@groundfloorcloud/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1345 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/auth/store.ts
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+var CONFIG_DIR = path.join(os.homedir(), ".groundfloor");
+var AUTH_FILE = path.join(CONFIG_DIR, "auth.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+async function ensureDir() {
+  await fs.mkdir(CONFIG_DIR, { recursive: true, mode: 448 });
+}
+async function readJson(file) {
+  try {
+    const raw = await fs.readFile(file, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return null;
+    }
+    throw err;
+  }
+}
+async function readAuth() {
+  return readJson(AUTH_FILE);
+}
+async function writeAuth(session) {
+  await ensureDir();
+  await fs.writeFile(AUTH_FILE, `${JSON.stringify(session, null, 2)}
+`, {
+    mode: 384
+  });
+  await fs.chmod(AUTH_FILE, 384);
+}
+async function clearAuth() {
+  try {
+    await fs.unlink(AUTH_FILE);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return false;
+    }
+    throw err;
+  }
+}
+async function readConfig() {
+  return await readJson(CONFIG_FILE) ?? {};
+}
+async function writeConfig(config) {
+  await ensureDir();
+  await fs.writeFile(CONFIG_FILE, `${JSON.stringify(config, null, 2)}
+`, {
+    mode: 384
+  });
+}
+async function updateConfig(patch) {
+  const current = await readConfig();
+  const next = { ...current, ...patch };
+  await writeConfig(next);
+  return next;
+}
+
+// src/auth/config.ts
+var DEFAULTS = {
+  issuer: "https://auth.dev.groundfloor.cloud/realms/groundfloor_dev",
+  clientId: "groundfloor-cli",
+  apiUrl: "http://localhost:8088"
+};
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+async function resolveConfig(overrides = {}) {
+  const file = await readConfig();
+  const issuer = overrides.issuer ?? process.env.GROUNDFLOOR_ISSUER ?? file.issuer ?? DEFAULTS.issuer;
+  const clientId = overrides.clientId ?? process.env.GROUNDFLOOR_CLIENT_ID ?? file.clientId ?? DEFAULTS.clientId;
+  const apiUrl = overrides.apiUrl ?? process.env.GROUNDFLOOR_API_URL ?? file.apiUrl ?? DEFAULTS.apiUrl;
+  const workspaceId = overrides.workspaceId ?? process.env.GROUNDFLOOR_WORKSPACE_ID ?? file.workspaceId;
+  return {
+    issuer: trimTrailingSlash(issuer),
+    clientId,
+    apiUrl: trimTrailingSlash(apiUrl),
+    workspaceId: workspaceId || void 0
+  };
+}
+
+// src/auth/oauth.ts
+import crypto from "crypto";
+import http from "http";
+import open from "open";
+var SCOPE = "openid profile email offline_access";
+function endpoints(issuer) {
+  const base = issuer.replace(/\/+$/, "");
+  return {
+    authorization: `${base}/protocol/openid-connect/auth`,
+    token: `${base}/protocol/openid-connect/token`,
+    deviceAuthorization: `${base}/protocol/openid-connect/auth/device`
+  };
+}
+function base64url(input) {
+  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createPkcePair() {
+  const verifier = base64url(crypto.randomBytes(32));
+  const challenge = base64url(
+    crypto.createHash("sha256").update(verifier).digest()
+  );
+  return { verifier, challenge };
+}
+async function postForm(url, form) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form).toString()
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  return { ok: res.ok, status: res.status, body };
+}
+function tokenResponseFrom(body) {
+  return {
+    access_token: String(body.access_token ?? ""),
+    refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    id_token: typeof body.id_token === "string" ? body.id_token : void 0,
+    expires_in: typeof body.expires_in === "number" ? body.expires_in : void 0,
+    token_type: typeof body.token_type === "string" ? body.token_type : void 0
+  };
+}
+var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Groundfloor CLI</title></head>
+<body style="font-family:system-ui,sans-serif;background:#0b0d12;color:#e6e8ec;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
+<div style="text-align:center"><h1 style="font-size:1.4rem">You're signed in</h1>
+<p style="opacity:.7">You can close this tab and return to your terminal.</p></div></body></html>`;
+async function loginWithBrowser(opts) {
+  const { issuer, clientId } = opts;
+  const host = opts.redirectHost ?? "127.0.0.1";
+  const listenPort = opts.redirectPort ?? 0;
+  const autoOpen = opts.autoOpen ?? true;
+  const ep = endpoints(issuer);
+  const { verifier, challenge } = createPkcePair();
+  const state = base64url(crypto.randomBytes(16));
+  return new Promise((resolve2, reject) => {
+    const server = http.createServer((req, res) => {
+      if (!req.url) return;
+      const url = new URL(req.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(SUCCESS_HTML);
+      const finish = (fn) => {
+        server.close();
+        fn();
+      };
+      if (error) {
+        finish(
+          () => reject(
+            new Error(
+              `Authorization failed: ${error} ${url.searchParams.get("error_description") ?? ""}`.trim()
+            )
+          )
+        );
+        return;
+      }
+      if (returnedState !== state) {
+        finish(() => reject(new Error("State mismatch; aborting login.")));
+        return;
+      }
+      if (!code) {
+        finish(() => reject(new Error("No authorization code returned.")));
+        return;
+      }
+      const port = server.address().port;
+      const redirectUri = `http://${host}:${port}/callback`;
+      postForm(ep.token, {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: verifier
+      }).then(({ ok, status, body }) => {
+        if (!ok) {
+          finish(
+            () => reject(
+              new Error(
+                `Token exchange failed (${status}): ${body.error_description ?? body.error ?? "unknown error"}`
+              )
+            )
+          );
+          return;
+        }
+        finish(() => resolve2(tokenResponseFrom(body)));
+      }).catch((err) => finish(() => reject(err)));
+    });
+    server.on("error", reject);
+    server.listen(listenPort, host, () => {
+      const port = server.address().port;
+      const redirectUri = `http://${host}:${port}/callback`;
+      const authUrl = new URL(ep.authorization);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("client_id", clientId);
+      authUrl.searchParams.set("redirect_uri", redirectUri);
+      authUrl.searchParams.set("scope", SCOPE);
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("code_challenge", challenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      const display = authUrl.toString();
+      if (autoOpen) {
+        process.stderr.write(
+          `
+Opening your browser to sign in...
+If it does not open, visit:
+  ${display}
+
+`
+        );
+        void open(display).catch(() => {
+        });
+      } else {
+        process.stderr.write(
+          `
+Open this URL to sign in (e.g. in a fresh incognito window):
+  ${display}
+
+`
+        );
+      }
+    });
+    setTimeout(
+      () => {
+        server.close();
+        reject(new Error("Login timed out after 5 minutes."));
+      },
+      5 * 60 * 1e3
+    ).unref();
+  });
+}
+async function loginWithDeviceCode(opts) {
+  const { issuer, clientId } = opts;
+  const ep = endpoints(issuer);
+  const start = await postForm(ep.deviceAuthorization, {
+    client_id: clientId,
+    scope: SCOPE
+  });
+  if (!start.ok) {
+    throw new Error(
+      `Device authorization failed (${start.status}): ${start.body.error_description ?? start.body.error ?? "unknown error"}`
+    );
+  }
+  const deviceCode = String(start.body.device_code ?? "");
+  const userCode = String(start.body.user_code ?? "");
+  const verificationUri = String(start.body.verification_uri ?? "");
+  const verificationUriComplete = typeof start.body.verification_uri_complete === "string" ? start.body.verification_uri_complete : void 0;
+  let interval = typeof start.body.interval === "number" ? start.body.interval : 5;
+  const expiresIn = typeof start.body.expires_in === "number" ? start.body.expires_in : 600;
+  process.stderr.write(
+    `
+To sign in, open:
+  ${verificationUri}
+and enter code:
+  ${userCode}
+
+`
+  );
+  if (verificationUriComplete) {
+    void open(verificationUriComplete).catch(() => {
+    });
+  }
+  const deadline = Date.now() + expiresIn * 1e3;
+  while (true) {
+    if (Date.now() > deadline) {
+      throw new Error("Device login timed out.");
+    }
+    await new Promise((r) => setTimeout(r, interval * 1e3));
+    const poll = await postForm(ep.token, {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: clientId
+    });
+    if (poll.ok) {
+      return tokenResponseFrom(poll.body);
+    }
+    const err = poll.body.error;
+    if (err === "authorization_pending") {
+      continue;
+    }
+    if (err === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    throw new Error(
+      `Device login failed: ${poll.body.error_description ?? err ?? "unknown error"}`
+    );
+  }
+}
+async function refreshTokens(opts) {
+  const ep = endpoints(opts.issuer);
+  const { ok, status, body } = await postForm(ep.token, {
+    grant_type: "refresh_token",
+    client_id: opts.clientId,
+    refresh_token: opts.refreshToken
+  });
+  if (!ok) {
+    throw new Error(
+      `Token refresh failed (${status}): ${body.error_description ?? body.error ?? "session expired"}`
+    );
+  }
+  return tokenResponseFrom(body);
+}
+
+// src/auth/session.ts
+var EXPIRY_SKEW_MS = 3e4;
+var NotLoggedInError = class extends Error {
+  constructor() {
+    super("Not logged in. Run `gf login` first.");
+    this.name = "NotLoggedInError";
+  }
+};
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function sessionFromTokens(tokens, ctx) {
+  const expiresInMs = (tokens.expires_in ?? 300) * 1e3;
+  return {
+    issuer: ctx.issuer,
+    clientId: ctx.clientId,
+    apiUrl: ctx.apiUrl,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    idToken: tokens.id_token,
+    expiresAt: Date.now() + expiresInMs
+  };
+}
+function isFresh(session) {
+  return Date.now() < session.expiresAt - EXPIRY_SKEW_MS;
+}
+async function getValidAccessToken() {
+  const session = await readAuth();
+  if (!session || !session.accessToken) {
+    throw new NotLoggedInError();
+  }
+  if (isFresh(session)) {
+    return session.accessToken;
+  }
+  if (!session.refreshToken) {
+    throw new NotLoggedInError();
+  }
+  const refreshed = await refreshTokens({
+    issuer: session.issuer,
+    clientId: session.clientId,
+    refreshToken: session.refreshToken
+  });
+  const next = sessionFromTokens(refreshed, {
+    issuer: session.issuer,
+    clientId: session.clientId,
+    apiUrl: session.apiUrl
+  });
+  if (!next.refreshToken) {
+    next.refreshToken = session.refreshToken;
+  }
+  await writeAuth(next);
+  return next.accessToken;
+}
+
+// src/commands/login.ts
+async function loginCommand(opts) {
+  const cfg = await resolveConfig({
+    issuer: opts.issuer,
+    clientId: opts.clientId,
+    apiUrl: opts.apiUrl
+  });
+  process.stderr.write(
+    `Signing in to ${cfg.issuer}
+  client: ${cfg.clientId}
+  api:    ${cfg.apiUrl}
+`
+  );
+  const redirectPort = opts.redirectPort ? Number.parseInt(opts.redirectPort, 10) : void 0;
+  if (redirectPort !== void 0 && Number.isNaN(redirectPort)) {
+    throw new Error(`Invalid --redirect-port "${opts.redirectPort}".`);
+  }
+  const tokens = opts.device ? await loginWithDeviceCode({ issuer: cfg.issuer, clientId: cfg.clientId }) : await loginWithBrowser({
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    redirectHost: opts.redirectHost,
+    redirectPort,
+    autoOpen: opts.open
+  });
+  if (!tokens.access_token) {
+    throw new Error("No access token returned from the identity provider.");
+  }
+  const session = sessionFromTokens(tokens, {
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    apiUrl: cfg.apiUrl
+  });
+  await writeAuth(session);
+  await updateConfig({
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    apiUrl: cfg.apiUrl
+  });
+  const claims = decodeJwt(tokens.access_token);
+  const who = claims?.email || claims?.preferred_username || claims?.sub || "unknown user";
+  process.stdout.write(`Logged in as ${who}
+`);
+  if (!tokens.refresh_token) {
+    process.stderr.write(
+      "Note: no refresh token was issued; you may need to log in again when the token expires.\n"
+    );
+  }
+}
+
+// src/commands/logout.ts
+async function logoutCommand() {
+  const removed = await clearAuth();
+  process.stdout.write(
+    removed ? "Logged out.\n" : "No active session to clear.\n"
+  );
+}
+
+// src/cp.ts
+var CpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "CpError";
+  }
+  status;
+};
+async function parseError(res) {
+  let detail = res.statusText;
+  try {
+    const body = await res.json();
+    if (body?.detail) detail = String(body.detail);
+  } catch {
+  }
+  return `${res.status} ${detail}`;
+}
+async function cpGet(apiUrl, path4) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path4}`, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json"
+    }
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+async function cpPostJson(apiUrl, path4, body) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path4}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+async function cpDelete(apiUrl, path4) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path4}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" }
+  });
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+}
+function listWorkspaces(apiUrl) {
+  return cpGet(apiUrl, "/v1/workspaces");
+}
+async function listCoderunners(apiUrl, workspaceId) {
+  const data = await cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/coderunners`
+  );
+  if (Array.isArray(data)) return data;
+  return data.coderunners ?? [];
+}
+function createCoderunner(apiUrl, workspaceId, payload) {
+  return cpPostJson(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/coderunners`,
+    payload
+  );
+}
+async function uploadZip(apiUrl, workspaceId, coderunnerId, zip, description) {
+  const token = await getValidAccessToken();
+  const form = new FormData();
+  form.append(
+    "file",
+    new Blob([zip], { type: "application/zip" }),
+    "code.zip"
+  );
+  form.append("description", description);
+  const res = await fetch(
+    `${apiUrl}/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(coderunnerId)}/upload`,
+    {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      body: form
+    }
+  );
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+function getVersion(apiUrl, workspaceId, coderunnerId, versionId) {
+  return cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(
+      coderunnerId
+    )}/versions/${encodeURIComponent(versionId)}`
+  );
+}
+function deployCoderunner(apiUrl, workspaceId, coderunnerId, payload) {
+  return cpPostJson(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(coderunnerId)}/deploy`,
+    payload
+  );
+}
+async function getDeployment(apiUrl, workspaceId, coderunnerId) {
+  const token = await getValidAccessToken();
+  const res = await fetch(
+    `${apiUrl}/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(coderunnerId)}/deployment`,
+    {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json"
+      }
+    }
+  );
+  if (res.status === 204) return null;
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+function getCoderunnerStatus(apiUrl, workspaceId, coderunnerId) {
+  return cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(coderunnerId)}/status`
+  );
+}
+function runCoderunner(apiUrl, workspaceId, coderunnerId, payload) {
+  return cpPostJson(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(
+      workspaceId
+    )}/coderunners/${encodeURIComponent(coderunnerId)}/run`,
+    payload
+  );
+}
+function domainsBase(workspaceId, coderunnerId) {
+  return `/v1/workspaces/${encodeURIComponent(
+    workspaceId
+  )}/coderunners/${encodeURIComponent(coderunnerId)}/domains`;
+}
+function listDomains(apiUrl, workspaceId, coderunnerId) {
+  return cpGet(
+    apiUrl,
+    domainsBase(workspaceId, coderunnerId)
+  );
+}
+function addDomain(apiUrl, workspaceId, coderunnerId, domain) {
+  return cpPostJson(
+    apiUrl,
+    domainsBase(workspaceId, coderunnerId),
+    { domain }
+  );
+}
+function removeDomain(apiUrl, workspaceId, coderunnerId, domain) {
+  return cpDelete(
+    apiUrl,
+    `${domainsBase(workspaceId, coderunnerId)}/${encodeURIComponent(domain)}`
+  );
+}
+function verifyDomain(apiUrl, workspaceId, coderunnerId, domain) {
+  return cpPostJson(
+    apiUrl,
+    `${domainsBase(workspaceId, coderunnerId)}/${encodeURIComponent(
+      domain
+    )}/verify`,
+    {}
+  );
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand() {
+  const cfg = await resolveConfig();
+  const token = await getValidAccessToken();
+  const claims = decodeJwt(token) ?? {};
+  const email = claims.email || claims.preferred_username || "(no email claim)";
+  const subject = claims.sub || "(no subject)";
+  process.stdout.write(`User:    ${email}
+`);
+  process.stdout.write(`Subject: ${subject}
+`);
+  process.stdout.write(`Issuer:  ${cfg.issuer}
+`);
+  process.stdout.write(`API:     ${cfg.apiUrl}
+`);
+  const workspaces2 = await listWorkspaces(cfg.apiUrl);
+  process.stdout.write(
+    `Session verified: Control Plane returned ${workspaces2.length} workspace(s).
+`
+  );
+}
+
+// src/commands/token.ts
+async function tokenCommand() {
+  const token = await getValidAccessToken();
+  process.stdout.write(`${token}
+`);
+}
+
+// src/commands/env.ts
+async function envCommand() {
+  const cfg = await resolveConfig();
+  const token = await getValidAccessToken();
+  const lines = [
+    `export GROUNDFLOOR_TOKEN=${token}`,
+    `export CONTROLPLANE_URL=${cfg.apiUrl}`,
+    `export NEXT_PUBLIC_API_URL=${cfg.apiUrl}`
+  ];
+  if (cfg.workspaceId) {
+    lines.push(`export GROUNDFLOOR_WORKSPACE_ID=${cfg.workspaceId}`);
+  }
+  process.stdout.write(`${lines.join("\n")}
+`);
+}
+
+// src/commands/workspaces.ts
+async function workspacesListCommand(opts) {
+  const cfg = await resolveConfig();
+  const workspaces2 = await listWorkspaces(cfg.apiUrl);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(workspaces2, null, 2)}
+`);
+    return;
+  }
+  if (workspaces2.length === 0) {
+    process.stdout.write("No workspaces found for this user.\n");
+    return;
+  }
+  const file = await readConfig();
+  const selected = cfg.workspaceId ?? file.workspaceId;
+  for (const ws of workspaces2) {
+    const marker = ws.id === selected ? "*" : " ";
+    const name = ws.name ?? ws.slug ?? "";
+    process.stdout.write(`${marker} ${ws.id}  ${name}
+`);
+  }
+  if (selected) {
+    process.stdout.write(`
+(* = default workspace)
+`);
+  } else {
+    process.stdout.write(
+      `
+Tip: run \`gf workspaces use <id>\` to set a default.
+`
+    );
+  }
+}
+async function workspacesUseCommand(workspaceId) {
+  await updateConfig({ workspaceId });
+  process.stdout.write(`Default workspace set to ${workspaceId}
+`);
+}
+
+// src/commands/coderunner.ts
+async function coderunnerListCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const coderunners = await listCoderunners(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(coderunners, null, 2)}
+`);
+    return;
+  }
+  if (coderunners.length === 0) {
+    process.stdout.write("No coderunners in this workspace.\n");
+    return;
+  }
+  for (const cr of coderunners) {
+    const name = cr.name ?? cr.slug ?? "";
+    const status = cr.status ?? "";
+    process.stdout.write(`${cr.id}  ${name}  [${status}]
+`);
+  }
+}
+
+// src/commands/deploy.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
+
+// src/deploy/package.ts
+import { execFile } from "child_process";
+import { promises as fs2 } from "fs";
+import os2 from "os";
+import path2 from "path";
+import { promisify } from "util";
+import AdmZip from "adm-zip";
+
+// src/deploy/git-ref.ts
+function isGitCommitSha(ref) {
+  return /^[0-9a-f]{7,40}$/i.test(ref);
+}
+
+// src/deploy/package.ts
+var exec = promisify(execFile);
+var DEFAULT_IGNORES = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".turbo",
+  ".cache",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".DS_Store"
+]);
+async function isGitRepo(dir) {
+  try {
+    await exec("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function gitFileList(dir) {
+  const { stdout } = await exec(
+    "git",
+    ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+    { maxBuffer: 64 * 1024 * 1024 }
+  );
+  return stdout.split("\0").map((f) => f.trim()).filter(Boolean);
+}
+async function walkFileList(dir) {
+  const out = [];
+  async function walk(current, rel) {
+    const entries = await fs2.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      if (DEFAULT_IGNORES.has(entry.name)) continue;
+      const abs = path2.join(current, entry.name);
+      const relPath = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(abs, relPath);
+      } else if (entry.isFile()) {
+        out.push(relPath);
+      }
+    }
+  }
+  await walk(dir, "");
+  return out;
+}
+async function buildZip(sourceDir, files) {
+  const zip = new AdmZip();
+  for (const rel of files) {
+    const abs = path2.join(sourceDir, rel);
+    try {
+      const data = await fs2.readFile(abs);
+      zip.addFile(rel.split(path2.sep).join("/"), data);
+    } catch {
+    }
+  }
+  return zip.toBuffer();
+}
+async function cloneRepo(url, ref) {
+  const tmp = await fs2.mkdtemp(path2.join(os2.tmpdir(), "gf-deploy-"));
+  try {
+    if (ref && isGitCommitSha(ref)) {
+      await exec("git", ["init"], { cwd: tmp });
+      await exec("git", ["remote", "add", "origin", url], { cwd: tmp });
+      await exec(
+        "git",
+        ["fetch", "--depth", "1", "origin", ref],
+        { cwd: tmp, maxBuffer: 64 * 1024 * 1024 }
+      );
+      await exec("git", ["checkout", "FETCH_HEAD"], { cwd: tmp });
+    } else {
+      const args = ["clone", "--depth", "1"];
+      if (ref) args.push("--branch", ref);
+      args.push(url, tmp);
+      await exec("git", args, { maxBuffer: 64 * 1024 * 1024 });
+    }
+  } catch (err) {
+    await fs2.rm(tmp, { recursive: true, force: true });
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`git clone failed: ${message}`);
+  }
+  return tmp;
+}
+async function packageSource(opts) {
+  let baseDir;
+  let cleanup = null;
+  if (opts.git) {
+    baseDir = await cloneRepo(opts.git, opts.ref);
+    cleanup = baseDir;
+  } else {
+    baseDir = path2.resolve(opts.path ?? process.cwd());
+  }
+  const sourceDir = opts.subdir ? path2.join(baseDir, opts.subdir) : baseDir;
+  try {
+    const stat = await fs2.stat(sourceDir);
+    if (!stat.isDirectory()) {
+      throw new Error(`Not a directory: ${sourceDir}`);
+    }
+    const useGit = await isGitRepo(sourceDir);
+    const files = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    if (files.length === 0) {
+      throw new Error(
+        `No files to package in ${sourceDir} (everything ignored or empty).`
+      );
+    }
+    const zip = await buildZip(sourceDir, files);
+    let gitSha = null;
+    const shaRoot = cleanup ?? (useGit ? sourceDir : null);
+    if (shaRoot) {
+      try {
+        const { stdout } = await exec("git", ["-C", shaRoot, "rev-parse", "HEAD"]);
+        gitSha = stdout.trim() || null;
+      } catch {
+        gitSha = null;
+      }
+    }
+    return { zip, fileCount: files.length, sourceDir, cleanup, gitSha };
+  } catch (err) {
+    if (cleanup) {
+      await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
+      });
+    }
+    throw err;
+  }
+}
+async function readProjectManifest(dir) {
+  try {
+    const raw = await fs2.readFile(path2.join(dir, "groundfloor.json"), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function detectRuntime(dir) {
+  const has = async (name) => {
+    try {
+      await fs2.access(path2.join(dir, name));
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (await has("package.json")) return "node";
+  if (await has("requirements.txt")) return "python";
+  if (await has("pyproject.toml")) return "python";
+  return null;
+}
+
+// src/commands/deploy.ts
+var RUNTIMES = /* @__PURE__ */ new Set(["python", "node", "dotnet-script"]);
+var WORKLOAD_TYPES = /* @__PURE__ */ new Set(["function", "service", "job", "schedule"]);
+var VERSION_POLL_INTERVAL_MS = 2e3;
+var VERSION_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
+var DEPLOY_POLL_INTERVAL_MS = 2e3;
+var DEPLOY_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
+function slugify(input) {
+  const slug = input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "app";
+}
+function nameFromGitUrl(url) {
+  const cleaned = url.replace(/\.git$/, "").replace(/\/+$/, "");
+  const last = cleaned.split(/[/:]/).pop();
+  return last || "app";
+}
+function parseEnvPairs(pairs) {
+  const out = {};
+  for (const pair of pairs ?? []) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) {
+      throw new Error(`Invalid --env "${pair}" (expected KEY=VALUE).`);
+    }
+    out[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  return out;
+}
+var log = (msg) => process.stderr.write(`${msg}
+`);
+async function deployCommand(opts) {
+  const cfg = await resolveConfig({
+    apiUrl: opts.apiUrl,
+    workspaceId: opts.workspace
+  });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const ws = cfg.workspaceId;
+  log(
+    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path3.resolve(opts.path ?? process.cwd())}...`
+  );
+  const pkg = await packageSource({
+    path: opts.path,
+    git: opts.git,
+    ref: opts.ref,
+    subdir: opts.subdir
+  });
+  try {
+    const manifest = await readProjectManifest(pkg.sourceDir) ?? {};
+    const sizeKb = (pkg.zip.byteLength / 1024).toFixed(1);
+    log(`Packaged ${pkg.fileCount} file(s), ${sizeKb} KB`);
+    const detected = await detectRuntime(pkg.sourceDir);
+    const runtime = opts.runtime ?? manifest.runtime ?? detected ?? "python";
+    if (!RUNTIMES.has(runtime)) {
+      throw new Error(
+        `Invalid runtime "${runtime}" (expected: ${[...RUNTIMES].join(", ")}).`
+      );
+    }
+    const workloadType = opts.workloadType ?? manifest.workloadType ?? manifest.workload_type ?? "function";
+    if (!WORKLOAD_TYPES.has(workloadType)) {
+      throw new Error(
+        `Invalid workload type "${workloadType}" (expected: ${[...WORKLOAD_TYPES].join(", ")}).`
+      );
+    }
+    let coderunnerId = opts.coderunner;
+    if (!coderunnerId) {
+      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path3.basename(path3.resolve(opts.path ?? process.cwd())));
+      const slug = manifest.slug ?? slugify(name);
+      const existing = await listCoderunners(cfg.apiUrl, ws);
+      const match = existing.find((c) => c.slug === slug || c.name === name);
+      if (match) {
+        coderunnerId = match.id;
+        log(`Using existing coderunner ${slug} (${coderunnerId})`);
+      } else {
+        log(`Creating coderunner ${slug} (runtime=${runtime}, type=${workloadType})...`);
+        const created = await createCoderunner(cfg.apiUrl, ws, {
+          title: name,
+          slug,
+          runtime,
+          workload_type: workloadType,
+          ...opts.appId ? { app_id: opts.appId } : {}
+        });
+        coderunnerId = created.id;
+        log(`Created coderunner ${created.id}`);
+      }
+    }
+    const description = opts.message ?? (pkg.gitSha ? `git_sha=${pkg.gitSha} gf deploy ${(/* @__PURE__ */ new Date()).toISOString()}` : `gf deploy ${(/* @__PURE__ */ new Date()).toISOString()}`);
+    if (pkg.gitSha) {
+      log(`git_sha ${pkg.gitSha.slice(0, 12)}`);
+    }
+    log("Uploading code...");
+    const uploaded = await uploadZip(
+      cfg.apiUrl,
+      ws,
+      coderunnerId,
+      pkg.zip,
+      description
+    );
+    log(`Uploaded version ${uploaded.version_id}`);
+    log("Waiting for build...");
+    const deadline = Date.now() + VERSION_POLL_TIMEOUT_MS;
+    let built = false;
+    while (Date.now() < deadline) {
+      const version = await getVersion(
+        cfg.apiUrl,
+        ws,
+        coderunnerId,
+        uploaded.version_id
+      );
+      const status = version.status ?? 0;
+      if (status === 3) {
+        built = true;
+        break;
+      }
+      if (status === 4) {
+        throw new Error(
+          `Build failed for version ${uploaded.version_id} (status=4).`
+        );
+      }
+      process.stderr.write(".");
+      await new Promise((r) => setTimeout(r, VERSION_POLL_INTERVAL_MS));
+    }
+    process.stderr.write("\n");
+    if (!built) {
+      throw new Error("Timed out waiting for the build to complete.");
+    }
+    log("Build completed.");
+    if (opts.skipDeploy) {
+      process.stdout.write(
+        `Uploaded (not deployed). coderunner=${coderunnerId} version=${uploaded.version_id}
+`
+      );
+      return;
+    }
+    const envVariable = {
+      ...manifest.env ?? {},
+      ...parseEnvPairs(opts.env)
+    };
+    log("Deploying...");
+    const result = await deployCoderunner(cfg.apiUrl, ws, coderunnerId, {
+      version_id: uploaded.version_id,
+      cpu: opts.cpu ?? manifest.cpu,
+      memory: opts.memory ?? manifest.memory,
+      envVariable: Object.keys(envVariable).length ? envVariable : void 0
+    });
+    log("Waiting for deployment...");
+    const deployDeadline = Date.now() + DEPLOY_POLL_TIMEOUT_MS;
+    let deployOk = false;
+    while (Date.now() < deployDeadline) {
+      const deployment = await getDeployment(cfg.apiUrl, ws, coderunnerId);
+      const dStatus = deployment?.status ?? 0;
+      if (dStatus === 3) {
+        deployOk = true;
+        break;
+      }
+      if (dStatus === 4) {
+        throw new Error(
+          `Deployment failed for coderunner ${coderunnerId} (status=4).`
+        );
+      }
+      process.stderr.write(".");
+      await new Promise((r) => setTimeout(r, DEPLOY_POLL_INTERVAL_MS));
+    }
+    process.stderr.write("\n");
+    if (!deployOk) {
+      throw new Error("Timed out waiting for the deployment to complete.");
+    }
+    log("Deployment completed.");
+    process.stdout.write(`
+Deployed coderunner ${coderunnerId}
+`);
+    process.stdout.write(`  version:    ${uploaded.version_id}
+`);
+    process.stdout.write(`  deployment: ${result.deployment_id}
+`);
+    if (result.public_host) {
+      process.stdout.write(`  url:        https://${result.public_host}
+`);
+    }
+    if (result.deployment_url) {
+      const label = result.public_host ? "upstream:   " : "url:        ";
+      process.stdout.write(`  ${label}${result.deployment_url}
+`);
+    }
+  } finally {
+    if (pkg.cleanup) {
+      await fs3.rm(pkg.cleanup, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+}
+
+// src/commands/run.ts
+async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
+  const list = await listCoderunners(apiUrl, workspaceId);
+  const match = list.find((c) => c.id === idOrSlug || c.slug === idOrSlug);
+  if (!match) {
+    throw new Error(`Coderunner not found: ${idOrSlug}`);
+  }
+  return match.id;
+}
+async function runCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  let payload = {};
+  if (opts.payload) {
+    try {
+      payload = JSON.parse(opts.payload);
+    } catch {
+      throw new Error(`Invalid --payload JSON: ${opts.payload}`);
+    }
+  }
+  const coderunnerId = await resolveCoderunnerId(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.coderunner
+  );
+  const result = await runCoderunner(cfg.apiUrl, cfg.workspaceId, coderunnerId, {
+    payload
+  });
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+}
+
+// src/commands/status.ts
+async function resolveCoderunnerId2(apiUrl, workspaceId, idOrSlug) {
+  const list = await listCoderunners(apiUrl, workspaceId);
+  const match = list.find((c) => c.id === idOrSlug || c.slug === idOrSlug);
+  if (!match) {
+    throw new Error(`Coderunner not found: ${idOrSlug}`);
+  }
+  return match.id;
+}
+async function statusCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const coderunnerId = await resolveCoderunnerId2(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.coderunner
+  );
+  const [status, deployment] = await Promise.all([
+    getCoderunnerStatus(cfg.apiUrl, cfg.workspaceId, coderunnerId),
+    getDeployment(cfg.apiUrl, cfg.workspaceId, coderunnerId)
+  ]);
+  const out = { coderunner_id: coderunnerId, status, deployment };
+  process.stdout.write(`${JSON.stringify(out, null, 2)}
+`);
+}
+
+// src/commands/domains.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolve(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const ref = opts.coderunner;
+  if (!ref) {
+    throw new Error(
+      "Specify the coderunner with --coderunner <id|slug>."
+    );
+  }
+  let coderunnerId = ref;
+  if (!UUID_RE.test(ref)) {
+    const all = await listCoderunners(cfg.apiUrl, cfg.workspaceId);
+    const match = all.find((c) => c.slug === ref || c.name === ref);
+    if (!match) {
+      throw new Error(`No coderunner matching "${ref}" in this workspace.`);
+    }
+    coderunnerId = match.id;
+  }
+  return {
+    apiUrl: cfg.apiUrl,
+    workspaceId: cfg.workspaceId,
+    coderunnerId
+  };
+}
+function printInstructions(item) {
+  const out = process.stdout;
+  out.write(`
+Added ${item.domain} (status: ${item.status})
+`);
+  out.write("\nCreate these DNS records at your registrar:\n");
+  if (item.cname_target) {
+    out.write(`  CNAME  ${item.domain}  \u2192  ${item.cname_target}
+`);
+  }
+  if (item.verification_record) {
+    const r = item.verification_record;
+    out.write(`  ${r.type}    ${r.name}  =  ${r.value}
+`);
+  }
+  out.write(`
+Then run:  gf domains verify ${item.domain} --coderunner <id|slug>
+`);
+}
+async function domainsAddCommand(domain, opts) {
+  const { apiUrl, workspaceId, coderunnerId } = await resolve(opts);
+  const item = await addDomain(apiUrl, workspaceId, coderunnerId, domain);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(item, null, 2)}
+`);
+    return;
+  }
+  printInstructions(item);
+}
+async function domainsListCommand(opts) {
+  const { apiUrl, workspaceId, coderunnerId } = await resolve(opts);
+  const result = await listDomains(apiUrl, workspaceId, coderunnerId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result.domains, null, 2)}
+`);
+    return;
+  }
+  if (result.domains.length === 0) {
+    process.stdout.write("No custom domains.\n");
+    return;
+  }
+  for (const d of result.domains) {
+    const target = d.cname_target ? ` \u2192 ${d.cname_target}` : "";
+    process.stdout.write(`${d.domain}  [${d.status}]${target}
+`);
+  }
+}
+async function domainsRemoveCommand(domain, opts) {
+  const { apiUrl, workspaceId, coderunnerId } = await resolve(opts);
+  await removeDomain(apiUrl, workspaceId, coderunnerId, domain);
+  process.stdout.write(`Removed ${domain}
+`);
+}
+async function domainsVerifyCommand(domain, opts) {
+  const { apiUrl, workspaceId, coderunnerId } = await resolve(opts);
+  const result = await verifyDomain(apiUrl, workspaceId, coderunnerId, domain);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  const mark = result.verified ? "verified" : "not verified";
+  process.stdout.write(`${result.domain}: ${mark} [${result.status}]
+`);
+  process.stdout.write(`${result.detail}
+`);
+  if (!result.verified) {
+    process.exitCode = 1;
+  }
+}
+
+// src/index.ts
+function collect(value, previous) {
+  return previous.concat([value]);
+}
+function run(fn) {
+  fn().catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Error: ${message}
+`);
+    process.exitCode = 1;
+  });
+}
+var program = new Command();
+program.name("gf").description(
+  "Groundfloor CLI \u2014 log in to the Control Plane and reuse the session during local development."
+).version("0.1.0");
+program.command("login").description("Log in via the browser (or --device) and cache the session").option("--issuer <url>", "Identity provider issuer URL").option("--client-id <id>", "OIDC client id").option("--api-url <url>", "Control Plane base URL").option("--device", "Use the device-code flow (headless / no local browser)").option(
+  "--redirect-host <host>",
+  "Loopback host for the redirect URI (default 127.0.0.1; try localhost)"
+).option(
+  "--redirect-port <port>",
+  "Fixed loopback port for the redirect URI (default: random)"
+).option("--no-open", "Do not auto-open the browser; print the URL instead").action((opts) => run(() => loginCommand(opts)));
+program.command("logout").description("Clear the cached session").action(() => run(() => logoutCommand()));
+program.command("whoami").description("Show the current identity and verify the Control Plane session").action(() => run(() => whoamiCommand()));
+program.command("token").description("Print a valid (auto-refreshed) access token to stdout").action(() => run(() => tokenCommand()));
+program.command("env").description('Print shell exports for `eval "$(gf env)"`').action(() => run(() => envCommand()));
+var workspaces = program.command("workspaces").alias("ws").description("List workspaces or set the default workspace");
+workspaces.command("list", { isDefault: true }).description("List workspaces visible to your user").option("--json", "Output raw JSON").action((opts) => run(() => workspacesListCommand(opts)));
+workspaces.command("use <workspaceId>").description("Set the default workspace").action(
+  (workspaceId) => run(() => workspacesUseCommand(workspaceId))
+);
+var coderunner = program.command("coderunner").alias("cr").description("Coderunner commands");
+coderunner.command("ls").alias("list").description("List coderunners in the default (or --workspace) workspace").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => coderunnerListCommand(opts)));
+coderunner.command("status").description("Show coderunner status + current deployment JSON").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => statusCommand(opts)));
+coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "JSON payload object", "{}").option("--json", "Output raw JSON").action(
+  (opts) => run(
+    () => runCommand({
+      workspace: opts.workspace,
+      coderunner: opts.coderunner,
+      payload: opts.payload,
+      json: opts.json
+    })
+  )
+);
+var domains = program.command("domains").description("Manage custom domains (CNAME) for a coderunner service");
+domains.command("add <domain>").description("Add a custom domain and print the DNS records to create").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((domain, opts) => run(() => domainsAddCommand(domain, opts)));
+domains.command("ls").alias("list").description("List custom domains for a coderunner service").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => domainsListCommand(opts)));
+domains.command("rm <domain>").alias("remove").description("Remove a custom domain from a coderunner service").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").action(
+  (domain, opts) => run(() => domainsRemoveCommand(domain, opts))
+);
+domains.command("verify <domain>").description("Re-check the DNS records for a custom domain").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action(
+  (domain, opts) => run(() => domainsVerifyCommand(domain, opts))
+);
+program.command("deploy").description(
+  "Package code (local folder or --git repo) and deploy as a standalone coderunner (D-061; not an App)"
+).option("-w, --workspace <id>", "Workspace id override").option("--api-url <url>", "Control Plane base URL").option(
+  "-c, --coderunner <id>",
+  "Deploy into an existing coderunner id (skip find/create)"
+).option("-n, --name <name>", "Coderunner name (default: folder or repo name)").option("-p, --path <dir>", "Local directory to package (default: cwd)").option("--git <url>", "Clone and deploy a remote git/bitbucket repo").option("--ref <ref>", "Branch/tag/commit for --git").option("--subdir <dir>", "Subdirectory within the source to package").option("--runtime <runtime>", "python | node | dotnet-script").option(
+  "--workload-type <type>",
+  "function | service | job | schedule"
+).option(
+  "--app-id <id>",
+  "Bind newly created coderunner as a helper of this App (optional)"
+).option("--cpu <cpu>", "CPU request, e.g. 250m").option("--memory <memory>", "Memory request, e.g. 256Mi").option("-e, --env <KEY=VALUE>", "Environment variable (repeatable)", collect, []).option("-m, --message <text>", "Version description").option("--skip-deploy", "Upload a new version but do not deploy it").action((opts) => run(() => deployCommand(opts)));
+program.parseAsync(process.argv).catch((err) => {
+  const message = err instanceof Error ? err.message : String(err);
+  process.stderr.write(`Error: ${message}
+`);
+  process.exitCode = 1;
+});