@gonvex/cli 0.1.8 → 0.1.10

package/dist/index.js

@@ -2,14 +2,35 @@
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { mkdir, readFile, readdir, stat, writeFile, copyFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, readdir, rm, stat, writeFile, copyFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { dirname, join, relative, resolve } from "node:path";
+import { Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
 const defaultRuntimeURL = "http://localhost:8080";
 const runtimeSyncRetryMs = 5000;
 const runtimeStateCheckMs = 2500;
 const supportsColor = process.env.NO_COLOR === undefined && (process.env.FORCE_COLOR !== undefined || process.stdout.isTTY);
+const defaultAccountTokenPermissions = ["projects:read", "projects:create", "projects:keys:read"];
+const accountTokenPermissions = [
+    "projects:read",
+    "projects:create",
+    "projects:update",
+    "projects:delete",
+    "projects:keys:read",
+    "projects:members:read",
+    "projects:members:write",
+    "projects:env:read",
+    "projects:env:write",
+    "projects:*",
+    "admin:projects",
+    "tokens:read",
+    "tokens:create",
+    "tokens:revoke",
+    "tokens:*",
+    "*",
+];
 function ansi(code, value) {
     return supportsColor ? `\x1b[${code}m${value}\x1b[0m` : value;
 }
@@ -42,20 +63,110 @@ export async function main(argv = process.argv.slice(2)) {
         await runEnv(argv.slice(1));
         return;
     }
+    if (command === "auth") {
+        await runAuth(argv.slice(1));
+        return;
+    }
+    if (command === "login") {
+        await runLogin(argv.slice(1));
+        return;
+    }
+    if (command === "logout") {
+        await runLogout(argv.slice(1));
+        return;
+    }
+    if (command === "whoami") {
+        await runWhoAmI(argv.slice(1));
+        return;
+    }
+    if (command === "token" || command === "tokens") {
+        await runToken(argv.slice(1));
+        return;
+    }
+    if (command === "project") {
+        await runProject(argv.slice(1));
+        return;
+    }
     printHelp();
     throw new Error(`unknown command ${command}`);
 }
 export async function runCreate(argv) {
-    const target = argv.find((arg) => !arg.startsWith("-")) ?? "my-gonvex-app";
+    const optionNames = ["--template", "--runtime-url", "--runtime", "--database-mode", "--origin", "--callback-path", "--signup-mode", "--owner"];
+    const target = positionalArgs(argv, optionNames)[0] ?? "my-gonvex-app";
     const appName = basename(target);
     const template = valueFor(argv, "--template") ?? "vite-react";
+    const runtimeURL = (valueFor(argv, "--runtime-url") ?? valueFor(argv, "--runtime") ?? defaultRuntimeURL).replace(/\/$/, "");
+    const databaseMode = valueFor(argv, "--database-mode") ?? "single";
+    if (databaseMode !== "single" && databaseMode !== "multiTenant")
+        throw new Error("--database-mode must be single or multiTenant");
+    const googleAuth = argv.includes("--google-auth");
+    const signupMode = normalizeAuthSignupMode(valueFor(argv, "--signup-mode") ?? "personal");
+    const ownerEmail = valueFor(argv, "--owner")?.trim() ?? "";
+    if (googleAuth && signupMode === "inviteOnly" && !ownerEmail) {
+        throw new Error("--owner <verified-google-email> is required when creating an invite-only Google app");
+    }
+    const shouldProvision = googleAuth || argv.includes("--provision") || Boolean(valueFor(argv, "--runtime-url") ?? valueFor(argv, "--runtime"));
     const root = resolve(target);
     if (existsSync(root))
         throw new Error(`${target} already exists`);
-    await copyTemplate(template, root);
-    await rewritePackageName(root, appName);
-    await rewriteGonvexConfig(root, appName, defaultRuntimeURL);
-    await writeEnvLocal(root, appName, defaultRuntimeURL);
+    let created = null;
+    let provisioningAccountToken;
+    try {
+        await copyTemplate(template, root);
+        await rewritePackageName(root, appName);
+        await rewriteGonvexConfig(root, appName, runtimeURL);
+        if (shouldProvision) {
+            provisioningAccountToken = await accountAccessTokenForRuntime(runtimeURL);
+            created = await createRuntimeProject(runtimeURL, appName, provisioningAccountToken, databaseMode);
+            await rewriteGonvexConfig(root, created.project.id, runtimeURL);
+            await writeProjectEnv(root, runtimeURL, created.project.id, created.projectKey, true);
+            if (googleAuth) {
+                const authArgs = ["add", "google", "--project", root, "--signup-mode", signupMode];
+                const callbackPath = valueFor(argv, "--callback-path");
+                if (callbackPath)
+                    authArgs.push("--callback-path", callbackPath);
+                const suppliedOrigins = valuesFor(argv, "--origin");
+                const origins = suppliedOrigins.length > 0 ? suppliedOrigins : [
+                    process.env.GONVEX_APP_ORIGIN ?? process.env.VITE_APP_URL ?? "http://localhost:5173",
+                ];
+                for (const origin of origins)
+                    authArgs.push("--origin", origin);
+                await runAuth(authArgs);
+                if (signupMode === "inviteOnly") {
+                    if (databaseMode === "multiTenant") {
+                        await runAuth(["tenants", "create", `${appName} workspace`, "--owner", ownerEmail, "--project", root]);
+                    }
+                    else {
+                        await runAuth(["memberships", "add", "--tenant", created.project.id, "--email", ownerEmail, "--role", "owner", "--project", root]);
+                    }
+                }
+                const hasProductionOrigin = origins.some((origin) => normalizeAppOrigin(origin).startsWith("https://"));
+                if (hasProductionOrigin && !argv.includes("--allow-unready")) {
+                    await runAuth(["doctor", "--project", root]);
+                }
+            }
+        }
+        else {
+            await writeEnvLocal(root, appName, runtimeURL);
+        }
+    }
+    catch (error) {
+        if (created) {
+            try {
+                await runtimeJSON(await fetch(`${runtimeURL}/dev/projects/${encodeURIComponent(created.project.id)}`, {
+                    method: "DELETE",
+                    headers: provisioningAccountToken
+                        ? accountHeaders(provisioningAccountToken)
+                        : projectAuthHeaders({ runtimeURL, projectID: created.project.id, key: created.projectKey }),
+                }));
+            }
+            catch (cleanupError) {
+                console.warn(`[gonvex] could not roll back runtime project ${created.project.id}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+            }
+        }
+        await rm(root, { recursive: true, force: true });
+        throw error;
+    }
     console.log(`[gonvex] created ${target} from ${template} template`);
     console.log(`[gonvex] next: cd ${target} && npm install && npm run dev`);
 }
@@ -67,6 +178,205 @@ async function runInit(argv) {
     await writeEnvLocal(process.cwd(), project, runtime);
     console.log(`[gonvex] initialized ${project}`);
 }
+async function runLogin(argv) {
+    const runtimeURL = await accountRuntimeForArgs(argv);
+    const suppliedToken = valueFor(argv, "--token") ?? process.env.GONVEX_ACCOUNT_TOKEN;
+    let accessToken;
+    let expiresAt;
+    if (suppliedToken) {
+        accessToken = suppliedToken.trim();
+        if (!accessToken)
+            throw new Error("--token requires a non-empty personal access token");
+    }
+    else {
+        const positional = positionalArgs(argv, ["--runtime-url", "--runtime", "--email", "--password", "--token"]);
+        let email = valueFor(argv, "--email") ?? positional[0] ?? "";
+        let password = valueFor(argv, "--password") ?? process.env.GONVEX_PASSWORD ?? "";
+        if ((!email || !password) && (!process.stdin.isTTY || !process.stdout.isTTY)) {
+            throw new Error("non-interactive login requires --email and --password (or GONVEX_PASSWORD), or --token");
+        }
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            if (!email)
+                email = (await rl.question("Email: ")).trim();
+        }
+        finally {
+            rl.close();
+        }
+        if (!password)
+            password = await promptHidden("Password: ");
+        if (!email || !password)
+            throw new Error("email and password are required");
+        const response = await fetch(`${runtimeURL}/dev/auth/login`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ email, password }),
+        });
+        const payload = await runtimeJSON(response);
+        accessToken = payload.session?.accessToken ?? "";
+        expiresAt = payload.session?.expiresAt;
+        if (!accessToken)
+            throw new Error("runtime login did not return an account session");
+    }
+    const identity = await fetchAccountIdentity(runtimeURL, accessToken);
+    await saveAccountProfile(runtimeURL, accessToken, identity, expiresAt);
+    console.log(`[gonvex] logged in as ${identity.account.email} to ${runtimeURL}`);
+}
+async function runLogout(argv) {
+    const runtimeURL = await accountRuntimeForArgs(argv);
+    const removed = await removeAccountProfile(runtimeURL);
+    if (removed)
+        console.log(`[gonvex] logged out of ${runtimeURL}`);
+    else
+        console.log(`[gonvex] no saved login for ${runtimeURL}`);
+}
+async function runWhoAmI(argv) {
+    const runtimeURL = await accountRuntimeForArgs(argv);
+    const accessToken = await requireAccountAccessToken(runtimeURL);
+    const identity = await fetchAccountIdentity(runtimeURL, accessToken);
+    if (argv.includes("--json")) {
+        console.log(JSON.stringify({ runtimeURL, ...identity }, null, 2));
+        return;
+    }
+    console.log(`${identity.account.email} (${identity.account.role})`);
+    console.log(`Runtime: ${runtimeURL}`);
+    console.log(`Authentication: ${identity.authentication}`);
+    console.log(`Permissions: ${identity.permissions.join(", ")}`);
+}
+async function runToken(argv) {
+    const commandArgs = positionalArgs(argv, ["--runtime-url", "--runtime", "--permission", "--expires-at"]);
+    const action = commandArgs[0];
+    if (!action || action === "help" || action === "--help") {
+        printTokenHelp();
+        return;
+    }
+    if (action === "permissions") {
+        for (const permission of accountTokenPermissions)
+            console.log(permission);
+        return;
+    }
+    const runtimeURL = await accountRuntimeForArgs(argv);
+    const accessToken = await requireAccountAccessToken(runtimeURL);
+    if (action === "list" || action === "ls") {
+        const response = await fetch(`${runtimeURL}/dev/auth/tokens`, { headers: accountHeaders(accessToken) });
+        const payload = await runtimeJSON(response);
+        const tokens = payload.tokens ?? [];
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(tokens, null, 2));
+            return;
+        }
+        if (tokens.length === 0) {
+            console.log("[gonvex] no account tokens");
+            return;
+        }
+        for (const token of tokens) {
+            const state = token.revokedAt ? "revoked" : token.expiresAt && Date.parse(token.expiresAt) <= Date.now() ? "expired" : "active";
+            console.log(`${token.id}\t${token.name}\t${state}\t${token.permissions.join(",")}`);
+        }
+        return;
+    }
+    if (action === "create") {
+        const positional = positionalArgs(argv, ["--runtime-url", "--runtime", "--permission", "--expires-at"]);
+        const name = positional[1] ?? "CLI provisioning";
+        let permissions = valuesFor(argv, "--permission").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
+        if (argv.includes("--full"))
+            permissions = ["*"];
+        if (permissions.length === 0)
+            permissions = defaultAccountTokenPermissions;
+        const unknown = permissions.find((permission) => !accountTokenPermissions.includes(permission));
+        if (unknown)
+            throw new Error(`unknown account token permission ${unknown}; run 'gonvex token permissions' to list valid values`);
+        const response = await fetch(`${runtimeURL}/dev/auth/tokens`, {
+            method: "POST",
+            headers: { ...accountHeaders(accessToken), "content-type": "application/json" },
+            body: JSON.stringify({ name, permissions, expiresAt: valueFor(argv, "--expires-at") }),
+        });
+        const payload = await runtimeJSON(response);
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(payload, null, 2));
+            return;
+        }
+        console.error(`[gonvex] created account token ${payload.token.id}; copy it now because it will not be shown again:`);
+        console.log(payload.accessToken);
+        return;
+    }
+    if (action === "revoke" || action === "delete" || action === "rm") {
+        const positional = positionalArgs(argv, ["--runtime-url", "--runtime"]);
+        const id = positional[1];
+        if (!id)
+            throw new Error("usage: gonvex token revoke <token-id>");
+        const response = await fetch(`${runtimeURL}/dev/auth/tokens/${encodeURIComponent(id)}`, {
+            method: "DELETE",
+            headers: accountHeaders(accessToken),
+        });
+        await runtimeJSON(response);
+        console.log(`[gonvex] revoked account token ${id}`);
+        return;
+    }
+    printTokenHelp();
+    throw new Error(`unknown token command ${action}`);
+}
+async function runProject(argv) {
+    const commandArgs = positionalArgs(argv, ["--runtime-url", "--runtime", "--database-mode", "--project-root"]);
+    const action = commandArgs[0];
+    if (!action || action === "help" || action === "--help") {
+        printProjectHelp();
+        return;
+    }
+    const runtimeURL = await accountRuntimeForArgs(argv);
+    const accountToken = await accountAccessTokenForRuntime(runtimeURL);
+    if (action === "list" || action === "ls") {
+        const projects = await fetchRuntimeProjects(runtimeURL, accountToken);
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(projects, null, 2));
+            return;
+        }
+        if (projects.length === 0) {
+            console.log("[gonvex] no projects");
+            return;
+        }
+        for (const project of projects)
+            console.log(`${project.id}\t${project.name}\t${project.environment ?? ""}\t${project.database ?? ""}`);
+        return;
+    }
+    if (action === "create") {
+        const positional = positionalArgs(argv, ["--runtime-url", "--runtime", "--database-mode", "--project-root"]);
+        const projectRoot = resolve(valueFor(argv, "--project-root") ?? ".");
+        if (!existsSync(projectRoot))
+            throw new Error(`project root ${projectRoot} does not exist`);
+        const name = positional[1] ?? basename(projectRoot);
+        const databaseMode = valueFor(argv, "--database-mode") ?? "single";
+        if (databaseMode !== "single" && databaseMode !== "multiTenant")
+            throw new Error("--database-mode must be single or multiTenant");
+        const created = await createRuntimeProject(runtimeURL, name, accountToken, databaseMode);
+        await writeProjectEnv(projectRoot, runtimeURL, created.project.id, created.projectKey, true);
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(created, null, 2));
+            return;
+        }
+        console.log(`[gonvex] created and configured ${created.project.name} (${created.project.id})`);
+        return;
+    }
+    if (action === "select" || action === "link") {
+        const positional = positionalArgs(argv, ["--runtime-url", "--runtime", "--project-root"]);
+        const id = positional[1];
+        if (!id)
+            throw new Error("usage: gonvex project select <project-id>");
+        const projectRoot = resolve(valueFor(argv, "--project-root") ?? ".");
+        if (!existsSync(projectRoot))
+            throw new Error(`project root ${projectRoot} does not exist`);
+        const projects = await fetchRuntimeProjects(runtimeURL, accountToken);
+        const project = projects.find((candidate) => candidate.id === id);
+        if (!project)
+            throw new Error(`project ${id} was not found or is not accessible`);
+        const projectKey = await fetchRuntimeProjectKey(runtimeURL, id, accountToken);
+        await writeProjectEnv(projectRoot, runtimeURL, id, projectKey, true);
+        console.log(`[gonvex] configured ${project.name} (${id})`);
+        return;
+    }
+    printProjectHelp();
+    throw new Error(`unknown project command ${action}`);
+}
 async function runDev(argv) {
     const split = argv.indexOf("--");
     const flagArgs = split === -1 ? argv : argv.slice(0, split);
@@ -161,6 +471,36 @@ async function runEnv(argv) {
         console.log(`[gonvex] saved ${parsed.name} for ${settings.projectID}`);
         return;
     }
+    if (action === "push" || action === "upload") {
+        const optionPath = parsedArgs.options["--file"];
+        if (optionPath && parsedArgs.positional.length > 0) {
+            throw new Error("pass the env file either as FILE or --file, not both");
+        }
+        if (parsedArgs.positional.length > 1)
+            throw new Error("usage: gonvex env push FILE");
+        const file = optionPath ?? parsedArgs.positional[0];
+        if (!file)
+            throw new Error("usage: gonvex env push FILE");
+        const envPath = resolve(projectRoot, file);
+        let content;
+        try {
+            content = await readFile(envPath, "utf8");
+        }
+        catch (error) {
+            throw new Error(`could not read env file ${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const names = dotEnvVariableNames(content);
+        if (names.length === 0)
+            throw new Error(`env file ${file} contains no variables; refusing to replace the project env with an empty set`);
+        const credentialName = names.find((name) => ["GONVEX_PROJECT_KEY", "GONVEX_DEPLOY_KEY", "GONVEX_KEY"].includes(name));
+        if (credentialName) {
+            throw new Error(`env file ${file} contains ${credentialName}; keep CLI project credentials out of uploaded function environment variables`);
+        }
+        const count = await replaceProjectEnv(settings, content);
+        const displayPath = relative(projectRoot, envPath) || file;
+        console.log(`[gonvex] replaced project env for ${settings.projectID} with ${count} variable(s) from ${displayPath}`);
+        return;
+    }
     if (action === "remove" || action === "rm" || action === "unset" || action === "delete") {
         const name = parsedArgs.positional[0];
         if (!name)
@@ -172,6 +512,373 @@ async function runEnv(argv) {
     printEnvHelp();
     throw new Error(`unknown env command ${action}`);
 }
+export async function runAuth(argv) {
+    const optionsWithValues = ["--project", "--runtime-url", "--project-id", "--key", "--origin", "--callback-path", "--signup-mode", "--tenant", "--email", "--owner", "--role", "--user"];
+    const positional = positionalArgs(argv, optionsWithValues);
+    const action = positional[0];
+    if (!action || action === "help") {
+        printAuthHelp();
+        return;
+    }
+    const projectRoot = resolve(valueFor(argv, "--project") ?? ".");
+    const settings = await loadSettings(projectRoot, {
+        runtimeURL: valueFor(argv, "--runtime-url"),
+        projectID: valueFor(argv, "--project-id"),
+        key: valueFor(argv, "--key"),
+    });
+    if (!settings.key)
+        throw new Error("GONVEX_PROJECT_KEY is required for project auth commands");
+    const endpoint = `${settings.runtimeURL}/dev/projects/${encodeURIComponent(settings.projectID)}/auth/google`;
+    if (action === "add" || action === "enable") {
+        const provider = positional[1];
+        if (provider !== "google")
+            throw new Error("usage: gonvex auth add google [--origin URL]");
+        const callbackPath = normalizeAuthCallbackPath(valueFor(argv, "--callback-path") ?? "/");
+        const signupMode = normalizeAuthSignupMode(valueFor(argv, "--signup-mode") ?? "personal");
+        const suppliedOrigins = valuesFor(argv, "--origin");
+        const rawOrigins = suppliedOrigins.length > 0 ? suppliedOrigins : [
+            process.env.GONVEX_APP_ORIGIN ?? process.env.VITE_APP_URL ?? "http://localhost:5173",
+        ];
+        const redirectUris = [...new Set(rawOrigins.map((raw) => new URL(callbackPath, `${normalizeAppOrigin(raw)}/`).toString()))];
+        let configured = null;
+        for (const redirectUri of redirectUris) {
+            configured = await runtimeJSON(await fetch(endpoint, {
+                method: "PUT",
+                headers: { ...projectAuthHeaders(settings), "content-type": "application/json" },
+                body: JSON.stringify({ redirectUri, signupMode }),
+            }));
+        }
+        await saveGoogleAuthProjectConfig(projectRoot, callbackPath, redirectUris, signupMode);
+        await writeGonvexAuthModule(projectRoot, settings, callbackPath);
+        const wired = await wireViteReactGoogleAuth(projectRoot);
+        console.log(`[gonvex] enabled Google auth for ${settings.projectID}`);
+        for (const redirectUri of redirectUris)
+            console.log(`[gonvex] registered callback ${redirectUri}`);
+        console.log(`[gonvex] wrote gonvex/auth.tsx; wrap your app with GonvexAuthProvider and render GoogleSignInButton`);
+        if (wired)
+            console.log("[gonvex] wired the Vite React starter with a production-ready sign-in screen");
+        if (!configured?.ready) {
+            console.warn(`[gonvex] Google auth is registered but the runtime is not production-ready: ${(configured?.issues ?? ["runtime broker configuration is incomplete"]).join("; ")}`);
+        }
+        return;
+    }
+    if (action === "remove" || action === "disable") {
+        const provider = positional[1];
+        if (provider !== "google")
+            throw new Error("usage: gonvex auth remove google");
+        const suppliedOrigins = valuesFor(argv, "--origin");
+        if (suppliedOrigins.length > 0) {
+            const localConfig = await loadConfig(projectRoot);
+            const callbackPath = normalizeAuthCallbackPath(valueFor(argv, "--callback-path") ?? localConfig.auth?.providers?.google?.callbackPath ?? "/");
+            const redirectUris = [...new Set(suppliedOrigins.map((raw) => new URL(callbackPath, `${normalizeAppOrigin(raw)}/`).toString()))];
+            for (const redirectUri of redirectUris) {
+                const url = new URL(endpoint);
+                url.searchParams.set("redirect_uri", redirectUri);
+                await runtimeJSON(await fetch(url, { method: "DELETE", headers: projectAuthHeaders(settings) }));
+            }
+            await removeGoogleAuthProjectRedirects(projectRoot, redirectUris);
+            for (const redirectUri of redirectUris)
+                console.log(`[gonvex] removed Google callback ${redirectUri}`);
+            return;
+        }
+        await runtimeJSON(await fetch(endpoint, { method: "DELETE", headers: projectAuthHeaders(settings) }));
+        await setGoogleAuthProjectEnabled(projectRoot, false);
+        console.log(`[gonvex] disabled Google auth for ${settings.projectID}`);
+        return;
+    }
+    if (action === "status") {
+        const configured = await runtimeJSON(await fetch(endpoint, { headers: projectAuthHeaders(settings) }));
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(configured, null, 2));
+            return;
+        }
+        console.log(`Google: ${configured.enabled ? "enabled" : "disabled"}`);
+        console.log(`Broker: ${configured.ready ? "ready" : "not ready"}`);
+        console.log(`Signup: ${configured.signupMode ?? "personal"}`);
+        for (const redirectUri of configured.redirectUris ?? [])
+            console.log(`Callback: ${redirectUri}`);
+        if (configured.brokerCallbackUrl)
+            console.log(`Google Cloud redirect URI: ${configured.brokerCallbackUrl}`);
+        for (const issue of configured.issues ?? [])
+            console.log(`Issue: ${issue}`);
+        return;
+    }
+    if (action === "doctor") {
+        const configured = await runtimeJSON(await fetch(endpoint, { headers: projectAuthHeaders(settings) }));
+        const localConfig = await loadConfig(projectRoot);
+        const localRedirects = localConfig.auth?.providers?.google?.redirectUris ?? [];
+        const missing = localRedirects.filter((redirectUri) => !(configured.redirectUris ?? []).includes(redirectUri));
+        const untracked = (configured.redirectUris ?? []).filter((redirectUri) => !localRedirects.includes(redirectUri));
+        const issues = [...(configured.issues ?? [])];
+        if (!configured.enabled)
+            issues.push("Google provider is disabled for this project");
+        for (const redirectUri of missing)
+            issues.push(`local callback is not registered: ${redirectUri}`);
+        for (const redirectUri of untracked)
+            issues.push(`runtime callback is not tracked in gonvex.json: ${redirectUri}`);
+        if ((configured.redirectUris ?? []).length === 0)
+            issues.push("no app callback is registered");
+        if (configured.signupMode === "inviteOnly" && (configured.tenantCount ?? 0) === 0)
+            issues.push("invite-only signup needs at least one tenant scope");
+        if (configured.signupMode === "inviteOnly" && (configured.membershipCount ?? 0) + (configured.invitationCount ?? 0) === 0)
+            issues.push("invite-only signup needs at least one member or invitation");
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify({ ...configured, issues, ready: configured.ready && issues.length === 0 }, null, 2));
+        }
+        else if (configured.ready && issues.length === 0) {
+            console.log(`[gonvex] Google auth is ready for production (${configured.brokerCallbackUrl})`);
+            for (const redirectUri of configured.redirectUris ?? [])
+                console.log(`Callback: ${redirectUri}`);
+        }
+        else {
+            for (const issue of issues)
+                console.error(`[gonvex] ${issue}`);
+        }
+        if (!configured.ready || issues.length > 0)
+            throw new Error("Google auth production readiness check failed");
+        return;
+    }
+    if (action === "users" || action === "accounts") {
+        const usersEndpoint = `${settings.runtimeURL}/dev/projects/${encodeURIComponent(settings.projectID)}/auth/users`;
+        const payload = await runtimeJSON(await fetch(usersEndpoint, { headers: projectAuthHeaders(settings) }));
+        const users = payload.users ?? [];
+        if (argv.includes("--json")) {
+            console.log(JSON.stringify(users, null, 2));
+            return;
+        }
+        if (users.length === 0) {
+            console.log(`[gonvex] no app accounts for ${settings.projectID}`);
+            return;
+        }
+        for (const user of users) {
+            console.log(`${user.id}\t${user.email ?? ""}\t${user.name ?? ""}\t${user.provider}`);
+        }
+        return;
+    }
+    if (action === "tenants" || action === "tenant") {
+        const operation = positional[1] ?? "list";
+        const tenantsEndpoint = `${settings.runtimeURL}/dev/projects/${encodeURIComponent(settings.projectID)}/auth/tenants`;
+        if (operation === "list" || operation === "ls") {
+            const payload = await runtimeJSON(await fetch(tenantsEndpoint, { headers: projectAuthHeaders(settings) }));
+            if (argv.includes("--json")) {
+                console.log(JSON.stringify(payload.tenants ?? [], null, 2));
+                return;
+            }
+            for (const tenant of payload.tenants ?? [])
+                console.log(`${tenant.id}\t${tenant.name}\t${tenant.memberCount} member(s)`);
+            return;
+        }
+        if (operation === "create") {
+            const name = positional[2];
+            if (!name)
+                throw new Error("usage: gonvex auth tenants create <name> [--owner email]");
+            const payload = await runtimeJSON(await fetch(tenantsEndpoint, {
+                method: "POST", headers: { ...projectAuthHeaders(settings), "content-type": "application/json" },
+                body: JSON.stringify({ name, ownerEmail: valueFor(argv, "--owner") ?? "" }),
+            }));
+            console.log(`[gonvex] created tenant ${payload.tenant.name} (${payload.tenant.id})`);
+            return;
+        }
+        throw new Error(`unknown auth tenants command ${operation}`);
+    }
+    if (action === "members" || action === "memberships") {
+        const operation = positional[1] ?? "list";
+        const tenant = valueFor(argv, "--tenant") ?? positional[2];
+        if (!tenant)
+            throw new Error("--tenant is required for membership commands");
+        const membershipEndpoint = `${settings.runtimeURL}/dev/projects/${encodeURIComponent(settings.projectID)}/auth/memberships?tenant=${encodeURIComponent(tenant)}`;
+        if (operation === "list" || operation === "ls") {
+            const payload = await runtimeJSON(await fetch(membershipEndpoint, { headers: projectAuthHeaders(settings) }));
+            if (argv.includes("--json")) {
+                console.log(JSON.stringify(payload, null, 2));
+                return;
+            }
+            for (const member of payload.members ?? [])
+                console.log(`${member.userId}\t${member.email}\t${member.role}\t${member.name}`);
+            for (const invitation of payload.invitations ?? [])
+                console.log(`invited\t${invitation.email}\t${invitation.role}\t${invitation.expiresAt ?? ""}`);
+            return;
+        }
+        if (operation === "add" || operation === "invite") {
+            const email = valueFor(argv, "--email") ?? positional[2];
+            if (!email)
+                throw new Error("--email is required when adding a membership");
+            const role = valueFor(argv, "--role") ?? "member";
+            await runtimeJSON(await fetch(membershipEndpoint, {
+                method: "PUT", headers: { ...projectAuthHeaders(settings), "content-type": "application/json" },
+                body: JSON.stringify({ email, role }),
+            }));
+            console.log(`[gonvex] granted ${role} access to ${email} for tenant ${tenant}`);
+            return;
+        }
+        if (operation === "remove" || operation === "rm") {
+            const user = valueFor(argv, "--user");
+            const email = valueFor(argv, "--email");
+            if (!user && !email)
+                throw new Error("--user is required to remove a member, or --email to revoke an invitation");
+            const target = user ? `user=${encodeURIComponent(user)}` : `email=${encodeURIComponent(email)}`;
+            await runtimeJSON(await fetch(`${membershipEndpoint}&${target}`, {
+                method: "DELETE", headers: projectAuthHeaders(settings),
+            }));
+            console.log(user
+                ? `[gonvex] removed ${user} from tenant ${tenant}`
+                : `[gonvex] revoked the invitation for ${email} from tenant ${tenant}`);
+            return;
+        }
+        throw new Error(`unknown auth memberships command ${operation}`);
+    }
+    if (action === "user") {
+        const operation = positional[1];
+        const user = valueFor(argv, "--user") ?? positional[2];
+        if (!operation || !user)
+            throw new Error("usage: gonvex auth user <disable|enable|delete> <user-id>");
+        const userEndpoint = `${settings.runtimeURL}/dev/projects/${encodeURIComponent(settings.projectID)}/auth/users/${encodeURIComponent(user)}`;
+        if (operation === "disable" || operation === "enable") {
+            await runtimeJSON(await fetch(userEndpoint, {
+                method: "PATCH", headers: { ...projectAuthHeaders(settings), "content-type": "application/json" },
+                body: JSON.stringify({ disabled: operation === "disable" }),
+            }));
+            console.log(`[gonvex] ${operation}d app account ${user}`);
+            return;
+        }
+        if (operation === "delete" || operation === "remove") {
+            await runtimeJSON(await fetch(userEndpoint, { method: "DELETE", headers: projectAuthHeaders(settings) }));
+            console.log(`[gonvex] deleted app account ${user}`);
+            return;
+        }
+        throw new Error(`unknown auth user command ${operation}`);
+    }
+    printAuthHelp();
+    throw new Error(`unknown auth command ${action}`);
+}
+function normalizeAppOrigin(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`invalid app origin ${raw}`);
+    }
+    if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+        throw new Error("--origin must contain only scheme, host, and optional port");
+    }
+    const local = ["localhost", "127.0.0.1", "[::1]", "::1"].includes(parsed.hostname);
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && local)) {
+        throw new Error("--origin must use https (http is allowed only for localhost)");
+    }
+    return parsed.origin;
+}
+function normalizeAuthCallbackPath(raw) {
+    const value = raw.trim();
+    if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#")) {
+        throw new Error("--callback-path must be an absolute pathname without a query or fragment");
+    }
+    return value;
+}
+function normalizeAuthSignupMode(raw) {
+    if (raw === "personal")
+        return raw;
+    if (raw === "inviteOnly" || raw === "invite-only" || raw === "invited")
+        return "inviteOnly";
+    throw new Error("--signup-mode must be personal or inviteOnly");
+}
+async function saveGoogleAuthProjectConfig(root, callbackPath, addedRedirectUris, signupMode) {
+    const configPath = join(root, "gonvex.json");
+    const config = await loadConfig(root);
+    const existing = config.auth?.providers?.google;
+    const redirectUris = [...new Set([...(existing?.redirectUris ?? []), ...addedRedirectUris])].sort();
+    config.auth = {
+        ...(config.auth ?? {}),
+        providers: {
+            ...(config.auth?.providers ?? {}),
+            google: { ...(existing ?? {}), enabled: true, callbackPath, redirectUris, signupMode },
+        },
+    };
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
+async function setGoogleAuthProjectEnabled(root, enabled) {
+    const configPath = join(root, "gonvex.json");
+    const config = await loadConfig(root);
+    const existing = config.auth?.providers?.google ?? {};
+    config.auth = {
+        ...(config.auth ?? {}),
+        providers: { ...(config.auth?.providers ?? {}), google: { ...existing, enabled } },
+    };
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
+async function removeGoogleAuthProjectRedirects(root, removedRedirectUris) {
+    const configPath = join(root, "gonvex.json");
+    const config = await loadConfig(root);
+    const existing = config.auth?.providers?.google ?? {};
+    const removed = new Set(removedRedirectUris);
+    config.auth = {
+        ...(config.auth ?? {}),
+        providers: {
+            ...(config.auth?.providers ?? {}),
+            google: { ...existing, redirectUris: (existing.redirectUris ?? []).filter((redirectUri) => !removed.has(redirectUri)) },
+        },
+    };
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
+async function writeGonvexAuthModule(root, settings, callbackPath) {
+    const source = [
+        "// Generated by `gonvex auth add google`. Re-running the command replaces this file.",
+        'import { createGonvexAuth } from "./_generated/react";',
+        "",
+        "const env = (import.meta as ImportMeta & { env?: Record<string, string | undefined> }).env ?? {};",
+        "",
+        "export const gonvexAuth = createGonvexAuth({",
+        `  runtimeUrl: env.VITE_GONVEX_URL ?? env.VITE_GONVEX_RUNTIME_URL ?? ${JSON.stringify(settings.runtimeURL)},`,
+        `  projectId: env.VITE_GONVEX_PROJECT_ID ?? ${JSON.stringify(settings.projectID)},`,
+        `  callbackPath: ${JSON.stringify(callbackPath)},`,
+        "});",
+        "",
+        "export const GonvexAuthProvider = gonvexAuth.GonvexAuthProvider;",
+        "export const GoogleSignInButton = gonvexAuth.GoogleSignInButton;",
+        "export const useGonvexAuth = gonvexAuth.useGonvexAuth;",
+        "",
+    ].join("\n");
+    await writeFileIfChanged(join(root, "gonvex", "auth.tsx"), source);
+}
+async function wireViteReactGoogleAuth(root) {
+    const mainPath = join(root, "src", "main.tsx");
+    const appPath = join(root, "src", "App.tsx");
+    if (!existsSync(mainPath) || !existsSync(appPath))
+        return false;
+    let main = await readFile(mainPath, "utf8");
+    let app = await readFile(appPath, "utf8");
+    if (main.includes('from "../gonvex/auth"') && app.includes("GoogleSignInButton"))
+        return true;
+    const providerImport = 'import { GonvexProvider } from "../gonvex/_generated/react";';
+    const reactImport = 'import { useMutation, useQuery } from "../gonvex/_generated/react";';
+    const appStart = 'export default function App(props: { runtimeURL: string }) {\n  const messages = useQuery<Message[]>(api["messages.list"], {}) ?? [];';
+    if (!main.includes(providerImport) || !main.includes("<GonvexProvider client={gonvex}>") || !app.includes(reactImport) || !app.includes(appStart)) {
+        return false;
+    }
+    main = main
+        .replace(providerImport, 'import { GonvexAuthProvider } from "../gonvex/auth";')
+        .replace("<GonvexProvider client={gonvex}>", "<GonvexAuthProvider client={gonvex}>")
+        .replace("</GonvexProvider>", "</GonvexAuthProvider>");
+    app = app
+        .replace(reactImport, `${reactImport}\nimport { GoogleSignInButton, useGonvexAuth } from "../gonvex/auth";`)
+        .replace(appStart, [
+        "export default function App(props: { runtimeURL: string }) {",
+        "  const auth = useGonvexAuth();",
+        "  if (!auth.isAuthenticated) {",
+        '    return <main className="shell"><section className="hero"><div className="status">Secure Gonvex account</div><h1>Sign in to continue.</h1><p>Your app uses Gonvex-native Google authentication—no Firebase SDK or per-app Google Cloud project.</p><GoogleSignInButton />{auth.error ? <p role="alert">{auth.error}</p> : null}</section></main>;',
+        "  }",
+        "  return <AuthenticatedApp runtimeURL={props.runtimeURL} />;",
+        "}",
+        "",
+        "function AuthenticatedApp(props: { runtimeURL: string }) {",
+        "  const auth = useGonvexAuth();",
+        '  const messages = useQuery<Message[]>(api["messages.list"], {}) ?? [];',
+    ].join("\n"))
+        .replace('<div className="status">Connected to {props.runtimeURL}</div>', '<div className="status"><span>Connected to {props.runtimeURL} as {auth.user?.email}</span><GoogleSignInButton /></div>');
+    await writeFile(mainPath, main);
+    await writeFile(appPath, app);
+    return true;
+}
 async function watchProject(root, settings, once, signal, initialState) {
     const backendDir = join(root, "gonvex");
     await mkdir(backendDir, { recursive: true });
@@ -292,7 +999,7 @@ function sanitizeProjectID(projectID) {
 }
 async function parseRegistrations(root, file) {
     const source = await readFile(file, "utf8");
-    const pattern = /app\.(Query|Mutation|Action|HTTP|InternalMutation|LiveGrid)\(\s*"([^"]+)"\s*,\s*([A-Za-z_][A-Za-z0-9_]*)/g;
+    const pattern = /app\.(Query|Mutation|Action|HTTP|PublicHTTP|InternalMutation|LiveGrid)\(\s*"([^"]+)"\s*,\s*([A-Za-z_][A-Za-z0-9_]*)/g;
     const entries = {};
     for (const match of source.matchAll(pattern)) {
         entries[match[2]] = {
@@ -348,7 +1055,7 @@ async function writeBindings(root, manifest) {
     const outputs = {
         "api.ts": renderAPI(manifest),
         "client.ts": '// Generated by gonvex dev. Do not edit.\nexport { GonvexClient, ConvexReactClient } from "@gonvex/client";\n',
-        "react.ts": '// Generated by gonvex dev. Do not edit.\nexport { ConvexProvider, ConvexProviderWithAuth, ConvexReactClient, GonvexProvider, useAction, useConvex, useConvexAuth, useConvexConnectionState, useMutation, usePaginatedQuery, useQuery } from "@gonvex/react";\n',
+        "react.ts": '// Generated by gonvex dev. Do not edit.\nexport { ConvexProvider, ConvexProviderWithAuth, ConvexReactClient, createGonvexAuth, GonvexAuthProvider, GonvexGoogleAuthButton, GonvexProvider, useAction, useConvex, useConvexAuth, useConvexConnectionState, useGonvexAuth, useMutation, usePaginatedQuery, useQuery } from "@gonvex/react";\nexport type { GonvexAuthConfig, GonvexAuthTenant, GonvexAuthUser, GonvexAuthValue } from "@gonvex/react";\n',
         "types.ts": "// Generated by gonvex dev. Do not edit.\nexport type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };\n",
         "schema.ts": renderSchemaIndex(manifest),
         "landlord/schema.ts": renderScopedSchemaModule("landlord", manifest.schema.landlordTables),
@@ -590,6 +1297,20 @@ async function saveProjectEnv(settings, name, value) {
     if (!response.ok)
         throw new Error(`runtime returned ${response.status} ${response.statusText}: ${await response.text()}`);
 }
+async function replaceProjectEnv(settings, content) {
+    const response = await fetch(projectEnvURL(settings), {
+        method: "PUT",
+        headers: {
+            "content-type": "application/json",
+            ...projectAuthHeaders(settings),
+        },
+        body: JSON.stringify({ content }),
+    });
+    if (!response.ok)
+        throw new Error(`runtime returned ${response.status} ${response.statusText}: ${await response.text()}`);
+    const payload = await response.json();
+    return typeof payload.count === "number" ? payload.count : 0;
+}
 async function deleteProjectEnv(settings, name) {
     const response = await fetch(projectEnvURL(settings), {
         method: "DELETE",
@@ -621,13 +1342,30 @@ function parseEnvSetArgs(positional) {
         throw new Error("usage: gonvex env set NAME VALUE");
     return { name: first, value };
 }
+function dotEnvVariableNames(content) {
+    const names = new Set();
+    for (const rawLine of content.split(/\r?\n/)) {
+        let line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        if (line.startsWith("export "))
+            line = line.slice("export ".length).trimStart();
+        const equalsIndex = line.indexOf("=");
+        if (equalsIndex < 1)
+            continue;
+        const name = line.slice(0, equalsIndex).trim();
+        if (name)
+            names.add(name);
+    }
+    return [...names];
+}
 function parseEnvCommandArgs(argv) {
     const options = {};
     const positional = [];
     let action = "";
     for (let index = 0; index < argv.length; index += 1) {
         const arg = argv[index];
-        if (["--project", "--runtime-url", "--project-id", "--key"].includes(arg)) {
+        if (["--project", "--runtime-url", "--project-id", "--key", "--file"].includes(arg)) {
             const value = argv[index + 1];
             if (value === undefined)
                 throw new Error(`${arg} requires a value`);
@@ -666,11 +1404,18 @@ async function ensureProjectSettings(root, settings, options) {
         return settings;
     if (options.keyWasExplicit)
         return settings;
-    const configuredProject = await findRuntimeProject(settings.runtimeURL, settings.projectID).catch(() => null);
+    let accountToken = await accountAccessTokenForRuntime(settings.runtimeURL);
+    const configuredProject = await findRuntimeProject(settings.runtimeURL, settings.projectID, accountToken).catch(() => null);
     if (configuredProject) {
+        if (accountToken) {
+            const projectKey = await fetchRuntimeProjectKey(settings.runtimeURL, configuredProject.id, accountToken);
+            await writeProjectEnv(root, settings.runtimeURL, configuredProject.id, projectKey);
+            console.log(`[gonvex] configured ${configuredProject.id} in .env.local`);
+            return { ...settings, projectID: configuredProject.id, key: projectKey };
+        }
         await writeProjectEnv(root, settings.runtimeURL, configuredProject.id, settings.key);
         console.log(`[gonvex] configured ${configuredProject.id} in .env.local`);
-        console.warn("[gonvex] GONVEX_PROJECT_KEY is not configured; runtime sync will fail if the runtime requires project keys.");
+        console.warn("[gonvex] GONVEX_PROJECT_KEY is not configured; run 'gonvex login' or provide the project key.");
         return { ...settings, projectID: configuredProject.id };
     }
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
@@ -682,7 +1427,8 @@ async function ensureProjectSettings(root, settings, options) {
         console.log("[gonvex] No Gonvex project is configured for this app.");
         const runtimeURL = await promptDefault(rl, "Runtime URL", settings.runtimeURL || defaultRuntimeURL);
         settings = { ...settings, runtimeURL };
-        const projects = await fetchRuntimeProjects(runtimeURL);
+        accountToken = await accountAccessTokenForRuntime(runtimeURL);
+        const projects = await fetchRuntimeProjects(runtimeURL, accountToken);
         let project;
         if (projects.length > 0) {
             console.log("[gonvex] Choose a project:");
@@ -694,7 +1440,9 @@ async function ensureProjectSettings(root, settings, options) {
             const index = Number.parseInt(choice, 10);
             if (Number.isFinite(index) && index >= 1 && index <= projects.length) {
                 project = projects[index - 1];
-                const projectKey = await promptDefault(rl, "Project key from dashboard", "");
+                const projectKey = accountToken
+                    ? await fetchRuntimeProjectKey(runtimeURL, project.id, accountToken)
+                    : await promptDefault(rl, "Project key", "");
                 if (!projectKey)
                     throw new Error("Gonvex project key is required for existing projects");
                 const next = { ...settings, projectID: project.id, key: projectKey };
@@ -703,7 +1451,7 @@ async function ensureProjectSettings(root, settings, options) {
                 return next;
             }
             else {
-                const created = await createRuntimeProject(runtimeURL, await promptDefault(rl, "New project name", basename(root)));
+                const created = await createRuntimeProject(runtimeURL, await promptDefault(rl, "New project name", basename(root)), accountToken);
                 project = created.project;
                 const next = { ...settings, projectID: project.id, key: created.projectKey };
                 await writeProjectEnv(root, runtimeURL, project.id, created.projectKey);
@@ -712,7 +1460,7 @@ async function ensureProjectSettings(root, settings, options) {
             }
         }
         else {
-            const created = await createRuntimeProject(runtimeURL, await promptDefault(rl, "New project name", basename(root)));
+            const created = await createRuntimeProject(runtimeURL, await promptDefault(rl, "New project name", basename(root)), accountToken);
             project = created.project;
             const next = { ...settings, projectID: project.id, key: created.projectKey };
             await writeProjectEnv(root, runtimeURL, project.id, created.projectKey);
@@ -724,38 +1472,48 @@ async function ensureProjectSettings(root, settings, options) {
         rl.close();
     }
 }
-async function findRuntimeProject(runtimeURL, projectID) {
+async function findRuntimeProject(runtimeURL, projectID, accountToken) {
     const wanted = projectID.trim();
     if (!wanted)
         return null;
-    const projects = await fetchRuntimeProjects(runtimeURL);
+    const projects = await fetchRuntimeProjects(runtimeURL, accountToken);
     return projects.find((project) => project.id === wanted) ?? null;
 }
-async function fetchRuntimeProjects(runtimeURL) {
-    const response = await fetch(`${runtimeURL.replace(/\/$/, "")}/dev/projects`);
-    if (!response.ok)
-        throw new Error(`runtime returned ${response.status} ${response.statusText}: ${await response.text()}`);
-    const payload = await response.json();
+async function fetchRuntimeProjects(runtimeURL, accountToken) {
+    const response = await fetch(`${runtimeURL.replace(/\/$/, "")}/dev/projects`, {
+        headers: accountToken ? accountHeaders(accountToken) : undefined,
+    });
+    const payload = await runtimeJSON(response);
     return payload.projects ?? [];
 }
-async function createRuntimeProject(runtimeURL, name) {
+async function createRuntimeProject(runtimeURL, name, accountToken, databaseMode = "single") {
     const response = await fetch(`${runtimeURL.replace(/\/$/, "")}/dev/projects`, {
         method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name }),
+        headers: { ...(accountToken ? accountHeaders(accountToken) : {}), "content-type": "application/json" },
+        body: JSON.stringify({ name, databaseMode }),
     });
-    if (!response.ok)
-        throw new Error(`runtime returned ${response.status} ${response.statusText}: ${await response.text()}`);
-    const payload = await response.json();
+    const payload = await runtimeJSON(response);
+    if (!payload.project?.id)
+        throw new Error("runtime did not return project details");
     if (!payload.projectKey)
         throw new Error("runtime did not return a project key");
     return { project: payload.project, projectKey: payload.projectKey };
 }
+async function fetchRuntimeProjectKey(runtimeURL, projectID, accountToken) {
+    const response = await fetch(`${runtimeURL.replace(/\/$/, "")}/dev/projects/${encodeURIComponent(projectID)}/key`, {
+        method: "POST",
+        headers: accountToken ? accountHeaders(accountToken) : undefined,
+    });
+    const payload = await runtimeJSON(response);
+    if (!payload.projectKey)
+        throw new Error("runtime did not return a project key");
+    return payload.projectKey;
+}
 async function promptDefault(rl, label, fallback) {
     const answer = (await rl.question(`${label} (${fallback}): `)).trim();
     return answer || fallback;
 }
-async function writeProjectEnv(root, runtimeURL, projectID, projectKey) {
+async function writeProjectEnv(root, runtimeURL, projectID, projectKey, overwrite = false) {
     await upsertEnvLocal(root, {
         GONVEX_PROJECT_ID: projectID,
         GONVEX_RUNTIME_URL: runtimeURL,
@@ -763,9 +1521,9 @@ async function writeProjectEnv(root, runtimeURL, projectID, projectKey) {
         VITE_GONVEX_PROJECT_ID: projectID,
         VITE_GONVEX_URL: runtimeURL,
         VITE_GONVEX_WS_URL: webSocketURL(runtimeURL),
-    });
+    }, overwrite);
 }
-async function upsertEnvLocal(root, values) {
+async function upsertEnvLocal(root, values, overwrite = false) {
     const envPath = join(root, ".env.local");
     const existing = existsSync(envPath) ? await readFile(envPath, "utf8") : "";
     const seen = new Set();
@@ -780,7 +1538,7 @@ async function upsertEnvLocal(root, values) {
         if (seen.has(key))
             return [];
         seen.add(key);
-        if (envLineValue(line) !== "")
+        if (!overwrite && envLineValue(line) !== "")
             return [line];
         return [`${key}=${values[key]}`];
     });
@@ -788,7 +1546,8 @@ async function upsertEnvLocal(root, values) {
         if (!seen.has(key))
             next.push(`${key}=${value}`);
     }
-    await writeFile(envPath, `${next.join("\n")}\n`);
+    await writeFile(envPath, `${next.join("\n")}\n`, { mode: 0o600 });
+    await chmod(envPath, 0o600).catch(() => { });
 }
 function envLineValue(line) {
     const index = line.indexOf("=");
@@ -886,21 +1645,172 @@ function shouldPrintRuntimeLogEntry(entry, options) {
     const outcome = String(entry.outcome ?? "").toLowerCase();
     return Boolean(entry.error) || outcome === "error" || outcome === "warn" || outcome === "warning";
 }
+function normalizeRuntimeURL(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    if (!trimmed)
+        return defaultRuntimeURL;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`invalid runtime URL ${value}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        throw new Error("runtime URL must use http or https");
+    return parsed.toString().replace(/\/+$/, "");
+}
+function cliConfigPath() {
+    if (process.env.GONVEX_CONFIG_PATH)
+        return resolve(process.env.GONVEX_CONFIG_PATH);
+    const configRoot = process.env.XDG_CONFIG_HOME ? resolve(process.env.XDG_CONFIG_HOME) : join(homedir(), ".config");
+    return join(configRoot, "gonvex", "config.json");
+}
+function emptyCLIConfig() {
+    return { version: 1, runtimes: {} };
+}
+async function readCLIConfig() {
+    const path = cliConfigPath();
+    if (!existsSync(path))
+        return emptyCLIConfig();
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`could not read Gonvex CLI config ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        version: 1,
+        currentRuntime: parsed.currentRuntime,
+        runtimes: parsed.runtimes && typeof parsed.runtimes === "object" ? parsed.runtimes : {},
+    };
+}
+async function writeCLIConfig(config) {
+    const path = cliConfigPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    await chmod(path, 0o600).catch(() => { });
+}
+async function saveAccountProfile(runtimeURL, accessToken, identity, expiresAt) {
+    runtimeURL = normalizeRuntimeURL(runtimeURL);
+    const config = await readCLIConfig();
+    config.currentRuntime = runtimeURL;
+    config.runtimes[runtimeURL] = {
+        runtimeURL,
+        accessToken,
+        email: identity.account.email,
+        name: identity.account.name,
+        authentication: identity.authentication,
+        permissions: identity.permissions,
+        ...(expiresAt ? { expiresAt } : {}),
+    };
+    await writeCLIConfig(config);
+}
+async function removeAccountProfile(runtimeURL) {
+    runtimeURL = normalizeRuntimeURL(runtimeURL);
+    const config = await readCLIConfig();
+    if (!config.runtimes[runtimeURL])
+        return false;
+    delete config.runtimes[runtimeURL];
+    if (config.currentRuntime === runtimeURL)
+        config.currentRuntime = Object.keys(config.runtimes)[0];
+    await writeCLIConfig(config);
+    return true;
+}
+async function accountRuntimeForArgs(argv) {
+    const explicit = valueFor(argv, "--runtime-url") ?? valueFor(argv, "--runtime") ?? process.env.GONVEX_RUNTIME_URL;
+    if (explicit)
+        return normalizeRuntimeURL(explicit);
+    const config = await readCLIConfig();
+    return normalizeRuntimeURL(config.currentRuntime ?? defaultRuntimeURL);
+}
+async function accountAccessTokenForRuntime(runtimeURL) {
+    if (process.env.GONVEX_ACCOUNT_TOKEN?.trim())
+        return process.env.GONVEX_ACCOUNT_TOKEN.trim();
+    const config = await readCLIConfig();
+    const profile = config.runtimes[normalizeRuntimeURL(runtimeURL)];
+    if (profile?.expiresAt && profile.expiresAt <= Date.now()) {
+        throw new Error(`saved login for ${normalizeRuntimeURL(runtimeURL)} has expired; run 'gonvex login' again`);
+    }
+    return profile?.accessToken;
+}
+async function requireAccountAccessToken(runtimeURL) {
+    const token = await accountAccessTokenForRuntime(runtimeURL);
+    if (!token)
+        throw new Error(`not logged in to ${normalizeRuntimeURL(runtimeURL)}; run 'gonvex login --runtime-url ${normalizeRuntimeURL(runtimeURL)}'`);
+    return token;
+}
+function accountHeaders(accessToken) {
+    return { authorization: `Bearer ${accessToken}` };
+}
+async function runtimeJSON(response) {
+    const text = await response.text();
+    let payload = {};
+    if (text) {
+        try {
+            payload = JSON.parse(text);
+        }
+        catch {
+            payload = { error: text };
+        }
+    }
+    if (!response.ok) {
+        const error = payload && typeof payload === "object" && "error" in payload ? String(payload.error) : response.statusText;
+        const permission = payload && typeof payload === "object" && "permission" in payload ? ` (${String(payload.permission)})` : "";
+        throw new Error(`runtime returned ${response.status}: ${error}${permission}`);
+    }
+    return payload;
+}
+async function fetchAccountIdentity(runtimeURL, accessToken) {
+    const response = await fetch(`${normalizeRuntimeURL(runtimeURL)}/dev/auth/me`, { headers: accountHeaders(accessToken) });
+    return runtimeJSON(response);
+}
+async function promptHidden(label) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        throw new Error("password must be provided non-interactively with --password or GONVEX_PASSWORD");
+    let hidden = false;
+    const output = new Writable({
+        write(chunk, encoding, callback) {
+            if (!hidden)
+                process.stdout.write(chunk, encoding);
+            callback();
+        },
+    });
+    const rl = createInterface({ input: process.stdin, output, terminal: true });
+    try {
+        const pending = rl.question(label);
+        hidden = true;
+        const answer = await pending;
+        hidden = false;
+        process.stdout.write("\n");
+        return answer;
+    }
+    finally {
+        rl.close();
+    }
+}
 async function loadSettings(root, overrides) {
     loadDotEnv(join(root, ".env.local"));
     loadDotEnv(join(root, ".env"));
     const config = await loadConfig(root);
+    const cliConfig = await readCLIConfig();
     const key = overrides.key ?? process.env.GONVEX_PROJECT_KEY ?? process.env.GONVEX_DEPLOY_KEY ?? process.env.GONVEX_KEY ?? "";
     const explicitProjectID = overrides.projectID ?? process.env.GONVEX_PROJECT_ID ?? process.env.GONVEX_PROJECT ?? config.project;
+    const overriddenProjectID = overrides.projectID?.trim() || undefined;
+    const keyedProjectID = projectIDFromKey(key);
+    if (overriddenProjectID && keyedProjectID && overriddenProjectID !== keyedProjectID) {
+        throw new Error(`project id ${JSON.stringify(overriddenProjectID)} does not match the project key for ${JSON.stringify(keyedProjectID)}`);
+    }
     return {
-        projectID: overrides.projectID ?? projectIDFromKey(key) ?? explicitProjectID ?? basename(root),
-        runtimeURL: overrides.runtimeURL ?? process.env.GONVEX_RUNTIME_URL ?? config.runtime ?? defaultRuntimeURL,
+        projectID: overriddenProjectID ?? keyedProjectID ?? (explicitProjectID?.trim() || basename(root)),
+        runtimeURL: normalizeRuntimeURL(overrides.runtimeURL ?? process.env.GONVEX_RUNTIME_URL ?? config.runtime ?? cliConfig.currentRuntime ?? defaultRuntimeURL),
         key,
     };
 }
 function projectIDFromKey(key) {
     const trimmed = key.trim();
-    if (!trimmed.startsWith("gvx_"))
+    if (!trimmed.startsWith("gvx_") || trimmed.startsWith("gvx_pat_"))
         return undefined;
     const payload = trimmed.slice("gvx_".length);
     let encodedProject = payload.split(".", 1)[0];
@@ -981,7 +1891,7 @@ async function copyDir(source, target, overwrite) {
     await mkdir(target, { recursive: true });
     for (const entry of await readdir(source, { withFileTypes: true })) {
         const sourcePath = join(source, entry.name);
-        const targetPath = join(target, entry.name);
+        const targetPath = join(target, entry.name === "_gitignore" ? ".gitignore" : entry.name);
         if (entry.isDirectory()) {
             await copyDir(sourcePath, targetPath, overwrite);
         }
@@ -1011,7 +1921,7 @@ async function writeEnvLocal(root, project, runtime) {
     if (existsSync(envPath))
         return;
     const wsURL = runtime.replace(/^http:/, "ws:").replace(/^https:/, "wss:").replace(/\/$/, "") + "/ws";
-    await writeFile(envPath, `GONVEX_PROJECT_ID=${project}\nGONVEX_RUNTIME_URL=${runtime}\nGONVEX_PROJECT_KEY=\nVITE_GONVEX_WS_URL=${wsURL}\n`);
+    await writeFile(envPath, `GONVEX_PROJECT_ID=${project}\nGONVEX_RUNTIME_URL=${runtime}\nGONVEX_PROJECT_KEY=\nVITE_GONVEX_PROJECT_ID=${project}\nVITE_GONVEX_URL=${runtime}\nVITE_GONVEX_WS_URL=${wsURL}\n`);
 }
 function templateDir(template) {
     const packageTemplate = resolve(dirname(fileURLToPath(import.meta.url)), "templates", template);
@@ -1024,6 +1934,8 @@ function functionKind(raw) {
         return "internalMutation";
     if (raw === "LiveGrid")
         return "liveGrid";
+    if (raw === "PublicHTTP")
+        return "http";
     return raw.toLowerCase();
 }
 function columnType(kind) {
@@ -1044,6 +1956,29 @@ function valueFor(args, key) {
         return undefined;
     return args[index + 1];
 }
+function valuesFor(args, key) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] === key && args[index + 1] !== undefined) {
+            values.push(args[index + 1]);
+            index += 1;
+        }
+    }
+    return values;
+}
+function positionalArgs(args, optionsWithValues) {
+    const positional = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (optionsWithValues.includes(arg)) {
+            index += 1;
+            continue;
+        }
+        if (!arg.startsWith("-"))
+            positional.push(arg);
+    }
+    return positional;
+}
 function basename(path) {
     const parts = path.split(/[\\/]/).filter(Boolean);
     return parts.at(-1) ?? "app";
@@ -1058,11 +1993,31 @@ function sleep(ms, signal) {
     });
 }
 function printHelp() {
-    console.log("Usage: gonvex <dev|init|create|env> [options]");
+    console.log("Usage: gonvex <dev|init|create|env|auth|login|logout|whoami|project|token> [options]");
     console.log("  gonvex dev [--project <path>] [--runtime-url <url>] [--project-id <id>] [--key <key>] [--once] [--verbose-logs] [-- <command>]");
     console.log("  gonvex init [--template vite-react] [--project <id>] [--runtime <url>]");
-    console.log("  gonvex create <app-name> [--template vite-react]");
-    console.log("  gonvex env <list|get|set|remove> [--project <path>] [--runtime-url <url>] [--project-id <id>] [--key <key>]");
+    console.log("  gonvex create <app-name> [--runtime-url <url>] [--provision] [--database-mode single|multiTenant] [--google-auth] [--origin <url>]... [--signup-mode personal|inviteOnly] [--owner <email>]");
+    console.log("  gonvex env <list|get|set|push|remove> [--project <path>] [--runtime-url <url>] [--project-id <id>] [--key <key>]");
+    console.log("  gonvex auth <add|remove|status|users> [google] [options]");
+    console.log("  gonvex login [--runtime-url <url>] [--email <email> | --token <personal-access-token>]");
+    console.log("  gonvex logout [--runtime-url <url>]");
+    console.log("  gonvex whoami [--runtime-url <url>] [--json]");
+    console.log("  gonvex project <list|create|select> [options]");
+    console.log("  gonvex token <list|create|revoke|permissions> [options]");
+}
+function printAuthHelp() {
+    console.log("Usage: gonvex auth <command> [options]");
+    console.log("  gonvex auth add google [--origin URL]... [--callback-path /] [--signup-mode personal|inviteOnly]");
+    console.log("  gonvex auth remove google [--origin URL]... [--callback-path /]");
+    console.log("  gonvex auth status [--json]");
+    console.log("  gonvex auth doctor [--json]");
+    console.log("  gonvex auth users [--json]");
+    console.log("  gonvex auth tenants list [--json]");
+    console.log("  gonvex auth tenants create <name> [--owner <email>]");
+    console.log("  gonvex auth memberships list --tenant <tenant-id> [--json]");
+    console.log("  gonvex auth memberships add --tenant <tenant-id> --email <email> [--role member]");
+    console.log("  gonvex auth memberships remove --tenant <tenant-id> (--user <user-id> | --email <invited-email>)");
+    console.log("  gonvex auth user <disable|enable|delete> <user-id>");
 }
 function printEnvHelp() {
     console.log("Usage: gonvex env <command> [options]");
@@ -1070,8 +2025,23 @@ function printEnvHelp() {
     console.log("  gonvex env get NAME");
     console.log("  gonvex env set NAME VALUE");
     console.log("  gonvex env set NAME=VALUE");
+    console.log("  gonvex env push FILE");
+    console.log("  gonvex env push --file FILE");
     console.log("  gonvex env remove NAME");
 }
+function printProjectHelp() {
+    console.log("Usage: gonvex project <command> [options]");
+    console.log("  gonvex project list [--runtime-url <url>] [--json]");
+    console.log("  gonvex project create [name] [--runtime-url <url>] [--database-mode single|multiTenant] [--project-root <path>] [--json]");
+    console.log("  gonvex project select <project-id> [--runtime-url <url>] [--project-root <path>]");
+}
+function printTokenHelp() {
+    console.log("Usage: gonvex token <command> [options]");
+    console.log("  gonvex token list [--runtime-url <url>] [--json]");
+    console.log("  gonvex token create [name] [--permission <permission>]... [--full] [--expires-at <RFC3339>] [--json]");
+    console.log("  gonvex token revoke <token-id> [--runtime-url <url>]");
+    console.log("  gonvex token permissions");
+}
 function isCliEntrypoint() {
     const invokedPath = process.argv[1];
     if (!invokedPath)