@insforge/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2405 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
+import { join as join5 } from "path";
+import { Command } from "commander";
+
+// src/commands/login.ts
+import * as clack from "@clack/prompts";
+
+// src/lib/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var GLOBAL_DIR = join(homedir(), ".insforge");
+var CREDENTIALS_FILE = join(GLOBAL_DIR, "credentials.json");
+var CONFIG_FILE = join(GLOBAL_DIR, "config.json");
+var DEFAULT_PLATFORM_URL = "https://api.insforge.dev";
+function ensureGlobalDir() {
+  if (!existsSync(GLOBAL_DIR)) {
+    mkdirSync(GLOBAL_DIR, { recursive: true });
+  }
+}
+function getGlobalConfig() {
+  if (!existsSync(CONFIG_FILE)) {
+    return { platform_api_url: DEFAULT_PLATFORM_URL };
+  }
+  const raw = readFileSync(CONFIG_FILE, "utf-8");
+  return JSON.parse(raw);
+}
+function saveGlobalConfig(config) {
+  ensureGlobalDir();
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+}
+function getCredentials() {
+  if (!existsSync(CREDENTIALS_FILE)) {
+    return null;
+  }
+  const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
+  return JSON.parse(raw);
+}
+function saveCredentials(creds) {
+  ensureGlobalDir();
+  writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function clearCredentials() {
+  if (existsSync(CREDENTIALS_FILE)) {
+    unlinkSync(CREDENTIALS_FILE);
+  }
+}
+function getLocalConfigDir() {
+  return join(process.cwd(), ".insforge");
+}
+function getLocalConfigFile() {
+  return join(getLocalConfigDir(), "project.json");
+}
+function getProjectConfig() {
+  const file = getLocalConfigFile();
+  if (!existsSync(file)) {
+    return null;
+  }
+  const raw = readFileSync(file, "utf-8");
+  return JSON.parse(raw);
+}
+function saveProjectConfig(config) {
+  const dir = getLocalConfigDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  writeFileSync(getLocalConfigFile(), JSON.stringify(config, null, 2), { mode: 384 });
+}
+function getPlatformApiUrl(override) {
+  return process.env.INSFORGE_API_URL ?? override ?? getGlobalConfig().platform_api_url ?? DEFAULT_PLATFORM_URL;
+}
+function getAccessToken() {
+  return process.env.INSFORGE_ACCESS_TOKEN ?? getCredentials()?.access_token ?? null;
+}
+
+// src/lib/errors.ts
+var CLIError = class extends Error {
+  constructor(message, exitCode = 1, code) {
+    super(message);
+    this.exitCode = exitCode;
+    this.code = code;
+    this.name = "CLIError";
+  }
+};
+var AuthError = class extends CLIError {
+  constructor(message = "Not authenticated. Run `insforge login` first.") {
+    super(message, 2, "AUTH_ERROR");
+  }
+};
+var ProjectNotLinkedError = class extends CLIError {
+  constructor() {
+    super("No project linked. Run `insforge projects link` first.", 3, "PROJECT_NOT_LINKED");
+  }
+};
+function handleError(err, json) {
+  if (err instanceof CLIError) {
+    if (json) {
+      console.error(JSON.stringify({ error: err.message, code: err.code }));
+    } else {
+      console.error(`Error: ${err.message}`);
+    }
+    process.exit(err.exitCode);
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  if (json) {
+    console.error(JSON.stringify({ error: message, code: "UNKNOWN_ERROR" }));
+  } else {
+    console.error(`Error: ${message}`);
+  }
+  process.exit(1);
+}
+function getRootOpts(cmd) {
+  let root = cmd;
+  while (root.parent) {
+    root = root.parent;
+  }
+  const opts = root.opts();
+  return {
+    json: opts.json ?? false,
+    projectId: opts.projectId,
+    apiUrl: opts.apiUrl,
+    yes: opts.yes ?? false
+  };
+}
+
+// src/lib/auth.ts
+import { createServer } from "http";
+import { randomBytes, createHash } from "crypto";
+import { URL } from "url";
+var DEFAULT_CLIENT_ID = "clf_NK8cMUs41gm8ZcfdtSguVw";
+var OAUTH_SCOPES = "user:read organizations:read projects:read projects:write";
+function generatePKCE() {
+  const code_verifier = randomBytes(32).toString("base64url");
+  const code_challenge = createHash("sha256").update(code_verifier).digest("base64url");
+  return { code_verifier, code_challenge };
+}
+function generateState() {
+  return randomBytes(16).toString("base64url");
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL(`${params.platformUrl}/api/oauth/v1/authorize`);
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", params.scopes);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", params.state);
+  return url.toString();
+}
+async function exchangeCodeForTokens(params) {
+  const res = await fetch(`${params.platformUrl}/api/oauth/v1/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: params.code,
+      redirect_uri: params.redirectUri,
+      client_id: params.clientId,
+      code_verifier: params.codeVerifier
+    })
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error_description ?? err.error ?? "Token exchange failed");
+  }
+  return await res.json();
+}
+async function refreshOAuthToken(params) {
+  const res = await fetch(`${params.platformUrl}/api/oauth/v1/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      refresh_token: params.refreshToken,
+      client_id: params.clientId
+    })
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error_description ?? err.error ?? "Token refresh failed");
+  }
+  return await res.json();
+}
+function startCallbackServer() {
+  return new Promise((resolveServer) => {
+    let resolveResult;
+    let rejectResult;
+    const resultPromise = new Promise((resolve2, reject) => {
+      resolveResult = resolve2;
+      rejectResult = reject;
+    });
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      if (url.pathname === "/callback") {
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        const error = url.searchParams.get("error");
+        if (error) {
+          const desc = url.searchParams.get("error_description") ?? error;
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`<html><body><h2>Authentication failed</h2><p>${desc}</p><p>You can close this window.</p></body></html>`);
+          rejectResult(new Error(desc));
+          return;
+        }
+        if (!code || !state) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<html><body><h2>Invalid callback</h2><p>Missing authorization code.</p></body></html>");
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Authentication successful!</h2><p>You can close this window and return to the terminal.</p></body></html>");
+        resolveResult({ code, state });
+      } else {
+        res.writeHead(404);
+        res.end("Not found");
+      }
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" ? addr.port : 0;
+      resolveServer({
+        port,
+        result: resultPromise,
+        close: () => {
+          server.close();
+          server.closeAllConnections();
+        }
+      });
+    });
+    setTimeout(() => {
+      rejectResult(new Error("Authentication timed out. Please try again."));
+      server.close();
+    }, 5 * 60 * 1e3).unref();
+  });
+}
+
+// src/lib/credentials.ts
+function requireAuth() {
+  const creds = getCredentials();
+  if (!creds || !creds.access_token) {
+    throw new AuthError();
+  }
+  return creds;
+}
+async function refreshAccessToken(apiUrl) {
+  const creds = getCredentials();
+  if (!creds?.refresh_token) {
+    throw new AuthError("Refresh token not found. Run `insforge login` again.");
+  }
+  const platformUrl = getPlatformApiUrl(apiUrl);
+  const config = getGlobalConfig();
+  const clientId = config.oauth_client_id ?? DEFAULT_CLIENT_ID;
+  try {
+    const data = await refreshOAuthToken({
+      platformUrl,
+      refreshToken: creds.refresh_token,
+      clientId
+    });
+    const updated = {
+      ...creds,
+      access_token: data.access_token,
+      // Update refresh token if rotated
+      refresh_token: data.refresh_token ?? creds.refresh_token
+    };
+    saveCredentials(updated);
+    return data.access_token;
+  } catch {
+    throw new AuthError("Failed to refresh token. Run `insforge login` again.");
+  }
+}
+
+// src/lib/api/platform.ts
+async function platformFetch(path3, options = {}, apiUrl) {
+  const baseUrl = getPlatformApiUrl(apiUrl);
+  const token = getAccessToken();
+  if (!token) {
+    throw new AuthError();
+  }
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${token}`,
+    ...options.headers ?? {}
+  };
+  const res = await fetch(`${baseUrl}${path3}`, { ...options, headers });
+  if (res.status === 401) {
+    const newToken = await refreshAccessToken(apiUrl);
+    headers.Authorization = `Bearer ${newToken}`;
+    const retryRes = await fetch(`${baseUrl}${path3}`, { ...options, headers });
+    if (!retryRes.ok) {
+      const err = await retryRes.json().catch(() => ({}));
+      throw new CLIError(err.error ?? `Request failed: ${retryRes.status}`, retryRes.status === 403 ? 5 : 1);
+    }
+    return retryRes;
+  }
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new CLIError(err.error ?? `Request failed: ${res.status}`, res.status === 403 ? 5 : 1);
+  }
+  return res;
+}
+async function login(email, password2, apiUrl) {
+  const baseUrl = getPlatformApiUrl(apiUrl);
+  const res = await fetch(`${baseUrl}/auth/v1/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password: password2 })
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new AuthError(err.error ?? "Login failed. Check your email and password.");
+  }
+  const setCookie = res.headers.get("set-cookie") ?? "";
+  const refreshTokenMatch = setCookie.match(/refreshToken=([^;]+)/);
+  const data = await res.json();
+  return {
+    ...data,
+    // Attach refresh token to the response for storage
+    _refreshToken: refreshTokenMatch?.[1]
+  };
+}
+async function getProfile(apiUrl) {
+  const res = await platformFetch("/auth/v1/profile", {}, apiUrl);
+  const data = await res.json();
+  return data.user ?? data;
+}
+async function listOrganizations(apiUrl) {
+  const res = await platformFetch("/organizations/v1", {}, apiUrl);
+  const data = await res.json();
+  return data.organizations ?? data;
+}
+async function listProjects(orgId, apiUrl) {
+  const res = await platformFetch(`/organizations/v1/${orgId}/projects`, {}, apiUrl);
+  const data = await res.json();
+  return data.projects ?? data;
+}
+async function getProject(projectId, apiUrl) {
+  const res = await platformFetch(`/projects/v1/${projectId}`, {}, apiUrl);
+  const data = await res.json();
+  return data.project ?? data;
+}
+async function getProjectApiKey(projectId, apiUrl) {
+  const res = await platformFetch(`/projects/v1/${projectId}/access-api-key`, {}, apiUrl);
+  const data = await res.json();
+  return data.access_api_key;
+}
+async function createProject(orgId, name, region, apiUrl) {
+  const body = { name };
+  if (region) body.region = region;
+  const res = await platformFetch(`/organizations/v1/${orgId}/projects`, {
+    method: "POST",
+    body: JSON.stringify(body)
+  }, apiUrl);
+  const data = await res.json();
+  return data.project ?? data;
+}
+
+// src/commands/login.ts
+function registerLoginCommand(program2) {
+  program2.command("login").description("Authenticate with InsForge platform").option("--email", "Login with email and password instead of browser").option("--client-id <id>", "OAuth client ID (defaults to insforge-cli)").action(async (opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      if (opts.email) {
+        await loginWithEmail(json, apiUrl);
+      } else {
+        await loginWithOAuth(json, apiUrl, opts.clientId);
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("cancelled")) {
+        process.exit(0);
+      }
+      handleError(err, json);
+    }
+  });
+}
+async function loginWithEmail(json, apiUrl) {
+  if (!json) {
+    clack.intro("InsForge CLI");
+  }
+  const email = json ? process.env.INSFORGE_EMAIL : await clack.text({
+    message: "Email:",
+    validate: (v) => v.includes("@") ? void 0 : "Please enter a valid email"
+  });
+  if (clack.isCancel(email)) {
+    clack.cancel("Login cancelled.");
+    throw new Error("cancelled");
+  }
+  const password2 = json ? process.env.INSFORGE_PASSWORD : await clack.password({
+    message: "Password:"
+  });
+  if (clack.isCancel(password2)) {
+    clack.cancel("Login cancelled.");
+    throw new Error("cancelled");
+  }
+  if (!email || !password2) {
+    throw new Error("Email and password are required. Set INSFORGE_EMAIL and INSFORGE_PASSWORD environment variables for non-interactive mode.");
+  }
+  if (!json) {
+    const s = clack.spinner();
+    s.start("Authenticating...");
+    const result = await login(email, password2, apiUrl);
+    const creds = {
+      access_token: result.token,
+      refresh_token: result._refreshToken ?? "",
+      user: result.user
+    };
+    saveCredentials(creds);
+    s.stop(`Authenticated as ${result.user.email}`);
+    clack.outro("Done");
+  } else {
+    const result = await login(email, password2, apiUrl);
+    const creds = {
+      access_token: result.token,
+      refresh_token: result._refreshToken ?? "",
+      user: result.user
+    };
+    saveCredentials(creds);
+    console.log(JSON.stringify({ success: true, user: result.user }));
+  }
+}
+async function loginWithOAuth(json, apiUrl, clientIdOverride) {
+  const platformUrl = getPlatformApiUrl(apiUrl);
+  const config = getGlobalConfig();
+  const clientId = clientIdOverride ?? config.oauth_client_id ?? DEFAULT_CLIENT_ID;
+  const pkce = generatePKCE();
+  const state = generateState();
+  const { port, result, close } = await startCallbackServer();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const authUrl = buildAuthorizeUrl({
+    platformUrl,
+    clientId,
+    redirectUri,
+    codeChallenge: pkce.code_challenge,
+    state,
+    scopes: OAUTH_SCOPES
+  });
+  if (!json) {
+    clack.intro("InsForge CLI");
+    clack.log.info("Opening browser for authentication...");
+    clack.log.info(`If browser doesn't open, visit:
+${authUrl}`);
+  }
+  try {
+    const open = (await import("open")).default;
+    await open(authUrl);
+  } catch {
+    if (!json) {
+      clack.log.warn(`Could not open browser. Please visit the URL above.`);
+    }
+  }
+  if (!json) {
+    const s = clack.spinner();
+    s.start("Waiting for authentication...");
+    try {
+      const callbackResult = await result;
+      close();
+      if (callbackResult.state !== state) {
+        s.stop("Authentication failed");
+        throw new Error("State mismatch. Possible CSRF attack.");
+      }
+      s.message("Exchanging authorization code...");
+      const tokens = await exchangeCodeForTokens({
+        platformUrl,
+        code: callbackResult.code,
+        redirectUri,
+        clientId,
+        codeVerifier: pkce.code_verifier
+      });
+      const creds = {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        user: { id: "", name: "", email: "", avatar_url: null, email_verified: true }
+      };
+      saveCredentials(creds);
+      try {
+        const profile = await getProfile(apiUrl);
+        creds.user = profile;
+        saveCredentials(creds);
+        s.stop(`Authenticated as ${profile.email}`);
+      } catch {
+        s.stop("Authenticated successfully");
+      }
+      clack.outro("Done");
+    } catch (err) {
+      close();
+      s.stop("Authentication failed");
+      throw err;
+    }
+  } else {
+    try {
+      const callbackResult = await result;
+      close();
+      if (callbackResult.state !== state) {
+        throw new Error("State mismatch.");
+      }
+      const tokens = await exchangeCodeForTokens({
+        platformUrl,
+        code: callbackResult.code,
+        redirectUri,
+        clientId,
+        codeVerifier: pkce.code_verifier
+      });
+      const creds = {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        user: { id: "", name: "", email: "", avatar_url: null, email_verified: true }
+      };
+      saveCredentials(creds);
+      try {
+        const profile = await getProfile(apiUrl);
+        creds.user = profile;
+        saveCredentials(creds);
+      } catch {
+      }
+      console.log(JSON.stringify({ success: true, user: creds.user }));
+    } catch (err) {
+      close();
+      throw err;
+    }
+  }
+}
+
+// src/lib/output.ts
+import Table from "cli-table3";
+function outputJson(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function outputTable(headers, rows) {
+  const table = new Table({
+    head: headers,
+    style: { head: ["cyan"] }
+  });
+  for (const row of rows) {
+    table.push(row);
+  }
+  console.log(table.toString());
+}
+function outputSuccess(message) {
+  console.log(`\u2713 ${message}`);
+}
+function outputInfo(message) {
+  console.log(message);
+}
+
+// src/commands/logout.ts
+function registerLogoutCommand(program2) {
+  program2.command("logout").description("Log out from InsForge platform").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      clearCredentials();
+      if (json) {
+        outputJson({ success: true, message: "Logged out successfully" });
+      } else {
+        outputSuccess("Logged out successfully.");
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/whoami.ts
+function registerWhoamiCommand(program2) {
+  program2.command("whoami").description("Show current authenticated user").action(async (_opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const profile = await getProfile(apiUrl);
+      if (json) {
+        outputJson(profile);
+      } else {
+        outputInfo(`Logged in as: ${profile.email ?? profile.name}`);
+        if (profile.name) outputInfo(`Name: ${profile.name}`);
+        if (profile.id) outputInfo(`ID: ${profile.id}`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/orgs/list.ts
+function registerOrgsCommands(orgsCmd2) {
+  orgsCmd2.command("list").description("List all organizations").action(async (_opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const orgs = await listOrganizations(apiUrl);
+      if (json) {
+        outputJson(orgs);
+      } else {
+        if (!orgs.length) {
+          console.log("No organizations found.");
+          return;
+        }
+        outputTable(
+          ["ID", "Name", "Type"],
+          orgs.map((o) => [
+            o.id,
+            o.name,
+            o.type ?? "-"
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/projects/list.ts
+import * as clack2 from "@clack/prompts";
+function registerProjectsCommands(projectsCmd2) {
+  projectsCmd2.command("list").description("List all projects in an organization").option("--org-id <id>", "Organization ID (uses default if not specified)").action(async (opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      let orgId = opts.orgId ?? getGlobalConfig().default_org_id;
+      if (!orgId) {
+        const orgs = await listOrganizations(apiUrl);
+        if (orgs.length === 0) {
+          throw new CLIError("No organizations found. Create one on the InsForge dashboard.");
+        }
+        if (orgs.length === 1) {
+          orgId = orgs[0].id;
+        } else if (!json) {
+          const selected = await clack2.select({
+            message: "Select an organization:",
+            options: orgs.map((o) => ({
+              value: o.id,
+              label: o.name
+            }))
+          });
+          if (clack2.isCancel(selected)) {
+            process.exit(0);
+          }
+          orgId = selected;
+        } else {
+          throw new CLIError("Multiple organizations found. Specify --org-id.");
+        }
+      }
+      const projects = await listProjects(orgId, apiUrl);
+      if (json) {
+        outputJson(projects);
+      } else {
+        if (!projects.length) {
+          console.log("No projects found.");
+          return;
+        }
+        outputTable(
+          ["ID", "Name", "Region", "Status", "AppKey"],
+          projects.map((p) => [p.id, p.name, p.region, p.status, p.appkey])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/projects/link.ts
+import * as clack4 from "@clack/prompts";
+
+// src/lib/skills.ts
+import { exec } from "child_process";
+import { promisify } from "util";
+import * as clack3 from "@clack/prompts";
+var execAsync = promisify(exec);
+async function installSkills(json) {
+  try {
+    if (!json) clack3.log.info("Installing InsForge agent skills...");
+    await execAsync("npx skills add insforge/agent-skills -y -a antigravity -a augment -a claude-code -a cline -a codex -a cursor -a gemini-cli -a github-copilot -a kilo -a qoder -a qwen-code -a roo -a trae -a windsurf", {
+      cwd: process.cwd(),
+      timeout: 6e4
+    });
+    if (!json) clack3.log.success("InsForge agent skills installed.");
+  } catch {
+    if (!json) clack3.log.warn("Failed to install agent skills. You can run manually: npx skills add insforge/agent-skills");
+  }
+}
+
+// src/commands/projects/link.ts
+function buildOssHost(appkey, region) {
+  return `https://${appkey}.${region}.insforge.app`;
+}
+function registerProjectLinkCommand(program2) {
+  program2.command("link").description("Link current directory to an InsForge project").option("--project-id <id>", "Project ID to link").option("--org-id <id>", "Organization ID").action(async (opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      let orgId = opts.orgId;
+      let projectId = opts.projectId;
+      if (!orgId) {
+        const orgs = await listOrganizations(apiUrl);
+        if (orgs.length === 0) {
+          throw new CLIError("No organizations found.");
+        }
+        if (json) {
+          throw new CLIError("Specify --org-id in JSON mode.");
+        }
+        const selected = await clack4.select({
+          message: "Select an organization:",
+          options: orgs.map((o) => ({
+            value: o.id,
+            label: o.name
+          }))
+        });
+        if (clack4.isCancel(selected)) process.exit(0);
+        orgId = selected;
+      }
+      const config = getGlobalConfig();
+      config.default_org_id = orgId;
+      saveGlobalConfig(config);
+      if (!projectId) {
+        const projects = await listProjects(orgId, apiUrl);
+        if (projects.length === 0) {
+          throw new CLIError("No projects found in this organization.");
+        }
+        if (json) {
+          throw new CLIError("Specify --project-id in JSON mode.");
+        }
+        const selected = await clack4.select({
+          message: "Select a project to link:",
+          options: projects.map((p) => ({
+            value: p.id,
+            label: `${p.name} (${p.region}, ${p.status})`
+          }))
+        });
+        if (clack4.isCancel(selected)) process.exit(0);
+        projectId = selected;
+      }
+      const [project, apiKey] = await Promise.all([
+        getProject(projectId, apiUrl),
+        getProjectApiKey(projectId, apiUrl)
+      ]);
+      const projectConfig = {
+        project_id: project.id,
+        project_name: project.name,
+        org_id: project.organization_id,
+        appkey: project.appkey,
+        region: project.region,
+        api_key: apiKey,
+        oss_host: buildOssHost(project.appkey, project.region)
+      };
+      saveProjectConfig(projectConfig);
+      if (json) {
+        outputJson({ success: true, project: { id: project.id, name: project.name, region: project.region } });
+      } else {
+        outputSuccess(`Linked to project "${project.name}" (${project.appkey}.${project.region})`);
+      }
+      await installSkills(json);
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/lib/api/oss.ts
+function requireProjectConfig() {
+  const config = getProjectConfig();
+  if (!config) {
+    throw new ProjectNotLinkedError();
+  }
+  return config;
+}
+async function getAnonKey() {
+  const res = await ossFetch("/api/auth/tokens/anon", { method: "POST" });
+  const data = await res.json();
+  return data.accessToken;
+}
+async function ossFetch(path3, options = {}) {
+  const config = requireProjectConfig();
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${config.api_key}`,
+    ...options.headers ?? {}
+  };
+  const res = await fetch(`${config.oss_host}${path3}`, { ...options, headers });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new CLIError(err.error ?? `OSS request failed: ${res.status}`);
+  }
+  return res;
+}
+
+// src/commands/db/query.ts
+function registerDbCommands(dbCmd2) {
+  dbCmd2.command("query <sql>").description("Execute a SQL query against the database").option("--unrestricted", "Use unrestricted mode (allows system table access)").action(async (sql, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const endpoint = opts.unrestricted ? "/api/database/advance/rawsql/unrestricted" : "/api/database/advance/rawsql";
+      const res = await ossFetch(endpoint, {
+        method: "POST",
+        body: JSON.stringify({ query: sql })
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        const rows = data.rows ?? data.data ?? null;
+        if (rows && rows.length > 0) {
+          const headers = Object.keys(rows[0]);
+          outputTable(
+            headers,
+            rows.map((row) => headers.map((h) => String(row[h] ?? "")))
+          );
+          console.log(`${rows.length} row(s) returned.`);
+        } else {
+          console.log("Query executed successfully.");
+          if (rows && rows.length === 0) {
+            console.log("No rows returned.");
+          }
+        }
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/tables.ts
+function registerDbTablesCommand(dbCmd2) {
+  dbCmd2.command("tables").description("List all database tables").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/database/tables");
+      const tables = await res.json();
+      if (json) {
+        outputJson(tables);
+      } else {
+        if (tables.length === 0) {
+          console.log("No tables found.");
+          return;
+        }
+        outputTable(
+          ["Table Name"],
+          tables.map((t) => [t])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/functions.ts
+function str(val) {
+  if (val === null || val === void 0) return "-";
+  if (Array.isArray(val)) return val.join(", ");
+  return String(val);
+}
+function extractArray(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const arr = Object.values(raw).find(Array.isArray);
+    if (arr) return arr;
+  }
+  return [];
+}
+function registerDbFunctionsCommand(dbCmd2) {
+  dbCmd2.command("functions").description("List all database functions").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/database/functions");
+      const raw = await res.json();
+      const functions = extractArray(raw);
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (functions.length === 0) {
+          console.log("No database functions found.");
+          return;
+        }
+        outputTable(
+          ["Name", "Schema", "Language", "Return Type", "Arguments"],
+          functions.map((f) => [str(f.name), str(f.schema), str(f.language), str(f.returnType), str(f.arguments)])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/indexes.ts
+function str2(val) {
+  if (val === null || val === void 0) return "-";
+  if (Array.isArray(val)) return val.join(", ");
+  return String(val);
+}
+function extractArray2(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const arr = Object.values(raw).find(Array.isArray);
+    if (arr) return arr;
+  }
+  return [];
+}
+function registerDbIndexesCommand(dbCmd2) {
+  dbCmd2.command("indexes").description("List all database indexes").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/database/indexes");
+      const raw = await res.json();
+      const indexes = extractArray2(raw);
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (indexes.length === 0) {
+          console.log("No database indexes found.");
+          return;
+        }
+        outputTable(
+          ["Table", "Index Name", "Definition", "Unique", "Primary"],
+          indexes.map((i) => [
+            str2(i.tableName),
+            str2(i.indexName),
+            str2(i.indexDef),
+            i.isUnique ? "Yes" : "No",
+            i.isPrimary ? "Yes" : "No"
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/policies.ts
+function str3(val) {
+  if (val === null || val === void 0) return "-";
+  if (Array.isArray(val)) return val.join(", ");
+  return String(val);
+}
+function extractArray3(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const arr = Object.values(raw).find(Array.isArray);
+    if (arr) return arr;
+  }
+  return [];
+}
+function registerDbPoliciesCommand(dbCmd2) {
+  dbCmd2.command("policies").description("List all RLS policies").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/database/policies");
+      const raw = await res.json();
+      const policies = extractArray3(raw);
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (policies.length === 0) {
+          console.log("No RLS policies found.");
+          return;
+        }
+        outputTable(
+          ["Table", "Policy Name", "Command", "Roles", "Qual", "With Check"],
+          policies.map((p) => [
+            str3(p.tableName),
+            str3(p.policyName),
+            str3(p.cmd),
+            str3(p.roles),
+            str3(p.qual),
+            str3(p.withCheck)
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/triggers.ts
+function str4(val) {
+  if (val === null || val === void 0) return "-";
+  if (Array.isArray(val)) return val.join(", ");
+  return String(val);
+}
+function extractArray4(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const arr = Object.values(raw).find(Array.isArray);
+    if (arr) return arr;
+  }
+  return [];
+}
+function registerDbTriggersCommand(dbCmd2) {
+  dbCmd2.command("triggers").description("List all database triggers").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/database/triggers");
+      const raw = await res.json();
+      const triggers = extractArray4(raw);
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (triggers.length === 0) {
+          console.log("No database triggers found.");
+          return;
+        }
+        outputTable(
+          ["Name", "Table", "Timing", "Events", "Function", "Enabled"],
+          triggers.map((t) => [
+            str4(t.name),
+            str4(t.tableName),
+            str4(t.timing),
+            str4(t.events),
+            str4(t.functionName),
+            t.enabled ? "Yes" : "No"
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/rpc.ts
+function registerDbRpcCommand(dbCmd2) {
+  dbCmd2.command("rpc <functionName>").description("Call a database function via RPC").option("--data <json>", "JSON body to pass as function parameters").action(async (functionName, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const body = opts.data ? JSON.stringify(JSON.parse(opts.data)) : void 0;
+      const res = await ossFetch(`/api/database/rpc/${encodeURIComponent(functionName)}`, {
+        method: body ? "POST" : "GET",
+        ...body ? { body } : {}
+      });
+      const result = await res.json();
+      if (json) {
+        outputJson(result);
+      } else {
+        console.log(JSON.stringify(result, null, 2));
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/export.ts
+import { writeFileSync as writeFileSync2 } from "fs";
+function registerDbExportCommand(dbCmd2) {
+  dbCmd2.command("export").description("Export database schema and/or data").option("--format <format>", "Export format: sql or json", "sql").option("--tables <tables>", "Comma-separated list of tables to export (default: all)").option("--no-data", "Exclude table data (schema only)").option("--include-functions", "Include database functions").option("--include-sequences", "Include sequences").option("--include-views", "Include views").option("--row-limit <n>", "Maximum rows per table").option("-o, --output <file>", "Output file path (default: stdout)").action(async (opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const body = {
+        format: opts.format,
+        includeData: opts.data !== false
+      };
+      if (opts.tables) {
+        body.tables = opts.tables.split(",").map((t) => t.trim());
+      }
+      if (opts.includeFunctions) body.includeFunctions = true;
+      if (opts.includeSequences) body.includeSequences = true;
+      if (opts.includeViews) body.includeViews = true;
+      if (opts.rowLimit) body.rowLimit = parseInt(opts.rowLimit, 10);
+      const res = await ossFetch("/api/database/advance/export", {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+      const raw = await res.text();
+      let content;
+      let meta = null;
+      try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.content === "string") {
+          content = parsed.content;
+          meta = { format: parsed.format, tables: parsed.tables };
+        } else {
+          content = raw;
+        }
+      } catch {
+        content = raw;
+      }
+      if (json) {
+        outputJson(meta ?? { content });
+        return;
+      }
+      if (opts.output) {
+        writeFileSync2(opts.output, content);
+        const tableCount = meta?.tables?.length;
+        const suffix = tableCount ? ` (${tableCount} tables, format: ${meta?.format ?? opts.format})` : "";
+        outputSuccess(`Exported to ${opts.output}${suffix}`);
+      } else {
+        console.log(content);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/db/import.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename } from "path";
+function registerDbImportCommand(dbCmd2) {
+  dbCmd2.command("import <file>").description("Import database from a local SQL file").option("--truncate", "Truncate existing tables before import").action(async (file, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      const fileContent = readFileSync2(file);
+      const fileName = basename(file);
+      const formData = new FormData();
+      formData.append("file", new Blob([fileContent]), fileName);
+      if (opts.truncate) {
+        formData.append("truncate", "true");
+      }
+      const res = await fetch(`${config.oss_host}/api/database/advance/import`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${config.api_key}`
+        },
+        body: formData
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new CLIError(err.error ?? `Import failed: ${res.status}`);
+      }
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(`Imported ${data.filename} (${data.tables.length} tables, ${data.rowsImported} rows)`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/records/list.ts
+function registerRecordsCommands(recordsCmd2) {
+  recordsCmd2.command("list <table>").description("List records from a table").option("--select <columns>", "Columns to select (comma-separated)").option("--filter <filter>", 'Filter expression (e.g. "name=eq.John")').option("--order <order>", 'Order by (e.g. "created_at.desc")').option("--limit <n>", "Limit number of records", parseInt).option("--offset <n>", "Offset for pagination", parseInt).action(async (table, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const params = new URLSearchParams();
+      if (opts.select) params.set("select", opts.select);
+      if (opts.filter) params.set(opts.filter.split("=")[0], opts.filter.split("=").slice(1).join("="));
+      if (opts.order) params.set("order", opts.order);
+      if (opts.limit) params.set("limit", String(opts.limit));
+      if (opts.offset) params.set("offset", String(opts.offset));
+      const query = params.toString();
+      const path3 = `/api/database/records/${encodeURIComponent(table)}${query ? `?${query}` : ""}`;
+      const res = await ossFetch(path3);
+      const data = await res.json();
+      const records = data.data ?? [];
+      if (json) {
+        outputJson(data);
+      } else {
+        if (records.length === 0) {
+          console.log("No records found.");
+          return;
+        }
+        const headers = Object.keys(records[0]);
+        outputTable(
+          headers,
+          records.map((r) => headers.map((h) => {
+            const val = r[h];
+            if (val === null || val === void 0) return "";
+            if (typeof val === "object") return JSON.stringify(val);
+            return String(val);
+          }))
+        );
+        console.log(`${records.length} record(s).`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/records/create.ts
+function registerRecordsCreateCommand(recordsCmd2) {
+  recordsCmd2.command("create <table>").description("Create record(s) in a table").option("--data <json>", "JSON data to insert (object or array of objects)").action(async (table, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!opts.data) {
+        throw new CLIError(`--data is required. Example: --data '{"name":"John"}'`);
+      }
+      let records;
+      try {
+        const parsed = JSON.parse(opts.data);
+        records = Array.isArray(parsed) ? parsed : [parsed];
+      } catch {
+        throw new CLIError("Invalid JSON in --data. Provide a JSON object or array.");
+      }
+      const res = await ossFetch(
+        `/api/database/records/${encodeURIComponent(table)}?return=representation`,
+        {
+          method: "POST",
+          body: JSON.stringify(records)
+        }
+      );
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        const created = data.data ?? [];
+        outputSuccess(`Created ${created.length || records.length} record(s) in "${table}".`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/records/update.ts
+function registerRecordsUpdateCommand(recordsCmd2) {
+  recordsCmd2.command("update <table>").description("Update records in a table matching a filter").option("--filter <filter>", 'Filter expression (e.g. "id=eq.123")').option("--data <json>", "JSON data to update").action(async (table, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!opts.filter) {
+        throw new CLIError("--filter is required to prevent accidental updates to all rows.");
+      }
+      if (!opts.data) {
+        throw new CLIError(`--data is required. Example: --data '{"name":"Jane"}'`);
+      }
+      let body;
+      try {
+        body = JSON.parse(opts.data);
+      } catch {
+        throw new CLIError("Invalid JSON in --data.");
+      }
+      const params = new URLSearchParams();
+      params.set(opts.filter.split("=")[0], opts.filter.split("=").slice(1).join("="));
+      params.set("return", "representation");
+      const res = await ossFetch(
+        `/api/database/records/${encodeURIComponent(table)}?${params}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      );
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        const updated = data.data ?? [];
+        outputSuccess(`Updated ${updated.length} record(s) in "${table}".`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/records/delete.ts
+function registerRecordsDeleteCommand(recordsCmd2) {
+  recordsCmd2.command("delete <table>").description("Delete records from a table matching a filter").option("--filter <filter>", 'Filter expression (e.g. "id=eq.123")').action(async (table, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!opts.filter) {
+        throw new CLIError("--filter is required to prevent accidental deletion of all rows.");
+      }
+      const params = new URLSearchParams();
+      params.set(opts.filter.split("=")[0], opts.filter.split("=").slice(1).join("="));
+      params.set("return", "representation");
+      const res = await ossFetch(
+        `/api/database/records/${encodeURIComponent(table)}?${params}`,
+        { method: "DELETE" }
+      );
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        const deleted = data.data ?? [];
+        outputSuccess(`Deleted ${deleted.length} record(s) from "${table}".`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/functions/list.ts
+function registerFunctionsCommands(functionsCmd2) {
+  functionsCmd2.command("list").description("List all edge functions").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/functions");
+      const data = await res.json();
+      const functions = data.functions ?? [];
+      if (json) {
+        outputJson(functions);
+      } else {
+        if (functions.length === 0) {
+          console.log("No functions found.");
+          return;
+        }
+        outputTable(
+          ["Slug", "Name", "Status", "Created At"],
+          functions.map((f) => [
+            f.slug,
+            f.name ?? "-",
+            f.status ?? "-",
+            f.created_at ? new Date(f.created_at).toLocaleString() : "-"
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/functions/deploy.ts
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+function registerFunctionsDeployCommand(functionsCmd2) {
+  functionsCmd2.command("deploy <slug>").description("Deploy an edge function (create or update)").option("--file <path>", "Path to the function source file").option("--name <name>", "Function display name").option("--description <desc>", "Function description").action(async (slug, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const filePath = opts.file ?? join2(process.cwd(), "insforge", "functions", slug, "index.ts");
+      if (!existsSync2(filePath)) {
+        throw new CLIError(
+          `Source file not found: ${filePath}
+Specify --file <path> or create ${join2("insforge", "functions", slug, "index.ts")}`
+        );
+      }
+      const code = readFileSync3(filePath, "utf-8");
+      const name = opts.name ?? slug;
+      const description = opts.description ?? "";
+      let exists = false;
+      try {
+        await ossFetch(`/api/functions/${encodeURIComponent(slug)}`);
+        exists = true;
+      } catch {
+        exists = false;
+      }
+      if (exists) {
+        await ossFetch(`/api/functions/${encodeURIComponent(slug)}`, {
+          method: "PUT",
+          body: JSON.stringify({ name, description, code })
+        });
+      } else {
+        await ossFetch("/api/functions", {
+          method: "POST",
+          body: JSON.stringify({ slug, name, description, code })
+        });
+      }
+      if (json) {
+        outputJson({ success: true, slug, action: exists ? "updated" : "created" });
+      } else {
+        outputSuccess(`Function "${slug}" ${exists ? "updated" : "created"} successfully.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/functions/invoke.ts
+function registerFunctionsInvokeCommand(functionsCmd2) {
+  functionsCmd2.command("invoke <slug>").description("Invoke an edge function").option("--data <json>", "JSON body to send to the function").option("--method <method>", "HTTP method (GET, POST, PUT, PATCH, DELETE)", "POST").action(async (slug, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      const method = opts.method.toUpperCase();
+      const headers = {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.api_key}`
+      };
+      const fetchOpts = { method, headers };
+      if (opts.data && ["POST", "PUT", "PATCH"].includes(method)) {
+        fetchOpts.body = opts.data;
+      }
+      const res = await fetch(
+        `${config.oss_host}/functions/${encodeURIComponent(slug)}`,
+        fetchOpts
+      );
+      const contentType = res.headers.get("content-type") ?? "";
+      const status = res.status;
+      if (contentType.includes("application/json")) {
+        const data = await res.json();
+        if (json) {
+          outputJson({ status, body: data });
+        } else {
+          if (status >= 400) {
+            console.error(`HTTP ${status}`);
+          }
+          console.log(JSON.stringify(data, null, 2));
+        }
+      } else {
+        const text3 = await res.text();
+        if (!json && status >= 400) {
+          console.error(`HTTP ${status}`);
+        }
+        console.log(text3);
+      }
+      if (status >= 400) {
+        process.exit(1);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/functions/code.ts
+function registerFunctionsCodeCommand(functionsCmd2) {
+  functionsCmd2.command("code <slug>").description("Fetch and display the source code of an edge function").action(async (slug, _opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch(`/api/functions/${encodeURIComponent(slug)}`);
+      const fn = await res.json();
+      if (json) {
+        outputJson(fn);
+      } else {
+        console.log(`Function: ${fn.name} (${fn.slug})`);
+        console.log(`Status:   ${fn.status}`);
+        if (fn.description) console.log(`Desc:     ${fn.description}`);
+        if (fn.deployed_at) console.log(`Deployed: ${fn.deployed_at}`);
+        console.log("---");
+        console.log(fn.code);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/buckets.ts
+function registerStorageBucketsCommand(storageCmd2) {
+  storageCmd2.command("buckets").description("List all storage buckets").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/storage/buckets");
+      const raw = await res.json();
+      let buckets;
+      if (Array.isArray(raw)) {
+        buckets = raw;
+      } else if (raw && typeof raw === "object" && "buckets" in raw && Array.isArray(raw.buckets)) {
+        buckets = raw.buckets;
+      } else {
+        const arr = raw && typeof raw === "object" ? Object.values(raw).find(Array.isArray) : null;
+        buckets = arr ?? [];
+      }
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (buckets.length === 0) {
+          console.log("No buckets found.");
+          return;
+        }
+        outputTable(
+          ["Bucket Name"],
+          buckets.map((b) => [typeof b === "string" ? b : JSON.stringify(b)])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/upload.ts
+import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { basename as basename2 } from "path";
+function registerStorageUploadCommand(storageCmd2) {
+  storageCmd2.command("upload <file>").description("Upload a file to a storage bucket").requiredOption("--bucket <name>", "Target bucket name").option("--key <objectKey>", "Object key (defaults to filename)").action(async (file, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      if (!existsSync3(file)) {
+        throw new CLIError(`File not found: ${file}`);
+      }
+      const fileContent = readFileSync4(file);
+      const objectKey = opts.key ?? basename2(file);
+      const bucketName = opts.bucket;
+      const formData = new FormData();
+      const blob = new Blob([fileContent]);
+      formData.append("file", blob, objectKey);
+      const url = `${config.oss_host}/api/storage/buckets/${encodeURIComponent(bucketName)}/objects/${encodeURIComponent(objectKey)}`;
+      const res = await fetch(url, {
+        method: "PUT",
+        headers: {
+          Authorization: `Bearer ${config.api_key}`
+        },
+        body: formData
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new CLIError(err.error ?? `Upload failed: ${res.status}`);
+      }
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(`Uploaded "${basename2(file)}" to bucket "${bucketName}".`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/download.ts
+import { writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, basename as basename3 } from "path";
+function registerStorageDownloadCommand(storageCmd2) {
+  storageCmd2.command("download <objectKey>").description("Download a file from a storage bucket").requiredOption("--bucket <name>", "Source bucket name").option("--output <path>", "Output file path (defaults to current directory)").action(async (objectKey, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      const bucketName = opts.bucket;
+      const url = `${config.oss_host}/api/storage/buckets/${encodeURIComponent(bucketName)}/objects/${encodeURIComponent(objectKey)}`;
+      const res = await fetch(url, {
+        headers: {
+          Authorization: `Bearer ${config.api_key}`
+        }
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new CLIError(err.error ?? `Download failed: ${res.status}`);
+      }
+      const buffer = Buffer.from(await res.arrayBuffer());
+      const outputPath = opts.output ?? join3(process.cwd(), basename3(objectKey));
+      writeFileSync3(outputPath, buffer);
+      if (json) {
+        outputJson({ success: true, path: outputPath, size: buffer.length });
+      } else {
+        outputSuccess(`Downloaded "${objectKey}" to ${outputPath} (${buffer.length} bytes).`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/create-bucket.ts
+function registerStorageCreateBucketCommand(storageCmd2) {
+  storageCmd2.command("create-bucket <name>").description("Create a new storage bucket").option("--public", "Make the bucket publicly accessible (default)").option("--private", "Make the bucket private").action(async (name, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const isPublic = !opts.private;
+      const res = await ossFetch("/api/storage/buckets", {
+        method: "POST",
+        body: JSON.stringify({ bucketName: name, isPublic })
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(`Bucket "${name}" created (${isPublic ? "public" : "private"}).`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/delete-bucket.ts
+import * as clack5 from "@clack/prompts";
+function registerStorageDeleteBucketCommand(storageCmd2) {
+  storageCmd2.command("delete-bucket <name>").description("Delete a storage bucket and all its objects").action(async (name, _opts, cmd) => {
+    const { json, yes } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!yes && !json) {
+        const confirm4 = await clack5.confirm({
+          message: `Delete bucket "${name}" and all its objects? This cannot be undone.`
+        });
+        if (!confirm4 || clack5.isCancel(confirm4)) {
+          process.exit(0);
+        }
+      }
+      const res = await ossFetch(`/api/storage/buckets/${encodeURIComponent(name)}`, {
+        method: "DELETE"
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(`Bucket "${name}" deleted.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/storage/list-objects.ts
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function registerStorageListObjectsCommand(storageCmd2) {
+  storageCmd2.command("list-objects <bucket>").description("List objects in a storage bucket").option("--limit <n>", "Maximum number of objects to return", "100").option("--offset <n>", "Number of objects to skip", "0").option("--prefix <prefix>", "Filter objects by key prefix").option("--search <term>", "Search objects by key (partial match)").option("--sort <field>", "Sort by field: key, size, uploadedAt (default: key)").action(async (bucket, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const params = new URLSearchParams();
+      params.set("limit", opts.limit);
+      params.set("offset", opts.offset);
+      if (opts.prefix) params.set("prefix", opts.prefix);
+      if (opts.search) params.set("search", opts.search);
+      const res = await ossFetch(
+        `/api/storage/buckets/${encodeURIComponent(bucket)}/objects?${params.toString()}`
+      );
+      const raw = await res.json();
+      const objects = Array.isArray(raw) ? raw : raw.data ?? [];
+      const sortField = opts.sort ?? "key";
+      objects.sort((a, b) => {
+        if (sortField === "size") return a.size - b.size;
+        if (sortField === "uploadedAt") return a.uploadedAt.localeCompare(b.uploadedAt);
+        return a.key.localeCompare(b.key);
+      });
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (objects.length === 0) {
+          console.log(`No objects found in bucket "${bucket}".`);
+          return;
+        }
+        const total = raw.pagination?.total;
+        if (total !== void 0) {
+          console.log(`Showing ${objects.length} of ${total} objects:
+`);
+        }
+        outputTable(
+          ["Key", "Size", "Type", "Uploaded At"],
+          objects.map((o) => [
+            o.key,
+            formatSize(o.size),
+            o.mimeType ?? "-",
+            o.uploadedAt
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/create.ts
+import { exec as exec2 } from "child_process";
+import { tmpdir } from "os";
+import { promisify as promisify2 } from "util";
+import * as fs from "fs/promises";
+import * as path from "path";
+import * as clack6 from "@clack/prompts";
+var execAsync2 = promisify2(exec2);
+function buildOssHost2(appkey, region) {
+  return `https://${appkey}.${region}.insforge.app`;
+}
+async function waitForProjectActive(projectId, apiUrl, timeoutMs = 12e4) {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const project = await getProject(projectId, apiUrl);
+    if (project.status === "active") return;
+    await new Promise((r) => setTimeout(r, 3e3));
+  }
+  throw new CLIError("Project creation timed out. Check the dashboard for status.");
+}
+async function copyDir(src, dest) {
+  const entries = await fs.readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      await fs.mkdir(destPath, { recursive: true });
+      await copyDir(srcPath, destPath);
+    } else {
+      await fs.copyFile(srcPath, destPath);
+    }
+  }
+}
+function registerCreateCommand(program2) {
+  program2.command("create").description("Create a new InsForge project").option("--name <name>", "Project name").option("--org-id <id>", "Organization ID").option("--region <region>", "Deployment region (us-east, us-west, eu-central, ap-southeast)").option("--template <template>", "Template to use: react, nextjs, or empty").action(async (opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!json) {
+        clack6.intro("Create a new InsForge project");
+      }
+      let orgId = opts.orgId;
+      if (!orgId) {
+        const orgs = await listOrganizations(apiUrl);
+        if (orgs.length === 0) {
+          throw new CLIError("No organizations found.");
+        }
+        if (json) {
+          throw new CLIError("Specify --org-id in JSON mode.");
+        }
+        const selected = await clack6.select({
+          message: "Select an organization:",
+          options: orgs.map((o) => ({
+            value: o.id,
+            label: o.name
+          }))
+        });
+        if (clack6.isCancel(selected)) process.exit(0);
+        orgId = selected;
+      }
+      const globalConfig = getGlobalConfig();
+      globalConfig.default_org_id = orgId;
+      saveGlobalConfig(globalConfig);
+      let projectName = opts.name;
+      if (!projectName) {
+        if (json) throw new CLIError("--name is required in JSON mode.");
+        const name = await clack6.text({
+          message: "Project name:",
+          validate: (v) => v.length >= 2 ? void 0 : "Name must be at least 2 characters"
+        });
+        if (clack6.isCancel(name)) process.exit(0);
+        projectName = name;
+      }
+      let template = opts.template;
+      if (!template) {
+        if (json) {
+          template = "empty";
+        } else {
+          const selected = await clack6.select({
+            message: "Choose a starter template:",
+            options: [
+              { value: "react", label: "Web app template with React" },
+              { value: "nextjs", label: "Web app template with Next.js" },
+              { value: "empty", label: "Empty project" }
+            ]
+          });
+          if (clack6.isCancel(selected)) process.exit(0);
+          template = selected;
+        }
+      }
+      const s = !json ? clack6.spinner() : null;
+      s?.start("Creating project...");
+      const project = await createProject(orgId, projectName, opts.region, apiUrl);
+      s?.message("Waiting for project to become active...");
+      await waitForProjectActive(project.id, apiUrl);
+      const apiKey = await getProjectApiKey(project.id, apiUrl);
+      const projectConfig = {
+        project_id: project.id,
+        project_name: project.name,
+        org_id: project.organization_id,
+        appkey: project.appkey,
+        region: project.region,
+        api_key: apiKey,
+        oss_host: buildOssHost2(project.appkey, project.region)
+      };
+      saveProjectConfig(projectConfig);
+      s?.stop(`Project "${project.name}" created and linked`);
+      if (template !== "empty") {
+        await downloadTemplate(template, projectConfig, projectName, json, apiUrl);
+      }
+      await installSkills(json);
+      if (json) {
+        outputJson({
+          success: true,
+          project: { id: project.id, name: project.name, appkey: project.appkey, region: project.region },
+          template
+        });
+      } else {
+        clack6.outro("Done! Run `npm install` to get started.");
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+async function downloadTemplate(framework, projectConfig, projectName, json, _apiUrl) {
+  const s = !json ? clack6.spinner() : null;
+  s?.start("Downloading template...");
+  try {
+    const anonKey = await getAnonKey();
+    if (!anonKey) {
+      throw new Error("Failed to retrieve anon key from backend");
+    }
+    const tempDir = tmpdir();
+    const targetDir = projectName;
+    const templatePath = path.join(tempDir, targetDir);
+    try {
+      await fs.rm(templatePath, { recursive: true, force: true });
+    } catch {
+    }
+    const frame = framework === "nextjs" ? "nextjs" : "react";
+    const command = `npx create-insforge-app ${targetDir} --frame ${frame} --base-url ${projectConfig.oss_host} --anon-key ${anonKey} --skip-install`;
+    s?.message(`Running create-insforge-app (${frame})...`);
+    await execAsync2(command, {
+      maxBuffer: 10 * 1024 * 1024,
+      cwd: tempDir
+    });
+    s?.message("Copying template files...");
+    const cwd = process.cwd();
+    await copyDir(templatePath, cwd);
+    await fs.rm(templatePath, { recursive: true, force: true }).catch(() => {
+    });
+    s?.stop("Template files downloaded");
+  } catch (err) {
+    s?.stop("Template download failed");
+    if (!json) {
+      clack6.log.warn(`Failed to download template: ${err.message}`);
+      clack6.log.info("You can manually set up the template later.");
+    }
+  }
+}
+
+// src/commands/info.ts
+function registerContextCommand(program2) {
+  program2.command("current").description("Show current CLI context (user, org, project)").action(async (_opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      const creds = getCredentials();
+      const globalConfig = getGlobalConfig();
+      const projectConfig = getProjectConfig();
+      if (json) {
+        outputJson({
+          authenticated: !!creds,
+          user: creds?.user ?? null,
+          default_org_id: globalConfig.default_org_id ?? null,
+          project: projectConfig
+        });
+        return;
+      }
+      console.log("\n  InsForge CLI Context\n");
+      if (creds) {
+        console.log(`  User:          ${creds.user.name} <${creds.user.email}>`);
+      } else {
+        console.log("  User:          (not logged in)");
+      }
+      if (globalConfig.default_org_id) {
+        console.log(`  Default Org:   ${globalConfig.default_org_id}`);
+      } else {
+        console.log("  Default Org:   (none)");
+      }
+      if (projectConfig) {
+        console.log("");
+        console.log(`  Project:       ${projectConfig.project_name} (${projectConfig.project_id})`);
+        console.log(`  App Key:       ${projectConfig.appkey}`);
+        console.log(`  Region:        ${projectConfig.region}`);
+        console.log(`  OSS Host:      ${projectConfig.oss_host}`);
+      } else {
+        console.log("\n  Project:       (not linked \u2014 run `insforge projects link`)");
+      }
+      console.log("");
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/list.ts
+function registerListCommand(program2) {
+  program2.command("list").description("List all organizations and their projects").action(async (_opts, cmd) => {
+    const { json, apiUrl } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const orgs = await listOrganizations(apiUrl);
+      if (orgs.length === 0) {
+        if (json) {
+          outputJson([]);
+        } else {
+          console.log("No organizations found.");
+        }
+        return;
+      }
+      const orgProjects = await Promise.all(
+        orgs.map(async (org) => ({
+          org,
+          projects: await listProjects(org.id, apiUrl)
+        }))
+      );
+      if (json) {
+        outputJson(
+          orgProjects.map(({ org, projects }) => ({
+            id: org.id,
+            name: org.name,
+            type: org.type ?? null,
+            projects: projects.map((p) => ({
+              id: p.id,
+              name: p.name,
+              region: p.region,
+              status: p.status,
+              appkey: p.appkey
+            }))
+          }))
+        );
+        return;
+      }
+      const rows = [];
+      for (const { org, projects } of orgProjects) {
+        if (projects.length === 0) {
+          rows.push([org.name, "-", "-", "-", "-"]);
+        } else {
+          for (let i = 0; i < projects.length; i++) {
+            const p = projects[i];
+            rows.push([
+              i === 0 ? org.name : "",
+              p.name,
+              p.region,
+              p.status,
+              p.appkey
+            ]);
+          }
+        }
+      }
+      outputTable(["Organization", "Project", "Region", "Status", "AppKey"], rows);
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/deployments/deploy.ts
+import * as path2 from "path";
+import * as fs2 from "fs/promises";
+import * as clack7 from "@clack/prompts";
+import archiver from "archiver";
+var POLL_INTERVAL_MS = 5e3;
+var POLL_TIMEOUT_MS = 12e4;
+var EXCLUDE_PATTERNS = [
+  "node_modules",
+  ".git",
+  ".next",
+  ".env",
+  ".env.local",
+  "dist",
+  "build",
+  ".DS_Store",
+  ".insforge"
+];
+function shouldExclude(name) {
+  const normalized = name.replace(/\\/g, "/");
+  for (const pattern of EXCLUDE_PATTERNS) {
+    if (normalized === pattern || normalized.startsWith(pattern + "/") || normalized.endsWith("/" + pattern) || normalized.includes("/" + pattern + "/")) {
+      return true;
+    }
+  }
+  if (normalized.endsWith(".log")) return true;
+  return false;
+}
+async function createZipBuffer(sourceDir) {
+  return new Promise((resolve2, reject) => {
+    const archive = archiver("zip", { zlib: { level: 9 } });
+    const chunks = [];
+    archive.on("data", (chunk) => chunks.push(chunk));
+    archive.on("end", () => resolve2(Buffer.concat(chunks)));
+    archive.on("error", (err) => reject(err));
+    archive.directory(sourceDir, false, (entry) => {
+      if (shouldExclude(entry.name)) return false;
+      return entry;
+    });
+    void archive.finalize();
+  });
+}
+function registerDeploymentsDeployCommand(deploymentsCmd2) {
+  deploymentsCmd2.command("deploy [directory]").description("Deploy a frontend project to Vercel").option("--env <vars>", `Environment variables as JSON (e.g. '{"KEY":"value"}')`).option("--meta <meta>", "Deployment metadata as JSON").action(async (directory, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      const sourceDir = path2.resolve(directory ?? ".");
+      const stats = await fs2.stat(sourceDir).catch(() => null);
+      if (!stats?.isDirectory()) {
+        throw new CLIError(`"${sourceDir}" is not a valid directory.`);
+      }
+      const s = !json ? clack7.spinner() : null;
+      s?.start("Creating deployment...");
+      const createRes = await ossFetch("/api/deployments", { method: "POST" });
+      const { id: deploymentId, uploadUrl, uploadFields } = await createRes.json();
+      s?.message("Compressing source files...");
+      const zipBuffer = await createZipBuffer(sourceDir);
+      s?.message("Uploading...");
+      const formData = new FormData();
+      for (const [key, value] of Object.entries(uploadFields)) {
+        formData.append(key, value);
+      }
+      formData.append(
+        "file",
+        new Blob([zipBuffer], { type: "application/zip" }),
+        "deployment.zip"
+      );
+      const uploadRes = await fetch(uploadUrl, { method: "POST", body: formData });
+      if (!uploadRes.ok) {
+        const uploadErr = await uploadRes.text();
+        throw new CLIError(`Failed to upload: ${uploadErr}`);
+      }
+      s?.message("Starting deployment...");
+      const startBody = {};
+      if (opts.env) {
+        try {
+          const parsed = JSON.parse(opts.env);
+          if (Array.isArray(parsed)) {
+            startBody.envVars = parsed;
+          } else {
+            startBody.envVars = Object.entries(parsed).map(([key, value]) => ({ key, value }));
+          }
+        } catch {
+          throw new CLIError("Invalid --env JSON.");
+        }
+      }
+      if (opts.meta) {
+        try {
+          startBody.meta = JSON.parse(opts.meta);
+        } catch {
+          throw new CLIError("Invalid --meta JSON.");
+        }
+      }
+      const startRes = await ossFetch(`/api/deployments/${deploymentId}/start`, {
+        method: "POST",
+        body: JSON.stringify(startBody)
+      });
+      await startRes.json();
+      s?.message("Building and deploying...");
+      const startTime = Date.now();
+      let deployment = null;
+      while (Date.now() - startTime < POLL_TIMEOUT_MS) {
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        try {
+          const statusRes = await ossFetch(`/api/deployments/${deploymentId}`);
+          deployment = await statusRes.json();
+          if (deployment.status === "ready" || deployment.status === "READY") {
+            break;
+          }
+          if (deployment.status === "error" || deployment.status === "ERROR" || deployment.status === "canceled") {
+            s?.stop("Deployment failed");
+            throw new CLIError(deployment.error ?? `Deployment failed with status: ${deployment.status}`);
+          }
+          const elapsed = Math.round((Date.now() - startTime) / 1e3);
+          s?.message(`Building and deploying... (${elapsed}s, status: ${deployment.status})`);
+        } catch (err) {
+          if (err instanceof CLIError) throw err;
+        }
+      }
+      const isReady = deployment?.status === "ready" || deployment?.status === "READY";
+      if (isReady) {
+        s?.stop("Deployment complete");
+        if (json) {
+          outputJson(deployment);
+        } else {
+          const liveUrl = deployment?.deploymentUrl ?? deployment?.url;
+          if (liveUrl) {
+            clack7.log.success(`Live at: ${liveUrl}`);
+          }
+          clack7.log.info(`Deployment ID: ${deploymentId}`);
+        }
+      } else {
+        s?.stop("Deployment is still building");
+        if (json) {
+          outputJson({ id: deploymentId, status: deployment?.status ?? "building", timedOut: true });
+        } else {
+          clack7.log.info(`Deployment ID: ${deploymentId}`);
+          clack7.log.warn("Deployment did not finish within 2 minutes.");
+          clack7.log.info(`Check status with: insforge deployments status ${deploymentId}`);
+        }
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/deployments/list.ts
+function registerDeploymentsListCommand(deploymentsCmd2) {
+  deploymentsCmd2.command("list").description("List all deployments").option("--limit <n>", "Limit number of results", "20").option("--offset <n>", "Offset for pagination", "0").action(async (opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!getProjectConfig()) throw new ProjectNotLinkedError();
+      const res = await ossFetch(`/api/deployments?limit=${opts.limit}&offset=${opts.offset}`);
+      const raw = await res.json();
+      let deployments;
+      if (Array.isArray(raw)) {
+        deployments = raw;
+      } else if (raw && typeof raw === "object" && "data" in raw && Array.isArray(raw.data)) {
+        deployments = raw.data;
+      } else {
+        deployments = [];
+      }
+      if (json) {
+        outputJson(raw);
+      } else {
+        if (!deployments.length) {
+          console.log("No deployments found.");
+          return;
+        }
+        outputTable(
+          ["ID", "Status", "Provider", "URL", "Created"],
+          deployments.map((d) => [
+            String(d.id ?? "-"),
+            String(d.status ?? "-"),
+            String(d.provider ?? "-"),
+            String(d.deploymentUrl ?? d.url ?? "-"),
+            d.createdAt ?? d.created_at ? new Date(String(d.createdAt ?? d.created_at)).toLocaleString() : "-"
+          ])
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/deployments/status.ts
+function registerDeploymentsStatusCommand(deploymentsCmd2) {
+  deploymentsCmd2.command("status <id>").description("Get deployment details and sync status from Vercel").option("--sync", "Sync status from Vercel before showing").action(async (id, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!getProjectConfig()) throw new ProjectNotLinkedError();
+      if (opts.sync) {
+        await ossFetch(`/api/deployments/${id}/sync`, { method: "POST" });
+      }
+      const res = await ossFetch(`/api/deployments/${id}`);
+      const d = await res.json();
+      if (json) {
+        outputJson(d);
+      } else {
+        outputTable(
+          ["Field", "Value"],
+          [
+            ["ID", d.id],
+            ["Status", d.status],
+            ["Provider", d.provider ?? "-"],
+            ["Provider ID", d.providerDeploymentId ?? "-"],
+            ["URL", d.deploymentUrl ?? d.url ?? "-"],
+            ["Created", new Date(d.createdAt).toLocaleString()],
+            ["Updated", new Date(d.updatedAt).toLocaleString()],
+            ...d.error ? [["Error", d.error]] : []
+          ]
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/deployments/cancel.ts
+import * as clack8 from "@clack/prompts";
+function registerDeploymentsCancelCommand(deploymentsCmd2) {
+  deploymentsCmd2.command("cancel <id>").description("Cancel a deployment").action(async (id, _opts, cmd) => {
+    const { json, yes } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!getProjectConfig()) throw new ProjectNotLinkedError();
+      if (!yes && !json) {
+        const confirmed = await clack8.confirm({
+          message: `Cancel deployment ${id}?`
+        });
+        if (clack8.isCancel(confirmed) || !confirmed) process.exit(0);
+      }
+      const res = await ossFetch(`/api/deployments/${id}/cancel`, { method: "POST" });
+      const result = await res.json();
+      if (json) {
+        outputJson(result);
+      } else {
+        outputSuccess(`Deployment ${id} cancelled.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/secrets/list.ts
+function registerSecretsListCommand(secretsCmd2) {
+  secretsCmd2.command("list").description("List secrets (metadata only, values are hidden)").option("--all", "Include inactive (deleted) secrets").action(async (opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch("/api/secrets");
+      const data = await res.json();
+      let secrets = data.secrets ?? [];
+      if (!opts.all) {
+        secrets = secrets.filter((s) => s.isActive !== false);
+      }
+      if (json) {
+        outputJson(opts.all ? data : { secrets });
+      } else {
+        if (!secrets.length) {
+          console.log("No secrets found.");
+          return;
+        }
+        const headers = opts.all ? ["Key", "Active", "Reserved", "Expires", "Updated"] : ["Key", "Reserved", "Expires", "Updated"];
+        outputTable(
+          headers,
+          secrets.map((s) => {
+            const row = [
+              String(s.key ?? "-"),
+              ...opts.all ? [s.isActive ? "Yes" : "No"] : [],
+              s.isReserved ? "Yes" : "No",
+              s.expiresAt ? new Date(String(s.expiresAt)).toLocaleString() : "-",
+              s.updatedAt ? new Date(String(s.updatedAt)).toLocaleString() : "-"
+            ];
+            return row;
+          })
+        );
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/secrets/get.ts
+function registerSecretsGetCommand(secretsCmd2) {
+  secretsCmd2.command("get <key>").description("Get the decrypted value of a secret").action(async (key, _opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const res = await ossFetch(`/api/secrets/${encodeURIComponent(key)}`);
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        console.log(`${data.key} = ${data.value}`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/secrets/add.ts
+function registerSecretsAddCommand(secretsCmd2) {
+  secretsCmd2.command("add <key> <value>").description("Create a new secret").option("--reserved", "Mark secret as protected from deletion").option("--expires <date>", "Expiration date (ISO 8601 format)").action(async (key, value, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const body = { key, value };
+      if (opts.reserved) body.isReserved = true;
+      if (opts.expires) body.expiresAt = opts.expires;
+      const res = await ossFetch("/api/secrets", {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(data.message ?? `Secret ${key} created.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/secrets/update.ts
+function registerSecretsUpdateCommand(secretsCmd2) {
+  secretsCmd2.command("update <key>").description("Update an existing secret").option("--value <value>", "New secret value").option("--active <bool>", "Set active status (true/false)").option("--reserved <bool>", "Set reserved status (true/false)").option("--expires <date>", 'Expiration date (ISO 8601, or "null" to remove)').action(async (key, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      const body = {};
+      if (opts.value !== void 0) body.value = opts.value;
+      if (opts.active !== void 0) body.isActive = opts.active === "true";
+      if (opts.reserved !== void 0) body.isReserved = opts.reserved === "true";
+      if (opts.expires !== void 0) body.expiresAt = opts.expires === "null" ? null : opts.expires;
+      if (Object.keys(body).length === 0) {
+        throw new CLIError("Provide at least one option to update (--value, --active, --reserved, --expires).");
+      }
+      const res = await ossFetch(`/api/secrets/${encodeURIComponent(key)}`, {
+        method: "PUT",
+        body: JSON.stringify(body)
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(data.message ?? `Secret ${key} updated.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/secrets/delete.ts
+import * as clack9 from "@clack/prompts";
+function registerSecretsDeleteCommand(secretsCmd2) {
+  secretsCmd2.command("delete <key>").description("Delete a secret").action(async (key, _opts, cmd) => {
+    const { json, yes } = getRootOpts(cmd);
+    try {
+      requireAuth();
+      if (!yes && !json) {
+        const confirm4 = await clack9.confirm({
+          message: `Delete secret "${key}"? This cannot be undone.`
+        });
+        if (!confirm4 || clack9.isCancel(confirm4)) {
+          process.exit(0);
+        }
+      }
+      const res = await ossFetch(`/api/secrets/${encodeURIComponent(key)}`, {
+        method: "DELETE"
+      });
+      const data = await res.json();
+      if (json) {
+        outputJson(data);
+      } else {
+        outputSuccess(data.message ?? `Secret ${key} deleted.`);
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/index.ts
+var INSFORGE_LOGO = `
+\u2588\u2588\u2557\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
+\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D
+\u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2557
+\u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255D
+\u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551     \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
+\u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D      \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`;
+function showLogoOnFirstRun() {
+  if (process.argv.includes("--json")) return;
+  const localDir = join5(process.cwd(), ".insforge");
+  if (existsSync4(localDir)) return;
+  console.log(INSFORGE_LOGO);
+  console.log("  Welcome to InsForge CLI! Run `insforge login` to get started.\n");
+  mkdirSync2(localDir, { recursive: true });
+}
+showLogoOnFirstRun();
+var program = new Command();
+program.name("insforge").description("InsForge CLI - Command line tool for InsForge platform").version("0.1.0");
+program.option("--json", "Output in JSON format").option("--project-id <id>", "Override linked project ID").option("--api-url <url>", "Override Platform API URL").option("-y, --yes", "Skip confirmation prompts");
+registerLoginCommand(program);
+registerLogoutCommand(program);
+registerWhoamiCommand(program);
+registerCreateCommand(program);
+registerContextCommand(program);
+registerListCommand(program);
+registerProjectLinkCommand(program);
+var orgsCmd = program.command("orgs", { hidden: true }).description("Manage organizations");
+registerOrgsCommands(orgsCmd);
+var projectsCmd = program.command("projects", { hidden: true }).description("Manage projects");
+registerProjectsCommands(projectsCmd);
+var dbCmd = program.command("db").description("Database operations");
+registerDbCommands(dbCmd);
+registerDbTablesCommand(dbCmd);
+registerDbFunctionsCommand(dbCmd);
+registerDbIndexesCommand(dbCmd);
+registerDbPoliciesCommand(dbCmd);
+registerDbTriggersCommand(dbCmd);
+registerDbRpcCommand(dbCmd);
+registerDbExportCommand(dbCmd);
+registerDbImportCommand(dbCmd);
+var recordsCmd = program.command("records", { hidden: true }).description("CRUD operations on table records");
+registerRecordsCommands(recordsCmd);
+registerRecordsCreateCommand(recordsCmd);
+registerRecordsUpdateCommand(recordsCmd);
+registerRecordsDeleteCommand(recordsCmd);
+var functionsCmd = program.command("functions").description("Manage edge functions");
+registerFunctionsCommands(functionsCmd);
+registerFunctionsCodeCommand(functionsCmd);
+registerFunctionsDeployCommand(functionsCmd);
+registerFunctionsInvokeCommand(functionsCmd);
+var storageCmd = program.command("storage").description("Manage storage");
+registerStorageBucketsCommand(storageCmd);
+registerStorageCreateBucketCommand(storageCmd);
+registerStorageDeleteBucketCommand(storageCmd);
+registerStorageListObjectsCommand(storageCmd);
+registerStorageUploadCommand(storageCmd);
+registerStorageDownloadCommand(storageCmd);
+var deploymentsCmd = program.command("deployments").description("Deploy and manage frontend sites");
+registerDeploymentsDeployCommand(deploymentsCmd);
+registerDeploymentsListCommand(deploymentsCmd);
+registerDeploymentsStatusCommand(deploymentsCmd);
+registerDeploymentsCancelCommand(deploymentsCmd);
+var secretsCmd = program.command("secrets").description("Manage secrets");
+registerSecretsListCommand(secretsCmd);
+registerSecretsGetCommand(secretsCmd);
+registerSecretsAddCommand(secretsCmd);
+registerSecretsUpdateCommand(secretsCmd);
+registerSecretsDeleteCommand(secretsCmd);
+program.parse();
+//# sourceMappingURL=index.js.map