@tallpond/cli 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carson Gragg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# @tallpond/cli
+
+The `tallpond` CLI is the whole developer workflow for [tallpond](https://tallpond.com):
+sign in once, register an app, and ship schema + frontend with one command. No
+dashboard steps, no hand-provisioned OAuth clients, no shared secrets.
+
+## Install
+
+Run it without installing:
+
+```sh
+npx @tallpond/cli login
+```
+
+or install globally so the `tallpond` command is on your PATH:
+
+```sh
+npm i -g @tallpond/cli
+```
+
+## Quick start
+
+```sh
+tallpond login                 # sign in (browser approval), saves a developer token
+tallpond apps create "My App"  # registers the app + its OAuth client, writes tallpond.json
+tallpond deploy                # applies .tallpond.schema.ts and publishes ./dist
+```
+
+A deployed app is served at `https://<slug>.tallpond.app` with the schema live
+behind the gateway.
+
+## `tallpond login`
+
+Device-flow sign-in: the CLI prints an approval URL with a short confirmation
+code, you approve it in the browser using your existing tallpond session, and the
+CLI receives a developer token saved to `~/.config/tallpond/credentials.json`
+(mode 600). The code in the URL can only *approve* — it can never mint a token,
+so a leaked link doesn't compromise the login.
+
+`TALLPOND_DEV_TOKEN` overrides the saved token (for CI / non-interactive agents).
+`tallpond logout` forgets it; `tallpond whoami` prints the signed-in user.
+
+## `tallpond deploy [schemaFile] [--dir dist] [--no-bundle]`
+
+Applies `.tallpond.schema.ts` (compiled locally) and uploads `./dist` as a new
+immutable version, then flips the live pointer in one call. Safe schema changes
+apply automatically; destructive ones are blocked pending an explicit migration.
+
+The schema file is TypeScript: the CLI compiles it in-process (via esbuild) so it
+runs on any supported Node — no bun or global TS loader required.
+
+Full command reference: <https://tallpond.com> → docs → CLI.
+
+## License
+
+MIT

package/cli.js

@@ -0,0 +1,816 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { parseArgs } from "node:util";
+import { spawn } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { writeFile as writeFile3 } from "node:fs/promises";
+import { resolve as resolve4 } from "node:path";
+
+// src/deploy.ts
+import { extname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+function resolveConfig(flags, env) {
+  const gatewayUrl = flags.gatewayUrl ?? env["TALLPOND_GATEWAY_URL"];
+  const appId = flags.appId ?? env["TALLPOND_APP_ID"];
+  const token = flags.token ?? env["TALLPOND_DEPLOY_TOKEN"];
+  const deploymentId = flags.deploymentId ?? env["TALLPOND_DEPLOYMENT_ID"] ?? generateDeploymentId();
+  if (!gatewayUrl) return { error: "missing gateway URL (--gateway-url or TALLPOND_GATEWAY_URL)" };
+  if (!appId) return { error: "missing app id (--app-id or TALLPOND_APP_ID)" };
+  if (!token) return { error: "missing deploy token (--token or TALLPOND_DEPLOY_TOKEN)" };
+  if (!/^[A-Za-z0-9]+$/.test(deploymentId)) {
+    return { error: `deploymentId "${deploymentId}" must be alphanumeric` };
+  }
+  return { gatewayUrl, appId, deploymentId, token };
+}
+function generateDeploymentId() {
+  const ts = Date.now().toString(36);
+  const rand = Math.random().toString(36).slice(2, 8);
+  return `d${ts}${rand}`;
+}
+var TS_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]);
+async function loadSchema(schemaPath) {
+  const abs = resolve(process.cwd(), schemaPath);
+  let importUrl = pathToFileURL(abs).href;
+  let cleanup;
+  if (TS_EXT.has(extname(abs).toLowerCase())) {
+    const { build } = await import("esbuild");
+    const result = await build({
+      entryPoints: [abs],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      write: false,
+      logLevel: "silent"
+    });
+    const dir = await mkdtemp(join(tmpdir(), "tallpond-schema-"));
+    const out = join(dir, "schema.mjs");
+    await writeFile(out, result.outputFiles[0].text);
+    importUrl = pathToFileURL(out).href;
+    cleanup = () => rm(dir, { recursive: true, force: true });
+  }
+  let mod;
+  try {
+    mod = await import(importUrl);
+  } catch (e) {
+    throw new Error(`failed to load schema at ${abs}: ${e.message}`);
+  } finally {
+    await cleanup?.();
+  }
+  const schema = mod.default;
+  if (!schema || typeof schema !== "object" || !Array.isArray(schema.tables)) {
+    throw new Error(`${abs} must \`export default defineSchema({ ... })\``);
+  }
+  return schema;
+}
+async function deploy(schema, config, deps = { fetch }) {
+  const res = await deps.fetch(new URL("/deploy", config.gatewayUrl).toString(), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-tallpond-deploy-token": config.token
+    },
+    body: JSON.stringify({
+      deploymentId: config.deploymentId,
+      appId: config.appId,
+      schema
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (res.ok) {
+    return {
+      ok: true,
+      version: body?.version ?? "(unknown)",
+      applied: body?.applied ?? 0,
+      noop: body?.noop ?? false
+    };
+  }
+  if (res.status === 409 && body?.error === "migration_blocked") {
+    return { ok: false, kind: "migration_blocked", changes: body.changes ?? [] };
+  }
+  return {
+    ok: false,
+    kind: "error",
+    status: res.status,
+    error: body?.error ?? `http_${res.status}`,
+    ...body?.detail ? { detail: body.detail } : {}
+  };
+}
+function renderBlockedChanges(changes) {
+  if (changes.length === 0) return "  (no change details returned)";
+  return changes.map((c) => {
+    const head = `  [${c.class}] ${c.description}`;
+    return c.sql ? `${head}
+      ${c.sql}` : head;
+  }).join("\n");
+}
+
+// src/typegen.ts
+var TS_TYPE = {
+  text: "string",
+  uuid: "string",
+  integer: "number",
+  bigint: "number",
+  boolean: "boolean",
+  jsonb: "unknown",
+  timestamp: "string"
+};
+function pascal(name) {
+  return name.replace(/(^|[_-])([a-z])/g, (_, __, c) => c.toUpperCase());
+}
+function fieldType(col) {
+  const base = TS_TYPE[col.type];
+  return col.primaryKey || col.notNull ? base : `${base} | null`;
+}
+function rowInterface(table) {
+  const name = `${pascal(table.name)}Row`;
+  const hasId = table.columns.some((c) => c.name === "id");
+  const fields = table.columns.map((c) => `  ${c.name}: ${fieldType(c)}`);
+  const lines = hasId ? fields : [`  id: string`, ...fields];
+  return { name, body: `export interface ${name} {
+${lines.join("\n")}
+}` };
+}
+function generateTypes(schema) {
+  const tables = [...schema.tables];
+  for (const res of schema.resources) tables.push(...res.tables);
+  tables.sort((a, b) => a.name.localeCompare(b.name));
+  const interfaces = tables.map(rowInterface);
+  const registryLines = tables.map((t, i) => `    ${t.name}: ${interfaces[i].name}`);
+  return `// Generated by \`tallpond typegen\`. Do not edit by hand.
+/* eslint-disable */
+import type {} from '@tallpond/sdk'
+
+${interfaces.map((i) => i.body).join("\n\n")}
+
+declare module '@tallpond/sdk' {
+  interface Register {
+    tables: {
+${registryLines.join("\n")}
+    }
+  }
+}
+`;
+}
+
+// src/config.ts
+import { homedir } from "node:os";
+import { dirname, join as join2, resolve as resolve2 } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+var DEFAULT_GATEWAY_URL = "https://api.tallpond.com";
+function resolveGatewayUrl(flag) {
+  return (flag ?? process.env["TALLPOND_GATEWAY_URL"] ?? DEFAULT_GATEWAY_URL).replace(/\/$/, "");
+}
+function credentialsPath() {
+  const base = process.env["XDG_CONFIG_HOME"] ?? join2(homedir(), ".config");
+  return join2(base, "tallpond", "credentials.json");
+}
+function readCredentialsFile() {
+  try {
+    return JSON.parse(readFileSync(credentialsPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function savedToken(gatewayUrl) {
+  const fromEnv = process.env["TALLPOND_DEV_TOKEN"];
+  if (fromEnv) return fromEnv;
+  return readCredentialsFile()[gatewayUrl]?.token ?? null;
+}
+function saveToken(gatewayUrl, token, userId) {
+  const path = credentialsPath();
+  const all = readCredentialsFile();
+  all[gatewayUrl] = { token, ...userId ? { userId } : {} };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+  return path;
+}
+function forgetToken(gatewayUrl) {
+  const all = readCredentialsFile();
+  if (!(gatewayUrl in all)) return;
+  delete all[gatewayUrl];
+  writeFileSync(credentialsPath(), `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+}
+var PROJECT_CONFIG_FILE = "tallpond.json";
+function readProjectConfig(cwd = process.cwd()) {
+  try {
+    const parsed = JSON.parse(readFileSync(resolve2(cwd, PROJECT_CONFIG_FILE), "utf8"));
+    return parsed.appId && parsed.slug ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeProjectConfig(config, cwd = process.cwd()) {
+  const path = resolve2(cwd, PROJECT_CONFIG_FILE);
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`);
+  return path;
+}
+
+// src/devapi.ts
+import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join3, relative } from "node:path";
+var DevApiError = class extends Error {
+  constructor(status, code, detail) {
+    super(detail ? `${code}: ${detail}` : code);
+    this.status = status;
+    this.code = code;
+    this.detail = detail;
+  }
+};
+async function request(fetcher, gatewayUrl, token, method, path, body) {
+  const res = await fetcher(new URL(path, `${gatewayUrl}/`).toString(), {
+    method,
+    headers: {
+      ...token ? { Authorization: `Bearer ${token}` } : {},
+      ...body !== void 0 && !(body instanceof Uint8Array) ? { "content-type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: body instanceof Uint8Array ? body : JSON.stringify(body) } : {}
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new DevApiError(
+      res.status,
+      typeof json["error"] === "string" ? json["error"] : `http_${res.status}`,
+      typeof json["detail"] === "string" ? json["detail"] : void 0
+    );
+  }
+  return json;
+}
+async function startDeviceFlow(gatewayUrl, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, null, "POST", "dev/cli/start");
+}
+async function pollForToken(gatewayUrl, start, deps = {}) {
+  const fetcher = deps.fetch ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const deadline = Date.now() + start.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    const res = await fetcher(new URL("dev/cli/token", `${gatewayUrl}/`).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_code: start.device_code })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.token) return { token: json.token, userId: json.user_id ?? "" };
+    if (json.error === "access_denied") throw new DevApiError(res.status, "access_denied", "the request was denied in the browser");
+    if (json.error === "expired_token") break;
+    if (json.error !== "authorization_pending") {
+      throw new DevApiError(res.status, json.error ?? `http_${res.status}`);
+    }
+    await sleep(start.interval * 1e3);
+  }
+  throw new DevApiError(400, "expired_token", "sign-in timed out \u2014 run `tallpond login` again");
+}
+function whoami(gatewayUrl, token, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, token, "GET", "dev/me");
+}
+function createApp(gatewayUrl, token, input, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, token, "POST", "dev/apps", input);
+}
+async function listApps(gatewayUrl, token, fetcher = fetch) {
+  const res = await request(fetcher, gatewayUrl, token, "GET", "dev/apps");
+  return res.apps;
+}
+async function deploySchemaAsDev(gatewayUrl, token, appId, schema, fetcher = fetch) {
+  const res = await fetcher(new URL(`dev/apps/${appId}/deploy`, `${gatewayUrl}/`).toString(), {
+    method: "POST",
+    headers: { "content-type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ schema })
+  });
+  const body = await res.json().catch(() => null);
+  if (res.ok) {
+    return { ok: true, version: body?.version ?? "(unknown)", applied: body?.applied ?? 0, noop: body?.noop ?? false };
+  }
+  if (res.status === 409 && body?.error === "migration_blocked") {
+    return { ok: false, kind: "migration_blocked", changes: body.changes ?? [] };
+  }
+  return {
+    ok: false,
+    kind: "error",
+    status: res.status,
+    error: body?.error ?? `http_${res.status}`,
+    ...body?.detail ? { detail: body.detail } : {}
+  };
+}
+function deployFunctionsAsDev(gatewayUrl, token, appId, bundle, fetcher = fetch) {
+  return request(
+    fetcher,
+    gatewayUrl,
+    token,
+    "POST",
+    `dev/apps/${appId}/functions`,
+    bundle
+  );
+}
+function collectBundleFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const full = join3(d, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) out.push(relative(dir, full).split("\\").join("/"));
+    }
+  };
+  walk(dir);
+  return out.sort();
+}
+async function uploadBundle(gatewayUrl, token, appId, dir, deps = {}) {
+  const fetcher = deps.fetch ?? fetch;
+  const files = collectBundleFiles(dir);
+  if (!files.includes("index.html")) {
+    throw new DevApiError(400, "invalid_bundle", `${dir} has no index.html \u2014 is it a built app?`);
+  }
+  const version = Date.now().toString(36);
+  for (const [i, path] of files.entries()) {
+    deps.onFile?.(path, i + 1, files.length);
+    const size = statSync(join3(dir, path)).size;
+    if (size > 25 * 1024 * 1024) {
+      throw new DevApiError(413, "file_too_large", `${path} is ${size} bytes (limit 25MB)`);
+    }
+    await request(fetcher, gatewayUrl, token, "PUT", `dev/apps/${appId}/bundle/${version}/${path}`, new Uint8Array(readFileSync2(join3(dir, path))));
+  }
+  const activated = await request(
+    fetcher,
+    gatewayUrl,
+    token,
+    "POST",
+    `dev/apps/${appId}/bundle/${version}/activate`,
+    { files }
+  );
+  return { version, files, url: activated.url };
+}
+
+// src/functions.ts
+import { basename, extname as extname2, join as join4, resolve as resolve3 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { existsSync, readdirSync as readdirSync2 } from "node:fs";
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+var FN_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+var FN_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".js", ".mjs"]);
+function discoverFunctions(dir) {
+  const abs = resolve3(dir);
+  if (!existsSync(abs)) return [];
+  const entries = [];
+  for (const file of readdirSync2(abs, { withFileTypes: true })) {
+    if (!file.isFile()) continue;
+    const ext = extname2(file.name);
+    if (!FN_EXT.has(ext)) continue;
+    const name = basename(file.name, ext);
+    if (!FN_NAME.test(name)) {
+      throw new Error(`function file "${file.name}" \u2014 names must be identifiers (letters/digits/underscores)`);
+    }
+    entries.push({ name, file: join4(abs, file.name) });
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  const seen = /* @__PURE__ */ new Set();
+  for (const e of entries) {
+    if (seen.has(e.name)) throw new Error(`duplicate function name "${e.name}" in ${dir}`);
+    seen.add(e.name);
+  }
+  return entries;
+}
+var RUNTIME_SOURCE = `// tallpond function runtime (generated \u2014 do not edit)
+function decodeInvocation(token) {
+  const payload = token.slice(4).split('.')[0].replace(/-/g, '+').replace(/_/g, '/')
+  return JSON.parse(atob(payload))
+}
+
+function makeCtx(env, token) {
+  const fetchImpl = env.TALLPOND_FETCH ?? fetch
+  const base = String(env.TALLPOND_GATEWAY_URL ?? '').replace(/\\/$/, '')
+  async function call(path, body) {
+    const res = await fetchImpl(base + path, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token },
+      body: JSON.stringify(body),
+    })
+    const data = await res.json().catch(() => null)
+    if (!res.ok) {
+      const err = new Error((data && (data.detail || data.error)) || ('gateway ' + res.status))
+      err.code = (data && data.error) || 'gateway_error'
+      throw err
+    }
+    return data
+  }
+  const inv = decodeInvocation(token)
+  return {
+    userId: inv.userId,
+    resourceId: inv.resourceId ?? null,
+    fn: inv.fn,
+    invocationId: inv.invocationId,
+    db: {
+      query: (request) => call('/v1/db/query', request),
+      batch: (operations) => call('/v1/db/batch', { operations }),
+    },
+    // Escape hatch for surfaces without a typed helper yet (ai, files, ...).
+    gateway: call,
+  }
+}
+
+export function createHandler(functions) {
+  return {
+    async fetch(req, env) {
+      if (req.method !== 'POST') return Response.json({ error: 'not_found' }, { status: 404 })
+      if (req.headers.get('x-tallpond-dispatch') !== env.TALLPOND_DISPATCH_SECRET) {
+        return Response.json({ error: 'forbidden' }, { status: 403 })
+      }
+      const token = req.headers.get('x-tallpond-invocation')
+      if (!token) return Response.json({ error: 'missing invocation token' }, { status: 401 })
+      const body = await req.json().catch(() => null)
+      const impl = body && functions[body.fn]
+      if (!impl) return Response.json({ error: 'not_found', detail: 'no such function' }, { status: 404 })
+      try {
+        const result = await impl(makeCtx(env, token), body.args ?? null)
+        return Response.json({ result: result === undefined ? null : result })
+      } catch (e) {
+        return Response.json(
+          { error: 'function_error', detail: String((e && e.message) || e) },
+          { status: 500 },
+        )
+      }
+    },
+  }
+}
+`;
+async function bundleFunctions(entries) {
+  const dir = await mkdtemp2(join4(tmpdir2(), "tallpond-functions-"));
+  try {
+    await writeFile2(join4(dir, "runtime.mjs"), RUNTIME_SOURCE);
+    const imports = entries.map((e, i) => `import fn${i} from ${JSON.stringify(e.file)}`).join("\n");
+    const table = entries.map((e, i) => `  ${JSON.stringify(e.name)}: fn${i},`).join("\n");
+    const entrySource = `import { createHandler } from './runtime.mjs'
+${imports}
+export default createHandler({
+${table}
+})
+`;
+    const entryPath = join4(dir, "entry.mjs");
+    await writeFile2(entryPath, entrySource);
+    const { build } = await import("esbuild");
+    const result = await build({
+      entryPoints: [entryPath],
+      bundle: true,
+      format: "esm",
+      // Workers are a browser-like runtime: no node builtins, fetch/crypto global.
+      platform: "browser",
+      conditions: ["workerd", "worker"],
+      write: false,
+      logLevel: "silent"
+    });
+    return {
+      script: result.outputFiles[0].text,
+      manifest: entries.map((e) => ({ name: e.name }))
+    };
+  } finally {
+    await rm2(dir, { recursive: true, force: true });
+  }
+}
+
+// src/cli.ts
+var USAGE = `tallpond \u2014 build and ship apps on the tallpond platform
+
+Usage:
+  tallpond login                     Sign in and save a developer token
+  tallpond logout                    Forget the saved token for this gateway
+  tallpond whoami                    Show the signed-in developer
+  tallpond apps create <name>        Register a new app (writes ${PROJECT_CONFIG_FILE})
+  tallpond apps list                 List your apps
+  tallpond deploy [schemaFile]       Deploy the app: schema + functions/ + built bundle
+  tallpond typegen [schemaFile]      Generate row types (--out tallpond-env.d.ts)
+  tallpond help                      Show this help
+
+Common flags:
+  --gateway-url <url>   gateway base URL [env TALLPOND_GATEWAY_URL, default https://api.tallpond.com]
+
+apps create flags:
+  --slug <slug>         hosted subdomain (default: derived from the name)
+
+deploy flags:
+  --dir <dir>           built bundle to publish (default: ./dist when present)
+  --no-bundle           deploy the schema only
+  schemaFile            defaults to ./.tallpond.schema.ts (skipped if absent)
+
+Platform/CI escape hatch (bypasses login; uses the shared deploy token):
+  --app-id <id> --deployment-id <id> --token <token>
+  [env TALLPOND_APP_ID, TALLPOND_DEPLOYMENT_ID, TALLPOND_DEPLOY_TOKEN]
+`;
+async function main(argv) {
+  const command = argv[0];
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    process.stdout.write(USAGE);
+    return command ? 0 : 1;
+  }
+  try {
+    if (command === "login") return await runLogin(argv.slice(1));
+    if (command === "logout") return runLogout(argv.slice(1));
+    if (command === "whoami") return await runWhoami(argv.slice(1));
+    if (command === "apps") return await runApps(argv.slice(1));
+    if (command === "create") return await runAppsCreate(argv.slice(1));
+    if (command === "deploy") return await runDeploy(argv.slice(1));
+    if (command === "typegen") return await runTypegen(argv.slice(1));
+  } catch (e) {
+    if (e instanceof DevApiError) {
+      if (e.status === 401) {
+        process.stderr.write(`error: not signed in (${e.message}) \u2014 run \`tallpond login\`
+`);
+      } else {
+        process.stderr.write(`error: ${e.message}
+`);
+      }
+      return 1;
+    }
+    throw e;
+  }
+  if (command === "dev") {
+    process.stderr.write(
+      "tallpond dev is not implemented yet. Point your app at the hosted gateway (or `bun run dev:gateway` from the platform repo) and use your framework dev server.\n"
+    );
+    return 1;
+  }
+  process.stderr.write(`unknown command "${command}"
+
+${USAGE}`);
+  return 1;
+}
+function gatewayFlag(args) {
+  return parseArgs({
+    args,
+    allowPositionals: true,
+    options: { "gateway-url": { type: "string" } }
+  });
+}
+async function runLogin(args) {
+  const { values } = gatewayFlag(args);
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"]);
+  const start = await startDeviceFlow(gatewayUrl);
+  process.stdout.write(
+    `Confirm this code in your browser: ${start.user_code}
+
+  ${start.verification_url}
+
+Waiting for approval\u2026
+`
+  );
+  openInBrowser(start.verification_url);
+  const { token, userId } = await pollForToken(gatewayUrl, start);
+  const path = saveToken(gatewayUrl, token, userId);
+  process.stdout.write(`Signed in as ${userId}. Token saved to ${path}
+`);
+  return 0;
+}
+function runLogout(args) {
+  const { values } = gatewayFlag(args);
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"]);
+  forgetToken(gatewayUrl);
+  process.stdout.write(`Forgot saved token for ${gatewayUrl}
+`);
+  return 0;
+}
+async function runWhoami(args) {
+  const { values } = gatewayFlag(args);
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"]);
+  const token = requireToken(gatewayUrl);
+  const me = await whoami(gatewayUrl, token);
+  process.stdout.write(`${me.user_id} (${gatewayUrl})
+`);
+  return 0;
+}
+async function runApps(args) {
+  const sub = args[0];
+  if (sub === "create") return runAppsCreate(args.slice(1));
+  if (sub === "list") return runAppsList(args.slice(1));
+  process.stderr.write(`usage: tallpond apps <create|list>
+`);
+  return 1;
+}
+async function runAppsCreate(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: { "gateway-url": { type: "string" }, slug: { type: "string" } }
+  });
+  const name = positionals.join(" ").trim();
+  if (!name) {
+    process.stderr.write("usage: tallpond apps create <name> [--slug my-app]\n");
+    return 1;
+  }
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"]);
+  const token = requireToken(gatewayUrl);
+  const app = await createApp(gatewayUrl, token, {
+    name,
+    ...values["slug"] ? { slug: values["slug"] } : {}
+  });
+  const path = writeProjectConfig({
+    appId: app.app_id,
+    slug: app.slug,
+    name: app.name,
+    gatewayUrl,
+    url: app.url
+  });
+  process.stdout.write(
+    `Created app "${app.name}" (${app.app_id})
+  slug:  ${app.slug}
+` + (app.url ? `  url:   ${app.url}
+` : "") + `  wrote ${path}
+
+Next: declare a schema in .tallpond.schema.ts, build your app, then \`tallpond deploy\`.
+`
+  );
+  return 0;
+}
+async function runAppsList(args) {
+  const { values } = gatewayFlag(args);
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"]);
+  const token = requireToken(gatewayUrl);
+  const apps = await listApps(gatewayUrl, token);
+  if (apps.length === 0) {
+    process.stdout.write("No apps yet \u2014 `tallpond apps create <name>`.\n");
+    return 0;
+  }
+  for (const a of apps) {
+    process.stdout.write(
+      `${a.slug.padEnd(24)} ${a.name}  ${a.url ?? ""}${a.live_version ? "" : "  (not deployed)"}
+`
+    );
+  }
+  return 0;
+}
+async function runDeploy(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      "gateway-url": { type: "string" },
+      "app-id": { type: "string" },
+      "deployment-id": { type: "string" },
+      token: { type: "string" },
+      dir: { type: "string" },
+      "no-bundle": { type: "boolean" }
+    }
+  });
+  const platformToken = values.token ?? process.env["TALLPOND_DEPLOY_TOKEN"];
+  if (platformToken) return runPlatformDeploy(values, positionals, platformToken);
+  const project = readProjectConfig();
+  if (!project) {
+    process.stderr.write(
+      `error: no ${PROJECT_CONFIG_FILE} here \u2014 run \`tallpond apps create <name>\` first
+(or pass the platform deploy token for the legacy path)
+`
+    );
+    return 1;
+  }
+  const gatewayUrl = resolveGatewayUrl(values["gateway-url"] ?? project.gatewayUrl);
+  const token = requireToken(gatewayUrl);
+  const schemaPath = positionals[0] ?? "./.tallpond.schema.ts";
+  if (existsSync2(resolve4(process.cwd(), schemaPath))) {
+    const schema = await loadSchema(schemaPath);
+    const result = await deploySchemaAsDev(gatewayUrl, token, project.appId, schema);
+    if (!result.ok) {
+      if (result.kind === "migration_blocked") {
+        process.stderr.write(
+          `deploy blocked: the schema change needs an explicit migration.
+${renderBlockedChanges(result.changes)}
+`
+        );
+      } else {
+        process.stderr.write(`schema deploy failed (${result.status}): ${result.error}${result.detail ? `: ${result.detail}` : ""}
+`);
+      }
+      return 1;
+    }
+    process.stdout.write(
+      result.noop ? `schema: up to date (version ${result.version})
+` : `schema: applied version ${result.version} (${result.applied} statement${result.applied === 1 ? "" : "s"})
+`
+    );
+  } else if (positionals[0]) {
+    process.stderr.write(`error: schema file ${schemaPath} not found
+`);
+    return 1;
+  }
+  const fnEntries = discoverFunctions(resolve4(process.cwd(), "functions"));
+  if (fnEntries.length > 0) {
+    const bundle = await bundleFunctions(fnEntries);
+    const version2 = `f${Date.now().toString(36)}`;
+    try {
+      const res = await deployFunctionsAsDev(gatewayUrl, token, project.appId, { version: version2, ...bundle });
+      process.stdout.write(`functions: ${res.functions.join(", ")} (version ${res.version})
+`);
+    } catch (e) {
+      if (e instanceof DevApiError) {
+        process.stderr.write(`functions deploy failed: ${e.message}
+`);
+        return 1;
+      }
+      throw e;
+    }
+  }
+  const dir = values.dir ?? (existsSync2(resolve4(process.cwd(), "dist")) ? "dist" : void 0);
+  if (values["no-bundle"] || !dir) {
+    if (!values["no-bundle"]) {
+      process.stdout.write("no bundle directory found (looked for ./dist) \u2014 schema-only deploy\n");
+    }
+    return 0;
+  }
+  if (!existsSync2(resolve4(process.cwd(), dir))) {
+    process.stderr.write(`error: bundle directory ${dir} not found \u2014 build your app first
+`);
+    return 1;
+  }
+  const { version, files, url } = await uploadBundle(gatewayUrl, token, project.appId, resolve4(process.cwd(), dir), {
+    onFile: (path, i, total) => process.stdout.write(`  [${i}/${total}] ${path}
+`)
+  });
+  process.stdout.write(`bundle: ${files.length} files live as version ${version}
+`);
+  if (url) process.stdout.write(`
+  \u2192 ${url}
+`);
+  return 0;
+}
+async function runPlatformDeploy(values, positionals, token) {
+  const config = resolveConfig(
+    {
+      ...typeof values["gateway-url"] === "string" ? { gatewayUrl: values["gateway-url"] } : {},
+      ...typeof values["app-id"] === "string" ? { appId: values["app-id"] } : {},
+      ...typeof values["deployment-id"] === "string" ? { deploymentId: values["deployment-id"] } : {},
+      token
+    },
+    process.env
+  );
+  if ("error" in config) {
+    process.stderr.write(`error: ${config.error}
+`);
+    return 1;
+  }
+  const schema = await loadSchema(positionals[0] ?? "./.tallpond.schema.ts");
+  const result = await deploy(schema, config);
+  if (result.ok) {
+    process.stdout.write(
+      result.noop ? `up to date \u2014 deployment ${config.deploymentId} already at version ${result.version}
+` : `deployed ${config.deploymentId} \u2192 version ${result.version} (${result.applied} statement${result.applied === 1 ? "" : "s"} applied)
+`
+    );
+    return 0;
+  }
+  if (result.kind === "migration_blocked") {
+    process.stderr.write(
+      `deploy blocked: the schema change needs an explicit migration.
+${renderBlockedChanges(result.changes)}
+`
+    );
+    return 1;
+  }
+  const detail = result.detail ? `: ${result.detail}` : "";
+  if (result.status === 401) {
+    process.stderr.write(`deploy failed: unauthorized (check --token / TALLPOND_DEPLOY_TOKEN)${detail}
+`);
+  } else {
+    process.stderr.write(`deploy failed (${result.status}): ${result.error}${detail}
+`);
+  }
+  return 1;
+}
+async function runTypegen(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: { out: { type: "string" } }
+  });
+  const schemaPath = positionals[0] ?? "./.tallpond.schema.ts";
+  let schema;
+  try {
+    schema = await loadSchema(schemaPath);
+  } catch (e) {
+    process.stderr.write(`error: ${e.message}
+`);
+    return 1;
+  }
+  const outPath = resolve4(process.cwd(), values.out ?? "tallpond-env.d.ts");
+  await writeFile3(outPath, generateTypes(schema));
+  process.stdout.write(`wrote ${outPath}
+`);
+  return 0;
+}
+function requireToken(gatewayUrl) {
+  const token = savedToken(gatewayUrl);
+  if (!token) throw new DevApiError(401, "not_signed_in", `no saved token for ${gatewayUrl}`);
+  return token;
+}
+function openInBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+main(process.argv.slice(2)).then((code) => process.exit(code)).catch((e) => {
+  process.stderr.write(`unexpected error: ${e.stack ?? e}
+`);
+  process.exit(1);
+});

package/index.js

@@ -0,0 +1,362 @@
+// src/deploy.ts
+import { extname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+function resolveConfig(flags, env) {
+  const gatewayUrl = flags.gatewayUrl ?? env["TALLPOND_GATEWAY_URL"];
+  const appId = flags.appId ?? env["TALLPOND_APP_ID"];
+  const token = flags.token ?? env["TALLPOND_DEPLOY_TOKEN"];
+  const deploymentId = flags.deploymentId ?? env["TALLPOND_DEPLOYMENT_ID"] ?? generateDeploymentId();
+  if (!gatewayUrl) return { error: "missing gateway URL (--gateway-url or TALLPOND_GATEWAY_URL)" };
+  if (!appId) return { error: "missing app id (--app-id or TALLPOND_APP_ID)" };
+  if (!token) return { error: "missing deploy token (--token or TALLPOND_DEPLOY_TOKEN)" };
+  if (!/^[A-Za-z0-9]+$/.test(deploymentId)) {
+    return { error: `deploymentId "${deploymentId}" must be alphanumeric` };
+  }
+  return { gatewayUrl, appId, deploymentId, token };
+}
+function generateDeploymentId() {
+  const ts = Date.now().toString(36);
+  const rand = Math.random().toString(36).slice(2, 8);
+  return `d${ts}${rand}`;
+}
+var TS_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]);
+async function loadSchema(schemaPath) {
+  const abs = resolve(process.cwd(), schemaPath);
+  let importUrl = pathToFileURL(abs).href;
+  let cleanup;
+  if (TS_EXT.has(extname(abs).toLowerCase())) {
+    const { build } = await import("esbuild");
+    const result = await build({
+      entryPoints: [abs],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      write: false,
+      logLevel: "silent"
+    });
+    const dir = await mkdtemp(join(tmpdir(), "tallpond-schema-"));
+    const out = join(dir, "schema.mjs");
+    await writeFile(out, result.outputFiles[0].text);
+    importUrl = pathToFileURL(out).href;
+    cleanup = () => rm(dir, { recursive: true, force: true });
+  }
+  let mod;
+  try {
+    mod = await import(importUrl);
+  } catch (e) {
+    throw new Error(`failed to load schema at ${abs}: ${e.message}`);
+  } finally {
+    await cleanup?.();
+  }
+  const schema = mod.default;
+  if (!schema || typeof schema !== "object" || !Array.isArray(schema.tables)) {
+    throw new Error(`${abs} must \`export default defineSchema({ ... })\``);
+  }
+  return schema;
+}
+async function deploy(schema, config, deps = { fetch }) {
+  const res = await deps.fetch(new URL("/deploy", config.gatewayUrl).toString(), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-tallpond-deploy-token": config.token
+    },
+    body: JSON.stringify({
+      deploymentId: config.deploymentId,
+      appId: config.appId,
+      schema
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (res.ok) {
+    return {
+      ok: true,
+      version: body?.version ?? "(unknown)",
+      applied: body?.applied ?? 0,
+      noop: body?.noop ?? false
+    };
+  }
+  if (res.status === 409 && body?.error === "migration_blocked") {
+    return { ok: false, kind: "migration_blocked", changes: body.changes ?? [] };
+  }
+  return {
+    ok: false,
+    kind: "error",
+    status: res.status,
+    error: body?.error ?? `http_${res.status}`,
+    ...body?.detail ? { detail: body.detail } : {}
+  };
+}
+function renderBlockedChanges(changes) {
+  if (changes.length === 0) return "  (no change details returned)";
+  return changes.map((c) => {
+    const head = `  [${c.class}] ${c.description}`;
+    return c.sql ? `${head}
+      ${c.sql}` : head;
+  }).join("\n");
+}
+
+// src/typegen.ts
+var TS_TYPE = {
+  text: "string",
+  uuid: "string",
+  integer: "number",
+  bigint: "number",
+  boolean: "boolean",
+  jsonb: "unknown",
+  timestamp: "string"
+};
+function pascal(name) {
+  return name.replace(/(^|[_-])([a-z])/g, (_, __, c) => c.toUpperCase());
+}
+function fieldType(col) {
+  const base = TS_TYPE[col.type];
+  return col.primaryKey || col.notNull ? base : `${base} | null`;
+}
+function rowInterface(table) {
+  const name = `${pascal(table.name)}Row`;
+  const hasId = table.columns.some((c) => c.name === "id");
+  const fields = table.columns.map((c) => `  ${c.name}: ${fieldType(c)}`);
+  const lines = hasId ? fields : [`  id: string`, ...fields];
+  return { name, body: `export interface ${name} {
+${lines.join("\n")}
+}` };
+}
+function generateTypes(schema) {
+  const tables = [...schema.tables];
+  for (const res of schema.resources) tables.push(...res.tables);
+  tables.sort((a, b) => a.name.localeCompare(b.name));
+  const interfaces = tables.map(rowInterface);
+  const registryLines = tables.map((t, i) => `    ${t.name}: ${interfaces[i].name}`);
+  return `// Generated by \`tallpond typegen\`. Do not edit by hand.
+/* eslint-disable */
+import type {} from '@tallpond/sdk'
+
+${interfaces.map((i) => i.body).join("\n\n")}
+
+declare module '@tallpond/sdk' {
+  interface Register {
+    tables: {
+${registryLines.join("\n")}
+    }
+  }
+}
+`;
+}
+
+// src/devapi.ts
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join as join2, relative } from "node:path";
+var DevApiError = class extends Error {
+  constructor(status, code, detail) {
+    super(detail ? `${code}: ${detail}` : code);
+    this.status = status;
+    this.code = code;
+    this.detail = detail;
+  }
+};
+async function request(fetcher, gatewayUrl, token, method, path, body) {
+  const res = await fetcher(new URL(path, `${gatewayUrl}/`).toString(), {
+    method,
+    headers: {
+      ...token ? { Authorization: `Bearer ${token}` } : {},
+      ...body !== void 0 && !(body instanceof Uint8Array) ? { "content-type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: body instanceof Uint8Array ? body : JSON.stringify(body) } : {}
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new DevApiError(
+      res.status,
+      typeof json["error"] === "string" ? json["error"] : `http_${res.status}`,
+      typeof json["detail"] === "string" ? json["detail"] : void 0
+    );
+  }
+  return json;
+}
+async function startDeviceFlow(gatewayUrl, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, null, "POST", "dev/cli/start");
+}
+async function pollForToken(gatewayUrl, start, deps = {}) {
+  const fetcher = deps.fetch ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const deadline = Date.now() + start.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    const res = await fetcher(new URL("dev/cli/token", `${gatewayUrl}/`).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_code: start.device_code })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.token) return { token: json.token, userId: json.user_id ?? "" };
+    if (json.error === "access_denied") throw new DevApiError(res.status, "access_denied", "the request was denied in the browser");
+    if (json.error === "expired_token") break;
+    if (json.error !== "authorization_pending") {
+      throw new DevApiError(res.status, json.error ?? `http_${res.status}`);
+    }
+    await sleep(start.interval * 1e3);
+  }
+  throw new DevApiError(400, "expired_token", "sign-in timed out \u2014 run `tallpond login` again");
+}
+function whoami(gatewayUrl, token, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, token, "GET", "dev/me");
+}
+function createApp(gatewayUrl, token, input, fetcher = fetch) {
+  return request(fetcher, gatewayUrl, token, "POST", "dev/apps", input);
+}
+async function listApps(gatewayUrl, token, fetcher = fetch) {
+  const res = await request(fetcher, gatewayUrl, token, "GET", "dev/apps");
+  return res.apps;
+}
+async function deploySchemaAsDev(gatewayUrl, token, appId, schema, fetcher = fetch) {
+  const res = await fetcher(new URL(`dev/apps/${appId}/deploy`, `${gatewayUrl}/`).toString(), {
+    method: "POST",
+    headers: { "content-type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ schema })
+  });
+  const body = await res.json().catch(() => null);
+  if (res.ok) {
+    return { ok: true, version: body?.version ?? "(unknown)", applied: body?.applied ?? 0, noop: body?.noop ?? false };
+  }
+  if (res.status === 409 && body?.error === "migration_blocked") {
+    return { ok: false, kind: "migration_blocked", changes: body.changes ?? [] };
+  }
+  return {
+    ok: false,
+    kind: "error",
+    status: res.status,
+    error: body?.error ?? `http_${res.status}`,
+    ...body?.detail ? { detail: body.detail } : {}
+  };
+}
+function deployFunctionsAsDev(gatewayUrl, token, appId, bundle, fetcher = fetch) {
+  return request(
+    fetcher,
+    gatewayUrl,
+    token,
+    "POST",
+    `dev/apps/${appId}/functions`,
+    bundle
+  );
+}
+function collectBundleFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const full = join2(d, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) out.push(relative(dir, full).split("\\").join("/"));
+    }
+  };
+  walk(dir);
+  return out.sort();
+}
+async function uploadBundle(gatewayUrl, token, appId, dir, deps = {}) {
+  const fetcher = deps.fetch ?? fetch;
+  const files = collectBundleFiles(dir);
+  if (!files.includes("index.html")) {
+    throw new DevApiError(400, "invalid_bundle", `${dir} has no index.html \u2014 is it a built app?`);
+  }
+  const version = Date.now().toString(36);
+  for (const [i, path] of files.entries()) {
+    deps.onFile?.(path, i + 1, files.length);
+    const size = statSync(join2(dir, path)).size;
+    if (size > 25 * 1024 * 1024) {
+      throw new DevApiError(413, "file_too_large", `${path} is ${size} bytes (limit 25MB)`);
+    }
+    await request(fetcher, gatewayUrl, token, "PUT", `dev/apps/${appId}/bundle/${version}/${path}`, new Uint8Array(readFileSync(join2(dir, path))));
+  }
+  const activated = await request(
+    fetcher,
+    gatewayUrl,
+    token,
+    "POST",
+    `dev/apps/${appId}/bundle/${version}/activate`,
+    { files }
+  );
+  return { version, files, url: activated.url };
+}
+
+// src/config.ts
+import { homedir } from "node:os";
+import { dirname, join as join3, resolve as resolve2 } from "node:path";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+var DEFAULT_GATEWAY_URL = "https://api.tallpond.com";
+function resolveGatewayUrl(flag) {
+  return (flag ?? process.env["TALLPOND_GATEWAY_URL"] ?? DEFAULT_GATEWAY_URL).replace(/\/$/, "");
+}
+function credentialsPath() {
+  const base = process.env["XDG_CONFIG_HOME"] ?? join3(homedir(), ".config");
+  return join3(base, "tallpond", "credentials.json");
+}
+function readCredentialsFile() {
+  try {
+    return JSON.parse(readFileSync2(credentialsPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function savedToken(gatewayUrl) {
+  const fromEnv = process.env["TALLPOND_DEV_TOKEN"];
+  if (fromEnv) return fromEnv;
+  return readCredentialsFile()[gatewayUrl]?.token ?? null;
+}
+function saveToken(gatewayUrl, token, userId) {
+  const path = credentialsPath();
+  const all = readCredentialsFile();
+  all[gatewayUrl] = { token, ...userId ? { userId } : {} };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+  return path;
+}
+function forgetToken(gatewayUrl) {
+  const all = readCredentialsFile();
+  if (!(gatewayUrl in all)) return;
+  delete all[gatewayUrl];
+  writeFileSync(credentialsPath(), `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+}
+var PROJECT_CONFIG_FILE = "tallpond.json";
+function readProjectConfig(cwd = process.cwd()) {
+  try {
+    const parsed = JSON.parse(readFileSync2(resolve2(cwd, PROJECT_CONFIG_FILE), "utf8"));
+    return parsed.appId && parsed.slug ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeProjectConfig(config, cwd = process.cwd()) {
+  const path = resolve2(cwd, PROJECT_CONFIG_FILE);
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`);
+  return path;
+}
+export {
+  DEFAULT_GATEWAY_URL,
+  DevApiError,
+  PROJECT_CONFIG_FILE,
+  collectBundleFiles,
+  createApp,
+  deploy,
+  deployFunctionsAsDev,
+  deploySchemaAsDev,
+  forgetToken,
+  generateDeploymentId,
+  generateTypes,
+  listApps,
+  loadSchema,
+  pollForToken,
+  readProjectConfig,
+  renderBlockedChanges,
+  resolveConfig,
+  resolveGatewayUrl,
+  saveToken,
+  savedToken,
+  startDeviceFlow,
+  uploadBundle,
+  whoami,
+  writeProjectConfig
+};

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@tallpond/cli",
+  "version": "0.0.1",
+  "description": "The tallpond developer CLI — sign in, register an app, and deploy schema + frontend with one command.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CarsonJoe/tallpond.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://tallpond.com",
+  "keywords": [
+    "tallpond",
+    "cli",
+    "deploy",
+    "oauth",
+    "backend"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "tallpond": "./cli.js"
+  },
+  "main": "./index.js",
+  "module": "./index.js",
+  "exports": {
+    ".": {
+      "import": "./index.js",
+      "default": "./index.js"
+    }
+  },
+  "dependencies": {
+    "@tallpond/schema": "^0.0.2",
+    "esbuild": "^0.24.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}