@syncular/cli 0.0.0-108 → 0.0.0-113

package/src/commands/demo.ts

@@ -1,1151 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { getBuildpackById } from '../buildpacks';
-import { parseBearerToken, resolveControlPlaneBase } from '../control-plane';
-import { resolveControlPlaneToken } from '../control-plane-token';
-import {
-  optionalBooleanFlag,
-  optionalEnumFlag,
-  optionalFlag,
-  optionalIntegerFlag,
-} from '../flags';
-import { printError, printInfo } from '../output';
-import { resolveDefaultSyncularConfigPath, resolveRepoRoot } from '../paths';
-import { resolveEffectiveTargetId } from '../targets';
-
-interface RuntimeResponse {
-  runtime?: {
-    workerName?: string;
-    hostname?: string;
-    baseUrl?: string;
-    syncUrl?: string;
-    consoleToken?: string;
-    databaseProvider?: 'sqlite' | 'neon' | 'postgres';
-  };
-  error?: string;
-  message?: string;
-}
-
-interface RuntimeInfo {
-  workerName: string;
-  hostname: string;
-  baseUrl: string;
-  syncUrl: string;
-  consoleToken: string | null;
-  databaseProvider: 'sqlite' | 'neon' | 'postgres';
-}
-
-interface DeploymentResponse {
-  deployment?: {
-    id?: string;
-    scriptName?: string;
-    status?: string;
-    createdAt?: string;
-    artifactHash?: string | null;
-    rollbackOfDeploymentId?: string | null;
-  };
-  error?: string;
-  message?: string;
-}
-
-interface DeploymentsResponse {
-  deployments?: Array<{
-    id?: string;
-    scriptName?: string;
-    source?: string;
-    status?: string;
-    createdAt?: string;
-    artifactHash?: string | null;
-    rollbackOfDeploymentId?: string | null;
-  }>;
-  error?: string;
-  message?: string;
-}
-
-interface DeployArtifactResponse {
-  artifact?: {
-    id?: string;
-    scriptName?: string;
-    artifactHash?: string;
-    source?: string;
-    byteSize?: number;
-    createdAt?: string;
-  };
-  error?: string;
-  message?: string;
-}
-
-interface DeployJobResponse {
-  job?: {
-    id?: string;
-    artifactId?: string;
-    deploymentId?: string | null;
-    scriptName?: string;
-    status?:
-      | 'queued'
-      | 'preparing'
-      | 'deploying'
-      | 'verifying'
-      | 'activating'
-      | 'completed'
-      | 'failed';
-    errorText?: string | null;
-    createdAt?: string;
-    updatedAt?: string;
-    completedAt?: string | null;
-  };
-  error?: string;
-  message?: string;
-}
-
-type SpaceDbProvider = 'sqlite' | 'neon' | 'postgres';
-type SpaceRegion = 'auto' | 'enam' | 'wnam' | 'weur' | 'eeur' | 'apac' | 'oc';
-
-interface CreateSpaceResponse {
-  space?: {
-    id?: string;
-    name?: string;
-  };
-  provisionJob?: {
-    id?: string;
-    status?: string;
-  };
-  runtime?: {
-    workerName?: string;
-    hostname?: string;
-    baseUrl?: string;
-    syncUrl?: string;
-    consoleUrl?: string;
-    consoleServerUrl?: string;
-    consoleToken?: string;
-    publishableKey?: string;
-    databaseProvider?: SpaceDbProvider;
-    databaseName?: string;
-    region?: string | null;
-  };
-  error?: string;
-  message?: string;
-}
-
-const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
-const CLI_SOURCE_LABEL = 'syncular-cli';
-const CONTRACT_WORKER_BUILDPACK_ID = 'contract-worker';
-const DEFAULT_VERIFY_CORS_ORIGIN = 'http://127.0.0.1:4320';
-const SPACE_DB_PROVIDERS = ['sqlite', 'neon', 'postgres'] as const;
-const SPACE_REGIONS = [
-  'auto',
-  'enam',
-  'wnam',
-  'weur',
-  'eeur',
-  'apac',
-  'oc',
-] as const;
-
-const contractWorkerBuildpack = (() => {
-  const buildpack = getBuildpackById(CONTRACT_WORKER_BUILDPACK_ID);
-  if (!buildpack) {
-    throw new Error(
-      `Required buildpack "${CONTRACT_WORKER_BUILDPACK_ID}" is not registered.`
-    );
-  }
-  return buildpack;
-})();
-
-function logStep(message: string): void {
-  printInfo(`[${CLI_SOURCE_LABEL}] ${message}`);
-}
-
-async function fetchWithTimeout(
-  url: string,
-  init?: RequestInit,
-  timeoutMs = DEFAULT_FETCH_TIMEOUT_MS
-): Promise<Response> {
-  try {
-    return await fetch(url, {
-      ...init,
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-  } catch (error: unknown) {
-    if (error instanceof Error && error.name === 'TimeoutError') {
-      throw new Error(`Request timed out after ${timeoutMs}ms: ${url}`);
-    }
-    throw error;
-  }
-}
-
-function requiredFlag(
-  flagValues: Map<string, string>,
-  flag: string,
-  envName?: string
-): string {
-  const value =
-    flagValues.get(flag)?.trim() ||
-    (envName ? process.env[envName]?.trim() : null);
-  if (!value) {
-    throw new Error(
-      `Missing required ${flag}${envName ? ` (or ${envName})` : ''}`
-    );
-  }
-  return value;
-}
-
-async function resolveControlTokenForCommand(args: {
-  flagValues: Map<string, string>;
-  controlPlaneBase: string;
-}): Promise<string> {
-  return (
-    (await resolveControlPlaneToken({
-      flagValues: args.flagValues,
-      controlPlaneBase: args.controlPlaneBase,
-      includeStdinToken: false,
-      includeStoredToken: true,
-    })) || ''
-  );
-}
-
-function buildControlPlaneHeaders(args: {
-  actorId: string;
-  controlToken: string;
-}): Record<string, string> {
-  const token = parseBearerToken(args.controlToken);
-  if (token.length > 0) {
-    return {
-      Authorization: `Bearer ${token}`,
-      'Content-Type': 'application/json',
-    };
-  }
-  return {
-    'x-user-id': args.actorId,
-    'Content-Type': 'application/json',
-  };
-}
-
-function resolveDefaultSpaceContractPath(): string {
-  return resolveDefaultSyncularConfigPath(process.cwd());
-}
-
-function resolveSyncularVersion(): string {
-  try {
-    const repoRoot = resolveRepoRoot();
-    const syncularPackageJsonPath = resolve(
-      repoRoot,
-      '..',
-      'syncular',
-      'package.json'
-    );
-    const parsed = JSON.parse(
-      readFileSync(syncularPackageJsonPath, 'utf8')
-    ) as {
-      version?: string;
-    };
-    if (typeof parsed.version === 'string' && parsed.version.length > 0) {
-      return parsed.version;
-    }
-  } catch {
-    // ignored - fallback below
-  }
-  return 'unknown';
-}
-
-function resolveSyncularCliVersion(): string {
-  const explicitVersion =
-    process.env.SYNCULAR_CLI_NPM_VERSION?.trim() ||
-    process.env.npm_package_version?.trim() ||
-    '';
-  return explicitVersion.length > 0 ? explicitVersion : '0.0.0';
-}
-
-function resolveGitCommit(): string {
-  try {
-    const repoRoot = resolveRepoRoot();
-    return execFileSync('git', ['rev-parse', 'HEAD'], {
-      cwd: repoRoot,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-  } catch {
-    return 'unknown';
-  }
-}
-
-function buildImmutableScriptName(spaceId: string): string {
-  const suffix = `${Date.now().toString(36)}-${randomUUID().slice(0, 6)}`;
-  return `space-${spaceId}-${suffix}`;
-}
-
-async function waitForSuccessfulFetch(args: {
-  url: string;
-  init?: RequestInit;
-  label: string;
-  attempts?: number;
-  delayMs?: number;
-  timeoutMs?: number;
-}): Promise<Response> {
-  const attempts = args.attempts ?? 12;
-  const delayMs = args.delayMs ?? 1000;
-  const timeoutMs = args.timeoutMs ?? 8_000;
-
-  let lastResponse: Response | null = null;
-  let lastError: Error | null = null;
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    try {
-      const response = await fetchWithTimeout(args.url, args.init, timeoutMs);
-      lastResponse = response;
-      if (response.ok) {
-        return response;
-      }
-    } catch (error: unknown) {
-      lastError =
-        error instanceof Error ? error : new Error('Unknown request error');
-    }
-
-    if (attempt < attempts) {
-      const reason = lastResponse
-        ? `${lastResponse.status} ${lastResponse.statusText}`
-        : (lastError?.message ?? 'unknown error');
-      logStep(
-        `${args.label} attempt ${attempt}/${attempts} failed (${reason}), retrying in ${delayMs}ms`
-      );
-      await Bun.sleep(delayMs);
-    }
-  }
-
-  throw new Error(
-    `${args.label} failed (${lastResponse ? `${lastResponse.status} ${lastResponse.statusText}` : (lastError?.message ?? 'unknown error')})`
-  );
-}
-
-function hasCaseInsensitiveToken(value: string | null, token: string): boolean {
-  if (!value) {
-    return false;
-  }
-  const normalizedToken = token.trim().toLowerCase();
-  return value
-    .split(',')
-    .map((entry) => entry.trim().toLowerCase())
-    .includes(normalizedToken);
-}
-
-async function verifyRuntimeSyncCorsPreflight(args: {
-  baseUrl: string;
-  origin: string;
-}): Promise<void> {
-  const targetUrl = `${args.baseUrl.replace(/\/$/, '')}/api/sync`;
-  const response = await fetchWithTimeout(
-    targetUrl,
-    {
-      method: 'OPTIONS',
-      headers: {
-        Origin: args.origin,
-        'Access-Control-Request-Method': 'POST',
-        'Access-Control-Request-Headers':
-          'authorization,content-type,x-syncular-publishable-key',
-      },
-    },
-    10_000
-  );
-
-  if (!response.ok) {
-    let details = `${response.status} ${response.statusText}`;
-    try {
-      const payload = (await response.clone().json()) as {
-        error?: string;
-        message?: string;
-      };
-      details = payload.message || payload.error || details;
-    } catch {
-      // ignored
-    }
-    throw new Error(
-      `Runtime CORS preflight failed for ${args.origin}: ${details}`
-    );
-  }
-
-  const allowOrigin = response.headers.get('access-control-allow-origin');
-  if (allowOrigin !== '*' && allowOrigin !== args.origin) {
-    throw new Error(
-      `Runtime CORS origin mismatch for ${args.origin}. Received Access-Control-Allow-Origin=${allowOrigin ?? 'null'}.`
-    );
-  }
-
-  if (
-    !hasCaseInsensitiveToken(
-      response.headers.get('access-control-allow-methods'),
-      'POST'
-    )
-  ) {
-    throw new Error('Runtime CORS preflight missing POST in allow-methods.');
-  }
-
-  const requiredHeaders = [
-    'authorization',
-    'content-type',
-    'x-syncular-publishable-key',
-  ];
-  for (const requiredHeader of requiredHeaders) {
-    if (
-      !hasCaseInsensitiveToken(
-        response.headers.get('access-control-allow-headers'),
-        requiredHeader
-      )
-    ) {
-      throw new Error(
-        `Runtime CORS preflight missing ${requiredHeader} in allow-headers.`
-      );
-    }
-  }
-}
-
-async function getSpaceRuntime(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-}): Promise<RuntimeInfo> {
-  const response = await fetchWithTimeout(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/runtime`,
-    {
-      method: 'GET',
-      headers: buildControlPlaneHeaders(args),
-    },
-    10_000
-  );
-
-  const payload = (await response.json()) as RuntimeResponse;
-  if (
-    !response.ok ||
-    !payload.runtime?.workerName ||
-    !payload.runtime.baseUrl
-  ) {
-    throw new Error(
-      `Failed to load runtime for ${args.spaceId} (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  const runtime = payload.runtime;
-  const workerName = runtime?.workerName;
-  const baseUrl = runtime?.baseUrl;
-  const hostname = runtime?.hostname;
-  const syncUrl = runtime?.syncUrl;
-  const consoleToken = runtime?.consoleToken?.trim() || null;
-  const databaseProvider =
-    runtime?.databaseProvider === 'neon' ||
-    runtime?.databaseProvider === 'postgres'
-      ? runtime.databaseProvider
-      : 'sqlite';
-
-  if (!workerName || !baseUrl || !hostname || !syncUrl) {
-    throw new Error(
-      `Runtime response for ${args.spaceId} is incomplete: ${JSON.stringify(payload)}`
-    );
-  }
-
-  return {
-    workerName,
-    hostname,
-    baseUrl,
-    syncUrl,
-    consoleToken,
-    databaseProvider,
-  };
-}
-
-async function createDeployArtifactRecord(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  scriptName: string;
-  artifactHash: string;
-  source: string;
-  sourceLabel: string;
-  manifest: Record<string, unknown>;
-}): Promise<string> {
-  const response = await fetchWithTimeout(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/deploy-artifacts`,
-    {
-      method: 'POST',
-      headers: buildControlPlaneHeaders(args),
-      body: JSON.stringify({
-        scriptName: args.scriptName,
-        artifactHash: args.artifactHash,
-        source: args.source,
-        sourceLabel: args.sourceLabel,
-        manifest: args.manifest,
-      }),
-    },
-    30_000
-  );
-
-  const payload = (await response.json()) as DeployArtifactResponse;
-  if (!response.ok || !payload.artifact?.id) {
-    throw new Error(
-      `Failed to create deploy artifact (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  return payload.artifact.id;
-}
-
-async function createDeployJobRecord(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  artifactId: string;
-  scriptName: string;
-}): Promise<NonNullable<DeployJobResponse['job']>> {
-  const response = await fetchWithTimeout(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/deploy-jobs`,
-    {
-      method: 'POST',
-      headers: buildControlPlaneHeaders(args),
-      body: JSON.stringify({
-        artifactId: args.artifactId,
-        scriptName: args.scriptName,
-      }),
-    },
-    20_000
-  );
-
-  const payload = (await response.json()) as DeployJobResponse;
-  if (!response.ok || !payload.job?.id) {
-    throw new Error(
-      `Failed to create deploy job (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  return payload.job;
-}
-
-async function getDeployJob(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  jobId: string;
-}): Promise<NonNullable<DeployJobResponse['job']>> {
-  const response = await fetchWithTimeout(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/deploy-jobs/${args.jobId}`,
-    {
-      method: 'GET',
-      headers: buildControlPlaneHeaders(args),
-    },
-    10_000
-  );
-
-  const payload = (await response.json()) as DeployJobResponse;
-  if (!response.ok || !payload.job?.id) {
-    throw new Error(
-      `Failed to load deploy job ${args.jobId} (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  return payload.job;
-}
-
-async function waitForDeployJob(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  jobId: string;
-  timeoutMs?: number;
-  pollMs?: number;
-}): Promise<NonNullable<DeployJobResponse['job']>> {
-  const timeoutMs = args.timeoutMs ?? 180_000;
-  const pollMs = args.pollMs ?? 1_000;
-  const startedAt = Date.now();
-
-  let lastStatus: string | undefined;
-  while (Date.now() - startedAt < timeoutMs) {
-    const job = await getDeployJob(args);
-    if (job.status && job.status !== lastStatus) {
-      logStep(`Deploy job ${job.id} -> ${job.status}`);
-      lastStatus = job.status;
-    }
-
-    if (job.status === 'completed' || job.status === 'failed') {
-      return job;
-    }
-
-    await Bun.sleep(pollMs);
-  }
-
-  throw new Error(`Timed out waiting for deploy job ${args.jobId}.`);
-}
-
-async function listDeploymentRecords(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  limit: number;
-}): Promise<DeploymentsResponse> {
-  const url = new URL(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/deployments`
-  );
-  url.searchParams.set('limit', String(args.limit));
-
-  const response = await fetchWithTimeout(
-    url.toString(),
-    {
-      method: 'GET',
-      headers: buildControlPlaneHeaders(args),
-    },
-    10_000
-  );
-
-  const payload = (await response.json()) as DeploymentsResponse;
-  if (!response.ok) {
-    throw new Error(
-      `Failed to list deployment records (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  return payload;
-}
-
-async function rollbackDeploymentRecord(args: {
-  controlPlaneBase: string;
-  actorId: string;
-  controlToken: string;
-  spaceId: string;
-  deploymentId: string;
-  reason?: string;
-}): Promise<DeploymentResponse['deployment']> {
-  const response = await fetchWithTimeout(
-    `${args.controlPlaneBase.replace(/\/$/, '')}/spaces/${args.spaceId}/deployments/${args.deploymentId}/rollback`,
-    {
-      method: 'POST',
-      headers: buildControlPlaneHeaders(args),
-      body: JSON.stringify(args.reason ? { reason: args.reason } : {}),
-    },
-    20_000
-  );
-
-  const payload = (await response.json()) as DeploymentResponse;
-  if (!response.ok) {
-    throw new Error(
-      `Failed to rollback deployment (${response.status}): ${JSON.stringify(payload)}`
-    );
-  }
-
-  return payload.deployment;
-}
-
-function redactConsoleUrl(url: string): string {
-  try {
-    const parsed = new URL(url);
-    if (parsed.searchParams.has('token')) {
-      parsed.searchParams.set('token', 'REDACTED');
-    }
-    return parsed.toString();
-  } catch {
-    return url.replace(/([?&]token=)[^&]+/gi, '$1REDACTED');
-  }
-}
-
-function redactCreateSpaceValue(value: unknown): unknown {
-  if (Array.isArray(value)) {
-    return value.map((entry) => redactCreateSpaceValue(entry));
-  }
-
-  if (value && typeof value === 'object') {
-    const redacted: Record<string, unknown> = {};
-    for (const [key, nestedValue] of Object.entries(value)) {
-      if (key === 'consoleToken') {
-        continue;
-      }
-      if (key === 'consoleUrl' && typeof nestedValue === 'string') {
-        redacted[key] = redactConsoleUrl(nestedValue);
-        continue;
-      }
-      redacted[key] = redactCreateSpaceValue(nestedValue);
-    }
-    return redacted;
-  }
-
-  return value;
-}
-
-function redactCreateSpaceResponse(payload: CreateSpaceResponse): unknown {
-  return redactCreateSpaceValue(payload);
-}
-
-async function parseCreateSpaceResponse(
-  response: Response
-): Promise<CreateSpaceResponse | null> {
-  try {
-    return (await response.json()) as CreateSpaceResponse;
-  } catch {
-    return null;
-  }
-}
-
-export async function runCreateSpace(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    const name = requiredFlag(flagValues, '--name');
-    const databaseProvider = optionalEnumFlag(
-      flagValues,
-      '--database-provider',
-      SPACE_DB_PROVIDERS,
-      'sqlite'
-    );
-    const region = optionalEnumFlag(
-      flagValues,
-      '--region',
-      SPACE_REGIONS,
-      'auto'
-    );
-    const connectionString = flagValues.get('--connection-string')?.trim();
-    if (
-      (databaseProvider === 'neon' || databaseProvider === 'postgres') &&
-      !connectionString
-    ) {
-      throw new Error(
-        '--connection-string is required when --database-provider is neon or postgres.'
-      );
-    }
-
-    const controlPlaneBase = resolveControlPlaneBase(flagValues);
-    const actorId = optionalFlag(
-      flagValues,
-      '--actor-id',
-      process.env.SPACES_TEST_ACTOR_ID?.trim() || CLI_SOURCE_LABEL
-    );
-    const controlToken = await resolveControlTokenForCommand({
-      flagValues,
-      controlPlaneBase,
-    });
-    const jsonOutput = optionalBooleanFlag(flagValues, '--json', false);
-
-    const requestBody: {
-      name: string;
-      databaseProvider: SpaceDbProvider;
-      region: SpaceRegion;
-      connectionString?: string;
-    } = {
-      name,
-      databaseProvider,
-      region,
-    };
-    if (connectionString && connectionString.length > 0) {
-      requestBody.connectionString = connectionString;
-    }
-
-    const response = await fetchWithTimeout(
-      `${controlPlaneBase.replace(/\/$/, '')}/spaces`,
-      {
-        method: 'POST',
-        headers: buildControlPlaneHeaders({
-          actorId,
-          controlToken,
-        }),
-        body: JSON.stringify(requestBody),
-      },
-      30_000
-    );
-
-    const payload = await parseCreateSpaceResponse(response);
-    if (!response.ok) {
-      throw new Error(
-        `Failed to create space (${response.status}): ${payload?.message || payload?.error || response.statusText || 'unknown error'}`
-      );
-    }
-
-    const spaceId = payload?.space?.id;
-    const runtimeBaseUrl = payload?.runtime?.baseUrl;
-    const runtimeSyncUrl = payload?.runtime?.syncUrl;
-    if (!spaceId || !runtimeBaseUrl || !runtimeSyncUrl) {
-      throw new Error(
-        `Create-space response is incomplete: ${JSON.stringify(payload)}`
-      );
-    }
-
-    if (jsonOutput) {
-      console.log(JSON.stringify(redactCreateSpaceResponse(payload), null, 2));
-      return 0;
-    }
-
-    console.log('Space created successfully.');
-    console.log(`Space: ${spaceId}`);
-    console.log(`Name: ${payload.space?.name ?? name}`);
-    console.log(`Runtime URL: ${runtimeBaseUrl}`);
-    console.log(`Sync URL: ${runtimeSyncUrl}`);
-    if (payload.runtime?.consoleUrl) {
-      console.log(
-        `Console URL: ${redactConsoleUrl(payload.runtime.consoleUrl)}`
-      );
-    }
-    console.log(
-      `Database provider: ${payload.runtime?.databaseProvider ?? databaseProvider}`
-    );
-    if (payload.runtime?.region) {
-      console.log(`Region: ${payload.runtime.region}`);
-    }
-    if (payload.provisionJob?.id) {
-      console.log(`Provision job: ${payload.provisionJob.id}`);
-    }
-    return 0;
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error
-        ? error.message
-        : 'Create-space failed unexpectedly.'
-    );
-    return 1;
-  }
-}
-
-async function runDeployImmutable(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    const spaceId = requiredFlag(flagValues, '--space');
-    const controlPlaneBase = resolveControlPlaneBase(flagValues);
-    const actorId = optionalFlag(
-      flagValues,
-      '--actor-id',
-      process.env.SPACES_TEST_ACTOR_ID?.trim() || CLI_SOURCE_LABEL
-    );
-    const controlToken = await resolveControlTokenForCommand({
-      flagValues,
-      controlPlaneBase,
-    });
-    const sourceLabel = optionalFlag(flagValues, '--source', CLI_SOURCE_LABEL);
-    const dryRun = optionalBooleanFlag(flagValues, '--dry-run', false);
-    const explicitEntry = flagValues.get('--entry')?.trim() || null;
-    const configPath = optionalFlag(
-      flagValues,
-      '--config',
-      resolveDefaultSpaceContractPath()
-    );
-    if (!explicitEntry && !existsSync(configPath)) {
-      throw new Error(
-        `Syncular config not found: ${configPath}. Provide --config or --entry.`
-      );
-    }
-
-    const scriptName = optionalFlag(
-      flagValues,
-      '--script-name',
-      buildImmutableScriptName(spaceId)
-    );
-
-    let runtime: RuntimeInfo | null = null;
-    if (!dryRun) {
-      logStep(`Loading runtime for space ${spaceId}`);
-      runtime = await getSpaceRuntime({
-        controlPlaneBase,
-        actorId,
-        controlToken,
-        spaceId,
-      });
-    }
-
-    const bundleLabel = explicitEntry
-      ? `entry ${explicitEntry}`
-      : `config ${configPath}`;
-    logStep(`Bundling space contract module from ${bundleLabel}`);
-    const migrationMetadata = await contractWorkerBuildpack.inspect({
-      configPath,
-      explicitEntry,
-    });
-    const deploymentMetadata = {
-      deployedAt: new Date().toISOString(),
-      syncularVersion: resolveSyncularVersion(),
-      syncularCliVersion: resolveSyncularCliVersion(),
-      gitCommit: resolveGitCommit(),
-      spaceId,
-      workerName: scriptName,
-      source: sourceLabel,
-      schemaVersion: migrationMetadata.schemaVersion,
-      migrationDigest: migrationMetadata.migrationDigest,
-      migrations: {
-        schemaVersion: migrationMetadata.schemaVersion,
-        migrationDigest: migrationMetadata.migrationDigest,
-        count: migrationMetadata.migrationCount,
-      },
-      ...(explicitEntry ? { entry: explicitEntry } : { configPath }),
-    };
-    const { source, artifactHash } = await contractWorkerBuildpack.build({
-      configPath,
-      explicitEntry,
-      commentTag: 'syncular-spaces-deploy',
-      metadata: deploymentMetadata,
-    });
-
-    if (dryRun) {
-      logStep('Dry run complete (no Cloudflare deployment performed)');
-      console.log(`Space: ${spaceId}`);
-      console.log(`Worker: ${scriptName}`);
-      if (explicitEntry) {
-        console.log(`Entry: ${explicitEntry}`);
-      } else {
-        console.log(`Config: ${configPath}`);
-      }
-      console.log(`Artifact hash: ${artifactHash}`);
-      console.log(`Deploy metadata: ${JSON.stringify(deploymentMetadata)}`);
-      return 0;
-    }
-    logStep('Uploading artifact to control-plane');
-    const artifactId = await createDeployArtifactRecord({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-      scriptName,
-      artifactHash,
-      source,
-      sourceLabel,
-      manifest: deploymentMetadata,
-    });
-
-    logStep('Creating deploy job in control-plane');
-    const job = await createDeployJobRecord({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-      artifactId,
-      scriptName,
-    });
-
-    const completedJob = await waitForDeployJob({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-      jobId: job.id!,
-    });
-    if (completedJob.status !== 'completed') {
-      throw new Error(
-        `Deploy job ${completedJob.id} failed: ${completedJob.errorText ?? 'unknown error'}`
-      );
-    }
-    const deploymentId = completedJob.deploymentId ?? null;
-
-    logStep('Validating health after activation');
-    await waitForSuccessfulFetch({
-      url: `${runtime!.baseUrl.replace(/\/$/, '')}/api/health`,
-      label: 'Post-activation health check',
-    });
-
-    console.log('Runtime deployed successfully.');
-    console.log(`Space: ${spaceId}`);
-    console.log(`Worker: ${scriptName}`);
-    console.log(`Base URL: ${runtime!.baseUrl}`);
-    console.log(`Sync URL: ${runtime!.syncUrl}`);
-    console.log(`Artifact hash: ${artifactHash}`);
-    if (deploymentId) {
-      console.log(`Deployment record: ${deploymentId}`);
-    }
-    console.log(`Deploy metadata: ${JSON.stringify(deploymentMetadata)}`);
-    return 0;
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error ? error.message : 'Runtime deploy failed.'
-    );
-    return 1;
-  }
-}
-
-export async function runDeploy(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    await resolveEffectiveTargetId({
-      cwd: process.cwd(),
-      explicitTargetId: flagValues.get('--target')?.trim() || null,
-    });
-    return runDeployImmutable(flagValues);
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error ? error.message : 'Runtime deploy failed.'
-    );
-    return 1;
-  }
-}
-
-async function runDeploymentsList(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    const spaceId = requiredFlag(flagValues, '--space');
-    const controlPlaneBase = resolveControlPlaneBase(flagValues);
-    const actorId = optionalFlag(
-      flagValues,
-      '--actor-id',
-      process.env.SPACES_TEST_ACTOR_ID?.trim() || CLI_SOURCE_LABEL
-    );
-    const controlToken = await resolveControlTokenForCommand({
-      flagValues,
-      controlPlaneBase,
-    });
-    const limit = optionalIntegerFlag(flagValues, '--limit', 20);
-
-    const payload = await listDeploymentRecords({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-      limit,
-    });
-    const deployments = payload.deployments ?? [];
-
-    if (deployments.length === 0) {
-      console.log(`No deployments found for space ${spaceId}.`);
-      return 0;
-    }
-
-    console.log(`Deployments for ${spaceId}:`);
-    for (const deployment of deployments) {
-      const id = deployment.id ?? '<unknown>';
-      const status = deployment.status ?? 'unknown';
-      const scriptName = deployment.scriptName ?? '<unknown-script>';
-      const source = deployment.source ?? 'unknown';
-      const createdAt = deployment.createdAt ?? 'unknown-time';
-      const artifactHash = deployment.artifactHash ?? '-';
-      const rollbackOf = deployment.rollbackOfDeploymentId ?? '-';
-      console.log(
-        `${id} | ${status} | ${scriptName} | source=${source} | created=${createdAt} | hash=${artifactHash} | rollbackOf=${rollbackOf}`
-      );
-    }
-    return 0;
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error
-        ? error.message
-        : 'Failed to list deployments unexpectedly.'
-    );
-    return 1;
-  }
-}
-
-export async function runDeployments(
-  flagValues: Map<string, string>
-): Promise<number> {
-  return runDeploymentsList(flagValues);
-}
-
-export async function runRollback(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    const spaceId = requiredFlag(flagValues, '--space');
-    const deploymentId = requiredFlag(flagValues, '--to');
-    const controlPlaneBase = resolveControlPlaneBase(flagValues);
-    const actorId = optionalFlag(
-      flagValues,
-      '--actor-id',
-      process.env.SPACES_TEST_ACTOR_ID?.trim() || CLI_SOURCE_LABEL
-    );
-    const controlToken = await resolveControlTokenForCommand({
-      flagValues,
-      controlPlaneBase,
-    });
-    const reason = flagValues.get('--reason')?.trim();
-
-    const rollbackDeployment = await rollbackDeploymentRecord({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-      deploymentId,
-      reason: reason && reason.length > 0 ? reason : undefined,
-    });
-
-    console.log('Rollback completed.');
-    console.log(`Space: ${spaceId}`);
-    console.log(`Target deployment: ${deploymentId}`);
-    if (rollbackDeployment?.id) {
-      console.log(`New deployment: ${rollbackDeployment.id}`);
-    }
-    if (rollbackDeployment?.scriptName) {
-      console.log(`Script: ${rollbackDeployment.scriptName}`);
-    }
-    if (rollbackDeployment?.status) {
-      console.log(`Status: ${rollbackDeployment.status}`);
-    }
-    return 0;
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error ? error.message : 'Rollback failed unexpectedly.'
-    );
-    return 1;
-  }
-}
-
-async function runVerifySpaces(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    const spaceId = requiredFlag(flagValues, '--space');
-    const controlPlaneBase = resolveControlPlaneBase(flagValues);
-    const actorId = optionalFlag(
-      flagValues,
-      '--actor-id',
-      process.env.SPACES_TEST_ACTOR_ID?.trim() || CLI_SOURCE_LABEL
-    );
-    const controlToken = await resolveControlTokenForCommand({
-      flagValues,
-      controlPlaneBase,
-    });
-    const runtime = await getSpaceRuntime({
-      controlPlaneBase,
-      actorId,
-      controlToken,
-      spaceId,
-    });
-    const baseUrl = optionalFlag(flagValues, '--base-url', runtime.baseUrl);
-    const corsOrigin = optionalFlag(
-      flagValues,
-      '--origin',
-      DEFAULT_VERIFY_CORS_ORIGIN
-    );
-
-    await waitForSuccessfulFetch({
-      url: `${baseUrl.replace(/\/$/, '')}/api/health`,
-      label: 'Runtime health check',
-    });
-    await verifyRuntimeSyncCorsPreflight({
-      baseUrl,
-      origin: corsOrigin,
-    });
-
-    console.log('Runtime verify passed.');
-    console.log(`Space: ${spaceId}`);
-    console.log(`Runtime URL: ${baseUrl}`);
-    console.log(`Sync URL: ${runtime.syncUrl}`);
-    console.log(`CORS origin check: ${corsOrigin}`);
-    return 0;
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error ? error.message : 'Runtime verify failed.'
-    );
-    return 1;
-  }
-}
-
-export async function runVerify(
-  flagValues: Map<string, string>
-): Promise<number> {
-  try {
-    await resolveEffectiveTargetId({
-      cwd: process.cwd(),
-      explicitTargetId: flagValues.get('--target')?.trim() || null,
-    });
-    return runVerifySpaces(flagValues);
-  } catch (error: unknown) {
-    printError(
-      error instanceof Error ? error.message : 'Runtime verify failed.'
-    );
-    return 1;
-  }
-}