@spacelr/cli 0.1.4 → 0.1.6

package/dist/index.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // libs/cli/src/index.ts
-var import_commander13 = require("commander");
+var import_commander14 = require("commander");
 
 // libs/cli/src/lib/output.ts
 var import_ora = __toESM(require("ora"));
@@ -106,47 +106,245 @@ var import_commander = require("commander");
 var import_open = __toESM(require("open"));
 
 // libs/cli/src/lib/auth.ts
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+var os = __toESM(require("os"));
+var crypto = __toESM(require("crypto"));
+
+// libs/cli/src/lib/config.ts
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
-var crypto = __toESM(require("crypto"));
-function getCredentialsDir() {
-  return path.join(
-    process.env["HOME"] ?? process.env["USERPROFILE"] ?? "~",
+var CONFIG_FILENAME = "spacelr.json";
+var RULES_FILENAME = "spacelr.rules.json";
+var INDEXES_FILENAME = "spacelr.indexes.json";
+function readJsonFile(filePath, label) {
+  const content = fs.readFileSync(filePath, "utf-8");
+  try {
+    return JSON.parse(content);
+  } catch (err) {
+    const detail = err instanceof Error ? `: ${err.message}` : "";
+    throw new Error(
+      `Invalid JSON in ${label}: ${filePath}${detail}
+Please check the file for syntax errors.`
+    );
+  }
+}
+function writeJsonFile(filePath, data) {
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+}
+function resolveSiblingPath(filename, configPath) {
+  const resolved = configPath ?? findConfigPath();
+  const dir = resolved ? path.dirname(resolved) : process.cwd();
+  return path.join(dir, filename);
+}
+function findConfigPath(startDir) {
+  let dir = startDir ?? process.cwd();
+  while (true) {
+    const candidate = path.join(dir, CONFIG_FILENAME);
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      return null;
+    }
+    dir = parent;
+  }
+}
+function loadConfig(configPath) {
+  const resolved = configPath ?? findConfigPath();
+  if (!resolved || !fs.existsSync(resolved)) return null;
+  return readJsonFile(resolved, "config file");
+}
+function saveConfig(config, configPath) {
+  const resolved = configPath ?? findConfigPath() ?? path.join(process.cwd(), CONFIG_FILENAME);
+  writeJsonFile(resolved, config);
+}
+function resolveProjectId(flagValue, config) {
+  const projectId = flagValue ?? config?.projectId;
+  if (!projectId) {
+    throw new Error(
+      'Project ID is required. Provide --project <id> or set "projectId" in spacelr.json'
+    );
+  }
+  return projectId;
+}
+function resolveApiUrl(flagValue, config) {
+  return flagValue ?? config?.apiUrl ?? process.env["SPACELR_API_URL"] ?? "https://api.spacelr.com/api/v1";
+}
+function loadRules(configPath) {
+  const filePath = resolveSiblingPath(RULES_FILENAME, configPath);
+  if (!fs.existsSync(filePath)) return null;
+  return readJsonFile(filePath, "rules file");
+}
+function saveRules(rules, configPath) {
+  writeJsonFile(resolveSiblingPath(RULES_FILENAME, configPath), rules);
+}
+function loadIndexes(configPath) {
+  const filePath = resolveSiblingPath(INDEXES_FILENAME, configPath);
+  if (!fs.existsSync(filePath)) return null;
+  return readJsonFile(filePath, "indexes file");
+}
+function saveIndexes(indexes, configPath) {
+  writeJsonFile(resolveSiblingPath(INDEXES_FILENAME, configPath), indexes);
+}
+
+// libs/cli/src/lib/auth.ts
+function getGlobalCredentialsDir() {
+  return path2.join(
+    process.env["HOME"] ?? process.env["USERPROFILE"] ?? os.homedir(),
     ".spacelr"
   );
 }
-function getCredentialsFile() {
-  return path.join(getCredentialsDir(), "credentials.json");
+function getGlobalCredentialsFile() {
+  return path2.join(getGlobalCredentialsDir(), "credentials.json");
+}
+function resolveCredentialsFile(forceGlobal = false) {
+  if (forceGlobal) {
+    return { path: getGlobalCredentialsFile(), scope: "global" };
+  }
+  const configPath = findConfigPath();
+  if (configPath) {
+    const projectDir = path2.dirname(configPath);
+    return {
+      path: path2.join(projectDir, ".spacelr", "credentials.json"),
+      scope: "project",
+      projectDir
+    };
+  }
+  return { path: getGlobalCredentialsFile(), scope: "global" };
 }
-function getStoredCredentials() {
+function ensureGitignored(projectDir) {
+  const gitignorePath = path2.join(projectDir, ".gitignore");
+  const entry = ".spacelr/";
+  const matchesExisting = (line) => {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) return false;
+    return trimmed === ".spacelr" || trimmed === ".spacelr/" || trimmed === ".spacelr/*" || trimmed === ".spacelr/**" || trimmed === ".spacelr/credentials.json" || // Leading-slash forms anchor the pattern to the repo root
+    trimmed === "/.spacelr" || trimmed === "/.spacelr/" || trimmed === "/.spacelr/*" || trimmed === "/.spacelr/**" || trimmed === "/.spacelr/credentials.json";
+  };
+  const hasNegation = (line) => {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) return false;
+    return trimmed.startsWith("!") && trimmed.includes(".spacelr");
+  };
+  let content = "";
+  let existed = false;
   try {
-    const file = getCredentialsFile();
-    if (!fs.existsSync(file)) return null;
-    const content = fs.readFileSync(file, "utf-8");
-    return JSON.parse(content);
+    content = fs2.readFileSync(gitignorePath, "utf-8");
+    existed = true;
+  } catch (err) {
+    if (err.code !== "ENOENT") return { safe: true };
+  }
+  const lines = content.split(/\r?\n/);
+  if (lines.some(hasNegation)) {
+    const alreadyHasMatch = lines.some(matchesExisting);
+    warn(
+      alreadyHasMatch ? ".gitignore already contains .spacelr/ but ALSO contains a negation pattern that un-ignores credentials. Remove the negation or store credentials globally with `spacelr login --global`." : ".gitignore contains a negation pattern for .spacelr/ \u2014 refusing to write credentials safety entry. Remove the negation or store credentials globally with `spacelr login --global`."
+    );
+    return { safe: false };
+  }
+  if (lines.some(matchesExisting)) return { safe: true };
+  const needsLeadingNewline = existed && content.length > 0 && !content.endsWith("\n");
+  const newContent = (existed ? content : "") + (needsLeadingNewline ? "\n" : "") + entry + "\n";
+  try {
+    writeFileAtomic(gitignorePath, newContent, 420);
+    info(`Added ${entry} to .gitignore (credentials must never be committed)`);
+    return { safe: true };
   } catch {
-    return null;
+    return { safe: true };
   }
 }
-function storeCredentials(credentials) {
-  const dir = getCredentialsDir();
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+function getStoredCredentialsWithLocation(forceGlobal = false) {
+  const primary = resolveCredentialsFile(forceGlobal);
+  const fromPrimary = readCredentialsFromDisk(primary.path);
+  if (fromPrimary) return { credentials: fromPrimary, location: primary };
+  if (!forceGlobal && primary.scope === "project") {
+    const globalPath = getGlobalCredentialsFile();
+    const fromGlobal = readCredentialsFromDisk(globalPath);
+    if (fromGlobal) {
+      return {
+        credentials: fromGlobal,
+        location: { path: globalPath, scope: "global" }
+      };
+    }
   }
-  fs.writeFileSync(
-    getCredentialsFile(),
-    JSON.stringify(credentials, null, 2),
-    { mode: 384 }
-  );
+  return null;
 }
-function clearCredentials() {
+function readCredentialsFromDisk(filePath) {
   try {
-    const file = getCredentialsFile();
-    if (fs.existsSync(file)) {
-      fs.unlinkSync(file);
+    const content = fs2.readFileSync(filePath, "utf-8");
+    const parsed = JSON.parse(content);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    if (typeof obj["accessToken"] !== "string" || obj["accessToken"].length === 0 || !Number.isFinite(obj["expiresAt"]) || typeof obj["apiUrl"] !== "string" || obj["apiUrl"].length === 0) {
+      return null;
+    }
+    if ("refreshToken" in obj && typeof obj["refreshToken"] !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeFileAtomic(filePath, data, mode) {
+  const tmpPath = `${filePath}.tmp.${process.pid}.${crypto.randomBytes(6).toString("hex")}`;
+  try {
+    fs2.writeFileSync(tmpPath, data, { mode });
+    fs2.renameSync(tmpPath, filePath);
+  } catch (err) {
+    try {
+      fs2.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+function storeCredentials(credentials, target = false) {
+  const location = typeof target === "boolean" ? resolveCredentialsFile(target) : target;
+  if (location.scope === "project" && location.projectDir) {
+    const { safe } = ensureGitignored(location.projectDir);
+    if (!safe) {
+      throw new Error(
+        "Refusing to write project-local credentials: .gitignore contains a negation pattern that would un-ignore .spacelr/. Run `spacelr login --global` to store credentials in ~/.spacelr/."
+      );
     }
+  }
+  const dir = path2.dirname(location.path);
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    fs2.chmodSync(dir, 448);
   } catch {
   }
+  writeFileAtomic(location.path, JSON.stringify(credentials, null, 2), 384);
+  return location;
+}
+function clearCredentials(scope = "auto") {
+  const cleared = [];
+  const tryDelete = (loc) => {
+    try {
+      fs2.unlinkSync(loc.path);
+      cleared.push(loc);
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") {
+        warn(
+          `Failed to remove ${loc.path} (${code ?? "unknown error"}) \u2014 file may still be on disk`
+        );
+      }
+    }
+  };
+  if (scope === "all") {
+    const primary = resolveCredentialsFile(false);
+    if (primary.scope === "project") tryDelete(primary);
+    tryDelete(
+      primary.scope === "global" ? primary : resolveCredentialsFile(true)
+    );
+  } else {
+    tryDelete(resolveCredentialsFile(scope === "global"));
+  }
+  return { cleared };
 }
 function isTokenExpired(credentials) {
   return Date.now() >= credentials.expiresAt - 6e4;
@@ -154,17 +352,29 @@ function isTokenExpired(credentials) {
 async function resolveToken(flagToken) {
   if (flagToken) return flagToken;
   if (process.env["SPACELR_TOKEN"]) return process.env["SPACELR_TOKEN"];
-  const credentials = getStoredCredentials();
-  if (!credentials) return null;
+  const loaded = getStoredCredentialsWithLocation();
+  if (!loaded) return null;
+  const { credentials, location } = loaded;
   if (!isTokenExpired(credentials)) return credentials.accessToken;
-  if (credentials.refreshToken && credentials.apiUrl) {
-    const newToken = await refreshStoredToken(credentials);
+  if (credentials.refreshToken) {
+    const newToken = await refreshStoredToken(credentials, location);
     if (newToken) return newToken;
   }
   return null;
 }
 var REFRESH_TIMEOUT_MS = 1e4;
-async function refreshStoredToken(credentials) {
+async function refreshStoredToken(credentials, sourceLocation) {
+  if (!credentials.refreshToken) return null;
+  try {
+    const parsed = new URL(credentials.apiUrl);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      verbose(`Refusing to refresh against non-http(s) URL: ${parsed.protocol}`);
+      return null;
+    }
+  } catch {
+    verbose("Refusing to refresh: stored apiUrl is not a valid URL");
+    return null;
+  }
   const apiUrl = credentials.apiUrl.replace(/\/+$/, "");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);
@@ -173,21 +383,34 @@ async function refreshStoredToken(credentials) {
     const response = await fetch(`${apiUrl}/auth/refresh`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refreshToken: credentials.refreshToken ?? "" }),
+      body: JSON.stringify({ refreshToken: credentials.refreshToken }),
       signal: controller.signal
     });
     if (!response.ok) {
       verbose(`Token refresh failed (HTTP ${response.status})`);
+      if (response.status === 401) {
+        const fresh = readCredentialsFromDisk(sourceLocation.path);
+        if (fresh && (fresh.accessToken !== credentials.accessToken || fresh.refreshToken !== credentials.refreshToken) && !isTokenExpired(fresh)) {
+          verbose("Using credentials refreshed by concurrent process");
+          return fresh.accessToken;
+        }
+      }
       return null;
     }
     const data = await response.json();
+    if (typeof data.access_token !== "string") {
+      verbose("Token refresh returned unexpected response shape");
+      return null;
+    }
+    const expiresInRaw = data.expires_in;
+    const expiresIn = typeof expiresInRaw === "number" && Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? expiresInRaw : 3600;
     const newCredentials = {
       accessToken: data.access_token,
       refreshToken: data.refresh_token ?? credentials.refreshToken,
-      expiresAt: Date.now() + (data.expires_in ?? 3600) * 1e3,
+      expiresAt: Date.now() + expiresIn * 1e3,
       apiUrl: credentials.apiUrl
     };
-    storeCredentials(newCredentials);
+    storeCredentials(newCredentials, sourceLocation);
     verbose("Token refreshed successfully");
     return data.access_token;
   } catch (err) {
@@ -220,100 +443,35 @@ function generatePKCE() {
   return { codeVerifier, codeChallenge };
 }
 
-// libs/cli/src/lib/config.ts
-var fs2 = __toESM(require("fs"));
-var path2 = __toESM(require("path"));
-var CONFIG_FILENAME = "spacelr.json";
-var RULES_FILENAME = "spacelr.rules.json";
-var INDEXES_FILENAME = "spacelr.indexes.json";
-function readJsonFile(filePath, label) {
-  const content = fs2.readFileSync(filePath, "utf-8");
-  try {
-    return JSON.parse(content);
-  } catch (err) {
-    const detail = err instanceof Error ? `: ${err.message}` : "";
-    throw new Error(
-      `Invalid JSON in ${label}: ${filePath}${detail}
-Please check the file for syntax errors.`
-    );
-  }
-}
-function writeJsonFile(filePath, data) {
-  fs2.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
-}
-function resolveSiblingPath(filename, configPath) {
-  const resolved = configPath ?? findConfigPath();
-  const dir = resolved ? path2.dirname(resolved) : process.cwd();
-  return path2.join(dir, filename);
-}
-function findConfigPath(startDir) {
-  let dir = startDir ?? process.cwd();
-  while (true) {
-    const candidate = path2.join(dir, CONFIG_FILENAME);
-    if (fs2.existsSync(candidate)) {
-      return candidate;
-    }
-    const parent = path2.dirname(dir);
-    if (parent === dir) {
-      return null;
-    }
-    dir = parent;
-  }
-}
-function loadConfig(configPath) {
-  const resolved = configPath ?? findConfigPath();
-  if (!resolved || !fs2.existsSync(resolved)) return null;
-  return readJsonFile(resolved, "config file");
-}
-function saveConfig(config, configPath) {
-  const resolved = configPath ?? findConfigPath() ?? path2.join(process.cwd(), CONFIG_FILENAME);
-  writeJsonFile(resolved, config);
-}
-function resolveProjectId(flagValue, config) {
-  const projectId = flagValue ?? config?.projectId;
-  if (!projectId) {
-    throw new Error(
-      'Project ID is required. Provide --project <id> or set "projectId" in spacelr.json'
-    );
-  }
-  return projectId;
-}
-function resolveApiUrl(flagValue, config) {
-  return flagValue ?? config?.apiUrl ?? process.env["SPACELR_API_URL"] ?? "https://api.spacelr.io";
-}
-function loadRules(configPath) {
-  const filePath = resolveSiblingPath(RULES_FILENAME, configPath);
-  if (!fs2.existsSync(filePath)) return null;
-  return readJsonFile(filePath, "rules file");
-}
-function saveRules(rules, configPath) {
-  writeJsonFile(resolveSiblingPath(RULES_FILENAME, configPath), rules);
-}
-function loadIndexes(configPath) {
-  const filePath = resolveSiblingPath(INDEXES_FILENAME, configPath);
-  if (!fs2.existsSync(filePath)) return null;
-  return readJsonFile(filePath, "indexes file");
-}
-function saveIndexes(indexes, configPath) {
-  writeJsonFile(resolveSiblingPath(INDEXES_FILENAME, configPath), indexes);
-}
-
 // libs/cli/src/commands/login.ts
 var CLI_CLIENT_ID = "spacelr-cli";
 function createLoginCommand() {
-  return new import_commander.Command("login").description("Authenticate with Spacelr via browser").option("--auth-url <url>", "OAuth server URL (defaults to --api-url)").action(async (opts, cmd) => {
+  return new import_commander.Command("login").description("Authenticate with Spacelr via browser").option("--auth-url <url>", "OAuth server URL (defaults to --api-url)").option(
+    "--global",
+    "Store credentials globally (~/.spacelr/credentials.json) instead of in the current project"
+  ).action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const config = loadConfig();
     const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
     const authUrl = opts.authUrl ?? apiUrl;
+    const forceGlobal = opts.global === true;
     try {
       const credentials = await performLogin(authUrl, apiUrl);
-      storeCredentials(credentials);
+      const location = storeCredentials(credentials, forceGlobal);
       if (isJsonMode()) {
-        json({ success: true, expiresAt: credentials.expiresAt });
+        json({
+          success: true,
+          expiresAt: credentials.expiresAt,
+          credentialsPath: location.path,
+          scope: location.scope
+        });
       } else {
         success("Logged in successfully");
-        info(`Credentials stored in ~/.spacelr/credentials.json`);
+        if (location.scope === "project") {
+          info(`Credentials stored in ${location.path} (project-local)`);
+        } else {
+          info(`Credentials stored in ${location.path} (global)`);
+        }
       }
     } catch (err) {
       error(err instanceof Error ? err.message : "Login failed");
@@ -340,10 +498,12 @@ async function performLogin(authUrl, apiUrl) {
       port
     );
     spin.succeed("Authentication complete");
+    const expiresInRaw = tokenResponse.expires_in;
+    const expiresIn = typeof expiresInRaw === "number" && Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? expiresInRaw : 3600;
     return {
       accessToken: tokenResponse.access_token,
       refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * 1e3,
+      expiresAt: Date.now() + expiresIn * 1e3,
       apiUrl
     };
   } catch (err) {
@@ -369,8 +529,8 @@ async function startCallbackServer(expectedState) {
   return new Promise((resolveServer) => {
     let resolveCode;
     let rejectCode;
-    const waitForCode = new Promise((resolve3, reject) => {
-      resolveCode = resolve3;
+    const waitForCode = new Promise((resolve4, reject) => {
+      resolveCode = resolve4;
       rejectCode = reject;
     });
     const server = http.createServer((req, res) => {
@@ -446,7 +606,11 @@ async function exchangeCode(apiUrl, code, codeVerifier, port) {
     }
     throw new Error(`Token exchange failed: ${message}`);
   }
-  return await response.json();
+  const parsed = await response.json();
+  if (typeof parsed.access_token !== "string" || parsed.access_token.length === 0) {
+    throw new Error("Token exchange returned no access_token");
+  }
+  return parsed;
 }
 function successPage() {
   return `<!DOCTYPE html>
@@ -469,16 +633,29 @@ function errorPage(message) {
 // libs/cli/src/commands/logout.ts
 var import_commander2 = require("commander");
 function createLogoutCommand() {
-  return new import_commander2.Command("logout").description("Clear stored credentials").action(async (_opts, cmd) => {
-    cmd.optsWithGlobals();
-    const existing = getStoredCredentials();
-    clearCredentials();
+  return new import_commander2.Command("logout").description("Clear stored credentials").option("--global", "Clear only the global credentials file").option(
+    "--all",
+    "Clear the current project credentials file (if any) and the global credentials file (other projects are not touched \u2014 they cannot be enumerated)"
+  ).action(async (opts) => {
+    if (opts.global === true && opts.all === true) {
+      warn("--global and --all cannot be combined; --all already removes the global file");
+      process.exitCode = 1;
+      return;
+    }
+    const scope = opts.all === true ? "all" : opts.global === true ? "global" : "auto";
+    const { cleared } = clearCredentials(scope);
     if (isJsonMode()) {
-      json({ success: true, hadCredentials: !!existing });
-    } else if (existing) {
-      success("Logged out successfully");
-    } else {
+      json({
+        success: true,
+        cleared: cleared.map((c) => ({ path: c.path, scope: c.scope }))
+      });
+    } else if (cleared.length === 0) {
       warn("No credentials found");
+    } else {
+      success("Logged out successfully");
+      for (const loc of cleared) {
+        info(`Removed ${loc.path} (${loc.scope})`);
+      }
     }
   });
 }
@@ -499,19 +676,20 @@ var ApiClient = class {
     if (this.explicitToken) return this.explicitToken;
     const envToken = process.env["SPACELR_TOKEN"];
     if (envToken) return envToken;
-    const credentials = getStoredCredentials();
-    if (!credentials) return null;
+    const loaded = getStoredCredentialsWithLocation();
+    if (!loaded) return null;
+    const { credentials, location } = loaded;
     if (!isTokenExpired(credentials)) {
       return credentials.accessToken;
     }
     if (credentials.refreshToken) {
-      return this.refreshAccessToken(credentials);
+      return this.refreshAccessToken(credentials, location);
     }
     return null;
   }
-  async refreshAccessToken(credentials) {
+  async refreshAccessToken(credentials, location) {
     if (this.refreshing) return this.refreshing;
-    this.refreshing = refreshStoredToken(credentials).finally(() => {
+    this.refreshing = refreshStoredToken(credentials, location).finally(() => {
       this.refreshing = null;
     });
     return this.refreshing;
@@ -523,9 +701,9 @@ var ApiClient = class {
     }
     return body;
   }
-  async request(path6, options = {}) {
+  async request(path7, options = {}) {
     const { method = "GET", body, headers = {}, timeout = 3e4 } = options;
-    const url = `${this.apiUrl}${path6}`;
+    const url = `${this.apiUrl}${path7}`;
     const token = await this.getToken();
     if (token) {
       headers["Authorization"] = `Bearer ${token}`;
@@ -549,9 +727,17 @@ var ApiClient = class {
         signal: controller.signal
       });
       if (response.status === 401 && !this.explicitToken) {
-        const credentials = getStoredCredentials();
-        if (credentials?.refreshToken) {
-          const newToken = await this.refreshAccessToken(credentials);
+        const loaded = getStoredCredentialsWithLocation();
+        if (loaded) {
+          let newToken = null;
+          if (!isTokenExpired(loaded.credentials)) {
+            newToken = loaded.credentials.accessToken;
+          } else if (loaded.credentials.refreshToken) {
+            newToken = await this.refreshAccessToken(
+              loaded.credentials,
+              loaded.location
+            );
+          }
           if (newToken) {
             headers["Authorization"] = `Bearer ${newToken}`;
             const retryController = new AbortController();
@@ -564,6 +750,11 @@ var ApiClient = class {
             });
             clearTimeout(retryTimer);
             if (!retryResponse.ok) {
+              if (retryResponse.status === 401) {
+                throw new Error(
+                  'Authentication required. Run "spacelr login" to authenticate.'
+                );
+              }
               await this.throwApiError(retryResponse);
             }
             return await retryResponse.json();
@@ -583,7 +774,7 @@ var ApiClient = class {
       return await response.text();
     } catch (err) {
       if (err instanceof Error && err.name === "AbortError") {
-        throw new Error(`Request timed out: ${method} ${path6}`);
+        throw new Error(`Request timed out: ${method} ${path7}`);
       }
       throw err;
     } finally {
@@ -600,24 +791,28 @@ var ApiClient = class {
     }
     throw new Error(`API error (${response.status}): ${message}`);
   }
-  async get(path6, timeout) {
-    return this.request(path6, { timeout });
+  async get(path7, timeout) {
+    return this.request(path7, { timeout });
+  }
+  async post(path7, body, timeout) {
+    return this.request(path7, { method: "POST", body, timeout });
   }
-  async post(path6, body, timeout) {
-    return this.request(path6, { method: "POST", body, timeout });
+  async put(path7, body, timeout) {
+    return this.request(path7, { method: "PUT", body, timeout });
   }
-  async put(path6, body, timeout) {
-    return this.request(path6, { method: "PUT", body, timeout });
+  async patch(path7, body, timeout) {
+    return this.request(path7, { method: "PATCH", body, timeout });
   }
-  async delete(path6, timeout) {
-    return this.request(path6, { method: "DELETE", timeout });
+  async delete(path7, timeout) {
+    return this.request(path7, { method: "DELETE", timeout });
   }
-  async uploadFile(path6, fileBuffer, filename) {
+  async uploadFile(path7, fileBuffer, filename) {
     const boundary = `----spacelr${Date.now()}`;
     const parts = [];
+    const safeFilename = filename.replace(/[\r\n"]/g, "_");
     const header = Buffer.from(
       `--${boundary}\r
-Content-Disposition: form-data; name="file"; filename="${filename}"\r
+Content-Disposition: form-data; name="file"; filename="${safeFilename}"\r
 Content-Type: application/zip\r
 \r
 `
@@ -627,7 +822,7 @@ Content-Type: application/zip\r
 `);
     parts.push(header, fileBuffer, footer);
     const body = Buffer.concat(parts);
-    return this.request(path6, {
+    return this.request(path7, {
       method: "POST",
       body,
       headers: {
@@ -728,7 +923,7 @@ ${message}
     console.error(`  ${i + 1}) ${choice.label}`);
   });
   console.error();
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     rl.question("  Enter number: ", (answer) => {
       rl.close();
       const index = parseInt(answer, 10) - 1;
@@ -736,7 +931,7 @@ ${message}
         reject(new Error("Invalid selection"));
         return;
       }
-      resolve3(choices[index]);
+      resolve4(choices[index]);
     });
   });
 }
@@ -745,10 +940,10 @@ async function promptConfirm(message) {
     input: process.stdin,
     output: process.stderr
   });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(`${message} (y/N) `, (answer) => {
       rl.close();
-      resolve3(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+      resolve4(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
     });
   });
 }
@@ -758,10 +953,10 @@ async function promptInput(message, defaultValue) {
     output: process.stderr
   });
   const suffix = defaultValue ? ` (${defaultValue})` : "";
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(`${message}${suffix}: `, (answer) => {
       rl.close();
-      resolve3(answer.trim() || defaultValue || "");
+      resolve4(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -860,7 +1055,7 @@ function createInitCommand() {
       );
       const config = {
         projectId: selected.id,
-        apiUrl: apiUrl !== "https://api.spacelr.io" ? apiUrl : void 0,
+        apiUrl: apiUrl !== "https://api.spacelr.com/api/v1" ? apiUrl : void 0,
         hosting: {
           directory: hostingDir
         }
@@ -901,11 +1096,11 @@ async function createZipBuffer(directory) {
   if (!fs4.statSync(absDir).isDirectory()) {
     throw new Error(`Not a directory: ${absDir}`);
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const chunks = [];
     const archive = (0, import_archiver.default)("zip", { zlib: { level: 9 } });
     archive.on("data", (chunk) => chunks.push(chunk));
-    archive.on("end", () => resolve3(Buffer.concat(chunks)));
+    archive.on("end", () => resolve4(Buffer.concat(chunks)));
     archive.on("error", reject);
     archive.directory(absDir, false);
     archive.finalize();
@@ -1034,7 +1229,7 @@ async function pollDeploymentStatus(client, projectId, deploymentId, spin) {
   throw new Error("Deployment timed out after 10 minutes");
 }
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 
 // libs/cli/src/commands/db/index.ts
@@ -1267,8 +1462,266 @@ function createDbCommand() {
   return db;
 }
 
+// libs/cli/src/commands/functions.ts
+var path6 = __toESM(require("path"));
+var import_commander13 = require("commander");
+function createFunctionsCommand() {
+  const functions = new import_commander13.Command("functions").description("Manage serverless functions");
+  functions.command("deploy [directory]").description("Deploy a function").requiredOption("--name <name>", "Function name").option("--entry <file>", "Entry point (default: index.js)").option("--cron <expression>", "Cron schedule expression").option("--timezone <tz>", "Timezone for cron (default: UTC)").option("--timeout <ms>", "Execution timeout in ms").option("--memory <mb>", "Memory limit in MB").option("--env <KEY=VALUE...>", "Environment variables", collectEnvVars, {}).option("--project <id>", "Project ID").action(async (directory, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const deployDir = directory ?? ".";
+      const absDir = path6.resolve(deployDir);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const spin = spinner("Preparing deployment...");
+      const fileCount = countFiles(absDir);
+      verbose(`Found ${fileCount} files in ${absDir}`);
+      spin.text = "Creating archive...";
+      const zipBuffer = await createZipBuffer(absDir);
+      verbose(`Archive size: ${formatBytes(zipBuffer.length)}`);
+      spin.text = "Checking for existing function...";
+      const envVars = opts.env;
+      const existingFns = await client.get(`/projects/${projectId}/functions`);
+      const fnList = Array.isArray(existingFns) ? existingFns : existingFns.data || [];
+      const existing = fnList.find(
+        (f) => f.name === opts.name
+      );
+      let functionId;
+      const functionBody = {
+        entryPoint: opts.entry,
+        cronExpression: opts.cron,
+        cronTimezone: opts.timezone,
+        timeout: opts.timeout ? parseInt(opts.timeout, 10) : void 0,
+        memoryLimitMb: opts.memory ? parseInt(opts.memory, 10) : void 0,
+        environmentVariables: Object.keys(envVars).length > 0 ? envVars : void 0
+      };
+      if (existing) {
+        spin.text = "Updating function...";
+        await client.patch(
+          `/projects/${projectId}/functions/${existing.id}`,
+          functionBody
+        );
+        functionId = existing.id;
+      } else {
+        spin.text = "Creating function...";
+        const createResult = await client.post(
+          `/projects/${projectId}/functions`,
+          { name: opts.name, ...functionBody }
+        );
+        const createdId = createResult.id || createResult.data?.id;
+        if (!createdId) {
+          throw new Error("Failed to create function");
+        }
+        functionId = createdId;
+      }
+      spin.text = "Uploading code...";
+      await client.uploadFile(
+        `/projects/${projectId}/functions/${functionId}/deploy`,
+        zipBuffer,
+        "code.zip"
+      );
+      spin.succeed(
+        `Function "${opts.name}" deployed (${formatBytes(zipBuffer.length)}, ${fileCount} files)`
+      );
+      if (opts.cron) {
+        info(`Cron schedule: ${opts.cron}`);
+      }
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Deploy failed");
+      process.exitCode = 1;
+    }
+  });
+  functions.command("list").description("List functions").option("--project <id>", "Project ID").action(async (opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const result = await client.get(
+        `/projects/${projectId}/functions`
+      );
+      const fns = Array.isArray(result) ? result : result.data || [];
+      if (isJsonMode()) {
+        json(fns);
+        return;
+      }
+      if (fns.length === 0) {
+        info("No functions found");
+        return;
+      }
+      for (const fn of fns) {
+        const status = fn.enabled ? "enabled" : "disabled";
+        const cron = fn.cronExpression ? ` [${fn.cronExpression}]` : "";
+        info(`${fn.name} (${fn.id}) - ${status}${cron}`);
+      }
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Failed to list functions");
+      process.exitCode = 1;
+    }
+  });
+  functions.command("delete <name>").description("Delete a function").option("--project <id>", "Project ID").action(async (name, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const fn = await findFunctionByName(client, projectId, name);
+      await client.delete(
+        `/projects/${projectId}/functions/${fn.id}`
+      );
+      info(`Function "${name}" deleted`);
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Failed to delete function");
+      process.exitCode = 1;
+    }
+  });
+  functions.command("trigger <name>").description("Trigger a function execution").option("--project <id>", "Project ID").action(async (name, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const fn = await findFunctionByName(client, projectId, name);
+      const spin = spinner("Triggering function...");
+      await client.post(
+        `/projects/${projectId}/functions/${fn.id}/trigger`
+      );
+      spin.succeed(`Function "${name}" triggered`);
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Failed to trigger function");
+      process.exitCode = 1;
+    }
+  });
+  functions.command("logs <name>").description("View function execution logs").option("--limit <n>", "Number of executions to show", "10").option("--project <id>", "Project ID").action(async (name, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const fn = await findFunctionByName(client, projectId, name);
+      const limit = parseInt(opts.limit, 10);
+      const result = await client.get(
+        `/projects/${projectId}/functions/${fn.id}/executions?limit=${limit}`
+      );
+      const executions = result.items || result.data?.items || [];
+      if (isJsonMode()) {
+        json(executions);
+        return;
+      }
+      if (executions.length === 0) {
+        info("No executions found");
+        return;
+      }
+      for (const exec of executions) {
+        const date = new Date(exec.startedAt).toLocaleString();
+        const duration = exec.duration ? `${exec.duration}ms` : "-";
+        info(
+          `[${exec.status}] ${date} (${duration}) - ${exec.triggeredBy}${exec.error ? ` - ${exec.error}` : ""}`
+        );
+        if (exec.logs && exec.logs.length > 0) {
+          for (const log of exec.logs) {
+            const logTime = new Date(log.timestamp).toLocaleTimeString();
+            info(`  ${logTime} [${log.level}] ${log.message}`);
+          }
+        }
+      }
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Failed to get logs");
+      process.exitCode = 1;
+    }
+  });
+  const envCmd = functions.command("env").description("Manage function environment variables");
+  envCmd.command("set <name> <keyValue>").description("Set an environment variable (KEY=VALUE)").option("--project <id>", "Project ID").action(async (name, keyValue, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const eqIndex = keyValue.indexOf("=");
+      if (eqIndex === -1) {
+        throw new Error("Format must be KEY=VALUE");
+      }
+      const key = keyValue.substring(0, eqIndex);
+      const value = keyValue.substring(eqIndex + 1);
+      const fn = await findFunctionByName(client, projectId, name);
+      const currentVars = fn.environmentVariables || {};
+      const updatedVars = { ...currentVars, [key]: value };
+      await client.patch(
+        `/projects/${projectId}/functions/${fn.id}`,
+        { environmentVariables: updatedVars }
+      );
+      info(`Set ${key} for function "${name}"`);
+    } catch (err) {
+      error(err instanceof Error ? err.message : "Failed to set env var");
+      process.exitCode = 1;
+    }
+  });
+  envCmd.command("list <name>").description("List environment variables for a function").option("--project <id>", "Project ID").action(async (name, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    const config = loadConfig();
+    const apiUrl = resolveApiUrl(globalOpts.apiUrl, config);
+    try {
+      const token = await requireAuth(globalOpts.token);
+      const projectId = resolveProjectId(opts.project, config);
+      const client = new ApiClient({ apiUrl, token, projectId });
+      const fn = await findFunctionByName(client, projectId, name);
+      const vars = fn.environmentVariables || {};
+      const keys = Object.keys(vars);
+      if (isJsonMode()) {
+        json(vars);
+        return;
+      }
+      if (keys.length === 0) {
+        info("No environment variables set");
+        return;
+      }
+      for (const key of keys) {
+        info(`${key}=${vars[key]}`);
+      }
+    } catch (err) {
+      error(
+        err instanceof Error ? err.message : "Failed to list env vars"
+      );
+      process.exitCode = 1;
+    }
+  });
+  return functions;
+}
+async function findFunctionByName(client, projectId, name) {
+  const result = await client.get(
+    `/projects/${projectId}/functions`
+  );
+  const fnList = Array.isArray(result) ? result : result.data || [];
+  const fn = fnList.find((f) => f.name === name);
+  if (!fn) {
+    throw new Error(`Function "${name}" not found`);
+  }
+  return fn;
+}
+function collectEnvVars(value, previous) {
+  const eqIndex = value.indexOf("=");
+  if (eqIndex === -1) return previous;
+  const key = value.substring(0, eqIndex);
+  const val = value.substring(eqIndex + 1);
+  return { ...previous, [key]: val };
+}
+
 // libs/cli/src/index.ts
-var program = new import_commander13.Command();
+var program = new import_commander14.Command();
 program.name("spacelr").description("CLI tool for the Spacelr platform").version("0.1.0").option("--api-url <url>", "Override API URL").option("--token <token>", "Explicit auth token (CI mode)").option("--json", "Output as JSON").option("--verbose", "Verbose logging").hook("preAction", (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
   setOutputMode({
@@ -1284,5 +1737,6 @@ program.addCommand(createUseCommand());
 program.addCommand(createInitCommand());
 program.addCommand(createDeployCommand());
 program.addCommand(createDbCommand());
+program.addCommand(createFunctionsCommand());
 program.parse();
 //# sourceMappingURL=index.js.map