@rodyssey/cli 0.1.4 → 0.1.5

package/dist/cli.js

@@ -2069,19 +2069,244 @@ var {
   Help
 } = import__.default;
 
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+var CMS_BASE_URLS = {
+  local: "http://localhost:5176",
+  development: "https://development-cms.rodyssey.ai",
+  staging: "https://staging-cms.rodyssey.ai",
+  production: "https://cms.rodyssey.ai"
+};
+var CONFIG_FILE = join(homedir(), ".rodyssey", "config.json");
+function readConfig() {
+  if (!existsSync(CONFIG_FILE))
+    return {};
+  try {
+    return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeConfig(config) {
+  mkdirSync(dirname(CONFIG_FILE), { recursive: true });
+  writeFileSync(CONFIG_FILE, `${JSON.stringify(config, null, 2)}
+`, "utf-8");
+}
+function getAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth !== "object" || Array.isArray(auth))
+    return {};
+  return auth;
+}
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function extractToken(payload) {
+  if (!isObject(payload))
+    return;
+  const candidates = [
+    payload.accessToken,
+    payload.token,
+    payload.jwt,
+    payload.idToken,
+    isObject(payload.session) ? payload.session.token : undefined,
+    isObject(payload.session) ? payload.session.accessToken : undefined,
+    isObject(payload.data) ? payload.data.accessToken : undefined,
+    isObject(payload.data) ? payload.data.token : undefined
+  ];
+  return candidates.find((candidate) => typeof candidate === "string" && candidate.length > 0);
+}
+function extractUser(payload) {
+  if (!isObject(payload))
+    return;
+  return payload.user ?? (isObject(payload.data) ? payload.data.user : undefined);
+}
+async function readResponsePayload(response) {
+  const text = await response.text();
+  if (!text)
+    return;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text };
+  }
+}
+function base64Url(buffer) {
+  return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function buildPkcePair() {
+  const verifier = base64Url(randomBytes(32));
+  const challenge = base64Url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.unref();
+}
+function resolveCmsUrl(env, cmsUrl) {
+  const resolved = cmsUrl || process.env.CMS_URL || CMS_BASE_URLS[env];
+  if (!resolved) {
+    throw new Error(`Unknown CMS environment "${env}". Available: ${Object.keys(CMS_BASE_URLS).join(", ")}`);
+  }
+  return resolved.replace(/\/$/, "");
+}
+function getStoredSession(env) {
+  return getAuthConfig(readConfig())[env];
+}
+function storeSession(session) {
+  const config = readConfig();
+  const auth = getAuthConfig(config);
+  auth[session.env] = session;
+  config.auth = auth;
+  writeConfig(config);
+}
+function resolveSessionToken(env) {
+  const token = process.env.CMS_TOKEN || getStoredSession(env)?.token;
+  if (!token) {
+    throw new Error(`No CMS auth token found for [${env}]. Run \`ro app auth login --env ${env}\` first.`);
+  }
+  return token;
+}
+async function login(options) {
+  const cmsUrl = resolveCmsUrl(options.env, options.cmsUrl);
+  const state = base64Url(randomBytes(24));
+  const pkce = buildPkcePair();
+  const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
+  const callback = await new Promise((resolve, reject) => {
+    const server = createServer((request, response2) => {
+      const requestUrl = new URL(request.url || "/", "http://127.0.0.1");
+      if (requestUrl.pathname !== "/auth/callback") {
+        response2.writeHead(404).end("Not found");
+        return;
+      }
+      const code = requestUrl.searchParams.get("code");
+      const returnedState = requestUrl.searchParams.get("state");
+      const error = requestUrl.searchParams.get("error");
+      if (error) {
+        clearTimeout(timer);
+        response2.writeHead(400, { "Content-Type": "text/plain" }).end(`Login failed: ${error}`);
+        server.close();
+        reject(new Error(`CMS login failed: ${error}`));
+        return;
+      }
+      if (!code || returnedState !== state) {
+        clearTimeout(timer);
+        response2.writeHead(400, { "Content-Type": "text/plain" }).end("Invalid CLI login callback.");
+        server.close();
+        reject(new Error("Invalid CMS login callback. Missing code or state mismatch."));
+        return;
+      }
+      response2.writeHead(200, { "Content-Type": "text/html" }).end('<!doctype html><meta charset="utf-8"><title>Rodyssey CLI</title><body><h1>Login complete</h1><p>You can close this window and return to the terminal.</p></body>');
+      const address = server.address();
+      clearTimeout(timer);
+      server.close();
+      resolve({ code, redirectUri: `http://127.0.0.1:${address.port}/auth/callback` });
+    });
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("CMS login timed out before the callback was received."));
+    }, timeoutMs);
+    server.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    server.listen(options.callbackPort ?? 0, "127.0.0.1", () => {
+      const address = server.address();
+      const redirectUri = `http://127.0.0.1:${address.port}/auth/callback`;
+      const authorizationUrl = new URL(options.loginUrl || `${cmsUrl}/auth/cli-login`);
+      authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+      authorizationUrl.searchParams.set("state", state);
+      authorizationUrl.searchParams.set("code_challenge", pkce.challenge);
+      authorizationUrl.searchParams.set("code_challenge_method", "S256");
+      console.log(`Open this URL to log in:
+${authorizationUrl.toString()}
+`);
+      if (options.open !== false) {
+        openBrowser(authorizationUrl.toString());
+      }
+    });
+  });
+  const tokenUrl = options.tokenUrl || `${cmsUrl}/api/auth/cli-token`;
+  const response = await fetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      code: callback.code,
+      redirect_uri: callback.redirectUri,
+      code_verifier: pkce.verifier
+    })
+  });
+  const payload = await readResponsePayload(response);
+  if (!response.ok) {
+    throw new Error(`CMS token exchange failed: ${response.status} ${response.statusText}
+${JSON.stringify(payload, null, 2)}`);
+  }
+  const token = extractToken(payload);
+  if (!token) {
+    throw new Error(`CMS token response did not include an auth token:
+${JSON.stringify(payload, null, 2)}`);
+  }
+  const session = {
+    env: options.env,
+    cmsUrl,
+    token,
+    user: extractUser(payload)
+  };
+  storeSession(session);
+  return session;
+}
+async function me(options) {
+  const storedSession = getStoredSession(options.env);
+  if (!options.remote) {
+    if (!storedSession) {
+      throw new Error(`No local CMS session found for [${options.env}]. Run \`ro app auth login --env ${options.env}\` first.`);
+    }
+    return {
+      env: storedSession.env,
+      cmsUrl: storedSession.cmsUrl,
+      loggedIn: true,
+      user: storedSession.user ?? null
+    };
+  }
+  const cmsUrl = resolveCmsUrl(options.env, options.cmsUrl || storedSession?.cmsUrl);
+  const response = await fetch(options.meUrl || `${cmsUrl}/api/auth/me`, {
+    method: "GET",
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${resolveSessionToken(options.env)}`
+    }
+  });
+  const payload = await readResponsePayload(response);
+  if (!response.ok) {
+    throw new Error(`CMS me failed: ${response.status} ${response.statusText}
+${JSON.stringify(payload, null, 2)}`);
+  }
+  return payload;
+}
+
 // src/create.ts
 import { execSync } from "node:child_process";
-import { existsSync as existsSync2, rmSync } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import path2 from "node:path";
 
 // src/utils.ts
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "node:fs";
 import path from "node:path";
 function replaceInFile(filePath, search, replace) {
-  const content = readFileSync(filePath, "utf-8");
+  const content = readFileSync2(filePath, "utf-8");
   const updated = content.replaceAll(search, replace);
   if (content !== updated) {
-    writeFileSync(filePath, updated, "utf-8");
+    writeFileSync2(filePath, updated, "utf-8");
   }
 }
 function replaceInFiles(dir, filenames, search, replace) {
@@ -2099,9 +2324,9 @@ function loadEnv(envName) {
   }
   files.push(".env");
   for (const file of files) {
-    if (!existsSync(file))
+    if (!existsSync2(file))
       continue;
-    const content = readFileSync(file, "utf-8");
+    const content = readFileSync2(file, "utf-8");
     for (const line of content.split(`
 `)) {
       const trimmed = line.trim();
@@ -2129,14 +2354,88 @@ var REPLACEMENT_FILES = {
   webapp: ["package.json", "index.html"],
   "webapp-fullstack": ["package.json", "wrangler.jsonc"]
 };
-async function create(projectName, repoUrl, templateName) {
+function isObject2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function pickString(...values) {
+  return values.find((value) => typeof value === "string" && value.length > 0);
+}
+function nestedObject(value, key) {
+  if (!isObject2(value))
+    return;
+  const nested = value[key];
+  return isObject2(nested) ? nested : undefined;
+}
+function extractWebappId(payload) {
+  const webapp = nestedObject(payload, "webapp");
+  return pickString(webapp?.id, webapp?.webappId);
+}
+function extractDeployToken(payload) {
+  const webapp = nestedObject(payload, "webapp");
+  return pickString(webapp?.deployToken, webapp?.deploymentToken);
+}
+function upsertEnvValue(content, key, value) {
+  const line = `${key}=${value}`;
+  const pattern = new RegExp(`^${key}=.*$`, "m");
+  if (pattern.test(content))
+    return content.replace(pattern, line);
+  return `${content}${content.endsWith(`
+`) || content.length === 0 ? "" : `
+`}${line}
+`;
+}
+function writeProjectEnv(projectDir, provisioned) {
+  const envFile = path2.join(projectDir, ".env");
+  let content = existsSync3(envFile) ? readFileSync3(envFile, "utf-8") : "";
+  content = upsertEnvValue(content, "WEBAPP_ID", provisioned.webappId);
+  content = upsertEnvValue(content, "DEPLOY_TOKEN", provisioned.deployToken);
+  writeFileSync3(envFile, content, "utf-8");
+}
+async function provisionWebapp(projectName, options) {
+  const cmsUrl = resolveCmsUrl(options.env, options.cmsUrl);
+  const token = resolveSessionToken(options.env);
+  const createUrl = options.createUrl || `${cmsUrl}/api/cli/webapps/create`;
+  const createResponse = await fetch(createUrl, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ title: projectName })
+  });
+  const createPayload = await readResponsePayload(createResponse);
+  if (!createResponse.ok) {
+    throw new Error(`CMS webapp creation failed: ${createResponse.status} ${createResponse.statusText}
+${JSON.stringify(createPayload, null, 2)}`);
+  }
+  const webappId = extractWebappId(createPayload);
+  if (!webappId) {
+    throw new Error(`CMS create response did not include webapp.id:
+${JSON.stringify(createPayload, null, 2)}`);
+  }
+  const deployToken = extractDeployToken(createPayload);
+  if (!deployToken) {
+    throw new Error(`CMS create response did not include webapp.deployToken:
+${JSON.stringify(createPayload, null, 2)}`);
+  }
+  return {
+    webappId,
+    deployToken
+  };
+}
+async function create(projectName, repoUrl, templateName, autoCreate) {
   const targetDir = path2.resolve(process.cwd(), projectName);
-  if (existsSync2(targetDir)) {
+  if (existsSync3(targetDir)) {
     console.error(`
   ✖ Directory "${projectName}" already exists.
 `);
     process.exit(1);
   }
+  if (autoCreate?.enabled) {
+    resolveCmsUrl(autoCreate.env, autoCreate.cmsUrl);
+    resolveSessionToken(autoCreate.env);
+  }
   console.log(`
   ⏳ Cloning template "${templateName}"...
 `);
@@ -2152,7 +2451,7 @@ async function create(projectName, repoUrl, templateName) {
     process.exit(1);
   }
   const gitDir = path2.join(targetDir, ".git");
-  if (existsSync2(gitDir)) {
+  if (existsSync3(gitDir)) {
     rmSync(gitDir, { recursive: true, force: true });
   }
   const filesToReplace = REPLACEMENT_FILES[templateName] ?? [];
@@ -2162,6 +2461,13 @@ async function create(projectName, repoUrl, templateName) {
     replaceInFiles(targetDir, filesToReplace, PLACEHOLDER_LOWER, projectName.toLowerCase());
   }
   execSync("git init", { stdio: "ignore", cwd: targetDir });
+  if (autoCreate?.enabled) {
+    console.log(`  \uD83C\uDF10 Creating CMS webapp in [${autoCreate.env}]...`);
+    const provisioned = await provisionWebapp(projectName, autoCreate);
+    writeProjectEnv(targetDir, provisioned);
+    console.log(`  \uD83D\uDD10 Wrote WEBAPP_ID and DEPLOY_TOKEN to .env`);
+    console.log(`  \uD83D\uDCCD Webapp ID: ${provisioned.webappId}`);
+  }
   console.log(`
   ✅ Project "${projectName}" created successfully!
 
@@ -2175,8 +2481,8 @@ async function create(projectName, repoUrl, templateName) {
 
 // src/deploy.ts
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, statSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync, statSync, unlinkSync } from "node:fs";
+import { join as join2 } from "node:path";
 
 // node_modules/mime/dist/types/other.js
 var types = {
@@ -3373,11 +3679,11 @@ var ZIP_FILE = "webapp-build.zip";
 var MAX_FILES_PER_BATCH = 5;
 var MAX_SIZE_PER_BATCH = 30 * 1024 * 1024;
 function getAllFiles(dirPath, arrayOfFiles = []) {
-  if (!existsSync3(dirPath))
+  if (!existsSync4(dirPath))
     return arrayOfFiles;
   const files = readdirSync(dirPath);
   files.forEach(function(f) {
-    const fullPath = join(dirPath, f);
+    const fullPath = join2(dirPath, f);
     if (statSync(fullPath).isDirectory()) {
       arrayOfFiles = getAllFiles(fullPath, arrayOfFiles);
     } else {
@@ -3387,7 +3693,7 @@ function getAllFiles(dirPath, arrayOfFiles = []) {
   return arrayOfFiles;
 }
 function fileToBlob(filePath) {
-  const buffer = readFileSync2(filePath);
+  const buffer = readFileSync4(filePath);
   return new Blob([buffer], { type: src_default.getType(filePath) || "application/octet-stream" });
 }
 async function deploy(env = "development", overrides = {}) {
@@ -3474,7 +3780,7 @@ ${errorText}`);
     console.log(`\uD83D\uDCDC Step 3: Setting up ${scriptFiles.length} scripts (APIs & Crons)...`);
     const scriptsPayload = { api: {}, cron: {}, cronConfig: null };
     for (const f of scriptFiles) {
-      const content = readFileSync2(f, "utf-8");
+      const content = readFileSync4(f, "utf-8");
       const relativePath = f.substring(BUILD_DIR.length + 1).replace(/\\/g, "/");
       if (relativePath === "cron-jobs/cron.config.json") {
         scriptsPayload.cronConfig = JSON.parse(content);
@@ -3514,7 +3820,7 @@ ${errorText}`);
   console.log(`✅ Created ${ZIP_FILE}
 `);
   console.log("☁️  Step 5: Deploying HTML zip to server...");
-  const zipBuffer = readFileSync2(ZIP_FILE);
+  const zipBuffer = readFileSync4(ZIP_FILE);
   try {
     const response = await fetch(DEPLOY_URL, {
       method: "POST",
@@ -3537,7 +3843,7 @@ ${errorText}`);
     console.error("❌ Deploy failed:", error);
     throw error;
   } finally {
-    if (existsSync3(ZIP_FILE)) {
+    if (existsSync4(ZIP_FILE)) {
       unlinkSync(ZIP_FILE);
       console.log(`
 \uD83E\uDDF9 Cleaned up ${ZIP_FILE}`);
@@ -3549,7 +3855,7 @@ ${errorText}`);
 
 // src/upgrade-template.ts
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, copyFileSync, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync2, copyFileSync, rmSync as rmSync2 } from "node:fs";
 var TEMPLATES = {
   webapp: {
     name: "webapp (SPA)",
@@ -3579,15 +3885,17 @@ var TEMPLATES = {
 var CLI_SCRIPTS = {
   "link-game-sdk": "bunx @rodyssey/cli@latest app update-game-sdk",
   deploy: "bunx @rodyssey/cli@latest app deploy",
+  "get-webapp-config": "bunx @rodyssey/cli@latest app config get",
+  "update-webapp-config": "bunx @rodyssey/cli@latest app config set",
   "upgrade-template": "bunx @rodyssey/cli@latest app upgrade-template"
 };
 function detectTemplate() {
-  if (existsSync4("app")) {
+  if (existsSync5("app")) {
     console.log(`\uD83D\uDD0D Detected fullstack template (found app/ directory)
 `);
     return TEMPLATES["webapp-fullstack"];
   }
-  if (existsSync4("src")) {
+  if (existsSync5("src")) {
     console.log(`\uD83D\uDD0D Detected SPA template (found src/ directory)
 `);
     return TEMPLATES["webapp"];
@@ -3598,11 +3906,11 @@ function detectTemplate() {
 }
 function updatePackageJsonScripts() {
   const pkgPath = "package.json";
-  if (!existsSync4(pkgPath)) {
+  if (!existsSync5(pkgPath)) {
     console.log("⚠️  No package.json found, skipping scripts update");
     return;
   }
-  const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
   if (!pkg.scripts) {
     pkg.scripts = {};
   }
@@ -3616,7 +3924,7 @@ function updatePackageJsonScripts() {
     }
   }
   if (updated) {
-    writeFileSync2(pkgPath, JSON.stringify(pkg, null, 2) + `
+    writeFileSync4(pkgPath, JSON.stringify(pkg, null, 2) + `
 `, "utf-8");
     console.log(`✅ package.json scripts updated
 `);
@@ -3640,8 +3948,8 @@ function updateCliSkill() {
     }
     execSync3(`git fetch ${cliRemote}`, { stdio: "inherit" });
     execSync3(`git checkout ${cliRemote}/main -- skills/ro-cli/SKILL.md`, { stdio: "inherit" });
-    if (existsSync4("skills/ro-cli/SKILL.md")) {
-      mkdirSync(".agent/skills/ro-cli", { recursive: true });
+    if (existsSync5("skills/ro-cli/SKILL.md")) {
+      mkdirSync2(".agent/skills/ro-cli", { recursive: true });
       copyFileSync("skills/ro-cli/SKILL.md", ".agent/skills/ro-cli/SKILL.md");
       rmSync2("skills", { recursive: true, force: true });
       console.log(`  ✅ CLI skill updated
@@ -3673,7 +3981,7 @@ async function upgradeTemplate() {
     const checkoutList = template.checkoutFiles.join(" ");
     execSync3(`git checkout ${template.remoteName}/main -- ${checkoutList}`, { stdio: "inherit" });
     for (const file of template.newFiles) {
-      if (!existsSync4(file)) {
+      if (!existsSync5(file)) {
         console.log(`\uD83D\uDCC2 Checking out ${file}...`);
         try {
           execSync3(`git checkout ${template.remoteName}/main -- ${file}`, { stdio: "inherit" });
@@ -3698,7 +4006,7 @@ async function upgradeTemplate() {
 
 // src/update-game-sdk.ts
 import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join3 } from "node:path";
 var BASE_URL = "https://development-app.rodyssey.ai";
 var FILES = [
   {
@@ -3728,7 +4036,7 @@ async function downloadFile(url, path3, description) {
       throw new Error(`HTTP ${response.status}: ${response.statusText}`);
     }
     const content = await response.text();
-    const dir = dirname(path3);
+    const dir = dirname2(path3);
     await mkdir(dir, { recursive: true });
     await writeFile(path3, content, "utf-8");
     console.log(`✅ Downloaded ${description} (${content.length} bytes)
@@ -3772,7 +4080,7 @@ async function downloadDocumentation(manifest) {
   let failCount = 0;
   for (const doc of manifest.documentation) {
     const url = `${BASE_URL}/skills/${doc.file}`;
-    const path3 = join2(".agent", "skills", "game-sdk", doc.file);
+    const path3 = join3(".agent", "skills", "game-sdk", doc.file);
     const description = `${doc.title} (${doc.category})`;
     const success = await downloadFile(url, path3, description);
     if (success) {
@@ -3831,6 +4139,162 @@ async function updateGameSdk() {
   }
 }
 
+// src/update-webapp-config.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { resolve } from "node:path";
+var CONFIG_URLS = {
+  local: "http://localhost:5176/api/webapps/config",
+  development: "https://development-cms.rodyssey.ai/api/webapps/config",
+  staging: "https://staging-cms.rodyssey.ai/api/webapps/config",
+  production: "https://cms.rodyssey.ai/api/webapps/config"
+};
+function parseJsonOption(value, optionName) {
+  const maybePath = resolve(process.cwd(), value);
+  const raw = existsSync6(maybePath) ? readFileSync6(maybePath, "utf-8") : value;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("value must be a JSON object");
+    }
+    return parsed;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid ${optionName}: ${message}`);
+  }
+}
+function resolveConfigUrl(options, required = true) {
+  const configUrl = options.url || process.env.WEBAPP_CONFIG_URL || CONFIG_URLS[options.env];
+  if (!configUrl) {
+    if (!required)
+      return;
+    console.error("❌ Error: no webapp config endpoint configured.");
+    console.error(`\uD83D\uDCA1 Use one of these environments: ${Object.keys(CONFIG_URLS).join(", ")}, pass --url, or set WEBAPP_CONFIG_URL in your .env file.`);
+    process.exit(1);
+  }
+  const url = new URL(configUrl);
+  if (!options.host && !options.port) {
+    return url.toString().replace(/\/$/, "");
+  }
+  if (options.host)
+    url.hostname = options.host;
+  if (options.port)
+    url.port = String(options.port);
+  return url.toString().replace(/\/$/, "");
+}
+function buildConfigPayload(options) {
+  const payload = options.config ? parseJsonOption(options.config, "--config") : {};
+  if (options.title !== undefined)
+    payload.title = options.title;
+  if (options.description !== undefined)
+    payload.description = options.description;
+  if (options.coverImg !== undefined)
+    payload.coverImg = options.coverImg;
+  if (options.localization !== undefined) {
+    payload.localization = parseJsonOption(options.localization, "--localization");
+  }
+  return payload;
+}
+function resolveWebappId(webappId) {
+  const resolved = webappId || process.env.WEBAPP_ID;
+  if (!resolved) {
+    console.error("❌ Error: WEBAPP_ID is not set. Pass --webapp-id or set it in your .env file.");
+    process.exit(1);
+  }
+  return resolved;
+}
+function ensureDeployToken(env) {
+  if (process.env.DEPLOY_TOKEN)
+    return;
+  console.error("❌ Error: DEPLOY_TOKEN is not set in environment variables.");
+  console.info(`\uD83D\uDCA1 Please check your .env or .env.${env} file.`);
+  process.exit(1);
+}
+function getConfigUrl(options, required = true) {
+  return resolveConfigUrl(options, required);
+}
+async function getWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const CONFIG_URL = getConfigUrl(options);
+  if (!CONFIG_URL)
+    return;
+  ensureDeployToken(options.env);
+  const url = new URL(CONFIG_URL);
+  url.searchParams.set("webappId", webappId);
+  console.log(`⚙️ Pulling webapp config for [${options.env}] environment...`);
+  console.log(`\uD83D\uDCCD Config URL: ${url.toString()}`);
+  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
+`);
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Config fetch failed: ${response.status} ${response.statusText}
+${errorText}`);
+  }
+  const config = await response.json();
+  const output = JSON.stringify(config, null, 2);
+  if (options.out) {
+    writeFileSync5(options.out, `${output}
+`, "utf-8");
+    console.log(`✅ Webapp config written to ${options.out}`);
+    return;
+  }
+  console.log(output);
+}
+async function updateWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const config = buildConfigPayload(options);
+  if (Object.keys(config).length === 0) {
+    console.error("❌ Error: no config fields provided. Use --title, --cover-img, --localization, or --config.");
+    process.exit(1);
+  }
+  const payload = { webappId, config };
+  const CONFIG_URL = getConfigUrl(options, !options.dryRun);
+  if (!options.dryRun)
+    ensureDeployToken(options.env);
+  console.log(`⚙️ Updating webapp config for [${options.env}] environment...`);
+  if (CONFIG_URL) {
+    console.log(`\uD83D\uDCCD Config URL: ${CONFIG_URL}`);
+  }
+  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
+`);
+  if (options.dryRun) {
+    console.log("\uD83E\uDDEA Dry run payload:");
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (!CONFIG_URL)
+    return;
+  const response = await fetch(CONFIG_URL, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(payload)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Config update failed: ${response.status} ${response.statusText}
+${errorText}`);
+  }
+  const result = await response.json().catch(() => {
+    return;
+  });
+  console.log("✅ Webapp config updated");
+  if (result !== undefined) {
+    console.log(`
+\uD83D\uDCCB Update result:`, result);
+  }
+}
+
 // src/cli.ts
 var TEMPLATES2 = {
   webapp: {
@@ -3858,22 +4322,28 @@ Available templates:
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     rl.question(`Select a template (1-${entries.length}): `, (answer) => {
       rl.close();
       const index = parseInt(answer, 10) - 1;
       if (index >= 0 && index < entries.length) {
-        resolve(entries[index].name);
+        resolve2(entries[index].name);
       } else {
         console.error("Invalid selection, defaulting to 'webapp'");
-        resolve("webapp");
+        resolve2("webapp");
       }
     });
   });
 }
 program.name("@rodyssey/cli").description("Airconcepts CLI toolkit").version("0.1.0");
 var app = program.command("app").description("Manage webapp projects");
-app.command("create").argument("<project-name>", "Name of the project to create").option("-t, --template <template>", "Template to use (webapp | webapp-fullstack)").description("Create a new project from a template").action(async (projectName, options) => {
+function addConfigTargetOptions(command) {
+  return command.option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--url <url>", "Override the config endpoint URL").option("--host <host>", "Override the config endpoint host").option("--port <port>", "Override the config endpoint port", parseInt).option("--webapp-id <id>", "Webapp ID. Defaults to WEBAPP_ID from .env");
+}
+function addConfigSetOptions(command) {
+  return addConfigTargetOptions(command).option("--title <title>", "Webapp title").option("--description <description>", "Webapp description").option("--cover-img <url>", "Cover image URL").option("--localization <json-or-file>", "Localization JSON object or path to a JSON file").option("--config <json-or-file>", "Full config JSON object or path to a JSON file").option("--dry-run", "Print the request payload without sending it");
+}
+app.command("create").argument("<project-name>", "Name of the project to create").option("-t, --template <template>", "Template to use (webapp | webapp-fullstack)").option("--auto", "Create a CMS webapp and write WEBAPP_ID/DEPLOY_TOKEN to .env").option("-e, --env <environment>", "CMS environment for --auto (local | development | staging | production)", "development").option("--cms-url <url>", "CMS base URL for --auto. Defaults to the selected environment").option("--create-url <url>", "Full CMS create endpoint for --auto. Defaults to <cms-url>/api/cli/webapps/create").description("Create a new project from a template").action(async (projectName, options) => {
   let templateName;
   if (options.template) {
     if (!(options.template in TEMPLATES2)) {
@@ -3885,7 +4355,12 @@ app.command("create").argument("<project-name>", "Name of the project to create"
     templateName = await selectTemplate();
   }
   const template = TEMPLATES2[templateName];
-  await create(projectName, template.repo, templateName);
+  await create(projectName, template.repo, templateName, {
+    enabled: options.auto,
+    env: options.env,
+    cmsUrl: options.cmsUrl,
+    createUrl: options.createUrl
+  });
 });
 app.command("update-game-sdk").description("Download and update the GameSDK library, types, and documentation").action(async () => {
   await updateGameSdk();
@@ -3893,6 +4368,31 @@ app.command("update-game-sdk").description("Download and update the GameSDK libr
 app.command("deploy").description("Build and deploy the webapp to the server").option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--host <host>", "Override the deploy host").option("--port <port>", "Override the deploy port", parseInt).action(async (options) => {
   await deploy(options.env, { host: options.host, port: options.port });
 });
+var auth = app.command("auth").description("Authenticate with the CMS");
+auth.command("login").description("Log in to the CMS using a browser callback").option("-e, --env <environment>", "CMS environment (local | development | staging | production)", "development").option("--cms-url <url>", "CMS base URL. Defaults to the selected environment").option("--login-url <url>", "Full browser login URL. Defaults to <cms-url>/auth/cli-login").option("--token-url <url>", "Full token exchange URL. Defaults to <cms-url>/api/auth/cli-token").option("--callback-port <port>", "Local callback port. Defaults to a random free port", parseInt).option("--timeout <seconds>", "Seconds to wait for the browser callback", parseInt, 300).option("--no-open", "Print the login URL without opening a browser").action(async (options) => {
+  const session = await login({
+    env: options.env,
+    cmsUrl: options.cmsUrl,
+    loginUrl: options.loginUrl,
+    tokenUrl: options.tokenUrl,
+    callbackPort: options.callbackPort,
+    open: options.open,
+    timeoutMs: (options.timeout ?? 300) * 1000
+  });
+  console.log(`✅ Logged in to CMS [${session.env}]`);
+  console.log(`\uD83D\uDCCD CMS URL: ${session.cmsUrl}`);
+});
+auth.command("me").description("Show the locally stored CMS login session").option("-e, --env <environment>", "CMS environment (local | development | staging | production)", "development").option("--remote", "Call the CMS /me endpoint instead of only reading the local session").option("--cms-url <url>", "CMS base URL for --remote. Defaults to the selected environment or stored session").option("--me-url <url>", "Full me endpoint URL for --remote. Defaults to <cms-url>/api/auth/me").action(async (options) => {
+  const currentUser = await me(options);
+  console.log(JSON.stringify(currentUser, null, 2));
+});
+var config = app.command("config").description("Manage webapp metadata config");
+addConfigTargetOptions(config.command("get").description("Pull the current webapp metadata config from the CMS").option("--out <file>", "Write the config JSON to a file")).action(async (options) => {
+  await getWebappConfig(options);
+});
+addConfigSetOptions(config.command("set").description("Update webapp metadata such as title, cover image, description, and localization")).action(async (options) => {
+  await updateWebappConfig(options);
+});
 app.command("upgrade-template").description("Upgrade template files and CLI scripts from the template repository").action(async () => {
   await upgradeTemplate();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodyssey/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Scaffold new projects from airconcepts templates",
   "bin": {
     "@rodyssey/cli": "dist/cli.js"