@astris-labs/cli 0.0.0-stage → 0.1.0

package/src/commands.mjs

@@ -0,0 +1,1515 @@
+import { parseArgs } from "node:util";
+
+import { astrisFetch, DEFAULT_BASE_URL, redact } from "./client.mjs";
+import { NoApiKeyError, readApiKey, removeApiKey, saveApiKey } from "./key.mjs";
+
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const SENTENCE = {
+  missingKey: "ASTRIS_API_KEY is not set",
+  incomplete:
+    "Those arguments were refused. Send --project, --name, --git-url, and --branch, or send --app to redeploy.",
+  app: "Send --app set to the application id.",
+  projectId: "Send --project set to the project id.",
+  databaseFlags: "Those arguments were refused. Send --project, --kind, and --name.",
+  databaseId: "Send --id set to the database id.",
+  domainId: "Send --id set to the domain id.",
+  git: "The Git URL must not include a user name or password.",
+  // T-169: reused word for word from the MCP's SENTENCE.deployKey (T-139).
+  deployKey:
+    "Add this public key to the repository as a read-only deploy key, then deploy again with this app_id. On GitHub the key goes in the repository Settings under Deploy keys, and write access stays off.",
+  unauthorized:
+    "This key was refused. Put a current Astris API key in the environment and try again.",
+  notFound: "Nothing with that id is on this account. Use the id from an earlier command.",
+  refused: "Those arguments were refused. Check the flags and send them again.",
+  taken: "That name or hostname is already taken. Choose another and try again.",
+  noBackup: "This database has no backup job. Only Postgres databases are backed up.",
+  deleteConfirm: "This removes the database and its data. Add --yes to confirm.",
+  bucketConfirm: "This removes the bucket and its objects. Add --yes to confirm.",
+  bucketRemoved: "Bucket removed.",
+  bucketNotEmpty: "That bucket is not empty. Remove its objects, then try again.",
+  bucketLimit: "This account has reached its bucket safety limit. Contact support.",
+  storageOff: "Storage is not available right now. Try again later.",
+  platform: "The platform did not accept the change. Check status, then try again.",
+  failed: "Astris failed on its side. Try again.",
+  logsApp: "Send the application id.",
+  rollback: "rollback is not available in this version.",
+  replaced: "Replaced the whole set.",
+  restarted: "Restarted.",
+  emptyKey: "The key was empty.",
+  loggedIn: "Logged in.",
+  loggedOut: "Logged out.",
+  nothingToRemove: "There was nothing to remove.",
+};
+
+const HTTP_SENTENCE = new Map([
+  [400, SENTENCE.refused],
+  [401, SENTENCE.unauthorized],
+  [404, SENTENCE.notFound],
+  [409, SENTENCE.taken],
+  [502, SENTENCE.platform],
+]);
+
+function sentenceFor(status) {
+  return HTTP_SENTENCE.get(status) ?? SENTENCE.failed;
+}
+
+function upgradeMessage(status, body) {
+  if (status !== 403 || !isRecord(body) || body.error !== "upgrade_required" || typeof body.message !== "string") {
+    return null;
+  }
+  return body.message;
+}
+
+function storageCreateMessage(status, body) {
+  if (!isRecord(body)) return null;
+  if (status === 403 && body.error === "bucket_limit") {
+    if (typeof body.message === "string" && body.message.length > 0) {
+      return body.message;
+    }
+    return SENTENCE.bucketLimit;
+  }
+  if (status === 503 && body.error === "storage_unavailable") {
+    if (typeof body.message === "string" && body.message.length > 0) {
+      return body.message;
+    }
+    return null;
+  }
+  return null;
+}
+
+function writeStdout(io, key, text) {
+  io.stdout.write(redact(text, key));
+}
+
+function writeStderr(io, key, text) {
+  io.stderr.write(redact(text, key));
+}
+
+function withCreated(sentence, created) {
+  let text = sentence;
+  if (created?.projectId) text += ` Created project ${created.projectId}.`;
+  if (created?.applicationId) text += ` Created application ${created.applicationId}.`;
+  return text;
+}
+
+function fail(io, key, json, sentence, created) {
+  const text = withCreated(sentence, created);
+  const safe = redact(text, key);
+  if (json) writeStdout(io, key, `${JSON.stringify({ error: safe })}\n`);
+  else writeStderr(io, key, `${safe}\n`);
+  return { exitCode: 1 };
+}
+
+function succeed(io, key, json, payload, human) {
+  if (json) writeStdout(io, key, `${JSON.stringify(payload)}\n`);
+  else writeStdout(io, key, human);
+  return { exitCode: 0 };
+}
+
+function loadKey(io) {
+  try {
+    return { key: readApiKey(io.env) };
+  } catch (error) {
+    if (error instanceof NoApiKeyError) {
+      io.stderr.write(`${SENTENCE.missingKey}\n`);
+      return { exit: { exitCode: 1 } };
+    }
+    throw error;
+  }
+}
+
+function wantsJson(args) {
+  return Array.isArray(args) && args.includes("--json");
+}
+
+const BASE_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+  project: { type: "string" },
+  name: { type: "string" },
+  "git-url": { type: "string" },
+  branch: { type: "string" },
+  "build-path": { type: "string" },
+  dockerfile: { type: "string" },
+  port: { type: "string" },
+  slug: { type: "string" },
+};
+
+// T-146: deploy's build and kind flags, env's --names. Given per command, so
+// status, domains and restart keep refusing them. T-169: hook on deploy only.
+const DEPLOY_OPTIONS = {
+  build: { type: "string" },
+  "publish-directory": { type: "string" },
+  spa: { type: "boolean" },
+  kind: { type: "string" },
+  command: { type: "string" },
+  schedule: { type: "string" },
+  hook: { type: "boolean" },
+};
+
+const ENV_OPTIONS = {
+  names: { type: "boolean" },
+};
+
+function parseFlags(args, extra) {
+  let tokens;
+  try {
+    tokens = parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: true,
+      allowPositionals: false,
+      tokens: true,
+      options: extra === undefined ? BASE_OPTIONS : { ...BASE_OPTIONS, ...extra },
+    }).tokens;
+  } catch {
+    return null;
+  }
+  const flags = {};
+  for (const token of tokens) {
+    if (token.kind !== "option") continue;
+    if (token.name === "json") flags.json = true;
+    else if (token.name === "app") flags.app = token.value;
+    else if (token.name === "project") flags.project = token.value;
+    else if (token.name === "name") flags.name = token.value;
+    else if (token.name === "git-url") flags.gitUrl = token.value;
+    else if (token.name === "branch") flags.branch = token.value;
+    else if (token.name === "build-path") flags.buildPath = token.value;
+    else if (token.name === "dockerfile") flags.dockerfile = token.value;
+    else if (token.name === "port") flags.port = token.value;
+    else if (token.name === "slug") flags.slug = token.value;
+    else if (token.name === "build") flags.build = token.value;
+    else if (token.name === "publish-directory") flags.publishDirectory = token.value;
+    else if (token.name === "spa") flags.spa = true;
+    else if (token.name === "kind") flags.kind = token.value;
+    else if (token.name === "command") flags.command = token.value;
+    else if (token.name === "schedule") flags.schedule = token.value;
+    else if (token.name === "names") flags.names = true;
+    else if (token.name === "hook") flags.hook = true;
+  }
+  return flags;
+}
+
+function open(args, io, extra) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded;
+  const flags = parseFlags(args, extra);
+  if (flags === null) return { exit: fail(io, loaded.key, wantsJson(args), SENTENCE.refused) };
+  return { key: loaded.key, json: flags.json === true, flags };
+}
+
+function appUuid(value) {
+  if (typeof value !== "string") return null;
+  const id = value.trim();
+  return UUID.test(id) ? id : null;
+}
+
+function requireApp(io, key, json, flags) {
+  const appId = appUuid(flags.app);
+  if (appId === null) return { exit: fail(io, key, json, SENTENCE.app) };
+  return { appId };
+}
+
+function trimmed(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+// T-169: the fixed SSH user "git" of an ssh:// URL is not user info; every
+// other user or password is refused before any request, as before.
+function gitUrlHasUserInfo(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.password !== "") return true;
+  if (url.username === "") return false;
+  return !(url.protocol === "ssh:" && url.username === "git");
+}
+
+// T-169: a well-formed deploy key, or null when any field is missing. The
+// MCP's deployKeyOf (src/lib/mcp/tools.ts) is the model; nothing imports it.
+function deployKeyOf(value) {
+  if (!isRecord(value)) return null;
+  const { type, public_key, fingerprint } = value;
+  if (typeof type !== "string" || typeof public_key !== "string" || typeof fingerprint !== "string") {
+    return null;
+  }
+  return { type, public_key, fingerprint };
+}
+
+function portNumber(raw) {
+  if (typeof raw !== "string") return null;
+  const text = raw.trim();
+  if (!/^[1-9][0-9]{0,4}$/.test(text)) return null;
+  const port = Number(text);
+  if (port < 1 || port > 65535) return null;
+  return port;
+}
+
+function baseUrlOf(io) {
+  return typeof io.baseUrl === "string" && io.baseUrl !== "" ? io.baseUrl : DEFAULT_BASE_URL;
+}
+
+async function call(io, key, request) {
+  try {
+    return await astrisFetch({
+      key,
+      baseUrl: baseUrlOf(io),
+      path: request.path,
+      method: request.method,
+      body: request.body,
+      fetchImpl: io.fetchImpl,
+    });
+  } catch {
+    return { network: true };
+  }
+}
+
+function text(value) {
+  return typeof value === "string" ? value : "";
+}
+
+function hostnamesOf(body) {
+  const hostnames = body?.application?.hostnames;
+  if (!Array.isArray(hostnames)) return [];
+  return hostnames.filter((item) => typeof item === "string");
+}
+
+function deploymentRows(body) {
+  const rows = Array.isArray(body?.deployments) ? body.deployments.slice(0, 5) : [];
+  return rows.map((row) => ({
+    status: typeof row?.status === "string" ? row.status : null,
+    created_at: typeof row?.created_at === "string" ? row.created_at : null,
+    finished_at:
+      row?.finished_at === null || typeof row?.finished_at === "string" ? row.finished_at : null,
+  }));
+}
+
+function envObject(stdin) {
+  if (typeof stdin !== "string") return null;
+  let value;
+  try {
+    value = JSON.parse(stdin);
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+
+function findProjectId(body, name) {
+  const projects = body?.projects;
+  if (!Array.isArray(projects)) return null;
+  for (const project of projects) {
+    if (project && project.name === name && typeof project.id === "string" && project.id !== "") {
+      return project.id;
+    }
+  }
+  return null;
+}
+
+async function redeploy(io, key, json, appId) {
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/deploy`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 202) return fail(io, key, json, sentenceFor(result.status));
+  const application = result.body?.application ?? {};
+  const id = text(application.id) || appId;
+  const name = text(application.name);
+  return succeed(
+    io,
+    key,
+    json,
+    { application_id: id, name, accepted: true },
+    `${id}\n${name}\n`,
+  );
+}
+
+// T-146: the create-only body keys from --build and --kind, or null when the
+// combination is refused. Only the flags the user passed are returned, under
+// the API's field names, so a call with no new flag adds no key. The rules
+// mirror the API's readers (src/lib/apps/input.ts readBuildKind, readKind,
+// readCommand, readSchedule); what the tables do not check stays with the API.
+const BUILD_RULES = new Map([
+  ["nixpacks", { dockerfile: "no", publishDirectory: "no", spa: "no" }],
+  ["dockerfile", { dockerfile: "required", publishDirectory: "no", spa: "no" }],
+  ["static", { dockerfile: "no", publishDirectory: "may", spa: "may" }],
+]);
+
+const KIND_RULES = new Map([
+  ["web", { command: "no", schedule: "no" }],
+  ["worker", { command: "required", schedule: "no" }],
+  ["cron", { command: "required", schedule: "required" }],
+]);
+
+const COMMAND_MAX = 512;
+const SCHEDULE_MAX = 100;
+const SCHEDULE_FIELD = /^[0-9*,/-]+$/;
+
+function validCommand(value) {
+  return (
+    typeof value === "string" &&
+    value.length >= 1 &&
+    value.length <= COMMAND_MAX &&
+    !value.includes("\n") &&
+    !value.includes("\u0000")
+  );
+}
+
+function validSchedule(value) {
+  if (typeof value !== "string" || value.length < 1 || value.length > SCHEDULE_MAX) return false;
+  const parts = value.split(" ");
+  return parts.length === 5 && parts.every((part) => part.length > 0 && SCHEDULE_FIELD.test(part));
+}
+
+function createFields(flags) {
+  const fields = {};
+  const build = flags.build;
+  if (build !== undefined) {
+    const rule = BUILD_RULES.get(build);
+    if (rule === undefined) return null;
+    if (rule.dockerfile === "no" && flags.dockerfile !== undefined) return null;
+    if (rule.dockerfile === "required" && flags.dockerfile === undefined) return null;
+    if (rule.publishDirectory === "no" && flags.publishDirectory !== undefined) return null;
+    if (rule.publishDirectory === "may" && flags.publishDirectory !== undefined) {
+      fields.publish_directory = flags.publishDirectory;
+    }
+    if (rule.spa === "no" && flags.spa !== undefined) return null;
+    if (rule.spa === "may" && flags.spa !== undefined) fields.spa = flags.spa === true;
+    fields.build = build;
+  } else if (flags.publishDirectory !== undefined || flags.spa !== undefined) {
+    return null;
+  }
+  const kind = flags.kind;
+  if (kind !== undefined) {
+    const rule = KIND_RULES.get(kind);
+    if (rule === undefined) return null;
+    if (rule.command === "no" && flags.command !== undefined) return null;
+    if (rule.command === "required") {
+      if (!validCommand(flags.command)) return null;
+      fields.command = flags.command;
+    }
+    if (rule.schedule === "no" && flags.schedule !== undefined) return null;
+    if (rule.schedule === "required") {
+      if (!validSchedule(flags.schedule)) return null;
+      fields.schedule = flags.schedule;
+    }
+    fields.kind = kind;
+    if (kind !== "web" && fields.build === "static") return null;
+  } else if (flags.command !== undefined || flags.schedule !== undefined) {
+    return null;
+  }
+  return fields;
+}
+
+async function createThenDeploy(io, key, json, flags) {
+  const project = trimmed(flags.project);
+  const name = trimmed(flags.name);
+  const gitUrl = trimmed(flags.gitUrl);
+  const branch = trimmed(flags.branch);
+  if (project === "" || name === "" || gitUrl === "" || branch === "") {
+    return fail(io, key, json, SENTENCE.incomplete);
+  }
+  if (gitUrlHasUserInfo(gitUrl)) return fail(io, key, json, SENTENCE.git);
+  let port = 3000;
+  if (flags.port !== undefined) {
+    const parsed = portNumber(flags.port);
+    if (parsed === null) return fail(io, key, json, SENTENCE.refused);
+    port = parsed;
+  }
+  const extraFields = createFields(flags);
+  if (extraFields === null) return fail(io, key, json, SENTENCE.refused);
+  const buildPath = flags.buildPath !== undefined ? flags.buildPath : "/";
+  const created = { projectId: null, applicationId: null };
+  try {
+    const listed = await call(io, key, { path: "/v1/projects", method: "GET" });
+    if (listed.network) return fail(io, key, json, SENTENCE.platform, created);
+    if (listed.status !== 200) return fail(io, key, json, sentenceFor(listed.status), created);
+    let projectId = findProjectId(listed.body, project);
+    if (projectId === null) {
+      const made = await call(io, key, {
+        path: "/v1/projects",
+        method: "POST",
+        body: { name: project },
+      });
+      if (made.network) return fail(io, key, json, SENTENCE.platform, created);
+      const madeId = made.body?.project?.id;
+      if (made.status !== 201 || typeof madeId !== "string" || madeId === "") {
+        return fail(io, key, json, made.status === 201 ? SENTENCE.failed : sentenceFor(made.status), created);
+      }
+      projectId = madeId;
+      created.projectId = madeId;
+    }
+    const appBody = {
+      name,
+      git_url: gitUrl,
+      branch,
+      build_path: buildPath,
+      port,
+      ...extraFields,
+    };
+    if (flags.dockerfile !== undefined) appBody.dockerfile = flags.dockerfile;
+    const madeApp = await call(io, key, {
+      path: `/v1/projects/${encodeURIComponent(projectId)}/apps`,
+      method: "POST",
+      body: appBody,
+    });
+    if (madeApp.network) return fail(io, key, json, SENTENCE.platform, created);
+    const application = madeApp.body?.application;
+    const applicationId = application?.id;
+    if (madeApp.status !== 201 || typeof applicationId !== "string" || applicationId === "") {
+      const passed = upgradeMessage(madeApp.status, madeApp.body);
+      return fail(
+        io,
+        key,
+        json,
+        passed ?? (madeApp.status === 201 ? SENTENCE.failed : sentenceFor(madeApp.status)),
+        created,
+      );
+    }
+    created.applicationId = applicationId;
+    // T-169: the create answer's deploy key decides, not the URL. A
+    // well-formed key prints the key and queues no deploy; a present but
+    // malformed key is a platform fault; an absent key is today's https flow.
+    const rawKey = application.deploy_key;
+    if (rawKey !== undefined && rawKey !== null) {
+      const deployKey = deployKeyOf(rawKey);
+      if (deployKey === null) return fail(io, key, json, SENTENCE.platform, created);
+      const keyName = text(application.name) || name;
+      const keySlug = text(application.slug);
+      return succeed(
+        io,
+        key,
+        json,
+        {
+          project_id: projectId,
+          application_id: applicationId,
+          name: keyName,
+          slug: keySlug,
+          deploy_key: deployKey,
+          next_step: SENTENCE.deployKey,
+        },
+        `${projectId}\n${applicationId}\n${keyName}\n${keySlug}\n${deployKey.type}\n${deployKey.public_key}\n${deployKey.fingerprint}\n${SENTENCE.deployKey}\n`,
+      );
+    }
+    const deployed = await call(io, key, {
+      path: `/v1/apps/${encodeURIComponent(applicationId)}/deploy`,
+      method: "POST",
+    });
+    if (deployed.network) return fail(io, key, json, SENTENCE.platform, created);
+    if (deployed.status !== 202) return fail(io, key, json, sentenceFor(deployed.status), created);
+    const shown = deployed.body?.application ?? application;
+    const id = text(shown.id) || applicationId;
+    const shownName = text(shown.name) || name;
+    const slug = text(shown.slug);
+    return succeed(
+      io,
+      key,
+      json,
+      {
+        project_id: projectId,
+        application_id: id,
+        name: shownName,
+        slug,
+        accepted: true,
+      },
+      `${projectId}\n${id}\n${shownName}\n${slug}\n`,
+    );
+  } catch {
+    return fail(io, key, json, SENTENCE.platform, created);
+  }
+}
+
+export async function deploy(args, io) {
+  const opened = open(args, io, DEPLOY_OPTIONS);
+  if (opened.exit) return opened.exit;
+  // T-169: the hook belongs to an app id, with or without create flags.
+  if (opened.flags.hook === true && opened.flags.app === undefined) {
+    return fail(io, opened.key, opened.json, SENTENCE.app);
+  }
+  if (opened.flags.app !== undefined) {
+    const appId = appUuid(opened.flags.app);
+    if (appId === null) return fail(io, opened.key, opened.json, SENTENCE.app);
+    if (
+      opened.flags.build !== undefined ||
+      opened.flags.publishDirectory !== undefined ||
+      opened.flags.spa !== undefined ||
+      opened.flags.kind !== undefined ||
+      opened.flags.command !== undefined ||
+      opened.flags.schedule !== undefined
+    ) {
+      return fail(io, opened.key, opened.json, SENTENCE.refused);
+    }
+    if (opened.flags.hook === true) return hookUrl(io, opened.key, opened.json, appId);
+    return redeploy(io, opened.key, opened.json, appId);
+  }
+  return createThenDeploy(io, opened.key, opened.json, opened.flags);
+}
+
+export async function status(args, io) {
+  const opened = open(args, io);
+  if (opened.exit) return opened.exit;
+  const required = requireApp(io, opened.key, opened.json, opened.flags);
+  if (required.exit) return required.exit;
+  const result = await call(io, opened.key, {
+    path: `/v1/apps/${encodeURIComponent(required.appId)}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, opened.key, opened.json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, opened.key, opened.json, sentenceFor(result.status));
+  const statusText = text(result.body?.status);
+  const hostnames = hostnamesOf(result.body);
+  const id = text(result.body?.application?.id) || required.appId;
+  return succeed(
+    io,
+    opened.key,
+    opened.json,
+    {
+      application_id: id,
+      status: statusText,
+      hostnames,
+      deployments: deploymentRows(result.body),
+    },
+    `${statusText}\n${hostnames.join("\n")}${hostnames.length > 0 ? "\n" : ""}`,
+  );
+}
+
+// T-169: GET /v1/apps/:id/hook answers {hook: {url}}. The URL is a
+// credential: it prints only from deploy --hook, and no error path carries it.
+async function hookUrl(io, key, json, appId) {
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/hook`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const url = result.body?.hook?.url;
+  if (typeof url !== "string") return fail(io, key, json, SENTENCE.failed);
+  return succeed(io, key, json, { application_id: appId, url }, `${url}\n`);
+}
+
+// T-146: GET /v1/apps/:id/env answers {names: [...]} and no value. Nothing
+// else of the body is read, so a value cannot reach the output.
+async function envNames(io, key, json, appId) {
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/env`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const names = result.body?.names;
+  if (!Array.isArray(names) || !names.every((name) => typeof name === "string")) {
+    return fail(io, key, json, SENTENCE.failed);
+  }
+  return succeed(
+    io,
+    key,
+    json,
+    { application_id: appId, names },
+    names.length === 0 ? "" : `${names.join("\n")}\n`,
+  );
+}
+
+export async function env(args, io) {
+  const opened = open(args, io, ENV_OPTIONS);
+  if (opened.exit) return opened.exit;
+  const required = requireApp(io, opened.key, opened.json, opened.flags);
+  if (required.exit) return required.exit;
+  if (opened.flags.names === true) return envNames(io, opened.key, opened.json, required.appId);
+  const body = envObject(io.stdin);
+  if (body === null) return fail(io, opened.key, opened.json, SENTENCE.refused);
+  const result = await call(io, opened.key, {
+    path: `/v1/apps/${encodeURIComponent(required.appId)}/env`,
+    method: "PUT",
+    body,
+  });
+  if (result.network) return fail(io, opened.key, opened.json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, opened.key, opened.json, sentenceFor(result.status));
+  return succeed(
+    io,
+    opened.key,
+    opened.json,
+    { application_id: required.appId, replaced: true },
+    `${SENTENCE.replaced}\n`,
+  );
+}
+
+const DOMAINS_BIND_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+  slug: { type: "string" },
+  hostname: { type: "string" },
+};
+
+const DOMAINS_VERIFY_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+  id: { type: "string" },
+};
+
+const DOMAINS_UNION = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+  slug: { type: "string" },
+  hostname: { type: "string" },
+  id: { type: "string" },
+};
+
+function domainsPositionals(args) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: false,
+      allowPositionals: true,
+      options: DOMAINS_UNION,
+    }).positionals;
+  } catch {
+    return null;
+  }
+}
+
+function customDomainView(domain) {
+  if (!isRecord(domain)) return null;
+  const verification = isRecord(domain.verification) ? domain.verification : null;
+  const cname = isRecord(verification?.cname) ? verification.cname : null;
+  const txt = isRecord(verification?.txt) ? verification.txt : null;
+  if (
+    cname === null ||
+    txt === null ||
+    typeof cname.name !== "string" ||
+    typeof cname.target !== "string" ||
+    typeof txt.name !== "string" ||
+    typeof txt.value !== "string" ||
+    typeof domain.hostname !== "string" ||
+    typeof domain.kind !== "string" ||
+    typeof domain.status !== "string"
+  ) {
+    return null;
+  }
+  return {
+    hostname: domain.hostname,
+    kind: domain.kind,
+    status: domain.status,
+    verification: {
+      cname: { name: cname.name, target: cname.target },
+      txt: { name: txt.name, value: txt.value },
+    },
+  };
+}
+
+async function domainsBind(args, io, key) {
+  const parsed = parseStrict(args, DOMAINS_BIND_OPTIONS, false);
+  if (parsed === null) return fail(io, key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, key, json, SENTENCE.app);
+  const hostnameFlag = parsed.values.hostname;
+  if (hostnameFlag !== undefined && parsed.values.slug !== undefined) {
+    return fail(io, key, json, SENTENCE.refused);
+  }
+  const request = {
+    path: `/v1/apps/${encodeURIComponent(appId)}/domains`,
+    method: "POST",
+  };
+  if (hostnameFlag !== undefined) {
+    const host = trimmed(hostnameFlag);
+    if (host === "" || /\s/.test(host)) return fail(io, key, json, SENTENCE.refused);
+    request.body = { kind: "custom", hostname: host };
+  } else if (parsed.values.slug !== undefined) {
+    request.body = { slug: parsed.values.slug };
+  }
+  const result = await call(io, key, request);
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 201) return fail(io, key, json, sentenceFor(result.status));
+  const domain = isRecord(result.body) ? result.body.domain : undefined;
+  const hostname = text(domain?.hostname);
+  if (hostnameFlag === undefined) {
+    return succeed(io, key, json, { application_id: appId, hostname }, `${hostname}\n`);
+  }
+  const view = customDomainView(domain);
+  if (view === null) return fail(io, key, json, SENTENCE.failed);
+  return succeed(
+    io,
+    key,
+    json,
+    {
+      application_id: appId,
+      hostname: view.hostname,
+      kind: view.kind,
+      status: view.status,
+      verification: view.verification,
+    },
+    `${view.hostname}\n${view.status}\n${view.verification.cname.name}\n${view.verification.cname.target}\n${view.verification.txt.name}\n${view.verification.txt.value}\n`,
+  );
+}
+
+async function domainsVerify(args, io, key) {
+  const parsed = parseStrict(args, DOMAINS_VERIFY_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "verify") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, key, json, SENTENCE.app);
+  const domainId = appUuid(parsed.values.id);
+  if (domainId === null) return fail(io, key, json, SENTENCE.domainId);
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/domains/${encodeURIComponent(domainId)}/verify`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const body = isRecord(result.body) ? result.body : {};
+  const domain = isRecord(body.domain) ? body.domain : {};
+  const statusText = typeof domain.status === "string" ? domain.status : "";
+  const payload = { application_id: appId, domain_id: domainId, status: statusText };
+  let human = `${statusText}\n`;
+  if (typeof body.reason === "string" && body.reason !== "") {
+    payload.reason = body.reason;
+    human = `${statusText}\n${body.reason}\n`;
+  }
+  return succeed(io, key, json, payload, human);
+}
+
+export async function domains(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const words = domainsPositionals(args);
+  if (words === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  if (words.length === 1 && words[0] === "verify") return domainsVerify(args, io, loaded.key);
+  if (words.length !== 0) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  return domainsBind(args, io, loaded.key);
+}
+
+export async function restart(args, io) {
+  const opened = open(args, io);
+  if (opened.exit) return opened.exit;
+  const required = requireApp(io, opened.key, opened.json, opened.flags);
+  if (required.exit) return required.exit;
+  const result = await call(io, opened.key, {
+    path: `/v1/apps/${encodeURIComponent(required.appId)}/restart`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, opened.key, opened.json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, opened.key, opened.json, sentenceFor(result.status));
+  return succeed(
+    io,
+    opened.key,
+    opened.json,
+    { application_id: required.appId, restarted: true },
+    `${SENTENCE.restarted}\n`,
+  );
+}
+
+const LOGS_OPTIONS = {
+  json: { type: "boolean" },
+  source: { type: "string" },
+  tail: { type: "string" },
+};
+
+const LIST_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+function logsSuffix(source, tail) {
+  const parts = [];
+  if (source !== undefined) {
+    if (source !== "runtime" && source !== "deploy") return null;
+    parts.push(`source=${source}`);
+  }
+  if (tail !== undefined) {
+    if (!/^[1-9][0-9]*$/.test(tail)) return null;
+    const parsed = Number(tail);
+    parts.push(`tail=${parsed > 500 ? 500 : parsed}`);
+  }
+  return parts.length === 0 ? "" : `?${parts.join("&")}`;
+}
+
+export async function logs(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, LOGS_OPTIONS, true);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  if (parsed.positionals.length === 0) return fail(io, loaded.key, json, SENTENCE.logsApp);
+  if (parsed.positionals.length !== 1) return fail(io, loaded.key, json, SENTENCE.refused);
+  const appId = appUuid(parsed.positionals[0]);
+  if (appId === null) return fail(io, loaded.key, json, SENTENCE.logsApp);
+  const suffix = logsSuffix(parsed.values.source, parsed.values.tail);
+  if (suffix === null) return fail(io, loaded.key, json, SENTENCE.refused);
+  const result = await call(io, loaded.key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/logs${suffix}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  if (!isRecord(result.body) || typeof result.body.lines !== "string") {
+    return fail(io, loaded.key, json, SENTENCE.failed);
+  }
+  return succeed(io, loaded.key, json, result.body, result.body.lines);
+}
+
+function listLine(resource, row) {
+  if (!isRecord(row)) return null;
+  const id = row.id;
+  const name = row.name;
+  const projectName = row.project_name;
+  if (typeof id !== "string" || typeof name !== "string" || typeof projectName !== "string") return null;
+  if (resource === "apps") return `${id} ${name} ${projectName}`;
+  if (typeof row.kind !== "string") return null;
+  return `${id} ${row.kind} ${name} ${projectName}`;
+}
+
+function listText(resource, body) {
+  if (!isRecord(body)) return null;
+  const rows = resource === "apps" ? body.apps : body.databases;
+  if (!Array.isArray(rows)) return null;
+  const lines = [];
+  for (const row of rows) {
+    const line = listLine(resource, row);
+    if (line === null) return null;
+    lines.push(line);
+  }
+  if (lines.length === 0) return "";
+  return `${lines.join("\n")}\n`;
+}
+
+function projectRows(body) {
+  if (!isRecord(body) || !Array.isArray(body.projects)) return null;
+  const rows = [];
+  for (const item of body.projects) {
+    if (
+      !isRecord(item) ||
+      typeof item.id !== "string" ||
+      typeof item.name !== "string" ||
+      typeof item.created_at !== "string"
+    ) {
+      return null;
+    }
+    rows.push({ id: item.id, name: item.name, created_at: item.created_at });
+  }
+  return rows;
+}
+
+export async function list(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, LIST_OPTIONS, true);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  if (parsed.positionals.length !== 1) return fail(io, loaded.key, json, SENTENCE.refused);
+  const resource = parsed.positionals[0];
+  if (resource !== "apps" && resource !== "databases" && resource !== "projects") {
+    return fail(io, loaded.key, json, SENTENCE.refused);
+  }
+  const path =
+    resource === "apps" ? "/v1/apps" : resource === "databases" ? "/v1/databases" : "/v1/projects";
+  const result = await call(io, loaded.key, { path, method: "GET" });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  if (resource !== "projects") {
+    const human = listText(resource, result.body);
+    if (human === null) return fail(io, loaded.key, json, SENTENCE.failed);
+    return succeed(io, loaded.key, json, result.body, human);
+  }
+  const rows = projectRows(result.body);
+  if (rows === null) return fail(io, loaded.key, json, SENTENCE.failed);
+  const human = rows.length === 0 ? "" : `${rows.map((row) => `${row.id} ${row.name}`).join("\n")}\n`;
+  return succeed(io, loaded.key, json, { projects: rows }, human);
+}
+
+const USAGE_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+function finiteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+
+function usageText(body) {
+  if (!isRecord(body) || !isRecord(body.used) || !finiteNumber(body.used.ram_mb)) return null;
+  const used = body.used.ram_mb;
+  if (body.plan === null) return `Plan: none\nRAM used: ${used} MiB\n`;
+  if (typeof body.plan !== "string" || !isRecord(body.pools)) return null;
+  if (!finiteNumber(body.pools.ram_mb) || !finiteNumber(body.ram_remaining_mb)) return null;
+  return `Plan: ${body.plan}\nRAM used: ${used} MiB of ${body.pools.ram_mb} MiB\nRAM left: ${body.ram_remaining_mb} MiB\n`;
+}
+
+export async function usage(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, USAGE_OPTIONS, false);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  const result = await call(io, loaded.key, { path: "/v1/usage", method: "GET" });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  const human = usageText(result.body);
+  if (human === null) return fail(io, loaded.key, json, SENTENCE.failed);
+  return succeed(io, loaded.key, json, result.body, human);
+}
+
+const PLANS_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+function plansText(body) {
+  if (!isRecord(body) || !Array.isArray(body.plans)) return null;
+  const lines = [];
+  for (const row of body.plans) {
+    if (!isRecord(row) || typeof row.name !== "string") return null;
+    if (!finiteNumber(row.ram_mb) || !finiteNumber(row.cpu_milli) || !finiteNumber(row.disk_gb)) return null;
+    lines.push(`${row.name}: RAM ${row.ram_mb} MiB, CPU ${row.cpu_milli} mCPU, disk ${row.disk_gb} GB`);
+  }
+  if (lines.length === 0) return "";
+  return `${lines.join("\n")}\n`;
+}
+
+export async function plans(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, PLANS_OPTIONS, false);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  const result = await call(io, loaded.key, { path: "/v1/plans", method: "GET" });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  const human = plansText(result.body);
+  if (human === null) return fail(io, loaded.key, json, SENTENCE.failed);
+  return succeed(io, loaded.key, json, result.body, human);
+}
+
+const WHOAMI_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+function whoamiView(body) {
+  if (!isRecord(body)) return null;
+  const account = body.account;
+  const apiKey = body.key;
+  if (!isRecord(account) || !isRecord(apiKey)) return null;
+  const id = account.id;
+  const email = account.email;
+  const accountStatus = account.status;
+  const plan = account.plan;
+  const createdAt = account.created_at;
+  const keyId = apiKey.id;
+  const name = apiKey.name;
+  const keyPrefix = apiKey.key_prefix;
+  if (
+    typeof id !== "string" ||
+    typeof email !== "string" ||
+    typeof accountStatus !== "string" ||
+    typeof createdAt !== "string" ||
+    (plan !== null && typeof plan !== "string") ||
+    typeof keyId !== "string" ||
+    typeof name !== "string" ||
+    typeof keyPrefix !== "string"
+  ) {
+    return null;
+  }
+  return {
+    account: { id, email, status: accountStatus, plan, created_at: createdAt },
+    key: { id: keyId, name, key_prefix: keyPrefix },
+  };
+}
+
+export async function whoami(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, WHOAMI_OPTIONS, false);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  const result = await call(io, loaded.key, { path: "/v1/me", method: "GET" });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  const view = whoamiView(result.body);
+  if (view === null) return fail(io, loaded.key, json, SENTENCE.failed);
+  const plan = view.account.plan === null ? "none" : view.account.plan;
+  const human = `Account: ${view.account.email}\nPlan: ${plan}\nKey: ${view.key.name} (${view.key.key_prefix})\n`;
+  return succeed(io, loaded.key, json, view, human);
+}
+
+export function rollback(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  return fail(io, loaded.key, wantsJson(args), SENTENCE.rollback);
+}
+
+const DIAGNOSE_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+};
+
+const DATABASE_CREATE_OPTIONS = {
+  json: { type: "boolean" },
+  project: { type: "string" },
+  kind: { type: "string" },
+  name: { type: "string" },
+};
+
+const DATABASE_STATUS_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string" },
+};
+
+const DATABASE_DELETE_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string", multiple: true },
+  yes: { type: "boolean" },
+};
+
+const DATABASE_UNION = {
+  json: { type: "boolean" },
+  project: { type: "string" },
+  kind: { type: "string" },
+  name: { type: "string" },
+  id: { type: "string" },
+  yes: { type: "boolean" },
+};
+
+function parseStrict(args, options, allowPositionals) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: true,
+      allowPositionals,
+      options,
+    });
+  } catch {
+    return null;
+  }
+}
+
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function diagnoseSentences(body) {
+  if (!isRecord(body)) return null;
+  if (body.diagnosis === null) {
+    return typeof body.note === "string" ? `${body.note}\n` : null;
+  }
+  if (!isRecord(body.diagnosis) || typeof body.diagnosis.reason !== "string") return null;
+  if (body.diagnosis.next_step === undefined) return `${body.diagnosis.reason}\n`;
+  if (typeof body.diagnosis.next_step !== "string") return null;
+  return `${body.diagnosis.reason}\n${body.diagnosis.next_step}\n`;
+}
+
+function databaseFields(value) {
+  if (!isRecord(value)) return null;
+  const id = value.id;
+  const projectId = value.project_id;
+  const kind = value.kind;
+  const name = value.name;
+  const host = value.host;
+  const port = value.port;
+  const databaseName = value.database;
+  const user = value.user;
+  const memory = value.memory_limit;
+  const createdAt = value.created_at;
+  const updatedAt = value.updated_at;
+  if (typeof id !== "string" || typeof projectId !== "string" || typeof kind !== "string") return null;
+  if (typeof name !== "string" || typeof host !== "string" || typeof user !== "string") return null;
+  if (typeof createdAt !== "string" || typeof updatedAt !== "string") return null;
+  if (typeof port !== "number" || !Number.isInteger(port)) return null;
+  if (typeof memory !== "number" || !Number.isInteger(memory)) return null;
+  if (databaseName !== null && typeof databaseName !== "string") return null;
+  return {
+    id,
+    project_id: projectId,
+    kind,
+    name,
+    host,
+    port,
+    database: databaseName,
+    user,
+    memory_limit: memory,
+    created_at: createdAt,
+    updated_at: updatedAt,
+  };
+}
+
+function databaseLines(view) {
+  const lines = [view.id, view.project_id, view.kind, view.name, view.host, String(view.port)];
+  if (view.database !== null) lines.push(view.database);
+  lines.push(view.user, String(view.memory_limit), view.created_at, view.updated_at);
+  return lines;
+}
+
+function databasePositionals(args) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: false,
+      allowPositionals: true,
+      options: DATABASE_UNION,
+    }).positionals;
+  } catch {
+    return null;
+  }
+}
+
+export async function diagnose(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const parsed = parseStrict(args, DIAGNOSE_OPTIONS, false);
+  if (parsed === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, loaded.key, json, SENTENCE.app);
+  const result = await call(io, loaded.key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/diagnostics`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, loaded.key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status));
+  const human = diagnoseSentences(result.body);
+  if (human === null) return fail(io, loaded.key, json, SENTENCE.failed);
+  return succeed(io, loaded.key, json, result.body, human);
+}
+
+async function databaseCreate(args, io, key) {
+  const parsed = parseStrict(args, DATABASE_CREATE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "create") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const project = trimmed(parsed.values.project);
+  const kind = trimmed(parsed.values.kind);
+  const name = trimmed(parsed.values.name);
+  if (project === "" || kind === "" || name === "") {
+    return fail(io, key, json, SENTENCE.databaseFlags);
+  }
+  const projectId = appUuid(project);
+  if (projectId === null) return fail(io, key, json, SENTENCE.projectId);
+  if (kind !== "postgres" && kind !== "redis") return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: `/v1/projects/${encodeURIComponent(projectId)}/databases`,
+    method: "POST",
+    body: { kind, name },
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 201) {
+    return fail(io, key, json, upgradeMessage(result.status, result.body) ?? sentenceFor(result.status));
+  }
+  const view = databaseFields(isRecord(result.body) ? result.body.database : null);
+  const password = isRecord(result.body) ? result.body.password : undefined;
+  if (view === null || typeof password !== "string") return fail(io, key, json, SENTENCE.failed);
+  const lines = databaseLines(view);
+  lines.push(password);
+  return succeed(io, key, json, { database: view, password }, `${lines.join("\n")}\n`);
+}
+
+async function databaseStatus(args, io, key) {
+  const parsed = parseStrict(args, DATABASE_STATUS_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "status") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const id = appUuid(parsed.values.id);
+  if (id === null) return fail(io, key, json, SENTENCE.databaseId);
+  const result = await call(io, key, {
+    path: `/v1/databases/${encodeURIComponent(id)}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const view = databaseFields(isRecord(result.body) ? result.body.database : null);
+  const statusText = isRecord(result.body) ? result.body.status : undefined;
+  if (view === null || typeof statusText !== "string") return fail(io, key, json, SENTENCE.failed);
+  const payload = {
+    id: view.id,
+    project_id: view.project_id,
+    kind: view.kind,
+    name: view.name,
+    host: view.host,
+    port: view.port,
+    database: view.database,
+    user: view.user,
+    memory_limit: view.memory_limit,
+    created_at: view.created_at,
+    updated_at: view.updated_at,
+    status: statusText,
+  };
+  const lines = [statusText, ...databaseLines(view)];
+  return succeed(io, key, json, payload, `${lines.join("\n")}\n`);
+}
+
+async function databaseBackup(args, io, key) {
+  const parsed = parseStrict(args, DATABASE_STATUS_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "backup") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const id = appUuid(parsed.values.id);
+  if (id === null) return fail(io, key, json, SENTENCE.databaseId);
+  const result = await call(io, key, {
+    path: `/v1/databases/${encodeURIComponent(id)}/backups`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status === 409) return fail(io, key, json, SENTENCE.noBackup);
+  if (result.status !== 202) return fail(io, key, json, sentenceFor(result.status));
+  return succeed(io, key, json, { database_id: id, backup: "run" }, "Backup run.\n");
+}
+
+async function databaseDelete(args, io, key) {
+  const parsed = parseStrict(args, DATABASE_DELETE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "delete") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const ids = Array.isArray(parsed.values.id) ? parsed.values.id : [];
+  if (ids.length > 1) return fail(io, key, json, SENTENCE.refused);
+  const id = appUuid(ids[0]);
+  if (id === null) return fail(io, key, json, SENTENCE.databaseId);
+  if (parsed.values.yes !== true) return fail(io, key, json, SENTENCE.deleteConfirm);
+  const result = await call(io, key, {
+    path: `/v1/databases/${encodeURIComponent(id)}`,
+    method: "DELETE",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 204) return fail(io, key, json, sentenceFor(result.status));
+  return succeed(io, key, json, { database_id: id, removed: true }, "Database removed.\n");
+}
+
+export async function database(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const words = databasePositionals(args);
+  if (words === null || words.length !== 1) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  if (words[0] === "create") return databaseCreate(args, io, loaded.key);
+  if (words[0] === "status") return databaseStatus(args, io, loaded.key);
+  if (words[0] === "backup") return databaseBackup(args, io, loaded.key);
+  if (words[0] === "delete") return databaseDelete(args, io, loaded.key);
+  return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+}
+
+const STORAGE_CREATE_OPTIONS = {
+  json: { type: "boolean" },
+  name: { type: "string" },
+};
+
+const STORAGE_LIST_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+const STORAGE_SHOW_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string" },
+};
+
+const STORAGE_DELETE_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string", multiple: true },
+  yes: { type: "boolean" },
+};
+
+const STORAGE_UNION = {
+  json: { type: "boolean" },
+  name: { type: "string" },
+  id: { type: "string" },
+  yes: { type: "boolean" },
+};
+
+function storagePositionals(args) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: false,
+      allowPositionals: true,
+      options: STORAGE_UNION,
+    }).positionals;
+  } catch {
+    return null;
+  }
+}
+
+function storageFields(value) {
+  if (!isRecord(value)) return null;
+  const id = value.id;
+  const name = value.name;
+  const endpoint = value.endpoint;
+  const bucket = value.bucket;
+  const accessKeyId = value.access_key_id;
+  const status = value.status;
+  const createdAt = value.created_at;
+  const updatedAt = value.updated_at;
+  if (typeof id !== "string" || typeof name !== "string" || typeof endpoint !== "string") return null;
+  if (typeof bucket !== "string" || typeof status !== "string") return null;
+  if (typeof createdAt !== "string" || typeof updatedAt !== "string") return null;
+  if (accessKeyId !== null && typeof accessKeyId !== "string") return null;
+  return {
+    id,
+    name,
+    endpoint,
+    bucket,
+    access_key_id: accessKeyId,
+    status,
+    created_at: createdAt,
+    updated_at: updatedAt,
+  };
+}
+
+function storageLines(view) {
+  const lines = [view.id, view.name, view.endpoint, view.bucket];
+  if (view.access_key_id !== null) lines.push(view.access_key_id);
+  lines.push(view.status, view.created_at, view.updated_at);
+  return lines;
+}
+
+async function storageCreate(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_CREATE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "create") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const name = trimmed(parsed.values.name);
+  if (name === "") return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: "/v1/buckets",
+    method: "POST",
+    body: { name },
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  const refusal = storageCreateMessage(result.status, result.body);
+  if (refusal !== null) return fail(io, key, json, refusal);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 201) {
+    return fail(io, key, json, upgradeMessage(result.status, result.body) ?? sentenceFor(result.status));
+  }
+  const body = isRecord(result.body) ? result.body : null;
+  const view = body === null ? null : storageFields(body.bucket);
+  const credentials = body === null ? null : body.credentials;
+  if (
+    view === null ||
+    !isRecord(credentials) ||
+    typeof credentials.endpoint !== "string" ||
+    typeof credentials.bucket !== "string" ||
+    typeof credentials.access_key_id !== "string" ||
+    typeof credentials.secret_access_key !== "string"
+  ) {
+    return fail(io, key, json, SENTENCE.failed);
+  }
+  const payloadCredentials = {
+    endpoint: credentials.endpoint,
+    bucket: credentials.bucket,
+    access_key_id: credentials.access_key_id,
+    secret_access_key: credentials.secret_access_key,
+    ...(typeof credentials.region === "string" ? { region: credentials.region } : {}),
+  };
+  const lines = [
+    view.id,
+    view.name,
+    payloadCredentials.endpoint,
+    payloadCredentials.bucket,
+    payloadCredentials.access_key_id,
+    payloadCredentials.secret_access_key,
+  ];
+  return succeed(io, key, json, { bucket: view, credentials: payloadCredentials }, `${lines.join("\n")}\n`);
+}
+
+async function storageList(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_LIST_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "list") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const result = await call(io, key, { path: "/v1/buckets", method: "GET" });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const items = isRecord(result.body) && Array.isArray(result.body.buckets) ? result.body.buckets : null;
+  if (items === null) return fail(io, key, json, SENTENCE.failed);
+  const views = [];
+  for (const item of items) {
+    const row = storageFields(item);
+    if (row === null) return fail(io, key, json, SENTENCE.failed);
+    views.push(row);
+  }
+  const human = views.length === 0 ? "" : `${views.map((row) => `${row.id} ${row.name} ${row.status}`).join("\n")}\n`;
+  return succeed(io, key, json, { buckets: views }, human);
+}
+
+async function storageShow(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_SHOW_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "show") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const id = appUuid(parsed.values.id);
+  if (id === null) return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: `/v1/buckets/${encodeURIComponent(id)}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status));
+  const view = storageFields(isRecord(result.body) ? result.body.bucket : null);
+  if (view === null) return fail(io, key, json, SENTENCE.failed);
+  return succeed(io, key, json, { bucket: view }, `${storageLines(view).join("\n")}\n`);
+}
+
+async function storageDelete(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_DELETE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "delete") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const ids = Array.isArray(parsed.values.id) ? parsed.values.id : [];
+  if (ids.length > 1) return fail(io, key, json, SENTENCE.refused);
+  const id = appUuid(ids[0]);
+  if (id === null) return fail(io, key, json, SENTENCE.refused);
+  if (parsed.values.yes !== true) return fail(io, key, json, SENTENCE.bucketConfirm);
+  const result = await call(io, key, {
+    path: `/v1/buckets/${encodeURIComponent(id)}`,
+    method: "DELETE",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status === 409) return fail(io, key, json, SENTENCE.bucketNotEmpty);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 204) return fail(io, key, json, sentenceFor(result.status));
+  return succeed(io, key, json, { bucket_id: id, removed: true }, `${SENTENCE.bucketRemoved}\n`);
+}
+
+export async function storage(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const words = storagePositionals(args);
+  if (words === null || words.length !== 1) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  if (words[0] === "create") return storageCreate(args, io, loaded.key);
+  if (words[0] === "list") return storageList(args, io, loaded.key);
+  if (words[0] === "show") return storageShow(args, io, loaded.key);
+  if (words[0] === "delete") return storageDelete(args, io, loaded.key);
+  return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+}
+
+function stdinKey(io) {
+  return typeof io.stdin === "string" ? io.stdin.trim() : "";
+}
+
+export async function login(args, io) {
+  if (Array.isArray(args) && args.length > 0) return fail(io, "", false, SENTENCE.refused);
+  const key = stdinKey(io);
+  if (key === "") return fail(io, "", false, SENTENCE.emptyKey);
+  const result = await call(io, key, { path: "/v1/me", method: "GET" });
+  if (result.network) return fail(io, key, false, SENTENCE.platform);
+  if (result.status !== 200) return fail(io, key, false, sentenceFor(result.status));
+  saveApiKey(io.env, key);
+  io.stdout.write(`${SENTENCE.loggedIn}\n`);
+  return { exitCode: 0 };
+}
+
+export async function logout(args, io) {
+  if (Array.isArray(args) && args.length > 0) return fail(io, "", false, SENTENCE.refused);
+  const removed = removeApiKey(io.env).removed === true;
+  io.stdout.write(`${removed ? SENTENCE.loggedOut : SENTENCE.nothingToRemove}\n`);
+  return { exitCode: 0 };
+}