@fluid-app/fluid-cli-portal 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2230 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { dirname, join } from "node:path";
+import { copyFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import prompts from "prompts";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import Handlebars from "handlebars";
+import { execa } from "execa";
+import fs from "fs-extra";
+import path from "path";
+import { config } from "dotenv";
+//#region src/types.ts
+/**
+* Available project templates
+*/
+const TEMPLATES = {
+	starter: "starter",
+	fullstack: "fullstack"
+};
+/**
+* Type guard to check if a string is a valid template name
+*/
+function isTemplateName(value) {
+	return Object.values(TEMPLATES).includes(value);
+}
+//#endregion
+//#region src/utils/prompts.ts
+/**
+* Available optional page templates that can be selected during project creation.
+* Core pages (Messaging, Contacts, CRM) are always included automatically.
+*/
+const OPTIONAL_PAGE_TEMPLATES = [];
+/**
+* Prompts the user for project configuration
+* Pre-fills values from CLI options when provided
+*/
+async function promptProjectConfig(projectName, options) {
+	const questions = [];
+	if (!options.template) questions.push({
+		type: "select",
+		name: "template",
+		message: "Select a project template",
+		choices: [{
+			title: "Starter",
+			value: TEMPLATES.starter,
+			description: "Frontend-only (React + Vite + Tailwind + portal-sdk)"
+		}, {
+			title: "Fullstack",
+			value: TEMPLATES.fullstack,
+			description: "Frontend + API server (Hono + Drizzle + SQLite)"
+		}]
+	});
+	if (OPTIONAL_PAGE_TEMPLATES.length > 0) questions.push({
+		type: "multiselect",
+		name: "selectedPages",
+		message: "Select additional page templates to include",
+		instructions: "\n  Space to select, Enter to confirm. Core pages (Messaging, Contacts, CRM) are always included.",
+		choices: OPTIONAL_PAGE_TEMPLATES.map((page) => ({
+			title: page.name,
+			value: {
+				id: page.id,
+				slug: page.slug,
+				name: page.name
+			},
+			description: page.description
+		}))
+	});
+	if (!options.skipInstall) questions.push({
+		type: "confirm",
+		name: "installDeps",
+		message: "Install dependencies?",
+		initial: true
+	});
+	if (questions.length === 0) {
+		const templateRaw = options.template;
+		return {
+			name: projectName,
+			template: isTemplateName(templateRaw ?? "") ? templateRaw : TEMPLATES.starter,
+			installDeps: options.skipInstall ? false : true,
+			selectedPages: []
+		};
+	}
+	let cancelled = false;
+	const response = await prompts(questions, { onCancel: () => {
+		cancelled = true;
+		return false;
+	} });
+	if (cancelled) return null;
+	const templateRaw = options.template ?? response.template;
+	const template = isTemplateName(templateRaw) ? templateRaw : TEMPLATES.starter;
+	const selectedPages = response.selectedPages ?? [];
+	return {
+		name: projectName,
+		template,
+		installDeps: options.skipInstall ? false : response.installDeps ?? true,
+		selectedPages
+	};
+}
+//#endregion
+//#region src/utils/result.ts
+/**
+* Create a successful result
+*/
+function success(value) {
+	return {
+		success: true,
+		value
+	};
+}
+/**
+* Create a failed result
+*/
+function failure(error) {
+	return {
+		success: false,
+		error
+	};
+}
+/**
+* Type guard for successful results
+*/
+function isSuccess(result) {
+	return result.success === true;
+}
+/**
+* Type guard for failed results
+*/
+function isFailure(result) {
+	return result.success === false;
+}
+/**
+* Wrap a function that may throw into a Result-returning function
+*/
+function tryCatch(fn) {
+	try {
+		return success(fn());
+	} catch (error) {
+		return failure(error instanceof Error ? error : new Error(String(error)));
+	}
+}
+/**
+* Wrap an async function that may throw into a Result-returning function
+*/
+async function tryCatchAsync(fn) {
+	try {
+		return success(await fn());
+	} catch (error) {
+		return failure(error instanceof Error ? error : new Error(String(error)));
+	}
+}
+/**
+* Extract value from Result or throw error
+* Use sparingly - prefer pattern matching with isSuccess/isFailure
+*/
+function unwrap(result) {
+	if (isSuccess(result)) return result.value;
+	throw result.error;
+}
+/**
+* Extract value from Result or return a default value
+*/
+function unwrapOr(result, defaultValue) {
+	if (isSuccess(result)) return result.value;
+	return defaultValue;
+}
+/**
+* Map over a successful Result value
+*/
+function mapResult(result, fn) {
+	if (isSuccess(result)) return success(fn(result.value));
+	return result;
+}
+/**
+* Map over a failed Result error
+*/
+function mapError(result, fn) {
+	if (isFailure(result)) return failure(fn(result.error));
+	return result;
+}
+/**
+* Type guard to check if a value is an Error instance
+*
+* @example
+* ```ts
+* catch (error) {
+*   if (isError(error)) {
+*     console.log(error.message); // TypeScript knows this is an Error
+*   }
+* }
+* ```
+*/
+function isError(value) {
+	return value instanceof Error;
+}
+/**
+* Type guard for Node.js system errors (with `code` property)
+*
+* @example
+* ```ts
+* catch (error) {
+*   if (isNodeError(error) && error.code === "ENOENT") {
+*     console.log("File not found");
+*   }
+* }
+* ```
+*/
+function isNodeError(value) {
+	return value instanceof Error && "code" in value;
+}
+/**
+* Extract error message safely from unknown catch parameter.
+* Prefer type guards (isError, isNodeError) when you need the full error object.
+*
+* @example
+* ```ts
+* catch (error) {
+*   console.log("Error: " + getErrorMessage(error));
+* }
+* ```
+*/
+function getErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	return String(error);
+}
+//#endregion
+//#region src/utils/file-system.ts
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+* Find the package root by walking up from __dirname to the nearest package.json.
+* Works whether running from dist/ (bundled) or src/utils/ (tsx dev mode).
+*/
+function findPackageRoot() {
+	let dir = __dirname;
+	while (!existsSync(join(dir, "package.json"))) {
+		const parent = dirname(dir);
+		if (parent === dir) throw new Error("Could not find package root");
+		dir = parent;
+	}
+	return dir;
+}
+/**
+* Error types for file system operations
+*/
+const FILE_SYSTEM_ERRORS = {
+	directoryNotFound: "DIRECTORY_NOT_FOUND",
+	fileNotFound: "FILE_NOT_FOUND",
+	readError: "READ_ERROR",
+	writeError: "WRITE_ERROR",
+	templateError: "TEMPLATE_ERROR"
+};
+/**
+* Create a file system error
+*/
+function createFsError(code, message, path, cause) {
+	return {
+		code,
+		message,
+		path,
+		cause
+	};
+}
+/**
+* Gets paths for the base + overlay template system.
+*
+* The create command copies `base` first, then the `overlay` on top.
+* Any overlay file with the same relative path overwrites the base version.
+*/
+function getTemplatePaths(templateName) {
+	const templatesDir = join(findPackageRoot(), "templates");
+	return {
+		base: join(templatesDir, "base"),
+		overlay: join(templatesDir, templateName)
+	};
+}
+/**
+* Gets all files in a directory recursively
+*/
+async function getFiles(dir, baseDir = dir) {
+	const entries = await readdir(dir, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		const fullPath = join(dir, entry.name);
+		if (entry.isDirectory()) files.push(...await getFiles(fullPath, baseDir));
+		else files.push(fullPath.slice(baseDir.length + 1));
+	}
+	return files;
+}
+/**
+* Processes a template file with Handlebars
+* Files ending in .template have the extension removed and content processed
+* Other files are copied as-is
+*/
+function processTemplate(content, variables, isTemplate, filePath) {
+	if (!isTemplate) return content;
+	try {
+		return Handlebars.compile(content)(variables);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Template processing failed${filePath ? ` for ${filePath}` : ""}: ${message}`);
+	}
+}
+/**
+* Gets the output filename for a template file
+* Removes .template extension if present
+*/
+function getOutputFilename(filename) {
+	if (filename.endsWith(".template")) return filename.slice(0, -9);
+	return filename;
+}
+/**
+* Copies a template directory to the target directory
+* Processes .template files with Handlebars
+*/
+async function copyTemplate(templatePath, targetPath, variables) {
+	const files = await getFiles(templatePath);
+	for (const file of files) {
+		const sourcePath = join(templatePath, file);
+		const isTemplate = file.endsWith(".template");
+		const destPath = join(targetPath, getOutputFilename(file));
+		await mkdir(dirname(destPath), { recursive: true });
+		await writeFile(destPath, processTemplate(await readFile(sourcePath, "utf-8"), variables, isTemplate, sourcePath), "utf-8");
+	}
+}
+/**
+* Checks if a directory exists
+*/
+async function directoryExists(path) {
+	try {
+		return (await stat(path)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
+* Checks if a file exists
+*/
+async function fileExists(path) {
+	try {
+		return (await stat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Checks if a path exists (file or directory)
+*/
+async function pathExists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Creates a directory
+*/
+async function createDirectory(path) {
+	await mkdir(path, { recursive: true });
+}
+/**
+* Reads the SDK version from the workspace package.json
+* Falls back to ^0.1.0 if not found
+*/
+async function getSdkVersion() {
+	try {
+		const content = await readFile(join(join(findPackageRoot(), "..", ".."), "portal", "sdk", "package.json"), "utf-8");
+		return `^${JSON.parse(content).version ?? "0.1.0"}`;
+	} catch {
+		return "^0.1.0";
+	}
+}
+/**
+* Read a file's content with Result-based error handling
+*/
+async function readFileSafe(path) {
+	try {
+		return success(await readFile(path, "utf-8"));
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		return failure(createFsError(FILE_SYSTEM_ERRORS.readError, `Failed to read file: ${path}`, path, error));
+	}
+}
+/**
+* Write content to a file with Result-based error handling
+*/
+async function writeFileSafe(path, content) {
+	try {
+		await writeFile(path, content, "utf-8");
+		return success(void 0);
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		return failure(createFsError(FILE_SYSTEM_ERRORS.writeError, `Failed to write file: ${path}`, path, error));
+	}
+}
+/**
+* Create a directory with Result-based error handling
+*/
+async function createDirectorySafe(path) {
+	try {
+		await mkdir(path, { recursive: true });
+		return success(void 0);
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		return failure(createFsError(FILE_SYSTEM_ERRORS.writeError, `Failed to create directory: ${path}`, path, error));
+	}
+}
+/**
+* Copy a template directory with Result-based error handling
+*/
+async function copyTemplateSafe(templatePath, targetPath, variables) {
+	try {
+		const files = await getFiles(templatePath);
+		for (const file of files) {
+			const sourcePath = join(templatePath, file);
+			const isTemplateFile = file.endsWith(".template");
+			const destPath = join(targetPath, getOutputFilename(file));
+			await mkdir(dirname(destPath), { recursive: true });
+			await writeFile(destPath, processTemplate(await readFile(sourcePath, "utf-8"), variables, isTemplateFile, sourcePath), "utf-8");
+		}
+		return success(void 0);
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		return failure(createFsError(FILE_SYSTEM_ERRORS.templateError, `Failed to copy template from ${templatePath} to ${targetPath}`, templatePath, error));
+	}
+}
+/**
+* Get SDK version with Result-based error handling
+* Unlike getSdkVersion, this returns an error instead of a fallback
+*/
+async function getSdkVersionSafe() {
+	try {
+		const sdkPackagePath = join(join(findPackageRoot(), "..", ".."), "portal", "sdk", "package.json");
+		const content = await readFile(sdkPackagePath, "utf-8");
+		const version = JSON.parse(content).version;
+		if (version === void 0) return failure(createFsError(FILE_SYSTEM_ERRORS.readError, "SDK package.json does not contain a version field", sdkPackagePath));
+		return success(`^${version}`);
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		return failure(createFsError(FILE_SYSTEM_ERRORS.fileNotFound, "Could not find SDK package.json", void 0, error));
+	}
+}
+//#endregion
+//#region src/utils/package-manager.ts
+/**
+* Returns the install command for pnpm
+*/
+function getInstallCommand() {
+	return "pnpm install";
+}
+/**
+* Returns the run command for pnpm
+*/
+function getRunCommand(script) {
+	return `pnpm run ${script}`;
+}
+/**
+* Runs a pnpm command in the specified directory
+*/
+async function runPackageManager(args, cwd) {
+	await execa("pnpm", args, {
+		cwd,
+		stdio: "inherit"
+	});
+}
+/**
+* Installs dependencies using pnpm
+*/
+async function installDependencies(cwd) {
+	await runPackageManager(["install"], cwd);
+}
+//#endregion
+//#region src/commands/create.ts
+const createCommand = new Command("create").description("Create a new Fluid portal application").argument("<app-name>", "Name of the application to create").option("-t, --template <template>", "Project template (starter, fullstack)").option("--skip-install", "Skip dependency installation").action(async (appName, options) => {
+	try {
+		console.log();
+		console.log(chalk.bold("Creating a new Fluid portal application"));
+		console.log();
+		if (!/^[a-z0-9-]+$/.test(appName)) {
+			console.error(chalk.red("Error: App name must contain only lowercase letters, numbers, and hyphens"));
+			process.exit(1);
+		}
+		const targetPath = join(process.cwd(), appName);
+		if (await directoryExists(targetPath)) {
+			console.error(chalk.red(`Error: Directory "${appName}" already exists`));
+			process.exit(1);
+		}
+		const config = await promptProjectConfig(appName, options);
+		if (!config) {
+			console.log();
+			console.log(chalk.yellow("Cancelled"));
+			process.exit(0);
+		}
+		console.log();
+		const templatePaths = getTemplatePaths(config.template);
+		if (!await directoryExists(templatePaths.base)) {
+			console.error(chalk.red("Error: Base template not found"));
+			process.exit(1);
+		}
+		if (!await directoryExists(templatePaths.overlay)) {
+			console.error(chalk.red(`Error: Template "${config.template}" not found`));
+			process.exit(1);
+		}
+		const sdkVersion = await getSdkVersion();
+		const spinner = ora("Creating project directory...").start();
+		try {
+			await createDirectory(targetPath);
+			spinner.succeed("Created project directory");
+		} catch (error) {
+			spinner.fail("Failed to create project directory");
+			throw error;
+		}
+		const templateVariables = {
+			projectName: config.name,
+			sdkVersion,
+			selectedPages: config.selectedPages,
+			hasSelectedPages: config.selectedPages.length > 0
+		};
+		spinner.start("Copying template files...");
+		try {
+			await copyTemplate(templatePaths.base, targetPath, templateVariables);
+			await copyTemplate(templatePaths.overlay, targetPath, templateVariables);
+			const envExamplePath = join(targetPath, ".env.example");
+			if (await fileExists(envExamplePath)) await copyFile(envExamplePath, join(targetPath, ".env"));
+			spinner.succeed("Copied template files");
+		} catch (error) {
+			spinner.fail("Failed to copy template files");
+			throw error;
+		}
+		if (config.installDeps) {
+			spinner.start("Installing dependencies with pnpm...");
+			try {
+				await installDependencies(targetPath);
+				spinner.succeed("Installed dependencies");
+			} catch {
+				spinner.fail("Failed to install dependencies");
+				console.log();
+				console.log(chalk.yellow("You can try installing dependencies manually:"));
+				console.log(chalk.cyan(`  cd ${appName}`));
+				console.log(chalk.cyan("  pnpm install"));
+			}
+		}
+		console.log();
+		console.log(chalk.green.bold("Success!") + ` Created ${chalk.cyan(appName)}`);
+		console.log();
+		console.log("Next steps:");
+		console.log();
+		console.log(chalk.cyan(`  cd ${appName}`));
+		if (!config.installDeps) console.log(chalk.cyan("  pnpm install"));
+		if (config.template === TEMPLATES.fullstack) console.log(chalk.cyan(`  ${getRunCommand("db:push")}`) + "   # create the database");
+		console.log(chalk.cyan(`  ${getRunCommand("dev")}`));
+		console.log();
+		console.log("Then open " + chalk.cyan("http://localhost:5173") + " in your browser.");
+		if (config.template === TEMPLATES.fullstack) console.log("API server: " + chalk.cyan("http://localhost:5173/api/health"));
+		console.log(chalk.dim("  (port may differ if 5173 is in use — check the dev server output)"));
+		console.log();
+		console.log("Edit " + chalk.cyan("src/portal.config.ts") + " to customize your navigation.");
+		console.log();
+	} catch (error) {
+		console.log();
+		console.log(chalk.red("Error:") + " " + (error instanceof Error ? error.message : String(error)));
+		console.log();
+		process.exit(1);
+	}
+});
+function registerCreateCommand(ctx) {
+	ctx.program.addCommand(createCommand);
+}
+//#endregion
+//#region src/commands/dev.ts
+const devCommand = new Command("dev").description("Start the development server").option("-p, --port <port>", "Port to run the dev server on", "5173").option("--host", "Expose the dev server to the network").action(async (options) => {
+	const cwd = process.cwd();
+	if (!existsSync(join(cwd, "package.json"))) {
+		console.error(chalk.red("Error: No package.json found in current directory"));
+		console.error(chalk.yellow("Make sure you're in a Fluid project directory"));
+		process.exit(1);
+	}
+	if (!existsSync(join(cwd, "vite.config.ts"))) {
+		console.error(chalk.red("Error: No vite.config.ts found"));
+		console.error(chalk.yellow("This command must be run from a Fluid project directory"));
+		process.exit(1);
+	}
+	const viteArgs = ["vite"];
+	if (options.port) viteArgs.push("--port", String(options.port));
+	if (options.host) viteArgs.push("--host");
+	console.log();
+	console.log(chalk.bold("Starting development server..."));
+	console.log();
+	try {
+		await execa("pnpm", viteArgs, {
+			cwd,
+			stdio: "inherit"
+		});
+	} catch (error) {
+		if (error.signal === "SIGINT") return;
+		console.error(chalk.red("Development server exited with an error"));
+		process.exit(1);
+	}
+});
+function registerDevCommand(ctx) {
+	ctx.program.addCommand(devCommand);
+}
+//#endregion
+//#region src/commands/build.ts
+const buildCommand = new Command("build").description("Build the application for production").option("-o, --out-dir <dir>", "Output directory", "dist").action(async (options) => {
+	const cwd = process.cwd();
+	if (!existsSync(join(cwd, "package.json"))) {
+		console.error(chalk.red("Error: No package.json found in current directory"));
+		console.error(chalk.yellow("Make sure you're in a Fluid project directory"));
+		process.exit(1);
+	}
+	if (!existsSync(join(cwd, "vite.config.ts"))) {
+		console.error(chalk.red("Error: No vite.config.ts found"));
+		console.error(chalk.yellow("This command must be run from a Fluid project directory"));
+		process.exit(1);
+	}
+	console.log();
+	console.log(chalk.bold("Building for production..."));
+	console.log();
+	const spinner = ora("Building...").start();
+	try {
+		await execa("pnpm", ["run", "build"], {
+			cwd,
+			stdio: "pipe"
+		});
+		spinner.succeed("Build completed");
+		console.log();
+		console.log(`Output written to ${chalk.cyan(options.outDir ?? "dist")}/`);
+		console.log();
+		console.log("To preview the build locally:");
+		console.log(chalk.cyan("  pnpm vite preview"));
+		console.log();
+	} catch (error) {
+		spinner.fail("Build failed");
+		const execaError = error;
+		if (execaError.stderr) console.error(execaError.stderr);
+		process.exit(1);
+	}
+});
+function registerBuildCommand(ctx) {
+	ctx.program.addCommand(buildCommand);
+}
+//#endregion
+//#region src/utils/turso.ts
+/**
+* Turso database provisioning utilities
+*
+* This module provides functions for provisioning Turso databases
+* using the Turso Platform REST API for Fluid portal app deployments.
+*
+* Credential resolution order:
+* 1. Environment variables (TURSO_API_TOKEN + TURSO_ORG) — CI/CD
+* 2. --turso-org flag > single org > "fluid" org > current org > interactive prompt
+* 3. Fail with instructions for both options
+*/
+const TURSO_API_BASE = "https://api.turso.tech/v1";
+const TURSO_ERROR = {
+	MISSING_TOKEN: {
+		code: "MISSING_TOKEN",
+		message: "TURSO_API_TOKEN environment variable is not set"
+	},
+	MISSING_ORG: {
+		code: "MISSING_ORG",
+		message: "TURSO_ORG environment variable is not set"
+	},
+	GROUP_CREATION_FAILED: {
+		code: "GROUP_CREATION_FAILED",
+		message: "Failed to create database group"
+	},
+	DATABASE_CREATION_FAILED: {
+		code: "DATABASE_CREATION_FAILED",
+		message: "Failed to create database"
+	},
+	TOKEN_CREATION_FAILED: {
+		code: "TOKEN_CREATION_FAILED",
+		message: "Failed to create database auth token"
+	},
+	DATABASE_DELETION_FAILED: {
+		code: "DATABASE_DELETION_FAILED",
+		message: "Failed to delete database"
+	},
+	INVALID_LOCATION: {
+		code: "INVALID_LOCATION",
+		message: "Invalid database location"
+	},
+	LOCATIONS_FETCH_FAILED: {
+		code: "LOCATIONS_FETCH_FAILED",
+		message: "Failed to fetch available Turso locations"
+	},
+	TURSO_CLI_NOT_FOUND: {
+		code: "TURSO_CLI_NOT_FOUND",
+		message: "Turso CLI is not installed"
+	},
+	TURSO_CLI_NOT_AUTHENTICATED: {
+		code: "TURSO_CLI_NOT_AUTHENTICATED",
+		message: "Turso CLI is not authenticated"
+	},
+	TURSO_NO_ORGS: {
+		code: "TURSO_NO_ORGS",
+		message: "No organizations found in Turso CLI"
+	}
+};
+/**
+* Create a Turso error from a constant and optional details
+*/
+function createTursoError(template, details) {
+	return {
+		code: template.code,
+		message: template.message,
+		details
+	};
+}
+/**
+* Validate that required Turso environment variables are present
+*/
+function validateTursoConfig() {
+	const apiToken = process.env.TURSO_API_TOKEN;
+	if (!apiToken) return failure(createTursoError(TURSO_ERROR.MISSING_TOKEN));
+	const org = process.env.TURSO_ORG;
+	if (!org) return failure(createTursoError(TURSO_ERROR.MISSING_ORG));
+	return success({
+		apiToken,
+		org
+	});
+}
+/**
+* Check if the Turso CLI is installed and authenticated.
+* Runs `turso auth whoami` which verifies both in a single call.
+*/
+async function isTursoCliAvailable() {
+	try {
+		await execa("turso", ["auth", "whoami"], { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Get the Turso platform API token from the CLI.
+* Runs `turso auth token` which outputs the token to stdout.
+*/
+async function getTursoCliToken() {
+	try {
+		const { stdout } = await execa("turso", ["auth", "token"], { stdio: "pipe" });
+		const token = stdout.trim().split("\n").filter(Boolean).pop()?.trim() ?? "";
+		if (!token) return failure(createTursoError(TURSO_ERROR.TURSO_CLI_NOT_AUTHENTICATED, "turso auth token returned an empty value. Run: turso auth login"));
+		return success(token);
+	} catch {
+		return failure(createTursoError(TURSO_ERROR.TURSO_CLI_NOT_AUTHENTICATED, "Failed to get token from Turso CLI. Run: turso auth login"));
+	}
+}
+/**
+* Parse the tabular output of `turso org list`.
+*
+* Example input:
+*   Name          Slug          Type
+*   My Org        my-org        personal (current)
+*   Team Org      team-org      team
+*
+* Exported for unit testing.
+*/
+function parseOrgList(stdout) {
+	const lines = stdout.trim().split("\n");
+	if (lines.length <= 1) return [];
+	return lines.slice(1).reduce((orgs, line) => {
+		const trimmed = line.trim();
+		if (!trimmed) return orgs;
+		const columns = trimmed.split(/\s{2,}/);
+		if (columns.length < 2) return orgs;
+		const name = columns[0].trim();
+		const slug = columns[1].trim().replace(/\s*\(current\)/, "");
+		const isCurrent = trimmed.includes("(current)");
+		if (name && slug) orgs.push({
+			name,
+			slug,
+			isCurrent
+		});
+		return orgs;
+	}, []);
+}
+/**
+* Get the list of Turso organizations from the CLI.
+*/
+async function getTursoCliOrgs() {
+	try {
+		const { stdout } = await execa("turso", ["org", "list"], { stdio: "pipe" });
+		const orgs = parseOrgList(stdout);
+		if (orgs.length === 0) return failure(createTursoError(TURSO_ERROR.TURSO_NO_ORGS, "No organizations found. Create one at https://turso.tech"));
+		return success(orgs);
+	} catch {
+		return failure(createTursoError(TURSO_ERROR.TURSO_NO_ORGS, "Failed to list organizations from Turso CLI."));
+	}
+}
+const TURSO_AUTH_HELP = [
+	"Option 1 — Turso CLI (recommended for local dev):",
+	"  curl -sSfL https://get.tur.so/install.sh | bash",
+	"  turso auth login",
+	"",
+	"Option 2 — Environment variables (CI/CD):",
+	"  export TURSO_API_TOKEN=your_token_here",
+	"  export TURSO_ORG=your_org_name",
+	"",
+	"Get your API token at: https://turso.tech/app/settings/api-tokens"
+].join("\n");
+/**
+* Resolve Turso credentials from the best available source.
+*
+* Priority:
+* 1. Environment variables (TURSO_API_TOKEN + TURSO_ORG) — immediate, for CI/CD
+* 2. Turso CLI (turso auth token + turso org list) — interactive, for local dev
+* 3. Fail with instructions for both options
+*
+* @param tursoOrgOverride - Optional org slug from --turso-org flag (skips interactive selection)
+*/
+async function resolveTursoConfig(tursoOrgOverride) {
+	const envToken = process.env.TURSO_API_TOKEN;
+	const envOrg = process.env.TURSO_ORG;
+	if (envToken && envOrg) return success({
+		apiToken: envToken,
+		org: envOrg,
+		source: "env"
+	});
+	if (!await isTursoCliAvailable()) return failure(createTursoError(TURSO_ERROR.TURSO_CLI_NOT_FOUND, `No Turso credentials found.\n\n${TURSO_AUTH_HELP}`));
+	const tokenResult = await getTursoCliToken();
+	if (!tokenResult.success) return tokenResult;
+	const apiToken = tokenResult.value;
+	if (tursoOrgOverride) return success({
+		apiToken,
+		org: tursoOrgOverride,
+		source: "cli"
+	});
+	const orgsResult = await getTursoCliOrgs();
+	if (!orgsResult.success) return orgsResult;
+	const orgs = orgsResult.value;
+	if (orgs.length === 1) return success({
+		apiToken,
+		org: orgs[0].slug,
+		source: "cli"
+	});
+	const fluidOrg = orgs.find((o) => o.slug === "fluid");
+	if (fluidOrg) return success({
+		apiToken,
+		org: fluidOrg.slug,
+		source: "cli"
+	});
+	const currentOrg = orgs.find((o) => o.isCurrent);
+	if (currentOrg) return success({
+		apiToken,
+		org: currentOrg.slug,
+		source: "cli"
+	});
+	const { orgSlug } = await prompts({
+		type: "select",
+		name: "orgSlug",
+		message: "Which Turso organization?",
+		choices: orgs.map((o) => ({
+			title: `${o.name} (${o.slug})`,
+			value: o.slug
+		}))
+	});
+	if (!orgSlug) return failure(createTursoError(TURSO_ERROR.TURSO_NO_ORGS, "Organization selection cancelled."));
+	return success({
+		apiToken,
+		org: orgSlug,
+		source: "cli"
+	});
+}
+/**
+* Build standard headers for Turso API requests
+*/
+function buildHeaders(apiToken) {
+	return {
+		Authorization: `Bearer ${apiToken}`,
+		"Content-Type": "application/json"
+	};
+}
+/**
+* Fetch available Turso database locations.
+* Returns a map of location ID → description (e.g., "aws-us-east-1" → "US East (N. Virginia)").
+*/
+async function fetchLocations(config) {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 3e4);
+		const response = await fetch(`${TURSO_API_BASE}/locations`, {
+			method: "GET",
+			headers: buildHeaders(config.apiToken),
+			signal: controller.signal
+		});
+		clearTimeout(timeout);
+		if (!response.ok) {
+			const body = await response.text();
+			return failure(createTursoError(TURSO_ERROR.LOCATIONS_FETCH_FAILED, `HTTP ${response.status}: ${body}`));
+		}
+		return success((await response.json()).locations);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.LOCATIONS_FETCH_FAILED, message));
+	}
+}
+/**
+* Validate that a location string is a known Turso location.
+* On failure, returns an error listing all valid locations.
+*/
+async function validateLocation(config, location) {
+	const locationsResult = await fetchLocations(config);
+	if (!locationsResult.success) return locationsResult;
+	const locations = locationsResult.value;
+	if (location in locations) return success(void 0);
+	const validLocations = Object.entries(locations).map(([id, desc]) => `  ${id} — ${desc}`).join("\n");
+	return failure(createTursoError(TURSO_ERROR.INVALID_LOCATION, `"${location}" is not a valid Turso location.\n\nAvailable locations:\n${validLocations}`));
+}
+/**
+* Ensure a default database group exists in the Turso organization.
+* Creates the group if it does not exist; treats 409 (conflict) as success
+* since it means the group already exists.
+*/
+async function ensureGroup(config, location = "aws-us-east-1") {
+	try {
+		const listController = new AbortController();
+		const listTimeout = setTimeout(() => listController.abort(), 3e4);
+		const listResponse = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/groups`, {
+			method: "GET",
+			headers: buildHeaders(config.apiToken),
+			signal: listController.signal
+		});
+		clearTimeout(listTimeout);
+		if (listResponse.ok) {
+			if ((await listResponse.json()).groups.some((g) => g.name === "default")) return success(void 0);
+		}
+		const createController = new AbortController();
+		const createTimeout = setTimeout(() => createController.abort(), 3e4);
+		const createResponse = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/groups`, {
+			method: "POST",
+			headers: buildHeaders(config.apiToken),
+			body: JSON.stringify({
+				name: "default",
+				location
+			}),
+			signal: createController.signal
+		});
+		clearTimeout(createTimeout);
+		if (createResponse.ok || createResponse.status === 409) return success(void 0);
+		const body = await createResponse.text();
+		return failure(createTursoError(TURSO_ERROR.GROUP_CREATION_FAILED, `HTTP ${createResponse.status}: ${body}`));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.GROUP_CREATION_FAILED, message));
+	}
+}
+/**
+* Create a new Turso database in the default group.
+* If the database already exists (409), fetches its info via GET instead.
+* Returns the database name and hostname.
+*/
+async function createDatabase(config, name) {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 3e4);
+		const response = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/databases`, {
+			method: "POST",
+			headers: buildHeaders(config.apiToken),
+			body: JSON.stringify({
+				name,
+				group: "default"
+			}),
+			signal: controller.signal
+		});
+		clearTimeout(timeout);
+		if (response.ok) {
+			const data = await response.json();
+			if (!data.database) return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, "Unexpected API response: missing database object"));
+			return success({
+				name: data.database.Name ?? data.database.name ?? name,
+				hostname: data.database.Hostname ?? data.database.hostname ?? "",
+				isNew: true
+			});
+		}
+		if (response.status === 409) {
+			const existing = await getDatabaseInfo(config, name);
+			if (!existing.success) return existing;
+			return success({
+				...existing.value,
+				isNew: false
+			});
+		}
+		const body = await response.text();
+		return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, `HTTP ${response.status}: ${body}`));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, message));
+	}
+}
+/**
+* Fetch existing database info by name
+*/
+async function getDatabaseInfo(config, name) {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 3e4);
+		const response = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/databases/${name}`, {
+			method: "GET",
+			headers: buildHeaders(config.apiToken),
+			signal: controller.signal
+		});
+		clearTimeout(timeout);
+		if (!response.ok) {
+			const body = await response.text();
+			return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, `Failed to fetch existing database info: HTTP ${response.status}: ${body}`));
+		}
+		const data = await response.json();
+		if (!data.database) return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, "Unexpected API response: missing database object"));
+		return success({
+			name: data.database.Name ?? data.database.name ?? name,
+			hostname: data.database.Hostname ?? data.database.hostname ?? ""
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.DATABASE_CREATION_FAILED, `Failed to fetch existing database info: ${message}`));
+	}
+}
+/**
+* Delete a Turso database by name.
+* Returns void on success, or a TursoError on failure.
+*/
+async function deleteDatabase(config, name) {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 3e4);
+		const response = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/databases/${name}`, {
+			method: "DELETE",
+			headers: buildHeaders(config.apiToken),
+			signal: controller.signal
+		});
+		clearTimeout(timeout);
+		if (response.ok || response.status === 404) return success(void 0);
+		const body = await response.text();
+		return failure(createTursoError(TURSO_ERROR.DATABASE_DELETION_FAILED, `HTTP ${response.status}: ${body}`));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.DATABASE_DELETION_FAILED, message));
+	}
+}
+/**
+* Create an auth token for a Turso database.
+* Returns the JWT token string used for database connections.
+*/
+async function createDatabaseToken(config, dbName) {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 3e4);
+		const response = await fetch(`${TURSO_API_BASE}/organizations/${config.org}/databases/${dbName}/auth/tokens`, {
+			method: "POST",
+			headers: buildHeaders(config.apiToken),
+			signal: controller.signal
+		});
+		clearTimeout(timeout);
+		if (!response.ok) {
+			const body = await response.text();
+			return failure(createTursoError(TURSO_ERROR.TOKEN_CREATION_FAILED, `HTTP ${response.status}: ${body}`));
+		}
+		const data = await response.json();
+		if (!data.jwt) return failure(createTursoError(TURSO_ERROR.TOKEN_CREATION_FAILED, "Unexpected API response: missing jwt field"));
+		return success(data.jwt);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createTursoError(TURSO_ERROR.TOKEN_CREATION_FAILED, message));
+	}
+}
+/**
+* Provision a complete Turso database for a project.
+*
+* Orchestrates the full flow:
+* 1. Ensure a default group exists
+* 2. Create (or retrieve) the database
+* 3. Generate an auth token
+*
+* Calls progress callbacks at each step so callers can display status.
+*/
+async function provisionDatabase(config, projectName, location, callbacks) {
+	if (location) {
+		const locationResult = await validateLocation(config, location);
+		if (!locationResult.success) return locationResult;
+	}
+	callbacks?.onGroupCreating?.();
+	const groupResult = await ensureGroup(config, location);
+	if (!groupResult.success) return groupResult;
+	callbacks?.onGroupReady?.();
+	callbacks?.onDatabaseCreating?.(projectName);
+	const dbResult = await createDatabase(config, projectName);
+	if (!dbResult.success) return dbResult;
+	const { name: databaseName, hostname, isNew } = dbResult.value;
+	callbacks?.onDatabaseReady?.(databaseName);
+	callbacks?.onTokenCreating?.();
+	const tokenResult = await createDatabaseToken(config, databaseName);
+	if (!tokenResult.success) return tokenResult;
+	const authToken = tokenResult.value;
+	callbacks?.onTokenReady?.();
+	return success({
+		url: `libsql://${hostname}`,
+		authToken,
+		databaseName,
+		hostname,
+		isNew
+	});
+}
+//#endregion
+//#region src/utils/cloud-run.ts
+/**
+* Cloud Run deployment utilities
+*
+* This module provides functions for deploying Fluid portal apps to Google Cloud Run
+* using the gcloud CLI via execa for programmatic deployments.
+*/
+/**
+* Cloud Run error codes and default messages
+*/
+const CLOUD_RUN_ERRORS = {
+	GCLOUD_NOT_INSTALLED: {
+		code: "GCLOUD_NOT_INSTALLED",
+		message: "gcloud CLI is not installed. Install it from https://cloud.google.com/sdk/docs/install"
+	},
+	GCLOUD_NOT_AUTHENTICATED: {
+		code: "GCLOUD_NOT_AUTHENTICATED",
+		message: "gcloud CLI is not authenticated. Run 'gcloud auth login' to authenticate"
+	},
+	NO_GCP_PROJECT: {
+		code: "NO_GCP_PROJECT",
+		message: "No GCP project configured. Run 'gcloud config set project PROJECT_ID' or pass --gcp-project"
+	},
+	DEPLOY_FAILED: {
+		code: "DEPLOY_FAILED",
+		message: "Cloud Run deployment failed"
+	},
+	SERVICE_DELETION_FAILED: {
+		code: "SERVICE_DELETION_FAILED",
+		message: "Cloud Run service deletion failed"
+	}
+};
+/**
+* Create a CloudRunError from a constant and optional details
+*/
+function createCloudRunError(template, details) {
+	return {
+		code: template.code,
+		message: template.message,
+		details
+	};
+}
+/**
+* Build a KEY=VALUE string from an env vars record using gcloud's custom
+* delimiter syntax to avoid issues with values containing commas.
+* Prefix with `^::^` and join entries with `::` instead of `,`.
+*/
+function buildEnvVarsString(envVars) {
+	return `^::^${Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join("::")}`;
+}
+/**
+* Validate that the gcloud CLI is installed
+*/
+async function validateGcloudInstalled() {
+	try {
+		await execa("gcloud", ["--version"], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		return success(void 0);
+	} catch {
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.GCLOUD_NOT_INSTALLED));
+	}
+}
+/**
+* Validate that the gcloud CLI has an active authenticated account
+*/
+async function validateGcloudAuth() {
+	try {
+		const { stdout } = await execa("gcloud", [
+			"auth",
+			"list",
+			"--format=json"
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		if (!JSON.parse(stdout).some((account) => account.status === "ACTIVE")) return failure(createCloudRunError(CLOUD_RUN_ERRORS.GCLOUD_NOT_AUTHENTICATED));
+		return success(void 0);
+	} catch {
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.GCLOUD_NOT_AUTHENTICATED, "Failed to check gcloud authentication status"));
+	}
+}
+/**
+* Get the currently configured GCP project from gcloud config
+*/
+async function getGcpProject() {
+	try {
+		const { stdout } = await execa("gcloud", [
+			"config",
+			"get-value",
+			"project"
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		const project = stdout.trim();
+		if (!project || project === "(unset)") return failure(createCloudRunError(CLOUD_RUN_ERRORS.NO_GCP_PROJECT));
+		return success(project);
+	} catch {
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.NO_GCP_PROJECT, "Failed to read GCP project from gcloud config"));
+	}
+}
+/**
+* Fetch the last 30 lines of the most recent Cloud Build log.
+* Returns `undefined` on any failure — this is best-effort diagnostic info.
+*/
+async function fetchRecentBuildLogs(gcpProject, region) {
+	try {
+		const { stdout: buildId } = await execa("gcloud", [
+			"builds",
+			"list",
+			"--limit=1",
+			"--project",
+			gcpProject,
+			"--region",
+			region,
+			"--format=value(id)"
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		const trimmedId = buildId.trim();
+		if (!trimmedId) return void 0;
+		const { stdout: logText } = await execa("gcloud", [
+			"builds",
+			"log",
+			trimmedId,
+			"--project",
+			gcpProject,
+			"--region",
+			region
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		return logText.split("\n").slice(-30).join("\n");
+	} catch {
+		return;
+	}
+}
+/**
+* Retrieve the service URL via `gcloud run services describe`.
+* Used as a fallback when the deploy command does not return parseable JSON.
+*/
+async function getServiceUrl(serviceName, gcpProject, region) {
+	try {
+		const { stdout } = await execa("gcloud", [
+			"run",
+			"services",
+			"describe",
+			serviceName,
+			"--project",
+			gcpProject,
+			"--region",
+			region,
+			"--format=json"
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		const url = JSON.parse(stdout).status?.url;
+		if (!url) return failure(createCloudRunError(CLOUD_RUN_ERRORS.DEPLOY_FAILED, "Service deployed but no URL found in service description"));
+		return success(url);
+	} catch (err) {
+		const details = err instanceof Error ? err.message : "Unknown error describing service";
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.DEPLOY_FAILED, details));
+	}
+}
+/**
+* Deploy to Cloud Run using `gcloud run deploy --source`
+*
+* This builds the container from source and deploys it in a single step.
+* Progress is reported through optional callbacks.
+*/
+async function deployToCloudRun(config, callbacks) {
+	callbacks?.onValidating?.();
+	const installCheck = await validateGcloudInstalled();
+	if (!installCheck.success) return failure(installCheck.error);
+	const authCheck = await validateGcloudAuth();
+	if (!authCheck.success) return failure(authCheck.error);
+	const args = [
+		"run",
+		"deploy",
+		config.serviceName,
+		"--source",
+		config.sourceDir,
+		"--project",
+		config.gcpProject,
+		"--region",
+		config.region,
+		...config.requireAuth ? [] : ["--allow-unauthenticated"],
+		"--quiet",
+		"--format=json"
+	];
+	const envVarsString = buildEnvVarsString(config.envVars);
+	if (envVarsString) args.push("--set-env-vars", envVarsString);
+	callbacks?.onDeploying?.();
+	try {
+		const { stdout } = await execa("gcloud", args, {
+			stdio: "pipe",
+			timeout: 3e5
+		});
+		let url;
+		try {
+			url = JSON.parse(stdout).status?.url;
+		} catch {}
+		if (!url) {
+			const fallbackResult = await getServiceUrl(config.serviceName, config.gcpProject, config.region);
+			if (!fallbackResult.success) return failure(fallbackResult.error);
+			url = fallbackResult.value;
+		}
+		const result = {
+			url,
+			serviceName: config.serviceName,
+			region: config.region,
+			gcpProject: config.gcpProject
+		};
+		callbacks?.onDeployComplete?.(url);
+		return success(result);
+	} catch (err) {
+		const execaError = err;
+		let details = execaError.stderr ?? execaError.message ?? String(err);
+		const buildLogs = await fetchRecentBuildLogs(config.gcpProject, config.region);
+		if (buildLogs) details += "\n\n── Recent Cloud Build logs ─────────────────────\n" + buildLogs;
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.DEPLOY_FAILED, details));
+	}
+}
+/**
+* Delete a Cloud Run service using `gcloud run services delete`.
+*/
+async function deleteCloudRunService(config) {
+	try {
+		await execa("gcloud", [
+			"run",
+			"services",
+			"delete",
+			config.serviceName,
+			"--region",
+			config.region,
+			"--project",
+			config.gcpProject,
+			"--quiet"
+		], {
+			stdio: "pipe",
+			timeout: 6e4
+		});
+		return success(void 0);
+	} catch (err) {
+		const execaError = err;
+		return failure(createCloudRunError(CLOUD_RUN_ERRORS.SERVICE_DELETION_FAILED, execaError.stderr ?? execaError.message ?? String(err)));
+	}
+}
+//#endregion
+//#region src/utils/fluid-api.ts
+/**
+* Fluid API validation utilities
+*
+* This module provides functions for validating Fluid API keys
+* before deploying or destroying infrastructure. Ensures the deployer
+* has a valid company token before touching Cloud Run or Turso resources.
+*/
+const FLUID_API_BASE$1 = "https://api.fluid.app";
+const FLUID_API_ERROR = {
+	MISSING_API_KEY: {
+		code: "MISSING_API_KEY",
+		message: "FLUID_COMPANY_API_KEY is not set"
+	},
+	INVALID_API_KEY: {
+		code: "INVALID_API_KEY",
+		message: "FLUID_COMPANY_API_KEY is invalid or expired"
+	},
+	API_UNREACHABLE: {
+		code: "API_UNREACHABLE",
+		message: "Could not reach the Fluid API"
+	}
+};
+/**
+* Create a Fluid API error from a constant and optional details
+*/
+function createFluidApiError(template, details) {
+	return {
+		code: template.code,
+		message: template.message,
+		details
+	};
+}
+/**
+* Resolve and validate the Fluid API key.
+*
+* Priority:
+* 1. `apiKeyOverride` parameter (from --fluid-company-api-key flag)
+* 2. FLUID_COMPANY_API_KEY environment variable
+* 3. Interactive hidden-input prompt
+* 4. Fail with instructions if all sources exhausted
+*
+* Once resolved, validates against the Fluid API (GET /api/company/v1/companies/me).
+*
+* @param apiKeyOverride - Optional API key from CLI flag (skips env + prompt)
+*/
+async function resolveFluidApiKey(apiKeyOverride) {
+	if (apiKeyOverride) return validateFluidApiKey(apiKeyOverride);
+	const envKey = process.env.FLUID_COMPANY_API_KEY;
+	if (envKey) return validateFluidApiKey(envKey);
+	const { apiKey } = await prompts({
+		type: "password",
+		name: "apiKey",
+		message: "Enter your Fluid company API key (FLUID_COMPANY_API_KEY)"
+	});
+	if (!apiKey) return failure(createFluidApiError(FLUID_API_ERROR.MISSING_API_KEY, "Set FLUID_COMPANY_API_KEY in your .env file or pass --fluid-company-api-key <key>."));
+	return validateFluidApiKey(apiKey);
+}
+/**
+* Validate a Fluid API key by calling the companies/me endpoint.
+*
+* - 200 → extract company name, return success
+* - 401/403 → invalid or expired key
+* - Network error → API unreachable
+*/
+async function validateFluidApiKey(apiKey) {
+	try {
+		const response = await fetch(`${FLUID_API_BASE$1}/api/company/v1/companies/me`, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${apiKey}`,
+				"Content-Type": "application/json"
+			}
+		});
+		if (response.ok) return success({
+			name: (await response.json()).data.company.name,
+			apiKey
+		});
+		if (response.status === 401 || response.status === 403) return failure(createFluidApiError(FLUID_API_ERROR.INVALID_API_KEY, `HTTP ${response.status}: Check that your FLUID_COMPANY_API_KEY is a valid, non-expired company token.`));
+		const body = await response.text();
+		return failure(createFluidApiError(FLUID_API_ERROR.API_UNREACHABLE, `HTTP ${response.status}: ${body}`));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return failure(createFluidApiError(FLUID_API_ERROR.API_UNREACHABLE, message));
+	}
+}
+//#endregion
+//#region src/utils/project.ts
+/**
+* Read project name from package.json
+*/
+async function getProjectName(cwd) {
+	const packageJsonPath = path.join(cwd, "package.json");
+	if (await fs.pathExists(packageJsonPath)) return (await fs.readJson(packageJsonPath)).name;
+}
+/**
+* Sanitize a project name into a valid Cloud Run service name.
+* Lowercase, alphanumeric, and hyphens only.
+*/
+function sanitizeServiceName(projectName) {
+	return projectName.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/--+/g, "-").replace(/^-|-$/g, "");
+}
+//#endregion
+//#region src/utils/extract-navigation.ts
+/**
+* Navigation extraction utility
+*
+* Extracts the `navigation` export from a project's navigation.config.ts
+* by writing a minimal wrapper script that imports from navigation.config.ts
+* and serializes the result to stdout, then running it with tsx.
+*
+* This avoids transitive dependency resolution — navigation.config.ts must
+* be self-contained static data with no import statements.
+*/
+const EXTRACT_FILENAME = "__fluid_extract_nav.ts";
+/**
+* Extract the `navigation` export from a project's navigation.config.ts.
+*
+* Reads the config file, validates it contains no import statements,
+* writes a minimal wrapper that imports and serializes navigation,
+* and runs it with tsx. This avoids needing project dependencies
+* (React, etc.) to be installed.
+*
+* The temp file is always cleaned up.
+* Returns null if no navigation export exists.
+*
+* @param projectDir - The project root directory containing src/navigation.config.ts
+*/
+async function extractNavigation(projectDir) {
+	const configPath = path.join(projectDir, "src", "navigation.config.ts");
+	const extractFile = path.join(projectDir, EXTRACT_FILENAME);
+	try {
+		const configSource = await fs.readFile(configPath, "utf-8");
+		if (!/export\s+(const|let)\s+navigation\s*=/.test(configSource)) return success(null);
+		if (/^\s*import\s/m.test(configSource)) return failure({
+			code: "EXTRACTION_FAILED",
+			message: "navigation.config.ts must not contain import statements — it should only export static data",
+			details: "Move all imports to portal.config.ts. navigation.config.ts must be self-contained."
+		});
+		const wrapperScript = [`import { navigation } from "./src/navigation.config.ts";`, `console.log(JSON.stringify(navigation ?? null));`].join("\n");
+		await fs.writeFile(extractFile, wrapperScript, "utf-8");
+		const output = (await execa("npx", ["tsx", EXTRACT_FILENAME], {
+			cwd: projectDir,
+			stdio: "pipe",
+			env: {
+				...process.env,
+				NODE_ENV: "production"
+			}
+		})).stdout.trim();
+		if (!output || output === "null") return success(null);
+		try {
+			const parsed = JSON.parse(output);
+			if (!Array.isArray(parsed)) return failure({
+				code: "INVALID_FORMAT",
+				message: "navigation export is not an array",
+				details: `Expected an array, got: ${typeof parsed}`
+			});
+			return success(parsed);
+		} catch {
+			return failure({
+				code: "INVALID_FORMAT",
+				message: "Failed to parse navigation output as JSON",
+				details: output.slice(0, 200)
+			});
+		}
+	} catch (err) {
+		const error = err;
+		return failure({
+			code: "EXTRACTION_FAILED",
+			message: "Failed to extract navigation from navigation.config.ts",
+			details: error.stderr ?? error.message ?? String(err)
+		});
+	} finally {
+		await fs.remove(extractFile).catch(() => {});
+	}
+}
+//#endregion
+//#region src/utils/navigation-sync.ts
+/**
+* Navigation sync utility
+*
+* Reconciles code-defined navigation items from portal.config.ts
+* against the Fluid OS API. Only manages items with source: "code",
+* leaving user-created and system items untouched.
+*/
+const FLUID_API_BASE = "https://api.fluid.app";
+async function apiGet(apiKey, path) {
+	const response = await fetch(`${FLUID_API_BASE}${path}`, {
+		method: "GET",
+		headers: {
+			Authorization: `Bearer ${apiKey}`,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) {
+		const body = await response.text();
+		throw new Error(`GET ${path} failed (${response.status}): ${body}`);
+	}
+	return response.json();
+}
+async function apiPost(apiKey, path, body) {
+	const response = await fetch(`${FLUID_API_BASE}${path}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${apiKey}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`POST ${path} failed (${response.status}): ${text}`);
+	}
+	return response.json();
+}
+async function apiPut(apiKey, path, body) {
+	const response = await fetch(`${FLUID_API_BASE}${path}`, {
+		method: "PUT",
+		headers: {
+			Authorization: `Bearer ${apiKey}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`PUT ${path} failed (${response.status}): ${text}`);
+	}
+	return response.json();
+}
+async function apiDelete(apiKey, path) {
+	const response = await fetch(`${FLUID_API_BASE}${path}`, {
+		method: "DELETE",
+		headers: {
+			Authorization: `Bearer ${apiKey}`,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`DELETE ${path} failed (${response.status}): ${text}`);
+	}
+}
+async function discoverContext(apiKey) {
+	let definitionId;
+	try {
+		const active = (await apiGet(apiKey, "/api/company/fluid_os/definitions")).definitions.find((d) => d.active);
+		if (!active) return failure({
+			code: "NO_DEFINITION",
+			message: "No active Fluid OS definition found",
+			details: "Create and activate a definition in the Fluid admin dashboard first."
+		});
+		definitionId = active.id;
+	} catch (err) {
+		return failure({
+			code: "API_ERROR",
+			message: "Failed to fetch Fluid OS definitions",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	let navigationId;
+	try {
+		const navs = await apiGet(apiKey, `/api/company/fluid_os/definitions/${definitionId}/navigations`);
+		const webNav = navs.navigations.find((n) => n.name.toLowerCase().includes("web")) ?? navs.navigations[0];
+		if (!webNav) return failure({
+			code: "NO_NAVIGATION",
+			message: "No navigation found for the active definition",
+			details: "The active definition has no navigations. Create one in the Fluid admin dashboard."
+		});
+		navigationId = webNav.id;
+	} catch (err) {
+		return failure({
+			code: "API_ERROR",
+			message: "Failed to fetch navigations",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	return success({
+		apiKey,
+		definitionId,
+		navigationId
+	});
+}
+/**
+* Build a lookup key for matching code items to API items.
+* Items with a slug are keyed by slug; headers (no slug) are keyed by "header:{label}".
+*/
+function itemKey(item) {
+	if (item.slug) return item.slug;
+	return `header:${item.label ?? ""}`;
+}
+/**
+* Recursively delete an API navigation item and all its source: "code" descendants
+* in post-order (deepest children first, then the item itself).
+*/
+async function deleteItemRecursive(apiKey, basePath, item, stats) {
+	const codeChildren = (item.children ?? []).filter((c) => c.source === "code");
+	for (const child of codeChildren) await deleteItemRecursive(apiKey, basePath, child, stats);
+	await apiDelete(apiKey, `${basePath}/${item.id}`);
+	stats.deleted++;
+}
+/**
+* Sync a level of code-defined navigation items against existing API items.
+* Recurses for children.
+*/
+async function syncLevel(ctx, codeItems, existingItems, parentId, stats) {
+	const existingByKey = /* @__PURE__ */ new Map();
+	for (const item of existingItems) if (item.source === "code") existingByKey.set(itemKey(item), item);
+	const basePath = `/api/company/fluid_os/definitions/${ctx.definitionId}/navigations/${ctx.navigationId}/navigation_items`;
+	const matched = /* @__PURE__ */ new Set();
+	for (let i = 0; i < codeItems.length; i++) {
+		const codeItem = codeItems[i];
+		const key = itemKey(codeItem);
+		const existing = existingByKey.get(key);
+		matched.add(key);
+		if (existing) {
+			if (existing.label !== codeItem.label || existing.icon !== (codeItem.icon ?? null) || existing.position !== i + 1) {
+				await apiPut(ctx.apiKey, `${basePath}/${existing.id}`, { navigation_item: {
+					label: codeItem.label,
+					icon: codeItem.icon ?? null,
+					position: i + 1
+				} });
+				stats.updated++;
+			}
+			if (codeItem.children?.length) await syncLevel(ctx, codeItem.children, existing.children ?? [], existing.id, stats);
+		} else {
+			const response = await apiPost(ctx.apiKey, basePath, { navigation_item: {
+				label: codeItem.label,
+				slug: codeItem.slug ?? null,
+				icon: codeItem.icon ?? null,
+				position: i + 1,
+				parent_id: parentId,
+				source: "code"
+			} });
+			stats.created++;
+			if (codeItem.children?.length) {
+				const newId = response.navigation_item.id;
+				await syncLevel(ctx, codeItem.children, [], newId, stats);
+			}
+		}
+	}
+	for (const [key, item] of existingByKey) if (!matched.has(key)) await deleteItemRecursive(ctx.apiKey, basePath, item, stats);
+}
+/**
+* Sync code-defined navigation items to the Fluid OS API.
+*
+* @param apiKey - Valid Fluid company API key
+* @param codeItems - Navigation items from portal.config.ts
+*/
+async function syncNavigation(apiKey, codeItems) {
+	const contextResult = await discoverContext(apiKey);
+	if (!contextResult.success) return contextResult;
+	const ctx = {
+		apiBase: FLUID_API_BASE,
+		...contextResult.value
+	};
+	let existingItems;
+	try {
+		existingItems = (await apiGet(ctx.apiKey, `/api/company/fluid_os/definitions/${ctx.definitionId}/navigations/${ctx.navigationId}/navigation_items`)).navigation_items;
+	} catch (err) {
+		return failure({
+			code: "API_ERROR",
+			message: "Failed to fetch existing navigation items",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	const stats = {
+		created: 0,
+		updated: 0,
+		deleted: 0
+	};
+	try {
+		await syncLevel(ctx, codeItems, existingItems, null, stats);
+	} catch (err) {
+		return failure({
+			code: "SYNC_FAILED",
+			message: "Navigation sync failed during reconciliation",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	return success(stats);
+}
+//#endregion
+//#region src/commands/deploy.ts
+/**
+* Detect if the project is a fullstack template (has server entry)
+*/
+async function isFullstackProject(cwd) {
+	return fs.pathExists(path.join(cwd, "src", "server", "index.ts"));
+}
+const deployCommand = new Command("deploy").description("Deploy the fullstack application to Cloud Run + Turso").option("--region <region>", "Cloud Run region", "us-central1").option("--gcp-project <id>", "GCP project ID (default: from gcloud config)").option("-p, --project <name>", "Service name override (default: from package.json)").option("--db-region <location>", "Turso database group location", "aws-us-east-1").option("--require-auth", "Require IAM authentication for the Cloud Run service (default: public)").option("--migrate", "Run database migrations (db:push) after successful deploy").option("--skip-local-build", "Skip the local Docker build check before deploying").option("--turso-org <slug>", "Turso organization slug (skips interactive org selection)").option("--fluid-company-api-key <key>", "Fluid company API key (skips env var lookup and prompt)").option("--skip-nav-sync", "Skip navigation sync from portal.config.ts").action(async (options) => {
+	const cwd = process.cwd();
+	config({ path: path.join(cwd, ".env") });
+	console.log();
+	console.log(chalk.blue.bold("Fluid Deploy") + chalk.gray(" (Cloud Run + Turso)"));
+	console.log();
+	if (!await isFullstackProject(cwd)) {
+		console.log(chalk.red("Error:") + " This project is not a fullstack template.");
+		console.log();
+		console.log(chalk.yellow("fluid deploy") + " only supports fullstack projects with a Hono API server.");
+		console.log();
+		console.log("For static sites (starter template), deploy the " + chalk.cyan("dist/") + " folder to:");
+		console.log("  - Firebase Hosting: " + chalk.gray("https://firebase.google.com/docs/hosting"));
+		console.log("  - Cloud Storage:    " + chalk.gray("https://cloud.google.com/storage/docs/hosting-static-website"));
+		console.log("  - Vercel:           " + chalk.gray("https://vercel.com"));
+		console.log("  - Netlify:          " + chalk.gray("https://netlify.com"));
+		console.log();
+		process.exit(1);
+	}
+	const spinner = ora();
+	spinner.start("Validating Fluid API key...");
+	const fluidResult = await resolveFluidApiKey(options.fluidCompanyApiKey);
+	if (!fluidResult.success) {
+		spinner.fail("Fluid API key validation failed");
+		console.log();
+		console.log(chalk.red("Error:") + " " + fluidResult.error.message);
+		if (fluidResult.error.details) {
+			console.log();
+			console.log(fluidResult.error.details);
+		}
+		console.log();
+		process.exit(1);
+	}
+	spinner.succeed(`Fluid company: ${chalk.cyan(fluidResult.value.name)}`);
+	if (!await fs.pathExists(path.join(cwd, "Dockerfile"))) {
+		console.log(chalk.red("Error:") + " No Dockerfile found in current directory.");
+		console.log();
+		console.log("Fullstack projects created with the latest template include a Dockerfile.");
+		console.log("If you upgraded from an older template, add a Dockerfile to your project.");
+		console.log();
+		process.exit(1);
+	}
+	spinner.start("Checking gcloud CLI...");
+	const gcloudResult = await validateGcloudInstalled();
+	if (!gcloudResult.success) {
+		spinner.fail("gcloud CLI not found");
+		console.log();
+		console.log(chalk.red("Error:") + " " + gcloudResult.error.message);
+		console.log();
+		console.log("Install the Google Cloud SDK: " + chalk.cyan("https://cloud.google.com/sdk/docs/install"));
+		console.log();
+		process.exit(1);
+	}
+	const authResult = await validateGcloudAuth();
+	if (!authResult.success) {
+		spinner.fail("gcloud not authenticated");
+		console.log();
+		console.log(chalk.red("Error:") + " " + authResult.error.message);
+		console.log();
+		console.log("Run " + chalk.cyan("gcloud auth login") + " to authenticate.");
+		console.log();
+		process.exit(1);
+	}
+	spinner.succeed("gcloud CLI ready");
+	let gcpProject = options.gcpProject;
+	if (!gcpProject) {
+		spinner.start("Detecting GCP project...");
+		const projectResult = await getGcpProject();
+		if (!projectResult.success) {
+			spinner.fail("No GCP project configured");
+			console.log();
+			console.log(chalk.red("Error:") + " " + projectResult.error.message);
+			console.log();
+			console.log("Either:");
+			console.log("  - Run " + chalk.cyan("gcloud config set project PROJECT_ID"));
+			console.log("  - Use the " + chalk.cyan("--gcp-project <id>") + " flag");
+			console.log();
+			process.exit(1);
+		}
+		gcpProject = projectResult.value;
+		spinner.succeed(`GCP project: ${chalk.cyan(gcpProject)}`);
+	}
+	spinner.start("Resolving Turso credentials...");
+	const tursoConfigResult = await resolveTursoConfig(options.tursoOrg);
+	if (!tursoConfigResult.success) {
+		spinner.fail("Turso credentials not found");
+		console.log();
+		console.log(chalk.red("Error:") + " " + tursoConfigResult.error.message);
+		if (tursoConfigResult.error.details) {
+			console.log();
+			console.log(tursoConfigResult.error.details);
+		}
+		console.log();
+		process.exit(1);
+	}
+	const tursoConfig = tursoConfigResult.value;
+	const sourceLabel = tursoConfig.source === "env" ? "environment variables" : "Turso CLI";
+	spinner.succeed(`Turso: authenticated via ${sourceLabel}`);
+	const projectName = options.project ?? await getProjectName(cwd);
+	if (!projectName) {
+		console.log(chalk.red("Error:") + " Could not determine project name.");
+		console.log();
+		console.log("Either:");
+		console.log("  - Add a " + chalk.cyan("name") + " field to package.json");
+		console.log("  - Use the " + chalk.cyan("--project <name>") + " flag");
+		console.log();
+		process.exit(1);
+	}
+	const serviceName = sanitizeServiceName(projectName);
+	if (!serviceName) {
+		console.log(chalk.red("Error:") + " Project name sanitizes to an empty service name.");
+		console.log();
+		console.log("Use the " + chalk.cyan("--project <name>") + " flag to provide a valid service name.");
+		console.log();
+		process.exit(1);
+	}
+	const region = options.region ?? "us-central1";
+	console.log();
+	console.log(chalk.gray("Service:     ") + chalk.white(serviceName));
+	console.log(chalk.gray("Region:      ") + chalk.white(region));
+	console.log(chalk.gray("GCP Project: ") + chalk.white(gcpProject));
+	console.log(chalk.gray("Turso Org:   ") + chalk.white(tursoConfig.org) + chalk.gray(` (via ${sourceLabel})`));
+	console.log();
+	if (!options.skipLocalBuild) {
+		let dockerAvailable = false;
+		try {
+			await execa("docker", ["--version"], { stdio: "pipe" });
+			dockerAvailable = true;
+		} catch {
+			spinner.warn("Docker not found — skipping local build check");
+		}
+		if (dockerAvailable) {
+			spinner.start("Running local Docker build check...");
+			try {
+				await execa("docker", [
+					"build",
+					"-t",
+					`${serviceName}-check`,
+					"."
+				], {
+					cwd,
+					stdio: "pipe"
+				});
+				spinner.succeed("Local Docker build passed");
+			} catch (buildErr) {
+				spinner.fail("Local Docker build failed");
+				const buildError = buildErr;
+				if (buildError.stderr) {
+					console.log();
+					console.log(chalk.gray(buildError.stderr));
+				}
+				console.log();
+				console.log(chalk.red("Fix the Dockerfile errors above before deploying."));
+				console.log(chalk.gray("Tip: Use --skip-local-build to bypass this check."));
+				console.log();
+				process.exit(1);
+			}
+			console.log();
+		}
+	}
+	try {
+		const dbResult = await provisionDatabase(tursoConfig, serviceName, options.dbRegion, {
+			onGroupCreating: () => {
+				spinner.start("Ensuring Turso database group...");
+			},
+			onGroupReady: () => {
+				spinner.succeed("Database group ready");
+			},
+			onDatabaseCreating: (name) => {
+				spinner.start(`Creating database "${name}"...`);
+			},
+			onDatabaseReady: (name) => {
+				spinner.succeed(`Database "${name}" ready`);
+			},
+			onTokenCreating: () => {
+				spinner.start("Creating database auth token...");
+			},
+			onTokenReady: () => {
+				spinner.succeed("Auth token created");
+			}
+		});
+		if (!dbResult.success) {
+			spinner.fail("Turso provisioning failed");
+			console.log();
+			console.log(chalk.red("Error:") + " " + dbResult.error.message);
+			if (dbResult.error.details) console.log(chalk.gray("Details: ") + dbResult.error.details);
+			console.log();
+			process.exit(1);
+		}
+		const database = dbResult.value;
+		console.log();
+		console.log(chalk.gray("Database URL: ") + chalk.cyan(database.url));
+		console.log();
+		const deployResult = await deployToCloudRun({
+			gcpProject,
+			region,
+			serviceName,
+			sourceDir: cwd,
+			requireAuth: options.requireAuth,
+			envVars: {
+				DATABASE_URL: database.url,
+				DATABASE_AUTH_TOKEN: database.authToken,
+				NODE_ENV: "production",
+				FLUID_COMPANY_API_KEY: fluidResult.value.apiKey
+			}
+		}, {
+			onValidating: () => {
+				spinner.start("Preparing Cloud Run deployment...");
+			},
+			onDeploying: () => {
+				spinner.text = "Deploying to Cloud Run (this may take 2-5 minutes)...";
+			},
+			onDeployComplete: () => {
+				spinner.succeed("Deployed to Cloud Run");
+			}
+		});
+		if (!deployResult.success) {
+			spinner.fail("Cloud Run deployment failed");
+			console.log();
+			console.log(chalk.red("Error:") + " " + deployResult.error.message);
+			if (deployResult.error.details) console.log(chalk.gray("Details: ") + deployResult.error.details);
+			console.log();
+			process.exit(1);
+		}
+		console.log();
+		console.log(chalk.green.bold("Deployed successfully!"));
+		console.log();
+		console.log(chalk.gray("Service URL:  ") + chalk.cyan(deployResult.value.url));
+		console.log(chalk.gray("Database:     ") + chalk.cyan(database.databaseName));
+		console.log(chalk.gray("Region:       ") + chalk.cyan(deployResult.value.region));
+		console.log(chalk.gray("GCP Project:  ") + chalk.cyan(deployResult.value.gcpProject));
+		console.log();
+		if (!options.skipNavSync) {
+			const configPath = path.join(cwd, "src", "navigation.config.ts");
+			if (await fs.pathExists(configPath)) {
+				const navSpinner = ora("Extracting navigation from navigation.config.ts...").start();
+				const extractResult = await extractNavigation(cwd);
+				if (extractResult.success && extractResult.value != null) {
+					const navItems = extractResult.value;
+					navSpinner.text = `Syncing ${navItems.length} navigation item(s)...`;
+					const syncResult = await syncNavigation(fluidResult.value.apiKey, navItems);
+					if (syncResult.success) {
+						const { created, updated, deleted } = syncResult.value;
+						const parts = [];
+						if (created > 0) parts.push(`${created} created`);
+						if (updated > 0) parts.push(`${updated} updated`);
+						if (deleted > 0) parts.push(`${deleted} deleted`);
+						if (parts.length > 0) navSpinner.succeed(`Navigation synced (${parts.join(", ")})`);
+						else navSpinner.succeed("Navigation up to date");
+					} else {
+						navSpinner.warn("Navigation sync failed (deploy succeeded)");
+						console.log(chalk.yellow("  Warning: ") + syncResult.error.message);
+						if (syncResult.error.details) console.log(chalk.gray("  Details: ") + syncResult.error.details);
+					}
+				} else if (extractResult.success && extractResult.value == null) navSpinner.info("No navigation export found in navigation.config.ts — skipping sync");
+				else {
+					navSpinner.warn("Could not extract navigation (deploy succeeded)");
+					if (!extractResult.success && extractResult.error.details) console.log(chalk.gray("  Details: ") + extractResult.error.details);
+				}
+			}
+		}
+		const serviceUrl = deployResult.value.url;
+		const healthSpinner = ora("Running health check...").start();
+		try {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 3e4);
+			const healthRes = await fetch(`${serviceUrl}/api/health`, { signal: controller.signal });
+			clearTimeout(timeout);
+			if (healthRes.ok) healthSpinner.succeed("Health check passed");
+			else healthSpinner.warn("Health check returned non-200 (service may still be starting)");
+		} catch {
+			healthSpinner.warn("Health check timed out (cold start may take a moment)");
+		}
+		if (options.migrate || database.isNew) {
+			if (database.isNew && !options.migrate) {
+				console.log();
+				console.log(chalk.blue("New database") + " — running migrations automatically...");
+			}
+			const migrateCmd = getRunCommand("db:push");
+			const migrateSpinner = ora(`Running migrations (${migrateCmd})...`).start();
+			try {
+				const [pmBin, ...pmArgs] = migrateCmd.split(" ");
+				await execa(pmBin, pmArgs, {
+					cwd,
+					stdio: "pipe",
+					env: {
+						...process.env,
+						DATABASE_URL: database.url,
+						DATABASE_AUTH_TOKEN: database.authToken
+					}
+				});
+				migrateSpinner.succeed("Database migrations complete");
+			} catch (migrateErr) {
+				const migrateError = migrateErr;
+				migrateSpinner.warn("Database migration failed (deploy succeeded)");
+				console.log();
+				console.log(chalk.yellow("Migration error:") + " " + (migrateError.stderr ?? migrateError.message ?? String(migrateErr)));
+				console.log();
+				console.log("Run migrations manually:");
+				console.log(`  DATABASE_URL=${database.url} DATABASE_AUTH_TOKEN=<token> ${migrateCmd}`);
+			}
+		} else {
+			console.log();
+			console.log(chalk.yellow("Important:") + " Run database migrations against your production database:");
+			console.log(`  DATABASE_URL=${database.url} DATABASE_AUTH_TOKEN=<token> pnpm db:push`);
+			console.log(chalk.gray("Tip: Use --migrate to run migrations automatically."));
+		}
+		console.log();
+	} catch (error) {
+		spinner.fail("Deployment failed");
+		console.log();
+		const errorMessage = getErrorMessage(error);
+		console.log(chalk.red("Error:") + " " + errorMessage);
+		console.log();
+		process.exit(1);
+	}
+});
+function registerDeployCommand(ctx) {
+	ctx.program.addCommand(deployCommand);
+}
+//#endregion
+//#region src/commands/destroy.ts
+const destroyCommand = new Command("destroy").description("Tear down deployed Cloud Run service and Turso database").option("--region <region>", "Cloud Run region", "us-central1").option("--gcp-project <id>", "GCP project ID (default: from gcloud config)").option("-p, --project <name>", "Service name override (default: from package.json)").option("--turso-org <slug>", "Turso organization slug (skips interactive org selection)").option("--fluid-company-api-key <key>", "Fluid company API key (skips env var lookup and prompt)").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+	const cwd = process.cwd();
+	config({ path: path.join(cwd, ".env") });
+	console.log();
+	console.log(chalk.red.bold("Fluid Destroy") + chalk.gray(" (Cloud Run + Turso)"));
+	console.log();
+	const spinner = ora();
+	spinner.start("Validating Fluid API key...");
+	const fluidResult = await resolveFluidApiKey(options.fluidCompanyApiKey);
+	if (!fluidResult.success) {
+		spinner.fail("Fluid API key validation failed");
+		console.log();
+		console.log(chalk.red("Error:") + " " + fluidResult.error.message);
+		if (fluidResult.error.details) {
+			console.log();
+			console.log(fluidResult.error.details);
+		}
+		console.log();
+		process.exit(1);
+	}
+	spinner.succeed(`Fluid company: ${chalk.cyan(fluidResult.value.name)}`);
+	spinner.start("Checking gcloud CLI...");
+	const gcloudResult = await validateGcloudInstalled();
+	if (!gcloudResult.success) {
+		spinner.fail("gcloud CLI not found");
+		console.log();
+		console.log(chalk.red("Error:") + " " + gcloudResult.error.message);
+		console.log();
+		process.exit(1);
+	}
+	const authResult = await validateGcloudAuth();
+	if (!authResult.success) {
+		spinner.fail("gcloud not authenticated");
+		console.log();
+		console.log(chalk.red("Error:") + " " + authResult.error.message);
+		console.log();
+		process.exit(1);
+	}
+	spinner.succeed("gcloud CLI ready");
+	let gcpProject = options.gcpProject;
+	if (!gcpProject) {
+		spinner.start("Detecting GCP project...");
+		const projectResult = await getGcpProject();
+		if (!projectResult.success) {
+			spinner.fail("No GCP project configured");
+			console.log();
+			console.log(chalk.red("Error:") + " " + projectResult.error.message);
+			console.log();
+			process.exit(1);
+		}
+		gcpProject = projectResult.value;
+		spinner.succeed(`GCP project: ${chalk.cyan(gcpProject)}`);
+	}
+	spinner.start("Resolving Turso credentials...");
+	const tursoConfigResult = await resolveTursoConfig(options.tursoOrg);
+	if (!tursoConfigResult.success) {
+		spinner.fail("Turso credentials not found");
+		console.log();
+		console.log(chalk.red("Error:") + " " + tursoConfigResult.error.message);
+		if (tursoConfigResult.error.details) {
+			console.log();
+			console.log(tursoConfigResult.error.details);
+		}
+		console.log();
+		process.exit(1);
+	}
+	const tursoConfig = tursoConfigResult.value;
+	spinner.succeed("Turso credentials resolved");
+	const projectName = options.project ?? await getProjectName(cwd);
+	if (!projectName) {
+		console.log(chalk.red("Error:") + " Could not determine project name.");
+		console.log();
+		console.log("Either:");
+		console.log("  - Add a " + chalk.cyan("name") + " field to package.json");
+		console.log("  - Use the " + chalk.cyan("--project <name>") + " flag");
+		console.log();
+		process.exit(1);
+	}
+	const serviceName = sanitizeServiceName(projectName);
+	if (!serviceName) {
+		console.log(chalk.red("Error:") + " Project name sanitizes to an empty service name.");
+		console.log();
+		console.log("Use the " + chalk.cyan("--project <name>") + " flag to provide a valid service name.");
+		console.log();
+		process.exit(1);
+	}
+	const region = options.region ?? "us-central1";
+	console.log();
+	console.log(chalk.yellow("The following resources will be destroyed:"));
+	console.log();
+	console.log(chalk.gray("  Cloud Run service: ") + chalk.white(serviceName));
+	console.log(chalk.gray("  Region:            ") + chalk.white(region));
+	console.log(chalk.gray("  GCP Project:       ") + chalk.white(gcpProject));
+	console.log(chalk.gray("  Turso database:    ") + chalk.white(serviceName));
+	console.log(chalk.gray("  Turso org:         ") + chalk.white(tursoConfig.org));
+	console.log();
+	if (!options.yes) {
+		const { confirmed } = await prompts({
+			type: "confirm",
+			name: "confirmed",
+			message: "Are you sure you want to destroy these resources?",
+			initial: false
+		});
+		if (!confirmed) {
+			console.log();
+			console.log(chalk.gray("Destroy cancelled."));
+			console.log();
+			return;
+		}
+	}
+	console.log();
+	spinner.start(`Deleting Cloud Run service "${serviceName}"...`);
+	const deleteServiceResult = await deleteCloudRunService({
+		serviceName,
+		gcpProject,
+		region
+	});
+	if (!deleteServiceResult.success) {
+		spinner.warn("Cloud Run service deletion failed");
+		console.log(chalk.yellow("Warning:") + " " + deleteServiceResult.error.message);
+		if (deleteServiceResult.error.details) console.log(chalk.gray("Details: ") + deleteServiceResult.error.details);
+	} else spinner.succeed("Cloud Run service deleted");
+	spinner.start(`Deleting Turso database "${serviceName}"...`);
+	const deleteDbResult = await deleteDatabase(tursoConfig, serviceName);
+	if (!deleteDbResult.success) {
+		spinner.warn("Turso database deletion failed");
+		console.log(chalk.yellow("Warning:") + " " + deleteDbResult.error.message);
+		if (deleteDbResult.error.details) console.log(chalk.gray("Details: ") + deleteDbResult.error.details);
+	} else spinner.succeed("Turso database deleted");
+	console.log();
+	if (deleteServiceResult.success && deleteDbResult.success) console.log(chalk.green.bold("All resources destroyed successfully."));
+	else console.log(chalk.yellow.bold("Destroy completed with warnings.") + " Some resources may need manual cleanup.");
+	console.log();
+});
+function registerDestroyCommand(ctx) {
+	ctx.program.addCommand(destroyCommand);
+}
+//#endregion
+//#region src/index.ts
+const plugin = {
+	name: "fluid-cli-portal",
+	version: "0.1.0",
+	async register(ctx) {
+		registerCreateCommand(ctx);
+		registerDevCommand(ctx);
+		registerBuildCommand(ctx);
+		registerDeployCommand(ctx);
+		registerDestroyCommand(ctx);
+	}
+};
+//#endregion
+export { CLOUD_RUN_ERRORS, FILE_SYSTEM_ERRORS, FLUID_API_ERROR, TEMPLATES, TURSO_ERROR, copyTemplate, copyTemplateSafe, createCommand, createDatabase, createDatabaseToken, createDirectory, createDirectorySafe, plugin as default, deleteCloudRunService, deleteDatabase, deployToCloudRun, destroyCommand, directoryExists, ensureGroup, failure, fetchLocations, fileExists, getErrorMessage, getGcpProject, getInstallCommand, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, installDependencies, isError, isFailure, isNodeError, isSuccess, isTemplateName, mapError, mapResult, parseOrgList, pathExists, promptProjectConfig, provisionDatabase, readFileSafe, resolveFluidApiKey, resolveTursoConfig, runPackageManager, success, tryCatch, tryCatchAsync, unwrap, unwrapOr, validateFluidApiKey, validateGcloudAuth, validateGcloudInstalled, validateLocation, validateTursoConfig, writeFileSafe };
+
+//# sourceMappingURL=index.mjs.map