@astris-labs/cli 0.1.4 → 0.2.0

package/src/commands.mjs

@@ -29,10 +29,14 @@ const SENTENCE = {
   taken: "That name or hostname is already taken. Choose another and try again.",
   noBackup: "This database has no backup job. Only Postgres databases are backed up.",
   deleteConfirm: "This removes the database and its data. Add --yes to confirm.",
+  projectDeleteConfirm: "This removes the project. Add --yes to confirm.",
+  domainRemoveConfirm: "This removes the domain and its hostname. Add --yes to confirm.",
+  domainRemoved: "Domain removed.",
+  projectRemoved: "Project removed.",
   bucketConfirm: "This removes the bucket and its objects. Add --yes to confirm.",
   bucketRemoved: "Bucket removed.",
   bucketNotEmpty: "That bucket is not empty. Remove its objects, then try again.",
-  bucketLimit: "This account has reached its bucket safety limit. Contact support.",
+  bucketLimit: "This account has reached its bucket limit. Delete a bucket you no longer need, then try again.",
   storageOff: "Storage is not available right now. Try again later.",
   platform: "The platform did not accept the change. Check status, then try again.",
   failed: "Astris failed on its side. Try again.",
@@ -45,14 +49,20 @@ const SENTENCE = {
   loggedOut: "Logged out.",
   nothingToRemove: "There was nothing to remove.",
   appRemoved: "App removed.",
+  appStarted: "App started.",
+  appStopped: "App stopped.",
   confirmRequired: "Send --confirm set to the application name.",
   nameMismatch: "The name does not match the application.",
+  composeConfirm: "Send --confirm set to the stack's exact name. Removing a stack deletes its volumes and all their data.",
+  composeRemoved: "Compose stack removed.",
   unreadableDir: "That directory cannot be read.",
   exportEmail: "Send --email set to the account email address.",
   exportAccepted:
     "Accepted. If that address is on an Astris account, check its inbox for the download link. The link works for one hour.",
 };
 
+export const REFUSED_DATABASE_KIND = "Astris offers Postgres and Redis databases. Set kind to postgres or redis.";
+
 const HTTP_SENTENCE = new Map([
   [400, SENTENCE.refused],
   [401, SENTENCE.unauthorized],
@@ -74,38 +84,60 @@ function sentenceFor(status, retryAfterSeconds = null) {
   return HTTP_SENTENCE.get(status) ?? SENTENCE.failed;
 }
 
-function errorMessage(status, body, retryAfterSeconds = null) {
+// T-439: every door print of server-controlled text goes through this first.
+// It strips ANSI escape sequences, C0 controls except tab and newline, C1
+// controls, U+2028, U+2029 and bidi controls. Same table as sanitizeMcp.
+export function sanitizeCli(text) {
+  return text.replace(
+    /\x1B\[[\x30-\x3F]*[\x40-\x7E]|[\x00-\x08\x0B-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069\u200E\u200F\u061C]/g,
+    "",
+  );
+}
+
+export function errorMessage(status, body, retryAfterSeconds = null) {
   if (status === 429) return rateWaitSentence(retryAfterSeconds);
-  if (isRecord(body) && typeof body.message === "string") return body.message;
+  if (isRecord(body) && typeof body.message === "string") return sanitizeCli(body.message);
   return sentenceFor(status, retryAfterSeconds);
 }
 
-function upgradeMessage(status, body) {
+// T-411 C4: a door's refusal is the route's refusal. The body's message wins,
+// then its error word, and only a body with neither gets the status sentence.
+function doorRefusal(io, key, json, result, fallback) {
+  if (result.status === 429) {
+    return fail(io, key, json, rateWaitSentence(result.retryAfterSeconds));
+  }
+  const body = isRecord(result.body) ? result.body : {};
+  if (typeof body.message === "string") return fail(io, key, json, sanitizeCli(body.message));
+  if (typeof body.error === "string") return fail(io, key, json, sanitizeCli(body.error));
+  return fail(io, key, json, fallback);
+}
+
+export function upgradeMessage(status, body) {
   if (status !== 403 || !isRecord(body) || body.error !== "upgrade_required" || typeof body.message !== "string") {
     return null;
   }
-  return body.message;
+  return sanitizeCli(body.message);
 }
 
 // T-275: the API pauses compose redeploy in the private preview and says why.
-function composeUnavailableMessage(status, body) {
+export function composeUnavailableMessage(status, body) {
   if (status !== 403 || !isRecord(body) || body.error !== "compose_unavailable" || typeof body.message !== "string") {
     return null;
   }
-  return body.message;
+  return sanitizeCli(body.message);
 }
 
-function storageCreateMessage(status, body) {
+export function storageCreateMessage(status, body) {
   if (!isRecord(body)) return null;
   if (status === 403 && body.error === "bucket_limit") {
     if (typeof body.message === "string" && body.message.length > 0) {
-      return body.message;
+      return sanitizeCli(body.message);
     }
     return SENTENCE.bucketLimit;
   }
   if (status === 503 && body.error === "storage_unavailable") {
     if (typeof body.message === "string" && body.message.length > 0) {
-      return body.message;
+      return sanitizeCli(body.message);
     }
     return null;
   }
@@ -180,6 +212,7 @@ const DEPLOY_OPTIONS = {
   command: { type: "string" },
   schedule: { type: "string" },
   hook: { type: "boolean" },
+  wait: { type: "boolean" },
 };
 
 const ENV_OPTIONS = {
@@ -220,6 +253,7 @@ function parseFlags(args, extra) {
     else if (token.name === "schedule") flags.schedule = token.value;
     else if (token.name === "names") flags.names = true;
     else if (token.name === "hook") flags.hook = true;
+    else if (token.name === "wait") flags.wait = true;
   }
   return flags;
 }
@@ -311,6 +345,22 @@ function hostnamesOf(body) {
   return hostnames.filter((item) => typeof item === "string");
 }
 
+function checkOf(body) {
+  const raw = body?.check;
+  if (!isRecord(raw)) return null;
+  const state = raw.state;
+  if (state !== "answering" && state !== "not_answering") return null;
+  const since = raw.since;
+  if (since !== null && typeof since !== "string") return null;
+  return { state, since };
+}
+
+function checkLine(check) {
+  const words = check.state === "not_answering" ? "not answering" : "answering";
+  if (check.since === null) return `check: ${words}`;
+  return `check: ${words} since ${check.since}`;
+}
+
 function deploymentRows(body) {
   const rows = Array.isArray(body?.deployments) ? body.deployments.slice(0, 5) : [];
   return rows.map((row) => ({
@@ -321,6 +371,78 @@ function deploymentRows(body) {
   }));
 }
 
+// T-440: the wait watches deployments[0], the newest row the route returns.
+// The stamp strings are compared to each other, never to the clock.
+const WAIT_CEILING_MS = 600000;
+const WAIT_POLL_MS = 3000;
+const WAIT_RUNNING = "still running, check status";
+
+function newerDeployment(body, mark) {
+  const [first] = deploymentRows(body);
+  if (first === undefined || first.created_at === null) return null;
+  if (mark === null || first.created_at > mark) return first;
+  return null;
+}
+
+async function waitMark(io, key, json, appId, created) {
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}`,
+    method: "GET",
+  });
+  if (result.network) return { exit: fail(io, key, json, SENTENCE.platform, created) };
+  if (result.status !== 200) {
+    return { exit: fail(io, key, json, sentenceFor(result.status, result.retryAfterSeconds), created) };
+  }
+  return { mark: deploymentRows(result.body)[0]?.created_at ?? null };
+}
+
+async function waitForOutcome(io, key, json, appId, mark, created) {
+  const started = Date.now();
+  let delay = 0;
+  let rateSentence = null;
+  for (;;) {
+    if (delay > 0) {
+      if (started + WAIT_CEILING_MS > Date.now() + delay) {
+        await new Promise((resolve) => setTimeout(resolve, delay));
+      } else {
+        return { exit: fail(io, key, json, rateSentence, created) };
+      }
+    }
+    const polled = await call(io, key, {
+      path: `/v1/apps/${encodeURIComponent(appId)}`,
+      method: "GET",
+    });
+    if (polled.network) return { exit: fail(io, key, json, SENTENCE.platform, created) };
+    if (polled.status === 429) {
+      rateSentence = sentenceFor(429, polled.retryAfterSeconds);
+      if (typeof polled.retryAfterSeconds !== "number") {
+        return { exit: fail(io, key, json, rateSentence, created) };
+      }
+      delay = polled.retryAfterSeconds * 1000;
+      continue;
+    }
+    if (polled.status !== 200) {
+      return { exit: fail(io, key, json, sentenceFor(polled.status, polled.retryAfterSeconds), created) };
+    }
+    const row = newerDeployment(polled.body, mark);
+    if (row !== null && (row.status === "done" || row.status === "error" || row.status === "cancelled")) {
+      return { outcome: row.status };
+    }
+    const remaining = started + WAIT_CEILING_MS - Date.now();
+    if (remaining > WAIT_POLL_MS) {
+      await new Promise((resolve) => setTimeout(resolve, WAIT_POLL_MS));
+      continue;
+    }
+    return { outcome: WAIT_RUNNING };
+  }
+}
+
+function waitSucceed(io, key, json, payload, outcome) {
+  if (json) writeStdout(io, key, `${JSON.stringify({ ...payload, outcome })}\n`);
+  else writeStdout(io, key, `${outcome}\n`);
+  return { exitCode: outcome === "done" ? 0 : 1 };
+}
+
 function envObject(stdin) {
   if (typeof stdin !== "string") return null;
   let value;
@@ -344,7 +466,13 @@ function findProjectId(body, name) {
   return null;
 }
 
-async function redeploy(io, key, json, appId) {
+async function redeploy(io, key, json, appId, wait) {
+  let mark = null;
+  if (wait) {
+    const watched = await waitMark(io, key, json, appId);
+    if (watched.exit) return watched.exit;
+    mark = watched.mark;
+  }
   const result = await call(io, key, {
     path: `/v1/apps/${encodeURIComponent(appId)}/deploy`,
     method: "POST",
@@ -354,13 +482,11 @@ async function redeploy(io, key, json, appId) {
   const application = result.body?.application ?? {};
   const id = text(application.id) || appId;
   const name = text(application.name);
-  return succeed(
-    io,
-    key,
-    json,
-    { application_id: id, name, accepted: true },
-    `${id}\n${name}\n`,
-  );
+  const payload = { application_id: id, name, accepted: true };
+  if (!wait) return succeed(io, key, json, payload, `${id}\n${name}\n`);
+  const waited = await waitForOutcome(io, key, json, id, mark);
+  if (waited.exit) return waited.exit;
+  return waitSucceed(io, key, json, payload, waited.outcome);
 }
 
 // T-146: the create-only body keys from --build and --kind, or null when the
@@ -530,6 +656,12 @@ async function createThenDeploy(io, key, json, flags) {
         `${projectId}\n${applicationId}\n${keyName}\n${keySlug}\n${deployKey.type}\n${deployKey.public_key}\n${deployKey.fingerprint}\n${SENTENCE.deployKey}\n`,
       );
     }
+    let mark = null;
+    if (flags.wait === true) {
+      const watched = await waitMark(io, key, json, applicationId, created);
+      if (watched.exit) return watched.exit;
+      mark = watched.mark;
+    }
     const deployed = await call(io, key, {
       path: `/v1/apps/${encodeURIComponent(applicationId)}/deploy`,
       method: "POST",
@@ -540,19 +672,19 @@ async function createThenDeploy(io, key, json, flags) {
     const id = text(shown.id) || applicationId;
     const shownName = text(shown.name) || name;
     const slug = text(shown.slug);
-    return succeed(
-      io,
-      key,
-      json,
-      {
-        project_id: projectId,
-        application_id: id,
-        name: shownName,
-        slug,
-        accepted: true,
-      },
-      `${projectId}\n${id}\n${shownName}\n${slug}\n`,
-    );
+    const payload = {
+      project_id: projectId,
+      application_id: id,
+      name: shownName,
+      slug,
+      accepted: true,
+    };
+    if (flags.wait !== true) {
+      return succeed(io, key, json, payload, `${projectId}\n${id}\n${shownName}\n${slug}\n`);
+    }
+    const waited = await waitForOutcome(io, key, json, id, mark, created);
+    if (waited.exit) return waited.exit;
+    return waitSucceed(io, key, json, payload, waited.outcome);
   } catch {
     return fail(io, key, json, SENTENCE.platform, created);
   }
@@ -578,8 +710,11 @@ export async function deploy(args, io) {
     ) {
       return fail(io, opened.key, opened.json, SENTENCE.refused);
     }
-    if (opened.flags.hook === true) return hookUrl(io, opened.key, opened.json, appId);
-    return redeploy(io, opened.key, opened.json, appId);
+    if (opened.flags.hook === true) {
+      if (opened.flags.wait === true) return fail(io, opened.key, opened.json, SENTENCE.refused);
+      return hookUrl(io, opened.key, opened.json, appId);
+    }
+    return redeploy(io, opened.key, opened.json, appId, opened.flags.wait === true);
   }
   return createThenDeploy(io, opened.key, opened.json, opened.flags);
 }
@@ -598,18 +733,19 @@ export async function status(args, io) {
   const statusText = text(result.body?.status);
   const hostnames = hostnamesOf(result.body);
   const id = text(result.body?.application?.id) || required.appId;
-  return succeed(
-    io,
-    opened.key,
-    opened.json,
-    {
-      application_id: id,
-      status: statusText,
-      hostnames,
-      deployments: deploymentRows(result.body),
-    },
-    `${statusText}\n${hostnames.join("\n")}${hostnames.length > 0 ? "\n" : ""}`,
-  );
+  const check = checkOf(result.body);
+  const payload = {
+    application_id: id,
+    status: statusText,
+    hostnames,
+    deployments: deploymentRows(result.body),
+  };
+  let human = `${statusText}\n${hostnames.join("\n")}${hostnames.length > 0 ? "\n" : ""}`;
+  if (check !== null) {
+    payload.check = check;
+    human += `${checkLine(check)}\n`;
+  }
+  return succeed(io, opened.key, opened.json, payload, human);
 }
 
 // T-169: GET /v1/apps/:id/hook answers {hook: {url}}. The URL is a
@@ -685,12 +821,20 @@ const DOMAINS_VERIFY_OPTIONS = {
   id: { type: "string" },
 };
 
+const DOMAINS_REMOVE_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+  id: { type: "string", multiple: true },
+  yes: { type: "boolean" },
+};
+
 const DOMAINS_UNION = {
   json: { type: "boolean" },
   app: { type: "string" },
   slug: { type: "string" },
   hostname: { type: "string" },
   id: { type: "string" },
+  yes: { type: "boolean" },
 };
 
 function domainsPositionals(args) {
@@ -781,6 +925,56 @@ async function domainsBind(args, io, key) {
   );
 }
 
+// T-411 R2: one domain read. GET /v1/apps/:id/domains/:domainId and nothing
+// else; the certificate word is the route's, not the door's.
+async function domainsStatus(args, io, key) {
+  const parsed = parseStrict(args, DOMAINS_VERIFY_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "status") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, key, json, SENTENCE.app);
+  const domainId = appUuid(parsed.values.id);
+  if (domainId === null) return fail(io, key, json, SENTENCE.domainId);
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/domains/${encodeURIComponent(domainId)}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  const domain = isRecord(result.body) && isRecord(result.body.domain) ? result.body.domain : null;
+  if (
+    domain === null ||
+    typeof domain.id !== "string" ||
+    typeof domain.hostname !== "string" ||
+    typeof domain.kind !== "string" ||
+    typeof domain.status !== "string" ||
+    typeof domain.certificate !== "string"
+  ) {
+    return fail(io, key, json, SENTENCE.failed);
+  }
+  const payload = {
+    application_id: appId,
+    domain: {
+      id: domain.id,
+      hostname: domain.hostname,
+      kind: domain.kind,
+      status: domain.status,
+      certificate: domain.certificate,
+    },
+  };
+  return succeed(
+    io,
+    key,
+    json,
+    payload,
+    `${domain.hostname}\n${domain.status}\n${domain.certificate}\n`,
+  );
+}
+
 async function domainsVerify(args, io, key) {
   const parsed = parseStrict(args, DOMAINS_VERIFY_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "verify") {
@@ -799,22 +993,55 @@ async function domainsVerify(args, io, key) {
   if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status, result.retryAfterSeconds));
   const body = isRecord(result.body) ? result.body : {};
   const domain = isRecord(body.domain) ? body.domain : {};
-  const statusText = typeof domain.status === "string" ? domain.status : "";
+  const statusText = sanitizeCli(typeof domain.status === "string" ? domain.status : "");
   const payload = { application_id: appId, domain_id: domainId, status: statusText };
   let human = `${statusText}\n`;
   if (typeof body.reason === "string" && body.reason !== "") {
-    payload.reason = body.reason;
-    human = `${statusText}\n${body.reason}\n`;
+    const reason = sanitizeCli(body.reason);
+    payload.reason = reason;
+    human = `${statusText}\n${reason}\n`;
   }
   return succeed(io, key, json, payload, human);
 }
 
+async function domainsRemove(args, io, key) {
+  const parsed = parseStrict(args, DOMAINS_REMOVE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "remove") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, key, json, SENTENCE.app);
+  const ids = Array.isArray(parsed.values.id) ? parsed.values.id : [];
+  if (ids.length > 1) return fail(io, key, json, SENTENCE.refused);
+  const domainId = appUuid(ids[0]);
+  if (domainId === null) return fail(io, key, json, SENTENCE.domainId);
+  if (parsed.values.yes !== true) return fail(io, key, json, SENTENCE.domainRemoveConfirm);
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/domains/${encodeURIComponent(domainId)}`,
+    method: "DELETE",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 204) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  return succeed(
+    io,
+    key,
+    json,
+    { application_id: appId, domain_id: domainId, removed: true },
+    `${SENTENCE.domainRemoved}\n`,
+  );
+}
+
 export async function domains(args, io) {
   const loaded = loadKey(io);
   if (loaded.exit) return loaded.exit;
   const words = domainsPositionals(args);
   if (words === null) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
   if (words.length === 1 && words[0] === "verify") return domainsVerify(args, io, loaded.key);
+  if (words.length === 1 && words[0] === "remove") return domainsRemove(args, io, loaded.key);
+  if (words.length === 1 && words[0] === "status") return domainsStatus(args, io, loaded.key);
   if (words.length !== 0) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
   return domainsBind(args, io, loaded.key);
 }
@@ -839,17 +1066,21 @@ export async function restart(args, io) {
   );
 }
 
+const MAX_DEPLOYMENT = 5; // the server's, src/app/v1/apps/[id]/logs/route.ts:15
+
 const LOGS_OPTIONS = {
   json: { type: "boolean" },
   source: { type: "string" },
   tail: { type: "string" },
+  deployment: { type: "string" },
 };
 
 const LIST_OPTIONS = {
   json: { type: "boolean" },
+  id: { type: "string" },
 };
 
-function logsSuffix(source, tail) {
+function logsSuffix(source, tail, deployment) {
   const parts = [];
   if (source !== undefined) {
     if (source !== "runtime" && source !== "deploy") return null;
@@ -860,6 +1091,13 @@ function logsSuffix(source, tail) {
     const parsed = Number(tail);
     parts.push(`tail=${parsed > 500 ? 500 : parsed}`);
   }
+  if (deployment !== undefined) {
+    if (source !== "deploy") return null;
+    if (!/^[1-9][0-9]*$/.test(deployment)) return null;
+    const parsed = Number(deployment);
+    if (parsed > MAX_DEPLOYMENT) return null;
+    parts.push(`deployment=${parsed}`);
+  }
   return parts.length === 0 ? "" : `?${parts.join("&")}`;
 }
 
@@ -873,7 +1111,7 @@ export async function logs(args, io) {
   if (parsed.positionals.length !== 1) return fail(io, loaded.key, json, SENTENCE.refused);
   const appId = appUuid(parsed.positionals[0]);
   if (appId === null) return fail(io, loaded.key, json, SENTENCE.logsApp);
-  const suffix = logsSuffix(parsed.values.source, parsed.values.tail);
+  const suffix = logsSuffix(parsed.values.source, parsed.values.tail, parsed.values.deployment);
   if (suffix === null) return fail(io, loaded.key, json, SENTENCE.refused);
   const result = await call(io, loaded.key, {
     path: `/v1/apps/${encodeURIComponent(appId)}/logs${suffix}`,
@@ -912,23 +1150,46 @@ function listText(resource, body) {
   return `${lines.join("\n")}\n`;
 }
 
+function projectRow(item) {
+  if (
+    !isRecord(item) ||
+    typeof item.id !== "string" ||
+    typeof item.name !== "string" ||
+    typeof item.created_at !== "string"
+  ) {
+    return null;
+  }
+  return { id: item.id, name: item.name, created_at: item.created_at };
+}
+
 function projectRows(body) {
   if (!isRecord(body) || !Array.isArray(body.projects)) return null;
   const rows = [];
   for (const item of body.projects) {
-    if (
-      !isRecord(item) ||
-      typeof item.id !== "string" ||
-      typeof item.name !== "string" ||
-      typeof item.created_at !== "string"
-    ) {
-      return null;
-    }
-    rows.push({ id: item.id, name: item.name, created_at: item.created_at });
+    const row = projectRow(item);
+    if (row === null) return null;
+    rows.push(row);
   }
   return rows;
 }
 
+// T-411 R21: the one project read. GET /v1/projects/:id, nothing else.
+async function listProject(io, key, json, rawId) {
+  const projectId = appUuid(rawId);
+  if (projectId === null) return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: `/v1/projects/${encodeURIComponent(projectId)}`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  const row = projectRow(isRecord(result.body) ? result.body.project : null);
+  if (row === null) return fail(io, key, json, SENTENCE.failed);
+  return succeed(io, key, json, { project: row }, `${row.id} ${row.name}\n`);
+}
+
 export async function list(args, io) {
   const loaded = loadKey(io);
   if (loaded.exit) return loaded.exit;
@@ -940,6 +1201,11 @@ export async function list(args, io) {
   if (resource !== "apps" && resource !== "databases" && resource !== "projects") {
     return fail(io, loaded.key, json, SENTENCE.refused);
   }
+  // Only projects has a one read here, so --id on apps or databases is refused.
+  if (parsed.values.id !== undefined) {
+    if (resource !== "projects") return fail(io, loaded.key, json, SENTENCE.refused);
+    return listProject(io, loaded.key, json, parsed.values.id);
+  }
   const path =
     resource === "apps" ? "/v1/apps" : resource === "databases" ? "/v1/databases" : "/v1/projects";
   const result = await call(io, loaded.key, { path, method: "GET" });
@@ -956,6 +1222,121 @@ export async function list(args, io) {
   return succeed(io, loaded.key, json, { projects: rows }, human);
 }
 
+const PROJECT_CREATE_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+const PROJECT_LIST_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+const PROJECT_DELETE_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string", multiple: true },
+  yes: { type: "boolean" },
+};
+
+const PROJECT_UNION = {
+  json: { type: "boolean" },
+  id: { type: "string" },
+  yes: { type: "boolean" },
+};
+
+function projectPositionals(args) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: false,
+      allowPositionals: true,
+      options: PROJECT_UNION,
+    }).positionals;
+  } catch {
+    return null;
+  }
+}
+
+async function projectCreate(args, io, key) {
+  const parsed = parseStrict(args, PROJECT_CREATE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 2 || parsed.positionals[0] !== "create") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const name = trimmed(parsed.positionals[1]);
+  if (name === "") return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: "/v1/projects",
+    method: "POST",
+    body: { name },
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 201) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  if (json) return succeed(io, key, json, result.body, "");
+  const row = projectRow(isRecord(result.body) ? result.body.project : null);
+  if (row === null) return fail(io, key, json, SENTENCE.failed);
+  return succeed(io, key, json, { project: row }, `${row.id}\n`);
+}
+
+async function projectList(args, io, key) {
+  const parsed = parseStrict(args, PROJECT_LIST_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "list") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const result = await call(io, key, { path: "/v1/projects", method: "GET" });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  if (json) return succeed(io, key, json, result.body, "");
+  const rows = projectRows(result.body);
+  if (rows === null) return fail(io, key, json, SENTENCE.failed);
+  const human = rows.length === 0 ? "" : `${rows.map((row) => `${row.id} ${row.name}`).join("\n")}\n`;
+  return succeed(io, key, json, { projects: rows }, human);
+}
+
+// T-411 second fix: DELETE /v1/projects/:id, the one project delete. The route
+// reads no body, so the door sends the id and nothing else.
+async function projectDelete(args, io, key) {
+  const parsed = parseStrict(args, PROJECT_DELETE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "delete") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const ids = Array.isArray(parsed.values.id) ? parsed.values.id : [];
+  if (ids.length > 1) return fail(io, key, json, SENTENCE.refused);
+  const projectId = appUuid(ids[0]);
+  if (projectId === null) return fail(io, key, json, SENTENCE.refused);
+  if (parsed.values.yes !== true) return fail(io, key, json, SENTENCE.projectDeleteConfirm);
+  const result = await call(io, key, {
+    path: `/v1/projects/${encodeURIComponent(projectId)}`,
+    method: "DELETE",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 204) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  return succeed(
+    io,
+    key,
+    json,
+    { project_id: projectId, removed: true },
+    `${SENTENCE.projectRemoved}\n`,
+  );
+}
+
+export async function project(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const words = projectPositionals(args);
+  if (words === null || words.length === 0) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  if (words[0] === "delete") return projectDelete(args, io, loaded.key);
+  if (words[0] === "create") return projectCreate(args, io, loaded.key);
+  if (words[0] === "list") return projectList(args, io, loaded.key);
+  return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+}
+
 const USAGE_OPTIONS = {
   json: { type: "boolean" },
 };
@@ -966,11 +1347,25 @@ function finiteNumber(value) {
 
 function usageText(body) {
   if (!isRecord(body) || !isRecord(body.used) || !finiteNumber(body.used.ram_mb)) return null;
-  const used = body.used.ram_mb;
-  if (body.plan === null) return `Plan: none\nRAM used: ${used} MiB\n`;
+  if (!finiteNumber(body.used.cpu_milli) || !finiteNumber(body.used.disk_gb)) return null;
+  const usedRam = body.used.ram_mb;
+  const usedCpu = body.used.cpu_milli;
+  const usedDisk = body.used.disk_gb;
+  if (body.plan === null) {
+    return `Plan: none\nRAM used: ${usedRam} MiB\nCPU used: ${usedCpu} mCPU\nDisk used: ${usedDisk} GB\n`;
+  }
   if (typeof body.plan !== "string" || !isRecord(body.pools)) return null;
-  if (!finiteNumber(body.pools.ram_mb) || !finiteNumber(body.ram_remaining_mb)) return null;
-  return `Plan: ${body.plan}\nRAM used: ${used} MiB of ${body.pools.ram_mb} MiB\nRAM left: ${body.ram_remaining_mb} MiB\n`;
+  if (
+    !finiteNumber(body.pools.ram_mb) ||
+    !finiteNumber(body.pools.cpu_milli) ||
+    !finiteNumber(body.pools.disk_gb) ||
+    !finiteNumber(body.ram_remaining_mb) ||
+    !finiteNumber(body.cpu_remaining_milli) ||
+    !finiteNumber(body.disk_remaining_gb)
+  ) {
+    return null;
+  }
+  return `Plan: ${body.plan}\nRAM used: ${usedRam} MiB of ${body.pools.ram_mb} MiB\nRAM left: ${body.ram_remaining_mb} MiB\nCPU used: ${usedCpu} mCPU of ${body.pools.cpu_milli} mCPU\nCPU left: ${body.cpu_remaining_milli} mCPU\nDisk used: ${usedDisk} GB of ${body.pools.disk_gb} GB\nDisk left: ${body.disk_remaining_gb} GB\n`;
 }
 
 export async function usage(args, io) {
@@ -997,7 +1392,9 @@ function plansText(body) {
   for (const row of body.plans) {
     if (!isRecord(row) || typeof row.name !== "string") return null;
     if (!finiteNumber(row.ram_mb) || !finiteNumber(row.cpu_milli) || !finiteNumber(row.disk_gb)) return null;
-    lines.push(`${row.name}: RAM ${row.ram_mb} MiB, CPU ${row.cpu_milli} mCPU, disk ${row.disk_gb} GB`);
+    let line = `${row.name}: RAM ${row.ram_mb} MiB, CPU ${row.cpu_milli} mCPU, disk ${row.disk_gb} GB`;
+    if (row.on_sale === false) line += " (not on sale yet)";
+    lines.push(line);
   }
   if (lines.length === 0) return "";
   return `${lines.join("\n")}\n`;
@@ -1123,15 +1520,56 @@ function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+const DIAGNOSE_LINE_CHARS = 200;
+const DIAGNOSE_LINE_COUNT = 50;
+
+// T-522: the cut counts code points, so it never splits a surrogate pair. The
+// loop stops at the limit, so a long line is not copied whole first.
+function firstCodePoints(text, count) {
+  let end = 0;
+  let seen = 0;
+  for (const char of text) {
+    if (seen === count) break;
+    end += char.length;
+    seen += 1;
+  }
+  return text.slice(0, end);
+}
+
+function capLines(text) {
+  const parts = text.split("\n");
+  if (parts.length > 0 && parts.at(-1) === "") parts.pop();
+  const capped = parts
+    .slice(0, DIAGNOSE_LINE_COUNT)
+    .map((line) => firstCodePoints(sanitizeCli(line), DIAGNOSE_LINE_CHARS));
+  return capped.length === 0 ? "\n" : `${capped.join("\n")}\n`;
+}
+
 function diagnoseSentences(body) {
   if (!isRecord(body)) return null;
   if (body.diagnosis === null) {
-    return typeof body.note === "string" ? `${body.note}\n` : null;
+    return typeof body.note === "string" ? capLines(body.note) : null;
   }
   if (!isRecord(body.diagnosis) || typeof body.diagnosis.reason !== "string") return null;
-  if (body.diagnosis.next_step === undefined) return `${body.diagnosis.reason}\n`;
+  if (body.diagnosis.next_step === undefined) return capLines(body.diagnosis.reason);
   if (typeof body.diagnosis.next_step !== "string") return null;
-  return `${body.diagnosis.reason}\n${body.diagnosis.next_step}\n`;
+  return `${capLines(body.diagnosis.reason)}${capLines(body.diagnosis.next_step)}`;
+}
+
+// T-439 fix round 2: the diagnose --json echo carries the ruling's named
+// fields, so the three strings are sanitized on a shallow copy before the
+// echo; the copy keeps the echo valid JSON.
+function diagnoseEcho(body) {
+  if (!isRecord(body)) return body;
+  const copy = { ...body };
+  if (typeof copy.note === "string") copy.note = sanitizeCli(copy.note);
+  if (isRecord(copy.diagnosis)) {
+    const diagnosis = { ...copy.diagnosis };
+    if (typeof diagnosis.reason === "string") diagnosis.reason = sanitizeCli(diagnosis.reason);
+    if (typeof diagnosis.next_step === "string") diagnosis.next_step = sanitizeCli(diagnosis.next_step);
+    copy.diagnosis = diagnosis;
+  }
+  return copy;
 }
 
 function databaseFields(value) {
@@ -1204,7 +1642,7 @@ export async function diagnose(args, io) {
   if (result.status !== 200) return fail(io, loaded.key, json, sentenceFor(result.status, result.retryAfterSeconds));
   const human = diagnoseSentences(result.body);
   if (human === null) return fail(io, loaded.key, json, SENTENCE.failed);
-  return succeed(io, loaded.key, json, result.body, human);
+  return succeed(io, loaded.key, json, diagnoseEcho(result.body), human);
 }
 
 async function databaseCreate(args, io, key) {
@@ -1221,7 +1659,7 @@ async function databaseCreate(args, io, key) {
   }
   const projectId = appUuid(project);
   if (projectId === null) return fail(io, key, json, SENTENCE.projectId);
-  if (kind !== "postgres" && kind !== "redis") return fail(io, key, json, SENTENCE.refused);
+  if (kind !== "postgres" && kind !== "redis") return fail(io, key, json, REFUSED_DATABASE_KIND);
   const result = await call(io, key, {
     path: `/v1/projects/${encodeURIComponent(projectId)}/databases`,
     method: "POST",
@@ -1254,7 +1692,7 @@ async function databaseStatus(args, io, key) {
   if (result.network) return fail(io, key, json, SENTENCE.platform);
   if (result.status !== 200) return fail(io, key, json, sentenceFor(result.status, result.retryAfterSeconds));
   const view = databaseFields(isRecord(result.body) ? result.body.database : null);
-  const statusText = isRecord(result.body) ? result.body.status : undefined;
+  const statusText = isRecord(result.body) && typeof result.body.status === "string" ? sanitizeCli(result.body.status) : undefined;
   if (view === null || typeof statusText !== "string") return fail(io, key, json, SENTENCE.failed);
   const payload = {
     id: view.id,
@@ -1292,6 +1730,45 @@ async function databaseBackup(args, io, key) {
   return succeed(io, key, json, { database_id: id, backup: "run" }, "Backup run.\n");
 }
 
+// T-411 R2: the database's backup list. GET /v1/databases/:id/backups and
+// nothing else; a Redis database is refused by the route's own sentence.
+async function databaseBackups(args, io, key) {
+  const parsed = parseStrict(args, DATABASE_STATUS_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "backups") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const id = appUuid(parsed.values.id);
+  if (id === null) return fail(io, key, json, SENTENCE.databaseId);
+  const result = await call(io, key, {
+    path: `/v1/databases/${encodeURIComponent(id)}/backups`,
+    method: "GET",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  const raw = isRecord(result.body) && Array.isArray(result.body.backups) ? result.body.backups : null;
+  if (raw === null) return fail(io, key, json, SENTENCE.failed);
+  const backups = [];
+  for (const row of raw) {
+    if (
+      !isRecord(row) ||
+      typeof row.key !== "string" ||
+      typeof row.size_bytes !== "number" ||
+      typeof row.last_modified !== "string"
+    ) {
+      return fail(io, key, json, SENTENCE.failed);
+    }
+    backups.push({ key: row.key, size_bytes: row.size_bytes, last_modified: row.last_modified });
+  }
+  const human =
+    backups.length === 0
+      ? ""
+      : `${backups.map((row) => `${row.key} ${row.size_bytes} ${row.last_modified}`).join("\n")}\n`;
+  return succeed(io, key, json, { database_id: id, backups }, human);
+}
+
 async function databaseDelete(args, io, key) {
   const parsed = parseStrict(args, DATABASE_DELETE_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "delete") {
@@ -1320,6 +1797,7 @@ export async function database(args, io) {
   if (words[0] === "create") return databaseCreate(args, io, loaded.key);
   if (words[0] === "status") return databaseStatus(args, io, loaded.key);
   if (words[0] === "backup") return databaseBackup(args, io, loaded.key);
+  if (words[0] === "backups") return databaseBackups(args, io, loaded.key);
   if (words[0] === "delete") return databaseDelete(args, io, loaded.key);
   return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
 }
@@ -1344,6 +1822,11 @@ const STORAGE_DELETE_OPTIONS = {
   yes: { type: "boolean" },
 };
 
+const STORAGE_ROTATE_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string" },
+};
+
 const STORAGE_UNION = {
   json: { type: "boolean" },
   name: { type: "string" },
@@ -1397,29 +1880,12 @@ function storageLines(view) {
   return lines;
 }
 
-async function storageCreate(args, io, key) {
-  const parsed = parseStrict(args, STORAGE_CREATE_OPTIONS, true);
-  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "create") {
-    return fail(io, key, wantsJson(args), SENTENCE.refused);
-  }
-  const json = parsed.values.json === true;
-  const name = trimmed(parsed.values.name);
-  if (name === "") return fail(io, key, json, SENTENCE.refused);
-  const result = await call(io, key, {
-    path: "/v1/buckets",
-    method: "POST",
-    body: { name },
-  });
-  if (result.network) return fail(io, key, json, SENTENCE.platform);
-  const refusal = storageCreateMessage(result.status, result.body);
-  if (refusal !== null) return fail(io, key, json, refusal);
-  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
-  if (result.status !== 201) {
-    return fail(io, key, json, upgradeMessage(result.status, result.body) ?? sentenceFor(result.status, result.retryAfterSeconds));
-  }
-  const body = isRecord(result.body) ? result.body : null;
-  const view = body === null ? null : storageFields(body.bucket);
-  const credentials = body === null ? null : body.credentials;
+// A bucket create and a key rotate answer with the same body: the bucket row
+// and the credentials to hand to an S3 client. The secret is printed once.
+function storageIssued(io, key, json, body) {
+  const root = isRecord(body) ? body : null;
+  const view = root === null ? null : storageFields(root.bucket);
+  const credentials = root === null ? null : root.credentials;
   if (
     view === null ||
     !isRecord(credentials) ||
@@ -1448,6 +1914,29 @@ async function storageCreate(args, io, key) {
   return succeed(io, key, json, { bucket: view, credentials: payloadCredentials }, `${lines.join("\n")}\n`);
 }
 
+async function storageCreate(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_CREATE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "create") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const name = trimmed(parsed.values.name);
+  if (name === "") return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: "/v1/buckets",
+    method: "POST",
+    body: { name },
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  const refusal = storageCreateMessage(result.status, result.body);
+  if (refusal !== null) return fail(io, key, json, refusal);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 201) {
+    return fail(io, key, json, upgradeMessage(result.status, result.body) ?? sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  return storageIssued(io, key, json, result.body);
+}
+
 async function storageList(args, io, key) {
   const parsed = parseStrict(args, STORAGE_LIST_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "list") {
@@ -1490,6 +1979,28 @@ async function storageShow(args, io, key) {
   return succeed(io, key, json, { bucket: view }, `${storageLines(view).join("\n")}\n`);
 }
 
+// T-411 R15: a new key for one bucket. POST /v1/buckets/:id/key and nothing
+// else; the route revokes the old key and says what went wrong in its body.
+async function storageRotate(args, io, key) {
+  const parsed = parseStrict(args, STORAGE_ROTATE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "rotate") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const id = appUuid(parsed.values.id);
+  if (id === null) return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: `/v1/buckets/${encodeURIComponent(id)}/key`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status === 503) return fail(io, key, json, SENTENCE.storageOff);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  return storageIssued(io, key, json, result.body);
+}
+
 async function storageDelete(args, io, key) {
   const parsed = parseStrict(args, STORAGE_DELETE_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "delete") {
@@ -1520,6 +2031,7 @@ export async function storage(args, io) {
   if (words[0] === "create") return storageCreate(args, io, loaded.key);
   if (words[0] === "list") return storageList(args, io, loaded.key);
   if (words[0] === "show") return storageShow(args, io, loaded.key);
+  if (words[0] === "rotate") return storageRotate(args, io, loaded.key);
   if (words[0] === "delete") return storageDelete(args, io, loaded.key);
   return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
 }
@@ -1561,6 +2073,11 @@ const APP_REMOVE_OPTIONS = {
   confirm: { type: "string" },
 };
 
+const APP_START_STOP_OPTIONS = {
+  json: { type: "boolean" },
+  app: { type: "string" },
+};
+
 function appPositionals(args) {
   try {
     return parseArgs({
@@ -1580,9 +2097,40 @@ export async function app(args, io) {
   const words = appPositionals(args);
   if (words === null || words.length !== 1) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
   if (words[0] === "remove") return appRemove(args, io, loaded.key);
+  if (words[0] === "start") return appStartStop(args, io, loaded.key, "start");
+  if (words[0] === "stop") return appStartStop(args, io, loaded.key, "stop");
   return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
 }
 
+// T-411 R2: the customer start and stop routes' doors. One POST, no body, and
+// the route's refusal is the caller's.
+async function appStartStop(args, io, key, word) {
+  const parsed = parseStrict(args, APP_START_STOP_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== word) {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const appId = appUuid(parsed.values.app);
+  if (appId === null) return fail(io, key, json, SENTENCE.app);
+  const result = await call(io, key, {
+    path: `/v1/apps/${encodeURIComponent(appId)}/${word}`,
+    method: "POST",
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 200) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  const payload =
+    word === "start" ? { app_id: appId, started: true } : { app_id: appId, stopped: true };
+  return succeed(
+    io,
+    key,
+    json,
+    payload,
+    `${word === "start" ? SENTENCE.appStarted : SENTENCE.appStopped}\n`,
+  );
+}
+
 async function appRemove(args, io, key) {
   const parsed = parseStrict(args, APP_REMOVE_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "remove") {
@@ -1640,6 +2188,111 @@ function validRelPath(p) {
   return p.split("/").every((segment) => segment.length > 0 && segment !== "..");
 }
 
+function isRootEnvName(name) {
+  return name === ".env" || name.startsWith(".env.");
+}
+
+// `*` and `?` against one path segment, no regex: one cursor over the pattern and
+// one over the text, rewinding to the last `*` on a mismatch.
+function segmentMatches(pattern, text) {
+  let p = 0;
+  let t = 0;
+  let starAt = -1;
+  let rewindTo = 0;
+  while (t < text.length) {
+    if (p < pattern.length && (pattern[p] === "?" || pattern[p] === text[t])) {
+      p++;
+      t++;
+    } else if (p < pattern.length && pattern[p] === "*") {
+      starAt = p;
+      rewindTo = t;
+      p++;
+    } else if (starAt >= 0) {
+      p = starAt + 1;
+      rewindTo++;
+      t = rewindTo;
+    } else {
+      return false;
+    }
+  }
+  while (p < pattern.length && pattern[p] === "*") p++;
+  return p === pattern.length;
+}
+
+function countLiteral(haystack, needle) {
+  let count = 0;
+  let at = haystack.indexOf(needle);
+  while (at !== -1) {
+    count++;
+    at = haystack.indexOf(needle, at + needle.length);
+  }
+  return count;
+}
+
+// The rules the client can answer with string work. A line holding `[`, a backslash
+// or a `**` that is not the leading `**/` sets broken, and the caller then treats
+// every .env as ignored rather than guessing.
+function parseGitignore(text) {
+  const rules = [];
+  let broken = false;
+  for (const rawLine of text.split("\n")) {
+    let line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+    if (line.length === 0 || line.startsWith("#")) continue;
+    if (line.includes("[") || line.includes("\\")) {
+      broken = true;
+      continue;
+    }
+    if (countLiteral(line, "**") > (line.startsWith("**/") ? 1 : 0)) {
+      broken = true;
+      continue;
+    }
+    let negation = false;
+    if (line.startsWith("!")) {
+      negation = true;
+      line = line.slice(1);
+    }
+    if (line.startsWith("/")) line = line.slice(1);
+    if (line.startsWith("**/")) line = line.slice(3);
+    if (line.endsWith("/")) continue;
+    // A rule holding a slash is anchored to the root and names a path below it,
+    // so it can never match a root file name. Only the root names are ever asked.
+    if (line.length === 0 || line.includes("/")) continue;
+    rules.push({ negation, pattern: line });
+  }
+  return {
+    broken,
+    matches(name) {
+      let ignored = false;
+      for (const rule of rules) {
+        if (segmentMatches(rule.pattern, name)) ignored = !rule.negation;
+      }
+      return ignored;
+    },
+  };
+}
+
+// A missing .gitignore ignores nothing. One the client cannot read as a plain file
+// fails closed, so a .env is never posted on a guess about its rules.
+function rootGitignoreMatcher(root) {
+  const file = path.join(root, ".gitignore");
+  let stat;
+  try {
+    stat = lstatSync(file);
+  } catch {
+    return () => false;
+  }
+  if (!stat.isFile()) return () => true;
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return () => true;
+  }
+  const rules = parseGitignore(text);
+  if (rules.broken) return () => true;
+  return rules.matches;
+}
+
 export function preflightFiles(root) {
   let rootStat;
   try {
@@ -1649,8 +2302,9 @@ export function preflightFiles(root) {
   }
   if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) return null;
 
+  const gitignored = rootGitignoreMatcher(root);
   const candidates = [];
-  function walk(dir) {
+  function walk(dir, depth) {
     let entries;
     try {
       entries = readdirSync(dir);
@@ -1658,7 +2312,9 @@ export function preflightFiles(root) {
       return false;
     }
     for (const name of entries) {
-      if (name.startsWith(".")) continue;
+      if (name.startsWith(".")) {
+        if (depth !== 0 || !isRootEnvName(name) || gitignored(name)) continue;
+      }
       const fullPath = path.join(dir, name);
       let stat;
       try {
@@ -1668,19 +2324,19 @@ export function preflightFiles(root) {
       }
       if (stat.isSymbolicLink()) continue;
       if (stat.isDirectory()) {
-        if (SKIP_DIRS.has(name)) continue;
-        const ok = walk(fullPath);
+        if (name.startsWith(".") || SKIP_DIRS.has(name)) continue;
+        const ok = walk(fullPath, depth + 1);
         if (!ok) return false;
       } else if (stat.isFile()) {
         const rel = path.relative(root, fullPath).split(path.sep).join("/");
-        const depth = rel.split("/").length - 1;
-        candidates.push({ rel, fullPath, depth, stat });
+        const candidateDepth = rel.split("/").length - 1;
+        candidates.push({ rel, fullPath, depth: candidateDepth, stat });
       }
     }
     return true;
   }
 
-  if (!walk(root)) return null;
+  if (!walk(root, 0)) return null;
 
   candidates.sort((a, b) => {
     if (a.depth !== b.depth) return a.depth - b.depth;
@@ -1775,11 +2431,29 @@ export async function preflight(args, io) {
     !isRecord(result.body) ||
     typeof result.body.verdict !== "string" ||
     !Array.isArray(result.body.checks) ||
-    (result.body.verdict !== "pass" && result.body.verdict !== "fixable" && result.body.verdict !== "refuse")
+    (result.body.verdict !== "pass" &&
+      result.body.verdict !== "fixable" &&
+      result.body.verdict !== "refuse")
   ) {
     return fail(io, loaded.key, json, SENTENCE.failed, undefined, 2);
   }
 
+  // T-439 fix round 2: the --json echo carries the verdict and the check
+  // strings, so they are sanitized on a shallow copy; the copy keeps the
+  // echo valid JSON because JSON.stringify does not escape the bidi marks.
+  const preflightEcho = () => {
+    const copy = { ...result.body, verdict: sanitizeCli(result.body.verdict) };
+    copy.checks = result.body.checks.map((check) => {
+      if (!isRecord(check)) return check;
+      const row = { ...check };
+      if (typeof row.name === "string") row.name = sanitizeCli(row.name);
+      if (typeof row.result === "string") row.result = sanitizeCli(row.result);
+      if (typeof row.reason === "string") row.reason = sanitizeCli(row.reason);
+      return row;
+    });
+    return copy;
+  };
+
   if (walked.leftOut > 0) {
     const leftOutMsg =
       walked.leftOut === 1
@@ -1790,11 +2464,11 @@ export async function preflight(args, io) {
 
   const exitCode = result.body.verdict === "refuse" ? 1 : 0;
   if (json) {
-    writeStdout(io, loaded.key, `${JSON.stringify(result.body)}\n`);
+    writeStdout(io, loaded.key, `${JSON.stringify(preflightEcho())}\n`);
     return { exitCode };
   }
 
-  let human = `Verdict: ${result.body.verdict}\n`;
+  let human = `Verdict: ${sanitizeCli(result.body.verdict)}\n`;
   for (const check of result.body.checks) {
     if (
       isRecord(check) &&
@@ -1802,7 +2476,7 @@ export async function preflight(args, io) {
       typeof check.result === "string" &&
       typeof check.reason === "string"
     ) {
-      human += `${check.name}: ${check.result} - ${check.reason}\n`;
+      human += `${sanitizeCli(check.name)}: ${sanitizeCli(check.result)} - ${sanitizeCli(check.reason)}\n`;
     }
   }
   writeStdout(io, loaded.key, human);
@@ -1880,9 +2554,16 @@ const COMPOSE_ACTION_OPTIONS = {
   id: { type: "string", multiple: true },
 };
 
+const COMPOSE_REMOVE_OPTIONS = {
+  json: { type: "boolean" },
+  id: { type: "string", multiple: true },
+  confirm: { type: "string" },
+};
+
 const COMPOSE_UNION = {
   json: { type: "boolean" },
   id: { type: "string" },
+  confirm: { type: "string" },
 };
 
 function composePositionals(args) {
@@ -2007,7 +2688,9 @@ async function composeDeploy(args, io, key) {
   return succeed(io, key, json, payload, `${composeLines(view).join("\n")}\n`);
 }
 
-async function composeStartStop(args, io, key, action) {
+// status, start and stop answer with the same body: the stack and its status.
+// status is the read (GET on the stack); start and stop post an action path.
+async function composeOne(args, io, key, action, method, pathSuffix) {
   const parsed = parseStrict(args, COMPOSE_ACTION_OPTIONS, true);
   if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== action) {
     return fail(io, key, wantsJson(args), SENTENCE.refused);
@@ -2015,9 +2698,10 @@ async function composeStartStop(args, io, key, action) {
   const json = parsed.values.json === true;
   const required = requireComposeId(io, key, json, parsed.values.id);
   if (required.exit) return required.exit;
+  const id = encodeURIComponent(required.id);
   const result = await call(io, key, {
-    path: `/v1/compose/${encodeURIComponent(required.id)}/${action}`,
-    method: "POST",
+    path: pathSuffix === "" ? `/v1/compose/${id}` : `/v1/compose/${id}/${pathSuffix}`,
+    method,
   });
   if (result.network) return fail(io, key, json, SENTENCE.platform);
   if (result.status !== 200) {
@@ -2032,6 +2716,30 @@ async function composeStartStop(args, io, key, action) {
   return succeed(io, key, json, payload, `${lines.join("\n")}\n`);
 }
 
+// T-411 R19, R20: the route owns the name check. The CLI sends what the caller
+// typed and never reads the stack first to compare it.
+async function composeRemove(args, io, key) {
+  const parsed = parseStrict(args, COMPOSE_REMOVE_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "remove") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const required = requireComposeId(io, key, json, parsed.values.id);
+  if (required.exit) return required.exit;
+  const confirm = trimmed(parsed.values.confirm);
+  if (confirm === "") return fail(io, key, json, SENTENCE.composeConfirm);
+  const result = await call(io, key, {
+    path: `/v1/compose/${encodeURIComponent(required.id)}`,
+    method: "DELETE",
+    body: { confirm },
+  });
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 204) {
+    return doorRefusal(io, key, json, result, sentenceFor(result.status, result.retryAfterSeconds));
+  }
+  return succeed(io, key, json, { compose_id: required.id, removed: true }, `${SENTENCE.composeRemoved}\n`);
+}
+
 export async function compose(args, io) {
   const loaded = loadKey(io);
   if (loaded.exit) return loaded.exit;
@@ -2039,7 +2747,110 @@ export async function compose(args, io) {
   if (words === null || words.length !== 1) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
   if (words[0] === "list") return composeList(args, io, loaded.key);
   if (words[0] === "deploy") return composeDeploy(args, io, loaded.key);
-  if (words[0] === "start") return composeStartStop(args, io, loaded.key, "start");
-  if (words[0] === "stop") return composeStartStop(args, io, loaded.key, "stop");
+  if (words[0] === "start") return composeOne(args, io, loaded.key, "start", "POST", "start");
+  if (words[0] === "stop") return composeOne(args, io, loaded.key, "stop", "POST", "stop");
+  if (words[0] === "status") return composeOne(args, io, loaded.key, "status", "GET", "");
+  if (words[0] === "remove") return composeRemove(args, io, loaded.key);
+  return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+}
+
+// ponytail: copy of ladder in src/lib/plans/limits.ts. Sellable stays on the route. A new ladder name is refused here until this list grows.
+const BILLING_PLAN_NAMES = ["starter", "growth", "pro", "scale", "business"];
+const BILLING_OFF = "Billing is not available right now. Try again later.";
+
+const BILLING_UNION = {
+  json: { type: "boolean" },
+  plan: { type: "string", multiple: true },
+};
+
+const BILLING_PORTAL_OPTIONS = {
+  json: { type: "boolean" },
+};
+
+function billingPositionals(args) {
+  try {
+    return parseArgs({
+      args: Array.isArray(args) ? args : [],
+      strict: false,
+      allowPositionals: true,
+      options: BILLING_UNION,
+    }).positionals;
+  } catch {
+    return null;
+  }
+}
+
+function billingMessage(status, body, retryAfterSeconds) {
+  if (isRecord(body) && typeof body.message === "string") {
+    // sanitizeCli keeps tab and newline; a billing message is one line, so the
+    // remaining tab and newline are removed after it.
+    const message = sanitizeCli(body.message).replace(/[\u0000-\u001F\u007F\u0080-\u009F]/g, "");
+    if (message.length > 0) return message;
+  }
+  if (status === 503) return BILLING_OFF;
+  return sentenceFor(status, retryAfterSeconds);
+}
+
+function billingUrl(result) {
+  if (!isRecord(result.body) || typeof result.body.url !== "string") return null;
+  const value = result.body.url;
+  if (value.length === 0 || value.includes(" ") || /[\u0000-\u001F\u007F\u0080-\u009F]/.test(value)) return null;
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") return null;
+  } catch {
+    return null;
+  }
+  return value;
+}
+
+async function billingFinish(io, key, json, result) {
+  if (result.network) return fail(io, key, json, SENTENCE.platform);
+  if (result.status !== 201) {
+    return fail(io, key, json, billingMessage(result.status, result.body, result.retryAfterSeconds));
+  }
+  const url = billingUrl(result);
+  if (url === null) return fail(io, key, json, SENTENCE.failed);
+  return succeed(io, key, json, result.body, `${url}\n`);
+}
+
+async function billingCheckout(args, io, key) {
+  const parsed = parseStrict(args, BILLING_UNION, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "checkout") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const plans = Array.isArray(parsed.values.plan) ? parsed.values.plan : [];
+  if (plans.length !== 1) return fail(io, key, json, SENTENCE.refused);
+  const plan = trimmed(plans[0]);
+  if (!BILLING_PLAN_NAMES.includes(plan)) return fail(io, key, json, SENTENCE.refused);
+  const result = await call(io, key, {
+    path: "/v1/billing/checkout",
+    method: "POST",
+    body: { plan },
+  });
+  return billingFinish(io, key, json, result);
+}
+
+async function billingPortal(args, io, key) {
+  const parsed = parseStrict(args, BILLING_PORTAL_OPTIONS, true);
+  if (parsed === null || parsed.positionals.length !== 1 || parsed.positionals[0] !== "portal") {
+    return fail(io, key, wantsJson(args), SENTENCE.refused);
+  }
+  const json = parsed.values.json === true;
+  const result = await call(io, key, {
+    path: "/v1/billing/portal",
+    method: "POST",
+  });
+  return billingFinish(io, key, json, result);
+}
+
+export async function billing(args, io) {
+  const loaded = loadKey(io);
+  if (loaded.exit) return loaded.exit;
+  const words = billingPositionals(args);
+  if (words === null || words.length !== 1) return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
+  if (words[0] === "checkout") return billingCheckout(args, io, loaded.key);
+  if (words[0] === "portal") return billingPortal(args, io, loaded.key);
   return fail(io, loaded.key, wantsJson(args), SENTENCE.refused);
 }