@cloudgrid-io/cli 0.3.0

package/dist/index.js

@@ -0,0 +1,2094 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command as Command21 } from "commander";
+import { readFileSync as readFileSync9 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname2, join as join9 } from "path";
+
+// src/utils.ts
+import { execa } from "execa";
+import chalk from "chalk";
+import ora from "ora";
+
+// ../shared/src/errors.ts
+var CloudGridError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloudGridError";
+  }
+};
+function die(msg) {
+  throw new CloudGridError(msg);
+}
+
+// ../shared/src/paths.ts
+import { existsSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function findPackageRoot() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (!existsSync(join(dir, "package.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir) throw new Error("Cannot find package root");
+    dir = parent;
+  }
+  return dir;
+}
+var PKG_ROOT = findPackageRoot();
+var TEMPLATES_DIR = join(PKG_ROOT, "templates");
+var SHARED_SERVICES_PATH = join(PKG_ROOT, "shared-services.yaml");
+
+// src/utils.ts
+var _verbose = false;
+function setVerbose(v) {
+  _verbose = v;
+}
+function isVerbose() {
+  return _verbose;
+}
+async function exec(cmd, args, opts) {
+  return execa(cmd, args, { ...opts, stdio: opts?.stdio ?? "pipe" });
+}
+var log = {
+  info: (msg) => console.log(chalk.blue("  " + msg)),
+  success: (msg) => console.log(chalk.green("  " + msg)),
+  warn: (msg) => console.log(chalk.yellow("  " + msg)),
+  error: (msg) => console.error(chalk.red("ERROR: " + msg)),
+  step: (msg) => console.log(chalk.gray("  " + msg))
+};
+function spinner(text) {
+  return ora({ text, color: "cyan" });
+}
+function die2(msg) {
+  log.error(msg);
+  throw new CloudGridError(msg);
+}
+function parseEnvFile(content) {
+  const values = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const stripped = trimmed.startsWith("export ") ? trimmed.slice(7) : trimmed;
+    const eq = stripped.indexOf("=");
+    if (eq < 1) continue;
+    let val = stripped.slice(eq + 1);
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    values[stripped.slice(0, eq)] = val;
+  }
+  return values;
+}
+
+// src/commands/init.ts
+import { Command } from "commander";
+import inquirer from "inquirer";
+
+// src/config.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir } from "os";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+
+// src/api-client.ts
+import * as net from "net";
+import WebSocket from "ws";
+var ApiError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "ApiError";
+  }
+};
+var CloudGridApiClient = class {
+  baseUrl;
+  jwt;
+  constructor(apiUrl, jwt) {
+    this.baseUrl = apiUrl.replace(/\/+$/, "");
+    this.jwt = jwt;
+  }
+  // ── HTTP helpers ────────────────────────────────────────────
+  async request(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      "authorization": `Bearer ${this.jwt}`
+    };
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    if (isVerbose()) {
+      console.error(`  [verbose] ${method} ${url}`);
+    }
+    const res = await fetch(url, {
+      method,
+      headers,
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    if (isVerbose()) {
+      console.error(`  [verbose] ${res.status} ${res.statusText}`);
+    }
+    if (!res.ok) {
+      let errBody;
+      try {
+        errBody = await res.json();
+      } catch {
+        errBody = { error: res.statusText, code: "UNKNOWN" };
+      }
+      throw new ApiError(res.status, errBody.code, errBody.error);
+    }
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  // ── Public API methods ──────────────────────────────────────
+  async build(name, services, cloudgridYaml, tag) {
+    return this.request("POST", `/apps/${name}/build`, {
+      cloudgrid_yaml: cloudgridYaml,
+      services,
+      tag
+    });
+  }
+  async deploy(name, images, cloudgridYaml) {
+    return this.request("POST", `/apps/${name}/deploy`, {
+      images,
+      cloudgrid_yaml: cloudgridYaml
+    });
+  }
+  async list() {
+    return this.request("GET", "/apps");
+  }
+  async status(name) {
+    return this.request("GET", `/apps/${name}`);
+  }
+  async logs(name, opts) {
+    const params = new URLSearchParams();
+    if (opts?.service) params.set("service", opts.service);
+    if (opts?.tail) params.set("tail", String(opts.tail));
+    const qs = params.toString();
+    const path = `/apps/${name}/logs${qs ? `?${qs}` : ""}`;
+    const result = await this.request("GET", path);
+    return result.logs;
+  }
+  async remove(name) {
+    await this.request("DELETE", `/apps/${name}`);
+  }
+  async listRepos() {
+    return this.request("GET", "/github/repos");
+  }
+  async connect(name, repo, branch) {
+    return this.request("POST", `/apps/${name}/connect`, { repo, branch });
+  }
+  async disconnect(name) {
+    return this.request("DELETE", `/apps/${name}/connect`);
+  }
+  async listBuilds(name) {
+    return this.request("GET", `/apps/${name}/builds`);
+  }
+  async listSecrets(name) {
+    return this.request("GET", `/apps/${name}/secrets`);
+  }
+  async setSecrets(name, values) {
+    return this.request("POST", `/apps/${name}/secrets`, { values });
+  }
+  async getSecret(name, key) {
+    return this.request("GET", `/apps/${name}/secrets/${encodeURIComponent(key)}`);
+  }
+  async removeSecret(name, key) {
+    return this.request("DELETE", `/apps/${name}/secrets/${encodeURIComponent(key)}`);
+  }
+  async listEnv(name) {
+    return this.request("GET", `/apps/${name}/env`);
+  }
+  async setEnv(name, values) {
+    return this.request("POST", `/apps/${name}/env`, { values });
+  }
+  async removeEnv(name, key) {
+    return this.request("DELETE", `/apps/${name}/env/${encodeURIComponent(key)}`);
+  }
+  async listEvents(name) {
+    return this.request("GET", `/apps/${name}/events`);
+  }
+  async getUsage(name) {
+    return this.request("GET", `/apps/${name}/usage`);
+  }
+  // ── WebSocket tunnel ────────────────────────────────────────
+  /**
+   * Opens a local TCP server on `localPort`. For each incoming connection,
+   * opens a WebSocket to the API tunnel endpoint and bridges data
+   * bidirectionally between the local TCP socket and the WebSocket.
+   *
+   * Returns the TCP server so the caller can close it.
+   */
+  openTunnel(service, localPort) {
+    return new Promise((resolve, reject) => {
+      const server = net.createServer((tcpSocket) => {
+        const wsProto = this.baseUrl.startsWith("https") ? "wss" : "ws";
+        const host = this.baseUrl.replace(/^https?:\/\//, "");
+        const wsUrl = `${wsProto}://${host}/tunnel/${service}`;
+        const wsHeaders = {
+          "authorization": `Bearer ${this.jwt}`
+        };
+        const ws = new WebSocket(wsUrl, { headers: wsHeaders });
+        ws.binaryType = "nodebuffer";
+        ws.on("open", () => {
+          tcpSocket.on("data", (data) => {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(data);
+            }
+          });
+          ws.on("message", (data) => {
+            if (!tcpSocket.destroyed) {
+              tcpSocket.write(data);
+            }
+          });
+        });
+        ws.on("close", () => {
+          if (!tcpSocket.destroyed) tcpSocket.destroy();
+        });
+        ws.on("error", () => {
+          if (!tcpSocket.destroyed) tcpSocket.destroy();
+        });
+        tcpSocket.on("close", () => {
+          if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
+            ws.close();
+          }
+        });
+        tcpSocket.on("error", () => {
+          if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
+            ws.close();
+          }
+        });
+      });
+      server.on("error", reject);
+      server.listen(localPort, "127.0.0.1", () => {
+        server.removeListener("error", reject);
+        server.on("error", (err) => {
+          console.error(`Tunnel server error: ${err.message}`);
+        });
+        resolve(server);
+      });
+    });
+  }
+};
+
+// src/config.ts
+var CONFIG_DIR = join2(homedir(), ".cloudgrid");
+var CONFIG_PATH = join2(CONFIG_DIR, "config.yaml");
+var APPS_DIR = join2(CONFIG_DIR, "apps");
+function getAppsDir() {
+  return APPS_DIR;
+}
+function configExists() {
+  return existsSync2(CONFIG_PATH);
+}
+function loadConfig() {
+  if (!existsSync2(CONFIG_PATH)) {
+    throw new Error("No CLI config found. Run: cloudgrid init");
+  }
+  return parseYaml(readFileSync(CONFIG_PATH, "utf-8"));
+}
+function saveConfig(config) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_PATH, stringifyYaml(config));
+}
+function detectConfig() {
+  return {
+    api_url: "https://api.cloudgrid.io",
+    domain: "cloudgrid.io"
+  };
+}
+function ensureAppsDir() {
+  mkdirSync(APPS_DIR, { recursive: true });
+}
+function createApiClient(config) {
+  const cfg = config || loadConfig();
+  if (!cfg.api_url) throw new Error("api_url not set. Run: cloudgrid login");
+  if (!cfg.jwt) throw new Error("Not authenticated. Run: cloudgrid login");
+  return new CloudGridApiClient(cfg.api_url, cfg.jwt);
+}
+
+// src/commands/init.ts
+var initCommand = new Command("init").description("Configure API URL (for non-default setups)").action(async () => {
+  const detected = detectConfig();
+  const answers = await inquirer.prompt([
+    {
+      type: "input",
+      name: "api_url",
+      message: "Cloud Grid API URL:",
+      default: detected.api_url || "https://api.cloudgrid.io"
+    }
+  ]);
+  const existing = configExists() ? loadConfig() : {};
+  saveConfig({ ...existing, ...answers });
+  log.success("Config saved. Run `cloudgrid login` to authenticate.");
+});
+
+// src/commands/create.ts
+import { Command as Command2 } from "commander";
+import inquirer2 from "inquirer";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync6, copyFileSync as copyFileSync3 } from "fs";
+import { join as join6 } from "path";
+import { stringify as stringifyYaml2 } from "yaml";
+
+// ../shared/src/generator/index.ts
+import { readFileSync as readFileSync3, existsSync as existsSync5 } from "fs";
+import { join as join5 } from "path";
+import { parse as parseYaml2 } from "yaml";
+
+// ../shared/src/validate.ts
+var NAME_REGEX = /^[a-z][a-z0-9-]{0,40}[a-z0-9]$/;
+var RESERVED_NAMES = [
+  "default",
+  "kube-system",
+  "kube-public",
+  "kube-node-lease",
+  "n8n",
+  "sharedgrid",
+  "sharedgrid-dev",
+  "cloudgrid",
+  "cloudgrid-system",
+  "istio-system",
+  "cert-manager",
+  "ingress-nginx",
+  "monitoring"
+];
+var VALID_TYPES = ["node", "nextjs", "python", "static", "cron"];
+var VALID_TIMEZONES = ["UTC", "EST", "PST"];
+var VALID_GCP_SERVICES = ["bigquery", "pubsub", "storage"];
+function validateName(name, label) {
+  if (!NAME_REGEX.test(name)) {
+    die(`Invalid ${label}: ${name} (must be 2-42 chars, lowercase alphanumeric + hyphens, no trailing hyphen)`);
+  }
+  if (label === "app name" && RESERVED_NAMES.includes(name)) {
+    die(`Reserved ${label}: ${name} (conflicts with system namespace)`);
+  }
+}
+function validateConfig(config) {
+  validateName(config.name, "app name");
+  if (!config.services || Object.keys(config.services).length === 0) {
+    die("No services defined in cloudgrid.yaml");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const [name, svc] of Object.entries(config.services)) {
+    validateName(name, "service name");
+    if (!VALID_TYPES.includes(svc.type)) {
+      die(`Service '${name}' has invalid type '${svc.type}'. Must be ${VALID_TYPES.join("|")}`);
+    }
+    if (svc.lang !== void 0) {
+      if (svc.lang !== "javascript" && svc.lang !== "typescript") {
+        die(`Service '${name}' has invalid lang '${svc.lang}'. Must be javascript|typescript`);
+      }
+      if (svc.type !== "node") {
+        die(`Service '${name}' uses lang but type is '${svc.type}'. lang is only valid for type: node`);
+      }
+    }
+    if (svc.path !== void 0) {
+      if (!svc.path.startsWith("/")) {
+        die(`Service '${name}' path '${svc.path}' must start with /`);
+      }
+      if (paths.has(svc.path)) {
+        die(`Duplicate path '${svc.path}'`);
+      }
+      paths.add(svc.path);
+    }
+    if (svc.type === "cron") {
+      if (!svc.schedule) {
+        die(`Service '${name}' is type 'cron' but missing required 'schedule' field`);
+      }
+      if (svc.path !== void 0) {
+        die(`Service '${name}' is type 'cron' and must not have a 'path' field`);
+      }
+      if (svc.timezone !== void 0 && !VALID_TIMEZONES.includes(svc.timezone)) {
+        die(`Service '${name}' has invalid timezone '${svc.timezone}'. Must be ${VALID_TIMEZONES.join("|")}`);
+      }
+      if (svc.run !== void 0 && svc.run !== "job" && !svc.run.startsWith("http://") && !svc.run.startsWith("https://")) {
+        die(`Service '${name}' has invalid run '${svc.run}'. Must be 'job', 'http://...', or 'https://...'`);
+      }
+    }
+  }
+}
+function parseRequires(requires, registry) {
+  const result = { shared: [], privateRedis: false };
+  if (!requires) return result;
+  let hasSharedRedis = false;
+  for (const entry of requires) {
+    if (typeof entry === "string") {
+      if (!registry[entry]) {
+        die(`Unknown shared service: ${entry} (not in shared-services.yaml)`);
+      }
+      result.shared.push(entry);
+      if (entry === "redis") hasSharedRedis = true;
+    } else if (typeof entry === "object" && entry !== null) {
+      const key = Object.keys(entry)[0];
+      if (key === "gcp" && isGcpRequires(entry)) {
+        const gcpEntry = entry;
+        if (!Array.isArray(gcpEntry.gcp.services) || gcpEntry.gcp.services.length === 0) {
+          die("gcp.services must be a non-empty array");
+        }
+        for (const svc of gcpEntry.gcp.services) {
+          if (!VALID_GCP_SERVICES.includes(svc)) {
+            die(`Invalid GCP service: '${svc}'. Must be one of: ${VALID_GCP_SERVICES.join(", ")}`);
+          }
+        }
+        result.gcp = { services: [...gcpEntry.gcp.services] };
+      } else if (key === "redis" && entry[key] === "private") {
+        result.privateRedis = true;
+      } else {
+        const val = entry[key];
+        die(`Unsupported requires modifier: ${key}: ${val} (only 'redis: private' and 'gcp: { services: [...] }' are supported)`);
+      }
+    } else {
+      die(`Invalid requires entry: ${JSON.stringify(entry)}`);
+    }
+  }
+  if (hasSharedRedis && result.privateRedis) {
+    die("Cannot use both shared and private Redis. Choose one.");
+  }
+  return result;
+}
+function isGcpRequires(entry) {
+  return typeof entry === "object" && entry !== null && "gcp" in entry && typeof entry.gcp === "object" && entry.gcp !== null && Array.isArray(entry.gcp.services);
+}
+
+// ../shared/src/utils.ts
+function upperSnake(name) {
+  return name.replace(/-/g, "_").toUpperCase();
+}
+
+// ../shared/src/generator/dockerfile.ts
+import { existsSync as existsSync3, copyFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { join as join3 } from "path";
+var defaultLogger = {
+  step: () => {
+  }
+};
+function generateDockerfiles(opts) {
+  const { appDir, config, logger = defaultLogger } = opts;
+  for (const [svcName, svc] of Object.entries(config.services)) {
+    if (svc.type === "cron" && svc.run && svc.run !== "job") {
+      logger.step(`Dockerfile: services/${svcName}/ skipped (cron HTTP mode)`);
+      continue;
+    }
+    const svcDir = join3(appDir, "services", svcName);
+    mkdirSync2(svcDir, { recursive: true });
+    const dockerfilePath = join3(svcDir, "Dockerfile");
+    if (existsSync3(dockerfilePath)) {
+      logger.step(`Dockerfile: services/${svcName}/Dockerfile exists, skipping`);
+    } else {
+      const templateName = svc.lang === "typescript" ? "typescript" : svc.type;
+      const templatePath = join3(TEMPLATES_DIR, "dockerfiles", `${templateName}.Dockerfile`);
+      if (!existsSync3(templatePath)) {
+        die(`Dockerfile template not found: ${templatePath}. Is @cloudgrid/cli installed correctly?`);
+      }
+      copyFileSync(templatePath, dockerfilePath);
+      logger.step(`Dockerfile: services/${svcName}/Dockerfile (${svc.type})`);
+    }
+    if (svc.type === "static") {
+      const nginxPath = join3(svcDir, "nginx.conf");
+      if (!existsSync3(nginxPath)) {
+        const templatePath = join3(TEMPLATES_DIR, "dockerfiles", "static.nginx.conf");
+        if (existsSync3(templatePath)) {
+          copyFileSync(templatePath, nginxPath);
+        }
+      }
+    }
+  }
+}
+
+// ../shared/src/generator/stubs.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, readdirSync, statSync, copyFileSync as copyFileSync2 } from "fs";
+import { join as join4 } from "path";
+var defaultLogger2 = {
+  step: () => {
+  }
+};
+function replacePlaceholders(content, appName, svcName) {
+  return content.replace(/__APP_NAME__/g, appName).replace(/__SERVICE_NAME__/g, svcName);
+}
+function copyDirRecursive(src, dest, appName, svcName) {
+  mkdirSync3(dest, { recursive: true });
+  const entries = readdirSync(src);
+  for (const entry of entries) {
+    const srcPath = join4(src, entry);
+    const destPath = join4(dest, entry);
+    const stat = statSync(srcPath);
+    if (stat.isDirectory()) {
+      copyDirRecursive(srcPath, destPath, appName, svcName);
+    } else {
+      if (/\.(js|json|ts|tsx|md|html)$/.test(entry)) {
+        const content = readFileSync2(srcPath, "utf-8");
+        writeFileSync2(destPath, replacePlaceholders(content, appName, svcName));
+      } else {
+        copyFileSync2(srcPath, destPath);
+      }
+    }
+  }
+}
+function generateStubs(opts) {
+  const { appDir, config, logger = defaultLogger2 } = opts;
+  const stubsDir = join4(TEMPLATES_DIR, "stubs");
+  for (const [svcName, svc] of Object.entries(config.services)) {
+    const svcDir = join4(appDir, "services", svcName);
+    mkdirSync3(svcDir, { recursive: true });
+    switch (svc.type) {
+      case "node": {
+        if (!existsSync4(join4(svcDir, "src")) && !existsSync4(join4(svcDir, "package.json"))) {
+          mkdirSync3(join4(svcDir, "src"), { recursive: true });
+          if (svc.lang === "typescript") {
+            const pkg2 = readFileSync2(join4(stubsDir, "typescript.stub.package.json"), "utf-8");
+            writeFileSync2(join4(svcDir, "package.json"), replacePlaceholders(pkg2, config.name, svcName));
+            const tsconfig = readFileSync2(join4(stubsDir, "typescript.stub.tsconfig.json"), "utf-8");
+            writeFileSync2(join4(svcDir, "tsconfig.json"), tsconfig);
+            const src = readFileSync2(join4(stubsDir, "typescript.stub.ts"), "utf-8");
+            writeFileSync2(join4(svcDir, "src/index.ts"), replacePlaceholders(src, config.name, svcName));
+            logger.step(`Stub: services/${svcName}/ (typescript)`);
+          } else {
+            const pkg2 = readFileSync2(join4(stubsDir, "node.stub.package.json"), "utf-8");
+            writeFileSync2(join4(svcDir, "package.json"), replacePlaceholders(pkg2, config.name, svcName));
+            const src = readFileSync2(join4(stubsDir, "node.stub.js"), "utf-8");
+            writeFileSync2(join4(svcDir, "src/index.js"), replacePlaceholders(src, config.name, svcName));
+            logger.step(`Stub: services/${svcName}/ (node)`);
+          }
+        }
+        break;
+      }
+      case "nextjs": {
+        if (!existsSync4(join4(svcDir, "src")) && !existsSync4(join4(svcDir, "package.json"))) {
+          const nextjsStubDir = join4(stubsDir, "nextjs.stub");
+          if (existsSync4(nextjsStubDir)) {
+            copyDirRecursive(nextjsStubDir, svcDir, config.name, svcName);
+          }
+          logger.step(`Stub: services/${svcName}/ (nextjs)`);
+        }
+        break;
+      }
+      case "python": {
+        if (!existsSync4(join4(svcDir, "src")) && !existsSync4(join4(svcDir, "requirements.txt"))) {
+          mkdirSync3(join4(svcDir, "src"), { recursive: true });
+          const reqs = readFileSync2(join4(stubsDir, "python.stub.requirements.txt"), "utf-8");
+          writeFileSync2(join4(svcDir, "requirements.txt"), reqs);
+          const src = readFileSync2(join4(stubsDir, "python.stub.py"), "utf-8");
+          writeFileSync2(join4(svcDir, "src/main.py"), replacePlaceholders(src, config.name, svcName));
+          logger.step(`Stub: services/${svcName}/ (python)`);
+        }
+        break;
+      }
+      case "static": {
+        if (!existsSync4(join4(svcDir, "public"))) {
+          mkdirSync3(join4(svcDir, "public"), { recursive: true });
+          const staticStubDir = join4(stubsDir, "static.stub");
+          if (existsSync4(join4(staticStubDir, "index.html"))) {
+            const html = readFileSync2(join4(staticStubDir, "index.html"), "utf-8");
+            writeFileSync2(join4(svcDir, "public/index.html"), replacePlaceholders(html, config.name, svcName));
+          }
+          logger.step(`Stub: services/${svcName}/ (static)`);
+        }
+        break;
+      }
+      case "cron": {
+        const runMode = svc.run || "job";
+        if (runMode === "job" && !existsSync4(join4(svcDir, "src")) && !existsSync4(join4(svcDir, "package.json"))) {
+          mkdirSync3(join4(svcDir, "src"), { recursive: true });
+          const pkg2 = readFileSync2(join4(stubsDir, "cron.stub.package.json"), "utf-8");
+          writeFileSync2(join4(svcDir, "package.json"), replacePlaceholders(pkg2, config.name, svcName));
+          const src = readFileSync2(join4(stubsDir, "cron.stub.js"), "utf-8");
+          writeFileSync2(join4(svcDir, "src/job.js"), replacePlaceholders(src, config.name, svcName));
+          logger.step(`Stub: services/${svcName}/ (cron)`);
+        }
+        break;
+      }
+    }
+  }
+}
+
+// ../shared/src/generator/ports.ts
+import * as net2 from "net";
+var BASE_PORTS = {
+  nextjs: 3e3,
+  node: 5e3,
+  python: 5e3,
+  static: 8e3
+};
+function isPortFree(port) {
+  return new Promise((resolve) => {
+    const server = net2.createServer();
+    server.once("error", () => resolve(false));
+    server.once("listening", () => {
+      server.close(() => resolve(true));
+    });
+    server.listen(port, "0.0.0.0");
+  });
+}
+async function computePortAssignments(config) {
+  const used = /* @__PURE__ */ new Set();
+  const portMap = /* @__PURE__ */ new Map();
+  for (const [name, svc] of Object.entries(config.services)) {
+    if (svc.type === "cron") continue;
+    let port = BASE_PORTS[svc.type] || 8080;
+    while (used.has(port) || !await isPortFree(port)) port++;
+    used.add(port);
+    portMap.set(name, port);
+  }
+  const requires = config.requires || [];
+  const hasMongodb = requires.some((r) => r === "mongodb");
+  const hasRedis = requires.some(
+    (r) => r === "redis" || typeof r === "object" && Object.keys(r)[0] === "redis"
+    // includes redis: private
+  );
+  if (hasMongodb) {
+    let port = 27017;
+    while (used.has(port) || !await isPortFree(port)) port++;
+    used.add(port);
+    portMap.set("_tunnel_mongodb", port);
+  }
+  if (hasRedis) {
+    let port = 6379;
+    while (used.has(port) || !await isPortFree(port)) port++;
+    used.add(port);
+    portMap.set("_tunnel_redis", port);
+  }
+  return portMap;
+}
+
+// ../shared/src/generator/dev-env.ts
+function computeDevEnv(opts) {
+  const { config, portMap, requires, sharedServices, mode, token, apiUrl } = opts;
+  const svcNames = Object.keys(config.services);
+  const result = /* @__PURE__ */ new Map();
+  const mongoPort = portMap.get("_tunnel_mongodb") || 27017;
+  const redisPort = portMap.get("_tunnel_redis") || 6379;
+  for (const svcName of svcNames) {
+    const svc = config.services[svcName];
+    const env = {};
+    const assignedPort = portMap.get(svcName);
+    env.PORT = mode === "native" ? String(assignedPort ?? "0") : "8080";
+    env.APP_NAME = config.name;
+    env.SERVICE_NAME = svcName;
+    env.NODE_ENV = "development";
+    const baseApiUrl = apiUrl || "https://api.cloudgrid.io";
+    env.AI_GATEWAY_URL = `${baseApiUrl}/ai-dev`;
+    if (token) {
+      env.CLOUDGRID_TOKEN = token;
+    }
+    for (const other of svcNames) {
+      if (config.services[other].type === "cron") continue;
+      const upper = upperSnake(other);
+      if (mode === "native") {
+        env[`${upper}_URL`] = `http://localhost:${portMap.get(other)}`;
+      } else {
+        env[`${upper}_URL`] = `http://${other}:8080`;
+      }
+    }
+    const host = mode === "native" ? "localhost" : "host.docker.internal";
+    for (const req of requires.shared) {
+      const svcDef = sharedServices[req];
+      if (req === "mongodb") {
+        env[svcDef.env_var] = `mongodb://${host}:${mongoPort}/${config.name}?directConnection=true`;
+      } else if (req === "redis") {
+        env[svcDef.env_var] = `redis://${host}:${redisPort}`;
+      } else if (req === "n8n") {
+        env[svcDef.env_var] = svcDef.local;
+      }
+    }
+    if (requires.privateRedis) {
+      env.REDIS_URL = `redis://${host}:${redisPort}`;
+    }
+    if (svc.env) {
+      for (const [key, val] of Object.entries(svc.env)) {
+        env[key] = val;
+      }
+    }
+    result.set(svcName, env);
+  }
+  return result;
+}
+
+// ../shared/src/generator/index.ts
+function loadCloudGridYaml(appDir) {
+  const yamlPath = join5(appDir, "cloudgrid.yaml");
+  if (!existsSync5(yamlPath)) {
+    die(`No cloudgrid.yaml found at ${yamlPath}`);
+  }
+  return parseYaml2(readFileSync3(yamlPath, "utf-8"));
+}
+function loadSharedServices() {
+  return parseYaml2(readFileSync3(SHARED_SERVICES_PATH, "utf-8"));
+}
+async function generate(appDir, opts) {
+  const config = loadCloudGridYaml(appDir);
+  validateConfig(config);
+  const sharedServices = loadSharedServices();
+  const requires = parseRequires(config.requires, sharedServices);
+  generateDockerfiles({ appDir, config });
+  generateStubs({ appDir, config });
+  return { config, requires, sharedServices };
+}
+
+// src/commands/create.ts
+var SAMPLES = [
+  { name: "Full-stack dashboard (Next.js + API + MongoDB)", value: "full-stack" },
+  { name: "Static site (HTML/React/Vue)", value: "static-site" },
+  { name: "Node.js API with MongoDB", value: "node-api" },
+  { name: "Python microservice with Redis", value: "python-worker" },
+  { name: "Multi-service with n8n integration", value: "multi-service" },
+  { name: "Blank", value: "blank" }
+];
+function validateAppName(name) {
+  validateName(name, "app name");
+}
+var createCommand = new Command2("create").argument("[name]", "App name").option("--interactive", "Use interactive wizard instead of template picker").option("--dir <path>", "Target directory").description("Create a new Cloud Grid app").action(async (nameArg, opts) => {
+  let name = nameArg;
+  if (!name) {
+    const answer = await inquirer2.prompt([
+      { type: "input", name: "name", message: "App name:" }
+    ]);
+    name = answer.name;
+  }
+  validateAppName(name);
+  let appDir;
+  if (opts.dir) {
+    appDir = opts.dir;
+  } else {
+    let isInGitRepo = false;
+    try {
+      const { execaSync } = await import("execa");
+      execaSync("git", ["rev-parse", "--show-toplevel"], { stdio: "pipe" });
+      isInGitRepo = true;
+    } catch {
+      isInGitRepo = false;
+    }
+    if (isInGitRepo) {
+      appDir = join6(process.cwd(), name);
+    } else {
+      ensureAppsDir();
+      appDir = join6(getAppsDir(), name);
+    }
+  }
+  if (existsSync6(appDir)) {
+    die2(`Directory already exists: ${appDir}`);
+  }
+  mkdirSync4(appDir, { recursive: true });
+  if (opts.interactive) {
+    await interactiveWizard(name, appDir);
+  } else {
+    await templatePicker(name, appDir);
+  }
+  log.step("Generating files...");
+  if (configExists()) {
+    const config = loadConfig();
+    await generate(appDir, {
+      environment: "local",
+      registry: config.registry,
+      domain: `${name}.${config.domain}`
+    });
+  } else {
+    log.warn("No CLI config found. Skipping file generation. Run: cloudgrid init");
+  }
+  const cloudgridMdSrc = join6(TEMPLATES_DIR, "CLOUDGRID.md");
+  if (existsSync6(cloudgridMdSrc)) {
+    copyFileSync3(cloudgridMdSrc, join6(appDir, "CLOUDGRID.md"));
+  }
+  writeFileSync3(join6(appDir, ".gitignore"), [
+    "node_modules/",
+    ".next/",
+    ".cloudgrid-dev.lock",
+    ""
+  ].join("\n"));
+  console.log("");
+  log.success(`Created ${name} at ${appDir}`);
+  console.log("");
+  console.log("  Next steps:");
+  console.log(`    cd ${appDir}`);
+  console.log("    cloudgrid dev       # start local development");
+  console.log("    cloudgrid deploy    # deploy to production");
+  console.log("");
+});
+async function templatePicker(name, appDir) {
+  const { template } = await inquirer2.prompt([
+    { type: "list", name: "template", message: "Pick a starting template:", choices: SAMPLES }
+  ]);
+  if (template === "blank") {
+    const yaml = `name: ${name}
+
+services:
+  app:
+    type: node
+    path: /
+`;
+    writeFileSync3(join6(appDir, "cloudgrid.yaml"), yaml);
+  } else {
+    const samplePath = join6(TEMPLATES_DIR, "samples", `${template}.yaml`);
+    if (existsSync6(samplePath)) {
+      let content = readFileSync4(samplePath, "utf-8");
+      content = content.replace(/__APP_NAME__/g, name);
+      writeFileSync3(join6(appDir, "cloudgrid.yaml"), content);
+    } else {
+      log.warn(`Template ${template} not found, using blank template`);
+      const yaml = `name: ${name}
+
+services:
+  app:
+    type: node
+    path: /
+`;
+      writeFileSync3(join6(appDir, "cloudgrid.yaml"), yaml);
+    }
+  }
+}
+async function interactiveWizard(name, appDir) {
+  const services = {};
+  const requires = [];
+  let addMore = true;
+  while (addMore) {
+    const svc = await inquirer2.prompt([
+      { type: "input", name: "name", message: "Service name:" },
+      { type: "list", name: "type", message: "Service type:", choices: ["nextjs", "node", "python", "static", "cron"] },
+      { type: "input", name: "path", message: "Public path (or enter to skip):", default: "", when: (a) => a.type !== "cron" },
+      { type: "input", name: "schedule", message: 'Cron schedule (e.g. "0 2 * * *"):', when: (a) => a.type === "cron" },
+      { type: "list", name: "runMode", message: "Run mode:", choices: [
+        { name: "Run code (src/job.js)", value: "job" },
+        { name: "Call HTTP URL", value: "http" }
+      ], when: (a) => a.type === "cron" },
+      { type: "input", name: "runUrl", message: "HTTP URL to call:", when: (a) => a.type === "cron" && a.runMode === "http" }
+    ]);
+    services[svc.name] = { type: svc.type };
+    if (svc.type === "node") {
+      const { lang } = await inquirer2.prompt([
+        {
+          type: "list",
+          name: "lang",
+          message: "Language:",
+          choices: [
+            { name: "JavaScript (default)", value: "javascript" },
+            { name: "TypeScript", value: "typescript" }
+          ]
+        }
+      ]);
+      if (lang === "typescript") {
+        services[svc.name].lang = "typescript";
+      }
+    }
+    if (svc.path) services[svc.name].path = svc.path;
+    if (svc.type === "cron") {
+      if (svc.schedule) services[svc.name].schedule = svc.schedule;
+      if (svc.runMode === "http" && svc.runUrl) {
+        services[svc.name].run = svc.runUrl;
+      }
+    }
+    const { more } = await inquirer2.prompt([
+      { type: "confirm", name: "more", message: "Add another service?", default: false }
+    ]);
+    addMore = more;
+  }
+  const { sharedSvcs } = await inquirer2.prompt([
+    {
+      type: "checkbox",
+      name: "sharedSvcs",
+      message: "Shared services:",
+      choices: [
+        { name: "MongoDB", value: "mongodb" },
+        { name: "Redis (shared)", value: "redis" },
+        { name: "Redis (private, app-scoped)", value: "redis-private" },
+        { name: "n8n webhooks", value: "n8n" }
+      ]
+    }
+  ]);
+  for (const svc of sharedSvcs) {
+    if (svc === "redis-private") requires.push({ redis: "private" });
+    else requires.push(svc);
+  }
+  const yaml = {
+    name,
+    services,
+    ...requires.length > 0 ? { requires } : {}
+  };
+  writeFileSync3(join6(appDir, "cloudgrid.yaml"), stringifyYaml2(yaml));
+}
+
+// src/commands/dev.ts
+import { Command as Command3 } from "commander";
+import { existsSync as existsSync7, writeFileSync as writeFileSync5, readFileSync as readFileSync5, unlinkSync } from "fs";
+import { join as join8 } from "path";
+import { tmpdir } from "os";
+import { createInterface } from "readline";
+import { execa as execa2 } from "execa";
+import chalk2 from "chalk";
+
+// ../shared/src/generator/docker-compose.ts
+import { writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+function generateDockerCompose(opts) {
+  const { outputPath, appDir, config, requires, sharedServices, portMap, token, apiUrl } = opts;
+  const svcNames = Object.keys(config.services);
+  const mongoPort = portMap.get("_tunnel_mongodb") || 27017;
+  const redisPort = portMap.get("_tunnel_redis") || 6379;
+  let yaml = "services:\n";
+  for (const svcName of svcNames) {
+    const svc = config.services[svcName];
+    if (svc.type === "cron") continue;
+    const localPort = portMap.get(svcName);
+    const containerPort = svc.type === "static" ? 80 : 8080;
+    yaml += `  ${svcName}:
+`;
+    yaml += `    build: ${join7(appDir, "services", svcName)}
+`;
+    yaml += `    ports:
+`;
+    yaml += `      - "${localPort}:${containerPort}"
+`;
+    if (svc.lang === "typescript") {
+      yaml += `    command: ["npx", "tsx", "watch", "src/index.ts"]
+`;
+    }
+    if (svc.type === "static") {
+      yaml += `    volumes:
+`;
+      yaml += `      - ${join7(appDir, "services", svcName, "public")}:/usr/share/nginx/html
+`;
+    } else {
+      yaml += `    volumes:
+`;
+      yaml += `      - ${join7(appDir, "services", svcName, "src")}:/app/src
+`;
+    }
+    yaml += `    environment:
+`;
+    yaml += `      PORT: "8080"
+`;
+    yaml += `      APP_NAME: "${config.name}"
+`;
+    yaml += `      SERVICE_NAME: "${svcName}"
+`;
+    yaml += `      NODE_ENV: development
+`;
+    if (apiUrl && token) {
+      const aiDevUrl = `${apiUrl.replace(/\/$/, "")}/ai-dev`;
+      yaml += `      AI_GATEWAY_URL: "${aiDevUrl}"
+`;
+      yaml += `      CLOUDGRID_TOKEN: "${token}"
+`;
+    }
+    for (const other of svcNames) {
+      const upper = upperSnake(other);
+      yaml += `      ${upper}_URL: "http://${other}:8080"
+`;
+    }
+    for (const req of requires.shared) {
+      const svcDef = sharedServices[req];
+      if (req === "mongodb") {
+        yaml += `      ${svcDef.env_var}: "mongodb://host.docker.internal:${mongoPort}/${config.name}?directConnection=true"
+`;
+      } else if (req === "redis") {
+        yaml += `      ${svcDef.env_var}: "redis://host.docker.internal:${redisPort}"
+`;
+      } else if (req === "n8n") {
+        yaml += `      ${svcDef.env_var}: "${svcDef.local}"
+`;
+      }
+    }
+    if (requires.privateRedis) {
+      yaml += `      REDIS_URL: "redis://host.docker.internal:${redisPort}"
+`;
+    }
+    if (svc.env) {
+      for (const [key, val] of Object.entries(svc.env)) {
+        yaml += `      ${key}: "${val}"
+`;
+      }
+    }
+  }
+  writeFileSync4(outputPath, yaml);
+}
+
+// src/commands/dev.ts
+var LOCK_FILE = ".cloudgrid-dev.lock";
+var SERVICE_COLORS = [chalk2.cyan, chalk2.magenta, chalk2.yellow, chalk2.green, chalk2.blue, chalk2.red];
+var RUNNERS = {
+  node: () => ({ cmd: "node", args: ["--watch", "src/index.js"] }),
+  nextjs: (port) => ({ cmd: "npx", args: ["next", "dev", "-p", String(port)] }),
+  python: () => ({ cmd: "python", args: ["src/main.py"] }),
+  static: (port) => ({ cmd: "npx", args: ["serve", "public/", "-l", String(port)] })
+};
+function checkDevLock(appDir) {
+  const lockPath = join8(appDir, LOCK_FILE);
+  if (!existsSync7(lockPath)) return;
+  try {
+    const lock = JSON.parse(readFileSync5(lockPath, "utf-8"));
+    try {
+      process.kill(lock.pid, 0);
+      die2(`Dev already running for this app (PID ${lock.pid}). Stop it first (Ctrl+C) or use --force`);
+    } catch {
+      unlinkSync(lockPath);
+    }
+  } catch {
+    try {
+      unlinkSync(lockPath);
+    } catch {
+    }
+  }
+}
+function writeDevLock(appDir, ports) {
+  writeFileSync5(join8(appDir, LOCK_FILE), JSON.stringify({
+    pid: process.pid,
+    ports: Object.fromEntries(ports),
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, null, 2));
+}
+function removeDevLock(appDir) {
+  try {
+    unlinkSync(join8(appDir, LOCK_FILE));
+  } catch {
+  }
+}
+function prefixStream(stream, name, color) {
+  const rl = createInterface({ input: stream });
+  rl.on("line", (line) => {
+    console.log(`${color(`[${name}]`)} ${line}`);
+  });
+}
+var devCommand = new Command3("dev").description("Start local development").option("--compose", "Use docker-compose instead of native processes").option("--force", "Ignore existing dev lock").action(async (opts) => {
+  const appDir = process.cwd();
+  if (!existsSync7(join8(appDir, "cloudgrid.yaml"))) {
+    die2("No cloudgrid.yaml found. Run: cloudgrid create <name>");
+  }
+  if (!opts.force) checkDevLock(appDir);
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const cliConfig = loadConfig();
+  if (!cliConfig.jwt) {
+    log.warn("Not logged in \u2014 AI features will not work in dev mode. Run: cloudgrid login");
+  }
+  const apiClient = createApiClient(cliConfig);
+  const config = loadCloudGridYaml(appDir);
+  const sharedServices = loadSharedServices();
+  const requires = parseRequires(config.requires, sharedServices);
+  const s1 = spinner("Checking available ports...");
+  s1.start();
+  const portMap = await computePortAssignments(config);
+  s1.succeed("Ports assigned");
+  writeDevLock(appDir, portMap);
+  const tunnels = [];
+  const mongoPort = portMap.get("_tunnel_mongodb");
+  const redisPort = portMap.get("_tunnel_redis");
+  if (mongoPort || redisPort) {
+    log.info("Opening tunnels via Cloud Grid API...");
+  }
+  if (mongoPort) {
+    try {
+      const t = await apiClient.openTunnel("mongodb", mongoPort);
+      tunnels.push(t);
+      log.step(`MongoDB: localhost:${mongoPort}`);
+    } catch (err) {
+      log.warn(`MongoDB tunnel failed: ${err.message}`);
+    }
+  }
+  if (redisPort) {
+    try {
+      const t = await apiClient.openTunnel("redis", redisPort);
+      tunnels.push(t);
+      log.step(`Redis: localhost:${redisPort}`);
+    } catch (err) {
+      log.warn(`Redis tunnel failed: ${err.message}`);
+    }
+  }
+  const children = [];
+  let tmpComposePath = null;
+  let cleaned = false;
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    for (const child of children) {
+      try {
+        child.kill();
+      } catch {
+      }
+    }
+    for (const tunnel of tunnels) {
+      try {
+        if ("closeAllConnections" in tunnel) tunnel.closeAllConnections();
+        tunnel.close();
+      } catch {
+      }
+    }
+    if (tmpComposePath) {
+      try {
+        unlinkSync(tmpComposePath);
+      } catch {
+      }
+    }
+    removeDevLock(appDir);
+  };
+  process.once("SIGTERM", () => {
+    cleanup();
+    process.exit(0);
+  });
+  process.once("SIGINT", () => {
+    cleanup();
+    process.exit(0);
+  });
+  if (opts.compose) {
+    tmpComposePath = join8(tmpdir(), `cloudgrid-${config.name}-compose.yaml`);
+    log.info("Starting docker-compose...");
+    generateDockerCompose({
+      outputPath: tmpComposePath,
+      appDir,
+      config,
+      requires,
+      sharedServices,
+      portMap,
+      token: cliConfig.jwt,
+      apiUrl: cliConfig.api_url
+    });
+    console.log("");
+    const svcNames = Object.keys(config.services);
+    for (const name of svcNames) {
+      log.info(`${name}: http://localhost:${portMap.get(name)}`);
+    }
+    console.log("");
+    try {
+      await exec("docker", ["compose", "-f", tmpComposePath, "up", "--build"], { stdio: "inherit" });
+    } finally {
+      cleanup();
+    }
+  } else {
+    const envMap = computeDevEnv({ config, portMap, requires, sharedServices, mode: "native", token: cliConfig.jwt, apiUrl: cliConfig.api_url });
+    const svcNames = Object.keys(config.services);
+    for (const svcName of svcNames) {
+      const svc = config.services[svcName];
+      if (svc.type !== "cron") continue;
+      const runMode = svc.run || "job";
+      const color = SERVICE_COLORS[svcNames.indexOf(svcName) % SERVICE_COLORS.length];
+      if (runMode === "job") {
+        const svcDir = join8(appDir, "services", svcName);
+        const svcEnv = envMap.get(svcName) || {};
+        log.info(`${color(svcName)}: Running cron job once...`);
+        try {
+          const result = await execa2("node", ["src/job.js"], {
+            cwd: svcDir,
+            env: { ...process.env, ...svcEnv },
+            stdio: "pipe"
+          });
+          if (result.stdout) {
+            for (const line of result.stdout.split("\n")) {
+              console.log(`${color(`[${svcName}]`)} ${line}`);
+            }
+          }
+        } catch (err) {
+          if (err.stdout) {
+            for (const line of err.stdout.split("\n")) {
+              console.log(`${color(`[${svcName}]`)} ${line}`);
+            }
+          }
+          if (err.stderr) {
+            for (const line of err.stderr.split("\n")) {
+              console.log(`${color(`[${svcName}]`)} ${line}`);
+            }
+          }
+        }
+        log.info(`${color(svcName)}: Job completed. It will run on schedule in production.`);
+      } else {
+        log.info(`${color(svcName)}: Cron '${svcName}' triggers ${runMode} on schedule '${svc.schedule}'. In dev, call the URL manually.`);
+      }
+    }
+    for (const svcName of svcNames) {
+      const svcDir = join8(appDir, "services", svcName);
+      const svcType = config.services[svcName].type;
+      if (svcType === "cron") continue;
+      if ((svcType === "node" || svcType === "nextjs") && !existsSync7(join8(svcDir, "node_modules"))) {
+        const si = spinner(`Installing dependencies for ${svcName}...`);
+        si.start();
+        try {
+          await exec("npm", ["install"], { cwd: svcDir, stdio: "pipe" });
+          si.succeed(`Dependencies installed for ${svcName}`);
+        } catch {
+          si.fail(`Failed to install dependencies for ${svcName}`);
+          cleanup();
+          die2(`npm install failed for ${svcName}. Fix the issue and retry.`);
+        }
+      }
+    }
+    console.log("");
+    for (let i = 0; i < svcNames.length; i++) {
+      const name = svcNames[i];
+      if (config.services[name].type === "cron") continue;
+      const port = portMap.get(name);
+      const color = SERVICE_COLORS[i % SERVICE_COLORS.length];
+      log.info(`${color(name)}: http://localhost:${port}`);
+    }
+    console.log("");
+    log.info("Hot reload enabled. Press Ctrl+C to stop.");
+    console.log("");
+    for (let i = 0; i < svcNames.length; i++) {
+      const svcName = svcNames[i];
+      const svc = config.services[svcName];
+      if (svc.type === "cron") continue;
+      const port = portMap.get(svcName);
+      const svcDir = join8(appDir, "services", svcName);
+      const svcEnv = envMap.get(svcName);
+      let runner = RUNNERS[svc.type];
+      const color = SERVICE_COLORS[i % SERVICE_COLORS.length];
+      if (svc.lang === "typescript") {
+        runner = () => ({ cmd: "npx", args: ["tsx", "watch", "src/index.ts"] });
+      }
+      if (!runner) {
+        log.warn(`Unknown service type: ${svc.type} for ${svcName}`);
+        continue;
+      }
+      const { cmd, args } = runner(port);
+      const child = execa2(cmd, args, {
+        cwd: svcDir,
+        env: { ...process.env, ...svcEnv },
+        stdio: "pipe"
+      });
+      if (child.stdout) prefixStream(child.stdout, svcName, color);
+      if (child.stderr) prefixStream(child.stderr, svcName, color);
+      child.catch(() => {
+      });
+      children.push(child);
+    }
+    await new Promise(() => {
+    });
+  }
+});
+
+// src/commands/deploy.ts
+import { Command as Command4 } from "commander";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { execSync } from "child_process";
+var deployCommand = new Command4("deploy").description("Deploy app to production").action(async () => {
+  if (!existsSync8("cloudgrid.yaml")) die2("No cloudgrid.yaml in current directory");
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const cliConfig = loadConfig();
+  const config = loadCloudGridYaml(process.cwd());
+  const apiClient = createApiClient(cliConfig);
+  console.log(`
+Deploying ${config.name} to production...
+`);
+  await serverBuild(config, apiClient);
+});
+async function serverBuild(config, apiClient) {
+  const cloudgridYaml = readFileSync6("cloudgrid.yaml", "utf-8");
+  const services = {};
+  for (const [svcName, svc] of Object.entries(config.services)) {
+    if (svc.type === "cron" && svc.run && (svc.run.startsWith("http://") || svc.run.startsWith("https://"))) {
+      log.step(`${svcName}: HTTP cron \u2014 no build needed`);
+      continue;
+    }
+    const svcDir = `services/${svcName}`;
+    if (!existsSync8(svcDir)) {
+      die2(`Service directory not found: ${svcDir}`);
+    }
+    const s = spinner(`Packaging ${svcName}...`);
+    s.start();
+    const excludes = ["node_modules", ".git", ".next", "dist", "__pycache__", ".venv"].map((d) => `--exclude=${d}`).join(" ");
+    const tarball = execSync(
+      `tar -czf - ${excludes} -C ${svcDir} .`,
+      { maxBuffer: 100 * 1024 * 1024 }
+    );
+    const sizeMB = (tarball.length / 1024 / 1024).toFixed(1);
+    if (tarball.length > 80 * 1024 * 1024) {
+      s.warn(`${svcName}: ${sizeMB}MB \u2014 consider adding .dockerignore to exclude unnecessary files`);
+    } else {
+      s.succeed(`${svcName}: packaged (${sizeMB}MB)`);
+    }
+    services[svcName] = tarball.toString("base64");
+  }
+  if (Object.keys(services).length === 0) {
+    log.step("No services to build");
+  }
+  const s2 = spinner("Building and deploying via Cloud Grid API...");
+  s2.start();
+  try {
+    const result = await apiClient.build(config.name, services, cloudgridYaml);
+    s2.succeed("Deployed");
+    for (const svc of result.services) {
+      const status = svc.ready ? "  ready" : "  pending";
+      log.step(`${svc.name}: ${status}`);
+    }
+    console.log(`
+  Live at ${result.url}
+`);
+  } catch (err) {
+    s2.fail("Deploy failed");
+    if (err instanceof ApiError) {
+      if (err.code === "BUILD_FAILED") die2(`Build failed: ${err.message}`);
+      if (err.code === "DEPLOY_IN_PROGRESS") die2("Another deploy is in progress. Try again shortly.");
+      if (err.code === "DEPLOY_TIMEOUT") {
+        log.warn("Deploy timed out. Check status with: cloudgrid status");
+        return;
+      }
+      die2(`API error (${err.code}): ${err.message}`);
+    }
+    throw err;
+  }
+}
+
+// src/commands/list.ts
+import { Command as Command5 } from "commander";
+import chalk3 from "chalk";
+var listCommand = new Command5("list").description("Show all deployed apps").action(async () => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const apiClient = createApiClient(loadConfig());
+  const { apps } = await apiClient.list();
+  if (apps.length === 0) {
+    console.log("No apps deployed.");
+    return;
+  }
+  console.log("");
+  console.log(chalk3.bold("NAME".padEnd(20) + "DOMAIN".padEnd(35) + "DEPLOYED"));
+  for (const app of apps) {
+    const ago = timeAgo(app.deployed_at);
+    console.log(`${app.name.padEnd(20)}${app.domain.padEnd(35)}${ago} by ${app.deployed_by}`);
+  }
+  console.log("");
+});
+function timeAgo(iso) {
+  const ms = Date.now() - new Date(iso).getTime();
+  const mins = Math.floor(ms / 6e4);
+  if (mins < 60) return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs}h ago`;
+  return `${Math.floor(hrs / 24)}d ago`;
+}
+
+// src/commands/remove.ts
+import { Command as Command6 } from "commander";
+import inquirer3 from "inquirer";
+var removeCommand = new Command6("remove").argument("<name>", "App name to remove").description("Remove an app from the cluster").action(async (name) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const { confirm } = await inquirer3.prompt([
+    {
+      type: "confirm",
+      name: "confirm",
+      message: `Remove ${name}? This deletes all pods, services, and data.`,
+      default: false
+    }
+  ]);
+  if (!confirm) return;
+  const apiClient = createApiClient(loadConfig());
+  const s = spinner(`Removing ${name}...`);
+  s.start();
+  try {
+    await apiClient.remove(name);
+    s.succeed(`${name} removed.`);
+  } catch (err) {
+    s.fail("Remove failed");
+    if (err instanceof ApiError && err.code === "NOT_FOUND") {
+      die2(`App "${name}" not found`);
+    }
+    if (err instanceof ApiError) {
+      die2(`API error (${err.code}): ${err.message}`);
+    }
+    throw err;
+  }
+});
+
+// src/commands/logs.ts
+import { Command as Command7 } from "commander";
+import { existsSync as existsSync9 } from "fs";
+var logsCommand = new Command7("logs").argument("[name]", "App name (auto-detected from cloudgrid.yaml if in app dir)").option("-s, --service <service>", "Filter by service name").option("-t, --tail <lines>", "Number of lines to show", "100").description("Show app logs").action(async (name, opts) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const appName = name || (existsSync9("cloudgrid.yaml") ? loadCloudGridYaml(process.cwd()).name : null);
+  if (!appName) {
+    die2("Provide app name or run from app directory");
+  }
+  const apiClient = createApiClient(loadConfig());
+  try {
+    const logs = await apiClient.logs(appName, {
+      service: opts.service,
+      tail: opts.tail ? parseInt(opts.tail, 10) : 100
+    });
+    if (logs) {
+      process.stdout.write(logs);
+      if (!logs.endsWith("\n")) process.stdout.write("\n");
+    } else {
+      console.log("No logs available.");
+    }
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "NOT_FOUND") {
+      die2(`App "${appName}" not found`);
+    }
+    throw err;
+  }
+});
+
+// src/commands/status.ts
+import { Command as Command8 } from "commander";
+import { existsSync as existsSync10 } from "fs";
+import chalk4 from "chalk";
+var statusCommand = new Command8("status").argument("[name]", "App name (auto-detected from cloudgrid.yaml if in app dir)").description("Show app status").action(async (name) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const appName = name || (existsSync10("cloudgrid.yaml") ? loadCloudGridYaml(process.cwd()).name : null);
+  if (!appName) {
+    die2("Provide app name or run from app directory");
+  }
+  const apiClient = createApiClient(loadConfig());
+  try {
+    const status = await apiClient.status(appName);
+    console.log("");
+    console.log(chalk4.bold(`App: ${status.name}`));
+    console.log(`Domain: ${status.domain}`);
+    console.log("");
+    console.log(chalk4.bold("PODS"));
+    console.log("NAME".padEnd(40) + "STATUS".padEnd(12) + "READY".padEnd(8) + "RESTARTS");
+    for (const pod of status.pods) {
+      const readyStr = pod.ready ? "Yes" : "No";
+      console.log(
+        `${pod.name.padEnd(40)}${pod.status.padEnd(12)}${readyStr.padEnd(8)}${pod.restarts}`
+      );
+    }
+    console.log("");
+    if (status.services.length > 0) {
+      console.log(chalk4.bold("SERVICES"));
+      console.log("NAME".padEnd(30) + "TYPE".padEnd(15) + "PORTS");
+      for (const svc of status.services) {
+        const portsStr = Array.isArray(svc.ports) ? svc.ports.map((p) => `${p.port}\u2192${p.targetPort}`).join(", ") : String(svc.ports);
+        console.log(`${svc.name.padEnd(30)}${svc.type.padEnd(15)}${portsStr}`);
+      }
+      console.log("");
+    }
+    if (status.cronJobs && status.cronJobs.length > 0) {
+      console.log(chalk4.bold("CRON JOBS"));
+      console.log(
+        "NAME".padEnd(20) + "SCHEDULE".padEnd(18) + "LAST RUN".padEnd(14) + "NEXT RUN".padEnd(14) + "STATUS".padEnd(16) + "TIMEZONE"
+      );
+      for (const cj of status.cronJobs) {
+        console.log(
+          `${(cj.name || "").padEnd(20)}${(cj.schedule || "").padEnd(18)}${(cj.lastRun || "-").padEnd(14)}${(cj.nextRun || "-").padEnd(14)}${(cj.status || "-").padEnd(16)}${cj.timezone || "UTC"}`
+        );
+      }
+      console.log("");
+    }
+    if (status.ingress) {
+      console.log(chalk4.bold("INGRESS"));
+      const hosts = status.ingress.hosts?.join(", ") || status.ingress.host || "unknown";
+      console.log(`Host: ${hosts}  IP: ${status.ingress.ip}`);
+      console.log("");
+    }
+    try {
+      const [envResult, secretsResult] = await Promise.all([
+        apiClient.listEnv(appName),
+        apiClient.listSecrets(appName)
+      ]);
+      const envCount = envResult.env?.length || 0;
+      const secretsCount = secretsResult.secrets?.length || 0;
+      if (envCount > 0 || secretsCount > 0) {
+        console.log(`
+  ENV: ${envCount} vars | SECRETS: ${secretsCount} keys`);
+      }
+    } catch {
+    }
+    try {
+      const eventsResult = await apiClient.listEvents(appName);
+      const events = eventsResult.events || [];
+      if (events.length > 0) {
+        const last = events[0];
+        const icon = last.status === "success" ? "\u2713" : last.status === "failed" ? "\u2717" : "\u23F3";
+        console.log("\n  LAST DEPLOY");
+        console.log(`  ${icon} ${last.status}  ${last.sha ? last.sha.slice(0, 7) : "N/A"}  by ${last.triggered_by} (${last.source})`);
+        if (last.status === "failed" && last.error) {
+          console.log(`    Error: ${last.error.slice(0, 100)}`);
+        }
+      }
+    } catch {
+    }
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "NOT_FOUND") {
+      die2(`App "${appName}" not found`);
+    }
+    throw err;
+  }
+});
+
+// src/commands/doctor.ts
+import { Command as Command9 } from "commander";
+import { execSync as execSync2 } from "child_process";
+import * as net3 from "net";
+import chalk5 from "chalk";
+var doctorCommand = new Command9("doctor").description("Run diagnostic checks").action(async () => {
+  console.log(`
+  ${chalk5.bold("Cloud Grid Doctor")}
+`);
+  const results = [];
+  results.push(checkNode());
+  results.push(await checkDocker());
+  const configResult = checkConfig();
+  results.push(configResult.result);
+  if (configResult.config) {
+    results.push(await checkApiReachable(configResult.config));
+    results.push(await checkApiAuth(configResult.config));
+  }
+  const ports = [3e3, 5e3, 27017, 6379];
+  for (const port of ports) {
+    results.push(await checkPort(port));
+  }
+  const passed = results.filter((r) => r.ok).length;
+  const total = results.length;
+  for (const r of results) {
+    const icon = r.ok ? chalk5.green("\u2713") : chalk5.red("\u2717");
+    console.log(`  ${icon} ${r.label}: ${r.detail}`);
+  }
+  const warnings = total - passed;
+  console.log(
+    `
+  ${passed}/${total} checks passed.${warnings > 0 ? ` ${warnings} warning${warnings > 1 ? "s" : ""}.` : ""}
+`
+  );
+});
+function checkNode() {
+  const version = process.version;
+  const major = parseInt(version.slice(1), 10);
+  return {
+    label: "Node.js",
+    ok: major >= 20,
+    detail: major >= 20 ? version : `${version} (need 20+)`
+  };
+}
+async function checkDocker() {
+  try {
+    execSync2("docker info", { stdio: "pipe" });
+    return { label: "Docker", ok: true, detail: "running" };
+  } catch {
+    return { label: "Docker", ok: false, detail: "not running or not installed" };
+  }
+}
+function checkConfig() {
+  if (!configExists()) {
+    return {
+      result: { label: "CLI config", ok: false, detail: "~/.cloudgrid/config.yaml not found" },
+      config: null
+    };
+  }
+  try {
+    const config = loadConfig();
+    if (!config.api_url || !config.jwt) {
+      return {
+        result: { label: "CLI config", ok: false, detail: "missing api_url or jwt" },
+        config: null
+      };
+    }
+    return {
+      result: { label: "CLI config", ok: true, detail: "~/.cloudgrid/config.yaml found" },
+      config
+    };
+  } catch {
+    return {
+      result: { label: "CLI config", ok: false, detail: "failed to parse config" },
+      config: null
+    };
+  }
+}
+async function checkApiReachable(config) {
+  try {
+    const url = `${config.api_url.replace(/\/+$/, "")}/healthz`;
+    const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+    return {
+      label: "API",
+      ok: res.ok,
+      detail: res.ok ? `${config.api_url} reachable (${res.status} OK)` : `${config.api_url} returned ${res.status}`
+    };
+  } catch (err) {
+    return { label: "API", ok: false, detail: `${config.api_url} unreachable (${err.message})` };
+  }
+}
+async function checkApiAuth(config) {
+  try {
+    const url = `${config.api_url.replace(/\/+$/, "")}/apps`;
+    const res = await fetch(url, {
+      headers: { "authorization": `Bearer ${config.jwt}` },
+      signal: AbortSignal.timeout(5e3)
+    });
+    return {
+      label: "API auth",
+      ok: res.ok,
+      detail: res.ok ? "valid" : `rejected (${res.status})`
+    };
+  } catch (err) {
+    return { label: "API auth", ok: false, detail: `failed (${err.message})` };
+  }
+}
+function checkPort(port) {
+  return new Promise((resolve) => {
+    const server = net3.createServer();
+    server.once("error", (err) => {
+      if (err.code === "EADDRINUSE") {
+        resolve({ label: `Port ${port}`, ok: false, detail: "in use" });
+      } else {
+        resolve({ label: `Port ${port}`, ok: false, detail: err.message });
+      }
+    });
+    server.once("listening", () => {
+      server.close(() => {
+        resolve({ label: `Port ${port}`, ok: true, detail: "free" });
+      });
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+
+// src/commands/connect.ts
+import { Command as Command10 } from "commander";
+import { existsSync as existsSync11 } from "fs";
+import inquirer4 from "inquirer";
+var connectCommand = new Command10("connect").description("Connect app to a GitHub repo for auto-deploy on push").action(async () => {
+  if (!existsSync11("cloudgrid.yaml")) die2("No cloudgrid.yaml in current directory");
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const cliConfig = loadConfig();
+  const config = loadCloudGridYaml(process.cwd());
+  const apiClient = createApiClient(cliConfig);
+  let repos;
+  try {
+    const result = await apiClient.listRepos();
+    repos = result.repos;
+  } catch (err) {
+    die2(`Failed to list repos: ${err.message}`);
+  }
+  if (!repos || repos.length === 0) {
+    die2("No repos found. Check that the Cloud Grid GitHub App is installed on your org.");
+  }
+  const { repo } = await inquirer4.prompt([{
+    type: "list",
+    name: "repo",
+    message: "Select repository:",
+    choices: repos.map((r) => r.full_name)
+  }]);
+  const selectedRepo = repos.find((r) => r.full_name === repo);
+  const { branch } = await inquirer4.prompt([{
+    type: "input",
+    name: "branch",
+    message: "Branch to deploy:",
+    default: selectedRepo?.default_branch || "main"
+  }]);
+  try {
+    await apiClient.connect(config.name, repo, branch);
+    log.success(`Connected ${repo} (${branch}) \u2192 ${config.name}.cloudgrid.io`);
+    log.step("Push to this branch to auto-deploy.");
+  } catch (err) {
+    die2(`Failed to connect: ${err.message}`);
+  }
+});
+
+// src/commands/disconnect.ts
+import { Command as Command11 } from "commander";
+import { existsSync as existsSync12 } from "fs";
+var disconnectCommand = new Command11("disconnect").description("Disconnect app from GitHub repo (stop auto-deploy)").action(async () => {
+  if (!existsSync12("cloudgrid.yaml")) die2("No cloudgrid.yaml in current directory");
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const cliConfig = loadConfig();
+  const config = loadCloudGridYaml(process.cwd());
+  const apiClient = createApiClient(cliConfig);
+  try {
+    await apiClient.disconnect(config.name);
+    log.success(`Disconnected ${config.name} from GitHub. Auto-deploy disabled.`);
+  } catch (err) {
+    die2(`Failed to disconnect: ${err.message}`);
+  }
+});
+
+// src/commands/builds.ts
+import { Command as Command12 } from "commander";
+import { existsSync as existsSync13 } from "fs";
+var buildsCommand = new Command12("builds").description("Show build history").argument("[name]", "App name (defaults to current directory)").option("--logs", "Show build logs for latest build").action(async (name, opts) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const cliConfig = loadConfig();
+  const apiClient = createApiClient(cliConfig);
+  const appName = name || (existsSync13("cloudgrid.yaml") ? loadCloudGridYaml(process.cwd()).name : null);
+  if (!appName) die2("Specify app name or run from a directory with cloudgrid.yaml");
+  try {
+    const result = await apiClient.listBuilds(appName);
+    const builds = result.builds || [];
+    if (builds.length === 0) {
+      log.info("No builds yet.");
+      return;
+    }
+    console.log("\n  BUILDS");
+    console.log("  " + "-".repeat(60));
+    for (const b of builds) {
+      const icon = b.status === "SUCCESS" ? "\u2713" : "\u2717";
+      console.log(`  ${icon} ${b.sha || "N/A"}  ${b.status}  ${b.duration_s || "?"}s  ${b.started_at || ""}`);
+    }
+    console.log("");
+  } catch (err) {
+    die2(`Failed to list builds: ${err.message}`);
+  }
+});
+
+// src/commands/open.ts
+import { Command as Command13 } from "commander";
+import { existsSync as existsSync14 } from "fs";
+import { spawn } from "child_process";
+var openCommand = new Command13("open").description("Open app in browser").argument("[name]", "App name (defaults to current directory)").action(async (name) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const appName = name || (existsSync14("cloudgrid.yaml") ? loadCloudGridYaml(process.cwd()).name : null);
+  if (!appName) die2("Specify app name or run from a directory with cloudgrid.yaml");
+  const cliConfig = loadConfig();
+  const apiClient = createApiClient(cliConfig);
+  try {
+    const status = await apiClient.status(appName);
+    const domain = status.domain || `${appName}.cloudgrid.io`;
+    const url = `https://${domain}`;
+    const platform = process.platform;
+    if (platform === "darwin" || platform === "linux" || platform === "win32") {
+      const opener = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : "start";
+      spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
+    } else {
+      log.info(`Open: ${url}`);
+      return;
+    }
+    log.success(`Opened ${url}`);
+  } catch (err) {
+    die2(`Failed to open app: ${err.message}`);
+  }
+});
+
+// src/commands/ssh.ts
+import { Command as Command14 } from "commander";
+import { WebSocket as WebSocket2 } from "ws";
+var sshCommand = new Command14("ssh").description("Open a shell in a running pod").argument("<name>", "App name").option("-s, --service <service>", "Service name (defaults to first)").action(async (name, opts) => {
+  if (!configExists()) die2("No CLI config. Run: cloudgrid init");
+  const config = loadConfig();
+  const baseUrl = config.api_url.replace(/^http/, "ws");
+  const serviceParam = opts.service ? `?service=${encodeURIComponent(opts.service)}` : "";
+  const wsUrl = `${baseUrl}/apps/${name}/exec${serviceParam}`;
+  const headers = {};
+  if (config.jwt) {
+    headers["authorization"] = `Bearer ${config.jwt}`;
+  }
+  const ws = new WebSocket2(wsUrl, { headers });
+  ws.on("open", () => {
+    log.info(`Connected to ${name}${opts.service ? `/${opts.service}` : ""}. Type 'exit' to disconnect.
+`);
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode(true);
+    }
+    process.stdin.resume();
+    process.stdin.on("data", (data) => {
+      if (ws.readyState === ws.OPEN) ws.send(data);
+    });
+  });
+  ws.on("message", (data) => {
+    process.stdout.write(data);
+  });
+  ws.on("close", () => {
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode(false);
+    }
+    process.stdin.pause();
+    console.log("\nDisconnected.");
+    process.exit(0);
+  });
+  ws.on("error", (err) => {
+    die2(`Connection failed: ${err.message}`);
+  });
+});
+
+// src/commands/login.ts
+import { Command as Command15 } from "commander";
+import { randomUUID } from "crypto";
+import { execSync as execSync3 } from "child_process";
+var loginCommand = new Command15("login").description("Authenticate with Google").action(async () => {
+  let config;
+  if (configExists()) {
+    config = loadConfig();
+  } else {
+    const defaults = detectConfig();
+    config = {
+      api_url: defaults.api_url || "https://api.cloudgrid.io",
+      registry: defaults.registry || "",
+      domain: defaults.domain || "cloudgrid.io"
+    };
+  }
+  const apiUrl = config.api_url;
+  const sessionCode = randomUUID();
+  const loginUrl = `${apiUrl}/auth/login?code=${sessionCode}`;
+  log.info("Opening browser for Google authentication...");
+  try {
+    const platform = process.platform;
+    if (platform === "darwin") execSync3(`open "${loginUrl}"`);
+    else if (platform === "linux") execSync3(`xdg-open "${loginUrl}"`);
+    else if (platform === "win32") execSync3(`start "${loginUrl}"`);
+    else log.info(`Open this URL: ${loginUrl}`);
+  } catch {
+    log.info(`Open this URL: ${loginUrl}`);
+  }
+  log.info("Waiting for authentication...");
+  const maxAttempts = 150;
+  for (let i = 0; i < maxAttempts; i++) {
+    await new Promise((r) => setTimeout(r, 2e3));
+    try {
+      const res = await fetch(`${apiUrl}/auth/status?code=${sessionCode}`);
+      const data = await res.json();
+      if (data.status === "authenticated" && data.jwt) {
+        const fullConfig = { ...config, jwt: data.jwt };
+        saveConfig(fullConfig);
+        const payload = JSON.parse(
+          Buffer.from(data.jwt.split(".")[1], "base64").toString()
+        );
+        log.success(`Logged in as ${payload.email} (${payload.role})`);
+        return;
+      }
+      if (data.status === "expired") {
+        die2("Authentication timed out. Run `cloudgrid login` to try again.");
+      }
+    } catch {
+    }
+  }
+  die2("Authentication timed out. Run `cloudgrid login` to try again.");
+});
+
+// src/commands/logout.ts
+import { Command as Command16 } from "commander";
+var logoutCommand = new Command16("logout").description("Log out of Cloud Grid").action(async () => {
+  if (!configExists()) die2("Not logged in.");
+  const config = loadConfig();
+  delete config.jwt;
+  saveConfig(config);
+  log.success("Logged out. Run `cloudgrid login` to authenticate.");
+});
+
+// src/commands/admin.ts
+import { Command as Command17 } from "commander";
+var adminCommand = new Command17("admin").description("Admin commands (invite, users, revoke)");
+adminCommand.command("invite <email>").description("Invite a user").requiredOption("--role <role>", "Role: admin, developer, or viewer").action(async (email, opts) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  const apiClient = createApiClient();
+  try {
+    await apiClient.request("POST", "/admin/invite", { email, role: opts.role });
+    log.success(`Invited ${email} as ${opts.role}`);
+  } catch (err) {
+    die2(`Failed to invite: ${err.message}`);
+  }
+});
+adminCommand.command("users").description("List all users").action(async () => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  const apiClient = createApiClient();
+  try {
+    const result = await apiClient.request("GET", "/admin/users");
+    console.log("\n  USERS");
+    console.log("  " + "-".repeat(60));
+    for (const u of result.users) {
+      const status = u.last_login ? u.role : `${u.role} (pending)`;
+      console.log(`  ${u.email.padEnd(30)} ${status.padEnd(20)} ${u.created_at?.slice(0, 10) || ""}`);
+    }
+    console.log("");
+  } catch (err) {
+    die2(`Failed to list users: ${err.message}`);
+  }
+});
+adminCommand.command("revoke <email>").description("Revoke user access").action(async (email) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  const apiClient = createApiClient();
+  try {
+    await apiClient.request("DELETE", `/admin/users/${encodeURIComponent(email)}`);
+    log.success(`Revoked access for ${email}`);
+  } catch (err) {
+    die2(`Failed to revoke: ${err.message}`);
+  }
+});
+
+// src/commands/secrets.ts
+import { Command as Command18 } from "commander";
+import { existsSync as existsSync15, readFileSync as readFileSync7 } from "fs";
+var secretsCommand = new Command18("secrets").description("Manage app secrets");
+secretsCommand.command("set <name> [pairs...]").description("Set secrets (KEY=VALUE)").action(async (name, pairs) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  if (!pairs.length) die2("Specify at least one KEY=VALUE pair");
+  const values = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) die2(`Invalid format: '${pair}'. Use KEY=VALUE`);
+    values[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  try {
+    const result = await createApiClient().setSecrets(name, values);
+    log.success(`Set ${result.keys.length} secret(s). Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+secretsCommand.command("list <name>").description("List secret names").action(async (name) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  try {
+    const result = await createApiClient().listSecrets(name);
+    if (result.secrets.length === 0) {
+      log.info("No secrets set.");
+      return;
+    }
+    console.log("\n  SECRETS");
+    console.log("  " + "-".repeat(40));
+    for (const s of result.secrets) console.log(`  ${s.key}`);
+    console.log("");
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+secretsCommand.command("get <name> <key>").description("Show partial reveal of a secret").action(async (name, key) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  try {
+    const result = await createApiClient().getSecret(name, key);
+    console.log(`
+  ${result.key}: ${result.preview}
+`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+secretsCommand.command("remove <name> <key>").description("Remove a secret").action(async (name, key) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  try {
+    await createApiClient().removeSecret(name, key);
+    log.success(`Removed secret '${key}'. Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+secretsCommand.command("import <name> <file>").description("Import secrets from .env file").action(async (name, file) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  if (!existsSync15(file)) die2(`File not found: ${file}`);
+  const values = parseEnvFile(readFileSync7(file, "utf-8"));
+  if (Object.keys(values).length === 0) die2("No valid KEY=VALUE pairs found");
+  try {
+    const result = await createApiClient().setSecrets(name, values);
+    log.success(`Imported ${result.keys.length} secret(s). Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+
+// src/commands/env-cmd.ts
+import { Command as Command19 } from "commander";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
+var envCommand = new Command19("env").description("Manage app environment variables");
+envCommand.command("set <name> [pairs...]").description("Set env vars (KEY=VALUE)").action(async (name, pairs) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  if (!pairs.length) die2("Specify at least one KEY=VALUE pair");
+  const values = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) die2(`Invalid format: '${pair}'. Use KEY=VALUE`);
+    values[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  try {
+    const result = await createApiClient().setEnv(name, values);
+    log.success(`Set ${result.keys.length} env var(s). Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+envCommand.command("list <name>").description("List env vars (key=value)").action(async (name) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  try {
+    const result = await createApiClient().listEnv(name);
+    if (result.env.length === 0) {
+      log.info("No env vars set.");
+      return;
+    }
+    console.log("\n  ENV");
+    console.log("  " + "-".repeat(50));
+    for (const e of result.env) console.log(`  ${e.key}=${e.value}`);
+    console.log("");
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+envCommand.command("remove <name> <key>").description("Remove an env var").action(async (name, key) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  try {
+    await createApiClient().removeEnv(name, key);
+    log.success(`Removed '${key}'. Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+envCommand.command("import <name> <file>").description("Import env vars from .env file").action(async (name, file) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  if (!existsSync16(file)) die2(`File not found: ${file}`);
+  const values = parseEnvFile(readFileSync8(file, "utf-8"));
+  if (Object.keys(values).length === 0) die2("No valid KEY=VALUE pairs found");
+  try {
+    const result = await createApiClient().setEnv(name, values);
+    log.success(`Imported ${result.keys.length} env var(s). Pods restarting.`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+
+// src/commands/usage.ts
+import { Command as Command20 } from "commander";
+import { existsSync as existsSync17 } from "fs";
+var usageCommand = new Command20("usage").description("Show AI usage for an app").argument("[name]", "App name (defaults to current directory)").action(async (name) => {
+  if (!configExists()) die2("Run: cloudgrid login");
+  const appName = name || (existsSync17("cloudgrid.yaml") ? loadCloudGridYaml(process.cwd()).name : null);
+  if (!appName) die2("Specify app name or run from a directory with cloudgrid.yaml");
+  const apiClient = createApiClient();
+  try {
+    const usage = await apiClient.getUsage(appName);
+    const models = usage.models || {};
+    const month = usage.month || (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
+    console.log(`
+  AI USAGE \u2014 ${appName} (${month})
+`);
+    if (!usage.total_requests || usage.total_requests === 0) {
+      log.info("No AI usage this month.");
+      return;
+    }
+    console.log("  MODEL              REQUESTS   TOKENS       EST. COST");
+    console.log("  " + "-".repeat(58));
+    for (const [model, data] of Object.entries(models)) {
+      const tokens = (data.input_tokens || 0) + (data.output_tokens || 0);
+      const cost = (data.estimated_cost_usd || 0).toFixed(2);
+      console.log(`  ${model.padEnd(20)} ${String(data.requests || 0).padEnd(10)} ${String(tokens).padEnd(12)} $${cost}`);
+    }
+    const totalCost = Object.values(models).reduce((sum, m) => sum + (m.estimated_cost_usd || 0), 0);
+    console.log("  " + "-".repeat(58));
+    console.log(`  Total: ${usage.total_requests} requests | ${usage.total_tokens} tokens | $${totalCost.toFixed(2)}
+`);
+  } catch (err) {
+    die2(`Failed: ${err.message}`);
+  }
+});
+
+// src/index.ts
+var __dirname = dirname2(fileURLToPath2(import.meta.url));
+var pkg = JSON.parse(readFileSync9(join9(__dirname, "../package.json"), "utf-8"));
+var program = new Command21();
+program.name("cloudgrid").description("Deploy apps with a single YAML file").version(pkg.version).option("-v, --verbose", "Show detailed output");
+program.hook("preAction", (_thisCommand, _actionCommand) => {
+  const opts = program.opts();
+  if (opts.verbose) setVerbose(true);
+});
+program.addCommand(initCommand);
+program.addCommand(createCommand);
+program.addCommand(devCommand);
+program.addCommand(deployCommand);
+program.addCommand(listCommand);
+program.addCommand(removeCommand);
+program.addCommand(logsCommand);
+program.addCommand(statusCommand);
+program.addCommand(doctorCommand);
+program.addCommand(connectCommand);
+program.addCommand(disconnectCommand);
+program.addCommand(buildsCommand);
+program.addCommand(openCommand);
+program.addCommand(sshCommand);
+program.addCommand(loginCommand);
+program.addCommand(logoutCommand);
+program.addCommand(adminCommand);
+program.addCommand(secretsCommand);
+program.addCommand(envCommand);
+program.addCommand(usageCommand);
+if (process.argv.includes("--verbose") || process.argv.includes("-v")) {
+  setVerbose(true);
+}
+try {
+  await program.parseAsync();
+} catch (e) {
+  if (e instanceof CloudGridError) process.exit(1);
+  if (isVerbose()) {
+    console.error(e);
+  } else if (e instanceof Error) {
+    console.error(`Error: ${e.message}`);
+  }
+  process.exit(1);
+}
+//# sourceMappingURL=index.js.map