deepspace 0.0.1 → 0.2.1

package/dist/cli.js

@@ -0,0 +1,1158 @@
+#!/usr/bin/env node
+
+// src/cli/cli.ts
+import { defineCommand as defineCommand10, runMain } from "citty";
+import { execSync as execSync4 } from "child_process";
+
+// src/cli/commands/login.ts
+import { defineCommand } from "citty";
+import { writeFileSync as writeFileSync2, mkdirSync } from "fs";
+import { join as join2 } from "path";
+import { homedir } from "os";
+import { exec } from "child_process";
+import { platform } from "os";
+import * as p from "@clack/prompts";
+
+// src/cli/env.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { parse as parseToml } from "smol-toml";
+var ENVS = {
+  dev: {
+    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
+    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
+    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
+    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
+  },
+  prod: {
+    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
+    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
+    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
+    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
+  }
+};
+async function fetchPublicKey(authUrl) {
+  const res = await fetch(`${authUrl}/api/auth/jwks`);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch JWT public key (${res.status})`);
+  }
+  const data = await res.json();
+  if (!data.publicKey) {
+    throw new Error("JWKS response missing publicKey");
+  }
+  return data.publicKey;
+}
+function readAppName(appDir) {
+  const wranglerPath = join(appDir, "wrangler.toml");
+  if (!existsSync(wranglerPath)) {
+    throw new Error("No wrangler.toml found. Are you in a DeepSpace app directory?");
+  }
+  const parsed = parseToml(readFileSync(wranglerPath, "utf-8"));
+  if (!parsed.name) {
+    throw new Error("wrangler.toml has no `name` field");
+  }
+  return parsed.name;
+}
+async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
+  const res = await fetch(`${authUrl}/api/auth/mint-app-token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${callerJwt}`
+    },
+    body: JSON.stringify({ appName })
+  });
+  if (!res.ok) {
+    const err = await res.text().catch(() => "");
+    throw new Error(`Failed to mint APP_OWNER_JWT (${res.status}): ${err}`);
+  }
+  const body = await res.json();
+  if (!body.token) {
+    throw new Error(`Auth worker returned no token: ${body.error ?? "unknown error"}`);
+  }
+  return body.token;
+}
+async function writeDevVars(appDir, env, ownerId, callerJwt) {
+  const urls = ENVS[env];
+  const publicKey = await fetchPublicKey(urls.auth);
+  const appName = readAppName(appDir);
+  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appName);
+  const devVars = [
+    `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
+    `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
+    `AUTH_WORKER_URL=${urls.auth}`,
+    `API_WORKER_URL=${urls.api}`,
+    `PLATFORM_WORKER_URL=${urls.platform}`,
+    `OWNER_USER_ID=${ownerId}`,
+    `APP_OWNER_JWT=${appOwnerJwt}`,
+    `INTERNAL_STORAGE_HMAC_SECRET=dev-${Date.now()}`,
+    // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
+    // Production secrets never set this, so deployed apps 404 the route.
+    `ALLOW_DEBUG_ROUTES=true`
+  ].join("\n");
+  writeFileSync(join(appDir, ".dev.vars"), devVars + "\n");
+}
+
+// src/cli/session.ts
+var SESSION_COOKIE = "__Secure-better-auth.session_token";
+async function exchangeSession(authUrl, sessionToken) {
+  const res = await fetch(`${authUrl}/api/auth/token`, {
+    method: "POST",
+    headers: {
+      Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}`,
+      Origin: authUrl
+    }
+  });
+  if (!res.ok) return null;
+  const data = await res.json();
+  return data.token ?? null;
+}
+
+// src/cli/commands/login.ts
+var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
+var login_default = defineCommand({
+  meta: {
+    name: "login",
+    description: "Log in to your DeepSpace account"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Email address (non-interactive mode)",
+      required: false
+    },
+    password: {
+      type: "string",
+      description: "Password (non-interactive mode)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    if (args.email && args.password) {
+      console.log(`Signing in as ${args.email}...`);
+      await doEmailLogin(args.email, args.password);
+      console.log("Logged in");
+      return;
+    }
+    p.intro("DeepSpace Login");
+    const s = p.spinner();
+    s.start("Creating login session...");
+    const sessionRes = await fetch(`${AUTH_URL}/api/auth/cli/session`, { method: "POST" });
+    if (!sessionRes.ok) {
+      s.stop("Failed");
+      p.cancel("Could not create login session");
+      process.exit(1);
+    }
+    const sessionData = await sessionRes.json();
+    if (!sessionData.sessionId || !sessionData.loginUrl) {
+      s.stop("Failed");
+      p.cancel("Could not create login session");
+      process.exit(1);
+    }
+    const { sessionId, loginUrl } = sessionData;
+    s.stop("Opening browser...");
+    p.log.info(`If the browser doesn't open, visit:
+  ${loginUrl}`);
+    openBrowser(loginUrl);
+    s.start("Waiting for authentication...");
+    const result = await pollForCompletion(sessionId);
+    if (!result) {
+      s.stop("Timed out");
+      p.cancel("Login timed out. Run `deepspace login` to try again.");
+      process.exit(1);
+    }
+    storeCredentials(result.sessionToken, result.jwt);
+    s.stop("Authenticated");
+    p.outro(`Logged in as ${result.name ?? result.email}`);
+  }
+});
+async function pollForCompletion(sessionId) {
+  const maxAttempts = 120;
+  const interval = 5e3;
+  for (let i = 0; i < maxAttempts; i++) {
+    await sleep(interval);
+    try {
+      const res = await fetch(`${AUTH_URL}/api/auth/cli/status/${sessionId}`);
+      if (res.status === 410 || res.status === 404) return null;
+      if (!res.ok) continue;
+      const data = await res.json();
+      if (data.state === "complete" && data.sessionToken && data.jwt) {
+        return {
+          sessionToken: data.sessionToken,
+          jwt: data.jwt,
+          email: data.email ?? "",
+          name: data.name ?? null
+        };
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function storeCredentials(sessionToken, jwt) {
+  const dir = join2(homedir(), ".deepspace");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync2(join2(dir, "session"), sessionToken, { mode: 384 });
+  writeFileSync2(join2(dir, "token"), jwt, { mode: 384 });
+}
+function openBrowser(url) {
+  const cmd = platform() === "darwin" ? `open "${url}"` : platform() === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
+  exec(cmd, () => {
+  });
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+async function doEmailLogin(email, password) {
+  const res = await fetch(`${AUTH_URL}/api/auth/sign-in/email`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Origin: AUTH_URL },
+    body: JSON.stringify({ email, password }),
+    redirect: "manual"
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(body.message ?? `Authentication failed (${res.status})`);
+  }
+  const setCookie = res.headers.get("set-cookie") ?? "";
+  const cookieMatch = setCookie.match(new RegExp(`${SESSION_COOKIE}=([^;]+)`));
+  if (!cookieMatch) {
+    throw new Error("No session cookie returned");
+  }
+  const sessionToken = decodeURIComponent(cookieMatch[1]);
+  const jwt = await exchangeSession(AUTH_URL, sessionToken);
+  if (!jwt) {
+    throw new Error("JWT issuance failed");
+  }
+  storeCredentials(sessionToken, jwt);
+}
+
+// src/cli/commands/logout.ts
+import { defineCommand as defineCommand2 } from "citty";
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
+var DIR = join3(homedir2(), ".deepspace");
+var SESSION_PATH = join3(DIR, "session");
+var TOKEN_PATH = join3(DIR, "token");
+var logout_default = defineCommand2({
+  meta: {
+    name: "logout",
+    description: "Sign out and remove cached credentials"
+  },
+  async run() {
+    const sessionToken = existsSync2(SESSION_PATH) ? readFileSync2(SESSION_PATH, "utf-8").trim() : null;
+    if (sessionToken) {
+      try {
+        await fetch(`${AUTH_URL2}/api/auth/sign-out`, {
+          method: "POST",
+          headers: {
+            Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}`,
+            Origin: AUTH_URL2
+          }
+        });
+      } catch {
+      }
+    }
+    let removed = 0;
+    for (const path of [SESSION_PATH, TOKEN_PATH]) {
+      if (existsSync2(path)) {
+        rmSync(path);
+        removed++;
+      }
+    }
+    if (removed === 0) {
+      console.log("Already logged out.");
+      return;
+    }
+    console.log("Logged out.");
+  }
+});
+
+// src/cli/commands/dev.ts
+import { defineCommand as defineCommand3 } from "citty";
+import { existsSync as existsSync4 } from "fs";
+import { join as join5, resolve } from "path";
+import { spawn } from "child_process";
+
+// src/cli/auth.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
+var DIR2 = join4(homedir3(), ".deepspace");
+var SESSION_PATH2 = join4(DIR2, "session");
+var TOKEN_PATH2 = join4(DIR2, "token");
+async function ensureToken() {
+  if (!existsSync3(SESSION_PATH2)) {
+    throw new Error("Not logged in. Run `deepspace login` first.");
+  }
+  const sessionToken = readFileSync3(SESSION_PATH2, "utf-8").trim();
+  if (existsSync3(TOKEN_PATH2)) {
+    const existing = readFileSync3(TOKEN_PATH2, "utf-8").trim();
+    if (isTokenValid(existing)) {
+      return existing;
+    }
+  }
+  const token = await exchangeSession(AUTH_URL3, sessionToken);
+  if (!token) {
+    throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
+  }
+  mkdirSync2(DIR2, { recursive: true });
+  writeFileSync3(TOKEN_PATH2, token, { mode: 384 });
+  return token;
+}
+function isTokenValid(jwt) {
+  try {
+    const payload = JSON.parse(atob(jwt.split(".")[1]));
+    return payload.exp * 1e3 > Date.now() + 3e4;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/commands/dev.ts
+var DEFAULT_PORT = 5173;
+var dev_default = defineCommand3({
+  meta: {
+    name: "dev",
+    description: "Start local development server"
+  },
+  args: {
+    dir: {
+      type: "positional",
+      description: "App directory (default: current directory)",
+      required: false
+    },
+    prod: {
+      type: "boolean",
+      description: "Use production workers (real auth, real API calls)",
+      default: false
+    },
+    port: {
+      type: "string",
+      description: `Port to bind (default ${DEFAULT_PORT}, or $DEEPSPACE_PORT)`,
+      required: false
+    }
+  },
+  async run({ args }) {
+    const appDir = resolve(args.dir ?? ".");
+    const env = args.prod ? "prod" : "dev";
+    const port = resolvePort(args.port);
+    if (!existsSync4(join5(appDir, "wrangler.toml"))) {
+      console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
+      process.exit(1);
+    }
+    let token;
+    try {
+      token = await ensureToken();
+    } catch (err) {
+      console.error(err.message);
+      process.exit(1);
+    }
+    let payload;
+    try {
+      payload = JSON.parse(atob(token.split(".")[1]));
+    } catch {
+      console.error("Malformed session token. Run `npx deepspace login`.");
+      process.exit(1);
+    }
+    console.log(`Logged in as ${payload.name ?? payload.email}`);
+    console.log(`Environment: ${env}`);
+    console.log(`Port: ${port}`);
+    await writeDevVars(appDir, env, payload.sub, token);
+    console.log("Starting dev server...\n");
+    const vite = spawn(
+      "npx",
+      ["vite", "--port", String(port), "--strictPort"],
+      {
+        cwd: appDir,
+        stdio: "inherit",
+        shell: process.platform === "win32",
+        env: { ...process.env, DEEPSPACE_PORT: String(port) }
+      }
+    );
+    process.on("SIGINT", () => vite.kill());
+    process.on("SIGTERM", () => vite.kill());
+    vite.on("close", (code) => process.exit(code ?? 0));
+  }
+});
+function resolvePort(arg) {
+  const raw = arg ?? process.env.DEEPSPACE_PORT;
+  if (!raw) return DEFAULT_PORT;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    console.error(`Invalid port: ${raw}. Must be an integer between 1 and 65535.`);
+    process.exit(1);
+  }
+  return n;
+}
+
+// src/cli/commands/test.ts
+import { defineCommand as defineCommand4 } from "citty";
+import { existsSync as existsSync5 } from "fs";
+import { join as join6, resolve as resolve2 } from "path";
+import { execSync, spawnSync } from "child_process";
+var DEFAULT_PORT2 = 5173;
+var test_default = defineCommand4({
+  meta: {
+    name: "test",
+    description: "Run tests for your DeepSpace app"
+  },
+  args: {
+    suite: {
+      type: "positional",
+      description: "Test suite: smoke, api, e2e, unit, all (default: smoke+api)",
+      required: false
+    },
+    port: {
+      type: "string",
+      description: `Port for vite/webServer (default ${DEFAULT_PORT2}, or $DEEPSPACE_PORT)`,
+      required: false
+    }
+  },
+  async run({ args }) {
+    const appDir = resolve2(".");
+    const suite = args.suite ?? "default";
+    const port = resolvePort2(args.port);
+    if (!existsSync5(join6(appDir, "wrangler.toml"))) {
+      console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
+      process.exit(1);
+    }
+    let token;
+    let ownerId;
+    try {
+      token = await ensureToken();
+      const payload = JSON.parse(atob(token.split(".")[1]));
+      ownerId = payload.sub;
+    } catch (err) {
+      console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
+      process.exit(1);
+    }
+    await writeDevVars(appDir, "dev", ownerId, token);
+    if (suite !== "unit") {
+      ensurePlaywright(appDir);
+    }
+    let exitCode = 0;
+    switch (suite) {
+      case "smoke":
+        exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port);
+        break;
+      case "api":
+        exitCode = runPlaywright(appDir, ["tests/api.spec.ts"], port);
+        break;
+      case "e2e":
+        exitCode = runPlaywright(appDir, [], port);
+        break;
+      case "unit":
+        exitCode = runVitest(appDir);
+        break;
+      case "all":
+        exitCode = runVitest(appDir);
+        if (exitCode === 0) exitCode = runPlaywright(appDir, [], port);
+        break;
+      case "default":
+        exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts", "tests/api.spec.ts"], port);
+        break;
+      default:
+        if (suite.endsWith(".spec.ts")) {
+          exitCode = runPlaywright(appDir, [suite], port);
+        } else {
+          console.error(`Unknown test suite: ${suite}`);
+          console.error("Available: smoke, api, e2e, unit, all");
+          process.exit(1);
+        }
+    }
+    process.exit(exitCode);
+  }
+});
+function runPlaywright(appDir, testFiles, port) {
+  const result = spawnSync("npx", [
+    "playwright",
+    "test",
+    "--config",
+    "tests/playwright.config.ts",
+    ...testFiles
+  ], {
+    cwd: appDir,
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    env: { ...process.env, DEEPSPACE_PORT: String(port) }
+  });
+  return result.status ?? 1;
+}
+function runVitest(appDir) {
+  const result = spawnSync("npx", ["vitest", "run", "--passWithNoTests"], {
+    cwd: appDir,
+    stdio: "inherit",
+    shell: process.platform === "win32"
+  });
+  return result.status ?? 1;
+}
+function ensurePlaywright(appDir) {
+  try {
+    execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
+  } catch {
+    console.log("Installing Playwright...");
+    execSync("npm install -D @playwright/test", { cwd: appDir, stdio: "pipe" });
+  }
+  try {
+    execSync("npx playwright install --dry-run chromium", { cwd: appDir, stdio: "pipe" });
+  } catch {
+    console.log("Installing Chromium for Playwright...");
+    execSync("npx playwright install chromium", { cwd: appDir, stdio: "inherit" });
+  }
+}
+function resolvePort2(arg) {
+  const raw = arg ?? process.env.DEEPSPACE_PORT;
+  if (!raw) return DEFAULT_PORT2;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    console.error(`Invalid port: ${raw}. Must be an integer between 1 and 65535.`);
+    process.exit(1);
+  }
+  return n;
+}
+
+// src/cli/commands/test-accounts.ts
+import { defineCommand as defineCommand5 } from "citty";
+import * as p2 from "@clack/prompts";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { join as join7 } from "path";
+import { homedir as homedir4 } from "os";
+var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
+var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
+var DIR3 = join7(homedir4(), ".deepspace");
+var ACCOUNTS_PATH = join7(DIR3, "test-accounts.json");
+function loadAccounts() {
+  if (!existsSync6(ACCOUNTS_PATH)) return [];
+  try {
+    return JSON.parse(readFileSync4(ACCOUNTS_PATH, "utf-8"));
+  } catch {
+    return [];
+  }
+}
+function saveAccounts(accounts) {
+  mkdirSync3(DIR3, { recursive: true });
+  writeFileSync4(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
+}
+function sessionCookie() {
+  const token = readFileSync4(SESSION_PATH2, "utf-8").trim();
+  return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
+}
+async function fetchRemoteAccounts() {
+  const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.accounts) {
+    throw new Error(data.error ?? "Failed to list test accounts");
+  }
+  return data.accounts;
+}
+async function deleteRemote(id) {
+  const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
+    method: "DELETE",
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  if (!res.ok) {
+    const data = await res.json().catch(() => ({}));
+    throw new Error(data.error ?? `DELETE returned ${res.status}`);
+  }
+}
+var create = defineCommand5({
+  meta: {
+    name: "create",
+    description: "Create a test account"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Email (must end with @deepspace.test)",
+      required: true
+    },
+    password: {
+      type: "string",
+      description: "Password (min 8 characters)",
+      required: true
+    },
+    name: {
+      type: "string",
+      description: "Display name",
+      required: false
+    },
+    label: {
+      type: "string",
+      description: "Label for this test account",
+      required: false
+    }
+  },
+  async run({ args }) {
+    await ensureToken();
+    const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: sessionCookie(),
+        Origin: AUTH_URL4
+      },
+      body: JSON.stringify({
+        email: args.email,
+        password: args.password,
+        name: args.name,
+        label: args.label
+      })
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || !data.id) {
+      console.error(`Failed: ${data.error ?? "Unknown error"}`);
+      process.exit(1);
+    }
+    const account = data;
+    const accounts = loadAccounts();
+    accounts.push({
+      id: account.id,
+      email: args.email,
+      password: args.password,
+      userId: account.userId,
+      name: args.name,
+      label: account.label,
+      createdAt: account.createdAt
+    });
+    saveAccounts(accounts);
+    console.log(`Created test account:`);
+    console.log(`  ID:       ${account.id}`);
+    console.log(`  Email:    ${account.email}`);
+    console.log(`  Password: ${args.password}`);
+    console.log(`  UserID:   ${account.userId}`);
+    if (account.label) console.log(`  Label:    ${account.label}`);
+    console.log(`
+Saved to ${ACCOUNTS_PATH}`);
+  }
+});
+var list = defineCommand5({
+  meta: {
+    name: "list",
+    description: "List your test accounts"
+  },
+  async run() {
+    await ensureToken();
+    let remote;
+    try {
+      remote = await fetchRemoteAccounts();
+    } catch (err) {
+      console.error(`Failed: ${err.message}`);
+      process.exit(1);
+    }
+    if (remote.length === 0) {
+      console.log("No test accounts. Create one with: deepspace test-accounts create --email <email> --password <password>");
+      return;
+    }
+    const local = loadAccounts();
+    const localByEmail = new Map(local.map((a) => [a.email, a]));
+    console.log(`Test accounts (${remote.length}/10):
+`);
+    for (const a of remote) {
+      const stored = localByEmail.get(a.email);
+      const date = new Date(a.createdAt).toLocaleDateString();
+      console.log(`  ${a.email}${a.label ? ` (${a.label})` : ""}`);
+      console.log(`    ID: ${a.id}  UserID: ${a.userId}  Created: ${date}`);
+      if (stored?.password) {
+        console.log(`    Password: ${stored.password}`);
+      } else {
+        console.log(`    Password: (not saved locally)`);
+      }
+    }
+  }
+});
+var del = defineCommand5({
+  meta: {
+    name: "delete",
+    description: "Delete a test account by --email or --id"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Email of the test account to delete",
+      required: false
+    },
+    id: {
+      type: "string",
+      description: "ID of the test account to delete",
+      required: false
+    }
+  },
+  async run({ args }) {
+    if (!args.email && !args.id) {
+      console.error("Provide --email <email> or --id <id>.");
+      process.exit(1);
+    }
+    if (args.email && args.id) {
+      console.error("Provide either --email or --id, not both.");
+      process.exit(1);
+    }
+    await ensureToken();
+    let targetId = args.id;
+    let targetEmail = args.email;
+    if (targetEmail && !targetId) {
+      let remote;
+      try {
+        remote = await fetchRemoteAccounts();
+      } catch (err) {
+        console.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+      const match = remote.find((a) => a.email === targetEmail);
+      if (!match) {
+        console.error(`No test account with email ${targetEmail}.`);
+        process.exit(1);
+      }
+      targetId = match.id;
+    }
+    try {
+      await deleteRemote(targetId);
+    } catch (err) {
+      console.error(`Failed: ${err.message}`);
+      process.exit(1);
+    }
+    const accounts = loadAccounts().filter(
+      (a) => a.id !== targetId && (!targetEmail || a.email !== targetEmail)
+    );
+    saveAccounts(accounts);
+    console.log(`Test account deleted${targetEmail ? `: ${targetEmail}` : `: ${targetId}`}`);
+  }
+});
+var clear = defineCommand5({
+  meta: {
+    name: "clear",
+    description: "Delete all your test accounts (or those matching --label)"
+  },
+  args: {
+    label: {
+      type: "string",
+      description: "Only delete accounts with this label (e.g. e2e, slack-clone)",
+      required: false
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip confirmation prompt (for CI scripts)",
+      default: false
+    }
+  },
+  async run({ args }) {
+    await ensureToken();
+    let remote;
+    try {
+      remote = await fetchRemoteAccounts();
+    } catch (err) {
+      console.error(`Failed: ${err.message}`);
+      process.exit(1);
+    }
+    const targets = args.label ? remote.filter((a) => a.label === args.label) : remote;
+    if (targets.length === 0) {
+      const suffix = args.label ? ` with label '${args.label}'` : "";
+      console.log(`No test accounts${suffix} to delete.`);
+      return;
+    }
+    if (!args.yes) {
+      const subject = args.label ? `${targets.length} test account(s) labeled '${args.label}'` : `all ${targets.length} test account(s)`;
+      const confirmed = await p2.confirm({
+        message: `Delete ${subject}? This is not reversible.`,
+        initialValue: false
+      });
+      if (p2.isCancel(confirmed) || !confirmed) {
+        console.log("Cancelled.");
+        return;
+      }
+    }
+    let ok = 0;
+    const failures = [];
+    for (const a of targets) {
+      try {
+        await deleteRemote(a.id);
+        ok++;
+      } catch (err) {
+        failures.push({ email: a.email, error: err.message });
+      }
+    }
+    const deletedIds = new Set(
+      targets.filter((t) => !failures.find((f) => f.email === t.email)).map((t) => t.id)
+    );
+    saveAccounts(loadAccounts().filter((a) => !deletedIds.has(a.id)));
+    console.log(`Deleted ${ok}/${targets.length} test account(s).`);
+    if (failures.length > 0) {
+      console.error(`
+Failed:`);
+      for (const f of failures) console.error(`  ${f.email}: ${f.error}`);
+      process.exit(1);
+    }
+  }
+});
+var test_accounts_default = defineCommand5({
+  meta: {
+    name: "test-accounts",
+    description: "Manage test accounts for development"
+  },
+  subCommands: {
+    create,
+    list,
+    delete: del,
+    clear
+  }
+});
+
+// src/cli/commands/deploy.ts
+import { defineCommand as defineCommand6 } from "citty";
+import { execSync as execSync2 } from "child_process";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync7 } from "fs";
+import { parse as parseToml2 } from "smol-toml";
+import { join as join8, resolve as resolve3, dirname } from "path";
+import * as p3 from "@clack/prompts";
+var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
+var deploy_default = defineCommand6({
+  meta: {
+    name: "deploy",
+    description: "Build and deploy your DeepSpace app"
+  },
+  args: {
+    dir: {
+      type: "positional",
+      description: "App directory (default: current directory)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const appDir = resolve3(args.dir ?? ".");
+    p3.intro("Deploying DeepSpace app");
+    const wranglerPath = join8(appDir, "wrangler.toml");
+    if (!existsSync7(wranglerPath)) {
+      p3.cancel("No wrangler.toml found. Are you in a DeepSpace app directory?");
+      process.exit(1);
+    }
+    const wranglerConfig = parseToml2(readFileSync5(wranglerPath, "utf-8"));
+    const appName = wranglerConfig.name;
+    if (!appName) {
+      p3.cancel("Could not find app name in wrangler.toml");
+      process.exit(1);
+    }
+    p3.log.info(`App: ${appName}`);
+    let token;
+    try {
+      token = await ensureToken();
+    } catch (err) {
+      p3.cancel(err.message);
+      process.exit(1);
+    }
+    const s = p3.spinner();
+    s.start("Building...");
+    try {
+      execSync2("npx vite build", { cwd: appDir, stdio: "pipe" });
+    } catch (err) {
+      s.stop("Build failed");
+      console.error(err.stderr?.toString() ?? err.message);
+      process.exit(1);
+    }
+    s.stop("Built");
+    const deployConfigPath = join8(appDir, ".wrangler", "deploy", "config.json");
+    if (!existsSync7(deployConfigPath)) {
+      p3.cancel("Build output config not found at .wrangler/deploy/config.json");
+      process.exit(1);
+    }
+    const deployConfig = JSON.parse(readFileSync5(deployConfigPath, "utf-8"));
+    const outputWranglerPath = resolve3(dirname(deployConfigPath), deployConfig.configPath);
+    if (!existsSync7(outputWranglerPath)) {
+      p3.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
+      process.exit(1);
+    }
+    const outputConfig = JSON.parse(readFileSync5(outputWranglerPath, "utf-8"));
+    const workerDir = dirname(outputWranglerPath);
+    const workerBundlePath = join8(workerDir, outputConfig.main);
+    const clientDir = outputConfig.assets?.directory ? resolve3(workerDir, outputConfig.assets.directory) : null;
+    if (!existsSync7(workerBundlePath)) {
+      p3.cancel(`Worker bundle not found at ${workerBundlePath}`);
+      process.exit(1);
+    }
+    if (!clientDir || !existsSync7(clientDir)) {
+      p3.cancel(`Client assets not found at ${clientDir}`);
+      process.exit(1);
+    }
+    s.start("Collecting assets...");
+    const assets = collectAssets(clientDir);
+    s.stop(`Collected ${assets.length} assets`);
+    const workerJs = readFileSync5(workerBundlePath, "utf-8");
+    const doBindings = outputConfig.durable_objects?.bindings;
+    const sqliteClasses = new Set(
+      outputConfig.migrations?.flatMap((m) => m.new_sqlite_classes ?? []) ?? []
+    );
+    const doManifest = doBindings?.map((b) => ({
+      binding: b.name,
+      className: b.class_name,
+      sqlite: sqliteClasses.has(b.class_name)
+    }));
+    if (doManifest?.length) {
+      p3.log.info(`DO manifest: ${doManifest.length} binding(s)`);
+    }
+    s.start(`Deploying to ${appName}.app.space...`);
+    const form = new FormData();
+    form.append("worker", new Blob([workerJs], { type: "application/javascript" }), "worker.js");
+    form.append("assets", JSON.stringify(assets));
+    if (doManifest) {
+      form.append("doManifest", JSON.stringify(doManifest));
+    }
+    const res = await fetch(`${DEPLOY_URL}/api/deploy/${appName}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      body: form
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.success) {
+      s.stop("Deploy failed");
+      p3.cancel(body.error ?? `Deployment error (${res.status})`);
+      process.exit(1);
+    }
+    s.stop("Deployed!");
+    p3.log.success(`Live at: ${body.url}`);
+    p3.outro("Done");
+  }
+});
+function collectAssets(dir) {
+  const assets = [];
+  function walk(d, prefix) {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      if (entry.name === ".assetsignore") continue;
+      const full = join8(d, entry.name);
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(full, rel);
+      } else {
+        assets.push({
+          path: "/" + rel,
+          contentBase64: readFileSync5(full).toString("base64")
+        });
+      }
+    }
+  }
+  walk(dir, "");
+  return assets;
+}
+
+// src/cli/commands/undeploy.ts
+import { defineCommand as defineCommand7 } from "citty";
+import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
+import { join as join9 } from "path";
+import { parse as parseToml3 } from "smol-toml";
+import * as p4 from "@clack/prompts";
+var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
+var undeploy_default = defineCommand7({
+  meta: {
+    name: "undeploy",
+    description: "Remove a deployed DeepSpace app"
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "App name to undeploy (reads from wrangler.toml if omitted)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    let appName = args.name;
+    if (!appName) {
+      const wranglerPath = join9(process.cwd(), "wrangler.toml");
+      if (existsSync8(wranglerPath)) {
+        const config = parseToml3(readFileSync6(wranglerPath, "utf-8"));
+        if (config.name) appName = config.name;
+      }
+    }
+    if (!appName) {
+      p4.cancel("Provide an app name or run from a DeepSpace app directory.");
+      process.exit(1);
+    }
+    let token;
+    try {
+      token = await ensureToken();
+    } catch (err) {
+      p4.cancel(err.message);
+      process.exit(1);
+    }
+    p4.intro(`Undeploying ${appName}`);
+    const s = p4.spinner();
+    s.start("Removing...");
+    const res = await fetch(`${DEPLOY_URL2}/api/deploy/${appName}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.success) {
+      s.stop("Failed");
+      p4.cancel(body.error ?? `Undeploy error (${res.status})`);
+      process.exit(1);
+    }
+    s.stop("Removed");
+    p4.outro(`${appName}.app.space has been taken down`);
+  }
+});
+
+// src/cli/commands/whoami.ts
+import { defineCommand as defineCommand8 } from "citty";
+var whoami_default = defineCommand8({
+  meta: {
+    name: "whoami",
+    description: "Show the currently logged-in user"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit a single-line JSON object instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    let jwt;
+    try {
+      jwt = await ensureToken();
+    } catch (err) {
+      console.error(err.message ?? "Not signed in. Run `deepspace login`.");
+      process.exit(1);
+    }
+    let payload;
+    try {
+      payload = JSON.parse(atob(jwt.split(".")[1]));
+    } catch {
+      console.error("Malformed session token. Run `deepspace login` again.");
+      process.exit(1);
+    }
+    const isTestAccount = !!payload.email?.endsWith("@deepspace.test");
+    const accountType = isTestAccount ? "test-account" : payload.email ? "developer" : "unknown";
+    if (args.json) {
+      console.log(JSON.stringify({
+        name: payload.name ?? null,
+        email: payload.email ?? null,
+        userId: payload.sub ?? null,
+        accountType,
+        issuer: payload.iss ?? null,
+        expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null
+      }));
+      return;
+    }
+    console.log(`Name:       ${payload.name ?? "(none)"}`);
+    console.log(`Email:      ${payload.email ?? "(none)"}`);
+    console.log(`UserID:     ${payload.sub ?? "(none)"}`);
+    console.log(`Type:       ${accountType}`);
+    if (payload.iss) console.log(`Issuer:     ${payload.iss}`);
+    if (isTestAccount) {
+      console.log("");
+      console.log("Note: this is a test account, not a real OAuth developer.");
+      console.log("See docs/auth/dev-vs-test-accounts.md.");
+    }
+  }
+});
+
+// src/cli/commands/add.ts
+import { defineCommand as defineCommand9 } from "citty";
+import { existsSync as existsSync9 } from "fs";
+import { resolve as resolve4, join as join10 } from "path";
+import { execSync as execSync3 } from "child_process";
+function findScript(from) {
+  const candidate = join10(from, ".deepspace", "scripts", "add-feature.cjs");
+  if (existsSync9(candidate)) return candidate;
+  return null;
+}
+var add_default = defineCommand9({
+  meta: {
+    name: "add",
+    description: "Add a feature to your DeepSpace app"
+  },
+  args: {
+    list: {
+      type: "boolean",
+      alias: "l",
+      description: "List available features",
+      required: false
+    },
+    info: {
+      type: "string",
+      description: "Show details about a feature",
+      required: false
+    },
+    feature: {
+      type: "positional",
+      description: "Feature to install",
+      required: false
+    },
+    dir: {
+      type: "positional",
+      description: "App directory (default: current directory)",
+      required: false
+    }
+  },
+  run({ args }) {
+    const appDir = resolve4(args.dir ?? ".");
+    const script = findScript(appDir);
+    if (!script) {
+      console.error("No .deepspace/scripts/add-feature.cjs found.");
+      console.error("Are you in a DeepSpace app directory?");
+      process.exit(1);
+    }
+    const passArgs = [];
+    if (args.list) {
+      passArgs.push("--list");
+    } else if (args.info) {
+      passArgs.push("--info", args.info);
+    } else if (args.feature) {
+      passArgs.push(args.feature, appDir);
+    } else {
+      passArgs.push("--help");
+    }
+    execSync3(`node ${JSON.stringify(script)} ${passArgs.map((a) => JSON.stringify(a)).join(" ")}`, {
+      stdio: "inherit",
+      cwd: appDir
+    });
+  }
+});
+
+// src/cli/cli.ts
+var create2 = defineCommand10({
+  meta: {
+    name: "create",
+    description: "Create a new DeepSpace app"
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "App name",
+      required: false
+    }
+  },
+  run({ args }) {
+    const name = args.name ? ` ${args.name}` : "";
+    console.log(`Running: npm create deepspace${name}
+`);
+    execSync4(`npm create deepspace@latest${name}`, { stdio: "inherit" });
+  }
+});
+var main = defineCommand10({
+  meta: {
+    name: "deepspace",
+    version: "0.2.1",
+    description: "DeepSpace SDK CLI"
+  },
+  subCommands: {
+    create: create2,
+    login: login_default,
+    logout: logout_default,
+    whoami: whoami_default,
+    dev: dev_default,
+    test: test_default,
+    "test-accounts": test_accounts_default,
+    add: add_default,
+    deploy: deploy_default,
+    undeploy: undeploy_default
+  },
+  run() {
+    console.log("deepspace CLI \u2014 run `npx deepspace --help` for usage");
+  }
+});
+runMain(main);
+//# sourceMappingURL=cli.js.map