEEvent('')).toBeNull();
+  });
+
+  test('returns null for heartbeat events with empty data', () => {
+    expect(parseSSEEvent('data: ')).toBeNull();
+    expect(parseSSEEvent('data:')).toBeNull();
+  });
+});
+
+describe('format: default', () => {
+  test('logs timestamp, level, and message', async () => {
+    await callTailLogs('default');
+
+    expect(consola.info).toHaveBeenCalledWith('Tailing logs...');
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('[2026-03-11T22:05:28.870Z]'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('hello world'));
+  });
+});
+
+describe('format: json', () => {
+  test('writes raw JSON to stdout', async () => {
+    await callTailLogs('json');
+
+    expect(stdoutWriteMock).toHaveBeenCalledWith(
+      expect.stringContaining('"uuid":"0f258256-0a83-4704-a456-03e99b4445c2"'),
+    );
+  });
+});
+
+describe('format: pretty', () => {
+  test('logs pretty-printed JSON', async () => {
+    await callTailLogs('pretty');
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('"uuid"'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('"hello world"'));
+  });
+
+  test('preserves unknown fields via loose schema', async () => {
+    const eventWithExtra = { ...validLogEvent, extra_field: 'should be preserved' };
+
+    await callTailLogs('pretty', [`data: ${JSON.stringify(eventWithExtra)}\n\n`]);
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('should be preserved'));
+  });
+});
+
+describe('format: short', () => {
+  test('logs only the message', async () => {
+    await callTailLogs('short');
+
+    expect(consola.log).toHaveBeenCalledWith('hello world');
+  });
+});
+
+describe('format: request', () => {
+  test('logs timestamp, level, request info, and message', async () => {
+    await callTailLogs('request');
+
+    expect(consola.log).toHaveBeenCalledWith(
+      expect.stringContaining('GET https://example.com/test'),
+    );
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('(200)'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('hello world'));
+  });
+});
+
+describe('log event processing', () => {
+  test.each([
+    ['info', 'INFO'],
+    ['warn', 'WARN'],
+    ['error', 'ERROR'],
+    ['debug', 'DEBUG'],
+  ])('formats %s level as %s', async (level, expected) => {
+    const event = { ...validLogEvent, logs: [{ ...validLogEvent.logs[0], level }] };
+
+    await callTailLogs('default', [`data: ${JSON.stringify(event)}\n\n`]);
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining(expected));
+  });
+
+  test('logs exceptions from the event', async () => {
+    const event = {
+      ...validLogEvent,
+      exceptions: [{ message: 'something broke', stack: 'Error: something broke' }],
+    };
+
+    await callTailLogs('default', [`data: ${JSON.stringify(event)}\n\n`]);
+
+    expect(consola.error).toHaveBeenCalledWith(
+      expect.stringContaining('EXCEPTION'),
+      expect.objectContaining({ message: 'something broke' }),
+    );
+  });
+
+  test('serializes non-string messages as JSON', async () => {
+    const event = {
+      ...validLogEvent,
+      logs: [{ ...validLogEvent.logs[0], messages: [{ nested: 'object' }, 42] }],
+    };
+
+    await callTailLogs('default', [`data: ${JSON.stringify(event)}\n\n`]);
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('{"nested":"object"}'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('42'));
+  });
+
+  test('multiple events in a single chunk are all processed', async () => {
+    const event1 = {
+      ...validLogEvent,
+      logs: [{ ...validLogEvent.logs[0], messages: ['first'] }],
+    };
+    const event2 = {
+      ...validLogEvent,
+      logs: [{ ...validLogEvent.logs[0], messages: ['second'] }],
+    };
+
+    await callTailLogs('default', [
+      `data: ${JSON.stringify(event1)}\n\ndata: ${JSON.stringify(event2)}\n\n`,
+    ]);
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('first'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('second'));
+  });
+});
+
+describe('error handling', () => {
+  test('silently ignores heartbeat events', async () => {
+    await callTailLogs('default', [`data: \n\ndata: ${JSON.stringify(validLogEvent)}\n\n`]);
+
+    expect(consola.warn).not.toHaveBeenCalled();
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('hello world'));
+  });
+
+  test('warns on invalid JSON in stream', async () => {
+    await callTailLogs('default', [`data: {not valid json}\n\n`]);
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining('Failed to parse log event'));
+  });
+
+  test('warns on valid JSON that does not match schema', async () => {
+    await callTailLogs('default', [`data: {"valid":"json","but":"wrong schema"}\n\n`]);
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining('Failed to parse log event'));
+  });
+
+  test('throws on fatal 4xx status codes', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    await expect(tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default')).rejects.toThrow(
+      'Failed to open log stream: The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.',
+    );
+  });
+
+  test('throws a re-auth error on fatal 401 unauthorized', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => new HttpResponse(null, { status: 401, statusText: 'Unauthorized' }),
+      ),
+    );
+
+    await expect(tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default')).rejects.toThrow(
+      'catalyst auth login',
+    );
+  });
+});
+
+describe('retry and reconnect', () => {
+  test('retries on 5xx errors and throws after max retries', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => new HttpResponse(null, { status: 502, statusText: 'Bad Gateway' }),
+      ),
+    );
+
+    await expect(tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default')).rejects.toThrow(
+      'Failed to connect to log stream after 5 retries.',
+    );
+
+    // 4 warnings logged for attempts 1-4, then throw on attempt 5
+    expect(consola.warn).toHaveBeenCalledTimes(4);
+  });
+
+  test('logs retry attempt number in warning messages', async () => {
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => new HttpResponse(null, { status: 503, statusText: 'Service Unavailable' }),
+      ),
+    );
+
+    await expect(
+      tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default'),
+    ).rejects.toThrow();
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining('attempt 1/5'),
+      expect.anything(),
+    );
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining('attempt 4/5'),
+      expect.anything(),
+    );
+  });
+
+  test('resets retry counter after a successful connection', async () => {
+    let requestCount = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => {
+          requestCount += 1;
+
+          // First 3 requests: 502 errors (builds up retries to 3)
+          if (requestCount <= 3) {
+            return new HttpResponse(null, { status: 502, statusText: 'Bad Gateway' });
+          }
+
+          // 4th request: successful stream (resets retries to 0)
+          if (requestCount === 4) {
+            return new HttpResponse(
+              createSSEStream([`data: ${JSON.stringify(validLogEvent)}\n\n`]),
+              {
+                status: 200,
+                headers: { 'Content-Type': 'text/event-stream' },
+              },
+            );
+          }
+
+          // 5th+ requests: 502 again until retries are exhausted a second time
+          return new HttpResponse(null, { status: 502, statusText: 'Bad Gateway' });
+        },
+      ),
+    );
+
+    await expect(tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default')).rejects.toThrow(
+      'Failed to connect to log stream after 5 retries.',
+    );
+
+    // 3 warnings before success + 4 warnings after success (throw on 5th retry)
+    expect(consola.warn).toHaveBeenCalledTimes(7);
+  });
+
+  test('server disconnect does not increment retry counter', async () => {
+    let requestCount = 0;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => {
+          requestCount += 1;
+
+          // Return a stream that immediately errors to simulate server disconnect
+          if (requestCount <= 3) {
+            const stream = new ReadableStream({
+              start(controller) {
+                controller.error(new TypeError('terminated'));
+              },
+            });
+
+            return new HttpResponse(stream, {
+              status: 200,
+              headers: { 'Content-Type': 'text/event-stream' },
+            });
+          }
+
+          // After 3 server disconnects, return 404 to break the loop
+          return new HttpResponse(null, { status: 404, statusText: 'Not Found' });
+        },
+      ),
+    );
+
+    await expect(tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default')).rejects.toThrow(
+      'Failed to open log stream: The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.',
+    );
+
+    // Server disconnect warnings should NOT contain "attempt X/5"
+    expect(consola.warn).toHaveBeenCalledTimes(3);
+    expect(consola.warn).toHaveBeenCalledWith('Log stream closed by server, reconnecting...');
+  });
+
+  test(
+    'reconnects when the stream stalls without emitting any data',
+    { timeout: 3000 },
+    async () => {
+      let requestCount = 0;
+      const ttlMs = 200;
+
+      // Stream that stays open but never enqueues — simulates an API proxy
+      // half-closing the socket: bytes stop arriving but no FIN or error is
+      // surfaced, so reader.read() would otherwise block forever.
+      const createStalledStream = () =>
+        new ReadableStream({
+          start() {
+            // intentionally empty
+          },
+        });
+
+      server.use(
+        http.get(
+          'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+          () => {
+            requestCount += 1;
+
+            if (requestCount <= 2) {
+              return new HttpResponse(createStalledStream(), {
+                status: 200,
+                headers: { 'Content-Type': 'text/event-stream' },
+              });
+            }
+
+            return new HttpResponse(null, { status: 404, statusText: 'Not Found' });
+          },
+        ),
+      );
+
+      await expect(
+        tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default', ttlMs),
+      ).rejects.toThrow(
+        'Failed to open log stream: The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.',
+      );
+
+      expect(requestCount).toBe(3);
+      expect(consola.warn).toHaveBeenCalledWith('Log stream idle, reconnecting...');
+    },
+  );
+
+  test('reconnects when connection TTL is reached', { timeout: 3000 }, async () => {
+    let requestCount = 0;
+    const ttlMs = 200;
+
+    // Creates a stream that sends data every 30ms via setInterval and never closes.
+    // The cancel callback cleans up the interval so reader.cancel() resolves.
+    const createOpenEndedStream = () => {
+      let intervalId: ReturnType<typeof setInterval>;
+
+      return new ReadableStream({
+        start(controller) {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(validLogEvent)}\n\n`));
+          intervalId = setInterval(() => {
+            controller.enqueue(encoder.encode(`data: ${JSON.stringify(validLogEvent)}\n\n`));
+          }, 30);
+        },
+        cancel() {
+          clearInterval(intervalId);
+        },
+      });
+    };
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail',
+        () => {
+          requestCount += 1;
+
+          if (requestCount <= 2) {
+            return new HttpResponse(createOpenEndedStream(), {
+              status: 200,
+              headers: { 'Content-Type': 'text/event-stream' },
+            });
+          }
+
+          // 3rd request: return 404 to break the reconnect loop
+          return new HttpResponse(null, { status: 404, statusText: 'Not Found' });
+        },
+      ),
+    );
+
+    await expect(
+      tailLogs(projectUuid, storeHash, accessToken, apiHost, 'default', ttlMs),
+    ).rejects.toThrow(
+      'Failed to open log stream: The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.',
+    );
+
+    // Should have connected 3 times: 2 TTL-triggered reconnects + final 404
+    expect(requestCount).toBe(3);
+
+    // Events from both successful connections should have been processed
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('hello world'));
+  });
+});
+
+describe('credential resolution', () => {
+  test('falls back to project.json for storeHash and accessToken', async () => {
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    server.use(createOneShotLogHandler([`data: ${JSON.stringify(validLogEvent)}\n\n`]));
+
+    await program.parseAsync(['node', 'catalyst', 'logs', 'tail', '--project-uuid', projectUuid]);
+
+    expect(consola.info).toHaveBeenCalledWith('Tailing logs...');
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('hello world'));
+  });
+
+  test('exits with error when no credentials are provided', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+
+    await program.parseAsync(['node', 'catalyst', 'logs', 'tail', '--project-uuid', projectUuid]);
+
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
+
+    expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+    expect(consola.info).toHaveBeenCalledWith(
+      'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
+
+describe('query subcommand', () => {
+  const start = '2026-06-01T00:00:00Z';
+  const end = '2026-06-02T00:00:00Z';
+
+  const queryArgs = (extra: string[] = []) => [
+    'node',
+    'catalyst',
+    'logs',
+    'query',
+    '--store-hash',
+    storeHash,
+    '--access-token',
+    accessToken,
+    '--project-uuid',
+    projectUuid,
+    '--start',
+    start,
+    '--end',
+    end,
+    ...extra,
+  ];
+
+  test('prints formatted log lines and a count footer', async () => {
+    await program.parseAsync(queryArgs());
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('/cart'));
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('[TypeError]'));
+    expect(consola.info).toHaveBeenCalledWith('1 entry shown (oldest first, times in UTC).');
+    // TODO(TRAC-934): no next-page hint is printed while pagination is removed.
+    expect(consola.info).not.toHaveBeenCalledWith(expect.stringContaining('More available'));
+  });
+
+  test('warns when the result fills --limit exactly', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid', () =>
+        HttpResponse.json({
+          data: [
+            { id: '2', timestamp: '2026-06-01T13:00:00Z', level: 'info', messages: ['newer'] },
+            { id: '1', timestamp: '2026-06-01T12:00:00Z', level: 'info', messages: ['older'] },
+          ],
+        }),
+      ),
+    );
+
+    await program.parseAsync(queryArgs(['--limit', '2']));
+
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('Limit of 2 reached'));
+  });
+
+  test('does not warn when the result is below --limit', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid', () =>
+        HttpResponse.json({
+          data: [{ id: '1', timestamp: '2026-06-01T12:00:00Z', level: 'info', messages: ['only'] }],
+        }),
+      ),
+    );
+
+    await program.parseAsync(queryArgs(['--limit', '5']));
+
+    expect(consola.info).not.toHaveBeenCalledWith(expect.stringContaining('reached'));
+  });
+
+  test('prints entries oldest-first', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid', () =>
+        HttpResponse.json({
+          data: [
+            { id: '2', timestamp: '2026-06-01T13:00:00Z', level: 'info', messages: ['newer'] },
+            { id: '1', timestamp: '2026-06-01T12:00:00Z', level: 'info', messages: ['older'] },
+          ],
+          meta: {
+            cursor_pagination: { count: 2, per_page: 50, start_cursor: null, end_cursor: null },
+          },
+        }),
+      ),
+    );
+
+    await program.parseAsync(queryArgs());
+
+    const logged = vi.mocked(consola.log).mock.calls.map(([line]) => String(line));
+    const olderIndex = logged.findIndex((line) => line.includes('older'));
+    const newerIndex = logged.findIndex((line) => line.includes('newer'));
+
+    expect(olderIndex).toBeGreaterThanOrEqual(0);
+    expect(olderIndex).toBeLessThan(newerIndex);
+  });
+
+  test('--since queries a relative window ending now', async () => {
+    let captured: URLSearchParams | undefined;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid',
+        ({ request }) => {
+          captured = new URL(request.url).searchParams;
+
+          return HttpResponse.json({
+            data: [],
+            meta: {
+              cursor_pagination: { count: 0, per_page: 50, start_cursor: null, end_cursor: null },
+            },
+          });
+        },
+      ),
+    );
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'logs',
+      'query',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      projectUuid,
+      '--since',
+      '1h',
+    ]);
+
+    const sentStart = Date.parse(captured?.get('start') ?? '');
+    const sentEnd = Date.parse(captured?.get('end') ?? '');
+
+    expect(sentEnd - sentStart).toBe(60 * 60 * 1000);
+    expect(Math.abs(Date.now() - sentEnd)).toBeLessThan(60 * 1000);
+  });
+
+  test('reads project UUID from project.json when --project-uuid is omitted', async () => {
+    config.set('projectUuid', projectUuid);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'logs',
+      'query',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--start',
+      start,
+      '--end',
+      end,
+    ]);
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('/cart'));
+  });
+
+  test('outputs one raw JSON entry per line with --format json', async () => {
+    await program.parseAsync(queryArgs(['--format', 'json']));
+
+    // NDJSON to stdout (like `tail --format json`), no footer chrome.
+    expect(stdoutWriteMock).toHaveBeenCalledWith(expect.stringContaining('"is_exception":true'));
+    expect(consola.info).not.toHaveBeenCalledWith(expect.stringContaining('entry shown'));
+  });
+
+  test('includes request details with --format request', async () => {
+    await program.parseAsync(queryArgs(['--format', 'request']));
+
+    expect(consola.log).toHaveBeenCalledWith(expect.stringContaining('GET /cart (500)'));
+  });
+
+  test('reports when no entries are found', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid', () =>
+        HttpResponse.json({
+          data: [],
+          meta: {
+            cursor_pagination: { count: 0, per_page: 50, start_cursor: null, end_cursor: null },
+          },
+        }),
+      ),
+    );
+
+    await program.parseAsync(queryArgs());
+
+    expect(consola.info).toHaveBeenCalledWith(
+      'No log entries found for the given window and filters.',
+    );
+  });
+
+  test('forwards filters as query params', async () => {
+    let captured: URLSearchParams | undefined;
+
+    server.use(
+      http.get(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid',
+        ({ request }) => {
+          captured = new URL(request.url).searchParams;
+
+          return HttpResponse.json({
+            data: [],
+            meta: {
+              cursor_pagination: { count: 0, per_page: 50, start_cursor: null, end_cursor: null },
+            },
+          });
+        },
+      ),
+    );
+
+    await program.parseAsync(
+      queryArgs([
+        '--method',
+        'GET',
+        '--status-code',
+        '500',
+        '--url-like',
+        '/cart',
+        '--level-min',
+        'warn',
+        '--limit',
+        '10',
+      ]),
+    );
+
+    expect(captured?.get('method')).toBe('GET');
+    expect(captured?.get('status_code')).toBe('500');
+    expect(captured?.get('url:like')).toBe('/cart');
+    expect(captured?.get('level:min')).toBe('warn');
+    expect(captured?.get('limit')).toBe('10');
+    expect(captured?.get('after')).toBeNull();
+  });
+
+  test('exits with error when no project UUID can be resolved', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'logs',
+      'query',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--start',
+      start,
+      '--end',
+      end,
+    ]);
+
+    expect(consola.error).toHaveBeenCalledWith(expect.stringContaining('Project UUID is required'));
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('exits with an error on an invalid time window', async () => {
+    await program.parseAsync(queryArgs(['--end', '2026-05-01T00:00:00Z']));
+
+    expect(consola.error).toHaveBeenCalledWith(
+      expect.stringContaining('--start must be before or equal to --end'),
+    );
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('exits with missing credentials error when none are provided', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+
+    await program.parseAsync(['node', 'catalyst', 'logs', 'query', '--start', start, '--end', end]);
+
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
+
+    expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
+
+describe('program integration', () => {
+  test('logs tail is the default subcommand', async () => {
+    server.use(createOneShotLogHandler([`data: ${JSON.stringify(validLogEvent)}\n\n`]));
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'logs',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      projectUuid,
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith('Tailing logs...');
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+
+  test('logs tail with --format json', async () => {
+    server.use(createOneShotLogHandler([`data: ${JSON.stringify(validLogEvent)}\n\n`]));
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'logs',
+      'tail',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+      '--project-uuid',
+      projectUuid,
+      '--format',
+      'json',
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith('Tailing logs...');
+    expect(stdoutWriteMock).toHaveBeenCalled();
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/logs.ts b/packages/catalyst/src/cli/commands/logs.ts
new file mode 100644
index 0000000000..1bf0a4a60a
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/logs.ts
@@ -0,0 +1,496 @@
+import { Command, InvalidArgumentError, Option } from 'commander';
+import { colorize } from 'consola/utils';
+import { z } from 'zod';
+
+import { UnauthorizedError } from '../lib/auth-errors';
+import { httpError } from '../lib/http-errors';
+import { consola } from '../lib/logger';
+import { formatLogEntry, LOG_LEVELS, queryLogs, resolveTimeWindow } from '../lib/observability';
+import { getProjectConfig } from '../lib/project-config';
+import { resolveCredentials } from '../lib/resolve-credentials';
+import {
+  accessTokenOption,
+  apiHostOption,
+  projectUuidOption,
+  resolveApiHost,
+  resolveProjectUuid,
+  storeHashOption,
+} from '../lib/shared-options';
+import { Telemetry } from '../lib/telemetry';
+
+type LogFormat = 'json' | 'pretty' | 'default' | 'short' | 'request';
+
+const telemetry = new Telemetry();
+
+const DEFAULT_CONNECTION_TTL_MS = 1 * 60 * 1000; // 1 minute
+const MAX_RETRIES = 5;
+
+const isFatalStatusCode = (status: number) => status >= 400 && status < 500;
+
+const LEVEL_COLORS: Record<string, Parameters<typeof colorize>[0]> = {
+  INFO: 'green',
+  WARN: 'yellow',
+  ERROR: 'red',
+  DEBUG: 'gray',
+};
+
+const LogEventSchema = z
+  .object({
+    uuid: z.string(),
+    project_uuid: z.string(),
+    request: z.object({
+      method: z.string(),
+      url: z.string(),
+      status_code: z.number(),
+    }),
+    logs: z.array(
+      z.object({
+        timestamp: z.string(),
+        level: z.string(),
+        messages: z.array(z.unknown()),
+      }),
+    ),
+    exceptions: z.array(z.unknown()),
+    timestamp: z.string(),
+  })
+  .loose();
+
+class StreamError extends Error {
+  fatal: boolean;
+
+  constructor(message: string, fatal: boolean) {
+    super(message);
+    this.fatal = fatal;
+  }
+}
+
+const formatMessages = (messages: unknown[]) =>
+  messages.map((m) => (typeof m === 'string' ? m : JSON.stringify(m))).join(' ');
+
+const formatLogEvent = (
+  event: z.infer<typeof LogEventSchema>,
+  format: 'default' | 'short' | 'request',
+) => {
+  const { request, logs: logEntries, exceptions } = event;
+
+  logEntries.forEach((entry) => {
+    const msg = formatMessages(entry.messages);
+    const level = entry.level.toUpperCase();
+    const coloredLevel = colorize(LEVEL_COLORS[level] ?? 'white', level);
+
+    switch (format) {
+      case 'short':
+        consola.log(msg);
+        break;
+
+      case 'request':
+        consola.log(
+          `[${entry.timestamp}] [${coloredLevel}] ${request.method} ${request.url}` +
+            ` (${request.status_code}) ${msg}`,
+        );
+        break;
+
+      default:
+        consola.log(`[${entry.timestamp}] [${coloredLevel}] ${msg}`);
+        break;
+    }
+  });
+
+  exceptions.forEach((exception) => {
+    consola.error(`[${event.timestamp}] EXCEPTION`, exception);
+  });
+};
+
+export const parseSSEEvent = (raw: string): string | null => {
+  const joined = raw
+    .split('\n')
+    .flatMap((line) => (line.startsWith('data:') ? [line.slice(5).trim()] : []))
+    .join('\n');
+
+  return joined.length > 0 ? joined : null;
+};
+
+const processLogEvent = (event: string, format: LogFormat) => {
+  if (format === 'json') {
+    process.stdout.write(`${event}\n`);
+
+    return;
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(event);
+    const logEvent = LogEventSchema.parse(parsed);
+
+    if (format === 'pretty') {
+      consola.log(JSON.stringify(logEvent, null, 2));
+    } else {
+      formatLogEvent(logEvent, format);
+    }
+  } catch {
+    consola.warn(`Failed to parse log event: ${event}`);
+  }
+};
+
+type TimeoutRaceResult<T> = { kind: 'value'; value: T } | { kind: 'timeout' };
+
+// Races a promise against a timer so a hung `reader.read()` doesn't block the
+// read pump. Without this, the connection TTL check never runs when the API
+// proxy half-closes the socket — bytes stop arriving but no FIN/error
+// surfaces, so the read promise stays pending forever.
+const raceWithTimeout = async <T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+): Promise<TimeoutRaceResult<T>> => {
+  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;
+
+  const timeoutPromise = new Promise<TimeoutRaceResult<T>>((resolve) => {
+    timeoutHandle = setTimeout(() => resolve({ kind: 'timeout' }), timeoutMs);
+  });
+
+  try {
+    return await Promise.race([
+      promise.then((value): TimeoutRaceResult<T> => ({ kind: 'value', value })),
+      timeoutPromise,
+    ]);
+  } finally {
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+  }
+};
+
+const openLogStream = async (
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+) => {
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/infrastructure/logs/${projectUuid}/tail`,
+    {
+      method: 'GET',
+      headers: {
+        'X-Auth-Token': accessToken,
+        Accept: 'text/event-stream',
+        Connection: 'keep-alive',
+      },
+    },
+  );
+
+  // An invalid/expired token won't recover by reconnecting — surface the
+  // re-auth guidance and stop the loop (fatal) rather than burning retries.
+  if (response.status === 401) {
+    throw new StreamError(new UnauthorizedError().message, true);
+  }
+
+  if (!response.ok) {
+    const error = await httpError(response, 'Failed to open log stream');
+
+    throw new StreamError(error.message, isFatalStatusCode(response.status));
+  }
+
+  const reader = response.body?.getReader();
+
+  if (!reader) {
+    throw new StreamError('Failed to read log stream.', true);
+  }
+
+  return reader;
+};
+
+// Reasons the read pump stops on its own (vs. throwing). The outer reconnect
+// loop maps each to a user-facing message — or silence — and opens a fresh
+// stream.
+type Rotation = 'ttl' | 'idle-timeout' | 'stream-done';
+
+const pumpUntilRotation = async (
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  format: LogFormat,
+  connectionTtlMs: number,
+): Promise<Rotation> => {
+  const decoder = new TextDecoder();
+  const connectTime = Date.now();
+  let buffer = '';
+  let receivedData = false;
+
+  // eslint-disable-next-line no-constant-condition, @typescript-eslint/no-unnecessary-condition
+  while (true) {
+    const remainingTtlMs = connectionTtlMs - (Date.now() - connectTime);
+
+    if (remainingTtlMs <= 0) {
+      void reader.cancel();
+
+      return 'ttl';
+    }
+
+    // eslint-disable-next-line no-await-in-loop
+    const readResult = await raceWithTimeout(reader.read(), remainingTtlMs);
+
+    if (readResult.kind === 'timeout') {
+      void reader.cancel();
+
+      // No data for the whole window: proxy likely half-closed the socket.
+      // If data flowed earlier, treat it as a normal TTL boundary instead.
+      return receivedData ? 'ttl' : 'idle-timeout';
+    }
+
+    const { value, done: streamDone } = readResult.value;
+
+    if (value) {
+      receivedData = true;
+      buffer += decoder.decode(value, { stream: true });
+
+      const parts = buffer.split('\n\n');
+
+      // Last element is either empty (complete event) or a partial chunk to carry over
+      buffer = parts.pop() ?? '';
+
+      parts
+        .map((raw) => parseSSEEvent(raw))
+        .filter((event): event is string => event !== null)
+        .forEach((event) => processLogEvent(event, format));
+    }
+
+    if (streamDone) {
+      void reader.cancel();
+
+      return 'stream-done';
+    }
+  }
+};
+
+export const tailLogs = async (
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+  format: LogFormat,
+  connectionTtlMs = DEFAULT_CONNECTION_TTL_MS,
+) => {
+  consola.info('Tailing logs...');
+
+  let retries = 0;
+
+  // eslint-disable-next-line no-constant-condition, @typescript-eslint/no-unnecessary-condition
+  while (true) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      const reader = await openLogStream(projectUuid, storeHash, accessToken, apiHost);
+
+      retries = 0;
+
+      // eslint-disable-next-line no-await-in-loop
+      const rotation = await pumpUntilRotation(reader, format, connectionTtlMs);
+
+      if (rotation === 'idle-timeout') {
+        consola.warn('Log stream idle, reconnecting...');
+      }
+      // 'ttl' and 'stream-done' are healthy rotations — reconnect silently.
+    } catch (error) {
+      if (error instanceof StreamError && error.fatal) {
+        throw error;
+      }
+
+      const isServerDisconnect = error instanceof TypeError && error.message === 'terminated';
+
+      if (isServerDisconnect) {
+        consola.warn('Log stream closed by server, reconnecting...');
+      } else {
+        retries += 1;
+
+        if (retries >= MAX_RETRIES) {
+          throw new Error(`Failed to connect to log stream after ${MAX_RETRIES} retries.`);
+        }
+
+        consola.warn(
+          `Log stream disconnected, reconnecting (attempt ${retries}/${MAX_RETRIES})...`,
+          error,
+        );
+      }
+    }
+  }
+};
+
+const tail = new Command('tail')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Tail live logs from your deployed application.')
+  .addHelpText(
+    'after',
+    `
+Examples:
+  $ catalyst logs tail
+
+  # Tail logs with request format
+  $ catalyst logs tail --format request
+
+  # Tail logs as raw JSON (useful for piping to other tools)
+  $ catalyst logs tail --format json`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .addOption(
+    new Option('--format <format>', 'Output format for log events.')
+      .choices(['json', 'pretty', 'default', 'short', 'request'])
+      .default('default'),
+  )
+  .action(async (options) => {
+    try {
+      const config = getProjectConfig();
+      const apiHost = resolveApiHost(options, config);
+      const { storeHash, accessToken } = resolveCredentials(options, config);
+
+      await telemetry.identify(storeHash);
+
+      const projectUuid = resolveProjectUuid(options);
+
+      await tailLogs(projectUuid, storeHash, accessToken, apiHost, options.format);
+    } catch (error) {
+      consola.error(error);
+      process.exit(1);
+    }
+  });
+
+// Validates a numeric flag client-side so typos fail instantly with a clear
+// message instead of sending NaN (or an out-of-range value) to the API.
+const parseIntInRange = (flag: string, min: number, max: number) => (value: string) => {
+  const parsed = Number(value);
+
+  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+    throw new InvalidArgumentError(`${flag} must be an integer between ${min} and ${max}.`);
+  }
+
+  return parsed;
+};
+
+const query = new Command('query')
+  .configureHelp({ showGlobalOptions: true })
+  .description('Query historical logs from your deployed application.')
+  .addHelpText(
+    'after',
+    `
+Specify a time window with \`--since\` (relative to now) or \`--start\`/\`--end\`
+(ISO-8601 timestamps or Unix epoch seconds, UTC). The window may not exceed
+7 days. Entries print oldest-first; timestamps are UTC.
+
+Examples:
+  # Last hour of logs
+  $ catalyst logs query --since 1h
+
+  # Everything from today (UTC)
+  $ catalyst logs query --start 2026-06-11T00:00:00Z
+
+  # Errors only for a specific path
+  $ catalyst logs query --since 24h --level-min error --url-like /cart
+
+  # Errors with request details (method, URL, status)
+  $ catalyst logs query --since 1h --level-min error --format request
+
+  # Raw JSON (NDJSON) for piping to other tools
+  $ catalyst logs query --since 2d --format json`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .addOption(
+    new Option(
+      '--since <duration>',
+      'Relative window ending at --end (default: now), e.g. 30m, 6h, 2d (units: s, m, h, d).',
+    ).conflicts('start'),
+  )
+  .option('--start <time>', 'Window start: ISO-8601 timestamp or Unix epoch (seconds).')
+  .option(
+    '--end <time>',
+    'Window end: ISO-8601 timestamp or Unix epoch (seconds). Defaults to now. The window must not exceed 7 days.',
+  )
+  .option('--method <method>', 'Filter by request HTTP method (case-insensitive).')
+  .addOption(
+    new Option('--status-code <code>', 'Filter by response status code (100-599).').argParser(
+      parseIntInRange('--status-code', 100, 599),
+    ),
+  )
+  .option('--url-like <substring>', 'Filter by URL substring (case-sensitive).')
+  .addOption(
+    new Option('--level-min <level>', 'Minimum log level.').choices(Array.from(LOG_LEVELS)),
+  )
+  .addOption(
+    new Option('--limit <n>', 'Maximum number of entries to return (1-500).')
+      .argParser(parseIntInRange('--limit', 1, 500))
+      .default(100),
+  )
+  // TODO(TRAC-934): --after (cursor) and --all (follow pagination) were
+  // removed until Cloudflare fixes invocations-view pagination
+  .addOption(
+    new Option('--format <format>', 'Output format for log entries.')
+      .choices(['json', 'pretty', 'default', 'short', 'request'])
+      .default('default'),
+  )
+  .action(async (options) => {
+    try {
+      const config = getProjectConfig();
+      const apiHost = resolveApiHost(options, config);
+      const { storeHash, accessToken } = resolveCredentials(options, config);
+
+      await telemetry.identify(storeHash);
+
+      const projectUuid = resolveProjectUuid(options);
+      const { start, end } = resolveTimeWindow(options);
+
+      const result = await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+        start,
+        end,
+        method: options.method,
+        statusCode: options.statusCode,
+        urlLike: options.urlLike,
+        levelMin: options.levelMin,
+        limit: options.limit,
+      });
+
+      const entries = result.data;
+      const ordered = [...entries].reverse();
+
+      if (options.format === 'json') {
+        ordered.forEach((entry) => process.stdout.write(`${JSON.stringify(entry)}\n`));
+
+        return;
+      }
+
+      if (options.format === 'pretty') {
+        ordered.forEach((entry) => consola.log(JSON.stringify(entry, null, 2)));
+
+        return;
+      }
+
+      if (entries.length === 0) {
+        consola.info('No log entries found for the given window and filters.');
+
+        return;
+      }
+
+      // `json`/`pretty` returned above, leaving the human line formats — capture
+      // the narrowed value so it survives into the forEach closure.
+      const lineFormat = options.format;
+
+      ordered.forEach((entry) => consola.log(formatLogEntry(entry, lineFormat)));
+
+      consola.info(
+        `${entries.length} ${entries.length === 1 ? 'entry' : 'entries'} shown (oldest first, times in UTC).`,
+      );
+
+      if (entries.length === options.limit) {
+        consola.info(
+          `Limit of ${options.limit} reached; older entries may exist. ` +
+            'Narrow the time window or raise --limit (max 500) to see more.',
+        );
+      }
+    } catch (error) {
+      consola.error(error instanceof Error ? error.message : error);
+      process.exit(1);
+    }
+  });
+
+export const logs = new Command('logs')
+  .configureHelp({ showGlobalOptions: true })
+  .description('View logs from your deployed application.')
+  .addCommand(tail, { isDefault: true })
+  .addCommand(query);
diff --git a/packages/catalyst/src/cli/commands/project.spec.ts b/packages/catalyst/src/cli/commands/project.spec.ts
index 68a32cab57..ec56c97d54 100644
--- a/packages/catalyst/src/cli/commands/project.spec.ts
+++ b/packages/catalyst/src/cli/commands/project.spec.ts
@@ -1,16 +1,82 @@
+import { confirm, input, password, select } from '@inquirer/prompts';
 import { Command } from 'commander';
 import Conf from 'conf';
 import { http, HttpResponse } from 'msw';
-import { afterAll, afterEach, beforeAll, describe, expect, MockInstance, test, vi } from 'vitest';
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  MockInstance,
+  test,
+  vi,
+} from 'vitest';
 
 import { server } from '../../../tests/mocks/node';
+import { setupCommerceHosting } from '../lib/commerce-hosting';
+import { installDependencies } from '../lib/install-dependencies';
 import { consola } from '../lib/logger';
 import { mkTempDir } from '../lib/mk-temp-dir';
 import { getProjectConfig, ProjectConfigSchema } from '../lib/project-config';
+import { getProjectState } from '../lib/project-state';
 import { program } from '../program';
 
 import { link, project } from './project';
 
+// eslint-disable-next-line import/dynamic-import-chunkname
+vi.mock('yocto-spinner', () => import('../../../tests/mocks/spinner'));
+vi.mock('open', () => ({ default: vi.fn().mockResolvedValue(undefined) }));
+vi.mock('@inquirer/prompts', () => ({
+  password: vi.fn(),
+  confirm: vi.fn(),
+  input: vi.fn(),
+  select: vi.fn(),
+}));
+
+vi.mock('../lib/project-state', () => ({
+  getProjectState: vi.fn(),
+}));
+
+vi.mock('../lib/install-dependencies', () => ({
+  installDependencies: vi.fn().mockResolvedValue(undefined),
+}));
+
+const passwordMock = vi.mocked(password);
+const confirmMock = vi.mocked(confirm);
+const inputMock = vi.mocked(input);
+const selectMock = vi.mocked(select);
+
+vi.mock('../lib/commerce-hosting', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../lib/commerce-hosting')>();
+
+  return {
+    ...actual,
+    setupCommerceHosting: vi.fn(),
+  };
+});
+
+const transformedState = {
+  projectUuid: 'abc-123',
+  hasMiddleware: true,
+  hasProxy: false,
+  hasOpenNextDep: true,
+  isLinked: true,
+  isTransformed: true,
+  isFullySetUp: true,
+};
+
+const untransformedState = {
+  projectUuid: undefined,
+  hasMiddleware: false,
+  hasProxy: true,
+  hasOpenNextDep: false,
+  isLinked: false,
+  isTransformed: false,
+  isFullySetUp: false,
+};
+
 let exitMock: MockInstance;
 
 let tmpDir: string;
@@ -31,17 +97,22 @@ beforeAll(async () => {
   consola.mockTypes(() => vi.fn());
 
   vi.mock('../lib/telemetry', () => {
+    const instance = {
+      identify: mockIdentify,
+      isEnabled: vi.fn(() => true),
+      track: vi.fn(),
+      correlationId: 'test-session-uuid',
+      commandName: 'unknown',
+      durationMs: vi.fn().mockReturnValue(0),
+      analytics: {
+        closeAndFlush: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
     return {
-      Telemetry: vi.fn().mockImplementation(() => {
-        return {
-          identify: mockIdentify,
-          isEnabled: vi.fn(() => true),
-          track: vi.fn(),
-          analytics: {
-            closeAndFlush: vi.fn(),
-          },
-        };
-      }),
+      Telemetry: vi.fn().mockImplementation(() => instance),
+      getTelemetry: vi.fn(() => instance),
+      resetTelemetry: vi.fn(),
     };
   });
 
@@ -50,11 +121,22 @@ beforeAll(async () => {
 
   [tmpDir, cleanup] = await mkTempDir();
 
-  config = getProjectConfig(tmpDir);
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+
+  config = getProjectConfig();
+});
+
+beforeEach(() => {
+  // Default to a fully-transformed project so existing tests skip the
+  // post-link Commerce Hosting setup prompt. Override per-test as needed.
+  vi.mocked(getProjectState).mockReturnValue(transformedState);
 });
 
 afterEach(() => {
   vi.clearAllMocks();
+  config.delete('storeHash');
+  config.delete('accessToken');
+  config.delete('projectUuid');
 });
 
 afterAll(async () => {
@@ -65,7 +147,7 @@ afterAll(async () => {
 });
 
 describe('project', () => {
-  test('has create, link, and list subcommands', () => {
+  test('has create, link, list, and delete subcommands', () => {
     expect(project).toBeInstanceOf(Command);
     expect(project.name()).toBe('project');
     expect(project.description()).toBe('Manage your BigCommerce infrastructure project.');
@@ -86,12 +168,25 @@ describe('project', () => {
 
     expect(listCmd).toBeDefined();
     expect(listCmd?.description()).toContain('List BigCommerce infrastructure projects');
+
+    const deleteCmd = project.commands.find((cmd) => cmd.name() === 'delete');
+
+    expect(deleteCmd).toBeDefined();
+    expect(deleteCmd?.description()).toContain(
+      'Permanently delete a BigCommerce infrastructure project',
+    );
+    expect(deleteCmd?.options).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ flags: '--project-uuid <uuid>' }),
+        expect.objectContaining({ flags: '--force' }),
+      ]),
+    );
   });
 });
 
 describe('project create', () => {
   test('prompts for name and creates project', async () => {
-    const consolaPromptMock = vi.spyOn(consola, 'prompt').mockResolvedValue('My New Project');
+    inputMock.mockResolvedValue('My New Project');
 
     await program.parseAsync([
       'node',
@@ -102,14 +197,11 @@ describe('project create', () => {
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
     expect(mockIdentify).toHaveBeenCalledWith(storeHash);
-    expect(consolaPromptMock).toHaveBeenCalledWith(
-      'Enter a name for the new project:',
-      expect.any(Object),
+    expect(inputMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Enter a name for the new project:' }),
     );
     expect(consola.success).toHaveBeenCalledWith('Project "New Project" created successfully.');
     expect(consola.start).toHaveBeenCalledWith(
@@ -121,29 +213,98 @@ describe('project create', () => {
     expect(exitMock).toHaveBeenCalledWith(0);
 
     expect(config.get('projectUuid')).toBe('c23f5785-fd99-4a94-9fb3-945551623925');
-    expect(config.get('framework')).toBe('catalyst');
+    expect(config.get('storeHash')).toBe(storeHash);
+    expect(config.get('accessToken')).toBe(accessToken);
+  });
+
+  test('runs interactive login when no credentials are provided', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+
+    inputMock.mockResolvedValueOnce('My New Project');
+
+    await program.parseAsync(['node', 'catalyst', 'project', 'create']);
+
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
+
+    expect(consola.info).toHaveBeenCalledWith(
+      "You're not logged in yet. Let's get you authenticated before creating a project.",
+    );
+    expect(consola.success).toHaveBeenCalledWith('Logged in to store mock-store-hash.');
+    expect(consola.success).toHaveBeenCalledWith('Project "New Project" created successfully.');
+    expect(exitMock).toHaveBeenCalledWith(0);
 
-    consolaPromptMock.mockRestore();
+    expect(config.get('storeHash')).toBe('mock-store-hash');
+    expect(config.get('accessToken')).toBe('mock-access-token');
+    expect(config.get('projectUuid')).toBe(projectUuid3);
   });
 
-  test('with insufficient credentials exits with error', async () => {
-    // Unset env so Commander doesn't pick up BIGCOMMERCE_* and trigger the create flow (which would prompt for name)
-    const savedStoreHash = process.env.BIGCOMMERCE_STORE_HASH;
-    const savedAccessToken = process.env.BIGCOMMERCE_ACCESS_TOKEN;
+  test('falls back to manual login when the device flow fails', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
+
+    passwordMock.mockResolvedValueOnce(accessToken);
+
+    // Manual-login fallback: confirm() to retry manually, input() for the store
+    // hash, password() for the token, then input() for the new project name.
+    confirmMock.mockResolvedValueOnce(true);
+    inputMock.mockResolvedValueOnce(storeHash).mockResolvedValueOnce('My New Project');
+
+    await program.parseAsync(['node', 'catalyst', 'project', 'create']);
+
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
 
-    delete process.env.BIGCOMMERCE_STORE_HASH;
-    delete process.env.BIGCOMMERCE_ACCESS_TOKEN;
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining("Browser login didn't work"));
+    expect(consola.success).toHaveBeenCalledWith(`Logged in to store ${storeHash}.`);
+    expect(consola.success).toHaveBeenCalledWith('Project "New Project" created successfully.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+
+    expect(config.get('storeHash')).toBe(storeHash);
+    expect(config.get('accessToken')).toBe(accessToken);
+  });
+
+  test('exits cleanly when the user aborts the manual login fallback', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
 
-    await program.parseAsync(['node', 'catalyst', 'project', 'create', '--root-dir', tmpDir]);
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 404, statusText: 'Not Found' }),
+      ),
+    );
 
-    if (savedStoreHash !== undefined) process.env.BIGCOMMERCE_STORE_HASH = savedStoreHash;
-    if (savedAccessToken !== undefined) process.env.BIGCOMMERCE_ACCESS_TOKEN = savedAccessToken;
+    // Decline the manual-login fallback confirm() — aborts cleanly.
+    confirmMock.mockResolvedValueOnce(false);
+
+    await program.parseAsync(['node', 'catalyst', 'project', 'create']);
+
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
 
-    expect(consola.error).toHaveBeenCalledWith('Insufficient information to create a project.');
     expect(consola.info).toHaveBeenCalledWith(
-      'Provide both --store-hash and --access-token (or set BIGCOMMERCE_STORE_HASH and BIGCOMMERCE_ACCESS_TOKEN).',
+      'Login aborted. Re-run `catalyst project create` when you have your credentials ready.',
     );
-    expect(exitMock).toHaveBeenCalledWith(1);
+    expect(exitMock).toHaveBeenCalledWith(0);
+    expect(config.get('projectUuid')).toBeUndefined();
   });
 
   test('propagates create project API errors', async () => {
@@ -153,32 +314,81 @@ describe('project create', () => {
       ),
     );
 
-    const promptMock = vi.spyOn(consola, 'prompt').mockResolvedValue('Duplicate');
+    inputMock.mockResolvedValue('Duplicate');
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'create',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow('Failed to create project, is the name already in use?');
+  });
 
+  test('propagates 422 validation error', async () => {
+    server.use(
+      http.post('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({}, { status: 422 }),
+      ),
+    );
+
+    inputMock.mockResolvedValue('bad name');
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'create',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow(
+      "The project name you entered doesn't meet the requirements. It must be 3–32 characters long and use only letters, numbers, hyphens (-), underscores (_), and periods (.)",
+    );
+  });
+});
+
+describe('project list', () => {
+  test('fetches and displays projects', async () => {
     await program.parseAsync([
       'node',
       'catalyst',
       'project',
-      'create',
+      'list',
       '--store-hash',
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
-    promptMock.mockRestore();
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
+    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
 
-    expect(consola.error).toHaveBeenCalledWith(
-      'Failed to create project, is the name already in use?',
-    );
-    expect(exitMock).toHaveBeenCalledWith(1);
+    const output = vi
+      .mocked(consola.log)
+      .mock.calls.map(([msg]) => String(msg))
+      .join('\n');
+
+    expect(output).toContain('Project One (a23f5785-fd99-4a94-9fb3-945551623923)');
+    expect(output).toContain('https://project-one.catalyst-sandbox.store');
+    expect(output).toContain('https://vanity.project-one.example.com');
+    expect(output).toContain('Project Two (b23f5785-fd99-4a94-9fb3-945551623924)');
+    expect(output).toContain('(not deployed)');
+    expect(exitMock).toHaveBeenCalledWith(0);
   });
-});
 
-describe('project list', () => {
-  test('fetches and displays projects', async () => {
+  test('marks the currently linked project with [linked]', async () => {
+    config.set('projectUuid', projectUuid2);
+
     await program.parseAsync([
       'node',
       'catalyst',
@@ -190,32 +400,77 @@ describe('project list', () => {
       accessToken,
     ]);
 
-    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
-    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
-    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
-    expect(consola.log).toHaveBeenCalledWith('Project One (a23f5785-fd99-4a94-9fb3-945551623923)');
-    expect(consola.log).toHaveBeenCalledWith('Project Two (b23f5785-fd99-4a94-9fb3-945551623924)');
-    expect(exitMock).toHaveBeenCalledWith(0);
+    const blocks = vi
+      .mocked(consola.log)
+      .mock.calls.map(([msg]) => String(msg))
+      .join('\n')
+      .split('\n\n');
+
+    const linkedBlock = blocks.find((block) => block.includes(projectUuid2));
+    const otherBlock = blocks.find((block) => block.includes(projectUuid1));
+
+    expect(linkedBlock).toContain('[linked]');
+    expect(otherBlock).not.toContain('[linked]');
+  });
+
+  test('does not mark any project when nothing is linked', async () => {
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'list',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    const logCalls = vi.mocked(consola.log).mock.calls.map(([msg]) => String(msg));
+
+    expect(logCalls.every((line) => !line.includes('[linked]'))).toBe(true);
   });
 
   test('with insufficient credentials exits with error', async () => {
-    const savedStoreHash = process.env.BIGCOMMERCE_STORE_HASH;
-    const savedAccessToken = process.env.BIGCOMMERCE_ACCESS_TOKEN;
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
 
-    delete process.env.BIGCOMMERCE_STORE_HASH;
-    delete process.env.BIGCOMMERCE_ACCESS_TOKEN;
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
 
-    await program.parseAsync(['node', 'catalyst', 'project', 'list']);
+    await expect(program.parseAsync(['node', 'catalyst', 'project', 'list'])).rejects.toThrow(
+      'Missing credentials',
+    );
 
-    if (savedStoreHash !== undefined) process.env.BIGCOMMERCE_STORE_HASH = savedStoreHash;
-    if (savedAccessToken !== undefined) process.env.BIGCOMMERCE_ACCESS_TOKEN = savedAccessToken;
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
 
-    expect(consola.error).toHaveBeenCalledWith('Insufficient information to list projects.');
+    expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
     expect(consola.info).toHaveBeenCalledWith(
-      'Provide both --store-hash and --access-token (or set BIGCOMMERCE_STORE_HASH and BIGCOMMERCE_ACCESS_TOKEN).',
+      'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
     );
     expect(exitMock).toHaveBeenCalledWith(1);
   });
+
+  test('surfaces an expired-session error on 401', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({}, { status: 401 }),
+      ),
+    );
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'list',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow('catalyst auth login');
+  });
 });
 
 describe('project link', () => {
@@ -229,12 +484,8 @@ describe('project link', () => {
       expect.arrayContaining([
         expect.objectContaining({ flags: '--store-hash <hash>' }),
         expect.objectContaining({ flags: '--access-token <token>' }),
-        expect.objectContaining({
-          flags: '--api-host <host>',
-          defaultValue: 'api.bigcommerce.com',
-        }),
+        expect.objectContaining({ flags: '--api-host <host>' }),
         expect.objectContaining({ flags: '--project-uuid <uuid>' }),
-        expect.objectContaining({ flags: '--root-dir <path>', defaultValue: process.cwd() }),
       ]),
     );
   });
@@ -247,8 +498,6 @@ describe('project link', () => {
       'link',
       '--project-uuid',
       projectUuid1,
-      '--root-dir',
-      tmpDir,
     ]);
 
     expect(consola.start).toHaveBeenCalledWith(
@@ -259,30 +508,10 @@ describe('project link', () => {
     );
     expect(exitMock).toHaveBeenCalledWith(0);
     expect(config.get('projectUuid')).toBe(projectUuid1);
-    expect(config.get('framework')).toBe('catalyst');
   });
 
   test('fetches projects and prompts user to select one', async () => {
-    const consolaPromptMock = vi
-      .spyOn(consola, 'prompt')
-      .mockImplementation(async (message, opts) => {
-        expect(message).toContain(
-          'Select a project or create a new project (Press <enter> to select).',
-        );
-
-        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        const options = (opts as { options: Array<{ label: string; value: string }> }).options;
-
-        expect(options).toHaveLength(3);
-        expect(options[0]).toMatchObject({ label: 'Project One', value: projectUuid1 });
-        expect(options[1]).toMatchObject({
-          label: 'Project Two',
-          value: projectUuid2,
-        });
-        expect(options[2]).toMatchObject({ label: 'Create a new project', value: 'create' });
-
-        return new Promise((resolve) => resolve(projectUuid2));
-      });
+    selectMock.mockResolvedValueOnce(projectUuid2);
 
     await program.parseAsync([
       'node',
@@ -293,10 +522,24 @@ describe('project link', () => {
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
+    expect(selectMock).toHaveBeenCalledTimes(1);
+
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as {
+      message: string;
+      choices: Array<{ name: string; value: string }>;
+    };
+
+    expect(selectArgs.message).toContain(
+      'Select a project or create a new project (Press <enter> to select).',
+    );
+    expect(selectArgs.choices).toHaveLength(3);
+    expect(selectArgs.choices[0]).toMatchObject({ name: 'Project One', value: projectUuid1 });
+    expect(selectArgs.choices[1]).toMatchObject({ name: 'Project Two', value: projectUuid2 });
+    expect(selectArgs.choices[2]).toMatchObject({ name: 'Create a new project', value: 'create' });
+
     expect(mockIdentify).toHaveBeenCalledWith(storeHash);
 
     expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
@@ -312,37 +555,13 @@ describe('project link', () => {
     expect(exitMock).toHaveBeenCalledWith(0);
 
     expect(config.get('projectUuid')).toBe(projectUuid2);
-    expect(config.get('framework')).toBe('catalyst');
-
-    consolaPromptMock.mockRestore();
+    expect(config.get('storeHash')).toBe(storeHash);
+    expect(config.get('accessToken')).toBe(accessToken);
   });
 
   test('prompts to create a new project', async () => {
-    const consolaPromptMock = vi
-      .spyOn(consola, 'prompt')
-      .mockImplementationOnce(async (message, opts) => {
-        expect(message).toContain(
-          'Select a project or create a new project (Press <enter> to select).',
-        );
-
-        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        const options = (opts as { options: Array<{ label: string; value: string }> }).options;
-
-        expect(options).toHaveLength(3);
-        expect(options[0]).toMatchObject({ label: 'Project One', value: projectUuid1 });
-        expect(options[1]).toMatchObject({
-          label: 'Project Two',
-          value: projectUuid2,
-        });
-        expect(options[2]).toMatchObject({ label: 'Create a new project', value: 'create' });
-
-        return new Promise((resolve) => resolve('create'));
-      })
-      .mockImplementationOnce(async (message) => {
-        expect(message).toBe('Enter a name for the new project:');
-
-        return new Promise((resolve) => resolve('New Project'));
-      });
+    selectMock.mockResolvedValueOnce('create');
+    inputMock.mockResolvedValueOnce('New Project');
 
     await program.parseAsync([
       'node',
@@ -353,10 +572,26 @@ describe('project link', () => {
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as {
+      message: string;
+      choices: Array<{ name: string; value: string }>;
+    };
+
+    expect(selectArgs.message).toContain(
+      'Select a project or create a new project (Press <enter> to select).',
+    );
+    expect(selectArgs.choices).toHaveLength(3);
+    expect(selectArgs.choices[0]).toMatchObject({ name: 'Project One', value: projectUuid1 });
+    expect(selectArgs.choices[1]).toMatchObject({ name: 'Project Two', value: projectUuid2 });
+    expect(selectArgs.choices[2]).toMatchObject({ name: 'Create a new project', value: 'create' });
+
+    expect(inputMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Enter a name for the new project:' }),
+    );
+
     expect(mockIdentify).toHaveBeenCalledWith(storeHash);
 
     expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
@@ -367,9 +602,8 @@ describe('project link', () => {
     expect(exitMock).toHaveBeenCalledWith(0);
 
     expect(config.get('projectUuid')).toBe(projectUuid3);
-    expect(config.get('framework')).toBe('catalyst');
-
-    consolaPromptMock.mockRestore();
+    expect(config.get('storeHash')).toBe(storeHash);
+    expect(config.get('accessToken')).toBe(accessToken);
   });
 
   test('errors when create project API fails', async () => {
@@ -379,31 +613,99 @@ describe('project link', () => {
       ),
     );
 
-    const consolaPromptMock = vi
-      .spyOn(consola, 'prompt')
-      .mockImplementationOnce(async (message, opts) => {
-        expect(message).toContain(
-          'Select a project or create a new project (Press <enter> to select).',
-        );
+    selectMock.mockResolvedValueOnce('create');
+    inputMock.mockResolvedValueOnce('New Project');
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow('Failed to create project, is the name already in use?');
 
-        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        const options = (opts as { options: Array<{ label: string; value: string }> }).options;
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as {
+      message: string;
+      choices: Array<{ name: string; value: string }>;
+    };
 
-        expect(options).toHaveLength(3);
-        expect(options[0]).toMatchObject({ label: 'Project One', value: projectUuid1 });
-        expect(options[1]).toMatchObject({
-          label: 'Project Two',
-          value: projectUuid2,
-        });
-        expect(options[2]).toMatchObject({ label: 'Create a new project', value: 'create' });
+    expect(selectArgs.message).toContain(
+      'Select a project or create a new project (Press <enter> to select).',
+    );
+    expect(selectArgs.choices).toHaveLength(3);
+    expect(selectArgs.choices[0]).toMatchObject({ name: 'Project One', value: projectUuid1 });
+    expect(selectArgs.choices[1]).toMatchObject({ name: 'Project Two', value: projectUuid2 });
+    expect(selectArgs.choices[2]).toMatchObject({ name: 'Create a new project', value: 'create' });
 
-        return new Promise((resolve) => resolve('create'));
-      })
-      .mockImplementationOnce(async (message) => {
-        expect(message).toBe('Enter a name for the new project:');
+    expect(inputMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Enter a name for the new project:' }),
+    );
 
-        return new Promise((resolve) => resolve('New Project'));
-      });
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+
+    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
+    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
+  });
+
+  test('errors when create project returns 422 validation error', async () => {
+    server.use(
+      http.post('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({}, { status: 422 }),
+      ),
+    );
+
+    selectMock.mockResolvedValueOnce('create');
+    inputMock.mockResolvedValueOnce('bad name');
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow(
+      "The project name you entered doesn't meet the requirements. It must be 3–32 characters long and use only letters, numbers, hyphens (-), underscores (_), and periods (.)",
+    );
+
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as {
+      message: string;
+      choices: Array<{ name: string; value: string }>;
+    };
+
+    expect(selectArgs.message).toContain(
+      'Select a project or create a new project (Press <enter> to select).',
+    );
+    expect(selectArgs.choices).toHaveLength(3);
+    expect(selectArgs.choices[0]).toMatchObject({ name: 'Project One', value: projectUuid1 });
+    expect(selectArgs.choices[1]).toMatchObject({ name: 'Project Two', value: projectUuid2 });
+    expect(selectArgs.choices[2]).toMatchObject({ name: 'Create a new project', value: 'create' });
+
+    expect(inputMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Enter a name for the new project:' }),
+    );
+
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+
+    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
+    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
+  });
+
+  test('marks the currently linked project with [linked] in the select prompt', async () => {
+    config.set('projectUuid', projectUuid2);
+
+    selectMock.mockResolvedValueOnce(projectUuid2);
 
     await program.parseAsync([
       'node',
@@ -414,22 +716,47 @@ describe('project link', () => {
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
-    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as unknown as {
+      choices: Array<{ name: string; value: string }>;
+    };
 
-    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
-    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
+    const linkedOption = selectArgs.choices.find((o) => o.value === projectUuid2);
+    const otherOption = selectArgs.choices.find((o) => o.value === projectUuid1);
 
-    expect(consola.error).toHaveBeenCalledWith(
-      'Failed to create project, is the name already in use?',
+    expect(linkedOption?.name).toContain('[linked]');
+    expect(otherOption?.name).not.toContain('[linked]');
+  });
+
+  test('exits gracefully with guidance when user declines to create from empty list', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
     );
 
-    expect(exitMock).toHaveBeenCalledWith(1);
+    // Empty list → confirm() to create; declining throws NoLinkedProjectError.
+    confirmMock.mockResolvedValue(false);
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow('No infrastructure project linked');
 
-    consolaPromptMock.mockRestore();
+    expect(consola.info).toHaveBeenCalledWith(
+      "When you're ready to create a project, run `catalyst project create` or re-run `catalyst project link`.",
+    );
+    expect(exitMock).toHaveBeenCalledWith(0);
   });
 
   test('errors when infrastructure projects API is not found', async () => {
@@ -439,38 +766,425 @@ describe('project link', () => {
       ),
     );
 
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow(
+      'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
+    );
+
+    expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+
+    expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
+  });
+
+  describe('post-link Commerce Hosting setup prompt', () => {
+    test('does not prompt when project is already transformed', async () => {
+      vi.mocked(getProjectState).mockReturnValue(transformedState);
+
+      await program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--project-uuid',
+        projectUuid1,
+      ]);
+
+      const confirmMessages = confirmMock.mock.calls.map(([opts]) => opts.message);
+
+      expect(confirmMessages).not.toContainEqual(
+        expect.stringContaining('not fully set up for Commerce Hosting'),
+      );
+    });
+
+    test('prompts and runs setup when user accepts', async () => {
+      vi.mocked(getProjectState).mockReturnValue(untransformedState);
+
+      confirmMock.mockResolvedValue(true);
+
+      await program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--project-uuid',
+        projectUuid1,
+      ]);
+
+      expect(confirmMock).toHaveBeenCalledTimes(1);
+      expect(confirmMock.mock.calls[0][0].message).toContain(
+        'not fully set up for Commerce Hosting',
+      );
+
+      expect(setupCommerceHosting).toHaveBeenCalledWith(
+        expect.objectContaining({ projectUuid: projectUuid1 }),
+      );
+      expect(installDependencies).toHaveBeenCalled();
+    });
+
+    test('skips setup when user declines', async () => {
+      vi.mocked(getProjectState).mockReturnValue(untransformedState);
+
+      confirmMock.mockResolvedValue(false);
+
+      await program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'link',
+        '--project-uuid',
+        projectUuid1,
+      ]);
+
+      expect(setupCommerceHosting).not.toHaveBeenCalled();
+      expect(installDependencies).not.toHaveBeenCalled();
+    });
+  });
+
+  test('errors when no projectUuid, storeHash, or accessToken are provided', async () => {
+    await expect(program.parseAsync(['node', 'catalyst', 'project', 'link'])).rejects.toThrow(
+      'Missing credentials',
+    );
+
+    expect(consola.start).not.toHaveBeenCalled();
+    expect(consola.success).not.toHaveBeenCalled();
+    expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+    expect(consola.info).toHaveBeenCalledWith(
+      'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
+    );
+
+    expect(exitMock).toHaveBeenCalledWith(1);
+  });
+});
+
+describe('project delete', () => {
+  test('with --project-uuid and --force deletes without prompting', async () => {
     await program.parseAsync([
       'node',
       'catalyst',
       'project',
-      'link',
+      'delete',
+      '--project-uuid',
+      projectUuid1,
+      '--force',
       '--store-hash',
       storeHash,
       '--access-token',
       accessToken,
-      '--root-dir',
-      tmpDir,
     ]);
 
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(confirmMock).not.toHaveBeenCalled();
     expect(mockIdentify).toHaveBeenCalledWith(storeHash);
+    expect(consola.start).toHaveBeenCalledWith(`Deleting project ${projectUuid1}...`);
+    expect(consola.success).toHaveBeenCalledWith(`Project ${projectUuid1} deleted.`);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('with --project-uuid prompts for confirmation and deletes on accept', async () => {
+    confirmMock.mockResolvedValue(true);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--project-uuid',
+      projectUuid1,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(confirmMock).toHaveBeenCalledTimes(1);
+
+    const confirmArgs = confirmMock.mock.calls[0][0];
+
+    expect(confirmArgs.message).toContain('Are you sure you want to delete project');
+    expect(confirmArgs.message).toContain(projectUuid1);
+    expect(confirmArgs.message).toContain('irreversible');
+    expect(confirmArgs.default).toBe(false);
+
+    expect(consola.success).toHaveBeenCalledWith(`Project ${projectUuid1} deleted.`);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('aborts when user declines the confirmation prompt', async () => {
+    let deleteRequested = false;
+
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid',
+        () => {
+          deleteRequested = true;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
+    );
+
+    confirmMock.mockResolvedValue(false);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--project-uuid',
+      projectUuid1,
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(deleteRequested).toBe(false);
+    expect(consola.info).toHaveBeenCalledWith('Aborted. No project was deleted.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('without --project-uuid fetches projects and prompts to select one', async () => {
+    selectMock.mockResolvedValueOnce(projectUuid2);
+    confirmMock.mockResolvedValueOnce(true);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as {
+      message: string;
+      choices: Array<{ name: string; value: string }>;
+    };
+
+    expect(selectArgs.message).toContain('Select a project to delete');
+    expect(selectArgs.choices).toHaveLength(3);
+    expect(selectArgs.choices[0]).toMatchObject({ name: 'Project One', value: projectUuid1 });
+    expect(selectArgs.choices[1]).toMatchObject({ name: 'Project Two', value: projectUuid2 });
+    expect(selectArgs.choices[2]).toMatchObject({ name: 'Cancel', value: 'cancel' });
+
+    const confirmArgs = confirmMock.mock.calls[0][0];
+
+    expect(confirmArgs.message).toContain('"Project Two"');
+    expect(confirmArgs.message).toContain(projectUuid2);
 
     expect(consola.start).toHaveBeenCalledWith('Fetching projects...');
-    expect(consola.error).toHaveBeenCalledWith(
-      'Infrastructure Projects API not enabled. If you are part of the alpha, contact support@bigcommerce.com to enable it.',
+    expect(consola.success).toHaveBeenCalledWith('Projects fetched.');
+    expect(consola.success).toHaveBeenCalledWith(`Project ${projectUuid2} deleted.`);
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('marks the currently linked project with [linked] in the select prompt', async () => {
+    config.set('projectUuid', projectUuid2);
+
+    selectMock.mockResolvedValueOnce(projectUuid1);
+    confirmMock.mockResolvedValueOnce(true);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const selectArgs = selectMock.mock.calls[0][0] as unknown as {
+      choices: Array<{ name: string; value: string }>;
+    };
+
+    const linkedOption = selectArgs.choices.find((o) => o.value === projectUuid2);
+    const otherOption = selectArgs.choices.find((o) => o.value === projectUuid1);
+
+    expect(linkedOption?.name).toContain('[linked]');
+    expect(otherOption?.name).not.toContain('[linked]');
+  });
+
+  test('aborts when user selects Cancel from the project list', async () => {
+    let deleteRequested = false;
+
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid',
+        () => {
+          deleteRequested = true;
+
+          return new HttpResponse(null, { status: 204 });
+        },
+      ),
     );
+
+    selectMock.mockResolvedValue('cancel');
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(selectMock).toHaveBeenCalledTimes(1);
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(deleteRequested).toBe(false);
+    expect(consola.info).toHaveBeenCalledWith('Aborted. No project was deleted.');
+    expect(exitMock).toHaveBeenCalledWith(0);
   });
 
-  test('errors when no projectUuid, storeHash, or accessToken are provided', async () => {
-    await program.parseAsync(['node', 'catalyst', 'project', 'link', '--root-dir', tmpDir]);
+  test('exits cleanly when there are no projects to delete', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
 
-    expect(consola.start).not.toHaveBeenCalled();
-    expect(consola.success).not.toHaveBeenCalled();
-    expect(consola.error).toHaveBeenCalledWith('Insufficient information to link a project.');
-    expect(consola.info).toHaveBeenCalledWith('Provide a project UUID with --project-uuid, or');
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--store-hash',
+      storeHash,
+      '--access-token',
+      accessToken,
+    ]);
+
+    expect(consola.info).toHaveBeenCalledWith('No projects found.');
+    expect(exitMock).toHaveBeenCalledWith(0);
+  });
+
+  test('clears linked projectUuid from config when the deleted project was linked', async () => {
+    config.set('projectUuid', projectUuid1);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--project-uuid',
+      projectUuid1,
+      '--force',
+    ]);
+
+    expect(config.get('projectUuid')).toBeUndefined();
     expect(consola.info).toHaveBeenCalledWith(
-      'Provide both --store-hash and --access-token to fetch and select a project.',
+      'Removed project UUID from .bigcommerce/project.json.',
+    );
+  });
+
+  test('preserves linked projectUuid when a different project is deleted', async () => {
+    config.set('projectUuid', projectUuid2);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+
+    await program.parseAsync([
+      'node',
+      'catalyst',
+      'project',
+      'delete',
+      '--project-uuid',
+      projectUuid1,
+      '--force',
+    ]);
+
+    expect(config.get('projectUuid')).toBe(projectUuid2);
+    expect(consola.info).not.toHaveBeenCalledWith(
+      'Removed project UUID from .bigcommerce/project.json.',
+    );
+  });
+
+  test('with insufficient credentials exits with error', async () => {
+    const savedStoreHash = process.env.CATALYST_STORE_HASH;
+    const savedAccessToken = process.env.CATALYST_ACCESS_TOKEN;
+
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+
+    await expect(program.parseAsync(['node', 'catalyst', 'project', 'delete'])).rejects.toThrow(
+      'Missing credentials',
     );
 
+    if (savedStoreHash !== undefined) process.env.CATALYST_STORE_HASH = savedStoreHash;
+    if (savedAccessToken !== undefined) process.env.CATALYST_ACCESS_TOKEN = savedAccessToken;
+
+    expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
     expect(exitMock).toHaveBeenCalledWith(1);
   });
+
+  test('throws when API returns 404', async () => {
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid',
+        () => HttpResponse.json({}, { status: 404 }),
+      ),
+    );
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'delete',
+        '--project-uuid',
+        projectUuid1,
+        '--force',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow(`Project ${projectUuid1} not found.`);
+  });
+
+  test('throws when API returns 403', async () => {
+    server.use(
+      http.delete(
+        'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid',
+        () => HttpResponse.json({}, { status: 403 }),
+      ),
+    );
+
+    await expect(
+      program.parseAsync([
+        'node',
+        'catalyst',
+        'project',
+        'delete',
+        '--project-uuid',
+        projectUuid1,
+        '--force',
+        '--store-hash',
+        storeHash,
+        '--access-token',
+        accessToken,
+      ]),
+    ).rejects.toThrow(
+      'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
+    );
+  });
 });
diff --git a/packages/catalyst/src/cli/commands/project.ts b/packages/catalyst/src/cli/commands/project.ts
index a97980e2e2..25864914c7 100644
--- a/packages/catalyst/src/cli/commands/project.ts
+++ b/packages/catalyst/src/cli/commands/project.ts
@@ -1,252 +1,385 @@
-import { Command, Option } from 'commander';
-
+import { confirm, input, select } from '@inquirer/prompts';
+import { Command } from 'commander';
+import { colorize } from 'consola/utils';
+
+import {
+  cleanupCloudflareIncompatibilities,
+  NoLinkedProjectError,
+  selectOrCreateInfrastructureProject,
+  setupCommerceHosting,
+} from '../lib/commerce-hosting';
+import { detectProjectPackageManager } from '../lib/detect-package-manager';
+import { installDependencies } from '../lib/install-dependencies';
 import { consola } from '../lib/logger';
-import { createProject, fetchProjects } from '../lib/project';
+import { LoginAbortedError, login as runInteractiveLogin } from '../lib/login';
+import { createProject, deleteProject, fetchProjects } from '../lib/project';
 import { getProjectConfig } from '../lib/project-config';
-import { Telemetry } from '../lib/telemetry';
+import { getProjectState } from '../lib/project-state';
+import { resolveCredentials } from '../lib/resolve-credentials';
+import {
+  accessTokenOption,
+  apiHostOption,
+  loginUrlOption,
+  projectUuidOption,
+  resolveApiHost,
+  storeHashOption,
+} from '../lib/shared-options';
+import { getTelemetry } from '../lib/telemetry';
+
+// `catalyst project link` runs from the project root, which is what
+// `setupCommerceHosting` and `installDependencies` expect.
+async function offerCommerceHostingSetup(
+  projectUuid: string,
+  credentials?: { storeHash: string; accessToken: string },
+) {
+  const projectDir = process.cwd();
+
+  // Already-transformed projects skip the setup prompt below — but they may
+  // still carry artifacts incompatible with the Cloudflare worker bundle
+  // (e.g. `core/instrumentation.ts`, `@vercel/otel`). Run cleanup so existing
+  // Commerce Hosting users pick up these fixes on re-link without prompting.
+  if (getProjectState().isTransformed) {
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    return;
+  }
+
+  const shouldSetup = await confirm({
+    message:
+      'Your project has been linked, but is not fully set up for Commerce Hosting deployments yet. Would you like to run the setup now?',
+    default: true,
+  });
+
+  if (!shouldSetup) return;
+
+  await setupCommerceHosting({
+    projectDir,
+    projectUuid,
+    storeHash: credentials?.storeHash,
+    accessToken: credentials?.accessToken,
+  });
+
+  consola.success('Commerce Hosting setup complete.');
 
-const telemetry = new Telemetry();
+  // Match the manager the project was scaffolded with (from its lockfile),
+  // rather than forcing pnpm on npm/yarn/bun projects.
+  const packageManager = await detectProjectPackageManager(projectDir);
+
+  await installDependencies(projectDir, packageManager);
+}
 
 const list = new Command('list')
+  .configureHelp({ showGlobalOptions: true })
   .description('List BigCommerce infrastructure projects for your store.')
-  .addOption(
-    new Option(
-      '--store-hash <hash>',
-      'BigCommerce store hash. Can be found in the URL of your store Control Panel.',
-    ).env('BIGCOMMERCE_STORE_HASH'),
-  )
-  .addOption(
-    new Option(
-      '--access-token <token>',
-      'BigCommerce access token. Can be found after creating a store-level API account.',
-    ).env('BIGCOMMERCE_ACCESS_TOKEN'),
-  )
-  .addOption(
-    new Option('--api-host <host>', 'BigCommerce API host. The default is api.bigcommerce.com.')
-      .env('BIGCOMMERCE_API_HOST')
-      .default('api.bigcommerce.com'),
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst project list`,
   )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
   .action(async (options) => {
-    try {
-      if (!options.storeHash || !options.accessToken) {
-        consola.error('Insufficient information to list projects.');
-        consola.info(
-          'Provide both --store-hash and --access-token (or set BIGCOMMERCE_STORE_HASH and BIGCOMMERCE_ACCESS_TOKEN).',
-        );
-        process.exit(1);
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+    const { storeHash, accessToken } = resolveCredentials(options, config);
 
-        return;
-      }
+    await getTelemetry().identify(storeHash);
 
-      await telemetry.identify(options.storeHash);
+    consola.start('Fetching projects...');
 
-      consola.start('Fetching projects...');
+    const projects = await fetchProjects(storeHash, accessToken, apiHost);
 
-      const projects = await fetchProjects(options.storeHash, options.accessToken, options.apiHost);
+    consola.success('Projects fetched.');
 
-      consola.success('Projects fetched.');
+    if (projects.length === 0) {
+      consola.info('No projects found.');
+      process.exit(0);
 
-      if (projects.length === 0) {
-        consola.info('No projects found.');
-        process.exit(0);
+      return;
+    }
 
-        return;
-      }
+    const linkedProjectUuid = config.get('projectUuid');
 
-      projects.forEach((p) => {
-        consola.log(`${p.name} (${p.uuid})`);
-      });
+    const projectList = projects.map((p) => {
+      const marker = p.uuid === linkedProjectUuid ? ` ${colorize('green', '[linked]')}` : '';
+      const hostnames =
+        p.deployment_hostnames.length === 0
+          ? ['  (not deployed)']
+          : p.deployment_hostnames.map(
+              (hostname) => `  ${colorize('blue', `https://${hostname}`)}`,
+            );
 
-      process.exit(0);
-    } catch (error) {
-      consola.error(error instanceof Error ? error.message : error);
-      process.exit(1);
-    }
+      return [`${p.name} (${p.uuid})${marker}`, ...hostnames].join('\n');
+    });
+
+    // Single log call so projects are blank-line separated without each blank
+    // picking up a reporter timestamp.
+    consola.log(projectList.join('\n\n'));
+
+    process.exit(0);
   });
 
 const create = new Command('create')
+  .configureHelp({ showGlobalOptions: true })
   .description(
-    'Create a new BigCommerce infrastructure project and link it to your local Catalyst project.',
+    'Create a new BigCommerce infrastructure project and link it to your local Catalyst project. Walks you through logging in if you are not authenticated yet.',
   )
-  .addOption(
-    new Option(
-      '--store-hash <hash>',
-      'BigCommerce store hash. Can be found in the URL of your store Control Panel.',
-    ).env('BIGCOMMERCE_STORE_HASH'),
-  )
-  .addOption(
-    new Option(
-      '--access-token <token>',
-      'BigCommerce access token. Can be found after creating a store-level API account.',
-    ).env('BIGCOMMERCE_ACCESS_TOKEN'),
-  )
-  .addOption(
-    new Option('--api-host <host>', 'BigCommerce API host. The default is api.bigcommerce.com.')
-      .env('BIGCOMMERCE_API_HOST')
-      .default('api.bigcommerce.com'),
-  )
-  .option(
-    '--root-dir <path>',
-    'Path to the root directory of your Catalyst project (default: current working directory).',
-    process.cwd(),
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst project create`,
   )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(loginUrlOption())
   .action(async (options) => {
-    try {
-      if (!options.storeHash || !options.accessToken) {
-        consola.error('Insufficient information to create a project.');
-        consola.info(
-          'Provide both --store-hash and --access-token (or set BIGCOMMERCE_STORE_HASH and BIGCOMMERCE_ACCESS_TOKEN).',
-        );
-        process.exit(1);
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
 
-        return;
+    let storeHash = options.storeHash ?? config.get('storeHash');
+    let accessToken = options.accessToken ?? config.get('accessToken');
+
+    if (!storeHash || !accessToken) {
+      consola.info(
+        "You're not logged in yet. Let's get you authenticated before creating a project.",
+      );
+
+      try {
+        const credentials = await runInteractiveLogin(options.loginUrl, apiHost);
+
+        storeHash = credentials.storeHash;
+        accessToken = credentials.accessToken;
+
+        config.set('storeHash', storeHash);
+        config.set('accessToken', accessToken);
+
+        consola.success(`Logged in to store ${storeHash}.`);
+      } catch (error) {
+        if (error instanceof LoginAbortedError) {
+          consola.info(
+            'Login aborted. Re-run `catalyst project create` when you have your credentials ready.',
+          );
+          process.exit(0);
+
+          return;
+        }
+
+        throw error;
       }
+    }
 
-      await telemetry.identify(options.storeHash);
+    await getTelemetry().identify(storeHash);
 
-      const newProjectName = await consola.prompt('Enter a name for the new project:', {
-        type: 'text',
-      });
+    const newProjectName = await input({ message: 'Enter a name for the new project:' });
 
-      const data = await createProject(
-        newProjectName,
-        options.storeHash,
-        options.accessToken,
-        options.apiHost,
-      );
+    const data = await createProject(newProjectName, storeHash, accessToken, apiHost);
+
+    consola.success(`Project "${data.name}" created successfully.`);
+
+    consola.start('Writing project UUID to .bigcommerce/project.json...');
+    config.set('projectUuid', data.uuid);
+    config.set('storeHash', storeHash);
+    config.set('accessToken', accessToken);
+    consola.success('Project UUID written to .bigcommerce/project.json.');
 
-      consola.success(`Project "${data.name}" created successfully.`);
+    process.exit(0);
+  });
 
-      const config = getProjectConfig(options.rootDir);
+export const link = new Command('link')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Link your local Catalyst project to a BigCommerce infrastructure project. You can provide a project UUID directly, or fetch and select from available projects using your store credentials.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Link interactively (prompts to select or create)
+  $ catalyst project link
+
+  # Link using a project UUID directly
+  $ catalyst project link --project-uuid <UUID>`,
+  )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .action(async (options) => {
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
 
+    const writeProjectConfig = (
+      uuid: string,
+      credentials?: { storeHash: string; accessToken: string },
+    ) => {
       consola.start('Writing project UUID to .bigcommerce/project.json...');
-      config.set('projectUuid', data.uuid);
-      config.set('framework', 'catalyst');
+      config.set('projectUuid', uuid);
+
+      if (credentials) {
+        config.set('storeHash', credentials.storeHash);
+        config.set('accessToken', credentials.accessToken);
+      }
+
       consola.success('Project UUID written to .bigcommerce/project.json.');
+    };
+
+    if (options.projectUuid) {
+      writeProjectConfig(options.projectUuid);
+      await offerCommerceHostingSetup(options.projectUuid);
 
       process.exit(0);
+
+      return;
+    }
+
+    const { storeHash, accessToken } = resolveCredentials(options, config);
+
+    await getTelemetry().identify(storeHash);
+
+    let selected;
+
+    try {
+      selected = await selectOrCreateInfrastructureProject(
+        { storeHash, accessToken, apiHost },
+        config.get('projectUuid'),
+      );
     } catch (error) {
-      consola.error(error instanceof Error ? error.message : error);
-      process.exit(1);
+      if (error instanceof NoLinkedProjectError) {
+        consola.info(
+          "When you're ready to create a project, run `catalyst project create` or re-run `catalyst project link`.",
+        );
+        process.exit(0);
+
+        // Unreachable in production; prevents continuation when process.exit is mocked in tests.
+        throw error;
+      }
+
+      throw error;
     }
+
+    writeProjectConfig(selected.uuid, { storeHash, accessToken });
+    await offerCommerceHostingSetup(selected.uuid, { storeHash, accessToken });
+
+    process.exit(0);
   });
 
-export const link = new Command('link')
+const del = new Command('delete')
+  .configureHelp({ showGlobalOptions: true })
   .description(
-    'Link your local Catalyst project to a BigCommerce infrastructure project. You can provide a project UUID directly, or fetch and select from available projects using your store credentials.',
+    'Permanently delete a BigCommerce infrastructure project. This action is irreversible.',
   )
-  .addOption(
-    new Option(
-      '--store-hash <hash>',
-      'BigCommerce store hash. Can be found in the URL of your store Control Panel.',
-    ).env('BIGCOMMERCE_STORE_HASH'),
-  )
-  .addOption(
-    new Option(
-      '--access-token <token>',
-      'BigCommerce access token. Can be found after creating a store-level API account.',
-    ).env('BIGCOMMERCE_ACCESS_TOKEN'),
-  )
-  .addOption(
-    new Option('--api-host <host>', 'BigCommerce API host. The default is api.bigcommerce.com.')
-      .env('BIGCOMMERCE_API_HOST')
-      .default('api.bigcommerce.com'),
-  )
-  .option(
-    '--project-uuid <uuid>',
-    'BigCommerce infrastructure project UUID. Can be found via the BigCommerce API (GET /v3/infrastructure/projects). Use this to link directly without fetching projects.',
-  )
-  .option(
-    '--root-dir <path>',
-    'Path to the root directory of your Catalyst project (default: current working directory).',
-    process.cwd(),
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Select a project to delete interactively
+  $ catalyst project delete
+
+  # Delete a specific project (still prompts for confirmation)
+  $ catalyst project delete --project-uuid <UUID>
+
+  # Skip the confirmation prompt
+  $ catalyst project delete --project-uuid <UUID> --force`,
   )
+  .addOption(storeHashOption())
+  .addOption(accessTokenOption())
+  .addOption(apiHostOption())
+  .addOption(projectUuidOption())
+  .option('--force', 'Skip the confirmation prompt before deleting.')
   .action(async (options) => {
-    try {
-      const config = getProjectConfig(options.rootDir);
+    const config = getProjectConfig();
+    const apiHost = resolveApiHost(options, config);
+    const { storeHash, accessToken } = resolveCredentials(options, config);
 
-      const writeProjectConfig = (uuid: string) => {
-        consola.start('Writing project UUID to .bigcommerce/project.json...');
-        config.set('projectUuid', uuid);
-        config.set('framework', 'catalyst');
-        consola.success('Project UUID written to .bigcommerce/project.json.');
-      };
+    await getTelemetry().identify(storeHash);
 
-      if (options.projectUuid) {
-        writeProjectConfig(options.projectUuid);
+    let targetUuid: string | undefined = options.projectUuid;
+    let targetName: string | undefined;
 
-        process.exit(0);
-      }
+    if (!targetUuid) {
+      consola.start('Fetching projects...');
 
-      if (options.storeHash && options.accessToken) {
-        await telemetry.identify(options.storeHash);
+      const projects = await fetchProjects(storeHash, accessToken, apiHost);
 
-        consola.start('Fetching projects...');
+      consola.success('Projects fetched.');
 
-        const projects = await fetchProjects(
-          options.storeHash,
-          options.accessToken,
-          options.apiHost,
-        );
+      if (projects.length === 0) {
+        consola.info('No projects found.');
+        process.exit(0);
 
-        consola.success('Projects fetched.');
+        return;
+      }
 
-        const promptOptions = [
-          ...projects.map((proj) => ({
-            label: proj.name,
-            value: proj.uuid,
-            hint: proj.uuid,
+      const linkedProjectUuid = config.get('projectUuid');
+
+      const selected = await select({
+        message: 'Select a project to delete (Press <enter> to select).',
+        choices: [
+          ...projects.map((p) => ({
+            name:
+              p.uuid === linkedProjectUuid ? `${p.name} ${colorize('green', '[linked]')}` : p.name,
+            value: p.uuid,
+            description: p.uuid,
           })),
-          {
-            label: 'Create a new project',
-            value: 'create',
-            hint: 'Create a new infrastructure project for this BigCommerce store.',
-          },
-        ];
-
-        let projectUuid = await consola.prompt(
-          'Select a project or create a new project (Press <enter> to select).',
-          {
-            type: 'select',
-            options: promptOptions,
-            cancel: 'reject',
-          },
-        );
+          { name: 'Cancel', value: 'cancel', description: 'Exit without deleting any project.' },
+        ],
+      });
 
-        if (projectUuid === 'create') {
-          const newProjectName = await consola.prompt('Enter a name for the new project:', {
-            type: 'text',
-          });
+      if (selected === 'cancel') {
+        consola.info('Aborted. No project was deleted.');
+        process.exit(0);
 
-          const data = await createProject(
-            newProjectName,
-            options.storeHash,
-            options.accessToken,
-            options.apiHost,
-          );
+        return;
+      }
 
-          projectUuid = data.uuid;
+      const matched = projects.find((p) => p.uuid === selected);
 
-          consola.success(`Project "${data.name}" created successfully.`);
-        }
+      if (!matched) {
+        throw new Error(`Selected project ${String(selected)} not found in fetched list.`);
+      }
+
+      targetUuid = matched.uuid;
+      targetName = matched.name;
+    }
 
-        writeProjectConfig(projectUuid);
+    if (!options.force) {
+      const label = targetName ? `"${targetName}" (${targetUuid})` : targetUuid;
 
+      const confirmed = await confirm({
+        message: `Are you sure you want to delete project ${label}? This action is irreversible and will permanently destroy the project and all of its data.`,
+        default: false,
+      });
+
+      if (!confirmed) {
+        consola.info('Aborted. No project was deleted.');
         process.exit(0);
+
+        return;
       }
+    }
 
-      consola.error('Insufficient information to link a project.');
-      consola.info('Provide a project UUID with --project-uuid, or');
-      consola.info('Provide both --store-hash and --access-token to fetch and select a project.');
-      process.exit(1);
-    } catch (error) {
-      consola.error(error instanceof Error ? error.message : error);
-      process.exit(1);
+    consola.start(`Deleting project ${targetUuid}...`);
+
+    await deleteProject(targetUuid, storeHash, accessToken, apiHost);
+
+    consola.success(`Project ${targetUuid} deleted.`);
+
+    if (config.get('projectUuid') === targetUuid) {
+      config.delete('projectUuid');
+      consola.info('Removed project UUID from .bigcommerce/project.json.');
     }
+
+    process.exit(0);
   });
 
 export const project = new Command('project')
+  .configureHelp({ showGlobalOptions: true })
   .description('Manage your BigCommerce infrastructure project.')
   .addCommand(create)
   .addCommand(list)
-  .addCommand(link);
+  .addCommand(link)
+  .addCommand(del);
diff --git a/packages/catalyst/src/cli/commands/start.spec.ts b/packages/catalyst/src/cli/commands/start.spec.ts
index 6a28be025a..b442d00184 100644
--- a/packages/catalyst/src/cli/commands/start.spec.ts
+++ b/packages/catalyst/src/cli/commands/start.spec.ts
@@ -1,15 +1,19 @@
 import { Command } from 'commander';
 import { execa } from 'execa';
+import { existsSync, lstatSync, symlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { afterEach, beforeAll, beforeEach, expect, test, vi } from 'vitest';
 
 import { consola } from '../lib/logger';
+import { getProjectState } from '../lib/project-state';
 import { program } from '../program';
 
 import { start } from './start';
 
 vi.mock('node:fs', () => ({
-  existsSync: vi.fn(() => true),
+  existsSync: vi.fn(() => false),
+  lstatSync: vi.fn(),
+  symlinkSync: vi.fn(),
 }));
 
 vi.mock('execa', () => ({
@@ -17,24 +21,37 @@ vi.mock('execa', () => ({
   __esModule: true,
 }));
 
-vi.mock('../../src/lib/project-config', () => ({
-  getProjectConfig: vi.fn(() => ({
-    get: vi.fn((key) => {
-      if (key === 'framework') {
-        return 'catalyst';
-      }
-
-      return undefined;
-    }),
-  })),
+vi.mock('../lib/project-state', () => ({
+  getProjectState: vi.fn(),
 }));
 
+const transformedState = {
+  projectUuid: 'abc-123',
+  hasMiddleware: true,
+  hasProxy: false,
+  hasOpenNextDep: true,
+  isLinked: true,
+  isTransformed: true,
+  isFullySetUp: true,
+};
+
+const untransformedState = {
+  projectUuid: undefined,
+  hasMiddleware: false,
+  hasProxy: true,
+  hasOpenNextDep: false,
+  isLinked: false,
+  isTransformed: false,
+  isFullySetUp: false,
+};
+
 beforeAll(() => {
   consola.wrapAll();
 });
 
 beforeEach(() => {
   consola.mockTypes(() => vi.fn());
+  vi.mocked(getProjectState).mockReturnValue(transformedState);
 });
 
 afterEach(() => {
@@ -44,48 +61,13 @@ afterEach(() => {
 test('properly configured Command instance', () => {
   expect(start).toBeInstanceOf(Command);
   expect(start.name()).toBe('start');
-  expect(start.description()).toBe('Start your Catalyst storefront in optimized production mode.');
-  expect(start.options).toEqual(
-    expect.arrayContaining([
-      expect.objectContaining({
-        flags: '--framework <framework>',
-        argChoices: ['catalyst', 'nextjs'],
-      }),
-    ]),
-  );
-});
-
-test('calls execa with Next.js production optimized server', async () => {
-  await program.parseAsync([
-    'node',
-    'catalyst',
-    'start',
-    '--port',
-    '3001',
-    '--framework',
-    'nextjs',
-  ]);
-
-  expect(execa).toHaveBeenCalledWith(
-    join('node_modules', '.bin', 'next'),
-    ['start', '--port', '3001'],
-    expect.objectContaining({
-      stdio: 'inherit',
-      cwd: process.cwd(),
-    }),
+  expect(start.description()).toBe(
+    'Start a local preview of your Catalyst storefront using the OpenNext Cloudflare adapter.',
   );
 });
 
 test('calls execa with OpenNext production optimized server', async () => {
-  await program.parseAsync([
-    'node',
-    'catalyst',
-    'start',
-    '--port',
-    '3001',
-    '--framework',
-    'catalyst',
-  ]);
+  await program.parseAsync(['node', 'catalyst', 'start']);
 
   expect(execa).toHaveBeenCalledWith(
     'pnpm',
@@ -95,8 +77,6 @@ test('calls execa with OpenNext production optimized server', async () => {
       'preview',
       '--config',
       join('.bigcommerce', 'wrangler.jsonc'),
-      '--port',
-      '3001',
     ],
     expect.objectContaining({
       stdio: 'inherit',
@@ -104,3 +84,51 @@ test('calls execa with OpenNext production optimized server', async () => {
     }),
   );
 });
+
+test('creates symlink when .env.local exists but .dev.vars does not', async () => {
+  vi.mocked(existsSync).mockImplementation((p) => {
+    if (String(p).endsWith('.env.local')) return true;
+
+    return false;
+  });
+
+  await program.parseAsync(['node', 'catalyst', 'start']);
+
+  expect(symlinkSync).toHaveBeenCalledWith(
+    expect.stringContaining('.env.local'),
+    expect.stringContaining('.dev.vars'),
+  );
+});
+
+test('warns when .dev.vars exists and is not a symlink', async () => {
+  vi.mocked(existsSync).mockReturnValue(true);
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- partial mock
+  vi.mocked(lstatSync).mockReturnValue({
+    isSymbolicLink: () => false,
+  } as ReturnType<typeof lstatSync>);
+
+  await program.parseAsync(['node', 'catalyst', 'start']);
+
+  expect(symlinkSync).not.toHaveBeenCalled();
+});
+
+test('warns when .env.local does not exist', async () => {
+  vi.mocked(existsSync).mockReturnValue(false);
+
+  await program.parseAsync(['node', 'catalyst', 'start']);
+
+  expect(symlinkSync).not.toHaveBeenCalled();
+});
+
+test('falls through to `next start` when project is not transformed', async () => {
+  vi.mocked(getProjectState).mockReturnValue(untransformedState);
+
+  await program.parseAsync(['node', 'catalyst', 'start']);
+
+  expect(execa).toHaveBeenCalledWith(
+    'pnpm',
+    ['exec', 'next', 'start'],
+    expect.objectContaining({ stdio: 'inherit', cwd: process.cwd() }),
+  );
+  expect(symlinkSync).not.toHaveBeenCalled();
+});
diff --git a/packages/catalyst/src/cli/commands/start.ts b/packages/catalyst/src/cli/commands/start.ts
index 2a0c68cbe3..9d1749ad9e 100644
--- a/packages/catalyst/src/cli/commands/start.ts
+++ b/packages/catalyst/src/cli/commands/start.ts
@@ -1,61 +1,73 @@
-import { Command, Option } from 'commander';
+import { Command } from 'commander';
 import { execa } from 'execa';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, lstatSync, symlinkSync } from 'node:fs';
+import { join, relative } from 'node:path';
 
 import { consola } from '../lib/logger';
-import { getProjectConfig } from '../lib/project-config';
+import { getProjectState } from '../lib/project-state';
 
 export const start = new Command('start')
-  .description('Start your Catalyst storefront in optimized production mode.')
-  .allowUnknownOption(true)
-  // The unknown options end up in program.args, not in program.opts(). Commander does not take a guess at how to interpret the unknown options.
-  .argument(
-    '[start-options...]',
-    'Pass additional options to the start command. If framework is Next.js, see https://nextjs.org/docs/api-reference/cli#start for available options.',
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'Start a local preview of your Catalyst storefront using the OpenNext Cloudflare adapter.',
   )
-  .addOption(
-    new Option('--framework <framework>', 'The framework to use for the preview').choices([
-      'catalyst',
-      'nextjs',
-    ]),
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst start`,
   )
-  .action(async (startOptions, options) => {
-    try {
-      const config = getProjectConfig();
-      const framework = options.framework ?? config.get('framework');
-
-      if (framework === 'nextjs') {
-        const nextBin = join('node_modules', '.bin', 'next');
-
-        if (!existsSync(nextBin)) {
-          throw new Error(
-            `Next.js is not installed in ${process.cwd()}. Are you in a valid Next.js project?`,
-          );
-        }
-
-        await execa(nextBin, ['start', ...startOptions], {
-          stdio: 'inherit',
-          cwd: process.cwd(),
-        });
-      }
+  .action(async () => {
+    // Project must be transformed before the OpenNext preview can run. If it
+    // isn't, fall through to `next start` so this command works for self-hosted
+    // Catalyst projects too.
+    const state = getProjectState();
+
+    if (!state.isTransformed) {
+      consola.info('Project is not set up for Commerce Hosting — running `next start`.');
+
+      await execa('pnpm', ['exec', 'next', 'start'], {
+        stdio: 'inherit',
+        cwd: process.cwd(),
+      });
+
+      return;
+    }
 
-      await execa(
-        'pnpm',
-        [
-          'exec',
-          'opennextjs-cloudflare',
-          'preview',
-          '--config',
-          join('.bigcommerce', 'wrangler.jsonc'),
-          ...startOptions,
-        ],
-        {
-          stdio: 'inherit',
-          cwd: process.cwd(),
-        },
+    const envLocal = join(process.cwd(), '.env.local');
+    const devVars = join(process.cwd(), '.bigcommerce', '.dev.vars');
+
+    if (existsSync(envLocal)) {
+      if (!existsSync(devVars)) {
+        const target = relative(join(process.cwd(), '.bigcommerce'), envLocal);
+
+        symlinkSync(target, devVars);
+        consola.success('Symlinked .bigcommerce/.dev.vars → .env.local');
+      } else if (!lstatSync(devVars).isSymbolicLink()) {
+        consola.warn(
+          '.bigcommerce/.dev.vars already exists and is not a symlink. ' +
+            'Wrangler will use it instead of .env.local.',
+        );
+      }
+    } else {
+      consola.warn(
+        'No .env.local file found. The preview server may fail without environment variables.\n' +
+          'Create a .env.local file in your project root with the required variables.',
       );
-    } catch (error) {
-      consola.error(error instanceof Error ? error.message : error);
     }
+
+    await execa(
+      'pnpm',
+      [
+        'exec',
+        'opennextjs-cloudflare',
+        'preview',
+        '--config',
+        join('.bigcommerce', 'wrangler.jsonc'),
+      ],
+      {
+        stdio: 'inherit',
+        cwd: process.cwd(),
+      },
+    );
   });
diff --git a/packages/catalyst/src/cli/commands/telemetry.ts b/packages/catalyst/src/cli/commands/telemetry.ts
index a08958374e..9075e73dcb 100644
--- a/packages/catalyst/src/cli/commands/telemetry.ts
+++ b/packages/catalyst/src/cli/commands/telemetry.ts
@@ -2,12 +2,29 @@ import { Argument, Command, Option } from 'commander';
 import { colorize } from 'consola/utils';
 
 import { consola } from '../lib/logger';
-import { Telemetry } from '../lib/telemetry';
+import { getTelemetry } from '../lib/telemetry';
 
-const telemetryService = new Telemetry();
+const telemetryService = getTelemetry();
 let isEnabled = telemetryService.isEnabled();
 
 export const telemetry = new Command('telemetry')
+  .configureHelp({ showGlobalOptions: true })
+  .description(
+    'View or change CLI telemetry collection status. Enabling telemetry helps BigCommerce support diagnose and troubleshoot errors you encounter when using the CLI.',
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Show telemetry status
+  $ catalyst telemetry
+
+  # Enable telemetry collection
+  $ catalyst telemetry enable
+
+  # Disable telemetry collection
+  $ catalyst telemetry --disable`,
+  )
   .addArgument(new Argument('[arg]').choices(['disable', 'enable', 'status']))
   .addOption(new Option('--enable', `Enables CLI telemetry collection.`).conflicts('disable'))
   .option('--disable', `Disables CLI telemetry collection.`)
@@ -21,7 +38,7 @@ export const telemetry = new Command('telemetry')
       telemetryService.setEnabled(false);
 
       if (isEnabled) {
-        consola.success('Your preference has been saved to .bigcommerce/project.json');
+        consola.success('Your preference has been saved.');
       } else {
         consola.info(`Catalyst CLI telemetry collection is already disabled.`);
       }
diff --git a/packages/catalyst/src/cli/commands/upgrade.action.spec.ts b/packages/catalyst/src/cli/commands/upgrade.action.spec.ts
new file mode 100644
index 0000000000..1b7c9e513d
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/upgrade.action.spec.ts
@@ -0,0 +1,343 @@
+/**
+ * Action-level tests for `catalyst upgrade`. Invokes upgrade.parseAsync() the
+ * same way the real CLI does, using process.chdir() to control the working
+ * directory. Telemetry, logger output, and spinner animations are mocked.
+ * Downloads use the shared CLI cache so subsequent runs are offline.
+ */
+
+import { execa } from 'execa';
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, expect, test, vi } from 'vitest';
+
+// Windows holds git file locks longer than the default 10 s hook timeout.
+vi.setConfig({ hookTimeout: 60_000 });
+
+import { downloadCore, parseRef, upgrade } from './upgrade';
+
+vi.mock('../lib/telemetry', () => ({ getTelemetry: () => ({ track: vi.fn() }) }));
+vi.mock('../lib/logger', () => ({
+  consola: { log: vi.fn(), success: vi.fn(), error: vi.fn(), warn: vi.fn(), info: vi.fn() },
+}));
+vi.mock('yocto-spinner', () => ({
+  default: () => ({ start: () => ({ success: vi.fn(), error: vi.fn(), warning: vi.fn() }) }),
+}));
+
+const REPO = 'bigcommerce/catalyst';
+const BASE_REF = '@bigcommerce/catalyst-core@1.6.3';
+const TARGET_VERSION = '1.7.0';
+const TARGET_REF = `@bigcommerce/catalyst-core@${TARGET_VERSION}`;
+const MAKESWIFT_BASE_REF = '@bigcommerce/catalyst-makeswift@1.2.0';
+const MAKESWIFT_TARGET_REF = '@bigcommerce/catalyst-makeswift@1.3.0';
+const TIMEOUT = 120_000;
+
+const createdDirs: string[] = [];
+let originalCwd: string;
+
+// JSON.parse returns `any`; centralise the unsafe-return suppression here.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-return
+const parseJson = (raw: string): Record<string, unknown> => JSON.parse(raw);
+
+async function mkTmp(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'upgrade-action-'));
+
+  createdDirs.push(dir);
+
+  return dir;
+}
+
+beforeEach(() => {
+  originalCwd = process.cwd();
+});
+
+afterEach(async () => {
+  process.chdir(originalCwd);
+  vi.restoreAllMocks();
+  await Promise.all(
+    createdDirs
+      .splice(0)
+      .map((d) => rm(d, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 })),
+  );
+});
+
+async function initGitProject(dir: string): Promise<void> {
+  await execa('git', ['init', '-q'], { cwd: dir });
+  await execa('git', ['config', 'user.email', 't@t.com'], { cwd: dir });
+  await execa('git', ['config', 'user.name', 't'], { cwd: dir });
+  await execa('git', ['config', 'commit.gpgsign', 'false'], { cwd: dir });
+  await execa('git', ['config', 'gc.auto', '0'], { cwd: dir });
+  await execa('git', ['add', '-A'], { cwd: dir });
+  await execa('git', ['commit', '-qm', 'base'], { cwd: dir });
+}
+
+// Creates and returns a committed project directory seeded from the 1.6.3 tarball.
+// Versions <= 1.7.0 predate LTRAC-466 and have no catalyst.ref field in the
+// tarball, so we inject it here when withCatalystRef is true so that action
+// tests which don't specifically test the missing-ref path don't hit the
+// interactive confirm prompt.
+async function setup163Project(
+  root: string,
+  opts: { withCatalystRef?: boolean } = {},
+): Promise<string> {
+  const { withCatalystRef = true } = opts;
+  const baseDir = join(root, 'base');
+
+  await downloadCore(REPO, BASE_REF, baseDir);
+
+  const projectDir = join(root, 'project');
+
+  await cp(baseDir, projectDir, { recursive: true });
+
+  const pkgPath = join(projectDir, 'package.json');
+  const pkg = parseJson(await readFile(pkgPath, 'utf-8'));
+
+  if (withCatalystRef) {
+    const { version } = parseRef(BASE_REF);
+
+    pkg.catalyst = { version, ref: BASE_REF };
+  } else {
+    delete pkg.catalyst;
+  }
+
+  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+  await initGitProject(projectDir);
+
+  return projectDir;
+}
+
+// ── Fast tests (no tarball downloads) ────────────────────────────────────────
+
+test('already up to date short-circuits before downloading', async () => {
+  const root = await mkTmp();
+  const projectDir = join(root, 'project');
+
+  await mkdir(projectDir, { recursive: true });
+  await writeFile(
+    join(projectDir, 'package.json'),
+    `${JSON.stringify(
+      {
+        name: '@bigcommerce/catalyst-core',
+        version: TARGET_VERSION,
+        catalyst: { version: TARGET_VERSION, ref: TARGET_REF },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  await initGitProject(projectDir);
+  process.chdir(projectDir);
+
+  // Resolves cleanly — no download, no exit, no file changes.
+  await expect(upgrade.parseAsync([TARGET_VERSION], { from: 'user' })).resolves.toBeDefined();
+
+  const status = (await execa('git', ['status', '--porcelain'], { cwd: projectDir })).stdout;
+
+  expect(status.trim()).toBe('');
+  // git init + commit on Windows CI takes longer than the 5s default
+}, 15_000);
+
+test('dirty worktree: uncommitted changes cause exit(1) before any download', async () => {
+  const root = await mkTmp();
+  const projectDir = join(root, 'project');
+
+  await mkdir(projectDir, { recursive: true });
+  await writeFile(
+    join(projectDir, 'package.json'),
+    `${JSON.stringify(
+      {
+        name: '@bigcommerce/catalyst-core',
+        version: '1.6.3',
+        catalyst: { version: '1.6.3', ref: BASE_REF },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  await initGitProject(projectDir);
+
+  // Untracked file → dirty tree.
+  await writeFile(join(projectDir, 'dirty.ts'), 'export const x = 1;\n');
+  process.chdir(projectDir);
+
+  const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('process.exit');
+  });
+
+  await expect(upgrade.parseAsync([TARGET_VERSION], { from: 'user' })).rejects.toThrow();
+  expect(exitSpy).toHaveBeenCalledWith(1);
+});
+
+test('invalid tag: a nonexistent version surfaces a 404 error', async () => {
+  const root = await mkTmp();
+
+  // Test downloadCore directly — the action re-throws this error unchanged.
+  await expect(
+    downloadCore(REPO, '@bigcommerce/catalyst-core@0.0.1-nonexistent', join(root, 'dest')),
+  ).rejects.toThrow(/404.*not found/i);
+}, 30_000);
+
+// ── Tests that use real tarballs (cached after first run) ─────────────────────
+
+test(
+  '--dry-run prints the diff but leaves the project completely unchanged',
+  async () => {
+    const root = await mkTmp();
+    const projectDir = await setup163Project(root);
+    const pkgBefore = await readFile(join(projectDir, 'package.json'), 'utf-8');
+
+    process.chdir(projectDir);
+
+    await upgrade.parseAsync([TARGET_VERSION, '--dry-run'], { from: 'user' });
+
+    // Nothing staged or modified.
+    const status = (await execa('git', ['status', '--porcelain'], { cwd: projectDir })).stdout;
+
+    expect(status.trim()).toBe('');
+    expect(await readFile(join(projectDir, 'package.json'), 'utf-8')).toBe(pkgBefore);
+  },
+  TIMEOUT,
+);
+
+test(
+  'missing catalyst.ref with --yes infers the base and stamps the target ref',
+  async () => {
+    const root = await mkTmp();
+    const projectDir = await setup163Project(root, { withCatalystRef: false });
+
+    process.chdir(projectDir);
+
+    await upgrade.parseAsync([TARGET_VERSION, '--yes'], { from: 'user' });
+
+    const pkg = parseJson(await readFile(join(projectDir, 'package.json'), 'utf-8'));
+
+    expect(pkg.catalyst).toMatchObject({ ref: TARGET_REF });
+  },
+  TIMEOUT,
+);
+
+test(
+  'running upgrade from inside core/ resolves to the git root and applies correctly',
+  async () => {
+    const root = await mkTmp();
+    const baseDir = join(root, 'base');
+
+    await downloadCore(REPO, BASE_REF, baseDir);
+
+    // Nested layout: Catalyst package lives under <projectRoot>/core/.
+    const projectRoot = join(root, 'project');
+
+    await mkdir(join(projectRoot, 'core'), { recursive: true });
+    await cp(baseDir, join(projectRoot, 'core'), { recursive: true });
+
+    // 1.6.3 predates LTRAC-466 — inject catalyst.ref so the action doesn't
+    // hit the interactive confirm prompt.
+    const corePkgPath = join(projectRoot, 'core', 'package.json');
+    const corePkg = parseJson(await readFile(corePkgPath, 'utf-8'));
+    const { version: baseVersion } = parseRef(BASE_REF);
+
+    corePkg.catalyst = { version: baseVersion, ref: BASE_REF };
+    await writeFile(corePkgPath, `${JSON.stringify(corePkg, null, 2)}\n`);
+    await initGitProject(projectRoot);
+
+    // Simulate running `catalyst upgrade` from inside core/.
+    process.chdir(join(projectRoot, 'core'));
+
+    await upgrade.parseAsync([TARGET_VERSION], { from: 'user' });
+
+    const pkg = parseJson(await readFile(join(projectRoot, 'core', 'package.json'), 'utf-8'));
+
+    expect(pkg.catalyst).toMatchObject({ ref: TARGET_REF });
+  },
+  TIMEOUT,
+);
+
+test(
+  'dirty worktree with --dry-run proceeds without error',
+  async () => {
+    const root = await mkTmp();
+    const projectDir = await setup163Project(root);
+
+    // Staged change — normally blocks the upgrade.
+    await writeFile(join(projectDir, 'dirty.ts'), 'export const x = 1;\n');
+    process.chdir(projectDir);
+
+    // Should resolve without throwing and leave the tree as-is.
+    await expect(
+      upgrade.parseAsync([TARGET_VERSION, '--dry-run'], { from: 'user' }),
+    ).resolves.toBeDefined();
+  },
+  TIMEOUT,
+);
+
+test(
+  'staged-but-uncommitted changes are treated as a dirty worktree and cause exit(1)',
+  async () => {
+    const root = await mkTmp();
+    const projectDir = await setup163Project(root);
+
+    // Stage a new file without committing — this is dirty too.
+    await writeFile(join(projectDir, 'staged.ts'), 'export const x = 1;\n');
+    await execa('git', ['add', 'staged.ts'], { cwd: projectDir });
+    process.chdir(projectDir);
+
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('process.exit');
+    });
+
+    await expect(upgrade.parseAsync([TARGET_VERSION], { from: 'user' })).rejects.toThrow();
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  },
+  TIMEOUT,
+);
+
+test(
+  '--from overrides base detection when catalyst.ref is missing',
+  async () => {
+    const root = await mkTmp();
+    // Start with a project that has no catalyst.ref — normally triggers the
+    // interactive confirm prompt. Passing --from bypasses it entirely.
+    const projectDir = await setup163Project(root, { withCatalystRef: false });
+
+    process.chdir(projectDir);
+
+    await upgrade.parseAsync([TARGET_VERSION, '--from', BASE_REF], { from: 'user' });
+
+    const pkg = parseJson(await readFile(join(projectDir, 'package.json'), 'utf-8'));
+
+    expect(pkg.catalyst).toMatchObject({ ref: TARGET_REF });
+  },
+  TIMEOUT,
+);
+
+test(
+  '--ref flag upgrades a makeswift integration family project to the target tag',
+  async () => {
+    const root = await mkTmp();
+    const baseDir = join(root, 'base');
+
+    await downloadCore(REPO, MAKESWIFT_BASE_REF, baseDir);
+
+    const projectDir = join(root, 'project');
+
+    await cp(baseDir, projectDir, { recursive: true });
+
+    // makeswift 1.2.0 also predates LTRAC-466 — inject catalyst.ref.
+    const pkgPath = join(projectDir, 'package.json');
+    const pkg = parseJson(await readFile(pkgPath, 'utf-8'));
+    const { version: baseVersion } = parseRef(MAKESWIFT_BASE_REF);
+
+    pkg.catalyst = { version: baseVersion, ref: MAKESWIFT_BASE_REF };
+    await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    await initGitProject(projectDir);
+
+    process.chdir(projectDir);
+
+    await upgrade.parseAsync(['--ref', MAKESWIFT_TARGET_REF], { from: 'user' });
+
+    const updated = parseJson(await readFile(pkgPath, 'utf-8'));
+
+    expect(updated.catalyst).toMatchObject({ ref: MAKESWIFT_TARGET_REF });
+  },
+  TIMEOUT,
+);
diff --git a/packages/catalyst/src/cli/commands/upgrade.integration.spec.ts b/packages/catalyst/src/cli/commands/upgrade.integration.spec.ts
new file mode 100644
index 0000000000..9bc7ebbd08
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/upgrade.integration.spec.ts
@@ -0,0 +1,406 @@
+/**
+ * Integration tests for `catalyst upgrade`. These tests download real Catalyst
+ * tarballs (using the same cache as the CLI at ~/.cache/catalyst-cli/cores) and
+ * run the full upgrade pipeline against them. On first run, tarballs are fetched
+ * from GitHub (~3MB each). Subsequent runs use the on-disk cache and run offline.
+ */
+import { execa } from 'execa';
+import { execSync } from 'node:child_process';
+import { access, cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+vi.setConfig({ hookTimeout: 60_000 });
+
+import {
+  applyIndexState,
+  computeBaseSimilarity,
+  downloadCore,
+  mergeCorePerFile,
+  mergeCoreTree,
+  resolveProject,
+} from './upgrade';
+
+const SUPPORTS_TREE = (() => {
+  try {
+    const match = /(\d+)\.(\d+)/.exec(execSync('git --version').toString());
+
+    return !!match && (Number(match[1]) > 2 || (Number(match[1]) === 2 && Number(match[2]) >= 38));
+  } catch {
+    return false;
+  }
+})();
+
+const engines: Array<'per-file' | 'tree'> = SUPPORTS_TREE ? ['per-file', 'tree'] : ['per-file'];
+
+const exists = (p: string) =>
+  access(p)
+    .then(() => true)
+    .catch(() => false);
+
+const createdDirs: string[] = [];
+
+async function mkTmp(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'upgrade-integ-'));
+
+  createdDirs.push(dir);
+
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(
+    createdDirs
+      .splice(0)
+      .map((d) => rm(d, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 })),
+  );
+});
+
+const REPO = 'bigcommerce/catalyst';
+// Versions used in the manual spike testing — known to have a meaningful diff.
+const BASE_REF = '@bigcommerce/catalyst-core@1.6.3';
+const TARGET_REF = '@bigcommerce/catalyst-core@1.7.0';
+
+const MAKESWIFT_BASE_REF = '@bigcommerce/catalyst-makeswift@1.2.0';
+const MAKESWIFT_TARGET_REF = '@bigcommerce/catalyst-makeswift@1.3.0';
+
+async function fetchTarballs(root: string): Promise<{ baseDir: string; theirsDir: string }> {
+  const baseDir = join(root, 'base');
+  const theirsDir = join(root, 'theirs');
+
+  await Promise.all([
+    downloadCore(REPO, BASE_REF, baseDir),
+    downloadCore(REPO, TARGET_REF, theirsDir),
+  ]);
+
+  return { baseDir, theirsDir };
+}
+
+async function initGitProject(dir: string): Promise<void> {
+  await execa('git', ['init', '-q'], { cwd: dir });
+  await execa('git', ['config', 'user.email', 't@t.com'], { cwd: dir });
+  await execa('git', ['config', 'user.name', 't'], { cwd: dir });
+  await execa('git', ['config', 'commit.gpgsign', 'false'], { cwd: dir });
+  // Disable auto-gc so git never spawns background pack processes that would
+  // still be running when afterEach tries to remove the temp directory.
+  await execa('git', ['config', 'gc.auto', '0'], { cwd: dir });
+  await execa('git', ['add', '-A'], { cwd: dir });
+  await execa('git', ['commit', '-qm', 'base'], { cwd: dir });
+}
+
+// 120s per test to allow cold-cache downloads on first run.
+const TIMEOUT = 120_000;
+
+describe.each(engines)('integration (engine: %s)', (engine) => {
+  const runMerge = (baseDir: string, theirsDir: string, oursDir: string, emptyFile: string) =>
+    engine === 'tree'
+      ? mergeCoreTree(baseDir, theirsDir, oursDir)
+      : mergeCorePerFile(baseDir, theirsDir, oursDir, emptyFile);
+
+  test(
+    'clean project upgrades without conflicts and all changes staged',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      // Project = fresh copy of 1.6.3 with no merchant modifications.
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+      await initGitProject(oursDir);
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const result = await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // No merchant customizations → no conflicts.
+      expect(result.conflicted).toHaveLength(0);
+      // Versions aren't identical, so there must be at least one change.
+      expect(result.applied.length + result.added.length + result.deleted.length).toBeGreaterThan(
+        0,
+      );
+
+      await applyIndexState(oursDir, '.', baseDir, theirsDir, result, false);
+
+      const status = (await execa('git', ['status', '--porcelain'], { cwd: oursDir })).stdout;
+      const lines = status.trim().split('\n').filter(Boolean);
+
+      // Every change should be staged (leading column non-space, non-?).
+      expect(lines.length).toBeGreaterThan(0);
+      expect(lines.every((l) => !l.startsWith(' ') && !l.startsWith('?'))).toBe(true);
+    },
+    TIMEOUT,
+  );
+
+  test(
+    'merchant-deleted file that upstream modifies is restored as a conflict',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      // Start from the base version, then delete package.json — a file upstream always
+      // modifies (version bump at minimum between 1.6.3 and 1.7.0).
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+      await rm(join(oursDir, 'package.json'), { force: true });
+      await initGitProject(oursDir);
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const result = await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // modify/delete: upstream's version should be restored and flagged as conflicted.
+      expect(result.conflicted).toContain('package.json');
+      expect(await exists(join(oursDir, 'package.json'))).toBe(true);
+    },
+    TIMEOUT,
+  );
+
+  test(
+    'merchant dep addition in a non-overlapping region is preserved after upgrade',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+
+      const pkgPath = join(oursDir, 'package.json');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+      const pkg: Record<string, unknown> = JSON.parse(await readFile(pkgPath, 'utf-8'));
+      const deps: Record<string, string> = {};
+
+      if (typeof pkg.dependencies === 'object' && pkg.dependencies !== null) {
+        Object.assign(deps, pkg.dependencies);
+      }
+
+      deps['some-merchant-package'] = '^1.0.0';
+      pkg.dependencies = deps;
+      await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+      await initGitProject(oursDir);
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // The merchant dep must be present in the merged output — either cleanly
+      // applied or in the ours side of any conflict markers.
+      const merged = await readFile(pkgPath, 'utf-8');
+
+      expect(merged).toContain('"some-merchant-package"');
+    },
+    TIMEOUT,
+  );
+
+  test(
+    're-merging after upgrade with identical base and target produces no changes',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+      await initGitProject(oursDir);
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      // First upgrade: base → target (ours now at target state)
+      await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // Second "upgrade": target → target (no upstream diff) → nothing to do
+      const idempotentResult = await runMerge(theirsDir, theirsDir, oursDir, emptyFile);
+
+      expect(idempotentResult.applied).toHaveLength(0);
+      expect(idempotentResult.added).toHaveLength(0);
+      expect(idempotentResult.deleted).toHaveLength(0);
+      expect(idempotentResult.conflicted).toHaveLength(0);
+    },
+    TIMEOUT,
+  );
+
+  test(
+    'flat repo layout — changes land at root and resolveProject detects relDir "."',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      // Flat layout: extract base tarball contents directly to the repo root (no core/ subdir).
+      const oursDir = join(root, 'flat-project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+      await initGitProject(oursDir);
+
+      // resolveProject must identify this as a flat layout.
+      const project = await resolveProject(oursDir);
+
+      expect(project).not.toBeNull();
+      expect(project?.relDir).toBe('.');
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const result = await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // All changed paths should be at the root — no "core/" prefix.
+      const allPaths = [
+        ...result.applied,
+        ...result.added,
+        ...result.deleted,
+        ...result.conflicted,
+      ];
+
+      expect(allPaths.some((p) => p.startsWith('core/'))).toBe(false);
+
+      // No nested core/ directory should have been created inside the flat project.
+      expect(await exists(join(oursDir, 'core'))).toBe(false);
+    },
+    TIMEOUT,
+  );
+
+  test(
+    'file modified by merchant AND upstream produces conflict markers',
+    async () => {
+      const root = await mkTmp();
+      const { baseDir, theirsDir } = await fetchTarballs(root);
+
+      // Merchant project: start from 1.6.3, then change package.json's version
+      // field — the same field that the 1.6.3 → 1.7.0 diff also touches.
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+
+      const pkgPath = join(oursDir, 'package.json');
+      const raw = await readFile(pkgPath, 'utf-8');
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+      const pkg: Record<string, unknown> = JSON.parse(raw);
+
+      pkg.version = 'custom-merchant-version'; // overlaps with upstream's version bump
+      await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+      await initGitProject(oursDir);
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const result = await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // package.json was modified by both sides → must be conflicted.
+      expect(result.conflicted).toContain('package.json');
+
+      // Confirm the file contains conflict markers.
+      const merged = await readFile(join(oursDir, 'package.json'), 'utf-8');
+
+      expect(merged).toContain('<<<<<<< ours');
+      expect(merged).toContain('>>>>>>> theirs');
+    },
+    TIMEOUT,
+  );
+});
+
+describe.each(engines)('integration makeswift family (engine: %s)', (engine) => {
+  const runMerge = (baseDir: string, theirsDir: string, oursDir: string, emptyFile: string) =>
+    engine === 'tree'
+      ? mergeCoreTree(baseDir, theirsDir, oursDir)
+      : mergeCorePerFile(baseDir, theirsDir, oursDir, emptyFile);
+
+  test(
+    'clean makeswift project (1.2.0 → 1.3.0) upgrades without conflicts',
+    async () => {
+      const root = await mkTmp();
+      const baseDir = join(root, 'base');
+      const theirsDir = join(root, 'theirs');
+
+      await Promise.all([
+        downloadCore(REPO, MAKESWIFT_BASE_REF, baseDir),
+        downloadCore(REPO, MAKESWIFT_TARGET_REF, theirsDir),
+      ]);
+
+      const oursDir = join(root, 'project');
+
+      await cp(baseDir, oursDir, { recursive: true });
+      await execa('git', ['init', '-q'], { cwd: oursDir });
+      await execa('git', ['config', 'user.email', 't@t.com'], { cwd: oursDir });
+      await execa('git', ['config', 'user.name', 't'], { cwd: oursDir });
+      await execa('git', ['config', 'commit.gpgsign', 'false'], { cwd: oursDir });
+      await execa('git', ['add', '-A'], { cwd: oursDir });
+      await execa('git', ['commit', '-qm', 'base'], { cwd: oursDir });
+
+      const emptyFile = join(root, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const result = await runMerge(baseDir, theirsDir, oursDir, emptyFile);
+
+      // A clean makeswift project should merge without conflicts.
+      expect(result.conflicted).toHaveLength(0);
+      expect(result.applied.length + result.added.length + result.deleted.length).toBeGreaterThan(
+        0,
+      );
+    },
+    TIMEOUT,
+  );
+
+  test(
+    'computeBaseSimilarity scores higher for the correct makeswift base than a wrong base',
+    async () => {
+      const root = await mkTmp();
+      const baseDir = join(root, 'base');
+      const theirsDir = join(root, 'theirs');
+
+      await Promise.all([
+        downloadCore(REPO, MAKESWIFT_BASE_REF, baseDir),
+        downloadCore(REPO, MAKESWIFT_TARGET_REF, theirsDir),
+      ]);
+
+      // "Project" = clean makeswift 1.2.0 (no modifications).
+      const projectDir = join(root, 'project');
+
+      await cp(baseDir, projectDir, { recursive: true });
+
+      // Correct base scores near-perfect (project is an unmodified 1.2.0 copy).
+      const correctScore = await computeBaseSimilarity(baseDir, projectDir);
+      // Wrong base (1.3.0) scores lower because files changed between versions.
+      const wrongScore = await computeBaseSimilarity(theirsDir, projectDir);
+
+      expect(correctScore).toBeGreaterThan(0.9);
+      expect(wrongScore).toBeLessThan(correctScore);
+    },
+    TIMEOUT,
+  );
+});
+
+test(
+  'computeBaseSimilarity: correct base scores higher than a wrong base',
+  async () => {
+    const root = await mkTmp();
+    const { baseDir, theirsDir } = await fetchTarballs(root);
+
+    // "Project" = clean 1.6.3 (no merchant modifications).
+    const projectDir = join(root, 'project');
+
+    await cp(baseDir, projectDir, { recursive: true });
+
+    // Correct base (1.6.3 vs a fresh 1.6.3 project) → near-perfect similarity.
+    const correctScore = await computeBaseSimilarity(baseDir, projectDir);
+
+    // Wrong base (1.7.0 vs the same 1.6.3 project) → lower similarity.
+    const wrongScore = await computeBaseSimilarity(theirsDir, projectDir);
+
+    expect(correctScore).toBeGreaterThan(0.9);
+    expect(wrongScore).toBeLessThan(correctScore);
+  },
+  TIMEOUT,
+);
diff --git a/packages/catalyst/src/cli/commands/upgrade.spec.ts b/packages/catalyst/src/cli/commands/upgrade.spec.ts
new file mode 100644
index 0000000000..f2b81f347f
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/upgrade.spec.ts
@@ -0,0 +1,528 @@
+import { Command } from '@commander-js/extra-typings';
+import { execa } from 'execa';
+import { execSync } from 'node:child_process';
+import { access, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+// The tree engine runs many git subprocesses sequentially on Windows CI; give
+// every test in this file enough headroom (the fast ones finish in < 1 s).
+vi.setConfig({ testTimeout: 30_000 });
+
+import {
+  applyIndexState,
+  computeBaseSimilarity,
+  mergeCorePerFile,
+  mergeCoreTree,
+  parseRef,
+  resolveBaseRef,
+  resolveProject,
+  resolveStrategy,
+  upgrade,
+} from './upgrade';
+
+const createdDirs: string[] = [];
+
+async function mkTmp(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'upgrade-spec-'));
+
+  createdDirs.push(dir);
+
+  return dir;
+}
+
+async function write(file: string, content: string | Buffer): Promise<void> {
+  await mkdir(dirname(file), { recursive: true });
+  await writeFile(file, content);
+}
+
+const exists = (p: string) =>
+  access(p)
+    .then(() => true)
+    .catch(() => false);
+
+afterEach(async () => {
+  await Promise.all(
+    createdDirs
+      .splice(0)
+      .map((dir) => rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 })),
+  );
+});
+
+test('properly configured Command instance', () => {
+  expect(upgrade).toBeInstanceOf(Command);
+  expect(upgrade.name()).toBe('upgrade');
+});
+
+describe('parseRef', () => {
+  test('splits a scoped package ref on the last @', () => {
+    expect(parseRef('@bigcommerce/catalyst-core@1.7.0')).toEqual({
+      packageName: '@bigcommerce/catalyst-core',
+      version: '1.7.0',
+    });
+  });
+
+  test('handles integration families', () => {
+    expect(parseRef('@bigcommerce/catalyst-makeswift@1.7.0')).toEqual({
+      packageName: '@bigcommerce/catalyst-makeswift',
+      version: '1.7.0',
+    });
+  });
+
+  test('throws when there is no version separator', () => {
+    expect(() => parseRef('catalyst-core')).toThrow();
+  });
+});
+
+describe('resolveProject', () => {
+  async function initRepo(): Promise<string> {
+    const repo = await mkTmp();
+
+    await execa('git', ['init', '-q'], { cwd: repo });
+    await execa('git', ['config', 'user.email', 't@t.com'], { cwd: repo });
+    await execa('git', ['config', 'user.name', 't'], { cwd: repo });
+
+    return repo;
+  }
+
+  const catalystPkg = (version: string) =>
+    `${JSON.stringify(
+      {
+        name: '@bigcommerce/catalyst-core',
+        version,
+        catalyst: { version, ref: `@bigcommerce/catalyst-core@${version}` },
+      },
+      null,
+      2,
+    )}\n`;
+
+  test('detects a nested (monorepo) layout → relDir "core"', async () => {
+    const repo = await initRepo();
+
+    await write(join(repo, 'core', 'package.json'), catalystPkg('1.6.3'));
+
+    const project = await resolveProject(repo);
+
+    expect(project).not.toBeNull();
+    expect(project?.relDir).toBe('core');
+    expect(project?.catalystRoot.endsWith('core')).toBe(true);
+    expect(project?.pkg.catalyst?.ref).toBe('@bigcommerce/catalyst-core@1.6.3');
+  });
+
+  test('detects a flat layout → relDir "."', async () => {
+    const repo = await initRepo();
+
+    await write(join(repo, 'package.json'), catalystPkg('1.7.0'));
+
+    const project = await resolveProject(repo);
+
+    expect(project).not.toBeNull();
+    expect(project?.relDir).toBe('.');
+    expect(project?.pkg.catalyst?.ref).toBe('@bigcommerce/catalyst-core@1.7.0');
+  });
+
+  test('returns null outside a git repo', async () => {
+    const notARepo = await mkTmp();
+
+    expect(await resolveProject(notARepo)).toBeNull();
+  });
+});
+
+describe('resolveBaseRef', () => {
+  // Minimal Project stub — resolveBaseRef only reads `.pkg` (plus its --from /
+  // --yes args). Conditional spreads keep optional fields truly absent so the
+  // stub satisfies CorePackageJson under exactOptionalPropertyTypes.
+  const projectWith = (pkg: { name?: string; version: string; ref?: string }) => ({
+    gitRoot: '/repo',
+    catalystRoot: '/repo/core',
+    relDir: 'core',
+    pkgPath: '/repo/core/package.json',
+    rawContent: '',
+    pkg: {
+      ...(pkg.name === undefined ? {} : { name: pkg.name }),
+      version: pkg.version,
+      ...(pkg.ref === undefined ? {} : { catalyst: { version: pkg.version, ref: pkg.ref } }),
+    },
+  });
+
+  test('uses catalyst.ref verbatim when present (ignores --from)', async () => {
+    expect(
+      await resolveBaseRef(
+        projectWith({
+          name: '@bigcommerce/catalyst-core',
+          version: '1.6.3',
+          ref: '@bigcommerce/catalyst-core@1.6.3',
+        }),
+        '@bigcommerce/catalyst-core@1.0.0',
+        false,
+      ),
+    ).toBe('@bigcommerce/catalyst-core@1.6.3');
+  });
+
+  test('missing catalyst.ref: --from wins when provided', async () => {
+    expect(
+      await resolveBaseRef(
+        projectWith({ name: '@bigcommerce/catalyst-core', version: '1.6.3' }),
+        '@bigcommerce/catalyst-makeswift@1.5.0',
+        false,
+      ),
+    ).toBe('@bigcommerce/catalyst-makeswift@1.5.0');
+  });
+
+  test('missing catalyst.ref (pre-LTRAC-466): infers <name>@<version> under --yes', async () => {
+    expect(
+      await resolveBaseRef(
+        projectWith({ name: '@bigcommerce/catalyst-makeswift', version: '1.6.3' }),
+        undefined,
+        true,
+      ),
+    ).toBe('@bigcommerce/catalyst-makeswift@1.6.3');
+  });
+
+  test('missing catalyst.ref + unknown package name: defaults to catalyst-core family', async () => {
+    expect(
+      await resolveBaseRef(
+        projectWith({ name: 'acme-storefront', version: '1.6.3' }),
+        undefined,
+        true,
+      ),
+    ).toBe('@bigcommerce/catalyst-core@1.6.3');
+  });
+});
+
+describe('computeBaseSimilarity', () => {
+  test('returns 1.0 when all base files match exactly', async () => {
+    const root = await mkTmp();
+
+    await Promise.all([
+      write(join(root, 'base', 'a.txt'), 'hello\n'),
+      write(join(root, 'base', 'b.txt'), 'world\n'),
+      write(join(root, 'dest', 'a.txt'), 'hello\n'),
+      write(join(root, 'dest', 'b.txt'), 'world\n'),
+    ]);
+
+    expect(await computeBaseSimilarity(join(root, 'base'), join(root, 'dest'))).toBe(1.0);
+  });
+
+  test('returns 0.5 when half the base files match', async () => {
+    const root = await mkTmp();
+
+    await Promise.all([
+      write(join(root, 'base', 'match.txt'), 'same\n'),
+      write(join(root, 'base', 'differ.txt'), 'original\n'),
+      write(join(root, 'dest', 'match.txt'), 'same\n'),
+      write(join(root, 'dest', 'differ.txt'), 'modified\n'),
+    ]);
+
+    expect(await computeBaseSimilarity(join(root, 'base'), join(root, 'dest'))).toBe(0.5);
+  });
+
+  test('returns 0 when no base files exist in dest', async () => {
+    const root = await mkTmp();
+
+    await Promise.all([
+      write(join(root, 'base', 'a.txt'), 'content\n'),
+      mkdir(join(root, 'dest'), { recursive: true }),
+    ]);
+
+    expect(await computeBaseSimilarity(join(root, 'base'), join(root, 'dest'))).toBe(0);
+  });
+
+  test('returns 0 for an empty base', async () => {
+    const root = await mkTmp();
+
+    await Promise.all([
+      mkdir(join(root, 'base'), { recursive: true }),
+      mkdir(join(root, 'dest'), { recursive: true }),
+    ]);
+
+    expect(await computeBaseSimilarity(join(root, 'base'), join(root, 'dest'))).toBe(0);
+  });
+
+  test('extra files in dest do not affect the score (only base coverage counts)', async () => {
+    const root = await mkTmp();
+
+    await Promise.all([
+      write(join(root, 'base', 'a.txt'), 'content\n'),
+      write(join(root, 'dest', 'a.txt'), 'content\n'),
+      write(join(root, 'dest', 'extra.txt'), 'merchant addition\n'),
+    ]);
+
+    // 1 base file, 1 match → 1.0 regardless of extra dest files
+    expect(await computeBaseSimilarity(join(root, 'base'), join(root, 'dest'))).toBe(1.0);
+  });
+});
+
+// merge-tree --write-tree (the whole-tree engine) needs git >= 2.38. Gate its
+// tests so they're skipped rather than failing on an older git.
+const SUPPORTS_TREE = (() => {
+  try {
+    const match = /(\d+)\.(\d+)/.exec(execSync('git --version').toString());
+
+    return !!match && (Number(match[1]) > 2 || (Number(match[1]) === 2 && Number(match[2]) >= 38));
+  } catch {
+    return false;
+  }
+})();
+
+const engines: Array<'per-file' | 'tree'> = SUPPORTS_TREE ? ['per-file', 'tree'] : ['per-file'];
+
+describe('resolveStrategy', () => {
+  test('passes explicit engines through unchanged', async () => {
+    expect(await resolveStrategy('per-file')).toBe('per-file');
+    expect(await resolveStrategy('tree')).toBe('tree');
+  });
+
+  test('auto resolves to a concrete engine', async () => {
+    expect(['tree', 'per-file']).toContain(await resolveStrategy('auto'));
+  });
+});
+
+describe('applyIndexState', () => {
+  test('pre-stages clean changes and marks conflicts as unmerged', async () => {
+    const root = await mkTmp();
+    const gitRoot = join(root, 'repo');
+    const baseDir = join(root, 'base');
+    const theirsDir = join(root, 'theirs');
+
+    await Promise.all([
+      mkdir(gitRoot, { recursive: true }),
+      mkdir(baseDir, { recursive: true }),
+      mkdir(theirsDir, { recursive: true }),
+    ]);
+    await execa('git', ['init', '-q'], { cwd: gitRoot });
+    await execa('git', ['config', 'user.email', 't@t.com'], { cwd: gitRoot });
+    await execa('git', ['config', 'user.name', 't'], { cwd: gitRoot });
+    await execa('git', ['config', 'commit.gpgsign', 'false'], { cwd: gitRoot });
+
+    // Committed (ours) state. `cf-added` is added by the merchant (add/add);
+    // `cf-deleted` is absent (merchant deleted it → modify/delete).
+    await Promise.all([
+      write(join(gitRoot, 'applied.txt'), 'base\n'),
+      write(join(gitRoot, 'conflict.txt'), 'ours\n'),
+      write(join(gitRoot, 'cf-added.txt'), 'ours-added\n'),
+      write(join(gitRoot, 'todelete.txt'), 'base\n'),
+      write(join(gitRoot, 'package.json'), '{}\n'),
+    ]);
+    await execa('git', ['add', '-A'], { cwd: gitRoot });
+    await execa('git', ['commit', '-qm', 'ours'], { cwd: gitRoot });
+
+    // base + theirs trees the merge ran against.
+    await Promise.all([
+      write(join(baseDir, 'applied.txt'), 'base\n'),
+      write(join(baseDir, 'conflict.txt'), 'base\n'),
+      write(join(baseDir, 'cf-deleted.txt'), 'base\n'),
+      write(join(baseDir, 'todelete.txt'), 'base\n'),
+      write(join(theirsDir, 'applied.txt'), 'upstream\n'),
+      write(join(theirsDir, 'conflict.txt'), 'theirs\n'),
+      write(join(theirsDir, 'cf-added.txt'), 'theirs-added\n'),
+      write(join(theirsDir, 'cf-deleted.txt'), 'theirs\n'),
+      write(join(theirsDir, 'added.txt'), 'new\n'),
+    ]);
+
+    // Worktree as the engine + ref-stamp would have left it.
+    await Promise.all([
+      write(join(gitRoot, 'applied.txt'), 'upstream\n'),
+      write(join(gitRoot, 'conflict.txt'), '<<<<<<< ours\nours\n=======\ntheirs\n>>>>>>> theirs\n'),
+      write(
+        join(gitRoot, 'cf-added.txt'),
+        '<<<<<<< ours\nours-added\n=======\ntheirs-added\n>>>>>>> theirs\n',
+      ),
+      write(join(gitRoot, 'cf-deleted.txt'), 'theirs\n'),
+      write(join(gitRoot, 'added.txt'), 'new\n'),
+      write(join(gitRoot, 'package.json'), '{ "catalyst": {} }\n'),
+      rm(join(gitRoot, 'todelete.txt'), { force: true }),
+    ]);
+
+    await applyIndexState(
+      gitRoot,
+      '.',
+      baseDir,
+      theirsDir,
+      {
+        applied: ['applied.txt'],
+        added: ['added.txt'],
+        deleted: ['todelete.txt'],
+        conflicted: ['conflict.txt', 'cf-added.txt', 'cf-deleted.txt'],
+      },
+      true,
+    );
+
+    const status = (await execa('git', ['status', '--porcelain'], { cwd: gitRoot })).stdout;
+    const line = (file: string) => status.split('\n').find((l) => l.endsWith(file)) ?? '';
+
+    expect(line('applied.txt').startsWith('M')).toBe(true); // staged modify
+    expect(line('added.txt').startsWith('A')).toBe(true); // staged add
+    expect(line('todelete.txt').startsWith('D')).toBe(true); // staged delete
+    expect(line('package.json').startsWith('M')).toBe(true); // stamped ref, staged
+    expect(line('conflict.txt').startsWith('UU')).toBe(true); // both modified
+    expect(line('cf-added.txt').startsWith('AA')).toBe(true); // both added
+    expect(line('cf-deleted.txt').startsWith('DU')).toBe(true); // deleted by us
+  }, 15_000);
+});
+
+// Both engines must satisfy the same MergeResult contract.
+describe.each(engines)('mergeCore engine: %s', (engine) => {
+  interface Fixture {
+    base?: Record<string, string | Buffer>;
+    theirs?: Record<string, string | Buffer>;
+    ours?: Record<string, string | Buffer>;
+  }
+
+  async function setup(fixture: Fixture) {
+    const root = await mkTmp();
+    const baseDir = join(root, 'base');
+    const theirsDir = join(root, 'theirs');
+    const oursDir = join(root, 'ours');
+    const emptyFile = join(root, '.empty');
+
+    await Promise.all([
+      mkdir(baseDir, { recursive: true }),
+      mkdir(theirsDir, { recursive: true }),
+      mkdir(oursDir, { recursive: true }),
+    ]);
+    await write(emptyFile, '');
+    await Promise.all([
+      ...Object.entries(fixture.base ?? {}).map(([k, v]) => write(join(baseDir, k), v)),
+      ...Object.entries(fixture.theirs ?? {}).map(([k, v]) => write(join(theirsDir, k), v)),
+      ...Object.entries(fixture.ours ?? {}).map(([k, v]) => write(join(oursDir, k), v)),
+    ]);
+
+    return { baseDir, theirsDir, oursDir, emptyFile };
+  }
+
+  const run = (baseDir: string, theirsDir: string, oursDir: string, emptyFile: string) =>
+    engine === 'tree'
+      ? mergeCoreTree(baseDir, theirsDir, oursDir)
+      : mergeCorePerFile(baseDir, theirsDir, oursDir, emptyFile);
+
+  test('clean modify: upstream change applies when ours == base', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'a.txt': 'one\ntwo\n' },
+      theirs: { 'a.txt': 'one\ntwo-upstream\n' },
+      ours: { 'a.txt': 'one\ntwo\n' },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.applied).toContain('a.txt');
+    expect(result.conflicted).toHaveLength(0);
+    expect(await readFile(join(oursDir, 'a.txt'), 'utf-8')).toBe('one\ntwo-upstream\n');
+  });
+
+  test('overlapping modify: writes conflict markers, never throws', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'a.txt': 'line\n' },
+      theirs: { 'a.txt': 'line-upstream\n' },
+      ours: { 'a.txt': 'line-merchant\n' },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.conflicted).toContain('a.txt');
+
+    const merged = await readFile(join(oursDir, 'a.txt'), 'utf-8');
+
+    expect(merged).toContain('<<<<<<< ours');
+    expect(merged).toContain('>>>>>>> theirs');
+  });
+
+  test('added file is copied in', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      theirs: { 'new.ts': 'export const x = 1;\n' },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.added).toContain('new.ts');
+    expect(await readFile(join(oursDir, 'new.ts'), 'utf-8')).toBe('export const x = 1;\n');
+  });
+
+  test('deleted upstream + unmodified locally is removed', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'gone.ts': 'old\n' },
+      ours: { 'gone.ts': 'old\n' },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.deleted).toContain('gone.ts');
+    expect(await exists(join(oursDir, 'gone.ts'))).toBe(false);
+  });
+
+  test('modify/delete: merchant-deleted file upstream modified is restored + flagged', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'keep.ts': 'v1\n' },
+      theirs: { 'keep.ts': 'v2\n' },
+      // ours is missing keep.ts (merchant deleted it)
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.conflicted).toContain('keep.ts');
+    expect(await readFile(join(oursDir, 'keep.ts'), 'utf-8')).toBe('v2\n');
+  });
+
+  test('binary change applies when ours == base (no corruption)', async () => {
+    const baseBin = Buffer.from([0x89, 0x50, 0x00, 0x01]);
+    const theirsBin = Buffer.from([0x89, 0x50, 0x00, 0x02, 0x03]);
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'img.png': baseBin },
+      theirs: { 'img.png': theirsBin },
+      ours: { 'img.png': baseBin },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.applied).toContain('img.png');
+    expect(await readFile(join(oursDir, 'img.png'))).toEqual(theirsBin);
+  });
+
+  test('identical versions produce no changes', async () => {
+    const { baseDir, theirsDir, oursDir, emptyFile } = await setup({
+      base: { 'a.txt': 'same\n' },
+      theirs: { 'a.txt': 'same\n' },
+      ours: { 'a.txt': 'same\n' },
+    });
+
+    const result = await run(baseDir, theirsDir, oursDir, emptyFile);
+
+    expect(result.applied).toHaveLength(0);
+    expect(result.added).toHaveLength(0);
+    expect(result.deleted).toHaveLength(0);
+    expect(result.conflicted).toHaveLength(0);
+  });
+});
+
+// The whole-tree engine's headline advantage over per-file: it follows renames
+// and merges local edits across them (per-file would see delete + add instead).
+describe.skipIf(!SUPPORTS_TREE)('mergeCoreTree rename fidelity', () => {
+  test('follows a rename and carries a local edit across it', async () => {
+    const root = await mkTmp();
+    const baseDir = join(root, 'base');
+    const theirsDir = join(root, 'theirs');
+    const oursDir = join(root, 'ours');
+
+    await Promise.all([
+      mkdir(baseDir, { recursive: true }),
+      mkdir(theirsDir, { recursive: true }),
+      mkdir(oursDir, { recursive: true }),
+    ]);
+
+    // theirs renames old.ts → new.ts; ours edits old.ts in place. A rename-aware
+    // merge lands the edit in new.ts; per-file would hit a modify/delete conflict.
+    await Promise.all([
+      write(join(baseDir, 'old.ts'), 'a\nb\nc\nd\ne\nf\n'),
+      write(join(oursDir, 'old.ts'), 'a\nb\nc\nd\ne-merchant\nf\n'),
+      write(join(theirsDir, 'new.ts'), 'a\nb\nc\nd\ne\nf\n'),
+    ]);
+
+    const result = await mergeCoreTree(baseDir, theirsDir, oursDir);
+
+    expect(await exists(join(oursDir, 'new.ts'))).toBe(true);
+    expect(await exists(join(oursDir, 'old.ts'))).toBe(false);
+    expect(result.conflicted).toHaveLength(0);
+    expect(await readFile(join(oursDir, 'new.ts'), 'utf-8')).toBe('a\nb\nc\nd\ne-merchant\nf\n');
+  });
+});
diff --git a/packages/catalyst/src/cli/commands/upgrade.ts b/packages/catalyst/src/cli/commands/upgrade.ts
new file mode 100644
index 0000000000..8f0b8ea94c
--- /dev/null
+++ b/packages/catalyst/src/cli/commands/upgrade.ts
@@ -0,0 +1,1067 @@
+import { Command, Option } from '@commander-js/extra-typings';
+import { confirm } from '@inquirer/prompts';
+import { execa } from 'execa';
+import {
+  access,
+  copyFile,
+  cp,
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join, relative } from 'node:path';
+import yoctoSpinner from 'yocto-spinner';
+import { z } from 'zod';
+
+import { consola } from '../lib/logger';
+import { getTelemetry } from '../lib/telemetry';
+
+const CorePackageJson = z.object({
+  name: z.string().optional(),
+  version: z.string(),
+  catalyst: z.object({ version: z.string(), ref: z.string() }).optional(),
+});
+
+// Catalyst versions are git tags on the upstream monorepo (e.g.
+// "@bigcommerce/catalyst-core@1.7.0"), NOT npm packages. GitHub serves a
+// tarball for any tag via the repos/<owner>/<repo>/tarball/<ref> endpoint.
+const DEFAULT_REPOSITORY = 'bigcommerce/catalyst';
+
+// Moving tags that don't pin a concrete version. When the target is one of
+// these we resolve the real version from the downloaded core/package.json so
+// catalyst.ref records a stable pin rather than the alias.
+const MOVING_TAGS = new Set(['latest', 'canary', 'alpha']);
+
+// Known Catalyst package families, used to reconstruct a base ref from a
+// project's package.json `name` when `catalyst.ref` is missing.
+const KNOWN_FAMILIES = new Set([
+  '@bigcommerce/catalyst-core',
+  '@bigcommerce/catalyst-makeswift',
+  '@bigcommerce/catalyst-b2b-makeswift',
+  '@bigcommerce/catalyst-b2b',
+]);
+
+const CACHE_DIR = join(homedir(), '.cache', 'catalyst-cli', 'cores');
+
+// ── small fs helpers ──────────────────────────────────────────────────────────
+const pathExists = (p: string) =>
+  access(p)
+    .then(() => true)
+    .catch(() => false);
+
+async function listFiles(dir: string, prefix = ''): Promise<string[]> {
+  const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+
+  const nested = await Promise.all(
+    entries.map((entry) => {
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+
+      return entry.isDirectory() ? listFiles(join(dir, entry.name), rel) : Promise.resolve([rel]);
+    }),
+  );
+
+  return nested.flat();
+}
+
+async function filesEqual(a: string, b: string): Promise<boolean> {
+  const [ba, bb] = await Promise.all([
+    readFile(a).catch(() => null),
+    readFile(b).catch(() => null),
+  ]);
+
+  return ba !== null && bb !== null && ba.equals(bb);
+}
+
+// Returns the fraction of files in baseDir that exist and are identical in
+// destDir. Used to validate an inferred base: a correct base scores ~0.7-0.8+
+// (the files the merchant hasn't touched); a wrong base scores much lower.
+export async function computeBaseSimilarity(baseDir: string, destDir: string): Promise<number> {
+  const baseFiles = await listFiles(baseDir);
+
+  if (baseFiles.length === 0) return 0;
+
+  const matches = await Promise.all(
+    baseFiles.map((rel) => filesEqual(join(baseDir, rel), join(destDir, rel))),
+  );
+
+  return matches.filter(Boolean).length / baseFiles.length;
+}
+
+async function isBinary(p: string): Promise<boolean> {
+  const buf = await readFile(p).catch(() => null);
+
+  if (!buf) return false;
+
+  // Same heuristic git uses: a NUL byte near the start means binary.
+  return buf.subarray(0, 8000).includes(0);
+}
+
+async function copyInto(src: string, dest: string): Promise<void> {
+  await mkdir(dirname(dest), { recursive: true });
+  await copyFile(src, dest);
+}
+
+// ── ref parsing ─────────────────────────────────────────────────────────────
+// Splits "@bigcommerce/catalyst-core@1.7.0" → { packageName, version }.
+// The last "@" separates the version (scoped names start with "@").
+export function parseRef(ref: string): { packageName: string; version: string } {
+  const lastAt = ref.lastIndexOf('@');
+
+  if (lastAt <= 0) throw new Error(`Cannot parse ref "${ref}" — expected <package>@<version>.`);
+
+  return { packageName: ref.slice(0, lastAt), version: ref.slice(lastAt + 1) };
+}
+
+async function readResolvedVersion(coreDir: string): Promise<string> {
+  const raw = await readFile(join(coreDir, 'package.json'), 'utf-8');
+  const pkg = CorePackageJson.parse(JSON.parse(raw));
+
+  // catalyst.version is the source of truth; older tags lack it and fall back to version.
+  return pkg.catalyst?.version ?? pkg.version;
+}
+
+// ── per-file 3-way merge engine ───────────────────────────────────────────────
+type MergeOutcome = 'applied' | 'added' | 'deleted' | 'conflicted';
+
+// Runs git merge-file (standalone, no object store) writing the merged result
+// (with <<<ours/===/theirs>>> markers on conflict) to `oursPath`.
+async function mergeFile(oursPath: string, basePath: string, theirsPath: string): Promise<boolean> {
+  const merged = await execa(
+    'git',
+    [
+      'merge-file',
+      '-p',
+      '-L',
+      'ours',
+      '-L',
+      'base',
+      '-L',
+      'theirs',
+      oursPath,
+      basePath,
+      theirsPath,
+    ],
+    { reject: false, stripFinalNewline: false },
+  );
+
+  // git merge-file exits 0 (clean) or N>0 (N conflict hunks) — both are normal.
+  // A fatal error (e.g. unreadable file) produces stderr output; guard against
+  // overwriting the user's file with empty/partial stdout in that case.
+  if (merged.stderr) throw new Error(`git merge-file failed: ${merged.stderr}`);
+
+  await writeFile(oursPath, merged.stdout);
+
+  return (merged.exitCode ?? 0) > 0; // >0 = conflict hunks
+}
+
+async function mergeModified(
+  rel: string,
+  baseDir: string,
+  theirsDir: string,
+  catalystRoot: string,
+): Promise<MergeOutcome | null> {
+  const basePath = join(baseDir, rel);
+  const theirsPath = join(theirsDir, rel);
+  const oursPath = join(catalystRoot, rel);
+
+  // Upstream didn't actually change this file — nothing to do.
+  if (await filesEqual(basePath, theirsPath)) return null;
+
+  // Merchant deleted a file upstream modifies → restore theirs, flag for review.
+  if (!(await pathExists(oursPath))) {
+    await copyInto(theirsPath, oursPath);
+
+    return 'conflicted';
+  }
+
+  if ((await isBinary(basePath)) || (await isBinary(theirsPath)) || (await isBinary(oursPath))) {
+    if (await filesEqual(oursPath, basePath)) {
+      await copyInto(theirsPath, oursPath);
+
+      return 'applied';
+    }
+
+    return 'conflicted'; // binary both-changed — can't 3-way; leave ours
+  }
+
+  return (await mergeFile(oursPath, basePath, theirsPath)) ? 'conflicted' : 'applied';
+}
+
+async function mergeAdded(
+  rel: string,
+  theirsDir: string,
+  catalystRoot: string,
+  emptyFile: string,
+): Promise<MergeOutcome> {
+  const theirsPath = join(theirsDir, rel);
+  const oursPath = join(catalystRoot, rel);
+
+  if (!(await pathExists(oursPath))) {
+    await copyInto(theirsPath, oursPath);
+
+    return 'added';
+  }
+
+  if (await filesEqual(oursPath, theirsPath)) return 'applied'; // merchant already has it
+
+  if ((await isBinary(oursPath)) || (await isBinary(theirsPath))) return 'conflicted';
+
+  // Both added a different version — merge against an empty ancestor.
+  const hadConflict = await mergeFile(oursPath, emptyFile, theirsPath);
+
+  return hadConflict ? 'conflicted' : 'applied';
+}
+
+async function mergeDeleted(
+  rel: string,
+  baseDir: string,
+  catalystRoot: string,
+): Promise<MergeOutcome | null> {
+  const basePath = join(baseDir, rel);
+  const oursPath = join(catalystRoot, rel);
+
+  if (!(await pathExists(oursPath))) return null; // already gone
+
+  // Merchant kept upstream's version → safe to delete. Otherwise it's a
+  // delete/modify conflict: keep ours and flag.
+  if (await filesEqual(oursPath, basePath)) {
+    await rm(oursPath, { force: true });
+
+    return 'deleted';
+  }
+
+  return 'conflicted';
+}
+
+export interface MergeResult {
+  applied: string[];
+  added: string[];
+  deleted: string[];
+  conflicted: string[];
+}
+
+// Per-file engine: walk the changed-file set and merge each file with
+// `git merge-file`. Needs no git object store, so it works on shallow / no-history
+// merchant repos. Trade-off: no rename detection (a rename = delete + add).
+export async function mergeCorePerFile(
+  baseDir: string,
+  theirsDir: string,
+  catalystRoot: string,
+  emptyFile: string,
+): Promise<MergeResult> {
+  const baseFiles = new Set(await listFiles(baseDir));
+  const theirsFiles = new Set(await listFiles(theirsDir));
+  const result: MergeResult = { applied: [], added: [], deleted: [], conflicted: [] };
+
+  const decide = async (rel: string): Promise<void> => {
+    const inBase = baseFiles.has(rel);
+    const inTheirs = theirsFiles.has(rel);
+
+    let outcome: MergeOutcome | null;
+
+    if (inBase && inTheirs) {
+      outcome = await mergeModified(rel, baseDir, theirsDir, catalystRoot);
+    } else if (inTheirs) {
+      outcome = await mergeAdded(rel, theirsDir, catalystRoot, emptyFile);
+    } else {
+      outcome = await mergeDeleted(rel, baseDir, catalystRoot);
+    }
+
+    if (outcome) result[outcome].push(rel);
+  };
+
+  await Promise.all([...new Set([...baseFiles, ...theirsFiles])].map(decide));
+
+  return result;
+}
+
+// ── merge strategy selection ───────────────────────────────────────────────────
+export type MergeStrategy = 'auto' | 'tree' | 'per-file';
+
+// `git merge-tree --write-tree` (the whole-tree engine) landed in git 2.38.
+export async function gitSupportsMergeTree(): Promise<boolean> {
+  try {
+    const { stdout } = await execa('git', ['--version']);
+    const match = /(\d+)\.(\d+)/.exec(stdout);
+
+    if (!match) return false;
+
+    const [major, minor] = [Number(match[1]), Number(match[2])];
+
+    return major > 2 || (major === 2 && minor >= 38);
+  } catch {
+    return false;
+  }
+}
+
+// 'auto' resolves to the whole-tree engine when git supports it, else per-file.
+export async function resolveStrategy(strategy: MergeStrategy): Promise<'tree' | 'per-file'> {
+  if (strategy !== 'auto') return strategy;
+
+  if (await gitSupportsMergeTree()) return 'tree';
+
+  consola.warn('git < 2.38 — using the per-file merge engine (no `git merge-tree`).');
+
+  return 'per-file';
+}
+
+// ── whole-tree 3-way merge engine (git merge-tree, 2.38+) ──────────────────────
+// Builds base/ours/theirs as commits in a throwaway object store, runs a real
+// recursive merge (rename detection, modify/delete, mode changes, binary — all
+// native to git), then materialises the merged tree into the catalyst root.
+// Conflicts come back as in-blob <<<ours/===/theirs>>> markers; like per-file it
+// never aborts. Branch names `ours`/`theirs` make the markers match the per-file
+// engine's labels.
+export async function mergeCoreTree(
+  baseDir: string,
+  theirsDir: string,
+  catalystRoot: string,
+): Promise<MergeResult> {
+  const scratch = await mkdtemp(join(tmpdir(), 'catalyst-merge-'));
+
+  try {
+    await execa('git', ['init', '-q', scratch]);
+    // Disable line-ending conversion so checkout-index writes LF on all platforms.
+    await execa('git', ['config', 'core.autocrlf', 'false'], {
+      env: { ...process.env, GIT_DIR: join(scratch, '.git') },
+    });
+
+    const env = {
+      ...process.env,
+      GIT_DIR: join(scratch, '.git'),
+      GIT_AUTHOR_NAME: 'catalyst',
+      GIT_AUTHOR_EMAIL: 'catalyst@bigcommerce.com',
+      GIT_COMMITTER_NAME: 'catalyst',
+      GIT_COMMITTER_EMAIL: 'catalyst@bigcommerce.com',
+    };
+
+    // Snapshot a directory as a tree object (own index per side; .gitignore is
+    // honoured, so build artifacts like node_modules never enter the tree).
+    const writeTree = async (workTree: string, tag: string): Promise<string> => {
+      const sideEnv = {
+        ...env,
+        GIT_WORK_TREE: workTree,
+        GIT_INDEX_FILE: join(scratch, `index.${tag}`),
+      };
+
+      await execa('git', ['add', '-A'], { env: sideEnv });
+
+      return (await execa('git', ['write-tree'], { env: sideEnv })).stdout.trim();
+    };
+
+    const commitTree = (tree: string, parent?: string) =>
+      execa('git', ['commit-tree', tree, '-m', 'x', ...(parent ? ['-p', parent] : [])], {
+        env,
+      }).then((r) => r.stdout.trim());
+
+    // Run sequentially to avoid concurrent writes to the shared object store
+    // on Windows, where simultaneous git processes cause EPERM on object files.
+    const baseTree = await writeTree(baseDir, 'base');
+    const oursTree = await writeTree(catalystRoot, 'ours');
+    const theirsTree = await writeTree(theirsDir, 'theirs');
+
+    const baseCommit = await commitTree(baseTree);
+    const [oursCommit, theirsCommit] = await Promise.all([
+      commitTree(oursTree, baseCommit),
+      commitTree(theirsTree, baseCommit),
+    ]);
+
+    await Promise.all([
+      execa('git', ['branch', 'ours', oursCommit], { env }),
+      execa('git', ['branch', 'theirs', theirsCommit], { env }),
+    ]);
+
+    // -z --name-only output: <merged-tree-oid> NUL, then conflicted paths each
+    // NUL-terminated, then an empty field marks the end of the conflicted set
+    // (everything after is informational messages we don't need).
+    const merge = await execa(
+      'git',
+      [
+        'merge-tree',
+        '--write-tree',
+        '-z',
+        '--name-only',
+        `--merge-base=${baseCommit}`,
+        'ours',
+        'theirs',
+      ],
+      { env, reject: false },
+    );
+
+    if ((merge.exitCode ?? 0) > 1)
+      throw new Error(merge.stderr || merge.stdout.slice(0, 500) || 'git merge-tree failed');
+
+    // -z --name-only emits <merged-tree-oid>, then conflicted paths, then an
+    // empty field; everything after that is informational and ignored.
+    const fields = merge.stdout.split('\0');
+    const mergedTree = fields[0];
+    const afterOid = fields.slice(1);
+    const emptyAt = afterOid.indexOf('');
+    const conflicted = afterOid.slice(0, emptyAt === -1 ? afterOid.length : emptyAt);
+    const conflictedSet = new Set(conflicted);
+
+    // Materialise the merged tree into the catalyst root (conflict markers are
+    // already baked into the conflicted blobs).
+    const outEnv = {
+      ...env,
+      GIT_WORK_TREE: catalystRoot,
+      GIT_INDEX_FILE: join(scratch, 'index.out'),
+    };
+
+    await execa('git', ['read-tree', mergedTree], { env: outEnv });
+    await execa('git', ['checkout-index', '-a', '-f'], { env: outEnv });
+
+    // Classify ours → merged. -z --name-status emits [status, path, status, …].
+    const diff = await execa(
+      'git',
+      ['diff', '-z', '--no-renames', '--name-status', oursTree, mergedTree],
+      { env },
+    );
+
+    const tokens = diff.stdout.split('\0');
+    const changes: Array<{ status: string; path: string }> = [];
+
+    for (let i = 0; i + 1 < tokens.length; i += 2) {
+      const status = tokens[i];
+      const path = tokens[i + 1];
+
+      if (status && path && !conflictedSet.has(path)) {
+        changes.push({ status, path });
+      }
+    }
+
+    // checkout-index only writes; it won't remove paths the merge dropped.
+    const deleted = changes.filter((change) => change.status === 'D').map((change) => change.path);
+
+    await Promise.all(deleted.map((path) => rm(join(catalystRoot, path), { force: true })));
+
+    return {
+      applied: changes
+        .filter((change) => change.status !== 'A' && change.status !== 'D')
+        .map((change) => change.path),
+      added: changes.filter((change) => change.status === 'A').map((change) => change.path),
+      deleted,
+      conflicted,
+    };
+  } finally {
+    await rm(scratch, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
+  }
+}
+
+// ── index staging ──────────────────────────────────────────────────────────────
+// After the merge, stage everything that merged cleanly (so the merchant only
+// reviews what needs attention) and register conflicted files as real unmerged
+// index entries: stage 1 = base, 2 = ours (the committed pre-upgrade blob),
+// 3 = theirs. `git status` then reports them as conflicts (UU / AA / DU), which
+// lights up editors' merge UIs. No MERGE_HEAD — the target tag isn't an ancestor,
+// so resolving is a normal `git add` + commit, not a merge commit.
+export async function applyIndexState(
+  gitRoot: string,
+  relDir: string,
+  baseDir: string,
+  theirsDir: string,
+  result: MergeResult,
+  stampedPkg: boolean,
+): Promise<void> {
+  const toRepoPath = (rel: string) => (relDir === '.' ? rel : `${relDir}/${rel}`);
+  const pkgRel = 'package.json';
+
+  // If the stamp resolved package.json (stripped its conflict markers and wrote
+  // clean JSON), treat it as a clean file rather than a conflict — it should be
+  // staged normally so it shows up in `git diff --cached`, not registered as UU.
+  const stillConflicted = result.conflicted.filter((rel) => !(stampedPkg && rel === pkgRel));
+  const conflictedRepoPaths = new Set(stillConflicted.map(toRepoPath));
+
+  // 1. Pre-stage the clean changes (+ the resolved package.json when stamped).
+  const clean = [...result.applied, ...result.added, ...result.deleted].map(toRepoPath);
+
+  if (stampedPkg) clean.push(toRepoPath(pkgRel));
+
+  const toStage = [...new Set(clean)].filter((path) => !conflictedRepoPaths.has(path));
+
+  if (toStage.length) {
+    await execa('git', ['add', '-A', '--', ...toStage], { cwd: gitRoot });
+  }
+
+  if (stillConflicted.length === 0) return;
+
+  // 2. Conflicts → unmerged index entries. ours = the committed blob (the
+  //    clean-tree precondition guarantees the worktree matched HEAD before the
+  //    merge); base/theirs blobs get written into the repo's object store.
+  const OID = /^[0-9a-f]{40,64}$/;
+  // Detect SHA-256 repos (git 2.29+). SHA-1 uses a 40-zero null OID; SHA-256 uses 64.
+  const gitFormat = (
+    await execa('git', ['rev-parse', '--show-object-format'], { cwd: gitRoot, reject: false })
+  ).stdout.trim();
+  const NULL_OID = gitFormat === 'sha256' ? '0'.repeat(64) : '0'.repeat(40);
+
+  // Write a file's content as a blob; null if the file is absent or the OID
+  // comes back malformed (guards against shell wrappers polluting stdout).
+  const hashBlob = async (file: string): Promise<string | null> => {
+    if (!(await pathExists(file))) return null;
+
+    const oid = (
+      await execa('git', ['hash-object', '-w', '--', file], { cwd: gitRoot })
+    ).stdout.trim();
+
+    return OID.test(oid) ? oid : null;
+  };
+
+  // ours mode + blob via `ls-tree`. Unlike `rev-parse HEAD:<path>`, ls-tree
+  // never echoes a missing path back as if it were an object name.
+  const headEntry = async (repoPath: string): Promise<{ mode: string; oid: string } | null> => {
+    const { stdout } = await execa('git', ['ls-tree', 'HEAD', '--', repoPath], {
+      cwd: gitRoot,
+      reject: false,
+    });
+    const match = /^(\d{6}) blob ([0-9a-f]+)\t/.exec(stdout);
+
+    return match ? { mode: match[1], oid: match[2] } : null;
+  };
+
+  const records = await Promise.all(
+    stillConflicted.map(async (rel) => {
+      const repoPath = toRepoPath(rel);
+      const [base, ours, theirs] = await Promise.all([
+        hashBlob(join(baseDir, rel)),
+        headEntry(repoPath),
+        hashBlob(join(theirsDir, rel)),
+      ]);
+
+      return [
+        `0 ${NULL_OID}\t${repoPath}`,
+        ...(base ? [`100644 ${base} 1\t${repoPath}`] : []),
+        ...(ours ? [`${ours.mode} ${ours.oid} 2\t${repoPath}`] : []),
+        ...(theirs ? [`100644 ${theirs} 3\t${repoPath}`] : []),
+      ].join('\n');
+    }),
+  );
+
+  await execa('git', ['update-index', '--index-info'], {
+    cwd: gitRoot,
+    input: `${records.join('\n')}\n`,
+  });
+}
+
+// ── project (destination) layout resolution ───────────────────────────────────
+// The command is merchant-facing and must support two repo shapes:
+//   * flat (future)  — core/ contents at the repo root (package.json at root)
+//   * nested (deprecated monorepo clone) — core/package.json under <root>/core
+// We locate the package.json carrying the `catalyst` field; if none has it yet
+// we fall back to the most likely Catalyst package.json so the auto-detect path
+// can still run.
+interface Project {
+  gitRoot: string;
+  catalystRoot: string;
+  relDir: string; // "." (flat) or "core" (nested), relative to gitRoot
+  pkgPath: string;
+  rawContent: string;
+  pkg: z.infer<typeof CorePackageJson>;
+}
+
+export async function resolveProject(cwd: string): Promise<Project | null> {
+  let gitRoot: string;
+
+  try {
+    gitRoot = (await execa('git', ['rev-parse', '--show-toplevel'], { cwd })).stdout.trim();
+  } catch {
+    return null;
+  }
+
+  // Probe order favours the nested core/ first (a monorepo clone also has a
+  // root package.json we don't want), then flat, then the cwd variants.
+  const candidateDirs = [...new Set([join(gitRoot, 'core'), gitRoot, join(cwd, 'core'), cwd])];
+
+  const parsed = (
+    await Promise.all(
+      candidateDirs.map(async (dir) => {
+        const pkgPath = join(dir, 'package.json');
+        const raw = await readFile(pkgPath, 'utf-8').catch(() => null);
+
+        if (!raw) return null;
+
+        let pkgJson: unknown;
+
+        try {
+          pkgJson = JSON.parse(raw);
+        } catch {
+          return null;
+        }
+
+        const result = CorePackageJson.safeParse(pkgJson);
+
+        return result.success ? { dir, pkgPath, raw, pkg: result.data } : null;
+      }),
+    )
+  ).filter((entry) => entry !== null);
+
+  if (parsed.length === 0) return null;
+
+  // Prefer the package.json that already declares `catalyst`; otherwise fall
+  // back to one that looks like a Catalyst project (known family name).
+  const chosen =
+    parsed.find((p) => p.pkg.catalyst?.ref) ??
+    parsed.find((p) => p.pkg.name !== undefined && KNOWN_FAMILIES.has(p.pkg.name)) ??
+    parsed[0];
+
+  return {
+    gitRoot,
+    catalystRoot: chosen.dir,
+    relDir: relative(gitRoot, chosen.dir) || '.',
+    pkgPath: chosen.pkgPath,
+    rawContent: chosen.raw,
+    pkg: chosen.pkg,
+  };
+}
+
+// ── tarball download (source side stays the monorepo) ─────────────────────────
+export async function downloadCore(
+  repository: string,
+  ref: string,
+  destDir: string,
+  token?: string,
+): Promise<void> {
+  // Never cache moving tags (latest/canary/alpha) — they'd go stale silently.
+  const cacheable = !MOVING_TAGS.has(parseRef(ref).version);
+  // Use a separator before the ref so that repository strings differing only
+  // by characters that sanitize to '_' (e.g. '/' vs '_') produce distinct keys.
+  const cacheKey = `${repository.replace(/[^a-zA-Z0-9._-]/g, '_')}__${ref.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+  const cachePath = join(CACHE_DIR, cacheKey);
+
+  // Guard against a partially-written cache entry: two concurrent downloadCore
+  // calls for the same ref can race — the first creates cachePath mid-copy, and
+  // the second sees it as present but gets an incomplete directory. Validate with
+  // a package.json sentinel (every extracted core/ tree must have one).
+  if (
+    cacheable &&
+    (await pathExists(cachePath)) &&
+    (await pathExists(join(cachePath, 'package.json')))
+  ) {
+    await cp(cachePath, destDir, { recursive: true });
+
+    return;
+  }
+
+  // encodeURIComponent turns "@bigcommerce/catalyst-core@1.7.0" into
+  // "%40bigcommerce%2Fcatalyst-core%401.7.0", which the API accepts.
+  const url = `https://api.github.com/repos/${repository}/tarball/${encodeURIComponent(ref)}`;
+  const headers: Record<string, string> = {
+    'User-Agent': 'catalyst-cli',
+    Accept: 'application/vnd.github+json',
+  };
+
+  if (token) headers.Authorization = `Bearer ${token}`;
+
+  const res = await fetch(url, { headers });
+
+  if (!res.ok) {
+    let hint = '';
+
+    if (res.status === 404) hint = ` — tag "${ref}" not found in ${repository}`;
+    if (res.status === 403) hint = ' — GitHub rate limit hit; set GITHUB_TOKEN to raise it';
+
+    throw new Error(`GitHub returned ${res.status} for ${ref}${hint}`);
+  }
+
+  const tarballPath = `${destDir}.tgz`;
+  const rawDir = `${destDir}.raw`;
+
+  await writeFile(tarballPath, Buffer.from(await res.arrayBuffer()));
+  await mkdir(rawDir, { recursive: true });
+  // --strip-components=1 drops the "bigcommerce-catalyst-<sha>/" top dir.
+  await execa('tar', ['-xzf', tarballPath, '-C', rawDir, '--strip-components=1']);
+
+  // Source is expected to be the monorepo (core/ inside); fall back to the
+  // extracted root for a hypothetical flat-source tag (insurance, not a target).
+  const coreDir = join(rawDir, 'core');
+  const sourceDir = (await pathExists(coreDir)) ? coreDir : rawDir;
+
+  await rename(sourceDir, destDir);
+  await rm(tarballPath, { force: true });
+  await rm(rawDir, { recursive: true, force: true });
+
+  if (cacheable) {
+    await mkdir(CACHE_DIR, { recursive: true });
+    await cp(destDir, cachePath, { recursive: true }).catch(() => {
+      /* best-effort cache; ignore failures */
+    });
+  }
+}
+
+// ── base-ref resolution / auto-detect ─────────────────────────────────────────
+// Returns the base ref to diff from, auto-detecting when catalyst.ref is absent.
+export async function resolveBaseRef(
+  project: Project,
+  fromOption: string | undefined,
+  assumeYes: boolean,
+): Promise<string | null> {
+  if (project.pkg.catalyst?.ref) return project.pkg.catalyst.ref;
+  if (fromOption) return fromOption;
+
+  // Older projects mirror the Catalyst version in `version`; the package `name`
+  // tells us the family. Propose the inferred ref and let the merchant confirm.
+  const family =
+    project.pkg.name && KNOWN_FAMILIES.has(project.pkg.name)
+      ? project.pkg.name
+      : '@bigcommerce/catalyst-core';
+  const guess = `${family}@${project.pkg.version}`;
+
+  consola.warn(`No \`catalyst.ref\` found in package.json. Inferred base: ${guess}`);
+
+  if (assumeYes) return guess;
+
+  const ok = await confirm({ message: `Upgrade from ${guess}?`, default: true }).catch(() => false);
+
+  if (!ok) {
+    consola.info('Re-run with `--from <ref>` to set the base version explicitly.');
+
+    return null;
+  }
+
+  return guess;
+}
+
+// ── summary output ────────────────────────────────────────────────────────────
+function printSummary(result: MergeResult, relDir: string, stampedPkg: boolean): void {
+  // package.json is excluded from the conflict list when the stamp resolved it.
+  const unresolved = result.conflicted.filter((f) => !(stampedPkg && f === 'package.json'));
+
+  const parts = [
+    `${result.applied.length} updated`,
+    `${result.added.length} added`,
+    `${result.deleted.length} removed`,
+  ];
+
+  if (unresolved.length) parts.push(`${unresolved.length} with conflicts`);
+
+  consola.log(`\n${parts.join(', ')}`);
+
+  if (unresolved.length) {
+    const files = unresolved.map((f) => `  ${f}`).join('\n');
+
+    consola.warn(
+      `\nStaged the clean changes. ${unresolved.length} file(s) need conflict resolution (the <<<ours/===/theirs>>> markers):\n${files}\n\nResolve them, then: git add ${relDir} && git commit`,
+    );
+  } else {
+    consola.success('Staged all changes — review with `git diff --cached`, then commit.');
+  }
+}
+
+export const upgrade = new Command('upgrade')
+  .configureHelp({ showGlobalOptions: true })
+  .aliases([
+    'up',
+    // These are hidden aliases
+    'upgrayedd',
+    'ugrad',
+  ])
+  .description('Upgrade your Catalyst project to a newer version by applying a 3-way merge.')
+  .argument('[version]', 'Target version to upgrade to (default: latest)')
+  .addOption(
+    new Option(
+      '--ref <ref>',
+      'Full git tag to upgrade to, e.g. an integration family like @bigcommerce/catalyst-makeswift@1.7.0. Overrides [version].',
+    ),
+  )
+  .addOption(new Option('--from <ref>', 'Base ref to upgrade from (when catalyst.ref is missing)'))
+  .option('--dry-run', 'Generate and display the diff without applying it')
+  .option('--yes', 'Skip confirmation prompts (e.g. inferred base ref)')
+  .addOption(
+    new Option(
+      '--strategy <strategy>',
+      'Merge engine: tree (git merge-tree, full fidelity), per-file (git merge-file, no-history fallback), or auto (tree when git >= 2.38, else per-file)',
+    )
+      .choices(['auto', 'tree', 'per-file'] as const)
+      .default('auto' as const)
+      .hideHelp(),
+  )
+  .addOption(
+    new Option('--repository <owner/repo>', 'GitHub repository to pull versions from').default(
+      DEFAULT_REPOSITORY,
+    ),
+  )
+  .addHelpText(
+    'after',
+    `
+Examples:
+  # Upgrade to the latest Catalyst version
+  $ catalyst upgrade
+
+  # Upgrade to a specific version
+  $ catalyst upgrade 1.8.0
+
+  # Preview what would change without applying
+  $ catalyst upgrade --dry-run
+
+  # Upgrade to an integration family (makeswift, b2b-makeswift, ...)
+  $ catalyst upgrade --ref @bigcommerce/catalyst-makeswift@1.7.0
+
+Conflicts are written as standard <<<ours/===/theirs>>> markers — the upgrade
+never aborts. Versions are git tags on the repository (not npm). Set GITHUB_TOKEN
+to raise the GitHub API rate limit.`,
+  )
+  // eslint-disable-next-line complexity
+  .action(async (version, options) => {
+    // ── 1. Resolve the merchant project (flat or nested layout) ───────────
+    const project = await resolveProject(process.cwd());
+
+    if (!project) {
+      consola.error(
+        'Run `catalyst upgrade` from inside a Catalyst git repository (flat core/ repo or a project containing core/).',
+      );
+      process.exit(1);
+    }
+
+    const { gitRoot, catalystRoot, relDir, pkgPath } = project;
+
+    // ── 2. Resolve base + target refs ─────────────────────────────────────
+    const baseRef = await resolveBaseRef(project, options.from, options.yes ?? false);
+
+    if (!baseRef) process.exit(1);
+
+    let basePackage: string;
+    let upstreamRef: string;
+    let upstreamTagVersion: string;
+
+    try {
+      ({ packageName: basePackage } = parseRef(baseRef));
+      upstreamRef = options.ref ?? `${basePackage}@${version ?? 'latest'}`;
+      ({ version: upstreamTagVersion } = parseRef(upstreamRef));
+    } catch {
+      consola.error(
+        `Invalid ref format — expected <package>@<version> (e.g. @bigcommerce/catalyst-core@1.7.0). Got: "${baseRef}"`,
+      );
+      process.exit(1);
+    }
+
+    if (upstreamRef === baseRef) {
+      consola.success('Already up to date.');
+
+      return;
+    }
+
+    // ── 3. Require a clean working tree at the catalyst root (preview exempt) ─
+    // The merge writes in place, so pre-existing uncommitted edits would be
+    // indistinguishable from the upgrade. Committing/stashing first gives the
+    // merchant a clean point to diff and roll back from.
+    if (!options.dryRun) {
+      const statusArgs = relDir === '.' ? [] : ['--', relDir];
+      const status = await execa('git', ['status', '--porcelain', ...statusArgs], {
+        cwd: gitRoot,
+        reject: false,
+      });
+
+      if (status.stdout.trim()) {
+        const where = relDir === '.' ? 'The repo' : `${relDir}/`;
+
+        consola.error(
+          `${where} has uncommitted changes. Commit or stash them before upgrading, so the upgrade is isolated and reversible:\n  git add ${relDir} && git commit -m "snapshot before upgrade"\n  # or: git stash`,
+        );
+        process.exit(1);
+      }
+    }
+
+    // ── 3b. Backfill catalyst.ref when it was inferred ────────────────────
+    // If catalyst.ref was absent and the user confirmed an inferred base (not
+    // an explicit --from), write the field and stage it so it travels with the
+    // upgrade commit. Runs after the clean-tree check so we only add to an
+    // already-clean index. --from is excluded: the user already knows the base
+    // and shouldn't get an extra staged change they didn't ask for.
+    if (!project.pkg.catalyst?.ref && !options.from && !options.dryRun) {
+      const { version: baseVersion } = parseRef(baseRef);
+      const rawPkg = await readFile(pkgPath, 'utf-8');
+      const parsedPkg = z.record(z.string(), z.unknown()).parse(JSON.parse(rawPkg));
+
+      parsedPkg.catalyst = { version: baseVersion, ref: baseRef };
+      await writeFile(pkgPath, `${JSON.stringify(parsedPkg, null, 2)}\n`);
+      await execa('git', ['add', '--', pkgPath], { cwd: gitRoot });
+      consola.success(`Added catalyst.ref → ${baseRef}`);
+    }
+
+    const token = process.env.GITHUB_TOKEN;
+    const tmpDir = await mkdtemp(join(tmpdir(), 'catalyst-upgrade-'));
+
+    try {
+      const baseDir = join(tmpDir, 'base');
+      const theirsDir = join(tmpDir, 'theirs');
+      const emptyFile = join(tmpDir, '.empty');
+
+      await writeFile(emptyFile, '');
+
+      const downloadSpinner = yoctoSpinner().start(`Downloading ${baseRef} and ${upstreamRef}...`);
+
+      try {
+        await Promise.all([
+          downloadCore(options.repository, baseRef, baseDir, token),
+          downloadCore(options.repository, upstreamRef, theirsDir, token),
+        ]);
+        downloadSpinner.success('Downloaded both versions.');
+      } catch (err) {
+        downloadSpinner.error('Download failed');
+        throw err;
+      }
+
+      // When the base was auto-inferred (no catalyst.ref, no --from), validate
+      // the guess by checking how many base files are unmodified in the project.
+      // A correct base scores ~70-80%+; a wrong guess (e.g. merchant manually
+      // bumped their version field without actually upgrading) scores much lower.
+      if (!project.pkg.catalyst?.ref && !options.from) {
+        const similarity = await computeBaseSimilarity(baseDir, catalystRoot);
+        const pct = Math.round(similarity * 100);
+
+        if (similarity < 0.5) {
+          consola.warn(
+            `Low confidence in inferred base ${baseRef} (${pct}% of base files match your project). If the merge result looks off, re-run with \`--from <correct-version>\` to set the base explicitly.`,
+          );
+        }
+      }
+
+      // For moving tags (latest/canary/alpha) we don't know the real version
+      // until the tarball lands, so read it from the downloaded package.json.
+      // For concrete tags the version is already in the tag itself.
+      const resolvedVersion = MOVING_TAGS.has(upstreamTagVersion)
+        ? await readResolvedVersion(theirsDir)
+        : upstreamTagVersion;
+      const newRef = MOVING_TAGS.has(upstreamTagVersion)
+        ? `${basePackage}@${resolvedVersion}`
+        : upstreamRef;
+
+      // ── 4. Dry run: show the unified diff and stop ──────────────────────
+      if (options.dryRun) {
+        const diffSpinner = yoctoSpinner().start('Generating diff...');
+        const diff = await execa(
+          'git',
+          ['diff', '--no-index', '--binary', '--diff-algorithm=histogram', 'base', 'theirs'],
+          { cwd: tmpDir, reject: false, stripFinalNewline: false },
+        );
+
+        if ((diff.exitCode ?? 0) > 1) {
+          diffSpinner.error('Failed to generate diff');
+          throw new Error(diff.stderr);
+        }
+
+        if (!diff.stdout.trim()) {
+          diffSpinner.success('No differences between versions — already up to date.');
+
+          return;
+        }
+
+        const fileCount = (diff.stdout.match(/^diff --git /gm) ?? []).length;
+
+        diffSpinner.success(`Diff ready — ${fileCount} file(s) affected.`);
+        consola.log('\nDiff preview (--dry-run, not applied):\n');
+        consola.log(diff.stdout);
+
+        return;
+      }
+
+      // ── 5. Apply via 3-way merge (whole-tree by default, per-file fallback) ─
+      const strategy = await resolveStrategy(options.strategy);
+      const mergeSpinner = yoctoSpinner().start(`Merging changes (${strategy})...`);
+      const result =
+        strategy === 'tree'
+          ? await mergeCoreTree(baseDir, theirsDir, catalystRoot)
+          : await mergeCorePerFile(baseDir, theirsDir, catalystRoot, emptyFile);
+      const total =
+        result.applied.length +
+        result.added.length +
+        result.deleted.length +
+        result.conflicted.length;
+
+      if (total === 0) {
+        mergeSpinner.success('No differences between versions — already up to date.');
+
+        return;
+      }
+
+      if (result.conflicted.length) {
+        mergeSpinner.warning('Merged with conflicts — resolve the markers, then commit.');
+      } else {
+        mergeSpinner.success('Merged cleanly.');
+      }
+
+      // ── 6. Stamp catalyst.ref (skip if package.json itself conflicted) ──
+      const patchedRaw = await readFile(pkgPath, 'utf-8');
+
+      let stampedPkg = false;
+
+      try {
+        const patchedPkg = z.record(z.string(), z.unknown()).parse(JSON.parse(patchedRaw));
+
+        patchedPkg.catalyst = { version: resolvedVersion, ref: newRef };
+        await writeFile(pkgPath, `${JSON.stringify(patchedPkg, null, 2)}\n`);
+        stampedPkg = true;
+        consola.success(`catalyst.ref updated → ${newRef}`);
+      } catch {
+        // package.json has conflict markers (scripts, deps, etc.). The catalyst
+        // field was added cleanly by ours and should sit outside the conflict
+        // blocks — so replace just that field in-place, leaving all other conflict
+        // markers intact for the merchant to resolve normally.
+        const catalystReplacement = JSON.stringify(
+          { version: resolvedVersion, ref: newRef },
+          null,
+          2,
+        )
+          .split('\n')
+          .map((line, i) => (i === 0 ? line : `  ${line}`))
+          .join('\n');
+
+        // Use a function replacer to prevent $-interpolation in the replacement string
+        // (e.g. $& or $1 in a ref/version value would silently corrupt the output).
+        const updated = patchedRaw.replace(
+          /"catalyst":\s*\{[^}]*\}/,
+          () => `"catalyst": ${catalystReplacement}`,
+        );
+
+        if (updated !== patchedRaw) {
+          await writeFile(pkgPath, updated);
+          // stampedPkg stays false — the file still has conflict markers in other
+          // sections, so it must stay as a UU unmerged entry so the editor shows
+          // the merge UI. Only the catalyst field was resolved in place.
+          consola.success(`catalyst.ref updated → ${newRef}`);
+          consola.info(
+            'package.json still has conflicts in other sections — resolve them, then: git add package.json',
+          );
+        } else {
+          consola.warn(
+            `package.json has conflicts — after resolving, add:\n  "catalyst": { "version": "${resolvedVersion}", "ref": "${newRef}" }`,
+          );
+        }
+      }
+
+      // ── 7. Stage the clean changes; mark conflicts as real unmerged entries ─
+      // Staging is a convenience; the merge already landed on disk, so never let
+      // a git quirk here fail the whole upgrade.
+      try {
+        await applyIndexState(gitRoot, relDir, baseDir, theirsDir, result, stampedPkg);
+      } catch (err) {
+        consola.warn(
+          `Couldn't auto-stage the changes (${err instanceof Error ? err.message : String(err)}). Your files are merged on disk — run \`git add ${relDir}\` yourself.`,
+        );
+      }
+
+      const gitVersion = await execa('git', ['--version'])
+        .then((r) => r.stdout.trim())
+        .catch(() => 'unknown');
+
+      await getTelemetry().track('upgrade', {
+        strategy,
+        gitVersion,
+        dryRun: Boolean(options.dryRun),
+        applied: result.applied.length,
+        added: result.added.length,
+        deleted: result.deleted.length,
+        conflicts: result.conflicted.length,
+        hasConflicts: result.conflicted.length > 0,
+      });
+
+      printSummary(result, relDir, stampedPkg);
+    } finally {
+      await rm(tmpDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
+    }
+  });
diff --git a/packages/catalyst/src/cli/commands/version.ts b/packages/catalyst/src/cli/commands/version.ts
index 935cf2f9a0..262f8fbdd4 100644
--- a/packages/catalyst/src/cli/commands/version.ts
+++ b/packages/catalyst/src/cli/commands/version.ts
@@ -4,7 +4,14 @@ import PACKAGE_INFO from '../../../package.json';
 import { consola } from '../lib/logger';
 
 export const version = new Command('version')
+  .configureHelp({ showGlobalOptions: true })
   .description('Display detailed version information.')
+  .addHelpText(
+    'after',
+    `
+Example:
+  $ catalyst version`,
+  )
   .action(() => {
     consola.log('Version Information:');
     consola.log(`CLI Version: ${PACKAGE_INFO.version}`);
diff --git a/packages/catalyst/src/cli/hooks/telemetry.ts b/packages/catalyst/src/cli/hooks/telemetry.ts
index c9e3de7a80..045203d030 100644
--- a/packages/catalyst/src/cli/hooks/telemetry.ts
+++ b/packages/catalyst/src/cli/hooks/telemetry.ts
@@ -1,8 +1,6 @@
-import { Command } from '@commander-js/extra-typings';
+import { Command, type CommandUnknownOpts } from '@commander-js/extra-typings';
 
-import { Telemetry } from '../lib/telemetry';
-
-const telemetry = new Telemetry();
+import { getTelemetry } from '../lib/telemetry';
 
 const allowlistArguments = ['--keep-temp-dir', '--api-host', '--project-uuid'];
 
@@ -35,16 +33,34 @@ function parseArguments(args: string[]) {
   }, {});
 }
 
-export const telemetryPreHook = async (command: Command) => {
-  const [commandName, ...args] = command.args;
+function getCommandPath(cmd: CommandUnknownOpts): string {
+  const parts: string[] = [];
+  let current: CommandUnknownOpts | null = cmd;
+
+  while (current.parent) {
+    parts.unshift(current.name());
+    current = current.parent;
+  }
+
+  return parts.join(' ');
+}
+
+export const telemetryPreHook = async (thisCommand: Command, actionCommand: CommandUnknownOpts) => {
+  const telemetry = getTelemetry();
+  const commandName = getCommandPath(actionCommand);
+
+  telemetry.commandName = commandName;
 
   // Return the await to get a proper stack trace.
   // eslint-disable-next-line @typescript-eslint/no-confusing-void-expression
   return await telemetry.track(commandName, {
-    ...parseArguments(args),
+    ...parseArguments(thisCommand.args),
   });
 };
 
 export const telemetryPostHook = async () => {
+  const telemetry = getTelemetry();
+
+  await telemetry.track('command_completed', { durationMs: telemetry.durationMs() });
   await telemetry.analytics.closeAndFlush();
 };
diff --git a/packages/catalyst/src/cli/index.spec.ts b/packages/catalyst/src/cli/index.spec.ts
index 76f750de9b..9a0020e6ab 100644
--- a/packages/catalyst/src/cli/index.spec.ts
+++ b/packages/catalyst/src/cli/index.spec.ts
@@ -1,5 +1,7 @@
 import { Command } from '@commander-js/extra-typings';
-import { describe, expect, test, vi } from 'vitest';
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { afterEach, describe, expect, test, vi } from 'vitest';
 
 vi.mock('./hooks/telemetry', () => ({
   telemetryPreHook: vi.fn().mockResolvedValue(undefined),
@@ -7,6 +9,7 @@ vi.mock('./hooks/telemetry', () => ({
 }));
 
 import { telemetryPostHook, telemetryPreHook } from './hooks/telemetry';
+import { mkTempDir } from './lib/mk-temp-dir';
 import { program } from './program';
 
 describe('CLI program', () => {
@@ -14,24 +17,37 @@ describe('CLI program', () => {
     expect(program).toBeInstanceOf(Command);
     expect(program.name()).toBe(process.env.npm_package_name);
     expect(program.version()).toBe(process.env.npm_package_version);
-    expect(program.description()).toBe('CLI tool for Catalyst development');
+    expect(program.description()).toContain('CLI tool for Catalyst development');
   });
 
   test('has expected commands', () => {
     const commands = program.commands.map((cmd) => cmd.name());
 
     expect(commands).toContain('version');
-    expect(commands).toContain('dev');
     expect(commands).toContain('start');
     expect(commands).toContain('build');
     expect(commands).toContain('deploy');
     expect(commands).toContain('project');
+    expect(commands).toContain('auth');
+    expect(commands).toContain('logs');
 
     const projectCmd = program.commands.find((cmd) => cmd.name() === 'project');
 
     expect(projectCmd?.commands.map((c) => c.name())).toEqual(
       expect.arrayContaining(['create', 'list', 'link']),
     );
+
+    const authCmd = program.commands.find((cmd) => cmd.name() === 'auth');
+
+    expect(authCmd?.commands.map((c) => c.name())).toEqual(
+      expect.arrayContaining(['whoami', 'login', 'logout']),
+    );
+
+    const logsCmd = program.commands.find((cmd) => cmd.name() === 'logs');
+
+    expect(logsCmd?.commands.map((c) => c.name())).toEqual(
+      expect.arrayContaining(['tail', 'query']),
+    );
   });
 
   test('telemetry hooks are called when executing version command', async () => {
@@ -46,3 +62,49 @@ describe('CLI program', () => {
     expect(telemetryPreHook).toHaveBeenCalledWith(expect.any(Command), expect.any(Command));
   });
 });
+
+describe('env-file loading', () => {
+  afterEach(() => {
+    delete process.env.CATALYST_STORE_HASH;
+    delete process.env.CATALYST_ACCESS_TOKEN;
+  });
+
+  test('--env-path is not a global option', () => {
+    const hasGlobalEnvPath = program.options.some((option) => option.long === '--env-path');
+
+    expect(hasGlobalEnvPath).toBe(false);
+  });
+
+  test('build and deploy expose an --env-path option', () => {
+    ['build', 'deploy'].forEach((name) => {
+      const command = program.commands.find((cmd) => cmd.name() === name);
+
+      expect(command?.options.some((option) => option.long === '--env-path')).toBe(true);
+    });
+  });
+
+  test('a non-build command does not load a .env.local from cwd', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('catalyst-env-path-');
+    const envPath = join(tmpDir, '.env.local');
+
+    await writeFile(
+      envPath,
+      'CATALYST_STORE_HASH=should-not-load\nCATALYST_ACCESS_TOKEN=should-not-load',
+      'utf-8',
+    );
+
+    const originalCwd = process.cwd();
+
+    process.chdir(tmpDir);
+
+    try {
+      await program.parseAsync(['version'], { from: 'user' });
+
+      expect(process.env.CATALYST_STORE_HASH).toBeUndefined();
+      expect(process.env.CATALYST_ACCESS_TOKEN).toBeUndefined();
+    } finally {
+      process.chdir(originalCwd);
+      await cleanup();
+    }
+  });
+});
diff --git a/packages/catalyst/src/cli/index.ts b/packages/catalyst/src/cli/index.ts
index 42c5a8a765..0dce988373 100644
--- a/packages/catalyst/src/cli/index.ts
+++ b/packages/catalyst/src/cli/index.ts
@@ -1,4 +1,63 @@
 #!/usr/bin/env node
+import { UserActionableError } from './lib/errors';
+import { consola } from './lib/logger';
+import { getTelemetry } from './lib/telemetry';
 import { program } from './program';
 
-program.parse(process.argv);
+const handleFatalError = async (error: unknown) => {
+  const telemetry = getTelemetry();
+
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const errorStack = error instanceof Error ? error.stack : undefined;
+
+  try {
+    await telemetry.track('error', {
+      commandName: telemetry.commandName,
+      errorMessage,
+      errorStack,
+      durationMs: telemetry.durationMs(),
+    });
+    await telemetry.analytics.closeAndFlush();
+  } catch {
+    // Don't mask the original error
+  }
+
+  // A user-actionable error (invalid/expired token, a clear 4xx validation or
+  // conflict response, a feature that isn't enabled) already tells the user what
+  // to do — print it without the "share your Correlation ID with support" noise
+  // that only helps for genuine bugs and server-side failures.
+  if (error instanceof UserActionableError) {
+    consola.error(errorMessage);
+    process.exit(1);
+  }
+
+  consola.error(errorMessage);
+
+  if (telemetry.isEnabled()) {
+    consola.info(
+      `Correlation ID: ${telemetry.correlationId}\nShare this Correlation ID with BigCommerce support.`,
+    );
+  } else {
+    consola.info(
+      'Enable telemetry (`catalyst telemetry enable`) for improved troubleshooting with BigCommerce support.',
+    );
+  }
+
+  process.exit(1);
+};
+
+process.on('uncaughtException', (error) => {
+  void handleFatalError(error);
+});
+
+process.on('unhandledRejection', (reason) => {
+  void handleFatalError(reason);
+});
+
+void (async () => {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (error) {
+    await handleFatalError(error);
+  }
+})();
diff --git a/packages/catalyst/src/cli/lib/auth-errors.spec.ts b/packages/catalyst/src/cli/lib/auth-errors.spec.ts
new file mode 100644
index 0000000000..084eb86b44
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/auth-errors.spec.ts
@@ -0,0 +1,24 @@
+import { describe, expect, test } from 'vitest';
+
+import { assertAuthorized, UnauthorizedError } from './auth-errors';
+
+const responseWith = (status: number) => new Response(null, { status });
+
+describe('assertAuthorized', () => {
+  test('throws UnauthorizedError on 401', () => {
+    expect(() => assertAuthorized(responseWith(401))).toThrow(UnauthorizedError);
+  });
+
+  test.each([200, 403, 404, 500])('does not throw on %i', (status) => {
+    expect(() => assertAuthorized(responseWith(status))).not.toThrow();
+  });
+});
+
+describe('UnauthorizedError', () => {
+  test('carries an actionable re-auth message', () => {
+    const error = new UnauthorizedError();
+
+    expect(error.name).toBe('UnauthorizedError');
+    expect(error.message).toContain('catalyst auth login');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/auth-errors.ts b/packages/catalyst/src/cli/lib/auth-errors.ts
new file mode 100644
index 0000000000..7fe0161dc5
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/auth-errors.ts
@@ -0,0 +1,33 @@
+import { UserActionableError } from './errors';
+
+// Thrown when an authenticated API call comes back 401 Unauthorized — i.e. the
+// access token was sent but rejected. This covers an expired/revoked token as
+// well as a token that was never valid (e.g. a typo'd `--access-token` flag or
+// a stale `CATALYST_ACCESS_TOKEN` env var). It does NOT cover the "no
+// credentials at all" case — that's caught earlier by `resolveCredentials`
+// (and `auth whoami`'s own guard) before any request is made.
+//
+// The CLI can't refresh the token silently (the device-code flow returns no
+// refresh token), so the only recovery is to re-authenticate. Callers should
+// let this propagate to the top-level handler in `index.ts`, which prints the
+// message without the generic "share your Correlation ID with support"
+// bug-report framing.
+export class UnauthorizedError extends UserActionableError {
+  constructor() {
+    super(
+      'Your access token is invalid or has expired.\n' +
+        'Run `catalyst auth login` to re-authenticate.',
+    );
+    this.name = 'UnauthorizedError';
+  }
+}
+
+// Call immediately after an authenticated `fetch`, before any other status
+// checks. Only 401 means "invalid/expired token" — 403 is overloaded elsewhere
+// to mean "API not enabled" (scope/feature flag), so it is intentionally not
+// treated as an auth failure here.
+export function assertAuthorized(response: Response): void {
+  if (response.status === 401) {
+    throw new UnauthorizedError();
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/auth.spec.ts b/packages/catalyst/src/cli/lib/auth.spec.ts
new file mode 100644
index 0000000000..e0792d4691
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/auth.spec.ts
@@ -0,0 +1,140 @@
+import { http, HttpResponse } from 'msw';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+
+import {
+  DEFAULT_LOGIN_URL,
+  DEVICE_OAUTH_CLIENT_ID,
+  DEVICE_OAUTH_SCOPES,
+  pollDeviceToken,
+  requestDeviceCode,
+  waitForDeviceToken,
+} from './auth';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+describe('requestDeviceCode', () => {
+  test('returns device code response on success', async () => {
+    const result = await requestDeviceCode(DEFAULT_LOGIN_URL);
+
+    expect(result).toEqual({
+      device_code: 'mock-device-code',
+      user_code: 'MOCK-CODE',
+      verification_uri: 'https://login.bigcommerce.com/device',
+      expires_in: 600,
+      interval: 5,
+    });
+  });
+
+  test('throws on non-OK response', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 500, statusText: 'Internal Server Error' }),
+      ),
+    );
+
+    await expect(requestDeviceCode(DEFAULT_LOGIN_URL)).rejects.toThrow(
+      'Failed to request device code: Something went wrong on our end. Please try again. If the issue persists, contact support.',
+    );
+  });
+
+  test('throws on malformed response', async () => {
+    server.use(
+      http.post('https://login.bigcommerce.com/device/token', () =>
+        HttpResponse.json({ invalid: 'data' }),
+      ),
+    );
+
+    await expect(requestDeviceCode(DEFAULT_LOGIN_URL)).rejects.toThrow();
+  });
+});
+
+describe('pollDeviceToken', () => {
+  test('returns null on non-200 response', async () => {
+    server.use(
+      http.post(
+        'https://login.bigcommerce.com/device/token',
+        () => new HttpResponse(null, { status: 400 }),
+      ),
+    );
+
+    const result = await pollDeviceToken(DEFAULT_LOGIN_URL, 'mock-device-code');
+
+    expect(result).toBeNull();
+  });
+
+  test('returns credentials on 200 response', async () => {
+    const result = await pollDeviceToken(DEFAULT_LOGIN_URL, 'mock-device-code');
+
+    expect(result).toEqual({
+      access_token: 'mock-access-token',
+      store_hash: 'mock-store-hash',
+      context: 'stores/mock-store-hash',
+      api_uri: 'https://api.bigcommerce.com',
+    });
+  });
+});
+
+describe('waitForDeviceToken', () => {
+  test('polls until success', async () => {
+    vi.useFakeTimers();
+
+    let callCount = 0;
+
+    server.use(
+      http.post('https://login.bigcommerce.com/device/token', () => {
+        callCount += 1;
+
+        if (callCount < 3) {
+          return new HttpResponse(null, { status: 400 });
+        }
+
+        return HttpResponse.json({
+          access_token: 'mock-access-token',
+          store_hash: 'mock-store-hash',
+          context: 'stores/mock-store-hash',
+          api_uri: 'https://api.bigcommerce.com',
+        });
+      }),
+    );
+
+    const promise = waitForDeviceToken(DEFAULT_LOGIN_URL, 'mock-device-code', 1);
+
+    // Advance timers to allow polling
+    await vi.advanceTimersByTimeAsync(1000);
+    await vi.advanceTimersByTimeAsync(1000);
+
+    const result = await promise;
+
+    expect(result).toEqual({
+      access_token: 'mock-access-token',
+      store_hash: 'mock-store-hash',
+      context: 'stores/mock-store-hash',
+      api_uri: 'https://api.bigcommerce.com',
+    });
+
+    vi.useRealTimers();
+  });
+});
+
+describe('constants', () => {
+  test('DEVICE_OAUTH_CLIENT_ID matches create-catalyst', () => {
+    expect(DEVICE_OAUTH_CLIENT_ID).toBe('b8063bu6hhml4e0lqh22yut63atsbyv');
+  });
+
+  test('DEVICE_OAUTH_SCOPES contains expected scopes', () => {
+    expect(DEVICE_OAUTH_SCOPES).toContain('store_v2_information');
+    expect(DEVICE_OAUTH_SCOPES).toContain('store_infrastructure_deployments_manage');
+    expect(DEVICE_OAUTH_SCOPES).toContain('store_infrastructure_logs_read_only');
+    expect(DEVICE_OAUTH_SCOPES).toContain('store_infrastructure_projects_manage');
+  });
+
+  test('DEFAULT_LOGIN_URL is correct', () => {
+    expect(DEFAULT_LOGIN_URL).toBe('https://login.bigcommerce.com');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/auth.ts b/packages/catalyst/src/cli/lib/auth.ts
new file mode 100644
index 0000000000..ef75cd96c0
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/auth.ts
@@ -0,0 +1,84 @@
+import { z } from 'zod';
+
+import { httpError } from './http-errors';
+
+export const DEVICE_OAUTH_CLIENT_ID = 'b8063bu6hhml4e0lqh22yut63atsbyv';
+export const DEVICE_OAUTH_SCOPES = [
+  'store_v2_information',
+  'store_infrastructure_deployments_manage',
+  'store_infrastructure_logs_read_only',
+  'store_infrastructure_projects_manage',
+  'store_channel_settings',
+].join(' ');
+export const DEFAULT_LOGIN_URL = 'https://login.bigcommerce.com';
+
+export const DeviceCodeResponseSchema = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.string(),
+  expires_in: z.number(),
+  interval: z.number(),
+});
+
+export const DeviceCodeSuccessSchema = z.object({
+  access_token: z.string(),
+  store_hash: z.string(),
+  context: z.string(),
+  api_uri: z.string(),
+});
+
+export async function requestDeviceCode(loginUrl: string) {
+  const response = await fetch(`${loginUrl}/device/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      client_id: DEVICE_OAUTH_CLIENT_ID,
+      scopes: DEVICE_OAUTH_SCOPES,
+    }),
+  });
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to request device code');
+  }
+
+  const res: unknown = await response.json();
+
+  return DeviceCodeResponseSchema.parse(res);
+}
+
+export async function pollDeviceToken(loginUrl: string, deviceCode: string) {
+  const response = await fetch(`${loginUrl}/device/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      device_code: deviceCode,
+      client_id: DEVICE_OAUTH_CLIENT_ID,
+    }),
+  });
+
+  if (response.status !== 200) {
+    return null;
+  }
+
+  const res: unknown = await response.json();
+
+  return DeviceCodeSuccessSchema.parse(res);
+}
+
+export async function waitForDeviceToken(
+  loginUrl: string,
+  deviceCode: string,
+  interval: number,
+): Promise<z.infer<typeof DeviceCodeSuccessSchema>> {
+  const credentials = await pollDeviceToken(loginUrl, deviceCode);
+
+  if (credentials) {
+    return credentials;
+  }
+
+  await new Promise((resolve) => {
+    setTimeout(resolve, interval * 1000);
+  });
+
+  return waitForDeviceToken(loginUrl, deviceCode, interval);
+}
diff --git a/packages/catalyst/src/cli/lib/build-env.spec.ts b/packages/catalyst/src/cli/lib/build-env.spec.ts
new file mode 100644
index 0000000000..b067a1564d
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/build-env.spec.ts
@@ -0,0 +1,90 @@
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { afterEach, describe, expect, test } from 'vitest';
+
+import { loadBuildEnv } from './build-env';
+import { UserActionableError } from './errors';
+import { mkTempDir } from './mk-temp-dir';
+
+describe('loadBuildEnv', () => {
+  afterEach(() => {
+    delete process.env.BUILD_ENV_TEST_A;
+    delete process.env.BUILD_ENV_TEST_B;
+  });
+
+  test('loads and overrides process.env from an explicit --env-path', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('build-env-');
+
+    await writeFile(join(tmpDir, '.env.custom'), 'BUILD_ENV_TEST_A=from-file', 'utf-8');
+    process.env.BUILD_ENV_TEST_A = 'from-process';
+
+    try {
+      loadBuildEnv({ envPath: '.env.custom', cwd: tmpDir });
+
+      expect(process.env.BUILD_ENV_TEST_A).toBe('from-file');
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test('throws a UserActionableError when --env-path does not exist', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('build-env-');
+
+    try {
+      expect(() => loadBuildEnv({ envPath: '.env.missing', cwd: tmpDir })).toThrow(
+        UserActionableError,
+      );
+      expect(() => loadBuildEnv({ envPath: '.env.missing', cwd: tmpDir })).toThrow(
+        /Env file not found/,
+      );
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test('auto-loads .env.local and .env, with .env.local taking precedence', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('build-env-');
+
+    await writeFile(
+      join(tmpDir, '.env'),
+      'BUILD_ENV_TEST_A=from-env\nBUILD_ENV_TEST_B=only-in-env',
+      'utf-8',
+    );
+    await writeFile(join(tmpDir, '.env.local'), 'BUILD_ENV_TEST_A=from-env-local', 'utf-8');
+
+    try {
+      loadBuildEnv({ cwd: tmpDir });
+
+      expect(process.env.BUILD_ENV_TEST_A).toBe('from-env-local');
+      expect(process.env.BUILD_ENV_TEST_B).toBe('only-in-env');
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test('auto-load does not override values already set in process.env', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('build-env-');
+
+    await writeFile(join(tmpDir, '.env.local'), 'BUILD_ENV_TEST_A=from-file', 'utf-8');
+    process.env.BUILD_ENV_TEST_A = 'from-process';
+
+    try {
+      loadBuildEnv({ cwd: tmpDir });
+
+      expect(process.env.BUILD_ENV_TEST_A).toBe('from-process');
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test('is a no-op when no env files are present', async () => {
+    const [tmpDir, cleanup] = await mkTempDir('build-env-');
+
+    try {
+      expect(() => loadBuildEnv({ cwd: tmpDir })).not.toThrow();
+      expect(process.env.BUILD_ENV_TEST_A).toBeUndefined();
+    } finally {
+      await cleanup();
+    }
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/build-env.ts b/packages/catalyst/src/cli/lib/build-env.ts
new file mode 100644
index 0000000000..037e86d2b0
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/build-env.ts
@@ -0,0 +1,69 @@
+import { colorize } from 'consola/utils';
+import { config } from 'dotenv';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { UserActionableError } from './errors';
+import { consola } from './logger';
+
+// Conventional env files auto-loaded (in precedence order) for the build when
+// `--env-path` isn't given. `.env.local` wins over `.env`, and neither
+// overrides values already present in the real environment — matching Next.js
+// precedence (process.env > .env.local > .env).
+const AUTO_ENV_FILES = ['.env.local', '.env'] as const;
+
+interface LoadBuildEnvOptions {
+  // Explicit env file passed via `--env-path`. When set, only this file is
+  // loaded (and it overrides existing values); when unset, the conventional
+  // files above are auto-loaded instead.
+  envPath?: string;
+  // Directory the paths are resolved against. Defaults to the current working
+  // directory; injectable for tests.
+  cwd?: string;
+}
+
+// Loads storefront environment variables into `process.env` for the
+// build/deploy pipeline so the spawned build (and the checks that run before
+// it) can see them. This is intentionally scoped to `build` and `deploy`: no
+// other command loads env files, so running the CLI can't be surprised by a
+// stray `.env.local` on disk.
+export function loadBuildEnv({ envPath, cwd = process.cwd() }: LoadBuildEnvOptions): void {
+  if (envPath !== undefined) {
+    const envFilePath = resolve(cwd, envPath);
+    const result = config({ path: envFilePath, override: true });
+
+    if (result.error) {
+      const errCode =
+        'code' in result.error && typeof result.error.code === 'string'
+          ? result.error.code
+          : undefined;
+      const message =
+        errCode === 'ENOENT'
+          ? `Env file not found: ${envFilePath}`
+          : `Failed to load --env-path ${envPath}: ${result.error.message}`;
+
+      throw new UserActionableError(message);
+    }
+
+    consola.log(colorize('cyanBright', `Loaded environment variables from ${envFilePath}\n`));
+
+    return;
+  }
+
+  // Auto-load the conventional files. `.env.local` is loaded first so it takes
+  // precedence over `.env`; `override: false` means the real environment always
+  // wins over both. Missing files are expected and ignored.
+  const loaded = AUTO_ENV_FILES.filter((file) => {
+    const envFilePath = resolve(cwd, file);
+
+    if (!existsSync(envFilePath)) {
+      return false;
+    }
+
+    return !config({ path: envFilePath, override: false }).error;
+  });
+
+  if (loaded.length > 0) {
+    consola.log(colorize('cyanBright', `Loaded environment variables from ${loaded.join(', ')}\n`));
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/channel-site-flow.spec.ts b/packages/catalyst/src/cli/lib/channel-site-flow.spec.ts
new file mode 100644
index 0000000000..8a8beba66d
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/channel-site-flow.spec.ts
@@ -0,0 +1,320 @@
+import { confirm, input, select } from '@inquirer/prompts';
+import { http, HttpResponse } from 'msw';
+import { afterAll, beforeAll, beforeEach, describe, expect, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+
+import { runChannelSiteUrlFlow } from './channel-site-flow';
+import { NoLinkedProjectError } from './commerce-hosting';
+import { consola } from './logger';
+
+vi.mock('@inquirer/prompts', () => ({
+  select: vi.fn(),
+  confirm: vi.fn(),
+  input: vi.fn(),
+}));
+
+const selectMock = vi.mocked(select);
+const confirmMock = vi.mocked(confirm);
+const inputMock = vi.mocked(input);
+
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+const apiHost = 'api.bigcommerce.com';
+const linkedProjectUuid = 'a23f5785-fd99-4a94-9fb3-945551623923';
+
+beforeAll(() => {
+  consola.mockTypes(() => vi.fn());
+
+  vi.mock('./telemetry', () => {
+    const instance = {
+      identify: vi.fn(),
+      isEnabled: vi.fn(() => true),
+      track: vi.fn(),
+      correlationId: 'test-session-uuid',
+      commandName: 'unknown',
+      durationMs: vi.fn().mockReturnValue(0),
+      analytics: {
+        closeAndFlush: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
+    return {
+      Telemetry: vi.fn().mockImplementation(() => instance),
+      getTelemetry: vi.fn(() => instance),
+      resetTelemetry: vi.fn(),
+    };
+  });
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+afterAll(() => {
+  vi.restoreAllMocks();
+});
+
+describe('runChannelSiteUrlFlow', () => {
+  test('happy path: prompts for channel and hostname, then PUTs', async () => {
+    let putBody: unknown;
+    let putChannelId: string | undefined;
+
+    server.use(
+      http.put(
+        'https://:apiHost/stores/:storeHash/v3/channels/:channelId/site',
+        async ({ request, params }) => {
+          putBody = await request.json();
+          putChannelId = String(params.channelId);
+
+          return HttpResponse.json({
+            data: {
+              id: 1,
+              url: 'https://project-one.catalyst-sandbox.store',
+              channel_id: 2,
+            },
+          });
+        },
+      ),
+    );
+
+    selectMock
+      // First select — channel select; resolves with the channel id (a number)
+      .mockResolvedValueOnce(2)
+      // Second select — hostname select (a string)
+      .mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+    });
+
+    expect(selectMock).toHaveBeenCalledTimes(2);
+    expect(putChannelId).toBe('2');
+    expect(putBody).toEqual({ url: 'https://project-one.catalyst-sandbox.store' });
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Updated channel "Catalyst Storefront" (2) site URL'),
+    );
+  });
+
+  test('--channel-id short-circuits the channel prompt', async () => {
+    selectMock.mockResolvedValueOnce('vanity.project-one.example.com');
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+      channelId: 99,
+    });
+
+    // Only the hostname select fires
+    expect(selectMock).toHaveBeenCalledTimes(1);
+    expect(selectMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Select the hostname to point the channel at.' }),
+    );
+  });
+
+  test('--hostname short-circuits the hostname prompt', async () => {
+    selectMock.mockResolvedValueOnce(2);
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+      hostname: 'manual.example.com',
+    });
+
+    expect(selectMock).toHaveBeenCalledTimes(1);
+    expect(selectMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Select the channel to update.' }),
+    );
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('https://manual.example.com'),
+    );
+  });
+
+  test('both overrides skip all prompts', async () => {
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+      channelId: 42,
+      hostname: 'auto.example.com',
+    });
+
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Updated channel 42 site URL to https://auto.example.com.'),
+    );
+  });
+
+  test('preferHostname is placed first in the hostname options', async () => {
+    selectMock
+      .mockResolvedValueOnce(2) // channel (the catalyst one)
+      .mockResolvedValueOnce('vanity.project-one.example.com'); // hostname
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+      preferHostname: 'vanity.project-one.example.com',
+    });
+
+    // The hostname select is the second call; inspect the choices passed to it.
+    const hostnameCall = selectMock.mock.calls[1][0];
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const hostnameChoices = hostnameCall.choices as Array<{ name: string; value: string }>;
+
+    expect(hostnameChoices[0]).toMatchObject({ value: 'vanity.project-one.example.com' });
+  });
+
+  test('throws when no Catalyst channels are available', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/channels', () =>
+        HttpResponse.json({
+          // Only non-Catalyst channels — filtered out, so the picker is empty.
+          data: [{ id: 1, name: 'Default Storefront', platform: 'bigcommerce' }],
+        }),
+      ),
+    );
+
+    await expect(
+      runChannelSiteUrlFlow({
+        storeHash,
+        accessToken,
+        apiHost,
+        projectUuid: linkedProjectUuid,
+      }),
+    ).rejects.toThrow('No Catalyst channels found on this store');
+  });
+
+  test('filters non-Catalyst channels out of the picker', async () => {
+    selectMock
+      .mockResolvedValueOnce(2) // channel
+      .mockResolvedValueOnce('project-one.catalyst-sandbox.store'); // hostname
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: linkedProjectUuid,
+    });
+
+    // The channel select is the first call; inspect the choices passed to it.
+    const channelCall = selectMock.mock.calls[0][0];
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const channelChoices = channelCall.choices as Array<{ name: string; value: number }>;
+
+    // The default handler returns one bigcommerce + one catalyst channel; only
+    // the catalyst one should appear in the picker.
+    expect(channelChoices).toHaveLength(1);
+    expect(channelChoices[0]).toMatchObject({ name: 'Catalyst Storefront', value: 2 });
+  });
+
+  test('throws when the project has no deployment hostnames', async () => {
+    // Project Two in the default handler has deployment_hostnames: []
+    const projectTwo = 'b23f5785-fd99-4a94-9fb3-945551623924';
+
+    selectMock.mockResolvedValueOnce(2);
+
+    await expect(
+      runChannelSiteUrlFlow({
+        storeHash,
+        accessToken,
+        apiHost,
+        projectUuid: projectTwo,
+      }),
+    ).rejects.toThrow('has no deployment hostnames yet');
+  });
+
+  test('falls back to selectOrCreateInfrastructureProject when projectUuid is unset', async () => {
+    let getProjectsCalls = 0;
+
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () => {
+        getProjectsCalls += 1;
+
+        return HttpResponse.json({
+          data: [
+            {
+              uuid: linkedProjectUuid,
+              name: 'Project One',
+              deployment_hostnames: ['project-one.catalyst-sandbox.store'],
+            },
+          ],
+        });
+      }),
+    );
+
+    selectMock
+      // selectOrCreateInfrastructureProject select — pick the only project (UUID string)
+      .mockResolvedValueOnce(linkedProjectUuid)
+      // channel (number)
+      .mockResolvedValueOnce(2)
+      // hostname (string)
+      .mockResolvedValueOnce('project-one.catalyst-sandbox.store');
+
+    await runChannelSiteUrlFlow({ storeHash, accessToken, apiHost });
+
+    expect(getProjectsCalls).toBeGreaterThanOrEqual(1);
+    expect(consola.success).toHaveBeenCalledWith(
+      expect.stringContaining('Updated channel "Catalyst Storefront" (2) site URL'),
+    );
+  });
+
+  test('throws NoLinkedProjectError when no projects exist and user declines to create', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({ data: [] }),
+      ),
+    );
+
+    // The "create a new project?" confirm prompt — user says no
+    confirmMock.mockResolvedValueOnce(false);
+
+    await expect(runChannelSiteUrlFlow({ storeHash, accessToken, apiHost })).rejects.toBeInstanceOf(
+      NoLinkedProjectError,
+    );
+  });
+
+  test('warns and re-prompts when the linked project no longer exists', async () => {
+    server.use(
+      http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
+        HttpResponse.json({
+          data: [
+            {
+              uuid: 'different-uuid',
+              name: 'Some Other Project',
+              deployment_hostnames: ['other.example.com'],
+            },
+          ],
+        }),
+      ),
+    );
+
+    selectMock
+      // project picker (UUID string)
+      .mockResolvedValueOnce('different-uuid')
+      // channel (number)
+      .mockResolvedValueOnce(1)
+      // hostname (string)
+      .mockResolvedValueOnce('other.example.com');
+
+    await runChannelSiteUrlFlow({
+      storeHash,
+      accessToken,
+      apiHost,
+      projectUuid: 'a-uuid-that-does-not-exist',
+    });
+
+    expect(consola.warn).toHaveBeenCalledWith(expect.stringContaining('not found on this store'));
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/channel-site-flow.ts b/packages/catalyst/src/cli/lib/channel-site-flow.ts
new file mode 100644
index 0000000000..5d8a41dff7
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/channel-site-flow.ts
@@ -0,0 +1,139 @@
+import { select } from '@inquirer/prompts';
+
+import { type Channel, fetchAvailableChannels, updateChannelSiteUrl } from './channels';
+import { selectOrCreateInfrastructureProject } from './commerce-hosting';
+import { consola } from './logger';
+import { fetchProjects, type ProjectListItem } from './project';
+
+export interface ChannelSiteFlowOptions {
+  storeHash: string;
+  accessToken: string;
+  apiHost: string;
+  // Linked project UUID (from --project-uuid or .bigcommerce/project.json). When
+  // present and resolvable, skips the project picker; otherwise falls back to
+  // `selectOrCreateInfrastructureProject`, which may throw NoLinkedProjectError
+  // (caller decides how to surface it).
+  projectUuid?: string;
+  // Non-interactive overrides. When supplied, the corresponding prompt is
+  // skipped.
+  channelId?: number;
+  hostname?: string;
+  // When set, this hostname is pre-selected in the hostname prompt. Used by
+  // `catalyst deploy --update-site-url` to default to the freshly-deployed
+  // hostname.
+  preferHostname?: string;
+}
+
+async function resolveProject(options: ChannelSiteFlowOptions): Promise<ProjectListItem> {
+  const api = {
+    storeHash: options.storeHash,
+    accessToken: options.accessToken,
+    apiHost: options.apiHost,
+  };
+
+  if (options.projectUuid) {
+    const projects = await fetchProjects(api.storeHash, api.accessToken, api.apiHost);
+    const matched = projects.find((p) => p.uuid === options.projectUuid);
+
+    if (matched) return matched;
+
+    consola.warn(
+      `Project ${options.projectUuid} not found on this store. Pick another to continue.`,
+    );
+  }
+
+  return selectOrCreateInfrastructureProject(api, options.projectUuid);
+}
+
+async function resolveChannel(
+  options: ChannelSiteFlowOptions,
+): Promise<{ id: number; name?: string }> {
+  if (options.channelId !== undefined) {
+    return { id: options.channelId };
+  }
+
+  consola.start('Fetching channels...');
+
+  const channels = await fetchAvailableChannels(
+    options.storeHash,
+    options.accessToken,
+    options.apiHost,
+  );
+
+  consola.success('Channels fetched.');
+
+  // Only Catalyst-platform channels can meaningfully be pointed at a Catalyst
+  // deployment hostname; other storefront platforms (Stencil, etc.) are
+  // filtered out so the picker stays focused.
+  const catalystChannels = channels.filter((c: Channel) => c.platform === 'catalyst');
+
+  if (catalystChannels.length === 0) {
+    throw new Error(
+      'No Catalyst channels found on this store. Create one with `catalyst create` and try again.',
+    );
+  }
+
+  const id = await select({
+    message: 'Select the channel to update.',
+    choices: catalystChannels.map((c: Channel) => ({
+      name: c.name,
+      value: c.id,
+      description: `id: ${c.id}`,
+    })),
+  });
+
+  const matched = catalystChannels.find((c) => c.id === id);
+
+  return { id, name: matched?.name };
+}
+
+async function resolveHostname(
+  project: ProjectListItem,
+  options: ChannelSiteFlowOptions,
+): Promise<string> {
+  if (options.hostname) {
+    return options.hostname;
+  }
+
+  if (project.deployment_hostnames.length === 0) {
+    throw new Error(
+      `Project "${project.name}" has no deployment hostnames yet. Run \`catalyst deploy\` first to create one.`,
+    );
+  }
+
+  // When the caller knows which hostname they want surfaced first (e.g. the
+  // freshly-deployed one from `catalyst deploy --update-site-url`), order it to
+  // the top of the list so it's the default selection.
+  const ordered = options.preferHostname
+    ? [
+        ...project.deployment_hostnames.filter((h) => h === options.preferHostname),
+        ...project.deployment_hostnames.filter((h) => h !== options.preferHostname),
+      ]
+    : project.deployment_hostnames;
+
+  const selected = await select({
+    message: 'Select the hostname to point the channel at.',
+    choices: ordered.map((h) => ({ name: h, value: h })),
+  });
+
+  return selected;
+}
+
+export async function runChannelSiteUrlFlow(options: ChannelSiteFlowOptions): Promise<void> {
+  const project = await resolveProject(options);
+  const channel = await resolveChannel(options);
+  const hostname = await resolveHostname(project, options);
+  const siteUrl = hostname.startsWith('https://') ? hostname : `https://${hostname}`;
+
+  await updateChannelSiteUrl(
+    channel.id,
+    siteUrl,
+    options.storeHash,
+    options.accessToken,
+    options.apiHost,
+  );
+
+  const channelLabel = channel.name ? `"${channel.name}" (${channel.id})` : String(channel.id);
+
+  consola.success(`Updated channel ${channelLabel} site URL to ${siteUrl}.`);
+}
diff --git a/packages/catalyst/src/cli/lib/channels.spec.ts b/packages/catalyst/src/cli/lib/channels.spec.ts
new file mode 100644
index 0000000000..56eba40de4
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/channels.spec.ts
@@ -0,0 +1,133 @@
+import { http, HttpResponse } from 'msw';
+import { afterAll, beforeAll, describe, expect, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+
+import {
+  type Channel,
+  channelPlatformLabel,
+  sortChannelsByPlatform,
+  updateChannelSiteUrl,
+} from './channels';
+
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+const apiHost = 'api.bigcommerce.com';
+const channelId = 1;
+
+beforeAll(() => {
+  vi.mock('./telemetry', () => {
+    const instance = {
+      identify: vi.fn(),
+      isEnabled: vi.fn(() => true),
+      track: vi.fn(),
+      correlationId: 'test-session-uuid',
+      commandName: 'unknown',
+      durationMs: vi.fn().mockReturnValue(0),
+      analytics: {
+        closeAndFlush: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
+    return {
+      Telemetry: vi.fn().mockImplementation(() => instance),
+      getTelemetry: vi.fn(() => instance),
+      resetTelemetry: vi.fn(),
+    };
+  });
+});
+
+afterAll(() => {
+  vi.restoreAllMocks();
+});
+
+describe('updateChannelSiteUrl', () => {
+  test('PUTs the URL and returns parsed channel site', async () => {
+    let receivedBody: unknown;
+
+    server.use(
+      http.put(
+        'https://:apiHost/stores/:storeHash/v3/channels/:channelId/site',
+        async ({ request }) => {
+          receivedBody = await request.json();
+
+          return HttpResponse.json({
+            data: {
+              id: 42,
+              url: 'https://new.example.com',
+              channel_id: channelId,
+            },
+          });
+        },
+      ),
+    );
+
+    const result = await updateChannelSiteUrl(
+      channelId,
+      'https://new.example.com',
+      storeHash,
+      accessToken,
+      apiHost,
+    );
+
+    expect(receivedBody).toEqual({ url: 'https://new.example.com' });
+    expect(result).toEqual({ id: 42, url: 'https://new.example.com', channelId });
+  });
+
+  test('throws with re-auth hint on 401', async () => {
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+        HttpResponse.json({}, { status: 401 }),
+      ),
+    );
+
+    await expect(
+      updateChannelSiteUrl(channelId, 'https://x.example', storeHash, accessToken, apiHost),
+    ).rejects.toThrow('Re-run `catalyst auth login`');
+  });
+
+  test('throws with re-auth hint on 403', async () => {
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+        HttpResponse.json({}, { status: 403 }),
+      ),
+    );
+
+    await expect(
+      updateChannelSiteUrl(channelId, 'https://x.example', storeHash, accessToken, apiHost),
+    ).rejects.toThrow('Re-run `catalyst auth login`');
+  });
+
+  test('throws a readable error on other errors', async () => {
+    server.use(
+      http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+        HttpResponse.json({}, { status: 500 }),
+      ),
+    );
+
+    await expect(
+      updateChannelSiteUrl(channelId, 'https://x.example', storeHash, accessToken, apiHost),
+    ).rejects.toThrow('Failed to update channel site: Something went wrong on our end.');
+  });
+});
+
+describe('sortChannelsByPlatform', () => {
+  const ch = (id: number, platform: string): Channel => ({ id, name: `ch-${id}`, platform });
+
+  test('orders catalyst → next → bigcommerce → unknown, without mutating the input', () => {
+    const input = [ch(1, 'wordpress'), ch(2, 'bigcommerce'), ch(3, 'next'), ch(4, 'catalyst')];
+    const sorted = sortChannelsByPlatform(input);
+
+    expect(sorted.map((c) => c.platform)).toEqual(['catalyst', 'next', 'bigcommerce', 'wordpress']);
+    // Original array is untouched.
+    expect(input.map((c) => c.platform)).toEqual(['wordpress', 'bigcommerce', 'next', 'catalyst']);
+  });
+});
+
+describe('channelPlatformLabel', () => {
+  test('maps bigcommerce to Stencil and title-cases the rest', () => {
+    expect(channelPlatformLabel('bigcommerce')).toBe('Stencil');
+    expect(channelPlatformLabel('catalyst')).toBe('Catalyst');
+    expect(channelPlatformLabel('next')).toBe('Next');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/channels.ts b/packages/catalyst/src/cli/lib/channels.ts
new file mode 100644
index 0000000000..352020dc15
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/channels.ts
@@ -0,0 +1,253 @@
+import { z } from 'zod';
+
+import { assertAuthorized } from './auth-errors';
+import { UserActionableError } from './errors';
+import { httpError } from './http-errors';
+import { getTelemetry } from './telemetry';
+
+// `origin` is the CLI-API gateway (configured via `--cli-api-origin`, default
+// `https://cxm-prd.bigcommerceapp.com`). Distinct from `apiHost` used for the
+// BC store API (api.bigcommerce.com).
+const cliApiUrl = (origin: string, storeHash: string, path: string) =>
+  `${origin}/stores/${storeHash}/cli-api/v3${path}`;
+
+const channelsUrl = (storeHash: string, apiHost: string, query: Record<string, string> = {}) => {
+  const params = new URLSearchParams(query).toString();
+
+  return `https://${apiHost}/stores/${storeHash}/v3/channels${params ? `?${params}` : ''}`;
+};
+
+const authHeaders = (accessToken: string) => ({
+  'X-Auth-Token': accessToken,
+  'X-Correlation-Id': getTelemetry().correlationId,
+  Accept: 'application/json',
+});
+
+// envVars values are coerced to strings: the BC API returns mixed primitives
+// (e.g. BIGCOMMERCE_CHANNEL_ID is a number) but they all end up in .env.local as text.
+const envVarsSchema = z.record(z.string(), z.coerce.string());
+
+const channelSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  platform: z.string(),
+});
+
+export type Channel = z.infer<typeof channelSchema>;
+
+const channelsResponseSchema = z.object({
+  data: z.array(channelSchema),
+});
+
+// Channels are surfaced Catalyst-first, then Next, then Stencil
+// (`bigcommerce`), then anything else — the order the `create` and
+// `channel link` pickers both present. Returns a sorted copy.
+const CHANNEL_PLATFORM_ORDER = ['catalyst', 'next', 'bigcommerce'];
+
+export function sortChannelsByPlatform(channels: Channel[]): Channel[] {
+  return [...channels].sort((a, b) => {
+    const aIndex = CHANNEL_PLATFORM_ORDER.indexOf(a.platform);
+    const bIndex = CHANNEL_PLATFORM_ORDER.indexOf(b.platform);
+
+    if (aIndex === -1 && bIndex === -1) return 0;
+    if (aIndex === -1) return 1;
+    if (bIndex === -1) return -1;
+
+    return aIndex - bIndex;
+  });
+}
+
+// Human-friendly platform name for channel pickers. `bigcommerce` is the
+// Stencil storefront platform; everything else is title-cased.
+export function channelPlatformLabel(platform: string): string {
+  return platform === 'bigcommerce'
+    ? 'Stencil'
+    : platform.charAt(0).toUpperCase() + platform.slice(1);
+}
+
+const initResponseSchema = z.object({
+  data: z.object({
+    storefront_api_token: z.string(),
+    envVars: envVarsSchema,
+  }),
+});
+
+const createChannelResponseSchema = z.object({
+  data: z.object({
+    id: z.number(),
+    storefront_api_token: z.string(),
+    envVars: envVarsSchema,
+  }),
+});
+
+const eligibilityResponseSchema = z.object({
+  data: z.object({
+    eligible: z.boolean(),
+    message: z.string(),
+  }),
+});
+
+const channelSiteSchema = z.object({
+  data: z.object({
+    id: z.number(),
+    url: z.string(),
+    channel_id: z.number(),
+  }),
+});
+
+export interface ChannelInit {
+  storefrontToken: string;
+  envVars: Record<string, string>;
+}
+
+export async function getChannelInit(
+  channelId: number | string,
+  storeHash: string,
+  accessToken: string,
+  origin: string,
+): Promise<ChannelInit> {
+  const response = await fetch(cliApiUrl(origin, storeHash, `/channels/${channelId}/init`), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to initialize channel');
+  }
+
+  const { data } = initResponseSchema.parse(await response.json());
+
+  return { storefrontToken: data.storefront_api_token, envVars: data.envVars };
+}
+
+export interface ChannelEligibility {
+  eligible: boolean;
+  message: string;
+}
+
+export async function checkChannelEligibility(
+  storeHash: string,
+  accessToken: string,
+  origin: string,
+): Promise<ChannelEligibility> {
+  const response = await fetch(cliApiUrl(origin, storeHash, '/channels/catalyst/eligibility'), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to check Catalyst eligibility');
+  }
+
+  return eligibilityResponseSchema.parse(await response.json()).data;
+}
+
+export interface CreatedChannel {
+  channelId: number;
+  storefrontToken: string;
+  envVars: Record<string, string>;
+}
+
+export async function createChannel(
+  name: string,
+  storefrontLocale: string,
+  additionalLocales: string[],
+  installSampleData: boolean,
+  storeHash: string,
+  accessToken: string,
+  origin: string,
+): Promise<CreatedChannel> {
+  const response = await fetch(cliApiUrl(origin, storeHash, '/channels/catalyst'), {
+    method: 'POST',
+    headers: { ...authHeaders(accessToken), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      name,
+      initialData: { type: installSampleData ? 'sample' : 'none' },
+      deployStorefront: true,
+      devOrigin: 'http://localhost:3000',
+      storefrontLanguage: storefrontLocale,
+      additionalLocales,
+    }),
+  });
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to create channel');
+  }
+
+  const { data } = createChannelResponseSchema.parse(await response.json());
+
+  return {
+    channelId: data.id,
+    storefrontToken: data.storefront_api_token,
+    envVars: data.envVars,
+  };
+}
+
+export async function fetchAvailableChannels(
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<Channel[]> {
+  const response = await fetch(
+    channelsUrl(storeHash, apiHost, { available: 'true', type: 'storefront' }),
+    {
+      method: 'GET',
+      headers: {
+        'X-Auth-Token': accessToken,
+        'X-Correlation-Id': getTelemetry().correlationId,
+        Accept: 'application/json',
+      },
+    },
+  );
+
+  assertAuthorized(response);
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to fetch channels');
+  }
+
+  return channelsResponseSchema.parse(await response.json()).data;
+}
+
+export interface ChannelSite {
+  id: number;
+  url: string;
+  channelId: number;
+}
+
+export async function updateChannelSiteUrl(
+  channelId: number,
+  siteUrl: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<ChannelSite> {
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/channels/${channelId}/site`,
+    {
+      method: 'PUT',
+      headers: {
+        'X-Auth-Token': accessToken,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        'X-Correlation-Id': getTelemetry().correlationId,
+      },
+      body: JSON.stringify({ url: siteUrl }),
+    },
+  );
+
+  if (response.status === 401 || response.status === 403) {
+    throw new UserActionableError(
+      `Failed to update channel site (${response.status}). Re-run \`catalyst auth login\` to refresh your access token with the store_channel_settings scope.`,
+    );
+  }
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to update channel site');
+  }
+
+  const res: unknown = await response.json();
+  const { data } = channelSiteSchema.parse(res);
+
+  return { id: data.id, url: data.url, channelId: data.channel_id };
+}
diff --git a/packages/catalyst/src/cli/lib/clipboard.spec.ts b/packages/catalyst/src/cli/lib/clipboard.spec.ts
new file mode 100644
index 0000000000..f346b09f03
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/clipboard.spec.ts
@@ -0,0 +1,102 @@
+import { execa } from 'execa';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+import { copyToClipboard } from './clipboard';
+
+vi.mock('execa', () => ({ execa: vi.fn() }));
+
+const execaMock = vi.mocked(execa);
+
+function withPlatform(value: NodeJS.Platform): () => void {
+  const previous = Object.getOwnPropertyDescriptor(process, 'platform');
+
+  Object.defineProperty(process, 'platform', { value, configurable: true });
+
+  return () => {
+    if (previous) {
+      Object.defineProperty(process, 'platform', previous);
+    }
+  };
+}
+
+function withWaylandDisplay(value: string | undefined): () => void {
+  const previous = process.env.WAYLAND_DISPLAY;
+
+  if (value === undefined) {
+    delete process.env.WAYLAND_DISPLAY;
+  } else {
+    process.env.WAYLAND_DISPLAY = value;
+  }
+
+  return () => {
+    if (previous === undefined) {
+      delete process.env.WAYLAND_DISPLAY;
+    } else {
+      process.env.WAYLAND_DISPLAY = previous;
+    }
+  };
+}
+
+let restore: Array<() => void> = [];
+
+afterEach(() => {
+  restore.forEach((fn) => fn());
+  restore = [];
+  vi.clearAllMocks();
+});
+
+describe('copyToClipboard', () => {
+  test('uses pbcopy on macOS', async () => {
+    restore.push(withPlatform('darwin'));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(true);
+    expect(execaMock).toHaveBeenCalledWith('pbcopy', [], { input: 'CODE' });
+  });
+
+  test('uses clip on Windows', async () => {
+    restore.push(withPlatform('win32'));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(true);
+    expect(execaMock).toHaveBeenCalledWith('clip', [], { input: 'CODE' });
+  });
+
+  test('uses wl-copy on Wayland Linux sessions', async () => {
+    restore.push(withPlatform('linux'), withWaylandDisplay('wayland-0'));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(true);
+    expect(execaMock).toHaveBeenCalledWith('wl-copy', [], { input: 'CODE' });
+  });
+
+  test('uses xclip on X11 Linux sessions', async () => {
+    restore.push(withPlatform('linux'), withWaylandDisplay(undefined));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(true);
+    expect(execaMock).toHaveBeenCalledWith('xclip', ['-selection', 'clipboard'], { input: 'CODE' });
+  });
+
+  test('returns false on unsupported platforms without spawning anything', async () => {
+    restore.push(withPlatform('aix'));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(false);
+    expect(execaMock).not.toHaveBeenCalled();
+  });
+
+  test('returns false when the clipboard utility fails', async () => {
+    restore.push(withPlatform('darwin'));
+    execaMock.mockRejectedValueOnce(new Error('command not found'));
+
+    const result = await copyToClipboard('CODE');
+
+    expect(result).toBe(false);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/clipboard.ts b/packages/catalyst/src/cli/lib/clipboard.ts
new file mode 100644
index 0000000000..8ca43002dd
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/clipboard.ts
@@ -0,0 +1,48 @@
+import { execa } from 'execa';
+
+interface ClipboardCommand {
+  command: string;
+  args: string[];
+}
+
+// Resolve the platform-native clipboard utility. Returns null when we don't
+// know how to reach the clipboard on this platform, so callers can fall back to
+// simply printing the value.
+function clipboardCommand(): ClipboardCommand | null {
+  switch (process.platform) {
+    case 'darwin':
+      return { command: 'pbcopy', args: [] };
+
+    case 'win32':
+      return { command: 'clip', args: [] };
+
+    case 'linux':
+      // Wayland sessions expose wl-copy; X11 sessions typically ship xclip.
+      return process.env.WAYLAND_DISPLAY
+        ? { command: 'wl-copy', args: [] }
+        : { command: 'xclip', args: ['-selection', 'clipboard'] };
+
+    default:
+      return null;
+  }
+}
+
+// Best-effort copy of `text` to the system clipboard. Never throws — returns
+// `true` on success and `false` when the clipboard is unreachable (unknown
+// platform, missing utility, spawn failure). Callers must always print the
+// value as a fallback so the flow works even when the copy fails.
+export async function copyToClipboard(text: string): Promise<boolean> {
+  const clipboard = clipboardCommand();
+
+  if (!clipboard) {
+    return false;
+  }
+
+  try {
+    await execa(clipboard.command, clipboard.args, { input: text });
+
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/collect-diagnostics.spec.ts b/packages/catalyst/src/cli/lib/collect-diagnostics.spec.ts
new file mode 100644
index 0000000000..fda8a48b9f
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/collect-diagnostics.spec.ts
@@ -0,0 +1,439 @@
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+
+import PACKAGE_INFO from '../../../package.json';
+
+import { BUILD_ENV_VARS, CLI_ENV_VARS, collectDiagnostics } from './collect-diagnostics';
+import { mkTempDir } from './mk-temp-dir';
+
+vi.mock('./telemetry', () => ({
+  getTelemetry: () => ({
+    correlationId: 'test-session-uuid',
+    isEnabled: () => false,
+  }),
+}));
+
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+
+const writeFileEnsured = async (path: string, contents: string) => {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, contents);
+};
+
+const writeProjectJson = (cwd: string, value: unknown) =>
+  writeFileEnsured(join(cwd, '.bigcommerce', 'project.json'), JSON.stringify(value));
+
+const emptyEnv: NodeJS.ProcessEnv = {};
+
+beforeEach(async () => {
+  [tmpDir, cleanup] = await mkTempDir();
+});
+
+afterEach(async () => {
+  await cleanup();
+});
+
+describe('collectDiagnostics', () => {
+  test('reports CLI, runtime, and telemetry basics', () => {
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.cli.name).toBe('@bigcommerce/catalyst');
+    expect(d.cli.version).toBe(PACKAGE_INFO.version);
+    expect(d.runtime.node).toBe(process.version);
+    expect(d.runtime.platform).toBe(process.platform);
+    expect(d.runtime.arch).toBe(process.arch);
+    expect(typeof d.runtime.osRelease).toBe('string');
+    expect(['npm', 'pnpm', 'yarn', 'bun']).toContain(d.runtime.packageManager);
+    // Telemetry is stubbed by the global test setup.
+    expect(d.telemetry.correlationId).toBe('test-session-uuid');
+    expect(typeof d.telemetry.enabled).toBe('boolean');
+  });
+
+  test('empty project: everything unset/absent', () => {
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.project).toEqual({
+      cwd: tmpDir,
+      storefrontName: null,
+      storefrontVersion: null,
+      projectUuid: null,
+      isLinked: false,
+      isTransformed: false,
+      isFullySetUp: false,
+      hasMiddleware: false,
+      hasProxy: false,
+      hasOpenNextDep: false,
+    });
+    expect(d.config.storeHash).toEqual({ present: false, source: 'unset' });
+    expect(d.config.accessToken).toEqual({ present: false, source: 'unset' });
+    expect(d.config.projectUuid).toEqual({ present: false, source: 'unset' });
+    expect(d.config.apiHost).toEqual({ present: false, source: 'unset' });
+    expect(d.config.projectJsonKeys).toEqual([]);
+    expect(d.config.storedEnvKeys).toEqual([]);
+    expect(Object.keys(d.config.cliEnvVars)).toEqual([...CLI_ENV_VARS]);
+    expect(Object.keys(d.config.buildEnvVars)).toEqual([...BUILD_ENV_VARS]);
+    expect(Object.values(d.config.cliEnvVars).every((v) => v === 'unset')).toBe(true);
+    expect(Object.values(d.config.buildEnvVars).every((v) => v === 'unset')).toBe(true);
+    expect(d.files).toEqual({
+      '.env.local': false,
+      '.env': false,
+      '.bigcommerce/project.json': false,
+      '.bigcommerce/wrangler.jsonc': false,
+      '.open-next/': false,
+      'package.json': false,
+    });
+  });
+
+  test('config resolves from project.json, listing keys without values', async () => {
+    await writeProjectJson(tmpDir, {
+      projectUuid: 'uuid-from-file',
+      framework: 'catalyst',
+      storeHash: 'store-secret',
+      accessToken: 'token-secret',
+      apiHost: 'api.example.com',
+      env: { ZEBRA: 'z', ALPHA: 'a' },
+    });
+
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.project.projectUuid).toBe('uuid-from-file');
+    expect(d.config.storeHash).toEqual({ present: true, source: 'project.json' });
+    expect(d.config.accessToken).toEqual({ present: true, source: 'project.json' });
+    expect(d.config.projectUuid).toEqual({ present: true, source: 'project.json' });
+    expect(d.config.apiHost).toEqual({ present: true, source: 'project.json' });
+    expect(d.config.projectJsonKeys).toEqual([
+      'accessToken',
+      'apiHost',
+      'env',
+      'framework',
+      'projectUuid',
+      'storeHash',
+    ]);
+    // Sorted, keys only.
+    expect(d.config.storedEnvKeys).toEqual(['ALPHA', 'ZEBRA']);
+  });
+
+  test('resolves the API host from CATALYST_API_HOST', () => {
+    const d = collectDiagnostics({
+      cwd: tmpDir,
+      env: { CATALYST_API_HOST: 'api.staging.example.com' },
+    });
+
+    expect(d.config.apiHost).toEqual({ present: true, source: 'process.env' });
+    expect(d.config.cliEnvVars.CATALYST_API_HOST).toBe('process.env');
+  });
+
+  test('process.env wins over project.json for resolved source', async () => {
+    await writeProjectJson(tmpDir, {
+      storeHash: 'store-from-file',
+      accessToken: 'token-from-file',
+      projectUuid: 'uuid-from-file',
+    });
+
+    const d = collectDiagnostics({
+      cwd: tmpDir,
+      env: {
+        CATALYST_STORE_HASH: 'store-from-env',
+        CATALYST_ACCESS_TOKEN: 'token-from-env',
+        CATALYST_PROJECT_UUID: 'uuid-from-env',
+      },
+    });
+
+    expect(d.config.storeHash).toEqual({ present: true, source: 'process.env' });
+    expect(d.config.accessToken).toEqual({ present: true, source: 'process.env' });
+    expect(d.config.projectUuid).toEqual({ present: true, source: 'process.env' });
+  });
+
+  test('store hash falls back to the BIGCOMMERCE_STORE_HASH alias', () => {
+    const d = collectDiagnostics({
+      cwd: tmpDir,
+      env: { BIGCOMMERCE_STORE_HASH: 'aliased-store' },
+    });
+
+    expect(d.config.storeHash).toEqual({ present: true, source: 'process.env' });
+  });
+
+  test('whitespace-only values are treated as unset', () => {
+    const d = collectDiagnostics({
+      cwd: tmpDir,
+      env: { CATALYST_STORE_HASH: '   ', AUTH_SECRET: '\t' },
+    });
+
+    expect(d.config.storeHash).toEqual({ present: false, source: 'unset' });
+    expect(d.config.buildEnvVars.AUTH_SECRET).toBe('unset');
+  });
+
+  test('reports env vars by source only (never the value), split by consumer', () => {
+    const d = collectDiagnostics({
+      cwd: tmpDir,
+      env: {
+        CATALYST_ACCESS_TOKEN: 'tok',
+        AUTH_SECRET: 'super-secret',
+        BIGCOMMERCE_CHANNEL_ID: '1',
+      },
+    });
+
+    // CLI-consumed vars land in cliEnvVars.
+    expect(d.config.cliEnvVars.CATALYST_ACCESS_TOKEN).toBe('process.env');
+    expect(d.config.cliEnvVars.BIGCOMMERCE_LOGIN_URL).toBe('unset');
+    // Build-consumed vars land in buildEnvVars.
+    expect(d.config.buildEnvVars.AUTH_SECRET).toBe('process.env');
+    expect(d.config.buildEnvVars.BIGCOMMERCE_CHANNEL_ID).toBe('process.env');
+  });
+
+  describe('env files (.env.local / .env)', () => {
+    test('build vars resolve from .env.local, but CLI vars/credentials do not', async () => {
+      await writeFileEnsured(
+        join(tmpDir, '.env.local'),
+        'CATALYST_STORE_HASH=fromlocal\nBIGCOMMERCE_CHANNEL_ID=42\n',
+      );
+
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      // Build vars ARE loaded from .env files (by build/deploy).
+      expect(d.config.buildEnvVars.BIGCOMMERCE_CHANNEL_ID).toBe('.env.local');
+      // CLI vars are read only from process.env — a .env.local value is ignored,
+      // matching how the CLI actually resolves them (no other command loads env
+      // files). So a store hash sitting only in .env.local reads as unset.
+      expect(d.config.cliEnvVars.CATALYST_STORE_HASH).toBe('unset');
+      expect(d.config.storeHash).toEqual({ present: false, source: 'unset' });
+      // Never loaded into the real environment either.
+      expect(process.env.CATALYST_STORE_HASH).toBeUndefined();
+    });
+
+    test('build var precedence: process.env > .env.local > .env', async () => {
+      await writeFileEnsured(join(tmpDir, '.env.local'), 'BIGCOMMERCE_STORE_HASH=local\n');
+      await writeFileEnsured(
+        join(tmpDir, '.env'),
+        'BIGCOMMERCE_STORE_HASH=base\nAUTH_SECRET=base\n',
+      );
+
+      const d = collectDiagnostics({
+        cwd: tmpDir,
+        env: { BIGCOMMERCE_STOREFRONT_TOKEN: 'real' },
+      });
+
+      // Only in process.env.
+      expect(d.config.buildEnvVars.BIGCOMMERCE_STOREFRONT_TOKEN).toBe('process.env');
+      // In .env.local and .env — .env.local wins.
+      expect(d.config.buildEnvVars.BIGCOMMERCE_STORE_HASH).toBe('.env.local');
+      // Only in .env.
+      expect(d.config.buildEnvVars.AUTH_SECRET).toBe('.env');
+    });
+
+    test('a malformed/unreadable env file does not break the report', async () => {
+      // A directory named .env.local makes readFileSync throw — the layer is
+      // skipped rather than crashing.
+      await mkdir(join(tmpDir, '.env.local'), { recursive: true });
+
+      const d = collectDiagnostics({ cwd: tmpDir, env: { AUTH_SECRET: 'x' } });
+
+      expect(d.config.buildEnvVars.AUTH_SECRET).toBe('process.env');
+      expect(d.files['.env.local']).toBe(true);
+    });
+  });
+
+  describe('project package manager detection', () => {
+    test.each([
+      ['pnpm-lock.yaml', 'pnpm'],
+      ['yarn.lock', 'yarn'],
+      ['bun.lock', 'bun'],
+      ['bun.lockb', 'bun'],
+      ['package-lock.json', 'npm'],
+    ])('detects %s -> %s', async (lockfile, expected) => {
+      await writeFileEnsured(join(tmpDir, lockfile), '');
+
+      expect(collectDiagnostics({ cwd: tmpDir, env: emptyEnv }).runtime.packageManager).toBe(
+        expected,
+      );
+    });
+
+    test('finds a lockfile in an ancestor directory (run from a subdirectory)', async () => {
+      await writeFileEnsured(join(tmpDir, 'pnpm-lock.yaml'), '');
+
+      const nested = join(tmpDir, 'apps', 'storefront');
+
+      await mkdir(nested, { recursive: true });
+
+      expect(collectDiagnostics({ cwd: nested, env: emptyEnv }).runtime.packageManager).toBe(
+        'pnpm',
+      );
+    });
+
+    test('falls back to the invoking package manager when no lockfile exists', () => {
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      expect(['npm', 'pnpm', 'yarn', 'bun']).toContain(d.runtime.packageManager);
+    });
+  });
+
+  describe('Storefront version', () => {
+    const writePackageJson = (value: unknown) =>
+      writeFileEnsured(join(tmpDir, 'package.json'), JSON.stringify(value));
+
+    test('reads name and version from package.json', async () => {
+      await writePackageJson({ name: '@bigcommerce/catalyst-core', version: '1.8.0' });
+
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      expect(d.project.storefrontName).toBe('@bigcommerce/catalyst-core');
+      expect(d.project.storefrontVersion).toBe('1.8.0');
+    });
+
+    test('prefers catalyst.version over the plain version', async () => {
+      await writePackageJson({
+        name: '@bigcommerce/catalyst-core',
+        version: '0.0.0',
+        catalyst: { version: '1.9.1', ref: '@bigcommerce/catalyst-core@1.9.1' },
+      });
+
+      expect(collectDiagnostics({ cwd: tmpDir, env: emptyEnv }).project.storefrontVersion).toBe(
+        '1.9.1',
+      );
+    });
+
+    test('null when package.json is absent', () => {
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      expect(d.project.storefrontName).toBeNull();
+      expect(d.project.storefrontVersion).toBeNull();
+    });
+
+    test('null version when package.json has no version field', async () => {
+      await writePackageJson({ name: 'some-project' });
+
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      expect(d.project.storefrontName).toBe('some-project');
+      expect(d.project.storefrontVersion).toBeNull();
+    });
+
+    test('null when package.json is malformed', async () => {
+      await writeFileEnsured(join(tmpDir, 'package.json'), '{not json');
+
+      const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+      expect(d.project.storefrontName).toBeNull();
+      expect(d.project.storefrontVersion).toBeNull();
+    });
+  });
+
+  test('detects present files and directories', async () => {
+    await writeFileEnsured(join(tmpDir, '.env.local'), 'X=1');
+    await writeFileEnsured(join(tmpDir, '.env'), 'X=1');
+    await writeProjectJson(tmpDir, { projectUuid: 'x' });
+    await writeFileEnsured(join(tmpDir, '.bigcommerce', 'wrangler.jsonc'), '{}');
+    await mkdir(join(tmpDir, '.open-next'), { recursive: true });
+    await writeFileEnsured(join(tmpDir, 'package.json'), '{}');
+
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.files).toEqual({
+      '.env.local': true,
+      '.env': true,
+      '.bigcommerce/project.json': true,
+      '.bigcommerce/wrangler.jsonc': true,
+      '.open-next/': true,
+      'package.json': true,
+    });
+  });
+
+  test('non-string credential values in project.json are ignored', async () => {
+    await writeProjectJson(tmpDir, { storeHash: 123, accessToken: { nested: true } });
+
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.config.storeHash).toEqual({ present: false, source: 'unset' });
+    expect(d.config.accessToken).toEqual({ present: false, source: 'unset' });
+    // The keys are still reported as present, just without their values.
+    expect(d.config.projectJsonKeys).toEqual(['accessToken', 'storeHash']);
+  });
+
+  test.each([
+    ['malformed JSON', 'not json{'],
+    ['top-level null', 'null'],
+    ['top-level string', '"just a string"'],
+    ['top-level array', '[]'],
+  ])('treats %s in project.json as no config', async (_label, contents) => {
+    await writeFileEnsured(join(tmpDir, '.bigcommerce', 'project.json'), contents);
+
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.config.projectJsonKeys).toEqual([]);
+    expect(d.config.storedEnvKeys).toEqual([]);
+    expect(d.config.storeHash).toEqual({ present: false, source: 'unset' });
+  });
+
+  test.each([
+    ['non-object env', { env: 'nope' }],
+    ['null env', { env: null }],
+    ['array env', { env: [] }],
+    ['missing env', { projectUuid: 'x' }],
+  ])('storedEnvKeys is empty when project.json has %s', async (_label, value) => {
+    await writeProjectJson(tmpDir, value);
+
+    const d = collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(d.config.storedEnvKeys).toEqual([]);
+  });
+
+  test('does not create .bigcommerce/ as a side effect', () => {
+    collectDiagnostics({ cwd: tmpDir, env: emptyEnv });
+
+    expect(existsSync(join(tmpDir, '.bigcommerce'))).toBe(false);
+  });
+
+  test('defaults cwd and env to process values', () => {
+    // Exercises the default-parameter path (no options passed).
+    const d = collectDiagnostics();
+
+    expect(d.project.cwd).toBe(process.cwd());
+    expect(d.cli.name).toBe('@bigcommerce/catalyst');
+  });
+
+  describe('secret-masking guarantee', () => {
+    test('no secret value appears anywhere in the report', async () => {
+      const secrets = {
+        storeHash: 'STORE_HASH_SECRET_VALUE',
+        accessToken: 'ACCESS_TOKEN_SECRET_VALUE',
+        env: {
+          STOREFRONT_TOKEN: 'STOREFRONT_TOKEN_SECRET_VALUE',
+          DB_PASSWORD: 'DB_PASSWORD_SECRET_VALUE',
+        },
+      };
+
+      await writeProjectJson(tmpDir, { projectUuid: 'uuid-x', framework: 'catalyst', ...secrets });
+
+      const env: NodeJS.ProcessEnv = {
+        CATALYST_STORE_HASH: 'ENV_STORE_HASH_SECRET',
+        CATALYST_ACCESS_TOKEN: 'ENV_ACCESS_TOKEN_SECRET',
+        BIGCOMMERCE_STOREFRONT_TOKEN: 'ENV_STOREFRONT_TOKEN_SECRET',
+        AUTH_SECRET: 'ENV_AUTH_SECRET_VALUE',
+      };
+
+      const serialized = JSON.stringify(collectDiagnostics({ cwd: tmpDir, env }));
+
+      const leaked = [
+        secrets.storeHash,
+        secrets.accessToken,
+        secrets.env.STOREFRONT_TOKEN,
+        secrets.env.DB_PASSWORD,
+        env.CATALYST_STORE_HASH,
+        env.CATALYST_ACCESS_TOKEN,
+        env.BIGCOMMERCE_STOREFRONT_TOKEN,
+        env.AUTH_SECRET,
+      ];
+
+      leaked.forEach((value) => {
+        expect(serialized).not.toContain(value);
+      });
+
+      // Key names (not values) are still surfaced so support knows what's set.
+      expect(serialized).toContain('STOREFRONT_TOKEN');
+      expect(serialized).toContain('DB_PASSWORD');
+    });
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/collect-diagnostics.ts b/packages/catalyst/src/cli/lib/collect-diagnostics.ts
new file mode 100644
index 0000000000..c46a11cc4b
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/collect-diagnostics.ts
@@ -0,0 +1,350 @@
+import { parse } from 'dotenv';
+import { existsSync, readFileSync } from 'node:fs';
+import { release } from 'node:os';
+import { dirname, join } from 'node:path';
+import { z } from 'zod';
+
+import PACKAGE_INFO from '../../../package.json';
+
+import { detectPackageManager, type PackageManager } from './detect-package-manager';
+import { getProjectState } from './project-state';
+import { getTelemetry } from './telemetry';
+
+// Env vars the CLI itself reads to run commands (credential/flag bindings in
+// shared-options.ts plus the telemetry opt-out). We report only WHERE each is
+// set (or that it is unset) — never its value — so the report can never leak a
+// token, secret, or store identifier.
+export const CLI_ENV_VARS = [
+  'CATALYST_STORE_HASH',
+  'CATALYST_ACCESS_TOKEN',
+  'CATALYST_PROJECT_UUID',
+  'CATALYST_API_HOST',
+  'BIGCOMMERCE_LOGIN_URL',
+  'CATALYST_TELEMETRY_DISABLED',
+] as const;
+
+// Env vars the storefront (Next.js app) build reads, not the CLI. Mirrors
+// REQUIRED_BUILD_ENV_VARS in required-build-env.ts — the values `build`/`deploy`
+// assert on before shelling out to the OpenNext/Next.js build.
+export const BUILD_ENV_VARS = [
+  'BIGCOMMERCE_STORE_HASH',
+  'BIGCOMMERCE_STOREFRONT_TOKEN',
+  'BIGCOMMERCE_CHANNEL_ID',
+  'AUTH_SECRET',
+] as const;
+
+// Env files `build`/`deploy` auto-load, in precedence order (see build-env.ts).
+// `debug` doesn't load them into process.env — it only inspects their KEYS so
+// the report reflects what a build would resolve, without side effects.
+const ENV_FILES = ['.env.local', '.env'] as const;
+
+// Lockfile -> package manager, checked in this order. This detects the
+// project's package manager (what `build`/`deploy` shell out to) rather than
+// whatever invoked the CLI, which is what a bug report actually needs.
+const PROJECT_LOCKFILES: ReadonlyArray<readonly [string, PackageManager]> = [
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['yarn.lock', 'yarn'],
+  ['bun.lock', 'bun'],
+  ['bun.lockb', 'bun'],
+  ['package-lock.json', 'npm'],
+];
+
+// Where a value resolved from, following the CLI's priority chain
+// (process.env > .env.local > .env > .bigcommerce/project.json). Flags are
+// excluded because `debug` takes none of the credential flags itself.
+export type EnvSource = 'process.env' | (typeof ENV_FILES)[number];
+export type ConfigSource = EnvSource | 'project.json' | 'unset';
+
+export interface ResolvedValue {
+  present: boolean;
+  source: ConfigSource;
+}
+
+export interface Diagnostics {
+  cli: {
+    name: string;
+    version: string;
+  };
+  runtime: {
+    node: string;
+    platform: string;
+    arch: string;
+    osRelease: string;
+    packageManager: PackageManager;
+  };
+  project: {
+    cwd: string;
+    // The storefront package name + version from the project's package.json,
+    // resolved the same way `upgrade` does. `name` identifies the Catalyst
+    // family (catalyst-core, catalyst-makeswift, …). null when absent.
+    storefrontName: string | null;
+    storefrontVersion: string | null;
+    projectUuid: string | null;
+    isLinked: boolean;
+    isTransformed: boolean;
+    isFullySetUp: boolean;
+    hasMiddleware: boolean;
+    hasProxy: boolean;
+    hasOpenNextDep: boolean;
+  };
+  config: {
+    storeHash: ResolvedValue;
+    accessToken: ResolvedValue;
+    projectUuid: ResolvedValue;
+    // The API host override. 'unset' means the CLI falls back to its default
+    // (api.bigcommerce.com). Resolved like the credentials above.
+    apiHost: ResolvedValue;
+    // Top-level keys present in .bigcommerce/project.json (names only — values
+    // are never included so masked secrets like accessToken can't leak).
+    projectJsonKeys: string[];
+    // Names of persisted deployment env vars (project.json `env` map keys only).
+    storedEnvKeys: string[];
+    // Env var name -> where it resolved from ('unset' if nowhere), split by
+    // consumer: `cliEnvVars` are read by the CLI, `buildEnvVars` by the Next.js
+    // app build. The value is never included, only the source.
+    cliEnvVars: Record<string, ConfigSource>;
+    buildEnvVars: Record<string, ConfigSource>;
+  };
+  telemetry: {
+    enabled: boolean;
+    correlationId: string;
+  };
+  // Relative path -> whether the file/directory exists on disk. Presence only;
+  // contents are never read into the report.
+  files: Record<string, boolean>;
+}
+
+export interface CollectDiagnosticsOptions {
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+}
+
+// A value counts as present only when it is a non-empty, non-whitespace string —
+// mirroring how the build treats "" the same as unset (see required-build-env.ts).
+const hasValue = (value: string | undefined): boolean => value !== undefined && value.trim() !== '';
+
+interface EnvLayer {
+  source: EnvSource;
+  values: Record<string, string | undefined>;
+}
+
+// Build the ordered env layers the CLI resolves against: the real environment
+// first, then the auto-loaded env files. File values are parsed into memory
+// only to detect presence — they are never surfaced in the report.
+const buildEnvLayers = (cwd: string, env: NodeJS.ProcessEnv): EnvLayer[] => {
+  const layers: EnvLayer[] = [{ source: 'process.env', values: env }];
+
+  ENV_FILES.forEach((file) => {
+    const path = join(cwd, file);
+
+    if (!existsSync(path)) {
+      return;
+    }
+
+    try {
+      layers.push({ source: file, values: parse(readFileSync(path, 'utf-8')) });
+    } catch {
+      // A malformed/unreadable env file shouldn't break the report.
+    }
+  });
+
+  return layers;
+};
+
+// The first layer (process.env > .env.local > .env) that carries a non-empty
+// value for any of the given keys. Returns only the source — never a value.
+const resolveEnvSource = (layers: EnvLayer[], ...keys: string[]): EnvSource | undefined =>
+  layers.find((layer) => keys.some((key) => hasValue(layer.values[key])))?.source;
+
+// Map each named var to the layer it resolves from (or 'unset'), values omitted.
+const resolveEnvVars = (
+  layers: EnvLayer[],
+  names: readonly string[],
+): Record<string, ConfigSource> =>
+  Object.fromEntries(names.map((name) => [name, resolveEnvSource(layers, name) ?? 'unset']));
+
+// Resolve which source (if any) supplies a credential, without exposing the
+// value itself. Env layers win over project.json, matching build/deploy.
+const resolveValue = (
+  envSource: EnvSource | undefined,
+  configValue: string | undefined,
+): ResolvedValue => {
+  if (envSource) {
+    return { present: true, source: envSource };
+  }
+
+  if (hasValue(configValue)) {
+    return { present: true, source: 'project.json' };
+  }
+
+  return { present: false, source: 'unset' };
+};
+
+const asString = (value: unknown): string | undefined =>
+  typeof value === 'string' ? value : undefined;
+
+const lockfileManager = (dir: string): PackageManager | undefined =>
+  PROJECT_LOCKFILES.find(([file]) => existsSync(join(dir, file)))?.[1];
+
+// Detect the project's package manager from the nearest lockfile, walking up
+// from cwd so it still works when the CLI is run from a subdirectory (e.g.
+// `core/` in a monorepo, where the lockfile lives at the repo root). Falls back
+// to the manager that invoked the CLI when no lockfile is found anywhere.
+const detectProjectPackageManager = (cwd: string): PackageManager => {
+  let dir = cwd;
+
+  for (;;) {
+    const match = lockfileManager(dir);
+
+    if (match) {
+      return match;
+    }
+
+    const parent = dirname(dir);
+
+    if (parent === dir) {
+      // Reached the filesystem root without finding a lockfile.
+      return detectPackageManager();
+    }
+
+    dir = parent;
+  }
+};
+
+// An open object schema: known credential fields plus any other keys the file
+// may carry, all kept as `unknown` so we can enumerate key names without
+// coercing (or trusting the type of) their values.
+const projectJsonSchema = z.looseObject({});
+
+const safeReadJson = (path: string): unknown => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return null;
+  }
+};
+
+// Read .bigcommerce/project.json as a raw object without going through
+// getProjectConfig() — that instantiates Conf and would create .bigcommerce/ as
+// a side effect (see project-state.ts). Returns null when absent, malformed, or
+// not a JSON object.
+const readProjectJson = (cwd: string): Record<string, unknown> | null => {
+  const result = projectJsonSchema.safeParse(
+    safeReadJson(join(cwd, '.bigcommerce', 'project.json')),
+  );
+
+  return result.success ? result.data : null;
+};
+
+// Mirrors upgrade.ts: `catalyst.version` is the source of truth for the
+// storefront version, falling back to the plain `version`. `name` identifies
+// which Catalyst family the project is on (e.g. @bigcommerce/catalyst-core).
+const storefrontPackageSchema = z.looseObject({
+  name: z.string().optional(),
+  version: z.string().optional(),
+  catalyst: z.looseObject({ version: z.string().optional() }).optional(),
+});
+
+const readStorefrontInfo = (cwd: string): { name: string | null; version: string | null } => {
+  const result = storefrontPackageSchema.safeParse(safeReadJson(join(cwd, 'package.json')));
+
+  if (!result.success) {
+    return { name: null, version: null };
+  }
+
+  return {
+    name: result.data.name ?? null,
+    version: result.data.catalyst?.version ?? result.data.version ?? null,
+  };
+};
+
+const readStoredEnvKeys = (projectJson: Record<string, unknown> | null): string[] => {
+  const env = projectJson?.env;
+
+  if (typeof env === 'object' && env !== null && !Array.isArray(env)) {
+    return Object.keys(env).sort();
+  }
+
+  return [];
+};
+
+// Gather a diagnostic snapshot of the CLI, runtime, project, and config state.
+// By construction this never includes secret values — credentials are reported
+// as presence + source only, and file/env checks report existence only.
+export function collectDiagnostics({
+  cwd = process.cwd(),
+  env = process.env,
+}: CollectDiagnosticsOptions = {}): Diagnostics {
+  const state = getProjectState(cwd);
+  const telemetry = getTelemetry();
+  const projectJson = readProjectJson(cwd);
+  const storefront = readStorefrontInfo(cwd);
+
+  // The CLI reads its own config only from the real environment (Commander
+  // `.env()` bindings) and .bigcommerce/project.json — never from .env files
+  // (see the note in program.ts). Only the storefront BUILD vars are loaded
+  // from .env.local/.env, and only by `build`/`deploy`, so only those are
+  // resolved across the file layers.
+  const cliEnv: EnvLayer[] = [{ source: 'process.env', values: env }];
+  const buildEnv = buildEnvLayers(cwd, env);
+
+  return {
+    cli: {
+      name: PACKAGE_INFO.name,
+      version: PACKAGE_INFO.version,
+    },
+    runtime: {
+      node: process.version,
+      platform: process.platform,
+      arch: process.arch,
+      osRelease: release(),
+      packageManager: detectProjectPackageManager(cwd),
+    },
+    project: {
+      cwd,
+      storefrontName: storefront.name,
+      storefrontVersion: storefront.version,
+      projectUuid: state.projectUuid ?? null,
+      isLinked: state.isLinked,
+      isTransformed: state.isTransformed,
+      isFullySetUp: state.isFullySetUp,
+      hasMiddleware: state.hasMiddleware,
+      hasProxy: state.hasProxy,
+      hasOpenNextDep: state.hasOpenNextDep,
+    },
+    config: {
+      storeHash: resolveValue(
+        resolveEnvSource(cliEnv, 'CATALYST_STORE_HASH', 'BIGCOMMERCE_STORE_HASH'),
+        asString(projectJson?.storeHash),
+      ),
+      accessToken: resolveValue(
+        resolveEnvSource(cliEnv, 'CATALYST_ACCESS_TOKEN'),
+        asString(projectJson?.accessToken),
+      ),
+      projectUuid: resolveValue(
+        resolveEnvSource(cliEnv, 'CATALYST_PROJECT_UUID'),
+        asString(projectJson?.projectUuid),
+      ),
+      apiHost: resolveValue(
+        resolveEnvSource(cliEnv, 'CATALYST_API_HOST'),
+        asString(projectJson?.apiHost),
+      ),
+      projectJsonKeys: projectJson ? Object.keys(projectJson).sort() : [],
+      storedEnvKeys: readStoredEnvKeys(projectJson),
+      cliEnvVars: resolveEnvVars(cliEnv, CLI_ENV_VARS),
+      buildEnvVars: resolveEnvVars(buildEnv, BUILD_ENV_VARS),
+    },
+    telemetry: {
+      enabled: telemetry.isEnabled(),
+      correlationId: telemetry.correlationId,
+    },
+    files: {
+      '.env.local': existsSync(join(cwd, '.env.local')),
+      '.env': existsSync(join(cwd, '.env')),
+      '.bigcommerce/project.json': existsSync(join(cwd, '.bigcommerce', 'project.json')),
+      '.bigcommerce/wrangler.jsonc': existsSync(join(cwd, '.bigcommerce', 'wrangler.jsonc')),
+      '.open-next/': existsSync(join(cwd, '.open-next')),
+      'package.json': existsSync(join(cwd, 'package.json')),
+    },
+  };
+}
diff --git a/packages/catalyst/src/cli/lib/commerce-hosting.spec.ts b/packages/catalyst/src/cli/lib/commerce-hosting.spec.ts
new file mode 100644
index 0000000000..3ef4086807
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/commerce-hosting.spec.ts
@@ -0,0 +1,939 @@
+import { confirm, input, select } from '@inquirer/prompts';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from 'vitest';
+import { z } from 'zod';
+
+import {
+  cleanupCloudflareIncompatibilities,
+  promptAndCreateCommerceHostingProject,
+  promptForCommerceHostingProject,
+  setupCommerceHosting,
+} from './commerce-hosting';
+import * as projectLib from './project';
+import { InfrastructureProjectValidationError } from './project';
+
+vi.mock('@inquirer/prompts', () => ({
+  confirm: vi.fn(),
+  input: vi.fn(),
+  select: vi.fn(),
+  Separator: class FakeSeparator {
+    type = 'separator';
+  },
+}));
+
+const confirmMock = vi.mocked(confirm);
+const inputMock = vi.mocked(input);
+const selectMock = vi.mocked(select);
+
+const API = { storeHash: 'store', accessToken: 'token', apiHost: 'api.example.com' };
+
+function withTtyValue(value: boolean): () => void {
+  const previous = Object.getOwnPropertyDescriptor(process.stdin, 'isTTY');
+
+  Object.defineProperty(process.stdin, 'isTTY', { value, configurable: true });
+
+  return () => {
+    if (previous) {
+      Object.defineProperty(process.stdin, 'isTTY', previous);
+    } else {
+      Reflect.deleteProperty(process.stdin, 'isTTY');
+    }
+  };
+}
+
+const withInteractiveTty = () => withTtyValue(true);
+const withNonInteractiveTty = () => withTtyValue(false);
+
+let fetchProjectsSpy: MockInstance<typeof projectLib.fetchProjects>;
+let createProjectSpy: MockInstance<typeof projectLib.createProject>;
+let consoleErrorSpy: MockInstance<(typeof console)['error']>;
+
+beforeEach(() => {
+  confirmMock.mockReset();
+  inputMock.mockReset();
+  selectMock.mockReset();
+  fetchProjectsSpy = vi.spyOn(projectLib, 'fetchProjects').mockResolvedValue([]);
+  createProjectSpy = vi.spyOn(projectLib, 'createProject');
+  consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  consoleErrorSpy.mockRestore();
+});
+
+function createdProject(uuid: string, name: string) {
+  return {
+    uuid,
+    name,
+    date_created: new Date(),
+    date_modified: new Date(),
+  };
+}
+
+describe('promptAndCreateCommerceHostingProject', () => {
+  it('returns the created project when the first attempt succeeds', async () => {
+    inputMock.mockResolvedValueOnce('my-project');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'my-project'));
+
+    const result = await promptAndCreateCommerceHostingProject(API, []);
+
+    expect(result).toEqual({ uuid: 'u', name: 'my-project', deployment_hostnames: [] });
+    expect(createProjectSpy).toHaveBeenCalledTimes(1);
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'my-project',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('trims whitespace from the entered name before calling the API', async () => {
+    inputMock.mockResolvedValueOnce('  spaced  ');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'spaced'));
+
+    await promptAndCreateCommerceHostingProject(API, []);
+
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'spaced',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('re-prompts after a validation error and succeeds on retry', async () => {
+    inputMock.mockResolvedValueOnce('###').mockResolvedValueOnce('good-name');
+
+    createProjectSpy
+      .mockRejectedValueOnce(new InfrastructureProjectValidationError('Invalid name'))
+      .mockResolvedValueOnce(createdProject('u', 'good-name'));
+
+    const result = await promptAndCreateCommerceHostingProject(API, []);
+
+    expect(result).toEqual({ uuid: 'u', name: 'good-name', deployment_hostnames: [] });
+    expect(inputMock).toHaveBeenCalledTimes(2);
+    expect(createProjectSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('re-prompts multiple times until the server accepts the name', async () => {
+    inputMock
+      .mockResolvedValueOnce('bad1')
+      .mockResolvedValueOnce('bad2')
+      .mockResolvedValueOnce('good');
+
+    createProjectSpy
+      .mockRejectedValueOnce(new InfrastructureProjectValidationError('first failure'))
+      .mockRejectedValueOnce(new InfrastructureProjectValidationError('second failure'))
+      .mockResolvedValueOnce(createdProject('u', 'good'));
+
+    const result = await promptAndCreateCommerceHostingProject(API, []);
+
+    expect(result).toEqual({ uuid: 'u', name: 'good', deployment_hostnames: [] });
+    expect(inputMock).toHaveBeenCalledTimes(3);
+    expect(createProjectSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('does not retry on non-validation errors', async () => {
+    inputMock.mockResolvedValueOnce('whatever');
+    createProjectSpy.mockRejectedValueOnce(new Error('500 server error'));
+
+    await expect(promptAndCreateCommerceHostingProject(API, [])).rejects.toThrow(
+      '500 server error',
+    );
+
+    expect(inputMock).toHaveBeenCalledTimes(1);
+    expect(createProjectSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('passes the supplied default name to the initial prompt', async () => {
+    inputMock.mockResolvedValueOnce('my-catalyst-store');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'my-catalyst-store'));
+
+    await promptAndCreateCommerceHostingProject(API, [], 'my-catalyst-store');
+
+    expect(inputMock.mock.calls[0]?.[0].default).toBe('my-catalyst-store');
+  });
+
+  it('preserves the original default on retry so the user is not stuck with the rejected value', async () => {
+    inputMock.mockResolvedValueOnce('bad-name').mockResolvedValueOnce('fixed-name');
+
+    createProjectSpy
+      .mockRejectedValueOnce(new InfrastructureProjectValidationError('Invalid'))
+      .mockResolvedValueOnce(createdProject('u', 'fixed-name'));
+
+    await promptAndCreateCommerceHostingProject(API, [], 'original-default');
+
+    expect(inputMock.mock.calls[0]?.[0].default).toBe('original-default');
+    expect(inputMock.mock.calls[1]?.[0].default).toBe('original-default');
+  });
+
+  it('uses a validator that rejects empty input', async () => {
+    inputMock.mockResolvedValueOnce('ok');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'ok'));
+
+    await promptAndCreateCommerceHostingProject(API, []);
+
+    const validator = inputMock.mock.calls[0]?.[0].validate;
+
+    expect(validator).toBeDefined();
+    expect(validator?.('')).toBe('Project name is required');
+    expect(validator?.('   ')).toBe('Project name is required');
+    expect(validator?.('name')).toBe(true);
+  });
+
+  it('rejects names that already exist on the store', async () => {
+    inputMock.mockResolvedValueOnce('available');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'available'));
+
+    await promptAndCreateCommerceHostingProject(API, ['taken-one', 'taken-two']);
+
+    const validator = inputMock.mock.calls[0]?.[0].validate;
+
+    expect(validator).toBeDefined();
+    expect(validator?.('taken-one')).toBe(
+      'A Commerce Hosting project named "taken-one" already exists',
+    );
+    expect(validator?.('  taken-two  ')).toBe(
+      'A Commerce Hosting project named "taken-two" already exists',
+    );
+    expect(validator?.('available')).toBe(true);
+  });
+
+  it('rejects names that match an existing project case-insensitively, and reports the stored name', async () => {
+    inputMock.mockResolvedValueOnce('different');
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'different'));
+
+    await promptAndCreateCommerceHostingProject(API, ['MyProject']);
+
+    const validator = inputMock.mock.calls[0]?.[0].validate;
+
+    expect(validator?.('myproject')).toBe(
+      'A Commerce Hosting project named "MyProject" already exists',
+    );
+    expect(validator?.('MYPROJECT')).toBe(
+      'A Commerce Hosting project named "MyProject" already exists',
+    );
+    expect(validator?.('  MyProject  ')).toBe(
+      'A Commerce Hosting project named "MyProject" already exists',
+    );
+  });
+});
+
+describe('promptForCommerceHostingProject', () => {
+  it('silently auto-creates with the supplied default name when no Commerce Hosting project conflicts (no existing projects)', async () => {
+    fetchProjectsSpy.mockResolvedValue([]);
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'fresh'));
+
+    const result = await promptForCommerceHostingProject(API, 'fresh');
+
+    expect(result).toEqual({ uuid: 'u', name: 'fresh', deployment_hostnames: [] });
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'fresh',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('silently auto-creates with the supplied default name when other projects exist but none conflict', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'aaa', name: 'unrelated-one', deployment_hostnames: [] },
+      { uuid: 'bbb', name: 'unrelated-two', deployment_hostnames: [] },
+    ]);
+    createProjectSpy.mockResolvedValueOnce(createdProject('new', 'my-store'));
+
+    const result = await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(result).toEqual({ uuid: 'new', name: 'my-store', deployment_hostnames: [] });
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'my-store',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('returns a selected existing project without calling create', async () => {
+    const existing = [
+      { uuid: 'aaa', name: 'first', deployment_hostnames: [] },
+      { uuid: 'bbb', name: 'second', deployment_hostnames: [] },
+    ];
+
+    fetchProjectsSpy.mockResolvedValue(existing);
+
+    selectMock
+      .mockResolvedValueOnce('select-from-list')
+      .mockResolvedValueOnce({ uuid: 'bbb', name: 'second', deployment_hostnames: [] });
+
+    const result = await promptForCommerceHostingProject(API, 'first');
+
+    expect(result).toEqual({ uuid: 'bbb', name: 'second', deployment_hostnames: [] });
+    expect(createProjectSpy).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(selectMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('routes to the create flow when the default name conflicts and the user chooses to create a new project', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'aaa', name: 'default-name', deployment_hostnames: [] },
+    ]);
+    createProjectSpy.mockResolvedValueOnce(createdProject('new', 'new-proj'));
+
+    selectMock.mockResolvedValueOnce('create');
+    inputMock.mockResolvedValueOnce('new-proj');
+
+    const result = await promptForCommerceHostingProject(API, 'default-name');
+
+    expect(result).toEqual({ uuid: 'new', name: 'new-proj', deployment_hostnames: [] });
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'new-proj',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+    expect(inputMock.mock.calls[0]?.[0].default).toBe('default-name');
+  });
+
+  it('shows the conflict-aware message and three choices when a conflict exists', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'aaa', name: 'My-Store', deployment_hostnames: [] },
+      { uuid: 'bbb', name: 'other-project', deployment_hostnames: [] },
+    ]);
+
+    selectMock.mockResolvedValueOnce('create');
+    inputMock.mockResolvedValueOnce('something-else');
+    createProjectSpy.mockResolvedValueOnce(createdProject('new', 'something-else'));
+
+    await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(selectMock.mock.calls[0]?.[0].message).toBe(
+      'It looks like you already have an existing Commerce Hosting project named "My-Store". Would you like to use it, select from your projects, or create a new one?',
+    );
+    expect(selectMock.mock.calls[0]?.[0].choices).toEqual([
+      { name: 'Use "My-Store"', value: 'use-named' },
+      { name: 'Select from my projects', value: 'select-from-list' },
+      { name: 'Create a new project', value: 'create' },
+    ]);
+  });
+
+  it('returns the conflicting project directly when the user picks Use "<name>"', async () => {
+    const conflict = { uuid: 'aaa', name: 'My-Store', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([
+      conflict,
+      { uuid: 'bbb', name: 'other-project', deployment_hostnames: [] },
+    ]);
+
+    selectMock.mockResolvedValueOnce('use-named');
+
+    const result = await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(result).toEqual(conflict);
+    expect(selectMock).toHaveBeenCalledTimes(1);
+    expect(createProjectSpy).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+  });
+
+  it('shows all projects (including the conflict) and a "Create a new project" option in the list', async () => {
+    const conflict = { uuid: 'aaa', name: 'My-Store', deployment_hostnames: [] };
+    const other = { uuid: 'bbb', name: 'other-project', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([conflict, other]);
+
+    selectMock.mockResolvedValueOnce('select-from-list').mockResolvedValueOnce(other);
+
+    const result = await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(result).toEqual(other);
+
+    const projectChoices = selectMock.mock.calls[1]?.[0].choices ?? [];
+
+    expect(projectChoices[0]).toEqual({ name: 'My-Store', value: conflict, description: 'aaa' });
+    expect(projectChoices[1]).toEqual({
+      name: 'other-project',
+      value: other,
+      description: 'bbb',
+    });
+    expect(projectChoices[projectChoices.length - 1]).toEqual({
+      name: 'Create a new project',
+      value: 'create-new',
+    });
+  });
+
+  it('routes to the create flow when the user picks "Create a new project" from the list', async () => {
+    const conflict = { uuid: 'aaa', name: 'My-Store', deployment_hostnames: [] };
+    const other = { uuid: 'bbb', name: 'other-project', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([conflict, other]);
+    createProjectSpy.mockResolvedValueOnce(createdProject('new', 'fresh-name'));
+
+    selectMock.mockResolvedValueOnce('select-from-list').mockResolvedValueOnce('create-new');
+    inputMock.mockResolvedValueOnce('fresh-name');
+
+    const result = await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(result).toEqual({ uuid: 'new', name: 'fresh-name', deployment_hostnames: [] });
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'fresh-name',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('omits Select from my projects when the conflict is the only existing project', async () => {
+    const conflict = { uuid: 'aaa', name: 'My-Store', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([conflict]);
+
+    selectMock.mockResolvedValueOnce('use-named');
+
+    await promptForCommerceHostingProject(API, 'my-store');
+
+    expect(selectMock.mock.calls[0]?.[0].choices).toEqual([
+      { name: 'Use "My-Store"', value: 'use-named' },
+      { name: 'Create a new project', value: 'create' },
+    ]);
+    expect(selectMock.mock.calls[0]?.[0].message).toBe(
+      'It looks like you already have an existing Commerce Hosting project named "My-Store". Would you like to use it, or create a new one?',
+    );
+  });
+
+  it('skips all prompts and creates with the supplied name when autoUseDefaultName is true', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'other', name: 'unrelated', deployment_hostnames: [] },
+    ]);
+    createProjectSpy.mockResolvedValueOnce(createdProject('u', 'auto-name'));
+
+    const result = await promptForCommerceHostingProject(API, 'auto-name', true);
+
+    expect(result).toEqual({ uuid: 'u', name: 'auto-name', deployment_hostnames: [] });
+    expect(fetchProjectsSpy).toHaveBeenCalled();
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(createProjectSpy).toHaveBeenCalledWith(
+      'auto-name',
+      API.storeHash,
+      API.accessToken,
+      API.apiHost,
+    );
+  });
+
+  it('returns the existing project when --project-name collides and the user picks Yes', async () => {
+    const existing = { uuid: 'aaa', name: 'taken-name', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([existing]);
+
+    selectMock.mockResolvedValueOnce(true);
+
+    const restoreTty = withInteractiveTty();
+
+    try {
+      const result = await promptForCommerceHostingProject(API, 'taken-name', true);
+
+      expect(result).toEqual(existing);
+      expect(createProjectSpy).not.toHaveBeenCalled();
+      expect(selectMock.mock.calls[0]?.[0].message).toMatch(
+        /A Commerce Hosting project named "taken-name" already exists/,
+      );
+    } finally {
+      restoreTty();
+    }
+  });
+
+  it('reuses the existing project without prompting when --use-existing is passed', async () => {
+    const existing = { uuid: 'aaa', name: 'taken-name', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([existing]);
+
+    const result = await promptForCommerceHostingProject(API, 'taken-name', true, true);
+
+    expect(result).toEqual(existing);
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(createProjectSpy).not.toHaveBeenCalled();
+  });
+
+  it('exits without prompting in non-interactive environments when --use-existing is not passed', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'aaa', name: 'taken-name', deployment_hostnames: [] },
+    ]);
+
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((code) => {
+      throw new Error(`process.exit(${String(code)})`);
+    });
+    const restoreTty = withNonInteractiveTty();
+
+    try {
+      await expect(promptForCommerceHostingProject(API, 'taken-name', true)).rejects.toThrow(
+        'process.exit(1)',
+      );
+
+      expect(selectMock).not.toHaveBeenCalled();
+      expect(createProjectSpy).not.toHaveBeenCalled();
+    } finally {
+      exitSpy.mockRestore();
+      restoreTty();
+    }
+  });
+
+  it('detects --project-name collision case-insensitively and reports the stored name', async () => {
+    const existing = { uuid: 'aaa', name: 'MyProject', deployment_hostnames: [] };
+
+    fetchProjectsSpy.mockResolvedValue([existing]);
+
+    selectMock.mockResolvedValueOnce(true);
+
+    const restoreTty = withInteractiveTty();
+
+    try {
+      const result = await promptForCommerceHostingProject(API, 'myproject', true);
+
+      expect(result).toEqual(existing);
+      expect(createProjectSpy).not.toHaveBeenCalled();
+      expect(selectMock.mock.calls[0]?.[0].message).toMatch(
+        /A Commerce Hosting project named "MyProject" already exists/,
+      );
+    } finally {
+      restoreTty();
+    }
+  });
+
+  it('exits when --project-name collides and the user picks No', async () => {
+    fetchProjectsSpy.mockResolvedValue([
+      { uuid: 'aaa', name: 'taken-name', deployment_hostnames: [] },
+    ]);
+
+    selectMock.mockResolvedValueOnce(false);
+
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((code) => {
+      throw new Error(`process.exit(${String(code)})`);
+    });
+    const restoreTty = withInteractiveTty();
+
+    try {
+      await expect(promptForCommerceHostingProject(API, 'taken-name', true)).rejects.toThrow(
+        'process.exit(1)',
+      );
+
+      expect(exitSpy).toHaveBeenCalledWith(1);
+      expect(createProjectSpy).not.toHaveBeenCalled();
+    } finally {
+      exitSpy.mockRestore();
+      restoreTty();
+    }
+  });
+
+  it('exits the process when auto-create fails with a validation error instead of re-prompting', async () => {
+    fetchProjectsSpy.mockResolvedValue([]);
+    createProjectSpy.mockRejectedValueOnce(
+      new InfrastructureProjectValidationError('Name already taken'),
+    );
+
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((code) => {
+      throw new Error(`process.exit(${String(code)})`);
+    });
+
+    await expect(promptForCommerceHostingProject(API, 'taken-name', true)).rejects.toThrow(
+      'process.exit(1)',
+    );
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(createProjectSpy).toHaveBeenCalledTimes(1);
+
+    exitSpy.mockRestore();
+  });
+
+  it('propagates errors from fetchProjects', async () => {
+    fetchProjectsSpy.mockRejectedValue(new Error('network down'));
+
+    await expect(promptForCommerceHostingProject(API, 'whatever')).rejects.toThrow('network down');
+    expect(selectMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('setupCommerceHosting', () => {
+  const packageJsonSchema = z.record(z.string(), z.unknown());
+  const projectJsonSchema = z.object({
+    projectUuid: z.string(),
+    framework: z.string(),
+    storeHash: z.string().optional(),
+    accessToken: z.string().optional(),
+  });
+
+  let projectDir: string;
+  let restoreTty: () => void;
+
+  beforeEach(() => {
+    projectDir = mkdtempSync(join(tmpdir(), 'catalyst-create-test-'));
+    restoreTty = withInteractiveTty();
+    confirmMock.mockResolvedValue(true);
+  });
+
+  afterEach(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+    restoreTty();
+  });
+
+  function writeCorePackageJson(contents: unknown) {
+    writeFileSync(join(projectDir, 'package.json'), JSON.stringify(contents, null, 2));
+  }
+
+  function writeCoreProxyFile(contents: string) {
+    writeFileSync(join(projectDir, 'proxy.ts'), contents);
+  }
+
+  function writeCoreInstrumentationFile(contents: string) {
+    writeFileSync(join(projectDir, 'instrumentation.ts'), contents);
+  }
+
+  function readCorePackageJson() {
+    return packageJsonSchema.parse(
+      JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf-8')),
+    );
+  }
+
+  function readProjectJson() {
+    return projectJsonSchema.parse(
+      JSON.parse(readFileSync(join(projectDir, '.bigcommerce', 'project.json'), 'utf-8')),
+    );
+  }
+
+  it('adds the OpenNext Cloudflare dep while preserving existing dependencies', async () => {
+    writeCorePackageJson({
+      scripts: { dev: 'next dev' },
+      dependencies: { next: '^15.0.0', react: '^18.0.0' },
+    });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.dependencies).toMatchObject({ next: '^15.0.0', react: '^18.0.0' });
+    expect(pkg.dependencies).toHaveProperty('@opennextjs/cloudflare');
+  });
+
+  it('drops @vercel/otel from dependencies when the user accepts the instrumentation removal prompt', async () => {
+    writeCorePackageJson({
+      scripts: { dev: 'next dev' },
+      dependencies: {
+        next: '^15.0.0',
+        react: '^18.0.0',
+        '@vercel/otel': '^2.1.0',
+        '@opentelemetry/api': '^1.9.0',
+      },
+    });
+    writeCoreInstrumentationFile('export function register() {}\n');
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.dependencies).not.toHaveProperty('@vercel/otel');
+    expect(pkg.dependencies).toMatchObject({
+      next: '^15.0.0',
+      react: '^18.0.0',
+      '@opentelemetry/api': '^1.9.0',
+    });
+    expect(pkg.dependencies).toHaveProperty('@opennextjs/cloudflare');
+  });
+
+  it('keeps @vercel/otel in place when no instrumentation.ts file exists', async () => {
+    writeCorePackageJson({
+      scripts: { dev: 'next dev' },
+      dependencies: { next: '^15.0.0', '@vercel/otel': '^2.1.0' },
+    });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.dependencies).toHaveProperty('@vercel/otel', '^2.1.0');
+    expect(confirmMock).not.toHaveBeenCalled();
+  });
+
+  it('does not modify package.json scripts (handled by setupCoreProject)', async () => {
+    writeCorePackageJson({
+      scripts: {
+        dev: 'npm run generate && next dev',
+        build: 'npm run generate && next build',
+        start: 'next start',
+      },
+    });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+    expect(readCorePackageJson().scripts).toEqual({
+      dev: 'npm run generate && next dev',
+      build: 'npm run generate && next build',
+      start: 'next start',
+    });
+  });
+
+  it('preserves unrelated top-level package.json fields', async () => {
+    writeCorePackageJson({
+      name: '@bigcommerce/catalyst-core',
+      description: 'test description',
+      version: '1.2.3',
+      private: true,
+      scripts: { dev: 'next dev' },
+      devDependencies: { jest: '^29.0.0' },
+    });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.name).toBe('@bigcommerce/catalyst-core');
+    expect(pkg.description).toBe('test description');
+    expect(pkg.version).toBe('1.2.3');
+    expect(pkg.private).toBe(true);
+    expect(pkg.devDependencies).toEqual({ jest: '^29.0.0' });
+  });
+
+  it('writes .bigcommerce/project.json with the correct shape', async () => {
+    writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'uuid-xyz' });
+
+    expect(readProjectJson()).toEqual({ projectUuid: 'uuid-xyz', framework: 'catalyst' });
+  });
+
+  it('includes storeHash and accessToken in project.json when provided', async () => {
+    writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+    await setupCommerceHosting({
+      projectDir,
+      projectUuid: 'uuid-xyz',
+      storeHash: 'abc123',
+      accessToken: 'token-xyz',
+    });
+
+    expect(readProjectJson()).toEqual({
+      projectUuid: 'uuid-xyz',
+      framework: 'catalyst',
+      storeHash: 'abc123',
+      accessToken: 'token-xyz',
+    });
+  });
+
+  it('omits storeHash and accessToken when not provided', async () => {
+    writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+    await setupCommerceHosting({ projectDir, projectUuid: 'uuid-xyz' });
+
+    const projectJson = readProjectJson();
+
+    expect(projectJson.storeHash).toBeUndefined();
+    expect(projectJson.accessToken).toBeUndefined();
+  });
+
+  it('includes only the credentials that are provided', async () => {
+    writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+    await setupCommerceHosting({
+      projectDir,
+      projectUuid: 'uuid-xyz',
+      storeHash: 'abc123',
+    });
+
+    const projectJson = readProjectJson();
+
+    expect(projectJson.storeHash).toBe('abc123');
+    expect(projectJson.accessToken).toBeUndefined();
+  });
+
+  it('throws when package.json is missing', async () => {
+    await expect(setupCommerceHosting({ projectDir, projectUuid: 'u' })).rejects.toThrow();
+  });
+
+  it('throws when package.json has an invalid shape', async () => {
+    writeCorePackageJson({ dependencies: { next: 42 } });
+
+    await expect(setupCommerceHosting({ projectDir, projectUuid: 'u' })).rejects.toThrow();
+  });
+
+  describe('proxy.ts → middleware.ts conversion', () => {
+    const proxyFixture = [
+      "import { composeProxies } from './proxies/compose-proxies';",
+      '',
+      'export const proxy = composeProxies();',
+      '',
+      'export const config = {',
+      "  matcher: ['/((?!api).*)'],",
+      '};',
+      '',
+    ].join('\n');
+
+    it('renames proxy.ts to middleware.ts, renames the export, and injects the edge runtime', async () => {
+      writeCorePackageJson({ scripts: { dev: 'next dev' } });
+      writeCoreProxyFile(proxyFixture);
+
+      await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+      const middlewarePath = join(projectDir, 'middleware.ts');
+      const proxyPath = join(projectDir, 'proxy.ts');
+
+      expect(existsSync(middlewarePath)).toBe(true);
+      expect(existsSync(proxyPath)).toBe(false);
+
+      const middleware = readFileSync(middlewarePath, 'utf-8');
+
+      expect(middleware).toContain('export const middleware = composeProxies()');
+      expect(middleware).not.toContain('export const proxy');
+      expect(middleware).toContain("runtime: 'experimental-edge'");
+    });
+
+    it('preserves the rest of the file contents', async () => {
+      writeCorePackageJson({ scripts: { dev: 'next dev' } });
+      writeCoreProxyFile(proxyFixture);
+
+      await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+      const middleware = readFileSync(join(projectDir, 'middleware.ts'), 'utf-8');
+
+      expect(middleware).toContain("import { composeProxies } from './proxies/compose-proxies';");
+      expect(middleware).toContain("matcher: ['/((?!api).*)']");
+    });
+
+    it('is a no-op when proxy.ts does not exist', async () => {
+      writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+      await expect(setupCommerceHosting({ projectDir, projectUuid: 'u' })).resolves.not.toThrow();
+      expect(existsSync(join(projectDir, 'middleware.ts'))).toBe(false);
+    });
+  });
+
+  describe('instrumentation.ts removal', () => {
+    it('deletes instrumentation.ts when the user accepts the prompt', async () => {
+      writeCorePackageJson({ scripts: { dev: 'next dev' } });
+      writeCoreInstrumentationFile('export function register() {}\n');
+
+      await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+      expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(false);
+    });
+
+    it('preserves instrumentation.ts when the user declines the prompt', async () => {
+      confirmMock.mockResolvedValueOnce(false);
+
+      writeCorePackageJson({
+        scripts: { dev: 'next dev' },
+        dependencies: { '@vercel/otel': '^2.1.0' },
+      });
+      writeCoreInstrumentationFile('export function register() {}\n');
+
+      await setupCommerceHosting({ projectDir, projectUuid: 'u' });
+
+      expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(true);
+      expect(readCorePackageJson().dependencies).toHaveProperty('@vercel/otel', '^2.1.0');
+    });
+
+    it('does not prompt when instrumentation.ts does not exist', async () => {
+      writeCorePackageJson({ scripts: { dev: 'next dev' } });
+
+      await expect(setupCommerceHosting({ projectDir, projectUuid: 'u' })).resolves.not.toThrow();
+      expect(confirmMock).not.toHaveBeenCalled();
+    });
+  });
+});
+
+describe('cleanupCloudflareIncompatibilities', () => {
+  const packageJsonSchema = z.record(z.string(), z.unknown());
+
+  let projectDir: string;
+  let restoreTty: () => void;
+
+  beforeEach(() => {
+    projectDir = mkdtempSync(join(tmpdir(), 'catalyst-cleanup-test-'));
+    restoreTty = withInteractiveTty();
+    confirmMock.mockResolvedValue(true);
+  });
+
+  afterEach(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+    restoreTty();
+  });
+
+  function writeCorePackageJson(contents: unknown) {
+    writeFileSync(join(projectDir, 'package.json'), JSON.stringify(contents, null, 2));
+  }
+
+  function writeCoreInstrumentationFile(contents: string) {
+    writeFileSync(join(projectDir, 'instrumentation.ts'), contents);
+  }
+
+  function readCorePackageJson() {
+    return packageJsonSchema.parse(
+      JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf-8')),
+    );
+  }
+
+  it('removes instrumentation.ts and drops @vercel/otel when the user accepts (TTY)', async () => {
+    writeCorePackageJson({
+      dependencies: { next: '^15.0.0', '@vercel/otel': '^2.1.0' },
+    });
+    writeCoreInstrumentationFile('export function register() {}\n');
+
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(false);
+    expect(readCorePackageJson().dependencies).not.toHaveProperty('@vercel/otel');
+    expect(readCorePackageJson().dependencies).toMatchObject({ next: '^15.0.0' });
+  });
+
+  it('leaves the file and the dep alone when the user declines (TTY)', async () => {
+    confirmMock.mockResolvedValueOnce(false);
+
+    writeCorePackageJson({
+      dependencies: { next: '^15.0.0', '@vercel/otel': '^2.1.0' },
+    });
+    writeCoreInstrumentationFile('// customized\nexport function register() {}\n');
+
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(true);
+    expect(readCorePackageJson().dependencies).toHaveProperty('@vercel/otel', '^2.1.0');
+  });
+
+  it('skips the cleanup and never prompts in non-interactive contexts', async () => {
+    restoreTty();
+    restoreTty = withNonInteractiveTty();
+
+    writeCorePackageJson({
+      dependencies: { next: '^15.0.0', '@vercel/otel': '^2.1.0' },
+    });
+    writeCoreInstrumentationFile('// customized\nexport function register() {}\n');
+
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(true);
+    expect(readCorePackageJson().dependencies).toHaveProperty('@vercel/otel', '^2.1.0');
+  });
+
+  it('is a silent no-op when instrumentation.ts does not exist', async () => {
+    writeCorePackageJson({ dependencies: { next: '^15.0.0', '@vercel/otel': '^2.1.0' } });
+
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    expect(confirmMock).not.toHaveBeenCalled();
+    expect(readCorePackageJson().dependencies).toHaveProperty('@vercel/otel', '^2.1.0');
+  });
+
+  it('removes the instrumentation file even when no package.json is present', async () => {
+    writeCoreInstrumentationFile('export function register() {}\n');
+
+    await cleanupCloudflareIncompatibilities(projectDir);
+
+    expect(existsSync(join(projectDir, 'instrumentation.ts'))).toBe(false);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/commerce-hosting.ts b/packages/catalyst/src/cli/lib/commerce-hosting.ts
new file mode 100644
index 0000000000..1dccf714a5
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/commerce-hosting.ts
@@ -0,0 +1,457 @@
+import { confirm, input, select, Separator } from '@inquirer/prompts';
+import { colorize } from 'consola/utils';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { z } from 'zod';
+
+import { consola } from './logger';
+import {
+  createProject,
+  fetchProjects,
+  InfrastructureProjectValidationError,
+  type ProjectListItem,
+} from './project';
+import { sortPackageJsonFields } from './sort-package-json';
+
+const OPENNEXT_CLOUDFLARE_VERSION = '1.17.3';
+
+const corePackageJsonSchema = z.looseObject({
+  dependencies: z.record(z.string(), z.string()).optional(),
+});
+
+const writeJson = (path: string, value: unknown) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+};
+
+const convertProxyToMiddleware = (projectDir: string) => {
+  const proxyPath = join(projectDir, 'proxy.ts');
+  const middlewarePath = join(projectDir, 'middleware.ts');
+
+  if (!existsSync(proxyPath)) return;
+
+  const contents = readFileSync(proxyPath, 'utf-8')
+    .replace('export const proxy', 'export const middleware')
+    .replace('export const config = {', "export const config = {\n  runtime: 'experimental-edge',");
+
+  writeFileSync(middlewarePath, contents);
+  unlinkSync(proxyPath);
+};
+
+// The default `instrumentation.ts` registers `@vercel/otel`, whose node
+// build OpenNext bundles into the worker chunk; workerd then throws on cold
+// start with "Failed to prepare server". A Vercel-deploying user may have
+// customized the hook though, so we prompt before removing it (and only drop
+// `@vercel/otel` if the user agrees — their customization probably imports it).
+// In non-TTY contexts (CI deploys, scripts), skip the cleanup with a warning so
+// no customization is silently wiped. Exported because callers run this on
+// already-transformed projects too, where `setupCommerceHosting` would
+// short-circuit.
+export const cleanupCloudflareIncompatibilities = async (projectDir: string) => {
+  const instrumentationPath = join(projectDir, 'instrumentation.ts');
+
+  if (!existsSync(instrumentationPath)) return;
+
+  if (!process.stdin.isTTY) {
+    consola.warn(
+      'instrumentation.ts is present and may be incompatible with the Cloudflare Workers ' +
+        'bundle (the default @vercel/otel scaffolding throws at cold start under workerd). ' +
+        'Skipping automatic cleanup in non-interactive mode — re-run interactively to remove it, ' +
+        'or delete/gate it manually.',
+    );
+
+    return;
+  }
+
+  const shouldRemove = await confirm({
+    message:
+      'Catalyst found instrumentation.ts, which is incompatible with the Cloudflare Workers ' +
+      'bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start). ' +
+      'Remove it and drop @vercel/otel from package.json?',
+    default: true,
+  });
+
+  if (!shouldRemove) {
+    consola.info(
+      'Leaving instrumentation.ts in place. The Cloudflare worker will continue to log ' +
+        '"Failed to prepare server" at cold start until this is resolved manually.',
+    );
+
+    return;
+  }
+
+  unlinkSync(instrumentationPath);
+  consola.info('Removed instrumentation.ts (incompatible with Cloudflare Workers).');
+
+  const corePackageJsonPath = join(projectDir, 'package.json');
+
+  if (existsSync(corePackageJsonPath)) {
+    const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync(corePackageJsonPath, 'utf-8')));
+
+    if (pkg.dependencies && '@vercel/otel' in pkg.dependencies) {
+      const { '@vercel/otel': _removedVercelOtel, ...preservedDeps } = pkg.dependencies;
+
+      pkg.dependencies = preservedDeps;
+      writeJson(corePackageJsonPath, sortPackageJsonFields(pkg));
+      consola.info('Dropped @vercel/otel from package.json.');
+    }
+  }
+};
+
+export const setupCommerceHosting = async ({
+  projectDir,
+  projectUuid,
+  storeHash,
+  accessToken,
+}: {
+  projectDir: string;
+  projectUuid: string;
+  storeHash?: string;
+  accessToken?: string;
+}) => {
+  await cleanupCloudflareIncompatibilities(projectDir);
+
+  const corePackageJsonPath = join(projectDir, 'package.json');
+  const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync(corePackageJsonPath, 'utf-8')));
+
+  pkg.dependencies = {
+    ...pkg.dependencies,
+    '@opennextjs/cloudflare': OPENNEXT_CLOUDFLARE_VERSION,
+  };
+
+  writeJson(corePackageJsonPath, sortPackageJsonFields(pkg));
+
+  const projectJson: Record<string, string> = {
+    projectUuid,
+    framework: 'catalyst',
+  };
+
+  if (storeHash) projectJson.storeHash = storeHash;
+  if (accessToken) projectJson.accessToken = accessToken;
+
+  writeJson(join(projectDir, '.bigcommerce', 'project.json'), projectJson);
+
+  convertProxyToMiddleware(projectDir);
+};
+
+interface CommerceHostingApiContext {
+  storeHash: string;
+  accessToken: string;
+  apiHost: string;
+}
+
+// Thrown by `selectOrCreateInfrastructureProject` when the user declines the
+// "Would you like to create one?" prompt that surfaces when no projects exist.
+// Callers translate this into a context-appropriate error (e.g. "Cannot deploy
+// without being linked to a project").
+export class NoLinkedProjectError extends Error {
+  constructor() {
+    super('No infrastructure project linked: user declined to create one.');
+    this.name = 'NoLinkedProjectError';
+  }
+}
+
+async function promptForNewProjectName(api: CommerceHostingApiContext): Promise<ProjectListItem> {
+  const newProjectName = await input({ message: 'Enter a name for the new project:' });
+
+  const data = await createProject(newProjectName, api.storeHash, api.accessToken, api.apiHost);
+
+  consola.success(`Project "${data.name}" created successfully.`);
+
+  // Newly created — provisioning is async, hostnames not registered yet.
+  return { uuid: data.uuid, name: data.name, deployment_hostnames: [] };
+}
+
+// Generic "select an existing project, or create a new one" prompt — used by
+// `catalyst project link` and by `catalyst deploy` when its linked project is
+// missing. Distinct from `promptForCommerceHostingProject` which has
+// default-name + auto-create semantics tailored to `catalyst create`.
+//
+// Pass `linkedProjectUuid` to decorate the matching project's label with
+// `[linked]` so the user can see which one is the current selection.
+export async function selectOrCreateInfrastructureProject(
+  api: CommerceHostingApiContext,
+  linkedProjectUuid?: string,
+): Promise<ProjectListItem> {
+  consola.start('Fetching projects...');
+
+  const existingProjects = await fetchProjects(api.storeHash, api.accessToken, api.apiHost);
+
+  consola.success('Projects fetched.');
+
+  // No existing projects on the store — skip the select prompt and offer
+  // creation directly. Declining means we have nothing to link to.
+  if (existingProjects.length === 0) {
+    const shouldCreate = await confirm({
+      message:
+        'There are not any hosting projects that you can link to yet. Would you like to create one?',
+      default: true,
+    });
+
+    if (!shouldCreate) {
+      throw new NoLinkedProjectError();
+    }
+
+    return promptForNewProjectName(api);
+  }
+
+  const choices = [
+    ...existingProjects.map((p) => ({
+      name: p.uuid === linkedProjectUuid ? `${p.name} ${colorize('green', '[linked]')}` : p.name,
+      value: p.uuid,
+      description: p.uuid,
+    })),
+    {
+      name: 'Create a new project',
+      value: 'create',
+      description: 'Create a new hosting project for this Catalyst storefront.',
+    },
+  ];
+
+  const selected = await select({
+    message: 'Select a project or create a new project (Press <enter> to select).',
+    choices,
+  });
+
+  if (selected === 'create') {
+    return promptForNewProjectName(api);
+  }
+
+  const matched = existingProjects.find((p) => p.uuid === selected);
+
+  if (!matched) {
+    throw new Error(`Selected project ${String(selected)} not found in fetched list.`);
+  }
+
+  return matched;
+}
+
+export async function promptForCommerceHostingProject(
+  api: CommerceHostingApiContext,
+  defaultName: string,
+  autoUseDefaultName?: boolean,
+  useExistingOnCollision?: boolean,
+): Promise<ProjectListItem> {
+  const existingProjects = await fetchProjects(api.storeHash, api.accessToken, api.apiHost);
+  const takenNames = existingProjects.map((project) => project.name);
+
+  if (autoUseDefaultName) {
+    return autoCreateCommerceHostingProject(
+      api,
+      defaultName,
+      existingProjects,
+      useExistingOnCollision,
+    );
+  }
+
+  const conflict = existingProjects.find(
+    (project) => project.name.toLowerCase() === defaultName.toLowerCase(),
+  );
+
+  if (!conflict) {
+    return autoCreateCommerceHostingProject(
+      api,
+      defaultName,
+      existingProjects,
+      useExistingOnCollision,
+    );
+  }
+
+  type Action = 'use-named' | 'select-from-list' | 'create';
+
+  const hasOtherProjects = existingProjects.length > 1;
+
+  const choices: Array<{ name: string; value: Action }> = [
+    { name: `Use "${conflict.name}"`, value: 'use-named' },
+  ];
+
+  if (hasOtherProjects) {
+    choices.push({ name: 'Select from my projects', value: 'select-from-list' });
+  }
+
+  choices.push({ name: 'Create a new project', value: 'create' });
+
+  const action = await select<Action>({
+    message: hasOtherProjects
+      ? `It looks like you already have an existing Commerce Hosting project named "${conflict.name}". Would you like to use it, select from your projects, or create a new one?`
+      : `It looks like you already have an existing Commerce Hosting project named "${conflict.name}". Would you like to use it, or create a new one?`,
+    choices,
+  });
+
+  if (action === 'use-named') {
+    consola.success(`Using existing Commerce Hosting project "${conflict.name}"`);
+
+    return conflict;
+  }
+
+  if (action === 'create') {
+    return promptAndCreateCommerceHostingProject(api, takenNames, defaultName);
+  }
+
+  const selected = await select<ProjectListItem | 'create-new'>({
+    message: 'Which Commerce Hosting project would you like to use?',
+    choices: [
+      ...existingProjects.map((project) => ({
+        name: project.name,
+        value: project,
+        description: project.uuid,
+      })),
+      new Separator(),
+      { name: 'Create a new project', value: 'create-new' as const },
+    ],
+  });
+
+  if (selected === 'create-new') {
+    return promptAndCreateCommerceHostingProject(api, takenNames, defaultName);
+  }
+
+  consola.success(`Using existing Commerce Hosting project "${selected.name}"`);
+
+  return selected;
+}
+
+export async function promptAndCreateCommerceHostingProject(
+  api: CommerceHostingApiContext,
+  takenNames: readonly string[],
+  defaultName?: string,
+): Promise<ProjectListItem> {
+  const projectName = await input({
+    message: 'What would you like to name your Commerce Hosting project?',
+    default: defaultName,
+    validate: (value) => {
+      const trimmed = value.trim();
+
+      if (!trimmed) return 'Project name is required';
+
+      const conflict = takenNames.find((taken) => taken.toLowerCase() === trimmed.toLowerCase());
+
+      if (conflict) {
+        return `A Commerce Hosting project named "${conflict}" already exists`;
+      }
+
+      return true;
+    },
+    theme: {
+      style: {
+        help: () =>
+          colorize(
+            'dim',
+            '(The project that hosts your storefront on Commerce — often matches your folder name.)',
+          ),
+      },
+    },
+  });
+
+  try {
+    const created = await createProject(
+      projectName.trim(),
+      api.storeHash,
+      api.accessToken,
+      api.apiHost,
+    );
+
+    consola.success(`Commerce Hosting project "${created.name}" created successfully`);
+
+    return { uuid: created.uuid, name: created.name, deployment_hostnames: [] };
+  } catch (error) {
+    if (error instanceof InfrastructureProjectValidationError) {
+      consola.error(error.message);
+
+      return promptAndCreateCommerceHostingProject(api, takenNames, defaultName);
+    }
+
+    throw error;
+  }
+}
+
+async function resolveCollisionChoice(
+  existingName: string,
+  useExistingOnCollision: boolean | undefined,
+): Promise<boolean> {
+  if (useExistingOnCollision === true) return true;
+
+  if (!process.stdin.isTTY) return false;
+
+  return select<boolean>({
+    message: `A Commerce Hosting project named "${existingName}" already exists. Use the existing project?`,
+    choices: [
+      { name: 'Yes', value: true },
+      { name: 'No', value: false },
+    ],
+  });
+}
+
+async function autoCreateCommerceHostingProject(
+  api: CommerceHostingApiContext,
+  name: string,
+  existingProjects: readonly ProjectListItem[],
+  useExistingOnCollision?: boolean,
+): Promise<ProjectListItem> {
+  const existing = existingProjects.find(
+    (project) => project.name.toLowerCase() === name.toLowerCase(),
+  );
+
+  if (existing) {
+    const shouldUseExisting = await resolveCollisionChoice(existing.name, useExistingOnCollision);
+
+    if (shouldUseExisting) {
+      consola.success(`Using existing Commerce Hosting project "${existing.name}"`);
+
+      return existing;
+    }
+
+    consola.error(
+      'Not reusing the existing project. Re-run with a different --project-name, or pass --use-existing to reuse it.',
+    );
+    process.exit(1);
+  }
+
+  try {
+    const created = await createProject(name, api.storeHash, api.accessToken, api.apiHost);
+
+    consola.success(`Commerce Hosting project "${created.name}" created successfully`);
+
+    return { uuid: created.uuid, name: created.name, deployment_hostnames: [] };
+  } catch (error) {
+    if (error instanceof InfrastructureProjectValidationError) {
+      consola.error(
+        `Failed to create Commerce Hosting project "${name}": ${error.message}\nRe-run with a different --project-name.`,
+      );
+      process.exit(1);
+    }
+
+    throw error;
+  }
+}
+
+// Orchestrates prompt + file mutations. Callable from `catalyst create --hosting commerce`
+// (eager) and `catalyst deploy` (lazy). Idempotent — safe to re-run.
+export async function runCommerceHostingSetup({
+  api,
+  projectDir,
+  defaultProjectName,
+  autoUseProjectName,
+  useExistingOnCollision,
+}: {
+  api: CommerceHostingApiContext;
+  projectDir: string;
+  defaultProjectName: string;
+  autoUseProjectName?: boolean;
+  useExistingOnCollision?: boolean;
+}): Promise<ProjectListItem> {
+  const project = await promptForCommerceHostingProject(
+    api,
+    defaultProjectName,
+    autoUseProjectName,
+    useExistingOnCollision,
+  );
+
+  await setupCommerceHosting({
+    projectDir,
+    projectUuid: project.uuid,
+    storeHash: api.storeHash,
+    accessToken: api.accessToken,
+  });
+
+  return project;
+}
diff --git a/packages/catalyst/src/cli/lib/create-channel-flow.spec.ts b/packages/catalyst/src/cli/lib/create-channel-flow.spec.ts
new file mode 100644
index 0000000000..588b35fba4
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/create-channel-flow.spec.ts
@@ -0,0 +1,137 @@
+import { checkbox, input, select } from '@inquirer/prompts';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+import { createChannel } from './channels';
+import { getChannelNameError, runCreateChannelFlow } from './create-channel-flow';
+import { UserActionableError } from './errors';
+import { getAvailableLocales } from './localization';
+
+vi.mock('@inquirer/prompts', () => ({
+  input: vi.fn(),
+  select: vi.fn(),
+  checkbox: vi.fn(),
+}));
+
+vi.mock('./channels', () => ({
+  createChannel: vi.fn(),
+}));
+
+vi.mock('./localization', () => ({
+  getAvailableLocales: vi.fn(),
+}));
+
+const mockInput = vi.mocked(input);
+const mockSelect = vi.mocked(select);
+const mockCheckbox = vi.mocked(checkbox);
+const mockCreateChannel = vi.mocked(createChannel);
+const mockGetAvailableLocales = vi.mocked(getAvailableLocales);
+
+const baseOptions = {
+  storeHash: 'test-store',
+  accessToken: 'test-token',
+  apiHost: 'api.bigcommerce.com',
+  cliApiOrigin: 'https://cxm-prd.bigcommerceapp.com',
+};
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('getChannelNameError', () => {
+  test.each([
+    ['My Store', 'a plain name'],
+    ['My-Store_2', 'hyphens and underscores'],
+    ['Café Münchën', 'accented / non-ASCII letters'],
+    ['   Padded   ', 'surrounding whitespace'],
+  ])('accepts %j (%s)', (name) => {
+    expect(getChannelNameError(name)).toBeUndefined();
+  });
+
+  test.each([
+    ["Bob's Store", 'an apostrophe'],
+    ['Store & Co', 'an ampersand'],
+    ['Store #1', 'a hash'],
+    ['Store (US)', 'parentheses'],
+  ])('rejects %j (%s) with an actionable message', (name) => {
+    const error = getChannelNameError(name);
+
+    expect(error).toContain(name);
+    expect(error).toContain('not a valid channel name');
+    expect(error).toContain('letters, numbers, spaces, hyphens (-), and underscores (_)');
+  });
+
+  test.each([
+    ['', 'an empty string'],
+    ['   ', 'only whitespace'],
+  ])('rejects %j (%s) as empty', (name) => {
+    expect(getChannelNameError(name)).toBe('Channel name cannot be empty.');
+  });
+});
+
+describe('runCreateChannelFlow', () => {
+  test('throws UserActionableError for an invalid --name before calling the API', async () => {
+    await expect(runCreateChannelFlow({ ...baseOptions, name: "Bob's Store" })).rejects.toThrow(
+      UserActionableError,
+    );
+
+    await expect(runCreateChannelFlow({ ...baseOptions, name: "Bob's Store" })).rejects.toThrow(
+      /not a valid channel name/,
+    );
+
+    expect(mockCreateChannel).not.toHaveBeenCalled();
+    expect(mockInput).not.toHaveBeenCalled();
+  });
+
+  test('validates the interactive name prompt with getChannelNameError', async () => {
+    mockInput.mockResolvedValue('My Store');
+    mockSelect
+      .mockResolvedValueOnce('en') // default locale
+      .mockResolvedValueOnce(false) // add additional languages?
+      .mockResolvedValueOnce(false); // install sample data?
+    mockGetAvailableLocales.mockResolvedValue([{ name: 'English', value: 'en' }]);
+    mockCreateChannel.mockResolvedValue({
+      channelId: 42,
+      storefrontToken: 'token',
+      envVars: {},
+    });
+
+    await runCreateChannelFlow(baseOptions);
+
+    const validate = mockInput.mock.calls[0]?.[0]?.validate;
+
+    expect(validate).toBeTypeOf('function');
+    expect(validate?.("Bob's Store")).toBe(
+      '"Bob\'s Store" is not a valid channel name. Channel names may contain only letters, numbers, spaces, hyphens (-), and underscores (_).',
+    );
+    expect(validate?.('My Store')).toBe(true);
+  });
+
+  test('passes a valid --name straight through to createChannel', async () => {
+    mockCreateChannel.mockResolvedValue({
+      channelId: 42,
+      storefrontToken: 'token',
+      envVars: {},
+    });
+
+    await runCreateChannelFlow({
+      ...baseOptions,
+      name: 'My Store',
+      locale: 'en',
+      additionalLocales: [],
+      sampleData: false,
+    });
+
+    expect(mockInput).not.toHaveBeenCalled();
+    expect(mockSelect).not.toHaveBeenCalled();
+    expect(mockCheckbox).not.toHaveBeenCalled();
+    expect(mockCreateChannel).toHaveBeenCalledWith(
+      'My Store',
+      'en',
+      [],
+      false,
+      baseOptions.storeHash,
+      baseOptions.accessToken,
+      baseOptions.cliApiOrigin,
+    );
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/create-channel-flow.ts b/packages/catalyst/src/cli/lib/create-channel-flow.ts
new file mode 100644
index 0000000000..e247422072
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/create-channel-flow.ts
@@ -0,0 +1,138 @@
+import { checkbox, input, select } from '@inquirer/prompts';
+import { colorize } from 'consola/utils';
+
+import { createChannel, type CreatedChannel } from './channels';
+import { UserActionableError } from './errors';
+import { getAvailableLocales } from './localization';
+
+// Human-readable summary of the allowed characters, reused in the prompt
+// validation and the flag-path error so both surface the same guidance.
+const ALLOWED_CHANNEL_NAME_CHARS = 'letters, numbers, spaces, hyphens (-), and underscores (_)';
+
+// The Catalyst channels API rejects names containing other punctuation (e.g. an
+// apostrophe in "Bob's Store") with an opaque server error. Validate up front so
+// the user gets an immediate, actionable message instead. Letters/numbers are
+// matched with Unicode classes so non-ASCII names (accents, other scripts) pass.
+const CHANNEL_NAME_PATTERN = /^[\p{L}\p{N} _-]+$/u;
+
+// Returns an error message when `name` is not a valid channel name, or
+// `undefined` when it is. Shared by the interactive prompt and the `--name` flag.
+export function getChannelNameError(name: string): string | undefined {
+  if (name.trim().length === 0) {
+    return 'Channel name cannot be empty.';
+  }
+
+  if (!CHANNEL_NAME_PATTERN.test(name)) {
+    return `"${name}" is not a valid channel name. Channel names may contain only ${ALLOWED_CHANNEL_NAME_CHARS}.`;
+  }
+
+  return undefined;
+}
+
+export interface CreateChannelFlowOptions {
+  storeHash: string;
+  accessToken: string;
+  apiHost: string;
+  cliApiOrigin: string;
+  // Non-interactive overrides. When a value is supplied the corresponding
+  // prompt is skipped, so a fully-flagged invocation runs headless.
+  name?: string;
+  locale?: string;
+  additionalLocales?: string[];
+  sampleData?: boolean;
+}
+
+// Shared channel-creation flow used by both `catalyst create` (while scaffolding)
+// and `catalyst channel create` (on an existing project). Prompts for anything
+// not provided as a flag, then POSTs to create the Catalyst channel.
+export async function runCreateChannelFlow(
+  options: CreateChannelFlowOptions,
+): Promise<CreatedChannel> {
+  const { storeHash, accessToken, apiHost, cliApiOrigin } = options;
+
+  // A `--name` flag skips the prompt (and its validation), so check it here to
+  // fail fast with the same clear message rather than an opaque API rejection.
+  if (options.name !== undefined) {
+    const nameError = getChannelNameError(options.name);
+
+    if (nameError) {
+      throw new UserActionableError(nameError);
+    }
+  }
+
+  const name =
+    options.name ??
+    (await input({
+      message: 'What would you like to name your new channel?',
+      validate: (value) => getChannelNameError(value) ?? true,
+    }));
+
+  // The locale list backs both the default-locale and additional-locales
+  // prompts. Fetch it lazily and once — a fully-flagged run skips the call.
+  let availableLocales: Awaited<ReturnType<typeof getAvailableLocales>> | undefined;
+  const loadLocales = async () => {
+    availableLocales ??= await getAvailableLocales(storeHash, accessToken, apiHost);
+
+    return availableLocales;
+  };
+
+  const storefrontLocale =
+    options.locale ??
+    (await select({
+      message: 'Which default language would you like to set for your channel?',
+      default: 'en',
+      choices: await loadLocales(),
+      theme: {
+        style: {
+          help: () => colorize('dim', '(Select locale from the list or start typing the name)'),
+        },
+      },
+    }));
+
+  let additionalLocales = options.additionalLocales;
+
+  if (additionalLocales === undefined) {
+    const shouldAddAdditionalLocales = await select({
+      message: 'Would you like to add additional languages?',
+      choices: [
+        { name: 'Yes', value: true },
+        { name: 'No', value: false },
+      ],
+    });
+
+    additionalLocales = [];
+
+    if (shouldAddAdditionalLocales) {
+      const localeChoices = (await loadLocales())
+        .filter(({ value }) => value !== storefrontLocale)
+        .map(({ name: localeName, value }) => ({ name: localeName, value, description: value }));
+
+      additionalLocales = await checkbox({
+        message: 'Which additional languages would you like to add to your channel?',
+        choices: localeChoices,
+        validate: (items) =>
+          items.length <= 4 || 'You can only select up to 4 additional languages.',
+      });
+    }
+  }
+
+  const shouldInstallSampleData =
+    options.sampleData ??
+    (await select({
+      message: 'Would you like to install sample data?',
+      choices: [
+        { name: 'Yes', value: true },
+        { name: 'No', value: false },
+      ],
+    }));
+
+  return createChannel(
+    name,
+    storefrontLocale,
+    additionalLocales,
+    shouldInstallSampleData,
+    storeHash,
+    accessToken,
+    cliApiOrigin,
+  );
+}
diff --git a/packages/catalyst/src/cli/lib/deployment-errors.spec.ts b/packages/catalyst/src/cli/lib/deployment-errors.spec.ts
new file mode 100644
index 0000000000..654e4c8876
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/deployment-errors.spec.ts
@@ -0,0 +1,50 @@
+import { describe, expect, test } from 'vitest';
+
+import { getDeploymentErrorMessage } from './deployment-errors';
+
+describe('getDeploymentErrorMessage', () => {
+  test('code 10 — internal error', () => {
+    expect(getDeploymentErrorMessage(10)).toBe(
+      'Something went wrong on our end. Please try again. If the issue persists, contact support.',
+    );
+  });
+
+  test('code 20 — bundle retrieval failure', () => {
+    expect(getDeploymentErrorMessage(20)).toBe(
+      "We couldn't retrieve your bundle. This is usually a temporary issue — please try deploying again. If the problem continues, contact support.",
+    );
+  });
+
+  test('code 30 — bundle extraction failure', () => {
+    expect(getDeploymentErrorMessage(30)).toBe(
+      'Your bundle could not be extracted. This may mean your build output is too large (max 64 MB compressed / 512 MB uncompressed) or the archive is corrupted. Try reducing your build size or rebuilding your project and deploying again.',
+    );
+  });
+
+  test('code 40 — build output validation failure', () => {
+    const message = getDeploymentErrorMessage(40);
+
+    expect(message).toContain("There's a problem with your build output.");
+    expect(message).toContain('A worker.js file larger than 40 MB');
+    expect(message).toContain('An individual asset file larger than 25 MB');
+    expect(message).toContain('More than 1,000 total files in the bundle');
+  });
+
+  test('code 50 — deployment failure', () => {
+    expect(getDeploymentErrorMessage(50)).toBe(
+      'Deployment failed. This is usually a temporary issue — please try again. If the problem persists, contact support.',
+    );
+  });
+
+  test('code 60 — deployment URL resolution failure', () => {
+    expect(getDeploymentErrorMessage(60)).toBe(
+      "Your code was deployed, but we couldn't determine your deployment URL. Please try deploying again. If the issue persists, contact support.",
+    );
+  });
+
+  test('unknown code — fallback message', () => {
+    expect(getDeploymentErrorMessage(99)).toBe(
+      'Deployment failed with an unexpected error (code: 99). Please try again. If the issue persists, contact support.',
+    );
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/deployment-errors.ts b/packages/catalyst/src/cli/lib/deployment-errors.ts
new file mode 100644
index 0000000000..29e0f67243
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/deployment-errors.ts
@@ -0,0 +1,18 @@
+const ERROR_MESSAGES: Record<number, string> = {
+  10: 'Something went wrong on our end. Please try again. If the issue persists, contact support.',
+  20: "We couldn't retrieve your bundle. This is usually a temporary issue — please try deploying again. If the problem continues, contact support.",
+  30: 'Your bundle could not be extracted. This may mean your build output is too large (max 64 MB compressed / 512 MB uncompressed) or the archive is corrupted. Try reducing your build size or rebuilding your project and deploying again.',
+  40: `There's a problem with your build output. This could be caused by:
+- A worker.js file larger than 40 MB
+- An individual asset file larger than 25 MB
+- More than 1,000 total files in the bundle`,
+  50: 'Deployment failed. This is usually a temporary issue — please try again. If the problem persists, contact support.',
+  60: "Your code was deployed, but we couldn't determine your deployment URL. Please try deploying again. If the issue persists, contact support.",
+};
+
+export function getDeploymentErrorMessage(code: number): string {
+  return (
+    ERROR_MESSAGES[code] ??
+    `Deployment failed with an unexpected error (code: ${code}). Please try again. If the issue persists, contact support.`
+  );
+}
diff --git a/packages/catalyst/src/cli/lib/detect-package-manager.spec.ts b/packages/catalyst/src/cli/lib/detect-package-manager.spec.ts
new file mode 100644
index 0000000000..79e839e74f
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/detect-package-manager.spec.ts
@@ -0,0 +1,68 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { detectPackageManager as detectFromDir } from 'nypm';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { detectProjectPackageManager } from './detect-package-manager';
+
+// nypm's own fallback sniffs process.argv[1] for a package manager's name, which
+// spuriously matches 'pnpm' in this pnpm-managed monorepo (test runner path
+// contains `.pnpm`). Spy on it so the "nothing detectable" case below tests our
+// fallback instead of that environment artifact.
+vi.mock('nypm', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('nypm')>();
+
+  return { ...actual, detectPackageManager: vi.fn(actual.detectPackageManager) };
+});
+
+let projectDir: string;
+
+beforeEach(() => {
+  projectDir = mkdtempSync(join(tmpdir(), 'catalyst-detect-pm-'));
+});
+
+afterEach(() => {
+  rmSync(projectDir, { recursive: true, force: true });
+});
+
+describe('detectProjectPackageManager', () => {
+  it('detects pnpm from a pnpm-lock.yaml', async () => {
+    writeFileSync(join(projectDir, 'pnpm-lock.yaml'), '');
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('pnpm');
+  });
+
+  it('detects npm from a package-lock.json', async () => {
+    writeFileSync(join(projectDir, 'package-lock.json'), '{}');
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('npm');
+  });
+
+  it('detects yarn from a yarn.lock', async () => {
+    writeFileSync(join(projectDir, 'yarn.lock'), '');
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('yarn');
+  });
+
+  it('detects bun from a bun.lock', async () => {
+    writeFileSync(join(projectDir, 'bun.lock'), '');
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('bun');
+  });
+
+  it('honors the package.json packageManager field', async () => {
+    writeFileSync(
+      join(projectDir, 'package.json'),
+      JSON.stringify({ packageManager: 'yarn@4.0.0' }),
+    );
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('yarn');
+  });
+
+  it('falls back to npm when nothing is detectable', async () => {
+    vi.mocked(detectFromDir).mockResolvedValueOnce(undefined);
+
+    await expect(detectProjectPackageManager(projectDir)).resolves.toBe('npm');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/detect-package-manager.ts b/packages/catalyst/src/cli/lib/detect-package-manager.ts
new file mode 100644
index 0000000000..6e4e681dda
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/detect-package-manager.ts
@@ -0,0 +1,42 @@
+import { detectPackageManager as detectFromDir } from 'nypm';
+
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun';
+
+// Detect the package manager that INVOKED the CLI (via npx / pnpm dlx / yarn dlx
+// / bunx) by parsing the leading token of npm_config_user_agent, which every
+// manager sets when it spawns a child process. This is deliberately not
+// nypm.detectPackageManager(cwd): that keys off a lockfile in the project, which
+// a freshly extracted project does not have yet.
+export const detectPackageManager = (): PackageManager => {
+  const userAgent = process.env.npm_config_user_agent ?? '';
+  const name = userAgent.split(' ')[0]?.split('/')[0];
+
+  if (name === 'pnpm' || name === 'yarn' || name === 'bun') {
+    return name;
+  }
+
+  // Some bunx versions omit npm_config_user_agent; fall back to the bun runtime marker.
+  if (process.versions.bun) {
+    return 'bun';
+  }
+
+  return 'npm';
+};
+
+// Detect the package manager an EXISTING project uses, from its lockfile or the
+// package.json `packageManager` field. Used by flows that run inside an
+// already-scaffolded project (e.g. `project link`), where a lockfile exists —
+// unlike detectPackageManager(), which infers the INVOKING manager for a freshly
+// extracted project that has no lockfile yet. Falls back to npm, since most
+// users will have it installed, when detection is inconclusive or returns a
+// manager we don't support.
+export const detectProjectPackageManager = async (projectDir: string): Promise<PackageManager> => {
+  const detected = await detectFromDir(projectDir);
+  const name = detected?.name;
+
+  if (name === 'pnpm' || name === 'yarn' || name === 'bun' || name === 'npm') {
+    return name;
+  }
+
+  return 'npm';
+};
diff --git a/packages/catalyst/src/cli/lib/domains.ts b/packages/catalyst/src/cli/lib/domains.ts
new file mode 100644
index 0000000000..3dcf1b899f
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/domains.ts
@@ -0,0 +1,333 @@
+/* eslint-disable max-classes-per-file -- the two domain-collision error types are co-located with the response parsing that throws them */
+import { z } from 'zod';
+
+import { assertAuthorized } from './auth-errors';
+import { UserActionableError } from './errors';
+import { formatV3Error } from './observability';
+import { getTelemetry } from './telemetry';
+
+export const domainStatusSchema = z.enum(['pending', 'verified', 'failed', 'unknown']);
+
+export type DomainStatus = z.infer<typeof domainStatusSchema>;
+
+const domainSchema = z.object({
+  domain: z.string(),
+  project_uuid: z.string(),
+  verification_status: domainStatusSchema,
+});
+
+const ownershipVerificationSchema = z.object({
+  type: z.string(),
+  name: z.string(),
+  value: z.string().optional(),
+});
+
+export type OwnershipVerification = z.infer<typeof ownershipVerificationSchema>;
+
+const ownershipVerificationMetaSchema = z.object({
+  meta: z.object({
+    ownership_verification: ownershipVerificationSchema,
+  }),
+});
+
+// Raised when the Domains API rejects an add/claim because ownership of a
+// domain bound to another store has not been verified. Carries the TXT record
+// the caller must publish so the command can render actionable next steps
+// instead of an opaque error.
+export class DomainOwnershipVerificationError extends UserActionableError {
+  readonly ownershipVerification: OwnershipVerification;
+
+  constructor(message: string, ownershipVerification: OwnershipVerification) {
+    super(message);
+    this.name = 'DomainOwnershipVerificationError';
+    this.ownershipVerification = ownershipVerification;
+  }
+}
+
+function parseOwnershipVerification(body: unknown): OwnershipVerification | undefined {
+  const parsed = ownershipVerificationMetaSchema.safeParse(body);
+
+  return parsed.success ? parsed.data.meta.ownership_verification : undefined;
+}
+
+const boundProjectMetaSchema = z.object({
+  meta: z.object({
+    project_uuid: z.string(),
+  }),
+});
+
+// Raised when the Domains API rejects an add/claim because the domain is
+// already bound to a different project in the *same* store. Carries the UUID of
+// that project so the caller can point the user at `domains transfer`.
+export class DomainBoundToProjectError extends UserActionableError {
+  readonly projectUuid: string;
+
+  constructor(message: string, projectUuid: string) {
+    super(message);
+    this.name = 'DomainBoundToProjectError';
+    this.projectUuid = projectUuid;
+  }
+}
+
+function parseBoundProjectUuid(body: unknown): string | undefined {
+  const parsed = boundProjectMetaSchema.safeParse(body);
+
+  return parsed.success ? parsed.data.meta.project_uuid : undefined;
+}
+
+const domainResponseSchema = z.object({
+  data: domainSchema,
+});
+
+const domainListResponseSchema = z.object({
+  data: z.array(domainSchema),
+});
+
+export type Domain = z.infer<typeof domainSchema>;
+export type DomainStatusFilter = Exclude<DomainStatus, 'unknown'>;
+
+interface ListDomainsFilters {
+  domains?: string[];
+  verificationStatus?: DomainStatusFilter;
+}
+
+const DOMAINS_API_NOT_ENABLED =
+  'Infrastructure Domains API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.';
+
+function domainsUrl(storeHash: string, projectUuid: string, apiHost: string) {
+  return `https://${apiHost}/stores/${storeHash}/v3/infrastructure/projects/${projectUuid}/domains`;
+}
+
+function domainUrl(storeHash: string, projectUuid: string, domain: string, apiHost: string) {
+  return `${domainsUrl(storeHash, projectUuid, apiHost)}/${encodeURIComponent(domain)}`;
+}
+
+function domainClaimUrl(storeHash: string, projectUuid: string, domain: string, apiHost: string) {
+  return `${domainUrl(storeHash, projectUuid, domain, apiHost)}/claim`;
+}
+
+function domainTransferUrl(
+  storeHash: string,
+  projectUuid: string,
+  domain: string,
+  apiHost: string,
+) {
+  return `${domainUrl(storeHash, projectUuid, domain, apiHost)}/transfer`;
+}
+
+function authHeaders(accessToken: string) {
+  return {
+    Accept: 'application/json',
+    'X-Auth-Token': accessToken,
+    'X-Correlation-Id': getTelemetry().correlationId,
+  };
+}
+
+function formatResponseStatus(response: Response, message?: string): string {
+  return [response.status, response.statusText || message].filter(Boolean).join(' ');
+}
+
+function buildErrorMessage(response: Response, body: unknown, action: string): string {
+  const message = formatV3Error(body);
+
+  if (response.status >= 500) {
+    const status = formatResponseStatus(response, message);
+
+    return `${action}: ${status}. This is a server-side response from the Domains API.`;
+  }
+
+  return message ?? `${action}: ${response.statusText}`;
+}
+
+// Throws for any non-OK Domains API response. Surfaces typed errors for the two
+// claimable/movable conflicts so callers can guide the user: a
+// `meta.ownership_verification` TXT record (domain on another store → claim) or
+// a `meta.project_uuid` (domain on another project in this store → transfer).
+// Otherwise throws a plain formatted error.
+async function assertDomainResponse(response: Response, action: string): Promise<void> {
+  assertAuthorized(response);
+
+  if (response.status === 403) {
+    throw new UserActionableError(DOMAINS_API_NOT_ENABLED);
+  }
+
+  if (response.ok) {
+    return;
+  }
+
+  const body: unknown = await response.json().catch(() => null);
+  const message = buildErrorMessage(response, body, action);
+  const ownershipVerification = parseOwnershipVerification(body);
+
+  if (ownershipVerification) {
+    throw new DomainOwnershipVerificationError(message, ownershipVerification);
+  }
+
+  const boundProjectUuid = parseBoundProjectUuid(body);
+
+  if (boundProjectUuid) {
+    throw new DomainBoundToProjectError(message, boundProjectUuid);
+  }
+
+  // 5xx responses are server-side failures worth escalating, so keep the
+  // Correlation ID + support framing. A 4xx (validation, not-found, conflict)
+  // is a clear, user-actionable response — surface just the message.
+  if (response.status >= 500) {
+    throw new Error(message);
+  }
+
+  throw new UserActionableError(message);
+}
+
+export async function createDomain(
+  domain: string,
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<Domain> {
+  const response = await fetch(domainsUrl(storeHash, projectUuid, apiHost), {
+    method: 'POST',
+    headers: {
+      ...authHeaders(accessToken),
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ domain }),
+  });
+
+  await assertDomainResponse(response, 'Failed to add domain');
+
+  const result: unknown = await response.json();
+
+  return domainResponseSchema.parse(result).data;
+}
+
+export async function getDomain(
+  domain: string,
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<Domain> {
+  const response = await fetch(domainUrl(storeHash, projectUuid, domain, apiHost), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  await assertDomainResponse(response, 'Failed to fetch domain');
+
+  const result: unknown = await response.json();
+
+  return domainResponseSchema.parse(result).data;
+}
+
+// Like `getDomain`, but returns null when the domain isn't present on the
+// given project (404) instead of throwing. Used by `transfer` to confirm the
+// source project actually owns the domain before attempting the move, so the
+// user gets clear guidance instead of the API's opaque ownership rejection.
+export async function findDomain(
+  domain: string,
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<Domain | null> {
+  const response = await fetch(domainUrl(storeHash, projectUuid, domain, apiHost), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  if (response.status === 404) {
+    return null;
+  }
+
+  await assertDomainResponse(response, 'Failed to fetch domain');
+
+  const result: unknown = await response.json();
+
+  return domainResponseSchema.parse(result).data;
+}
+
+export async function listDomains(
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+  filters: ListDomainsFilters = {},
+): Promise<Domain[]> {
+  const search = new URLSearchParams();
+
+  if (filters.domains && filters.domains.length > 0) {
+    search.set('domain:in', filters.domains.join(','));
+  }
+
+  if (filters.verificationStatus) {
+    search.set('verification_status', filters.verificationStatus);
+  }
+
+  const query = search.toString();
+  const url = `${domainsUrl(storeHash, projectUuid, apiHost)}${query ? `?${query}` : ''}`;
+  const response = await fetch(url, {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  await assertDomainResponse(response, 'Failed to fetch domains');
+
+  const result: unknown = await response.json();
+
+  return domainListResponseSchema.parse(result).data;
+}
+
+export async function deleteDomain(
+  domain: string,
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<void> {
+  const response = await fetch(domainUrl(storeHash, projectUuid, domain, apiHost), {
+    method: 'DELETE',
+    headers: authHeaders(accessToken),
+  });
+
+  await assertDomainResponse(response, `Failed to remove domain: ${response.statusText}`);
+}
+
+export async function claimDomain(
+  domain: string,
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<void> {
+  const response = await fetch(domainClaimUrl(storeHash, projectUuid, domain, apiHost), {
+    method: 'POST',
+    headers: authHeaders(accessToken),
+  });
+
+  await assertDomainResponse(response, 'Failed to claim domain');
+}
+
+// Moves a domain from its current project (`projectUuid`, the source) to
+// `newProjectUuid` (the destination) within the same store. The API rejects a
+// transfer where the destination equals the source.
+export async function transferDomain(
+  domain: string,
+  projectUuid: string,
+  newProjectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<void> {
+  const response = await fetch(domainTransferUrl(storeHash, projectUuid, domain, apiHost), {
+    method: 'POST',
+    headers: {
+      ...authHeaders(accessToken),
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ new_project_uuid: newProjectUuid }),
+  });
+
+  await assertDomainResponse(response, 'Failed to transfer domain');
+}
diff --git a/packages/catalyst/src/cli/lib/env-config.spec.ts b/packages/catalyst/src/cli/lib/env-config.spec.ts
new file mode 100644
index 0000000000..a41680e956
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/env-config.spec.ts
@@ -0,0 +1,70 @@
+import { describe, expect, test } from 'vitest';
+
+import { mergeDeploymentSecrets, parseEnvAssignment, toDeploymentSecrets } from './env-config';
+
+describe('parseEnvAssignment', () => {
+  test('parses a basic KEY=VALUE assignment', () => {
+    expect(parseEnvAssignment('FOO=bar')).toEqual({ key: 'FOO', value: 'bar' });
+  });
+
+  test('splits on the first = so values containing = survive', () => {
+    expect(parseEnvAssignment('TOKEN=abc=def==')).toEqual({ key: 'TOKEN', value: 'abc=def==' });
+  });
+
+  test('trims surrounding whitespace', () => {
+    expect(parseEnvAssignment('  FOO = bar ')).toEqual({ key: 'FOO', value: 'bar' });
+  });
+
+  test('throws when there is no =', () => {
+    expect(() => parseEnvAssignment('FOO')).toThrow(
+      'Invalid env var format: FOO. Expected format: KEY=VALUE',
+    );
+  });
+
+  test('throws when the value is empty', () => {
+    expect(() => parseEnvAssignment('FOO=')).toThrow(
+      'Invalid env var format: FOO=. Expected format: KEY=VALUE',
+    );
+  });
+
+  test('throws when the key is not a valid env var name', () => {
+    expect(() => parseEnvAssignment('1FOO=bar')).toThrow('Invalid env var name: 1FOO');
+    expect(() => parseEnvAssignment('FOO-BAR=baz')).toThrow('Invalid env var name: FOO-BAR');
+  });
+});
+
+describe('toDeploymentSecrets', () => {
+  test('maps an env map into secret payload entries', () => {
+    expect(toDeploymentSecrets({ FOO: 'bar', BAZ: 'qux' })).toEqual([
+      { type: 'secret', key: 'FOO', value: 'bar' },
+      { type: 'secret', key: 'BAZ', value: 'qux' },
+    ]);
+  });
+
+  test('returns an empty array for an empty map', () => {
+    expect(toDeploymentSecrets({})).toEqual([]);
+  });
+});
+
+describe('mergeDeploymentSecrets', () => {
+  test('merges both sets with flag secrets overriding persisted on conflict', () => {
+    const persisted = toDeploymentSecrets({ PERSISTED_ONLY: 'keep', SHARED: 'stored' });
+    const flagSecrets = toDeploymentSecrets({ SHARED: 'override', FLAG_ONLY: 'flag' });
+
+    const merged = mergeDeploymentSecrets(persisted, flagSecrets);
+
+    expect(merged).toEqual([
+      { type: 'secret', key: 'PERSISTED_ONLY', value: 'keep' },
+      { type: 'secret', key: 'SHARED', value: 'override' },
+      { type: 'secret', key: 'FLAG_ONLY', value: 'flag' },
+    ]);
+  });
+
+  test('returns persisted secrets when there are no flag secrets', () => {
+    const persisted = toDeploymentSecrets({ FOO: 'bar' });
+
+    expect(mergeDeploymentSecrets(persisted, [])).toEqual([
+      { type: 'secret', key: 'FOO', value: 'bar' },
+    ]);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/env-config.ts b/packages/catalyst/src/cli/lib/env-config.ts
new file mode 100644
index 0000000000..62f5cd53bd
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/env-config.ts
@@ -0,0 +1,66 @@
+import type Conf from 'conf';
+
+import { ProjectConfigSchema } from './project-config';
+
+// A single deployment environment variable as the infrastructure API expects
+// it. We only persist/send `secret` vars today (see ProjectConfigSchema.env).
+export interface DeploymentSecret {
+  type: 'secret';
+  key: string;
+  value: string;
+}
+
+// Matches POSIX-ish env var names: leading letter/underscore, then
+// letters/digits/underscores. Keeps the stored config (and the deployment
+// payload) free of keys that wouldn't be valid env vars at runtime.
+const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+// Parse a single `KEY=VALUE` assignment. Splits on the *first* `=` only, so
+// values containing `=` (e.g. base64 or tokens) survive intact. Validates the
+// key shape and rejects empty values.
+export const parseEnvAssignment = (input: string): { key: string; value: string } => {
+  const separatorIndex = input.indexOf('=');
+
+  if (separatorIndex === -1) {
+    throw new Error(`Invalid env var format: ${input}. Expected format: KEY=VALUE`);
+  }
+
+  const key = input.slice(0, separatorIndex).trim();
+  const value = input.slice(separatorIndex + 1).trim();
+
+  if (!key || !value) {
+    throw new Error(`Invalid env var format: ${input}. Expected format: KEY=VALUE`);
+  }
+
+  if (!ENV_KEY_PATTERN.test(key)) {
+    throw new Error(
+      `Invalid env var name: ${key}. Names must start with a letter or underscore and contain only letters, numbers, and underscores.`,
+    );
+  }
+
+  return { key, value };
+};
+
+// Read the persisted env var map (KEY -> VALUE), defaulting to empty.
+export const getStoredEnv = (config: Conf<ProjectConfigSchema>): Record<string, string> => {
+  return config.get('env') ?? {};
+};
+
+// Convert a persisted env var map into the deployment `secret` payload shape.
+export const toDeploymentSecrets = (envVars: Record<string, string>): DeploymentSecret[] => {
+  return Object.entries(envVars).map(([key, value]) => ({ type: 'secret', key, value }));
+};
+
+// Merge persisted secrets with inline `--secret` flag secrets, keyed by name.
+// Inline flags win on conflict so users can override a stored value per-run.
+export const mergeDeploymentSecrets = (
+  persisted: DeploymentSecret[],
+  flagSecrets: DeploymentSecret[],
+): DeploymentSecret[] => {
+  const byKey = new Map<string, DeploymentSecret>();
+
+  persisted.forEach((secret) => byKey.set(secret.key, secret));
+  flagSecrets.forEach((secret) => byKey.set(secret.key, secret));
+
+  return Array.from(byKey.values());
+};
diff --git a/packages/catalyst/src/cli/lib/errors.ts b/packages/catalyst/src/cli/lib/errors.ts
new file mode 100644
index 0000000000..1f04776668
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/errors.ts
@@ -0,0 +1,12 @@
+// Base class for errors that are the user's to fix and whose message already
+// says everything they need (bad input, a naming/ownership conflict, invalid
+// credentials, a feature that isn't enabled). The top-level handler in
+// `index.ts` prints these plainly and exits non-zero WITHOUT the "share your
+// Correlation ID with BigCommerce support" bug-report framing that unexpected
+// and server-side errors get — a clear 4xx response is not a bug to report.
+export class UserActionableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'UserActionableError';
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/extract-catalyst.ts b/packages/catalyst/src/cli/lib/extract-catalyst.ts
new file mode 100644
index 0000000000..c6833cdb86
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/extract-catalyst.ts
@@ -0,0 +1,90 @@
+import { mkdirSync } from 'fs';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
+import type { ReadableStream as NodeReadableStream } from 'stream/web';
+import { x } from 'tar';
+
+import { consola } from './logger';
+
+const SUBDIR = 'core';
+const MAX_ATTEMPTS = 3;
+
+const codeloadUrl = (repository: string, ref: string) =>
+  `https://codeload.github.com/${repository}/tar.gz/${encodeURIComponent(ref)}`;
+
+const wait = (ms: number) =>
+  new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+
+// Download the repo tarball from GitHub's codeload endpoint and stream-extract
+// ONLY the `core/` subdirectory into `projectDir`, so merchants receive a clean
+// standalone project instead of the whole monorepo. Mirrors create-next-app:
+// fetch -> stream.pipeline -> tar.x({ strip, filter }).
+//
+// The archive's top-level directory is dynamic (e.g.
+// `catalyst--bigcommerce-catalyst-core-1.6.2` for a tag, `catalyst-canary` for a
+// branch), so we never hardcode it — `filter` keeps entries whose first path
+// segment after the top dir is `core/`, and `strip: 2` drops `<top>/core` so the
+// contents land at the project root.
+const downloadAndExtract = async (repository: string, ref: string, projectDir: string) => {
+  const url = codeloadUrl(repository, ref);
+  const response = await fetch(url);
+
+  if (!response.ok || !response.body) {
+    throw new Error(`Failed to download ${url} (HTTP ${response.status})`);
+  }
+
+  await pipeline(
+    // Node's global fetch types `body` as the DOM ReadableStream; it is the same
+    // object Readable.fromWeb expects at runtime.
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    Readable.fromWeb(response.body as NodeReadableStream<Uint8Array>),
+    x({
+      cwd: projectDir,
+      strip: 2,
+      filter: (path) => path.split('/')[1] === SUBDIR,
+    }),
+  );
+};
+
+// Retries the download up to MAX_ATTEMPTS with linear backoff, following
+// create-next-app's pattern. Recursive rather than looped to keep each await off
+// the hot loop path (and satisfy lint).
+const attemptDownload = async (
+  repository: string,
+  ref: string,
+  projectDir: string,
+  attempt = 1,
+): Promise<void> => {
+  try {
+    await downloadAndExtract(repository, ref, projectDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'unknown error';
+
+    if (attempt >= MAX_ATTEMPTS) {
+      throw new Error(`Failed to download Catalyst after ${MAX_ATTEMPTS} attempts: ${message}`);
+    }
+
+    consola.warn(`Download attempt ${attempt} failed (${message}). Retrying...`);
+    await wait(attempt * 1000);
+
+    return attemptDownload(repository, ref, projectDir, attempt + 1);
+  }
+};
+
+export const extractCatalyst = async ({
+  repository,
+  ref,
+  projectDir,
+}: {
+  repository: string;
+  ref: string;
+  projectDir: string;
+}) => {
+  consola.info(`Downloading ${repository}#${ref}...`);
+
+  mkdirSync(projectDir, { recursive: true });
+
+  await attemptDownload(repository, ref, projectDir);
+};
diff --git a/packages/catalyst/src/cli/lib/http-errors.spec.ts b/packages/catalyst/src/cli/lib/http-errors.spec.ts
new file mode 100644
index 0000000000..156b26cd77
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/http-errors.spec.ts
@@ -0,0 +1,104 @@
+import { HttpResponse } from 'msw';
+import { describe, expect, test } from 'vitest';
+
+import { UserActionableError } from './errors';
+import { extractApiErrorMessage, httpError } from './http-errors';
+
+describe('extractApiErrorMessage', () => {
+  test('prefers the server detail', () => {
+    expect(
+      extractApiErrorMessage({ title: 'Bad Request', detail: 'The domain is already claimed.' }),
+    ).toBe('The domain is already claimed.');
+  });
+
+  test('falls back to the title when there is no detail', () => {
+    expect(extractApiErrorMessage({ title: 'Not Found' })).toBe('Not Found');
+  });
+
+  test('enriches the headline with field-level errors', () => {
+    expect(
+      extractApiErrorMessage({
+        title: 'Invalid request.',
+        errors: { name: 'must be at least 3 characters' },
+      }),
+    ).toBe('Invalid request. (name: must be at least 3 characters)');
+  });
+
+  test('returns field errors alone when there is no title or detail', () => {
+    expect(extractApiErrorMessage({ errors: { name: 'is required' } })).toBe('name: is required');
+  });
+
+  test('returns undefined for a body that is not the v3 envelope', () => {
+    expect(extractApiErrorMessage(null)).toBeUndefined();
+    expect(extractApiErrorMessage('oops')).toBeUndefined();
+    expect(extractApiErrorMessage({ unrelated: true })).toBeUndefined();
+  });
+});
+
+describe('httpError', () => {
+  test('surfaces the API body message on a 4xx', async () => {
+    const response = HttpResponse.json(
+      { title: 'Bad Request', detail: 'The project name is already in use.' },
+      { status: 400 },
+    );
+
+    const error = await httpError(response, 'Failed to create project');
+
+    // A 4xx is a clear, user-actionable response — no Correlation ID/support framing.
+    expect(error).toBeInstanceOf(UserActionableError);
+    expect(error.message).toBe('Failed to create project: The project name is already in use.');
+  });
+
+  test('surfaces the API body message on a 5xx but keeps it a plain Error', async () => {
+    const response = HttpResponse.json(
+      { title: 'Bad Gateway', detail: 'Upstream is unavailable.' },
+      { status: 502 },
+    );
+
+    const error = await httpError(response, 'Failed to fetch logs');
+
+    // A 5xx is a server-side failure worth escalating — stays a plain Error so
+    // the top-level handler keeps the Correlation ID + support framing.
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UserActionableError);
+    expect(error.message).toBe('Failed to fetch logs: Upstream is unavailable.');
+  });
+
+  test('falls back to user-actionable copy for a 4xx with an empty body', async () => {
+    const response = new HttpResponse(null, { status: 403 });
+
+    const error = await httpError(response, 'Failed to fetch projects');
+
+    expect(error).toBeInstanceOf(UserActionableError);
+    expect(error.message).toBe(
+      'Failed to fetch projects: The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.',
+    );
+  });
+
+  test('falls back to transient copy for a 5xx with an empty body', async () => {
+    const response = new HttpResponse(null, { status: 500 });
+
+    const error = await httpError(response, 'Failed to fetch logs');
+
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UserActionableError);
+    expect(error.message).toBe(
+      'Failed to fetch logs: Something went wrong on our end. Please try again. If the issue persists, contact support.',
+    );
+  });
+
+  test('falls back gracefully when the body is unparseable JSON', async () => {
+    const response = new HttpResponse('<html>Bad Gateway</html>', {
+      status: 502,
+      headers: { 'Content-Type': 'text/html' },
+    });
+
+    const error = await httpError(response, 'Failed to upload bundle');
+
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UserActionableError);
+    expect(error.message).toBe(
+      'Failed to upload bundle: Something went wrong on our end. Please try again. If the issue persists, contact support.',
+    );
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/http-errors.ts b/packages/catalyst/src/cli/lib/http-errors.ts
new file mode 100644
index 0000000000..0da003b627
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/http-errors.ts
@@ -0,0 +1,67 @@
+import { z } from 'zod';
+
+import { UserActionableError } from './errors';
+
+// BigCommerce APIs surface errors as an RFC-7807-ish envelope:
+// `{ title, detail, errors: { <field>: <message> } }`. We prefer the server's
+// own prose over anything we could invent, so callers show the API's reason
+// verbatim when it's available.
+const apiErrorBodySchema = z.object({
+  title: z.string().optional(),
+  detail: z.string().optional(),
+  errors: z.record(z.string(), z.string()).optional(),
+});
+
+// Curated copy for when the response has no usable body. Keyed by status class,
+// not exact code, so any 4xx/5xx we don't specifically handle still reads well.
+const FALLBACK_CLIENT_ERROR =
+  'The request was rejected. Check your input — your access token may be missing a required scope, or the resource may not exist.';
+const FALLBACK_SERVER_ERROR =
+  'Something went wrong on our end. Please try again. If the issue persists, contact support.';
+
+// Pulls a human-readable message out of a parsed API error body, preferring the
+// most specific prose the server gave us: its `detail`, then `title`, enriched
+// with any field-level `errors`. Returns undefined when the body doesn't match
+// the envelope (empty, HTML, plain text, or already-consumed).
+export function extractApiErrorMessage(body: unknown): string | undefined {
+  const parsed = apiErrorBodySchema.safeParse(body);
+
+  if (!parsed.success) return undefined;
+
+  const { title, detail, errors } = parsed.data;
+  const fieldErrors =
+    errors && Object.keys(errors).length > 0
+      ? Object.entries(errors)
+          .map(([field, message]) => `${field}: ${message}`)
+          .join('; ')
+      : undefined;
+
+  const headline = detail ?? title;
+
+  if (headline && fieldErrors) return `${headline} (${fieldErrors})`;
+
+  return headline ?? fieldErrors;
+}
+
+// Turns a non-OK `Response` into a readable error to throw. Reads the body once
+// (safely — a malformed or empty body never throws) and prefers the API's own
+// message; otherwise it falls back to curated copy for the status class.
+//
+// The 4xx/5xx split decides the *type*, which the top-level handler in
+// `index.ts` keys off: a 4xx is a clear, user-actionable response, so it throws
+// `UserActionableError` and the handler drops the "share your Correlation ID
+// with support" bug-report framing; a 5xx is a server-side failure worth
+// escalating, so it stays a plain `Error` and keeps that framing.
+//
+// Returns the error rather than throwing so call sites read
+// `throw await httpError(response, 'Failed to fetch projects')` and TypeScript
+// still sees the throw for control-flow narrowing.
+export async function httpError(response: Response, action: string): Promise<Error> {
+  const body: unknown = await response.json().catch(() => null);
+  const isServerError = response.status >= 500;
+  const detail =
+    extractApiErrorMessage(body) ?? (isServerError ? FALLBACK_SERVER_ERROR : FALLBACK_CLIENT_ERROR);
+  const message = `${action}: ${detail}`;
+
+  return isServerError ? new Error(message) : new UserActionableError(message);
+}
diff --git a/packages/catalyst/src/cli/lib/init-git-repo.ts b/packages/catalyst/src/cli/lib/init-git-repo.ts
new file mode 100644
index 0000000000..ec28846624
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/init-git-repo.ts
@@ -0,0 +1,23 @@
+import { execSync } from 'child_process';
+import { rmSync } from 'fs';
+import { join } from 'path';
+
+import { consola } from './logger';
+
+const run = (command: string, cwd: string) => execSync(command, { cwd, stdio: 'ignore' });
+
+// Initialize a fresh git repository for the merchant with a single initial
+// commit. We no longer clone, so there is no history or upstream remote to carry
+// over — merchants add their own. Best-effort: a missing git or a pre-existing
+// repo shouldn't fail project creation, so we warn and roll back a partial init.
+export const initGitRepo = (projectDir: string) => {
+  try {
+    run('git init', projectDir);
+    run('git add -A', projectDir);
+    run('git commit -m "Initial commit from Catalyst"', projectDir);
+    consola.success('Initialized a git repository.');
+  } catch {
+    rmSync(join(projectDir, '.git'), { recursive: true, force: true });
+    consola.warn('Could not initialize a git repository. Skipping.');
+  }
+};
diff --git a/packages/catalyst/src/cli/lib/install-dependencies.ts b/packages/catalyst/src/cli/lib/install-dependencies.ts
new file mode 100644
index 0000000000..28d96a05f4
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/install-dependencies.ts
@@ -0,0 +1,60 @@
+import { installDependencies as installDeps } from 'nypm';
+import yoctoSpinner from 'yocto-spinner';
+
+import type { PackageManager } from './detect-package-manager';
+
+// Restore an env var to a captured previous value, unsetting it when it wasn't
+// set before (a plain assignment can't represent "absent").
+const restoreEnv = (key: string, previous: string | undefined) => {
+  if (previous === undefined) {
+    Reflect.deleteProperty(process.env, key);
+  } else {
+    process.env[key] = previous;
+  }
+};
+
+// nypm runs the install through tinyexec, which in silent mode drains the
+// child's stdout to completion BEFORE it starts reading stderr. pnpm sends its
+// progress to stdout but floods stderr with Node warnings — on Node 26 the
+// `File descriptor N opened in unmanaged mode` spam alone is thousands of
+// lines. That stderr fills its ~64KB pipe buffer while tinyexec is still busy
+// on stdout, pnpm blocks writing, and the whole install deadlocks (the original
+// "hangs forever" bug). These env vars keep the child quiet on stderr so the
+// buffer never fills:
+//   - NODE_NO_WARNINGS: drop pnpm/corepack's internal Node warnings (the flood).
+//   - COREPACK_ENABLE_DOWNLOAD_PROMPT: never block on corepack's download
+//     confirmation (defensive; corepack already defaults this off for the
+//     `corepack pnpm` entrypoint, but pin it so no path can stall on stdin).
+const withQuietInstallEnv = async <T>(run: () => Promise<T>): Promise<T> => {
+  const prevNodeNoWarnings = process.env.NODE_NO_WARNINGS;
+  const prevDownloadPrompt = process.env.COREPACK_ENABLE_DOWNLOAD_PROMPT;
+
+  process.env.NODE_NO_WARNINGS ??= '1';
+  process.env.COREPACK_ENABLE_DOWNLOAD_PROMPT ??= '0';
+
+  try {
+    return await run();
+  } finally {
+    restoreEnv('NODE_NO_WARNINGS', prevNodeNoWarnings);
+    restoreEnv('COREPACK_ENABLE_DOWNLOAD_PROMPT', prevDownloadPrompt);
+  }
+};
+
+export const installDependencies = async (
+  projectDir: string,
+  packageManager: PackageManager = 'pnpm',
+) => {
+  const spinner = yoctoSpinner().start(
+    `Installing dependencies with ${packageManager}. This could take a minute...`,
+  );
+
+  try {
+    await withQuietInstallEnv(() => installDeps({ cwd: projectDir, silent: true, packageManager }));
+    spinner.success('Dependencies installed successfully.');
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'unknown error';
+
+    spinner.error(`Failed to install dependencies: ${message}`);
+    throw error;
+  }
+};
diff --git a/packages/create-catalyst/src/utils/localization.ts b/packages/catalyst/src/cli/lib/localization.ts
similarity index 50%
rename from packages/create-catalyst/src/utils/localization.ts
rename to packages/catalyst/src/cli/lib/localization.ts
index d6b20353da..4f9059c93b 100644
--- a/packages/create-catalyst/src/utils/localization.ts
+++ b/packages/catalyst/src/cli/lib/localization.ts
@@ -1,6 +1,8 @@
 import { z } from 'zod';
 
-import { Https } from './https';
+import { assertAuthorized } from './auth-errors';
+import { httpError } from './http-errors';
+import { getTelemetry } from './telemetry';
 
 const allowedLocales = [
   'en',
@@ -35,13 +37,27 @@ const AvailableLocalesSuccessSchema = z.object({
   ),
 });
 
-export const getAvailableLocales = async (bc: Https) => {
-  const response = await bc.fetch('/v3/settings/store/available-locales');
+export const getAvailableLocales = async (
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+) => {
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/settings/store/available-locales`,
+    {
+      method: 'GET',
+      headers: {
+        'X-Auth-Token': accessToken,
+        'X-Correlation-Id': getTelemetry().correlationId,
+        Accept: 'application/json',
+      },
+    },
+  );
+
+  assertAuthorized(response);
 
   if (!response.ok) {
-    throw new Error(
-      `GET /v3/settings/store/available-locales failed: ${response.status} ${response.statusText}`,
-    );
+    throw await httpError(response, 'Failed to fetch available locales');
   }
 
   return AvailableLocalesSuccessSchema.parse(await response.json())
diff --git a/packages/catalyst/src/cli/lib/logger.ts b/packages/catalyst/src/cli/lib/logger.ts
index 065d7b55ce..51643fdcdc 100644
--- a/packages/catalyst/src/cli/lib/logger.ts
+++ b/packages/catalyst/src/cli/lib/logger.ts
@@ -2,4 +2,8 @@ import { createConsola } from 'consola';
 
 export const consola = createConsola({
   level: process.env.CONSOLA_LEVEL ? parseInt(process.env.CONSOLA_LEVEL, 10) : 3,
+  // Drop the per-line timestamp. It adds noise for a short-lived CLI and, on
+  // long lines, consola can't right-align it so it falls back to an inline
+  // `[time]` prefix that breaks copy-pasteable command suggestions.
+  formatOptions: { date: false },
 });
diff --git a/packages/catalyst/src/cli/lib/login.spec.ts b/packages/catalyst/src/cli/lib/login.spec.ts
new file mode 100644
index 0000000000..57261a190b
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/login.spec.ts
@@ -0,0 +1,128 @@
+import { input } from '@inquirer/prompts';
+import open from 'open';
+import { afterEach, beforeAll, beforeEach, describe, expect, MockInstance, test, vi } from 'vitest';
+
+import * as authLib from './auth';
+import * as clipboardLib from './clipboard';
+import { consola } from './logger';
+import { login } from './login';
+
+// eslint-disable-next-line import/dynamic-import-chunkname
+vi.mock('yocto-spinner', () => import('../../../tests/mocks/spinner'));
+vi.mock('open', () => ({ default: vi.fn().mockResolvedValue(undefined) }));
+vi.mock('@inquirer/prompts', () => ({
+  confirm: vi.fn(),
+  input: vi.fn(),
+  password: vi.fn(),
+}));
+
+const inputMock = vi.mocked(input);
+const openMock = vi.mocked(open);
+
+const LOGIN_URL = 'https://login.example.com';
+const API_HOST = 'api.example.com';
+
+const DEVICE_CODE = {
+  device_code: 'device-code',
+  user_code: 'USER-CODE',
+  verification_uri: 'https://login.example.com/device',
+  expires_in: 600,
+  interval: 5,
+};
+
+const CREDENTIALS = {
+  access_token: 'access-token',
+  store_hash: 'store-hash',
+  context: 'stores/store-hash',
+  api_uri: 'https://api.example.com',
+};
+
+function withTtyValue(value: boolean): () => void {
+  const previous = Object.getOwnPropertyDescriptor(process.stdin, 'isTTY');
+
+  Object.defineProperty(process.stdin, 'isTTY', { value, configurable: true });
+
+  return () => {
+    if (previous) {
+      Object.defineProperty(process.stdin, 'isTTY', previous);
+    } else {
+      Reflect.deleteProperty(process.stdin, 'isTTY');
+    }
+  };
+}
+
+let copyToClipboardSpy: MockInstance<typeof clipboardLib.copyToClipboard>;
+let restoreTty: (() => void) | undefined;
+
+beforeAll(() => {
+  consola.mockTypes(() => vi.fn());
+});
+
+beforeEach(() => {
+  vi.spyOn(authLib, 'requestDeviceCode').mockResolvedValue(DEVICE_CODE);
+  vi.spyOn(authLib, 'waitForDeviceToken').mockResolvedValue(CREDENTIALS);
+  copyToClipboardSpy = vi.spyOn(clipboardLib, 'copyToClipboard').mockResolvedValue(true);
+});
+
+afterEach(() => {
+  restoreTty?.();
+  restoreTty = undefined;
+  vi.clearAllMocks();
+});
+
+describe('device-code login', () => {
+  test('waits for Enter before opening the browser when interactive', async () => {
+    restoreTty = withTtyValue(true);
+
+    inputMock.mockResolvedValueOnce('');
+
+    const result = await login(LOGIN_URL, API_HOST);
+
+    expect(inputMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Press Enter to open your browser and sign in' }),
+    );
+    expect(openMock).toHaveBeenCalledWith(DEVICE_CODE.verification_uri);
+    // The browser must not open until the user has pressed Enter: the prompt has
+    // to be invoked before the call to open the browser.
+    expect(inputMock.mock.invocationCallOrder[0]).toBeLessThan(
+      openMock.mock.invocationCallOrder[0],
+    );
+    expect(result).toEqual({ storeHash: 'store-hash', accessToken: 'access-token' });
+  });
+
+  test('copies the code to the clipboard once the user proceeds', async () => {
+    restoreTty = withTtyValue(true);
+    inputMock.mockResolvedValueOnce('');
+    copyToClipboardSpy.mockResolvedValueOnce(true);
+
+    await login(LOGIN_URL, API_HOST);
+
+    expect(copyToClipboardSpy).toHaveBeenCalledWith('USER-CODE');
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('clipboard'));
+  });
+
+  test('still completes and prints the code when the clipboard copy fails', async () => {
+    restoreTty = withTtyValue(true);
+    inputMock.mockResolvedValueOnce('');
+    copyToClipboardSpy.mockResolvedValueOnce(false);
+
+    const result = await login(LOGIN_URL, API_HOST);
+
+    // Code was printed as a fallback, but no clipboard confirmation shown.
+    expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('USER-CODE'));
+    expect(consola.info).not.toHaveBeenCalledWith(expect.stringContaining('clipboard'));
+    expect(openMock).toHaveBeenCalledWith(DEVICE_CODE.verification_uri);
+    expect(result).toEqual({ storeHash: 'store-hash', accessToken: 'access-token' });
+  });
+
+  test('does not wait for Enter or touch the clipboard when non-interactive', async () => {
+    restoreTty = withTtyValue(false);
+
+    const result = await login(LOGIN_URL, API_HOST);
+
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(copyToClipboardSpy).not.toHaveBeenCalled();
+    expect(openMock).toHaveBeenCalledWith(DEVICE_CODE.verification_uri);
+    expect(result).toEqual({ storeHash: 'store-hash', accessToken: 'access-token' });
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/login.ts b/packages/catalyst/src/cli/lib/login.ts
new file mode 100644
index 0000000000..d2b43d1754
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/login.ts
@@ -0,0 +1,171 @@
+import { confirm, input, password } from '@inquirer/prompts';
+import { colorize } from 'consola/utils';
+import open from 'open';
+import yoctoSpinner from 'yocto-spinner';
+import { z } from 'zod';
+
+import { DEVICE_OAUTH_SCOPES, requestDeviceCode, waitForDeviceToken } from './auth';
+import { copyToClipboard } from './clipboard';
+import { UserActionableError } from './errors';
+import { consola } from './logger';
+
+export interface LoginResult {
+  storeHash: string;
+  accessToken: string;
+}
+
+// Thrown when the user declines the manual-login fallback after the browser
+// (device-code) flow has failed. Callers should treat this as a clean exit,
+// not an error — the user explicitly chose to abort.
+export class LoginAbortedError extends Error {
+  constructor() {
+    super('Login aborted by user.');
+    this.name = 'LoginAbortedError';
+  }
+}
+
+const StoreProfileSchema = z.object({
+  data: z.object({
+    store_name: z.string(),
+  }),
+});
+
+async function fetchStoreProfile(storeHash: string, accessToken: string, apiHost: string) {
+  const response = await fetch(`https://${apiHost}/stores/${storeHash}/v3/settings/store/profile`, {
+    method: 'GET',
+    headers: {
+      'X-Auth-Token': accessToken,
+      Accept: 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}`);
+  }
+
+  const res: unknown = await response.json();
+  const result = StoreProfileSchema.safeParse(res);
+
+  if (!result.success) {
+    throw new Error('Unexpected response from store profile API');
+  }
+
+  return result.data.data;
+}
+
+async function deviceCodeLogin(loginUrl: string): Promise<LoginResult> {
+  const deviceCode = await requestDeviceCode(loginUrl);
+
+  consola.info(
+    `${colorize('yellow', 'Your one-time code:')} ${colorize('bold', deviceCode.user_code)}`,
+  );
+
+  // Wait for the user to acknowledge before hijacking their browser. This keeps
+  // the UX consistent across `create`, `auth login`, and the channel commands.
+  // In non-interactive contexts (CI, piped stdin) there's nobody to press
+  // Enter, so skip straight to opening the verification URL.
+  if (process.stdin.isTTY) {
+    await input({ message: 'Press Enter to open your browser and sign in' });
+
+    // Best-effort: drop the code on the clipboard so the user can paste it
+    // straight into the verification page. We already printed it above as a
+    // fallback, and a clipboard failure must never interrupt the flow.
+    const copied = await copyToClipboard(deviceCode.user_code);
+
+    if (copied) {
+      consola.info('Copied the code to your clipboard — paste it into the sign-in page.');
+    }
+  }
+
+  try {
+    await open(deviceCode.verification_uri);
+    consola.info(`Opened ${deviceCode.verification_uri} in your browser.`);
+  } catch {
+    consola.info(`Open ${deviceCode.verification_uri} in your browser and enter the code above.`);
+  }
+
+  const spinner = yoctoSpinner().start('Waiting for authentication...');
+
+  const credentials = await waitForDeviceToken(
+    loginUrl,
+    deviceCode.device_code,
+    deviceCode.interval,
+  );
+
+  spinner.success('Authentication complete.');
+
+  return {
+    storeHash: credentials.store_hash,
+    accessToken: credentials.access_token,
+  };
+}
+
+async function manualLogin(apiHost: string): Promise<LoginResult> {
+  consola.info(
+    'Create a store-level API account from your BigCommerce Control Panel:\n' +
+      '  Settings → API → Store-level API accounts → Create API account\n' +
+      `Grant these OAuth scopes: ${DEVICE_OAUTH_SCOPES}`,
+  );
+
+  const storeHashInput = await input({ message: 'Store hash:' });
+  const storeHash = storeHashInput.trim();
+
+  if (!storeHash) {
+    throw new UserActionableError('Store hash is required.');
+  }
+
+  const accessTokenInput = await password({ message: 'Access token:', mask: true });
+  const accessToken = accessTokenInput.trim();
+
+  if (!accessToken) {
+    throw new UserActionableError('Access token is required.');
+  }
+
+  const spinner = yoctoSpinner().start('Validating credentials...');
+
+  try {
+    const profile = await fetchStoreProfile(storeHash, accessToken, apiHost);
+
+    spinner.success(`Validated credentials for ${profile.store_name} (${storeHash}).`);
+  } catch (error) {
+    spinner.error('Failed to validate credentials.');
+
+    const message = error instanceof Error ? error.message : String(error);
+
+    throw new UserActionableError(
+      `Could not validate credentials (${message}). Double-check your store hash and access token, then try again.`,
+    );
+  }
+
+  return { storeHash, accessToken };
+}
+
+// Interactive login orchestrator. Used by `catalyst create`, `catalyst auth
+// login`, and `catalyst project create` to gather credentials when none are
+// supplied via flags/env/config.
+//
+// Happy path: opens the browser device-code flow. When that fails (e.g. the
+// device-code endpoint returns 404 because the OAuth client isn't yet
+// provisioned for the user's environment), we ask the user if they'd like to
+// fall back to pasting a store-level API account's credentials instead, then
+// validate them via the store profile API before returning.
+export async function login(loginUrl: string, apiHost: string): Promise<LoginResult> {
+  try {
+    return await deviceCodeLogin(loginUrl);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+
+    consola.warn(`Browser login didn't work (${message}).`);
+
+    const shouldFallback = await confirm({
+      message: 'Try logging in manually with a store hash and access token instead?',
+      default: true,
+    });
+
+    if (!shouldFallback) {
+      throw new LoginAbortedError();
+    }
+
+    return manualLogin(apiHost);
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/observability.spec.ts b/packages/catalyst/src/cli/lib/observability.spec.ts
new file mode 100644
index 0000000000..1acc5b5adf
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/observability.spec.ts
@@ -0,0 +1,477 @@
+import { http, HttpResponse } from 'msw';
+import { afterAll, afterEach, beforeAll, describe, expect, test, vi } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+
+import { UserActionableError } from './errors';
+import { consola } from './logger';
+import { formatLogEntry, formatV3Error, queryLogs, resolveTimeWindow } from './observability';
+
+const projectUuid = '6b202364-10f3-11f1-8bc7-fe9b9d8b14ab';
+const storeHash = 'test-store';
+const accessToken = 'test-token';
+const apiHost = 'api.bigcommerce.com';
+
+const logsUrl = 'https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid';
+
+beforeAll(() => {
+  consola.mockTypes(() => vi.fn());
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+afterAll(() => {
+  vi.restoreAllMocks();
+});
+
+describe('resolveTimeWindow', () => {
+  const nowMs = Date.parse('2026-06-11T12:00:00Z');
+
+  test('throws when both since and start are missing', () => {
+    expect(() => resolveTimeWindow({ end: '2026-06-01T00:00:00Z' })).toThrow(
+      'Provide a time window with --since <duration> or --start <time>.',
+    );
+  });
+
+  test('bad time-window input is user-actionable (no support/correlation framing)', () => {
+    expect(() => resolveTimeWindow({ since: 'yesterday' })).toThrow(UserActionableError);
+  });
+
+  test('defaults end to now when omitted', () => {
+    expect(resolveTimeWindow({ start: '2026-06-11T00:00:00Z' }, nowMs)).toEqual({
+      start: '2026-06-11T00:00:00Z',
+      end: '2026-06-11T12:00:00.000Z',
+    });
+  });
+
+  test('computes start from since relative to now', () => {
+    expect(resolveTimeWindow({ since: '6h' }, nowMs)).toEqual({
+      start: '2026-06-11T06:00:00.000Z',
+      end: '2026-06-11T12:00:00.000Z',
+    });
+  });
+
+  test('computes start from since relative to an explicit end', () => {
+    expect(resolveTimeWindow({ since: '30m', end: '2026-06-10T12:00:00Z' }, nowMs)).toEqual({
+      start: '2026-06-10T11:30:00.000Z',
+      end: '2026-06-10T12:00:00Z',
+    });
+  });
+
+  test('supports day-unit durations', () => {
+    expect(resolveTimeWindow({ since: '2d' }, nowMs)).toEqual({
+      start: '2026-06-09T12:00:00.000Z',
+      end: '2026-06-11T12:00:00.000Z',
+    });
+  });
+
+  test('throws on an unparseable since value', () => {
+    expect(() => resolveTimeWindow({ since: 'yesterday' })).toThrow('Invalid --since value');
+    expect(() => resolveTimeWindow({ since: '1w' })).toThrow('Invalid --since value');
+  });
+
+  test('throws when since exceeds 7 days', () => {
+    expect(() => resolveTimeWindow({ since: '8d' })).toThrow('must not exceed 7 days');
+  });
+
+  test('throws on an unparseable start value', () => {
+    expect(() => resolveTimeWindow({ start: 'not-a-date', end: '2026-06-01T00:00:00Z' })).toThrow(
+      'Invalid --start value',
+    );
+  });
+
+  test('throws on an unparseable end value', () => {
+    expect(() => resolveTimeWindow({ start: '2026-06-01T00:00:00Z', end: 'nope' })).toThrow(
+      'Invalid --end value',
+    );
+  });
+
+  test('throws when the window is out of order', () => {
+    expect(() =>
+      resolveTimeWindow({ start: '2026-06-02T00:00:00Z', end: '2026-06-01T00:00:00Z' }),
+    ).toThrow('--start must be before or equal to --end');
+  });
+
+  test('throws when the window exceeds 7 days', () => {
+    expect(() =>
+      resolveTimeWindow({ start: '2026-06-01T00:00:00Z', end: '2026-06-09T00:00:01Z' }),
+    ).toThrow('must not exceed 7 days');
+  });
+
+  test('passes ISO-8601 values through unchanged', () => {
+    expect(
+      resolveTimeWindow({ start: '2026-06-01T00:00:00Z', end: '2026-06-02T00:00:00Z' }),
+    ).toEqual({ start: '2026-06-01T00:00:00Z', end: '2026-06-02T00:00:00Z' });
+  });
+
+  test('passes Unix epoch (seconds) values through unchanged', () => {
+    expect(resolveTimeWindow({ start: '1717200000', end: '1717203600' })).toEqual({
+      start: '1717200000',
+      end: '1717203600',
+    });
+  });
+
+  test('accepts an exactly 7-day window', () => {
+    expect(
+      resolveTimeWindow({ start: '2026-06-01T00:00:00Z', end: '2026-06-08T00:00:00Z' }),
+    ).toEqual({ start: '2026-06-01T00:00:00Z', end: '2026-06-08T00:00:00Z' });
+  });
+});
+
+describe('formatLogEntry', () => {
+  test('formats the default line as [timestamp] [LEVEL] message, like tail', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'error',
+      messages: ['boom', 'happened'],
+      request: { method: 'GET', url: '/cart', status_code: 500 },
+    });
+
+    expect(line).toContain('[2026-06-01T12:34:56.789Z]');
+    expect(line).toContain('ERROR');
+    expect(line).toContain('boom happened');
+    // The default format omits request details — those only show in `request`.
+    expect(line).not.toContain('/cart');
+  });
+
+  test('uses the raw UTC ISO-8601 timestamp in brackets', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'info',
+      messages: ['hi'],
+    });
+
+    expect(line).toContain('[2026-06-01T12:34:56.789Z]');
+  });
+
+  test('includes request method, URL, and status in the request format', () => {
+    const line = formatLogEntry(
+      {
+        timestamp: '2026-06-01T12:34:56.789Z',
+        level: 'error',
+        messages: ['boom'],
+        request: { method: 'GET', url: '/cart', status_code: 500 },
+      },
+      'request',
+    );
+
+    expect(line).toContain('GET /cart (500)');
+    expect(line).toContain('boom');
+  });
+
+  test('prints only the message in the short format', () => {
+    const line = formatLogEntry(
+      {
+        timestamp: '2026-06-01T12:34:56.789Z',
+        level: 'error',
+        messages: ['just the message'],
+        request: { method: 'GET', url: '/cart', status_code: 500 },
+      },
+      'short',
+    );
+
+    expect(line).toBe('just the message');
+  });
+
+  test('marks exceptions with the exception name', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'error',
+      messages: ['Unhandled exception'],
+      is_exception: true,
+      exception_name: 'TypeError',
+    });
+
+    expect(line).toContain('[TypeError]');
+  });
+
+  test('skips the exception marker when the message already contains the name', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'error',
+      messages: ['BigCommerceAPIError: \n    BigCommerce API returned 530\n    \n    '],
+      is_exception: true,
+      exception_name: 'BigCommerceAPIError',
+    });
+
+    expect(line).not.toContain('[BigCommerceAPIError]');
+    expect(line).toContain('BigCommerceAPIError: BigCommerce API returned 530');
+  });
+
+  test('treats <*> placeholders in the exception name as wildcards', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'error',
+      messages: ['\n    BigCommerce API returned 530\n    \n    '],
+      is_exception: true,
+      exception_name: 'BigCommerce API returned <*>',
+    });
+
+    expect(line).not.toContain('[BigCommerce API returned <*>]');
+  });
+
+  test('collapses embedded newlines and indentation into single spaces', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'error',
+      messages: ['first\n    second\n    \n    ', 'third'],
+    });
+
+    expect(line).not.toContain('\n');
+    expect(line).toContain('first second third');
+  });
+
+  test('omits the status code when it is the 0 sentinel', () => {
+    const line = formatLogEntry(
+      {
+        timestamp: '2026-06-01T12:34:56.789Z',
+        level: 'error',
+        messages: ['boom'],
+        request: { method: 'GET', url: '', status_code: 0 },
+      },
+      'request',
+    );
+
+    expect(line).toContain('GET');
+    expect(line).not.toContain('(0)');
+  });
+
+  test('stringifies non-string messages', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'info',
+      messages: ['payload', { code: 530 }],
+    });
+
+    expect(line).toContain('payload {"code":530}');
+  });
+
+  test('renders unrecognized levels without color mapping', () => {
+    const line = formatLogEntry({
+      timestamp: '2026-06-01T12:34:56.789Z',
+      level: 'log',
+      messages: ['hi'],
+    });
+
+    expect(line).toContain('LOG');
+  });
+
+  test('renders a placeholder time when the timestamp is missing', () => {
+    const line = formatLogEntry({ level: 'info', messages: ['hi'] });
+
+    expect(line).toContain('[unknown]');
+    expect(line).toContain('INFO');
+  });
+
+  test('handles a null request and missing level gracefully', () => {
+    const line = formatLogEntry({ messages: ['orphan log'], request: null }, 'request');
+
+    expect(line).toContain('UNKNOWN');
+    expect(line).toContain('orphan log');
+  });
+});
+
+describe('formatV3Error', () => {
+  test('combines title and field errors', () => {
+    expect(
+      formatV3Error({
+        title: 'Invalid request.',
+        errors: { timeframe: 'must span at most 7 days' },
+      }),
+    ).toBe('Invalid request. (timeframe: must span at most 7 days)');
+  });
+
+  test('returns the title alone when there are no field errors', () => {
+    expect(formatV3Error({ title: 'Invalid request.', errors: {} })).toBe('Invalid request.');
+  });
+
+  test('returns field errors alone when there is no title', () => {
+    expect(formatV3Error({ errors: { start: 'is required' } })).toBe('start: is required');
+  });
+
+  test('returns undefined for an unrecognizable body', () => {
+    expect(formatV3Error(null)).toBeUndefined();
+    expect(formatV3Error('oops')).toBeUndefined();
+  });
+});
+
+describe('queryLogs', () => {
+  test('returns the parsed page on success', async () => {
+    server.use(
+      http.get(logsUrl, () =>
+        HttpResponse.json({
+          data: [
+            {
+              id: '01HX',
+              timestamp: '2026-06-01T12:34:56.789Z',
+              level: 'error',
+              messages: ['boom'],
+              request: { method: 'GET', url: '/cart', status_code: 500 },
+            },
+          ],
+          meta: {
+            cursor_pagination: {
+              count: 1,
+              per_page: 50,
+              start_cursor: 'cursor_start',
+              end_cursor: 'cursor_end',
+              links: {},
+            },
+          },
+        }),
+      ),
+    );
+
+    const result = await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+      start: '2026-06-01T00:00:00Z',
+      end: '2026-06-02T00:00:00Z',
+    });
+
+    expect(result.data).toHaveLength(1);
+    expect(result.data[0].level).toBe('error');
+    // TODO(TRAC-934): meta.cursor_pagination is no longer parsed; the
+    // fixture keeps it to confirm the schema tolerates (ignores) extra keys.
+  });
+
+  test('accepts levels outside the known set and non-string messages', async () => {
+    server.use(
+      http.get(logsUrl, () =>
+        HttpResponse.json({
+          data: [
+            {
+              id: '01HX',
+              timestamp: '2026-06-01T12:34:56.789Z',
+              level: 'log',
+              messages: ['payload', { code: 530 }],
+            },
+          ],
+          meta: {
+            cursor_pagination: { count: 1, per_page: 50, start_cursor: null, end_cursor: null },
+          },
+        }),
+      ),
+    );
+
+    const result = await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+      start: '2026-06-01T00:00:00Z',
+      end: '2026-06-02T00:00:00Z',
+    });
+
+    expect(result.data[0].level).toBe('log');
+  });
+
+  test('forwards filters as query params, including colon params', async () => {
+    let captured: URLSearchParams | undefined;
+
+    server.use(
+      http.get(logsUrl, ({ request }) => {
+        captured = new URL(request.url).searchParams;
+
+        return HttpResponse.json({
+          data: [],
+          meta: {
+            cursor_pagination: { count: 0, per_page: 50, start_cursor: null, end_cursor: null },
+          },
+        });
+      }),
+    );
+
+    await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+      start: '2026-06-01T00:00:00Z',
+      end: '2026-06-02T00:00:00Z',
+      method: 'GET',
+      statusCode: 500,
+      urlLike: '/cart',
+      levelMin: 'warn',
+      limit: 25,
+    });
+
+    expect(captured?.get('start')).toBe('2026-06-01T00:00:00Z');
+    expect(captured?.get('end')).toBe('2026-06-02T00:00:00Z');
+    expect(captured?.get('method')).toBe('GET');
+    expect(captured?.get('status_code')).toBe('500');
+    expect(captured?.get('url:like')).toBe('/cart');
+    expect(captured?.get('level:min')).toBe('warn');
+    expect(captured?.get('limit')).toBe('25');
+    expect(captured?.get('after')).toBeNull();
+  });
+
+  test('maps 401 to a re-auth error', async () => {
+    server.use(http.get(logsUrl, () => new HttpResponse(null, { status: 401 })));
+
+    await expect(
+      queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+        start: '2026-06-01T00:00:00Z',
+        end: '2026-06-02T00:00:00Z',
+      }),
+    ).rejects.toThrow('catalyst auth login');
+  });
+
+  test('maps 403 to an API-not-enabled error', async () => {
+    server.use(http.get(logsUrl, () => new HttpResponse(null, { status: 403 })));
+
+    await expect(
+      queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+        start: '2026-06-01T00:00:00Z',
+        end: '2026-06-02T00:00:00Z',
+      }),
+    ).rejects.toThrow('Infrastructure Logs API not enabled');
+  });
+
+  test('maps 404 to a project-not-found error', async () => {
+    server.use(http.get(logsUrl, () => new HttpResponse(null, { status: 404 })));
+
+    const error = await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+      start: '2026-06-01T00:00:00Z',
+      end: '2026-06-02T00:00:00Z',
+    }).catch((err: unknown) => err);
+
+    // A 4xx is a clear, user-actionable response — no Correlation ID/support framing.
+    expect(error).toBeInstanceOf(UserActionableError);
+    expect(error).toHaveProperty('message', expect.stringContaining('Project not found'));
+  });
+
+  test('surfaces the v3 error message on 422', async () => {
+    server.use(
+      http.get(logsUrl, () =>
+        HttpResponse.json(
+          {
+            status: 422,
+            title: 'Invalid request.',
+            errors: { timeframe: 'must span at most 7 days' },
+          },
+          { status: 422 },
+        ),
+      ),
+    );
+
+    await expect(
+      queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+        start: '2026-06-01T00:00:00Z',
+        end: '2026-06-02T00:00:00Z',
+      }),
+    ).rejects.toThrow('Invalid request. (timeframe: must span at most 7 days)');
+  });
+
+  test('throws a generic error on other non-ok responses', async () => {
+    server.use(
+      http.get(logsUrl, () => new HttpResponse(null, { status: 500, statusText: 'Server Error' })),
+    );
+
+    const error = await queryLogs(projectUuid, storeHash, accessToken, apiHost, {
+      start: '2026-06-01T00:00:00Z',
+      end: '2026-06-02T00:00:00Z',
+    }).catch((err: unknown) => err);
+
+    // A 5xx is a server-side failure worth escalating, so it stays a plain Error
+    // and keeps the top-level Correlation ID + support framing.
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UserActionableError);
+    expect(error).toHaveProperty(
+      'message',
+      'Failed to fetch logs: Something went wrong on our end. Please try again. If the issue persists, contact support.',
+    );
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/observability.ts b/packages/catalyst/src/cli/lib/observability.ts
new file mode 100644
index 0000000000..9d0cd9ff0c
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/observability.ts
@@ -0,0 +1,277 @@
+import { colorize } from 'consola/utils';
+import { z } from 'zod';
+
+import { assertAuthorized } from './auth-errors';
+import { UserActionableError } from './errors';
+import { httpError } from './http-errors';
+import { getTelemetry } from './telemetry';
+
+export const LOG_LEVELS = ['debug', 'info', 'warn', 'error'] as const;
+export type LogLevel = (typeof LOG_LEVELS)[number];
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+
+const logEntrySchema = z.object({
+  timestamp: z.string().nullable().optional(),
+  level: z.string().optional(),
+  messages: z.array(z.unknown()).optional(),
+  is_exception: z.boolean().optional(),
+  exception_name: z.string().optional(),
+  request: z
+    .object({
+      method: z.string().optional(),
+      url: z.string().optional(),
+      status_code: z.number().optional(),
+    })
+    .nullable()
+    .optional(),
+});
+
+// TODO(TRAC-934): any `meta.cursor_pagination` the backend still returns is ignored (zod strips unknown keys)
+const queryLogsSchema = z.object({
+  data: z.array(logEntrySchema),
+});
+
+export type LogEntry = z.infer<typeof logEntrySchema>;
+export type QueryLogsResult = z.infer<typeof queryLogsSchema>;
+
+export interface QueryLogsParams {
+  start: string;
+  end: string;
+  method?: string;
+  statusCode?: number;
+  urlLike?: string;
+  levelMin?: LogLevel;
+  limit?: number;
+}
+
+const v3ErrorSchema = z.object({
+  title: z.string().optional(),
+  errors: z.record(z.string(), z.string()).optional(),
+});
+
+export function formatV3Error(body: unknown): string | undefined {
+  const parsed = v3ErrorSchema.safeParse(body);
+
+  if (!parsed.success) return undefined;
+
+  const { title, errors } = parsed.data;
+  const fieldErrors =
+    errors && Object.keys(errors).length > 0
+      ? Object.entries(errors)
+          .map(([field, message]) => `${field}: ${message}`)
+          .join('; ')
+      : undefined;
+
+  if (title && fieldErrors) return `${title} (${fieldErrors})`;
+
+  return title ?? fieldErrors;
+}
+
+// Accepts either an ISO-8601 timestamp or a Unix epoch (seconds) and returns
+// milliseconds since epoch, or null when the value can't be parsed.
+function parseTimeInput(value: string): number | null {
+  const trimmed = value.trim();
+
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1000;
+  }
+
+  const ms = Date.parse(trimmed);
+
+  return Number.isNaN(ms) ? null : ms;
+}
+
+const DURATION_UNIT_MS: Record<string, number> = {
+  s: 1000,
+  m: 60 * 1000,
+  h: 60 * 60 * 1000,
+  d: 24 * 60 * 60 * 1000,
+};
+
+function parseDuration(value: string): number | null {
+  const match = /^(\d+)([smhd])$/.exec(value.trim());
+
+  if (!match) return null;
+
+  return Number(match[1]) * DURATION_UNIT_MS[match[2]];
+}
+
+export function resolveTimeWindow(
+  opts: { start?: string; end?: string; since?: string },
+  nowMs = Date.now(),
+): {
+  start: string;
+  end: string;
+} {
+  const { since } = opts;
+  let { start, end } = opts;
+  let startMs: number | null;
+  let endMs: number | null;
+
+  if (end) {
+    endMs = parseTimeInput(end);
+
+    if (endMs === null) {
+      throw new UserActionableError(
+        `Invalid --end value "${end}". Provide an ISO-8601 timestamp or a Unix epoch (seconds).`,
+      );
+    }
+  } else {
+    endMs = nowMs;
+    end = new Date(endMs).toISOString();
+  }
+
+  if (since) {
+    const durationMs = parseDuration(since);
+
+    if (durationMs === null) {
+      throw new UserActionableError(
+        `Invalid --since value "${since}". Provide a duration like 30m, 6h, or 2d (units: s, m, h, d).`,
+      );
+    }
+
+    startMs = endMs - durationMs;
+    start = new Date(startMs).toISOString();
+  } else if (start) {
+    startMs = parseTimeInput(start);
+
+    if (startMs === null) {
+      throw new UserActionableError(
+        `Invalid --start value "${start}". Provide an ISO-8601 timestamp or a Unix epoch (seconds).`,
+      );
+    }
+  } else {
+    throw new UserActionableError(
+      'Provide a time window with --since <duration> or --start <time>.',
+    );
+  }
+
+  if (startMs > endMs) {
+    throw new UserActionableError('Invalid time window: --start must be before or equal to --end.');
+  }
+
+  if (endMs - startMs > SEVEN_DAYS_MS) {
+    throw new UserActionableError('Invalid time window: the range must not exceed 7 days.');
+  }
+
+  return { start, end };
+}
+
+const LEVEL_COLORS: Record<string, Parameters<typeof colorize>[0]> = {
+  debug: 'gray',
+  info: 'green',
+  warn: 'yellow',
+  error: 'red',
+};
+
+export type LogLineFormat = 'default' | 'short' | 'request';
+
+const UNKNOWN_TIME = 'unknown';
+
+function isRedundantExceptionName(name: string, message: string): boolean {
+  const parts = name
+    .split('<*>')
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0);
+
+  return parts.length > 0 && parts.every((part) => message.includes(part));
+}
+
+const stringifyMessage = (message: unknown) =>
+  typeof message === 'string' ? message : JSON.stringify(message);
+
+export function formatLogEntry(entry: LogEntry, format: LogLineFormat = 'default'): string {
+  const message = (entry.messages ?? [])
+    .map(stringifyMessage)
+    .join(' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+
+  if (format === 'short') return message;
+
+  const level = entry.level ?? 'unknown';
+  const coloredLevel = colorize(LEVEL_COLORS[level.toLowerCase()] ?? 'white', level.toUpperCase());
+
+  const exceptionStr =
+    entry.is_exception &&
+    entry.exception_name &&
+    !isRedundantExceptionName(entry.exception_name, message)
+      ? ` ${colorize('red', `[${entry.exception_name}]`)}`
+      : '';
+
+  let requestStr = '';
+
+  if (format === 'request' && entry.request) {
+    const parts: string[] = [];
+
+    if (entry.request.method) parts.push(entry.request.method);
+    if (entry.request.url) parts.push(entry.request.url);
+
+    // status_code 0 is the backend's "unknown" sentinel — omit it.
+    const status = entry.request.status_code ? ` (${entry.request.status_code})` : '';
+
+    if (parts.length > 0) requestStr = ` ${parts.join(' ')}${status}`;
+  }
+
+  return `[${entry.timestamp ?? UNKNOWN_TIME}] [${coloredLevel}]${requestStr}${exceptionStr} ${message}`;
+}
+
+export async function queryLogs(
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+  params: QueryLogsParams,
+): Promise<QueryLogsResult> {
+  const search = new URLSearchParams();
+
+  search.set('start', params.start);
+  search.set('end', params.end);
+
+  if (params.method) search.set('method', params.method);
+  if (params.statusCode != null) search.set('status_code', String(params.statusCode));
+  if (params.urlLike) search.set('url:like', params.urlLike); // colon param
+  if (params.levelMin) search.set('level:min', params.levelMin); // colon param
+  if (params.limit != null) search.set('limit', String(params.limit));
+
+  const response = await fetch(
+    `https://${apiHost}/stores/${storeHash}/v3/infrastructure/logs/${projectUuid}?${search.toString()}`,
+    {
+      method: 'GET',
+      headers: {
+        'X-Auth-Token': accessToken,
+        'X-Correlation-Id': getTelemetry().correlationId,
+        Accept: 'application/json',
+      },
+    },
+  );
+
+  assertAuthorized(response);
+
+  if (response.status === 403) {
+    throw new UserActionableError(
+      'Infrastructure Logs API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
+    );
+  }
+
+  if (response.status === 404) {
+    throw new UserActionableError('Project not found. Check the project UUID.');
+  }
+
+  // 400 (bad UUID) and 422 (invalid window/filter) both carry the field-keyed
+  // v3 error envelope — surface its message rather than the bare status.
+  if (response.status === 400 || response.status === 422) {
+    const body: unknown = await response.json().catch(() => null);
+
+    throw new UserActionableError(formatV3Error(body) ?? 'Invalid log query.');
+  }
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to fetch logs');
+  }
+
+  const res: unknown = await response.json();
+
+  return queryLogsSchema.parse(res);
+}
diff --git a/packages/catalyst/src/cli/lib/project-config.spec.ts b/packages/catalyst/src/cli/lib/project-config.spec.ts
index 8e0fcd17ca..5f50c2f245 100644
--- a/packages/catalyst/src/cli/lib/project-config.spec.ts
+++ b/packages/catalyst/src/cli/lib/project-config.spec.ts
@@ -1,7 +1,7 @@
 import Conf from 'conf';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { afterAll, beforeAll, expect, test } from 'vitest';
+import { afterAll, beforeAll, expect, test, vi } from 'vitest';
 
 import { mkTempDir } from './mk-temp-dir';
 import { getProjectConfig, ProjectConfigSchema } from './project-config';
@@ -15,10 +15,13 @@ const projectUuid = 'a23f5785-fd99-4a94-9fb3-945551623923';
 beforeAll(async () => {
   [tmpDir, cleanup] = await mkTempDir();
 
-  config = getProjectConfig(tmpDir);
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+
+  config = getProjectConfig();
 });
 
 afterAll(async () => {
+  vi.restoreAllMocks();
   await cleanup();
 });
 
@@ -40,17 +43,20 @@ test('writes and reads field from .bigcommerce/project.json', async () => {
   await writeFile(projectJsonPath, JSON.stringify({}));
 
   config.set('projectUuid', projectUuid);
+  config.set('storeHash', 'abc123');
+  config.set('accessToken', 'secret-token');
 
-  const modifiedProjectUuid = config.get('projectUuid');
-
-  expect(modifiedProjectUuid).toBe(projectUuid);
+  expect(config.get('projectUuid')).toBe(projectUuid);
+  expect(config.get('storeHash')).toBe('abc123');
+  expect(config.get('accessToken')).toBe('secret-token');
 });
 
-test('sets default framework to nextjs', async () => {
-  const projectJsonPath = join(tmpDir, '.bigcommerce/project.json');
+test('env defaults to an empty object and round-trips a map', () => {
+  expect(config.get('env')).toEqual({});
 
-  await mkdir(dirname(projectJsonPath), { recursive: true });
-  await writeFile(projectJsonPath, JSON.stringify({}));
+  config.set('env', { FOO: 'bar', BAZ: 'qux' });
+
+  expect(config.get('env')).toEqual({ FOO: 'bar', BAZ: 'qux' });
 
-  expect(config.get('framework')).toBe('nextjs');
+  config.delete('env');
 });
diff --git a/packages/catalyst/src/cli/lib/project-config.ts b/packages/catalyst/src/cli/lib/project-config.ts
index 20cd65f98d..2485d3a49d 100644
--- a/packages/catalyst/src/cli/lib/project-config.ts
+++ b/packages/catalyst/src/cli/lib/project-config.ts
@@ -3,31 +3,37 @@ import { join } from 'path';
 
 export interface ProjectConfigSchema {
   projectUuid: string;
-  framework: 'catalyst' | 'nextjs';
-  telemetry: {
-    enabled: boolean;
-    anonymousId: string;
-  };
+  // Reserved for future use
+  framework: 'catalyst';
+  storeHash?: string;
+  accessToken?: string;
+  apiHost?: string;
+  // Persistent deployment environment variables (KEY -> VALUE). Every entry is
+  // sent to the deployment as a `secret` by `catalyst deploy`. Managed via the
+  // `catalyst env` commands. Lives here (gitignored .bigcommerce/project.json)
+  // so users don't have to re-pass `--secret` on every deploy.
+  env?: Record<string, string>;
 }
 
-export function getProjectConfig(rootDir = process.cwd()) {
+export function getProjectConfig() {
   return new Conf<ProjectConfigSchema>({
-    cwd: join(rootDir, '.bigcommerce'),
+    cwd: join(process.cwd(), '.bigcommerce'),
     projectSuffix: '',
     configName: 'project',
     schema: {
       projectUuid: { type: 'string', format: 'uuid' },
       framework: {
         type: 'string',
-        enum: ['catalyst', 'nextjs'],
-        default: 'nextjs',
+        enum: ['catalyst'],
+        default: 'catalyst',
       },
-      telemetry: {
+      storeHash: { type: 'string' },
+      accessToken: { type: 'string' },
+      apiHost: { type: 'string' },
+      env: {
         type: 'object',
-        properties: {
-          enabled: { type: 'boolean' },
-          anonymousId: { type: 'string' },
-        },
+        additionalProperties: { type: 'string' },
+        default: {},
       },
     },
   });
diff --git a/packages/catalyst/src/cli/lib/project-state.spec.ts b/packages/catalyst/src/cli/lib/project-state.spec.ts
new file mode 100644
index 0000000000..5788908786
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/project-state.spec.ts
@@ -0,0 +1,164 @@
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+
+import { mkTempDir } from './mk-temp-dir';
+import { getProjectState } from './project-state';
+
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+
+const writeFileEnsured = async (path: string, contents: string) => {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, contents);
+};
+
+const writeProjectJson = (cwd: string, value: unknown) =>
+  writeFileEnsured(join(cwd, '.bigcommerce', 'project.json'), JSON.stringify(value));
+
+const writePackageJson = (cwd: string, value: unknown) =>
+  writeFileEnsured(join(cwd, 'package.json'), JSON.stringify(value));
+
+beforeEach(async () => {
+  [tmpDir, cleanup] = await mkTempDir();
+});
+
+afterEach(async () => {
+  await cleanup();
+});
+
+describe('getProjectState', () => {
+  test('empty directory returns all-false flags', () => {
+    const state = getProjectState(tmpDir);
+
+    expect(state).toEqual({
+      projectUuid: undefined,
+      hasMiddleware: false,
+      hasProxy: false,
+      hasOpenNextDep: false,
+      isLinked: false,
+      isTransformed: false,
+      isFullySetUp: false,
+    });
+  });
+
+  test('does not create .bigcommerce/ as a side effect', () => {
+    getProjectState(tmpDir);
+
+    expect(existsSync(join(tmpDir, '.bigcommerce'))).toBe(false);
+  });
+
+  test('isLinked when projectUuid is set', async () => {
+    await writeProjectJson(tmpDir, { projectUuid: 'abc-123' });
+
+    const state = getProjectState(tmpDir);
+
+    expect(state.projectUuid).toBe('abc-123');
+    expect(state.isLinked).toBe(true);
+    expect(state.isTransformed).toBe(false);
+    expect(state.isFullySetUp).toBe(false);
+  });
+
+  test('malformed project.json is treated as unlinked', async () => {
+    await writeFileEnsured(join(tmpDir, '.bigcommerce', 'project.json'), '{not json');
+
+    const state = getProjectState(tmpDir);
+
+    expect(state.projectUuid).toBeUndefined();
+    expect(state.isLinked).toBe(false);
+  });
+
+  test('hasMiddleware/hasProxy reflect file presence', async () => {
+    await writeFileEnsured(join(tmpDir, 'proxy.ts'), '// proxy');
+
+    const before = getProjectState(tmpDir);
+
+    expect(before.hasProxy).toBe(true);
+    expect(before.hasMiddleware).toBe(false);
+
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+
+    const after = getProjectState(tmpDir);
+
+    expect(after.hasProxy).toBe(true);
+    expect(after.hasMiddleware).toBe(true);
+  });
+
+  test('hasOpenNextDep reflects package.json dependencies', async () => {
+    await writePackageJson(tmpDir, {
+      dependencies: { '@opennextjs/cloudflare': '1.17.3' },
+    });
+
+    expect(getProjectState(tmpDir).hasOpenNextDep).toBe(true);
+  });
+
+  test('package.json without OpenNext dep returns false', async () => {
+    await writePackageJson(tmpDir, { dependencies: { next: '15.0.0' } });
+
+    expect(getProjectState(tmpDir).hasOpenNextDep).toBe(false);
+  });
+
+  test('isTransformed requires middleware present, proxy absent, and OpenNext dep installed', async () => {
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+    await writePackageJson(tmpDir, {
+      dependencies: { '@opennextjs/cloudflare': '1.17.3' },
+    });
+
+    expect(getProjectState(tmpDir).isTransformed).toBe(true);
+  });
+
+  test('isTransformed is false if proxy.ts still exists', async () => {
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+    await writeFileEnsured(join(tmpDir, 'proxy.ts'), '// proxy');
+    await writePackageJson(tmpDir, {
+      dependencies: { '@opennextjs/cloudflare': '1.17.3' },
+    });
+
+    expect(getProjectState(tmpDir).isTransformed).toBe(false);
+  });
+
+  test('isTransformed is false if OpenNext dep missing', async () => {
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+
+    expect(getProjectState(tmpDir).isTransformed).toBe(false);
+  });
+
+  test('isFullySetUp requires both linked and transformed', async () => {
+    await writeProjectJson(tmpDir, { projectUuid: 'abc-123' });
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+    await writePackageJson(tmpDir, {
+      dependencies: { '@opennextjs/cloudflare': '1.17.3' },
+    });
+
+    const state = getProjectState(tmpDir);
+
+    expect(state.isLinked).toBe(true);
+    expect(state.isTransformed).toBe(true);
+    expect(state.isFullySetUp).toBe(true);
+  });
+
+  test('linked but untransformed (e.g. after `catalyst project create` only)', async () => {
+    await writeProjectJson(tmpDir, { projectUuid: 'abc-123' });
+    await writeFileEnsured(join(tmpDir, 'proxy.ts'), '// proxy');
+
+    const state = getProjectState(tmpDir);
+
+    expect(state.isLinked).toBe(true);
+    expect(state.isTransformed).toBe(false);
+    expect(state.isFullySetUp).toBe(false);
+  });
+
+  test('transformed but unlinked (e.g. mid-setup before UUID is written)', async () => {
+    await writeFileEnsured(join(tmpDir, 'middleware.ts'), '// middleware');
+    await writePackageJson(tmpDir, {
+      dependencies: { '@opennextjs/cloudflare': '1.17.3' },
+    });
+
+    const state = getProjectState(tmpDir);
+
+    expect(state.isLinked).toBe(false);
+    expect(state.isTransformed).toBe(true);
+    expect(state.isFullySetUp).toBe(false);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/project-state.ts b/packages/catalyst/src/cli/lib/project-state.ts
new file mode 100644
index 0000000000..479ebc0158
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/project-state.ts
@@ -0,0 +1,67 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+
+const projectJsonSchema = z.looseObject({
+  projectUuid: z.string().optional(),
+});
+
+const packageJsonSchema = z.looseObject({
+  dependencies: z.record(z.string(), z.string()).optional(),
+});
+
+export interface ProjectState {
+  projectUuid: string | undefined;
+  hasMiddleware: boolean;
+  hasProxy: boolean;
+  hasOpenNextDep: boolean;
+
+  // Derived signals — `isLinked` reflects intent (UUID registered via
+  // `catalyst project create` or commerce-hosting setup); `isTransformed`
+  // reflects on-disk readiness (middleware.ts swapped in, OpenNext dep
+  // installed). A deploy needs both, but `catalyst build` only cares about
+  // `isTransformed` so it can dispatch to OpenNext vs `next build`.
+  isLinked: boolean;
+  isTransformed: boolean;
+  isFullySetUp: boolean;
+}
+
+const safeReadJson = (path: string): unknown => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return null;
+  }
+};
+
+// Read-only inspection of a Catalyst project at `cwd` (typically `core/`).
+// Avoids `getProjectConfig()` deliberately — that would instantiate `Conf`
+// and create `.bigcommerce/` as a side effect.
+export function getProjectState(cwd: string = process.cwd()): ProjectState {
+  const projectJson = projectJsonSchema.safeParse(
+    safeReadJson(join(cwd, '.bigcommerce', 'project.json')),
+  );
+  const projectUuid = projectJson.success ? projectJson.data.projectUuid : undefined;
+
+  const hasMiddleware = existsSync(join(cwd, 'middleware.ts'));
+  const hasProxy = existsSync(join(cwd, 'proxy.ts'));
+
+  const pkgJson = packageJsonSchema.safeParse(safeReadJson(join(cwd, 'package.json')));
+  const hasOpenNextDep = pkgJson.success
+    ? Boolean(pkgJson.data.dependencies?.['@opennextjs/cloudflare'])
+    : false;
+
+  const isLinked = Boolean(projectUuid);
+  const isTransformed = hasMiddleware && !hasProxy && hasOpenNextDep;
+  const isFullySetUp = isLinked && isTransformed;
+
+  return {
+    projectUuid,
+    hasMiddleware,
+    hasProxy,
+    hasOpenNextDep,
+    isLinked,
+    isTransformed,
+    isFullySetUp,
+  };
+}
diff --git a/packages/catalyst/src/cli/lib/project.spec.ts b/packages/catalyst/src/cli/lib/project.spec.ts
new file mode 100644
index 0000000000..c577de2aa8
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/project.spec.ts
@@ -0,0 +1,34 @@
+import { http, HttpResponse } from 'msw';
+import { describe, expect, it } from 'vitest';
+
+import { server } from '../../../tests/mocks/node';
+
+import { createProject } from './project';
+
+const API = { storeHash: 'store', accessToken: 'token', apiHost: 'api.example.com' };
+const CREATE_PROJECT_URL = 'https://:apiHost/stores/:storeHash/v3/infrastructure/projects';
+
+const NOT_ENABLED_MESSAGE =
+  'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.';
+
+describe('createProject', () => {
+  // The API returns 403 when the store lacks the scope and 404 when the
+  // Infrastructure Projects feature flag is off. Both mean "not enabled for this
+  // store", so both surface the same actionable "join the beta" guidance rather
+  // than a cryptic `Failed to create project: Not Found`.
+  it.each([403, 404])(
+    'surfaces the not-enabled guidance when the API responds %i',
+    async (status) => {
+      server.use(
+        http.post(
+          CREATE_PROJECT_URL,
+          () => new HttpResponse(null, { status, statusText: 'Not Found' }),
+        ),
+      );
+
+      await expect(
+        createProject('my-project', API.storeHash, API.accessToken, API.apiHost),
+      ).rejects.toThrow(NOT_ENABLED_MESSAGE);
+    },
+  );
+});
diff --git a/packages/catalyst/src/cli/lib/project.ts b/packages/catalyst/src/cli/lib/project.ts
index ffdb319902..4855255836 100644
--- a/packages/catalyst/src/cli/lib/project.ts
+++ b/packages/catalyst/src/cli/lib/project.ts
@@ -1,10 +1,23 @@
 import { z } from 'zod';
 
+import { assertAuthorized } from './auth-errors';
+import { UserActionableError } from './errors';
+import { httpError } from './http-errors';
+import { getTelemetry } from './telemetry';
+
+export class InfrastructureProjectValidationError extends UserActionableError {
+  constructor(message: string) {
+    super(message);
+    this.name = 'InfrastructureProjectValidationError';
+  }
+}
+
 const fetchProjectsSchema = z.object({
   data: z.array(
     z.object({
       uuid: z.string(),
       name: z.string(),
+      deployment_hostnames: z.array(z.string()),
     }),
   ),
 });
@@ -12,6 +25,36 @@ const fetchProjectsSchema = z.object({
 export interface ProjectListItem {
   uuid: string;
   name: string;
+  deployment_hostnames: string[];
+}
+
+function projectsUrl(storeHash: string, apiHost: string) {
+  return `https://${apiHost}/stores/${storeHash}/v3/infrastructure/projects`;
+}
+
+function authHeaders(accessToken: string) {
+  return {
+    'X-Auth-Token': accessToken,
+    'X-Correlation-Id': getTelemetry().correlationId,
+  };
+}
+
+export async function hasProjectsAccess(
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<boolean> {
+  const response = await fetch(projectsUrl(storeHash, apiHost), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  assertAuthorized(response);
+
+  if (response.status === 200) return true;
+  if (response.status === 403) return false;
+
+  throw await httpError(response, 'Failed to check project access');
 }
 
 export async function fetchProjects(
@@ -19,24 +62,21 @@ export async function fetchProjects(
   accessToken: string,
   apiHost: string,
 ): Promise<ProjectListItem[]> {
-  const response = await fetch(
-    `https://${apiHost}/stores/${storeHash}/v3/infrastructure/projects`,
-    {
-      method: 'GET',
-      headers: {
-        'X-Auth-Token': accessToken,
-      },
-    },
-  );
+  const response = await fetch(projectsUrl(storeHash, apiHost), {
+    method: 'GET',
+    headers: authHeaders(accessToken),
+  });
+
+  assertAuthorized(response);
 
   if (response.status === 403) {
-    throw new Error(
-      'Infrastructure Projects API not enabled. If you are part of the alpha, contact support@bigcommerce.com to enable it.',
+    throw new UserActionableError(
+      'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
     );
   }
 
   if (!response.ok) {
-    throw new Error(`Failed to fetch projects: ${response.statusText}`);
+    throw await httpError(response, 'Failed to fetch projects');
   }
 
   const res: unknown = await response.json();
@@ -62,37 +102,70 @@ export interface CreateProjectResult {
   date_modified: Date;
 }
 
+const validationErrorBodySchema = z.object({
+  title: z.string().optional(),
+  detail: z.string().optional(),
+  errors: z.record(z.string(), z.string()).optional(),
+});
+
+function extractValidationMessage(body: unknown): string | null {
+  const parsed = validationErrorBodySchema.safeParse(body);
+
+  if (!parsed.success) return null;
+
+  const { title, detail, errors } = parsed.data;
+
+  if (errors && Object.keys(errors).length > 0) {
+    return Object.values(errors).join('; ');
+  }
+
+  return detail ?? title ?? null;
+}
+
 export async function createProject(
   name: string,
   storeHash: string,
   accessToken: string,
   apiHost: string,
 ): Promise<CreateProjectResult> {
-  const response = await fetch(
-    `https://${apiHost}/stores/${storeHash}/v3/infrastructure/projects`,
-    {
-      method: 'POST',
-      headers: {
-        'X-Auth-Token': accessToken,
-        Accept: 'application/json',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ name }),
+  const response = await fetch(projectsUrl(storeHash, apiHost), {
+    method: 'POST',
+    headers: {
+      ...authHeaders(accessToken),
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
     },
-  );
+    body: JSON.stringify({ name }),
+  });
 
-  if (response.status === 502) {
-    throw new Error('Failed to create project, is the name already in use?');
+  assertAuthorized(response);
+
+  if (response.status === 400 || response.status === 422) {
+    const body: unknown = await response.json().catch(() => null);
+    const fallback =
+      response.status === 422
+        ? "The project name you entered doesn't meet the requirements. It must be 3–32 characters long and use only letters, numbers, hyphens (-), underscores (_), and periods (.)"
+        : response.statusText;
+    const message = extractValidationMessage(body) ?? fallback;
+
+    throw new InfrastructureProjectValidationError(message);
   }
 
-  if (response.status === 403) {
-    throw new Error(
-      'Infrastructure Projects API not enabled. If you are part of the alpha, contact support@bigcommerce.com to enable it.',
+  // The API returns 403 (or 404 when the flag is off) if the store isn't in the
+  // Infrastructure Projects beta; both mean "not enabled for this store".
+  if (response.status === 403 || response.status === 404) {
+    throw new UserActionableError(
+      'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
     );
   }
 
+  // TODO: TRAC-592 - remove this check once the API returns proper 400/422 with validation messages for duplicate names instead of 502
+  if (response.status === 502) {
+    throw new Error('Failed to create project, is the name already in use?');
+  }
+
   if (!response.ok) {
-    throw new Error(`Failed to create project: ${response.statusText}`);
+    throw await httpError(response, 'Failed to create project');
   }
 
   const res: unknown = await response.json();
@@ -101,3 +174,31 @@ export async function createProject(
 
   return data;
 }
+
+export async function deleteProject(
+  projectUuid: string,
+  storeHash: string,
+  accessToken: string,
+  apiHost: string,
+): Promise<void> {
+  const response = await fetch(`${projectsUrl(storeHash, apiHost)}/${projectUuid}`, {
+    method: 'DELETE',
+    headers: authHeaders(accessToken),
+  });
+
+  assertAuthorized(response);
+
+  if (response.status === 403) {
+    throw new UserActionableError(
+      'Infrastructure Projects API not enabled. If you are part of the beta, contact support@bigcommerce.com to enable it.',
+    );
+  }
+
+  if (response.status === 404) {
+    throw new UserActionableError(`Project ${projectUuid} not found.`);
+  }
+
+  if (!response.ok) {
+    throw await httpError(response, 'Failed to delete project');
+  }
+}
diff --git a/packages/catalyst/src/cli/lib/required-build-env.spec.ts b/packages/catalyst/src/cli/lib/required-build-env.spec.ts
new file mode 100644
index 0000000000..93a0f2f9f7
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/required-build-env.spec.ts
@@ -0,0 +1,62 @@
+import { describe, expect, test } from 'vitest';
+
+import { UserActionableError } from './errors';
+import {
+  assertRequiredBuildEnv,
+  findMissingBuildEnv,
+  REQUIRED_BUILD_ENV_VARS,
+} from './required-build-env';
+
+const completeEnv = (): NodeJS.ProcessEnv => ({
+  BIGCOMMERCE_STORE_HASH: 'abc123',
+  BIGCOMMERCE_STOREFRONT_TOKEN: 'token',
+  BIGCOMMERCE_CHANNEL_ID: '1',
+  AUTH_SECRET: 'secret',
+});
+
+describe('findMissingBuildEnv', () => {
+  test('returns an empty array when every required var is set', () => {
+    expect(findMissingBuildEnv(completeEnv())).toEqual([]);
+  });
+
+  test('reports vars that are unset', () => {
+    const env = completeEnv();
+
+    delete env.BIGCOMMERCE_STOREFRONT_TOKEN;
+
+    expect(findMissingBuildEnv(env)).toEqual(['BIGCOMMERCE_STOREFRONT_TOKEN']);
+  });
+
+  test('treats empty or whitespace-only values as missing', () => {
+    const env = { ...completeEnv(), BIGCOMMERCE_STORE_HASH: '', AUTH_SECRET: '   ' };
+
+    expect(findMissingBuildEnv(env)).toEqual(['BIGCOMMERCE_STORE_HASH', 'AUTH_SECRET']);
+  });
+
+  test('reports all missing vars when the env is empty', () => {
+    expect(findMissingBuildEnv({})).toEqual([...REQUIRED_BUILD_ENV_VARS]);
+  });
+});
+
+describe('assertRequiredBuildEnv', () => {
+  test('does not throw when every required var is set', () => {
+    expect(() => assertRequiredBuildEnv(completeEnv())).not.toThrow();
+  });
+
+  test('throws a UserActionableError naming the missing vars', () => {
+    expect(() => assertRequiredBuildEnv({})).toThrow(UserActionableError);
+
+    REQUIRED_BUILD_ENV_VARS.forEach((name) => {
+      expect(() => assertRequiredBuildEnv({})).toThrow(new RegExp(name));
+    });
+  });
+
+  test('suggests --env-path and .env.local in the message', () => {
+    const env = completeEnv();
+
+    delete env.AUTH_SECRET;
+
+    expect(() => assertRequiredBuildEnv(env)).toThrow(/--env-path/);
+    expect(() => assertRequiredBuildEnv(env)).toThrow(/\.env\.local/);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/required-build-env.ts b/packages/catalyst/src/cli/lib/required-build-env.ts
new file mode 100644
index 0000000000..3c154ed5d3
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/required-build-env.ts
@@ -0,0 +1,51 @@
+import { UserActionableError } from './errors';
+
+// Env vars the core storefront build genuinely asserts on. Without these the
+// OpenNext/Next.js build fails deep inside prerendering with a raw stack trace:
+// BIGCOMMERCE_CHANNEL_ID is passed straight to createClient() with no fallback,
+// so the client constructor throws "Client configuration must include a
+// channelId" immediately; empty storefront token/store hash make Storefront API
+// calls fail; a missing AUTH_SECRET throws "AUTH_SECRET is not set" during
+// static generation. These are the values the app reads at build time — see
+// core/client/index.ts and core/auth/anonymous-session.ts.
+export const REQUIRED_BUILD_ENV_VARS = [
+  'BIGCOMMERCE_STORE_HASH',
+  'BIGCOMMERCE_STOREFRONT_TOKEN',
+  'BIGCOMMERCE_CHANNEL_ID',
+  'AUTH_SECRET',
+] as const;
+
+// A var counts as missing when it's unset or only whitespace — the core reads
+// most of these with a `?? ''` fallback, so an empty value fails just as
+// cryptically as an absent one.
+export const findMissingBuildEnv = (env: NodeJS.ProcessEnv = process.env): string[] => {
+  return REQUIRED_BUILD_ENV_VARS.filter((name) => {
+    const value = env[name];
+
+    return value === undefined || value.trim() === '';
+  });
+};
+
+// Fail fast with a clear, actionable message before we shell out to the build.
+// Naming the missing vars (and pointing at `--env-path`/`.env.local`) turns an
+// "ugly build error" into something the user can act on immediately.
+export const assertRequiredBuildEnv = (env: NodeJS.ProcessEnv = process.env): void => {
+  const missing = findMissingBuildEnv(env);
+
+  if (missing.length === 0) {
+    return;
+  }
+
+  const missingList = missing.map((name) => `  - ${name}`).join('\n');
+
+  throw new UserActionableError(
+    `Missing required environment variable${missing.length === 1 ? '' : 's'} for the build:\n` +
+      `${missingList}\n\n` +
+      'These are read by the build itself, so they must be set before it runs. ' +
+      'The build automatically loads `.env.local` and `.env` from the current ' +
+      `directory (${process.cwd()}) — add the variables above to one of those ` +
+      'files (`.env.local` takes precedence).\n' +
+      'To load an env file from a different location, pass `--env-path <path>` ' +
+      '(for example `--env-path ../.env.local` when running from a subdirectory).',
+  );
+};
diff --git a/packages/catalyst/src/cli/lib/resolve-credentials.spec.ts b/packages/catalyst/src/cli/lib/resolve-credentials.spec.ts
new file mode 100644
index 0000000000..ffe39723ce
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/resolve-credentials.spec.ts
@@ -0,0 +1,81 @@
+import Conf from 'conf';
+import { afterAll, afterEach, beforeAll, expect, MockInstance, test, vi } from 'vitest';
+
+import { consola } from './logger';
+import { mkTempDir } from './mk-temp-dir';
+import { getProjectConfig, ProjectConfigSchema } from './project-config';
+import { resolveCredentials } from './resolve-credentials';
+
+let exitMock: MockInstance;
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let config: Conf<ProjectConfigSchema>;
+
+beforeAll(async () => {
+  consola.mockTypes(() => vi.fn());
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  exitMock = vi.spyOn(process, 'exit').mockImplementation(() => null as never);
+
+  [tmpDir, cleanup] = await mkTempDir();
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+  config = getProjectConfig();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  config.delete('storeHash');
+  config.delete('accessToken');
+});
+
+afterAll(async () => {
+  vi.restoreAllMocks();
+  exitMock.mockRestore();
+  await cleanup();
+});
+
+test('returns credentials from options when both provided', () => {
+  const result = resolveCredentials({ storeHash: 'opt-hash', accessToken: 'opt-token' }, config);
+
+  expect(result).toEqual({ storeHash: 'opt-hash', accessToken: 'opt-token' });
+  expect(exitMock).not.toHaveBeenCalled();
+});
+
+test('falls back to config when options missing', () => {
+  config.set('storeHash', 'cfg-hash');
+  config.set('accessToken', 'cfg-token');
+
+  const result = resolveCredentials({}, config);
+
+  expect(result).toEqual({ storeHash: 'cfg-hash', accessToken: 'cfg-token' });
+  expect(exitMock).not.toHaveBeenCalled();
+});
+
+test('options take precedence over config', () => {
+  config.set('storeHash', 'cfg-hash');
+  config.set('accessToken', 'cfg-token');
+
+  const result = resolveCredentials({ storeHash: 'opt-hash', accessToken: 'opt-token' }, config);
+
+  expect(result).toEqual({ storeHash: 'opt-hash', accessToken: 'opt-token' });
+});
+
+test('mixed resolution: option storeHash + config accessToken', () => {
+  config.set('accessToken', 'cfg-token');
+
+  const result = resolveCredentials({ storeHash: 'opt-hash' }, config);
+
+  expect(result).toEqual({ storeHash: 'opt-hash', accessToken: 'cfg-token' });
+});
+
+test('exits with error when no credentials found anywhere', () => {
+  expect(() => resolveCredentials({}, config)).toThrow('Missing credentials');
+
+  expect(consola.error).toHaveBeenCalledWith('Missing credentials.');
+  expect(exitMock).toHaveBeenCalledWith(1);
+});
+
+test('error message mentions catalyst auth login', () => {
+  expect(() => resolveCredentials({}, config)).toThrow();
+
+  expect(consola.info).toHaveBeenCalledWith(expect.stringContaining('catalyst auth login'));
+});
diff --git a/packages/catalyst/src/cli/lib/resolve-credentials.ts b/packages/catalyst/src/cli/lib/resolve-credentials.ts
new file mode 100644
index 0000000000..670e27d407
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/resolve-credentials.ts
@@ -0,0 +1,25 @@
+import Conf from 'conf';
+
+import { consola } from './logger';
+import { ProjectConfigSchema } from './project-config';
+
+export function resolveCredentials(
+  options: { storeHash?: string; accessToken?: string },
+  config: Conf<ProjectConfigSchema>,
+): { storeHash: string; accessToken: string } {
+  const storeHash = options.storeHash ?? config.get('storeHash');
+  const accessToken = options.accessToken ?? config.get('accessToken');
+
+  if (!storeHash || !accessToken) {
+    consola.error('Missing credentials.');
+    consola.info(
+      'Run `catalyst auth login`, or provide --store-hash and --access-token flags (or set CATALYST_STORE_HASH and CATALYST_ACCESS_TOKEN environment variables).',
+    );
+    process.exit(1);
+
+    // Unreachable in production; prevents continuation when process.exit is mocked in tests.
+    throw new Error('Missing credentials');
+  }
+
+  return { storeHash, accessToken };
+}
diff --git a/packages/catalyst/src/cli/lib/rewrite-core-package.ts b/packages/catalyst/src/cli/lib/rewrite-core-package.ts
new file mode 100644
index 0000000000..acf32a4d37
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/rewrite-core-package.ts
@@ -0,0 +1,118 @@
+import { readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { z } from 'zod';
+
+import { consola } from './logger';
+import { sortPackageJsonFields } from './sort-package-json';
+
+// Native-module build allowlist, lifted from the monorepo's root
+// pnpm-workspace.yaml `onlyBuiltDependencies`. A standalone install needs this so
+// pnpm (`pnpm.onlyBuiltDependencies`) and bun (`trustedDependencies`) run the
+// native postinstall builds without prompting. npm/yarn-classic run them anyway.
+const NATIVE_BUILD_ALLOWLIST = [
+  '@parcel/watcher',
+  '@swc/core',
+  '@vercel/speed-insights',
+  'esbuild',
+  'msw',
+  'protobufjs',
+  'puppeteer',
+  'sharp',
+  'workerd',
+];
+
+const DEP_FIELDS = [
+  'dependencies',
+  'devDependencies',
+  'optionalDependencies',
+  'peerDependencies',
+] as const;
+
+const corePackageJsonSchema = z.looseObject({
+  version: z.string().optional(),
+  private: z.boolean().optional(),
+  scripts: z.record(z.string(), z.string()).optional(),
+  dependencies: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+  optionalDependencies: z.record(z.string(), z.string()).optional(),
+  peerDependencies: z.record(z.string(), z.string()).optional(),
+  pnpm: z.looseObject({}).optional(),
+  catalyst: z.looseObject({}).optional(),
+});
+
+const registryVersionSchema = z.object({ version: z.string() });
+
+// Resolve the published npm version for a workspace dependency. The extracted
+// tag tree still carries `workspace:^` (core is private, so changesets' publish-
+// time rewrite never touches the committed tree) — so we resolve the real
+// version at extraction time from the npm registry. The two workspace deps
+// (`@bigcommerce/catalyst-client`, `@bigcommerce/eslint-config-catalyst`) are
+// published in lockstep with core, so `latest` is the compatible version.
+const resolvePublishedVersion = async (pkgName: string): Promise<string> => {
+  const response = await fetch(`https://registry.npmjs.org/${pkgName}/latest`);
+
+  if (!response.ok) {
+    throw new Error(
+      `Could not resolve a published version for "${pkgName}" (HTTP ${response.status}). ` +
+        'The extracted project still references it via the workspace protocol and cannot be installed.',
+    );
+  }
+
+  const { version } = registryVersionSchema.parse(await response.json());
+
+  return `^${version}`;
+};
+
+// Transforms an extracted `core/package.json` into an installable, standalone
+// manifest: resolves `workspace:` deps to published versions, drops `private`,
+// bakes the native-build allowlist for pnpm/bun, strips monorepo-only (turbo)
+// scripts, and records the Catalyst version/ref the project was created from.
+// Also writes `.npmrc` so npm tolerates react-headroom's stale react peer range.
+export const rewriteCorePackage = async (projectDir: string, ref: string) => {
+  const packageJsonPath = join(projectDir, 'package.json');
+  const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync(packageJsonPath, 'utf-8')));
+
+  // Collect every workspace-protocol dependency across all dep fields, keeping a
+  // reference to its owning record so we can rewrite it in place after resolving.
+  const workspaceDeps = DEP_FIELDS.flatMap((field) => {
+    const deps = pkg[field];
+
+    if (!deps) return [];
+
+    return Object.entries(deps)
+      .filter(([, range]) => range.startsWith('workspace:'))
+      .map(([name]) => ({ deps, name }));
+  });
+
+  await Promise.all(
+    workspaceDeps.map(async ({ deps, name }) => {
+      const resolved = await resolvePublishedVersion(name);
+
+      deps[name] = resolved;
+      consola.info(`Resolved ${name} to ${resolved}`);
+    }),
+  );
+
+  // Merchants need an installable project; `private` blocks publish/install ergonomics.
+  delete pkg.private;
+
+  // Drop any monorepo-only scripts that shell out to turbo.
+  if (pkg.scripts) {
+    pkg.scripts = Object.fromEntries(
+      Object.entries(pkg.scripts).filter(([, command]) => !command.includes('turbo')),
+    );
+  }
+
+  pkg.pnpm = { ...pkg.pnpm, onlyBuiltDependencies: NATIVE_BUILD_ALLOWLIST };
+  pkg.trustedDependencies = NATIVE_BUILD_ALLOWLIST;
+
+  // Track what this project was scaffolded from (consumed by `catalyst upgrade`
+  // and the backend user-agent). `ref` is the exact ref extracted.
+  pkg.catalyst = { ...pkg.catalyst, version: pkg.version, ref };
+
+  writeFileSync(packageJsonPath, `${JSON.stringify(sortPackageJsonFields(pkg), null, 2)}\n`);
+
+  // react-headroom (unmaintained) declares a react <=18 peer; core ships react 19.
+  // pnpm/yarn/bun tolerate it, but npm errors ERESOLVE without this.
+  writeFileSync(join(projectDir, '.npmrc'), 'legacy-peer-deps=true\n');
+};
diff --git a/packages/catalyst/src/cli/lib/setup-core-project.spec.ts b/packages/catalyst/src/cli/lib/setup-core-project.spec.ts
new file mode 100644
index 0000000000..b6589b772d
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/setup-core-project.spec.ts
@@ -0,0 +1,117 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { z } from 'zod';
+
+import PACKAGE_INFO from '../../../package.json';
+
+import { setupCoreProject } from './setup-core-project';
+
+const packageJsonSchema = z.looseObject({
+  name: z.string().optional(),
+  scripts: z.record(z.string(), z.string()).optional(),
+  dependencies: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+});
+
+let projectDir: string;
+
+const writeCorePackageJson = (contents: unknown) => {
+  writeFileSync(join(projectDir, 'package.json'), JSON.stringify(contents, null, 2));
+};
+
+const readCorePackageJson = () =>
+  packageJsonSchema.parse(JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf-8')));
+
+beforeEach(() => {
+  projectDir = mkdtempSync(join(tmpdir(), 'catalyst-setup-core-test-'));
+});
+
+afterEach(() => {
+  rmSync(projectDir, { recursive: true, force: true });
+});
+
+describe('setupCoreProject', () => {
+  it('overrides build, start, and deploy scripts to dispatch through the catalyst CLI', () => {
+    writeCorePackageJson({
+      scripts: {
+        dev: 'npm run generate && next dev',
+        generate: 'dotenv -e .env.local -- node ./scripts/generate.cjs',
+        build: 'npm run generate && next build',
+        start: 'next start',
+      },
+    });
+
+    setupCoreProject(projectDir);
+
+    expect(readCorePackageJson().scripts).toEqual({
+      dev: 'npm run generate && next dev',
+      generate: 'dotenv -e .env.local -- node ./scripts/generate.cjs',
+      build: 'npm run generate && catalyst build',
+      start: 'catalyst start',
+      deploy: 'npm run generate && catalyst deploy',
+    });
+  });
+
+  it('keeps the `npm run generate &&` prefix on build', () => {
+    writeCorePackageJson({ scripts: { build: 'next build' } });
+
+    setupCoreProject(projectDir);
+
+    expect(readCorePackageJson().scripts?.build).toBe('npm run generate && catalyst build');
+  });
+
+  it('leaves unrelated scripts (dev, generate, lint, etc.) untouched', () => {
+    writeCorePackageJson({
+      scripts: {
+        dev: 'npm run generate && next dev',
+        generate: 'dotenv -e .env.local -- node ./scripts/generate.cjs',
+        lint: 'eslint .',
+        typecheck: 'tsc --noEmit',
+      },
+    });
+
+    setupCoreProject(projectDir);
+
+    expect(readCorePackageJson().scripts).toMatchObject({
+      dev: 'npm run generate && next dev',
+      generate: 'dotenv -e .env.local -- node ./scripts/generate.cjs',
+      lint: 'eslint .',
+      typecheck: 'tsc --noEmit',
+    });
+  });
+
+  it('adds @bigcommerce/catalyst as a devDependency at the CLI version', () => {
+    writeCorePackageJson({ devDependencies: { prettier: '^3.0.0' } });
+
+    setupCoreProject(projectDir);
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.devDependencies?.['@bigcommerce/catalyst']).toBe(PACKAGE_INFO.version);
+    expect(pkg.devDependencies?.prettier).toBe('^3.0.0');
+  });
+
+  it('does not add @bigcommerce/catalyst to runtime dependencies', () => {
+    writeCorePackageJson({ dependencies: { next: '^15.0.0' } });
+
+    setupCoreProject(projectDir);
+
+    const pkg = readCorePackageJson();
+
+    expect(pkg.dependencies?.['@bigcommerce/catalyst']).toBeUndefined();
+    expect(pkg.dependencies?.next).toBe('^15.0.0');
+  });
+
+  it('preserves unrelated top-level fields like name and version', () => {
+    writeCorePackageJson({
+      name: '@bigcommerce/catalyst-core',
+      scripts: { dev: 'next dev' },
+    });
+
+    setupCoreProject(projectDir);
+
+    expect(readCorePackageJson().name).toBe('@bigcommerce/catalyst-core');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/setup-core-project.ts b/packages/catalyst/src/cli/lib/setup-core-project.ts
new file mode 100644
index 0000000000..26ab9846ef
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/setup-core-project.ts
@@ -0,0 +1,42 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { z } from 'zod';
+
+import PACKAGE_INFO from '../../../package.json';
+
+import { sortPackageJsonFields } from './sort-package-json';
+
+const corePackageJsonSchema = z.looseObject({
+  scripts: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+});
+
+const writeJson = (path: string, value: unknown) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+};
+
+// Wires Catalyst CLI scripts and the `@bigcommerce/catalyst` dev dependency into
+// a freshly extracted project. Always runs at create time, regardless of hosting
+// choice — `catalyst build` / `catalyst start` / `catalyst deploy` dispatch on
+// project state, so these scripts work for self-hosted projects too without
+// rewrite. The CLI is a build-time tool (it only backs those npm scripts), never
+// imported at runtime, so it belongs in devDependencies, not dependencies.
+export const setupCoreProject = (projectDir: string) => {
+  const corePackageJsonPath = join(projectDir, 'package.json');
+  const pkg = corePackageJsonSchema.parse(JSON.parse(readFileSync(corePackageJsonPath, 'utf-8')));
+
+  pkg.scripts = {
+    ...pkg.scripts,
+    build: 'npm run generate && catalyst build',
+    start: 'catalyst start',
+    deploy: 'npm run generate && catalyst deploy',
+  };
+
+  pkg.devDependencies = {
+    ...pkg.devDependencies,
+    '@bigcommerce/catalyst': PACKAGE_INFO.version,
+  };
+
+  writeJson(corePackageJsonPath, sortPackageJsonFields(pkg));
+};
diff --git a/packages/catalyst/src/cli/lib/shared-options.spec.ts b/packages/catalyst/src/cli/lib/shared-options.spec.ts
new file mode 100644
index 0000000000..013a977341
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/shared-options.spec.ts
@@ -0,0 +1,45 @@
+import Conf from 'conf';
+import { afterAll, afterEach, beforeAll, expect, test, vi } from 'vitest';
+
+import { mkTempDir } from './mk-temp-dir';
+import { getProjectConfig, ProjectConfigSchema } from './project-config';
+import { DEFAULT_API_HOST, resolveApiHost } from './shared-options';
+
+let tmpDir: string;
+let cleanup: () => Promise<void>;
+let config: Conf<ProjectConfigSchema>;
+
+beforeAll(async () => {
+  [tmpDir, cleanup] = await mkTempDir();
+  vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+  config = getProjectConfig();
+});
+
+afterEach(() => {
+  config.delete('apiHost');
+});
+
+afterAll(async () => {
+  vi.restoreAllMocks();
+  await cleanup();
+});
+
+test('returns the --api-host flag when provided', () => {
+  expect(resolveApiHost({ apiHost: 'flag.example.com' }, config)).toBe('flag.example.com');
+});
+
+test('falls back to config apiHost when the flag is missing', () => {
+  config.set('apiHost', 'config.example.com');
+
+  expect(resolveApiHost({}, config)).toBe('config.example.com');
+});
+
+test('falls back to the default host when neither flag nor config is set', () => {
+  expect(resolveApiHost({}, config)).toBe(DEFAULT_API_HOST);
+});
+
+test('the flag takes precedence over the config apiHost', () => {
+  config.set('apiHost', 'config.example.com');
+
+  expect(resolveApiHost({ apiHost: 'flag.example.com' }, config)).toBe('flag.example.com');
+});
diff --git a/packages/catalyst/src/cli/lib/shared-options.ts b/packages/catalyst/src/cli/lib/shared-options.ts
new file mode 100644
index 0000000000..2fadfb6683
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/shared-options.ts
@@ -0,0 +1,63 @@
+import { Option } from 'commander';
+import type Conf from 'conf';
+
+import { DEFAULT_LOGIN_URL } from './auth';
+import { getProjectConfig, ProjectConfigSchema } from './project-config';
+
+export const DEFAULT_API_HOST = 'api.bigcommerce.com';
+
+export const storeHashOption = () =>
+  new Option(
+    '--store-hash <hash>',
+    'BigCommerce store hash. Can be found in the URL of your store Control Panel. Read from .bigcommerce/project.json or .env when not provided.',
+  ).env('CATALYST_STORE_HASH');
+
+export const accessTokenOption = () =>
+  new Option(
+    '--access-token <token>',
+    'BigCommerce access token. Can be found after creating a store-level API account. Read from .bigcommerce/project.json or .env when not provided.',
+  ).env('CATALYST_ACCESS_TOKEN');
+
+export const apiHostOption = () =>
+  new Option(
+    '--api-host <host>',
+    'BigCommerce API host. Read from .bigcommerce/project.json or CATALYST_API_HOST when not provided. Defaults to api.bigcommerce.com.',
+  )
+    .env('CATALYST_API_HOST')
+    .hideHelp();
+
+export const loginUrlOption = () =>
+  new Option('--login-url <url>', 'BigCommerce login URL.')
+    .env('BIGCOMMERCE_LOGIN_URL')
+    .default(DEFAULT_LOGIN_URL)
+    .hideHelp();
+
+export const projectUuidOption = () =>
+  new Option(
+    '--project-uuid <uuid>',
+    'BigCommerce infrastructure project UUID. Read from .bigcommerce/project.json or .env when not provided.',
+  ).env('CATALYST_PROJECT_UUID');
+
+export const envPathOption = () =>
+  new Option(
+    '--env-path <path>',
+    'Path to an environment file to load for the build (relative to the current working directory). When omitted, .env.local and .env are auto-loaded from the current directory. Other commands never load env files.',
+  );
+
+export const resolveProjectUuid = (options: { projectUuid?: string }) => {
+  const config = getProjectConfig();
+  const projectUuid = options.projectUuid ?? config.get('projectUuid');
+
+  if (!projectUuid) {
+    throw new Error(
+      'Project UUID is required. Please run either `catalyst project link` or `catalyst project create` or this command again with --project-uuid <uuid>.',
+    );
+  }
+
+  return projectUuid;
+};
+
+export const resolveApiHost = (
+  options: { apiHost?: string },
+  config: Conf<ProjectConfigSchema>,
+): string => options.apiHost ?? config.get('apiHost') ?? DEFAULT_API_HOST;
diff --git a/packages/catalyst/src/cli/lib/sort-package-json.spec.ts b/packages/catalyst/src/cli/lib/sort-package-json.spec.ts
new file mode 100644
index 0000000000..6fc1daf120
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/sort-package-json.spec.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest';
+
+import { sortPackageJsonFields } from './sort-package-json';
+
+describe('sortPackageJsonFields', () => {
+  it('places known fields in canonical order', () => {
+    const input = {
+      dependencies: { next: '^15.0.0' },
+      scripts: { build: 'next build' },
+      version: '1.0.0',
+      name: '@bigcommerce/catalyst-core',
+    };
+
+    expect(Object.keys(sortPackageJsonFields(input))).toEqual([
+      'name',
+      'version',
+      'scripts',
+      'dependencies',
+    ]);
+  });
+
+  it('preserves all canonical fields when present', () => {
+    const input = {
+      devDependencies: { vitest: '^3.0.0' },
+      dependencies: { next: '^15.0.0' },
+      scripts: { build: 'next build' },
+      engines: { node: '^20.0.0' },
+      private: true,
+      version: '1.0.0',
+      description: 'A Catalyst storefront',
+      name: '@bigcommerce/catalyst-core',
+    };
+
+    expect(Object.keys(sortPackageJsonFields(input))).toEqual([
+      'name',
+      'description',
+      'version',
+      'private',
+      'engines',
+      'scripts',
+      'dependencies',
+      'devDependencies',
+    ]);
+  });
+
+  it('appends unknown fields after canonical ones, preserving their relative order', () => {
+    const input = {
+      keywords: ['catalyst'],
+      name: '@bigcommerce/catalyst-core',
+      repository: { type: 'git', url: 'git+https://example.com/repo.git' },
+      scripts: { build: 'next build' },
+      license: 'MIT',
+    };
+
+    expect(Object.keys(sortPackageJsonFields(input))).toEqual([
+      'name',
+      'scripts',
+      'keywords',
+      'repository',
+      'license',
+    ]);
+  });
+
+  it('does not mutate values', () => {
+    const input = {
+      name: '@bigcommerce/catalyst-core',
+      scripts: { build: 'next build' },
+      dependencies: { next: '^15.0.0' },
+    };
+
+    const result = sortPackageJsonFields(input);
+
+    expect(result.scripts).toEqual({ build: 'next build' });
+    expect(result.dependencies).toEqual({ next: '^15.0.0' });
+    expect(result.name).toBe('@bigcommerce/catalyst-core');
+  });
+
+  it('handles an empty object', () => {
+    expect(sortPackageJsonFields({})).toEqual({});
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/sort-package-json.ts b/packages/catalyst/src/cli/lib/sort-package-json.ts
new file mode 100644
index 0000000000..56b49fd17b
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/sort-package-json.ts
@@ -0,0 +1,32 @@
+// Canonical order for top-level fields in core/package.json. Anything not in
+// this list is appended afterwards in its original position relative to other
+// unknown keys, so we don't drop or reshuffle uncommon fields like `keywords`.
+const FIELD_ORDER = [
+  'name',
+  'description',
+  'version',
+  'private',
+  'engines',
+  'scripts',
+  'dependencies',
+  'devDependencies',
+] as const;
+
+export function sortPackageJsonFields<T extends Record<string, unknown>>(pkg: T): T {
+  const ordered: Record<string, unknown> = {};
+
+  FIELD_ORDER.forEach((field) => {
+    if (field in pkg) {
+      ordered[field] = pkg[field];
+    }
+  });
+
+  Object.keys(pkg).forEach((key) => {
+    if (!(key in ordered)) {
+      ordered[key] = pkg[key];
+    }
+  });
+
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  return ordered as T;
+}
diff --git a/packages/catalyst/src/cli/lib/telemetry.spec.ts b/packages/catalyst/src/cli/lib/telemetry.spec.ts
new file mode 100644
index 0000000000..2d05961731
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/telemetry.spec.ts
@@ -0,0 +1,59 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+
+vi.unmock('./telemetry');
+
+// eslint-disable-next-line import/dynamic-import-chunkname
+const { Telemetry, getTelemetry, resetTelemetry } = await import('./telemetry');
+
+beforeEach(() => {
+  resetTelemetry();
+});
+
+afterEach(() => {
+  resetTelemetry();
+});
+
+describe('Telemetry', () => {
+  test('correlationId is a valid UUID', () => {
+    const telemetry = new Telemetry();
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+    expect(telemetry.correlationId).toMatch(uuidRegex);
+  });
+
+  test('commandName defaults to unknown', () => {
+    const telemetry = new Telemetry();
+
+    expect(telemetry.commandName).toBe('unknown');
+  });
+
+  test('durationMs returns elapsed time', async () => {
+    const telemetry = new Telemetry();
+
+    await new Promise((resolve) => {
+      setTimeout(resolve, 50);
+    });
+
+    expect(telemetry.durationMs()).toBeGreaterThanOrEqual(40);
+  });
+});
+
+describe('getTelemetry', () => {
+  test('returns same instance on repeated calls', () => {
+    const first = getTelemetry();
+    const second = getTelemetry();
+
+    expect(first).toBe(second);
+  });
+
+  test('resetTelemetry causes fresh instance', () => {
+    const first = getTelemetry();
+
+    resetTelemetry();
+
+    const second = getTelemetry();
+
+    expect(first).not.toBe(second);
+    expect(first.correlationId).not.toBe(second.correlationId);
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/telemetry.ts b/packages/catalyst/src/cli/lib/telemetry.ts
index b6480edd98..6c74e2a96d 100644
--- a/packages/catalyst/src/cli/lib/telemetry.ts
+++ b/packages/catalyst/src/cli/lib/telemetry.ts
@@ -1,19 +1,21 @@
 import { Analytics } from '@segment/analytics-node';
 import Conf from 'conf';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 
 import PACKAGE_INFO from '../../../package.json';
 
-import { getProjectConfig, ProjectConfigSchema } from './project-config';
+import { getUserConfig, UserConfigSchema } from './user-config';
 
 const TELEMETRY_KEY_ENABLED = 'telemetry.enabled';
 const TELEMETRY_KEY_ID = `telemetry.anonymousId`;
 
 export class Telemetry {
-  readonly sessionId: string;
+  readonly correlationId: string;
   readonly analytics: Analytics;
+  readonly startTime: number;
+  commandName = 'unknown';
 
-  private projectConfig: Conf<ProjectConfigSchema>;
+  private userConfig: Conf<UserConfigSchema>;
   private CATALYST_TELEMETRY_DISABLED: string | undefined;
 
   private readonly projectName = 'catalyst-cli';
@@ -22,14 +24,19 @@ export class Telemetry {
   constructor() {
     this.CATALYST_TELEMETRY_DISABLED = process.env.CATALYST_TELEMETRY_DISABLED;
 
-    this.projectConfig = getProjectConfig();
+    this.userConfig = getUserConfig();
 
-    this.sessionId = randomBytes(32).toString('hex');
+    this.correlationId = randomUUID();
+    this.startTime = Date.now();
     this.analytics = new Analytics({
       writeKey: process.env.CLI_SEGMENT_WRITE_KEY ?? 'not-a-valid-segment-write-key',
     });
   }
 
+  durationMs(): number {
+    return Date.now() - this.startTime;
+  }
+
   async track(eventName: string, payload: Record<string, unknown>) {
     if (!this.isEnabled()) {
       return Promise.resolve(undefined);
@@ -40,7 +47,11 @@ export class Telemetry {
       anonymousId: this.getAnonymousId(),
       properties: {
         ...payload,
-        sessionId: this.sessionId,
+        correlationId: this.correlationId,
+        nodeVersion: process.version,
+        platform: process.platform,
+        arch: process.arch,
+        cliVersion: PACKAGE_INFO.version,
       },
       context: {
         app: {
@@ -75,18 +86,18 @@ export class Telemetry {
   setEnabled = (_enabled: boolean) => {
     const enabled = Boolean(_enabled);
 
-    this.projectConfig.set('telemetry.enabled', enabled);
+    this.userConfig.set('telemetry.enabled', enabled);
   };
 
   isEnabled() {
     return (
       !this.CATALYST_TELEMETRY_DISABLED &&
-      this.projectConfig.get<typeof TELEMETRY_KEY_ENABLED, boolean>(TELEMETRY_KEY_ENABLED, true)
+      this.userConfig.get<typeof TELEMETRY_KEY_ENABLED, boolean>(TELEMETRY_KEY_ENABLED, true)
     );
   }
 
   private getAnonymousId(): string {
-    const val = this.projectConfig.get<typeof TELEMETRY_KEY_ID, string>(TELEMETRY_KEY_ID);
+    const val = this.userConfig.get<typeof TELEMETRY_KEY_ID, string>(TELEMETRY_KEY_ID);
 
     if (val) {
       return val;
@@ -94,8 +105,22 @@ export class Telemetry {
 
     const generated = randomBytes(32).toString('hex');
 
-    this.projectConfig.set(TELEMETRY_KEY_ID, generated);
+    this.userConfig.set(TELEMETRY_KEY_ID, generated);
 
     return generated;
   }
 }
+
+let telemetryInstance: Telemetry | undefined;
+
+// Singleton so the pre-hook, post-hook, error handler, and command bodies all
+// share one correlationId. resetTelemetry() is for test isolation.
+export function getTelemetry(): Telemetry {
+  telemetryInstance ??= new Telemetry();
+
+  return telemetryInstance;
+}
+
+export function resetTelemetry(): void {
+  telemetryInstance = undefined;
+}
diff --git a/packages/catalyst/src/cli/lib/user-config.ts b/packages/catalyst/src/cli/lib/user-config.ts
new file mode 100644
index 0000000000..2fb7f48ebe
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/user-config.ts
@@ -0,0 +1,36 @@
+import Conf from 'conf';
+
+export interface UserConfigSchema {
+  telemetry: {
+    enabled: boolean;
+    anonymousId: string;
+  };
+}
+
+let userConfigInstance: Conf<UserConfigSchema> | undefined;
+
+// User-scoped config (per-machine, not per-project). Lives in the OS config dir
+// — keeping telemetry out of the user's working directory so commands like
+// `catalyst create` don't drop a stray `.bigcommerce/` next to where they're run.
+export function getUserConfig(): Conf<UserConfigSchema> {
+  userConfigInstance ??= new Conf<UserConfigSchema>({
+    projectName: 'catalyst-cli',
+    projectSuffix: '',
+    configName: 'config',
+    schema: {
+      telemetry: {
+        type: 'object',
+        properties: {
+          enabled: { type: 'boolean' },
+          anonymousId: { type: 'string' },
+        },
+      },
+    },
+  });
+
+  return userConfigInstance;
+}
+
+export function resetUserConfig(): void {
+  userConfigInstance = undefined;
+}
diff --git a/packages/catalyst/src/cli/lib/wrangler-config.spec.ts b/packages/catalyst/src/cli/lib/wrangler-config.spec.ts
index 09f4673e0b..daa854696a 100644
--- a/packages/catalyst/src/cli/lib/wrangler-config.spec.ts
+++ b/packages/catalyst/src/cli/lib/wrangler-config.spec.ts
@@ -1,12 +1,26 @@
 import { expect, test } from 'vitest';
 
-import { getWranglerConfig } from './wrangler-config';
+import { getCompatibilityDate, getWranglerConfig } from './wrangler-config';
 
 test('returns a config with name identical to worker self reference service', () => {
-  const config = getWranglerConfig('uuid', 'kv-namespace-id');
+  const config = getWranglerConfig('uuid');
 
   expect(config.name).toBe(`project-uuid`);
   expect(
     config.services.find((service) => service.binding === 'WORKER_SELF_REFERENCE')?.service,
   ).toBe(`project-uuid`);
 });
+
+test('compatibility date is one month before the given date', () => {
+  expect(getCompatibilityDate(new Date('2026-06-11T15:00:00Z'))).toBe('2026-05-11');
+});
+
+test('compatibility date handles month-end normalization', () => {
+  // May 31 minus one month lands in early May (no April 31), still a valid date.
+  expect(getCompatibilityDate(new Date('2026-05-31T12:00:00Z'))).toBe('2026-05-01');
+  expect(getCompatibilityDate(new Date('2026-01-15T00:00:00Z'))).toBe('2025-12-15');
+});
+
+test('config uses a YYYY-MM-DD compatibility date', () => {
+  expect(getWranglerConfig('uuid').compatibility_date).toMatch(/^\d{4}-\d{2}-\d{2}$/u);
+});
diff --git a/packages/catalyst/src/cli/lib/wrangler-config.ts b/packages/catalyst/src/cli/lib/wrangler-config.ts
index 14ec6512e1..ca12b3d46e 100644
--- a/packages/catalyst/src/cli/lib/wrangler-config.ts
+++ b/packages/catalyst/src/cli/lib/wrangler-config.ts
@@ -1,9 +1,27 @@
-export function getWranglerConfig(projectUuid: string, kvNamespaceId: string) {
+// The compatibility date, compatibility flags, Durable Object classes, and
+// migration tag below are mirrored in Ignition, which builds its own Worker
+// metadata at deploy time (pkg/cloudflare/upload/metadata.go and
+// pkg/cloudflare/upload/migrations/migrations.go). Keep both sides in sync
+// when changing any of them.
+export function getCompatibilityDate(now = new Date()): string {
+  const date = new Date(now);
+
+  // One month behind the current date: recent enough to track Cloudflare
+  // runtime behavior (per Cloudflare guidance), buffered enough to avoid
+  // brand-new compatibility-date-gated changes. Ignition applies the same
+  // offset at deploy time, so the bundle is never built against newer
+  // semantics than it runs under.
+  date.setUTCMonth(date.getUTCMonth() - 1);
+
+  return date.toISOString().slice(0, 10);
+}
+
+export function getWranglerConfig(projectUuid: string) {
   return {
     $schema: 'node_modules/wrangler/config-schema.json',
     main: '../.open-next/worker.js',
     name: `project-${projectUuid}`,
-    compatibility_date: '2025-07-15',
+    compatibility_date: getCompatibilityDate(),
     compatibility_flags: ['nodejs_compat', 'global_fetch_strictly_public'],
     observability: {
       enabled: true,
@@ -24,10 +42,10 @@ export function getWranglerConfig(projectUuid: string, kvNamespaceId: string) {
         service: `project-${projectUuid}`,
       },
     ],
-    kv_namespaces: [
+    r2_buckets: [
       {
-        binding: 'NEXT_INC_CACHE_KV',
-        id: kvNamespaceId,
+        binding: 'NEXT_INC_CACHE_R2_BUCKET',
+        bucket_name: `project-${projectUuid}`,
       },
     ],
     durable_objects: {
diff --git a/packages/catalyst/src/cli/lib/write-env.spec.ts b/packages/catalyst/src/cli/lib/write-env.spec.ts
new file mode 100644
index 0000000000..55bd3170ce
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/write-env.spec.ts
@@ -0,0 +1,209 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { writeEnv } from './write-env';
+
+// A trimmed-down stand-in for core/.env.example: one blank documented key, one
+// documented key with a default value, each with its own leading comment block.
+const EXAMPLE = `# Store hash comment.
+BIGCOMMERCE_STORE_HASH=
+
+# Channel id comment.
+BIGCOMMERCE_CHANNEL_ID=1
+
+# Admin route comment.
+ENABLE_ADMIN_ROUTE=true
+`;
+
+let projectDir: string;
+
+const writeExample = (contents: string) => {
+  writeFileSync(join(projectDir, '.env.example'), contents);
+};
+
+const writeLocal = (contents: string) => {
+  writeFileSync(join(projectDir, '.env.local'), contents);
+};
+
+const readLocal = () => readFileSync(join(projectDir, '.env.local'), 'utf-8');
+
+beforeEach(() => {
+  projectDir = mkdtempSync(join(tmpdir(), 'catalyst-write-env-test-'));
+});
+
+afterEach(() => {
+  rmSync(projectDir, { recursive: true, force: true });
+});
+
+describe('writeEnv', () => {
+  it('follows .env.example ordering and preserves each key comment block', () => {
+    writeExample(EXAMPLE);
+
+    writeEnv(projectDir, {
+      BIGCOMMERCE_STORE_HASH: 'abc123',
+      BIGCOMMERCE_CHANNEL_ID: '42',
+    });
+
+    expect(readLocal()).toBe(
+      `# Store hash comment.
+BIGCOMMERCE_STORE_HASH=abc123
+
+# Channel id comment.
+BIGCOMMERCE_CHANNEL_ID=42
+
+# Admin route comment.
+ENABLE_ADMIN_ROUTE=true
+`,
+    );
+  });
+
+  it('renders documented keys that were not supplied using the example line', () => {
+    writeExample(EXAMPLE);
+
+    // Only supply the store hash — the other two keep the example's own line, so
+    // the blank placeholder and the `=1` default both survive.
+    writeEnv(projectDir, { BIGCOMMERCE_STORE_HASH: 'abc123' });
+
+    const local = readLocal();
+
+    expect(local).toContain('BIGCOMMERCE_STORE_HASH=abc123');
+    expect(local).toContain('BIGCOMMERCE_CHANNEL_ID=1');
+    expect(local).toContain('ENABLE_ADMIN_ROUTE=true');
+  });
+
+  it('appends keys not present in .env.example in a separated trailing section', () => {
+    writeExample(EXAMPLE);
+
+    writeEnv(projectDir, {
+      BIGCOMMERCE_STORE_HASH: 'abc123',
+      CATALYST_ACCESS_TOKEN: 'tok_secret',
+    });
+
+    expect(readLocal()).toBe(
+      `# Store hash comment.
+BIGCOMMERCE_STORE_HASH=abc123
+
+# Channel id comment.
+BIGCOMMERCE_CHANNEL_ID=1
+
+# Admin route comment.
+ENABLE_ADMIN_ROUTE=true
+
+# Additional variables set by the Catalyst CLI (not in .env.example).
+CATALYST_ACCESS_TOKEN=tok_secret
+`,
+    );
+  });
+
+  it('preserves existing user values that the CLI does not supply on a re-run', () => {
+    writeExample(EXAMPLE);
+    writeLocal(
+      `BIGCOMMERCE_STORE_HASH=old_hash
+BIGCOMMERCE_CHANNEL_ID=7
+ENABLE_ADMIN_ROUTE=false
+`,
+    );
+
+    // Re-link a channel: only the channel-specific keys are supplied.
+    writeEnv(projectDir, {
+      BIGCOMMERCE_STORE_HASH: 'new_hash',
+      BIGCOMMERCE_CHANNEL_ID: '9',
+    });
+
+    const local = readLocal();
+
+    // Supplied keys are updated in place...
+    expect(local).toContain('BIGCOMMERCE_STORE_HASH=new_hash');
+    expect(local).toContain('BIGCOMMERCE_CHANNEL_ID=9');
+    // ...while the user's untouched value is preserved (not reset to default).
+    expect(local).toContain('ENABLE_ADMIN_ROUTE=false');
+  });
+
+  it('does not clobber an existing value when the CLI supplies an empty placeholder', () => {
+    // The channel init API returns blank placeholders for keys it does not own
+    // (e.g. MAKESWIFT_SITE_API_KEY). Those must not wipe a value the user
+    // already set on disk.
+    writeExample(`# Store hash comment.
+BIGCOMMERCE_STORE_HASH=
+
+# Makeswift comment.
+MAKESWIFT_SITE_API_KEY=
+`);
+    writeLocal(`BIGCOMMERCE_STORE_HASH=old_hash
+MAKESWIFT_SITE_API_KEY=user_makeswift_key
+`);
+
+    writeEnv(projectDir, {
+      BIGCOMMERCE_STORE_HASH: 'new_hash',
+      MAKESWIFT_SITE_API_KEY: '',
+    });
+
+    const local = readLocal();
+
+    expect(local).toContain('BIGCOMMERCE_STORE_HASH=new_hash');
+    // The empty CLI value falls back to the user's existing value.
+    expect(local).toContain('MAKESWIFT_SITE_API_KEY=user_makeswift_key');
+  });
+
+  it('reconciles a stale .env.local by inserting a newly documented key in canonical position', () => {
+    // The existing file predates ENABLE_ADMIN_ROUTE being documented and also
+    // carries an unknown key the user added by hand.
+    writeExample(EXAMPLE);
+    writeLocal(
+      `BIGCOMMERCE_STORE_HASH=abc123
+BIGCOMMERCE_CHANNEL_ID=1
+MY_CUSTOM_KEY=custom_value
+`,
+    );
+
+    writeEnv(projectDir, {});
+
+    expect(readLocal()).toBe(
+      `# Store hash comment.
+BIGCOMMERCE_STORE_HASH=abc123
+
+# Channel id comment.
+BIGCOMMERCE_CHANNEL_ID=1
+
+# Admin route comment.
+ENABLE_ADMIN_ROUTE=true
+
+# Additional variables set by the Catalyst CLI (not in .env.example).
+MY_CUSTOM_KEY=custom_value
+`,
+    );
+  });
+
+  it('preserves the ordering of existing unknown keys ahead of newly supplied ones', () => {
+    writeExample(EXAMPLE);
+    writeLocal(
+      `EXISTING_UNKNOWN_A=a
+EXISTING_UNKNOWN_B=b
+`,
+    );
+
+    writeEnv(projectDir, { NEW_UNKNOWN: 'c' });
+
+    const local = readLocal();
+    const indexA = local.indexOf('EXISTING_UNKNOWN_A=a');
+    const indexB = local.indexOf('EXISTING_UNKNOWN_B=b');
+    const indexNew = local.indexOf('NEW_UNKNOWN=c');
+
+    expect(indexA).toBeGreaterThan(-1);
+    expect(indexB).toBeGreaterThan(indexA);
+    expect(indexNew).toBeGreaterThan(indexB);
+  });
+
+  it('falls back to a flat merge when .env.example is absent', () => {
+    writeLocal(`EXISTING=keep\n`);
+
+    writeEnv(projectDir, { SUPPLIED: 'value' });
+
+    const local = readLocal();
+
+    expect(local).toContain('EXISTING=keep');
+    expect(local).toContain('SUPPLIED=value');
+  });
+});
diff --git a/packages/catalyst/src/cli/lib/write-env.ts b/packages/catalyst/src/cli/lib/write-env.ts
new file mode 100644
index 0000000000..c36aa44eb6
--- /dev/null
+++ b/packages/catalyst/src/cli/lib/write-env.ts
@@ -0,0 +1,124 @@
+import { outputFileSync } from 'fs-extra/esm';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Matches an "active" env assignment — `KEY=VALUE` that isn't commented out.
+// The value is captured greedily (and may be empty) so blank documented keys
+// like `KEY=` still parse and `KEY=a=b` keeps the full value.
+const ACTIVE_KEY_LINE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+
+const keyFromLine = (line: string): string | null => {
+  const match = ACTIVE_KEY_LINE.exec(line);
+
+  return match ? match[1] : null;
+};
+
+// Parse a .env-style body into an ordered KEY -> VALUE map, skipping comments
+// and blank lines. Last assignment wins, matching dotenv semantics.
+const parseEnvValues = (contents: string): Map<string, string> => {
+  const values = new Map<string, string>();
+
+  contents.split('\n').forEach((line) => {
+    const match = ACTIVE_KEY_LINE.exec(line);
+
+    if (match) {
+      values.set(match[1], match[2]);
+    }
+  });
+
+  return values;
+};
+
+// Writes .env.local at the project root — Next.js (and all the catalyst CLI
+// commands) read env vars from there, since the extracted project is the package
+// they run inside.
+//
+// `.env.example` (shipped with the scaffolded project) is the source of truth
+// for shape: the generated `.env.local` mirrors its ordering and per-key comment
+// blocks so the file stays self-documenting. Values supplied by the CLI are
+// substituted in place; documented keys we weren't given keep the example's own
+// line (blank or default) so the user still sees what's expected. Any existing
+// `.env.local` is reconciled rather than clobbered — the user's current values
+// are preserved unless the CLI is explicitly supplying a new one.
+export const writeEnv = (projectDir: string, envVars: Record<string, string>) => {
+  const examplePath = join(projectDir, '.env.example');
+  const localPath = join(projectDir, '.env.local');
+
+  const existingLocal = existsSync(localPath)
+    ? parseEnvValues(readFileSync(localPath, 'utf-8'))
+    : new Map<string, string>();
+
+  // CLI-supplied vars win over what's already on disk so a re-run (e.g.
+  // `channel link`) updates credentials in place; anything the CLI didn't touch
+  // falls back to the user's existing value. An empty CLI value is treated as
+  // "not supplied" — the channel init API returns blank placeholders for keys it
+  // doesn't own (e.g. MAKESWIFT_SITE_API_KEY), and those must not clobber a real
+  // value the user already has on disk.
+  const resolve = (key: string): string | undefined => {
+    if (key in envVars && envVars[key] !== '') {
+      return envVars[key];
+    }
+
+    return existingLocal.get(key);
+  };
+
+  // Without a template we can't follow the documented ordering/comments, so fall
+  // back to a flat merge that still preserves the user's existing values.
+  if (!existsSync(examplePath)) {
+    const keys = [...new Set([...existingLocal.keys(), ...Object.keys(envVars)])];
+
+    outputFileSync(localPath, `${keys.map((key) => `${key}=${resolve(key) ?? ''}`).join('\n')}\n`);
+
+    return;
+  }
+
+  // Drop a single trailing newline before splitting so we don't reproduce a
+  // spurious blank line; the final `join` re-adds exactly one.
+  const exampleLines = readFileSync(examplePath, 'utf-8').replace(/\n$/, '').split('\n');
+  const exampleKeys = new Set<string>();
+
+  const lines = exampleLines.map((line) => {
+    const key = keyFromLine(line);
+
+    // Comments and blank lines are copied verbatim, preserving each key's
+    // leading comment block.
+    if (key === null) {
+      return line;
+    }
+
+    exampleKeys.add(key);
+
+    const value = resolve(key);
+
+    // Documented keys without a value keep the example's own line so defaults
+    // (e.g. `BIGCOMMERCE_CHANNEL_ID=1`) and blank placeholders survive.
+    return value === undefined ? line : `${key}=${value}`;
+  });
+
+  // Keys the CLI supplied — or the user already had — that the template doesn't
+  // document get appended in a clearly separated section, preserving the order
+  // they were first seen (existing keys first, then newly supplied ones).
+  const extraKeys: string[] = [];
+
+  [...existingLocal.keys()].forEach((key) => {
+    if (!exampleKeys.has(key)) {
+      extraKeys.push(key);
+    }
+  });
+
+  Object.keys(envVars).forEach((key) => {
+    if (!exampleKeys.has(key) && !extraKeys.includes(key)) {
+      extraKeys.push(key);
+    }
+  });
+
+  if (extraKeys.length > 0) {
+    lines.push('', '# Additional variables set by the Catalyst CLI (not in .env.example).');
+
+    extraKeys.forEach((key) => {
+      lines.push(`${key}=${resolve(key) ?? ''}`);
+    });
+  }
+
+  outputFileSync(localPath, `${lines.join('\n')}\n`);
+};
diff --git a/packages/catalyst/src/cli/program.ts b/packages/catalyst/src/cli/program.ts
index 4a99a17ac5..108c7103b4 100644
--- a/packages/catalyst/src/cli/program.ts
+++ b/packages/catalyst/src/cli/program.ts
@@ -1,44 +1,62 @@
 import { Command } from 'commander';
 import { colorize } from 'consola/utils';
-import { config } from 'dotenv';
-import { resolve } from 'node:path';
 
 import PACKAGE_INFO from '../../package.json';
 
+import { auth } from './commands/auth';
 import { build } from './commands/build';
+import { channel } from './commands/channel';
+import { create } from './commands/create';
+import { debug } from './commands/debug';
 import { deploy } from './commands/deploy';
-import { dev } from './commands/dev';
+import { domains } from './commands/domains';
+import { env } from './commands/env';
+import { logs } from './commands/logs';
 import { project } from './commands/project';
 import { start } from './commands/start';
 import { telemetry } from './commands/telemetry';
+import { upgrade } from './commands/upgrade';
 import { version } from './commands/version';
 import { telemetryPostHook, telemetryPreHook } from './hooks/telemetry';
 import { consola } from './lib/logger';
 
-export const program = new Command();
+// Env files are only loaded by `build` and `deploy` (which auto-load
+// .env.local and .env, or an explicit `--env-path`). No other command reads env
+// files, so running the CLI can't be surprised by a stray `.env.local` on disk.
+
+// CATALYST_STORE_HASH falls back to BIGCOMMERCE_STORE_HASH so freshly-scaffolded
+// projects work without duplicating the same value under two names. Aliasing
+// here means every command's `.env('CATALYST_STORE_HASH')` binding picks it up
+// without per-command changes.
+if (!process.env.CATALYST_STORE_HASH && process.env.BIGCOMMERCE_STORE_HASH) {
+  process.env.CATALYST_STORE_HASH = process.env.BIGCOMMERCE_STORE_HASH;
+}
 
-config({
-  path: [
-    resolve(process.cwd(), '.env'),
-    resolve(process.cwd(), '.env.local'),
-    // Assumes the parent directory is the monorepo root:
-    resolve(process.cwd(), '..', '.env'),
-    resolve(process.cwd(), '..', '.env.local'),
-  ],
-});
+export const program = new Command();
 
 consola.log(colorize('cyanBright', `◢ ${PACKAGE_INFO.name} v${PACKAGE_INFO.version}\n`));
 
 program
   .name(PACKAGE_INFO.name)
   .version(PACKAGE_INFO.version)
-  .description('CLI tool for Catalyst development')
+  .summary('CLI tool for Catalyst development')
+  .description(
+    'CLI tool for Catalyst development.\n\nConfiguration priority: flags > process.env > .bigcommerce/project.json. `build` and `deploy` additionally load env files (--env-path, or an auto-loaded .env.local/.env) for the build.\n\nCATALYST_STORE_HASH falls back to BIGCOMMERCE_STORE_HASH if unset.\n\nRun `catalyst <command> --help` for details on a specific command.',
+  )
+  .configureHelp({ showGlobalOptions: true })
   .addCommand(version)
-  .addCommand(dev)
+  .addCommand(create)
   .addCommand(start)
   .addCommand(build)
   .addCommand(deploy)
+  .addCommand(domains)
+  .addCommand(logs)
   .addCommand(project)
+  .addCommand(env)
+  .addCommand(channel)
+  .addCommand(auth)
+  .addCommand(upgrade)
   .addCommand(telemetry)
+  .addCommand(debug)
   .hook('preAction', telemetryPreHook)
   .hook('postAction', telemetryPostHook);
diff --git a/packages/catalyst/templates/open-next.config.ts b/packages/catalyst/templates/open-next.config.ts
index b0b2d67a5f..2099c83800 100644
--- a/packages/catalyst/templates/open-next.config.ts
+++ b/packages/catalyst/templates/open-next.config.ts
@@ -1,20 +1,26 @@
 import { defineCloudflareConfig, type OpenNextConfig } from '@opennextjs/cloudflare';
 import { purgeCache } from '@opennextjs/cloudflare/overrides/cache-purge/index';
-import kvIncrementalCache from '@opennextjs/cloudflare/overrides/incremental-cache/kv-incremental-cache';
+import r2IncrementalCache from '@opennextjs/cloudflare/overrides/incremental-cache/r2-incremental-cache';
+import { withRegionalCache } from '@opennextjs/cloudflare/overrides/incremental-cache/regional-cache';
 import doQueue from '@opennextjs/cloudflare/overrides/queue/do-queue';
 import queueCache from '@opennextjs/cloudflare/overrides/queue/queue-cache';
 import doShardedTagCache from '@opennextjs/cloudflare/overrides/tag-cache/do-sharded-tag-cache';
 
 const cloudflareConfig = defineCloudflareConfig({
-  incrementalCache: kvIncrementalCache,
+  incrementalCache: withRegionalCache(r2IncrementalCache, {
+    mode: 'long-lived',
+    bypassTagCacheOnCacheHit: true,
+  }),
   queue: queueCache(doQueue, {
     regionalCacheTtlSec: 5,
+    waitForQueueAck: true,
   }),
   routePreloadingBehavior: 'withWaitUntil',
   tagCache: doShardedTagCache({
     baseShardSize: 12,
     regionalCache: true,
     regionalCacheTtlSec: 5,
+    regionalCacheDangerouslyPersistMissingTags: true,
     shardReplication: {
       numberOfSoftReplicas: 4,
       numberOfHardReplicas: 2,
diff --git a/packages/catalyst/templates/public_headers b/packages/catalyst/templates/public_headers
new file mode 100644
index 0000000000..e6320ab147
--- /dev/null
+++ b/packages/catalyst/templates/public_headers
@@ -0,0 +1,2 @@
+/_next/static/*
+  Cache-Control: public,max-age=31536000,immutable
\ No newline at end of file
diff --git a/packages/catalyst/tests/mocks/handlers.ts b/packages/catalyst/tests/mocks/handlers.ts
index a2a46c3b42..1c335ac3be 100644
--- a/packages/catalyst/tests/mocks/handlers.ts
+++ b/packages/catalyst/tests/mocks/handlers.ts
@@ -25,12 +25,94 @@ export const handlers = [
     }),
   ),
 
+  // Handler for createDomain
+  http.post(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+    async ({ request }) => {
+      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+      const body = (await request.json()) as { domain: string };
+
+      return HttpResponse.json(
+        {
+          data: {
+            domain: body.domain,
+            project_uuid: '6b202364-10f3-11f1-8bc7-fe9b9d8b14ab',
+            verification_status: 'pending',
+          },
+        },
+        { status: 201 },
+      );
+    },
+  ),
+
+  // Handler for listDomains
+  http.get(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains',
+    ({ params }) =>
+      HttpResponse.json({
+        data: [
+          {
+            domain: 'www.example.com',
+            project_uuid: params.projectUuid,
+            verification_status: 'pending',
+          },
+          {
+            domain: 'shop.example.com',
+            project_uuid: params.projectUuid,
+            verification_status: 'verified',
+          },
+        ],
+      }),
+  ),
+
+  // Handler for getDomain
+  http.get(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+    ({ params }) =>
+      HttpResponse.json({
+        data: {
+          domain: params.domain,
+          project_uuid: params.projectUuid,
+          verification_status: 'verified',
+        },
+      }),
+  ),
+
+  // Handler for deleteDomain
+  http.delete(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain',
+    () => new HttpResponse(null, { status: 204 }),
+  ),
+
+  // Handler for claimDomain
+  http.post(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/claim',
+    () => new HttpResponse(null, { status: 204 }),
+  ),
+
+  // Handler for transferDomain
+  http.post(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid/domains/:domain/transfer',
+    () => new HttpResponse(null, { status: 204 }),
+  ),
+
   // Handler for fetchProjects
   http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
     HttpResponse.json({
       data: [
-        { uuid: 'a23f5785-fd99-4a94-9fb3-945551623923', name: 'Project One' },
-        { uuid: 'b23f5785-fd99-4a94-9fb3-945551623924', name: 'Project Two' },
+        {
+          uuid: 'a23f5785-fd99-4a94-9fb3-945551623923',
+          name: 'Project One',
+          deployment_hostnames: [
+            'project-one.catalyst-sandbox.store',
+            'vanity.project-one.example.com',
+          ],
+        },
+        {
+          uuid: 'b23f5785-fd99-4a94-9fb3-945551623924',
+          name: 'Project Two',
+          deployment_hostnames: [],
+        },
       ],
     }),
   ),
@@ -44,14 +126,14 @@ export const handlers = [
           controller.enqueue(
             encoder.encode(
               // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-              `data: {"deployment_status":"in_progress","deployment_uuid":"${params.deploymentUuid}","event":{"step":"processing","progress":75}}`,
+              `data: {"deployment_status":"in_progress","deployment_uuid":"${params.deploymentUuid}","event":{"step":"processing","progress":75},"deployment_hostnames":[]}`,
             ),
           );
           setTimeout(() => {
             controller.enqueue(
               encoder.encode(
                 // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-                `data: {"deployment_status":"in_progress","deployment_uuid":"${params.deploymentUuid}","event":{"step":"finalizing","progress":99}}`,
+                `data: {"deployment_status":"in_progress","deployment_uuid":"${params.deploymentUuid}","event":{"step":"finalizing","progress":99},"deployment_hostnames":[]}`,
               ),
             );
           }, 10);
@@ -59,7 +141,7 @@ export const handlers = [
             controller.enqueue(
               encoder.encode(
                 // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-                `data: {"deployment_status":"completed","deployment_uuid":"${params.deploymentUuid}","event":null}`,
+                `data: {"deployment_status":"completed","deployment_uuid":"${params.deploymentUuid}","event":null,"deployment_hostnames":["example.com"]}`,
               ),
             );
             controller.close();
@@ -74,6 +156,85 @@ export const handlers = [
     },
   ),
 
+  // Handler for fetchStoreProfile (auth whoami)
+  http.get('https://:apiHost/stores/:storeHash/v3/settings/store/profile', () =>
+    HttpResponse.json({
+      data: {
+        store_name: 'Test Store',
+      },
+    }),
+  ),
+
+  // Handler for device code OAuth flow (auth login)
+  http.post('https://login.bigcommerce.com/device/token', async ({ request }) => {
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+    const body = (await request.json()) as Record<string, string>;
+
+    // Poll request (has device_code) — return credentials
+    if (body.device_code) {
+      return HttpResponse.json({
+        access_token: 'mock-access-token',
+        store_hash: 'mock-store-hash',
+        context: 'stores/mock-store-hash',
+        api_uri: 'https://api.bigcommerce.com',
+      });
+    }
+
+    // Initial request (has scopes) — return device code
+    return HttpResponse.json({
+      device_code: 'mock-device-code',
+      user_code: 'MOCK-CODE',
+      verification_uri: 'https://login.bigcommerce.com/device',
+      expires_in: 600,
+      interval: 5,
+    });
+  }),
+
+  // Handler for log tailing
+  http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid/tail', () => {
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(
+          encoder.encode(
+            'data: {"uuid":"0f258256-0a83-4704-a456-03e99b4445c2","project_uuid":"6b202364-10f3-11f1-8bc7-fe9b9d8b14ab","request":{"method":"GET","url":"https://example.com/test","status_code":200},"logs":[{"timestamp":"2026-03-11T22:05:28.870Z","level":"info","messages":["hello world"]}],"exceptions":[],"timestamp":"2026-03-11T22:05:28.870Z"}\n\n',
+          ),
+        );
+        setTimeout(() => controller.close(), 10);
+      },
+    });
+
+    return new HttpResponse(stream, {
+      status: 200,
+      headers: { 'Content-Type': 'text/event-stream' },
+    });
+  }),
+
+  http.get('https://:apiHost/stores/:storeHash/v3/infrastructure/logs/:projectUuid', () =>
+    HttpResponse.json({
+      data: [
+        {
+          id: '01HX9Z8K2J4P7Q6R3T5V8W0YN',
+          timestamp: '2026-06-01T12:34:56.789Z',
+          level: 'error',
+          messages: ['Unhandled exception while rendering /cart'],
+          is_exception: true,
+          request_id: '8f1c2d3e4b5a6978',
+          exception_name: 'TypeError',
+          request: { method: 'GET', url: '/cart', status_code: 500 },
+        },
+      ],
+      meta: {
+        cursor_pagination: {
+          count: 1,
+          per_page: 50,
+          start_cursor: 'cursor_start',
+          end_cursor: 'cursor_end',
+          links: {},
+        },
+      },
+    }),
+  ),
+
   // Handle for createProjects
   http.post('https://:apiHost/stores/:storeHash/v3/infrastructure/projects', () =>
     HttpResponse.json({
@@ -85,4 +246,64 @@ export const handlers = [
       },
     }),
   ),
+
+  // Handler for deleteProject
+  http.delete(
+    'https://:apiHost/stores/:storeHash/v3/infrastructure/projects/:projectUuid',
+    () => new HttpResponse(null, { status: 204 }),
+  ),
+
+  // Default handler for fetchAvailableChannels — returns two storefront
+  // channels so the picker has something to render. Tests that need an
+  // empty list or different channel shapes should override with `server.use(...)`.
+  http.get('https://:apiHost/stores/:storeHash/v3/channels', () =>
+    HttpResponse.json({
+      data: [
+        { id: 1, name: 'Default Storefront', platform: 'bigcommerce' },
+        { id: 2, name: 'Catalyst Storefront', platform: 'catalyst' },
+      ],
+    }),
+  ),
+
+  // Default handler for checkChannelEligibility — eligible by default. Tests
+  // covering the ineligible path should override with `server.use(...)`.
+  http.get('https://:apiHost/stores/:storeHash/cli-api/v3/channels/catalyst/eligibility', () =>
+    HttpResponse.json({ data: { eligible: true, message: 'Eligible.' } }),
+  ),
+
+  // Default handler for createChannel — returns a freshly-created Catalyst
+  // channel with its storefront token and env vars.
+  http.post('https://:apiHost/stores/:storeHash/cli-api/v3/channels/catalyst', () =>
+    HttpResponse.json({
+      data: {
+        id: 42,
+        storefront_api_token: 'new-sft-token',
+        envVars: {
+          BIGCOMMERCE_STORE_HASH: 'test-store',
+          BIGCOMMERCE_CHANNEL_ID: '42',
+          BIGCOMMERCE_STOREFRONT_TOKEN: 'new-sft-token',
+        },
+      },
+    }),
+  ),
+
+  // Default handler for getAvailableLocales — the channel-creation flow reads
+  // this to populate the language pickers.
+  http.get('https://:apiHost/stores/:storeHash/v3/settings/store/available-locales', () =>
+    HttpResponse.json({
+      data: [
+        { id: 'en', name: 'English', fallback: null, is_supported: true },
+        { id: 'es', name: 'Spanish', fallback: null, is_supported: true },
+        { id: 'fr', name: 'French', fallback: null, is_supported: true },
+      ],
+    }),
+  ),
+
+  // Default handler for updateChannelSiteUrl — succeeds with a generic
+  // payload. Tests that need to assert error handling should override.
+  http.put('https://:apiHost/stores/:storeHash/v3/channels/:channelId/site', () =>
+    HttpResponse.json({
+      data: { id: 1, url: 'https://example.com', channel_id: 1 },
+    }),
+  ),
 ];
diff --git a/packages/catalyst/tsconfig.json b/packages/catalyst/tsconfig.json
index 37e0c17d44..d7bf0af065 100644
--- a/packages/catalyst/tsconfig.json
+++ b/packages/catalyst/tsconfig.json
@@ -3,6 +3,7 @@
   "display": "Node",
   "compilerOptions": {
     "strict": true,
+    "lib": ["esnext", "dom", "dom.iterable"],
     "target": "es2020",
     "module": "esnext",
     "moduleResolution": "bundler",
diff --git a/packages/catalyst/tsup.config.ts b/packages/catalyst/tsup.config.ts
index b0d6ffe955..f83dfee78f 100644
--- a/packages/catalyst/tsup.config.ts
+++ b/packages/catalyst/tsup.config.ts
@@ -11,5 +11,6 @@ export default defineConfig((options: Options) => ({
     CLI_SEGMENT_WRITE_KEY: process.env.CLI_SEGMENT_WRITE_KEY ?? 'not-a-valid-segment-write-key',
     CONSOLA_LEVEL: process.env.NODE_ENV === 'production' ? '2' : '3',
   },
+  external: ['commander', '@commander-js/extra-typings'],
   ...options,
 }));
diff --git a/packages/catalyst/vitest.setup.ts b/packages/catalyst/vitest.setup.ts
index 26c64cc33c..2a12be9d12 100644
--- a/packages/catalyst/vitest.setup.ts
+++ b/packages/catalyst/vitest.setup.ts
@@ -2,19 +2,32 @@ import { afterAll, afterEach, beforeAll, vi } from 'vitest';
 
 import { server } from './tests/mocks/node';
 
+// Default all specs to a non-interactive stdin so TTY-gated prompts don't fire
+// based on whether the test runner happens to inherit a terminal. Tests that
+// need to exercise interactive branches opt in explicitly (see the
+// `withTtyValue` helpers in the specs).
+Object.defineProperty(process.stdin, 'isTTY', { value: false, configurable: true });
+
+const mockTelemetryInstance = {
+  correlationId: 'test-session-uuid',
+  commandName: 'unknown',
+  analytics: {
+    track: vi.fn(),
+    identify: vi.fn(),
+    closeAndFlush: vi.fn().mockResolvedValue(undefined),
+  },
+  track: vi.fn().mockResolvedValue(undefined),
+  identify: vi.fn().mockResolvedValue(undefined),
+  startTime: 0,
+  durationMs: vi.fn().mockReturnValue(0),
+  setEnabled: vi.fn(),
+  isEnabled: vi.fn().mockReturnValue(false),
+};
+
 vi.mock('../src/lib/telemetry', () => ({
-  Telemetry: vi.fn().mockImplementation(() => ({
-    sessionId: 'test-session-id',
-    analytics: {
-      track: vi.fn(),
-      identify: vi.fn(),
-      closeAndFlush: vi.fn().mockResolvedValue(undefined),
-    },
-    track: vi.fn().mockResolvedValue(undefined),
-    identify: vi.fn().mockResolvedValue(undefined),
-    setEnabled: vi.fn(),
-    isEnabled: vi.fn().mockReturnValue(false),
-  })),
+  Telemetry: vi.fn().mockImplementation(() => mockTelemetryInstance),
+  getTelemetry: vi.fn(() => mockTelemetryInstance),
+  resetTelemetry: vi.fn(),
 }));
 
 beforeAll(() => server.listen());
diff --git a/packages/create-catalyst/CHANGELOG.md b/packages/create-catalyst/CHANGELOG.md
index d52035da62..15ad54d2f0 100644
--- a/packages/create-catalyst/CHANGELOG.md
+++ b/packages/create-catalyst/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## 2.0.1
+
+### Patch Changes
+
+- Updated dependencies [[`552cfb5`](https://github.com/bigcommerce/catalyst/commit/552cfb5c59a1e69b92f7018c2ddc3c9b3c5f0c61), [`9565d76`](https://github.com/bigcommerce/catalyst/commit/9565d7636de95327651af0a90ced37a352241be7), [`fea7b30`](https://github.com/bigcommerce/catalyst/commit/fea7b30bab0d1b09dc5bddbe3884317968264760), [`5ca4c61`](https://github.com/bigcommerce/catalyst/commit/5ca4c615ead79bc3bf1b7b1bc3ce1743fddeb12b), [`27373e8`](https://github.com/bigcommerce/catalyst/commit/27373e8a50c9bd0703f474364a7c269947d56179), [`b4e5952`](https://github.com/bigcommerce/catalyst/commit/b4e595210b2a38e24aac98c656581dfbd67a1c8f), [`e3e5ab2`](https://github.com/bigcommerce/catalyst/commit/e3e5ab2e3cae414e6067017b1a8939f472fa1456), [`aadaf27`](https://github.com/bigcommerce/catalyst/commit/aadaf27b72cbbf0889262a26ca44daec54bdbbb4), [`8d9f9a9`](https://github.com/bigcommerce/catalyst/commit/8d9f9a92da07d65ec8c9cc9a45ec1ffb582d96c7), [`0d42b12`](https://github.com/bigcommerce/catalyst/commit/0d42b12a59157eceba1397411de504767d7a309d), [`c1d0f3d`](https://github.com/bigcommerce/catalyst/commit/c1d0f3df789f304f8ce1aa07225cdcc5a110dfa3), [`bf58b13`](https://github.com/bigcommerce/catalyst/commit/bf58b134cd870e04ec585eec465e93ce9481d13b), [`05f600a`](https://github.com/bigcommerce/catalyst/commit/05f600a5fcee8c17927b2b56343f942a2e6d4b2c), [`ce03afb`](https://github.com/bigcommerce/catalyst/commit/ce03afb8e7ef27e4821e99f8fd4e4d94a7654922), [`07cd41c`](https://github.com/bigcommerce/catalyst/commit/07cd41cd5867fd3fc520a7a3fda752f059bf0c5a)]:
+  - @bigcommerce/catalyst@1.1.0
+
+## 2.0.0
+
+### Major Changes
+
+- [#3077](https://github.com/bigcommerce/catalyst/pull/3077) [`a45ab43`](https://github.com/bigcommerce/catalyst/commit/a45ab4346c27e8cc60d6ce64fb597f22dbde2243) Thanks [@jorgemoya](https://github.com/jorgemoya)! - Reduce `create-catalyst` to a thin wrapper that delegates to `catalyst create`. `pnpm create catalyst` / `npx create-catalyst` still scaffold a project — now by invoking `@bigcommerce/catalyst` under the hood — so the scaffolding UX is unchanged. The standalone `init`, `integration`, and `telemetry` subcommands are removed; use `catalyst channel link` and `catalyst telemetry` from the consolidated CLI instead.
+
+### Patch Changes
+
+- Updated dependencies [[`a45ab43`](https://github.com/bigcommerce/catalyst/commit/a45ab4346c27e8cc60d6ce64fb597f22dbde2243)]:
+  - @bigcommerce/catalyst@1.0.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/create-catalyst/package.json b/packages/create-catalyst/package.json
index 1a68ba4071..b99202e55c 100644
--- a/packages/create-catalyst/package.json
+++ b/packages/create-catalyst/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bigcommerce/create-catalyst",
-  "version": "1.1.0",
+  "version": "2.0.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/bigcommerce/catalyst",
@@ -23,45 +23,19 @@
     "node": "^24.0.0"
   },
   "dependencies": {
-    "@commander-js/extra-typings": "^14.0.0",
-    "@iarna/toml": "^2.2.5",
-    "@inquirer/core": "^10.1.13",
-    "@inquirer/figures": "^1.0.12",
-    "@inquirer/prompts": "^7.5.3",
-    "@inquirer/type": "^3.0.7",
-    "@segment/analytics-node": "^2.2.1",
-    "ansi-escapes": "^7.0.0",
-    "commander": "^14.0.0",
-    "conf": "^13.1.0",
-    "consola": "^3.4.2",
-    "cross-spawn": "^7.0.6",
-    "dotenv": "^16.5.0",
-    "fs-extra": "^11.3.0",
-    "giget": "^1.2.5",
-    "lodash.kebabcase": "^4.1.1",
-    "nypm": "^0.5.4",
-    "open": "^10.1.2",
-    "ora": "^8.2.0",
-    "semver": "^7.7.2",
-    "std-env": "^3.9.0",
-    "zod": "^3.25.51",
-    "zod-validation-error": "^3.4.1"
+    "@bigcommerce/catalyst": "workspace:^",
+    "semver": "^7.7.2"
   },
   "devDependencies": {
     "@bigcommerce/eslint-config": "^2.11.0",
     "@bigcommerce/eslint-config-catalyst": "workspace:^",
     "@swc/core": "^1.11.31",
     "@swc/jest": "^0.2.38",
-    "@types/cross-spawn": "^6.0.6",
-    "@types/fs-extra": "^11.0.4",
     "@types/jest": "^29.5.14",
-    "@types/lodash.kebabcase": "^4.1.9",
     "@types/node": "^22.15.30",
-    "@types/prompts": "^2.4.9",
     "@types/semver": "^7.7.0",
     "eslint": "^8.57.1",
     "jest": "^29.7.0",
-    "msw": "^2.9.0",
     "prettier": "^3.6.2",
     "tsup": "^8.5.0",
     "typescript": "^5.8.3"
diff --git a/packages/create-catalyst/src/commands/create.ts b/packages/create-catalyst/src/commands/create.ts
deleted file mode 100644
index 06665575a7..0000000000
--- a/packages/create-catalyst/src/commands/create.ts
+++ /dev/null
@@ -1,598 +0,0 @@
-import { Command, Option } from '@commander-js/extra-typings';
-import { input, select } from '@inquirer/prompts';
-import { execSync } from 'child_process';
-import { colorize } from 'consola/utils';
-import { pathExistsSync } from 'fs-extra/esm';
-import kebabCase from 'lodash.kebabcase';
-import { join } from 'path';
-
-import { multiSelect } from '../prompts/multi-select';
-import { CliApi } from '../utils/cli-api';
-import { cloneCatalyst } from '../utils/clone-catalyst';
-import { Https } from '../utils/https';
-import { installDependencies } from '../utils/install-dependencies';
-import { getAvailableLocales } from '../utils/localization';
-import { login, storeCredentials } from '../utils/login';
-import { Telemetry } from '../utils/telemetry/telemetry';
-import { writeEnv } from '../utils/write-env';
-
-interface Channel {
-  id: number;
-  name: string;
-  platform: string;
-}
-
-interface ChannelsResponse {
-  data: Channel[];
-}
-
-interface InitResponse {
-  data: {
-    makeswift_dev_api_key: string;
-    storefront_api_token: string;
-    envVars: Record<string, string>;
-  };
-}
-
-interface CreateChannelResponse {
-  data: {
-    id: number;
-    storefront_api_token: string;
-    envVars: Record<string, string>;
-  };
-}
-
-interface EligibilityResponse {
-  data: {
-    eligible: boolean;
-    message: string;
-  };
-}
-
-function getPlatformCheckCommand(command: string): string {
-  const isWindows = process.platform === 'win32';
-
-  return isWindows ? `where.exe ${command}` : `which ${command}`;
-}
-
-const telemetry = new Telemetry();
-
-async function handleChannelCreation(bc: Https, cliApi: CliApi) {
-  const newChannelName = await input({
-    message: 'What would you like to name your new channel?',
-  });
-
-  let availableLocales = [];
-
-  try {
-    availableLocales = await getAvailableLocales(bc);
-  } catch (error) {
-    if (error instanceof Error) {
-      console.error(colorize('red', error.message));
-    }
-
-    process.exit(1);
-  }
-
-  const storefrontLocale = await select({
-    message: 'Which default language would you like to set for your channel?',
-    default: 'en',
-    choices: availableLocales,
-    theme: {
-      style: {
-        help: () => colorize('dim', '(Select locale from the list or start typing the name)'),
-      },
-    },
-  });
-
-  const shouldAddAdditionalLocales = await select({
-    message: 'Would you like to add additional languages?',
-    choices: [
-      { name: 'Yes', value: true },
-      { name: 'No', value: false },
-    ],
-  });
-
-  let additionalLocales: string[] = [];
-
-  if (shouldAddAdditionalLocales) {
-    additionalLocales = await multiSelect({
-      choices: availableLocales.filter(({ value }) => value !== storefrontLocale),
-      message: 'Which additional languages would you like to add to your channel?',
-      theme: {
-        style: {
-          help: () => colorize('dim', '(Select locale from the list or start typing the name)'),
-        },
-      },
-      validate: (selections) => {
-        if (selections.length > 4) {
-          return 'You can only select up to 4 additional languages';
-        }
-
-        return true;
-      },
-    });
-  }
-
-  const shouldInstallSampleData = await select({
-    message: 'Would you like to install sample data?',
-    choices: [
-      { name: 'Yes', value: true },
-      { name: 'No', value: false },
-    ],
-  });
-
-  const response = await cliApi.createChannel(
-    newChannelName,
-    storefrontLocale,
-    additionalLocales,
-    shouldInstallSampleData,
-  );
-
-  if (!response.ok) {
-    console.error(
-      colorize(
-        'red',
-        `\nPOST /channels/catalyst failed: ${response.status} ${response.statusText}\n`,
-      ),
-    );
-    process.exit(1);
-  }
-
-  const channelData: unknown = await response.json();
-
-  if (!isCreateChannelResponse(channelData)) {
-    console.error(colorize('red', '\nUnexpected response format from create channel endpoint\n'));
-    process.exit(1);
-  }
-
-  return {
-    channelId: channelData.data.id,
-    storefrontToken: channelData.data.storefront_api_token,
-    envVars: channelData.data.envVars,
-  };
-}
-
-async function handleChannelSelection(bc: Https) {
-  const channelSortOrder = ['catalyst', 'next', 'bigcommerce'];
-  const channelsResponse = await bc.fetch('/v3/channels?available=true&type=storefront');
-
-  if (!channelsResponse.ok) {
-    console.error(
-      colorize(
-        'red',
-        `\nGET /v3/channels failed: ${channelsResponse.status} ${channelsResponse.statusText}\n`,
-      ),
-    );
-    process.exit(1);
-  }
-
-  const availableChannels: unknown = await channelsResponse.json();
-
-  if (!isChannelsResponse(availableChannels)) {
-    console.error(colorize('red', '\nUnexpected response format from channels endpoint\n'));
-    process.exit(1);
-  }
-
-  const existingChannel = await select({
-    message: 'Which channel would you like to use?',
-    choices: availableChannels.data
-      .sort((a: Channel, b: Channel) => {
-        const aIndex = channelSortOrder.indexOf(a.platform);
-        const bIndex = channelSortOrder.indexOf(b.platform);
-
-        // If both platforms are not in the sort order, maintain their original order
-        if (aIndex === -1 && bIndex === -1) {
-          return 0;
-        }
-
-        // If one platform is not in the sort order, it should go to the end
-        if (aIndex === -1) return 1;
-        if (bIndex === -1) return -1;
-
-        // If both platforms are in the sort order, use their relative positions
-        return aIndex - bIndex;
-      })
-      .map((ch: Channel) => ({
-        name: ch.name,
-        value: ch,
-        description: `Channel Platform: ${
-          ch.platform === 'bigcommerce'
-            ? 'Stencil'
-            : ch.platform.charAt(0).toUpperCase() + ch.platform.slice(1)
-        }`,
-      })),
-  });
-
-  return existingChannel.id;
-}
-
-async function getChannelInit(cliApi: CliApi, channelId: number) {
-  const initResponse = await cliApi.getChannelInit(channelId);
-
-  if (!initResponse.ok) {
-    console.error(
-      colorize(
-        'red',
-        `\nGET /channels/${channelId}/init failed: ${initResponse.status} ${initResponse.statusText}\n`,
-      ),
-    );
-    process.exit(1);
-  }
-
-  const initData: unknown = await initResponse.json();
-
-  if (!isInitResponse(initData)) {
-    console.error(colorize('red', '\nUnexpected response format from init endpoint\n'));
-    process.exit(1);
-  }
-
-  return {
-    storefrontToken: initData.data.storefront_api_token,
-    envVars: initData.data.envVars,
-  };
-}
-
-async function setupProject(options: {
-  projectName?: string;
-  projectDir: string;
-}): Promise<{ projectName: string; projectDir: string }> {
-  let { projectName, projectDir } = options;
-
-  if (!pathExistsSync(projectDir)) {
-    console.error(colorize('red', `Error: --projectDir ${projectDir} is not a valid path\n`));
-    process.exit(1);
-  }
-
-  if (projectName) {
-    projectName = kebabCase(projectName);
-    projectDir = join(options.projectDir, projectName);
-
-    if (pathExistsSync(projectDir)) {
-      console.error(colorize('red', `Error: ${projectDir} already exists\n`));
-      process.exit(1);
-    }
-  }
-
-  if (!projectName) {
-    const validateProjectName = (i: string) => {
-      const formatted = kebabCase(i);
-
-      if (!formatted) return 'Project name is required';
-
-      const targetDir = join(options.projectDir, formatted);
-
-      if (pathExistsSync(targetDir)) return `Destination '${targetDir}' already exists`;
-
-      projectName = formatted;
-      projectDir = targetDir;
-
-      return true;
-    };
-
-    await input({
-      message: 'What is the name of your project?',
-      default: 'my-catalyst-app',
-      validate: validateProjectName,
-    });
-  }
-
-  if (!projectName) throw new Error('Something went wrong, projectName is not defined');
-  if (!projectDir) throw new Error('Something went wrong, projectDir is not defined');
-
-  return { projectName, projectDir };
-}
-
-function checkRequiredTools() {
-  try {
-    execSync(getPlatformCheckCommand('git'), { stdio: 'ignore' });
-  } catch {
-    console.error(colorize('red', 'Error: git is required to create a Catalyst project\n'));
-    process.exit(1);
-  }
-
-  try {
-    execSync(getPlatformCheckCommand('pnpm'), { stdio: 'ignore' });
-  } catch {
-    console.error(colorize('red', 'Error: pnpm is required to create a Catalyst project\n'));
-    console.error('Tip: Enable it by running `corepack enable pnpm`\n');
-    process.exit(1);
-  }
-}
-
-export const create = new Command('create')
-  .description('Command to scaffold and connect a Catalyst storefront to your BigCommerce store')
-  .option('--project-name <name>', 'Name of your Catalyst project')
-  .option('--project-dir <dir>', 'Directory in which to create your project', process.cwd())
-  .option('--store-hash <hash>', 'BigCommerce store hash')
-  .option('--access-token <token>', 'BigCommerce access token')
-  .option('--channel-id <id>', 'BigCommerce channel ID')
-  .option('--storefront-token <token>', 'BigCommerce storefront token')
-  .option(
-    '--gh-ref <ref>',
-    'Clone a specific ref from the source repository',
-    '@bigcommerce/catalyst-core@latest',
-  )
-  .option('--reset-main', 'Reset the main branch to the gh-ref')
-  .option('--repository <repository>', 'GitHub repository to clone from', 'bigcommerce/catalyst')
-  .option('--env <vars...>', 'Arbitrary environment variables to set in .env.local')
-  .addOption(
-    new Option('--bigcommerce-hostname <hostname>', 'BigCommerce hostname')
-      .default('bigcommerce.com')
-      .hideHelp(),
-  )
-  .addOption(
-    new Option('--cli-api-origin <origin>', 'Catalyst CLI API origin')
-      .default('https://cxm-prd.bigcommerceapp.com')
-      .hideHelp(),
-  )
-  // eslint-disable-next-line complexity
-  .action(async (options) => {
-    const { ghRef, repository } = options;
-
-    checkRequiredTools();
-
-    const { projectName, projectDir } = await setupProject({
-      projectName: options.projectName,
-      projectDir: options.projectDir,
-    });
-
-    let storeHash = options.storeHash;
-    let accessToken = options.accessToken;
-    let channelId;
-    let storefrontToken = options.storefrontToken;
-    let credentials;
-
-    if (options.channelId) {
-      channelId = parseInt(options.channelId, 10);
-    }
-
-    let envVars: Record<string, string> = {};
-
-    // Get credentials if needed
-    if ((!storeHash || !accessToken) && (!channelId || !storefrontToken)) {
-      credentials = await login(`https://login.${options.bigcommerceHostname}`);
-      storeHash = credentials.storeHash;
-      accessToken = credentials.accessToken;
-    }
-
-    // If store hash, channel ID, and storefront token are all provided, skip channel selection/creation
-    if (storeHash && channelId && storefrontToken) {
-      envVars.BIGCOMMERCE_STORE_HASH = storeHash;
-      envVars.BIGCOMMERCE_CHANNEL_ID = channelId.toString();
-      envVars.BIGCOMMERCE_STOREFRONT_API_TOKEN = storefrontToken;
-    } else {
-      if (!storeHash || !accessToken) {
-        // Create project without credentials
-        console.log(`\nCreating '${projectName}' at '${projectDir}'\n`);
-        cloneCatalyst({ repository, projectName, projectDir, ghRef, resetMain: options.resetMain });
-        await installDependencies(projectDir);
-
-        // Add any CLI-provided env vars
-        if (options.env) {
-          const cliEnvVars = options.env.reduce<Record<string, string>>((acc, env) => {
-            const [key, value] = env.split('=');
-
-            if (key && value) {
-              acc[key] = value;
-            }
-
-            return acc;
-          }, {});
-
-          Object.assign(envVars, cliEnvVars);
-        }
-
-        // Write env vars even if we don't have store credentials
-        writeEnv(projectDir, envVars);
-
-        console.log(
-          [
-            colorize('green', `\nSuccess! Created '${projectName}' at '${projectDir}'\n`),
-            `Next steps:`,
-            Object.keys(envVars).length > 0
-              ? colorize('yellow', `\n- cd ${projectName} && pnpm run dev\n`)
-              : [
-                  colorize('yellow', `\n- cd ${projectName} && cp .env.example .env.local`),
-                  colorize(
-                    'yellow',
-                    `\n- Populate .env.local with your BigCommerce API credentials\n`,
-                  ),
-                ].join(''),
-          ].join('\n'),
-        );
-
-        process.exit(0);
-      }
-
-      // At this point we should have a storeHash and can identify the account
-      await telemetry.identify(storeHash);
-
-      if (!channelId || !storefrontToken) {
-        const bc = new Https({
-          baseUrl: `https://api.${options.bigcommerceHostname}/stores/${storeHash}`,
-          accessToken,
-        });
-
-        const cliApi = new CliApi({
-          origin: options.cliApiOrigin,
-          storeHash,
-          accessToken,
-        });
-
-        // If we have channelId but no storefrontToken, just get the init data
-        if (channelId && !storefrontToken) {
-          const initData = await getChannelInit(cliApi, channelId);
-
-          envVars = { ...initData.envVars };
-          storefrontToken = initData.storefrontToken;
-        } else if (!channelId) {
-          const eligibilityResponse = await cliApi.checkEligibility();
-
-          if (!eligibilityResponse.ok) {
-            console.error(
-              colorize(
-                'red',
-                `\nGET /channels/catalyst/eligibility failed: ${eligibilityResponse.status} ${eligibilityResponse.statusText}\n`,
-              ),
-            );
-            process.exit(1);
-          }
-
-          const eligibilityData: unknown = await eligibilityResponse.json();
-
-          if (!isEligibilityResponse(eligibilityData)) {
-            console.error(
-              colorize('red', '\nUnexpected response format from eligibility endpoint\n'),
-            );
-            process.exit(1);
-          }
-
-          if (!eligibilityData.data.eligible) {
-            console.warn(colorize('yellow', eligibilityData.data.message));
-          }
-
-          let shouldCreateChannel;
-
-          if (eligibilityData.data.eligible) {
-            shouldCreateChannel = await select({
-              message: 'Would you like to create a new channel?',
-              choices: [
-                { name: 'Yes', value: true },
-                { name: 'No', value: false },
-              ],
-            });
-          }
-
-          if (shouldCreateChannel) {
-            const channelData = await handleChannelCreation(bc, cliApi);
-
-            channelId = channelData.channelId;
-            storefrontToken = channelData.storefrontToken;
-            envVars = { ...channelData.envVars };
-
-            console.log(colorize('green', `Channel created successfully`));
-            console.warn(
-              colorize(
-                'yellow',
-                '\nNote: A preview storefront has been deployed in your BigCommerce control panel. This preview may look different from your local environment as it may be running different code.',
-              ),
-            );
-          }
-
-          if (!shouldCreateChannel) {
-            channelId = await handleChannelSelection(bc);
-
-            const initData = await getChannelInit(cliApi, channelId);
-
-            envVars = { ...initData.envVars };
-            storefrontToken = initData.storefrontToken;
-          }
-        }
-      }
-    }
-
-    // Add any CLI-provided env vars as overrides
-    if (options.env) {
-      const cliEnvVars = options.env.reduce<Record<string, string>>((acc, env) => {
-        const [key, value] = env.split('=');
-
-        if (key && value) {
-          acc[key] = value;
-        }
-
-        return acc;
-      }, {});
-
-      Object.assign(envVars, cliEnvVars);
-    }
-
-    // Add store hash, channel ID, and storefront token to envVars if provided
-    if (options.storeHash) {
-      envVars.BIGCOMMERCE_STORE_HASH = options.storeHash;
-    }
-
-    if (options.channelId) {
-      envVars.BIGCOMMERCE_CHANNEL_ID = options.channelId;
-    }
-
-    if (options.storefrontToken) {
-      envVars.BIGCOMMERCE_STOREFRONT_TOKEN = options.storefrontToken;
-    }
-
-    if (!channelId) throw new Error('Something went wrong, channelId is not defined');
-    if (!storefrontToken) throw new Error('Something went wrong, storefrontToken is not defined');
-
-    // Create the project with all necessary configuration
-    console.log(`\nCreating '${projectName}' at '${projectDir}'\n`);
-    cloneCatalyst({ repository, projectName, projectDir, ghRef, resetMain: options.resetMain });
-    await installDependencies(projectDir);
-
-    // Write env vars
-    writeEnv(projectDir, envVars);
-
-    // Store credentials after successful project creation
-    if (credentials) {
-      storeCredentials(projectDir, credentials);
-    }
-
-    console.log(
-      colorize('green', `\nSuccess! Created '${projectName}' at '${projectDir}'\n`),
-      '\nNext steps:\n',
-      colorize('yellow', `\ncd ${projectName} && pnpm run dev\n`),
-    );
-  });
-
-function isInitResponse(response: unknown): response is InitResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    typeof response.data === 'object' &&
-    response.data !== null &&
-    'storefront_api_token' in response.data &&
-    'envVars' in response.data
-  );
-}
-
-function isEligibilityResponse(response: unknown): response is EligibilityResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    typeof response.data === 'object' &&
-    response.data !== null &&
-    'eligible' in response.data &&
-    'message' in response.data
-  );
-}
-
-function isCreateChannelResponse(response: unknown): response is CreateChannelResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    typeof response.data === 'object' &&
-    response.data !== null &&
-    'id' in response.data &&
-    'storefront_api_token' in response.data &&
-    'envVars' in response.data
-  );
-}
-
-function isChannelsResponse(response: unknown): response is ChannelsResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    Array.isArray(response.data) &&
-    response.data.every(
-      (item) =>
-        typeof item === 'object' &&
-        item !== null &&
-        'id' in item &&
-        'name' in item &&
-        'platform' in item,
-    )
-  );
-}
diff --git a/packages/create-catalyst/src/commands/init.ts b/packages/create-catalyst/src/commands/init.ts
deleted file mode 100644
index 65d7d49975..0000000000
--- a/packages/create-catalyst/src/commands/init.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-import { Command, Option } from '@commander-js/extra-typings';
-import { select } from '@inquirer/prompts';
-import { colorize } from 'consola/utils';
-
-import { CliApi } from '../utils/cli-api';
-import { Config } from '../utils/config';
-import { Https } from '../utils/https';
-import { login, storeCredentials } from '../utils/login';
-import { Telemetry } from '../utils/telemetry/telemetry';
-import { writeEnv } from '../utils/write-env';
-
-interface Channel {
-  id: number;
-  name: string;
-  platform: string;
-}
-
-interface ChannelsResponse {
-  data: Channel[];
-}
-
-interface InitResponse {
-  data: {
-    makeswift_dev_api_key: string;
-    storefront_api_token: string;
-    envVars: Record<string, string>;
-  };
-}
-
-function isChannelsResponse(response: unknown): response is ChannelsResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    Array.isArray(response.data) &&
-    response.data.every(
-      (item) =>
-        typeof item === 'object' &&
-        item !== null &&
-        'id' in item &&
-        'name' in item &&
-        'platform' in item,
-    )
-  );
-}
-
-function isInitResponse(response: unknown): response is InitResponse {
-  return (
-    typeof response === 'object' &&
-    response !== null &&
-    'data' in response &&
-    typeof response.data === 'object' &&
-    response.data !== null &&
-    'storefront_api_token' in response.data &&
-    'envVars' in response.data
-  );
-}
-
-const telemetry = new Telemetry();
-
-export const init = new Command('init')
-  .description('Connect a BigCommerce store with an existing Catalyst project')
-  .option('--store-hash <hash>', 'BigCommerce store hash')
-  .option('--access-token <token>', 'BigCommerce access token')
-  .option('--env <vars...>', 'Arbitrary environment variables to set in .env.local')
-  .addOption(
-    new Option('--bigcommerce-hostname <hostname>', 'BigCommerce hostname')
-      .default('bigcommerce.com')
-      .hideHelp(),
-  )
-  .addOption(
-    new Option('--cli-api-origin <origin>', 'Catalyst CLI API origin')
-      .default('https://cxm-prd.bigcommerceapp.com')
-      .hideHelp(),
-  )
-  .action(async (options) => {
-    const projectDir = process.cwd();
-
-    let storeHash = options.storeHash;
-    let accessToken = options.accessToken;
-
-    // Check for stored credentials
-    if (!storeHash || !accessToken) {
-      const config = new Config(projectDir);
-      const storedAuth = config.getAuth();
-
-      storeHash = storeHash ?? storedAuth.storeHash;
-      accessToken = accessToken ?? storedAuth.accessToken;
-    }
-
-    if (!storeHash || !accessToken) {
-      const credentials = await login(`https://login.${options.bigcommerceHostname}`);
-
-      storeHash = credentials.storeHash;
-      accessToken = credentials.accessToken;
-
-      // Store credentials after successful authentication
-      storeCredentials(projectDir, credentials);
-    }
-
-    await telemetry.identify(storeHash);
-
-    const bc = new Https({
-      baseUrl: `https://api.${options.bigcommerceHostname}/stores/${storeHash}`,
-      accessToken,
-    });
-
-    const cliApi = new CliApi({
-      origin: options.cliApiOrigin,
-      storeHash,
-      accessToken,
-    });
-
-    const channelSortOrder = ['catalyst', 'next', 'bigcommerce'];
-    const channelsResponse = await bc.fetch('/v3/channels?available=true&type=storefront');
-
-    if (!channelsResponse.ok) {
-      console.error(
-        colorize(
-          'red',
-          `\nGET /v3/channels failed: ${channelsResponse.status} ${channelsResponse.statusText}\n`,
-        ),
-      );
-      process.exit(1);
-    }
-
-    const availableChannels: unknown = await channelsResponse.json();
-
-    if (!isChannelsResponse(availableChannels)) {
-      console.error(colorize('red', '\nUnexpected response format from channels endpoint\n'));
-      process.exit(1);
-    }
-
-    const existingChannel = await select({
-      message: 'Which channel would you like to use?',
-      choices: availableChannels.data
-        .sort(
-          (a: Channel, b: Channel) =>
-            channelSortOrder.indexOf(a.platform) - channelSortOrder.indexOf(b.platform),
-        )
-        .map((ch: Channel) => ({
-          name: ch.name,
-          value: ch,
-          description: `Channel Platform: ${
-            ch.platform === 'bigcommerce'
-              ? 'Stencil'
-              : ch.platform.charAt(0).toUpperCase() + ch.platform.slice(1)
-          }`,
-        })),
-    });
-
-    const channelId = existingChannel.id;
-
-    // Get channel init data
-    const initResponse = await cliApi.getChannelInit(channelId);
-
-    if (!initResponse.ok) {
-      console.error(
-        colorize(
-          'red',
-          `\nGET /channels/${channelId}/init failed: ${initResponse.status} ${initResponse.statusText}\n`,
-        ),
-      );
-      process.exit(1);
-    }
-
-    const initData: unknown = await initResponse.json();
-
-    if (!isInitResponse(initData)) {
-      console.error(colorize('red', '\nUnexpected response format from init endpoint\n'));
-      process.exit(1);
-    }
-
-    const envVars = { ...initData.data.envVars };
-
-    // Add any CLI-provided env vars as overrides
-    if (options.env) {
-      const cliEnvVars = options.env.reduce<Record<string, string>>((acc, env) => {
-        const [key, value] = env.split('=');
-
-        if (key && value) {
-          acc[key] = value;
-        }
-
-        return acc;
-      }, {});
-
-      Object.assign(envVars, cliEnvVars);
-    }
-
-    writeEnv(projectDir, envVars);
-
-    console.log(
-      colorize('green', `\n.env.local file created for channel ${existingChannel.name}!\n`),
-    );
-    console.log(colorize('green', `\nNext steps:\n`));
-    console.log(colorize('yellow', `\npnpm run dev\n`));
-  });
diff --git a/packages/create-catalyst/src/commands/integration.ts b/packages/create-catalyst/src/commands/integration.ts
deleted file mode 100644
index 6fadaa5046..0000000000
--- a/packages/create-catalyst/src/commands/integration.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import { Command } from '@commander-js/extra-typings';
-import { exec as execCb } from 'child_process';
-import { colorize } from 'consola/utils';
-import { parse } from 'dotenv';
-import { outputFileSync, writeJsonSync } from 'fs-extra/esm';
-import kebabCase from 'lodash.kebabcase';
-import { coerce, compare } from 'semver';
-import { promisify } from 'util';
-import { z } from 'zod';
-
-const exec = promisify(execCb);
-
-export const ManifestSchema = z.object({
-  name: z.string(),
-  dependencies: z.object({ add: z.array(z.string()) }),
-  devDependencies: z.object({ add: z.array(z.string()) }),
-  environmentVariables: z.array(z.string()),
-});
-
-type Manifest = z.infer<typeof ManifestSchema>;
-
-export const integration = new Command('integration')
-  .argument('<integration-name>', 'Formatted name of the integration')
-  .option('--commit-hash <hash>', 'Override integration source branch with a specific commit hash')
-  .action(async (integrationNameRaw, options) => {
-    console.warn(
-      colorize(
-        'yellow',
-        '⚠ `create-catalyst integration` is deprecated and will be replaced by the ' +
-          '`catalyst upgrade` command.',
-      ),
-    );
-
-    // @todo check for integration name conflicts
-    const integrationName = z.string().transform(kebabCase).parse(integrationNameRaw);
-
-    const manifest: Manifest = {
-      name: integrationName,
-      dependencies: { add: [] },
-      devDependencies: { add: [] },
-      environmentVariables: [],
-    };
-
-    await exec('git fetch --tags');
-
-    const { stdout: headRefStdOut } = await exec('git rev-parse --abbrev-ref HEAD');
-    let [sourceRef] = headRefStdOut.split('\n');
-
-    if (options.commitHash) {
-      sourceRef = options.commitHash;
-    }
-
-    const { stdout: catalystTags } = await exec('git tag --list @bigcommerce/catalyst-core@\\*');
-    const [latestCoreTag] = catalystTags
-      .split('\n')
-      .filter(Boolean)
-      .sort((a, b) => {
-        const versionA = coerce(a.replace('@bigcommerce/catalyst-core@', ''));
-        const versionB = coerce(b.replace('@bigcommerce/catalyst-core@', ''));
-
-        if (versionA && versionB) {
-          return compare(versionA, versionB);
-        }
-
-        return 0;
-      })
-      .reverse();
-
-    const PackageDependenciesSchema = z.object({
-      dependencies: z.object({}).passthrough(),
-      devDependencies: z.object({}).passthrough(),
-    });
-
-    const getPackageDeps = async (ref: string) => {
-      const { stdout } = await exec(`git show ${ref}:core/package.json`);
-
-      return PackageDependenciesSchema.parse(JSON.parse(stdout));
-    };
-
-    const integrationJson = await getPackageDeps(sourceRef);
-    const latestCoreTagJson = await getPackageDeps(latestCoreTag);
-
-    const diffObjectKeys = (a: Record<string, unknown>, b: Record<string, unknown>) => {
-      return Object.keys(a).filter((key) => !Object.keys(b).includes(key));
-    };
-
-    manifest.dependencies.add = diffObjectKeys(
-      integrationJson.dependencies,
-      latestCoreTagJson.dependencies,
-    );
-    manifest.devDependencies.add = diffObjectKeys(
-      integrationJson.devDependencies,
-      latestCoreTagJson.devDependencies,
-    );
-
-    const { stdout: latestCoreEnv } = await exec(`git show ${latestCoreTag}:core/.env.example`);
-    const { stdout: integrationEnv } = await exec(`git show ${sourceRef}:core/.env.example`);
-
-    manifest.environmentVariables = diffObjectKeys(parse(integrationEnv), parse(latestCoreEnv));
-
-    const { stdout: integrationDiff } = await exec(
-      `git diff ${latestCoreTag}...${sourceRef} -- ':(exclude)core/package.json' ':(exclude)pnpm-lock.yaml'`,
-    );
-
-    outputFileSync(`integrations/${integrationName}/integration.patch`, integrationDiff);
-    writeJsonSync(`integrations/${integrationName}/manifest.json`, manifest, {
-      spaces: 2,
-    });
-
-    console.log('Integration created successfully.');
-  });
diff --git a/packages/create-catalyst/src/commands/telemetry.ts b/packages/create-catalyst/src/commands/telemetry.ts
deleted file mode 100644
index 36962e66ee..0000000000
--- a/packages/create-catalyst/src/commands/telemetry.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { Argument, Command, Option } from '@commander-js/extra-typings';
-
-import { catalystTelemetry, CatalystTelemetryOptions } from '../utils/telemetry';
-
-export const telemetry = new Command('telemetry')
-  .addArgument(new Argument('[arg]').choices(['disable', 'enable', 'status']))
-  .addOption(new Option('--enable', `Enables CLI telemetry collection.`).conflicts('disable'))
-  .option('--disable', `Disables CLI telemetry collection.`)
-  .action((arg: string | undefined, options: CatalystTelemetryOptions) =>
-    catalystTelemetry(options, arg),
-  );
diff --git a/packages/create-catalyst/src/hooks/telemetry.ts b/packages/create-catalyst/src/hooks/telemetry.ts
deleted file mode 100644
index b36aa33c3b..0000000000
--- a/packages/create-catalyst/src/hooks/telemetry.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import { Command } from '@commander-js/extra-typings';
-
-import { Telemetry } from '../utils/telemetry/telemetry';
-
-const telemetry = new Telemetry();
-
-const allowlistArguments = ['--gh-ref', '--repository', '--project-name'];
-
-function parseArguments(args: string[]) {
-  return args.reduce<Record<string, string>>((result, arg, index, array) => {
-    if (arg.includes('=')) {
-      const [key, value] = arg.split('=');
-
-      if (allowlistArguments.includes(key)) {
-        return {
-          ...result,
-          [key]: value,
-        };
-      }
-    }
-
-    if (allowlistArguments.includes(arg)) {
-      const nextValue =
-        array[index + 1] && !array[index + 1].startsWith('--') ? array[index + 1] : null;
-
-      if (nextValue && !nextValue.includes('--')) {
-        return {
-          ...result,
-          [arg]: nextValue,
-        };
-      }
-    }
-
-    return result;
-  }, {});
-}
-
-export const telemetryPreHook = async (command: Command) => {
-  // @ts-expect-error _name is a private property
-  const availableCommands = command.commands.map((cmd) => cmd._name); // eslint-disable-line @typescript-eslint/no-unsafe-return, no-underscore-dangle
-
-  const [commandName = 'create', ...args] = command.args;
-
-  // When running `npm create @bigcommerce/catalyst`, the command defaults to
-  // the `create` command but commander doesn't pass it as part of the arguments.
-  //  We need to handle this case separately.
-  if (!availableCommands.includes(commandName)) {
-    // Return the await to get a proper stack trace.
-    // eslint-disable-next-line @typescript-eslint/no-confusing-void-expression
-    return await telemetry.track('create', {
-      ...parseArguments(args),
-    });
-  }
-
-  // Return the await to get a proper stack trace.
-  // eslint-disable-next-line @typescript-eslint/no-confusing-void-expression
-  return await telemetry.track(commandName, {
-    ...parseArguments(args),
-  });
-};
-
-export const telemetryPostHook = async () => {
-  await telemetry.analytics.closeAndFlush();
-};
diff --git a/packages/create-catalyst/src/index.ts b/packages/create-catalyst/src/index.ts
index 5c2023287a..6544c2be44 100644
--- a/packages/create-catalyst/src/index.ts
+++ b/packages/create-catalyst/src/index.ts
@@ -1,29 +1,40 @@
-#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
 
-import { program } from '@commander-js/extra-typings';
-import { colorize } from 'consola/utils';
+const require = createRequire(import.meta.url);
 
-import PACKAGE_INFO from '../package.json';
+// `create-catalyst` is a thin wrapper around `@bigcommerce/catalyst`: it forwards
+// everything to `catalyst create` so all scaffolding logic lives in one place
+// (mirroring how `create-next-app` fronts `next`). `pnpm create catalyst` /
+// `npx create-catalyst` install `@bigcommerce/catalyst` as a dependency, so its
+// bin is resolvable from this package — no global `catalyst` install required.
+function resolveCatalystBin(): string {
+  const packageJsonPath = require.resolve('@bigcommerce/catalyst/package.json');
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  const { bin } = require('@bigcommerce/catalyst/package.json') as {
+    bin: string | Record<string, string>;
+  };
+  const relativeBin = typeof bin === 'string' ? bin : bin.catalyst;
 
-import { create } from './commands/create';
-import { init } from './commands/init';
-import { integration } from './commands/integration';
-import { telemetry } from './commands/telemetry';
-import { telemetryPostHook, telemetryPreHook } from './hooks/telemetry';
+  return join(dirname(packageJsonPath), relativeBin);
+}
 
-console.log(colorize('cyanBright', `\n◢ ${PACKAGE_INFO.name} v${PACKAGE_INFO.version}\n`));
+const child = spawn(process.execPath, [resolveCatalystBin(), 'create', ...process.argv.slice(2)], {
+  stdio: 'inherit',
+});
 
-program
-  .name(PACKAGE_INFO.name)
-  .version(PACKAGE_INFO.version)
-  .description('A command line tool to create a new Catalyst project.')
-  .addCommand(create, { isDefault: true })
-  .addCommand(init)
-  // Deprecated: hidden from help so new users don't discover it; still runnable
-  // (with a deprecation warning) until it's removed. See LTRAC-467.
-  .addCommand(integration, { hidden: true })
-  .addCommand(telemetry)
-  .hook('preAction', telemetryPreHook)
-  .hook('postAction', telemetryPostHook);
+child.on('error', (error) => {
+  console.error(error);
+  process.exit(1);
+});
 
-program.parse(process.argv);
+// Mirror the child's exit so CI/automation sees the real status code, and
+// re-raise signals (e.g. Ctrl-C) rather than swallowing them.
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 0);
+  }
+});
diff --git a/packages/create-catalyst/src/utils/node-version.spec.ts b/packages/create-catalyst/src/node-version.spec.ts
similarity index 100%
rename from packages/create-catalyst/src/utils/node-version.spec.ts
rename to packages/create-catalyst/src/node-version.spec.ts
diff --git a/packages/create-catalyst/src/prompts/multi-select/helpers.ts b/packages/create-catalyst/src/prompts/multi-select/helpers.ts
deleted file mode 100644
index 08bc4f57a8..0000000000
--- a/packages/create-catalyst/src/prompts/multi-select/helpers.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { Separator } from '@inquirer/core';
-import figures from '@inquirer/figures';
-import { colorize } from 'consola/utils';
-
-import { Choice, Item, NormalizedChoice, SelectTheme } from './types';
-
-export const selectTheme: SelectTheme = {
-  helpMode: 'auto',
-  icon: {
-    checked: colorize('green', figures.circleFilled),
-    unchecked: figures.circle,
-    cursor: figures.pointer,
-  },
-  style: {
-    description: (text: string) => colorize('cyan', text),
-    disabledChoice: (text: string) => colorize('dim', `- ${text}`),
-    renderSelectedChoices: (selectedChoices) =>
-      selectedChoices.map((choice) => choice.short).join(', '),
-  },
-};
-
-export const isSelectable = <Value>(item: Item<Value>): item is NormalizedChoice<Value> =>
-  !Separator.isSeparator(item) && !item.disabled;
-
-export const isChecked = <Value>(item: Item<Value>): item is NormalizedChoice<Value> =>
-  isSelectable(item) && Boolean(item.checked);
-
-export const toggle = <Value>(item: Item<Value>): Item<Value> =>
-  isSelectable(item) ? { ...item, checked: !item.checked } : item;
-
-export const normalizeChoices = <Value>(
-  choices: ReadonlyArray<string | Choice<Value> | Separator>,
-): Array<Item<Value>> =>
-  choices.map((choice) => {
-    if (Separator.isSeparator(choice)) {
-      return choice;
-    }
-
-    if (typeof choice === 'string') {
-      return {
-        checked: false,
-        disabled: false,
-        name: choice,
-        short: choice,
-        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        value: choice as Value,
-      };
-    }
-
-    const name = choice.name ?? String(choice.value);
-
-    return {
-      checked: choice.checked ?? false,
-      description: choice.description,
-      disabled: choice.disabled ?? false,
-      name,
-      short: choice.short ?? name,
-      value: choice.value,
-    };
-  });
diff --git a/packages/create-catalyst/src/prompts/multi-select/index.ts b/packages/create-catalyst/src/prompts/multi-select/index.ts
deleted file mode 100644
index dbd80422ea..0000000000
--- a/packages/create-catalyst/src/prompts/multi-select/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from './multi-select';
diff --git a/packages/create-catalyst/src/prompts/multi-select/multi-select.ts b/packages/create-catalyst/src/prompts/multi-select/multi-select.ts
deleted file mode 100644
index db336ae794..0000000000
--- a/packages/create-catalyst/src/prompts/multi-select/multi-select.ts
+++ /dev/null
@@ -1,218 +0,0 @@
-import {
-  createPrompt,
-  isBackspaceKey,
-  isDownKey,
-  isEnterKey,
-  isNumberKey,
-  isSpaceKey,
-  isUpKey,
-  makeTheme,
-  Separator,
-  type Status,
-  useEffect,
-  useKeypress,
-  useMemo,
-  usePagination,
-  usePrefix,
-  useRef,
-  useState,
-  ValidationError,
-} from '@inquirer/core';
-import ansiEscapes from 'ansi-escapes';
-
-import { isChecked, isSelectable, normalizeChoices, selectTheme, toggle } from './helpers';
-import { Item, MultiSelectConfig, SelectTheme } from './types';
-
-export const multiSelect = createPrompt(
-  <Value>(config: MultiSelectConfig<Value>, done: (value: Value[]) => void) => {
-    const theme = makeTheme<SelectTheme>(selectTheme, config.theme);
-    const searchTimeoutRef = useRef<ReturnType<typeof setTimeout>>();
-    const firstRender = useRef(true);
-    const [items, setItems] = useState<ReadonlyArray<Item<Value>>>(
-      normalizeChoices(config.choices),
-    );
-    const [status, setStatus] = useState<Status>('idle');
-    const [errorMsg, setError] = useState<string>();
-    const prefix = usePrefix({ status, theme });
-    const { instructions, loop = true, pageSize = 7, required, validate = () => true } = config;
-
-    const bounds = useMemo(() => {
-      const first = items.findIndex(isSelectable);
-      const last = items.findLastIndex(isSelectable);
-
-      if (first === -1) {
-        throw new ValidationError(
-          '[multi select prompt] No selectable choices. All choices are disabled.',
-        );
-      }
-
-      return { first, last };
-    }, [items]);
-
-    const [showHelpTip, setShowHelpTip] = useState(true);
-    const [active, setActive] = useState(bounds.first);
-
-    useEffect(
-      () => () => {
-        clearTimeout(searchTimeoutRef.current);
-      },
-      [],
-    );
-
-    // eslint-disable-next-line complexity
-    useKeypress(async (key, rl) => {
-      clearTimeout(searchTimeoutRef.current);
-
-      if (isEnterKey(key)) {
-        const selection = items.filter(isChecked);
-        const isValid = await validate([...selection]);
-
-        if (required && !items.some(isChecked)) {
-          setError('At least one choice must be selected');
-        } else if (isValid === true) {
-          setStatus('done');
-          done(selection.map((choice) => choice.value));
-        } else {
-          setError(isValid || 'You must select a valid value');
-        }
-      } else if (isUpKey(key) || isDownKey(key)) {
-        rl.clearLine(0);
-
-        if (
-          loop ||
-          (isUpKey(key) && active !== bounds.first) ||
-          (isDownKey(key) && active !== bounds.last)
-        ) {
-          const offset = isUpKey(key) ? -1 : 1;
-          let next = active;
-
-          do {
-            next = (next + offset + items.length) % items.length;
-          } while (!isSelectable(items[next]));
-
-          setActive(next);
-        }
-      } else if (isNumberKey(key)) {
-        rl.clearLine(0);
-
-        const position = Number(key.name) - 1;
-
-        if (isSelectable(items[position])) {
-          setActive(position);
-        }
-      } else if (isBackspaceKey(key)) {
-        rl.clearLine(0);
-      } else if (isSpaceKey(key)) {
-        rl.clearLine(0);
-        setShowHelpTip(false);
-
-        const nextItems = items.map((choice, i) => (i === active ? toggle(choice) : choice));
-        const selection = nextItems.filter(isChecked);
-        const isValid = await validate([...selection]);
-
-        if (isValid === true) {
-          setError(undefined);
-          setItems(nextItems);
-        } else {
-          setError(isValid || 'You must select a valid value');
-        }
-      } else {
-        // Default to search
-        const searchTerm = rl.line.toLowerCase();
-        const matchIndex = items.findIndex((item) =>
-          Separator.isSeparator(item) || !isSelectable(item)
-            ? false
-            : item.name.toLowerCase().startsWith(searchTerm),
-        );
-
-        if (matchIndex !== -1) {
-          setActive(matchIndex);
-        }
-
-        searchTimeoutRef.current = setTimeout(() => {
-          rl.clearLine(0);
-        }, 700);
-      }
-    });
-
-    const message = theme.style.message(config.message, status);
-
-    let helpTipTop = '';
-    let helpTipBottom = '';
-    let description: string | undefined;
-
-    if (
-      theme.helpMode === 'always' ||
-      (theme.helpMode === 'auto' && showHelpTip && (instructions === undefined || instructions))
-    ) {
-      if (typeof instructions === 'string') {
-        helpTipTop = instructions;
-      } else {
-        const keys = [
-          `${theme.style.key('space')} to select`,
-          `${theme.style.key('enter')} to proceed`,
-        ];
-
-        helpTipTop = ` (Press ${keys.filter((key) => key !== '').join(', ')})`;
-      }
-
-      if (
-        items.length > pageSize &&
-        (theme.helpMode === 'always' ||
-          // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-          (theme.helpMode === 'auto' && firstRender.current))
-      ) {
-        helpTipBottom = `\n${theme.style.help('(Use arrow keys to reveal more choices)')}`;
-        firstRender.current = false;
-      }
-    }
-
-    const page = usePagination({
-      items,
-      active,
-      renderItem({ item, isActive }) {
-        if (Separator.isSeparator(item)) {
-          return ` ${item.separator}`;
-        }
-
-        if (item.disabled) {
-          return theme.style.disabledChoice(
-            `${item.name} ${typeof item.disabled === 'string' ? item.disabled : '(disabled)'}`,
-          );
-        }
-
-        if (isActive) {
-          description = item.description;
-        }
-
-        const checkbox = item.checked ? theme.icon.checked : theme.icon.unchecked;
-        const color = isActive ? theme.style.highlight : (x: string) => x;
-        const cursor = isActive ? theme.icon.cursor : ` `;
-
-        return color(`${cursor}${checkbox} ${item.name}`);
-      },
-      pageSize,
-      loop,
-    });
-
-    if (status === 'done') {
-      return `${prefix} ${message} ${theme.style.answer(theme.style.renderSelectedChoices(items.filter(isChecked), items))}`;
-    }
-
-    const selectedChoices =
-      items.filter(isChecked).length > 0
-        ? ` (${theme.style.answer(theme.style.renderSelectedChoices(items.filter(isChecked), items))})`
-        : '';
-    const choiceDescription = description ? `\n${theme.style.description(description)}` : ``;
-
-    let error = '';
-
-    if (errorMsg) {
-      error = `\n${theme.style.error(errorMsg)}`;
-    }
-
-    return `${prefix} ${message}${selectedChoices}${helpTipTop}\n${page}${helpTipBottom}${choiceDescription}${error}${ansiEscapes.cursorHide}`;
-  },
-);
-
-export { Separator } from '@inquirer/core';
diff --git a/packages/create-catalyst/src/prompts/multi-select/types.ts b/packages/create-catalyst/src/prompts/multi-select/types.ts
deleted file mode 100644
index 025c1f804f..0000000000
--- a/packages/create-catalyst/src/prompts/multi-select/types.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { Separator, type Theme } from '@inquirer/core';
-import type { PartialDeep } from '@inquirer/type';
-
-export interface SelectTheme {
-  helpMode: 'always' | 'never' | 'auto';
-  icon: {
-    checked: string;
-    unchecked: string;
-    cursor: string;
-  };
-  style: {
-    description: (text: string) => string;
-    disabledChoice: (text: string) => string;
-    renderSelectedChoices: <T>(
-      selectedChoices: ReadonlyArray<NormalizedChoice<T>>,
-      allChoices: ReadonlyArray<NormalizedChoice<T> | Separator>,
-    ) => string;
-  };
-}
-
-export interface Choice<Value> {
-  checked?: boolean;
-  description?: string;
-  disabled?: boolean | string;
-  name?: string;
-  short?: string;
-  type?: never;
-  value: Value;
-}
-
-export interface NormalizedChoice<Value> {
-  checked: boolean;
-  description?: string;
-  disabled: boolean | string;
-  name: string;
-  short: string;
-  value: Value;
-}
-
-export interface MultiSelectConfig<
-  Value,
-  ChoicesObject = ReadonlyArray<string | Separator> | ReadonlyArray<Choice<Value> | Separator>,
-> {
-  choices: ChoicesObject extends ReadonlyArray<string | Separator>
-    ? ChoicesObject
-    : ReadonlyArray<Choice<Value> | Separator>;
-  default?: unknown;
-  instructions?: string | boolean;
-  loop?: boolean;
-  message: string;
-  pageSize?: number;
-  required?: boolean;
-  theme?: PartialDeep<Theme<SelectTheme>>;
-  validate?: (
-    choices: ReadonlyArray<Choice<Value>>,
-  ) => boolean | string | Promise<string | boolean>;
-}
-
-export type Item<Value> = NormalizedChoice<Value> | Separator;
diff --git a/packages/create-catalyst/src/utils/auth.ts b/packages/create-catalyst/src/utils/auth.ts
deleted file mode 100644
index c43bc05449..0000000000
--- a/packages/create-catalyst/src/utils/auth.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import { z } from 'zod';
-
-import { Https } from './https';
-import { parse } from './parse';
-
-interface AuthConfig {
-  baseUrl: string;
-}
-
-export class Auth {
-  private client: Https;
-  private readonly DEVICE_OAUTH_CLIENT_ID = 'b8063bu6hhml4e0lqh22yut63atsbyv';
-
-  constructor({ baseUrl }: AuthConfig) {
-    this.client = new Https({ baseUrl });
-  }
-
-  async getDeviceCode() {
-    const response = await this.client.fetch('/device/token', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        scopes: [
-          'store_channel_settings',
-          'store_sites',
-          'store_storefront_api',
-          'store_v2_content',
-          'store_v2_information',
-          'store_v2_products',
-          'store_cart',
-        ].join(' '),
-        client_id: this.DEVICE_OAUTH_CLIENT_ID,
-      }),
-    });
-
-    const DeviceCodeSchema = z.object({
-      device_code: z.string(),
-      user_code: z.string(),
-      verification_uri: z.string(),
-      expires_in: z.number(),
-      interval: z.number(),
-    });
-
-    return parse(await response.json(), DeviceCodeSchema);
-  }
-
-  async checkDeviceCode(deviceCode: string) {
-    const response = await this.client.fetch('/device/token', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        device_code: deviceCode,
-        client_id: this.DEVICE_OAUTH_CLIENT_ID,
-      }),
-    });
-
-    if (response.status !== 200) {
-      throw new Error('Device code not yet verified');
-    }
-
-    const DeviceCodeSuccessSchema = z.object({
-      access_token: z.string(),
-      store_hash: z.string(),
-      context: z.string(),
-      api_uri: z.string().url(),
-    });
-
-    return parse(await response.json(), DeviceCodeSuccessSchema);
-  }
-}
diff --git a/packages/create-catalyst/src/utils/checkout-ref.ts b/packages/create-catalyst/src/utils/checkout-ref.ts
deleted file mode 100644
index 4ef52e5625..0000000000
--- a/packages/create-catalyst/src/utils/checkout-ref.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { sync as spawnSync } from 'cross-spawn';
-
-import { isExecException } from './is-exec-exception';
-
-export function checkoutRef(repoDir: string, ref: string): void {
-  try {
-    // Attempt to checkout the specified ref
-    const spawn = spawnSync('git', ['checkout', ref, '--'], {
-      cwd: repoDir,
-      encoding: 'utf8',
-      // Explicitly set shell to false to avoid shell injection
-      // Don't use shell: true as it's a security risk
-      shell: false,
-    });
-
-    const stderr = spawn.stderr.trim();
-
-    if (spawn.status !== 0 && stderr) {
-      throw new Error(stderr);
-    }
-
-    console.log(`Checked out ref ${ref} successfully.`);
-  } catch (error: unknown) {
-    // Handle the error safely according to ESLint rules
-    if (isExecException(error)) {
-      const stderr = error.stderr ? error.stderr.toString() : '';
-
-      // Check if the error message indicates that the ref was not found
-      if (
-        stderr.includes(`fatal: reference is not a tree: ${ref}`) ||
-        stderr.includes(`fatal: ambiguous argument '${ref}'`) ||
-        stderr.includes(`unknown revision or path not in the working tree`)
-      ) {
-        console.error(`Ref '${ref}' not found in the repository.`);
-      } else {
-        console.error(`Error checking out ref '${ref}':`, stderr.trim());
-      }
-    } else if (error instanceof Error) {
-      // General error handling
-      console.error(`Error checking out ref '${ref}':`, error.message);
-    } else {
-      // Unknown error type
-      console.error(`Unknown error occurred while checking out ref '${ref}'.`);
-    }
-
-    console.warn(`Falling back to the default branch.`);
-  }
-}
diff --git a/packages/create-catalyst/src/utils/cli-api.ts b/packages/create-catalyst/src/utils/cli-api.ts
deleted file mode 100644
index 6d621266fa..0000000000
--- a/packages/create-catalyst/src/utils/cli-api.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import { Https } from './https';
-
-interface CliApiConfig {
-  origin: string;
-  storeHash: string;
-  accessToken: string;
-}
-
-export class CliApi {
-  private client: Https;
-
-  constructor({ origin, storeHash, accessToken }: CliApiConfig) {
-    this.client = new Https({
-      baseUrl: `${origin}/stores/${storeHash}/cli-api/v3`,
-      accessToken,
-    });
-  }
-
-  async getChannelInit(channelId: number | string) {
-    return this.client.fetch(`/channels/${channelId}/init`, {
-      method: 'GET',
-    });
-  }
-
-  async checkEligibility() {
-    return this.client.fetch('/channels/catalyst/eligibility', {
-      method: 'GET',
-    });
-  }
-
-  async createChannel(
-    name: string,
-    storefrontLocale: string,
-    additionalLocales: string[],
-    installSampleData = false,
-  ) {
-    return this.client.fetch('/channels/catalyst', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        name,
-        initialData: {
-          type: installSampleData ? 'sample' : 'none',
-        },
-        deployStorefront: true,
-        devOrigin: 'http://localhost:3000',
-        storefrontLanguage: storefrontLocale,
-        additionalLocales,
-      }),
-    });
-  }
-}
diff --git a/packages/create-catalyst/src/utils/clone-catalyst.ts b/packages/create-catalyst/src/utils/clone-catalyst.ts
deleted file mode 100644
index 9b11a63d0d..0000000000
--- a/packages/create-catalyst/src/utils/clone-catalyst.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-import { execSync } from 'child_process';
-
-import { checkoutRef } from './checkout-ref';
-import { hasGitHubSSH } from './has-github-ssh';
-import { resetBranchToRef } from './reset-branch-to-ref';
-
-export const cloneCatalyst = ({
-  repository,
-  projectName,
-  projectDir,
-  ghRef,
-  resetMain = false,
-}: {
-  repository: string;
-  projectName: string;
-  projectDir: string;
-  ghRef?: string;
-  resetMain?: boolean;
-}) => {
-  const useSSH = hasGitHubSSH();
-
-  console.log(`Cloning ${repository} using ${useSSH ? 'SSH' : 'HTTPS'}...\n`);
-
-  const cloneCommand = `git clone ${
-    useSSH ? `git@github.com:${repository}` : `https://github.com/${repository}`
-  }.git${projectName ? ` ${projectName}` : ''}`;
-
-  execSync(cloneCommand, { stdio: 'inherit' });
-  console.log();
-
-  execSync('git remote rename origin upstream', { cwd: projectDir, stdio: 'inherit' });
-  console.log();
-
-  if (ghRef) {
-    if (resetMain) {
-      // Create and checkout a new main branch
-      execSync('git checkout -b main', { cwd: projectDir, stdio: 'inherit' });
-
-      // Reset it to the specified ref
-      resetBranchToRef(projectDir, ghRef);
-
-      console.log(`Reset main to ${ghRef} successfully.\n`);
-
-      return;
-    }
-
-    checkoutRef(projectDir, ghRef);
-
-    console.log();
-  }
-};
diff --git a/packages/create-catalyst/src/utils/config.ts b/packages/create-catalyst/src/utils/config.ts
deleted file mode 100644
index 6123c6404d..0000000000
--- a/packages/create-catalyst/src/utils/config.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-import { parse as parseTOML, stringify as stringifyTOML } from '@iarna/toml';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { dirname, join } from 'path';
-
-interface CatalystConfig {
-  auth?: {
-    storeHash?: string;
-    accessToken?: string;
-  };
-}
-
-interface TomlRecord {
-  [key: string]: string | number | boolean | TomlRecord | TomlRecord[];
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
-}
-
-function isCatalystConfig(obj: unknown): obj is CatalystConfig {
-  if (!isRecord(obj)) {
-    return false;
-  }
-
-  if ('auth' in obj) {
-    if (!isRecord(obj.auth)) {
-      return false;
-    }
-
-    const { storeHash, accessToken } = obj.auth;
-
-    return (
-      (storeHash === undefined || typeof storeHash === 'string') &&
-      (accessToken === undefined || typeof accessToken === 'string')
-    );
-  }
-
-  return true;
-}
-
-export class Config {
-  private configPath: string;
-  private config: CatalystConfig;
-
-  constructor(projectDir: string) {
-    this.configPath = join(projectDir, '.catalyst');
-    this.config = this.read();
-  }
-
-  getAuth(): { storeHash?: string; accessToken?: string } {
-    return this.config.auth ?? {};
-  }
-
-  setAuth(storeHash: string, accessToken: string): void {
-    this.config.auth = { storeHash, accessToken };
-    this.save();
-  }
-
-  save(): void {
-    const configObj: TomlRecord = {};
-
-    if (this.config.auth?.storeHash && this.config.auth.accessToken) {
-      configObj.auth = {
-        storeHash: this.config.auth.storeHash,
-        accessToken: this.config.auth.accessToken,
-      };
-    }
-
-    const dir = dirname(this.configPath);
-
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
-    }
-
-    const preamble = `# DO NOT commit this file to your repository!
-# This file contains sensitive configuration specific to your local CLI setup.
-# It includes authentication tokens and store-specific information.
-# If using version control, make sure to add .catalyst to your .gitignore file.
-
-`;
-
-    writeFileSync(this.configPath, preamble + stringifyTOML(configObj));
-  }
-
-  private read(): CatalystConfig {
-    if (!existsSync(this.configPath)) {
-      return {};
-    }
-
-    try {
-      const contents = readFileSync(this.configPath, 'utf-8');
-      const parsed = parseTOML(contents);
-
-      if (isCatalystConfig(parsed)) {
-        return parsed;
-      }
-
-      console.warn('Invalid config format in .catalyst file, using defaults');
-
-      return {};
-    } catch {
-      console.warn('Failed to parse .catalyst config file, using defaults');
-
-      return {};
-    }
-  }
-}
diff --git a/packages/create-catalyst/src/utils/has-github-ssh.ts b/packages/create-catalyst/src/utils/has-github-ssh.ts
deleted file mode 100644
index e9cb5cdcb7..0000000000
--- a/packages/create-catalyst/src/utils/has-github-ssh.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { execSync } from 'child_process';
-
-import { isExecException } from './is-exec-exception';
-
-export function hasGitHubSSH(): boolean {
-  try {
-    // Attempt to connect to GitHub via SSH and capture the output
-    const output = execSync('ssh -T git@github.com', {
-      encoding: 'utf8',
-      stdio: 'pipe',
-    }).toString();
-
-    // Check the output for successful authentication
-    return output.includes('successfully authenticated');
-  } catch (error: unknown) {
-    // Use the type guard to check if error is an ExecException
-    if (isExecException(error)) {
-      const stdout = error.stdout ? error.stdout.toString() : '';
-      const stderr = error.stderr ? error.stderr.toString() : '';
-      const combinedOutput = stdout + stderr;
-
-      // Check if the output indicates successful authentication
-      if (combinedOutput.includes('successfully authenticated')) {
-        return true;
-      }
-    }
-
-    return false;
-  }
-}
diff --git a/packages/create-catalyst/src/utils/https.ts b/packages/create-catalyst/src/utils/https.ts
deleted file mode 100644
index b4bf2aa297..0000000000
--- a/packages/create-catalyst/src/utils/https.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { getCLIUserAgent } from './user-agent';
-
-interface HttpsConfig {
-  baseUrl: string;
-  accessToken?: string;
-}
-
-export class Https {
-  private baseUrl: string;
-  private accessToken?: string;
-  private userAgent: string;
-
-  constructor({ baseUrl, accessToken }: HttpsConfig) {
-    this.baseUrl = baseUrl;
-    this.accessToken = accessToken;
-    this.userAgent = getCLIUserAgent();
-  }
-
-  async fetch(path: string, opts: RequestInit = {}) {
-    const { headers = {}, ...rest } = opts;
-
-    const options = {
-      headers: {
-        ...Object.fromEntries(new Headers(headers)),
-        Accept: 'application/json',
-        'User-Agent': this.userAgent,
-        ...(this.accessToken && { 'X-Auth-Token': this.accessToken }),
-      },
-      ...rest,
-    };
-
-    return fetch(`${this.baseUrl}${path}`, options);
-  }
-}
diff --git a/packages/create-catalyst/src/utils/install-dependencies.ts b/packages/create-catalyst/src/utils/install-dependencies.ts
deleted file mode 100644
index d48229695e..0000000000
--- a/packages/create-catalyst/src/utils/install-dependencies.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { colorize } from 'consola/utils';
-import { installDependencies as installDeps } from 'nypm';
-
-import { spinner } from './spinner';
-
-const installAllDeps = async (projectDir: string) => {
-  await installDeps({ cwd: projectDir, silent: true, packageManager: 'pnpm' });
-};
-
-export const installDependencies = async (projectDir: string) =>
-  spinner(installAllDeps(projectDir), {
-    text: `Installing dependencies. This could take a minute...`,
-    successText: `Dependencies installed successfully`,
-    failText: (err) => colorize('red', `Failed to install dependencies: ${err.message}`),
-  });
diff --git a/packages/create-catalyst/src/utils/is-exec-exception.ts b/packages/create-catalyst/src/utils/is-exec-exception.ts
deleted file mode 100644
index 9cdf5a6280..0000000000
--- a/packages/create-catalyst/src/utils/is-exec-exception.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { ExecException } from 'node:child_process';
-
-export function isExecException(error: unknown): error is ExecException {
-  return typeof error === 'object' && error !== null && 'stdout' in error && 'stderr' in error;
-}
diff --git a/packages/create-catalyst/src/utils/login.ts b/packages/create-catalyst/src/utils/login.ts
deleted file mode 100644
index 76daa16b42..0000000000
--- a/packages/create-catalyst/src/utils/login.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-import { colorize } from 'consola/utils';
-import open from 'open';
-import { createInterface } from 'readline';
-
-import { Auth } from './auth';
-import { Config } from './config';
-import { spinner } from './spinner';
-
-interface LoginResult {
-  storeHash: string;
-  accessToken: string;
-}
-
-interface DeviceCodeCredentials {
-  store_hash: string;
-  access_token: string;
-}
-
-async function pollDeviceCode(
-  auth: Auth,
-  deviceCode: string,
-  interval: number,
-): Promise<DeviceCodeCredentials | null> {
-  try {
-    const credentials = await auth.checkDeviceCode(deviceCode);
-
-    return credentials;
-  } catch {
-    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-
-    return null;
-  }
-}
-
-async function waitForCredentials(
-  auth: Auth,
-  deviceCode: string,
-  interval: number,
-): Promise<DeviceCodeCredentials> {
-  const credentials = await pollDeviceCode(auth, deviceCode, interval);
-
-  if (credentials) {
-    return credentials;
-  }
-
-  return waitForCredentials(auth, deviceCode, interval);
-}
-
-async function waitForKeyPress(prompt: string): Promise<boolean> {
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  // Enable raw mode to get individual keystrokes
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-
-  return new Promise((resolve) => {
-    process.stdin.once('data', (data) => {
-      // Restore normal stdin mode
-      process.stdin.setRawMode(false);
-      process.stdin.pause();
-      rl.close();
-
-      // Only proceed if Enter was pressed (13 or 10 are the ASCII codes for CR and LF)
-      const shouldProceed = data[0] === 13 || data[0] === 10;
-
-      // Add a newline since we're in raw mode
-      process.stdout.write('\n');
-
-      resolve(shouldProceed);
-    });
-
-    // Display the prompt
-    rl.write(prompt);
-  });
-}
-
-export async function login(baseUrl: string): Promise<LoginResult> {
-  const auth = new Auth({ baseUrl });
-
-  const deviceCode = await auth.getDeviceCode();
-
-  console.log(
-    colorize('yellow', '\n! First copy your one-time code: ') +
-      colorize('bold', deviceCode.user_code),
-  );
-  console.log(`Press Enter to open ${deviceCode.verification_uri} in your browser...`);
-
-  const shouldOpenUrl = await waitForKeyPress('');
-
-  if (shouldOpenUrl) {
-    await open(deviceCode.verification_uri);
-  }
-
-  const credentials = await spinner(
-    () => waitForCredentials(auth, deviceCode.device_code, deviceCode.interval),
-    { text: 'Waiting for authentication...', successText: 'Authentication complete' },
-  );
-
-  return {
-    storeHash: credentials.store_hash,
-    accessToken: credentials.access_token,
-  };
-}
-
-export function storeCredentials(projectDir: string, credentials: LoginResult): void {
-  const config = new Config(projectDir);
-
-  config.setAuth(credentials.storeHash, credentials.accessToken);
-}
diff --git a/packages/create-catalyst/src/utils/parse.ts b/packages/create-catalyst/src/utils/parse.ts
deleted file mode 100644
index c902ca90dd..0000000000
--- a/packages/create-catalyst/src/utils/parse.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import * as z from 'zod';
-import { fromZodError } from 'zod-validation-error';
-
-export const parse = <T>(data: unknown, schema: z.Schema<T>): T => {
-  try {
-    return schema.parse(data);
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      console.error(fromZodError(error).toString());
-    }
-
-    process.exit(1);
-  }
-};
diff --git a/packages/create-catalyst/src/utils/reset-branch-to-ref.ts b/packages/create-catalyst/src/utils/reset-branch-to-ref.ts
deleted file mode 100644
index ebaf7e0e66..0000000000
--- a/packages/create-catalyst/src/utils/reset-branch-to-ref.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { sync as spawnSync } from 'cross-spawn';
-
-export function resetBranchToRef(projectDir: string, ghRef: string) {
-  const spawn = spawnSync('git', ['reset', '--hard', ghRef, '--'], {
-    cwd: projectDir,
-    encoding: 'utf8',
-    // Explicitly set shell to false to avoid shell injection
-    // Don't use shell: true as it's a security risk
-    shell: false,
-  });
-
-  const stderr = spawn.stderr.trim();
-
-  if (spawn.status !== 0 && stderr) {
-    throw new Error(stderr);
-  }
-}
diff --git a/packages/create-catalyst/src/utils/spinner.spec.ts b/packages/create-catalyst/src/utils/spinner.spec.ts
deleted file mode 100644
index fe50bcd61f..0000000000
--- a/packages/create-catalyst/src/utils/spinner.spec.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { oraPromise } from 'ora';
-
-import { spinner } from './spinner';
-
-jest.mock('ora', () => ({
-  oraPromise: jest.fn().mockResolvedValue('Result'),
-}));
-
-describe('spinner', () => {
-  it('should call oraPromise with the provided action', async () => {
-    const mockAction = jest.fn();
-
-    await spinner(mockAction, { text: 'Loading', successText: 'Loaded' });
-
-    expect(oraPromise).toHaveBeenCalledWith(mockAction, {
-      spinner: 'triangle',
-      text: 'Loading',
-      successText: 'Loaded',
-    });
-  });
-
-  it('should return the resolved value of the action', async () => {
-    const mockAction = jest.fn().mockResolvedValue('Result');
-
-    const result = await spinner(mockAction, { text: 'Loading', successText: 'Loaded' });
-
-    expect(result).toBe('Result');
-  });
-});
diff --git a/packages/create-catalyst/src/utils/spinner.ts b/packages/create-catalyst/src/utils/spinner.ts
deleted file mode 100644
index cd04f2aac2..0000000000
--- a/packages/create-catalyst/src/utils/spinner.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { type Ora, oraPromise, type PromiseOptions } from 'ora';
-
-export const spinner = async <T>(
-  action: PromiseLike<T> | ((spinner: Ora) => PromiseLike<T>),
-  oraOpts: PromiseOptions<T>,
-) => {
-  return oraPromise(action, {
-    spinner: 'triangle',
-    ...oraOpts,
-  }).catch(() => process.exit(1));
-};
diff --git a/packages/create-catalyst/src/utils/telemetry/index.ts b/packages/create-catalyst/src/utils/telemetry/index.ts
deleted file mode 100644
index 67c0ef85c9..0000000000
--- a/packages/create-catalyst/src/utils/telemetry/index.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { colorize } from 'consola/utils';
-
-import { Telemetry } from './telemetry';
-
-export interface CatalystTelemetryOptions {
-  enable?: boolean;
-  disable?: boolean;
-}
-
-const telemetry = new Telemetry();
-let isEnabled = telemetry.isEnabled();
-
-const catalystTelemetry = (options: CatalystTelemetryOptions, arg: string | undefined) => {
-  if (options.enable || arg === 'enable') {
-    telemetry.setEnabled(true);
-    isEnabled = true;
-
-    console.log('Success!');
-  } else if (options.disable || arg === 'disable') {
-    const path = telemetry.setEnabled(false);
-
-    if (isEnabled) {
-      console.log(`Your preference has been saved${path ? ` to ${path}` : ''}`);
-    } else {
-      console.log(`Catalyst CLI telemetry collection is already disabled.`);
-    }
-
-    isEnabled = false;
-  } else {
-    console.log('Catalyst CLI Telemetry');
-  }
-
-  console.log(
-    `\nStatus: ${colorize('bold', isEnabled ? colorize('green', 'Enabled') : colorize('red', 'Disabled'))}`,
-  );
-
-  if (!isEnabled) {
-    console.log(
-      `\nYou have opted-out of Catalyst CLI telemetry.\nNo data will be collected from your machine.`,
-    );
-  }
-};
-
-export { catalystTelemetry };
diff --git a/packages/create-catalyst/src/utils/telemetry/telemetry.ts b/packages/create-catalyst/src/utils/telemetry/telemetry.ts
deleted file mode 100644
index 369a4e5698..0000000000
--- a/packages/create-catalyst/src/utils/telemetry/telemetry.ts
+++ /dev/null
@@ -1,119 +0,0 @@
-import { Analytics } from '@segment/analytics-node';
-import Conf from 'conf';
-import { randomBytes } from 'crypto';
-
-import PACKAGE_INFO from '../../../package.json';
-
-// This is the key that stores whether or not telemetry is enabled or disabled.
-const TELEMETRY_KEY_ENABLED = 'telemetry.enabled';
-
-// This is a quasi-persistent identifier used to dedupe recurring events.
-const TELEMETRY_KEY_ID = `telemetry.anonymousId`;
-
-interface Config {
-  telemetry: {
-    enabled: boolean;
-    anonymousId: string;
-  };
-}
-
-export class Telemetry {
-  readonly sessionId: string;
-  readonly analytics: Analytics;
-
-  private conf: Conf<Config> | null;
-  private CATALYST_TELEMETRY_DISABLED: string | undefined;
-
-  private readonly projectName = 'catalyst-cli';
-  private readonly projectVersion = PACKAGE_INFO.version;
-
-  constructor() {
-    this.CATALYST_TELEMETRY_DISABLED = process.env.CATALYST_TELEMETRY_DISABLED;
-
-    try {
-      this.conf = new Conf({
-        projectName: this.projectName,
-        projectVersion: this.projectVersion,
-      });
-    } catch {
-      this.conf = null;
-    }
-
-    this.sessionId = randomBytes(32).toString('hex');
-    this.analytics = new Analytics({
-      writeKey: process.env.CLI_SEGMENT_WRITE_KEY ?? 'not-a-valid-segment-write-key',
-    });
-  }
-
-  async track(eventName: string, payload: Record<string, unknown>) {
-    if (!this.isEnabled()) {
-      return Promise.resolve(undefined);
-    }
-
-    this.analytics.track({
-      event: eventName,
-      anonymousId: this.getAnonymousId(),
-      properties: {
-        ...payload,
-        sessionId: this.sessionId,
-      },
-      context: {
-        app: {
-          name: this.projectName,
-          version: this.projectVersion,
-        },
-      },
-    });
-  }
-
-  async identify(storeHash?: string) {
-    if (!this.isEnabled()) {
-      return Promise.resolve(undefined);
-    }
-
-    if (!storeHash) {
-      return Promise.resolve(undefined);
-    }
-
-    this.analytics.identify({
-      userId: storeHash,
-      anonymousId: this.getAnonymousId(),
-      context: {
-        app: {
-          name: this.projectName,
-          version: this.projectVersion,
-        },
-      },
-    });
-  }
-
-  setEnabled = (_enabled: boolean) => {
-    const enabled = Boolean(_enabled);
-
-    this.conf?.set(TELEMETRY_KEY_ENABLED, enabled);
-
-    return this.conf?.path;
-  };
-
-  isEnabled(): boolean {
-    return (
-      !this.CATALYST_TELEMETRY_DISABLED &&
-      !!this.conf &&
-      this.conf.get<typeof TELEMETRY_KEY_ENABLED, boolean>(TELEMETRY_KEY_ENABLED, true)
-    );
-  }
-
-  private getAnonymousId(): string {
-    const val = this.conf?.get<typeof TELEMETRY_KEY_ID, string>(TELEMETRY_KEY_ID);
-
-    if (val) {
-      return val;
-    }
-
-    const generated = randomBytes(32).toString('hex');
-
-    this.conf?.set(TELEMETRY_KEY_ID, generated);
-
-    return generated;
-  }
-}
diff --git a/packages/create-catalyst/src/utils/user-agent.ts b/packages/create-catalyst/src/utils/user-agent.ts
deleted file mode 100644
index 141c92e9aa..0000000000
--- a/packages/create-catalyst/src/utils/user-agent.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import {
-  isDevelopment,
-  isLinux,
-  isMacOS,
-  isProduction,
-  isTest,
-  isWindows,
-  nodeVersion,
-  process,
-  provider,
-  runtime,
-} from 'std-env';
-
-import packageInfo from '../../package.json';
-
-const { name, version } = packageInfo;
-
-const getOS = () => {
-  if (isWindows) return 'Windows';
-  if (isMacOS) return 'macOS';
-  if (isLinux) return 'Linux';
-
-  return 'Unknown OS';
-};
-
-const getEnv = () => {
-  if (isDevelopment) return 'Development';
-  if (isTest) return 'Test';
-  if (isProduction) return 'Production';
-};
-
-const getPlatform = () => {
-  const os = getOS();
-  const env = getEnv();
-
-  const keysOfInterest = [
-    os,
-    env,
-    runtime,
-    provider,
-    `Node ${nodeVersion}`,
-    process.env.NODE_ENV,
-  ].filter(Boolean);
-
-  return keysOfInterest.join('; ');
-};
-
-const detectedPlatform = getPlatform();
-
-export const getCLIUserAgent = (platform?: string, extensions?: string): string => {
-  const userAgentParts = [`${name}/${version}`];
-
-  const platformValue = platform ?? detectedPlatform;
-
-  userAgentParts.push(`(${platformValue})`);
-
-  if (extensions) {
-    userAgentParts.push(extensions);
-  }
-
-  return userAgentParts.join(' ');
-};
diff --git a/packages/create-catalyst/src/utils/write-env.ts b/packages/create-catalyst/src/utils/write-env.ts
deleted file mode 100644
index 686eb79e26..0000000000
--- a/packages/create-catalyst/src/utils/write-env.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { outputFileSync } from 'fs-extra/esm';
-import { join } from 'path';
-
-export const writeEnv = (projectDir: string, envVars: Record<string, string>) => {
-  outputFileSync(
-    join(projectDir, '.env.local'),
-    `${Object.entries(envVars)
-      .map(([key, value]) => `${key}=${value}`)
-      .join('\n')}\n`,
-  );
-};
diff --git a/packages/create-catalyst/tsup.config.ts b/packages/create-catalyst/tsup.config.ts
index 175ef8047f..8f158032e6 100644
--- a/packages/create-catalyst/tsup.config.ts
+++ b/packages/create-catalyst/tsup.config.ts
@@ -3,10 +3,10 @@ import { defineConfig, Options } from 'tsup';
 export default defineConfig((options: Options) => ({
   entry: ['src/index.ts'],
   format: ['esm'],
+  // Match the `node >= 24` engine so esbuild preserves `import.meta.url`
+  // (a lower target shims it to `{}`, breaking `createRequire`).
+  target: 'node24',
   clean: !options.watch,
   sourcemap: true,
-  env: {
-    CLI_SEGMENT_WRITE_KEY: process.env.CLI_SEGMENT_WRITE_KEY ?? 'not-a-valid-segment-write-key',
-  },
   ...options,
 }));
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f5377351b4..20eac480a6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -38,12 +38,15 @@ importers:
 
   core:
     dependencies:
+      '@base-ui/react':
+        specifier: ^1.6.0
+        version: 1.6.0(@date-fns/tz@1.2.0)(@types/react@19.2.7)(date-fns@4.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       '@bigcommerce/catalyst-client':
         specifier: workspace:^
         version: link:../packages/client
       '@c15t/nextjs':
         specifier: ^1.8.2
-        version: 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
+        version: 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
       '@conform-to/react':
         specifier: ^1.6.1
         version: 1.6.1(react@19.1.7)
@@ -121,7 +124,7 @@ importers:
         version: 1.5.0(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(react@19.1.7)(svelte@5.1.15)(vue@3.5.16(typescript@5.8.3))
       '@vercel/functions':
         specifier: ^2.2.12
-        version: 2.2.12(@aws-sdk/credential-provider-web-identity@3.864.0)
+        version: 2.2.12(@aws-sdk/credential-provider-web-identity@3.972.59)
       '@vercel/otel':
         specifier: ^2.1.0
         version: 2.1.0(@opentelemetry/api-logs@0.208.0)(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@opentelemetry/resources@2.2.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-logs@0.208.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-metrics@2.0.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))
@@ -161,6 +164,9 @@ importers:
       jose:
         specifier: ^5.10.0
         version: 5.10.0
+      lite-youtube-embed:
+        specifier: ^0.3.4
+        version: 0.3.4
       lodash.debounce:
         specifier: ^4.0.8
         version: 4.0.8
@@ -215,9 +221,12 @@ importers:
       sonner:
         specifier: ^1.7.4
         version: 1.7.4(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      storefront-kit:
+        specifier: ^0.24.0
+        version: 0.24.0(2eea54938541e43338f6c40ea8e1cef3)
       swr:
         specifier: ^2.2.5
-        version: 2.4.1(react@19.1.7)
+        version: 2.4.2(react@19.1.7)
       tailwindcss-radix:
         specifier: ^3.0.5
         version: 3.0.5(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))
@@ -321,9 +330,15 @@ importers:
 
   packages/catalyst:
     dependencies:
+      '@commander-js/extra-typings':
+        specifier: ^14.0.0
+        version: 14.0.0(commander@14.0.0)
+      '@inquirer/prompts':
+        specifier: ^7.5.3
+        version: 7.5.3(@types/node@22.15.30)
       '@opennextjs/cloudflare':
-        specifier: ^1.8.0
-        version: 1.8.0(encoding@0.1.13)(wrangler@4.31.0)
+        specifier: 1.17.3
+        version: 1.17.3(encoding@0.1.13)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(wrangler@4.31.0)
       '@segment/analytics-node':
         specifier: ^2.2.1
         version: 2.2.1(encoding@0.1.13)
@@ -339,12 +354,36 @@ importers:
       consola:
         specifier: ^3.4.2
         version: 3.4.2
+      cross-spawn:
+        specifier: ^7.0.6
+        version: 7.0.6
       dotenv:
         specifier: ^16.5.0
         version: 16.5.0
       execa:
         specifier: ^9.6.0
         version: 9.6.0
+      fs-extra:
+        specifier: ^11.3.0
+        version: 11.3.0
+      lodash.kebabcase:
+        specifier: ^4.1.1
+        version: 4.1.1
+      nypm:
+        specifier: ^0.5.4
+        version: 0.5.4
+      open:
+        specifier: ^10.1.0
+        version: 10.1.2
+      semver:
+        specifier: ^7.7.4
+        version: 7.7.4
+      std-env:
+        specifier: ^3.9.0
+        version: 3.9.0
+      tar:
+        specifier: ^7.5.7
+        version: 7.5.19
       yocto-spinner:
         specifier: ^1.0.0
         version: 1.0.0
@@ -358,15 +397,24 @@ importers:
       '@bigcommerce/eslint-config-catalyst':
         specifier: workspace:^
         version: link:../eslint-config-catalyst
-      '@commander-js/extra-typings':
-        specifier: ^14.0.0
-        version: 14.0.0(commander@14.0.0)
       '@types/adm-zip':
         specifier: ^0.5.7
         version: 0.5.7
+      '@types/cross-spawn':
+        specifier: ^6.0.6
+        version: 6.0.6
+      '@types/fs-extra':
+        specifier: ^11.0.4
+        version: 11.0.4
+      '@types/lodash.kebabcase':
+        specifier: ^4.1.9
+        version: 4.1.9
       '@types/node':
         specifier: ^22.15.30
         version: 22.15.30
+      '@types/semver':
+        specifier: ^7.7.0
+        version: 7.7.0
       '@vitest/coverage-v8':
         specifier: ^3.2.4
         version: 3.2.4(vitest@3.2.4)
@@ -428,75 +476,12 @@ importers:
 
   packages/create-catalyst:
     dependencies:
-      '@commander-js/extra-typings':
-        specifier: ^14.0.0
-        version: 14.0.0(commander@14.0.0)
-      '@iarna/toml':
-        specifier: ^2.2.5
-        version: 2.2.5
-      '@inquirer/core':
-        specifier: ^10.1.13
-        version: 10.1.13(@types/node@22.15.30)
-      '@inquirer/figures':
-        specifier: ^1.0.12
-        version: 1.0.12
-      '@inquirer/prompts':
-        specifier: ^7.5.3
-        version: 7.5.3(@types/node@22.15.30)
-      '@inquirer/type':
-        specifier: ^3.0.7
-        version: 3.0.7(@types/node@22.15.30)
-      '@segment/analytics-node':
-        specifier: ^2.2.1
-        version: 2.2.1(encoding@0.1.13)
-      ansi-escapes:
-        specifier: ^7.0.0
-        version: 7.0.0
-      commander:
-        specifier: ^14.0.0
-        version: 14.0.0
-      conf:
-        specifier: ^13.1.0
-        version: 13.1.0
-      consola:
-        specifier: ^3.4.2
-        version: 3.4.2
-      cross-spawn:
-        specifier: ^7.0.6
-        version: 7.0.6
-      dotenv:
-        specifier: ^16.5.0
-        version: 16.5.0
-      fs-extra:
-        specifier: ^11.3.0
-        version: 11.3.0
-      giget:
-        specifier: ^1.2.5
-        version: 1.2.5
-      lodash.kebabcase:
-        specifier: ^4.1.1
-        version: 4.1.1
-      nypm:
-        specifier: ^0.5.4
-        version: 0.5.4
-      open:
-        specifier: ^10.1.2
-        version: 10.1.2
-      ora:
-        specifier: ^8.2.0
-        version: 8.2.0
+      '@bigcommerce/catalyst':
+        specifier: workspace:^
+        version: link:../catalyst
       semver:
         specifier: ^7.7.2
         version: 7.7.2
-      std-env:
-        specifier: ^3.9.0
-        version: 3.9.0
-      zod:
-        specifier: ^3.25.51
-        version: 3.25.51
-      zod-validation-error:
-        specifier: ^3.4.1
-        version: 3.4.1(zod@3.25.51)
     devDependencies:
       '@bigcommerce/eslint-config':
         specifier: ^2.11.0
@@ -510,24 +495,12 @@ importers:
       '@swc/jest':
         specifier: ^0.2.38
         version: 0.2.38(@swc/core@1.11.31)
-      '@types/cross-spawn':
-        specifier: ^6.0.6
-        version: 6.0.6
-      '@types/fs-extra':
-        specifier: ^11.0.4
-        version: 11.0.4
       '@types/jest':
         specifier: ^29.5.14
         version: 29.5.14
-      '@types/lodash.kebabcase':
-        specifier: ^4.1.9
-        version: 4.1.9
       '@types/node':
         specifier: ^22.15.30
         version: 22.15.30
-      '@types/prompts':
-        specifier: ^2.4.9
-        version: 2.4.9
       '@types/semver':
         specifier: ^7.7.0
         version: 7.7.0
@@ -537,9 +510,6 @@ importers:
       jest:
         specifier: ^29.7.0
         version: 29.7.0(@types/node@22.15.30)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.11.31)(@types/node@22.15.30)(typescript@5.8.3))
-      msw:
-        specifier: ^2.9.0
-        version: 2.9.0(@types/node@22.15.30)(typescript@5.8.3)
       prettier:
         specifier: ^3.6.2
         version: 3.6.2
@@ -602,62 +572,62 @@ packages:
   '@asamuzakjp/css-color@3.2.0':
     resolution: {integrity: sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==}
 
-  '@ast-grep/napi-darwin-arm64@0.35.0':
-    resolution: {integrity: sha512-T+MN4Oinc+sXjXCIHzfxDDWY7r2pKgPxM6zVeVlkMTrJV2mJtyKYBIS+CABhRM6kflps2T2I6l4DGaKV/8Ym9w==}
+  '@ast-grep/napi-darwin-arm64@0.40.5':
+    resolution: {integrity: sha512-2F072fGN0WTq7KI3okuEnkGJVEHLbi56Bw1H6NAMf7j2mJJeQWsRyGOMcyNnUXZDeNdvoMH0OB2a5wwUegY/nQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@ast-grep/napi-darwin-x64@0.35.0':
-    resolution: {integrity: sha512-pEYiN6JI1HY2uWhMYJ9+3yIMyVYKuYdFzeD+dL7odA3qzK0o9N9AM3/NOt4ynU2EhufaWCJr0P5NoQ636qN6MQ==}
+  '@ast-grep/napi-darwin-x64@0.40.5':
+    resolution: {integrity: sha512-dJMidHZhhxuLBYNi6/FKI812jQ7wcFPSKkVPwviez2D+KvYagapUMAV/4dJ7FCORfguVk8Y0jpPAlYmWRT5nvA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@ast-grep/napi-linux-arm64-gnu@0.35.0':
-    resolution: {integrity: sha512-NBuzQngABGKz7lhG08IQb+7nPqUx81Ol37xmS3ZhVSdSgM0mtp93rCbgFTkJcAFE8IMfCHQSg7G4g0Iotz4ABQ==}
+  '@ast-grep/napi-linux-arm64-gnu@0.40.5':
+    resolution: {integrity: sha512-nBRCbyoS87uqkaw4Oyfe5VO+SRm2B+0g0T8ME69Qry9ShMf41a2bTdpcQx9e8scZPogq+CTwDHo3THyBV71l9w==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@ast-grep/napi-linux-arm64-musl@0.35.0':
-    resolution: {integrity: sha512-1EcvHPwyWpCL/96LuItBYGfeI5FaMTRvL+dHbO/hL5q1npqbb5qn+ppJwtNOjTPz8tayvgggxVk9T4C2O7taYA==}
+  '@ast-grep/napi-linux-arm64-musl@0.40.5':
+    resolution: {integrity: sha512-/qKsmds5FMoaEj6FdNzepbmLMtlFuBLdrAn9GIWCqOIcVcYvM1Nka8+mncfeXB/MFZKOrzQsQdPTWqrrQzXLrA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@ast-grep/napi-linux-x64-gnu@0.35.0':
-    resolution: {integrity: sha512-FDzNdlqmQnsiWXhnLxusw5AOfEcEM+5xtmrnAf3SBRFr86JyWD9qsynnFYC2pnP9hlMfifNH2TTmMpyGJW49Xw==}
+  '@ast-grep/napi-linux-x64-gnu@0.40.5':
+    resolution: {integrity: sha512-DP4oDbq7f/1A2hRTFLhJfDFR6aI5mRWdEfKfHzRItmlKsR9WlcEl1qDJs/zX9R2EEtIDsSKRzuJNfJllY3/W8Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@ast-grep/napi-linux-x64-musl@0.35.0':
-    resolution: {integrity: sha512-wlmndjfBafT8u5p4DBnoRQyoCSGNuVSz7rT3TqhvlHcPzUouRWMn95epU9B1LNLyjXvr9xHeRjSktyCN28w57Q==}
+  '@ast-grep/napi-linux-x64-musl@0.40.5':
+    resolution: {integrity: sha512-BRZUvVBPUNpWPo6Ns8chXVzxHPY+k9gpsubGTHy92Q26ecZULd/dTkWWdnvfhRqttsSQ9Pe/XQdi5+hDQ6RYcg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@ast-grep/napi-win32-arm64-msvc@0.35.0':
-    resolution: {integrity: sha512-gkhJeYc4rrZLX2icLxalPikTLMR57DuIYLwLr9g+StHYXIsGHrbfrE6Nnbdd8Izfs34ArFCrcwdaMrGlvOPSeg==}
+  '@ast-grep/napi-win32-arm64-msvc@0.40.5':
+    resolution: {integrity: sha512-y95zSEwc7vhxmcrcH0GnK4ZHEBQrmrszRBNQovzaciF9GUqEcCACNLoBesn4V47IaOp4fYgD2/EhGRTIBFb2Ug==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@ast-grep/napi-win32-ia32-msvc@0.35.0':
-    resolution: {integrity: sha512-OdUuRa3chHCZ65y+qALfkUjz0W0Eg21YZ9TyPquV5why07M6HAK38mmYGzLxFH6294SvRQhs+FA/rAfbKeH0jA==}
+  '@ast-grep/napi-win32-ia32-msvc@0.40.5':
+    resolution: {integrity: sha512-K/u8De62iUnFCzVUs7FBdTZ2Jrgc5/DLHqjpup66KxZ7GIM9/HGME/O8aSoPkpcAeCD4TiTZ11C1i5p5H98hTg==}
     engines: {node: '>= 10'}
     cpu: [ia32]
     os: [win32]
 
-  '@ast-grep/napi-win32-x64-msvc@0.35.0':
-    resolution: {integrity: sha512-pcQRUHqbroTN1oQ56V982a7IZTUUySQYWa2KEyksiifHGuBuitlzcyzFGjT96ThcqD9XW0UVJMvpoF2Qjh006Q==}
+  '@ast-grep/napi-win32-x64-msvc@0.40.5':
+    resolution: {integrity: sha512-dqm5zg/o4Nh4VOQPEpMS23ot8HVd22gG0eg01t4CFcZeuzyuSgBlOL3N7xLbz3iH2sVkk7keuBwAzOIpTqziNQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@ast-grep/napi@0.35.0':
-    resolution: {integrity: sha512-3ucaaSxV6fxXoqHrE/rxAvP1THnDdY5jNzGlnvx+JvnY9C/dSRKc0jlRMRz59N3El572+/yNRUUpAV1T9aBJug==}
+  '@ast-grep/napi@0.40.5':
+    resolution: {integrity: sha512-hJA62OeBKUQT68DD2gDyhOqJxZxycqg8wLxbqjgqSzYttCMSDL9tiAQ9abgekBYNHudbJosm9sWOEbmCDfpX2A==}
     engines: {node: '>= 10'}
 
   '@auth/core@0.41.0':
@@ -674,289 +644,183 @@ packages:
       nodemailer:
         optional: true
 
-  '@aws-crypto/crc32@5.2.0':
-    resolution: {integrity: sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==}
-    engines: {node: '>=16.0.0'}
-
-  '@aws-crypto/crc32c@5.2.0':
-    resolution: {integrity: sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag==}
-
-  '@aws-crypto/ie11-detection@3.0.0':
-    resolution: {integrity: sha512-341lBBkiY1DfDNKai/wXM3aujNBkXR7tq1URPQDL9wi3AUbI80NR74uF1TXHMm7po1AcnFk8iu2S2IeU/+/A+Q==}
-
   '@aws-crypto/sha1-browser@5.2.0':
     resolution: {integrity: sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg==}
 
-  '@aws-crypto/sha256-browser@3.0.0':
-    resolution: {integrity: sha512-8VLmW2B+gjFbU5uMeqtQM6Nj0/F1bro80xQXCW6CQBWgosFWXTx77aeOF5CAIAmbOK64SdMBJdNr6J41yP5mvQ==}
-
   '@aws-crypto/sha256-browser@5.2.0':
     resolution: {integrity: sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw==}
 
-  '@aws-crypto/sha256-js@3.0.0':
-    resolution: {integrity: sha512-PnNN7os0+yd1XvXAy23CFOmTbMaDxgxXtTKHybrJ39Y8kGzBATgBFibWJKH6BhytLI/Zyszs87xCOBNyBig6vQ==}
-
   '@aws-crypto/sha256-js@5.2.0':
     resolution: {integrity: sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==}
     engines: {node: '>=16.0.0'}
 
-  '@aws-crypto/supports-web-crypto@3.0.0':
-    resolution: {integrity: sha512-06hBdMwUAb2WFTuGG73LSC0wfPu93xWwo5vL2et9eymgmu3Id5vFAHBbajVWiGhPO37qcsdCap/FqXvJGJWPIg==}
-
   '@aws-crypto/supports-web-crypto@5.2.0':
     resolution: {integrity: sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg==}
 
-  '@aws-crypto/util@3.0.0':
-    resolution: {integrity: sha512-2OJlpeJpCR48CC8r+uKVChzs9Iungj9wkZrl8Z041DWEWvyIHILYKCPNzJghKsivj+S3mLo6BVc7mBNzdxA46w==}
-
   '@aws-crypto/util@5.2.0':
     resolution: {integrity: sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==}
 
-  '@aws-sdk/client-cloudfront@3.398.0':
-    resolution: {integrity: sha512-kISKhqN1k48TaMPbLgq9jj7mO2jvbJdhirvfu4JW3jhFhENnkY0oCwTPvR4Q6Ne2as6GFAMo2XZDZq4rxC7YDw==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/client-dynamodb@3.868.0':
-    resolution: {integrity: sha512-a2uKLRplH3vTHgTHr+MaZ1YH0Sy0yVHK9rhM/drktxgXehMf4p7dZtt783c9SEupZvo46LxXryvwifoUdL4nRg==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/client-lambda@3.865.0':
-    resolution: {integrity: sha512-ncCEW/kNRV8yJA/45z5HO6WEeihADzFY7RISfezDbvP3/X4dZb2gycRVPmJIE6CBqf01jwTkbG36qO+/iHIELg==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/client-s3@3.864.0':
-    resolution: {integrity: sha512-QGYi9bWliewxumsvbJLLyx9WC0a4DP4F+utygBcq0zwPxaM0xDfBspQvP1dsepi7mW5aAjZmJ2+Xb7X0EhzJ/g==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/client-sqs@3.864.0':
-    resolution: {integrity: sha512-SxEdQW/g2hb7/O4juAQL0kOD86/QBUSNkdJ5rN3Nd04rJmYTCxe38iCJBT637n+hiedxThLuj8H9ZmY1/OSg7Q==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/client-sso@3.398.0':
-    resolution: {integrity: sha512-CygL0jhfibw4kmWXG/3sfZMFNjcXo66XUuPC4BqZBk8Rj5vFoxp1vZeMkDLzTIk97Nvo5J5Bh+QnXKhub6AckQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/client-sso@3.864.0':
-    resolution: {integrity: sha512-THiOp0OpQROEKZ6IdDCDNNh3qnNn/kFFaTSOiugDpgcE5QdsOxh1/RXq7LmHpTJum3cmnFf8jG59PHcz9Tjnlw==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/client-sts@3.398.0':
-    resolution: {integrity: sha512-/3Pa9wLMvBZipKraq3AtbmTfXW6q9kyvhwOno64f1Fz7kFb8ijQFMGoATS70B2pGEZTlxkUqJFWDiisT6Q6dFg==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/core@3.864.0':
-    resolution: {integrity: sha512-LFUREbobleHEln+Zf7IG83lAZwvHZG0stI7UU0CtwyuhQy5Yx0rKksHNOCmlM7MpTEbSCfntEhYi3jUaY5e5lg==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/credential-provider-env@3.398.0':
-    resolution: {integrity: sha512-Z8Yj5z7FroAsR6UVML+XUdlpoqEe9Dnle8c2h8/xWwIC2feTfIBhjLhRVxfbpbM1pLgBSNEcZ7U8fwq5l7ESVQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/credential-provider-env@3.864.0':
-    resolution: {integrity: sha512-StJPOI2Rt8UE6lYjXUpg6tqSZaM72xg46ljPg8kIevtBAAfdtq9K20qT/kSliWGIBocMFAv0g2mC0hAa+ECyvg==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/credential-provider-http@3.864.0':
-    resolution: {integrity: sha512-E/RFVxGTuGnuD+9pFPH2j4l6HvrXzPhmpL8H8nOoJUosjx7d4v93GJMbbl1v/fkDLqW9qN4Jx2cI6PAjohA6OA==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/credential-provider-ini@3.398.0':
-    resolution: {integrity: sha512-AsK1lStK3nB9Cn6S6ODb1ktGh7SRejsNVQVKX3t5d3tgOaX+aX1Iwy8FzM/ZEN8uCloeRifUGIY9uQFygg5mSw==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/credential-provider-ini@3.864.0':
-    resolution: {integrity: sha512-PlxrijguR1gxyPd5EYam6OfWLarj2MJGf07DvCx9MAuQkw77HBnsu6+XbV8fQriFuoJVTBLn9ROhMr/ROAYfUg==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/credential-provider-node@3.398.0':
-    resolution: {integrity: sha512-odmI/DSKfuWUYeDnGTCEHBbC8/MwnF6yEq874zl6+owoVv0ZsYP8qBHfiJkYqrwg7wQ7Pi40sSAPC1rhesGwzg==}
-    engines: {node: '>=14.0.0'}
-
-  '@aws-sdk/credential-provider-node@3.864.0':
-    resolution: {integrity: sha512-2BEymFeXURS+4jE9tP3vahPwbYRl0/1MVaFZcijj6pq+nf5EPGvkFillbdBRdc98ZI2NedZgSKu3gfZXgYdUhQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@aws-sdk/credential-provider-process@3.398.0':
-    resolution: {integrity: sha512-WrkBL1W7TXN508PA9wRXPFtzmGpVSW98gDaHEaa8GolAPHMPa5t2QcC/z/cFpglzrcVv8SA277zu9Z8tELdZhg==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/checksums@3.1000.12':
+    resolution: {integrity: sha512-RgNDWfhNRIlNEzePIRrYTNi/6q+wwRMMapojn8YVzw4ZcJRa/gxVMtUbeZARR1gmopuv6oIhMbY7J66qIQ0ynw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-process@3.864.0':
-    resolution: {integrity: sha512-Zxnn1hxhq7EOqXhVYgkF4rI9MnaO3+6bSg/tErnBQ3F8kDpA7CFU24G1YxwaJXp2X4aX3LwthefmSJHwcVP/2g==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/client-cloudfront@3.984.0':
+    resolution: {integrity: sha512-couDuDLpJtoeWne/nYyJ+I+5ntBVdNgBVRTCoDaXuVV7OC3u/wz5Ps0+GogspEwMLEFoOJ8t691h3YXQtnpQTw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.398.0':
-    resolution: {integrity: sha512-2Dl35587xbnzR/GGZqA2MnFs8+kS4wbHQO9BioU0okA+8NRueohNMdrdQmQDdSNK4BfIpFspiZmFkXFNyEAfgw==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/client-dynamodb@3.984.0':
+    resolution: {integrity: sha512-8/Oft9MWQtbG6p9f8eY5fsKC2CcO5YVDlwive8eUYS9mEbgnyQxm68OyH26WvsSTykQ9QkIbR+fOG56RsIBODw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.864.0':
-    resolution: {integrity: sha512-UPyPNQbxDwHVGmgWdGg9/9yvzuedRQVF5jtMkmP565YX9pKZ8wYAcXhcYdNPWFvH0GYdB0crKOmvib+bmCuwkw==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/client-lambda@3.984.0':
+    resolution: {integrity: sha512-kqwNBIGNxGVhINwgN/UQfdsQkaMjbu9PFV2EhATWouV+RT60uMjK9JENgLDwbgJmEVbbnPsh9HaZ5KKwPSdiDg==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.398.0':
-    resolution: {integrity: sha512-iG3905Alv9pINbQ8/MIsshgqYMbWx+NDQWpxbIW3W0MkSH3iAqdVpSCteYidYX9G/jv2Um1nW3y360ib20bvNg==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/client-s3@3.984.0':
+    resolution: {integrity: sha512-7ny2Slr93Y+QniuluvcfWwyDi32zWQfznynL56Tk0vVh7bWrvS/odm8WP2nInKicRVNipcJHY2YInur6Q/9V0A==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.864.0':
-    resolution: {integrity: sha512-nNcjPN4SYg8drLwqK0vgVeSvxeGQiD0FxOaT38mV2H8cu0C5NzpvA+14Xy+W6vT84dxgmJYKk71Cr5QL2Oz+rA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/client-sqs@3.984.0':
+    resolution: {integrity: sha512-TDvHpOUWlpanc3xQ5Xw0y8L2hoojBFCCSmXQ/6rKqGOf1ScX3dMA+K9aF0Zp0iwjhSh4VvsHD42esl8XwQZDjA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/endpoint-cache@3.804.0':
-    resolution: {integrity: sha512-TQVDkA/lV6ua75ELZaichMzlp6x7tDa1bqdy/+0ZftmODPtKXuOOEcJxmdN7Ui/YRo1gkRz2D9txYy7IlNg1Og==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/core@3.974.27':
+    resolution: {integrity: sha512-WRWEgIq6vx+NU6ot3VrRu4Jovj9MIObitSi6of/GV5THDDPccBhivCRNkWJutMM+m3GvdeI3l/UbGNcoOobxOA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-bucket-endpoint@3.862.0':
-    resolution: {integrity: sha512-Wcsc7VPLjImQw+CP1/YkwyofMs9Ab6dVq96iS8p0zv0C6YTaMjvillkau4zFfrrrTshdzFWKptIFhKK8Zsei1g==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-env@3.972.53':
+    resolution: {integrity: sha512-+KDA3uc/HZ1vIneGu5QMQb0gAXDYrm2vOE60+BJ7lS0YinMQ5i2oV4PR1A16XkF6K1IbSwjEHd1hQIIgMsK48w==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-endpoint-discovery@3.862.0':
-    resolution: {integrity: sha512-43KnrSlzsa6/locegW9SLe/kMv51PPPAslDbBuLVtLcFUNWuCE7wgKTTzMPeA+NJQHKuJTFRR2TLKPYEs+4VJA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-http@3.972.55':
+    resolution: {integrity: sha512-1gBfkWY3RWeBlCoB9lIJjXMx45/54wxcgfzv6BY9otTmMrZPcNPi1v+MwZxxaCUg441NV3jsr1efnFNCXiW70g==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-expect-continue@3.862.0':
-    resolution: {integrity: sha512-oG3AaVUJ+26p0ESU4INFn6MmqqiBFZGrebST66Or+YBhteed2rbbFl7mCfjtPWUFgquQlvT1UP19P3LjQKeKpw==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-ini@3.972.60':
+    resolution: {integrity: sha512-CV2md+PXvABwRjApWGhQ0wACy9WSFIhnUGrovLcjnjBCd/46TbuivLADtkF8IWNjtCQmQ+2IagSaxqBYqXBNAQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-flexible-checksums@3.864.0':
-    resolution: {integrity: sha512-MvakvzPZi9uyP3YADuIqtk/FAcPFkyYFWVVMf5iFs/rCdk0CUzn02Qf4CSuyhbkS6Y0KrAsMgKR4MgklPU79Wg==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-login@3.972.59':
+    resolution: {integrity: sha512-JG4S9yyA1GFzJdJXqLKrUzZbyK+VDp2QIsJD7YOicJHAhqymfHpDJIok2dLnhOdVB0I37RjdC53uOwCMVS00gw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-host-header@3.398.0':
-    resolution: {integrity: sha512-m+5laWdBaxIZK2ko0OwcCHJZJ5V1MgEIt8QVQ3k4/kOkN9ICjevOYmba751pHoTnbOYB7zQd6D2OT3EYEEsUcA==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/credential-provider-node@3.972.62':
+    resolution: {integrity: sha512-S6Slq3Tx7bvFk5yc34XNADyZYTX2HUXvaFAnowGRQnhjBO8J/mP62Fn7lxvJwjaDyYm/7gh9h6HEHaltRyMFXw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-host-header@3.862.0':
-    resolution: {integrity: sha512-jDje8dCFeFHfuCAxMDXBs8hy8q9NCTlyK4ThyyfAj3U4Pixly2mmzY2u7b7AyGhWsjJNx8uhTjlYq5zkQPQCYw==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-process@3.972.53':
+    resolution: {integrity: sha512-EhfH+MQlqOMCkXIVa8MMObPzAQqwTTtxA7KhEJiyPeuNVA8PLOOUpgK7nBrgaDaGiIDLN/9LpGdaHuDjomeRTw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-location-constraint@3.862.0':
-    resolution: {integrity: sha512-MnwLxCw7Cc9OngEH3SHFhrLlDI9WVxaBkp3oTsdY9JE7v8OE38wQ9vtjaRsynjwu0WRtrctSHbpd7h/QVvtjyA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/credential-provider-sso@3.972.59':
+    resolution: {integrity: sha512-h8793pOjcImx0SB+VcLONcaQQ57VAvKVuqyewQMRKqqH+CSXsG2dwOeLMUJPMxLdNvL7dXOM0ueTukyNUnu5mA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-logger@3.398.0':
-    resolution: {integrity: sha512-CiJjW+FL12elS6Pn7/UVjVK8HWHhXMfvHZvOwx/Qkpy340sIhkuzOO6fZEruECDTZhl2Wqn81XdJ1ZQ4pRKpCg==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/credential-provider-web-identity@3.972.59':
+    resolution: {integrity: sha512-VoyO9+vl3XVmpZwn4obskrWIkrA/Jf3lSe1E3ZERlaN9u0D4YZ6+HywC3+L98QOXqZesEfedk67gRER8tK8+8w==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-logger@3.862.0':
-    resolution: {integrity: sha512-N/bXSJznNBR/i7Ofmf9+gM6dx/SPBK09ZWLKsW5iQjqKxAKn/2DozlnE54uiEs1saHZWoNDRg69Ww4XYYSlG1Q==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/dynamodb-codec@3.973.27':
+    resolution: {integrity: sha512-eOTdNw3SwpkO/WOBFFY28Us9WcjBxejRw0vRD0eRqp6+aisHnBXiyQhSX2VIPHkCMFThhBRfSftdXBbgh95y8A==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-recursion-detection@3.398.0':
-    resolution: {integrity: sha512-7QpOqPQAZNXDXv6vsRex4R8dLniL0E/80OPK4PPFsrCh9btEyhN9Begh4i1T+5lL28hmYkztLOkTQ2N5J3hgRQ==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/endpoint-cache@3.972.8':
+    resolution: {integrity: sha512-bBmkG0Dnhfq0/T4Z0PpUr7HkncBVaWvvCbvafeaUM+yC9wa8GGjLJmonq0QL17REB9WivgGeYgWQ5A80Uw5UnQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-recursion-detection@3.862.0':
-    resolution: {integrity: sha512-KVoo3IOzEkTq97YKM4uxZcYFSNnMkhW/qj22csofLegZi5fk90ztUnnaeKfaEJHfHp/tm1Y3uSoOXH45s++kKQ==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-bucket-endpoint@3.972.31':
+    resolution: {integrity: sha512-qAq2i5wj8wnZ+V/WlwwE0cfvJamyvV2k6v9Iq7UfDYzQC60xCHG/4/f4hJG4DELoCQeR6DstbD93pR7wLtfOtg==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-sdk-s3@3.864.0':
-    resolution: {integrity: sha512-GjYPZ6Xnqo17NnC8NIQyvvdzzO7dm+Ks7gpxD/HsbXPmV2aEfuFveJXneGW9e1BheSKFff6FPDWu8Gaj2Iu1yg==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-endpoint-discovery@3.972.22':
+    resolution: {integrity: sha512-GMoLg4XAnkiwevqcOfgz0lOTYmIdM7MJK/BL9EAvsoMFqKIGRpyNIvuSNg5gdFzP57yB+EklMlK0+TwBqj1tCg==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-sdk-sqs@3.862.0':
-    resolution: {integrity: sha512-DBX+xTAd3uhMYUFI3wIoSQYBmVFmq918Ah2t/NhTtkNmiuHAFxCy4fSzSklt9qS0i1WzccJEqOZNmqxGEFtolA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-expect-continue@3.972.27':
+    resolution: {integrity: sha512-yqwl26dLHxWYVcF8drGETF5vU0rmoYd6tY89qeoe9lsS+NWerD/0YkgUnRe1p4ZALiO3vHcxWYoi3dtahAvDZQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-sdk-sts@3.398.0':
-    resolution: {integrity: sha512-+JH76XHEgfVihkY+GurohOQ5Z83zVN1nYcQzwCFnCDTh4dG4KwhnZKG+WPw6XJECocY0R+H0ivofeALHvVWJtQ==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/middleware-flexible-checksums@3.974.37':
+    resolution: {integrity: sha512-EI6E7KlYzEGXCqfznmkmqebY3XLcqHQNnl/o3rOFRX//LJ4Vc81igwtohmfM/kHnqxE8J/hyItwL5+LdDynXQg==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-signing@3.398.0':
-    resolution: {integrity: sha512-O0KqXAix1TcvZBFt1qoFkHMUNJOSgjJTYS7lFTRKSwgsD27bdW2TM2r9R8DAccWFt5Amjkdt+eOwQMIXPGTm8w==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/middleware-host-header@3.972.28':
+    resolution: {integrity: sha512-2w4cKugljxKCgBPL5LQJLj+1kUBkWG8HO7C+7GYTS7UNATMijEK+MCEktnCpfA2koBZFcf7Ioe5YhNZ5vh5ruw==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-ssec@3.862.0':
-    resolution: {integrity: sha512-72VtP7DZC8lYTE2L3Efx2BrD98oe9WTK8X6hmd3WTLkbIjvgWQWIdjgaFXBs8WevsXkewIctfyA3KEezvL5ggw==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-location-constraint@3.972.24':
+    resolution: {integrity: sha512-a/1rbT9Vhz8Z6KXppZFFh+2zuFclkeTkzVJcRHfd4ejqkO/Gdsy7OINCAQHfX3VV0yDhRb7HjoAXy03D9N56rA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-user-agent@3.398.0':
-    resolution: {integrity: sha512-nF1jg0L+18b5HvTcYzwyFgfZQQMELJINFqI0mi4yRKaX7T5a3aGp5RVLGGju/6tAGTuFbfBoEhkhU3kkxexPYQ==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/middleware-logger@3.972.27':
+    resolution: {integrity: sha512-Qia7FsijpSh+LL9H6i9HQ3JZQsN9qdOQjwCAIi4Zi9Xqc62N7c3udBOfliavqn40FKZlgpgV/Js+NpKguyXfiA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-user-agent@3.864.0':
-    resolution: {integrity: sha512-wrddonw4EyLNSNBrApzEhpSrDwJiNfjxDm5E+bn8n32BbAojXASH8W8jNpxz/jMgNkkJNxCfyqybGKzBX0OhbQ==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-recursion-detection@3.972.29':
+    resolution: {integrity: sha512-iM0ZSNerIexGGFokLEJqEr/H2kV+WiTENZXHLb391q1ldF+qWDn86MpyH4HKfKwQRzEhInehwX9u9/a1IXAz6g==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/nested-clients@3.864.0':
-    resolution: {integrity: sha512-H1C+NjSmz2y8Tbgh7Yy89J20yD/hVyk15hNoZDbCYkXg0M358KS7KVIEYs8E2aPOCr1sK3HBE819D/yvdMgokA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-sdk-s3@3.972.58':
+    resolution: {integrity: sha512-6uaWRRYJGhOqc9EoTSbLDf9nI/doSAb5vAwGshs5/Hlv5Ce25b246lBkbRd/77fLAi+uMI1a70mJzVyLyCEufQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/region-config-resolver@3.862.0':
-    resolution: {integrity: sha512-VisR+/HuVFICrBPY+q9novEiE4b3mvDofWqyvmxHcWM7HumTz9ZQSuEtnlB/92GVM3KDUrR9EmBHNRrfXYZkcQ==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-sdk-sqs@3.972.34':
+    resolution: {integrity: sha512-BgCMs873RWtMe8LlNY5hxJjVbZtaHR6nY3BtQZk14drRJb3Iqecp5VADpw3eF5cnBvlZLWblAjCjJFU1mTjoeQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/signature-v4-multi-region@3.864.0':
-    resolution: {integrity: sha512-w2HIn/WIcUyv1bmyCpRUKHXB5KdFGzyxPkp/YK5g+/FuGdnFFYWGfcO8O+How4jwrZTarBYsAHW9ggoKvwr37w==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/middleware-ssec@3.972.24':
+    resolution: {integrity: sha512-m/+ToPJQkdRF0o9CWaQWFwdsCM1IEsppDHff43/o4fAADAZPx7YRxo18XsKStjghr7QBTdEinE4PdLcmxNqf0w==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/token-providers@3.398.0':
-    resolution: {integrity: sha512-nrYgjzavGCKJL/48Vt0EL+OlIc5UZLfNGpgyUW9cv3XZwl+kXV0QB+HH0rHZZLfpbBgZ2RBIJR9uD5ieu/6hpQ==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/middleware-user-agent@3.972.57':
+    resolution: {integrity: sha512-4gstakrfAVK7CAQ8Rar4Sig7Ztjxdp+Xt/A48VwTxwPVVNs+lAWs1+ZTGF+zlT65qWbnihUsX7uzBdPEllzLSA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/token-providers@3.864.0':
-    resolution: {integrity: sha512-gTc2QHOBo05SCwVA65dUtnJC6QERvFaPiuppGDSxoF7O5AQNK0UR/kMSenwLqN8b5E1oLYvQTv3C1idJLRX0cg==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/nested-clients@3.997.27':
+    resolution: {integrity: sha512-A8PIePF9NIIOJ/4Lg1rl9xm/+QaKkHGetq+Z9wb5B+3Da31YYXRo8n7IDMh5C+HQI5eyEmjrwkGWVdYtnLtbXQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/types@3.398.0':
-    resolution: {integrity: sha512-r44fkS+vsEgKCuEuTV+TIk0t0m5ZlXHNjSDYEUvzLStbbfUFiNus/YG4UCa0wOk9R7VuQI67badsvvPeVPCGDQ==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/region-config-resolver@3.972.31':
+    resolution: {integrity: sha512-5qLGtfKWyPK/eSLxIzsrNRfHVYZliXxe5mXYldmVB1Ca5VCpz0TjZhIb9otq1eUER8m2AQ1Jy0EBeR6qC65wvg==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/types@3.862.0':
-    resolution: {integrity: sha512-Bei+RL0cDxxV+lW2UezLbCYYNeJm6Nzee0TpW0FfyTRBhH9C1XQh4+x+IClriXvgBnRquTMMYsmJfvx8iyLKrg==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/signature-v4-multi-region@3.984.0':
+    resolution: {integrity: sha512-TaWbfYCwnuOSvDSrgs7QgoaoXse49E7LzUkVOUhoezwB7bkmhp+iojADm7UepCEu4021SquD7NG1xA+WCvmldA==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/util-arn-parser@3.804.0':
-    resolution: {integrity: sha512-wmBJqn1DRXnZu3b4EkE6CWnoWMo1ZMvlfkqU5zPz67xx1GMaXlDCchFvKAXMjk4jn/L1O3tKnoFDNsoLV1kgNQ==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/signature-v4-multi-region@3.996.38':
+    resolution: {integrity: sha512-C379Sk+MiFZCfWZphKlMyLHKxV22OjoGM5KJjj5IJNJcOCWL4IGIpnEGzv1FQiRwhYXfq55SJMfxlqPE08JJ9g==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/util-endpoints@3.398.0':
-    resolution: {integrity: sha512-Fy0gLYAei/Rd6BrXG4baspCnWTUSd0NdokU1pZh4KlfEAEN1i8SPPgfiO5hLk7+2inqtCmqxVJlfqbMVe9k4bw==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/token-providers@3.1079.0':
+    resolution: {integrity: sha512-cbietrLlHPhhmbnMPTuDS4Zj/KNGhY+3vVhn6dwjO6Dqzrwothzg2srtcY34T9mlICsTXn34avDoWLHSntP54A==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/util-endpoints@3.862.0':
-    resolution: {integrity: sha512-eCZuScdE9MWWkHGM2BJxm726MCmWk/dlHjOKvkM0sN1zxBellBMw5JohNss1Z8/TUmnW2gb9XHTOiHuGjOdksA==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/types@3.973.15':
+    resolution: {integrity: sha512-IULn8uBV/SMtmOIANsm4WHXIOtVPBWfOWs3WGL0j/sI+KhaYehvOw0ET+9urnn8MBpiijuU/0JOpuwKOE451PQ==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/util-locate-window@3.804.0':
-    resolution: {integrity: sha512-zVoRfpmBVPodYlnMjgVjfGoEZagyRF5IPn3Uo6ZvOZp24chnW/FRstH7ESDHDDRga4z3V+ElUQHKpFDXWyBW5A==}
-    engines: {node: '>=18.0.0'}
+  '@aws-sdk/util-endpoints@3.984.0':
+    resolution: {integrity: sha512-9ebjLA0hMKHeVvXEtTDCCOBtwjb0bOXiuUV06HNeVdgAjH6gj4x4Zwt4IBti83TiyTGOCl5YfZqGx4ehVsasbQ==}
+    engines: {node: '>=20.0.0'}
 
   '@aws-sdk/util-locate-window@3.893.0':
     resolution: {integrity: sha512-T89pFfgat6c8nMmpI8eKjBcDcgJq36+m9oiXbcUzeU55MP9ZuGgBomGjGnHaEyF36jenW9gmg3NfZDm0AO2XPg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/util-user-agent-browser@3.398.0':
-    resolution: {integrity: sha512-A3Tzx1tkDHlBT+IgxmsMCHbV8LM7SwwCozq2ZjJRx0nqw3MCrrcxQFXldHeX/gdUMO+0Oocb7HGSnVODTq+0EA==}
-
-  '@aws-sdk/util-user-agent-browser@3.862.0':
-    resolution: {integrity: sha512-BmPTlm0r9/10MMr5ND9E92r8KMZbq5ltYXYpVcUbAsnB1RJ8ASJuRoLne5F7mB3YMx0FJoOTuSq7LdQM3LgW3Q==}
+  '@aws-sdk/util-user-agent-browser@3.972.28':
+    resolution: {integrity: sha512-qr0fi8bkpkALaVPQzPinjAlWYR9/gswh4JUXHMoCBKS9YnoHCX+1qHROYGxWRI13BRg+OD4Wpl2NcuM0eFPyUA==}
 
-  '@aws-sdk/util-user-agent-node@3.398.0':
-    resolution: {integrity: sha512-RTVQofdj961ej4//fEkppFf4KXqKGMTCqJYghx3G0C/MYXbg7MGl7LjfNGtJcboRE8pfHHQ/TUWBDA7RIAPPlQ==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      aws-crt: '>=1.0.0'
-    peerDependenciesMeta:
-      aws-crt:
-        optional: true
-
-  '@aws-sdk/util-user-agent-node@3.864.0':
-    resolution: {integrity: sha512-d+FjUm2eJEpP+FRpVR3z6KzMdx1qwxEYDz8jzNKwxYLBBquaBaP/wfoMtMQKAcbrR7aT9FZVZF7zDgzNxUvQlQ==}
-    engines: {node: '>=18.0.0'}
-    peerDependencies:
-      aws-crt: '>=1.0.0'
-    peerDependenciesMeta:
-      aws-crt:
-        optional: true
-
-  '@aws-sdk/util-utf8-browser@3.259.0':
-    resolution: {integrity: sha512-UvFa/vR+e19XookZF8RzFZBrw2EUkQWxiBW0yYQAhvk3C+QVGl0H3ouca8LDBlBfQKXwmW3huo/59H8rwb1wJw==}
+  '@aws-sdk/util-user-agent-node@3.973.43':
+    resolution: {integrity: sha512-sM+qbPrMr3kLDSJi6J93On74p9IFNzI2Jx4JyO/8TvYB9sn2e0EbBt2z7pES+NCfKI+ITSqixY8pM+RZdT0Qow==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/xml-builder@3.310.0':
-    resolution: {integrity: sha512-TqELu4mOuSIKQCqj63fGVs86Yh+vBx5nHRpWKNUNhB2nPTpfbziTs5c1X358be3peVWA4wPxW7Nt53KIg1tnNw==}
-    engines: {node: '>=14.0.0'}
+  '@aws-sdk/xml-builder@3.972.33':
+    resolution: {integrity: sha512-ezbwz9WpuLctm6o7P2t2naDhVVPI5jFGrVefVybhcKGjU57VIyT46pQVO0RI2RYkUdhdj2Z9uSIlAzGZE9NW9A==}
+    engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/xml-builder@3.862.0':
-    resolution: {integrity: sha512-6Ed0kmC1NMbuFTEgNmamAUU1h5gShgxL1hBVLbEzUa3trX5aJBz1vU4bXaBTvOYUAnOHtiy1Ml4AMStd6hJnFA==}
+  '@aws/lambda-invoke-store@0.3.0':
+    resolution: {integrity: sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ==}
     engines: {node: '>=18.0.0'}
 
   '@babel/code-frame@7.27.1':
@@ -1091,6 +955,10 @@ packages:
     resolution: {integrity: sha512-AOPI3D+a8dXnja+iwsUqGRjr1BbZIe771sXdapOtYI531gSqpi92vXivKcq2asu/DFpdl1ceFAKZyRzK2PCVcQ==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/standalone@7.27.5':
     resolution: {integrity: sha512-AvoXdFyKqvcxS0pMMs4dNl3hOYUkhTCF4P7aEwLXN1ED5ekxxjVWeFtr4ZVUGO0Y7u5d5H3nOyO8Y0CS/EBXPA==}
     engines: {node: '>=6.9.0'}
@@ -1107,6 +975,33 @@ packages:
     resolution: {integrity: sha512-jYnje+JyZG5YThjHiF28oT4SIZLnYOcSBb6+SDaFIyzDVSkXQmQQYclJ2R+YxcdmK0AX6x1E5OQNtuh3jHDrUg==}
     engines: {node: '>=6.9.0'}
 
+  '@base-ui/react@1.6.0':
+    resolution: {integrity: sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      '@date-fns/tz': ^1.2.0
+      '@types/react': ^17 || ^18 || ^19
+      date-fns: ^4.0.0
+      react: ^17 || ^18 || ^19
+      react-dom: ^17 || ^18 || ^19
+    peerDependenciesMeta:
+      '@date-fns/tz':
+        optional: true
+      '@types/react':
+        optional: true
+      date-fns:
+        optional: true
+
+  '@base-ui/utils@0.3.1':
+    resolution: {integrity: sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==}
+    peerDependencies:
+      '@types/react': ^17 || ^18 || ^19
+      react: ^17 || ^18 || ^19
+      react-dom: ^17 || ^18 || ^19
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
   '@bcoe/v8-coverage@0.2.3':
     resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
 
@@ -1959,15 +1854,30 @@ packages:
   '@floating-ui/core@1.7.1':
     resolution: {integrity: sha512-azI0DrjMMfIug/ExbBaeDVJXcY0a7EPvPjb2xAJPa4HeimBX+Z18HK8QQR3jb6356SnDDdxx+hinMLcJEDdOjw==}
 
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+
   '@floating-ui/dom@1.7.1':
     resolution: {integrity: sha512-cwsmW/zyw5ltYTUeeYJ60CnQuPqmGwuGVhG9w0PRaRKkAyi38BT5CKrpIbb+jtahSwUl04cWzSx9ZOIxeS6RsQ==}
 
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+
   '@floating-ui/react-dom@2.1.3':
     resolution: {integrity: sha512-huMBfiU9UnQ2oBwIhgzyIiSpVgvlDstU8CX0AF+wS+KzmYMs0J2a3GwuFHV1Lz+jlrQGeC1fF+Nv0QoumyV0bA==}
     peerDependencies:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
+  '@floating-ui/react-dom@2.1.8':
+    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
+    peerDependencies:
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+
   '@floating-ui/utils@0.2.9':
     resolution: {integrity: sha512-MDWhGtE+eHw5JW7lq4qhc5yRLS11ERl1c7Z6Xd0a58DozHES6EnNNwUWbMiG4J9Cgj053Bhk8zvlhFYKVhULwg==}
 
@@ -2049,9 +1959,6 @@ packages:
     resolution: {integrity: sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==}
     deprecated: Use @eslint/object-schema instead
 
-  '@iarna/toml@2.2.5':
-    resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==}
-
   '@icons-pack/react-simple-icons@11.2.0':
     resolution: {integrity: sha512-jCJ+1Fe0yiBQGYSfhx8QGU/9o27t8J4Hw3mxHEI9vohRltLSi5CaPzO2fCQcMNeTrAUAm4j+yaDuAutskiKRjA==}
     peerDependencies:
@@ -2420,18 +2327,14 @@ packages:
       '@types/node':
         optional: true
 
-  '@isaacs/balanced-match@4.0.1':
-    resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==}
-    engines: {node: 20 || >=22}
-
-  '@isaacs/brace-expansion@5.0.0':
-    resolution: {integrity: sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==}
-    engines: {node: 20 || >=22}
-
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
 
+  '@isaacs/fs-minipass@4.0.1':
+    resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
+    engines: {node: '>=18.0.0'}
+
   '@istanbuljs/load-nyc-config@1.1.0':
     resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
     engines: {node: '>=8'}
@@ -2703,15 +2606,18 @@ packages:
   '@open-draft/until@2.1.0':
     resolution: {integrity: sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==}
 
-  '@opennextjs/aws@3.7.6':
-    resolution: {integrity: sha512-l4UGkmaZaAjWER+PuZ/zNziMnrbf6oA9B1RUDKcyKsX+hEES1b7h6kLgpo4a4maf01M+k0yJUZQyF4sf+vI+Iw==}
+  '@opennextjs/aws@3.9.16':
+    resolution: {integrity: sha512-jQQStCysIllNCPqz5W2KSguXpr+ETlOcD8SyNu+h9zwpRVYk4uEPQge+ErG3avI5xsT8vKA7EGLYG59dhj/B6Q==}
     hasBin: true
+    peerDependencies:
+      next: ~15.0.8 || ~15.1.12 || ~15.2.9 || ~15.3.9 || ~15.4.11 || ~15.5.10 || ~16.0.11 || ^16.1.5
 
-  '@opennextjs/cloudflare@1.8.0':
-    resolution: {integrity: sha512-1hcX7wHPNsF6jsMetANIECFnZ7lxsYdOzQAuR7S+2pi7QjLS487fQZ/WZ1pxoDYx4vpziw6yTFnaR+FyIqdsMg==}
+  '@opennextjs/cloudflare@1.17.3':
+    resolution: {integrity: sha512-BQT8R/CEqrZS2sYydJ6uqv3U+yZAxbTeDUfgqQIlOnhu3wDPsB/QuuUBBseWOZiOdZ8gLegK6F2SLKia74Nv6g==}
     hasBin: true
     peerDependencies:
-      wrangler: ^4.24.4
+      next: ~15.0.8 || ~15.1.12 || ~15.2.9 || ~15.3.9 || ~15.4.11 || ~15.5.10 || ~16.0.11 || ^16.1.5
+      wrangler: ^4.65.0
 
   '@opentelemetry/api-logs@0.203.0':
     resolution: {integrity: sha512-9B9RU0H7Ya1Dx/Rkyc4stuBZSGVQF27WigitInx2QQoj6KUpEFYPKoWjdFTunJYxmXmh17HeBvbMa1EhGyPmqQ==}
@@ -3711,8 +3617,8 @@ packages:
   '@radix-ui/rect@1.1.1':
     resolution: {integrity: sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==}
 
-  '@reduxjs/toolkit@2.11.2':
-    resolution: {integrity: sha512-Kd6kAHTA6/nUpp8mySPqj3en3dm0tdMIgbttnQ1xFMVpufoj+ADi8pXLBsd4xzTRHQa7t/Jv8W5UnCuW4kuWMQ==}
+  '@reduxjs/toolkit@2.12.0':
+    resolution: {integrity: sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==}
     peerDependencies:
       react: ^16.9.0 || ^17.0.0 || ^18 || ^19
       react-redux: ^7.2.1 || ^8.1.3 || ^9.0.0
@@ -3926,374 +3832,118 @@ packages:
   '@sinonjs/fake-timers@10.3.0':
     resolution: {integrity: sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==}
 
-  '@smithy/abort-controller@2.2.0':
-    resolution: {integrity: sha512-wRlta7GuLWpTqtFfGo+nZyOO1vEvewdNR1R4rTxpC8XU6vG/NDyrFBhwLZsqg1NUoR1noVaXJPC/7ZK47QCySw==}
-    engines: {node: '>=14.0.0'}
+  '@smithy/config-resolver@4.6.6':
+    resolution: {integrity: sha512-yI8StAYGQKiI+DxT0xkLhHSzxcIFSZTTWi0c4Lk3WLgmbe2QfLpR/Roo81ZF3VYwfwqH4IQVTKsy3FLZiVRaTQ==}
+    engines: {node: '>=18.0.0'}
 
-  '@smithy/abort-controller@4.0.5':
-    resolution: {integrity: sha512-jcrqdTQurIrBbUm4W2YdLVMQDoL0sA9DTxYd2s+R/y+2U9NLOP7Xf/YqfSg1FZhlZIYEnvk2mwbyvIfdLEPo8g==}
+  '@smithy/core@3.29.1':
+    resolution: {integrity: sha512-qoiY4nrk5OCu1+eIR1VB8l5DmON/oKiqrd5zZFAhXJXjJlLWQusKEW/SkBDAtGDcPaz86m9kfcE1lngU0GlM6A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/abort-controller@4.2.3':
-    resolution: {integrity: sha512-xWL9Mf8b7tIFuAlpjKtRPnHrR8XVrwTj5NPYO/QwZPtc0SDLsPxb56V5tzi5yspSMytISHybifez+4jlrx0vkQ==}
+  '@smithy/credential-provider-imds@4.4.6':
+    resolution: {integrity: sha512-B2WQ/PV/H6Jeg3lrIq6bKUfa6Hy01mtK7CGs6lhjzHA6k4aagldH6T6eEjnzKl4HI0cJnAsxfJ19pgb5PV+CVQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/chunked-blob-reader-native@4.0.0':
-    resolution: {integrity: sha512-R9wM2yPmfEMsUmlMlIgSzOyICs0x9uu7UTHoccMyt7BWw8shcGM8HqB355+BZCPBcySvbTYMs62EgEQkNxz2ig==}
+  '@smithy/eventstream-serde-browser@4.4.6':
+    resolution: {integrity: sha512-++N4gziozNj71MLr9HN/pzt8nnoTdsX9ccjShQthl2TcoZtHObjmbT3d3kBZ8ih1uRTepGGVUVc06qkFtRUAKg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/chunked-blob-reader@5.0.0':
-    resolution: {integrity: sha512-+sKqDBQqb036hh4NPaUiEkYFkTUGYzRsn3EuFhyfQfMy6oGHEUJDurLP9Ufb5dasr/XiAmPNMr6wa9afjQB+Gw==}
+  '@smithy/eventstream-serde-config-resolver@4.5.6':
+    resolution: {integrity: sha512-Xn7gFGQg6fxaE0bQSnoAN6miP4M4t7juhv/0ch7wBba+8r+XHCNaF7ktpLkOSrzyCrVQ3ixV8SaMZKINWB80hA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/config-resolver@2.2.0':
-    resolution: {integrity: sha512-fsiMgd8toyUba6n1WRmr+qACzXltpdDkPTAaDqc8QqPBUzO+/JKwL6bUBseHVi8tu9l+3JOK+tSf7cay+4B3LA==}
-    engines: {node: '>=14.0.0'}
+  '@smithy/eventstream-serde-node@4.4.6':
+    resolution: {integrity: sha512-kt2PZjaLJK+kSfLetRFKdHo6rfUeVuk65TreMlGBwVi+EhGspaDw3GTQMKKCrHPVe/LVYrkNf518pMZ4hrj/EQ==}
+    engines: {node: '>=18.0.0'}
 
-  '@smithy/config-resolver@4.1.5':
-    resolution: {integrity: sha512-viuHMxBAqydkB0AfWwHIdwf/PRH2z5KHGUzqyRtS/Wv+n3IHI993Sk76VCA7dD/+GzgGOmlJDITfPcJC1nIVIw==}
+  '@smithy/fetch-http-handler@5.6.3':
+    resolution: {integrity: sha512-CwCc/7SMTj45y97MUnDTbTaxvtAsiNNRm81z3abROIuMbMsC2Iy5EKfkkVdsKrz8WExQAAMx1EJapq+9j4fFTQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/config-resolver@4.4.0':
-    resolution: {integrity: sha512-Kkmz3Mup2PGp/HNJxhCWkLNdlajJORLSjwkcfrj0E7nu6STAEdcMR1ir5P9/xOmncx8xXfru0fbUYLlZog/cFg==}
+  '@smithy/hash-blob-browser@4.4.6':
+    resolution: {integrity: sha512-9fGuAK2nhFC3J3XCOrAlzUP6td4LhBN7sBUxkcGMzXljFMJAmVnXBoKLImZP2BNB5IqJJlEUUAgqNJ5uAuIudQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/core@3.17.1':
-    resolution: {integrity: sha512-V4Qc2CIb5McABYfaGiIYLTmo/vwNIK7WXI5aGveBd9UcdhbOMwcvIMxIw/DJj1S9QgOMa/7FBkarMdIC0EOTEQ==}
+  '@smithy/hash-node@4.4.6':
+    resolution: {integrity: sha512-O6YGQgZGxypohUJDm+aIBNx9ldzOvQOjnnAmHYKAVJcVRMYQLf+g88s/vCUIHJudeXbgEo7xq1vXUGYlBpdBsg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/core@3.8.0':
-    resolution: {integrity: sha512-EYqsIYJmkR1VhVE9pccnk353xhs+lB6btdutJEtsp7R055haMJp2yE16eSxw8fv+G0WUY6vqxyYOP8kOqawxYQ==}
+  '@smithy/hash-stream-node@4.4.6':
+    resolution: {integrity: sha512-yk7nZACmlT5GVchRP+vazlOU9krAsl1AwPny7x4YmiDOsnFdgxl9LhoXRlN12RY+t60dY2fDoiNpAlmsCHPPMQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/credential-provider-imds@2.3.0':
-    resolution: {integrity: sha512-BWB9mIukO1wjEOo1Ojgl6LrG4avcaC7T/ZP6ptmAaW4xluhSIPZhY+/PI5YKzlk+jsm+4sQZB45Bt1OfMeQa3w==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/credential-provider-imds@4.0.7':
-    resolution: {integrity: sha512-dDzrMXA8d8riFNiPvytxn0mNwR4B3h8lgrQ5UjAGu6T9z/kRg/Xncf4tEQHE/+t25sY8IH3CowcmWi+1U5B1Gw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/credential-provider-imds@4.2.3':
-    resolution: {integrity: sha512-hA1MQ/WAHly4SYltJKitEsIDVsNmXcQfYBRv2e+q04fnqtAX5qXaybxy/fhUeAMCnQIdAjaGDb04fMHQefWRhw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/eventstream-codec@4.0.5':
-    resolution: {integrity: sha512-miEUN+nz2UTNoRYRhRqVTJCx7jMeILdAurStT2XoS+mhokkmz1xAPp95DFW9Gxt4iF2VBqpeF9HbTQ3kY1viOA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/eventstream-serde-browser@4.0.5':
-    resolution: {integrity: sha512-LCUQUVTbM6HFKzImYlSB9w4xafZmpdmZsOh9rIl7riPC3osCgGFVP+wwvYVw6pXda9PPT9TcEZxaq3XE81EdJQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/eventstream-serde-config-resolver@4.1.3':
-    resolution: {integrity: sha512-yTTzw2jZjn/MbHu1pURbHdpjGbCuMHWncNBpJnQAPxOVnFUAbSIUSwafiphVDjNV93TdBJWmeVAds7yl5QCkcA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/eventstream-serde-node@4.0.5':
-    resolution: {integrity: sha512-lGS10urI4CNzz6YlTe5EYG0YOpsSp3ra8MXyco4aqSkQDuyZPIw2hcaxDU82OUVtK7UY9hrSvgWtpsW5D4rb4g==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/eventstream-serde-universal@4.0.5':
-    resolution: {integrity: sha512-JFnmu4SU36YYw3DIBVao3FsJh4Uw65vVDIqlWT4LzR6gXA0F3KP0IXFKKJrhaVzCBhAuMsrUUaT5I+/4ZhF7aw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/fetch-http-handler@2.5.0':
-    resolution: {integrity: sha512-BOWEBeppWhLn/no/JxUL/ghTfANTjT7kg3Ww2rPqTUY9R4yHPXxJ9JhMe3Z03LN3aPwiwlpDIUcVw1xDyHqEhw==}
-
-  '@smithy/fetch-http-handler@5.1.1':
-    resolution: {integrity: sha512-61WjM0PWmZJR+SnmzaKI7t7G0UkkNFboDpzIdzSoy7TByUzlxo18Qlh9s71qug4AY4hlH/CwXdubMtkcNEb/sQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/fetch-http-handler@5.3.4':
-    resolution: {integrity: sha512-bwigPylvivpRLCm+YK9I5wRIYjFESSVwl8JQ1vVx/XhCw0PtCi558NwTnT2DaVCl5pYlImGuQTSwMsZ+pIavRw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/hash-blob-browser@4.0.5':
-    resolution: {integrity: sha512-F7MmCd3FH/Q2edhcKd+qulWkwfChHbc9nhguBlVjSUE6hVHhec3q6uPQ+0u69S6ppvLtR3eStfCuEKMXBXhvvA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/hash-node@2.2.0':
-    resolution: {integrity: sha512-zLWaC/5aWpMrHKpoDF6nqpNtBhlAYKF/7+9yMN7GpdR8CzohnWfGtMznPybnwSS8saaXBMxIGwJqR4HmRp6b3g==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/hash-node@4.0.5':
-    resolution: {integrity: sha512-cv1HHkKhpyRb6ahD8Vcfb2Hgz67vNIXEp2vnhzfxLFGRukLCNEA5QdsorbUEzXma1Rco0u3rx5VTqbM06GcZqQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/hash-node@4.2.3':
-    resolution: {integrity: sha512-6+NOdZDbfuU6s1ISp3UOk5Rg953RJ2aBLNLLBEcamLjHAg1Po9Ha7QIB5ZWhdRUVuOUrT8BVFR+O2KIPmw027g==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/hash-stream-node@4.0.5':
-    resolution: {integrity: sha512-IJuDS3+VfWB67UC0GU0uYBG/TA30w+PlOaSo0GPm9UHS88A6rCP6uZxNjNYiyRtOcjv7TXn/60cW8ox1yuZsLg==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/invalid-dependency@2.2.0':
-    resolution: {integrity: sha512-nEDASdbKFKPXN2O6lOlTgrEEOO9NHIeO+HVvZnkqc8h5U9g3BIhWsvzFo+UcUbliMHvKNPD/zVxDrkP1Sbgp8Q==}
-
-  '@smithy/invalid-dependency@4.0.5':
-    resolution: {integrity: sha512-IVnb78Qtf7EJpoEVo7qJ8BEXQwgC4n3igeJNNKEj/MLYtapnx8A67Zt/J3RXAj2xSO1910zk0LdFiygSemuLow==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/invalid-dependency@4.2.3':
-    resolution: {integrity: sha512-Cc9W5DwDuebXEDMpOpl4iERo8I0KFjTnomK2RMdhhR87GwrSmUmwMxS4P5JdRf+LsjOdIqumcerwRgYMr/tZ9Q==}
+  '@smithy/invalid-dependency@4.4.6':
+    resolution: {integrity: sha512-M2NNf2yB5pDYQiMyW3q6kD/aQyEfQlVFtFNR+LCnRKS/sg9xqOrOqkIZNP94B2aTwf+pwX3Qgp6foKw2ls9vIg==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/is-array-buffer@2.2.0':
     resolution: {integrity: sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/is-array-buffer@4.0.0':
-    resolution: {integrity: sha512-saYhF8ZZNoJDTvJBEWgeBccCg+yvp1CX+ed12yORU3NilJScfc6gfch2oVb4QgxZrGUx3/ZJlb+c/dJbyupxlw==}
-    engines: {node: '>=18.0.0'}
-
   '@smithy/is-array-buffer@4.2.0':
     resolution: {integrity: sha512-DZZZBvC7sjcYh4MazJSGiWMI2L7E0oCiRHREDzIxi/M2LY79/21iXt6aPLHge82wi5LsuRF5A06Ds3+0mlh6CQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/md5-js@4.0.5':
-    resolution: {integrity: sha512-8n2XCwdUbGr8W/XhMTaxILkVlw2QebkVTn5tm3HOcbPbOpWg89zr6dPXsH8xbeTsbTXlJvlJNTQsKAIoqQGbdA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-content-length@2.2.0':
-    resolution: {integrity: sha512-5bl2LG1Ah/7E5cMSC+q+h3IpVHMeOkG0yLRyQT1p2aMJkSrZG7RlXHPuAgb7EyaFeidKEnnd/fNaLLaKlHGzDQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/middleware-content-length@4.0.5':
-    resolution: {integrity: sha512-l1jlNZoYzoCC7p0zCtBDE5OBXZ95yMKlRlftooE5jPWQn4YBPLgsp+oeHp7iMHaTGoUdFqmHOPa8c9G3gBsRpQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-content-length@4.2.3':
-    resolution: {integrity: sha512-/atXLsT88GwKtfp5Jr0Ks1CSa4+lB+IgRnkNrrYP0h1wL4swHNb0YONEvTceNKNdZGJsye+W2HH8W7olbcPUeA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-endpoint@2.5.1':
-    resolution: {integrity: sha512-1/8kFp6Fl4OsSIVTWHnNjLnTL8IqpIb/D3sTSczrKFnrE9VMNWxnrRKNvpUHOJ6zpGD5f62TPm7+17ilTJpiCQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/middleware-endpoint@4.1.18':
-    resolution: {integrity: sha512-ZhvqcVRPZxnZlokcPaTwb+r+h4yOIOCJmx0v2d1bpVlmP465g3qpVSf7wxcq5zZdu4jb0H4yIMxuPwDJSQc3MQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-endpoint@4.3.5':
-    resolution: {integrity: sha512-SIzKVTvEudFWJbxAaq7f2GvP3jh2FHDpIFI6/VAf4FOWGFZy0vnYMPSRj8PGYI8Hjt29mvmwSRgKuO3bK4ixDw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-retry@2.3.1':
-    resolution: {integrity: sha512-P2bGufFpFdYcWvqpyqqmalRtwFUNUA8vHjJR5iGqbfR6mp65qKOLcUd6lTr4S9Gn/enynSrSf3p3FVgVAf6bXA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/middleware-retry@4.1.19':
-    resolution: {integrity: sha512-X58zx/NVECjeuUB6A8HBu4bhx72EoUz+T5jTMIyeNKx2lf+Gs9TmWPNNkH+5QF0COjpInP/xSpJGJ7xEnAklQQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-retry@4.4.5':
-    resolution: {integrity: sha512-DCaXbQqcZ4tONMvvdz+zccDE21sLcbwWoNqzPLFlZaxt1lDtOE2tlVpRSwcTOJrjJSUThdgEYn7HrX5oLGlK9A==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-serde@2.3.0':
-    resolution: {integrity: sha512-sIADe7ojwqTyvEQBe1nc/GXB9wdHhi9UwyX0lTyttmUWDJLP655ZYE1WngnNyXREme8I27KCaUhyhZWRXL0q7Q==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/middleware-serde@4.0.9':
-    resolution: {integrity: sha512-uAFFR4dpeoJPGz8x9mhxp+RPjo5wW0QEEIPPPbLXiRRWeCATf/Km3gKIVR5vaP8bN1kgsPhcEeh+IZvUlBv6Xg==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-serde@4.2.3':
-    resolution: {integrity: sha512-8g4NuUINpYccxiCXM5s1/V+uLtts8NcX4+sPEbvYQDZk4XoJfDpq5y2FQxfmUL89syoldpzNzA0R9nhzdtdKnQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-stack@2.2.0':
-    resolution: {integrity: sha512-Qntc3jrtwwrsAC+X8wms8zhrTr0sFXnyEGhZd9sLtsJ/6gGQKFzNB+wWbOcpJd7BR8ThNCoKt76BuQahfMvpeA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/middleware-stack@4.0.5':
-    resolution: {integrity: sha512-/yoHDXZPh3ocRVyeWQFvC44u8seu3eYzZRveCMfgMOBcNKnAmOvjbL9+Cp5XKSIi9iYA9PECUuW2teDAk8T+OQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/middleware-stack@4.2.3':
-    resolution: {integrity: sha512-iGuOJkH71faPNgOj/gWuEGS6xvQashpLwWB1HjHq1lNNiVfbiJLpZVbhddPuDbx9l4Cgl0vPLq5ltRfSaHfspA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/node-config-provider@2.3.0':
-    resolution: {integrity: sha512-0elK5/03a1JPWMDPaS726Iw6LpQg80gFut1tNpPfxFuChEEklo2yL823V94SpTZTxmKlXFtFgsP55uh3dErnIg==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/node-config-provider@4.1.4':
-    resolution: {integrity: sha512-+UDQV/k42jLEPPHSn39l0Bmc4sB1xtdI9Gd47fzo/0PbXzJ7ylgaOByVjF5EeQIumkepnrJyfx86dPa9p47Y+w==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/node-config-provider@4.3.3':
-    resolution: {integrity: sha512-NzI1eBpBSViOav8NVy1fqOlSfkLgkUjUTlohUSgAEhHaFWA3XJiLditvavIP7OpvTjDp5u2LhtlBhkBlEisMwA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/node-http-handler@2.5.0':
-    resolution: {integrity: sha512-mVGyPBzkkGQsPoxQUbxlEfRjrj6FPyA3u3u2VXGr9hT8wilsoQdZdvKpMBFMB8Crfhv5dNkKHIW0Yyuc7eABqA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/node-http-handler@4.1.1':
-    resolution: {integrity: sha512-RHnlHqFpoVdjSPPiYy/t40Zovf3BBHc2oemgD7VsVTFFZrU5erFFe0n52OANZZ/5sbshgD93sOh5r6I35Xmpaw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/node-http-handler@4.4.3':
-    resolution: {integrity: sha512-MAwltrDB0lZB/H6/2M5PIsISSwdI5yIh6DaBB9r0Flo9nx3y0dzl/qTMJPd7tJvPdsx6Ks/cwVzheGNYzXyNbQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/property-provider@2.2.0':
-    resolution: {integrity: sha512-+xiil2lFhtTRzXkx8F053AV46QnIw6e7MV8od5Mi68E1ICOjCeCHw2XfLnDEUHnT9WGUIkwcqavXjfwuJbGlpg==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/property-provider@4.0.5':
-    resolution: {integrity: sha512-R/bswf59T/n9ZgfgUICAZoWYKBHcsVDurAGX88zsiUtOTA/xUAPyiT+qkNCPwFn43pZqN84M4MiUsbSGQmgFIQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/property-provider@4.2.3':
-    resolution: {integrity: sha512-+1EZ+Y+njiefCohjlhyOcy1UNYjT+1PwGFHCxA/gYctjg3DQWAU19WigOXAco/Ql8hZokNehpzLd0/+3uCreqQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/protocol-http@2.0.5':
-    resolution: {integrity: sha512-d2hhHj34mA2V86doiDfrsy2fNTnUOowGaf9hKb0hIPHqvcnShU4/OSc4Uf1FwHkAdYF3cFXTrj5VGUYbEuvMdw==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/protocol-http@3.3.0':
-    resolution: {integrity: sha512-Xy5XK1AFWW2nlY/biWZXu6/krgbaf2dg0q492D8M5qthsnU2H+UgFeZLbM76FnH7s6RO/xhQRkj+T6KBO3JzgQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/protocol-http@5.1.3':
-    resolution: {integrity: sha512-fCJd2ZR7D22XhDY0l+92pUag/7je2BztPRQ01gU5bMChcyI0rlly7QFibnYHzcxDvccMjlpM/Q1ev8ceRIb48w==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/protocol-http@5.3.3':
-    resolution: {integrity: sha512-Mn7f/1aN2/jecywDcRDvWWWJF4uwg/A0XjFMJtj72DsgHTByfjRltSqcT9NyE9RTdBSN6X1RSXrhn/YWQl8xlw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/querystring-builder@2.2.0':
-    resolution: {integrity: sha512-L1kSeviUWL+emq3CUVSgdogoM/D9QMFaqxL/dd0X7PCNWmPXqt+ExtrBjqT0V7HLN03Vs9SuiLrG3zy3JGnE5A==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/querystring-builder@4.0.5':
-    resolution: {integrity: sha512-NJeSCU57piZ56c+/wY+AbAw6rxCCAOZLCIniRE7wqvndqxcKKDOXzwWjrY7wGKEISfhL9gBbAaWWgHsUGedk+A==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/querystring-builder@4.2.3':
-    resolution: {integrity: sha512-LOVCGCmwMahYUM/P0YnU/AlDQFjcu+gWbFJooC417QRB/lDJlWSn8qmPSDp+s4YVAHOgtgbNG4sR+SxF/VOcJQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/querystring-parser@2.2.0':
-    resolution: {integrity: sha512-BvHCDrKfbG5Yhbpj4vsbuPV2GgcpHiAkLeIlcA1LtfpMz3jrqizP1+OguSNSj1MwBHEiN+jwNisXLGdajGDQJA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/querystring-parser@4.0.5':
-    resolution: {integrity: sha512-6SV7md2CzNG/WUeTjVe6Dj8noH32r4MnUeFKZrnVYsQxpGSIcphAanQMayi8jJLZAWm6pdM9ZXvKCpWOsIGg0w==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/querystring-parser@4.2.3':
-    resolution: {integrity: sha512-cYlSNHcTAX/wc1rpblli3aUlLMGgKZ/Oqn8hhjFASXMCXjIqeuQBei0cnq2JR8t4RtU9FpG6uyl6PxyArTiwKA==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/service-error-classification@2.1.5':
-    resolution: {integrity: sha512-uBDTIBBEdAQryvHdc5W8sS5YX7RQzF683XrHePVdFmAgKiMofU15FLSM0/HU03hKTnazdNRFa0YHS7+ArwoUSQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/service-error-classification@4.0.7':
-    resolution: {integrity: sha512-XvRHOipqpwNhEjDf2L5gJowZEm5nsxC16pAZOeEcsygdjv9A2jdOh3YoDQvOXBGTsaJk6mNWtzWalOB9976Wlg==}
+  '@smithy/md5-js@4.4.6':
+    resolution: {integrity: sha512-iF/3959r6gxyhaMA8ZO1dAknRe5znpRJX8KGp9zh3YhkFX7XYRJXxR1vM5pV4rTHfCAEKZRTR5wqYnfNLBvlBw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/service-error-classification@4.2.3':
-    resolution: {integrity: sha512-NkxsAxFWwsPsQiwFG2MzJ/T7uIR6AQNh1SzcxSUnmmIqIQMlLRQDKhc17M7IYjiuBXhrQRjQTo3CxX+DobS93g==}
+  '@smithy/middleware-content-length@4.4.6':
+    resolution: {integrity: sha512-kMXyfLgm2iqC3objUiElh1fp0AI33PxiAmPX+C0z7H8v4sfae2I2V9N62MlwO/LVPf+MlXpmfCYCHouetbecGg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/shared-ini-file-loader@2.4.0':
-    resolution: {integrity: sha512-WyujUJL8e1B6Z4PBfAqC/aGY1+C7T0w20Gih3yrvJSk97gpiVfB+y7c46T4Nunk+ZngLq0rOIdeVeIklk0R3OA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/shared-ini-file-loader@4.0.5':
-    resolution: {integrity: sha512-YVVwehRDuehgoXdEL4r1tAAzdaDgaC9EQvhK0lEbfnbrd0bd5+CTQumbdPryX3J2shT7ZqQE+jPW4lmNBAB8JQ==}
+  '@smithy/middleware-endpoint@4.6.6':
+    resolution: {integrity: sha512-d7L894W4LE9HL2MkpWi0+KJG6/VCcuoxkquVaXYMMsrqK7PLT83GZsUBYL+ixxpEfwnlSE5hBotsB1A/qfWO9A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/shared-ini-file-loader@4.3.3':
-    resolution: {integrity: sha512-9f9Ixej0hFhroOK2TxZfUUDR13WVa8tQzhSzPDgXe5jGL3KmaM9s8XN7RQwqtEypI82q9KHnKS71CJ+q/1xLtQ==}
+  '@smithy/middleware-retry@4.7.6':
+    resolution: {integrity: sha512-zUF+liYyzSiPcz8vQhGCjUlykg521Y3shrsyzJ37Y3nkpz20KujcVXcOvgZb6e68n7Unl/Pb2RG0jrkx73AE+Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/signature-v4@2.3.0':
-    resolution: {integrity: sha512-ui/NlpILU+6HAQBfJX8BBsDXuKSNrjTSuOYArRblcrErwKFutjrCNb/OExfVRyj9+26F9J+ZmfWT+fKWuDrH3Q==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/signature-v4@5.1.3':
-    resolution: {integrity: sha512-mARDSXSEgllNzMw6N+mC+r1AQlEBO3meEAkR/UlfAgnMzJUB3goRBWgip1EAMG99wh36MDqzo86SfIX5Y+VEaw==}
+  '@smithy/middleware-serde@4.4.6':
+    resolution: {integrity: sha512-h9JBsYQBiltcbe5EJECXoJy+ZJSmnJKhc9UXyoWvEB1BIUkE8inxQ614dpeb+yydm2cq4YXqMXQLQB0QUBE6rA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/signature-v4@5.3.3':
-    resolution: {integrity: sha512-CmSlUy+eEYbIEYN5N3vvQTRfqt0lJlQkaQUIf+oizu7BbDut0pozfDjBGecfcfWf7c62Yis4JIEgqQ/TCfodaA==}
+  '@smithy/middleware-stack@4.4.6':
+    resolution: {integrity: sha512-LUO+XAQP381sbiZ0QHOSLKPpS2I0/wXTh44rH/kP4/751Ogscn5JUsAWvUH+rYJWLupmiEsdHZT3Bn4Dvd4J/Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/smithy-client@2.5.1':
-    resolution: {integrity: sha512-jrbSQrYCho0yDaaf92qWgd+7nAeap5LtHTI51KXqmpIFCceKU3K9+vIVTUH72bOJngBMqa4kyu1VJhRcSrk/CQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/smithy-client@4.4.10':
-    resolution: {integrity: sha512-iW6HjXqN0oPtRS0NK/zzZ4zZeGESIFcxj2FkWed3mcK8jdSdHzvnCKXSjvewESKAgGKAbJRA+OsaqKhkdYRbQQ==}
+  '@smithy/node-config-provider@4.5.6':
+    resolution: {integrity: sha512-3fFpVGK28z1UhbDIPY6pujmnGwDhcD70NqJ8wJJwdQES5EYBe3mdOojSZdXtL0jfQE9BAbZSBi73WQ6VEOLRgQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/smithy-client@4.9.1':
-    resolution: {integrity: sha512-Ngb95ryR5A9xqvQFT5mAmYkCwbXvoLavLFwmi7zVg/IowFPCfiqRfkOKnbc/ZRL8ZKJ4f+Tp6kSu6wjDQb8L/g==}
+  '@smithy/node-http-handler@4.9.3':
+    resolution: {integrity: sha512-qZTa4gQFUo8RM02rk6q5UVTDLNrQ1oS20LsepBzqq1QBVc/EHJ03OOUADcqMZiXHArW+Y7+OGY0BpdTwZRq/Yg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/types@2.12.0':
-    resolution: {integrity: sha512-QwYgloJ0sVNBeBuBs65cIkTbfzV/Q6ZNPCJ99EICFEdJYG50nGIY/uYXp+TbsdJReIuPr0a0kXmCvren3MbRRw==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/types@4.3.2':
-    resolution: {integrity: sha512-QO4zghLxiQ5W9UZmX2Lo0nta2PuE1sSrXUYDoaB6HMR762C0P7v/HEPHf6ZdglTVssJG1bsrSBxdc3quvDSihw==}
+  '@smithy/protocol-http@5.5.6':
+    resolution: {integrity: sha512-ezPS1foOBPU+uv0da16sLF/7fMBXxeo7hFKitn/2gOxHd8HaQ7qK6DT8l0f1dUGoUS1lZC2s7mEkCwJ44QLCJg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/types@4.8.0':
-    resolution: {integrity: sha512-QpELEHLO8SsQVtqP+MkEgCYTFW0pleGozfs3cZ183ZBj9z3VC1CX1/wtFMK64p+5bhtZo41SeLK1rBRtd25nHQ==}
+  '@smithy/signature-v4@5.6.2':
+    resolution: {integrity: sha512-QgHflghMoPxCJ9axiCVh8KZfbC9fuP6vkXXyK//E3cq7nLaSSyyLj0GAoqVWezYeDQmXIZhmlRvLE16jsqDK6g==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/url-parser@2.2.0':
-    resolution: {integrity: sha512-hoA4zm61q1mNTpksiSWp2nEl1dt3j726HdRhiNgVJQMj7mLp7dprtF57mOB6JvEk/x9d2bsuL5hlqZbBuHQylQ==}
-
-  '@smithy/url-parser@4.0.5':
-    resolution: {integrity: sha512-j+733Um7f1/DXjYhCbvNXABV53NyCRRA54C7bNEIxNPs0YjfRxeMKjjgm2jvTYrciZyCjsicHwQ6Q0ylo+NAUw==}
+  '@smithy/smithy-client@4.14.6':
+    resolution: {integrity: sha512-Nr6u0buDP8iprqxAJ83pSFu2RavKHa/OG8n/ReWTYHg1OS3GLoDoa8F+2zoWoYkvwUawTa/dFugJ7NS0CuPcYg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/url-parser@4.2.3':
-    resolution: {integrity: sha512-I066AigYvY3d9VlU3zG9XzZg1yT10aNqvCaBTw9EPgu5GrsEl1aUkcMvhkIXascYH1A8W0LQo3B1Kr1cJNcQEw==}
+  '@smithy/types@4.15.1':
+    resolution: {integrity: sha512-x3L0XSACF6UYzKpa9biqiRMgvH5+wnFFew9Tm/grFYqgaupPwx/+ojDPpPJM8dZON3S9tjz5U+PQYsCBd1Mw5Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-base64@2.3.0':
-    resolution: {integrity: sha512-s3+eVwNeJuXUwuMbusncZNViuhv2LjVJ1nMwTqSA0XAC7gjKhqqxRdJPhR8+YrkoZ9IiIbFk/yK6ACe/xlF+hw==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-base64@4.0.0':
-    resolution: {integrity: sha512-CvHfCmO2mchox9kjrtzoHkWHxjHZzaFojLc8quxXY7WAAMAg43nuxwv95tATVgQFNDwd4M9S1qFzj40Ul41Kmg==}
+  '@smithy/url-parser@4.4.6':
+    resolution: {integrity: sha512-bR6Te2/feLMCLiyEFqnZpM5AqkXlBGr7A5jHQn+WSVLk0X53NvPq1KF8jh5TJIv56RzDv3oKEW3t0DysRNLZdw==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-base64@4.3.0':
     resolution: {integrity: sha512-GkXZ59JfyxsIwNTWFnjmFEI8kZpRNIBfxKjv09+nkAWPt/4aGaEWMM04m4sxgNVWkbt2MdSvE3KF/PfX4nFedQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-body-length-browser@2.2.0':
-    resolution: {integrity: sha512-dtpw9uQP7W+n3vOtx0CfBD5EWd7EPdIdsQnWTDoFf77e3VUf05uA7R7TGipIo8e4WL2kuPdnsr3hMQn9ziYj5w==}
-
-  '@smithy/util-body-length-browser@4.0.0':
-    resolution: {integrity: sha512-sNi3DL0/k64/LO3A256M+m3CDdG6V7WKWHdAiBBMUN8S3hK3aMPhwnPik2A/a2ONN+9doY9UxaLfgqsIRg69QA==}
-    engines: {node: '>=18.0.0'}
-
   '@smithy/util-body-length-browser@4.2.0':
     resolution: {integrity: sha512-Fkoh/I76szMKJnBXWPdFkQJl2r9SjPt3cMzLdOB6eJ4Pnpas8hVoWPYemX/peO0yrrvldgCUVJqOAjUrOLjbxg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-body-length-node@2.3.0':
-    resolution: {integrity: sha512-ITWT1Wqjubf2CJthb0BuT9+bpzBfXeMokH/AAa5EJQgbv9aPMVfnM76iFIZVFf50hYXGbtiV71BHAthNWd6+dw==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-body-length-node@4.0.0':
-    resolution: {integrity: sha512-q0iDP3VsZzqJyje8xJWEJCNIu3lktUGVoSy1KB0UWym2CL1siV3artm+u1DFYTLejpsrdGyCSWBdGNjJzfDPjg==}
-    engines: {node: '>=18.0.0'}
-
   '@smithy/util-body-length-node@4.2.1':
     resolution: {integrity: sha512-h53dz/pISVrVrfxV1iqXlx5pRg3V2YWFcSQyPyXZRrZoZj4R4DeWRDo1a7dd3CPTcFi3kE+98tuNyD2axyZReA==}
     engines: {node: '>=18.0.0'}
@@ -4302,140 +3952,44 @@ packages:
     resolution: {integrity: sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/util-buffer-from@4.0.0':
-    resolution: {integrity: sha512-9TOQ7781sZvddgO8nxueKi3+yGvkY35kotA0Y6BWRajAv8jjmigQ1sBwz0UX47pQMYXJPahSKEKYFgt+rXdcug==}
-    engines: {node: '>=18.0.0'}
-
   '@smithy/util-buffer-from@4.2.0':
     resolution: {integrity: sha512-kAY9hTKulTNevM2nlRtxAG2FQ3B2OR6QIrPY3zE5LqJy1oxzmgBGsHLWTcNhWXKchgA0WHW+mZkQrng/pgcCew==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-config-provider@2.3.0':
-    resolution: {integrity: sha512-HZkzrRcuFN1k70RLqlNK4FnPXKOpkik1+4JaBoHNJn+RnJGYqaa3c5/+XtLOXhlKzlRgNvyaLieHTW2VwGN0VQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-config-provider@4.0.0':
-    resolution: {integrity: sha512-L1RBVzLyfE8OXH+1hsJ8p+acNUSirQnWQ6/EgpchV88G6zGBTDPdXiiExei6Z1wR2RxYvxY/XLw6AMNCCt8H3w==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-config-provider@4.2.0':
-    resolution: {integrity: sha512-YEjpl6XJ36FTKmD+kRJJWYvrHeUvm5ykaUS5xK+6oXffQPHeEM4/nXlZPe+Wu0lsgRUcNZiliYNh/y7q9c2y6Q==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-defaults-mode-browser@2.2.1':
-    resolution: {integrity: sha512-RtKW+8j8skk17SYowucwRUjeh4mCtnm5odCL0Lm2NtHQBsYKrNW0od9Rhopu9wF1gHMfHeWF7i90NwBz/U22Kw==}
-    engines: {node: '>= 10.0.0'}
-
-  '@smithy/util-defaults-mode-browser@4.0.26':
-    resolution: {integrity: sha512-xgl75aHIS/3rrGp7iTxQAOELYeyiwBu+eEgAk4xfKwJJ0L8VUjhO2shsDpeil54BOFsqmk5xfdesiewbUY5tKQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-defaults-mode-browser@4.3.4':
-    resolution: {integrity: sha512-qI5PJSW52rnutos8Bln8nwQZRpyoSRN6k2ajyoUHNMUzmWqHnOJCnDELJuV6m5PML0VkHI+XcXzdB+6awiqYUw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-defaults-mode-node@2.3.1':
-    resolution: {integrity: sha512-vkMXHQ0BcLFysBMWgSBLSk3+leMpFSyyFj8zQtv5ZyUBx8/owVh1/pPEkzmW/DR/Gy/5c8vjLDD9gZjXNKbrpA==}
-    engines: {node: '>= 10.0.0'}
-
-  '@smithy/util-defaults-mode-node@4.0.26':
-    resolution: {integrity: sha512-z81yyIkGiLLYVDetKTUeCZQ8x20EEzvQjrqJtb/mXnevLq2+w3XCEWTJ2pMp401b6BkEkHVfXb/cROBpVauLMQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-defaults-mode-node@4.2.6':
-    resolution: {integrity: sha512-c6M/ceBTm31YdcFpgfgQAJaw3KbaLuRKnAz91iMWFLSrgxRpYm03c3bu5cpYojNMfkV9arCUelelKA7XQT36SQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-endpoints@3.0.7':
-    resolution: {integrity: sha512-klGBP+RpBp6V5JbrY2C/VKnHXn3d5V2YrifZbmMY8os7M6m8wdYFoO6w/fe5VkP+YVwrEktW3IWYaSQVNZJ8oQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-endpoints@3.2.3':
-    resolution: {integrity: sha512-aCfxUOVv0CzBIkU10TubdgKSx5uRvzH064kaiPEWfNIvKOtNpu642P4FP1hgOFkjQIkDObrfIDnKMKkeyrejvQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-hex-encoding@2.2.0':
-    resolution: {integrity: sha512-7iKXR+/4TpLK194pVjKiasIyqMtTYJsgKgM242Y9uzt5dhHnUDvMNb+3xIhRJ9QhvqGii/5cRUt4fJn3dtXNHQ==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-hex-encoding@4.0.0':
-    resolution: {integrity: sha512-Yk5mLhHtfIgW2W2WQZWSg5kuMZCVbvhFmC7rV4IO2QqnZdbEFPmQnCcGMAX2z/8Qj3B9hYYNjZOhWym+RwhePw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-hex-encoding@4.2.0':
-    resolution: {integrity: sha512-CCQBwJIvXMLKxVbO88IukazJD9a4kQ9ZN7/UMGBjBcJYvatpWk+9g870El4cB8/EJxfe+k+y0GmR9CAzkF+Nbw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-middleware@2.2.0':
-    resolution: {integrity: sha512-L1qpleXf9QD6LwLCJ5jddGkgWyuSvWBkJwWAZ6kFkdifdso+sk3L3O1HdmPvCdnCK3IS4qWyPxev01QMnfHSBw==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-middleware@4.0.5':
-    resolution: {integrity: sha512-N40PfqsZHRSsByGB81HhSo+uvMxEHT+9e255S53pfBw/wI6WKDI7Jw9oyu5tJTLwZzV5DsMha3ji8jk9dsHmQQ==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-middleware@4.2.3':
-    resolution: {integrity: sha512-v5ObKlSe8PWUHCqEiX2fy1gNv6goiw6E5I/PN2aXg3Fb/hse0xeaAnSpXDiWl7x6LamVKq7senB+m5LOYHUAHw==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/util-retry@2.2.0':
-    resolution: {integrity: sha512-q9+pAFPTfftHXRytmZ7GzLFFrEGavqapFc06XxzZFcSIGERXMerXxCitjOG1prVDR9QdjqotF40SWvbqcCpf8g==}
-    engines: {node: '>= 14.0.0'}
-
-  '@smithy/util-retry@4.0.7':
-    resolution: {integrity: sha512-TTO6rt0ppK70alZpkjwy+3nQlTiqNfoXja+qwuAchIEAIoSZW8Qyd76dvBv3I5bCpE38APafG23Y/u270NspiQ==}
+  '@smithy/util-defaults-mode-browser@4.5.6':
+    resolution: {integrity: sha512-lsApK6dpDK9LY49GMHEsNQV2XpT/Y9WxKy8CmfbN6oLqPMCXlCYVLeIhedtdJmgbi0Mg09ZIjbhYVEg+V/wK0Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-retry@4.2.3':
-    resolution: {integrity: sha512-lLPWnakjC0q9z+OtiXk+9RPQiYPNAovt2IXD3CP4LkOnd9NpUsxOjMx1SnoUVB7Orb7fZp67cQMtTBKMFDvOGg==}
+  '@smithy/util-defaults-mode-node@4.4.6':
+    resolution: {integrity: sha512-lKt5zA8YVx5SXanQ1t1iVZuaCuQcoJxUEh9BEpW64y5qKo3asCua7PiYsKkCv2RctwWZQqeEquB6WMostXBI4w==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-stream@2.2.0':
-    resolution: {integrity: sha512-17faEXbYWIRst1aU9SvPZyMdWmqIrduZjVOqCPMIsWFNxs5yQQgFrJL6b2SdiCzyW9mJoDjFtgi53xx7EH+BXA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-stream@4.2.4':
-    resolution: {integrity: sha512-vSKnvNZX2BXzl0U2RgCLOwWaAP9x/ddd/XobPK02pCbzRm5s55M53uwb1rl/Ts7RXZvdJZerPkA+en2FDghLuQ==}
+  '@smithy/util-endpoints@3.6.6':
+    resolution: {integrity: sha512-IIgVh4W8OwBP3WL17RROPs7EWkaRdygli4I3vnhEK+zkVvMFagoKN7KbDCitTafQ7GSM3ev0ZawYehN+cFzd+A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-stream@4.5.4':
-    resolution: {integrity: sha512-+qDxSkiErejw1BAIXUFBSfM5xh3arbz1MmxlbMCKanDDZtVEQ7PSKW9FQS0Vud1eI/kYn0oCTVKyNzRlq+9MUw==}
+  '@smithy/util-middleware@4.4.6':
+    resolution: {integrity: sha512-13aBkHIs4auNrqDwGE40rbkF/gXZQ/qNtufQKDHxYjc1juSAzY0ol0Kbv8Md5oaUovnNpTp2cXLQXZn3eAEnlA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-uri-escape@2.2.0':
-    resolution: {integrity: sha512-jtmJMyt1xMD/d8OtbVJ2gFZOSKc+ueYJZPW20ULW1GOp/q/YIM0wNh+u8ZFao9UaIGz4WoPW8hC64qlWLIfoDA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-uri-escape@4.0.0':
-    resolution: {integrity: sha512-77yfbCbQMtgtTylO9itEAdpPXSog3ZxMe09AEhm0dU0NLTalV70ghDZFR+Nfi1C60jnJoh/Re4090/DuZh2Omg==}
+  '@smithy/util-retry@4.5.6':
+    resolution: {integrity: sha512-o7QZYe6U1HV5c9Oqb/mwf01YL+8NJ1wTWjGNSyA3fuaOaiC0U2UhmAY320dcBZlKOJU8O60QNfr8RWqE+OnU/w==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-uri-escape@4.2.0':
-    resolution: {integrity: sha512-igZpCKV9+E/Mzrpq6YacdTQ0qTiLm85gD6N/IrmyDvQFA4UnU3d5g3m8tMT/6zG/vVkWSU+VxeUyGonL62DuxA==}
+  '@smithy/util-stream@4.7.6':
+    resolution: {integrity: sha512-eUq7Efp6Wn0/IzSs4EP55whnN2jQF/U20HxIEOg+zW3RyfuM6ypW7RvdMiJV+AOeVfsU6Yn76sraz1ayDgZvBg==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-utf8@2.3.0':
     resolution: {integrity: sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/util-utf8@4.0.0':
-    resolution: {integrity: sha512-b+zebfKCfRdgNJDknHCob3O7FpeYQN6ZG6YLExMcasDHsCXlsXCEuiPZeLnJLpwa5dvPetGlnGCiMHuLwGvFow==}
-    engines: {node: '>=18.0.0'}
-
   '@smithy/util-utf8@4.2.0':
     resolution: {integrity: sha512-zBPfuzoI8xyBtR2P6WQj63Rz8i3AmfAaJLuNG8dWsfvPe8lO4aCPYLn879mEgHndZH1zQ2oXmG8O1GGzzaoZiw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-waiter@2.2.0':
-    resolution: {integrity: sha512-IHk53BVw6MPMi2Gsn+hCng8rFA3ZmR3Rk7GllxDUW9qFJl/hiSvskn7XldkECapQVkIg/1dHpMAxI9xSTaLLSA==}
-    engines: {node: '>=14.0.0'}
-
-  '@smithy/util-waiter@4.0.7':
-    resolution: {integrity: sha512-mYqtQXPmrwvUljaHyGxYUIIRI3qjBTEb/f5QFi3A6VlxhpmZd5mWXn9W+qUkf2pVE1Hv3SqxefiZOPGdxmO64A==}
-    engines: {node: '>=18.0.0'}
-
-  '@smithy/uuid@1.1.0':
-    resolution: {integrity: sha512-4aUIteuyxtBUhVdiQqcDhKFitwfd9hqoSDYY2KRXiWtgoWJ9Bmise+KfEPDiVHWeJepvF8xJO9/9+WDIciMFFw==}
+  '@smithy/util-waiter@4.5.6':
+    resolution: {integrity: sha512-96pDomZ4N3QmkcFZ9m9wl68pW8ny+JSV2fBZhmhQBrsuvygH90DNiFafKsGqzwvLQrh3mURsGpiqwxGHH4ZwcQ==}
     engines: {node: '>=18.0.0'}
 
   '@speed-highlight/core@1.2.7':
@@ -4779,9 +4333,6 @@ packages:
   '@types/parse-json@4.0.2':
     resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==}
 
-  '@types/prompts@2.4.9':
-    resolution: {integrity: sha512-qTxFi6Buiu8+50/+3DGIWLHM6QuWsEKugJnnP6iv2Mc4ncxE4A/OJkjuVOA+5X0X1S/nq5VJRa8Lu+nwcvbrKA==}
-
   '@types/react-dom@19.2.3':
     resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
     peerDependencies:
@@ -4820,9 +4371,6 @@ packages:
   '@types/uuid@10.0.0':
     resolution: {integrity: sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==}
 
-  '@types/uuid@9.0.8':
-    resolution: {integrity: sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==}
-
   '@types/yargs-parser@21.0.3':
     resolution: {integrity: sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==}
 
@@ -4881,6 +4429,7 @@ packages:
 
   '@ungap/structured-clone@1.2.0':
     resolution: {integrity: sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==}
+    deprecated: Potential CWE-502 - Update to 1.3.1 or higher
 
   '@unlighthouse/cli@0.16.3':
     resolution: {integrity: sha512-4erwxa9mij2qxbtMtJe3OB0ONjjg6ZpWcHr4tQHwgjewn9tNVyhdnIiMneig8EfyoKbxnvY0HBJOG4VBMJcaVA==}
@@ -5206,10 +4755,6 @@ packages:
     resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==}
     engines: {node: '>=8'}
 
-  ansi-escapes@7.0.0:
-    resolution: {integrity: sha512-GdYO7a61mR0fOlAsvC9/rIHf7L96sBc6dEWzeOu+KAea5bZyQRPIpojrVoI4AXGJS/ycu/fBTdLrUkA4ODrvjw==}
-    engines: {node: '>=18'}
-
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
@@ -5277,6 +4822,9 @@ packages:
     resolution: {integrity: sha512-itaWrbYbqpGXkGhZPGUulwnhVf5Hpy1xiCFsGqyIGglbBxmG5vSjxQen3/WGOjPpNEv1RtBLKxbmVXm8HpJStQ==}
     engines: {node: '>= 0.4'}
 
+  array-timsort@1.0.3:
+    resolution: {integrity: sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==}
+
   array-union@2.1.0:
     resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
     engines: {node: '>=8'}
@@ -5389,6 +4937,10 @@ packages:
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
   bare-events@2.5.4:
     resolution: {integrity: sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==}
 
@@ -5450,16 +5002,13 @@ packages:
   blake3-wasm@2.1.5:
     resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
 
-  body-parser@2.2.0:
-    resolution: {integrity: sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg==}
+  body-parser@2.3.0:
+    resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
     engines: {node: '>=18'}
 
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
-  bowser@2.12.0:
-    resolution: {integrity: sha512-HcOcTudTeEWgbHh0Y1Tyb6fdeR71m4b/QACf0D4KswGTsNeIJQmg38mRENZPAYPZvGFN3fk3604XbQEPdxXdKg==}
-
   bowser@2.12.1:
     resolution: {integrity: sha512-z4rE2Gxh7tvshQ4hluIT7XcFrgLIQaw9X3A+kTTRdovCz5PMukm/0QC/BKSYPj3omF5Qfypn9O/c5kgpmvYUCw==}
 
@@ -5469,6 +5018,10 @@ packages:
   brace-expansion@2.0.1:
     resolution: {integrity: sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==}
 
+  brace-expansion@5.0.7:
+    resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
+    engines: {node: 18 || 20 || >=22}
+
   braces@3.0.3:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
@@ -5576,6 +5129,10 @@ packages:
     resolution: {integrity: sha512-zgVZuo2WcZgfUEmsn6eO3kINexW8RAE4maiQ8QNs8CtpPCSyMiYsULR3HQYkm3w8FIA3SberyMJMSldGsW+U3w==}
     engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
 
+  chalk@5.6.2:
+    resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
+    engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
+
   char-regex@1.0.2:
     resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
     engines: {node: '>=10'}
@@ -5602,9 +5159,9 @@ packages:
     resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
     engines: {node: '>= 14.16.0'}
 
-  chownr@2.0.0:
-    resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
-    engines: {node: '>=10'}
+  chownr@3.0.0:
+    resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==}
+    engines: {node: '>=18'}
 
   chrome-launcher@1.2.0:
     resolution: {integrity: sha512-JbuGuBNss258bvGil7FT4HKdC3SC2K7UAEUqiPy3ACS3Yxo3hAW6bvFpCu2HsIJLgTqxgEX6BkujvzZfLpUD0Q==}
@@ -5631,13 +5188,8 @@ packages:
   cjs-module-lexer@1.3.1:
     resolution: {integrity: sha512-a3KdPAANPbNE4ZUv9h6LckSl9zLsYOP4MBmhIPkRaeyybt+r4UghLvq+xw/YwUcC1gqylCkL4rdVs3Lwupjm4Q==}
 
-  cli-cursor@5.0.0:
-    resolution: {integrity: sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==}
-    engines: {node: '>=18'}
-
-  cli-spinners@2.9.2:
-    resolution: {integrity: sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==}
-    engines: {node: '>=6'}
+  class-variance-authority@0.7.1:
+    resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
 
   cli-width@4.1.0:
     resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
@@ -5721,6 +5273,10 @@ packages:
     resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==}
     engines: {node: '>= 10'}
 
+  comment-json@4.6.2:
+    resolution: {integrity: sha512-R2rze/hDX30uul4NZoIZ76ImSJLFxn/1/ZxtKC1L77y2X1k+yYu1joKbAtMA2Fg3hZrTOiw0I5mwVMo0cf250w==}
+    engines: {node: '>= 6'}
+
   comment-parser@1.4.1:
     resolution: {integrity: sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==}
     engines: {node: '>= 12.0.0'}
@@ -5769,6 +5325,10 @@ packages:
     resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
     engines: {node: '>= 0.6'}
 
+  content-type@2.0.0:
+    resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==}
+    engines: {node: '>=18'}
+
   convert-source-map@1.9.0:
     resolution: {integrity: sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==}
 
@@ -5786,10 +5346,6 @@ packages:
     resolution: {integrity: sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==}
     engines: {node: '>= 0.6'}
 
-  cookie@0.7.1:
-    resolution: {integrity: sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==}
-    engines: {node: '>= 0.6'}
-
   cookie@0.7.2:
     resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
     engines: {node: '>= 0.6'}
@@ -5957,15 +5513,6 @@ packages:
       supports-color:
         optional: true
 
-  debug@4.3.6:
-    resolution: {integrity: sha512-O/09Bd4Z1fBrU4VzkhFqVgpPzaGbw6Sm9FEkBT1A/YBXQFGuuSxa1dN2nxgxS34JmKXqYx8CZAwEVoJFImUXIg==}
-    engines: {node: '>=6.0'}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
   debug@4.4.1:
     resolution: {integrity: sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==}
     engines: {node: '>=6.0'}
@@ -6297,11 +5844,21 @@ packages:
   electron-to-chromium@1.5.165:
     resolution: {integrity: sha512-naiMx1Z6Nb2TxPU6fiFrUrDTjyPMLdTtaOd2oLmG8zVSg2hCWGkhPyxwk+qRmZ1ytwVqUv0u7ZcDA5+ALhaUtw==}
 
+  embla-carousel-autoplay@8.6.0:
+    resolution: {integrity: sha512-OBu5G3nwaSXkZCo1A6LTaFMZ8EpkYbwIaH+bPqdBnDGQ2fh4+NbzjXjs2SktoPNKCtflfVMc75njaDHOYXcrsA==}
+    peerDependencies:
+      embla-carousel: 8.6.0
+
   embla-carousel-autoplay@9.0.0-rc01:
     resolution: {integrity: sha512-gl7jUe0X9xd5v7IiyFF2FCR+KTBesnutM0gQ3S75oo9EizZi5tJMNdVaFwvzepz6kGzDkkSbKMWitQvAbFVfdQ==}
     peerDependencies:
       embla-carousel: 9.0.0-rc01
 
+  embla-carousel-fade@8.6.0:
+    resolution: {integrity: sha512-qaYsx5mwCz72ZrjlsXgs1nKejSrW+UhkbOMwLgfRT7w2LtdEB03nPRI06GHuHv5ac2USvbEiX2/nAHctcDwvpg==}
+    peerDependencies:
+      embla-carousel: 8.6.0
+
   embla-carousel-fade@9.0.0-rc01:
     resolution: {integrity: sha512-sIpJaJmcrp7+vm5r/XHEqDcCo5Fg29DdL/2Za5FQ2k//ePqapnPPzfUeG018uPT/6ylBjhn007s4sRkilbu2GA==}
     peerDependencies:
@@ -6317,6 +5874,9 @@ packages:
     peerDependencies:
       embla-carousel: 9.0.0-rc01
 
+  embla-carousel@8.6.0:
+    resolution: {integrity: sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA==}
+
   embla-carousel@9.0.0-rc01:
     resolution: {integrity: sha512-4BTERU1gAXgg4Vl0m7hQ1GzePGLNNfM2j030ww8i9idiPXumyRUpaNUDfT2zx1Hv8um1Ew7QKBy/HdNPz8L30g==}
 
@@ -6374,10 +5934,6 @@ packages:
     resolution: {integrity: sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  environment@1.1.0:
-    resolution: {integrity: sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==}
-    engines: {node: '>=18'}
-
   error-ex@1.3.2:
     resolution: {integrity: sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==}
 
@@ -6707,8 +6263,8 @@ packages:
     resolution: {integrity: sha512-2Zks0hf1VLFYI1kbh0I5jP3KHHyCHpkfyHBzsSXRFgl/Bg9mWYfMW8oD+PdMPlEwy5HNsR9JutYy6pMeOh61nw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  express@5.0.1:
-    resolution: {integrity: sha512-ORF7g6qGnD+YtUG9yx4DFoqCShNMmUKiXuT5oWMHiOvt/4WFbHC6yCwQMTSBMno7AqntNCAzzcnnjowRkTL9eQ==}
+  express@5.2.1:
+    resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
     engines: {node: '>= 18'}
 
   exsolve@1.0.5:
@@ -6758,18 +6314,10 @@ packages:
   fast-uri@3.0.3:
     resolution: {integrity: sha512-aLrHthzCjH5He4Z2H9YZ+v6Ujb9ocRuW6ZzkJQOrTxleEijANq4v1TsaPaVG1PZcuurEzrLcWRyYBYXD5cEiaw==}
 
-  fast-xml-parser@4.2.5:
-    resolution: {integrity: sha512-B9/wizE4WngqQftFPmdaMYlXoJlJOYxGQOanC77fq9k8+Z0v5dDSVh+3glErdIROP//s/jgb7ZuxKfB8nVyo0g==}
-    hasBin: true
-
   fast-xml-parser@4.5.3:
     resolution: {integrity: sha512-RKihhV+SHsIUGXObeVy9AXiBbFwkVk7Syp8XgwN5U3JV416+Gwp/GO9i0JYKmikykgz/UHRrrV4ROuZEo/T0ig==}
     hasBin: true
 
-  fast-xml-parser@5.2.5:
-    resolution: {integrity: sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ==}
-    hasBin: true
-
   fastq@1.17.1:
     resolution: {integrity: sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==}
 
@@ -6902,10 +6450,6 @@ packages:
     resolution: {integrity: sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==}
     engines: {node: '>=6 <7 || >=8'}
 
-  fs-minipass@2.1.0:
-    resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
-    engines: {node: '>= 8'}
-
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
@@ -7014,10 +6558,6 @@ packages:
   gettext-parser@4.2.0:
     resolution: {integrity: sha512-aMgPyjC9W5Mz9tbFU8DcQ7GYMXoFWq633kaWGt4imlcpBWzDIWk7HY7nCSZTCJxyjRaLq9L/NEjMKkZ9gR630Q==}
 
-  giget@1.2.5:
-    resolution: {integrity: sha512-r1ekGw/Bgpi3HLV3h1MRBIlSAdHoIMklpaQ3OQLFcRw9PwAj2rqigvIbg+dBUI51OxVI2jsEtDywDBjSiuf7Ug==}
-    hasBin: true
-
   giget@2.0.0:
     resolution: {integrity: sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==}
     hasBin: true
@@ -7038,10 +6578,9 @@ packages:
     deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
-  glob@11.0.3:
-    resolution: {integrity: sha512-2Nim7dha1KVkaiF4q6Dj+ngPPMdfvLJEOpZk/jKiUAkqKebpGAWQXAq9z1xu9HKu5lWfqw/FASuccEjyznjPaA==}
+  glob@12.0.0:
+    resolution: {integrity: sha512-5Qcll1z7IKgHr5g485ePDdHcNQY0k2dtv/bjYy0iuyGxQw2qSOiiXUXJ+AYQpg3HNoUMHqAruX478Jeev7UULw==}
     engines: {node: 20 || >=22}
-    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   glob@7.2.3:
@@ -7176,6 +6715,10 @@ packages:
     resolution: {integrity: sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==}
     engines: {node: '>= 0.8'}
 
+  http-errors@2.0.1:
+    resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
+    engines: {node: '>= 0.8'}
+
   http-link-header@1.1.3:
     resolution: {integrity: sha512-3cZ0SRL8fb9MUlU3mKM61FcQvPfXx2dBrZW3Vbg5CXa8jFlK8OaEpePenLe1oEXQduhz8b0QjsqfS59QP4AJDQ==}
     engines: {node: '>=6.0.0'}
@@ -7227,6 +6770,10 @@ packages:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
 
+  iconv-lite@0.7.2:
+    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
+    engines: {node: '>=0.10.0'}
+
   icu-minify@4.8.3:
     resolution: {integrity: sha512-65Av7FLosNk7bPbmQx5z5XG2Y3T2GFppcjiXh4z1idHeVgQxlDpAmkGoYI0eFzAvrOnjpWTL5FmPDhsdfRMPEA==}
 
@@ -7247,14 +6794,14 @@ packages:
   immediate@3.0.6:
     resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==}
 
-  immer@11.1.8:
-    resolution: {integrity: sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==}
+  immer@11.1.15:
+    resolution: {integrity: sha512-VrNANlmnWQnh5COXIIOQXM9oOJw7naGKlBT74ZOOR6lpVXc3gFEu9FJLDFcpCJ2j+NWr8TIwtWD//T6ZX6TKiQ==}
 
   immer@9.0.21:
     resolution: {integrity: sha512-bc4NBHqOqSfRW7POMkHd51LvClaeMXpm8dx0e8oE2GORbq5aRK7Bxl4FyzVLdGtLmvLKL7BTDBG5ACQm4HWjTA==}
 
-  immutable@4.3.8:
-    resolution: {integrity: sha512-d/Ld9aLbKpNwyl0KiM2CT1WYvkitQ1TSvmRtkcV8FKStiDoA7Slzgjmb/1G2yhKM1p0XeNOieaTbFZmU1d3Xuw==}
+  immutable@4.3.9:
+    resolution: {integrity: sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==}
 
   import-fresh@3.3.1:
     resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
@@ -7397,10 +6944,6 @@ packages:
     engines: {node: '>=14.16'}
     hasBin: true
 
-  is-interactive@2.0.0:
-    resolution: {integrity: sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ==}
-    engines: {node: '>=12'}
-
   is-map@2.0.3:
     resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
     engines: {node: '>= 0.4'}
@@ -7484,10 +7027,6 @@ packages:
   is-typedarray@1.0.0:
     resolution: {integrity: sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
 
-  is-unicode-supported@1.3.0:
-    resolution: {integrity: sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ==}
-    engines: {node: '>=12'}
-
   is-unicode-supported@2.1.0:
     resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
     engines: {node: '>=18'}
@@ -7732,8 +7271,8 @@ packages:
   jpeg-js@0.4.4:
     resolution: {integrity: sha512-WZzeDOEtTOBK4Mdsar0IqEU5sMr3vSV2RqkAIzUEV2BHnUfKGyswWFPFwK5EeDo93K3FohSHbLAjj0s1Wzd+dg==}
 
-  js-base64@3.7.8:
-    resolution: {integrity: sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow==}
+  js-base64@3.9.1:
+    resolution: {integrity: sha512-U73qptcvf/HIOauFOmqT3a0mDUp0MYlfd15oqoe9kqZt5XhiXVb+HG09sLvI9PQ9tZIBFS4nlErai8zbWazP0g==}
 
   js-library-detector@6.7.0:
     resolution: {integrity: sha512-c80Qupofp43y4cJ7+8TTDN/AsDwLi5oOm/plBrWI+iQt485vKXCco+yVmOwEgdo9VOdsYTuV0UlTeetVPTriXA==}
@@ -7967,6 +7506,9 @@ packages:
     resolution: {integrity: sha512-I8oW2+QL5KJo8zXNWX046M134WchxsXC7SawLPvRQpogCbkyQIaFxPE89A2HiwR7vAK2Dm2ERBAmyjTYGYEpBg==}
     hasBin: true
 
+  lite-youtube-embed@0.3.4:
+    resolution: {integrity: sha512-aXgxpwK7AIW58GEbRzA8EYaY4LWvF3FKak6B9OtSJmuNyLhX2ouD4cMTxz/yR5HFInhknaYd2jLWOTRTvT8oAw==}
+
   load-script@1.0.0:
     resolution: {integrity: sha512-kPEjMFtZvwL9TaZo0uZ2ml+Ye9HUMmPwbYRJ324qF9tqMejwykJ5ggTyvzmrbBeapCAbk98BSbTeovHEEP1uCA==}
 
@@ -8028,10 +7570,6 @@ packages:
   lodash@4.17.21:
     resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
 
-  log-symbols@6.0.0:
-    resolution: {integrity: sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==}
-    engines: {node: '>=18'}
-
   long@5.3.2:
     resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
 
@@ -8122,10 +7660,6 @@ packages:
   metaviewport-parser@0.3.0:
     resolution: {integrity: sha512-EoYJ8xfjQ6kpe9VbVHvZTZHiOl4HL1Z18CrZ+qahvLXT7ZO4YTC2JMyt5FaUp9JJp6J4Ybb/z7IsCXZt86/QkQ==}
 
-  methods@1.1.2:
-    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
-    engines: {node: '>= 0.6'}
-
   micromatch@4.0.8:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
@@ -8176,9 +7710,9 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
-  minimatch@10.0.3:
-    resolution: {integrity: sha512-IPZ167aShDZZUMdRk66cyQAW3qr0WzbHkPdMYa8bzZhlHhO3jALbKdxcaak7W9FfT2rZNpQuUu4Od7ILEpXSaw==}
-    engines: {node: 20 || >=22}
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
 
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
@@ -8194,25 +7728,17 @@ packages:
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
-  minipass@3.3.6:
-    resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==}
-    engines: {node: '>=8'}
-
   minipass@4.2.8:
     resolution: {integrity: sha512-fNzuVyifolSLFL4NzpF+wEF4qrgqaaKX0haXPQEdQ7NKAN+WecoKMHV09YcuL/DHxrUsYQOK3MiuDf7Ip2OXfQ==}
     engines: {node: '>=8'}
 
-  minipass@5.0.0:
-    resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==}
-    engines: {node: '>=8'}
-
   minipass@7.1.2:
     resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==}
     engines: {node: '>=16 || 14 >=14.17'}
 
-  minizlib@2.1.2:
-    resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==}
-    engines: {node: '>= 8'}
+  minizlib@3.1.0:
+    resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
+    engines: {node: '>= 18'}
 
   mitt@3.0.1:
     resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==}
@@ -8242,9 +7768,6 @@ packages:
   ms@2.0.0:
     resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
 
-  ms@2.1.2:
-    resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}
-
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
@@ -8448,6 +7971,10 @@ packages:
     resolution: {integrity: sha512-kDCGIbxkDSXE3euJZZXzc6to7fCrKHNI/hSRQnRuQ+BWjFNzZwiFF8fj/6o2t2G9/jTj8PSIYTfCLelLZEeRpA==}
     engines: {node: '>= 0.4'}
 
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
   object-keys@0.4.0:
     resolution: {integrity: sha512-ncrLw+X55z7bkl5PnUvHwFK9FcGuFYo9gtjws2XtSzL+aZ8tm830P60WJ0dSmFVaSalWieW5MD7kEdnXda9yJw==}
 
@@ -8510,10 +8037,6 @@ packages:
     resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
     engines: {node: '>=12'}
 
-  onetime@7.0.0:
-    resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
-    engines: {node: '>=18'}
-
   open@10.1.2:
     resolution: {integrity: sha512-cxN6aIDPz6rm8hbebcP7vrQNhvRcveZoJU72Y7vskh4oIm+BZwBECnx5nTmrlres1Qapvx27Qo1Auukpf8PKXw==}
     engines: {node: '>=18'}
@@ -8533,10 +8056,6 @@ packages:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
 
-  ora@8.2.0:
-    resolution: {integrity: sha512-weP+BZ8MVNnlCm8c0Qdc1WSWq4Qn7I+9CJGm7Qali6g44e/PUzbjNqJX5NJ9ljlNMosfJvg1fKEGILklK9cwnw==}
-    engines: {node: '>=18'}
-
   os-tmpdir@1.0.2:
     resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==}
     engines: {node: '>=0.10.0'}
@@ -9118,20 +8637,19 @@ packages:
   puppeteer@24.10.0:
     resolution: {integrity: sha512-Oua9VkGpj0S2psYu5e6mCer6W9AU9POEQh22wRgSXnLXASGH+MwLUVWgLCLeP9QPHHcJ7tySUlg4Sa9OJmaLpw==}
     engines: {node: '>=18'}
-    deprecated: < 24.15.0 is no longer supported
     hasBin: true
 
   pure-rand@6.1.0:
     resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==}
 
-  qs@6.13.0:
-    resolution: {integrity: sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==}
-    engines: {node: '>=0.6'}
-
   qs@6.14.0:
     resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==}
     engines: {node: '>=0.6'}
 
+  qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
+    engines: {node: '>=0.6'}
+
   quansync@0.2.10:
     resolution: {integrity: sha512-t41VRkMYbkHyCYmOvx/6URnN80H7k4X0lLdBMGsz+maAwrJQYB1djpV6vHrQIBE0WBSGqhtEHrK9U3DWWH8v7A==}
 
@@ -9159,9 +8677,9 @@ packages:
     resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
     engines: {node: '>= 0.6'}
 
-  raw-body@3.0.0:
-    resolution: {integrity: sha512-RmkhL8CAyCRPXCE28MMH0z2PNWQBNk2Q09ZdxM9IOOXwxwZbN+qbWaatPkdkWIKL2ZVDImrN/pK5HTRz2PcS4g==}
-    engines: {node: '>= 0.8'}
+  raw-body@3.0.2:
+    resolution: {integrity: sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==}
+    engines: {node: '>= 0.10'}
 
   rc9@2.1.2:
     resolution: {integrity: sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==}
@@ -9320,8 +8838,8 @@ packages:
   requires-port@1.0.0:
     resolution: {integrity: sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==}
 
-  reselect@5.1.1:
-    resolution: {integrity: sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==}
+  reselect@5.2.0:
+    resolution: {integrity: sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==}
 
   resolve-alpn@1.2.1:
     resolution: {integrity: sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
@@ -9357,10 +8875,6 @@ packages:
   responselike@2.0.1:
     resolution: {integrity: sha512-4gl03wn3hj1HP3yzgdI7d3lCkF95F21Pz4BPGvKHinyQzALR5CapwC8yIi0Rh58DEMQ/SguC03wFj2k0M/mHhw==}
 
-  restore-cursor@5.1.0:
-    resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
-    engines: {node: '>=18'}
-
   reusify@1.0.4:
     resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
@@ -9519,6 +9033,10 @@ packages:
     resolution: {integrity: sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==}
     engines: {node: '>= 0.4'}
 
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
   side-channel-map@1.0.1:
     resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
     engines: {node: '>= 0.4'}
@@ -9531,6 +9049,10 @@ packages:
     resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
     engines: {node: '>= 0.4'}
 
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
@@ -9670,17 +9192,92 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
-  std-env@3.9.0:
-    resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
+  statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
 
-  stdin-discarder@0.2.2:
-    resolution: {integrity: sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ==}
-    engines: {node: '>=18'}
+  std-env@3.9.0:
+    resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
 
   stoppable@1.1.0:
     resolution: {integrity: sha512-KXDYZ9dszj6bzvnEMRYvxgeTHU74QBFL54XKtP3nyMuJ81CFYtABZ3bAzL2EdFUaEwJOBOgENyFj3R7oTzDyyw==}
     engines: {node: '>=4', npm: '>=6'}
 
+  storefront-kit@0.24.0:
+    resolution: {integrity: sha512-Mo+FcFpNs4AogAGAmhuQiteAMzPr1AvARfPzzfs2NVYZSkJ48ptVCGmmGzWXI3I7WX4D9u/I/wU2jsyUS7NtHA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@base-ui/react': ^1.5.0
+      '@radix-ui/react-accordion': ^1.2.0
+      '@radix-ui/react-checkbox': ^1.3.0
+      '@radix-ui/react-dialog': ^1.1.0
+      '@radix-ui/react-dropdown-menu': ^2.1.0
+      '@radix-ui/react-hover-card': ^1.1.15
+      '@radix-ui/react-label': ^2.1.0
+      '@radix-ui/react-navigation-menu': ^1.2.0
+      '@radix-ui/react-popover': ^1.1.0
+      '@radix-ui/react-portal': ^1.1.0
+      '@radix-ui/react-radio-group': ^1.3.0
+      '@radix-ui/react-scroll-area': ^1.2.0
+      '@radix-ui/react-select': ^2.2.0
+      '@radix-ui/react-slot': ^1.2.0
+      '@radix-ui/react-tabs': ^1.1.0
+      '@radix-ui/react-toggle': ^1.1.0
+      '@radix-ui/react-toggle-group': ^1.1.0
+      '@tailwindcss/container-queries': ^0.1.0
+      '@tailwindcss/typography': ^0.5.0
+      embla-carousel-react: ^8.0.0
+      lucide-react: ^0.471.0
+      react: ^18.0.0 || ^19.0.0
+      react-day-picker: ^9.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+      sonner: ^2.0.0
+      tailwindcss: ^3.0.0
+      tailwindcss-animate: ^1.0.0
+    peerDependenciesMeta:
+      '@base-ui/react':
+        optional: true
+      '@radix-ui/react-accordion':
+        optional: true
+      '@radix-ui/react-checkbox':
+        optional: true
+      '@radix-ui/react-dialog':
+        optional: true
+      '@radix-ui/react-dropdown-menu':
+        optional: true
+      '@radix-ui/react-hover-card':
+        optional: true
+      '@radix-ui/react-label':
+        optional: true
+      '@radix-ui/react-navigation-menu':
+        optional: true
+      '@radix-ui/react-popover':
+        optional: true
+      '@radix-ui/react-portal':
+        optional: true
+      '@radix-ui/react-radio-group':
+        optional: true
+      '@radix-ui/react-scroll-area':
+        optional: true
+      '@radix-ui/react-select':
+        optional: true
+      '@radix-ui/react-slot':
+        optional: true
+      '@radix-ui/react-tabs':
+        optional: true
+      '@radix-ui/react-toggle':
+        optional: true
+      '@radix-ui/react-toggle-group':
+        optional: true
+      embla-carousel-react:
+        optional: true
+      lucide-react:
+        optional: true
+      react-day-picker:
+        optional: true
+      sonner:
+        optional: true
+
   streamx@2.22.1:
     resolution: {integrity: sha512-znKXEBxfatz2GBNK02kRnCXjV+AA4kjZIUxeWSr3UGirZMJfTE9uiwKHobnbgxWyL/JWro8tTq+vOqAK1/qbSA==}
 
@@ -9776,9 +9373,6 @@ packages:
   strnum@1.1.2:
     resolution: {integrity: sha512-vrN+B7DBIoTTZjnPNewwhx6cBA/H+IS7rfW68n7XxC1y7uoiGQBxaKzqucGUgavX15dJgiGztLJ8vxuEzwqBdA==}
 
-  strnum@2.1.1:
-    resolution: {integrity: sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==}
-
   stubborn-fs@1.2.5:
     resolution: {integrity: sha512-H2N9c26eXjzL/S/K+i/RHHcFanE74dptvvjM8iwzwbVcWY/zjBbgRqF3K0DY4+OD+uTTASTBvDoxPDaPN02D7g==}
 
@@ -9833,8 +9427,8 @@ packages:
     resolution: {integrity: sha512-cs2JYADrEorRCB4AUCHMvwperwAKcn/mz7w1xzVOv3fG6TmAS2n13JYHH8/uDCFbqVyRSXXlL+vA5RDwGUXEZg==}
     engines: {node: '>=18'}
 
-  swr@2.4.1:
-    resolution: {integrity: sha512-2CC6CiKQtEwaEeNiqWTAw9PGykW8SR5zZX8MZk6TeAvEAnVS7Visz8WzphqgtQ8v2xz/4Q5K+j+SeMaKXeeQIA==}
+  swr@2.4.2:
+    resolution: {integrity: sha512-ej644Y2bvkIajfR32KGeSSdBXQW+ScjGjkybZgSE7kFpk9eGnV44XY9FJylXi+W75pavSX1PVNB57W5EbhGIYw==}
     peerDependencies:
       react: ^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -9857,6 +9451,9 @@ packages:
     resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
     engines: {node: '>=20'}
 
+  tailwind-merge@3.6.0:
+    resolution: {integrity: sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w==}
+
   tailwindcss-animate@1.0.7:
     resolution: {integrity: sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==}
     peerDependencies:
@@ -9883,10 +9480,9 @@ packages:
   tar-stream@3.1.7:
     resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==}
 
-  tar@6.2.1:
-    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
-    engines: {node: '>=10'}
-    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+  tar@7.5.19:
+    resolution: {integrity: sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==}
+    engines: {node: '>=18'}
 
   term-size@2.2.1:
     resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==}
@@ -10151,6 +9747,10 @@ packages:
     resolution: {integrity: sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==}
     engines: {node: '>= 0.6'}
 
+  type-is@2.1.0:
+    resolution: {integrity: sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==}
+    engines: {node: '>= 18'}
+
   typed-array-buffer@1.0.3:
     resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
     engines: {node: '>= 0.4'}
@@ -10348,6 +9948,9 @@ packages:
   urlpattern-polyfill@10.0.0:
     resolution: {integrity: sha512-H/A06tKD7sS1O1X2SshBVeA5FLycRpjqiBeqGKmBwBDBy28EnRjORxTNe269KSSr5un5qyWi1iL61wLxpd+ZOg==}
 
+  urlpattern-polyfill@10.1.0:
+    resolution: {integrity: sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==}
+
   use-callback-ref@1.3.3:
     resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
     engines: {node: '>=10'}
@@ -10384,10 +9987,6 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  utils-merge@1.0.1:
-    resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
-    engines: {node: '>= 0.4.0'}
-
   uuid@11.1.0:
     resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==}
     hasBin: true
@@ -10680,8 +10279,9 @@ packages:
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
-  yallist@4.0.0:
-    resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
+  yallist@5.0.0:
+    resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
+    engines: {node: '>=18'}
 
   yaml@1.10.3:
     resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==}
@@ -10745,12 +10345,6 @@ packages:
   zimmerframe@1.1.4:
     resolution: {integrity: sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==}
 
-  zod-validation-error@3.4.1:
-    resolution: {integrity: sha512-1KP64yqDPQ3rupxNv7oXhf7KdhHHgaqbKuspVoiN93TT0xrBjql+Svjkdjq/Qh/7GSMmgQs3AfvBT0heE35thw==}
-    engines: {node: '>=18.0.0'}
-    peerDependencies:
-      zod: ^3.24.4
-
   zod@3.22.3:
     resolution: {integrity: sha512-EjIevzuJRiRPbVH4mGc8nApb/lVLKVpmUhAaR5R5doKGfAnGJ6Gr3CViAVjP+4FWSxCsybeWQdcgCtbX+7oZug==}
 
@@ -10812,44 +10406,44 @@ snapshots:
       lru-cache: 10.4.3
     optional: true
 
-  '@ast-grep/napi-darwin-arm64@0.35.0':
+  '@ast-grep/napi-darwin-arm64@0.40.5':
     optional: true
 
-  '@ast-grep/napi-darwin-x64@0.35.0':
+  '@ast-grep/napi-darwin-x64@0.40.5':
     optional: true
 
-  '@ast-grep/napi-linux-arm64-gnu@0.35.0':
+  '@ast-grep/napi-linux-arm64-gnu@0.40.5':
     optional: true
 
-  '@ast-grep/napi-linux-arm64-musl@0.35.0':
+  '@ast-grep/napi-linux-arm64-musl@0.40.5':
     optional: true
 
-  '@ast-grep/napi-linux-x64-gnu@0.35.0':
+  '@ast-grep/napi-linux-x64-gnu@0.40.5':
     optional: true
 
-  '@ast-grep/napi-linux-x64-musl@0.35.0':
+  '@ast-grep/napi-linux-x64-musl@0.40.5':
     optional: true
 
-  '@ast-grep/napi-win32-arm64-msvc@0.35.0':
+  '@ast-grep/napi-win32-arm64-msvc@0.40.5':
     optional: true
 
-  '@ast-grep/napi-win32-ia32-msvc@0.35.0':
+  '@ast-grep/napi-win32-ia32-msvc@0.40.5':
     optional: true
 
-  '@ast-grep/napi-win32-x64-msvc@0.35.0':
+  '@ast-grep/napi-win32-x64-msvc@0.40.5':
     optional: true
 
-  '@ast-grep/napi@0.35.0':
+  '@ast-grep/napi@0.40.5':
     optionalDependencies:
-      '@ast-grep/napi-darwin-arm64': 0.35.0
-      '@ast-grep/napi-darwin-x64': 0.35.0
-      '@ast-grep/napi-linux-arm64-gnu': 0.35.0
-      '@ast-grep/napi-linux-arm64-musl': 0.35.0
-      '@ast-grep/napi-linux-x64-gnu': 0.35.0
-      '@ast-grep/napi-linux-x64-musl': 0.35.0
-      '@ast-grep/napi-win32-arm64-msvc': 0.35.0
-      '@ast-grep/napi-win32-ia32-msvc': 0.35.0
-      '@ast-grep/napi-win32-x64-msvc': 0.35.0
+      '@ast-grep/napi-darwin-arm64': 0.40.5
+      '@ast-grep/napi-darwin-x64': 0.40.5
+      '@ast-grep/napi-linux-arm64-gnu': 0.40.5
+      '@ast-grep/napi-linux-arm64-musl': 0.40.5
+      '@ast-grep/napi-linux-x64-gnu': 0.40.5
+      '@ast-grep/napi-linux-x64-musl': 0.40.5
+      '@ast-grep/napi-win32-arm64-msvc': 0.40.5
+      '@ast-grep/napi-win32-ia32-msvc': 0.40.5
+      '@ast-grep/napi-win32-x64-msvc': 0.40.5
 
   '@auth/core@0.41.0':
     dependencies:
@@ -10859,979 +10453,537 @@ snapshots:
       preact: 10.24.3
       preact-render-to-string: 6.5.11(preact@10.24.3)
 
-  '@aws-crypto/crc32@5.2.0':
-    dependencies:
-      '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.862.0
-      tslib: 2.8.1
-
-  '@aws-crypto/crc32c@5.2.0':
-    dependencies:
-      '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.862.0
-      tslib: 2.8.1
-
-  '@aws-crypto/ie11-detection@3.0.0':
-    dependencies:
-      tslib: 1.14.1
-
   '@aws-crypto/sha1-browser@5.2.0':
     dependencies:
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-locate-window': 3.804.0
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-locate-window': 3.893.0
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-crypto/sha256-browser@3.0.0':
-    dependencies:
-      '@aws-crypto/ie11-detection': 3.0.0
-      '@aws-crypto/sha256-js': 3.0.0
-      '@aws-crypto/supports-web-crypto': 3.0.0
-      '@aws-crypto/util': 3.0.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-locate-window': 3.804.0
-      '@aws-sdk/util-utf8-browser': 3.259.0
-      tslib: 1.14.1
-
   '@aws-crypto/sha256-browser@5.2.0':
     dependencies:
       '@aws-crypto/sha256-js': 5.2.0
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.862.0
+      '@aws-sdk/types': 3.973.15
       '@aws-sdk/util-locate-window': 3.893.0
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-crypto/sha256-js@3.0.0':
-    dependencies:
-      '@aws-crypto/util': 3.0.0
-      '@aws-sdk/types': 3.862.0
-      tslib: 1.14.1
-
   '@aws-crypto/sha256-js@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.862.0
+      '@aws-sdk/types': 3.973.15
       tslib: 2.8.1
 
-  '@aws-crypto/supports-web-crypto@3.0.0':
-    dependencies:
-      tslib: 1.14.1
-
   '@aws-crypto/supports-web-crypto@5.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@aws-crypto/util@3.0.0':
-    dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-utf8-browser': 3.259.0
-      tslib: 1.14.1
-
   '@aws-crypto/util@5.2.0':
     dependencies:
-      '@aws-sdk/types': 3.862.0
+      '@aws-sdk/types': 3.973.15
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-sdk/client-cloudfront@3.398.0':
-    dependencies:
-      '@aws-crypto/sha256-browser': 3.0.0
-      '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/client-sts': 3.398.0
-      '@aws-sdk/credential-provider-node': 3.398.0
-      '@aws-sdk/middleware-host-header': 3.398.0
-      '@aws-sdk/middleware-logger': 3.398.0
-      '@aws-sdk/middleware-recursion-detection': 3.398.0
-      '@aws-sdk/middleware-signing': 3.398.0
-      '@aws-sdk/middleware-user-agent': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@aws-sdk/util-endpoints': 3.398.0
-      '@aws-sdk/util-user-agent-browser': 3.398.0
-      '@aws-sdk/util-user-agent-node': 3.398.0
-      '@aws-sdk/xml-builder': 3.310.0
-      '@smithy/config-resolver': 2.2.0
-      '@smithy/fetch-http-handler': 2.5.0
-      '@smithy/hash-node': 2.2.0
-      '@smithy/invalid-dependency': 2.2.0
-      '@smithy/middleware-content-length': 2.2.0
-      '@smithy/middleware-endpoint': 2.5.1
-      '@smithy/middleware-retry': 2.3.1
-      '@smithy/middleware-serde': 2.3.0
-      '@smithy/middleware-stack': 2.2.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/node-http-handler': 2.5.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      '@smithy/util-base64': 2.3.0
-      '@smithy/util-body-length-browser': 2.2.0
-      '@smithy/util-body-length-node': 2.3.0
-      '@smithy/util-defaults-mode-browser': 2.2.1
-      '@smithy/util-defaults-mode-node': 2.3.1
-      '@smithy/util-retry': 2.2.0
-      '@smithy/util-stream': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      '@smithy/util-waiter': 2.2.0
-      fast-xml-parser: 4.2.5
+  '@aws-sdk/checksums@3.1000.12':
+    dependencies:
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/client-dynamodb@3.868.0':
+  '@aws-sdk/client-cloudfront@3.984.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/credential-provider-node': 3.864.0
-      '@aws-sdk/middleware-endpoint-discovery': 3.862.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/core': 3.8.0
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/hash-node': 4.0.5
-      '@smithy/invalid-dependency': 4.0.5
-      '@smithy/middleware-content-length': 4.0.5
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-retry': 4.1.19
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-body-length-node': 4.0.0
-      '@smithy/util-defaults-mode-browser': 4.0.26
-      '@smithy/util-defaults-mode-node': 4.0.26
-      '@smithy/util-endpoints': 3.0.7
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@smithy/util-utf8': 4.0.0
-      '@smithy/util-waiter': 4.0.7
-      '@types/uuid': 9.0.8
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/middleware-host-header': 3.972.28
+      '@aws-sdk/middleware-logger': 3.972.27
+      '@aws-sdk/middleware-recursion-detection': 3.972.29
+      '@aws-sdk/middleware-user-agent': 3.972.57
+      '@aws-sdk/region-config-resolver': 3.972.31
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-endpoints': 3.984.0
+      '@aws-sdk/util-user-agent-browser': 3.972.28
+      '@aws-sdk/util-user-agent-node': 3.973.43
+      '@smithy/config-resolver': 4.6.6
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/hash-node': 4.4.6
+      '@smithy/invalid-dependency': 4.4.6
+      '@smithy/middleware-content-length': 4.4.6
+      '@smithy/middleware-endpoint': 4.6.6
+      '@smithy/middleware-retry': 4.7.6
+      '@smithy/middleware-serde': 4.4.6
+      '@smithy/middleware-stack': 4.4.6
+      '@smithy/node-config-provider': 4.5.6
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/smithy-client': 4.14.6
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
+      '@smithy/util-base64': 4.3.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.1
+      '@smithy/util-defaults-mode-browser': 4.5.6
+      '@smithy/util-defaults-mode-node': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
+      '@smithy/util-middleware': 4.4.6
+      '@smithy/util-retry': 4.5.6
+      '@smithy/util-stream': 4.7.6
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/util-waiter': 4.5.6
       tslib: 2.8.1
-      uuid: 9.0.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/client-lambda@3.865.0':
+  '@aws-sdk/client-dynamodb@3.984.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/credential-provider-node': 3.864.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/core': 3.8.0
-      '@smithy/eventstream-serde-browser': 4.0.5
-      '@smithy/eventstream-serde-config-resolver': 4.1.3
-      '@smithy/eventstream-serde-node': 4.0.5
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/hash-node': 4.0.5
-      '@smithy/invalid-dependency': 4.0.5
-      '@smithy/middleware-content-length': 4.0.5
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-retry': 4.1.19
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-body-length-node': 4.0.0
-      '@smithy/util-defaults-mode-browser': 4.0.26
-      '@smithy/util-defaults-mode-node': 4.0.26
-      '@smithy/util-endpoints': 3.0.7
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@smithy/util-stream': 4.2.4
-      '@smithy/util-utf8': 4.0.0
-      '@smithy/util-waiter': 4.0.7
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/dynamodb-codec': 3.973.27
+      '@aws-sdk/middleware-endpoint-discovery': 3.972.22
+      '@aws-sdk/middleware-host-header': 3.972.28
+      '@aws-sdk/middleware-logger': 3.972.27
+      '@aws-sdk/middleware-recursion-detection': 3.972.29
+      '@aws-sdk/middleware-user-agent': 3.972.57
+      '@aws-sdk/region-config-resolver': 3.972.31
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-endpoints': 3.984.0
+      '@aws-sdk/util-user-agent-browser': 3.972.28
+      '@aws-sdk/util-user-agent-node': 3.973.43
+      '@smithy/config-resolver': 4.6.6
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/hash-node': 4.4.6
+      '@smithy/invalid-dependency': 4.4.6
+      '@smithy/middleware-content-length': 4.4.6
+      '@smithy/middleware-endpoint': 4.6.6
+      '@smithy/middleware-retry': 4.7.6
+      '@smithy/middleware-serde': 4.4.6
+      '@smithy/middleware-stack': 4.4.6
+      '@smithy/node-config-provider': 4.5.6
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/smithy-client': 4.14.6
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
+      '@smithy/util-base64': 4.3.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.1
+      '@smithy/util-defaults-mode-browser': 4.5.6
+      '@smithy/util-defaults-mode-node': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
+      '@smithy/util-middleware': 4.4.6
+      '@smithy/util-retry': 4.5.6
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/util-waiter': 4.5.6
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/client-s3@3.864.0':
+  '@aws-sdk/client-lambda@3.984.0':
     dependencies:
-      '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/credential-provider-node': 3.864.0
-      '@aws-sdk/middleware-bucket-endpoint': 3.862.0
-      '@aws-sdk/middleware-expect-continue': 3.862.0
-      '@aws-sdk/middleware-flexible-checksums': 3.864.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-location-constraint': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-sdk-s3': 3.864.0
-      '@aws-sdk/middleware-ssec': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/signature-v4-multi-region': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@aws-sdk/xml-builder': 3.862.0
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/core': 3.8.0
-      '@smithy/eventstream-serde-browser': 4.0.5
-      '@smithy/eventstream-serde-config-resolver': 4.1.3
-      '@smithy/eventstream-serde-node': 4.0.5
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/hash-blob-browser': 4.0.5
-      '@smithy/hash-node': 4.0.5
-      '@smithy/hash-stream-node': 4.0.5
-      '@smithy/invalid-dependency': 4.0.5
-      '@smithy/md5-js': 4.0.5
-      '@smithy/middleware-content-length': 4.0.5
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-retry': 4.1.19
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-body-length-node': 4.0.0
-      '@smithy/util-defaults-mode-browser': 4.0.26
-      '@smithy/util-defaults-mode-node': 4.0.26
-      '@smithy/util-endpoints': 3.0.7
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@smithy/util-stream': 4.2.4
-      '@smithy/util-utf8': 4.0.0
-      '@smithy/util-waiter': 4.0.7
-      '@types/uuid': 9.0.8
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/middleware-host-header': 3.972.28
+      '@aws-sdk/middleware-logger': 3.972.27
+      '@aws-sdk/middleware-recursion-detection': 3.972.29
+      '@aws-sdk/middleware-user-agent': 3.972.57
+      '@aws-sdk/region-config-resolver': 3.972.31
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-endpoints': 3.984.0
+      '@aws-sdk/util-user-agent-browser': 3.972.28
+      '@aws-sdk/util-user-agent-node': 3.973.43
+      '@smithy/config-resolver': 4.6.6
+      '@smithy/core': 3.29.1
+      '@smithy/eventstream-serde-browser': 4.4.6
+      '@smithy/eventstream-serde-config-resolver': 4.5.6
+      '@smithy/eventstream-serde-node': 4.4.6
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/hash-node': 4.4.6
+      '@smithy/invalid-dependency': 4.4.6
+      '@smithy/middleware-content-length': 4.4.6
+      '@smithy/middleware-endpoint': 4.6.6
+      '@smithy/middleware-retry': 4.7.6
+      '@smithy/middleware-serde': 4.4.6
+      '@smithy/middleware-stack': 4.4.6
+      '@smithy/node-config-provider': 4.5.6
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/smithy-client': 4.14.6
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
+      '@smithy/util-base64': 4.3.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.1
+      '@smithy/util-defaults-mode-browser': 4.5.6
+      '@smithy/util-defaults-mode-node': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
+      '@smithy/util-middleware': 4.4.6
+      '@smithy/util-retry': 4.5.6
+      '@smithy/util-stream': 4.7.6
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/util-waiter': 4.5.6
       tslib: 2.8.1
-      uuid: 9.0.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/client-sqs@3.864.0':
+  '@aws-sdk/client-s3@3.984.0':
     dependencies:
+      '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/credential-provider-node': 3.864.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-sdk-sqs': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/core': 3.8.0
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/hash-node': 4.0.5
-      '@smithy/invalid-dependency': 4.0.5
-      '@smithy/md5-js': 4.0.5
-      '@smithy/middleware-content-length': 4.0.5
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-retry': 4.1.19
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-body-length-node': 4.0.0
-      '@smithy/util-defaults-mode-browser': 4.0.26
-      '@smithy/util-defaults-mode-node': 4.0.26
-      '@smithy/util-endpoints': 3.0.7
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/client-sso@3.398.0':
-    dependencies:
-      '@aws-crypto/sha256-browser': 3.0.0
-      '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/middleware-host-header': 3.398.0
-      '@aws-sdk/middleware-logger': 3.398.0
-      '@aws-sdk/middleware-recursion-detection': 3.398.0
-      '@aws-sdk/middleware-user-agent': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@aws-sdk/util-endpoints': 3.398.0
-      '@aws-sdk/util-user-agent-browser': 3.398.0
-      '@aws-sdk/util-user-agent-node': 3.398.0
-      '@smithy/config-resolver': 2.2.0
-      '@smithy/fetch-http-handler': 2.5.0
-      '@smithy/hash-node': 2.2.0
-      '@smithy/invalid-dependency': 2.2.0
-      '@smithy/middleware-content-length': 2.2.0
-      '@smithy/middleware-endpoint': 2.5.1
-      '@smithy/middleware-retry': 2.3.1
-      '@smithy/middleware-serde': 2.3.0
-      '@smithy/middleware-stack': 2.2.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/node-http-handler': 2.5.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      '@smithy/util-base64': 2.3.0
-      '@smithy/util-body-length-browser': 2.2.0
-      '@smithy/util-body-length-node': 2.3.0
-      '@smithy/util-defaults-mode-browser': 2.2.1
-      '@smithy/util-defaults-mode-node': 2.3.1
-      '@smithy/util-retry': 2.2.0
-      '@smithy/util-utf8': 2.3.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/middleware-bucket-endpoint': 3.972.31
+      '@aws-sdk/middleware-expect-continue': 3.972.27
+      '@aws-sdk/middleware-flexible-checksums': 3.974.37
+      '@aws-sdk/middleware-host-header': 3.972.28
+      '@aws-sdk/middleware-location-constraint': 3.972.24
+      '@aws-sdk/middleware-logger': 3.972.27
+      '@aws-sdk/middleware-recursion-detection': 3.972.29
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
+      '@aws-sdk/middleware-ssec': 3.972.24
+      '@aws-sdk/middleware-user-agent': 3.972.57
+      '@aws-sdk/region-config-resolver': 3.972.31
+      '@aws-sdk/signature-v4-multi-region': 3.984.0
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-endpoints': 3.984.0
+      '@aws-sdk/util-user-agent-browser': 3.972.28
+      '@aws-sdk/util-user-agent-node': 3.973.43
+      '@smithy/config-resolver': 4.6.6
+      '@smithy/core': 3.29.1
+      '@smithy/eventstream-serde-browser': 4.4.6
+      '@smithy/eventstream-serde-config-resolver': 4.5.6
+      '@smithy/eventstream-serde-node': 4.4.6
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/hash-blob-browser': 4.4.6
+      '@smithy/hash-node': 4.4.6
+      '@smithy/hash-stream-node': 4.4.6
+      '@smithy/invalid-dependency': 4.4.6
+      '@smithy/md5-js': 4.4.6
+      '@smithy/middleware-content-length': 4.4.6
+      '@smithy/middleware-endpoint': 4.6.6
+      '@smithy/middleware-retry': 4.7.6
+      '@smithy/middleware-serde': 4.4.6
+      '@smithy/middleware-stack': 4.4.6
+      '@smithy/node-config-provider': 4.5.6
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/smithy-client': 4.14.6
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
+      '@smithy/util-base64': 4.3.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.1
+      '@smithy/util-defaults-mode-browser': 4.5.6
+      '@smithy/util-defaults-mode-node': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
+      '@smithy/util-middleware': 4.4.6
+      '@smithy/util-retry': 4.5.6
+      '@smithy/util-stream': 4.7.6
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/util-waiter': 4.5.6
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/client-sso@3.864.0':
+  '@aws-sdk/client-sqs@3.984.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/core': 3.8.0
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/hash-node': 4.0.5
-      '@smithy/invalid-dependency': 4.0.5
-      '@smithy/middleware-content-length': 4.0.5
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-retry': 4.1.19
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-body-length-node': 4.0.0
-      '@smithy/util-defaults-mode-browser': 4.0.26
-      '@smithy/util-defaults-mode-node': 4.0.26
-      '@smithy/util-endpoints': 3.0.7
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/client-sts@3.398.0':
-    dependencies:
-      '@aws-crypto/sha256-browser': 3.0.0
-      '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/credential-provider-node': 3.398.0
-      '@aws-sdk/middleware-host-header': 3.398.0
-      '@aws-sdk/middleware-logger': 3.398.0
-      '@aws-sdk/middleware-recursion-detection': 3.398.0
-      '@aws-sdk/middleware-sdk-sts': 3.398.0
-      '@aws-sdk/middleware-signing': 3.398.0
-      '@aws-sdk/middleware-user-agent': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@aws-sdk/util-endpoints': 3.398.0
-      '@aws-sdk/util-user-agent-browser': 3.398.0
-      '@aws-sdk/util-user-agent-node': 3.398.0
-      '@smithy/config-resolver': 2.2.0
-      '@smithy/fetch-http-handler': 2.5.0
-      '@smithy/hash-node': 2.2.0
-      '@smithy/invalid-dependency': 2.2.0
-      '@smithy/middleware-content-length': 2.2.0
-      '@smithy/middleware-endpoint': 2.5.1
-      '@smithy/middleware-retry': 2.3.1
-      '@smithy/middleware-serde': 2.3.0
-      '@smithy/middleware-stack': 2.2.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/node-http-handler': 2.5.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      '@smithy/util-base64': 2.3.0
-      '@smithy/util-body-length-browser': 2.2.0
-      '@smithy/util-body-length-node': 2.3.0
-      '@smithy/util-defaults-mode-browser': 2.2.1
-      '@smithy/util-defaults-mode-node': 2.3.1
-      '@smithy/util-retry': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      fast-xml-parser: 4.2.5
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/core@3.864.0':
-    dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/xml-builder': 3.862.0
-      '@smithy/core': 3.17.1
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/property-provider': 4.2.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/signature-v4': 5.3.3
-      '@smithy/smithy-client': 4.9.1
-      '@smithy/types': 4.8.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/middleware-host-header': 3.972.28
+      '@aws-sdk/middleware-logger': 3.972.27
+      '@aws-sdk/middleware-recursion-detection': 3.972.29
+      '@aws-sdk/middleware-sdk-sqs': 3.972.34
+      '@aws-sdk/middleware-user-agent': 3.972.57
+      '@aws-sdk/region-config-resolver': 3.972.31
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/util-endpoints': 3.984.0
+      '@aws-sdk/util-user-agent-browser': 3.972.28
+      '@aws-sdk/util-user-agent-node': 3.973.43
+      '@smithy/config-resolver': 4.6.6
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/hash-node': 4.4.6
+      '@smithy/invalid-dependency': 4.4.6
+      '@smithy/md5-js': 4.4.6
+      '@smithy/middleware-content-length': 4.4.6
+      '@smithy/middleware-endpoint': 4.6.6
+      '@smithy/middleware-retry': 4.7.6
+      '@smithy/middleware-serde': 4.4.6
+      '@smithy/middleware-stack': 4.4.6
+      '@smithy/node-config-provider': 4.5.6
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/smithy-client': 4.14.6
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
       '@smithy/util-base64': 4.3.0
       '@smithy/util-body-length-browser': 4.2.0
-      '@smithy/util-middleware': 4.2.3
+      '@smithy/util-body-length-node': 4.2.1
+      '@smithy/util-defaults-mode-browser': 4.5.6
+      '@smithy/util-defaults-mode-node': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
+      '@smithy/util-middleware': 4.4.6
+      '@smithy/util-retry': 4.5.6
       '@smithy/util-utf8': 4.2.0
-      fast-xml-parser: 5.2.5
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-env@3.398.0':
-    dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-env@3.864.0':
-    dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/property-provider': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-http@3.864.0':
-    dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/property-provider': 4.0.5
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/util-stream': 4.2.4
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-ini@3.398.0':
-    dependencies:
-      '@aws-sdk/credential-provider-env': 3.398.0
-      '@aws-sdk/credential-provider-process': 3.398.0
-      '@aws-sdk/credential-provider-sso': 3.398.0
-      '@aws-sdk/credential-provider-web-identity': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@smithy/credential-provider-imds': 2.3.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-ini@3.864.0':
-    dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/credential-provider-env': 3.864.0
-      '@aws-sdk/credential-provider-http': 3.864.0
-      '@aws-sdk/credential-provider-process': 3.864.0
-      '@aws-sdk/credential-provider-sso': 3.864.0
-      '@aws-sdk/credential-provider-web-identity': 3.864.0
-      '@aws-sdk/nested-clients': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/credential-provider-imds': 4.0.7
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-node@3.398.0':
-    dependencies:
-      '@aws-sdk/credential-provider-env': 3.398.0
-      '@aws-sdk/credential-provider-ini': 3.398.0
-      '@aws-sdk/credential-provider-process': 3.398.0
-      '@aws-sdk/credential-provider-sso': 3.398.0
-      '@aws-sdk/credential-provider-web-identity': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@smithy/credential-provider-imds': 2.3.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-node@3.864.0':
-    dependencies:
-      '@aws-sdk/credential-provider-env': 3.864.0
-      '@aws-sdk/credential-provider-http': 3.864.0
-      '@aws-sdk/credential-provider-ini': 3.864.0
-      '@aws-sdk/credential-provider-process': 3.864.0
-      '@aws-sdk/credential-provider-sso': 3.864.0
-      '@aws-sdk/credential-provider-web-identity': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/credential-provider-imds': 4.0.7
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-process@3.398.0':
-    dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-process@3.864.0':
-    dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-sso@3.398.0':
+  '@aws-sdk/core@3.974.27':
     dependencies:
-      '@aws-sdk/client-sso': 3.398.0
-      '@aws-sdk/token-providers': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-sso@3.864.0':
-    dependencies:
-      '@aws-sdk/client-sso': 3.864.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/token-providers': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/credential-provider-web-identity@3.398.0':
-    dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/types': 2.12.0
+      '@aws-sdk/types': 3.973.15
+      '@aws-sdk/xml-builder': 3.972.33
+      '@aws/lambda-invoke-store': 0.3.0
+      '@smithy/core': 3.29.1
+      '@smithy/signature-v4': 5.6.2
+      '@smithy/types': 4.15.1
+      bowser: 2.12.1
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-web-identity@3.864.0':
+  '@aws-sdk/credential-provider-env@3.972.53':
     dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/nested-clients': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/property-provider': 4.2.3
-      '@smithy/types': 4.8.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/endpoint-cache@3.804.0':
+  '@aws-sdk/credential-provider-http@3.972.55':
     dependencies:
-      mnemonist: 0.38.3
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-bucket-endpoint@3.862.0':
-    dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-arn-parser': 3.804.0
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      '@smithy/util-config-provider': 4.0.0
+  '@aws-sdk/credential-provider-ini@3.972.60':
+    dependencies:
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-env': 3.972.53
+      '@aws-sdk/credential-provider-http': 3.972.55
+      '@aws-sdk/credential-provider-login': 3.972.59
+      '@aws-sdk/credential-provider-process': 3.972.53
+      '@aws-sdk/credential-provider-sso': 3.972.59
+      '@aws-sdk/credential-provider-web-identity': 3.972.59
+      '@aws-sdk/nested-clients': 3.997.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/credential-provider-imds': 4.4.6
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-endpoint-discovery@3.862.0':
+  '@aws-sdk/credential-provider-login@3.972.59':
     dependencies:
-      '@aws-sdk/endpoint-cache': 3.804.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/nested-clients': 3.997.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-expect-continue@3.862.0':
-    dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
+  '@aws-sdk/credential-provider-node@3.972.62':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.53
+      '@aws-sdk/credential-provider-http': 3.972.55
+      '@aws-sdk/credential-provider-ini': 3.972.60
+      '@aws-sdk/credential-provider-process': 3.972.53
+      '@aws-sdk/credential-provider-sso': 3.972.59
+      '@aws-sdk/credential-provider-web-identity': 3.972.59
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/credential-provider-imds': 4.4.6
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-flexible-checksums@3.864.0':
+  '@aws-sdk/credential-provider-process@3.972.53':
     dependencies:
-      '@aws-crypto/crc32': 5.2.0
-      '@aws-crypto/crc32c': 5.2.0
-      '@aws-crypto/util': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/is-array-buffer': 4.0.0
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-stream': 4.2.4
-      '@smithy/util-utf8': 4.0.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-host-header@3.398.0':
+  '@aws-sdk/credential-provider-sso@3.972.59':
     dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/types': 2.12.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/nested-clients': 3.997.27
+      '@aws-sdk/token-providers': 3.1079.0
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-host-header@3.862.0':
+  '@aws-sdk/credential-provider-web-identity@3.972.59':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/nested-clients': 3.997.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-location-constraint@3.862.0':
+  '@aws-sdk/dynamodb-codec@3.973.27':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/types': 4.3.2
+      '@aws-sdk/core': 3.974.27
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-logger@3.398.0':
+  '@aws-sdk/endpoint-cache@3.972.8':
     dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/types': 2.12.0
+      mnemonist: 0.38.3
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-logger@3.862.0':
+  '@aws-sdk/middleware-bucket-endpoint@3.972.31':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/types': 4.8.0
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-recursion-detection@3.398.0':
+  '@aws-sdk/middleware-endpoint-discovery@3.972.22':
     dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/types': 2.12.0
+      '@aws-sdk/endpoint-cache': 3.972.8
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-recursion-detection@3.862.0':
+  '@aws-sdk/middleware-expect-continue@3.972.27':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@aws-sdk/middleware-sdk-s3@3.864.0':
-    dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-arn-parser': 3.804.0
-      '@smithy/core': 3.8.0
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/signature-v4': 5.1.3
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/util-config-provider': 4.0.0
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-stream': 4.2.4
-      '@smithy/util-utf8': 4.0.0
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-sqs@3.862.0':
+  '@aws-sdk/middleware-flexible-checksums@3.974.37':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/util-hex-encoding': 4.0.0
-      '@smithy/util-utf8': 4.0.0
+      '@aws-sdk/checksums': 3.1000.12
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-sts@3.398.0':
+  '@aws-sdk/middleware-host-header@3.972.28':
     dependencies:
-      '@aws-sdk/middleware-signing': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@smithy/types': 2.12.0
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-signing@3.398.0':
+  '@aws-sdk/middleware-location-constraint@3.972.24':
     dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/signature-v4': 2.3.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-middleware': 2.2.0
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-ssec@3.862.0':
+  '@aws-sdk/middleware-logger@3.972.27':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/types': 4.3.2
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-user-agent@3.398.0':
+  '@aws-sdk/middleware-recursion-detection@3.972.29':
     dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@aws-sdk/util-endpoints': 3.398.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/types': 2.12.0
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-user-agent@3.864.0':
+  '@aws-sdk/middleware-sdk-s3@3.972.58':
     dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@smithy/core': 3.17.1
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/signature-v4-multi-region': 3.996.38
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/nested-clients@3.864.0':
+  '@aws-sdk/middleware-sdk-sqs@3.972.34':
     dependencies:
-      '@aws-crypto/sha256-browser': 5.2.0
-      '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/middleware-host-header': 3.862.0
-      '@aws-sdk/middleware-logger': 3.862.0
-      '@aws-sdk/middleware-recursion-detection': 3.862.0
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/region-config-resolver': 3.862.0
-      '@aws-sdk/types': 3.862.0
-      '@aws-sdk/util-endpoints': 3.862.0
-      '@aws-sdk/util-user-agent-browser': 3.862.0
-      '@aws-sdk/util-user-agent-node': 3.864.0
-      '@smithy/config-resolver': 4.4.0
-      '@smithy/core': 3.17.1
-      '@smithy/fetch-http-handler': 5.3.4
-      '@smithy/hash-node': 4.2.3
-      '@smithy/invalid-dependency': 4.2.3
-      '@smithy/middleware-content-length': 4.2.3
-      '@smithy/middleware-endpoint': 4.3.5
-      '@smithy/middleware-retry': 4.4.5
-      '@smithy/middleware-serde': 4.2.3
-      '@smithy/middleware-stack': 4.2.3
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/node-http-handler': 4.4.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/smithy-client': 4.9.1
-      '@smithy/types': 4.8.0
-      '@smithy/url-parser': 4.2.3
-      '@smithy/util-base64': 4.3.0
-      '@smithy/util-body-length-browser': 4.2.0
-      '@smithy/util-body-length-node': 4.2.1
-      '@smithy/util-defaults-mode-browser': 4.3.4
-      '@smithy/util-defaults-mode-node': 4.2.6
-      '@smithy/util-endpoints': 3.2.3
-      '@smithy/util-middleware': 4.2.3
-      '@smithy/util-retry': 4.2.3
-      '@smithy/util-utf8': 4.2.0
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/region-config-resolver@3.862.0':
+  '@aws-sdk/middleware-ssec@3.972.24':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-config-provider': 4.2.0
-      '@smithy/util-middleware': 4.2.3
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
       tslib: 2.8.1
 
-  '@aws-sdk/signature-v4-multi-region@3.864.0':
+  '@aws-sdk/middleware-user-agent@3.972.57':
     dependencies:
-      '@aws-sdk/middleware-sdk-s3': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/signature-v4': 5.1.3
-      '@smithy/types': 4.3.2
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/token-providers@3.398.0':
-    dependencies:
-      '@aws-crypto/sha256-browser': 3.0.0
-      '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/middleware-host-header': 3.398.0
-      '@aws-sdk/middleware-logger': 3.398.0
-      '@aws-sdk/middleware-recursion-detection': 3.398.0
-      '@aws-sdk/middleware-user-agent': 3.398.0
-      '@aws-sdk/types': 3.398.0
-      '@aws-sdk/util-endpoints': 3.398.0
-      '@aws-sdk/util-user-agent-browser': 3.398.0
-      '@aws-sdk/util-user-agent-node': 3.398.0
-      '@smithy/config-resolver': 2.2.0
-      '@smithy/fetch-http-handler': 2.5.0
-      '@smithy/hash-node': 2.2.0
-      '@smithy/invalid-dependency': 2.2.0
-      '@smithy/middleware-content-length': 2.2.0
-      '@smithy/middleware-endpoint': 2.5.1
-      '@smithy/middleware-retry': 2.3.1
-      '@smithy/middleware-serde': 2.3.0
-      '@smithy/middleware-stack': 2.2.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/node-http-handler': 2.5.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/protocol-http': 2.0.5
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      '@smithy/util-base64': 2.3.0
-      '@smithy/util-body-length-browser': 2.2.0
-      '@smithy/util-body-length-node': 2.3.0
-      '@smithy/util-defaults-mode-browser': 2.2.1
-      '@smithy/util-defaults-mode-node': 2.3.1
-      '@smithy/util-retry': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
-
-  '@aws-sdk/token-providers@3.864.0':
+  '@aws-sdk/nested-clients@3.997.27':
     dependencies:
-      '@aws-sdk/core': 3.864.0
-      '@aws-sdk/nested-clients': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/signature-v4-multi-region': 3.996.38
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
-    transitivePeerDependencies:
-      - aws-crt
 
-  '@aws-sdk/types@3.398.0':
+  '@aws-sdk/region-config-resolver@3.972.31':
     dependencies:
-      '@smithy/types': 2.12.0
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/types@3.862.0':
+  '@aws-sdk/signature-v4-multi-region@3.984.0':
     dependencies:
-      '@smithy/types': 4.8.0
+      '@aws-sdk/middleware-sdk-s3': 3.972.58
+      '@aws-sdk/types': 3.973.15
+      '@smithy/protocol-http': 5.5.6
+      '@smithy/signature-v4': 5.6.2
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-arn-parser@3.804.0':
+  '@aws-sdk/signature-v4-multi-region@3.996.38':
     dependencies:
+      '@aws-sdk/types': 3.973.15
+      '@smithy/signature-v4': 5.6.2
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-endpoints@3.398.0':
+  '@aws-sdk/token-providers@3.1079.0':
     dependencies:
-      '@aws-sdk/types': 3.398.0
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/nested-clients': 3.997.27
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-endpoints@3.862.0':
+  '@aws-sdk/types@3.973.15':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/types': 4.8.0
-      '@smithy/url-parser': 4.2.3
-      '@smithy/util-endpoints': 3.2.3
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-locate-window@3.804.0':
+  '@aws-sdk/util-endpoints@3.984.0':
     dependencies:
+      '@aws-sdk/types': 3.973.15
+      '@smithy/types': 4.15.1
+      '@smithy/url-parser': 4.4.6
+      '@smithy/util-endpoints': 3.6.6
       tslib: 2.8.1
 
   '@aws-sdk/util-locate-window@3.893.0':
     dependencies:
       tslib: 2.8.1
 
-  '@aws-sdk/util-user-agent-browser@3.398.0':
-    dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/types': 2.12.0
-      bowser: 2.12.0
-      tslib: 2.8.1
-
-  '@aws-sdk/util-user-agent-browser@3.862.0':
+  '@aws-sdk/util-user-agent-browser@3.972.28':
     dependencies:
-      '@aws-sdk/types': 3.862.0
-      '@smithy/types': 4.8.0
-      bowser: 2.12.1
-      tslib: 2.8.1
-
-  '@aws-sdk/util-user-agent-node@3.398.0':
-    dependencies:
-      '@aws-sdk/types': 3.398.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/types': 2.12.0
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/util-user-agent-node@3.864.0':
+  '@aws-sdk/util-user-agent-node@3.973.43':
     dependencies:
-      '@aws-sdk/middleware-user-agent': 3.864.0
-      '@aws-sdk/types': 3.862.0
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/types': 4.8.0
+      '@aws-sdk/core': 3.974.27
       tslib: 2.8.1
 
-  '@aws-sdk/util-utf8-browser@3.259.0':
+  '@aws-sdk/xml-builder@3.972.33':
     dependencies:
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@aws-sdk/xml-builder@3.310.0':
-    dependencies:
-      tslib: 2.8.1
-
-  '@aws-sdk/xml-builder@3.862.0':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
+  '@aws/lambda-invoke-store@0.3.0': {}
 
   '@babel/code-frame@7.27.1':
     dependencies:
@@ -11984,6 +11136,8 @@ snapshots:
     dependencies:
       regenerator-runtime: 0.14.1
 
+  '@babel/runtime@7.29.7': {}
+
   '@babel/standalone@7.27.5': {}
 
   '@babel/template@7.27.2':
@@ -12009,6 +11163,31 @@ snapshots:
       '@babel/helper-string-parser': 7.27.1
       '@babel/helper-validator-identifier': 7.27.1
 
+  '@base-ui/react@1.6.0(@date-fns/tz@1.2.0)(@types/react@19.2.7)(date-fns@4.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)':
+    dependencies:
+      '@babel/runtime': 7.29.7
+      '@base-ui/utils': 0.3.1(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@floating-ui/react-dom': 2.1.8(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@floating-ui/utils': 0.2.11
+      react: 19.1.7
+      react-dom: 19.1.7(react@19.1.7)
+      use-sync-external-store: 1.6.0(react@19.1.7)
+    optionalDependencies:
+      '@date-fns/tz': 1.2.0
+      '@types/react': 19.2.7
+      date-fns: 4.1.0
+
+  '@base-ui/utils@0.3.1(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)':
+    dependencies:
+      '@babel/runtime': 7.29.7
+      '@floating-ui/utils': 0.2.11
+      react: 19.1.7
+      react-dom: 19.1.7(react@19.1.7)
+      reselect: 5.2.0
+      use-sync-external-store: 1.6.0(react@19.1.7)
+    optionalDependencies:
+      '@types/react': 19.2.7
+
   '@bcoe/v8-coverage@0.2.3': {}
 
   '@bcoe/v8-coverage@1.0.2': {}
@@ -12162,9 +11341,9 @@ snapshots:
       neverthrow: 8.2.0
       picocolors: 1.1.1
 
-  '@c15t/nextjs@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)':
+  '@c15t/nextjs@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)':
     dependencies:
-      '@c15t/react': 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
+      '@c15t/react': 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
       '@c15t/translations': 1.8.0
       next: 16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       react: 19.1.7
@@ -12210,16 +11389,16 @@ snapshots:
       - use-sync-external-store
       - ws
 
-  '@c15t/react@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)':
+  '@c15t/react@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)':
     dependencies:
       '@radix-ui/react-accordion': 1.2.4(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       '@radix-ui/react-slot': 1.2.0(@types/react@19.2.7)(react@19.1.7)
       '@radix-ui/react-switch': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
-      c15t: 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
+      c15t: 1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2)
       clsx: 2.1.1
       react: 19.1.7
       react-dom: 19.1.7(react@19.1.7)
-      zustand: 5.0.8(@types/react@19.2.7)(immer@11.1.8)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7))
+      zustand: 5.0.8(@types/react@19.2.7)(immer@11.1.15)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7))
     transitivePeerDependencies:
       - '@aws-sdk/client-rds-data'
       - '@cloudflare/workers-types'
@@ -12277,7 +11456,7 @@ snapshots:
       outdent: 0.5.0
       prettier: 2.8.8
       resolve-from: 5.0.0
-      semver: 7.7.2
+      semver: 7.7.4
 
   '@changesets/assemble-release-plan@6.0.8':
     dependencies:
@@ -12286,7 +11465,7 @@ snapshots:
       '@changesets/should-skip-package': 0.1.2
       '@changesets/types': 6.1.0
       '@manypkg/get-packages': 1.1.3
-      semver: 7.7.2
+      semver: 7.7.4
 
   '@changesets/changelog-git@0.2.1':
     dependencies:
@@ -12327,7 +11506,7 @@ snapshots:
       package-manager-detector: 0.2.8
       picocolors: 1.1.1
       resolve-from: 5.0.0
-      semver: 7.7.2
+      semver: 7.7.4
       spawndamnit: 3.0.1
       term-size: 2.2.1
 
@@ -12350,7 +11529,7 @@ snapshots:
       '@changesets/types': 6.1.0
       '@manypkg/get-packages': 1.1.3
       picocolors: 1.1.1
-      semver: 7.7.2
+      semver: 7.7.4
 
   '@changesets/get-github-info@0.6.0(encoding@0.1.13)':
     dependencies:
@@ -12744,7 +11923,7 @@ snapshots:
   '@dotenvx/dotenvx@1.31.0':
     dependencies:
       commander: 11.1.0
-      dotenv: 16.5.0
+      dotenv: 16.6.1
       eciesjs: 0.4.15
       execa: 5.1.1
       fdir: 6.4.6(picomatch@4.0.2)
@@ -12781,7 +11960,7 @@ snapshots:
   '@emotion/babel-plugin@11.13.5':
     dependencies:
       '@babel/helper-module-imports': 7.27.1
-      '@babel/runtime': 7.26.7
+      '@babel/runtime': 7.29.7
       '@emotion/hash': 0.9.2
       '@emotion/memoize': 0.9.0
       '@emotion/serialize': 1.3.3
@@ -13037,17 +12216,34 @@ snapshots:
     dependencies:
       '@floating-ui/utils': 0.2.9
 
+  '@floating-ui/core@1.7.5':
+    dependencies:
+      '@floating-ui/utils': 0.2.11
+
   '@floating-ui/dom@1.7.1':
     dependencies:
       '@floating-ui/core': 1.7.1
       '@floating-ui/utils': 0.2.9
 
+  '@floating-ui/dom@1.7.6':
+    dependencies:
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
+
   '@floating-ui/react-dom@2.1.3(react-dom@19.1.7(react@19.1.7))(react@19.1.7)':
     dependencies:
       '@floating-ui/dom': 1.7.1
       react: 19.1.7
       react-dom: 19.1.7(react@19.1.7)
 
+  '@floating-ui/react-dom@2.1.8(react-dom@19.1.7(react@19.1.7))(react@19.1.7)':
+    dependencies:
+      '@floating-ui/dom': 1.7.6
+      react: 19.1.7
+      react-dom: 19.1.7(react@19.1.7)
+
+  '@floating-ui/utils@0.2.11': {}
+
   '@floating-ui/utils@0.2.9': {}
 
   '@formatjs/ecma402-abstract@2.3.4':
@@ -13145,8 +12341,6 @@ snapshots:
 
   '@humanwhocodes/object-schema@2.0.3': {}
 
-  '@iarna/toml@2.2.5': {}
-
   '@icons-pack/react-simple-icons@11.2.0(react@19.1.7)':
     dependencies:
       react: 19.1.7
@@ -13439,12 +12633,6 @@ snapshots:
     optionalDependencies:
       '@types/node': 22.15.30
 
-  '@isaacs/balanced-match@4.0.1': {}
-
-  '@isaacs/brace-expansion@5.0.0':
-    dependencies:
-      '@isaacs/balanced-match': 4.0.1
-
   '@isaacs/cliui@8.0.2':
     dependencies:
       string-width: 5.1.2
@@ -13454,6 +12642,10 @@ snapshots:
       wrap-ansi: 8.1.0
       wrap-ansi-cjs: wrap-ansi@7.0.0
 
+  '@isaacs/fs-minipass@4.0.1':
+    dependencies:
+      minipass: 7.1.2
+
   '@istanbuljs/load-nyc-config@1.1.0':
     dependencies:
       camelcase: 5.3.1
@@ -13760,7 +12952,7 @@ snapshots:
       '@makeswift/controls': 0.1.18
       '@makeswift/next-plugin': 0.6.1(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))
       '@makeswift/prop-controllers': 0.4.12
-      '@reduxjs/toolkit': 2.11.2(react@19.1.7)
+      '@reduxjs/toolkit': 2.12.0(react@19.1.7)
       '@use-gesture/react': 10.3.1(react@19.1.7)
       color: 3.2.1
       cookie: 1.0.2
@@ -13773,9 +12965,9 @@ snapshots:
       framer-motion: 10.18.0(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       graphql: 16.11.0
       html-react-parser: 5.2.17(@types/react@19.2.7)(react@19.1.7)
-      immutable: 4.3.8
+      immutable: 4.3.9
       is-hotkey: 0.1.8
-      js-base64: 3.7.8
+      js-base64: 3.9.1
       jwt-decode: 4.0.0
       next: 16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       ot-json0: 1.1.0
@@ -13785,7 +12977,7 @@ snapshots:
       react: 19.1.7
       react-dom: 19.1.7(react@19.1.7)
       react-player: 2.16.1(react@19.1.7)
-      reselect: 5.1.1
+      reselect: 5.2.0
       scroll-into-view-if-needed: 2.2.31
       set-cookie-parser: 2.7.2
       slate: 0.91.4
@@ -13921,41 +13113,43 @@ snapshots:
 
   '@open-draft/until@2.1.0': {}
 
-  '@opennextjs/aws@3.7.6':
+  '@opennextjs/aws@3.9.16(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))':
     dependencies:
-      '@ast-grep/napi': 0.35.0
-      '@aws-sdk/client-cloudfront': 3.398.0
-      '@aws-sdk/client-dynamodb': 3.868.0
-      '@aws-sdk/client-lambda': 3.865.0
-      '@aws-sdk/client-s3': 3.864.0
-      '@aws-sdk/client-sqs': 3.864.0
+      '@ast-grep/napi': 0.40.5
+      '@aws-sdk/client-cloudfront': 3.984.0
+      '@aws-sdk/client-dynamodb': 3.984.0
+      '@aws-sdk/client-lambda': 3.984.0
+      '@aws-sdk/client-s3': 3.984.0
+      '@aws-sdk/client-sqs': 3.984.0
       '@node-minify/core': 8.0.6
       '@node-minify/terser': 8.0.6
       '@tsconfig/node18': 1.0.3
       aws4fetch: 1.0.20
-      chalk: 5.4.1
+      chalk: 5.6.2
       cookie: 1.0.2
       esbuild: 0.25.4
-      express: 5.0.1
+      express: 5.2.1
+      next: 16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       path-to-regexp: 6.3.0
-      urlpattern-polyfill: 10.0.0
+      urlpattern-polyfill: 10.1.0
       yaml: 2.8.1
     transitivePeerDependencies:
-      - aws-crt
       - supports-color
 
-  '@opennextjs/cloudflare@1.8.0(encoding@0.1.13)(wrangler@4.31.0)':
+  '@opennextjs/cloudflare@1.17.3(encoding@0.1.13)(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))(wrangler@4.31.0)':
     dependencies:
+      '@ast-grep/napi': 0.40.5
       '@dotenvx/dotenvx': 1.31.0
-      '@opennextjs/aws': 3.7.6
+      '@opennextjs/aws': 3.9.16(next@16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7))
       cloudflare: 4.5.0(encoding@0.1.13)
+      comment-json: 4.6.2
       enquirer: 2.4.1
-      glob: 11.0.3
+      glob: 12.0.0
+      next: 16.2.6(@babel/core@7.27.4)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(babel-plugin-macros@3.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
       ts-tqdm: 0.8.6
       wrangler: 4.31.0
       yargs: 18.0.0
     transitivePeerDependencies:
-      - aws-crt
       - encoding
       - supports-color
 
@@ -14502,7 +13696,7 @@ snapshots:
       extract-zip: 2.0.1
       progress: 2.0.3
       proxy-agent: 6.5.0
-      semver: 7.7.2
+      semver: 7.7.4
       tar-fs: 3.0.9
       yargs: 17.7.2
     transitivePeerDependencies:
@@ -15110,14 +14304,14 @@ snapshots:
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@reduxjs/toolkit@2.11.2(react@19.1.7)':
+  '@reduxjs/toolkit@2.12.0(react@19.1.7)':
     dependencies:
       '@standard-schema/spec': 1.0.0
       '@standard-schema/utils': 0.3.0
-      immer: 11.1.8
+      immer: 11.1.15
       redux: 5.0.1
       redux-thunk: 3.1.0(redux@5.0.1)
-      reselect: 5.1.1
+      reselect: 5.2.0
     optionalDependencies:
       react: 19.1.7
 
@@ -15215,894 +14409,285 @@ snapshots:
       '@segment/analytics-generic-utils': 1.2.0
       buffer: 6.0.3
       jose: 5.10.0
-      node-fetch: 2.7.0(encoding@0.1.13)
-      tslib: 2.8.1
-    transitivePeerDependencies:
-      - encoding
-
-  '@sentry-internal/tracing@7.120.3':
-    dependencies:
-      '@sentry/core': 7.120.3
-      '@sentry/types': 7.120.3
-      '@sentry/utils': 7.120.3
-
-  '@sentry/core@6.19.7':
-    dependencies:
-      '@sentry/hub': 6.19.7
-      '@sentry/minimal': 6.19.7
-      '@sentry/types': 6.19.7
-      '@sentry/utils': 6.19.7
-      tslib: 1.14.1
-
-  '@sentry/core@7.120.3':
-    dependencies:
-      '@sentry/types': 7.120.3
-      '@sentry/utils': 7.120.3
-
-  '@sentry/hub@6.19.7':
-    dependencies:
-      '@sentry/types': 6.19.7
-      '@sentry/utils': 6.19.7
-      tslib: 1.14.1
-
-  '@sentry/integrations@7.120.3':
-    dependencies:
-      '@sentry/core': 7.120.3
-      '@sentry/types': 7.120.3
-      '@sentry/utils': 7.120.3
-      localforage: 1.10.0
-
-  '@sentry/minimal@6.19.7':
-    dependencies:
-      '@sentry/hub': 6.19.7
-      '@sentry/types': 6.19.7
-      tslib: 1.14.1
-
-  '@sentry/node@6.19.7':
-    dependencies:
-      '@sentry/core': 6.19.7
-      '@sentry/hub': 6.19.7
-      '@sentry/types': 6.19.7
-      '@sentry/utils': 6.19.7
-      cookie: 0.4.2
-      https-proxy-agent: 5.0.1
-      lru_map: 0.3.3
-      tslib: 1.14.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@sentry/node@7.120.3':
-    dependencies:
-      '@sentry-internal/tracing': 7.120.3
-      '@sentry/core': 7.120.3
-      '@sentry/integrations': 7.120.3
-      '@sentry/types': 7.120.3
-      '@sentry/utils': 7.120.3
-
-  '@sentry/types@6.19.7': {}
-
-  '@sentry/types@7.120.3': {}
-
-  '@sentry/utils@6.19.7':
-    dependencies:
-      '@sentry/types': 6.19.7
-      tslib: 1.14.1
-
-  '@sentry/utils@7.120.3':
-    dependencies:
-      '@sentry/types': 7.120.3
-
-  '@sinclair/typebox@0.27.8': {}
-
-  '@sindresorhus/is@4.6.0': {}
-
-  '@sindresorhus/is@7.0.2': {}
-
-  '@sindresorhus/merge-streams@2.3.0': {}
-
-  '@sindresorhus/merge-streams@4.0.0': {}
-
-  '@sinonjs/commons@3.0.1':
-    dependencies:
-      type-detect: 4.0.8
-
-  '@sinonjs/fake-timers@10.3.0':
-    dependencies:
-      '@sinonjs/commons': 3.0.1
-
-  '@smithy/abort-controller@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/abort-controller@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/abort-controller@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/chunked-blob-reader-native@4.0.0':
-    dependencies:
-      '@smithy/util-base64': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/chunked-blob-reader@5.0.0':
-    dependencies:
-      tslib: 2.8.1
-
-  '@smithy/config-resolver@2.2.0':
-    dependencies:
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-config-provider': 2.3.0
-      '@smithy/util-middleware': 2.2.0
-      tslib: 2.8.1
-
-  '@smithy/config-resolver@4.1.5':
-    dependencies:
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/types': 4.3.2
-      '@smithy/util-config-provider': 4.0.0
-      '@smithy/util-middleware': 4.0.5
-      tslib: 2.8.1
-
-  '@smithy/config-resolver@4.4.0':
-    dependencies:
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-config-provider': 4.2.0
-      '@smithy/util-endpoints': 3.2.3
-      '@smithy/util-middleware': 4.2.3
-      tslib: 2.8.1
-
-  '@smithy/core@3.17.1':
-    dependencies:
-      '@smithy/middleware-serde': 4.2.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-base64': 4.3.0
-      '@smithy/util-body-length-browser': 4.2.0
-      '@smithy/util-middleware': 4.2.3
-      '@smithy/util-stream': 4.5.4
-      '@smithy/util-utf8': 4.2.0
-      '@smithy/uuid': 1.1.0
-      tslib: 2.8.1
-
-  '@smithy/core@3.8.0':
-    dependencies:
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-body-length-browser': 4.0.0
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-stream': 4.2.4
-      '@smithy/util-utf8': 4.0.0
-      '@types/uuid': 9.0.8
-      tslib: 2.8.1
-      uuid: 9.0.1
-
-  '@smithy/credential-provider-imds@2.3.0':
-    dependencies:
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      tslib: 2.8.1
-
-  '@smithy/credential-provider-imds@4.0.7':
-    dependencies:
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/property-provider': 4.0.5
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      tslib: 2.8.1
-
-  '@smithy/credential-provider-imds@4.2.3':
-    dependencies:
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/property-provider': 4.2.3
-      '@smithy/types': 4.8.0
-      '@smithy/url-parser': 4.2.3
-      tslib: 2.8.1
-
-  '@smithy/eventstream-codec@4.0.5':
-    dependencies:
-      '@aws-crypto/crc32': 5.2.0
-      '@smithy/types': 4.3.2
-      '@smithy/util-hex-encoding': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/eventstream-serde-browser@4.0.5':
-    dependencies:
-      '@smithy/eventstream-serde-universal': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/eventstream-serde-config-resolver@4.1.3':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/eventstream-serde-node@4.0.5':
-    dependencies:
-      '@smithy/eventstream-serde-universal': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/eventstream-serde-universal@4.0.5':
-    dependencies:
-      '@smithy/eventstream-codec': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/fetch-http-handler@2.5.0':
-    dependencies:
-      '@smithy/protocol-http': 3.3.0
-      '@smithy/querystring-builder': 2.2.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-base64': 2.3.0
-      tslib: 2.8.1
-
-  '@smithy/fetch-http-handler@5.1.1':
-    dependencies:
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/querystring-builder': 4.0.5
-      '@smithy/types': 4.3.2
-      '@smithy/util-base64': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/fetch-http-handler@5.3.4':
-    dependencies:
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/querystring-builder': 4.2.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-base64': 4.3.0
-      tslib: 2.8.1
-
-  '@smithy/hash-blob-browser@4.0.5':
-    dependencies:
-      '@smithy/chunked-blob-reader': 5.0.0
-      '@smithy/chunked-blob-reader-native': 4.0.0
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/hash-node@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      '@smithy/util-buffer-from': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      tslib: 2.8.1
-
-  '@smithy/hash-node@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      '@smithy/util-buffer-from': 4.0.0
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/hash-node@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      '@smithy/util-buffer-from': 4.2.0
-      '@smithy/util-utf8': 4.2.0
-      tslib: 2.8.1
-
-  '@smithy/hash-stream-node@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/invalid-dependency@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/invalid-dependency@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/invalid-dependency@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/is-array-buffer@2.2.0':
-    dependencies:
-      tslib: 2.8.1
-
-  '@smithy/is-array-buffer@4.0.0':
-    dependencies:
-      tslib: 2.8.1
-
-  '@smithy/is-array-buffer@4.2.0':
-    dependencies:
-      tslib: 2.8.1
-
-  '@smithy/md5-js@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-content-length@2.2.0':
-    dependencies:
-      '@smithy/protocol-http': 3.3.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-content-length@4.0.5':
-    dependencies:
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/middleware-content-length@4.2.3':
-    dependencies:
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-endpoint@2.5.1':
-    dependencies:
-      '@smithy/middleware-serde': 2.3.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      '@smithy/url-parser': 2.2.0
-      '@smithy/util-middleware': 2.2.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-endpoint@4.1.18':
-    dependencies:
-      '@smithy/core': 3.8.0
-      '@smithy/middleware-serde': 4.0.9
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
-      '@smithy/url-parser': 4.0.5
-      '@smithy/util-middleware': 4.0.5
-      tslib: 2.8.1
-
-  '@smithy/middleware-endpoint@4.3.5':
-    dependencies:
-      '@smithy/core': 3.17.1
-      '@smithy/middleware-serde': 4.2.3
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/shared-ini-file-loader': 4.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/url-parser': 4.2.3
-      '@smithy/util-middleware': 4.2.3
-      tslib: 2.8.1
-
-  '@smithy/middleware-retry@2.3.1':
-    dependencies:
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/protocol-http': 3.3.0
-      '@smithy/service-error-classification': 2.1.5
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      '@smithy/util-middleware': 2.2.0
-      '@smithy/util-retry': 2.2.0
-      tslib: 2.8.1
-      uuid: 9.0.1
-
-  '@smithy/middleware-retry@4.1.19':
-    dependencies:
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/service-error-classification': 4.0.7
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-retry': 4.0.7
-      '@types/uuid': 9.0.8
-      tslib: 2.8.1
-      uuid: 9.0.1
-
-  '@smithy/middleware-retry@4.4.5':
-    dependencies:
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/service-error-classification': 4.2.3
-      '@smithy/smithy-client': 4.9.1
-      '@smithy/types': 4.8.0
-      '@smithy/util-middleware': 4.2.3
-      '@smithy/util-retry': 4.2.3
-      '@smithy/uuid': 1.1.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-serde@2.3.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-serde@4.0.9':
-    dependencies:
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/middleware-serde@4.2.3':
-    dependencies:
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-stack@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/middleware-stack@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/middleware-stack@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/node-config-provider@2.3.0':
-    dependencies:
-      '@smithy/property-provider': 2.2.0
-      '@smithy/shared-ini-file-loader': 2.4.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/node-config-provider@4.1.4':
-    dependencies:
-      '@smithy/property-provider': 4.0.5
-      '@smithy/shared-ini-file-loader': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/node-config-provider@4.3.3':
-    dependencies:
-      '@smithy/property-provider': 4.2.3
-      '@smithy/shared-ini-file-loader': 4.3.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/node-http-handler@2.5.0':
-    dependencies:
-      '@smithy/abort-controller': 2.2.0
-      '@smithy/protocol-http': 3.3.0
-      '@smithy/querystring-builder': 2.2.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/node-http-handler@4.1.1':
-    dependencies:
-      '@smithy/abort-controller': 4.0.5
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/querystring-builder': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/node-http-handler@4.4.3':
-    dependencies:
-      '@smithy/abort-controller': 4.2.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/querystring-builder': 4.2.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/property-provider@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/property-provider@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/property-provider@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/protocol-http@2.0.5':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/protocol-http@3.3.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/protocol-http@5.1.3':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/protocol-http@5.3.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
-
-  '@smithy/querystring-builder@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      '@smithy/util-uri-escape': 2.2.0
-      tslib: 2.8.1
-
-  '@smithy/querystring-builder@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      '@smithy/util-uri-escape': 4.0.0
-      tslib: 2.8.1
-
-  '@smithy/querystring-builder@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
-      '@smithy/util-uri-escape': 4.2.0
-      tslib: 2.8.1
-
-  '@smithy/querystring-parser@2.2.0':
-    dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/querystring-parser@4.0.5':
-    dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/querystring-parser@4.2.3':
-    dependencies:
-      '@smithy/types': 4.8.0
+      node-fetch: 2.7.0(encoding@0.1.13)
       tslib: 2.8.1
+    transitivePeerDependencies:
+      - encoding
 
-  '@smithy/service-error-classification@2.1.5':
+  '@sentry-internal/tracing@7.120.3':
     dependencies:
-      '@smithy/types': 2.12.0
+      '@sentry/core': 7.120.3
+      '@sentry/types': 7.120.3
+      '@sentry/utils': 7.120.3
 
-  '@smithy/service-error-classification@4.0.7':
+  '@sentry/core@6.19.7':
     dependencies:
-      '@smithy/types': 4.3.2
+      '@sentry/hub': 6.19.7
+      '@sentry/minimal': 6.19.7
+      '@sentry/types': 6.19.7
+      '@sentry/utils': 6.19.7
+      tslib: 1.14.1
 
-  '@smithy/service-error-classification@4.2.3':
+  '@sentry/core@7.120.3':
     dependencies:
-      '@smithy/types': 4.8.0
+      '@sentry/types': 7.120.3
+      '@sentry/utils': 7.120.3
 
-  '@smithy/shared-ini-file-loader@2.4.0':
+  '@sentry/hub@6.19.7':
     dependencies:
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
+      '@sentry/types': 6.19.7
+      '@sentry/utils': 6.19.7
+      tslib: 1.14.1
 
-  '@smithy/shared-ini-file-loader@4.0.5':
+  '@sentry/integrations@7.120.3':
     dependencies:
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
+      '@sentry/core': 7.120.3
+      '@sentry/types': 7.120.3
+      '@sentry/utils': 7.120.3
+      localforage: 1.10.0
 
-  '@smithy/shared-ini-file-loader@4.3.3':
+  '@sentry/minimal@6.19.7':
     dependencies:
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
+      '@sentry/hub': 6.19.7
+      '@sentry/types': 6.19.7
+      tslib: 1.14.1
 
-  '@smithy/signature-v4@2.3.0':
+  '@sentry/node@6.19.7':
     dependencies:
-      '@smithy/is-array-buffer': 2.2.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-hex-encoding': 2.2.0
-      '@smithy/util-middleware': 2.2.0
-      '@smithy/util-uri-escape': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      tslib: 2.8.1
+      '@sentry/core': 6.19.7
+      '@sentry/hub': 6.19.7
+      '@sentry/types': 6.19.7
+      '@sentry/utils': 6.19.7
+      cookie: 0.4.2
+      https-proxy-agent: 5.0.1
+      lru_map: 0.3.3
+      tslib: 1.14.1
+    transitivePeerDependencies:
+      - supports-color
 
-  '@smithy/signature-v4@5.1.3':
+  '@sentry/node@7.120.3':
     dependencies:
-      '@smithy/is-array-buffer': 4.0.0
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      '@smithy/util-hex-encoding': 4.0.0
-      '@smithy/util-middleware': 4.0.5
-      '@smithy/util-uri-escape': 4.0.0
-      '@smithy/util-utf8': 4.0.0
-      tslib: 2.8.1
+      '@sentry-internal/tracing': 7.120.3
+      '@sentry/core': 7.120.3
+      '@sentry/integrations': 7.120.3
+      '@sentry/types': 7.120.3
+      '@sentry/utils': 7.120.3
 
-  '@smithy/signature-v4@5.3.3':
-    dependencies:
-      '@smithy/is-array-buffer': 4.2.0
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-hex-encoding': 4.2.0
-      '@smithy/util-middleware': 4.2.3
-      '@smithy/util-uri-escape': 4.2.0
-      '@smithy/util-utf8': 4.2.0
-      tslib: 2.8.1
+  '@sentry/types@6.19.7': {}
 
-  '@smithy/smithy-client@2.5.1':
-    dependencies:
-      '@smithy/middleware-endpoint': 2.5.1
-      '@smithy/middleware-stack': 2.2.0
-      '@smithy/protocol-http': 3.3.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-stream': 2.2.0
-      tslib: 2.8.1
+  '@sentry/types@7.120.3': {}
 
-  '@smithy/smithy-client@4.4.10':
+  '@sentry/utils@6.19.7':
     dependencies:
-      '@smithy/core': 3.8.0
-      '@smithy/middleware-endpoint': 4.1.18
-      '@smithy/middleware-stack': 4.0.5
-      '@smithy/protocol-http': 5.1.3
-      '@smithy/types': 4.3.2
-      '@smithy/util-stream': 4.2.4
-      tslib: 2.8.1
+      '@sentry/types': 6.19.7
+      tslib: 1.14.1
 
-  '@smithy/smithy-client@4.9.1':
+  '@sentry/utils@7.120.3':
     dependencies:
-      '@smithy/core': 3.17.1
-      '@smithy/middleware-endpoint': 4.3.5
-      '@smithy/middleware-stack': 4.2.3
-      '@smithy/protocol-http': 5.3.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-stream': 4.5.4
-      tslib: 2.8.1
+      '@sentry/types': 7.120.3
 
-  '@smithy/types@2.12.0':
-    dependencies:
-      tslib: 2.8.1
+  '@sinclair/typebox@0.27.8': {}
 
-  '@smithy/types@4.3.2':
-    dependencies:
-      tslib: 2.8.1
+  '@sindresorhus/is@4.6.0': {}
 
-  '@smithy/types@4.8.0':
-    dependencies:
-      tslib: 2.8.1
+  '@sindresorhus/is@7.0.2': {}
 
-  '@smithy/url-parser@2.2.0':
-    dependencies:
-      '@smithy/querystring-parser': 2.2.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
+  '@sindresorhus/merge-streams@2.3.0': {}
 
-  '@smithy/url-parser@4.0.5':
-    dependencies:
-      '@smithy/querystring-parser': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
+  '@sindresorhus/merge-streams@4.0.0': {}
 
-  '@smithy/url-parser@4.2.3':
+  '@sinonjs/commons@3.0.1':
     dependencies:
-      '@smithy/querystring-parser': 4.2.3
-      '@smithy/types': 4.8.0
-      tslib: 2.8.1
+      type-detect: 4.0.8
 
-  '@smithy/util-base64@2.3.0':
+  '@sinonjs/fake-timers@10.3.0':
     dependencies:
-      '@smithy/util-buffer-from': 2.2.0
-      '@smithy/util-utf8': 2.3.0
-      tslib: 2.8.1
+      '@sinonjs/commons': 3.0.1
 
-  '@smithy/util-base64@4.0.0':
+  '@smithy/config-resolver@4.6.6':
     dependencies:
-      '@smithy/util-buffer-from': 4.0.0
-      '@smithy/util-utf8': 4.0.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-base64@4.3.0':
+  '@smithy/core@3.29.1':
     dependencies:
-      '@smithy/util-buffer-from': 4.2.0
-      '@smithy/util-utf8': 4.2.0
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-browser@2.2.0':
+  '@smithy/credential-provider-imds@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-browser@4.0.0':
+  '@smithy/eventstream-serde-browser@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-browser@4.2.0':
+  '@smithy/eventstream-serde-config-resolver@4.5.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-node@2.3.0':
+  '@smithy/eventstream-serde-node@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-node@4.0.0':
+  '@smithy/fetch-http-handler@5.6.3':
     dependencies:
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-body-length-node@4.2.1':
+  '@smithy/hash-blob-browser@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-buffer-from@2.2.0':
+  '@smithy/hash-node@4.4.6':
     dependencies:
-      '@smithy/is-array-buffer': 2.2.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-buffer-from@4.0.0':
+  '@smithy/hash-stream-node@4.4.6':
     dependencies:
-      '@smithy/is-array-buffer': 4.0.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-buffer-from@4.2.0':
+  '@smithy/invalid-dependency@4.4.6':
     dependencies:
-      '@smithy/is-array-buffer': 4.2.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-config-provider@2.3.0':
+  '@smithy/is-array-buffer@2.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-config-provider@4.0.0':
+  '@smithy/is-array-buffer@4.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-config-provider@4.2.0':
+  '@smithy/md5-js@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-browser@2.2.1':
+  '@smithy/middleware-content-length@4.4.6':
     dependencies:
-      '@smithy/property-provider': 2.2.0
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
-      bowser: 2.12.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-browser@4.0.26':
+  '@smithy/middleware-endpoint@4.6.6':
     dependencies:
-      '@smithy/property-provider': 4.0.5
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
-      bowser: 2.12.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-browser@4.3.4':
+  '@smithy/middleware-retry@4.7.6':
     dependencies:
-      '@smithy/property-provider': 4.2.3
-      '@smithy/smithy-client': 4.9.1
-      '@smithy/types': 4.8.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-node@2.3.1':
+  '@smithy/middleware-serde@4.4.6':
     dependencies:
-      '@smithy/config-resolver': 2.2.0
-      '@smithy/credential-provider-imds': 2.3.0
-      '@smithy/node-config-provider': 2.3.0
-      '@smithy/property-provider': 2.2.0
-      '@smithy/smithy-client': 2.5.1
-      '@smithy/types': 2.12.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-node@4.0.26':
+  '@smithy/middleware-stack@4.4.6':
     dependencies:
-      '@smithy/config-resolver': 4.1.5
-      '@smithy/credential-provider-imds': 4.0.7
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/property-provider': 4.0.5
-      '@smithy/smithy-client': 4.4.10
-      '@smithy/types': 4.3.2
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-node@4.2.6':
+  '@smithy/node-config-provider@4.5.6':
     dependencies:
-      '@smithy/config-resolver': 4.4.0
-      '@smithy/credential-provider-imds': 4.2.3
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/property-provider': 4.2.3
-      '@smithy/smithy-client': 4.9.1
-      '@smithy/types': 4.8.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-endpoints@3.0.7':
+  '@smithy/node-http-handler@4.9.3':
     dependencies:
-      '@smithy/node-config-provider': 4.1.4
-      '@smithy/types': 4.3.2
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-endpoints@3.2.3':
+  '@smithy/protocol-http@5.5.6':
     dependencies:
-      '@smithy/node-config-provider': 4.3.3
-      '@smithy/types': 4.8.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-hex-encoding@2.2.0':
+  '@smithy/signature-v4@5.6.2':
     dependencies:
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-hex-encoding@4.0.0':
+  '@smithy/smithy-client@4.14.6':
     dependencies:
+      '@smithy/core': 3.29.1
+      '@smithy/types': 4.15.1
       tslib: 2.8.1
 
-  '@smithy/util-hex-encoding@4.2.0':
+  '@smithy/types@4.15.1':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-middleware@2.2.0':
+  '@smithy/url-parser@4.4.6':
     dependencies:
-      '@smithy/types': 2.12.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-middleware@4.0.5':
+  '@smithy/util-base64@4.3.0':
     dependencies:
-      '@smithy/types': 4.3.2
+      '@smithy/util-buffer-from': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-middleware@4.2.3':
+  '@smithy/util-body-length-browser@4.2.0':
     dependencies:
-      '@smithy/types': 4.8.0
       tslib: 2.8.1
 
-  '@smithy/util-retry@2.2.0':
+  '@smithy/util-body-length-node@4.2.1':
     dependencies:
-      '@smithy/service-error-classification': 2.1.5
-      '@smithy/types': 2.12.0
       tslib: 2.8.1
 
-  '@smithy/util-retry@4.0.7':
+  '@smithy/util-buffer-from@2.2.0':
     dependencies:
-      '@smithy/service-error-classification': 4.0.7
-      '@smithy/types': 4.3.2
+      '@smithy/is-array-buffer': 2.2.0
       tslib: 2.8.1
 
-  '@smithy/util-retry@4.2.3':
+  '@smithy/util-buffer-from@4.2.0':
     dependencies:
-      '@smithy/service-error-classification': 4.2.3
-      '@smithy/types': 4.8.0
+      '@smithy/is-array-buffer': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-stream@2.2.0':
+  '@smithy/util-defaults-mode-browser@4.5.6':
     dependencies:
-      '@smithy/fetch-http-handler': 2.5.0
-      '@smithy/node-http-handler': 2.5.0
-      '@smithy/types': 2.12.0
-      '@smithy/util-base64': 2.3.0
-      '@smithy/util-buffer-from': 2.2.0
-      '@smithy/util-hex-encoding': 2.2.0
-      '@smithy/util-utf8': 2.3.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-stream@4.2.4':
+  '@smithy/util-defaults-mode-node@4.4.6':
     dependencies:
-      '@smithy/fetch-http-handler': 5.1.1
-      '@smithy/node-http-handler': 4.1.1
-      '@smithy/types': 4.3.2
-      '@smithy/util-base64': 4.0.0
-      '@smithy/util-buffer-from': 4.0.0
-      '@smithy/util-hex-encoding': 4.0.0
-      '@smithy/util-utf8': 4.0.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-stream@4.5.4':
+  '@smithy/util-endpoints@3.6.6':
     dependencies:
-      '@smithy/fetch-http-handler': 5.3.4
-      '@smithy/node-http-handler': 4.4.3
-      '@smithy/types': 4.8.0
-      '@smithy/util-base64': 4.3.0
-      '@smithy/util-buffer-from': 4.2.0
-      '@smithy/util-hex-encoding': 4.2.0
-      '@smithy/util-utf8': 4.2.0
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-uri-escape@2.2.0':
+  '@smithy/util-middleware@4.4.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-uri-escape@4.0.0':
+  '@smithy/util-retry@4.5.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
-  '@smithy/util-uri-escape@4.2.0':
+  '@smithy/util-stream@4.7.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
   '@smithy/util-utf8@2.3.0':
@@ -16110,30 +14695,14 @@ snapshots:
       '@smithy/util-buffer-from': 2.2.0
       tslib: 2.8.1
 
-  '@smithy/util-utf8@4.0.0':
-    dependencies:
-      '@smithy/util-buffer-from': 4.0.0
-      tslib: 2.8.1
-
   '@smithy/util-utf8@4.2.0':
     dependencies:
       '@smithy/util-buffer-from': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-waiter@2.2.0':
-    dependencies:
-      '@smithy/abort-controller': 2.2.0
-      '@smithy/types': 2.12.0
-      tslib: 2.8.1
-
-  '@smithy/util-waiter@4.0.7':
-    dependencies:
-      '@smithy/abort-controller': 4.0.5
-      '@smithy/types': 4.3.2
-      tslib: 2.8.1
-
-  '@smithy/uuid@1.1.0':
+  '@smithy/util-waiter@4.5.6':
     dependencies:
+      '@smithy/core': 3.29.1
       tslib: 2.8.1
 
   '@speed-highlight/core@1.2.7': {}
@@ -16446,11 +15015,6 @@ snapshots:
 
   '@types/parse-json@4.0.2': {}
 
-  '@types/prompts@2.4.9':
-    dependencies:
-      '@types/node': 22.15.30
-      kleur: 3.0.3
-
   '@types/react-dom@19.2.3(@types/react@19.2.7)':
     dependencies:
       '@types/react': 19.2.7
@@ -16488,8 +15052,6 @@ snapshots:
 
   '@types/uuid@10.0.0': {}
 
-  '@types/uuid@9.0.8': {}
-
   '@types/yargs-parser@21.0.3': {}
 
   '@types/yargs@17.0.32':
@@ -16556,7 +15118,7 @@ snapshots:
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.7.2
+      semver: 7.7.4
       ts-api-utils: 2.1.0(typescript@5.8.3)
       typescript: 5.8.3
     transitivePeerDependencies:
@@ -16788,11 +15350,11 @@ snapshots:
       svelte: 5.1.15
       vue: 3.5.16(typescript@5.8.3)
 
-  '@vercel/functions@2.2.12(@aws-sdk/credential-provider-web-identity@3.864.0)':
+  '@vercel/functions@2.2.12(@aws-sdk/credential-provider-web-identity@3.972.59)':
     dependencies:
       '@vercel/oidc': 2.0.1
     optionalDependencies:
-      '@aws-sdk/credential-provider-web-identity': 3.864.0
+      '@aws-sdk/credential-provider-web-identity': 3.972.59
 
   '@vercel/oidc@2.0.1':
     dependencies:
@@ -17013,10 +15575,6 @@ snapshots:
     dependencies:
       type-fest: 0.21.3
 
-  ansi-escapes@7.0.0:
-    dependencies:
-      environment: 1.1.0
-
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.1.0: {}
@@ -17073,6 +15631,8 @@ snapshots:
       get-intrinsic: 1.3.0
       is-string: 1.1.1
 
+  array-timsort@1.0.3: {}
+
   array-union@2.1.0: {}
 
   array.prototype.findlast@1.2.5:
@@ -17211,7 +15771,7 @@ snapshots:
 
   babel-plugin-macros@3.1.0:
     dependencies:
-      '@babel/runtime': 7.26.7
+      '@babel/runtime': 7.29.7
       cosmiconfig: 7.1.0
       resolve: 1.22.10
 
@@ -17239,6 +15799,8 @@ snapshots:
 
   balanced-match@1.0.2: {}
 
+  balanced-match@4.0.4: {}
+
   bare-events@2.5.4:
     optional: true
 
@@ -17284,24 +15846,22 @@ snapshots:
 
   blake3-wasm@2.1.5: {}
 
-  body-parser@2.2.0:
+  body-parser@2.3.0:
     dependencies:
       bytes: 3.1.2
-      content-type: 1.0.5
+      content-type: 2.0.0
       debug: 4.4.3
-      http-errors: 2.0.0
-      iconv-lite: 0.6.3
+      http-errors: 2.0.1
+      iconv-lite: 0.7.2
       on-finished: 2.4.1
-      qs: 6.14.0
-      raw-body: 3.0.0
-      type-is: 2.0.1
+      qs: 6.15.3
+      raw-body: 3.0.2
+      type-is: 2.1.0
     transitivePeerDependencies:
       - supports-color
 
   boolbase@1.0.0: {}
 
-  bowser@2.12.0: {}
-
   bowser@2.12.1: {}
 
   brace-expansion@1.1.11:
@@ -17313,6 +15873,10 @@ snapshots:
     dependencies:
       balanced-match: 1.0.2
 
+  brace-expansion@5.0.7:
+    dependencies:
+      balanced-match: 4.0.4
+
   braces@3.0.3:
     dependencies:
       fill-range: 7.1.1
@@ -17372,13 +15936,13 @@ snapshots:
     optionalDependencies:
       magicast: 0.3.5
 
-  c15t@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.8)(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2):
+  c15t@1.8.2(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@types/react@19.2.7)(@upstash/redis@1.35.0)(crossws@0.3.5)(immer@11.1.15)(react@19.1.7)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(use-sync-external-store@1.6.0(react@19.1.7))(ws@8.18.2):
     dependencies:
       '@c15t/backend': 1.8.0(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@upstash/redis@1.35.0)(crossws@0.3.5)(typeorm@0.3.27(babel-plugin-macros@3.1.0)(reflect-metadata@0.2.2)(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))(ws@8.18.2)
       '@c15t/translations': 1.8.0
       '@orpc/client': 1.8.1(@opentelemetry/api@1.9.0)
       '@orpc/server': 1.8.1(@opentelemetry/api@1.9.0)(crossws@0.3.5)(ws@8.18.2)
-      zustand: 5.0.8(@types/react@19.2.7)(immer@11.1.8)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7))
+      zustand: 5.0.8(@types/react@19.2.7)(immer@11.1.15)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7))
     transitivePeerDependencies:
       - '@aws-sdk/client-rds-data'
       - '@cloudflare/workers-types'
@@ -17476,6 +16040,8 @@ snapshots:
 
   chalk@5.4.1: {}
 
+  chalk@5.6.2: {}
+
   char-regex@1.0.2: {}
 
   chardet@0.7.0: {}
@@ -17521,7 +16087,7 @@ snapshots:
     dependencies:
       readdirp: 4.1.1
 
-  chownr@2.0.0: {}
+  chownr@3.0.0: {}
 
   chrome-launcher@1.2.0:
     dependencies:
@@ -17553,11 +16119,9 @@ snapshots:
 
   cjs-module-lexer@1.3.1: {}
 
-  cli-cursor@5.0.0:
+  class-variance-authority@0.7.1:
     dependencies:
-      restore-cursor: 5.1.0
-
-  cli-spinners@2.9.2: {}
+      clsx: 2.1.1
 
   cli-width@4.1.0: {}
 
@@ -17644,6 +16208,11 @@ snapshots:
 
   commander@7.2.0: {}
 
+  comment-json@4.6.2:
+    dependencies:
+      array-timsort: 1.0.3
+      esprima: 4.0.1
+
   comment-parser@1.4.1: {}
 
   compressible@2.0.18:
@@ -17675,7 +16244,7 @@ snapshots:
       dot-prop: 9.0.0
       env-paths: 3.0.0
       json-schema-typed: 8.0.1
-      semver: 7.7.2
+      semver: 7.7.4
       uint8array-extras: 1.4.0
 
   confbox@0.1.8: {}
@@ -17701,6 +16270,8 @@ snapshots:
 
   content-type@1.0.5: {}
 
+  content-type@2.0.0: {}
+
   convert-source-map@1.9.0: {}
 
   convert-source-map@2.0.0: {}
@@ -17711,8 +16282,6 @@ snapshots:
 
   cookie@0.4.2: {}
 
-  cookie@0.7.1: {}
-
   cookie@0.7.2: {}
 
   cookie@1.0.2: {}
@@ -17893,10 +16462,6 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
-  debug@4.3.6:
-    dependencies:
-      ms: 2.1.2
-
   debug@4.4.1:
     dependencies:
       ms: 2.1.3
@@ -18087,10 +16652,18 @@ snapshots:
 
   electron-to-chromium@1.5.165: {}
 
+  embla-carousel-autoplay@8.6.0(embla-carousel@8.6.0):
+    dependencies:
+      embla-carousel: 8.6.0
+
   embla-carousel-autoplay@9.0.0-rc01(embla-carousel@9.0.0-rc01):
     dependencies:
       embla-carousel: 9.0.0-rc01
 
+  embla-carousel-fade@8.6.0(embla-carousel@8.6.0):
+    dependencies:
+      embla-carousel: 8.6.0
+
   embla-carousel-fade@9.0.0-rc01(embla-carousel@9.0.0-rc01):
     dependencies:
       embla-carousel: 9.0.0-rc01
@@ -18105,6 +16678,8 @@ snapshots:
     dependencies:
       embla-carousel: 9.0.0-rc01
 
+  embla-carousel@8.6.0: {}
+
   embla-carousel@9.0.0-rc01: {}
 
   emittery@0.13.1: {}
@@ -18150,8 +16725,6 @@ snapshots:
 
   env-paths@3.0.0: {}
 
-  environment@1.1.0: {}
-
   error-ex@1.3.2:
     dependencies:
       is-arrayish: 0.2.1
@@ -18534,7 +17107,7 @@ snapshots:
       espree: 10.3.0
       esquery: 1.6.0
       parse-imports: 2.2.1
-      semver: 7.7.2
+      semver: 7.7.4
       spdx-expression-parse: 4.0.0
       synckit: 0.9.2
     transitivePeerDependencies:
@@ -18768,15 +17341,15 @@ snapshots:
       jest-message-util: 29.7.0
       jest-util: 29.7.0
 
-  express@5.0.1:
+  express@5.2.1:
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.2.0
+      body-parser: 2.3.0
       content-disposition: 1.0.0
       content-type: 1.0.5
-      cookie: 0.7.1
+      cookie: 0.7.2
       cookie-signature: 1.2.2
-      debug: 4.3.6
+      debug: 4.4.3
       depd: 2.0.0
       encodeurl: 2.0.0
       escape-html: 1.0.3
@@ -18785,22 +17358,18 @@ snapshots:
       fresh: 2.0.0
       http-errors: 2.0.0
       merge-descriptors: 2.0.0
-      methods: 1.1.2
       mime-types: 3.0.1
       on-finished: 2.4.1
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.13.0
+      qs: 6.14.0
       range-parser: 1.2.1
       router: 2.2.0
-      safe-buffer: 5.2.1
       send: 1.2.0
       serve-static: 2.2.0
-      setprototypeof: 1.2.0
       statuses: 2.0.1
       type-is: 2.0.1
-      utils-merge: 1.0.1
       vary: 1.1.2
     transitivePeerDependencies:
       - supports-color
@@ -18857,18 +17426,10 @@ snapshots:
 
   fast-uri@3.0.3: {}
 
-  fast-xml-parser@4.2.5:
-    dependencies:
-      strnum: 1.1.2
-
   fast-xml-parser@4.5.3:
     dependencies:
       strnum: 1.1.2
 
-  fast-xml-parser@5.2.5:
-    dependencies:
-      strnum: 2.1.1
-
   fastq@1.17.1:
     dependencies:
       reusify: 1.0.4
@@ -19020,10 +17581,6 @@ snapshots:
       jsonfile: 4.0.0
       universalify: 0.1.2
 
-  fs-minipass@2.1.0:
-    dependencies:
-      minipass: 3.3.6
-
   fs.realpath@1.0.0: {}
 
   fsevents@2.3.2:
@@ -19128,16 +17685,6 @@ snapshots:
       readable-stream: 3.6.2
       safe-buffer: 5.2.1
 
-  giget@1.2.5:
-    dependencies:
-      citty: 0.1.6
-      consola: 3.4.2
-      defu: 6.1.4
-      node-fetch-native: 1.6.6
-      nypm: 0.5.4
-      pathe: 2.0.3
-      tar: 6.2.1
-
   giget@2.0.0:
     dependencies:
       citty: 0.1.6
@@ -19166,11 +17713,11 @@ snapshots:
       package-json-from-dist: 1.0.1
       path-scurry: 1.11.1
 
-  glob@11.0.3:
+  glob@12.0.0:
     dependencies:
       foreground-child: 3.3.1
       jackspeak: 4.1.1
-      minimatch: 10.0.3
+      minimatch: 10.2.5
       minipass: 7.1.2
       package-json-from-dist: 1.0.1
       path-scurry: 2.0.0
@@ -19354,6 +17901,14 @@ snapshots:
       statuses: 2.0.1
       toidentifier: 1.0.1
 
+  http-errors@2.0.1:
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      toidentifier: 1.0.1
+
   http-link-header@1.1.3: {}
 
   http-proxy-agent@7.0.2:
@@ -19404,6 +17959,10 @@ snapshots:
     dependencies:
       safer-buffer: 2.1.2
 
+  iconv-lite@0.7.2:
+    dependencies:
+      safer-buffer: 2.1.2
+
   icu-minify@4.8.3:
     dependencies:
       '@formatjs/icu-messageformat-parser': 3.5.1
@@ -19418,11 +17977,11 @@ snapshots:
 
   immediate@3.0.6: {}
 
-  immer@11.1.8: {}
+  immer@11.1.15: {}
 
   immer@9.0.21: {}
 
-  immutable@4.3.8: {}
+  immutable@4.3.9: {}
 
   import-fresh@3.3.1:
     dependencies:
@@ -19521,7 +18080,7 @@ snapshots:
 
   is-bun-module@1.3.0:
     dependencies:
-      semver: 7.7.2
+      semver: 7.7.4
 
   is-callable@1.2.7: {}
 
@@ -19573,8 +18132,6 @@ snapshots:
     dependencies:
       is-docker: 3.0.0
 
-  is-interactive@2.0.0: {}
-
   is-map@2.0.3: {}
 
   is-node-process@1.2.0: {}
@@ -19644,8 +18201,6 @@ snapshots:
 
   is-typedarray@1.0.0: {}
 
-  is-unicode-supported@1.3.0: {}
-
   is-unicode-supported@2.1.0: {}
 
   is-weakmap@2.0.2: {}
@@ -20146,7 +18701,7 @@ snapshots:
 
   jpeg-js@0.4.4: {}
 
-  js-base64@3.7.8: {}
+  js-base64@3.9.1: {}
 
   js-library-detector@6.7.0: {}
 
@@ -20437,6 +18992,8 @@ snapshots:
       untun: 0.1.3
       uqr: 0.1.2
 
+  lite-youtube-embed@0.3.4: {}
+
   load-script@1.0.0: {}
 
   load-tsconfig@0.2.5: {}
@@ -20486,11 +19043,6 @@ snapshots:
 
   lodash@4.17.21: {}
 
-  log-symbols@6.0.0:
-    dependencies:
-      chalk: 5.4.1
-      is-unicode-supported: 1.3.0
-
   long@5.3.2: {}
 
   lookup-closest-locale@6.2.0: {}
@@ -20565,8 +19117,6 @@ snapshots:
 
   metaviewport-parser@0.3.0: {}
 
-  methods@1.1.2: {}
-
   micromatch@4.0.8:
     dependencies:
       braces: 3.0.3
@@ -20614,9 +19164,9 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  minimatch@10.0.3:
+  minimatch@10.2.5:
     dependencies:
-      '@isaacs/brace-expansion': 5.0.0
+      brace-expansion: 5.0.7
 
   minimatch@3.1.2:
     dependencies:
@@ -20632,20 +19182,13 @@ snapshots:
 
   minimist@1.2.8: {}
 
-  minipass@3.3.6:
-    dependencies:
-      yallist: 4.0.0
-
   minipass@4.2.8: {}
 
-  minipass@5.0.0: {}
-
   minipass@7.1.2: {}
 
-  minizlib@2.1.2:
+  minizlib@3.1.0:
     dependencies:
-      minipass: 3.3.6
-      yallist: 4.0.0
+      minipass: 7.1.2
 
   mitt@3.0.1: {}
 
@@ -20670,8 +19213,6 @@ snapshots:
 
   ms@2.0.0: {}
 
-  ms@2.1.2: {}
-
   ms@2.1.3: {}
 
   msw@2.9.0(@types/node@22.15.30)(typescript@5.8.3):
@@ -20855,6 +19396,8 @@ snapshots:
 
   object-inspect@1.13.3: {}
 
+  object-inspect@1.13.4: {}
+
   object-keys@0.4.0: {}
 
   object-keys@1.1.1: {}
@@ -20927,10 +19470,6 @@ snapshots:
     dependencies:
       mimic-fn: 4.0.0
 
-  onetime@7.0.0:
-    dependencies:
-      mimic-function: 5.0.1
-
   open@10.1.2:
     dependencies:
       default-browser: 5.2.1
@@ -20957,18 +19496,6 @@ snapshots:
       type-check: 0.4.0
       word-wrap: 1.2.5
 
-  ora@8.2.0:
-    dependencies:
-      chalk: 5.4.1
-      cli-cursor: 5.0.0
-      cli-spinners: 2.9.2
-      is-interactive: 2.0.0
-      is-unicode-supported: 2.1.0
-      log-symbols: 6.0.0
-      stdin-discarder: 0.2.2
-      string-width: 7.2.0
-      strip-ansi: 7.1.0
-
   os-tmpdir@1.0.2: {}
 
   ot-json0@1.1.0: {}
@@ -21148,7 +19675,7 @@ snapshots:
 
   polished@3.0.3:
     dependencies:
-      '@babel/runtime': 7.26.7
+      '@babel/runtime': 7.29.7
 
   possible-typed-array-names@1.0.0: {}
 
@@ -21569,13 +20096,14 @@ snapshots:
 
   pure-rand@6.1.0: {}
 
-  qs@6.13.0:
+  qs@6.14.0:
     dependencies:
       side-channel: 1.1.0
 
-  qs@6.14.0:
+  qs@6.15.3:
     dependencies:
-      side-channel: 1.1.0
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
 
   quansync@0.2.10: {}
 
@@ -21595,11 +20123,11 @@ snapshots:
 
   range-parser@1.2.1: {}
 
-  raw-body@3.0.0:
+  raw-body@3.0.2:
     dependencies:
       bytes: 3.1.2
-      http-errors: 2.0.0
-      iconv-lite: 0.6.3
+      http-errors: 2.0.1
+      iconv-lite: 0.7.2
       unpipe: 1.0.0
 
   rc9@2.1.2:
@@ -21781,7 +20309,7 @@ snapshots:
 
   requires-port@1.0.0: {}
 
-  reselect@5.1.1: {}
+  reselect@5.2.0: {}
 
   resolve-alpn@1.2.1: {}
 
@@ -21813,11 +20341,6 @@ snapshots:
     dependencies:
       lowercase-keys: 2.0.0
 
-  restore-cursor@5.1.0:
-    dependencies:
-      onetime: 7.0.0
-      signal-exit: 4.1.0
-
   reusify@1.0.4: {}
 
   rimraf@3.0.2:
@@ -22071,6 +20594,11 @@ snapshots:
       es-errors: 1.3.0
       object-inspect: 1.13.3
 
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
   side-channel-map@1.0.1:
     dependencies:
       call-bound: 1.0.4
@@ -22094,6 +20622,14 @@ snapshots:
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
 
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
   siginfo@2.0.0: {}
 
   signal-exit@3.0.7: {}
@@ -22235,12 +20771,46 @@ snapshots:
 
   statuses@2.0.1: {}
 
-  std-env@3.9.0: {}
+  statuses@2.0.2: {}
 
-  stdin-discarder@0.2.2: {}
+  std-env@3.9.0: {}
 
   stoppable@1.1.0: {}
 
+  storefront-kit@0.24.0(2eea54938541e43338f6c40ea8e1cef3):
+    dependencies:
+      '@tailwindcss/container-queries': 0.1.1(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))
+      '@tailwindcss/typography': 0.5.16(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))
+      class-variance-authority: 0.7.1
+      clsx: 2.1.1
+      embla-carousel: 8.6.0
+      embla-carousel-autoplay: 8.6.0(embla-carousel@8.6.0)
+      embla-carousel-fade: 8.6.0(embla-carousel@8.6.0)
+      react: 19.1.7
+      react-dom: 19.1.7(react@19.1.7)
+      tailwind-merge: 3.6.0
+      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3))
+      tailwindcss-animate: 1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3)))
+    optionalDependencies:
+      '@base-ui/react': 1.6.0(@date-fns/tz@1.2.0)(@types/react@19.2.7)(date-fns@4.1.0)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-accordion': 1.2.11(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-checkbox': 1.3.2(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-dropdown-menu': 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-navigation-menu': 1.2.13(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-popover': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-radio-group': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-select': 2.2.5(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.7)(react@19.1.7)
+      '@radix-ui/react-toggle': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      '@radix-ui/react-toggle-group': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+      embla-carousel-react: 9.0.0-rc01(react@19.1.7)
+      lucide-react: 0.474.0(react@19.1.7)
+      react-day-picker: 9.7.0(react@19.1.7)
+      sonner: 1.7.4(react-dom@19.1.7(react@19.1.7))(react@19.1.7)
+
   streamx@2.22.1:
     dependencies:
       fast-fifo: 1.3.2
@@ -22363,8 +20933,6 @@ snapshots:
 
   strnum@1.1.2: {}
 
-  strnum@2.1.1: {}
-
   stubborn-fs@1.2.5: {}
 
   style-to-js@1.1.21:
@@ -22428,7 +20996,7 @@ snapshots:
       zimmerframe: 1.1.4
     optional: true
 
-  swr@2.4.1(react@19.1.7):
+  swr@2.4.2(react@19.1.7):
     dependencies:
       dequal: 2.0.3
       react: 19.1.7
@@ -22450,6 +21018,8 @@ snapshots:
 
   tagged-tag@1.0.0: {}
 
+  tailwind-merge@3.6.0: {}
+
   tailwindcss-animate@1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3))):
     dependencies:
       tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.15.18)(@types/node@22.15.30)(typescript@5.8.3))
@@ -22503,14 +21073,13 @@ snapshots:
       fast-fifo: 1.3.2
       streamx: 2.22.1
 
-  tar@6.2.1:
+  tar@7.5.19:
     dependencies:
-      chownr: 2.0.0
-      fs-minipass: 2.1.0
-      minipass: 5.0.0
-      minizlib: 2.1.2
-      mkdirp: 1.0.4
-      yallist: 4.0.0
+      '@isaacs/fs-minipass': 4.0.1
+      chownr: 3.0.0
+      minipass: 7.1.2
+      minizlib: 3.1.0
+      yallist: 5.0.0
 
   term-size@2.2.1: {}
 
@@ -22818,6 +21387,12 @@ snapshots:
       media-typer: 1.1.0
       mime-types: 3.0.1
 
+  type-is@2.1.0:
+    dependencies:
+      content-type: 2.0.0
+      media-typer: 1.1.0
+      mime-types: 3.0.1
+
   typed-array-buffer@1.0.3:
     dependencies:
       call-bound: 1.0.4
@@ -23031,6 +21606,8 @@ snapshots:
 
   urlpattern-polyfill@10.0.0: {}
 
+  urlpattern-polyfill@10.1.0: {}
+
   use-callback-ref@1.3.3(@types/react@19.2.7)(react@19.1.7):
     dependencies:
       react: 19.1.7
@@ -23062,8 +21639,6 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
-  utils-merge@1.0.1: {}
-
   uuid@11.1.0: {}
 
   uuid@9.0.1: {}
@@ -23376,7 +21951,7 @@ snapshots:
 
   yallist@3.1.1: {}
 
-  yallist@4.0.0: {}
+  yallist@5.0.0: {}
 
   yaml@1.10.3: {}
 
@@ -23441,10 +22016,6 @@ snapshots:
   zimmerframe@1.1.4:
     optional: true
 
-  zod-validation-error@3.4.1(zod@3.25.51):
-    dependencies:
-      zod: 3.25.51
-
   zod@3.22.3: {}
 
   zod@3.23.8: {}
@@ -23455,9 +22026,9 @@ snapshots:
 
   zod@4.1.12: {}
 
-  zustand@5.0.8(@types/react@19.2.7)(immer@11.1.8)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7)):
+  zustand@5.0.8(@types/react@19.2.7)(immer@11.1.15)(react@19.1.7)(use-sync-external-store@1.6.0(react@19.1.7)):
     optionalDependencies:
       '@types/react': 19.2.7
-      immer: 11.1.8
+      immer: 11.1.15
       react: 19.1.7
       use-sync-external-store: 1.6.0(react@19.1.7)