firth 0.0.1 → 0.0.2

package/README.md

@@ -1,76 +1,75 @@
-# firth-cli
+# firth
 
-> The runtime CLI for [Firth](https://github.com/firthdev/firth) — the cloud platform SDK for AI coding agents.
+The **Firth CLI** — provision and govern a project's cloud resources (Neon Postgres,
+Tigris storage, Fly.io compute) behind one CLI and one credential seam. It is a thin
+client of the Firth control-plane API; you sign in, create a project (which provisions
+the resources under Firth's own provider accounts), and pull a complete `.env` of
+scoped, encrypted-at-rest credentials.
 
-**Status:** Pre-alpha. v0.0.1 ships only `firth init` (project scaffolding).
-
-This repo is the **L2 / CLI layer** of the Firth project. The companion repo [`firth`](https://github.com/firthdev/firth) holds the L1 / Knowledge layer (Skills, templates, runbooks, ARCHITECTURE.md).
-
-For the project's overall design and rationale, see [`firth/ARCHITECTURE.md`](https://github.com/firthdev/firth/blob/main/ARCHITECTURE.md). This README is just for the CLI itself.
-
-## Local development
+## Install
 
 ```bash
-# from this directory
-npm install
-
-# run the CLI in dev (no build step)
-npm run dev -- init
-
-# typecheck
-npm run typecheck
-
-# tests
-npm test
-
-# build a distributable
-npm run build
-
-# link into your shell so `firth` works globally during dev
-npm link
-firth init my-test-app
+npm install -g firth
+# or run without installing
+npx firth --help
 ```
 
-## Commands (current)
-
-### `firth init [name]`
+Requires Node ≥ 20.
 
-Scaffold a Firth project. Generates `firth.config.ts` and `firth.lock.json`.
+## Quickstart
 
 ```bash
-# interactive
-firth init my-app
+firth login                      # sign in (email/password)
+firth project create my-app      # provision DB + storage + compute; links ./.firth/project.json
+firth branch create dev          # fork an isolated DB branch (storage shared; compute redeploys)
+firth branch switch dev          # make dev the current branch
+firth secrets                    # write the project's credentials into ./.env
+firth deploy --image <url>       # deploy a container image to the project's compute
+firth events                     # the action ↔ side-effect timeline
+```
 
-# in current directory
-firth init .
+> **Connectivity:** the CLI talks to the Firth control-plane API. Set `FIRTH_API_URL`
+> (default `http://localhost:8080`) to point at your control plane. While Firth is
+> pre-release, run the control plane locally and target `http://localhost:8080`.
 
-# non-interactive (agent-friendly): use defaults
-firth init my-app --yes
+## Commands
 
-# non-interactive with explicit overrides
-firth init my-app --frontend=nextjs --backend=hono --db=neon \
-  --frontend-host=vercel --backend-host=railway --yes
+```
+login                     Sign in (email/password)
+logout                    Clear stored credentials
+status                    Show login, linked project, and current branch
+
+project create <name>     Create + link a project (provisions DB/storage/compute)
+project link <id>         Link this directory to a project
+project list              List your projects
+project delete            Delete the linked project + all resources (--yes)
+
+branch create <name>      Create a branch (--from <parent>, default main)
+branch list               List the linked project's branches
+branch switch <name>      Set the current branch (secrets/events default to it)
+branch delete <name>      Delete a branch + its Neon branch (--yes)
+
+secrets                   Fetch the linked project's secrets into .env (--branch <id>)
+deploy                    Deploy --image <url> to the project's compute (--from, --port)
+events                    Show the action ↔ side-effect timeline (--branch, --limit)
+observe sync              Upload local observe-hook findings (.firth/audit.jsonl) to the timeline
+skills pull               Install the firth skill into ./.claude/skills
 ```
 
-Defaults (when `--yes` is passed): Next.js + Hono + Neon Postgres + Vercel + Railway.
-
-## Commands (planned)
-
-- `firth deploy` — provision resources and push code across the stack.
-- `firth secrets set/get/list` — sync secrets across providers.
-- `firth logs [--service]` — tail logs.
-- `firth status` — current deployment + resource state.
-- `firth handoff` — generate a context dump for a fresh agent session.
-- `firth db migrate / db reset` — database lifecycle.
+## Configuration & state
 
-## Design notes
+- **Global** — `~/.firth/config.json`: API URL, InsForge auth endpoint, and your access token.
+- **Per-project** — `./.firth/project.json`: the linked project id and the current branch
+  (set by `firth branch switch`). `secrets` and `events` default to the current branch.
+- **Override** — `FIRTH_API_URL` selects which control plane to talk to.
 
-- **Thin orchestrator, not a wrapper.** Every command shells out to the official provider CLI/API; we never re-implement provider features.
-- **Agent-friendly errors.** Failures emit `ERROR / LIKELY CAUSE / SUGGESTED ACTIONS` so an agent loop can recover.
-- **Local state lives in the project.** `firth.config.ts` (declarative, hand-edited) + `firth.lock.json` (generated, holds resource IDs) — both committed.
+## Credentials
 
-See [`firth/ARCHITECTURE.md`](https://github.com/firthdev/firth/blob/main/ARCHITECTURE.md) for the full rationale.
+Treat `./.env` as the only source of resource credentials — never hardcode them or copy
+them elsewhere. A branch's `DATABASE_URL` is isolated per branch; storage (`AWS_*`) is
+shared across branches. Re-run `firth secrets` after `firth branch switch` to refresh
+`DATABASE_URL`.
 
 ## License
 
-MIT (planned).
+MIT

package/dist/api.js

@@ -0,0 +1,60 @@
+const realFetcher = async (url, init) => {
+    const res = await fetch(url, { method: init.method, headers: init.headers, body: init.body });
+    return { status: res.status, json: () => res.json(), text: () => res.text() };
+};
+export class FirthApi {
+    apiUrl;
+    token;
+    fetcher;
+    constructor(apiUrl, token, fetcher = realFetcher) {
+        this.apiUrl = apiUrl;
+        this.token = token;
+        this.fetcher = fetcher;
+    }
+    async req(method, path, body) {
+        const res = await this.fetcher(`${this.apiUrl}${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${this.token}`, 'Content-Type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (res.status < 200 || res.status >= 300) {
+            let msg = '';
+            try {
+                msg = (await res.json())?.error ?? '';
+            }
+            catch { /* ignore */ }
+            throw new Error(`request failed: ${res.status}${msg ? ` ${msg}` : ''}`);
+        }
+        return res.json();
+    }
+    createProject(name) { return this.req('POST', '/projects', { name }); }
+    listProjects() { return this.req('GET', '/projects').then((r) => r.projects); }
+    createBranch(projectId, name, from) {
+        return this.req('POST', `/projects/${projectId}/branches`, { name, from });
+    }
+    listBranches(projectId) { return this.req('GET', `/projects/${projectId}/branches`).then((r) => r.branches); }
+    getSecrets(projectId, branch) {
+        const q = branch ? `?branch=${encodeURIComponent(branch)}` : '';
+        return this.req('GET', `/projects/${projectId}/secrets${q}`).then((r) => r.secrets);
+    }
+    deploy(projectId, opts) {
+        return this.req('POST', `/projects/${projectId}/deploy`, opts);
+    }
+    listEvents(projectId, opts = {}) {
+        const qs = new URLSearchParams();
+        if (opts.branch)
+            qs.set('branch', opts.branch);
+        if (opts.limit)
+            qs.set('limit', String(opts.limit));
+        const q = qs.toString();
+        return this.req('GET', `/projects/${projectId}/events${q ? `?${q}` : ''}`).then((r) => r.events);
+    }
+    postEvents(projectId, events) {
+        return this.req('POST', `/projects/${projectId}/events`, { events });
+    }
+    deleteProject(id) { return this.req('DELETE', `/projects/${id}`); }
+    deleteBranch(projectId, branchId) { return this.req('DELETE', `/projects/${projectId}/branches/${branchId}`); }
+    login(email, password) {
+        return this.req('POST', '/auth/login', { email, password });
+    }
+}

package/dist/commands/auth.js

@@ -0,0 +1,35 @@
+import { parseArgs } from 'node:util';
+import { FirthApi } from '../api.js';
+import { readConfig, writeConfig } from '../config.js';
+export async function login(argv, deps) {
+    const { values } = parseArgs({ args: argv, options: { email: { type: 'string' }, password: { type: 'string' }, 'api-url': { type: 'string' } }, allowPositionals: false });
+    const email = values.email ?? deps.env.FIRTH_EMAIL;
+    const password = values.password ?? deps.env.FIRTH_PASSWORD;
+    if (!email || !password) {
+        deps.print('login requires --email and --password (or FIRTH_EMAIL/FIRTH_PASSWORD)');
+        return 1;
+    }
+    const cfg = readConfig(deps.home, deps.env);
+    // --api-url sets the control-plane host for this login and persists it for later commands
+    // (a token is host-specific, so switching hosts means logging in there). Falls back to the
+    // existing config / FIRTH_API_URL env / the built-in default (the deployed control plane).
+    const apiUrl = values['api-url'] ?? cfg.apiUrl;
+    const api = deps.makeApi ? deps.makeApi() : new FirthApi(apiUrl, '');
+    try {
+        const { token } = await api.login(email, password);
+        writeConfig({ ...cfg, apiUrl, token }, deps.home);
+        deps.print(`signed in as ${email} (control plane: ${apiUrl})`);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`login failed: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}
+export async function logout(_argv, deps) {
+    const cfg = readConfig(deps.home, deps.env);
+    delete cfg.token;
+    writeConfig(cfg, deps.home);
+    deps.print('signed out');
+    return 0;
+}

package/dist/commands/branch.js

@@ -0,0 +1,107 @@
+import { parseArgs } from 'node:util';
+import { readProjectLink, setCurrentBranch } from '../config.js';
+import { apiFromDeps } from './project.js';
+import { formatTeardown } from './util.js';
+import { ensureFlyctl } from '../fly.js';
+import { ensureSkills } from '../ensure-skills.js';
+function linkedProject(deps) {
+    const link = readProjectLink(deps.cwd);
+    if (!link)
+        throw new Error('this directory is not linked — run `firth project link <id>` or `firth project create`');
+    return link.projectId;
+}
+export async function branchCreate(argv, deps) {
+    await ensureFlyctl(deps);
+    try {
+        const { values, positionals } = parseArgs({ args: argv, options: { from: { type: 'string' } }, allowPositionals: true });
+        const name = positionals[0];
+        if (!name) {
+            deps.print('usage: firth branch create <name> [--from <parent>]');
+            return 1;
+        }
+        const projectId = linkedProject(deps);
+        const out = await apiFromDeps(deps).createBranch(projectId, name, values.from ?? 'main');
+        deps.print(`created branch ${out.branch.name} (${out.branch.id})`);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}
+export async function branchList(_argv, deps) {
+    try {
+        const projectId = linkedProject(deps);
+        const branches = await apiFromDeps(deps).listBranches(projectId);
+        for (const b of branches)
+            deps.print(`${b.id}  ${b.name}`);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}
+export async function branchSwitch(argv, deps) {
+    await ensureFlyctl(deps);
+    try {
+        const { positionals } = parseArgs({ args: argv, options: {}, allowPositionals: true });
+        const name = positionals[0];
+        if (!name) {
+            deps.print('usage: firth branch switch <name>');
+            return 1;
+        }
+        const projectId = linkedProject(deps);
+        const branches = await apiFromDeps(deps).listBranches(projectId);
+        const target = branches.find((b) => b.name === name || b.id === name);
+        if (!target) {
+            deps.print(`branch "${name}" not found; available: ${branches.map((b) => b.name).join(', ')}`);
+            return 1;
+        }
+        setCurrentBranch({ id: target.id, name: target.name }, deps.cwd);
+        deps.print(`switched to branch ${target.name} (${target.id}) — run \`firth secrets\` to refresh .env`);
+        await ensureSkills(deps);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}
+export async function branchDelete(argv, deps) {
+    try {
+        const { values, positionals } = parseArgs({ args: argv, options: { yes: { type: 'boolean' } }, allowPositionals: true });
+        const name = positionals[0];
+        if (!name) {
+            deps.print('usage: firth branch delete <name>');
+            return 1;
+        }
+        const projectId = linkedProject(deps);
+        const branches = await apiFromDeps(deps).listBranches(projectId);
+        const target = branches.find((b) => b.name === name || b.id === name);
+        if (!target) {
+            deps.print(`branch "${name}" not found; available: ${branches.map((b) => b.name).join(', ')}`);
+            return 1;
+        }
+        if (target.is_default) {
+            deps.print('cannot delete the default branch');
+            return 1;
+        }
+        if (!values.yes) {
+            deps.print(`this destroys branch "${name}" (its Neon branch). re-run with --yes to confirm.`);
+            return 1;
+        }
+        const out = await apiFromDeps(deps).deleteBranch(projectId, target.id);
+        // If the deleted branch is the current one, clear it
+        const link = readProjectLink(deps.cwd);
+        if (link?.branch?.id === target.id) {
+            setCurrentBranch(null, deps.cwd);
+        }
+        deps.print(`deleted branch ${target.name}${formatTeardown(out.teardown ?? {})}`);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}

package/dist/commands/deploy.js

@@ -0,0 +1,22 @@
+import { parseArgs } from 'node:util';
+import { readProjectLink } from '../config.js';
+import { apiFromDeps } from './project.js';
+export async function deploy(argv, deps) {
+    const { values } = parseArgs({ args: argv, options: {
+            image: { type: 'string' }, from: { type: 'string' }, port: { type: 'string' },
+        }, allowPositionals: false });
+    if (!values.image) {
+        deps.print('usage: firth deploy --image <url> [--from <branch>] [--port <n>]');
+        return 1;
+    }
+    const link = readProjectLink(deps.cwd);
+    if (!link) {
+        deps.print('this directory is not linked — run `firth project link <id>`');
+        return 1;
+    }
+    const out = await apiFromDeps(deps).deploy(link.projectId, {
+        image: values.image, from: values.from, port: values.port ? Number(values.port) : undefined,
+    });
+    deps.print(`deployed machine ${out.machineId} → ${out.url}`);
+    return 0;
+}

package/dist/commands/events.js

@@ -0,0 +1,20 @@
+import { parseArgs } from 'node:util';
+import { readProjectLink } from '../config.js';
+import { apiFromDeps } from './project.js';
+export async function events(argv, deps) {
+    const { values } = parseArgs({ args: argv, options: { branch: { type: 'string' }, limit: { type: 'string' } }, allowPositionals: false });
+    const link = readProjectLink(deps.cwd);
+    if (!link) {
+        deps.print('this directory is not linked — run `firth project link <id>`');
+        return 1;
+    }
+    const effectiveBranch = values.branch ?? link.branch?.id;
+    const rows = await apiFromDeps(deps).listEvents(link.projectId, { branch: effectiveBranch, limit: values.limit ? Number(values.limit) : undefined });
+    if (rows.length === 0)
+        deps.print('(no events yet)');
+    for (const e of rows) {
+        const summary = e.payload?.url ?? e.payload?.name ?? e.payload?.machineId ?? '';
+        deps.print(`${e.created_at}  ${e.source.padEnd(8)}  ${e.kind}${summary ? `  ${summary}` : ''}`);
+    }
+    return 0;
+}

package/dist/commands/observe.js

@@ -0,0 +1,33 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readProjectLink } from '../config.js';
+import { apiFromDeps } from './project.js';
+export async function observeSync(_argv, deps) {
+    const link = readProjectLink(deps.cwd);
+    if (!link) {
+        deps.print('this directory is not linked — run `firth project link <id>`');
+        return 1;
+    }
+    const path = join(deps.cwd, '.firth', 'audit.jsonl');
+    if (!existsSync(path)) {
+        deps.print('no audit log found at .firth/audit.jsonl (is the observe hook installed?)');
+        return 0;
+    }
+    const events = readFileSync(path, 'utf8').split('\n').filter((l) => l.trim()).map((line) => {
+        let parsed = {};
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            parsed = { raw: line };
+        }
+        return { source: 'agent', kind: `agent.${parsed.sink ?? parsed.kind ?? 'action'}`, payload: parsed };
+    });
+    if (events.length === 0) {
+        deps.print('audit log is empty — nothing to sync');
+        return 0;
+    }
+    const res = await apiFromDeps(deps).postEvents(link.projectId, events);
+    deps.print(`synced ${res.recorded} agent events to the timeline`);
+    return 0;
+}

package/dist/commands/project.js

@@ -0,0 +1,84 @@
+import { parseArgs } from 'node:util';
+import { readConfig, writeProjectLink, readProjectLink, clearProjectLink, setCurrentBranch } from '../config.js';
+import { FirthApi } from '../api.js';
+import { formatTeardown } from './util.js';
+import { ensureFlyctl } from '../fly.js';
+import { ensureSkills } from '../ensure-skills.js';
+// Build a FirthApi from stored config; tests can override via deps.makeApi.
+export function apiFromDeps(deps) {
+    if (deps.makeApi)
+        return deps.makeApi();
+    const cfg = readConfig(deps.home, deps.env);
+    if (!cfg.token)
+        throw new Error('not logged in — run `firth login`');
+    return new FirthApi(cfg.apiUrl, cfg.token);
+}
+export async function projectCreate(argv, deps) {
+    await ensureFlyctl(deps);
+    const name = argv[0];
+    if (!name) {
+        deps.print('usage: firth project create <name>');
+        return 1;
+    }
+    const out = await apiFromDeps(deps).createProject(name);
+    writeProjectLink(out.project.id, deps.cwd);
+    // start on the project's default branch so later commands target it without a manual `branch switch`
+    setCurrentBranch({ id: out.defaultBranch.id, name: out.defaultBranch.name }, deps.cwd);
+    deps.print(`created project ${out.project.name} (${out.project.id}); linked + on branch ${out.defaultBranch.name}`);
+    await ensureSkills(deps);
+    return 0;
+}
+export async function projectLink(argv, deps) {
+    await ensureFlyctl(deps);
+    const id = argv[0];
+    if (!id) {
+        deps.print('usage: firth project link <id>');
+        return 1;
+    }
+    writeProjectLink(id, deps.cwd);
+    // best-effort: switch to the project's default branch so later commands target main without a manual
+    // `branch switch`. If we can't reach the API (not logged in / offline / no access), the id is still linked.
+    let on = '';
+    try {
+        const branches = await apiFromDeps(deps).listBranches(id);
+        const def = branches.find((b) => b.is_default) ?? branches[0];
+        if (def) {
+            setCurrentBranch({ id: def.id, name: def.name }, deps.cwd);
+            on = ` on branch ${def.name}`;
+        }
+    }
+    catch { /* the id is still linked; secrets/events fall back to the default branch */ }
+    deps.print(`linked this directory to project ${id}${on}`);
+    await ensureSkills(deps);
+    return 0;
+}
+export async function projectList(_argv, deps) {
+    const projects = await apiFromDeps(deps).listProjects();
+    if (projects.length === 0)
+        deps.print('(no projects)');
+    for (const p of projects)
+        deps.print(`${p.id}  ${p.name}`);
+    return 0;
+}
+export async function projectDelete(argv, deps) {
+    try {
+        const { values } = parseArgs({ args: argv, options: { yes: { type: 'boolean' } }, allowPositionals: false });
+        const link = readProjectLink(deps.cwd);
+        if (!link) {
+            deps.print('this directory is not linked — run `firth project link <id>` or `firth project create`');
+            return 1;
+        }
+        if (!values.yes) {
+            deps.print(`this permanently destroys the project's Neon DB, Fly app, and storage bucket. re-run with --yes to confirm.`);
+            return 1;
+        }
+        const out = await apiFromDeps(deps).deleteProject(link.projectId);
+        clearProjectLink(deps.cwd);
+        deps.print(`deleted project ${link.projectId}${formatTeardown(out.teardown ?? {})}; unlinked ./.firth/project.json`);
+        return 0;
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}

package/dist/commands/secrets.js

@@ -0,0 +1,44 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseArgs } from 'node:util';
+import { readProjectLink } from '../config.js';
+import { apiFromDeps } from './project.js';
+export async function secrets(argv, deps) {
+    const { values } = parseArgs({ args: argv, options: { branch: { type: 'string' } }, allowPositionals: false });
+    const link = readProjectLink(deps.cwd);
+    if (!link) {
+        deps.print('this directory is not linked — run `firth project link <id>`');
+        return 1;
+    }
+    const api = apiFromDeps(deps);
+    // Resolve the target branch (by name/id, default = the project's default branch).
+    const branches = await api.listBranches(link.projectId);
+    const target = values.branch
+        ? branches.find((b) => b.name === values.branch || b.id === values.branch)
+        : link.branch
+            ? branches.find((b) => b.id === link.branch.id)
+            : (branches.find((b) => b.is_default) ?? branches[0]);
+    if (!target) {
+        deps.print(`branch "${values.branch ?? '(default)'}" not found`);
+        return 1;
+    }
+    // The seam returns EITHER project-scoped (no branch) OR branch-scoped; merge both for a complete .env.
+    const project = await api.getSecrets(link.projectId);
+    const branch = await api.getSecrets(link.projectId, target.id);
+    const bundle = { ...project, ...branch };
+    // Merge Firth-managed keys into any existing .env, preserving user-added lines/comments.
+    const path = join(deps.cwd, '.env');
+    const firthKeys = new Set(Object.keys(bundle));
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const kept = existing.split('\n').filter((line) => {
+        const key = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+        return !(key && firthKeys.has(key)); // drop stale Firth keys; keep user vars/comments/blanks
+    });
+    while (kept.length && kept[kept.length - 1].trim() === '')
+        kept.pop(); // trim trailing blanks
+    const firthLines = Object.entries(bundle).map(([k, v]) => `${k}=${v}`);
+    const merged = [...kept, ...firthLines];
+    writeFileSync(path, merged.length ? merged.join('\n') + '\n' : '');
+    deps.print(`wrote ${firthLines.length} secrets to ${path}`); // values never printed
+    return 0;
+}

package/dist/commands/skills.js

@@ -0,0 +1,18 @@
+import { copyFileSync, mkdirSync, existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export async function skillsPull(_argv, deps) {
+    const here = dirname(fileURLToPath(import.meta.url));
+    // built run: cli/dist/commands -> cli/dist/skills (build copies the top-level skills/ in)
+    // source run: cli/src/commands -> <repo-root>/skills
+    const candidates = [
+        join(here, '..', 'skills', 'firth', 'SKILL.md'),
+        join(here, '..', '..', '..', 'skills', 'firth', 'SKILL.md'),
+    ];
+    const src = candidates.find((p) => existsSync(p)) ?? candidates[candidates.length - 1];
+    const destDir = join(deps.cwd, '.claude', 'skills', 'firth');
+    mkdirSync(destDir, { recursive: true });
+    copyFileSync(src, join(destDir, 'SKILL.md'));
+    deps.print(`installed firth skill → ${join('.claude', 'skills', 'firth', 'SKILL.md')}`);
+    return 0;
+}

package/dist/commands/status.js

@@ -0,0 +1,11 @@
+import { readConfig, readProjectLink } from '../config.js';
+export async function status(_argv, deps) {
+    const cfg = readConfig(deps.home, deps.env);
+    const link = readProjectLink(deps.cwd);
+    deps.print(`api:     ${cfg.apiUrl}`);
+    deps.print(`auth:    ${cfg.token ? 'signed in' : 'not signed in (run `firth login`)'}`);
+    deps.print(`project: ${link ? link.projectId : '(not linked)'}`);
+    const branchLabel = link?.branch ? `${link.branch.name} (${link.branch.id})` : '(default)';
+    deps.print(`branch:  ${branchLabel}`);
+    return 0;
+}

package/dist/commands/util.js

@@ -0,0 +1,11 @@
+export function formatTeardown(t) {
+    let result = '';
+    if (t.destroyed && t.destroyed.length > 0) {
+        result += ` (destroyed: ${t.destroyed.join(', ')})`;
+    }
+    if (t.failed && t.failed.length > 0) {
+        const failedKinds = t.failed.map(f => f.kind).join(', ');
+        result += result ? `; FAILED: ${failedKinds}` : ` FAILED: ${failedKinds}`;
+    }
+    return result;
+}

package/dist/config.js

@@ -0,0 +1,66 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+// Production control plane (InsForge compute). Override with `firth login --api-url`
+// or FIRTH_API_URL=… for local dev against http://localhost:8080.
+const DEFAULT_API = 'https://firth-control-plane-0662c2ef-202a-4feb-8267-5501b3b60037.fly.dev';
+const gpath = (home) => join(home, '.firth', 'config.json');
+const lpath = (cwd) => join(cwd, '.firth', 'project.json');
+export function readConfig(home = homedir(), env = process.env) {
+    let file = {};
+    const p = gpath(home);
+    if (existsSync(p))
+        file = JSON.parse(readFileSync(p, 'utf8'));
+    return { ...file, apiUrl: env.FIRTH_API_URL ?? file.apiUrl ?? DEFAULT_API };
+}
+export function writeConfig(cfg, home = homedir()) {
+    mkdirSync(join(home, '.firth'), { recursive: true });
+    writeFileSync(gpath(home), JSON.stringify(cfg, null, 2));
+}
+export function readProjectLink(cwd = process.cwd()) {
+    const p = lpath(cwd);
+    return existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : null;
+}
+// One-time marker so related-skill installation runs once per linked project, not on every command.
+export function markSkillsInstalled(cwd = process.cwd()) {
+    const link = readProjectLink(cwd);
+    if (!link)
+        return;
+    link.skillsInstalled = true;
+    writeFileSync(lpath(cwd), JSON.stringify(link, null, 2));
+}
+export function writeProjectLink(projectId, cwd = process.cwd()) {
+    mkdirSync(join(cwd, '.firth'), { recursive: true });
+    writeFileSync(lpath(cwd), JSON.stringify({ projectId }, null, 2));
+}
+export function setCurrentBranch(branch, cwd = process.cwd()) {
+    const link = readProjectLink(cwd);
+    if (!link)
+        throw new Error('not linked');
+    if (branch !== null) {
+        link.branch = branch;
+    }
+    else {
+        delete link.branch;
+    }
+    writeFileSync(lpath(cwd), JSON.stringify(link, null, 2));
+}
+export function clearProjectLink(cwd = process.cwd()) {
+    const p = lpath(cwd);
+    if (existsSync(p))
+        unlinkSync(p);
+}
+// Append any missing entries to the project's ./.gitignore (creating it if absent).
+// Idempotent: entries already present are left alone. Returns the entries it added.
+export function ensureGitignore(cwd, entries) {
+    const p = join(cwd, '.gitignore');
+    const existing = existsSync(p) ? readFileSync(p, 'utf8') : '';
+    const have = new Set(existing.split('\n').map((l) => l.trim()));
+    const missing = entries.filter((e) => !have.has(e));
+    if (missing.length === 0)
+        return [];
+    const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+    const block = `${prefix}\n# Firth: agent skills installed by \`firth\` / \`npx skills add\` (regenerable, not source)\n${missing.join('\n')}\n`;
+    writeFileSync(p, existing + block);
+    return missing;
+}

package/dist/ensure-skills.js

@@ -0,0 +1,37 @@
+import { readProjectLink, markSkillsInstalled, ensureGitignore } from './config.js';
+// Where `npx skills add` / `firth skills pull` drop skills, per detected agent.
+// These are regenerable agent context, not the developer's source — keep them out of git.
+const SKILL_DIRS = ['.claude/skills/', '.agents/skills/', '.github/skills/'];
+// Agent skills installed once per linked project so the developer's agent has
+// Neon / Tigris / Firth context. Run via `npx skills add` (vercel-labs/skills).
+const SKILLS = [
+    { label: 'neon-postgres', args: ['skills', 'add', 'neondatabase/agent-skills', '-s', 'neon-postgres'] },
+    { label: 'tigris', args: ['skills', 'add', 'tigrisdata/skills'] },
+    { label: 'firth', args: ['skills', 'add', 'firthstack/firth', '--skill', 'firth'] },
+];
+// Install the related agent skills once per linked project. No-op unless deps.run is set
+// (production wires the real runner; tests inject a fake; other command tests omit it → no-op,
+// so nothing is spawned). Convenience only — never blocks or fails the host command.
+export async function ensureSkills(deps) {
+    const run = deps.run;
+    if (!run)
+        return;
+    try {
+        const link = readProjectLink(deps.cwd);
+        if (!link || link.skillsInstalled)
+            return; // not linked yet, or already done
+        deps.print('installing related agent skills (neon, tigris, firth) via `npx skills add` …');
+        for (const s of SKILLS) {
+            const r = await run('npx', s.args, true); // streamed so the user sees progress
+            deps.print(r.ok ? `  ${s.label} ✓` : `  ${s.label} failed — add manually: npx ${s.args.join(' ')}`);
+        }
+        // keep the installed (regenerable) skill folders out of the developer's git history
+        const added = ensureGitignore(deps.cwd, SKILL_DIRS);
+        if (added.length)
+            deps.print(`  .gitignore += ${added.join(', ')}`);
+        markSkillsInstalled(deps.cwd); // mark done even on partial failure so we don't re-run every command
+    }
+    catch {
+        /* convenience only — never block the command */
+    }
+}

package/dist/fly.js

@@ -0,0 +1,25 @@
+import { spawn } from 'node:child_process';
+export const defaultRunner = (cmd, args, inherit = false) => new Promise((resolve) => {
+    const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+    p.on('error', () => resolve({ ok: false })); // ENOENT etc.
+    p.on('close', (code) => resolve({ ok: code === 0 }));
+});
+// Ensure flyctl is installed. No-op unless deps.run is set (production wires defaultRunner;
+// tests inject a fake; other command tests omit it → this is a no-op so nothing is spawned).
+export async function ensureFlyctl(deps) {
+    const run = deps.run;
+    if (!run)
+        return;
+    try {
+        if ((await run('flyctl', ['version'])).ok)
+            return; // already installed
+        if (!(await run('brew', ['--version'])).ok) { // no Homebrew → just hint
+            deps.print('note: flyctl (fly CLI) not found and Homebrew is unavailable — install it: https://fly.io/docs/flyctl/install/');
+            return;
+        }
+        deps.print('flyctl not found — installing with `brew install flyctl` (one-time)…');
+        const r = await run('brew', ['install', 'flyctl'], true);
+        deps.print(r.ok ? 'flyctl installed ✓' : 'flyctl install failed — install manually: https://fly.io/docs/flyctl/install/');
+    }
+    catch { /* convenience only — never block the command */ }
+}

package/dist/index.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { homedir } from 'node:os';
+import { login, logout } from './commands/auth.js';
+import { projectCreate, projectLink, projectList, projectDelete } from './commands/project.js';
+import { branchCreate, branchList, branchSwitch, branchDelete } from './commands/branch.js';
+import { secrets } from './commands/secrets.js';
+import { skillsPull } from './commands/skills.js';
+import { deploy } from './commands/deploy.js';
+import { events } from './commands/events.js';
+import { observeSync } from './commands/observe.js';
+import { status } from './commands/status.js';
+import { defaultRunner } from './fly.js';
+function readVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        return JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8')).version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const USAGE = `firth <command>
+
+Commands:
+  login                     Sign in (--email, --password; --api-url <url> sets the control-plane host)
+  logout                    Clear stored credentials
+  project create <name>     Create + link a project
+  project link <id>         Link this directory to a project
+  project list              List your projects
+  branch create <name>      Create a branch (--from <parent>, default main)
+  branch list               List the linked project's branches
+  secrets                   Fetch the linked project's secrets into .env (--branch <id>)
+  skills pull               Install the firth skill into ./.claude/skills
+  deploy                    Deploy --image <url> to the project's compute (--from, --port)
+  events                    Show the project's action↔side-effect timeline (--branch, --limit)
+  observe sync              Upload local observe-hook findings (.firth/audit.jsonl) to the timeline
+  status                    Show login, linked project, and current branch
+  project delete            Delete the linked project + all resources (--yes)
+  branch switch <name>      Set the current branch (secrets/events default to it)
+  branch delete <name>      Delete a branch + its Neon branch (--yes)
+  --help                    Show this help
+  --version, -v             Print the CLI version`;
+// Command handlers registered by later tasks. Each: (argv, deps) => Promise<number>.
+export const COMMANDS = {};
+COMMANDS['login'] = login;
+COMMANDS['logout'] = logout;
+COMMANDS['project create'] = projectCreate;
+COMMANDS['project link'] = projectLink;
+COMMANDS['project list'] = projectList;
+COMMANDS['branch create'] = branchCreate;
+COMMANDS['branch list'] = branchList;
+COMMANDS['secrets'] = secrets;
+COMMANDS['skills pull'] = skillsPull;
+COMMANDS['deploy'] = deploy;
+COMMANDS['events'] = events;
+COMMANDS['observe sync'] = observeSync;
+COMMANDS['branch switch'] = branchSwitch;
+COMMANDS['branch delete'] = branchDelete;
+COMMANDS['project delete'] = projectDelete;
+COMMANDS['status'] = status;
+export async function route(argv, deps) {
+    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+        deps.print(USAGE);
+        return 0;
+    }
+    if (argv[0] === '--version' || argv[0] === '-v') {
+        deps.print(readVersion());
+        return 0;
+    }
+    // Support two-word commands ("project create") and one-word ("login").
+    const key2 = argv.length >= 2 ? `${argv[0]} ${argv[1]}` : '';
+    const handler = COMMANDS[key2] ?? COMMANDS[argv[0]];
+    if (!handler) {
+        deps.print(`unknown command: ${argv.join(' ')}\n\n${USAGE}`);
+        return 1;
+    }
+    const rest = COMMANDS[key2] ? argv.slice(2) : argv.slice(1);
+    try {
+        return await handler(rest, deps);
+    }
+    catch (e) {
+        deps.print(`error: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}
+export async function main() {
+    const code = await route(process.argv.slice(2), {
+        print: (s) => console.log(s), home: homedir(), cwd: process.cwd(), env: process.env,
+        run: defaultRunner,
+    });
+    process.exit(code);
+}
+if (process.env.NODE_ENV !== 'test') {
+    void main();
+}

package/dist/skills/README.md

@@ -0,0 +1,58 @@
+# Firth Skills
+
+This directory holds the **Skills bundle** for Firth — Markdown files in the [Anthropic Skills format](https://docs.claude.com) that teach AI coding agents how to operate cloud platforms in the context of a Firth project.
+
+## Layout (planned)
+
+```
+skills/
+├── README.md                       ← you are here
+├── stack-overview/
+│   └── SKILL.md                    ← what stack this project uses, why
+├── deploy-flow/
+│   └── SKILL.md                    ← how `firth deploy` actually works
+├── debug-runbook/
+│   └── SKILL.md                    ← what to do when a deploy / migration / build fails
+├── cost-and-scaling/
+│   └── SKILL.md                    ← free-tier limits, when to scale up, how
+├── handoff/
+│   └── SKILL.md                    ← how to produce a context dump for a fresh agent
+│
+├── neon/                           ← provider-specific Skills
+│   ├── connection-pooling/
+│   │   └── SKILL.md
+│   └── ...
+├── vercel/
+│   └── ...
+├── railway/
+│   └── ...
+└── ...
+```
+
+## Skill format
+
+Each Skill is a single `SKILL.md` file with YAML frontmatter:
+
+```markdown
+---
+name: <skill-name>
+description: <one-line description used by the agent to decide whether to invoke this Skill>
+---
+
+# <Skill title>
+
+<Markdown body — instructions, examples, gotchas, references to firth CLI commands>
+```
+
+See the Anthropic Skills documentation for full schema details.
+
+## Authoring guidelines (early draft)
+
+- **One Skill, one capability.** Don't write a 2,000-line "everything about Vercel" Skill. Split by task: `vercel-deploy`, `vercel-env-vars`, `vercel-debug-build`.
+- **Reference the Firth CLI.** Skills should tell the agent which `firth` command to invoke, not how to call provider APIs directly. Provider-specific knowledge lives behind the CLI.
+- **Include known failure modes.** A Skill is most valuable when it teaches the agent what can go wrong and how to recover.
+- **Keep examples runnable.** Code blocks should be copy-pasteable; agents will execute them.
+
+## Status
+
+Empty for now. The first batch of Skills will land alongside the first golden path (Next.js + Hono + Neon + Vercel + Railway).

package/dist/skills/firth/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: firth
+description: Use when working in a project managed by Firth — provisioning DB/storage/compute, creating/switching/merging branches, deploying, checking status, or wiring app secrets via the firth CLI.
+---
+
+# Firth
+
+Firth provisions and governs a project's cloud resources behind one CLI and one credential seam. The CLI talks **only** to the Firth control plane; you never configure a cloud backend directly.
+
+## Resources Firth provisions
+Every project automatically gets three base resources — build your app directly against them:
+- **Postgres database** (Neon) — your app's relational DB.
+- **S3-compatible storage** (Tigris) — object/blob storage.
+- **Compute** (Fly.io) — where your container runs.
+
+`firth secrets` writes the connection credentials for all three into `./.env`.
+
+## Setup
+- `firth login --email <e> --password <p>` — sign in. Add `--api-url <url>` to target a non-local control plane; it persists for later commands.
+- `firth status` — login state, linked project, current branch.
+- `firth --version`.
+
+## Workflow
+1. **Create or link a project** — you end up linked (`./.firth/project.json`) and on the default branch `main`:
+   - `firth project create <name>` — provisions DB + storage + compute.
+   - `firth project link <id>` — link an existing project.
+2. `firth secrets` — write the current branch's credentials into `./.env`. **This is how an agent gets DB/storage access.** (`--branch <id>` targets a specific branch.)
+3. `firth deploy --image <url>` — deploy a container image to the project's compute (`--port`, `--from`).
+4. `firth events` — the action ↔ resource-side-effect timeline (`--branch`, `--limit`).
+
+## Database & migrations
+You connect **directly** to the Postgres database (the `DATABASE_URL` from `firth secrets` — there is no ORM/abstraction in front of it). Keep a **`migrations/` directory at the project root** to store and track your database migration files, so schema changes are versioned and reproducible — this is essential for applying the same schema to a branch DB and re-applying it on `main` after a merge.
+
+## Branching — isolate risky changes
+Before a high-risk change (schema migration, data backfill, risky refactor), do the work on a **branch**, verify it, then merge back to `main`.
+
+- `firth branch create <name>` creates an **isolated Neon DB branch** — a full copy of the parent's data, isolated from `main` — and gives it its own `DATABASE_URL`.
+  - **Storage and compute are NOT branched.** The storage bucket is **shared** across branches. Compute is the project's **single shared app** (redeploy-to-restore) — to bring up the branch's environment, **redeploy your branch's code** to it (`firth deploy`). Because the compute is shared, deploying a branch redeploys that one app to the branch's code, so only one branch's app runs at a time.
+- `firth branch switch <name>` then `firth secrets` → `./.env` now has the branch's `DATABASE_URL`. Run your migrations against the branch DB and deploy → an isolated branch environment to validate the change.
+
+### Merging a branch back to main
+Firth does **not** auto-merge — you do it in your local code repo:
+1. Merge the branch's frontend + backend **code** into `main`.
+2. Merge the branch's **migration files** into `main`'s `migrations/`.
+3. Switch to main: `firth branch switch main` → `firth secrets`.
+4. Re-run the DB **migrations** against `main`'s database, then **re-deploy** compute: `firth deploy`.
+
+## Delete (destructive — require `--yes`)
+- `firth project delete --yes` — tears down ALL resources (Neon DB, Fly app, Tigris bucket) and unlinks the directory.
+- `firth branch delete <name> --yes` — tears down the branch's Neon branch. The default branch can't be deleted.
+
+## Rules for agents
+- Treat `./.env` as the **only** source of resource credentials — run `firth secrets` to populate it; never hardcode credential values or print them.
+- `DATABASE_URL` is isolated **per branch**; storage credentials (`AWS_*` / `BUCKET_NAME`) are **shared** across branches.
+- Track all DB schema changes as files under `migrations/` so they can be replayed on a branch DB and on `main` after merge.
+- The CLI auto-installs `flyctl` (via Homebrew) when missing during project/branch commands, so the Fly app is manageable directly if needed.

package/package.json

@@ -1,45 +1,20 @@
 {
   "name": "firth",
-  "version": "0.0.1",
-  "description": "Cloud platform SDK for AI coding agents — scaffold, deploy, and operate cloud stacks alongside your AI coding agent.",
+  "version": "0.0.2",
+  "description": "The Firth CLI — provision and govern a project's cloud resources (Neon Postgres, Tigris storage, Fly.io compute) behind one credential seam.",
   "type": "module",
-  "bin": {
-    "firth": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
+  "bin": { "firth": "dist/index.js" },
+  "files": ["dist", "README.md"],
+  "engines": { "node": ">=20" },
+  "license": "MIT",
+  "keywords": ["firth", "cli", "ai-agent", "neon", "tigris", "fly", "deploy", "secrets", "branching"],
+  "repository": { "type": "git", "url": "git+https://github.com/firthstack/firth.git", "directory": "cli" },
   "scripts": {
-    "dev": "tsx src/cli.ts",
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
+    "build": "tsc -p tsconfig.json && node -e \"require('node:fs').cpSync('../skills','dist/skills',{recursive:true})\"",
     "test": "vitest run",
-    "test:watch": "vitest"
-  },
-  "keywords": [
-    "cli",
-    "ai-agent",
-    "deploy",
-    "scaffold",
-    "vercel",
-    "railway",
-    "neon",
-    "firth"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "@clack/prompts": "^0.7.0",
-    "citty": "^0.1.6"
+    "dev": "tsx src/index.ts",
+    "prepublishOnly": "npm run build"
   },
-  "devDependencies": {
-    "@types/node": "^20.11.0",
-    "tsup": "^8.0.2",
-    "tsx": "^4.7.1",
-    "typescript": "^5.4.0",
-    "vitest": "^1.4.0"
-  }
+  "dependencies": { "@insforge/sdk": "^1.4.2" },
+  "devDependencies": { "@types/node": "^20.14.0", "tsx": "^4.16.0", "typescript": "^5.5.0", "vitest": "^2.0.0" }
 }

package/dist/cli.js

@@ -1,183 +0,0 @@
-#!/usr/bin/env node
-
-// src/cli.ts
-import { defineCommand as defineCommand2, runMain } from "citty";
-
-// src/commands/init.ts
-import { defineCommand } from "citty";
-import * as p from "@clack/prompts";
-import { writeFile, mkdir } from "fs/promises";
-import { existsSync } from "fs";
-import { resolve, basename } from "path";
-var initCommand = defineCommand({
-  meta: {
-    name: "init",
-    description: "Scaffold Firth project files (firth.config.ts + firth.lock.json) in the target directory."
-  },
-  args: {
-    name: {
-      type: "positional",
-      description: "Project directory (use '.' for current directory)",
-      required: false,
-      default: "."
-    },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip all prompts; use defaults (Next.js + Hono + Neon + Vercel + Railway). Safe for non-interactive agent runs.",
-      default: false
-    },
-    frontend: {
-      type: "string",
-      description: "Frontend framework override (nextjs)"
-    },
-    backend: {
-      type: "string",
-      description: "Backend framework override (hono | express | none)"
-    },
-    db: {
-      type: "string",
-      description: "Database provider override (neon | none)"
-    },
-    "frontend-host": {
-      type: "string",
-      description: "Frontend host override (vercel | none)"
-    },
-    "backend-host": {
-      type: "string",
-      description: "Backend host override (railway | none)"
-    }
-  },
-  async run({ args }) {
-    const rawName = String(args.name);
-    const targetDir = resolve(process.cwd(), rawName);
-    const projectName = rawName === "." ? basename(targetDir) : basename(targetDir);
-    p.intro("firth init");
-    const configPath = resolve(targetDir, "firth.config.ts");
-    if (existsSync(configPath)) {
-      p.cancel(
-        [
-          "ERROR: firth.config.ts already exists.",
-          `LOCATION: ${configPath}`,
-          "SUGGESTED ACTIONS:",
-          "  1. Edit firth.config.ts by hand to change the stack.",
-          "  2. Or delete firth.config.ts and re-run `firth init`."
-        ].join("\n")
-      );
-      process.exit(1);
-    }
-    const stack = args.yes ? defaultStack() : await promptStack(args);
-    if (!stack) {
-      p.cancel("Cancelled.");
-      process.exit(0);
-    }
-    const config = { project: projectName, stack };
-    const lock = { version: 1, resources: {} };
-    if (!existsSync(targetDir)) {
-      await mkdir(targetDir, { recursive: true });
-    }
-    await writeFile(configPath, renderConfig(config), "utf8");
-    await writeFile(
-      resolve(targetDir, "firth.lock.json"),
-      JSON.stringify(lock, null, 2) + "\n",
-      "utf8"
-    );
-    p.outro(
-      [
-        `OK: wrote firth.config.ts and firth.lock.json to ${targetDir}`,
-        "",
-        "NEXT STEPS:",
-        "  1. Review firth.config.ts and adjust the stack if needed.",
-        "  2. Run `firth deploy` to provision and ship (coming soon)."
-      ].join("\n")
-    );
-  }
-});
-function defaultStack() {
-  return {
-    frontend: "nextjs",
-    backend: "hono",
-    db: "neon",
-    frontendHost: "vercel",
-    backendHost: "railway"
-  };
-}
-async function promptStack(args) {
-  const frontend = args.frontend ?? await p.select({
-    message: "Frontend framework?",
-    options: [{ value: "nextjs", label: "Next.js" }],
-    initialValue: "nextjs"
-  });
-  if (p.isCancel(frontend)) return null;
-  const backend = args.backend ?? await p.select({
-    message: "Backend framework?",
-    options: [
-      { value: "hono", label: "Hono (recommended)" },
-      { value: "express", label: "Express" },
-      { value: "none", label: "None (frontend-only)" }
-    ],
-    initialValue: "hono"
-  });
-  if (p.isCancel(backend)) return null;
-  const db = args.db ?? await p.select({
-    message: "Database?",
-    options: [
-      { value: "neon", label: "Neon Postgres" },
-      { value: "none", label: "None" }
-    ],
-    initialValue: "neon"
-  });
-  if (p.isCancel(db)) return null;
-  const frontendHost = args["frontend-host"] ?? await p.select({
-    message: "Frontend hosting?",
-    options: [
-      { value: "vercel", label: "Vercel" },
-      { value: "none", label: "Not yet" }
-    ],
-    initialValue: "vercel"
-  });
-  if (p.isCancel(frontendHost)) return null;
-  let backendHost;
-  if (backend === "none") {
-    backendHost = "none";
-  } else {
-    const result = args["backend-host"] ?? await p.select({
-      message: "Backend hosting?",
-      options: [
-        { value: "railway", label: "Railway" },
-        { value: "none", label: "Not yet" }
-      ],
-      initialValue: "railway"
-    });
-    if (p.isCancel(result)) return null;
-    backendHost = String(result);
-  }
-  return {
-    frontend: String(frontend),
-    backend: String(backend),
-    db: String(db),
-    frontendHost: String(frontendHost),
-    backendHost
-  };
-}
-function renderConfig(config) {
-  return `// firth.config.ts
-// Generated by \`firth init\`. Source-of-truth for this project's stack.
-// Hand-edit, then run \`firth deploy\` to apply changes.
-
-export default ${JSON.stringify(config, null, 2)};
-`;
-}
-
-// src/cli.ts
-var main = defineCommand2({
-  meta: {
-    name: "firth",
-    version: "0.0.1",
-    description: "Cloud platform SDK for AI coding agents."
-  },
-  subCommands: {
-    init: initCommand
-  }
-});
-runMain(main);