@insforge/cli 0.1.5 → 0.1.7

package/dist/index.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 import { Command } from "commander";
 
 // src/commands/login.ts
-import * as clack from "@clack/prompts";
+import * as clack3 from "@clack/prompts";
 
 // src/lib/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
@@ -17,6 +17,7 @@ var GLOBAL_DIR = join(homedir(), ".insforge");
 var CREDENTIALS_FILE = join(GLOBAL_DIR, "credentials.json");
 var CONFIG_FILE = join(GLOBAL_DIR, "config.json");
 var DEFAULT_PLATFORM_URL = "https://api.insforge.dev";
+var DEFAULT_FRONTEND_URL = "https://insforge.dev";
 function ensureGlobalDir() {
   if (!existsSync(GLOBAL_DIR)) {
     mkdirSync(GLOBAL_DIR, { recursive: true });
@@ -78,6 +79,9 @@ function saveProjectConfig(config) {
 function getPlatformApiUrl(override) {
   return process.env.INSFORGE_API_URL ?? override ?? getGlobalConfig().platform_api_url ?? DEFAULT_PLATFORM_URL;
 }
+function getFrontendUrl() {
+  return process.env.INSFORGE_FRONTEND_URL ?? DEFAULT_FRONTEND_URL;
+}
 function getAccessToken() {
   return process.env.INSFORGE_ACCESS_TOKEN ?? getCredentials()?.access_token ?? null;
 }
@@ -135,6 +139,7 @@ function getRootOpts(cmd) {
 import { createServer } from "http";
 import { randomBytes, createHash } from "crypto";
 import { URL } from "url";
+import * as clack from "@clack/prompts";
 var DEFAULT_CLIENT_ID = "clf_NK8cMUs41gm8ZcfdtSguVw";
 var OAUTH_SCOPES = "user:read organizations:read projects:read projects:write";
 function generatePKCE() {
@@ -242,14 +247,77 @@ function startCallbackServer() {
     }, 5 * 60 * 1e3).unref();
   });
 }
+async function performOAuthLogin(apiUrl) {
+  const platformUrl = getPlatformApiUrl(apiUrl);
+  const config = getGlobalConfig();
+  const clientId = config.oauth_client_id ?? DEFAULT_CLIENT_ID;
+  const pkce = generatePKCE();
+  const state = generateState();
+  const { port, result, close } = await startCallbackServer();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const authUrl = buildAuthorizeUrl({
+    platformUrl,
+    clientId,
+    redirectUri,
+    codeChallenge: pkce.code_challenge,
+    state,
+    scopes: OAUTH_SCOPES
+  });
+  clack.log.info("Opening browser for authentication...");
+  clack.log.info(`If browser doesn't open, visit:
+${authUrl}`);
+  try {
+    const open = (await import("open")).default;
+    await open(authUrl);
+  } catch {
+    clack.log.warn("Could not open browser. Please visit the URL above.");
+  }
+  const s = clack.spinner();
+  s.start("Waiting for authentication...");
+  try {
+    const callbackResult = await result;
+    close();
+    if (callbackResult.state !== state) {
+      s.stop("Authentication failed");
+      throw new Error("State mismatch. Possible CSRF attack.");
+    }
+    s.message("Exchanging authorization code...");
+    const tokens = await exchangeCodeForTokens({
+      platformUrl,
+      code: callbackResult.code,
+      redirectUri,
+      clientId,
+      codeVerifier: pkce.code_verifier
+    });
+    const creds = {
+      access_token: tokens.access_token,
+      refresh_token: tokens.refresh_token,
+      user: { id: "", name: "", email: "", avatar_url: null, email_verified: true }
+    };
+    saveCredentials(creds);
+    try {
+      const profile = await getProfile(apiUrl);
+      creds.user = profile;
+      saveCredentials(creds);
+      s.stop(`Authenticated as ${profile.email}`);
+    } catch {
+      s.stop("Authenticated successfully");
+    }
+    return creds;
+  } catch (err) {
+    close();
+    s.stop("Authentication failed");
+    throw err;
+  }
+}
 
 // src/lib/credentials.ts
-function requireAuth() {
+import * as clack2 from "@clack/prompts";
+async function requireAuth(apiUrl) {
   const creds = getCredentials();
-  if (!creds || !creds.access_token) {
-    throw new AuthError();
-  }
-  return creds;
+  if (creds && creds.access_token) return creds;
+  clack2.log.info("You need to log in to continue.");
+  return await performOAuthLogin(apiUrl);
 }
 async function refreshAccessToken(apiUrl) {
   const creds = getCredentials();
@@ -371,7 +439,7 @@ function registerLoginCommand(program2) {
       if (opts.email) {
         await loginWithEmail(json, apiUrl);
       } else {
-        await loginWithOAuth(json, apiUrl, opts.clientId);
+        await loginWithOAuth(json, apiUrl);
       }
     } catch (err) {
       if (err instanceof Error && err.message.includes("cancelled")) {
@@ -383,28 +451,28 @@ function registerLoginCommand(program2) {
 }
 async function loginWithEmail(json, apiUrl) {
   if (!json) {
-    clack.intro("InsForge CLI");
+    clack3.intro("InsForge CLI");
   }
-  const email = json ? process.env.INSFORGE_EMAIL : await clack.text({
+  const email = json ? process.env.INSFORGE_EMAIL : await clack3.text({
     message: "Email:",
     validate: (v) => v.includes("@") ? void 0 : "Please enter a valid email"
   });
-  if (clack.isCancel(email)) {
-    clack.cancel("Login cancelled.");
+  if (clack3.isCancel(email)) {
+    clack3.cancel("Login cancelled.");
     throw new Error("cancelled");
   }
-  const password2 = json ? process.env.INSFORGE_PASSWORD : await clack.password({
+  const password2 = json ? process.env.INSFORGE_PASSWORD : await clack3.password({
     message: "Password:"
   });
-  if (clack.isCancel(password2)) {
-    clack.cancel("Login cancelled.");
+  if (clack3.isCancel(password2)) {
+    clack3.cancel("Login cancelled.");
     throw new Error("cancelled");
   }
   if (!email || !password2) {
     throw new Error("Email and password are required. Set INSFORGE_EMAIL and INSFORGE_PASSWORD environment variables for non-interactive mode.");
   }
   if (!json) {
-    const s = clack.spinner();
+    const s = clack3.spinner();
     s.start("Authenticating...");
     const result = await login(email, password2, apiUrl);
     const creds = {
@@ -414,7 +482,7 @@ async function loginWithEmail(json, apiUrl) {
     };
     saveCredentials(creds);
     s.stop(`Authenticated as ${result.user.email}`);
-    clack.outro("Done");
+    clack3.outro("Done");
   } else {
     const result = await login(email, password2, apiUrl);
     const creds = {
@@ -426,105 +494,15 @@ async function loginWithEmail(json, apiUrl) {
     console.log(JSON.stringify({ success: true, user: result.user }));
   }
 }
-async function loginWithOAuth(json, apiUrl, clientIdOverride) {
-  const platformUrl = getPlatformApiUrl(apiUrl);
-  const config = getGlobalConfig();
-  const clientId = clientIdOverride ?? config.oauth_client_id ?? DEFAULT_CLIENT_ID;
-  const pkce = generatePKCE();
-  const state = generateState();
-  const { port, result, close } = await startCallbackServer();
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const authUrl = buildAuthorizeUrl({
-    platformUrl,
-    clientId,
-    redirectUri,
-    codeChallenge: pkce.code_challenge,
-    state,
-    scopes: OAUTH_SCOPES
-  });
+async function loginWithOAuth(json, apiUrl) {
   if (!json) {
-    clack.intro("InsForge CLI");
-    clack.log.info("Opening browser for authentication...");
-    clack.log.info(`If browser doesn't open, visit:
-${authUrl}`);
-  }
-  try {
-    const open = (await import("open")).default;
-    await open(authUrl);
-  } catch {
-    if (!json) {
-      clack.log.warn(`Could not open browser. Please visit the URL above.`);
-    }
+    clack3.intro("InsForge CLI");
   }
+  const creds = await performOAuthLogin(apiUrl);
   if (!json) {
-    const s = clack.spinner();
-    s.start("Waiting for authentication...");
-    try {
-      const callbackResult = await result;
-      close();
-      if (callbackResult.state !== state) {
-        s.stop("Authentication failed");
-        throw new Error("State mismatch. Possible CSRF attack.");
-      }
-      s.message("Exchanging authorization code...");
-      const tokens = await exchangeCodeForTokens({
-        platformUrl,
-        code: callbackResult.code,
-        redirectUri,
-        clientId,
-        codeVerifier: pkce.code_verifier
-      });
-      const creds = {
-        access_token: tokens.access_token,
-        refresh_token: tokens.refresh_token,
-        user: { id: "", name: "", email: "", avatar_url: null, email_verified: true }
-      };
-      saveCredentials(creds);
-      try {
-        const profile = await getProfile(apiUrl);
-        creds.user = profile;
-        saveCredentials(creds);
-        s.stop(`Authenticated as ${profile.email}`);
-      } catch {
-        s.stop("Authenticated successfully");
-      }
-      clack.outro("Done");
-    } catch (err) {
-      close();
-      s.stop("Authentication failed");
-      throw err;
-    }
+    clack3.outro("Done");
   } else {
-    try {
-      const callbackResult = await result;
-      close();
-      if (callbackResult.state !== state) {
-        throw new Error("State mismatch.");
-      }
-      const tokens = await exchangeCodeForTokens({
-        platformUrl,
-        code: callbackResult.code,
-        redirectUri,
-        clientId,
-        codeVerifier: pkce.code_verifier
-      });
-      const creds = {
-        access_token: tokens.access_token,
-        refresh_token: tokens.refresh_token,
-        user: { id: "", name: "", email: "", avatar_url: null, email_verified: true }
-      };
-      saveCredentials(creds);
-      try {
-        const profile = await getProfile(apiUrl);
-        creds.user = profile;
-        saveCredentials(creds);
-      } catch {
-      }
-      console.log(JSON.stringify({ success: true, user: creds.user }));
-    } catch (err) {
-      close();
-      throw err;
-    }
+    console.log(JSON.stringify({ success: true, user: creds.user }));
   }
 }
 
@@ -572,7 +550,7 @@ function registerWhoamiCommand(program2) {
   program2.command("whoami").description("Show current authenticated user").action(async (_opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       const profile = await getProfile(apiUrl);
       if (json) {
         outputJson(profile);
@@ -592,7 +570,7 @@ function registerOrgsCommands(orgsCmd2) {
   orgsCmd2.command("list").description("List all organizations").action(async (_opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       const orgs = await listOrganizations(apiUrl);
       if (json) {
         outputJson(orgs);
@@ -617,12 +595,12 @@ function registerOrgsCommands(orgsCmd2) {
 }
 
 // src/commands/projects/list.ts
-import * as clack2 from "@clack/prompts";
+import * as clack4 from "@clack/prompts";
 function registerProjectsCommands(projectsCmd2) {
   projectsCmd2.command("list").description("List all projects in an organization").option("--org-id <id>", "Organization ID (uses default if not specified)").action(async (opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       let orgId = opts.orgId ?? getGlobalConfig().default_org_id;
       if (!orgId) {
         const orgs = await listOrganizations(apiUrl);
@@ -632,14 +610,14 @@ function registerProjectsCommands(projectsCmd2) {
         if (orgs.length === 1) {
           orgId = orgs[0].id;
         } else if (!json) {
-          const selected = await clack2.select({
+          const selected = await clack4.select({
             message: "Select an organization:",
             options: orgs.map((o) => ({
               value: o.id,
               label: o.name
             }))
           });
-          if (clack2.isCancel(selected)) {
+          if (clack4.isCancel(selected)) {
             process.exit(0);
           }
           orgId = selected;
@@ -667,23 +645,23 @@ function registerProjectsCommands(projectsCmd2) {
 }
 
 // src/commands/projects/link.ts
-import * as clack4 from "@clack/prompts";
+import * as clack6 from "@clack/prompts";
 
 // src/lib/skills.ts
 import { exec } from "child_process";
 import { promisify } from "util";
-import * as clack3 from "@clack/prompts";
+import * as clack5 from "@clack/prompts";
 var execAsync = promisify(exec);
 async function installSkills(json) {
   try {
-    if (!json) clack3.log.info("Installing InsForge agent skills...");
+    if (!json) clack5.log.info("Installing InsForge agent skills...");
     await execAsync("npx skills add insforge/agent-skills -y -a antigravity -a augment -a claude-code -a cline -a codex -a cursor -a gemini-cli -a github-copilot -a kilo -a qoder -a qwen-code -a roo -a trae -a windsurf", {
       cwd: process.cwd(),
       timeout: 6e4
     });
-    if (!json) clack3.log.success("InsForge agent skills installed.");
+    if (!json) clack5.log.success("InsForge agent skills installed.");
   } catch {
-    if (!json) clack3.log.warn("Failed to install agent skills. You can run manually: npx skills add insforge/agent-skills");
+    if (!json) clack5.log.warn("Failed to install agent skills. You can run manually: npx skills add insforge/agent-skills");
   }
 }
 
@@ -695,7 +673,7 @@ function registerProjectLinkCommand(program2) {
   program2.command("link").description("Link current directory to an InsForge project").option("--project-id <id>", "Project ID to link").option("--org-id <id>", "Organization ID").action(async (opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       let orgId = opts.orgId;
       let projectId = opts.projectId;
       if (!orgId) {
@@ -706,14 +684,14 @@ function registerProjectLinkCommand(program2) {
         if (json) {
           throw new CLIError("Specify --org-id in JSON mode.");
         }
-        const selected = await clack4.select({
+        const selected = await clack6.select({
           message: "Select an organization:",
           options: orgs.map((o) => ({
             value: o.id,
             label: o.name
           }))
         });
-        if (clack4.isCancel(selected)) process.exit(0);
+        if (clack6.isCancel(selected)) process.exit(0);
         orgId = selected;
       }
       const config = getGlobalConfig();
@@ -727,14 +705,14 @@ function registerProjectLinkCommand(program2) {
         if (json) {
           throw new CLIError("Specify --project-id in JSON mode.");
         }
-        const selected = await clack4.select({
+        const selected = await clack6.select({
           message: "Select a project to link:",
           options: projects.map((p) => ({
             value: p.id,
             label: `${p.name} (${p.region}, ${p.status})`
           }))
         });
-        if (clack4.isCancel(selected)) process.exit(0);
+        if (clack6.isCancel(selected)) process.exit(0);
         projectId = selected;
       }
       const [project, apiKey] = await Promise.all([
@@ -796,7 +774,7 @@ function registerDbCommands(dbCmd2) {
   dbCmd2.command("query <sql>").description("Execute a SQL query against the database").option("--unrestricted", "Use unrestricted mode (allows system table access)").action(async (sql, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const endpoint = opts.unrestricted ? "/api/database/advance/rawsql/unrestricted" : "/api/database/advance/rawsql";
       const res = await ossFetch(endpoint, {
         method: "POST",
@@ -832,7 +810,7 @@ function registerDbTablesCommand(dbCmd2) {
   dbCmd2.command("tables").description("List all database tables").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/database/tables");
       const tables = await res.json();
       if (json) {
@@ -871,7 +849,7 @@ function registerDbFunctionsCommand(dbCmd2) {
   dbCmd2.command("functions").description("List all database functions").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/database/functions");
       const raw = await res.json();
       const functions = extractArray(raw);
@@ -911,7 +889,7 @@ function registerDbIndexesCommand(dbCmd2) {
   dbCmd2.command("indexes").description("List all database indexes").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/database/indexes");
       const raw = await res.json();
       const indexes = extractArray2(raw);
@@ -957,7 +935,7 @@ function registerDbPoliciesCommand(dbCmd2) {
   dbCmd2.command("policies").description("List all RLS policies").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/database/policies");
       const raw = await res.json();
       const policies = extractArray3(raw);
@@ -1004,7 +982,7 @@ function registerDbTriggersCommand(dbCmd2) {
   dbCmd2.command("triggers").description("List all database triggers").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/database/triggers");
       const raw = await res.json();
       const triggers = extractArray4(raw);
@@ -1038,7 +1016,7 @@ function registerDbRpcCommand(dbCmd2) {
   dbCmd2.command("rpc <functionName>").description("Call a database function via RPC").option("--data <json>", "JSON body to pass as function parameters").action(async (functionName, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = opts.data ? JSON.stringify(JSON.parse(opts.data)) : void 0;
       const res = await ossFetch(`/api/database/rpc/${encodeURIComponent(functionName)}`, {
         method: body ? "POST" : "GET",
@@ -1062,7 +1040,7 @@ function registerDbExportCommand(dbCmd2) {
   dbCmd2.command("export").description("Export database schema and/or data").option("--format <format>", "Export format: sql or json", "sql").option("--tables <tables>", "Comma-separated list of tables to export (default: all)").option("--no-data", "Exclude table data (schema only)").option("--include-functions", "Include database functions").option("--include-sequences", "Include sequences").option("--include-views", "Include views").option("--row-limit <n>", "Maximum rows per table").option("-o, --output <file>", "Output file path (default: stdout)").action(async (opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = {
         format: opts.format,
         includeData: opts.data !== false
@@ -1117,7 +1095,7 @@ function registerDbImportCommand(dbCmd2) {
   dbCmd2.command("import <file>").description("Import database from a local SQL file").option("--truncate", "Truncate existing tables before import").action(async (file, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const config = getProjectConfig();
       if (!config) throw new ProjectNotLinkedError();
       const fileContent = readFileSync2(file);
@@ -1155,7 +1133,7 @@ function registerRecordsCommands(recordsCmd2) {
   recordsCmd2.command("list <table>").description("List records from a table").option("--select <columns>", "Columns to select (comma-separated)").option("--filter <filter>", 'Filter expression (e.g. "name=eq.John")').option("--order <order>", 'Order by (e.g. "created_at.desc")').option("--limit <n>", "Limit number of records", parseInt).option("--offset <n>", "Offset for pagination", parseInt).action(async (table, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const params = new URLSearchParams();
       if (opts.select) params.set("select", opts.select);
       if (opts.filter) params.set(opts.filter.split("=")[0], opts.filter.split("=").slice(1).join("="));
@@ -1197,7 +1175,7 @@ function registerRecordsCreateCommand(recordsCmd2) {
   recordsCmd2.command("create <table>").description("Create record(s) in a table").option("--data <json>", "JSON data to insert (object or array of objects)").action(async (table, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!opts.data) {
         throw new CLIError(`--data is required. Example: --data '{"name":"John"}'`);
       }
@@ -1233,7 +1211,7 @@ function registerRecordsUpdateCommand(recordsCmd2) {
   recordsCmd2.command("update <table>").description("Update records in a table matching a filter").option("--filter <filter>", 'Filter expression (e.g. "id=eq.123")').option("--data <json>", "JSON data to update").action(async (table, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!opts.filter) {
         throw new CLIError("--filter is required to prevent accidental updates to all rows.");
       }
@@ -1274,7 +1252,7 @@ function registerRecordsDeleteCommand(recordsCmd2) {
   recordsCmd2.command("delete <table>").description("Delete records from a table matching a filter").option("--filter <filter>", 'Filter expression (e.g. "id=eq.123")').action(async (table, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!opts.filter) {
         throw new CLIError("--filter is required to prevent accidental deletion of all rows.");
       }
@@ -1303,7 +1281,7 @@ function registerFunctionsCommands(functionsCmd2) {
   functionsCmd2.command("list").description("List all edge functions").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/functions");
       const data = await res.json();
       const functions = data.functions ?? [];
@@ -1337,7 +1315,7 @@ function registerFunctionsDeployCommand(functionsCmd2) {
   functionsCmd2.command("deploy <slug>").description("Deploy an edge function (create or update)").option("--file <path>", "Path to the function source file").option("--name <name>", "Function display name").option("--description <desc>", "Function description").action(async (slug, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const filePath = opts.file ?? join2(process.cwd(), "insforge", "functions", slug, "index.ts");
       if (!existsSync2(filePath)) {
         throw new CLIError(
@@ -1382,7 +1360,7 @@ function registerFunctionsInvokeCommand(functionsCmd2) {
   functionsCmd2.command("invoke <slug>").description("Invoke an edge function").option("--data <json>", "JSON body to send to the function").option("--method <method>", "HTTP method (GET, POST, PUT, PATCH, DELETE)", "POST").action(async (slug, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const config = getProjectConfig();
       if (!config) throw new ProjectNotLinkedError();
       const method = opts.method.toUpperCase();
@@ -1431,7 +1409,7 @@ function registerFunctionsCodeCommand(functionsCmd2) {
   functionsCmd2.command("code <slug>").description("Fetch and display the source code of an edge function").action(async (slug, _opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch(`/api/functions/${encodeURIComponent(slug)}`);
       const fn = await res.json();
       if (json) {
@@ -1455,7 +1433,7 @@ function registerStorageBucketsCommand(storageCmd2) {
   storageCmd2.command("buckets").description("List all storage buckets").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/storage/buckets");
       const raw = await res.json();
       let buckets;
@@ -1492,7 +1470,7 @@ function registerStorageUploadCommand(storageCmd2) {
   storageCmd2.command("upload <file>").description("Upload a file to a storage bucket").requiredOption("--bucket <name>", "Target bucket name").option("--key <objectKey>", "Object key (defaults to filename)").action(async (file, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const config = getProjectConfig();
       if (!config) throw new ProjectNotLinkedError();
       if (!existsSync3(file)) {
@@ -1535,7 +1513,7 @@ function registerStorageDownloadCommand(storageCmd2) {
   storageCmd2.command("download <objectKey>").description("Download a file from a storage bucket").requiredOption("--bucket <name>", "Source bucket name").option("--output <path>", "Output file path (defaults to current directory)").action(async (objectKey, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const config = getProjectConfig();
       if (!config) throw new ProjectNotLinkedError();
       const bucketName = opts.bucket;
@@ -1568,7 +1546,7 @@ function registerStorageCreateBucketCommand(storageCmd2) {
   storageCmd2.command("create-bucket <name>").description("Create a new storage bucket").option("--public", "Make the bucket publicly accessible (default)").option("--private", "Make the bucket private").action(async (name, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const isPublic = !opts.private;
       const res = await ossFetch("/api/storage/buckets", {
         method: "POST",
@@ -1587,17 +1565,17 @@ function registerStorageCreateBucketCommand(storageCmd2) {
 }
 
 // src/commands/storage/delete-bucket.ts
-import * as clack5 from "@clack/prompts";
+import * as clack7 from "@clack/prompts";
 function registerStorageDeleteBucketCommand(storageCmd2) {
   storageCmd2.command("delete-bucket <name>").description("Delete a storage bucket and all its objects").action(async (name, _opts, cmd) => {
     const { json, yes } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!yes && !json) {
-        const confirm5 = await clack5.confirm({
+        const confirm6 = await clack7.confirm({
           message: `Delete bucket "${name}" and all its objects? This cannot be undone.`
         });
-        if (!confirm5 || clack5.isCancel(confirm5)) {
+        if (!confirm6 || clack7.isCancel(confirm6)) {
           process.exit(0);
         }
       }
@@ -1626,7 +1604,7 @@ function registerStorageListObjectsCommand(storageCmd2) {
   storageCmd2.command("list-objects <bucket>").description("List objects in a storage bucket").option("--limit <n>", "Maximum number of objects to return", "100").option("--offset <n>", "Number of objects to skip", "0").option("--prefix <prefix>", "Filter objects by key prefix").option("--search <term>", "Search objects by key (partial match)").option("--sort <field>", "Sort by field: key, size, uploadedAt (default: key)").action(async (bucket, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const params = new URLSearchParams();
       params.set("limit", opts.limit);
       params.set("offset", opts.offset);
@@ -1675,9 +1653,166 @@ function registerStorageListObjectsCommand(storageCmd2) {
 import { exec as exec2 } from "child_process";
 import { tmpdir } from "os";
 import { promisify as promisify2 } from "util";
-import * as fs from "fs/promises";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import * as clack9 from "@clack/prompts";
+
+// src/commands/deployments/deploy.ts
 import * as path from "path";
-import * as clack6 from "@clack/prompts";
+import * as fs from "fs/promises";
+import * as clack8 from "@clack/prompts";
+import archiver from "archiver";
+var POLL_INTERVAL_MS = 5e3;
+var POLL_TIMEOUT_MS = 12e4;
+var EXCLUDE_PATTERNS = [
+  "node_modules",
+  ".git",
+  ".next",
+  ".env",
+  ".env.local",
+  "dist",
+  "build",
+  ".DS_Store",
+  ".insforge"
+];
+function shouldExclude(name) {
+  const normalized = name.replace(/\\/g, "/");
+  for (const pattern of EXCLUDE_PATTERNS) {
+    if (normalized === pattern || normalized.startsWith(pattern + "/") || normalized.endsWith("/" + pattern) || normalized.includes("/" + pattern + "/")) {
+      return true;
+    }
+  }
+  if (normalized.endsWith(".log")) return true;
+  return false;
+}
+async function createZipBuffer(sourceDir) {
+  return new Promise((resolve2, reject) => {
+    const archive = archiver("zip", { zlib: { level: 9 } });
+    const chunks = [];
+    archive.on("data", (chunk) => chunks.push(chunk));
+    archive.on("end", () => resolve2(Buffer.concat(chunks)));
+    archive.on("error", (err) => reject(err));
+    archive.directory(sourceDir, false, (entry) => {
+      if (shouldExclude(entry.name)) return false;
+      return entry;
+    });
+    void archive.finalize();
+  });
+}
+async function deployProject(opts) {
+  const { sourceDir, startBody = {}, spinner: s } = opts;
+  s?.start("Creating deployment...");
+  const createRes = await ossFetch("/api/deployments", { method: "POST" });
+  const { id: deploymentId, uploadUrl, uploadFields } = await createRes.json();
+  s?.message("Compressing source files...");
+  const zipBuffer = await createZipBuffer(sourceDir);
+  s?.message("Uploading...");
+  const formData = new FormData();
+  for (const [key, value] of Object.entries(uploadFields)) {
+    formData.append(key, value);
+  }
+  formData.append(
+    "file",
+    new Blob([zipBuffer], { type: "application/zip" }),
+    "deployment.zip"
+  );
+  const uploadRes = await fetch(uploadUrl, { method: "POST", body: formData });
+  if (!uploadRes.ok) {
+    const uploadErr = await uploadRes.text();
+    throw new CLIError(`Failed to upload: ${uploadErr}`);
+  }
+  s?.message("Starting deployment...");
+  const startRes = await ossFetch(`/api/deployments/${deploymentId}/start`, {
+    method: "POST",
+    body: JSON.stringify(startBody)
+  });
+  await startRes.json();
+  s?.message("Building and deploying...");
+  const startTime = Date.now();
+  let deployment = null;
+  while (Date.now() - startTime < POLL_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const statusRes = await ossFetch(`/api/deployments/${deploymentId}`);
+      deployment = await statusRes.json();
+      if (deployment.status === "ready" || deployment.status === "READY") {
+        break;
+      }
+      if (deployment.status === "error" || deployment.status === "ERROR" || deployment.status === "canceled") {
+        s?.stop("Deployment failed");
+        throw new CLIError(deployment.error ?? `Deployment failed with status: ${deployment.status}`);
+      }
+      const elapsed = Math.round((Date.now() - startTime) / 1e3);
+      s?.message(`Building and deploying... (${elapsed}s, status: ${deployment.status})`);
+    } catch (err) {
+      if (err instanceof CLIError) throw err;
+    }
+  }
+  const isReady = deployment?.status === "ready" || deployment?.status === "READY";
+  const liveUrl = isReady ? deployment?.deploymentUrl ?? deployment?.url ?? null : null;
+  return { deploymentId, deployment, isReady, liveUrl };
+}
+function registerDeploymentsDeployCommand(deploymentsCmd2) {
+  deploymentsCmd2.command("deploy [directory]").description("Deploy a frontend project to Vercel").option("--env <vars>", `Environment variables as JSON (e.g. '{"KEY":"value"}')`).option("--meta <meta>", "Deployment metadata as JSON").action(async (directory, opts, cmd) => {
+    const { json } = getRootOpts(cmd);
+    try {
+      await requireAuth();
+      const config = getProjectConfig();
+      if (!config) throw new ProjectNotLinkedError();
+      const sourceDir = path.resolve(directory ?? ".");
+      const stats = await fs.stat(sourceDir).catch(() => null);
+      if (!stats?.isDirectory()) {
+        throw new CLIError(`"${sourceDir}" is not a valid directory.`);
+      }
+      const s = !json ? clack8.spinner() : null;
+      const startBody = {};
+      if (opts.env) {
+        try {
+          const parsed = JSON.parse(opts.env);
+          if (Array.isArray(parsed)) {
+            startBody.envVars = parsed;
+          } else {
+            startBody.envVars = Object.entries(parsed).map(([key, value]) => ({ key, value }));
+          }
+        } catch {
+          throw new CLIError("Invalid --env JSON.");
+        }
+      }
+      if (opts.meta) {
+        try {
+          startBody.meta = JSON.parse(opts.meta);
+        } catch {
+          throw new CLIError("Invalid --meta JSON.");
+        }
+      }
+      const result = await deployProject({ sourceDir, startBody, spinner: s });
+      if (result.isReady) {
+        s?.stop("Deployment complete");
+        if (json) {
+          outputJson(result.deployment);
+        } else {
+          if (result.liveUrl) {
+            clack8.log.success(`Live at: ${result.liveUrl}`);
+          }
+          clack8.log.info(`Deployment ID: ${result.deploymentId}`);
+        }
+      } else {
+        s?.stop("Deployment is still building");
+        if (json) {
+          outputJson({ id: result.deploymentId, status: result.deployment?.status ?? "building", timedOut: true });
+        } else {
+          clack8.log.info(`Deployment ID: ${result.deploymentId}`);
+          clack8.log.warn("Deployment did not finish within 2 minutes.");
+          clack8.log.info(`Check status with: insforge deployments status ${result.deploymentId}`);
+        }
+      }
+    } catch (err) {
+      handleError(err, json);
+    }
+  });
+}
+
+// src/commands/create.ts
 var execAsync2 = promisify2(exec2);
 function buildOssHost2(appkey, region) {
   return `https://${appkey}.${region}.insforge.app`;
@@ -1692,15 +1827,15 @@ async function waitForProjectActive(projectId, apiUrl, timeoutMs = 12e4) {
   throw new CLIError("Project creation timed out. Check the dashboard for status.");
 }
 async function copyDir(src, dest) {
-  const entries = await fs.readdir(src, { withFileTypes: true });
+  const entries = await fs2.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
+    const srcPath = path2.join(src, entry.name);
+    const destPath = path2.join(dest, entry.name);
     if (entry.isDirectory()) {
-      await fs.mkdir(destPath, { recursive: true });
+      await fs2.mkdir(destPath, { recursive: true });
       await copyDir(srcPath, destPath);
     } else {
-      await fs.copyFile(srcPath, destPath);
+      await fs2.copyFile(srcPath, destPath);
     }
   }
 }
@@ -1708,9 +1843,9 @@ function registerCreateCommand(program2) {
   program2.command("create").description("Create a new InsForge project").option("--name <name>", "Project name").option("--org-id <id>", "Organization ID").option("--region <region>", "Deployment region (us-east, us-west, eu-central, ap-southeast)").option("--template <template>", "Template to use: react, nextjs, or empty").action(async (opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       if (!json) {
-        clack6.intro("Create a new InsForge project");
+        clack9.intro("Create a new InsForge project");
       }
       let orgId = opts.orgId;
       if (!orgId) {
@@ -1721,14 +1856,14 @@ function registerCreateCommand(program2) {
         if (json) {
           throw new CLIError("Specify --org-id in JSON mode.");
         }
-        const selected = await clack6.select({
+        const selected = await clack9.select({
           message: "Select an organization:",
           options: orgs.map((o) => ({
             value: o.id,
             label: o.name
           }))
         });
-        if (clack6.isCancel(selected)) process.exit(0);
+        if (clack9.isCancel(selected)) process.exit(0);
         orgId = selected;
       }
       const globalConfig = getGlobalConfig();
@@ -1737,11 +1872,11 @@ function registerCreateCommand(program2) {
       let projectName = opts.name;
       if (!projectName) {
         if (json) throw new CLIError("--name is required in JSON mode.");
-        const name = await clack6.text({
+        const name = await clack9.text({
           message: "Project name:",
           validate: (v) => v.length >= 2 ? void 0 : "Name must be at least 2 characters"
         });
-        if (clack6.isCancel(name)) process.exit(0);
+        if (clack9.isCancel(name)) process.exit(0);
         projectName = name;
       }
       let template = opts.template;
@@ -1749,7 +1884,7 @@ function registerCreateCommand(program2) {
         if (json) {
           template = "empty";
         } else {
-          const selected = await clack6.select({
+          const selected = await clack9.select({
             message: "Choose a starter template:",
             options: [
               { value: "react", label: "Web app template with React" },
@@ -1757,11 +1892,11 @@ function registerCreateCommand(program2) {
               { value: "empty", label: "Empty project" }
             ]
           });
-          if (clack6.isCancel(selected)) process.exit(0);
+          if (clack9.isCancel(selected)) process.exit(0);
           template = selected;
         }
       }
-      const s = !json ? clack6.spinner() : null;
+      const s = !json ? clack9.spinner() : null;
       s?.start("Creating project...");
       const project = await createProject(orgId, projectName, opts.region, apiUrl);
       s?.message("Waiting for project to become active...");
@@ -1778,18 +1913,68 @@ function registerCreateCommand(program2) {
       };
       saveProjectConfig(projectConfig);
       s?.stop(`Project "${project.name}" created and linked`);
-      if (template !== "empty") {
+      const hasTemplate = template !== "empty";
+      if (hasTemplate) {
         await downloadTemplate(template, projectConfig, projectName, json, apiUrl);
       }
       await installSkills(json);
+      if (hasTemplate) {
+        const installSpinner = !json ? clack9.spinner() : null;
+        installSpinner?.start("Installing dependencies...");
+        try {
+          await execAsync2("npm install", { cwd: process.cwd(), maxBuffer: 10 * 1024 * 1024 });
+          installSpinner?.stop("Dependencies installed");
+        } catch (err) {
+          installSpinner?.stop("Failed to install dependencies");
+          if (!json) {
+            clack9.log.warn(`npm install failed: ${err.message}`);
+            clack9.log.info("Run `npm install` manually to install dependencies.");
+          }
+        }
+      }
+      let liveUrl = null;
+      if (hasTemplate && !json) {
+        const shouldDeploy = await clack9.confirm({
+          message: "Would you like to deploy now?"
+        });
+        if (!clack9.isCancel(shouldDeploy) && shouldDeploy) {
+          try {
+            const deploySpinner = clack9.spinner();
+            const result = await deployProject({
+              sourceDir: process.cwd(),
+              spinner: deploySpinner
+            });
+            if (result.isReady) {
+              deploySpinner.stop("Deployment complete");
+              liveUrl = result.liveUrl;
+            } else {
+              deploySpinner.stop("Deployment is still building");
+              clack9.log.info(`Deployment ID: ${result.deploymentId}`);
+              clack9.log.warn("Deployment did not finish within 2 minutes.");
+              clack9.log.info(`Check status with: insforge deployments status ${result.deploymentId}`);
+            }
+          } catch (err) {
+            clack9.log.warn(`Deploy failed: ${err.message}`);
+          }
+        }
+      }
+      const dashboardUrl = `${getFrontendUrl()}/dashboard/project/${project.id}`;
       if (json) {
         outputJson({
           success: true,
           project: { id: project.id, name: project.name, appkey: project.appkey, region: project.region },
-          template
+          template,
+          urls: {
+            dashboard: dashboardUrl,
+            ...liveUrl ? { liveSite: liveUrl } : {}
+          }
         });
       } else {
-        clack6.outro("Done! Run `npm install` to get started.");
+        clack9.log.step(`Dashboard: ${dashboardUrl}`);
+        if (liveUrl) {
+          clack9.log.success(`Live site: ${liveUrl}`);
+        }
+        clack9.outro("Done!");
       }
     } catch (err) {
       handleError(err, json);
@@ -1797,7 +1982,7 @@ function registerCreateCommand(program2) {
   });
 }
 async function downloadTemplate(framework, projectConfig, projectName, json, _apiUrl) {
-  const s = !json ? clack6.spinner() : null;
+  const s = !json ? clack9.spinner() : null;
   s?.start("Downloading template...");
   try {
     const anonKey = await getAnonKey();
@@ -1806,9 +1991,9 @@ async function downloadTemplate(framework, projectConfig, projectName, json, _ap
     }
     const tempDir = tmpdir();
     const targetDir = projectName;
-    const templatePath = path.join(tempDir, targetDir);
+    const templatePath = path2.join(tempDir, targetDir);
     try {
-      await fs.rm(templatePath, { recursive: true, force: true });
+      await fs2.rm(templatePath, { recursive: true, force: true });
     } catch {
     }
     const frame = framework === "nextjs" ? "nextjs" : "react";
@@ -1821,14 +2006,14 @@ async function downloadTemplate(framework, projectConfig, projectName, json, _ap
     s?.message("Copying template files...");
     const cwd = process.cwd();
     await copyDir(templatePath, cwd);
-    await fs.rm(templatePath, { recursive: true, force: true }).catch(() => {
+    await fs2.rm(templatePath, { recursive: true, force: true }).catch(() => {
     });
     s?.stop("Template files downloaded");
   } catch (err) {
     s?.stop("Template download failed");
     if (!json) {
-      clack6.log.warn(`Failed to download template: ${err.message}`);
-      clack6.log.info("You can manually set up the template later.");
+      clack9.log.warn(`Failed to download template: ${err.message}`);
+      clack9.log.info("You can manually set up the template later.");
     }
   }
 }
@@ -1882,7 +2067,7 @@ function registerListCommand(program2) {
   program2.command("list").description("List all organizations and their projects").action(async (_opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth(apiUrl);
       const orgs = await listOrganizations(apiUrl);
       if (orgs.length === 0) {
         if (json) {
@@ -1939,162 +2124,12 @@ function registerListCommand(program2) {
   });
 }
 
-// src/commands/deployments/deploy.ts
-import * as path2 from "path";
-import * as fs2 from "fs/promises";
-import * as clack7 from "@clack/prompts";
-import archiver from "archiver";
-var POLL_INTERVAL_MS = 5e3;
-var POLL_TIMEOUT_MS = 12e4;
-var EXCLUDE_PATTERNS = [
-  "node_modules",
-  ".git",
-  ".next",
-  ".env",
-  ".env.local",
-  "dist",
-  "build",
-  ".DS_Store",
-  ".insforge"
-];
-function shouldExclude(name) {
-  const normalized = name.replace(/\\/g, "/");
-  for (const pattern of EXCLUDE_PATTERNS) {
-    if (normalized === pattern || normalized.startsWith(pattern + "/") || normalized.endsWith("/" + pattern) || normalized.includes("/" + pattern + "/")) {
-      return true;
-    }
-  }
-  if (normalized.endsWith(".log")) return true;
-  return false;
-}
-async function createZipBuffer(sourceDir) {
-  return new Promise((resolve2, reject) => {
-    const archive = archiver("zip", { zlib: { level: 9 } });
-    const chunks = [];
-    archive.on("data", (chunk) => chunks.push(chunk));
-    archive.on("end", () => resolve2(Buffer.concat(chunks)));
-    archive.on("error", (err) => reject(err));
-    archive.directory(sourceDir, false, (entry) => {
-      if (shouldExclude(entry.name)) return false;
-      return entry;
-    });
-    void archive.finalize();
-  });
-}
-function registerDeploymentsDeployCommand(deploymentsCmd2) {
-  deploymentsCmd2.command("deploy [directory]").description("Deploy a frontend project to Vercel").option("--env <vars>", `Environment variables as JSON (e.g. '{"KEY":"value"}')`).option("--meta <meta>", "Deployment metadata as JSON").action(async (directory, opts, cmd) => {
-    const { json } = getRootOpts(cmd);
-    try {
-      requireAuth();
-      const config = getProjectConfig();
-      if (!config) throw new ProjectNotLinkedError();
-      const sourceDir = path2.resolve(directory ?? ".");
-      const stats = await fs2.stat(sourceDir).catch(() => null);
-      if (!stats?.isDirectory()) {
-        throw new CLIError(`"${sourceDir}" is not a valid directory.`);
-      }
-      const s = !json ? clack7.spinner() : null;
-      s?.start("Creating deployment...");
-      const createRes = await ossFetch("/api/deployments", { method: "POST" });
-      const { id: deploymentId, uploadUrl, uploadFields } = await createRes.json();
-      s?.message("Compressing source files...");
-      const zipBuffer = await createZipBuffer(sourceDir);
-      s?.message("Uploading...");
-      const formData = new FormData();
-      for (const [key, value] of Object.entries(uploadFields)) {
-        formData.append(key, value);
-      }
-      formData.append(
-        "file",
-        new Blob([zipBuffer], { type: "application/zip" }),
-        "deployment.zip"
-      );
-      const uploadRes = await fetch(uploadUrl, { method: "POST", body: formData });
-      if (!uploadRes.ok) {
-        const uploadErr = await uploadRes.text();
-        throw new CLIError(`Failed to upload: ${uploadErr}`);
-      }
-      s?.message("Starting deployment...");
-      const startBody = {};
-      if (opts.env) {
-        try {
-          const parsed = JSON.parse(opts.env);
-          if (Array.isArray(parsed)) {
-            startBody.envVars = parsed;
-          } else {
-            startBody.envVars = Object.entries(parsed).map(([key, value]) => ({ key, value }));
-          }
-        } catch {
-          throw new CLIError("Invalid --env JSON.");
-        }
-      }
-      if (opts.meta) {
-        try {
-          startBody.meta = JSON.parse(opts.meta);
-        } catch {
-          throw new CLIError("Invalid --meta JSON.");
-        }
-      }
-      const startRes = await ossFetch(`/api/deployments/${deploymentId}/start`, {
-        method: "POST",
-        body: JSON.stringify(startBody)
-      });
-      await startRes.json();
-      s?.message("Building and deploying...");
-      const startTime = Date.now();
-      let deployment = null;
-      while (Date.now() - startTime < POLL_TIMEOUT_MS) {
-        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-        try {
-          const statusRes = await ossFetch(`/api/deployments/${deploymentId}`);
-          deployment = await statusRes.json();
-          if (deployment.status === "ready" || deployment.status === "READY") {
-            break;
-          }
-          if (deployment.status === "error" || deployment.status === "ERROR" || deployment.status === "canceled") {
-            s?.stop("Deployment failed");
-            throw new CLIError(deployment.error ?? `Deployment failed with status: ${deployment.status}`);
-          }
-          const elapsed = Math.round((Date.now() - startTime) / 1e3);
-          s?.message(`Building and deploying... (${elapsed}s, status: ${deployment.status})`);
-        } catch (err) {
-          if (err instanceof CLIError) throw err;
-        }
-      }
-      const isReady = deployment?.status === "ready" || deployment?.status === "READY";
-      if (isReady) {
-        s?.stop("Deployment complete");
-        if (json) {
-          outputJson(deployment);
-        } else {
-          const liveUrl = deployment?.deploymentUrl ?? deployment?.url;
-          if (liveUrl) {
-            clack7.log.success(`Live at: ${liveUrl}`);
-          }
-          clack7.log.info(`Deployment ID: ${deploymentId}`);
-        }
-      } else {
-        s?.stop("Deployment is still building");
-        if (json) {
-          outputJson({ id: deploymentId, status: deployment?.status ?? "building", timedOut: true });
-        } else {
-          clack7.log.info(`Deployment ID: ${deploymentId}`);
-          clack7.log.warn("Deployment did not finish within 2 minutes.");
-          clack7.log.info(`Check status with: insforge deployments status ${deploymentId}`);
-        }
-      }
-    } catch (err) {
-      handleError(err, json);
-    }
-  });
-}
-
 // src/commands/deployments/list.ts
 function registerDeploymentsListCommand(deploymentsCmd2) {
   deploymentsCmd2.command("list").description("List all deployments").option("--limit <n>", "Limit number of results", "20").option("--offset <n>", "Offset for pagination", "0").action(async (opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!getProjectConfig()) throw new ProjectNotLinkedError();
       const res = await ossFetch(`/api/deployments?limit=${opts.limit}&offset=${opts.offset}`);
       const raw = await res.json();
@@ -2135,7 +2170,7 @@ function registerDeploymentsStatusCommand(deploymentsCmd2) {
   deploymentsCmd2.command("status <id>").description("Get deployment details and sync status from Vercel").option("--sync", "Sync status from Vercel before showing").action(async (id, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!getProjectConfig()) throw new ProjectNotLinkedError();
       if (opts.sync) {
         await ossFetch(`/api/deployments/${id}/sync`, { method: "POST" });
@@ -2166,18 +2201,18 @@ function registerDeploymentsStatusCommand(deploymentsCmd2) {
 }
 
 // src/commands/deployments/cancel.ts
-import * as clack8 from "@clack/prompts";
+import * as clack10 from "@clack/prompts";
 function registerDeploymentsCancelCommand(deploymentsCmd2) {
   deploymentsCmd2.command("cancel <id>").description("Cancel a deployment").action(async (id, _opts, cmd) => {
     const { json, yes } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!getProjectConfig()) throw new ProjectNotLinkedError();
       if (!yes && !json) {
-        const confirmed = await clack8.confirm({
+        const confirmed = await clack10.confirm({
           message: `Cancel deployment ${id}?`
         });
-        if (clack8.isCancel(confirmed) || !confirmed) process.exit(0);
+        if (clack10.isCancel(confirmed) || !confirmed) process.exit(0);
       }
       const res = await ossFetch(`/api/deployments/${id}/cancel`, { method: "POST" });
       const result = await res.json();
@@ -2208,7 +2243,7 @@ Examples:
   insforge docs storage rest-api       Show REST API storage docs`).action(async (feature, language, _opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!feature) {
         await listDocs(json);
         return;
@@ -2264,7 +2299,7 @@ function registerSecretsListCommand(secretsCmd2) {
   secretsCmd2.command("list").description("List secrets (metadata only, values are hidden)").option("--all", "Include inactive (deleted) secrets").action(async (opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/secrets");
       const data = await res.json();
       let secrets = data.secrets ?? [];
@@ -2304,7 +2339,7 @@ function registerSecretsGetCommand(secretsCmd2) {
   secretsCmd2.command("get <key>").description("Get the decrypted value of a secret").action(async (key, _opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch(`/api/secrets/${encodeURIComponent(key)}`);
       const data = await res.json();
       if (json) {
@@ -2323,7 +2358,7 @@ function registerSecretsAddCommand(secretsCmd2) {
   secretsCmd2.command("add <key> <value>").description("Create a new secret").option("--reserved", "Mark secret as protected from deletion").option("--expires <date>", "Expiration date (ISO 8601 format)").action(async (key, value, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = { key, value };
       if (opts.reserved) body.isReserved = true;
       if (opts.expires) body.expiresAt = opts.expires;
@@ -2348,7 +2383,7 @@ function registerSecretsUpdateCommand(secretsCmd2) {
   secretsCmd2.command("update <key>").description("Update an existing secret").option("--value <value>", "New secret value").option("--active <bool>", "Set active status (true/false)").option("--reserved <bool>", "Set reserved status (true/false)").option("--expires <date>", 'Expiration date (ISO 8601, or "null" to remove)').action(async (key, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = {};
       if (opts.value !== void 0) body.value = opts.value;
       if (opts.active !== void 0) body.isActive = opts.active === "true";
@@ -2374,17 +2409,17 @@ function registerSecretsUpdateCommand(secretsCmd2) {
 }
 
 // src/commands/secrets/delete.ts
-import * as clack9 from "@clack/prompts";
+import * as clack11 from "@clack/prompts";
 function registerSecretsDeleteCommand(secretsCmd2) {
   secretsCmd2.command("delete <key>").description("Delete a secret").action(async (key, _opts, cmd) => {
     const { json, yes } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!yes && !json) {
-        const confirm5 = await clack9.confirm({
+        const confirm6 = await clack11.confirm({
           message: `Delete secret "${key}"? This cannot be undone.`
         });
-        if (!confirm5 || clack9.isCancel(confirm5)) {
+        if (!confirm6 || clack11.isCancel(confirm6)) {
           process.exit(0);
         }
       }
@@ -2408,7 +2443,7 @@ function registerSchedulesListCommand(schedulesCmd2) {
   schedulesCmd2.command("list").description("List all schedules").action(async (_opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch("/api/schedules");
       const data = await res.json();
       const schedules = Array.isArray(data) ? data : data.schedules ?? [];
@@ -2443,7 +2478,7 @@ function registerSchedulesGetCommand(schedulesCmd2) {
   schedulesCmd2.command("get <id>").description("Get schedule details").action(async (id, _opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const res = await ossFetch(`/api/schedules/${encodeURIComponent(id)}`);
       const data = await res.json();
       if (json) {
@@ -2473,7 +2508,7 @@ function registerSchedulesCreateCommand(schedulesCmd2) {
   schedulesCmd2.command("create").description("Create a new schedule").requiredOption("--name <name>", "Schedule name").requiredOption("--cron <expression>", "Cron expression (5-field format)").requiredOption("--url <url>", "URL to invoke").requiredOption("--method <method>", "HTTP method (GET, POST, PUT, PATCH, DELETE)").option("--headers <json>", "HTTP headers as JSON").option("--body <json>", "Request body as JSON").action(async (opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = {
         name: opts.name,
         cronSchedule: opts.cron,
@@ -2515,7 +2550,7 @@ function registerSchedulesUpdateCommand(schedulesCmd2) {
   schedulesCmd2.command("update <id>").description("Update a schedule").option("--name <name>", "New schedule name").option("--cron <expression>", "New cron expression").option("--url <url>", "New URL to invoke").option("--method <method>", "New HTTP method").option("--headers <json>", "New HTTP headers as JSON").option("--body <json>", "New request body as JSON").option("--active <bool>", "Enable/disable schedule (true/false)").action(async (id, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const body = {};
       if (opts.name !== void 0) body.name = opts.name;
       if (opts.cron !== void 0) body.cronSchedule = opts.cron;
@@ -2556,17 +2591,17 @@ function registerSchedulesUpdateCommand(schedulesCmd2) {
 }
 
 // src/commands/schedules/delete.ts
-import * as clack10 from "@clack/prompts";
+import * as clack12 from "@clack/prompts";
 function registerSchedulesDeleteCommand(schedulesCmd2) {
   schedulesCmd2.command("delete <id>").description("Delete a schedule").action(async (id, _opts, cmd) => {
     const { json, yes } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       if (!yes && !json) {
-        const confirm5 = await clack10.confirm({
+        const confirm6 = await clack12.confirm({
           message: `Delete schedule "${id}"? This cannot be undone.`
         });
-        if (!confirm5 || clack10.isCancel(confirm5)) {
+        if (!confirm6 || clack12.isCancel(confirm6)) {
           process.exit(0);
         }
       }
@@ -2590,7 +2625,7 @@ function registerSchedulesLogsCommand(schedulesCmd2) {
   schedulesCmd2.command("logs <id>").description("Get execution logs for a schedule").option("--limit <n>", "Max logs to return (default: 50, max: 100)", "50").option("--offset <n>", "Pagination offset", "0").action(async (id, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const limit = parseInt(opts.limit, 10) || 50;
       const offset = parseInt(opts.offset, 10) || 0;
       const res = await ossFetch(`/api/schedules/${encodeURIComponent(id)}/logs?limit=${limit}&offset=${offset}`);
@@ -2630,7 +2665,7 @@ function registerLogsCommand(program2) {
   program2.command("logs <source>").description("Fetch backend container logs (insforge.logs | postgREST.logs | postgres.logs | function.logs)").option("--limit <n>", "Number of log entries to return", "20").action(async (source, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
-      requireAuth();
+      await requireAuth();
       const resolved = SOURCE_LOOKUP.get(source.toLowerCase());
       if (!resolved) {
         console.error(`Invalid log source "${source}". Valid sources: ${VALID_SOURCES.join(", ")}`);