@amerged/ohmyhost-mcp 0.1.10

package/src/apps/product-cli/command.ts

@@ -0,0 +1,1811 @@
+import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
+export type ProductCliCommand =
+  | {
+      readonly kind: "github-connect";
+      readonly organizationId: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "github-status";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-compute-set";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly profile: "standard" | "performance";
+      readonly idempotencyKey: string;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-compute-get";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-context";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-notes-set";
+      readonly projectId: string;
+      readonly markdown: string;
+      readonly expectedVersion: number;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "export-create";
+      readonly projectId: string;
+      readonly idempotencyKey: string;
+      readonly stdin: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "export-get";
+      readonly projectId: string;
+      readonly exportId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "token-create";
+      readonly organizationId: string;
+      readonly name: string;
+      readonly idempotencyKey: string;
+      readonly outputPath: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "token-list";
+      readonly organizationId: string;
+      readonly after?: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "token-revoke";
+      readonly organizationId: string;
+      readonly keyId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "feedback-submit";
+      readonly report: import("@ohmyhost/sdk-ts").FeedbackSubmission;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | { kind: "billing-recharge-get"; organizationId: string; credentialStore: "native" }
+  | ({ kind: "billing-recharge-set"; credentialStore: "native" } & {
+      organizationId: string;
+      enabled: boolean;
+      monthlyLimitMinor: number;
+      consent: "off_session_v1" | null;
+      revision: number;
+      idempotencyKey: string;
+    })
+  | {
+      readonly kind: "billing-checkout";
+      readonly organizationId: string;
+      readonly offer: "topup" | "paid";
+      readonly packs: number;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "billing-status";
+      readonly organizationId: string;
+      readonly checkoutId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "billing-portal";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "credits-usage";
+      readonly organizationId: string;
+      readonly month: string;
+      readonly cursor?: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "credits-account";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "credits-balance";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
+  | { readonly kind: "budget-get"; readonly projectId: string; readonly credentialStore: "native" }
+  | {
+      readonly kind: "budget-set";
+      readonly projectId: string;
+      readonly amountMicros: string | null;
+      readonly mode: "continue" | "stop";
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | { readonly kind: "help"; readonly topic?: string }
+  | { readonly kind: "version" }
+  | { readonly kind: "whoami"; readonly credentialStore: "native" }
+  | {
+      readonly kind: "organization-create";
+      readonly signupSource?: string;
+      readonly name: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | { readonly kind: "organization-list"; readonly credentialStore: "native" }
+  | {
+      readonly kind: "organization-use";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "init";
+      readonly directory: string;
+      readonly project?: string;
+      readonly root?: string;
+      /** The hosting region of the project the repository deploys to; `us` when unknown. */
+      readonly region?: "us" | "eu";
+      readonly dryRun: boolean;
+    }
+  | {
+      readonly kind: "login";
+      readonly organizationId?: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "logout";
+      readonly revoke: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "operation-get";
+      readonly operationId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "operation-reconcile";
+      readonly operationId: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-create";
+      readonly organizationId: string;
+      readonly name: string;
+      readonly dataMode?: "shared" | "isolated";
+      readonly region?: "us" | "eu";
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-list";
+      readonly cursor?: string;
+      readonly limit: number;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-dev-access-create";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-write";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly statementFile: string;
+      readonly parameters: readonly import("@ohmyhost/contracts/database-access").DatabaseJson[];
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-query";
+      readonly environment: "dev" | "prod";
+      readonly projectId: string;
+      readonly statement: string;
+      readonly parameters: readonly (string | number | boolean | null)[];
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-access-create";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly mode: "read" | "write";
+      readonly ttlSeconds: number;
+      readonly label: string | null;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-access-list";
+      readonly projectId: string;
+      readonly environment?: "dev" | "prod";
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-access-revoke";
+      readonly projectId: string;
+      readonly accessId: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-psql";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly mode: "read" | "write";
+      readonly ttlSeconds: number;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "link";
+      readonly projectId: string;
+      readonly repositoryOwner: string;
+      readonly repositoryName: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-auto-deploy-set";
+      readonly projectId: string;
+      readonly branch: string;
+      readonly enabled: boolean;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-auto-deploy-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "plan";
+      readonly projectId: string;
+      readonly commitSha: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "deploy";
+      readonly projectId: string;
+      readonly planId: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "logs";
+      readonly operationId: string;
+      readonly follow: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "deployment-logs";
+      readonly projectId: string;
+      readonly deploymentId: string;
+      readonly follow: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "rollback-plan";
+      readonly projectId: string;
+      readonly deploymentId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "rollback";
+      readonly projectId: string;
+      readonly deploymentId: string;
+      readonly ifMatch: string;
+      readonly confirmationToken: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "promotion-plan";
+      readonly projectId: string;
+      readonly sourceDeploymentId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "promote";
+      readonly projectId: string;
+      readonly sourceDeploymentId: string;
+      readonly ifMatch: string;
+      readonly confirmationToken: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "delete-plan";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "delete";
+      readonly projectId: string;
+      readonly ifMatch: string;
+      readonly confirmationToken: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "secret-list";
+      readonly projectId: string;
+      readonly environmentId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "function-runs";
+      readonly projectId: string;
+      readonly environmentId: string;
+      readonly limit: number;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "secret-set";
+      readonly projectId: string;
+      readonly environmentId: string;
+      readonly name: string;
+      readonly idempotencyKey: string;
+      readonly stdin: true;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "secret-delete";
+      readonly projectId: string;
+      readonly environmentId: string;
+      readonly name: string;
+      readonly idempotencyKey: string;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "mail-domain-set";
+      readonly projectId: string;
+      readonly domain: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "mail-domain-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "domain-cloudflare-authorize";
+      readonly projectId: string;
+      readonly zone: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "domain-cloudflare-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "domain-cloudflare-apply";
+      readonly projectId: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly wait: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "paid-domain-plan";
+      readonly projectId: string;
+      readonly hostname: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "paid-domain-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "paid-domain-apply";
+      readonly projectId: string;
+      readonly hostname: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "paid-domain-delete";
+      readonly projectId: string;
+      readonly hostname: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    };
+
+export class InvalidCommandError extends Error {
+  public constructor() {
+    super("The command arguments are invalid.");
+    this.name = "InvalidCommandError";
+  }
+}
+
+export type RecognizedCommandLabel =
+  | "database compute set"
+  | "database compute get"
+  | "project context"
+  | "project notes set"
+  | "export create"
+  | "export get"
+  | "billing recharge get"
+  | "billing recharge set"
+  | "billing checkout"
+  | "billing status"
+  | "billing portal"
+  | "unknown"
+  | "help"
+  | "version"
+  | "whoami"
+  | "credits account"
+  | "credits balance"
+  | "credits usage"
+  | "budget get"
+  | "budget set"
+  | "init"
+  | "login"
+  | "logout"
+  | "operation get"
+  | "operation reconcile"
+  | "token create"
+  | "token list"
+  | "token revoke"
+  | "feedback submit"
+  | "project create"
+  | "organization create"
+  | "organization list"
+  | "organization use"
+  | "github connect"
+  | "github status"
+  | "project list"
+  | "project status"
+  | "project dev-access create"
+  | "database write"
+  | "database query"
+  | "database access create"
+  | "database access list"
+  | "database access revoke"
+  | "database psql"
+  | "link"
+  | "source auto-deploy set"
+  | "source auto-deploy status"
+  | "domain cloudflare authorize"
+  | "domain cloudflare status"
+  | "domain cloudflare apply"
+  | "domain paid plan"
+  | "domain paid apply"
+  | "domain paid status"
+  | "domain paid delete"
+  | "plan"
+  | "deploy"
+  | "logs"
+  | "deployment logs"
+  | "rollback plan"
+  | "rollback"
+  | "deployment promote plan"
+  | "deployment promote"
+  | "delete plan"
+  | "delete"
+  | "secret list"
+  | "function runs"
+  | "secret set"
+  | "secret delete"
+  | "mail domain set"
+  | "mail domain status";
+
+export const recognizedCommandLabel = (argv: readonly string[]): RecognizedCommandLabel => {
+  const values = [...argv];
+  if (values.includes("--help")) return "help";
+  if (values.includes("--version")) return "version";
+  while (values.length > 0) {
+    const value = values.shift();
+    if (
+      value === "--json" ||
+      value === "--dry-run" ||
+      value === "--revoke" ||
+      value === "--yes" ||
+      value === "--wait" ||
+      value === "--follow" ||
+      value === "--stdin"
+    ) {
+      continue;
+    }
+    if (
+      value === "help" ||
+      value === "version" ||
+      value === "whoami" ||
+      value === "init" ||
+      value === "login" ||
+      value === "logout"
+    )
+      return value;
+    if (value === "github" && values[0] === "connect") return "github connect";
+    if (value === "github" && values[0] === "status") return "github status";
+    if (value === "operation" && values[0] === "get") return "operation get";
+    if (value === "credits" && values[0] === "account") return "credits account";
+    if (value === "credits" && values[0] === "balance") return "credits balance";
+    if (value === "billing" && values[0] === "recharge" && values[1] === "get")
+      return "billing recharge get";
+    if (value === "billing" && values[0] === "recharge" && values[1] === "set")
+      return "billing recharge set";
+    if (value === "billing" && values[0] === "checkout") return "billing checkout";
+    if (value === "billing" && values[0] === "status") return "billing status";
+    if (value === "billing" && values[0] === "portal") return "billing portal";
+    if (value === "credits" && values[0] === "usage") return "credits usage";
+    if (value === "budget" && values[0] === "get") return "budget get";
+    if (value === "budget" && values[0] === "set") return "budget set";
+    if (value === "operation" && values[0] === "reconcile") return "operation reconcile";
+    if (value === "token" && ["create", "list", "revoke"].includes(values[0] ?? ""))
+      return `token ${values[0]}` as RecognizedCommandLabel;
+    if (value === "export" && (values[0] === "create" || values[0] === "get"))
+      return `export ${values[0]}`;
+    if (value === "feedback" && values[0] === "submit") return "feedback submit";
+    if (value === "project" && values[0] === "create") return "project create";
+    if (value === "organization" && values[0] === "create") return "organization create";
+    if (value === "organization" && values[0] === "list") return "organization list";
+    if (value === "organization" && values[0] === "use") return "organization use";
+    if (value === "project" && values[0] === "list") return "project list";
+    if (value === "project" && values[0] === "context") return "project context";
+    if (value === "project" && values[0] === "notes" && values[1] === "set")
+      return "project notes set";
+    if (value === "project" && values[0] === "status") return "project status";
+    if (value === "project" && values[0] === "dev-access" && values[1] === "create")
+      return "project dev-access create";
+    if (value === "database" && values[0] === "compute" && values[1] === "set")
+      return "database compute set";
+    if (value === "database" && values[0] === "compute" && values[1] === "get")
+      return "database compute get";
+    if (value === "database" && values[0] === "write") return "database write";
+    if (value === "database" && values[0] === "query") return "database query";
+    if (value === "database" && values[0] === "access") {
+      if (values[1] === "create") return "database access create";
+      if (values[1] === "list") return "database access list";
+      if (values[1] === "revoke") return "database access revoke";
+    }
+    if (value === "database" && values[0] === "psql") return "database psql";
+    if (value === "link" || value === "plan" || value === "deploy" || value === "logs")
+      return value;
+    if (value === "source" && values[0] === "auto-deploy") {
+      if (values[1] === "set") return "source auto-deploy set";
+      if (values[1] === "status") return "source auto-deploy status";
+    }
+    if (value === "domain" && values[0] === "cloudflare") {
+      if (values[1] === "authorize") return "domain cloudflare authorize";
+      if (values[1] === "status") return "domain cloudflare status";
+      if (values[1] === "apply") return "domain cloudflare apply";
+    }
+    if (value === "domain" && values[0] === "paid") {
+      if (values[1] === "plan") return "domain paid plan";
+      if (values[1] === "apply") return "domain paid apply";
+      if (values[1] === "status") return "domain paid status";
+      if (values[1] === "delete") return "domain paid delete";
+    }
+    if (value === "rollback") return values[0] === "plan" ? "rollback plan" : "rollback";
+    if (value === "deployment" && values[0] === "promote")
+      return values[1] === "plan" ? "deployment promote plan" : "deployment promote";
+    if (value === "deployment" && values[0] === "logs") return "deployment logs";
+    if (value === "delete") return values[0] === "plan" ? "delete plan" : "delete";
+    if (value === "secret") {
+      if (values[0] === "list") return "secret list";
+      if (values[0] === "set") return "secret set";
+      if (values[0] === "delete") return "secret delete";
+    }
+    if (value === "function" && values[0] === "runs") return "function runs";
+    if (value === "mail" && values[0] === "domain") {
+      if (values[1] === "set") return "mail domain set";
+      if (values[1] === "status") return "mail domain status";
+    }
+    return "unknown";
+  }
+  return "unknown";
+};
+
+export const parseProductCliCommand = (argv: readonly string[]): ProductCliCommand => {
+  const values = [...argv];
+  removeFlag(values, "--json");
+  const help = removeFlag(values, "--help");
+  if ((values.length === 1 && values[0] === "help") || values.length === 0) {
+    return { kind: "help" };
+  }
+  if (help) {
+    const topic = recognizedCommandLabel(values);
+    if (topic === "unknown" || topic === "version" || topic !== values.join(" "))
+      throw new InvalidCommandError();
+    return { kind: "help", topic };
+  }
+  if (values.length === 1 && (values[0] === "--version" || values[0] === "version")) {
+    return { kind: "version" };
+  }
+  const dryRun = removeFlag(values, "--dry-run");
+  const credentialStore = "native" as const;
+  const revoke = removeFlag(values, "--revoke");
+  const yes = removeFlag(values, "--yes");
+  const wait = removeFlag(values, "--wait");
+  const follow = removeFlag(values, "--follow");
+  const stdin = removeFlag(values, "--stdin");
+  const first = values.shift();
+  if (
+    first === "whoami" &&
+    !dryRun &&
+    !revoke &&
+    !yes &&
+    !wait &&
+    !follow &&
+    !stdin &&
+    values.length === 0
+  ) {
+    return { kind: "whoami", credentialStore };
+  }
+  if (first === "init") {
+    if (revoke || yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--directory",
+      "--project",
+      "--root",
+      "--region",
+    ]);
+    const region = options["--region"];
+    if (region !== undefined && region !== "us" && region !== "eu") throw new InvalidCommandError();
+    return {
+      kind: "init",
+      directory: options["--directory"] ?? ".",
+      project: options["--project"],
+      root: options["--root"],
+      ...(region === undefined ? {} : { region }),
+      dryRun,
+    };
+  }
+  if (dryRun) throw new InvalidCommandError();
+  if (first === "login" && !revoke && !yes && !wait && !follow && !stdin) {
+    const options = parseOptionalOptions(values, ["--organization"]);
+    const organizationId = options["--organization"];
+    if (organizationId !== undefined && !ORGANIZATION_ULID.test(organizationId))
+      throw new InvalidCommandError();
+    return {
+      kind: "login",
+      ...(organizationId === undefined ? {} : { organizationId }),
+      credentialStore,
+    };
+  }
+  if (first === "logout") {
+    if (!yes && !wait && !follow && !stdin && values.length === 0)
+      return { kind: "logout", revoke, credentialStore };
+  }
+  if (revoke) throw new InvalidCommandError();
+  if (first === "token") {
+    if (wait || follow || stdin) throw new InvalidCommandError();
+    const sub = values.shift();
+    const options = parseOptionalOptions(
+      values,
+      sub === "create"
+        ? ["--organization", "--name", "--idempotency-key", "--out"]
+        : sub === "list"
+          ? ["--organization", "--after"]
+          : ["--organization", "--key"],
+    );
+    const organizationId = options["--organization"];
+    if (!organizationId || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(organizationId))
+      throw new InvalidCommandError();
+    if (sub === "create" && !yes) {
+      const name = options["--name"],
+        idempotencyKey = options["--idempotency-key"],
+        outputPath = options["--out"];
+      if (
+        !name ||
+        name.trim() !== name ||
+        name.length > 64 ||
+        /\p{Cc}/u.test(name) ||
+        !idempotencyKey ||
+        !/^[A-Za-z0-9._:-]{1,128}$/u.test(idempotencyKey) ||
+        !outputPath
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "token-create",
+        organizationId,
+        name,
+        idempotencyKey,
+        outputPath,
+        credentialStore,
+      };
+    }
+    if (sub === "list" && !yes) {
+      const after = options["--after"];
+      if (after !== undefined && !USER_API_KEY_ID.test(after)) throw new InvalidCommandError();
+      return {
+        kind: "token-list",
+        organizationId,
+        ...(after === undefined ? {} : { after }),
+        credentialStore,
+      };
+    }
+    if (sub === "revoke" && yes && options["--key"] && USER_API_KEY_ID.test(options["--key"]))
+      return { kind: "token-revoke", organizationId, keyId: options["--key"], credentialStore };
+    throw new InvalidCommandError();
+  }
+  if (first === "feedback" && values.shift() === "submit") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--organization",
+      "--kind",
+      "--title",
+      "--description",
+      "--project",
+      "--environment",
+      "--operation",
+      "--error-code",
+      "--client-version",
+      "--idempotency-key",
+    ]);
+    const organization = options["--organization"],
+      kind = options["--kind"],
+      title = options["--title"],
+      description = options["--description"],
+      key = options["--idempotency-key"];
+    if (
+      !organization ||
+      !title ||
+      !description ||
+      !key ||
+      (kind !== "bug" && kind !== "issue" && kind !== "feature_request")
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "feedback-submit",
+      credentialStore,
+      idempotencyKey: key,
+      report: {
+        organization_id: organization,
+        kind,
+        title,
+        description,
+        ...(options["--project"] === undefined ? {} : { project_id: options["--project"] }),
+        ...(options["--environment"] === undefined
+          ? {}
+          : { environment_id: options["--environment"] }),
+        ...(options["--operation"] === undefined ? {} : { operation_id: options["--operation"] }),
+        ...(options["--error-code"] === undefined ? {} : { error_code: options["--error-code"] }),
+        ...(options["--client-version"] === undefined
+          ? {}
+          : { client_version: options["--client-version"] }),
+      },
+    };
+  }
+  if (first === "billing") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const sub = values.shift();
+    if (sub === "recharge") {
+      const action = values.shift();
+      if (action === "get") {
+        const o = parseOptions(values, ["--organization"]);
+        return {
+          kind: "billing-recharge-get",
+          organizationId: o["--organization"],
+          credentialStore,
+        };
+      }
+      if (action !== "set") throw new InvalidCommandError();
+      const o = parseOptionalOptions(values, [
+        "--organization",
+        "--enabled",
+        "--monthly-limit-minor",
+        "--consent",
+        "--revision",
+        "--idempotency-key",
+      ]);
+      const limit = Number(o["--monthly-limit-minor"]),
+        revision = Number(o["--revision"]);
+      if (
+        !o["--organization"] ||
+        !o["--idempotency-key"] ||
+        !["true", "false"].includes(o["--enabled"] ?? "") ||
+        !Number.isSafeInteger(limit) ||
+        limit < 1000 ||
+        limit > 100000 ||
+        !o["--revision"] ||
+        !Number.isSafeInteger(revision) ||
+        revision < 0 ||
+        (o["--enabled"] === "true"
+          ? o["--consent"] !== "off_session_v1"
+          : o["--consent"] !== undefined)
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "billing-recharge-set",
+        organizationId: o["--organization"],
+        enabled: o["--enabled"] === "true",
+        monthlyLimitMinor: limit,
+        consent: o["--enabled"] === "true" ? "off_session_v1" : null,
+        revision,
+        idempotencyKey: o["--idempotency-key"],
+        credentialStore,
+      };
+    }
+    if (sub === "portal") {
+      const options = parseOptions(values, ["--organization"]);
+      return { kind: "billing-portal", organizationId: options["--organization"], credentialStore };
+    }
+    if (sub === "status") {
+      const options = parseOptions(values, ["--organization", "--checkout"]);
+      return {
+        kind: "billing-status",
+        organizationId: options["--organization"],
+        checkoutId: options["--checkout"],
+        credentialStore,
+      };
+    }
+    if (sub === "checkout") {
+      const options = parseOptionalOptions(values, [
+          "--organization",
+          "--offer",
+          "--packs",
+          "--idempotency-key",
+        ]),
+        offer = options["--offer"],
+        packs = Number(options["--packs"] ?? "1");
+      if (
+        !options["--organization"] ||
+        !options["--idempotency-key"] ||
+        (offer !== "topup" && offer !== "paid") ||
+        !/^[1-9][0-9]{0,2}$/u.test(options["--packs"] ?? "1") ||
+        packs > 100 ||
+        (offer === "paid" && packs !== 1)
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "billing-checkout",
+        organizationId: options["--organization"],
+        offer,
+        packs,
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "credits" && values[0] === "usage") {
+    values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, ["--organization", "--month", "--cursor"]);
+    if (
+      !options["--organization"] ||
+      !options["--month"] ||
+      !/^20[0-9]{2}-(0[1-9]|1[0-2])$/u.test(options["--month"])
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "credits-usage",
+      organizationId: options["--organization"],
+      month: options["--month"],
+      ...(options["--cursor"] ? { cursor: options["--cursor"] } : {}),
+      credentialStore,
+    };
+  }
+  if (first === "credits" && values[0] === "account") {
+    values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--organization"]);
+    return { kind: "credits-account", organizationId: options["--organization"], credentialStore };
+  }
+  if (first === "credits" && values.shift() === "balance") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--organization"]);
+    return { kind: "credits-balance", organizationId: options["--organization"], credentialStore };
+  }
+  if (first === "budget") {
+    const subcommand = values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    if (subcommand === "get")
+      return {
+        kind: "budget-get",
+        projectId: parseOptions(values, ["--project"])["--project"],
+        credentialStore,
+      };
+    if (subcommand !== "set") throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--credits",
+      "--mode",
+      "--idempotency-key",
+    ]);
+    const projectId = options["--project"];
+    const value = options["--credits"];
+    const mode = options["--mode"] ?? "continue";
+    const idempotencyKey = options["--idempotency-key"];
+    if (
+      !isValue(projectId) ||
+      !isValue(value) ||
+      !isValue(idempotencyKey) ||
+      (mode !== "continue" && mode !== "stop")
+    )
+      throw new InvalidCommandError();
+    if (value === "none") {
+      if (mode !== "continue") throw new InvalidCommandError();
+      return {
+        kind: "budget-set",
+        projectId,
+        amountMicros: null,
+        mode,
+        idempotencyKey,
+        credentialStore,
+      };
+    }
+    if (!/^(0|[1-9][0-9]{0,12})(\.[0-9]{1,6})?$/u.test(value)) throw new InvalidCommandError();
+    const [whole, fraction = ""] = value.split(".");
+    const amount = BigInt(whole ?? "0") * 1_000_000n + BigInt(fraction.padEnd(6, "0"));
+    if (amount > 9223372036854775807n) throw new InvalidCommandError();
+    return {
+      kind: "budget-set",
+      projectId,
+      amountMicros: amount.toString(),
+      mode,
+      idempotencyKey,
+      credentialStore,
+    };
+  }
+  if (first === "operation") {
+    const subcommand = values.shift();
+    if (subcommand === "get") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const operationId = values.shift();
+      if (isValue(operationId) && values.length === 0) {
+        return { kind: "operation-get", operationId, credentialStore };
+      }
+    }
+    if (subcommand === "reconcile") {
+      if (!yes || wait || follow || stdin) throw new InvalidCommandError();
+      const operationId = values.shift();
+      if (!isValue(operationId)) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--idempotency-key"]);
+      return {
+        kind: "operation-reconcile",
+        operationId,
+        idempotencyKey: options["--idempotency-key"],
+        yes,
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "github") {
+    const subcommand = values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    if (subcommand !== "connect" && subcommand !== "status") throw new InvalidCommandError();
+    const options = parseOptions(
+      values,
+      subcommand === "connect" ? ["--organization", "--idempotency-key"] : ["--organization"],
+    );
+    const organizationId = options["--organization"];
+    if (!ORGANIZATION_ULID.test(organizationId)) throw new InvalidCommandError();
+    return subcommand === "connect"
+      ? {
+          kind: "github-connect",
+          organizationId,
+          idempotencyKey: options["--idempotency-key"],
+          credentialStore,
+        }
+      : { kind: "github-status", organizationId, credentialStore };
+  }
+  if (first === "organization") {
+    const subcommand = values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    if (subcommand === "create") {
+      const options = parseOptionalOptions(values, ["--name", "--source", "--idempotency-key"]);
+      const name = options["--name"];
+      const idempotencyKey = options["--idempotency-key"];
+      // Signup is open: the source is optional attribution, the other two are required.
+      if (!isValue(name) || !isValue(idempotencyKey)) throw new InvalidCommandError();
+      const signupSource = options["--source"];
+      if (signupSource !== undefined && !isValue(signupSource)) throw new InvalidCommandError();
+      return {
+        kind: "organization-create",
+        ...(signupSource === undefined ? {} : { signupSource }),
+        name,
+        idempotencyKey,
+        credentialStore,
+      };
+    }
+    if (subcommand === "list") {
+      if (values.length > 0) throw new InvalidCommandError();
+      return { kind: "organization-list", credentialStore };
+    }
+    if (subcommand === "use") {
+      const organizationId = parseOptions(values, ["--organization"])["--organization"];
+      if (!ORGANIZATION_ULID.test(organizationId)) throw new InvalidCommandError();
+      return { kind: "organization-use", organizationId, credentialStore };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "project") {
+    const subcommand = values.shift();
+    if (subcommand === "dev-access" && values.shift() === "create") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return {
+        kind: "project-dev-access-create",
+        projectId: options["--project"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "list") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, ["--cursor", "--limit"]);
+      const limit = options["--limit"] === undefined ? 50 : Number(options["--limit"]);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+        throw new InvalidCommandError();
+      }
+      return {
+        kind: "project-list",
+        cursor: options["--cursor"],
+        limit,
+        credentialStore,
+      };
+    }
+    if (subcommand === "context") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return { kind: "project-context", projectId: options["--project"], credentialStore };
+    }
+    if (subcommand === "notes" && values.shift() === "set") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const textIndex = values.indexOf("--markdown");
+      const markdown = values[textIndex + 1];
+      if (textIndex < 0 || markdown === undefined) throw new InvalidCommandError();
+      values.splice(textIndex, 2);
+      const options = parseOptions(values, ["--project", "--version", "--idempotency-key"]);
+      if (
+        !/^(?:0|[1-9][0-9]*)$/u.test(options["--version"]) ||
+        Number(options["--version"]) >= 2147483647
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "project-notes-set",
+        projectId: options["--project"],
+        markdown,
+        expectedVersion: Number(options["--version"]),
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "status") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return { kind: "project-status", projectId: options["--project"], credentialStore };
+    }
+    if (subcommand !== "create") throw new InvalidCommandError();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--organization",
+      "--name",
+      "--idempotency-key",
+      "--data-mode",
+      "--region",
+    ]);
+    const dataMode = options["--data-mode"];
+    const region = options["--region"];
+    if (
+      !options["--organization"] ||
+      !options["--name"] ||
+      !options["--idempotency-key"] ||
+      (dataMode !== undefined && dataMode !== "shared" && dataMode !== "isolated") ||
+      (region !== undefined && region !== "us" && region !== "eu")
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "project-create",
+      organizationId: options["--organization"],
+      name: options["--name"],
+      ...(dataMode === undefined ? {} : { dataMode }),
+      ...(region === undefined ? {} : { region }),
+      idempotencyKey: options["--idempotency-key"],
+      credentialStore,
+    };
+  }
+  if (first === "database" && values[0] === "compute" && values[1] === "set") {
+    values.splice(0, 2);
+    if (!yes || follow || stdin || revoke) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--profile",
+      "--idempotency-key",
+    ]);
+    if (
+      !options["--project"] ||
+      !options["--idempotency-key"] ||
+      (options["--profile"] !== "standard" && options["--profile"] !== "performance") ||
+      (options["--environment"] !== "dev" && options["--environment"] !== "prod")
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "database-compute-set",
+      projectId: options["--project"],
+      environment: options["--environment"],
+      profile: options["--profile"],
+      idempotencyKey: options["--idempotency-key"],
+      wait,
+      credentialStore,
+    };
+  }
+  if (first === "database" && values[0] === "compute" && values[1] === "get") {
+    values.splice(0, 2);
+    if (yes || wait || follow || stdin || revoke) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, ["--project", "--environment"]);
+    if (!options["--project"]) throw new InvalidCommandError();
+    const environment = options["--environment"] ?? "dev";
+    if (environment !== "dev" && environment !== "prod") throw new InvalidCommandError();
+    return {
+      kind: "database-compute-get",
+      projectId: options["--project"],
+      environment,
+      credentialStore,
+    };
+  }
+  if (first === "database" && values[0] === "write") {
+    values.shift();
+    if (!yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--statement-file",
+      "--parameters-json",
+      "--idempotency-key",
+    ]);
+    const projectId = options["--project"],
+      environment = options["--environment"],
+      statementFile = options["--statement-file"],
+      idempotencyKey = options["--idempotency-key"];
+    if (
+      !isValue(projectId) ||
+      !isValue(statementFile) ||
+      !isValue(idempotencyKey) ||
+      (environment !== "dev" && environment !== "prod")
+    )
+      throw new InvalidCommandError();
+    let parameters: unknown;
+    try {
+      parameters = JSON.parse(options["--parameters-json"] ?? "[]");
+    } catch {
+      throw new InvalidCommandError();
+    }
+    if (!Array.isArray(parameters) || parameters.length > 100) throw new InvalidCommandError();
+    return {
+      kind: "database-write",
+      projectId,
+      environment,
+      statementFile,
+      parameters,
+      idempotencyKey,
+      yes: true,
+      credentialStore,
+    };
+  }
+  if (first === "database" && values[0] === "access") {
+    values.shift();
+    const subcommand = values.shift();
+    if (subcommand === "create") {
+      if (!yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, [
+        "--project",
+        "--environment",
+        "--mode",
+        "--ttl",
+        "--label",
+      ]);
+      const projectId = options["--project"],
+        environment = options["--environment"],
+        mode = options["--mode"] ?? "read";
+      if (
+        !isValue(projectId) ||
+        (environment !== "dev" && environment !== "prod") ||
+        (mode !== "read" && mode !== "write")
+      )
+        throw new InvalidCommandError();
+      const label = options["--label"];
+      if (label !== undefined && (label.trim() !== label || label.length < 1 || label.length > 64))
+        throw new InvalidCommandError();
+      return {
+        kind: "database-access-create",
+        projectId,
+        environment,
+        mode,
+        ttlSeconds: accessTtlSeconds(options["--ttl"]),
+        label: label ?? null,
+        yes: true,
+        credentialStore,
+      };
+    }
+    if (subcommand === "list") {
+      if (yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, ["--project", "--environment"]);
+      const projectId = options["--project"],
+        environment = options["--environment"];
+      if (
+        !isValue(projectId) ||
+        (environment !== undefined && environment !== "dev" && environment !== "prod")
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "database-access-list",
+        projectId,
+        ...(environment === undefined ? {} : { environment }),
+        credentialStore,
+      };
+    }
+    if (subcommand === "revoke") {
+      if (!yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--access"]);
+      return {
+        kind: "database-access-revoke",
+        projectId: options["--project"],
+        accessId: options["--access"],
+        yes: true,
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "database" && values[0] === "psql") {
+    values.shift();
+    if (yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, ["--project", "--environment", "--mode", "--ttl"]);
+    const projectId = options["--project"],
+      environment = options["--environment"],
+      mode = options["--mode"] ?? "read";
+    if (
+      !isValue(projectId) ||
+      (environment !== "dev" && environment !== "prod") ||
+      (mode !== "read" && mode !== "write")
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "database-psql",
+      projectId,
+      environment,
+      mode,
+      ttlSeconds: accessTtlSeconds(options["--ttl"]),
+      credentialStore,
+    };
+  }
+  if (first === "database" && values.shift() === "query") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--statement",
+      "--parameters-json",
+    ]);
+    const environment = options["--environment"];
+    if (environment !== "dev" && environment !== "prod") throw new InvalidCommandError();
+    const projectId = options["--project"];
+    const statement = options["--statement"];
+    if (
+      !isValue(projectId) ||
+      !isValue(statement) ||
+      !/^(?:select|with)\b/iu.test(statement.trimStart()) ||
+      new TextEncoder().encode(statement).byteLength > 4_096
+    ) {
+      throw new InvalidCommandError();
+    }
+    let parameters: unknown = [];
+    try {
+      parameters = JSON.parse(options["--parameters-json"] ?? "[]") as unknown;
+    } catch {
+      throw new InvalidCommandError();
+    }
+    if (
+      !Array.isArray(parameters) ||
+      parameters.length > 32 ||
+      !parameters.every(
+        (parameter) =>
+          parameter === null ||
+          typeof parameter === "string" ||
+          typeof parameter === "boolean" ||
+          (typeof parameter === "number" && Number.isFinite(parameter)),
+      )
+    ) {
+      throw new InvalidCommandError();
+    }
+    return {
+      kind: "database-query",
+      projectId,
+      environment,
+      statement,
+      parameters: Object.freeze([...parameters]) as readonly (string | number | boolean | null)[],
+      credentialStore,
+    };
+  }
+  if (first === "link") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, [
+      "--project",
+      "--repository-owner",
+      "--repository-name",
+      "--idempotency-key",
+    ]);
+    return {
+      kind: "link",
+      projectId: options["--project"],
+      repositoryOwner: options["--repository-owner"],
+      repositoryName: options["--repository-name"],
+      idempotencyKey: options["--idempotency-key"],
+      credentialStore,
+    };
+  }
+  if (first === "source" && values.shift() === "auto-deploy") {
+    const subcommand = values.shift();
+    if (subcommand === "set") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, [
+        "--project",
+        "--branch",
+        "--enabled",
+        "--idempotency-key",
+      ]);
+      if (!validGithubBranchName(options["--branch"])) throw new InvalidCommandError();
+      if (options["--enabled"] !== "true" && options["--enabled"] !== "false")
+        throw new InvalidCommandError();
+      return {
+        kind: "source-auto-deploy-set",
+        projectId: options["--project"],
+        branch: options["--branch"],
+        enabled: options["--enabled"] === "true",
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "status") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return {
+        kind: "source-auto-deploy-status",
+        projectId: options["--project"],
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "plan") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project", "--commit"]);
+    return {
+      kind: "plan",
+      projectId: options["--project"],
+      commitSha: options["--commit"],
+      credentialStore,
+    };
+  }
+  if (first === "deploy") {
+    if (!yes || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project", "--plan-id", "--idempotency-key"]);
+    return {
+      kind: "deploy",
+      projectId: options["--project"],
+      planId: options["--plan-id"],
+      idempotencyKey: options["--idempotency-key"],
+      yes,
+      wait,
+      credentialStore,
+    };
+  }
+  if (first === "logs") {
+    if (!follow || yes || wait || stdin) throw new InvalidCommandError();
+    const operationId = values.shift();
+    if (isValue(operationId) && values.length === 0)
+      return { kind: "logs", operationId, follow, credentialStore };
+  }
+  if (first === "deployment" && values[0] === "logs") {
+    values.shift();
+    if (!follow || yes || wait || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project", "--deployment"]);
+    return {
+      kind: "deployment-logs",
+      projectId: options["--project"],
+      deploymentId: options["--deployment"],
+      follow: true,
+      credentialStore,
+    };
+  }
+  if (first === "rollback" && values[0] === "plan") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const options = parseOptions(values, ["--project", "--deployment"]);
+    return {
+      kind: "rollback-plan",
+      projectId: options["--project"],
+      deploymentId: options["--deployment"],
+      credentialStore,
+    };
+  }
+  if (first === "rollback") {
+    if (!yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, [
+      "--project",
+      "--deployment",
+      "--if-match",
+      "--confirmation-token",
+      "--idempotency-key",
+    ]);
+    return {
+      kind: "rollback",
+      projectId: options["--project"],
+      deploymentId: options["--deployment"],
+      ifMatch: options["--if-match"],
+      confirmationToken: options["--confirmation-token"],
+      idempotencyKey: options["--idempotency-key"],
+      yes,
+      credentialStore,
+    };
+  }
+  if (first === "deployment" && values[0] === "promote" && values[1] === "plan") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.splice(0, 2);
+    const options = parseOptions(values, ["--project", "--deployment"]);
+    return {
+      kind: "promotion-plan",
+      projectId: options["--project"],
+      sourceDeploymentId: options["--deployment"],
+      credentialStore,
+    };
+  }
+  if (first === "deployment" && values[0] === "promote") {
+    if (!yes || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const options = parseOptions(values, [
+      "--project",
+      "--deployment",
+      "--if-match",
+      "--confirmation-token",
+      "--idempotency-key",
+    ]);
+    return {
+      kind: "promote",
+      projectId: options["--project"],
+      sourceDeploymentId: options["--deployment"],
+      ifMatch: options["--if-match"],
+      confirmationToken: options["--confirmation-token"],
+      idempotencyKey: options["--idempotency-key"],
+      yes,
+      wait,
+      credentialStore,
+    };
+  }
+  if (first === "delete" && values[0] === "plan") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const options = parseOptions(values, ["--project"]);
+    return { kind: "delete-plan", projectId: options["--project"], credentialStore };
+  }
+  if (first === "delete") {
+    if (!yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, [
+      "--project",
+      "--if-match",
+      "--confirmation-token",
+      "--idempotency-key",
+    ]);
+    return {
+      kind: "delete",
+      projectId: options["--project"],
+      ifMatch: options["--if-match"],
+      confirmationToken: options["--confirmation-token"],
+      idempotencyKey: options["--idempotency-key"],
+      yes,
+      credentialStore,
+    };
+  }
+  if (first === "export" && values[0] === "create") {
+    if (yes || wait || follow || !stdin) throw new InvalidCommandError();
+    values.shift();
+    const options = parseOptions(values, ["--project", "--idempotency-key"]);
+    return {
+      kind: "export-create",
+      projectId: options["--project"],
+      idempotencyKey: options["--idempotency-key"],
+      stdin,
+      credentialStore,
+    };
+  }
+  if (first === "export" && values[0] === "get") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const exportId = values.shift();
+    if (!exportId) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project"]);
+    return { kind: "export-get", projectId: options["--project"], exportId, credentialStore };
+  }
+  if (first === "secret" && values[0] === "list") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const options = parseOptions(values, ["--project", "--environment"]);
+    return {
+      kind: "secret-list",
+      projectId: options["--project"],
+      environmentId: options["--environment"],
+      credentialStore,
+    };
+  }
+  if (first === "function" && values[0] === "runs") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    // --limit is the only optional option: one to one hundred runs, fifty by default.
+    const limitIndex = values.indexOf("--limit");
+    let limit = 50;
+    if (limitIndex !== -1) {
+      const raw = values[limitIndex + 1];
+      if (typeof raw !== "string" || !/^[1-9][0-9]{0,2}$/u.test(raw) || Number(raw) > 100) {
+        throw new InvalidCommandError();
+      }
+      limit = Number(raw);
+      values.splice(limitIndex, 2);
+    }
+    const options = parseOptions(values, ["--project", "--environment"]);
+    return {
+      kind: "function-runs",
+      projectId: options["--project"],
+      environmentId: options["--environment"],
+      limit,
+      credentialStore,
+    };
+  }
+  if (first === "secret" && values[0] === "set") {
+    if (yes || follow || !stdin) throw new InvalidCommandError();
+    values.shift();
+    const name = values.shift();
+    if (!isUserSecretName(name)) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project", "--environment", "--idempotency-key"]);
+    return {
+      kind: "secret-set",
+      projectId: options["--project"],
+      environmentId: options["--environment"],
+      name,
+      idempotencyKey: options["--idempotency-key"],
+      stdin,
+      wait,
+      credentialStore,
+    };
+  }
+  if (first === "secret" && values[0] === "delete") {
+    if (yes || follow || stdin) throw new InvalidCommandError();
+    values.shift();
+    const name = values.shift();
+    if (!isUserSecretName(name)) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--project", "--environment", "--idempotency-key"]);
+    return {
+      kind: "secret-delete",
+      projectId: options["--project"],
+      environmentId: options["--environment"],
+      name,
+      idempotencyKey: options["--idempotency-key"],
+      wait,
+      credentialStore,
+    };
+  }
+  if (first === "domain" && values[0] === "paid") {
+    const subcommand = values[1];
+    values.splice(0, 2);
+    if (subcommand === "plan") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--hostname"]);
+      if (!validPaidHostname(options["--hostname"])) throw new InvalidCommandError();
+      return {
+        kind: "paid-domain-plan",
+        projectId: options["--project"],
+        hostname: options["--hostname"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "status") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return { kind: "paid-domain-status", projectId: options["--project"], credentialStore };
+    }
+    if (subcommand === "apply" || subcommand === "delete") {
+      if (!yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--hostname", "--idempotency-key"]);
+      if (!validPaidHostname(options["--hostname"])) throw new InvalidCommandError();
+      return {
+        kind: subcommand === "apply" ? "paid-domain-apply" : "paid-domain-delete",
+        projectId: options["--project"],
+        hostname: options["--hostname"],
+        idempotencyKey: options["--idempotency-key"],
+        yes,
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "domain" && values[0] === "cloudflare") {
+    const subcommand = values[1];
+    values.splice(0, 2);
+    if (subcommand === "authorize") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--zone", "--idempotency-key"]);
+      if (!validPaidHostname(options["--zone"])) throw new InvalidCommandError();
+      return {
+        kind: "domain-cloudflare-authorize",
+        projectId: options["--project"],
+        zone: options["--zone"],
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "status") {
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project"]);
+      return {
+        kind: "domain-cloudflare-status",
+        projectId: options["--project"],
+        credentialStore,
+      };
+    }
+    if (subcommand === "apply") {
+      if (!yes || !wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--idempotency-key"]);
+      return {
+        kind: "domain-cloudflare-apply",
+        projectId: options["--project"],
+        idempotencyKey: options["--idempotency-key"],
+        yes,
+        wait,
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
+  if (first === "mail" && values[0] === "domain" && values[1] === "set") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.splice(0, 2);
+    const options = parseOptions(values, ["--project", "--domain", "--idempotency-key"]);
+    if (
+      !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
+        options["--domain"],
+      )
+    ) {
+      throw new InvalidCommandError();
+    }
+    return {
+      kind: "mail-domain-set",
+      projectId: options["--project"],
+      domain: options["--domain"],
+      idempotencyKey: options["--idempotency-key"],
+      credentialStore,
+    };
+  }
+  if (first === "mail" && values[0] === "domain" && values[1] === "status") {
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    values.splice(0, 2);
+    const options = parseOptions(values, ["--project"]);
+    return {
+      kind: "mail-domain-status",
+      projectId: options["--project"],
+      credentialStore,
+    };
+  }
+  throw new InvalidCommandError();
+};
+
+const removeFlag = (values: Array<string>, flag: string): boolean => {
+  const index = values.indexOf(flag);
+  if (index < 0) return false;
+  if (values.indexOf(flag, index + 1) >= 0) throw new InvalidCommandError();
+  values.splice(index, 1);
+  return true;
+};
+
+const parseOptions = <T extends string>(
+  values: readonly string[],
+  allowed: readonly T[],
+): Record<T, string> => {
+  const result = {} as Record<T, string>;
+  for (let index = 0; index < values.length; index += 2) {
+    const option = values[index];
+    const value = values[index + 1];
+    if (option === undefined || !allowed.includes(option as T) || !isValue(value)) {
+      throw new InvalidCommandError();
+    }
+    if (option in result) throw new InvalidCommandError();
+    result[option as T] = value;
+  }
+  if (Object.keys(result).length !== allowed.length) throw new InvalidCommandError();
+  return result;
+};
+
+const parseOptionalOptions = <T extends string>(
+  values: readonly string[],
+  allowed: readonly T[],
+): Partial<Record<T, string>> => {
+  const result: Partial<Record<T, string>> = {};
+  for (let index = 0; index < values.length; index += 2) {
+    const option = values[index];
+    const value = values[index + 1];
+    if (option === undefined || !allowed.includes(option as T) || !isValue(value)) {
+      throw new InvalidCommandError();
+    }
+    if (option in result) throw new InvalidCommandError();
+    result[option as T] = value;
+  }
+  return result;
+};
+
+/** A credential lifetime is minutes, hours or plain seconds, always within 5 minutes and 24 hours. */
+const accessTtlSeconds = (value: string | undefined): number => {
+  if (value === undefined) return 3_600;
+  const match = /^(\d{1,6})(m|h)?$/u.exec(value);
+  if (!match) throw new InvalidCommandError();
+  const amount = Number(match[1]);
+  const seconds = match[2] === "m" ? amount * 60 : match[2] === "h" ? amount * 3_600 : amount;
+  if (!Number.isSafeInteger(seconds) || seconds < 300 || seconds > 86_400)
+    throw new InvalidCommandError();
+  return seconds;
+};
+
+/** A platform organization identifier as the API returns it. */
+const ORGANIZATION_ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+
+const isValue = (value: string | undefined): value is string =>
+  value !== undefined && value.length > 0 && !value.startsWith("--");
+
+const validGithubBranchName = (value: string): boolean =>
+  !(
+    value.length < 1 ||
+    value.length > 1_024 ||
+    !/^[A-Za-z0-9]/u.test(value) ||
+    value.startsWith("-") ||
+    value.startsWith("/") ||
+    value.endsWith("/") ||
+    value.endsWith(".") ||
+    value.includes("//") ||
+    value.includes("..") ||
+    value.includes("@{") ||
+    [...value].some((character) => {
+      const code = character.codePointAt(0) ?? 0;
+      return code <= 0x20 || code === 0x7f || "\\~^:?*[]".includes(character);
+    }) ||
+    value.split("/").some((component) => component.startsWith(".") || component.endsWith(".lock"))
+  );
+
+const validPaidHostname = (value: string): boolean =>
+  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(value) &&
+  !value.endsWith(".poc.aixyte.com") &&
+  value !== "omh.st" &&
+  !value.endsWith(".omh.st") &&
+  value !== "ohmyho.st" &&
+  !value.endsWith(".ohmyho.st");
+
+const isUserSecretName = (value: string | undefined): value is string =>
+  isValue(value) &&
+  /^[A-Z][A-Z0-9_]{0,127}$/u.test(value) &&
+  value !== "DATABASE_URL" &&
+  value !== "HYPERDRIVE" &&
+  value !== "BETTER_AUTH_SECRET" &&
+  value !== "BETTER_AUTH_URL" &&
+  value !== "OHMYHOST_MAIL_KEY" &&
+  value !== "OHMYHOST_MAIL_GATEWAY_URL";