deepspace 0.3.10 → 0.4.0

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand17, runMain } from "citty";
+import { defineCommand as defineCommand19, runMain } from "citty";
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
-import { dirname as dirname2, join as join13 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync14 } from "fs";
+import { dirname as dirname2, join as join16 } from "path";
 import { fileURLToPath } from "url";
 
 // src/cli/commands/login.ts
@@ -14,6 +14,7 @@ import { join as join2 } from "path";
 import { homedir } from "os";
 import { exec } from "child_process";
 import { platform } from "os";
+import { randomBytes, createHash } from "crypto";
 import * as p2 from "@clack/prompts";
 
 // src/cli/lib/spinner.ts
@@ -180,7 +181,6 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "OWNER_USER_ID",
   "APP_OWNER_JWT",
   "APP_IDENTITY_TOKEN",
-  "INTERNAL_STORAGE_HMAC_SECRET",
   "ALLOW_DEBUG_ROUTES"
 ]);
 var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
@@ -302,7 +302,6 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
     ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    `INTERNAL_STORAGE_HMAC_SECRET=dev-${Date.now()}`,
     // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
     // Production secrets never set this, so deployed apps 404 the route.
     `ALLOW_DEBUG_ROUTES=true`
@@ -363,7 +362,13 @@ var login_default = defineCommand({
     p2.intro("DeepSpace Login");
     const s = createSpinner();
     s.start("Creating login session...");
-    const sessionRes = await fetch(`${AUTH_URL}/api/auth/cli/session`, { method: "POST" });
+    const codeVerifier = base64url(randomBytes(32));
+    const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+    const sessionRes = await fetch(`${AUTH_URL}/api/auth/cli/session`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code_challenge: codeChallenge })
+    });
     if (!sessionRes.ok) {
       s.stop("Failed");
       p2.cancel("Could not create login session");
@@ -381,7 +386,7 @@ var login_default = defineCommand({
   ${loginUrl}`);
     openBrowser(loginUrl);
     s.start("Waiting for authentication...");
-    const result = await pollForCompletion(sessionId);
+    const result = await pollForCompletion(sessionId, codeVerifier);
     if (!result) {
       s.stop("Timed out");
       p2.cancel("Login timed out. Run `deepspace login` to try again.");
@@ -400,13 +405,15 @@ plans on the web dashboard:
     p2.outro("Done");
   }
 });
-async function pollForCompletion(sessionId) {
+async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
   const interval = 5e3;
   for (let i = 0; i < maxAttempts; i++) {
     await sleep(interval);
     try {
-      const res = await fetch(`${AUTH_URL}/api/auth/cli/status/${sessionId}`);
+      const res = await fetch(`${AUTH_URL}/api/auth/cli/status/${sessionId}`, {
+        headers: { "x-code-verifier": codeVerifier }
+      });
       if (res.status === 410 || res.status === 404) return null;
       if (!res.ok) continue;
       const data = await res.json();
@@ -425,7 +432,7 @@ async function pollForCompletion(sessionId) {
 }
 function storeCredentials(sessionToken, jwt) {
   const dir = join2(homedir(), ".deepspace");
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 448 });
   writeFileSync2(join2(dir, "session"), sessionToken, { mode: 384 });
   writeFileSync2(join2(dir, "token"), jwt, { mode: 384 });
 }
@@ -437,6 +444,9 @@ function openBrowser(url) {
 function sleep(ms) {
   return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
+function base64url(bytes) {
+  return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 async function doEmailLogin(email, password) {
   const res = await fetch(`${AUTH_URL}/api/auth/sign-in/email`, {
     method: "POST",
@@ -506,8 +516,8 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { existsSync as existsSync5 } from "fs";
-import { join as join5, resolve as resolve2 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join6, resolve as resolve2 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/auth.ts
@@ -530,21 +540,21 @@ var DIR2 = join4(homedir3(), ".deepspace");
 var SESSION_PATH2 = join4(DIR2, "session");
 var TOKEN_PATH2 = join4(DIR2, "token");
 async function ensureToken() {
-  if (!existsSync3(SESSION_PATH2)) {
-    throw new Error("Not logged in. Run `deepspace login` first.");
-  }
-  const sessionToken = readFileSync3(SESSION_PATH2, "utf-8").trim();
   if (existsSync3(TOKEN_PATH2)) {
     const existing = readFileSync3(TOKEN_PATH2, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
   }
+  if (!existsSync3(SESSION_PATH2)) {
+    throw new Error("Not logged in. Run `deepspace login` first.");
+  }
+  const sessionToken = readFileSync3(SESSION_PATH2, "utf-8").trim();
   const token2 = await exchangeSession(AUTH_URL3, sessionToken);
   if (!token2) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
   }
-  mkdirSync2(DIR2, { recursive: true });
+  mkdirSync2(DIR2, { recursive: true, mode: 448 });
   writeFileSync3(TOKEN_PATH2, token2, { mode: 384 });
   return token2;
 }
@@ -557,9 +567,37 @@ function isTokenValid(jwt) {
   }
 }
 
+// src/cli/lib/install-status.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+function ensureInstallReady(appDir) {
+  if (existsSync4(join5(appDir, "node_modules", "deepspace", "package.json"))) return;
+  const sentinelDir = join5(appDir, ".deepspace");
+  const errPath = join5(sentinelDir, "install.err");
+  const startedPath = join5(sentinelDir, "install.started");
+  const donePath = join5(sentinelDir, "install.done");
+  const logPath = join5(sentinelDir, "install.log");
+  if (existsSync4(errPath)) {
+    console.error("Background install failed:");
+    console.error(readFileSync4(errPath, "utf-8").trimEnd());
+    if (existsSync4(logPath)) console.error(`
+Full log: ${logPath}`);
+    console.error("\nRun `npm install` (or `bun install`) manually, then retry.");
+    process.exit(1);
+  }
+  if (existsSync4(startedPath) && !existsSync4(donePath)) {
+    console.error("Dependencies are still installing in the background.");
+    if (existsSync4(logPath)) console.error(`Tail progress: tail -f ${logPath}`);
+    console.error("Retry once it finishes.");
+    process.exit(1);
+  }
+  console.error("Dependencies not installed. Run `npm install` (or `bun install`) first.");
+  process.exit(1);
+}
+
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { resolve } from "path";
 var DLL_NOT_FOUND = -1073741515;
 function preflightWindowsWorkerd(appDir) {
@@ -572,7 +610,7 @@ function preflightWindowsWorkerd(appDir) {
     "bin",
     "workerd.exe"
   );
-  if (!existsSync4(workerdExe)) return;
+  if (!existsSync5(workerdExe)) return;
   try {
     execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
     return;
@@ -622,10 +660,11 @@ var dev_default = defineCommand3({
     const appDir = resolve2(args.dir ?? ".");
     const env = args.prod ? "prod" : "dev";
     const port = resolvePort(args.port);
-    if (!existsSync5(join5(appDir, "wrangler.toml"))) {
+    if (!existsSync6(join6(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
+    ensureInstallReady(appDir);
     let token2;
     try {
       token2 = await ensureToken();
@@ -834,8 +873,8 @@ function isAlive(pid) {
 
 // src/cli/commands/test.ts
 import { defineCommand as defineCommand5 } from "citty";
-import { existsSync as existsSync6 } from "fs";
-import { join as join6, resolve as resolve3 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { join as join7, resolve as resolve3 } from "path";
 import { sync as spawnSync3 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
@@ -885,10 +924,11 @@ var test_default = defineCommand5({
     const appDir = resolve3(".");
     const suite = args.suite ?? "default";
     const port = resolvePort3(args.port);
-    if (!existsSync6(join6(appDir, "wrangler.toml"))) {
+    if (!existsSync7(join7(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
+    ensureInstallReady(appDir);
     let token2;
     let ownerId;
     try {
@@ -1019,17 +1059,17 @@ var screenshot_default = defineCommand6({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync3 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
-var DIR3 = join7(homedir4(), ".deepspace");
-var ACCOUNTS_PATH = join7(DIR3, "test-accounts.json");
+var DIR3 = join8(homedir4(), ".deepspace");
+var ACCOUNTS_PATH = join8(DIR3, "test-accounts.json");
 function loadAccounts() {
-  if (!existsSync7(ACCOUNTS_PATH)) return [];
+  if (!existsSync8(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync4(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync5(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
@@ -1039,7 +1079,7 @@ function saveAccounts(accounts) {
   writeFileSync4(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token2 = readFileSync4(SESSION_PATH2, "utf-8").trim();
+  const token2 = readFileSync5(SESSION_PATH2, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token2)}`;
 }
 async function fetchRemoteAccounts() {
@@ -1306,9 +1346,9 @@ var test_accounts_default = defineCommand7({
 // src/cli/commands/deploy.ts
 import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
-import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync9 } from "fs";
 import { parse as parseToml2 } from "smol-toml";
-import { join as join8, resolve as resolve5, dirname } from "path";
+import { join as join9, resolve as resolve5, dirname } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
 
@@ -1337,7 +1377,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "INTERNAL_STORAGE_HMAC_SECRET",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -1518,6 +1557,7 @@ function asObjectArray(v) {
 // src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
 var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
   "/api/*",
   "/ws/*",
@@ -1541,6 +1581,24 @@ function extractRunWorkerFirst(cfg) {
   }
   return out;
 }
+function isLikelyCloudflareDeployFailure(status2, error) {
+  if (status2 >= 500) return true;
+  if (!error) return false;
+  return [
+    "Upload session failed",
+    "Asset upload failed",
+    "Worker deploy failed",
+    "entitlements.not_available",
+    "Internal Server Error"
+  ].some((needle) => error.includes(needle));
+}
+function formatDeployWorkerError(status2, error) {
+  const detail = error ?? `Deployment error (${status2})`;
+  if (!isLikelyCloudflareDeployFailure(status2, error)) return detail;
+  return `${CLOUDFLARE_DEPLOY_ERROR_HINT}
+
+Underlying error: ${detail}`;
+}
 var deploy_default = defineCommand8({
   meta: {
     name: "deploy",
@@ -1555,13 +1613,14 @@ var deploy_default = defineCommand8({
   },
   async run({ args }) {
     const appDir = resolve5(args.dir ?? ".");
-    p4.intro("Deploying DeepSpace app");
-    const wranglerPath = join8(appDir, "wrangler.toml");
-    if (!existsSync8(wranglerPath)) {
-      p4.cancel("No wrangler.toml found. Are you in a DeepSpace app directory?");
+    const wranglerPath = join9(appDir, "wrangler.toml");
+    if (!existsSync9(wranglerPath)) {
+      console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
-    const wranglerConfig = parseToml2(readFileSync5(wranglerPath, "utf-8"));
+    ensureInstallReady(appDir);
+    p4.intro("Deploying DeepSpace app");
+    const wranglerConfig = parseToml2(readFileSync6(wranglerPath, "utf-8"));
     const nameRes = resolveAppName(wranglerConfig.name);
     if (!nameRes.ok) {
       p4.cancel(`wrangler.toml: ${nameRes.reason}`);
@@ -1592,33 +1651,33 @@ var deploy_default = defineCommand8({
       process.exit(1);
     }
     s.stop("Built");
-    const deployConfigPath = join8(appDir, ".wrangler", "deploy", "config.json");
-    if (!existsSync8(deployConfigPath)) {
+    const deployConfigPath = join9(appDir, ".wrangler", "deploy", "config.json");
+    if (!existsSync9(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync5(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync6(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve5(dirname(deployConfigPath), deployConfig.configPath);
-    if (!existsSync8(outputWranglerPath)) {
+    if (!existsSync9(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync5(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync6(outputWranglerPath, "utf-8"));
     const workerDir = dirname(outputWranglerPath);
-    const workerBundlePath = join8(workerDir, outputConfig.main);
+    const workerBundlePath = join9(workerDir, outputConfig.main);
     const clientDir = outputConfig.assets?.directory ? resolve5(workerDir, outputConfig.assets.directory) : null;
-    if (!existsSync8(workerBundlePath)) {
+    if (!existsSync9(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
       process.exit(1);
     }
-    if (!clientDir || !existsSync8(clientDir)) {
+    if (!clientDir || !existsSync9(clientDir)) {
       p4.cancel(`Client assets not found at ${clientDir}`);
       process.exit(1);
     }
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync5(workerBundlePath, "utf-8");
+    const workerJs = readFileSync6(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap((m) => m.new_sqlite_classes ?? []) ?? []
@@ -1645,10 +1704,10 @@ var deploy_default = defineCommand8({
         `Custom bindings: ${customBindings.map((b) => `${b.name} (${b.type})`).join(", ")}`
       );
     }
-    const devVarsPath = join8(appDir, ".dev.vars");
+    const devVarsPath = join9(appDir, ".dev.vars");
     let userSecrets = {};
-    if (existsSync8(devVarsPath)) {
-      const customSection = extractCustomDevVars(readFileSync5(devVarsPath, "utf-8"));
+    if (existsSync9(devVarsPath)) {
+      const customSection = extractCustomDevVars(readFileSync6(devVarsPath, "utf-8"));
       if (customSection) {
         try {
           userSecrets = parseDevVars(customSection);
@@ -1706,7 +1765,7 @@ var deploy_default = defineCommand8({
     const body = await res.json().catch(() => ({}));
     if (!res.ok || !body.success) {
       s.stop("Deploy failed");
-      p4.cancel(body.error ?? `Deployment error (${res.status})`);
+      p4.cancel(formatDeployWorkerError(res.status, body.error));
       process.exit(1);
     }
     if (body.url) {
@@ -1730,15 +1789,15 @@ var deploy_default = defineCommand8({
   }
 });
 async function syncSubscriptionPlans(appDir, appName, token2) {
-  const subsPath = join8(appDir, "src", "subscriptions.ts");
-  if (!existsSync8(subsPath)) return;
+  const subsPath = join9(appDir, "src", "subscriptions.ts");
+  if (!existsSync9(subsPath)) return;
   const s = createSpinner();
   s.start("Syncing subscription plans...");
   let plans;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join8(appDir, ".wrangler", "deploy");
-    const outFile = join8(outDir, "subscriptions.bundle.mjs");
+    const outDir = join9(appDir, ".wrangler", "deploy");
+    const outFile = join9(outDir, "subscriptions.bundle.mjs");
     await esbuild.build({
       entryPoints: [subsPath],
       bundle: true,
@@ -1879,15 +1938,15 @@ current billing period? (Skip to leave them grandfathered.)`
   }
 }
 async function syncOneTimeProducts(appDir, appName, token2) {
-  const productsPath = join8(appDir, "src", "products.ts");
-  if (!existsSync8(productsPath)) return;
+  const productsPath = join9(appDir, "src", "products.ts");
+  if (!existsSync9(productsPath)) return;
   const s = createSpinner();
   s.start("Syncing one-time products...");
   let products;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join8(appDir, ".wrangler", "deploy");
-    const outFile = join8(outDir, "products.bundle.mjs");
+    const outDir = join9(appDir, ".wrangler", "deploy");
+    const outFile = join9(outDir, "products.bundle.mjs");
     await esbuild.build({
       entryPoints: [productsPath],
       bundle: true,
@@ -1961,14 +2020,14 @@ function collectAssets(dir) {
   function walk(d, prefix) {
     for (const entry of readdirSync(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
-      const full = join8(d, entry.name);
+      const full = join9(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(full, rel);
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync5(full).toString("base64")
+          contentBase64: readFileSync6(full).toString("base64")
         });
       }
     }
@@ -1979,8 +2038,8 @@ function collectAssets(dir) {
 
 // src/cli/commands/undeploy.ts
 import { defineCommand as defineCommand9 } from "citty";
-import { readFileSync as readFileSync6, existsSync as existsSync9 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync7, existsSync as existsSync10 } from "fs";
+import { join as join10 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 import * as p5 from "@clack/prompts";
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
@@ -1999,9 +2058,9 @@ var undeploy_default = defineCommand9({
   async run({ args }) {
     let appName = args.name;
     if (!appName) {
-      const wranglerPath = join9(process.cwd(), "wrangler.toml");
-      if (existsSync9(wranglerPath)) {
-        const config = parseToml3(readFileSync6(wranglerPath, "utf-8"));
+      const wranglerPath = join10(process.cwd(), "wrangler.toml");
+      if (existsSync10(wranglerPath)) {
+        const config = parseToml3(readFileSync7(wranglerPath, "utf-8"));
         if (config.name) appName = config.name;
       }
     }
@@ -2092,12 +2151,14 @@ var whoami_default = defineCommand10({
 
 // src/cli/commands/add.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { existsSync as existsSync10 } from "fs";
-import { resolve as resolve6, join as join10 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { resolve as resolve6, join as join11 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
-  const candidate = join10(from, ".deepspace", "scripts", "add-feature.cjs");
-  if (existsSync10(candidate)) return candidate;
+  const inNodeModules = join11(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
+  if (existsSync11(inNodeModules)) return inNodeModules;
+  const inDotDeepspace = join11(from, ".deepspace", "scripts", "add-feature.cjs");
+  if (existsSync11(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
 var add_default = defineCommand11({
@@ -2130,10 +2191,14 @@ var add_default = defineCommand11({
   },
   run({ args }) {
     const appDir = resolve6(args.dir ?? ".");
+    ensureInstallReady(appDir);
     const script = findScript(appDir);
     if (!script) {
-      console.error("No .deepspace/scripts/add-feature.cjs found.");
-      console.error("Are you in a DeepSpace app directory?");
+      console.error("Could not find the deepspace feature installer.");
+      console.error("Looked in:");
+      console.error(`  ${join11(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join11(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
+      console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
     const passArgs = [];
@@ -2153,19 +2218,96 @@ var add_default = defineCommand11({
   }
 });
 
-// src/cli/commands/domain.ts
+// src/cli/commands/skills.ts
 import { defineCommand as defineCommand12 } from "citty";
+import spawn2 from "cross-spawn";
+import { mkdirSync as mkdirSync4 } from "fs";
+import { join as join12 } from "path";
+import { homedir as homedir5 } from "os";
+var SKILL_REPO = "deepdotspace/deepspace-skill";
+function runSkillsAdd(extraArgs) {
+  return new Promise((resolve9) => {
+    const child = spawn2(
+      "npx",
+      ["-y", "skills@latest", "add", SKILL_REPO, ...extraArgs],
+      { stdio: "inherit" }
+    );
+    child.on("close", (code) => resolve9(code ?? 1));
+    child.on("error", (err) => {
+      console.error(`Failed to invoke npx: ${err.message}`);
+      console.error("Is Node.js installed and on PATH?");
+      resolve9(1);
+    });
+  });
+}
+function precreateClaudeDir(baseDir) {
+  mkdirSync4(join12(baseDir, ".claude"), { recursive: true });
+}
+var add = defineCommand12({
+  meta: {
+    name: "add",
+    description: "Install the DeepSpace skill for your coding agent"
+  },
+  args: {
+    global: {
+      type: "boolean",
+      alias: "g",
+      description: "Install globally (~/.agents/skills/) instead of into the current directory",
+      default: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip prompts (assume yes for any confirmation)",
+      default: false
+    },
+    agent: {
+      type: "string",
+      description: "Target a single agent (e.g. claude-code, codex, opencode). Default: install for all detected agents.",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const extra = [];
+    if (args.global) extra.push("-g");
+    if (args.yes) extra.push("-y");
+    if (args.agent) extra.push("--agent", args.agent);
+    if (!args.agent || args.agent === "claude-code") {
+      const baseDir = args.global ? homedir5() : process.cwd();
+      try {
+        precreateClaudeDir(baseDir);
+      } catch (err) {
+        console.warn(`
+  Note: could not pre-create .claude/ for Claude Code: ${err?.message ?? err}`);
+      }
+    }
+    const code = await runSkillsAdd(extra);
+    if (code !== 0) process.exit(code);
+  }
+});
+var skills_default = defineCommand12({
+  meta: {
+    name: "skills",
+    description: "Manage the DeepSpace agent skill (Claude Code, Codex, OpenCode, Cursor, ...)"
+  },
+  subCommands: {
+    add
+  }
+});
+
+// src/cli/commands/domain.ts
+import { defineCommand as defineCommand13 } from "citty";
 import { execSync as execSync4 } from "child_process";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
-import { join as join11, resolve as resolve7 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
+import { join as join13, resolve as resolve7 } from "path";
 import { parse as parseToml4 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join11(resolve7(cwd), "wrangler.toml");
-  if (!existsSync11(wranglerPath)) return null;
+  const wranglerPath = join13(resolve7(cwd), "wrangler.toml");
+  if (!existsSync12(wranglerPath)) return null;
   try {
-    const cfg = parseToml4(readFileSync7(wranglerPath, "utf-8"));
+    const cfg = parseToml4(readFileSync8(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
   } catch {
     return null;
@@ -2235,7 +2377,7 @@ async function confirm3(message) {
     });
   });
 }
-var search = defineCommand12({
+var search = defineCommand13({
   meta: { name: "search", description: "Search for available domains" },
   args: {
     query: { type: "positional", description: "Domain or keyword", required: true },
@@ -2265,7 +2407,7 @@ var search = defineCommand12({
     }
   }
 });
-var buy = defineCommand12({
+var buy = defineCommand13({
   meta: { name: "buy", description: "Buy a domain and attach it to an app" },
   args: {
     domain: { type: "positional", description: "Domain to buy", required: true },
@@ -2354,7 +2496,7 @@ var buy = defineCommand12({
     process.exit(1);
   }
 });
-var list2 = defineCommand12({
+var list2 = defineCommand13({
   meta: { name: "list", description: "List your domains" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
@@ -2378,7 +2520,7 @@ var list2 = defineCommand12({
     }
   }
 });
-var status = defineCommand12({
+var status = defineCommand13({
   meta: { name: "status", description: "Show details for one domain" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -2406,7 +2548,7 @@ var status = defineCommand12({
     console.log(`Charged:       ${fmtCents(found.chargedCents)}/yr`);
   }
 });
-var attach = defineCommand12({
+var attach = defineCommand13({
   meta: { name: "attach", description: "Re-point a domain at a different app" },
   args: {
     domain: { type: "positional", description: "Domain to re-point", required: true },
@@ -2437,7 +2579,7 @@ var attach = defineCommand12({
     console.log(`\u2713 ${args.domain} now points at ${targetApp}`);
   }
 });
-var detach = defineCommand12({
+var detach = defineCommand13({
   meta: {
     name: "detach",
     description: "Stop routing the domain (keeps the registration; auto-renew unchanged)"
@@ -2467,7 +2609,7 @@ var detach = defineCommand12({
     console.log(`\u2713 ${args.domain} detached. Use \`deepspace domain attach\` to re-route, or \`renew --auto off\` to stop auto-renewal.`);
   }
 });
-var renew = defineCommand12({
+var renew = defineCommand13({
   meta: { name: "renew", description: "Toggle auto-renewal at the registrar" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -2501,16 +2643,16 @@ function openBrowser2(url) {
   } catch {
   }
 }
-var domain_default = defineCommand12({
+var domain_default = defineCommand13({
   meta: { name: "domain", description: "Buy and manage custom domains" },
   subCommands: { search, buy, list: list2, status, attach, detach, renew }
 });
 
 // src/cli/commands/integrations.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -2531,7 +2673,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync8(0, "utf-8") : readFileSync8(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync9(0, "utf-8") : readFileSync9(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -2681,7 +2823,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list3 = defineCommand13({
+var list3 = defineCommand14({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -2702,7 +2844,7 @@ var list3 = defineCommand13({
     }
   }
 });
-var info = defineCommand13({
+var info = defineCommand14({
   meta: {
     name: "info",
     description: "Print schema + example body for an integration endpoint"
@@ -2728,7 +2870,7 @@ var info = defineCommand13({
     }
   }
 });
-var invoke = defineCommand13({
+var invoke = defineCommand14({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -2781,7 +2923,7 @@ var invoke = defineCommand13({
     }
   }
 });
-var integrations_default = defineCommand13({
+var integrations_default = defineCommand14({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
@@ -2794,8 +2936,8 @@ var integrations_default = defineCommand13({
 });
 
 // src/cli/commands/invoke.ts
-import { defineCommand as defineCommand14 } from "citty";
-var invoke_default = defineCommand14({
+import { defineCommand as defineCommand15 } from "citty";
+var invoke_default = defineCommand15({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -2868,7 +3010,7 @@ var invoke_default = defineCommand14({
 });
 
 // src/cli/commands/managed-repos.ts
-import { defineCommand as defineCommand15 } from "citty";
+import { defineCommand as defineCommand16 } from "citty";
 var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var SIMPLE_APP_ID = /^[a-z0-9][a-z0-9_.:-]{0,119}$/i;
 var SIMPLE_APP_NAME = /^[a-z0-9][a-z0-9_-]{0,119}$/i;
@@ -2927,7 +3069,7 @@ async function confirm4(message) {
     });
   });
 }
-var list4 = defineCommand15({
+var list4 = defineCommand16({
   meta: {
     name: "list",
     description: "List your DeepSpace-managed repos and quota"
@@ -2957,7 +3099,7 @@ var list4 = defineCommand15({
     }
   }
 });
-var create2 = defineCommand15({
+var create2 = defineCommand16({
   meta: {
     name: "create",
     description: "Create a private DeepSpace-managed GitHub repo"
@@ -3009,7 +3151,7 @@ var create2 = defineCommand15({
     printRepo(result.repo);
   }
 });
-var token = defineCommand15({
+var token = defineCommand16({
   meta: {
     name: "token",
     description: "Mint a short-lived GitHub token for a DeepSpace-managed repo"
@@ -3044,7 +3186,7 @@ var token = defineCommand15({
     console.log(`Clone:     git clone https://x-access-token:${encodeURIComponent(result.token.token)}@github.com/${result.repo.fullName}.git`);
   }
 });
-var remove = defineCommand15({
+var remove = defineCommand16({
   meta: {
     name: "delete",
     description: "Delete a DeepSpace-managed GitHub repo"
@@ -3097,7 +3239,7 @@ var remove = defineCommand15({
     );
   }
 });
-var managed_repos_default = defineCommand15({
+var managed_repos_default = defineCommand16({
   meta: {
     name: "managed-repos",
     description: "Create and manage DeepSpace-owned GitHub repos"
@@ -3111,13 +3253,13 @@ var managed_repos_default = defineCommand15({
 });
 
 // src/cli/commands/library.ts
-import { defineCommand as defineCommand16 } from "citty";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join12, resolve as resolve8 } from "path";
+import { defineCommand as defineCommand17 } from "citty";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
+import { join as join14, resolve as resolve8 } from "path";
 import { parse as parseToml5 } from "smol-toml";
 import * as p6 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var publish = defineCommand16({
+var publish = defineCommand17({
   meta: {
     name: "publish",
     description: "Publish the current app to the DeepSpace library"
@@ -3191,11 +3333,11 @@ var publish = defineCommand16({
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
       const appDir = resolve8(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join12(appDir, "wrangler.toml");
-      if (!existsSync12(wranglerPath)) {
+      const wranglerPath = join14(appDir, "wrangler.toml");
+      if (!existsSync13(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml5(readFileSync9(wranglerPath, "utf-8"));
+      const cfg = parseToml5(readFileSync10(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -3256,7 +3398,7 @@ var publish = defineCommand16({
     p6.outro("Done");
   }
 });
-var unpublish = defineCommand16({
+var unpublish = defineCommand17({
   meta: {
     name: "unpublish",
     description: "Remove a library entry (owner or admin only)"
@@ -3315,7 +3457,7 @@ var unpublish = defineCommand16({
     p6.outro("Done");
   }
 });
-var library_default = defineCommand16({
+var library_default = defineCommand17({
   meta: {
     name: "library",
     description: "Manage your DeepSpace library entries"
@@ -3326,13 +3468,85 @@ var library_default = defineCommand16({
   }
 });
 
+// src/cli/commands/admin.ts
+import { defineCommand as defineCommand18 } from "citty";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join15 } from "path";
+var AUTH_URL5 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
+var impersonate = defineCommand18({
+  meta: {
+    name: "impersonate",
+    description: "Store a short-lived CLI token for another user"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Target user email",
+      required: false
+    },
+    userId: {
+      type: "string",
+      description: "Target user id",
+      required: false
+    },
+    secret: {
+      type: "string",
+      description: "Admin secret; defaults to DEEPSPACE_ADMIN_SECRET",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const secret = args.secret ?? process.env.DEEPSPACE_ADMIN_SECRET;
+    if (!secret) {
+      console.error("Missing admin secret. Set DEEPSPACE_ADMIN_SECRET or pass --secret.");
+      process.exit(1);
+    }
+    if (!args.email && !args.userId) {
+      console.error("Pass --email or --userId.");
+      process.exit(1);
+    }
+    const res = await fetch(`${AUTH_URL5}/api/auth/admin/impersonate`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${secret}`
+      },
+      body: JSON.stringify({
+        email: args.email,
+        userId: args.userId
+      })
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || !data.token || !data.user) {
+      console.error(`Failed: ${data.error ?? `HTTP ${res.status}`}`);
+      process.exit(1);
+    }
+    const dir = join15(homedir6(), ".deepspace");
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync5(TOKEN_PATH2, data.token, { mode: 384 });
+    console.log(`Impersonating ${data.user.name ?? data.user.email ?? data.user.id}`);
+    console.log(`Email:  ${data.user.email ?? "(none)"}`);
+    console.log(`UserID: ${data.user.id}`);
+  }
+});
+var admin_default = defineCommand18({
+  meta: {
+    name: "admin",
+    description: "Maintainer-only admin commands"
+  },
+  subCommands: {
+    impersonate
+  }
+});
+
 // src/cli/cli.ts
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync10(join13(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync13("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync11(join16(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create3 = defineCommand17({
+var create3 = defineCommand19({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -3351,7 +3565,7 @@ var create3 = defineCommand17({
     execSync5(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand17({
+var main = defineCommand19({
   meta: {
     name: "deepspace",
     version: pkg.version,
@@ -3368,13 +3582,15 @@ var main = defineCommand17({
     screenshot: screenshot_default,
     "test-accounts": test_accounts_default,
     add: add_default,
+    skills: skills_default,
     integrations: integrations_default,
     "managed-repos": managed_repos_default,
     invoke: invoke_default,
     deploy: deploy_default,
     undeploy: undeploy_default,
     domain: domain_default,
-    library: library_default
+    library: library_default,
+    admin: admin_default
   }
   // No `run()` here — citty cascades parent run() AFTER subcommand finishes,
   // which corrupts agent-friendly output (`--json`) and prints noise on every