@omg-dev/cli 0.4.30

package/dist/omg.mjs

@@ -0,0 +1,1426 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/index.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join4, resolve as resolve3, basename, dirname as dirname3 } from "path";
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+
+// ../auth/src/oauth.ts
+var MCP_OAUTH_RESOURCE = "https://mcp.omg.dev";
+var MCP_OAUTH_AUDIENCES = [
+  MCP_OAUTH_RESOURCE,
+  `${MCP_OAUTH_RESOURCE}/`,
+  `${MCP_OAUTH_RESOURCE}/mcp`
+];
+var CLI_OAUTH_RESOURCE = "https://backend.omg.dev/api/cli";
+var CLI_OAUTH_AUDIENCES = [CLI_OAUTH_RESOURCE];
+var OAUTH_PROVIDER_AUDIENCES = [
+  ...MCP_OAUTH_AUDIENCES,
+  ...CLI_OAUTH_AUDIENCES
+];
+var CLI_API_OAUTH_AUDIENCES = [
+  ...MCP_OAUTH_AUDIENCES,
+  ...CLI_OAUTH_AUDIENCES
+];
+
+// src/config.ts
+var INFRA_URL = process.env.OMG_INFRA_URL?.trim() || "https://infra.omg.dev";
+var CONTROL_PLANE_URL = process.env.OMG_API_URL?.trim() || "https://backend.omg.dev";
+var AUTH_URL = process.env.OMG_AUTH_URL?.trim() || "https://auth.omg.dev";
+var OAUTH_RESOURCE = process.env.OMG_OAUTH_RESOURCE?.trim() || CLI_OAUTH_RESOURCE;
+var CREDENTIALS_PATH = join(homedir(), ".omg", "credentials.json");
+var LINK_DIR = ".omg";
+var LINK_FILE = join(LINK_DIR, "project.json");
+
+// src/auth.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { createInterface } from "readline/promises";
+import { dirname } from "path";
+import { stdin, stdout } from "process";
+var REFRESH_WINDOW_MS = 5 * 60 * 1000;
+var OAUTH_SCOPES = "openid email omg:apps offline_access";
+
+class AuthError extends Error {
+}
+function isNodeError(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+function loadCredentials(path = CREDENTIALS_PATH) {
+  const envKey = process.env.OMG_API_KEY?.trim();
+  if (envKey)
+    return { token: envKey, kind: "api-key" };
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    if (!raw?.token)
+      return null;
+    return raw;
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds, path = CREDENTIALS_PATH) {
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  chmodSync(directory, 448);
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporaryPath, JSON.stringify(creds, null, 2), { mode: 384 });
+    renameSync(temporaryPath, path);
+    chmodSync(path, 384);
+  } catch (error) {
+    try {
+      unlinkSync(temporaryPath);
+    } catch {}
+    throw error;
+  }
+}
+function clearCredentials(path = CREDENTIALS_PATH) {
+  try {
+    unlinkSync(path);
+    return true;
+  } catch (error) {
+    if (isNodeError(error, "ENOENT"))
+      return false;
+    throw error;
+  }
+}
+function base64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function pkceChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+async function oauthError(response, action) {
+  const text = await response.text();
+  let detail = text;
+  try {
+    const body = JSON.parse(text);
+    detail = body.error_description || body.error || text;
+  } catch {}
+  return new AuthError(`${action} failed (${response.status}): ${detail || response.statusText}`);
+}
+async function registerOAuthClient(redirectUri, options = {}) {
+  const authUrl = options.authUrl ?? AUTH_URL;
+  const fetchFn = options.fetch ?? fetch;
+  const response = await fetchFn(`${authUrl}/api/auth/oauth2/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "omg CLI",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  if (!response.ok)
+    throw await oauthError(response, "Client registration");
+  const client = await response.json();
+  if (!client.client_id)
+    throw new AuthError("Client registration returned no client_id.");
+  return { client_id: client.client_id };
+}
+async function requestToken(params, options) {
+  const authUrl = options.authUrl ?? AUTH_URL;
+  const fetchFn = options.fetch ?? fetch;
+  const response = await fetchFn(`${authUrl}/api/auth/oauth2/token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: params
+  });
+  if (!response.ok)
+    throw await oauthError(response, options.action);
+  const token = await response.json();
+  if (!token.access_token || !Number.isFinite(token.expires_in) || Number(token.expires_in) <= 0) {
+    throw new AuthError(`${options.action} returned an incomplete token response.`);
+  }
+  return {
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    expires_in: Number(token.expires_in)
+  };
+}
+function exchangeAuthorizationCode(args, options = {}) {
+  return requestToken(new URLSearchParams({
+    grant_type: "authorization_code",
+    code: args.code,
+    redirect_uri: args.redirectUri,
+    client_id: args.clientId,
+    code_verifier: args.verifier,
+    resource: args.resource ?? OAUTH_RESOURCE
+  }), { ...options, action: "Token exchange" });
+}
+function isHeadless() {
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY)
+    return true;
+  return process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+}
+function openSystemBrowser(url) {
+  if (isHeadless())
+    return false;
+  let command;
+  if (process.platform === "darwin") {
+    command = ["open", url];
+  } else if (process.platform === "win32") {
+    command = ["cmd", "/c", "start", "", url];
+  } else {
+    command = ["xdg-open", url];
+  }
+  if (process.platform !== "win32" && !Bun.which(command[0]))
+    return false;
+  try {
+    const child = Bun.spawn(command, { stdin: "ignore", stdout: "ignore", stderr: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function callbackCode(value, expectedState) {
+  const pasted = value.trim();
+  if (!pasted)
+    throw new AuthError("No authorization code was provided.");
+  if (!/^https?:\/\//i.test(pasted))
+    return pasted;
+  let url;
+  try {
+    url = new URL(pasted);
+  } catch {
+    throw new AuthError("The pasted callback URL is invalid.");
+  }
+  const error = url.searchParams.get("error");
+  if (error) {
+    throw new AuthError(`Authorization failed: ${url.searchParams.get("error_description") || error}`);
+  }
+  if (url.searchParams.get("state") !== expectedState) {
+    throw new AuthError("Authorization state did not match. Run `omg login` again.");
+  }
+  const code = url.searchParams.get("code");
+  if (!code)
+    throw new AuthError("The callback URL contained no authorization code.");
+  return code;
+}
+function callbackPage(ok, message) {
+  const title = ok ? "Signed in to omg" : "Could not sign in";
+  const safeMessage = message.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+  return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${title}</title><body style="font:16px system-ui;max-width:36rem;margin:15vh auto;padding:0 1.5rem"><h1>${title}</h1><p>${safeMessage}</p></body>`, {
+    status: ok ? 200 : 400,
+    headers: { "Content-Type": "text/html; charset=utf-8" }
+  });
+}
+function createLoopbackReceiver(expectedState) {
+  let resolveCode;
+  let rejectCode;
+  let settled = false;
+  const code = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname !== "/callback")
+        return new Response(`not found
+`, { status: 404 });
+      try {
+        const value = callbackCode(url.toString(), expectedState);
+        if (!settled) {
+          settled = true;
+          resolveCode(value);
+        }
+        return callbackPage(true, "You can close this window and return to your terminal.");
+      } catch (error) {
+        const authError = error instanceof Error ? error : new AuthError("The authorization callback failed.");
+        if (!settled) {
+          settled = true;
+          rejectCode(authError);
+        }
+        return callbackPage(false, authError.message);
+      }
+    }
+  });
+  return {
+    redirectUri: `http://127.0.0.1:${server.port}/callback`,
+    code,
+    stop: () => server.stop(true)
+  };
+}
+async function readCodeFromTerminal(authorizeUrl, signal) {
+  if (!stdin.isTTY) {
+    throw new AuthError(`No browser or interactive terminal is available. Open this URL elsewhere and rerun in an interactive shell:
+${authorizeUrl}`);
+  }
+  const reader = createInterface({ input: stdin, output: stdout });
+  try {
+    return await reader.question("Paste the callback URL or code here: ", { signal });
+  } finally {
+    reader.close();
+  }
+}
+async function loginWithBrowser(options = {}) {
+  const authUrl = options.authUrl ?? AUTH_URL;
+  const resource = options.resource ?? OAUTH_RESOURCE;
+  const fetchFn = options.fetch ?? fetch;
+  const output = options.output ?? console.log;
+  const state = base64Url(randomBytes(32));
+  const verifier = base64Url(randomBytes(64));
+  const receiver = createLoopbackReceiver(state);
+  try {
+    const client = await registerOAuthClient(receiver.redirectUri, { authUrl, fetch: fetchFn });
+    const authorizeUrl = new URL(`${authUrl}/api/auth/oauth2/authorize`);
+    authorizeUrl.search = new URLSearchParams({
+      response_type: "code",
+      client_id: client.client_id,
+      redirect_uri: receiver.redirectUri,
+      scope: OAUTH_SCOPES,
+      code_challenge: pkceChallenge(verifier),
+      code_challenge_method: "S256",
+      state,
+      resource
+    }).toString();
+    const openBrowser = options.openBrowser ?? openSystemBrowser;
+    const browserOpened = await openBrowser(authorizeUrl.toString());
+    if (browserOpened) {
+      output("Opening your browser to sign in\u2026");
+    } else {
+      output("Open this URL in a browser:");
+      output(authorizeUrl.toString());
+    }
+    let code;
+    if (browserOpened) {
+      code = await receiver.code;
+    } else {
+      const terminalRead = new AbortController;
+      const pastedCode = (async () => {
+        const pasted = options.readCode ? await options.readCode(authorizeUrl.toString()) : await readCodeFromTerminal(authorizeUrl.toString(), terminalRead.signal);
+        return callbackCode(pasted, state);
+      })();
+      try {
+        code = await Promise.race([receiver.code, pastedCode]);
+      } finally {
+        terminalRead.abort();
+        receiver.code.catch(() => {});
+      }
+    }
+    const token = await exchangeAuthorizationCode({
+      code,
+      clientId: client.client_id,
+      redirectUri: receiver.redirectUri,
+      verifier,
+      resource
+    }, { authUrl, fetch: fetchFn });
+    if (!token.refresh_token) {
+      throw new AuthError("The authorization server returned no refresh token. Run `omg login` again.");
+    }
+    const credentials = {
+      token: token.access_token,
+      refreshToken: token.refresh_token,
+      clientId: client.client_id,
+      expiresAt: Date.now() + token.expires_in * 1000,
+      authUrl,
+      resource,
+      kind: "oauth"
+    };
+    saveCredentials(credentials, options.credentialPath);
+    return credentials;
+  } finally {
+    receiver.stop();
+  }
+}
+async function refreshOAuthCredentials(credentials, options = {}) {
+  if (credentials.kind !== "oauth" || !credentials.refreshToken || !credentials.clientId) {
+    throw new AuthError("Session cannot be refreshed. Run `omg login` again.");
+  }
+  const authUrl = credentials.authUrl ?? AUTH_URL;
+  const resource = credentials.resource ?? OAUTH_RESOURCE;
+  const token = await requestToken(new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: credentials.refreshToken,
+    client_id: credentials.clientId,
+    resource
+  }), {
+    authUrl,
+    fetch: options.fetch,
+    action: "Session refresh"
+  });
+  const refreshed = {
+    ...credentials,
+    token: token.access_token,
+    refreshToken: token.refresh_token ?? credentials.refreshToken,
+    expiresAt: (options.now ?? Date.now()) + token.expires_in * 1000
+  };
+  saveCredentials(refreshed, options.credentialPath);
+  return refreshed;
+}
+async function requireToken(options = {}) {
+  const creds = loadCredentials(options.credentialPath);
+  if (!creds) {
+    throw new AuthError("Not signed in. Run `omg login`, set OMG_API_KEY, or use `omg login --token omg_sk_...`.");
+  }
+  if (creds.kind === "api-key" || !creds.expiresAt)
+    return creds.token;
+  const now = options.now ?? Date.now();
+  if (creds.kind === "oauth" && creds.expiresAt <= now + REFRESH_WINDOW_MS) {
+    const refreshed = await refreshOAuthCredentials(creds, {
+      credentialPath: options.credentialPath,
+      fetch: options.fetch,
+      now
+    });
+    return refreshed.token;
+  }
+  if (creds.expiresAt <= now) {
+    throw new AuthError("Session expired. Run `omg login` again.");
+  }
+  return creds.token;
+}
+
+// src/api.ts
+class ApiError extends Error {
+  status;
+  path;
+  body;
+  constructor(status, path, body) {
+    let detail = body;
+    try {
+      const parsed = JSON.parse(body);
+      if (parsed?.error)
+        detail = parsed.error;
+    } catch {}
+    super(`${path} \u2192 ${status}: ${detail.slice(0, 400)}`);
+    this.status = status;
+    this.path = path;
+    this.body = body;
+  }
+}
+var UA = "omg-cli/0.4.27";
+async function request(base, path, token, init = {}) {
+  const res = await fetch(base + path, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "User-Agent": UA,
+      "Content-Type": "application/json",
+      ...init.headers ?? {}
+    }
+  });
+  const text = await res.text();
+  if (!res.ok)
+    throw new ApiError(res.status, path, text);
+  if (!text)
+    return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var infra = (path, token, init) => request(INFRA_URL, path, token, init);
+var controlPlane = (path, token, init) => request(CONTROL_PLANE_URL, path, token, init);
+function whoAmI(token) {
+  return controlPlane("/api/cli/whoami", token);
+}
+async function createSandbox(token, templateId = "react-ts") {
+  const sb = await infra("/v1/sandboxes", token, {
+    method: "POST",
+    body: JSON.stringify({ size: "small", templateId, skipAppProcesses: true })
+  });
+  return { id: sb.id ?? sb.sandboxId, status: sb.status };
+}
+async function waitForRunning(token, id, timeoutMs = 120000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const s = await infra(`/v1/sandboxes/${id}`, token);
+    if (s.status === "running")
+      return;
+    if (s.status === "failed")
+      throw new Error(`sandbox ${id} failed to boot`);
+    await new Promise((r) => setTimeout(r, 2000));
+  }
+  throw new Error(`sandbox ${id} did not reach running within ${timeoutMs}ms`);
+}
+function writeFiles(token, id, files) {
+  return infra(`/v1/sandboxes/${id}/files`, token, {
+    method: "POST",
+    body: JSON.stringify(files.map((f) => ({ ...f, encoding: "base64" })))
+  });
+}
+function snapshotProject(token, id) {
+  return infra(`/v1/sandboxes/${id}/tarball`, token, { method: "POST", body: "{}" });
+}
+async function deleteSandbox(token, id) {
+  try {
+    await infra(`/v1/sandboxes/${id}`, token, { method: "DELETE" });
+  } catch {}
+}
+function deployFromSnapshot(token, body) {
+  return controlPlane("/api/cli/apps/deploy", token, {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+}
+function getStatus(token, slug) {
+  return controlPlane(`/api/cli/apps/status?slug=${encodeURIComponent(slug)}`, token);
+}
+function listApps(token) {
+  return controlPlane("/api/cli/apps/list", token);
+}
+
+// src/create.ts
+var DEFAULT_GENERATOR = "create-omg@latest";
+function createCommand(args, generator = process.env.OMG_CREATE_PACKAGE?.trim() || DEFAULT_GENERATOR) {
+  return ["bunx", "--package", generator, "create-omg", ...args];
+}
+async function runCreate(args) {
+  const child = Bun.spawn(createCommand(args), {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  return child.exited;
+}
+
+// src/files.ts
+import { readdirSync, lstatSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2, relative, sep } from "path";
+var ALWAYS_SKIP = new Set([
+  "node_modules",
+  "dist",
+  ".vibes",
+  ".git",
+  ".omg",
+  ".DS_Store",
+  ".next",
+  ".turbo",
+  "coverage"
+]);
+var GUEST_PROJECT_ROOT = "/home/user/project";
+var MAX_FILE_BYTES = 2000000;
+var MAX_TOTAL_BYTES = 40000000;
+function collectProjectFiles(root) {
+  const files = [];
+  const skippedLarge = [];
+  const skippedSecrets = [];
+  let totalBytes = 0;
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      if (ALWAYS_SKIP.has(entry))
+        continue;
+      const abs = join2(dir, entry);
+      const st = lstatSync(abs);
+      if (st.isDirectory()) {
+        walk(abs);
+        continue;
+      }
+      if (!st.isFile())
+        continue;
+      const rel = relative(root, abs);
+      if (entry === ".env" || entry.startsWith(".env.")) {
+        skippedSecrets.push(rel);
+        continue;
+      }
+      if (st.size > MAX_FILE_BYTES) {
+        skippedLarge.push(rel);
+        continue;
+      }
+      totalBytes += st.size;
+      if (totalBytes > MAX_TOTAL_BYTES) {
+        throw new Error(`Project exceeds ${(MAX_TOTAL_BYTES / 1e6).toFixed(0)} MB of source. ` + `Large assets belong in storage, not the repo.`);
+      }
+      files.push({
+        path: `${GUEST_PROJECT_ROOT}/${rel.split(sep).join("/")}`,
+        content: readFileSync2(abs).toString("base64"),
+        bytes: st.size
+      });
+    }
+  };
+  walk(root);
+  return { files, totalBytes, skippedLarge, skippedSecrets };
+}
+function assertDeployable(root) {
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(root, "package.json"), "utf8"));
+    if (!pkg.scripts?.build) {
+      throw new Error("package.json has no `build` script \u2014 the builder runs `bun run build`, so the deploy would fail.");
+    }
+  } catch (err) {
+    if (err instanceof SyntaxError)
+      throw new Error("package.json is not valid JSON");
+    if (err instanceof Error && err.message.includes("build` script"))
+      throw err;
+    throw new Error(`No package.json in ${root} \u2014 run \`omg deploy\` from your project root.`);
+  }
+}
+
+// src/deploy.ts
+var READY = new Set(["ready", "succeeded"]);
+var FAILED = new Set(["failed", "error"]);
+async function deploy(opts) {
+  const { root, token, onProgress = () => {} } = opts;
+  const ingress = opts.ingress ?? "source";
+  if (ingress === "artifact") {
+    throw new Error("The artifact ingress is not implemented yet \u2014 it needs POST /v1/artifacts on infra " + "(see apps/infra/EXTERNAL_DEPLOY.md). Use the default source ingress.");
+  }
+  assertDeployable(root);
+  const collected = collectProjectFiles(root);
+  if (collected.files.length === 0)
+    throw new Error(`No files to deploy in ${root}`);
+  for (const s of collected.skippedSecrets) {
+    onProgress(`skipping ${s} \u2014 set secrets in project settings, not the artifact`);
+  }
+  for (const s of collected.skippedLarge)
+    onProgress(`skipping ${s} \u2014 over the per-file limit`);
+  onProgress(`uploading ${collected.files.length} files (${(collected.totalBytes / 1024).toFixed(0)} KB)`);
+  const sandbox = await createSandbox(token);
+  onProgress(`staging sandbox ${sandbox.id}`);
+  let snapshotId;
+  try {
+    await waitForRunning(token, sandbox.id);
+    await writeFiles(token, sandbox.id, collected.files);
+    const snap = await snapshotProject(token, sandbox.id);
+    if (!snap?.id)
+      throw new Error("snapshot did not return an id");
+    snapshotId = snap.id;
+    onProgress(`snapshot ${snap.id}` + (snap.tarballSizeBytes ? ` (${(snap.tarballSizeBytes / 1e6).toFixed(2)} MB)` : ""));
+  } finally {
+    await deleteSandbox(token, sandbox.id);
+  }
+  onProgress("publishing");
+  const result = await deployFromSnapshot(token, {
+    name: opts.name,
+    snapshotId,
+    projectId: opts.projectId
+  });
+  return result;
+}
+async function waitForDeploy(token, slug, onProgress = () => {}, timeoutMs = 8 * 60000) {
+  const deadline = Date.now() + timeoutMs;
+  let last = "";
+  while (Date.now() < deadline) {
+    let st;
+    try {
+      st = await getStatus(token, slug);
+    } catch {
+      await new Promise((r) => setTimeout(r, 4000));
+      continue;
+    }
+    const status = String(st?.status ?? st?.deployStatus ?? "building");
+    if (status !== last) {
+      onProgress(status + (st?.phase ? ` (${st.phase})` : ""));
+      last = status;
+    }
+    if (READY.has(status))
+      return status;
+    if (FAILED.has(status)) {
+      throw new Error(`build failed: ${st?.buildError || st?.error || "no detail returned"}`);
+    }
+    await new Promise((r) => setTimeout(r, 4000));
+  }
+  throw new Error(`still building after ${Math.round(timeoutMs / 60000)}m \u2014 check \`omg status\` or the dashboard`);
+}
+
+// src/dev.ts
+import { resolve as resolve2 } from "path";
+
+// src/dev-backend.ts
+import {
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  readdirSync as readdirSync2,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { dirname as dirname2, join as join3, relative as relative2, resolve, sep as sep2 } from "path";
+var jsonHeaders = { "content-type": "application/json" };
+function json(body, status = 200, headers) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { ...jsonHeaders, ...headers }
+  });
+}
+function error(message, status = 400) {
+  return json({ error: message }, status);
+}
+async function body(req) {
+  try {
+    return await req.json();
+  } catch {
+    throw new Error("invalid JSON body");
+  }
+}
+function stableId(prefix, value) {
+  const hash = createHash2("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 20);
+  return `${prefix}_${hash}`;
+}
+function safeSegment(value, label) {
+  const segment = String(value ?? "");
+  if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\")) {
+    throw new Error(`${label} is invalid`);
+  }
+  return segment;
+}
+function safeKey(value) {
+  const key = String(value ?? "").replace(/^\/+/, "");
+  if (!/^[a-zA-Z0-9._\-/]{1,256}$/.test(key))
+    throw new Error("invalid key");
+  const parts = key.split("/");
+  if (parts.some((part) => !part || part === "." || part === ".."))
+    throw new Error("invalid key");
+  return key;
+}
+
+class LocalCache {
+  root;
+  constructor(projectRoot) {
+    this.root = join3(projectRoot, ".omg", "cache");
+    mkdirSync2(this.root, { recursive: true });
+  }
+  read(name, fallback) {
+    const path = join3(this.root, name);
+    if (!existsSync(path))
+      return fallback;
+    return JSON.parse(readFileSync3(path, "utf8"));
+  }
+  write(name, value) {
+    const path = join3(this.root, name);
+    mkdirSync2(dirname2(path), { recursive: true });
+    writeFileSync2(path, JSON.stringify(value, null, 2) + `
+`);
+  }
+}
+
+class LocalDevBackend {
+  name = "local";
+  cache;
+  projectRoot;
+  constructor(projectRoot) {
+    this.projectRoot = resolve(projectRoot);
+    this.cache = new LocalCache(this.projectRoot);
+  }
+  async handle(req, url, origin) {
+    const path = url.pathname;
+    if (req.method === "GET" && path === "/health") {
+      return json({ ok: true, backend: this.name });
+    }
+    if (req.method === "POST" && path === "/_emit")
+      return this.emit(req);
+    if (req.method === "POST" && path === "/_schedule")
+      return this.schedule(req);
+    if (req.method === "DELETE" && path.startsWith("/_schedule/")) {
+      return this.cancelSchedule(decodeURIComponent(path.slice("/_schedule/".length)));
+    }
+    if (req.method === "POST" && path === "/_workflow/start")
+      return this.startWorkflow(req);
+    if (req.method === "POST" && path === "/_storage/presign") {
+      return this.presignStorage(req, origin);
+    }
+    if (req.method === "POST" && path === "/_storage/list")
+      return this.listStorage(req);
+    if (req.method === "POST" && path === "/_storage/delete")
+      return this.deleteStorage(req);
+    if ((req.method === "PUT" || req.method === "GET") && path === "/_storage/object") {
+      return this.storageObject(req, url);
+    }
+    if (path.startsWith("/_billing/"))
+      return this.billing(req, url);
+    if (req.method === "GET" && path.startsWith("/_checkout/")) {
+      return new Response("<!doctype html><title>omg dev checkout</title><h1>Checkout simulated locally</h1><p>No payment was made.</p>", { headers: { "content-type": "text/html; charset=utf-8" } });
+    }
+    if (req.method === "POST" && (path === "/_sandbox/create" || path === "/_sandbox/fork")) {
+      return this.sandbox(req, path.endsWith("/fork"));
+    }
+    if (req.method === "POST" && path === "/media/submit")
+      return this.submitMedia(req);
+    if (req.method === "GET" && path.startsWith("/media/jobs/")) {
+      return this.getMediaJob(decodeURIComponent(path.slice("/media/jobs/".length)), origin);
+    }
+    if (req.method === "GET" && path.startsWith("/media/artifacts/")) {
+      return this.getMediaArtifact(path.slice("/media/artifacts/".length));
+    }
+    if (path === "/auth/token" && req.method === "POST") {
+      return json({ error: "No local omg session. Authenticated cloud bridging is not available in the local backend." }, 401, { "X-Vibes-Auth-Proxy": "1" });
+    }
+    if (path === "/auth/get-session" && req.method === "GET") {
+      return json(null, 200, { "X-Vibes-Auth-Proxy": "1" });
+    }
+    return;
+  }
+  subscriberCount(topic) {
+    try {
+      const raw = JSON.parse(readFileSync3(join3(this.projectRoot, ".vibes", "triggers.json"), "utf8"));
+      const triggers = Array.isArray(raw) ? raw : raw.triggers ?? [];
+      return triggers.filter((trigger) => trigger.kind === "event" && trigger.key === topic).length;
+    } catch {
+      return 0;
+    }
+  }
+  async emit(req) {
+    try {
+      const input = await body(req);
+      const topic = String(input.topic ?? "");
+      if (!topic || topic.length > 200)
+        return error("topic required (1-200 chars)");
+      const eventId = `evt_local_${randomUUID2()}`;
+      const events = this.cache.read("events.json", []);
+      events.push({ eventId, topic, payload: input.payload ?? null, status: "emitted" });
+      this.cache.write("events.json", events);
+      return json({ eventId, subscriberCount: this.subscriberCount(topic) });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async schedule(req) {
+    try {
+      const input = await body(req);
+      const topic = String(input.topic ?? "");
+      const runAt = Number(input.runAt);
+      if (!topic || topic.length > 200)
+        return error("topic required (1-200 chars)");
+      if (!Number.isFinite(runAt) || runAt <= 0)
+        return error("runAt required (unix ms)");
+      const eventId = `evt_local_${randomUUID2()}`;
+      const events = this.cache.read("events.json", []);
+      events.push({ eventId, topic, payload: input.payload ?? null, runAt, status: "scheduled" });
+      this.cache.write("events.json", events);
+      return json({ eventId, subscriberCount: this.subscriberCount(topic), runAt });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  cancelSchedule(eventId) {
+    const events = this.cache.read("events.json", []);
+    const event = events.find((item) => item.eventId === eventId && item.status === "scheduled");
+    if (!event)
+      return json({ cancelled: 0 });
+    event.status = "cancelled";
+    this.cache.write("events.json", events);
+    return json({ cancelled: 1 });
+  }
+  async startWorkflow(req) {
+    try {
+      const input = await body(req);
+      const workflow = String(input.workflow ?? "");
+      if (!workflow || workflow.length > 200)
+        return error("workflow required (1-200 chars)");
+      const key = input.idempotencyKey ? String(input.idempotencyKey) : randomUUID2();
+      const runId = stableId("wfr_local", { workflow, key });
+      const workflows = this.cache.read("workflows.json", {});
+      workflows[runId] = {
+        runId,
+        workflow,
+        payload: input.payload ?? null,
+        idempotencyKey: input.idempotencyKey,
+        status: "accepted"
+      };
+      this.cache.write("workflows.json", workflows);
+      return json({ runId });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  storageParts(input) {
+    const scope = input.scope === "app" ? "app" : "user";
+    const userId = scope === "user" ? safeSegment(input.userId, "userId") : "shared";
+    const key = safeKey(input.key);
+    return { scope, userId, key };
+  }
+  storagePath(scope, userId, key) {
+    const base = resolve(this.cache.root, "storage", scope, userId);
+    const target = resolve(base, key);
+    if (target !== base && !target.startsWith(base + sep2))
+      throw new Error("invalid key");
+    return target;
+  }
+  async presignStorage(req, origin) {
+    try {
+      const input = await body(req);
+      const action = String(input.action ?? "");
+      if (action !== "put" && action !== "get")
+        return error('action must be "put" or "get"');
+      const { scope, userId, key } = this.storageParts(input);
+      const params = new URLSearchParams({ scope, userId, key });
+      if (input.contentType)
+        params.set("contentType", String(input.contentType));
+      return json({
+        url: `${origin}/_storage/object?${params}`,
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+        key: `local/${scope}/${userId}/${key}`,
+        method: action === "put" ? "PUT" : "GET",
+        maxBytes: 25 * 1024 * 1024
+      });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async storageObject(req, url) {
+    try {
+      const scope = safeSegment(url.searchParams.get("scope"), "scope");
+      const userId = safeSegment(url.searchParams.get("userId"), "userId");
+      const key = safeKey(url.searchParams.get("key"));
+      const path = this.storagePath(scope, userId, key);
+      if (req.method === "PUT") {
+        const bytes = Buffer.from(await req.arrayBuffer());
+        if (bytes.byteLength > 25 * 1024 * 1024)
+          return error("object exceeds 25 MB", 413);
+        mkdirSync2(dirname2(path), { recursive: true });
+        writeFileSync2(path, bytes);
+        const metadata2 = this.cache.read("storage-content-types.json", {});
+        metadata2[`${scope}/${userId}/${key}`] = url.searchParams.get("contentType") || req.headers.get("content-type") || "application/octet-stream";
+        this.cache.write("storage-content-types.json", metadata2);
+        return new Response(null, { status: 204 });
+      }
+      if (!existsSync(path))
+        return error("object not found", 404);
+      const metadata = this.cache.read("storage-content-types.json", {});
+      return new Response(readFileSync3(path), {
+        headers: {
+          "content-type": metadata[`${scope}/${userId}/${key}`] || "application/octet-stream"
+        }
+      });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async listStorage(req) {
+    try {
+      const input = await body(req);
+      const scope = input.scope === "app" ? "app" : "user";
+      const userId = scope === "user" ? safeSegment(input.userId, "userId") : "shared";
+      const prefix = input.prefix ? safeKey(input.prefix) : "";
+      const limit = Math.min(1000, Math.max(1, Number(input.limit) || 200));
+      const root = resolve(this.cache.root, "storage", scope, userId);
+      if (!existsSync(root))
+        return json([]);
+      const metadata = this.cache.read("storage-content-types.json", {});
+      const files = [];
+      const walk = (dir) => {
+        for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+          const path = join3(dir, entry.name);
+          if (entry.isDirectory())
+            walk(path);
+          else if (entry.isFile()) {
+            const relPath = relative2(root, path).split(sep2).join("/");
+            if (prefix && !relPath.startsWith(prefix))
+              continue;
+            const stat = statSync(path);
+            files.push({
+              key: `local/${scope}/${userId}/${relPath}`,
+              relPath,
+              size: stat.size,
+              lastModified: stat.mtime.toISOString(),
+              contentType: metadata[`${scope}/${userId}/${relPath}`]
+            });
+          }
+          if (files.length >= limit)
+            return;
+        }
+      };
+      walk(root);
+      return json(files.slice(0, limit));
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async deleteStorage(req) {
+    try {
+      const input = await body(req);
+      const { scope, userId, key } = this.storageParts(input);
+      rmSync(this.storagePath(scope, userId, key), { force: true });
+      return new Response(null, { status: 204 });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  billingState() {
+    return this.cache.read("billing.json", {
+      customers: {},
+      idempotency: {},
+      grants: {}
+    });
+  }
+  ensureCustomer(state, externalRef, plan) {
+    const existing = state.customers[externalRef];
+    if (existing)
+      return { customer: existing, created: false };
+    const customer = {
+      customerId: stableId("cus_local", externalRef),
+      plan: plan || "free",
+      balances: {}
+    };
+    state.customers[externalRef] = customer;
+    return { customer, created: true };
+  }
+  async billing(req, url) {
+    const route = url.pathname.slice("/_billing/".length);
+    const state = this.billingState();
+    try {
+      if (req.method === "POST" && route === "customers") {
+        const input = await body(req);
+        const externalRef = String(input.externalRef ?? "");
+        if (!externalRef)
+          return error("externalRef required");
+        const { customer, created } = this.ensureCustomer(state, externalRef, input.plan ? String(input.plan) : undefined);
+        this.cache.write("billing.json", state);
+        return json({ customerId: customer.customerId, plan: customer.plan, created });
+      }
+      if (req.method === "POST" && route === "check") {
+        const input = await body(req);
+        const externalRef = String(input.externalRef ?? "");
+        const feature = String(input.feature ?? "");
+        if (!externalRef || !feature)
+          return error("feature and externalRef required");
+        const { customer } = this.ensureCustomer(state, externalRef);
+        this.cache.write("billing.json", state);
+        const balanceMicros = customer.balances[feature] ?? 0;
+        return json({
+          allow: balanceMicros > 0,
+          balanceMicros,
+          plan: customer.plan,
+          reason: balanceMicros > 0 ? "" : "insufficient_credit"
+        });
+      }
+      if (req.method === "POST" && (route === "track" || route === "grant")) {
+        const input = await body(req);
+        const externalRef = String(input.externalRef ?? "");
+        const feature = String(input.feature ?? "");
+        const idempotencyKey = String(input.idempotencyKey ?? "");
+        const amountMicros = Number(input.amountMicros);
+        if (!externalRef || !feature)
+          return error("externalRef and feature required");
+        if (!idempotencyKey)
+          return error("idempotencyKey required");
+        if (!Number.isSafeInteger(amountMicros) || (route === "grant" ? amountMicros <= 0 : amountMicros < 0)) {
+          return error(route === "grant" ? "amountMicros must be > 0" : "amountMicros must be >= 0");
+        }
+        const { customer } = this.ensureCustomer(state, externalRef);
+        const opKey = `${route}:${idempotencyKey}`;
+        const grantKey = input.grantKey ? `${externalRef}:${String(input.grantKey)}` : "";
+        const alreadyApplied = state.idempotency[opKey] || grantKey && state.grants[grantKey];
+        if (!alreadyApplied) {
+          const current = customer.balances[feature] ?? 0;
+          customer.balances[feature] = route === "grant" ? current + amountMicros : current - amountMicros;
+          state.idempotency[opKey] = true;
+          if (grantKey)
+            state.grants[grantKey] = true;
+          this.cache.write("billing.json", state);
+        }
+        return json({ balanceMicros: customer.balances[feature] ?? 0 });
+      }
+      if (req.method === "GET" && route === "balance") {
+        const externalRef = url.searchParams.get("externalRef") ?? "";
+        const feature = url.searchParams.get("feature") ?? "";
+        if (!externalRef || !feature)
+          return error("externalRef and feature query params required");
+        const customer = state.customers[externalRef];
+        return json({
+          exists: Boolean(customer),
+          plan: customer?.plan ?? "free",
+          balanceMicros: customer?.balances[feature] ?? 0
+        });
+      }
+      if (req.method === "GET" && route === "subscription") {
+        const externalRef = url.searchParams.get("externalRef") ?? "";
+        if (!externalRef)
+          return error("externalRef query param required");
+        return json({ plan: state.customers[externalRef]?.plan ?? "free", subscription: null });
+      }
+      if (req.method === "POST" && route === "checkout") {
+        const input = await body(req);
+        const externalRef = String(input.externalRef ?? "");
+        const plan = String(input.plan ?? "");
+        if (!externalRef || !plan)
+          return error("plan and externalRef required");
+        const { customer } = this.ensureCustomer(state, externalRef, plan);
+        customer.plan = plan;
+        this.cache.write("billing.json", state);
+        const checkoutId = stableId("checkout_local", { externalRef, plan });
+        return json({ checkoutId, checkoutUrl: `${url.origin}/_checkout/${checkoutId}` });
+      }
+      return error(`unknown billing route: ${req.method} ${url.pathname}`, 404);
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async sandbox(req, fork) {
+    try {
+      const input = await body(req);
+      if (fork && !input.snapshotId)
+        return error("snapshotId required");
+      const id = `sbx_local_${randomUUID2()}`;
+      const sandboxes = this.cache.read("sandboxes.json", {});
+      const result = {
+        id,
+        status: "running",
+        local: true,
+        ports: input.ports ?? [],
+        ...fork ? { snapshotId: input.snapshotId } : {}
+      };
+      sandboxes[id] = result;
+      this.cache.write("sandboxes.json", sandboxes);
+      return json(result);
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async submitMedia(req) {
+    try {
+      const input = await body(req);
+      const model = String(input.model ?? "");
+      if (!model)
+        return error("model required");
+      const jobId = stableId("media_local", { model, input: input.input ?? {} });
+      const jobs = this.cache.read("media-jobs.json", {});
+      if (!jobs[jobId]) {
+        if (model.includes("scribe")) {
+          const source = String(input.input?.audio_url ?? "local audio");
+          jobs[jobId] = {
+            jobId,
+            status: "succeeded",
+            model,
+            results: [{ text: `[omg dev transcript placeholder for ${source}]` }]
+          };
+        } else {
+          const artifact = `${jobId}.svg`;
+          const prompt = String(input.input?.prompt ?? model);
+          const svg = this.placeholderSvg(model, prompt);
+          const artifactDir = join3(this.cache.root, "media");
+          mkdirSync2(artifactDir, { recursive: true });
+          writeFileSync2(join3(artifactDir, artifact), svg);
+          jobs[jobId] = {
+            jobId,
+            status: "succeeded",
+            model,
+            results: [{
+              artifact,
+              contentType: "image/svg+xml"
+            }]
+          };
+        }
+        this.cache.write("media-jobs.json", jobs);
+      }
+      return json({ jobId, status: "queued" }, 202);
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  getMediaJob(jobId, origin) {
+    const job = this.cache.read("media-jobs.json", {})[jobId];
+    if (!job)
+      return error("job not found", 404);
+    return json({
+      ...job,
+      results: job.results.map((result) => ({
+        ...result.artifact ? { url: `${origin}/media/artifacts/${result.artifact}` } : {},
+        ...result.contentType ? { contentType: result.contentType } : {},
+        ...result.text !== undefined ? { text: result.text } : {}
+      }))
+    });
+  }
+  getMediaArtifact(name) {
+    const safeName = safeSegment(name, "artifact");
+    const path = join3(this.cache.root, "media", safeName);
+    if (!existsSync(path))
+      return error("artifact not found", 404);
+    return new Response(readFileSync3(path), { headers: { "content-type": "image/svg+xml" } });
+  }
+  placeholderSvg(model, prompt) {
+    const escape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+    const shortPrompt = prompt.replace(/\s+/g, " ").slice(0, 72);
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
+<defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#635bff"/><stop offset="1" stop-color="#12b981"/></linearGradient></defs>
+<rect width="1024" height="1024" fill="url(#g)"/><circle cx="512" cy="420" r="190" fill="none" stroke="white" stroke-width="28" opacity=".9"/>
+<text x="512" y="430" fill="white" font-family="system-ui,sans-serif" font-size="72" font-weight="700" text-anchor="middle">omg dev</text>
+<text x="512" y="690" fill="white" font-family="system-ui,sans-serif" font-size="30" text-anchor="middle">${escape(model.slice(0, 54))}</text>
+<text x="512" y="750" fill="white" font-family="system-ui,sans-serif" font-size="25" text-anchor="middle">${escape(shortPrompt)}</text>
+</svg>`;
+  }
+}
+
+class CloudDevBackend {
+  name = "cloud";
+  async handle(_req, url) {
+    return error(`Cloud proxy is not implemented for ${url.pathname}. The public omg service routes require a service token; use the default local backend until the control-plane broker lands.`, 501);
+  }
+}
+
+// src/dev.ts
+function startDevEmulator(options) {
+  const root = resolve2(options.root);
+  const mode = options.mode ?? "local";
+  const backend = mode === "cloud" ? new CloudDevBackend : new LocalDevBackend(root);
+  let origin = "";
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: options.port ?? 0,
+    async fetch(req) {
+      if (req.method === "OPTIONS") {
+        return new Response(null, {
+          status: 204,
+          headers: {
+            "access-control-allow-origin": "*",
+            "access-control-allow-methods": "GET,POST,PUT,DELETE,OPTIONS",
+            "access-control-allow-headers": "*"
+          }
+        });
+      }
+      const response = await backend.handle(req, new URL(req.url), origin);
+      const result = response ?? new Response(JSON.stringify({ error: `Not found: ${req.method} ${new URL(req.url).pathname}` }), { status: 404, headers: { "content-type": "application/json" } });
+      result.headers.set("access-control-allow-origin", "*");
+      return result;
+    }
+  });
+  const port = server.port;
+  if (port === undefined) {
+    server.stop(true);
+    throw new Error("omg dev emulator did not bind a TCP port");
+  }
+  origin = `http://127.0.0.1:${port}`;
+  return {
+    backend: mode,
+    port,
+    url: origin,
+    env: {
+      VIBES_MODE: "dev",
+      OMG_AGENT_URL: origin,
+      VIBES_AGENT_URL: `${origin}/_sandbox`,
+      VIBES_SANDBOX_ROUTER_URL: `${origin}/_sandbox`,
+      OMG_AI_URL: origin,
+      OMG_MEDIA_URL: `${origin}/media`
+    },
+    stop() {
+      server.stop(true);
+    }
+  };
+}
+async function runDev(options) {
+  const root = resolve2(options.root);
+  const emulator = startDevEmulator({ root, mode: options.mode, port: options.port });
+  const log = options.onLog ?? console.log;
+  log(`omg dev \xB7 ${emulator.backend} backend`);
+  log(`agent  ${emulator.url}`);
+  log(`cache  ${root}/.omg/cache`);
+  if (emulator.backend === "cloud") {
+    log("cloud routes are intentionally disabled: the required control-plane service-token broker has not landed");
+  }
+  log("");
+  log("starting `bun run dev`");
+  const child = Bun.spawn(["bun", "run", "dev"], {
+    cwd: root,
+    env: { ...process.env, ...emulator.env },
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  let stopping = false;
+  const stop = () => {
+    if (stopping)
+      return;
+    stopping = true;
+    child.kill();
+    emulator.stop();
+  };
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+  try {
+    return await child.exited;
+  } finally {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+    stop();
+  }
+}
+
+// src/index.ts
+var argv = process.argv.slice(2);
+var cmd = argv[0] ?? "help";
+function flag(name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : undefined;
+}
+var has = (name) => argv.includes(`--${name}`);
+var out = (msg = "") => process.stdout.write(msg + `
+`);
+var step = (msg) => out(`  ${msg}`);
+function readLink(root) {
+  try {
+    return JSON.parse(readFileSync4(join4(root, LINK_FILE), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeLink(root, link) {
+  const path = join4(root, LINK_FILE);
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync3(path, JSON.stringify(link, null, 2) + `
+`);
+}
+var HELP = `omg \u2014 deploy a local project to omg.dev
+
+  omg create <name> [--no-install]
+  omg deploy [--name <name>] [--dir <path>] [--no-wait]
+  omg status [--dir <path>]
+  omg link <slug> [--dir <path>]
+  omg login [--token <omg_sk_...>]
+  omg logout
+  omg whoami
+  omg apps
+  omg dev [--dir <path>] [--agent-port <port>] [--cloud]
+
+Credentials: OMG_API_KEY, or ~/.omg/credentials.json via \`omg login\`.
+`;
+async function main() {
+  const root = resolve3(flag("dir") ?? process.cwd());
+  switch (cmd) {
+    case "create": {
+      const createArgs = argv.slice(1);
+      if (!createArgs.some((arg) => !arg.startsWith("-"))) {
+        out("Usage: omg create <name> [--no-install]");
+        return 1;
+      }
+      return runCreate(createArgs);
+    }
+    case "login": {
+      const token = flag("token");
+      if (!token) {
+        await loginWithBrowser({ output: out });
+        out("Signed in. Credentials saved to ~/.omg/credentials.json");
+        return 0;
+      }
+      if (!token.startsWith("omg_sk_")) {
+        out("That does not look like an omg key (expected omg_sk_...).");
+        return 1;
+      }
+      saveCredentials({ token, kind: "api-key" });
+      out("Saved to ~/.omg/credentials.json");
+      return 0;
+    }
+    case "logout": {
+      clearCredentials();
+      out(process.env.OMG_API_KEY?.trim() ? "Cleared saved credentials. OMG_API_KEY is still set." : "Signed out.");
+      return 0;
+    }
+    case "whoami": {
+      const token = await requireToken();
+      const identity = await whoAmI(token);
+      out(identity.name ? `${identity.name} <${identity.email}>` : identity.email);
+      out(`User ID: ${identity.userId}`);
+      return 0;
+    }
+    case "apps": {
+      const token = await requireToken();
+      const { apps } = await listApps(token);
+      if (!apps?.length) {
+        out("No apps yet.");
+        return 0;
+      }
+      for (const a of apps)
+        out(`  ${a.slug.padEnd(32)} ${a.name ?? ""}`);
+      return 0;
+    }
+    case "link": {
+      const slug = argv[1];
+      if (!slug) {
+        out("Usage: omg link <slug>");
+        return 1;
+      }
+      const token = await requireToken();
+      const { apps } = await listApps(token);
+      const app = apps?.find((a) => a.slug === slug);
+      if (!app) {
+        out(`No app "${slug}" on your account. Run \`omg apps\` to see them.`);
+        return 1;
+      }
+      const existing = readLink(root);
+      writeLink(root, { slug, projectId: existing?.projectId ?? "", name: app.name });
+      out(`Linked ${root} \u2192 ${slug}`);
+      if (!existing?.projectId) {
+        out("Run `omg deploy` to complete the binding.");
+      }
+      return 0;
+    }
+    case "status": {
+      const token = await requireToken();
+      const link = readLink(root);
+      if (!link?.slug) {
+        out("Not linked. Run `omg deploy` or `omg link <slug>`.");
+        return 1;
+      }
+      const status = await waitForDeploy(token, link.slug, (s) => step(s), 1).catch((e) => e.message);
+      out(`${link.slug}: ${status}`);
+      return 0;
+    }
+    case "deploy": {
+      const token = await requireToken();
+      const link = readLink(root);
+      const name = flag("name") ?? link?.name ?? basename(root);
+      out(`Deploying ${root}`);
+      if (link?.projectId)
+        step(`linked \u2192 ${link.slug}`);
+      const result = await deploy({
+        root,
+        token,
+        name,
+        projectId: link?.projectId,
+        onProgress: step
+      });
+      writeLink(root, { slug: result.slug, projectId: result.projectId, name });
+      step(`\u2192 ${result.slug} (${result.status})`);
+      if (has("no-wait")) {
+        out("");
+        out(`Building. Check with \`omg status\`.`);
+        out(`  https://${result.slug}.omgs.app`);
+        return 0;
+      }
+      await waitForDeploy(token, result.slug, step);
+      out("");
+      out(`  https://${result.slug}.omgs.app`);
+      return 0;
+    }
+    case "dev": {
+      const portFlag = flag("agent-port");
+      const port = portFlag === undefined ? 0 : Number(portFlag);
+      if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        out("--agent-port must be an integer from 0 to 65535");
+        return 1;
+      }
+      return runDev({
+        root,
+        mode: has("cloud") ? "cloud" : "local",
+        port,
+        onLog: out
+      });
+    }
+    default:
+      out(HELP);
+      return cmd === "help" || has("help") ? 0 : 1;
+  }
+}
+main().then((code) => process.exit(code)).catch((err) => {
+  const msg = err instanceof Error ? err.message : String(err);
+  process.stderr.write(`
+error: ${msg}
+`);
+  if (err instanceof AuthError) {
+    process.stderr.write("Run `omg login` to sign in again.\n");
+  }
+  process.exit(1);
+});